From efabcaa362216ef52a8bb11560155112fd1effd0 Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Sat, 1 Aug 2026 18:05:52 +0900
Subject: [PATCH 01/63] docs: design native main profile switching

---
 .../260801_native_main_profiles/000_design.md | 466 ++++++++++++++++++
 1 file changed, 466 insertions(+)
 create mode 100644 devlog/_plan/260801_native_main_profiles/000_design.md

diff --git a/devlog/_plan/260801_native_main_profiles/000_design.md b/devlog/_plan/260801_native_main_profiles/000_design.md
new file mode 100644
index 000000000..b149c230e
--- /dev/null
+++ b/devlog/_plan/260801_native_main_profiles/000_design.md
@@ -0,0 +1,466 @@
+# Native main profile switching design spike (#656)
+
+Status: fork-only design spike, not implementation-ready
+
+Issue: https://github.com/lidge-jun/opencodex/issues/656
+
+Official Codex reference: `openai/codex@ee0247f95a6fe2b094ba2253d82cae2a2b4c2dff`
+
+## Decision summary
+
+The first implementation should be CLI/backend-only and should use these safety boundaries:
+
+1. Support native ChatGPT credentials only when the effective Codex credential store is `file`.
+2. Treat the complete native auth envelope as opaque bytes. Parse it for validation, but never rebuild it from Pool fields.
+3. Keep exactly one refresh owner. Official Codex owns the active profile; the encrypted OpenCodex vault owns inactive profiles.
+4. Move a profile between those owners transactionally. Do not create a second independently refreshable Pool record.
+5. Require encrypted storage for inactive profiles, backed by an OS-protected key. There is no plaintext fallback.
+6. Bind every vault and switch transaction to one canonical effective `CODEX_HOME`.
+7. Refuse a live switch while a native Codex process can still refresh the old credential. Drain OpenCodex `__main__` traffic and require a native Codex restart.
+8. Preserve task and history data. Only the active credential and `__main__` runtime-derived state may change.
+9. Prove rollback for every failure after the first credential write before opening a behavior-changing PR.
+10. Keep GUI work out of the first PR.
+
+This design deliberately rejects `keyring`, `auto`, and `ephemeral` Codex credential modes in v1. Supporting those modes requires an official Codex integration point; directly reproducing Codex keyring internals in TypeScript would be brittle and unsafe.
+
+## Why the Pool credential model cannot be reused
+
+The current Pool record contains the fields OpenCodex needs to route and refresh Pool traffic. It is not the complete native Codex credential record.
+
+The current official Codex `AuthDotJson` includes:
+
+- `auth_mode`
+- `OPENAI_API_KEY`
+- `tokens`
+- `last_refresh`
+- `agent_identity`
+- `personal_access_token`
+- `bedrock_api_key`
+
+The ChatGPT token payload includes the raw ID token, access token, refresh token, and optional account ID. The format can gain fields independently of OpenCodex.
+
+Relevant official definitions:
+
+- [AuthDotJson](https://github.com/openai/codex/blob/ee0247f95a6fe2b094ba2253d82cae2a2b4c2dff/codex-rs/login/src/auth/storage.rs#L38)
+- [TokenData](https://github.com/openai/codex/blob/ee0247f95a6fe2b094ba2253d82cae2a2b4c2dff/codex-rs/login/src/token_data.rs#L10)
+
+Converting a Pool record into `auth.json` would lose native fields and assign refresh ownership to two independent implementations. That is not a supported conversion path.
+
+## Official Codex storage constraints
+
+Official Codex currently has four credential-store modes:
+
+| Mode | Official behavior | v1 behavior |
+| --- | --- | --- |
+| `file` | Stores credentials in `$CODEX_HOME/auth.json` | Supported |
+| `keyring` | Stores credentials in the keyring and fails if unavailable | Refuse |
+| `auto` | Prefers keyring and falls back to `auth.json` | Refuse because the active backend can change |
+| `ephemeral` | Keeps credentials in process memory only | Refuse |
+
+The official default is currently `file`. On Windows, the default keyring backend stores encrypted secrets in a local file whose key is in the OS keyring. A successful keyring save can remove `auth.json`.
+
+Relevant official definitions:
+
+- [AuthCredentialsStoreMode](https://github.com/openai/codex/blob/ee0247f95a6fe2b094ba2253d82cae2a2b4c2dff/codex-rs/config/src/types.rs#L104)
+- [AuthKeyringBackendKind](https://github.com/openai/codex/blob/ee0247f95a6fe2b094ba2253d82cae2a2b4c2dff/codex-rs/config/src/types.rs#L136)
+- [Auth storage backends](https://github.com/openai/codex/blob/ee0247f95a6fe2b094ba2253d82cae2a2b4c2dff/codex-rs/login/src/auth/storage.rs#L163)
+
+Therefore, the presence or absence of `auth.json` alone does not identify the official active credential source. The capability probe must resolve the credential mode before any write.
+
+## Threat model
+
+The feature must protect against:
+
+- Token disclosure through logs, CLI output, management responses, crash journals, or diagnostic bundles.
+- Writing to a different Codex home than the one shown to the user.
+- Losing the original login after malformed input, failed validation, failed rename, failed ACL application, or failed read-back.
+- Two components using the same rotating refresh token independently.
+- A process crash between the auth-file replacement and the vault metadata update.
+- A native Codex process refreshing the source profile while OpenCodex is switching it out.
+- Stale in-flight `__main__` responses publishing usage or plan state for the old identity.
+- Clearing tasks or history as a side effect of an account switch.
+- Treating a missing, malformed, or temporarily unreadable credential as a confirmed logout or identity change.
+
+It does not claim to protect an unlocked account from malware running as the same OS user. The OS credential store and file ACLs are still required to reduce accidental disclosure and offline credential exposure.
+
+## Invariants
+
+### I1. Full-fidelity envelope
+
+OpenCodex stores the exact source bytes and their SHA-256 digest. It may parse a copy for validation, but it must write the original decrypted bytes without serializing a reduced TypeScript shape.
+
+This preserves fields that the installed Codex understands but the installed OpenCodex does not.
+
+### I2. One refresh owner
+
+Credential ownership is stateful:
+
+| Profile state | Credential owner | Refresh allowed by OpenCodex |
+| --- | --- | --- |
+| Active | Official Codex active store | No |
+| Inactive | Encrypted OpenCodex vault | No |
+| Staged login | Official Codex in a restricted temporary home | No |
+| Switching | Transaction journal under an exclusive switch lock | No |
+
+OpenCodex never calls the OAuth refresh grant for native profiles. The Pool refresh implementation remains Pool-only.
+
+On a successful switch, the target encrypted payload is consumed from the inactive vault record and becomes the official active credential. The source active envelope becomes the encrypted inactive record. The target record retains metadata and an active marker, not a second refreshable payload.
+
+### I3. Exact home binding
+
+The operation resolves `CODEX_HOME` once, canonicalizes it, and computes:
+
+```text
+home_id = SHA-256("opencodex-native-profile-home-v1\0" || canonical_home_bytes)
+```
+
+The vault, encrypted payload AAD, lock, and journal all carry this `home_id`. A mismatch is a hard error. An invalid explicit `CODEX_HOME` is never replaced with a fallback path.
+
+The CLI displays the canonical path used for the operation. The vault may store only `home_id`; it does not need to persist the raw path.
+
+### I4. No plaintext inactive profile
+
+After a successful command returns, an inactive native envelope exists only as authenticated ciphertext. Temporary plaintext created for staged official login is ACL-restricted and removed before success is reported.
+
+There is no `--allow-plaintext`, environment-variable bypass, or automatic fallback when key storage is unavailable.
+
+### I5. Unknown reads are not transitions
+
+Missing, malformed, and unreadable active credentials are `unknown` states. They stop the switch without changing the vault, runtime state, active profile marker, or task affinity.
+
+### I6. Commit before runtime reset
+
+`__main__` quota, cooldown, reauth, plan, cache, thread affinity, and WebSockets are cleared only after both the credential replacement and vault ownership transfer have committed.
+
+### I7. Task and history preservation
+
+No transaction step may write, move, truncate, or delete Codex task, history, rollout, session, or project files. A different account may be unable to continue a server-side task, but OpenCodex does not rewrite that task to hide the incompatibility.
+
+## Storage model
+
+The vault contains public metadata and authenticated ciphertext. Token-bearing fields are always inside `payload`.
+
+```ts
+type NativeMainProfileVaultV1 = {
+  version: 1;
+  revision: number;
+  homeId: string;
+  activeProfileId: string | null;
+  profiles: NativeMainProfileRecordV1[];
+};
+
+type NativeMainProfileRecordV1 = {
+  id: string;
+  label: string;
+  identityHash: string;
+  identityHint: string;
+  state: "active" | "inactive";
+  payload: EncryptedEnvelopeV1 | null;
+  createdAt: string;
+  updatedAt: string;
+};
+
+type EncryptedEnvelopeV1 = {
+  cipher: "aes-256-gcm";
+  keyRef: string;
+  nonce: string;
+  ciphertext: string;
+  tag: string;
+  envelopeSha256: string;
+};
+```
+
+`identityHint` is a user-safe, masked value. Email and raw account IDs are not required for listing. The authenticated additional data binds the ciphertext to:
+
+```text
+format_version || home_id || profile_id || identity_hash || envelope_sha256
+```
+
+The vault and journal use `atomicWriteFileAsync()` so Windows ACL application remains asynchronous and happens before publication by rename.
+
+## Key custody
+
+The implementation needs a narrow key-provider boundary:
+
+```ts
+interface NativeProfileKeyProvider {
+  getOrCreate(homeId: string): Promise<{
+    keyRef: string;
+    key: Uint8Array;
+  }>;
+}
+```
+
+Requirements:
+
+- The production provider stores the random 256-bit master key in an OS-protected credential store.
+- The vault file never contains the master key.
+- A key-store failure is terminal and leaves native auth unchanged.
+- Tests inject an in-memory deterministic provider.
+- Decrypted buffers are short-lived and cleared on a best-effort basis.
+- Crypto code uses a Bun-compatible `node:crypto` surface and is tested with both bundled Bun and Bun 1.4 canary.
+
+The current OpenCodex tree has no suitable cross-platform OS-keyring primitive. Selecting that dependency or platform adapter is a maintainer decision and is a blocking design gate for production code. A random key in a neighboring ACL-only file is not an acceptable substitute.
+
+## Credential capability probe
+
+Every mutating command runs the following read-only probe first:
+
+1. Resolve and canonicalize the effective `CODEX_HOME`.
+2. Resolve the installed Codex credential-store mode.
+3. Accept only an explicit or default `file` result.
+4. Reject `keyring`, `auto`, and `ephemeral` with a specific error and no writes.
+5. Read `auth.json` once and classify it as `ok`, `missing`, `invalid`, or `unreadable`.
+6. Parse the complete JSON only to validate the ChatGPT envelope and derive a stable identity.
+7. Report the canonical home, store mode, active identity hint, and feature availability without returning credentials.
+
+`auto` is rejected even when `auth.json` currently exists. Official Codex may later save to keyring and remove the file, so treating that file as authoritative would create split ownership.
+
+## Enrollment
+
+Two enrollment paths are needed.
+
+### Register the current active profile
+
+`ocx account main register <label>` associates the current native identity with a profile ID and active marker. It does not create an inactive copy that can be refreshed independently.
+
+### Add another profile
+
+`ocx account main add <label>` should run the installed official `codex login` against a new, restricted staging `CODEX_HOME` forced to `file` mode. After the official login exits successfully:
+
+1. Read and validate the complete staged envelope.
+2. Reject an identity already registered for the same home.
+3. Encrypt the exact staged bytes into an inactive vault record.
+4. Atomically publish the updated vault.
+5. Remove the staging directory.
+6. Report success only after no staged plaintext remains.
+
+This keeps the current active login untouched and delegates login creation to official Codex. OpenCodex does not synthesize a native envelope from Pool credentials.
+
+A crash can leave an ACL-restricted staging directory. The next `doctor`, `add`, or `switch` command must detect it and offer deterministic cleanup without printing its contents.
+
+## Switch transaction
+
+The management backend, not the GUI, owns the transaction.
+
+### Preconditions
+
+1. The capability probe reports `file` mode and a readable ChatGPT envelope.
+2. No unresolved switch journal exists.
+3. The target profile is inactive, decrypts successfully, and belongs to the same `home_id`.
+4. Source and target identities are known and different.
+5. The OS key provider is available.
+6. OpenCodex has drained new `__main__` requests.
+7. No known native Codex process can refresh the source credential.
+
+The first implementation does not expose a force-live option.
+
+### Commit sequence
+
+1. Acquire an interprocess lock scoped to `home_id`.
+2. Re-run recovery if a journal appeared before lock acquisition.
+3. Read the source raw envelope once and verify its identity and digest.
+4. Decrypt and validate the target raw envelope in memory.
+5. Encrypt the current source raw envelope as the future inactive source payload.
+6. Atomically write a `PREPARED` journal containing encrypted source and target candidates, expected identities, expected digests, and the pre-transaction vault revision.
+7. Replace `auth.json` with the exact target bytes using `atomicWriteFileAsync()` and restrictive ACLs.
+8. Read back `auth.json`; require exact target digest and target identity.
+9. On any failure after step 7, atomically restore the exact source bytes and verify source digest and identity.
+10. Atomically mark the journal `AUTH_REPLACED`.
+11. Atomically update the vault: source becomes inactive with its encrypted payload; target becomes active with `payload: null`.
+12. Atomically mark the journal `VAULT_COMMITTED`, then remove it.
+13. Publish a confirmed native-main transition from source identity to target identity.
+14. Clear only `__main__` derived runtime state and close stale WebSockets.
+15. Release the traffic drain and lock.
+16. Return `restartRequired: true` for native Codex clients.
+
+If source restoration fails, the command must retain the encrypted journal, stop all further writes, and return a manual-recovery error. It must never claim that the old login was restored.
+
+## Crash recovery state machine
+
+The journal is encrypted where it carries auth bytes. Recovery compares current auth digest and identity rather than trusting the last recorded phase.
+
+| Journal phase | Current auth observation | Recovery action |
+| --- | --- | --- |
+| `PREPARED` | Exact source | Restore pre-transaction vault metadata and remove journal |
+| `PREPARED` | Exact target | Finish target ownership commit |
+| `PREPARED` | Target identity, new digest | Treat as target refreshed externally; finish commit and warn |
+| `AUTH_REPLACED` | Exact target or target identity | Finish vault commit |
+| Any | Exact source or source identity | Roll back vault ownership to source |
+| Any | Missing, invalid, unreadable, or third identity | Make no credential write; require explicit recovery |
+| `VAULT_COMMITTED` | Target identity | Publish runtime transition if needed and remove journal |
+
+Recovery is idempotent. Repeating it must converge on the same active owner without duplicating an inactive payload.
+
+## Validation contract
+
+Validation has three layers.
+
+### Offline envelope validation
+
+- Root must be a JSON object.
+- Auth mode must represent native ChatGPT auth, including supported legacy absence of `auth_mode`.
+- `tokens.id_token`, `tokens.access_token`, and `tokens.refresh_token` must be non-empty strings.
+- The account identity must be derivable and internally consistent.
+- JWT claims are parsed as hints, not treated as signature validation.
+- Unknown fields are accepted and preserved in the raw bytes.
+
+### Optional authority probe
+
+If the target access token is not expired, the backend may perform the existing read-only main-account probe before writing. It must not refresh the token. A confirmed rejection aborts before `auth.json` changes.
+
+An expired access token with a present refresh token is not refreshed by OpenCodex. The switch may proceed under the single-owner transfer, after which official Codex owns refresh. The result must state that restart and official refresh are required.
+
+### Write validation
+
+After replacement, the backend verifies exact raw digest and confirmed target identity. Any mismatch triggers exact source restoration and restoration verification.
+
+This gives the first PR a testable guarantee: failed preflight leaves the original untouched, and failed publication restores the original before returning.
+
+## Runtime reconciliation
+
+The existing external-identity reconciliation remains necessary for logins changed outside OpenCodex. A managed switch should additionally publish an explicit confirmed transition event:
+
+```ts
+applyConfirmedMainAccountTransition({
+  fromAccountId,
+  toAccountId,
+  source: "native-profile-switch",
+});
+```
+
+That event should call the same internal reset primitive used by external reconciliation. It must clear only:
+
+- `__main__` usage and plan cache
+- `__main__` quota and cooldown state
+- `__main__` reauth state
+- `__main__` thread affinity
+- stale main-account WebSockets
+
+It must not clear task/history data, Pool credentials, Pool account state, provider credentials, or unrelated account caches.
+
+Existing request-generation fencing should continue to prevent an old in-flight response from publishing state after the confirmed transition.
+
+## Native Codex restart semantics
+
+OpenCodex can drain its own main-account requests, but it cannot acquire the internal refresh lock of another native Codex process.
+
+For v1:
+
+- Detect known Codex desktop, CLI, and app-server processes on a best-effort basis.
+- Refuse a switch while such a process is active.
+- Do not terminate user processes automatically.
+- Return an explicit restart requirement after success.
+- Keep `--restart` orchestration out of the first PR.
+
+This is stricter than allowing existing work to continue, but it closes the rotating-refresh-token race. OpenCodex requests that were already in flight before the drain may finish with their captured identity; their stale state publication remains fenced.
+
+## CLI contract
+
+Proposed first-version commands:
+
+```text
+ocx account main doctor
+ocx account main register <label>
+ocx account main add <label>
+ocx account main list [--json]
+ocx account main switch <profile-id-or-label>
+ocx account main recover [--rollback]
+```
+
+Output rules:
+
+- Always show the effective canonical `CODEX_HOME` for mutating commands.
+- Show profile IDs, user labels, active/inactive state, and masked identity hints.
+- Never show raw account IDs, email unless explicitly opted in, token fragments, digests derived directly from tokens, decrypted paths, or auth JSON.
+- JSON errors use stable codes such as `UNSUPPORTED_AUTH_STORE`, `CODEX_HOME_MISMATCH`, `CODEX_BUSY`, `AUTH_UNKNOWN`, `PROFILE_DECRYPT_FAILED`, `AUTH_RESTORE_FAILED`, and `RECOVERY_REQUIRED`.
+- `switch` reports whether online probing was performed and whether official refresh is expected after restart, without exposing the reason body from an auth server.
+
+The existing `ocx account use` command remains Pool selection. Native profile commands live under `ocx account main` so the two concepts cannot be confused.
+
+## Management boundary
+
+The running service should perform the switch because it owns the `__main__` request drain and runtime reconciliation. The CLI sends only a profile ID and operation options through an authenticated local management route. Decrypted envelopes never cross the management API.
+
+If the service is unavailable, read-only `doctor` and `list` may work locally. A mutating `switch` should fail closed rather than changing auth without draining and reconciling the running service.
+
+## Required test matrix
+
+All focused tests run once with the repository's bundled Bun and once with Bun 1.4 canary.
+
+### Envelope fidelity
+
+- Preserve unknown top-level and nested fields byte-for-byte.
+- Preserve whitespace and field order in a restored original.
+- Reject incomplete ChatGPT token data without writing.
+- Reject Pool credential records as native envelopes.
+- Keep token values out of thrown errors, logs, snapshots, and JSON output.
+
+### Home and store mode
+
+- Bind records to the canonical effective home.
+- Reject an invalid explicit home without fallback.
+- Reject home hash mismatch before decryption/write.
+- Reject `keyring`, `auto`, and `ephemeral` without writes.
+- Accept absent store configuration as official default `file` only when no higher-precedence override is active.
+
+### Transaction and rollback
+
+- Target decrypt failure leaves source and vault unchanged.
+- Target validation failure leaves source and vault unchanged.
+- Temporary write failure leaves source unchanged.
+- ACL failure leaves source unchanged and removes residual temp files.
+- Rename/read-back mismatch restores the exact source bytes.
+- Restore verification failure retains the encrypted journal and reports `AUTH_RESTORE_FAILED`.
+- Vault commit failure after auth replacement is recovered deterministically.
+- Every crash phase converges correctly when recovery is repeated.
+- A third identity or unreadable auth during recovery causes no write.
+
+### Refresh ownership and concurrency
+
+- Active records never retain an inactive payload after commit.
+- Inactive records are never passed to the Pool refresh path.
+- Concurrent switches serialize on `home_id`.
+- Native Codex busy detection prevents mutation.
+- New `__main__` requests are drained during commit.
+- An old in-flight response cannot publish usage/plan data after transition.
+
+### Runtime and data preservation
+
+- Successful identity change clears only documented `__main__` derived state.
+- Unknown reads and same-identity token changes do not clear state.
+- Task and history fixture trees are byte-identical before and after switch and rollback.
+- Pool, OAuth, provider, and API-key stores are byte-identical.
+- Switch-back uses the same transaction and restores the previous profile as a normal target.
+
+## PR boundary
+
+This design document is not itself a request to merge credential handling.
+
+The first behavior-changing PR should include:
+
+- CLI/backend only, no dashboard UI.
+- File-mode capability probe and explicit unsupported-mode errors.
+- Full-fidelity opaque envelope handling.
+- OS-protected key-provider implementation with no plaintext fallback.
+- Encrypted inactive-profile vault.
+- Home-scoped lock and encrypted crash journal.
+- Atomic switch, exact read-back, exact restore, and recovery.
+- Confirmed `__main__` runtime transition integration.
+- Failure-injection tests proving original-login restoration.
+- Bundled Bun and Bun 1.4 canary focused test results.
+
+A smaller read-only `doctor` PR can precede it only if maintainers want the credential-mode diagnostics separately. No PR should add a partial write path that lacks rollback proof.
+
+## Open design gates
+
+The design is ready for maintainer review after these choices are confirmed:
+
+1. OS key provider: approve a cross-platform dependency or platform adapter for the vault master key.
+2. File-only v1: confirm that `keyring`, `auto`, and `ephemeral` should fail closed rather than delaying the entire feature.
+3. Stale inactive profile: allow owner transfer with a required restart when the access token is expired but the unique refresh token is present.
+4. Process policy: approve fail-closed busy detection and manual restart for the first PR.
+5. Staged login: approve invoking official `codex login` in an isolated file-mode home for adding profiles.
+
+Recommended answers are yes to items 2 through 5. Item 1 needs a dependency decision before production implementation can safely begin.
+

From 549c81daa7a17fd2ad92b1001d1c34a283e88555 Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Sat, 1 Aug 2026 18:35:21 +0900
Subject: [PATCH 02/63] test: model native profile crash recovery

---
 .../001_validation.md                         | 76 ++++++++++++++++
 src/codex/native-profile-recovery.ts          | 91 +++++++++++++++++++
 tests/native-profile-recovery.test.ts         | 89 ++++++++++++++++++
 3 files changed, 256 insertions(+)
 create mode 100644 devlog/_plan/260801_native_main_profiles/001_validation.md
 create mode 100644 src/codex/native-profile-recovery.ts
 create mode 100644 tests/native-profile-recovery.test.ts

diff --git a/devlog/_plan/260801_native_main_profiles/001_validation.md b/devlog/_plan/260801_native_main_profiles/001_validation.md
new file mode 100644
index 000000000..32374b947
--- /dev/null
+++ b/devlog/_plan/260801_native_main_profiles/001_validation.md
@@ -0,0 +1,76 @@
+# Native main profile design-spike validation
+
+Date: 2026-08-01
+
+Branch: `experiment/656-native-profile-design`
+
+## Validated artifact
+
+The executable part of this spike is intentionally limited to the pure crash-recovery decision model in:
+
+- `src/codex/native-profile-recovery.ts`
+- `tests/native-profile-recovery.test.ts`
+
+The model has no filesystem, credential, network, encryption, process-control, or runtime-state side effects.
+
+## Runtime matrix
+
+| Runtime | Exact revision | Focused tests | Typecheck |
+| --- | --- | --- | --- |
+| OpenCodex packaged Bun | `1.3.14+0d9b296af` | 18 passed, 0 failed | Passed |
+| User-selected Bun 1.4 canary | `1.4.0-canary.1+5f65d3785` | 18 passed, 0 failed | Passed |
+
+The canary executable reports the display version `1.4.0`; `bun --revision` confirms the exact canary build above.
+
+## Commands
+
+```powershell
+& $packagedBun test tests/native-profile-recovery.test.ts
+& bun test tests/native-profile-recovery.test.ts
+
+& $packagedBun install --frozen-lockfile
+& $packagedBun run typecheck
+& bun run typecheck
+```
+
+The frozen install resolved 101 packages and did not require a lockfile update.
+
+## Covered recovery decisions
+
+Each journal phase was checked against exact and changed source/target observations:
+
+- `prepared`
+- `auth-replaced`
+- `vault-committed`
+
+The tests prove these pure decisions:
+
+- A confirmed source identity converges to source ownership.
+- A confirmed target identity before vault commit completes target ownership.
+- A confirmed target identity after vault commit finalizes runtime reconciliation.
+- An unreadable or otherwise unconfirmed auth state requires manual recovery and publishes no runtime transition.
+- A third identity requires manual recovery and publishes no runtime transition.
+- A changed digest with the expected identity follows the identity-safe recovery branch rather than overwriting an external refresh blindly.
+
+## Explicitly not validated yet
+
+This spike does not claim that production native-profile switching is ready. The following work remains behind the design gates in `000_design.md`:
+
+- Cross-platform OS-protected key provider selection and security review.
+- Full-fidelity encrypted envelope implementation.
+- Effective Codex credential-store mode resolution.
+- Staged official Codex login.
+- Home-scoped interprocess locking.
+- Atomic auth replacement and exact-byte restoration.
+- Encrypted crash-journal persistence and idempotent I/O recovery.
+- Native Codex process quiescence and restart behavior.
+- OpenCodex `__main__` request drain and confirmed runtime-state transition.
+- Failure injection for ACL, rename, read-back, vault commit, and restoration failures.
+- Verification that task/history and unrelated credential stores remain byte-identical.
+
+No production code in this spike reads or writes a user's `auth.json`, vault, task, history, Pool, OAuth, provider, or API-key data.
+
+## PR readiness
+
+The design and pure state model are suitable for maintainer discussion. A behavior-changing upstream PR is not suitable until maintainers choose the OS key-provider approach and confirm the file-only v1 boundary.
+
diff --git a/src/codex/native-profile-recovery.ts b/src/codex/native-profile-recovery.ts
new file mode 100644
index 000000000..233d4e9dd
--- /dev/null
+++ b/src/codex/native-profile-recovery.ts
@@ -0,0 +1,91 @@
+/**
+ * Pure recovery decision model for the native-main profile design spike.
+ *
+ * This module deliberately performs no credential, vault, or filesystem I/O.
+ * The eventual transaction runner must make its observations first, then apply
+ * exactly one decision returned here while holding the home-scoped lock.
+ */
+
+export type NativeProfileJournalPhase =
+  | "prepared"
+  | "auth-replaced"
+  | "vault-committed";
+
+export type NativeProfileAuthObservation =
+  | {
+      identity: "source";
+      digest: "exact" | "changed";
+    }
+  | {
+      identity: "target";
+      digest: "exact" | "changed";
+    }
+  | {
+      identity: "unknown" | "other";
+      digest: "unknown";
+    };
+
+export type NativeProfileRecoveryDecision =
+  | {
+      action: "rollback-source";
+      publishRuntimeTransition: false;
+      reason: "source-active";
+    }
+  | {
+      action: "commit-target";
+      publishRuntimeTransition: true;
+      reason: "target-active-vault-pending";
+    }
+  | {
+      action: "finalize-target";
+      publishRuntimeTransition: true;
+      reason: "target-active-vault-committed";
+    }
+  | {
+      action: "manual-recovery";
+      publishRuntimeTransition: false;
+      reason: "auth-unconfirmed" | "third-identity";
+    };
+
+export function decideNativeProfileRecovery(
+  phase: NativeProfileJournalPhase,
+  observation: NativeProfileAuthObservation,
+): NativeProfileRecoveryDecision {
+  if (observation.identity === "unknown") {
+    return {
+      action: "manual-recovery",
+      publishRuntimeTransition: false,
+      reason: "auth-unconfirmed",
+    };
+  }
+
+  if (observation.identity === "other") {
+    return {
+      action: "manual-recovery",
+      publishRuntimeTransition: false,
+      reason: "third-identity",
+    };
+  }
+
+  if (observation.identity === "source") {
+    return {
+      action: "rollback-source",
+      publishRuntimeTransition: false,
+      reason: "source-active",
+    };
+  }
+
+  if (phase === "vault-committed") {
+    return {
+      action: "finalize-target",
+      publishRuntimeTransition: true,
+      reason: "target-active-vault-committed",
+    };
+  }
+
+  return {
+    action: "commit-target",
+    publishRuntimeTransition: true,
+    reason: "target-active-vault-pending",
+  };
+}
diff --git a/tests/native-profile-recovery.test.ts b/tests/native-profile-recovery.test.ts
new file mode 100644
index 000000000..2d5fbb4b1
--- /dev/null
+++ b/tests/native-profile-recovery.test.ts
@@ -0,0 +1,89 @@
+import { describe, expect, test } from "bun:test";
+
+import {
+  decideNativeProfileRecovery,
+  type NativeProfileAuthObservation,
+  type NativeProfileJournalPhase,
+} from "../src/codex/native-profile-recovery";
+
+const phases: NativeProfileJournalPhase[] = [
+  "prepared",
+  "auth-replaced",
+  "vault-committed",
+];
+
+const sourceObservations: NativeProfileAuthObservation[] = [
+  { identity: "source", digest: "exact" },
+  { identity: "source", digest: "changed" },
+];
+
+const targetObservations: NativeProfileAuthObservation[] = [
+  { identity: "target", digest: "exact" },
+  { identity: "target", digest: "changed" },
+];
+
+describe("native profile crash recovery decisions", () => {
+  for (const phase of phases) {
+    for (const observation of sourceObservations) {
+      test(`${phase}: ${observation.digest} source converges to source ownership`, () => {
+        expect(decideNativeProfileRecovery(phase, observation)).toEqual({
+          action: "rollback-source",
+          publishRuntimeTransition: false,
+          reason: "source-active",
+        });
+      });
+    }
+  }
+
+  for (const phase of ["prepared", "auth-replaced"] as const) {
+    for (const observation of targetObservations) {
+      test(`${phase}: ${observation.digest} target completes the vault commit`, () => {
+        expect(decideNativeProfileRecovery(phase, observation)).toEqual({
+          action: "commit-target",
+          publishRuntimeTransition: true,
+          reason: "target-active-vault-pending",
+        });
+      });
+    }
+  }
+
+  for (const observation of targetObservations) {
+    test(`vault-committed: ${observation.digest} target finalizes runtime state`, () => {
+      expect(
+        decideNativeProfileRecovery("vault-committed", observation),
+      ).toEqual({
+        action: "finalize-target",
+        publishRuntimeTransition: true,
+        reason: "target-active-vault-committed",
+      });
+    });
+  }
+
+  for (const phase of phases) {
+    test(`${phase}: unreadable auth requires manual recovery`, () => {
+      expect(
+        decideNativeProfileRecovery(phase, {
+          identity: "unknown",
+          digest: "unknown",
+        }),
+      ).toEqual({
+        action: "manual-recovery",
+        publishRuntimeTransition: false,
+        reason: "auth-unconfirmed",
+      });
+    });
+
+    test(`${phase}: a third identity requires manual recovery`, () => {
+      expect(
+        decideNativeProfileRecovery(phase, {
+          identity: "other",
+          digest: "unknown",
+        }),
+      ).toEqual({
+        action: "manual-recovery",
+        publishRuntimeTransition: false,
+        reason: "third-identity",
+      });
+    });
+  }
+});

From 0408dfdd744176ff90e846d83521012e859284d5 Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Sun, 2 Aug 2026 01:02:36 +0900
Subject: [PATCH 03/63] feat(codex): add encrypted native main profiles

---
 bun.lock                                      |  27 +
 .../260801_native_main_profiles/000_design.md |  21 +-
 .../002_implementation.md                     |  24 +
 .../docs/reference/cli/providers-accounts.md  |  19 +
 package.json                                  |   1 +
 src/cli/account-api.ts                        |   2 +
 src/cli/account-main.ts                       | 144 +++++
 src/cli/account.ts                            |   5 +
 src/cli/help.ts                               |   3 +-
 src/codex/account-lifecycle.ts                |  19 +
 src/codex/native-profile-api.ts               | 100 +++
 src/codex/native-profile-manager.ts           | 601 ++++++++++++++++++
 src/codex/native-profile-processes.ts         |  53 ++
 src/codex/native-profile-store.ts             | 401 ++++++++++++
 src/codex/native-profile-types.ts             | 100 +++
 src/server/management-api.ts                  |   5 +
 tests/cli-native-profile.test.ts              |  62 ++
 tests/native-profile-api.test.ts              |  32 +
 tests/native-profile-manager.test.ts          | 158 +++++
 19 files changed, 1765 insertions(+), 12 deletions(-)
 create mode 100644 devlog/_plan/260801_native_main_profiles/002_implementation.md
 create mode 100644 src/cli/account-main.ts
 create mode 100644 src/codex/native-profile-api.ts
 create mode 100644 src/codex/native-profile-manager.ts
 create mode 100644 src/codex/native-profile-processes.ts
 create mode 100644 src/codex/native-profile-store.ts
 create mode 100644 src/codex/native-profile-types.ts
 create mode 100644 tests/cli-native-profile.test.ts
 create mode 100644 tests/native-profile-api.test.ts
 create mode 100644 tests/native-profile-manager.test.ts

diff --git a/bun.lock b/bun.lock
index 7da1b7b91..3ab941dd6 100644
--- a/bun.lock
+++ b/bun.lock
@@ -7,6 +7,7 @@
       "dependencies": {
         "@bufbuild/protobuf": "^2.12.0",
         "@modelcontextprotocol/sdk": "^1",
+        "@napi-rs/keyring": "1.3.0",
         "bun": "1.3.14",
         "zod": "4.4.3",
       },
@@ -29,6 +30,32 @@
 
     "@modelcontextprotocol/sdk": ["@modelcontextprotocol/sdk@1.29.0", "", { "dependencies": { "@hono/node-server": "^1.19.9", "ajv": "^8.17.1", "ajv-formats": "^3.0.1", "content-type": "^1.0.5", "cors": "^2.8.5", "cross-spawn": "^7.0.5", "eventsource": "^3.0.2", "eventsource-parser": "^3.0.0", "express": "^5.2.1", "express-rate-limit": "^8.2.1", "hono": "^4.11.4", "jose": "^6.1.3", "json-schema-typed": "^8.0.2", "pkce-challenge": "^5.0.0", "raw-body": "^3.0.0", "zod": "^3.25 || ^4.0", "zod-to-json-schema": "^3.25.1" }, "peerDependencies": { "@cfworker/json-schema": "^4.1.1" }, "optionalPeers": ["@cfworker/json-schema"] }, "sha512-zo37mZA9hJWpULgkRpowewez1y6ML5GsXJPY8FI0tBBCd77HEvza4jDqRKOXgHNn867PVGCyTdzqpz0izu5ZjQ=="],
 
+    "@napi-rs/keyring": ["@napi-rs/keyring@1.3.0", "", { "optionalDependencies": { "@napi-rs/keyring-darwin-arm64": "1.3.0", "@napi-rs/keyring-darwin-x64": "1.3.0", "@napi-rs/keyring-freebsd-x64": "1.3.0", "@napi-rs/keyring-linux-arm-gnueabihf": "1.3.0", "@napi-rs/keyring-linux-arm64-gnu": "1.3.0", "@napi-rs/keyring-linux-arm64-musl": "1.3.0", "@napi-rs/keyring-linux-riscv64-gnu": "1.3.0", "@napi-rs/keyring-linux-x64-gnu": "1.3.0", "@napi-rs/keyring-linux-x64-musl": "1.3.0", "@napi-rs/keyring-win32-arm64-msvc": "1.3.0", "@napi-rs/keyring-win32-ia32-msvc": "1.3.0", "@napi-rs/keyring-win32-x64-msvc": "1.3.0" } }, "sha512-WrOw/bcXm0f9qHkumlT1QlArXSTWqaY9sunsDpOk+yCCorCKMxvWT/a3xko4EYHVdeZoh00yI2TydXn6eyICDA=="],
+
+    "@napi-rs/keyring-darwin-arm64": ["@napi-rs/keyring-darwin-arm64@1.3.0", "", { "os": "darwin", "cpu": "arm64" }, "sha512-pl76hJvdYUBn6I24bXiOBMA9nbDapo3I5B+f3OorjDU4dUMSypXeKbOVehJe8fhgTiH24flMyTS3aAIy43xegQ=="],
+
+    "@napi-rs/keyring-darwin-x64": ["@napi-rs/keyring-darwin-x64@1.3.0", "", { "os": "darwin", "cpu": "x64" }, "sha512-YcJtEV5LA3cvA4z3BurgxH5IhTsW1JfIvcAAcqcecwk06Si9F9NqkxbZVIfDwQ8oRHgaBmT3zZJnLAotCrVahw=="],
+
+    "@napi-rs/keyring-freebsd-x64": ["@napi-rs/keyring-freebsd-x64@1.3.0", "", { "os": "freebsd", "cpu": "x64" }, "sha512-vlLf31TGhfRAaxLDBhg8b89ss0HHD/lyNmL5F3UjSaz5CUXElsJmKYq9fqA/B+cZKUEUcLHHGhF0I/CqcFdaVw=="],
+
+    "@napi-rs/keyring-linux-arm-gnueabihf": ["@napi-rs/keyring-linux-arm-gnueabihf@1.3.0", "", { "os": "linux", "cpu": "arm" }, "sha512-KiWdMMu/Inz/bHHIAGrnF7r54FZDYXuHO6UFF/rhIrshUsxbMG1Rl9lEymNtqqsVo927G0VYcb02FzWQ3iBQRQ=="],
+
+    "@napi-rs/keyring-linux-arm64-gnu": ["@napi-rs/keyring-linux-arm64-gnu@1.3.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-eyKGpY40lm9Jvs1aD294XRH4y7+TlJM0YVAryZeXA6TX0mb4gMkxVXwSQv7MCwgah7raeUd0dKUb4BPAYIgcMg=="],
+
+    "@napi-rs/keyring-linux-arm64-musl": ["@napi-rs/keyring-linux-arm64-musl@1.3.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-iIK6JWHXAJqDrEyLY3TmswwloVyt2vj+04TZnew+uSJ9gnDO8EwRbp3/iw3LpWaXiDO7VomGO6y8I0Id8uBZSw=="],
+
+    "@napi-rs/keyring-linux-riscv64-gnu": ["@napi-rs/keyring-linux-riscv64-gnu@1.3.0", "", { "os": "linux", "cpu": "none" }, "sha512-/PGqrwn6EwgtK6vccASSXJRfOSP4vN1F4ASsIQ+7MdrK6hNvAJ1FZPrIuD5gGGdxezo3F++To2Wq7DbuGIeuNQ=="],
+
+    "@napi-rs/keyring-linux-x64-gnu": ["@napi-rs/keyring-linux-x64-gnu@1.3.0", "", { "os": "linux", "cpu": "x64" }, "sha512-2PDK1WKWTu9lBGq9VvNEkSlQD3O7YwVpmnyN2M3cy4v7NJ/8gDMd9GXv3G+FVXN13uhp4gnnPBS+ScefmEeD2A=="],
+
+    "@napi-rs/keyring-linux-x64-musl": ["@napi-rs/keyring-linux-x64-musl@1.3.0", "", { "os": "linux", "cpu": "x64" }, "sha512-oJ2HkX8YUo46QBkn0pG+HuIKQNqr523q6vBobCn+P95s4C4K6/kLBqHY/1bg5J4ap31DzsznhnFKcfBNBsjCnw=="],
+
+    "@napi-rs/keyring-win32-arm64-msvc": ["@napi-rs/keyring-win32-arm64-msvc@1.3.0", "", { "os": "win32", "cpu": "arm64" }, "sha512-tOd3c/uAaeoE4ycVlmAdSvygz0Zt3zdca6Y7gokBeIbaRDWpjDIUOpU3MvML59XAaqyuKGsVVu0F/DZb1lHPmw=="],
+
+    "@napi-rs/keyring-win32-ia32-msvc": ["@napi-rs/keyring-win32-ia32-msvc@1.3.0", "", { "os": "win32", "cpu": "ia32" }, "sha512-sPSqeAFZMGqP1R++M2JTza7GQJJ/TpCo6JU6Vcd4jnebvOaEDs9b7eipakU1PJdSvhpC2yXMCNRk9gXfrhuwHQ=="],
+
+    "@napi-rs/keyring-win32-x64-msvc": ["@napi-rs/keyring-win32-x64-msvc@1.3.0", "", { "os": "win32", "cpu": "x64" }, "sha512-4DnCWXwDc0HRKwyRlG5y0VhKZW2tNRQfKKfyj6IX/KWfDNyq9hn4n+GL1auyDcOO/v8PwnhmYo2+rOOqCkvvOg=="],
+
     "@oven/bun-darwin-aarch64": ["@oven/bun-darwin-aarch64@1.3.14", "", { "os": "darwin", "cpu": "arm64" }, "sha512-Omj20SuiHBOUjUBIyqtkNjSUIjOtEOJwmbix/ZyFH4BaQ6OZTaaRWIR4TjHVz0yadHgli6lLTiAh1uarnvD49A=="],
 
     "@oven/bun-darwin-x64": ["@oven/bun-darwin-x64@1.3.14", "", { "os": "darwin", "cpu": "x64" }, "sha512-FFj3QdU/OhlDyZOJ8CWfN5eWLpRlT4qjZg7lMQi7jA6GuoY5ajlO1zWLP/MuHYRSbXQUvV52RejNi8DVnAp13w=="],
diff --git a/devlog/_plan/260801_native_main_profiles/000_design.md b/devlog/_plan/260801_native_main_profiles/000_design.md
index b149c230e..763e3052f 100644
--- a/devlog/_plan/260801_native_main_profiles/000_design.md
+++ b/devlog/_plan/260801_native_main_profiles/000_design.md
@@ -1,6 +1,6 @@
 # Native main profile switching design spike (#656)
 
-Status: fork-only design spike, not implementation-ready
+Status: implementation candidate for maintainer and security review
 
 Issue: https://github.com/lidge-jun/opencodex/issues/656
 
@@ -200,7 +200,7 @@ Requirements:
 - Decrypted buffers are short-lived and cleared on a best-effort basis.
 - Crypto code uses a Bun-compatible `node:crypto` surface and is tested with both bundled Bun and Bun 1.4 canary.
 
-The current OpenCodex tree has no suitable cross-platform OS-keyring primitive. Selecting that dependency or platform adapter is a maintainer decision and is a blocking design gate for production code. A random key in a neighboring ACL-only file is not an acceptable substitute.
+The implementation candidate uses `@napi-rs/keyring` 1.3.0, a Rust N-API binding over the native platform credential stores. It is loaded only for native-profile operations and has no shell, PowerShell, environment-variable, or adjacent-file fallback. A missing native binary or unavailable key store fails closed. A random key in a neighboring ACL-only file remains an unacceptable substitute.
 
 ## Credential capability probe
 
@@ -452,15 +452,14 @@ The first behavior-changing PR should include:
 
 A smaller read-only `doctor` PR can precede it only if maintainers want the credential-mode diagnostics separately. No PR should add a partial write path that lacks rollback proof.
 
-## Open design gates
+## Implementation choices proposed by the PR
 
-The design is ready for maintainer review after these choices are confirmed:
+The PR makes the recommended choices concrete instead of blocking on a separate policy round:
 
-1. OS key provider: approve a cross-platform dependency or platform adapter for the vault master key.
-2. File-only v1: confirm that `keyring`, `auto`, and `ephemeral` should fail closed rather than delaying the entire feature.
-3. Stale inactive profile: allow owner transfer with a required restart when the access token is expired but the unique refresh token is present.
-4. Process policy: approve fail-closed busy detection and manual restart for the first PR.
-5. Staged login: approve invoking official `codex login` in an isolated file-mode home for adding profiles.
-
-Recommended answers are yes to items 2 through 5. Item 1 needs a dependency decision before production implementation can safely begin.
+1. Use `@napi-rs/keyring` as the OS-protected master-key provider and fail closed without it.
+2. Support file-mode Codex credentials only in v1; reject `keyring`, `auto`, and `ephemeral` before writes.
+3. Transfer an expired target envelope without refreshing it in OpenCodex; official Codex owns refresh after restart.
+4. Detect native Codex processes best-effort, never terminate them, and require explicit stopped confirmation when detection is unavailable.
+5. Invoke official `codex login` in an ACL-restricted staging home and remove its plaintext envelope before reporting success.
 
+These are reviewable implementation decisions, not claims of governance authority. Maintainers can accept, narrow, or replace them against working code and failure-injection evidence.
diff --git a/devlog/_plan/260801_native_main_profiles/002_implementation.md b/devlog/_plan/260801_native_main_profiles/002_implementation.md
new file mode 100644
index 000000000..866c3327d
--- /dev/null
+++ b/devlog/_plan/260801_native_main_profiles/002_implementation.md
@@ -0,0 +1,24 @@
+# Native main profile implementation candidate
+
+Date: 2026-08-01
+
+Branch: `feat/656-native-main-profiles`
+
+This increment turns the design spike into a CLI/backend-only implementation candidate. It adds an
+OS-keyring-backed encrypted vault, restricted official-login staging, a home-scoped transaction
+lock, encrypted crash journal, exact-byte auth replacement and rollback, explicit recovery, and
+confirmed `__main__` runtime reconciliation.
+
+The management API carries profile labels, generated profile IDs, and staging IDs only. It never
+accepts or returns auth envelopes, access tokens, refresh tokens, raw account IDs, or decrypted
+payloads. All routes remain behind the existing local management origin and update-token gate.
+
+The candidate intentionally excludes dashboard UI, Pool-to-native credential conversion, native
+process termination, non-file Codex credential stores, and plaintext key fallbacks.
+
+Required publication evidence:
+
+- Focused native-profile and CLI tests on packaged Bun 1.3.14 and Bun 1.4 canary.
+- Full typecheck and privacy scan.
+- Security diff review covering key custody, journal integrity, rollback failure, process detection,
+  management authorization, secret redaction, and task/history preservation.
diff --git a/docs-site/src/content/docs/reference/cli/providers-accounts.md b/docs-site/src/content/docs/reference/cli/providers-accounts.md
index 5e36468ab..50713e21f 100644
--- a/docs-site/src/content/docs/reference/cli/providers-accounts.md
+++ b/docs-site/src/content/docs/reference/cli/providers-accounts.md
@@ -210,6 +210,25 @@ security find-generic-password -w openrouter | ocx account add-key openrouter --
 Inspect Codex reset credits for an account. Consuming a credit is destructive and requires both
 `--consume` and `--yes`.
 
+### `ocx account main <subcommand>`
+
+Manage named native Codex main-login profiles without changing OpenCodex account-pool routing:
+
+```text
+ocx account main doctor
+ocx account main list
+ocx account main register <name>
+ocx account main add <name>
+ocx account main switch <name>
+ocx account main recover
+```
+
+Version 1 supports file-based Codex authentication, encrypts stored profiles with AES-256-GCM, and
+keeps the encryption key in the operating-system credential store. `add` stages the official Codex
+login flow before importing the resulting credential. Close Codex before switching profiles; a
+successful switch preserves local tasks and history, then requires Codex to be restarted. Use
+`doctor` to inspect profile state and `recover` to finish or roll back an interrupted transition.
+
 ## Models
 
 ### `ocx models [subcommand]` · `ocx model <subcommand>`
diff --git a/package.json b/package.json
index bda377321..ba35941b1 100644
--- a/package.json
+++ b/package.json
@@ -57,6 +57,7 @@
   "dependencies": {
     "@bufbuild/protobuf": "^2.12.0",
     "@modelcontextprotocol/sdk": "^1",
+    "@napi-rs/keyring": "1.3.0",
     "bun": "1.3.14",
     "zod": "4.4.3"
   },
diff --git a/src/cli/account-api.ts b/src/cli/account-api.ts
index 03708512d..4d81b67ed 100644
--- a/src/cli/account-api.ts
+++ b/src/cli/account-api.ts
@@ -35,6 +35,8 @@ export interface AccountDeps {
   loadConfigImpl?: () => OcxConfig;
   stdinImpl?: AccountStdin;
   stdinTimeoutMs?: number;
+  /** Test/platform injection for the official Codex login in a restricted staging home. */
+  runCodexLoginImpl?: (codexHome: string) => Promise<number>;
 }
 
 export function classifyAccount(config: OcxConfig, name: string): ClassifyResult {
diff --git a/src/cli/account-main.ts b/src/cli/account-main.ts
new file mode 100644
index 000000000..c67555d04
--- /dev/null
+++ b/src/cli/account-main.ts
@@ -0,0 +1,144 @@
+import { isAbsolute } from "node:path";
+import { apiError, apiJson, proxyUnreachable, resolveBaseUrl, type AccountDeps } from "./account-api";
+
+const USAGE = `Usage:
+  ocx account main doctor [--json]
+  ocx account main list [--json]
+  ocx account main register <label> [--json]
+  ocx account main add <label>
+  ocx account main switch <profile-id-or-label> --yes [--json]
+  ocx account main recover [--rollback --yes] [--json]
+
+Native main login profiles change the physical Codex App/CLI login in the effective CODEX_HOME.
+They are independent from the OpenCodex Pool selected by 'ocx account use openai'.`;
+
+interface PublicProfile {
+  id: string;
+  label: string;
+  identityHint: string;
+  state: "active" | "inactive";
+}
+
+function flag(args: string[], name: string): boolean {
+  const index = args.indexOf(name);
+  if (index < 0) return false;
+  args.splice(index, 1);
+  return true;
+}
+
+function reject(args: string[]): number {
+  if (args.length > 0) console.error(`Unexpected argument(s): ${args.join(", ")}`);
+  console.error(USAGE);
+  return 1;
+}
+
+function printProfiles(profiles: PublicProfile[]): void {
+  if (profiles.length === 0) { console.log("No native main login profiles registered."); return; }
+  const rows = profiles.map(profile => [profile.state === "active" ? "*" : " ", profile.label, profile.id, profile.identityHint]);
+  const header = ["", "LABEL", "PROFILE ID", "IDENTITY"];
+  const widths = header.map((value, index) => Math.max(value.length, ...rows.map(row => row[index]!.length)));
+  const line = (columns: string[]) => columns.map((value, index) => value.padEnd(widths[index]!)).join("  ").trimEnd();
+  console.log([line(header), ...rows.map(line)].join("\n"));
+}
+
+async function runOfficialCodexLogin(codexHome: string): Promise<number> {
+  const child = Bun.spawn(["codex", "login"], {
+    env: { ...process.env, CODEX_HOME: codexHome },
+    stdin: "inherit",
+    stdout: "inherit",
+    stderr: "inherit",
+  });
+  return child.exited;
+}
+
+export async function cmdNativeMainAccount(args: string[], deps: AccountDeps): Promise<number> {
+  const sub = args.shift();
+  const wantsJson = flag(args, "--json");
+  const confirmed = flag(args, "--yes");
+  const rollback = flag(args, "--rollback");
+  const baseUrl = await resolveBaseUrl(deps);
+  if (!baseUrl) return proxyUnreachable();
+
+  if (sub === "doctor" || sub === "list") {
+    if (args.length > 0 || confirmed || rollback) return reject(args);
+    const path = sub === "doctor" ? "/api/native-main-profiles/doctor" : "/api/native-main-profiles";
+    const result = await apiJson(deps, baseUrl, "GET", path);
+    if (result.status === 0) return proxyUnreachable();
+    if (result.status !== 200) return apiError(result.json, `failed to ${sub} native profiles`);
+    if (wantsJson || sub === "doctor") console.log(JSON.stringify(result.json, null, 2));
+    else printProfiles(Array.isArray(result.json.profiles) ? result.json.profiles as PublicProfile[] : []);
+    return 0;
+  }
+
+  if (sub === "register") {
+    const label = args.shift();
+    if (!label || args.length > 0 || confirmed || rollback) return reject(args);
+    const result = await apiJson(deps, baseUrl, "POST", "/api/native-main-profiles/register", { label });
+    if (result.status === 0) return proxyUnreachable();
+    if (result.status !== 200) return apiError(result.json, "failed to register the current native login");
+    if (wantsJson) console.log(JSON.stringify(result.json, null, 2));
+    else console.log(`Registered '${label}' for ${String(result.json.effectiveCodexHome ?? "the effective CODEX_HOME")}.`);
+    return 0;
+  }
+
+  if (sub === "add") {
+    const label = args.shift();
+    if (!label || args.length > 0 || wantsJson || confirmed || rollback) return reject(args);
+    const stage = await apiJson(deps, baseUrl, "POST", "/api/native-main-profiles/stage", {});
+    if (stage.status === 0) return proxyUnreachable();
+    if (stage.status !== 200) return apiError(stage.json, "failed to prepare native login staging");
+    const stageId = typeof stage.json.stageId === "string" ? stage.json.stageId : "";
+    const stagingHome = typeof stage.json.stagingCodexHome === "string" ? stage.json.stagingCodexHome : "";
+    if (!stageId || !isAbsolute(stagingHome)) {
+      console.error("Error: the proxy returned an invalid staging session.");
+      return 1;
+    }
+    let exitCode = 1;
+    try {
+      console.error(`Starting official Codex login in restricted staging home: ${stagingHome}`);
+      exitCode = await (deps.runCodexLoginImpl ?? runOfficialCodexLogin)(stagingHome);
+      if (exitCode !== 0) throw new Error("Official Codex login did not complete successfully.");
+      const finish = await apiJson(deps, baseUrl, "POST", "/api/native-main-profiles/stage/finish", { stageId, label });
+      if (finish.status === 0) return proxyUnreachable();
+      if (finish.status !== 200) return apiError(finish.json, "failed to encrypt the staged native login");
+      console.log(`Added encrypted native profile '${label}'.`);
+      return 0;
+    } catch (error) {
+      await apiJson(deps, baseUrl, "POST", "/api/native-main-profiles/stage/cancel", { stageId });
+      console.error(`Error: ${error instanceof Error ? error.message : "Official Codex login failed."}`);
+      return exitCode === 0 ? 1 : exitCode;
+    }
+  }
+
+  if (sub === "switch") {
+    const target = args.shift();
+    if (!target || args.length > 0 || rollback || !confirmed) {
+      if (!confirmed) console.error("Close Codex App/CLI, then pass --yes to confirm it is stopped.");
+      return reject(args);
+    }
+    const result = await apiJson(deps, baseUrl, "POST", "/api/native-main-profiles/switch", { target, confirmedStopped: true });
+    if (result.status === 0) return proxyUnreachable();
+    if (result.status !== 200) return apiError(result.json, "failed to switch the native login");
+    if (wantsJson) console.log(JSON.stringify(result.json, null, 2));
+    else {
+      const profile = result.json.activeProfile as PublicProfile | undefined;
+      console.log(`Native Codex login is now '${profile?.label ?? target}'. Restart Codex App/CLI before continuing.`);
+    }
+    return 0;
+  }
+
+  if (sub === "recover") {
+    if (args.length > 0 || (rollback && !confirmed)) {
+      if (rollback && !confirmed) console.error("--rollback changes the native login and requires --yes.");
+      return reject(args);
+    }
+    const result = await apiJson(deps, baseUrl, "POST", "/api/native-main-profiles/recover", { rollback });
+    if (result.status === 0) return proxyUnreachable();
+    if (result.status !== 200) return apiError(result.json, "failed to recover the native-profile transaction");
+    if (wantsJson) console.log(JSON.stringify(result.json, null, 2));
+    else console.log(result.json.recovered === true ? `Recovery completed: ${String(result.json.action ?? "converged")}.` : "No recovery journal is pending.");
+    return 0;
+  }
+
+  return reject(args);
+}
diff --git a/src/cli/account.ts b/src/cli/account.ts
index a237c4c32..d9bc38687 100644
--- a/src/cli/account.ts
+++ b/src/cli/account.ts
@@ -29,6 +29,7 @@ const ACCOUNT_USAGE = `Usage:
   ocx account code <provider> [--flow <flow-id>] [--json]   (reads the code from stdin)
   ocx account cancel <provider> [--flow <flow-id>] [--json]
   ocx account reset-credits <account-id|main> [--consume --yes] [--json]
+  ocx account main <doctor|list|register|add|switch|recover> ...
 
