diff --git a/docs-site/src/content/docs/reference/cli/providers-accounts.md b/docs-site/src/content/docs/reference/cli/providers-accounts.md
index f4ba4e6f112..ba5e4187e0d 100644
--- a/docs-site/src/content/docs/reference/cli/providers-accounts.md
+++ b/docs-site/src/content/docs/reference/cli/providers-accounts.md
@@ -795,7 +795,9 @@ Clear the manual Codex account selection without resolving an account id, so it
 
 ### `ocx account pause|resume <provider> <id|alias|main> [--json]`
 
-Pause or resume one account in the Codex, Anthropic, or generic OAuth provider pool, including
+Accounts paused by the opt-in [per-provider auto-pause policy](/reference/configuration/providers/#auto-pause-permanently-refused-accounts) use the same commands. Listing shows the fixed pause reason; resume clears it.
+
+Pause or resume one account in the Codex, Anthropic, generic OAuth, or API-key provider pool, including
 `google-antigravity`. For the Codex pool, `main` identifies only the built-in Codex account;
 OAuth accounts must be identified by id or a unique alias. A paused OAuth account
 is excluded from request selection, 429 failover, and proactive token refresh, and cannot be
diff --git a/docs-site/src/content/docs/reference/configuration/providers.md b/docs-site/src/content/docs/reference/configuration/providers.md
index 12ccbf51df1..3752356b52e 100644
--- a/docs-site/src/content/docs/reference/configuration/providers.md
+++ b/docs-site/src/content/docs/reference/configuration/providers.md
@@ -1904,3 +1904,42 @@ original reasoning. Other model families require the preserve declaration.
 Tool-enabled DeepSeek requests also require reasoning on earlier assistant answers without tool
 calls. The configured placeholder fills these omissions; no original reasoning can be recovered
 from the tool-call cache for those turns. Preserve their supplied reasoning for full fidelity.
+
+## Auto-pause permanently refused accounts
+
+`providers.<provider>.accountAutoPause` is opt-in and defaults to off. It applies to that
+provider's OAuth accounts, Codex pool accounts (including the main account in pool mode),
+and configured API-key pool entries. For example:
+
+```sh
+ocx config set providers.anthropic.accountAutoPause.enabled true
+ocx config set providers.anthropic.accountAutoPause.consecutiveFailures 2
+```
+
+`consecutiveFailures` is an integer from 1 to 100; omitting it uses 2. Only exact,
+account-scoped HTTP 401/403 refusals qualify: an organization forbidding OAuth, an inactive
+or expired subscription, an account denied API/Claude Code access, or a downgrade to a free
+plan with no credits. A model permission error, expired access token, quota window, 429,
+5xx, malformed response or network failure never pauses an account.
+
+The counter is process-local, serialized per account, and resets on a successful HTTP
+response, explicit resume or a new login. Token refresh alone does not reset an OAuth
+account's streak. Transient errors leave the counter unchanged. Restarting the proxy clears
+counters; completed pauses, their fixed reason codes and timestamps persist. Independent
+proxy processes maintain independent counters. Changing, disabling or re-enabling the policy, disabling the provider,
+or changing its endpoint discards in-flight refusal observations, so a refusal from a request
+sent under the earlier policy can never pause an account afterwards. A refusal counts only for the credential that actually
+reached the upstream: when a local plugin rewrites the credential or destination of a send, that
+send never counts toward a pause. For Codex pool accounts this includes the workspace
+(`chatgpt-account-id`) the request was sent for.
+
+At the threshold, OpenCodex excludes the account using its existing pause mechanism and
+attempts an eligible sibling for the current request within the existing retry/send budget.
+Fixed Codex account selectors and account-bound uploaded files retain their restrictions.
+A pause never cancels already dispatched work or changes credentials. It emits one generic
+log line without account identifiers or upstream error text.
+
+`ocx account list <provider>` shows the pause reason. The dashboard's Paused badge exposes
+the reason and time. Use `ocx account resume <provider> <account-id-or-alias>` to clear the
+reason and allow selection again. On an API-key row, clicking Resume also activates the key.
+This policy never resumes an account automatically.
diff --git a/gui/src/account-pause-display.ts b/gui/src/account-pause-display.ts
new file mode 100644
index 00000000000..3a656bfe89d
--- /dev/null
+++ b/gui/src/account-pause-display.ts
@@ -0,0 +1,20 @@
+import type { AccountPauseReason } from "../../src/types/account-auto-pause";
+import type { Locale, TFn, TKey } from "./i18n/shared";
+
+const REASON_KEYS = {
+  oauth_organization_disabled: "accountPause.reason.organizationDisabled",
+  account_permission_denied: "accountPause.reason.permissionDenied",
+  subscription_inactive: "accountPause.reason.subscriptionInactive",
+  subscription_expired: "accountPause.reason.subscriptionExpired",
+  plan_downgraded: "accountPause.reason.planDowngraded",
+} satisfies Record<AccountPauseReason, TKey>;
+
+/** Display fixed reason labels and timestamps in the selected dashboard language. */
+export function formatAccountPauseTooltip(
+  t: TFn, locale: Locale, details: { reason: string; pausedAt: number },
+): string {
+  const reason = Object.hasOwn(REASON_KEYS, details.reason)
+    ? t(REASON_KEYS[details.reason as AccountPauseReason]) : t("codexAuth.paused");
+  const date = new Date(details.pausedAt);
+  return Number.isNaN(date.getTime()) ? reason : t("accountPause.tooltip", { reason, date: date.toLocaleString(locale) });
+}
diff --git a/gui/src/components/codex-account-pool-cards.tsx b/gui/src/components/codex-account-pool-cards.tsx
index e607afbf1bf..d6d015dff1b 100644
--- a/gui/src/components/codex-account-pool-cards.tsx
+++ b/gui/src/components/codex-account-pool-cards.tsx
@@ -1,4 +1,5 @@
 import { useState } from "react";
+import { formatAccountPauseTooltip } from "../account-pause-display";
 import { useT, useI18n } from "../i18n/shared";
 import { useCopyFeedback } from "./use-copy-feedback";
 import { IconAlert, IconPause, IconPlay, IconX } from "../icons";
@@ -118,7 +119,7 @@ export function CodexAccountPoolCards({
                 </span>
               )}
               {a.paused && (
-                <span className="badge badge-muted" title={t("codexAuth.pausedHint")}>
+                <span className="badge badge-muted" title={a.pauseDetails ? formatAccountPauseTooltip(t, locale, a.pauseDetails) : t("codexAuth.pausedHint")}>
                   {t("codexAuth.paused")}
                 </span>
               )}
diff --git a/gui/src/components/provider-workspace/ProviderAuthPanel.tsx b/gui/src/components/provider-workspace/ProviderAuthPanel.tsx
index e21f627d5e5..d6f6b0c833c 100644
--- a/gui/src/components/provider-workspace/ProviderAuthPanel.tsx
+++ b/gui/src/components/provider-workspace/ProviderAuthPanel.tsx
@@ -5,7 +5,8 @@ import { anthropicInstanceRowShapeMatches, isAnthropicInstanceId } from "../../.
  * handlers via props-down; no internal auth machinery.
  */
 import { useEffect, useMemo, useRef, useState } from "react";
-import { useT } from "../../i18n/shared";
+import { useT, useI18n } from "../../i18n/shared";
+import { formatAccountPauseTooltip } from "../../account-pause-display";
 import { IconLock, IconRefresh, IconTrash } from "../../icons";
 import type { WorkspaceItem } from "../../provider-workspace/catalog";
 import { oauthAccountDisplayLabel, providerAuthSurface } from "../../provider-workspace/auth";
@@ -201,6 +202,7 @@ export default function ProviderAuthPanel({
   codexController?: CodexAccountPoolController;
 }) {
   const t = useT();
+  const { locale } = useI18n();
   const [addingKey, setAddingKey] = useState(false);
   const [kiroChooser, setKiroChooser] = useState<{ addAccount: boolean } | null>(null);
   const kiroLoginTriggerRef = useRef<HTMLButtonElement>(null);
@@ -589,7 +591,7 @@ export default function ProviderAuthPanel({
                       )}
                       {showReauth && !healthLabel && <span className="badge badge-amber">{t("pws.reauth")}</span>}
                       {kiroSkipReasonKey(account, item.name) && <span className="badge badge-amber">{t(kiroSkipReasonKey(account, item.name)!)}</span>}
-                      {account.paused && <span className="badge badge-muted">{t("codexAuth.paused")}</span>}
+                      {account.paused && <span className="badge badge-muted" title={account.pauseDetails ? formatAccountPauseTooltip(t, locale, account.pauseDetails) : undefined}>{t("codexAuth.paused")}</span>}
                       {account.active && !account.paused && <span className="badge badge-primary">{t("prov.accountActive")}</span>}
                       {switching && <span className="badge badge-muted">{t("pws.accountSwitching")}</span>}
                     </button>
@@ -722,13 +724,14 @@ export default function ProviderAuthPanel({
                     <div className={`pwi-auth-row${entry.active ? " pwi-auth-row--active" : ""}`}>
                     <button type="button" className="pwi-auth-row-main"
                       onClick={() => void authHandlers.onSwitchApiKey(item.name, entry)}
-                      disabled={entry.active}>
+                      disabled={entry.active && !entry.disabled} aria-label={entry.disabled ? `${t("codexAuth.resume")} — ${entry.label ?? entry.masked}` : undefined}>
                       <span className={`pwi-auth-dot ${entry.active ? "pwi-auth-dot--ok" : "pwi-auth-dot--off"}`} aria-hidden="true" />
                       <span className="pwi-auth-row-copy">
                         <span className="pwi-auth-row-label">{entry.label ?? entry.masked}</span>
                         {entry.label && <code className="pwi-auth-row-secondary">{entry.masked} · {t("prov.accountId")}: {entry.id}</code>}
                       </span>
-                      {entry.active && <span className="badge badge-primary">{t("prov.accountActive")}</span>}
+                      {entry.disabled && <span className="badge badge-muted" title={entry.pauseDetails ? formatAccountPauseTooltip(t, locale, entry.pauseDetails) : undefined}>{t("codexAuth.paused")} · {t("codexAuth.resume")}</span>}
+                      {entry.active && !entry.disabled && <span className="badge badge-primary">{t("prov.accountActive")}</span>}
                     </button>
                     <button type="button" className="btn btn-ghost btn-sm"
                       onClick={() => void authHandlers.onEditAlias(item.name, "api-key", entry.id, entry.label)}>
diff --git a/gui/src/components/provider-workspace/types.ts b/gui/src/components/provider-workspace/types.ts
index cab52acd928..09933657ee3 100644
--- a/gui/src/components/provider-workspace/types.ts
+++ b/gui/src/components/provider-workspace/types.ts
@@ -62,6 +62,7 @@ export type OAuthAccountRow = AccountQuotaReading & {
   autoSelectable?: boolean;
   skipReason?: "needs_reauth" | "paused" | "suspended" | "cooldown" | "quota_exhausted";
   paused?: boolean;
+  pauseDetails?: { reason: string; pausedAt: number };
   autoSwitchThresholdOverride?: number | null;
   autoSwitchThreshold?: number;
   effectiveAutoSwitchThreshold?: number;
@@ -73,6 +74,8 @@ export type OAuthAccountRow = AccountQuotaReading & {
 };
 
 export type ApiKeyRow = AccountQuotaReading & {
+  disabled?: boolean;
+  pauseDetails?: { reason: string; pausedAt: number };
   id: string;
   label?: string;
   masked: string;
diff --git a/gui/src/hooks/useCodexAccountPool.ts b/gui/src/hooks/useCodexAccountPool.ts
index a529ad28a03..4ceff38fc9e 100644
--- a/gui/src/hooks/useCodexAccountPool.ts
+++ b/gui/src/hooks/useCodexAccountPool.ts
@@ -69,6 +69,7 @@ export interface CodexAccountEntry {
   isMain: boolean;
   /** Persisted routing exclusion. Paused accounts remain visible but cannot be selected. */
   paused: boolean;
+  pauseDetails?: { reason: string; pausedAt: number };
   /** Selection order; higher is used earlier. Always present, 0 when unset. */
   priority: number;
   /** Null inherits global threshold; 0 disables usage-driven switching for this account. */
diff --git a/gui/src/hooks/useProviderAccountPools.ts b/gui/src/hooks/useProviderAccountPools.ts
index 49782cb7605..81011166529 100644
--- a/gui/src/hooks/useProviderAccountPools.ts
+++ b/gui/src/hooks/useProviderAccountPools.ts
@@ -23,6 +23,7 @@ export interface OAuthAccount extends AccountQuotaReading {
   autoSelectable?: boolean;
   skipReason?: "needs_reauth" | "paused" | "suspended" | "cooldown" | "quota_exhausted";
   paused?: boolean;
+  pauseDetails?: { reason: string; pausedAt: number };
   autoSwitchThresholdOverride?: number | null;
   autoSwitchThreshold?: number;
   effectiveAutoSwitchThreshold?: number;
@@ -33,7 +34,7 @@ export interface OAuthAccount extends AccountQuotaReading {
   healthSummary?: string;
   healthAction?: string;
 }
-export interface ApiKeyEntry extends AccountQuotaReading { id: string; label?: string; masked: string; active: boolean }
+export interface ApiKeyEntry extends AccountQuotaReading { id: string; label?: string; masked: string; active: boolean; disabled?: boolean; pauseDetails?: { reason: string; pausedAt: number } }
 export interface AccountSelectionTarget { provider: string; kind: "oauth" | "api-key" }
 
 function selectionRows<T extends { id: string; active: boolean }>(rows: T[], id: string | null | undefined): T[] {
@@ -549,17 +550,24 @@ export function useProviderAccountPools(deps: {
   };
 
   const switchApiKey = async (provider: string, entry: ApiKeyEntry) => {
-    if (entry.active || selectionMutationsRef.current.has(`key:${provider}`)) return;
+    if (entry.active && !entry.disabled || selectionMutationsRef.current.has(`key:${provider}`)) return;
     const key = invalidateSelectionReads(provider, "api-key");
     const mutation = Symbol();
     selectionMutationsRef.current.set(key, mutation);
     const currentMutation = () => aliveRef.current && mountedRef.current && serverRef.current === apiBase && selectionMutationsRef.current.get(key) === mutation;
+    let resumed = false;
     try {
+      if (entry.disabled) {
+        const resumeResponse = await fetch(`${apiBase}/api/providers/keys/pause`, { method: "PUT", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ name: provider, id: entry.id, paused: false }) });
+        if (!currentMutation()) return;
+        if (!resumeResponse.ok) { notify(t("prov.keySwitchFail"), false); return; }
+        resumed = true;
+      }
       const res = await fetch(`${apiBase}/api/providers/keys/active`, { method: "PUT", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ name: provider, id: entry.id }) });
       if (!currentMutation()) return;
       if (!res.ok) {
         const failure = await res.json().catch(() => ({})) as { error?: string };
-        if (currentMutation()) notify(failure.error || t("prov.keySwitchFail"), false);
+        if (currentMutation()) notify(resumed ? t("prov.keyResumedSwitchFailed") : failure.error || t("prov.keySwitchFail"), false);
         return;
       }
       const data = await res.json().catch(() => ({})) as { activeId?: string | null };
@@ -570,7 +578,7 @@ export function useProviderAccountPools(deps: {
       notify(t("prov.keySwitched", { key: entry.label ?? entry.masked }), true);
       void fetchProviderQuotas(true);
     } catch {
-      if (currentMutation()) notify(t("prov.keySwitchFail"), false);
+      if (currentMutation()) notify(t(resumed ? "prov.keyResumedSwitchFailed" : "prov.keySwitchFail"), false);
     } finally {
       if (currentMutation()) {
         invalidateSelectionReads(provider, "api-key");
diff --git a/gui/src/i18n/de.ts b/gui/src/i18n/de.ts
index 22c5edac19d..184afc5e096 100644
--- a/gui/src/i18n/de.ts
+++ b/gui/src/i18n/de.ts
@@ -1977,6 +1977,13 @@ export const de: Record<TKey, string> = {
   "codexAuth.resumeSucceeded": "{email} ist wieder im Pool verfügbar",
   "codexAuth.pauseFailed": "{email} konnte nicht pausiert werden. Es wurde nichts geändert.",
   "codexAuth.resumeFailed": "{email} konnte nicht fortgesetzt werden. Es wurde nichts geändert.",
+  "accountPause.tooltip": "{reason} · {date}",
+  "accountPause.reason.organizationDisabled": "Organisation deaktiviert",
+  "accountPause.reason.permissionDenied": "Kontoberechtigung verweigert",
+  "accountPause.reason.subscriptionInactive": "Abonnement inaktiv",
+  "accountPause.reason.subscriptionExpired": "Abonnement abgelaufen",
+  "accountPause.reason.planDowngraded": "Tarif herabgestuft",
+  "prov.keyResumedSwitchFailed": "Schlüssel fortgesetzt, aber Aktivierung fehlgeschlagen. Der Schlüssel kann automatisch ausgewählt werden. Wählen Sie ihn erneut aus.",
   "codexAuth.pausedHint": "Bis zur Fortsetzung von automatischem Wechsel, Wiederholungen, Cooldown-Wiederherstellung und manueller Auswahl ausgeschlossen.",
   "codexAuth.creditsAfterLimit": "Credits nach dem Limit nutzen",
   "codexAuth.creditsAfterLimitHint": "Standardmäßig aus: Ein Konto, dessen Nutzungsfenster 100 % erreicht, wird bis zum Zurücksetzen ausgewechselt, sodass seine ChatGPT-Credits nicht verbraucht werden. Schalte ein Konto ein, damit es mit seinen Credits weiterarbeitet. Neue Konten starten ausgeschaltet.",
diff --git a/gui/src/i18n/en.ts b/gui/src/i18n/en.ts
index 350a21304ae..7c50d7f2831 100644
--- a/gui/src/i18n/en.ts
+++ b/gui/src/i18n/en.ts
@@ -2599,6 +2599,13 @@ export const en = {
   "codexAuth.resumeSucceeded": "{email} is available to the pool again",
   "codexAuth.pauseFailed": "Could not pause {email}. Nothing was changed.",
   "codexAuth.resumeFailed": "Could not resume {email}. Nothing was changed.",
+  "accountPause.tooltip": "{reason} · {date}",
+  "accountPause.reason.organizationDisabled": "Organization disabled",
+  "accountPause.reason.permissionDenied": "Account permission denied",
+  "accountPause.reason.subscriptionInactive": "Subscription inactive",
+  "accountPause.reason.subscriptionExpired": "Subscription expired",
+  "accountPause.reason.planDowngraded": "Plan downgraded",
+  "prov.keyResumedSwitchFailed": "Key resumed, but activation failed. The key is eligible for automatic selection. Try selecting it again.",
   "codexAuth.pausedHint": "Excluded from automatic switching, retries, cooldown recovery, and manual selection until resumed.",
   "codexAuth.creditsAfterLimit": "Use credits after limit",
   "codexAuth.creditsAfterLimitHint": "Off by default: an account whose usage window reaches 100% is switched out until it resets, so its ChatGPT credits are not spent. Turn an account on to let it keep working from its credits. New accounts start off.",
diff --git a/gui/src/i18n/fr.ts b/gui/src/i18n/fr.ts
index a17e39b0bd0..f0cd9d2b2ca 100644
--- a/gui/src/i18n/fr.ts
+++ b/gui/src/i18n/fr.ts
@@ -2526,6 +2526,13 @@ export const fr: Record<TKey, string> = {
   "codexAuth.resumeSucceeded": "{email} est de nouveau disponible dans le groupe",
   "codexAuth.pauseFailed": "Impossible de suspendre {email}. Aucune modification apportée.",
   "codexAuth.resumeFailed": "Impossible de réactiver {email}. Aucune modification apportée.",
+  "accountPause.tooltip": "{reason} · {date}",
+  "accountPause.reason.organizationDisabled": "Organisation désactivée",
+  "accountPause.reason.permissionDenied": "Accès au compte refusé",
+  "accountPause.reason.subscriptionInactive": "Abonnement inactif",
+  "accountPause.reason.subscriptionExpired": "Abonnement expiré",
+  "accountPause.reason.planDowngraded": "Offre rétrogradée",
+  "prov.keyResumedSwitchFailed": "Clé réactivée, mais la sélection a échoué. La clé peut être sélectionnée automatiquement. Essayez de la sélectionner à nouveau.",
   "codexAuth.pausedHint": "Exclu du changement automatique, des nouvelles tentatives, de la récupération après délai et de la sélection manuelle jusqu’à sa réactivation.",
   "codexAuth.creditsAfterLimit": "Utiliser les crédits après la limite",
   "codexAuth.creditsAfterLimitHint": "Désactivé par défaut : un compte dont une fenêtre d’utilisation atteint 100 % est remplacé jusqu’à sa réinitialisation, et ses crédits ChatGPT ne sont pas dépensés. Activez un compte pour qu’il continue avec ses crédits. Les nouveaux comptes démarrent désactivés.",
diff --git a/gui/src/i18n/ja.ts b/gui/src/i18n/ja.ts
index 08799fa8f3f..d6d55fd4a23 100644
--- a/gui/src/i18n/ja.ts
+++ b/gui/src/i18n/ja.ts
@@ -2421,6 +2421,13 @@ export const ja: Record<TKey, string> = {
   "codexAuth.resumeSucceeded": "{email} をアカウントプールに戻しました",
   "codexAuth.pauseFailed": "{email} を一時停止できませんでした。変更はありません。",
   "codexAuth.resumeFailed": "{email} を再開できませんでした。変更はありません。",
+  "accountPause.tooltip": "{reason} · {date}",
+  "accountPause.reason.organizationDisabled": "組織が無効",
+  "accountPause.reason.permissionDenied": "アカウントの権限が拒否されました",
+  "accountPause.reason.subscriptionInactive": "サブスクリプションが無効",
+  "accountPause.reason.subscriptionExpired": "サブスクリプションの期限切れ",
+  "accountPause.reason.planDowngraded": "プランがダウングレードされました",
+  "prov.keyResumedSwitchFailed": "キーの一時停止は解除されましたが、有効化に失敗しました。自動選択は可能です。もう一度選択してください。",
   "codexAuth.pausedHint": "再開するまで、自動切り替え、再試行、クールダウン復旧、手動選択の対象外です。",
   "codexAuth.creditsAfterLimit": "上限後にクレジットを使用",
   "codexAuth.creditsAfterLimitHint": "既定はオフです。使用量ウィンドウが100%に達したアカウントはリセットまで別のアカウントに切り替わり、ChatGPTクレジットを消費しません。オンにしたアカウントだけが上限後もクレジットで使われます。新しいアカウントはオフで始まります。",
diff --git a/gui/src/i18n/ko.ts b/gui/src/i18n/ko.ts
index 0781408ca97..af4a7427a0c 100644
--- a/gui/src/i18n/ko.ts
+++ b/gui/src/i18n/ko.ts
@@ -2021,6 +2021,13 @@ export const ko: Record<TKey, string> = {
   "codexAuth.resumeSucceeded": "{email} 계정을 풀에서 다시 사용할 수 있습니다",
   "codexAuth.pauseFailed": "{email} 계정을 일시 중지하지 못했습니다. 변경 사항이 없습니다.",
   "codexAuth.resumeFailed": "{email} 계정을 재개하지 못했습니다. 변경 사항이 없습니다.",
+  "accountPause.tooltip": "{reason} · {date}",
+  "accountPause.reason.organizationDisabled": "조직 비활성화",
+  "accountPause.reason.permissionDenied": "계정 권한 거부",
+  "accountPause.reason.subscriptionInactive": "구독 비활성",
+  "accountPause.reason.subscriptionExpired": "구독 만료",
+  "accountPause.reason.planDowngraded": "요금제 하향 변경",
+  "prov.keyResumedSwitchFailed": "키의 일시 중지는 해제했지만 활성화하지 못했습니다. 자동 선택은 가능합니다. 다시 선택해 주세요.",
   "codexAuth.pausedHint": "재개할 때까지 자동 전환, 재시도, 쿨다운 복구 및 수동 선택에서 제외됩니다.",
   "codexAuth.creditsAfterLimit": "한도 도달 후 크레딧 사용",
   "codexAuth.creditsAfterLimitHint": "기본은 꺼짐입니다. 사용량이 100%에 도달한 계정은 리셋될 때까지 다른 계정으로 전환되어 ChatGPT 크레딧을 쓰지 않습니다. 켠 계정만 한도 이후에도 크레딧으로 계속 사용됩니다. 새로 추가한 계정은 꺼진 상태로 시작합니다.",
diff --git a/gui/src/i18n/pt.ts b/gui/src/i18n/pt.ts
index 5d0f1dd1761..e9840564465 100644
--- a/gui/src/i18n/pt.ts
+++ b/gui/src/i18n/pt.ts
@@ -2572,6 +2572,13 @@ export const pt: Record<TKey, string> = {
   "codexAuth.resumeSucceeded": "{email} voltou a ficar disponível para o pool",
   "codexAuth.pauseFailed": "Não foi possível pausar {email}. Nada foi alterado.",
   "codexAuth.resumeFailed": "Não foi possível retomar {email}. Nada foi alterado.",
+  "accountPause.tooltip": "{reason} · {date}",
+  "accountPause.reason.organizationDisabled": "Organização desativada",
+  "accountPause.reason.permissionDenied": "Permissão da conta negada",
+  "accountPause.reason.subscriptionInactive": "Assinatura inativa",
+  "accountPause.reason.subscriptionExpired": "Assinatura expirada",
+  "accountPause.reason.planDowngraded": "Plano rebaixado",
+  "prov.keyResumedSwitchFailed": "A chave foi retomada, mas a ativação falhou. A chave está disponível para seleção automática. Tente selecioná-la novamente.",
   "codexAuth.pausedHint": "Excluída da troca automática, das novas tentativas, da recuperação de cooldown e da seleção manual até ser retomada.",
   "codexAuth.creditsAfterLimit": "Usar créditos após o limite",
   "codexAuth.creditsAfterLimitHint": "Desativado por padrão: uma conta cuja janela de uso chega a 100% é retirada de uso até a janela reiniciar, para que seus créditos do ChatGPT não sejam gastos. Ative em uma conta para que ela continue trabalhando com seus créditos. Contas novas começam desativadas.",
diff --git a/gui/src/i18n/ru.ts b/gui/src/i18n/ru.ts
index ad8863b0cce..c78eb9d8b72 100644
--- a/gui/src/i18n/ru.ts
+++ b/gui/src/i18n/ru.ts
@@ -2512,6 +2512,13 @@ export const ru: Record<TKey, string> = {
   "codexAuth.resumeSucceeded": "Аккаунт {email} снова доступен в пуле",
   "codexAuth.pauseFailed": "Не удалось приостановить {email}. Изменений нет.",
   "codexAuth.resumeFailed": "Не удалось возобновить {email}. Изменений нет.",
+  "accountPause.tooltip": "{reason} · {date}",
+  "accountPause.reason.organizationDisabled": "Организация отключена",
+  "accountPause.reason.permissionDenied": "Доступ к аккаунту запрещён",
+  "accountPause.reason.subscriptionInactive": "Подписка неактивна",
+  "accountPause.reason.subscriptionExpired": "Подписка истекла",
+  "accountPause.reason.planDowngraded": "Тариф понижен",
+  "prov.keyResumedSwitchFailed": "Ключ возобновлён, но активация не удалась. Ключ доступен для автоматического выбора. Попробуйте выбрать его снова.",
   "codexAuth.pausedHint": "До возобновления исключён из автоматического переключения, повторов, восстановления после задержки и ручного выбора.",
   "codexAuth.creditsAfterLimit": "Кредиты после лимита",
   "codexAuth.creditsAfterLimitHint": "По умолчанию выключено: аккаунт, у которого окно использования достигло 100%, заменяется до сброса, и его кредиты ChatGPT не тратятся. Включите эту настройку для аккаунта, чтобы он продолжал работать за счёт кредитов. Новые аккаунты начинают с выключенной настройкой.",
diff --git a/gui/src/i18n/tr.ts b/gui/src/i18n/tr.ts
index 147e954d1c9..f5babcc2e80 100644
--- a/gui/src/i18n/tr.ts
+++ b/gui/src/i18n/tr.ts
@@ -2550,6 +2550,13 @@ export const tr: Record<TKey, string> = {
   "codexAuth.resumeSucceeded": "{email} tekrar havuza alındı",
   "codexAuth.pauseFailed": "{email} duraklatılamadı.",
   "codexAuth.resumeFailed": "{email} devam ettirilemedi.",
+  "accountPause.tooltip": "{reason} · {date}",
+  "accountPause.reason.organizationDisabled": "Kuruluş devre dışı",
+  "accountPause.reason.permissionDenied": "Hesap izni reddedildi",
+  "accountPause.reason.subscriptionInactive": "Abonelik etkin değil",
+  "accountPause.reason.subscriptionExpired": "Abonelik süresi doldu",
+  "accountPause.reason.planDowngraded": "Plan düşürüldü",
+  "prov.keyResumedSwitchFailed": "Anahtarın duraklatılması kaldırıldı ancak etkinleştirme başarısız oldu. Anahtar otomatik olarak seçilebilir. Yeniden seçmeyi deneyin.",
   "codexAuth.pausedHint": "Devam ettirilene kadar otomatik seçimden hariç tutulur.",
   "codexAuth.creditsAfterLimit": "Limitten sonra kredi kullan",
   "codexAuth.creditsAfterLimitHint": "Varsayılan olarak kapalı: kullanım penceresi %100’e ulaşan hesap sıfırlanana kadar otomatik seçim dışında kalır ve ChatGPT kredileri harcanmaz. Bir hesabın kredileriyle çalışmaya devam etmesi için bu ayarı açın. Yeni hesaplar kapalı başlar.",
diff --git a/gui/src/i18n/vi.ts b/gui/src/i18n/vi.ts
index 18fa8b93963..b2c5f729ad0 100644
--- a/gui/src/i18n/vi.ts
+++ b/gui/src/i18n/vi.ts
@@ -2547,6 +2547,13 @@ export const vi: Record<TKey, string> = {
   "codexAuth.resumeSucceeded": "{email} đã có mặt lại trong pool",
   "codexAuth.pauseFailed": "Không thể ngưng {email}. Không có thay đổi nào.",
   "codexAuth.resumeFailed": "Không thể tiếp tục {email}. Không có thay đổi nào.",
+  "accountPause.tooltip": "{reason} · {date}",
+  "accountPause.reason.organizationDisabled": "Tổ chức đã bị vô hiệu hóa",
+  "accountPause.reason.permissionDenied": "Quyền truy cập tài khoản bị từ chối",
+  "accountPause.reason.subscriptionInactive": "Gói đăng ký không hoạt động",
+  "accountPause.reason.subscriptionExpired": "Gói đăng ký đã hết hạn",
+  "accountPause.reason.planDowngraded": "Gói đã bị hạ cấp",
+  "prov.keyResumedSwitchFailed": "Khóa đã được tiếp tục nhưng kích hoạt thất bại. Khóa có thể được chọn tự động. Hãy thử chọn lại.",
   "codexAuth.pausedHint": "Được loại trừ khỏi luân phiên tự động, thử lại, hồi phục sau thời gian chờ, và lựa chọn thủ công cho đến khi tiếp tục.",
   "codexAuth.creditsAfterLimit": "Dùng tín dụng sau giới hạn",
   "codexAuth.creditsAfterLimitHint": "Mặc định tắt: tài khoản có cửa sổ sử dụng đạt 100% sẽ được thay thế cho đến khi đặt lại, nên tín dụng ChatGPT của nó không bị tiêu. Bật một tài khoản để nó tiếp tục chạy bằng tín dụng. Tài khoản mới bắt đầu ở trạng thái tắt.",
diff --git a/gui/src/i18n/zh-TW.ts b/gui/src/i18n/zh-TW.ts
index 783ea79a4fc..fed5f3564f9 100644
--- a/gui/src/i18n/zh-TW.ts
+++ b/gui/src/i18n/zh-TW.ts
@@ -1929,6 +1929,13 @@ export const zhTW: Record<TKey, string> = {
   "codexAuth.resumeSucceeded": "{email} 已重新加入帳號池",
   "codexAuth.pauseFailed": "無法暫停 {email}，未做任何變更。",
   "codexAuth.resumeFailed": "無法恢復 {email}，未做任何變更。",
+  "accountPause.tooltip": "{reason} · {date}",
+  "accountPause.reason.organizationDisabled": "組織已停用",
+  "accountPause.reason.permissionDenied": "帳戶權限遭拒",
+  "accountPause.reason.subscriptionInactive": "訂閱未啟用",
+  "accountPause.reason.subscriptionExpired": "訂閱已到期",
+  "accountPause.reason.planDowngraded": "方案已降級",
+  "prov.keyResumedSwitchFailed": "金鑰已恢復，但啟用失敗。此金鑰可被自動選取，請嘗試重新選取。",
   "codexAuth.pausedHint": "恢復前不會參與自動切換、重試、冷卻恢復或手動選擇。",
   "codexAuth.creditsAfterLimit": "達到上限後使用額度",
   "codexAuth.creditsAfterLimitHint": "預設關閉：用量視窗達到 100% 的帳戶會被切換出去，直到重設，不消耗其 ChatGPT 額度。開啟某個帳戶後，它在達到上限後仍會使用額度繼續運作。新帳戶預設關閉。",
diff --git a/gui/src/i18n/zh.ts b/gui/src/i18n/zh.ts
index dacb18d70ea..9192f498b2f 100644
--- a/gui/src/i18n/zh.ts
+++ b/gui/src/i18n/zh.ts
@@ -1994,6 +1994,13 @@ export const zh: Record<TKey, string> = {
   "codexAuth.resumeSucceeded": "{email} 已重新加入账号池",
   "codexAuth.pauseFailed": "无法暂停 {email}，未做任何更改。",
   "codexAuth.resumeFailed": "无法恢复 {email}，未做任何更改。",
+  "accountPause.tooltip": "{reason} · {date}",
+  "accountPause.reason.organizationDisabled": "组织已停用",
+  "accountPause.reason.permissionDenied": "账户权限被拒绝",
+  "accountPause.reason.subscriptionInactive": "订阅未激活",
+  "accountPause.reason.subscriptionExpired": "订阅已过期",
+  "accountPause.reason.planDowngraded": "套餐已降级",
+  "prov.keyResumedSwitchFailed": "密钥已恢复，但激活失败。该密钥可被自动选择，请尝试重新选择。",
   "codexAuth.pausedHint": "恢复前不会参与自动切换、重试、冷却恢复或手动选择。",
   "codexAuth.creditsAfterLimit": "达到上限后使用额度",
   "codexAuth.creditsAfterLimitHint": "默认关闭：用量窗口达到 100% 的账户会被切换出去，直到重置，不消耗其 ChatGPT 额度。打开某个账户后，它在达到上限后仍会使用额度继续工作。新账户默认关闭。",
diff --git a/gui/tests/account-pause-display.test.tsx b/gui/tests/account-pause-display.test.tsx
new file mode 100644
index 00000000000..47fcf8ce490
--- /dev/null
+++ b/gui/tests/account-pause-display.test.tsx
@@ -0,0 +1,78 @@
+import { expect, test } from "bun:test";
+import { renderToStaticMarkup } from "react-dom/server";
+import type { ReactNode } from "react";
+import { Window } from "happy-dom";
+import ProviderAuthPanel from "../src/components/provider-workspace/ProviderAuthPanel";
+import { CodexAccountPoolCards } from "../src/components/codex-account-pool-cards";
+import type { ProviderAuthHandlers } from "../src/components/provider-workspace/types";
+import type { WorkspaceItem } from "../src/provider-workspace/catalog";
+import { I18nContext, DICTS, interpolate, LOCALES, type Locale, type TFn } from "../src/i18n/shared";
+import { formatAccountPauseTooltip } from "../src/account-pause-display";
+import { ACCOUNT_PAUSE_REASONS } from "../../src/types/account-auto-pause";
+
+const details = { reason: "subscription_expired", pausedAt: Date.UTC(2026, 0, 15, 13, 42) };
+const translator = (locale: Locale): TFn => (key, vars) => interpolate(DICTS[locale][key], vars);
+const handlers = {
+  onLogin() {}, onLogout() {}, onReauth() {}, onSwitchAccount() {}, onPauseAccount() {},
+  onRemoveAccount() {}, onAddApiKey: async () => true, onSwitchApiKey() {}, onRemoveApiKey() {}, onEditAlias() {},
+} satisfies ProviderAuthHandlers;
+
+function render(node: ReactNode, locale: Locale) {
+  const win = new Window();
+  win.document.body.innerHTML = renderToStaticMarkup(
+    <I18nContext.Provider value={{ locale, setLocale() {}, t: translator(locale) }}>{node}</I18nContext.Provider>,
+  );
+  return win;
+}
+
+test.each(LOCALES)("all pause reasons and partial-success copy exist in $code", ({ code }) => {
+  const t = translator(code);
+  for (const reason of ACCOUNT_PAUSE_REASONS) {
+    const text = formatAccountPauseTooltip(t, code, { ...details, reason });
+    expect(text).toContain(new Date(details.pausedAt).toLocaleString(code));
+    expect(text).not.toContain(reason);
+    expect(text).not.toStartWith(`${t("codexAuth.paused")} ·`);
+  }
+  expect(DICTS[code]["prov.keyResumedSwitchFailed"].length).toBeGreaterThan(20);
+});
+
+test.each(["fr", "ko"] as const)("provider OAuth and key tooltips use the app locale %s", locale => {
+  const t = translator(locale);
+  const expected = `${t("accountPause.reason.subscriptionExpired")} · ${new Date(details.pausedAt).toLocaleString(locale)}`;
+  for (const authMode of ["oauth", "key"] as const) {
+    const item = { name: "fixture", authMode, adapter: "openai", hasApiKey: authMode === "key" } as WorkspaceItem;
+    const win = render(<ProviderAuthPanel item={item} apiBase="" oauth={{ loggedIn: true }} authHandlers={handlers}
+      accounts={[{ id: "account-fixture", alias: "Reserve account", active: false, paused: true, pauseDetails: details }]}
+      keys={[{ id: "key-fixture", label: "Reserve key", masked: "****", active: false, disabled: true, pauseDetails: details }]} />, locale);
+    try {
+      expect(win.document.querySelector(".badge-muted[title]")?.getAttribute("title")).toBe(expected);
+      if (authMode === "key") {
+        expect(win.document.querySelector(".pwi-auth-row-main")?.getAttribute("aria-label"))
+          .toBe(`${t("codexAuth.resume")} — Reserve key`);
+      }
+    } finally { void win.happyDOM.close(); }
+  }
+});
+
+test("Codex tooltip shares the translated reason and app locale date", () => {
+  const locale = "fr";
+  const t = translator(locale);
+  const noop = () => {};
+  const win = render(<CodexAccountPoolCards
+    pool={[{ id: "fixture", email: "fixture@example.test", isMain: false, paused: true, pauseDetails: details,
+      priority: 0, autoSwitchThresholdOverride: null, hasCredential: true, quota: null }]}
+    activeId={null} accountModeState={null} switchActionLabel="Switch" threshold={0}
+    onOpenReset={noop} onSwitch={noop} onTogglePause={noop} pauseUpdatingId={null} pauseBusy={false}
+    onPriorityChange={noop} priorityUpdatingId={null} onAutoSwitchThresholdChange={async () => true}
+    autoSwitchDisabled={false} switchingId={null} onUnpin={noop} onReauth={noop} onEditAlias={noop} onRemove={noop}
+  />, locale);
+  try {
+    expect(win.document.querySelector(".badge-muted[title]")?.getAttribute("title"))
+      .toBe(`${t("accountPause.reason.subscriptionExpired")} · ${new Date(details.pausedAt).toLocaleString(locale)}`);
+  } finally { void win.happyDOM.close(); }
+});
+
+test("unknown display reasons use a translated pause label", () => {
+  expect(formatAccountPauseTooltip(translator("ko"), "ko", { reason: "future_reason", pausedAt: NaN }))
+    .toBe(DICTS.ko["codexAuth.paused"]);
+});
diff --git a/gui/tests/provider-account-pause-refresh.test.tsx b/gui/tests/provider-account-pause-refresh.test.tsx
index c5046f894b3..5c6f1b32fc0 100644
--- a/gui/tests/provider-account-pause-refresh.test.tsx
+++ b/gui/tests/provider-account-pause-refresh.test.tsx
@@ -206,3 +206,44 @@ test("a rejected save reports the pause failure and leaves the row unpaused", as
   expect(pools.accountSets.fixture.accounts.find(account => account.id === "b")?.paused).toBe(false);
   expect(notices).toEqual([{ key: "codexAuth.pauseFailed", ok: false }]);
 });
+
+test("paused key selection resumes before activation and refreshes the roster", async () => {
+  const entry = { id: "key-fixture", masked: "****", active: false, disabled: true, pauseDetails: { reason: "subscription_expired", pausedAt: 1 } };
+  const writes: Array<{ path: string; body: unknown }> = [];
+  respond = async (url, init) => {
+    if (init?.method === "PUT") { writes.push({ path: url, body: JSON.parse(String(init.body)) }); return Response.json({ activeId: entry.id }); }
+    return Response.json({ activeId: entry.id, keys: [{ ...entry, disabled: false, active: true, pauseDetails: undefined }] });
+  };
+  await act(async () => { pools.setKeyPools({ fixture: [entry] }); });
+  await act(async () => { await pools.switchApiKey("fixture", entry); });
+  expect(writes.map(row => row.path)).toEqual(["/pause-hook/api/providers/keys/pause", "/pause-hook/api/providers/keys/active"]);
+  expect(writes[0]!.body).toEqual({ name: "fixture", id: entry.id, paused: false });
+});
+
+test("a failed key resume never attempts activation", async () => {
+  const writes: string[] = [];
+  respond = async (url, init) => {
+    if (init?.method === "PUT") { writes.push(url); return new Response(null, { status: 503 }); }
+    return Response.json({ keys: [] });
+  };
+  await act(async () => { await pools.switchApiKey("fixture", { id: "key-fixture", masked: "****", active: false, disabled: true }); });
+  expect(writes).toEqual(["/pause-hook/api/providers/keys/pause"]);
+  expect(notices).toContainEqual({ key: "prov.keySwitchFail", ok: false });
+});
+
+test.each(["http", "transport"])("a resumed key reports partial success when activation fails via %s", async failure => {
+  const entry = { id: "key-fixture", masked: "****", active: false, disabled: true };
+  respond = async (url, init) => {
+    if (init?.method === "PUT" && url.endsWith("/active")) {
+      if (failure === "transport") throw new Error("fixture offline");
+      return Response.json({ error: "fixture activation refused" }, { status: 503 });
+    }
+    if (init?.method === "PUT") return Response.json({ ok: true });
+    return Response.json({ keys: [{ ...entry, disabled: false }] });
+  };
+  await act(async () => { pools.setKeyPools({ fixture: [entry] }); });
+  await act(async () => { await pools.switchApiKey("fixture", entry); });
+  expect(notices).toContainEqual({ key: "prov.keyResumedSwitchFailed", ok: false });
+  expect(notices.some(notice => notice.key === "prov.keySwitchFail")).toBe(false);
+  expect(pools.keyPools.fixture[0]?.disabled).toBe(false);
+});
diff --git a/scripts/test-layout/layout.json b/scripts/test-layout/layout.json
index ca9decdee3c..d1146330c9d 100644
--- a/scripts/test-layout/layout.json
+++ b/scripts/test-layout/layout.json
@@ -2,9 +2,9 @@
   "version": 1,
   "root": "tests",
   "explicitShards": ["layout-clients.json"],
-  "explicit": { "combo-description.test.ts": "routing", "combo-description-catalog.test.ts": "codex-integration", "codex-provider-routing.test.ts": "codex-integration", "config-native-reasoning-retention.test.ts": "config", "server-native-reasoning-retention-merge.test.ts": "server", "server-native-reasoning-retention.test.ts": "server", "responses-retained-reasoning-stream-recovery.test.ts": "responses", "openai-native-hosted-search-history.test.ts": "adapters/openai", "responses-native-compact-search-history.test.ts": "responses", "config-hosted-search-projection.test.ts": "config", "gcp-credential-boundary.test.ts": "adapters/google", "gcp-sa-marker.test.ts": "adapters/google", "gcp-sa-adapter.test.ts": "adapters/google", "management-gcp-credential-input.test.ts": "server", "codex-preserve-signed-in.test.ts": "codex-integration", "cli-account-preservation.test.ts": "cli", "service-state-isolation.test.ts": "service", "compaction-history-framing.test.ts": "responses", "catalog-native-max-context.test.ts": "codex-integration", "protocol-argon-thought-boundary.test.ts": "responses", "service-log.test.ts": "service", "messages-native-empty-inline.test.ts": "claude-integration", "catalog-auto-review-override.test.ts": "codex-integration", "management-auto-review-settings.test.ts": "server", "management-auto-review-auth.test.ts": "server", "prefer-model-alias-ids.test.ts": "server", "responses-mimo-envelope.test.ts": "responses", "responses-call-id-linkage.test.ts": "responses", "bridge-terminal-refusal.test.ts": "adapters", "loop-terminal-refusal.test.ts": "images", "web-search-terminal-refusal.test.ts": "web-search", "combo-terminal-refusal.test.ts": "routing", "server-terminal-refusal-wiring.test.ts": "server", "incomplete-reason-normalization.test.ts": "responses", "advisor-retention.test.ts": "advisor", "responses-native-key-cooldown.test.ts": "responses", "responses-run-turn-key-readmission.test.ts": "responses", "qoder-spawn-readmission.test.ts": "adapters", "api-key-selection-cooldown.test.ts": "providers", "server-chat-native-key-selection.test.ts": "server", "compact-key-selection.test.ts": "responses", "messages-native-key-selection.test.ts": "claude-integration",
+  "explicit": { "combo-description.test.ts": "routing", "combo-description-catalog.test.ts": "codex-integration", "codex-provider-routing.test.ts": "codex-integration", "config-native-reasoning-retention.test.ts": "config", "server-native-reasoning-retention-merge.test.ts": "server", "server-native-reasoning-retention.test.ts": "server", "responses-retained-reasoning-stream-recovery.test.ts": "responses", "openai-native-hosted-search-history.test.ts": "adapters/openai", "responses-native-compact-search-history.test.ts": "responses", "config-hosted-search-projection.test.ts": "config", "gcp-credential-boundary.test.ts": "adapters/google", "gcp-sa-marker.test.ts": "adapters/google", "gcp-sa-adapter.test.ts": "adapters/google", "management-gcp-credential-input.test.ts": "server", "codex-preserve-signed-in.test.ts": "codex-integration", "cli-account-preservation.test.ts": "cli", "service-state-isolation.test.ts": "service", "compaction-history-framing.test.ts": "responses", "catalog-native-max-context.test.ts": "codex-integration", "protocol-argon-thought-boundary.test.ts": "responses", "service-log.test.ts": "service", "messages-native-empty-inline.test.ts": "claude-integration", "catalog-auto-review-override.test.ts": "codex-integration", "management-auto-review-settings.test.ts": "server", "management-auto-review-auth.test.ts": "server", "prefer-model-alias-ids.test.ts": "server", "responses-mimo-envelope.test.ts": "responses", "responses-call-id-linkage.test.ts": "responses", "bridge-terminal-refusal.test.ts": "adapters", "loop-terminal-refusal.test.ts": "images", "web-search-terminal-refusal.test.ts": "web-search", "combo-terminal-refusal.test.ts": "routing", "server-terminal-refusal-wiring.test.ts": "server", "incomplete-reason-normalization.test.ts": "responses", "advisor-retention.test.ts": "advisor", "responses-native-key-cooldown.test.ts": "responses", "responses-run-turn-key-readmission.test.ts": "responses", "qoder-spawn-readmission.test.ts": "adapters", "api-key-selection-cooldown.test.ts": "providers", "api-key-auto-pause-distribution.test.ts": "providers", "server-chat-native-key-selection.test.ts": "server", "compact-key-selection.test.ts": "responses", "messages-native-key-selection.test.ts": "claude-integration",
     "owner-registry-isolation.test.ts": "config",
-    "codex-history-pending-wal.test.ts": "codex-integration", "responses-anthropic-billing-send-budget.test.ts": "responses", "anthropic-billing-ownership.test.ts": "adapters/anthropic", "server-anthropic-billing.test.ts": "server", "server-anthropic-billing-boundaries.test.ts": "server", "router-anthropic-billing-failover.test.ts": "routing", "anthropic-billing-refusal.test.ts": "adapters/anthropic", "messages-request-id-headers.test.ts": "claude-integration", "bounded-file-read.test.ts": "lib", "responses-undeclared-tool-guard-inbound.test.ts": "responses", "explicit-empty-tool-catalog.test.ts": "responses", "explicit-empty-tool-catalog-history.test.ts": "responses",
+    "responses-auto-pause-replay-owner.test.ts": "responses", "responses-account-auto-pause.test.ts": "responses", "oauth-account-auto-pause.test.ts": "oauth", "responses-account-auto-pause-wire-owner.test.ts": "responses", "oauth-upsert-paused-api-key.test.ts": "oauth", "management-account-auto-pause.test.ts": "server", "cli-account-key-pause.test.ts": "cli", "oauth-account-auto-pause-revision.test.ts": "oauth", "config-account-auto-pause-revisions.test.ts": "config", "codex-history-pending-wal.test.ts": "codex-integration", "responses-anthropic-billing-send-budget.test.ts": "responses", "anthropic-billing-ownership.test.ts": "adapters/anthropic", "server-anthropic-billing.test.ts": "server", "server-anthropic-billing-boundaries.test.ts": "server", "router-anthropic-billing-failover.test.ts": "routing", "anthropic-billing-refusal.test.ts": "adapters/anthropic", "messages-request-id-headers.test.ts": "claude-integration", "bounded-file-read.test.ts": "lib", "responses-undeclared-tool-guard-inbound.test.ts": "responses", "explicit-empty-tool-catalog.test.ts": "responses", "explicit-empty-tool-catalog-history.test.ts": "responses",
     "messages-request-id-endpoint.test.ts": "claude-integration",
     "anthropic-revoked-token.test.ts": "adapters/anthropic",
     "messages-revoked-token.test.ts": "claude-integration",
diff --git a/skills/ocx/references/01_surface_accounts.md b/skills/ocx/references/01_surface_accounts.md
index 51e20b04ce5..2afeea1ce6e 100644
--- a/skills/ocx/references/01_surface_accounts.md
+++ b/skills/ocx/references/01_surface_accounts.md
@@ -185,7 +185,7 @@ State-changing: yes. JSON mode: `payload`.
 
