[NineDayCC]

Summary

• After a ChatGPT plan change, an authenticated WHAM response can report an allowed weekly primary window and a null secondary window while omitting the optional tertiary window. The main policy parser previously retained an exhausted five-hour reading in this shape, so Codex requests still received a local quota refusal even after the displayed plan and weekly allowance recovered.
• Recognize that two-window topology only with an explicit rate_limit.allowed === true verdict. Primary and secondary still require measured long-window or explicit null evidence, and a present tertiary must pass the existing validation.
• Apply the validated retirement proof to both the identity-bound main policy snapshot and the display/rotation snapshot. The latter previously kept a future-reset short tuple even when the policy snapshot recovered, leaving account selection blocked.
• Add synthetic regression coverage for request admission without credit consent, enabled and disabled hard lock, omitted and null tertiary windows, invalid or incomplete snapshots, stale writers, and persistence. Update the account-mode contract and user guide.

Verification

Rebased head: 913e64ddcf42083a442f4618eebcfd6671104c3c, based on upstream dev at 3e58c2ce3ee5433901ed467fe87c32fb4b5c5e77. git range-diff and a byte-for-byte patch comparison confirm the reviewed fix is unchanged by rebase.

Checks run again on the rebased head:

• bun test tests/codex-integration/main-account-credit-renewal.test.ts tests/codex-integration/main-account-hard-lock-retirement.test.ts tests/codex-integration/main-quota-window-observation.test.ts tests/codex-integration/main-quota-provenance.test.ts tests/codex-integration/main-quota-evidence-validation.test.ts tests/codex-integration/codex-quota-parser-parity.test.ts tests/lab/core-lab-boundary.test.ts — 514 passed, 0 failed on Bun 1.4.0.
• bun run typecheck — passed.
• bun run privacy:scan — passed.
• bun run structure:check — passed.
• cd docs-site && bun run build — passed; 569 pages built and 79,359 internal links checked. Dependencies were installed with bun install --frozen-lockfile before the earlier build; manifests and lockfiles did not change during rebase.
• git diff --check upstream/dev...HEAD — passed. Scope remains seven project files with synthetic fixtures.

Before rebase, bun run test:changed --parallel=1 tests/codex-integration reported 7,160 passed, 35 skipped, 3 failed across 286 files. All three failing assertions also reproduced in an unmodified checkout of the previous upstream baseline dc45bb2ca92e9a4f841a73d70177bfec04722d47:

• codex-shim-readiness.test.ts: warning prefix instead of the expected success prefix.
• codex-runtime.test.ts: installed instead of the expected fallback selection.
• native-profile-route-security.test.ts: 502 instead of the expected 401 in the remote-session test.

Baseline comparison used bun test tests/codex-integration/codex-runtime.test.ts tests/codex-integration/codex-shim-readiness.test.ts tests/providers/github-copilot/github-copilot-account-origin.test.ts and bun test tests/codex-integration/native-profile-route-security.test.ts. These expanded and baseline results belong to the pre-rebase revision; they are not current-head passing claims.

Local validation uses the documented AGENTS.md resource exception. The unrestricted change-connected run approached the available memory limit with four workers and was interrupted; a later unrestricted single-worker attempt was also interrupted to bound the scope. The current-head focused checks above cover the changed quota behavior, persistence, request admission, and core import boundary. Full-suite and other-platform coverage remain unverified locally and are left to CI or a suitably resourced environment. Required CI must pass before merge.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Scope and privacy checks are complete. Explicit security review of the main-account admission-policy change remains pending.

Review readiness checklist

This PR stays in draft until every box below is ticked. Tick all four boxes once the requirements are met:

• Required local validation passed; commands, results, and any full-suite exception are documented.

• I pushed my PR to a recent dev commit (at most 10 behind; a maintainer may still ask for the exact tip before merge).

• I resolved all correct Codex and CodeRabbit findings.

• My PR is ready for review.

Contributor standards and behavior reviews found no code findings. The PR-description readiness-marker finding was corrected and verified with the repository parser. Maintainer security review, GitHub Codex/CodeRabbit review, and required CI remain separate requirements.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[github-actions]

⏳ DRAFT

• review readiness checklist open (2/4 boxes ticked).

What to do

• Tick all four boxes in the PR description once you're done (currently 2/4).

Review readiness checklist

• ✅ Required local validation passed; commands, results, and any full-suite exception are documented.
• ✅ I pushed my PR to a recent dev commit (at most 10 behind; a maintainer may still ask for the exact tip before merge).
• ⬜ I resolved all correct Codex and CodeRabbit findings.
• ⬜ My PR is ready for review.

2/4 boxes ticked.

This PR stays in draft until every box above is ticked.

[Ingwannu]

Reviewed exact head 913e64ddcf42083a442f4618eebcfd6671104c3c against current dev 3e58c2ce3ee5433901ed467fe87c32fb4b5c5e77.

Independent focused execution on Bun 1.4.0: bun test tests/codex-integration/main-account-credit-renewal.test.ts tests/codex-integration/main-account-hard-lock-retirement.test.ts tests/codex-integration/main-quota-provenance.test.ts — 138 pass, 0 fail, 1046 assertions. Isolated exact-head worktree, synthetic quota/transport fixtures, fresh private homes, verified cgroup CPU=75%, memory.high=1280M/max=1536M/swap=0, tasks=64, nice=10 and finite runtime. No real account/provider/native CLI calls or scans.

The inspected change requires explicit allowed:true plus measured long-window evidence before treating omitted/null tertiary data as proof of short-window absence; malformed partial data does not retire the old block. The absence proof reaches the live quota presentation/rotation consumer as well as policy state, and existing writer/config generation fencing remains ahead of publication. The focused suite exercised absence, malformed snapshots, credit/no-consent, hard-lock modes and stale-writer ownership cases.

This is a scoped correctness/fixture receipt, not an approval or independent trust-boundary sign-off. Keep Draft until the current-head CI/readiness and required owner review are satisfied. Latest inspected checks only establish hygiene/label success with resolve-pr still queued; they do not establish a green cross-platform/full suite. Native plan-change behavior and whole-suite coverage remain unverified here.

[lidge-jun]

Landed on dev through #7008 (merge a63267c134), carried as commit b1832a3 (plus 6a69e54 adding coverage) with your authorship and a Co-authored-by trailer preserved. Thank you — this ships in 2.84.0.