 List and switch provider accounts and API-key pools (masked output only).
 'main' selects the Codex App login for the openai account pool.`;
@@ -262,6 +263,10 @@ export async function cmdAccount(args: string[], deps: AccountDeps = {}): Promis
     if (sub === "remove") return await cmdRemove(rest, deps);
     if (sub === "clear-cooldown") return await cmdClearCooldown(rest, deps);
     if (sub === "add-key") return await cmdAddKey(rest, deps);
+    if (sub === "main") {
+      const { cmdNativeMainAccount } = await import("./account-main");
+      return await cmdNativeMainAccount(rest, deps);
+    }
     if (["login", "reauth", "code", "cancel", "reset-credits"].includes(sub ?? "")) {
       const { handleAccountAuthCommand } = await import("./account-auth");
       return await handleAccountAuthCommand(sub!, rest, deps) ?? 1;
diff --git a/src/cli/help.ts b/src/cli/help.ts
index 2c1964478..c74ba6475 100644
--- a/src/cli/help.ts
+++ b/src/cli/help.ts
@@ -110,7 +110,7 @@ const helpEntries: Record<string, HelpEntry> = {
     ],
   },
   account: {
-    usage: "ocx account <list|current|use|refresh|auto-switch|login|reauth|code|cancel|remove|add-key|reset-credits> ...",
+    usage: "ocx account <list|current|use|refresh|auto-switch|login|reauth|code|cancel|remove|add-key|reset-credits|main> ...",
     summary: "List and switch provider accounts and API-key pools (GUI parity).",
     details: [
       "list [provider]     Codex account pool, OAuth accounts and API keys (identifiers shown masked as the API returns them).",
@@ -122,6 +122,7 @@ const helpEntries: Record<string, HelpEntry> = {
       "add-key <provider> [--label <label>]  Add a key read only from piped stdin.",
       "login/reauth/code/cancel  Run browser or manual-code auth from a headless shell.",
       "reset-credits <id|main> [--consume --yes]  Inspect or consume Codex reset credits.",
+      "main <subcommand>     Manage the physical native Codex login separately from Pool routing.",
       "Codex pool selection applies to the next request after clearing existing affinity; in-flight requests keep their captured account.",
     ],
   },
diff --git a/src/codex/account-lifecycle.ts b/src/codex/account-lifecycle.ts
index 35831af55..870962426 100644
--- a/src/codex/account-lifecycle.ts
+++ b/src/codex/account-lifecycle.ts
@@ -40,6 +40,25 @@ export function reconcileMainCodexAccountRuntimeState(): boolean {
   return true;
 }
 
+/**
+ * Apply a transaction-confirmed physical native-login change without waiting for
+ * a later auth.json observation. The caller owns credential commit/rollback.
+ */
+export function applyConfirmedMainCodexAccountTransition(
+  fromAccountId: string,
+  toAccountId: string,
+): boolean {
+  if (!fromAccountId || !toAccountId || fromAccountId === toAccountId) {
+    if (toAccountId) observedMainChatgptAccountId = toAccountId;
+    return false;
+  }
+  observedMainChatgptAccountId = toAccountId;
+  purgeCodexAccountRuntimeState(MAIN_CODEX_ACCOUNT_ID);
+  setMainAccountPlan(null);
+  invalidateCodexWebSocketsForAccount(MAIN_CODEX_ACCOUNT_ID);
+  return true;
+}
+
 export function resetMainCodexAccountIdentityTrackingForTests(): void {
   observedMainChatgptAccountId = undefined;
 }
diff --git a/src/codex/native-profile-api.ts b/src/codex/native-profile-api.ts
new file mode 100644
index 000000000..e0c02553b
--- /dev/null
+++ b/src/codex/native-profile-api.ts
@@ -0,0 +1,100 @@
+import type { OcxConfig } from "../types";
+import { jsonResponse } from "../server/auth-cors";
+import { getActiveTurnCount, isDraining, setDraining } from "../server/lifecycle";
+import { NativeProfileManager } from "./native-profile-manager";
+import { NativeProfileError } from "./native-profile-types";
+
+export interface NativeProfileApiDeps {
+  manager?: NativeProfileManager;
+  drainTimeoutMs?: number;
+  sleep?: (ms: number) => Promise<void>;
+}
+
+async function body(req: Request): Promise<Record<string, unknown>> {
+  try {
+    const parsed = await req.json();
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("body");
+    return parsed as Record<string, unknown>;
+  } catch {
+    throw new NativeProfileError("INVALID_REQUEST", "A JSON object body is required.", 400);
+  }
+}
+
+async function withMainRequestDrain<T>(deps: NativeProfileApiDeps, operation: () => Promise<T>): Promise<T> {
+  if (isDraining()) throw new NativeProfileError("MAIN_REQUESTS_ACTIVE", "The proxy is already draining requests.", 503, true);
+  setDraining(true);
+  try {
+    const deadline = Date.now() + (deps.drainTimeoutMs ?? 10_000);
+    while (getActiveTurnCount() > 0 && Date.now() < deadline) await (deps.sleep ?? Bun.sleep)(50);
+    if (getActiveTurnCount() > 0) {
+      throw new NativeProfileError("MAIN_REQUESTS_ACTIVE", "In-flight requests did not finish before the native-login switch deadline.", 409, true);
+    }
+    return await operation();
+  } finally {
+    setDraining(false);
+  }
+}
+
+export async function handleNativeProfileAPI(
+  req: Request,
+  url: URL,
+  config: OcxConfig,
+  deps: NativeProfileApiDeps = {},
+): Promise<Response | null> {
+  if (!url.pathname.startsWith("/api/native-main-profiles")) return null;
+  try {
+    const manager = deps.manager ?? new NativeProfileManager();
+    if (url.pathname === "/api/native-main-profiles" && req.method === "GET") {
+      return jsonResponse(await manager.list(), 200, req, config);
+    }
+    if (url.pathname === "/api/native-main-profiles/doctor" && req.method === "GET") {
+      return jsonResponse(await manager.doctor(), 200, req, config);
+    }
+    if (url.pathname === "/api/native-main-profiles/register" && req.method === "POST") {
+      const input = await body(req);
+      if (typeof input.label !== "string") throw new NativeProfileError("INVALID_REQUEST", "A profile label is required.", 400);
+      return jsonResponse(await manager.register(input.label), 200, req, config);
+    }
+    if (url.pathname === "/api/native-main-profiles/stage" && req.method === "POST") {
+      return jsonResponse(await manager.prepareStage(), 200, req, config);
+    }
+    if (url.pathname === "/api/native-main-profiles/stage/finish" && req.method === "POST") {
+      const input = await body(req);
+      if (typeof input.stageId !== "string" || typeof input.label !== "string") {
+        throw new NativeProfileError("INVALID_REQUEST", "A staging identifier and profile label are required.", 400);
+      }
+      return jsonResponse(await manager.finishStage(input.stageId, input.label), 200, req, config);
+    }
+    if (url.pathname === "/api/native-main-profiles/stage/cancel" && req.method === "POST") {
+      const input = await body(req);
+      if (typeof input.stageId !== "string") throw new NativeProfileError("INVALID_REQUEST", "A staging identifier is required.", 400);
+      await manager.cancelStage(input.stageId);
+      return jsonResponse({ ok: true }, 200, req, config);
+    }
+    if (url.pathname === "/api/native-main-profiles/switch" && req.method === "POST") {
+      const input = await body(req);
+      if (typeof input.target !== "string") throw new NativeProfileError("INVALID_REQUEST", "A target profile is required.", 400);
+      return jsonResponse(
+        await withMainRequestDrain(deps, () => manager.switch(input.target as string, input.confirmedStopped === true)),
+        200,
+        req,
+        config,
+      );
+    }
+    if (url.pathname === "/api/native-main-profiles/recover" && req.method === "POST") {
+      const input = await body(req);
+      return jsonResponse(
+        await withMainRequestDrain(deps, () => manager.recover(input.rollback === true)),
+        200,
+        req,
+        config,
+      );
+    }
+    return jsonResponse({ error: "Unknown native-profile operation", code: "INVALID_REQUEST" }, 404, req, config);
+  } catch (error) {
+    if (error instanceof NativeProfileError) {
+      return jsonResponse({ error: error.message, code: error.code, retryable: error.retryable }, error.status, req, config);
+    }
+    return jsonResponse({ error: "Native-profile operation failed without changing or exposing credential data", code: "RECOVERY_REQUIRED" }, 500, req, config);
+  }
+}
diff --git a/src/codex/native-profile-manager.ts b/src/codex/native-profile-manager.ts
new file mode 100644
index 000000000..01a27b34a
--- /dev/null
+++ b/src/codex/native-profile-manager.ts
@@ -0,0 +1,601 @@
+import { randomUUID } from "node:crypto";
+import {
+  chmodSync,
+  closeSync,
+  existsSync,
+  lstatSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  realpathSync,
+  rmSync,
+  statSync,
+  truncateSync,
+  unlinkSync,
+  writeFileSync,
+} from "node:fs";
+import { dirname, join, relative, resolve, sep } from "node:path";
+import { atomicWriteFileAsync } from "../config";
+import { hardenSecretPathAsync } from "../lib/windows-secret-acl";
+import { applyConfirmedMainCodexAccountTransition } from "./account-lifecycle";
+import { decideNativeProfileRecovery } from "./native-profile-recovery";
+import { probeNativeCodexProcesses, type NativeCodexProcessProbe } from "./native-profile-processes";
+import {
+  assertUniqueNativeProfileLabel,
+  decryptNativeEnvelope,
+  encryptNativeEnvelope,
+  nativeIdentityHash,
+  nativeIdentityHint,
+  OsNativeProfileKeyProvider,
+  publicNativeProfile,
+  readNativeEnvelope,
+  readNativeEnvelopeResult,
+  readNativeProfileJournal,
+  readNativeProfileVault,
+  requireFileCredentialStore,
+  resolveNativeCredentialStoreMode,
+  resolveNativeProfileContext,
+  serializeNativeProfileMetadata,
+  validateNativeProfileLabel,
+  type NativeEnvelopeSnapshot,
+  type NativeProfileContext,
+} from "./native-profile-store";
+import {
+  NativeProfileError,
+  type NativeMainProfileRecordV1,
+  type NativeMainProfileVaultV1,
+  type NativeProfileKey,
+  type NativeProfileKeyProvider,
+  type NativeProfilePublic,
+  type NativeProfileSwitchJournalV1,
+} from "./native-profile-types";
+
+const LOCK_WAIT_MS = 5_000;
+const LOCK_STALE_MS = 10 * 60_000;
+const STAGE_MAX_AGE_MS = 30 * 60_000;
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+
+type AtomicWriter = (path: string, content: string) => Promise<void>;
+type TransitionApplier = (fromAccountId: string, toAccountId: string) => void;
+
+export interface NativeProfileManagerOptions {
+  codexHome?: string;
+  configDir?: string;
+  keyProvider?: NativeProfileKeyProvider;
+  atomicWrite?: AtomicWriter;
+  hardenPath?: (path: string) => Promise<void>;
+  processProbe?: () => Promise<NativeCodexProcessProbe>;
+  applyTransition?: TransitionApplier;
+  now?: () => number;
+  randomUUID?: () => string;
+  sleep?: (ms: number) => Promise<void>;
+}
+
+export interface NativeProfileListResult {
+  effectiveCodexHome: string;
+  activeProfileId: string | null;
+  profiles: NativeProfilePublic[];
+}
+
+async function hardenNativeProfilePath(path: string): Promise<void> {
+  const mode = statSync(path).isDirectory() ? 0o700 : 0o600;
+  try { chmodSync(path, mode); } catch { /* Windows ACL below is authoritative there. */ }
+  if (process.platform === "win32") {
+    await hardenSecretPathAsync(path, { required: true, timeoutMemoKey: path });
+  }
+}
+
+function errorCode(error: unknown): string | undefined {
+  return error && typeof error === "object" && "code" in error ? String((error as { code?: unknown }).code) : undefined;
+}
+
+function processAlive(pid: number): boolean {
+  try { process.kill(pid, 0); return true; } catch { return false; }
+}
+
+export class NativeProfileManager {
+  readonly context: NativeProfileContext;
+  private readonly keyProvider: NativeProfileKeyProvider;
+  private readonly atomicWrite: AtomicWriter;
+  private readonly hardenPath: (path: string) => Promise<void>;
+  private readonly processProbe: () => Promise<NativeCodexProcessProbe>;
+  private readonly applyTransition: TransitionApplier;
+  private readonly now: () => number;
+  private readonly uuid: () => string;
+  private readonly sleep: (ms: number) => Promise<void>;
+
+  constructor(options: NativeProfileManagerOptions = {}) {
+    this.context = resolveNativeProfileContext(options);
+    this.keyProvider = options.keyProvider ?? new OsNativeProfileKeyProvider();
+    this.atomicWrite = options.atomicWrite ?? atomicWriteFileAsync;
+    this.hardenPath = options.hardenPath ?? hardenNativeProfilePath;
+    this.processProbe = options.processProbe ?? probeNativeCodexProcesses;
+    this.applyTransition = options.applyTransition ?? ((from, to) => { applyConfirmedMainCodexAccountTransition(from, to); });
+    this.now = options.now ?? Date.now;
+    this.uuid = options.randomUUID ?? randomUUID;
+    this.sleep = options.sleep ?? (ms => Bun.sleep(ms));
+  }
+
+  private async ensureRoot(): Promise<void> {
+    if (!existsSync(this.context.rootDir)) mkdirSync(this.context.rootDir, { recursive: true, mode: 0o700 });
+    await this.hardenPath(this.context.rootDir);
+  }
+
+  private isLockStale(): boolean {
+    try {
+      const lock = JSON.parse(readFileSync(this.context.lockPath, "utf8")) as { pid?: unknown; acquiredAt?: unknown };
+      if (typeof lock.pid === "number" && processAlive(lock.pid)) return false;
+      return typeof lock.acquiredAt !== "number" || this.now() - lock.acquiredAt > LOCK_STALE_MS;
+    } catch {
+      return true;
+    }
+  }
+
+  private async withLock<T>(operation: () => Promise<T>): Promise<T> {
+    await this.ensureRoot();
+    const deadline = this.now() + LOCK_WAIT_MS;
+    let fd: number | null = null;
+    while (fd === null) {
+      try {
+        fd = openSync(this.context.lockPath, "wx", 0o600);
+        writeFileSync(fd, serializeNativeProfileMetadata({ pid: process.pid, acquiredAt: this.now(), homeId: this.context.homeId }));
+        await this.hardenPath(this.context.lockPath);
+      } catch (error) {
+        if (fd !== null) {
+          closeSync(fd);
+          fd = null;
+          try { unlinkSync(this.context.lockPath); } catch { /* reported below */ }
+          throw new NativeProfileError("PROFILE_LOCK_UNAVAILABLE", "The native-profile lock could not be secured.", 503, true);
+        }
+        if (errorCode(error) !== "EEXIST") {
+          throw new NativeProfileError("PROFILE_LOCK_UNAVAILABLE", "The native-profile lock is unavailable.", 503, true);
+        }
+        if (this.isLockStale()) {
+          try { unlinkSync(this.context.lockPath); } catch (unlinkError) { if (errorCode(unlinkError) !== "ENOENT") throw unlinkError; }
+          continue;
+        }
+        if (this.now() >= deadline) {
+          throw new NativeProfileError("PROFILE_LOCK_UNAVAILABLE", "Another native-profile operation is still running.", 503, true);
+        }
+        await this.sleep(50);
+      }
+    }
+    try {
+      return await operation();
+    } finally {
+      closeSync(fd);
+      try { unlinkSync(this.context.lockPath); } catch (error) { if (errorCode(error) !== "ENOENT") throw error; }
+    }
+  }
+
+  private async keyForVault(vault: NativeMainProfileVaultV1 | null): Promise<NativeProfileKey> {
+    const existing = await this.keyProvider.get(this.context.homeId);
+    if (existing) return existing;
+    if (vault) {
+      throw new NativeProfileError("KEYRING_KEY_MISSING", "The OS credential-store key for this vault is missing.", 409);
+    }
+    return this.keyProvider.create(this.context.homeId);
+  }
+
+  private async writeVault(vault: NativeMainProfileVaultV1): Promise<void> {
+    await this.atomicWrite(this.context.vaultPath, serializeNativeProfileMetadata(vault));
+  }
+
+  private async writeJournal(journal: NativeProfileSwitchJournalV1): Promise<void> {
+    await this.atomicWrite(this.context.journalPath, serializeNativeProfileMetadata(journal));
+  }
+
+  private removeJournal(): void {
+    try { unlinkSync(this.context.journalPath); } catch (error) { if (errorCode(error) !== "ENOENT") throw error; }
+  }
+
+  private requireVault(): NativeMainProfileVaultV1 {
+    const vault = readNativeProfileVault(this.context);
+    if (!vault) throw new NativeProfileError("PROFILE_NOT_FOUND", "Register the current native login before adding or switching profiles.", 404);
+    return vault;
+  }
+
+  private currentProfile(vault: NativeMainProfileVaultV1): NativeMainProfileRecordV1 {
+    const profile = vault.profiles.find(item => item.id === vault.activeProfileId && item.state === "active");
+    if (!profile) throw new NativeProfileError("VAULT_INVALID", "The native-profile vault has no active owner.", 409);
+    return profile;
+  }
+
+  private assertCurrentIdentity(vault: NativeMainProfileVaultV1, envelope: NativeEnvelopeSnapshot, key: NativeProfileKey): NativeMainProfileRecordV1 {
+    const active = this.currentProfile(vault);
+    if (nativeIdentityHash(key.key, envelope.accountId) !== active.identityHash) {
+      throw new NativeProfileError(
+        "ACTIVE_PROFILE_MISMATCH",
+        "The physical native login changed outside OpenCodex; recover or register the expected login before continuing.",
+        409,
+      );
+    }
+    return active;
+  }
+
+  async register(labelInput: string): Promise<{ effectiveCodexHome: string; profile: NativeProfilePublic }> {
+    return this.withLock(async () => {
+      requireFileCredentialStore(this.context);
+      const label = validateNativeProfileLabel(labelInput);
+      const envelope = readNativeEnvelope(this.context.authPath);
+      let vault = readNativeProfileVault(this.context);
+      const key = await this.keyForVault(vault);
+      try {
+        const identityHash = nativeIdentityHash(key.key, envelope.accountId);
+        const timestamp = new Date(this.now()).toISOString();
+        if (!vault) {
+          const id = this.uuid();
+          vault = {
+            version: 1,
+            revision: 1,
+            homeId: this.context.homeId,
+            activeProfileId: id,
+            profiles: [{
+              id,
+              label,
+              identityHash,
+              identityHint: nativeIdentityHint(identityHash),
+              state: "active",
+              payload: null,
+              createdAt: timestamp,
+              updatedAt: timestamp,
+            }],
+          };
+        } else {
+          const active = this.assertCurrentIdentity(vault, envelope, key);
+          assertUniqueNativeProfileLabel(vault, label, active.id);
+          active.label = label;
+          active.updatedAt = timestamp;
+          vault.revision += 1;
+        }
+        await this.writeVault(vault);
+        return { effectiveCodexHome: this.context.codexHome, profile: publicNativeProfile(this.currentProfile(vault)) };
+      } finally {
+        envelope.raw.fill(0);
+        key.key.fill(0);
+      }
+    });
+  }
+
+  async list(): Promise<NativeProfileListResult> {
+    const vault = readNativeProfileVault(this.context);
+    return {
+      effectiveCodexHome: this.context.codexHome,
+      activeProfileId: vault?.activeProfileId ?? null,
+      profiles: vault?.profiles.map(publicNativeProfile) ?? [],
+    };
+  }
+
+  async doctor(): Promise<Record<string, unknown>> {
+    const mode = (() => {
+      try { return resolveNativeCredentialStoreMode(this.context); } catch { return "unknown"; }
+    })();
+    const auth = readNativeEnvelopeResult(this.context.authPath);
+    const vault = readNativeProfileVault(this.context);
+    let keyStore: "available" | "missing-key" | "unavailable" = "available";
+    try {
+      const key = await this.keyProvider.get(this.context.homeId);
+      if (vault && !key) keyStore = "missing-key";
+      if (key) key.key.fill(0);
+    } catch {
+      keyStore = "unavailable";
+    }
+    let stagingCount = 0;
+    try {
+      if (existsSync(this.context.stagingRoot)) {
+        stagingCount = Array.from(new Bun.Glob("*").scanSync({ cwd: this.context.stagingRoot, onlyFiles: false })).length;
+      }
+    } catch { stagingCount = 0; }
+    return {
+      effectiveCodexHome: this.context.codexHome,
+      credentialStoreMode: mode,
+      supported: mode === "file",
+      authStatus: auth.status,
+      keyStore,
+      profileCount: vault?.profiles.length ?? 0,
+      activeProfileId: vault?.activeProfileId ?? null,
+      recoveryPending: existsSync(this.context.journalPath),
+      stagingCount,
+    };
+  }
+
+  private stagePath(stageId: string): string {
+    if (!UUID_RE.test(stageId)) throw new NativeProfileError("INVALID_REQUEST", "The staging identifier is invalid.", 400);
+    return join(this.context.stagingRoot, stageId);
+  }
+
+  private verifiedStagePath(stageId: string): string {
+    const expected = resolve(this.stagePath(stageId));
+    try {
+      if (lstatSync(expected).isSymbolicLink() || !lstatSync(expected).isDirectory()) throw new Error("stage type");
+      const canonicalRoot = resolve(realpathSync.native(this.context.stagingRoot));
+      const canonicalExpected = resolve(realpathSync.native(expected));
+      const rel = relative(canonicalRoot, canonicalExpected);
+      if (!rel || rel.startsWith("..") || rel.includes(sep)) throw new Error("stage root");
+      const metadata = JSON.parse(readFileSync(join(canonicalExpected, "stage.json"), "utf8")) as Record<string, unknown>;
+      if (metadata.version !== 1 || metadata.stageId !== stageId || metadata.homeId !== this.context.homeId) throw new Error("stage metadata");
+      if (typeof metadata.createdAt !== "number" || this.now() - metadata.createdAt > STAGE_MAX_AGE_MS) throw new Error("stage age");
+      return canonicalExpected;
+    } catch {
+      throw new NativeProfileError("STAGING_NOT_FOUND", "The native-login staging session is missing, expired, or invalid.", 404);
+    }
+  }
+
+  private deleteStage(path: string): void {
+    const authPath = join(path, "auth.json");
+    if (existsSync(authPath)) truncateSync(authPath, 0);
+    rmSync(path, { recursive: true, force: false });
+  }
+
+  async prepareStage(): Promise<{ stageId: string; stagingCodexHome: string; effectiveCodexHome: string }> {
+    return this.withLock(async () => {
+      requireFileCredentialStore(this.context);
+      const vault = this.requireVault();
+      const key = await this.keyForVault(vault);
+      const current = readNativeEnvelope(this.context.authPath);
+      try { this.assertCurrentIdentity(vault, current, key); } finally { current.raw.fill(0); key.key.fill(0); }
+      if (!existsSync(this.context.stagingRoot)) mkdirSync(this.context.stagingRoot, { recursive: true, mode: 0o700 });
+      await this.hardenPath(dirname(this.context.stagingRoot));
+      await this.hardenPath(this.context.stagingRoot);
+      const stageId = this.uuid();
+      const path = this.stagePath(stageId);
+      mkdirSync(path, { mode: 0o700 });
+      try {
+        await this.hardenPath(path);
+        writeFileSync(join(path, "config.toml"), 'cli_auth_credentials_store = "file"\n', { mode: 0o600 });
+        await this.hardenPath(join(path, "config.toml"));
+        writeFileSync(join(path, "stage.json"), serializeNativeProfileMetadata({ version: 1, stageId, homeId: this.context.homeId, createdAt: this.now() }), { mode: 0o600 });
+        await this.hardenPath(join(path, "stage.json"));
+      } catch (error) {
+        try { rmSync(path, { recursive: true, force: true }); } catch { /* original error wins */ }
+        throw error;
+      }
+      return { stageId, stagingCodexHome: path, effectiveCodexHome: this.context.codexHome };
+    });
+  }
+
+  async finishStage(stageId: string, labelInput: string): Promise<{ effectiveCodexHome: string; profile: NativeProfilePublic }> {
+    return this.withLock(async () => {
+      requireFileCredentialStore(this.context);
+      const label = validateNativeProfileLabel(labelInput);
+      const stagePath = this.verifiedStagePath(stageId);
+      const target = readNativeEnvelope(join(stagePath, "auth.json"));
+      const current = readNativeEnvelope(this.context.authPath);
+      const vault = this.requireVault();
+      const key = await this.keyForVault(vault);
+      try {
+        this.assertCurrentIdentity(vault, current, key);
+        assertUniqueNativeProfileLabel(vault, label);
+        const identityHash = nativeIdentityHash(key.key, target.accountId);
+        if (vault.profiles.some(profile => profile.identityHash === identityHash)) {
+          throw new NativeProfileError("PROFILE_ALREADY_EXISTS", "That native identity is already registered.", 409);
+        }
+        const timestamp = new Date(this.now()).toISOString();
+        const id = this.uuid();
+        const profile: NativeMainProfileRecordV1 = {
+          id,
+          label,
+          identityHash,
+          identityHint: nativeIdentityHint(identityHash),
+          state: "inactive",
+          payload: encryptNativeEnvelope(this.context, id, identityHash, target, key),
+          createdAt: timestamp,
+          updatedAt: timestamp,
+        };
+        vault.profiles.push(profile);
+        vault.revision += 1;
+        await this.writeVault(vault);
+        try {
+          this.deleteStage(stagePath);
+        } catch {
+          throw new NativeProfileError(
+            "STAGING_CLEANUP_REQUIRED",
+            "The profile was encrypted, but the restricted staging credential could not be removed; run recover after fixing filesystem permissions.",
+            500,
+          );
+        }
+        return { effectiveCodexHome: this.context.codexHome, profile: publicNativeProfile(profile) };
+      } finally {
+        target.raw.fill(0);
+        current.raw.fill(0);
+        key.key.fill(0);
+      }
+    });
+  }
+
+  async cancelStage(stageId: string): Promise<void> {
+    await this.withLock(async () => { this.deleteStage(this.verifiedStagePath(stageId)); });
+  }
+
+  private resolveTarget(vault: NativeMainProfileVaultV1, target: string): NativeMainProfileRecordV1 {
+    const normalized = target.trim().toLowerCase();
+    const profile = vault.profiles.find(item => item.id.toLowerCase() === normalized || item.label.toLowerCase() === normalized);
+    if (!profile) throw new NativeProfileError("PROFILE_NOT_FOUND", "The requested native profile does not exist.", 404);
+    if (profile.state !== "inactive" || !profile.payload) {
+      throw new NativeProfileError("INVALID_REQUEST", "The requested native profile is already active.", 400);
+    }
+    return profile;
+  }
+
+  private verifyWrittenEnvelope(expectedDigest: string, expectedIdentityHash: string, key: NativeProfileKey): NativeEnvelopeSnapshot {
+    const observed = readNativeEnvelope(this.context.authPath);
+    if (observed.digest !== expectedDigest || nativeIdentityHash(key.key, observed.accountId) !== expectedIdentityHash) {
+      observed.raw.fill(0);
+      throw new Error("auth read-back mismatch");
+    }
+    return observed;
+  }
+
+  async switch(targetSelector: string, confirmedStopped = false): Promise<Record<string, unknown>> {
+    return this.withLock(async () => {
+      requireFileCredentialStore(this.context);
+      const processState = await this.processProbe();
+      if (processState.status === "busy") {
+        throw new NativeProfileError("CODEX_BUSY", `Close the ${processState.count} detected native Codex process(es) before switching.`, 409);
+      }
+      if (processState.status === "unknown" && !confirmedStopped) {
+        throw new NativeProfileError("CODEX_PROCESS_CHECK_UNAVAILABLE", "Codex process state could not be confirmed; close Codex and retry with explicit confirmation.", 409);
+      }
+      if (readNativeProfileJournal(this.context)) await this.recoverLocked(false);
+      const beforeVault = this.requireVault();
+      const key = await this.keyForVault(beforeVault);
+      const source = readNativeEnvelope(this.context.authPath);
+      let target: NativeEnvelopeSnapshot | null = null;
+      let journalPrepared = false;
+      let committed = false;
+      try {
+        const sourceProfile = this.assertCurrentIdentity(beforeVault, source, key);
+        const targetProfile = this.resolveTarget(beforeVault, targetSelector);
+        target = decryptNativeEnvelope(this.context, targetProfile.id, targetProfile.identityHash, targetProfile.payload!, key);
+        if (nativeIdentityHash(key.key, target.accountId) !== targetProfile.identityHash) {
+          throw new NativeProfileError("PROFILE_DECRYPT_FAILED", "The selected native profile identity does not match its encrypted record.", 409);
+        }
+        const timestamp = new Date(this.now()).toISOString();
+        const sourcePayload = encryptNativeEnvelope(this.context, sourceProfile.id, sourceProfile.identityHash, source, key);
+        const afterVault = structuredClone(beforeVault);
+        const nextSource = afterVault.profiles.find(profile => profile.id === sourceProfile.id)!;
+        const nextTarget = afterVault.profiles.find(profile => profile.id === targetProfile.id)!;
+        nextSource.state = "inactive";
+        nextSource.payload = sourcePayload;
+        nextSource.updatedAt = timestamp;
+        nextTarget.state = "active";
+        nextTarget.payload = null;
+        nextTarget.updatedAt = timestamp;
+        afterVault.activeProfileId = nextTarget.id;
+        afterVault.revision += 1;
+        const journal: NativeProfileSwitchJournalV1 = {
+          version: 1,
+          transactionId: this.uuid(),
+          homeId: this.context.homeId,
+          phase: "prepared",
+          sourceProfileId: sourceProfile.id,
+          sourceIdentityHash: sourceProfile.identityHash,
+          sourcePayload,
+          targetProfileId: targetProfile.id,
+          targetIdentityHash: targetProfile.identityHash,
+          targetPayload: targetProfile.payload!,
+          beforeVault: structuredClone(beforeVault),
+          afterVault,
+          createdAt: timestamp,
+        };
+        await this.writeJournal(journal);
+        journalPrepared = true;
+        await this.atomicWrite(this.context.authPath, target.text);
+        const observedTarget = this.verifyWrittenEnvelope(target.digest, targetProfile.identityHash, key);
+        observedTarget.raw.fill(0);
+        journal.phase = "auth-replaced";
+        await this.writeJournal(journal);
+        await this.writeVault(afterVault);
+        committed = true;
+        journal.phase = "vault-committed";
+        await this.writeJournal(journal);
+        this.applyTransition(source.accountId, target.accountId);
+        this.removeJournal();
+        return {
+          ok: true,
+          effectiveCodexHome: this.context.codexHome,
+          activeProfile: publicNativeProfile(nextTarget),
+          restartRequired: true,
+        };
+      } catch (cause) {
+        if (!journalPrepared) throw cause;
+        if (committed) {
+          throw new NativeProfileError("RECOVERY_REQUIRED", "The login changed, but final transaction cleanup requires recovery.", 409);
+        }
+        try {
+          await this.atomicWrite(this.context.authPath, source.text);
+          const restored = this.verifyWrittenEnvelope(source.digest, nativeIdentityHash(key.key, source.accountId), key);
+          restored.raw.fill(0);
+          await this.writeVault(beforeVault);
+          this.removeJournal();
+        } catch {
+          throw new NativeProfileError(
+            "AUTH_RESTORE_FAILED",
+            "The original native login could not be verified after rollback; the encrypted recovery journal was retained.",
+            500,
+          );
+        }
+        throw new NativeProfileError("SWITCH_ROLLED_BACK", "The native-login switch failed and the exact original login was restored.", 409);
+      } finally {
+        source.raw.fill(0);
+        target?.raw.fill(0);
+        key.key.fill(0);
+      }
+    });
+  }
+
+  private async recoverLocked(rollback: boolean): Promise<Record<string, unknown>> {
+    const journal = readNativeProfileJournal(this.context);
+    if (!journal) return { ok: true, recovered: false, effectiveCodexHome: this.context.codexHome };
+    const key = await this.keyForVault(journal.beforeVault);
+    const current = readNativeEnvelopeResult(this.context.authPath);
+    if (current.status !== "ok") {
+      key.key.fill(0);
+      throw new NativeProfileError("RECOVERY_REQUIRED", "Recovery stopped because the current native login is not readable and confirmed.", 409);
+    }
+    let sourceEnvelope: NativeEnvelopeSnapshot | null = null;
+    try {
+      const currentHash = nativeIdentityHash(key.key, current.envelope.accountId);
+      if (rollback) {
+        if (currentHash === journal.sourceIdentityHash) {
+          await this.writeVault(journal.beforeVault);
+          this.removeJournal();
+          return { ok: true, recovered: true, action: "rollback-source", effectiveCodexHome: this.context.codexHome, restartRequired: false };
+        }
+        if (currentHash !== journal.targetIdentityHash) {
+          throw new NativeProfileError("RECOVERY_REQUIRED", "Recovery found a third or unknown native identity and made no credential write.", 409);
+        }
+        sourceEnvelope = decryptNativeEnvelope(
+          this.context,
+          journal.sourceProfileId,
+          journal.sourceIdentityHash,
+          journal.sourcePayload,
+          key,
+        );
+        await this.atomicWrite(this.context.authPath, sourceEnvelope.text);
+        const restored = this.verifyWrittenEnvelope(sourceEnvelope.digest, journal.sourceIdentityHash, key);
+        restored.raw.fill(0);
+        await this.writeVault(journal.beforeVault);
+        this.applyTransition(current.envelope.accountId, sourceEnvelope.accountId);
+        this.removeJournal();
+        return { ok: true, recovered: true, action: "rollback-source", effectiveCodexHome: this.context.codexHome, restartRequired: true };
+      }
+      const observation = currentHash === journal.sourceIdentityHash
+        ? { identity: "source" as const, digest: current.envelope.digest === journal.sourcePayload.envelopeSha256 ? "exact" as const : "changed" as const }
+        : currentHash === journal.targetIdentityHash
+          ? { identity: "target" as const, digest: current.envelope.digest === journal.targetPayload.envelopeSha256 ? "exact" as const : "changed" as const }
+          : { identity: "other" as const, digest: "unknown" as const };
+      const decision = decideNativeProfileRecovery(journal.phase, observation);
+      if (decision.action === "manual-recovery") {
+        throw new NativeProfileError("RECOVERY_REQUIRED", "Recovery found a third or unknown native identity and made no credential write.", 409);
+      }
+      if (decision.action === "rollback-source") {
+        await this.writeVault(journal.beforeVault);
+        this.removeJournal();
+        return { ok: true, recovered: true, action: decision.action, effectiveCodexHome: this.context.codexHome, restartRequired: false };
+      }
+      sourceEnvelope = decryptNativeEnvelope(
+        this.context,
+        journal.sourceProfileId,
+        journal.sourceIdentityHash,
+        journal.sourcePayload,
+        key,
+      );
+      await this.writeVault(journal.afterVault);
+      this.applyTransition(sourceEnvelope.accountId, current.envelope.accountId);
+      this.removeJournal();
+      return { ok: true, recovered: true, action: decision.action, effectiveCodexHome: this.context.codexHome, restartRequired: true };
+    } finally {
+      current.envelope.raw.fill(0);
+      sourceEnvelope?.raw.fill(0);
+      key.key.fill(0);
+    }
+  }
+
+  async recover(rollback = false): Promise<Record<string, unknown>> {
+    return this.withLock(async () => {
+      requireFileCredentialStore(this.context);
+      return this.recoverLocked(rollback);
+    });
+  }
+}
diff --git a/src/codex/native-profile-processes.ts b/src/codex/native-profile-processes.ts
new file mode 100644
index 000000000..2ddcb519b
--- /dev/null
+++ b/src/codex/native-profile-processes.ts
@@ -0,0 +1,53 @@
+import { execFileSync } from "node:child_process";
+import { basename } from "node:path";
+
+export type NativeCodexProcessProbe =
+  | { status: "clear"; count: 0 }
+  | { status: "busy"; count: number }
+  | { status: "unknown"; count: 0 };
+
+function windowsProcessCount(): number {
+  const powershell = `${process.env.SystemRoot ?? "C:\\Windows"}\\System32\\WindowsPowerShell\\v1.0\\powershell.exe`;
+  const script = [
+    "$ErrorActionPreference='Stop';",
+    "$self=$PID;",
+    "$items=Get-CimInstance Win32_Process | Where-Object { $_.ProcessId -ne $self -and ($_.Name -match '^(?i:codex)(?:\\.exe)?$' -or $_.CommandLine -match '(?i)(?:^|[\\\\/\"\\s])codex(?:\\.exe|\\.cmd)?(?:[\"\\s]|$)') };",
+    "@($items).Count",
+  ].join(" ");
+  const output = execFileSync(powershell, ["-NoLogo", "-NoProfile", "-NonInteractive", "-Command", script], {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "ignore"],
+    timeout: 12_000,
+    windowsHide: true,
+  }).trim();
+  const count = Number(output);
+  if (!Number.isInteger(count) || count < 0) throw new Error("invalid process count");
+  return count;
+}
+
+function unixProcessCount(): number {
+  const output = execFileSync("ps", ["-eo", "pid=,comm=,args="], {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "ignore"],
+    timeout: 5_000,
+  });
+  let count = 0;
+  for (const line of output.split("\n")) {
+    const match = line.trim().match(/^(\d+)\s+(\S+)\s*(.*)$/);
+    if (!match || Number(match[1]) === process.pid) continue;
+    const command = basename(match[2]!).toLowerCase();
+    const firstArg = basename(match[3]!.trim().split(/\s+/, 1)[0] ?? "").toLowerCase();
+    if (command === "codex" || command === "codex.exe" || firstArg === "codex" || firstArg === "codex.exe") count += 1;
+  }
+  return count;
+}
+
+/** Best-effort, read-only process probe. It never terminates a user process. */
+export async function probeNativeCodexProcesses(): Promise<NativeCodexProcessProbe> {
+  try {
+    const count = process.platform === "win32" ? windowsProcessCount() : unixProcessCount();
+    return count > 0 ? { status: "busy", count } : { status: "clear", count: 0 };
+  } catch {
+    return { status: "unknown", count: 0 };
+  }
+}
diff --git a/src/codex/native-profile-store.ts b/src/codex/native-profile-store.ts
new file mode 100644
index 000000000..7b0cbad79
--- /dev/null
+++ b/src/codex/native-profile-store.ts
@@ -0,0 +1,401 @@
+import {
+  createCipheriv,
+  createDecipheriv,
+  createHash,
+  createHmac,
+  randomBytes,
+  timingSafeEqual,
+} from "node:crypto";
+import { existsSync, readFileSync, realpathSync, statSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { getConfigDir } from "../config";
+import { extractAccountId } from "../oauth/chatgpt";
+import { getCodexHome, readRootTomlString } from "./paths";
+import {
+  NativeProfileError,
+  type EncryptedNativeEnvelopeV1,
+  type NativeMainProfileRecordV1,
+  type NativeMainProfileVaultV1,
+  type NativeProfileKey,
+  type NativeProfileKeyProvider,
+  type NativeProfilePublic,
+  type NativeProfileSwitchJournalV1,
+} from "./native-profile-types";
+
+const DOMAIN_HOME = "opencodex-native-profile-home-v1\0";
+const DOMAIN_IDENTITY = "opencodex-native-profile-identity-v1\0";
+const KEYRING_SERVICE = "opencodex.native-main-profile.v1";
+const MAX_AUTH_BYTES = 4 * 1024 * 1024;
+const MAX_METADATA_BYTES = 4 * 1024 * 1024;
+const MAX_PROFILES = 32;
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+const HASH_RE = /^[0-9a-f]{64}$/;
+
+export interface NativeProfileContext {
+  codexHome: string;
+  configDir: string;
+  rootDir: string;
+  stagingRoot: string;
+  homeId: string;
+  authPath: string;
+  vaultPath: string;
+  journalPath: string;
+  lockPath: string;
+}
+
+export interface NativeEnvelopeSnapshot {
+  raw: Buffer;
+  text: string;
+  digest: string;
+  accountId: string;
+}
+
+export type NativeEnvelopeReadResult =
+  | { status: "ok"; envelope: NativeEnvelopeSnapshot }
+  | { status: "missing" | "invalid" | "unreadable" };
+
+export class OsNativeProfileKeyProvider implements NativeProfileKeyProvider {
+  private async entry(homeId: string): Promise<import("@napi-rs/keyring").AsyncEntry> {
+    try {
+      const { AsyncEntry } = await import("@napi-rs/keyring");
+      return new AsyncEntry(KEYRING_SERVICE, homeId);
+    } catch {
+      throw new NativeProfileError(
+        "KEYRING_UNAVAILABLE",
+        "The native OS credential store is unavailable; no plaintext fallback is permitted.",
+        503,
+        true,
+      );
+    }
+  }
+
+  async get(homeId: string): Promise<NativeProfileKey | null> {
+    try {
+      const secret = await (await this.entry(homeId)).getSecret(AbortSignal.timeout(8_000));
+      if (!secret) return null;
+      const key = Buffer.from(secret);
+      if (key.byteLength !== 32) {
+        key.fill(0);
+        throw new NativeProfileError("KEYRING_UNAVAILABLE", "The OS credential-store key is invalid.", 503);
+      }
+      return { keyRef: `${KEYRING_SERVICE}:${homeId}`, key };
+    } catch (error) {
+      if (error instanceof NativeProfileError) throw error;
+      throw new NativeProfileError(
+        "KEYRING_UNAVAILABLE",
+        "The native OS credential store could not be read.",
+        503,
+        true,
+      );
+    }
+  }
+
+  async create(homeId: string): Promise<NativeProfileKey> {
+    const existing = await this.get(homeId);
+    if (existing) return existing;
+    const key = randomBytes(32);
+    try {
+      const entry = await this.entry(homeId);
+      await entry.setSecret(key, AbortSignal.timeout(8_000));
+      const stored = await entry.getSecret(AbortSignal.timeout(8_000));
+      const verified = stored ? Buffer.from(stored) : null;
+      if (!verified || verified.byteLength !== key.byteLength || !timingSafeEqual(verified, key)) {
+        verified?.fill(0);
+        throw new NativeProfileError("KEYRING_UNAVAILABLE", "The OS credential-store key could not be verified.", 503);
+      }
+      verified.fill(0);
+      return { keyRef: `${KEYRING_SERVICE}:${homeId}`, key: Buffer.from(key) };
+    } catch (error) {
+      if (error instanceof NativeProfileError) throw error;
+      throw new NativeProfileError(
+        "KEYRING_UNAVAILABLE",
+        "The native OS credential store could not save the profile key.",
+        503,
+        true,
+      );
+    } finally {
+      key.fill(0);
+    }
+  }
+}
+
+function canonicalExistingDirectory(path: string, label: string): string {
+  const absolute = resolve(path);
+  try {
+    if (!statSync(absolute).isDirectory()) throw new Error("not a directory");
+    return realpathSync.native(absolute);
+  } catch {
+    throw new NativeProfileError("CODEX_HOME_UNAVAILABLE", `${label} is not an accessible directory.`, 409);
+  }
+}
+
+export function resolveNativeProfileContext(options: { codexHome?: string; configDir?: string } = {}): NativeProfileContext {
+  const codexHome = canonicalExistingDirectory(options.codexHome ?? getCodexHome(), "The effective CODEX_HOME");
+  const configDir = resolve(options.configDir ?? getConfigDir());
+  const homeBytes = process.platform === "win32" ? codexHome.toLowerCase() : codexHome;
+  const homeId = createHash("sha256").update(DOMAIN_HOME).update(homeBytes).digest("hex");
+  const rootDir = join(configDir, "native-main-profiles");
+  return {
+    codexHome,
+    configDir,
+    rootDir,
+    stagingRoot: join(rootDir, "staging", homeId),
+    homeId,
+    authPath: join(codexHome, "auth.json"),
+    vaultPath: join(rootDir, `${homeId}.vault.json`),
+    journalPath: join(rootDir, `${homeId}.journal.json`),
+    lockPath: join(rootDir, `${homeId}.lock`),
+  };
+}
+
+function readBounded(path: string, limit: number): Buffer {
+  const stat = statSync(path);
+  if (!stat.isFile() || stat.size > limit) throw new Error("invalid bounded file");
+  return readFileSync(path);
+}
+
+export function resolveNativeCredentialStoreMode(context: NativeProfileContext): string {
+  const path = join(context.codexHome, "config.toml");
+  let content: string;
+  try {
+    content = readBounded(path, 1024 * 1024).toString("utf8");
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") return "file";
+    throw new NativeProfileError("UNSUPPORTED_AUTH_STORE", "The Codex credential-store configuration is unreadable.", 409);
+  }
+  const mode = readRootTomlString(content, "cli_auth_credentials_store");
+  if (mode === null && /^\s*cli_auth_credentials_store\s*=/m.test(content)) {
+    throw new NativeProfileError("UNSUPPORTED_AUTH_STORE", "The Codex credential-store mode is invalid.", 409);
+  }
+  return mode ?? "file";
+}
+
+export function requireFileCredentialStore(context: NativeProfileContext): void {
+  const mode = resolveNativeCredentialStoreMode(context);
+  if (mode !== "file") {
+    throw new NativeProfileError(
+      "UNSUPPORTED_AUTH_STORE",
+      `Native profile switching supports Codex credential-store mode "file" only; current mode is "${mode}".`,
+      409,
+    );
+  }
+}
+
+export function parseNativeEnvelopeBytes(raw: Buffer): NativeEnvelopeSnapshot {
+  if (raw.byteLength === 0 || raw.byteLength > MAX_AUTH_BYTES) {
+    throw new NativeProfileError("AUTH_INVALID", "The native Codex credential envelope is invalid.", 409);
+  }
+  const text = raw.toString("utf8");
+  if (!Buffer.from(text, "utf8").equals(raw)) {
+    throw new NativeProfileError("AUTH_INVALID", "The native Codex credential envelope is not valid UTF-8.", 409);
+  }
+  try {
+    const parsed = JSON.parse(text.replace(/^\uFEFF/, "")) as {
+      auth_mode?: unknown;
+      tokens?: {
+        id_token?: unknown;
+        access_token?: unknown;
+        refresh_token?: unknown;
+        account_id?: unknown;
+      };
+    };
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("root");
+    if (parsed.auth_mode !== undefined && parsed.auth_mode !== "chatgpt") throw new Error("mode");
+    const tokens = parsed.tokens;
+    if (
+      !tokens
+      || typeof tokens.id_token !== "string" || tokens.id_token.length === 0
+      || typeof tokens.access_token !== "string" || tokens.access_token.length === 0
+      || typeof tokens.refresh_token !== "string" || tokens.refresh_token.length === 0
+    ) throw new Error("tokens");
+    const derived = extractAccountId(tokens.id_token, tokens.access_token);
+    const explicit = typeof tokens.account_id === "string" && tokens.account_id.trim() ? tokens.account_id.trim() : null;
+    if (derived && explicit && derived !== explicit) throw new Error("identity mismatch");
+    const accountId = derived ?? explicit;
+    if (!accountId) throw new Error("identity");
+    return {
+      raw,
+      text,
+      accountId,
+      digest: createHash("sha256").update(raw).digest("hex"),
+    };
+  } catch (error) {
+    if (error instanceof NativeProfileError) throw error;
+    throw new NativeProfileError("AUTH_INVALID", "The native Codex credential envelope is invalid.", 409);
+  }
+}
+
+export function readNativeEnvelopeResult(path: string): NativeEnvelopeReadResult {
+  let raw: Buffer;
+  try {
+    raw = readBounded(path, MAX_AUTH_BYTES);
+  } catch (error) {
+    return { status: (error as NodeJS.ErrnoException).code === "ENOENT" ? "missing" : "unreadable" };
+  }
+  try {
+    return { status: "ok", envelope: parseNativeEnvelopeBytes(raw) };
+  } catch {
+    raw.fill(0);
+    return { status: "invalid" };
+  }
+}
+
+export function readNativeEnvelope(path: string): NativeEnvelopeSnapshot {
+  const result = readNativeEnvelopeResult(path);
+  if (result.status === "ok") return result.envelope;
+  const code = result.status === "missing" ? "AUTH_MISSING" : result.status === "invalid" ? "AUTH_INVALID" : "AUTH_UNREADABLE";
+  throw new NativeProfileError(code, `The native Codex credential envelope is ${result.status}.`, 409);
+}
+
+export function nativeIdentityHash(key: Uint8Array, accountId: string): string {
+  return createHmac("sha256", key).update(DOMAIN_IDENTITY).update(accountId).digest("hex");
+}
+
+export function nativeIdentityHint(identityHash: string): string {
+  return `account-${identityHash.slice(0, 8)}`;
+}
+
+function aad(context: NativeProfileContext, profileId: string, identityHash: string, digest: string): Buffer {
+  return Buffer.from(JSON.stringify([1, context.homeId, profileId, identityHash, digest]), "utf8");
+}
+
+export function encryptNativeEnvelope(
+  context: NativeProfileContext,
+  profileId: string,
+  identityHash: string,
+  envelope: NativeEnvelopeSnapshot,
+  key: NativeProfileKey,
+): EncryptedNativeEnvelopeV1 {
+  const nonce = randomBytes(12);
+  const cipher = createCipheriv("aes-256-gcm", key.key, nonce);
+  cipher.setAAD(aad(context, profileId, identityHash, envelope.digest));
+  const ciphertext = Buffer.concat([cipher.update(envelope.raw), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  return {
+    cipher: "aes-256-gcm",
+    keyRef: key.keyRef,
+    nonce: nonce.toString("base64"),
+    ciphertext: ciphertext.toString("base64"),
+    tag: tag.toString("base64"),
+    envelopeSha256: envelope.digest,
+  };
+}
+
+export function decryptNativeEnvelope(
+  context: NativeProfileContext,
+  profileId: string,
+  identityHash: string,
+  payload: EncryptedNativeEnvelopeV1,
+  key: NativeProfileKey,
+): NativeEnvelopeSnapshot {
+  let raw: Buffer | null = null;
+  try {
+    if (payload.keyRef !== key.keyRef || payload.cipher !== "aes-256-gcm") throw new Error("key");
+    const decipher = createDecipheriv("aes-256-gcm", key.key, Buffer.from(payload.nonce, "base64"));
+    decipher.setAAD(aad(context, profileId, identityHash, payload.envelopeSha256));
+    decipher.setAuthTag(Buffer.from(payload.tag, "base64"));
+    raw = Buffer.concat([decipher.update(Buffer.from(payload.ciphertext, "base64")), decipher.final()]);
+    const parsed = parseNativeEnvelopeBytes(raw);
+    if (parsed.digest !== payload.envelopeSha256) throw new Error("digest");
+    return parsed;
+  } catch {
+    raw?.fill(0);
+    throw new NativeProfileError("PROFILE_DECRYPT_FAILED", "The selected native profile could not be decrypted or verified.", 409);
+  }
+}
+
+function isEncryptedPayload(value: unknown): value is EncryptedNativeEnvelopeV1 {
+  if (!value || typeof value !== "object") return false;
+  const v = value as Record<string, unknown>;
+  return v.cipher === "aes-256-gcm"
+    && typeof v.keyRef === "string" && v.keyRef.length > 0
+    && typeof v.nonce === "string" && v.nonce.length > 0
+    && typeof v.ciphertext === "string" && v.ciphertext.length > 0
+    && typeof v.tag === "string" && v.tag.length > 0
+    && typeof v.envelopeSha256 === "string" && HASH_RE.test(v.envelopeSha256);
+}
+
+function parseVaultObject(value: unknown, homeId: string): NativeMainProfileVaultV1 {
+  if (!value || typeof value !== "object") throw new Error("root");
+  const vault = value as NativeMainProfileVaultV1;
+  if (vault.version !== 1 || vault.homeId !== homeId || !Number.isSafeInteger(vault.revision) || vault.revision < 0) throw new Error("header");
+  if (!Array.isArray(vault.profiles) || vault.profiles.length > MAX_PROFILES) throw new Error("profiles");
+  if (vault.activeProfileId !== null && (typeof vault.activeProfileId !== "string" || !UUID_RE.test(vault.activeProfileId))) throw new Error("active");
+  const ids = new Set<string>();
+  const labels = new Set<string>();
+  const identities = new Set<string>();
+  let activeCount = 0;
+  for (const profile of vault.profiles) {
+    if (!profile || typeof profile !== "object" || !UUID_RE.test(profile.id) || ids.has(profile.id)) throw new Error("id");
+    const label = profile.label?.trim();
+    if (!label || label.length > 64 || /[\u0000-\u001f\u007f]/.test(label)) throw new Error("label");
+    const normalizedLabel = label.toLowerCase();
+    if (labels.has(normalizedLabel) || !HASH_RE.test(profile.identityHash) || identities.has(profile.identityHash)) throw new Error("identity");
+    if (profile.identityHint !== nativeIdentityHint(profile.identityHash)) throw new Error("hint");
+    if (profile.state === "active") {
+      activeCount += 1;
+      if (profile.payload !== null || profile.id !== vault.activeProfileId) throw new Error("active payload");
+    } else if (profile.state === "inactive") {
+      if (!isEncryptedPayload(profile.payload)) throw new Error("inactive payload");
+    } else throw new Error("state");
+    ids.add(profile.id);
+    labels.add(normalizedLabel);
+    identities.add(profile.identityHash);
+  }
+  if ((vault.profiles.length === 0 && vault.activeProfileId !== null) || (vault.profiles.length > 0 && activeCount !== 1)) throw new Error("active count");
+  return vault;
+}
+
+export function readNativeProfileVault(context: NativeProfileContext): NativeMainProfileVaultV1 | null {
+  if (!existsSync(context.vaultPath)) return null;
+  try {
+    return parseVaultObject(JSON.parse(readBounded(context.vaultPath, MAX_METADATA_BYTES).toString("utf8")), context.homeId);
+  } catch {
+    throw new NativeProfileError("VAULT_INVALID", "The encrypted native-profile vault is invalid.", 409);
+  }
+}
+
+export function readNativeProfileJournal(context: NativeProfileContext): NativeProfileSwitchJournalV1 | null {
+  if (!existsSync(context.journalPath)) return null;
+  try {
+    const journal = JSON.parse(readBounded(context.journalPath, MAX_METADATA_BYTES).toString("utf8")) as NativeProfileSwitchJournalV1;
+    if (
+      journal.version !== 1 || journal.homeId !== context.homeId || !UUID_RE.test(journal.transactionId)
+      || !["prepared", "auth-replaced", "vault-committed"].includes(journal.phase)
+      || !UUID_RE.test(journal.sourceProfileId) || !UUID_RE.test(journal.targetProfileId)
+      || !HASH_RE.test(journal.sourceIdentityHash) || !HASH_RE.test(journal.targetIdentityHash)
+      || !isEncryptedPayload(journal.sourcePayload) || !isEncryptedPayload(journal.targetPayload)
+    ) throw new Error("journal");
+    journal.beforeVault = parseVaultObject(journal.beforeVault, context.homeId);
+    journal.afterVault = parseVaultObject(journal.afterVault, context.homeId);
+    return journal;
+  } catch {
+    throw new NativeProfileError("RECOVERY_REQUIRED", "The native-profile recovery journal is invalid.", 409);
+  }
+}
+
+export function serializeNativeProfileMetadata(value: unknown): string {
+  return `${JSON.stringify(value, null, 2)}\n`;
+}
+
+export function validateNativeProfileLabel(label: string): string {
+  const trimmed = label.trim();
+  if (!trimmed || trimmed.length > 64 || /[\u0000-\u001f\u007f]/.test(trimmed)) {
+    throw new NativeProfileError("INVALID_REQUEST", "Profile labels must contain 1-64 printable characters.", 400);
+  }
+  return trimmed;
+}
+
+export function assertUniqueNativeProfileLabel(
+  vault: NativeMainProfileVaultV1,
+  label: string,
+  excludeId?: string,
+): void {
+  if (vault.profiles.some(profile => profile.id !== excludeId && profile.label.toLowerCase() === label.toLowerCase())) {
+    throw new NativeProfileError("PROFILE_ALREADY_EXISTS", "A native profile already uses that label.", 409);
+  }
+}
+
+export function publicNativeProfile(profile: NativeMainProfileRecordV1): NativeProfilePublic {
+  return { id: profile.id, label: profile.label, identityHint: profile.identityHint, state: profile.state };
+}
diff --git a/src/codex/native-profile-types.ts b/src/codex/native-profile-types.ts
new file mode 100644
index 000000000..4a6593878
--- /dev/null
+++ b/src/codex/native-profile-types.ts
@@ -0,0 +1,100 @@
+export type NativeProfileErrorCode =
+  | "INVALID_REQUEST"
+  | "CODEX_HOME_UNAVAILABLE"
+  | "UNSUPPORTED_AUTH_STORE"
+  | "AUTH_MISSING"
+  | "AUTH_INVALID"
+  | "AUTH_UNREADABLE"
+  | "ACTIVE_PROFILE_MISMATCH"
+  | "PROFILE_NOT_FOUND"
+  | "PROFILE_ALREADY_EXISTS"
+  | "PROFILE_DECRYPT_FAILED"
+  | "KEYRING_UNAVAILABLE"
+  | "KEYRING_KEY_MISSING"
+  | "PROFILE_LOCK_UNAVAILABLE"
+  | "CODEX_BUSY"
+  | "CODEX_PROCESS_CHECK_UNAVAILABLE"
+  | "MAIN_REQUESTS_ACTIVE"
+  | "RECOVERY_REQUIRED"
+  | "AUTH_RESTORE_FAILED"
+  | "SWITCH_ROLLED_BACK"
+  | "STAGING_NOT_FOUND"
+  | "STAGING_CLEANUP_REQUIRED"
+  | "VAULT_INVALID";
+
+export class NativeProfileError extends Error {
+  constructor(
+    readonly code: NativeProfileErrorCode,
+    message: string,
+    readonly status = 409,
+    readonly retryable = false,
+  ) {
+    super(message);
+    this.name = "NativeProfileError";
+  }
+}
+
+export type NativeProfileState = "active" | "inactive";
+
+export interface EncryptedNativeEnvelopeV1 {
+  cipher: "aes-256-gcm";
+  keyRef: string;
+  nonce: string;
+  ciphertext: string;
+  tag: string;
+  envelopeSha256: string;
+}
+
+export interface NativeMainProfileRecordV1 {
+  id: string;
+  label: string;
+  identityHash: string;
+  identityHint: string;
+  state: NativeProfileState;
+  payload: EncryptedNativeEnvelopeV1 | null;
+  createdAt: string;
+  updatedAt: string;
+}
+
+export interface NativeMainProfileVaultV1 {
+  version: 1;
+  revision: number;
+  homeId: string;
+  activeProfileId: string | null;
+  profiles: NativeMainProfileRecordV1[];
+}
+
+export type NativeProfileJournalPhase = "prepared" | "auth-replaced" | "vault-committed";
+
+export interface NativeProfileSwitchJournalV1 {
+  version: 1;
+  transactionId: string;
+  homeId: string;
+  phase: NativeProfileJournalPhase;
+  sourceProfileId: string;
+  sourceIdentityHash: string;
+  sourcePayload: EncryptedNativeEnvelopeV1;
+  targetProfileId: string;
+  targetIdentityHash: string;
+  targetPayload: EncryptedNativeEnvelopeV1;
+  beforeVault: NativeMainProfileVaultV1;
+  afterVault: NativeMainProfileVaultV1;
+  createdAt: string;
+}
+
+export interface NativeProfilePublic {
+  id: string;
+  label: string;
+  identityHint: string;
+  state: NativeProfileState;
+}
+
+export interface NativeProfileKey {
+  keyRef: string;
+  key: Uint8Array;
+}
+
+export interface NativeProfileKeyProvider {
+  get(homeId: string): Promise<NativeProfileKey | null>;
+  create(homeId: string): Promise<NativeProfileKey>;
+}
diff --git a/src/server/management-api.ts b/src/server/management-api.ts
index af4b6bf9a..801352e34 100644
--- a/src/server/management-api.ts
+++ b/src/server/management-api.ts
@@ -192,6 +192,11 @@ export async function handleManagementAPI(
       : { success: false, message: `Proxy stopping, but native Codex restore failed: ${restore.message}. Run \`ocx restore\`.${grokNote}` });
   }
 
+  if (url.pathname.startsWith("/api/native-main-profiles")) {
+    const { handleNativeProfileAPI } = await import("../codex/native-profile-api");
+    return handleNativeProfileAPI(req, url, config);
+  }
+
   if (url.pathname.startsWith("/api/codex-auth/")) {
     const { handleCodexAuthAPI } = await import("../codex/auth-api");
     const { ConfigMutationLockError } = await import("../config");
diff --git a/tests/cli-native-profile.test.ts b/tests/cli-native-profile.test.ts
new file mode 100644
index 000000000..39928bd65
--- /dev/null
+++ b/tests/cli-native-profile.test.ts
@@ -0,0 +1,62 @@
+import { afterEach, describe, expect, test } from "bun:test";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { cmdAccount } from "../src/cli/account";
+
+const originalLog = console.log;
+const originalError = console.error;
+
+afterEach(() => {
+  console.log = originalLog;
+  console.error = originalError;
+});
+
+describe("ocx account main", () => {
+  test("add keeps the auth envelope off HTTP and switch requires explicit stopped confirmation", async () => {
+    const stagingHome = join(tmpdir(), "ocx-native-profile-stage");
+    const requests: Array<{ path: string; body?: Record<string, unknown> }> = [];
+    const output: string[] = [];
+    const errors: string[] = [];
+    console.log = (...values: unknown[]) => output.push(values.join(" "));
+    console.error = (...values: unknown[]) => errors.push(values.join(" "));
+    let loginHome = "";
+    const fetchImpl: typeof fetch = async (input, init) => {
+      const url = new URL(String(input));
+      const requestBody = typeof init?.body === "string" ? JSON.parse(init.body) as Record<string, unknown> : undefined;
+      requests.push({ path: url.pathname, body: requestBody });
+      if (url.pathname.endsWith("/stage") && !url.pathname.endsWith("/finish")) {
+        return Response.json({ stageId: "11111111-1111-4111-8111-111111111111", stagingCodexHome: stagingHome, effectiveCodexHome: join(tmpdir(), "codex-home") });
+      }
+      if (url.pathname.endsWith("/stage/finish")) {
+        return Response.json({ effectiveCodexHome: join(tmpdir(), "codex-home"), profile: { id: "p2", label: "work", identityHint: "account-12345678", state: "inactive" } });
+      }
+      if (url.pathname.endsWith("/switch")) {
+        return Response.json({ ok: true, activeProfile: { id: "p2", label: "work", identityHint: "account-12345678", state: "active" }, restartRequired: true });
+      }
+      return Response.json({ ok: true });
+    };
+    const deps = {
+      baseUrl: "http://127.0.0.1:10100",
+      fetchImpl,
+      runCodexLoginImpl: async (home: string) => { loginHome = home; return 0; },
+    };
+
+    expect(await cmdAccount(["main", "add", "work"], deps)).toBe(0);
+    expect(loginHome).toBe(stagingHome);
+    expect(requests.find(request => request.path.endsWith("/stage/finish"))?.body).toEqual({
+      stageId: "11111111-1111-4111-8111-111111111111",
+      label: "work",
+    });
+    expect(JSON.stringify(requests)).not.toContain("access_token");
+    expect(JSON.stringify(requests)).not.toContain("refresh_token");
+
+    const before = requests.length;
+    expect(await cmdAccount(["main", "switch", "work"], deps)).toBe(1);
+    expect(requests).toHaveLength(before);
+    expect(errors.join("\n")).toContain("--yes");
+
+    expect(await cmdAccount(["main", "switch", "work", "--yes"], deps)).toBe(0);
+    expect(requests.at(-1)?.body).toEqual({ target: "work", confirmedStopped: true });
+    expect(output.join("\n")).toContain("Restart Codex App/CLI");
+  });
+});
diff --git a/tests/native-profile-api.test.ts b/tests/native-profile-api.test.ts
new file mode 100644
index 000000000..56dd89c5b
--- /dev/null
+++ b/tests/native-profile-api.test.ts
@@ -0,0 +1,32 @@
+import { afterEach, describe, expect, test } from "bun:test";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import type { OcxConfig } from "../src/types";
+import { handleNativeProfileAPI } from "../src/codex/native-profile-api";
+
+const originalCodexHome = process.env.CODEX_HOME;
+
+afterEach(() => {
+  if (originalCodexHome === undefined) delete process.env.CODEX_HOME;
+  else process.env.CODEX_HOME = originalCodexHome;
+});
+
+describe("native main profile management API", () => {
+  test("constructor failures remain inside the redacted management error boundary", async () => {
+    const missingHome = join(tmpdir(), `ocx-native-profile-missing-${crypto.randomUUID()}`);
+    process.env.CODEX_HOME = missingHome;
+    const request = new Request("http://localhost/api/native-main-profiles");
+
+    const response = await handleNativeProfileAPI(
+      request,
+      new URL(request.url),
+      {} as OcxConfig,
+    );
+
+    expect(response).not.toBeNull();
+    expect(response!.status).toBeGreaterThanOrEqual(400);
+    const payload = JSON.stringify(await response!.json());
+    expect(payload).not.toContain(missingHome);
+    expect(payload).not.toContain(process.env.USERNAME ?? "Administrator");
+  });
+});
diff --git a/tests/native-profile-manager.test.ts b/tests/native-profile-manager.test.ts
new file mode 100644
index 000000000..c0e187c80
--- /dev/null
+++ b/tests/native-profile-manager.test.ts
@@ -0,0 +1,158 @@
+import { afterEach, describe, expect, test } from "bun:test";
+import { mkdirSync, mkdtempSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { NativeProfileManager } from "../src/codex/native-profile-manager";
+import { NativeProfileError, type NativeProfileKey, type NativeProfileKeyProvider } from "../src/codex/native-profile-types";
+
+const roots: string[] = [];
+
+afterEach(() => {
+  for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true });
+});
+
+class MemoryKeyProvider implements NativeProfileKeyProvider {
+  private readonly keys = new Map<string, Buffer>();
+  async get(homeId: string): Promise<NativeProfileKey | null> {
+    const key = this.keys.get(homeId);
+    return key ? { keyRef: `memory:${homeId}`, key: Buffer.from(key) } : null;
+  }
+  async create(homeId: string): Promise<NativeProfileKey> {
+    const key = Buffer.alloc(32, 7);
+    this.keys.set(homeId, key);
+    return { keyRef: `memory:${homeId}`, key: Buffer.from(key) };
+  }
+}
+
+function envelope(accountId: string, marker: string): string {
+  return ` {\n  \"auth_mode\": \"chatgpt\",\n  \"tokens\": {\n    \"id_token\": \"opaque-id-${marker}\",\n    \"access_token\": \"opaque-access-${marker}\",\n    \"refresh_token\": \"opaque-refresh-${marker}\",\n    \"account_id\": \"${accountId}\",\n    \"future_token_field\": \"preserve-${marker}\"\n  },\n  \"future_root_field\": { \"marker\": \"${marker}\" }\n}\n`;
+}
+
+async function atomic(path: string, content: string): Promise<void> {
+  mkdirSync(dirname(path), { recursive: true });
+  const temp = `${path}.test.tmp`;
+  writeFileSync(temp, content, { mode: 0o600 });
+  renameSync(temp, path);
+}
+
+function fixture() {
+  const root = mkdtempSync(join(tmpdir(), "ocx-native-profile-"));
+  roots.push(root);
+  const codexHome = join(root, "codex");
+  const configDir = join(root, "opencodex");
+  mkdirSync(codexHome, { recursive: true });
+  mkdirSync(configDir, { recursive: true });
+  writeFileSync(join(codexHome, "config.toml"), 'cli_auth_credentials_store = "file"\n');
+  const source = envelope("account-source", "source");
+  const target = envelope("account-target", "target");
+  writeFileSync(join(codexHome, "auth.json"), source);
+  const keyProvider = new MemoryKeyProvider();
+  const transitions: string[] = [];
+  const options = {
+    codexHome,
+    configDir,
+    keyProvider,
+    atomicWrite: atomic,
+    hardenPath: async () => {},
+    processProbe: async () => ({ status: "clear" as const, count: 0 as const }),
+    applyTransition: (from: string, to: string) => transitions.push(`${from}->${to}`),
+  };
+  return { root, codexHome, configDir, source, target, keyProvider, transitions, options };
+}
+
+async function enrolledFixture() {
+  const f = fixture();
+  const manager = new NativeProfileManager(f.options);
+  const sourceProfile = await manager.register("personal");
+  const stage = await manager.prepareStage();
+  writeFileSync(join(stage.stagingCodexHome, "auth.json"), f.target);
+  const targetProfile = await manager.finishStage(stage.stageId, "work");
+  return { ...f, manager, sourceProfile: sourceProfile.profile, targetProfile: targetProfile.profile, stage };
+}
+
+describe("native main profile transactions", () => {
+  test("preserves exact auth bytes, encrypts inactive profiles, and leaves task/history files untouched", async () => {
+    const f = await enrolledFixture();
+    const taskPath = join(f.codexHome, "sessions", "task.jsonl");
+    const historyPath = join(f.codexHome, "history.jsonl");
+    mkdirSync(dirname(taskPath), { recursive: true });
+    writeFileSync(taskPath, "task-history\n");
+    writeFileSync(historyPath, "local-history\n");
+
+    const vaultText = readFileSync(f.manager.context.vaultPath, "utf8");
+    expect(vaultText).not.toContain("opaque-access-target");
+    expect(vaultText).not.toContain("opaque-refresh-target");
+    expect(vaultText).not.toContain("account-target");
+    expect(() => readFileSync(join(f.stage.stagingCodexHome, "auth.json"))).toThrow();
+
+    const switched = await f.manager.switch("work", true);
+    expect(switched.restartRequired).toBe(true);
+    expect(readFileSync(join(f.codexHome, "auth.json"), "utf8")).toBe(f.target);
+    expect(readFileSync(taskPath, "utf8")).toBe("task-history\n");
+    expect(readFileSync(historyPath, "utf8")).toBe("local-history\n");
+
+    await f.manager.switch("personal", true);
+    expect(readFileSync(join(f.codexHome, "auth.json"), "utf8")).toBe(f.source);
+    expect(f.transitions).toEqual([
+      "account-source->account-target",
+      "account-target->account-source",
+    ]);
+  });
+
+  test("a read-back mismatch restores the exact source and removes the journal", async () => {
+    const f = await enrolledFixture();
+    const authPath = f.manager.context.authPath;
+    let authWrites = 0;
+    const failing = new NativeProfileManager({
+      ...f.options,
+      atomicWrite: async (path, content) => {
+        if (path === authPath && authWrites++ === 0) return atomic(path, "{}\n");
+        return atomic(path, content);
+      },
+    });
+    let caught: unknown;
+    try { await failing.switch("work", true); } catch (error) { caught = error; }
+    expect(caught).toBeInstanceOf(NativeProfileError);
+    expect((caught as NativeProfileError).code).toBe("SWITCH_ROLLED_BACK");
+    expect(readFileSync(join(f.codexHome, "auth.json"), "utf8")).toBe(f.source);
+    expect((await failing.doctor()).recoveryPending).toBe(false);
+    expect((await failing.list()).activeProfileId).toBe(f.sourceProfile.id);
+  });
+
+  test("a failed exact restore retains the encrypted recovery journal and never claims success", async () => {
+    const f = await enrolledFixture();
+    const authPath = f.manager.context.authPath;
+    let authWrites = 0;
+    const failing = new NativeProfileManager({
+      ...f.options,
+      atomicWrite: async (path, content) => {
+        if (path === authPath) {
+          authWrites += 1;
+          if (authWrites === 1) return atomic(path, "{}\n");
+          throw new Error("injected restore failure");
+        }
+        return atomic(path, content);
+      },
+    });
+    let caught: unknown;
+    try { await failing.switch("work", true); } catch (error) { caught = error; }
+    expect(caught).toBeInstanceOf(NativeProfileError);
+    expect((caught as NativeProfileError).code).toBe("AUTH_RESTORE_FAILED");
+    expect((await failing.doctor()).recoveryPending).toBe(true);
+    const journal = readFileSync(failing.context.journalPath, "utf8");
+    expect(journal).not.toContain("opaque-refresh-source");
+    expect(journal).not.toContain("opaque-refresh-target");
+  });
+
+  test("non-file Codex credential stores fail before vault or auth mutation", async () => {
+    const f = fixture();
+    writeFileSync(join(f.codexHome, "config.toml"), 'cli_auth_credentials_store = "auto"\n');
+    const manager = new NativeProfileManager(f.options);
+    let caught: unknown;
+    try { await manager.register("personal"); } catch (error) { caught = error; }
+    expect(caught).toBeInstanceOf(NativeProfileError);
+    expect((caught as NativeProfileError).code).toBe("UNSUPPORTED_AUTH_STORE");
+    expect(readFileSync(join(f.codexHome, "auth.json"), "utf8")).toBe(f.source);
+    expect(() => readFileSync(manager.context.vaultPath)).toThrow();
+  });
+});

