From a76e928f7bac7c52f5876d51a4526f9ed0cf2bec Mon Sep 17 00:00:00 2001
From: JUN <jun@lidgeai.com>
Date: Thu, 15 Oct 2026 17:07:44 +0900
Subject: [PATCH 01/17] feat(accounts): opt in to auto-pause permanent account
 refusals

---
 .../docs/reference/cli/providers-accounts.md  |   4 +-
 .../docs/reference/configuration/providers.md |  34 +++
 .../components/codex-account-pool-cards.tsx   |   2 +-
 .../provider-workspace/ProviderAuthPanel.tsx  |   7 +-
 .../components/provider-workspace/types.ts    |   3 +
 gui/src/hooks/useCodexAccountPool.ts          |   1 +
 gui/src/hooks/useProviderAccountPools.ts      |  10 +-
 .../provider-account-pause-refresh.test.tsx   |  24 ++
 scripts/test-layout/layout.json               |   2 +-
 skills/ocx/references/01_surface_accounts.md  |  10 +-
 src/adapters/google-http.ts                   |   5 +-
 src/adapters/upstream-http-error.ts           |   5 +-
 src/cli/account-api.ts                        |  11 +-
 src/cli/account-extended.ts                   |  13 +-
 src/cli/account.ts                            |   2 +-
 src/cli/capabilities-base.ts                  |  10 +-
 src/codex/account-pause.ts                    |   7 +-
 src/codex/auth-api/account-list.ts            |   3 +
 src/codex/auth-context.ts                     |   4 +-
 src/config/schema/account-auto-pause.ts       |  14 +
 src/config/schema/config-schema.ts            |   2 +
 src/config/schema/leaf-validators.ts          |   3 +
 src/lib/account-auto-pause-response.ts        |  12 +
 src/oauth/account-auto-pause-policy.ts        |  66 +++++
 src/oauth/account-auto-pause.ts               | 128 ++++++++
 src/oauth/anthropic-account-refusal.ts        |   6 +
 src/oauth/store.ts                            |  22 +-
 src/oauth/types.ts                            |   2 +
 src/providers/api-key-pause.ts                |  30 ++
 src/providers/api-key-selection.ts            |   3 +-
 src/providers/api-keys.ts                     |  12 +-
 src/providers/key-failover.ts                 |  14 +-
 src/providers/model-rename-fields.ts          |   1 +
 src/server/auth-cors.ts                       |   1 +
 src/server/chat-native.ts                     |  26 +-
 src/server/management/oauth-account-routes.ts |  10 +-
 src/server/messages-native.ts                 |  15 +-
 .../responses/account-auto-pause-recovery.ts  |  26 ++
 src/server/responses/adapter-dispatch.ts      |  23 +-
 src/server/responses/compact.ts               |  13 +-
 src/server/responses/core-codex-account.ts    |   8 +-
 src/server/responses/fetch-helpers.ts         |  10 +-
 src/server/responses/passthrough-delivery.ts  |   5 +-
 src/server/responses/passthrough-dispatch.ts  |  62 ++--
 .../responses/passthrough-observations.ts     |  38 +++
 src/server/responses/request-transport.ts     |  19 ++
 src/types/account-auto-pause.ts               |  15 +
 src/types/config.ts                           |   1 +
 src/types/provider.ts                         |   5 +-
 structure/INDEX.md                            |   6 +
 structure/account-auto-pause.md               |  71 +++++
 structure/config.md                           |   2 +-
 structure/dashboard-and-usage.md              |   2 +-
 structure/gui-and-management-api.md           |   2 +-
 structure/manifest.json                       |  13 +
 structure/providers-and-adapters.md           |   2 +-
 structure/providers/anthropic-account-pool.md |   9 +
 structure/providers/openai-accounts.md        |  11 +
 structure/runtime.md                          |   2 +-
 structure/transports/responses-failover.md    |   2 +-
 tests/fixtures/test-layout-expected.json      |   2 +-
 tests/oauth/oauth-account-auto-pause.test.ts  | 278 ++++++++++++++++++
 .../responses-account-auto-pause.test.ts      | 228 ++++++++++++++
 63 files changed, 1279 insertions(+), 100 deletions(-)
 create mode 100644 src/config/schema/account-auto-pause.ts
 create mode 100644 src/lib/account-auto-pause-response.ts
 create mode 100644 src/oauth/account-auto-pause-policy.ts
 create mode 100644 src/oauth/account-auto-pause.ts
 create mode 100644 src/providers/api-key-pause.ts
 create mode 100644 src/server/responses/account-auto-pause-recovery.ts
 create mode 100644 src/server/responses/passthrough-observations.ts
 create mode 100644 src/types/account-auto-pause.ts
 create mode 100644 structure/account-auto-pause.md
 create mode 100644 tests/oauth/oauth-account-auto-pause.test.ts
 create mode 100644 tests/responses/responses-account-auto-pause.test.ts

diff --git a/docs-site/src/content/docs/reference/cli/providers-accounts.md b/docs-site/src/content/docs/reference/cli/providers-accounts.md
index 27387b52951..1e9b7f034de 100644
--- a/docs-site/src/content/docs/reference/cli/providers-accounts.md
+++ b/docs-site/src/content/docs/reference/cli/providers-accounts.md
@@ -734,7 +734,9 @@ Clear the manual Codex account selection without resolving an account id, so it
 
 ### `ocx account pause|resume <provider> <id|alias|main> [--json]`
 
-Pause or resume one account in the Codex, Anthropic, or generic OAuth provider pool, including
+Accounts paused by the opt-in [per-provider auto-pause policy](/reference/configuration/providers/#auto-pause-permanently-refused-accounts) use the same commands. Listing shows the fixed pause reason; resume clears it.
+
+Pause or resume one account in the Codex, Anthropic, generic OAuth, or API-key provider pool, including
 `google-antigravity`. For the Codex pool, `main` identifies only the built-in Codex account;
 OAuth accounts must be identified by id or a unique alias. A paused OAuth account
 is excluded from request selection, 429 failover, and proactive token refresh, and cannot be
diff --git a/docs-site/src/content/docs/reference/configuration/providers.md b/docs-site/src/content/docs/reference/configuration/providers.md
index 50c3520b0df..7c99ef4b09b 100644
--- a/docs-site/src/content/docs/reference/configuration/providers.md
+++ b/docs-site/src/content/docs/reference/configuration/providers.md
@@ -1730,3 +1730,37 @@ raised output allowance would exceed that ceiling.
   }
 }
 ```
+
+## Auto-pause permanently refused accounts
+
+`providers.<provider>.accountAutoPause` is opt-in and defaults to off. It applies to that
+provider's OAuth accounts, Codex pool accounts (including the main account in pool mode),
+and configured API-key pool entries. For example:
+
+```sh
+ocx config set providers.anthropic.accountAutoPause.enabled true
+ocx config set providers.anthropic.accountAutoPause.consecutiveFailures 2
+```
+
+`consecutiveFailures` is an integer from 1 to 100; omitting it uses 2. Only exact,
+account-scoped HTTP 401/403 refusals qualify: an organization forbidding OAuth, an inactive
+or expired subscription, an account denied API/Claude Code access, or a downgrade to a free
+plan with no credits. A model permission error, expired access token, quota window, 429,
+5xx, malformed response or network failure never pauses an account.
+
+The counter is process-local, serialized per account, and resets on a successful HTTP
+response, explicit resume or a new login. Token refresh alone does not reset an OAuth
+account's streak. Transient errors leave the counter unchanged. Restarting the proxy clears
+counters; completed pauses, their fixed reason codes and timestamps persist. Independent
+proxy processes maintain independent counters.
+
+At the threshold, OpenCodex excludes the account using its existing pause mechanism and
+attempts an eligible sibling for the current request within the existing retry/send budget.
+Fixed Codex account selectors and account-bound uploaded files retain their restrictions.
+A pause never cancels already dispatched work or changes credentials. It emits one generic
+log line without account identifiers or upstream error text.
+
+`ocx account list <provider>` shows the pause reason. The dashboard's Paused badge exposes
+the reason and time. Use `ocx account resume <provider> <account-id-or-alias>` to clear the
+reason and allow selection again. On an API-key row, clicking Resume also activates the key.
+This policy never resumes an account automatically.
diff --git a/gui/src/components/codex-account-pool-cards.tsx b/gui/src/components/codex-account-pool-cards.tsx
index e607afbf1bf..daa95e26e84 100644
--- a/gui/src/components/codex-account-pool-cards.tsx
+++ b/gui/src/components/codex-account-pool-cards.tsx
@@ -118,7 +118,7 @@ export function CodexAccountPoolCards({
                 </span>
               )}
               {a.paused && (
-                <span className="badge badge-muted" title={t("codexAuth.pausedHint")}>
+                <span className="badge badge-muted" title={a.pauseDetails ? `${a.pauseDetails.reason} · ${new Date(a.pauseDetails.pausedAt).toLocaleString()}` : t("codexAuth.pausedHint")}>
                   {t("codexAuth.paused")}
                 </span>
               )}
diff --git a/gui/src/components/provider-workspace/ProviderAuthPanel.tsx b/gui/src/components/provider-workspace/ProviderAuthPanel.tsx
index da5419c975c..5f1d45863e1 100644
--- a/gui/src/components/provider-workspace/ProviderAuthPanel.tsx
+++ b/gui/src/components/provider-workspace/ProviderAuthPanel.tsx
@@ -588,7 +588,7 @@ export default function ProviderAuthPanel({
                       )}
                       {showReauth && !healthLabel && <span className="badge badge-amber">{t("pws.reauth")}</span>}
                       {kiroSkipReasonKey(account, item.name) && <span className="badge badge-amber">{t(kiroSkipReasonKey(account, item.name)!)}</span>}
-                      {account.paused && <span className="badge badge-muted">{t("codexAuth.paused")}</span>}
+                      {account.paused && <span className="badge badge-muted" title={account.pauseDetails ? `${account.pauseDetails.reason} · ${new Date(account.pauseDetails.pausedAt).toLocaleString()}` : undefined}>{t("codexAuth.paused")}</span>}
                       {account.active && !account.paused && <span className="badge badge-primary">{t("prov.accountActive")}</span>}
                       {switching && <span className="badge badge-muted">{t("pws.accountSwitching")}</span>}
                     </button>
@@ -721,13 +721,14 @@ export default function ProviderAuthPanel({
                     <div className={`pwi-auth-row${entry.active ? " pwi-auth-row--active" : ""}`}>
                     <button type="button" className="pwi-auth-row-main"
                       onClick={() => void authHandlers.onSwitchApiKey(item.name, entry)}
-                      disabled={entry.active}>
+                      disabled={entry.active && !entry.disabled} aria-label={entry.disabled ? t("codexAuth.resume") : undefined}>
                       <span className={`pwi-auth-dot ${entry.active ? "pwi-auth-dot--ok" : "pwi-auth-dot--off"}`} aria-hidden="true" />
                       <span className="pwi-auth-row-copy">
                         <span className="pwi-auth-row-label">{entry.label ?? entry.masked}</span>
                         {entry.label && <code className="pwi-auth-row-secondary">{entry.masked} · {t("prov.accountId")}: {entry.id}</code>}
                       </span>
-                      {entry.active && <span className="badge badge-primary">{t("prov.accountActive")}</span>}
+                      {entry.disabled && <span className="badge badge-muted" title={entry.pauseDetails ? `${entry.pauseDetails.reason} · ${new Date(entry.pauseDetails.pausedAt).toLocaleString()}` : undefined}>{t("codexAuth.paused")} · {t("codexAuth.resume")}</span>}
+                      {entry.active && !entry.disabled && <span className="badge badge-primary">{t("prov.accountActive")}</span>}
                     </button>
                     <button type="button" className="btn btn-ghost btn-sm"
                       onClick={() => void authHandlers.onEditAlias(item.name, "api-key", entry.id, entry.label)}>
diff --git a/gui/src/components/provider-workspace/types.ts b/gui/src/components/provider-workspace/types.ts
index b8d8b7c1ee5..d61fbec5ae7 100644
--- a/gui/src/components/provider-workspace/types.ts
+++ b/gui/src/components/provider-workspace/types.ts
@@ -62,6 +62,7 @@ export type OAuthAccountRow = AccountQuotaReading & {
   autoSelectable?: boolean;
   skipReason?: "needs_reauth" | "paused" | "suspended" | "cooldown" | "quota_exhausted";
   paused?: boolean;
+  pauseDetails?: { reason: string; pausedAt: number };
   autoSwitchThresholdOverride?: number | null;
   autoSwitchThreshold?: number;
   effectiveAutoSwitchThreshold?: number;
@@ -72,6 +73,8 @@ export type OAuthAccountRow = AccountQuotaReading & {
 };
 
 export type ApiKeyRow = AccountQuotaReading & {
+  disabled?: boolean;
+  pauseDetails?: { reason: string; pausedAt: number };
   id: string;
   label?: string;
   masked: string;
diff --git a/gui/src/hooks/useCodexAccountPool.ts b/gui/src/hooks/useCodexAccountPool.ts
index a529ad28a03..4ceff38fc9e 100644
--- a/gui/src/hooks/useCodexAccountPool.ts
+++ b/gui/src/hooks/useCodexAccountPool.ts
@@ -69,6 +69,7 @@ export interface CodexAccountEntry {
   isMain: boolean;
   /** Persisted routing exclusion. Paused accounts remain visible but cannot be selected. */
   paused: boolean;
+  pauseDetails?: { reason: string; pausedAt: number };
   /** Selection order; higher is used earlier. Always present, 0 when unset. */
   priority: number;
   /** Null inherits global threshold; 0 disables usage-driven switching for this account. */
diff --git a/gui/src/hooks/useProviderAccountPools.ts b/gui/src/hooks/useProviderAccountPools.ts
index b934bd94f60..7adf07b63be 100644
--- a/gui/src/hooks/useProviderAccountPools.ts
+++ b/gui/src/hooks/useProviderAccountPools.ts
@@ -23,6 +23,7 @@ export interface OAuthAccount extends AccountQuotaReading {
   autoSelectable?: boolean;
   skipReason?: "needs_reauth" | "paused" | "suspended" | "cooldown" | "quota_exhausted";
   paused?: boolean;
+  pauseDetails?: { reason: string; pausedAt: number };
   autoSwitchThresholdOverride?: number | null;
   autoSwitchThreshold?: number;
   effectiveAutoSwitchThreshold?: number;
@@ -32,7 +33,7 @@ export interface OAuthAccount extends AccountQuotaReading {
   healthSummary?: string;
   healthAction?: string;
 }
-export interface ApiKeyEntry extends AccountQuotaReading { id: string; label?: string; masked: string; active: boolean }
+export interface ApiKeyEntry extends AccountQuotaReading { id: string; label?: string; masked: string; active: boolean; disabled?: boolean; pauseDetails?: { reason: string; pausedAt: number } }
 export interface AccountSelectionTarget { provider: string; kind: "oauth" | "api-key" }
 
 function selectionRows<T extends { id: string; active: boolean }>(rows: T[], id: string | null | undefined): T[] {
@@ -548,12 +549,17 @@ export function useProviderAccountPools(deps: {
   };
 
   const switchApiKey = async (provider: string, entry: ApiKeyEntry) => {
-    if (entry.active || selectionMutationsRef.current.has(`key:${provider}`)) return;
+    if (entry.active && !entry.disabled || selectionMutationsRef.current.has(`key:${provider}`)) return;
     const key = invalidateSelectionReads(provider, "api-key");
     const mutation = Symbol();
     selectionMutationsRef.current.set(key, mutation);
     const currentMutation = () => aliveRef.current && mountedRef.current && serverRef.current === apiBase && selectionMutationsRef.current.get(key) === mutation;
     try {
+      if (entry.disabled) {
+        const resumed = await fetch(`${apiBase}/api/providers/keys/pause`, { method: "PUT", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ name: provider, id: entry.id, paused: false }) });
+        if (!currentMutation()) return;
+        if (!resumed.ok) { notify(t("prov.keySwitchFail"), false); return; }
+      }
       const res = await fetch(`${apiBase}/api/providers/keys/active`, { method: "PUT", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ name: provider, id: entry.id }) });
       if (!currentMutation()) return;
       if (!res.ok) {
diff --git a/gui/tests/provider-account-pause-refresh.test.tsx b/gui/tests/provider-account-pause-refresh.test.tsx
index c5046f894b3..73e77378443 100644
--- a/gui/tests/provider-account-pause-refresh.test.tsx
+++ b/gui/tests/provider-account-pause-refresh.test.tsx
@@ -206,3 +206,27 @@ test("a rejected save reports the pause failure and leaves the row unpaused", as
   expect(pools.accountSets.fixture.accounts.find(account => account.id === "b")?.paused).toBe(false);
   expect(notices).toEqual([{ key: "codexAuth.pauseFailed", ok: false }]);
 });
+
+test("paused key selection resumes before activation and refreshes the roster", async () => {
+  const entry = { id: "key-fixture", masked: "****", active: false, disabled: true, pauseDetails: { reason: "subscription_expired", pausedAt: 1 } };
+  const writes: Array<{ path: string; body: unknown }> = [];
+  respond = async (url, init) => {
+    if (init?.method === "PUT") { writes.push({ path: url, body: JSON.parse(String(init.body)) }); return Response.json({ activeId: entry.id }); }
+    return Response.json({ activeId: entry.id, keys: [{ ...entry, disabled: false, active: true, pauseDetails: undefined }] });
+  };
+  await act(async () => { pools.setKeyPools({ fixture: [entry] }); });
+  await act(async () => { await pools.switchApiKey("fixture", entry); });
+  expect(writes.map(row => row.path)).toEqual(["/pause-hook/api/providers/keys/pause", "/pause-hook/api/providers/keys/active"]);
+  expect(writes[0]!.body).toEqual({ name: "fixture", id: entry.id, paused: false });
+});
+
+test("a failed key resume never attempts activation", async () => {
+  const writes: string[] = [];
+  respond = async (url, init) => {
+    if (init?.method === "PUT") { writes.push(url); return new Response(null, { status: 503 }); }
+    return Response.json({ keys: [] });
+  };
+  await act(async () => { await pools.switchApiKey("fixture", { id: "key-fixture", masked: "****", active: false, disabled: true }); });
+  expect(writes).toEqual(["/pause-hook/api/providers/keys/pause"]);
+  expect(notices).toContainEqual({ key: "prov.keySwitchFail", ok: false });
+});
diff --git a/scripts/test-layout/layout.json b/scripts/test-layout/layout.json
index 16227fe5cf1..0aba7f7bf27 100644
--- a/scripts/test-layout/layout.json
+++ b/scripts/test-layout/layout.json
@@ -3,7 +3,7 @@
   "root": "tests",
   "explicitShards": ["layout-clients.json"],
   "explicit": { "service-log.test.ts": "service",
-    "codex-history-pending-wal.test.ts": "codex-integration", "responses-anthropic-billing-send-budget.test.ts": "responses", "anthropic-billing-ownership.test.ts": "adapters/anthropic", "server-anthropic-billing.test.ts": "server", "server-anthropic-billing-boundaries.test.ts": "server", "router-anthropic-billing-failover.test.ts": "routing", "anthropic-billing-refusal.test.ts": "adapters/anthropic", "messages-request-id-headers.test.ts": "claude-integration", "bounded-file-read.test.ts": "lib", "responses-undeclared-tool-guard-inbound.test.ts": "responses",
+    "responses-account-auto-pause.test.ts": "responses", "oauth-account-auto-pause.test.ts": "oauth", "codex-history-pending-wal.test.ts": "codex-integration", "responses-anthropic-billing-send-budget.test.ts": "responses", "anthropic-billing-ownership.test.ts": "adapters/anthropic", "server-anthropic-billing.test.ts": "server", "server-anthropic-billing-boundaries.test.ts": "server", "router-anthropic-billing-failover.test.ts": "routing", "anthropic-billing-refusal.test.ts": "adapters/anthropic", "messages-request-id-headers.test.ts": "claude-integration", "bounded-file-read.test.ts": "lib", "responses-undeclared-tool-guard-inbound.test.ts": "responses",
     "messages-request-id-endpoint.test.ts": "claude-integration",
     "anthropic-revoked-token.test.ts": "adapters/anthropic",
     "messages-revoked-token.test.ts": "claude-integration",
diff --git a/skills/ocx/references/01_surface_accounts.md b/skills/ocx/references/01_surface_accounts.md
index 68d05ed225d..7169ac65999 100644
--- a/skills/ocx/references/01_surface_accounts.md
+++ b/skills/ocx/references/01_surface_accounts.md
@@ -199,7 +199,7 @@ JSON mode: `payload`.
 
 Usage: `ocx account pause <provider> <account-id|alias|main> [--json]`
 
-Exclude one account in a Codex, Anthropic or supported generic OAuth pool from automatic selection.
+Exclude one account in a Codex, Anthropic, generic OAuth or API-key pool from automatic selection.
 
 State-changing: yes.
 
@@ -209,6 +209,8 @@ State-changing: yes.
 | PUT | `/api/codex-auth/accounts/pause` |
 | GET | `/api/oauth/accounts` |
 | PUT | `/api/oauth/accounts/pause` |
+| GET | `/api/providers/keys` |
+| PUT | `/api/providers/keys/pause` |
 
 | Flag | Value | Meaning |
 |---|---|---|
@@ -216,13 +218,13 @@ State-changing: yes.
 
 JSON mode: `envelope`.
 
-- Codex pause unbinds pinned threads and selects a fallback when possible; with no fallback, a paused-but-selected Codex account still receives requests. Anthropic and generic OAuth pause exclude the account from new requests, failover and refresh, and an all-paused pool answers 403. Credentials and health are preserved; already-sent turns are not cancelled.
+- Codex pause unbinds pinned threads and selects a fallback when possible; with no fallback, the paused account cannot dispatch until resumed. Anthropic and generic OAuth pause exclude the account from new requests, failover and refresh, and an all-paused pool answers 403. Credentials and health are preserved; already-sent turns are not cancelled.
 
 ### `ocx account resume`
 
 Usage: `ocx account resume <provider> <account-id|alias|main> [--json]`
 
-Return a paused account to a Codex, Anthropic or supported generic OAuth pool.
+Return a paused account to a Codex, Anthropic, generic OAuth or API-key pool.
 
 State-changing: yes.
 
@@ -232,6 +234,8 @@ State-changing: yes.
 | PUT | `/api/codex-auth/accounts/pause` |
 | GET | `/api/oauth/accounts` |
 | PUT | `/api/oauth/accounts/pause` |
+| GET | `/api/providers/keys` |
+| PUT | `/api/providers/keys/pause` |
 
 | Flag | Value | Meaning |
 |---|---|---|
diff --git a/src/adapters/google-http.ts b/src/adapters/google-http.ts
index 3b062e24bdc..ddce944901a 100644
--- a/src/adapters/google-http.ts
+++ b/src/adapters/google-http.ts
@@ -1,3 +1,4 @@
+import { inheritAccountAutoPauseResponse } from "../lib/account-auto-pause-response";
 import type { AdapterFetchContext, AdapterRequest } from "./base";
 import { createAdapterPhysicalSend } from "./physical-send";
 import type { SendClass } from "../lib/request-execution-budget";
@@ -38,10 +39,10 @@ async function normalizeFinalGoogleError(label: string, res: Response, signal?:
     const headers = new Headers(res.headers);
     headers.delete("content-encoding");
     headers.delete("content-length");
-    return new Response(safeGoogleHttpErrorMessage(label, res.status,
+    return inheritAccountAutoPauseResponse(res, new Response(safeGoogleHttpErrorMessage(label, res.status,
       body.displaySafe && !body.truncated ? body.text : ""), {
       status: res.status, statusText: res.statusText, headers,
-    });
+    }));
   }
   return normalizeUpstreamHttpErrorResponse(res, {
     signal,
diff --git a/src/adapters/upstream-http-error.ts b/src/adapters/upstream-http-error.ts
index f0627ceffe4..25b49e38c4b 100644
--- a/src/adapters/upstream-http-error.ts
+++ b/src/adapters/upstream-http-error.ts
@@ -1,3 +1,4 @@
+import { inheritAccountAutoPauseResponse } from "../lib/account-auto-pause-response";
 import { readBoundedResponseBody } from "../lib/bounded-body";
 import { redactSecretString } from "../lib/redact";
 
@@ -40,9 +41,9 @@ export async function normalizeUpstreamHttpErrorResponse(
   const headers = new Headers(res.headers);
   headers.delete("content-encoding");
   headers.delete("content-length");
-  return new Response(await opts.formatMessage(payloadText), {
+  return inheritAccountAutoPauseResponse(res, new Response(await opts.formatMessage(payloadText), {
     status: res.status,
     statusText: res.statusText,
     headers,
-  });
+  }));
 }
diff --git a/src/cli/account-api.ts b/src/cli/account-api.ts
index c4ad6cb4abe..e4f2edfdf15 100644
--- a/src/cli/account-api.ts
+++ b/src/cli/account-api.ts
@@ -16,6 +16,7 @@ import { projectApiKeyQuotaRows } from "./account-key-quota";
 import { projectAccountHealth } from "./account-next-actions";
 import type { OAuthHealthLabel } from "../oauth/health";
 
+import { accountPauseDetailsSchema } from "../config/schema/account-auto-pause";
 export type AccountType = "codex" | "oauth" | "api-key";
 
 export interface AccountRow {
@@ -61,6 +62,7 @@ export interface AccountRow {
    * human listing (#2703).
    */
   paused?: boolean;
+  pauseDetails?: import("../types/account-auto-pause").AccountPauseDetails;
 }
 
 export type ClassifyResult = { type: AccountType } | { error: string };
@@ -341,6 +343,7 @@ interface CodexAccountDto {
   quota?: CodexQuotaDto | null;
   quotaRefresh?: unknown;
   paused?: boolean;
+  pauseDetails?: import("../types/account-auto-pause").AccountPauseDetails;
 }
 
 function projectQuota(quota: CodexQuotaDto | null | undefined): CodexQuotaDto | null {
@@ -414,6 +417,7 @@ export async function fetchCodexRows(
       ? a.autoSwitchThresholdOverride
       : null,
     paused: a.paused === true,
+    pauseDetails: accountPauseDetailsSchema.safeParse(a.pauseDetails).data,
     ...(includeQuota ? {
       quota: projectQuota(a.quota),
       quotaRefresh: projectCodexQuotaRefreshOutcome(a.quotaRefresh),
@@ -431,6 +435,7 @@ interface OAuthAccountDto {
   healthLabel?: unknown;
   /** Present only for providers that support operator pause (generic OAuth pools). */
   paused?: boolean;
+  pauseDetails?: import("../types/account-auto-pause").AccountPauseDetails;
   autoSwitchThresholdOverride?: number | null;
   needsReauthReason?: "verify_account";
   autoSelectable?: boolean;
@@ -474,7 +479,7 @@ async function fetchOAuthRows(
     active: a.active ?? a.id === activeId,
     needsReauth: a.needsReauth,
     ...projectAccountHealth(a, name, a.id),
-    ...(a.paused === true ? { paused: true } : {}),
+    ...(a.paused === true ? { paused: true, pauseDetails: accountPauseDetailsSchema.safeParse(a.pauseDetails).data } : {}),
     ...(isAnthropicOAuthInstance(name) && Object.hasOwn(a, "autoSwitchThresholdOverride") ? { autoSwitchThresholdOverride: a.autoSwitchThresholdOverride } : {}),
     ...(a.needsReauthReason === "verify_account" ? { needsReauthReason: a.needsReauthReason } : {}),
     ...(name === "kiro" && typeof a.autoSelectable === "boolean"
@@ -494,6 +499,8 @@ async function fetchOAuthRows(
 }
 
 interface ApiKeyDto {
+  disabled?: boolean;
+  pauseDetails?: import("../types/account-auto-pause").AccountPauseDetails;
   id: string;
   label?: string;
   masked?: string;
@@ -522,6 +529,8 @@ async function fetchKeyRows(deps: AccountDeps, baseUrl: string, name: string, qu
     label: k.label ?? k.masked,
     masked: k.masked,
     active: k.active ?? k.id === activeId,
+    paused: k.disabled === true,
+    pauseDetails: accountPauseDetailsSchema.safeParse(k.pauseDetails).data,
   }));
   return { rows, activeId, status: 200 };
 }
diff --git a/src/cli/account-extended.ts b/src/cli/account-extended.ts
index 931cc1c9602..8b743baf7d2 100644
--- a/src/cli/account-extended.ts
+++ b/src/cli/account-extended.ts
@@ -260,7 +260,7 @@ function resetIso(value: number | undefined): string | null {
 
 function refreshLine(row: FamilyRows["rows"][number]): string {
   const parts = [row.id === MAIN_ID ? "main" : row.id, row.email, row.plan];
-  if (row.paused) parts.push("paused");
+  if (row.paused) parts.push(row.pauseDetails ? `paused(${row.pauseDetails.reason})` : "paused");
   // Was a second quota dialect: it gated the whole block on weekly/monthly, so an account
   // reporting only a 5h window printed `quota: unknown` while `quotaParts` five lines below
   // rendered the same data correctly for the provider path (#2703). Two halves of one file
@@ -839,6 +839,17 @@ export async function cmdPause(args: string[], deps: AccountDeps, paused: boolea
     return 0;
   }
 
+  if (classified.type === "api-key") {
+    const rows = await fetchRows(deps, baseUrl, name, "api-key");
+    if (rows.status === 0) return proxyUnreachable(rows.transportError);
+    if (rows.status !== 200) return apiError(rows.errorJson ?? {}, "failed to list API key accounts", rows.status);
+    const target = resolveGenericOAuthAccountTarget(rows.rows.map(row => ({ id: row.id, alias: row.label })), requestedId);
+    if ("error" in target) return usage(target.error.replace("OAuth", "API key"));
+    const result = await apiJson(deps, baseUrl, "PUT", "/api/providers/keys/pause", { name, id: target.id, paused });
+    if (result.status !== 200) return apiError(result.json, `failed to ${verb} account`, result.status);
+    console.log(wantsJson ? JSON.stringify({ ok: true, provider: name, id: target.id, paused }) : `${name}: account ${paused ? "paused" : "resumed"}`);
+    return 0;
+  }
   if (classified.type !== "codex") {
     return usage(`Error: ${verb} applies to the openai Codex account pool or a generic OAuth provider`);
   }
diff --git a/src/cli/account.ts b/src/cli/account.ts
index 09ddaf81c40..86dd96c4ea5 100644
--- a/src/cli/account.ts
+++ b/src/cli/account.ts
@@ -117,7 +117,7 @@ function statusText(row: AccountRow): string {
   // `paused` leads, and does NOT replace `selected`. A paused-but-selected account is the
   // state an operator most needs named -- requests route to it while the pool believes it is
   // held out -- so printing only one of the two would hide exactly the confusing case (#2703).
-  if (row.paused) parts.push("paused");
+  if (row.paused) parts.push(row.pauseDetails ? `paused(${row.pauseDetails.reason})` : "paused");
   if (row.active) parts.push(row.type === "codex" ? "selected" : "active");
   if (row.needsReauth && !(row.provider === "kiro" && row.skipReason === "needs_reauth")) {
     parts.push(row.needsReauthReason === "verify_account" ? "needs-reauth(verify)" : "needs-reauth");
diff --git a/src/cli/capabilities-base.ts b/src/cli/capabilities-base.ts
index 4a374354b43..3c40a1956e3 100644
--- a/src/cli/capabilities-base.ts
+++ b/src/cli/capabilities-base.ts
@@ -331,18 +331,18 @@ export const CAPABILITIES: readonly Capability[] = [
   },
   {
     command: ["account","pause"],
-    summary: "Exclude one account in a Codex, Anthropic or supported generic OAuth pool from automatic selection.",
-    routes: [{"method":"GET","path":"/api/codex-auth/accounts"},{"method":"PUT","path":"/api/codex-auth/accounts/pause"},{"method":"GET","path":"/api/oauth/accounts"},{"method":"PUT","path":"/api/oauth/accounts/pause"}],
+    summary: "Exclude one account in a Codex, Anthropic, generic OAuth or API-key pool from automatic selection.",
+    routes: [{"method":"GET","path":"/api/codex-auth/accounts"},{"method":"PUT","path":"/api/codex-auth/accounts/pause"},{"method":"GET","path":"/api/oauth/accounts"},{"method":"PUT","path":"/api/oauth/accounts/pause"},{"method":"GET","path":"/api/providers/keys"},{"method":"PUT","path":"/api/providers/keys/pause"}],
     flags: [{"name":"--json","value":"boolean","summary":"Emit the pause result as JSON."}],
     mutates: true,
     json: "envelope",
-    details: ["Codex pause unbinds pinned threads and selects a fallback when possible; with no fallback, a paused-but-selected Codex account still receives requests. Anthropic and generic OAuth pause exclude the account from new requests, failover and refresh, and an all-paused pool answers 403. Credentials and health are preserved; already-sent turns are not cancelled."],
+    details: ["Codex pause unbinds pinned threads and selects a fallback when possible; with no fallback, the paused account cannot dispatch until resumed. Anthropic and generic OAuth pause exclude the account from new requests, failover and refresh, and an all-paused pool answers 403. Credentials and health are preserved; already-sent turns are not cancelled."],
     usage: "ocx account pause <provider> <account-id|alias|main> [--json]",
   },
   {
     command: ["account","resume"],
-    summary: "Return a paused account to a Codex, Anthropic or supported generic OAuth pool.",
-    routes: [{"method":"GET","path":"/api/codex-auth/accounts"},{"method":"PUT","path":"/api/codex-auth/accounts/pause"},{"method":"GET","path":"/api/oauth/accounts"},{"method":"PUT","path":"/api/oauth/accounts/pause"}],
+    summary: "Return a paused account to a Codex, Anthropic, generic OAuth or API-key pool.",
+    routes: [{"method":"GET","path":"/api/codex-auth/accounts"},{"method":"PUT","path":"/api/codex-auth/accounts/pause"},{"method":"GET","path":"/api/oauth/accounts"},{"method":"PUT","path":"/api/oauth/accounts/pause"},{"method":"GET","path":"/api/providers/keys"},{"method":"PUT","path":"/api/providers/keys/pause"}],
     flags: [{"name":"--json","value":"boolean","summary":"Emit the resume result as JSON."}],
     mutates: true,
     json: "envelope",
diff --git a/src/codex/account-pause.ts b/src/codex/account-pause.ts
index a8a4c2d1e20..e98c45af8e1 100644
--- a/src/codex/account-pause.ts
+++ b/src/codex/account-pause.ts
@@ -1,3 +1,5 @@
+import { randomUUID } from "node:crypto";
+import type { AccountPauseDetails } from "../types/account-auto-pause";
 import type { OcxConfig } from "../types";
 import { deleteConfigTopLevelKey } from "../config/rebase-provenance";
 
@@ -7,7 +9,9 @@ export function isCodexAccountPaused(config: OcxConfig, accountId: string): bool
 }
 
 /** Persist the account's pool eligibility without changing credentials or runtime health. */
-export function setCodexAccountPaused(config: OcxConfig, accountId: string, paused: boolean): void {
+export function setCodexAccountPaused(config: OcxConfig, accountId: string, paused: boolean, details?: AccountPauseDetails): void {
+  config.codexAccountPauseState = { ...config.codexAccountPauseState,
+    [accountId]: { revision: randomUUID(), ...(paused && details ? { details } : {}) } };
   const pausedIds = new Set(config.pausedCodexAccountIds ?? []);
   if (paused) pausedIds.add(accountId);
   else pausedIds.delete(accountId);
@@ -18,4 +22,5 @@ export function setCodexAccountPaused(config: OcxConfig, accountId: string, paus
 
 export function forgetCodexAccountPause(config: OcxConfig, accountId: string): void {
   setCodexAccountPaused(config, accountId, false);
+  if (config.codexAccountPauseState) delete config.codexAccountPauseState[accountId];
 }
diff --git a/src/codex/auth-api/account-list.ts b/src/codex/auth-api/account-list.ts
index 267a39d1219..fca5d08d7af 100644
--- a/src/codex/auth-api/account-list.ts
+++ b/src/codex/auth-api/account-list.ts
@@ -140,6 +140,7 @@ export function poolAccountDto(
     logLabel: codexAccountLogLabel(account),
     isMain: false,
     paused,
+    ...(config.codexAccountPauseState?.[account.id]?.details ? { pauseDetails: config.codexAccountPauseState[account.id]!.details } : {}),
     priority,
     autoSwitchThresholdOverride: getCodexAccountAutoSwitchThresholdOverride(config, account.id),
     creditsAfterLimit: codexAccountUsesCreditsAfterLimit(config, account.id),
@@ -165,6 +166,7 @@ export interface CodexAuthAccountDto {
   logLabel?: string;
   isMain: boolean;
   paused: boolean;
+  pauseDetails?: import("../../types/account-auto-pause").AccountPauseDetails;
   /** Selection order; higher is used earlier. Always present, 0 when unset. */
   priority: number;
   /** Null inherits the global usage-switch threshold; 0 disables it for this account. */
@@ -400,6 +402,7 @@ export async function listCodexAuthAccountsSnapshot(
       logLabel: "main",
       isMain: true,
       paused: isCodexAccountPaused(runtimeConfig, MAIN_CODEX_ACCOUNT_ID),
+      ...(runtimeConfig.codexAccountPauseState?.[MAIN_CODEX_ACCOUNT_ID]?.details ? { pauseDetails: runtimeConfig.codexAccountPauseState[MAIN_CODEX_ACCOUNT_ID]!.details } : {}),
       mainAccountHardLock: { ...getMainAccountHardLockStatus(runtimeConfig),
         externalUsage: getMainAccountExternalUsageWarning(getObservedMainQuotaIdentityKey()) },
       priority: getCodexAccountPriority(runtimeConfig, MAIN_CODEX_ACCOUNT_ID),
diff --git a/src/codex/auth-context.ts b/src/codex/auth-context.ts
index 76438d04ac3..59667d0bfae 100644
--- a/src/codex/auth-context.ts
+++ b/src/codex/auth-context.ts
@@ -769,8 +769,10 @@ export function createCodexAuthDispatchGuard(
   terminalHelper = false,
 ): ((headers: Headers) => void) | undefined {
   const reserveGuard = createCodexReserveDispatchGuard(ctx, config, modelId, admission, terminalHelper);
-  if (ctx.kind !== "pool") return reserveGuard;
+  if (ctx.kind !== "pool" && ctx.kind !== "main-pool") return reserveGuard;
   return headers => {
+    if (config.pausedCodexAccountIds?.includes(ctx.accountId)) throw new CodexPoolAuthenticationError("Selected Codex account is paused; resume it in account settings");
+    if (ctx.kind === "main-pool") { reserveGuard?.(headers); return; }
     assertPoolAccountCredits(ctx.accountId, poolContextCreditHoldResetAt(ctx, config));
     reserveGuard?.(headers);
   };
diff --git a/src/config/schema/account-auto-pause.ts b/src/config/schema/account-auto-pause.ts
new file mode 100644
index 00000000000..0ad38056b9c
--- /dev/null
+++ b/src/config/schema/account-auto-pause.ts
@@ -0,0 +1,14 @@
+import * as z from "zod/v4";
+import { ACCOUNT_PAUSE_REASONS } from "../../types/account-auto-pause";
+
+export const accountAutoPausePolicySchema = z.object({
+  enabled: z.boolean().optional(),
+  consecutiveFailures: z.number().int().min(1).max(100).optional(),
+}).strict();
+export const accountPauseDetailsSchema = z.object({
+  reason: z.enum(ACCOUNT_PAUSE_REASONS),
+  pausedAt: z.number().int().nonnegative(),
+}).strict();
+export const accountPauseStateSchema = z.record(z.string(), z.object({
+  revision: z.string(), details: accountPauseDetailsSchema.optional(),
+}).strict());
diff --git a/src/config/schema/config-schema.ts b/src/config/schema/config-schema.ts
index 36a09ba78f9..6aecf51d1fb 100644
--- a/src/config/schema/config-schema.ts
+++ b/src/config/schema/config-schema.ts
@@ -1,5 +1,6 @@
 import { MAIN_ACCOUNT_HARD_LOCK_MIN_PERCENT } from "../../codex/quota-types";
 import * as z from "zod/v4";
+import { accountPauseStateSchema } from "./account-auto-pause";
 import { anthropicAccountPoolSchema } from "./anthropic-account-pool";
 import { compactionRecoverySchema } from "./compaction-recovery";
 import { desktopCompatibilitySchema } from "./desktop-compatibility";
@@ -287,6 +288,7 @@ export const configSchema = z.object({
   // and the default label is emitted, rather than failing the parse or writing a config Codex
   // would refuse to load — the provider id routing depends on is never derived from it.
   codexProviderDisplayName: z.string().trim().min(1).max(128).optional().catch(undefined),
+  codexAccountPauseState: accountPauseStateSchema.optional(),
   pausedCodexAccountIds: z.array(z.string().regex(/^[a-zA-Z0-9._-]{1,64}$/)).optional(),
   // A malformed allow-list degrades to "no account spends credits" rather than failing the parse,
   // so a hand-edited typo cannot trip the backup-and-defaults repair path; the write path rejects
diff --git a/src/config/schema/leaf-validators.ts b/src/config/schema/leaf-validators.ts
index 75b39a29ba3..d8ac762b59e 100644
--- a/src/config/schema/leaf-validators.ts
+++ b/src/config/schema/leaf-validators.ts
@@ -1,4 +1,5 @@
 import * as z from "zod/v4";
+import { accountAutoPausePolicySchema, accountPauseDetailsSchema } from "./account-auto-pause";
 import { anthropicAccountPoolSchema } from "./anthropic-account-pool";
 import { join } from "node:path";
 import { isValidProviderName } from "../provider-name";
@@ -286,6 +287,8 @@ const providerNoProxySchema = z.unknown().superRefine((value, ctx) => {
  * fields pass through (preserved for runtime extensions).
  */
 export const providerConfigSchema = z.object({
+  accountAutoPause: accountAutoPausePolicySchema.optional(),
+  apiKeyPool: z.array(z.object({ id: z.string(), key: z.string(), label: z.string().optional(), addedAt: z.number().optional(), disabled: z.boolean().optional(), pauseRevision: z.string().optional(), pauseDetails: accountPauseDetailsSchema.optional() }).passthrough()).optional(),
   anthropicAccountPool: anthropicAccountPoolSchema,
   // Raw diagnostics/writes reject malformed provenance; tolerant loads preserve the custom row.
   anthropicOAuthInstance: z.literal("anthropic2").optional().catch(undefined),
diff --git a/src/lib/account-auto-pause-response.ts b/src/lib/account-auto-pause-response.ts
new file mode 100644
index 00000000000..9e8262d8453
--- /dev/null
+++ b/src/lib/account-auto-pause-response.ts
@@ -0,0 +1,12 @@
+/** Process-local outcome ownership; these markers never become upstream/client headers. */
+const pausedResponses = new WeakSet<Response>();
+const permanentResponses = new WeakSet<Response>();
+export const wasAccountAutoPaused = (response: Response): boolean => pausedResponses.has(response);
+export const wasPermanentAccountRefusal = (response: Response): boolean => permanentResponses.has(response);
+export function markPermanentAccountRefusal(response: Response): void { permanentResponses.add(response); }
+export function markAccountAutoPaused(response: Response): void { pausedResponses.add(response); }
+export function inheritAccountAutoPauseResponse(source: Response, target: Response): Response {
+  if (wasAccountAutoPaused(source)) markAccountAutoPaused(target);
+  if (wasPermanentAccountRefusal(source)) markPermanentAccountRefusal(target);
+  return target;
+}
diff --git a/src/oauth/account-auto-pause-policy.ts b/src/oauth/account-auto-pause-policy.ts
new file mode 100644
index 00000000000..cbf2a2aab74
--- /dev/null
+++ b/src/oauth/account-auto-pause-policy.ts
@@ -0,0 +1,66 @@
+import type { AccountPauseReason, AccountAutoPausePolicy } from "../types/account-auto-pause";
+import { readBoundedResponseBody } from "../lib/bounded-body";
+
+/** Only whole, account-scoped messages are authority; model/resource policy errors are not. */
+export function classifyPermanentAccountRefusal(status: number, payload: unknown): AccountPauseReason | undefined {
+  if (status !== 401 && status !== 403 || !payload || typeof payload !== "object" || Array.isArray(payload)) return;
+  const error = (payload as { error?: unknown }).error;
+  if (!error || typeof error !== "object" || Array.isArray(error)) return;
+  const { type: rawType, code, message, status: googleStatus } = error as Record<string, unknown>;
+  const google = googleStatus === "PERMISSION_DENIED" || googleStatus === "UNAUTHENTICATED";
+  const type = rawType ?? (googleStatus === "PERMISSION_DENIED" ? "permission_error" : googleStatus === "UNAUTHENTICATED" ? "authentication_error" : undefined);
+  if (typeof message !== "string" || !["permission_error", "authentication_error", "invalid_request_error"].includes(String(type))) return;
+  if (code != null && !(google && code === status) && !["permission_error", "permission_denied", "subscription_inactive", "subscription_expired", "subscription_required", "plan_downgraded"].includes(String(code))) return;
+  const text = message.trim();
+  if (/^OAuth authentication is (?:currently )?not allowed for this organi[sz]ation[.!]?$/i.test(text)) return "oauth_organization_disabled";
+  if (/^(?:Your |The )?(?:Claude |ChatGPT )?subscription (?:has expired|is expired)[.!]?$/i.test(text)) return "subscription_expired";
+  if (/^(?:(?:Your |The )?(?:Claude |ChatGPT )?subscription is inactive|Your account does not have an active subscription)[.!]?$/i.test(text)) return "subscription_inactive";
+  if (/^Your (?:account|plan) (?:has been |was )?downgraded to (?:the )?free(?: plan)? (?:and |with )?(?:has )?(?:no|without) (?:remaining )?credits[.!]?$/i.test(text)) return "plan_downgraded";
+  if (type === "permission_error" && /^Your account (?:does not have access to Claude Code|is (?:disabled|suspended)|is not permitted to use (?:the |this )?API)[.!]?$/i.test(text)) return "account_permission_denied";
+}
+
+export async function permanentAccountRefusal(response: Response, signal?: AbortSignal): Promise<AccountPauseReason | undefined> {
+  if (response.status !== 401 && response.status !== 403) return;
+  try {
+    const body = await readBoundedResponseBody(response.clone(), { signal, fatalUtf8: true,
+      maxBytes: 16_384, totalTimeoutMs: 250, inactivityTimeoutMs: 250 });
+    if (!body.displaySafe || body.truncated) return;
+    return classifyPermanentAccountRefusal(response.status, JSON.parse(body.text));
+  } catch { return; }
+}
+
+export function autoPauseThreshold(policy: AccountAutoPausePolicy | undefined): number | undefined {
+  if (policy?.enabled !== true) return;
+  const threshold = policy.consecutiveFailures ?? 2;
+  return Number.isInteger(threshold) && threshold >= 1 && threshold <= 100 ? threshold : undefined;
+}
+
+type Streak = { incarnation: string; count: number; tail: Promise<unknown>; paused: boolean };
+/** Process-local streaks, serialized in response-arrival order, including asynchronous reads/writes. */
+export class AccountRefusalStreaks {
+  private readonly accounts = new Map<string, Streak>();
+  observe(key: string, incarnation: string, threshold: number, verdict: Promise<AccountPauseReason | undefined>, success: boolean,
+    current: () => boolean, pause: (reason: AccountPauseReason) => Promise<boolean>): Promise<boolean> {
+    if (!current()) return Promise.resolve(false);
+    let streak = this.accounts.get(key);
+    if (!streak || streak.incarnation !== incarnation) {
+      // Capacity refusal forgets no live streak and never pauses on incomplete evidence.
+      if (!streak && this.accounts.size >= 2048) return Promise.resolve(false);
+      streak = { incarnation, count: 0, tail: Promise.resolve(), paused: false };
+      this.accounts.set(key, streak);
+    }
+    const owned = streak;
+    const result = owned.tail.catch(() => undefined).then(async () => {
+      const reason = await verdict;
+      if (this.accounts.get(key) !== owned || owned.paused || !current()) return false;
+      if (success) { owned.count = 0; return false; }
+      if (!reason) return false;
+      owned.count = Math.min(owned.count + 1, threshold);
+      if (owned.count < threshold) return false;
+      owned.paused = await pause(reason);
+      return owned.paused;
+    });
+    owned.tail = result;
+    return result;
+  }
+}
diff --git a/src/oauth/account-auto-pause.ts b/src/oauth/account-auto-pause.ts
new file mode 100644
index 00000000000..cfa0962e33e
--- /dev/null
+++ b/src/oauth/account-auto-pause.ts
@@ -0,0 +1,128 @@
+import type { OcxConfig, OcxProviderConfig } from "../types";
+import type { OAuthAccessSnapshot } from "./index";
+import type { CodexAuthContext } from "../codex/auth-context";
+import type { AccountPauseReason } from "../types/account-auto-pause";
+import { credentialGeneration, getAccountSet, setAccountPaused } from "./store";
+import { mutatePersistedConfig } from "../config";
+import { isCodexAccountGenerationLive, readCodexAccountRecord } from "../codex/account-store";
+import { captureMainQuotaDispatch, isMainQuotaDispatchLive } from "../codex/main-account-cache";
+import { isCodexAccountPaused, setCodexAccountPaused } from "../codex/account-pause";
+import { apiKeyPoolEntryId } from "../providers/api-keys";
+import { resolveProviderApiKey } from "../providers/api-key-resolve";
+import { createHash } from "node:crypto";
+import { setProviderApiKeyPaused } from "../providers/api-key-pause";
+import { AccountRefusalStreaks, autoPauseThreshold, permanentAccountRefusal } from "./account-auto-pause-policy";
+import { clearThreadAccountMapForAccount, reconcileCodexActiveAfterExclusion } from "../codex/routing";
+import { isNonReplayableResponse } from "../lib/upstream-retry";
+
+const streaks = new WeakMap<OcxConfig, AccountRefusalStreaks>();
+export { wasAccountAutoPaused, wasPermanentAccountRefusal } from "../lib/account-auto-pause-response";
+import { markAccountAutoPaused, markPermanentAccountRefusal } from "../lib/account-auto-pause-response";
+export interface AccountAutoPauseBinding {
+  config: OcxConfig;
+  oauth?: OAuthAccessSnapshot;
+  codex?: CodexAuthContext;
+}
+
+/** Capture before transport. A later response cannot acquire authority over a newer login/resume. */
+export function captureAccountAutoPauseAttempt(name: string, provider: OcxProviderConfig, binding?: AccountAutoPauseBinding, headers?: Headers):
+  ((response: Response) => Promise<Response>) | undefined {
+  if (!binding) return;
+  const { config, oauth, codex } = binding;
+  const threshold = autoPauseThreshold(config.providers[name]?.accountAutoPause);
+  if (!threshold) return;
+  const configured = config.providers[name];
+  if (!configured || configured.disabled) return;
+  const route = JSON.stringify([configured.baseUrl, configured.adapter, configured.authMode]);
+  const policyCurrent = () => autoPauseThreshold(config.providers[name]?.accountAutoPause) === threshold
+    && JSON.stringify([config.providers[name]?.baseUrl, config.providers[name]?.adapter, config.providers[name]?.authMode]) === route;
+  let key: string, incarnation: string, current: () => boolean;
+  let pause: (reason: AccountPauseReason) => Promise<boolean>;
+  if (provider.authMode === "oauth") {
+    if (!oauth || oauth.provider !== name || headers?.get("authorization") !== `Bearer ${oauth.accessToken}` || headers.has("x-api-key")) return;
+    const row = getAccountSet(name)?.accounts.find(a => a.id === oauth.accountId);
+    if (!row || row.paused || credentialGeneration(row.credential) !== oauth.generation) return;
+    const revision = row.pauseRevision;
+    key = `${name}\0oauth\0${oauth.accountId}`;
+    incarnation = `${row.loginId ?? row.addedAt ?? oauth.accountId}\0${revision ?? ""}`;
+    current = () => {
+      const live = getAccountSet(name)?.accounts.find(a => a.id === oauth.accountId);
+      return !!live && !live.paused && live.pauseRevision === revision && credentialGeneration(live.credential) === oauth.generation;
+    };
+    pause = async reason => (await setAccountPaused(name, oauth.accountId, true, {
+      generation: oauth.generation, pauseRevision: revision, isCurrent: policyCurrent, details: { reason, pausedAt: Date.now() },
+    })).status === "updated";
+  } else if (provider.authMode === "forward") {
+    if (!codex || codex.kind !== "pool" && codex.kind !== "main-pool") return;
+    const { accountId } = codex;
+    if (headers?.get("authorization") !== `Bearer ${codex.accessToken}`) return;
+    const revision = config.codexAccountPauseState?.[accountId]?.revision;
+    const mainDispatch = codex.kind === "main-pool" ? captureMainQuotaDispatch(codex.accessToken, codex.chatgptAccountId, codex.writerGeneration) : undefined;
+    const credentialCurrent = () => codex.kind === "pool"
+      ? isCodexAccountGenerationLive(accountId, codex.generation)
+      : !!mainDispatch && isMainQuotaDispatchLive(mainDispatch);
+    key = `${name}\0codex\0${accountId}`;
+    incarnation = `${codex.kind === "pool" ? readCodexAccountRecord(accountId)?.quotaHistoryIdentity ?? codex.generation : mainDispatch?.credentialGeneration}\0${revision ?? ""}`;
+    current = () => !isCodexAccountPaused(config, accountId)
+      && config.codexAccountPauseState?.[accountId]?.revision === revision && credentialCurrent();
+    pause = async reason => {
+      let pauseState: OcxConfig["codexAccountPauseState"];
+      const outcome = mutatePersistedConfig(fresh => {
+        if (!credentialCurrent() || isCodexAccountPaused(fresh, accountId)
+          || fresh.codexAccountPauseState?.[accountId]?.revision !== revision
+          || autoPauseThreshold(fresh.providers[name]?.accountAutoPause) !== threshold) return { changed: false, value: false };
+        setCodexAccountPaused(fresh, accountId, true, { reason, pausedAt: Date.now() });
+        pauseState = structuredClone(fresh.codexAccountPauseState);
+        return { changed: true, value: true };
+      });
+      if (outcome.status !== "committed" || !outcome.value) return false;
+      config.pausedCodexAccountIds = [...new Set([...(config.pausedCodexAccountIds ?? []), accountId])];
+      config.codexAccountPauseState = pauseState;
+      clearThreadAccountMapForAccount(accountId);
+      reconcileCodexActiveAfterExclusion(config, accountId);
+      return true;
+    };
+  } else {
+    const selection = provider._apiKeyAttempt;
+    if (!headers || !provider.apiKey || ![headers.get("authorization"), headers.get("x-api-key"), headers.get("x-goog-api-key")].some(value => value === provider.apiKey || value === `Bearer ${provider.apiKey}`)) return;
+    const entry = configured.apiKeyPool?.find(e => e.id === selection?.entryId && e.key === selection.reference)
+      ?? (!configured.apiKeyPool?.length && configured.apiKey ? { id: apiKeyPoolEntryId(configured.apiKey), key: configured.apiKey, disabled: false, pauseRevision: undefined } : undefined);
+    if (!entry || entry.disabled || !selection) return;
+    const { id, key: reference, pauseRevision } = entry;
+    key = `${name}\0key\0${id}`;
+    const resolvedKey = provider.apiKey;
+    incarnation = `${createHash("sha256").update(resolvedKey).digest("hex")}\0${pauseRevision ?? ""}`;
+    current = () => {
+      const configured = config.providers[name];
+      const live = configured?.apiKeyPool?.find(e => e.id === id) ?? (!configured?.apiKeyPool?.length && configured?.apiKey === reference ? entry : undefined);
+      return !!live && !live.disabled && live.key === reference && live.pauseRevision === pauseRevision && resolveProviderApiKey(reference) === resolvedKey;
+    };
+    pause = async reason => setProviderApiKeyPaused(config, name, id, true, {
+      selection, pauseRevision, resolvedKey, details: { reason, pausedAt: Date.now() },
+    });
+  }
+  let tracker = streaks.get(config);
+  if (!tracker) { tracker = new AccountRefusalStreaks(); streaks.set(config, tracker); }
+  const observed = new WeakSet<Response>();
+  return async response => {
+    if (observed.has(response) || isNonReplayableResponse(response)) return response;
+    observed.add(response);
+    try {
+      const verdict = permanentAccountRefusal(response).then(reason => {
+        if (reason) markPermanentAccountRefusal(response);
+        return reason;
+      });
+      const paused = await tracker.observe(key, incarnation, threshold, verdict, response.ok,
+        () => policyCurrent() && current(), pause);
+      if (paused) {
+        markAccountAutoPaused(response);
+        // Fixed codes only. Never print the upstream body, provider label, or account identifier.
+        console.warn(`[account-auto-pause] paused after ${threshold} consecutive permanent account refusals`);
+      }
+    } catch {
+      // Optional persistence must preserve the original provider response.
+      console.warn("[account-auto-pause] could not persist account pause; upstream response preserved");
+    }
+    return response;
+  };
+}
diff --git a/src/oauth/anthropic-account-refusal.ts b/src/oauth/anthropic-account-refusal.ts
index 63d4d5790a4..4243a138d04 100644
--- a/src/oauth/anthropic-account-refusal.ts
+++ b/src/oauth/anthropic-account-refusal.ts
@@ -1,3 +1,4 @@
+import { wasAccountAutoPaused } from "./account-auto-pause";
 import { anthropicModelFamily } from "./anthropic-model-quota";
 /** Narrow pre-output account recovery, fenced to the bearer that physically sent the turn. */
 import { readBoundedResponseBody } from "../lib/bounded-body";
@@ -99,6 +100,11 @@ export async function rotateAnthropicAccountOnResponseForInstance(
   const { pauseAnthropicRateAdmission, anthropicRatePauseUntil } = anthropicRatePolicyFor(instance);
   const { recordAnthropicAccountRefusal, rotateAnthropicAccountOnRefusal,
     hasAnthropicFailoverQuorum, isAnthropicAccountPoolEnabled, pickAlternateAnthropicAccount } = routing;
+  if (wasAccountAutoPaused(response)) {
+    if (!options.canRetry || options.signal?.aborted) return null;
+    return pickAlternateAnthropicAccount(options.config, sent.accountId, Date.now(),
+      options.currentDecision ? options.currentDecision() : options.decision ?? null, options.model, options.excludedAccountIds);
+  }
   const ownedCurrent = () => {
     if (configuredAnthropicInstance(options.config, instance) !== instance
       || !anthropicPhysicalSendOwnershipIsCurrent(sent)) return undefined;
diff --git a/src/oauth/store.ts b/src/oauth/store.ts
index 25c3e7dfda4..dc13244bca2 100644
--- a/src/oauth/store.ts
+++ b/src/oauth/store.ts
@@ -19,6 +19,7 @@
  *   distinct one. Kimi extracts JWT `user_id`/`sub` as accountId; Cursor extracts JWT `sub` —
  *   both append distinct identified accounts under multiauth.
