[luvs01]

Summary

• Fence same-grant alias records that adopt a rotated credential during a WHAM 401 forced refresh. Propagation already advances dormant alias records to the rotated grant (Bug: close remaining stored Pool 401 concurrency and recovery-budget gaps #2892 gap 3), but the quota-recovery budget never learned about them, so a later poll on an alias could claim a fresh recovery and rotate the same underlying grant a second time.
• Carry propagatedAliases on ForcedRefreshOutcome and forward it through resolveCodexToken / forceRefreshCodexPoolToken, so the recovery settlement sees every record the flight advanced.
• Add fencePropagatedQuotaRecovery(accountId, lineage) in src/codex/quota-401-recovery.ts and call it for each propagated alias in the recoverPoolQuotaFrom401 settlement (src/codex/auth-api/pool-quota-probe.ts), deliberately superseding any stale pre-propagation claim.

Verification

• Head: e7f81e3d351ab39006d3669961d6a5ab25f4cc0e (tree 438d2439439bdc965bf963e5f32520bd862204d1), based on dev 1c7ab30978093560224a477ba8fd35e233b9862b.
• bun test tests/usage/quota-401-recovery.test.ts tests/usage/quota-401-recovery-runtime.test.ts — 24 pass / 0 fail, including a new unit test for claim-superseding alias fences and a runtime regression that reproduces the owner/alias interleaving and asserts a single OAuth token refresh.
• New runtime test verified red against the unfenced path (token endpoint hit twice).
• bun x tsc --noEmit — clean.
• bun run structure:check — passed.
• bun run privacy:scan — passed.
• bun scripts/file-size-ratchet.ts — passed.

Remaining gates

• Fork CI dispatched via gh workflow run ci.yml on this branch: diagnostic run 35269696053 (contributor fork Actions) . The macOS control job is expected to cancel at the 30-minute mark; that is the known upstream limitation tracked in [Bug]: macOS control is cancelled near its 30-minute limit in full dispatch CI #4905, not a signal from this change.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Summary by CodeRabbit

• Bug Fixes

  • Improved quota recovery for accounts sharing the same refresh grant.
  • Prevented duplicate credential refreshes when refreshed credentials propagate to related accounts.
  • Ensured propagated account generations are correctly marked as settled, including late-arriving aliases.

• Tests

  • Added coverage for shared-account quota recovery and propagated credential handling.

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: d14a8e61-69d4-4255-b973-2d8127d5fc6d

📥 Commits

Reviewing files that changed from the base of the PR and between 238bb76 and e7f81e3.

📒 Files selected for processing (5)

• src/codex/account-store.ts
• src/codex/auth-api/pool-quota-probe.ts
• src/codex/quota-401-recovery.ts
• tests/usage/quota-401-recovery-runtime.test.ts
• tests/usage/quota-401-recovery.test.ts

 ______________________________________
< I am an equal opportunity nitpicker. >
 --------------------------------------
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[github-actions]

✅ READY

• all PR quality gates passed.

Hygiene

✅ Deterministic PR hygiene checks passed.