From 6f0f41d6d9cfb12adce42e5c5d2aa8dd6054a739 Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Sun, 2 Aug 2026 09:51:38 +0900
Subject: [PATCH 04/63] fix(codex): harden native profile transitions

---
 src/cli/account-main.ts              |  4 +-
 src/codex/native-profile-api.ts      | 14 ++++-
 src/codex/native-profile-manager.ts  | 84 ++++++++++++++++++++--------
 src/server/lifecycle.ts              |  1 +
 tests/cli-native-profile.test.ts     |  6 ++
 tests/native-profile-api.test.ts     | 31 ++++++++++
 tests/native-profile-manager.test.ts | 69 ++++++++++++++++++++++-
 7 files changed, 181 insertions(+), 28 deletions(-)

diff --git a/src/cli/account-main.ts b/src/cli/account-main.ts
index c67555d04..143f36991 100644
--- a/src/cli/account-main.ts
+++ b/src/cli/account-main.ts
@@ -132,7 +132,9 @@ export async function cmdNativeMainAccount(args: string[], deps: AccountDeps): P
       if (rollback && !confirmed) console.error("--rollback changes the native login and requires --yes.");
       return reject(args);
     }
-    const result = await apiJson(deps, baseUrl, "POST", "/api/native-main-profiles/recover", { rollback });
+    const result = await apiJson(deps, baseUrl, "POST", "/api/native-main-profiles/recover", rollback
+      ? { rollback: true, confirmedStopped: true }
+      : { rollback: false });
     if (result.status === 0) return proxyUnreachable();
     if (result.status !== 200) return apiError(result.json, "failed to recover the native-profile transaction");
     if (wantsJson) console.log(JSON.stringify(result.json, null, 2));
diff --git a/src/codex/native-profile-api.ts b/src/codex/native-profile-api.ts
index e0c02553b..605add312 100644
--- a/src/codex/native-profile-api.ts
+++ b/src/codex/native-profile-api.ts
@@ -1,6 +1,11 @@
 import type { OcxConfig } from "../types";
 import { jsonResponse } from "../server/auth-cors";
 import { getActiveTurnCount, isDraining, setDraining } from "../server/lifecycle";
+import {
+  managementBodyTooLargeResponse,
+  readManagementJsonBody,
+  rethrowManagementBodyTooLarge,
+} from "../server/management/body";
 import { NativeProfileManager } from "./native-profile-manager";
 import { NativeProfileError } from "./native-profile-types";
 
@@ -12,10 +17,11 @@ export interface NativeProfileApiDeps {
 
 async function body(req: Request): Promise<Record<string, unknown>> {
   try {
-    const parsed = await req.json();
+    const parsed = await readManagementJsonBody(req);
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("body");
     return parsed as Record<string, unknown>;
-  } catch {
+  } catch (error) {
+    rethrowManagementBodyTooLarge(error);
     throw new NativeProfileError("INVALID_REQUEST", "A JSON object body is required.", 400);
   }
 }
@@ -84,7 +90,7 @@ export async function handleNativeProfileAPI(
     if (url.pathname === "/api/native-main-profiles/recover" && req.method === "POST") {
       const input = await body(req);
       return jsonResponse(
-        await withMainRequestDrain(deps, () => manager.recover(input.rollback === true)),
+        await withMainRequestDrain(deps, () => manager.recover(input.rollback === true, input.confirmedStopped === true)),
         200,
         req,
         config,
@@ -92,6 +98,8 @@ export async function handleNativeProfileAPI(
     }
     return jsonResponse({ error: "Unknown native-profile operation", code: "INVALID_REQUEST" }, 404, req, config);
   } catch (error) {
+    const tooLarge = managementBodyTooLargeResponse(error, req, config);
+    if (tooLarge) return tooLarge;
     if (error instanceof NativeProfileError) {
       return jsonResponse({ error: error.message, code: error.code, retryable: error.retryable }, error.status, req, config);
     }
diff --git a/src/codex/native-profile-manager.ts b/src/codex/native-profile-manager.ts
index 01a27b34a..6352fe934 100644
--- a/src/codex/native-profile-manager.ts
+++ b/src/codex/native-profile-manager.ts
@@ -3,6 +3,7 @@ import {
   chmodSync,
   closeSync,
   existsSync,
+  linkSync,
   lstatSync,
   mkdirSync,
   openSync,
@@ -51,6 +52,7 @@ import {
 } from "./native-profile-types";
 
 const LOCK_WAIT_MS = 5_000;
+const LOCK_METADATA_GRACE_MS = 1_000;
 const LOCK_STALE_MS = 10 * 60_000;
 const STAGE_MAX_AGE_MS = 30 * 60_000;
 const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
@@ -122,32 +124,62 @@ export class NativeProfileManager {
   }
 
   private isLockStale(): boolean {
+    const observedAt = this.now();
+    let pathAgeMs: number;
+    try {
+      pathAgeMs = Math.max(0, observedAt - lstatSync(this.context.lockPath).mtimeMs);
+    } catch (error) {
+      return errorCode(error) === "ENOENT";
+    }
     try {
       const lock = JSON.parse(readFileSync(this.context.lockPath, "utf8")) as { pid?: unknown; acquiredAt?: unknown };
       if (typeof lock.pid === "number" && processAlive(lock.pid)) return false;
-      return typeof lock.acquiredAt !== "number" || this.now() - lock.acquiredAt > LOCK_STALE_MS;
+      return typeof lock.acquiredAt === "number"
+        ? observedAt - lock.acquiredAt > LOCK_STALE_MS
+        : pathAgeMs > LOCK_METADATA_GRACE_MS;
     } catch {
-      return true;
+      return pathAgeMs > LOCK_METADATA_GRACE_MS;
+    }
+  }
+
+  private releaseLock(ownerToken: string): void {
+    try {
+      const lock = JSON.parse(readFileSync(this.context.lockPath, "utf8")) as { ownerToken?: unknown };
+      if (lock.ownerToken !== ownerToken) return;
+    } catch (error) {
+      if (errorCode(error) === "ENOENT") return;
+      return;
     }
+    try { unlinkSync(this.context.lockPath); } catch (error) { if (errorCode(error) !== "ENOENT") throw error; }
   }
 
   private async withLock<T>(operation: () => Promise<T>): Promise<T> {
     await this.ensureRoot();
     const deadline = this.now() + LOCK_WAIT_MS;
-    let fd: number | null = null;
-    while (fd === null) {
+    let ownerToken: string | null = null;
+    while (ownerToken === null) {
+      const candidateToken = this.uuid();
+      const candidatePath = `${this.context.lockPath}.${candidateToken}.candidate`;
+      let candidateFd: number | null = null;
       try {
-        fd = openSync(this.context.lockPath, "wx", 0o600);
-        writeFileSync(fd, serializeNativeProfileMetadata({ pid: process.pid, acquiredAt: this.now(), homeId: this.context.homeId }));
-        await this.hardenPath(this.context.lockPath);
+        candidateFd = openSync(candidatePath, "wx", 0o600);
+        writeFileSync(candidateFd, serializeNativeProfileMetadata({
+          pid: process.pid,
+          acquiredAt: this.now(),
+          homeId: this.context.homeId,
+          ownerToken: candidateToken,
+        }));
+        closeSync(candidateFd);
+        candidateFd = null;
+        await this.hardenPath(candidatePath);
+        linkSync(candidatePath, this.context.lockPath);
+        unlinkSync(candidatePath);
+        ownerToken = candidateToken;
       } catch (error) {
-        if (fd !== null) {
-          closeSync(fd);
-          fd = null;
-          try { unlinkSync(this.context.lockPath); } catch { /* reported below */ }
-          throw new NativeProfileError("PROFILE_LOCK_UNAVAILABLE", "The native-profile lock could not be secured.", 503, true);
-        }
+        if (candidateFd !== null) try { closeSync(candidateFd); } catch { /* reported below */ }
+        try { unlinkSync(candidatePath); } catch (cleanupError) { if (errorCode(cleanupError) !== "ENOENT") { /* reported below */ } }
         if (errorCode(error) !== "EEXIST") {
+          try { this.releaseLock(candidateToken); } catch { /* reported below */ }
           throw new NativeProfileError("PROFILE_LOCK_UNAVAILABLE", "The native-profile lock is unavailable.", 503, true);
         }
         if (this.isLockStale()) {
@@ -163,8 +195,17 @@ export class NativeProfileManager {
     try {
       return await operation();
     } finally {
-      closeSync(fd);
-      try { unlinkSync(this.context.lockPath); } catch (error) { if (errorCode(error) !== "ENOENT") throw error; }
+      this.releaseLock(ownerToken);
+    }
+  }
+
+  private async assertNativeCodexStopped(confirmedStopped: boolean): Promise<void> {
+    const processState = await this.processProbe();
+    if (processState.status === "busy") {
+      throw new NativeProfileError("CODEX_BUSY", `Close the ${processState.count} detected native Codex process(es) before switching.`, 409);
+    }
+    if (processState.status === "unknown" && !confirmedStopped) {
+      throw new NativeProfileError("CODEX_PROCESS_CHECK_UNAVAILABLE", "Codex process state could not be confirmed; close Codex and retry with explicit confirmation.", 409);
     }
   }
 
@@ -429,13 +470,7 @@ export class NativeProfileManager {
   async switch(targetSelector: string, confirmedStopped = false): Promise<Record<string, unknown>> {
     return this.withLock(async () => {
       requireFileCredentialStore(this.context);
-      const processState = await this.processProbe();
-      if (processState.status === "busy") {
-        throw new NativeProfileError("CODEX_BUSY", `Close the ${processState.count} detected native Codex process(es) before switching.`, 409);
-      }
-      if (processState.status === "unknown" && !confirmedStopped) {
-        throw new NativeProfileError("CODEX_PROCESS_CHECK_UNAVAILABLE", "Codex process state could not be confirmed; close Codex and retry with explicit confirmation.", 409);
-      }
+      await this.assertNativeCodexStopped(confirmedStopped);
       if (readNativeProfileJournal(this.context)) await this.recoverLocked(false);
       const beforeVault = this.requireVault();
       const key = await this.keyForVault(beforeVault);
@@ -592,9 +627,12 @@ export class NativeProfileManager {
     }
   }
 
-  async recover(rollback = false): Promise<Record<string, unknown>> {
+  async recover(rollback = false, confirmedStopped = false): Promise<Record<string, unknown>> {
     return this.withLock(async () => {
       requireFileCredentialStore(this.context);
+      if (rollback && readNativeProfileJournal(this.context)) {
+        await this.assertNativeCodexStopped(confirmedStopped);
+      }
       return this.recoverLocked(rollback);
     });
   }
diff --git a/src/server/lifecycle.ts b/src/server/lifecycle.ts
index 4b1ebdec5..6e769a571 100644
--- a/src/server/lifecycle.ts
+++ b/src/server/lifecycle.ts
@@ -42,6 +42,7 @@ let _serverRef: ReturnType<typeof Bun.serve> | undefined;
 export function setServerRef(server: ReturnType<typeof Bun.serve> | undefined): void { _serverRef = server; }
 export function setDraining(value: boolean): void { draining = value; }
 export function tryAdmitTurn(): ActiveTurnLease | null {
+  if (draining) return null;
   const gateLease = turnGate.tryAcquire();
   if (!gateLease) return null;
   const controllers = new Set<AbortController>();
diff --git a/tests/cli-native-profile.test.ts b/tests/cli-native-profile.test.ts
index 39928bd65..6b6dfc65d 100644
--- a/tests/cli-native-profile.test.ts
+++ b/tests/cli-native-profile.test.ts
@@ -58,5 +58,11 @@ describe("ocx account main", () => {
     expect(await cmdAccount(["main", "switch", "work", "--yes"], deps)).toBe(0);
     expect(requests.at(-1)?.body).toEqual({ target: "work", confirmedStopped: true });
     expect(output.join("\n")).toContain("Restart Codex App/CLI");
+
+    const recoveryBefore = requests.length;
+    expect(await cmdAccount(["main", "recover", "--rollback"], deps)).toBe(1);
+    expect(requests).toHaveLength(recoveryBefore);
+    expect(await cmdAccount(["main", "recover", "--rollback", "--yes"], deps)).toBe(0);
+    expect(requests.at(-1)?.body).toEqual({ rollback: true, confirmedStopped: true });
   });
 });
diff --git a/tests/native-profile-api.test.ts b/tests/native-profile-api.test.ts
index 56dd89c5b..5c7251b8a 100644
--- a/tests/native-profile-api.test.ts
+++ b/tests/native-profile-api.test.ts
@@ -3,15 +3,46 @@ import { join } from "node:path";
 import { tmpdir } from "node:os";
 import type { OcxConfig } from "../src/types";
 import { handleNativeProfileAPI } from "../src/codex/native-profile-api";
+import type { NativeProfileManager } from "../src/codex/native-profile-manager";
+import { setDraining, tryAdmitTurn } from "../src/server/lifecycle";
 
 const originalCodexHome = process.env.CODEX_HOME;
 
 afterEach(() => {
+  setDraining(false);
   if (originalCodexHome === undefined) delete process.env.CODEX_HOME;
   else process.env.CODEX_HOME = originalCodexHome;
 });
 
 describe("native main profile management API", () => {
+  test("the shared admission gate rejects new turns during a native-profile drain", () => {
+    setDraining(true);
+    expect(tryAdmitTurn()).toBeNull();
+
+    setDraining(false);
+    const lease = tryAdmitTurn();
+    expect(lease).not.toBeNull();
+    lease?.release();
+  });
+
+  test("length-unknown native-profile bodies use the bounded management reader", async () => {
+    let registered = false;
+    const manager = {
+      register: async () => { registered = true; return { ok: true }; },
+    } as unknown as NativeProfileManager;
+    const request = new Request("http://localhost/api/native-main-profiles/register", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ label: "large", padding: "x".repeat(4 * 1024 * 1024 + 1) }),
+    });
+    expect(request.headers.has("content-length")).toBe(false);
+
+    const response = await handleNativeProfileAPI(request, new URL(request.url), {} as OcxConfig, { manager });
+
+    expect(response?.status).toBe(413);
+    expect(registered).toBe(false);
+  });
+
   test("constructor failures remain inside the redacted management error boundary", async () => {
     const missingHome = join(tmpdir(), `ocx-native-profile-missing-${crypto.randomUUID()}`);
     process.env.CODEX_HOME = missingHome;
diff --git a/tests/native-profile-manager.test.ts b/tests/native-profile-manager.test.ts
index c0e187c80..97b14da53 100644
--- a/tests/native-profile-manager.test.ts
+++ b/tests/native-profile-manager.test.ts
@@ -1,5 +1,5 @@
 import { afterEach, describe, expect, test } from "bun:test";
-import { mkdirSync, mkdtempSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 import { NativeProfileManager } from "../src/codex/native-profile-manager";
@@ -71,6 +71,36 @@ async function enrolledFixture() {
 }
 
 describe("native main profile transactions", () => {
+  test("does not reclaim a fresh lock before its owner metadata is stable", async () => {
+    const f = fixture();
+    const now = Date.now();
+    const manager = new NativeProfileManager({
+      ...f.options,
+      now: () => now,
+      sleep: async () => { throw new Error("lock remains owned"); },
+    });
+    mkdirSync(manager.context.rootDir, { recursive: true });
+    writeFileSync(manager.context.lockPath, "");
+
+    let caught: unknown;
+    try { await manager.recover(false); } catch (error) { caught = error; }
+
+    expect(caught).toBeInstanceOf(Error);
+    expect((caught as Error).message).toBe("lock remains owned");
+    expect(existsSync(manager.context.lockPath)).toBe(true);
+  });
+
+  test("does not unlink a lock published by a different owner", () => {
+    const f = fixture();
+    const manager = new NativeProfileManager(f.options);
+    mkdirSync(manager.context.rootDir, { recursive: true });
+    writeFileSync(manager.context.lockPath, JSON.stringify({ ownerToken: "new-owner" }));
+
+    (manager as unknown as { releaseLock: (ownerToken: string) => void }).releaseLock("old-owner");
+
+    expect(existsSync(manager.context.lockPath)).toBe(true);
+  });
+
   test("preserves exact auth bytes, encrypts inactive profiles, and leaves task/history files untouched", async () => {
     const f = await enrolledFixture();
     const taskPath = join(f.codexHome, "sessions", "task.jsonl");
@@ -144,6 +174,43 @@ describe("native main profile transactions", () => {
     expect(journal).not.toContain("opaque-refresh-target");
   });
 
+  test("explicit rollback recovery applies the native Codex process guard", async () => {
+    const f = await enrolledFixture();
+    const authPath = f.manager.context.authPath;
+    const journalPath = f.manager.context.journalPath;
+    let authWrites = 0;
+    const interrupted = new NativeProfileManager({
+      ...f.options,
+      atomicWrite: async (path, content) => {
+        if (path === authPath) {
+          authWrites += 1;
+          if (authWrites > 1) throw new Error("injected restore failure");
+        }
+        if (path === journalPath && content.includes('"phase": "auth-replaced"')) {
+          throw new Error("injected post-replacement failure");
+        }
+        return atomic(path, content);
+      },
+    });
+    let switchError: unknown;
+    try { await interrupted.switch("work", true); } catch (error) { switchError = error; }
+    expect(switchError).toBeInstanceOf(NativeProfileError);
+    expect((switchError as NativeProfileError).code).toBe("AUTH_RESTORE_FAILED");
+    expect(readFileSync(authPath, "utf8")).toBe(f.target);
+
+    const blocked = new NativeProfileManager({
+      ...f.options,
+      processProbe: async () => ({ status: "busy" as const, count: 1 }),
+    });
+    let recoveryError: unknown;
+    try { await blocked.recover(true, true); } catch (error) { recoveryError = error; }
+
+    expect(recoveryError).toBeInstanceOf(NativeProfileError);
+    expect((recoveryError as NativeProfileError).code).toBe("CODEX_BUSY");
+    expect(readFileSync(authPath, "utf8")).toBe(f.target);
+    expect(existsSync(journalPath)).toBe(true);
+  });
+
   test("non-file Codex credential stores fail before vault or auth mutation", async () => {
     const f = fixture();
     writeFileSync(join(f.codexHome, "config.toml"), 'cli_auth_credentials_store = "auto"\n');

From 9e9c7f772b9512d05f421ab83bac6a9385660a04 Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Sun, 2 Aug 2026 09:59:56 +0900
Subject: [PATCH 05/63] docs: normalize native profile validation

---
 devlog/_plan/260801_native_main_profiles/001_validation.md | 1 -
 1 file changed, 1 deletion(-)

diff --git a/devlog/_plan/260801_native_main_profiles/001_validation.md b/devlog/_plan/260801_native_main_profiles/001_validation.md
index 32374b947..18aece136 100644
--- a/devlog/_plan/260801_native_main_profiles/001_validation.md
+++ b/devlog/_plan/260801_native_main_profiles/001_validation.md
@@ -73,4 +73,3 @@ No production code in this spike reads or writes a user's `auth.json`, vault, ta
 ## PR readiness
 
 The design and pure state model are suitable for maintainer discussion. A behavior-changing upstream PR is not suitable until maintainers choose the OS key-provider approach and confirm the file-only v1 boundary.
-

From 474ecabd5f7fc24a4fef2c3bd365165618211364 Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Sun, 2 Aug 2026 10:29:08 +0900
Subject: [PATCH 06/63] fix(codex): harden native profile staging locks

---
 src/cli/account-main.ts                    |  13 +-
 src/codex/native-profile-manager.ts        | 204 +++++++++++++--------
 src/codex/native-profile-types.ts          |   1 +
 tests/cli-native-profile.test.ts           |  48 +++++
 tests/helpers/native-profile-lock-child.ts |  26 +++
 tests/native-profile-manager.test.ts       | 153 ++++++++++++++--
 6 files changed, 345 insertions(+), 100 deletions(-)
 create mode 100644 tests/helpers/native-profile-lock-child.ts

diff --git a/src/cli/account-main.ts b/src/cli/account-main.ts
index 143f36991..951389d74 100644
--- a/src/cli/account-main.ts
+++ b/src/cli/account-main.ts
@@ -89,24 +89,27 @@ export async function cmdNativeMainAccount(args: string[], deps: AccountDeps): P
     if (stage.status !== 200) return apiError(stage.json, "failed to prepare native login staging");
     const stageId = typeof stage.json.stageId === "string" ? stage.json.stageId : "";
     const stagingHome = typeof stage.json.stagingCodexHome === "string" ? stage.json.stagingCodexHome : "";
-    if (!stageId || !isAbsolute(stagingHome)) {
-      console.error("Error: the proxy returned an invalid staging session.");
-      return 1;
-    }
     let exitCode = 1;
+    let finished = false;
     try {
+      if (!stageId || !isAbsolute(stagingHome)) throw new Error("The proxy returned an invalid staging session.");
       console.error(`Starting official Codex login in restricted staging home: ${stagingHome}`);
       exitCode = await (deps.runCodexLoginImpl ?? runOfficialCodexLogin)(stagingHome);
       if (exitCode !== 0) throw new Error("Official Codex login did not complete successfully.");
       const finish = await apiJson(deps, baseUrl, "POST", "/api/native-main-profiles/stage/finish", { stageId, label });
       if (finish.status === 0) return proxyUnreachable();
       if (finish.status !== 200) return apiError(finish.json, "failed to encrypt the staged native login");
+      finished = true;
       console.log(`Added encrypted native profile '${label}'.`);
       return 0;
     } catch (error) {
-      await apiJson(deps, baseUrl, "POST", "/api/native-main-profiles/stage/cancel", { stageId });
       console.error(`Error: ${error instanceof Error ? error.message : "Official Codex login failed."}`);
       return exitCode === 0 ? 1 : exitCode;
+    } finally {
+      if (stageId && !finished) {
+        const cleanup = await apiJson(deps, baseUrl, "POST", "/api/native-main-profiles/stage/cancel", { stageId });
+        if (cleanup.status !== 200) console.error("Error: the proxy could not confirm native-login staging cleanup; run account main doctor.");
+      }
     }
   }
 
diff --git a/src/codex/native-profile-manager.ts b/src/codex/native-profile-manager.ts
index 6352fe934..4bce86d18 100644
--- a/src/codex/native-profile-manager.ts
+++ b/src/codex/native-profile-manager.ts
@@ -1,13 +1,12 @@
 import { randomUUID } from "node:crypto";
+import { Database } from "bun:sqlite";
 import {
   chmodSync,
-  closeSync,
   existsSync,
-  linkSync,
   lstatSync,
   mkdirSync,
-  openSync,
   readFileSync,
+  readdirSync,
   realpathSync,
   rmSync,
   statSync,
@@ -52,8 +51,6 @@ import {
 } from "./native-profile-types";
 
 const LOCK_WAIT_MS = 5_000;
-const LOCK_METADATA_GRACE_MS = 1_000;
-const LOCK_STALE_MS = 10 * 60_000;
 const STAGE_MAX_AGE_MS = 30 * 60_000;
 const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 
@@ -71,6 +68,9 @@ export interface NativeProfileManagerOptions {
   now?: () => number;
   randomUUID?: () => string;
   sleep?: (ms: number) => Promise<void>;
+  lockWaitMs?: number;
+  onLockAcquired?: () => void | Promise<void>;
+  removeStageTree?: (path: string) => void;
 }
 
 export interface NativeProfileListResult {
@@ -91,10 +91,6 @@ function errorCode(error: unknown): string | undefined {
   return error && typeof error === "object" && "code" in error ? String((error as { code?: unknown }).code) : undefined;
 }
 
-function processAlive(pid: number): boolean {
-  try { process.kill(pid, 0); return true; } catch { return false; }
-}
-
 export class NativeProfileManager {
   readonly context: NativeProfileContext;
   private readonly keyProvider: NativeProfileKeyProvider;
@@ -105,6 +101,9 @@ export class NativeProfileManager {
   private readonly now: () => number;
   private readonly uuid: () => string;
   private readonly sleep: (ms: number) => Promise<void>;
+  private readonly lockWaitMs: number;
+  private readonly onLockAcquired: () => void | Promise<void>;
+  private readonly removeStageTree: (path: string) => void;
 
   constructor(options: NativeProfileManagerOptions = {}) {
     this.context = resolveNativeProfileContext(options);
@@ -116,6 +115,9 @@ export class NativeProfileManager {
     this.now = options.now ?? Date.now;
     this.uuid = options.randomUUID ?? randomUUID;
     this.sleep = options.sleep ?? (ms => Bun.sleep(ms));
+    this.lockWaitMs = options.lockWaitMs ?? LOCK_WAIT_MS;
+    this.onLockAcquired = options.onLockAcquired ?? (() => {});
+    this.removeStageTree = options.removeStageTree ?? (path => rmSync(path, { recursive: true, force: false }));
   }
 
   private async ensureRoot(): Promise<void> {
@@ -123,79 +125,57 @@ export class NativeProfileManager {
     await this.hardenPath(this.context.rootDir);
   }
 
-  private isLockStale(): boolean {
-    const observedAt = this.now();
-    let pathAgeMs: number;
+  private async ensureLockDatabase(): Promise<void> {
+    let database: Database | undefined;
     try {
-      pathAgeMs = Math.max(0, observedAt - lstatSync(this.context.lockPath).mtimeMs);
-    } catch (error) {
-      return errorCode(error) === "ENOENT";
+      database = new Database(this.context.lockPath, { create: true });
+    } catch {
+      throw new NativeProfileError("PROFILE_LOCK_UNAVAILABLE", "The native-profile lock is unavailable.", 503, true);
+    } finally {
+      try { database?.close(); } catch { /* acquisition already failed */ }
     }
     try {
-      const lock = JSON.parse(readFileSync(this.context.lockPath, "utf8")) as { pid?: unknown; acquiredAt?: unknown };
-      if (typeof lock.pid === "number" && processAlive(lock.pid)) return false;
-      return typeof lock.acquiredAt === "number"
-        ? observedAt - lock.acquiredAt > LOCK_STALE_MS
-        : pathAgeMs > LOCK_METADATA_GRACE_MS;
+      try { chmodSync(this.context.lockPath, 0o600); } catch { /* Windows ACL below is authoritative there. */ }
+      await this.hardenPath(this.context.lockPath);
     } catch {
-      return pathAgeMs > LOCK_METADATA_GRACE_MS;
+      throw new NativeProfileError("PROFILE_LOCK_UNAVAILABLE", "The native-profile lock could not be permission-hardened.", 503, true);
     }
   }
 
-  private releaseLock(ownerToken: string): void {
-    try {
-      const lock = JSON.parse(readFileSync(this.context.lockPath, "utf8")) as { ownerToken?: unknown };
-      if (lock.ownerToken !== ownerToken) return;
-    } catch (error) {
-      if (errorCode(error) === "ENOENT") return;
-      return;
-    }
-    try { unlinkSync(this.context.lockPath); } catch (error) { if (errorCode(error) !== "ENOENT") throw error; }
+  private isLockBusy(error: unknown): boolean {
+    const code = errorCode(error);
+    const message = error instanceof Error ? error.message : String(error);
+    return code === "SQLITE_BUSY" || code === "SQLITE_LOCKED" || /database (?:is|table is) locked/i.test(message);
   }
 
   private async withLock<T>(operation: () => Promise<T>): Promise<T> {
     await this.ensureRoot();
-    const deadline = this.now() + LOCK_WAIT_MS;
-    let ownerToken: string | null = null;
-    while (ownerToken === null) {
-      const candidateToken = this.uuid();
-      const candidatePath = `${this.context.lockPath}.${candidateToken}.candidate`;
-      let candidateFd: number | null = null;
+    await this.ensureLockDatabase();
+    const deadline = this.now() + this.lockWaitMs;
+    let database: Database | undefined;
+    while (!database) {
+      let candidate: Database | undefined;
       try {
-        candidateFd = openSync(candidatePath, "wx", 0o600);
-        writeFileSync(candidateFd, serializeNativeProfileMetadata({
-          pid: process.pid,
-          acquiredAt: this.now(),
-          homeId: this.context.homeId,
-          ownerToken: candidateToken,
-        }));
-        closeSync(candidateFd);
-        candidateFd = null;
-        await this.hardenPath(candidatePath);
-        linkSync(candidatePath, this.context.lockPath);
-        unlinkSync(candidatePath);
-        ownerToken = candidateToken;
+        candidate = new Database(this.context.lockPath, { create: true });
+        candidate.exec("PRAGMA busy_timeout = 0; BEGIN IMMEDIATE");
+        database = candidate;
       } catch (error) {
-        if (candidateFd !== null) try { closeSync(candidateFd); } catch { /* reported below */ }
-        try { unlinkSync(candidatePath); } catch (cleanupError) { if (errorCode(cleanupError) !== "ENOENT") { /* reported below */ } }
-        if (errorCode(error) !== "EEXIST") {
-          try { this.releaseLock(candidateToken); } catch { /* reported below */ }
+        try { candidate?.close(); } catch { /* acquisition already failed */ }
+        if (!this.isLockBusy(error)) {
           throw new NativeProfileError("PROFILE_LOCK_UNAVAILABLE", "The native-profile lock is unavailable.", 503, true);
         }
-        if (this.isLockStale()) {
-          try { unlinkSync(this.context.lockPath); } catch (unlinkError) { if (errorCode(unlinkError) !== "ENOENT") throw unlinkError; }
-          continue;
-        }
         if (this.now() >= deadline) {
-          throw new NativeProfileError("PROFILE_LOCK_UNAVAILABLE", "Another native-profile operation is still running.", 503, true);
+          throw new NativeProfileError("NATIVE_PROFILE_BUSY", "Another native-profile operation is still running.", 503, true);
         }
         await this.sleep(50);
       }
     }
     try {
+      await this.onLockAcquired();
       return await operation();
     } finally {
-      this.releaseLock(ownerToken);
+      try { database.exec("ROLLBACK"); } catch { /* close still releases the OS-backed lock */ }
+      try { database.close(); } catch { /* transaction is already ending */ }
     }
   }
 
@@ -308,6 +288,8 @@ export class NativeProfileManager {
   }
 
   async doctor(): Promise<Record<string, unknown>> {
+    return this.withLock(async () => {
+    this.sweepStaleStages();
     const mode = (() => {
       try { return resolveNativeCredentialStoreMode(this.context); } catch { return "unknown"; }
     })();
@@ -338,6 +320,7 @@ export class NativeProfileManager {
       recoveryPending: existsSync(this.context.journalPath),
       stagingCount,
     };
+    });
   }
 
   private stagePath(stageId: string): string {
@@ -345,7 +328,7 @@ export class NativeProfileManager {
     return join(this.context.stagingRoot, stageId);
   }
 
-  private verifiedStagePath(stageId: string): string {
+  private verifiedStagePath(stageId: string, requireFresh = true): string {
     const expected = resolve(this.stagePath(stageId));
     try {
       if (lstatSync(expected).isSymbolicLink() || !lstatSync(expected).isDirectory()) throw new Error("stage type");
@@ -355,7 +338,8 @@ export class NativeProfileManager {
       if (!rel || rel.startsWith("..") || rel.includes(sep)) throw new Error("stage root");
       const metadata = JSON.parse(readFileSync(join(canonicalExpected, "stage.json"), "utf8")) as Record<string, unknown>;
       if (metadata.version !== 1 || metadata.stageId !== stageId || metadata.homeId !== this.context.homeId) throw new Error("stage metadata");
-      if (typeof metadata.createdAt !== "number" || this.now() - metadata.createdAt > STAGE_MAX_AGE_MS) throw new Error("stage age");
+      if (typeof metadata.createdAt !== "number") throw new Error("stage age");
+      if (requireFresh && this.now() - metadata.createdAt > STAGE_MAX_AGE_MS) throw new Error("stage age");
       return canonicalExpected;
     } catch {
       throw new NativeProfileError("STAGING_NOT_FOUND", "The native-login staging session is missing, expired, or invalid.", 404);
@@ -364,12 +348,66 @@ export class NativeProfileManager {
 
   private deleteStage(path: string): void {
     const authPath = join(path, "auth.json");
-    if (existsSync(authPath)) truncateSync(authPath, 0);
-    rmSync(path, { recursive: true, force: false });
+    try {
+      const authStat = lstatSync(authPath);
+      if (authStat.isFile() && !authStat.isSymbolicLink()) truncateSync(authPath, 0);
+    } catch { /* removal below is authoritative */ }
+    this.removeStageTree(path);
+  }
+
+  private deleteStageById(stageId: string): void {
+    const expected = resolve(this.stagePath(stageId));
+    let stageStat: ReturnType<typeof lstatSync>;
+    try { stageStat = lstatSync(expected); } catch (error) { if (errorCode(error) === "ENOENT") return; throw error; }
+    if (stageStat.isSymbolicLink() || !stageStat.isDirectory()) {
+      unlinkSync(expected);
+      return;
+    }
+    const canonicalRoot = resolve(realpathSync.native(this.context.stagingRoot));
+    const canonicalExpected = resolve(realpathSync.native(expected));
+    const rel = relative(canonicalRoot, canonicalExpected);
+    if (!rel || rel.startsWith("..") || rel.includes(sep)) {
+      throw new NativeProfileError("STAGING_CLEANUP_REQUIRED", "The staging path could not be safely removed.", 500);
+    }
+    this.deleteStage(canonicalExpected);
+  }
+
+  private sweepStaleStages(): number {
+    if (!existsSync(this.context.stagingRoot)) return 0;
+    let removed = 0;
+    for (const name of readdirSync(this.context.stagingRoot)) {
+      if (!UUID_RE.test(name)) continue;
+      const path = this.stagePath(name);
+      let createdAt: number;
+      try {
+        const stageStat = lstatSync(path);
+        createdAt = stageStat.mtimeMs;
+        if (stageStat.isDirectory() && !stageStat.isSymbolicLink()) {
+          try {
+            const metadata = JSON.parse(readFileSync(join(path, "stage.json"), "utf8")) as Record<string, unknown>;
+            if (metadata.version === 1 && metadata.stageId === name && metadata.homeId === this.context.homeId && typeof metadata.createdAt === "number") {
+              createdAt = metadata.createdAt;
+            }
+          } catch { /* mtime bounds malformed crash residue */ }
+        }
+      } catch (error) {
+        if (errorCode(error) === "ENOENT") continue;
+        throw error;
+      }
+      if (this.now() - createdAt <= STAGE_MAX_AGE_MS) continue;
+      try {
+        this.deleteStageById(name);
+        removed += 1;
+      } catch {
+        throw new NativeProfileError("STAGING_CLEANUP_REQUIRED", "An expired native-login staging session could not be securely removed.", 500);
+      }
+    }
+    return removed;
   }
 
   async prepareStage(): Promise<{ stageId: string; stagingCodexHome: string; effectiveCodexHome: string }> {
     return this.withLock(async () => {
+      this.sweepStaleStages();
       requireFileCredentialStore(this.context);
       const vault = this.requireVault();
       const key = await this.keyForVault(vault);
@@ -397,14 +435,18 @@ export class NativeProfileManager {
 
   async finishStage(stageId: string, labelInput: string): Promise<{ effectiveCodexHome: string; profile: NativeProfilePublic }> {
     return this.withLock(async () => {
-      requireFileCredentialStore(this.context);
-      const label = validateNativeProfileLabel(labelInput);
-      const stagePath = this.verifiedStagePath(stageId);
-      const target = readNativeEnvelope(join(stagePath, "auth.json"));
-      const current = readNativeEnvelope(this.context.authPath);
-      const vault = this.requireVault();
-      const key = await this.keyForVault(vault);
+      this.stagePath(stageId);
+      let target: NativeEnvelopeSnapshot | null = null;
+      let current: NativeEnvelopeSnapshot | null = null;
+      let key: NativeProfileKey | null = null;
       try {
+        const stagePath = this.verifiedStagePath(stageId);
+        requireFileCredentialStore(this.context);
+        const label = validateNativeProfileLabel(labelInput);
+        target = readNativeEnvelope(join(stagePath, "auth.json"));
+        current = readNativeEnvelope(this.context.authPath);
+        const vault = this.requireVault();
+        key = await this.keyForVault(vault);
         this.assertCurrentIdentity(vault, current, key);
         assertUniqueNativeProfileLabel(vault, label);
         const identityHash = nativeIdentityHash(key.key, target.accountId);
@@ -426,26 +468,31 @@ export class NativeProfileManager {
         vault.profiles.push(profile);
         vault.revision += 1;
         await this.writeVault(vault);
+        return { effectiveCodexHome: this.context.codexHome, profile: publicNativeProfile(profile) };
+      } finally {
+        target?.raw.fill(0);
+        current?.raw.fill(0);
+        key?.key.fill(0);
         try {
-          this.deleteStage(stagePath);
+          this.deleteStageById(stageId);
         } catch {
           throw new NativeProfileError(
             "STAGING_CLEANUP_REQUIRED",
-            "The profile was encrypted, but the restricted staging credential could not be removed; run recover after fixing filesystem permissions.",
+            "The native-login staging session could not be securely removed; fix filesystem permissions and cancel it explicitly.",
             500,
           );
         }
-        return { effectiveCodexHome: this.context.codexHome, profile: publicNativeProfile(profile) };
-      } finally {
-        target.raw.fill(0);
-        current.raw.fill(0);
-        key.key.fill(0);
       }
     });
   }
 
   async cancelStage(stageId: string): Promise<void> {
-    await this.withLock(async () => { this.deleteStage(this.verifiedStagePath(stageId)); });
+    await this.withLock(async () => {
+      try { this.deleteStageById(stageId); } catch (error) {
+        if (error instanceof NativeProfileError) throw error;
+        throw new NativeProfileError("STAGING_CLEANUP_REQUIRED", "The native-login staging session could not be securely removed.", 500);
+      }
+    });
   }
 
   private resolveTarget(vault: NativeMainProfileVaultV1, target: string): NativeMainProfileRecordV1 {
@@ -469,6 +516,7 @@ export class NativeProfileManager {
 
   async switch(targetSelector: string, confirmedStopped = false): Promise<Record<string, unknown>> {
     return this.withLock(async () => {
+      this.sweepStaleStages();
       requireFileCredentialStore(this.context);
       await this.assertNativeCodexStopped(confirmedStopped);
       if (readNativeProfileJournal(this.context)) await this.recoverLocked(false);
diff --git a/src/codex/native-profile-types.ts b/src/codex/native-profile-types.ts
index 4a6593878..a58f86b82 100644
--- a/src/codex/native-profile-types.ts
+++ b/src/codex/native-profile-types.ts
@@ -12,6 +12,7 @@ export type NativeProfileErrorCode =
   | "KEYRING_UNAVAILABLE"
   | "KEYRING_KEY_MISSING"
   | "PROFILE_LOCK_UNAVAILABLE"
+  | "NATIVE_PROFILE_BUSY"
   | "CODEX_BUSY"
   | "CODEX_PROCESS_CHECK_UNAVAILABLE"
   | "MAIN_REQUESTS_ACTIVE"
diff --git a/tests/cli-native-profile.test.ts b/tests/cli-native-profile.test.ts
index 6b6dfc65d..c9d25f46a 100644
--- a/tests/cli-native-profile.test.ts
+++ b/tests/cli-native-profile.test.ts
@@ -65,4 +65,52 @@ describe("ocx account main", () => {
     expect(await cmdAccount(["main", "recover", "--rollback", "--yes"], deps)).toBe(0);
     expect(requests.at(-1)?.body).toEqual({ rollback: true, confirmedStopped: true });
   });
+
+  test("add cancels server staging after a non-200 finish response", async () => {
+    const stagingHome = join(tmpdir(), "ocx-native-profile-stage-non-200");
+    const requests: string[] = [];
+    const fetchImpl: typeof fetch = async input => {
+      const path = new URL(String(input)).pathname;
+      requests.push(path);
+      if (path.endsWith("/stage") && !path.endsWith("/finish")) {
+        return Response.json({ stageId: "22222222-2222-4222-8222-222222222222", stagingCodexHome: stagingHome });
+      }
+      if (path.endsWith("/stage/finish")) return Response.json({ error: "validation failed" }, { status: 409 });
+      return Response.json({ ok: true });
+    };
+
+    expect(await cmdAccount(["main", "add", "work"], {
+      baseUrl: "http://127.0.0.1:10100",
+      fetchImpl,
+      runCodexLoginImpl: async () => 0,
+    })).toBe(1);
+    expect(requests).toEqual([
+      "/api/native-main-profiles/stage",
+      "/api/native-main-profiles/stage/finish",
+      "/api/native-main-profiles/stage/cancel",
+    ]);
+  });
+
+  test("add cancels server staging when official login aborts", async () => {
+    const stagingHome = join(tmpdir(), "ocx-native-profile-stage-abort");
+    const requests: string[] = [];
+    const fetchImpl: typeof fetch = async input => {
+      const path = new URL(String(input)).pathname;
+      requests.push(path);
+      if (path.endsWith("/stage") && !path.endsWith("/finish")) {
+        return Response.json({ stageId: "33333333-3333-4333-8333-333333333333", stagingCodexHome: stagingHome });
+      }
+      return Response.json({ ok: true });
+    };
+
+    expect(await cmdAccount(["main", "add", "work"], {
+      baseUrl: "http://127.0.0.1:10100",
+      fetchImpl,
+      runCodexLoginImpl: async () => { throw new Error("login aborted"); },
+    })).toBe(1);
+    expect(requests).toEqual([
+      "/api/native-main-profiles/stage",
+      "/api/native-main-profiles/stage/cancel",
+    ]);
+  });
 });
diff --git a/tests/helpers/native-profile-lock-child.ts b/tests/helpers/native-profile-lock-child.ts
new file mode 100644
index 000000000..3c962752f
--- /dev/null
+++ b/tests/helpers/native-profile-lock-child.ts
@@ -0,0 +1,26 @@
+import { existsSync, writeFileSync } from "node:fs";
+
+import { NativeProfileManager } from "../../src/codex/native-profile-manager";
+
+const codexHome = process.env.NATIVE_PROFILE_TEST_CODEX_HOME;
+const configDir = process.env.NATIVE_PROFILE_TEST_CONFIG_DIR;
+const readyPath = process.env.NATIVE_PROFILE_TEST_READY;
+const releasePath = process.env.NATIVE_PROFILE_TEST_RELEASE;
+
+if (!codexHome || !configDir || !readyPath || !releasePath) {
+  throw new Error("native-profile lock child is missing required test paths");
+}
+
+const manager = new NativeProfileManager({
+  codexHome,
+  configDir,
+  hardenPath: async () => {},
+  lockWaitMs: 5_000,
+  onLockAcquired: async () => {
+    writeFileSync(readyPath, "ready");
+    if (process.env.NATIVE_PROFILE_TEST_CRASH === "1") process.exit(0);
+    while (!existsSync(releasePath)) await Bun.sleep(10);
+  },
+});
+
+await manager.recover(false);
diff --git a/tests/native-profile-manager.test.ts b/tests/native-profile-manager.test.ts
index 97b14da53..4e9406033 100644
--- a/tests/native-profile-manager.test.ts
+++ b/tests/native-profile-manager.test.ts
@@ -70,35 +70,154 @@ async function enrolledFixture() {
   return { ...f, manager, sourceProfile: sourceProfile.profile, targetProfile: targetProfile.profile, stage };
 }
 
+async function waitForPath(path: string): Promise<void> {
+  const deadline = Date.now() + 5_000;
+  while (!existsSync(path) && Date.now() < deadline) await Bun.sleep(10);
+  if (!existsSync(path)) throw new Error(`Timed out waiting for child marker ${path}`);
+}
+
+function spawnLockHolder(
+  f: ReturnType<typeof fixture>,
+  readyPath: string,
+  releasePath: string,
+  crash = false,
+): ReturnType<typeof Bun.spawn> {
+  return Bun.spawn([process.execPath, join(import.meta.dir, "helpers", "native-profile-lock-child.ts")], {
+    cwd: join(import.meta.dir, ".."),
+    env: {
+      ...process.env,
+      NATIVE_PROFILE_TEST_CODEX_HOME: f.codexHome,
+      NATIVE_PROFILE_TEST_CONFIG_DIR: f.configDir,
+      NATIVE_PROFILE_TEST_READY: readyPath,
+      NATIVE_PROFILE_TEST_RELEASE: releasePath,
+      NATIVE_PROFILE_TEST_CRASH: crash ? "1" : "0",
+    },
+    stdin: "ignore",
+    stdout: "pipe",
+    stderr: "pipe",
+  });
+}
+
 describe("native main profile transactions", () => {
-  test("does not reclaim a fresh lock before its owner metadata is stable", async () => {
+  test("an abruptly exited child releases the OS-backed profile transaction", async () => {
+    const f = fixture();
+    const readyPath = join(f.root, "crash-ready");
+    const child = spawnLockHolder(f, readyPath, join(f.root, "unused-release"), true);
+    await waitForPath(readyPath);
+    expect(await child.exited).toBe(0);
+
+    const successor = new NativeProfileManager({ ...f.options, lockWaitMs: 250 });
+    expect((await successor.recover(false)).recovered).toBe(false);
+  }, 15_000);
+
+  test("two processes exclude each other and predecessor release cannot delete a successor lock", async () => {
+    const f = fixture();
+    const firstReady = join(f.root, "first-ready");
+    const firstRelease = join(f.root, "first-release");
+    const secondReady = join(f.root, "second-ready");
+    const secondRelease = join(f.root, "second-release");
+    const first = spawnLockHolder(f, firstReady, firstRelease);
+    let second: ReturnType<typeof Bun.spawn> | undefined;
+    try {
+      await waitForPath(firstReady);
+      second = spawnLockHolder(f, secondReady, secondRelease);
+      await Bun.sleep(150);
+      expect(existsSync(secondReady)).toBe(false);
+
+      writeFileSync(firstRelease, "release");
+      expect(await first.exited).toBe(0);
+      await waitForPath(secondReady);
+
+      const contender = new NativeProfileManager({ ...f.options, lockWaitMs: 100 });
+      let caught: unknown;
+      try { await contender.recover(false); } catch (error) { caught = error; }
+      expect(caught).toBeInstanceOf(NativeProfileError);
+      expect((caught as NativeProfileError).code).toBe("NATIVE_PROFILE_BUSY");
+      expect((caught as NativeProfileError).retryable).toBe(true);
+
+      writeFileSync(secondRelease, "release");
+      expect(await second.exited).toBe(0);
+      expect((await contender.recover(false)).recovered).toBe(false);
+    } finally {
+      try { writeFileSync(firstRelease, "release"); } catch { /* fixture cleanup */ }
+      try { writeFileSync(secondRelease, "release"); } catch { /* fixture cleanup */ }
+      if (first.exitCode === null) first.kill();
+      if (second?.exitCode === null) second.kill();
+      await first.exited;
+      if (second) await second.exited;
+    }
+  }, 15_000);
+
+  test("finish removes staging after auth validation failure", async () => {
+    const f = fixture();
+    const manager = new NativeProfileManager(f.options);
+    await manager.register("personal");
+    const stage = await manager.prepareStage();
+    writeFileSync(join(stage.stagingCodexHome, "auth.json"), "{}\n");
+
+    let caught: unknown;
+    try { await manager.finishStage(stage.stageId, "invalid"); } catch (error) { caught = error; }
+    expect(caught).toBeInstanceOf(NativeProfileError);
+    expect(existsSync(stage.stagingCodexHome)).toBe(false);
+  });
+
+  test("finish removes staging after vault persistence failure", async () => {
     const f = fixture();
-    const now = Date.now();
-    const manager = new NativeProfileManager({
+    const manager = new NativeProfileManager(f.options);
+    await manager.register("personal");
+    const stage = await manager.prepareStage();
+    writeFileSync(join(stage.stagingCodexHome, "auth.json"), f.target);
+    const failing = new NativeProfileManager({
       ...f.options,
-      now: () => now,
-      sleep: async () => { throw new Error("lock remains owned"); },
+      atomicWrite: async (path, content) => {
+        if (path === manager.context.vaultPath) throw new Error("injected vault failure");
+        return atomic(path, content);
+      },
     });
-    mkdirSync(manager.context.rootDir, { recursive: true });
-    writeFileSync(manager.context.lockPath, "");
 
     let caught: unknown;
-    try { await manager.recover(false); } catch (error) { caught = error; }
-
+    try { await failing.finishStage(stage.stageId, "work"); } catch (error) { caught = error; }
     expect(caught).toBeInstanceOf(Error);
-    expect((caught as Error).message).toBe("lock remains owned");
-    expect(existsSync(manager.context.lockPath)).toBe(true);
+    expect(existsSync(stage.stagingCodexHome)).toBe(false);
   });
 
-  test("does not unlink a lock published by a different owner", () => {
+  test("expired stages can be cancelled and are swept before preparing another stage", async () => {
     const f = fixture();
-    const manager = new NativeProfileManager(f.options);
-    mkdirSync(manager.context.rootDir, { recursive: true });
-    writeFileSync(manager.context.lockPath, JSON.stringify({ ownerToken: "new-owner" }));
+    let now = Date.now();
+    const manager = new NativeProfileManager({ ...f.options, now: () => now });
+    await manager.register("personal");
+    const cancelled = await manager.prepareStage();
+    writeFileSync(join(cancelled.stagingCodexHome, "auth.json"), f.target);
+    now += 31 * 60_000;
+    await manager.cancelStage(cancelled.stageId);
+    expect(existsSync(cancelled.stagingCodexHome)).toBe(false);
 
-    (manager as unknown as { releaseLock: (ownerToken: string) => void }).releaseLock("old-owner");
+    const stale = await manager.prepareStage();
+    writeFileSync(join(stale.stagingCodexHome, "auth.json"), f.target);
+    now += 31 * 60_000;
+    const fresh = await manager.prepareStage();
+    expect(existsSync(stale.stagingCodexHome)).toBe(false);
+    expect(existsSync(fresh.stagingCodexHome)).toBe(true);
+    await manager.cancelStage(fresh.stageId);
+  });
 
-    expect(existsSync(manager.context.lockPath)).toBe(true);
+  test("finish reports cleanup failure instead of claiming success", async () => {
+    const f = fixture();
+    const manager = new NativeProfileManager(f.options);
+    await manager.register("personal");
+    const stage = await manager.prepareStage();
+    writeFileSync(join(stage.stagingCodexHome, "auth.json"), f.target);
+    const failing = new NativeProfileManager({
+      ...f.options,
+      removeStageTree: () => { throw new Error("injected cleanup failure"); },
+    });
+
+    let caught: unknown;
+    try { await failing.finishStage(stage.stageId, "work"); } catch (error) { caught = error; }
+    expect(caught).toBeInstanceOf(NativeProfileError);
+    expect((caught as NativeProfileError).code).toBe("STAGING_CLEANUP_REQUIRED");
+    expect(existsSync(stage.stagingCodexHome)).toBe(true);
+    await manager.cancelStage(stage.stageId);
   });
 
   test("preserves exact auth bytes, encrypts inactive profiles, and leaves task/history files untouched", async () => {

From 884c88ab4ce1cfacbd1bdb46c59ad68e5881d41f Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Sun, 2 Aug 2026 10:26:00 +0900
Subject: [PATCH 07/63] test: cover native profile route admission

---
 src/server/index.ts                         |  23 ++-
 src/server/management-api.ts                |   2 +-
 src/server/management/context.ts            |   6 +
 tests/native-profile-route-security.test.ts | 165 ++++++++++++++++++++
 4 files changed, 190 insertions(+), 6 deletions(-)
 create mode 100644 tests/native-profile-route-security.test.ts

diff --git a/src/server/index.ts b/src/server/index.ts
index 5220a4d17..3c13c42d4 100644
--- a/src/server/index.ts
+++ b/src/server/index.ts
@@ -156,8 +156,14 @@ import { runClaudeAuthModeMigration } from "../claude/auth-mode-migration";
 import { handleImages } from "./images";
 import { handleLive, logLiveSidebandFrame, parseLiveSidebandTarget, resolveLiveSidebandUpgrade } from "./live";
 import { handleSearch } from "./search";
-import { fetchAllModels, handleManagementAPI, VERSION } from "./management-api";
-import { initializeManagementAuthState, issueGuiSession, managementPrincipal, requireManagementAuth } from "./management-auth";
+import { fetchAllModels, handleManagementAPI, VERSION, type ManagementApiDeps } from "./management-api";
+import {
+  initializeManagementAuthState,
+  issueGuiSession,
+  managementPrincipal,
+  requireManagementAuth,
+  type ManagementAuthState,
+} from "./management-auth";
 
 const MAX_WS_FRAME_BYTES = 50 * 1024 * 1024;
 const WEBSOCKET_IDLE_TIMEOUT_SECONDS = 0;
@@ -271,12 +277,19 @@ function attachLiveSidebandUpstream(ws: ServerWebSocket<WsData>): void {
 // trackSseForRequestLog(
 // export function relaySseWithHeartbeat
 
-export function startServer(port?: number) {
+export interface StartServerDeps {
+  /** Test-only seam; production always initializes its own management credential state. */
+  managementAuthState?: ManagementAuthState;
+  /** Test-only route dependencies, forwarded only after management admission succeeds. */
+  managementApi?: ManagementApiDeps;
+}
+
+export function startServer(port?: number, deps: StartServerDeps = {}) {
   const config = runAlibabaRegionStartupMigration(runOpenAiTierStartupMigration(loadConfig()));
   setLiveStateStoreConfig(config);
   applyProxyEnv(config);
   assertServerAuthConfig(config);
-  const managementAuth = initializeManagementAuthState(config);
+  const managementAuth = deps.managementAuthState ?? initializeManagementAuthState(config);
   // Refresh OAuth provider presets (models/noReasoningModels) from the registry so a proxy update
   // adding/dropping models reaches existing configs on start — not just fresh installs.
   reconcileOAuthProviders(config);
@@ -452,7 +465,7 @@ export function startServer(port?: number) {
         // gate used. Consent-bearing routes need this: request headers are forgeable
         // by anything holding the admin token, the credential is not.
         const principal = managementPrincipal(req, managementAuth, config) ?? undefined;
-        const mgmtResponse = await handleManagementAPI(req, url, config, {}, principal);
+        const mgmtResponse = await handleManagementAPI(req, url, config, deps.managementApi, principal);
         if (mgmtResponse) return withManagementCors(mgmtResponse, req, config);
         return withManagementCors(formatErrorResponse(404, "not_found", `Unknown endpoint: ${req.method} ${url.pathname}`), req, config);
       }
diff --git a/src/server/management-api.ts b/src/server/management-api.ts
index 801352e34..0a4f7cb7b 100644
--- a/src/server/management-api.ts
+++ b/src/server/management-api.ts
@@ -194,7 +194,7 @@ export async function handleManagementAPI(
 
   if (url.pathname.startsWith("/api/native-main-profiles")) {
     const { handleNativeProfileAPI } = await import("../codex/native-profile-api");
-    return handleNativeProfileAPI(req, url, config);
+    return handleNativeProfileAPI(req, url, config, deps.nativeProfileApi);
   }
 
   if (url.pathname.startsWith("/api/codex-auth/")) {
diff --git a/src/server/management/context.ts b/src/server/management/context.ts
index 437422b96..23bb039bb 100644
--- a/src/server/management/context.ts
+++ b/src/server/management/context.ts
@@ -1,4 +1,5 @@
 import type { OcxConfig } from "../../types";
+import type { NativeProfileApiDeps } from "../../codex/native-profile-api";
 import type { StartupInstallAction } from "../startup-action-control";
 import type { ManagementPrincipal } from "../management-auth";
 
@@ -20,6 +21,11 @@ export interface ManagementApiDeps {
     action: StartupInstallAction,
     options?: { repair?: boolean },
   ) => Promise<{ message: string }>;
+  /**
+   * Native-main profile persistence seam for server-boundary tests. Production
+   * leaves this unset, so the route creates its normal NativeProfileManager.
+   */
+  nativeProfileApi?: NativeProfileApiDeps;
 }
 
 
diff --git a/tests/native-profile-route-security.test.ts b/tests/native-profile-route-security.test.ts
new file mode 100644
index 000000000..a480bf826
--- /dev/null
+++ b/tests/native-profile-route-security.test.ts
@@ -0,0 +1,165 @@
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { saveConfig } from "../src/config";
+import type { NativeProfileManager } from "../src/codex/native-profile-manager";
+import { startServer } from "../src/server";
+import { initializeManagementAuthState, issueGuiSession, type ManagementAuthState } from "../src/server/management-auth";
+import type { OcxConfig } from "../src/types";
+import { SERVER_BUDGET_MS } from "./helpers/test-budget";
+
+const previousHome = process.env.HOME;
+const previousOpenCodexHome = process.env.OPENCODEX_HOME;
+const previousCodexHome = process.env.CODEX_HOME;
+const previousAdminToken = process.env.OPENCODEX_ADMIN_AUTH_TOKEN;
+const previousDataToken = process.env.OPENCODEX_API_AUTH_TOKEN;
+let testHome = "";
+
+interface NativeOperation {
+  name: string;
+  path: string;
+  method: "GET" | "POST";
+  body?: Record<string, unknown>;
+}
+
+const operations: readonly NativeOperation[] = [
+  { name: "list", path: "/api/native-main-profiles", method: "GET" },
+  { name: "doctor", path: "/api/native-main-profiles/doctor", method: "GET" },
+  { name: "register", path: "/api/native-main-profiles/register", method: "POST", body: { label: "Test profile" } },
+  { name: "stage", path: "/api/native-main-profiles/stage", method: "POST" },
+  { name: "stage finish", path: "/api/native-main-profiles/stage/finish", method: "POST", body: { stageId: "stage-1", label: "Test profile" } },
+  { name: "stage cancel", path: "/api/native-main-profiles/stage/cancel", method: "POST", body: { stageId: "stage-1" } },
+  { name: "switch", path: "/api/native-main-profiles/switch", method: "POST", body: { target: "profile-1", confirmedStopped: true } },
+  { name: "recover", path: "/api/native-main-profiles/recover", method: "POST", body: { rollback: true, confirmedStopped: true } },
+];
+
+function loopbackConfig(): OcxConfig {
+  return {
+    port: 0,
+    hostname: "127.0.0.1",
+    defaultProvider: "test",
+    providers: {
+      test: {
+        adapter: "openai-chat",
+        baseUrl: "https://example.test/v1",
+        disabled: true,
+      },
+    },
+  };
+}
+
+function testManager(calls: string[]): NativeProfileManager {
+  const dispatched = (operation: string) => {
+    calls.push(operation);
+    return { operation };
+  };
+  return {
+    list: async () => dispatched("list"),
+    doctor: async () => dispatched("doctor"),
+    register: async () => dispatched("register"),
+    prepareStage: async () => dispatched("stage"),
+    finishStage: async () => dispatched("stage finish"),
+    cancelStage: async () => { dispatched("stage cancel"); },
+    switch: async () => dispatched("switch"),
+    recover: async () => dispatched("recover"),
+  } as unknown as NativeProfileManager;
+}
+
+beforeEach(() => {
+  testHome = mkdtempSync(join(tmpdir(), "ocx-native-profile-route-security-"));
+  process.env.HOME = testHome;
+  process.env.OPENCODEX_HOME = testHome;
+  process.env.CODEX_HOME = join(testHome, "codex-home");
+  process.env.OPENCODEX_ADMIN_AUTH_TOKEN = "native-main-admin-token";
+  delete process.env.OPENCODEX_API_AUTH_TOKEN;
+});
+
+afterEach(() => {
+  if (previousHome === undefined) delete process.env.HOME;
+  else process.env.HOME = previousHome;
+  if (previousOpenCodexHome === undefined) delete process.env.OPENCODEX_HOME;
+  else process.env.OPENCODEX_HOME = previousOpenCodexHome;
+  if (previousCodexHome === undefined) delete process.env.CODEX_HOME;
+  else process.env.CODEX_HOME = previousCodexHome;
+  if (previousAdminToken === undefined) delete process.env.OPENCODEX_ADMIN_AUTH_TOKEN;
+  else process.env.OPENCODEX_ADMIN_AUTH_TOKEN = previousAdminToken;
+  if (previousDataToken === undefined) delete process.env.OPENCODEX_API_AUTH_TOKEN;
+  else process.env.OPENCODEX_API_AUTH_TOKEN = previousDataToken;
+  if (testHome) rmSync(testHome, { recursive: true, force: true });
+  testHome = "";
+});
+
+describe("native-main profile routes at the management admission boundary", () => {
+  test("rejects missing or wrong credentials and hostile origins before every native operation dispatches", async () => {
+    const config = loopbackConfig();
+    saveConfig(config);
+    const calls: string[] = [];
+    const server = startServer(0, { managementApi: { nativeProfileApi: { manager: testManager(calls) } } });
+    try {
+      for (const operation of operations) {
+        const request = (headers: HeadersInit = {}) => fetch(new URL(operation.path, server.url), {
+          method: operation.method,
+          headers: operation.body ? { "content-type": "application/json", ...headers } : headers,
+          body: operation.body ? JSON.stringify(operation.body) : undefined,
+        });
+
+        expect((await request()).status).toBe(401);
+        expect((await request({ "x-opencodex-api-key": "wrong-admin-token" })).status).toBe(401);
+        expect((await request({
+          "x-opencodex-api-key": "native-main-admin-token",
+          origin: "https://attacker.example",
+        })).status).toBe(403);
+        expect(calls).toEqual([]);
+
+        expect((await request({ "x-opencodex-api-key": "native-main-admin-token" })).status).toBe(200);
+        expect(calls).toEqual([operation.name]);
+        calls.length = 0;
+      }
+    } finally {
+      await server.stop(true);
+    }
+  }, SERVER_BUDGET_MS);
+
+  test("requires a same-origin GUI session CSRF token for every native mutation before dispatch", async () => {
+    const config = loopbackConfig();
+    saveConfig(config);
+    const calls: string[] = [];
+    const managementAuth: ManagementAuthState = initializeManagementAuthState(config);
+    const server = startServer(0, {
+      managementAuthState: managementAuth,
+      managementApi: { nativeProfileApi: { manager: testManager(calls) } },
+    });
+    try {
+      const session = issueGuiSession(new Request(new URL("/", server.url), {
+        headers: { Host: server.url.host },
+      }), config, managementAuth);
+      expect(session).not.toBeNull();
+      if (!session) throw new Error("expected a loopback GUI session");
+
+      for (const operation of operations.filter(operation => operation.method === "POST")) {
+        const request = (csrf?: string) => fetch(new URL(operation.path, server.url), {
+          method: "POST",
+          headers: {
+            "content-type": "application/json",
+            Origin: server.url.origin,
+            "x-opencodex-api-key": session.token,
+            "x-opencodex-gui-origin": server.url.origin,
+            ...(csrf === undefined ? {} : { "x-opencodex-csrf-token": csrf }),
+          },
+          body: operation.body ? JSON.stringify(operation.body) : undefined,
+        });
+
+        expect((await request()).status).toBe(401);
+        expect((await request("wrong-csrf-token")).status).toBe(401);
+        expect(calls).toEqual([]);
+
+        expect((await request(session.csrfToken)).status).toBe(200);
+        expect(calls).toEqual([operation.name]);
+        calls.length = 0;
+      }
+    } finally {
+      await server.stop(true);
+    }
+  }, SERVER_BUDGET_MS);
+});