  */
+import { accountPauseDetailsSchema } from "../config/schema/account-auto-pause";
 import { normalizeOAuthPlan, mergeOAuthPlan } from "./plan";
 import { normalizeAnthropicIdentity, matchesAnthropicImport, mergeAnthropicIdentity } from "./anthropic-identity";
 import { findKiroAccountForLogin, withRetainedKiroUser } from "./kiro-account-identity";
@@ -638,7 +639,12 @@ function normalizeAccount(value: unknown): ProviderAccount | null {
   if (candidate.refreshAttentionGeneration === credentialGeneration(credential)) {
     account.refreshAttentionGeneration = candidate.refreshAttentionGeneration;
   }
-  if (candidate.paused === true) account.paused = true;
+  if (candidate.paused === true) {
+    account.paused = true;
+    const details = accountPauseDetailsSchema.safeParse(candidate.pauseDetails);
+    if (details.success) account.pauseDetails = details.data;
+  }
+  if (typeof candidate.pauseRevision === "string") account.pauseRevision = candidate.pauseRevision;
   const threshold = parseAnthropicAccountThreshold(candidate.autoSwitchThresholdOverride);
   if (threshold !== null) account.autoSwitchThresholdOverride = threshold;
   if (candidate.needsReauth === true && candidate.needsReauthReason === "verify_account") {
@@ -1381,17 +1387,23 @@ export async function setAccountPaused(
   provider: string,
   accountId: string,
   paused: boolean,
+  automatic?: { generation: string; pauseRevision?: string; details: import("../types/account-auto-pause").AccountPauseDetails; isCurrent?: () => boolean },
 ): Promise<SetAccountPausedResult> {
   const result = await mutateStore(store => {
     const set = store[provider];
     const account = set?.accounts.find(candidate => candidate.id === accountId);
     if (!set || !account) return { status: "not-found" } as const;
-    if ((account.paused === true) === paused) {
+    if (automatic && (automatic.isCurrent?.() === false || credentialGeneration(account.credential) !== automatic.generation
+      || account.pauseRevision !== automatic.pauseRevision)) return { status: "not-found" } as const;
+    if (paused && account.paused === true) {
       return { status: "unchanged", activeAccountId: set.activeAccountId, activeAccountChanged: false } as const;
     }
 
     if (paused) account.paused = true;
     else delete account.paused;
+    account.pauseRevision = randomUUID();
+    if (automatic) account.pauseDetails = automatic.details;
+    else delete account.pauseDetails;
     // Pause is part of selection eligibility even when the operator changes a non-active
     // account. Bump the provider selection revision so observers receive the existing
     // post-persistence roster invalidation and stale automatic proposals cannot commit.
@@ -1425,7 +1437,9 @@ export async function setAccountPaused(
       activeAccountId: set.activeAccountId,
       activeAccountChanged,
     } as const;
-  }, [provider, accountId, paused]);
+  }, [provider, accountId, paused], { assertBeforePersist: () => {
+    if (automatic?.isCurrent?.() === false) throw new Error("Account auto-pause policy changed before persistence");
+  } });
   if (result.status === "updated") publishOAuthAccountPauseChange(provider);
   return result;
 }
@@ -1478,6 +1492,8 @@ export async function replaceProviderAccountSet(
         ...(account.needsReauth ? { needsReauth: true } : {}),
         ...(account.refreshAttentionGeneration ? { refreshAttentionGeneration: account.refreshAttentionGeneration } : {}),
         ...(account.paused ? { paused: true } : {}),
+        ...(account.pauseDetails ? { pauseDetails: account.pauseDetails } : {}),
+        ...(account.pauseRevision ? { pauseRevision: account.pauseRevision } : {}),
         ...(account.autoSwitchThresholdOverride !== undefined ? { autoSwitchThresholdOverride: account.autoSwitchThresholdOverride } : {}),
         ...(account.needsReauthReason === "verify_account" ? { needsReauthReason: account.needsReauthReason } : {}),
         ...(account.addedAt !== undefined ? { addedAt: account.addedAt } : {}),
diff --git a/src/oauth/types.ts b/src/oauth/types.ts
index 05852753f38..14bf29c88af 100644
--- a/src/oauth/types.ts
+++ b/src/oauth/types.ts
@@ -96,6 +96,8 @@ export interface ProviderAccount {
   refreshAttentionGeneration?: string;
   /** Operator exclusion from generic OAuth account selection until explicitly resumed. */
   paused?: boolean;
+  pauseDetails?: import("../types/account-auto-pause").AccountPauseDetails;
+  pauseRevision?: string;
   /** Anthropic-only usage-switch override; absent inherits its pool default, zero disables it. */
   autoSwitchThresholdOverride?: number;
   /**
diff --git a/src/providers/api-key-pause.ts b/src/providers/api-key-pause.ts
new file mode 100644
index 00000000000..3b5087356ec
--- /dev/null
+++ b/src/providers/api-key-pause.ts
@@ -0,0 +1,30 @@
+import { randomUUID } from "node:crypto";
+import type { OcxConfig } from "../types";
+import type { ProviderApiKeySelection } from "../types/provider";
+import type { AccountPauseDetails } from "../types/account-auto-pause";
+import { apiKeyPoolEntryId } from "./api-keys";
+import { resolveProviderApiKey } from "./api-key-resolve";
+import { commitProviderApiKeySelection } from "./api-key-selection";
+
+export function setProviderApiKeyPaused(config: OcxConfig, name: string, id: string, paused: boolean,
+  automatic?: { selection: ProviderApiKeySelection; pauseRevision?: string; resolvedKey?: string; details: AccountPauseDetails }): boolean {
+  const result = commitProviderApiKeySelection(config, name, provider => {
+    const pool = provider.apiKeyPool?.length ? provider.apiKeyPool
+      : provider.apiKey ? [{ id: apiKeyPoolEntryId(provider.apiKey), key: provider.apiKey }] : [];
+    const entry = pool.find(e => e.id === id);
+    if (!entry || automatic && (entry.disabled || entry.key !== automatic.selection.reference || entry.pauseRevision !== automatic.pauseRevision
+      || provider.accountAutoPause?.enabled !== true || resolveProviderApiKey(entry.key) !== automatic.resolvedKey)) return { changed: false, value: false };
+    provider.apiKeyPool = pool;
+    entry.disabled = paused;
+    entry.pauseRevision = randomUUID();
+    if (automatic) entry.pauseDetails = automatic.details;
+    else delete entry.pauseDetails;
+    if (paused && provider.apiKey === entry.key) {
+      const next = provider.apiKeyPool?.find(e => !e.disabled);
+      if (next) provider.apiKey = next.key;
+      else delete provider.apiKey;
+    } else if (!paused && !provider.apiKey) provider.apiKey = entry.key;
+    return { changed: true, selectionChanged: true, value: true };
+  });
+  return result.status === "committed" && result.value;
+}
diff --git a/src/providers/api-key-selection.ts b/src/providers/api-key-selection.ts
index 40eff2d49a9..27a4091b61d 100644
--- a/src/providers/api-key-selection.ts
+++ b/src/providers/api-key-selection.ts
@@ -19,7 +19,8 @@ function matchesSelection(provider: OcxProviderConfig, expected: ProviderApiKeyS
 
 function currentKeyProvider(config: OcxConfig, name: string): OcxProviderConfig | null {
   const configured = config.providers[name];
-  if (!configured || configured.disabled) return null;
+  if (!configured || configured.disabled || configured.apiKeyPool?.some(entry => entry.disabled && entry.key === configured.apiKey)
+    || configured.apiKeyPool?.length && configured.apiKeyPool.every(entry => entry.disabled)) return null;
   const current = routedProviderConfig(name, { ...configured, _apiKeyAttempt: undefined });
   if (current.authMode === "oauth" || current.authMode === "forward") return null;
   if (current.authMode === "key" && !current.keyOptional && !current.apiKey?.trim()) return null;
diff --git a/src/providers/api-keys.ts b/src/providers/api-keys.ts
index ceb5522df29..0683e970e6f 100644
--- a/src/providers/api-keys.ts
+++ b/src/providers/api-keys.ts
@@ -18,6 +18,8 @@ export interface ProviderApiKeyInfo extends AccountQuotaFields {
   /** First/last 4 chars only; env references (`${VAR}`) are shown verbatim (not secrets). */
   masked: string;
   active: boolean;
+  disabled?: boolean;
+  pauseDetails?: import("../types/account-auto-pause").AccountPauseDetails;
   addedAt?: number;
 }
 
@@ -66,7 +68,7 @@ export function listProviderApiKeys(config: OcxConfig, name: string): { activeId
   const pool = provider.apiKeyPool?.length
     ? provider.apiKeyPool
     : provider.apiKey ? [{ id: apiKeyPoolEntryId(provider.apiKey), key: provider.apiKey }] : [];
-  const activeId = (pool.find(entry => entry.key === provider.apiKey) ?? pool[0])?.id ?? null;
+  const activeId = pool.find(entry => entry.key === provider.apiKey)?.id ?? null;
   return {
     activeId,
     keys: pool.map(entry => ({
@@ -74,6 +76,8 @@ export function listProviderApiKeys(config: OcxConfig, name: string): { activeId
       ...(entry.label ? { label: entry.label } : {}),
       masked: maskApiKey(entry.key),
       active: entry.id === activeId,
+      ...(entry.disabled ? { disabled: true } : {}),
+      ...(entry.pauseDetails ? { pauseDetails: entry.pauseDetails } : {}),
       ...(entry.addedAt !== undefined ? { addedAt: entry.addedAt } : {}),
     })),
   };
@@ -95,7 +99,7 @@ export function addProviderApiKey(config: OcxConfig, name: string, key: string,
     } else {
       pool.push({ id, key: trimmed, ...(label?.trim() ? { label: label.trim() } : {}), addedAt: Date.now() });
     }
-    fresh.apiKey = trimmed;
+    if (!existing?.disabled) fresh.apiKey = trimmed;
     return { changed: true, selectionChanged: true, value: id };
   });
   return committed.status === "committed" ? { id } : { error: "provider selection unavailable" };
@@ -107,7 +111,7 @@ export function setActiveProviderApiKey(config: OcxConfig, name: string, id: str
     const entry = provider.apiKeyPool?.find(e => e.id === id)
       ?? (!provider.apiKeyPool?.length && provider.apiKey && apiKeyPoolEntryId(provider.apiKey) === id
         ? { id, key: provider.apiKey } : undefined);
-    if (!entry) return { changed: false, value: false };
+    if (!entry || entry.disabled) return { changed: false, value: false };
     ensurePool(provider);
     provider.apiKey = entry.key;
     return { changed: true, selectionChanged: true, value: true };
@@ -136,7 +140,7 @@ export function removeProviderApiKey(config: OcxConfig, name: string, id: string
     if (!entry) return { changed: false, value: false };
     provider.apiKeyPool = pool.filter(e => e.id !== id);
     if (provider.apiKey === entry.key) {
-      const next = provider.apiKeyPool[0];
+      const next = provider.apiKeyPool.find(candidate => !candidate.disabled);
       if (next) provider.apiKey = next.key;
       else delete provider.apiKey;
     }
diff --git a/src/providers/key-failover.ts b/src/providers/key-failover.ts
index 564f03e19e8..13f569a59de 100644
--- a/src/providers/key-failover.ts
+++ b/src/providers/key-failover.ts
@@ -507,9 +507,9 @@ export function selectProactiveApiKey(
 
   const activeEntry = pool.find(entry => entry.key === provider.apiKey);
   // A healthy committed key wins, whether the operator chose it or a previous rotation did.
-  if (activeEntry && !isKeyInCooldown(providerName, activeEntry.id, now)) return null;
+  if (activeEntry && !activeEntry.disabled && !isKeyInCooldown(providerName, activeEntry.id, now)) return null;
 
-  const eligible = pool.filter(entry => !isKeyInCooldown(providerName, entry.id, now));
+  const eligible = pool.filter(entry => !entry.disabled && !isKeyInCooldown(providerName, entry.id, now));
   if (eligible.length === 0) return null;
 
   let chosen = eligible[0]!;
@@ -518,7 +518,7 @@ export function selectProactiveApiKey(
     const lastIndex = lastId ? pool.findIndex(entry => entry.id === lastId) : -1;
     for (let offset = 1; offset <= pool.length; offset += 1) {
       const candidate = pool[(lastIndex + offset) % pool.length]!;
-      if (isKeyInCooldown(providerName, candidate.id, now)) continue;
+      if (candidate.disabled || isKeyInCooldown(providerName, candidate.id, now)) continue;
       chosen = candidate;
       break;
     }
@@ -532,11 +532,11 @@ export function selectProactiveApiKey(
   const outcome = commitProviderApiKeySelection<string | null>(config, providerName, freshProvider => {
     const freshPool = freshProvider.apiKeyPool ?? [];
     const target = freshPool.find(entry => entry.id === chosen.id);
-    if (!target) return { changed: false, value: null };
+    if (!target || target.disabled) return { changed: false, value: null };
     if (freshProvider.apiKey === target.key) return { changed: false, value: null };
     const freshActive = freshPool.find(entry => entry.key === freshProvider.apiKey);
     // Re-check under the lock: a concurrent manual selection may have landed a healthy key.
-    if (freshActive && !isKeyInCooldown(providerName, freshActive.id, now)) {
+    if (freshActive && !freshActive.disabled && !isKeyInCooldown(providerName, freshActive.id, now)) {
       return { changed: false, value: null };
     }
     freshProvider.apiKey = target.key;
@@ -731,7 +731,7 @@ function rotateKeyAfterFailure(
 
     if (freshProvider.apiKey !== failedKey) {
       const activeEntry = pool.find(entry => entry.key === freshProvider.apiKey);
-      if (activeEntry && !isKeyInCooldown(providerName, activeEntry.id, now)) {
+      if (activeEntry && !activeEntry.disabled && !isKeyInCooldown(providerName, activeEntry.id, now)) {
         return {
           changed: false,
           value: { failedId: failedEntry?.id },
@@ -743,7 +743,7 @@ function rotateKeyAfterFailure(
     const candidateCount = failedEntry ? pool.length - 1 : pool.length;
     for (let offset = 1; offset <= candidateCount; offset += 1) {
       const candidate = pool[(currentIndex + offset) % pool.length]!;
-      if (isKeyInCooldown(providerName, candidate.id, now)) continue;
+      if (candidate.disabled || isKeyInCooldown(providerName, candidate.id, now)) continue;
       freshProvider.apiKey = candidate.key;
       return {
         changed: true,
diff --git a/src/providers/model-rename-fields.ts b/src/providers/model-rename-fields.ts
index bba6fc99e91..6d8271faa6f 100644
--- a/src/providers/model-rename-fields.ts
+++ b/src/providers/model-rename-fields.ts
@@ -48,6 +48,7 @@ export const PROVIDER_MODEL_RENAME_ROLES = {
   apiKeyTransport: "none",
   apiKeyPool: "none",
   apiKeyPoolStrategy: "none",
+  accountAutoPause: "none",
   apiKeySelectionRevision: "none",
   _apiKeyAttempt: "none",
   defaultModel: "scalar",
diff --git a/src/server/auth-cors.ts b/src/server/auth-cors.ts
index 71f7d43d436..88d4d3d1e99 100644
--- a/src/server/auth-cors.ts
+++ b/src/server/auth-cors.ts
@@ -1076,6 +1076,7 @@ const PROVIDER_CONFIG_FIELD_POLICY = {
   apiKeyPool: "redacted",
   // Ordering preference only; it names no key material, so an editor may read and set it.
   apiKeyPoolStrategy: "editor",
+  accountAutoPause: "editor",
   apiKeySelectionRevision: "runtime",
   _apiKeyAttempt: "runtime",
   defaultModel: "editor",
diff --git a/src/server/chat-native.ts b/src/server/chat-native.ts
index cebac32464c..4e2036b6bea 100644
--- a/src/server/chat-native.ts
+++ b/src/server/chat-native.ts
@@ -1,3 +1,4 @@
+import { captureAccountAutoPauseAttempt, wasAccountAutoPaused } from "../oauth/account-auto-pause";
 import { createPhysicalSendReporter } from "../lib/request-execution-budget";
 import { createInferenceSendBudget } from "./inference/context";
 import { buildOpenAIChatPassthroughRequest, createOpenAIChatAdapter } from "../adapters/openai-chat";
@@ -423,7 +424,7 @@ export async function runNativeChatAttempt(
 
   const send = async (
     request: AdapterRequest,
-    recovery?: "rate-limit-429" | "key-429" | UpstreamSendRecovery,
+    recovery?: "rate-limit-429" | "key-401" | "key-429" | UpstreamSendRecovery,
     singleShot = false,
   ): Promise<Response> => {
     try {
@@ -478,6 +479,7 @@ export async function runNativeChatAttempt(
               const spendReport = createPhysicalSendReporter(physicalBudget, () => ({
                 poolId: logCtx.spendPoolId ?? route.providerName, identityId: logCtx.accountLogLabel,
               }), execution.comboDispatchPermit);
+              const observeAutoPause = captureAccountAutoPauseAttempt(route.providerName, activeProvider, { config, oauth: undefined }, headers);
               let dispatched: Response;
               try {
                 // Capture this request's spend policy at its first physical boundary, including
@@ -511,7 +513,7 @@ export async function runNativeChatAttempt(
                 finally { spendReport.close?.(); }
               }
               if (!dispatched.ok) await recordKeyAttemptFailure(logCtx, dispatched, init.signal ?? upstream.signal);
-              return dispatched;
+              return observeAutoPause ? observeAutoPause(dispatched) : dispatched;
             },
           }),
         );
@@ -544,6 +546,22 @@ export async function runNativeChatAttempt(
     response = await send(activeRequest);
     const retryPolicy = rateLimitRetryPolicyFor(activeProvider);
     let retries = 0;
+    let autoPauseMoves = 0;
+    for (;;) {
+      const priorResponse = response;
+    for (; wasAccountAutoPaused(response) && config.providers[route.providerName]?.apiKey && autoPauseMoves < 3 && transientSendAvailable(); autoPauseMoves++) {
+      const next = resolveCurrentProviderApiKeyTransport(config, route.providerName, activeProvider);
+      if (!next) break;
+      try { void response.body?.cancel().catch(() => {}); } catch { /* closed */ }
+      activeProvider = next;
+      stampApiKeyAccountLabel(logCtx, route.providerName, activeProvider);
+      activeAdapter = createOpenAIChatAdapter(activeProvider);
+      releaseRetainedRequest();
+      activeRequest = buildActiveRequest();
+      retainRequest(activeRequest);
+      response = await send(activeRequest, "key-401");
+    }
+
     while (
       response.status === 429
       // A 429 this proxy synthesized for a refused reset replay is not a provider rate
@@ -588,6 +606,10 @@ export async function runNativeChatAttempt(
       retainRequest(activeRequest);
       response = await send(activeRequest, "key-429");
     }
+      if (response !== priorResponse && wasAccountAutoPaused(response)) continue;
+      break;
+    }
+
   } catch (error) {
     releaseRetainedRequest();
     cleanupAbort();
diff --git a/src/server/management/oauth-account-routes.ts b/src/server/management/oauth-account-routes.ts
index 50c2cabb3c2..156d4a9a2ab 100644
--- a/src/server/management/oauth-account-routes.ts
+++ b/src/server/management/oauth-account-routes.ts
@@ -442,7 +442,7 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
               reauthReason: summary.needsReauth === true ? "refresh_failed" : undefined,
             });
           return { ...summary, ...oauthAccountHealthFields(provider, summary.id, health), quotaMode,
-            ...(supportsPause ? { paused: full?.paused === true } : {}),
+            ...(supportsPause ? { paused: full?.paused === true, ...(full?.pauseDetails ? { pauseDetails: full.pauseDetails } : {}) } : {}),
             ...(isAnthropicOAuthInstance(provider) && supportsPause ? { autoSwitchThresholdOverride: full?.autoSwitchThresholdOverride ?? null,
               effectiveAutoSwitchThreshold: effectiveAnthropicAccountThresholdForInstance(provider as AnthropicInstanceId, config, full),
               autoSwitchThreshold: effectiveAnthropicAccountThresholdForInstance(provider as AnthropicInstanceId, config) } : {}),
@@ -1043,6 +1043,14 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     clearProviderQuotaCache();
     return jsonResponse({ ...result, name, store: providerKeyStoreKind(config.providers[name]) });
   }
+  if (url.pathname === "/api/providers/keys/pause" && req.method === "PUT") {
+    const body = await readManagementJsonBodyOr(req, {}) as { name?: unknown; id?: unknown; paused?: unknown };
+    if (typeof body.name !== "string" || typeof body.id !== "string" || typeof body.paused !== "boolean") return jsonResponse({ error: "name, id and paused required" }, 400);
+    if (!isValidProviderName(body.name) || !hasOwnProvider(config.providers, body.name)) return jsonResponse({ error: "unknown provider" }, 404);
+    const { setProviderApiKeyPaused } = await import("../../providers/api-key-pause");
+    return setProviderApiKeyPaused(config, body.name, body.id, body.paused)
+      ? jsonResponse({ ok: true }) : jsonResponse({ error: "key not found" }, 404);
+  }
   if (url.pathname === "/api/providers/keys/active" && req.method === "PUT") {
     const body = await readManagementJsonBodyOr(req, {}) as { name?: string; id?: string };
     const name = (body.name ?? "").trim();
diff --git a/src/server/messages-native.ts b/src/server/messages-native.ts
index dab3432d8ba..43e8e93537d 100644
--- a/src/server/messages-native.ts
+++ b/src/server/messages-native.ts
@@ -1,3 +1,4 @@
+import { captureAccountAutoPauseAttempt, wasAccountAutoPaused } from "../oauth/account-auto-pause";
 import { createPhysicalSendReporter } from "../lib/request-execution-budget";
 import { createInferenceSendBudget } from "./inference/context";
 /**
@@ -579,6 +580,7 @@ export async function handleNativeMessages(options: HandleNativeMessagesOptions)
             }
             const releaseFamily = snapshot && oauthBinding ? anthropicModelQuotaFor(oauthBinding.instance).claimAnthropicFamilyRevalidation(snapshot.accountId, route.modelId) : () => {};
             if (!releaseFamily) throw new AnthropicAccountCooldownError(1);
+            const observeAutoPause = captureAccountAutoPauseAttempt(route.providerName, activeProvider, { config, oauth: sendingBinding?.snapshot }, headers);
             let dispatched: Response;
             const spendReport = createPhysicalSendReporter(physicalBudget, () => ({
               poolId: logCtx.spendPoolId ?? route.providerName, identityId: logCtx.accountLogLabel,
@@ -624,7 +626,7 @@ export async function handleNativeMessages(options: HandleNativeMessagesOptions)
               } catch { /* Passive observation must not fail the response. */ }
             }
             if (!dispatched.ok) await recordKeyAttemptFailure(logCtx, dispatched, init.signal ?? upstream.signal);
-            return dispatched;
+            return observeAutoPause ? observeAutoPause(dispatched) : dispatched;
           },
         }),
       ),
@@ -652,8 +654,17 @@ export async function handleNativeMessages(options: HandleNativeMessagesOptions)
     let billingRecoveryActive = false;
     const keySendAvailable = () => transientSendAvailable()
       && (!billingRecoveryActive || Math.max(physicalSendsUsed, physicalBudget.used) < physicalBudget.policy.maxTotalModelSends);
+    let autoPauseMoves = 0;
     for (;;) {
       const priorResponse = response;
+    for (; wasAccountAutoPaused(response) && !oauthBinding && config.providers[route.providerName]?.apiKey && autoPauseMoves < 3 && keySendAvailable(); autoPauseMoves++) {
+      const next = resolveCurrentProviderApiKeyTransport(config, route.providerName, activeProvider);
+      if (!next) break;
+      try { void response.body?.cancel().catch(() => {}); } catch { /* closed */ }
+      rebuildFor(next);
+      response = await send("key-401");
+    }
+
       // A credential-scoped 401 on a static key pool says nothing about the sibling keys.
       while (response.status === 401 && hasKeyPoolFailover(activeProvider) && keySendAvailable()) {
         const rotated = rotateProviderTransportOn401(config, route.providerName, activeProvider, {
@@ -707,7 +718,7 @@ export async function handleNativeMessages(options: HandleNativeMessagesOptions)
       }
       // A sibling's next refusal may change class; the same counters survive that transition.
       if (response !== priorResponse && (
-        (billingRecoveryActive && [401, 429].includes(response.status))
+        wasAccountAutoPaused(response) || (billingRecoveryActive && [401, 429].includes(response.status))
         || (activeProvider.adapter === "anthropic" && hasKeyPoolFailover(activeProvider) && [400, 402].includes(response.status))
       )) continue;
       break;
diff --git a/src/server/responses/account-auto-pause-recovery.ts b/src/server/responses/account-auto-pause-recovery.ts
new file mode 100644
index 00000000000..0bd39b64f8d
--- /dev/null
+++ b/src/server/responses/account-auto-pause-recovery.ts
@@ -0,0 +1,26 @@
+import type { ResponsesSendBudget } from "./request-send-budget";
+
+const moves = new WeakMap<object, number>();
+/** One same-provider credential move, funded by the existing recovery owner. */
+export async function recoverAutoPausedAccount<T>(options: {
+  requestKey: object;
+  remaining?: number;
+  reserve: ResponsesSendBudget["reserveCredentialHop"];
+  refresh: () => Promise<boolean>;
+  refetch: () => Promise<T>;
+  setPermit: (permit: ResponsesSendBudget["pendingHopPermit"]) => void;
+}): Promise<T | undefined> {
+  const count = moves.get(options.requestKey) ?? 0;
+  if (count >= 3 || options.remaining !== undefined && options.remaining <= 0) return;
+  const hop = options.reserve("auth-recovery", "account-auto-pause", true);
+  if (!hop.allowed) return;
+  try {
+    if (!await options.refresh()) return;
+    moves.set(options.requestKey, count + 1);
+    options.setPermit(hop.permit);
+    return await options.refetch();
+  } finally {
+    options.setPermit(undefined);
+    hop.permit?.release();
+  }
+}
diff --git a/src/server/responses/adapter-dispatch.ts b/src/server/responses/adapter-dispatch.ts
index 8c75b514d2c..934e271db59 100644
--- a/src/server/responses/adapter-dispatch.ts
+++ b/src/server/responses/adapter-dispatch.ts
@@ -1,3 +1,5 @@
+import { recoverAutoPausedAccount } from "./account-auto-pause-recovery";
+import { wasAccountAutoPaused, wasPermanentAccountRefusal } from "../../oauth/account-auto-pause";
 import { deferPhysicalSendReporter } from "./deferred-send-reporter";
 import { spendLedgerStorageErrorResponse } from "./spend-storage-error";
 import { classifyAnthropic429 } from "../../oauth/anthropic-rate-limit-policy";
@@ -139,6 +141,7 @@ export async function prepareAdapterExchange(
     | "sameTargetToken"
     | "transportToken"
     | "oauthDispatch"
+    | "recoverAutoPausedSelection"
     | "imageTierBias"
     | "oauth401ReplayAttempted"
     | "isOAuth401ReplayProvider"
@@ -392,11 +395,12 @@ export async function prepareAdapterExchange(
     upstreamResponse = new Response(text, { status: original.status, statusText: original.statusText, headers });
     return upstreamResponse;
   };
+  const autoPauseEnabled = config.providers[route.providerName]?.accountAutoPause?.enabled === true;
   const billingPoolRequest = isAnthropicBillingKeyPool(route.provider);
   let billingRecoveryActive = false;
   const genericRefetchCountsSends = () => sendBudgetState.adapterSendBudget?.spendEnforced === true
     || transientRetryPolicyFor(route.provider) !== null || resetReplayPolicyFor(route.provider) !== null
-    || billingPoolRequest || billingRecoveryActive;
+    || billingPoolRequest || billingRecoveryActive || autoPauseEnabled;
   let handoffPermit: ResponsesSendBudget["pendingHopPermit"];
   try {
     if (transportState.activeAdapter.fetchResponse) {
@@ -518,10 +522,10 @@ export async function prepareAdapterExchange(
           label: safeHostLabel(builtInitialRequest.url),
           claimAmbiguousResend: claimPreHeaderResend,
           ...(sendBudgetState.adapterSendBudget?.spendEnforced || options.comboDispatchPermit || transientPolicy || resetPolicy || compactPrepaid || options.comboAttempt
-            || billingPoolRequest
+            || billingPoolRequest || autoPauseEnabled
             ? {
               // A pending compaction permit already booked this leg's first physical send.
-              ...(transientPolicy || resetPolicy || compactPrepaid || options.comboAttempt
+              ...(transientPolicy || resetPolicy || compactPrepaid || options.comboAttempt || autoPauseEnabled
                 ? {
                   attempts: Math.min(initialSendCap,
                     sendBudgetState.initialSendAllowance(initialSendCap) + (compactPrepaid ? 1 : 0)),
@@ -913,6 +917,15 @@ export async function prepareAdapterExchange(
     };
    // Keep recovery kinds in sync with the native Responses `passthroughRecovery:` loop above.
    recovery: for (;;) {
+      if (wasAccountAutoPaused(upstreamResponse) && route.provider.authMode !== "forward") {
+        const recovered = await recoverAutoPausedAccount({ requestKey: transportState, reserve: reserveCredentialHop,
+          remaining: transientSendCapFor(transientRetryPolicyFor(route.provider)?.attempts, sendBudgetState.targetSendsUsed),
+          refresh: () => transportState.recoverAutoPausedSelection(parsed), refetch: () => rebuildAndRefetch("oauth-account-429"), setPermit: permit => { sendBudgetState.pendingHopPermit = permit; } });
+        if (!recovered) break;
+        if ("failed" in recovered) return recovered.failed;
+        upstreamResponse = recovered; continue recovery;
+      }
+
       // Preserve the terminal verdict through adapter and combo error formatting.
       // This also covers a reset reached by a 401/429/413 recovery refetch.
       if (isNonReplayableResponse(upstreamResponse)) {
@@ -921,7 +934,7 @@ export async function prepareAdapterExchange(
         } finally { cleanupUpstreamAbort(); }
       }
      if (
-       upstreamResponse.status === 401
+       upstreamResponse.status === 401 && !wasPermanentAccountRefusal(upstreamResponse)
        && isOAuth401ReplayProvider
         && transportState.sentOAuthSnapshot
         && !oauth401ReplayAttempted
@@ -1032,7 +1045,7 @@ export async function prepareAdapterExchange(
         continue recovery;
       }
 
-      if (route.providerName === "google-antigravity" && upstreamResponse.status === 401
+      if (route.providerName === "google-antigravity" && upstreamResponse.status === 401 && !wasPermanentAccountRefusal(upstreamResponse)
         && oauth401ReplayAttempted && !antigravityAuthRotationAttempted
         && !isNonReplayableResponse(upstreamResponse)) {
         antigravityAuthRotationAttempted = true;
diff --git a/src/server/responses/compact.ts b/src/server/responses/compact.ts
index c3c74102035..be1bd57cd5d 100644
--- a/src/server/responses/compact.ts
+++ b/src/server/responses/compact.ts
@@ -1,3 +1,4 @@
+import { wasAccountAutoPaused, wasPermanentAccountRefusal } from "../../oauth/account-auto-pause";
 import { spendLedgerStorageErrorResponse } from "./spend-storage-error";
 import { createPhysicalSendReporter } from "../../lib/request-execution-budget";
 import { createInferenceSendBudget } from "../inference/context";
@@ -1000,6 +1001,7 @@ export async function handleResponsesCompact(
       } = {},
     ) => {
       if (!usesCodexForwardPoolAuth(ctx, route.provider)) return;
+      if ((outcome === 401 || outcome === 403) && upstream && wasPermanentAccountRefusal(upstream)) return;
       recordCodexUpstreamOutcome(config, ctx.accountId, outcome, {
         ...meta,
         threadId: ctx.kind === "pool" || ctx.kind === "main-pool" ? ctx.affinityKey : undefined,
@@ -1076,6 +1078,7 @@ export async function handleResponsesCompact(
         providerFetch(sendProvider, undefined, {
           providerName: route.providerName,
           modelId: route.modelId,
+          accountAutoPause: { config, codex: sendAuthCtx },
           beforeDispatch: isCanonicalOpenAiForwardProvider(sendProvider)
             ? createCodexAuthDispatchGuard(sendAuthCtx, config, selectedModelId, admission) : undefined,
           ...(onPhysicalDispatch ? { onPhysicalDispatch } : {}),
@@ -1153,7 +1156,7 @@ export async function handleResponsesCompact(
     }
 
     if (
-      upstream.status === 401
+      upstream.status === 401 && !wasPermanentAccountRefusal(upstream)
       && (authCtx.kind === "main-pool" || authCtx.kind === "pool")
       && usesCodexForwardPoolAuth(authCtx, compactProvider)
       && !req.signal.aborted
@@ -1276,12 +1279,12 @@ export async function handleResponsesCompact(
     // surfaces to the client, which retries the compact task OUTSIDE the logical request
     // — reporting exhausted retries while another pool account sat idle (#913).
     if (
-      (upstream.status === 429 || upstream.status === 402)
+      (upstream.status === 429 || upstream.status === 402 || wasAccountAutoPaused(upstream))
       // A replay refusal this proxy synthesized carries 429 for the client's benefit only.
       // It is not pool quota evidence, and the alternate account below is another send of a
       // compact turn that may already have been processed.
       && !isNonReplayableResponse(upstream)
-      && !storedPool401ReplayAttempted
+      && (!storedPool401ReplayAttempted || wasAccountAutoPaused(upstream))
       && usesCodexForwardPoolAuth(authCtx, route.provider)
       && !authCtx.fixedAccount
       && route.codexAccountMode
@@ -1385,7 +1388,7 @@ export async function handleResponsesCompact(
     // the same guards as the quota move, and a 5xx whose body confirms quota keeps today's path.
     if (
       shouldRetryCodexPoolAccountTransient(upstream)
-      && !storedPool401ReplayAttempted
+      && (!storedPool401ReplayAttempted || wasAccountAutoPaused(upstream))
       && usesCodexForwardPoolAuth(authCtx, route.provider)
       && !authCtx.fixedAccount
       && route.codexAccountMode
@@ -1497,7 +1500,7 @@ export async function handleResponsesCompact(
       inspectResponseLogJson(logCtx, await buffered.clone().text());
       if (!options.compactionRoutingOverride) forgetCompactHandoffRoute(req, admission);
       rememberServingConversationStateIssuer(outcomeCtx, codexPoolAffinityKey(req.headers));
-    } else if (!options.compactionRoutingOverride && quotaFailure && !storedPool401ReplayAttempted) {
+    } else if (!options.compactionRoutingOverride && quotaFailure && (!storedPool401ReplayAttempted || wasAccountAutoPaused(upstream))) {
       const fallbackModel = compactHandoffRoute(req, admission, raw.model);
       if (fallbackModel && !req.signal.aborted) {
         const fallbackReq = new Request(req.url, {
diff --git a/src/server/responses/core-codex-account.ts b/src/server/responses/core-codex-account.ts
index 17071ba24d2..bbd85a7eca1 100644
--- a/src/server/responses/core-codex-account.ts
+++ b/src/server/responses/core-codex-account.ts
@@ -1,3 +1,4 @@
+import { wasPermanentAccountRefusal } from "../../oauth/account-auto-pause";
 import type { OcxConfig, OcxProviderConfig, OcxParsedRequest } from "../../types";
 import type { CodexAuthContext, CodexAuthPolicyConfig } from "../../codex/auth-context";
 import type { CodexUpstreamOutcome } from "../../codex/routing";
@@ -143,7 +144,7 @@ export function recordCodexPreOutputRefusalOutcome(
   modelId: string,
 ): void {
   if (!isCodexWsPreOutputRefusal(response) || codexWsPreOutputRefusalOutcomeRecorded(response)) return;
-  if (!usesCodexForwardPoolAuth(authCtx, provider)) return;
+  if (!usesCodexForwardPoolAuth(authCtx, provider) || wasPermanentAccountRefusal(response)) return;
   noteCodexWsPreOutputRefusalOutcome(response);
   recordCodexUpstreamOutcome(config, authCtx.accountId, response.status, {
     threadId: authCtx.affinityKey,
@@ -854,6 +855,10 @@ export async function retryCodexPoolOnAlternateAccount(
     options.deferCodexResetDerivedCooldown,
   );
   const recordFirstOutcome = (): void => {
+    if (wasPermanentAccountRefusal(firstResponse)) {
+      noteCodexWsPreOutputRefusalOutcome(firstResponse);
+      return;
+    }
     recordCodexUpstreamOutcome(config, firstAuthCtx.accountId, outcomeStatus, {
       ...quotaMeta,
       threadId: firstAuthCtx.affinityKey,
@@ -1022,6 +1027,7 @@ export async function retryCodexPoolOnAlternateAccount(
             providerName: route.providerName,
             modelId: route.modelId,
             preOutputRefusalHold: args.preOutputRefusalHold,
+            accountAutoPause: { config, codex: retryAuthCtx },
             onCodexWsQuota: codexWsQuotaObserver(retryAuthCtx, route.provider, route.modelId),
             beforeDispatch: isCanonicalOpenAiForwardProvider(route.provider)
               ? createCodexAuthDispatchGuard(retryAuthCtx, options.codexAuthPolicy ?? config, route.modelId, options.admission, options.visionDescribeTerminal === true) : undefined,
diff --git a/src/server/responses/fetch-helpers.ts b/src/server/responses/fetch-helpers.ts
index 1781ea19694..6ab4dfc7f22 100644
--- a/src/server/responses/fetch-helpers.ts
+++ b/src/server/responses/fetch-helpers.ts
@@ -1,3 +1,4 @@
+import { captureAccountAutoPauseAttempt, type AccountAutoPauseBinding } from "../../oauth/account-auto-pause";
 import type { NativeResponseControl } from "./native-response-control";
 import type { CodexWsPreOutputRefusalHold } from "./codex-ws-wire";
 import type { Server } from "bun";
@@ -223,6 +224,7 @@ export function sendWithConnectionPolicy(
 }
 
 export interface ProviderFetchOptions {
+  accountAutoPause?: AccountAutoPauseBinding;
   /**
    * Keep this send on HTTP even where the WebSocket upstream would normally be selected.
    *
@@ -337,7 +339,7 @@ export function providerFetch(
   // ChatGPT Codex backend: streaming turns ride the responses_websockets
   // transport (measured ~3s faster TTFT than the SSE POST queue); everything
   // else keeps the provider's HTTP fetch. See ws-upstream.ts for the details.
-  const unpaced = async (input: Parameters<typeof globalThis.fetch>[0], init?: RequestInit) => {
+  const unobserved = async (input: Parameters<typeof globalThis.fetch>[0], init?: RequestInit) => {
     const upstreamWebsocket = provider.upstreamWebsocket;
     if (!options.httpOnly && typeof input === "string" && init
       && shouldUseCodexWsUpstream(input, init, runtime, upstreamWebsocket)) {
@@ -371,6 +373,12 @@ export function providerFetch(
     }
     return httpFetch(input, init);
   };
+  const unpaced = async (input: Parameters<typeof globalThis.fetch>[0], init?: RequestInit) => {
+    const observe = captureAccountAutoPauseAttempt(providerName, provider, options.accountAutoPause,
+      new Headers(init?.headers ?? (input instanceof Request ? input.headers : undefined)));
+    const response = await unobserved(input, init);
+    return observe ? observe(response) : response;
+  };
   let pacingSlotAcquired = options.pacingSlotAcquired === true;
   const waitForPacing = async (signal?: AbortSignal): Promise<ProviderRequestSlot | undefined> => {
     if (pacingSlotAcquired) {
diff --git a/src/server/responses/passthrough-delivery.ts b/src/server/responses/passthrough-delivery.ts
index 25d4531c1ac..961f4a54adb 100644
--- a/src/server/responses/passthrough-delivery.ts
+++ b/src/server/responses/passthrough-delivery.ts
@@ -1,3 +1,4 @@
+import { wasPermanentAccountRefusal } from "../../oauth/account-auto-pause";
 import { isNativeControlResponse } from "./native-response-control";
 import { createOutboundCredentialMask, createTerminalErrorRedactionBlockRewrite } from "./terminal-error-redaction";
 import type { ResponsesRequestContext, ResponsesAdmissionState } from "./core-options";
@@ -526,7 +527,7 @@ export async function deliverPassthroughResponse(
       } else if (!shouldDeferCodexResetDerivedCooldown(
         upstreamResponse,
         options.deferCodexResetDerivedCooldown,
-      ) && !isReplayRefusalResponse(upstreamResponse)) {
+      ) && !isReplayRefusalResponse(upstreamResponse) && !wasPermanentAccountRefusal(upstreamResponse)) {
         // A refusal this proxy made is not evidence about the account. Recording it would
         // classify the synthetic 429 as quota exhaustion and write a default cooldown against
         // a credential the request may never have reached, and that false signal outlives the
@@ -571,7 +572,7 @@ export async function deliverPassthroughResponse(
     // through sanitizePassthroughHeaders) so a redirect to a dead host can never
     // masquerade as a pre-connection failure after the credential was seen.
     // The numeric outcome above already classified it neutral — no streak.
-    if (isNonReplayableResponse(upstreamResponse) && !isReplayRefusalResponse(upstreamResponse)) {
+    if (isNonReplayableResponse(upstreamResponse) && !isReplayRefusalResponse(upstreamResponse) && !wasPermanentAccountRefusal(upstreamResponse)) {
       return await sanitizeNonReplayableUpstreamError(upstreamResponse, upstream.signal);
     }
     if (upstreamResponse.status >= 300 && upstreamResponse.status < 400) {
diff --git a/src/server/responses/passthrough-dispatch.ts b/src/server/responses/passthrough-dispatch.ts
index 58a1d8be395..6a241088014 100644
--- a/src/server/responses/passthrough-dispatch.ts
+++ b/src/server/responses/passthrough-dispatch.ts
@@ -1,3 +1,5 @@
+import { recoverAutoPausedAccount } from "./account-auto-pause-recovery";
+import { adoptCodexWsStage, capturePassthroughAffinity } from "./passthrough-observations";
 import { spendLedgerStorageErrorResponse } from "./spend-storage-error";
 import { createSteeringSettingsNormalizer } from "./native-steering-policy";
 import { nativeResponseControlEligible } from "./native-response-control";
@@ -97,7 +99,6 @@ import {
   upstreamHostCircuitOpenResponse,
   usesCodexForwardPoolAuth,
   codexWsQuotaObserver,
-  isFixedCodexAccount,
   codexPoolAccountModel400Denial,
   shouldRetryCodexPoolAccountQuota,
   shouldRetryCodexPoolAccountTransient,
@@ -109,7 +110,7 @@ import {
   clearCodexModelDenialEvidence,
   recordCodexModelDenialEvidence,
 } from "../../codex/model-entitlements";
-import { codexWsSocketDeathStage, isCodexWsUpstreamResponse, readCodexWsStage } from "./codex-ws-wire";
+import { codexWsSocketDeathStage, isCodexWsUpstreamResponse } from "./codex-ws-wire";
 import { linkAbortSignal } from "./core-lifetime";
 import type { CodexAuthContext } from "../../codex/auth-context";
 import { checkOutboundBodySize, describeOutboundBodyRefusal } from "./outbound-body-guard";
@@ -128,6 +129,7 @@ import {
 } from "../../lib/upstream-retry";
 import { mapCodexAuthContextErrorToResponse } from "./codex-auth-error";
 import { classifyTransportFailureKind, transportErrorCode } from "../../lib/upstream-reachability";
+import { wasAccountAutoPaused, wasPermanentAccountRefusal } from "../../oauth/account-auto-pause";
 import { recordCodexUpstreamOutcome } from "../../codex/routing";
 import { describeUpstreamConnectFailure } from "./upstream-error";
 import type { OpaqueBlobRecoveryGuard } from "./core-opaque-recovery";
@@ -150,7 +152,6 @@ import {
   rotateGenericOAuthAccountOn429,
   failoverAccountSnapshot,
 } from "../../oauth/generic-account-failover";
-import { captureCodexAffinityDiagnostic } from "../../codex/affinity-debug";
 import { ACCOUNT_GATED_NATIVE_OPENAI_MODELS } from "../../codex/catalog/native-models";
 import {
   attemptOpaqueBlobRecovery,
@@ -199,6 +200,7 @@ export async function preparePassthroughExchange(
     | "genericFailoverAccountId"
     | "passiveQuotaWriterGeneration"
     | "oauthDispatch"
+    | "recoverAutoPausedSelection"
     | "resolveSelectionAdapter"
     | "resolveCopilotSelection"
     | "copilotRefusalResponse"
@@ -731,20 +733,9 @@ export async function preparePassthroughExchange(
       }
       nativeHostState.lease = null;
     };
-    /**
-     * #4191: a Codex WS exchange pins its content-free stage record on the
-     * Response it resolves (markCodexWsStage). Adopting the record here, at
-     * the single funnel every physical upstream response passes through,
-     * binds it to the attempt that actually served it — including the 502/504
-     * pre-response JSON settles that never reach the SSE relay.
-     */
-    const adoptCodexWsStage = (response: Response): void => {
-      const stage = readCodexWsStage(response);
-      if (stage && logCtx.activeAttempt) logCtx.activeAttempt.codexWsStage = stage;
-    };
     const adoptObservedResponse = <T extends Response>(response: T): T => {
       settleObservedHostResponse();
-      adoptCodexWsStage(response);
+      adoptCodexWsStage(response, logCtx);
       return response;
     };
     let passthroughEstimate = typeof request.usageLog?.inputTokens === "number"
@@ -1047,6 +1038,7 @@ export async function preparePassthroughExchange(
               providerName: route.providerName,
               modelId: route.modelId,
               onPhysicalDispatch: receiptMode ? sendBudgetState.noteInitialDispatch : undefined,
+              accountAutoPause: { config, codex: admissionState.authCtx },
               onCodexWsQuota: codexWsQuotaObserver(admissionState.authCtx, route.provider, route.modelId),
               beforeDispatch: isCanonicalOpenAiForwardProvider(route.provider)
                 ? createCodexAuthDispatchGuard(admissionState.authCtx, options.codexAuthPolicy ?? config, route.modelId, options.admission, options.visionDescribeTerminal === true) : undefined,
@@ -1184,6 +1176,7 @@ export async function preparePassthroughExchange(
                 dispatchOverride: oauthDispatch(request, parsed, "passthrough"),
                 providerName: route.providerName,
                 modelId: route.modelId,
+                accountAutoPause: { config, codex: admissionState.authCtx },
                 onCodexWsQuota: codexWsQuotaObserver(admissionState.authCtx, route.provider, route.modelId),
                 beforeDispatch: isCanonicalOpenAiForwardProvider(route.provider)
                   ? createCodexAuthDispatchGuard(admissionState.authCtx, options.codexAuthPolicy ?? config, route.modelId, options.admission, options.visionDescribeTerminal === true) : undefined,
@@ -1206,9 +1199,18 @@ export async function preparePassthroughExchange(
 
     // Keep recovery kinds in sync with the generic `recovery:` loop below.
     passthroughRecovery: for (;;) {
+      if (wasAccountAutoPaused(upstreamResponse) && route.provider.authMode !== "forward") {
+        const recovered = await recoverAutoPausedAccount({ requestKey: transportState, reserve: reserveCredentialHop,
+          remaining: transientSendCapFor(transientRetryPolicyFor(route.provider)?.attempts, sendBudgetState.targetSendsUsed),
+          refresh: () => transportState.recoverAutoPausedSelection(parsed), refetch: () => rebuildAndRefetch("oauth-account-429"), setPermit: permit => { sendBudgetState.pendingHopPermit = permit; } });
+        if (!recovered) break;
+        if ("failed" in recovered) return recovered.failed;
+        upstreamResponse = recovered; continue passthroughRecovery;
+      }
+
 
     if (
-      upstreamResponse.status === 401
+      upstreamResponse.status === 401 && !wasPermanentAccountRefusal(upstreamResponse)
       && (admissionState.authCtx.kind === "main-pool" || admissionState.authCtx.kind === "pool")
       && usesCodexForwardPoolAuth(admissionState.authCtx, route.provider)
       && codex401ReplayKind === null
@@ -1291,6 +1293,7 @@ export async function preparePassthroughExchange(
             dispatchOverride: oauthDispatch(request, parsed, "passthrough"),
             providerName: route.providerName,
             modelId: route.modelId,
+            accountAutoPause: { config, codex: admissionState.authCtx },
             onCodexWsQuota: codexWsQuotaObserver(admissionState.authCtx, route.provider, route.modelId),
             beforeDispatch: headers => {
               replayGuard?.(headers);
@@ -1334,14 +1337,14 @@ export async function preparePassthroughExchange(
       continue passthroughRecovery;
     }
 
-    if (codex401ReplayKind !== null && upstreamResponse.status === 401) break;
+    if (codex401ReplayKind !== null && upstreamResponse.status === 401 && !wasPermanentAccountRefusal(upstreamResponse)) break;
 
     // Native Responses providers return before the generic adapter recovery loop below. Keep
     // their OAuth contract identical: one pre-stream 401 forces a credential refresh and one
     // rebuilt replay. xAI's current subscription models use this branch now that their official
     // Grok CLI catalog declares the Responses backend.
     if (
-      upstreamResponse.status === 401
+      upstreamResponse.status === 401 && !wasPermanentAccountRefusal(upstreamResponse)
       && isOAuth401ReplayProvider
       && transportState.sentOAuthSnapshot
       && !oauth401ReplayAttempted
@@ -1436,6 +1439,7 @@ export async function preparePassthroughExchange(
                 dispatchOverride: oauthDispatch(request, parsed, "passthrough"),
                 providerName: route.providerName,
                 modelId: route.modelId,
+                accountAutoPause: { config, codex: admissionState.authCtx },
                 onCodexWsQuota: codexWsQuotaObserver(admissionState.authCtx, route.provider, route.modelId),
                 beforeDispatch: isCanonicalOpenAiForwardProvider(route.provider)
                   ? createCodexAuthDispatchGuard(admissionState.authCtx, options.codexAuthPolicy ?? config, route.modelId, options.admission, options.visionDescribeTerminal === true) : undefined,
@@ -1583,6 +1587,7 @@ export async function preparePassthroughExchange(
                 dispatchOverride: oauthDispatch(request, parsed, "passthrough"),
                 providerName: route.providerName,
                 modelId: route.modelId,
+                accountAutoPause: { config, codex: admissionState.authCtx },
                 onCodexWsQuota: codexWsQuotaObserver(admissionState.authCtx, route.provider, route.modelId),
                 beforeDispatch: isCanonicalOpenAiForwardProvider(route.provider)
                   ? createCodexAuthDispatchGuard(admissionState.authCtx, options.codexAuthPolicy ?? config, route.modelId, options.admission, options.visionDescribeTerminal === true) : undefined,
@@ -1606,18 +1611,7 @@ export async function preparePassthroughExchange(
         || captureAuthCtx.kind === "pool"
         || captureAuthCtx.kind === "main-pool",
     ): void => {
-      if (!isCanonicalOpenAiForwardProvider(route.provider)) return;
-      captureCodexAffinityDiagnostic({
-        inboundHeaders: req.headers,
-        outboundHeaders: captureRequest.headers,
-        authKind: captureAuthCtx.kind,
-        accountMode: route.codexAccountMode,
-        fixedAccount: isFixedCodexAccount(captureAuthCtx),
-        credentialSubstituted,
-        accountGatedModel: ACCOUNT_GATED_NATIVE_OPENAI_MODELS.has(route.modelId),
-        wireModelNormalized: parsed.modelId !== route.modelId,
-        status: response.status,
-      });
+      capturePassthroughAffinity(response, req.headers, captureRequest.headers, captureAuthCtx, route, parsed.modelId, credentialSubstituted);
     };
     captureAffinityResponse(upstreamResponse);
 
@@ -1644,7 +1638,9 @@ export async function preparePassthroughExchange(
         options.abortSignal,
         parsed.modelId,
       );
-      if (model400Denial !== undefined) {
+      if (wasAccountAutoPaused(upstreamResponse)) {
+        poolRetryOutcome = upstreamResponse.status;
+      } else if (model400Denial !== undefined) {
         // Spend this refusal on more than one retry. It is the account's own authenticated
         // answer about this model, and the roster cache that selection otherwise reads expires
         // five minutes after a catalog sync fills it -- so without remembering this, the next
@@ -1677,7 +1673,7 @@ export async function preparePassthroughExchange(
         // ladder does have one — retrying the account the refreshed roster still grants — and
         // keeps it. An earlier revision also broke here on a non-400 outcome, which no test could
         // justify because this flag already produced the identical result.
-        const storedReplaySpent = codex401ReplayKind === "stored";
+        const storedReplaySpent = codex401ReplayKind === "stored" && !wasAccountAutoPaused(upstreamResponse);
         const retry = await retryCodexPoolOnAlternateAccount({
           callerAuthHeaders,
           config,
@@ -1696,7 +1692,7 @@ export async function preparePassthroughExchange(
           httpOnly: canonicalBufferedJson,
           preOutputRefusalHold: preOutputRefusalHold(),
           onResponse: (response, retryAuthCtx, retryRequest) => {
-            adoptCodexWsStage(response);
+            adoptCodexWsStage(response, logCtx);
             captureAffinityResponse(
               response,
               retryAuthCtx,
diff --git a/src/server/responses/passthrough-observations.ts b/src/server/responses/passthrough-observations.ts
new file mode 100644
index 00000000000..993501423fc
--- /dev/null
+++ b/src/server/responses/passthrough-observations.ts
@@ -0,0 +1,38 @@
+import { readCodexWsStage } from "./codex-ws-wire";
+import type { RequestLogContext } from "../request-log";
+
+/**
+ * #4191: a Codex WS exchange pins its content-free stage record on the
+ * Response it resolves (markCodexWsStage). Adopting the record here, at
+ * the single funnel every physical upstream response passes through,
+ * binds it to the attempt that actually served it — including the 502/504
+ * pre-response JSON settles that never reach the SSE relay.
+ */
+export function adoptCodexWsStage(response: Response, logCtx: RequestLogContext): void {
+  const stage = readCodexWsStage(response);
+  if (stage && logCtx.activeAttempt) logCtx.activeAttempt.codexWsStage = stage;
+}
+
+import type { CodexAuthContext } from "../../codex/auth-context";
+import type { RouteResult } from "../../router";
+import { captureCodexAffinityDiagnostic } from "../../codex/affinity-debug";
+import { ACCOUNT_GATED_NATIVE_OPENAI_MODELS } from "../../codex/catalog/native-models";
+import { isCanonicalOpenAiForwardProvider } from "../../providers/openai-tiers";
+import { isFixedCodexAccount } from "./core-codex-account";
+
+export function capturePassthroughAffinity(response: Response, inboundHeaders: Headers, outboundHeaders: Record<string, string>,
+  captureAuthCtx: CodexAuthContext, route: Pick<RouteResult, "provider" | "modelId" | "codexAccountMode">,
+  parsedModelId: string, credentialSubstituted: boolean): void {
+  if (!isCanonicalOpenAiForwardProvider(route.provider)) return;
+  captureCodexAffinityDiagnostic({
+    inboundHeaders: inboundHeaders,
+    outboundHeaders: outboundHeaders,
+    authKind: captureAuthCtx.kind,
+    accountMode: route.codexAccountMode,
+    fixedAccount: isFixedCodexAccount(captureAuthCtx),
+    credentialSubstituted,
+    accountGatedModel: ACCOUNT_GATED_NATIVE_OPENAI_MODELS.has(route.modelId),
+    wireModelNormalized: parsedModelId !== route.modelId,
+    status: response.status,
+  });
+}
diff --git a/src/server/responses/request-transport.ts b/src/server/responses/request-transport.ts
index 1b6cb6f4c44..bea305dd4fb 100644
--- a/src/server/responses/request-transport.ts
+++ b/src/server/responses/request-transport.ts
@@ -77,6 +77,7 @@ import { formatErrorResponse } from "../../bridge";
 import { bindRouteReasoningReplayScope } from "./core-replay";
 import { sessionIdHeaderFromRequest, normalizeLogConversationId } from "../request-log-conversation";
 import { redactSecretString } from "../../lib/redact";
+import { captureAccountAutoPauseAttempt } from "../../oauth/account-auto-pause";
 import { selectProactiveApiKeyTransport } from "../../providers/key-failover";
 import { isCanonicalOpenAiForwardProvider } from "../../providers/openai-tiers";
 import { providerConsumesCallerAuthorization } from "../../providers/caller-authorization";
@@ -587,6 +588,10 @@ export async function prepareResponsesTransport(
       // Pacing may outlive admission. Preserve local pause/cooldown reasons even when
       // a strict route rejects the old proposal before another bearer can be resolved.
       let candidate = servingOAuthSnapshot;
+      if (anthropicInstance === undefined && candidate && getAccountSet(route.providerName)?.accounts.find(row => row.id === candidate!.accountId)?.paused) {
+        oauthSelection = captureOAuthAccountSelection(route.providerName);
+        candidate = oauthSelection ? await getValidAccessSnapshotForAccount(route.providerName, oauthSelection.accountId, { requireUsableAccount: true }) : undefined;
+      }
       if (anthropicInstance !== undefined) {
         oauthSelection = captureOAuthAccountSelection(route.providerName);
         const accountId = await anthropicRouting!.resolveAnthropicDispatchAccountId(config, anthropicSessionKey, anthropicRouteDecision, route.modelId);
@@ -608,6 +613,15 @@ export async function prepareResponsesTransport(
     invalidateSameTargetRequest();
     return adapter;
   };
+  const recoverAutoPausedSelection = async (requestParsed: OcxParsedRequest): Promise<boolean> => {
+    if (route.provider.authMode === "forward") return false;
+    const available = route.provider.authMode === "oauth"
+      ? getAccountSet(route.providerName)?.accounts.some(row => !row.paused && !row.needsReauth)
+      : !!config.providers[route.providerName]?.apiKey;
+    if (!available) return false;
+    await refreshDispatchAdapter(requestParsed);
+    return true;
+  };
   const refreshRunTurnAdapter = async (requestParsed: OcxParsedRequest): Promise<ProviderAdapter> => {
     requestParsed._cursorIdentityScope = undefined;
     requestParsed._cursorConversationId = undefined;
@@ -642,6 +656,7 @@ export async function prepareResponsesTransport(
           providerName: route.providerName, modelId: route.modelId, pacingSlotAcquired: true,
           pacingSlot: attemptSlot,
           turnScopedPacing: true,
+          accountAutoPause: { config, oauth: binding?.kind === "oauth" ? binding.snapshot : undefined },
           beforeDispatch: () => {
             if (sent) return;
             if (!selectionIsCurrent(binding)) {
@@ -696,6 +711,8 @@ export async function prepareResponsesTransport(
           // apply a host-scoped decision to a different host.
           const releaseFamily = snapshot ? anthropicQuota!.claimAnthropicFamilyRevalidation(snapshot.accountId, route.modelId) : () => {};
           if (!releaseFamily) throw new AnthropicAccountCooldownError(1);
+          const observeAutoPause = captureAccountAutoPauseAttempt(route.providerName, binding?.kind === "api-key" ? binding.provider : route.provider,
+            { config, oauth: binding?.kind === "oauth" ? binding.snapshot : undefined }, new Headers(dispatchInit.headers));
           let response: Response;
           let physicalOwner: AnthropicPhysicalSendOwnership | null = null;
           try {
@@ -735,6 +752,7 @@ export async function prepareResponsesTransport(
             } catch { /* best-effort observation cannot fail the response */ }
           }
           if (!response.ok) await recordKeyAttemptFailure(logCtx, response, dispatchInit.signal ?? options.abortSignal);
+          if (observeAutoPause) response = await observeAutoPause(response);
           return response;
         }
         let nextAdapter: ProviderAdapter;
@@ -1203,6 +1221,7 @@ export async function prepareResponsesTransport(
     oauthDispatch,
     noteRoutedAttemptSend,
     commitKeyAttemptSend,
+    recoverAutoPausedSelection,
     bindKeyUsageFromBridge,
     anthropicSessionKey,
     isPassthrough,
diff --git a/src/types/account-auto-pause.ts b/src/types/account-auto-pause.ts
new file mode 100644
index 00000000000..001c66aebfa
--- /dev/null
+++ b/src/types/account-auto-pause.ts
@@ -0,0 +1,15 @@
+export const ACCOUNT_PAUSE_REASONS = [
+  "oauth_organization_disabled", "account_permission_denied", "subscription_inactive",
+  "subscription_expired", "plan_downgraded",
+] as const;
+export type AccountPauseReason = typeof ACCOUNT_PAUSE_REASONS[number];
+export interface AccountPauseDetails {
+  reason: AccountPauseReason;
+  pausedAt: number;
+}
+export interface AccountAutoPausePolicy {
+  /** Explicit opt-in. Omitted and false both leave account eligibility unchanged. */
+  enabled?: boolean;
+  /** Consecutive permanent refusals; defaults to 2. */
+  consecutiveFailures?: number;
+}
diff --git a/src/types/config.ts b/src/types/config.ts
index 9b56063c760..da342088838 100644
--- a/src/types/config.ts
+++ b/src/types/config.ts
@@ -1063,6 +1063,7 @@ export interface OcxConfig {
   codexAccounts?: CodexAccount[];
   /** Account ids administratively excluded from future pool selection until resumed. */
   pausedCodexAccountIds?: string[];
+  codexAccountPauseState?: Record<string, { revision: string; details?: import("./account-auto-pause").AccountPauseDetails }>;
   /**
    * Account ids, `__main__` included, allowed to keep serving from ChatGPT credits once one of
    * their usage windows is full. Every other account is skipped by selection at 100% until its
diff --git a/src/types/provider.ts b/src/types/provider.ts
index a06e907a420..b0c7fae40a7 100644
--- a/src/types/provider.ts
+++ b/src/types/provider.ts
@@ -1,4 +1,5 @@
 import type { UpstreamHttpVersion, ReasoningSummaryDelivery, CodexAccountMode } from "./wire";
+import type { AccountAutoPausePolicy, AccountPauseDetails } from "./account-auto-pause";
 import type { AnthropicAccountPoolConfig } from "./anthropic-account-pool";
 
 /**
@@ -543,7 +544,9 @@ export interface OcxProviderConfig {
    * entry so routing stays single-key; managed via /api/providers/keys. A legacy bare
    * `apiKey` seeds a one-entry pool on first management touch.