 Usage: `ocx account pause <provider> <account-id|alias|main> [--json]`
 
-Exclude one account in a Codex, Anthropic or supported generic OAuth pool from automatic selection.
+Exclude one account in a Codex, Anthropic, generic OAuth or API-key pool from automatic selection.
 
 State-changing: yes. JSON mode: `envelope`.
 
@@ -195,18 +195,20 @@ State-changing: yes. JSON mode: `envelope`.
 | PUT | `/api/codex-auth/accounts/pause` |
 | GET | `/api/oauth/accounts` |
 | PUT | `/api/oauth/accounts/pause` |
+| GET | `/api/providers/keys` |
+| PUT | `/api/providers/keys/pause` |
 
 | Flag | Value | Meaning |
 |---|---|---|
 | `--json` | boolean | Emit the pause result as JSON. |
 
-- Codex pause unbinds pinned threads and selects a fallback when possible; with no fallback, a paused-but-selected Codex account still receives requests. Anthropic and generic OAuth pause exclude the account from new requests, failover and refresh, and an all-paused pool answers 403. Credentials and health are preserved; already-sent turns are not cancelled.
+- Codex pause unbinds pinned threads and selects a fallback when possible; with no fallback, the paused account cannot dispatch until resumed. Anthropic and generic OAuth pause exclude the account from new requests, failover and refresh, and an all-paused pool answers 403. Credentials and health are preserved; already-sent turns are not cancelled.
 
 ### `ocx account resume`
 
 Usage: `ocx account resume <provider> <account-id|alias|main> [--json]`
 
-Return a paused account to a Codex, Anthropic or supported generic OAuth pool.
+Return a paused account to a Codex, Anthropic, generic OAuth or API-key pool.
 
 State-changing: yes. JSON mode: `envelope`.
 
@@ -216,6 +218,8 @@ State-changing: yes. JSON mode: `envelope`.
 | PUT | `/api/codex-auth/accounts/pause` |
 | GET | `/api/oauth/accounts` |
 | PUT | `/api/oauth/accounts/pause` |
+| GET | `/api/providers/keys` |
+| PUT | `/api/providers/keys/pause` |
 
 | Flag | Value | Meaning |
 |---|---|---|
diff --git a/src/adapters/google-http.ts b/src/adapters/google-http.ts
index 3b062e24bdc..ddce944901a 100644
--- a/src/adapters/google-http.ts
+++ b/src/adapters/google-http.ts
@@ -1,3 +1,4 @@
+import { inheritAccountAutoPauseResponse } from "../lib/account-auto-pause-response";
 import type { AdapterFetchContext, AdapterRequest } from "./base";
 import { createAdapterPhysicalSend } from "./physical-send";
 import type { SendClass } from "../lib/request-execution-budget";
@@ -38,10 +39,10 @@ async function normalizeFinalGoogleError(label: string, res: Response, signal?:
     const headers = new Headers(res.headers);
     headers.delete("content-encoding");
     headers.delete("content-length");
-    return new Response(safeGoogleHttpErrorMessage(label, res.status,
+    return inheritAccountAutoPauseResponse(res, new Response(safeGoogleHttpErrorMessage(label, res.status,
       body.displaySafe && !body.truncated ? body.text : ""), {
       status: res.status, statusText: res.statusText, headers,
-    });
+    }));
   }
   return normalizeUpstreamHttpErrorResponse(res, {
     signal,
diff --git a/src/adapters/upstream-http-error.ts b/src/adapters/upstream-http-error.ts
index f0627ceffe4..25b49e38c4b 100644
--- a/src/adapters/upstream-http-error.ts
+++ b/src/adapters/upstream-http-error.ts
@@ -1,3 +1,4 @@
+import { inheritAccountAutoPauseResponse } from "../lib/account-auto-pause-response";
 import { readBoundedResponseBody } from "../lib/bounded-body";
 import { redactSecretString } from "../lib/redact";
 
@@ -40,9 +41,9 @@ export async function normalizeUpstreamHttpErrorResponse(
   const headers = new Headers(res.headers);
   headers.delete("content-encoding");
   headers.delete("content-length");
-  return new Response(await opts.formatMessage(payloadText), {
+  return inheritAccountAutoPauseResponse(res, new Response(await opts.formatMessage(payloadText), {
     status: res.status,
     statusText: res.statusText,
     headers,
-  });
+  }));
 }
diff --git a/src/cli/account-api.ts b/src/cli/account-api.ts
index f0bff707be0..6ea43d96d9c 100644
--- a/src/cli/account-api.ts
+++ b/src/cli/account-api.ts
@@ -16,6 +16,7 @@ import { projectApiKeyQuotaRows } from "./account-key-quota";
 import { projectAccountHealth } from "./account-next-actions";
 import type { OAuthHealthLabel } from "../oauth/health";
 
+import { accountPauseDetailsSchema } from "../config/schema/account-auto-pause";
 export type AccountType = "codex" | "oauth" | "api-key";
 
 export interface AccountRow {
@@ -61,6 +62,7 @@ export interface AccountRow {
    * human listing (#2703).
    */
   paused?: boolean;
+  pauseDetails?: import("../types/account-auto-pause").AccountPauseDetails;
 }
 
 export type ClassifyResult = { type: AccountType } | { error: string };
@@ -342,6 +344,7 @@ interface CodexAccountDto {
   quota?: CodexQuotaDto | null;
   quotaRefresh?: unknown;
   paused?: boolean;
+  pauseDetails?: import("../types/account-auto-pause").AccountPauseDetails;
 }
 
 function projectQuota(quota: CodexQuotaDto | null | undefined): CodexQuotaDto | null {
@@ -415,6 +418,8 @@ export async function fetchCodexRows(
       ? a.autoSwitchThresholdOverride
       : null,
     paused: a.paused === true,
+    // Unknown display details are dropped defensively; the pause state above is retained.
+    pauseDetails: accountPauseDetailsSchema.safeParse(a.pauseDetails).data,
     ...(includeQuota ? {
       quota: projectQuota(a.quota),
       quotaRefresh: projectCodexQuotaRefreshOutcome(a.quotaRefresh),
@@ -432,6 +437,7 @@ interface OAuthAccountDto {
   healthLabel?: unknown;
   /** Present only for providers that support operator pause (generic OAuth pools). */
   paused?: boolean;
+  pauseDetails?: import("../types/account-auto-pause").AccountPauseDetails;
   autoSwitchThresholdOverride?: number | null;
   needsReauthReason?: "verify_account";
   autoSelectable?: boolean;
@@ -475,7 +481,8 @@ async function fetchOAuthRows(
     active: a.active ?? a.id === activeId,
     needsReauth: a.needsReauth,
     ...projectAccountHealth(a, name, a.id),
-    ...(a.paused === true ? { paused: true } : {}),
+    // Unknown display details are dropped defensively; paused remains authoritative.
+    ...(a.paused === true ? { paused: true, pauseDetails: accountPauseDetailsSchema.safeParse(a.pauseDetails).data } : {}),
     ...(isAnthropicOAuthInstance(name) && Object.hasOwn(a, "autoSwitchThresholdOverride") ? { autoSwitchThresholdOverride: a.autoSwitchThresholdOverride } : {}),
     ...(a.needsReauthReason === "verify_account" ? { needsReauthReason: a.needsReauthReason } : {}),
     ...(name === "kiro" && typeof a.autoSelectable === "boolean"
@@ -495,6 +502,8 @@ async function fetchOAuthRows(
 }
 
 interface ApiKeyDto {
+  disabled?: boolean;
+  pauseDetails?: import("../types/account-auto-pause").AccountPauseDetails;
   id: string;
   label?: string;
   masked?: string;
@@ -523,6 +532,9 @@ async function fetchKeyRows(deps: AccountDeps, baseUrl: string, name: string, qu
     label: k.label ?? k.masked,
     masked: k.masked,
     active: k.active ?? k.id === activeId,
+    paused: k.disabled === true,
+    // Unknown display details are dropped defensively; disabled still keeps the key paused.
+    pauseDetails: accountPauseDetailsSchema.safeParse(k.pauseDetails).data,
   }));
   return { rows, activeId, status: 200 };
 }
diff --git a/src/cli/account-extended.ts b/src/cli/account-extended.ts
index 931cc1c9602..d7f635fd50a 100644
--- a/src/cli/account-extended.ts
+++ b/src/cli/account-extended.ts
@@ -260,7 +260,7 @@ function resetIso(value: number | undefined): string | null {
 
 function refreshLine(row: FamilyRows["rows"][number]): string {
   const parts = [row.id === MAIN_ID ? "main" : row.id, row.email, row.plan];
-  if (row.paused) parts.push("paused");
+  if (row.paused) parts.push(row.pauseDetails ? `paused(${row.pauseDetails.reason})` : "paused");
   // Was a second quota dialect: it gated the whole block on weekly/monthly, so an account
   // reporting only a 5h window printed `quota: unknown` while `quotaParts` five lines below
   // rendered the same data correctly for the provider path (#2703). Two halves of one file
@@ -786,7 +786,7 @@ export async function cmdPriority(args: string[], deps: AccountDeps): Promise<nu
   return 0;
 }
 
-function resolveGenericOAuthAccountTarget(accounts: unknown[], requested: string): { id: string } | { error: string } {
+function resolveGenericOAuthAccountTarget(accounts: unknown[], requested: string, kind: "OAuth" | "API key" = "OAuth"): { id: string } | { error: string } {
   const rows = accounts.filter((value): value is { id: string; alias?: unknown } =>
     typeof value === "object" && value !== null && typeof (value as { id?: unknown }).id === "string",
   );
@@ -797,10 +797,10 @@ function resolveGenericOAuthAccountTarget(accounts: unknown[], requested: string
     : rows.filter(account => typeof account.alias === "string" && account.alias.toLowerCase() === requested.toLowerCase());
   if (matches.length === 1) return { id: matches[0]!.id };
   if (matches.length > 1) return { error: `alias "${requested}" names ${matches.length} accounts; use the account id` };
-  return { error: `Account not found: no OAuth account has the id or alias "${requested}"` };
+  return { error: `Account not found: no ${kind} account has the id or alias "${requested}"` };
 }
 
-/** Pause or resume a Codex or OAuth provider account, including Anthropic. */
+/** Pause or resume a Codex, OAuth, or API-key pool account. */
 export async function cmdPause(args: string[], deps: AccountDeps, paused: boolean): Promise<number> {
   const wantsJson = flag(args, "--json");
   const name = args.shift();
@@ -839,8 +839,20 @@ export async function cmdPause(args: string[], deps: AccountDeps, paused: boolea
     return 0;
   }
 
+  if (classified.type === "api-key") {
+    const rows = await fetchRows(deps, baseUrl, name, "api-key");
+    if (rows.status === 0) return proxyUnreachable(rows.transportError);
+    if (rows.status !== 200) return apiError(rows.errorJson ?? {}, "failed to list API key accounts", rows.status);
+    const target = resolveGenericOAuthAccountTarget(rows.rows.map(row => ({ id: row.id, alias: row.label })), requestedId, "API key");
+    if ("error" in target) return usage(`Error: ${target.error}`);
+    const result = await apiJson(deps, baseUrl, "PUT", "/api/providers/keys/pause", { name, id: target.id, paused });
+    if (result.status === 0) return proxyUnreachable(result.transportError);
+    if (result.status !== 200) return apiError(result.json, `failed to ${verb} account`, result.status);
+    console.log(wantsJson ? JSON.stringify({ ok: true, provider: name, id: target.id, paused }, null, 2) : `${name}: account ${paused ? "paused" : "resumed"}`);
+    return 0;
+  }
   if (classified.type !== "codex") {
-    return usage(`Error: ${verb} applies to the openai Codex account pool or a generic OAuth provider`);
+    return usage(`Error: ${verb} applies to the openai Codex account pool, a generic OAuth provider, or an API-key pool`);
   }
   const target = await resolveCodexAccountTarget(deps, baseUrl, requestedId);
   if ("networkDown" in target) return proxyUnreachable(target.transportError);
diff --git a/src/cli/account-key-quota.ts b/src/cli/account-key-quota.ts
index 9ba56a0cc8f..3b890f06cfd 100644
--- a/src/cli/account-key-quota.ts
+++ b/src/cli/account-key-quota.ts
@@ -2,6 +2,7 @@
 import { parseQuotaFailureCode, type AccountQuotaFields, type ProviderQuota, type ProviderQuotaWindow, type ProviderQuotaCreditsUsd } from "../providers/quota-types";
 import { terminalSafeText } from "./runtime-api";
 import type { AccountRow, FamilyRows } from "./account-api";
+import { accountPauseDetailsSchema } from "../config/schema/account-auto-pause";
 
 function record(value: unknown): Record<string, unknown> {
   if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("Malformed API-key quota response.");
@@ -88,7 +89,9 @@ export function projectApiKeyQuotaRows(value: unknown, provider: string): Family
     }
     const masked = optionalString(row, "masked");
     return { provider, type: "api-key", id, label: optionalString(row, "label") ?? masked,
-      masked, active: optionalBoolean(row, "active") ?? id === activeId, ...fields };
+      masked, active: optionalBoolean(row, "active") ?? id === activeId,
+      // Same projection as the plain key listing: disabled keeps the key paused, unknown details drop.
+      paused: row.disabled === true, pauseDetails: accountPauseDetailsSchema.safeParse(row.pauseDetails).data, ...fields };
   });
   return { rows, activeId, status: 200 };
 }
diff --git a/src/cli/account.ts b/src/cli/account.ts
index 925512acfe8..0c6135f02bb 100644
--- a/src/cli/account.ts
+++ b/src/cli/account.ts
@@ -119,7 +119,7 @@ function statusText(row: AccountRow): string {
   // `paused` leads, and does NOT replace `selected`. A paused-but-selected account is the
   // state an operator most needs named -- requests route to it while the pool believes it is
   // held out -- so printing only one of the two would hide exactly the confusing case (#2703).
-  if (row.paused) parts.push("paused");
+  if (row.paused) parts.push(row.pauseDetails ? `paused(${row.pauseDetails.reason})` : "paused");
   if (row.active) parts.push(row.type === "codex" ? "selected" : "active");
   if (row.needsReauth && !(row.provider === "kiro" && row.skipReason === "needs_reauth")) {
     parts.push(row.needsReauthReason === "verify_account" ? "needs-reauth(verify)" : "needs-reauth");
diff --git a/src/cli/capabilities-base.ts b/src/cli/capabilities-base.ts
index ebc1ff731ff..1563cab2c48 100644
--- a/src/cli/capabilities-base.ts
+++ b/src/cli/capabilities-base.ts
@@ -340,18 +340,18 @@ export const CAPABILITIES: readonly Capability[] = [
   },
   {
     command: ["account","pause"],
-    summary: "Exclude one account in a Codex, Anthropic or supported generic OAuth pool from automatic selection.",
-    routes: [{"method":"GET","path":"/api/codex-auth/accounts"},{"method":"PUT","path":"/api/codex-auth/accounts/pause"},{"method":"GET","path":"/api/oauth/accounts"},{"method":"PUT","path":"/api/oauth/accounts/pause"}],
+    summary: "Exclude one account in a Codex, Anthropic, generic OAuth or API-key pool from automatic selection.",
+    routes: [{"method":"GET","path":"/api/codex-auth/accounts"},{"method":"PUT","path":"/api/codex-auth/accounts/pause"},{"method":"GET","path":"/api/oauth/accounts"},{"method":"PUT","path":"/api/oauth/accounts/pause"},{"method":"GET","path":"/api/providers/keys"},{"method":"PUT","path":"/api/providers/keys/pause"}],
     flags: [{"name":"--json","value":"boolean","summary":"Emit the pause result as JSON."}],
     mutates: true,
     json: "envelope",
-    details: ["Codex pause unbinds pinned threads and selects a fallback when possible; with no fallback, a paused-but-selected Codex account still receives requests. Anthropic and generic OAuth pause exclude the account from new requests, failover and refresh, and an all-paused pool answers 403. Credentials and health are preserved; already-sent turns are not cancelled."],
+    details: ["Codex pause unbinds pinned threads and selects a fallback when possible; with no fallback, the paused account cannot dispatch until resumed. Anthropic and generic OAuth pause exclude the account from new requests, failover and refresh, and an all-paused pool answers 403. Credentials and health are preserved; already-sent turns are not cancelled."],
     usage: "ocx account pause <provider> <account-id|alias|main> [--json]",
   },
   {
     command: ["account","resume"],
-    summary: "Return a paused account to a Codex, Anthropic or supported generic OAuth pool.",
-    routes: [{"method":"GET","path":"/api/codex-auth/accounts"},{"method":"PUT","path":"/api/codex-auth/accounts/pause"},{"method":"GET","path":"/api/oauth/accounts"},{"method":"PUT","path":"/api/oauth/accounts/pause"}],
+    summary: "Return a paused account to a Codex, Anthropic, generic OAuth or API-key pool.",
+    routes: [{"method":"GET","path":"/api/codex-auth/accounts"},{"method":"PUT","path":"/api/codex-auth/accounts/pause"},{"method":"GET","path":"/api/oauth/accounts"},{"method":"PUT","path":"/api/oauth/accounts/pause"},{"method":"GET","path":"/api/providers/keys"},{"method":"PUT","path":"/api/providers/keys/pause"}],
     flags: [{"name":"--json","value":"boolean","summary":"Emit the resume result as JSON."}],
     mutates: true,
     json: "envelope",
diff --git a/src/codex/account-pause.ts b/src/codex/account-pause.ts
index a8a4c2d1e20..e98c45af8e1 100644
--- a/src/codex/account-pause.ts
+++ b/src/codex/account-pause.ts
@@ -1,3 +1,5 @@
+import { randomUUID } from "node:crypto";
+import type { AccountPauseDetails } from "../types/account-auto-pause";
 import type { OcxConfig } from "../types";
 import { deleteConfigTopLevelKey } from "../config/rebase-provenance";
 
@@ -7,7 +9,9 @@ export function isCodexAccountPaused(config: OcxConfig, accountId: string): bool
 }
 
 /** Persist the account's pool eligibility without changing credentials or runtime health. */
-export function setCodexAccountPaused(config: OcxConfig, accountId: string, paused: boolean): void {
+export function setCodexAccountPaused(config: OcxConfig, accountId: string, paused: boolean, details?: AccountPauseDetails): void {
+  config.codexAccountPauseState = { ...config.codexAccountPauseState,
+    [accountId]: { revision: randomUUID(), ...(paused && details ? { details } : {}) } };
   const pausedIds = new Set(config.pausedCodexAccountIds ?? []);
   if (paused) pausedIds.add(accountId);
   else pausedIds.delete(accountId);
@@ -18,4 +22,5 @@ export function setCodexAccountPaused(config: OcxConfig, accountId: string, paus
 
 export function forgetCodexAccountPause(config: OcxConfig, accountId: string): void {
   setCodexAccountPaused(config, accountId, false);
+  if (config.codexAccountPauseState) delete config.codexAccountPauseState[accountId];
 }
diff --git a/src/codex/auth-api/account-list.ts b/src/codex/auth-api/account-list.ts
index c56d139ea78..2fb458f046e 100644
--- a/src/codex/auth-api/account-list.ts
+++ b/src/codex/auth-api/account-list.ts
@@ -141,6 +141,7 @@ export function poolAccountDto(
     logLabel: codexAccountLogLabel(account),
     isMain: false,
     paused,
+    ...(config.codexAccountPauseState?.[account.id]?.details ? { pauseDetails: config.codexAccountPauseState[account.id]!.details } : {}),
     priority,
     autoSwitchThresholdOverride: getCodexAccountAutoSwitchThresholdOverride(config, account.id),
     creditsAfterLimit: codexAccountUsesCreditsAfterLimit(config, account.id),
@@ -167,6 +168,7 @@ export interface CodexAuthAccountDto {
   logLabel?: string;
   isMain: boolean;
   paused: boolean;
+  pauseDetails?: import("../../types/account-auto-pause").AccountPauseDetails;
   /** Selection order; higher is used earlier. Always present, 0 when unset. */
   priority: number;
   /** Null inherits the global usage-switch threshold; 0 disables it for this account. */
@@ -403,6 +405,7 @@ export async function listCodexAuthAccountsSnapshot(
       logLabel: "main",
       isMain: true,
       paused: isCodexAccountPaused(runtimeConfig, MAIN_CODEX_ACCOUNT_ID),
+      ...(runtimeConfig.codexAccountPauseState?.[MAIN_CODEX_ACCOUNT_ID]?.details ? { pauseDetails: runtimeConfig.codexAccountPauseState[MAIN_CODEX_ACCOUNT_ID]!.details } : {}),
       mainAccountHardLock: { ...getMainAccountHardLockStatus(runtimeConfig),
         externalUsage: getMainAccountExternalUsageWarning(getObservedMainQuotaIdentityKey()) },
       priority: getCodexAccountPriority(runtimeConfig, MAIN_CODEX_ACCOUNT_ID),
diff --git a/src/codex/auth-context.ts b/src/codex/auth-context.ts
index fbe8205f283..f2ebc614cc8 100644
--- a/src/codex/auth-context.ts
+++ b/src/codex/auth-context.ts
@@ -769,8 +769,10 @@ export function createCodexAuthDispatchGuard(
   terminalHelper = false,
 ): ((headers: Headers) => void) | undefined {
   const reserveGuard = createCodexReserveDispatchGuard(ctx, config, modelId, admission, terminalHelper);
-  if (ctx.kind !== "pool") return reserveGuard;
+  if (ctx.kind !== "pool" && ctx.kind !== "main-pool") return reserveGuard;
   return headers => {
+    if (config.pausedCodexAccountIds?.includes(ctx.accountId)) throw new CodexPoolAuthenticationError("Selected Codex account is paused; resume it in account settings");
+    if (ctx.kind === "main-pool") { reserveGuard?.(headers); return; }
     assertPoolAccountCredits(ctx.accountId, poolContextCreditHoldResetAt(ctx, config));
     reserveGuard?.(headers);
   };
diff --git a/src/config.ts b/src/config.ts
index bdd93e331b9..960edcb2cdc 100644
--- a/src/config.ts
+++ b/src/config.ts
@@ -1,3 +1,4 @@
+import { normalizeAccountAutoPauseRevisions, observeAccountAutoPauseRevisions, observeLoadedAutoPauseConfig } from "./config/account-auto-pause-revisions";
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import type { OcxConfig } from "./types";
@@ -211,7 +212,7 @@ import {
  * until a valid config or a genuinely missing file is observed. A partially-
  * invalid config is merged with defaults so providers and pool accounts survive.
  */
-export function loadConfig(): OcxConfig {
+function loadConfigUnobserved(): OcxConfig {
   const dir = getConfigDir();
   const configPath = getConfigPath();
   hardenConfigDir();
@@ -332,6 +333,10 @@ export function loadConfig(): OcxConfig {
   }
 }
 
+export function loadConfig(): OcxConfig {
+  return observeLoadedAutoPauseConfig(loadConfigUnobserved());
+}
+
 export type PersistedConfigInitializationOutcome = "created" | "exists" | "invalid";
 