From c252de94e9b053755a05abef1b5dcfbcc41e750a Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Sun, 2 Aug 2026 10:28:22 +0900
Subject: [PATCH 08/63] ci: verify release audit and OS keyring

---
 .github/workflows/ci.yml      | 60 ++++++++++++++++++++++++++++++++++-
 .github/workflows/release.yml | 29 ++++++++++++++++-
 package.json                  |  3 +-
 scripts/keyring-smoke.ts      | 57 +++++++++++++++++++++++++++++++++
 scripts/release.ts            |  4 ++-
 tests/keyring-smoke.test.ts   | 57 +++++++++++++++++++++++++++++++++
 6 files changed, 206 insertions(+), 4 deletions(-)
 create mode 100644 scripts/keyring-smoke.ts
 create mode 100644 tests/keyring-smoke.test.ts

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 51014e332..a1b0956e3 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -432,6 +432,64 @@ jobs:
       - name: CLI help smoke
         run: bun run src/cli/index.ts help
 
+  # Keep OS credential-store checks on disposable GitHub-hosted machines. The
+  # Windows platform leg may use the persistent ocx-home runner for trusted push
+  # events; a force-cancelled process cannot run its in-process finally cleanup.
+  keyring-smoke:
+    name: keyring ${{ matrix.name }}
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 8
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: ubuntu
+            runner: ubuntu-latest
+          - name: windows
+            runner: windows-latest
+          - name: macos
+            runner: macos-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: 1.3.14
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      # Linux hosted runners do not provide an unlocked desktop keyring session.
+      # Run Secret Service with temporary state instead of skipping Linux.
+      - name: Install Secret Service dependencies (Linux)
+        if: matrix.name == 'ubuntu'
+        shell: bash
+        run: |
+          set -euo pipefail
+          sudo apt-get update
+          sudo apt-get install --yes --no-install-recommends dbus-x11 gnome-keyring
+
+      - name: OS keyring create/read/delete smoke
+        shell: bash
+        run: |
+          set -euo pipefail
+          if [ "$RUNNER_OS" != "Linux" ]; then
+            bun run scripts/keyring-smoke.ts
+            exit 0
+          fi
+
+          keyring_home="$(mktemp -d)"
+          runtime_dir="$(mktemp -d)"
+          cleanup() { rm -rf "$keyring_home" "$runtime_dir"; }
+          trap cleanup EXIT
+          chmod 700 "$keyring_home" "$runtime_dir"
+          HOME="$keyring_home" XDG_RUNTIME_DIR="$runtime_dir" dbus-run-session -- bash -euo pipefail -c '
+            eval "$(gnome-keyring-daemon --start --components=secrets)"
+            bun run scripts/keyring-smoke.ts
+          '
+
   npm-global-smoke:
     name: npm-global ${{ matrix.os }}
     needs: changes
@@ -507,7 +565,7 @@ jobs:
     # direct dependencies only, so a failing `select-windows-runner` would
     # otherwise reach this gate as nothing at all while its dependents report
     # `skipped` — which the gate is required to read as a deliberate skip.
-    needs: [changes, select-windows-runner, test, gates, platform-macos, platform-windows, npm-global-smoke]
+    needs: [changes, select-windows-runner, test, gates, platform-macos, platform-windows, keyring-smoke, npm-global-smoke]
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 225b9e94a..1588c6216 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -60,7 +60,7 @@ jobs:
             exit 1
           fi
 
-      # opencodex is bun-native (the prepublishOnly GUI build + typecheck run under bun).
+      # opencodex is bun-native (the prepublishOnly audit, GUI build, and typecheck run under bun).
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
@@ -92,6 +92,33 @@ jobs:
       - name: Install dependencies
         run: bun install --frozen-lockfile
 
+      - name: Dependency audit (high severity)
+        run: bun audit --audit-level=high
+
+      # Release runs on Linux, whose hosted image has no user keyring session.
+      # Use an isolated HOME and D-Bus session so this validates Secret Service
+      # without touching persistent runner state or silently skipping the check.
+      - name: Install Secret Service dependencies
+        shell: bash
+        run: |
+          set -euo pipefail
+          sudo apt-get update
+          sudo apt-get install --yes --no-install-recommends dbus-x11 gnome-keyring
+
+      - name: OS keyring create/read/delete smoke
+        shell: bash
+        run: |
+          set -euo pipefail
+          keyring_home="$(mktemp -d)"
+          runtime_dir="$(mktemp -d)"
+          cleanup() { rm -rf "$keyring_home" "$runtime_dir"; }
+          trap cleanup EXIT
+          chmod 700 "$keyring_home" "$runtime_dir"
+          HOME="$keyring_home" XDG_RUNTIME_DIR="$runtime_dir" dbus-run-session -- bash -euo pipefail -c '
+            eval "$(gnome-keyring-daemon --start --components=secrets)"
+            bun run scripts/keyring-smoke.ts
+          '
+
       - name: Verify version matches package.json
         env:
           RELEASE_VERSION: ${{ inputs.version }}
diff --git a/package.json b/package.json
index ba35941b1..2879e58e8 100644
--- a/package.json
+++ b/package.json
@@ -39,12 +39,13 @@
     "start": "bun run src/cli/index.ts start",
     "test": "bun scripts/test.ts",
     "typecheck": "bun x tsc --noEmit",
+    "audit:high": "bun audit --audit-level=high",
     "privacy:scan": "bun scripts/privacy-scan.ts",
     "generate:jawcode-metadata": "bun scripts/generate-jawcode-metadata.ts",
     "build:gui": "cd gui && bun install --frozen-lockfile && bun run build && cd .. && bun run prepare:package",
     "prepare:package": "bun scripts/prepare-package.ts",
     "prepack": "bun run prepare:package",
-    "prepublishOnly": "bun run typecheck && bun run build:gui",
+    "prepublishOnly": "bun run audit:high && bun run typecheck && bun run build:gui",
     "release": "bun scripts/release.ts",
     "release:watch": "bun scripts/release.ts watch",
     "prepush": "bun run typecheck && bun run lint:gui && bun run test && bun run privacy:scan && bun run doctor:gui:if-changed",
diff --git a/scripts/keyring-smoke.ts b/scripts/keyring-smoke.ts
new file mode 100644
index 000000000..66f79e635
--- /dev/null
+++ b/scripts/keyring-smoke.ts
@@ -0,0 +1,57 @@
+#!/usr/bin/env bun
+import { randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
+
+export interface KeyringSmokeEntry {
+  setSecret(secret: Uint8Array, signal?: AbortSignal): Promise<void>;
+  getSecret(signal?: AbortSignal): Promise<Uint8Array | null>;
+  deleteCredential(signal?: AbortSignal): Promise<boolean>;
+}
+
+export interface KeyringSmokeOptions {
+  createEntry?: (service: string, account: string) => Promise<KeyringSmokeEntry>;
+  createRandomBytes?: (size: number) => Buffer;
+  createId?: () => string;
+  timeoutMs?: number;
+}
+
+async function createOsEntry(service: string, account: string): Promise<KeyringSmokeEntry> {
+  const { AsyncEntry } = await import("@napi-rs/keyring");
+  return new AsyncEntry(service, account);
+}
+
+export async function runKeyringSmoke({
+  createEntry = createOsEntry,
+  createRandomBytes = randomBytes,
+  createId = randomUUID,
+  timeoutMs = 8_000,
+}: KeyringSmokeOptions = {}): Promise<void> {
+  const service = `opencodex.keyring-smoke.${createId()}`;
+  const account = `ci-${createId()}`;
+  const secret = createRandomBytes(32);
+  let entry: KeyringSmokeEntry | null = null;
+  let stored: Buffer | null = null;
+
+  try {
+    entry = await createEntry(service, account);
+    await entry.setSecret(secret, AbortSignal.timeout(timeoutMs));
+    const readback = await entry.getSecret(AbortSignal.timeout(timeoutMs));
+    stored = readback ? Buffer.from(readback) : null;
+    if (!stored || stored.byteLength !== secret.byteLength || !timingSafeEqual(stored, secret)) {
+      throw new Error("OS keyring smoke readback did not match the stored value.");
+    }
+  } finally {
+    try {
+      if (entry && !await entry.deleteCredential(AbortSignal.timeout(timeoutMs))) {
+        throw new Error("OS keyring smoke could not delete the temporary entry.");
+      }
+    } finally {
+      stored?.fill(0);
+      secret.fill(0);
+    }
+  }
+}
+
+if (import.meta.main) {
+  await runKeyringSmoke();
+  console.log("OS keyring create/read/delete smoke passed.");
+}
diff --git a/scripts/release.ts b/scripts/release.ts
index c3e1beb3d..20d59e7a1 100644
--- a/scripts/release.ts
+++ b/scripts/release.ts
@@ -4,7 +4,7 @@
  *
  * Usage:
  *   bun scripts/release.ts <version> [--tag latest|preview] [--publish]
- *       Preflight (clean tree + typecheck + tests + privacy scan) → bump package.json → commit → push →
+ *       Preflight (clean tree + dependency audit + typecheck + tests + privacy scan) → bump package.json → commit → push →
  *       wait for Cross-platform CI → dispatch the Release workflow → watch it.
  *       The version bump commit/push is real; the Release workflow publish step is dry-run by default.
  *       Pass --publish to publish.
@@ -298,6 +298,8 @@ if ((await capture(["git", "status", "--porcelain"])).trim()) { console.error("
 const packageName = await readPackageName();
 console.log(`→ release metadata preflight (${packageName}@${version})`);
 await assertUnusedReleaseVersion(packageName, version);
+console.log("→ dependency audit");
+await runLoud(["bun", "audit", "--audit-level=high"]);
 console.log("→ typecheck");
 await runLoud(["bun", "x", "tsc", "--noEmit"]);
 console.log("→ test suite");
diff --git a/tests/keyring-smoke.test.ts b/tests/keyring-smoke.test.ts
new file mode 100644
index 000000000..0683dd821
--- /dev/null
+++ b/tests/keyring-smoke.test.ts
@@ -0,0 +1,57 @@
+import { describe, expect, test } from "bun:test";
+import { runKeyringSmoke, type KeyringSmokeEntry } from "../scripts/keyring-smoke";
+
+class MemoryKeyringEntry implements KeyringSmokeEntry {
+  secret: Buffer | null = null;
+  deletes = 0;
+
+  async setSecret(secret: Uint8Array): Promise<void> {
+    this.secret = Buffer.from(secret);
+  }
+
+  async getSecret(): Promise<Uint8Array | null> {
+    return this.secret ? Buffer.from(this.secret) : null;
+  }
+
+  async deleteCredential(): Promise<boolean> {
+    this.deletes += 1;
+    this.secret?.fill(0);
+    this.secret = null;
+    return true;
+  }
+}
+
+describe("runKeyringSmoke", () => {
+  test("creates, exactly reads, and deletes a unique entry", async () => {
+    const entry = new MemoryKeyringEntry();
+    const created: Array<[string, string]> = [];
+    const ids = ["service-id", "account-id"];
+
+    await runKeyringSmoke({
+      createEntry: async (service, account) => {
+        created.push([service, account]);
+        return entry;
+      },
+      createRandomBytes: (size) => Buffer.alloc(size, 0x5a),
+      createId: () => ids.shift()!,
+    });
+
+    expect(created).toEqual([["opencodex.keyring-smoke.service-id", "ci-account-id"]]);
+    expect(entry.deletes).toBe(1);
+    expect(entry.secret).toBeNull();
+  });
+
+  test("deletes the entry when readback verification fails", async () => {
+    const entry = new MemoryKeyringEntry();
+    entry.getSecret = async () => Buffer.alloc(32, 0x00);
+
+    await expect(runKeyringSmoke({
+      createEntry: async () => entry,
+      createRandomBytes: (size) => Buffer.alloc(size, 0x5a),
+      createId: () => "test-id",
+    })).rejects.toThrow("readback did not match");
+
+    expect(entry.deletes).toBe(1);
+    expect(entry.secret).toBeNull();
+  });
+});

From 5ba19361694a58fd6e9795998bd31b6638e222e4 Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Sun, 2 Aug 2026 10:52:48 +0900
Subject: [PATCH 09/63] fix(codex): gate native main startup recovery

---
 src/codex/account-usability.ts                |   4 +
 src/codex/auth-api.ts                         |   4 +
 src/codex/auth-context.ts                     |   7 +
 src/codex/native-profile-api.ts               |  11 +-
 src/codex/native-profile-startup.ts           |  87 +++++
 src/server/index.ts                           |   6 +
 tests/helpers/native-profile-startup-child.ts |  79 +++++
 tests/native-profile-startup.test.ts          | 321 ++++++++++++++++++
 8 files changed, 514 insertions(+), 5 deletions(-)
 create mode 100644 src/codex/native-profile-startup.ts
 create mode 100644 tests/helpers/native-profile-startup-child.ts
 create mode 100644 tests/native-profile-startup.test.ts

diff --git a/src/codex/account-usability.ts b/src/codex/account-usability.ts
index 66141c86c..b4f9a2493 100644
--- a/src/codex/account-usability.ts
+++ b/src/codex/account-usability.ts
@@ -3,9 +3,13 @@ import { isAccountNeedsReauth } from "./account-runtime-state";
 import { MAIN_CODEX_ACCOUNT_ID, isMainAccountTokenLive } from "./main-account";
 import { hasLegacyMainCodexPoolAccount, isSelectableCodexPoolAccount } from "./account-id";
 import type { OcxConfig } from "../types";
+import { isNativeMainTrafficBlocked } from "./native-profile-startup";
 
 export function isCodexAccountUsable(config: OcxConfig, accountId: string): boolean {
   if (accountId === MAIN_CODEX_ACCOUNT_ID) {
+    // Startup recovery owns the physical auth/vault boundary. Never parse or select
+    // native __main__ while an encrypted switch journal is pending or inconclusive.
+    if (isNativeMainTrafficBlocked()) return false;
     // A legacy pool row with the sentinel makes an active `__main__` ambiguous.
     // Fail closed until the authenticated compatibility-delete path removes it.
     if (hasLegacyMainCodexPoolAccount(config.codexAccounts)) return false;
diff --git a/src/codex/auth-api.ts b/src/codex/auth-api.ts
index fa0472267..a4e4c1003 100644
--- a/src/codex/auth-api.ts
+++ b/src/codex/auth-api.ts
@@ -14,6 +14,7 @@ import {
   TokenRefreshError,
 } from "./account-store";
 import { deleteCodexAccount, reconcileMainCodexAccountRuntimeState } from "./account-lifecycle";
+import { isNativeMainTrafficBlocked } from "./native-profile-startup";
 import { isCodexAccountPaused, setCodexAccountPaused } from "./account-pause";
 import {
   clearCodexAccountCooldown,
@@ -383,6 +384,9 @@ async function retryMainAccountInfoIfIdentityChanged(
 }
 
 async function fetchMainAccountInfoAttempt(forceRefresh: boolean, retriesRemaining: number): Promise<MainAccountInfoFetchResult> {
+  // Startup journal recovery is the credential ownership boundary. Do not let a
+  // best-effort quota probe read or quarantine __main__ while that boundary is closed.
+  if (isNativeMainTrafficBlocked()) return { info: EMPTY_MAIN_ACCOUNT_INFO };
   const writerGeneration = captureConfigGeneration();
   reconcileMainCodexAccountRuntimeState();
   const tokenRead = readCodexTokensResult();
diff --git a/src/codex/auth-context.ts b/src/codex/auth-context.ts
index 4993291ea..b8942b7ad 100644
--- a/src/codex/auth-context.ts
+++ b/src/codex/auth-context.ts
@@ -11,6 +11,7 @@ import { markAccountNeedsReauth } from "./account-runtime-state";
 import { isCodexAccountUsable } from "./account-usability";
 import { reconcileMainCodexAccountRuntimeState } from "./account-lifecycle";
 import { MAIN_CODEX_ACCOUNT_ID, getMainAccountToken } from "./main-account";
+import { isNativeMainTrafficBlocked } from "./native-profile-startup";
 import {
   codexQuotaScopeForModel,
   getCodexQuotaHealthSnapshot,
@@ -210,6 +211,12 @@ export async function resolveCodexAuthContext(
     if (!hasCallerCodexBearer(headers)) throw new CodexDirectAuthenticationError();
     return { kind: "main", accountId: null };
   }
+  // Preserve the explicit main selection while startup recovery is pending. Letting
+  // normal strategy resolution run would demote/mutate it before recovery can reopen
+  // the same physical account. Pool-active configurations never enter this branch.
+  if (isNativeMainTrafficBlocked() && config.activeCodexAccountId === MAIN_CODEX_ACCOUNT_ID) {
+    throw new CodexPoolAuthenticationError();
+  }
   reconcileMainCodexAccountRuntimeState();
   const threadId = headers.get("x-codex-parent-thread-id");
   const quotaScope = codexQuotaScopeForModel(options.modelId);
diff --git a/src/codex/native-profile-api.ts b/src/codex/native-profile-api.ts
index 605add312..89a8ec881 100644
--- a/src/codex/native-profile-api.ts
+++ b/src/codex/native-profile-api.ts
@@ -8,6 +8,7 @@ import {
 } from "../server/management/body";
 import { NativeProfileManager } from "./native-profile-manager";
 import { NativeProfileError } from "./native-profile-types";
+import { completeNativeMainRecovery } from "./native-profile-startup";
 
 export interface NativeProfileApiDeps {
   manager?: NativeProfileManager;
@@ -89,12 +90,12 @@ export async function handleNativeProfileAPI(
     }
     if (url.pathname === "/api/native-main-profiles/recover" && req.method === "POST") {
       const input = await body(req);
-      return jsonResponse(
-        await withMainRequestDrain(deps, () => manager.recover(input.rollback === true, input.confirmedStopped === true)),
-        200,
-        req,
-        config,
+      const recovered = await withMainRequestDrain(
+        deps,
+        () => manager.recover(input.rollback === true, input.confirmedStopped === true),
       );
+      if (manager.context?.homeId) completeNativeMainRecovery(manager.context.homeId);
+      return jsonResponse(recovered, 200, req, config);
     }
     return jsonResponse({ error: "Unknown native-profile operation", code: "INVALID_REQUEST" }, 404, req, config);
   } catch (error) {
diff --git a/src/codex/native-profile-startup.ts b/src/codex/native-profile-startup.ts
new file mode 100644
index 000000000..ffc21c2eb
--- /dev/null
+++ b/src/codex/native-profile-startup.ts
@@ -0,0 +1,87 @@
+import { existsSync } from "node:fs";
+
+import { NativeProfileManager } from "./native-profile-manager";
+import { clearAccountNeedsReauth } from "./account-runtime-state";
+import { MAIN_CODEX_ACCOUNT_ID } from "./main-account";
+
+export type NativeMainStartupGateSnapshot =
+  | { status: "ready"; homeId: string | null }
+  | { status: "blocked"; homeId: string; reason: "recovery-pending" | "manual-recovery" };
+
+export interface NativeMainStartupGateDeps {
+  manager?: NativeProfileManager;
+  /** Test-only barrier used to prove admission stays closed while startup recovery is pending. */
+  beforeRecovery?: () => void | Promise<void>;
+}
+
+let epoch = 0;
+let snapshot: NativeMainStartupGateSnapshot = { status: "ready", homeId: null };
+let settled: Promise<NativeMainStartupGateSnapshot> = Promise.resolve(snapshot);
+
+function ready(homeId: string | null): NativeMainStartupGateSnapshot {
+  return { status: "ready", homeId };
+}
+
+/**
+ * Arm the native-main gate synchronously, then converge the encrypted journal in the background.
+ * No credential bytes are read here: journal/auth inspection remains inside NativeProfileManager.
+ */
+export function initializeNativeMainStartupGate(
+  deps: NativeMainStartupGateDeps = {},
+): Promise<NativeMainStartupGateSnapshot> {
+  const currentEpoch = ++epoch;
+  let manager: NativeProfileManager;
+  try {
+    manager = deps.manager ?? new NativeProfileManager();
+  } catch {
+    // A missing/unresolvable Codex home cannot provide a usable native-main token either.
+    // Do not turn an unused opt-in feature into a process-wide startup outage.
+    snapshot = ready(null);
+    settled = Promise.resolve(snapshot);
+    return settled;
+  }
+
+  const homeId = manager.context.homeId;
+  if (!existsSync(manager.context.journalPath)) {
+    snapshot = ready(homeId);
+    settled = Promise.resolve(snapshot);
+    return settled;
+  }
+
+  snapshot = { status: "blocked", homeId, reason: "recovery-pending" };
+  settled = (async () => {
+    try {
+      await deps.beforeRecovery?.();
+      await manager.recover(false);
+      if (epoch === currentEpoch) {
+        clearAccountNeedsReauth(MAIN_CODEX_ACCOUNT_ID);
+        snapshot = ready(homeId);
+      }
+    } catch {
+      if (epoch === currentEpoch) snapshot = { status: "blocked", homeId, reason: "manual-recovery" };
+    }
+    return snapshot;
+  })();
+  return settled;
+}
+
+export function isNativeMainTrafficBlocked(): boolean {
+  return snapshot.status === "blocked";
+}
+
+export function completeNativeMainRecovery(homeId: string): boolean {
+  if (snapshot.status !== "blocked" || snapshot.homeId !== homeId) return false;
+  epoch += 1;
+  clearAccountNeedsReauth(MAIN_CODEX_ACCOUNT_ID);
+  snapshot = ready(homeId);
+  settled = Promise.resolve(snapshot);
+  return true;
+}
+
+export function nativeMainStartupGateSnapshot(): NativeMainStartupGateSnapshot {
+  return { ...snapshot };
+}
+
+export function waitForNativeMainStartupGate(): Promise<NativeMainStartupGateSnapshot> {
+  return settled;
+}
diff --git a/src/server/index.ts b/src/server/index.ts
index 3c13c42d4..510deb4b0 100644
--- a/src/server/index.ts
+++ b/src/server/index.ts
@@ -153,6 +153,7 @@ import { handleChatCompletions } from "./chat-completions";
 import { anthropicErrorResponse } from "../claude/outbound";
 import { buildDesktop3pRegistry } from "../claude/desktop-3p";
 import { runClaudeAuthModeMigration } from "../claude/auth-mode-migration";
+import { initializeNativeMainStartupGate, type NativeMainStartupGateDeps } from "../codex/native-profile-startup";
 import { handleImages } from "./images";
 import { handleLive, logLiveSidebandFrame, parseLiveSidebandTarget, resolveLiveSidebandUpgrade } from "./live";
 import { handleSearch } from "./search";
@@ -282,6 +283,8 @@ export interface StartServerDeps {
   managementAuthState?: ManagementAuthState;
   /** Test-only route dependencies, forwarded only after management admission succeeds. */
   managementApi?: ManagementApiDeps;
+  /** Test-only native-main recovery dependencies; production constructs the normal manager. */
+  nativeMainStartup?: NativeMainStartupGateDeps;
 }
 
 export function startServer(port?: number, deps: StartServerDeps = {}) {
@@ -290,6 +293,9 @@ export function startServer(port?: number, deps: StartServerDeps = {}) {
   applyProxyEnv(config);
   assertServerAuthConfig(config);
   const managementAuth = deps.managementAuthState ?? initializeManagementAuthState(config);
+  // Arm synchronously before listen. A pending journal therefore makes __main__ unusable
+  // before any request can resolve its physical credential, while health/management/Pool stay live.
+  void initializeNativeMainStartupGate(deps.nativeMainStartup);
   // Refresh OAuth provider presets (models/noReasoningModels) from the registry so a proxy update
   // adding/dropping models reaches existing configs on start — not just fresh installs.
   reconcileOAuthProviders(config);
diff --git a/tests/helpers/native-profile-startup-child.ts b/tests/helpers/native-profile-startup-child.ts
new file mode 100644
index 000000000..b29761573
--- /dev/null
+++ b/tests/helpers/native-profile-startup-child.ts
@@ -0,0 +1,79 @@
+import { appendFileSync, existsSync, writeFileSync } from "node:fs";
+
+import { NativeProfileManager } from "../../src/codex/native-profile-manager";
+import { isCodexAccountUsable } from "../../src/codex/account-usability";
+import { isMainAccountTokenLive, MAIN_CODEX_ACCOUNT_ID } from "../../src/codex/main-account";
+import { loadConfig } from "../../src/config";
+import {
+  nativeMainStartupGateSnapshot,
+  waitForNativeMainStartupGate,
+} from "../../src/codex/native-profile-startup";
+import type { NativeProfileKey, NativeProfileKeyProvider } from "../../src/codex/native-profile-types";
+import { startServer } from "../../src/server";
+
+const required = (name: string): string => {
+  const value = process.env[name];
+  if (!value) throw new Error(`missing ${name}`);
+  return value;
+};
+
+const codexHome = required("NATIVE_STARTUP_CODEX_HOME");
+const configDir = required("NATIVE_STARTUP_CONFIG_DIR");
+const keyBytes = Buffer.from(required("NATIVE_STARTUP_KEY"), "base64");
+const portPath = required("NATIVE_STARTUP_PORT");
+const recoveryReleasePath = required("NATIVE_STARTUP_RECOVERY_RELEASE");
+const settledPath = required("NATIVE_STARTUP_SETTLED");
+const upstreamPath = required("NATIVE_STARTUP_UPSTREAM");
+const stopPath = required("NATIVE_STARTUP_STOP");
+
+class EnvKeyProvider implements NativeProfileKeyProvider {
+  async get(): Promise<NativeProfileKey> { return { keyRef: "memory:startup-test", key: Buffer.from(keyBytes) }; }
+  async create(): Promise<NativeProfileKey> { return { keyRef: "memory:startup-test", key: Buffer.from(keyBytes) }; }
+}
+
+const manager = new NativeProfileManager({
+  codexHome,
+  configDir,
+  keyProvider: new EnvKeyProvider(),
+  hardenPath: async () => {},
+  processProbe: async () => ({ status: "clear", count: 0 }),
+});
+
+const realFetch = globalThis.fetch;
+globalThis.fetch = (async (input: RequestInfo | URL, init?: RequestInit): Promise<Response> => {
+  const url = new URL(input instanceof Request ? input.url : String(input));
+  if (url.hostname === "chatgpt.com" && url.pathname.endsWith("/responses")) {
+    const headers = new Headers(input instanceof Request ? input.headers : init?.headers);
+    appendFileSync(upstreamPath, `${JSON.stringify({ authorization: headers.get("authorization") })}\n`);
+    return Response.json({
+      id: "resp_startup_gate",
+      object: "response",
+      status: "completed",
+      output: [],
+      usage: { input_tokens: 1, output_tokens: 1, total_tokens: 2 },
+    });
+  }
+  return realFetch(input, init);
+}) as typeof fetch;
+
+const server = startServer(0, {
+  nativeMainStartup: {
+    manager,
+    beforeRecovery: async () => {
+      while (!existsSync(recoveryReleasePath)) await Bun.sleep(10);
+    },
+  },
+  managementApi: { nativeProfileApi: { manager } },
+});
+
+writeFileSync(portPath, String(server.port));
+void waitForNativeMainStartupGate().then(() => {
+  writeFileSync(settledPath, JSON.stringify({
+    gate: nativeMainStartupGateSnapshot(),
+    mainTokenLive: isMainAccountTokenLive(),
+    mainUsable: isCodexAccountUsable(loadConfig(), MAIN_CODEX_ACCOUNT_ID),
+  }));
+});
+
+while (!existsSync(stopPath)) await Bun.sleep(10);
+await server.stop(true);
diff --git a/tests/native-profile-startup.test.ts b/tests/native-profile-startup.test.ts
new file mode 100644
index 000000000..812a81b07
--- /dev/null
+++ b/tests/native-profile-startup.test.ts
@@ -0,0 +1,321 @@
+import { afterEach, describe, expect, test } from "bun:test";
+import {
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import { saveConfig } from "../src/config";
+import { saveCodexAccountCredential } from "../src/codex/account-store";
+import { MAIN_CODEX_ACCOUNT_ID } from "../src/codex/main-account";
+import { NativeProfileManager } from "../src/codex/native-profile-manager";
+import {
+  encryptNativeEnvelope,
+  readNativeEnvelope,
+  readNativeProfileVault,
+  serializeNativeProfileMetadata,
+} from "../src/codex/native-profile-store";
+import type {
+  NativeProfileKey,
+  NativeProfileKeyProvider,
+  NativeProfileSwitchJournalV1,
+} from "../src/codex/native-profile-types";
+import type { OcxConfig } from "../src/types";
+
+const roots: string[] = [];
+const previousOpencodexHome = process.env.OPENCODEX_HOME;
+const previousCodexHome = process.env.CODEX_HOME;
+
+afterEach(() => {
+  process.env.OPENCODEX_HOME = previousOpencodexHome;
+  process.env.CODEX_HOME = previousCodexHome;
+  for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true });
+});
+
+class MemoryKeyProvider implements NativeProfileKeyProvider {
+  constructor(private readonly bytes: Buffer) {}
+  async get(): Promise<NativeProfileKey> { return { keyRef: "memory:startup-test", key: Buffer.from(this.bytes) }; }
+  async create(): Promise<NativeProfileKey> { return { keyRef: "memory:startup-test", key: Buffer.from(this.bytes) }; }
+}
+
+function envelope(accountId: string, marker: string): string {
+  return JSON.stringify({
+    auth_mode: "chatgpt",
+    tokens: {
+      id_token: `id-${marker}`,
+      access_token: `access-${marker}`,
+      refresh_token: `refresh-${marker}`,
+      account_id: accountId,
+    },
+  }, null, 2) + "\n";
+}
+
+type Phase = "prepared" | "auth-replaced" | "vault-committed";
+type Observation = "source-exact" | "source-changed" | "target-exact" | "target-changed" | "unreadable" | "third";
+
+interface Fixture {
+  root: string;
+  codexHome: string;
+  configDir: string;
+  key: Buffer;
+  manager: NativeProfileManager;
+  target: string;
+  sourceProfileId: string;
+  targetProfileId: string;
+}
+
+async function fixture(phase: Phase, observation: Observation, activePool = false): Promise<Fixture> {
+  const root = mkdtempSync(join(tmpdir(), "ocx-native-startup-"));
+  roots.push(root);
+  const codexHome = join(root, "codex");
+  const configDir = join(root, "opencodex");
+  mkdirSync(codexHome, { recursive: true });
+  mkdirSync(configDir, { recursive: true });
+  writeFileSync(join(codexHome, "config.toml"), 'cli_auth_credentials_store = "file"\n');
+  const source = envelope("account-source", "source");
+  const target = envelope("account-target", "target");
+  writeFileSync(join(codexHome, "auth.json"), source);
+  const key = Buffer.alloc(32, 0x5a);
+  const keyProvider = new MemoryKeyProvider(key);
+  const manager = new NativeProfileManager({
+    codexHome,
+    configDir,
+    keyProvider,
+    hardenPath: async () => {},
+    processProbe: async () => ({ status: "clear", count: 0 }),
+  });
+  const registered = await manager.register("source");
+  const stage = await manager.prepareStage();
+  writeFileSync(join(stage.stagingCodexHome, "auth.json"), target);
+  const added = await manager.finishStage(stage.stageId, "target");
+
+  const beforeVault = readNativeProfileVault(manager.context)!;
+  const sourceRecord = beforeVault.profiles.find(profile => profile.id === registered.profile.id)!;
+  const targetRecord = beforeVault.profiles.find(profile => profile.id === added.profile.id)!;
+  const sourceEnvelope = readNativeEnvelope(manager.context.authPath);
+  const sourcePayload = encryptNativeEnvelope(
+    manager.context,
+    sourceRecord.id,
+    sourceRecord.identityHash,
+    sourceEnvelope,
+    { keyRef: "memory:startup-test", key: Buffer.from(key) },
+  );
+  sourceEnvelope.raw.fill(0);
+  const afterVault = structuredClone(beforeVault);
+  const afterSource = afterVault.profiles.find(profile => profile.id === sourceRecord.id)!;
+  const afterTarget = afterVault.profiles.find(profile => profile.id === targetRecord.id)!;
+  afterSource.state = "inactive";
+  afterSource.payload = sourcePayload;
+  afterTarget.state = "active";
+  afterTarget.payload = null;
+  afterVault.activeProfileId = afterTarget.id;
+  afterVault.revision += 1;
+
+  const journal: NativeProfileSwitchJournalV1 = {
+    version: 1,
+    transactionId: crypto.randomUUID(),
+    homeId: manager.context.homeId,
+    phase,
+    sourceProfileId: sourceRecord.id,
+    sourceIdentityHash: sourceRecord.identityHash,
+    sourcePayload,
+    targetProfileId: targetRecord.id,
+    targetIdentityHash: targetRecord.identityHash,
+    targetPayload: targetRecord.payload!,
+    beforeVault,
+    afterVault,
+    createdAt: new Date().toISOString(),
+  };
+  writeFileSync(manager.context.journalPath, serializeNativeProfileMetadata(journal));
+
+  const observed = observation === "source-exact" ? source
+    : observation === "source-changed" ? envelope("account-source", "source-changed")
+      : observation === "target-exact" ? target
+        : observation === "target-changed" ? envelope("account-target", "target-changed")
+          : observation === "third" ? envelope("account-third", "third")
+            : "{}\n";
+  writeFileSync(manager.context.authPath, observed);
+
+  process.env.OPENCODEX_HOME = configDir;
+  process.env.CODEX_HOME = codexHome;
+  const config = {
+    port: 0,
+    hostname: "127.0.0.1",
+    defaultProvider: "openai",
+    providers: {
+      openai: {
+        adapter: "openai-responses",
+        baseUrl: "https://chatgpt.com/backend-api/codex",
+        authMode: "forward",
+        codexAccountMode: "pool",
+      },
+    },
+    codexAccounts: activePool ? [{ id: "pool-a", email: "pool@test", isMain: false }] : [],
+    activeCodexAccountId: activePool ? "pool-a" : MAIN_CODEX_ACCOUNT_ID,
+    autoSwitchThreshold: 0,
+  } as OcxConfig;
+  saveConfig(config);
+  if (activePool) {
+    saveCodexAccountCredential("pool-a", {
+      accessToken: "pool-access",
+      refreshToken: "pool-refresh",
+      expiresAt: Date.now() + 10 * 60_000,
+      chatgptAccountId: "pool-account",
+    });
+  }
+  process.env.OPENCODEX_HOME = previousOpencodexHome;
+  process.env.CODEX_HOME = previousCodexHome;
+  return { root, codexHome, configDir, key, manager, target, sourceProfileId: sourceRecord.id, targetProfileId: targetRecord.id };
+}
+
+async function waitForPath(path: string, timeoutMs = 10_000): Promise<void> {
+  const deadline = Date.now() + timeoutMs;
+  while (!existsSync(path) && Date.now() < deadline) await Bun.sleep(10);
+  if (!existsSync(path)) throw new Error(`Timed out waiting for ${path}`);
+}
+
+function childPaths(f: Fixture) {
+  return {
+    port: join(f.root, "port"),
+    release: join(f.root, "recovery-release"),
+    settled: join(f.root, "recovery-settled"),
+    upstream: join(f.root, "upstream.jsonl"),
+    stop: join(f.root, "stop"),
+  };
+}
+
+function spawnChild(f: Fixture, paths: ReturnType<typeof childPaths>): ReturnType<typeof Bun.spawn> {
+  return Bun.spawn([process.execPath, join(import.meta.dir, "helpers", "native-profile-startup-child.ts")], {
+    cwd: join(import.meta.dir, ".."),
+    env: {
+      ...process.env,
+      OPENCODEX_HOME: f.configDir,
+      CODEX_HOME: f.codexHome,
+      OPENCODEX_ADMIN_AUTH_TOKEN: "startup-test-admin",
+      NATIVE_STARTUP_CODEX_HOME: f.codexHome,
+      NATIVE_STARTUP_CONFIG_DIR: f.configDir,
+      NATIVE_STARTUP_KEY: f.key.toString("base64"),
+      NATIVE_STARTUP_PORT: paths.port,
+      NATIVE_STARTUP_RECOVERY_RELEASE: paths.release,
+      NATIVE_STARTUP_SETTLED: paths.settled,
+      NATIVE_STARTUP_UPSTREAM: paths.upstream,
+      NATIVE_STARTUP_STOP: paths.stop,
+    },
+    stdin: "ignore",
+    stdout: "pipe",
+    stderr: "pipe",
+  });
+}
+
+async function stopChild(child: ReturnType<typeof Bun.spawn>, paths: ReturnType<typeof childPaths>): Promise<void> {
+  writeFileSync(paths.release, "release");
+  writeFileSync(paths.stop, "stop");
+  const exit = await Promise.race([child.exited, Bun.sleep(10_000).then(() => null)]);
+  if (exit === null) {
+    child.kill();
+    await child.exited;
+    throw new Error("startup child did not stop");
+  }
+  if (exit !== 0) throw new Error(await new Response(child.stderr).text());
+}
+
+async function mainRequest(port: number): Promise<Response> {
+  return fetch(`http://127.0.0.1:${port}/v1/responses`, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ model: "gpt-5.6-sol", input: "startup gate", stream: false }),
+  });
+}
+
+const recoverable: Array<{ phase: Phase; observation: Observation; active: "source" | "target" }> = [
+  ...(["prepared", "auth-replaced", "vault-committed"] as const).flatMap(phase => [
+    { phase, observation: "source-exact" as const, active: "source" as const },
+    { phase, observation: "source-changed" as const, active: "source" as const },
+    { phase, observation: "target-exact" as const, active: "target" as const },
+    { phase, observation: "target-changed" as const, active: "target" as const },
+  ]),
+];
+
+describe("native-main startup journal gate", () => {
+  test("fresh processes gate first admission and converge every recoverable phase/observation", async () => {
+    for (const scenario of recoverable) {
+      const f = await fixture(scenario.phase, scenario.observation);
+      const paths = childPaths(f);
+      const child = spawnChild(f, paths);
+      try {
+        await waitForPath(paths.port);
+        const port = Number(readFileSync(paths.port, "utf8"));
+        const blocked = await mainRequest(port);
+        expect(blocked.status).toBeGreaterThanOrEqual(400);
+        expect(existsSync(paths.upstream)).toBe(false);
+
+        writeFileSync(paths.release, "release");
+        await waitForPath(paths.settled);
+        expect(JSON.parse(readFileSync(paths.settled, "utf8"))).toMatchObject({ gate: { status: "ready" } });
+        const allowed = await mainRequest(port);
+        if (allowed.status !== 200) {
+          throw new Error(`${scenario.phase}/${scenario.observation}: ${allowed.status} ${await allowed.text()} settled=${readFileSync(paths.settled, "utf8")}`);
+        }
+        expect(existsSync(paths.upstream)).toBe(true);
+        const active = (await f.manager.list()).activeProfileId;
+        expect(active).toBe(scenario.active === "target" ? f.targetProfileId : f.sourceProfileId);
+      } finally {
+        await stopChild(child, paths);
+      }
+    }
+  }, 120_000);
+
+  test("manual observations keep main closed while health and explicit recovery remain available", async () => {
+    for (const observation of ["unreadable", "third"] as const) {
+      const f = await fixture("prepared", observation);
+      const paths = childPaths(f);
+      const child = spawnChild(f, paths);
+      try {
+        await waitForPath(paths.port);
+        const port = Number(readFileSync(paths.port, "utf8"));
+        expect((await mainRequest(port)).status).toBeGreaterThanOrEqual(400);
+        expect(existsSync(paths.upstream)).toBe(false);
+        expect((await fetch(`http://127.0.0.1:${port}/healthz`)).status).toBe(200);
+
+        writeFileSync(paths.release, "release");
+        await waitForPath(paths.settled);
+        expect(JSON.parse(readFileSync(paths.settled, "utf8"))).toMatchObject({ gate: { status: "blocked", reason: "manual-recovery" } });
+        expect((await mainRequest(port)).status).toBeGreaterThanOrEqual(400);
+        expect(existsSync(paths.upstream)).toBe(false);
+
+        writeFileSync(join(f.codexHome, "auth.json"), f.target);
+        const recovered = await fetch(`http://127.0.0.1:${port}/api/native-main-profiles/recover`, {
+          method: "POST",
+          headers: { "content-type": "application/json", "x-opencodex-api-key": "startup-test-admin" },
+          body: JSON.stringify({ rollback: false }),
+        });
+        expect(recovered.status).toBe(200);
+        expect((await mainRequest(port)).status).toBe(200);
+        expect(existsSync(paths.upstream)).toBe(true);
+      } finally {
+        await stopChild(child, paths);
+      }
+    }
+  }, 45_000);
+
+  test("a pending native-main journal does not block an ordinary Pool account", async () => {
+    const f = await fixture("prepared", "unreadable", true);
+    const paths = childPaths(f);
+    const child = spawnChild(f, paths);
+    try {
+      await waitForPath(paths.port);
+      const port = Number(readFileSync(paths.port, "utf8"));
+      expect((await mainRequest(port)).status).toBe(200);
+      await waitForPath(paths.upstream);
+      const receipt = JSON.parse(readFileSync(paths.upstream, "utf8").trim());
+      expect(receipt.authorization).toBe("Bearer pool-access");
+    } finally {
+      await stopChild(child, paths);
+    }
+  }, 20_000);
+});

From a56136d9af6d2dade25ce97e1fb772d5425480d4 Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Sun, 2 Aug 2026 11:05:12 +0900
Subject: [PATCH 10/63] test(codex): cover native profile crash matrix

---
 src/codex/native-profile-manager.ts           |  15 ++
 tests/codex-websocket-registry.test.ts        |  20 ++
 tests/helpers/native-profile-startup-child.ts |   5 +-
 tests/helpers/native-profile-switch-child.ts  |  52 +++++
 tests/native-profile-api.test.ts              |  52 +++++
 tests/native-profile-crash-boundaries.test.ts | 217 ++++++++++++++++++
 tests/native-profile-manager.test.ts          |  39 +++-
 7 files changed, 395 insertions(+), 5 deletions(-)
 create mode 100644 tests/helpers/native-profile-switch-child.ts
 create mode 100644 tests/native-profile-crash-boundaries.test.ts

diff --git a/src/codex/native-profile-manager.ts b/src/codex/native-profile-manager.ts
index 4bce86d18..17a18db07 100644
--- a/src/codex/native-profile-manager.ts
+++ b/src/codex/native-profile-manager.ts
@@ -56,6 +56,12 @@ const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-
 
 type AtomicWriter = (path: string, content: string) => Promise<void>;
 type TransitionApplier = (fromAccountId: string, toAccountId: string) => void;
+export type NativeProfileSwitchBoundary =
+  | "journal-prepared"
+  | "auth-replaced"
+  | "vault-committed"
+  | "runtime-transition-published"
+  | "journal-deleted";
 
 export interface NativeProfileManagerOptions {
   codexHome?: string;
@@ -71,6 +77,8 @@ export interface NativeProfileManagerOptions {
   lockWaitMs?: number;
   onLockAcquired?: () => void | Promise<void>;
   removeStageTree?: (path: string) => void;
+  /** Test-only crash seam; production never supplies this callback. */
+  onSwitchBoundary?: (boundary: NativeProfileSwitchBoundary) => void | Promise<void>;
 }
 
 export interface NativeProfileListResult {
@@ -104,6 +112,7 @@ export class NativeProfileManager {
   private readonly lockWaitMs: number;
   private readonly onLockAcquired: () => void | Promise<void>;
   private readonly removeStageTree: (path: string) => void;
+  private readonly onSwitchBoundary: (boundary: NativeProfileSwitchBoundary) => void | Promise<void>;
 
   constructor(options: NativeProfileManagerOptions = {}) {
     this.context = resolveNativeProfileContext(options);
@@ -118,6 +127,7 @@ export class NativeProfileManager {
     this.lockWaitMs = options.lockWaitMs ?? LOCK_WAIT_MS;
     this.onLockAcquired = options.onLockAcquired ?? (() => {});
     this.removeStageTree = options.removeStageTree ?? (path => rmSync(path, { recursive: true, force: false }));
+    this.onSwitchBoundary = options.onSwitchBoundary ?? (() => {});
   }
 
   private async ensureRoot(): Promise<void> {
@@ -563,17 +573,22 @@ export class NativeProfileManager {
         };
         await this.writeJournal(journal);
         journalPrepared = true;
+        await this.onSwitchBoundary("journal-prepared");
         await this.atomicWrite(this.context.authPath, target.text);
         const observedTarget = this.verifyWrittenEnvelope(target.digest, targetProfile.identityHash, key);
         observedTarget.raw.fill(0);
+        await this.onSwitchBoundary("auth-replaced");
         journal.phase = "auth-replaced";
         await this.writeJournal(journal);
         await this.writeVault(afterVault);
         committed = true;
+        await this.onSwitchBoundary("vault-committed");
         journal.phase = "vault-committed";
         await this.writeJournal(journal);
         this.applyTransition(source.accountId, target.accountId);
+        await this.onSwitchBoundary("runtime-transition-published");
         this.removeJournal();
+        await this.onSwitchBoundary("journal-deleted");
         return {
           ok: true,
           effectiveCodexHome: this.context.codexHome,
diff --git a/tests/codex-websocket-registry.test.ts b/tests/codex-websocket-registry.test.ts
index fd717ece0..0fad252cb 100644
--- a/tests/codex-websocket-registry.test.ts
+++ b/tests/codex-websocket-registry.test.ts
@@ -8,6 +8,7 @@ import {
   unregisterCodexWebSocket,
   updateCodexWebSocketAuthContext,
 } from "../src/codex/websocket-registry";
+import { applyConfirmedMainCodexAccountTransition } from "../src/codex/account-lifecycle";
 import type { WsData } from "../src/server/ws-bridge";
 
 function mockWs(data: WsData): {
@@ -71,6 +72,25 @@ describe("codex websocket registry", () => {
     expect(getTrackedCodexWebSocketCountForAccount("__main__")).toBe(0);
   });
 
+  test("confirmed native-main transition cancels and closes tracked Responses WebSocket work", () => {
+    let cancelled = 0;
+    const mainPool = mockWs({
+      authContext: {
+        kind: "main-pool",
+        accountId: "__main__",
+        accessToken: "old-main-token",
+        chatgptAccountId: "old-main-account",
+      },
+      cancel: () => { cancelled += 1; },
+    });
+    registerCodexWebSocket(mainPool.ws);
+
+    expect(applyConfirmedMainCodexAccountTransition("old-main-account", "new-main-account")).toBe(true);
+    expect(cancelled).toBe(1);
+    expect(mainPool.closed).toEqual([{ code: 4001, reason: "Codex account invalidated" }]);
+    expect(getTrackedCodexWebSocketCountForAccount("__main__")).toBe(0);
+  });
+
   test("unregister removes tracked socket", () => {
     const pool = mockWs({
       authContext: {
diff --git a/tests/helpers/native-profile-startup-child.ts b/tests/helpers/native-profile-startup-child.ts
index b29761573..f9b112ba7 100644
--- a/tests/helpers/native-profile-startup-child.ts
+++ b/tests/helpers/native-profile-startup-child.ts
@@ -20,6 +20,7 @@ const required = (name: string): string => {
 const codexHome = required("NATIVE_STARTUP_CODEX_HOME");
 const configDir = required("NATIVE_STARTUP_CONFIG_DIR");
 const keyBytes = Buffer.from(required("NATIVE_STARTUP_KEY"), "base64");
+const keyRef = process.env.NATIVE_STARTUP_KEY_REF ?? "memory:startup-test";
 const portPath = required("NATIVE_STARTUP_PORT");
 const recoveryReleasePath = required("NATIVE_STARTUP_RECOVERY_RELEASE");
 const settledPath = required("NATIVE_STARTUP_SETTLED");
@@ -27,8 +28,8 @@ const upstreamPath = required("NATIVE_STARTUP_UPSTREAM");
 const stopPath = required("NATIVE_STARTUP_STOP");
 
 class EnvKeyProvider implements NativeProfileKeyProvider {
-  async get(): Promise<NativeProfileKey> { return { keyRef: "memory:startup-test", key: Buffer.from(keyBytes) }; }
-  async create(): Promise<NativeProfileKey> { return { keyRef: "memory:startup-test", key: Buffer.from(keyBytes) }; }
+  async get(): Promise<NativeProfileKey> { return { keyRef, key: Buffer.from(keyBytes) }; }
+  async create(): Promise<NativeProfileKey> { return { keyRef, key: Buffer.from(keyBytes) }; }
 }
 
 const manager = new NativeProfileManager({
diff --git a/tests/helpers/native-profile-switch-child.ts b/tests/helpers/native-profile-switch-child.ts
new file mode 100644
index 000000000..8434d01f6
--- /dev/null
+++ b/tests/helpers/native-profile-switch-child.ts
@@ -0,0 +1,52 @@
+import { existsSync, writeFileSync } from "node:fs";
+
+import {
+  NativeProfileManager,
+  type NativeProfileSwitchBoundary,
+} from "../../src/codex/native-profile-manager";
+import type { NativeProfileKey, NativeProfileKeyProvider } from "../../src/codex/native-profile-types";
+
+const required = (name: string): string => {
+  const value = process.env[name];
+  if (!value) throw new Error(`missing ${name}`);
+  return value;
+};
+
+const keyBytes = Buffer.from(required("NATIVE_SWITCH_KEY"), "base64");
+const resultPath = required("NATIVE_SWITCH_RESULT");
+const markerPath = process.env.NATIVE_SWITCH_MARKER;
+const releasePath = process.env.NATIVE_SWITCH_RELEASE;
+const crashBoundary = process.env.NATIVE_SWITCH_CRASH_BOUNDARY as NativeProfileSwitchBoundary | undefined;
+
+class EnvKeyProvider implements NativeProfileKeyProvider {
+  async get(): Promise<NativeProfileKey> { return { keyRef: "memory:switch-test", key: Buffer.from(keyBytes) }; }
+  async create(): Promise<NativeProfileKey> { return { keyRef: "memory:switch-test", key: Buffer.from(keyBytes) }; }
+}
+
+const manager = new NativeProfileManager({
+  codexHome: required("NATIVE_SWITCH_CODEX_HOME"),
+  configDir: required("NATIVE_SWITCH_CONFIG_DIR"),
+  keyProvider: new EnvKeyProvider(),
+  hardenPath: async () => {},
+  processProbe: async () => ({ status: "clear", count: 0 }),
+  onLockAcquired: async () => {
+    if (markerPath && !crashBoundary) writeFileSync(markerPath, "lock-acquired");
+    if (releasePath && !crashBoundary) while (!existsSync(releasePath)) await Bun.sleep(10);
+  },
+  onSwitchBoundary: async boundary => {
+    if (boundary !== crashBoundary) return;
+    if (markerPath) writeFileSync(markerPath, boundary);
+    process.exit(86);
+  },
+});
+
+try {
+  const result = await manager.switch("target", true);
+  writeFileSync(resultPath, JSON.stringify({ ok: true, result }));
+} catch (error) {
+  writeFileSync(resultPath, JSON.stringify({
+    ok: false,
+    code: error && typeof error === "object" && "code" in error ? String(error.code) : null,
+    message: error instanceof Error ? error.message : String(error),
+  }));
+}
diff --git a/tests/native-profile-api.test.ts b/tests/native-profile-api.test.ts
index 5c7251b8a..d9143ed18 100644
--- a/tests/native-profile-api.test.ts
+++ b/tests/native-profile-api.test.ts
@@ -25,6 +25,58 @@ describe("native main profile management API", () => {
     lease?.release();
   });
 
+  test("real drain timeout leaves an admitted HTTP response live and never enters switch", async () => {
+    const lease = tryAdmitTurn();
+    expect(lease).not.toBeNull();
+    let switched = 0;
+    const manager = { switch: async () => { switched += 1; return { ok: true }; } } as unknown as NativeProfileManager;
+    const request = new Request("http://localhost/api/native-main-profiles/switch", {
+      method: "POST",
+      body: JSON.stringify({ target: "target", confirmedStopped: true }),
+    });
+    try {
+      const response = await handleNativeProfileAPI(request, new URL(request.url), {} as OcxConfig, {
+        manager,
+        drainTimeoutMs: 0,
+      });
+      expect(response?.status).toBe(409);
+      expect(await response?.json()).toMatchObject({ code: "MAIN_REQUESTS_ACTIVE", retryable: true });
+      expect(switched).toBe(0);
+    } finally {
+      lease?.release();
+    }
+  });
+
+  test("stale HTTP/Responses-WebSocket work settles before switch and new turns stay fenced", async () => {
+    const oldTurn = tryAdmitTurn();
+    expect(oldTurn).not.toBeNull();
+    const order: string[] = [];
+    let slept = false;
+    const manager = {
+      switch: async () => { order.push("switch"); return { ok: true }; },
+    } as unknown as NativeProfileManager;
+    const request = new Request("http://localhost/api/native-main-profiles/switch", {
+      method: "POST",
+      body: JSON.stringify({ target: "target", confirmedStopped: true }),
+    });
+    const response = await handleNativeProfileAPI(request, new URL(request.url), {} as OcxConfig, {
+      manager,
+      drainTimeoutMs: 1_000,
+      sleep: async () => {
+        if (slept) return Bun.sleep(1);
+        slept = true;
+        expect(tryAdmitTurn()).toBeNull();
+        order.push("old-http-or-ws-response-finished");
+        oldTurn?.release();
+      },
+    });
+    expect(response?.status).toBe(200);
+    expect(order).toEqual(["old-http-or-ws-response-finished", "switch"]);
+    const after = tryAdmitTurn();
+    expect(after).not.toBeNull();
+    after?.release();
+  });
+
   test("length-unknown native-profile bodies use the bounded management reader", async () => {
     let registered = false;
     const manager = {
diff --git a/tests/native-profile-crash-boundaries.test.ts b/tests/native-profile-crash-boundaries.test.ts
new file mode 100644
index 000000000..f9dda7e2c
--- /dev/null
+++ b/tests/native-profile-crash-boundaries.test.ts
@@ -0,0 +1,217 @@
+import { afterEach, describe, expect, test } from "bun:test";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import { saveConfig } from "../src/config";
+import { MAIN_CODEX_ACCOUNT_ID } from "../src/codex/main-account";
+import { NativeProfileManager, type NativeProfileSwitchBoundary } from "../src/codex/native-profile-manager";
+import { readNativeProfileJournal, readNativeProfileVault } from "../src/codex/native-profile-store";
+import type { NativeProfileKey, NativeProfileKeyProvider } from "../src/codex/native-profile-types";
+import type { OcxConfig } from "../src/types";
+
+const roots: string[] = [];
+const oldOcx = process.env.OPENCODEX_HOME;
+const oldCodex = process.env.CODEX_HOME;
+
+afterEach(() => {
+  process.env.OPENCODEX_HOME = oldOcx;
+  process.env.CODEX_HOME = oldCodex;
+  for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true });
+});
+
+class MemoryKeyProvider implements NativeProfileKeyProvider {
+  constructor(private readonly bytes: Buffer) {}
+  async get(): Promise<NativeProfileKey> { return { keyRef: "memory:switch-test", key: Buffer.from(this.bytes) }; }
+  async create(): Promise<NativeProfileKey> { return { keyRef: "memory:switch-test", key: Buffer.from(this.bytes) }; }
+}
+
+function envelope(accountId: string, marker: string): string {
+  return ` {\n  "auth_mode": "chatgpt",\n  "tokens": {\n    "id_token": "opaque-id-${marker}",\n    "access_token": "opaque-access-${marker}",\n    "refresh_token": "opaque-refresh-${marker}",\n    "account_id": "${accountId}"\n  }\n}\n`;
+}
+
+async function fixture() {
+  const root = mkdtempSync(join(tmpdir(), "ocx-native-crash-"));
+  roots.push(root);
+  const home = join(root, "home");
+  const codexHome = join(home, ".codex");
+  const configDir = join(home, ".opencodex");
+  mkdirSync(codexHome, { recursive: true });
+  mkdirSync(configDir, { recursive: true });
+  writeFileSync(join(codexHome, "config.toml"), 'cli_auth_credentials_store = "file"\n');
+  const source = envelope("account-source", "source");
+  const target = envelope("account-target", "target");
+  writeFileSync(join(codexHome, "auth.json"), source);
+  const key = Buffer.alloc(32, 0x33);
+  const manager = new NativeProfileManager({
+    codexHome,
+    configDir,
+    keyProvider: new MemoryKeyProvider(key),
+    hardenPath: async () => {},
+    processProbe: async () => ({ status: "clear", count: 0 }),
+  });
+  const sourceProfile = (await manager.register("source")).profile;
+  const stage = await manager.prepareStage();
+  writeFileSync(join(stage.stagingCodexHome, "auth.json"), target);
+  const targetProfile = (await manager.finishStage(stage.stageId, "target")).profile;
+  const initialRevision = readNativeProfileVault(manager.context)!.revision;
+
+  process.env.OPENCODEX_HOME = configDir;
+  process.env.CODEX_HOME = codexHome;
+  saveConfig({
+    port: 0,
+    hostname: "127.0.0.1",
+    defaultProvider: "openai",
+    providers: { openai: { adapter: "openai-responses", baseUrl: "https://chatgpt.com/backend-api/codex", authMode: "forward", codexAccountMode: "pool" } },
+    codexAccounts: [],
+    activeCodexAccountId: MAIN_CODEX_ACCOUNT_ID,
+    autoSwitchThreshold: 0,
+  } as OcxConfig);
+  process.env.OPENCODEX_HOME = oldOcx;
+  process.env.CODEX_HOME = oldCodex;
+  return { root, home, codexHome, configDir, source, target, key, manager, sourceProfile, targetProfile, initialRevision };
+}
+
+async function waitFor(path: string, timeout = 10_000): Promise<void> {
+  const deadline = Date.now() + timeout;
+  while (!existsSync(path) && Date.now() < deadline) await Bun.sleep(10);
+  if (!existsSync(path)) throw new Error(`timed out waiting for ${path}`);
+}
+
+function spawnSwitch(f: Awaited<ReturnType<typeof fixture>>, options: { boundary?: NativeProfileSwitchBoundary; marker?: string; release?: string; result: string }) {
+  return Bun.spawn([process.execPath, join(import.meta.dir, "helpers", "native-profile-switch-child.ts")], {
+    cwd: join(import.meta.dir, ".."),
+    env: {
+      ...process.env,
+      HOME: f.home,
+      USERPROFILE: f.home,
+      CODEX_HOME: f.codexHome,
+      OPENCODEX_HOME: f.configDir,
+      NATIVE_SWITCH_CODEX_HOME: f.codexHome,
+      NATIVE_SWITCH_CONFIG_DIR: f.configDir,
+      NATIVE_SWITCH_KEY: f.key.toString("base64"),
+      NATIVE_SWITCH_RESULT: options.result,
+      ...(options.boundary ? { NATIVE_SWITCH_CRASH_BOUNDARY: options.boundary } : {}),
+      ...(options.marker ? { NATIVE_SWITCH_MARKER: options.marker } : {}),
+      ...(options.release ? { NATIVE_SWITCH_RELEASE: options.release } : {}),
+    },
+    stdin: "ignore", stdout: "pipe", stderr: "pipe",
+  });
+}
+
+function startupPaths(f: Awaited<ReturnType<typeof fixture>>) {
+  return { port: join(f.root, "port"), release: join(f.root, "recover"), settled: join(f.root, "settled"), upstream: join(f.root, "upstream"), stop: join(f.root, "stop") };
+}
+
+function spawnStartup(f: Awaited<ReturnType<typeof fixture>>, p: ReturnType<typeof startupPaths>) {
+  return Bun.spawn([process.execPath, join(import.meta.dir, "helpers", "native-profile-startup-child.ts")], {
+    cwd: join(import.meta.dir, ".."),
+    env: {
+      ...process.env, HOME: f.home, USERPROFILE: f.home, CODEX_HOME: f.codexHome, OPENCODEX_HOME: f.configDir,
+      OPENCODEX_ADMIN_AUTH_TOKEN: "crash-test-admin",
+      NATIVE_STARTUP_CODEX_HOME: f.codexHome, NATIVE_STARTUP_CONFIG_DIR: f.configDir,
+      NATIVE_STARTUP_KEY: f.key.toString("base64"), NATIVE_STARTUP_KEY_REF: "memory:switch-test", NATIVE_STARTUP_PORT: p.port,
+      NATIVE_STARTUP_RECOVERY_RELEASE: p.release, NATIVE_STARTUP_SETTLED: p.settled,
+      NATIVE_STARTUP_UPSTREAM: p.upstream, NATIVE_STARTUP_STOP: p.stop,
+    },
+    stdin: "ignore", stdout: "pipe", stderr: "pipe",
+  });
+}
+
+async function mainRequest(port: number) {
+  return fetch(`http://127.0.0.1:${port}/v1/responses`, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ model: "gpt-5.6-sol", input: "crash recovery", stream: false }) });
+}
+
+const boundaries: Array<{
+  boundary: NativeProfileSwitchBoundary;
+  auth: "source" | "target";
+  owner: "source" | "target";
+  phase: "prepared" | "auth-replaced" | "vault-committed" | null;
+}> = [
+  { boundary: "journal-prepared", auth: "source", owner: "source", phase: "prepared" },
+  { boundary: "auth-replaced", auth: "target", owner: "source", phase: "prepared" },
+  { boundary: "vault-committed", auth: "target", owner: "target", phase: "auth-replaced" },
+  { boundary: "runtime-transition-published", auth: "target", owner: "target", phase: "vault-committed" },
+  { boundary: "journal-deleted", auth: "target", owner: "target", phase: null },
+];
+
+describe("native profile subprocess crash boundaries", () => {
+  test("hard process exit at every durable boundary converges exact auth, vault, journal, gate, and runtime bearer", async () => {
+    for (const scenario of boundaries) {
+      const f = await fixture();
+      const marker = join(f.root, `crash-${scenario.boundary}`);
+      const result = join(f.root, `result-${scenario.boundary}`);
+      const child = spawnSwitch(f, { boundary: scenario.boundary, marker, result });
+      await Promise.race([
+        waitFor(marker),
+        child.exited.then(async exit => {
+          if (existsSync(marker)) return;
+          const detail = existsSync(result) ? readFileSync(result, "utf8") : await new Response(child.stderr).text();
+          throw new Error(`${scenario.boundary} child exited ${exit} before marker: ${detail}`);
+        }),
+      ]);
+      expect(await child.exited).toBe(86);
+      expect(existsSync(result)).toBe(false);
+
+      expect(readFileSync(f.manager.context.authPath, "utf8")).toBe(scenario.auth === "source" ? f.source : f.target);
+      const vault = readNativeProfileVault(f.manager.context)!;
+      expect(vault.activeProfileId).toBe(scenario.owner === "source" ? f.sourceProfile.id : f.targetProfile.id);
+      expect(vault.revision).toBe(f.initialRevision + (scenario.owner === "target" ? 1 : 0));
+      const rawVault = readFileSync(f.manager.context.vaultPath, "utf8");
+      expect(rawVault).not.toContain("opaque-access");
+      expect(rawVault).not.toContain("opaque-refresh");
+      const journal = readNativeProfileJournal(f.manager.context);
+      expect(journal?.phase ?? null).toBe(scenario.phase);
+
+      const p = startupPaths(f);
+      const restart = spawnStartup(f, p);
+      try {
+        await waitFor(p.port);
+        const port = Number(readFileSync(p.port, "utf8"));
+        if (scenario.phase) {
+          expect((await mainRequest(port)).status).toBeGreaterThanOrEqual(400);
+          expect(existsSync(p.upstream)).toBe(false);
+          writeFileSync(p.release, "recover");
+        }
+        await waitFor(p.settled);
+        expect(JSON.parse(readFileSync(p.settled, "utf8"))).toMatchObject({ gate: { status: "ready" } });
+        expect((await mainRequest(port)).status).toBe(200);
+        await waitFor(p.upstream);
+        const receipt = JSON.parse(readFileSync(p.upstream, "utf8").trim().split("\n").at(-1)!);
+        const finalTarget = scenario.boundary !== "journal-prepared";
+        expect(receipt.authorization).toBe(`Bearer opaque-access-${finalTarget ? "target" : "source"}`);
+        expect(readFileSync(f.manager.context.authPath, "utf8")).toBe(finalTarget ? f.target : f.source);
+        const recoveredVault = readNativeProfileVault(f.manager.context)!;
+        expect(recoveredVault.activeProfileId).toBe(finalTarget ? f.targetProfile.id : f.sourceProfile.id);
+        expect(recoveredVault.revision).toBe(f.initialRevision + (finalTarget ? 1 : 0));
+        expect(readNativeProfileJournal(f.manager.context)).toBeNull();
+      } finally {
+        writeFileSync(p.release, "recover");
+        writeFileSync(p.stop, "stop");
+        expect(await restart.exited).toBe(0);
+      }
+    }
+  }, 90_000);
+
+  test("two concurrent real switches serialize to one commit without credential overlap", async () => {
+    const f = await fixture();
+    const firstReady = join(f.root, "first-ready");
+    const firstRelease = join(f.root, "first-release");
+    const firstResult = join(f.root, "first-result");
+    const secondResult = join(f.root, "second-result");
+    const first = spawnSwitch(f, { marker: firstReady, release: firstRelease, result: firstResult });
+    await waitFor(firstReady);
+    const second = spawnSwitch(f, { result: secondResult });
+    await Bun.sleep(100);
+    expect(existsSync(secondResult)).toBe(false);
+    writeFileSync(firstRelease, "release");
+    expect(await first.exited).toBe(0);
+    expect(await second.exited).toBe(0);
+    const results = [JSON.parse(readFileSync(firstResult, "utf8")), JSON.parse(readFileSync(secondResult, "utf8"))];
+    if (results.filter(item => item.ok).length !== 1) throw new Error(`unexpected concurrent results: ${JSON.stringify(results)}`);
+    expect(results.filter(item => !item.ok).map(item => item.code)).toEqual(["INVALID_REQUEST"]);
+    expect(readFileSync(f.manager.context.authPath, "utf8")).toBe(f.target);
+    expect(readNativeProfileVault(f.manager.context)!.activeProfileId).toBe(f.targetProfile.id);
+    expect(readNativeProfileJournal(f.manager.context)).toBeNull();
+  }, 20_000);
+});
diff --git a/tests/native-profile-manager.test.ts b/tests/native-profile-manager.test.ts
index 4e9406033..f7fee37bb 100644
--- a/tests/native-profile-manager.test.ts
+++ b/tests/native-profile-manager.test.ts
@@ -268,7 +268,7 @@ describe("native main profile transactions", () => {
     expect((await failing.list()).activeProfileId).toBe(f.sourceProfile.id);
   });
 