    */
-  apiKeyPool?: Array<{ id: string; key: string; label?: string; addedAt?: number }>;
+  apiKeyPool?: Array<{ id: string; key: string; label?: string; addedAt?: number; disabled?: boolean; pauseDetails?: AccountPauseDetails; pauseRevision?: string }>;
+  /** Explicit opt-in permanent account refusal policy; default off. */
+  accountAutoPause?: AccountAutoPausePolicy;
   /**
    * Optional proactive ordering for `apiKeyPool` when the committed key is already
    * cooling. Deliberately NOT named like the OAuth `accountPoolStrategy`: an API key
diff --git a/structure/INDEX.md b/structure/INDEX.md
index 0942d50a14a..b81ea7a678d 100644
--- a/structure/INDEX.md
+++ b/structure/INDEX.md
@@ -33,6 +33,7 @@ Persisted config, the Codex home it writes into, and the model catalog it publis
 | [`subagents.md`](subagents.md) | Multi-agent surface mode and subagent roster ordering. |
 | [`advisor.md`](advisor.md) | The OpenCodex-owned expert consultation sidecar: synthetic advisor tool, preflight policy, loopback consultation through the routing authority, and the optional-subsystem seam. |
 | [`config-proxy.md`](config-proxy.md) | Global proxy activation, start flags, and credential-safe CLI output. |
+| [`account-auto-pause.md`](account-auto-pause.md) | Opt-in permanent account refusal classification, credential fences, durable pause metadata, bounded recovery and resume. |
 
 ### Tier 3 — Data planes and transports
 
@@ -172,18 +173,22 @@ A source area can be described by more than one doc, because these docs are orga
 | `src/integrations/` | [`clients/integrations.md`](clients/integrations.md)<br>[`clients/qoder.md`](clients/qoder.md) |
 | `src/lab/` | [`runtime.md`](runtime.md)<br>[`adapters/compatibility-lab.md`](adapters/compatibility-lab.md) |
 | `src/lib/` | [`overview.md`](overview.md)<br>[`runtime.md`](runtime.md)<br>[`transports/byte-accounting.md`](transports/byte-accounting.md)<br>[`transports/responses-wire-shapes.md`](transports/responses-wire-shapes.md)<br>[`transports/responses-failover.md`](transports/responses-failover.md)<br>[`transports/responses-spend.md`](transports/responses-spend.md)<br>[`transports/inventory.md`](transports/inventory.md)<br>[`gui-and-management-api.md`](gui-and-management-api.md)<br>[`dashboard-and-usage.md`](dashboard-and-usage.md)<br>[`clients/integrations.md`](clients/integrations.md)<br>[`ops/service-and-sidecars.md`](ops/service-and-sidecars.md)<br>[`ops/docs-and-release.md`](ops/docs-and-release.md) |
+| `src/lib/account-auto-pause-response.ts` | [`account-auto-pause.md`](account-auto-pause.md) |
 | `src/lib/advisor-activation.ts` | [`advisor.md`](advisor.md) |
 | `src/lib/gui-pair-intent.ts` | [`remote-link.md`](remote-link.md) |
 | `src/lib/windows-owner-acl.ts` | [`remote-link.md`](remote-link.md) |
 | `src/link/` | [`remote-link.md`](remote-link.md) |
 | `src/messaging/` | [`local-messaging.md`](local-messaging.md) |
 | `src/oauth/` | [`runtime.md`](runtime.md)<br>[`transports/inventory.md`](transports/inventory.md)<br>[`providers/anthropic-account-thresholds.md`](providers/anthropic-account-thresholds.md)<br>[`providers-and-adapters.md`](providers-and-adapters.md)<br>[`providers/anthropic-account-pool.md`](providers/anthropic-account-pool.md)<br>[`providers/xai-grok.md`](providers/xai-grok.md) |
+| `src/oauth/account-auto-pause-policy.ts` | [`account-auto-pause.md`](account-auto-pause.md) |
+| `src/oauth/account-auto-pause.ts` | [`account-auto-pause.md`](account-auto-pause.md) |
 | `src/plugins/` | [`ops/plugins.md`](ops/plugins.md) |
 | `src/protocols/` | [`data-planes/protocol-paths.md`](data-planes/protocol-paths.md) |
 | `src/providers/` | [`runtime.md`](runtime.md)<br>[`subagents.md`](subagents.md)<br>[`transports/inventory.md`](transports/inventory.md)<br>[`providers-and-adapters.md`](providers-and-adapters.md)<br>[`providers/anthropic-account-pool.md`](providers/anthropic-account-pool.md)<br>[`providers/xai-grok.md`](providers/xai-grok.md) |
 | `src/providers/anthropic-billing-ownership.ts` | [`providers/anthropic-key-billing.md`](providers/anthropic-key-billing.md) |
 | `src/providers/anthropic-billing-recovery.ts` | [`providers/anthropic-key-billing.md`](providers/anthropic-key-billing.md) |
 | `src/providers/anthropic-billing-refusal.ts` | [`providers/anthropic-key-billing.md`](providers/anthropic-key-billing.md) |
+| `src/providers/api-key-pause.ts` | [`account-auto-pause.md`](account-auto-pause.md) |
 | `src/providers/quota/anthropic-account-quota.ts` | [`providers/anthropic-account-pool.md`](providers/anthropic-account-pool.md) |
 | `src/providers/request-pacing.ts` | [`providers/anthropic-key-billing.md`](providers/anthropic-key-billing.md) |
 | `src/quota/` | [`dashboard-and-usage.md`](dashboard-and-usage.md) |
@@ -218,6 +223,7 @@ A source area can be described by more than one doc, because these docs are orga
 | `src/tray/` | [`runtime.md`](runtime.md) |
 | `src/types.ts` | [`runtime.md`](runtime.md)<br>[`config.md`](config.md) |
 | `src/types/` | [`providers-and-adapters.md`](providers-and-adapters.md) |
+| `src/types/account-auto-pause.ts` | [`account-auto-pause.md`](account-auto-pause.md) |
 | `src/update/` | [`runtime.md`](runtime.md)<br>[`ops/service-and-sidecars.md`](ops/service-and-sidecars.md) |
 | `src/update/job-supervised-restart.ts` | [`ops/update-supervised-recovery.md`](ops/update-supervised-recovery.md) |
 | `src/update/job.ts` | [`ops/update-supervised-recovery.md`](ops/update-supervised-recovery.md) |
diff --git a/structure/account-auto-pause.md b/structure/account-auto-pause.md
new file mode 100644
index 00000000000..927d2f44e8f
--- /dev/null
+++ b/structure/account-auto-pause.md
@@ -0,0 +1,71 @@
+# Account Auto-Pause
+
+Opt-in policy, credential ownership, durable pause metadata, and bounded recovery for
+permanent account refusals. Counters are process-local; persisted pauses require explicit resume.
+
+## Opt-in account refusal observation
+
+`src/server/responses/fetch-helpers.ts` accepts an optional account binding for physical
+Codex/runTurn response observation. OAuth/key HTTP overrides capture after reselection in
+`src/server/responses/request-transport.ts`; native Chat/Messages capture at their send
+boundaries. `src/oauth/account-auto-pause.ts` is dormant unless the named provider explicitly
+enables the policy, writes only fixed pause metadata, and preserves upstream responses if
+optional persistence fails. Counters and asynchronous decisions belong to the runtime
+config object; completed pauses belong to the existing durable account stores.
+
+## Permanent account refusal policy
+
+`providers.<name>.accountAutoPause` is optional, default off, with an integer
+`consecutiveFailures` in 1–100 (default 2). `src/config/schema/account-auto-pause.ts` validates
+the policy and allowlisted reason/timestamp DTO. OAuth pause metadata is stored with the
+auth row; Codex metadata/revision fences use `codexAccountPauseState`; key pools retain
+`disabled`, `pauseDetails` and `pauseRevision` per entry. Runtime counters are process-local.
+Manual resume clears details and changes the revision, fencing already-sent refusals.
+
+## Opt-in permanent refusal recovery
+
+`src/server/responses/request-transport.ts` observes exact physical account outcomes before
+retry wrappers replace the response. Threshold-triggered OAuth/key pauses rebuild the
+request through `src/server/responses/account-auto-pause-recovery.ts` and the existing selection owner, with at most three account moves funded by the existing recovery owner.
+`src/server/responses/passthrough-dispatch.ts` and
+`src/server/responses/core-codex-account.ts` admit a confirmed Codex auto-pause to the
+existing alternate-account ladder without reclassifying subscription refusal as a dead
+credential. `src/server/responses/compact.ts` observes the same pool contexts. Fixed
+account selectors and uploaded-file constraints continue to suppress alternate moves.
+
+## Permanent account refusal auto-pause
+
+`src/oauth/account-auto-pause.ts` captures the exact sending OAuth snapshot, Codex context
+or API-key selection and validates outgoing credential headers before observing a response.
+`src/oauth/account-auto-pause-policy.ts` recognizes whole account-scoped 401/403 messages,
+serializes response-arrival decisions, resets on accepted HTTP responses, and excludes
+transient/quota/model/request failures. No provider body or account identifier enters its log.
+The opt-in counter defaults to two refusals; each process owns its counters. Durable pause
+uses `setAccountPaused`, `setCodexAccountPaused`, or
+`src/providers/api-key-pause.ts`; resume changes an incarnation fence and clears the reason.
+API-key selectors and reactive/proactive failover exclude disabled pool entries.
+Regression coverage: `tests/oauth/oauth-account-auto-pause.test.ts` and
+`tests/responses/responses-account-auto-pause.test.ts`.
+
+## Auto-paused account recovery
+
+OAuth and Codex account-list DTOs project optional `pauseDetails` (fixed reason plus epoch
+ms timestamp) beside the existing pause flag. The CLI preserves those fields and includes
+the reason in account listings. `src/server/management/oauth-account-routes.ts` also serves
+`PUT /api/providers/keys/pause` with provider `name`, key `id` and boolean `paused`, through
+the existing management authorization boundary. Key listings expose `disabled` and pause
+details. Dashboard key Resume clears the pause through that endpoint before activating
+the key; OAuth/Codex keep their existing resume actions.
+
+## Permanent refusal pause indicators
+
+`gui/src/components/provider-workspace/ProviderAuthPanel.tsx` and
+`gui/src/components/codex-account-pool-cards.tsx` expose fixed auto-pause reason and timestamp
+on Paused badges. Disabled key rows offer Resume through their existing selection action;
+`gui/src/hooks/useProviderAccountPools.ts` resumes before activation, then refreshes the
+roster under its existing selection-mutation fence. No upstream error body is displayed.
+
+`src/lib/account-auto-pause-response.ts` retains process-local pause/refusal markers when
+adapter error normalization replaces a response, without exposing metadata in HTTP headers.
+
+`src/types/account-auto-pause.ts` owns the policy and fixed pause-reason DTO vocabulary.
diff --git a/structure/config.md b/structure/config.md
index f803d408c5c..27bde8f6e4a 100644
--- a/structure/config.md
+++ b/structure/config.md
@@ -24,7 +24,7 @@ Native main reauthentication follows the [CLI JSON output contract](runtime.md#n
 The Codex restart command follows the [CLI restart scope contract](runtime.md#cli-codex-restart-scope).
 
 `src/cli/account-orca-import.ts` exposes an explicit-source, preview-first local import command. Apply adds pool configuration under the shared mutation lock;
-the [source-owned credential contract](codex-home.md#orca-source-owned-account-import) governs deduplication and credential storage separately from Codex config injection.
+the [source-owned credential contract](codex-home.md#orca-source-owned-account-import) governs deduplication and credential storage separately from Codex config injection. See [permanent refusal auto-pause](account-auto-pause.md).
 
 ## Config surface
 
diff --git a/structure/dashboard-and-usage.md b/structure/dashboard-and-usage.md
index 3cbebeb3a11..aa0ee46c9fb 100644
--- a/structure/dashboard-and-usage.md
+++ b/structure/dashboard-and-usage.md
@@ -13,7 +13,7 @@ Codex quota cards consume the display cache from `src/codex/quota.ts`. Partial r
 omitted short tuples after their reset deadline; validated main-window absence also removes
 future-reset short tuples. Main-account hard-lock evidence and reset-notification history follow
 separate retention rules in
-[OpenAI account modes](providers/openai-tiers.md#quota-cache-and-short-window-history).
+[OpenAI account modes](providers/openai-tiers.md#quota-cache-and-short-window-history). See [permanent refusal auto-pause](account-auto-pause.md).
 Codex account panels expose no Spark quota toggle or setting and retain quota refresh, pause/resume, selection order, reset-credit confirmation and Advanced settings; account/provider quota DTOs suppress retired windows upstream of the generic quota renderer, under [OpenAI quota scopes](providers/openai-tiers.md#public-provider-contract).
 
 ## Dashboard surfaces
diff --git a/structure/gui-and-management-api.md b/structure/gui-and-management-api.md
index 961a55f07ed..85bcb33ae5c 100644
--- a/structure/gui-and-management-api.md
+++ b/structure/gui-and-management-api.md
@@ -4,7 +4,7 @@ Anthropic OAuth account DTOs include `autoSwitchThresholdOverride` (integer or n
 `autoSwitchThreshold` (pool default) and `effectiveAutoSwitchThreshold`. The dedicated
 `PUT /api/oauth/accounts/auto-switch` accepts `{ provider: "anthropic", accountId, threshold }`;
 explicit null restores inheritance and missing/invalid values fail. Other providers are rejected.
-`src/server/management/anthropic-account-threshold.ts` validates; the auth store serializes writes.
+`src/server/management/anthropic-account-threshold.ts` validates; the auth store serializes writes. See [permanent refusal auto-pause](account-auto-pause.md).
 CLI `ocx account auto-switch anthropic` requires `--account <id>` with status, inherit, on, off or
 threshold. The dashboard reuses `AccountAutoSwitchControl` below account actions, retaining
 focus/draft semantics and translated copy. The hook protects same-provider selection mutations
diff --git a/structure/manifest.json b/structure/manifest.json
index 5176735ae24..032b4a6772a 100644
--- a/structure/manifest.json
+++ b/structure/manifest.json
@@ -766,6 +766,19 @@
       "documents": [
         "tests/"
       ]
+    },
+    {
+      "path": "account-auto-pause.md",
+      "tier": 2,
+      "title": "Account Auto-Pause",
+      "scope": "Opt-in permanent account refusal classification, credential fences, durable pause metadata, bounded recovery and resume.",
+      "documents": [
+        "src/oauth/account-auto-pause.ts",
+        "src/oauth/account-auto-pause-policy.ts",
+        "src/providers/api-key-pause.ts",
+        "src/types/account-auto-pause.ts",
+        "src/lib/account-auto-pause-response.ts"
+      ]
     }
   ],
   "contracts": {
diff --git a/structure/providers-and-adapters.md b/structure/providers-and-adapters.md
index c522806f375..d9b0b9a83f3 100644
--- a/structure/providers-and-adapters.md
+++ b/structure/providers-and-adapters.md
@@ -6,7 +6,7 @@ Anthropic account pause, model routes, quota labels, and the separate `anthropic
 
 API-key credit-balance refusals follow the [Anthropic billing recovery contract](providers/anthropic-key-billing.md). Managed native Anthropic serving UUID and observed CLI header continuity follow [native Messages](data-planes/protocol-paths.md#managed-native-messages); generated Responses retain the adapter's compatibility fingerprint.
 
-Per-account usage thresholds follow the [Anthropic account thresholds contract](providers/anthropic-account-thresholds.md).
+Per-account usage thresholds follow the [Anthropic account thresholds contract](providers/anthropic-account-thresholds.md). See [permanent refusal auto-pause](account-auto-pause.md).
 A shared-quota Anthropic 429 or classified pre-output account 403 records the served account's cooldown even when the request has used its allowed retry sends. That final account remains excluded on the next request; combo target cooling for 429 is skipped only after the matching account cooldown is present. Exact revoked-token 401s persist generation-fenced reauthentication under [the Anthropic recovery contract](providers/anthropic-account-pool.md#revoked-oauth-access-token-recovery).
 
 The Anthropic helper sends share the same routing authority: `getAnthropicSidecarAccessToken` resolves the vision-describe and web-search sidecars' helper model through the same first-match route decision, so a routed send authenticates as the route's own account rather than whatever pool account happens to be active. A strict route with no eligible account fails the helper locally instead of silently falling back to the active outsider, matching the primary-traffic contract; callers without a pool config keep the plain stored-credential path.
diff --git a/structure/providers/anthropic-account-pool.md b/structure/providers/anthropic-account-pool.md
index cf0c0b9ba8e..34783937fe2 100644
--- a/structure/providers/anthropic-account-pool.md
+++ b/structure/providers/anthropic-account-pool.md
@@ -450,3 +450,12 @@ updating live state. A confirmed published write followed by bookkeeping failure
 pool and returns a fixed warning; an unpublished failure keeps old state. Unknown outcomes require
 reload and are not represented as a successful save. The GUI checkbox is a saved preference rather
 than a promise that a route is eligible; explicit rollout opt-outs still apply.
+
+## Permanent refusal auto-pause
+
+The separate `providers.<instance>.accountAutoPause` policy is default off. Physical
+Responses and native Messages sends observe their captured bearer before recovery. Exact
+organization/OAuth or subscription refusals can persist `pauseDetails` with a fixed reason
+and timestamp through `src/oauth/store.ts`. `pauseRevision` changes on resume, so late
+pre-resume responses cannot pause the resumed account. The existing selectors rebuild an
+eligible sibling within their send budgets; proactive-pool activation is not required.
diff --git a/structure/providers/openai-accounts.md b/structure/providers/openai-accounts.md
index af23cc1d3a3..05210953ccf 100644
--- a/structure/providers/openai-accounts.md
+++ b/structure/providers/openai-accounts.md
@@ -568,3 +568,14 @@ replacement drops that window's warning. Main/all quota cleanup forgets the base
 expire at reset or six hours after detection. Main-card/settings DTOs and live CLI projections expose
 only window kind, previous/current percentage and observation time; the notice says possible usage
 outside opencodex because a long-running request can also explain the rise.
+
+## Permanent refusal auto-pause
+
+The opt-in `providers.openai.accountAutoPause` observer in
+`src/oauth/account-auto-pause.ts` uses the sent pool credential generation or main quota
+writer, not the active account at response time. It persists exclusions in
+`pausedCodexAccountIds` with revision/reason/time in `codexAccountPauseState`, clears
+affinities and reconciles selection. `src/codex/account-pause.ts` changes the revision
+on resume. The physical guard in `src/codex/auth-context.ts` also rejects newly paused
+queued sends. Confirmed permanent refusals preserve credentials instead of forcing token
+refresh; threshold-triggered retries retain fixed-selector, file and send-budget guards.
diff --git a/structure/runtime.md b/structure/runtime.md
index 2a31215cb52..b590adaf357 100644
--- a/structure/runtime.md
+++ b/structure/runtime.md
@@ -114,7 +114,7 @@ config write or process control occurs. Existing Windows `check` retains zero ca
 filesystem I/O. A reported refusal can exit 0; consumers inspect `status`.
 
 The local account CLI and pool credential resolver share the [Orca source-owned import contract](codex-home.md#orca-source-owned-account-import): importing
-does not perform OAuth, and runtime credential resolution rereads the owned source.
+does not perform OAuth, and runtime credential resolution rereads the owned source. See [permanent refusal auto-pause](account-auto-pause.md).
 
 ## Entrypoints
 
diff --git a/structure/transports/responses-failover.md b/structure/transports/responses-failover.md
index 535ffb4c842..d6665770c0d 100644
--- a/structure/transports/responses-failover.md
+++ b/structure/transports/responses-failover.md
@@ -130,7 +130,7 @@ Native account-gated model selection maps no grant to 400, temporary capable-acc
 429/402 carrying only `x-codex-*-reset-at` may advance to the later model on the same account. The
 failed physical combo target still enters its normal target cooldown. An explicit `Retry-After`
 remains an account-wide instruction and blocks the later target; a quota response with neither an
-explicit retry delay nor a usable reset timestamp keeps the conservative default account cooldown.
+explicit retry delay nor a usable reset timestamp keeps the conservative default account cooldown. See [permanent refusal auto-pause](../account-auto-pause.md).
 This exception is request-scoped and is not applied to direct requests, round-robin combos, or a
 combo whose remaining eligible targets use other providers.
 
diff --git a/tests/fixtures/test-layout-expected.json b/tests/fixtures/test-layout-expected.json
index 210221f4d50..f81f262f6e2 100644
--- a/tests/fixtures/test-layout-expected.json
+++ b/tests/fixtures/test-layout-expected.json
@@ -1,5 +1,5 @@
 {
-  "codex-history-pending-wal.test.ts": "codex-integration",
+  "responses-account-auto-pause.test.ts": "responses", "oauth-account-auto-pause.test.ts": "oauth", "codex-history-pending-wal.test.ts": "codex-integration",
   "service-log.test.ts": "service",
   "service-health-sentinel-policy.test.ts": "service",
   "service-health-sentinel-runner.test.ts": "service",
diff --git a/tests/oauth/oauth-account-auto-pause.test.ts b/tests/oauth/oauth-account-auto-pause.test.ts
new file mode 100644
index 00000000000..6f1befca9ce
--- /dev/null
+++ b/tests/oauth/oauth-account-auto-pause.test.ts
@@ -0,0 +1,278 @@
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { mkdtempSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { getDefaultConfig, loadConfig, saveConfig } from "../../src/config";
+import { captureAccountAutoPauseAttempt, wasAccountAutoPaused } from "../../src/oauth/account-auto-pause";
+import { AccountRefusalStreaks, autoPauseThreshold, classifyPermanentAccountRefusal, permanentAccountRefusal } from "../../src/oauth/account-auto-pause-policy";
+import { getValidAccessSnapshotForAccount, OAuthAccountPausedError } from "../../src/oauth";
+import { getAccountSet, saveCredential, setAccountPaused, setActiveAccount } from "../../src/oauth/store";
+import { routedProviderConfig } from "../../src/router";
+import { listProviderApiKeys } from "../../src/providers/api-keys";
+import { setProviderApiKeyPaused } from "../../src/providers/api-key-pause";
+import { rotateKeyOn401 } from "../../src/providers/key-failover";
+import { saveCodexAccountCredential } from "../../src/codex/account-store";
+import { setCodexAccountPaused } from "../../src/codex/account-pause";
+import { configSchema } from "../../src/config/schema/config-schema";
+import type { OcxConfig } from "../../src/types";
+import { removeTreeWithRetry } from "../helpers/remove-tree";
+
+const orgMessage = "OAuth authentication is currently not allowed for this organization";
+const payload = (message = orgMessage, type = "permission_error") => ({ error: { type, message } });
+const refusal = (status = 403) => Response.json(payload(), { status });
+const oldHome = process.env.OPENCODEX_HOME;
+let home: string;
+beforeEach(() => { home = mkdtempSync(join(tmpdir(), "ocx-auto-pause-")); process.env.OPENCODEX_HOME = home; });
+afterEach(() => {
+  if (oldHome === undefined) delete process.env.OPENCODEX_HOME; else process.env.OPENCODEX_HOME = oldHome;
+  removeTreeWithRetry(home);
+});
+function configFor(name: string, mode: "oauth" | "key" | "forward" = "oauth"): OcxConfig {
+  const config = getDefaultConfig();
+  config.providers = { [name]: { adapter: "openai-chat", baseUrl: "https://example.test/v1", authMode: mode,
+    accountAutoPause: { enabled: true } } };
+  config.defaultProvider = name;
+  return config;
+}
+async function oauthFixture(name = "command-code") {
+  const config = configFor(name);
+  for (let n = 0; n < 2; n++) await saveCredential(name, {
+    access: `synthetic-access-${n}`, refresh: `synthetic-refresh-${n}`,
+    expires: Date.now() + 3_600_000, accountId: `synthetic-${n}`, source: "oauth",
+  });
+  const ids = getAccountSet(name)!.accounts.map(a => a.id);
+  await setActiveAccount(name, ids[0]!);
+  saveConfig(config);
+  const snapshot = await getValidAccessSnapshotForAccount(name, ids[0]!);
+  const capture = () => captureAccountAutoPauseAttempt(name, config.providers[name]!, { config, oauth: snapshot },
+    new Headers({ authorization: `Bearer ${snapshot.accessToken}` }))!;
+  return { config, ids, snapshot, capture };
+}
+
+describe("permanent account refusal classification", () => {
+  for (const [message, expected] of [
+    [orgMessage, "oauth_organization_disabled"],
+    ["Your subscription has expired.", "subscription_expired"],
+    ["Your Claude subscription is inactive", "subscription_inactive"],
+    ["Your account does not have an active subscription", "subscription_inactive"],
+    ["Your plan was downgraded to free with no credits", "plan_downgraded"],
+    ["Your account does not have access to Claude Code", "account_permission_denied"],
+  ] as const) {
+    test(expected + ": exact 401/403 only", () => {
+      expect(classifyPermanentAccountRefusal(403, payload(message))).toBe(expected);
+      expect(classifyPermanentAccountRefusal(401, payload(message))).toBe(expected);
+      for (const status of [200, 400, 402, 429, 500, 503]) expect(classifyPermanentAccountRefusal(status, payload(message))).toBeUndefined();
+    });
+  }
+  test("model, request, quota, malformed and quoted errors grant no account authority", () => {
+    for (const message of ["You do not have access to this model", "Your quota resets tomorrow", "Your access token has expired", `Diagnostic: ${orgMessage}`, `Model says: Your subscription is inactive`]) {
+      expect(classifyPermanentAccountRefusal(403, payload(message))).toBeUndefined();
+    }
+    expect(classifyPermanentAccountRefusal(403, { error: { ...payload().error, code: "model_not_found" } })).toBeUndefined();
+    for (const value of [null, [], {}, { error: orgMessage }]) expect(classifyPermanentAccountRefusal(403, value)).toBeUndefined();
+  });
+  test("bounded reader preserves original and refuses malformed/oversized data", async () => {
+    const response = refusal();
+    expect(await permanentAccountRefusal(response)).toBe("oauth_organization_disabled");
+    expect(await response.json()).toEqual(payload());
+    expect(await permanentAccountRefusal(new Response("not json", { status: 403 }))).toBeUndefined();
+    expect(await permanentAccountRefusal(new Response("x".repeat(20_000), { status: 403 }))).toBeUndefined();
+  });
+  test("default off, default threshold two, strict schema", () => {
+    expect(autoPauseThreshold(undefined)).toBeUndefined();
+    expect(autoPauseThreshold({ enabled: false })).toBeUndefined();
+    expect(autoPauseThreshold({ enabled: true })).toBe(2);
+    for (const n of [0, -1, 1.5, 101]) expect(autoPauseThreshold({ enabled: true, consecutiveFailures: n })).toBeUndefined();
+    const config = configFor("fixture");
+    expect(configSchema.safeParse(config).success).toBe(true);
+    config.providers.fixture!.accountAutoPause!.consecutiveFailures = 0;
+    expect(configSchema.safeParse(config).success).toBe(false);
+  });
+});
+
+test("concurrent refusals pause once; response-arrival order serializes slow verdicts and success", async () => {
+  const tracker = new AccountRefusalStreaks();
+  let pauses = 0;
+  const pause = async () => { pauses++; return true; };
+  let resolve!: (value: "subscription_expired") => void;
+  const first = tracker.observe("fixture", "login", 2, new Promise(r => { resolve = r; }), false, () => true, pause);
+  const success = tracker.observe("fixture", "login", 2, Promise.resolve(undefined), true, () => true, pause);
+  const third = tracker.observe("fixture", "login", 2, Promise.resolve("subscription_expired"), false, () => true, pause);
+  resolve("subscription_expired");
+  await Promise.all([first, success, third]);
+  expect(pauses).toBe(0);
+  await Promise.all(Array.from({ length: 8 }, () => tracker.observe("fixture", "login", 2, Promise.resolve("subscription_expired"), false, () => true, pause)));
+  expect(pauses).toBe(1);
+});
+
+test("OAuth threshold, transient neutrality, stored reason, skip and manual resume", async () => {
+  const f = await oauthFixture();
+  await f.capture()(refusal());
+  expect(getAccountSet("command-code")!.accounts[0]!.paused).not.toBe(true);
+  await f.capture()(refusal(429));
+  const stale = f.capture();
+  const response = await f.capture()(refusal());
+  expect(wasAccountAutoPaused(response)).toBe(true);
+  const set = getAccountSet("command-code")!;
+  expect(set.accounts[0]!.pauseDetails?.reason).toBe("oauth_organization_disabled");
+  expect(set.accounts[0]!.pauseDetails?.pausedAt).toBeGreaterThan(0);
+  expect(set.activeAccountId).toBe(f.ids[1]!);
+  await expect(getValidAccessSnapshotForAccount("command-code", f.ids[0]!)).rejects.toBeInstanceOf(OAuthAccountPausedError);
+  await setAccountPaused("command-code", f.ids[0]!, false);
+  expect(getAccountSet("command-code")!.accounts[0]!.pauseDetails).toBeUndefined();
+  await stale(refusal()); // old pre-resume capture is fenced out
+  expect(getAccountSet("command-code")!.accounts[0]!.paused).not.toBe(true);
+});
+
+test("success resets, default-off and wrong credential headers do nothing", async () => {
+  const f = await oauthFixture();
+  await f.capture()(refusal());
+  await f.capture()(new Response("ok"));
+  await f.capture()(refusal());
+  expect(getAccountSet("command-code")!.accounts[0]!.paused).not.toBe(true);
+  f.config.providers["command-code"]!.accountAutoPause = undefined;
+  expect(f.capture()).toBeUndefined();
+  f.config.providers["command-code"]!.accountAutoPause = { enabled: true };
+  expect(captureAccountAutoPauseAttempt("command-code", f.config.providers["command-code"]!, { config: f.config, oauth: f.snapshot }, new Headers({ authorization: "Bearer synthetic-other" }))).toBeUndefined();
+});
+
+test("key pool pause persists disabled, rotates and resumes; later failover skips disabled entries", async () => {
+  const config = configFor("fixture", "key");
+  const provider = config.providers.fixture!;
+  provider.apiKey = "synthetic-A";
+  provider.apiKeyPool = ["A", "B", "C"].map(id => ({ id, key: `synthetic-${id}` }));
+  saveConfig(config);
+  const routed = routedProviderConfig("fixture", provider);
+  const capture = () => captureAccountAutoPauseAttempt("fixture", routed, { config }, new Headers({ authorization: `Bearer ${routed.apiKey}` }))!;
+  await capture()(refusal());
+  await capture()(refusal());
+  expect(config.providers.fixture!.apiKeyPool![0]!.disabled).toBe(true);
+  expect(loadConfig().providers.fixture!.apiKeyPool![0]!.pauseDetails?.reason).toBe("oauth_organization_disabled");
+  expect(config.providers.fixture!.apiKey).toBe("synthetic-B");
+  expect(rotateKeyOn401(config, "fixture", Date.now(), "synthetic-B")?.apiKey).toBe("synthetic-C");
+  expect(rotateKeyOn401(config, "fixture", Date.now(), "synthetic-C")).toBeNull();
+  expect(setProviderApiKeyPaused(config, "fixture", "A", false)).toBe(true);
+  expect(listProviderApiKeys(config, "fixture").keys[0]!.pauseDetails).toBeUndefined();
+});
+
+test("Codex pool uses persistent pause ids, generation fence and resume metadata", async () => {
+  const config = configFor("openai", "forward");
+  config.codexAccounts = [{ id: "fixture", email: "", isMain: false }];
+  const generation = saveCodexAccountCredential("fixture", { accessToken: "synthetic-access", refreshToken: "synthetic-refresh", expiresAt: Date.now() + 3_600_000, chatgptAccountId: "synthetic" });
+  saveConfig(config);
+  const codex = { kind: "pool" as const, accountId: "fixture", generation, writerGeneration: 0, accessToken: "synthetic-access", chatgptAccountId: "synthetic" };
+  const capture = () => captureAccountAutoPauseAttempt("openai", config.providers.openai!, { config, codex }, new Headers({ authorization: "Bearer synthetic-access" }))!;
+  await capture()(refusal());
+  await capture()(refusal());
+  expect(config.pausedCodexAccountIds).toContain("fixture");
+  expect(loadConfig().pausedCodexAccountIds).toContain("fixture");
+  expect(config.codexAccountPauseState?.fixture?.details?.reason).toBe("oauth_organization_disabled");
+  setCodexAccountPaused(config, "fixture", false);
+  expect(config.codexAccountPauseState?.fixture?.details).toBeUndefined();
+});
+
+test("single scalar key materializes a resumable paused pool row", async () => {
+  const config = configFor("fixture", "key");
+  config.providers.fixture!.apiKey = "synthetic-single";
+  config.providers.fixture!.accountAutoPause!.consecutiveFailures = 1;
+  saveConfig(config);
+  const provider = routedProviderConfig("fixture", config.providers.fixture!);
+  const observe = captureAccountAutoPauseAttempt("fixture", provider, { config }, new Headers({ authorization: `Bearer ${provider.apiKey}` }))!;
+  await observe(refusal());
+  const entry = config.providers.fixture!.apiKeyPool![0]!;
+  expect(entry.disabled).toBe(true);
+  expect(config.providers.fixture!.apiKey).toBeUndefined();
+  expect(setProviderApiKeyPaused(config, "fixture", entry.id, false)).toBe(true);
+  expect(config.providers.fixture!.apiKey).toBe("synthetic-single");
+});
+
+test("replacing an environment-backed secret fences the old response", async () => {
+  const previous = process.env.OCX_AUTO_PAUSE_FIXTURE_KEY;
+  try {
+    process.env.OCX_AUTO_PAUSE_FIXTURE_KEY = "synthetic-old";
+    const config = configFor("fixture", "key");
+    config.providers.fixture!.apiKey = "$OCX_AUTO_PAUSE_FIXTURE_KEY";
+    config.providers.fixture!.apiKeyPool = [{ id: "fixture", key: "$OCX_AUTO_PAUSE_FIXTURE_KEY" }];
+    config.providers.fixture!.accountAutoPause!.consecutiveFailures = 1;
+    saveConfig(config);
+    const provider = routedProviderConfig("fixture", config.providers.fixture!);
+    const observe = captureAccountAutoPauseAttempt("fixture", provider, { config }, new Headers({ authorization: `Bearer ${provider.apiKey}` }))!;
+    process.env.OCX_AUTO_PAUSE_FIXTURE_KEY = "synthetic-new";
+    await observe(refusal());
+    expect(config.providers.fixture!.apiKeyPool![0]!.disabled).not.toBe(true);
+  } finally {
+    if (previous === undefined) delete process.env.OCX_AUTO_PAUSE_FIXTURE_KEY; else process.env.OCX_AUTO_PAUSE_FIXTURE_KEY = previous;
+  }
+});
+
+test("same-identity main credential replacement fences a delayed refusal", async () => {
+  const { observeMainQuotaCredential, observeMainQuotaIdentity } = await import("../../src/codex/main-account-cache");
+  const { captureConfigGeneration } = await import("../../src/lib/state-store-sweeper");
+  const config = configFor("openai", "forward");
+  config.providers.openai!.accountAutoPause!.consecutiveFailures = 1;
+  observeMainQuotaIdentity("synthetic-main");
+  const writer = observeMainQuotaCredential("synthetic-old", "synthetic-main")!;
+  saveConfig(config);
+  const observe = captureAccountAutoPauseAttempt("openai", config.providers.openai!, { config,
+    codex: { kind: "main-pool", accountId: "__main__", writerGeneration: captureConfigGeneration(), mainQuotaWriter: writer, accessToken: "synthetic-old", chatgptAccountId: "synthetic-main" },
+  }, new Headers({ authorization: "Bearer synthetic-old" }))!;
+  observeMainQuotaCredential("synthetic-new", "synthetic-main");
+  await observe(refusal());
+  expect(config.pausedCodexAccountIds).toBeUndefined();
+});
+
+test("an async OAuth pause cannot commit after policy opt-out", async () => {
+  const f = await oauthFixture();
+  let enabled = true;
+  const row = getAccountSet("command-code")!.accounts[0]!;
+  const pending = setAccountPaused("command-code", row.id, true, { generation: f.snapshot.generation, pauseRevision: row.pauseRevision,
+    details: { reason: "subscription_expired", pausedAt: Date.now() }, isCurrent: () => enabled });
+  enabled = false;
+  await expect(pending).rejects.toThrow("policy changed");
+  expect(getAccountSet("command-code")!.accounts[0]!.paused).not.toBe(true);
+});
+
+test("removing an active key skips paused survivors, which remain deletable", async () => {
+  const { removeProviderApiKey } = await import("../../src/providers/api-keys");
+  const config = configFor("fixture", "key");
+  config.providers.fixture!.apiKey = "synthetic-B";
+  config.providers.fixture!.apiKeyPool = [{ id: "A", key: "synthetic-A", disabled: true }, { id: "B", key: "synthetic-B" }, { id: "C", key: "synthetic-C" }];
+  saveConfig(config);
+  expect(removeProviderApiKey(config, "fixture", "B")).toBe(true);
+  expect(config.providers.fixture!.apiKey).toBe("synthetic-C");
+  expect(removeProviderApiKey(config, "fixture", "A")).toBe(true);
+});
+
+test("Google structured account refusals classify without accepting model permission errors", () => {
+  expect(classifyPermanentAccountRefusal(403, { error: { code: 403, status: "PERMISSION_DENIED", message: "Your subscription is inactive" } })).toBe("subscription_inactive");
+  expect(classifyPermanentAccountRefusal(403, { error: { code: 403, status: "PERMISSION_DENIED", message: "This model is not available in this project" } })).toBeUndefined();
+});
+
+test("Antigravity normalization retains permanent refusal and auto-pause ownership", async () => {
+  const { fetchGoogleWithRetry } = await import("../../src/adapters/google-http");
+  const { wasPermanentAccountRefusal } = await import("../../src/oauth/account-auto-pause");
+  const config = configFor("fixture", "key");
+  config.providers.fixture!.apiKey = "synthetic-A";
+  config.providers.fixture!.accountAutoPause!.consecutiveFailures = 1;
+  saveConfig(config);
+  const provider = routedProviderConfig("fixture", config.providers.fixture!);
+  const headers = { authorization: `Bearer ${provider.apiKey}` };
+  const observe = captureAccountAutoPauseAttempt("fixture", provider, { config }, new Headers(headers))!;
+  const response = await fetchGoogleWithRetry("Antigravity", { url: "https://example.test", method: "POST", headers, body: "{}" }, {
+    executor: (async () => observe(refusal())) as typeof fetch,
+  });
+  expect(response.status).toBe(403);
+  expect(wasAccountAutoPaused(response)).toBe(true);
+  expect(wasPermanentAccountRefusal(response)).toBe(true);
+});
+
+test("a stale pre-resume response cannot erase the resumed account's refusal streak", async () => {
+  const f = await oauthFixture();
+  const stale = f.capture();
+  await setAccountPaused("command-code", f.ids[0]!, true);
+  await setAccountPaused("command-code", f.ids[0]!, false);
+  await f.capture()(refusal());
+  await stale(refusal());
+  await f.capture()(refusal());
+  expect(getAccountSet("command-code")!.accounts[0]!.paused).toBe(true);
+});
diff --git a/tests/responses/responses-account-auto-pause.test.ts b/tests/responses/responses-account-auto-pause.test.ts
new file mode 100644
index 00000000000..bb77f44f848
--- /dev/null
+++ b/tests/responses/responses-account-auto-pause.test.ts
@@ -0,0 +1,228 @@
+import { afterEach, beforeEach, expect, test } from "bun:test";
+import { mkdtempSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { getDefaultConfig, saveConfig } from "../../src/config";
+import { getAccountSet, saveCredential, setActiveAccount } from "../../src/oauth/store";
+import { handleResponses } from "../../src/server/responses/core";
+import { flushResponseState, clearResponseStateForTests } from "../../src/responses/state";
+import { clearGenericFailoverHealth } from "../../src/oauth/generic-account-failover";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
+import { removeTreeWithRetry } from "../helpers/remove-tree";
+import type { OcxConfig } from "../../src/types";
+
+const originalHome = process.env.OPENCODEX_HOME;
+const originalFetch = globalThis.fetch;
+let home: string;
+let releaseSpend: () => void;
+beforeEach(() => {
+  home = mkdtempSync(join(tmpdir(), "ocx-auto-pause-runtime-"));
+  process.env.OPENCODEX_HOME = home;
+  releaseSpend = acquireOwnedSpendHome();
+  clearGenericFailoverHealth();
+});
+afterEach(async () => {
+  await flushResponseState(); clearResponseStateForTests();
+  releaseSpend(); clearGenericFailoverHealth();
+  globalThis.fetch = originalFetch;
+  if (originalHome === undefined) delete process.env.OPENCODEX_HOME; else process.env.OPENCODEX_HOME = originalHome;
+  removeTreeWithRetry(home);
+});
+const orgRefusal = () => Response.json({ error: { type: "permission_error", message: "OAuth authentication is currently not allowed for this organization" } }, { status: 403 });
+const completion = () => Response.json({ id: "synthetic-completion", object: "chat.completion", model: "fixture", choices: [{ index: 0, message: { role: "assistant", content: "ok" }, finish_reason: "stop" }], usage: { prompt_tokens: 1, completion_tokens: 1, total_tokens: 2 } });
+function configFor(name: string, oauth: boolean): OcxConfig {
+  const config = getDefaultConfig();
+  config.defaultProvider = name; config.defaultModel = "fixture";
+  config.providers = { [name]: { baseUrl: "https://example.test/v1", adapter: "openai-chat", authMode: oauth ? "oauth" : "key", models: ["fixture"], accountAutoPause: { enabled: true },
+    ...(!oauth ? { apiKey: "synthetic-A", apiKeyPool: [{ id: "A", key: "synthetic-A" }, { id: "B", key: "synthetic-B" }] } : {}),
+  } };
+  saveConfig(config);
+  return config;
+}
+async function send(config: OcxConfig, name: string, sendBudget?: import("../../src/lib/request-execution-budget").RequestExecutionBudget) {
+  const response = await handleResponses(new Request("http://localhost/v1/responses", { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ model: `${name}/fixture`, input: "synthetic", stream: false, store: false }) }), config, { model: "fixture", provider: name }, { sendBudget });
+  const text = await response.text();
+  return { status: response.status, text };
+}
+for (const oauth of [true, false]) {
+  test(`${oauth ? "OAuth" : "key"} HTTP path pauses at threshold and serves the same request with its sibling`, async () => {
+    const name = oauth ? "command-code" : "fixture";
+    if (oauth) {
+      for (let n = 0; n < 2; n++) await saveCredential(name, { access: `synthetic-${n}`, refresh: `synthetic-refresh-${n}`, expires: Date.now() + 3_600_000, accountId: `synthetic-${n}`, source: "oauth" });
+      await setActiveAccount(name, getAccountSet(name)!.accounts[0]!.id);
+    }
+    const config = configFor(name, oauth);
+    const sends: string[] = [];
+    globalThis.fetch = (async (_input, init) => {
+      const auth = new Headers(init?.headers).get("authorization")!;
+      sends.push(auth);
+      return auth === `Bearer synthetic-${oauth ? "0" : "A"}` ? orgRefusal() : completion();
+    }) as typeof fetch;
+    const first = await send(config, name);
+    expect(first.status, first.text).toBe(403);
+    expect(sends.length).toBe(1);
+    const second = await send(config, name);
+    expect(second.status, second.text).toBe(200);
+    expect(sends).toEqual([`Bearer synthetic-${oauth ? "0" : "A"}`, `Bearer synthetic-${oauth ? "0" : "A"}`, `Bearer synthetic-${oauth ? "1" : "B"}`]);
+    const third = await send(config, name);
+    expect(third.status, third.text).toBe(200);
+    expect(sends.at(-1)).toBe(`Bearer synthetic-${oauth ? "1" : "B"}`);
+  });
+}
+
+test("default-off HTTP requests preserve the refusal and never rotate/pause", async () => {
+  const config = configFor("fixture", false);
+  delete config.providers.fixture!.accountAutoPause;
+  saveConfig(config);
+  let sends = 0;
+  globalThis.fetch = (async () => { sends++; return orgRefusal(); }) as typeof fetch;
+  for (let n = 0; n < 3; n++) expect((await send(config, "fixture")).status).toBe(403);
+  expect(sends).toBe(3);
+  expect(config.providers.fixture!.apiKeyPool![0]!.disabled).not.toBe(true);
+});
+
+test("Anthropic organization refusal pauses and rebuilds the in-flight OAuth request", async () => {
+  const { deriveOAuthProviderConfig } = await import("../../src/providers/derive");
+  const { clearAnthropicAccountPoolState } = await import("../../src/oauth/anthropic-routing");
+  clearAnthropicAccountPoolState();
+  for (let n = 0; n < 2; n++) await saveCredential("anthropic", { access: `synthetic-${n}`, refresh: `synthetic-refresh-${n}`, expires: Date.now() + 3_600_000, accountId: `synthetic-${n}`, source: "oauth" });
+  const ids = getAccountSet("anthropic")!.accounts.map(a => a.id);
+  await setActiveAccount("anthropic", ids[0]!);
+  const config = getDefaultConfig();
+  config.providers = { anthropic: { ...deriveOAuthProviderConfig("anthropic")!, models: ["fixture"], accountAutoPause: { enabled: true } } };
+  config.defaultProvider = "anthropic"; config.defaultModel = "fixture";
+  saveConfig(config);
+  const sends: string[] = [];
+  globalThis.fetch = (async (_input, init) => {
+    const bearer = new Headers(init?.headers).get("authorization")!;
+    sends.push(bearer);
+    return bearer === "Bearer synthetic-0" ? orgRefusal() : Response.json({ id: "synthetic-message", type: "message", role: "assistant", model: "fixture", content: [{ type: "text", text: "ok" }], stop_reason: "end_turn", usage: { input_tokens: 1, output_tokens: 1 } });
+  }) as typeof fetch;
+  try {
+    const first = await send(config, "anthropic");
+    expect(first.status, first.text).toBe(403);
+    const second = await send(config, "anthropic");
+    expect(second.status, second.text).toBe(200);
+    expect(sends).toEqual(["Bearer synthetic-0", "Bearer synthetic-0", "Bearer synthetic-1"]);
+    expect(getAccountSet("anthropic")!.accounts[0]!.paused).toBe(true);
+  } finally { clearAnthropicAccountPoolState(); }
+});
+
+
+test("auto-pause never buys a sibling send when the request has only one send", async () => {
+  const { createRequestExecutionBudget, CODEX_TEXT_GUARDED_BUDGET_POLICY } = await import("../../src/lib/request-execution-budget");
+  const config = configFor("fixture", false);
+  config.providers.fixture!.accountAutoPause = { enabled: true, consecutiveFailures: 1 };
+  saveConfig(config);
+  let sends = 0;
+  globalThis.fetch = (async () => { sends++; return orgRefusal(); }) as typeof fetch;
+  const budget = createRequestExecutionBudget({ ...CODEX_TEXT_GUARDED_BUDGET_POLICY, maxTotalModelSends: 1, baseSendAllowance: 1, finalRecoveryAllowance: 0 });
+  const result = await send(config, "fixture", budget);
+  expect(result.status, result.text).toBe(403);
+  expect(sends).toBe(1);
+  expect(config.providers.fixture!.apiKeyPool![0]!.disabled).toBe(true);
+});
+
+test("Codex pool permanent refusal pauses without forcing reauth and retries a sibling", async () => {
+  const { saveCodexAccountCredential } = await import("../../src/codex/account-store");
+  const { updateAccountQuota, clearAccountNeedsReauth } = await import("../../src/codex/auth-api");
+  const { clearCodexUpstreamHealth, clearThreadAccountMap } = await import("../../src/codex/routing");
+  const config = getDefaultConfig();
+  config.providers = { openai: { adapter: "openai-responses", baseUrl: "https://chatgpt.com/backend-api/codex", authMode: "forward", codexAccountMode: "pool", upstreamWebsocket: false, accountAutoPause: { enabled: true }, models: ["gpt-5.5"] } };
+  config.defaultProvider = "openai"; config.defaultModel = "gpt-5.5";
+  config.openaiProviderTierVersion = 2;
+  config.codexAccounts = ["fixture-a", "fixture-b"].map(id => ({ id, email: "", isMain: false, chatgptAccountId: `synthetic-${id}` }));
+  config.activeCodexAccountId = "fixture-a";
+  for (const id of ["fixture-a", "fixture-b"]) {
+    saveCodexAccountCredential(id, { accessToken: `synthetic-${id}`, refreshToken: `synthetic-refresh-${id}`, expiresAt: Date.now() + 3_600_000, chatgptAccountId: `synthetic-${id}` });
+    updateAccountQuota(id, 10); clearAccountNeedsReauth(id);
+  }
+  saveConfig(config);
+  clearCodexUpstreamHealth(); clearThreadAccountMap();
+  const sends: string[] = [];
+  globalThis.fetch = (async (input, init) => {
+    if (String(input).includes("/models")) return Response.json({ models: [{ slug: "gpt-5.5", supported_in_api: true, visibility: "list" }] });
+    const bearer = new Headers(init?.headers).get("authorization")!;
+    sends.push(bearer);
+    return bearer === "Bearer synthetic-fixture-a" ? orgRefusal() : Response.json({ id: "synthetic-response", object: "response", status: "completed", output: [], usage: { input_tokens: 1, output_tokens: 1, total_tokens: 2 } });
+  }) as typeof fetch;
+  const request = () => new Request("http://localhost/v1/responses", { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ model: "openai/gpt-5.5", input: "synthetic", stream: false, store: false }) });
+  try {
+    const first = await handleResponses(request(), config, { model: "gpt-5.5", provider: "openai" });
+    const firstText = await first.text();
+    expect(first.status, firstText).toBe(403);
+    const second = await handleResponses(request(), config, { model: "gpt-5.5", provider: "openai" });
+    const secondText = await second.text();
+    expect(second.status, secondText).toBe(200);
+    expect(config.pausedCodexAccountIds).toContain("fixture-a");
+    expect(sends).toEqual(["Bearer synthetic-fixture-a", "Bearer synthetic-fixture-a", "Bearer synthetic-fixture-b"]);
+  } finally { clearCodexUpstreamHealth(); clearThreadAccountMap(); }
+});
+
+test("native Messages keeps OAuth auto-pause and current-request rotation", async () => {
+  const { handleClaudeMessages } = await import("../../src/server/claude-messages");
+  const { clearAnthropicAccountPoolState } = await import("../../src/oauth/anthropic-routing");
+  clearAnthropicAccountPoolState();
+  for (let n = 0; n < 2; n++) await saveCredential("anthropic", { access: `synthetic-native-${n}`, refresh: `synthetic-refresh-${n}`, expires: Date.now() + 3_600_000, accountId: `synthetic-native-${n}`, source: "oauth" });
+  await setActiveAccount("anthropic", getAccountSet("anthropic")!.accounts[0]!.id);
+  const config = getDefaultConfig();
+  config.providers = { anthropic: { adapter: "anthropic", baseUrl: "https://api.anthropic.com", authMode: "oauth", models: ["claude-sonnet-4-5"], accountAutoPause: { enabled: true } } };
+  config.defaultProvider = "anthropic";
+  config.protocols = { rollout: { managedMessagesNative: true, managedMessagesNativeOAuth: true } };
+  saveConfig(config);
+  const sends: string[] = [];
+  globalThis.fetch = (async (_input, init) => {
+    const bearer = new Headers(init?.headers).get("authorization")!;
+    sends.push(bearer);
+    return bearer === "Bearer synthetic-native-0" ? orgRefusal() : Response.json({ id: "synthetic-native", type: "message", role: "assistant", model: "claude-sonnet-4-5", content: [{ type: "text", text: "ok" }], stop_reason: "end_turn", usage: { input_tokens: 1, output_tokens: 1 } });
+  }) as typeof fetch;
+  const sendNative = () => handleClaudeMessages(new Request("http://localhost/v1/messages", { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ model: "anthropic/claude-sonnet-4-5", max_tokens: 64, messages: [{ role: "user", content: "synthetic" }] }) }), config, { model: "", provider: "" });
+  try {
+    const first = await sendNative(); await first.text(); expect(first.status).toBe(403);
+    const second = await sendNative(); const text = await second.text(); expect(second.status, text).toBe(200);
+    expect(sends).toEqual(["Bearer synthetic-native-0", "Bearer synthetic-native-0", "Bearer synthetic-native-1"]);
+  } finally { clearAnthropicAccountPoolState(); }
+});
+
+test("provider-specific exact send total preserves the original refusal", async () => {
+  const config = configFor("fixture", false);
+  config.providers.fixture!.accountAutoPause = { enabled: true, consecutiveFailures: 1 };
+  config.providers.fixture!.transientRetryOn5xx = { attempts: 1 };
+  saveConfig(config);
+  let sends = 0;
+  globalThis.fetch = (async () => { sends++; return orgRefusal(); }) as typeof fetch;
+  const response = await send(config, "fixture");
+  expect(response.status, response.text).toBe(403);
+  expect(sends).toBe(1);
+});
+
+for (const wire of ["chat", "messages"] as const) {
+  test(`native ${wire} recovers auto-pause reached after a same-key 429 replay`, async () => {
+    const config = configFor("fixture", false);
+    const provider = config.providers.fixture!;
+    provider.accountAutoPause = { enabled: true, consecutiveFailures: 1 };
+    provider.retryOn429 = { attempts: 1, intervalMs: 100, maxIntervalMs: 100, respectRetryAfter: false };
+    if (wire === "messages") {
+      provider.adapter = "anthropic"; provider.baseUrl = "https://api.anthropic.com";
+      config.protocols = { rollout: { managedMessagesNative: true } };
+    }
+    saveConfig(config);
+    const sends: string[] = [];
+    globalThis.fetch = (async (_input, init) => {
+      const headers = new Headers(init?.headers);
+      sends.push(headers.get("authorization") ?? headers.get("x-api-key") ?? "missing");
+      if (sends.length === 1) return Response.json({ error: { type: "rate_limit_error", message: "synthetic rate limit" } }, { status: 429 });
+      if (sends.length === 2) return orgRefusal();
+      return wire === "chat" ? completion() : Response.json({ id: "synthetic-message", type: "message", role: "assistant", model: "fixture", content: [{ type: "text", text: "ok" }], stop_reason: "end_turn", usage: { input_tokens: 1, output_tokens: 1 } });
+    }) as typeof fetch;
+    const body = { model: "fixture/fixture", max_tokens: 64, messages: [{ role: "user", content: "synthetic" }], stream: false };
+    const req = new Request(`http://localhost/v1/${wire === "chat" ? "chat/completions" : "messages"}`, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify(body) });
+    const response = wire === "chat"
+      ? await (await import("../../src/server/chat-completions")).handleChatCompletions(req, config, { model: "fixture", provider: "fixture" })
+      : await (await import("../../src/server/claude-messages")).handleClaudeMessages(req, config, { model: "fixture", provider: "fixture" });
+    const text = await response.text();
+    expect(response.status, text).toBe(200);
+    expect(sends.length).toBe(3);
+    expect(sends[2]).toContain("synthetic-B");
+  });
+}

From eb374a3201e3aee56b03ea5ce45d71343fa22a09 Mon Sep 17 00:00:00 2001
From: JUN <jun@lidgeai.com>
Date: Thu, 15 Oct 2026 21:08:49 +0900
Subject: [PATCH 02/17] fix(accounts): register pause route and extracted
 Responses owners

---
 src/server/management/route-registry.ts        | 1 +
 structure/account-auto-pause.md                | 4 ++++
 tests/helpers/responses-core-source.ts         | 2 ++
 tests/server/management-route-registry.test.ts | 4 +++-
 4 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/src/server/management/route-registry.ts b/src/server/management/route-registry.ts
index 3a24f7138fe..deb9cced5a8 100644
--- a/src/server/management/route-registry.ts
+++ b/src/server/management/route-registry.ts
@@ -355,6 +355,7 @@ export const MANAGEMENT_ROUTES: readonly ManagementRoute[] = [
   { method: "PUT", path: "/api/oauth/accounts/pool", module: "server/management/oauth-account-routes", mutates: true },
   { method: "PUT", path: "/api/providers/keys/active", module: "server/management/oauth-account-routes", mutates: true },
   { method: "PUT", path: "/api/providers/keys/alias", module: "server/management/oauth-account-routes", mutates: true },
+  { method: "PUT", path: "/api/providers/keys/pause", module: "server/management/oauth-account-routes", mutates: true },
   // server/management/provider-routes
   { method: "DELETE", path: "/api/providers", module: "server/management/provider-routes", mutates: true },
   { method: "GET", path: "/api/provider-context-caps", module: "server/management/provider-routes", mutates: false },
diff --git a/structure/account-auto-pause.md b/structure/account-auto-pause.md
index 927d2f44e8f..4865b6499d8 100644
--- a/structure/account-auto-pause.md
+++ b/structure/account-auto-pause.md
@@ -56,6 +56,10 @@ the reason in account listings. `src/server/management/oauth-account-routes.ts`
 the existing management authorization boundary. Key listings expose `disabled` and pause
 details. Dashboard key Resume clears the pause through that endpoint before activating
 the key; OAuth/Codex keep their existing resume actions.
+`src/server/management/route-registry.ts` declares key pause as an ordinary management mutation,
+covered by the existing account pause/resume CLI capabilities. Responses recovery and passthrough
+observation owners are included in `tests/helpers/responses-core-source.ts`; its graph guard checks
+inventory coverage, physical line limits, and acyclic dependencies including type-only imports.
 
 ## Permanent refusal pause indicators
 
diff --git a/tests/helpers/responses-core-source.ts b/tests/helpers/responses-core-source.ts
index 516521ecf48..435d1289a07 100644
--- a/tests/helpers/responses-core-source.ts
+++ b/tests/helpers/responses-core-source.ts
@@ -45,8 +45,10 @@ export const RESPONSES_CORE_MODULES = [
   "request-sidecar-auth.ts",
   "response-effects.ts",
   "request-send-budget.ts",
+  "account-auto-pause-recovery.ts",
   "passthrough-execution.ts",
   "passthrough-dispatch.ts",
+  "passthrough-observations.ts",
   // Reached from passthrough/adapter dispatch, compact and runTurn: local spend-ledger refusal mapping.