 /** Initialize only a missing config; ordinary explicit updates still use saveConfig. */
@@ -348,11 +353,13 @@ export function initializePersistedConfigIfMissing(
       const current = observeInitialConfigState();
       if (current !== "missing") return current;
       const projected = projectCustomModelCatalogMigration(undefined, projectConfigRebaseProvenance(config));
+      normalizeAccountAutoPauseRevisions(undefined, projected);
       if (!validateConfigCandidate(projected).ok) throw new Error("Initial configuration is invalid.");
       if (!publishInitialConfigNoReplace(getConfigPath(), JSON.stringify(projected, null, 2) + "\n", io)) {
         return observeInitialConfigState() === "exists" ? "exists" : "invalid";
       }
       published = true;
+      observeAccountAutoPauseRevisions(projected);
       recordOwnedConfigPath(getConfigDir(), getConfigPath());
       bumpGenerationForCooperatingConfigWrite();
       return projected;
diff --git a/src/config/account-auto-pause-revisions.ts b/src/config/account-auto-pause-revisions.ts
new file mode 100644
index 00000000000..f5cd5bd23c7
--- /dev/null
+++ b/src/config/account-auto-pause-revisions.ts
@@ -0,0 +1,136 @@
+import * as z from "zod/v4";
+import { randomUUID } from "node:crypto";
+import { readFileSync } from "node:fs";
+import type { OcxConfig } from "../types";
+import { getConfigPath } from "./paths";
+
+type PolicyConfig = { providers?: unknown; accountAutoPausePolicyRevisions?: unknown };
+// fingerprint follows the live config; diskFingerprint follows the last observed disk state, so a
+// detached load compares disk with disk and still fences an observed external policy change.
+type Observed = { diskRevision: string; localGen: number; unknown: boolean; fingerprint: string; diskFingerprint: string };
+export type AccountAutoPauseFence = { configPath: string; diskRevision: string; localGen: number; threshold: number; route: string };
+const observed = new Map<string, Map<string, Observed>>();
+// One process-wide allocator for every new entry and every advance: a deleted and recreated name
+// can never reproduce an old {diskRevision, localGen} pair, even when both read "legacy".
+let nextGeneration = 0;
+const allocateGeneration = (): number => ++nextGeneration;
+function hasProvider(config: PolicyConfig | undefined, name: string): boolean {
+  const providers = record(config?.providers);
+  return !!providers && Object.hasOwn(providers, name);
+}
+const UUID = z.uuid();
+function record(value: unknown): Record<string, unknown> | undefined {
+  return value !== null && typeof value === "object" && !Array.isArray(value) ? value as Record<string, unknown> : undefined;
+}
+function revisions(config: PolicyConfig): Record<string, string> | undefined | null {
+  const value = config.accountAutoPausePolicyRevisions;
+  if (value === undefined) return undefined;
+  const map = record(value);
+  return map && Object.values(map).every(v => typeof v === "string" && UUID.safeParse(v).success) ? map as Record<string, string> : null;
+}
+function revisionFor(map: Record<string, string> | undefined | null, name: string): string | undefined {
+  return map && Object.hasOwn(map, name) ? map[name] : undefined;
+}
+function provider(config: PolicyConfig, name: string): Record<string, unknown> | undefined {
+  const providers = record(config.providers);
+  return providers && Object.hasOwn(providers, name) ? record(providers[name]) : undefined;
+}
+function route(row: Record<string, unknown> | undefined): string {
+  return JSON.stringify([row?.baseUrl, row?.adapter, row?.authMode]);
+}
+export function accountAutoPauseFingerprint(row: unknown): string {
+  const p = record(row), policy = record(p?.accountAutoPause);
+  return JSON.stringify([!!p, policy?.enabled === true, policy?.consecutiveFailures ?? 2, p?.disabled === true, route(p)]);
+}
+export function snapshotAutoPauseFingerprints(config: PolicyConfig): Map<string, string> {
+  return new Map(Object.entries(record(config.providers) ?? {}).map(([name, row]) => [name, accountAutoPauseFingerprint(row)]));
+}
+/** Caller revisions never authorize a write. The literal pre-write file owns the epoch. */
+export function normalizeAccountAutoPauseRevisions(before: PolicyConfig | undefined, persisted: OcxConfig): void {
+  const old = revisions(before ?? {});
+  const names = new Set(Object.keys(old ?? {}));
+  for (const config of [before, persisted]) {
+    for (const [name, row] of Object.entries(record(config?.providers) ?? {})) {
+      if (record(row)?.accountAutoPause !== undefined) names.add(name);
+    }
+  }
+  // Records follow the providers that exist after disk-only preservation; a deleted provider's
+  // record is reclaimed and a recreated one is minted a fresh UUID.
+  const entries = [...names].filter(name => hasProvider(persisted, name)).map(name => [name, revisionFor(old, name)
+    && accountAutoPauseFingerprint(provider(before ?? {}, name)) === accountAutoPauseFingerprint(provider(persisted, name))
+    ? revisionFor(old, name)! : randomUUID()]);
+  if (entries.length) persisted.accountAutoPausePolicyRevisions = Object.fromEntries(entries);
+  else delete persisted.accountAutoPausePolicyRevisions;
+}
+/** Adopt disk epochs even when an external ABA left the effective policy unchanged. */
+export function observeAccountAutoPauseRevisions(config: PolicyConfig, disk: PolicyConfig = config, previous?: Map<string, string>): void {
+  const path = getConfigPath();
+  let entries = observed.get(path);
+  if (!entries) { entries = new Map(); observed.set(path, entries); }
+  const map = revisions(disk);
+  const names = new Set([...entries.keys(), ...Object.keys(record(config.providers) ?? {}), ...Object.keys(map ?? {})]);
+  for (const name of names) {
+    if (!hasProvider(config, name) && !hasProvider(disk, name)) { entries.delete(name); continue; }
+    const fingerprint = accountAutoPauseFingerprint(provider(config, name));
+    const old = entries.get(name);
+    const prior = previous?.get(name) ?? old?.fingerprint ?? fingerprint;
+    entries.set(name, { fingerprint, diskRevision: revisionFor(map, name) ?? "legacy", unknown: map === null,
+      diskFingerprint: accountAutoPauseFingerprint(provider(disk, name)),
+      localGen: !old || prior !== fingerprint ? allocateGeneration() : old.localGen });
+  }
+}
+/**
+ * A loaded snapshot adopts the disk epoch and compares its policy with the previously observed
+ * disk policy. Many callers read detached snapshots; comparing one with the live fingerprint would
+ * advance localGen on every live/snapshot difference. A disk-to-disk change still advances it.
+ */
+function adoptDiskAutoPauseRevisions(config: PolicyConfig): void {
+  const path = getConfigPath();
+  let entries = observed.get(path);
+  if (!entries) { entries = new Map(); observed.set(path, entries); }
+  const map = revisions(config);
+  for (const name of new Set([...entries.keys(), ...Object.keys(record(config.providers) ?? {}), ...Object.keys(map ?? {})])) {
+    if (!hasProvider(config, name)) { entries.delete(name); continue; }
+    const old = entries.get(name);
+    const diskRevision = revisionFor(map, name) ?? "legacy";
+    const diskFingerprint = accountAutoPauseFingerprint(provider(config, name));
+    entries.set(name, old
+      ? { ...old, diskRevision, unknown: map === null, diskFingerprint, localGen: old.diskFingerprint !== diskFingerprint ? allocateGeneration() : old.localGen }
+      : { fingerprint: diskFingerprint, diskFingerprint, diskRevision, unknown: map === null, localGen: allocateGeneration() });
+  }
+}
+/** Test inspection only: observed records for the current config path. */
+export function accountAutoPauseObservedSizeForTests(): number {
+  return observed.get(getConfigPath())?.size ?? 0;
+}
+/** Initial load is an observation, never a persistence operation. */
+export function observeLoadedAutoPauseConfig(config: OcxConfig): OcxConfig {
+  adoptDiskAutoPauseRevisions(config);
+  return config;
+}
+export function captureAccountAutoPauseFence(config: OcxConfig, name: string): AccountAutoPauseFence | undefined {
+  // Only a config path no load or save has observed may be seeded from the caller's object. Once a
+  // path is observed, a missing name means an authoritative observation removed it, and a stale
+  // live snapshot must not re-enroll it; adoption by load, reload or save is required.
+  if (!observed.has(getConfigPath())) observeAccountAutoPauseRevisions(config);
+  const state = observed.get(getConfigPath())?.get(name);
+  const p = provider(config, name), policy = record(p?.accountAutoPause);
+  const threshold = policy?.consecutiveFailures ?? 2;
+  if (!state || state.unknown || !p || p.disabled === true || policy?.enabled !== true || typeof threshold !== "number" || !Number.isInteger(threshold) || threshold < 1 || threshold > 100) return;
+  return { configPath: getConfigPath(), diskRevision: state.diskRevision, localGen: state.localGen, threshold, route: route(p) };
+}
+export function accountAutoPauseFenceIsLocal(name: string, fence: AccountAutoPauseFence): boolean {
+  const state = observed.get(fence.configPath)?.get(name);
+  return getConfigPath() === fence.configPath && !!state && !state.unknown
+    && state.diskRevision === fence.diskRevision && state.localGen === fence.localGen;
+}
+/** Must run inside the config mutation lock at the final persistence boundary. */
+export function accountAutoPauseFenceMatchesDisk(name: string, fence: AccountAutoPauseFence, fresh?: PolicyConfig): boolean {
+  if (!accountAutoPauseFenceIsLocal(name, fence)) return false;
+  try {
+    const disk = fresh ?? JSON.parse(readFileSync(fence.configPath, "utf8").replace(/^\uFEFF/, "")) as PolicyConfig;
+    const map = revisions(disk), p = provider(disk, name), policy = record(p?.accountAutoPause);
+    return map !== null && (revisionFor(map, name) ?? "legacy") === fence.diskRevision && !!p && p.disabled !== true
+      && policy?.enabled === true && (policy.consecutiveFailures ?? 2) === fence.threshold && route(p) === fence.route;
+  } catch { return false; }
+}
diff --git a/src/config/live-reconcile.ts b/src/config/live-reconcile.ts
index 2cc9f00fe0e..9739911dbea 100644
--- a/src/config/live-reconcile.ts
+++ b/src/config/live-reconcile.ts
@@ -1,3 +1,4 @@
+import { observeAccountAutoPauseRevisions, snapshotAutoPauseFingerprints } from "./account-auto-pause-revisions";
 import type { OcxConfig, OcxProviderConfig, ProviderCostOverlay } from "../types";
 import { configReasoningPinsConfigError } from "./provider-validation";
 import { adoptCustomModelCatalogMigration, projectCustomModelCatalogMigration } from "../codex/custom-model-catalog-migration";
@@ -161,7 +162,9 @@ export function adoptPersistedProviderIntoLiveConfig(
   provider: OcxProviderConfig,
   persistedConfig?: OcxConfig,
 ): void {
+  const pauseBefore = snapshotAutoPauseFingerprints(config);
   config.providers[name] = structuredClone(provider);
+  observeAccountAutoPauseRevisions(config, persistedConfig ?? readRawConfigJson() ?? { accountAutoPausePolicyRevisions: null }, pauseBefore);
   const baseline = liveConfigBaseline.get(config);
   if (baseline) baseline.providers[name] = structuredClone(provider);
   if (persistedConfig) refreshPreservedProviderOwner(config, persistedConfig);
@@ -436,6 +439,7 @@ export function reconcileLiveConfigFromDisk(config: OcxConfig, persistedBaseline
   if (diagnostics.source === "fallback") {
     throw new Error(`OAuth config reconciliation failed: ${diagnostics.error ?? "invalid config file"}`);
   }
+  const pauseBefore = snapshotAutoPauseFingerprints(config);
   const persisted = diagnostics.config;
   const claudeGuardArmed = claudeCodeBaseline.has(config);
   const pendingLiveClaudeMutation = claudeGuardArmed
@@ -460,6 +464,7 @@ export function reconcileLiveConfigFromDisk(config: OcxConfig, persistedBaseline
     else config.claudeCode = structuredClone(persisted.claudeCode);
     claudeCodeBaseline.set(config, structuredClone(config.claudeCode));
   }
+  observeAccountAutoPauseRevisions(config, persisted, pauseBefore);
   // The reconciliation may have adopted a providers.<name>.modelCosts edit made
   // by a cooperating process while the OAuth login was pending; keep the overlay
   // registry (and the usage-cache overlay version) in sync with the live config.
@@ -526,6 +531,7 @@ export function saveConfigPreservingClaudeCode(config: OcxConfig): void {
     // One authoritative pre-write read feeds both the live-config reconciliation and
     // custom-model deletion migration. A second read could observe different bytes.
     const onDisk = readRawConfigJson();
+    const pauseBefore = snapshotAutoPauseFingerprints(config);
     const baseline = liveConfigBaseline.get(config);
     let diskDeletedKeys = new Set<string>();
     let persistedSnapshot: OcxConfig | undefined;
@@ -576,6 +582,7 @@ export function saveConfigPreservingClaudeCode(config: OcxConfig): void {
         }
       }
     }
+    observeAccountAutoPauseRevisions(config, onDisk ?? config, pauseBefore);
     applyConfigObjectChildDeletions(config, childDeletions);
     // Recursive three-way merging preserves sibling rows; explicit PUT/reset
     // replaces only its model after merging, including absent policy fields.
diff --git a/src/config/persist-unlocked.ts b/src/config/persist-unlocked.ts
index 9ffac0c8e43..f6014966e47 100644
--- a/src/config/persist-unlocked.ts
+++ b/src/config/persist-unlocked.ts
@@ -1,3 +1,4 @@
+import { normalizeAccountAutoPauseRevisions, observeAccountAutoPauseRevisions, snapshotAutoPauseFingerprints } from "./account-auto-pause-revisions";
 import { existsSync, readFileSync } from "node:fs";
 import { configReasoningPinsConfigError } from "./provider-validation";
 import type { OcxConfig } from "../types";
@@ -78,6 +79,8 @@ export function persistConfigUnlocked(config: OcxConfig): boolean {
   const persisted = withPreservedDiskOnlyProviders(config);
   if (provenanceProjection.configRebaseProvenance === undefined) delete persisted.configRebaseProvenance;
   else persisted.configRebaseProvenance = provenanceProjection.configRebaseProvenance;
+  normalizeAccountAutoPauseRevisions(rawBeforeWrite, persisted);
+  const beforeFingerprints = snapshotAutoPauseFingerprints(rawBeforeWrite ?? {});
   const bytes = JSON.stringify(persisted, null, 2) + "\n";
   let unchanged = false;
   try {
@@ -90,6 +93,7 @@ export function persistConfigUnlocked(config: OcxConfig): boolean {
   // the same bytes (e.g. before a proxy notification), and Logs/Usage must
   // adopt the overlay without waiting for a changed save or restart.
   let published = unchanged;
+  let observedPublication = false;
   try {
     if (!unchanged) {
       atomicWriteFile(configPath, bytes, undefined, { afterRename: () => { published = true; } });
@@ -97,10 +101,15 @@ export function persistConfigUnlocked(config: OcxConfig): boolean {
     }
     // Publication, not successful cache refresh, is the rollback boundary. A
     // byte-identical save already has the requested state on disk as well.
+    observeAccountAutoPauseRevisions(persisted, persisted, beforeFingerprints);
+    observedPublication = true;
     refreshConfigDerivedRegistries(persisted);
     return !unchanged;
   } catch (error) {
-    if (published) throw new ConfigWritePublishedError(error);
+    if (published) {
+      if (!observedPublication) observeAccountAutoPauseRevisions(persisted, persisted, beforeFingerprints);
+      throw new ConfigWritePublishedError(error);
+    }
     throw error;
   }
 }
diff --git a/src/config/schema/account-auto-pause.ts b/src/config/schema/account-auto-pause.ts
new file mode 100644
index 00000000000..0ad38056b9c
--- /dev/null
+++ b/src/config/schema/account-auto-pause.ts
@@ -0,0 +1,14 @@
+import * as z from "zod/v4";
+import { ACCOUNT_PAUSE_REASONS } from "../../types/account-auto-pause";
+
+export const accountAutoPausePolicySchema = z.object({
+  enabled: z.boolean().optional(),
+  consecutiveFailures: z.number().int().min(1).max(100).optional(),
+}).strict();
+export const accountPauseDetailsSchema = z.object({
+  reason: z.enum(ACCOUNT_PAUSE_REASONS),
+  pausedAt: z.number().int().nonnegative(),
+}).strict();
+export const accountPauseStateSchema = z.record(z.string(), z.object({
+  revision: z.string(), details: accountPauseDetailsSchema.optional(),
+}).strict());
diff --git a/src/config/schema/config-schema.ts b/src/config/schema/config-schema.ts
index 9975aa3106b..ddf640a8a15 100644
--- a/src/config/schema/config-schema.ts
+++ b/src/config/schema/config-schema.ts
@@ -1,6 +1,7 @@
 import { MAIN_ACCOUNT_HARD_LOCK_MIN_PERCENT } from "../../codex/quota-types";
 import { validRemainingQuotaAccountIds } from "../../codex/account-use-remaining";
 import * as z from "zod/v4";
+import { accountPauseStateSchema } from "./account-auto-pause";
 import { anthropicAccountPoolSchema } from "./anthropic-account-pool";
 import { compactionRecoverySchema } from "./compaction-recovery";
 import { nativeReasoningRetentionSchema } from "./native-reasoning-retention";
@@ -306,6 +307,17 @@ export const configSchema = z.object({
   // and the default label is emitted, rather than failing the parse or writing a config Codex
   // would refuse to load — the provider id routing depends on is never derived from it.
   codexProviderDisplayName: z.string().trim().min(1).max(128).optional().catch(undefined),
+  // Preserve an invalid marker: silently treating corrupt epochs as legacy would grant stale attempts authority.
+  accountAutoPausePolicyRevisions: z.record(z.string(), z.uuid()).nullable().optional().catch(null),
+  // Details are display-only; keep each usable resume revision and the separate paused-id authority.
+  codexAccountPauseState: z.preprocess(value => {
+    if (!value || typeof value !== "object" || Array.isArray(value)) return undefined;
+    return Object.fromEntries(Object.entries(value).flatMap(([id, row]) => {
+      if (!row || typeof row !== "object" || Array.isArray(row) || typeof row.revision !== "string") return [];
+      const parsed = accountPauseStateSchema.safeParse({ [id]: row });
+      return [[id, parsed.success ? parsed.data[id] : { revision: row.revision }]];
+    }));
+  }, accountPauseStateSchema.optional()),
   pausedCodexAccountIds: z.array(z.string().regex(/^[a-zA-Z0-9._-]{1,64}$/)).optional(),
   // A malformed allow-list degrades to "no account spends credits" rather than failing the parse,
   // so a hand-edited typo cannot trip the backup-and-defaults repair path; the write path rejects
diff --git a/src/config/schema/leaf-validators.ts b/src/config/schema/leaf-validators.ts
index fb73a197f77..7f002082b0a 100644
--- a/src/config/schema/leaf-validators.ts
+++ b/src/config/schema/leaf-validators.ts
@@ -1,4 +1,5 @@
 import * as z from "zod/v4";
+import { accountAutoPausePolicySchema, accountPauseDetailsSchema } from "./account-auto-pause";
 import { anthropicAccountPoolSchema } from "./anthropic-account-pool";
 import { join } from "node:path";
 import { isValidProviderName } from "../provider-name";
@@ -303,6 +304,8 @@ const providerNoProxySchema = z.unknown().superRefine((value, ctx) => {
  * fields pass through (preserved for runtime extensions).
  */
 export const providerConfigSchema = z.object({
+  accountAutoPause: accountAutoPausePolicySchema.optional(),
+  apiKeyPool: z.array(z.object({ id: z.string(), key: z.string(), label: z.string().optional(), addedAt: z.number().optional(), disabled: z.boolean().optional(), pauseRevision: z.string().optional(), pauseDetails: accountPauseDetailsSchema.optional() }).passthrough()).optional(),
   anthropicAccountPool: anthropicAccountPoolSchema,
   // Raw diagnostics/writes reject malformed provenance; tolerant loads preserve the custom row.
   anthropicOAuthInstance: z.literal("anthropic2").optional().catch(undefined),
diff --git a/src/lib/account-auto-pause-response.ts b/src/lib/account-auto-pause-response.ts
new file mode 100644
index 00000000000..92e5f19d399
--- /dev/null
+++ b/src/lib/account-auto-pause-response.ts
@@ -0,0 +1,16 @@
+import { registerProviderResponseProvenance } from "../providers/request-pacing";
+
+/** Process-local outcome ownership; these markers never become upstream/client headers. */
+const pausedResponses = new WeakMap<Response, true>();
+const permanentResponses = new WeakMap<Response, true>();
+registerProviderResponseProvenance(pausedResponses);
+registerProviderResponseProvenance(permanentResponses);
+export const wasAccountAutoPaused = (response: Response): boolean => pausedResponses.has(response);
+export const wasPermanentAccountRefusal = (response: Response): boolean => permanentResponses.has(response);
+export function markPermanentAccountRefusal(response: Response): void { permanentResponses.set(response, true); }
+export function markAccountAutoPaused(response: Response): void { pausedResponses.set(response, true); }
+export function inheritAccountAutoPauseResponse(source: Response, target: Response): Response {
+  if (wasAccountAutoPaused(source)) markAccountAutoPaused(target);
+  if (wasPermanentAccountRefusal(source)) markPermanentAccountRefusal(target);
+  return target;
+}
diff --git a/src/oauth/account-auto-pause-policy.ts b/src/oauth/account-auto-pause-policy.ts
new file mode 100644
index 00000000000..cbf2a2aab74
--- /dev/null
+++ b/src/oauth/account-auto-pause-policy.ts
@@ -0,0 +1,66 @@
+import type { AccountPauseReason, AccountAutoPausePolicy } from "../types/account-auto-pause";
+import { readBoundedResponseBody } from "../lib/bounded-body";
+
+/** Only whole, account-scoped messages are authority; model/resource policy errors are not. */
+export function classifyPermanentAccountRefusal(status: number, payload: unknown): AccountPauseReason | undefined {
+  if (status !== 401 && status !== 403 || !payload || typeof payload !== "object" || Array.isArray(payload)) return;
+  const error = (payload as { error?: unknown }).error;
+  if (!error || typeof error !== "object" || Array.isArray(error)) return;
+  const { type: rawType, code, message, status: googleStatus } = error as Record<string, unknown>;
+  const google = googleStatus === "PERMISSION_DENIED" || googleStatus === "UNAUTHENTICATED";
+  const type = rawType ?? (googleStatus === "PERMISSION_DENIED" ? "permission_error" : googleStatus === "UNAUTHENTICATED" ? "authentication_error" : undefined);
+  if (typeof message !== "string" || !["permission_error", "authentication_error", "invalid_request_error"].includes(String(type))) return;
+  if (code != null && !(google && code === status) && !["permission_error", "permission_denied", "subscription_inactive", "subscription_expired", "subscription_required", "plan_downgraded"].includes(String(code))) return;
+  const text = message.trim();
+  if (/^OAuth authentication is (?:currently )?not allowed for this organi[sz]ation[.!]?$/i.test(text)) return "oauth_organization_disabled";
+  if (/^(?:Your |The )?(?:Claude |ChatGPT )?subscription (?:has expired|is expired)[.!]?$/i.test(text)) return "subscription_expired";
+  if (/^(?:(?:Your |The )?(?:Claude |ChatGPT )?subscription is inactive|Your account does not have an active subscription)[.!]?$/i.test(text)) return "subscription_inactive";
+  if (/^Your (?:account|plan) (?:has been |was )?downgraded to (?:the )?free(?: plan)? (?:and |with )?(?:has )?(?:no|without) (?:remaining )?credits[.!]?$/i.test(text)) return "plan_downgraded";
+  if (type === "permission_error" && /^Your account (?:does not have access to Claude Code|is (?:disabled|suspended)|is not permitted to use (?:the |this )?API)[.!]?$/i.test(text)) return "account_permission_denied";
+}
+
+export async function permanentAccountRefusal(response: Response, signal?: AbortSignal): Promise<AccountPauseReason | undefined> {
+  if (response.status !== 401 && response.status !== 403) return;
+  try {
+    const body = await readBoundedResponseBody(response.clone(), { signal, fatalUtf8: true,
+      maxBytes: 16_384, totalTimeoutMs: 250, inactivityTimeoutMs: 250 });
+    if (!body.displaySafe || body.truncated) return;
+    return classifyPermanentAccountRefusal(response.status, JSON.parse(body.text));
+  } catch { return; }
+}
+
+export function autoPauseThreshold(policy: AccountAutoPausePolicy | undefined): number | undefined {
+  if (policy?.enabled !== true) return;
+  const threshold = policy.consecutiveFailures ?? 2;
+  return Number.isInteger(threshold) && threshold >= 1 && threshold <= 100 ? threshold : undefined;
+}
+
+type Streak = { incarnation: string; count: number; tail: Promise<unknown>; paused: boolean };
+/** Process-local streaks, serialized in response-arrival order, including asynchronous reads/writes. */
+export class AccountRefusalStreaks {
+  private readonly accounts = new Map<string, Streak>();
+  observe(key: string, incarnation: string, threshold: number, verdict: Promise<AccountPauseReason | undefined>, success: boolean,
+    current: () => boolean, pause: (reason: AccountPauseReason) => Promise<boolean>): Promise<boolean> {
+    if (!current()) return Promise.resolve(false);
+    let streak = this.accounts.get(key);
+    if (!streak || streak.incarnation !== incarnation) {
+      // Capacity refusal forgets no live streak and never pauses on incomplete evidence.
+      if (!streak && this.accounts.size >= 2048) return Promise.resolve(false);
+      streak = { incarnation, count: 0, tail: Promise.resolve(), paused: false };
+      this.accounts.set(key, streak);
+    }
+    const owned = streak;
+    const result = owned.tail.catch(() => undefined).then(async () => {
+      const reason = await verdict;
+      if (this.accounts.get(key) !== owned || owned.paused || !current()) return false;
+      if (success) { owned.count = 0; return false; }
+      if (!reason) return false;
+      owned.count = Math.min(owned.count + 1, threshold);
+      if (owned.count < threshold) return false;
+      owned.paused = await pause(reason);
+      return owned.paused;
+    });
+    owned.tail = result;
+    return result;
+  }
+}
diff --git a/src/oauth/account-auto-pause.ts b/src/oauth/account-auto-pause.ts
new file mode 100644
index 00000000000..3dd51c8e6ca
--- /dev/null
+++ b/src/oauth/account-auto-pause.ts
@@ -0,0 +1,171 @@
+import { captureAccountAutoPauseFence, accountAutoPauseFenceIsLocal, accountAutoPauseFenceMatchesDisk } from "../config/account-auto-pause-revisions";
+import type { OcxConfig, OcxProviderConfig } from "../types";
+import type { OAuthAccessSnapshot } from "./index";
+import type { CodexAuthContext } from "../codex/auth-context";
+import type { AccountPauseReason } from "../types/account-auto-pause";
+import { credentialGeneration, getAccountSet, setAccountPaused } from "./store";
+import { mutatePersistedConfig } from "../config";
+import { isCodexAccountGenerationLive, readCodexAccountRecord } from "../codex/account-store";
+import { captureMainQuotaDispatch, isMainQuotaDispatchLive } from "../codex/main-account-cache";
+import { isCodexAccountPaused, setCodexAccountPaused } from "../codex/account-pause";
+import { apiKeyPoolEntryId } from "../providers/api-keys";
+import { resolveProviderApiKey } from "../providers/api-key-resolve";
+import { createHash } from "node:crypto";
+import { setProviderApiKeyPaused } from "../providers/api-key-pause";
+import { AccountRefusalStreaks, autoPauseThreshold, permanentAccountRefusal } from "./account-auto-pause-policy";
+import { clearThreadAccountMapForAccount, reconcileCodexActiveAfterExclusion } from "../codex/routing";
+import { isNonReplayableResponse } from "../lib/upstream-retry";
+import { hasUpstreamRewriters, upstreamRewriterEpoch } from "../plugins/upstream-hooks";
+
+const streaks = new WeakMap<OcxConfig, AccountRefusalStreaks>();
+export { wasAccountAutoPaused, wasPermanentAccountRefusal } from "../lib/account-auto-pause-response";
+import { markAccountAutoPaused, markPermanentAccountRefusal } from "../lib/account-auto-pause-response";
+export interface AccountAutoPauseBinding {
+  config: OcxConfig;
+  oauth?: OAuthAccessSnapshot;
+  codex?: CodexAuthContext;
+}
+
+/** Capture before transport. A later response cannot acquire authority over a newer login/resume. */
+export type AccountAutoPauseObserver = ((response: Response) => Promise<Response>) & {
+  /** Final-send report: only a response whose wire credential and destination match is counted. */
+  physical: (sameDestination: boolean, headers: Headers) => void;
+};
+const CREDENTIAL_HEADERS = ["authorization", "x-api-key", "x-goog-api-key", "api-key"] as const;
+const CODEX_SELECTOR_HEADERS = ["openai-organization", "openai-project"] as const;
+// Nested capture sites (a providerFetch observer around a dispatchOverride's own observer) see the
+// same physical response. It counts once per account, and a response whose final send was reported
+// to any observer is never attributed by an observer that received no report.
+const countedResponses = new WeakMap<Response, Set<string>>();
+const reportedResponses = new WeakSet<Response>();
+export function captureAccountAutoPauseAttempt(name: string, provider: OcxProviderConfig, binding?: AccountAutoPauseBinding, headers?: Headers):
+  AccountAutoPauseObserver | undefined {
+  if (!binding) return;
+  const { config, oauth, codex } = binding;
+  const threshold = autoPauseThreshold(config.providers[name]?.accountAutoPause);
+  if (!threshold) return;
+  const configured = config.providers[name];
+  if (!configured || configured.disabled) return;
+  const fence = captureAccountAutoPauseFence(config, name);
+  if (!fence) return;
+  const route = JSON.stringify([configured.baseUrl, configured.adapter, configured.authMode]);
+  const policyCurrent = () => accountAutoPauseFenceIsLocal(name, fence) && !config.providers[name]?.disabled
+    && autoPauseThreshold(config.providers[name]?.accountAutoPause) === threshold
+    && JSON.stringify([config.providers[name]?.baseUrl, config.providers[name]?.adapter, config.providers[name]?.authMode]) === route;
+  let key: string, incarnation: string, current: () => boolean, owns: (wire: Headers) => boolean;
+  let pause: (reason: AccountPauseReason) => Promise<boolean>;
+  if (provider.authMode === "oauth") {
+    if (!oauth || oauth.provider !== name || headers?.get("authorization") !== `Bearer ${oauth.accessToken}` || headers.has("x-api-key")) return;
+    const row = getAccountSet(name)?.accounts.find(a => a.id === oauth.accountId);
+    if (!row || row.paused || credentialGeneration(row.credential) !== oauth.generation) return;
+    const revision = row.pauseRevision;
+    owns = wire => wire.get("authorization") === `Bearer ${oauth.accessToken}` && !wire.has("x-api-key");
+    key = `${name}\0oauth\0${oauth.accountId}`;
+    incarnation = `${row.loginId ?? row.addedAt ?? oauth.accountId}\0${revision ?? ""}`;
+    current = () => {
+      const live = getAccountSet(name)?.accounts.find(a => a.id === oauth.accountId);
+      return !!live && !live.paused && live.pauseRevision === revision && credentialGeneration(live.credential) === oauth.generation;
+    };
+    pause = async reason => (await setAccountPaused(name, oauth.accountId, true, {
+      generation: oauth.generation, pauseRevision: revision, isCurrent: policyCurrent,
+      assertPolicyBeforePersist: () => { if (!accountAutoPauseFenceMatchesDisk(name, fence)) throw new Error("Account auto-pause policy changed before persistence"); }, details: { reason, pausedAt: Date.now() },
+    })).status === "updated";
+  } else if (provider.authMode === "forward") {
+    if (!codex || codex.kind !== "pool" && codex.kind !== "main-pool") return;
+    const { accountId } = codex;
+    // The bearer and the workspace together name the Codex account; organization/project selectors
+    // must stay as captured, so a rewrite that keeps the bearer cannot redirect the refusal.
+    const selectors = CODEX_SELECTOR_HEADERS.map(header => headers?.get(header) ?? null);
+    const codexOwns = (wire: Headers) => wire.get("authorization") === `Bearer ${codex.accessToken}`
+      && wire.get("chatgpt-account-id") === codex.chatgptAccountId
+      && CODEX_SELECTOR_HEADERS.every((header, index) => wire.get(header) === selectors[index]);
+    if (!headers || !codexOwns(headers)) return;
+    owns = codexOwns;
+    const revision = config.codexAccountPauseState?.[accountId]?.revision;
+    const mainDispatch = codex.kind === "main-pool" ? captureMainQuotaDispatch(codex.accessToken, codex.chatgptAccountId, codex.writerGeneration) : undefined;
+    const credentialCurrent = () => codex.kind === "pool"
+      ? isCodexAccountGenerationLive(accountId, codex.generation)
+      : !!mainDispatch && isMainQuotaDispatchLive(mainDispatch);
+    key = `${name}\0codex\0${accountId}`;
+    incarnation = `${codex.kind === "pool" ? readCodexAccountRecord(accountId)?.quotaHistoryIdentity ?? codex.generation : mainDispatch?.credentialGeneration}\0${revision ?? ""}`;
+    current = () => !isCodexAccountPaused(config, accountId)
+      && config.codexAccountPauseState?.[accountId]?.revision === revision && credentialCurrent();
+    pause = async reason => {
+      let pauseState: OcxConfig["codexAccountPauseState"];
+      const outcome = mutatePersistedConfig(fresh => {
+        if (!policyCurrent() || !accountAutoPauseFenceMatchesDisk(name, fence, fresh) || !credentialCurrent() || isCodexAccountPaused(fresh, accountId)
+          || fresh.codexAccountPauseState?.[accountId]?.revision !== revision
+          || autoPauseThreshold(fresh.providers[name]?.accountAutoPause) !== threshold) return { changed: false, value: false };
+        setCodexAccountPaused(fresh, accountId, true, { reason, pausedAt: Date.now() });
+        pauseState = structuredClone(fresh.codexAccountPauseState);
+        return { changed: true, value: true };
+      });
+      if (outcome.status !== "committed" || !outcome.value) return false;
+      config.pausedCodexAccountIds = [...new Set([...(config.pausedCodexAccountIds ?? []), accountId])];
+      config.codexAccountPauseState = pauseState;
+      clearThreadAccountMapForAccount(accountId);
+      reconcileCodexActiveAfterExclusion(config, accountId);
+      return true;
+    };
+  } else {
+    const selection = provider._apiKeyAttempt;
+    if (!headers || !provider.apiKey || ![headers.get("authorization"), headers.get("x-api-key"), headers.get("x-goog-api-key")].some(value => value === provider.apiKey || value === `Bearer ${provider.apiKey}`)) return;
+    const entry = configured.apiKeyPool?.find(e => e.id === selection?.entryId && e.key === selection.reference)
+      ?? (!configured.apiKeyPool?.length && configured.apiKey ? { id: apiKeyPoolEntryId(configured.apiKey), key: configured.apiKey, disabled: false, pauseRevision: undefined } : undefined);
+    if (!entry || entry.disabled || !selection) return;
+    const { id, key: reference, pauseRevision } = entry;
+    key = `${name}\0key\0${id}`;
+    const resolvedKey = provider.apiKey;
+    owns = wire => {
+      const sent = CREDENTIAL_HEADERS.map(header => wire.get(header)).filter((value): value is string => value !== null);
+      return sent.length > 0 && sent.every(value => value === resolvedKey || value === `Bearer ${resolvedKey}`);
+    };
+    incarnation = `${createHash("sha256").update(resolvedKey).digest("hex")}\0${pauseRevision ?? ""}`;
+    current = () => {
+      const configured = config.providers[name];
+      const live = configured?.apiKeyPool?.find(e => e.id === id) ?? (!configured?.apiKeyPool?.length && configured?.apiKey === reference ? entry : undefined);
+      return !!live && !live.disabled && live.key === reference && live.pauseRevision === pauseRevision && resolveProviderApiKey(reference) === resolvedKey;
+    };
+    pause = async reason => setProviderApiKeyPaused(config, name, id, true, {
+      selection, pauseRevision, resolvedKey, fence, details: { reason, pausedAt: Date.now() },
+    });
+  }
+  incarnation += `\0${fence.diskRevision}\0${fence.localGen}`;
+  let tracker = streaks.get(config);
+  if (!tracker) { tracker = new AccountRefusalStreaks(); streaks.set(config, tracker); }
+  const observed = new WeakSet<Response>();
+  // undefined: no HTTP final-send report (Codex WebSocket). Such a send is attributable only when
+  // no rewriter was registered at capture and none was registered or removed before the response,
+  // so no plugin could have rewritten the dial in between.
+  const rewriterEpoch = hasUpstreamRewriters() ? undefined : upstreamRewriterEpoch();
+  let wireOwned: boolean | undefined;
+  const observer = (async (response: Response) => {
+    if (observed.has(response) || isNonReplayableResponse(response)) return response;
+    observed.add(response);
+    if (wireOwned !== undefined) reportedResponses.add(response);
+    else if (reportedResponses.has(response)) return response;
+    if (!(wireOwned ?? (rewriterEpoch !== undefined && upstreamRewriterEpoch() === rewriterEpoch))) return response;
+    const counted = countedResponses.get(response) ?? new Set<string>();
+    if (counted.has(key)) return response;
+    countedResponses.set(response, counted.add(key));
+    try {
+      const verdict = permanentAccountRefusal(response).then(reason => {
+        if (reason) markPermanentAccountRefusal(response);
+        return reason;
+      });
+      const paused = await tracker.observe(key, incarnation, threshold, verdict, response.ok,
+        () => policyCurrent() && current(), pause);
+      if (paused) {
+        markAccountAutoPaused(response);
+        // Fixed codes only. Never print the upstream body, provider label, or account identifier.
+        console.warn(`[account-auto-pause] paused after ${threshold} consecutive permanent account refusals`);
+      }
+    } catch {
+      // Optional persistence must preserve the original provider response.
+      console.warn("[account-auto-pause] could not persist account pause; upstream response preserved");
+    }
+    return response;
+  }) as AccountAutoPauseObserver;
+  observer.physical = (sameDestination, wire) => { wireOwned = sameDestination && owns(wire); };
+  return observer;
+}
diff --git a/src/oauth/anthropic-account-refusal.ts b/src/oauth/anthropic-account-refusal.ts
index 0885e95ffa9..fc384602910 100644
--- a/src/oauth/anthropic-account-refusal.ts
+++ b/src/oauth/anthropic-account-refusal.ts
@@ -1,3 +1,4 @@
+import { wasAccountAutoPaused } from "./account-auto-pause";
 import { anthropicModelFamily } from "./anthropic-model-quota";
 /** Narrow pre-output account recovery, fenced to the bearer that physically sent the turn. */
 import { readBoundedResponseBody } from "../lib/bounded-body";
@@ -117,6 +118,11 @@ export async function rotateAnthropicAccountOnResponseForInstance(
   const { pauseAnthropicRateAdmission, anthropicRatePauseUntil } = anthropicRatePolicyFor(instance);
   const { recordAnthropicAccountRefusal, rotateAnthropicAccountOnRefusal,
     hasAnthropicFailoverQuorum, isAnthropicAccountPoolEnabled, pickAlternateAnthropicAccount } = routing;
+  if (wasAccountAutoPaused(response)) {
+    if (!options.canRetry || options.signal?.aborted) return null;
+    return pickAlternateAnthropicAccount(options.config, sent.accountId, Date.now(),
+      options.currentDecision ? options.currentDecision() : options.decision ?? null, options.model, options.excludedAccountIds);
+  }
   const ownedCurrent = () => {
     if (configuredAnthropicInstance(options.config, instance) !== instance
       || !anthropicPhysicalSendOwnershipIsCurrent(sent)) return undefined;
diff --git a/src/oauth/api-key-pool-preserve.ts b/src/oauth/api-key-pool-preserve.ts
new file mode 100644
index 00000000000..4a8b6198692
--- /dev/null
+++ b/src/oauth/api-key-pool-preserve.ts
@@ -0,0 +1,37 @@
+import type { OcxProviderConfig } from "../types";
+import { sanitizeApiKeyValue } from "../providers/api-keys";
+import { accountPauseDetailsSchema } from "../config/schema/account-auto-pause";
+
+/** Runtime guards: provider config is intentionally passthrough, so persisted fields may be malformed. */
+export function preservableApiKeyPool(value: unknown): NonNullable<OcxProviderConfig["apiKeyPool"]> | undefined {
+  if (!Array.isArray(value)) return undefined;
+  const pool: NonNullable<OcxProviderConfig["apiKeyPool"]> = [];
+  const ids = new Set<string>();
+  const keys = new Set<string>();
+  for (const entry of value as unknown[]) {
+    if (!entry || typeof entry !== "object" || Array.isArray(entry)) continue;
+    const candidate = entry as Record<string, unknown>;
+    const id = typeof candidate.id === "string" ? candidate.id.trim() : "";
+    const key = sanitizeApiKeyValue(candidate.key);
+    if (!id || !key || ids.has(id) || keys.has(key)) continue;
+    const label = typeof candidate.label === "string" ? candidate.label : undefined;
+    const addedAt = typeof candidate.addedAt === "number" && Number.isFinite(candidate.addedAt)
+      ? candidate.addedAt
+      : undefined;
+    const details = accountPauseDetailsSchema.safeParse(candidate.pauseDetails);
+    ids.add(id);
+    keys.add(key);
+    pool.push({
+      id,
+      key,
+      ...(label !== undefined ? { label } : {}),
+      ...(addedAt !== undefined ? { addedAt } : {}),
+      ...(typeof candidate.disabled === "boolean" ? { disabled: candidate.disabled } : {}),
+      ...(typeof candidate.pauseRevision === "string" ? { pauseRevision: candidate.pauseRevision } : {}),
+      ...(details.success ? { pauseDetails: details.data } : {}),
+    });
+  }
+  // Retain paused slots too: their metadata and credentials are needed for explicit resume.
+  return pool.length > 0 ? pool : undefined;
+}
+
diff --git a/src/oauth/index.ts b/src/oauth/index.ts
index 8309e1a30fc..ef793933a56 100644
--- a/src/oauth/index.ts
+++ b/src/oauth/index.ts
@@ -55,6 +55,7 @@ import { loginOrcaRouter, orcaRouterInferenceBaseUrl, refreshOrcaRouterKey } fro
 import { ANTIGRAVITY_DISCOVERY_UA } from "../adapters/google-antigravity-wire";
 import { deriveOAuthDefaultModel, deriveOAuthProviderConfig } from "../providers/derive";
 import { apiKeyPoolEntryId, sanitizeApiKeyValue } from "../providers/api-keys";
+import { preservableApiKeyPool } from "./api-key-pool-preserve";
 import { effectiveGoogleMode, getProviderRegistryEntry, mergeRegistryStaticHeaders, providerMatchesRegistryTransport } from "../providers/registry";
 import { providerModelsUrl, resolveProviderModelDiscoveryUrl } from "../providers/model-discovery";
 import { resolveProviderTransport } from "../providers/xai-transport";
@@ -1513,36 +1514,6 @@ export function reconcileOAuthProviders(config: OcxConfig, persist = true): bool
   return true;
 }
 
-/** Runtime guards: provider config is intentionally passthrough, so persisted fields may be malformed. */
-function preservableApiKeyPool(value: unknown): NonNullable<OcxProviderConfig["apiKeyPool"]> | undefined {
-  if (!Array.isArray(value)) return undefined;
-  const pool: NonNullable<OcxProviderConfig["apiKeyPool"]> = [];
-  const ids = new Set<string>();
-  const keys = new Set<string>();
-  for (const entry of value as unknown[]) {
-    if (!entry || typeof entry !== "object" || Array.isArray(entry)) continue;
-    const candidate = entry as Record<string, unknown>;
-    const id = typeof candidate.id === "string" ? candidate.id.trim() : "";
-    const key = sanitizeApiKeyValue(candidate.key);
-    if (!id || !key || ids.has(id) || keys.has(key)) continue;
-    const label = typeof candidate.label === "string" ? candidate.label : undefined;
-    const addedAt = typeof candidate.addedAt === "number" && Number.isFinite(candidate.addedAt)
-      ? candidate.addedAt
-      : undefined;
-    ids.add(id);
-    keys.add(key);
-    pool.push({
-      id,
-      key,
-      ...(label !== undefined ? { label } : {}),
-      ...(addedAt !== undefined ? { addedAt } : {}),
-    });
-  }
-  // `apiKey` remains the routing source of truth. Keep valid alternate slots even when a
-  // hand-edited config left the pool out of sync, rather than deleting usable credentials.
-  return pool.length > 0 ? pool : undefined;
-}
-
 const OAUTH_LOGIN_OWNED_PROVIDER_FIELDS = [
   "adapter",
   "baseUrl",
@@ -1597,11 +1568,10 @@ export function upsertOAuthProvider(config: OcxConfig, provider: string): void {
     // Shared sanitizeApiKeyValue trim / no-CRLF checks from api-key pool writes.
     let storedApiKey = sanitizeApiKeyValue(existing.apiKey);
     const storedApiKeyPool = preservableApiKeyPool(existing.apiKeyPool);
-    // Unsafe/blank active key with a usable pool: promote the first safe pool entry so
-    // key billing keeps working instead of falling back to oauth while pool keys remain.
-    if (storedApiKey === undefined && storedApiKeyPool && storedApiKeyPool.length > 0) {
-      storedApiKey = storedApiKeyPool[0]!.key;
-    }
+    // Retain all-paused pools without activating any paused credential during login.
+    if (storedApiKeyPool?.some(entry => entry.key === storedApiKey && entry.disabled)) storedApiKey = undefined;
+    if (storedApiKey === undefined) storedApiKey = storedApiKeyPool?.find(entry => !entry.disabled)?.key;
+    if (storedApiKeyPool) next.apiKeyPool = storedApiKeyPool;
     if (storedApiKey !== undefined) {
       const pool = storedApiKeyPool ? [...storedApiKeyPool] : [];
       // Keep routing and listProviderApiKeys in sync: never leave a hidden active key that
diff --git a/src/oauth/store.ts b/src/oauth/store.ts
index 58ae9c891dc..0bce2de098e 100644
--- a/src/oauth/store.ts
+++ b/src/oauth/store.ts
@@ -19,6 +19,7 @@
  *   distinct one. Kimi extracts JWT `user_id`/`sub` as accountId; Cursor extracts JWT `sub` —
  *   both append distinct identified accounts under multiauth.
  */
+import { accountPauseDetailsSchema } from "../config/schema/account-auto-pause";
 import { normalizeOAuthPlan, mergeOAuthPlan } from "./plan";
 import { normalizeAnthropicIdentity, matchesAnthropicImport, mergeAnthropicIdentity } from "./anthropic-identity";
 import { findKiroAccountForLogin, withRetainedKiroUser } from "./kiro-account-identity";
@@ -638,7 +639,12 @@ function normalizeAccount(value: unknown): ProviderAccount | null {
   if (candidate.refreshAttentionGeneration === credentialGeneration(credential)) {
     account.refreshAttentionGeneration = candidate.refreshAttentionGeneration;
   }
-  if (candidate.paused === true) account.paused = true;
+  if (candidate.paused === true) {
+    account.paused = true;
+    const details = accountPauseDetailsSchema.safeParse(candidate.pauseDetails);
+    if (details.success) account.pauseDetails = details.data;
+  }
+  if (typeof candidate.pauseRevision === "string") account.pauseRevision = candidate.pauseRevision;
   const threshold = parseAnthropicAccountThreshold(candidate.autoSwitchThresholdOverride);
   if (threshold !== null) account.autoSwitchThresholdOverride = threshold;
   if (candidate.needsReauth === true && candidate.needsReauthReason === "verify_account") {
@@ -801,7 +807,7 @@ function serializeMutation<T>(work: () => Promise<T>, retainedValues: readonly u
   drainOAuthMutations();
   return result;
 }
-export function mutateStore<T>(fn:(store:AuthStore)=>T|Promise<T>, retainedValues: readonly unknown[] = [], options?: { waitMs?: number; assertBeforePersist?: () => void; scrubLegacyBackup?: (result: T) => readonly string[]; finalizeResult?: (result: T, store: AuthStore) => void; afterPersist?: (result: T) => void }):Promise<T>{return serializeMutation(async()=>{const guard=await createOAuthFileLock({path:getAuthStoreLockPath(),staleAfterMs:30000}).acquire();try{
+export function mutateStore<T>(fn:(store:AuthStore)=>T|Promise<T>, retainedValues: readonly unknown[] = [], options?: { waitMs?: number; assertBeforePersist?: () => void; scrubLegacyBackup?: (result: T) => readonly string[]; finalizeResult?: (result: T, store: AuthStore) => void; afterPersist?: (result: T) => void; withConfigLock?: boolean }):Promise<T>{return serializeMutation(async()=>{const guard=await createOAuthFileLock({path:getAuthStoreLockPath(),staleAfterMs:30000}).acquire();try{
     const { store, hadLegacy } = loadAuthStoreInternal();
     if (hadLegacy) backupLegacyOnce();
     const selections = new Map(Object.entries(store).map(([provider, set]) => [provider, {
@@ -814,7 +820,7 @@ export function mutateStore<T>(fn:(store:AuthStore)=>T|Promise<T>, retainedValue
     // Only providers whose credentials this mutation actually removed leave the downgrade
     // backup; a no-op removal names none. The result decides, so it is read here.
     const scrubbedProviders = options?.scrubLegacyBackup?.(result) ?? [];
-    options?.assertBeforePersist?.();
+    if (!options?.withConfigLock) options?.assertBeforePersist?.();
     const changedProviders: string[] = [];
     for (const provider of new Set([...selections.keys(), ...Object.keys(store)])) {
       const before = selections.get(provider);
@@ -837,7 +843,8 @@ export function mutateStore<T>(fn:(store:AuthStore)=>T|Promise<T>, retainedValue
     // Receipt-producing mutations need the revision assigned by the bookkeeping above, not the
     // provisional value visible inside their callback. Finalization cannot await or mutate disk.
     options?.finalizeResult?.(result, store);
-    persist(store);
+    const publish = () => { if (options?.withConfigLock) options.assertBeforePersist?.(); persist(store); };
+    if (options?.withConfigLock) withConfigMutationLockSync(publish); else publish();
     if (scrubbedProviders.length > 0) scrubLegacyBackup(scrubbedProviders);
     // A committed observer may establish ordering before the generic selection
     // publication, but its failure can never turn a durable write into a reported failure.
@@ -1388,17 +1395,23 @@ export async function setAccountPaused(
   provider: string,
   accountId: string,
   paused: boolean,
+  automatic?: { generation: string; pauseRevision?: string; details: import("../types/account-auto-pause").AccountPauseDetails; isCurrent?: () => boolean; assertPolicyBeforePersist?: () => void },
 ): Promise<SetAccountPausedResult> {
   const result = await mutateStore(store => {
     const set = store[provider];
     const account = set?.accounts.find(candidate => candidate.id === accountId);
     if (!set || !account) return { status: "not-found" } as const;
-    if ((account.paused === true) === paused) {
+    if (automatic && (automatic.isCurrent?.() === false || credentialGeneration(account.credential) !== automatic.generation
+      || account.pauseRevision !== automatic.pauseRevision)) return { status: "not-found" } as const;
+    if (paused && account.paused === true) {
       return { status: "unchanged", activeAccountId: set.activeAccountId, activeAccountChanged: false } as const;
     }
 
     if (paused) account.paused = true;
     else delete account.paused;
+    account.pauseRevision = randomUUID();
+    if (automatic) account.pauseDetails = automatic.details;
+    else delete account.pauseDetails;
     // Pause is part of selection eligibility even when the operator changes a non-active
     // account. Bump the provider selection revision so observers receive the existing
     // post-persistence roster invalidation and stale automatic proposals cannot commit.
@@ -1432,7 +1445,10 @@ export async function setAccountPaused(
       activeAccountId: set.activeAccountId,
       activeAccountChanged,
     } as const;
-  }, [provider, accountId, paused]);
+  }, [provider, accountId, paused], { withConfigLock: !!automatic, assertBeforePersist: () => {
+    automatic?.assertPolicyBeforePersist?.();
+    if (automatic?.isCurrent?.() === false) throw new Error("Account auto-pause policy changed before persistence");
+  } });
   if (result.status === "updated") publishOAuthAccountPauseChange(provider);
   return result;
 }
@@ -1485,6 +1501,8 @@ export async function replaceProviderAccountSet(
         ...(account.needsReauth ? { needsReauth: true } : {}),
         ...(account.refreshAttentionGeneration ? { refreshAttentionGeneration: account.refreshAttentionGeneration } : {}),
         ...(account.paused ? { paused: true } : {}),
+        ...(account.pauseDetails ? { pauseDetails: account.pauseDetails } : {}),
+        ...(account.pauseRevision ? { pauseRevision: account.pauseRevision } : {}),
         ...(account.autoSwitchThresholdOverride !== undefined ? { autoSwitchThresholdOverride: account.autoSwitchThresholdOverride } : {}),
         ...(account.needsReauthReason === "verify_account" ? { needsReauthReason: account.needsReauthReason } : {}),
         ...(account.addedAt !== undefined ? { addedAt: account.addedAt } : {}),
diff --git a/src/oauth/types.ts b/src/oauth/types.ts
index 05852753f38..14bf29c88af 100644
--- a/src/oauth/types.ts
+++ b/src/oauth/types.ts
@@ -96,6 +96,8 @@ export interface ProviderAccount {
   refreshAttentionGeneration?: string;
   /** Operator exclusion from generic OAuth account selection until explicitly resumed. */
   paused?: boolean;
+  pauseDetails?: import("../types/account-auto-pause").AccountPauseDetails;
+  pauseRevision?: string;
   /** Anthropic-only usage-switch override; absent inherits its pool default, zero disables it. */
   autoSwitchThresholdOverride?: number;
   /**
diff --git a/src/plugins/upstream-hooks.ts b/src/plugins/upstream-hooks.ts
index 13c64f8896d..b401c04690d 100644
--- a/src/plugins/upstream-hooks.ts
+++ b/src/plugins/upstream-hooks.ts
@@ -31,13 +31,20 @@ interface Registration {
 }
 
 const registrations: Registration[] = [];
+// Changes on every registration and removal, so an observer can tell that no rewriter could
+// have touched a send between two points even when the slot is empty at both.
+let registrationEpoch = 0;
 
 export function registerUpstreamRewriter(name: string, rewrite: UpstreamRewriter): () => void {
   const registration: Registration = { name, rewrite, disabled: false };
   registrations.push(registration);
+  registrationEpoch += 1;
   return () => {
     const index = registrations.indexOf(registration);
-    if (index >= 0) registrations.splice(index, 1);
+    if (index >= 0) {
+      registrations.splice(index, 1);
+      registrationEpoch += 1;
+    }
   };
 }
 
@@ -45,6 +52,11 @@ export function hasUpstreamRewriters(): boolean {
   return registrations.length > 0;
 }
 
+/** Monotonic registration epoch; equal values bracket a window with no registration change. */
+export function upstreamRewriterEpoch(): number {
+  return registrationEpoch;
+}
+
 /**
  * Run every active rewriter over one send. Returns the input untouched (same objects) when
  * no rewriter is registered, so the common path allocates nothing.
@@ -116,4 +128,5 @@ export function rewriteWebSocketDial(
 
 export function resetUpstreamRewritersForTests(): void {
   registrations.length = 0;
+  registrationEpoch += 1;
 }
diff --git a/src/providers/api-key-pause.ts b/src/providers/api-key-pause.ts
new file mode 100644
index 00000000000..bae072b82f3
--- /dev/null
+++ b/src/providers/api-key-pause.ts
@@ -0,0 +1,32 @@
+import { accountAutoPauseFenceMatchesDisk, type AccountAutoPauseFence } from "../config/account-auto-pause-revisions";
+import { randomUUID } from "node:crypto";
+import type { OcxConfig } from "../types";
+import type { ProviderApiKeySelection } from "../types/provider";
+import type { AccountPauseDetails } from "../types/account-auto-pause";
+import { apiKeyPoolEntryId } from "./api-keys";
+import { resolveProviderApiKey } from "./api-key-resolve";
+import { commitProviderApiKeySelection } from "./api-key-selection";
+
+export function setProviderApiKeyPaused(config: OcxConfig, name: string, id: string, paused: boolean,
+  automatic?: { fence: AccountAutoPauseFence; selection: ProviderApiKeySelection; pauseRevision?: string; resolvedKey?: string; details: AccountPauseDetails }): boolean {
+  const result = commitProviderApiKeySelection(config, name, provider => {
+    if (automatic && !accountAutoPauseFenceMatchesDisk(name, automatic.fence)) return { changed: false, value: false };
+    const pool = provider.apiKeyPool?.length ? provider.apiKeyPool
+      : provider.apiKey ? [{ id: apiKeyPoolEntryId(provider.apiKey), key: provider.apiKey }] : [];
+    const entry = pool.find(e => e.id === id);
+    if (!entry || automatic && (entry.disabled || entry.key !== automatic.selection.reference || entry.pauseRevision !== automatic.pauseRevision
+      || provider.accountAutoPause?.enabled !== true || resolveProviderApiKey(entry.key) !== automatic.resolvedKey)) return { changed: false, value: false };
+    provider.apiKeyPool = pool;
+    entry.disabled = paused;
+    entry.pauseRevision = randomUUID();
+    if (automatic) entry.pauseDetails = automatic.details;
+    else delete entry.pauseDetails;
+    if (paused && provider.apiKey === entry.key) {
+      const next = provider.apiKeyPool?.find(e => !e.disabled);
+      if (next) provider.apiKey = next.key;
+      else delete provider.apiKey;
+    } else if (!paused && !provider.apiKey) provider.apiKey = entry.key;
+    return { changed: true, selectionChanged: true, value: true };
+  }, automatic?.selection);
+  return result.status === "committed" && result.value;
+}
diff --git a/src/providers/api-key-selection.ts b/src/providers/api-key-selection.ts
index d06ad72bc63..550f5420867 100644
--- a/src/providers/api-key-selection.ts
+++ b/src/providers/api-key-selection.ts
@@ -13,6 +13,9 @@ import { captureProviderApiKeySelection } from "./api-key-selection-capture";
 export { captureProviderApiKeySelection } from "./api-key-selection-capture";
 
 function matchesSelection(provider: OcxProviderConfig, expected: ProviderApiKeySelection): boolean {
+  if (expected.distributed) return provider.apiKeySelectionRevision === expected.revision
+    && provider.requestPacing?.enabled === true && provider.requestPacing.keySelection === "round-robin"
+    && !!provider.apiKeyPool?.some(entry => !entry.disabled && entry.id === expected.entryId && entry.key === expected.reference);
   const current = captureProviderApiKeySelection(provider);
   return current.entryId === expected.entryId && current.reference === expected.reference
     && current.revision === expected.revision;
@@ -24,10 +27,12 @@ function currentKeyProvider(config: OcxConfig, name: string, selection?: Provide
   let row = configured;
   if (selection?.distributed) {
     const entry = configured.apiKeyPool?.find(key => key.id === selection.entryId && key.key === selection.reference);
-    if (!entry || (!allowCooling && isKeyInCooldown(name, entry.id)) || configured.apiKeySelectionRevision !== selection.revision
+    if (!entry || entry.disabled || (!allowCooling && isKeyInCooldown(name, entry.id)) || configured.apiKeySelectionRevision !== selection.revision
       || !configured.requestPacing?.enabled || configured.requestPacing.keySelection !== "round-robin") return null;
     row = { ...configured, apiKey: entry.key, _apiKeyAttempt: selection };
   }
+  if (row.apiKeyPool?.some(entry => entry.disabled && entry.key === row.apiKey)
+    || row.apiKeyPool?.length && row.apiKeyPool.every(entry => entry.disabled)) return null;
   const current = routedProviderConfig(name, { ...row, _apiKeyAttempt: selection?.distributed ? selection : undefined });
   if (current.authMode === "oauth" || current.authMode === "forward") return null;
   if (current.authMode === "key" && !current.keyOptional && !current.apiKey?.trim()) return null;
diff --git a/src/providers/api-keys.ts b/src/providers/api-keys.ts
index fe6bc883c2a..4ced73a61e5 100644
--- a/src/providers/api-keys.ts
+++ b/src/providers/api-keys.ts
@@ -21,6 +21,8 @@ export interface ProviderApiKeyInfo extends AccountQuotaFields {
   /** First/last 4 chars only; env references (`${VAR}`) are shown verbatim (not secrets). */
   masked: string;
   active: boolean;
+  disabled?: boolean;
+  pauseDetails?: import("../types/account-auto-pause").AccountPauseDetails;
   addedAt?: number;
 }
 
@@ -217,7 +219,7 @@ export function listProviderApiKeys(config: OcxConfig, name: string): { activeId
   const pool = provider.apiKeyPool?.length
     ? provider.apiKeyPool
     : provider.apiKey ? [{ id: apiKeyPoolEntryId(provider.apiKey), key: provider.apiKey }] : [];
-  const activeId = (pool.find(entry => entry.key === provider.apiKey) ?? pool[0])?.id ?? null;
+  const activeId = pool.find(entry => entry.key === provider.apiKey)?.id ?? null;
   return {
     activeId,
     keys: pool.map(entry => ({
@@ -225,6 +227,8 @@ export function listProviderApiKeys(config: OcxConfig, name: string): { activeId
       ...(entry.label ? { label: entry.label } : {}),
       masked: maskApiKey(entry.key),
       active: entry.id === activeId,
+      ...(entry.disabled ? { disabled: true } : {}),
+      ...(entry.pauseDetails ? { pauseDetails: entry.pauseDetails } : {}),
       ...(entry.addedAt !== undefined ? { addedAt: entry.addedAt } : {}),
     })),
   };
@@ -300,7 +304,7 @@ export function addProviderApiKey(config: OcxConfig, name: string, key: string,
     } else {
       pool.push({ id, key: trimmed, ...(label?.trim() ? { label: label.trim() } : {}), addedAt: Date.now() });
     }
-    fresh.apiKey = trimmed;
+    if (!existing?.disabled) fresh.apiKey = trimmed;
     return { changed: true, selectionChanged: true, value: id };
   });
   if (committed.status !== "committed") return { error: "provider selection unavailable" };
@@ -313,7 +317,7 @@ export function setActiveProviderApiKey(config: OcxConfig, name: string, id: str
     const entry = provider.apiKeyPool?.find(e => e.id === id)
       ?? (!provider.apiKeyPool?.length && provider.apiKey && apiKeyPoolEntryId(provider.apiKey) === id
         ? { id, key: provider.apiKey } : undefined);
-    if (!entry) return { changed: false, value: false };
+    if (!entry || entry.disabled) return { changed: false, value: false };
     ensurePool(provider);
     provider.apiKey = entry.key;
     return { changed: true, selectionChanged: true, value: true };
@@ -344,7 +348,7 @@ export function removeProviderApiKey(config: OcxConfig, name: string, id: string
     removed = entry.key;
     provider.apiKeyPool = pool.filter(e => e.id !== id);
     if (provider.apiKey === entry.key) {
-      const next = provider.apiKeyPool[0];
+      const next = provider.apiKeyPool.find(candidate => !candidate.disabled);
       if (next) provider.apiKey = next.key;
       else delete provider.apiKey;
     }
diff --git a/src/providers/key-failover.ts b/src/providers/key-failover.ts
index 36fefe09ae5..2c02f9a0ca8 100644
--- a/src/providers/key-failover.ts
+++ b/src/providers/key-failover.ts
@@ -493,9 +493,9 @@ export function selectProactiveApiKey(
 
   const activeEntry = pool.find(entry => entry.key === provider.apiKey);
   // A healthy committed key wins, whether the operator chose it or a previous rotation did.
-  if (activeEntry && !isKeyInCooldown(providerName, activeEntry.id, now)) return null;
+  if (activeEntry && !activeEntry.disabled && !isKeyInCooldown(providerName, activeEntry.id, now)) return null;
 
-  const eligible = pool.filter(entry => !isKeyInCooldown(providerName, entry.id, now));
+  const eligible = pool.filter(entry => !entry.disabled && !isKeyInCooldown(providerName, entry.id, now));
   if (eligible.length === 0) return null;
 
   let chosen = eligible[0]!;
@@ -504,7 +504,7 @@ export function selectProactiveApiKey(
     const lastIndex = lastId ? pool.findIndex(entry => entry.id === lastId) : -1;
     for (let offset = 1; offset <= pool.length; offset += 1) {
       const candidate = pool[(lastIndex + offset) % pool.length]!;
-      if (isKeyInCooldown(providerName, candidate.id, now)) continue;
+      if (candidate.disabled || isKeyInCooldown(providerName, candidate.id, now)) continue;
       chosen = candidate;
       break;
     }
@@ -518,11 +518,11 @@ export function selectProactiveApiKey(
   const outcome = commitProviderApiKeySelection<string | null>(config, providerName, freshProvider => {
     const freshPool = freshProvider.apiKeyPool ?? [];
     const target = freshPool.find(entry => entry.id === chosen.id);
-    if (!target) return { changed: false, value: null };
+    if (!target || target.disabled) return { changed: false, value: null };
     if (freshProvider.apiKey === target.key) return { changed: false, value: null };
     const freshActive = freshPool.find(entry => entry.key === freshProvider.apiKey);
     // Re-check under the lock: a concurrent manual selection may have landed a healthy key.
-    if (freshActive && !isKeyInCooldown(providerName, freshActive.id, now)) {
+    if (freshActive && !freshActive.disabled && !isKeyInCooldown(providerName, freshActive.id, now)) {
       return { changed: false, value: null };
     }
     freshProvider.apiKey = target.key;
@@ -564,7 +564,7 @@ export function selectProactiveApiKeyTransport(
 
 const dispatchKeyCursor = new Map<string, string>();
 function allocateDistributedKey(providerName: string, provider: OcxProviderConfig, now: number): OcxProviderConfig {
-  const pool = (provider.apiKeyPool ?? []).filter((entry, index, all) => all.findIndex(other => other.key === entry.key) === index);
+  const pool = (provider.apiKeyPool ?? []).filter(entry => !entry.disabled).filter((entry, index, all) => all.findIndex(other => other.key === entry.key) === index);
   const previous = dispatchKeyCursor.get(providerName);
   const start = pool.findIndex(entry => entry.id === previous);
   for (let offset = 1; offset <= pool.length; offset++) {
@@ -575,7 +575,7 @@ function allocateDistributedKey(providerName: string, provider: OcxProviderConfi
       entryId: entry.id, reference: entry.key, revision: provider.apiKeySelectionRevision, distributed: true,
     } };
   }
-  const next = Math.min(...pool.map(entry => getKeyCooldownUntil(providerName, entry.id, now) ?? now + 1000));
+  const next = pool.length ? Math.min(...pool.map(entry => getKeyCooldownUntil(providerName, entry.id, now) ?? now + 1000)) : now + 1000;
   throw new RequestPacingQueueOverloadError(providerName, "keys_exhausted", Math.max(1, Math.ceil((next - now) / 1000)));
 }
 