-  test("a failed exact restore retains the encrypted recovery journal and never claims success", async () => {
+  test("rollback verification failure retains the encrypted recovery journal and never claims success", async () => {
     const f = await enrolledFixture();
     const authPath = f.manager.context.authPath;
     let authWrites = 0;
@@ -277,8 +277,7 @@ describe("native main profile transactions", () => {
       atomicWrite: async (path, content) => {
         if (path === authPath) {
           authWrites += 1;
-          if (authWrites === 1) return atomic(path, "{}\n");
-          throw new Error("injected restore failure");
+          if (authWrites <= 2) return atomic(path, "{}\n");
         }
         return atomic(path, content);
       },
@@ -293,6 +292,40 @@ describe("native main profile transactions", () => {
     expect(journal).not.toContain("opaque-refresh-target");
   });
 
+  test("normal switch rejects a busy native Codex process before any durable write", async () => {
+    const f = await enrolledFixture();
+    const blocked = new NativeProfileManager({
+      ...f.options,
+      processProbe: async () => ({ status: "busy" as const, count: 2 }),
+    });
+    let caught: unknown;
+    try { await blocked.switch("work", true); } catch (error) { caught = error; }
+    expect(caught).toBeInstanceOf(NativeProfileError);
+    expect((caught as NativeProfileError).code).toBe("CODEX_BUSY");
+    expect(readFileSync(blocked.context.authPath, "utf8")).toBe(f.source);
+    expect(existsSync(blocked.context.journalPath)).toBe(false);
+    expect((await blocked.list()).activeProfileId).toBe(f.sourceProfile.id);
+  });
+
+  test("vault-write failure after auth replacement restores exact source and removes the journal", async () => {
+    const f = await enrolledFixture();
+    let vaultWrites = 0;
+    const failing = new NativeProfileManager({
+      ...f.options,
+      atomicWrite: async (path, content) => {
+        if (path === f.manager.context.vaultPath && vaultWrites++ === 0) throw new Error("injected switch vault failure");
+        return atomic(path, content);
+      },
+    });
+    let caught: unknown;
+    try { await failing.switch("work", true); } catch (error) { caught = error; }
+    expect(caught).toBeInstanceOf(NativeProfileError);
+    expect((caught as NativeProfileError).code).toBe("SWITCH_ROLLED_BACK");
+    expect(readFileSync(failing.context.authPath, "utf8")).toBe(f.source);
+    expect(existsSync(failing.context.journalPath)).toBe(false);
+    expect((await failing.list()).activeProfileId).toBe(f.sourceProfile.id);
+  });
+
   test("explicit rollback recovery applies the native Codex process guard", async () => {
     const f = await enrolledFixture();
     const authPath = f.manager.context.authPath;

From 8f7120734c80e7b0c45e6678e5a3fba266ab16a6 Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Sun, 2 Aug 2026 12:28:19 +0900
Subject: [PATCH 11/63] fix(codex): guard native profile recovery state

---
 .../docs/reference/cli/providers-accounts.md  |   3 +-
 src/codex/native-profile-manager.ts           |  47 +++++-
 tests/native-profile-api.test.ts              |  17 +++
 tests/native-profile-manager.test.ts          | 144 +++++++++++++++++-
 4 files changed, 208 insertions(+), 3 deletions(-)

diff --git a/docs-site/src/content/docs/reference/cli/providers-accounts.md b/docs-site/src/content/docs/reference/cli/providers-accounts.md
index 50713e21f..7141971f2 100644
--- a/docs-site/src/content/docs/reference/cli/providers-accounts.md
+++ b/docs-site/src/content/docs/reference/cli/providers-accounts.md
@@ -219,8 +219,9 @@ ocx account main doctor
 ocx account main list
 ocx account main register <name>
 ocx account main add <name>
-ocx account main switch <name>
+ocx account main switch <name> --yes
 ocx account main recover
+ocx account main recover --rollback --yes
 ```
 
 Version 1 supports file-based Codex authentication, encrypts stored profiles with AES-256-GCM, and
diff --git a/src/codex/native-profile-manager.ts b/src/codex/native-profile-manager.ts
index 17a18db07..2ec34d92d 100644
--- a/src/codex/native-profile-manager.ts
+++ b/src/codex/native-profile-manager.ts
@@ -220,6 +220,15 @@ export class NativeProfileManager {
     try { unlinkSync(this.context.journalPath); } catch (error) { if (errorCode(error) !== "ENOENT") throw error; }
   }
 
+  private assertNoPendingRecovery(): void {
+    if (!readNativeProfileJournal(this.context)) return;
+    throw new NativeProfileError(
+      "RECOVERY_REQUIRED",
+      "A native-profile recovery journal is pending. Run `ocx account main recover` or `ocx account main recover --rollback --yes` before registering or adding profiles.",
+      409,
+    );
+  }
+
   private requireVault(): NativeMainProfileVaultV1 {
     const vault = readNativeProfileVault(this.context);
     if (!vault) throw new NativeProfileError("PROFILE_NOT_FOUND", "Register the current native login before adding or switching profiles.", 404);
@@ -246,6 +255,7 @@ export class NativeProfileManager {
 
   async register(labelInput: string): Promise<{ effectiveCodexHome: string; profile: NativeProfilePublic }> {
     return this.withLock(async () => {
+      this.assertNoPendingRecovery();
       requireFileCredentialStore(this.context);
       const label = validateNativeProfileLabel(labelInput);
       const envelope = readNativeEnvelope(this.context.authPath);
@@ -417,6 +427,7 @@ export class NativeProfileManager {
 
   async prepareStage(): Promise<{ stageId: string; stagingCodexHome: string; effectiveCodexHome: string }> {
     return this.withLock(async () => {
+      this.assertNoPendingRecovery();
       this.sweepStaleStages();
       requireFileCredentialStore(this.context);
       const vault = this.requireVault();
@@ -445,6 +456,7 @@ export class NativeProfileManager {
 
   async finishStage(stageId: string, labelInput: string): Promise<{ effectiveCodexHome: string; profile: NativeProfilePublic }> {
     return this.withLock(async () => {
+      this.assertNoPendingRecovery();
       this.stagePath(stageId);
       let target: NativeEnvelopeSnapshot | null = null;
       let current: NativeEnvelopeSnapshot | null = null;
@@ -650,10 +662,43 @@ export class NativeProfileManager {
           journal.sourcePayload,
           key,
         );
+        let rollbackVault = journal.beforeVault;
+        let rollbackVaultPublished = false;
+        if (current.envelope.digest !== journal.targetPayload.envelopeSha256) {
+          rollbackVault = structuredClone(journal.beforeVault);
+          const targetProfile = rollbackVault.profiles.find(profile =>
+            profile.id === journal.targetProfileId
+            && profile.identityHash === journal.targetIdentityHash
+            && profile.state === "inactive"
+          );
+          if (!targetProfile) {
+            throw new NativeProfileError(
+              "VAULT_INVALID",
+              "Recovery could not preserve the refreshed target login in its inactive profile and made no credential write.",
+              409,
+            );
+          }
+          const refreshedTargetPayload = encryptNativeEnvelope(
+            this.context,
+            targetProfile.id,
+            targetProfile.identityHash,
+            current.envelope,
+            key,
+          );
+          targetProfile.payload = refreshedTargetPayload;
+          targetProfile.updatedAt = new Date(this.now()).toISOString();
+          rollbackVault.revision += 1;
+          const preservedJournal = structuredClone(journal);
+          preservedJournal.targetPayload = refreshedTargetPayload;
+          preservedJournal.beforeVault = structuredClone(rollbackVault);
+          await this.writeJournal(preservedJournal);
+          await this.writeVault(rollbackVault);
+          rollbackVaultPublished = true;
+        }
         await this.atomicWrite(this.context.authPath, sourceEnvelope.text);
         const restored = this.verifyWrittenEnvelope(sourceEnvelope.digest, journal.sourceIdentityHash, key);
         restored.raw.fill(0);
-        await this.writeVault(journal.beforeVault);
+        if (!rollbackVaultPublished) await this.writeVault(rollbackVault);
         this.applyTransition(current.envelope.accountId, sourceEnvelope.accountId);
         this.removeJournal();
         return { ok: true, recovered: true, action: "rollback-source", effectiveCodexHome: this.context.codexHome, restartRequired: true };
diff --git a/tests/native-profile-api.test.ts b/tests/native-profile-api.test.ts
index d9143ed18..a212fd4a1 100644
--- a/tests/native-profile-api.test.ts
+++ b/tests/native-profile-api.test.ts
@@ -4,6 +4,7 @@ import { tmpdir } from "node:os";
 import type { OcxConfig } from "../src/types";
 import { handleNativeProfileAPI } from "../src/codex/native-profile-api";
 import type { NativeProfileManager } from "../src/codex/native-profile-manager";
+import { NativeProfileError } from "../src/codex/native-profile-types";
 import { setDraining, tryAdmitTurn } from "../src/server/lifecycle";
 
 const originalCodexHome = process.env.CODEX_HOME;
@@ -112,4 +113,20 @@ describe("native main profile management API", () => {
     expect(payload).not.toContain(missingHome);
     expect(payload).not.toContain(process.env.USERNAME ?? "Administrator");
   });
+
+  test("pending-recovery errors retain actionable public recovery commands", async () => {
+    const message = "A native-profile recovery journal is pending. Run `ocx account main recover` or `ocx account main recover --rollback --yes` before registering or adding profiles.";
+    const manager = {
+      register: async () => { throw new NativeProfileError("RECOVERY_REQUIRED", message, 409); },
+    } as unknown as NativeProfileManager;
+    const request = new Request("http://localhost/api/native-main-profiles/register", {
+      method: "POST",
+      body: JSON.stringify({ label: "personal" }),
+    });
+
+    const response = await handleNativeProfileAPI(request, new URL(request.url), {} as OcxConfig, { manager });
+
+    expect(response?.status).toBe(409);
+    expect(await response?.json()).toMatchObject({ code: "RECOVERY_REQUIRED", error: message });
+  });
 });
diff --git a/tests/native-profile-manager.test.ts b/tests/native-profile-manager.test.ts
index f7fee37bb..685a584b1 100644
--- a/tests/native-profile-manager.test.ts
+++ b/tests/native-profile-manager.test.ts
@@ -1,8 +1,9 @@
 import { afterEach, describe, expect, test } from "bun:test";
-import { existsSync, mkdirSync, mkdtempSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 import { NativeProfileManager } from "../src/codex/native-profile-manager";
+import { decryptNativeEnvelope, readNativeProfileVault } from "../src/codex/native-profile-store";
 import { NativeProfileError, type NativeProfileKey, type NativeProfileKeyProvider } from "../src/codex/native-profile-types";
 
 const roots: string[] = [];
@@ -70,6 +71,31 @@ async function enrolledFixture() {
   return { ...f, manager, sourceProfile: sourceProfile.profile, targetProfile: targetProfile.profile, stage };
 }
 
+async function leavePendingJournal(f: Awaited<ReturnType<typeof enrolledFixture>>): Promise<NativeProfileManager> {
+  const authPath = f.manager.context.authPath;
+  const journalPath = f.manager.context.journalPath;
+  let authWrites = 0;
+  const interrupted = new NativeProfileManager({
+    ...f.options,
+    atomicWrite: async (path, content) => {
+      if (path === authPath) {
+        authWrites += 1;
+        if (authWrites > 1) throw new Error("injected restore failure");
+      }
+      if (path === journalPath && content.includes('"phase": "auth-replaced"')) {
+        throw new Error("injected post-replacement failure");
+      }
+      return atomic(path, content);
+    },
+  });
+  let caught: unknown;
+  try { await interrupted.switch("work", true); } catch (error) { caught = error; }
+  expect(caught).toBeInstanceOf(NativeProfileError);
+  expect((caught as NativeProfileError).code).toBe("AUTH_RESTORE_FAILED");
+  expect(existsSync(journalPath)).toBe(true);
+  return interrupted;
+}
+
 async function waitForPath(path: string): Promise<void> {
   const deadline = Date.now() + 5_000;
   while (!existsSync(path) && Date.now() < deadline) await Bun.sleep(10);
@@ -363,6 +389,122 @@ describe("native main profile transactions", () => {
     expect(existsSync(journalPath)).toBe(true);
   });
 
+  test("pending recovery blocks register before auth or vault mutation", async () => {
+    const f = await enrolledFixture();
+    await leavePendingJournal(f);
+    const authBefore = readFileSync(f.manager.context.authPath, "utf8");
+    const vaultBefore = readFileSync(f.manager.context.vaultPath, "utf8");
+    const journalBefore = readFileSync(f.manager.context.journalPath, "utf8");
+
+    let caught: unknown;
+    try { await f.manager.register("renamed"); } catch (error) { caught = error; }
+
+    expect(caught).toBeInstanceOf(NativeProfileError);
+    expect((caught as NativeProfileError).code).toBe("RECOVERY_REQUIRED");
+    expect((caught as NativeProfileError).message).toContain("ocx account main recover");
+    expect(readFileSync(f.manager.context.authPath, "utf8")).toBe(authBefore);
+    expect(readFileSync(f.manager.context.vaultPath, "utf8")).toBe(vaultBefore);
+    expect(readFileSync(f.manager.context.journalPath, "utf8")).toBe(journalBefore);
+  });
+
+  test("pending recovery blocks prepareStage before creating staging plaintext", async () => {
+    const f = await enrolledFixture();
+    await leavePendingJournal(f);
+    const authBefore = readFileSync(f.manager.context.authPath, "utf8");
+    const vaultBefore = readFileSync(f.manager.context.vaultPath, "utf8");
+    const journalBefore = readFileSync(f.manager.context.journalPath, "utf8");
+    const stagingBefore = readdirSync(f.manager.context.stagingRoot);
+
+    let caught: unknown;
+    try { await f.manager.prepareStage(); } catch (error) { caught = error; }
+
+    expect(caught).toBeInstanceOf(NativeProfileError);
+    expect((caught as NativeProfileError).code).toBe("RECOVERY_REQUIRED");
+    expect(readdirSync(f.manager.context.stagingRoot)).toEqual(stagingBefore);
+    expect(readFileSync(f.manager.context.authPath, "utf8")).toBe(authBefore);
+    expect(readFileSync(f.manager.context.vaultPath, "utf8")).toBe(vaultBefore);
+    expect(readFileSync(f.manager.context.journalPath, "utf8")).toBe(journalBefore);
+  });
+
+  test("pending recovery blocks finishStage without deleting staged plaintext", async () => {
+    const f = await enrolledFixture();
+    const stage = await f.manager.prepareStage();
+    const stagedEnvelope = envelope("account-third", "third");
+    writeFileSync(join(stage.stagingCodexHome, "auth.json"), stagedEnvelope);
+    await leavePendingJournal(f);
+    const authBefore = readFileSync(f.manager.context.authPath, "utf8");
+    const vaultBefore = readFileSync(f.manager.context.vaultPath, "utf8");
+    const journalBefore = readFileSync(f.manager.context.journalPath, "utf8");
+
+    let caught: unknown;
+    try { await f.manager.finishStage(stage.stageId, "third"); } catch (error) { caught = error; }
+
+    expect(caught).toBeInstanceOf(NativeProfileError);
+    expect((caught as NativeProfileError).code).toBe("RECOVERY_REQUIRED");
+    expect(readFileSync(join(stage.stagingCodexHome, "auth.json"), "utf8")).toBe(stagedEnvelope);
+    expect(readFileSync(f.manager.context.authPath, "utf8")).toBe(authBefore);
+    expect(readFileSync(f.manager.context.vaultPath, "utf8")).toBe(vaultBefore);
+    expect(readFileSync(f.manager.context.journalPath, "utf8")).toBe(journalBefore);
+  });
+
+  test("explicit rollback preserves a digest-changed target envelope before restoring source auth", async () => {
+    const f = await enrolledFixture();
+    await leavePendingJournal(f);
+    const refreshedTarget = envelope("account-target", "target-refreshed");
+    writeFileSync(f.manager.context.authPath, refreshedTarget);
+
+    const result = await f.manager.recover(true, true);
+
+    expect(result).toMatchObject({ recovered: true, action: "rollback-source", restartRequired: true });
+    expect(readFileSync(f.manager.context.authPath, "utf8")).toBe(f.source);
+    expect(existsSync(f.manager.context.journalPath)).toBe(false);
+    const vaultText = readFileSync(f.manager.context.vaultPath, "utf8");
+    expect(vaultText).not.toContain("target-refreshed");
+    expect(vaultText).not.toContain("opaque-access-target-refreshed");
+    expect(vaultText).not.toContain("opaque-refresh-target-refreshed");
+    const vault = readNativeProfileVault(f.manager.context)!;
+    expect(vault.activeProfileId).toBe(f.sourceProfile.id);
+    const targetProfile = vault.profiles.find(profile => profile.id === f.targetProfile.id)!;
+    expect(targetProfile.state).toBe("inactive");
+    const key = await f.keyProvider.get(f.manager.context.homeId);
+    expect(key).not.toBeNull();
+    const decrypted = decryptNativeEnvelope(
+      f.manager.context,
+      targetProfile.id,
+      targetProfile.identityHash,
+      targetProfile.payload!,
+      key!,
+    );
+    try { expect(decrypted.text).toBe(refreshedTarget); } finally { decrypted.raw.fill(0); key!.key.fill(0); }
+    expect(f.transitions).toEqual(["account-target->account-source"]);
+  });
+
+  test("rollback preservation failure leaves refreshed target auth untouched and journaled", async () => {
+    const f = await enrolledFixture();
+    await leavePendingJournal(f);
+    const refreshedTarget = envelope("account-target", "target-refreshed-failure");
+    writeFileSync(f.manager.context.authPath, refreshedTarget);
+    const vaultBefore = readFileSync(f.manager.context.vaultPath, "utf8");
+    const failing = new NativeProfileManager({
+      ...f.options,
+      atomicWrite: async (path, content) => {
+        if (path === f.manager.context.vaultPath) throw new Error("injected rollback vault failure");
+        return atomic(path, content);
+      },
+    });
+
+    let caught: unknown;
+    try { await failing.recover(true, true); } catch (error) { caught = error; }
+
+    expect(caught).toBeInstanceOf(Error);
+    expect(readFileSync(f.manager.context.authPath, "utf8")).toBe(refreshedTarget);
+    expect(readFileSync(f.manager.context.vaultPath, "utf8")).toBe(vaultBefore);
+    expect(existsSync(f.manager.context.journalPath)).toBe(true);
+    const journalText = readFileSync(f.manager.context.journalPath, "utf8");
+    expect(journalText).not.toContain("target-refreshed-failure");
+    expect(journalText).not.toContain("opaque-refresh-target-refreshed-failure");
+  });
+
   test("non-file Codex credential stores fail before vault or auth mutation", async () => {
     const f = fixture();
     writeFileSync(join(f.codexHome, "config.toml"), 'cli_auth_credentials_store = "auto"\n');

From 1f7fa2dae230fb99b51bb0fa4b288e094c238544 Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Sun, 2 Aug 2026 13:37:46 +0900
Subject: [PATCH 12/63] fix(ci): harden native profile platform checks

---
 scripts/keyring-smoke.ts               | 33 +++++++++++--
 src/codex/native-profile-processes.ts  | 67 ++++++++++++++++++++++----
 tests/keyring-smoke.test.ts            | 58 ++++++++++++++++++++++
 tests/native-profile-processes.test.ts | 59 +++++++++++++++++++++++
 4 files changed, 203 insertions(+), 14 deletions(-)
 create mode 100644 tests/native-profile-processes.test.ts

diff --git a/scripts/keyring-smoke.ts b/scripts/keyring-smoke.ts
index 66f79e635..cf49dd7cf 100644
--- a/scripts/keyring-smoke.ts
+++ b/scripts/keyring-smoke.ts
@@ -30,6 +30,8 @@ export async function runKeyringSmoke({
   const secret = createRandomBytes(32);
   let entry: KeyringSmokeEntry | null = null;
   let stored: Buffer | null = null;
+  let operationFailed = false;
+  let operationError: unknown;
 
   try {
     entry = await createEntry(service, account);
@@ -39,16 +41,37 @@ export async function runKeyringSmoke({
     if (!stored || stored.byteLength !== secret.byteLength || !timingSafeEqual(stored, secret)) {
       throw new Error("OS keyring smoke readback did not match the stored value.");
     }
-  } finally {
+  } catch (error) {
+    operationFailed = true;
+    operationError = error;
+  }
+
+  let cleanupFailed = false;
+  let cleanupError: unknown;
+  if (entry) {
     try {
-      if (entry && !await entry.deleteCredential(AbortSignal.timeout(timeoutMs))) {
+      if (!await entry.deleteCredential(AbortSignal.timeout(timeoutMs))) {
         throw new Error("OS keyring smoke could not delete the temporary entry.");
       }
-    } finally {
-      stored?.fill(0);
-      secret.fill(0);
+    } catch (error) {
+      cleanupFailed = true;
+      cleanupError = error;
+    }
+  }
+
+  stored?.fill(0);
+  secret.fill(0);
+
+  if (operationFailed) {
+    if (cleanupFailed && operationError instanceof Error) {
+      Object.defineProperty(operationError, "cleanupError", {
+        configurable: true,
+        value: cleanupError,
+      });
     }
+    throw operationError;
   }
+  if (cleanupFailed) throw cleanupError;
 }
 
 if (import.meta.main) {
diff --git a/src/codex/native-profile-processes.ts b/src/codex/native-profile-processes.ts
index 2ddcb519b..6780f01ee 100644
--- a/src/codex/native-profile-processes.ts
+++ b/src/codex/native-profile-processes.ts
@@ -1,23 +1,64 @@
 import { execFileSync } from "node:child_process";
-import { basename } from "node:path";
+import { basename, win32 } from "node:path";
+
+const DEFAULT_WINDOWS_SYSTEM_ROOT = "C:\\Windows";
+const PROCESS_LIST_MAX_BUFFER = 16 * 1024 * 1024;
+
+export interface NativeProcessExecOptions {
+  encoding: "utf8";
+  stdio: ["ignore", "pipe", "ignore"];
+  timeout: number;
+  maxBuffer: number;
+  windowsHide?: boolean;
+}
+
+export type NativeProcessExecutor = (file: string, args: string[], options: NativeProcessExecOptions) => string;
+
+export interface NativeCodexProcessProbeOptions {
+  platform?: NodeJS.Platform;
+  systemRoot?: string;
+  execFile?: NativeProcessExecutor;
+  pid?: number;
+}
 
 export type NativeCodexProcessProbe =
   | { status: "clear"; count: 0 }
   | { status: "busy"; count: number }
   | { status: "unknown"; count: 0 };
 
-function windowsProcessCount(): number {
-  const powershell = `${process.env.SystemRoot ?? "C:\\Windows"}\\System32\\WindowsPowerShell\\v1.0\\powershell.exe`;
+const executeProcess: NativeProcessExecutor = (file, args, options) => execFileSync(file, args, options);
+
+export function resolveWindowsSystemRoot(value: string | undefined): string {
+  if (!value?.trim()) return DEFAULT_WINDOWS_SYSTEM_ROOT;
+  const normalized = win32.normalize(value.trim());
+  const parsed = win32.parse(normalized);
+  const driveRoot = /^[A-Za-z]:\\$/.test(parsed.root);
+  const directWindowsDirectory = win32.dirname(normalized).toLowerCase() === parsed.root.toLowerCase()
+    && win32.basename(normalized).toLowerCase() === "windows";
+  return driveRoot && directWindowsDirectory
+    ? `${parsed.root[0]!.toUpperCase()}:\\Windows`
+    : DEFAULT_WINDOWS_SYSTEM_ROOT;
+}
+
+function windowsProcessCount(execFile: NativeProcessExecutor, systemRoot: string | undefined): number {
+  const powershell = win32.join(
+    resolveWindowsSystemRoot(systemRoot),
+    "System32",
+    "WindowsPowerShell",
+    "v1.0",
+    "powershell.exe",
+  );
   const script = [
     "$ErrorActionPreference='Stop';",
     "$self=$PID;",
     "$items=Get-CimInstance Win32_Process | Where-Object { $_.ProcessId -ne $self -and ($_.Name -match '^(?i:codex)(?:\\.exe)?$' -or $_.CommandLine -match '(?i)(?:^|[\\\\/\"\\s])codex(?:\\.exe|\\.cmd)?(?:[\"\\s]|$)') };",
     "@($items).Count",
   ].join(" ");
-  const output = execFileSync(powershell, ["-NoLogo", "-NoProfile", "-NonInteractive", "-Command", script], {
+  const output = execFile(powershell, ["-NoLogo", "-NoProfile", "-NonInteractive", "-Command", script], {
     encoding: "utf8",
     stdio: ["ignore", "pipe", "ignore"],
     timeout: 12_000,
+    maxBuffer: PROCESS_LIST_MAX_BUFFER,
     windowsHide: true,
   }).trim();
   const count = Number(output);
@@ -25,16 +66,17 @@ function windowsProcessCount(): number {
   return count;
 }
 
-function unixProcessCount(): number {
-  const output = execFileSync("ps", ["-eo", "pid=,comm=,args="], {
+function unixProcessCount(execFile: NativeProcessExecutor, pid: number): number {
+  const output = execFile("ps", ["-eo", "pid=,comm=,args="], {
     encoding: "utf8",
     stdio: ["ignore", "pipe", "ignore"],
     timeout: 5_000,
+    maxBuffer: PROCESS_LIST_MAX_BUFFER,
   });
   let count = 0;
   for (const line of output.split("\n")) {
     const match = line.trim().match(/^(\d+)\s+(\S+)\s*(.*)$/);
-    if (!match || Number(match[1]) === process.pid) continue;
+    if (!match || Number(match[1]) === pid) continue;
     const command = basename(match[2]!).toLowerCase();
     const firstArg = basename(match[3]!.trim().split(/\s+/, 1)[0] ?? "").toLowerCase();
     if (command === "codex" || command === "codex.exe" || firstArg === "codex" || firstArg === "codex.exe") count += 1;
@@ -43,9 +85,16 @@ function unixProcessCount(): number {
 }
 
 /** Best-effort, read-only process probe. It never terminates a user process. */
-export async function probeNativeCodexProcesses(): Promise<NativeCodexProcessProbe> {
+export async function probeNativeCodexProcesses({
+  platform = process.platform,
+  systemRoot = process.env.SystemRoot,
+  execFile = executeProcess,
+  pid = process.pid,
+}: NativeCodexProcessProbeOptions = {}): Promise<NativeCodexProcessProbe> {
   try {
-    const count = process.platform === "win32" ? windowsProcessCount() : unixProcessCount();
+    const count = platform === "win32"
+      ? windowsProcessCount(execFile, systemRoot)
+      : unixProcessCount(execFile, pid);
     return count > 0 ? { status: "busy", count } : { status: "clear", count: 0 };
   } catch {
     return { status: "unknown", count: 0 };
diff --git a/tests/keyring-smoke.test.ts b/tests/keyring-smoke.test.ts
index 0683dd821..30efa122c 100644
--- a/tests/keyring-smoke.test.ts
+++ b/tests/keyring-smoke.test.ts
@@ -54,4 +54,62 @@ describe("runKeyringSmoke", () => {
     expect(entry.deletes).toBe(1);
     expect(entry.secret).toBeNull();
   });
+
+  test("preserves a readback error when deletion returns false", async () => {
+    const entry = new MemoryKeyringEntry();
+    const generated = Buffer.alloc(32, 0x5a);
+    entry.getSecret = async () => Buffer.alloc(32, 0x00);
+    entry.deleteCredential = async () => {
+      entry.deletes += 1;
+      return false;
+    };
+
+    const error = await runKeyringSmoke({
+      createEntry: async () => entry,
+      createRandomBytes: () => generated,
+      createId: () => "test-id",
+    }).catch(cause => cause);
+
+    expect(error).toBeInstanceOf(Error);
+    expect((error as Error).message).toContain("readback did not match");
+    expect((error as Error & { cleanupError?: unknown }).cleanupError).toBeInstanceOf(Error);
+    expect(entry.deletes).toBe(1);
+    expect(generated.equals(Buffer.alloc(32))).toBe(true);
+  });
+
+  test("preserves a readback error when deletion throws", async () => {
+    const entry = new MemoryKeyringEntry();
+    const deletionError = new Error("injected keyring deletion failure");
+    entry.getSecret = async () => Buffer.alloc(32, 0x00);
+    entry.deleteCredential = async () => {
+      entry.deletes += 1;
+      throw deletionError;
+    };
+
+    const error = await runKeyringSmoke({
+      createEntry: async () => entry,
+      createRandomBytes: (size) => Buffer.alloc(size, 0x5a),
+      createId: () => "test-id",
+    }).catch(cause => cause);
+
+    expect((error as Error).message).toContain("readback did not match");
+    expect((error as Error & { cleanupError?: unknown }).cleanupError).toBe(deletionError);
+    expect(entry.deletes).toBe(1);
+  });
+
+  test("fails when deletion is the only failed operation", async () => {
+    const entry = new MemoryKeyringEntry();
+    entry.deleteCredential = async () => {
+      entry.deletes += 1;
+      return false;
+    };
+
+    await expect(runKeyringSmoke({
+      createEntry: async () => entry,
+      createRandomBytes: (size) => Buffer.alloc(size, 0x5a),
+      createId: () => "test-id",
+    })).rejects.toThrow("could not delete the temporary entry");
+
+    expect(entry.deletes).toBe(1);
+  });
 });
diff --git a/tests/native-profile-processes.test.ts b/tests/native-profile-processes.test.ts
new file mode 100644
index 000000000..065083d09
--- /dev/null
+++ b/tests/native-profile-processes.test.ts
@@ -0,0 +1,59 @@
+import { describe, expect, test } from "bun:test";
+import {
+  probeNativeCodexProcesses,
+  resolveWindowsSystemRoot,
+  type NativeProcessExecutor,
+} from "../src/codex/native-profile-processes";
+
+describe("native profile process probe", () => {
+  test("accepts only a drive-root Windows directory as SystemRoot", () => {
+    expect(resolveWindowsSystemRoot(undefined)).toBe("C:\\Windows");
+    expect(resolveWindowsSystemRoot("D:\\Windows")).toBe("D:\\Windows");
+    expect(resolveWindowsSystemRoot("d:\\WINDOWS\\")).toBe("D:\\Windows");
+    expect(resolveWindowsSystemRoot("C:\\Users\\runner\\Windows")).toBe("C:\\Windows");
+    expect(resolveWindowsSystemRoot("\\\\server\\share\\Windows")).toBe("C:\\Windows");
+    expect(resolveWindowsSystemRoot("relative\\Windows")).toBe("C:\\Windows");
+  });
+
+  test("uses the validated PowerShell path and an explicit process-list buffer", async () => {
+    const calls: Parameters<NativeProcessExecutor>[] = [];
+    const execFile: NativeProcessExecutor = (file, args, options) => {
+      calls.push([file, args, options]);
+      return "2\n";
+    };
+
+    await expect(probeNativeCodexProcesses({
+      platform: "win32",
+      systemRoot: "C:\\Users\\runner\\fake-root",
+      execFile,
+    })).resolves.toEqual({ status: "busy", count: 2 });
+
+    expect(calls).toHaveLength(1);
+    expect(calls[0]![0]).toBe("C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe");
+    expect(calls[0]![2].maxBuffer).toBe(16 * 1024 * 1024);
+    expect(calls[0]![2].windowsHide).toBe(true);
+  });
+
+  test("sets the same buffer for Unix process lists and excludes its own pid", async () => {
+    const calls: Parameters<NativeProcessExecutor>[] = [];
+    const execFile: NativeProcessExecutor = (file, args, options) => {
+      calls.push([file, args, options]);
+      return [
+        "41 codex /usr/local/bin/codex",
+        "42 codex /usr/local/bin/codex",
+        "43 bun /opt/tools/codex --serve",
+      ].join("\n");
+    };
+
+    await expect(probeNativeCodexProcesses({
+      platform: "linux",
+      execFile,
+      pid: 42,
+    })).resolves.toEqual({ status: "busy", count: 2 });
+
+    expect(calls).toHaveLength(1);
+    expect(calls[0]![0]).toBe("ps");
+    expect(calls[0]![1]).toEqual(["-eo", "pid=,comm=,args="]);
+    expect(calls[0]![2].maxBuffer).toBe(16 * 1024 * 1024);
+  });
+});

From 047a7a2c6b17ea8b50de0264a5217a56070f3599 Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Sun, 2 Aug 2026 13:36:21 +0900
Subject: [PATCH 13/63] fix(codex): address native profile CLI review

---
 .../ja/reference/cli/providers-accounts.md    | 15 ++++++++++++++
 .../ko/reference/cli/providers-accounts.md    | 15 ++++++++++++++
 .../docs/reference/cli/providers-accounts.md  | 14 ++++++-------
 .../ru/reference/cli/providers-accounts.md    | 15 ++++++++++++++
 .../zh-cn/reference/cli/providers-accounts.md | 15 ++++++++++++++
 src/cli/account-main.ts                       | 13 +++++++++++-
 tests/cli-native-profile.test.ts              | 20 +++++++++++++++++++
 7 files changed, 99 insertions(+), 8 deletions(-)

diff --git a/docs-site/src/content/docs/ja/reference/cli/providers-accounts.md b/docs-site/src/content/docs/ja/reference/cli/providers-accounts.md
index 958117d67..bf403110c 100644
--- a/docs-site/src/content/docs/ja/reference/cli/providers-accounts.md
+++ b/docs-site/src/content/docs/ja/reference/cli/providers-accounts.md
@@ -164,6 +164,21 @@ security find-generic-password -w openrouter | ocx account add-key openrouter --
 
 アカウントの Codex リセット クレジットを検査します。クレジットの消費は破壊的であり、`--consume` と `--yes` の両方が必要です。
 
+### `ocx account main <subcommand>`
+
+OpenCodex のアカウントプールルーティングを変更せずに、名前付きのネイティブ Codex メインログインプロファイルを管理します。
+
+```text
+ocx account main doctor [--json]
+ocx account main list [--json]
+ocx account main register <label> [--json]
+ocx account main add <label>
+ocx account main switch <profile-id-or-label> --yes [--json]
+ocx account main recover [--rollback --yes] [--json]
+```
+
+バージョン 1 はファイルベースの Codex 認証をサポートし、保存したプロファイルを AES-256-GCM で暗号化し、暗号鍵を OS の資格情報ストアに保持します。`add` は、生成された資格情報を取り込む前に公式 Codex ログインをステージングします。プロファイルを切り替える前に Codex を終了してください。切り替えに成功するとローカルのタスクと履歴は保持されますが、続行する前に Codex の再起動が必要です。`doctor` でプロファイル状態を確認し、`recover` で中断した切り替えを完了またはロールバックできます。`switch` にはプロファイル ID またはラベルを指定できます。
+
 ## モデル
 
 ### `ocx models [subcommand]`・`ocx model <subcommand>`
diff --git a/docs-site/src/content/docs/ko/reference/cli/providers-accounts.md b/docs-site/src/content/docs/ko/reference/cli/providers-accounts.md
index 936c1e769..ea33bb69a 100644
--- a/docs-site/src/content/docs/ko/reference/cli/providers-accounts.md
+++ b/docs-site/src/content/docs/ko/reference/cli/providers-accounts.md
@@ -164,6 +164,21 @@ security find-generic-password -w openrouter | ocx account add-key openrouter --
 
 계정의 Codex reset credits를 확인합니다. credit을 소비하는 동작은 파괴적이므로 `--consume`와 `--yes`를 둘 다 요구합니다.
 
+### `ocx account main <subcommand>`
+
+OpenCodex 계정 풀 라우팅을 변경하지 않고 이름이 지정된 네이티브 Codex 기본 로그인 프로필을 관리합니다.
+
+```text
+ocx account main doctor [--json]
+ocx account main list [--json]
+ocx account main register <label> [--json]
+ocx account main add <label>
+ocx account main switch <profile-id-or-label> --yes [--json]
+ocx account main recover [--rollback --yes] [--json]
+```
+
+버전 1은 파일 기반 Codex 인증을 지원하고 저장된 프로필을 AES-256-GCM으로 암호화하며 암호화 키를 운영 체제 자격 증명 저장소에 보관합니다. `add`는 생성된 자격 증명을 가져오기 전에 공식 Codex 로그인을 스테이징합니다. 프로필을 전환하기 전에 Codex를 종료하십시오. 전환에 성공하면 로컬 작업과 기록은 보존되지만 계속하기 전에 Codex를 다시 시작해야 합니다. `doctor`로 프로필 상태를 확인하고 `recover`로 중단된 전환을 완료하거나 롤백할 수 있습니다. `switch`에는 프로필 ID 또는 라벨을 지정할 수 있습니다.
+
 ## 모델
 
 ### `ocx models [subcommand]` · `ocx model <subcommand>`
diff --git a/docs-site/src/content/docs/reference/cli/providers-accounts.md b/docs-site/src/content/docs/reference/cli/providers-accounts.md
index 7141971f2..d2504380f 100644
--- a/docs-site/src/content/docs/reference/cli/providers-accounts.md
+++ b/docs-site/src/content/docs/reference/cli/providers-accounts.md
@@ -215,13 +215,12 @@ Inspect Codex reset credits for an account. Consuming a credit is destructive an
 Manage named native Codex main-login profiles without changing OpenCodex account-pool routing:
 