   "spend-storage-error.ts",
   "reset-replay.ts",
diff --git a/tests/server/management-route-registry.test.ts b/tests/server/management-route-registry.test.ts
index 510a5a3f363..ff380295506 100644
--- a/tests/server/management-route-registry.test.ts
+++ b/tests/server/management-route-registry.test.ts
@@ -256,13 +256,15 @@ describe("route exemptions stay honest", () => {
     });
   });
 
-  test("account-switch routes remain ordinary management mutations", () => {
+  test("account-switch and key pause routes remain ordinary management mutations", () => {
     for (const path of [
       "/api/codex-auth/active", "/api/oauth/accounts/active", "/api/providers/keys/active",
+      "/api/providers/keys/pause",
     ]) {
       const row = MANAGEMENT_ROUTES.find(r => r.method === "PUT" && r.path === path);
       expect(row?.mutates, path).toBe(true);
       expect(row?.exempt, path).toBeUndefined();
+      if (path === "/api/providers/keys/pause") expect(row?.module).toBe("server/management/oauth-account-routes");
     }
   });
 

From 1d64b3b8eba9c2abecb039298640379d021c02e0 Mon Sep 17 00:00:00 2001
From: JUN <jun@lidgeai.com>
Date: Fri, 16 Oct 2026 10:01:29 +0900
Subject: [PATCH 03/17] fix(accounts): inject refusal observer across transport
 leaf boundary

---
 src/server/responses/compact.ts              |  4 ++--
 src/server/responses/core-codex-account.ts   |  4 ++--
 src/server/responses/fetch-helpers.ts        |  5 ++---
 src/server/responses/passthrough-dispatch.ts | 12 ++++++------
 src/server/responses/request-transport.ts    |  2 +-
 structure/account-auto-pause.md              |  4 ++--
 structure/transports/responses.md            |  1 +
 7 files changed, 16 insertions(+), 16 deletions(-)

diff --git a/src/server/responses/compact.ts b/src/server/responses/compact.ts
index 70b16203297..26d47786d98 100644
--- a/src/server/responses/compact.ts
+++ b/src/server/responses/compact.ts
@@ -1,4 +1,4 @@
-import { wasAccountAutoPaused, wasPermanentAccountRefusal } from "../../oauth/account-auto-pause";
+import { captureAccountAutoPauseAttempt, wasAccountAutoPaused, wasPermanentAccountRefusal } from "../../oauth/account-auto-pause";
 import { spendLedgerStorageErrorResponse } from "./spend-storage-error";
 import { createPhysicalSendReporter } from "../../lib/request-execution-budget";
 import { createInferenceSendBudget } from "../inference/context";
@@ -1080,7 +1080,7 @@ export async function handleResponsesCompact(
         providerFetch(sendProvider, undefined, {
           providerName: route.providerName,
           modelId: route.modelId,
-          accountAutoPause: { config, codex: sendAuthCtx },
+          accountAutoPause: (name, provider, headers) => captureAccountAutoPauseAttempt(name, provider, { config, codex: sendAuthCtx }, headers),
           beforeDispatch: isCanonicalOpenAiForwardProvider(sendProvider)
             ? createCodexAuthDispatchGuard(sendAuthCtx, config, selectedModelId, admission) : undefined,
           ...(onPhysicalDispatch ? { onPhysicalDispatch } : {}),
diff --git a/src/server/responses/core-codex-account.ts b/src/server/responses/core-codex-account.ts
index bbd85a7eca1..0fb18eebb81 100644
--- a/src/server/responses/core-codex-account.ts
+++ b/src/server/responses/core-codex-account.ts
@@ -1,4 +1,4 @@
-import { wasPermanentAccountRefusal } from "../../oauth/account-auto-pause";
+import { captureAccountAutoPauseAttempt, wasPermanentAccountRefusal } from "../../oauth/account-auto-pause";
 import type { OcxConfig, OcxProviderConfig, OcxParsedRequest } from "../../types";
 import type { CodexAuthContext, CodexAuthPolicyConfig } from "../../codex/auth-context";
 import type { CodexUpstreamOutcome } from "../../codex/routing";
@@ -1027,7 +1027,7 @@ export async function retryCodexPoolOnAlternateAccount(
             providerName: route.providerName,
             modelId: route.modelId,
             preOutputRefusalHold: args.preOutputRefusalHold,
-            accountAutoPause: { config, codex: retryAuthCtx },
+            accountAutoPause: (name, provider, headers) => captureAccountAutoPauseAttempt(name, provider, { config, codex: retryAuthCtx }, headers),
             onCodexWsQuota: codexWsQuotaObserver(retryAuthCtx, route.provider, route.modelId),
             beforeDispatch: isCanonicalOpenAiForwardProvider(route.provider)
               ? createCodexAuthDispatchGuard(retryAuthCtx, options.codexAuthPolicy ?? config, route.modelId, options.admission, options.visionDescribeTerminal === true) : undefined,
diff --git a/src/server/responses/fetch-helpers.ts b/src/server/responses/fetch-helpers.ts
index 6ab4dfc7f22..6adad19d23f 100644
--- a/src/server/responses/fetch-helpers.ts
+++ b/src/server/responses/fetch-helpers.ts
@@ -1,4 +1,3 @@
-import { captureAccountAutoPauseAttempt, type AccountAutoPauseBinding } from "../../oauth/account-auto-pause";
 import type { NativeResponseControl } from "./native-response-control";
 import type { CodexWsPreOutputRefusalHold } from "./codex-ws-wire";
 import type { Server } from "bun";
@@ -224,7 +223,7 @@ export function sendWithConnectionPolicy(
 }
 
 export interface ProviderFetchOptions {
-  accountAutoPause?: AccountAutoPauseBinding;
+  accountAutoPause?: (name: string, provider: OcxProviderConfig, headers: Headers) => ((response: Response) => Promise<Response>) | undefined;
   /**
    * Keep this send on HTTP even where the WebSocket upstream would normally be selected.
    *
@@ -374,7 +373,7 @@ export function providerFetch(
     return httpFetch(input, init);
   };
   const unpaced = async (input: Parameters<typeof globalThis.fetch>[0], init?: RequestInit) => {
-    const observe = captureAccountAutoPauseAttempt(providerName, provider, options.accountAutoPause,
+    const observe = options.accountAutoPause?.(providerName, provider,
       new Headers(init?.headers ?? (input instanceof Request ? input.headers : undefined)));
     const response = await unobserved(input, init);
     return observe ? observe(response) : response;
diff --git a/src/server/responses/passthrough-dispatch.ts b/src/server/responses/passthrough-dispatch.ts
index 30b12f1fc6a..fb01fc438ad 100644
--- a/src/server/responses/passthrough-dispatch.ts
+++ b/src/server/responses/passthrough-dispatch.ts
@@ -129,7 +129,7 @@ import {
 } from "../../lib/upstream-retry";
 import { mapCodexAuthContextErrorToResponse } from "./codex-auth-error";
 import { classifyTransportFailureKind, transportErrorCode } from "../../lib/upstream-reachability";
-import { wasAccountAutoPaused, wasPermanentAccountRefusal } from "../../oauth/account-auto-pause";
+import { captureAccountAutoPauseAttempt, wasAccountAutoPaused, wasPermanentAccountRefusal } from "../../oauth/account-auto-pause";
 import { recordCodexUpstreamOutcome } from "../../codex/routing";
 import { describeUpstreamConnectFailure } from "./upstream-error";
 import type { OpaqueBlobRecoveryGuard } from "./core-opaque-recovery";
@@ -1038,7 +1038,7 @@ export async function preparePassthroughExchange(
               providerName: route.providerName,
               modelId: route.modelId,
               onPhysicalDispatch: receiptMode ? sendBudgetState.noteInitialDispatch : undefined,
-              accountAutoPause: { config, codex: admissionState.authCtx },
+              accountAutoPause: (name, provider, headers) => captureAccountAutoPauseAttempt(name, provider, { config, codex: admissionState.authCtx }, headers),
               onCodexWsQuota: codexWsQuotaObserver(admissionState.authCtx, route.provider, route.modelId),
               beforeDispatch: isCanonicalOpenAiForwardProvider(route.provider)
                 ? createCodexAuthDispatchGuard(admissionState.authCtx, options.codexAuthPolicy ?? config, route.modelId, options.admission, options.visionDescribeTerminal === true) : undefined,
@@ -1176,7 +1176,7 @@ export async function preparePassthroughExchange(
                 dispatchOverride: oauthDispatch(request, parsed, "passthrough"),
                 providerName: route.providerName,
                 modelId: route.modelId,
-                accountAutoPause: { config, codex: admissionState.authCtx },
+                accountAutoPause: (name, provider, headers) => captureAccountAutoPauseAttempt(name, provider, { config, codex: admissionState.authCtx }, headers),
                 onCodexWsQuota: codexWsQuotaObserver(admissionState.authCtx, route.provider, route.modelId),
                 beforeDispatch: isCanonicalOpenAiForwardProvider(route.provider)
                   ? createCodexAuthDispatchGuard(admissionState.authCtx, options.codexAuthPolicy ?? config, route.modelId, options.admission, options.visionDescribeTerminal === true) : undefined,
@@ -1293,7 +1293,7 @@ export async function preparePassthroughExchange(
             dispatchOverride: oauthDispatch(request, parsed, "passthrough"),
             providerName: route.providerName,
             modelId: route.modelId,
-            accountAutoPause: { config, codex: admissionState.authCtx },
+            accountAutoPause: (name, provider, headers) => captureAccountAutoPauseAttempt(name, provider, { config, codex: admissionState.authCtx }, headers),
             onCodexWsQuota: codexWsQuotaObserver(admissionState.authCtx, route.provider, route.modelId),
             beforeDispatch: headers => {
               replayGuard?.(headers);
@@ -1441,7 +1441,7 @@ export async function preparePassthroughExchange(
                 dispatchOverride: oauthDispatch(request, parsed, "passthrough"),
                 providerName: route.providerName,
                 modelId: route.modelId,
-                accountAutoPause: { config, codex: admissionState.authCtx },
+                accountAutoPause: (name, provider, headers) => captureAccountAutoPauseAttempt(name, provider, { config, codex: admissionState.authCtx }, headers),
                 onCodexWsQuota: codexWsQuotaObserver(admissionState.authCtx, route.provider, route.modelId),
                 beforeDispatch: isCanonicalOpenAiForwardProvider(route.provider)
                   ? createCodexAuthDispatchGuard(admissionState.authCtx, options.codexAuthPolicy ?? config, route.modelId, options.admission, options.visionDescribeTerminal === true) : undefined,
@@ -1589,7 +1589,7 @@ export async function preparePassthroughExchange(
                 dispatchOverride: oauthDispatch(request, parsed, "passthrough"),
                 providerName: route.providerName,
                 modelId: route.modelId,
-                accountAutoPause: { config, codex: admissionState.authCtx },
+                accountAutoPause: (name, provider, headers) => captureAccountAutoPauseAttempt(name, provider, { config, codex: admissionState.authCtx }, headers),
                 onCodexWsQuota: codexWsQuotaObserver(admissionState.authCtx, route.provider, route.modelId),
                 beforeDispatch: isCanonicalOpenAiForwardProvider(route.provider)
                   ? createCodexAuthDispatchGuard(admissionState.authCtx, options.codexAuthPolicy ?? config, route.modelId, options.admission, options.visionDescribeTerminal === true) : undefined,
diff --git a/src/server/responses/request-transport.ts b/src/server/responses/request-transport.ts
index 30c2666adfa..b3b7ddebb12 100644
--- a/src/server/responses/request-transport.ts
+++ b/src/server/responses/request-transport.ts
@@ -686,7 +686,7 @@ export async function prepareResponsesTransport(
           providerName: route.providerName, modelId: route.modelId, pacingSlotAcquired: true,
           pacingSlot: attemptSlot,
           turnScopedPacing: true,
-          accountAutoPause: { config, oauth: binding?.kind === "oauth" ? binding.snapshot : undefined },
+          accountAutoPause: (name, provider, headers) => captureAccountAutoPauseAttempt(name, provider, { config, oauth: binding?.kind === "oauth" ? binding.snapshot : undefined }, headers),
           beforeDispatch: () => {
             if (sent) return;
             if (!selectionIsCurrent(binding)) {
diff --git a/structure/account-auto-pause.md b/structure/account-auto-pause.md
index 4865b6499d8..0a764d283e5 100644
--- a/structure/account-auto-pause.md
+++ b/structure/account-auto-pause.md
@@ -5,8 +5,8 @@ permanent account refusals. Counters are process-local; persisted pauses require
 
 ## Opt-in account refusal observation
 
-`src/server/responses/fetch-helpers.ts` accepts an optional account binding for physical
-Codex/runTurn response observation. OAuth/key HTTP overrides capture after reselection in
+`src/server/responses/fetch-helpers.ts` accepts an optional caller-owned observer factory for physical
+Codex/runTurn response observation; the transport leaf imports no account or OAuth policy. OAuth/key HTTP overrides capture after reselection in
 `src/server/responses/request-transport.ts`; native Chat/Messages capture at their send
 boundaries. `src/oauth/account-auto-pause.ts` is dormant unless the named provider explicitly
 enables the policy, writes only fixed pause metadata, and preserves upstream responses if
diff --git a/structure/transports/responses.md b/structure/transports/responses.md
index d0d1fcd17c2..da6dff08ca4 100644
--- a/structure/transports/responses.md
+++ b/structure/transports/responses.md
@@ -41,6 +41,7 @@ redirect following; providers requiring a redirect must be configured with their
 `src/server/responses/fetch-helpers.ts` is a transport leaf shared by Responses, compact, and native
 Chat. Its runtime imports are limited to the Codex WebSocket transport, provider request pacing, and
 the upstream HTTP-version helper. Server, provider, and WebSocket data types remain type-only edges. Opt-in `codexWsReuseAcrossTurns` (default off) in `src/server/responses/codex-ws-pool.ts` keeps a socket for an account and thread across turns, waits at most 750ms for a busy socket before dialing another, and leaves `x-codex-turn-state` / `x-codex-turn-metadata` on each frame.
+Account refusal observers are injected by the calling transport owner and captured before the physical send.
 It must not import routing, combos, OAuth, adapters, sidecars, response parsing, logging, or relay
 modules merely because those imports existed in the pre-split `responses.ts` monolith.
 

From 36e01f904f40161d236b6b654fd192b68c434d8c Mon Sep 17 00:00:00 2001
From: JUN <jun@lidgeai.com>
Date: Fri, 16 Oct 2026 12:57:54 +0900
Subject: [PATCH 04/17] Preserve pause ownership through distributed revisions
 and pacing rewraps

---
 src/lib/account-auto-pause-response.ts | 12 ++++++++----
 src/providers/api-key-pause.ts         |  2 +-
 structure/account-auto-pause.md        |  4 ++--
 structure/transports/responses.md      |  3 +--
 4 files changed, 12 insertions(+), 9 deletions(-)

diff --git a/src/lib/account-auto-pause-response.ts b/src/lib/account-auto-pause-response.ts
index 9e8262d8453..92e5f19d399 100644
--- a/src/lib/account-auto-pause-response.ts
+++ b/src/lib/account-auto-pause-response.ts
@@ -1,10 +1,14 @@
+import { registerProviderResponseProvenance } from "../providers/request-pacing";
+
 /** Process-local outcome ownership; these markers never become upstream/client headers. */
-const pausedResponses = new WeakSet<Response>();
-const permanentResponses = new WeakSet<Response>();
+const pausedResponses = new WeakMap<Response, true>();
+const permanentResponses = new WeakMap<Response, true>();
+registerProviderResponseProvenance(pausedResponses);
+registerProviderResponseProvenance(permanentResponses);
 export const wasAccountAutoPaused = (response: Response): boolean => pausedResponses.has(response);
 export const wasPermanentAccountRefusal = (response: Response): boolean => permanentResponses.has(response);
-export function markPermanentAccountRefusal(response: Response): void { permanentResponses.add(response); }
-export function markAccountAutoPaused(response: Response): void { pausedResponses.add(response); }
+export function markPermanentAccountRefusal(response: Response): void { permanentResponses.set(response, true); }
+export function markAccountAutoPaused(response: Response): void { pausedResponses.set(response, true); }
 export function inheritAccountAutoPauseResponse(source: Response, target: Response): Response {
   if (wasAccountAutoPaused(source)) markAccountAutoPaused(target);
   if (wasPermanentAccountRefusal(source)) markPermanentAccountRefusal(target);
diff --git a/src/providers/api-key-pause.ts b/src/providers/api-key-pause.ts
index 3b5087356ec..2d55e3852f2 100644
--- a/src/providers/api-key-pause.ts
+++ b/src/providers/api-key-pause.ts
@@ -25,6 +25,6 @@ export function setProviderApiKeyPaused(config: OcxConfig, name: string, id: str
       else delete provider.apiKey;
     } else if (!paused && !provider.apiKey) provider.apiKey = entry.key;
     return { changed: true, selectionChanged: true, value: true };
-  });
+  }, automatic?.selection);
   return result.status === "committed" && result.value;
 }
diff --git a/structure/account-auto-pause.md b/structure/account-auto-pause.md
index 96eb8b0a1dc..47ae9e4b41b 100644
--- a/structure/account-auto-pause.md
+++ b/structure/account-auto-pause.md
@@ -69,7 +69,7 @@ on Paused badges. Disabled key rows offer Resume through their existing selectio
 `gui/src/hooks/useProviderAccountPools.ts` resumes before activation, then refreshes the
 roster under its existing selection-mutation fence. No upstream error body is displayed.
 
-`src/lib/account-auto-pause-response.ts` retains process-local pause/refusal markers when
-adapter error normalization replaces a response, without exposing metadata in HTTP headers.
+`src/lib/account-auto-pause-response.ts` registers process-local pause/refusal provenance with the pacing owner and retains it when
+adapter error normalization or a leased pacing-body rewrap replaces a response, without exposing metadata in HTTP headers.
 
 `src/types/account-auto-pause.ts` owns the policy and fixed pause-reason DTO vocabulary.
diff --git a/structure/transports/responses.md b/structure/transports/responses.md
index 999bd00eefe..59aec0f8c9b 100644
--- a/structure/transports/responses.md
+++ b/structure/transports/responses.md
@@ -41,8 +41,7 @@ redirect following; providers requiring a redirect must be configured with their
 `src/server/responses/fetch-helpers.ts` is a transport leaf shared by Responses, compact, and native
 Chat. Its runtime imports are limited to the Codex WebSocket transport, provider request pacing, and
 the upstream HTTP-version helper. Server, provider, and WebSocket data types remain type-only edges. Opt-in `codexWsReuseAcrossTurns` (default off) in `src/server/responses/codex-ws-pool.ts` keeps a socket for an account and thread across turns, waits at most 750ms for a busy socket before dialing another, and leaves `x-codex-turn-state` / `x-codex-turn-metadata` on each frame.
-Account refusal observers are injected by the calling transport owner and captured before the physical send; their wrapper forwards replacement pacing admission to the physical dispatch owner.
-It must not import routing, combos, OAuth, adapters, sidecars, response parsing, logging, or relay
+Account refusal observers are injected by the calling transport owner and captured before the physical send; their wrapper forwards replacement pacing admission to the physical dispatch owner. It must not import routing, combos, OAuth, adapters, sidecars, response parsing, logging, or relay
 modules merely because those imports existed in the pre-split `responses.ts` monolith.
 
 `OCX_FRESH_CONNECTION_HOSTS` accepts comma-separated hostnames whose outbound HTTP sends bypass

From b8d84a1483e438302dd35c881d212eafb57b1671 Mon Sep 17 00:00:00 2001
From: JUN <jun@lidgeai.com>
Date: Fri, 16 Oct 2026 13:39:02 +0900
Subject: [PATCH 05/17] test(responses): cover replay ownership after
 auto-pause rotation

---
 scripts/test-layout/layout.json               |   2 +-
 tests/fixtures/test-layout-expected.json      |   2 +-
 .../responses-auto-pause-replay-owner.test.ts | 122 ++++++++++++++++++
 3 files changed, 124 insertions(+), 2 deletions(-)
 create mode 100644 tests/responses/responses-auto-pause-replay-owner.test.ts

diff --git a/scripts/test-layout/layout.json b/scripts/test-layout/layout.json
index a8b4d527e9c..524ebe3a761 100644
--- a/scripts/test-layout/layout.json
+++ b/scripts/test-layout/layout.json
@@ -4,7 +4,7 @@
   "explicitShards": ["layout-clients.json"],
   "explicit": { "catalog-auto-review-override.test.ts": "codex-integration", "management-auto-review-settings.test.ts": "server", "management-auto-review-auth.test.ts": "server", "prefer-model-alias-ids.test.ts": "server", "responses-mimo-envelope.test.ts": "responses", "responses-call-id-linkage.test.ts": "responses", "bridge-terminal-refusal.test.ts": "adapters", "loop-terminal-refusal.test.ts": "images", "web-search-terminal-refusal.test.ts": "web-search", "combo-terminal-refusal.test.ts": "routing", "server-terminal-refusal-wiring.test.ts": "server", "incomplete-reason-normalization.test.ts": "responses", "advisor-retention.test.ts": "advisor", "gcp-credential-boundary.test.ts": "adapters/google", "gcp-sa-marker.test.ts": "adapters/google", "gcp-sa-adapter.test.ts": "adapters/google", "management-gcp-credential-input.test.ts": "server", "codex-preserve-signed-in.test.ts": "codex-integration", "cli-account-preservation.test.ts": "cli", "service-state-isolation.test.ts": "service", "compaction-history-framing.test.ts": "responses", "catalog-native-max-context.test.ts": "codex-integration", "protocol-argon-thought-boundary.test.ts": "responses", "service-log.test.ts": "service", "messages-native-empty-inline.test.ts": "claude-integration", "responses-native-key-cooldown.test.ts": "responses", "responses-run-turn-key-readmission.test.ts": "responses", "qoder-spawn-readmission.test.ts": "adapters", "api-key-selection-cooldown.test.ts": "providers", "api-key-auto-pause-distribution.test.ts": "providers", "server-chat-native-key-selection.test.ts": "server", "compact-key-selection.test.ts": "responses", "messages-native-key-selection.test.ts": "claude-integration",
     "owner-registry-isolation.test.ts": "config",
-    "responses-account-auto-pause.test.ts": "responses", "oauth-account-auto-pause.test.ts": "oauth", "codex-history-pending-wal.test.ts": "codex-integration", "responses-anthropic-billing-send-budget.test.ts": "responses", "anthropic-billing-ownership.test.ts": "adapters/anthropic", "server-anthropic-billing.test.ts": "server", "server-anthropic-billing-boundaries.test.ts": "server", "router-anthropic-billing-failover.test.ts": "routing", "anthropic-billing-refusal.test.ts": "adapters/anthropic", "messages-request-id-headers.test.ts": "claude-integration", "bounded-file-read.test.ts": "lib", "responses-undeclared-tool-guard-inbound.test.ts": "responses", "explicit-empty-tool-catalog.test.ts": "responses", "explicit-empty-tool-catalog-history.test.ts": "responses",
+    "responses-auto-pause-replay-owner.test.ts": "responses", "responses-account-auto-pause.test.ts": "responses", "oauth-account-auto-pause.test.ts": "oauth", "codex-history-pending-wal.test.ts": "codex-integration", "responses-anthropic-billing-send-budget.test.ts": "responses", "anthropic-billing-ownership.test.ts": "adapters/anthropic", "server-anthropic-billing.test.ts": "server", "server-anthropic-billing-boundaries.test.ts": "server", "router-anthropic-billing-failover.test.ts": "routing", "anthropic-billing-refusal.test.ts": "adapters/anthropic", "messages-request-id-headers.test.ts": "claude-integration", "bounded-file-read.test.ts": "lib", "responses-undeclared-tool-guard-inbound.test.ts": "responses", "explicit-empty-tool-catalog.test.ts": "responses", "explicit-empty-tool-catalog-history.test.ts": "responses",
     "messages-request-id-endpoint.test.ts": "claude-integration",
     "anthropic-revoked-token.test.ts": "adapters/anthropic",
     "messages-revoked-token.test.ts": "claude-integration",
diff --git a/tests/fixtures/test-layout-expected.json b/tests/fixtures/test-layout-expected.json
index 75f4b76e0d0..8501ac50c19 100644
--- a/tests/fixtures/test-layout-expected.json
+++ b/tests/fixtures/test-layout-expected.json
@@ -9,7 +9,7 @@
   "codex-preserve-signed-in.test.ts": "codex-integration", "cli-account-preservation.test.ts": "cli",
   "catalog-native-max-context.test.ts": "codex-integration",
   "protocol-argon-thought-boundary.test.ts": "responses",
-  "responses-account-auto-pause.test.ts": "responses", "oauth-account-auto-pause.test.ts": "oauth",
+  "responses-auto-pause-replay-owner.test.ts": "responses", "responses-account-auto-pause.test.ts": "responses", "oauth-account-auto-pause.test.ts": "oauth",
   "advisor-retention.test.ts": "advisor", "responses-native-key-cooldown.test.ts": "responses", "responses-run-turn-key-readmission.test.ts": "responses", "qoder-spawn-readmission.test.ts": "adapters",
   "api-key-selection-cooldown.test.ts": "providers", "api-key-auto-pause-distribution.test.ts": "providers", "server-chat-native-key-selection.test.ts": "server", "compact-key-selection.test.ts": "responses",
   "messages-native-key-selection.test.ts": "claude-integration",
diff --git a/tests/responses/responses-auto-pause-replay-owner.test.ts b/tests/responses/responses-auto-pause-replay-owner.test.ts
new file mode 100644
index 00000000000..f7dd3689f2c
--- /dev/null
+++ b/tests/responses/responses-auto-pause-replay-owner.test.ts
@@ -0,0 +1,122 @@
+import { afterEach, beforeEach, expect, spyOn, test } from "bun:test";
+import { mkdtempSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { getDefaultConfig, saveConfig } from "../../src/config";
+import { getAccountSet, saveCredential, setActiveAccount } from "../../src/oauth/store";
+import { clearGenericFailoverHealth } from "../../src/oauth/generic-account-failover";
+import { handleResponses } from "../../src/server/responses/core";
+import * as transport from "../../src/server/responses/request-transport";
+import { createResponsesEffects } from "../../src/server/responses/response-effects";
+import { commitReasoningReplayServingIdentity } from "../../src/responses/reasoning-replay-cache";
+import { flushResponseState, clearResponseStateForTests } from "../../src/responses/state";
+import type { OcxParsedRequest, OcxProviderContinuationOwner } from "../../src/types";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
+import { removeTreeWithRetry } from "../helpers/remove-tree";
+
+const originalHome = process.env.OPENCODEX_HOME;
+const originalFetch = globalThis.fetch;
+let home: string;
+let releaseSpend: () => void;
+beforeEach(() => {
+  home = mkdtempSync(join(tmpdir(), "ocx-auto-pause-replay-"));
+  process.env.OPENCODEX_HOME = home;
+  releaseSpend = acquireOwnedSpendHome();
+  clearGenericFailoverHealth();
+});
+afterEach(async () => {
+  await flushResponseState(); clearResponseStateForTests();
+  releaseSpend(); clearGenericFailoverHealth();
+  globalThis.fetch = originalFetch;
+  if (originalHome === undefined) delete process.env.OPENCODEX_HOME;
+  else process.env.OPENCODEX_HOME = originalHome;
+  removeTreeWithRetry(home);
+});
+
+for (const oauth of [false, true]) for (const native of [false, true]) {
+  test(`${oauth ? "OAuth" : "key"} auto-pause rebinds ${native ? "native Responses" : "translated Chat"} retry and persistence owners`, async () => {
+    const name = oauth ? "command-code" : "fixture";
+    if (oauth) {
+      for (const id of ["A", "B"]) await saveCredential(name, {
+        access: `synthetic-${id}`, refresh: `synthetic-refresh-${id}`,
+        expires: Date.now() + 3_600_000, accountId: `synthetic-${id}`, source: "oauth",
+      });
+      await setActiveAccount(name, getAccountSet(name)!.accounts[0]!.id);
+    }
+    const config = getDefaultConfig();
+    config.defaultProvider = name; config.defaultModel = "fixture";
+    config.providers = { [name]: {
+      baseUrl: "https://example.test/v1", adapter: native ? "openai-responses" : "openai-chat",
+      authMode: oauth ? "oauth" : "key", models: ["fixture"],
+      accountAutoPause: { enabled: true, consecutiveFailures: 1 },
+      ...(!oauth ? { apiKey: "synthetic-A", apiKeyPool: [{ id: "A", key: "synthetic-A" }, { id: "B", key: "synthetic-B" }] } : {}),
+    } };
+    saveConfig(config);
+    const sends: string[] = [];
+    globalThis.fetch = (async (_input, init) => {
+      const auth = new Headers(init?.headers).get("authorization")!;
+      sends.push(auth);
+      if (auth === "Bearer synthetic-A") return Response.json({ error: {
+        type: "permission_error", message: "OAuth authentication is currently not allowed for this organization",
+      } }, { status: 403 });
+      return native
+        ? Response.json({ id: "synthetic-response", object: "response", model: "fixture", status: "completed", output: [{ id: "synthetic-message", type: "message", role: "assistant", content: [{ type: "output_text", text: "ok", annotations: [] }] }], usage: { input_tokens: 1, output_tokens: 1, total_tokens: 2 } })
+        : Response.json({ id: "synthetic-completion", object: "chat.completion", model: "fixture", choices: [{ index: 0, message: { role: "assistant", content: "ok" }, finish_reason: "stop" }], usage: { prompt_tokens: 1, completion_tokens: 1, total_tokens: 2 } });
+    }) as typeof fetch;
+    let outer: OcxParsedRequest | undefined;
+    let retry: OcxParsedRequest | undefined;
+    let oldOwner: OcxProviderContinuationOwner | undefined;
+    let oldReplayCredential: string | undefined;
+    let persisted: ReturnType<Exclude<ReturnType<typeof createResponsesEffects>, Response>["continuationStateForResponse"]>;
+    const prepare = transport.prepareResponsesTransport;
+    const prepared = spyOn(transport, "prepareResponsesTransport").mockImplementation(async (...args) => {
+      const state = await prepare(...args);
+      if (state instanceof Response) return state;
+      outer = args[2].parsed;
+      oldOwner = outer._providerContinuationOwner;
+      oldReplayCredential = outer._reasoningReplayScope?.current?.credentialIdentity;
+      // Seed previously accepted A state; transport and account selection remain real.
+      commitReasoningReplayServingIdentity(outer._reasoningReplayScope);
+      outer._providerContinuationCandidate = { __ocxOwner: oldOwner!, cursor: { conversationId: "synthetic-A-conversation" } };
+      outer._providerContinuation = { cursor: { conversationId: "synthetic-A-conversation" } };
+      outer._cursorConversationId = "synthetic-A-conversation";
+      const recover = state.recoverAutoPausedSelection;
+      state.recoverAutoPausedSelection = async requestParsed => {
+        // Terminal recovery may pass a shallow clone; its owner fields are independent
+        // even though the replay scope holder is shared with the persistence request.
+        retry = { ...requestParsed };
+        const recovered = await recover(retry);
+        const effects = createResponsesEffects(args[0], args[1], {
+          parsed: outer!, route: args[2].route, poolAffinityKey: null, substituteMainCredential: false,
+        }, { routedCompaction: false });
+        if (!(effects instanceof Response)) persisted = effects.continuationStateForResponse({ cursor: { conversationId: "synthetic-B-conversation" } });
+        return recovered;
+      };
+      return state;
+    });
+    try {
+      const response = await handleResponses(new Request("http://localhost/v1/responses", {
+        method: "POST", headers: { "content-type": "application/json", "x-session-id": `synthetic-${oauth}-${native}` },
+        body: JSON.stringify({ model: `${name}/fixture`, input: "synthetic", stream: false, store: false }),
+      }), config, { model: "fixture", provider: name });
+      const text = await response.text();
+      expect(response.status, text).toBe(200);
+      expect(sends).toEqual(["Bearer synthetic-A", "Bearer synthetic-B"]);
+      expect(oldOwner).toBeDefined();
+      expect(oldReplayCredential).toBeDefined();
+      expect(retry).toBeDefined();
+      for (const parsed of [outer!, retry!]) {
+        expect(parsed._providerContinuationOwner?.credentialIdentity).not.toBe(oldOwner!.credentialIdentity);
+        expect(parsed._reasoningReplayScope?.current?.credentialIdentity).not.toBe(oldReplayCredential);
+        expect(parsed._providerContinuation).toBeUndefined();
+        expect(parsed._cursorConversationId).toBeUndefined();
+        expect(parsed._stripReasoningEncryptedContent).toBe(true);
+        expect(parsed._dropForeignReasoningItemIds).toBe(true);
+      }
+      expect(retry!._providerContinuationOwner).toEqual(outer!._providerContinuationOwner);
+      expect(persisted?.__ocxOwner).toEqual(retry!._providerContinuationOwner);
+      expect(persisted?.__ocxOwner?.credentialIdentity).not.toBe(oldOwner!.credentialIdentity);
+      expect(persisted?.cursor?.conversationId).toBe("synthetic-B-conversation");
+    } finally { prepared.mockRestore(); }
+  });
+}

From 1be259c0d19572ff07e5237d612f0712a6d40044 Mon Sep 17 00:00:00 2001
From: JUN <jun@lidgeai.com>
Date: Fri, 16 Oct 2026 13:40:15 +0900
Subject: [PATCH 06/17] test(responses): supply the replay conversation header

---
 tests/responses/responses-auto-pause-replay-owner.test.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/responses/responses-auto-pause-replay-owner.test.ts b/tests/responses/responses-auto-pause-replay-owner.test.ts
index f7dd3689f2c..31be97d2e7f 100644
--- a/tests/responses/responses-auto-pause-replay-owner.test.ts
+++ b/tests/responses/responses-auto-pause-replay-owner.test.ts
@@ -96,7 +96,7 @@ for (const oauth of [false, true]) for (const native of [false, true]) {
     });
     try {
       const response = await handleResponses(new Request("http://localhost/v1/responses", {
-        method: "POST", headers: { "content-type": "application/json", "x-session-id": `synthetic-${oauth}-${native}` },
+        method: "POST", headers: { "content-type": "application/json", "thread-id": `synthetic-${oauth}-${native}` },
         body: JSON.stringify({ model: `${name}/fixture`, input: "synthetic", stream: false, store: false }),
       }), config, { model: "fixture", provider: name });
       const text = await response.text();

From 8a469246b2db69d599e8e36564f2748ff69670ba Mon Sep 17 00:00:00 2001
From: JUN <jun@lidgeai.com>
Date: Fri, 16 Oct 2026 13:40:44 +0900
Subject: [PATCH 07/17] fix(responses): rebind replay owners after auto-pause
 rotation

---
 src/server/responses/request-transport.ts | 9 +++++++++
 structure/account-auto-pause.md           | 2 +-
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/src/server/responses/request-transport.ts b/src/server/responses/request-transport.ts
index 2ae273145c2..5da6f25cf71 100644
--- a/src/server/responses/request-transport.ts
+++ b/src/server/responses/request-transport.ts
@@ -656,6 +656,15 @@ export async function prepareResponsesTransport(
       : !!config.providers[route.providerName]?.apiKey;
     if (!available) return false;
     await refreshDispatchAdapter(requestParsed);
+    // Bind before the recovery caller rebuilds. A terminal retry can be a clone;
+    // the outer request also owns continuation persistence and replay publication.
+    for (const replayParsed of new Set([parsed, requestParsed])) {
+      bindRouteReasoningReplayScope({
+        parsed: replayParsed, providerName: route.providerName, provider: route.provider,
+        adapterName: activeAdapter.name, oauthCredentialSnapshot: replayOAuthCredentialSnapshot,
+        forwardHeaders: requestState.selectedForwardHeaders,
+      });
+    }
     return true;
   };
   const refreshRunTurnAdapter = async (requestParsed: OcxParsedRequest): Promise<ProviderAdapter> => {
diff --git a/structure/account-auto-pause.md b/structure/account-auto-pause.md
index 47ae9e4b41b..b750007fcd7 100644
--- a/structure/account-auto-pause.md
+++ b/structure/account-auto-pause.md
@@ -26,7 +26,7 @@ Manual resume clears details and changes the revision, fencing already-sent refu
 
 `src/server/responses/request-transport.ts` observes exact physical account outcomes before
 retry wrappers replace the response. Threshold-triggered OAuth/key pauses rebuild the
-request through `src/server/responses/account-auto-pause-recovery.ts` and the existing selection owner, with at most three account moves funded by the existing recovery owner.
+request through `src/server/responses/account-auto-pause-recovery.ts` and the existing selection owner, with at most three account moves funded by the existing recovery owner. Before rebuilding, the transport binds replay and continuation ownership to the refreshed credential on both the retry request and the outer request used for persistence.
 `src/server/responses/passthrough-dispatch.ts` and
 `src/server/responses/core-codex-account.ts` admit a confirmed Codex auto-pause to the
 existing alternate-account ladder without reclassifying subscription refusal as a dead

From cbe6563c7be4758a4d6a145420ec49e0c5d60921 Mon Sep 17 00:00:00 2001
From: JUN <jun@lidgeai.com>
Date: Fri, 16 Oct 2026 13:59:49 +0900
Subject: [PATCH 08/17] test(responses): require the exact sibling replay
 identity

---
 .../responses-auto-pause-replay-owner.test.ts  | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/tests/responses/responses-auto-pause-replay-owner.test.ts b/tests/responses/responses-auto-pause-replay-owner.test.ts
index 31be97d2e7f..26c237c1fe6 100644
--- a/tests/responses/responses-auto-pause-replay-owner.test.ts
+++ b/tests/responses/responses-auto-pause-replay-owner.test.ts
@@ -3,12 +3,12 @@ import { mkdtempSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { getDefaultConfig, saveConfig } from "../../src/config";
-import { getAccountSet, saveCredential, setActiveAccount } from "../../src/oauth/store";
+import { credentialGeneration, getAccountSet, saveCredential, setActiveAccount } from "../../src/oauth/store";
 import { clearGenericFailoverHealth } from "../../src/oauth/generic-account-failover";
 import { handleResponses } from "../../src/server/responses/core";
 import * as transport from "../../src/server/responses/request-transport";
 import { createResponsesEffects } from "../../src/server/responses/response-effects";
-import { commitReasoningReplayServingIdentity } from "../../src/responses/reasoning-replay-cache";
+import { commitReasoningReplayServingIdentity, reasoningReplayKeyCredentialIdentity, reasoningReplayOAuthCredentialIdentity } from "../../src/responses/reasoning-replay-cache";
 import { flushResponseState, clearResponseStateForTests } from "../../src/responses/state";
 import type { OcxParsedRequest, OcxProviderContinuationOwner } from "../../src/types";
 import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
@@ -52,6 +52,12 @@ for (const oauth of [false, true]) for (const native of [false, true]) {
       ...(!oauth ? { apiKey: "synthetic-A", apiKeyPool: [{ id: "A", key: "synthetic-A" }, { id: "B", key: "synthetic-B" }] } : {}),
     } };
     saveConfig(config);
+    // Derive the opaque expected digest from fixture B, independently of recovery's selection.
+    const secondAccount = oauth ? getAccountSet(name)!.accounts[1]! : undefined;
+    const expectedCredentialIdentity = secondAccount
+      ? reasoningReplayOAuthCredentialIdentity({ accountId: secondAccount.id, generation: credentialGeneration(secondAccount.credential) })
+      : reasoningReplayKeyCredentialIdentity({ apiKey: "synthetic-B" });
+    expect(expectedCredentialIdentity).toBeDefined();
     const sends: string[] = [];
     globalThis.fetch = (async (_input, init) => {
       const auth = new Headers(init?.headers).get("authorization")!;
@@ -104,10 +110,12 @@ for (const oauth of [false, true]) for (const native of [false, true]) {
       expect(sends).toEqual(["Bearer synthetic-A", "Bearer synthetic-B"]);
       expect(oldOwner).toBeDefined();
       expect(oldReplayCredential).toBeDefined();
+      expect(oldOwner!.credentialIdentity).not.toBe(expectedCredentialIdentity);
+      expect(oldReplayCredential).not.toBe(expectedCredentialIdentity);
       expect(retry).toBeDefined();
       for (const parsed of [outer!, retry!]) {
-        expect(parsed._providerContinuationOwner?.credentialIdentity).not.toBe(oldOwner!.credentialIdentity);
-        expect(parsed._reasoningReplayScope?.current?.credentialIdentity).not.toBe(oldReplayCredential);
+        expect(parsed._providerContinuationOwner?.credentialIdentity).toBe(expectedCredentialIdentity);
+        expect(parsed._reasoningReplayScope?.current?.credentialIdentity).toBe(expectedCredentialIdentity);
         expect(parsed._providerContinuation).toBeUndefined();
         expect(parsed._cursorConversationId).toBeUndefined();
         expect(parsed._stripReasoningEncryptedContent).toBe(true);
@@ -115,7 +123,7 @@ for (const oauth of [false, true]) for (const native of [false, true]) {
       }
       expect(retry!._providerContinuationOwner).toEqual(outer!._providerContinuationOwner);
       expect(persisted?.__ocxOwner).toEqual(retry!._providerContinuationOwner);
-      expect(persisted?.__ocxOwner?.credentialIdentity).not.toBe(oldOwner!.credentialIdentity);
+      expect(persisted?.__ocxOwner?.credentialIdentity).toBe(expectedCredentialIdentity);
       expect(persisted?.cursor?.conversationId).toBe("synthetic-B-conversation");
     } finally { prepared.mockRestore(); }
   });

From bb6e6f15fa3082236ba8dc2311f8d175c9cca3a3 Mon Sep 17 00:00:00 2001
From: JUN <jun@lidgeai.com>
Date: Sun, 18 Oct 2026 04:47:09 +0900
Subject: [PATCH 09/17] fix(accounts): fence auto-pause against policy changes
 and address review

Persist a per-provider accountAutoPausePolicyRevisions UUID, minted only by
persistConfigUnlocked from the pre-write file when a tracked provider's
effective policy fingerprint changes. Attempts capture revision, local
generation, threshold and route; OAuth, API-key and Codex pauses commit only
while the in-memory and fresh persisted fence still match, with the OAuth
automatic publication serialized under the config mutation lock.

Also preserve key pause fields across dual-auth OAuth upserts, keep an
omitted accountAutoPause on full provider saves, accept the policy as a
canonical-provider overlay, reject non-object pause bodies, degrade
malformed pause display metadata, and fix CLI/dashboard pause messages,
translations and accessible names.
---
 .../docs/reference/configuration/providers.md |   4 +-
 gui/src/account-pause-display.ts              |  20 ++
 .../components/codex-account-pool-cards.tsx   |   3 +-
 .../provider-workspace/ProviderAuthPanel.tsx  |  10 +-
 gui/src/hooks/useProviderAccountPools.ts      |  10 +-
 gui/src/i18n/de.ts                            |   7 +
 gui/src/i18n/en.ts                            |   7 +
 gui/src/i18n/fr.ts                            |   7 +
 gui/src/i18n/ja.ts                            |   7 +
 gui/src/i18n/ko.ts                            |   7 +
 gui/src/i18n/pt.ts                            |   7 +
 gui/src/i18n/ru.ts                            |   7 +
 gui/src/i18n/tr.ts                            |   7 +
 gui/src/i18n/vi.ts                            |   7 +
 gui/src/i18n/zh-TW.ts                         |   7 +
 gui/src/i18n/zh.ts                            |   7 +
 gui/tests/account-pause-display.test.tsx      |  78 +++++++
 .../provider-account-pause-refresh.test.tsx   |  17 ++
 scripts/test-layout/layout.json               |   2 +-
 src/cli/account-api.ts                        |   3 +
 src/cli/account-extended.ts                   |  15 +-
 src/config.ts                                 |   9 +-
 src/config/account-auto-pause-revisions.ts    |  95 ++++++++
 src/config/live-reconcile.ts                  |   7 +
 src/config/persist-unlocked.ts                |  11 +-
 src/config/schema/config-schema.ts            |  12 +-
 src/oauth/account-auto-pause.ts               |  14 +-
 src/oauth/api-key-pool-preserve.ts            |  37 ++++
 src/oauth/index.ts                            |  40 +---
 src/oauth/store.ts                            |  12 +-
 src/providers/api-key-pause.ts                |   4 +-
 src/server/auth-cors.ts                       |   6 +
 src/server/management/oauth-account-routes.ts |   3 +-
 src/server/management/provider-routes.ts      |   6 +
 src/types/config.ts                           |   2 +
 structure/INDEX.md                            |   8 +
 structure/account-auto-pause.md               |  25 ++-
 structure/manifest.json                       |  10 +-
 structure/providers-and-adapters.md           |   4 +-
 structure/runtime.md                          |   2 +-
 structure/transports/responses-failover.md    |   2 +-
 tests/cli/cli-account-key-pause.test.ts       |  60 +++++
 ...onfig-account-auto-pause-revisions.test.ts | 167 ++++++++++++++
 tests/fixtures/test-layout-expected.json      |   2 +-
 .../oauth-account-auto-pause-revision.test.ts | 208 ++++++++++++++++++
 .../oauth/oauth-upsert-paused-api-key.test.ts |  61 +++++
 .../management-account-auto-pause.test.ts     | 135 ++++++++++++
 47 files changed, 1106 insertions(+), 75 deletions(-)
 create mode 100644 gui/src/account-pause-display.ts
 create mode 100644 gui/tests/account-pause-display.test.tsx
 create mode 100644 src/config/account-auto-pause-revisions.ts
 create mode 100644 src/oauth/api-key-pool-preserve.ts
 create mode 100644 tests/cli/cli-account-key-pause.test.ts
 create mode 100644 tests/config/config-account-auto-pause-revisions.test.ts
 create mode 100644 tests/oauth/oauth-account-auto-pause-revision.test.ts
 create mode 100644 tests/oauth/oauth-upsert-paused-api-key.test.ts
 create mode 100644 tests/server/management-account-auto-pause.test.ts

diff --git a/docs-site/src/content/docs/reference/configuration/providers.md b/docs-site/src/content/docs/reference/configuration/providers.md
index 72e3249b7bf..7244b396296 100644
--- a/docs-site/src/content/docs/reference/configuration/providers.md
+++ b/docs-site/src/content/docs/reference/configuration/providers.md
@@ -1922,7 +1922,9 @@ The counter is process-local, serialized per account, and resets on a successful
 response, explicit resume or a new login. Token refresh alone does not reset an OAuth
 account's streak. Transient errors leave the counter unchanged. Restarting the proxy clears
 counters; completed pauses, their fixed reason codes and timestamps persist. Independent
-proxy processes maintain independent counters.
+proxy processes maintain independent counters. Changing, disabling or re-enabling the policy, disabling the provider,
+or changing its endpoint discards in-flight refusal observations, so a refusal from a request
+sent under the earlier policy can never pause an account afterwards.
 
 At the threshold, OpenCodex excludes the account using its existing pause mechanism and
 attempts an eligible sibling for the current request within the existing retry/send budget.
diff --git a/gui/src/account-pause-display.ts b/gui/src/account-pause-display.ts
new file mode 100644
index 00000000000..3a656bfe89d
--- /dev/null
+++ b/gui/src/account-pause-display.ts
@@ -0,0 +1,20 @@
+import type { AccountPauseReason } from "../../src/types/account-auto-pause";
+import type { Locale, TFn, TKey } from "./i18n/shared";
+
+const REASON_KEYS = {
+  oauth_organization_disabled: "accountPause.reason.organizationDisabled",
+  account_permission_denied: "accountPause.reason.permissionDenied",
+  subscription_inactive: "accountPause.reason.subscriptionInactive",
+  subscription_expired: "accountPause.reason.subscriptionExpired",
+  plan_downgraded: "accountPause.reason.planDowngraded",
+} satisfies Record<AccountPauseReason, TKey>;
+
+/** Display fixed reason labels and timestamps in the selected dashboard language. */
+export function formatAccountPauseTooltip(
+  t: TFn, locale: Locale, details: { reason: string; pausedAt: number },
+): string {
+  const reason = Object.hasOwn(REASON_KEYS, details.reason)
+    ? t(REASON_KEYS[details.reason as AccountPauseReason]) : t("codexAuth.paused");
+  const date = new Date(details.pausedAt);
+  return Number.isNaN(date.getTime()) ? reason : t("accountPause.tooltip", { reason, date: date.toLocaleString(locale) });
+}
diff --git a/gui/src/components/codex-account-pool-cards.tsx b/gui/src/components/codex-account-pool-cards.tsx
index daa95e26e84..d6d015dff1b 100644
--- a/gui/src/components/codex-account-pool-cards.tsx
+++ b/gui/src/components/codex-account-pool-cards.tsx
@@ -1,4 +1,5 @@
 import { useState } from "react";
+import { formatAccountPauseTooltip } from "../account-pause-display";
 import { useT, useI18n } from "../i18n/shared";
 import { useCopyFeedback } from "./use-copy-feedback";
 import { IconAlert, IconPause, IconPlay, IconX } from "../icons";
@@ -118,7 +119,7 @@ export function CodexAccountPoolCards({
                 </span>
               )}
               {a.paused && (
-                <span className="badge badge-muted" title={a.pauseDetails ? `${a.pauseDetails.reason} · ${new Date(a.pauseDetails.pausedAt).toLocaleString()}` : t("codexAuth.pausedHint")}>
+                <span className="badge badge-muted" title={a.pauseDetails ? formatAccountPauseTooltip(t, locale, a.pauseDetails) : t("codexAuth.pausedHint")}>
                   {t("codexAuth.paused")}
                 </span>
               )}
diff --git a/gui/src/components/provider-workspace/ProviderAuthPanel.tsx b/gui/src/components/provider-workspace/ProviderAuthPanel.tsx
index 131a446fe45..d6f6b0c833c 100644
--- a/gui/src/components/provider-workspace/ProviderAuthPanel.tsx
+++ b/gui/src/components/provider-workspace/ProviderAuthPanel.tsx
@@ -5,7 +5,8 @@ import { anthropicInstanceRowShapeMatches, isAnthropicInstanceId } from "../../.
  * handlers via props-down; no internal auth machinery.