@@ -711,7 +711,7 @@ export function recordDistributedKeyFailure(
   const provider = config.providers[providerName];
   if (!selection?.distributed || !provider || provider.authMode === "oauth" || provider.authMode === "forward") return false;
   const failed = provider.apiKeyPool?.find(entry => entry.id === selection.entryId && entry.key === selection.reference);
-  if (!failed || provider.apiKeySelectionRevision !== selection.revision) return false;
+  if (!failed || failed.disabled || provider.apiKeySelectionRevision !== selection.revision) return false;
   const delay = status === "billing" ? ANTHROPIC_BILLING_COOLDOWN_MS : status === 401 ? MAX_COOLDOWN_MS : quotaResetAt !== undefined
     ? Math.max(1, quotaResetAt - now) : parseRetryAfterMs(retryAfter, now) ?? DEFAULT_COOLDOWN_MS;
   for (const entry of provider.apiKeyPool ?? []) if (entry.key === failed.key) {
@@ -739,7 +739,7 @@ function rotateKeyAfterFailure(
   if (attemptedSelection?.distributed) {
     if (acceptsFreshProvider && !acceptsFreshProvider(provider)) return null;
     if (!recordDistributedKeyFailure(config, providerName, attemptedSelection, failureStatus, now, retryAfterHeader, quotaResetAt)) return null;
-    if (!(provider.apiKeyPool ?? []).some(entry => !isKeyInCooldown(providerName, entry.id, now))) return null;
+    if (!(provider.apiKeyPool ?? []).some(entry => !entry.disabled && !isKeyInCooldown(providerName, entry.id, now))) return null;
     return allocateDistributedKey(providerName, provider, now);
   }
 
@@ -764,7 +764,7 @@ function rotateKeyAfterFailure(
 
     if (freshProvider.apiKey !== failedKey) {
       const activeEntry = pool.find(entry => entry.key === freshProvider.apiKey);
-      if (activeEntry && !isKeyInCooldown(providerName, activeEntry.id, now)) {
+      if (activeEntry && !activeEntry.disabled && !isKeyInCooldown(providerName, activeEntry.id, now)) {
         return {
           changed: false,
           value: { failedId: failedEntry?.id },
@@ -776,7 +776,7 @@ function rotateKeyAfterFailure(
     const candidateCount = failedEntry ? pool.length - 1 : pool.length;
     for (let offset = 1; offset <= candidateCount; offset += 1) {
       const candidate = pool[(currentIndex + offset) % pool.length]!;
-      if (isKeyInCooldown(providerName, candidate.id, now)) continue;
+      if (candidate.disabled || isKeyInCooldown(providerName, candidate.id, now)) continue;
       freshProvider.apiKey = candidate.key;
       return {
         changed: true,
diff --git a/src/providers/model-rename-fields.ts b/src/providers/model-rename-fields.ts
index 142ee4f5689..b4a3355caf0 100644
--- a/src/providers/model-rename-fields.ts
+++ b/src/providers/model-rename-fields.ts
@@ -51,6 +51,7 @@ export const PROVIDER_MODEL_RENAME_ROLES = {
   apiKeyTransport: "none",
   apiKeyPool: "none",
   apiKeyPoolStrategy: "none",
+  accountAutoPause: "none",
   apiKeySelectionRevision: "none",
   _apiKeyAttempt: "none",
   defaultModel: "scalar",
diff --git a/src/server/auth-cors.ts b/src/server/auth-cors.ts
index 19a276157b7..d9ca58b20aa 100644
--- a/src/server/auth-cors.ts
+++ b/src/server/auth-cors.ts
@@ -40,6 +40,7 @@ import { DECLARABLE_HOSTED_TOOL_TYPES } from "../responses/hosted-tool-policy";
 import { effectiveGoogleMode, getProviderRegistryEntry, providerCodexAccountMode, providerMatchesRegistryTransport, registryEntryForProviderDestination } from "../providers/registry";
 import { providerConfigSeed } from "../providers/derive";
 import { anthropicOAuthInstanceConfigError } from "../config/schema/anthropic-account-pool";
+import { accountAutoPausePolicySchema } from "../config/schema/account-auto-pause";
 import type { OcxConfig, OcxProviderConfig } from "../types";
 import { openRouterRoutingConfigError } from "../providers/openrouter-routing";
 import { modelAutoCompactTokenLimitsConfigError } from "../providers/auto-compact-budget";
@@ -740,6 +741,9 @@ export function providerManagementConfigError(
     return "provider must be a plain object";
   }
   const raw = provider as Record<string, unknown>;
+  if (raw.accountAutoPause !== undefined && !accountAutoPausePolicySchema.safeParse(raw.accountAutoPause).success) {
+    return "accountAutoPause must be an object with optional boolean enabled and integer consecutiveFailures (1-100)";
+  }
   const contextTiersError = contextTierRecordConfigError(raw.modelContextTiers);
   if (contextTiersError) return contextTiersError;
   const capabilitiesError = modelCapabilitiesConfigError(raw.modelCapabilities);
@@ -796,6 +800,8 @@ export function providerManagementConfigError(
     // sends recover, not what the canonical forward seed is. Validated below
     // (retryOnResetPolicyConfigError).
     delete canonicalCandidate.retryOnReset;
+    // Validated account eligibility policy is independent of the canonical transport.
+    delete canonicalCandidate.accountAutoPause;
     // Context windows are the same kind of user-owned overlay as requestPacing: the operator
     // narrowing what their own native rows advertise. They can only ever LOWER the measured
     // window (see nativeOpenAiContextWindow), so admitting them cannot widen what the proxy
@@ -1087,6 +1093,7 @@ const PROVIDER_CONFIG_FIELD_POLICY = {
   apiKeyPool: "redacted",
   // Ordering preference only; it names no key material, so an editor may read and set it.
   apiKeyPoolStrategy: "editor",
+  accountAutoPause: "editor",
   apiKeySelectionRevision: "runtime",
   _apiKeyAttempt: "runtime",
   defaultModel: "editor",
diff --git a/src/server/chat-native.ts b/src/server/chat-native.ts
index 96546c29595..314ceaad5c8 100644
--- a/src/server/chat-native.ts
+++ b/src/server/chat-native.ts
@@ -1,3 +1,4 @@
+import { captureAccountAutoPauseAttempt, wasAccountAutoPaused } from "../oauth/account-auto-pause";
 import { createPhysicalSendReporter } from "../lib/request-execution-budget";
 import { createInferenceSendBudget } from "./inference/context";
 import { observeAdvisorNativeReasoning } from "./inference/advisor-diagnostics";
@@ -68,7 +69,7 @@ import { enrichOpenCodeZenFreeTierMessage } from "../providers/opencode-zen-rate
 import type { OcxProviderTransport } from "../providers/xai-transport";
 import type { RouteResult } from "../router";
 import type { OcxConfig, OcxProviderConfig } from "../types";
-import { fetchWithHeaderTimeout, providerFetch, safeHostLabel, sendWithConnectionPolicy } from "./responses/fetch-helpers";
+import { fetchWithHeaderTimeout, physicalSendObserverInit, providerFetch, safeHostLabel, sendWithConnectionPolicy } from "./responses/fetch-helpers";
 import { isLocalUpstream } from "../lib/local-upstream";
 import { linkAbortSignal } from "./responses";
 import {
@@ -449,7 +450,7 @@ export async function runNativeChatAttempt(
   let responseOwnsDistributedKey = true;
   const send = async (
     request: AdapterRequest,
-    recovery?: "rate-limit-429" | "key-429" | "key-401" | UpstreamSendRecovery,
+    recovery?: "rate-limit-429" | "key-401" | "key-429" | UpstreamSendRecovery,
     singleShot = false,
   ): Promise<Response> => {
     try {
@@ -516,6 +517,7 @@ export async function runNativeChatAttempt(
               const spendReport = createPhysicalSendReporter(physicalBudget, () => ({
                 poolId: logCtx.spendPoolId ?? route.providerName, identityId: logCtx.accountLogLabel,
               }), execution.comboDispatchPermit);
+              const observeAutoPause = captureAccountAutoPauseAttempt(route.providerName, activeProvider, { config, oauth: undefined }, headers);
               let dispatched: Response;
               try {
                 // Capture this request's spend policy at its first physical boundary, including
@@ -538,6 +540,7 @@ export async function runNativeChatAttempt(
                   request.url,
                   applyUpstreamRecoveryInit({
                     ...init, method: request.method, headers, body: request.body,
+                    ...physicalSendObserverInit(observeAutoPause, request.url),
                   }, transportRecovery),
                   // Reselection can replace the provider transport and the wire shape, so the
                   // egress route is bound to the provider this send actually uses. Omitting it
@@ -552,7 +555,7 @@ export async function runNativeChatAttempt(
               responseOwnsDistributedKey = !activeProvider._apiKeyAttempt?.distributed
                 || distributedKeyResponseOwner(dispatched, config, route.providerName) !== null;
               if (!dispatched.ok) await recordKeyAttemptFailure(logCtx, dispatched, init.signal ?? upstream.signal);
-              return dispatched;
+              return observeAutoPause ? observeAutoPause(dispatched) : dispatched;
             },
           }),
         );
@@ -585,6 +588,23 @@ export async function runNativeChatAttempt(
     response = await send(activeRequest);
     const retryPolicy = rateLimitRetryPolicyFor(activeProvider);
     let retries = 0;
+    let autoPauseMoves = 0;
+    for (;;) {
+      const priorResponse = response;
+      for (; wasAccountAutoPaused(response) && config.providers[route.providerName]?.apiKey && autoPauseMoves < 3 && transientSendAvailable(); autoPauseMoves++) {
+        const fresh = resolveCurrentProviderApiKeyTransport(config, route.providerName, { ...activeProvider, _apiKeyAttempt: undefined });
+        const next = fresh && (selectProactiveApiKeyTransport(config, route.providerName, fresh) ?? fresh);
+        if (!next) break;
+        try { void response.body?.cancel().catch(() => {}); } catch { /* closed */ }
+        activeProvider = next;
+        stampApiKeyAccountLabel(logCtx, route.providerName, activeProvider);
+        activeAdapter = createOpenAIChatAdapter(activeProvider);
+        releaseRetainedRequest();
+        activeRequest = buildActiveRequest();
+        retainRequest(activeRequest);
+        response = await send(activeRequest, "key-401");
+      }
+
     while (
       response.status === 429
       // A 429 this proxy synthesized for a refused reset replay is not a provider rate
@@ -632,6 +652,10 @@ export async function runNativeChatAttempt(
       retainRequest(activeRequest);
       response = await send(activeRequest, failureStatus === 401 ? "key-401" : "key-429");
     }
+      if (response !== priorResponse && wasAccountAutoPaused(response)) continue;
+      break;
+    }
+
   } catch (error) {
     releaseRetainedRequest();
     cleanupAbort();
diff --git a/src/server/management/oauth-account-routes.ts b/src/server/management/oauth-account-routes.ts
index 3f48867ed6f..865995ecbf9 100644
--- a/src/server/management/oauth-account-routes.ts
+++ b/src/server/management/oauth-account-routes.ts
@@ -510,7 +510,7 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
               reauthReason: summary.needsReauth === true ? "refresh_failed" : undefined,
             });
           return { ...summary, ...oauthAccountHealthFields(provider, summary.id, health), quotaMode,
-            ...(supportsPause ? { paused: full?.paused === true } : {}),
+            ...(supportsPause ? { paused: full?.paused === true, ...(full?.pauseDetails ? { pauseDetails: full.pauseDetails } : {}) } : {}),
             ...(isAnthropicOAuthInstance(provider) && supportsPause ? { autoSwitchThresholdOverride: full?.autoSwitchThresholdOverride ?? null,
               effectiveAutoSwitchThreshold: effectiveAnthropicAccountThresholdForInstance(provider as AnthropicInstanceId, config, full),
               autoSwitchThreshold: effectiveAnthropicAccountThresholdForInstance(provider as AnthropicInstanceId, config) } : {}),
@@ -1116,6 +1116,15 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     clearProviderQuotaCache();
     return jsonResponse({ ...result, name, store: providerKeyStoreKind(config.providers[name]) });
   }
+  if (url.pathname === "/api/providers/keys/pause" && req.method === "PUT") {
+    const body = await readManagementJsonBodyOr(req, {});
+    if (!isPlainRecord(body)) return jsonResponse({ error: "body must be an object" }, 400);
+    if (typeof body.name !== "string" || typeof body.id !== "string" || typeof body.paused !== "boolean") return jsonResponse({ error: "name, id and paused required" }, 400);
+    if (!isValidProviderName(body.name) || !hasOwnProvider(config.providers, body.name)) return jsonResponse({ error: "unknown provider" }, 404);
+    const { setProviderApiKeyPaused } = await import("../../providers/api-key-pause");
+    return setProviderApiKeyPaused(config, body.name, body.id, body.paused)
+      ? jsonResponse({ ok: true }) : jsonResponse({ error: "key not found" }, 404);
+  }
   if (url.pathname === "/api/providers/keys/active" && req.method === "PUT") {
     const body = await readManagementJsonBodyOr(req, {}) as { name?: string; id?: string };
     const name = (body.name ?? "").trim();
diff --git a/src/server/management/provider-routes.ts b/src/server/management/provider-routes.ts
index 0dd9cfb8ba1..55cba4310f6 100644
--- a/src/server/management/provider-routes.ts
+++ b/src/server/management/provider-routes.ts
@@ -1357,6 +1357,12 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
       if (submittedModelContextTiers && liveTiers) candidate.modelContextTiers = Object.assign(Object.create(null), liveTiers, candidate.modelContextTiers ?? {});
       else if (!submittedModelContextTiers && liveTiers) candidate.modelContextTiers = { ...liveTiers };
       else if (!submittedModelContextTiers) delete candidate.modelContextTiers;
+      // Read omitted policy at publication time, after any concurrent operator edit.
+      if (!Object.hasOwn(rawProvider, "accountAutoPause")) {
+        const livePolicy = config.providers[name]?.accountAutoPause;
+        if (livePolicy === undefined) delete candidate.accountAutoPause;
+        else candidate.accountAutoPause = structuredClone(livePolicy);
+      }
       // Full forms omit the opt-in; preserve the latest value, including a concurrent clear.
       if (!Object.hasOwn(rawProvider, "inferContextWindow")) {
         const liveInference = config.providers[name]?.inferContextWindow;
diff --git a/src/server/management/route-registry.ts b/src/server/management/route-registry.ts
index 72037819a04..6640ed3ed47 100644
--- a/src/server/management/route-registry.ts
+++ b/src/server/management/route-registry.ts
@@ -364,6 +364,7 @@ export const MANAGEMENT_ROUTES: readonly ManagementRoute[] = [
   { method: "PUT", path: "/api/oauth/accounts/pool", module: "server/management/oauth-account-routes", mutates: true },
   { method: "PUT", path: "/api/providers/keys/active", module: "server/management/oauth-account-routes", mutates: true },
   { method: "PUT", path: "/api/providers/keys/alias", module: "server/management/oauth-account-routes", mutates: true },
+  { method: "PUT", path: "/api/providers/keys/pause", module: "server/management/oauth-account-routes", mutates: true },
   // server/management/provider-routes
   { method: "DELETE", path: "/api/providers", module: "server/management/provider-routes", mutates: true },
   { method: "GET", path: "/api/provider-context-caps", module: "server/management/provider-routes", mutates: false },
diff --git a/src/server/messages-native.ts b/src/server/messages-native.ts
index eccee246fc8..43be7603fe8 100644
--- a/src/server/messages-native.ts
+++ b/src/server/messages-native.ts
@@ -1,3 +1,4 @@
+import { captureAccountAutoPauseAttempt, wasAccountAutoPaused } from "../oauth/account-auto-pause";
 import { createPhysicalSendReporter } from "../lib/request-execution-budget";
 import { createInferenceSendBudget } from "./inference/context";
 /**
@@ -120,7 +121,7 @@ import {
   recordKeyWireAttemptUsage,
   type RequestLogContext,
 } from "./request-log";
-import { fetchWithHeaderTimeout, providerFetch, safeHostLabel, sendWithConnectionPolicy } from "./responses/fetch-helpers";
+import { fetchWithHeaderTimeout, physicalSendObserverInit, providerFetch, safeHostLabel, sendWithConnectionPolicy } from "./responses/fetch-helpers";
 import { anthropicBillingPhysicalFetch } from "../providers/anthropic-billing-ownership";
 import { rotateAnthropicBillingKeyOnResponse } from "../providers/anthropic-billing-recovery";
 import { linkAbortSignal } from "./responses/core-lifetime";
@@ -616,6 +617,7 @@ export async function handleNativeMessages(options: HandleNativeMessagesOptions)
             }
             const releaseFamily = snapshot && oauthBinding ? anthropicModelQuotaFor(oauthBinding.instance).claimAnthropicFamilyRevalidation(snapshot.accountId, route.modelId) : () => {};
             if (!releaseFamily) throw new AnthropicAccountCooldownError(1);
+            const observeAutoPause = captureAccountAutoPauseAttempt(route.providerName, activeProvider, { config, oauth: sendingBinding?.snapshot }, headers);
             const selection = activeProvider._apiKeyAttempt;
             let dispatched: Response;
             const spendReport = createPhysicalSendReporter(physicalBudget, () => ({
@@ -641,7 +643,7 @@ export async function handleNativeMessages(options: HandleNativeMessagesOptions)
                   anthropicBillingPhysicalFetch((activeProvider as OcxProviderTransport).fetch ?? execute, route.providerName, activeProvider),
                   route.providerName, activeProvider, wire.url, activeProvider.apiKeyTransport === "bearer" ? "authorization" : "x-api-key"),
                 wire.url,
-                applyUpstreamRecoveryInit({ ...init, method: "POST", headers, body: wire.body }, transportRecovery),
+                applyUpstreamRecoveryInit({ ...init, method: "POST", headers, body: wire.body, ...physicalSendObserverInit(observeAutoPause, wire.url) }, transportRecovery),
                 { providerName: route.providerName, provider: activeProvider },
               );
             } finally {
@@ -672,7 +674,7 @@ export async function handleNativeMessages(options: HandleNativeMessagesOptions)
               ? () => { recordDistributedResponseFailure(dispatched, config, route.providerName, req.signal); }
               : undefined;
             if (!dispatched.ok) await recordKeyAttemptFailure(logCtx, dispatched, init.signal ?? upstream.signal);
-            return dispatched;
+            return observeAutoPause ? observeAutoPause(dispatched) : dispatched;
           },
         }),
       ),
@@ -700,9 +702,19 @@ export async function handleNativeMessages(options: HandleNativeMessagesOptions)
     let billingRecoveryActive = false;
     const keySendAvailable = () => transientSendAvailable()
       && (!billingRecoveryActive || Math.max(physicalSendsUsed, physicalBudget.used) < physicalBudget.policy.maxTotalModelSends);
+    let autoPauseMoves = 0;
     const recoveryPasses = activeProvider._apiKeyAttempt?.distributed ? activeProvider.apiKeyPool?.length ?? 1 : 1;
     for (let pass = 0; ; pass++) {
       const priorResponse = response;
+      for (; wasAccountAutoPaused(response) && !oauthBinding && config.providers[route.providerName]?.apiKey && autoPauseMoves < 3 && keySendAvailable(); autoPauseMoves++) {
+        const fresh = resolveCurrentProviderApiKeyTransport(config, route.providerName, { ...activeProvider, _apiKeyAttempt: undefined });
+        const next = fresh && (selectProactiveApiKeyTransport(config, route.providerName, fresh) ?? fresh);
+        if (!next) break;
+        try { void response.body?.cancel().catch(() => {}); } catch { /* closed */ }
+        rebuildFor(next);
+        response = await send("key-401");
+      }
+
       // A credential-scoped 401 on a static key pool says nothing about the sibling keys.
       while (response.status === 401 && distributedResponseOwnsKey && hasKeyPoolFailover(activeProvider) && keySendAvailable()) {
         const rotated = rotateProviderTransportOn401(config, route.providerName, activeProvider, {
@@ -762,6 +774,7 @@ export async function handleNativeMessages(options: HandleNativeMessagesOptions)
       if (response === priorResponse || isNonReplayableResponse(response) || !keySendAvailable()) break;
       // Billing class transitions share the physical-send ceiling; distributed-only
       // transitions additionally retain their original bounded pool-pass allowance.
+      if (wasAccountAutoPaused(response) && autoPauseMoves < 3) continue;
       if (distributedResponseOwnsKey && (
         (billingRecoveryActive && [401, 429].includes(response.status))
         || (activeProvider.adapter === "anthropic" && hasKeyPoolFailover(activeProvider) && [400, 402].includes(response.status))
diff --git a/src/server/responses/account-auto-pause-recovery.ts b/src/server/responses/account-auto-pause-recovery.ts
new file mode 100644
index 00000000000..0bd39b64f8d
--- /dev/null
+++ b/src/server/responses/account-auto-pause-recovery.ts
@@ -0,0 +1,26 @@
+import type { ResponsesSendBudget } from "./request-send-budget";
+
+const moves = new WeakMap<object, number>();
+/** One same-provider credential move, funded by the existing recovery owner. */
+export async function recoverAutoPausedAccount<T>(options: {
+  requestKey: object;
+  remaining?: number;
+  reserve: ResponsesSendBudget["reserveCredentialHop"];
+  refresh: () => Promise<boolean>;
+  refetch: () => Promise<T>;
+  setPermit: (permit: ResponsesSendBudget["pendingHopPermit"]) => void;
+}): Promise<T | undefined> {
+  const count = moves.get(options.requestKey) ?? 0;
+  if (count >= 3 || options.remaining !== undefined && options.remaining <= 0) return;
+  const hop = options.reserve("auth-recovery", "account-auto-pause", true);
+  if (!hop.allowed) return;
+  try {
+    if (!await options.refresh()) return;
+    moves.set(options.requestKey, count + 1);
+    options.setPermit(hop.permit);
+    return await options.refetch();
+  } finally {
+    options.setPermit(undefined);
+    hop.permit?.release();
+  }
+}
diff --git a/src/server/responses/adapter-dispatch.ts b/src/server/responses/adapter-dispatch.ts
index 6d228c4721e..38c48500f16 100644
--- a/src/server/responses/adapter-dispatch.ts
+++ b/src/server/responses/adapter-dispatch.ts
@@ -1,3 +1,5 @@
+import { recoverAutoPausedAccount } from "./account-auto-pause-recovery";
+import { wasAccountAutoPaused, wasPermanentAccountRefusal } from "../../oauth/account-auto-pause";
 import { bindAnthropicRejectionResponse } from "../../adapters/anthropic-rejection-memo";
 import { deferPhysicalSendReporter } from "./deferred-send-reporter";
 import { spendLedgerStorageErrorResponse } from "./spend-storage-error";
@@ -141,6 +143,7 @@ export async function prepareAdapterExchange(
     | "sameTargetToken"
     | "transportToken"
     | "oauthDispatch"
+    | "recoverAutoPausedSelection"
     | "imageTierBias"
     | "oauth401ReplayAttempted"
     | "isOAuth401ReplayProvider"
@@ -394,11 +397,12 @@ export async function prepareAdapterExchange(
     upstreamResponse = new Response(text, { status: original.status, statusText: original.statusText, headers });
     return upstreamResponse;
   };
+  const autoPauseEnabled = config.providers[route.providerName]?.accountAutoPause?.enabled === true;
   const billingPoolRequest = isAnthropicBillingKeyPool(route.provider);
   let billingRecoveryActive = false;
   const genericRefetchCountsSends = () => sendBudgetState.adapterSendBudget?.spendEnforced === true
     || transientRetryPolicyFor(route.provider) !== null || resetReplayPolicyFor(route.provider) !== null
-    || billingPoolRequest || billingRecoveryActive;
+    || billingPoolRequest || billingRecoveryActive || autoPauseEnabled;
   let handoffPermit: ResponsesSendBudget["pendingHopPermit"];
   try {
     if (transportState.activeAdapter.fetchResponse) {
@@ -520,10 +524,10 @@ export async function prepareAdapterExchange(
           label: safeHostLabel(builtInitialRequest.url),
           claimAmbiguousResend: claimPreHeaderResend,
           ...(sendBudgetState.adapterSendBudget?.spendEnforced || options.comboDispatchPermit || transientPolicy || resetPolicy || compactPrepaid || options.comboAttempt
-            || billingPoolRequest
+            || billingPoolRequest || autoPauseEnabled
             ? {
               // A pending compaction permit already booked this leg's first physical send.
-              ...(transientPolicy || resetPolicy || compactPrepaid || options.comboAttempt
+              ...(transientPolicy || resetPolicy || compactPrepaid || options.comboAttempt || autoPauseEnabled
                 ? {
                   attempts: Math.min(initialSendCap,
                     sendBudgetState.initialSendAllowance(initialSendCap) + (compactPrepaid ? 1 : 0)),
@@ -923,6 +927,15 @@ export async function prepareAdapterExchange(
     };
    // Keep recovery kinds in sync with the native Responses `passthroughRecovery:` loop above.
    recovery: for (;;) {
+      if (wasAccountAutoPaused(upstreamResponse) && route.provider.authMode !== "forward") {
+        const recovered = await recoverAutoPausedAccount({ requestKey: transportState, reserve: reserveCredentialHop,
+          remaining: transientSendCapFor(transientRetryPolicyFor(route.provider)?.attempts, sendBudgetState.targetSendsUsed),
+          refresh: () => transportState.recoverAutoPausedSelection(parsed), refetch: () => rebuildAndRefetch("oauth-account-429"), setPermit: permit => { sendBudgetState.pendingHopPermit = permit; } });
+        if (!recovered) break;
+        if ("failed" in recovered) return recovered.failed;
+        upstreamResponse = recovered; continue recovery;
+      }
+
       // Preserve the terminal verdict through adapter and combo error formatting.
       // This also covers a reset reached by a 401/429/413 recovery refetch.
       if (isNonReplayableResponse(upstreamResponse)) {
@@ -942,7 +955,7 @@ export async function prepareAdapterExchange(
         continue recovery;
       }
      if (
-       upstreamResponse.status === 401
+       upstreamResponse.status === 401 && !wasPermanentAccountRefusal(upstreamResponse)
        && isOAuth401ReplayProvider
         && transportState.sentOAuthSnapshot
         && !oauth401ReplayAttempted
@@ -1062,7 +1075,7 @@ export async function prepareAdapterExchange(
         continue recovery;
       }
 
-      if (route.providerName === "google-antigravity" && upstreamResponse.status === 401
+      if (route.providerName === "google-antigravity" && upstreamResponse.status === 401 && !wasPermanentAccountRefusal(upstreamResponse)
         && oauth401ReplayAttempted && !antigravityAuthRotationAttempted
         && !isNonReplayableResponse(upstreamResponse)) {
         antigravityAuthRotationAttempted = true;
diff --git a/src/server/responses/compact.ts b/src/server/responses/compact.ts
index 671898cd72e..cb93a79f280 100644
--- a/src/server/responses/compact.ts
+++ b/src/server/responses/compact.ts
@@ -1,3 +1,4 @@
+import { captureAccountAutoPauseAttempt, wasAccountAutoPaused, wasPermanentAccountRefusal } from "../../oauth/account-auto-pause";
 import { spendLedgerStorageErrorResponse } from "./spend-storage-error";
 import { createPhysicalSendReporter, rebindPhysicalSend } from "../../lib/request-execution-budget";
 import { createInferenceSendBudget } from "../inference/context";
@@ -1058,6 +1059,7 @@ export async function handleResponsesCompact(
     ) => {
       // A gateway response is not evidence about any Codex account.
       if (gatewayTransport || !usesCodexForwardPoolAuth(ctx, route.provider)) return;
+      if ((outcome === 401 || outcome === 403) && upstream && wasPermanentAccountRefusal(upstream)) return;
       recordCodexUpstreamOutcome(config, ctx.accountId, outcome, {
         ...meta,
         threadId: ctx.kind === "pool" || ctx.kind === "main-pool" ? ctx.affinityKey : undefined,
@@ -1166,6 +1168,7 @@ export async function handleResponsesCompact(
         providerFetch(sendProvider, undefined, {
           providerName: route.providerName,
           modelId: route.modelId,
+          accountAutoPause: (name, provider, headers) => captureAccountAutoPauseAttempt(name, provider, { config, codex: sendAuthCtx }, headers),
           beforeDispatch: isCanonicalOpenAiForwardProvider(sendProvider)
             ? createCodexAuthDispatchGuard(sendAuthCtx, config, selectedModelId, admission) : undefined,
           dispatchOverride: sendProvider.authMode !== "forward" && sendProvider.apiKey
@@ -1287,7 +1290,7 @@ export async function handleResponsesCompact(
 
     recordDistributedResponseFailure(upstream, config, route.providerName, req.signal);
     if (
-      upstream.status === 401
+      upstream.status === 401 && !wasPermanentAccountRefusal(upstream)
       && (authCtx.kind === "main-pool" || authCtx.kind === "pool")
       && !gatewayTransport
       && usesCodexForwardPoolAuth(authCtx, compactProvider)
@@ -1411,12 +1414,12 @@ export async function handleResponsesCompact(
     // surfaces to the client, which retries the compact task OUTSIDE the logical request
     // — reporting exhausted retries while another pool account sat idle (#913).
     if (
-      (upstream.status === 429 || upstream.status === 402)
+      (upstream.status === 429 || upstream.status === 402 || wasAccountAutoPaused(upstream))
       // A replay refusal this proxy synthesized carries 429 for the client's benefit only.
       // It is not pool quota evidence, and the alternate account below is another send of a
       // compact turn that may already have been processed.
       && !isNonReplayableResponse(upstream)
-      && !storedPool401ReplayAttempted
+      && (!storedPool401ReplayAttempted || wasAccountAutoPaused(upstream))
       && !gatewayTransport
       && usesCodexForwardPoolAuth(authCtx, route.provider)
       && !authCtx.fixedAccount
@@ -1521,7 +1524,7 @@ export async function handleResponsesCompact(
     // the same guards as the quota move, and a 5xx whose body confirms quota keeps today's path.
     if (
       shouldRetryCodexPoolAccountTransient(upstream)
-      && !storedPool401ReplayAttempted
+      && (!storedPool401ReplayAttempted || wasAccountAutoPaused(upstream))
       && !gatewayTransport
       && usesCodexForwardPoolAuth(authCtx, route.provider)
       && !authCtx.fixedAccount
@@ -1642,7 +1645,7 @@ export async function handleResponsesCompact(
       inspectResponseLogJson(logCtx, compactText);
       if (!options.compactionRoutingOverride) forgetCompactHandoffRoute(req, admission);
       rememberServingConversationStateIssuer(outcomeCtx, codexPoolAffinityKey(req.headers));
-    } else if (!options.compactionRoutingOverride && quotaFailure && !storedPool401ReplayAttempted) {
+    } else if (!options.compactionRoutingOverride && quotaFailure && (!storedPool401ReplayAttempted || wasAccountAutoPaused(upstream))) {
       const fallbackModel = compactHandoffRoute(req, admission, raw.model);
       if (fallbackModel && !req.signal.aborted) {
         const fallbackReq = new Request(req.url, {
diff --git a/src/server/responses/core-codex-account.ts b/src/server/responses/core-codex-account.ts
index 7f73f04c4ce..a2b35f7da73 100644
--- a/src/server/responses/core-codex-account.ts
+++ b/src/server/responses/core-codex-account.ts
@@ -1,3 +1,4 @@
+import { captureAccountAutoPauseAttempt, wasPermanentAccountRefusal } from "../../oauth/account-auto-pause";
 import type { OcxConfig, OcxProviderConfig, OcxParsedRequest } from "../../types";
 import type { CodexAuthContext, CodexAuthPolicyConfig } from "../../codex/auth-context";
 import type { CodexUpstreamOutcome } from "../../codex/routing";
@@ -144,7 +145,7 @@ export function recordCodexPreOutputRefusalOutcome(
   modelId: string,
 ): void {
   if (!isCodexWsPreOutputRefusal(response) || codexWsPreOutputRefusalOutcomeRecorded(response)) return;
-  if (!usesCodexForwardPoolAuth(authCtx, provider)) return;
+  if (!usesCodexForwardPoolAuth(authCtx, provider) || wasPermanentAccountRefusal(response)) return;
   noteCodexWsPreOutputRefusalOutcome(response);
   recordCodexUpstreamOutcome(config, authCtx.accountId, response.status, {
     threadId: authCtx.affinityKey,
@@ -855,6 +856,10 @@ export async function retryCodexPoolOnAlternateAccount(
     options.deferCodexResetDerivedCooldown,
   );
   const recordFirstOutcome = (): void => {
+    if (wasPermanentAccountRefusal(firstResponse)) {
+      noteCodexWsPreOutputRefusalOutcome(firstResponse);
+      return;
+    }
     recordCodexUpstreamOutcome(config, firstAuthCtx.accountId, outcomeStatus, {
       ...quotaMeta,
       threadId: firstAuthCtx.affinityKey,
@@ -1032,6 +1037,7 @@ export async function retryCodexPoolOnAlternateAccount(
             providerName: route.providerName,
             modelId: route.modelId,
             preOutputRefusalHold: args.preOutputRefusalHold,
+            accountAutoPause: (name, provider, headers) => captureAccountAutoPauseAttempt(name, provider, { config, codex: retryAuthCtx }, headers),
             onCodexWsQuota: codexWsQuotaObserver(retryAuthCtx, route.provider, route.modelId),
             beforeDispatch: isCanonicalOpenAiForwardProvider(route.provider)
               ? createCodexAuthDispatchGuard(retryAuthCtx, options.codexAuthPolicy ?? config, route.modelId, options.admission, options.visionDescribeTerminal === true) : undefined,
diff --git a/src/server/responses/fetch-helpers.ts b/src/server/responses/fetch-helpers.ts
index 0d6edb60de7..008bbc9ec8b 100644
--- a/src/server/responses/fetch-helpers.ts
+++ b/src/server/responses/fetch-helpers.ts
@@ -49,6 +49,17 @@ const EGRESS_DECIDED = Symbol.for("opencodex.provider-egress.decided");
 const UPSTREAM_REWRITTEN = Symbol.for("opencodex.plugins.upstream-rewritten");
 // Survives queued credential rebuilds and executor replacement without importing budget owners.
 const PHYSICAL_DISPATCH = Symbol.for("opencodex.physical-dispatch");
+// Final destination and headers after plugin rewrites and queued rebuilds, for observers that
+// must attribute a response to the credential that actually reached the wire.
+const PHYSICAL_SEND_OBSERVER = Symbol.for("opencodex.physical-send-observer");
+export type AccountAutoPauseObserver = ((response: Response) => Promise<Response>) & {
+  physical?: (sameDestination: boolean, headers: Headers) => void;
+};
+/** Init fragment that reports the final send of the observer's attempt; empty when nothing observes. */
+export function physicalSendObserverInit(observer: AccountAutoPauseObserver | undefined, target: string): Record<symbol, unknown> {
+  const physical = observer?.physical;
+  return physical ? { [PHYSICAL_SEND_OBSERVER]: (destination: string, headers: Headers) => physical(destination === target, headers) } : {};
+}
 // One WS attempt and its HTTP fallback are one logical physical-send receipt.
 const WS_FALLBACK_RECEIPT = Symbol.for("opencodex.ws-fallback-receipt");
 // Replacement admission waits on the client signal, outside the response-header deadline.
@@ -221,6 +232,7 @@ export function sendWithConnectionPolicy(
     && isCanonicalCodexResponsesUrl(target)
     && Buffer.byteLength(body, "utf8") >= 1024 * 1024;
   (init as Record<symbol, (() => void) | undefined> | undefined)?.[PHYSICAL_DISPATCH]?.();
+  (init as Record<symbol, ((destination: string, headers: Headers) => void) | undefined> | undefined)?.[PHYSICAL_SEND_OBSERVER]?.(target, headers);
   // Final headers, after plugin rewrites: an upstream can only echo what it received here, so the
   // request log refuses any diagnostic that repeats one of these values (see request-log-terminal-status).
   outboundCredentials().remember(headers);
@@ -237,6 +249,7 @@ export function sendWithConnectionPolicy(
 }
 
 export interface ProviderFetchOptions {
+  accountAutoPause?: (name: string, provider: OcxProviderConfig, headers: Headers) => AccountAutoPauseObserver | undefined;
   /**
    * Keep this send on HTTP even where the WebSocket upstream would normally be selected.
    *
@@ -353,7 +366,7 @@ export function providerFetch(
   // ChatGPT Codex backend: streaming turns ride the responses_websockets
   // transport (measured ~3s faster TTFT than the SSE POST queue); everything
   // else keeps the provider's HTTP fetch. See ws-upstream.ts for the details.
-  const unpaced = async (input: Parameters<typeof globalThis.fetch>[0], init?: RequestInit,
+  const unobserved = async (input: Parameters<typeof globalThis.fetch>[0], init?: RequestInit,
     reacquirePacing?: (provider: OcxProviderConfig, modelId?: string) => Promise<void>) => {
     const upstreamWebsocket = provider.upstreamWebsocket;
     if (!options.httpOnly && typeof input === "string" && init
@@ -390,6 +403,15 @@ export function providerFetch(
     }
     return httpFetch(input, init, reacquirePacing);
   };
+  const unpaced = async (input: Parameters<typeof globalThis.fetch>[0], init?: RequestInit,
+    reacquirePacing?: (provider: OcxProviderConfig, modelId?: string) => Promise<void>) => {
+    const observe = options.accountAutoPause?.(providerName, provider,
+      new Headers(init?.headers ?? (input instanceof Request ? input.headers : undefined)));
+    const observedInit = observe?.physical
+      ? { ...init, ...physicalSendObserverInit(observe, input instanceof Request ? input.url : String(input)) } : init;
+    const response = await unobserved(input, observedInit, reacquirePacing);
+    return observe ? observe(response) : response;
+  };
   let pacingSlotAcquired = options.pacingSlotAcquired === true;
   const waitForPacing = async (signal?: AbortSignal): Promise<ProviderRequestSlot | undefined> => {
     if (pacingSlotAcquired) {
diff --git a/src/server/responses/passthrough-delivery.ts b/src/server/responses/passthrough-delivery.ts
index 9d5dbbf9dbb..3d286dec672 100644
--- a/src/server/responses/passthrough-delivery.ts
+++ b/src/server/responses/passthrough-delivery.ts
@@ -1,3 +1,4 @@
+import { wasPermanentAccountRefusal } from "../../oauth/account-auto-pause";
 import { isNativeControlResponse } from "./native-response-control";
 import { createOutboundCredentialMask, createTerminalErrorRedactionBlockRewrite } from "./terminal-error-redaction";
 import type { ResponsesRequestContext, ResponsesAdmissionState } from "./core-options";
@@ -527,7 +528,7 @@ export async function deliverPassthroughResponse(
       } else if (!shouldDeferCodexResetDerivedCooldown(
         upstreamResponse,
         options.deferCodexResetDerivedCooldown,
-      ) && !isReplayRefusalResponse(upstreamResponse)) {
+      ) && !isReplayRefusalResponse(upstreamResponse) && !wasPermanentAccountRefusal(upstreamResponse)) {
         // A refusal this proxy made is not evidence about the account. Recording it would
         // classify the synthetic 429 as quota exhaustion and write a default cooldown against
         // a credential the request may never have reached, and that false signal outlives the
@@ -572,7 +573,7 @@ export async function deliverPassthroughResponse(
     // through sanitizePassthroughHeaders) so a redirect to a dead host can never
     // masquerade as a pre-connection failure after the credential was seen.
     // The numeric outcome above already classified it neutral — no streak.
-    if (isNonReplayableResponse(upstreamResponse) && !isReplayRefusalResponse(upstreamResponse)) {
+    if (isNonReplayableResponse(upstreamResponse) && !isReplayRefusalResponse(upstreamResponse) && !wasPermanentAccountRefusal(upstreamResponse)) {
       return await sanitizeNonReplayableUpstreamError(upstreamResponse, upstream.signal);
     }
     if (upstreamResponse.status >= 300 && upstreamResponse.status < 400) {
diff --git a/src/server/responses/passthrough-dispatch.ts b/src/server/responses/passthrough-dispatch.ts
index 9eee8ea699f..849001a6798 100644
--- a/src/server/responses/passthrough-dispatch.ts
+++ b/src/server/responses/passthrough-dispatch.ts
@@ -1,3 +1,5 @@
+import { recoverAutoPausedAccount } from "./account-auto-pause-recovery";
+import { adoptCodexWsStage, capturePassthroughAffinity } from "./passthrough-observations";
 import { spendLedgerStorageErrorResponse } from "./spend-storage-error";
 import { requestPacingOverloadResponse } from "./pacing-overload";
 import { recordDistributedResponseFailure } from "../../providers/api-key-response-ownership";
@@ -99,7 +101,6 @@ import {
   upstreamHostCircuitOpenResponse,
   usesCodexForwardPoolAuth,
   codexWsQuotaObserver,
-  isFixedCodexAccount,
   codexPoolAccountModel400Denial,
   shouldRetryCodexPoolAccountQuota,
   shouldRetryCodexPoolAccountTransient,
@@ -111,7 +112,7 @@ import {
   clearCodexModelDenialEvidence,
   recordCodexModelDenialEvidence,
 } from "../../codex/model-entitlements";
-import { codexWsSocketDeathStage, isCodexWsUpstreamResponse, readCodexWsStage } from "./codex-ws-wire";
+import { codexWsSocketDeathStage, isCodexWsUpstreamResponse } from "./codex-ws-wire";
 import { linkAbortSignal } from "./core-lifetime";
 import type { CodexAuthContext } from "../../codex/auth-context";
 import { checkOutboundBodySize, describeOutboundBodyRefusal } from "./outbound-body-guard";
@@ -130,6 +131,7 @@ import {
 } from "../../lib/upstream-retry";
 import { mapCodexAuthContextErrorToResponse } from "./codex-auth-error";
 import { classifyTransportFailureKind, transportErrorCode } from "../../lib/upstream-reachability";
+import { captureAccountAutoPauseAttempt, wasAccountAutoPaused, wasPermanentAccountRefusal } from "../../oauth/account-auto-pause";
 import { recordCodexUpstreamOutcome } from "../../codex/routing";
 import { describeUpstreamConnectFailure } from "./upstream-error";
 import type { OpaqueBlobRecoveryGuard } from "./core-opaque-recovery";
@@ -152,7 +154,6 @@ import {
   rotateGenericOAuthAccountOn429,
   failoverAccountSnapshot,
 } from "../../oauth/generic-account-failover";
-import { captureCodexAffinityDiagnostic } from "../../codex/affinity-debug";
 import { ACCOUNT_GATED_NATIVE_OPENAI_MODELS } from "../../codex/catalog/native-models";
 import {
   attemptOpaqueBlobRecovery,
@@ -201,6 +202,7 @@ export async function preparePassthroughExchange(
     | "genericFailoverAccountId"
     | "passiveQuotaWriterGeneration"
     | "oauthDispatch"
+    | "recoverAutoPausedSelection"
     | "resolveSelectionAdapter"
     | "resolveCopilotSelection"
     | "copilotRefusalResponse"
@@ -733,22 +735,11 @@ export async function preparePassthroughExchange(
       }
       nativeHostState.lease = null;
     };
-    /**
-     * #4191: a Codex WS exchange pins its content-free stage record on the
-     * Response it resolves (markCodexWsStage). Adopting the record here, at
-     * the single funnel every physical upstream response passes through,
-     * binds it to the attempt that actually served it — including the 502/504
-     * pre-response JSON settles that never reach the SSE relay.
-     */
-    const adoptCodexWsStage = (response: Response): void => {
-      const stage = readCodexWsStage(response);
-      if (stage && logCtx.activeAttempt) logCtx.activeAttempt.codexWsStage = stage;
-    };
     let upstreamResponse: Response, lastDistributedResponse: Response | undefined;
     const adoptObservedResponse = <T extends Response>(response: T): T => {
       if (!isNonReplayableResponse(response)) lastDistributedResponse = response.status === 401 || response.status === 429 ? response : undefined;
       settleObservedHostResponse();
-      adoptCodexWsStage(response);
+      adoptCodexWsStage(response, logCtx);
       return response;
     };
     let passthroughEstimate = typeof request.usageLog?.inputTokens === "number"
@@ -1050,6 +1041,7 @@ export async function preparePassthroughExchange(
               providerName: route.providerName,
               modelId: route.modelId,
               onPhysicalDispatch: receiptMode ? sendBudgetState.noteInitialDispatch : undefined,
+              accountAutoPause: (name, provider, headers) => captureAccountAutoPauseAttempt(name, provider, { config, codex: admissionState.authCtx }, headers),
               onCodexWsQuota: codexWsQuotaObserver(admissionState.authCtx, route.provider, route.modelId),
               beforeDispatch: isCanonicalOpenAiForwardProvider(route.provider)
                 ? createCodexAuthDispatchGuard(admissionState.authCtx, options.codexAuthPolicy ?? config, route.modelId, options.admission, options.visionDescribeTerminal === true) : undefined,
@@ -1187,6 +1179,7 @@ export async function preparePassthroughExchange(
                 dispatchOverride: oauthDispatch(request, parsed, "passthrough"),
                 providerName: route.providerName,
                 modelId: route.modelId,
+                accountAutoPause: (name, provider, headers) => captureAccountAutoPauseAttempt(name, provider, { config, codex: admissionState.authCtx }, headers),
                 onCodexWsQuota: codexWsQuotaObserver(admissionState.authCtx, route.provider, route.modelId),
                 beforeDispatch: isCanonicalOpenAiForwardProvider(route.provider)
                   ? createCodexAuthDispatchGuard(admissionState.authCtx, options.codexAuthPolicy ?? config, route.modelId, options.admission, options.visionDescribeTerminal === true) : undefined,
@@ -1209,8 +1202,18 @@ export async function preparePassthroughExchange(
 
