fix(codex): fence propagated quota recovery aliases

src/codex/account-store.ts

@@ -429,7 +429,14 @@ export type CodexRefreshProvenance = "self-refresh" | "joined-lineage" | "extern
 
 /** Terminal outcome of one forced refresh, as seen by the caller that requested it. */
 export type ForcedRefreshOutcome =
-  | { kind: "resolved"; provenance: CodexRefreshProvenance; generation: number; rotated: boolean }
+  | {
+      kind: "resolved";
+      provenance: CodexRefreshProvenance;
+      generation: number;
+      rotated: boolean;
+      /** Same-grant records advanced by this refresh, at their committed generations. */
+      propagatedAliases?: { id: string; generation: number }[];
+    }
   | { kind: "failed"; error: unknown };
 const MAX_CODEX_REFRESH_FLIGHTS = 32;
 const CODEX_REFRESH_FLIGHT_STALE_MS = 120_000;
@@ -669,6 +676,9 @@ export async function forceRefreshCodexPoolToken(
       provenance: classify(resolved),
       generation: resolved.generation,
       rotated: resolved.accessToken !== options.rejectedAccessToken,
+      ...(resolved.propagatedAliases?.length
+        ? { propagatedAliases: resolved.propagatedAliases }
+        : {}),
     }),
     error => settle({ kind: "failed", error }),
   );
@@ -1036,6 +1046,7 @@ async function resolveCodexToken(
     // Provenance rides out with the rest: a joiner that adopts this result needs the
     // flight's own classification, not a guess made at the adoption site (#3019).
     ...(result.provenance !== undefined ? { provenance: result.provenance } : {}),
+    ...(result.propagatedAliases?.length ? { propagatedAliases: result.propagatedAliases } : {}),
     ...(result.resolvedGrantFingerprint !== undefined
       ? { resolvedGrantFingerprint: result.resolvedGrantFingerprint }
       : {}),

src/codex/auth-api.ts

@@ -128,6 +128,7 @@ import { NativeProfileError } from "./native-profile-types";
 import { WHAM_REQUEST_TIMEOUT_MS } from "./quota-recovery-timing";
 import {
   claimQuotaRecovery,
+  fencePropagatedQuotaRecovery,
   quotaRecoveryTerminalFor,
   releaseQuotaRecovery,
   settleQuotaRecovery,
@@ -1029,6 +1030,9 @@ async function recoverPoolQuotaFrom401(ctx: {
       onSettled: outcome => {
         if (outcome.kind === "resolved") {
           settleQuotaRecovery(accountId, claim.claimId, outcome);
+          for (const alias of outcome.propagatedAliases ?? []) {
+            fencePropagatedQuotaRecovery(alias.id, alias.generation);
+          }
         } else if (outcome.error instanceof TokenRefreshError && isTerminalRefreshError(outcome.error)) {
           // A revoked or expired grant does not become valid on the next poll. Releasing it
           // into backoff would let the following bare 401 find a non-terminal record and

src/codex/quota-401-recovery.ts

@@ -105,6 +105,18 @@ export function settleQuotaRecovery(
   records.set(accountId, { state: "spent", lineage: fenced });
 }
 
+/**
+ * Fence a same-grant alias that adopted the credential produced by another account's refresh.
+ *
+ * Propagation advances the alias without making it a separate credential lineage. Leaving its
+ * committed generation unspent would let a later quota poll rotate the same refresh grant again.
+ * This deliberately supersedes an old live claim for the alias: that claim targets the
+ * pre-propagation generation, and its eventual settlement must not erase this newer fence.
+ */
+export function fencePropagatedQuotaRecovery(accountId: string, lineage: number): void {
+  records.set(accountId, { state: "spent", lineage });
+}
+
 /**
  * Record a refresh that failed with proof the grant itself is dead.
  *

tests/quota-401-recovery-runtime.test.ts

@@ -235,6 +235,69 @@ test("a transient refresh failure does not quarantine the account", async () =>
   expect(quotaRecoveryRecordForTests("slow-grant")).toMatchObject({ state: "backoff" });
 });
 