  */
 import { useEffect, useMemo, useRef, useState } from "react";
-import { useT } from "../../i18n/shared";
+import { useT, useI18n } from "../../i18n/shared";
+import { formatAccountPauseTooltip } from "../../account-pause-display";
 import { IconLock, IconRefresh, IconTrash } from "../../icons";
 import type { WorkspaceItem } from "../../provider-workspace/catalog";
 import { oauthAccountDisplayLabel, providerAuthSurface } from "../../provider-workspace/auth";
@@ -201,6 +202,7 @@ export default function ProviderAuthPanel({
   codexController?: CodexAccountPoolController;
 }) {
   const t = useT();
+  const { locale } = useI18n();
   const [addingKey, setAddingKey] = useState(false);
   const [kiroChooser, setKiroChooser] = useState<{ addAccount: boolean } | null>(null);
   const kiroLoginTriggerRef = useRef<HTMLButtonElement>(null);
@@ -589,7 +591,7 @@ export default function ProviderAuthPanel({
                       )}
                       {showReauth && !healthLabel && <span className="badge badge-amber">{t("pws.reauth")}</span>}
                       {kiroSkipReasonKey(account, item.name) && <span className="badge badge-amber">{t(kiroSkipReasonKey(account, item.name)!)}</span>}
-                      {account.paused && <span className="badge badge-muted" title={account.pauseDetails ? `${account.pauseDetails.reason} · ${new Date(account.pauseDetails.pausedAt).toLocaleString()}` : undefined}>{t("codexAuth.paused")}</span>}
+                      {account.paused && <span className="badge badge-muted" title={account.pauseDetails ? formatAccountPauseTooltip(t, locale, account.pauseDetails) : undefined}>{t("codexAuth.paused")}</span>}
                       {account.active && !account.paused && <span className="badge badge-primary">{t("prov.accountActive")}</span>}
                       {switching && <span className="badge badge-muted">{t("pws.accountSwitching")}</span>}
                     </button>
@@ -722,13 +724,13 @@ export default function ProviderAuthPanel({
                     <div className={`pwi-auth-row${entry.active ? " pwi-auth-row--active" : ""}`}>
                     <button type="button" className="pwi-auth-row-main"
                       onClick={() => void authHandlers.onSwitchApiKey(item.name, entry)}
-                      disabled={entry.active && !entry.disabled} aria-label={entry.disabled ? t("codexAuth.resume") : undefined}>
+                      disabled={entry.active && !entry.disabled} aria-label={entry.disabled ? `${t("codexAuth.resume")} — ${entry.label ?? entry.masked}` : undefined}>
                       <span className={`pwi-auth-dot ${entry.active ? "pwi-auth-dot--ok" : "pwi-auth-dot--off"}`} aria-hidden="true" />
                       <span className="pwi-auth-row-copy">
                         <span className="pwi-auth-row-label">{entry.label ?? entry.masked}</span>
                         {entry.label && <code className="pwi-auth-row-secondary">{entry.masked} · {t("prov.accountId")}: {entry.id}</code>}
                       </span>
-                      {entry.disabled && <span className="badge badge-muted" title={entry.pauseDetails ? `${entry.pauseDetails.reason} · ${new Date(entry.pauseDetails.pausedAt).toLocaleString()}` : undefined}>{t("codexAuth.paused")} · {t("codexAuth.resume")}</span>}
+                      {entry.disabled && <span className="badge badge-muted" title={entry.pauseDetails ? formatAccountPauseTooltip(t, locale, entry.pauseDetails) : undefined}>{t("codexAuth.paused")} · {t("codexAuth.resume")}</span>}
                       {entry.active && !entry.disabled && <span className="badge badge-primary">{t("prov.accountActive")}</span>}
                     </button>
                     <button type="button" className="btn btn-ghost btn-sm"
diff --git a/gui/src/hooks/useProviderAccountPools.ts b/gui/src/hooks/useProviderAccountPools.ts
index 7cd01786ade..81011166529 100644
--- a/gui/src/hooks/useProviderAccountPools.ts
+++ b/gui/src/hooks/useProviderAccountPools.ts
@@ -555,17 +555,19 @@ export function useProviderAccountPools(deps: {
     const mutation = Symbol();
     selectionMutationsRef.current.set(key, mutation);
     const currentMutation = () => aliveRef.current && mountedRef.current && serverRef.current === apiBase && selectionMutationsRef.current.get(key) === mutation;
+    let resumed = false;
     try {
       if (entry.disabled) {
-        const resumed = await fetch(`${apiBase}/api/providers/keys/pause`, { method: "PUT", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ name: provider, id: entry.id, paused: false }) });
+        const resumeResponse = await fetch(`${apiBase}/api/providers/keys/pause`, { method: "PUT", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ name: provider, id: entry.id, paused: false }) });
         if (!currentMutation()) return;
-        if (!resumed.ok) { notify(t("prov.keySwitchFail"), false); return; }
+        if (!resumeResponse.ok) { notify(t("prov.keySwitchFail"), false); return; }
+        resumed = true;
       }
       const res = await fetch(`${apiBase}/api/providers/keys/active`, { method: "PUT", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ name: provider, id: entry.id }) });
       if (!currentMutation()) return;
       if (!res.ok) {
         const failure = await res.json().catch(() => ({})) as { error?: string };
-        if (currentMutation()) notify(failure.error || t("prov.keySwitchFail"), false);
+        if (currentMutation()) notify(resumed ? t("prov.keyResumedSwitchFailed") : failure.error || t("prov.keySwitchFail"), false);
         return;
       }
       const data = await res.json().catch(() => ({})) as { activeId?: string | null };
@@ -576,7 +578,7 @@ export function useProviderAccountPools(deps: {
       notify(t("prov.keySwitched", { key: entry.label ?? entry.masked }), true);
       void fetchProviderQuotas(true);
     } catch {
-      if (currentMutation()) notify(t("prov.keySwitchFail"), false);
+      if (currentMutation()) notify(t(resumed ? "prov.keyResumedSwitchFailed" : "prov.keySwitchFail"), false);
     } finally {
       if (currentMutation()) {
         invalidateSelectionReads(provider, "api-key");
diff --git a/gui/src/i18n/de.ts b/gui/src/i18n/de.ts
index 22c5edac19d..184afc5e096 100644
--- a/gui/src/i18n/de.ts
+++ b/gui/src/i18n/de.ts
@@ -1977,6 +1977,13 @@ export const de: Record<TKey, string> = {
   "codexAuth.resumeSucceeded": "{email} ist wieder im Pool verfügbar",
   "codexAuth.pauseFailed": "{email} konnte nicht pausiert werden. Es wurde nichts geändert.",
   "codexAuth.resumeFailed": "{email} konnte nicht fortgesetzt werden. Es wurde nichts geändert.",
+  "accountPause.tooltip": "{reason} · {date}",
+  "accountPause.reason.organizationDisabled": "Organisation deaktiviert",
+  "accountPause.reason.permissionDenied": "Kontoberechtigung verweigert",
+  "accountPause.reason.subscriptionInactive": "Abonnement inaktiv",
+  "accountPause.reason.subscriptionExpired": "Abonnement abgelaufen",
+  "accountPause.reason.planDowngraded": "Tarif herabgestuft",
+  "prov.keyResumedSwitchFailed": "Schlüssel fortgesetzt, aber Aktivierung fehlgeschlagen. Der Schlüssel kann automatisch ausgewählt werden. Wählen Sie ihn erneut aus.",
   "codexAuth.pausedHint": "Bis zur Fortsetzung von automatischem Wechsel, Wiederholungen, Cooldown-Wiederherstellung und manueller Auswahl ausgeschlossen.",
   "codexAuth.creditsAfterLimit": "Credits nach dem Limit nutzen",
   "codexAuth.creditsAfterLimitHint": "Standardmäßig aus: Ein Konto, dessen Nutzungsfenster 100 % erreicht, wird bis zum Zurücksetzen ausgewechselt, sodass seine ChatGPT-Credits nicht verbraucht werden. Schalte ein Konto ein, damit es mit seinen Credits weiterarbeitet. Neue Konten starten ausgeschaltet.",
diff --git a/gui/src/i18n/en.ts b/gui/src/i18n/en.ts
index 350a21304ae..7c50d7f2831 100644
--- a/gui/src/i18n/en.ts
+++ b/gui/src/i18n/en.ts
@@ -2599,6 +2599,13 @@ export const en = {
   "codexAuth.resumeSucceeded": "{email} is available to the pool again",
   "codexAuth.pauseFailed": "Could not pause {email}. Nothing was changed.",
   "codexAuth.resumeFailed": "Could not resume {email}. Nothing was changed.",
+  "accountPause.tooltip": "{reason} · {date}",
+  "accountPause.reason.organizationDisabled": "Organization disabled",
+  "accountPause.reason.permissionDenied": "Account permission denied",
+  "accountPause.reason.subscriptionInactive": "Subscription inactive",
+  "accountPause.reason.subscriptionExpired": "Subscription expired",
+  "accountPause.reason.planDowngraded": "Plan downgraded",
+  "prov.keyResumedSwitchFailed": "Key resumed, but activation failed. The key is eligible for automatic selection. Try selecting it again.",
   "codexAuth.pausedHint": "Excluded from automatic switching, retries, cooldown recovery, and manual selection until resumed.",
   "codexAuth.creditsAfterLimit": "Use credits after limit",
   "codexAuth.creditsAfterLimitHint": "Off by default: an account whose usage window reaches 100% is switched out until it resets, so its ChatGPT credits are not spent. Turn an account on to let it keep working from its credits. New accounts start off.",
diff --git a/gui/src/i18n/fr.ts b/gui/src/i18n/fr.ts
index a17e39b0bd0..f0cd9d2b2ca 100644
--- a/gui/src/i18n/fr.ts
+++ b/gui/src/i18n/fr.ts
@@ -2526,6 +2526,13 @@ export const fr: Record<TKey, string> = {
   "codexAuth.resumeSucceeded": "{email} est de nouveau disponible dans le groupe",
   "codexAuth.pauseFailed": "Impossible de suspendre {email}. Aucune modification apportée.",
   "codexAuth.resumeFailed": "Impossible de réactiver {email}. Aucune modification apportée.",
+  "accountPause.tooltip": "{reason} · {date}",
+  "accountPause.reason.organizationDisabled": "Organisation désactivée",
+  "accountPause.reason.permissionDenied": "Accès au compte refusé",
+  "accountPause.reason.subscriptionInactive": "Abonnement inactif",
+  "accountPause.reason.subscriptionExpired": "Abonnement expiré",
+  "accountPause.reason.planDowngraded": "Offre rétrogradée",
+  "prov.keyResumedSwitchFailed": "Clé réactivée, mais la sélection a échoué. La clé peut être sélectionnée automatiquement. Essayez de la sélectionner à nouveau.",
   "codexAuth.pausedHint": "Exclu du changement automatique, des nouvelles tentatives, de la récupération après délai et de la sélection manuelle jusqu’à sa réactivation.",
   "codexAuth.creditsAfterLimit": "Utiliser les crédits après la limite",
   "codexAuth.creditsAfterLimitHint": "Désactivé par défaut : un compte dont une fenêtre d’utilisation atteint 100 % est remplacé jusqu’à sa réinitialisation, et ses crédits ChatGPT ne sont pas dépensés. Activez un compte pour qu’il continue avec ses crédits. Les nouveaux comptes démarrent désactivés.",
diff --git a/gui/src/i18n/ja.ts b/gui/src/i18n/ja.ts
index 08799fa8f3f..d6d55fd4a23 100644
--- a/gui/src/i18n/ja.ts
+++ b/gui/src/i18n/ja.ts
@@ -2421,6 +2421,13 @@ export const ja: Record<TKey, string> = {
   "codexAuth.resumeSucceeded": "{email} をアカウントプールに戻しました",
   "codexAuth.pauseFailed": "{email} を一時停止できませんでした。変更はありません。",
   "codexAuth.resumeFailed": "{email} を再開できませんでした。変更はありません。",
+  "accountPause.tooltip": "{reason} · {date}",
+  "accountPause.reason.organizationDisabled": "組織が無効",
+  "accountPause.reason.permissionDenied": "アカウントの権限が拒否されました",
+  "accountPause.reason.subscriptionInactive": "サブスクリプションが無効",
+  "accountPause.reason.subscriptionExpired": "サブスクリプションの期限切れ",
+  "accountPause.reason.planDowngraded": "プランがダウングレードされました",
+  "prov.keyResumedSwitchFailed": "キーの一時停止は解除されましたが、有効化に失敗しました。自動選択は可能です。もう一度選択してください。",
   "codexAuth.pausedHint": "再開するまで、自動切り替え、再試行、クールダウン復旧、手動選択の対象外です。",
   "codexAuth.creditsAfterLimit": "上限後にクレジットを使用",
   "codexAuth.creditsAfterLimitHint": "既定はオフです。使用量ウィンドウが100%に達したアカウントはリセットまで別のアカウントに切り替わり、ChatGPTクレジットを消費しません。オンにしたアカウントだけが上限後もクレジットで使われます。新しいアカウントはオフで始まります。",
diff --git a/gui/src/i18n/ko.ts b/gui/src/i18n/ko.ts
index 0781408ca97..af4a7427a0c 100644
--- a/gui/src/i18n/ko.ts
+++ b/gui/src/i18n/ko.ts
@@ -2021,6 +2021,13 @@ export const ko: Record<TKey, string> = {
   "codexAuth.resumeSucceeded": "{email} 계정을 풀에서 다시 사용할 수 있습니다",
   "codexAuth.pauseFailed": "{email} 계정을 일시 중지하지 못했습니다. 변경 사항이 없습니다.",
   "codexAuth.resumeFailed": "{email} 계정을 재개하지 못했습니다. 변경 사항이 없습니다.",
+  "accountPause.tooltip": "{reason} · {date}",
+  "accountPause.reason.organizationDisabled": "조직 비활성화",
+  "accountPause.reason.permissionDenied": "계정 권한 거부",
+  "accountPause.reason.subscriptionInactive": "구독 비활성",
+  "accountPause.reason.subscriptionExpired": "구독 만료",
+  "accountPause.reason.planDowngraded": "요금제 하향 변경",
+  "prov.keyResumedSwitchFailed": "키의 일시 중지는 해제했지만 활성화하지 못했습니다. 자동 선택은 가능합니다. 다시 선택해 주세요.",
   "codexAuth.pausedHint": "재개할 때까지 자동 전환, 재시도, 쿨다운 복구 및 수동 선택에서 제외됩니다.",
   "codexAuth.creditsAfterLimit": "한도 도달 후 크레딧 사용",
   "codexAuth.creditsAfterLimitHint": "기본은 꺼짐입니다. 사용량이 100%에 도달한 계정은 리셋될 때까지 다른 계정으로 전환되어 ChatGPT 크레딧을 쓰지 않습니다. 켠 계정만 한도 이후에도 크레딧으로 계속 사용됩니다. 새로 추가한 계정은 꺼진 상태로 시작합니다.",
diff --git a/gui/src/i18n/pt.ts b/gui/src/i18n/pt.ts
index 5d0f1dd1761..e9840564465 100644
--- a/gui/src/i18n/pt.ts
+++ b/gui/src/i18n/pt.ts
@@ -2572,6 +2572,13 @@ export const pt: Record<TKey, string> = {
   "codexAuth.resumeSucceeded": "{email} voltou a ficar disponível para o pool",
   "codexAuth.pauseFailed": "Não foi possível pausar {email}. Nada foi alterado.",
   "codexAuth.resumeFailed": "Não foi possível retomar {email}. Nada foi alterado.",
+  "accountPause.tooltip": "{reason} · {date}",
+  "accountPause.reason.organizationDisabled": "Organização desativada",
+  "accountPause.reason.permissionDenied": "Permissão da conta negada",
+  "accountPause.reason.subscriptionInactive": "Assinatura inativa",
+  "accountPause.reason.subscriptionExpired": "Assinatura expirada",
+  "accountPause.reason.planDowngraded": "Plano rebaixado",
+  "prov.keyResumedSwitchFailed": "A chave foi retomada, mas a ativação falhou. A chave está disponível para seleção automática. Tente selecioná-la novamente.",
   "codexAuth.pausedHint": "Excluída da troca automática, das novas tentativas, da recuperação de cooldown e da seleção manual até ser retomada.",
   "codexAuth.creditsAfterLimit": "Usar créditos após o limite",
   "codexAuth.creditsAfterLimitHint": "Desativado por padrão: uma conta cuja janela de uso chega a 100% é retirada de uso até a janela reiniciar, para que seus créditos do ChatGPT não sejam gastos. Ative em uma conta para que ela continue trabalhando com seus créditos. Contas novas começam desativadas.",
diff --git a/gui/src/i18n/ru.ts b/gui/src/i18n/ru.ts
index ad8863b0cce..c78eb9d8b72 100644
--- a/gui/src/i18n/ru.ts
+++ b/gui/src/i18n/ru.ts
@@ -2512,6 +2512,13 @@ export const ru: Record<TKey, string> = {
   "codexAuth.resumeSucceeded": "Аккаунт {email} снова доступен в пуле",
   "codexAuth.pauseFailed": "Не удалось приостановить {email}. Изменений нет.",
   "codexAuth.resumeFailed": "Не удалось возобновить {email}. Изменений нет.",
+  "accountPause.tooltip": "{reason} · {date}",
+  "accountPause.reason.organizationDisabled": "Организация отключена",
+  "accountPause.reason.permissionDenied": "Доступ к аккаунту запрещён",
+  "accountPause.reason.subscriptionInactive": "Подписка неактивна",
+  "accountPause.reason.subscriptionExpired": "Подписка истекла",
+  "accountPause.reason.planDowngraded": "Тариф понижен",
+  "prov.keyResumedSwitchFailed": "Ключ возобновлён, но активация не удалась. Ключ доступен для автоматического выбора. Попробуйте выбрать его снова.",
   "codexAuth.pausedHint": "До возобновления исключён из автоматического переключения, повторов, восстановления после задержки и ручного выбора.",
   "codexAuth.creditsAfterLimit": "Кредиты после лимита",
   "codexAuth.creditsAfterLimitHint": "По умолчанию выключено: аккаунт, у которого окно использования достигло 100%, заменяется до сброса, и его кредиты ChatGPT не тратятся. Включите эту настройку для аккаунта, чтобы он продолжал работать за счёт кредитов. Новые аккаунты начинают с выключенной настройкой.",
diff --git a/gui/src/i18n/tr.ts b/gui/src/i18n/tr.ts
index 147e954d1c9..f5babcc2e80 100644
--- a/gui/src/i18n/tr.ts
+++ b/gui/src/i18n/tr.ts
@@ -2550,6 +2550,13 @@ export const tr: Record<TKey, string> = {
   "codexAuth.resumeSucceeded": "{email} tekrar havuza alındı",
   "codexAuth.pauseFailed": "{email} duraklatılamadı.",
   "codexAuth.resumeFailed": "{email} devam ettirilemedi.",
+  "accountPause.tooltip": "{reason} · {date}",
+  "accountPause.reason.organizationDisabled": "Kuruluş devre dışı",
+  "accountPause.reason.permissionDenied": "Hesap izni reddedildi",
+  "accountPause.reason.subscriptionInactive": "Abonelik etkin değil",
+  "accountPause.reason.subscriptionExpired": "Abonelik süresi doldu",
+  "accountPause.reason.planDowngraded": "Plan düşürüldü",
+  "prov.keyResumedSwitchFailed": "Anahtarın duraklatılması kaldırıldı ancak etkinleştirme başarısız oldu. Anahtar otomatik olarak seçilebilir. Yeniden seçmeyi deneyin.",
   "codexAuth.pausedHint": "Devam ettirilene kadar otomatik seçimden hariç tutulur.",
   "codexAuth.creditsAfterLimit": "Limitten sonra kredi kullan",
   "codexAuth.creditsAfterLimitHint": "Varsayılan olarak kapalı: kullanım penceresi %100’e ulaşan hesap sıfırlanana kadar otomatik seçim dışında kalır ve ChatGPT kredileri harcanmaz. Bir hesabın kredileriyle çalışmaya devam etmesi için bu ayarı açın. Yeni hesaplar kapalı başlar.",
diff --git a/gui/src/i18n/vi.ts b/gui/src/i18n/vi.ts
index 18fa8b93963..b2c5f729ad0 100644
--- a/gui/src/i18n/vi.ts
+++ b/gui/src/i18n/vi.ts
@@ -2547,6 +2547,13 @@ export const vi: Record<TKey, string> = {
   "codexAuth.resumeSucceeded": "{email} đã có mặt lại trong pool",
   "codexAuth.pauseFailed": "Không thể ngưng {email}. Không có thay đổi nào.",
   "codexAuth.resumeFailed": "Không thể tiếp tục {email}. Không có thay đổi nào.",
+  "accountPause.tooltip": "{reason} · {date}",
+  "accountPause.reason.organizationDisabled": "Tổ chức đã bị vô hiệu hóa",
+  "accountPause.reason.permissionDenied": "Quyền truy cập tài khoản bị từ chối",
+  "accountPause.reason.subscriptionInactive": "Gói đăng ký không hoạt động",
+  "accountPause.reason.subscriptionExpired": "Gói đăng ký đã hết hạn",
+  "accountPause.reason.planDowngraded": "Gói đã bị hạ cấp",
+  "prov.keyResumedSwitchFailed": "Khóa đã được tiếp tục nhưng kích hoạt thất bại. Khóa có thể được chọn tự động. Hãy thử chọn lại.",
   "codexAuth.pausedHint": "Được loại trừ khỏi luân phiên tự động, thử lại, hồi phục sau thời gian chờ, và lựa chọn thủ công cho đến khi tiếp tục.",
   "codexAuth.creditsAfterLimit": "Dùng tín dụng sau giới hạn",
   "codexAuth.creditsAfterLimitHint": "Mặc định tắt: tài khoản có cửa sổ sử dụng đạt 100% sẽ được thay thế cho đến khi đặt lại, nên tín dụng ChatGPT của nó không bị tiêu. Bật một tài khoản để nó tiếp tục chạy bằng tín dụng. Tài khoản mới bắt đầu ở trạng thái tắt.",
diff --git a/gui/src/i18n/zh-TW.ts b/gui/src/i18n/zh-TW.ts
index 783ea79a4fc..fed5f3564f9 100644
--- a/gui/src/i18n/zh-TW.ts
+++ b/gui/src/i18n/zh-TW.ts
@@ -1929,6 +1929,13 @@ export const zhTW: Record<TKey, string> = {
   "codexAuth.resumeSucceeded": "{email} 已重新加入帳號池",
   "codexAuth.pauseFailed": "無法暫停 {email}，未做任何變更。",
   "codexAuth.resumeFailed": "無法恢復 {email}，未做任何變更。",
+  "accountPause.tooltip": "{reason} · {date}",
+  "accountPause.reason.organizationDisabled": "組織已停用",
+  "accountPause.reason.permissionDenied": "帳戶權限遭拒",
+  "accountPause.reason.subscriptionInactive": "訂閱未啟用",
+  "accountPause.reason.subscriptionExpired": "訂閱已到期",
+  "accountPause.reason.planDowngraded": "方案已降級",
+  "prov.keyResumedSwitchFailed": "金鑰已恢復，但啟用失敗。此金鑰可被自動選取，請嘗試重新選取。",
   "codexAuth.pausedHint": "恢復前不會參與自動切換、重試、冷卻恢復或手動選擇。",
   "codexAuth.creditsAfterLimit": "達到上限後使用額度",
   "codexAuth.creditsAfterLimitHint": "預設關閉：用量視窗達到 100% 的帳戶會被切換出去，直到重設，不消耗其 ChatGPT 額度。開啟某個帳戶後，它在達到上限後仍會使用額度繼續運作。新帳戶預設關閉。",
diff --git a/gui/src/i18n/zh.ts b/gui/src/i18n/zh.ts
index dacb18d70ea..9192f498b2f 100644
--- a/gui/src/i18n/zh.ts
+++ b/gui/src/i18n/zh.ts
@@ -1994,6 +1994,13 @@ export const zh: Record<TKey, string> = {
   "codexAuth.resumeSucceeded": "{email} 已重新加入账号池",
   "codexAuth.pauseFailed": "无法暂停 {email}，未做任何更改。",
   "codexAuth.resumeFailed": "无法恢复 {email}，未做任何更改。",
+  "accountPause.tooltip": "{reason} · {date}",
+  "accountPause.reason.organizationDisabled": "组织已停用",
+  "accountPause.reason.permissionDenied": "账户权限被拒绝",
+  "accountPause.reason.subscriptionInactive": "订阅未激活",
+  "accountPause.reason.subscriptionExpired": "订阅已过期",
+  "accountPause.reason.planDowngraded": "套餐已降级",
+  "prov.keyResumedSwitchFailed": "密钥已恢复，但激活失败。该密钥可被自动选择，请尝试重新选择。",
   "codexAuth.pausedHint": "恢复前不会参与自动切换、重试、冷却恢复或手动选择。",
   "codexAuth.creditsAfterLimit": "达到上限后使用额度",
   "codexAuth.creditsAfterLimitHint": "默认关闭：用量窗口达到 100% 的账户会被切换出去，直到重置，不消耗其 ChatGPT 额度。打开某个账户后，它在达到上限后仍会使用额度继续工作。新账户默认关闭。",
diff --git a/gui/tests/account-pause-display.test.tsx b/gui/tests/account-pause-display.test.tsx
new file mode 100644
index 00000000000..47fcf8ce490
--- /dev/null
+++ b/gui/tests/account-pause-display.test.tsx
@@ -0,0 +1,78 @@
+import { expect, test } from "bun:test";
+import { renderToStaticMarkup } from "react-dom/server";
+import type { ReactNode } from "react";
+import { Window } from "happy-dom";
+import ProviderAuthPanel from "../src/components/provider-workspace/ProviderAuthPanel";
+import { CodexAccountPoolCards } from "../src/components/codex-account-pool-cards";
+import type { ProviderAuthHandlers } from "../src/components/provider-workspace/types";
+import type { WorkspaceItem } from "../src/provider-workspace/catalog";
+import { I18nContext, DICTS, interpolate, LOCALES, type Locale, type TFn } from "../src/i18n/shared";
+import { formatAccountPauseTooltip } from "../src/account-pause-display";
+import { ACCOUNT_PAUSE_REASONS } from "../../src/types/account-auto-pause";
+
+const details = { reason: "subscription_expired", pausedAt: Date.UTC(2026, 0, 15, 13, 42) };
+const translator = (locale: Locale): TFn => (key, vars) => interpolate(DICTS[locale][key], vars);
+const handlers = {
+  onLogin() {}, onLogout() {}, onReauth() {}, onSwitchAccount() {}, onPauseAccount() {},
+  onRemoveAccount() {}, onAddApiKey: async () => true, onSwitchApiKey() {}, onRemoveApiKey() {}, onEditAlias() {},
+} satisfies ProviderAuthHandlers;
+
+function render(node: ReactNode, locale: Locale) {
+  const win = new Window();
+  win.document.body.innerHTML = renderToStaticMarkup(
+    <I18nContext.Provider value={{ locale, setLocale() {}, t: translator(locale) }}>{node}</I18nContext.Provider>,
+  );
+  return win;
+}
+
+test.each(LOCALES)("all pause reasons and partial-success copy exist in $code", ({ code }) => {
+  const t = translator(code);
+  for (const reason of ACCOUNT_PAUSE_REASONS) {
+    const text = formatAccountPauseTooltip(t, code, { ...details, reason });
+    expect(text).toContain(new Date(details.pausedAt).toLocaleString(code));
+    expect(text).not.toContain(reason);
+    expect(text).not.toStartWith(`${t("codexAuth.paused")} ·`);
+  }
+  expect(DICTS[code]["prov.keyResumedSwitchFailed"].length).toBeGreaterThan(20);
+});
+
+test.each(["fr", "ko"] as const)("provider OAuth and key tooltips use the app locale %s", locale => {
+  const t = translator(locale);
+  const expected = `${t("accountPause.reason.subscriptionExpired")} · ${new Date(details.pausedAt).toLocaleString(locale)}`;
+  for (const authMode of ["oauth", "key"] as const) {
+    const item = { name: "fixture", authMode, adapter: "openai", hasApiKey: authMode === "key" } as WorkspaceItem;
+    const win = render(<ProviderAuthPanel item={item} apiBase="" oauth={{ loggedIn: true }} authHandlers={handlers}
+      accounts={[{ id: "account-fixture", alias: "Reserve account", active: false, paused: true, pauseDetails: details }]}
+      keys={[{ id: "key-fixture", label: "Reserve key", masked: "****", active: false, disabled: true, pauseDetails: details }]} />, locale);
+    try {
+      expect(win.document.querySelector(".badge-muted[title]")?.getAttribute("title")).toBe(expected);
+      if (authMode === "key") {
+        expect(win.document.querySelector(".pwi-auth-row-main")?.getAttribute("aria-label"))
+          .toBe(`${t("codexAuth.resume")} — Reserve key`);
+      }
+    } finally { void win.happyDOM.close(); }
+  }
+});
+
+test("Codex tooltip shares the translated reason and app locale date", () => {
+  const locale = "fr";
+  const t = translator(locale);
+  const noop = () => {};
+  const win = render(<CodexAccountPoolCards
+    pool={[{ id: "fixture", email: "fixture@example.test", isMain: false, paused: true, pauseDetails: details,
+      priority: 0, autoSwitchThresholdOverride: null, hasCredential: true, quota: null }]}
+    activeId={null} accountModeState={null} switchActionLabel="Switch" threshold={0}
+    onOpenReset={noop} onSwitch={noop} onTogglePause={noop} pauseUpdatingId={null} pauseBusy={false}
+    onPriorityChange={noop} priorityUpdatingId={null} onAutoSwitchThresholdChange={async () => true}
+    autoSwitchDisabled={false} switchingId={null} onUnpin={noop} onReauth={noop} onEditAlias={noop} onRemove={noop}
+  />, locale);
+  try {
+    expect(win.document.querySelector(".badge-muted[title]")?.getAttribute("title"))
+      .toBe(`${t("accountPause.reason.subscriptionExpired")} · ${new Date(details.pausedAt).toLocaleString(locale)}`);
+  } finally { void win.happyDOM.close(); }
+});
+
+test("unknown display reasons use a translated pause label", () => {
+  expect(formatAccountPauseTooltip(translator("ko"), "ko", { reason: "future_reason", pausedAt: NaN }))
+    .toBe(DICTS.ko["codexAuth.paused"]);
+});
diff --git a/gui/tests/provider-account-pause-refresh.test.tsx b/gui/tests/provider-account-pause-refresh.test.tsx
index 73e77378443..5c6f1b32fc0 100644
--- a/gui/tests/provider-account-pause-refresh.test.tsx
+++ b/gui/tests/provider-account-pause-refresh.test.tsx
@@ -230,3 +230,20 @@ test("a failed key resume never attempts activation", async () => {
   expect(writes).toEqual(["/pause-hook/api/providers/keys/pause"]);
   expect(notices).toContainEqual({ key: "prov.keySwitchFail", ok: false });
 });
+
+test.each(["http", "transport"])("a resumed key reports partial success when activation fails via %s", async failure => {
+  const entry = { id: "key-fixture", masked: "****", active: false, disabled: true };
+  respond = async (url, init) => {
+    if (init?.method === "PUT" && url.endsWith("/active")) {
+      if (failure === "transport") throw new Error("fixture offline");
+      return Response.json({ error: "fixture activation refused" }, { status: 503 });
+    }
+    if (init?.method === "PUT") return Response.json({ ok: true });
+    return Response.json({ keys: [{ ...entry, disabled: false }] });
+  };
+  await act(async () => { pools.setKeyPools({ fixture: [entry] }); });
+  await act(async () => { await pools.switchApiKey("fixture", entry); });
+  expect(notices).toContainEqual({ key: "prov.keyResumedSwitchFailed", ok: false });
+  expect(notices.some(notice => notice.key === "prov.keySwitchFail")).toBe(false);
+  expect(pools.keyPools.fixture[0]?.disabled).toBe(false);
+});
diff --git a/scripts/test-layout/layout.json b/scripts/test-layout/layout.json
index 2e2c6f62f60..a5f0d191d9d 100644
--- a/scripts/test-layout/layout.json
+++ b/scripts/test-layout/layout.json
@@ -4,7 +4,7 @@
   "explicitShards": ["layout-clients.json"],
   "explicit": { "codex-provider-routing.test.ts": "codex-integration", "config-native-reasoning-retention.test.ts": "config", "server-native-reasoning-retention-merge.test.ts": "server", "server-native-reasoning-retention.test.ts": "server", "responses-retained-reasoning-stream-recovery.test.ts": "responses", "openai-native-hosted-search-history.test.ts": "adapters/openai", "responses-native-compact-search-history.test.ts": "responses", "config-hosted-search-projection.test.ts": "config", "gcp-credential-boundary.test.ts": "adapters/google", "gcp-sa-marker.test.ts": "adapters/google", "gcp-sa-adapter.test.ts": "adapters/google", "management-gcp-credential-input.test.ts": "server", "codex-preserve-signed-in.test.ts": "codex-integration", "cli-account-preservation.test.ts": "cli", "service-state-isolation.test.ts": "service", "compaction-history-framing.test.ts": "responses", "catalog-native-max-context.test.ts": "codex-integration", "protocol-argon-thought-boundary.test.ts": "responses", "service-log.test.ts": "service", "messages-native-empty-inline.test.ts": "claude-integration", "catalog-auto-review-override.test.ts": "codex-integration", "management-auto-review-settings.test.ts": "server", "management-auto-review-auth.test.ts": "server", "prefer-model-alias-ids.test.ts": "server", "responses-mimo-envelope.test.ts": "responses", "responses-call-id-linkage.test.ts": "responses", "bridge-terminal-refusal.test.ts": "adapters", "loop-terminal-refusal.test.ts": "images", "web-search-terminal-refusal.test.ts": "web-search", "combo-terminal-refusal.test.ts": "routing", "server-terminal-refusal-wiring.test.ts": "server", "incomplete-reason-normalization.test.ts": "responses", "advisor-retention.test.ts": "advisor", "responses-native-key-cooldown.test.ts": "responses", "responses-run-turn-key-readmission.test.ts": "responses", "qoder-spawn-readmission.test.ts": "adapters", "api-key-selection-cooldown.test.ts": "providers", "api-key-auto-pause-distribution.test.ts": "providers", "server-chat-native-key-selection.test.ts": "server", "compact-key-selection.test.ts": "responses", "messages-native-key-selection.test.ts": "claude-integration",
     "owner-registry-isolation.test.ts": "config",
-    "responses-auto-pause-replay-owner.test.ts": "responses", "responses-account-auto-pause.test.ts": "responses", "oauth-account-auto-pause.test.ts": "oauth", "codex-history-pending-wal.test.ts": "codex-integration", "responses-anthropic-billing-send-budget.test.ts": "responses", "anthropic-billing-ownership.test.ts": "adapters/anthropic", "server-anthropic-billing.test.ts": "server", "server-anthropic-billing-boundaries.test.ts": "server", "router-anthropic-billing-failover.test.ts": "routing", "anthropic-billing-refusal.test.ts": "adapters/anthropic", "messages-request-id-headers.test.ts": "claude-integration", "bounded-file-read.test.ts": "lib", "responses-undeclared-tool-guard-inbound.test.ts": "responses", "explicit-empty-tool-catalog.test.ts": "responses", "explicit-empty-tool-catalog-history.test.ts": "responses",
+    "responses-auto-pause-replay-owner.test.ts": "responses", "responses-account-auto-pause.test.ts": "responses", "oauth-account-auto-pause.test.ts": "oauth", "oauth-upsert-paused-api-key.test.ts": "oauth", "management-account-auto-pause.test.ts": "server", "cli-account-key-pause.test.ts": "cli", "oauth-account-auto-pause-revision.test.ts": "oauth", "config-account-auto-pause-revisions.test.ts": "config", "codex-history-pending-wal.test.ts": "codex-integration", "responses-anthropic-billing-send-budget.test.ts": "responses", "anthropic-billing-ownership.test.ts": "adapters/anthropic", "server-anthropic-billing.test.ts": "server", "server-anthropic-billing-boundaries.test.ts": "server", "router-anthropic-billing-failover.test.ts": "routing", "anthropic-billing-refusal.test.ts": "adapters/anthropic", "messages-request-id-headers.test.ts": "claude-integration", "bounded-file-read.test.ts": "lib", "responses-undeclared-tool-guard-inbound.test.ts": "responses", "explicit-empty-tool-catalog.test.ts": "responses", "explicit-empty-tool-catalog-history.test.ts": "responses",
     "messages-request-id-endpoint.test.ts": "claude-integration",
     "anthropic-revoked-token.test.ts": "adapters/anthropic",
     "messages-revoked-token.test.ts": "claude-integration",
diff --git a/src/cli/account-api.ts b/src/cli/account-api.ts
index a4f3e1d427e..6ea43d96d9c 100644
--- a/src/cli/account-api.ts
+++ b/src/cli/account-api.ts
@@ -418,6 +418,7 @@ export async function fetchCodexRows(
       ? a.autoSwitchThresholdOverride
       : null,
     paused: a.paused === true,
+    // Unknown display details are dropped defensively; the pause state above is retained.
     pauseDetails: accountPauseDetailsSchema.safeParse(a.pauseDetails).data,
     ...(includeQuota ? {
       quota: projectQuota(a.quota),
@@ -480,6 +481,7 @@ async function fetchOAuthRows(
     active: a.active ?? a.id === activeId,
     needsReauth: a.needsReauth,
     ...projectAccountHealth(a, name, a.id),
+    // Unknown display details are dropped defensively; paused remains authoritative.
     ...(a.paused === true ? { paused: true, pauseDetails: accountPauseDetailsSchema.safeParse(a.pauseDetails).data } : {}),
     ...(isAnthropicOAuthInstance(name) && Object.hasOwn(a, "autoSwitchThresholdOverride") ? { autoSwitchThresholdOverride: a.autoSwitchThresholdOverride } : {}),
     ...(a.needsReauthReason === "verify_account" ? { needsReauthReason: a.needsReauthReason } : {}),
@@ -531,6 +533,7 @@ async function fetchKeyRows(deps: AccountDeps, baseUrl: string, name: string, qu
     masked: k.masked,
     active: k.active ?? k.id === activeId,
     paused: k.disabled === true,
+    // Unknown display details are dropped defensively; disabled still keeps the key paused.
     pauseDetails: accountPauseDetailsSchema.safeParse(k.pauseDetails).data,
   }));
   return { rows, activeId, status: 200 };
diff --git a/src/cli/account-extended.ts b/src/cli/account-extended.ts
index 8b743baf7d2..d7f635fd50a 100644
--- a/src/cli/account-extended.ts
+++ b/src/cli/account-extended.ts
@@ -786,7 +786,7 @@ export async function cmdPriority(args: string[], deps: AccountDeps): Promise<nu
   return 0;
 }
 
-function resolveGenericOAuthAccountTarget(accounts: unknown[], requested: string): { id: string } | { error: string } {
+function resolveGenericOAuthAccountTarget(accounts: unknown[], requested: string, kind: "OAuth" | "API key" = "OAuth"): { id: string } | { error: string } {
   const rows = accounts.filter((value): value is { id: string; alias?: unknown } =>
     typeof value === "object" && value !== null && typeof (value as { id?: unknown }).id === "string",
   );
@@ -797,10 +797,10 @@ function resolveGenericOAuthAccountTarget(accounts: unknown[], requested: string
     : rows.filter(account => typeof account.alias === "string" && account.alias.toLowerCase() === requested.toLowerCase());
   if (matches.length === 1) return { id: matches[0]!.id };
   if (matches.length > 1) return { error: `alias "${requested}" names ${matches.length} accounts; use the account id` };
-  return { error: `Account not found: no OAuth account has the id or alias "${requested}"` };
+  return { error: `Account not found: no ${kind} account has the id or alias "${requested}"` };
 }
 
-/** Pause or resume a Codex or OAuth provider account, including Anthropic. */
+/** Pause or resume a Codex, OAuth, or API-key pool account. */
 export async function cmdPause(args: string[], deps: AccountDeps, paused: boolean): Promise<number> {
   const wantsJson = flag(args, "--json");
   const name = args.shift();
@@ -843,15 +843,16 @@ export async function cmdPause(args: string[], deps: AccountDeps, paused: boolea
     const rows = await fetchRows(deps, baseUrl, name, "api-key");
     if (rows.status === 0) return proxyUnreachable(rows.transportError);
     if (rows.status !== 200) return apiError(rows.errorJson ?? {}, "failed to list API key accounts", rows.status);
-    const target = resolveGenericOAuthAccountTarget(rows.rows.map(row => ({ id: row.id, alias: row.label })), requestedId);
-    if ("error" in target) return usage(target.error.replace("OAuth", "API key"));
+    const target = resolveGenericOAuthAccountTarget(rows.rows.map(row => ({ id: row.id, alias: row.label })), requestedId, "API key");
+    if ("error" in target) return usage(`Error: ${target.error}`);
     const result = await apiJson(deps, baseUrl, "PUT", "/api/providers/keys/pause", { name, id: target.id, paused });
+    if (result.status === 0) return proxyUnreachable(result.transportError);
     if (result.status !== 200) return apiError(result.json, `failed to ${verb} account`, result.status);
-    console.log(wantsJson ? JSON.stringify({ ok: true, provider: name, id: target.id, paused }) : `${name}: account ${paused ? "paused" : "resumed"}`);
+    console.log(wantsJson ? JSON.stringify({ ok: true, provider: name, id: target.id, paused }, null, 2) : `${name}: account ${paused ? "paused" : "resumed"}`);
     return 0;
   }
   if (classified.type !== "codex") {
-    return usage(`Error: ${verb} applies to the openai Codex account pool or a generic OAuth provider`);
+    return usage(`Error: ${verb} applies to the openai Codex account pool, a generic OAuth provider, or an API-key pool`);
   }
   const target = await resolveCodexAccountTarget(deps, baseUrl, requestedId);
   if ("networkDown" in target) return proxyUnreachable(target.transportError);
diff --git a/src/config.ts b/src/config.ts
index bdd93e331b9..960edcb2cdc 100644
--- a/src/config.ts
+++ b/src/config.ts
@@ -1,3 +1,4 @@
+import { normalizeAccountAutoPauseRevisions, observeAccountAutoPauseRevisions, observeLoadedAutoPauseConfig } from "./config/account-auto-pause-revisions";
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import type { OcxConfig } from "./types";
@@ -211,7 +212,7 @@ import {
  * until a valid config or a genuinely missing file is observed. A partially-
  * invalid config is merged with defaults so providers and pool accounts survive.
  */
-export function loadConfig(): OcxConfig {
+function loadConfigUnobserved(): OcxConfig {
   const dir = getConfigDir();
   const configPath = getConfigPath();
   hardenConfigDir();
@@ -332,6 +333,10 @@ export function loadConfig(): OcxConfig {
   }
 }
 
+export function loadConfig(): OcxConfig {
+  return observeLoadedAutoPauseConfig(loadConfigUnobserved());
+}
+
 export type PersistedConfigInitializationOutcome = "created" | "exists" | "invalid";
 
 /** Initialize only a missing config; ordinary explicit updates still use saveConfig. */
@@ -348,11 +353,13 @@ export function initializePersistedConfigIfMissing(
       const current = observeInitialConfigState();
       if (current !== "missing") return current;
       const projected = projectCustomModelCatalogMigration(undefined, projectConfigRebaseProvenance(config));
+      normalizeAccountAutoPauseRevisions(undefined, projected);
       if (!validateConfigCandidate(projected).ok) throw new Error("Initial configuration is invalid.");
       if (!publishInitialConfigNoReplace(getConfigPath(), JSON.stringify(projected, null, 2) + "\n", io)) {
         return observeInitialConfigState() === "exists" ? "exists" : "invalid";
       }
       published = true;
+      observeAccountAutoPauseRevisions(projected);
       recordOwnedConfigPath(getConfigDir(), getConfigPath());
       bumpGenerationForCooperatingConfigWrite();
       return projected;
diff --git a/src/config/account-auto-pause-revisions.ts b/src/config/account-auto-pause-revisions.ts
new file mode 100644
index 00000000000..360c2cb6066
--- /dev/null
+++ b/src/config/account-auto-pause-revisions.ts
@@ -0,0 +1,95 @@
+import * as z from "zod/v4";
+import { randomUUID } from "node:crypto";
+import { readFileSync } from "node:fs";
+import type { OcxConfig } from "../types";
+import { getConfigPath } from "./paths";
+
+type PolicyConfig = { providers?: unknown; accountAutoPausePolicyRevisions?: unknown };
+type Observed = { diskRevision: string; localGen: number; unknown: boolean; fingerprint: string };
+export type AccountAutoPauseFence = { configPath: string; diskRevision: string; localGen: number; threshold: number; route: string };
+const observed = new Map<string, Map<string, Observed>>();
+const UUID = z.uuid();
+function record(value: unknown): Record<string, unknown> | undefined {
+  return value !== null && typeof value === "object" && !Array.isArray(value) ? value as Record<string, unknown> : undefined;
+}
+function revisions(config: PolicyConfig): Record<string, string> | undefined | null {
+  const value = config.accountAutoPausePolicyRevisions;
+  if (value === undefined) return undefined;
+  const map = record(value);
+  return map && Object.values(map).every(v => typeof v === "string" && UUID.safeParse(v).success) ? map as Record<string, string> : null;
+}
+function revisionFor(map: Record<string, string> | undefined | null, name: string): string | undefined {
+  return map && Object.hasOwn(map, name) ? map[name] : undefined;
+}
+function provider(config: PolicyConfig, name: string): Record<string, unknown> | undefined {
+  const providers = record(config.providers);
+  return providers && Object.hasOwn(providers, name) ? record(providers[name]) : undefined;
+}
+function route(row: Record<string, unknown> | undefined): string {
+  return JSON.stringify([row?.baseUrl, row?.adapter, row?.authMode]);
+}
+export function accountAutoPauseFingerprint(row: unknown): string {
+  const p = record(row), policy = record(p?.accountAutoPause);
+  return JSON.stringify([!!p, policy?.enabled === true, policy?.consecutiveFailures ?? 2, p?.disabled === true, route(p)]);
+}
+export function snapshotAutoPauseFingerprints(config: PolicyConfig): Map<string, string> {
+  return new Map(Object.entries(record(config.providers) ?? {}).map(([name, row]) => [name, accountAutoPauseFingerprint(row)]));
+}
+/** Caller revisions never authorize a write. The literal pre-write file owns the epoch. */
+export function normalizeAccountAutoPauseRevisions(before: PolicyConfig | undefined, persisted: OcxConfig): void {
+  const old = revisions(before ?? {});
+  const names = new Set(Object.keys(old ?? {}));
+  for (const config of [before, persisted]) {
+    for (const [name, row] of Object.entries(record(config?.providers) ?? {})) {
+      if (record(row)?.accountAutoPause !== undefined) names.add(name);
+    }
+  }
+  const entries = [...names].map(name => [name, revisionFor(old, name)
+    && accountAutoPauseFingerprint(provider(before ?? {}, name)) === accountAutoPauseFingerprint(provider(persisted, name))
+    ? revisionFor(old, name)! : randomUUID()]);
+  if (entries.length) persisted.accountAutoPausePolicyRevisions = Object.fromEntries(entries);
+  else delete persisted.accountAutoPausePolicyRevisions;
+}
+/** Adopt disk epochs even when an external ABA left the effective policy unchanged. */
+export function observeAccountAutoPauseRevisions(config: PolicyConfig, disk: PolicyConfig = config, previous?: Map<string, string>): void {
+  const path = getConfigPath();
+  let entries = observed.get(path);
+  if (!entries) { entries = new Map(); observed.set(path, entries); }
+  const map = revisions(disk);
+  const names = new Set([...entries.keys(), ...Object.keys(record(config.providers) ?? {}), ...Object.keys(map ?? {})]);
+  for (const name of names) {
+    const fingerprint = accountAutoPauseFingerprint(provider(config, name));
+    const old = entries.get(name);
+    const prior = previous?.get(name) ?? old?.fingerprint ?? fingerprint;
+    entries.set(name, { fingerprint, diskRevision: revisionFor(map, name) ?? "legacy", unknown: map === null,
+      localGen: (old?.localGen ?? 0) + (prior !== fingerprint ? 1 : 0) });
+  }
+}
+/** Initial load is an observation, never a persistence operation. */
+export function observeLoadedAutoPauseConfig(config: OcxConfig): OcxConfig {
+  observeAccountAutoPauseRevisions(config);
+  return config;
+}
+export function captureAccountAutoPauseFence(config: OcxConfig, name: string): AccountAutoPauseFence | undefined {
+  if (!observed.get(getConfigPath())?.has(name)) observeAccountAutoPauseRevisions(config);
+  const state = observed.get(getConfigPath())!.get(name);
+  const p = provider(config, name), policy = record(p?.accountAutoPause);
+  const threshold = policy?.consecutiveFailures ?? 2;
+  if (!state || state.unknown || !p || p.disabled === true || policy?.enabled !== true || typeof threshold !== "number" || !Number.isInteger(threshold) || threshold < 1 || threshold > 100) return;
+  return { configPath: getConfigPath(), diskRevision: state.diskRevision, localGen: state.localGen, threshold, route: route(p) };
+}
+export function accountAutoPauseFenceIsLocal(name: string, fence: AccountAutoPauseFence): boolean {
+  const state = observed.get(fence.configPath)?.get(name);
+  return getConfigPath() === fence.configPath && !!state && !state.unknown
+    && state.diskRevision === fence.diskRevision && state.localGen === fence.localGen;
+}
+/** Must run inside the config mutation lock at the final persistence boundary. */
+export function accountAutoPauseFenceMatchesDisk(name: string, fence: AccountAutoPauseFence, fresh?: PolicyConfig): boolean {
+  if (!accountAutoPauseFenceIsLocal(name, fence)) return false;
+  try {
+    const disk = fresh ?? JSON.parse(readFileSync(fence.configPath, "utf8").replace(/^\uFEFF/, "")) as PolicyConfig;
+    const map = revisions(disk), p = provider(disk, name), policy = record(p?.accountAutoPause);
+    return map !== null && (revisionFor(map, name) ?? "legacy") === fence.diskRevision && !!p && p.disabled !== true
+      && policy?.enabled === true && (policy.consecutiveFailures ?? 2) === fence.threshold && route(p) === fence.route;
+  } catch { return false; }
+}
diff --git a/src/config/live-reconcile.ts b/src/config/live-reconcile.ts
index 2cc9f00fe0e..9739911dbea 100644
--- a/src/config/live-reconcile.ts
+++ b/src/config/live-reconcile.ts
@@ -1,3 +1,4 @@
+import { observeAccountAutoPauseRevisions, snapshotAutoPauseFingerprints } from "./account-auto-pause-revisions";
 import type { OcxConfig, OcxProviderConfig, ProviderCostOverlay } from "../types";
 import { configReasoningPinsConfigError } from "./provider-validation";
 import { adoptCustomModelCatalogMigration, projectCustomModelCatalogMigration } from "../codex/custom-model-catalog-migration";
@@ -161,7 +162,9 @@ export function adoptPersistedProviderIntoLiveConfig(
   provider: OcxProviderConfig,
   persistedConfig?: OcxConfig,
 ): void {
+  const pauseBefore = snapshotAutoPauseFingerprints(config);
   config.providers[name] = structuredClone(provider);
+  observeAccountAutoPauseRevisions(config, persistedConfig ?? readRawConfigJson() ?? { accountAutoPausePolicyRevisions: null }, pauseBefore);
   const baseline = liveConfigBaseline.get(config);
   if (baseline) baseline.providers[name] = structuredClone(provider);
   if (persistedConfig) refreshPreservedProviderOwner(config, persistedConfig);
@@ -436,6 +439,7 @@ export function reconcileLiveConfigFromDisk(config: OcxConfig, persistedBaseline
   if (diagnostics.source === "fallback") {
     throw new Error(`OAuth config reconciliation failed: ${diagnostics.error ?? "invalid config file"}`);
   }
+  const pauseBefore = snapshotAutoPauseFingerprints(config);
   const persisted = diagnostics.config;
   const claudeGuardArmed = claudeCodeBaseline.has(config);
   const pendingLiveClaudeMutation = claudeGuardArmed
@@ -460,6 +464,7 @@ export function reconcileLiveConfigFromDisk(config: OcxConfig, persistedBaseline
     else config.claudeCode = structuredClone(persisted.claudeCode);
     claudeCodeBaseline.set(config, structuredClone(config.claudeCode));
   }
+  observeAccountAutoPauseRevisions(config, persisted, pauseBefore);
   // The reconciliation may have adopted a providers.<name>.modelCosts edit made
   // by a cooperating process while the OAuth login was pending; keep the overlay
   // registry (and the usage-cache overlay version) in sync with the live config.
@@ -526,6 +531,7 @@ export function saveConfigPreservingClaudeCode(config: OcxConfig): void {
     // One authoritative pre-write read feeds both the live-config reconciliation and
     // custom-model deletion migration. A second read could observe different bytes.
     const onDisk = readRawConfigJson();
+    const pauseBefore = snapshotAutoPauseFingerprints(config);
     const baseline = liveConfigBaseline.get(config);
     let diskDeletedKeys = new Set<string>();
     let persistedSnapshot: OcxConfig | undefined;
@@ -576,6 +582,7 @@ export function saveConfigPreservingClaudeCode(config: OcxConfig): void {
         }
       }
     }
+    observeAccountAutoPauseRevisions(config, onDisk ?? config, pauseBefore);
     applyConfigObjectChildDeletions(config, childDeletions);
     // Recursive three-way merging preserves sibling rows; explicit PUT/reset
     // replaces only its model after merging, including absent policy fields.
diff --git a/src/config/persist-unlocked.ts b/src/config/persist-unlocked.ts
index 9ffac0c8e43..f6014966e47 100644
--- a/src/config/persist-unlocked.ts
+++ b/src/config/persist-unlocked.ts
@@ -1,3 +1,4 @@
+import { normalizeAccountAutoPauseRevisions, observeAccountAutoPauseRevisions, snapshotAutoPauseFingerprints } from "./account-auto-pause-revisions";
 import { existsSync, readFileSync } from "node:fs";
 import { configReasoningPinsConfigError } from "./provider-validation";
 import type { OcxConfig } from "../types";
@@ -78,6 +79,8 @@ export function persistConfigUnlocked(config: OcxConfig): boolean {
   const persisted = withPreservedDiskOnlyProviders(config);
   if (provenanceProjection.configRebaseProvenance === undefined) delete persisted.configRebaseProvenance;
   else persisted.configRebaseProvenance = provenanceProjection.configRebaseProvenance;
+  normalizeAccountAutoPauseRevisions(rawBeforeWrite, persisted);
+  const beforeFingerprints = snapshotAutoPauseFingerprints(rawBeforeWrite ?? {});
   const bytes = JSON.stringify(persisted, null, 2) + "\n";
   let unchanged = false;
   try {
@@ -90,6 +93,7 @@ export function persistConfigUnlocked(config: OcxConfig): boolean {
   // the same bytes (e.g. before a proxy notification), and Logs/Usage must
   // adopt the overlay without waiting for a changed save or restart.
   let published = unchanged;
+  let observedPublication = false;
   try {
     if (!unchanged) {
       atomicWriteFile(configPath, bytes, undefined, { afterRename: () => { published = true; } });
@@ -97,10 +101,15 @@ export function persistConfigUnlocked(config: OcxConfig): boolean {
     }
     // Publication, not successful cache refresh, is the rollback boundary. A
     // byte-identical save already has the requested state on disk as well.
+    observeAccountAutoPauseRevisions(persisted, persisted, beforeFingerprints);
+    observedPublication = true;
     refreshConfigDerivedRegistries(persisted);
     return !unchanged;
   } catch (error) {
-    if (published) throw new ConfigWritePublishedError(error);
+    if (published) {
+      if (!observedPublication) observeAccountAutoPauseRevisions(persisted, persisted, beforeFingerprints);
+      throw new ConfigWritePublishedError(error);
+    }
     throw error;
   }
 }
diff --git a/src/config/schema/config-schema.ts b/src/config/schema/config-schema.ts
index f71d6563c77..3b9b7d1d6f2 100644
--- a/src/config/schema/config-schema.ts
+++ b/src/config/schema/config-schema.ts
@@ -304,7 +304,17 @@ export const configSchema = z.object({
   // and the default label is emitted, rather than failing the parse or writing a config Codex
   // would refuse to load — the provider id routing depends on is never derived from it.
   codexProviderDisplayName: z.string().trim().min(1).max(128).optional().catch(undefined),
-  codexAccountPauseState: accountPauseStateSchema.optional(),
+  // Preserve an invalid marker: silently treating corrupt epochs as legacy would grant stale attempts authority.
+  accountAutoPausePolicyRevisions: z.record(z.string(), z.uuid()).nullable().optional().catch(null),
+  // Details are display-only; keep each usable resume revision and the separate paused-id authority.
+  codexAccountPauseState: z.preprocess(value => {
+    if (!value || typeof value !== "object" || Array.isArray(value)) return undefined;
+    return Object.fromEntries(Object.entries(value).flatMap(([id, row]) => {
+      if (!row || typeof row !== "object" || Array.isArray(row) || typeof row.revision !== "string") return [];
+      const parsed = accountPauseStateSchema.safeParse({ [id]: row });
+      return [[id, parsed.success ? parsed.data[id] : { revision: row.revision }]];
+    }));
+  }, accountPauseStateSchema.optional()),
   pausedCodexAccountIds: z.array(z.string().regex(/^[a-zA-Z0-9._-]{1,64}$/)).optional(),
   // A malformed allow-list degrades to "no account spends credits" rather than failing the parse,
   // so a hand-edited typo cannot trip the backup-and-defaults repair path; the write path rejects
diff --git a/src/oauth/account-auto-pause.ts b/src/oauth/account-auto-pause.ts
index cfa0962e33e..4e254812f78 100644
--- a/src/oauth/account-auto-pause.ts
+++ b/src/oauth/account-auto-pause.ts
@@ -1,3 +1,4 @@
+import { captureAccountAutoPauseFence, accountAutoPauseFenceIsLocal, accountAutoPauseFenceMatchesDisk } from "../config/account-auto-pause-revisions";
 import type { OcxConfig, OcxProviderConfig } from "../types";
 import type { OAuthAccessSnapshot } from "./index";
 import type { CodexAuthContext } from "../codex/auth-context";
@@ -33,8 +34,11 @@ export function captureAccountAutoPauseAttempt(name: string, provider: OcxProvid
   if (!threshold) return;
   const configured = config.providers[name];
   if (!configured || configured.disabled) return;
+  const fence = captureAccountAutoPauseFence(config, name);
+  if (!fence) return;
   const route = JSON.stringify([configured.baseUrl, configured.adapter, configured.authMode]);
-  const policyCurrent = () => autoPauseThreshold(config.providers[name]?.accountAutoPause) === threshold
+  const policyCurrent = () => accountAutoPauseFenceIsLocal(name, fence) && !config.providers[name]?.disabled
+    && autoPauseThreshold(config.providers[name]?.accountAutoPause) === threshold
     && JSON.stringify([config.providers[name]?.baseUrl, config.providers[name]?.adapter, config.providers[name]?.authMode]) === route;
   let key: string, incarnation: string, current: () => boolean;
   let pause: (reason: AccountPauseReason) => Promise<boolean>;
@@ -50,7 +54,8 @@ export function captureAccountAutoPauseAttempt(name: string, provider: OcxProvid
       return !!live && !live.paused && live.pauseRevision === revision && credentialGeneration(live.credential) === oauth.generation;
     };
     pause = async reason => (await setAccountPaused(name, oauth.accountId, true, {
-      generation: oauth.generation, pauseRevision: revision, isCurrent: policyCurrent, details: { reason, pausedAt: Date.now() },
+      generation: oauth.generation, pauseRevision: revision, isCurrent: policyCurrent,
+      assertPolicyBeforePersist: () => { if (!accountAutoPauseFenceMatchesDisk(name, fence)) throw new Error("Account auto-pause policy changed before persistence"); }, details: { reason, pausedAt: Date.now() },
     })).status === "updated";
   } else if (provider.authMode === "forward") {
     if (!codex || codex.kind !== "pool" && codex.kind !== "main-pool") return;
@@ -68,7 +73,7 @@ export function captureAccountAutoPauseAttempt(name: string, provider: OcxProvid
     pause = async reason => {
       let pauseState: OcxConfig["codexAccountPauseState"];
       const outcome = mutatePersistedConfig(fresh => {
-        if (!credentialCurrent() || isCodexAccountPaused(fresh, accountId)
+        if (!policyCurrent() || !accountAutoPauseFenceMatchesDisk(name, fence, fresh) || !credentialCurrent() || isCodexAccountPaused(fresh, accountId)
           || fresh.codexAccountPauseState?.[accountId]?.revision !== revision
           || autoPauseThreshold(fresh.providers[name]?.accountAutoPause) !== threshold) return { changed: false, value: false };
         setCodexAccountPaused(fresh, accountId, true, { reason, pausedAt: Date.now() });
@@ -98,9 +103,10 @@ export function captureAccountAutoPauseAttempt(name: string, provider: OcxProvid
       return !!live && !live.disabled && live.key === reference && live.pauseRevision === pauseRevision && resolveProviderApiKey(reference) === resolvedKey;
     };
     pause = async reason => setProviderApiKeyPaused(config, name, id, true, {
-      selection, pauseRevision, resolvedKey, details: { reason, pausedAt: Date.now() },
+      selection, pauseRevision, resolvedKey, fence, details: { reason, pausedAt: Date.now() },
     });
   }
+  incarnation += `\0${fence.diskRevision}\0${fence.localGen}`;
   let tracker = streaks.get(config);
   if (!tracker) { tracker = new AccountRefusalStreaks(); streaks.set(config, tracker); }
   const observed = new WeakSet<Response>();
diff --git a/src/oauth/api-key-pool-preserve.ts b/src/oauth/api-key-pool-preserve.ts
new file mode 100644
index 00000000000..4a8b6198692
--- /dev/null
+++ b/src/oauth/api-key-pool-preserve.ts
@@ -0,0 +1,37 @@
+import type { OcxProviderConfig } from "../types";
+import { sanitizeApiKeyValue } from "../providers/api-keys";
+import { accountPauseDetailsSchema } from "../config/schema/account-auto-pause";
+
+/** Runtime guards: provider config is intentionally passthrough, so persisted fields may be malformed. */
+export function preservableApiKeyPool(value: unknown): NonNullable<OcxProviderConfig["apiKeyPool"]> | undefined {
+  if (!Array.isArray(value)) return undefined;
+  const pool: NonNullable<OcxProviderConfig["apiKeyPool"]> = [];
+  const ids = new Set<string>();
+  const keys = new Set<string>();
+  for (const entry of value as unknown[]) {
+    if (!entry || typeof entry !== "object" || Array.isArray(entry)) continue;
+    const candidate = entry as Record<string, unknown>;
+    const id = typeof candidate.id === "string" ? candidate.id.trim() : "";
+    const key = sanitizeApiKeyValue(candidate.key);
+    if (!id || !key || ids.has(id) || keys.has(key)) continue;
+    const label = typeof candidate.label === "string" ? candidate.label : undefined;
+    const addedAt = typeof candidate.addedAt === "number" && Number.isFinite(candidate.addedAt)
+      ? candidate.addedAt
+      : undefined;
+    const details = accountPauseDetailsSchema.safeParse(candidate.pauseDetails);
+    ids.add(id);
+    keys.add(key);
+    pool.push({
+      id,
+      key,
+      ...(label !== undefined ? { label } : {}),
+      ...(addedAt !== undefined ? { addedAt } : {}),
+      ...(typeof candidate.disabled === "boolean" ? { disabled: candidate.disabled } : {}),
+      ...(typeof candidate.pauseRevision === "string" ? { pauseRevision: candidate.pauseRevision } : {}),
+      ...(details.success ? { pauseDetails: details.data } : {}),
+    });
+  }
+  // Retain paused slots too: their metadata and credentials are needed for explicit resume.
+  return pool.length > 0 ? pool : undefined;
+}
+
diff --git a/src/oauth/index.ts b/src/oauth/index.ts
index 8309e1a30fc..ef793933a56 100644
--- a/src/oauth/index.ts
+++ b/src/oauth/index.ts
@@ -55,6 +55,7 @@ import { loginOrcaRouter, orcaRouterInferenceBaseUrl, refreshOrcaRouterKey } fro
 import { ANTIGRAVITY_DISCOVERY_UA } from "../adapters/google-antigravity-wire";
 import { deriveOAuthDefaultModel, deriveOAuthProviderConfig } from "../providers/derive";
 import { apiKeyPoolEntryId, sanitizeApiKeyValue } from "../providers/api-keys";
+import { preservableApiKeyPool } from "./api-key-pool-preserve";
 import { effectiveGoogleMode, getProviderRegistryEntry, mergeRegistryStaticHeaders, providerMatchesRegistryTransport } from "../providers/registry";
 import { providerModelsUrl, resolveProviderModelDiscoveryUrl } from "../providers/model-discovery";
 import { resolveProviderTransport } from "../providers/xai-transport";
@@ -1513,36 +1514,6 @@ export function reconcileOAuthProviders(config: OcxConfig, persist = true): bool
   return true;
 }
 
-/** Runtime guards: provider config is intentionally passthrough, so persisted fields may be malformed. */
-function preservableApiKeyPool(value: unknown): NonNullable<OcxProviderConfig["apiKeyPool"]> | undefined {
-  if (!Array.isArray(value)) return undefined;
-  const pool: NonNullable<OcxProviderConfig["apiKeyPool"]> = [];
-  const ids = new Set<string>();
-  const keys = new Set<string>();
-  for (const entry of value as unknown[]) {
-    if (!entry || typeof entry !== "object" || Array.isArray(entry)) continue;
-    const candidate = entry as Record<string, unknown>;
-    const id = typeof candidate.id === "string" ? candidate.id.trim() : "";
-    const key = sanitizeApiKeyValue(candidate.key);
-    if (!id || !key || ids.has(id) || keys.has(key)) continue;
-    const label = typeof candidate.label === "string" ? candidate.label : undefined;
-    const addedAt = typeof candidate.addedAt === "number" && Number.isFinite(candidate.addedAt)
-      ? candidate.addedAt
-      : undefined;
-    ids.add(id);
-    keys.add(key);
-    pool.push({
-      id,
-      key,
-      ...(label !== undefined ? { label } : {}),
-      ...(addedAt !== undefined ? { addedAt } : {}),
-    });
-  }
-  // `apiKey` remains the routing source of truth. Keep valid alternate slots even when a
-  // hand-edited config left the pool out of sync, rather than deleting usable credentials.
-  return pool.length > 0 ? pool : undefined;
-}
-
 const OAUTH_LOGIN_OWNED_PROVIDER_FIELDS = [
   "adapter",
   "baseUrl",
@@ -1597,11 +1568,10 @@ export function upsertOAuthProvider(config: OcxConfig, provider: string): void {
     // Shared sanitizeApiKeyValue trim / no-CRLF checks from api-key pool writes.
     let storedApiKey = sanitizeApiKeyValue(existing.apiKey);
     const storedApiKeyPool = preservableApiKeyPool(existing.apiKeyPool);
-    // Unsafe/blank active key with a usable pool: promote the first safe pool entry so
-    // key billing keeps working instead of falling back to oauth while pool keys remain.
-    if (storedApiKey === undefined && storedApiKeyPool && storedApiKeyPool.length > 0) {
-      storedApiKey = storedApiKeyPool[0]!.key;
-    }
+    // Retain all-paused pools without activating any paused credential during login.
+    if (storedApiKeyPool?.some(entry => entry.key === storedApiKey && entry.disabled)) storedApiKey = undefined;
+    if (storedApiKey === undefined) storedApiKey = storedApiKeyPool?.find(entry => !entry.disabled)?.key;
+    if (storedApiKeyPool) next.apiKeyPool = storedApiKeyPool;
     if (storedApiKey !== undefined) {
       const pool = storedApiKeyPool ? [...storedApiKeyPool] : [];
       // Keep routing and listProviderApiKeys in sync: never leave a hidden active key that
diff --git a/src/oauth/store.ts b/src/oauth/store.ts
index 5d2239cc11e..0bce2de098e 100644
--- a/src/oauth/store.ts
+++ b/src/oauth/store.ts
@@ -807,7 +807,7 @@ function serializeMutation<T>(work: () => Promise<T>, retainedValues: readonly u
   drainOAuthMutations();
   return result;
 }
-export function mutateStore<T>(fn:(store:AuthStore)=>T|Promise<T>, retainedValues: readonly unknown[] = [], options?: { waitMs?: number; assertBeforePersist?: () => void; scrubLegacyBackup?: (result: T) => readonly string[]; finalizeResult?: (result: T, store: AuthStore) => void; afterPersist?: (result: T) => void }):Promise<T>{return serializeMutation(async()=>{const guard=await createOAuthFileLock({path:getAuthStoreLockPath(),staleAfterMs:30000}).acquire();try{
+export function mutateStore<T>(fn:(store:AuthStore)=>T|Promise<T>, retainedValues: readonly unknown[] = [], options?: { waitMs?: number; assertBeforePersist?: () => void; scrubLegacyBackup?: (result: T) => readonly string[]; finalizeResult?: (result: T, store: AuthStore) => void; afterPersist?: (result: T) => void; withConfigLock?: boolean }):Promise<T>{return serializeMutation(async()=>{const guard=await createOAuthFileLock({path:getAuthStoreLockPath(),staleAfterMs:30000}).acquire();try{
     const { store, hadLegacy } = loadAuthStoreInternal();
     if (hadLegacy) backupLegacyOnce();
     const selections = new Map(Object.entries(store).map(([provider, set]) => [provider, {
@@ -820,7 +820,7 @@ export function mutateStore<T>(fn:(store:AuthStore)=>T|Promise<T>, retainedValue
     // Only providers whose credentials this mutation actually removed leave the downgrade
     // backup; a no-op removal names none. The result decides, so it is read here.
     const scrubbedProviders = options?.scrubLegacyBackup?.(result) ?? [];
-    options?.assertBeforePersist?.();
+    if (!options?.withConfigLock) options?.assertBeforePersist?.();
     const changedProviders: string[] = [];
     for (const provider of new Set([...selections.keys(), ...Object.keys(store)])) {
       const before = selections.get(provider);
@@ -843,7 +843,8 @@ export function mutateStore<T>(fn:(store:AuthStore)=>T|Promise<T>, retainedValue
     // Receipt-producing mutations need the revision assigned by the bookkeeping above, not the
     // provisional value visible inside their callback. Finalization cannot await or mutate disk.
     options?.finalizeResult?.(result, store);
-    persist(store);
+    const publish = () => { if (options?.withConfigLock) options.assertBeforePersist?.(); persist(store); };
+    if (options?.withConfigLock) withConfigMutationLockSync(publish); else publish();
     if (scrubbedProviders.length > 0) scrubLegacyBackup(scrubbedProviders);
     // A committed observer may establish ordering before the generic selection
     // publication, but its failure can never turn a durable write into a reported failure.