 ```text
-ocx account main doctor
-ocx account main list
-ocx account main register <name>
-ocx account main add <name>
-ocx account main switch <name> --yes
-ocx account main recover
-ocx account main recover --rollback --yes
+ocx account main doctor [--json]
+ocx account main list [--json]
+ocx account main register <label> [--json]
+ocx account main add <label>
+ocx account main switch <profile-id-or-label> --yes [--json]
+ocx account main recover [--rollback --yes] [--json]
 ```
 
 Version 1 supports file-based Codex authentication, encrypts stored profiles with AES-256-GCM, and
@@ -229,6 +228,7 @@ keeps the encryption key in the operating-system credential store. `add` stages
 login flow before importing the resulting credential. Close Codex before switching profiles; a
 successful switch preserves local tasks and history, then requires Codex to be restarted. Use
 `doctor` to inspect profile state and `recover` to finish or roll back an interrupted transition.
+`switch` accepts either the profile ID or its label.
 
 ## Models
 
diff --git a/docs-site/src/content/docs/ru/reference/cli/providers-accounts.md b/docs-site/src/content/docs/ru/reference/cli/providers-accounts.md
index b603b47f2..bf57cb1f5 100644
--- a/docs-site/src/content/docs/ru/reference/cli/providers-accounts.md
+++ b/docs-site/src/content/docs/ru/reference/cli/providers-accounts.md
@@ -215,6 +215,21 @@ security find-generic-password -w openrouter | ocx account add-key openrouter --
 Проверить reset-credit'ы Codex для аккаунта. Расходование кредита разрушительно и требует сразу
 оба флага: и `--consume`, и `--yes`.
 
+### `ocx account main <subcommand>`
+
+Управлять именованными профилями нативного основного логина Codex, не изменяя маршрутизацию пула аккаунтов OpenCodex.
+
+```text
+ocx account main doctor [--json]
+ocx account main list [--json]
+ocx account main register <label> [--json]
+ocx account main add <label>
+ocx account main switch <profile-id-or-label> --yes [--json]
+ocx account main recover [--rollback --yes] [--json]
+```
+
+Версия 1 поддерживает файловую аутентификацию Codex, шифрует сохранённые профили с помощью AES-256-GCM и хранит ключ шифрования в хранилище учётных данных операционной системы. `add` запускает официальный вход Codex в промежуточной среде перед импортом полученных учётных данных. Перед переключением профиля закройте Codex. Успешное переключение сохраняет локальные задачи и историю, после чего Codex необходимо перезапустить. Используйте `doctor` для проверки состояния профилей, а `recover` для завершения или отката прерванного перехода. `switch` принимает ID профиля или его label.
+
 ## Модели
 
 ### `ocx models [subcommand]` · `ocx model <subcommand>`
diff --git a/docs-site/src/content/docs/zh-cn/reference/cli/providers-accounts.md b/docs-site/src/content/docs/zh-cn/reference/cli/providers-accounts.md
index 4dda2b618..9f04dba1b 100644
--- a/docs-site/src/content/docs/zh-cn/reference/cli/providers-accounts.md
+++ b/docs-site/src/content/docs/zh-cn/reference/cli/providers-accounts.md
@@ -198,6 +198,21 @@ security find-generic-password -w openrouter | ocx account add-key openrouter --
 查看某个账号的 Codex 重置额度。消耗额度会造成破坏性影响，因此同时需要 `--consume`
 和 `--yes`。
 
+### `ocx account main <subcommand>`
+
+管理命名的原生 Codex 主登录配置文件，而不更改 OpenCodex 账号池路由。
+
+```text
+ocx account main doctor [--json]
+ocx account main list [--json]
+ocx account main register <label> [--json]
+ocx account main add <label>
+ocx account main switch <profile-id-or-label> --yes [--json]
+ocx account main recover [--rollback --yes] [--json]
+```
+
+版本 1 支持基于文件的 Codex 身份验证，使用 AES-256-GCM 加密保存的配置文件，并将加密密钥保存在操作系统凭据存储中。`add` 会先在受限暂存环境中启动官方 Codex 登录，再导入生成的凭据。切换配置文件前请关闭 Codex。切换成功后会保留本地任务和历史记录，但继续使用前必须重启 Codex。使用 `doctor` 检查配置文件状态，使用 `recover` 完成或回滚中断的切换。`switch` 可接受配置文件 ID 或标签。
+
 ## 模型
 
 ### `ocx models [subcommand]` · `ocx model <subcommand>`
diff --git a/src/cli/account-main.ts b/src/cli/account-main.ts
index 951389d74..28436d6bd 100644
--- a/src/cli/account-main.ts
+++ b/src/cli/account-main.ts
@@ -1,4 +1,6 @@
 import { isAbsolute } from "node:path";
+import { codexExecInvocation } from "../codex/exec-invocation";
+import type { ResolveDeps, SpawnInvocation } from "../lib/win-exec";
 import { apiError, apiJson, proxyUnreachable, resolveBaseUrl, type AccountDeps } from "./account-api";
 
 const USAGE = `Usage:
@@ -41,12 +43,21 @@ function printProfiles(profiles: PublicProfile[]): void {
   console.log([line(header), ...rows.map(line)].join("\n"));
 }
 
+export function nativeMainCodexLoginInvocation(
+  platform: NodeJS.Platform = process.platform,
+  deps: ResolveDeps = {},
+): SpawnInvocation {
+  return codexExecInvocation("codex", ["login"], platform, deps);
+}
+
 async function runOfficialCodexLogin(codexHome: string): Promise<number> {
-  const child = Bun.spawn(["codex", "login"], {
+  const invocation = nativeMainCodexLoginInvocation();
+  const child = Bun.spawn([invocation.file, ...invocation.args], {
     env: { ...process.env, CODEX_HOME: codexHome },
     stdin: "inherit",
     stdout: "inherit",
     stderr: "inherit",
+    ...(invocation.options.windowsVerbatimArguments ? { windowsVerbatimArguments: true } : {}),
   });
   return child.exited;
 }
diff --git a/tests/cli-native-profile.test.ts b/tests/cli-native-profile.test.ts
index c9d25f46a..e711836b3 100644
--- a/tests/cli-native-profile.test.ts
+++ b/tests/cli-native-profile.test.ts
@@ -2,6 +2,7 @@ import { afterEach, describe, expect, test } from "bun:test";
 import { join } from "node:path";
 import { tmpdir } from "node:os";
 import { cmdAccount } from "../src/cli/account";
+import { nativeMainCodexLoginInvocation } from "../src/cli/account-main";
 
 const originalLog = console.log;
 const originalError = console.error;
@@ -12,6 +13,25 @@ afterEach(() => {
 });
 
 describe("ocx account main", () => {
+  test("official login resolves a Windows npm shim through ComSpec", () => {
+    const npmBin = "C:\\Users\\tester\\AppData\\Roaming\\npm";
+    const codexShim = `${npmBin}\\codex.cmd`;
+    const invocation = nativeMainCodexLoginInvocation("win32", {
+      env: {
+        PATH: npmBin,
+        PATHEXT: ".CMD",
+        ComSpec: "C:\\Windows\\System32\\cmd.exe",
+      },
+      exists: path => path.toLowerCase() === codexShim.toLowerCase(),
+    });
+
+    expect(invocation.file).toBe("C:\\Windows\\System32\\cmd.exe");
+    expect(invocation.args.slice(0, 3)).toEqual(["/d", "/s", "/c"]);
+    expect(invocation.args[3]).toContain("codex.cmd");
+    expect(invocation.args[3]).toContain('^"login^"');
+    expect(invocation.options).toEqual({ windowsVerbatimArguments: true });
+  });
+
   test("add keeps the auth envelope off HTTP and switch requires explicit stopped confirmation", async () => {
     const stagingHome = join(tmpdir(), "ocx-native-profile-stage");
     const requests: Array<{ path: string; body?: Record<string, unknown> }> = [];

From 31ce02f47366cb16fe91bfb9348577a4226e4d43 Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Sun, 2 Aug 2026 13:35:42 +0900
Subject: [PATCH 14/63] test(codex): harden native profile review coverage

---
 tests/helpers/native-profile-lock-child.ts    |  7 ++-
 tests/helpers/native-profile-startup-child.ts |  4 ++
 tests/helpers/native-profile-switch-child.ts  |  5 ++
 tests/native-profile-api.test.ts              | 55 ++++++++++---------
 tests/native-profile-crash-boundaries.test.ts | 52 ++++++++++++------
 tests/native-profile-manager.test.ts          | 22 +++++---
 tests/native-profile-startup.test.ts          | 13 +++--
 7 files changed, 102 insertions(+), 56 deletions(-)

diff --git a/tests/helpers/native-profile-lock-child.ts b/tests/helpers/native-profile-lock-child.ts
index 3c962752f..52707cd6a 100644
--- a/tests/helpers/native-profile-lock-child.ts
+++ b/tests/helpers/native-profile-lock-child.ts
@@ -6,6 +6,7 @@ const codexHome = process.env.NATIVE_PROFILE_TEST_CODEX_HOME;
 const configDir = process.env.NATIVE_PROFILE_TEST_CONFIG_DIR;
 const readyPath = process.env.NATIVE_PROFILE_TEST_READY;
 const releasePath = process.env.NATIVE_PROFILE_TEST_RELEASE;
+const contentionPath = process.env.NATIVE_PROFILE_TEST_CONTENTION;
 
 if (!codexHome || !configDir || !readyPath || !releasePath) {
   throw new Error("native-profile lock child is missing required test paths");
@@ -16,9 +17,13 @@ const manager = new NativeProfileManager({
   configDir,
   hardenPath: async () => {},
   lockWaitMs: 5_000,
+  sleep: async ms => {
+    if (contentionPath) writeFileSync(contentionPath, "contended");
+    await Bun.sleep(ms);
+  },
   onLockAcquired: async () => {
     writeFileSync(readyPath, "ready");
-    if (process.env.NATIVE_PROFILE_TEST_CRASH === "1") process.exit(0);
+    if (process.env.NATIVE_PROFILE_TEST_CRASH === "1") process.exit(87);
     while (!existsSync(releasePath)) await Bun.sleep(10);
   },
 });
diff --git a/tests/helpers/native-profile-startup-child.ts b/tests/helpers/native-profile-startup-child.ts
index f9b112ba7..b0b1e6f49 100644
--- a/tests/helpers/native-profile-startup-child.ts
+++ b/tests/helpers/native-profile-startup-child.ts
@@ -74,6 +74,10 @@ void waitForNativeMainStartupGate().then(() => {
     mainTokenLive: isMainAccountTokenLive(),
     mainUsable: isCodexAccountUsable(loadConfig(), MAIN_CODEX_ACCOUNT_ID),
   }));
+}).catch((error: unknown) => {
+  writeFileSync(settledPath, JSON.stringify({
+    error: error instanceof Error ? `${error.message}\n${error.stack ?? ""}` : String(error),
+  }));
 });
 
 while (!existsSync(stopPath)) await Bun.sleep(10);
diff --git a/tests/helpers/native-profile-switch-child.ts b/tests/helpers/native-profile-switch-child.ts
index 8434d01f6..a6555e6c6 100644
--- a/tests/helpers/native-profile-switch-child.ts
+++ b/tests/helpers/native-profile-switch-child.ts
@@ -16,6 +16,7 @@ const keyBytes = Buffer.from(required("NATIVE_SWITCH_KEY"), "base64");
 const resultPath = required("NATIVE_SWITCH_RESULT");
 const markerPath = process.env.NATIVE_SWITCH_MARKER;
 const releasePath = process.env.NATIVE_SWITCH_RELEASE;
+const contentionPath = process.env.NATIVE_SWITCH_CONTENTION;
 const crashBoundary = process.env.NATIVE_SWITCH_CRASH_BOUNDARY as NativeProfileSwitchBoundary | undefined;
 
 class EnvKeyProvider implements NativeProfileKeyProvider {
@@ -29,6 +30,10 @@ const manager = new NativeProfileManager({
   keyProvider: new EnvKeyProvider(),
   hardenPath: async () => {},
   processProbe: async () => ({ status: "clear", count: 0 }),
+  sleep: async ms => {
+    if (contentionPath) writeFileSync(contentionPath, "contended");
+    await Bun.sleep(ms);
+  },
   onLockAcquired: async () => {
     if (markerPath && !crashBoundary) writeFileSync(markerPath, "lock-acquired");
     if (releasePath && !crashBoundary) while (!existsSync(releasePath)) await Bun.sleep(10);
diff --git a/tests/native-profile-api.test.ts b/tests/native-profile-api.test.ts
index a212fd4a1..eb15cd2f6 100644
--- a/tests/native-profile-api.test.ts
+++ b/tests/native-profile-api.test.ts
@@ -1,6 +1,6 @@
 import { afterEach, describe, expect, test } from "bun:test";
 import { join } from "node:path";
-import { tmpdir } from "node:os";
+import { tmpdir, userInfo } from "node:os";
 import type { OcxConfig } from "../src/types";
 import { handleNativeProfileAPI } from "../src/codex/native-profile-api";
 import type { NativeProfileManager } from "../src/codex/native-profile-manager";
@@ -53,29 +53,34 @@ describe("native main profile management API", () => {
     expect(oldTurn).not.toBeNull();
     const order: string[] = [];
     let slept = false;
-    const manager = {
-      switch: async () => { order.push("switch"); return { ok: true }; },
-    } as unknown as NativeProfileManager;
-    const request = new Request("http://localhost/api/native-main-profiles/switch", {
-      method: "POST",
-      body: JSON.stringify({ target: "target", confirmedStopped: true }),
-    });
-    const response = await handleNativeProfileAPI(request, new URL(request.url), {} as OcxConfig, {
-      manager,
-      drainTimeoutMs: 1_000,
-      sleep: async () => {
-        if (slept) return Bun.sleep(1);
-        slept = true;
-        expect(tryAdmitTurn()).toBeNull();
-        order.push("old-http-or-ws-response-finished");
-        oldTurn?.release();
-      },
-    });
-    expect(response?.status).toBe(200);
-    expect(order).toEqual(["old-http-or-ws-response-finished", "switch"]);
-    const after = tryAdmitTurn();
-    expect(after).not.toBeNull();
-    after?.release();
+    let after: ReturnType<typeof tryAdmitTurn> = null;
+    try {
+      const manager = {
+        switch: async () => { order.push("switch"); return { ok: true }; },
+      } as unknown as NativeProfileManager;
+      const request = new Request("http://localhost/api/native-main-profiles/switch", {
+        method: "POST",
+        body: JSON.stringify({ target: "target", confirmedStopped: true }),
+      });
+      const response = await handleNativeProfileAPI(request, new URL(request.url), {} as OcxConfig, {
+        manager,
+        drainTimeoutMs: 1_000,
+        sleep: async () => {
+          if (slept) return Bun.sleep(1);
+          slept = true;
+          expect(tryAdmitTurn()).toBeNull();
+          order.push("old-http-or-ws-response-finished");
+          oldTurn?.release();
+        },
+      });
+      expect(response?.status).toBe(200);
+      expect(order).toEqual(["old-http-or-ws-response-finished", "switch"]);
+      after = tryAdmitTurn();
+      expect(after).not.toBeNull();
+    } finally {
+      oldTurn?.release();
+      after?.release();
+    }
   });
 
   test("length-unknown native-profile bodies use the bounded management reader", async () => {
@@ -111,7 +116,7 @@ describe("native main profile management API", () => {
     expect(response!.status).toBeGreaterThanOrEqual(400);
     const payload = JSON.stringify(await response!.json());
     expect(payload).not.toContain(missingHome);
-    expect(payload).not.toContain(process.env.USERNAME ?? "Administrator");
+    expect(payload).not.toContain(userInfo().username);
   });
 
   test("pending-recovery errors retain actionable public recovery commands", async () => {
diff --git a/tests/native-profile-crash-boundaries.test.ts b/tests/native-profile-crash-boundaries.test.ts
index f9dda7e2c..599f680b0 100644
--- a/tests/native-profile-crash-boundaries.test.ts
+++ b/tests/native-profile-crash-boundaries.test.ts
@@ -14,9 +14,14 @@ const roots: string[] = [];
 const oldOcx = process.env.OPENCODEX_HOME;
 const oldCodex = process.env.CODEX_HOME;
 
+function restoreEnv(name: "OPENCODEX_HOME" | "CODEX_HOME", value: string | undefined): void {
+  if (value === undefined) delete process.env[name];
+  else process.env[name] = value;
+}
+
 afterEach(() => {
-  process.env.OPENCODEX_HOME = oldOcx;
-  process.env.CODEX_HOME = oldCodex;
+  restoreEnv("OPENCODEX_HOME", oldOcx);
+  restoreEnv("CODEX_HOME", oldCodex);
   for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true });
 });
 
@@ -67,8 +72,8 @@ async function fixture() {
     activeCodexAccountId: MAIN_CODEX_ACCOUNT_ID,
     autoSwitchThreshold: 0,
   } as OcxConfig);
-  process.env.OPENCODEX_HOME = oldOcx;
-  process.env.CODEX_HOME = oldCodex;
+  restoreEnv("OPENCODEX_HOME", oldOcx);
+  restoreEnv("CODEX_HOME", oldCodex);
   return { root, home, codexHome, configDir, source, target, key, manager, sourceProfile, targetProfile, initialRevision };
 }
 
@@ -78,7 +83,7 @@ async function waitFor(path: string, timeout = 10_000): Promise<void> {
   if (!existsSync(path)) throw new Error(`timed out waiting for ${path}`);
 }
 
-function spawnSwitch(f: Awaited<ReturnType<typeof fixture>>, options: { boundary?: NativeProfileSwitchBoundary; marker?: string; release?: string; result: string }) {
+function spawnSwitch(f: Awaited<ReturnType<typeof fixture>>, options: { boundary?: NativeProfileSwitchBoundary; marker?: string; release?: string; contention?: string; result: string }) {
   return Bun.spawn([process.execPath, join(import.meta.dir, "helpers", "native-profile-switch-child.ts")], {
     cwd: join(import.meta.dir, ".."),
     env: {
@@ -94,6 +99,7 @@ function spawnSwitch(f: Awaited<ReturnType<typeof fixture>>, options: { boundary
       ...(options.boundary ? { NATIVE_SWITCH_CRASH_BOUNDARY: options.boundary } : {}),
       ...(options.marker ? { NATIVE_SWITCH_MARKER: options.marker } : {}),
       ...(options.release ? { NATIVE_SWITCH_RELEASE: options.release } : {}),
+      ...(options.contention ? { NATIVE_SWITCH_CONTENTION: options.contention } : {}),
     },
     stdin: "ignore", stdout: "pipe", stderr: "pipe",
   });
@@ -199,19 +205,29 @@ describe("native profile subprocess crash boundaries", () => {
     const firstRelease = join(f.root, "first-release");
     const firstResult = join(f.root, "first-result");
     const secondResult = join(f.root, "second-result");
+    const secondContention = join(f.root, "second-contention");
     const first = spawnSwitch(f, { marker: firstReady, release: firstRelease, result: firstResult });
-    await waitFor(firstReady);
-    const second = spawnSwitch(f, { result: secondResult });
-    await Bun.sleep(100);
-    expect(existsSync(secondResult)).toBe(false);
-    writeFileSync(firstRelease, "release");
-    expect(await first.exited).toBe(0);
-    expect(await second.exited).toBe(0);
-    const results = [JSON.parse(readFileSync(firstResult, "utf8")), JSON.parse(readFileSync(secondResult, "utf8"))];
-    if (results.filter(item => item.ok).length !== 1) throw new Error(`unexpected concurrent results: ${JSON.stringify(results)}`);
-    expect(results.filter(item => !item.ok).map(item => item.code)).toEqual(["INVALID_REQUEST"]);
-    expect(readFileSync(f.manager.context.authPath, "utf8")).toBe(f.target);
-    expect(readNativeProfileVault(f.manager.context)!.activeProfileId).toBe(f.targetProfile.id);
-    expect(readNativeProfileJournal(f.manager.context)).toBeNull();
+    let second: ReturnType<typeof spawnSwitch> | undefined;
+    try {
+      await waitFor(firstReady);
+      second = spawnSwitch(f, { contention: secondContention, result: secondResult });
+      await waitFor(secondContention);
+      expect(existsSync(secondResult)).toBe(false);
+      writeFileSync(firstRelease, "release");
+      expect(await first.exited).toBe(0);
+      expect(await second.exited).toBe(0);
+      const results = [JSON.parse(readFileSync(firstResult, "utf8")), JSON.parse(readFileSync(secondResult, "utf8"))];
+      if (results.filter(item => item.ok).length !== 1) throw new Error(`unexpected concurrent results: ${JSON.stringify(results)}`);
+      expect(results.filter(item => !item.ok).map(item => item.code)).toEqual(["INVALID_REQUEST"]);
+      expect(readFileSync(f.manager.context.authPath, "utf8")).toBe(f.target);
+      expect(readNativeProfileVault(f.manager.context)!.activeProfileId).toBe(f.targetProfile.id);
+      expect(readNativeProfileJournal(f.manager.context)).toBeNull();
+    } finally {
+      try { writeFileSync(firstRelease, "release"); } catch { /* fixture cleanup */ }
+      if (first.exitCode === null) first.kill();
+      if (second?.exitCode === null) second.kill();
+      await first.exited;
+      if (second) await second.exited;
+    }
   }, 20_000);
 });
diff --git a/tests/native-profile-manager.test.ts b/tests/native-profile-manager.test.ts
index 685a584b1..936e56c67 100644
--- a/tests/native-profile-manager.test.ts
+++ b/tests/native-profile-manager.test.ts
@@ -36,6 +36,10 @@ async function atomic(path: string, content: string): Promise<void> {
   renameSync(temp, path);
 }
 
+function hasJournalPhase(content: string, phase: string): boolean {
+  return (JSON.parse(content) as { phase?: unknown }).phase === phase;
+}
+
 function fixture() {
   const root = mkdtempSync(join(tmpdir(), "ocx-native-profile-"));
   roots.push(root);
@@ -82,7 +86,7 @@ async function leavePendingJournal(f: Awaited<ReturnType<typeof enrolledFixture>
         authWrites += 1;
         if (authWrites > 1) throw new Error("injected restore failure");
       }
-      if (path === journalPath && content.includes('"phase": "auth-replaced"')) {
+      if (path === journalPath && hasJournalPhase(content, "auth-replaced")) {
         throw new Error("injected post-replacement failure");
       }
       return atomic(path, content);
@@ -106,7 +110,7 @@ function spawnLockHolder(
   f: ReturnType<typeof fixture>,
   readyPath: string,
   releasePath: string,
-  crash = false,
+  options: { crash?: boolean; contention?: string } = {},
 ): ReturnType<typeof Bun.spawn> {
   return Bun.spawn([process.execPath, join(import.meta.dir, "helpers", "native-profile-lock-child.ts")], {
     cwd: join(import.meta.dir, ".."),
@@ -116,7 +120,8 @@ function spawnLockHolder(
       NATIVE_PROFILE_TEST_CONFIG_DIR: f.configDir,
       NATIVE_PROFILE_TEST_READY: readyPath,
       NATIVE_PROFILE_TEST_RELEASE: releasePath,
-      NATIVE_PROFILE_TEST_CRASH: crash ? "1" : "0",
+      NATIVE_PROFILE_TEST_CRASH: options.crash ? "1" : "0",
+      ...(options.contention ? { NATIVE_PROFILE_TEST_CONTENTION: options.contention } : {}),
     },
     stdin: "ignore",
     stdout: "pipe",
@@ -128,9 +133,9 @@ describe("native main profile transactions", () => {
   test("an abruptly exited child releases the OS-backed profile transaction", async () => {
     const f = fixture();
     const readyPath = join(f.root, "crash-ready");
-    const child = spawnLockHolder(f, readyPath, join(f.root, "unused-release"), true);
+    const child = spawnLockHolder(f, readyPath, join(f.root, "unused-release"), { crash: true });
     await waitForPath(readyPath);
-    expect(await child.exited).toBe(0);
+    expect(await child.exited).toBe(87);
 
     const successor = new NativeProfileManager({ ...f.options, lockWaitMs: 250 });
     expect((await successor.recover(false)).recovered).toBe(false);
@@ -142,12 +147,13 @@ describe("native main profile transactions", () => {
     const firstRelease = join(f.root, "first-release");
     const secondReady = join(f.root, "second-ready");
     const secondRelease = join(f.root, "second-release");
+    const secondContention = join(f.root, "second-contention");
     const first = spawnLockHolder(f, firstReady, firstRelease);
     let second: ReturnType<typeof Bun.spawn> | undefined;
     try {
       await waitForPath(firstReady);
-      second = spawnLockHolder(f, secondReady, secondRelease);
-      await Bun.sleep(150);
+      second = spawnLockHolder(f, secondReady, secondRelease, { contention: secondContention });
+      await waitForPath(secondContention);
       expect(existsSync(secondReady)).toBe(false);
 
       writeFileSync(firstRelease, "release");
@@ -364,7 +370,7 @@ describe("native main profile transactions", () => {
           authWrites += 1;
           if (authWrites > 1) throw new Error("injected restore failure");
         }
-        if (path === journalPath && content.includes('"phase": "auth-replaced"')) {
+        if (path === journalPath && hasJournalPhase(content, "auth-replaced")) {
           throw new Error("injected post-replacement failure");
         }
         return atomic(path, content);
diff --git a/tests/native-profile-startup.test.ts b/tests/native-profile-startup.test.ts
index 812a81b07..bd872eb66 100644
--- a/tests/native-profile-startup.test.ts
+++ b/tests/native-profile-startup.test.ts
@@ -31,9 +31,14 @@ const roots: string[] = [];
 const previousOpencodexHome = process.env.OPENCODEX_HOME;
 const previousCodexHome = process.env.CODEX_HOME;
 
+function restoreEnv(name: "OPENCODEX_HOME" | "CODEX_HOME", value: string | undefined): void {
+  if (value === undefined) delete process.env[name];
+  else process.env[name] = value;
+}
+
 afterEach(() => {
-  process.env.OPENCODEX_HOME = previousOpencodexHome;
-  process.env.CODEX_HOME = previousCodexHome;
+  restoreEnv("OPENCODEX_HOME", previousOpencodexHome);
+  restoreEnv("CODEX_HOME", previousCodexHome);
   for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true });
 });
 
@@ -168,8 +173,8 @@ async function fixture(phase: Phase, observation: Observation, activePool = fals
       chatgptAccountId: "pool-account",
     });
   }
-  process.env.OPENCODEX_HOME = previousOpencodexHome;
-  process.env.CODEX_HOME = previousCodexHome;
+  restoreEnv("OPENCODEX_HOME", previousOpencodexHome);
+  restoreEnv("CODEX_HOME", previousCodexHome);
   return { root, codexHome, configDir, key, manager, target, sourceProfileId: sourceRecord.id, targetProfileId: targetRecord.id };
 }
 

From e80f29f2c01b9eef8ac2f15b5c487664b97245e6 Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Sun, 2 Aug 2026 14:02:13 +0900
Subject: [PATCH 15/63] fix(codex): harden native profile recovery invariants

---
 src/codex/native-profile-manager.ts   | 230 +++++++++++++++++++++++---
 src/codex/native-profile-recovery.ts  |  16 +-
 src/codex/native-profile-store.ts     | 100 +++++++++--
 src/codex/native-profile-types.ts     |  10 +-
 tests/native-profile-manager.test.ts  | 190 ++++++++++++++++++++-
 tests/native-profile-recovery.test.ts |   5 +
 6 files changed, 505 insertions(+), 46 deletions(-)

diff --git a/src/codex/native-profile-manager.ts b/src/codex/native-profile-manager.ts
index 2ec34d92d..bd9815e9b 100644
--- a/src/codex/native-profile-manager.ts
+++ b/src/codex/native-profile-manager.ts
@@ -8,6 +8,7 @@ import {
   readFileSync,
   readdirSync,
   realpathSync,
+  renameSync,
   rmSync,
   statSync,
   truncateSync,
@@ -24,14 +25,16 @@ import {
   assertUniqueNativeProfileLabel,
   decryptNativeEnvelope,
   encryptNativeEnvelope,
+  inspectNativeProfileJournal,
+  MAX_NATIVE_PROFILES,
   nativeIdentityHash,
   nativeIdentityHint,
   OsNativeProfileKeyProvider,
   publicNativeProfile,
   readNativeEnvelope,
   readNativeEnvelopeResult,
-  readNativeProfileJournal,
   readNativeProfileVault,
+  probeNativeProfileRecoveryState,
   requireFileCredentialStore,
   resolveNativeCredentialStoreMode,
   resolveNativeProfileContext,
@@ -220,8 +223,87 @@ export class NativeProfileManager {
     try { unlinkSync(this.context.journalPath); } catch (error) { if (errorCode(error) !== "ENOENT") throw error; }
   }
 
+  private removeRecoveryBlock(): void {
+    try { unlinkSync(this.context.recoveryBlockPath); } catch (error) { if (errorCode(error) !== "ENOENT") throw error; }
+  }
+
+  private async currentOwnershipConfirmed(): Promise<boolean> {
+    let key: NativeProfileKey | null = null;
+    let current: NativeEnvelopeSnapshot | null = null;
+    try {
+      const vault = readNativeProfileVault(this.context);
+      if (!vault) return false;
+      key = await this.keyForVault(vault);
+      current = readNativeEnvelope(this.context.authPath);
+      this.assertCurrentIdentity(vault, current, key);
+      return true;
+    } catch {
+      return false;
+    } finally {
+      current?.raw.fill(0);
+      key?.key.fill(0);
+    }
+  }
+
+  private async clearRecoveryBlockLocked(): Promise<Record<string, unknown>> {
+    if (!(await this.currentOwnershipConfirmed())) {
+      throw new NativeProfileError(
+        "RECOVERY_REQUIRED",
+        "The quarantined recovery state remains blocked until auth.json matches the active encrypted profile.",
+        409,
+      );
+    }
+    this.removeRecoveryBlock();
+    return {
+      ok: true,
+      recovered: true,
+      action: "confirm-current-owner",
+      externallyRefreshed: false,
+      effectiveCodexHome: this.context.codexHome,
+      restartRequired: false,
+    };
+  }
+
+  private async quarantineInvalidJournalLocked(): Promise<Record<string, unknown>> {
+    const quarantineFile = this.context.homeId + ".journal.quarantine-" + this.uuid() + ".json";
+    const quarantinePath = join(this.context.rootDir, quarantineFile);
+    await this.atomicWrite(this.context.recoveryBlockPath, serializeNativeProfileMetadata({
+      version: 1,
+      homeId: this.context.homeId,
+      reason: "malformed-journal",
+      quarantineFile,
+      createdAt: new Date(this.now()).toISOString(),
+    }));
+    try {
+      renameSync(this.context.journalPath, quarantinePath);
+    } catch {
+      throw new NativeProfileError(
+        "RECOVERY_REQUIRED",
+        "The invalid recovery journal could not be quarantined; the fail-closed recovery marker remains active.",
+        409,
+      );
+    }
+    if (!(await this.currentOwnershipConfirmed())) {
+      throw new NativeProfileError(
+        "RECOVERY_REQUIRED",
+        "The invalid recovery journal was quarantined as " + quarantineFile + ", but current credential ownership is not confirmed.",
+        409,
+      );
+    }
+    this.removeRecoveryBlock();
+    return {
+      ok: true,
+      recovered: true,
+      action: "quarantine-invalid-journal",
+      quarantineFile,
+      externallyRefreshed: false,
+      effectiveCodexHome: this.context.codexHome,
+      restartRequired: false,
+    };
+  }
+
   private assertNoPendingRecovery(): void {
-    if (!readNativeProfileJournal(this.context)) return;
+    if (probeNativeProfileRecoveryState(this.context) === "none") return;
     throw new NativeProfileError(
       "RECOVERY_REQUIRED",
       "A native-profile recovery journal is pending. Run `ocx account main recover` or `ocx account main recover --rollback --yes` before registering or adding profiles.",
@@ -309,35 +391,55 @@ export class NativeProfileManager {
 
   async doctor(): Promise<Record<string, unknown>> {
     return this.withLock(async () => {
-    this.sweepStaleStages();
+    let stagingSweep: "ok" | "cleanup-required" | "unreadable" = "ok";
+    try {
+      this.sweepStaleStages();
+    } catch (error) {
+      stagingSweep = error instanceof NativeProfileError && error.code === "STAGING_CLEANUP_REQUIRED"
+        ? "cleanup-required"
+        : "unreadable";
+    }
     const mode = (() => {
       try { return resolveNativeCredentialStoreMode(this.context); } catch { return "unknown"; }
     })();
     const auth = readNativeEnvelopeResult(this.context.authPath);
-    const vault = readNativeProfileVault(this.context);
+    let vault: NativeMainProfileVaultV1 | null = null;
+    let vaultStatus: "ok" | "missing" | "invalid" = "missing";
+    try {
+      vault = readNativeProfileVault(this.context);
+      vaultStatus = vault ? "ok" : "missing";
+    } catch {
+      vaultStatus = "invalid";
+    }
     let keyStore: "available" | "missing-key" | "unavailable" = "available";
     try {
       const key = await this.keyProvider.get(this.context.homeId);
-      if (vault && !key) keyStore = "missing-key";
+      if (vaultStatus !== "missing" && !key) keyStore = "missing-key";
       if (key) key.key.fill(0);
     } catch {
       keyStore = "unavailable";
     }
-    let stagingCount = 0;
+    let stagingCount: number | null = 0;
     try {
       if (existsSync(this.context.stagingRoot)) {
         stagingCount = Array.from(new Bun.Glob("*").scanSync({ cwd: this.context.stagingRoot, onlyFiles: false })).length;
       }
-    } catch { stagingCount = 0; }
+    } catch {
+      stagingSweep = "unreadable";
+      stagingCount = null;
+    }
     return {
       effectiveCodexHome: this.context.codexHome,
       credentialStoreMode: mode,
       supported: mode === "file",
       authStatus: auth.status,
       keyStore,
-      profileCount: vault?.profiles.length ?? 0,
+      vaultStatus,
+      profileCount: vaultStatus === "invalid" ? null : vault?.profiles.length ?? 0,
       activeProfileId: vault?.activeProfileId ?? null,
-      recoveryPending: existsSync(this.context.journalPath),
+      recoveryPending: probeNativeProfileRecoveryState(this.context) !== "none",
+      recoveryState: probeNativeProfileRecoveryState(this.context),
+      stagingSweep,
       stagingCount,
     };
     });
@@ -461,6 +563,9 @@ export class NativeProfileManager {
       let target: NativeEnvelopeSnapshot | null = null;
       let current: NativeEnvelopeSnapshot | null = null;
       let key: NativeProfileKey | null = null;
+      let operationFailed = false;
+      let importCommitted = false;
+      let result: { effectiveCodexHome: string; profile: NativeProfilePublic } | undefined;
       try {
         const stagePath = this.verifiedStagePath(stageId);
         requireFileCredentialStore(this.context);
@@ -468,6 +573,9 @@ export class NativeProfileManager {
         target = readNativeEnvelope(join(stagePath, "auth.json"));
         current = readNativeEnvelope(this.context.authPath);
         const vault = this.requireVault();
+        if (vault.profiles.length >= MAX_NATIVE_PROFILES) {
+          throw new NativeProfileError("INVALID_REQUEST", "Native profiles are limited to 32 entries.", 400);
+        }
         key = await this.keyForVault(vault);
         this.assertCurrentIdentity(vault, current, key);
         assertUniqueNativeProfileLabel(vault, label);
@@ -490,7 +598,11 @@ export class NativeProfileManager {
         vault.profiles.push(profile);
         vault.revision += 1;
         await this.writeVault(vault);
-        return { effectiveCodexHome: this.context.codexHome, profile: publicNativeProfile(profile) };
+        importCommitted = true;
+        result = { effectiveCodexHome: this.context.codexHome, profile: publicNativeProfile(profile) };
+      } catch (error) {
+        operationFailed = true;
+        throw error;
       } finally {
         target?.raw.fill(0);
         current?.raw.fill(0);
@@ -498,13 +610,18 @@ export class NativeProfileManager {
         try {
           this.deleteStageById(stageId);
         } catch {
-          throw new NativeProfileError(
-            "STAGING_CLEANUP_REQUIRED",
-            "The native-login staging session could not be securely removed; fix filesystem permissions and cancel it explicitly.",
-            500,
-          );
+          if (!operationFailed) {
+            throw new NativeProfileError(
+              "STAGING_CLEANUP_REQUIRED",
+              importCommitted
+                ? "The native profile was imported, but its staging session could not be securely removed. Do not retry the import; fix filesystem permissions and cancel it explicitly."
+                : "The native-login staging session could not be securely removed; fix filesystem permissions and cancel it explicitly.",
+              500,
+            );
+          }
         }
       }
+      return result!;
     });
   }
 
@@ -541,7 +658,7 @@ export class NativeProfileManager {
       this.sweepStaleStages();
       requireFileCredentialStore(this.context);
       await this.assertNativeCodexStopped(confirmedStopped);
-      if (readNativeProfileJournal(this.context)) await this.recoverLocked(false);
+      if (probeNativeProfileRecoveryState(this.context) !== "none") await this.recoverLocked(false);
       const beforeVault = this.requireVault();
       const key = await this.keyForVault(beforeVault);
       const source = readNativeEnvelope(this.context.authPath);
@@ -583,6 +700,10 @@ export class NativeProfileManager {
           afterVault,
           createdAt: timestamp,
         };
+        serializeNativeProfileMetadata(afterVault);
+        serializeNativeProfileMetadata({ ...journal, phase: "prepared" });
+        serializeNativeProfileMetadata({ ...journal, phase: "auth-replaced" });
+        serializeNativeProfileMetadata({ ...journal, phase: "vault-committed" });
         await this.writeJournal(journal);
         journalPrepared = true;
         await this.onSwitchBoundary("journal-prepared");
@@ -635,8 +756,30 @@ export class NativeProfileManager {
   }
 
   private async recoverLocked(rollback: boolean): Promise<Record<string, unknown>> {
-    const journal = readNativeProfileJournal(this.context);
-    if (!journal) return { ok: true, recovered: false, effectiveCodexHome: this.context.codexHome };
+    const inspection = inspectNativeProfileJournal(this.context);
+    const recoveryState = probeNativeProfileRecoveryState(this.context);
+    if (inspection.status === "invalid" || recoveryState === "unreadable") {
+      throw new NativeProfileError(
+        "RECOVERY_REQUIRED",
+        "The native-profile recovery state is invalid and requires explicit confirmed rollback quarantine.",
+        409,
+      );
+    }
+    if (recoveryState === "manual") {
+      if (inspection.status !== "missing") {
+        throw new NativeProfileError("RECOVERY_REQUIRED", "Manual native-profile recovery remains pending.", 409);
+      }
+      return this.clearRecoveryBlockLocked();
+    }
+    const journal = inspection.status === "valid" ? inspection.journal : null;
+    if (!journal) {
+      return {
+        ok: true,
+        recovered: false,
+        externallyRefreshed: false,
+        effectiveCodexHome: this.context.codexHome,
+      };
+    }
     const key = await this.keyForVault(journal.beforeVault);
     const current = readNativeEnvelopeResult(this.context.authPath);
     if (current.status !== "ok") {
@@ -650,7 +793,14 @@ export class NativeProfileManager {
         if (currentHash === journal.sourceIdentityHash) {
           await this.writeVault(journal.beforeVault);
           this.removeJournal();
-          return { ok: true, recovered: true, action: "rollback-source", effectiveCodexHome: this.context.codexHome, restartRequired: false };
+          return {
+            ok: true,
+            recovered: true,
+            action: "rollback-source",
+            externallyRefreshed: current.envelope.digest !== journal.sourcePayload.envelopeSha256,
+            effectiveCodexHome: this.context.codexHome,
+            restartRequired: false,
+          };
         }
         if (currentHash !== journal.targetIdentityHash) {
           throw new NativeProfileError("RECOVERY_REQUIRED", "Recovery found a third or unknown native identity and made no credential write.", 409);
@@ -663,6 +813,7 @@ export class NativeProfileManager {
           key,
         );
         let rollbackVault = journal.beforeVault;
+        const externallyRefreshed = current.envelope.digest !== journal.targetPayload.envelopeSha256;
         let rollbackVaultPublished = false;
         if (current.envelope.digest !== journal.targetPayload.envelopeSha256) {
           rollbackVault = structuredClone(journal.beforeVault);
@@ -701,7 +852,14 @@ export class NativeProfileManager {
         if (!rollbackVaultPublished) await this.writeVault(rollbackVault);
         this.applyTransition(current.envelope.accountId, sourceEnvelope.accountId);
         this.removeJournal();
-        return { ok: true, recovered: true, action: "rollback-source", effectiveCodexHome: this.context.codexHome, restartRequired: true };
+        return {
+          ok: true,
+          recovered: true,
+          action: "rollback-source",
+          externallyRefreshed,
+          effectiveCodexHome: this.context.codexHome,
+          restartRequired: true,
+        };
       }
       const observation = currentHash === journal.sourceIdentityHash
         ? { identity: "source" as const, digest: current.envelope.digest === journal.sourcePayload.envelopeSha256 ? "exact" as const : "changed" as const }
@@ -715,7 +873,14 @@ export class NativeProfileManager {
       if (decision.action === "rollback-source") {
         await this.writeVault(journal.beforeVault);
         this.removeJournal();
-        return { ok: true, recovered: true, action: decision.action, effectiveCodexHome: this.context.codexHome, restartRequired: false };
+        return {
+          ok: true,
+          recovered: true,
+          action: decision.action,
+          externallyRefreshed: decision.externallyRefreshed,
+          effectiveCodexHome: this.context.codexHome,
+          restartRequired: false,
+        };
       }
       sourceEnvelope = decryptNativeEnvelope(
         this.context,
@@ -727,7 +892,14 @@ export class NativeProfileManager {
       await this.writeVault(journal.afterVault);
       this.applyTransition(sourceEnvelope.accountId, current.envelope.accountId);
       this.removeJournal();
-      return { ok: true, recovered: true, action: decision.action, effectiveCodexHome: this.context.codexHome, restartRequired: true };
+      return {
+        ok: true,
+        recovered: true,
+        action: decision.action,
+        externallyRefreshed: decision.externallyRefreshed,
+        effectiveCodexHome: this.context.codexHome,
+        restartRequired: true,
+      };
     } finally {
       current.envelope.raw.fill(0);
       sourceEnvelope?.raw.fill(0);
@@ -738,7 +910,19 @@ export class NativeProfileManager {
   async recover(rollback = false, confirmedStopped = false): Promise<Record<string, unknown>> {
     return this.withLock(async () => {
       requireFileCredentialStore(this.context);
-      if (rollback && readNativeProfileJournal(this.context)) {
+      const inspection = inspectNativeProfileJournal(this.context);
+      if (inspection.status === "invalid") {
+        if (!rollback) {
+          throw new NativeProfileError(
+            "RECOVERY_REQUIRED",
+            "The invalid native-profile recovery journal requires recover --rollback --yes.",
+            409,
+          );
+        }
+        await this.assertNativeCodexStopped(confirmedStopped);
+        return this.quarantineInvalidJournalLocked();
+      }
+      if (rollback && inspection.status === "valid") {
         await this.assertNativeCodexStopped(confirmedStopped);
       }
       return this.recoverLocked(rollback);
diff --git a/src/codex/native-profile-recovery.ts b/src/codex/native-profile-recovery.ts
index 233d4e9dd..e6960f76a 100644
--- a/src/codex/native-profile-recovery.ts
+++ b/src/codex/native-profile-recovery.ts
@@ -6,10 +6,9 @@
  * exactly one decision returned here while holding the home-scoped lock.
  */
 
-export type NativeProfileJournalPhase =
-  | "prepared"
-  | "auth-replaced"
-  | "vault-committed";
+import type { NativeProfileJournalPhase } from "./native-profile-types";
+
+export type { NativeProfileJournalPhase } from "./native-profile-types";
 
 export type NativeProfileAuthObservation =
   | {
@@ -29,21 +28,25 @@ export type NativeProfileRecoveryDecision =
   | {
       action: "rollback-source";
       publishRuntimeTransition: false;
+      externallyRefreshed: boolean;
       reason: "source-active";
     }
   | {
       action: "commit-target";
       publishRuntimeTransition: true;
+      externallyRefreshed: boolean;
       reason: "target-active-vault-pending";
     }
   | {
       action: "finalize-target";
       publishRuntimeTransition: true;
+      externallyRefreshed: boolean;
       reason: "target-active-vault-committed";
     }
   | {
       action: "manual-recovery";
       publishRuntimeTransition: false;
+      externallyRefreshed: false;
       reason: "auth-unconfirmed" | "third-identity";
     };
 
@@ -55,6 +58,7 @@ export function decideNativeProfileRecovery(
     return {
       action: "manual-recovery",
       publishRuntimeTransition: false,
+      externallyRefreshed: false,
       reason: "auth-unconfirmed",
     };
   }
@@ -63,6 +67,7 @@ export function decideNativeProfileRecovery(
     return {
       action: "manual-recovery",
       publishRuntimeTransition: false,
+      externallyRefreshed: false,
       reason: "third-identity",
     };
   }
@@ -71,6 +76,7 @@ export function decideNativeProfileRecovery(
     return {
       action: "rollback-source",
       publishRuntimeTransition: false,
+      externallyRefreshed: observation.digest === "changed",
       reason: "source-active",
     };
   }
@@ -79,6 +85,7 @@ export function decideNativeProfileRecovery(
     return {
       action: "finalize-target",
       publishRuntimeTransition: true,
+      externallyRefreshed: observation.digest === "changed",
       reason: "target-active-vault-committed",
     };
   }
@@ -86,6 +93,7 @@ export function decideNativeProfileRecovery(
   return {
     action: "commit-target",
     publishRuntimeTransition: true,
+    externallyRefreshed: observation.digest === "changed",
     reason: "target-active-vault-pending",
   };
 }
diff --git a/src/codex/native-profile-store.ts b/src/codex/native-profile-store.ts
index 7b0cbad79..3c41de7e4 100644
--- a/src/codex/native-profile-store.ts
+++ b/src/codex/native-profile-store.ts
@@ -6,13 +6,14 @@ import {
   randomBytes,
   timingSafeEqual,
 } from "node:crypto";
-import { existsSync, readFileSync, realpathSync, statSync } from "node:fs";
+import { existsSync, lstatSync, readFileSync, realpathSync, statSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { getConfigDir } from "../config";
 import { extractAccountId } from "../oauth/chatgpt";
 import { getCodexHome, readRootTomlString } from "./paths";
 import {
   NativeProfileError,
+  NATIVE_PROFILE_JOURNAL_PHASES,
   type EncryptedNativeEnvelopeV1,
   type NativeMainProfileRecordV1,
   type NativeMainProfileVaultV1,
@@ -26,8 +27,8 @@ const DOMAIN_HOME = "opencodex-native-profile-home-v1\0";
 const DOMAIN_IDENTITY = "opencodex-native-profile-identity-v1\0";
 const KEYRING_SERVICE = "opencodex.native-main-profile.v1";
 const MAX_AUTH_BYTES = 4 * 1024 * 1024;
-const MAX_METADATA_BYTES = 4 * 1024 * 1024;
-const MAX_PROFILES = 32;
+export const MAX_NATIVE_PROFILE_METADATA_BYTES = 4 * 1024 * 1024;
+export const MAX_NATIVE_PROFILES = 32;
 const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 const HASH_RE = /^[0-9a-f]{64}$/;
 
@@ -40,6 +41,7 @@ export interface NativeProfileContext {
   authPath: string;
   vaultPath: string;
   journalPath: string;
+  recoveryBlockPath: string;
   lockPath: string;
 }
 
@@ -144,7 +146,8 @@ export function resolveNativeProfileContext(options: { codexHome?: string; confi
     authPath: join(codexHome, "auth.json"),
     vaultPath: join(rootDir, `${homeId}.vault.json`),
     journalPath: join(rootDir, `${homeId}.journal.json`),
-    lockPath: join(rootDir, `${homeId}.lock`),
+    recoveryBlockPath: join(rootDir, `${homeId}.recovery-block.json`),
+    lockPath: join(codexHome, ".opencodex-native-profile.lock.sqlite"),
   };
 }
 
@@ -319,7 +322,7 @@ function parseVaultObject(value: unknown, homeId: string): NativeMainProfileVaul
   if (!value || typeof value !== "object") throw new Error("root");
   const vault = value as NativeMainProfileVaultV1;
   if (vault.version !== 1 || vault.homeId !== homeId || !Number.isSafeInteger(vault.revision) || vault.revision < 0) throw new Error("header");
-  if (!Array.isArray(vault.profiles) || vault.profiles.length > MAX_PROFILES) throw new Error("profiles");
+  if (!Array.isArray(vault.profiles) || vault.profiles.length > MAX_NATIVE_PROFILES) throw new Error("profiles");
   if (vault.activeProfileId !== null && (typeof vault.activeProfileId !== "string" || !UUID_RE.test(vault.activeProfileId))) throw new Error("active");
   const ids = new Set<string>();
   const labels = new Set<string>();
@@ -327,8 +330,9 @@ function parseVaultObject(value: unknown, homeId: string): NativeMainProfileVaul
   let activeCount = 0;
   for (const profile of vault.profiles) {
     if (!profile || typeof profile !== "object" || !UUID_RE.test(profile.id) || ids.has(profile.id)) throw new Error("id");
-    const label = profile.label?.trim();
-    if (!label || label.length > 64 || /[\u0000-\u001f\u007f]/.test(label)) throw new Error("label");
+    const label = normalizedNativeProfileLabel(profile.label);
+    if (!label) throw new Error("label");
+    profile.label = label;
     const normalizedLabel = label.toLowerCase();
     if (labels.has(normalizedLabel) || !HASH_RE.test(profile.identityHash) || identities.has(profile.identityHash)) throw new Error("identity");
     if (profile.identityHint !== nativeIdentityHint(profile.identityHash)) throw new Error("hint");
@@ -349,38 +353,100 @@ function parseVaultObject(value: unknown, homeId: string): NativeMainProfileVaul
 export function readNativeProfileVault(context: NativeProfileContext): NativeMainProfileVaultV1 | null {
   if (!existsSync(context.vaultPath)) return null;
   try {
-    return parseVaultObject(JSON.parse(readBounded(context.vaultPath, MAX_METADATA_BYTES).toString("utf8")), context.homeId);
+    return parseVaultObject(
+      JSON.parse(readBounded(context.vaultPath, MAX_NATIVE_PROFILE_METADATA_BYTES).toString("utf8")),
+      context.homeId,
+    );
   } catch {
     throw new NativeProfileError("VAULT_INVALID", "The encrypted native-profile vault is invalid.", 409);
   }
 }
 
-export function readNativeProfileJournal(context: NativeProfileContext): NativeProfileSwitchJournalV1 | null {
-  if (!existsSync(context.journalPath)) return null;
+type PrivateFileState = "missing" | "present" | "unreadable";
+
+function privateFileState(path: string): PrivateFileState {
+  try {
+    const stat = lstatSync(path);
+    return stat.isFile() && !stat.isSymbolicLink() ? "present" : "unreadable";
+  } catch (error) {
+    return (error as NodeJS.ErrnoException).code === "ENOENT" ? "missing" : "unreadable";
+  }
+}
+
+export type NativeProfileRecoveryState = "none" | "journal" | "manual" | "unreadable";
+
+export function probeNativeProfileRecoveryState(context: NativeProfileContext): NativeProfileRecoveryState {
+  const block = privateFileState(context.recoveryBlockPath);
+  if (block === "unreadable") return "unreadable";
+  if (block === "present") return "manual";
+  const journal = privateFileState(context.journalPath);
+  if (journal === "unreadable") return "unreadable";
+  return journal === "present" ? "journal" : "none";
+}
+
+export type NativeProfileJournalInspection =
+  | { status: "missing" }
+  | { status: "valid"; journal: NativeProfileSwitchJournalV1 }
+  | { status: "invalid" };
+
+export function inspectNativeProfileJournal(context: NativeProfileContext): NativeProfileJournalInspection {
+  const state = privateFileState(context.journalPath);
+  if (state === "missing") return { status: "missing" };
+  if (state === "unreadable") return { status: "invalid" };
   try {
-    const journal = JSON.parse(readBounded(context.journalPath, MAX_METADATA_BYTES).toString("utf8")) as NativeProfileSwitchJournalV1;
+    const journal = JSON.parse(
+      readBounded(context.journalPath, MAX_NATIVE_PROFILE_METADATA_BYTES).toString("utf8"),
+    ) as NativeProfileSwitchJournalV1;
     if (
       journal.version !== 1 || journal.homeId !== context.homeId || !UUID_RE.test(journal.transactionId)
-      || !["prepared", "auth-replaced", "vault-committed"].includes(journal.phase)
+      || !NATIVE_PROFILE_JOURNAL_PHASES.includes(journal.phase)
       || !UUID_RE.test(journal.sourceProfileId) || !UUID_RE.test(journal.targetProfileId)
       || !HASH_RE.test(journal.sourceIdentityHash) || !HASH_RE.test(journal.targetIdentityHash)
       || !isEncryptedPayload(journal.sourcePayload) || !isEncryptedPayload(journal.targetPayload)
     ) throw new Error("journal");
     journal.beforeVault = parseVaultObject(journal.beforeVault, context.homeId);
     journal.afterVault = parseVaultObject(journal.afterVault, context.homeId);
-    return journal;
+    return { status: "valid", journal };
   } catch {
-    throw new NativeProfileError("RECOVERY_REQUIRED", "The native-profile recovery journal is invalid.", 409);
+    return { status: "invalid" };
   }
 }
 
+export function readNativeProfileJournal(context: NativeProfileContext): NativeProfileSwitchJournalV1 | null {
+  const inspection = inspectNativeProfileJournal(context);
+  if (inspection.status === "missing") return null;
+  if (inspection.status === "valid") return inspection.journal;
+  throw new NativeProfileError(
+    "RECOVERY_REQUIRED",
+    "The native-profile recovery journal is invalid. Run account main recover --rollback --yes to quarantine it.",
+    409,
+  );
+}
+
 export function serializeNativeProfileMetadata(value: unknown): string {
-  return `${JSON.stringify(value, null, 2)}\n`;
+  const serialized = JSON.stringify(value, null, 2) + "\n";
+  if (Buffer.byteLength(serialized, "utf8") > MAX_NATIVE_PROFILE_METADATA_BYTES) {
+    throw new NativeProfileError(
+      "PROFILE_METADATA_TOO_LARGE",
+      "Native-profile metadata exceeds the 4 MiB recovery limit; no credential write was made.",
+      409,
+    );
+  }
+  return serialized;
+}
+
+const FORBIDDEN_PROFILE_LABEL_RE = /[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/u;
+
+function normalizedNativeProfileLabel(value: unknown): string | null {
+  if (typeof value !== "string" || FORBIDDEN_PROFILE_LABEL_RE.test(value)) return null;
+  const normalized = value.normalize("NFC").trim();
+  if (!normalized || normalized.length > 64 || FORBIDDEN_PROFILE_LABEL_RE.test(normalized)) return null;
+  return normalized;
 }
 
 export function validateNativeProfileLabel(label: string): string {
-  const trimmed = label.trim();
-  if (!trimmed || trimmed.length > 64 || /[\u0000-\u001f\u007f]/.test(trimmed)) {
+  const trimmed = normalizedNativeProfileLabel(label);
+  if (!trimmed) {
     throw new NativeProfileError("INVALID_REQUEST", "Profile labels must contain 1-64 printable characters.", 400);
   }
   return trimmed;
diff --git a/src/codex/native-profile-types.ts b/src/codex/native-profile-types.ts
index a58f86b82..228b5cff3 100644
--- a/src/codex/native-profile-types.ts
+++ b/src/codex/native-profile-types.ts
@@ -21,6 +21,8 @@ export type NativeProfileErrorCode =
   | "SWITCH_ROLLED_BACK"
   | "STAGING_NOT_FOUND"
   | "STAGING_CLEANUP_REQUIRED"
+  | "PROFILE_METADATA_TOO_LARGE"
+  | "INTERNAL_ERROR"
   | "VAULT_INVALID";
 
 export class NativeProfileError extends Error {
@@ -65,7 +67,13 @@ export interface NativeMainProfileVaultV1 {
   profiles: NativeMainProfileRecordV1[];
 }
 
-export type NativeProfileJournalPhase = "prepared" | "auth-replaced" | "vault-committed";
+export const NATIVE_PROFILE_JOURNAL_PHASES = [
+  "prepared",
+  "auth-replaced",
+  "vault-committed",
+] as const;
+
+export type NativeProfileJournalPhase = (typeof NATIVE_PROFILE_JOURNAL_PHASES)[number];
 
 export interface NativeProfileSwitchJournalV1 {
   version: 1;
diff --git a/tests/native-profile-manager.test.ts b/tests/native-profile-manager.test.ts
index 936e56c67..9e6181d53 100644
--- a/tests/native-profile-manager.test.ts
+++ b/tests/native-profile-manager.test.ts
@@ -3,7 +3,12 @@ import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, renameSy
 import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 import { NativeProfileManager } from "../src/codex/native-profile-manager";
-import { decryptNativeEnvelope, readNativeProfileVault } from "../src/codex/native-profile-store";
+import {
+  decryptNativeEnvelope,
+  MAX_NATIVE_PROFILE_METADATA_BYTES,
+  probeNativeProfileRecoveryState,
+  readNativeProfileVault,
+} from "../src/codex/native-profile-store";
 import { NativeProfileError, type NativeProfileKey, type NativeProfileKeyProvider } from "../src/codex/native-profile-types";
 
 const roots: string[] = [];
@@ -180,6 +185,27 @@ describe("native main profile transactions", () => {
     }
   }, 15_000);
 
+  test("the same canonical CODEX_HOME serializes different OpenCodex config roots", async () => {
+    const f = fixture();
+    const secondConfigDir = join(f.root, "opencodex-second");
+    mkdirSync(secondConfigDir, { recursive: true });
+    const ready = join(f.root, "canonical-home-ready");
+    const release = join(f.root, "canonical-home-release");
+    const first = spawnLockHolder(f, ready, release);
+    try {
+      await waitForPath(ready);
+      const contender = new NativeProfileManager({ ...f.options, configDir: secondConfigDir, lockWaitMs: 100 });
+      expect(contender.context.lockPath).toBe(new NativeProfileManager(f.options).context.lockPath);
+      let caught: unknown;
+      try { await contender.recover(false); } catch (error) { caught = error; }
+      expect(caught).toBeInstanceOf(NativeProfileError);
+      expect((caught as NativeProfileError).code).toBe("NATIVE_PROFILE_BUSY");
+    } finally {
+      writeFileSync(release, "release");
+      await first.exited;
+    }
+  }, 15_000);
+
   test("finish removes staging after auth validation failure", async () => {
     const f = fixture();
     const manager = new NativeProfileManager(f.options);
@@ -248,10 +274,172 @@ describe("native main profile transactions", () => {
     try { await failing.finishStage(stage.stageId, "work"); } catch (error) { caught = error; }
     expect(caught).toBeInstanceOf(NativeProfileError);
     expect((caught as NativeProfileError).code).toBe("STAGING_CLEANUP_REQUIRED");
+    expect((caught as NativeProfileError).message).toContain("was imported");
+    expect((caught as NativeProfileError).message).toContain("Do not retry");
+    expect((await manager.list()).profiles.some(profile => profile.label === "work")).toBe(true);
+    expect(existsSync(stage.stagingCodexHome)).toBe(true);
+    await manager.cancelStage(stage.stageId);
+  });
+
+  test("finish preserves the primary validation error when cleanup also fails", async () => {
+    const f = fixture();
+    const manager = new NativeProfileManager(f.options);
+    await manager.register("personal");
+    const stage = await manager.prepareStage();
+    writeFileSync(join(stage.stagingCodexHome, "auth.json"), "{}\n");
+    const failing = new NativeProfileManager({
+      ...f.options,
+      removeStageTree: () => { throw new Error("injected cleanup failure"); },
+    });
+    let caught: unknown;
+    try { await failing.finishStage(stage.stageId, "invalid"); } catch (error) { caught = error; }
+    expect(caught).toBeInstanceOf(NativeProfileError);
+    expect((caught as NativeProfileError).code).toBe("AUTH_INVALID");
     expect(existsSync(stage.stagingCodexHome)).toBe(true);
     await manager.cancelStage(stage.stageId);
   });
 
+  test("doctor degrades for corrupt vaults and stale-stage cleanup failures", async () => {
+    const f = fixture();
+    let now = Date.now();
+    const manager = new NativeProfileManager({ ...f.options, now: () => now });
+    const registered = await manager.register("personal");
+    expect(await manager.doctor()).toMatchObject({
+      vaultStatus: "ok",
+      profileCount: 1,
+      activeProfileId: registered.profile.id,
+      stagingSweep: "ok",
+    });
+    const stage = await manager.prepareStage();
+    writeFileSync(join(stage.stagingCodexHome, "auth.json"), f.target);
+    now += 31 * 60_000;
+    const degraded = new NativeProfileManager({
+      ...f.options,
+      now: () => now,
+      removeStageTree: () => { throw new Error("injected cleanup failure"); },
+    });
+    expect(await degraded.doctor()).toMatchObject({
+      vaultStatus: "ok",
+      stagingSweep: "cleanup-required",
+      stagingCount: 1,
+    });
+    await manager.cancelStage(stage.stageId);
+    writeFileSync(manager.context.vaultPath, "{invalid-json\n");
+    expect(await manager.doctor()).toMatchObject({
+      vaultStatus: "invalid",
+      profileCount: null,
+      activeProfileId: null,
+    });
+  });
+
+  test("rejects Unicode format labels and canonicalizes NFC before uniqueness", async () => {
+    for (const bad of ["work\u202E", "work\u2066", "work\u200E", "work\u200D", "\uFEFFwork"]) {
+      const f = fixture();
+      const manager = new NativeProfileManager(f.options);
+      let caught: unknown;
+      try { await manager.register(bad); } catch (error) { caught = error; }
+      expect(caught).toBeInstanceOf(NativeProfileError);
+      expect((caught as NativeProfileError).code).toBe("INVALID_REQUEST");
+      expect(existsSync(manager.context.vaultPath)).toBe(false);
+    }
+    const f = fixture();
+    const manager = new NativeProfileManager(f.options);
+    const registered = await manager.register("개인 Cafe\u0301");
+    expect(registered.profile.label).toBe("개인 Café");
+    const stage = await manager.prepareStage();
+    writeFileSync(join(stage.stagingCodexHome, "auth.json"), f.target);
+    let duplicate: unknown;
+    try { await manager.finishStage(stage.stageId, "개인 Café"); } catch (error) { duplicate = error; }
+    expect(duplicate).toBeInstanceOf(NativeProfileError);
+    expect((duplicate as NativeProfileError).code).toBe("PROFILE_ALREADY_EXISTS");
+  });
+
+  test("allows 32 profiles and rejects profile 33 without changing the vault", async () => {
+    const f = fixture();
+    const manager = new NativeProfileManager(f.options);
+    await manager.register("personal");
+    for (let index = 1; index < 32; index += 1) {
+      const stage = await manager.prepareStage();
+      writeFileSync(join(stage.stagingCodexHome, "auth.json"), envelope("account-" + index, "profile-" + index));
+      await manager.finishStage(stage.stageId, "profile-" + index);
+    }
+    expect((await manager.list()).profiles).toHaveLength(32);
+    const vaultBefore = readFileSync(manager.context.vaultPath, "utf8");
+    const overflow = await manager.prepareStage();
+    writeFileSync(join(overflow.stagingCodexHome, "auth.json"), envelope("account-overflow", "overflow"));
+    let caught: unknown;
+    try { await manager.finishStage(overflow.stageId, "overflow"); } catch (error) { caught = error; }
+    expect(caught).toBeInstanceOf(NativeProfileError);
+    expect((caught as NativeProfileError).code).toBe("INVALID_REQUEST");
+    expect(readFileSync(manager.context.vaultPath, "utf8")).toBe(vaultBefore);
+    expect((await manager.list()).profiles).toHaveLength(32);
+    expect(existsSync(overflow.stagingCodexHome)).toBe(false);
+  }, 30_000);
+
+  test("rejects an oversized prospective journal before the first durable switch write", async () => {
+    const f = fixture();
+    const manager = new NativeProfileManager(f.options);
+    const sourceProfile = await manager.register("personal");
+    const stage = await manager.prepareStage();
+    const large = JSON.parse(f.target) as Record<string, unknown>;
+    large.padding = "x".repeat(Math.floor(MAX_NATIVE_PROFILE_METADATA_BYTES * 0.42));
+    writeFileSync(join(stage.stagingCodexHome, "auth.json"), JSON.stringify(large, null, 2) + "\n");
+    await manager.finishStage(stage.stageId, "work");
+    const authBefore = readFileSync(manager.context.authPath, "utf8");
+    const vaultBefore = readFileSync(manager.context.vaultPath, "utf8");
+    let caught: unknown;
+    try { await manager.switch("work", true); } catch (error) { caught = error; }
+    expect(caught).toBeInstanceOf(NativeProfileError);
+    expect((caught as NativeProfileError).code).toBe("PROFILE_METADATA_TOO_LARGE");
+    expect(readFileSync(manager.context.authPath, "utf8")).toBe(authBefore);
+    expect(readFileSync(manager.context.vaultPath, "utf8")).toBe(vaultBefore);
+    expect(existsSync(manager.context.journalPath)).toBe(false);
+    expect((await manager.list()).activeProfileId).toBe(sourceProfile.profile.id);
+    expect(f.transitions).toEqual([]);
+  }, 30_000);
+
+  test("quarantines malformed journals byte-for-byte and keeps ownership fail closed", async () => {
+    const f = await enrolledFixture();
+    const malformed = "{malformed-journal\n";
+    writeFileSync(f.manager.context.journalPath, malformed);
+    writeFileSync(f.manager.context.authPath, f.target);
+    const authBefore = readFileSync(f.manager.context.authPath);
+    const vaultBefore = readFileSync(f.manager.context.vaultPath);
+    let caught: unknown;
+    try { await f.manager.recover(true, true); } catch (error) { caught = error; }
+    expect(caught).toBeInstanceOf(NativeProfileError);
+    expect((caught as NativeProfileError).code).toBe("RECOVERY_REQUIRED");
+    expect(readFileSync(f.manager.context.authPath)).toEqual(authBefore);
+    expect(readFileSync(f.manager.context.vaultPath)).toEqual(vaultBefore);
+    expect(existsSync(f.manager.context.journalPath)).toBe(false);
+    expect(existsSync(f.manager.context.recoveryBlockPath)).toBe(true);
+    expect(probeNativeProfileRecoveryState(f.manager.context)).toBe("manual");
+    const quarantine = readdirSync(f.manager.context.rootDir).filter(name => name.includes(".journal.quarantine-"));
+    expect(quarantine).toHaveLength(1);
+    expect(readFileSync(join(f.manager.context.rootDir, quarantine[0]!), "utf8")).toBe(malformed);
+    writeFileSync(f.manager.context.authPath, f.source);
+    expect(await f.manager.recover(false)).toMatchObject({
+      recovered: true,
+      action: "confirm-current-owner",
+    });
+    expect(existsSync(f.manager.context.recoveryBlockPath)).toBe(false);
+    expect(probeNativeProfileRecoveryState(f.manager.context)).toBe("none");
+  });
+
+  test("automatic recovery reports an externally refreshed target", async () => {
+    const f = await enrolledFixture();
+    await leavePendingJournal(f);
+    const refreshed = envelope("account-target", "target-refreshed-auto");
+    writeFileSync(f.manager.context.authPath, refreshed);
+    expect(await f.manager.recover(false)).toMatchObject({
+      recovered: true,
+      action: "commit-target",
+      externallyRefreshed: true,
+      restartRequired: true,
+    });
+    expect(readFileSync(f.manager.context.authPath, "utf8")).toBe(refreshed);
+  });
+
   test("preserves exact auth bytes, encrypts inactive profiles, and leaves task/history files untouched", async () => {
     const f = await enrolledFixture();
     const taskPath = join(f.codexHome, "sessions", "task.jsonl");
diff --git a/tests/native-profile-recovery.test.ts b/tests/native-profile-recovery.test.ts
index 2d5fbb4b1..4e7eb57f4 100644
--- a/tests/native-profile-recovery.test.ts
+++ b/tests/native-profile-recovery.test.ts
@@ -29,6 +29,7 @@ describe("native profile crash recovery decisions", () => {
         expect(decideNativeProfileRecovery(phase, observation)).toEqual({
           action: "rollback-source",
           publishRuntimeTransition: false,
+          externallyRefreshed: observation.digest === "changed",
           reason: "source-active",
         });
       });
@@ -41,6 +42,7 @@ describe("native profile crash recovery decisions", () => {
         expect(decideNativeProfileRecovery(phase, observation)).toEqual({
           action: "commit-target",
           publishRuntimeTransition: true,
+          externallyRefreshed: observation.digest === "changed",
           reason: "target-active-vault-pending",
         });
       });
@@ -54,6 +56,7 @@ describe("native profile crash recovery decisions", () => {
       ).toEqual({
         action: "finalize-target",
         publishRuntimeTransition: true,
+        externallyRefreshed: observation.digest === "changed",
         reason: "target-active-vault-committed",
       });
     });
@@ -69,6 +72,7 @@ describe("native profile crash recovery decisions", () => {
       ).toEqual({
         action: "manual-recovery",
         publishRuntimeTransition: false,
+        externallyRefreshed: false,
         reason: "auth-unconfirmed",
       });
     });
@@ -82,6 +86,7 @@ describe("native profile crash recovery decisions", () => {
       ).toEqual({
         action: "manual-recovery",
         publishRuntimeTransition: false,
+        externallyRefreshed: false,
         reason: "third-identity",
       });
     });

From db678013b2b3a30f1e69dc3da21b53cb0fb736ea Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Sun, 2 Aug 2026 14:19:58 +0900
Subject: [PATCH 16/63] fix(codex): harden profile startup lifecycle

---
 src/codex/account-lifecycle.ts          | 14 +++--
 src/codex/native-profile-api.ts         | 27 ++++++---
 src/codex/native-profile-startup.ts     | 26 ++++++++-
 src/server/lifecycle.ts                 | 71 ++++++++++++++++++++++--
 src/server/management/system-restart.ts | 17 +++++-
 tests/native-profile-api.test.ts        | 73 ++++++++++++++++++++++++-
 tests/native-profile-startup.test.ts    | 29 ++++++++++
 tests/shutdown-drain.test.ts            | 15 ++++-
 tests/system-restart.test.ts            | 31 ++++++++++-
 9 files changed, 274 insertions(+), 29 deletions(-)

diff --git a/src/codex/account-lifecycle.ts b/src/codex/account-lifecycle.ts
index 870962426..2ae99f61d 100644
--- a/src/codex/account-lifecycle.ts
+++ b/src/codex/account-lifecycle.ts
@@ -19,6 +19,12 @@ export function purgeCodexAccountRuntimeState(accountId: string): void {