     // Keep recovery kinds in sync with the generic `recovery:` loop below.
     passthroughRecovery: for (;;) {
+      if (wasAccountAutoPaused(upstreamResponse) && route.provider.authMode !== "forward") {
+        const recovered = await recoverAutoPausedAccount({ requestKey: transportState, reserve: reserveCredentialHop,
+          remaining: transientSendCapFor(transientRetryPolicyFor(route.provider)?.attempts, sendBudgetState.targetSendsUsed),
+          refresh: () => transportState.recoverAutoPausedSelection(parsed), refetch: () => rebuildAndRefetch("oauth-account-429"), setPermit: permit => { sendBudgetState.pendingHopPermit = permit; } });
+        if (!recovered) break;
+        if ("failed" in recovered) return recovered.failed;
+        upstreamResponse = recovered; continue passthroughRecovery;
+      }
+
+
     if (
-      upstreamResponse.status === 401
+      upstreamResponse.status === 401 && !wasPermanentAccountRefusal(upstreamResponse)
       && (admissionState.authCtx.kind === "main-pool" || admissionState.authCtx.kind === "pool")
       && usesCodexForwardPoolAuth(admissionState.authCtx, route.provider)
       && codex401ReplayKind === null
@@ -1293,6 +1296,7 @@ export async function preparePassthroughExchange(
             dispatchOverride: oauthDispatch(request, parsed, "passthrough"),
             providerName: route.providerName,
             modelId: route.modelId,
+            accountAutoPause: (name, provider, headers) => captureAccountAutoPauseAttempt(name, provider, { config, codex: admissionState.authCtx }, headers),
             onCodexWsQuota: codexWsQuotaObserver(admissionState.authCtx, route.provider, route.modelId),
             beforeDispatch: headers => {
               replayGuard?.(headers);
@@ -1336,14 +1340,14 @@ export async function preparePassthroughExchange(
       continue passthroughRecovery;
     }
 
-    if (codex401ReplayKind !== null && upstreamResponse.status === 401) break;
+    if (codex401ReplayKind !== null && upstreamResponse.status === 401 && !wasPermanentAccountRefusal(upstreamResponse)) break;
 
     // Native Responses providers return before the generic adapter recovery loop below. Keep
     // their OAuth contract identical: one pre-stream 401 forces a credential refresh and one
     // rebuilt replay. xAI's current subscription models use this branch now that their official
     // Grok CLI catalog declares the Responses backend.
     if (
-      upstreamResponse.status === 401
+      upstreamResponse.status === 401 && !wasPermanentAccountRefusal(upstreamResponse)
       && isOAuth401ReplayProvider
       && transportState.sentOAuthSnapshot
       && !oauth401ReplayAttempted
@@ -1440,6 +1444,7 @@ export async function preparePassthroughExchange(
                 dispatchOverride: oauthDispatch(request, parsed, "passthrough"),
                 providerName: route.providerName,
                 modelId: route.modelId,
+                accountAutoPause: (name, provider, headers) => captureAccountAutoPauseAttempt(name, provider, { config, codex: admissionState.authCtx }, headers),
                 onCodexWsQuota: codexWsQuotaObserver(admissionState.authCtx, route.provider, route.modelId),
                 beforeDispatch: isCanonicalOpenAiForwardProvider(route.provider)
                   ? createCodexAuthDispatchGuard(admissionState.authCtx, options.codexAuthPolicy ?? config, route.modelId, options.admission, options.visionDescribeTerminal === true) : undefined,
@@ -1586,6 +1591,7 @@ export async function preparePassthroughExchange(
                 dispatchOverride: oauthDispatch(request, parsed, "passthrough"),
                 providerName: route.providerName,
                 modelId: route.modelId,
+                accountAutoPause: (name, provider, headers) => captureAccountAutoPauseAttempt(name, provider, { config, codex: admissionState.authCtx }, headers),
                 onCodexWsQuota: codexWsQuotaObserver(admissionState.authCtx, route.provider, route.modelId),
                 beforeDispatch: isCanonicalOpenAiForwardProvider(route.provider)
                   ? createCodexAuthDispatchGuard(admissionState.authCtx, options.codexAuthPolicy ?? config, route.modelId, options.admission, options.visionDescribeTerminal === true) : undefined,
@@ -1608,18 +1614,7 @@ export async function preparePassthroughExchange(
         || captureAuthCtx.kind === "pool"
         || captureAuthCtx.kind === "main-pool",
     ): void => {
-      if (!isCanonicalOpenAiForwardProvider(route.provider)) return;
-      captureCodexAffinityDiagnostic({
-        inboundHeaders: req.headers,
-        outboundHeaders: captureRequest.headers,
-        authKind: captureAuthCtx.kind,
-        accountMode: route.codexAccountMode,
-        fixedAccount: isFixedCodexAccount(captureAuthCtx),
-        credentialSubstituted,
-        accountGatedModel: ACCOUNT_GATED_NATIVE_OPENAI_MODELS.has(route.modelId),
-        wireModelNormalized: parsed.modelId !== route.modelId,
-        status: response.status,
-      });
+      capturePassthroughAffinity(response, req.headers, captureRequest.headers, captureAuthCtx, route, parsed.modelId, credentialSubstituted);
     };
     recordDistributedResponseFailure(lastDistributedResponse ?? upstreamResponse, config, route.providerName, options.abortSignal);
     captureAffinityResponse(upstreamResponse);
@@ -1646,7 +1641,9 @@ export async function preparePassthroughExchange(
         options.abortSignal,
         parsed.modelId,
       );
-      if (model400Denial !== undefined) {
+      if (wasAccountAutoPaused(upstreamResponse)) {
+        poolRetryOutcome = upstreamResponse.status;
+      } else if (model400Denial !== undefined) {
         // Spend this refusal on more than one retry. It is the account's own authenticated
         // answer about this model, and the roster cache that selection otherwise reads expires
         // five minutes after a catalog sync fills it -- so without remembering this, the next
@@ -1679,7 +1676,7 @@ export async function preparePassthroughExchange(
         // ladder does have one — retrying the account the refreshed roster still grants — and
         // keeps it. An earlier revision also broke here on a non-400 outcome, which no test could
         // justify because this flag already produced the identical result.
-        const storedReplaySpent = codex401ReplayKind === "stored";
+        const storedReplaySpent = codex401ReplayKind === "stored" && !wasAccountAutoPaused(upstreamResponse);
         const retry = await retryCodexPoolOnAlternateAccount({
           callerAuthHeaders,
           config,
@@ -1698,7 +1695,7 @@ export async function preparePassthroughExchange(
           httpOnly: canonicalBufferedJson,
           preOutputRefusalHold: preOutputRefusalHold(),
           onResponse: (response, retryAuthCtx, retryRequest) => {
-            adoptCodexWsStage(response);
+            adoptCodexWsStage(response, logCtx);
             captureAffinityResponse(
               response,
               retryAuthCtx,
diff --git a/src/server/responses/passthrough-observations.ts b/src/server/responses/passthrough-observations.ts
new file mode 100644
index 00000000000..993501423fc
--- /dev/null
+++ b/src/server/responses/passthrough-observations.ts
@@ -0,0 +1,38 @@
+import { readCodexWsStage } from "./codex-ws-wire";
+import type { RequestLogContext } from "../request-log";
+
+/**
+ * #4191: a Codex WS exchange pins its content-free stage record on the
+ * Response it resolves (markCodexWsStage). Adopting the record here, at
+ * the single funnel every physical upstream response passes through,
+ * binds it to the attempt that actually served it — including the 502/504
+ * pre-response JSON settles that never reach the SSE relay.
+ */
+export function adoptCodexWsStage(response: Response, logCtx: RequestLogContext): void {
+  const stage = readCodexWsStage(response);
+  if (stage && logCtx.activeAttempt) logCtx.activeAttempt.codexWsStage = stage;
+}
+
+import type { CodexAuthContext } from "../../codex/auth-context";
+import type { RouteResult } from "../../router";
+import { captureCodexAffinityDiagnostic } from "../../codex/affinity-debug";
+import { ACCOUNT_GATED_NATIVE_OPENAI_MODELS } from "../../codex/catalog/native-models";
+import { isCanonicalOpenAiForwardProvider } from "../../providers/openai-tiers";
+import { isFixedCodexAccount } from "./core-codex-account";
+
+export function capturePassthroughAffinity(response: Response, inboundHeaders: Headers, outboundHeaders: Record<string, string>,
+  captureAuthCtx: CodexAuthContext, route: Pick<RouteResult, "provider" | "modelId" | "codexAccountMode">,
+  parsedModelId: string, credentialSubstituted: boolean): void {
+  if (!isCanonicalOpenAiForwardProvider(route.provider)) return;
+  captureCodexAffinityDiagnostic({
+    inboundHeaders: inboundHeaders,
+    outboundHeaders: outboundHeaders,
+    authKind: captureAuthCtx.kind,
+    accountMode: route.codexAccountMode,
+    fixedAccount: isFixedCodexAccount(captureAuthCtx),
+    credentialSubstituted,
+    accountGatedModel: ACCOUNT_GATED_NATIVE_OPENAI_MODELS.has(route.modelId),
+    wireModelNormalized: parsedModelId !== route.modelId,
+    status: response.status,
+  });
+}
diff --git a/src/server/responses/request-transport.ts b/src/server/responses/request-transport.ts
index 6f2f1987ce4..482b3f96b86 100644
--- a/src/server/responses/request-transport.ts
+++ b/src/server/responses/request-transport.ts
@@ -71,7 +71,7 @@ import {
   resolveCurrentProviderApiKeyTransport,
 } from "../../providers/api-key-selection";
 import { resolveAdapter, resolveWireProtocolOverride } from "../adapter-resolve";
-import { providerFetch, sendWithConnectionPolicy } from "./fetch-helpers";
+import { physicalSendObserverInit, providerFetch, sendWithConnectionPolicy } from "./fetch-helpers";
 import type { ProviderFetchOptions } from "./fetch-helpers";
 import { captureConfigGeneration } from "../../lib/state-store-sweeper";
 import { recordAnthropicAccountQuotaFromHeadersForInstance, hasPassiveAccountQuota } from "../../providers/quota";
@@ -80,6 +80,7 @@ import { formatErrorResponse } from "../../bridge";
 import { bindRouteReasoningReplayScope } from "./core-replay";
 import { sessionIdHeaderFromRequest, normalizeLogConversationId } from "../request-log-conversation";
 import { redactSecretString } from "../../lib/redact";
+import { captureAccountAutoPauseAttempt } from "../../oauth/account-auto-pause";
 import { selectProactiveApiKeyTransport } from "../../providers/key-failover";
 import { distributedKeyPhysicalFetch } from "../../providers/api-key-response-ownership";
 import { isCanonicalOpenAiForwardProvider } from "../../providers/openai-tiers";
@@ -612,6 +613,10 @@ export async function prepareResponsesTransport(
       // Pacing may outlive admission. Preserve local pause/cooldown reasons even when
       // a strict route rejects the old proposal before another bearer can be resolved.
       let candidate = servingOAuthSnapshot;
+      if (anthropicInstance === undefined && candidate && getAccountSet(route.providerName)?.accounts.find(row => row.id === candidate!.accountId)?.paused) {
+        oauthSelection = captureOAuthAccountSelection(route.providerName);
+        candidate = oauthSelection ? await getValidAccessSnapshotForAccount(route.providerName, oauthSelection.accountId, { requireUsableAccount: true }) : undefined;
+      }
       if (anthropicInstance !== undefined) {
         oauthSelection = captureOAuthAccountSelection(route.providerName);
         const accountId = await anthropicRouting!.resolveAnthropicDispatchAccountId(config, anthropicSessionKey, anthropicRouteDecision, route.modelId);
@@ -644,6 +649,24 @@ export async function prepareResponsesTransport(
     invalidateSameTargetRequest();
     return adapter;
   };
+  const recoverAutoPausedSelection = async (requestParsed: OcxParsedRequest): Promise<boolean> => {
+    if (route.provider.authMode === "forward") return false;
+    const available = route.provider.authMode === "oauth"
+      ? getAccountSet(route.providerName)?.accounts.some(row => !row.paused && !row.needsReauth)
+      : !!config.providers[route.providerName]?.apiKey;
+    if (!available) return false;
+    await refreshDispatchAdapter(requestParsed);
+    // Bind before the recovery caller rebuilds. A terminal retry can be a clone;
+    // the outer request also owns continuation persistence and replay publication.
+    for (const replayParsed of new Set([parsed, requestParsed])) {
+      bindRouteReasoningReplayScope({
+        parsed: replayParsed, providerName: route.providerName, provider: route.provider,
+        adapterName: activeAdapter.name, oauthCredentialSnapshot: replayOAuthCredentialSnapshot,
+        forwardHeaders: requestState.selectedForwardHeaders,
+      });
+    }
+    return true;
+  };
   const refreshRunTurnAdapter = async (requestParsed: OcxParsedRequest): Promise<ProviderAdapter> => {
     requestParsed._cursorIdentityScope = undefined;
     requestParsed._cursorConversationId = undefined;
@@ -704,6 +727,7 @@ export async function prepareResponsesTransport(
           providerName: route.providerName, modelId: route.modelId, pacingSlotAcquired: true,
           pacingSlot: attemptSlot,
           turnScopedPacing: true,
+          accountAutoPause: (name, provider, headers) => captureAccountAutoPauseAttempt(name, provider, { config, oauth: binding?.kind === "oauth" ? binding.snapshot : undefined }, headers),
           beforeDispatch: beforePhysicalSend,
         });
         await run(requestParsed, { ...incoming, pacingSlot: attemptSlot, providerFetch: fetch, beforePhysicalSend }, event => { if (!refused) emit(event); });
@@ -756,6 +780,8 @@ export async function prepareResponsesTransport(
           // apply a host-scoped decision to a different host.
           const releaseFamily = snapshot ? anthropicQuota!.claimAnthropicFamilyRevalidation(snapshot.accountId, route.modelId) : () => {};
           if (!releaseFamily) throw new AnthropicAccountCooldownError(1);
+          const observeAutoPause = captureAccountAutoPauseAttempt(route.providerName, binding?.kind === "api-key" ? binding.provider : route.provider,
+            { config, oauth: binding?.kind === "oauth" ? binding.snapshot : undefined }, new Headers(dispatchInit.headers));
           let response: Response;
           let physicalOwner: AnthropicPhysicalSendOwnership | null = null;
           try {
@@ -775,7 +801,8 @@ export async function prepareResponsesTransport(
             response = await sendWithConnectionPolicy(
               distributedKeyPhysicalFetch(anthropicBillingPhysicalFetch(fetchImpl, route.providerName, route.provider), route.providerName, route.provider, target),
               destination,
-              { ...dispatchInit, redirect: "manual" },
+              { ...dispatchInit, redirect: "manual",
+                ...physicalSendObserverInit(observeAutoPause, destination instanceof Request ? destination.url : String(destination)) },
               { providerName: route.providerName, provider: route.provider },
             );
           } finally { releaseFamily(); }
@@ -795,6 +822,7 @@ export async function prepareResponsesTransport(
             } catch { /* best-effort observation cannot fail the response */ }
           }
           if (!response.ok) await recordKeyAttemptFailure(logCtx, response, dispatchInit.signal ?? options.abortSignal);
+          if (observeAutoPause) response = await observeAutoPause(response);
           return response;
         }
         let nextAdapter: ProviderAdapter;
@@ -1280,6 +1308,7 @@ export async function prepareResponsesTransport(
     oauthDispatch,
     noteRoutedAttemptSend,
     commitKeyAttemptSend,
+    recoverAutoPausedSelection,
     bindKeyUsageFromBridge,
     anthropicSessionKey,
     isPassthrough,
diff --git a/src/types/account-auto-pause.ts b/src/types/account-auto-pause.ts
new file mode 100644
index 00000000000..001c66aebfa
--- /dev/null
+++ b/src/types/account-auto-pause.ts
@@ -0,0 +1,15 @@
+export const ACCOUNT_PAUSE_REASONS = [
+  "oauth_organization_disabled", "account_permission_denied", "subscription_inactive",
+  "subscription_expired", "plan_downgraded",
+] as const;
+export type AccountPauseReason = typeof ACCOUNT_PAUSE_REASONS[number];
+export interface AccountPauseDetails {
+  reason: AccountPauseReason;
+  pausedAt: number;
+}
+export interface AccountAutoPausePolicy {
+  /** Explicit opt-in. Omitted and false both leave account eligibility unchanged. */
+  enabled?: boolean;
+  /** Consecutive permanent refusals; defaults to 2. */
+  consecutiveFailures?: number;
+}
diff --git a/src/types/config.ts b/src/types/config.ts
index cc7e6346524..d79173a4373 100644
--- a/src/types/config.ts
+++ b/src/types/config.ts
@@ -1113,6 +1113,9 @@ export interface OcxConfig {
   codexAccounts?: CodexAccount[];
   /** Account ids administratively excluded from future pool selection until resumed. */
   pausedCodexAccountIds?: string[];
+  /** Internal policy epochs; null marks malformed disk input and suppresses automatic pause. */
+  accountAutoPausePolicyRevisions?: Record<string, string> | null;
+  codexAccountPauseState?: Record<string, { revision: string; details?: import("./account-auto-pause").AccountPauseDetails }>;
   /**
    * Account ids, `__main__` included, allowed to keep serving from ChatGPT credits once one of
    * their usage windows is full. Every other account is skipped by selection at 100% until its
diff --git a/src/types/provider.ts b/src/types/provider.ts
index 2a94ae0a52e..6d445d0bb12 100644
--- a/src/types/provider.ts
+++ b/src/types/provider.ts
@@ -1,4 +1,5 @@
 import type { UpstreamHttpVersion, ReasoningSummaryDelivery, CodexAccountMode } from "./wire";
+import type { AccountAutoPausePolicy, AccountPauseDetails } from "./account-auto-pause";
 import type { AnthropicAccountPoolConfig } from "./anthropic-account-pool";
 
 /**
@@ -567,7 +568,9 @@ export interface OcxProviderConfig {
    * entry so routing stays single-key; managed via /api/providers/keys. A legacy bare
    * `apiKey` seeds a one-entry pool on first management touch.
    */
-  apiKeyPool?: Array<{ id: string; key: string; label?: string; addedAt?: number }>;
+  apiKeyPool?: Array<{ id: string; key: string; label?: string; addedAt?: number; disabled?: boolean; pauseDetails?: AccountPauseDetails; pauseRevision?: string }>;
+  /** Explicit opt-in permanent account refusal policy; default off. */
+  accountAutoPause?: AccountAutoPausePolicy;
   /**
    * Optional proactive ordering for `apiKeyPool` when the committed key is already
    * cooling. Deliberately NOT named like the OAuth `accountPoolStrategy`: an API key
diff --git a/structure/INDEX.md b/structure/INDEX.md
index fbb9ab1c7a9..cd2055dd2d8 100644
--- a/structure/INDEX.md
+++ b/structure/INDEX.md
@@ -37,6 +37,7 @@ Persisted config, the Codex home it writes into, and the model catalog it publis
 | [`subagent-capacity.md`](subagent-capacity.md) | Surface mode, hybrid global flag, concurrent child limits and canonical Codex setting ownership. |
 | [`advisor.md`](advisor.md) | The optional expert consultation sidecar: manual/preflight/adaptive policies, evidence, durable task allowance, metadata activity, and loopback routing. |
 | [`config-proxy.md`](config-proxy.md) | Global proxy activation, start flags, and credential-safe CLI output. |
+| [`account-auto-pause.md`](account-auto-pause.md) | Opt-in permanent account refusal classification, credential fences, durable pause metadata, bounded recovery and resume. |
 
 ### Tier 3 — Data planes and transports
 
@@ -152,7 +153,9 @@ A source area can be described by more than one doc, because these docs are orga
 | `desktop/ui/cli.js` | [`desktop-terminal-command.md`](desktop-terminal-command.md) |
 | `docs-site/` | [`ops/docs-and-release.md`](ops/docs-and-release.md) |
 | `gui/` | [`overview.md`](overview.md)<br>[`transports/native-reasoning-retention.md`](transports/native-reasoning-retention.md)<br>[`gui-and-management-api.md`](gui-and-management-api.md)<br>[`dashboard-and-usage.md`](dashboard-and-usage.md)<br>[`design-methodology.md`](design-methodology.md)<br>[`companion.md`](companion.md) |
+| `gui/src/account-pause-display.ts` | [`account-auto-pause.md`](account-auto-pause.md) |
 | `gui/src/components/ModelPriceDialog.tsx` | [`pricing.md`](pricing.md) |
+| `gui/src/hooks/useProviderAccountPools.ts` | [`account-auto-pause.md`](account-auto-pause.md) |
 | `scripts/` | [`overview.md`](overview.md)<br>[`ops/docs-and-release.md`](ops/docs-and-release.md) |
 | `scripts/generate-ocx-skill-surface.ts` | [`cli-management.md`](cli-management.md) |
 | `skills/ocx/` | [`cli-management.md`](cli-management.md) |
@@ -175,6 +178,7 @@ A source area can be described by more than one doc, because these docs are orga
 | `src/client/` | [`runtime.md`](runtime.md)<br>[`clients/claude-desktop.md`](clients/claude-desktop.md) |
 | `src/clients/` | [`clients/integrations.md`](clients/integrations.md)<br>[`clients/qoder.md`](clients/qoder.md) |
 | `src/codex/` | [`runtime.md`](runtime.md)<br>[`config.md`](config.md)<br>[`codex-home.md`](codex-home.md)<br>[`codex-prompts.md`](codex-prompts.md)<br>[`catalog.md`](catalog.md)<br>[`subagents.md`](subagents.md)<br>[`subagent-capacity.md`](subagent-capacity.md)<br>[`transports/responses-failover.md`](transports/responses-failover.md)<br>[`providers/openai-tiers.md`](providers/openai-tiers.md)<br>[`providers/openai-accounts.md`](providers/openai-accounts.md)<br>[`gui-and-management-api.md`](gui-and-management-api.md)<br>[`dashboard-and-usage.md`](dashboard-and-usage.md)<br>[`clients/codex-desktop.md`](clients/codex-desktop.md)<br>[`clients/chatgpt-desktop.md`](clients/chatgpt-desktop.md)<br>[`ops/docs-and-release.md`](ops/docs-and-release.md) |
+| `src/codex/account-pause.ts` | [`account-auto-pause.md`](account-auto-pause.md) |
 | `src/codex/account-preservation.ts` | [`providers/openai-signed-in-preservation.md`](providers/openai-signed-in-preservation.md) |
 | `src/codex/app-server-processes.ts` | [`codex-cli-update.md`](codex-cli-update.md) |
 | `src/codex/auth-api/account-preservation.ts` | [`providers/openai-signed-in-preservation.md`](providers/openai-signed-in-preservation.md) |
@@ -193,8 +197,10 @@ A source area can be described by more than one doc, because these docs are orga
 | `src/compatibility/` | [`runtime.md`](runtime.md)<br>[`adapters/compatibility-contracts.md`](adapters/compatibility-contracts.md) |
 | `src/config.ts` | [`overview.md`](overview.md)<br>[`runtime.md`](runtime.md)<br>[`config.md`](config.md)<br>[`providers/openai-accounts.md`](providers/openai-accounts.md) |
 | `src/config/` | [`runtime.md`](runtime.md)<br>[`config.md`](config.md)<br>[`transports/native-reasoning-retention.md`](transports/native-reasoning-retention.md) |
+| `src/config/account-auto-pause-revisions.ts` | [`account-auto-pause.md`](account-auto-pause.md) |
 | `src/config/live-reconcile.ts` | [`pricing.md`](pricing.md) |
 | `src/config/persisted-mutation.ts` | [`runtime.md`](runtime.md) |
+| `src/config/schema/account-auto-pause.ts` | [`account-auto-pause.md`](account-auto-pause.md) |
 | `src/config/schema/leaf-validators.ts` | [`pricing.md`](pricing.md) |
 | `src/generated/` | [`runtime.md`](runtime.md) |
 | `src/github/` | [`runtime.md`](runtime.md) |
@@ -204,12 +210,16 @@ A source area can be described by more than one doc, because these docs are orga
 | `src/integrations/` | [`clients/integrations.md`](clients/integrations.md)<br>[`clients/qoder.md`](clients/qoder.md) |
 | `src/lab/` | [`runtime.md`](runtime.md)<br>[`adapters/compatibility-lab.md`](adapters/compatibility-lab.md) |
 | `src/lib/` | [`overview.md`](overview.md)<br>[`runtime.md`](runtime.md)<br>[`transports/byte-accounting.md`](transports/byte-accounting.md)<br>[`transports/responses-wire-shapes.md`](transports/responses-wire-shapes.md)<br>[`transports/responses-failover.md`](transports/responses-failover.md)<br>[`transports/responses-spend.md`](transports/responses-spend.md)<br>[`transports/inventory.md`](transports/inventory.md)<br>[`gui-and-management-api.md`](gui-and-management-api.md)<br>[`dashboard-and-usage.md`](dashboard-and-usage.md)<br>[`clients/integrations.md`](clients/integrations.md)<br>[`ops/service-and-sidecars.md`](ops/service-and-sidecars.md)<br>[`ops/docs-and-release.md`](ops/docs-and-release.md) |
+| `src/lib/account-auto-pause-response.ts` | [`account-auto-pause.md`](account-auto-pause.md) |
 | `src/lib/advisor-activation.ts` | [`advisor.md`](advisor.md) |
 | `src/lib/gui-pair-intent.ts` | [`remote-link.md`](remote-link.md) |
 | `src/lib/windows-owner-acl.ts` | [`remote-link.md`](remote-link.md) |
 | `src/link/` | [`remote-link.md`](remote-link.md) |
 | `src/messaging/` | [`local-messaging.md`](local-messaging.md) |
 | `src/oauth/` | [`providers/generic-account-pool.md`](providers/generic-account-pool.md)<br>[`runtime.md`](runtime.md)<br>[`transports/inventory.md`](transports/inventory.md)<br>[`providers/anthropic-account-thresholds.md`](providers/anthropic-account-thresholds.md)<br>[`providers/oauth-reconciliation.md`](providers/oauth-reconciliation.md)<br>[`providers-and-adapters.md`](providers-and-adapters.md)<br>[`providers/anthropic-account-pool.md`](providers/anthropic-account-pool.md)<br>[`providers/oauth-code-display-login.md`](providers/oauth-code-display-login.md)<br>[`providers/xai-grok.md`](providers/xai-grok.md) |
+| `src/oauth/account-auto-pause-policy.ts` | [`account-auto-pause.md`](account-auto-pause.md) |
+| `src/oauth/account-auto-pause.ts` | [`account-auto-pause.md`](account-auto-pause.md) |
+| `src/oauth/api-key-pool-preserve.ts` | [`account-auto-pause.md`](account-auto-pause.md) |
 | `src/oauth/dsh.ts` | [`providers/dsh-account.md`](providers/dsh-account.md) |
 | `src/oauth/login-cli.ts` | [`providers/meta-muse.md`](providers/meta-muse.md) |
 | `src/oauth/meta-muse-errors.ts` | [`providers/meta-muse.md`](providers/meta-muse.md) |
@@ -221,6 +231,7 @@ A source area can be described by more than one doc, because these docs are orga
 | `src/providers/anthropic-billing-ownership.ts` | [`providers/anthropic-key-billing.md`](providers/anthropic-key-billing.md) |
 | `src/providers/anthropic-billing-recovery.ts` | [`providers/anthropic-key-billing.md`](providers/anthropic-key-billing.md) |
 | `src/providers/anthropic-billing-refusal.ts` | [`providers/anthropic-key-billing.md`](providers/anthropic-key-billing.md) |
+| `src/providers/api-key-pause.ts` | [`account-auto-pause.md`](account-auto-pause.md) |
 | `src/providers/dsh-account-destination.ts` | [`providers/dsh-account.md`](providers/dsh-account.md) |
 | `src/providers/quota/anthropic-account-quota.ts` | [`providers/anthropic-account-pool.md`](providers/anthropic-account-pool.md) |
 | `src/providers/quota/dsh-account.ts` | [`providers/dsh-account.md`](providers/dsh-account.md) |
@@ -242,9 +253,11 @@ A source area can be described by more than one doc, because these docs are orga
 | `src/server/management/anthropic-pool-settings.ts` | [`providers/anthropic-account-pool.md`](providers/anthropic-account-pool.md) |
 | `src/server/management/companion-routes.ts` | [`desktop-shell.md`](desktop-shell.md) |
 | `src/server/management/model-routes.ts` | [`pricing.md`](pricing.md) |
+| `src/server/responses/account-auto-pause-recovery.ts` | [`account-auto-pause.md`](account-auto-pause.md) |
 | `src/server/responses/advisor-plan-slot.ts` | [`advisor.md`](advisor.md) |
 | `src/server/responses/advisor-slot.ts` | [`advisor.md`](advisor.md) |
 | `src/server/responses/anthropic-thinking-recovery.ts` | [`transports/anthropic-thinking-recovery.md`](transports/anthropic-thinking-recovery.md) |
+| `src/server/responses/request-transport.ts` | [`account-auto-pause.md`](account-auto-pause.md) |
 | `src/service-manager-probe.ts` | [`ops/service-and-sidecars.md`](ops/service-and-sidecars.md) |
 | `src/service.ts` | [`runtime.md`](runtime.md)<br>[`ops/docs-and-release.md`](ops/docs-and-release.md) |
 | `src/service/` | [`runtime.md`](runtime.md) |
@@ -263,6 +276,7 @@ A source area can be described by more than one doc, because these docs are orga
 | `src/tray/` | [`runtime.md`](runtime.md) |
 | `src/types.ts` | [`runtime.md`](runtime.md)<br>[`config.md`](config.md) |
 | `src/types/` | [`providers/generic-account-pool.md`](providers/generic-account-pool.md)<br>[`transports/native-reasoning-retention.md`](transports/native-reasoning-retention.md)<br>[`providers/anthropic-progress.md`](providers/anthropic-progress.md)<br>[`providers-and-adapters.md`](providers-and-adapters.md) |
+| `src/types/account-auto-pause.ts` | [`account-auto-pause.md`](account-auto-pause.md) |
 | `src/types/provider.ts` | [`pricing.md`](pricing.md) |
 | `src/update/` | [`runtime.md`](runtime.md)<br>[`ops/service-and-sidecars.md`](ops/service-and-sidecars.md) |
 | `src/update/job-supervised-restart.ts` | [`ops/update-supervised-recovery.md`](ops/update-supervised-recovery.md) |
diff --git a/structure/account-auto-pause.md b/structure/account-auto-pause.md
new file mode 100644
index 00000000000..4d3a29ffb43
--- /dev/null
+++ b/structure/account-auto-pause.md
@@ -0,0 +1,112 @@
+# Account Auto-Pause
+
+Opt-in policy, credential ownership, durable pause metadata, and bounded recovery for
+permanent account refusals. Counters are process-local; persisted pauses require explicit resume.
+
+## Opt-in account refusal observation
+
+`src/server/responses/fetch-helpers.ts` accepts an optional caller-owned observer factory for physical
+Codex/runTurn response observation; the transport leaf imports no account or OAuth policy. OAuth/key HTTP overrides capture after reselection in
+`src/server/responses/request-transport.ts`; native Chat/Messages capture at their send
+boundaries. `src/oauth/account-auto-pause.ts` is dormant unless the named provider explicitly
+enables the policy, writes only fixed pause metadata, and preserves upstream responses if
+optional persistence fails. Counters and asynchronous decisions belong to the runtime
+config object; completed pauses belong to the existing durable account stores. A response is counted only when the final destination and credential
+headers, reported by `sendWithConnectionPolicy` after plugin rewrites and queued rebuilds, match the
+captured attempt; a Codex WebSocket send has no HTTP final-send report and counts only when no
+plugin upstream rewriter was registered at capture and the registration epoch in
+`src/plugins/upstream-hooks.ts` is unchanged when the response arrives. Nested capture sites that see the same physical response count it once
+per account, and an observer without a final-send report never attributes a response another
+observer had reported. Regression coverage:
+`tests/responses/responses-account-auto-pause-wire-owner.test.ts`.
+
+## Permanent account refusal policy
+
+`providers.<name>.accountAutoPause` is optional, default off, with an integer
+`consecutiveFailures` in 1–100 (default 2). `src/config/schema/account-auto-pause.ts` validates
+the policy and allowlisted reason/timestamp DTO. OAuth pause metadata is stored with the
+auth row; Codex metadata/revision fences use `codexAccountPauseState`; key pools retain
+`disabled`, `pauseDetails` and `pauseRevision` per entry. Runtime counters are process-local.
+Manual resume clears details and changes the revision, fencing already-sent refusals.
+
+## Opt-in permanent refusal recovery
+
+`src/server/responses/request-transport.ts` observes exact physical account outcomes before
+retry wrappers replace the response. Threshold-triggered OAuth/key pauses rebuild the
+request through `src/server/responses/account-auto-pause-recovery.ts` and the existing selection owner, with at most three account moves funded by the existing recovery owner. Before rebuilding, the transport binds replay and continuation ownership to the refreshed credential on both the retry request and the outer request used for persistence.
+`src/server/responses/passthrough-dispatch.ts` and
+`src/server/responses/core-codex-account.ts` admit a confirmed Codex auto-pause to the
+existing alternate-account ladder without reclassifying subscription refusal as a dead
+credential. `src/server/responses/compact.ts` observes the same pool contexts; custom gateway sends stay outside Codex pool outcome recording and recovery. Fixed
+account selectors and uploaded-file constraints continue to suppress alternate moves.
+
+## Permanent account refusal auto-pause
+
+`src/oauth/account-auto-pause.ts` captures the exact sending OAuth snapshot, Codex context
+or API-key selection and validates outgoing credential headers before observing a response.
+`src/oauth/account-auto-pause-policy.ts` recognizes whole account-scoped 401/403 messages,
+serializes response-arrival decisions, resets on accepted HTTP responses, and excludes
+transient/quota/model/request failures. No provider body or account identifier enters its log.
+The opt-in counter defaults to two refusals; each process owns its counters. Durable pause
+uses `setAccountPaused`, `setCodexAccountPaused`, or
+`src/providers/api-key-pause.ts`; resume changes an incarnation fence and clears the reason.
+API-key selectors and reactive/proactive failover exclude disabled pool entries, including request-local round-robin allocation. A distributed refusal pauses its exact sending entry even when a different key is active, under the existing selection-revision fence. Recovery allocates a healthy sibling and reacquires its pacing lease before dispatch.
+Regression coverage: `tests/oauth/oauth-account-auto-pause.test.ts` and
+`tests/responses/responses-account-auto-pause.test.ts` and `tests/providers/api-key-auto-pause-distribution.test.ts`.
+
+## Policy-change fence
+
+`src/config/account-auto-pause-revisions.ts` keeps `accountAutoPausePolicyRevisions`, a per-provider
+UUID that changes whenever a tracked provider's effective policy fingerprint changes (policy enabled,
+threshold, provider disabled, base URL, adapter, auth mode). A provider is tracked once it has ever
+configured `accountAutoPause`; providers that never opted in leave no map in the file. Only
+`persistConfigUnlocked` mints values, from the literal pre-write file, so caller-supplied revisions never
+authorize anything. Each process also keeps an observed map with a local generation, bumped on
+fingerprint changes adopted by reload and save-time reconciliation, and on disk-to-disk changes seen
+by any load; a detached load never compares itself with the live fingerprint. A capture records
+the revision, generation, threshold and route. A pause commits only while all of these are still
+equal, both in memory and in the fresh persisted file inside the config mutation lock. The OAuth
+automatic commit runs its final check and auth publication under that lock, and contention means
+no pause. API-key commits use the same disk check in their selection mutation, and Codex commits
+check it beside `src/codex/account-pause.ts` state. Revision records exist only for providers present after disk-only provider
+preservation: deleting a provider reclaims its record, and both the persisted and the observed
+maps stay bounded by the provider list. Every new observed record and every generation advance draws
+from one process-wide counter, so a deleted and recreated provider can never reproduce an older
+attempt's fence. Once a config path has been observed, a capture never seeds a missing name from
+the caller's config object: only load, reload or save adoption can enroll it, so a stale live config
+cannot re-enroll a provider an observation deleted. A raw legacy delete and identical recreate that no load observes stays undetectable.
+Codex pool ownership binds the bearer, the `chatgpt-account-id` workspace and any organization or
+project selector at capture and in the final-send report. A malformed map suppresses automatic pause
+until the next valid write mints fresh revisions. A raw editor that bypasses the lock and finishes a
+disable/re-enable between two observations stays undetectable.
+Regression coverage: `tests/oauth/oauth-account-auto-pause-revision.test.ts` and
+`tests/config/config-account-auto-pause-revisions.test.ts`.
+
+## Auto-paused account recovery
+
+OAuth and Codex account-list DTOs project optional `pauseDetails` (fixed reason plus epoch
+ms timestamp) beside the existing pause flag. The CLI preserves those fields and includes
+the reason in account listings. `src/server/management/oauth-account-routes.ts` also serves
+`PUT /api/providers/keys/pause` with provider `name`, key `id` and boolean `paused`, through
+the existing management authorization boundary. Key listings expose `disabled` and pause
+details. OAuth upserts for dual-auth providers keep validated key pause fields through
+`src/oauth/api-key-pool-preserve.ts` and never promote a paused key to the active key. Dashboard key Resume clears the pause through that endpoint before activating
+the key; OAuth/Codex keep their existing resume actions.
+`src/server/management/route-registry.ts` declares key pause as an ordinary management mutation,
+covered by the existing account pause/resume CLI capabilities. Responses recovery and passthrough
+observation owners are included in `tests/helpers/responses-core-source.ts`; its graph guard checks
+inventory coverage, physical line limits, and acyclic dependencies including type-only imports.
+
+## Permanent refusal pause indicators
+
+`gui/src/components/provider-workspace/ProviderAuthPanel.tsx` and
+`gui/src/components/codex-account-pool-cards.tsx` expose fixed auto-pause reason and timestamp
+on Paused badges; `gui/src/account-pause-display.ts` translates the reason and formats the
+timestamp with the app locale. Disabled key rows offer Resume through their existing selection action;
+`gui/src/hooks/useProviderAccountPools.ts` resumes before activation, then refreshes the
+roster under its existing selection-mutation fence. No upstream error body is displayed.
+
+`src/lib/account-auto-pause-response.ts` registers process-local pause/refusal provenance with the pacing owner and retains it when
+adapter error normalization or a leased pacing-body rewrap replaces a response, without exposing metadata in HTTP headers.
+
+`src/types/account-auto-pause.ts` owns the policy and fixed pause-reason DTO vocabulary.
diff --git a/structure/config.md b/structure/config.md
index e00cfec7524..76680c0ba06 100644
--- a/structure/config.md
+++ b/structure/config.md
@@ -24,7 +24,7 @@ Native main reauthentication follows the [CLI JSON output contract](runtime.md#n
 The Codex restart command follows the [CLI restart scope contract](runtime.md#cli-codex-restart-scope).
 
 `src/cli/account-orca-import.ts` exposes an explicit-source, preview-first local import command. Apply adds pool configuration under the shared mutation lock;
-the [source-owned credential contract](codex-home.md#orca-source-owned-account-import) governs deduplication and credential storage separately from Codex config injection.
+the [source-owned credential contract](codex-home.md#orca-source-owned-account-import) governs deduplication and credential storage separately from Codex config injection. See [permanent refusal auto-pause](account-auto-pause.md).
 
 ## Config surface
 Custom Responses providers may declare independent boolean `supportsNativeCompactionTrigger` and `supportsNativeCompactEndpoint` capabilities in `src/config/schema/leaf-validators.ts`; absence remains off. They do not imply `decodesNativeCompactionBlobs`, official identity, or credential authority; custom native v1 key/local/forward replay enforces the separate blob capability and known serving-identity changes, while OAuth retains routed credential resolution. The native gateway contract and regression are in [Responses transport](transports/responses.md) and `tests/responses/native-compaction-gateway.test.ts`.
diff --git a/structure/dashboard-and-usage.md b/structure/dashboard-and-usage.md
index e4023469732..438eddbf7b9 100644
--- a/structure/dashboard-and-usage.md
+++ b/structure/dashboard-and-usage.md
@@ -13,7 +13,7 @@ Codex quota cards consume the display cache from `src/codex/quota.ts`. Partial r
 omitted short tuples after their reset deadline; validated main-window absence also removes
 future-reset short tuples. Main-account hard-lock evidence and reset-notification history follow
 separate retention rules in
-[OpenAI account modes](providers/openai-tiers.md#quota-cache-and-short-window-history).
+[OpenAI account modes](providers/openai-tiers.md#quota-cache-and-short-window-history). See [permanent refusal auto-pause](account-auto-pause.md).
 Codex account panels expose no Spark quota toggle or setting and retain quota refresh, pause/resume, selection order, reset-credit confirmation and Advanced settings; account/provider quota DTOs suppress retired windows upstream of the generic quota renderer, under [OpenAI quota scopes](providers/openai-tiers.md#public-provider-contract).
 
 ## Dashboard surfaces
diff --git a/structure/gui-and-management-api.md b/structure/gui-and-management-api.md
index d9f8afa5a83..d1ce4425d14 100644
--- a/structure/gui-and-management-api.md
+++ b/structure/gui-and-management-api.md
@@ -4,7 +4,7 @@ Provider PUT, POST and DELETE in `src/server/management/provider-routes.ts` run
 `autoSwitchThreshold` (pool default) and `effectiveAutoSwitchThreshold`. The dedicated
 `PUT /api/oauth/accounts/auto-switch` accepts `{ provider: "anthropic", accountId, threshold }`;
 explicit null restores inheritance and missing/invalid values fail. Other providers are rejected.
-`src/server/management/anthropic-account-threshold.ts` validates; the auth store serializes writes.
+`src/server/management/anthropic-account-threshold.ts` validates; the auth store serializes writes. See [permanent refusal auto-pause](account-auto-pause.md).
 CLI `ocx account auto-switch anthropic` requires `--account <id>` with status, inherit, on, off or
 threshold. The dashboard reuses `AccountAutoSwitchControl` below account actions, retaining
 focus/draft semantics and translated copy. The hook protects same-provider selection mutations
diff --git a/structure/manifest.json b/structure/manifest.json
index 2c26f539809..ea48ed597b9 100644
--- a/structure/manifest.json
+++ b/structure/manifest.json
@@ -908,6 +908,27 @@
       "documents": [
         "tests/"
       ]
+    },
+    {
+      "path": "account-auto-pause.md",
+      "tier": 2,
+      "title": "Account Auto-Pause",
+      "scope": "Opt-in permanent account refusal classification, credential fences, durable pause metadata, bounded recovery and resume.",
+      "documents": [
+        "src/oauth/account-auto-pause.ts",
+        "src/oauth/account-auto-pause-policy.ts",
+        "src/providers/api-key-pause.ts",
+        "src/types/account-auto-pause.ts",
+        "src/lib/account-auto-pause-response.ts",
+        "src/server/responses/request-transport.ts",
+        "src/server/responses/account-auto-pause-recovery.ts",
+        "src/codex/account-pause.ts",
+        "src/config/schema/account-auto-pause.ts",
+        "gui/src/hooks/useProviderAccountPools.ts",
+        "src/config/account-auto-pause-revisions.ts",
+        "src/oauth/api-key-pool-preserve.ts",
+        "gui/src/account-pause-display.ts"
+      ]
     }
   ],
   "contracts": {
diff --git a/structure/providers-and-adapters.md b/structure/providers-and-adapters.md
index 6fc19e30b8a..41dd2480154 100644
--- a/structure/providers-and-adapters.md
+++ b/structure/providers-and-adapters.md
@@ -281,7 +281,7 @@ Cursor, one lease spans the whole turn: RunSSE and BidiAppend may overlap inside
 turns wait at the cap. Follow-up sends still obey start intervals. The turn owner returns its lease
 after `runTurn` settles, so RunSSE body completion cannot admit another turn early. A capped
 canonical Codex WebSocket turn uses HTTP/SSE because the socket has no response-body lifecycle.
-Capacity waits use the same bounded queue and retryable queue-overload errors as interval waits. Optional `requestPacing.keys` adds a shared cross-model limit for each credential reference; duplicate references share capacity, but distinct references resolving to one upstream project do not imply separate quota. `keySelection: round-robin` assigns request-local healthy keys without mutating persisted selection, skips known cooldowns, and refuses exhausted pools with retryable 429. Provider, model and key gates reserve atomically; key counters and the allocation cursor are process-local, not token or billing balances. OAuth and forwarded credentials retain their existing selection. Cooldown state is shared through the dependency-light `src/providers/api-key-cooldowns.ts` (retaining the longest outstanding expiry until explicit manual clearing) owner. Distributed selections are checked again at physical dispatch; a cooled queued key releases its old permit, selects a healthy sibling, and reacquires pacing before sending. Native Messages follows the same readmission rule. Native Responses, compact, Chat and Messages settle distributed refusals from immutable credential and destination metadata captured by `src/providers/api-key-response-ownership.ts` at physical fetch; successful same-key retry and unowned refusals do not cool keys. Failure ownership remains valid for a still-configured cooling key, so late in-flight rejections retain the longest cooldown without admitting another send. CLI-backed adapters check `IncomingMeta.beforePhysicalSend` after asynchronous setup and before spawn. An established distributed turn refuses later sends after its key cools instead of changing credentials mid-turn.
+Capacity waits use the same bounded queue and retryable queue-overload errors as interval waits. Optional `requestPacing.keys` adds a shared cross-model limit for each credential reference; duplicate references share capacity, but distinct references resolving to one upstream project do not imply separate quota. `keySelection: round-robin` assigns request-local healthy keys without mutating persisted selection, skips disabled entries (including keys paused by [permanent refusal auto-pause](account-auto-pause.md)) and known cooldowns, and refuses exhausted pools with retryable 429. Provider, model and key gates reserve atomically; key counters and the allocation cursor are process-local, not token or billing balances. OAuth and forwarded credentials retain their existing selection. Cooldown state is shared through the dependency-light `src/providers/api-key-cooldowns.ts` (retaining the longest outstanding expiry until explicit manual clearing) owner. Distributed selections are checked again at physical dispatch; a cooled queued key releases its old permit, selects a healthy sibling, and reacquires pacing before sending. Native Messages follows the same readmission rule. Native Responses, compact, Chat and Messages settle distributed refusals from immutable credential and destination metadata captured by `src/providers/api-key-response-ownership.ts` at physical fetch; successful same-key retry and unowned refusals do not cool keys. Failure ownership remains valid for a still-configured cooling key, so late in-flight rejections retain the longest cooldown without admitting another send. CLI-backed adapters check `IncomingMeta.beforePhysicalSend` after asynchronous setup and before spawn. An established distributed turn refuses later sends after its key cools instead of changing credentials mid-turn.
 