@@ -1394,7 +1395,7 @@ export async function setAccountPaused(
   provider: string,
   accountId: string,
   paused: boolean,
-  automatic?: { generation: string; pauseRevision?: string; details: import("../types/account-auto-pause").AccountPauseDetails; isCurrent?: () => boolean },
+  automatic?: { generation: string; pauseRevision?: string; details: import("../types/account-auto-pause").AccountPauseDetails; isCurrent?: () => boolean; assertPolicyBeforePersist?: () => void },
 ): Promise<SetAccountPausedResult> {
   const result = await mutateStore(store => {
     const set = store[provider];
@@ -1444,7 +1445,8 @@ export async function setAccountPaused(
       activeAccountId: set.activeAccountId,
       activeAccountChanged,
     } as const;
-  }, [provider, accountId, paused], { assertBeforePersist: () => {
+  }, [provider, accountId, paused], { withConfigLock: !!automatic, assertBeforePersist: () => {
+    automatic?.assertPolicyBeforePersist?.();
     if (automatic?.isCurrent?.() === false) throw new Error("Account auto-pause policy changed before persistence");
   } });
   if (result.status === "updated") publishOAuthAccountPauseChange(provider);
diff --git a/src/providers/api-key-pause.ts b/src/providers/api-key-pause.ts
index 2d55e3852f2..bae072b82f3 100644
--- a/src/providers/api-key-pause.ts
+++ b/src/providers/api-key-pause.ts
@@ -1,3 +1,4 @@
+import { accountAutoPauseFenceMatchesDisk, type AccountAutoPauseFence } from "../config/account-auto-pause-revisions";
 import { randomUUID } from "node:crypto";
 import type { OcxConfig } from "../types";
 import type { ProviderApiKeySelection } from "../types/provider";
@@ -7,8 +8,9 @@ import { resolveProviderApiKey } from "./api-key-resolve";
 import { commitProviderApiKeySelection } from "./api-key-selection";
 
 export function setProviderApiKeyPaused(config: OcxConfig, name: string, id: string, paused: boolean,
-  automatic?: { selection: ProviderApiKeySelection; pauseRevision?: string; resolvedKey?: string; details: AccountPauseDetails }): boolean {
+  automatic?: { fence: AccountAutoPauseFence; selection: ProviderApiKeySelection; pauseRevision?: string; resolvedKey?: string; details: AccountPauseDetails }): boolean {
   const result = commitProviderApiKeySelection(config, name, provider => {
+    if (automatic && !accountAutoPauseFenceMatchesDisk(name, automatic.fence)) return { changed: false, value: false };
     const pool = provider.apiKeyPool?.length ? provider.apiKeyPool
       : provider.apiKey ? [{ id: apiKeyPoolEntryId(provider.apiKey), key: provider.apiKey }] : [];
     const entry = pool.find(e => e.id === id);
diff --git a/src/server/auth-cors.ts b/src/server/auth-cors.ts
index 7cc67bbf8a0..d9ca58b20aa 100644
--- a/src/server/auth-cors.ts
+++ b/src/server/auth-cors.ts
@@ -40,6 +40,7 @@ import { DECLARABLE_HOSTED_TOOL_TYPES } from "../responses/hosted-tool-policy";
 import { effectiveGoogleMode, getProviderRegistryEntry, providerCodexAccountMode, providerMatchesRegistryTransport, registryEntryForProviderDestination } from "../providers/registry";
 import { providerConfigSeed } from "../providers/derive";
 import { anthropicOAuthInstanceConfigError } from "../config/schema/anthropic-account-pool";
+import { accountAutoPausePolicySchema } from "../config/schema/account-auto-pause";
 import type { OcxConfig, OcxProviderConfig } from "../types";
 import { openRouterRoutingConfigError } from "../providers/openrouter-routing";
 import { modelAutoCompactTokenLimitsConfigError } from "../providers/auto-compact-budget";
@@ -740,6 +741,9 @@ export function providerManagementConfigError(
     return "provider must be a plain object";
   }
   const raw = provider as Record<string, unknown>;
+  if (raw.accountAutoPause !== undefined && !accountAutoPausePolicySchema.safeParse(raw.accountAutoPause).success) {
+    return "accountAutoPause must be an object with optional boolean enabled and integer consecutiveFailures (1-100)";
+  }
   const contextTiersError = contextTierRecordConfigError(raw.modelContextTiers);
   if (contextTiersError) return contextTiersError;
   const capabilitiesError = modelCapabilitiesConfigError(raw.modelCapabilities);
@@ -796,6 +800,8 @@ export function providerManagementConfigError(
     // sends recover, not what the canonical forward seed is. Validated below
     // (retryOnResetPolicyConfigError).
     delete canonicalCandidate.retryOnReset;
+    // Validated account eligibility policy is independent of the canonical transport.
+    delete canonicalCandidate.accountAutoPause;
     // Context windows are the same kind of user-owned overlay as requestPacing: the operator
     // narrowing what their own native rows advertise. They can only ever LOWER the measured
     // window (see nativeOpenAiContextWindow), so admitting them cannot widen what the proxy
diff --git a/src/server/management/oauth-account-routes.ts b/src/server/management/oauth-account-routes.ts
index 8bc807b12bd..865995ecbf9 100644
--- a/src/server/management/oauth-account-routes.ts
+++ b/src/server/management/oauth-account-routes.ts
@@ -1117,7 +1117,8 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     return jsonResponse({ ...result, name, store: providerKeyStoreKind(config.providers[name]) });
   }
   if (url.pathname === "/api/providers/keys/pause" && req.method === "PUT") {
-    const body = await readManagementJsonBodyOr(req, {}) as { name?: unknown; id?: unknown; paused?: unknown };
+    const body = await readManagementJsonBodyOr(req, {});
+    if (!isPlainRecord(body)) return jsonResponse({ error: "body must be an object" }, 400);
     if (typeof body.name !== "string" || typeof body.id !== "string" || typeof body.paused !== "boolean") return jsonResponse({ error: "name, id and paused required" }, 400);
     if (!isValidProviderName(body.name) || !hasOwnProvider(config.providers, body.name)) return jsonResponse({ error: "unknown provider" }, 404);
     const { setProviderApiKeyPaused } = await import("../../providers/api-key-pause");
diff --git a/src/server/management/provider-routes.ts b/src/server/management/provider-routes.ts
index 0dd9cfb8ba1..55cba4310f6 100644
--- a/src/server/management/provider-routes.ts
+++ b/src/server/management/provider-routes.ts
@@ -1357,6 +1357,12 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
       if (submittedModelContextTiers && liveTiers) candidate.modelContextTiers = Object.assign(Object.create(null), liveTiers, candidate.modelContextTiers ?? {});
       else if (!submittedModelContextTiers && liveTiers) candidate.modelContextTiers = { ...liveTiers };
       else if (!submittedModelContextTiers) delete candidate.modelContextTiers;
+      // Read omitted policy at publication time, after any concurrent operator edit.
+      if (!Object.hasOwn(rawProvider, "accountAutoPause")) {
+        const livePolicy = config.providers[name]?.accountAutoPause;
+        if (livePolicy === undefined) delete candidate.accountAutoPause;
+        else candidate.accountAutoPause = structuredClone(livePolicy);
+      }
       // Full forms omit the opt-in; preserve the latest value, including a concurrent clear.
       if (!Object.hasOwn(rawProvider, "inferContextWindow")) {
         const liveInference = config.providers[name]?.inferContextWindow;
diff --git a/src/types/config.ts b/src/types/config.ts
index 66b152323ea..d24554bb027 100644
--- a/src/types/config.ts
+++ b/src/types/config.ts
@@ -1113,6 +1113,8 @@ export interface OcxConfig {
   codexAccounts?: CodexAccount[];
   /** Account ids administratively excluded from future pool selection until resumed. */
   pausedCodexAccountIds?: string[];
+  /** Internal policy epochs; null marks malformed disk input and suppresses automatic pause. */
+  accountAutoPausePolicyRevisions?: Record<string, string> | null;
   codexAccountPauseState?: Record<string, { revision: string; details?: import("./account-auto-pause").AccountPauseDetails }>;
   /**
    * Account ids, `__main__` included, allowed to keep serving from ChatGPT credits once one of
diff --git a/structure/INDEX.md b/structure/INDEX.md
index 2e1e0fd2cd0..de69c842f19 100644
--- a/structure/INDEX.md
+++ b/structure/INDEX.md
@@ -152,7 +152,9 @@ A source area can be described by more than one doc, because these docs are orga
 | `desktop/ui/cli.js` | [`desktop-terminal-command.md`](desktop-terminal-command.md) |
 | `docs-site/` | [`ops/docs-and-release.md`](ops/docs-and-release.md) |
 | `gui/` | [`overview.md`](overview.md)<br>[`transports/native-reasoning-retention.md`](transports/native-reasoning-retention.md)<br>[`gui-and-management-api.md`](gui-and-management-api.md)<br>[`dashboard-and-usage.md`](dashboard-and-usage.md)<br>[`design-methodology.md`](design-methodology.md)<br>[`companion.md`](companion.md) |
+| `gui/src/account-pause-display.ts` | [`account-auto-pause.md`](account-auto-pause.md) |
 | `gui/src/components/ModelPriceDialog.tsx` | [`pricing.md`](pricing.md) |
+| `gui/src/hooks/useProviderAccountPools.ts` | [`account-auto-pause.md`](account-auto-pause.md) |
 | `scripts/` | [`overview.md`](overview.md)<br>[`ops/docs-and-release.md`](ops/docs-and-release.md) |
 | `scripts/generate-ocx-skill-surface.ts` | [`cli-management.md`](cli-management.md) |
 | `skills/ocx/` | [`cli-management.md`](cli-management.md) |
@@ -175,6 +177,7 @@ A source area can be described by more than one doc, because these docs are orga
 | `src/client/` | [`runtime.md`](runtime.md)<br>[`clients/claude-desktop.md`](clients/claude-desktop.md) |
 | `src/clients/` | [`clients/integrations.md`](clients/integrations.md)<br>[`clients/qoder.md`](clients/qoder.md) |
 | `src/codex/` | [`runtime.md`](runtime.md)<br>[`config.md`](config.md)<br>[`codex-home.md`](codex-home.md)<br>[`codex-prompts.md`](codex-prompts.md)<br>[`catalog.md`](catalog.md)<br>[`subagents.md`](subagents.md)<br>[`subagent-capacity.md`](subagent-capacity.md)<br>[`transports/responses-failover.md`](transports/responses-failover.md)<br>[`providers/openai-tiers.md`](providers/openai-tiers.md)<br>[`providers/openai-accounts.md`](providers/openai-accounts.md)<br>[`gui-and-management-api.md`](gui-and-management-api.md)<br>[`dashboard-and-usage.md`](dashboard-and-usage.md)<br>[`clients/codex-desktop.md`](clients/codex-desktop.md)<br>[`clients/chatgpt-desktop.md`](clients/chatgpt-desktop.md)<br>[`ops/docs-and-release.md`](ops/docs-and-release.md) |
+| `src/codex/account-pause.ts` | [`account-auto-pause.md`](account-auto-pause.md) |
 | `src/codex/account-preservation.ts` | [`providers/openai-signed-in-preservation.md`](providers/openai-signed-in-preservation.md) |
 | `src/codex/app-server-processes.ts` | [`codex-cli-update.md`](codex-cli-update.md) |
 | `src/codex/auth-api/account-preservation.ts` | [`providers/openai-signed-in-preservation.md`](providers/openai-signed-in-preservation.md) |
@@ -192,8 +195,10 @@ A source area can be described by more than one doc, because these docs are orga
 | `src/compatibility/` | [`runtime.md`](runtime.md)<br>[`adapters/compatibility-contracts.md`](adapters/compatibility-contracts.md) |
 | `src/config.ts` | [`overview.md`](overview.md)<br>[`runtime.md`](runtime.md)<br>[`config.md`](config.md)<br>[`providers/openai-accounts.md`](providers/openai-accounts.md) |
 | `src/config/` | [`runtime.md`](runtime.md)<br>[`config.md`](config.md)<br>[`transports/native-reasoning-retention.md`](transports/native-reasoning-retention.md) |
+| `src/config/account-auto-pause-revisions.ts` | [`account-auto-pause.md`](account-auto-pause.md) |
 | `src/config/live-reconcile.ts` | [`pricing.md`](pricing.md) |
 | `src/config/persisted-mutation.ts` | [`runtime.md`](runtime.md) |
+| `src/config/schema/account-auto-pause.ts` | [`account-auto-pause.md`](account-auto-pause.md) |
 | `src/config/schema/leaf-validators.ts` | [`pricing.md`](pricing.md) |
 | `src/generated/` | [`runtime.md`](runtime.md) |
 | `src/github/` | [`runtime.md`](runtime.md) |
@@ -212,6 +217,7 @@ A source area can be described by more than one doc, because these docs are orga
 | `src/oauth/` | [`providers/generic-account-pool.md`](providers/generic-account-pool.md)<br>[`runtime.md`](runtime.md)<br>[`transports/inventory.md`](transports/inventory.md)<br>[`providers/anthropic-account-thresholds.md`](providers/anthropic-account-thresholds.md)<br>[`providers/oauth-reconciliation.md`](providers/oauth-reconciliation.md)<br>[`providers-and-adapters.md`](providers-and-adapters.md)<br>[`providers/anthropic-account-pool.md`](providers/anthropic-account-pool.md)<br>[`providers/oauth-code-display-login.md`](providers/oauth-code-display-login.md)<br>[`providers/xai-grok.md`](providers/xai-grok.md) |
 | `src/oauth/account-auto-pause-policy.ts` | [`account-auto-pause.md`](account-auto-pause.md) |
 | `src/oauth/account-auto-pause.ts` | [`account-auto-pause.md`](account-auto-pause.md) |
+| `src/oauth/api-key-pool-preserve.ts` | [`account-auto-pause.md`](account-auto-pause.md) |
 | `src/oauth/dsh.ts` | [`providers/dsh-account.md`](providers/dsh-account.md) |
 | `src/oauth/login-cli.ts` | [`providers/meta-muse.md`](providers/meta-muse.md) |
 | `src/oauth/meta-muse-errors.ts` | [`providers/meta-muse.md`](providers/meta-muse.md) |
@@ -245,9 +251,11 @@ A source area can be described by more than one doc, because these docs are orga
 | `src/server/management/anthropic-pool-settings.ts` | [`providers/anthropic-account-pool.md`](providers/anthropic-account-pool.md) |
 | `src/server/management/companion-routes.ts` | [`desktop-shell.md`](desktop-shell.md) |
 | `src/server/management/model-routes.ts` | [`pricing.md`](pricing.md) |
+| `src/server/responses/account-auto-pause-recovery.ts` | [`account-auto-pause.md`](account-auto-pause.md) |
 | `src/server/responses/advisor-plan-slot.ts` | [`advisor.md`](advisor.md) |
 | `src/server/responses/advisor-slot.ts` | [`advisor.md`](advisor.md) |
 | `src/server/responses/anthropic-thinking-recovery.ts` | [`transports/anthropic-thinking-recovery.md`](transports/anthropic-thinking-recovery.md) |
+| `src/server/responses/request-transport.ts` | [`account-auto-pause.md`](account-auto-pause.md) |
 | `src/service-manager-probe.ts` | [`ops/service-and-sidecars.md`](ops/service-and-sidecars.md) |
 | `src/service.ts` | [`runtime.md`](runtime.md)<br>[`ops/docs-and-release.md`](ops/docs-and-release.md) |
 | `src/service/` | [`runtime.md`](runtime.md) |
diff --git a/structure/account-auto-pause.md b/structure/account-auto-pause.md
index 9fa4765bb51..50b0b94fddf 100644
--- a/structure/account-auto-pause.md
+++ b/structure/account-auto-pause.md
@@ -47,6 +47,25 @@ API-key selectors and reactive/proactive failover exclude disabled pool entries,
 Regression coverage: `tests/oauth/oauth-account-auto-pause.test.ts` and
 `tests/responses/responses-account-auto-pause.test.ts` and `tests/providers/api-key-auto-pause-distribution.test.ts`.
 
+## Policy-change fence
+
+`src/config/account-auto-pause-revisions.ts` keeps `accountAutoPausePolicyRevisions`, a per-provider
+UUID that changes whenever a tracked provider's effective policy fingerprint changes (policy enabled,
+threshold, provider disabled, base URL, adapter, auth mode). A provider is tracked once it has ever
+configured `accountAutoPause`; providers that never opted in leave no map in the file. Only
+`persistConfigUnlocked` mints values, from the literal pre-write file, so caller-supplied revisions never
+authorize anything. Each process also keeps an observed map with a local generation, bumped on
+fingerprint changes adopted by load, reload and save-time reconciliation. A capture records
+the revision, generation, threshold and route. A pause commits only while all of these are still
+equal, both in memory and in the fresh persisted file inside the config mutation lock. The OAuth
+automatic commit runs its final check and auth publication under that lock, and contention means
+no pause. API-key commits use the same disk check in their selection mutation, and Codex commits
+check it beside `src/codex/account-pause.ts` state. A malformed map suppresses automatic pause
+until the next valid write mints fresh revisions. A raw editor that bypasses the lock and finishes a
+disable/re-enable between two observations stays undetectable.
+Regression coverage: `tests/oauth/oauth-account-auto-pause-revision.test.ts` and
+`tests/config/config-account-auto-pause-revisions.test.ts`.
+
 ## Auto-paused account recovery
 
 OAuth and Codex account-list DTOs project optional `pauseDetails` (fixed reason plus epoch
@@ -54,7 +73,8 @@ ms timestamp) beside the existing pause flag. The CLI preserves those fields and
 the reason in account listings. `src/server/management/oauth-account-routes.ts` also serves
 `PUT /api/providers/keys/pause` with provider `name`, key `id` and boolean `paused`, through
 the existing management authorization boundary. Key listings expose `disabled` and pause
-details. Dashboard key Resume clears the pause through that endpoint before activating
+details. OAuth upserts for dual-auth providers keep validated key pause fields through
+`src/oauth/api-key-pool-preserve.ts` and never promote a paused key to the active key. Dashboard key Resume clears the pause through that endpoint before activating
 the key; OAuth/Codex keep their existing resume actions.
 `src/server/management/route-registry.ts` declares key pause as an ordinary management mutation,
 covered by the existing account pause/resume CLI capabilities. Responses recovery and passthrough
@@ -65,7 +85,8 @@ inventory coverage, physical line limits, and acyclic dependencies including typ
 
 `gui/src/components/provider-workspace/ProviderAuthPanel.tsx` and
 `gui/src/components/codex-account-pool-cards.tsx` expose fixed auto-pause reason and timestamp
-on Paused badges. Disabled key rows offer Resume through their existing selection action;
+on Paused badges; `gui/src/account-pause-display.ts` translates the reason and formats the
+timestamp with the app locale. Disabled key rows offer Resume through their existing selection action;
 `gui/src/hooks/useProviderAccountPools.ts` resumes before activation, then refreshes the
 roster under its existing selection-mutation fence. No upstream error body is displayed.
 
diff --git a/structure/manifest.json b/structure/manifest.json
index 9357feabdf6..48353f050b1 100644
--- a/structure/manifest.json
+++ b/structure/manifest.json
@@ -912,7 +912,15 @@
         "src/oauth/account-auto-pause-policy.ts",
         "src/providers/api-key-pause.ts",
         "src/types/account-auto-pause.ts",
-        "src/lib/account-auto-pause-response.ts"
+        "src/lib/account-auto-pause-response.ts",
+        "src/server/responses/request-transport.ts",
+        "src/server/responses/account-auto-pause-recovery.ts",
+        "src/codex/account-pause.ts",
+        "src/config/schema/account-auto-pause.ts",
+        "gui/src/hooks/useProviderAccountPools.ts",
+        "src/config/account-auto-pause-revisions.ts",
+        "src/oauth/api-key-pool-preserve.ts",
+        "gui/src/account-pause-display.ts"
       ]
     }
   ],
diff --git a/structure/providers-and-adapters.md b/structure/providers-and-adapters.md
index a4b80d9ab84..d7521163ef1 100644
--- a/structure/providers-and-adapters.md
+++ b/structure/providers-and-adapters.md
@@ -6,7 +6,7 @@ Claude CLI replay, client tool capture and usage admission follow [Claude CLI re
 
 API-key credit-balance refusals follow the [Anthropic billing recovery contract](providers/anthropic-key-billing.md). Managed native Anthropic serving UUID and observed CLI header continuity follow [native Messages](data-planes/protocol-paths.md#managed-native-messages); generated Responses retain the adapter's compatibility fingerprint.
 
-Opus 5.5 commentary follows the [signed progress-update contract](providers/anthropic-progress.md). Per-account usage thresholds follow the [Anthropic account thresholds contract](providers/anthropic-account-thresholds.md). See [permanent refusal auto-pause](account-auto-pause.md).
+Opus 5.5 commentary follows the [signed progress-update contract](providers/anthropic-progress.md). Per-account usage thresholds follow the [Anthropic account thresholds contract](providers/anthropic-account-thresholds.md).
 A shared-quota Anthropic 429 or classified pre-output account 403 records the served account's cooldown even when the request has used its allowed retry sends. That final account remains excluded on the next request; combo target cooling for 429 is skipped only after the matching account cooldown is present. Exact revoked-token 401s persist generation-fenced reauthentication under [the Anthropic recovery contract](providers/anthropic-account-pool.md#revoked-oauth-access-token-recovery).
 
 The Anthropic helper sends share the same routing authority: `getAnthropicSidecarAccessToken` resolves the vision-describe and web-search sidecars' helper model through the same first-match route decision, so a routed send authenticates as the route's own account rather than whatever pool account happens to be active. A strict route with no eligible account fails the helper locally instead of silently falling back to the active outsider, matching the primary-traffic contract; callers without a pool config keep the plain stored-credential path.
@@ -281,7 +281,7 @@ Cursor, one lease spans the whole turn: RunSSE and BidiAppend may overlap inside
 turns wait at the cap. Follow-up sends still obey start intervals. The turn owner returns its lease
 after `runTurn` settles, so RunSSE body completion cannot admit another turn early. A capped
 canonical Codex WebSocket turn uses HTTP/SSE because the socket has no response-body lifecycle.
-Capacity waits use the same bounded queue and retryable queue-overload errors as interval waits. Optional `requestPacing.keys` adds a shared cross-model limit for each credential reference; duplicate references share capacity, but distinct references resolving to one upstream project do not imply separate quota. `keySelection: round-robin` assigns request-local healthy keys without mutating persisted selection, skips disabled entries and known cooldowns, and refuses exhausted pools with retryable 429. Provider, model and key gates reserve atomically; key counters and the allocation cursor are process-local, not token or billing balances. OAuth and forwarded credentials retain their existing selection. Cooldown state is shared through the dependency-light `src/providers/api-key-cooldowns.ts` (retaining the longest outstanding expiry until explicit manual clearing) owner. Distributed selections are checked again at physical dispatch; a cooled queued key releases its old permit, selects a healthy sibling, and reacquires pacing before sending. Native Messages follows the same readmission rule. Native Responses, compact, Chat and Messages settle distributed refusals from immutable credential and destination metadata captured by `src/providers/api-key-response-ownership.ts` at physical fetch; successful same-key retry and unowned refusals do not cool keys. Failure ownership remains valid for a still-configured cooling key, so late in-flight rejections retain the longest cooldown without admitting another send. CLI-backed adapters check `IncomingMeta.beforePhysicalSend` after asynchronous setup and before spawn. An established distributed turn refuses later sends after its key cools instead of changing credentials mid-turn.
+Capacity waits use the same bounded queue and retryable queue-overload errors as interval waits. Optional `requestPacing.keys` adds a shared cross-model limit for each credential reference; duplicate references share capacity, but distinct references resolving to one upstream project do not imply separate quota. `keySelection: round-robin` assigns request-local healthy keys without mutating persisted selection, skips disabled entries (including keys paused by [permanent refusal auto-pause](account-auto-pause.md)) and known cooldowns, and refuses exhausted pools with retryable 429. Provider, model and key gates reserve atomically; key counters and the allocation cursor are process-local, not token or billing balances. OAuth and forwarded credentials retain their existing selection. Cooldown state is shared through the dependency-light `src/providers/api-key-cooldowns.ts` (retaining the longest outstanding expiry until explicit manual clearing) owner. Distributed selections are checked again at physical dispatch; a cooled queued key releases its old permit, selects a healthy sibling, and reacquires pacing before sending. Native Messages follows the same readmission rule. Native Responses, compact, Chat and Messages settle distributed refusals from immutable credential and destination metadata captured by `src/providers/api-key-response-ownership.ts` at physical fetch; successful same-key retry and unowned refusals do not cool keys. Failure ownership remains valid for a still-configured cooling key, so late in-flight rejections retain the longest cooldown without admitting another send. CLI-backed adapters check `IncomingMeta.beforePhysicalSend` after asynchronous setup and before spawn. An established distributed turn refuses later sends after its key cools instead of changing credentials mid-turn.
 
 Command Code effort defaults in `src/providers/command-code-efforts.ts` combine public-profile
 facts with the live API measurements from #5096. Both presets share the exact per-model rows;
diff --git a/structure/runtime.md b/structure/runtime.md
index 9b8a855ffa1..35542264e3a 100644
--- a/structure/runtime.md
+++ b/structure/runtime.md
@@ -96,7 +96,7 @@ The prefilter is only an optimization, not final process-membership authority.
 `src/cli/codex-cli-update.ts` dispatches the opt-in Windows x64 `attest` operation to `src/codex/cli-installation-identity.ts`. With no options, `src/codex/cli-installation-targets.ts` derives the four inputs from the proof-bound launcher snapshot: the configured candidate or the first codex on the captured PATH, an OpenCodex wrapper resolving to its renamed npm backing, the npm prefix layout, and the Node/npm toolchain beside the resolved node.exe. Configured values containing a path separator must be drive-absolute; otherwise derivation refuses with `candidate_unavailable` instead of substituting a different PATH candidate. Bare command names and the unset default continue to resolve only through the captured PATH. Discovery probes candidates through the same local-volume, reparse-refusing held-handle reader as final observation, so captured PATH entries cannot trigger network filesystem I/O. It never reads ambient state. Four explicit absolute paths remain accepted as an all-or-none override. Only the standard npm command shim or direct Codex package entry is accepted. The native reader in `src/codex/windows-installation-files.ts` holds ancestor/file handles for bounded reads and rejects reparse points, conflicting writers and unsupported paths/platforms. Its path-free report binds file identities and bytes to this observation, not a durable update permission. `installationIdentityObserved` can be true; `selectionAttested`, `managed` and `applyAllowed` remain false. Supplied Node identity does not prove launcher selection, effective npm config, past installer identity or tool authenticity. No package-registry request, installation, config write or process control occurs. Existing Windows `check` retains zero candidate/config filesystem I/O. A reported refusal can exit 0; consumers inspect `status`.
 
 The local account CLI and pool credential resolver share the [Orca source-owned import contract](codex-home.md#orca-source-owned-account-import): importing
-does not perform OAuth, and runtime credential resolution rereads the owned source. See [permanent refusal auto-pause](account-auto-pause.md).
+does not perform OAuth, and runtime credential resolution rereads the owned source.
 
 ## Entrypoints
 
diff --git a/structure/transports/responses-failover.md b/structure/transports/responses-failover.md
index 1fbe3388dab..ebff7e8c852 100644
--- a/structure/transports/responses-failover.md
+++ b/structure/transports/responses-failover.md
@@ -130,7 +130,7 @@ Native account-gated model selection maps no grant to 400, temporary capable-acc
 429/402 carrying only `x-codex-*-reset-at` may advance to the later model on the same account. The
 failed physical combo target still enters its normal target cooldown. An explicit `Retry-After`
 remains an account-wide instruction and blocks the later target; a quota response with neither an
-explicit retry delay nor a usable reset timestamp keeps the conservative default account cooldown. See [permanent refusal auto-pause](../account-auto-pause.md).
+explicit retry delay nor a usable reset timestamp keeps the conservative default account cooldown.
 This exception is request-scoped and is not applied to direct requests, round-robin combos, or a
 combo whose remaining eligible targets use other providers.
 
diff --git a/tests/cli/cli-account-key-pause.test.ts b/tests/cli/cli-account-key-pause.test.ts
new file mode 100644
index 00000000000..2c025898af5
--- /dev/null
+++ b/tests/cli/cli-account-key-pause.test.ts
@@ -0,0 +1,60 @@
+import { expect, test } from "bun:test";
+import { cmdPause } from "../../src/cli/account-extended";
+import type { AccountDeps } from "../../src/cli/account-api";
+import { repoPath } from "../helpers/repo-root";
+
+async function run(requested: string, options: { failWrite?: boolean; keys?: unknown[]; json?: boolean } = {}) {
+  const lines: string[] = [], errors: string[] = [], writes: unknown[] = [];
+  const log = console.log, error = console.error;
+  console.log = value => { lines.push(String(value)); };
+  console.error = value => { errors.push(String(value)); };
+  const deps: AccountDeps = {
+    baseUrl: "http://127.0.0.1:10100",
+    loadConfigImpl: () => ({ providers: { fixture: { adapter: "openai", authMode: "key" } } }) as never,
+    fetchImpl: (async (_url, init) => {
+      if (init?.method === "PUT") {
+        writes.push(JSON.parse(String(init.body)));
+        if (options.failWrite) throw new Error("fixture connection refused");
+        return Response.json({ ok: true });
+      }
+      return Response.json({ keys: options.keys ?? [{ id: "key-1", label: "reserve" }] });
+    }) as typeof fetch,
+  };
+  try {
+    const code = await cmdPause(["fixture", requested, ...(options.json ? ["--json"] : [])], deps, true);
+    return { code, lines, errors, writes };
+  } finally { console.log = log; console.error = error; }
+}
+
+test("API-key target errors retain the Error prefix and identify the pool kind", async () => {
+  const result = await run("missing");
+  expect(result.code).toBe(1);
+  expect(result.errors[0]).toBe('Error: Account not found: no API key account has the id or alias "missing"');
+  expect(result.writes).toEqual([]);
+});
+
+test("ambiguous key aliases are never rewritten when they contain OAuth", async () => {
+  const result = await run("OAuth reserve", { keys: [{ id: "one", label: "OAuth reserve" }, { id: "two", label: "OAuth reserve" }] });
+  expect(result.errors[0]).toBe('Error: alias "OAuth reserve" names 2 accounts; use the account id');
+  expect(result.writes).toEqual([]);
+});
+
+test("a failed pause transport reports an unreachable proxy and its cause", async () => {
+  const result = await run("reserve", { failWrite: true });
+  expect(result.code).toBe(1);
+  expect(result.errors.join("\n")).toContain("Proxy not reachable.");
+  expect(result.errors.join("\n")).toContain("fixture connection refused");
+});
+
+test("API-key pause JSON uses the same two-space indentation as the other pools", async () => {
+  const result = await run("reserve", { json: true });
+  expect(result.code).toBe(0);
+  expect(result.lines).toEqual([JSON.stringify({ ok: true, provider: "fixture", id: "key-1", paused: true }, null, 2)]);
+  expect(result.writes).toEqual([{ name: "fixture", id: "key-1", paused: true }]);
+});
+
+test("the defensive pause usage fallback also names API-key pools", async () => {
+  const source = await Bun.file(repoPath("src/cli/account-extended.ts")).text();
+  const fallback = source.split("\n").find(line => line.includes("${verb} applies to"));
+  expect(fallback).toContain('applies to the openai Codex account pool, a generic OAuth provider, or an API-key pool');
+});
diff --git a/tests/config/config-account-auto-pause-revisions.test.ts b/tests/config/config-account-auto-pause-revisions.test.ts
new file mode 100644
index 00000000000..56550fd472e
--- /dev/null
+++ b/tests/config/config-account-auto-pause-revisions.test.ts
@@ -0,0 +1,167 @@
+import { afterEach, beforeEach, expect, spyOn, test } from "bun:test";
+import { mkdtempSync, readFileSync, writeFileSync } from "node:fs";
+import { randomUUID } from "node:crypto";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { getDefaultConfig, initializePersistedConfigIfMissing, loadConfig, saveConfig } from "../../src/config";
+import { configSchema } from "../../src/config/schema/config-schema";
+import { captureAccountAutoPauseFence, accountAutoPauseFenceIsLocal } from "../../src/config/account-auto-pause-revisions";
+import { armClaudeCodeBaseline, reconcileLiveConfigFromDisk, saveConfigPreservingClaudeCode } from "../../src/config/live-reconcile";
+import { removeTreeWithRetry } from "../helpers/remove-tree";
+
+const previousHome = process.env.OPENCODEX_HOME;
+let home: string;
+beforeEach(() => { home = mkdtempSync(join(tmpdir(), "ocx-policy-config-")); process.env.OPENCODEX_HOME = home; });
+afterEach(() => {
+  if (previousHome === undefined) delete process.env.OPENCODEX_HOME; else process.env.OPENCODEX_HOME = previousHome;
+  removeTreeWithRetry(home);
+});
+function fixture(tracked = true) {
+  const config = getDefaultConfig();
+  config.providers = { fixture: { adapter: "openai-chat", baseUrl: "https://example.test/v1", authMode: "key", apiKey: "synthetic",
+    ...(tracked ? { accountAutoPause: { enabled: true } } : {}) } };
+  config.defaultProvider = "fixture";
+  return config;
+}
+const bytes = () => readFileSync(join(home, "config.json"), "utf8");
+const raw = () => JSON.parse(bytes());
+const revision = () => raw().accountAutoPausePolicyRevisions?.fixture;
+
+test("never-configured provider create, edit, initialize and unrelated writes omit the map", () => {
+  const config = fixture(false);
+  config.accountAutoPausePolicyRevisions = { injected: randomUUID() };
+  expect(initializePersistedConfigIfMissing(config)).toBe("created");
+  expect(bytes()).not.toContain("accountAutoPausePolicyRevisions");
+  config.providers.fixture!.baseUrl = "https://other.test/v1";
+  saveConfig(config);
+  expect(bytes()).not.toContain("accountAutoPausePolicyRevisions");
+  config.port++;
+  saveConfig(config);
+  expect(bytes()).not.toContain("accountAutoPausePolicyRevisions");
+  const stable = bytes();
+  saveConfig(config);
+  expect(bytes()).toBe(stable);
+  saveConfig(loadConfig());
+  expect(bytes()).not.toContain("accountAutoPausePolicyRevisions");
+});
+
+test("invalid-map recovery does not enroll never-configured providers", () => {
+  const config = fixture(false);
+  saveConfig(config);
+  writeFileSync(join(home, "config.json"), JSON.stringify({ ...raw(), accountAutoPausePolicyRevisions: { fixture: 12 } }));
+  const loaded = loadConfig();
+  expect(loaded.providers.fixture).toBeDefined();
+  expect(loaded.accountAutoPausePolicyRevisions).toBeNull();
+  saveConfig(loaded);
+  expect(bytes()).not.toContain("accountAutoPausePolicyRevisions");
+});
+
+test("caller epochs are ignored, unrelated edits preserve UUIDs and removed policies retain entries", () => {
+  const config = fixture();
+  saveConfig(config);
+  const first = revision();
+  expect(first).toMatch(/^[a-f0-9-]{36}$/);
+  config.accountAutoPausePolicyRevisions = { fixture: randomUUID(), injected: randomUUID() };
+  config.port++;
+  saveConfig(config);
+  expect(revision()).toBe(first);
+  expect(raw().accountAutoPausePolicyRevisions.injected).toBeUndefined();
+  config.providers.fixture!.accountAutoPause = undefined;
+  saveConfig(config);
+  expect(revision()).not.toBe(first);
+  const removedPolicy = revision();
+  delete config.providers.fixture;
+  saveConfig(config);
+  expect(revision()).not.toBe(removedPolicy);
+  expect(revision()).toBeDefined();
+});
+
+test("all full-fingerprint fields rotate policy epochs and wall-clock rollback cannot restore one", () => {
+  const config = fixture();
+  saveConfig(config);
+  const row = config.providers.fixture!;
+  const edits = [() => { row.accountAutoPause!.enabled = false; }, () => { row.accountAutoPause!.enabled = true; },
+    () => { row.accountAutoPause!.consecutiveFailures = 3; }, () => { row.disabled = true; },
+    () => { row.disabled = false; }, () => { row.baseUrl = "https://other.test/v1"; },
+    () => { row.adapter = "anthropic"; }, () => { row.authMode = "oauth"; }];
+  const seen = new Set([revision()]);
+  const oldNow = Date.now;
+  try {
+    Date.now = () => 1;
+    for (const edit of edits) { edit(); saveConfig(config); expect(seen.has(revision())).toBe(false); seen.add(revision()); }
+  } finally { Date.now = oldNow; }
+});
+
+test("invalid epochs load as unknown and the recovery write mints only configured providers", () => {
+  const config = fixture();
+  config.providers.untracked = { adapter: "openai-chat", baseUrl: "https://untracked.test/v1", authMode: "key" };
+  saveConfig(config);
+  const first = revision();
+  writeFileSync(join(home, "config.json"), JSON.stringify({ ...raw(), accountAutoPausePolicyRevisions: [first] }));
+  const loaded = loadConfig();
+  expect(loaded.providers.fixture).toBeDefined();
+  expect(captureAccountAutoPauseFence(loaded, "fixture")).toBeUndefined();
+  saveConfig(loaded);
+  expect(revision()).not.toBe(first);
+  expect(Object.keys(raw().accountAutoPausePolicyRevisions)).toEqual(["fixture"]);
+  expect(captureAccountAutoPauseFence(loaded, "fixture")).toBeDefined();
+});
+
+test("malformed Codex display details degrade per entry while revisions and paused ids survive", () => {
+  const config = fixture();
+  config.pausedCodexAccountIds = ["a", "b"];
+  const parsed = configSchema.parse({ ...config, codexAccountPauseState: {
+    a: { revision: "revision-a", details: { reason: "wrong", pausedAt: -1 } },
+    b: { revision: "revision-b", details: { reason: "subscription_expired", pausedAt: 42 } },
+    broken: null,
+  } });
+  expect(parsed.codexAccountPauseState?.a).toEqual({ revision: "revision-a" });
+  expect(parsed.codexAccountPauseState?.b?.details?.pausedAt).toBe(42);
+  expect(parsed.pausedCodexAccountIds).toEqual(["a", "b"]);
+  expect(configSchema.parse({ ...config, codexAccountPauseState: "invalid" }).pausedCodexAccountIds).toEqual(["a", "b"]);
+});
+
+test("save-time reconciliation and full reload observe fingerprint changes before replacement", () => {
+  const config = fixture();
+  saveConfig(config);
+  armClaudeCodeBaseline(config);
+  const fence = captureAccountAutoPauseFence(config, "fixture")!;
+  const disk = raw();
+  disk.providers.fixture.accountAutoPause.consecutiveFailures = 3;
+  writeFileSync(join(home, "config.json"), JSON.stringify(disk));
+  config.port++;
+  saveConfigPreservingClaudeCode(config);
+  expect(config.providers.fixture!.accountAutoPause!.consecutiveFailures).toBe(3);
+  expect(accountAutoPauseFenceIsLocal("fixture", fence)).toBe(false);
+  const newer = captureAccountAutoPauseFence(config, "fixture")!;
+  const baseline = structuredClone(config);
+  disk.providers.fixture.accountAutoPause.consecutiveFailures = 2;
+  writeFileSync(join(home, "config.json"), JSON.stringify(disk));
+  reconcileLiveConfigFromDisk(config, baseline);
+  expect(accountAutoPauseFenceIsLocal("fixture", newer)).toBe(false);
+});
+
+
+test("initial publication normalizes caller epochs for configured providers", () => {
+  const config = fixture();
+  const caller = randomUUID();
+  config.accountAutoPausePolicyRevisions = { fixture: caller };
+  expect(initializePersistedConfigIfMissing(config)).toBe("created");
+  expect(revision()).not.toBe(caller);
+  expect(captureAccountAutoPauseFence(config, "fixture")?.diskRevision).toBe(revision());
+});
+
+test("post-publication bookkeeping failure still adopts the new policy epoch", async () => {
+  const config = fixture();
+  saveConfig(config);
+  const fence = captureAccountAutoPauseFence(config, "fixture")!;
+  const registries = await import("../../src/config/derived-registries");
+  const { ConfigWritePublishedError } = await import("../../src/config/persist-unlocked");
+  const fail = spyOn(registries, "refreshConfigDerivedRegistries").mockImplementation(() => { throw new Error("synthetic bookkeeping failure"); });
+  try {
+    config.providers.fixture!.accountAutoPause!.enabled = false;
+    expect(() => saveConfig(config)).toThrow(ConfigWritePublishedError);
+    expect(revision()).not.toBe(fence.diskRevision);
+    expect(accountAutoPauseFenceIsLocal("fixture", fence)).toBe(false);
+  } finally { fail.mockRestore(); }
+});
diff --git a/tests/fixtures/test-layout-expected.json b/tests/fixtures/test-layout-expected.json
index 0ca412bbad5..c1aad6ceeef 100644
--- a/tests/fixtures/test-layout-expected.json
+++ b/tests/fixtures/test-layout-expected.json
@@ -9,7 +9,7 @@
   "codex-preserve-signed-in.test.ts": "codex-integration", "cli-account-preservation.test.ts": "cli",
   "catalog-native-max-context.test.ts": "codex-integration",
   "protocol-argon-thought-boundary.test.ts": "responses",
-  "responses-auto-pause-replay-owner.test.ts": "responses", "responses-account-auto-pause.test.ts": "responses", "oauth-account-auto-pause.test.ts": "oauth",
+  "responses-auto-pause-replay-owner.test.ts": "responses", "responses-account-auto-pause.test.ts": "responses", "oauth-account-auto-pause.test.ts": "oauth", "oauth-upsert-paused-api-key.test.ts": "oauth", "management-account-auto-pause.test.ts": "server", "cli-account-key-pause.test.ts": "cli", "oauth-account-auto-pause-revision.test.ts": "oauth", "config-account-auto-pause-revisions.test.ts": "config",
   "codex-provider-routing.test.ts": "codex-integration",
   "claude-picker-trust-windows.test.ts": "claude-integration", "claude-picker-windows.test.ts": "claude-integration", "config-native-reasoning-retention.test.ts": "config", "server-native-reasoning-retention-merge.test.ts": "server", "server-native-reasoning-retention.test.ts": "server", "responses-retained-reasoning-stream-recovery.test.ts": "responses",
   "advisor-retention.test.ts": "advisor", "responses-native-key-cooldown.test.ts": "responses", "responses-run-turn-key-readmission.test.ts": "responses", "qoder-spawn-readmission.test.ts": "adapters",
diff --git a/tests/oauth/oauth-account-auto-pause-revision.test.ts b/tests/oauth/oauth-account-auto-pause-revision.test.ts
new file mode 100644
index 00000000000..d1c9ac7777c
--- /dev/null
+++ b/tests/oauth/oauth-account-auto-pause-revision.test.ts
@@ -0,0 +1,208 @@
+import { afterEach, beforeEach, expect, test } from "bun:test";
+import { mkdtempSync, readFileSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { getDefaultConfig, saveConfig, loadConfig, mutatePersistedConfig } from "../../src/config";
+import { captureAccountAutoPauseAttempt, wasAccountAutoPaused } from "../../src/oauth/account-auto-pause";
+import { routedProviderConfig } from "../../src/router";
+import { saveCredential, getAccountSet } from "../../src/oauth/store";
+import { getValidAccessSnapshotForAccount } from "../../src/oauth";
+import { saveCodexAccountCredential } from "../../src/codex/account-store";
+import { removeTreeWithRetry } from "../helpers/remove-tree";
+
+const previousHome = process.env.OPENCODEX_HOME;
+let home: string;
+beforeEach(() => { home = mkdtempSync(join(tmpdir(), "ocx-policy-revision-")); process.env.OPENCODEX_HOME = home; });
+afterEach(() => {
+  if (previousHome === undefined) delete process.env.OPENCODEX_HOME; else process.env.OPENCODEX_HOME = previousHome;
+  removeTreeWithRetry(home);
+});
+const refusal = () => Response.json({ error: { type: "permission_error", message: "Your subscription has expired." } }, { status: 403 });
+async function fixture(mode: "key" | "oauth" | "forward" = "key", threshold = 1) {
+  const config = getDefaultConfig();
+  const name = mode === "oauth" ? "command-code" : "revision-fixture";
+  config.providers = { [name]: { adapter: "openai-chat", baseUrl: "https://example.test/v1", authMode: mode,
+    accountAutoPause: { enabled: true, consecutiveFailures: threshold }, ...(mode === "key" ? { apiKey: "synthetic-key" } : {}) } };
+  config.defaultProvider = name;
+  let oauth, codex;
+  if (mode === "oauth") {
+    await saveCredential(name, { access: "synthetic-access", refresh: "synthetic-refresh", expires: Date.now() + 3_600_000, accountId: "synthetic", source: "oauth" });
+    oauth = await getValidAccessSnapshotForAccount(name, getAccountSet(name)!.accounts[0]!.id);
+  }
+  if (mode === "forward") {
+    config.codexAccounts = [{ id: "fixture", email: "", isMain: false }];
+    const generation = saveCodexAccountCredential("fixture", { accessToken: "synthetic-access", refreshToken: "synthetic-refresh", expiresAt: Date.now() + 3_600_000, chatgptAccountId: "synthetic" });
+    codex = { kind: "pool" as const, accountId: "fixture", generation, writerGeneration: 0, accessToken: "synthetic-access", chatgptAccountId: "synthetic" };
+  }
+  saveConfig(config);
+  const capture = () => {
+    const provider = mode === "key" ? routedProviderConfig(name, config.providers[name]!) : config.providers[name]!;
+    return captureAccountAutoPauseAttempt(name, provider, { config, oauth, codex }, new Headers({ authorization: `Bearer ${mode === "key" ? provider.apiKey : "synthetic-access"}` }))!;
+  };
+  const paused = () => mode === "key" ? config.providers[name]!.apiKeyPool?.[0]?.disabled === true
+    : mode === "oauth" ? getAccountSet(name)!.accounts[0]!.paused === true : config.pausedCodexAccountIds?.includes("fixture") === true;
+  return { config, name, capture, paused };
+}
+for (const mode of ["oauth", "key", "forward"] as const) {
+  test(`${mode}: disable/re-enable with a backward clock fences an already captured response`, async () => {
+    const f = await fixture(mode);
+    const observe = f.capture();
+    const oldNow = Date.now;
+    try {
+      Date.now = () => 1;
+      f.config.providers[f.name]!.accountAutoPause!.enabled = false;
+      saveConfig(f.config);
+      f.config.providers[f.name]!.accountAutoPause!.enabled = true;
+      saveConfig(f.config);
+    } finally { Date.now = oldNow; }
+    const response = await observe(refusal());
+    expect(f.paused()).toBe(false);
+    expect(wasAccountAutoPaused(response)).toBe(false);
+    await f.capture()(refusal());
+    expect(f.paused()).toBe(true);
+  });
+}
+
+function editDisk(edit: (raw: ReturnType<typeof getDefaultConfig>) => void) {
+  const path = join(home, "config.json");
+  const raw = JSON.parse(readFileSync(path, "utf8"));
+  edit(raw);
+  writeFileSync(path, JSON.stringify(raw, null, 2) + "\n");
+}
+async function externalWrite(body: string) {
+  const { repoPath, repoRoot } = await import("../helpers/repo-root");
+  const child = Bun.spawn([process.execPath, "-e", `import { mutatePersistedConfig } from ${JSON.stringify(repoPath("src/config.ts"))}; ${body}`],
+    { cwd: repoRoot(), env: { ...process.env }, stdout: "pipe", stderr: "pipe" });
+  const error = await new Response(child.stderr).text();
+  expect(await child.exited, error).toBe(0);
+}
+for (const mode of ["oauth", "key", "forward"] as const) {
+  test(`${mode}: disk-only disabled provider cannot pause without reload`, async () => {
+    const f = await fixture(mode);
+    const observe = f.capture();
+    editDisk(raw => { raw.providers[f.name]!.disabled = true; });
+    const response = await observe(refusal());
+    expect(f.paused()).toBe(false);
+    expect(wasAccountAutoPaused(response)).toBe(false);
+  });
+  test(`${mode}: unrelated write preserves the streak and policy epoch`, async () => {
+    const f = await fixture(mode, 2);
+    await f.capture()(refusal());
+    const before = loadConfig().accountAutoPausePolicyRevisions;
+    mutatePersistedConfig(fresh => { fresh.port++; return { changed: true, value: true }; });
+    expect(loadConfig().accountAutoPausePolicyRevisions).toEqual(before);
+    await f.capture()(refusal());
+    expect(f.paused()).toBe(true);
+  });
+  test(`${mode}: external threshold change is checked at commit`, async () => {
+    const f = await fixture(mode);
+    const observe = f.capture();
+    await externalWrite(`mutatePersistedConfig(c => { c.providers[${JSON.stringify(f.name)}].accountAutoPause.consecutiveFailures = 3; return {changed: true, value: true}; });`);
+    const response = await observe(refusal());
+    expect(f.paused()).toBe(false);
+    expect(wasAccountAutoPaused(response)).toBe(false);
+  });
+  test(`${mode}: external ABA adopted by reload rejects old attempts and accepts new ones`, async () => {
+    const f = await fixture(mode);
+    const baseline = structuredClone(f.config);
+    const observe = f.capture();
+    await externalWrite(`for (const enabled of [false, true]) mutatePersistedConfig(c => { c.providers[${JSON.stringify(f.name)}].accountAutoPause.enabled = enabled; return {changed: true, value: true}; });`);
+    const { reconcileLiveConfigFromDisk } = await import("../../src/config/live-reconcile");
+    reconcileLiveConfigFromDisk(f.config, baseline);
+    const response = await observe(refusal());
+    expect(f.paused()).toBe(false);
+    expect(wasAccountAutoPaused(response)).toBe(false);
+    await f.capture()(refusal());
+    expect(f.paused()).toBe(true);
+  });
+  test(`${mode}: malformed revision map suppresses pauses until a valid write`, async () => {
+    const f = await fixture(mode);
+    const before = f.capture();
+    editDisk(raw => { raw.accountAutoPausePolicyRevisions = { [f.name]: "invalid" }; });
+    expect(loadConfig().accountAutoPausePolicyRevisions).toBeNull();
+    expect(f.capture()).toBeUndefined();
+    expect(wasAccountAutoPaused(await before(refusal()))).toBe(false);
+    expect(f.paused()).toBe(false);
+    saveConfig(f.config);
+    await f.capture()(refusal());
+    expect(f.paused()).toBe(true);
+  });
+}
+
+test("OAuth automatic commit fails fast under a separate-process config lock, then retries", async () => {
+  const f = await fixture("oauth");
+  const observe = f.capture();
+  const { repoPath, repoRoot } = await import("../helpers/repo-root");
+  const child = Bun.spawn([process.execPath, "-e", `import { withConfigMutationLockSync } from ${JSON.stringify(repoPath("src/config/mutation-lock.ts"))};
+    withConfigMutationLockSync(() => { process.stdout.write("locked"); Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 20000); });`],
+    { cwd: repoRoot(), env: { ...process.env }, stdout: "pipe", stderr: "pipe" });
+  try {
+    const reader = child.stdout.getReader();
+    const ready = await reader.read();
+    reader.releaseLock();
+    expect(new TextDecoder().decode(ready.value)).toBe("locked");
+    const started = performance.now();
+    const response = await observe(refusal());
+    expect(performance.now() - started).toBeLessThan(2000);
+    expect(wasAccountAutoPaused(response)).toBe(false);
+    expect(f.paused()).toBe(false);
+  } finally { child.kill(); await child.exited; }
+  await f.capture()(refusal());
+  expect(f.paused()).toBe(true);
+});
+
+test("reload row replacement changes local generation before a stale verdict can commit", async () => {
+  const f = await fixture();
+  const observe = f.capture();
+  const { adoptPersistedProviderIntoLiveConfig } = await import("../../src/config/live-reconcile");
+  const row = structuredClone(f.config.providers[f.name]!);
+  row.accountAutoPause!.consecutiveFailures = 3;
+  // A raw editor cannot update epochs; local generation still remembers both observations.
+  editDisk(raw => { raw.providers[f.name] = row; });
+  const changed = loadConfig();
+  adoptPersistedProviderIntoLiveConfig(f.config, f.name, row, changed);
+  row.accountAutoPause!.consecutiveFailures = 1;
+  editDisk(raw => { raw.providers[f.name] = row; });
+  adoptPersistedProviderIntoLiveConfig(f.config, f.name, row, loadConfig());
+  expect(wasAccountAutoPaused(await observe(refusal()))).toBe(false);
+  expect(f.paused()).toBe(false);
+  await f.capture()(refusal());
+  expect(f.paused()).toBe(true);
+});
+
+
+for (const field of ["baseUrl", "adapter", "authMode"] as const) {
+  test(`key: disk-only ${field} change with the same revision rejects a stale pause`, async () => {
+    const f = await fixture();
+    const observe = f.capture();
+    editDisk(raw => {
+      const row = raw.providers[f.name]!;
+      if (field === "baseUrl") row.baseUrl = "https://changed.test/v1";
+      else if (field === "adapter") row.adapter = "anthropic";
+      else row.authMode = "oauth";
+    });
+    expect(wasAccountAutoPaused(await observe(refusal()))).toBe(false);
+    expect(f.paused()).toBe(false);
+  });
+}
+
+test("OAuth policy ABA while waiting for the auth writer never commits the old pause", async () => {
+  const f = await fixture("oauth");
+  const { mutateStore } = await import("../../src/oauth/store");
+  let release!: () => void, entered!: () => void;
+  const ready = new Promise<void>(resolve => { entered = resolve; });
+  const held = mutateStore(async () => { entered(); await new Promise<void>(resolve => { release = resolve; }); });
+  await ready;
+  const observe = f.capture();
+  const pending = observe(refusal());
+  try {
+    for (const enabled of [false, true]) {
+      f.config.providers[f.name]!.accountAutoPause!.enabled = enabled;
+      saveConfig(f.config);
+    }
+  } finally { release(); await held; }
+  expect(wasAccountAutoPaused(await pending)).toBe(false);
+  expect(f.paused()).toBe(false);
+  await f.capture()(refusal());
+  expect(f.paused()).toBe(true);
+});
diff --git a/tests/oauth/oauth-upsert-paused-api-key.test.ts b/tests/oauth/oauth-upsert-paused-api-key.test.ts
new file mode 100644
index 00000000000..6c61f11069f
--- /dev/null
+++ b/tests/oauth/oauth-upsert-paused-api-key.test.ts
@@ -0,0 +1,61 @@
+import { describe, expect, test } from "bun:test";
+import { upsertOAuthProvider } from "../../src/oauth";
+import type { OcxConfig, OcxProviderConfig } from "../../src/types";
+
+function fixture(provider: string, fields: Partial<OcxProviderConfig>): OcxConfig {
+  return { port: 10100, defaultProvider: provider, providers: { [provider]: {
+    adapter: "openai-chat", baseUrl: "https://api.example.test/v1", authMode: "key", ...fields,
+  } } };
+}
+
+const paused = {
+  id: "paused", key: "paused-key-fixture", label: "Paused slot", addedAt: 42,
+  disabled: true, pauseRevision: "pause-revision-fixture",
+  pauseDetails: { reason: "subscription_expired", pausedAt: 1234 },
+} as const;
+
+describe("OAuth upsert preserves paused API keys", () => {
+  for (const provider of ["xai", "github-copilot"]) {
+    test.each([undefined, paused.key])(`${provider}: all-paused pool stays inactive (active=%s)`, apiKey => {
+      const config = fixture(provider, { apiKey, apiKeyPool: [structuredClone(paused)] });
+      const before = config.providers[provider]!;
+      upsertOAuthProvider(config, provider);
+      const after = config.providers[provider]!;
+      expect(after.apiKeyPool).toEqual([paused]);
+      expect(after.apiKeyPool).not.toBe(before.apiKeyPool);
+      expect(after.apiKeyPool![0]!.pauseDetails).not.toBe(before.apiKeyPool![0]!.pauseDetails);
+      expect(after.apiKey).toBeUndefined();
+      expect(after.authMode).toBe("oauth");
+      expect(before.apiKeyPool).toEqual([paused]);
+    });
+
+    test(`${provider}: promotes the first enabled key and preserves pause metadata`, () => {
+      const enabled = { id: "enabled", key: "enabled-key-fixture", disabled: false, pauseRevision: "resumed" };
+      const config = fixture(provider, { apiKeyPool: [structuredClone(paused), enabled] });
+      upsertOAuthProvider(config, provider);
+      expect(config.providers[provider]!.apiKey).toBe(enabled.key);
+      expect(config.providers[provider]!.apiKeyPool).toEqual([paused, enabled]);
+      expect(config.providers[provider]!.authMode).toBe("key");
+    });
+  }
+
+  test("malformed pause fields degrade independently while valid credentials survive", () => {
+    const badEntries = [
+      { id: "bad-types", key: "bad-types-key-fixture", disabled: "true", pauseRevision: 12,
+        pauseDetails: { reason: "subscription_expired", pausedAt: -1 } },
+      { ...paused, id: "bad-reason", key: "bad-reason-key-fixture",
+        pauseDetails: { reason: "unknown", pausedAt: 1234 } },
+      { ...paused, id: "bad-extra", key: "bad-extra-key-fixture",
+        pauseDetails: { ...paused.pauseDetails, extra: true } },
+    ];
+    const config = fixture("xai", { apiKeyPool: badEntries as unknown as OcxProviderConfig["apiKeyPool"] });
+    upsertOAuthProvider(config, "xai");
+    expect(config.providers.xai!.apiKeyPool).toEqual([
+      { id: "bad-types", key: "bad-types-key-fixture" },
+      { id: "bad-reason", key: "bad-reason-key-fixture", label: paused.label, addedAt: 42,
+        disabled: true, pauseRevision: paused.pauseRevision },
+      { id: "bad-extra", key: "bad-extra-key-fixture", label: paused.label, addedAt: 42,
+        disabled: true, pauseRevision: paused.pauseRevision },
+    ]);
+  });
+});
diff --git a/tests/server/management-account-auto-pause.test.ts b/tests/server/management-account-auto-pause.test.ts
new file mode 100644
index 00000000000..b24f09e901c
--- /dev/null
+++ b/tests/server/management-account-auto-pause.test.ts
@@ -0,0 +1,135 @@
+import { afterEach, beforeEach, describe, expect, spyOn, test } from "bun:test";
+import { mkdtempSync, readFileSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import * as destinationPolicy from "../../src/lib/destination-policy";
+import * as stateStores from "../../src/lib/state-store-registrations";
+import * as mutationLock from "../../src/config/mutation-lock";
+import { clearModelCache } from "../../src/codex/model-cache";
+import { providerManagementConfigError } from "../../src/server/auth-cors";
+import { handleProviderRoutes } from "../../src/server/management/provider-routes";
+import { handleOauthAccountRoutes } from "../../src/server/management/oauth-account-routes";
+import type { ManagementContext } from "../../src/server/management/context";
+import type { OcxConfig, OcxProviderConfig } from "../../src/types";
+import { removeTreeWithRetry } from "../helpers/remove-tree";
+
+const canonical = {
+  adapter: "openai-responses", baseUrl: "https://chatgpt.com/backend-api/codex",
+  authMode: "forward", codexAccountMode: "direct",
+} as const;
+const base = { adapter: "openai-chat", baseUrl: "https://relay.example.test/v1", liveModels: false } as const;
+let home: string;
+let previousHome: string | undefined;
+let destination: ReturnType<typeof spyOn<typeof destinationPolicy, "providerDestinationResolvedError">>;
+let reconcile: ReturnType<typeof spyOn<typeof stateStores, "reconcileLiveStateStores">>;
+
+beforeEach(() => {
+  previousHome = process.env.OPENCODEX_HOME;
+  home = mkdtempSync(join(tmpdir(), "ocx-account-pause-management-"));
+  process.env.OPENCODEX_HOME = home;
+  destination = spyOn(destinationPolicy, "providerDestinationResolvedError").mockResolvedValue(null);
+  reconcile = spyOn(stateStores, "reconcileLiveStateStores").mockReturnValue({ storesVisited: 0, rowsRemoved: 0 });
+});
+afterEach(() => {
+  destination.mockRestore();
+  reconcile.mockRestore();
+  clearModelCache();
+  if (previousHome === undefined) delete process.env.OPENCODEX_HOME;
+  else process.env.OPENCODEX_HOME = previousHome;
+  removeTreeWithRetry(home);
+});
+
+function harness(policy?: OcxProviderConfig["accountAutoPause"]) {
+  const config: OcxConfig = { port: 10100, defaultProvider: "relay", providers: {
+    relay: { ...base, ...(policy === undefined ? {} : { accountAutoPause: policy }) },
+  } };
+  const path = join(home, "saved.json");
+  writeFileSync(path, JSON.stringify(config));
+  async function request(method: "POST" | "PUT", body: unknown, pathname = "/api/providers") {
+    const url = new URL(pathname, "http://127.0.0.1");
+    const context: ManagementContext = {
+      req: new Request(url, { method, headers: { "Content-Type": "application/json" }, body: JSON.stringify(body) }),
+      url, config, version: "test", trustedLoopbackIngress: true, guiSessionIssuance: null,
+      deps: { saveConfigPreservingClaudeCode: saved => writeFileSync(path, JSON.stringify(saved)) },
+      convergeCodexCatalog: async () => ({ status: "committed", changed: false, degraded: false, notices: [] }),
+      syncClaudeAgentDefsBestEffort: async () => {},
+    };
+    return pathname.endsWith("/pause") ? handleOauthAccountRoutes(context) : handleProviderRoutes(context);
+  }
+  return { config, path, request, post: (fields: Record<string, unknown> = {}) =>
+    request("POST", { name: "relay", provider: { ...base, ...fields } }),
+    storedPolicy: () => (JSON.parse(readFileSync(path, "utf8")) as OcxConfig).providers.relay!.accountAutoPause };
+}
+
+describe("account auto-pause management", () => {
+  test.each([{}, { enabled: false }, { enabled: true, consecutiveFailures: 7 }])(
+    "POST omission retains stored policy %j and explicit policy replaces it", async policy => {
+      const h = harness(policy);
+      expect((await h.post({ note: "unrelated edit" }))?.status).toBe(200);
+      expect(h.config.providers.relay!.accountAutoPause).toEqual(policy);
+      expect(h.storedPolicy()).toEqual(policy);
+      expect((await h.post({ accountAutoPause: { enabled: false, consecutiveFailures: 3 } }))?.status).toBe(200);
+      expect(h.storedPolicy()).toEqual({ enabled: false, consecutiveFailures: 3 });
+    });
+
+  test.each([undefined, { enabled: false }, { enabled: true, consecutiveFailures: 9 }]
+    .flatMap(latest => [false, true].map(submitted => ({ latest, submitted }))))(
+    "publication uses latest omission or explicit replacement: %j", async ({ latest, submitted }) => {
+      const h = harness({ enabled: true, consecutiveFailures: 4 });
+      const lock = mutationLock.withConfigMutationLockSync;
+      let entered = false;
+      const probe = spyOn(mutationLock, "withConfigMutationLockSync").mockImplementation((fn, dir) => lock(() => {
+        entered = true;
+        if (latest === undefined) delete h.config.providers.relay!.accountAutoPause;
+        else h.config.providers.relay!.accountAutoPause = { ...latest };
+        return fn();
+      }, dir));
+      try {
+        const replacement = { enabled: false, consecutiveFailures: 2 };
+        expect((await h.post(submitted ? { accountAutoPause: replacement } : {}))?.status).toBe(200);
+        expect(entered).toBe(true);
+        expect(h.storedPolicy()).toEqual(submitted ? replacement : latest);
+        expect(h.config.providers.relay!.accountAutoPause).toEqual(submitted ? replacement : latest);
+      } finally { probe.mockRestore(); }
+    });
+
+  test("canonical OpenAI accepts valid auto-pause overlays while transport stays canonical", () => {
+    for (const policy of [{}, { enabled: false }, { enabled: true, consecutiveFailures: 100 }]) {
+      expect(providerManagementConfigError("openai", { ...canonical, accountAutoPause: policy })).toBeNull();
+    }
+    expect(providerManagementConfigError("openai", { ...canonical, baseUrl: "https://other.example.test/v1",
+      accountAutoPause: { enabled: true } })).not.toBeNull();
+  });
+
+  test("canonical OpenAI policy survives POST and invalid policy cannot publish", async () => {
+    const h = harness();
+    const policy = { enabled: true, consecutiveFailures: 6 };
+    expect((await h.request("POST", { name: "openai", provider: { ...canonical, accountAutoPause: policy } }))?.status).toBe(200);
+    expect(h.config.providers.openai!.accountAutoPause).toEqual(policy);
+    const before = readFileSync(h.path, "utf8");
+    expect((JSON.parse(before) as OcxConfig).providers.openai!.accountAutoPause).toEqual(policy);
+    for (const accountAutoPause of [null, { enabled: "true" }, { unexpected: true }]) {
+      expect((await h.request("POST", { name: "openai", provider: { ...canonical, accountAutoPause } }))?.status).toBe(400);
+      expect(readFileSync(h.path, "utf8")).toBe(before);
+      expect(h.config.providers.openai!.accountAutoPause).toEqual(policy);
+    }
+  });
+
+  test.each([null, [], true, { enabled: "true" }, { consecutiveFailures: 0 }, { consecutiveFailures: 101 },
+    { consecutiveFailures: 1.5 }, { unknown: "private-value-fixture" }].map(policy => ({ policy })))("invalid policy rejected: %j", ({ policy }) => {
+    for (const [name, provider] of [["relay", base], ["openai", canonical]] as const) {
+      for (const allowOperatorOverlays of [false, true]) {
+        const error = providerManagementConfigError(name, { ...provider, accountAutoPause: policy }, { allowOperatorOverlays });
+        expect(error).toContain("accountAutoPause");
+        expect(error).not.toContain("private-value-fixture");
+      }
+    }
+  });
+
+  test.each([null, [], true, "body"].map(body => ({ body })))("pause endpoint rejects non-object JSON %j", async ({ body }) => {
+    const h = harness();
+    const before = readFileSync(h.path, "utf8");
+    expect((await h.request("PUT", body, "/api/providers/keys/pause"))?.status).toBe(400);
+    expect(readFileSync(h.path, "utf8")).toBe(before);
+  });
+});

From 6a2bf5c609d0fd5b5ffcb0cd292269d30d332247 Mon Sep 17 00:00:00 2001
From: JUN <jun@lidgeai.com>
Date: Sun, 18 Oct 2026 05:09:18 +0900
Subject: [PATCH 10/17] fix(accounts): count auto-pause refusals only for the
 credential on the wire

sendWithConnectionPolicy now reports the final destination and headers,
after plugin rewrites and queued rebuilds, through an init symbol. Auto-pause
observers count a response only when that wire credential and destination
match the captured attempt; a Codex WebSocket send, which has no HTTP
final-send report, counts only while no plugin upstream rewriter is
registered. Native Chat, native Messages and the Responses providerFetch
path all report the final send.