   if (accountId === MAIN_CODEX_ACCOUNT_ID) clearMainAccountInfoCache();
 }
 
+function purgeMainCodexAccountRuntimeState(): void {
+  purgeCodexAccountRuntimeState(MAIN_CODEX_ACCOUNT_ID);
+  setMainAccountPlan(null);
+  invalidateCodexWebSocketsForAccount(MAIN_CODEX_ACCOUNT_ID);
+}
+
 /**
  * The main Codex login is stored under the stable `__main__` alias, while
  * `~/.codex/auth.json` can be replaced with credentials for another physical
@@ -34,9 +40,7 @@ export function reconcileMainCodexAccountRuntimeState(): boolean {
   observedMainChatgptAccountId = currentAccountId;
   if (previousAccountId === undefined || previousAccountId === currentAccountId) return false;
 
-  purgeCodexAccountRuntimeState(MAIN_CODEX_ACCOUNT_ID);
-  setMainAccountPlan(null);
-  invalidateCodexWebSocketsForAccount(MAIN_CODEX_ACCOUNT_ID);
+  purgeMainCodexAccountRuntimeState();
   return true;
 }
 
@@ -53,9 +57,7 @@ export function applyConfirmedMainCodexAccountTransition(
     return false;
   }
   observedMainChatgptAccountId = toAccountId;
-  purgeCodexAccountRuntimeState(MAIN_CODEX_ACCOUNT_ID);
-  setMainAccountPlan(null);
-  invalidateCodexWebSocketsForAccount(MAIN_CODEX_ACCOUNT_ID);
+  purgeMainCodexAccountRuntimeState();
   return true;
 }
 
diff --git a/src/codex/native-profile-api.ts b/src/codex/native-profile-api.ts
index 89a8ec881..60b8018a2 100644
--- a/src/codex/native-profile-api.ts
+++ b/src/codex/native-profile-api.ts
@@ -1,6 +1,6 @@
 import type { OcxConfig } from "../types";
 import { jsonResponse } from "../server/auth-cors";
-import { getActiveTurnCount, isDraining, setDraining } from "../server/lifecycle";
+import { acquireTemporaryDrain, getActiveTurnCount } from "../server/lifecycle";
 import {
   managementBodyTooLargeResponse,
   readManagementJsonBody,
@@ -8,12 +8,14 @@ import {
 } from "../server/management/body";
 import { NativeProfileManager } from "./native-profile-manager";
 import { NativeProfileError } from "./native-profile-types";
-import { completeNativeMainRecovery } from "./native-profile-startup";
+import { completeNativeMainRecovery, inspectNativeMainRecoveryJournal } from "./native-profile-startup";
 
 export interface NativeProfileApiDeps {
   manager?: NativeProfileManager;
   drainTimeoutMs?: number;
   sleep?: (ms: number) => Promise<void>;
+  inspectRecoveryJournal?: typeof inspectNativeMainRecoveryJournal;
+  completeRecovery?: typeof completeNativeMainRecovery;
 }
 
 async function body(req: Request): Promise<Record<string, unknown>> {
@@ -28,8 +30,8 @@ async function body(req: Request): Promise<Record<string, unknown>> {
 }
 
 async function withMainRequestDrain<T>(deps: NativeProfileApiDeps, operation: () => Promise<T>): Promise<T> {
-  if (isDraining()) throw new NativeProfileError("MAIN_REQUESTS_ACTIVE", "The proxy is already draining requests.", 503, true);
-  setDraining(true);
+  const drainLease = acquireTemporaryDrain("native-main-profile");
+  if (!drainLease) throw new NativeProfileError("MAIN_REQUESTS_ACTIVE", "The proxy is already draining requests.", 503, true);
   try {
     const deadline = Date.now() + (deps.drainTimeoutMs ?? 10_000);
     while (getActiveTurnCount() > 0 && Date.now() < deadline) await (deps.sleep ?? Bun.sleep)(50);
@@ -38,7 +40,7 @@ async function withMainRequestDrain<T>(deps: NativeProfileApiDeps, operation: ()
     }
     return await operation();
   } finally {
-    setDraining(false);
+    drainLease.release();
   }
 }
 
@@ -81,8 +83,19 @@ export async function handleNativeProfileAPI(
     if (url.pathname === "/api/native-main-profiles/switch" && req.method === "POST") {
       const input = await body(req);
       if (typeof input.target !== "string") throw new NativeProfileError("INVALID_REQUEST", "A target profile is required.", 400);
+      const switched = await withMainRequestDrain(deps, async () => {
+        const context = manager.context;
+        const hadPendingRecovery = context
+          ? (deps.inspectRecoveryJournal ?? inspectNativeMainRecoveryJournal)(context.journalPath) === "present"
+          : false;
+        const result = await manager.switch(input.target as string, input.confirmedStopped === true);
+        if (hadPendingRecovery && context?.homeId) {
+          (deps.completeRecovery ?? completeNativeMainRecovery)(context.homeId);
+        }
+        return result;
+      });
       return jsonResponse(
-        await withMainRequestDrain(deps, () => manager.switch(input.target as string, input.confirmedStopped === true)),
+        switched,
         200,
         req,
         config,
@@ -104,6 +117,6 @@ export async function handleNativeProfileAPI(
     if (error instanceof NativeProfileError) {
       return jsonResponse({ error: error.message, code: error.code, retryable: error.retryable }, error.status, req, config);
     }
-    return jsonResponse({ error: "Native-profile operation failed without changing or exposing credential data", code: "RECOVERY_REQUIRED" }, 500, req, config);
+    return jsonResponse({ error: "Native-profile operation failed.", code: "INTERNAL_ERROR" }, 500, req, config);
   }
 }
diff --git a/src/codex/native-profile-startup.ts b/src/codex/native-profile-startup.ts
index ffc21c2eb..009fb1d67 100644
--- a/src/codex/native-profile-startup.ts
+++ b/src/codex/native-profile-startup.ts
@@ -1,4 +1,4 @@
-import { existsSync } from "node:fs";
+import { statSync } from "node:fs";
 
 import { NativeProfileManager } from "./native-profile-manager";
 import { clearAccountNeedsReauth } from "./account-runtime-state";
@@ -12,6 +12,7 @@ export interface NativeMainStartupGateDeps {
   manager?: NativeProfileManager;
   /** Test-only barrier used to prove admission stays closed while startup recovery is pending. */
   beforeRecovery?: () => void | Promise<void>;
+  inspectJournal?: typeof inspectNativeMainRecoveryJournal;
 }
 
 let epoch = 0;
@@ -22,6 +23,19 @@ function ready(homeId: string | null): NativeMainStartupGateSnapshot {
   return { status: "ready", homeId };
 }
 
+export function inspectNativeMainRecoveryJournal(
+  path: string,
+  stat: (path: string) => unknown = statSync,
+): "present" | "absent" {
+  try {
+    stat(path);
+    return "present";
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException)?.code === "ENOENT") return "absent";
+    throw error;
+  }
+}
+
 /**
  * Arm the native-main gate synchronously, then converge the encrypted journal in the background.
  * No credential bytes are read here: journal/auth inspection remains inside NativeProfileManager.
@@ -42,7 +56,15 @@ export function initializeNativeMainStartupGate(
   }
 
   const homeId = manager.context.homeId;
-  if (!existsSync(manager.context.journalPath)) {
+  let journal: "present" | "absent";
+  try {
+    journal = (deps.inspectJournal ?? inspectNativeMainRecoveryJournal)(manager.context.journalPath);
+  } catch {
+    snapshot = { status: "blocked", homeId, reason: "manual-recovery" };
+    settled = Promise.resolve(snapshot);
+    return settled;
+  }
+  if (journal === "absent") {
     snapshot = ready(homeId);
     settled = Promise.resolve(snapshot);
     return settled;
diff --git a/src/server/lifecycle.ts b/src/server/lifecycle.ts
index 6e769a571..2ae339e2b 100644
--- a/src/server/lifecycle.ts
+++ b/src/server/lifecycle.ts
@@ -35,14 +35,71 @@ const activeTurns = new Map<AbortController, ActiveTurnLease>();
 const admittedTurns = new Set<ActiveTurnLease>();
 const knownTurnControllers = new WeakSet<AbortController>();
 let turnReleaseMisses = 0;
-let draining = false;
+let shutdownDraining = false;
+const temporaryDrainOwners = new Set<symbol>();
+const temporaryDrainWaiters = new Set<() => void>();
+let legacyDrainLease: AdmissionLease | null = null;
 let recyclingForExit = false;
 let _serverRef: ReturnType<typeof Bun.serve> | undefined;
 
 export function setServerRef(server: ReturnType<typeof Bun.serve> | undefined): void { _serverRef = server; }
-export function setDraining(value: boolean): void { draining = value; }
+/**
+ * Legacy/test-only drain control. Production scoped operations must use a lease,
+ * while process shutdown uses the irreversible shutdown latch.
+ */
+export function setDraining(value: boolean): void {
+  if (value) {
+    legacyDrainLease ??= acquireTemporaryDrain("legacy");
+  } else {
+    legacyDrainLease?.release();
+    legacyDrainLease = null;
+  }
+}
+
+/** Acquire the single owner-scoped temporary data-plane fence. */
+export function acquireTemporaryDrain(owner: string): AdmissionLease | null {
+  if (shutdownDraining || temporaryDrainOwners.size > 0) return null;
+  const token = Symbol(owner);
+  temporaryDrainOwners.add(token);
+  let active = true;
+  return {
+    release() {
+      if (!active) return;
+      active = false;
+      temporaryDrainOwners.delete(token);
+      if (temporaryDrainOwners.size === 0) {
+        for (const resolve of temporaryDrainWaiters) resolve();
+        temporaryDrainWaiters.clear();
+      }
+    },
+  };
+}
+
+/** Permanently fence this process for shutdown; scoped lease release cannot clear it. */
+export function beginShutdownDrain(): boolean {
+  if (shutdownDraining) return false;
+  shutdownDraining = true;
+  return true;
+}
+
+export function isShutdownDraining(): boolean { return shutdownDraining; }
+
+export function waitForTemporaryDrains(): Promise<void> {
+  if (temporaryDrainOwners.size === 0) return Promise.resolve();
+  return new Promise(resolve => temporaryDrainWaiters.add(resolve));
+}
+
+/** Test-only process-lifetime reset. Never call from production recovery paths. */
+export function resetLifecycleDrainStateForTests(): void {
+  legacyDrainLease?.release();
+  legacyDrainLease = null;
+  temporaryDrainOwners.clear();
+  for (const resolve of temporaryDrainWaiters) resolve();
+  temporaryDrainWaiters.clear();
+  shutdownDraining = false;
+}
 export function tryAdmitTurn(): ActiveTurnLease | null {
-  if (draining) return null;
+  if (isDraining()) return null;
   const gateLease = turnGate.tryAcquire();
   if (!gateLease) return null;
   const controllers = new Set<AbortController>();
@@ -86,7 +143,7 @@ export function unregisterTurn(ac: AbortController): void {
   }
   lease.release();
 }
-export function isDraining(): boolean { return draining; }
+export function isDraining(): boolean { return shutdownDraining || temporaryDrainOwners.size > 0; }
 export function getActiveTurnCount(): number { return turnGate.metrics().active; }
 export function activeRegistryMetrics(): Record<string, AdmissionMetrics> {
   const turns = turnGate.metrics();
@@ -159,7 +216,8 @@ export async function drainAndShutdown(
   timeoutMs: number,
 ): Promise<void> {
   const s = server ?? _serverRef;
-  draining = true;
+  beginShutdownDrain();
+  await waitForTemporaryDrains();
   beginBackgroundShellShutdown();
   try {
     const deadline = Date.now() + timeoutMs;
@@ -222,7 +280,8 @@ export async function drainAndShutdown(
       // isolate reclaim / follow-on listen the same way unterminated Workers did.
       if (s) await s.stop(true);
     } finally {
-      draining = false;
+      // shutdownDraining is a process-lifetime latch. A stopped server must
+      // never resume admission merely because shutdown cleanup returned.
     }
   }
 }
diff --git a/src/server/management/system-restart.ts b/src/server/management/system-restart.ts
index b7c57dd82..f722db5f9 100644
--- a/src/server/management/system-restart.ts
+++ b/src/server/management/system-restart.ts
@@ -23,12 +23,14 @@
  */
 import { spawn } from "node:child_process";
 import {
+  beginShutdownDrain,
   drainAndShutdown,
   getActiveTurnCount,
   getServerListenPort,
   isDraining,
+  isShutdownDraining,
   markRecyclingForExit,
-  setDraining,
+  waitForTemporaryDrains,
 } from "../lifecycle";
 import { isServiceViable } from "../../service";
 import { readRuntimePort } from "../../config";
@@ -48,6 +50,9 @@ export interface SystemRestartIo {
   exitProcess?: (code: number) => void;
   schedule?: (fn: () => void | Promise<void>, ms: number) => void;
   isDraining?: () => boolean;
+  isShutdownDraining?: () => boolean;
+  beginShutdownDrain?: () => boolean;
+  waitForTemporaryDrains?: () => Promise<void>;
   setDraining?: (value: boolean) => void;
   getActiveTurnCount?: () => number;
   listenPort?: () => number | undefined;
@@ -134,15 +139,21 @@ export function acceptSystemRestart(io: SystemRestartIo = restartIo): {
   activeTurnCount: number;
   drainTimeoutMs: number;
 } {
-  const alreadyDraining = restartAccepted || (io.isDraining ?? isDraining)();
+  const shutdownActive = io.isShutdownDraining
+    ?? io.isDraining
+    ?? isShutdownDraining;
+  const alreadyDraining = restartAccepted || shutdownActive();
   const activeTurnCount = (io.getActiveTurnCount ?? getActiveTurnCount)();
   const schedule = io.schedule ?? ((fn, ms) => { setTimeout(() => { void fn(); }, ms); });
 
   if (!alreadyDraining) {
     restartAccepted = true;
     // Reject new data-plane traffic immediately (503), before the 200ms response-flush delay.
-    (io.setDraining ?? setDraining)(true);
+    if (io.beginShutdownDrain) io.beginShutdownDrain();
+    else if (io.setDraining) io.setDraining(true);
+    else beginShutdownDrain();
     schedule(async () => {
+      await (io.waitForTemporaryDrains ?? waitForTemporaryDrains)();
       const drain = io.drainAndShutdown ?? drainAndShutdown;
       await drain(undefined, MEMORY_DRAIN_RESTART_MS);
       const supervised = (io.isSupervisedServiceChild ?? (() => isSupervisedServiceChild(io)))();
diff --git a/tests/native-profile-api.test.ts b/tests/native-profile-api.test.ts
index eb15cd2f6..7a2fe521d 100644
--- a/tests/native-profile-api.test.ts
+++ b/tests/native-profile-api.test.ts
@@ -5,12 +5,17 @@ import type { OcxConfig } from "../src/types";
 import { handleNativeProfileAPI } from "../src/codex/native-profile-api";
 import type { NativeProfileManager } from "../src/codex/native-profile-manager";
 import { NativeProfileError } from "../src/codex/native-profile-types";
-import { setDraining, tryAdmitTurn } from "../src/server/lifecycle";
+import { resetLifecycleDrainStateForTests, setDraining, tryAdmitTurn } from "../src/server/lifecycle";
+import {
+  completeNativeMainRecovery,
+  initializeNativeMainStartupGate,
+  nativeMainStartupGateSnapshot,
+} from "../src/codex/native-profile-startup";
 
 const originalCodexHome = process.env.CODEX_HOME;
 
 afterEach(() => {
-  setDraining(false);
+  resetLifecycleDrainStateForTests();
   if (originalCodexHome === undefined) delete process.env.CODEX_HOME;
   else process.env.CODEX_HOME = originalCodexHome;
 });
@@ -134,4 +139,68 @@ describe("native main profile management API", () => {
     expect(response?.status).toBe(409);
     expect(await response?.json()).toMatchObject({ code: "RECOVERY_REQUIRED", error: message });
   });
+
+  test("successful switch auto-recovery completes the matching startup gate before releasing its drain lease", async () => {
+    const homeId = "home-switch-gate";
+    await initializeNativeMainStartupGate({
+      manager: {
+        context: { homeId, journalPath: "pending" },
+        recover: async () => { throw new NativeProfileError("RECOVERY_REQUIRED", "manual", 409); },
+      } as unknown as NativeProfileManager,
+      inspectJournal: () => "present",
+    });
+    expect(nativeMainStartupGateSnapshot()).toMatchObject({ status: "blocked", homeId });
+    let completedWhileDraining = false;
+    const manager = {
+      context: { homeId, journalPath: "pending" },
+      switch: async () => ({ ok: true }),
+    } as unknown as NativeProfileManager;
+    const request = new Request("http://localhost/api/native-main-profiles/switch", {
+      method: "POST",
+      body: JSON.stringify({ target: "target", confirmedStopped: true }),
+    });
+    const response = await handleNativeProfileAPI(request, new URL(request.url), {} as OcxConfig, {
+      manager,
+      inspectRecoveryJournal: () => "present",
+      completeRecovery: id => {
+        completedWhileDraining = tryAdmitTurn() === null;
+        return completeNativeMainRecovery(id);
+      },
+    });
+    expect(response?.status).toBe(200);
+    expect(completedWhileDraining).toBe(true);
+    expect(nativeMainStartupGateSnapshot()).toMatchObject({ status: "ready", homeId });
+  });
+
+  test("switch without auto-recovery does not complete a blocked startup gate", async () => {
+    let completions = 0;
+    const manager = {
+      context: { homeId: "home-no-journal", journalPath: "missing" },
+      switch: async () => ({ ok: true }),
+    } as unknown as NativeProfileManager;
+    const request = new Request("http://localhost/api/native-main-profiles/switch", {
+      method: "POST",
+      body: JSON.stringify({ target: "target", confirmedStopped: true }),
+    });
+    const response = await handleNativeProfileAPI(request, new URL(request.url), {} as OcxConfig, {
+      manager,
+      inspectRecoveryJournal: () => "absent",
+      completeRecovery: () => { completions += 1; return true; },
+    });
+    expect(response?.status).toBe(200);
+    expect(completions).toBe(0);
+  });
+
+  test("unknown failures use a fixed redacted internal code while typed recovery remains distinct", async () => {
+    const secret = "C:\\Users\\Private\\.codex\\auth.json bearer-secret";
+    const manager = {
+      list: async () => { throw new Error(secret); },
+    } as unknown as NativeProfileManager;
+    const request = new Request("http://localhost/api/native-main-profiles");
+    const response = await handleNativeProfileAPI(request, new URL(request.url), {} as OcxConfig, { manager });
+    expect(response?.status).toBe(500);
+    const payload = await response?.json() as { code: string; error: string };
+    expect(payload).toEqual({ code: "INTERNAL_ERROR", error: "Native-profile operation failed." });
+    expect(JSON.stringify(payload)).not.toContain(secret);
+  });
 });
diff --git a/tests/native-profile-startup.test.ts b/tests/native-profile-startup.test.ts
index bd872eb66..5245a1ccf 100644
--- a/tests/native-profile-startup.test.ts
+++ b/tests/native-profile-startup.test.ts
@@ -26,6 +26,11 @@ import type {
   NativeProfileSwitchJournalV1,
 } from "../src/codex/native-profile-types";
 import type { OcxConfig } from "../src/types";
+import {
+  initializeNativeMainStartupGate,
+  inspectNativeMainRecoveryJournal,
+  nativeMainStartupGateSnapshot,
+} from "../src/codex/native-profile-startup";
 
 const roots: string[] = [];
 const previousOpencodexHome = process.env.OPENCODEX_HOME;
@@ -247,6 +252,30 @@ const recoverable: Array<{ phase: Phase; observation: Observation; active: "sour
 ];
 
 describe("native-main startup journal gate", () => {
+  test("sync journal inspection treats only ENOENT as absent and propagates other failures", () => {
+    expect(inspectNativeMainRecoveryJournal("missing", () => {
+      throw Object.assign(new Error("missing"), { code: "ENOENT" });
+    })).toBe("absent");
+    expect(() => inspectNativeMainRecoveryJournal("denied", () => {
+      throw Object.assign(new Error("private path"), { code: "EACCES" });
+    })).toThrow();
+  });
+
+  test("startup inspection failure closes the main gate without attempting recovery", async () => {
+    let recoverCalls = 0;
+    const homeId = "home-inspection-failure";
+    const gate = await initializeNativeMainStartupGate({
+      manager: {
+        context: { homeId, journalPath: "denied" },
+        recover: async () => { recoverCalls += 1; return {}; },
+      } as unknown as NativeProfileManager,
+      inspectJournal: () => { throw Object.assign(new Error("private path"), { code: "EACCES" }); },
+    });
+    expect(gate).toEqual({ status: "blocked", homeId, reason: "manual-recovery" });
+    expect(nativeMainStartupGateSnapshot()).toEqual(gate);
+    expect(recoverCalls).toBe(0);
+  });
+
   test("fresh processes gate first admission and converge every recoverable phase/observation", async () => {
     for (const scenario of recoverable) {
       const f = await fixture(scenario.phase, scenario.observation);
diff --git a/tests/shutdown-drain.test.ts b/tests/shutdown-drain.test.ts
index 3a10d643f..99e35fec4 100644
--- a/tests/shutdown-drain.test.ts
+++ b/tests/shutdown-drain.test.ts
@@ -13,7 +13,13 @@ import {
   isRecyclingForExit,
   markRecyclingForExit,
 } from "../src/server";
-import { activeRegistryMetrics, tryAdmitTurn } from "../src/server/lifecycle";
+import {
+  acquireTemporaryDrain,
+  activeRegistryMetrics,
+  beginShutdownDrain,
+  resetLifecycleDrainStateForTests,
+  tryAdmitTurn,
+} from "../src/server/lifecycle";
 import {
   backgroundShellAdmissionMetrics,
   backgroundShellSpawnExec,
@@ -31,6 +37,7 @@ class ShutdownFakeChild extends EventEmitter {
 
 afterEach(async () => {
   await resetBackgroundShellStateForTests();
+  resetLifecycleDrainStateForTests();
 });
 
 function installShutdownShell() {
@@ -80,6 +87,12 @@ describe("active turn tracking", () => {
     expect(isDraining()).toBe(false);
   });
 
+  test("shutdown first rejects profile leases and remains latched after scoped release attempts", () => {
+    expect(beginShutdownDrain()).toBe(true);
+    expect(acquireTemporaryDrain("native-profile")).toBeNull();
+    expect(isDraining()).toBe(true);
+  });
+
   test("forced shutdown releases an admitted turn before controller binding", async () => {
     const before = getActiveTurnCount();
     const releaseMissesBefore = activeRegistryMetrics().activeTurns.releaseMisses;
diff --git a/tests/system-restart.test.ts b/tests/system-restart.test.ts
index 709ef0813..969a639b4 100644
--- a/tests/system-restart.test.ts
+++ b/tests/system-restart.test.ts
@@ -3,7 +3,7 @@
  */
 import { afterEach, describe, expect, test } from "bun:test";
 import { handleManagementAPI } from "../src/server/management-api";
-import { setDraining } from "../src/server/lifecycle";
+import { resetLifecycleDrainStateForTests, setDraining } from "../src/server/lifecycle";
 import {
   MEMORY_DRAIN_RESTART_MS,
   acceptSystemRestart,
@@ -28,7 +28,7 @@ function config(): OcxConfig {
 
 afterEach(() => {
   setSystemRestartIoForTests();
-  setDraining(false);
+  resetLifecycleDrainStateForTests();
 });
 
 describe("acceptSystemRestart", () => {
@@ -260,6 +260,33 @@ describe("acceptSystemRestart", () => {
     expect(second.alreadyDraining).toBe(true);
     expect(scheduled).toBe(1);
   });
+
+  test("profile drain first queues one restart and waits for its owner lease", async () => {
+    const calls: string[] = [];
+    let scheduled: (() => void | Promise<void>) | null = null;
+    let releaseProfile!: () => void;
+    const profileReleased = new Promise<void>(resolve => { releaseProfile = resolve; });
+    const io = {
+      isShutdownDraining: () => false,
+      getActiveTurnCount: () => 0,
+      beginShutdownDrain: () => { calls.push("shutdown-latched"); return true; },
+      waitForTemporaryDrains: async () => { calls.push("wait-profile"); await profileReleased; },
+      schedule: (fn: () => void | Promise<void>) => { scheduled = fn; },
+      drainAndShutdown: async () => { calls.push("shutdown"); },
+      isSupervisedServiceChild: () => true,
+      exitProcess: (code: number) => { calls.push(`exit:${code}`); },
+    };
+    const first = acceptSystemRestart(io);
+    const second = acceptSystemRestart(io);
+    expect(first.alreadyDraining).toBe(false);
+    expect(second.alreadyDraining).toBe(true);
+    const running = scheduled!();
+    await Promise.resolve();
+    expect(calls).toEqual(["shutdown-latched", "wait-profile"]);
+    releaseProfile();
+    await running;
+    expect(calls).toEqual(["shutdown-latched", "wait-profile", "shutdown", "exit:1"]);
+  });
 });
 
 describe("POST /api/system/restart", () => {

From f3c2e9e97132a9638297f1a67bee75d2bb49adfe Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Sun, 2 Aug 2026 14:48:41 +0900
Subject: [PATCH 17/63] fix(codex): keep manual profile recovery gated

---
 src/codex/native-profile-api.ts      |  44 +++++++----
 src/codex/native-profile-startup.ts  |  38 +++++-----
 tests/native-profile-api.test.ts     | 107 +++++++++++++++++++++++++--
 tests/native-profile-startup.test.ts |  55 ++++++++++----
 4 files changed, 186 insertions(+), 58 deletions(-)

diff --git a/src/codex/native-profile-api.ts b/src/codex/native-profile-api.ts
index 60b8018a2..c8eb8948b 100644
--- a/src/codex/native-profile-api.ts
+++ b/src/codex/native-profile-api.ts
@@ -8,13 +8,14 @@ import {
 } from "../server/management/body";
 import { NativeProfileManager } from "./native-profile-manager";
 import { NativeProfileError } from "./native-profile-types";
-import { completeNativeMainRecovery, inspectNativeMainRecoveryJournal } from "./native-profile-startup";
+import { completeNativeMainRecovery } from "./native-profile-startup";
+import { probeNativeProfileRecoveryState } from "./native-profile-store";
 
 export interface NativeProfileApiDeps {
   manager?: NativeProfileManager;
   drainTimeoutMs?: number;
   sleep?: (ms: number) => Promise<void>;
-  inspectRecoveryJournal?: typeof inspectNativeMainRecoveryJournal;
+  probeRecoveryState?: typeof probeNativeProfileRecoveryState;
   completeRecovery?: typeof completeNativeMainRecovery;
 }
 
@@ -44,6 +45,23 @@ async function withMainRequestDrain<T>(deps: NativeProfileApiDeps, operation: ()
   }
 }
 
+async function withRecoveryGateTransition<T>(
+  manager: NativeProfileManager,
+  deps: NativeProfileApiDeps,
+  operation: () => Promise<T>,
+): Promise<T> {
+  const context = manager.context;
+  if (!context) return operation();
+  const probe = deps.probeRecoveryState ?? probeNativeProfileRecoveryState;
+  const before = probe(context);
+  const result = await operation();
+  const after = probe(context);
+  if (before !== "none" && after === "none") {
+    (deps.completeRecovery ?? completeNativeMainRecovery)(context.homeId);
+  }
+  return result;
+}
+
 export async function handleNativeProfileAPI(
   req: Request,
   url: URL,
@@ -83,17 +101,11 @@ export async function handleNativeProfileAPI(
     if (url.pathname === "/api/native-main-profiles/switch" && req.method === "POST") {
       const input = await body(req);
       if (typeof input.target !== "string") throw new NativeProfileError("INVALID_REQUEST", "A target profile is required.", 400);
-      const switched = await withMainRequestDrain(deps, async () => {
-        const context = manager.context;
-        const hadPendingRecovery = context
-          ? (deps.inspectRecoveryJournal ?? inspectNativeMainRecoveryJournal)(context.journalPath) === "present"
-          : false;
-        const result = await manager.switch(input.target as string, input.confirmedStopped === true);
-        if (hadPendingRecovery && context?.homeId) {
-          (deps.completeRecovery ?? completeNativeMainRecovery)(context.homeId);
-        }
-        return result;
-      });
+      const switched = await withMainRequestDrain(deps, () => withRecoveryGateTransition(
+        manager,
+        deps,
+        () => manager.switch(input.target as string, input.confirmedStopped === true),
+      ));
       return jsonResponse(
         switched,
         200,
@@ -103,11 +115,11 @@ export async function handleNativeProfileAPI(
     }
     if (url.pathname === "/api/native-main-profiles/recover" && req.method === "POST") {
       const input = await body(req);
-      const recovered = await withMainRequestDrain(
+      const recovered = await withMainRequestDrain(deps, () => withRecoveryGateTransition(
+        manager,
         deps,
         () => manager.recover(input.rollback === true, input.confirmedStopped === true),
-      );
-      if (manager.context?.homeId) completeNativeMainRecovery(manager.context.homeId);
+      ));
       return jsonResponse(recovered, 200, req, config);
     }
     return jsonResponse({ error: "Unknown native-profile operation", code: "INVALID_REQUEST" }, 404, req, config);
diff --git a/src/codex/native-profile-startup.ts b/src/codex/native-profile-startup.ts
index 009fb1d67..5b1c73c7d 100644
--- a/src/codex/native-profile-startup.ts
+++ b/src/codex/native-profile-startup.ts
@@ -1,8 +1,10 @@
-import { statSync } from "node:fs";
-
 import { NativeProfileManager } from "./native-profile-manager";
 import { clearAccountNeedsReauth } from "./account-runtime-state";
 import { MAIN_CODEX_ACCOUNT_ID } from "./main-account";
+import {
+  probeNativeProfileRecoveryState,
+  type NativeProfileRecoveryState,
+} from "./native-profile-store";
 
 export type NativeMainStartupGateSnapshot =
   | { status: "ready"; homeId: string | null }
@@ -12,7 +14,7 @@ export interface NativeMainStartupGateDeps {
   manager?: NativeProfileManager;
   /** Test-only barrier used to prove admission stays closed while startup recovery is pending. */
   beforeRecovery?: () => void | Promise<void>;
-  inspectJournal?: typeof inspectNativeMainRecoveryJournal;
+  probeRecoveryState?: typeof probeNativeProfileRecoveryState;
 }
 
 let epoch = 0;
@@ -23,19 +25,6 @@ function ready(homeId: string | null): NativeMainStartupGateSnapshot {
   return { status: "ready", homeId };
 }
 
-export function inspectNativeMainRecoveryJournal(
-  path: string,
-  stat: (path: string) => unknown = statSync,
-): "present" | "absent" {
-  try {
-    stat(path);
-    return "present";
-  } catch (error) {
-    if ((error as NodeJS.ErrnoException)?.code === "ENOENT") return "absent";
-    throw error;
-  }
-}
-
 /**
  * Arm the native-main gate synchronously, then converge the encrypted journal in the background.
  * No credential bytes are read here: journal/auth inspection remains inside NativeProfileManager.
@@ -56,28 +45,37 @@ export function initializeNativeMainStartupGate(
   }
 
   const homeId = manager.context.homeId;
-  let journal: "present" | "absent";
+  const probe = deps.probeRecoveryState ?? probeNativeProfileRecoveryState;
+  let recoveryState: NativeProfileRecoveryState;
   try {
-    journal = (deps.inspectJournal ?? inspectNativeMainRecoveryJournal)(manager.context.journalPath);
+    recoveryState = probe(manager.context);
   } catch {
     snapshot = { status: "blocked", homeId, reason: "manual-recovery" };
     settled = Promise.resolve(snapshot);
     return settled;
   }
-  if (journal === "absent") {
+  if (recoveryState === "none") {
     snapshot = ready(homeId);
     settled = Promise.resolve(snapshot);
     return settled;
   }
 
+  if (recoveryState !== "journal") {
+    snapshot = { status: "blocked", homeId, reason: "manual-recovery" };
+    settled = Promise.resolve(snapshot);
+    return settled;
+  }
+
   snapshot = { status: "blocked", homeId, reason: "recovery-pending" };
   settled = (async () => {
     try {
       await deps.beforeRecovery?.();
       await manager.recover(false);
-      if (epoch === currentEpoch) {
+      if (epoch === currentEpoch && probe(manager.context) === "none") {
         clearAccountNeedsReauth(MAIN_CODEX_ACCOUNT_ID);
         snapshot = ready(homeId);
+      } else if (epoch === currentEpoch) {
+        snapshot = { status: "blocked", homeId, reason: "manual-recovery" };
       }
     } catch {
       if (epoch === currentEpoch) snapshot = { status: "blocked", homeId, reason: "manual-recovery" };
diff --git a/tests/native-profile-api.test.ts b/tests/native-profile-api.test.ts
index 7a2fe521d..e6314ddbf 100644
--- a/tests/native-profile-api.test.ts
+++ b/tests/native-profile-api.test.ts
@@ -144,15 +144,15 @@ describe("native main profile management API", () => {
     const homeId = "home-switch-gate";
     await initializeNativeMainStartupGate({
       manager: {
-        context: { homeId, journalPath: "pending" },
+        context: { homeId, journalPath: "pending", recoveryBlockPath: "block" },
         recover: async () => { throw new NativeProfileError("RECOVERY_REQUIRED", "manual", 409); },
       } as unknown as NativeProfileManager,
-      inspectJournal: () => "present",
+      probeRecoveryState: () => "journal",
     });
     expect(nativeMainStartupGateSnapshot()).toMatchObject({ status: "blocked", homeId });
     let completedWhileDraining = false;
     const manager = {
-      context: { homeId, journalPath: "pending" },
+      context: { homeId, journalPath: "pending", recoveryBlockPath: "block" },
       switch: async () => ({ ok: true }),
     } as unknown as NativeProfileManager;
     const request = new Request("http://localhost/api/native-main-profiles/switch", {
@@ -161,7 +161,10 @@ describe("native main profile management API", () => {
     });
     const response = await handleNativeProfileAPI(request, new URL(request.url), {} as OcxConfig, {
       manager,
-      inspectRecoveryJournal: () => "present",
+      probeRecoveryState: (() => {
+        const states = ["journal", "none"] as const;
+        return () => states.shift() ?? "none";
+      })(),
       completeRecovery: id => {
         completedWhileDraining = tryAdmitTurn() === null;
         return completeNativeMainRecovery(id);
@@ -175,7 +178,7 @@ describe("native main profile management API", () => {
   test("switch without auto-recovery does not complete a blocked startup gate", async () => {
     let completions = 0;
     const manager = {
-      context: { homeId: "home-no-journal", journalPath: "missing" },
+      context: { homeId: "home-no-journal", journalPath: "missing", recoveryBlockPath: "missing-block" },
       switch: async () => ({ ok: true }),
     } as unknown as NativeProfileManager;
     const request = new Request("http://localhost/api/native-main-profiles/switch", {
@@ -184,13 +187,105 @@ describe("native main profile management API", () => {
     });
     const response = await handleNativeProfileAPI(request, new URL(request.url), {} as OcxConfig, {
       manager,
-      inspectRecoveryJournal: () => "absent",
+      probeRecoveryState: () => "none",
       completeRecovery: () => { completions += 1; return true; },
     });
     expect(response?.status).toBe(200);
     expect(completions).toBe(0);
   });
 
+  test("explicit recovery completes a manual marker gate only after the marker clears", async () => {
+    const homeId = "home-manual-clear";
+    await initializeNativeMainStartupGate({
+      manager: { context: { homeId }, recover: async () => ({}) } as unknown as NativeProfileManager,
+      probeRecoveryState: () => "manual",
+    });
+    let completions = 0;
+    const manager = {
+      context: { homeId, journalPath: "missing", recoveryBlockPath: "block" },
+      recover: async () => ({ ok: true, recovered: true, action: "confirm-current-owner" }),
+    } as unknown as NativeProfileManager;
+    const states = ["manual", "none"] as const;
+    const request = new Request("http://localhost/api/native-main-profiles/recover", {
+      method: "POST",
+      body: JSON.stringify({ rollback: false }),
+    });
+    const response = await handleNativeProfileAPI(request, new URL(request.url), {} as OcxConfig, {
+      manager,
+      probeRecoveryState: () => states.shift() ?? "none",
+      completeRecovery: id => {
+        completions += 1;
+        return completeNativeMainRecovery(id);
+      },
+    });
+    expect(response?.status).toBe(200);
+    expect(completions).toBe(1);
+    expect(nativeMainStartupGateSnapshot()).toMatchObject({ status: "ready", homeId });
+  });
+
+  test("retained manual markers and failed recovery never complete the gate", async () => {
+    const homeId = "home-manual-retained";
+    await initializeNativeMainStartupGate({
+      manager: { context: { homeId }, recover: async () => ({}) } as unknown as NativeProfileManager,
+      probeRecoveryState: () => "manual",
+    });
+    let completions = 0;
+    const retainedManager = {
+      context: { homeId, journalPath: "missing", recoveryBlockPath: "block" },
+      recover: async () => ({ ok: true, recovered: false }),
+    } as unknown as NativeProfileManager;
+    const retainedRequest = new Request("http://localhost/api/native-main-profiles/recover", {
+      method: "POST",
+      body: JSON.stringify({ rollback: false }),
+    });
+    const retained = await handleNativeProfileAPI(retainedRequest, new URL(retainedRequest.url), {} as OcxConfig, {
+      manager: retainedManager,
+      probeRecoveryState: () => "manual",
+      completeRecovery: () => { completions += 1; return true; },
+    });
+    expect(retained?.status).toBe(200);
+    expect(completions).toBe(0);
+    expect(nativeMainStartupGateSnapshot()).toMatchObject({ status: "blocked", homeId });
+
+    const failedManager = {
+      context: retainedManager.context,
+      recover: async () => { throw new NativeProfileError("RECOVERY_REQUIRED", "marker retained", 409); },
+    } as unknown as NativeProfileManager;
+    const failedRequest = new Request("http://localhost/api/native-main-profiles/recover", {
+      method: "POST",
+      body: JSON.stringify({ rollback: false }),
+    });
+    const failed = await handleNativeProfileAPI(failedRequest, new URL(failedRequest.url), {} as OcxConfig, {
+      manager: failedManager,
+      probeRecoveryState: () => "manual",
+      completeRecovery: () => { completions += 1; return true; },
+    });
+    expect(failed?.status).toBe(409);
+    expect(completions).toBe(0);
+  });
+
+  test("a cleared recovery state cannot complete a startup gate for another home", async () => {
+    await initializeNativeMainStartupGate({
+      manager: { context: { homeId: "home-a" }, recover: async () => ({}) } as unknown as NativeProfileManager,
+      probeRecoveryState: () => "manual",
+    });
+    const manager = {
+      context: { homeId: "home-b", journalPath: "pending", recoveryBlockPath: "block" },
+      recover: async () => ({ ok: true }),
+    } as unknown as NativeProfileManager;
+    const states = ["manual", "none"] as const;
+    const request = new Request("http://localhost/api/native-main-profiles/recover", {
+      method: "POST",
+      body: JSON.stringify({ rollback: false }),
+    });
+    const response = await handleNativeProfileAPI(request, new URL(request.url), {} as OcxConfig, {
+      manager,
+      probeRecoveryState: () => states.shift() ?? "none",
+    });
+    expect(response?.status).toBe(200);
+    expect(nativeMainStartupGateSnapshot()).toMatchObject({ status: "blocked", homeId: "home-a" });
+  });
+
   test("unknown failures use a fixed redacted internal code while typed recovery remains distinct", async () => {
     const secret = "C:\\Users\\Private\\.codex\\auth.json bearer-secret";
     const manager = {
diff --git a/tests/native-profile-startup.test.ts b/tests/native-profile-startup.test.ts
index 5245a1ccf..74339c023 100644
--- a/tests/native-profile-startup.test.ts
+++ b/tests/native-profile-startup.test.ts
@@ -28,7 +28,6 @@ import type {
 import type { OcxConfig } from "../src/types";
 import {
   initializeNativeMainStartupGate,
-  inspectNativeMainRecoveryJournal,
   nativeMainStartupGateSnapshot,
 } from "../src/codex/native-profile-startup";
 
@@ -252,28 +251,52 @@ const recoverable: Array<{ phase: Phase; observation: Observation; active: "sour
 ];
 
 describe("native-main startup journal gate", () => {
-  test("sync journal inspection treats only ENOENT as absent and propagates other failures", () => {
-    expect(inspectNativeMainRecoveryJournal("missing", () => {
-      throw Object.assign(new Error("missing"), { code: "ENOENT" });
-    })).toBe("absent");
-    expect(() => inspectNativeMainRecoveryJournal("denied", () => {
-      throw Object.assign(new Error("private path"), { code: "EACCES" });
-    })).toThrow();
+  test("manual and unreadable recovery states close the main gate without automatic recovery", async () => {
+    let recoverCalls = 0;
+    for (const state of ["manual", "unreadable"] as const) {
+      const homeId = `home-${state}`;
+      const gate = await initializeNativeMainStartupGate({
+        manager: {
+          context: { homeId },
+          recover: async () => { recoverCalls += 1; return {}; },
+        } as unknown as NativeProfileManager,
+        probeRecoveryState: () => state,
+      });
+      expect(gate).toEqual({ status: "blocked", homeId, reason: "manual-recovery" });
+      expect(nativeMainStartupGateSnapshot()).toEqual(gate);
+    }
+    expect(recoverCalls).toBe(0);
   });
 
-  test("startup inspection failure closes the main gate without attempting recovery", async () => {
+  test("journal recovery opens only after the post-recovery probe reaches none", async () => {
+    const states = ["journal", "none"] as const;
     let recoverCalls = 0;
-    const homeId = "home-inspection-failure";
+    const homeId = "home-journal-recovered";
     const gate = await initializeNativeMainStartupGate({
       manager: {
-        context: { homeId, journalPath: "denied" },
-        recover: async () => { recoverCalls += 1; return {}; },
+        context: { homeId },
+        recover: async () => { recoverCalls += 1; return { recovered: true }; },
       } as unknown as NativeProfileManager,
-      inspectJournal: () => { throw Object.assign(new Error("private path"), { code: "EACCES" }); },
+      probeRecoveryState: () => states.shift() ?? "none",
+    });
+    expect(gate).toEqual({ status: "ready", homeId });
+    expect(recoverCalls).toBe(1);
+  });
+
+  test("marker-only restart remains blocked after a malformed journal is quarantined", async () => {
+    const f = await fixture("prepared", "target-exact");
+    writeFileSync(f.manager.context.journalPath, "{malformed-journal\n");
+    writeFileSync(f.manager.context.authPath, f.target);
+    await expect(f.manager.recover(true, true)).rejects.toMatchObject({ code: "RECOVERY_REQUIRED" });
+    expect(existsSync(f.manager.context.journalPath)).toBe(false);
+    expect(existsSync(f.manager.context.recoveryBlockPath)).toBe(true);
+
+    const gate = await initializeNativeMainStartupGate({ manager: f.manager });
+    expect(gate).toEqual({
+      status: "blocked",
+      homeId: f.manager.context.homeId,
+      reason: "manual-recovery",
     });
-    expect(gate).toEqual({ status: "blocked", homeId, reason: "manual-recovery" });
-    expect(nativeMainStartupGateSnapshot()).toEqual(gate);
-    expect(recoverCalls).toBe(0);
   });
 
   test("fresh processes gate first admission and converge every recoverable phase/observation", async () => {

From 57ebab00882c7366574f71612c1da7fa196165c9 Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Sun, 2 Aug 2026 14:54:37 +0900
Subject: [PATCH 18/63] fix(codex): release gate after converged switch error

---
 src/codex/native-profile-api.ts      | 24 ++++++++++---
 tests/native-profile-startup.test.ts | 50 ++++++++++++++++++++++++++++
 2 files changed, 69 insertions(+), 5 deletions(-)

diff --git a/src/codex/native-profile-api.ts b/src/codex/native-profile-api.ts
index c8eb8948b..a3e7a9050 100644
--- a/src/codex/native-profile-api.ts
+++ b/src/codex/native-profile-api.ts
@@ -54,12 +54,26 @@ async function withRecoveryGateTransition<T>(
   if (!context) return operation();
   const probe = deps.probeRecoveryState ?? probeNativeProfileRecoveryState;
   const before = probe(context);
-  const result = await operation();
-  const after = probe(context);
-  if (before !== "none" && after === "none") {
-    (deps.completeRecovery ?? completeNativeMainRecovery)(context.homeId);
+  let operationFailed = false;
+  try {
+    return await operation();
+  } catch (error) {
+    operationFailed = true;
+    throw error;
+  } finally {
+    if (before !== "none") {
+      try {
+        const after = probe(context);
+        if (after === "none") {
+          (deps.completeRecovery ?? completeNativeMainRecovery)(context.homeId);
+        }
+      } catch (transitionError) {
+        // Preserve the operation's typed/public error. A post-operation probe or
+        // completion failure must not replace it; the gate remains fail closed.
+        if (!operationFailed) throw transitionError;
+      }
+    }
   }
-  return result;
 }
 
 export async function handleNativeProfileAPI(
diff --git a/tests/native-profile-startup.test.ts b/tests/native-profile-startup.test.ts
index 74339c023..95884ebea 100644
--- a/tests/native-profile-startup.test.ts
+++ b/tests/native-profile-startup.test.ts
@@ -14,8 +14,10 @@ import { saveConfig } from "../src/config";
 import { saveCodexAccountCredential } from "../src/codex/account-store";
 import { MAIN_CODEX_ACCOUNT_ID } from "../src/codex/main-account";
 import { NativeProfileManager } from "../src/codex/native-profile-manager";
+import { handleNativeProfileAPI } from "../src/codex/native-profile-api";
 import {
   encryptNativeEnvelope,
+  probeNativeProfileRecoveryState,
   readNativeEnvelope,
   readNativeProfileVault,
   serializeNativeProfileMetadata,
@@ -28,6 +30,7 @@ import type {
 import type { OcxConfig } from "../src/types";
 import {
   initializeNativeMainStartupGate,
+  isNativeMainTrafficBlocked,
   nativeMainStartupGateSnapshot,
 } from "../src/codex/native-profile-startup";
 
@@ -299,6 +302,53 @@ describe("native-main startup journal gate", () => {
     });
   });
 
+  test("a switch error after real journal convergence preserves the selector error and reopens main", async () => {
+    const f = await fixture("prepared", "source-exact");
+    await initializeNativeMainStartupGate({
+      manager: f.manager,
+      // Arm the matching startup gate without consuming the real journal; the
+      // API switch below owns and exercises the actual convergence path.
+      probeRecoveryState: () => "manual",
+    });
+    expect(probeNativeProfileRecoveryState(f.manager.context)).toBe("journal");
+    expect(isNativeMainTrafficBlocked()).toBe(true);
+
+    const request = new Request("http://localhost/api/native-main-profiles/switch", {
+      method: "POST",
+      body: JSON.stringify({ target: "missing-after-recovery", confirmedStopped: true }),
+    });
+    const response = await handleNativeProfileAPI(request, new URL(request.url), {} as OcxConfig, {
+      manager: f.manager,
+    });
+
+    expect(response?.status).toBe(404);
+    expect(await response?.json()).toMatchObject({ code: "PROFILE_NOT_FOUND" });
+    expect(probeNativeProfileRecoveryState(f.manager.context)).toBe("none");
+    expect(nativeMainStartupGateSnapshot()).toMatchObject({ status: "ready", homeId: f.manager.context.homeId });
+    expect(isNativeMainTrafficBlocked()).toBe(false);
+  });
+
+  test("a failed real recovery that retains its journal preserves recovery-required and keeps main blocked", async () => {
+    const f = await fixture("prepared", "third");
+    await initializeNativeMainStartupGate({
+      manager: f.manager,
+      probeRecoveryState: () => "manual",
+    });
+    const request = new Request("http://localhost/api/native-main-profiles/switch", {
+      method: "POST",
+      body: JSON.stringify({ target: "missing-after-recovery", confirmedStopped: true }),
+    });
+    const response = await handleNativeProfileAPI(request, new URL(request.url), {} as OcxConfig, {
+      manager: f.manager,
+    });
+
+    expect(response?.status).toBe(409);
+    expect(await response?.json()).toMatchObject({ code: "RECOVERY_REQUIRED" });
+    expect(probeNativeProfileRecoveryState(f.manager.context)).toBe("journal");
+    expect(nativeMainStartupGateSnapshot()).toMatchObject({ status: "blocked", homeId: f.manager.context.homeId });
+    expect(isNativeMainTrafficBlocked()).toBe(true);
+  });
+
   test("fresh processes gate first admission and converge every recoverable phase/observation", async () => {
     for (const scenario of recoverable) {
       const f = await fixture(scenario.phase, scenario.observation);

From fac61c48410318b0c3a4a8fe7bd9ca423863eeee Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Sun, 2 Aug 2026 15:01:12 +0900
Subject: [PATCH 19/63] fix(server): bound restart drain by one deadline

---
 src/server/lifecycle.ts                 | 28 ++++++++++++-
 src/server/management/system-restart.ts | 15 +++++--
 tests/shutdown-drain.test.ts            | 31 +++++++++++++++
 tests/system-restart.test.ts            | 52 ++++++++++++++++++-------
 4 files changed, 106 insertions(+), 20 deletions(-)

diff --git a/src/server/lifecycle.ts b/src/server/lifecycle.ts
index 2ae339e2b..90bca7805 100644
--- a/src/server/lifecycle.ts
+++ b/src/server/lifecycle.ts
@@ -89,6 +89,25 @@ export function waitForTemporaryDrains(): Promise<void> {
   return new Promise(resolve => temporaryDrainWaiters.add(resolve));
 }
 
+/** Wait for scoped drains without allowing them to outlive the shutdown deadline. */
+async function waitForTemporaryDrainsUntil(deadlineMs: number): Promise<boolean> {
+  if (temporaryDrainOwners.size === 0) return true;
+  const remainingMs = Math.max(0, deadlineMs - Date.now());
+  if (remainingMs === 0) return false;
+  return new Promise<boolean>((resolve) => {
+    let settled = false;
+    let timer: ReturnType<typeof setTimeout> | undefined;
+    const finish = (drained: boolean) => {
+      if (settled) return;
+      settled = true;
+      if (timer) clearTimeout(timer);
+      resolve(drained);
+    };
+    timer = setTimeout(() => finish(false), remainingMs);
+    void waitForTemporaryDrains().then(() => finish(true));
+  });
+}
+
 /** Test-only process-lifetime reset. Never call from production recovery paths. */
 export function resetLifecycleDrainStateForTests(): void {
   legacyDrainLease?.release();
@@ -216,11 +235,16 @@ export async function drainAndShutdown(
   timeoutMs: number,
 ): Promise<void> {
   const s = server ?? _serverRef;
+  // One absolute budget covers both a pre-existing scoped profile drain and
+  // ordinary in-flight turns. A stuck scoped owner must not pin shutdown forever.
+  const deadline = Date.now() + Math.max(0, timeoutMs);
   beginShutdownDrain();
-  await waitForTemporaryDrains();
+  const temporaryDrainsSettled = await waitForTemporaryDrainsUntil(deadline);
+  if (!temporaryDrainsSettled) {
+    console.warn("Temporary drain lease did not settle before the shutdown deadline; forcing shutdown");
+  }
   beginBackgroundShellShutdown();
   try {
-    const deadline = Date.now() + timeoutMs;
     while (admittedTurns.size > 0 && Date.now() < deadline) {
       await Bun.sleep(100);
     }
diff --git a/src/server/management/system-restart.ts b/src/server/management/system-restart.ts
index f722db5f9..079b5721f 100644
--- a/src/server/management/system-restart.ts
+++ b/src/server/management/system-restart.ts
@@ -30,7 +30,6 @@ import {
   isDraining,
   isShutdownDraining,
   markRecyclingForExit,
-  waitForTemporaryDrains,
 } from "../lifecycle";
 import { isServiceViable } from "../../service";
 import { readRuntimePort } from "../../config";
@@ -52,10 +51,10 @@ export interface SystemRestartIo {
   isDraining?: () => boolean;
   isShutdownDraining?: () => boolean;
   beginShutdownDrain?: () => boolean;
-  waitForTemporaryDrains?: () => Promise<void>;
   setDraining?: (value: boolean) => void;
   getActiveTurnCount?: () => number;
   listenPort?: () => number | undefined;
+  now?: () => number;
 }
 
 let restartIo: SystemRestartIo = {};
@@ -148,14 +147,22 @@ export function acceptSystemRestart(io: SystemRestartIo = restartIo): {
 
   if (!alreadyDraining) {
     restartAccepted = true;
+    const now = io.now ?? Date.now;
+    const restartDeadlineMs = now() + MEMORY_DRAIN_RESTART_MS;
     // Reject new data-plane traffic immediately (503), before the 200ms response-flush delay.
     if (io.beginShutdownDrain) io.beginShutdownDrain();
     else if (io.setDraining) io.setDraining(true);
     else beginShutdownDrain();
     schedule(async () => {
-      await (io.waitForTemporaryDrains ?? waitForTemporaryDrains)();
       const drain = io.drainAndShutdown ?? drainAndShutdown;
-      await drain(undefined, MEMORY_DRAIN_RESTART_MS);
+      const remainingMs = Math.max(0, restartDeadlineMs - now());
+      try {
+        await drain(undefined, remainingMs);
+      } catch {
+        // drainAndShutdown stops the listener in finally. Even if ancillary cleanup
+        // rejects, an accepted restart must still reach replacement or terminal exit.
+        console.warn("Drain-and-restart cleanup failed; continuing terminal restart handoff");
+      }
       const supervised = (io.isSupervisedServiceChild ?? (() => isSupervisedServiceChild(io)))();
       if (supervised) {
         // Failure-only supervisors ignore exit(0); intentional non-zero triggers respawn.
diff --git a/tests/shutdown-drain.test.ts b/tests/shutdown-drain.test.ts
index 99e35fec4..5d2232d76 100644
--- a/tests/shutdown-drain.test.ts
+++ b/tests/shutdown-drain.test.ts
@@ -93,6 +93,37 @@ describe("active turn tracking", () => {
     expect(isDraining()).toBe(true);
   });
 
+  test("deadline forces shutdown past a never-releasing profile lease and keeps the latch terminal", async () => {
+    const profileLease = acquireTemporaryDrain("native-profile");
+    expect(profileLease).not.toBeNull();
+    const fake = fakeServer();
+
+    await drainAndShutdown(fake.server, 0);
+
+    expect(fake.stops()).toBe(1);
+    expect(isDraining()).toBe(true);
+    profileLease?.release();
+    expect(isDraining()).toBe(true);
+    expect(tryAdmitTurn()).toBeNull();
+  });
+
+  test("profile-first shutdown resumes on normal early lease release", async () => {
+    const profileLease = acquireTemporaryDrain("native-profile");
+    expect(profileLease).not.toBeNull();
+    const fake = fakeServer();
+    let settled = false;
+    const draining = drainAndShutdown(fake.server, 1_000).then(() => { settled = true; });
+    await Promise.resolve();
+    await Promise.resolve();
+    expect(settled).toBe(false);
+
+    profileLease?.release();
+    await draining;
+
+    expect(fake.stops()).toBe(1);
+    expect(isDraining()).toBe(true);
+  });
+
   test("forced shutdown releases an admitted turn before controller binding", async () => {
     const before = getActiveTurnCount();
     const releaseMissesBefore = activeRegistryMetrics().activeTurns.releaseMisses;
diff --git a/tests/system-restart.test.ts b/tests/system-restart.test.ts
index 969a639b4..42e7be9b4 100644
--- a/tests/system-restart.test.ts
+++ b/tests/system-restart.test.ts
@@ -32,9 +32,10 @@ afterEach(() => {
 });
 
 describe("acceptSystemRestart", () => {
-  test("schedules a 60s drain, spawns start on the live port, marks recycle, then exits 0", async () => {
+  test("uses the remaining absolute restart budget, spawns start, marks recycle, then exits 0", async () => {
     const calls: string[] = [];
     let scheduled: (() => void | Promise<void>) | null = null;
+    let now = 10_000;
 
     const result = acceptSystemRestart({
       isDraining: () => false,
@@ -42,6 +43,7 @@ describe("acceptSystemRestart", () => {
       isSupervisedServiceChild: () => false,
       listenPort: () => 10123,
       schedule: (fn) => { scheduled = fn; },
+      now: () => now,
       setDraining: (value) => { calls.push(`draining:${value}`); },
       drainAndShutdown: async (_server, timeoutMs) => {
         calls.push(`drain:${timeoutMs}`);
@@ -61,8 +63,9 @@ describe("acceptSystemRestart", () => {
     expect(calls).toEqual(["draining:true"]);
     expect(MEMORY_DRAIN_RESTART_MS).toBe(60_000);
     expect(scheduled).not.toBeNull();
+    now += 15_000;
     await scheduled!();
-    expect(calls).toEqual(["draining:true", "drain:60000", "start:10123", "recycle", "exit:0"]);
+    expect(calls).toEqual(["draining:true", "drain:45000", "start:10123", "recycle", "exit:0"]);
   });
 
   test("supervised service child exits 1 so failure-only supervisors respawn", async () => {
@@ -202,6 +205,30 @@ describe("acceptSystemRestart", () => {
     expect(calls).toEqual(["drain", "start", "exit:1"]);
   });
 
+  test("drain rejection still reaches one replacement handoff and terminal exit", async () => {
+    const calls: string[] = [];
+    let scheduled: (() => void | Promise<void>) | null = null;
+
+    acceptSystemRestart({
+      isDraining: () => false,
+      getActiveTurnCount: () => 1,
+      isSupervisedServiceChild: () => false,
+      listenPort: () => 10123,
+      schedule: (fn) => { scheduled = fn; },
+      setDraining: () => { calls.push("latched"); },
+      drainAndShutdown: async () => {
+        calls.push("drain");
+        throw new Error("fixture cleanup rejection");
+      },
+      spawnStart: (port) => { calls.push(`start:${port}`); },
+      markRecycling: () => { calls.push("recycle"); },
+      exitProcess: (code) => { calls.push(`exit:${code}`); },
+    });
+
+    await scheduled!();
+    expect(calls).toEqual(["latched", "drain", "start:10123", "recycle", "exit:0"]);
+  });
+
   test("spawn failure clears OCX_SERVICE so exit cleanup can restore fences", async () => {
     const calls: string[] = [];
     let scheduled: (() => void | Promise<void>) | null = null;
@@ -261,31 +288,28 @@ describe("acceptSystemRestart", () => {
     expect(scheduled).toBe(1);
   });
 
-  test("profile drain first queues one restart and waits for its owner lease", async () => {
+  test("profile-first ordering queues and hands off exactly once across repeated accepts", async () => {
     const calls: string[] = [];
     let scheduled: (() => void | Promise<void>) | null = null;
-    let releaseProfile!: () => void;
-    const profileReleased = new Promise<void>(resolve => { releaseProfile = resolve; });
+    let scheduleCount = 0;
     const io = {
       isShutdownDraining: () => false,
       getActiveTurnCount: () => 0,
       beginShutdownDrain: () => { calls.push("shutdown-latched"); return true; },
-      waitForTemporaryDrains: async () => { calls.push("wait-profile"); await profileReleased; },
-      schedule: (fn: () => void | Promise<void>) => { scheduled = fn; },
+      schedule: (fn: () => void | Promise<void>) => { scheduleCount += 1; scheduled = fn; },
       drainAndShutdown: async () => { calls.push("shutdown"); },
-      isSupervisedServiceChild: () => true,
+      isSupervisedServiceChild: () => false,
+      spawnStart: () => { calls.push("start"); },
+      markRecycling: () => { calls.push("recycle"); },
       exitProcess: (code: number) => { calls.push(`exit:${code}`); },
     };
     const first = acceptSystemRestart(io);
     const second = acceptSystemRestart(io);
     expect(first.alreadyDraining).toBe(false);
     expect(second.alreadyDraining).toBe(true);
-    const running = scheduled!();
-    await Promise.resolve();
-    expect(calls).toEqual(["shutdown-latched", "wait-profile"]);
-    releaseProfile();
-    await running;
-    expect(calls).toEqual(["shutdown-latched", "wait-profile", "shutdown", "exit:1"]);
+    expect(scheduleCount).toBe(1);
+    await scheduled!();
+    expect(calls).toEqual(["shutdown-latched", "shutdown", "start", "recycle", "exit:0"]);
   });
 });
 

From ba53f1df3b3272526e6e9eccdc6da9f22339af70 Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Sun, 2 Aug 2026 15:22:54 +0900
Subject: [PATCH 20/63] fix(codex): close profile journal and cleanup gaps

---
 src/cli/account-api.ts               |   3 +
 src/codex/native-profile-api.ts      |   7 +-
 src/codex/native-profile-manager.ts  |  53 +++++++---
 src/codex/native-profile-store.ts    |  15 ++-
 src/codex/native-profile-types.ts    |   1 +
 tests/cli-native-profile.test.ts     |  24 ++++-
 tests/native-profile-api.test.ts     |  27 ++++-
 tests/native-profile-manager.test.ts |  39 ++++---
 tests/native-profile-store.test.ts   | 151 +++++++++++++++++++++++++++
 9 files changed, 290 insertions(+), 30 deletions(-)
 create mode 100644 tests/native-profile-store.test.ts

diff --git a/src/cli/account-api.ts b/src/cli/account-api.ts
index 4d81b67ed..01061697c 100644
--- a/src/cli/account-api.ts
+++ b/src/cli/account-api.ts
@@ -100,6 +100,9 @@ export function proxyUnreachable(): number {
 export function apiError(json: Record<string, unknown>, fallback: string): number {
   const message = typeof json.error === "string" ? json.error : fallback;
   console.error(`Error: ${message}`);
+  if (json.cleanupRequired === true) {
+    console.error("Warning: native-login staging cleanup is still required; run 'ocx account main doctor'.");
+  }
   return 1;
 }
 
diff --git a/src/codex/native-profile-api.ts b/src/codex/native-profile-api.ts
index a3e7a9050..34a7f8931 100644
--- a/src/codex/native-profile-api.ts
+++ b/src/codex/native-profile-api.ts
@@ -141,7 +141,12 @@ export async function handleNativeProfileAPI(
     const tooLarge = managementBodyTooLargeResponse(error, req, config);
     if (tooLarge) return tooLarge;
     if (error instanceof NativeProfileError) {
-      return jsonResponse({ error: error.message, code: error.code, retryable: error.retryable }, error.status, req, config);
+      return jsonResponse({
+        error: error.message,
+        code: error.code,
+        retryable: error.retryable,
+        ...(error.cleanupRequired === true ? { cleanupRequired: true } : {}),
+      }, error.status, req, config);
     }
     return jsonResponse({ error: "Native-profile operation failed.", code: "INTERNAL_ERROR" }, 500, req, config);
   }
diff --git a/src/codex/native-profile-manager.ts b/src/codex/native-profile-manager.ts
index bd9815e9b..4cdd451d1 100644
--- a/src/codex/native-profile-manager.ts
+++ b/src/codex/native-profile-manager.ts
@@ -38,6 +38,7 @@ import {
   requireFileCredentialStore,
   resolveNativeCredentialStoreMode,
   resolveNativeProfileContext,
+  serializeNativeProfileJournal,
   serializeNativeProfileMetadata,
   validateNativeProfileLabel,
   type NativeEnvelopeSnapshot,
@@ -216,7 +217,7 @@ export class NativeProfileManager {
   }
 
   private async writeJournal(journal: NativeProfileSwitchJournalV1): Promise<void> {
-    await this.atomicWrite(this.context.journalPath, serializeNativeProfileMetadata(journal));
+    await this.atomicWrite(this.context.journalPath, serializeNativeProfileJournal(journal));
   }
 
   private removeJournal(): void {
@@ -564,6 +565,7 @@ export class NativeProfileManager {
       let current: NativeEnvelopeSnapshot | null = null;
       let key: NativeProfileKey | null = null;
       let operationFailed = false;
+      let operationError: unknown;
       let importCommitted = false;
       let result: { effectiveCodexHome: string; profile: NativeProfilePublic } | undefined;
       try {
@@ -602,24 +604,47 @@ export class NativeProfileManager {
         result = { effectiveCodexHome: this.context.codexHome, profile: publicNativeProfile(profile) };
       } catch (error) {
         operationFailed = true;
-        throw error;
+        operationError = error;
       } finally {
         target?.raw.fill(0);
         current?.raw.fill(0);
         key?.key.fill(0);
-        try {
-          this.deleteStageById(stageId);
-        } catch {
-          if (!operationFailed) {
+      }
+      let cleanupFailed = false;
+      try {
+        this.deleteStageById(stageId);
+      } catch {
+        cleanupFailed = true;
+      }
+      if (operationFailed) {
+        if (cleanupFailed) {
+          if (operationError instanceof NativeProfileError) {
             throw new NativeProfileError(
-              "STAGING_CLEANUP_REQUIRED",
-              importCommitted
-                ? "The native profile was imported, but its staging session could not be securely removed. Do not retry the import; fix filesystem permissions and cancel it explicitly."
-                : "The native-login staging session could not be securely removed; fix filesystem permissions and cancel it explicitly.",
-              500,
+              operationError.code,
+              operationError.message,
+              operationError.status,
+              operationError.retryable,
+              true,
             );
           }
+          throw new NativeProfileError(
+            "INTERNAL_ERROR",
+            "The native profile import failed and its staging session could not be securely removed.",
+            500,
+            false,
+            true,
+          );
         }
+        throw operationError;
+      }
+      if (cleanupFailed) {
+        throw new NativeProfileError(
+          "STAGING_CLEANUP_REQUIRED",
+          importCommitted
+            ? "The native profile was imported, but its staging session could not be securely removed. Do not retry the import; fix filesystem permissions and cancel it explicitly."
+            : "The native-login staging session could not be securely removed; fix filesystem permissions and cancel it explicitly.",
+          500,
+        );
       }
       return result!;
     });
@@ -701,9 +726,9 @@ export class NativeProfileManager {
           createdAt: timestamp,
         };
         serializeNativeProfileMetadata(afterVault);
-        serializeNativeProfileMetadata({ ...journal, phase: "prepared" });
-        serializeNativeProfileMetadata({ ...journal, phase: "auth-replaced" });
-        serializeNativeProfileMetadata({ ...journal, phase: "vault-committed" });
+        serializeNativeProfileJournal({ ...journal, phase: "prepared" });
+        serializeNativeProfileJournal({ ...journal, phase: "auth-replaced" });
+        serializeNativeProfileJournal({ ...journal, phase: "vault-committed" });
         await this.writeJournal(journal);
         journalPrepared = true;
         await this.onSwitchBoundary("journal-prepared");
diff --git a/src/codex/native-profile-store.ts b/src/codex/native-profile-store.ts
index 3c41de7e4..527116ac7 100644
--- a/src/codex/native-profile-store.ts
+++ b/src/codex/native-profile-store.ts
@@ -28,6 +28,7 @@ const DOMAIN_IDENTITY = "opencodex-native-profile-identity-v1\0";
 const KEYRING_SERVICE = "opencodex.native-main-profile.v1";
 const MAX_AUTH_BYTES = 4 * 1024 * 1024;
 export const MAX_NATIVE_PROFILE_METADATA_BYTES = 4 * 1024 * 1024;
+export const MAX_NATIVE_PROFILE_JOURNAL_BYTES = 17 * 1024 * 1024;
 export const MAX_NATIVE_PROFILES = 32;
 const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 const HASH_RE = /^[0-9a-f]{64}$/;
@@ -395,7 +396,7 @@ export function inspectNativeProfileJournal(context: NativeProfileContext): Nati
   if (state === "unreadable") return { status: "invalid" };
   try {
     const journal = JSON.parse(
-      readBounded(context.journalPath, MAX_NATIVE_PROFILE_METADATA_BYTES).toString("utf8"),
+      readBounded(context.journalPath, MAX_NATIVE_PROFILE_JOURNAL_BYTES).toString("utf8"),
     ) as NativeProfileSwitchJournalV1;
     if (
       journal.version !== 1 || journal.homeId !== context.homeId || !UUID_RE.test(journal.transactionId)
@@ -435,6 +436,18 @@ export function serializeNativeProfileMetadata(value: unknown): string {
   return serialized;
 }
 
+export function serializeNativeProfileJournal(journal: NativeProfileSwitchJournalV1): string {
+  const serialized = JSON.stringify(journal) + "\n";
+  if (Buffer.byteLength(serialized, "utf8") > MAX_NATIVE_PROFILE_JOURNAL_BYTES) {
+    throw new NativeProfileError(
+      "PROFILE_METADATA_TOO_LARGE",
+      "The native-profile recovery journal exceeds the 17 MiB limit; no credential write was made.",
+      409,
+    );
+  }
+  return serialized;
+}
+
 const FORBIDDEN_PROFILE_LABEL_RE = /[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/u;
 
 function normalizedNativeProfileLabel(value: unknown): string | null {
diff --git a/src/codex/native-profile-types.ts b/src/codex/native-profile-types.ts
index 228b5cff3..69f98efb1 100644
--- a/src/codex/native-profile-types.ts
+++ b/src/codex/native-profile-types.ts
@@ -31,6 +31,7 @@ export class NativeProfileError extends Error {
     message: string,
     readonly status = 409,
     readonly retryable = false,
+    readonly cleanupRequired?: true,
   ) {
     super(message);
     this.name = "NativeProfileError";
diff --git a/tests/cli-native-profile.test.ts b/tests/cli-native-profile.test.ts
index e711836b3..92a8c642a 100644
--- a/tests/cli-native-profile.test.ts
+++ b/tests/cli-native-profile.test.ts
@@ -2,6 +2,7 @@ import { afterEach, describe, expect, test } from "bun:test";
 import { join } from "node:path";
 import { tmpdir } from "node:os";
 import { cmdAccount } from "../src/cli/account";