 Command Code effort defaults in `src/providers/command-code-efforts.ts` combine public-profile
 facts with the live API measurements from #5096. Both presets share the exact per-model rows;
diff --git a/structure/providers/anthropic-account-pool.md b/structure/providers/anthropic-account-pool.md
index 1981b3a9261..6f1eb5b579a 100644
--- a/structure/providers/anthropic-account-pool.md
+++ b/structure/providers/anthropic-account-pool.md
@@ -461,3 +461,12 @@ reload and are not represented as a successful save. The GUI checkbox is a saved
 than a promise that a route is eligible; explicit rollout opt-outs still apply.
 
 The shared conversation-key precedence is implemented by `src/oauth/session-affinity-key.ts` and re-exported as `anthropicSessionKeyFromParts`; Anthropic routing semantics remain owned here. [Generic OAuth affinity](generic-account-pool.md#conversation-affinity) uses independent request-local receipts.
+
+## Permanent refusal auto-pause
+
+The separate `providers.<instance>.accountAutoPause` policy is default off. Physical
+Responses and native Messages sends observe their captured bearer before recovery. Exact
+organization/OAuth or subscription refusals can persist `pauseDetails` with a fixed reason
+and timestamp through `src/oauth/store.ts`. `pauseRevision` changes on resume, so late
+pre-resume responses cannot pause the resumed account. The existing selectors rebuild an
+eligible sibling within their send budgets; proactive-pool activation is not required.
diff --git a/structure/providers/openai-accounts.md b/structure/providers/openai-accounts.md
index bce47e46292..e07ab88928f 100644
--- a/structure/providers/openai-accounts.md
+++ b/structure/providers/openai-accounts.md
@@ -585,3 +585,14 @@ replacement drops that window's warning. Main/all quota cleanup forgets the base
 expire at reset or six hours after detection. Main-card/settings DTOs and live CLI projections expose
 only window kind, previous/current percentage and observation time; the notice says possible usage
 outside opencodex because a long-running request can also explain the rise.
+
+## Permanent refusal auto-pause
+
+The opt-in `providers.openai.accountAutoPause` observer in
+`src/oauth/account-auto-pause.ts` uses the sent pool credential generation or main quota
+writer, not the active account at response time. It persists exclusions in
+`pausedCodexAccountIds` with revision/reason/time in `codexAccountPauseState`, clears
+affinities and reconciles selection. `src/codex/account-pause.ts` changes the revision
+on resume. The physical guard in `src/codex/auth-context.ts` also rejects newly paused
+queued sends. Confirmed permanent refusals preserve credentials instead of forcing token
+refresh; threshold-triggered retries retain fixed-selector, file and send-budget guards.
diff --git a/structure/transports/responses-failover.md b/structure/transports/responses-failover.md
index 4116d06a62c..ebff7e8c852 100644
--- a/structure/transports/responses-failover.md
+++ b/structure/transports/responses-failover.md
@@ -156,7 +156,7 @@ The shared Responses path follows the [bounded multipart recovery contract](../s
 
 ## Upstream key attempt accounting
 
-Key identity is sealed at guarded physical dispatch after queued selections are rebuilt. Distributed selections retain their request-local entry and revision. A rebuild after selection drift releases the old per-key lease and reacquires admission for the refreshed key; the send guard checks again after waiting. Turn-scoped adapters follow the same rule before invocation. Native Chat, Messages and keyed compact all rebuild stale queued selections before dispatch, including a manual active-key switch under per-key limits; they release the old lease, readmit the new key and honor cancellation while its capacity is occupied. Direct compact and Images record genuine distributed 401/429 cooldowns without replaying paid POSTs; synthetic replay refusals never cool a key. Native Messages revisits mixed distributed 401/429 outcomes with its existing counters. Native Chat and Messages require the physical outgoing credential to match the selected distributed key before pooling a rejection; Messages honors the configured `x-api-key` or Bearer transport while rejecting a conflicting credential header; configured credential overrides cannot cool unused entries. Replacement admission pauses the response-header deadline and retains client cancellation; the header deadline restarts once admission completes. Native Responses captures distributed-key ownership after connection-policy rewrites in `src/providers/api-key-response-ownership.ts`; terminal 401/429 responses settle cooldown only after same-key retry policy, and a failed replay admission or synthetic replay refusal retains the last genuine refusal. Failure ownership accepts an already cooling, still-configured credential so concurrent late 401s extend earlier short cooldowns; physical-send eligibility still refuses cooling credentials. Reused responses, credential/destination overrides, stale revisions and synthetic refusals cannot confer ownership. Local pacing errors retain 429 and Retry-After at the passthrough catch boundary. Unpaced dispatch without a readmission owner fails closed. Replay notification errors release acquired slots before propagating, including pre-acquired-slot dispatch. Translated Anthropic billing recovery uses the [immutable physical-send ownership contract](../providers/anthropic-key-billing.md). Its initial send, credential hop and later mixed-class refusals share the request budget. A denied hop retains the upstream refusal, and a leased pacing body rewrap carries the existing marker rather than attributing the response to rebuilt headers.
+Key identity is sealed at guarded physical dispatch after queued selections are rebuilt. Distributed selections retain their request-local entry and revision. Permanent refusal auto-pause can disable that exact entry independently of the active key; recovery selects a healthy sibling under the same pacing and physical-send bounds. A rebuild after selection drift releases the old per-key lease and reacquires admission for the refreshed key; the send guard checks again after waiting. Turn-scoped adapters follow the same rule before invocation. Native Chat, Messages and keyed compact all rebuild stale queued selections before dispatch, including a manual active-key switch under per-key limits; they release the old lease, readmit the new key and honor cancellation while its capacity is occupied. Direct compact and Images record genuine distributed 401/429 cooldowns without replaying paid POSTs; synthetic replay refusals never cool a key. Native Messages revisits mixed distributed 401/429 outcomes with its existing counters. Native Chat and Messages require the physical outgoing credential to match the selected distributed key before pooling a rejection; Messages honors the configured `x-api-key` or Bearer transport while rejecting a conflicting credential header; configured credential overrides cannot cool unused entries. Replacement admission pauses the response-header deadline and retains client cancellation; the header deadline restarts once admission completes. Native Responses captures distributed-key ownership after connection-policy rewrites in `src/providers/api-key-response-ownership.ts`; terminal 401/429 responses settle cooldown only after same-key retry policy, and a failed replay admission or synthetic replay refusal retains the last genuine refusal. Failure ownership accepts an already cooling, still-configured credential so concurrent late 401s extend earlier short cooldowns; physical-send eligibility still refuses cooling credentials. Reused responses, credential/destination overrides, stale revisions and synthetic refusals cannot confer ownership. Local pacing errors retain 429 and Retry-After at the passthrough catch boundary. Unpaced dispatch without a readmission owner fails closed. Replay notification errors release acquired slots before propagating, including pre-acquired-slot dispatch. Translated Anthropic billing recovery uses the [immutable physical-send ownership contract](../providers/anthropic-key-billing.md). Its initial send, credential hop and later mixed-class refusals share the request budget. A denied hop retains the upstream refusal, and a leased pacing body rewrap carries the existing marker rather than attributing the response to rebuilt headers.
 Before a turn-scoped retry readmits a refreshed selection, it rejects a binding already recorded as failed for this request and returns the last key failure. Eligible replacement keys still release the old lease and reacquire their own pacing capacity before invocation, rechecking after every admission. CLI-backed turns carry a synchronous selection fence through asynchronous tool setup to the physical spawn boundary. Raw adapter terminal usage is recorded before continuation, search, or image loops merge it;
 repeated parsing of one physical response does not count it twice. Key changes preserve the
 previous attempt while retaining the active attempt object shared by streaming/combo callbacks.
diff --git a/structure/transports/responses.md b/structure/transports/responses.md
index deec7280d1c..d11c13a36d8 100644
--- a/structure/transports/responses.md
+++ b/structure/transports/responses.md
@@ -41,7 +41,7 @@ redirect following; providers requiring a redirect must be configured with their
 `src/server/responses/fetch-helpers.ts` is a transport leaf shared by Responses, compact, and native
 Chat. Its runtime imports are limited to the Codex WebSocket transport, provider request pacing, and
 the upstream HTTP-version helper. Server, provider, and WebSocket data types remain type-only edges. Opt-in `codexWsReuseAcrossTurns` (default off) in `src/server/responses/codex-ws-pool.ts` keeps a socket for an account and thread across turns, waits at most 750ms for a busy socket before dialing another, and leaves `x-codex-turn-state` / `x-codex-turn-metadata` on each frame.
-It must not import routing, combos, OAuth, adapters, sidecars, response parsing, logging, or relay
+Account refusal observers are injected by the calling transport owner and captured before the physical send; their wrapper forwards replacement pacing admission to the physical dispatch owner. It must not import routing, combos, OAuth, adapters, sidecars, response parsing, logging, or relay
 modules merely because those imports existed in the pre-split `responses.ts` monolith.
 