---
 .../docs/reference/configuration/providers.md |   4 +-
 scripts/test-layout/layout.json               |   2 +-
 src/oauth/account-auto-pause.ts               |  26 ++-
 src/server/chat-native.ts                     |   3 +-
 src/server/messages-native.ts                 |   4 +-
 src/server/responses/fetch-helpers.ts         |  18 +-
 structure/account-auto-pause.md               |   6 +-
 tests/fixtures/test-layout-expected.json      |   2 +-
 ...nses-account-auto-pause-wire-owner.test.ts | 187 ++++++++++++++++++
 9 files changed, 239 insertions(+), 13 deletions(-)
 create mode 100644 tests/responses/responses-account-auto-pause-wire-owner.test.ts

diff --git a/docs-site/src/content/docs/reference/configuration/providers.md b/docs-site/src/content/docs/reference/configuration/providers.md
index 7244b396296..1f17c8405d9 100644
--- a/docs-site/src/content/docs/reference/configuration/providers.md
+++ b/docs-site/src/content/docs/reference/configuration/providers.md
@@ -1924,7 +1924,9 @@ account's streak. Transient errors leave the counter unchanged. Restarting the p
 counters; completed pauses, their fixed reason codes and timestamps persist. Independent
 proxy processes maintain independent counters. Changing, disabling or re-enabling the policy, disabling the provider,
 or changing its endpoint discards in-flight refusal observations, so a refusal from a request
-sent under the earlier policy can never pause an account afterwards.
+sent under the earlier policy can never pause an account afterwards. A refusal counts only for the credential that actually
+reached the upstream: when a local plugin rewrites the credential or destination of a send, that
+send never counts toward a pause.
 
 At the threshold, OpenCodex excludes the account using its existing pause mechanism and
 attempts an eligible sibling for the current request within the existing retry/send budget.
diff --git a/scripts/test-layout/layout.json b/scripts/test-layout/layout.json
index a5f0d191d9d..e3c8142e2c5 100644
--- a/scripts/test-layout/layout.json
+++ b/scripts/test-layout/layout.json
@@ -4,7 +4,7 @@
   "explicitShards": ["layout-clients.json"],
   "explicit": { "codex-provider-routing.test.ts": "codex-integration", "config-native-reasoning-retention.test.ts": "config", "server-native-reasoning-retention-merge.test.ts": "server", "server-native-reasoning-retention.test.ts": "server", "responses-retained-reasoning-stream-recovery.test.ts": "responses", "openai-native-hosted-search-history.test.ts": "adapters/openai", "responses-native-compact-search-history.test.ts": "responses", "config-hosted-search-projection.test.ts": "config", "gcp-credential-boundary.test.ts": "adapters/google", "gcp-sa-marker.test.ts": "adapters/google", "gcp-sa-adapter.test.ts": "adapters/google", "management-gcp-credential-input.test.ts": "server", "codex-preserve-signed-in.test.ts": "codex-integration", "cli-account-preservation.test.ts": "cli", "service-state-isolation.test.ts": "service", "compaction-history-framing.test.ts": "responses", "catalog-native-max-context.test.ts": "codex-integration", "protocol-argon-thought-boundary.test.ts": "responses", "service-log.test.ts": "service", "messages-native-empty-inline.test.ts": "claude-integration", "catalog-auto-review-override.test.ts": "codex-integration", "management-auto-review-settings.test.ts": "server", "management-auto-review-auth.test.ts": "server", "prefer-model-alias-ids.test.ts": "server", "responses-mimo-envelope.test.ts": "responses", "responses-call-id-linkage.test.ts": "responses", "bridge-terminal-refusal.test.ts": "adapters", "loop-terminal-refusal.test.ts": "images", "web-search-terminal-refusal.test.ts": "web-search", "combo-terminal-refusal.test.ts": "routing", "server-terminal-refusal-wiring.test.ts": "server", "incomplete-reason-normalization.test.ts": "responses", "advisor-retention.test.ts": "advisor", "responses-native-key-cooldown.test.ts": "responses", "responses-run-turn-key-readmission.test.ts": "responses", "qoder-spawn-readmission.test.ts": "adapters", "api-key-selection-cooldown.test.ts": "providers", "api-key-auto-pause-distribution.test.ts": "providers", "server-chat-native-key-selection.test.ts": "server", "compact-key-selection.test.ts": "responses", "messages-native-key-selection.test.ts": "claude-integration",
     "owner-registry-isolation.test.ts": "config",
-    "responses-auto-pause-replay-owner.test.ts": "responses", "responses-account-auto-pause.test.ts": "responses", "oauth-account-auto-pause.test.ts": "oauth", "oauth-upsert-paused-api-key.test.ts": "oauth", "management-account-auto-pause.test.ts": "server", "cli-account-key-pause.test.ts": "cli", "oauth-account-auto-pause-revision.test.ts": "oauth", "config-account-auto-pause-revisions.test.ts": "config", "codex-history-pending-wal.test.ts": "codex-integration", "responses-anthropic-billing-send-budget.test.ts": "responses", "anthropic-billing-ownership.test.ts": "adapters/anthropic", "server-anthropic-billing.test.ts": "server", "server-anthropic-billing-boundaries.test.ts": "server", "router-anthropic-billing-failover.test.ts": "routing", "anthropic-billing-refusal.test.ts": "adapters/anthropic", "messages-request-id-headers.test.ts": "claude-integration", "bounded-file-read.test.ts": "lib", "responses-undeclared-tool-guard-inbound.test.ts": "responses", "explicit-empty-tool-catalog.test.ts": "responses", "explicit-empty-tool-catalog-history.test.ts": "responses",
+    "responses-auto-pause-replay-owner.test.ts": "responses", "responses-account-auto-pause.test.ts": "responses", "oauth-account-auto-pause.test.ts": "oauth", "responses-account-auto-pause-wire-owner.test.ts": "responses", "oauth-upsert-paused-api-key.test.ts": "oauth", "management-account-auto-pause.test.ts": "server", "cli-account-key-pause.test.ts": "cli", "oauth-account-auto-pause-revision.test.ts": "oauth", "config-account-auto-pause-revisions.test.ts": "config", "codex-history-pending-wal.test.ts": "codex-integration", "responses-anthropic-billing-send-budget.test.ts": "responses", "anthropic-billing-ownership.test.ts": "adapters/anthropic", "server-anthropic-billing.test.ts": "server", "server-anthropic-billing-boundaries.test.ts": "server", "router-anthropic-billing-failover.test.ts": "routing", "anthropic-billing-refusal.test.ts": "adapters/anthropic", "messages-request-id-headers.test.ts": "claude-integration", "bounded-file-read.test.ts": "lib", "responses-undeclared-tool-guard-inbound.test.ts": "responses", "explicit-empty-tool-catalog.test.ts": "responses", "explicit-empty-tool-catalog-history.test.ts": "responses",
     "messages-request-id-endpoint.test.ts": "claude-integration",
     "anthropic-revoked-token.test.ts": "adapters/anthropic",
     "messages-revoked-token.test.ts": "claude-integration",
diff --git a/src/oauth/account-auto-pause.ts b/src/oauth/account-auto-pause.ts
index 4e254812f78..d9d5c8d977c 100644
--- a/src/oauth/account-auto-pause.ts
+++ b/src/oauth/account-auto-pause.ts
@@ -15,6 +15,7 @@ import { setProviderApiKeyPaused } from "../providers/api-key-pause";
 import { AccountRefusalStreaks, autoPauseThreshold, permanentAccountRefusal } from "./account-auto-pause-policy";
 import { clearThreadAccountMapForAccount, reconcileCodexActiveAfterExclusion } from "../codex/routing";
 import { isNonReplayableResponse } from "../lib/upstream-retry";
+import { hasUpstreamRewriters } from "../plugins/upstream-hooks";
 
 const streaks = new WeakMap<OcxConfig, AccountRefusalStreaks>();
 export { wasAccountAutoPaused, wasPermanentAccountRefusal } from "../lib/account-auto-pause-response";
@@ -26,8 +27,13 @@ export interface AccountAutoPauseBinding {
 }
 
 /** Capture before transport. A later response cannot acquire authority over a newer login/resume. */
+export type AccountAutoPauseObserver = ((response: Response) => Promise<Response>) & {
+  /** Final-send report: only a response whose wire credential and destination match is counted. */
+  physical: (sameDestination: boolean, headers: Headers) => void;
+};
+const CREDENTIAL_HEADERS = ["authorization", "x-api-key", "x-goog-api-key", "api-key"] as const;
 export function captureAccountAutoPauseAttempt(name: string, provider: OcxProviderConfig, binding?: AccountAutoPauseBinding, headers?: Headers):
-  ((response: Response) => Promise<Response>) | undefined {
+  AccountAutoPauseObserver | undefined {
   if (!binding) return;
   const { config, oauth, codex } = binding;
   const threshold = autoPauseThreshold(config.providers[name]?.accountAutoPause);
@@ -40,13 +46,14 @@ export function captureAccountAutoPauseAttempt(name: string, provider: OcxProvid
   const policyCurrent = () => accountAutoPauseFenceIsLocal(name, fence) && !config.providers[name]?.disabled
     && autoPauseThreshold(config.providers[name]?.accountAutoPause) === threshold
     && JSON.stringify([config.providers[name]?.baseUrl, config.providers[name]?.adapter, config.providers[name]?.authMode]) === route;
-  let key: string, incarnation: string, current: () => boolean;
+  let key: string, incarnation: string, current: () => boolean, owns: (wire: Headers) => boolean;
   let pause: (reason: AccountPauseReason) => Promise<boolean>;
   if (provider.authMode === "oauth") {
     if (!oauth || oauth.provider !== name || headers?.get("authorization") !== `Bearer ${oauth.accessToken}` || headers.has("x-api-key")) return;
     const row = getAccountSet(name)?.accounts.find(a => a.id === oauth.accountId);
     if (!row || row.paused || credentialGeneration(row.credential) !== oauth.generation) return;
     const revision = row.pauseRevision;
+    owns = wire => wire.get("authorization") === `Bearer ${oauth.accessToken}` && !wire.has("x-api-key");
     key = `${name}\0oauth\0${oauth.accountId}`;
     incarnation = `${row.loginId ?? row.addedAt ?? oauth.accountId}\0${revision ?? ""}`;
     current = () => {
@@ -61,6 +68,7 @@ export function captureAccountAutoPauseAttempt(name: string, provider: OcxProvid
     if (!codex || codex.kind !== "pool" && codex.kind !== "main-pool") return;
     const { accountId } = codex;
     if (headers?.get("authorization") !== `Bearer ${codex.accessToken}`) return;
+    owns = wire => wire.get("authorization") === `Bearer ${codex.accessToken}`;
     const revision = config.codexAccountPauseState?.[accountId]?.revision;
     const mainDispatch = codex.kind === "main-pool" ? captureMainQuotaDispatch(codex.accessToken, codex.chatgptAccountId, codex.writerGeneration) : undefined;
     const credentialCurrent = () => codex.kind === "pool"
@@ -96,6 +104,10 @@ export function captureAccountAutoPauseAttempt(name: string, provider: OcxProvid
     const { id, key: reference, pauseRevision } = entry;
     key = `${name}\0key\0${id}`;
     const resolvedKey = provider.apiKey;
+    owns = wire => {
+      const sent = CREDENTIAL_HEADERS.map(header => wire.get(header)).filter((value): value is string => value !== null);
+      return sent.length > 0 && sent.every(value => value === resolvedKey || value === `Bearer ${resolvedKey}`);
+    };
     incarnation = `${createHash("sha256").update(resolvedKey).digest("hex")}\0${pauseRevision ?? ""}`;
     current = () => {
       const configured = config.providers[name];
@@ -110,9 +122,13 @@ export function captureAccountAutoPauseAttempt(name: string, provider: OcxProvid
   let tracker = streaks.get(config);
   if (!tracker) { tracker = new AccountRefusalStreaks(); streaks.set(config, tracker); }
   const observed = new WeakSet<Response>();
-  return async response => {
+  // undefined: no HTTP final-send report (Codex WebSocket). Such a send is attributable only while
+  // no plugin can rewrite credentials or destination at the dial.
+  let wireOwned: boolean | undefined;
+  const observer = (async (response: Response) => {
     if (observed.has(response) || isNonReplayableResponse(response)) return response;
     observed.add(response);
+    if (!(wireOwned ?? !hasUpstreamRewriters())) return response;
     try {
       const verdict = permanentAccountRefusal(response).then(reason => {
         if (reason) markPermanentAccountRefusal(response);
@@ -130,5 +146,7 @@ export function captureAccountAutoPauseAttempt(name: string, provider: OcxProvid
       console.warn("[account-auto-pause] could not persist account pause; upstream response preserved");
     }
     return response;
-  };
+  }) as AccountAutoPauseObserver;
+  observer.physical = (sameDestination, wire) => { wireOwned = sameDestination && owns(wire); };
+  return observer;
 }
diff --git a/src/server/chat-native.ts b/src/server/chat-native.ts
index 0e5b6171b38..314ceaad5c8 100644
--- a/src/server/chat-native.ts
+++ b/src/server/chat-native.ts
@@ -69,7 +69,7 @@ import { enrichOpenCodeZenFreeTierMessage } from "../providers/opencode-zen-rate
 import type { OcxProviderTransport } from "../providers/xai-transport";
 import type { RouteResult } from "../router";
 import type { OcxConfig, OcxProviderConfig } from "../types";
-import { fetchWithHeaderTimeout, providerFetch, safeHostLabel, sendWithConnectionPolicy } from "./responses/fetch-helpers";
+import { fetchWithHeaderTimeout, physicalSendObserverInit, providerFetch, safeHostLabel, sendWithConnectionPolicy } from "./responses/fetch-helpers";
 import { isLocalUpstream } from "../lib/local-upstream";
 import { linkAbortSignal } from "./responses";
 import {
@@ -540,6 +540,7 @@ export async function runNativeChatAttempt(
                   request.url,
                   applyUpstreamRecoveryInit({
                     ...init, method: request.method, headers, body: request.body,
+                    ...physicalSendObserverInit(observeAutoPause, request.url),
                   }, transportRecovery),
                   // Reselection can replace the provider transport and the wire shape, so the
                   // egress route is bound to the provider this send actually uses. Omitting it
diff --git a/src/server/messages-native.ts b/src/server/messages-native.ts
index 37b8bde637d..43be7603fe8 100644
--- a/src/server/messages-native.ts
+++ b/src/server/messages-native.ts
@@ -121,7 +121,7 @@ import {
   recordKeyWireAttemptUsage,
   type RequestLogContext,
 } from "./request-log";
-import { fetchWithHeaderTimeout, providerFetch, safeHostLabel, sendWithConnectionPolicy } from "./responses/fetch-helpers";
+import { fetchWithHeaderTimeout, physicalSendObserverInit, providerFetch, safeHostLabel, sendWithConnectionPolicy } from "./responses/fetch-helpers";
 import { anthropicBillingPhysicalFetch } from "../providers/anthropic-billing-ownership";
 import { rotateAnthropicBillingKeyOnResponse } from "../providers/anthropic-billing-recovery";
 import { linkAbortSignal } from "./responses/core-lifetime";
@@ -643,7 +643,7 @@ export async function handleNativeMessages(options: HandleNativeMessagesOptions)
                   anthropicBillingPhysicalFetch((activeProvider as OcxProviderTransport).fetch ?? execute, route.providerName, activeProvider),
                   route.providerName, activeProvider, wire.url, activeProvider.apiKeyTransport === "bearer" ? "authorization" : "x-api-key"),
                 wire.url,
-                applyUpstreamRecoveryInit({ ...init, method: "POST", headers, body: wire.body }, transportRecovery),
+                applyUpstreamRecoveryInit({ ...init, method: "POST", headers, body: wire.body, ...physicalSendObserverInit(observeAutoPause, wire.url) }, transportRecovery),
                 { providerName: route.providerName, provider: activeProvider },
               );
             } finally {
diff --git a/src/server/responses/fetch-helpers.ts b/src/server/responses/fetch-helpers.ts
index e2d26135c9d..fbb4c250c93 100644
--- a/src/server/responses/fetch-helpers.ts
+++ b/src/server/responses/fetch-helpers.ts
@@ -48,6 +48,17 @@ const EGRESS_DECIDED = Symbol.for("opencodex.provider-egress.decided");
 const UPSTREAM_REWRITTEN = Symbol.for("opencodex.plugins.upstream-rewritten");
 // Survives queued credential rebuilds and executor replacement without importing budget owners.
 const PHYSICAL_DISPATCH = Symbol.for("opencodex.physical-dispatch");
+// Final destination and headers after plugin rewrites and queued rebuilds, for observers that
+// must attribute a response to the credential that actually reached the wire.
+const PHYSICAL_SEND_OBSERVER = Symbol.for("opencodex.physical-send-observer");
+export type AccountAutoPauseObserver = ((response: Response) => Promise<Response>) & {
+  physical?: (sameDestination: boolean, headers: Headers) => void;
+};
+/** Init fragment that reports the final send of the observer's attempt; empty when nothing observes. */
+export function physicalSendObserverInit(observer: AccountAutoPauseObserver | undefined, target: string): Record<symbol, unknown> {
+  const physical = observer?.physical;
+  return physical ? { [PHYSICAL_SEND_OBSERVER]: (destination: string, headers: Headers) => physical(destination === target, headers) } : {};
+}
 // One WS attempt and its HTTP fallback are one logical physical-send receipt.
 const WS_FALLBACK_RECEIPT = Symbol.for("opencodex.ws-fallback-receipt");
 // Replacement admission waits on the client signal, outside the response-header deadline.
@@ -212,6 +223,7 @@ export function sendWithConnectionPolicy(
     && /^https:\/\/chatgpt\.com\/backend-api\/codex\/responses(?:\/compact)?$/.test(target)
     && Buffer.byteLength(body, "utf8") >= 1024 * 1024;
   (init as Record<symbol, (() => void) | undefined> | undefined)?.[PHYSICAL_DISPATCH]?.();
+  (init as Record<symbol, ((destination: string, headers: Headers) => void) | undefined> | undefined)?.[PHYSICAL_SEND_OBSERVER]?.(target, headers);
   // Final headers, after plugin rewrites: an upstream can only echo what it received here, so the
   // request log refuses any diagnostic that repeats one of these values (see request-log-terminal-status).
   outboundCredentials().remember(headers);
@@ -228,7 +240,7 @@ export function sendWithConnectionPolicy(
 }
 
 export interface ProviderFetchOptions {
-  accountAutoPause?: (name: string, provider: OcxProviderConfig, headers: Headers) => ((response: Response) => Promise<Response>) | undefined;
+  accountAutoPause?: (name: string, provider: OcxProviderConfig, headers: Headers) => AccountAutoPauseObserver | undefined;
   /**
    * Keep this send on HTTP even where the WebSocket upstream would normally be selected.
    *
@@ -386,7 +398,9 @@ export function providerFetch(
     reacquirePacing?: (provider: OcxProviderConfig, modelId?: string) => Promise<void>) => {
     const observe = options.accountAutoPause?.(providerName, provider,
       new Headers(init?.headers ?? (input instanceof Request ? input.headers : undefined)));
-    const response = await unobserved(input, init, reacquirePacing);
+    const observedInit = observe?.physical
+      ? { ...init, ...physicalSendObserverInit(observe, input instanceof Request ? input.url : String(input)) } : init;
+    const response = await unobserved(input, observedInit, reacquirePacing);
     return observe ? observe(response) : response;
   };
   let pacingSlotAcquired = options.pacingSlotAcquired === true;
diff --git a/structure/account-auto-pause.md b/structure/account-auto-pause.md
index 50b0b94fddf..328eb7ca950 100644
--- a/structure/account-auto-pause.md
+++ b/structure/account-auto-pause.md
@@ -11,7 +11,11 @@ Codex/runTurn response observation; the transport leaf imports no account or OAu
 boundaries. `src/oauth/account-auto-pause.ts` is dormant unless the named provider explicitly
 enables the policy, writes only fixed pause metadata, and preserves upstream responses if
 optional persistence fails. Counters and asynchronous decisions belong to the runtime
-config object; completed pauses belong to the existing durable account stores.
+config object; completed pauses belong to the existing durable account stores. A response is counted only when the final destination and credential
+headers, reported by `sendWithConnectionPolicy` after plugin rewrites and queued rebuilds, match the
+captured attempt; a Codex WebSocket send has no HTTP final-send report and counts only while no
+plugin upstream rewriter is registered. Regression coverage:
+`tests/responses/responses-account-auto-pause-wire-owner.test.ts`.
 
 ## Permanent account refusal policy
 
diff --git a/tests/fixtures/test-layout-expected.json b/tests/fixtures/test-layout-expected.json
index c1aad6ceeef..7bded41c864 100644
--- a/tests/fixtures/test-layout-expected.json
+++ b/tests/fixtures/test-layout-expected.json
@@ -9,7 +9,7 @@
   "codex-preserve-signed-in.test.ts": "codex-integration", "cli-account-preservation.test.ts": "cli",
   "catalog-native-max-context.test.ts": "codex-integration",
   "protocol-argon-thought-boundary.test.ts": "responses",
-  "responses-auto-pause-replay-owner.test.ts": "responses", "responses-account-auto-pause.test.ts": "responses", "oauth-account-auto-pause.test.ts": "oauth", "oauth-upsert-paused-api-key.test.ts": "oauth", "management-account-auto-pause.test.ts": "server", "cli-account-key-pause.test.ts": "cli", "oauth-account-auto-pause-revision.test.ts": "oauth", "config-account-auto-pause-revisions.test.ts": "config",
+  "responses-auto-pause-replay-owner.test.ts": "responses", "responses-account-auto-pause.test.ts": "responses", "oauth-account-auto-pause.test.ts": "oauth", "responses-account-auto-pause-wire-owner.test.ts": "responses", "oauth-upsert-paused-api-key.test.ts": "oauth", "management-account-auto-pause.test.ts": "server", "cli-account-key-pause.test.ts": "cli", "oauth-account-auto-pause-revision.test.ts": "oauth", "config-account-auto-pause-revisions.test.ts": "config",
   "codex-provider-routing.test.ts": "codex-integration",
   "claude-picker-trust-windows.test.ts": "claude-integration", "claude-picker-windows.test.ts": "claude-integration", "config-native-reasoning-retention.test.ts": "config", "server-native-reasoning-retention-merge.test.ts": "server", "server-native-reasoning-retention.test.ts": "server", "responses-retained-reasoning-stream-recovery.test.ts": "responses",
   "advisor-retention.test.ts": "advisor", "responses-native-key-cooldown.test.ts": "responses", "responses-run-turn-key-readmission.test.ts": "responses", "qoder-spawn-readmission.test.ts": "adapters",
diff --git a/tests/responses/responses-account-auto-pause-wire-owner.test.ts b/tests/responses/responses-account-auto-pause-wire-owner.test.ts
new file mode 100644
index 00000000000..704ebd07841
--- /dev/null
+++ b/tests/responses/responses-account-auto-pause-wire-owner.test.ts
@@ -0,0 +1,187 @@
+import { afterEach, beforeEach, expect, test } from "bun:test";
+import { mkdtempSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { getDefaultConfig, loadConfig, saveConfig } from "../../src/config";
+import { captureAccountAutoPauseAttempt, wasAccountAutoPaused } from "../../src/oauth/account-auto-pause";
+import { clearGenericFailoverHealth } from "../../src/oauth/generic-account-failover";
+import { registerUpstreamRewriter, type UpstreamRewriter } from "../../src/plugins/upstream-hooks";
+import { clearKeyCooldowns, forgetApiKeyRotationCursor } from "../../src/providers/key-failover";
+import { routedProviderConfig } from "../../src/router";
+import { clearResponseStateForTests, flushResponseState } from "../../src/responses/state";
+import { handleChatCompletions } from "../../src/server/chat-completions";
+import { handleClaudeMessages } from "../../src/server/claude-messages";
+import { providerFetch } from "../../src/server/responses/fetch-helpers";
+import type { OcxConfig } from "../../src/types";
+import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
+import { removeTreeWithRetry } from "../helpers/remove-tree";
+
+const originalFetch = globalThis.fetch;
+let previousHome: string | undefined;
+let home: string;
+let releaseSpend: () => void;
+const unregister: (() => void)[] = [];
+const target = "https://example.test/v1/responses";
+const replacementTarget = "https://other.example.test/v1/responses";
+const refusal = () => Response.json({ error: { type: "permission_error", message: "Your subscription has expired." } }, { status: 403 });
+
+beforeEach(() => {
+  previousHome = process.env.OPENCODEX_HOME;
+  home = mkdtempSync(join(tmpdir(), "ocx-auto-pause-wire-owner-"));
+  process.env.OPENCODEX_HOME = home;
+  releaseSpend = acquireOwnedSpendHome();
+  clearGenericFailoverHealth(); clearKeyCooldowns(); forgetApiKeyRotationCursor();
+});
+afterEach(async () => {
+  for (const remove of unregister.splice(0)) remove();
+  await flushResponseState(); clearResponseStateForTests();
+  releaseSpend();
+  clearGenericFailoverHealth(); clearKeyCooldowns(); forgetApiKeyRotationCursor();
+  globalThis.fetch = originalFetch;
+  if (previousHome === undefined) delete process.env.OPENCODEX_HOME;
+  else process.env.OPENCODEX_HOME = previousHome;
+  removeTreeWithRetry(home);
+});
+function rewrite(fn: UpstreamRewriter) {
+  unregister.push(registerUpstreamRewriter("account-auto-pause-wire-owner-fixture", fn));
+}
+function fixture(adapter: "openai-chat" | "anthropic" | "openai-responses" = "openai-chat"): OcxConfig {
+  const config = getDefaultConfig();
+  config.defaultProvider = "fixture"; config.defaultModel = "fixture";
+  config.providers = { fixture: { adapter, authMode: "key", baseUrl: "https://example.test/v1", models: ["fixture"],
+    apiKey: "synthetic-A", apiKeyPool: [{ id: "A", key: "synthetic-A" }, { id: "B", key: "synthetic-B" }],
+    requestPacing: { enabled: true, keySelection: "round-robin", keys: { maxConcurrentRequests: 1 } },
+    accountAutoPause: { enabled: true, consecutiveFailures: 1 },
+  } };
+  if (adapter === "anthropic") config.protocols = { rollout: { managedMessagesNative: true } };
+  saveConfig(config);
+  return config;
+}
+function expectUnpaused(config: OcxConfig) {
+  for (const provider of [config.providers.fixture!, loadConfig().providers.fixture!]) {
+    expect(provider.apiKeyPool!.map(row => row.id)).toEqual(["A", "B"]);
+    for (const row of provider.apiKeyPool!) {
+      expect(row.disabled).not.toBe(true);
+      expect(row.pauseDetails).toBeUndefined();
+    }
+  }
+}
+function expectPaused(config: OcxConfig) {
+  for (const provider of [config.providers.fixture!, loadConfig().providers.fixture!]) {
+    expect(provider.apiKeyPool![0]).toMatchObject({ id: "A", disabled: true, pauseDetails: { reason: "subscription_expired" } });
+    expect(provider.apiKeyPool![1]!.disabled).not.toBe(true);
+  }
+}
+
+for (const wire of ["Chat", "Messages"] as const) {
+  for (const replaced of [true, false]) {
+    test(`native ${wire}: ${replaced ? "rewritten credential cannot pause either round-robin key" : "identity rewriter still permits the wire owner to pause"}`, async () => {
+      const config = fixture(wire === "Chat" ? "openai-chat" : "anthropic");
+      const credentialHeader = wire === "Chat" ? "authorization" : "x-api-key";
+      const beforeRewrite: string[] = [];
+      rewrite(({ headers }) => {
+        beforeRewrite.push(headers.get(credentialHeader)!);
+        if (replaced) headers.set(credentialHeader, wire === "Chat" ? "Bearer synthetic-third" : "synthetic-third");
+      });
+      const sent: { url: string; credential: string | null; response: Response }[] = [];
+      globalThis.fetch = (async (input, init) => {
+        const credential = new Headers(init?.headers).get(credentialHeader);
+        const response = !replaced && credential?.includes("synthetic-B")
+          ? Response.json(wire === "Chat"
+            ? { id: "synthetic-chat", object: "chat.completion", model: "fixture", choices: [{ index: 0, message: { role: "assistant", content: "ok" }, finish_reason: "stop" }], usage: { prompt_tokens: 1, completion_tokens: 1, total_tokens: 2 } }
+            : { id: "synthetic-message", type: "message", role: "assistant", model: "fixture", content: [{ type: "text", text: "ok" }], stop_reason: "end_turn", usage: { input_tokens: 1, output_tokens: 1 } })
+          : refusal();
+        sent.push({ url: String(input), credential, response });
+        return response;
+      }) as typeof fetch;
+      const endpoint = wire === "Chat" ? "chat/completions" : "messages";
+      const request = new Request(`http://localhost/v1/${endpoint}`, { method: "POST", headers: { "content-type": "application/json" },
+        body: JSON.stringify({ model: "fixture/fixture", max_tokens: 64, messages: [{ role: "user", content: "synthetic" }], stream: false }),
+      });
+      const handler = wire === "Chat" ? handleChatCompletions : handleClaudeMessages;
+      const response = await handler(request, config, { model: "fixture", provider: "fixture" });
+      const body = await response.text();
+      expect(response.status, body).toBe(replaced ? 403 : 200);
+      expect(sent).toHaveLength(replaced ? 1 : 2);
+      expect(sent[0]!.url).toContain(`/v1/${endpoint}`);
+      expect(beforeRewrite).toEqual((replaced ? ["A"] : ["A", "B"]).map(id => wire === "Chat" ? `Bearer synthetic-${id}` : `synthetic-${id}`));
+      expect(sent[0]!.credential).toBe(wire === "Chat" ? `Bearer synthetic-${replaced ? "third" : "A"}` : `synthetic-${replaced ? "third" : "A"}`);
+      expect(wasAccountAutoPaused(sent[0]!.response)).toBe(!replaced);
+      if (replaced) {
+        expect(wasAccountAutoPaused(response)).toBe(false);
+        expectUnpaused(config);
+      } else expectPaused(config);
+    });
+  }
+}
+
+for (const change of ["credential", "URL", "conflicting header", "none", "identity rewriter"] as const) {
+  test(`Responses providerFetch: ${change} ${change === "none" || change === "identity rewriter" ? "pauses the wire owner" : "does not pause a configured key"}`, async () => {
+    const config = fixture("openai-responses");
+    const route = routedProviderConfig("fixture", config.providers.fixture!);
+    const rewrittenFrom: string[] = [];
+    if (change !== "none") rewrite(t => {
+      rewrittenFrom.push(t.headers.get("authorization")!);
+      if (change === "credential") t.headers.set("authorization", "Bearer synthetic-third");
+      if (change === "URL") t.url = replacementTarget;
+      if (change === "conflicting header") t.headers.set("x-api-key", "synthetic-third");
+    });
+    const sends: { url: string; headers: Headers }[] = [];
+    const upstream = refusal();
+    const physical = (async (input, init) => {
+      sends.push({ url: String(input), headers: new Headers(init?.headers) });
+      return upstream;
+    }) as typeof fetch;
+    let captured = 0;
+    const send = providerFetch(Object.assign(route, { fetch: physical }), undefined, {
+      providerName: "fixture", httpOnly: true,
+      accountAutoPause: (name, provider, headers) => {
+        captured++;
+        const observer = captureAccountAutoPauseAttempt(name, provider, { config }, headers);
+        expect(observer).toBeDefined();
+        return observer;
+      },
+    });
+    const response = await send(target, { method: "POST", headers: { authorization: "Bearer synthetic-A" }, body: "{}" });
+    const body = await response.json();
+    expect(captured).toBe(1);
+    expect(response.status).toBe(403);
+    expect(body).toEqual({ error: { type: "permission_error", message: "Your subscription has expired." } });
+    expect(sends).toHaveLength(1);
+    expect(rewrittenFrom).toEqual(change === "none" ? [] : ["Bearer synthetic-A"]);
+    expect(sends[0]!.url).toBe(change === "URL" ? replacementTarget : target);
+    expect(sends[0]!.headers.get("authorization")).toBe(change === "credential" ? "Bearer synthetic-third" : "Bearer synthetic-A");
+    expect(sends[0]!.headers.get("x-api-key")).toBe(change === "conflicting header" ? "synthetic-third" : null);
+    const shouldPause = change === "none" || change === "identity rewriter";
+    expect(wasAccountAutoPaused(response)).toBe(shouldPause);
+    if (shouldPause) expectPaused(config); else expectUnpaused(config);
+  });
+}
+
+for (const registered of [true, false]) {
+  test(`observer without physical report: ${registered ? "registered rewriter prevents counting" : "no rewriter permits counting"}`, async () => {
+    const config = fixture();
+    const route = routedProviderConfig("fixture", config.providers.fixture!);
+    const observer = captureAccountAutoPauseAttempt("fixture", route, { config }, new Headers({ authorization: "Bearer synthetic-A" }));
+    expect(observer).toBeDefined();
+    // Captured before registration: the no-report fallback must check at response time.
+    if (registered) rewrite(() => {});
+    const response = refusal();
+    expect(await observer!(response)).toBe(response);
+    expect(wasAccountAutoPaused(response)).toBe(!registered);
+    if (registered) expectUnpaused(config); else expectPaused(config);
+  });
+}
+
+test("physical report with matching bearer and conflicting x-api-key grants no API-key pause authority", async () => {
+  const config = fixture();
+  const route = routedProviderConfig("fixture", config.providers.fixture!);
+  const observer = captureAccountAutoPauseAttempt("fixture", route, { config }, new Headers({ authorization: "Bearer synthetic-A" }))!;
+  expect(observer).toBeDefined();
+  expect(typeof observer.physical).toBe("function");
+  observer.physical(true, new Headers({ authorization: "Bearer synthetic-A", "x-api-key": "synthetic-third" }));
+  const response = refusal();
+  expect(await observer(response)).toBe(response);
+  expect(wasAccountAutoPaused(response)).toBe(false);
+  expectUnpaused(config);
+});

From 828defc71afb9721a83a155e11a5f34a4c6f508f Mon Sep 17 00:00:00 2001
From: JUN <jun@lidgeai.com>
Date: Sun, 18 Oct 2026 05:16:22 +0900
Subject: [PATCH 11/17] fix(accounts): report oauthDispatch final sends and
 fence WebSocket attribution

The Responses oauthDispatch send now attaches its auto-pause observer's
final-send report. A send without an HTTP report (Codex WebSocket) counts
only when no upstream rewriter was registered at capture and the rewriter
registration epoch is unchanged at the response, so a rewriter that
registers or unregisters mid-send can no longer make a rewritten dial look
attributable.
---
 src/oauth/account-auto-pause.ts               |  10 +-
 src/plugins/upstream-hooks.ts                 |  15 ++-
 src/server/responses/request-transport.ts     |   5 +-
 structure/account-auto-pause.md               |   5 +-
 ...nses-account-auto-pause-wire-owner.test.ts | 114 +++++++++++++++++-
 5 files changed, 138 insertions(+), 11 deletions(-)

diff --git a/src/oauth/account-auto-pause.ts b/src/oauth/account-auto-pause.ts
index d9d5c8d977c..0e097737e8a 100644
--- a/src/oauth/account-auto-pause.ts
+++ b/src/oauth/account-auto-pause.ts
@@ -15,7 +15,7 @@ import { setProviderApiKeyPaused } from "../providers/api-key-pause";
 import { AccountRefusalStreaks, autoPauseThreshold, permanentAccountRefusal } from "./account-auto-pause-policy";
 import { clearThreadAccountMapForAccount, reconcileCodexActiveAfterExclusion } from "../codex/routing";
 import { isNonReplayableResponse } from "../lib/upstream-retry";
-import { hasUpstreamRewriters } from "../plugins/upstream-hooks";
+import { hasUpstreamRewriters, upstreamRewriterEpoch } from "../plugins/upstream-hooks";
 
 const streaks = new WeakMap<OcxConfig, AccountRefusalStreaks>();
 export { wasAccountAutoPaused, wasPermanentAccountRefusal } from "../lib/account-auto-pause-response";
@@ -122,13 +122,15 @@ export function captureAccountAutoPauseAttempt(name: string, provider: OcxProvid
   let tracker = streaks.get(config);
   if (!tracker) { tracker = new AccountRefusalStreaks(); streaks.set(config, tracker); }
   const observed = new WeakSet<Response>();
-  // undefined: no HTTP final-send report (Codex WebSocket). Such a send is attributable only while
-  // no plugin can rewrite credentials or destination at the dial.
+  // undefined: no HTTP final-send report (Codex WebSocket). Such a send is attributable only when
+  // no rewriter was registered at capture and none was registered or removed before the response,
+  // so no plugin could have rewritten the dial in between.
+  const rewriterEpoch = hasUpstreamRewriters() ? undefined : upstreamRewriterEpoch();
   let wireOwned: boolean | undefined;
   const observer = (async (response: Response) => {
     if (observed.has(response) || isNonReplayableResponse(response)) return response;
     observed.add(response);
-    if (!(wireOwned ?? !hasUpstreamRewriters())) return response;
+    if (!(wireOwned ?? (rewriterEpoch !== undefined && upstreamRewriterEpoch() === rewriterEpoch))) return response;
     try {
       const verdict = permanentAccountRefusal(response).then(reason => {
         if (reason) markPermanentAccountRefusal(response);
diff --git a/src/plugins/upstream-hooks.ts b/src/plugins/upstream-hooks.ts
index 13c64f8896d..b401c04690d 100644
--- a/src/plugins/upstream-hooks.ts
+++ b/src/plugins/upstream-hooks.ts
@@ -31,13 +31,20 @@ interface Registration {
 }
 
 const registrations: Registration[] = [];
+// Changes on every registration and removal, so an observer can tell that no rewriter could
+// have touched a send between two points even when the slot is empty at both.
+let registrationEpoch = 0;
 
 export function registerUpstreamRewriter(name: string, rewrite: UpstreamRewriter): () => void {
   const registration: Registration = { name, rewrite, disabled: false };
   registrations.push(registration);
+  registrationEpoch += 1;
   return () => {
     const index = registrations.indexOf(registration);
-    if (index >= 0) registrations.splice(index, 1);
+    if (index >= 0) {
+      registrations.splice(index, 1);
+      registrationEpoch += 1;
+    }
   };
 }
 
@@ -45,6 +52,11 @@ export function hasUpstreamRewriters(): boolean {
   return registrations.length > 0;
 }
 
+/** Monotonic registration epoch; equal values bracket a window with no registration change. */
+export function upstreamRewriterEpoch(): number {
+  return registrationEpoch;
+}
+
 /**
  * Run every active rewriter over one send. Returns the input untouched (same objects) when
  * no rewriter is registered, so the common path allocates nothing.
@@ -116,4 +128,5 @@ export function rewriteWebSocketDial(
 
 export function resetUpstreamRewritersForTests(): void {
   registrations.length = 0;
+  registrationEpoch += 1;
 }
diff --git a/src/server/responses/request-transport.ts b/src/server/responses/request-transport.ts
index 5da6f25cf71..482b3f96b86 100644
--- a/src/server/responses/request-transport.ts
+++ b/src/server/responses/request-transport.ts
@@ -71,7 +71,7 @@ import {
   resolveCurrentProviderApiKeyTransport,
 } from "../../providers/api-key-selection";
 import { resolveAdapter, resolveWireProtocolOverride } from "../adapter-resolve";
-import { providerFetch, sendWithConnectionPolicy } from "./fetch-helpers";
+import { physicalSendObserverInit, providerFetch, sendWithConnectionPolicy } from "./fetch-helpers";
 import type { ProviderFetchOptions } from "./fetch-helpers";
 import { captureConfigGeneration } from "../../lib/state-store-sweeper";
 import { recordAnthropicAccountQuotaFromHeadersForInstance, hasPassiveAccountQuota } from "../../providers/quota";
@@ -801,7 +801,8 @@ export async function prepareResponsesTransport(
             response = await sendWithConnectionPolicy(
               distributedKeyPhysicalFetch(anthropicBillingPhysicalFetch(fetchImpl, route.providerName, route.provider), route.providerName, route.provider, target),
               destination,
-              { ...dispatchInit, redirect: "manual" },
+              { ...dispatchInit, redirect: "manual",
+                ...physicalSendObserverInit(observeAutoPause, destination instanceof Request ? destination.url : String(destination)) },
               { providerName: route.providerName, provider: route.provider },
             );
           } finally { releaseFamily(); }
diff --git a/structure/account-auto-pause.md b/structure/account-auto-pause.md
index 328eb7ca950..6a01923de11 100644
--- a/structure/account-auto-pause.md
+++ b/structure/account-auto-pause.md
@@ -13,8 +13,9 @@ enables the policy, writes only fixed pause metadata, and preserves upstream res
 optional persistence fails. Counters and asynchronous decisions belong to the runtime
 config object; completed pauses belong to the existing durable account stores. A response is counted only when the final destination and credential
 headers, reported by `sendWithConnectionPolicy` after plugin rewrites and queued rebuilds, match the
-captured attempt; a Codex WebSocket send has no HTTP final-send report and counts only while no
-plugin upstream rewriter is registered. Regression coverage:
+captured attempt; a Codex WebSocket send has no HTTP final-send report and counts only when no
+plugin upstream rewriter was registered at capture and the registration epoch in
+`src/plugins/upstream-hooks.ts` is unchanged when the response arrives. Regression coverage:
 `tests/responses/responses-account-auto-pause-wire-owner.test.ts`.
 
 ## Permanent account refusal policy
diff --git a/tests/responses/responses-account-auto-pause-wire-owner.test.ts b/tests/responses/responses-account-auto-pause-wire-owner.test.ts
index 704ebd07841..f417214fdb8 100644
--- a/tests/responses/responses-account-auto-pause-wire-owner.test.ts
+++ b/tests/responses/responses-account-auto-pause-wire-owner.test.ts
@@ -1,17 +1,20 @@
-import { afterEach, beforeEach, expect, test } from "bun:test";
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
 import { mkdtempSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { getDefaultConfig, loadConfig, saveConfig } from "../../src/config";
+import { saveCodexAccountCredential } from "../../src/codex/account-store";
 import { captureAccountAutoPauseAttempt, wasAccountAutoPaused } from "../../src/oauth/account-auto-pause";
 import { clearGenericFailoverHealth } from "../../src/oauth/generic-account-failover";
-import { registerUpstreamRewriter, type UpstreamRewriter } from "../../src/plugins/upstream-hooks";
+import { registerUpstreamRewriter, rewriteWebSocketDial, type UpstreamRewriter } from "../../src/plugins/upstream-hooks";
 import { clearKeyCooldowns, forgetApiKeyRotationCursor } from "../../src/providers/key-failover";
 import { routedProviderConfig } from "../../src/router";
+import { resetProviderRequestPacingForTest } from "../../src/providers/request-pacing";
 import { clearResponseStateForTests, flushResponseState } from "../../src/responses/state";
 import { handleChatCompletions } from "../../src/server/chat-completions";
 import { handleClaudeMessages } from "../../src/server/claude-messages";
 import { providerFetch } from "../../src/server/responses/fetch-helpers";
+import { handleResponses } from "../../src/server/responses/core";
 import type { OcxConfig } from "../../src/types";
 import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
 import { removeTreeWithRetry } from "../helpers/remove-tree";
@@ -185,3 +188,110 @@ test("physical report with matching bearer and conflicting x-api-key grants no A
   expect(wasAccountAutoPaused(response)).toBe(false);
   expectUnpaused(config);
 });
+
+
+describe("Responses handler translated Chat physical send ownership", () => {
+  beforeEach(() => resetProviderRequestPacingForTest());
+  afterEach(() => resetProviderRequestPacingForTest());
+  for (const plugin of ["none", "identity", "credential replacement then unregister"] as const) {
+    test(`${plugin}: ${plugin === "credential replacement then unregister" ? "preserves refusal without pausing either key" : "pauses A and recovers with B"}`, async () => {
+      const config = fixture("openai-chat");
+      const rewrittenFrom: string[] = [];
+      let removeRewriter: (() => void) | undefined;
+      const replaced = plugin === "credential replacement then unregister";
+      if (plugin !== "none") {
+        removeRewriter = registerUpstreamRewriter("responses-chat-wire-owner-fixture", ({ headers, transport }) => {
+          expect(transport).toBe("http");
+          rewrittenFrom.push(headers.get("authorization")!);
+          if (replaced) headers.set("authorization", "Bearer synthetic-third");
+        });
+        unregister.push(removeRewriter);
+      }
+      const sends: { url: string; credential: string | null; response: Response }[] = [];
+      globalThis.fetch = (async (input, init) => {
+        const credential = new Headers(init?.headers).get("authorization");
+        // The plugin disappears while the rewritten physical send is in flight.
+        if (replaced) removeRewriter!();
+        const response = credential === "Bearer synthetic-B"
+          ? Response.json({ id: "synthetic-chat", object: "chat.completion", model: "fixture",
+            choices: [{ index: 0, message: { role: "assistant", content: "ok" }, finish_reason: "stop" }],
+            usage: { prompt_tokens: 1, completion_tokens: 1, total_tokens: 2 } })
+          : refusal();
+        sends.push({ url: String(input), credential, response });
+        return response;
+      }) as typeof fetch;
+      const response = await handleResponses(new Request("http://localhost/v1/responses", {
+        method: "POST", headers: { "content-type": "application/json" },
+        body: JSON.stringify({ model: "fixture/fixture", input: "synthetic", stream: false, store: false }),
+      }), config, { model: "fixture", provider: "fixture" });
+      const body = await response.text();
+      expect(response.status, body).toBe(replaced ? 403 : 200);
+      expect(sends.map(send => send.url)).toEqual(Array(replaced ? 1 : 2).fill("https://example.test/v1/chat/completions"));
+      expect(sends.map(send => send.credential)).toEqual(replaced
+        ? ["Bearer synthetic-third"] : ["Bearer synthetic-A", "Bearer synthetic-B"]);
+      expect(rewrittenFrom).toEqual(plugin === "none" ? []
+        : replaced ? ["Bearer synthetic-A"] : ["Bearer synthetic-A", "Bearer synthetic-B"]);
+      expect(wasAccountAutoPaused(sends[0]!.response)).toBe(!replaced);
+      if (replaced) {
+        expect(body).toContain("Your subscription has expired.");
+        expectUnpaused(config);
+      } else {
+        expect(body).toContain("ok");
+        expectPaused(config);
+      }
+    });
+  }
+});
+
+describe("Codex pool WebSocket observer without a physical report", () => {
+  for (const plugin of ["registered after capture then removed", "registered at capture then removed", "none"] as const) {
+    test(`${plugin}: ${plugin === "none" ? "counts the refusal and pauses the captured account" : "does not count the rewritten dial refusal"}`, async () => {
+      const config = getDefaultConfig();
+      config.defaultProvider = "openai"; config.defaultModel = "gpt-5.5";
+      config.providers = { openai: { adapter: "openai-responses", authMode: "forward", codexAccountMode: "pool",
+        baseUrl: "https://chatgpt.com/backend-api/codex", models: ["gpt-5.5"],
+        accountAutoPause: { enabled: true, consecutiveFailures: 1 } } };
+      config.codexAccounts = ["fixture-a", "fixture-b"].map(id => ({ id, email: "", isMain: false }));
+      config.activeCodexAccountId = "fixture-a";
+      const generation = saveCodexAccountCredential("fixture-a", { accessToken: "synthetic-access", refreshToken: "synthetic-refresh",
+        expiresAt: Date.now() + 3_600_000, chatgptAccountId: "synthetic-account" });
+      saveConfig(config);
+      let removeRewriter: (() => void) | undefined;
+      let rewrites = 0;
+      const install = () => {
+        removeRewriter = registerUpstreamRewriter("codex-ws-wire-owner-fixture", target => {
+          rewrites++;
+          expect(target.transport).toBe("websocket");
+          target.headers.set("authorization", "Bearer synthetic-third");
+        });
+        unregister.push(removeRewriter);
+      };
+      if (plugin === "registered at capture then removed") install();
+      const observer = captureAccountAutoPauseAttempt("openai", config.providers.openai!, { config,
+        codex: { kind: "pool", accountId: "fixture-a", generation, writerGeneration: 0,
+          accessToken: "synthetic-access", chatgptAccountId: "synthetic-account" },
+      }, new Headers({ authorization: "Bearer synthetic-access" }));
+      expect(observer).toBeDefined();
+      if (plugin === "registered after capture then removed") install();
+      const dial = rewriteWebSocketDial("wss://chatgpt.com/backend-api/codex/responses", {
+        authorization: "Bearer synthetic-access", "chatgpt-account-id": "synthetic-account",
+      }, undefined);
+      expect(rewrites).toBe(plugin === "none" ? 0 : 1);
+      expect(dial.headers.authorization).toBe(plugin === "none" ? "Bearer synthetic-access" : "Bearer synthetic-third");
+      removeRewriter?.();
+      // WebSocket has no HTTP physical report; observe only after the plugin is gone.
+      const response = refusal();
+      expect(await observer!(response)).toBe(response);
+      expect(response.status).toBe(403);
+      expect(await response.json()).toEqual({ error: { type: "permission_error", message: "Your subscription has expired." } });
+      const shouldPause = plugin === "none";
+      expect(wasAccountAutoPaused(response)).toBe(shouldPause);
+      for (const live of [config, loadConfig()]) {
+        expect(live.pausedCodexAccountIds?.includes("fixture-a") ?? false).toBe(shouldPause);
+        expect(live.pausedCodexAccountIds?.includes("fixture-b") ?? false).toBe(false);
+        if (shouldPause) expect(live.codexAccountPauseState?.["fixture-a"]?.details?.reason).toBe("subscription_expired");
+        else expect(live.codexAccountPauseState?.["fixture-a"]).toBeUndefined();
+      }
+    });
+  }
+});

From 1b75d31415718401f57e6a11c1cdf13bd93d11e4 Mon Sep 17 00:00:00 2001
From: JUN <jun@lidgeai.com>
Date: Sun, 18 Oct 2026 05:18:22 +0900
Subject: [PATCH 12/17] fix(accounts): count a nested physical response once
 per account

A providerFetch observer and the dispatchOverride observer inside it see the
same physical response. Count it once per account key, and never let an
observer without a final-send report attribute a response that another
observer reported as sent with a different credential.
---
 src/oauth/account-auto-pause.ts               | 10 +++++
 structure/account-auto-pause.md               |  4 +-
 ...nses-account-auto-pause-wire-owner.test.ts | 40 +++++++++++++++++++
 3 files changed, 53 insertions(+), 1 deletion(-)

diff --git a/src/oauth/account-auto-pause.ts b/src/oauth/account-auto-pause.ts
index 0e097737e8a..08185131390 100644
--- a/src/oauth/account-auto-pause.ts
+++ b/src/oauth/account-auto-pause.ts
@@ -32,6 +32,11 @@ export type AccountAutoPauseObserver = ((response: Response) => Promise<Response
   physical: (sameDestination: boolean, headers: Headers) => void;
 };
 const CREDENTIAL_HEADERS = ["authorization", "x-api-key", "x-goog-api-key", "api-key"] as const;
+// Nested capture sites (a providerFetch observer around a dispatchOverride's own observer) see the
+// same physical response. It counts once per account, and a response whose final send was reported
+// to any observer is never attributed by an observer that received no report.
+const countedResponses = new WeakMap<Response, Set<string>>();
+const reportedResponses = new WeakSet<Response>();
 export function captureAccountAutoPauseAttempt(name: string, provider: OcxProviderConfig, binding?: AccountAutoPauseBinding, headers?: Headers):
   AccountAutoPauseObserver | undefined {
   if (!binding) return;
@@ -130,7 +135,12 @@ export function captureAccountAutoPauseAttempt(name: string, provider: OcxProvid
   const observer = (async (response: Response) => {
     if (observed.has(response) || isNonReplayableResponse(response)) return response;
     observed.add(response);
+    if (wireOwned !== undefined) reportedResponses.add(response);
+    else if (reportedResponses.has(response)) return response;
     if (!(wireOwned ?? (rewriterEpoch !== undefined && upstreamRewriterEpoch() === rewriterEpoch))) return response;
+    const counted = countedResponses.get(response) ?? new Set<string>();
+    if (counted.has(key)) return response;
+    countedResponses.set(response, counted.add(key));
     try {
       const verdict = permanentAccountRefusal(response).then(reason => {
         if (reason) markPermanentAccountRefusal(response);
diff --git a/structure/account-auto-pause.md b/structure/account-auto-pause.md
index 6a01923de11..d154b8526b2 100644
--- a/structure/account-auto-pause.md
+++ b/structure/account-auto-pause.md
@@ -15,7 +15,9 @@ config object; completed pauses belong to the existing durable account stores. A
 headers, reported by `sendWithConnectionPolicy` after plugin rewrites and queued rebuilds, match the
 captured attempt; a Codex WebSocket send has no HTTP final-send report and counts only when no
 plugin upstream rewriter was registered at capture and the registration epoch in
-`src/plugins/upstream-hooks.ts` is unchanged when the response arrives. Regression coverage:
+`src/plugins/upstream-hooks.ts` is unchanged when the response arrives. Nested capture sites that see the same physical response count it once
+per account, and an observer without a final-send report never attributes a response another
+observer had reported. Regression coverage:
 `tests/responses/responses-account-auto-pause-wire-owner.test.ts`.