+test("same-grant aliases share one quota recovery budget after propagation", async () => {
+  const { listCodexAuthAccounts } = await import("../src/codex/auth-api");
+  const { readCodexAccountRecord, saveCodexAccountCredential } = await import("../src/codex/account-store");
+  const { loadConfig, saveConfig } = await import("../src/config");
+  const { quotaRecoveryRecordForTests } = await import("../src/codex/quota-401-recovery");
+
+  const expiresAt = Date.now() + 3600_000;
+  for (const id of ["alias-owner", "alias-later"]) {
+    saveCodexAccountCredential(id, {
+      accessToken: REJECTED,
+      refreshToken: "shared-grant",
+      expiresAt,
+      chatgptAccountId: "shared-account",
+    });
+  }
+  for (let index = 0; index < 3; index += 1) {
+    saveCodexAccountCredential(`queue-${index}`, {
+      accessToken: `queue-bearer-${index}`,
+      refreshToken: `queue-grant-${index}`,
+      expiresAt,
+      chatgptAccountId: `queue-account-${index}`,
+    });
+  }
+  const config = loadConfig();
+  saveConfig({
+    ...config,
+    // Four workers start the owner and three queued probes. The alias cannot begin until
+    // the owner's refresh has propagated, reproducing the interleaving that bypassed the
+    // old per-account-only fence.
+    codexAccounts: ["alias-owner", "queue-0", "queue-1", "queue-2", "alias-later"]
+      .map(id => ({ id, label: id })),
+  });
+
+  let finishOwnerRefresh!: () => void;
+  const ownerRefreshed = new Promise<void>(resolve => { finishOwnerRefresh = resolve; });
+  let tokenCalls = 0;
+  globalThis.fetch = (async (input: string | URL | Request, init?: RequestInit) => {
+    const url = String(input);
+    if (url.includes("/oauth/token")) {
+      tokenCalls += 1;
+      return Response.json({ access_token: ROTATED, refresh_token: "rotated-grant", expires_in: 3600 });
+    }
+    if (!url.includes("/wham/usage")) return new Response("{}", { status: 401 });
+    const headers = new Headers(input instanceof Request ? input.headers : init?.headers);
+    const bearer = headers.get("authorization");
+    if (bearer === `Bearer ${ROTATED}`) {
+      finishOwnerRefresh();
+      return new Response("{}", { status: 401 });
+    }
+    if (bearer === `Bearer ${REJECTED}`) {
+      return new Response("{}", { status: 401 });
+    }
+    await ownerRefreshed;
+    return Response.json({ plan_type: "plus", rate_limit: { primary_window: { used_percent: 1 } } });
+  }) as typeof fetch;
+
+  await listCodexAuthAccounts(loadConfig(), true);
+
+  expect(tokenCalls).toBe(1);
+  const aliasGeneration = readCodexAccountRecord("alias-later")!.generation;
+  expect(quotaRecoveryRecordForTests("alias-later")).toEqual({ state: "spent", lineage: aliasGeneration });
+});
+
 test("an already-aborted caller starts no refresh at all", async () => {
   const { forceRefreshCodexPoolToken } = await import("../src/codex/account-store");
   const { claimQuotaRecovery, quotaRecoveryRecordForTests, releaseQuotaRecovery, settleQuotaRecovery } =

tests/quota-401-recovery.test.ts

@@ -1,6 +1,7 @@
 import { afterEach, beforeEach, describe, expect, test } from "bun:test";
 import {
   claimQuotaRecovery,
+  fencePropagatedQuotaRecovery,
   quotaRecoveryRecordForTests,
   releaseQuotaRecovery,
   resetQuotaRecoveryForTests,
@@ -75,6 +76,19 @@ describe("claim identity", () => {
 });
 
 describe("settlement by outcome", () => {
+  test("a propagated alias generation is fenced without its own claim", () => {
+    const alias = "same-grant-alias";
+    const staleClaim = claimQuotaRecovery(alias, 4);
+    if (!staleClaim.granted) throw new Error("expected a claim");
+
+    fencePropagatedQuotaRecovery(alias, 5);
+
+    expect(quotaRecoveryRecordForTests(alias)).toEqual({ state: "spent", lineage: 5 });
+    expect(claimQuotaRecovery(alias, 5)).toEqual({ granted: false, reason: "spent" });
+    settleQuotaRecovery(alias, staleClaim.claimId, { provenance: "self-refresh", generation: 6 });
+    expect(quotaRecoveryRecordForTests(alias)).toEqual({ state: "spent", lineage: 5 });
+  });
+
   test("a joined lineage spends the returned generation, like a self-refresh", () => {
     const claim = claimQuotaRecovery(ACCOUNT, 7);
     if (!claim.granted) throw new Error("expected a claim");