 `OCX_FRESH_CONNECTION_HOSTS` accepts comma-separated hostnames whose outbound HTTP sends bypass
diff --git a/tests/cli/cli-account-key-pause.test.ts b/tests/cli/cli-account-key-pause.test.ts
new file mode 100644
index 00000000000..2c025898af5
--- /dev/null
+++ b/tests/cli/cli-account-key-pause.test.ts
@@ -0,0 +1,60 @@
+import { expect, test } from "bun:test";
+import { cmdPause } from "../../src/cli/account-extended";
+import type { AccountDeps } from "../../src/cli/account-api";
+import { repoPath } from "../helpers/repo-root";
+
+async function run(requested: string, options: { failWrite?: boolean; keys?: unknown[]; json?: boolean } = {}) {
+  const lines: string[] = [], errors: string[] = [], writes: unknown[] = [];
+  const log = console.log, error = console.error;
+  console.log = value => { lines.push(String(value)); };
+  console.error = value => { errors.push(String(value)); };
+  const deps: AccountDeps = {
+    baseUrl: "http://127.0.0.1:10100",
+    loadConfigImpl: () => ({ providers: { fixture: { adapter: "openai", authMode: "key" } } }) as never,
+    fetchImpl: (async (_url, init) => {
+      if (init?.method === "PUT") {
+        writes.push(JSON.parse(String(init.body)));
+        if (options.failWrite) throw new Error("fixture connection refused");
+        return Response.json({ ok: true });
+      }
+      return Response.json({ keys: options.keys ?? [{ id: "key-1", label: "reserve" }] });
+    }) as typeof fetch,
+  };
+  try {
+    const code = await cmdPause(["fixture", requested, ...(options.json ? ["--json"] : [])], deps, true);
+    return { code, lines, errors, writes };
+  } finally { console.log = log; console.error = error; }
+}
+
+test("API-key target errors retain the Error prefix and identify the pool kind", async () => {
+  const result = await run("missing");
+  expect(result.code).toBe(1);
+  expect(result.errors[0]).toBe('Error: Account not found: no API key account has the id or alias "missing"');
+  expect(result.writes).toEqual([]);
+});
+
+test("ambiguous key aliases are never rewritten when they contain OAuth", async () => {
+  const result = await run("OAuth reserve", { keys: [{ id: "one", label: "OAuth reserve" }, { id: "two", label: "OAuth reserve" }] });
+  expect(result.errors[0]).toBe('Error: alias "OAuth reserve" names 2 accounts; use the account id');
+  expect(result.writes).toEqual([]);
+});
+
+test("a failed pause transport reports an unreachable proxy and its cause", async () => {
+  const result = await run("reserve", { failWrite: true });
+  expect(result.code).toBe(1);
+  expect(result.errors.join("\n")).toContain("Proxy not reachable.");
+  expect(result.errors.join("\n")).toContain("fixture connection refused");
+});
+
+test("API-key pause JSON uses the same two-space indentation as the other pools", async () => {
+  const result = await run("reserve", { json: true });
+  expect(result.code).toBe(0);
+  expect(result.lines).toEqual([JSON.stringify({ ok: true, provider: "fixture", id: "key-1", paused: true }, null, 2)]);
+  expect(result.writes).toEqual([{ name: "fixture", id: "key-1", paused: true }]);
+});
+
+test("the defensive pause usage fallback also names API-key pools", async () => {
+  const source = await Bun.file(repoPath("src/cli/account-extended.ts")).text();
+  const fallback = source.split("\n").find(line => line.includes("${verb} applies to"));
+  expect(fallback).toContain('applies to the openai Codex account pool, a generic OAuth provider, or an API-key pool');
+});
diff --git a/tests/cli/cli-account-key-quota.test.ts b/tests/cli/cli-account-key-quota.test.ts
index 5521e4fd61e..8353e7a4fd3 100644
--- a/tests/cli/cli-account-key-quota.test.ts
+++ b/tests/cli/cli-account-key-quota.test.ts
@@ -222,3 +222,16 @@ test("absence, explicit null and unavailable last-good remain distinct in JSON",
   expect(accounts[2].quotaUnavailable).toBe(true);
   expect(formatAccountTable(projectApiKeyQuotaRows(body(keys), "openrouter").rows, true)).toContain("probe: unavailable");
 });
+
+test("quota key rows keep the pause flag and only known pause details", () => {
+  const rows = projectApiKeyQuotaRows(body([
+    row({ disabled: true, pauseDetails: { reason: "subscription_expired", pausedAt: 1 } }),
+    row({ id: "second", disabled: true, pauseDetails: { reason: "reason_from_a_newer_proxy", pausedAt: 2 } }),
+    row({ id: "third" }),
+  ]), "openrouter").rows;
+  expect(rows[0]).toMatchObject({ paused: true, pauseDetails: { reason: "subscription_expired", pausedAt: 1 } });
+  expect(rows[1]!.paused).toBe(true);
+  expect(rows[1]!.pauseDetails).toBeUndefined();
+  expect(rows[2]!.paused).toBe(false);
+});
+
diff --git a/tests/config/config-account-auto-pause-revisions.test.ts b/tests/config/config-account-auto-pause-revisions.test.ts
new file mode 100644
index 00000000000..9ac1efcc9bf
--- /dev/null
+++ b/tests/config/config-account-auto-pause-revisions.test.ts
@@ -0,0 +1,396 @@
+import { afterEach, beforeEach, expect, spyOn, test } from "bun:test";
+import { mkdtempSync, readFileSync, writeFileSync } from "node:fs";
+import { randomUUID } from "node:crypto";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { getDefaultConfig, initializePersistedConfigIfMissing, loadConfig, saveConfig } from "../../src/config";
+import { configSchema } from "../../src/config/schema/config-schema";
+import { captureAccountAutoPauseFence, accountAutoPauseFenceIsLocal, observeAccountAutoPauseRevisions, accountAutoPauseObservedSizeForTests } from "../../src/config/account-auto-pause-revisions";
+import { armClaudeCodeBaseline, reconcileLiveConfigFromDisk, saveConfigPreservingClaudeCode } from "../../src/config/live-reconcile";
+import { captureAccountAutoPauseAttempt, wasAccountAutoPaused } from "../../src/oauth/account-auto-pause";
+import { routedProviderConfig } from "../../src/router";
+import { setPreservedDiskOnlyProviders } from "../../src/usage/user-cost-overlays";
+import { removeTreeWithRetry } from "../helpers/remove-tree";
+
+const previousHome = process.env.OPENCODEX_HOME;
+let home: string;
+beforeEach(() => { home = mkdtempSync(join(tmpdir(), "ocx-policy-config-")); process.env.OPENCODEX_HOME = home; });
+afterEach(() => {
+  if (previousHome === undefined) delete process.env.OPENCODEX_HOME; else process.env.OPENCODEX_HOME = previousHome;
+  removeTreeWithRetry(home);
+});
+function fixture(tracked = true) {
+  const config = getDefaultConfig();
+  config.providers = { fixture: { adapter: "openai-chat", baseUrl: "https://example.test/v1", authMode: "key", apiKey: "synthetic",
+    ...(tracked ? { accountAutoPause: { enabled: true } } : {}) } };
+  config.defaultProvider = "fixture";
+  return config;
+}
+const bytes = () => readFileSync(join(home, "config.json"), "utf8");
+const raw = () => JSON.parse(bytes());
+const revision = () => raw().accountAutoPausePolicyRevisions?.fixture;
+
+test("never-configured provider create, edit, initialize and unrelated writes omit the map", () => {
+  const config = fixture(false);
+  config.accountAutoPausePolicyRevisions = { injected: randomUUID() };
+  expect(initializePersistedConfigIfMissing(config)).toBe("created");
+  expect(bytes()).not.toContain("accountAutoPausePolicyRevisions");
+  config.providers.fixture!.baseUrl = "https://other.test/v1";
+  saveConfig(config);
+  expect(bytes()).not.toContain("accountAutoPausePolicyRevisions");
+  config.port++;
+  saveConfig(config);
+  expect(bytes()).not.toContain("accountAutoPausePolicyRevisions");
+  const stable = bytes();
+  saveConfig(config);
+  expect(bytes()).toBe(stable);
+  saveConfig(loadConfig());
+  expect(bytes()).not.toContain("accountAutoPausePolicyRevisions");
+});
+
+test("invalid-map recovery does not enroll never-configured providers", () => {
+  const config = fixture(false);
+  saveConfig(config);
+  writeFileSync(join(home, "config.json"), JSON.stringify({ ...raw(), accountAutoPausePolicyRevisions: { fixture: 12 } }));
+  const loaded = loadConfig();
+  expect(loaded.providers.fixture).toBeDefined();
+  expect(loaded.accountAutoPausePolicyRevisions).toBeNull();
+  saveConfig(loaded);
+  expect(bytes()).not.toContain("accountAutoPausePolicyRevisions");
+});
+
+test("caller epochs are ignored; removed policies retain revisions only while the provider exists", () => {
+  const config = fixture();
+  saveConfig(config);
+  const first = revision();
+  expect(first).toMatch(/^[a-f0-9-]{36}$/);
+  config.accountAutoPausePolicyRevisions = { fixture: randomUUID(), injected: randomUUID() };
+  config.port++;
+  saveConfig(config);
+  expect(revision()).toBe(first);
+  expect(raw().accountAutoPausePolicyRevisions.injected).toBeUndefined();
+  config.providers.fixture!.accountAutoPause = undefined;
+  saveConfig(config);
+  expect(revision()).not.toBe(first);
+  const removedPolicy = revision();
+  expect(removedPolicy).toMatch(/^[a-f0-9-]{36}$/);
+  config.port++;
+  saveConfig(config);
+  expect(revision()).toBe(removedPolicy);
+  delete config.providers.fixture;
+  saveConfig(config);
+  expect(revision()).toBeUndefined();
+  expect(bytes()).not.toContain("accountAutoPausePolicyRevisions");
+  expect(accountAutoPauseObservedSizeForTests()).toBe(0);
+});
+
+test("all full-fingerprint fields rotate policy epochs and wall-clock rollback cannot restore one", () => {
+  const config = fixture();
+  saveConfig(config);
+  const row = config.providers.fixture!;
+  const edits = [() => { row.accountAutoPause!.enabled = false; }, () => { row.accountAutoPause!.enabled = true; },
+    () => { row.accountAutoPause!.consecutiveFailures = 3; }, () => { row.disabled = true; },
+    () => { row.disabled = false; }, () => { row.baseUrl = "https://other.test/v1"; },
+    () => { row.adapter = "anthropic"; }, () => { row.authMode = "oauth"; }];
+  const seen = new Set([revision()]);
+  const oldNow = Date.now;
+  try {
+    Date.now = () => 1;
+    for (const edit of edits) { edit(); saveConfig(config); expect(seen.has(revision())).toBe(false); seen.add(revision()); }
+  } finally { Date.now = oldNow; }
+});
+
+test("invalid epochs load as unknown and the recovery write mints only configured providers", () => {
+  const config = fixture();
+  config.providers.untracked = { adapter: "openai-chat", baseUrl: "https://untracked.test/v1", authMode: "key" };
+  saveConfig(config);
+  const first = revision();
+  writeFileSync(join(home, "config.json"), JSON.stringify({ ...raw(), accountAutoPausePolicyRevisions: [first] }));
+  const loaded = loadConfig();
+  expect(loaded.providers.fixture).toBeDefined();
+  expect(captureAccountAutoPauseFence(loaded, "fixture")).toBeUndefined();
+  saveConfig(loaded);
+  expect(revision()).not.toBe(first);
+  expect(Object.keys(raw().accountAutoPausePolicyRevisions)).toEqual(["fixture"]);
+  expect(captureAccountAutoPauseFence(loaded, "fixture")).toBeDefined();
+});
+
+test("malformed Codex display details degrade per entry while revisions and paused ids survive", () => {
+  const config = fixture();
+  config.pausedCodexAccountIds = ["a", "b"];
+  const parsed = configSchema.parse({ ...config, codexAccountPauseState: {
+    a: { revision: "revision-a", details: { reason: "wrong", pausedAt: -1 } },
+    b: { revision: "revision-b", details: { reason: "subscription_expired", pausedAt: 42 } },
+    broken: null,
+  } });
+  expect(parsed.codexAccountPauseState?.a).toEqual({ revision: "revision-a" });
+  expect(parsed.codexAccountPauseState?.b?.details?.pausedAt).toBe(42);
+  expect(parsed.pausedCodexAccountIds).toEqual(["a", "b"]);
+  expect(configSchema.parse({ ...config, codexAccountPauseState: "invalid" }).pausedCodexAccountIds).toEqual(["a", "b"]);
+});
+
+test("save-time reconciliation and full reload observe fingerprint changes before replacement", () => {
+  const config = fixture();
+  saveConfig(config);
+  armClaudeCodeBaseline(config);
+  const fence = captureAccountAutoPauseFence(config, "fixture")!;
+  const disk = raw();
+  disk.providers.fixture.accountAutoPause.consecutiveFailures = 3;
+  writeFileSync(join(home, "config.json"), JSON.stringify(disk));
+  config.port++;
+  saveConfigPreservingClaudeCode(config);
+  expect(config.providers.fixture!.accountAutoPause!.consecutiveFailures).toBe(3);
+  expect(accountAutoPauseFenceIsLocal("fixture", fence)).toBe(false);
+  const newer = captureAccountAutoPauseFence(config, "fixture")!;
+  const baseline = structuredClone(config);
+  disk.providers.fixture.accountAutoPause.consecutiveFailures = 2;
+  writeFileSync(join(home, "config.json"), JSON.stringify(disk));
+  reconcileLiveConfigFromDisk(config, baseline);
+  expect(accountAutoPauseFenceIsLocal("fixture", newer)).toBe(false);
+});
+
+
+test("initial publication normalizes caller epochs for configured providers", () => {
+  const config = fixture();
+  const caller = randomUUID();
+  config.accountAutoPausePolicyRevisions = { fixture: caller };
+  expect(initializePersistedConfigIfMissing(config)).toBe("created");
+  expect(revision()).not.toBe(caller);
+  expect(captureAccountAutoPauseFence(config, "fixture")?.diskRevision).toBe(revision());
+});
+
+test("post-publication bookkeeping failure still adopts the new policy epoch", async () => {
+  const config = fixture();
+  saveConfig(config);
+  const fence = captureAccountAutoPauseFence(config, "fixture")!;
+  const registries = await import("../../src/config/derived-registries");
+  const { ConfigWritePublishedError } = await import("../../src/config/persist-unlocked");
+  const fail = spyOn(registries, "refreshConfigDerivedRegistries").mockImplementation(() => { throw new Error("synthetic bookkeeping failure"); });
+  try {
+    config.providers.fixture!.accountAutoPause!.enabled = false;
+    expect(() => saveConfig(config)).toThrow(ConfigWritePublishedError);
+    expect(revision()).not.toBe(fence.diskRevision);
+    expect(accountAutoPauseFenceIsLocal("fixture", fence)).toBe(false);
+  } finally { fail.mockRestore(); }
+});
+
+test("a detached loadConfig snapshot adopts the disk epoch without invalidating an in-flight fence", () => {
+  saveConfig(fixture());
+  const live = structuredClone(loadConfig());
+  // The live object differs from disk in memory only; its own observation advances the generation.
+  live.providers.fixture!.accountAutoPause = { enabled: true, consecutiveFailures: 3 };
+  observeAccountAutoPauseRevisions(live, raw());
+  const fence = captureAccountAutoPauseFence(live, "fixture");
+  expect(fence).toBeDefined();
+  loadConfig();
+  loadConfig();
+  expect(accountAutoPauseFenceIsLocal("fixture", fence!)).toBe(true);
+});
+
+
+test("an observed external policy change and restore invalidates an older attempt", () => {
+  saveConfig(fixture());
+  const live = loadConfig();
+  const fence = captureAccountAutoPauseFence(live, "fixture");
+  expect(fence).toBeDefined();
+  const original = bytes();
+  const edited = raw();
+  edited.providers.fixture.accountAutoPause = { enabled: true, consecutiveFailures: 3 };
+  writeFileSync(join(home, "config.json"), JSON.stringify(edited));
+  loadConfig();
+  writeFileSync(join(home, "config.json"), original);
+  loadConfig();
+  expect(raw().accountAutoPausePolicyRevisions.fixture).toBe(fence!.diskRevision);
+  expect(accountAutoPauseFenceIsLocal("fixture", fence!)).toBe(false);
+});
+
+test("50 provider create/delete cycles retain only live disk revisions and observed entries", () => {
+  const config = fixture();
+  saveConfig(config);
+  const survivor = revision();
+  for (let cycle = 0; cycle < 50; cycle++) {
+    const name = `temporary-${cycle}`;
+    config.providers[name] = structuredClone(config.providers.fixture!);
+    saveConfig(config);
+    expect(Object.keys(raw().accountAutoPausePolicyRevisions).sort()).toEqual(["fixture", name]);
+    expect(accountAutoPauseObservedSizeForTests()).toBe(2);
+    delete config.providers[name];
+    saveConfig(config);
+    expect(Object.keys(raw().providers)).toEqual(["fixture"]);
+    expect(Object.keys(raw().accountAutoPausePolicyRevisions)).toEqual(["fixture"]);
+    expect(bytes()).not.toContain(`"${name}"`);
+    expect(accountAutoPauseObservedSizeForTests()).toBe(1);
+    expect(revision()).toBe(survivor);
+  }
+});
+
+test("an unrelated save preserves every live provider UUID", () => {
+  const config = fixture();
+  config.providers.other = structuredClone(config.providers.fixture!);
+  saveConfig(config);
+  const first = raw().accountAutoPausePolicyRevisions;
+  expect(Object.keys(first).sort()).toEqual(["fixture", "other"]);
+  expect(first.fixture).not.toBe(first.other);
+  config.port++;
+  saveConfig(config);
+  expect(raw().accountAutoPausePolicyRevisions).toEqual(first);
+  saveConfig(loadConfig());
+  expect(raw().accountAutoPausePolicyRevisions).toEqual(first);
+});
+
+test("a disk-only preserved provider retains its policy revision on an unrelated live save", () => {
+  const config = fixture();
+  saveConfig(config);
+  const first = revision();
+  const disk = raw();
+  const diskOnlyRevision = randomUUID();
+  disk.providers.external = structuredClone(disk.providers.fixture);
+  disk.accountAutoPausePolicyRevisions.external = diskOnlyRevision;
+  writeFileSync(join(home, "config.json"), JSON.stringify(disk));
+  expect(config.providers.external).toBeUndefined();
+  // The overlay reconciler publishes disk-only rows into this serialization registry.
+  setPreservedDiskOnlyProviders({ external: disk.providers.external });
+  try {
+    config.port++;
+    saveConfig(config);
+    expect(config.providers.external).toBeUndefined();
+    expect(raw().providers.external).toEqual(disk.providers.external);
+    expect(raw().accountAutoPausePolicyRevisions).toEqual({ fixture: first, external: diskOnlyRevision });
+    expect(accountAutoPauseObservedSizeForTests()).toBe(2);
+  } finally { setPreservedDiskOnlyProviders(null); }
+});
+
+function captureKeyAttempt(config: ReturnType<typeof fixture>) {
+  const route = routedProviderConfig("fixture", config.providers.fixture!);
+  const observer = captureAccountAutoPauseAttempt("fixture", route, { config }, new Headers({ authorization: `Bearer ${route.apiKey}` }));
+  expect(observer).toBeDefined();
+  return observer!;
+}
+const refusal = () => Response.json({ error: { type: "permission_error", message: "Your subscription has expired." } }, { status: 403 });
+async function expectStaleAttemptRejected(config: ReturnType<typeof fixture>, attempt: ReturnType<typeof captureKeyAttempt>) {
+  const response = refusal();
+  expect(await attempt(response)).toBe(response);
+  expect(wasAccountAutoPaused(response)).toBe(false);
+  expect(config.providers.fixture!.apiKeyPool?.some(row => row.disabled === true) ?? false).toBe(false);
+  expect(loadConfig().providers.fixture!.apiKeyPool?.some(row => row.disabled === true) ?? false).toBe(false);
+  // A fresh attempt must still be able to pause the same credential after recreation.
+  const current = refusal();
+  await captureKeyAttempt(config)(current);
+  expect(wasAccountAutoPaused(current)).toBe(true);
+  expect(config.providers.fixture!.apiKeyPool?.[0]?.disabled).toBe(true);
+  expect(loadConfig().providers.fixture!.apiKeyPool?.[0]?.disabled).toBe(true);
+}
+
+test("saveConfig delete/recreate mints a new UUID and rejects the pre-deletion attempt", async () => {
+  const config = fixture();
+  config.providers.fixture!.accountAutoPause!.consecutiveFailures = 1;
+  saveConfig(config);
+  const fence = captureAccountAutoPauseFence(config, "fixture")!;
+  expect(fence).toBeDefined();
+  const attempt = captureKeyAttempt(config);
+  const row = structuredClone(config.providers.fixture!);
+  delete config.providers.fixture;
+  saveConfig(config);
+  expect(raw().accountAutoPausePolicyRevisions).toBeUndefined();
+  expect(accountAutoPauseFenceIsLocal("fixture", fence)).toBe(false);
+  expect(accountAutoPauseObservedSizeForTests()).toBe(0);
+  config.providers.fixture = row;
+  saveConfig(config);
+  expect(revision()).toMatch(/^[a-f0-9-]{36}$/);
+  expect(revision()).not.toBe(fence.diskRevision);
+  expect(accountAutoPauseFenceIsLocal("fixture", fence)).toBe(false);
+  expect(accountAutoPauseObservedSizeForTests()).toBe(1);
+  await expectStaleAttemptRejected(config, attempt);
+});
+
+test("legacy no-map observations delete/recreate without reviving a pre-deletion attempt", async () => {
+  const config = fixture();
+  config.providers.fixture!.accountAutoPause!.consecutiveFailures = 1;
+  writeFileSync(join(home, "config.json"), JSON.stringify(config));
+  observeAccountAutoPauseRevisions(config);
+  const fence = captureAccountAutoPauseFence(config, "fixture")!;
+  expect(fence.diskRevision).toBe("legacy");
+  const attempt = captureKeyAttempt(config);
+  const original = bytes();
+  const row = structuredClone(config.providers.fixture!);
+  delete config.providers.fixture;
+  writeFileSync(join(home, "config.json"), JSON.stringify(config));
+  observeAccountAutoPauseRevisions(config);
+  expect(accountAutoPauseObservedSizeForTests()).toBe(0);
+  config.providers.fixture = row;
+  writeFileSync(join(home, "config.json"), original);
+  observeAccountAutoPauseRevisions(config);
+  const recreated = captureAccountAutoPauseFence(config, "fixture")!;
+  expect(recreated.diskRevision).toBe("legacy");
+  expect(recreated.localGen).not.toBe(fence.localGen);
+  expect(accountAutoPauseFenceIsLocal("fixture", fence)).toBe(false);
+  expect(accountAutoPauseObservedSizeForTests()).toBe(1);
+  await expectStaleAttemptRejected(config, attempt);
+});
+
+for (const epoch of ["persisted UUID", "legacy no-map"] as const) {
+  test(`load-only ${epoch}: identical raw restore after observed deletion rejects the old fence and attempt`, async () => {
+    const initial = fixture();
+    initial.providers.fixture!.accountAutoPause!.consecutiveFailures = 1;
+    initial.providers.keeper = { adapter: "openai-chat", baseUrl: "https://keeper.test/v1", authMode: "key" };
+    initial.defaultProvider = "keeper";
+    saveConfig(initial);
+    if (epoch === "legacy no-map") {
+      const disk = raw();
+      delete disk.accountAutoPausePolicyRevisions;
+      writeFileSync(join(home, "config.json"), JSON.stringify(disk));
+    }
+    const config = loadConfig();
+    const original = bytes();
+    const fence = captureAccountAutoPauseFence(config, "fixture")!;
+    expect(fence).toBeDefined();
+    expect(fence.diskRevision).toBe(epoch === "legacy no-map" ? "legacy" : revision());
+    const attempt = captureKeyAttempt(config);
+    const deleted = raw();
+    delete deleted.providers.fixture;
+    // A raw editor may leave the old UUID behind; absent providers must still be reclaimed.
+    writeFileSync(join(home, "config.json"), JSON.stringify(deleted));
+    expect(loadConfig().providers.fixture).toBeUndefined();
+    expect(accountAutoPauseObservedSizeForTests()).toBe(1);
+    expect(accountAutoPauseFenceIsLocal("fixture", fence)).toBe(false);
+    writeFileSync(join(home, "config.json"), original);
+    const restored = loadConfig();
+    expect(bytes()).toBe(original);
+    const recreated = captureAccountAutoPauseFence(restored, "fixture")!;
+    expect(recreated.diskRevision).toBe(fence.diskRevision);
+    expect(recreated.localGen).not.toBe(fence.localGen);
+    expect(accountAutoPauseFenceIsLocal("fixture", fence)).toBe(false);
+    expect(accountAutoPauseObservedSizeForTests()).toBe(2);
+    await expectStaleAttemptRejected(config, attempt);
+  });
+}
+
+for (const legacy of [false, true]) {
+  test(`${legacy ? "legacy no-map" : "persisted UUID"}: a stale live config cannot re-enroll a provider observed as deleted`, async () => {
+    const config = fixture();
+    config.providers.fixture!.accountAutoPause!.consecutiveFailures = 1;
+    config.providers.other = { adapter: "openai-chat", baseUrl: "https://other.test/v1", authMode: "key", apiKey: "synthetic-other" };
+    if (legacy) writeFileSync(join(home, "config.json"), JSON.stringify(config)); else saveConfig(config);
+    loadConfig();
+    const original = bytes();
+    const deleted = raw();
+    delete deleted.providers.fixture;
+    deleted.defaultProvider = "other";
+    writeFileSync(join(home, "config.json"), JSON.stringify(deleted));
+    loadConfig();
+    expect(accountAutoPauseObservedSizeForTests()).toBe(1);
+    // The live object still holds the provider; capturing from it while it is deleted must not
+    // re-enroll an observation or produce a fence that survives an identical restore.
+    const route = routedProviderConfig("fixture", config.providers.fixture!);
+    expect(captureAccountAutoPauseFence(config, "fixture")).toBeUndefined();
+    expect(captureAccountAutoPauseAttempt("fixture", route, { config }, new Headers({ authorization: `Bearer ${route.apiKey}` }))).toBeUndefined();
+    expect(accountAutoPauseObservedSizeForTests()).toBe(1);
+    writeFileSync(join(home, "config.json"), original);
+    loadConfig();
+    expect(accountAutoPauseObservedSizeForTests()).toBe(2);
+    const current = refusal();
+    await captureKeyAttempt(config)(current);
+    expect(wasAccountAutoPaused(current)).toBe(true);
+  });
+}
+
diff --git a/tests/fixtures/test-layout-expected.json b/tests/fixtures/test-layout-expected.json
index 67e74a49650..fe9fd10a005 100644
--- a/tests/fixtures/test-layout-expected.json
+++ b/tests/fixtures/test-layout-expected.json
@@ -9,10 +9,11 @@
   "codex-preserve-signed-in.test.ts": "codex-integration", "cli-account-preservation.test.ts": "cli",
   "catalog-native-max-context.test.ts": "codex-integration",
   "protocol-argon-thought-boundary.test.ts": "responses",
+  "responses-auto-pause-replay-owner.test.ts": "responses", "responses-account-auto-pause.test.ts": "responses", "oauth-account-auto-pause.test.ts": "oauth", "responses-account-auto-pause-wire-owner.test.ts": "responses", "oauth-upsert-paused-api-key.test.ts": "oauth", "management-account-auto-pause.test.ts": "server", "cli-account-key-pause.test.ts": "cli", "oauth-account-auto-pause-revision.test.ts": "oauth", "config-account-auto-pause-revisions.test.ts": "config",
   "codex-provider-routing.test.ts": "codex-integration",
   "claude-picker-trust-windows.test.ts": "claude-integration", "claude-picker-windows.test.ts": "claude-integration", "config-native-reasoning-retention.test.ts": "config", "server-native-reasoning-retention-merge.test.ts": "server", "server-native-reasoning-retention.test.ts": "server", "responses-retained-reasoning-stream-recovery.test.ts": "responses",
   "advisor-retention.test.ts": "advisor", "responses-native-key-cooldown.test.ts": "responses", "responses-run-turn-key-readmission.test.ts": "responses", "qoder-spawn-readmission.test.ts": "adapters",
-  "api-key-selection-cooldown.test.ts": "providers", "server-chat-native-key-selection.test.ts": "server", "compact-key-selection.test.ts": "responses",
+  "api-key-selection-cooldown.test.ts": "providers", "api-key-auto-pause-distribution.test.ts": "providers", "server-chat-native-key-selection.test.ts": "server", "compact-key-selection.test.ts": "responses",
   "messages-native-key-selection.test.ts": "claude-integration",
   "messages-native-empty-inline.test.ts": "claude-integration",
   "explicit-empty-tool-catalog.test.ts": "responses",
diff --git a/tests/helpers/responses-core-source.ts b/tests/helpers/responses-core-source.ts
index 13867fa68bb..f83382af06c 100644
--- a/tests/helpers/responses-core-source.ts
+++ b/tests/helpers/responses-core-source.ts
@@ -49,8 +49,10 @@ export const RESPONSES_CORE_MODULES = [
   "response-effects.ts",
   "response-tool-ownership.ts",
   "request-send-budget.ts",
+  "account-auto-pause-recovery.ts",
   "passthrough-execution.ts",
   "passthrough-dispatch.ts",
+  "passthrough-observations.ts",
   // Reached from passthrough/adapter dispatch, compact and runTurn: local spend-ledger refusal mapping.
   "spend-storage-error.ts",
   // Reached from passthrough dispatch: local pacing refusals retain 429 and Retry-After.
diff --git a/tests/oauth/oauth-account-auto-pause-revision.test.ts b/tests/oauth/oauth-account-auto-pause-revision.test.ts
new file mode 100644
index 00000000000..b3b9bff3b87
--- /dev/null
+++ b/tests/oauth/oauth-account-auto-pause-revision.test.ts
@@ -0,0 +1,209 @@
+import { afterEach, beforeEach, expect, test } from "bun:test";
+import { mkdtempSync, readFileSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { getDefaultConfig, saveConfig, loadConfig, mutatePersistedConfig } from "../../src/config";
+import { captureAccountAutoPauseAttempt, wasAccountAutoPaused } from "../../src/oauth/account-auto-pause";
+import { routedProviderConfig } from "../../src/router";
+import { saveCredential, getAccountSet } from "../../src/oauth/store";
+import { getValidAccessSnapshotForAccount } from "../../src/oauth";
+import { saveCodexAccountCredential } from "../../src/codex/account-store";
+import { removeTreeWithRetry } from "../helpers/remove-tree";
+
+const previousHome = process.env.OPENCODEX_HOME;
+let home: string;
+beforeEach(() => { home = mkdtempSync(join(tmpdir(), "ocx-policy-revision-")); process.env.OPENCODEX_HOME = home; });
+afterEach(() => {
+  if (previousHome === undefined) delete process.env.OPENCODEX_HOME; else process.env.OPENCODEX_HOME = previousHome;
+  removeTreeWithRetry(home);
+});
+const refusal = () => Response.json({ error: { type: "permission_error", message: "Your subscription has expired." } }, { status: 403 });
+async function fixture(mode: "key" | "oauth" | "forward" = "key", threshold = 1) {
+  const config = getDefaultConfig();
+  const name = mode === "oauth" ? "command-code" : "revision-fixture";
+  config.providers = { [name]: { adapter: "openai-chat", baseUrl: "https://example.test/v1", authMode: mode,
+    accountAutoPause: { enabled: true, consecutiveFailures: threshold }, ...(mode === "key" ? { apiKey: "synthetic-key" } : {}) } };
+  config.defaultProvider = name;
+  let oauth, codex;
+  if (mode === "oauth") {
+    await saveCredential(name, { access: "synthetic-access", refresh: "synthetic-refresh", expires: Date.now() + 3_600_000, accountId: "synthetic", source: "oauth" });
+    oauth = await getValidAccessSnapshotForAccount(name, getAccountSet(name)!.accounts[0]!.id);
+  }
+  if (mode === "forward") {
+    config.codexAccounts = [{ id: "fixture", email: "", isMain: false }];
+    const generation = saveCodexAccountCredential("fixture", { accessToken: "synthetic-access", refreshToken: "synthetic-refresh", expiresAt: Date.now() + 3_600_000, chatgptAccountId: "synthetic" });
+    codex = { kind: "pool" as const, accountId: "fixture", generation, writerGeneration: 0, accessToken: "synthetic-access", chatgptAccountId: "synthetic" };
+  }
+  saveConfig(config);
+  const capture = () => {
+    const provider = mode === "key" ? routedProviderConfig(name, config.providers[name]!) : config.providers[name]!;
+    return captureAccountAutoPauseAttempt(name, provider, { config, oauth, codex }, new Headers({ authorization: `Bearer ${mode === "key" ? provider.apiKey : "synthetic-access"}`,
+      ...(codex ? { "chatgpt-account-id": codex.chatgptAccountId } : {}) }))!;
+  };
+  const paused = () => mode === "key" ? config.providers[name]!.apiKeyPool?.[0]?.disabled === true
+    : mode === "oauth" ? getAccountSet(name)!.accounts[0]!.paused === true : config.pausedCodexAccountIds?.includes("fixture") === true;
+  return { config, name, capture, paused };
+}
+for (const mode of ["oauth", "key", "forward"] as const) {
+  test(`${mode}: disable/re-enable with a backward clock fences an already captured response`, async () => {
+    const f = await fixture(mode);
+    const observe = f.capture();
+    const oldNow = Date.now;
+    try {
+      Date.now = () => 1;
+      f.config.providers[f.name]!.accountAutoPause!.enabled = false;
+      saveConfig(f.config);
+      f.config.providers[f.name]!.accountAutoPause!.enabled = true;
+      saveConfig(f.config);
+    } finally { Date.now = oldNow; }
+    const response = await observe(refusal());
+    expect(f.paused()).toBe(false);
+    expect(wasAccountAutoPaused(response)).toBe(false);
+    await f.capture()(refusal());
+    expect(f.paused()).toBe(true);
+  });
+}
+
+function editDisk(edit: (raw: ReturnType<typeof getDefaultConfig>) => void) {
+  const path = join(home, "config.json");
+  const raw = JSON.parse(readFileSync(path, "utf8"));
+  edit(raw);
+  writeFileSync(path, JSON.stringify(raw, null, 2) + "\n");
+}
+async function externalWrite(body: string) {
+  const { repoPath, repoRoot } = await import("../helpers/repo-root");
+  const child = Bun.spawn([process.execPath, "-e", `import { mutatePersistedConfig } from ${JSON.stringify(repoPath("src/config.ts"))}; ${body}`],
+    { cwd: repoRoot(), env: { ...process.env }, stdout: "pipe", stderr: "pipe" });
+  const error = await new Response(child.stderr).text();
+  expect(await child.exited, error).toBe(0);
+}
+for (const mode of ["oauth", "key", "forward"] as const) {
+  test(`${mode}: disk-only disabled provider cannot pause without reload`, async () => {
+    const f = await fixture(mode);
+    const observe = f.capture();
+    editDisk(raw => { raw.providers[f.name]!.disabled = true; });
+    const response = await observe(refusal());
+    expect(f.paused()).toBe(false);
+    expect(wasAccountAutoPaused(response)).toBe(false);
+  });
+  test(`${mode}: unrelated write preserves the streak and policy epoch`, async () => {
+    const f = await fixture(mode, 2);
+    await f.capture()(refusal());
+    const before = loadConfig().accountAutoPausePolicyRevisions;
+    mutatePersistedConfig(fresh => { fresh.port++; return { changed: true, value: true }; });
+    expect(loadConfig().accountAutoPausePolicyRevisions).toEqual(before);
+    await f.capture()(refusal());
+    expect(f.paused()).toBe(true);
+  });
+  test(`${mode}: external threshold change is checked at commit`, async () => {
+    const f = await fixture(mode);
+    const observe = f.capture();
+    await externalWrite(`mutatePersistedConfig(c => { c.providers[${JSON.stringify(f.name)}].accountAutoPause.consecutiveFailures = 3; return {changed: true, value: true}; });`);
+    const response = await observe(refusal());
+    expect(f.paused()).toBe(false);
+    expect(wasAccountAutoPaused(response)).toBe(false);
+  });
+  test(`${mode}: external ABA adopted by reload rejects old attempts and accepts new ones`, async () => {
+    const f = await fixture(mode);
+    const baseline = structuredClone(f.config);
+    const observe = f.capture();
+    await externalWrite(`for (const enabled of [false, true]) mutatePersistedConfig(c => { c.providers[${JSON.stringify(f.name)}].accountAutoPause.enabled = enabled; return {changed: true, value: true}; });`);
+    const { reconcileLiveConfigFromDisk } = await import("../../src/config/live-reconcile");
+    reconcileLiveConfigFromDisk(f.config, baseline);
+    const response = await observe(refusal());
+    expect(f.paused()).toBe(false);
+    expect(wasAccountAutoPaused(response)).toBe(false);
+    await f.capture()(refusal());
+    expect(f.paused()).toBe(true);
+  });
+  test(`${mode}: malformed revision map suppresses pauses until a valid write`, async () => {
+    const f = await fixture(mode);
+    const before = f.capture();
+    editDisk(raw => { raw.accountAutoPausePolicyRevisions = { [f.name]: "invalid" }; });
+    expect(loadConfig().accountAutoPausePolicyRevisions).toBeNull();
+    expect(f.capture()).toBeUndefined();
+    expect(wasAccountAutoPaused(await before(refusal()))).toBe(false);
+    expect(f.paused()).toBe(false);
+    saveConfig(f.config);
+    await f.capture()(refusal());
+    expect(f.paused()).toBe(true);
+  });
+}
+
+test("OAuth automatic commit fails fast under a separate-process config lock, then retries", async () => {
+  const f = await fixture("oauth");
+  const observe = f.capture();
+  const { repoPath, repoRoot } = await import("../helpers/repo-root");
+  const child = Bun.spawn([process.execPath, "-e", `import { withConfigMutationLockSync } from ${JSON.stringify(repoPath("src/config/mutation-lock.ts"))};
+    withConfigMutationLockSync(() => { process.stdout.write("locked"); Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 20000); });`],
+    { cwd: repoRoot(), env: { ...process.env }, stdout: "pipe", stderr: "pipe" });
+  try {
+    const reader = child.stdout.getReader();
+    const ready = await reader.read();
+    reader.releaseLock();
+    expect(new TextDecoder().decode(ready.value)).toBe("locked");
+    const started = performance.now();
+    const response = await observe(refusal());
+    expect(performance.now() - started).toBeLessThan(2000);
+    expect(wasAccountAutoPaused(response)).toBe(false);
+    expect(f.paused()).toBe(false);
+  } finally { child.kill(); await child.exited; }
+  await f.capture()(refusal());
+  expect(f.paused()).toBe(true);
+});
+
+test("reload row replacement changes local generation before a stale verdict can commit", async () => {
+  const f = await fixture();
+  const observe = f.capture();
+  const { adoptPersistedProviderIntoLiveConfig } = await import("../../src/config/live-reconcile");
+  const row = structuredClone(f.config.providers[f.name]!);
+  row.accountAutoPause!.consecutiveFailures = 3;
+  // A raw editor cannot update epochs; local generation still remembers both observations.
+  editDisk(raw => { raw.providers[f.name] = row; });
+  const changed = loadConfig();
+  adoptPersistedProviderIntoLiveConfig(f.config, f.name, row, changed);
+  row.accountAutoPause!.consecutiveFailures = 1;
+  editDisk(raw => { raw.providers[f.name] = row; });
+  adoptPersistedProviderIntoLiveConfig(f.config, f.name, row, loadConfig());
+  expect(wasAccountAutoPaused(await observe(refusal()))).toBe(false);
+  expect(f.paused()).toBe(false);
+  await f.capture()(refusal());
+  expect(f.paused()).toBe(true);
+});
+
+
+for (const field of ["baseUrl", "adapter", "authMode"] as const) {
+  test(`key: disk-only ${field} change with the same revision rejects a stale pause`, async () => {
+    const f = await fixture();
+    const observe = f.capture();
+    editDisk(raw => {
+      const row = raw.providers[f.name]!;
+      if (field === "baseUrl") row.baseUrl = "https://changed.test/v1";
+      else if (field === "adapter") row.adapter = "anthropic";
+      else row.authMode = "oauth";
+    });
+    expect(wasAccountAutoPaused(await observe(refusal()))).toBe(false);
+    expect(f.paused()).toBe(false);
+  });
+}
+
+test("OAuth policy ABA while waiting for the auth writer never commits the old pause", async () => {
+  const f = await fixture("oauth");
+  const { mutateStore } = await import("../../src/oauth/store");
+  let release!: () => void, entered!: () => void;
+  const ready = new Promise<void>(resolve => { entered = resolve; });
+  const held = mutateStore(async () => { entered(); await new Promise<void>(resolve => { release = resolve; }); });
+  await ready;
+  const observe = f.capture();
+  const pending = observe(refusal());
+  try {
+    for (const enabled of [false, true]) {
+      f.config.providers[f.name]!.accountAutoPause!.enabled = enabled;
+      saveConfig(f.config);
+    }
+  } finally { release(); await held; }
+  expect(wasAccountAutoPaused(await pending)).toBe(false);
+  expect(f.paused()).toBe(false);
+  await f.capture()(refusal());
+  expect(f.paused()).toBe(true);
+});
diff --git a/tests/oauth/oauth-account-auto-pause.test.ts b/tests/oauth/oauth-account-auto-pause.test.ts
new file mode 100644
index 00000000000..a228c7c8246
--- /dev/null
+++ b/tests/oauth/oauth-account-auto-pause.test.ts
@@ -0,0 +1,278 @@
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { mkdtempSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { getDefaultConfig, loadConfig, saveConfig } from "../../src/config";
+import { captureAccountAutoPauseAttempt, wasAccountAutoPaused } from "../../src/oauth/account-auto-pause";
+import { AccountRefusalStreaks, autoPauseThreshold, classifyPermanentAccountRefusal, permanentAccountRefusal } from "../../src/oauth/account-auto-pause-policy";
+import { getValidAccessSnapshotForAccount, OAuthAccountPausedError } from "../../src/oauth";
+import { getAccountSet, saveCredential, setAccountPaused, setActiveAccount } from "../../src/oauth/store";
+import { routedProviderConfig } from "../../src/router";
+import { listProviderApiKeys } from "../../src/providers/api-keys";
+import { setProviderApiKeyPaused } from "../../src/providers/api-key-pause";
+import { rotateKeyOn401 } from "../../src/providers/key-failover";
+import { saveCodexAccountCredential } from "../../src/codex/account-store";
+import { setCodexAccountPaused } from "../../src/codex/account-pause";
+import { configSchema } from "../../src/config/schema/config-schema";
+import type { OcxConfig } from "../../src/types";
+import { removeTreeWithRetry } from "../helpers/remove-tree";
+
+const orgMessage = "OAuth authentication is currently not allowed for this organization";
+const payload = (message = orgMessage, type = "permission_error") => ({ error: { type, message } });
+const refusal = (status = 403) => Response.json(payload(), { status });
+const oldHome = process.env.OPENCODEX_HOME;
+let home: string;
+beforeEach(() => { home = mkdtempSync(join(tmpdir(), "ocx-auto-pause-")); process.env.OPENCODEX_HOME = home; });
+afterEach(() => {
+  if (oldHome === undefined) delete process.env.OPENCODEX_HOME; else process.env.OPENCODEX_HOME = oldHome;
+  removeTreeWithRetry(home);
+});
+function configFor(name: string, mode: "oauth" | "key" | "forward" = "oauth"): OcxConfig {
+  const config = getDefaultConfig();
+  config.providers = { [name]: { adapter: "openai-chat", baseUrl: "https://example.test/v1", authMode: mode,
+    accountAutoPause: { enabled: true } } };
+  config.defaultProvider = name;
+  return config;
+}
+async function oauthFixture(name = "command-code") {
+  const config = configFor(name);
+  for (let n = 0; n < 2; n++) await saveCredential(name, {
+    access: `synthetic-access-${n}`, refresh: `synthetic-refresh-${n}`,
+    expires: Date.now() + 3_600_000, accountId: `synthetic-${n}`, source: "oauth",
+  });
+  const ids = getAccountSet(name)!.accounts.map(a => a.id);
+  await setActiveAccount(name, ids[0]!);
+  saveConfig(config);
+  const snapshot = await getValidAccessSnapshotForAccount(name, ids[0]!);
+  const capture = () => captureAccountAutoPauseAttempt(name, config.providers[name]!, { config, oauth: snapshot },
+    new Headers({ authorization: `Bearer ${snapshot.accessToken}` }))!;
+  return { config, ids, snapshot, capture };
+}
+
+describe("permanent account refusal classification", () => {
+  for (const [message, expected] of [
+    [orgMessage, "oauth_organization_disabled"],
+    ["Your subscription has expired.", "subscription_expired"],
+    ["Your Claude subscription is inactive", "subscription_inactive"],
+    ["Your account does not have an active subscription", "subscription_inactive"],
+    ["Your plan was downgraded to free with no credits", "plan_downgraded"],
+    ["Your account does not have access to Claude Code", "account_permission_denied"],
+  ] as const) {
+    test(expected + ": exact 401/403 only", () => {
+      expect(classifyPermanentAccountRefusal(403, payload(message))).toBe(expected);
+      expect(classifyPermanentAccountRefusal(401, payload(message))).toBe(expected);
+      for (const status of [200, 400, 402, 429, 500, 503]) expect(classifyPermanentAccountRefusal(status, payload(message))).toBeUndefined();
+    });
+  }
+  test("model, request, quota, malformed and quoted errors grant no account authority", () => {
+    for (const message of ["You do not have access to this model", "Your quota resets tomorrow", "Your access token has expired", `Diagnostic: ${orgMessage}`, `Model says: Your subscription is inactive`]) {
+      expect(classifyPermanentAccountRefusal(403, payload(message))).toBeUndefined();
+    }
+    expect(classifyPermanentAccountRefusal(403, { error: { ...payload().error, code: "model_not_found" } })).toBeUndefined();
+    for (const value of [null, [], {}, { error: orgMessage }]) expect(classifyPermanentAccountRefusal(403, value)).toBeUndefined();
+  });
+  test("bounded reader preserves original and refuses malformed/oversized data", async () => {
+    const response = refusal();
+    expect(await permanentAccountRefusal(response)).toBe("oauth_organization_disabled");
+    expect(await response.json()).toEqual(payload());
+    expect(await permanentAccountRefusal(new Response("not json", { status: 403 }))).toBeUndefined();
+    expect(await permanentAccountRefusal(new Response("x".repeat(20_000), { status: 403 }))).toBeUndefined();
+  });
+  test("default off, default threshold two, strict schema", () => {
+    expect(autoPauseThreshold(undefined)).toBeUndefined();
+    expect(autoPauseThreshold({ enabled: false })).toBeUndefined();
+    expect(autoPauseThreshold({ enabled: true })).toBe(2);
+    for (const n of [0, -1, 1.5, 101]) expect(autoPauseThreshold({ enabled: true, consecutiveFailures: n })).toBeUndefined();
+    const config = configFor("fixture");
+    expect(configSchema.safeParse(config).success).toBe(true);
+    config.providers.fixture!.accountAutoPause!.consecutiveFailures = 0;
+    expect(configSchema.safeParse(config).success).toBe(false);
+  });
+});
+
+test("concurrent refusals pause once; response-arrival order serializes slow verdicts and success", async () => {
+  const tracker = new AccountRefusalStreaks();
+  let pauses = 0;
+  const pause = async () => { pauses++; return true; };
+  let resolve!: (value: "subscription_expired") => void;
+  const first = tracker.observe("fixture", "login", 2, new Promise(r => { resolve = r; }), false, () => true, pause);
+  const success = tracker.observe("fixture", "login", 2, Promise.resolve(undefined), true, () => true, pause);
+  const third = tracker.observe("fixture", "login", 2, Promise.resolve("subscription_expired"), false, () => true, pause);
+  resolve("subscription_expired");
+  await Promise.all([first, success, third]);
+  expect(pauses).toBe(0);
+  await Promise.all(Array.from({ length: 8 }, () => tracker.observe("fixture", "login", 2, Promise.resolve("subscription_expired"), false, () => true, pause)));
+  expect(pauses).toBe(1);
+});
+
+test("OAuth threshold, transient neutrality, stored reason, skip and manual resume", async () => {
+  const f = await oauthFixture();
+  await f.capture()(refusal());
+  expect(getAccountSet("command-code")!.accounts[0]!.paused).not.toBe(true);
+  await f.capture()(refusal(429));
+  const stale = f.capture();
+  const response = await f.capture()(refusal());
+  expect(wasAccountAutoPaused(response)).toBe(true);
+  const set = getAccountSet("command-code")!;
+  expect(set.accounts[0]!.pauseDetails?.reason).toBe("oauth_organization_disabled");
+  expect(set.accounts[0]!.pauseDetails?.pausedAt).toBeGreaterThan(0);
+  expect(set.activeAccountId).toBe(f.ids[1]!);
+  await expect(getValidAccessSnapshotForAccount("command-code", f.ids[0]!)).rejects.toBeInstanceOf(OAuthAccountPausedError);
+  await setAccountPaused("command-code", f.ids[0]!, false);
+  expect(getAccountSet("command-code")!.accounts[0]!.pauseDetails).toBeUndefined();
+  await stale(refusal()); // old pre-resume capture is fenced out
+  expect(getAccountSet("command-code")!.accounts[0]!.paused).not.toBe(true);
+});
+
+test("success resets, default-off and wrong credential headers do nothing", async () => {
+  const f = await oauthFixture();
+  await f.capture()(refusal());
+  await f.capture()(new Response("ok"));
+  await f.capture()(refusal());
+  expect(getAccountSet("command-code")!.accounts[0]!.paused).not.toBe(true);
+  f.config.providers["command-code"]!.accountAutoPause = undefined;
+  expect(f.capture()).toBeUndefined();
+  f.config.providers["command-code"]!.accountAutoPause = { enabled: true };
+  expect(captureAccountAutoPauseAttempt("command-code", f.config.providers["command-code"]!, { config: f.config, oauth: f.snapshot }, new Headers({ authorization: "Bearer synthetic-other" }))).toBeUndefined();
+});
+
+test("key pool pause persists disabled, rotates and resumes; later failover skips disabled entries", async () => {
+  const config = configFor("fixture", "key");
+  const provider = config.providers.fixture!;
+  provider.apiKey = "synthetic-A";
+  provider.apiKeyPool = ["A", "B", "C"].map(id => ({ id, key: `synthetic-${id}` }));
+  saveConfig(config);
+  const routed = routedProviderConfig("fixture", provider);
+  const capture = () => captureAccountAutoPauseAttempt("fixture", routed, { config }, new Headers({ authorization: `Bearer ${routed.apiKey}` }))!;
+  await capture()(refusal());
+  await capture()(refusal());
+  expect(config.providers.fixture!.apiKeyPool![0]!.disabled).toBe(true);
+  expect(loadConfig().providers.fixture!.apiKeyPool![0]!.pauseDetails?.reason).toBe("oauth_organization_disabled");
+  expect(config.providers.fixture!.apiKey).toBe("synthetic-B");
+  expect(rotateKeyOn401(config, "fixture", Date.now(), "synthetic-B")?.apiKey).toBe("synthetic-C");
+  expect(rotateKeyOn401(config, "fixture", Date.now(), "synthetic-C")).toBeNull();
+  expect(setProviderApiKeyPaused(config, "fixture", "A", false)).toBe(true);
+  expect(listProviderApiKeys(config, "fixture").keys[0]!.pauseDetails).toBeUndefined();
+});
+
+test("Codex pool uses persistent pause ids, generation fence and resume metadata", async () => {
+  const config = configFor("openai", "forward");
+  config.codexAccounts = [{ id: "fixture", email: "", isMain: false }];
+  const generation = saveCodexAccountCredential("fixture", { accessToken: "synthetic-access", refreshToken: "synthetic-refresh", expiresAt: Date.now() + 3_600_000, chatgptAccountId: "synthetic" });
+  saveConfig(config);
+  const codex = { kind: "pool" as const, accountId: "fixture", generation, writerGeneration: 0, accessToken: "synthetic-access", chatgptAccountId: "synthetic" };
+  const capture = () => captureAccountAutoPauseAttempt("openai", config.providers.openai!, { config, codex }, new Headers({ authorization: "Bearer synthetic-access", "chatgpt-account-id": "synthetic" }))!;
+  await capture()(refusal());
+  await capture()(refusal());
+  expect(config.pausedCodexAccountIds).toContain("fixture");
+  expect(loadConfig().pausedCodexAccountIds).toContain("fixture");
+  expect(config.codexAccountPauseState?.fixture?.details?.reason).toBe("oauth_organization_disabled");
+  setCodexAccountPaused(config, "fixture", false);
+  expect(config.codexAccountPauseState?.fixture?.details).toBeUndefined();
+});
+
+test("single scalar key materializes a resumable paused pool row", async () => {
+  const config = configFor("fixture", "key");
+  config.providers.fixture!.apiKey = "synthetic-single";
+  config.providers.fixture!.accountAutoPause!.consecutiveFailures = 1;
+  saveConfig(config);
+  const provider = routedProviderConfig("fixture", config.providers.fixture!);
+  const observe = captureAccountAutoPauseAttempt("fixture", provider, { config }, new Headers({ authorization: `Bearer ${provider.apiKey}` }))!;
+  await observe(refusal());
+  const entry = config.providers.fixture!.apiKeyPool![0]!;
+  expect(entry.disabled).toBe(true);
+  expect(config.providers.fixture!.apiKey).toBeUndefined();
+  expect(setProviderApiKeyPaused(config, "fixture", entry.id, false)).toBe(true);
+  expect(config.providers.fixture!.apiKey).toBe("synthetic-single");
+});
+
+test("replacing an environment-backed secret fences the old response", async () => {
+  const previous = process.env.OCX_AUTO_PAUSE_FIXTURE_KEY;
+  try {
+    process.env.OCX_AUTO_PAUSE_FIXTURE_KEY = "synthetic-old";
+    const config = configFor("fixture", "key");
+    config.providers.fixture!.apiKey = "$OCX_AUTO_PAUSE_FIXTURE_KEY";
+    config.providers.fixture!.apiKeyPool = [{ id: "fixture", key: "$OCX_AUTO_PAUSE_FIXTURE_KEY" }];
+    config.providers.fixture!.accountAutoPause!.consecutiveFailures = 1;
+    saveConfig(config);
+    const provider = routedProviderConfig("fixture", config.providers.fixture!);
+    const observe = captureAccountAutoPauseAttempt("fixture", provider, { config }, new Headers({ authorization: `Bearer ${provider.apiKey}` }))!;
+    process.env.OCX_AUTO_PAUSE_FIXTURE_KEY = "synthetic-new";
+    await observe(refusal());
+    expect(config.providers.fixture!.apiKeyPool![0]!.disabled).not.toBe(true);
+  } finally {
+    if (previous === undefined) delete process.env.OCX_AUTO_PAUSE_FIXTURE_KEY; else process.env.OCX_AUTO_PAUSE_FIXTURE_KEY = previous;
+  }
+});
+
+test("same-identity main credential replacement fences a delayed refusal", async () => {
+  const { observeMainQuotaCredential, observeMainQuotaIdentity } = await import("../../src/codex/main-account-cache");
+  const { captureConfigGeneration } = await import("../../src/lib/state-store-sweeper");
+  const config = configFor("openai", "forward");
+  config.providers.openai!.accountAutoPause!.consecutiveFailures = 1;
+  observeMainQuotaIdentity("synthetic-main");
+  const writer = observeMainQuotaCredential("synthetic-old", "synthetic-main")!;
+  saveConfig(config);
+  const observe = captureAccountAutoPauseAttempt("openai", config.providers.openai!, { config,
+    codex: { kind: "main-pool", accountId: "__main__", writerGeneration: captureConfigGeneration(), mainQuotaWriter: writer, accessToken: "synthetic-old", chatgptAccountId: "synthetic-main" },
+  }, new Headers({ authorization: "Bearer synthetic-old", "chatgpt-account-id": "synthetic-main" }))!;
+  observeMainQuotaCredential("synthetic-new", "synthetic-main");
+  await observe(refusal());
+  expect(config.pausedCodexAccountIds).toBeUndefined();
+});
+
+test("an async OAuth pause cannot commit after policy opt-out", async () => {
+  const f = await oauthFixture();
+  let enabled = true;
+  const row = getAccountSet("command-code")!.accounts[0]!;
+  const pending = setAccountPaused("command-code", row.id, true, { generation: f.snapshot.generation, pauseRevision: row.pauseRevision,
+    details: { reason: "subscription_expired", pausedAt: Date.now() }, isCurrent: () => enabled });
+  enabled = false;
+  await expect(pending).rejects.toThrow("policy changed");
+  expect(getAccountSet("command-code")!.accounts[0]!.paused).not.toBe(true);
+});
+
+test("removing an active key skips paused survivors, which remain deletable", async () => {
+  const { removeProviderApiKey } = await import("../../src/providers/api-keys");
+  const config = configFor("fixture", "key");
+  config.providers.fixture!.apiKey = "synthetic-B";
+  config.providers.fixture!.apiKeyPool = [{ id: "A", key: "synthetic-A", disabled: true }, { id: "B", key: "synthetic-B" }, { id: "C", key: "synthetic-C" }];
+  saveConfig(config);
+  expect(removeProviderApiKey(config, "fixture", "B")).toBe(true);
+  expect(config.providers.fixture!.apiKey).toBe("synthetic-C");
+  expect(removeProviderApiKey(config, "fixture", "A")).toBe(true);
+});
+
+test("Google structured account refusals classify without accepting model permission errors", () => {
+  expect(classifyPermanentAccountRefusal(403, { error: { code: 403, status: "PERMISSION_DENIED", message: "Your subscription is inactive" } })).toBe("subscription_inactive");
+  expect(classifyPermanentAccountRefusal(403, { error: { code: 403, status: "PERMISSION_DENIED", message: "This model is not available in this project" } })).toBeUndefined();
+});
+
+test("Antigravity normalization retains permanent refusal and auto-pause ownership", async () => {
+  const { fetchGoogleWithRetry } = await import("../../src/adapters/google-http");
+  const { wasPermanentAccountRefusal } = await import("../../src/oauth/account-auto-pause");
+  const config = configFor("fixture", "key");
+  config.providers.fixture!.apiKey = "synthetic-A";
+  config.providers.fixture!.accountAutoPause!.consecutiveFailures = 1;
+  saveConfig(config);
+  const provider = routedProviderConfig("fixture", config.providers.fixture!);
+  const headers = { authorization: `Bearer ${provider.apiKey}` };
+  const observe = captureAccountAutoPauseAttempt("fixture", provider, { config }, new Headers(headers))!;
+  const response = await fetchGoogleWithRetry("Antigravity", { url: "https://example.test", method: "POST", headers, body: "{}" }, {
+    executor: (async () => observe(refusal())) as typeof fetch,
+  });
+  expect(response.status).toBe(403);
+  expect(wasAccountAutoPaused(response)).toBe(true);
+  expect(wasPermanentAccountRefusal(response)).toBe(true);
+});
+
+test("a stale pre-resume response cannot erase the resumed account's refusal streak", async () => {
+  const f = await oauthFixture();
+  const stale = f.capture();
+  await setAccountPaused("command-code", f.ids[0]!, true);
+  await setAccountPaused("command-code", f.ids[0]!, false);
+  await f.capture()(refusal());
+  await stale(refusal());
+  await f.capture()(refusal());
+  expect(getAccountSet("command-code")!.accounts[0]!.paused).toBe(true);
+});
diff --git a/tests/oauth/oauth-upsert-paused-api-key.test.ts b/tests/oauth/oauth-upsert-paused-api-key.test.ts
new file mode 100644
index 00000000000..6c61f11069f
--- /dev/null
+++ b/tests/oauth/oauth-upsert-paused-api-key.test.ts
@@ -0,0 +1,61 @@
+import { describe, expect, test } from "bun:test";
+import { upsertOAuthProvider } from "../../src/oauth";
+import type { OcxConfig, OcxProviderConfig } from "../../src/types";
+
+function fixture(provider: string, fields: Partial<OcxProviderConfig>): OcxConfig {
+  return { port: 10100, defaultProvider: provider, providers: { [provider]: {
+    adapter: "openai-chat", baseUrl: "https://api.example.test/v1", authMode: "key", ...fields,
+  } } };
+}
+
+const paused = {
+  id: "paused", key: "paused-key-fixture", label: "Paused slot", addedAt: 42,
+  disabled: true, pauseRevision: "pause-revision-fixture",
+  pauseDetails: { reason: "subscription_expired", pausedAt: 1234 },
+} as const;
+
+describe("OAuth upsert preserves paused API keys", () => {
+  for (const provider of ["xai", "github-copilot"]) {
+    test.each([undefined, paused.key])(`${provider}: all-paused pool stays inactive (active=%s)`, apiKey => {
+      const config = fixture(provider, { apiKey, apiKeyPool: [structuredClone(paused)] });
+      const before = config.providers[provider]!;
+      upsertOAuthProvider(config, provider);
+      const after = config.providers[provider]!;
+      expect(after.apiKeyPool).toEqual([paused]);
+      expect(after.apiKeyPool).not.toBe(before.apiKeyPool);
+      expect(after.apiKeyPool![0]!.pauseDetails).not.toBe(before.apiKeyPool![0]!.pauseDetails);
+      expect(after.apiKey).toBeUndefined();
+      expect(after.authMode).toBe("oauth");
+      expect(before.apiKeyPool).toEqual([paused]);
+    });
+
+    test(`${provider}: promotes the first enabled key and preserves pause metadata`, () => {
+      const enabled = { id: "enabled", key: "enabled-key-fixture", disabled: false, pauseRevision: "resumed" };
+      const config = fixture(provider, { apiKeyPool: [structuredClone(paused), enabled] });
+      upsertOAuthProvider(config, provider);
+      expect(config.providers[provider]!.apiKey).toBe(enabled.key);
+      expect(config.providers[provider]!.apiKeyPool).toEqual([paused, enabled]);
+      expect(config.providers[provider]!.authMode).toBe("key");
+    });
+  }
+
+  test("malformed pause fields degrade independently while valid credentials survive", () => {
+    const badEntries = [
+      { id: "bad-types", key: "bad-types-key-fixture", disabled: "true", pauseRevision: 12,
+        pauseDetails: { reason: "subscription_expired", pausedAt: -1 } },
+      { ...paused, id: "bad-reason", key: "bad-reason-key-fixture",
+        pauseDetails: { reason: "unknown", pausedAt: 1234 } },
+      { ...paused, id: "bad-extra", key: "bad-extra-key-fixture",
+        pauseDetails: { ...paused.pauseDetails, extra: true } },
+    ];
+    const config = fixture("xai", { apiKeyPool: badEntries as unknown as OcxProviderConfig["apiKeyPool"] });
+    upsertOAuthProvider(config, "xai");
+    expect(config.providers.xai!.apiKeyPool).toEqual([
+      { id: "bad-types", key: "bad-types-key-fixture" },
+      { id: "bad-reason", key: "bad-reason-key-fixture", label: paused.label, addedAt: 42,
+        disabled: true, pauseRevision: paused.pauseRevision },
+      { id: "bad-extra", key: "bad-extra-key-fixture", label: paused.label, addedAt: 42,
+        disabled: true, pauseRevision: paused.pauseRevision },
+    ]);
+  });
+});
diff --git a/tests/providers/api-key-auto-pause-distribution.test.ts b/tests/providers/api-key-auto-pause-distribution.test.ts
new file mode 100644
index 00000000000..ce683cbfc2f
--- /dev/null
+++ b/tests/providers/api-key-auto-pause-distribution.test.ts
@@ -0,0 +1,78 @@
+import { afterEach, beforeEach, expect, test } from "bun:test";
+import { mkdtempSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { getDefaultConfig, loadConfig, saveConfig } from "../../src/config";
+import { captureAccountAutoPauseAttempt, wasAccountAutoPaused } from "../../src/oauth/account-auto-pause";
+import { providerApiKeySelectionIsCurrent, resolveCurrentProviderApiKeyTransport } from "../../src/providers/api-key-selection";
+import { clearKeyCooldowns, forgetApiKeyRotationCursor, selectProactiveApiKeyTransport } from "../../src/providers/key-failover";
+import { routedProviderConfig } from "../../src/router";
+import { removeTreeWithRetry } from "../helpers/remove-tree";
+
+let home: string;
+let previousHome: string | undefined;
+beforeEach(() => {
+  previousHome = process.env.OPENCODEX_HOME;
+  home = mkdtempSync(join(tmpdir(), "ocx-pause-distribution-"));
+  process.env.OPENCODEX_HOME = home;
+  clearKeyCooldowns(); forgetApiKeyRotationCursor();
+});
+afterEach(() => {
+  clearKeyCooldowns(); forgetApiKeyRotationCursor();
+  if (previousHome === undefined) delete process.env.OPENCODEX_HOME;
+  else process.env.OPENCODEX_HOME = previousHome;
+  removeTreeWithRetry(home);
+});
+function fixture() {
+  const config = getDefaultConfig();
+  config.providers = { fixture: { adapter: "openai-chat", authMode: "key", baseUrl: "https://example.test/v1",
+    apiKey: "synthetic-A", apiKeySelectionRevision: "saved-revision",
+    apiKeyPool: [{ id: "A", key: "synthetic-A" }, { id: "B", key: "synthetic-B" }],
+    requestPacing: { enabled: true, keySelection: "round-robin", keys: { maxConcurrentRequests: 1 } },
+    accountAutoPause: { enabled: true, consecutiveFailures: 1 },
+  } };
+  saveConfig(config);
+  const provider = config.providers.fixture!;
+  const route = routedProviderConfig("fixture", { ...provider, apiKey: "synthetic-B", _apiKeyAttempt: {
+    entryId: "B", reference: "synthetic-B", revision: provider.apiKeySelectionRevision, distributed: true,
+  } });
+  return { config, route };
+}
+const refusal = () => Response.json({ error: { type: "permission_error", message: "Your subscription has expired." } }, { status: 403 });
+
+test("a non-active distributed key pauses durably without changing the active key", async () => {
+  const { config, route } = fixture();
+  const observe = captureAccountAutoPauseAttempt("fixture", route, { config }, new Headers({ authorization: `Bearer ${route.apiKey}` }))!;
+  const response = await observe(refusal());
+  expect(wasAccountAutoPaused(response)).toBe(true);
+  for (const provider of [config.providers.fixture!, loadConfig().providers.fixture!]) {
+    expect(provider.apiKey).toBe("synthetic-A");
+    expect(provider.apiKeyPool![0]!.disabled).not.toBe(true);
+    expect(provider.apiKeyPool![1]).toMatchObject({ disabled: true, pauseDetails: { reason: "subscription_expired" } });
+  }
+  expect(providerApiKeySelectionIsCurrent(config, "fixture", route)).toBe(false);