 
 ## Permanent account refusal policy
diff --git a/tests/responses/responses-account-auto-pause-wire-owner.test.ts b/tests/responses/responses-account-auto-pause-wire-owner.test.ts
index f417214fdb8..c6ae597cb98 100644
--- a/tests/responses/responses-account-auto-pause-wire-owner.test.ts
+++ b/tests/responses/responses-account-auto-pause-wire-owner.test.ts
@@ -295,3 +295,43 @@ describe("Codex pool WebSocket observer without a physical report", () => {
     });
   }
 });
+
+describe("nested auto-pause observers on one physical response", () => {
+  test("count a refusal once per account when both observers see it", async () => {
+    const config = fixture();
+    config.providers.fixture!.accountAutoPause = { enabled: true, consecutiveFailures: 2 };
+    saveConfig(config);
+    const route = routedProviderConfig("fixture", config.providers.fixture!);
+    const headers = () => new Headers({ authorization: "Bearer synthetic-A" });
+    const outer = captureAccountAutoPauseAttempt("fixture", route, { config }, headers())!;
+    const inner = captureAccountAutoPauseAttempt("fixture", route, { config }, headers())!;
+    inner.physical(true, headers());
+    const first = refusal();
+    await inner(first);
+    await outer(first);
+    expect(wasAccountAutoPaused(first)).toBe(false);
+    expectUnpaused(config);
+    // The streak still holds one refusal: the next owned refusal reaches the threshold of two.
+    const next = captureAccountAutoPauseAttempt("fixture", route, { config }, headers())!;
+    next.physical(true, headers());
+    const second = refusal();
+    await next(second);
+    expect(wasAccountAutoPaused(second)).toBe(true);
+    expectPaused(config);
+  });
+
+  test("an unreported observer never attributes a response reported as sent with another credential", async () => {
+    const config = fixture();
+    const route = routedProviderConfig("fixture", config.providers.fixture!);
+    const headers = new Headers({ authorization: "Bearer synthetic-A" });
+    const outer = captureAccountAutoPauseAttempt("fixture", route, { config }, headers)!;
+    const inner = captureAccountAutoPauseAttempt("fixture", route, { config }, headers)!;
+    inner.physical(true, new Headers({ authorization: "Bearer synthetic-third" }));
+    const response = refusal();
+    await inner(response);
+    await outer(response);
+    expect(wasAccountAutoPaused(response)).toBe(false);
+    expectUnpaused(config);
+  });
+});
+

From 9da33869d0e4533d762f170764826b01a1f2e1a4 Mon Sep 17 00:00:00 2001
From: JUN <jun@lidgeai.com>
Date: Sun, 18 Oct 2026 05:25:14 +0900
Subject: [PATCH 13/17] fix(accounts): keep live auto-pause fences across
 detached config loads

A loadConfig() snapshot now adopts only the disk revision; fingerprints and
local generations start there only for providers not yet observed, so a
detached snapshot that differs from the live config can no longer keep
invalidating in-flight fences. API-key quota rows also keep the pause flag
and known pause details, matching the plain key listing.
---
 src/cli/account-key-quota.ts                  |  5 ++++-
 src/config/account-auto-pause-revisions.ts    | 19 ++++++++++++++++++-
 tests/cli/cli-account-key-quota.test.ts       | 13 +++++++++++++
 ...onfig-account-auto-pause-revisions.test.ts | 16 +++++++++++++++-
 4 files changed, 50 insertions(+), 3 deletions(-)

diff --git a/src/cli/account-key-quota.ts b/src/cli/account-key-quota.ts
index 9ba56a0cc8f..3b890f06cfd 100644
--- a/src/cli/account-key-quota.ts
+++ b/src/cli/account-key-quota.ts
@@ -2,6 +2,7 @@
 import { parseQuotaFailureCode, type AccountQuotaFields, type ProviderQuota, type ProviderQuotaWindow, type ProviderQuotaCreditsUsd } from "../providers/quota-types";
 import { terminalSafeText } from "./runtime-api";
 import type { AccountRow, FamilyRows } from "./account-api";
+import { accountPauseDetailsSchema } from "../config/schema/account-auto-pause";
 
 function record(value: unknown): Record<string, unknown> {
   if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("Malformed API-key quota response.");
@@ -88,7 +89,9 @@ export function projectApiKeyQuotaRows(value: unknown, provider: string): Family
     }
     const masked = optionalString(row, "masked");
     return { provider, type: "api-key", id, label: optionalString(row, "label") ?? masked,
-      masked, active: optionalBoolean(row, "active") ?? id === activeId, ...fields };
+      masked, active: optionalBoolean(row, "active") ?? id === activeId,
+      // Same projection as the plain key listing: disabled keeps the key paused, unknown details drop.
+      paused: row.disabled === true, pauseDetails: accountPauseDetailsSchema.safeParse(row.pauseDetails).data, ...fields };
   });
   return { rows, activeId, status: 200 };
 }
diff --git a/src/config/account-auto-pause-revisions.ts b/src/config/account-auto-pause-revisions.ts
index 360c2cb6066..8fd9424f46a 100644
--- a/src/config/account-auto-pause-revisions.ts
+++ b/src/config/account-auto-pause-revisions.ts
@@ -65,9 +65,26 @@ export function observeAccountAutoPauseRevisions(config: PolicyConfig, disk: Pol
       localGen: (old?.localGen ?? 0) + (prior !== fingerprint ? 1 : 0) });
   }
 }
+/**
+ * A loaded snapshot adopts the disk epoch only. Many callers read detached snapshots; letting one
+ * replace the live fingerprint would advance localGen on every live/snapshot difference and keep
+ * invalidating in-flight fences. Fingerprints and generations start here only for unseen names.
+ */
+function adoptDiskAutoPauseRevisions(config: PolicyConfig): void {
+  const path = getConfigPath();
+  let entries = observed.get(path);
+  if (!entries) { entries = new Map(); observed.set(path, entries); }
+  const map = revisions(config);
+  for (const name of new Set([...entries.keys(), ...Object.keys(record(config.providers) ?? {}), ...Object.keys(map ?? {})])) {
+    const old = entries.get(name);
+    const diskRevision = revisionFor(map, name) ?? "legacy";
+    entries.set(name, old ? { ...old, diskRevision, unknown: map === null }
+      : { fingerprint: accountAutoPauseFingerprint(provider(config, name)), diskRevision, unknown: map === null, localGen: 0 });
+  }
+}
 /** Initial load is an observation, never a persistence operation. */
 export function observeLoadedAutoPauseConfig(config: OcxConfig): OcxConfig {
-  observeAccountAutoPauseRevisions(config);
+  adoptDiskAutoPauseRevisions(config);
   return config;
 }
 export function captureAccountAutoPauseFence(config: OcxConfig, name: string): AccountAutoPauseFence | undefined {
diff --git a/tests/cli/cli-account-key-quota.test.ts b/tests/cli/cli-account-key-quota.test.ts
index 5521e4fd61e..8353e7a4fd3 100644
--- a/tests/cli/cli-account-key-quota.test.ts
+++ b/tests/cli/cli-account-key-quota.test.ts
@@ -222,3 +222,16 @@ test("absence, explicit null and unavailable last-good remain distinct in JSON",
   expect(accounts[2].quotaUnavailable).toBe(true);
   expect(formatAccountTable(projectApiKeyQuotaRows(body(keys), "openrouter").rows, true)).toContain("probe: unavailable");
 });
+
+test("quota key rows keep the pause flag and only known pause details", () => {
+  const rows = projectApiKeyQuotaRows(body([
+    row({ disabled: true, pauseDetails: { reason: "subscription_expired", pausedAt: 1 } }),
+    row({ id: "second", disabled: true, pauseDetails: { reason: "reason_from_a_newer_proxy", pausedAt: 2 } }),
+    row({ id: "third" }),
+  ]), "openrouter").rows;
+  expect(rows[0]).toMatchObject({ paused: true, pauseDetails: { reason: "subscription_expired", pausedAt: 1 } });
+  expect(rows[1]!.paused).toBe(true);
+  expect(rows[1]!.pauseDetails).toBeUndefined();
+  expect(rows[2]!.paused).toBe(false);
+});
+
diff --git a/tests/config/config-account-auto-pause-revisions.test.ts b/tests/config/config-account-auto-pause-revisions.test.ts
index 56550fd472e..b5174c4cade 100644
--- a/tests/config/config-account-auto-pause-revisions.test.ts
+++ b/tests/config/config-account-auto-pause-revisions.test.ts
@@ -5,7 +5,7 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { getDefaultConfig, initializePersistedConfigIfMissing, loadConfig, saveConfig } from "../../src/config";
 import { configSchema } from "../../src/config/schema/config-schema";
-import { captureAccountAutoPauseFence, accountAutoPauseFenceIsLocal } from "../../src/config/account-auto-pause-revisions";
+import { captureAccountAutoPauseFence, accountAutoPauseFenceIsLocal, observeAccountAutoPauseRevisions } from "../../src/config/account-auto-pause-revisions";
 import { armClaudeCodeBaseline, reconcileLiveConfigFromDisk, saveConfigPreservingClaudeCode } from "../../src/config/live-reconcile";
 import { removeTreeWithRetry } from "../helpers/remove-tree";
 
@@ -165,3 +165,17 @@ test("post-publication bookkeeping failure still adopts the new policy epoch", a
     expect(accountAutoPauseFenceIsLocal("fixture", fence)).toBe(false);
   } finally { fail.mockRestore(); }
 });
+
+test("a detached loadConfig snapshot adopts the disk epoch without invalidating an in-flight fence", () => {
+  saveConfig(fixture());
+  const live = structuredClone(loadConfig());
+  // The live object differs from disk in memory only; its own observation advances the generation.
+  live.providers.fixture!.accountAutoPause = { enabled: true, consecutiveFailures: 3 };
+  observeAccountAutoPauseRevisions(live);
+  const fence = captureAccountAutoPauseFence(live, "fixture");
+  expect(fence).toBeDefined();
+  loadConfig();
+  loadConfig();
+  expect(accountAutoPauseFenceIsLocal("fixture", fence!)).toBe(true);
+});
+

From 6222eb08e8bb0f0ecc27ed4bb5ccf8ba1efaff8b Mon Sep 17 00:00:00 2001
From: JUN <jun@lidgeai.com>
Date: Sun, 18 Oct 2026 05:27:55 +0900
Subject: [PATCH 14/17] fix(accounts): fence observed disk policy changes
 across detached loads

Track the last observed disk fingerprint separately from the live one. A
loadConfig() snapshot advances the local generation when the disk policy
differs from the previously observed disk policy, so an external change
followed by a restore still invalidates older attempts, while a snapshot
that merely differs from the live config does not.
---
 src/config/account-auto-pause-revisions.ts     | 17 +++++++++++------
 structure/account-auto-pause.md                |  3 ++-
 ...config-account-auto-pause-revisions.test.ts | 18 +++++++++++++++++-
 3 files changed, 30 insertions(+), 8 deletions(-)

diff --git a/src/config/account-auto-pause-revisions.ts b/src/config/account-auto-pause-revisions.ts
index 8fd9424f46a..a5de9bee7a0 100644
--- a/src/config/account-auto-pause-revisions.ts
+++ b/src/config/account-auto-pause-revisions.ts
@@ -5,7 +5,9 @@ import type { OcxConfig } from "../types";
 import { getConfigPath } from "./paths";
 
 type PolicyConfig = { providers?: unknown; accountAutoPausePolicyRevisions?: unknown };
-type Observed = { diskRevision: string; localGen: number; unknown: boolean; fingerprint: string };
+// fingerprint follows the live config; diskFingerprint follows the last observed disk state, so a
+// detached load compares disk with disk and still fences an observed external policy change.
+type Observed = { diskRevision: string; localGen: number; unknown: boolean; fingerprint: string; diskFingerprint: string };
 export type AccountAutoPauseFence = { configPath: string; diskRevision: string; localGen: number; threshold: number; route: string };
 const observed = new Map<string, Map<string, Observed>>();
 const UUID = z.uuid();
@@ -62,13 +64,14 @@ export function observeAccountAutoPauseRevisions(config: PolicyConfig, disk: Pol
     const old = entries.get(name);
     const prior = previous?.get(name) ?? old?.fingerprint ?? fingerprint;
     entries.set(name, { fingerprint, diskRevision: revisionFor(map, name) ?? "legacy", unknown: map === null,
+      diskFingerprint: accountAutoPauseFingerprint(provider(disk, name)),
       localGen: (old?.localGen ?? 0) + (prior !== fingerprint ? 1 : 0) });
   }
 }
 /**
- * A loaded snapshot adopts the disk epoch only. Many callers read detached snapshots; letting one
- * replace the live fingerprint would advance localGen on every live/snapshot difference and keep
- * invalidating in-flight fences. Fingerprints and generations start here only for unseen names.
+ * A loaded snapshot adopts the disk epoch and compares its policy with the previously observed
+ * disk policy. Many callers read detached snapshots; comparing one with the live fingerprint would
+ * advance localGen on every live/snapshot difference. A disk-to-disk change still advances it.
  */
 function adoptDiskAutoPauseRevisions(config: PolicyConfig): void {
   const path = getConfigPath();
@@ -78,8 +81,10 @@ function adoptDiskAutoPauseRevisions(config: PolicyConfig): void {
   for (const name of new Set([...entries.keys(), ...Object.keys(record(config.providers) ?? {}), ...Object.keys(map ?? {})])) {
     const old = entries.get(name);
     const diskRevision = revisionFor(map, name) ?? "legacy";
-    entries.set(name, old ? { ...old, diskRevision, unknown: map === null }
-      : { fingerprint: accountAutoPauseFingerprint(provider(config, name)), diskRevision, unknown: map === null, localGen: 0 });
+    const diskFingerprint = accountAutoPauseFingerprint(provider(config, name));
+    entries.set(name, old
+      ? { ...old, diskRevision, unknown: map === null, diskFingerprint, localGen: old.localGen + (old.diskFingerprint !== diskFingerprint ? 1 : 0) }
+      : { fingerprint: diskFingerprint, diskFingerprint, diskRevision, unknown: map === null, localGen: 0 });
   }
 }
 /** Initial load is an observation, never a persistence operation. */
diff --git a/structure/account-auto-pause.md b/structure/account-auto-pause.md
index d154b8526b2..ae1f743ea0a 100644
--- a/structure/account-auto-pause.md
+++ b/structure/account-auto-pause.md
@@ -62,7 +62,8 @@ threshold, provider disabled, base URL, adapter, auth mode). A provider is track
 configured `accountAutoPause`; providers that never opted in leave no map in the file. Only
 `persistConfigUnlocked` mints values, from the literal pre-write file, so caller-supplied revisions never
 authorize anything. Each process also keeps an observed map with a local generation, bumped on
-fingerprint changes adopted by load, reload and save-time reconciliation. A capture records
+fingerprint changes adopted by reload and save-time reconciliation, and on disk-to-disk changes seen
+by any load; a detached load never compares itself with the live fingerprint. A capture records
 the revision, generation, threshold and route. A pause commits only while all of these are still
 equal, both in memory and in the fresh persisted file inside the config mutation lock. The OAuth
 automatic commit runs its final check and auth publication under that lock, and contention means
diff --git a/tests/config/config-account-auto-pause-revisions.test.ts b/tests/config/config-account-auto-pause-revisions.test.ts
index b5174c4cade..1e9d80c82b7 100644
--- a/tests/config/config-account-auto-pause-revisions.test.ts
+++ b/tests/config/config-account-auto-pause-revisions.test.ts
@@ -171,7 +171,7 @@ test("a detached loadConfig snapshot adopts the disk epoch without invalidating
   const live = structuredClone(loadConfig());
   // The live object differs from disk in memory only; its own observation advances the generation.
   live.providers.fixture!.accountAutoPause = { enabled: true, consecutiveFailures: 3 };
-  observeAccountAutoPauseRevisions(live);
+  observeAccountAutoPauseRevisions(live, raw());
   const fence = captureAccountAutoPauseFence(live, "fixture");
   expect(fence).toBeDefined();
   loadConfig();
@@ -179,3 +179,19 @@ test("a detached loadConfig snapshot adopts the disk epoch without invalidating
   expect(accountAutoPauseFenceIsLocal("fixture", fence!)).toBe(true);
 });
 
+
+test("an observed external policy change and restore invalidates an older attempt", () => {
+  saveConfig(fixture());
+  const live = loadConfig();
+  const fence = captureAccountAutoPauseFence(live, "fixture");
+  expect(fence).toBeDefined();
+  const original = bytes();
+  const edited = raw();
+  edited.providers.fixture.accountAutoPause = { enabled: true, consecutiveFailures: 3 };
+  writeFileSync(join(home, "config.json"), JSON.stringify(edited));
+  loadConfig();
+  writeFileSync(join(home, "config.json"), original);
+  loadConfig();
+  expect(raw().accountAutoPausePolicyRevisions.fixture).toBe(fence!.diskRevision);
+  expect(accountAutoPauseFenceIsLocal("fixture", fence!)).toBe(false);
+});

From 04fefebac43f76de41b711edc4e38a695f405a0a Mon Sep 17 00:00:00 2001
From: JUN <jun@lidgeai.com>
Date: Sun, 18 Oct 2026 05:58:06 +0900
Subject: [PATCH 15/17] fix(accounts): bind the Codex workspace into auto-pause
 ownership and reclaim deleted-provider epochs

Codex pool and main-pool attempts now own a response only when the final
wire request carries the captured bearer, the context's chatgpt-account-id
and unchanged organization/project selectors, at capture and in the
final-send report. Policy revision records are kept only for providers that
exist after disk-only preservation, observed records for deleted providers
are dropped, and every new record or advance draws from one process-wide
generation counter so a recreated provider cannot revive an older fence.
---
 .../docs/reference/configuration/providers.md |   3 +-
 src/config/account-auto-pause-revisions.ts    |  24 ++-
 src/oauth/account-auto-pause.ts               |  11 +-
 structure/account-auto-pause.md               |   8 +-
 ...onfig-account-auto-pause-revisions.test.ts | 177 +++++++++++++++++-
 .../oauth-account-auto-pause-revision.test.ts |   3 +-
 tests/oauth/oauth-account-auto-pause.test.ts  |   4 +-
 ...nses-account-auto-pause-wire-owner.test.ts |  87 ++++++++-
 8 files changed, 301 insertions(+), 16 deletions(-)

diff --git a/docs-site/src/content/docs/reference/configuration/providers.md b/docs-site/src/content/docs/reference/configuration/providers.md
index 1f17c8405d9..688ee81909c 100644
--- a/docs-site/src/content/docs/reference/configuration/providers.md
+++ b/docs-site/src/content/docs/reference/configuration/providers.md
@@ -1926,7 +1926,8 @@ proxy processes maintain independent counters. Changing, disabling or re-enablin
 or changing its endpoint discards in-flight refusal observations, so a refusal from a request
 sent under the earlier policy can never pause an account afterwards. A refusal counts only for the credential that actually
 reached the upstream: when a local plugin rewrites the credential or destination of a send, that
-send never counts toward a pause.
+send never counts toward a pause. For Codex pool accounts this includes the workspace
+(`chatgpt-account-id`) the request was sent for.
 
 At the threshold, OpenCodex excludes the account using its existing pause mechanism and
 attempts an eligible sibling for the current request within the existing retry/send budget.
diff --git a/src/config/account-auto-pause-revisions.ts b/src/config/account-auto-pause-revisions.ts
index a5de9bee7a0..ac077d1a1f2 100644
--- a/src/config/account-auto-pause-revisions.ts
+++ b/src/config/account-auto-pause-revisions.ts
@@ -10,6 +10,14 @@ type PolicyConfig = { providers?: unknown; accountAutoPausePolicyRevisions?: unk
 type Observed = { diskRevision: string; localGen: number; unknown: boolean; fingerprint: string; diskFingerprint: string };
 export type AccountAutoPauseFence = { configPath: string; diskRevision: string; localGen: number; threshold: number; route: string };
 const observed = new Map<string, Map<string, Observed>>();
+// One process-wide allocator for every new entry and every advance: a deleted and recreated name
+// can never reproduce an old {diskRevision, localGen} pair, even when both read "legacy".
+let nextGeneration = 0;
+const allocateGeneration = (): number => ++nextGeneration;
+function hasProvider(config: PolicyConfig | undefined, name: string): boolean {
+  const providers = record(config?.providers);
+  return !!providers && Object.hasOwn(providers, name);
+}
 const UUID = z.uuid();
 function record(value: unknown): Record<string, unknown> | undefined {
   return value !== null && typeof value === "object" && !Array.isArray(value) ? value as Record<string, unknown> : undefined;
@@ -46,7 +54,9 @@ export function normalizeAccountAutoPauseRevisions(before: PolicyConfig | undefi
       if (record(row)?.accountAutoPause !== undefined) names.add(name);
     }
   }
-  const entries = [...names].map(name => [name, revisionFor(old, name)
+  // Records follow the providers that exist after disk-only preservation; a deleted provider's
+  // record is reclaimed and a recreated one is minted a fresh UUID.
+  const entries = [...names].filter(name => hasProvider(persisted, name)).map(name => [name, revisionFor(old, name)
     && accountAutoPauseFingerprint(provider(before ?? {}, name)) === accountAutoPauseFingerprint(provider(persisted, name))
     ? revisionFor(old, name)! : randomUUID()]);
   if (entries.length) persisted.accountAutoPausePolicyRevisions = Object.fromEntries(entries);
@@ -60,12 +70,13 @@ export function observeAccountAutoPauseRevisions(config: PolicyConfig, disk: Pol
   const map = revisions(disk);
   const names = new Set([...entries.keys(), ...Object.keys(record(config.providers) ?? {}), ...Object.keys(map ?? {})]);
   for (const name of names) {
+    if (!hasProvider(config, name) && !hasProvider(disk, name)) { entries.delete(name); continue; }
     const fingerprint = accountAutoPauseFingerprint(provider(config, name));
     const old = entries.get(name);
     const prior = previous?.get(name) ?? old?.fingerprint ?? fingerprint;
     entries.set(name, { fingerprint, diskRevision: revisionFor(map, name) ?? "legacy", unknown: map === null,
       diskFingerprint: accountAutoPauseFingerprint(provider(disk, name)),
-      localGen: (old?.localGen ?? 0) + (prior !== fingerprint ? 1 : 0) });
+      localGen: !old || prior !== fingerprint ? allocateGeneration() : old.localGen });
   }
 }
 /**
@@ -79,14 +90,19 @@ function adoptDiskAutoPauseRevisions(config: PolicyConfig): void {
   if (!entries) { entries = new Map(); observed.set(path, entries); }
   const map = revisions(config);
   for (const name of new Set([...entries.keys(), ...Object.keys(record(config.providers) ?? {}), ...Object.keys(map ?? {})])) {
+    if (!hasProvider(config, name)) { entries.delete(name); continue; }
     const old = entries.get(name);
     const diskRevision = revisionFor(map, name) ?? "legacy";
     const diskFingerprint = accountAutoPauseFingerprint(provider(config, name));
     entries.set(name, old
-      ? { ...old, diskRevision, unknown: map === null, diskFingerprint, localGen: old.localGen + (old.diskFingerprint !== diskFingerprint ? 1 : 0) }
-      : { fingerprint: diskFingerprint, diskFingerprint, diskRevision, unknown: map === null, localGen: 0 });
+      ? { ...old, diskRevision, unknown: map === null, diskFingerprint, localGen: old.diskFingerprint !== diskFingerprint ? allocateGeneration() : old.localGen }
+      : { fingerprint: diskFingerprint, diskFingerprint, diskRevision, unknown: map === null, localGen: allocateGeneration() });
   }
 }
+/** Test inspection only: observed records for the current config path. */
+export function accountAutoPauseObservedSizeForTests(): number {
+  return observed.get(getConfigPath())?.size ?? 0;
+}
 /** Initial load is an observation, never a persistence operation. */
 export function observeLoadedAutoPauseConfig(config: OcxConfig): OcxConfig {
   adoptDiskAutoPauseRevisions(config);
diff --git a/src/oauth/account-auto-pause.ts b/src/oauth/account-auto-pause.ts
index 08185131390..3dd51c8e6ca 100644
--- a/src/oauth/account-auto-pause.ts
+++ b/src/oauth/account-auto-pause.ts
@@ -32,6 +32,7 @@ export type AccountAutoPauseObserver = ((response: Response) => Promise<Response
   physical: (sameDestination: boolean, headers: Headers) => void;
 };
 const CREDENTIAL_HEADERS = ["authorization", "x-api-key", "x-goog-api-key", "api-key"] as const;
+const CODEX_SELECTOR_HEADERS = ["openai-organization", "openai-project"] as const;
 // Nested capture sites (a providerFetch observer around a dispatchOverride's own observer) see the
 // same physical response. It counts once per account, and a response whose final send was reported
 // to any observer is never attributed by an observer that received no report.
@@ -72,8 +73,14 @@ export function captureAccountAutoPauseAttempt(name: string, provider: OcxProvid
   } else if (provider.authMode === "forward") {
     if (!codex || codex.kind !== "pool" && codex.kind !== "main-pool") return;
     const { accountId } = codex;
-    if (headers?.get("authorization") !== `Bearer ${codex.accessToken}`) return;
-    owns = wire => wire.get("authorization") === `Bearer ${codex.accessToken}`;
+    // The bearer and the workspace together name the Codex account; organization/project selectors
+    // must stay as captured, so a rewrite that keeps the bearer cannot redirect the refusal.
+    const selectors = CODEX_SELECTOR_HEADERS.map(header => headers?.get(header) ?? null);
+    const codexOwns = (wire: Headers) => wire.get("authorization") === `Bearer ${codex.accessToken}`
+      && wire.get("chatgpt-account-id") === codex.chatgptAccountId
+      && CODEX_SELECTOR_HEADERS.every((header, index) => wire.get(header) === selectors[index]);
+    if (!headers || !codexOwns(headers)) return;
+    owns = codexOwns;
     const revision = config.codexAccountPauseState?.[accountId]?.revision;
     const mainDispatch = codex.kind === "main-pool" ? captureMainQuotaDispatch(codex.accessToken, codex.chatgptAccountId, codex.writerGeneration) : undefined;
     const credentialCurrent = () => codex.kind === "pool"
diff --git a/structure/account-auto-pause.md b/structure/account-auto-pause.md
index ae1f743ea0a..a9ac3f261ca 100644
--- a/structure/account-auto-pause.md
+++ b/structure/account-auto-pause.md
@@ -68,7 +68,13 @@ the revision, generation, threshold and route. A pause commits only while all of
 equal, both in memory and in the fresh persisted file inside the config mutation lock. The OAuth
 automatic commit runs its final check and auth publication under that lock, and contention means
 no pause. API-key commits use the same disk check in their selection mutation, and Codex commits
-check it beside `src/codex/account-pause.ts` state. A malformed map suppresses automatic pause
+check it beside `src/codex/account-pause.ts` state. Revision records exist only for providers present after disk-only provider
+preservation: deleting a provider reclaims its record, and both the persisted and the observed
+maps stay bounded by the provider list. Every new observed record and every generation advance draws
+from one process-wide counter, so a deleted and recreated provider can never reproduce an older
+attempt's fence. A raw legacy delete and identical recreate that no load observes stays undetectable.
+Codex pool ownership binds the bearer, the `chatgpt-account-id` workspace and any organization or
+project selector at capture and in the final-send report. A malformed map suppresses automatic pause
 until the next valid write mints fresh revisions. A raw editor that bypasses the lock and finishes a
 disable/re-enable between two observations stays undetectable.
 Regression coverage: `tests/oauth/oauth-account-auto-pause-revision.test.ts` and
diff --git a/tests/config/config-account-auto-pause-revisions.test.ts b/tests/config/config-account-auto-pause-revisions.test.ts
index 1e9d80c82b7..6b28a32f310 100644
--- a/tests/config/config-account-auto-pause-revisions.test.ts
+++ b/tests/config/config-account-auto-pause-revisions.test.ts
@@ -5,8 +5,11 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { getDefaultConfig, initializePersistedConfigIfMissing, loadConfig, saveConfig } from "../../src/config";
 import { configSchema } from "../../src/config/schema/config-schema";
-import { captureAccountAutoPauseFence, accountAutoPauseFenceIsLocal, observeAccountAutoPauseRevisions } from "../../src/config/account-auto-pause-revisions";
+import { captureAccountAutoPauseFence, accountAutoPauseFenceIsLocal, observeAccountAutoPauseRevisions, accountAutoPauseObservedSizeForTests } from "../../src/config/account-auto-pause-revisions";
 import { armClaudeCodeBaseline, reconcileLiveConfigFromDisk, saveConfigPreservingClaudeCode } from "../../src/config/live-reconcile";
+import { captureAccountAutoPauseAttempt, wasAccountAutoPaused } from "../../src/oauth/account-auto-pause";
+import { routedProviderConfig } from "../../src/router";
+import { setPreservedDiskOnlyProviders } from "../../src/usage/user-cost-overlays";
 import { removeTreeWithRetry } from "../helpers/remove-tree";
 
 const previousHome = process.env.OPENCODEX_HOME;
@@ -56,7 +59,7 @@ test("invalid-map recovery does not enroll never-configured providers", () => {
   expect(bytes()).not.toContain("accountAutoPausePolicyRevisions");
 });
 
-test("caller epochs are ignored, unrelated edits preserve UUIDs and removed policies retain entries", () => {
+test("caller epochs are ignored; removed policies retain revisions only while the provider exists", () => {
   const config = fixture();
   saveConfig(config);
   const first = revision();
@@ -70,10 +73,15 @@ test("caller epochs are ignored, unrelated edits preserve UUIDs and removed poli
   saveConfig(config);
   expect(revision()).not.toBe(first);
   const removedPolicy = revision();
+  expect(removedPolicy).toMatch(/^[a-f0-9-]{36}$/);
+  config.port++;
+  saveConfig(config);
+  expect(revision()).toBe(removedPolicy);
   delete config.providers.fixture;
   saveConfig(config);
-  expect(revision()).not.toBe(removedPolicy);
-  expect(revision()).toBeDefined();
+  expect(revision()).toBeUndefined();
+  expect(bytes()).not.toContain("accountAutoPausePolicyRevisions");
+  expect(accountAutoPauseObservedSizeForTests()).toBe(0);
 });
 
 test("all full-fingerprint fields rotate policy epochs and wall-clock rollback cannot restore one", () => {
@@ -195,3 +203,164 @@ test("an observed external policy change and restore invalidates an older attemp
   expect(raw().accountAutoPausePolicyRevisions.fixture).toBe(fence!.diskRevision);
   expect(accountAutoPauseFenceIsLocal("fixture", fence!)).toBe(false);
 });
+
+test("50 provider create/delete cycles retain only live disk revisions and observed entries", () => {
+  const config = fixture();
+  saveConfig(config);
+  const survivor = revision();
+  for (let cycle = 0; cycle < 50; cycle++) {
+    const name = `temporary-${cycle}`;
+    config.providers[name] = structuredClone(config.providers.fixture!);
+    saveConfig(config);
+    expect(Object.keys(raw().accountAutoPausePolicyRevisions).sort()).toEqual(["fixture", name]);
+    expect(accountAutoPauseObservedSizeForTests()).toBe(2);
+    delete config.providers[name];
+    saveConfig(config);
+    expect(Object.keys(raw().providers)).toEqual(["fixture"]);
+    expect(Object.keys(raw().accountAutoPausePolicyRevisions)).toEqual(["fixture"]);
+    expect(bytes()).not.toContain(`"${name}"`);
+    expect(accountAutoPauseObservedSizeForTests()).toBe(1);
+    expect(revision()).toBe(survivor);
+  }
+});
+
+test("an unrelated save preserves every live provider UUID", () => {
+  const config = fixture();
+  config.providers.other = structuredClone(config.providers.fixture!);
+  saveConfig(config);
+  const first = raw().accountAutoPausePolicyRevisions;
+  expect(Object.keys(first).sort()).toEqual(["fixture", "other"]);
+  expect(first.fixture).not.toBe(first.other);
+  config.port++;
+  saveConfig(config);
+  expect(raw().accountAutoPausePolicyRevisions).toEqual(first);
+  saveConfig(loadConfig());
+  expect(raw().accountAutoPausePolicyRevisions).toEqual(first);
+});
+
+test("a disk-only preserved provider retains its policy revision on an unrelated live save", () => {
+  const config = fixture();
+  saveConfig(config);
+  const first = revision();
+  const disk = raw();
+  const diskOnlyRevision = randomUUID();
+  disk.providers.external = structuredClone(disk.providers.fixture);
+  disk.accountAutoPausePolicyRevisions.external = diskOnlyRevision;
+  writeFileSync(join(home, "config.json"), JSON.stringify(disk));
+  expect(config.providers.external).toBeUndefined();
+  // The overlay reconciler publishes disk-only rows into this serialization registry.
+  setPreservedDiskOnlyProviders({ external: disk.providers.external });
+  try {
+    config.port++;
+    saveConfig(config);
+    expect(config.providers.external).toBeUndefined();
+    expect(raw().providers.external).toEqual(disk.providers.external);
+    expect(raw().accountAutoPausePolicyRevisions).toEqual({ fixture: first, external: diskOnlyRevision });
+    expect(accountAutoPauseObservedSizeForTests()).toBe(2);
+  } finally { setPreservedDiskOnlyProviders(null); }
+});
+
+function captureKeyAttempt(config: ReturnType<typeof fixture>) {
+  const route = routedProviderConfig("fixture", config.providers.fixture!);
+  const observer = captureAccountAutoPauseAttempt("fixture", route, { config }, new Headers({ authorization: `Bearer ${route.apiKey}` }));
+  expect(observer).toBeDefined();
+  return observer!;
+}
+const refusal = () => Response.json({ error: { type: "permission_error", message: "Your subscription has expired." } }, { status: 403 });
+async function expectStaleAttemptRejected(config: ReturnType<typeof fixture>, attempt: ReturnType<typeof captureKeyAttempt>) {
+  const response = refusal();
+  expect(await attempt(response)).toBe(response);
+  expect(wasAccountAutoPaused(response)).toBe(false);
+  expect(config.providers.fixture!.apiKeyPool?.some(row => row.disabled === true) ?? false).toBe(false);
+  expect(loadConfig().providers.fixture!.apiKeyPool?.some(row => row.disabled === true) ?? false).toBe(false);
+  // A fresh attempt must still be able to pause the same credential after recreation.
+  const current = refusal();
+  await captureKeyAttempt(config)(current);
+  expect(wasAccountAutoPaused(current)).toBe(true);
+  expect(config.providers.fixture!.apiKeyPool?.[0]?.disabled).toBe(true);
+  expect(loadConfig().providers.fixture!.apiKeyPool?.[0]?.disabled).toBe(true);
+}
+
+test("saveConfig delete/recreate mints a new UUID and rejects the pre-deletion attempt", async () => {
+  const config = fixture();
+  config.providers.fixture!.accountAutoPause!.consecutiveFailures = 1;
+  saveConfig(config);
+  const fence = captureAccountAutoPauseFence(config, "fixture")!;
+  expect(fence).toBeDefined();
+  const attempt = captureKeyAttempt(config);
+  const row = structuredClone(config.providers.fixture!);
+  delete config.providers.fixture;
+  saveConfig(config);
+  expect(raw().accountAutoPausePolicyRevisions).toBeUndefined();
+  expect(accountAutoPauseFenceIsLocal("fixture", fence)).toBe(false);
+  expect(accountAutoPauseObservedSizeForTests()).toBe(0);
+  config.providers.fixture = row;
+  saveConfig(config);
+  expect(revision()).toMatch(/^[a-f0-9-]{36}$/);
+  expect(revision()).not.toBe(fence.diskRevision);
+  expect(accountAutoPauseFenceIsLocal("fixture", fence)).toBe(false);
+  expect(accountAutoPauseObservedSizeForTests()).toBe(1);
+  await expectStaleAttemptRejected(config, attempt);
+});
+
+test("legacy no-map observations delete/recreate without reviving a pre-deletion attempt", async () => {
+  const config = fixture();
+  config.providers.fixture!.accountAutoPause!.consecutiveFailures = 1;
+  writeFileSync(join(home, "config.json"), JSON.stringify(config));
+  observeAccountAutoPauseRevisions(config);
+  const fence = captureAccountAutoPauseFence(config, "fixture")!;
+  expect(fence.diskRevision).toBe("legacy");
+  const attempt = captureKeyAttempt(config);
+  const original = bytes();
+  const row = structuredClone(config.providers.fixture!);
+  delete config.providers.fixture;
+  writeFileSync(join(home, "config.json"), JSON.stringify(config));
+  observeAccountAutoPauseRevisions(config);
+  expect(accountAutoPauseObservedSizeForTests()).toBe(0);
+  config.providers.fixture = row;
+  writeFileSync(join(home, "config.json"), original);
+  observeAccountAutoPauseRevisions(config);
+  const recreated = captureAccountAutoPauseFence(config, "fixture")!;
+  expect(recreated.diskRevision).toBe("legacy");
+  expect(recreated.localGen).not.toBe(fence.localGen);
+  expect(accountAutoPauseFenceIsLocal("fixture", fence)).toBe(false);
+  expect(accountAutoPauseObservedSizeForTests()).toBe(1);
+  await expectStaleAttemptRejected(config, attempt);
+});
+
+for (const epoch of ["persisted UUID", "legacy no-map"] as const) {
+  test(`load-only ${epoch}: identical raw restore after observed deletion rejects the old fence and attempt`, async () => {
+    const initial = fixture();
+    initial.providers.fixture!.accountAutoPause!.consecutiveFailures = 1;
+    initial.providers.keeper = { adapter: "openai-chat", baseUrl: "https://keeper.test/v1", authMode: "key" };
+    initial.defaultProvider = "keeper";
+    saveConfig(initial);
+    if (epoch === "legacy no-map") {
+      const disk = raw();
+      delete disk.accountAutoPausePolicyRevisions;
+      writeFileSync(join(home, "config.json"), JSON.stringify(disk));
+    }
+    const config = loadConfig();
+    const original = bytes();
+    const fence = captureAccountAutoPauseFence(config, "fixture")!;
+    expect(fence).toBeDefined();
+    expect(fence.diskRevision).toBe(epoch === "legacy no-map" ? "legacy" : revision());
+    const attempt = captureKeyAttempt(config);
+    const deleted = raw();
+    delete deleted.providers.fixture;
+    // A raw editor may leave the old UUID behind; absent providers must still be reclaimed.
+    writeFileSync(join(home, "config.json"), JSON.stringify(deleted));
+    expect(loadConfig().providers.fixture).toBeUndefined();
+    expect(accountAutoPauseObservedSizeForTests()).toBe(1);
+    expect(accountAutoPauseFenceIsLocal("fixture", fence)).toBe(false);
+    writeFileSync(join(home, "config.json"), original);
+    const restored = loadConfig();
+    expect(bytes()).toBe(original);
+    const recreated = captureAccountAutoPauseFence(restored, "fixture")!;
+    expect(recreated.diskRevision).toBe(fence.diskRevision);
+    expect(recreated.localGen).not.toBe(fence.localGen);
+    expect(accountAutoPauseFenceIsLocal("fixture", fence)).toBe(false);
+    expect(accountAutoPauseObservedSizeForTests()).toBe(2);
+    await expectStaleAttemptRejected(config, attempt);
+  });
+}
diff --git a/tests/oauth/oauth-account-auto-pause-revision.test.ts b/tests/oauth/oauth-account-auto-pause-revision.test.ts
index d1c9ac7777c..b3b9bff3b87 100644
--- a/tests/oauth/oauth-account-auto-pause-revision.test.ts
+++ b/tests/oauth/oauth-account-auto-pause-revision.test.ts
@@ -37,7 +37,8 @@ async function fixture(mode: "key" | "oauth" | "forward" = "key", threshold = 1)
   saveConfig(config);
   const capture = () => {
     const provider = mode === "key" ? routedProviderConfig(name, config.providers[name]!) : config.providers[name]!;
-    return captureAccountAutoPauseAttempt(name, provider, { config, oauth, codex }, new Headers({ authorization: `Bearer ${mode === "key" ? provider.apiKey : "synthetic-access"}` }))!;
+    return captureAccountAutoPauseAttempt(name, provider, { config, oauth, codex }, new Headers({ authorization: `Bearer ${mode === "key" ? provider.apiKey : "synthetic-access"}`,
+      ...(codex ? { "chatgpt-account-id": codex.chatgptAccountId } : {}) }))!;
   };
   const paused = () => mode === "key" ? config.providers[name]!.apiKeyPool?.[0]?.disabled === true
     : mode === "oauth" ? getAccountSet(name)!.accounts[0]!.paused === true : config.pausedCodexAccountIds?.includes("fixture") === true;
diff --git a/tests/oauth/oauth-account-auto-pause.test.ts b/tests/oauth/oauth-account-auto-pause.test.ts
index 6f1befca9ce..a228c7c8246 100644
--- a/tests/oauth/oauth-account-auto-pause.test.ts
+++ b/tests/oauth/oauth-account-auto-pause.test.ts
@@ -161,7 +161,7 @@ test("Codex pool uses persistent pause ids, generation fence and resume metadata
   const generation = saveCodexAccountCredential("fixture", { accessToken: "synthetic-access", refreshToken: "synthetic-refresh", expiresAt: Date.now() + 3_600_000, chatgptAccountId: "synthetic" });
   saveConfig(config);
   const codex = { kind: "pool" as const, accountId: "fixture", generation, writerGeneration: 0, accessToken: "synthetic-access", chatgptAccountId: "synthetic" };
-  const capture = () => captureAccountAutoPauseAttempt("openai", config.providers.openai!, { config, codex }, new Headers({ authorization: "Bearer synthetic-access" }))!;
+  const capture = () => captureAccountAutoPauseAttempt("openai", config.providers.openai!, { config, codex }, new Headers({ authorization: "Bearer synthetic-access", "chatgpt-account-id": "synthetic" }))!;
   await capture()(refusal());
   await capture()(refusal());
   expect(config.pausedCodexAccountIds).toContain("fixture");
@@ -215,7 +215,7 @@ test("same-identity main credential replacement fences a delayed refusal", async
   saveConfig(config);
   const observe = captureAccountAutoPauseAttempt("openai", config.providers.openai!, { config,
     codex: { kind: "main-pool", accountId: "__main__", writerGeneration: captureConfigGeneration(), mainQuotaWriter: writer, accessToken: "synthetic-old", chatgptAccountId: "synthetic-main" },
-  }, new Headers({ authorization: "Bearer synthetic-old" }))!;
+  }, new Headers({ authorization: "Bearer synthetic-old", "chatgpt-account-id": "synthetic-main" }))!;
   observeMainQuotaCredential("synthetic-new", "synthetic-main");
   await observe(refusal());
   expect(config.pausedCodexAccountIds).toBeUndefined();
diff --git a/tests/responses/responses-account-auto-pause-wire-owner.test.ts b/tests/responses/responses-account-auto-pause-wire-owner.test.ts
index c6ae597cb98..23cc7fa6faa 100644
--- a/tests/responses/responses-account-auto-pause-wire-owner.test.ts
+++ b/tests/responses/responses-account-auto-pause-wire-owner.test.ts
@@ -3,6 +3,9 @@ import { mkdtempSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { getDefaultConfig, loadConfig, saveConfig } from "../../src/config";
+import { observeMainQuotaCredential, observeMainQuotaIdentity } from "../../src/codex/main-account-cache";
+import { captureConfigGeneration } from "../../src/lib/state-store-sweeper";
+import type { CodexAuthContext } from "../../src/codex/auth-context";
 import { saveCodexAccountCredential } from "../../src/codex/account-store";
 import { captureAccountAutoPauseAttempt, wasAccountAutoPaused } from "../../src/oauth/account-auto-pause";
 import { clearGenericFailoverHealth } from "../../src/oauth/generic-account-failover";
@@ -270,7 +273,7 @@ describe("Codex pool WebSocket observer without a physical report", () => {
       const observer = captureAccountAutoPauseAttempt("openai", config.providers.openai!, { config,
         codex: { kind: "pool", accountId: "fixture-a", generation, writerGeneration: 0,
           accessToken: "synthetic-access", chatgptAccountId: "synthetic-account" },
-      }, new Headers({ authorization: "Bearer synthetic-access" }));
+      }, new Headers({ authorization: "Bearer synthetic-access", "chatgpt-account-id": "synthetic-account" }));
       expect(observer).toBeDefined();
       if (plugin === "registered after capture then removed") install();
       const dial = rewriteWebSocketDial("wss://chatgpt.com/backend-api/codex/responses", {
@@ -335,3 +338,85 @@ describe("nested auto-pause observers on one physical response", () => {
   });
 });
 
+function codexFixture(kind: "pool" | "main-pool") {
+  const config = getDefaultConfig();
+  config.defaultProvider = "openai";
+  config.providers = { openai: { adapter: "openai-responses", authMode: "forward", codexAccountMode: "pool",
+    baseUrl: "https://chatgpt.com/backend-api/codex", accountAutoPause: { enabled: true, consecutiveFailures: 1 } } };
+  const accountId = kind === "pool" ? "fixture-a" : "__main__";
+  config.codexAccounts = [{ id: accountId, email: "", isMain: kind === "main-pool" }, { id: "fixture-b", email: "", isMain: false }];
+  config.activeCodexAccountId = accountId;
+  let codex: CodexAuthContext;
+  if (kind === "pool") {
+    const generation = saveCodexAccountCredential(accountId, { accessToken: "synthetic-access", refreshToken: "synthetic-refresh",
+      expiresAt: Date.now() + 3_600_000, chatgptAccountId: "synthetic-account" });
+    codex = { kind, accountId, generation, writerGeneration: 0, accessToken: "synthetic-access", chatgptAccountId: "synthetic-account" };
+  } else {
+    observeMainQuotaIdentity("synthetic-account");
+    const mainQuotaWriter = observeMainQuotaCredential("synthetic-access", "synthetic-account")!;
+    codex = { kind, accountId, writerGeneration: captureConfigGeneration(), mainQuotaWriter,
+      accessToken: "synthetic-access", chatgptAccountId: "synthetic-account" };
+  }
+  saveConfig(config);
+  const headers = new Headers({ authorization: "Bearer synthetic-access", "chatgpt-account-id": "synthetic-account" });
+  const capture = (sent = headers) => captureAccountAutoPauseAttempt("openai", config.providers.openai!, { config, codex }, sent);
+  const expectPause = (paused: boolean) => {
+    for (const live of [config, loadConfig()]) {
+      expect(live.pausedCodexAccountIds?.includes(accountId) ?? false).toBe(paused);
+      expect(live.pausedCodexAccountIds?.includes("fixture-b") ?? false).toBe(false);
+      if (paused) expect(live.codexAccountPauseState?.[accountId]?.details?.reason).toBe("subscription_expired");
+      else expect(live.codexAccountPauseState?.[accountId]).toBeUndefined();
+    }
+  };
+  return { headers, capture, expectPause };
+}
+
+for (const kind of ["pool", "main-pool"] as const) {
+  for (const change of ["workspace replaced", "workspace deleted", "organization added", "organization changed", "organization deleted",
+    "project added", "project changed", "project deleted", "matching headers", "matching selectors"] as const) {
+    test(`Codex ${kind} physical report: ${change}`, async () => {
+      const f = codexFixture(kind);
+      if (change === "organization changed" || change === "organization deleted" || change === "matching selectors") f.headers.set("openai-organization", "synthetic-org");
+      if (change === "project changed" || change === "project deleted" || change === "matching selectors") f.headers.set("openai-project", "synthetic-project");
+      const observer = f.capture();
+      expect(observer).toBeDefined();
+      const sent = new Headers(f.headers);
+      if (change === "workspace replaced") sent.set("chatgpt-account-id", "synthetic-other-account");
+      if (change === "workspace deleted") sent.delete("chatgpt-account-id");
+      if (change === "organization added" || change === "organization changed") sent.set("openai-organization", "synthetic-other-org");
+      if (change === "organization deleted") sent.delete("openai-organization");
+      if (change === "project added" || change === "project changed") sent.set("openai-project", "synthetic-other-project");
+      if (change === "project deleted") sent.delete("openai-project");
+      expect(sent.get("authorization")).toBe("Bearer synthetic-access");
+      observer!.physical(true, sent);
+      const response = refusal();
+      expect(await observer!(response)).toBe(response);
+      expect(response.status).toBe(403);
+      const shouldPause = change === "matching headers" || change === "matching selectors";
+      expect(wasAccountAutoPaused(response)).toBe(shouldPause);
+      f.expectPause(shouldPause);
+    });
+  }
+  for (const workspace of ["missing", "different"] as const) {
+    test(`Codex ${kind} capture: ${workspace} workspace grants no observer`, () => {
+      const f = codexFixture(kind);
+      if (workspace === "missing") f.headers.delete("chatgpt-account-id");
+      else f.headers.set("chatgpt-account-id", "synthetic-other-account");
+      expect(f.capture()).toBeUndefined();
+      f.expectPause(false);
+    });
+  }
+  for (const registered of [false, true]) {
+    test(`Codex ${kind} no physical report with workspace: ${registered ? "rewriter blocks pause" : "no rewriter permits pause"}`, async () => {
+      const f = codexFixture(kind);
+      expect(f.headers.get("chatgpt-account-id")).toBe("synthetic-account");
+      const observer = f.capture();
+      expect(observer).toBeDefined();
+      if (registered) rewrite(() => {});
+      const response = refusal();
+      expect(await observer!(response)).toBe(response);
+      expect(wasAccountAutoPaused(response)).toBe(!registered);
+      f.expectPause(!registered);
+    });
+  }
+}

From a7b05e9e984f44e9a266e5b912111264c1169e71 Mon Sep 17 00:00:00 2001
From: JUN <jun@lidgeai.com>
Date: Sun, 18 Oct 2026 06:03:21 +0900
Subject: [PATCH 16/17] fix(accounts): never re-enroll an observed-deleted
 provider from a stale capture

Once a config path has been observed, captureAccountAutoPauseFence no longer
seeds a missing provider from the caller's config object; only load, reload
or save adoption can enroll it. A capture taken from a stale live config
while its provider is observed deleted therefore cannot survive an identical
restore.
---
 src/config/account-auto-pause-revisions.ts    |  7 +++--
 structure/account-auto-pause.md               |  4 ++-
 ...onfig-account-auto-pause-revisions.test.ts | 30 +++++++++++++++++++
 3 files changed, 38 insertions(+), 3 deletions(-)

diff --git a/src/config/account-auto-pause-revisions.ts b/src/config/account-auto-pause-revisions.ts
index ac077d1a1f2..f5cd5bd23c7 100644
--- a/src/config/account-auto-pause-revisions.ts
+++ b/src/config/account-auto-pause-revisions.ts
@@ -109,8 +109,11 @@ export function observeLoadedAutoPauseConfig(config: OcxConfig): OcxConfig {
   return config;
 }
 export function captureAccountAutoPauseFence(config: OcxConfig, name: string): AccountAutoPauseFence | undefined {
-  if (!observed.get(getConfigPath())?.has(name)) observeAccountAutoPauseRevisions(config);
-  const state = observed.get(getConfigPath())!.get(name);
+  // Only a config path no load or save has observed may be seeded from the caller's object. Once a
+  // path is observed, a missing name means an authoritative observation removed it, and a stale
+  // live snapshot must not re-enroll it; adoption by load, reload or save is required.
+  if (!observed.has(getConfigPath())) observeAccountAutoPauseRevisions(config);
+  const state = observed.get(getConfigPath())?.get(name);
   const p = provider(config, name), policy = record(p?.accountAutoPause);
   const threshold = policy?.consecutiveFailures ?? 2;
   if (!state || state.unknown || !p || p.disabled === true || policy?.enabled !== true || typeof threshold !== "number" || !Number.isInteger(threshold) || threshold < 1 || threshold > 100) return;
diff --git a/structure/account-auto-pause.md b/structure/account-auto-pause.md
index a9ac3f261ca..4d3a29ffb43 100644
--- a/structure/account-auto-pause.md
+++ b/structure/account-auto-pause.md
@@ -72,7 +72,9 @@ check it beside `src/codex/account-pause.ts` state. Revision records exist only
 preservation: deleting a provider reclaims its record, and both the persisted and the observed
 maps stay bounded by the provider list. Every new observed record and every generation advance draws
 from one process-wide counter, so a deleted and recreated provider can never reproduce an older
-attempt's fence. A raw legacy delete and identical recreate that no load observes stays undetectable.
+attempt's fence. Once a config path has been observed, a capture never seeds a missing name from
+the caller's config object: only load, reload or save adoption can enroll it, so a stale live config
+cannot re-enroll a provider an observation deleted. A raw legacy delete and identical recreate that no load observes stays undetectable.
 Codex pool ownership binds the bearer, the `chatgpt-account-id` workspace and any organization or
 project selector at capture and in the final-send report. A malformed map suppresses automatic pause
 until the next valid write mints fresh revisions. A raw editor that bypasses the lock and finishes a
diff --git a/tests/config/config-account-auto-pause-revisions.test.ts b/tests/config/config-account-auto-pause-revisions.test.ts
index 6b28a32f310..9ac1efcc9bf 100644
--- a/tests/config/config-account-auto-pause-revisions.test.ts
+++ b/tests/config/config-account-auto-pause-revisions.test.ts
@@ -364,3 +364,33 @@ for (const epoch of ["persisted UUID", "legacy no-map"] as const) {
     await expectStaleAttemptRejected(config, attempt);
   });
 }
+
+for (const legacy of [false, true]) {
+  test(`${legacy ? "legacy no-map" : "persisted UUID"}: a stale live config cannot re-enroll a provider observed as deleted`, async () => {
+    const config = fixture();
+    config.providers.fixture!.accountAutoPause!.consecutiveFailures = 1;
+    config.providers.other = { adapter: "openai-chat", baseUrl: "https://other.test/v1", authMode: "key", apiKey: "synthetic-other" };
+    if (legacy) writeFileSync(join(home, "config.json"), JSON.stringify(config)); else saveConfig(config);
+    loadConfig();
+    const original = bytes();
+    const deleted = raw();
+    delete deleted.providers.fixture;
+    deleted.defaultProvider = "other";
+    writeFileSync(join(home, "config.json"), JSON.stringify(deleted));
+    loadConfig();
+    expect(accountAutoPauseObservedSizeForTests()).toBe(1);
+    // The live object still holds the provider; capturing from it while it is deleted must not
+    // re-enroll an observation or produce a fence that survives an identical restore.
+    const route = routedProviderConfig("fixture", config.providers.fixture!);
+    expect(captureAccountAutoPauseFence(config, "fixture")).toBeUndefined();
+    expect(captureAccountAutoPauseAttempt("fixture", route, { config }, new Headers({ authorization: `Bearer ${route.apiKey}` }))).toBeUndefined();
+    expect(accountAutoPauseObservedSizeForTests()).toBe(1);
+    writeFileSync(join(home, "config.json"), original);
+    loadConfig();
+    expect(accountAutoPauseObservedSizeForTests()).toBe(2);
+    const current = refusal();
+    await captureKeyAttempt(config)(current);
+    expect(wasAccountAutoPaused(current)).toBe(true);
+  });
+}
+

From 06e146cea6a074cfb71a2886404200af04af0c95 Mon Sep 17 00:00:00 2001
From: JUN <jun@lidgeai.com>
Date: Sun, 18 Oct 2026 07:00:44 +0900
Subject: [PATCH 17/17] test(accounts): auto-pause attribution reads
 post-compression wire headers

With opt-in gzip request compression enabled, the auto-pause final-send
report sees the compressed send's headers (content-encoding set, stale
content-length removed) and still attributes a refusal to the credential
actually sent.
---
 ...nses-account-auto-pause-wire-owner.test.ts | 51 +++++++++++++++++++
 1 file changed, 51 insertions(+)

diff --git a/tests/responses/responses-account-auto-pause-wire-owner.test.ts b/tests/responses/responses-account-auto-pause-wire-owner.test.ts
index 23cc7fa6faa..6aa1c0beab9 100644
--- a/tests/responses/responses-account-auto-pause-wire-owner.test.ts
+++ b/tests/responses/responses-account-auto-pause-wire-owner.test.ts
@@ -17,6 +17,8 @@ import { clearResponseStateForTests, flushResponseState } from "../../src/respon
 import { handleChatCompletions } from "../../src/server/chat-completions";
 import { handleClaudeMessages } from "../../src/server/claude-messages";
 import { providerFetch } from "../../src/server/responses/fetch-helpers";
+import { bindUpstreamRequestCompressionConfig } from "../../src/server/responses/request-compression";
+import { gunzipSync } from "node:zlib";
 import { handleResponses } from "../../src/server/responses/core";
 import type { OcxConfig } from "../../src/types";
 import { acquireOwnedSpendHome } from "../helpers/owned-spend-home";
@@ -420,3 +422,52 @@ for (const kind of ["pool", "main-pool"] as const) {
     });
   }
 }
+
+describe("auto-pause ownership on compressed native Responses sends", () => {
+  const codexUrl = "https://chatgpt.com/backend-api/codex/responses";
+  for (const rewritten of [false, true]) {
+    test(`${rewritten ? "rewritten credential under gzip does not pause" : "wire owner under gzip pauses"}; the report carries post-compression headers`, async () => {
+      bindUpstreamRequestCompressionConfig({ upstreamRequestCompression: "gzip" });
+      try {
+        const config = fixture("openai-responses");
+        const route = routedProviderConfig("fixture", config.providers.fixture!);
+        if (rewritten) rewrite(t => { t.headers.set("authorization", "Bearer synthetic-third"); });
+        const original = JSON.stringify({ input: "x".repeat(4096) });
+        const reported: Headers[] = [];
+        const sends: { headers: Headers; body: Uint8Array }[] = [];
+        const upstream = refusal();
+        const physical = (async (_input, init) => {
+          sends.push({ headers: new Headers(init?.headers), body: new Uint8Array(init?.body as ArrayBufferLike) });
+          return upstream;
+        }) as typeof fetch;
+        const send = providerFetch(Object.assign(route, { fetch: physical }), undefined, {
+          providerName: "fixture", httpOnly: true,
+          accountAutoPause: (name, provider, headers) => {
+            const observer = captureAccountAutoPauseAttempt(name, provider, { config }, headers)!;
+            expect(observer).toBeDefined();
+            const report = observer.physical;
+            observer.physical = (sameDestination, wire) => { reported.push(new Headers(wire)); report(sameDestination, wire); };
+            return observer;
+          },
+        });
+        const response = await send(codexUrl, { method: "POST",
+          headers: { authorization: "Bearer synthetic-A", "content-type": "application/json", "content-length": String(original.length) }, body: original });
+        // Consuming the body releases the per-key pacing slot for the next case.
+        expect(await response.json()).toEqual({ error: { type: "permission_error", message: "Your subscription has expired." } });
+        expect(sends).toHaveLength(1);
+        expect(reported).toHaveLength(1);
+        for (const headers of [reported[0]!, sends[0]!.headers]) {
+          expect(headers.get("content-encoding")).toBe("gzip");
+          expect(headers.get("content-length")).toBeNull();
+          expect(headers.get("authorization")).toBe(rewritten ? "Bearer synthetic-third" : "Bearer synthetic-A");
+        }
+        expect(new TextDecoder().decode(gunzipSync(sends[0]!.body))).toBe(original);
+        expect(wasAccountAutoPaused(response)).toBe(!rewritten);
+        if (rewritten) expectUnpaused(config); else expectPaused(config);
+      } finally {
+        bindUpstreamRequestCompressionConfig(null);
+      }
+    });
+  }
+});
+