+  const fresh = resolveCurrentProviderApiKeyTransport(config, "fixture", { ...route, _apiKeyAttempt: undefined })!;
+  for (let n = 0; n < 3; n++) expect(selectProactiveApiKeyTransport(config, "fixture", fresh)?.apiKey).toBe("synthetic-A");
+});
+
+for (const change of ["revision", "disabled", "headers"] as const) test(`distributed pause rejects stale or unowned ${change}`, async () => {
+  const { config, route } = fixture();
+  const headers = new Headers({ authorization: `Bearer ${change === "headers" ? "synthetic-override" : route.apiKey}` });
+  const observe = captureAccountAutoPauseAttempt("fixture", route, { config }, headers);
+  if (change === "revision") config.providers.fixture!.apiKeySelectionRevision = "replacement";
+  if (change === "disabled") config.providers.fixture!.accountAutoPause = { enabled: false };
+  saveConfig(config);
+  const response = refusal();
+  if (observe) await observe(response);
+  expect(wasAccountAutoPaused(response)).toBe(false);
+  expect(loadConfig().providers.fixture!.apiKeyPool![1]!.disabled).not.toBe(true);
+});
+
+test("a disabled distributed selection cannot dispatch even if its revision is unchanged", () => {
+  const { config, route } = fixture();
+  config.providers.fixture!.apiKeyPool![1]!.disabled = true;
+  expect(providerApiKeySelectionIsCurrent(config, "fixture", route)).toBe(false);
+  expect(resolveCurrentProviderApiKeyTransport(config, "fixture", route)).toBeNull();
+  const fresh = routedProviderConfig("fixture", config.providers.fixture!);
+  for (let n = 0; n < 3; n++) expect(selectProactiveApiKeyTransport(config, "fixture", fresh)?.apiKey).toBe("synthetic-A");
+});
diff --git a/tests/responses/responses-account-auto-pause-wire-owner.test.ts b/tests/responses/responses-account-auto-pause-wire-owner.test.ts
new file mode 100644
index 00000000000..6aa1c0beab9
--- /dev/null
+++ b/tests/responses/responses-account-auto-pause-wire-owner.test.ts
@@ -0,0 +1,473 @@
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { mkdtempSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { getDefaultConfig, loadConfig, saveConfig } from "../../src/config";
+import { observeMainQuotaCredential, observeMainQuotaIdentity } from "../../src/codex/main-account-cache";
+import { captureConfigGeneration } from "../../src/lib/state-store-sweeper";
+import type { CodexAuthContext } from "../../src/codex/auth-context";
+import { saveCodexAccountCredential } from "../../src/codex/account-store";
+import { captureAccountAutoPauseAttempt, wasAccountAutoPaused } from "../../src/oauth/account-auto-pause";
+import { clearGenericFailoverHealth } from "../../src/oauth/generic-account-failover";
+import { registerUpstreamRewriter, rewriteWebSocketDial, type UpstreamRewriter } from "../../src/plugins/upstream-hooks";
+import { clearKeyCooldowns, forgetApiKeyRotationCursor } from "../../src/providers/key-failover";
+import { routedProviderConfig } from "../../src/router";
+import { resetProviderRequestPacingForTest } from "../../src/providers/request-pacing";
+import { clearResponseStateForTests, flushResponseState } from "../../src/responses/state";
+import { handleChatCompletions } from "../../src/server/chat-completions";
+import { handleClaudeMessages } from "../../src/server/claude-messages";
+import { providerFetch } from "../../src/server/responses/fetch-helpers";
+import { bindUpstreamRequestCompressionConfig } from "../../src/server/responses/request-compression";
+import { gunzipSync } from "node:zlib";
+import { handleResponses } from "../../src/server/responses/core";
+import type { OcxConfig } from "../../src/types";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
+import { removeTreeWithRetry } from "../helpers/remove-tree";
+
+const originalFetch = globalThis.fetch;
+let previousHome: string | undefined;
+let home: string;
+let releaseSpend: () => void;
+const unregister: (() => void)[] = [];
+const target = "https://example.test/v1/responses";
+const replacementTarget = "https://other.example.test/v1/responses";
+const refusal = () => Response.json({ error: { type: "permission_error", message: "Your subscription has expired." } }, { status: 403 });
+
+beforeEach(() => {
+  previousHome = process.env.OPENCODEX_HOME;
+  home = mkdtempSync(join(tmpdir(), "ocx-auto-pause-wire-owner-"));
+  process.env.OPENCODEX_HOME = home;
+  releaseSpend = acquireOwnedSpendHome();
+  clearGenericFailoverHealth(); clearKeyCooldowns(); forgetApiKeyRotationCursor();
+});
+afterEach(async () => {
+  for (const remove of unregister.splice(0)) remove();
+  await flushResponseState(); clearResponseStateForTests();
+  releaseSpend();
+  clearGenericFailoverHealth(); clearKeyCooldowns(); forgetApiKeyRotationCursor();
+  globalThis.fetch = originalFetch;
+  if (previousHome === undefined) delete process.env.OPENCODEX_HOME;
+  else process.env.OPENCODEX_HOME = previousHome;
+  removeTreeWithRetry(home);
+});
+function rewrite(fn: UpstreamRewriter) {
+  unregister.push(registerUpstreamRewriter("account-auto-pause-wire-owner-fixture", fn));
+}
+function fixture(adapter: "openai-chat" | "anthropic" | "openai-responses" = "openai-chat"): OcxConfig {
+  const config = getDefaultConfig();
+  config.defaultProvider = "fixture"; config.defaultModel = "fixture";
+  config.providers = { fixture: { adapter, authMode: "key", baseUrl: "https://example.test/v1", models: ["fixture"],
+    apiKey: "synthetic-A", apiKeyPool: [{ id: "A", key: "synthetic-A" }, { id: "B", key: "synthetic-B" }],
+    requestPacing: { enabled: true, keySelection: "round-robin", keys: { maxConcurrentRequests: 1 } },
+    accountAutoPause: { enabled: true, consecutiveFailures: 1 },
+  } };
+  if (adapter === "anthropic") config.protocols = { rollout: { managedMessagesNative: true } };
+  saveConfig(config);
+  return config;
+}
+function expectUnpaused(config: OcxConfig) {
+  for (const provider of [config.providers.fixture!, loadConfig().providers.fixture!]) {
+    expect(provider.apiKeyPool!.map(row => row.id)).toEqual(["A", "B"]);
+    for (const row of provider.apiKeyPool!) {
+      expect(row.disabled).not.toBe(true);
+      expect(row.pauseDetails).toBeUndefined();
+    }
+  }
+}
+function expectPaused(config: OcxConfig) {
+  for (const provider of [config.providers.fixture!, loadConfig().providers.fixture!]) {
+    expect(provider.apiKeyPool![0]).toMatchObject({ id: "A", disabled: true, pauseDetails: { reason: "subscription_expired" } });
+    expect(provider.apiKeyPool![1]!.disabled).not.toBe(true);
+  }
+}
+
+for (const wire of ["Chat", "Messages"] as const) {
+  for (const replaced of [true, false]) {
+    test(`native ${wire}: ${replaced ? "rewritten credential cannot pause either round-robin key" : "identity rewriter still permits the wire owner to pause"}`, async () => {
+      const config = fixture(wire === "Chat" ? "openai-chat" : "anthropic");
+      const credentialHeader = wire === "Chat" ? "authorization" : "x-api-key";
+      const beforeRewrite: string[] = [];
+      rewrite(({ headers }) => {
+        beforeRewrite.push(headers.get(credentialHeader)!);
+        if (replaced) headers.set(credentialHeader, wire === "Chat" ? "Bearer synthetic-third" : "synthetic-third");
+      });
+      const sent: { url: string; credential: string | null; response: Response }[] = [];
+      globalThis.fetch = (async (input, init) => {
+        const credential = new Headers(init?.headers).get(credentialHeader);
+        const response = !replaced && credential?.includes("synthetic-B")
+          ? Response.json(wire === "Chat"
+            ? { id: "synthetic-chat", object: "chat.completion", model: "fixture", choices: [{ index: 0, message: { role: "assistant", content: "ok" }, finish_reason: "stop" }], usage: { prompt_tokens: 1, completion_tokens: 1, total_tokens: 2 } }
+            : { id: "synthetic-message", type: "message", role: "assistant", model: "fixture", content: [{ type: "text", text: "ok" }], stop_reason: "end_turn", usage: { input_tokens: 1, output_tokens: 1 } })
+          : refusal();
+        sent.push({ url: String(input), credential, response });
+        return response;
+      }) as typeof fetch;
+      const endpoint = wire === "Chat" ? "chat/completions" : "messages";
+      const request = new Request(`http://localhost/v1/${endpoint}`, { method: "POST", headers: { "content-type": "application/json" },
+        body: JSON.stringify({ model: "fixture/fixture", max_tokens: 64, messages: [{ role: "user", content: "synthetic" }], stream: false }),
+      });
+      const handler = wire === "Chat" ? handleChatCompletions : handleClaudeMessages;
+      const response = await handler(request, config, { model: "fixture", provider: "fixture" });
+      const body = await response.text();
+      expect(response.status, body).toBe(replaced ? 403 : 200);
+      expect(sent).toHaveLength(replaced ? 1 : 2);
+      expect(sent[0]!.url).toContain(`/v1/${endpoint}`);
+      expect(beforeRewrite).toEqual((replaced ? ["A"] : ["A", "B"]).map(id => wire === "Chat" ? `Bearer synthetic-${id}` : `synthetic-${id}`));
+      expect(sent[0]!.credential).toBe(wire === "Chat" ? `Bearer synthetic-${replaced ? "third" : "A"}` : `synthetic-${replaced ? "third" : "A"}`);
+      expect(wasAccountAutoPaused(sent[0]!.response)).toBe(!replaced);
+      if (replaced) {
+        expect(wasAccountAutoPaused(response)).toBe(false);
+        expectUnpaused(config);
+      } else expectPaused(config);
+    });
+  }
+}
+
+for (const change of ["credential", "URL", "conflicting header", "none", "identity rewriter"] as const) {
+  test(`Responses providerFetch: ${change} ${change === "none" || change === "identity rewriter" ? "pauses the wire owner" : "does not pause a configured key"}`, async () => {
+    const config = fixture("openai-responses");
+    const route = routedProviderConfig("fixture", config.providers.fixture!);
+    const rewrittenFrom: string[] = [];
+    if (change !== "none") rewrite(t => {
+      rewrittenFrom.push(t.headers.get("authorization")!);
+      if (change === "credential") t.headers.set("authorization", "Bearer synthetic-third");
+      if (change === "URL") t.url = replacementTarget;
+      if (change === "conflicting header") t.headers.set("x-api-key", "synthetic-third");
+    });
+    const sends: { url: string; headers: Headers }[] = [];
+    const upstream = refusal();
+    const physical = (async (input, init) => {
+      sends.push({ url: String(input), headers: new Headers(init?.headers) });
+      return upstream;
+    }) as typeof fetch;
+    let captured = 0;
+    const send = providerFetch(Object.assign(route, { fetch: physical }), undefined, {
+      providerName: "fixture", httpOnly: true,
+      accountAutoPause: (name, provider, headers) => {
+        captured++;
+        const observer = captureAccountAutoPauseAttempt(name, provider, { config }, headers);
+        expect(observer).toBeDefined();
+        return observer;
+      },
+    });
+    const response = await send(target, { method: "POST", headers: { authorization: "Bearer synthetic-A" }, body: "{}" });
+    const body = await response.json();
+    expect(captured).toBe(1);
+    expect(response.status).toBe(403);
+    expect(body).toEqual({ error: { type: "permission_error", message: "Your subscription has expired." } });
+    expect(sends).toHaveLength(1);
+    expect(rewrittenFrom).toEqual(change === "none" ? [] : ["Bearer synthetic-A"]);
+    expect(sends[0]!.url).toBe(change === "URL" ? replacementTarget : target);
+    expect(sends[0]!.headers.get("authorization")).toBe(change === "credential" ? "Bearer synthetic-third" : "Bearer synthetic-A");
+    expect(sends[0]!.headers.get("x-api-key")).toBe(change === "conflicting header" ? "synthetic-third" : null);
+    const shouldPause = change === "none" || change === "identity rewriter";
+    expect(wasAccountAutoPaused(response)).toBe(shouldPause);
+    if (shouldPause) expectPaused(config); else expectUnpaused(config);
+  });
+}
+
+for (const registered of [true, false]) {
+  test(`observer without physical report: ${registered ? "registered rewriter prevents counting" : "no rewriter permits counting"}`, async () => {
+    const config = fixture();
+    const route = routedProviderConfig("fixture", config.providers.fixture!);
+    const observer = captureAccountAutoPauseAttempt("fixture", route, { config }, new Headers({ authorization: "Bearer synthetic-A" }));
+    expect(observer).toBeDefined();
+    // Captured before registration: the no-report fallback must check at response time.
+    if (registered) rewrite(() => {});
+    const response = refusal();
+    expect(await observer!(response)).toBe(response);
+    expect(wasAccountAutoPaused(response)).toBe(!registered);
+    if (registered) expectUnpaused(config); else expectPaused(config);
+  });
+}
+
+test("physical report with matching bearer and conflicting x-api-key grants no API-key pause authority", async () => {
+  const config = fixture();
+  const route = routedProviderConfig("fixture", config.providers.fixture!);
+  const observer = captureAccountAutoPauseAttempt("fixture", route, { config }, new Headers({ authorization: "Bearer synthetic-A" }))!;
+  expect(observer).toBeDefined();
+  expect(typeof observer.physical).toBe("function");
+  observer.physical(true, new Headers({ authorization: "Bearer synthetic-A", "x-api-key": "synthetic-third" }));
+  const response = refusal();
+  expect(await observer(response)).toBe(response);
+  expect(wasAccountAutoPaused(response)).toBe(false);
+  expectUnpaused(config);
+});
+
+
+describe("Responses handler translated Chat physical send ownership", () => {
+  beforeEach(() => resetProviderRequestPacingForTest());
+  afterEach(() => resetProviderRequestPacingForTest());
+  for (const plugin of ["none", "identity", "credential replacement then unregister"] as const) {
+    test(`${plugin}: ${plugin === "credential replacement then unregister" ? "preserves refusal without pausing either key" : "pauses A and recovers with B"}`, async () => {
+      const config = fixture("openai-chat");
+      const rewrittenFrom: string[] = [];
+      let removeRewriter: (() => void) | undefined;
+      const replaced = plugin === "credential replacement then unregister";
+      if (plugin !== "none") {
+        removeRewriter = registerUpstreamRewriter("responses-chat-wire-owner-fixture", ({ headers, transport }) => {
+          expect(transport).toBe("http");
+          rewrittenFrom.push(headers.get("authorization")!);
+          if (replaced) headers.set("authorization", "Bearer synthetic-third");
+        });
+        unregister.push(removeRewriter);
+      }
+      const sends: { url: string; credential: string | null; response: Response }[] = [];
+      globalThis.fetch = (async (input, init) => {
+        const credential = new Headers(init?.headers).get("authorization");
+        // The plugin disappears while the rewritten physical send is in flight.
+        if (replaced) removeRewriter!();
+        const response = credential === "Bearer synthetic-B"
+          ? Response.json({ id: "synthetic-chat", object: "chat.completion", model: "fixture",
+            choices: [{ index: 0, message: { role: "assistant", content: "ok" }, finish_reason: "stop" }],
+            usage: { prompt_tokens: 1, completion_tokens: 1, total_tokens: 2 } })
+          : refusal();
+        sends.push({ url: String(input), credential, response });
+        return response;
+      }) as typeof fetch;
+      const response = await handleResponses(new Request("http://localhost/v1/responses", {
+        method: "POST", headers: { "content-type": "application/json" },
+        body: JSON.stringify({ model: "fixture/fixture", input: "synthetic", stream: false, store: false }),
+      }), config, { model: "fixture", provider: "fixture" });
+      const body = await response.text();
+      expect(response.status, body).toBe(replaced ? 403 : 200);
+      expect(sends.map(send => send.url)).toEqual(Array(replaced ? 1 : 2).fill("https://example.test/v1/chat/completions"));
+      expect(sends.map(send => send.credential)).toEqual(replaced
+        ? ["Bearer synthetic-third"] : ["Bearer synthetic-A", "Bearer synthetic-B"]);
+      expect(rewrittenFrom).toEqual(plugin === "none" ? []
+        : replaced ? ["Bearer synthetic-A"] : ["Bearer synthetic-A", "Bearer synthetic-B"]);
+      expect(wasAccountAutoPaused(sends[0]!.response)).toBe(!replaced);
+      if (replaced) {
+        expect(body).toContain("Your subscription has expired.");
+        expectUnpaused(config);
+      } else {
+        expect(body).toContain("ok");
+        expectPaused(config);
+      }
+    });
+  }
+});
+
+describe("Codex pool WebSocket observer without a physical report", () => {
+  for (const plugin of ["registered after capture then removed", "registered at capture then removed", "none"] as const) {
+    test(`${plugin}: ${plugin === "none" ? "counts the refusal and pauses the captured account" : "does not count the rewritten dial refusal"}`, async () => {
+      const config = getDefaultConfig();
+      config.defaultProvider = "openai"; config.defaultModel = "gpt-5.5";
+      config.providers = { openai: { adapter: "openai-responses", authMode: "forward", codexAccountMode: "pool",
+        baseUrl: "https://chatgpt.com/backend-api/codex", models: ["gpt-5.5"],
+        accountAutoPause: { enabled: true, consecutiveFailures: 1 } } };
+      config.codexAccounts = ["fixture-a", "fixture-b"].map(id => ({ id, email: "", isMain: false }));
+      config.activeCodexAccountId = "fixture-a";
+      const generation = saveCodexAccountCredential("fixture-a", { accessToken: "synthetic-access", refreshToken: "synthetic-refresh",
+        expiresAt: Date.now() + 3_600_000, chatgptAccountId: "synthetic-account" });
+      saveConfig(config);
+      let removeRewriter: (() => void) | undefined;
+      let rewrites = 0;
+      const install = () => {
+        removeRewriter = registerUpstreamRewriter("codex-ws-wire-owner-fixture", target => {
+          rewrites++;
+          expect(target.transport).toBe("websocket");
+          target.headers.set("authorization", "Bearer synthetic-third");
+        });
+        unregister.push(removeRewriter);
+      };
+      if (plugin === "registered at capture then removed") install();
+      const observer = captureAccountAutoPauseAttempt("openai", config.providers.openai!, { config,
+        codex: { kind: "pool", accountId: "fixture-a", generation, writerGeneration: 0,
+          accessToken: "synthetic-access", chatgptAccountId: "synthetic-account" },
+      }, new Headers({ authorization: "Bearer synthetic-access", "chatgpt-account-id": "synthetic-account" }));
+      expect(observer).toBeDefined();
+      if (plugin === "registered after capture then removed") install();
+      const dial = rewriteWebSocketDial("wss://chatgpt.com/backend-api/codex/responses", {
+        authorization: "Bearer synthetic-access", "chatgpt-account-id": "synthetic-account",
+      }, undefined);
+      expect(rewrites).toBe(plugin === "none" ? 0 : 1);
+      expect(dial.headers.authorization).toBe(plugin === "none" ? "Bearer synthetic-access" : "Bearer synthetic-third");
+      removeRewriter?.();
+      // WebSocket has no HTTP physical report; observe only after the plugin is gone.
+      const response = refusal();
+      expect(await observer!(response)).toBe(response);
+      expect(response.status).toBe(403);
+      expect(await response.json()).toEqual({ error: { type: "permission_error", message: "Your subscription has expired." } });
+      const shouldPause = plugin === "none";
+      expect(wasAccountAutoPaused(response)).toBe(shouldPause);
+      for (const live of [config, loadConfig()]) {
+        expect(live.pausedCodexAccountIds?.includes("fixture-a") ?? false).toBe(shouldPause);
+        expect(live.pausedCodexAccountIds?.includes("fixture-b") ?? false).toBe(false);
+        if (shouldPause) expect(live.codexAccountPauseState?.["fixture-a"]?.details?.reason).toBe("subscription_expired");
+        else expect(live.codexAccountPauseState?.["fixture-a"]).toBeUndefined();
+      }
+    });
+  }
+});
+
+describe("nested auto-pause observers on one physical response", () => {
+  test("count a refusal once per account when both observers see it", async () => {
+    const config = fixture();
+    config.providers.fixture!.accountAutoPause = { enabled: true, consecutiveFailures: 2 };
+    saveConfig(config);
+    const route = routedProviderConfig("fixture", config.providers.fixture!);
+    const headers = () => new Headers({ authorization: "Bearer synthetic-A" });
+    const outer = captureAccountAutoPauseAttempt("fixture", route, { config }, headers())!;
+    const inner = captureAccountAutoPauseAttempt("fixture", route, { config }, headers())!;
+    inner.physical(true, headers());
+    const first = refusal();
+    await inner(first);
+    await outer(first);
+    expect(wasAccountAutoPaused(first)).toBe(false);
+    expectUnpaused(config);
+    // The streak still holds one refusal: the next owned refusal reaches the threshold of two.
+    const next = captureAccountAutoPauseAttempt("fixture", route, { config }, headers())!;
+    next.physical(true, headers());
+    const second = refusal();
+    await next(second);
+    expect(wasAccountAutoPaused(second)).toBe(true);
+    expectPaused(config);
+  });
+
+  test("an unreported observer never attributes a response reported as sent with another credential", async () => {
+    const config = fixture();
+    const route = routedProviderConfig("fixture", config.providers.fixture!);
+    const headers = new Headers({ authorization: "Bearer synthetic-A" });
+    const outer = captureAccountAutoPauseAttempt("fixture", route, { config }, headers)!;
+    const inner = captureAccountAutoPauseAttempt("fixture", route, { config }, headers)!;
+    inner.physical(true, new Headers({ authorization: "Bearer synthetic-third" }));
+    const response = refusal();
+    await inner(response);
+    await outer(response);
+    expect(wasAccountAutoPaused(response)).toBe(false);
+    expectUnpaused(config);
+  });
+});
+
+function codexFixture(kind: "pool" | "main-pool") {
+  const config = getDefaultConfig();
+  config.defaultProvider = "openai";
+  config.providers = { openai: { adapter: "openai-responses", authMode: "forward", codexAccountMode: "pool",
+    baseUrl: "https://chatgpt.com/backend-api/codex", accountAutoPause: { enabled: true, consecutiveFailures: 1 } } };
+  const accountId = kind === "pool" ? "fixture-a" : "__main__";
+  config.codexAccounts = [{ id: accountId, email: "", isMain: kind === "main-pool" }, { id: "fixture-b", email: "", isMain: false }];
+  config.activeCodexAccountId = accountId;
+  let codex: CodexAuthContext;
+  if (kind === "pool") {
+    const generation = saveCodexAccountCredential(accountId, { accessToken: "synthetic-access", refreshToken: "synthetic-refresh",
+      expiresAt: Date.now() + 3_600_000, chatgptAccountId: "synthetic-account" });
+    codex = { kind, accountId, generation, writerGeneration: 0, accessToken: "synthetic-access", chatgptAccountId: "synthetic-account" };
+  } else {
+    observeMainQuotaIdentity("synthetic-account");
+    const mainQuotaWriter = observeMainQuotaCredential("synthetic-access", "synthetic-account")!;
+    codex = { kind, accountId, writerGeneration: captureConfigGeneration(), mainQuotaWriter,
+      accessToken: "synthetic-access", chatgptAccountId: "synthetic-account" };
+  }
+  saveConfig(config);
+  const headers = new Headers({ authorization: "Bearer synthetic-access", "chatgpt-account-id": "synthetic-account" });
+  const capture = (sent = headers) => captureAccountAutoPauseAttempt("openai", config.providers.openai!, { config, codex }, sent);
+  const expectPause = (paused: boolean) => {
+    for (const live of [config, loadConfig()]) {
+      expect(live.pausedCodexAccountIds?.includes(accountId) ?? false).toBe(paused);
+      expect(live.pausedCodexAccountIds?.includes("fixture-b") ?? false).toBe(false);
+      if (paused) expect(live.codexAccountPauseState?.[accountId]?.details?.reason).toBe("subscription_expired");
+      else expect(live.codexAccountPauseState?.[accountId]).toBeUndefined();
+    }
+  };
+  return { headers, capture, expectPause };
+}
+
+for (const kind of ["pool", "main-pool"] as const) {
+  for (const change of ["workspace replaced", "workspace deleted", "organization added", "organization changed", "organization deleted",
+    "project added", "project changed", "project deleted", "matching headers", "matching selectors"] as const) {
+    test(`Codex ${kind} physical report: ${change}`, async () => {
+      const f = codexFixture(kind);
+      if (change === "organization changed" || change === "organization deleted" || change === "matching selectors") f.headers.set("openai-organization", "synthetic-org");
+      if (change === "project changed" || change === "project deleted" || change === "matching selectors") f.headers.set("openai-project", "synthetic-project");
+      const observer = f.capture();
+      expect(observer).toBeDefined();
+      const sent = new Headers(f.headers);
+      if (change === "workspace replaced") sent.set("chatgpt-account-id", "synthetic-other-account");
+      if (change === "workspace deleted") sent.delete("chatgpt-account-id");
+      if (change === "organization added" || change === "organization changed") sent.set("openai-organization", "synthetic-other-org");
+      if (change === "organization deleted") sent.delete("openai-organization");
+      if (change === "project added" || change === "project changed") sent.set("openai-project", "synthetic-other-project");
+      if (change === "project deleted") sent.delete("openai-project");
+      expect(sent.get("authorization")).toBe("Bearer synthetic-access");
+      observer!.physical(true, sent);
+      const response = refusal();
+      expect(await observer!(response)).toBe(response);
+      expect(response.status).toBe(403);
+      const shouldPause = change === "matching headers" || change === "matching selectors";
+      expect(wasAccountAutoPaused(response)).toBe(shouldPause);
+      f.expectPause(shouldPause);
+    });
+  }
+  for (const workspace of ["missing", "different"] as const) {
+    test(`Codex ${kind} capture: ${workspace} workspace grants no observer`, () => {
+      const f = codexFixture(kind);
+      if (workspace === "missing") f.headers.delete("chatgpt-account-id");
+      else f.headers.set("chatgpt-account-id", "synthetic-other-account");
+      expect(f.capture()).toBeUndefined();
+      f.expectPause(false);
+    });
+  }
+  for (const registered of [false, true]) {
+    test(`Codex ${kind} no physical report with workspace: ${registered ? "rewriter blocks pause" : "no rewriter permits pause"}`, async () => {
+      const f = codexFixture(kind);
+      expect(f.headers.get("chatgpt-account-id")).toBe("synthetic-account");
+      const observer = f.capture();
+      expect(observer).toBeDefined();
+      if (registered) rewrite(() => {});
+      const response = refusal();
+      expect(await observer!(response)).toBe(response);
+      expect(wasAccountAutoPaused(response)).toBe(!registered);
+      f.expectPause(!registered);
+    });
+  }
+}
+
+describe("auto-pause ownership on compressed native Responses sends", () => {
+  const codexUrl = "https://chatgpt.com/backend-api/codex/responses";
+  for (const rewritten of [false, true]) {
+    test(`${rewritten ? "rewritten credential under gzip does not pause" : "wire owner under gzip pauses"}; the report carries post-compression headers`, async () => {
+      bindUpstreamRequestCompressionConfig({ upstreamRequestCompression: "gzip" });
+      try {
+        const config = fixture("openai-responses");
+        const route = routedProviderConfig("fixture", config.providers.fixture!);
+        if (rewritten) rewrite(t => { t.headers.set("authorization", "Bearer synthetic-third"); });
+        const original = JSON.stringify({ input: "x".repeat(4096) });
+        const reported: Headers[] = [];
+        const sends: { headers: Headers; body: Uint8Array }[] = [];
+        const upstream = refusal();
+        const physical = (async (_input, init) => {
+          sends.push({ headers: new Headers(init?.headers), body: new Uint8Array(init?.body as ArrayBufferLike) });
+          return upstream;
+        }) as typeof fetch;
+        const send = providerFetch(Object.assign(route, { fetch: physical }), undefined, {
+          providerName: "fixture", httpOnly: true,
+          accountAutoPause: (name, provider, headers) => {
+            const observer = captureAccountAutoPauseAttempt(name, provider, { config }, headers)!;
+            expect(observer).toBeDefined();
+            const report = observer.physical;
+            observer.physical = (sameDestination, wire) => { reported.push(new Headers(wire)); report(sameDestination, wire); };
+            return observer;
+          },
+        });
+        const response = await send(codexUrl, { method: "POST",
+          headers: { authorization: "Bearer synthetic-A", "content-type": "application/json", "content-length": String(original.length) }, body: original });
+        // Consuming the body releases the per-key pacing slot for the next case.
+        expect(await response.json()).toEqual({ error: { type: "permission_error", message: "Your subscription has expired." } });
+        expect(sends).toHaveLength(1);
+        expect(reported).toHaveLength(1);
+        for (const headers of [reported[0]!, sends[0]!.headers]) {
+          expect(headers.get("content-encoding")).toBe("gzip");
+          expect(headers.get("content-length")).toBeNull();
+          expect(headers.get("authorization")).toBe(rewritten ? "Bearer synthetic-third" : "Bearer synthetic-A");
+        }
+        expect(new TextDecoder().decode(gunzipSync(sends[0]!.body))).toBe(original);
+        expect(wasAccountAutoPaused(response)).toBe(!rewritten);
+        if (rewritten) expectUnpaused(config); else expectPaused(config);
+      } finally {
+        bindUpstreamRequestCompressionConfig(null);
+      }
+    });
+  }
+});
+
diff --git a/tests/responses/responses-account-auto-pause.test.ts b/tests/responses/responses-account-auto-pause.test.ts
new file mode 100644
index 00000000000..ff99c31ab95
--- /dev/null
+++ b/tests/responses/responses-account-auto-pause.test.ts
@@ -0,0 +1,230 @@
+import { afterEach, beforeEach, expect, test } from "bun:test";
+import { mkdtempSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { getDefaultConfig, saveConfig } from "../../src/config";
+import { getAccountSet, saveCredential, setActiveAccount } from "../../src/oauth/store";
+import { handleResponses } from "../../src/server/responses/core";
+import { flushResponseState, clearResponseStateForTests } from "../../src/responses/state";
+import { clearGenericFailoverHealth } from "../../src/oauth/generic-account-failover";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
+import { removeTreeWithRetry } from "../helpers/remove-tree";
+import type { OcxConfig } from "../../src/types";
+
+const originalHome = process.env.OPENCODEX_HOME;
+const originalFetch = globalThis.fetch;
+let home: string;
+let releaseSpend: () => void;
+beforeEach(() => {
+  home = mkdtempSync(join(tmpdir(), "ocx-auto-pause-runtime-"));
+  process.env.OPENCODEX_HOME = home;
+  releaseSpend = acquireOwnedSpendHome();
+  clearGenericFailoverHealth();
+});
+afterEach(async () => {
+  await flushResponseState(); clearResponseStateForTests();
+  releaseSpend(); clearGenericFailoverHealth();
+  globalThis.fetch = originalFetch;
+  if (originalHome === undefined) delete process.env.OPENCODEX_HOME; else process.env.OPENCODEX_HOME = originalHome;
+  removeTreeWithRetry(home);
+});
+const orgRefusal = () => Response.json({ error: { type: "permission_error", message: "OAuth authentication is currently not allowed for this organization" } }, { status: 403 });
+const completion = () => Response.json({ id: "synthetic-completion", object: "chat.completion", model: "fixture", choices: [{ index: 0, message: { role: "assistant", content: "ok" }, finish_reason: "stop" }], usage: { prompt_tokens: 1, completion_tokens: 1, total_tokens: 2 } });
+function configFor(name: string, oauth: boolean): OcxConfig {
+  const config = getDefaultConfig();
+  config.defaultProvider = name; config.defaultModel = "fixture";
+  config.providers = { [name]: { baseUrl: "https://example.test/v1", adapter: "openai-chat", authMode: oauth ? "oauth" : "key", models: ["fixture"], accountAutoPause: { enabled: true },
+    ...(!oauth ? { apiKey: "synthetic-A", apiKeyPool: [{ id: "A", key: "synthetic-A" }, { id: "B", key: "synthetic-B" }] } : {}),
+  } };
+  saveConfig(config);
+  return config;
+}
+async function send(config: OcxConfig, name: string, sendBudget?: import("../../src/lib/request-execution-budget").RequestExecutionBudget) {
+  const response = await handleResponses(new Request("http://localhost/v1/responses", { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ model: `${name}/fixture`, input: "synthetic", stream: false, store: false }) }), config, { model: "fixture", provider: name }, { sendBudget });
+  const text = await response.text();
+  return { status: response.status, text };
+}
+for (const oauth of [true, false]) {
+  test(`${oauth ? "OAuth" : "key"} HTTP path pauses at threshold and serves the same request with its sibling`, async () => {
+    const name = oauth ? "command-code" : "fixture";
+    if (oauth) {
+      for (let n = 0; n < 2; n++) await saveCredential(name, { access: `synthetic-${n}`, refresh: `synthetic-refresh-${n}`, expires: Date.now() + 3_600_000, accountId: `synthetic-${n}`, source: "oauth" });
+      await setActiveAccount(name, getAccountSet(name)!.accounts[0]!.id);
+    }
+    const config = configFor(name, oauth);
+    const sends: string[] = [];
+    globalThis.fetch = (async (_input, init) => {
+      const auth = new Headers(init?.headers).get("authorization")!;
+      sends.push(auth);
+      return auth === `Bearer synthetic-${oauth ? "0" : "A"}` ? orgRefusal() : completion();
+    }) as typeof fetch;
+    const first = await send(config, name);
+    expect(first.status, first.text).toBe(403);
+    expect(sends.length).toBe(1);
+    const second = await send(config, name);
+    expect(second.status, second.text).toBe(200);
+    expect(sends).toEqual([`Bearer synthetic-${oauth ? "0" : "A"}`, `Bearer synthetic-${oauth ? "0" : "A"}`, `Bearer synthetic-${oauth ? "1" : "B"}`]);
+    const third = await send(config, name);
+    expect(third.status, third.text).toBe(200);
+    expect(sends.at(-1)).toBe(`Bearer synthetic-${oauth ? "1" : "B"}`);
+  });
+}
+
+test("default-off HTTP requests preserve the refusal and never rotate/pause", async () => {
+  const config = configFor("fixture", false);
+  delete config.providers.fixture!.accountAutoPause;
+  saveConfig(config);
+  let sends = 0;
+  globalThis.fetch = (async () => { sends++; return orgRefusal(); }) as typeof fetch;
+  for (let n = 0; n < 3; n++) expect((await send(config, "fixture")).status).toBe(403);
+  expect(sends).toBe(3);
+  expect(config.providers.fixture!.apiKeyPool![0]!.disabled).not.toBe(true);
+});
+
+test("Anthropic organization refusal pauses and rebuilds the in-flight OAuth request", async () => {
+  const { deriveOAuthProviderConfig } = await import("../../src/providers/derive");
+  const { clearAnthropicAccountPoolState } = await import("../../src/oauth/anthropic-routing");
+  clearAnthropicAccountPoolState();
+  for (let n = 0; n < 2; n++) await saveCredential("anthropic", { access: `synthetic-${n}`, refresh: `synthetic-refresh-${n}`, expires: Date.now() + 3_600_000, accountId: `synthetic-${n}`, source: "oauth" });
+  const ids = getAccountSet("anthropic")!.accounts.map(a => a.id);
+  await setActiveAccount("anthropic", ids[0]!);
+  const config = getDefaultConfig();
+  config.providers = { anthropic: { ...deriveOAuthProviderConfig("anthropic")!, models: ["fixture"], accountAutoPause: { enabled: true } } };
+  config.defaultProvider = "anthropic"; config.defaultModel = "fixture";
+  saveConfig(config);
+  const sends: string[] = [];
+  globalThis.fetch = (async (_input, init) => {
+    const bearer = new Headers(init?.headers).get("authorization")!;
+    sends.push(bearer);
+    return bearer === "Bearer synthetic-0" ? orgRefusal() : Response.json({ id: "synthetic-message", type: "message", role: "assistant", model: "fixture", content: [{ type: "text", text: "ok" }], stop_reason: "end_turn", usage: { input_tokens: 1, output_tokens: 1 } });
+  }) as typeof fetch;
+  try {
+    const first = await send(config, "anthropic");
+    expect(first.status, first.text).toBe(403);
+    const second = await send(config, "anthropic");
+    expect(second.status, second.text).toBe(200);
+    expect(sends).toEqual(["Bearer synthetic-0", "Bearer synthetic-0", "Bearer synthetic-1"]);
+    expect(getAccountSet("anthropic")!.accounts[0]!.paused).toBe(true);
+  } finally { clearAnthropicAccountPoolState(); }
+});
+
+
+test("auto-pause never buys a sibling send when the request has only one send", async () => {
+  const { createRequestExecutionBudget, CODEX_TEXT_GUARDED_BUDGET_POLICY } = await import("../../src/lib/request-execution-budget");
+  const config = configFor("fixture", false);
+  config.providers.fixture!.accountAutoPause = { enabled: true, consecutiveFailures: 1 };
+  saveConfig(config);
+  let sends = 0;
+  globalThis.fetch = (async () => { sends++; return orgRefusal(); }) as typeof fetch;
+  const budget = createRequestExecutionBudget({ ...CODEX_TEXT_GUARDED_BUDGET_POLICY, maxTotalModelSends: 1, baseSendAllowance: 1, finalRecoveryAllowance: 0 });
+  const result = await send(config, "fixture", budget);
+  expect(result.status, result.text).toBe(403);
+  expect(sends).toBe(1);
+  expect(config.providers.fixture!.apiKeyPool![0]!.disabled).toBe(true);
+});
+
+test("Codex pool permanent refusal pauses without forcing reauth and retries a sibling", async () => {
+  const { saveCodexAccountCredential } = await import("../../src/codex/account-store");
+  const { updateAccountQuota, clearAccountNeedsReauth } = await import("../../src/codex/auth-api");
+  const { clearCodexUpstreamHealth, clearThreadAccountMap } = await import("../../src/codex/routing");
+  const config = getDefaultConfig();
+  config.providers = { openai: { adapter: "openai-responses", baseUrl: "https://chatgpt.com/backend-api/codex", authMode: "forward", codexAccountMode: "pool", upstreamWebsocket: false, accountAutoPause: { enabled: true }, models: ["gpt-5.5"] } };
+  config.defaultProvider = "openai"; config.defaultModel = "gpt-5.5";
+  config.openaiProviderTierVersion = 2;
+  config.codexAccounts = ["fixture-a", "fixture-b"].map(id => ({ id, email: "", isMain: false, chatgptAccountId: `synthetic-${id}` }));
+  config.activeCodexAccountId = "fixture-a";
+  for (const id of ["fixture-a", "fixture-b"]) {
+    saveCodexAccountCredential(id, { accessToken: `synthetic-${id}`, refreshToken: `synthetic-refresh-${id}`, expiresAt: Date.now() + 3_600_000, chatgptAccountId: `synthetic-${id}` });
+    updateAccountQuota(id, 10); clearAccountNeedsReauth(id);
+  }
+  saveConfig(config);
+  clearCodexUpstreamHealth(); clearThreadAccountMap();
+  const sends: string[] = [];
+  globalThis.fetch = (async (input, init) => {
+    if (String(input).includes("/models")) return Response.json({ models: [{ slug: "gpt-5.5", supported_in_api: true, visibility: "list" }] });
+    const bearer = new Headers(init?.headers).get("authorization")!;
+    sends.push(bearer);
+    return bearer === "Bearer synthetic-fixture-a" ? orgRefusal() : Response.json({ id: "synthetic-response", object: "response", status: "completed", output: [], usage: { input_tokens: 1, output_tokens: 1, total_tokens: 2 } });
+  }) as typeof fetch;
+  const request = () => new Request("http://localhost/v1/responses", { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ model: "openai/gpt-5.5", input: "synthetic", stream: false, store: false }) });
+  try {
+    const first = await handleResponses(request(), config, { model: "gpt-5.5", provider: "openai" });
+    const firstText = await first.text();
+    expect(first.status, firstText).toBe(403);
+    const second = await handleResponses(request(), config, { model: "gpt-5.5", provider: "openai" });
+    const secondText = await second.text();
+    expect(second.status, secondText).toBe(200);
+    expect(config.pausedCodexAccountIds).toContain("fixture-a");
+    expect(sends).toEqual(["Bearer synthetic-fixture-a", "Bearer synthetic-fixture-a", "Bearer synthetic-fixture-b"]);
+  } finally { clearCodexUpstreamHealth(); clearThreadAccountMap(); }
+});
+
+test("native Messages keeps OAuth auto-pause and current-request rotation", async () => {
+  const { handleClaudeMessages } = await import("../../src/server/claude-messages");
+  const { clearAnthropicAccountPoolState } = await import("../../src/oauth/anthropic-routing");
+  clearAnthropicAccountPoolState();
+  for (let n = 0; n < 2; n++) await saveCredential("anthropic", { access: `synthetic-native-${n}`, refresh: `synthetic-refresh-${n}`, expires: Date.now() + 3_600_000, accountId: `synthetic-native-${n}`, source: "oauth" });
+  await setActiveAccount("anthropic", getAccountSet("anthropic")!.accounts[0]!.id);
+  const config = getDefaultConfig();
+  config.providers = { anthropic: { adapter: "anthropic", baseUrl: "https://api.anthropic.com", authMode: "oauth", models: ["claude-sonnet-4-5"], accountAutoPause: { enabled: true } } };
+  config.defaultProvider = "anthropic";
+  config.protocols = { rollout: { managedMessagesNative: true, managedMessagesNativeOAuth: true } };
+  saveConfig(config);
+  const sends: string[] = [];
+  globalThis.fetch = (async (_input, init) => {
+    const bearer = new Headers(init?.headers).get("authorization")!;
+    sends.push(bearer);
+    return bearer === "Bearer synthetic-native-0" ? orgRefusal() : Response.json({ id: "synthetic-native", type: "message", role: "assistant", model: "claude-sonnet-4-5", content: [{ type: "text", text: "ok" }], stop_reason: "end_turn", usage: { input_tokens: 1, output_tokens: 1 } });
+  }) as typeof fetch;
+  const sendNative = () => handleClaudeMessages(new Request("http://localhost/v1/messages", { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ model: "anthropic/claude-sonnet-4-5", max_tokens: 64, messages: [{ role: "user", content: "synthetic" }] }) }), config, { model: "", provider: "" });
+  try {
+    const first = await sendNative(); await first.text(); expect(first.status).toBe(403);
+    const second = await sendNative(); const text = await second.text(); expect(second.status, text).toBe(200);
+    expect(sends).toEqual(["Bearer synthetic-native-0", "Bearer synthetic-native-0", "Bearer synthetic-native-1"]);
+  } finally { clearAnthropicAccountPoolState(); }
+});
+
+test("provider-specific exact send total preserves the original refusal", async () => {
+  const config = configFor("fixture", false);
+  config.providers.fixture!.accountAutoPause = { enabled: true, consecutiveFailures: 1 };
+  config.providers.fixture!.transientRetryOn5xx = { attempts: 1 };
+  saveConfig(config);
+  let sends = 0;
+  globalThis.fetch = (async () => { sends++; return orgRefusal(); }) as typeof fetch;
+  const response = await send(config, "fixture");
+  expect(response.status, response.text).toBe(403);
+  expect(sends).toBe(1);
+});
+
+for (const wire of ["chat", "messages"] as const) for (const distributed of [false, true]) {
+  test(`native ${wire} recovers auto-pause reached after a same-key 429 replay (distributed=${distributed})`, async () => {
+    const config = configFor("fixture", false);
+    const provider = config.providers.fixture!;
+    provider.accountAutoPause = { enabled: true, consecutiveFailures: 1 };
+    if (distributed) provider.requestPacing = { enabled: true, keySelection: "round-robin", keys: { maxConcurrentRequests: 1 } };
+    provider.retryOn429 = { attempts: 1, intervalMs: 100, maxIntervalMs: 100, respectRetryAfter: false };
+    if (wire === "messages") {
+      provider.adapter = "anthropic"; provider.baseUrl = "https://api.anthropic.com";
+      config.protocols = { rollout: { managedMessagesNative: true } };
+    }
+    saveConfig(config);
+    const sends: string[] = [];
+    globalThis.fetch = (async (_input, init) => {
+      const headers = new Headers(init?.headers);
+      sends.push(headers.get("authorization") ?? headers.get("x-api-key") ?? "missing");
+      if (sends.length === 1) return Response.json({ error: { type: "rate_limit_error", message: "synthetic rate limit" } }, { status: 429 });
+      if (sends.length === 2) return orgRefusal();
+      return wire === "chat" ? completion() : Response.json({ id: "synthetic-message", type: "message", role: "assistant", model: "fixture", content: [{ type: "text", text: "ok" }], stop_reason: "end_turn", usage: { input_tokens: 1, output_tokens: 1 } });
+    }) as typeof fetch;
+    const body = { model: "fixture/fixture", max_tokens: 64, messages: [{ role: "user", content: "synthetic" }], stream: false };
+    const req = new Request(`http://localhost/v1/${wire === "chat" ? "chat/completions" : "messages"}`, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify(body) });
+    const response = wire === "chat"
+      ? await (await import("../../src/server/chat-completions")).handleChatCompletions(req, config, { model: "fixture", provider: "fixture" })
+      : await (await import("../../src/server/claude-messages")).handleClaudeMessages(req, config, { model: "fixture", provider: "fixture" });
+    const text = await response.text();
+    expect(response.status, text).toBe(200);
+    expect(sends.length).toBe(3);
+    expect(sends[2]).toContain("synthetic-B");
+    expect(config.providers.fixture!.apiKeyPool![0]!.disabled).toBe(true);
+  });
+}
diff --git a/tests/responses/responses-auto-pause-replay-owner.test.ts b/tests/responses/responses-auto-pause-replay-owner.test.ts
new file mode 100644
index 00000000000..26c237c1fe6
--- /dev/null
+++ b/tests/responses/responses-auto-pause-replay-owner.test.ts
@@ -0,0 +1,130 @@
+import { afterEach, beforeEach, expect, spyOn, test } from "bun:test";
+import { mkdtempSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { getDefaultConfig, saveConfig } from "../../src/config";
+import { credentialGeneration, getAccountSet, saveCredential, setActiveAccount } from "../../src/oauth/store";
+import { clearGenericFailoverHealth } from "../../src/oauth/generic-account-failover";
+import { handleResponses } from "../../src/server/responses/core";
+import * as transport from "../../src/server/responses/request-transport";
+import { createResponsesEffects } from "../../src/server/responses/response-effects";
+import { commitReasoningReplayServingIdentity, reasoningReplayKeyCredentialIdentity, reasoningReplayOAuthCredentialIdentity } from "../../src/responses/reasoning-replay-cache";
+import { flushResponseState, clearResponseStateForTests } from "../../src/responses/state";
+import type { OcxParsedRequest, OcxProviderContinuationOwner } from "../../src/types";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
+import { removeTreeWithRetry } from "../helpers/remove-tree";
+
+const originalHome = process.env.OPENCODEX_HOME;
+const originalFetch = globalThis.fetch;
+let home: string;
+let releaseSpend: () => void;
+beforeEach(() => {
+  home = mkdtempSync(join(tmpdir(), "ocx-auto-pause-replay-"));
+  process.env.OPENCODEX_HOME = home;
+  releaseSpend = acquireOwnedSpendHome();
+  clearGenericFailoverHealth();
+});
+afterEach(async () => {
+  await flushResponseState(); clearResponseStateForTests();
+  releaseSpend(); clearGenericFailoverHealth();
+  globalThis.fetch = originalFetch;
+  if (originalHome === undefined) delete process.env.OPENCODEX_HOME;
+  else process.env.OPENCODEX_HOME = originalHome;
+  removeTreeWithRetry(home);
+});
+
+for (const oauth of [false, true]) for (const native of [false, true]) {
+  test(`${oauth ? "OAuth" : "key"} auto-pause rebinds ${native ? "native Responses" : "translated Chat"} retry and persistence owners`, async () => {
+    const name = oauth ? "command-code" : "fixture";
+    if (oauth) {
+      for (const id of ["A", "B"]) await saveCredential(name, {
+        access: `synthetic-${id}`, refresh: `synthetic-refresh-${id}`,
+        expires: Date.now() + 3_600_000, accountId: `synthetic-${id}`, source: "oauth",
+      });
+      await setActiveAccount(name, getAccountSet(name)!.accounts[0]!.id);
+    }
+    const config = getDefaultConfig();
+    config.defaultProvider = name; config.defaultModel = "fixture";
+    config.providers = { [name]: {
+      baseUrl: "https://example.test/v1", adapter: native ? "openai-responses" : "openai-chat",
+      authMode: oauth ? "oauth" : "key", models: ["fixture"],
+      accountAutoPause: { enabled: true, consecutiveFailures: 1 },
+      ...(!oauth ? { apiKey: "synthetic-A", apiKeyPool: [{ id: "A", key: "synthetic-A" }, { id: "B", key: "synthetic-B" }] } : {}),
+    } };
+    saveConfig(config);
+    // Derive the opaque expected digest from fixture B, independently of recovery's selection.
+    const secondAccount = oauth ? getAccountSet(name)!.accounts[1]! : undefined;
+    const expectedCredentialIdentity = secondAccount
+      ? reasoningReplayOAuthCredentialIdentity({ accountId: secondAccount.id, generation: credentialGeneration(secondAccount.credential) })
+      : reasoningReplayKeyCredentialIdentity({ apiKey: "synthetic-B" });
+    expect(expectedCredentialIdentity).toBeDefined();
+    const sends: string[] = [];
+    globalThis.fetch = (async (_input, init) => {
+      const auth = new Headers(init?.headers).get("authorization")!;
+      sends.push(auth);
+      if (auth === "Bearer synthetic-A") return Response.json({ error: {
+        type: "permission_error", message: "OAuth authentication is currently not allowed for this organization",
+      } }, { status: 403 });
+      return native
+        ? Response.json({ id: "synthetic-response", object: "response", model: "fixture", status: "completed", output: [{ id: "synthetic-message", type: "message", role: "assistant", content: [{ type: "output_text", text: "ok", annotations: [] }] }], usage: { input_tokens: 1, output_tokens: 1, total_tokens: 2 } })
+        : Response.json({ id: "synthetic-completion", object: "chat.completion", model: "fixture", choices: [{ index: 0, message: { role: "assistant", content: "ok" }, finish_reason: "stop" }], usage: { prompt_tokens: 1, completion_tokens: 1, total_tokens: 2 } });
+    }) as typeof fetch;
+    let outer: OcxParsedRequest | undefined;
+    let retry: OcxParsedRequest | undefined;
+    let oldOwner: OcxProviderContinuationOwner | undefined;
+    let oldReplayCredential: string | undefined;
+    let persisted: ReturnType<Exclude<ReturnType<typeof createResponsesEffects>, Response>["continuationStateForResponse"]>;
+    const prepare = transport.prepareResponsesTransport;
+    const prepared = spyOn(transport, "prepareResponsesTransport").mockImplementation(async (...args) => {
+      const state = await prepare(...args);
+      if (state instanceof Response) return state;
+      outer = args[2].parsed;
+      oldOwner = outer._providerContinuationOwner;
+      oldReplayCredential = outer._reasoningReplayScope?.current?.credentialIdentity;
+      // Seed previously accepted A state; transport and account selection remain real.
+      commitReasoningReplayServingIdentity(outer._reasoningReplayScope);
+      outer._providerContinuationCandidate = { __ocxOwner: oldOwner!, cursor: { conversationId: "synthetic-A-conversation" } };
+      outer._providerContinuation = { cursor: { conversationId: "synthetic-A-conversation" } };
+      outer._cursorConversationId = "synthetic-A-conversation";
+      const recover = state.recoverAutoPausedSelection;
+      state.recoverAutoPausedSelection = async requestParsed => {
+        // Terminal recovery may pass a shallow clone; its owner fields are independent
+        // even though the replay scope holder is shared with the persistence request.
+        retry = { ...requestParsed };
+        const recovered = await recover(retry);
+        const effects = createResponsesEffects(args[0], args[1], {
+          parsed: outer!, route: args[2].route, poolAffinityKey: null, substituteMainCredential: false,
+        }, { routedCompaction: false });
+        if (!(effects instanceof Response)) persisted = effects.continuationStateForResponse({ cursor: { conversationId: "synthetic-B-conversation" } });
+        return recovered;
+      };
+      return state;
+    });
+    try {
+      const response = await handleResponses(new Request("http://localhost/v1/responses", {
+        method: "POST", headers: { "content-type": "application/json", "thread-id": `synthetic-${oauth}-${native}` },
+        body: JSON.stringify({ model: `${name}/fixture`, input: "synthetic", stream: false, store: false }),
+      }), config, { model: "fixture", provider: name });
+      const text = await response.text();
+      expect(response.status, text).toBe(200);
+      expect(sends).toEqual(["Bearer synthetic-A", "Bearer synthetic-B"]);
+      expect(oldOwner).toBeDefined();
+      expect(oldReplayCredential).toBeDefined();
+      expect(oldOwner!.credentialIdentity).not.toBe(expectedCredentialIdentity);
+      expect(oldReplayCredential).not.toBe(expectedCredentialIdentity);
+      expect(retry).toBeDefined();
+      for (const parsed of [outer!, retry!]) {
+        expect(parsed._providerContinuationOwner?.credentialIdentity).toBe(expectedCredentialIdentity);
+        expect(parsed._reasoningReplayScope?.current?.credentialIdentity).toBe(expectedCredentialIdentity);
+        expect(parsed._providerContinuation).toBeUndefined();
+        expect(parsed._cursorConversationId).toBeUndefined();
+        expect(parsed._stripReasoningEncryptedContent).toBe(true);
+        expect(parsed._dropForeignReasoningItemIds).toBe(true);
+      }
+      expect(retry!._providerContinuationOwner).toEqual(outer!._providerContinuationOwner);
+      expect(persisted?.__ocxOwner).toEqual(retry!._providerContinuationOwner);
+      expect(persisted?.__ocxOwner?.credentialIdentity).toBe(expectedCredentialIdentity);
+      expect(persisted?.cursor?.conversationId).toBe("synthetic-B-conversation");
+    } finally { prepared.mockRestore(); }
+  });
+}
diff --git a/tests/server/management-account-auto-pause.test.ts b/tests/server/management-account-auto-pause.test.ts
new file mode 100644
index 00000000000..b24f09e901c
--- /dev/null
+++ b/tests/server/management-account-auto-pause.test.ts
@@ -0,0 +1,135 @@
+import { afterEach, beforeEach, describe, expect, spyOn, test } from "bun:test";
+import { mkdtempSync, readFileSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import * as destinationPolicy from "../../src/lib/destination-policy";
+import * as stateStores from "../../src/lib/state-store-registrations";
+import * as mutationLock from "../../src/config/mutation-lock";
+import { clearModelCache } from "../../src/codex/model-cache";
+import { providerManagementConfigError } from "../../src/server/auth-cors";
+import { handleProviderRoutes } from "../../src/server/management/provider-routes";
+import { handleOauthAccountRoutes } from "../../src/server/management/oauth-account-routes";
+import type { ManagementContext } from "../../src/server/management/context";
+import type { OcxConfig, OcxProviderConfig } from "../../src/types";
+import { removeTreeWithRetry } from "../helpers/remove-tree";
+
+const canonical = {
+  adapter: "openai-responses", baseUrl: "https://chatgpt.com/backend-api/codex",
+  authMode: "forward", codexAccountMode: "direct",
+} as const;
+const base = { adapter: "openai-chat", baseUrl: "https://relay.example.test/v1", liveModels: false } as const;
+let home: string;
+let previousHome: string | undefined;
+let destination: ReturnType<typeof spyOn<typeof destinationPolicy, "providerDestinationResolvedError">>;
+let reconcile: ReturnType<typeof spyOn<typeof stateStores, "reconcileLiveStateStores">>;
+
+beforeEach(() => {
+  previousHome = process.env.OPENCODEX_HOME;
+  home = mkdtempSync(join(tmpdir(), "ocx-account-pause-management-"));
+  process.env.OPENCODEX_HOME = home;
+  destination = spyOn(destinationPolicy, "providerDestinationResolvedError").mockResolvedValue(null);
+  reconcile = spyOn(stateStores, "reconcileLiveStateStores").mockReturnValue({ storesVisited: 0, rowsRemoved: 0 });
+});
+afterEach(() => {
+  destination.mockRestore();
+  reconcile.mockRestore();
+  clearModelCache();
+  if (previousHome === undefined) delete process.env.OPENCODEX_HOME;
+  else process.env.OPENCODEX_HOME = previousHome;
+  removeTreeWithRetry(home);
+});
+
+function harness(policy?: OcxProviderConfig["accountAutoPause"]) {
+  const config: OcxConfig = { port: 10100, defaultProvider: "relay", providers: {
+    relay: { ...base, ...(policy === undefined ? {} : { accountAutoPause: policy }) },
+  } };
+  const path = join(home, "saved.json");
+  writeFileSync(path, JSON.stringify(config));
+  async function request(method: "POST" | "PUT", body: unknown, pathname = "/api/providers") {
+    const url = new URL(pathname, "http://127.0.0.1");
+    const context: ManagementContext = {
+      req: new Request(url, { method, headers: { "Content-Type": "application/json" }, body: JSON.stringify(body) }),
+      url, config, version: "test", trustedLoopbackIngress: true, guiSessionIssuance: null,
+      deps: { saveConfigPreservingClaudeCode: saved => writeFileSync(path, JSON.stringify(saved)) },
+      convergeCodexCatalog: async () => ({ status: "committed", changed: false, degraded: false, notices: [] }),
+      syncClaudeAgentDefsBestEffort: async () => {},
+    };
+    return pathname.endsWith("/pause") ? handleOauthAccountRoutes(context) : handleProviderRoutes(context);
+  }
+  return { config, path, request, post: (fields: Record<string, unknown> = {}) =>
+    request("POST", { name: "relay", provider: { ...base, ...fields } }),
+    storedPolicy: () => (JSON.parse(readFileSync(path, "utf8")) as OcxConfig).providers.relay!.accountAutoPause };
+}
+
+describe("account auto-pause management", () => {
+  test.each([{}, { enabled: false }, { enabled: true, consecutiveFailures: 7 }])(
+    "POST omission retains stored policy %j and explicit policy replaces it", async policy => {
+      const h = harness(policy);
+      expect((await h.post({ note: "unrelated edit" }))?.status).toBe(200);
+      expect(h.config.providers.relay!.accountAutoPause).toEqual(policy);
+      expect(h.storedPolicy()).toEqual(policy);
+      expect((await h.post({ accountAutoPause: { enabled: false, consecutiveFailures: 3 } }))?.status).toBe(200);
+      expect(h.storedPolicy()).toEqual({ enabled: false, consecutiveFailures: 3 });
+    });
+
+  test.each([undefined, { enabled: false }, { enabled: true, consecutiveFailures: 9 }]
+    .flatMap(latest => [false, true].map(submitted => ({ latest, submitted }))))(
+    "publication uses latest omission or explicit replacement: %j", async ({ latest, submitted }) => {
+      const h = harness({ enabled: true, consecutiveFailures: 4 });
+      const lock = mutationLock.withConfigMutationLockSync;
+      let entered = false;
+      const probe = spyOn(mutationLock, "withConfigMutationLockSync").mockImplementation((fn, dir) => lock(() => {
+        entered = true;
+        if (latest === undefined) delete h.config.providers.relay!.accountAutoPause;
+        else h.config.providers.relay!.accountAutoPause = { ...latest };
+        return fn();
+      }, dir));
+      try {
+        const replacement = { enabled: false, consecutiveFailures: 2 };
+        expect((await h.post(submitted ? { accountAutoPause: replacement } : {}))?.status).toBe(200);
+        expect(entered).toBe(true);
+        expect(h.storedPolicy()).toEqual(submitted ? replacement : latest);
+        expect(h.config.providers.relay!.accountAutoPause).toEqual(submitted ? replacement : latest);
+      } finally { probe.mockRestore(); }
+    });
+
+  test("canonical OpenAI accepts valid auto-pause overlays while transport stays canonical", () => {
+    for (const policy of [{}, { enabled: false }, { enabled: true, consecutiveFailures: 100 }]) {
+      expect(providerManagementConfigError("openai", { ...canonical, accountAutoPause: policy })).toBeNull();
+    }
+    expect(providerManagementConfigError("openai", { ...canonical, baseUrl: "https://other.example.test/v1",
+      accountAutoPause: { enabled: true } })).not.toBeNull();
+  });
+
+  test("canonical OpenAI policy survives POST and invalid policy cannot publish", async () => {
+    const h = harness();
+    const policy = { enabled: true, consecutiveFailures: 6 };
+    expect((await h.request("POST", { name: "openai", provider: { ...canonical, accountAutoPause: policy } }))?.status).toBe(200);
+    expect(h.config.providers.openai!.accountAutoPause).toEqual(policy);
+    const before = readFileSync(h.path, "utf8");
+    expect((JSON.parse(before) as OcxConfig).providers.openai!.accountAutoPause).toEqual(policy);
+    for (const accountAutoPause of [null, { enabled: "true" }, { unexpected: true }]) {
+      expect((await h.request("POST", { name: "openai", provider: { ...canonical, accountAutoPause } }))?.status).toBe(400);
+      expect(readFileSync(h.path, "utf8")).toBe(before);
+      expect(h.config.providers.openai!.accountAutoPause).toEqual(policy);
+    }
+  });
+
+  test.each([null, [], true, { enabled: "true" }, { consecutiveFailures: 0 }, { consecutiveFailures: 101 },
+    { consecutiveFailures: 1.5 }, { unknown: "private-value-fixture" }].map(policy => ({ policy })))("invalid policy rejected: %j", ({ policy }) => {
+    for (const [name, provider] of [["relay", base], ["openai", canonical]] as const) {
+      for (const allowOperatorOverlays of [false, true]) {
+        const error = providerManagementConfigError(name, { ...provider, accountAutoPause: policy }, { allowOperatorOverlays });
+        expect(error).toContain("accountAutoPause");
+        expect(error).not.toContain("private-value-fixture");
+      }
+    }
+  });
+
+  test.each([null, [], true, "body"].map(body => ({ body })))("pause endpoint rejects non-object JSON %j", async ({ body }) => {
+    const h = harness();
+    const before = readFileSync(h.path, "utf8");
+    expect((await h.request("PUT", body, "/api/providers/keys/pause"))?.status).toBe(400);
+    expect(readFileSync(h.path, "utf8")).toBe(before);
+  });
+});
diff --git a/tests/server/management-route-registry.test.ts b/tests/server/management-route-registry.test.ts
index 510a5a3f363..ff380295506 100644
--- a/tests/server/management-route-registry.test.ts
+++ b/tests/server/management-route-registry.test.ts
@@ -256,13 +256,15 @@ describe("route exemptions stay honest", () => {
     });
   });
 
-  test("account-switch routes remain ordinary management mutations", () => {
+  test("account-switch and key pause routes remain ordinary management mutations", () => {
     for (const path of [
       "/api/codex-auth/active", "/api/oauth/accounts/active", "/api/providers/keys/active",
+      "/api/providers/keys/pause",
     ]) {
       const row = MANAGEMENT_ROUTES.find(r => r.method === "PUT" && r.path === path);
       expect(row?.mutates, path).toBe(true);
       expect(row?.exempt, path).toBeUndefined();
+      if (path === "/api/providers/keys/pause") expect(row?.module).toBe("server/management/oauth-account-routes");
     }
   });