+import { apiError } from "../src/cli/account-api";
 import { nativeMainCodexLoginInvocation } from "../src/cli/account-main";
 
 const originalLog = console.log;
@@ -13,6 +14,21 @@ afterEach(() => {
 });
 
 describe("ocx account main", () => {
+  test("cleanup guidance requires a literal true signal", () => {
+    const errors: string[] = [];
+    console.error = (...values: unknown[]) => errors.push(values.join(" "));
+
+    expect(apiError({ error: "validation failed" }, "fallback")).toBe(1);
+    expect(apiError({ error: "validation failed", cleanupRequired: "true" }, "fallback")).toBe(1);
+    expect(errors).toEqual([
+      "Error: validation failed",
+      "Error: validation failed",
+    ]);
+
+    expect(apiError({ error: "validation failed", cleanupRequired: true }, "fallback")).toBe(1);
+    expect(errors.at(-1)).toBe("Warning: native-login staging cleanup is still required; run 'ocx account main doctor'.");
+  });
+
   test("official login resolves a Windows npm shim through ComSpec", () => {
     const npmBin = "C:\\Users\\tester\\AppData\\Roaming\\npm";
     const codexShim = `${npmBin}\\codex.cmd`;
@@ -89,13 +105,17 @@ describe("ocx account main", () => {
   test("add cancels server staging after a non-200 finish response", async () => {
     const stagingHome = join(tmpdir(), "ocx-native-profile-stage-non-200");
     const requests: string[] = [];
+    const errors: string[] = [];
+    console.error = (...values: unknown[]) => errors.push(values.join(" "));
     const fetchImpl: typeof fetch = async input => {
       const path = new URL(String(input)).pathname;
       requests.push(path);
       if (path.endsWith("/stage") && !path.endsWith("/finish")) {
         return Response.json({ stageId: "22222222-2222-4222-8222-222222222222", stagingCodexHome: stagingHome });
       }
-      if (path.endsWith("/stage/finish")) return Response.json({ error: "validation failed" }, { status: 409 });
+      if (path.endsWith("/stage/finish")) {
+        return Response.json({ error: "validation failed", code: "AUTH_INVALID", cleanupRequired: true }, { status: 409 });
+      }
       return Response.json({ ok: true });
     };
 
@@ -109,6 +129,8 @@ describe("ocx account main", () => {
       "/api/native-main-profiles/stage/finish",
       "/api/native-main-profiles/stage/cancel",
     ]);
+    expect(errors).toContain("Error: validation failed");
+    expect(errors).toContain("Warning: native-login staging cleanup is still required; run 'ocx account main doctor'.");
   });
 
   test("add cancels server staging when official login aborts", async () => {
diff --git a/tests/native-profile-api.test.ts b/tests/native-profile-api.test.ts
index e6314ddbf..89a2163ff 100644
--- a/tests/native-profile-api.test.ts
+++ b/tests/native-profile-api.test.ts
@@ -137,7 +137,32 @@ describe("native main profile management API", () => {
     const response = await handleNativeProfileAPI(request, new URL(request.url), {} as OcxConfig, { manager });
 
     expect(response?.status).toBe(409);
-    expect(await response?.json()).toMatchObject({ code: "RECOVERY_REQUIRED", error: message });
+    const payload = await response?.json() as Record<string, unknown>;
+    expect(payload).toMatchObject({ code: "RECOVERY_REQUIRED", error: message });
+    expect("cleanupRequired" in payload).toBe(false);
+  });
+
+  test("cleanup-required failures preserve the primary error and expose a true-only signal", async () => {
+    const message = "The staged native login is invalid.";
+    const manager = {
+      finishStage: async () => {
+        throw new NativeProfileError("AUTH_INVALID", message, 422, true, true);
+      },
+    } as unknown as NativeProfileManager;
+    const request = new Request("http://localhost/api/native-main-profiles/stage/finish", {
+      method: "POST",
+      body: JSON.stringify({ stageId: "11111111-1111-4111-8111-111111111111", label: "work" }),
+    });
+
+    const response = await handleNativeProfileAPI(request, new URL(request.url), {} as OcxConfig, { manager });
+
+    expect(response?.status).toBe(422);
+    expect(await response?.json()).toEqual({
+      error: message,
+      code: "AUTH_INVALID",
+      retryable: true,
+      cleanupRequired: true,
+    });
   });
 
   test("successful switch auto-recovery completes the matching startup gate before releasing its drain lease", async () => {
diff --git a/tests/native-profile-manager.test.ts b/tests/native-profile-manager.test.ts
index 9e6181d53..d0ac66c5f 100644
--- a/tests/native-profile-manager.test.ts
+++ b/tests/native-profile-manager.test.ts
@@ -216,6 +216,7 @@ describe("native main profile transactions", () => {
     let caught: unknown;
     try { await manager.finishStage(stage.stageId, "invalid"); } catch (error) { caught = error; }
     expect(caught).toBeInstanceOf(NativeProfileError);
+    expect((caught as NativeProfileError).cleanupRequired).toBeUndefined();
     expect(existsSync(stage.stagingCodexHome)).toBe(false);
   });
 
@@ -276,6 +277,7 @@ describe("native main profile transactions", () => {
     expect((caught as NativeProfileError).code).toBe("STAGING_CLEANUP_REQUIRED");
     expect((caught as NativeProfileError).message).toContain("was imported");
     expect((caught as NativeProfileError).message).toContain("Do not retry");
+    expect((caught as NativeProfileError).cleanupRequired).toBeUndefined();
     expect((await manager.list()).profiles.some(profile => profile.label === "work")).toBe(true);
     expect(existsSync(stage.stagingCodexHome)).toBe(true);
     await manager.cancelStage(stage.stageId);
@@ -295,6 +297,9 @@ describe("native main profile transactions", () => {
     try { await failing.finishStage(stage.stageId, "invalid"); } catch (error) { caught = error; }
     expect(caught).toBeInstanceOf(NativeProfileError);
     expect((caught as NativeProfileError).code).toBe("AUTH_INVALID");
+    expect((caught as NativeProfileError).status).toBe(409);
+    expect((caught as NativeProfileError).retryable).toBe(false);
+    expect((caught as NativeProfileError).cleanupRequired).toBe(true);
     expect(existsSync(stage.stagingCodexHome)).toBe(true);
     await manager.cancelStage(stage.stageId);
   });
@@ -376,26 +381,36 @@ describe("native main profile transactions", () => {
     expect(existsSync(overflow.stagingCodexHome)).toBe(false);
   }, 30_000);
 
-  test("rejects an oversized prospective journal before the first durable switch write", async () => {
+  test("switches with a journal larger than the metadata cap", async () => {
     const f = fixture();
     const manager = new NativeProfileManager(f.options);
-    const sourceProfile = await manager.register("personal");
+    await manager.register("personal");
     const stage = await manager.prepareStage();
     const large = JSON.parse(f.target) as Record<string, unknown>;
     large.padding = "x".repeat(Math.floor(MAX_NATIVE_PROFILE_METADATA_BYTES * 0.42));
     writeFileSync(join(stage.stagingCodexHome, "auth.json"), JSON.stringify(large, null, 2) + "\n");
-    await manager.finishStage(stage.stageId, "work");
-    const authBefore = readFileSync(manager.context.authPath, "utf8");
-    const vaultBefore = readFileSync(manager.context.vaultPath, "utf8");
+    const work = await manager.finishStage(stage.stageId, "work");
+    const switched = await manager.switch("work", true);
+    expect(readFileSync(manager.context.authPath, "utf8")).toBe(JSON.stringify(large, null, 2) + "\n");
+    expect((switched.activeProfile as { id: string }).id).toBe(work.profile.id);
+    expect((await manager.list()).activeProfileId).toBe(work.profile.id);
+    expect(existsSync(manager.context.journalPath)).toBe(false);
+    expect(f.transitions).toEqual(["account-source->account-target"]);
+  }, 30_000);
+
+  test("fails closed for an oversized on-disk journal without mutating auth or vault", async () => {
+    const f = await enrolledFixture();
+    const authBefore = readFileSync(f.manager.context.authPath, "utf8");
+    const vaultBefore = readFileSync(f.manager.context.vaultPath, "utf8");
+    writeFileSync(f.manager.context.journalPath, "x".repeat(17 * 1024 * 1024 + 1));
+
     let caught: unknown;
-    try { await manager.switch("work", true); } catch (error) { caught = error; }
+    try { await f.manager.switch("work", true); } catch (error) { caught = error; }
+
     expect(caught).toBeInstanceOf(NativeProfileError);
-    expect((caught as NativeProfileError).code).toBe("PROFILE_METADATA_TOO_LARGE");
-    expect(readFileSync(manager.context.authPath, "utf8")).toBe(authBefore);
-    expect(readFileSync(manager.context.vaultPath, "utf8")).toBe(vaultBefore);
-    expect(existsSync(manager.context.journalPath)).toBe(false);
-    expect((await manager.list()).activeProfileId).toBe(sourceProfile.profile.id);
-    expect(f.transitions).toEqual([]);
+    expect((caught as NativeProfileError).code).toBe("RECOVERY_REQUIRED");
+    expect(readFileSync(f.manager.context.authPath, "utf8")).toBe(authBefore);
+    expect(readFileSync(f.manager.context.vaultPath, "utf8")).toBe(vaultBefore);
   }, 30_000);
 
   test("quarantines malformed journals byte-for-byte and keeps ownership fail closed", async () => {
diff --git a/tests/native-profile-store.test.ts b/tests/native-profile-store.test.ts
new file mode 100644
index 000000000..330d0f80b
--- /dev/null
+++ b/tests/native-profile-store.test.ts
@@ -0,0 +1,151 @@
+import { afterEach, describe, expect, test } from "bun:test";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import {
+  inspectNativeProfileJournal,
+  MAX_NATIVE_PROFILE_JOURNAL_BYTES,
+  serializeNativeProfileJournal,
+  type NativeProfileContext,
+} from "../src/codex/native-profile-store";
+import {
+  NativeProfileError,
+  type EncryptedNativeEnvelopeV1,
+  type NativeMainProfileRecordV1,
+  type NativeMainProfileVaultV1,
+  type NativeProfileSwitchJournalV1,
+} from "../src/codex/native-profile-types";
+
+const roots: string[] = [];
+const HOME_ID = "a".repeat(64);
+const SOURCE_ID = "11111111-1111-4111-8111-111111111111";
+const TARGET_ID = "22222222-2222-4222-8222-222222222222";
+const TRANSACTION_ID = "33333333-3333-4333-8333-333333333333";
+const SOURCE_HASH = "b".repeat(64);
+const TARGET_HASH = "c".repeat(64);
+const CREATED_AT = "2026-08-02T00:00:00.000Z";
+
+afterEach(() => {
+  for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true });
+});
+
+function context(): NativeProfileContext {
+  const rootDir = mkdtempSync(join(tmpdir(), "ocx-native-profile-store-"));
+  roots.push(rootDir);
+  return {
+    codexHome: rootDir,
+    configDir: rootDir,
+    rootDir,
+    stagingRoot: join(rootDir, "staging"),
+    homeId: HOME_ID,
+    authPath: join(rootDir, "auth.json"),
+    vaultPath: join(rootDir, "profiles.vault.json"),
+    journalPath: join(rootDir, "profiles.journal.json"),
+    recoveryBlockPath: join(rootDir, "recovery-block.json"),
+    lockPath: join(rootDir, "profiles.lock.sqlite"),
+  };
+}
+
+function payload(identityHash: string): EncryptedNativeEnvelopeV1 {
+  return {
+    cipher: "aes-256-gcm",
+    keyRef: "test:key",
+    nonce: "AAECAwQFBgcICQoL",
+    ciphertext: "eA==",
+    tag: "AAECAwQFBgcICQoLDA0ODw==",
+    envelopeSha256: identityHash,
+  };
+}
+
+function profile(
+  id: string,
+  label: string,
+  identityHash: string,
+  state: "active" | "inactive",
+  encryptedPayload: EncryptedNativeEnvelopeV1 | null,
+): NativeMainProfileRecordV1 {
+  return {
+    id,
+    label,
+    identityHash,
+    identityHint: `account-${identityHash.slice(0, 8)}`,
+    state,
+    payload: encryptedPayload,
+    createdAt: CREATED_AT,
+    updatedAt: CREATED_AT,
+  };
+}
+
+function vault(active: "source" | "target"): NativeMainProfileVaultV1 {
+  const sourceIsActive = active === "source";
+  return {
+    version: 1,
+    revision: sourceIsActive ? 1 : 2,
+    homeId: HOME_ID,
+    activeProfileId: sourceIsActive ? SOURCE_ID : TARGET_ID,
+    profiles: [
+      profile(SOURCE_ID, "source", SOURCE_HASH, sourceIsActive ? "active" : "inactive", sourceIsActive ? null : payload(SOURCE_HASH)),
+      profile(TARGET_ID, "target", TARGET_HASH, sourceIsActive ? "inactive" : "active", sourceIsActive ? payload(TARGET_HASH) : null),
+    ],
+  };
+}
+
+function journal(): NativeProfileSwitchJournalV1 {
+  return {
+    version: 1,
+    transactionId: TRANSACTION_ID,
+    homeId: HOME_ID,
+    phase: "prepared",
+    sourceProfileId: SOURCE_ID,
+    sourceIdentityHash: SOURCE_HASH,
+    sourcePayload: payload(SOURCE_HASH),
+    targetProfileId: TARGET_ID,
+    targetIdentityHash: TARGET_HASH,
+    targetPayload: payload(TARGET_HASH),
+    beforeVault: vault("source"),
+    afterVault: vault("target"),
+    createdAt: CREATED_AT,
+  };
+}
+
+function journalAtExactLimit(): NativeProfileSwitchJournalV1 {
+  const value = journal();
+  const baseline = Buffer.byteLength(JSON.stringify(value) + "\n", "utf8");
+  const paddingBytes = MAX_NATIVE_PROFILE_JOURNAL_BYTES - baseline;
+  if (paddingBytes <= 0) throw new Error("journal fixture unexpectedly exceeds its target boundary");
+  value.sourcePayload.keyRef += "x".repeat(paddingBytes);
+  return value;
+}
+
+describe("native-profile recovery journal storage", () => {
+  test("accepts and reads a compact journal exactly at the 17 MiB boundary", () => {
+    const store = context();
+    const serialized = serializeNativeProfileJournal(journalAtExactLimit());
+
+    expect(Buffer.byteLength(serialized, "utf8")).toBe(MAX_NATIVE_PROFILE_JOURNAL_BYTES);
+    writeFileSync(store.journalPath, serialized);
+
+    const inspection = inspectNativeProfileJournal(store);
+    expect(inspection.status).toBe("valid");
+    if (inspection.status === "valid") {
+      expect(inspection.journal.transactionId).toBe(TRANSACTION_ID);
+      expect(inspection.journal.phase).toBe("prepared");
+    }
+  });
+
+  test("rejects a compact journal one byte over the 17 MiB boundary", () => {
+    const store = context();
+    const value = journalAtExactLimit();
+    value.sourcePayload.keyRef += "x";
+
+    let caught: unknown;
+    try { serializeNativeProfileJournal(value); } catch (error) { caught = error; }
+
+    expect(caught).toBeInstanceOf(NativeProfileError);
+    expect((caught as NativeProfileError).code).toBe("PROFILE_METADATA_TOO_LARGE");
+    const serialized = JSON.stringify(value) + "\n";
+    expect(Buffer.byteLength(serialized, "utf8")).toBe(MAX_NATIVE_PROFILE_JOURNAL_BYTES + 1);
+    writeFileSync(store.journalPath, serialized);
+    expect(inspectNativeProfileJournal(store)).toEqual({ status: "invalid" });
+  });
+});

From f63139d985bbd9b3d39f390e3c7cd91ca0b30e98 Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Sun, 2 Aug 2026 15:39:04 +0900
Subject: [PATCH 21/63] fix(server): cap restart cleanup orchestration

---
 src/server/management/system-restart.ts |  50 ++++++++++-
 tests/system-restart.test.ts            | 108 ++++++++++++++++++++++++
 2 files changed, 154 insertions(+), 4 deletions(-)

diff --git a/src/server/management/system-restart.ts b/src/server/management/system-restart.ts
index 079b5721f..6d815c1f3 100644
--- a/src/server/management/system-restart.ts
+++ b/src/server/management/system-restart.ts
@@ -48,6 +48,7 @@ export interface SystemRestartIo {
   markRecycling?: () => void;
   exitProcess?: (code: number) => void;
   schedule?: (fn: () => void | Promise<void>, ms: number) => void;
+  scheduleDeadline?: (fn: () => void, ms: number) => () => void;
   isDraining?: () => boolean;
   isShutdownDraining?: () => boolean;
   beginShutdownDrain?: () => boolean;
@@ -61,6 +62,38 @@ let restartIo: SystemRestartIo = {};
 /** Prevents double-scheduling in the 200ms window before drainAndShutdown sets draining. */
 let restartAccepted = false;
 
+type RestartDrainOutcome = "completed" | "rejected" | "deadline";
+
+function waitForRestartDrain(
+  drainPromise: Promise<void>,
+  deadlineMs: number,
+  now: () => number,
+  scheduleDeadline: NonNullable<SystemRestartIo["scheduleDeadline"]>,
+): Promise<RestartDrainOutcome> {
+  const remainingMs = Math.max(0, deadlineMs - now());
+  if (remainingMs === 0) {
+    // Observe any late rejection even though orchestration is already terminal.
+    void drainPromise.catch(() => {});
+    return Promise.resolve("deadline");
+  }
+  return new Promise<RestartDrainOutcome>((resolve) => {
+    let settled = false;
+    let cancelDeadline: (() => void) | undefined;
+    const finish = (outcome: RestartDrainOutcome) => {
+      if (settled) return;
+      settled = true;
+      cancelDeadline?.();
+      resolve(outcome);
+    };
+    cancelDeadline = scheduleDeadline(() => finish("deadline"), remainingMs);
+    if (settled) cancelDeadline();
+    void drainPromise.then(
+      () => finish("completed"),
+      () => finish("rejected"),
+    );
+  });
+}
+
 /** Test seam — reset between tests. */
 export function setSystemRestartIoForTests(io: SystemRestartIo = {}): void {
   restartIo = io;
@@ -156,9 +189,19 @@ export function acceptSystemRestart(io: SystemRestartIo = restartIo): {
     schedule(async () => {
       const drain = io.drainAndShutdown ?? drainAndShutdown;
       const remainingMs = Math.max(0, restartDeadlineMs - now());
-      try {
-        await drain(undefined, remainingMs);
-      } catch {
+      const drainPromise = Promise.resolve().then(() => drain(undefined, remainingMs));
+      const scheduleDeadline = io.scheduleDeadline ?? ((fn, ms) => {
+        const timer = setTimeout(fn, ms);
+        return () => clearTimeout(timer);
+      });
+      const drainOutcome = await waitForRestartDrain(drainPromise, restartDeadlineMs, now, scheduleDeadline);
+      const exitProcess = io.exitProcess ?? ((code: number) => { process.exit(code); });
+      if (drainOutcome === "deadline") {
+        console.warn("Drain-and-restart deadline expired; forcing terminal exit");
+        exitProcess(1);
+        return;
+      }
+      if (drainOutcome === "rejected") {
         // drainAndShutdown stops the listener in finally. Even if ancillary cleanup
         // rejects, an accepted restart must still reach replacement or terminal exit.
         console.warn("Drain-and-restart cleanup failed; continuing terminal restart handoff");
@@ -170,7 +213,6 @@ export function acceptSystemRestart(io: SystemRestartIo = restartIo): {
         return;
       }
       const port = (io.listenPort ?? resolveListenPort)();
-      const exitProcess = io.exitProcess ?? ((code: number) => { process.exit(code); });
       try {
         await (io.spawnStart ?? spawnDetachedStart)(port);
       } catch (err) {
diff --git a/tests/system-restart.test.ts b/tests/system-restart.test.ts
index 42e7be9b4..72380ee6c 100644
--- a/tests/system-restart.test.ts
+++ b/tests/system-restart.test.ts
@@ -35,6 +35,9 @@ describe("acceptSystemRestart", () => {
   test("uses the remaining absolute restart budget, spawns start, marks recycle, then exits 0", async () => {
     const calls: string[] = [];
     let scheduled: (() => void | Promise<void>) | null = null;
+    let deadlineCallback: (() => void) | null = null;
+    let deadlineDelay = -1;
+    let deadlineCancellations = 0;
     let now = 10_000;
 
     const result = acceptSystemRestart({
@@ -43,6 +46,11 @@ describe("acceptSystemRestart", () => {
       isSupervisedServiceChild: () => false,
       listenPort: () => 10123,
       schedule: (fn) => { scheduled = fn; },
+      scheduleDeadline: (fn, ms) => {
+        deadlineCallback = fn;
+        deadlineDelay = ms;
+        return () => { deadlineCancellations += 1; };
+      },
       now: () => now,
       setDraining: (value) => { calls.push(`draining:${value}`); },
       drainAndShutdown: async (_server, timeoutMs) => {
@@ -66,6 +74,106 @@ describe("acceptSystemRestart", () => {
     now += 15_000;
     await scheduled!();
     expect(calls).toEqual(["draining:true", "drain:45000", "start:10123", "recycle", "exit:0"]);
+    expect(deadlineDelay).toBe(45_000);
+    expect(deadlineCancellations).toBe(1);
+    deadlineCallback?.();
+    expect(calls).toEqual(["draining:true", "drain:45000", "start:10123", "recycle", "exit:0"]);
+  });
+
+  test("never-settling drain reaches one terminal exit at the original deadline", async () => {
+    const calls: string[] = [];
+    let scheduled: (() => void | Promise<void>) | null = null;
+    let fireDeadline: (() => void) | null = null;
+    let now = 1_000;
+
+    acceptSystemRestart({
+      isDraining: () => false,
+      getActiveTurnCount: () => 1,
+      schedule: (fn) => { scheduled = fn; },
+      scheduleDeadline: (fn, ms) => {
+        expect(ms).toBe(60_000);
+        fireDeadline = fn;
+        return () => {};
+      },
+      now: () => now,
+      setDraining: () => { calls.push("latched"); },
+      drainAndShutdown: () => {
+        calls.push("drain");
+        return new Promise<void>(() => {});
+      },
+      spawnStart: () => { calls.push("start"); },
+      exitProcess: (code) => { calls.push(`exit:${code}`); },
+    });
+
+    const running = scheduled!();
+    await Promise.resolve();
+    await Promise.resolve();
+    expect(calls).toEqual(["latched", "drain"]);
+    now += 60_000;
+    fireDeadline?.();
+    await running;
+    expect(calls).toEqual(["latched", "drain", "exit:1"]);
+  });
+
+  test("exactly elapsed deadline exits without waiting for late drain resolution", async () => {
+    const calls: string[] = [];
+    let scheduled: (() => void | Promise<void>) | null = null;
+    let resolveDrain!: () => void;
+    let now = 5_000;
+
+    acceptSystemRestart({
+      isDraining: () => false,
+      getActiveTurnCount: () => 0,
+      schedule: (fn) => { scheduled = fn; },
+      scheduleDeadline: () => { throw new Error("exact deadline must not schedule another timer"); },
+      now: () => now,
+      setDraining: () => { calls.push("latched"); },
+      drainAndShutdown: (_server, timeoutMs) => {
+        calls.push(`drain:${timeoutMs}`);
+        return new Promise<void>(resolve => { resolveDrain = resolve; });
+      },
+      spawnStart: () => { calls.push("start"); },
+      exitProcess: (code) => { calls.push(`exit:${code}`); },
+    });
+
+    now += MEMORY_DRAIN_RESTART_MS;
+    await scheduled!();
+    expect(calls).toEqual(["latched", "drain:0", "exit:1"]);
+    resolveDrain();
+    await Promise.resolve();
+    expect(calls).toEqual(["latched", "drain:0", "exit:1"]);
+  });
+
+  test("late drain rejection after timeout is observed without a second terminal action", async () => {
+    const calls: string[] = [];
+    let scheduled: (() => void | Promise<void>) | null = null;
+    let fireDeadline: (() => void) | null = null;
+    let rejectDrain!: (reason?: unknown) => void;
+
+    acceptSystemRestart({
+      isDraining: () => false,
+      getActiveTurnCount: () => 1,
+      schedule: (fn) => { scheduled = fn; },
+      scheduleDeadline: (fn) => { fireDeadline = fn; return () => {}; },
+      setDraining: () => { calls.push("latched"); },
+      drainAndShutdown: () => {
+        calls.push("drain");
+        return new Promise<void>((_resolve, reject) => { rejectDrain = reject; });
+      },
+      spawnStart: () => { calls.push("start"); },
+      exitProcess: (code) => { calls.push(`exit:${code}`); },
+    });
+
+    const running = scheduled!();
+    await Promise.resolve();
+    await Promise.resolve();
+    fireDeadline?.();
+    await running;
+    expect(calls).toEqual(["latched", "drain", "exit:1"]);
+    rejectDrain(new Error("late fixture rejection"));
+    await Promise.resolve();
+    await Promise.resolve();
+    expect(calls).toEqual(["latched", "drain", "exit:1"]);
   });
 
   test("supervised service child exits 1 so failure-only supervisors respawn", async () => {

From 50e0d3e67fb34a6a27e3a10bd11f2c9a20a685fe Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Sun, 2 Aug 2026 15:55:50 +0900
Subject: [PATCH 22/63] fix(codex): close profile bounded-read races

---
 src/codex/native-profile-store.ts    | 85 ++++++++++++++++++++++++---
 tests/native-profile-manager.test.ts | 42 ++++++++++++-
 tests/native-profile-store.test.ts   | 88 +++++++++++++++++++++++++++-
 3 files changed, 202 insertions(+), 13 deletions(-)

diff --git a/src/codex/native-profile-store.ts b/src/codex/native-profile-store.ts
index 527116ac7..b4e412a3e 100644
--- a/src/codex/native-profile-store.ts
+++ b/src/codex/native-profile-store.ts
@@ -6,7 +6,17 @@ import {
   randomBytes,
   timingSafeEqual,
 } from "node:crypto";
-import { existsSync, lstatSync, readFileSync, realpathSync, statSync } from "node:fs";
+import {
+  closeSync,
+  constants as fsConstants,
+  existsSync,
+  fstatSync,
+  lstatSync,
+  openSync,
+  readSync,
+  realpathSync,
+  statSync,
+} from "node:fs";
 import { join, resolve } from "node:path";
 import { getConfigDir } from "../config";
 import { extractAccountId } from "../oauth/chatgpt";
@@ -32,6 +42,7 @@ export const MAX_NATIVE_PROFILE_JOURNAL_BYTES = 17 * 1024 * 1024;
 export const MAX_NATIVE_PROFILES = 32;
 const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 const HASH_RE = /^[0-9a-f]{64}$/;
+const BOUNDED_READ_TEST_SEAM = Symbol.for("opencodex.native-profile-store.bounded-read-test-seam");
 
 export interface NativeProfileContext {
   codexHome: string;
@@ -46,6 +57,16 @@ export interface NativeProfileContext {
   lockPath: string;
 }
 
+interface BoundedReadTestSeam {
+  afterValidatedOpen?: (path: string, fd: number) => void;
+  onBufferAllocated?: (byteLength: number) => void;
+  onRead?: (requestedBytes: number, bytesRead: number, totalBytesRead: number) => void;
+}
+
+function boundedReadTestSeam(context: NativeProfileContext): BoundedReadTestSeam | undefined {
+  return (context as NativeProfileContext & { [BOUNDED_READ_TEST_SEAM]?: BoundedReadTestSeam })[BOUNDED_READ_TEST_SEAM];
+}
+
 export interface NativeEnvelopeSnapshot {
   raw: Buffer;
   text: string;
@@ -152,10 +173,52 @@ export function resolveNativeProfileContext(options: { codexHome?: string; confi
   };
 }
 
-function readBounded(path: string, limit: number): Buffer {
-  const stat = statSync(path);
-  if (!stat.isFile() || stat.size > limit) throw new Error("invalid bounded file");
-  return readFileSync(path);
+function readBounded(path: string, limit: number, testSeam?: BoundedReadTestSeam): Buffer {
+  let fd: number | undefined;
+  let failed = false;
+  try {
+    const flags = process.platform === "win32"
+      ? fsConstants.O_RDONLY
+      : fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW;
+    fd = openSync(path, flags);
+    const opened = fstatSync(fd, { bigint: true });
+    if (!opened.isFile() || opened.size > BigInt(limit)) throw new Error("invalid bounded file");
+
+    if (process.platform === "win32") {
+      const pathEntry = lstatSync(path, { bigint: true });
+      if (
+        !pathEntry.isFile()
+        || pathEntry.isSymbolicLink()
+        || pathEntry.dev !== opened.dev
+        || pathEntry.ino !== opened.ino
+      ) throw new Error("invalid bounded file");
+    }
+
+    testSeam?.afterValidatedOpen?.(path, fd);
+    const buffer = Buffer.allocUnsafe(limit + 1);
+    testSeam?.onBufferAllocated?.(buffer.byteLength);
+    let totalBytesRead = 0;
+    while (totalBytesRead < buffer.byteLength) {
+      const requestedBytes = buffer.byteLength - totalBytesRead;
+      const bytesRead = readSync(fd, buffer, totalBytesRead, requestedBytes, totalBytesRead);
+      totalBytesRead += bytesRead;
+      testSeam?.onRead?.(requestedBytes, bytesRead, totalBytesRead);
+      if (bytesRead === 0) break;
+    }
+    if (totalBytesRead > limit) throw new Error("invalid bounded file");
+    return buffer.subarray(0, totalBytesRead);
+  } catch (error) {
+    failed = true;
+    throw error;
+  } finally {
+    if (fd !== undefined) {
+      try {
+        closeSync(fd);
+      } catch (error) {
+        if (!failed) throw error;
+      }
+    }
+  }
 }
 
 export function resolveNativeCredentialStoreMode(context: NativeProfileContext): string {
@@ -355,7 +418,11 @@ export function readNativeProfileVault(context: NativeProfileContext): NativeMai
   if (!existsSync(context.vaultPath)) return null;
   try {
     return parseVaultObject(
-      JSON.parse(readBounded(context.vaultPath, MAX_NATIVE_PROFILE_METADATA_BYTES).toString("utf8")),
+      JSON.parse(readBounded(
+        context.vaultPath,
+        MAX_NATIVE_PROFILE_METADATA_BYTES,
+        boundedReadTestSeam(context),
+      ).toString("utf8")),
       context.homeId,
     );
   } catch {
@@ -396,7 +463,11 @@ export function inspectNativeProfileJournal(context: NativeProfileContext): Nati
   if (state === "unreadable") return { status: "invalid" };
   try {
     const journal = JSON.parse(
-      readBounded(context.journalPath, MAX_NATIVE_PROFILE_JOURNAL_BYTES).toString("utf8"),
+      readBounded(
+        context.journalPath,
+        MAX_NATIVE_PROFILE_JOURNAL_BYTES,
+        boundedReadTestSeam(context),
+      ).toString("utf8"),
     ) as NativeProfileSwitchJournalV1;
     if (
       journal.version !== 1 || journal.homeId !== context.homeId || !UUID_RE.test(journal.transactionId)
diff --git a/tests/native-profile-manager.test.ts b/tests/native-profile-manager.test.ts
index d0ac66c5f..e2dafde3c 100644
--- a/tests/native-profile-manager.test.ts
+++ b/tests/native-profile-manager.test.ts
@@ -5,6 +5,7 @@ import { dirname, join } from "node:path";
 import { NativeProfileManager } from "../src/codex/native-profile-manager";
 import {
   decryptNativeEnvelope,
+  MAX_NATIVE_PROFILE_JOURNAL_BYTES,
   MAX_NATIVE_PROFILE_METADATA_BYTES,
   probeNativeProfileRecoveryState,
   readNativeProfileVault,
@@ -388,21 +389,56 @@ describe("native main profile transactions", () => {
     const stage = await manager.prepareStage();
     const large = JSON.parse(f.target) as Record<string, unknown>;
     large.padding = "x".repeat(Math.floor(MAX_NATIVE_PROFILE_METADATA_BYTES * 0.42));
-    writeFileSync(join(stage.stagingCodexHome, "auth.json"), JSON.stringify(large, null, 2) + "\n");
+    const largeTarget = JSON.stringify(large, null, 2) + "\n";
+    writeFileSync(join(stage.stagingCodexHome, "auth.json"), largeTarget);
     const work = await manager.finishStage(stage.stageId, "work");
     const switched = await manager.switch("work", true);
-    expect(readFileSync(manager.context.authPath, "utf8")).toBe(JSON.stringify(large, null, 2) + "\n");
+    expect(readFileSync(manager.context.authPath, "utf8")).toBe(largeTarget);
     expect((switched.activeProfile as { id: string }).id).toBe(work.profile.id);
     expect((await manager.list()).activeProfileId).toBe(work.profile.id);
     expect(existsSync(manager.context.journalPath)).toBe(false);
     expect(f.transitions).toEqual(["account-source->account-target"]);
+
+    await manager.switch("personal", true);
+    const authPath = manager.context.authPath;
+    const journalPath = manager.context.journalPath;
+    let authWrites = 0;
+    const interrupted = new NativeProfileManager({
+      ...f.options,
+      atomicWrite: async (path, content) => {
+        if (path === authPath && authWrites++ > 0) throw new Error("injected restore failure");
+        if (path === journalPath && hasJournalPhase(content, "auth-replaced")) {
+          throw new Error("injected post-replacement failure");
+        }
+        return atomic(path, content);
+      },
+    });
+    let interruptedError: unknown;
+    try { await interrupted.switch("work", true); } catch (error) { interruptedError = error; }
+    expect(interruptedError).toBeInstanceOf(NativeProfileError);
+    expect((interruptedError as NativeProfileError).code).toBe("AUTH_RESTORE_FAILED");
+    const persistedJournal = readFileSync(journalPath, "utf8");
+    expect(Buffer.byteLength(persistedJournal)).toBeGreaterThan(MAX_NATIVE_PROFILE_METADATA_BYTES);
+    expect(Buffer.byteLength(persistedJournal)).toBeLessThanOrEqual(MAX_NATIVE_PROFILE_JOURNAL_BYTES);
+    expect(readFileSync(authPath, "utf8")).toBe(largeTarget);
+    const vaultBeforeRecovery = readFileSync(manager.context.vaultPath, "utf8");
+
+    expect(await manager.recover(false)).toMatchObject({
+      recovered: true,
+      action: "commit-target",
+      externallyRefreshed: false,
+    });
+    expect(readFileSync(authPath, "utf8")).toBe(largeTarget);
+    expect(readFileSync(manager.context.vaultPath, "utf8")).not.toBe(vaultBeforeRecovery);
+    expect((await manager.list()).activeProfileId).toBe(work.profile.id);
+    expect(existsSync(journalPath)).toBe(false);
   }, 30_000);
 
   test("fails closed for an oversized on-disk journal without mutating auth or vault", async () => {
     const f = await enrolledFixture();
     const authBefore = readFileSync(f.manager.context.authPath, "utf8");
     const vaultBefore = readFileSync(f.manager.context.vaultPath, "utf8");
-    writeFileSync(f.manager.context.journalPath, "x".repeat(17 * 1024 * 1024 + 1));
+    writeFileSync(f.manager.context.journalPath, "x".repeat(MAX_NATIVE_PROFILE_JOURNAL_BYTES + 1));
 
     let caught: unknown;
     try { await f.manager.switch("work", true); } catch (error) { caught = error; }
diff --git a/tests/native-profile-store.test.ts b/tests/native-profile-store.test.ts
index 330d0f80b..9f6f98274 100644
--- a/tests/native-profile-store.test.ts
+++ b/tests/native-profile-store.test.ts
@@ -1,10 +1,12 @@
 import { afterEach, describe, expect, test } from "bun:test";
-import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { appendFileSync, mkdtempSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import {
   inspectNativeProfileJournal,
   MAX_NATIVE_PROFILE_JOURNAL_BYTES,
+  MAX_NATIVE_PROFILE_METADATA_BYTES,
+  readNativeProfileVault,
   serializeNativeProfileJournal,
   type NativeProfileContext,
 } from "../src/codex/native-profile-store";
@@ -24,6 +26,14 @@ const TRANSACTION_ID = "33333333-3333-4333-8333-333333333333";
 const SOURCE_HASH = "b".repeat(64);
 const TARGET_HASH = "c".repeat(64);
 const CREATED_AT = "2026-08-02T00:00:00.000Z";
+const REPLACEMENT_TRANSACTION_ID = "44444444-4444-4444-8444-444444444444";
+const BOUNDED_READ_TEST_SEAM = Symbol.for("opencodex.native-profile-store.bounded-read-test-seam");
+
+interface BoundedReadTestSeam {
+  afterValidatedOpen?: (path: string, fd: number) => void;
+  onBufferAllocated?: (byteLength: number) => void;
+  onRead?: (requestedBytes: number, bytesRead: number, totalBytesRead: number) => void;
+}
 
 afterEach(() => {
   for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true });
@@ -46,6 +56,10 @@ function context(): NativeProfileContext {
   };
 }
 
+function installBoundedReadTestSeam(store: NativeProfileContext, seam: BoundedReadTestSeam): void {
+  (store as NativeProfileContext & { [key: symbol]: unknown })[BOUNDED_READ_TEST_SEAM] = seam;
+}
+
 function payload(identityHash: string): EncryptedNativeEnvelopeV1 {
   return {
     cipher: "aes-256-gcm",
@@ -90,10 +104,10 @@ function vault(active: "source" | "target"): NativeMainProfileVaultV1 {
   };
 }
 
-function journal(): NativeProfileSwitchJournalV1 {
+function journal(transactionId = TRANSACTION_ID): NativeProfileSwitchJournalV1 {
   return {
     version: 1,
-    transactionId: TRANSACTION_ID,
+    transactionId,
     homeId: HOME_ID,
     phase: "prepared",
     sourceProfileId: SOURCE_ID,
@@ -121,6 +135,12 @@ describe("native-profile recovery journal storage", () => {
   test("accepts and reads a compact journal exactly at the 17 MiB boundary", () => {
     const store = context();
     const serialized = serializeNativeProfileJournal(journalAtExactLimit());
+    const allocations: number[] = [];
+    let totalBytesRead = 0;
+    installBoundedReadTestSeam(store, {
+      onBufferAllocated: byteLength => allocations.push(byteLength),
+      onRead: (_requestedBytes, _bytesRead, total) => { totalBytesRead = total; },
+    });
 
     expect(Buffer.byteLength(serialized, "utf8")).toBe(MAX_NATIVE_PROFILE_JOURNAL_BYTES);
     writeFileSync(store.journalPath, serialized);
@@ -131,6 +151,8 @@ describe("native-profile recovery journal storage", () => {
       expect(inspection.journal.transactionId).toBe(TRANSACTION_ID);
       expect(inspection.journal.phase).toBe("prepared");
     }
+    expect(allocations).toEqual([MAX_NATIVE_PROFILE_JOURNAL_BYTES + 1]);
+    expect(totalBytesRead).toBe(MAX_NATIVE_PROFILE_JOURNAL_BYTES);
   });
 
   test("rejects a compact journal one byte over the 17 MiB boundary", () => {
@@ -148,4 +170,64 @@ describe("native-profile recovery journal storage", () => {
     writeFileSync(store.journalPath, serialized);
     expect(inspectNativeProfileJournal(store)).toEqual({ status: "invalid" });
   });
+
+  test("reads the opened descriptor when the journal path is replaced after validation", () => {
+    const store = context();
+    writeFileSync(store.journalPath, serializeNativeProfileJournal(journal()));
+    installBoundedReadTestSeam(store, {
+      afterValidatedOpen: path => {
+        renameSync(path, path + ".opened");
+        writeFileSync(path, serializeNativeProfileJournal(journal(REPLACEMENT_TRANSACTION_ID)));
+      },
+    });
+
+    const inspection = inspectNativeProfileJournal(store);
+
+    expect(inspection.status).toBe("valid");
+    if (inspection.status === "valid") {
+      expect(inspection.journal.transactionId).toBe(TRANSACTION_ID);
+    }
+  });
+
+  test("reads at most vault cap plus one when the opened vault grows after fstat", () => {
+    const store = context();
+    const initial = JSON.stringify(vault("source")) + "\n";
+    writeFileSync(store.vaultPath, initial);
+    const allocations: number[] = [];
+    let totalBytesRead = 0;
+    installBoundedReadTestSeam(store, {
+      afterValidatedOpen: path => {
+        appendFileSync(path, Buffer.alloc(MAX_NATIVE_PROFILE_METADATA_BYTES + 2 - Buffer.byteLength(initial), 0x20));
+      },
+      onBufferAllocated: byteLength => allocations.push(byteLength),
+      onRead: (_requestedBytes, _bytesRead, total) => { totalBytesRead = total; },
+    });
+
+    let caught: unknown;
+    try { readNativeProfileVault(store); } catch (error) { caught = error; }
+
+    expect(caught).toBeInstanceOf(NativeProfileError);
+    expect((caught as NativeProfileError).code).toBe("VAULT_INVALID");
+    expect(allocations).toEqual([MAX_NATIVE_PROFILE_METADATA_BYTES + 1]);
+    expect(totalBytesRead).toBe(MAX_NATIVE_PROFILE_METADATA_BYTES + 1);
+  });
+
+  test("reads at most journal cap plus one when the opened journal grows after fstat", () => {
+    const store = context();
+    const initial = serializeNativeProfileJournal(journal());
+    writeFileSync(store.journalPath, initial);
+    const allocations: number[] = [];
+    let totalBytesRead = 0;
+    installBoundedReadTestSeam(store, {
+      afterValidatedOpen: path => {
+        appendFileSync(path, Buffer.alloc(MAX_NATIVE_PROFILE_JOURNAL_BYTES + 2 - Buffer.byteLength(initial), 0x20));
+      },
+      onBufferAllocated: byteLength => allocations.push(byteLength),
+      onRead: (_requestedBytes, _bytesRead, total) => { totalBytesRead = total; },
+    });
+
+    expect(inspectNativeProfileJournal(store)).toEqual({ status: "invalid" });
+    expect(allocations).toEqual([MAX_NATIVE_PROFILE_JOURNAL_BYTES + 1]);
+    expect(totalBytesRead).toBe(MAX_NATIVE_PROFILE_JOURNAL_BYTES + 1);
+  });
 });

From 766071c5ec05e61548723e824b6678864a510a3f Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Sun, 2 Aug 2026 16:03:20 +0900
Subject: [PATCH 23/63] fix(codex): reconcile stale recovery gate

---
 src/codex/native-profile-api.ts      |  4 ++-
 tests/native-profile-startup.test.ts | 39 ++++++++++++++++++++++++++++
 2 files changed, 42 insertions(+), 1 deletion(-)

diff --git a/src/codex/native-profile-api.ts b/src/codex/native-profile-api.ts
index 34a7f8931..0ae9fffc7 100644
--- a/src/codex/native-profile-api.ts
+++ b/src/codex/native-profile-api.ts
@@ -49,6 +49,7 @@ async function withRecoveryGateTransition<T>(
   manager: NativeProfileManager,
   deps: NativeProfileApiDeps,
   operation: () => Promise<T>,
+  completeIfAlreadyClearAfterSuccess = false,
 ): Promise<T> {
   const context = manager.context;
   if (!context) return operation();
@@ -61,7 +62,7 @@ async function withRecoveryGateTransition<T>(
     operationFailed = true;
     throw error;
   } finally {
-    if (before !== "none") {
+    if (before !== "none" || (completeIfAlreadyClearAfterSuccess && !operationFailed)) {
       try {
         const after = probe(context);
         if (after === "none") {
@@ -133,6 +134,7 @@ export async function handleNativeProfileAPI(
         manager,
         deps,
         () => manager.recover(input.rollback === true, input.confirmedStopped === true),
+        true,
       ));
       return jsonResponse(recovered, 200, req, config);
     }
diff --git a/tests/native-profile-startup.test.ts b/tests/native-profile-startup.test.ts
index 95884ebea..ce972e6ca 100644
--- a/tests/native-profile-startup.test.ts
+++ b/tests/native-profile-startup.test.ts
@@ -349,6 +349,45 @@ describe("native-main startup journal gate", () => {
     expect(isNativeMainTrafficBlocked()).toBe(true);
   });
 
+  test("explicit recovery reopens a stale matching gate after another manager converges the shared home", async () => {
+    const f = await fixture("prepared", "source-exact");
+    await initializeNativeMainStartupGate({
+      manager: f.manager,
+      probeRecoveryState: () => "manual",
+    });
+    expect(nativeMainStartupGateSnapshot()).toMatchObject({
+      status: "blocked",
+      homeId: f.manager.context.homeId,
+    });
+
+    const otherManager = new NativeProfileManager({
+      codexHome: f.codexHome,
+      configDir: f.configDir,
+      keyProvider: new MemoryKeyProvider(f.key),
+      hardenPath: async () => {},
+      processProbe: async () => ({ status: "clear", count: 0 }),
+    });
+    expect(await otherManager.recover(false)).toMatchObject({ recovered: true });
+    expect(probeNativeProfileRecoveryState(f.manager.context)).toBe("none");
+    expect(isNativeMainTrafficBlocked()).toBe(true);
+
+    const request = new Request("http://localhost/api/native-main-profiles/recover", {
+      method: "POST",
+      body: JSON.stringify({ rollback: false }),
+    });
+    const response = await handleNativeProfileAPI(request, new URL(request.url), {} as OcxConfig, {
+      manager: f.manager,
+    });
+
+    expect(response?.status).toBe(200);
+    expect(await response?.json()).toMatchObject({ recovered: false });
+    expect(nativeMainStartupGateSnapshot()).toMatchObject({
+      status: "ready",
+      homeId: f.manager.context.homeId,
+    });
+    expect(isNativeMainTrafficBlocked()).toBe(false);
+  });
+
   test("fresh processes gate first admission and converge every recoverable phase/observation", async () => {
     for (const scenario of recoverable) {
       const f = await fixture(scenario.phase, scenario.observation);

From 7a9a17e92a0328304d11f06ac80a1df8d00dc0dd Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Sun, 2 Aug 2026 16:24:43 +0900
Subject: [PATCH 24/63] fix(codex): preflight profile switch layouts

---
 src/codex/native-profile-manager.ts  | 30 +++++++++--
 tests/native-profile-manager.test.ts | 79 ++++++++++++++++++++++++++++
 2 files changed, 106 insertions(+), 3 deletions(-)

diff --git a/src/codex/native-profile-manager.ts b/src/codex/native-profile-manager.ts
index 4cdd451d1..9501943f4 100644
--- a/src/codex/native-profile-manager.ts
+++ b/src/codex/native-profile-manager.ts
@@ -587,6 +587,14 @@ export class NativeProfileManager {
         }
         const timestamp = new Date(this.now()).toISOString();
         const id = this.uuid();
+        const currentProfile = this.currentProfile(vault);
+        const currentSourcePayload = encryptNativeEnvelope(
+          this.context,
+          currentProfile.id,
+          currentProfile.identityHash,
+          current,
+          key,
+        );
         const profile: NativeMainProfileRecordV1 = {
           id,
           label,
@@ -597,9 +605,25 @@ export class NativeProfileManager {
           createdAt: timestamp,
           updatedAt: timestamp,
         };
-        vault.profiles.push(profile);
-        vault.revision += 1;
-        await this.writeVault(vault);
+        const prospectiveVault = structuredClone(vault);
+        prospectiveVault.profiles.push(profile);
+        prospectiveVault.revision += 1;
+        const currentActivePreflight = structuredClone(prospectiveVault);
+        currentActivePreflight.revision = Number.MAX_SAFE_INTEGER;
+        serializeNativeProfileMetadata(currentActivePreflight);
+        for (const inactiveProfile of prospectiveVault.profiles.filter(item => item.state === "inactive")) {
+          const activePlacement = structuredClone(prospectiveVault);
+          activePlacement.revision = Number.MAX_SAFE_INTEGER;
+          const nextCurrent = activePlacement.profiles.find(item => item.id === currentProfile.id)!;
+          const nextActive = activePlacement.profiles.find(item => item.id === inactiveProfile.id)!;
+          nextCurrent.state = "inactive";
+          nextCurrent.payload = currentSourcePayload;
+          nextActive.state = "active";
+          nextActive.payload = null;
+          activePlacement.activeProfileId = nextActive.id;
+          serializeNativeProfileMetadata(activePlacement);
+        }
+        await this.writeVault(prospectiveVault);
         importCommitted = true;
         result = { effectiveCodexHome: this.context.codexHome, profile: publicNativeProfile(profile) };
       } catch (error) {
diff --git a/tests/native-profile-manager.test.ts b/tests/native-profile-manager.test.ts
index e2dafde3c..3cec8c4d2 100644
--- a/tests/native-profile-manager.test.ts
+++ b/tests/native-profile-manager.test.ts
@@ -241,6 +241,85 @@ describe("native main profile transactions", () => {
     expect(existsSync(stage.stagingCodexHome)).toBe(false);
   });
 
+  test("finish rejects a near-cap current source before importing an unusable target", async () => {
+    const f = fixture();
+    const largeSource = JSON.parse(f.source) as Record<string, unknown>;
+    largeSource.padding = "x".repeat(Math.floor(MAX_NATIVE_PROFILE_METADATA_BYTES * 0.85));
+    const sourceText = JSON.stringify(largeSource, null, 2) + "\n";
+    writeFileSync(join(f.codexHome, "auth.json"), sourceText);
+    let authWrites = 0;
+    let vaultWrites = 0;
+    let vaultPath: string | undefined;
+    const manager = new NativeProfileManager({
+      ...f.options,
+      atomicWrite: async (path, content) => {
+        if (path === join(f.codexHome, "auth.json")) authWrites += 1;
+        if (path === vaultPath) vaultWrites += 1;
+        return atomic(path, content);
+      },
+    });
+    vaultPath = manager.context.vaultPath;
+    const registered = await manager.register("personal");
+    const vaultBefore = readFileSync(manager.context.vaultPath, "utf8");
+    const parsedVaultBefore = readNativeProfileVault(manager.context)!;
+    authWrites = 0;
+    vaultWrites = 0;
+    const stage = await manager.prepareStage();
+    writeFileSync(join(stage.stagingCodexHome, "auth.json"), f.target);
+
+    let caught: unknown;
+    try { await manager.finishStage(stage.stageId, "work"); } catch (error) { caught = error; }
+
+    expect(caught).toBeInstanceOf(NativeProfileError);
+    expect((caught as NativeProfileError).code).toBe("PROFILE_METADATA_TOO_LARGE");
+    expect(authWrites).toBe(0);
+    expect(vaultWrites).toBe(0);
+    expect(readFileSync(manager.context.authPath, "utf8")).toBe(sourceText);
+    expect(readFileSync(manager.context.vaultPath, "utf8")).toBe(vaultBefore);
+    const parsedVaultAfter = readNativeProfileVault(manager.context)!;
+    expect(parsedVaultAfter.revision).toBe(parsedVaultBefore.revision);
+    expect(parsedVaultAfter.activeProfileId).toBe(parsedVaultBefore.activeProfileId);
+    expect(parsedVaultAfter.profiles.map(profile => profile.id)).toEqual(parsedVaultBefore.profiles.map(profile => profile.id));
+    expect((await manager.list())).toMatchObject({
+      activeProfileId: registered.profile.id,
+      profiles: [{ id: registered.profile.id, label: "personal" }],
+    });
+    expect(f.transitions).toEqual([]);
+    expect(existsSync(stage.stagingCodexHome)).toBe(false);
+  }, 30_000);
+
+  test("accepted small profiles remain mutually switchable across active placements", async () => {
+    const f = fixture();
+    const manager = new NativeProfileManager(f.options);
+    const personal = await manager.register("personal");
+    const workStage = await manager.prepareStage();
+    writeFileSync(join(workStage.stagingCodexHome, "auth.json"), f.target);
+    const work = await manager.finishStage(workStage.stageId, "work");
+    const thirdStage = await manager.prepareStage();
+    const thirdAuth = envelope("account-third", "third");
+    writeFileSync(join(thirdStage.stagingCodexHome, "auth.json"), thirdAuth);
+    const third = await manager.finishStage(thirdStage.stageId, "third");
+    const expected = new Map([
+      ["personal", { id: personal.profile.id, auth: f.source }],
+      ["work", { id: work.profile.id, auth: f.target }],
+      ["third", { id: third.profile.id, auth: thirdAuth }],
+    ]);
+
+    for (const label of ["work", "third", "personal", "third", "work", "personal"]) {
+      const selected = expected.get(label)!;
+      await manager.switch(label, true);
+      expect(readFileSync(manager.context.authPath, "utf8")).toBe(selected.auth);
+      const vault = readNativeProfileVault(manager.context)!;
+      const active = vault.profiles.filter(profile => profile.state === "active");
+      const inactive = vault.profiles.filter(profile => profile.state === "inactive");
+      expect(vault.activeProfileId).toBe(selected.id);
+      expect(active).toEqual([expect.objectContaining({ id: selected.id, payload: null })]);
+      expect(inactive).toHaveLength(2);
+      expect(inactive.every(profile => profile.payload !== null)).toBe(true);
+      expect(existsSync(manager.context.journalPath)).toBe(false);
+    }
+  });
+
   test("expired stages can be cancelled and are swept before preparing another stage", async () => {
     const f = fixture();
     let now = Date.now();

From 27083969f5443e32c2e1601af3c0b8d4bb270a21 Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Sun, 2 Aug 2026 16:53:17 +0900
Subject: [PATCH 25/63] fix(codex): zeroize early native profile errors

---
 src/codex/native-profile-manager.ts  | 113 ++++++++++++++++-----------
 tests/native-profile-manager.test.ts |  88 ++++++++++++++++++++-
 2 files changed, 155 insertions(+), 46 deletions(-)

diff --git a/src/codex/native-profile-manager.ts b/src/codex/native-profile-manager.ts
index 9501943f4..fc8f40e5b 100644
--- a/src/codex/native-profile-manager.ts
+++ b/src/codex/native-profile-manager.ts
@@ -60,6 +60,8 @@ const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-
 
 type AtomicWriter = (path: string, content: string) => Promise<void>;
 type TransitionApplier = (fromAccountId: string, toAccountId: string) => void;
+type EnvelopeReader = (path: string) => NativeEnvelopeSnapshot;
+type VaultReader = () => NativeMainProfileVaultV1 | null;
 export type NativeProfileSwitchBoundary =
   | "journal-prepared"
   | "auth-replaced"
@@ -83,6 +85,9 @@ export interface NativeProfileManagerOptions {
   removeStageTree?: (path: string) => void;
   /** Test-only crash seam; production never supplies this callback. */
   onSwitchBoundary?: (boundary: NativeProfileSwitchBoundary) => void | Promise<void>;
+  /** Test-only reader seams; production uses the native profile store directly. */
+  readEnvelope?: EnvelopeReader;
+  readVault?: VaultReader;
 }
 
 export interface NativeProfileListResult {
@@ -117,6 +122,8 @@ export class NativeProfileManager {
   private readonly onLockAcquired: () => void | Promise<void>;
   private readonly removeStageTree: (path: string) => void;
   private readonly onSwitchBoundary: (boundary: NativeProfileSwitchBoundary) => void | Promise<void>;
+  private readonly readEnvelope: EnvelopeReader;
+  private readonly readVault: VaultReader;
 
   constructor(options: NativeProfileManagerOptions = {}) {
     this.context = resolveNativeProfileContext(options);
@@ -132,6 +139,8 @@ export class NativeProfileManager {
     this.onLockAcquired = options.onLockAcquired ?? (() => {});
     this.removeStageTree = options.removeStageTree ?? (path => rmSync(path, { recursive: true, force: false }));
     this.onSwitchBoundary = options.onSwitchBoundary ?? (() => {});
+    this.readEnvelope = options.readEnvelope ?? readNativeEnvelope;
+    this.readVault = options.readVault ?? (() => readNativeProfileVault(this.context));
   }
 
   private async ensureRoot(): Promise<void> {
@@ -232,10 +241,10 @@ export class NativeProfileManager {
     let key: NativeProfileKey | null = null;
     let current: NativeEnvelopeSnapshot | null = null;
     try {
-      const vault = readNativeProfileVault(this.context);
+      const vault = this.readVault();
       if (!vault) return false;
       key = await this.keyForVault(vault);
-      current = readNativeEnvelope(this.context.authPath);
+      current = this.readEnvelope(this.context.authPath);
       this.assertCurrentIdentity(vault, current, key);
       return true;
     } catch {
@@ -313,7 +322,7 @@ export class NativeProfileManager {
   }
 
   private requireVault(): NativeMainProfileVaultV1 {
-    const vault = readNativeProfileVault(this.context);
+    const vault = this.readVault();
     if (!vault) throw new NativeProfileError("PROFILE_NOT_FOUND", "Register the current native login before adding or switching profiles.", 404);
     return vault;
   }
@@ -341,10 +350,12 @@ export class NativeProfileManager {
       this.assertNoPendingRecovery();
       requireFileCredentialStore(this.context);
       const label = validateNativeProfileLabel(labelInput);
-      const envelope = readNativeEnvelope(this.context.authPath);
-      let vault = readNativeProfileVault(this.context);
-      const key = await this.keyForVault(vault);
+      let envelope: NativeEnvelopeSnapshot | null = null;
+      let key: NativeProfileKey | null = null;
       try {
+        envelope = this.readEnvelope(this.context.authPath);
+        let vault = this.readVault();
+        key = await this.keyForVault(vault);
         const identityHash = nativeIdentityHash(key.key, envelope.accountId);
         const timestamp = new Date(this.now()).toISOString();
         if (!vault) {
@@ -375,8 +386,8 @@ export class NativeProfileManager {
         await this.writeVault(vault);
         return { effectiveCodexHome: this.context.codexHome, profile: publicNativeProfile(this.currentProfile(vault)) };
       } finally {
-        envelope.raw.fill(0);
-        key.key.fill(0);
+        envelope?.raw.fill(0);
+        key?.key.fill(0);
       }
     });
   }
@@ -534,26 +545,33 @@ export class NativeProfileManager {
       this.sweepStaleStages();
       requireFileCredentialStore(this.context);
       const vault = this.requireVault();
-      const key = await this.keyForVault(vault);
-      const current = readNativeEnvelope(this.context.authPath);
-      try { this.assertCurrentIdentity(vault, current, key); } finally { current.raw.fill(0); key.key.fill(0); }
-      if (!existsSync(this.context.stagingRoot)) mkdirSync(this.context.stagingRoot, { recursive: true, mode: 0o700 });
-      await this.hardenPath(dirname(this.context.stagingRoot));
-      await this.hardenPath(this.context.stagingRoot);
-      const stageId = this.uuid();
-      const path = this.stagePath(stageId);
-      mkdirSync(path, { mode: 0o700 });
+      let key: NativeProfileKey | null = null;
+      let current: NativeEnvelopeSnapshot | null = null;
       try {
-        await this.hardenPath(path);
-        writeFileSync(join(path, "config.toml"), 'cli_auth_credentials_store = "file"\n', { mode: 0o600 });
-        await this.hardenPath(join(path, "config.toml"));
-        writeFileSync(join(path, "stage.json"), serializeNativeProfileMetadata({ version: 1, stageId, homeId: this.context.homeId, createdAt: this.now() }), { mode: 0o600 });
-        await this.hardenPath(join(path, "stage.json"));
-      } catch (error) {
-        try { rmSync(path, { recursive: true, force: true }); } catch { /* original error wins */ }
-        throw error;
+        key = await this.keyForVault(vault);
+        current = this.readEnvelope(this.context.authPath);
+        this.assertCurrentIdentity(vault, current, key);
+        if (!existsSync(this.context.stagingRoot)) mkdirSync(this.context.stagingRoot, { recursive: true, mode: 0o700 });
+        await this.hardenPath(dirname(this.context.stagingRoot));
+        await this.hardenPath(this.context.stagingRoot);
+        const stageId = this.uuid();
+        const path = this.stagePath(stageId);
+        mkdirSync(path, { mode: 0o700 });
+        try {
+          await this.hardenPath(path);
+          writeFileSync(join(path, "config.toml"), 'cli_auth_credentials_store = "file"\n', { mode: 0o600 });
+          await this.hardenPath(join(path, "config.toml"));
+          writeFileSync(join(path, "stage.json"), serializeNativeProfileMetadata({ version: 1, stageId, homeId: this.context.homeId, createdAt: this.now() }), { mode: 0o600 });
+          await this.hardenPath(join(path, "stage.json"));
+        } catch (error) {
+          try { rmSync(path, { recursive: true, force: true }); } catch { /* original error wins */ }
+          throw error;
+        }
+        return { stageId, stagingCodexHome: path, effectiveCodexHome: this.context.codexHome };
+      } finally {
+        current?.raw.fill(0);
+        key?.key.fill(0);
       }
-      return { stageId, stagingCodexHome: path, effectiveCodexHome: this.context.codexHome };
     });
   }
 
@@ -694,12 +712,16 @@ export class NativeProfileManager {
   }
 
   private verifyWrittenEnvelope(expectedDigest: string, expectedIdentityHash: string, key: NativeProfileKey): NativeEnvelopeSnapshot {
-    const observed = readNativeEnvelope(this.context.authPath);
-    if (observed.digest !== expectedDigest || nativeIdentityHash(key.key, observed.accountId) !== expectedIdentityHash) {
+    const observed = this.readEnvelope(this.context.authPath);
+    try {
+      if (observed.digest !== expectedDigest || nativeIdentityHash(key.key, observed.accountId) !== expectedIdentityHash) {
+        throw new Error("auth read-back mismatch");
+      }
+      return observed;
+    } catch (error) {
       observed.raw.fill(0);
-      throw new Error("auth read-back mismatch");
+      throw error;
     }
-    return observed;
   }
 
   async switch(targetSelector: string, confirmedStopped = false): Promise<Record<string, unknown>> {
@@ -709,12 +731,14 @@ export class NativeProfileManager {
       await this.assertNativeCodexStopped(confirmedStopped);
       if (probeNativeProfileRecoveryState(this.context) !== "none") await this.recoverLocked(false);
       const beforeVault = this.requireVault();
-      const key = await this.keyForVault(beforeVault);
-      const source = readNativeEnvelope(this.context.authPath);
+      let key: NativeProfileKey | null = null;
+      let source: NativeEnvelopeSnapshot | null = null;
       let target: NativeEnvelopeSnapshot | null = null;
       let journalPrepared = false;
       let committed = false;
       try {
+        key = await this.keyForVault(beforeVault);
+        source = this.readEnvelope(this.context.authPath);
         const sourceProfile = this.assertCurrentIdentity(beforeVault, source, key);
         const targetProfile = this.resolveTarget(beforeVault, targetSelector);
         target = decryptNativeEnvelope(this.context, targetProfile.id, targetProfile.identityHash, targetProfile.payload!, key);
@@ -783,8 +807,8 @@ export class NativeProfileManager {
           throw new NativeProfileError("RECOVERY_REQUIRED", "The login changed, but final transaction cleanup requires recovery.", 409);
         }
         try {
-          await this.atomicWrite(this.context.authPath, source.text);
-          const restored = this.verifyWrittenEnvelope(source.digest, nativeIdentityHash(key.key, source.accountId), key);
+          await this.atomicWrite(this.context.authPath, source!.text);
+          const restored = this.verifyWrittenEnvelope(source!.digest, nativeIdentityHash(key!.key, source!.accountId), key!);
           restored.raw.fill(0);
           await this.writeVault(beforeVault);
           this.removeJournal();
@@ -797,9 +821,9 @@ export class NativeProfileManager {
         }
         throw new NativeProfileError("SWITCH_ROLLED_BACK", "The native-login switch failed and the exact original login was restored.", 409);
       } finally {
-        source.raw.fill(0);
+        source?.raw.fill(0);
         target?.raw.fill(0);
-        key.key.fill(0);
+        key?.key.fill(0);
       }
     });
   }
@@ -829,14 +853,15 @@ export class NativeProfileManager {
         effectiveCodexHome: this.context.codexHome,
       };
     }
-    const key = await this.keyForVault(journal.beforeVault);
-    const current = readNativeEnvelopeResult(this.context.authPath);
-    if (current.status !== "ok") {
-      key.key.fill(0);
-      throw new NativeProfileError("RECOVERY_REQUIRED", "Recovery stopped because the current native login is not readable and confirmed.", 409);
-    }
+    let key: NativeProfileKey | null = null;
+    let current: ReturnType<typeof readNativeEnvelopeResult> | null = null;
     let sourceEnvelope: NativeEnvelopeSnapshot | null = null;
     try {
+      key = await this.keyForVault(journal.beforeVault);
+      current = readNativeEnvelopeResult(this.context.authPath);
+      if (current.status !== "ok") {
+        throw new NativeProfileError("RECOVERY_REQUIRED", "Recovery stopped because the current native login is not readable and confirmed.", 409);
+      }
       const currentHash = nativeIdentityHash(key.key, current.envelope.accountId);
       if (rollback) {
         if (currentHash === journal.sourceIdentityHash) {
@@ -950,9 +975,9 @@ export class NativeProfileManager {
         restartRequired: true,
       };
     } finally {
-      current.envelope.raw.fill(0);
+      if (current?.status === "ok") current.envelope.raw.fill(0);
       sourceEnvelope?.raw.fill(0);
-      key.key.fill(0);
+      key?.key.fill(0);
     }
   }
 
diff --git a/tests/native-profile-manager.test.ts b/tests/native-profile-manager.test.ts
index 3cec8c4d2..23b6845fc 100644
--- a/tests/native-profile-manager.test.ts
+++ b/tests/native-profile-manager.test.ts
@@ -7,8 +7,10 @@ import {
   decryptNativeEnvelope,
   MAX_NATIVE_PROFILE_JOURNAL_BYTES,
   MAX_NATIVE_PROFILE_METADATA_BYTES,
+  readNativeEnvelope,
   probeNativeProfileRecoveryState,
   readNativeProfileVault,
+  type NativeEnvelopeSnapshot,
 } from "../src/codex/native-profile-store";
 import { NativeProfileError, type NativeProfileKey, type NativeProfileKeyProvider } from "../src/codex/native-profile-types";
 
@@ -20,14 +22,20 @@ afterEach(() => {
 
 class MemoryKeyProvider implements NativeProfileKeyProvider {
   private readonly keys = new Map<string, Buffer>();
+  readonly issuedKeys: Buffer[] = [];
   async get(homeId: string): Promise<NativeProfileKey | null> {
     const key = this.keys.get(homeId);
-    return key ? { keyRef: `memory:${homeId}`, key: Buffer.from(key) } : null;
+    if (!key) return null;
+    const returned = Buffer.from(key);
+    this.issuedKeys.push(returned);
+    return { keyRef: `memory:${homeId}`, key: returned };
   }
   async create(homeId: string): Promise<NativeProfileKey> {
     const key = Buffer.alloc(32, 7);
     this.keys.set(homeId, key);
-    return { keyRef: `memory:${homeId}`, key: Buffer.from(key) };
+    const returned = Buffer.from(key);
+    this.issuedKeys.push(returned);
+    return { keyRef: `memory:${homeId}`, key: returned };
   }
 }
 
@@ -46,6 +54,18 @@ function hasJournalPhase(content: string, phase: string): boolean {
   return (JSON.parse(content) as { phase?: unknown }).phase === phase;
 }
 
+function expectZeroized(buffer: Buffer): void {
+  expect([...buffer].every(byte => byte === 0)).toBe(true);
+}
+
+function captureEnvelopes(captured: NativeEnvelopeSnapshot[]): (path: string) => NativeEnvelopeSnapshot {
+  return path => {
+    const snapshot = readNativeEnvelope(path);
+    captured.push(snapshot);
+    return snapshot;
+  };
+}
+
 function fixture() {
   const root = mkdtempSync(join(tmpdir(), "ocx-native-profile-"));
   roots.push(root);
@@ -829,6 +849,70 @@ describe("native main profile transactions", () => {
     expect(journalText).not.toContain("opaque-refresh-target-refreshed-failure");
   });
 
+  test("register zeroizes the auth envelope when vault loading fails early", async () => {
+    const f = fixture();
+    const captured: NativeEnvelopeSnapshot[] = [];
+    const manager = new NativeProfileManager({
+      ...f.options,
+      readEnvelope: captureEnvelopes(captured),
+      readVault: () => { throw new Error("injected vault read failure"); },
+    });
+
+    let caught: unknown;
+    try { await manager.register("personal"); } catch (error) { caught = error; }
+
+    expect(caught).toEqual(new Error("injected vault read failure"));
+    expect(captured).toHaveLength(1);
+    expectZeroized(captured[0].raw);
+    expect(f.keyProvider.issuedKeys).toHaveLength(0);
+  });
+
+  test("prepareStage zeroizes the key and auth envelope when identity validation fails early", async () => {
+    const f = await enrolledFixture();
+    const captured: NativeEnvelopeSnapshot[] = [];
+    const manager = new NativeProfileManager({ ...f.options, readEnvelope: captureEnvelopes(captured) });
+    writeFileSync(f.manager.context.authPath, f.target);
+
+    let caught: unknown;
+    try { await manager.prepareStage(); } catch (error) { caught = error; }
+
+    expect(caught).toBeInstanceOf(NativeProfileError);
+    expect((caught as NativeProfileError).code).toBe("ACTIVE_PROFILE_MISMATCH");
+    expect(captured).toHaveLength(1);
+    expectZeroized(captured[0].raw);
+    expectZeroized(f.keyProvider.issuedKeys.at(-1)!);
+  });
+
+  test("switch zeroizes the key and source envelope when target resolution fails early", async () => {
+    const f = await enrolledFixture();
+    const captured: NativeEnvelopeSnapshot[] = [];
+    const manager = new NativeProfileManager({ ...f.options, readEnvelope: captureEnvelopes(captured) });
+
+    let caught: unknown;
+    try { await manager.switch("missing", true); } catch (error) { caught = error; }
+
+    expect(caught).toBeInstanceOf(NativeProfileError);
+    expect((caught as NativeProfileError).code).toBe("PROFILE_NOT_FOUND");
+    expect(captured).toHaveLength(1);
+    expectZeroized(captured[0].raw);
+    expectZeroized(f.keyProvider.issuedKeys.at(-1)!);
+  });
+
+  test("recover zeroizes the key when current auth inspection fails after key acquisition", async () => {
+    const f = await enrolledFixture();
+    await leavePendingJournal(f);
+    const issuedBefore = f.keyProvider.issuedKeys.length;
+    writeFileSync(f.manager.context.authPath, "{}\n");
+
+    let caught: unknown;
+    try { await f.manager.recover(true, true); } catch (error) { caught = error; }
+
+    expect(caught).toBeInstanceOf(NativeProfileError);
+    expect((caught as NativeProfileError).code).toBe("RECOVERY_REQUIRED");
+    expect(f.keyProvider.issuedKeys.slice(issuedBefore)).not.toHaveLength(0);
+    for (const key of f.keyProvider.issuedKeys.slice(issuedBefore)) expectZeroized(key);
+  });
+
   test("non-file Codex credential stores fail before vault or auth mutation", async () => {
     const f = fixture();
     writeFileSync(join(f.codexHome, "config.toml"), 'cli_auth_credentials_store = "auto"\n');

From 405181f1d4b351dac47b83c4e5df07db76c23651 Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Sun, 2 Aug 2026 16:52:13 +0900
Subject: [PATCH 26/63] fix(restart): hand off deadline restarts

---
 src/server/management/system-restart.ts | 32 ++++++++-
 tests/system-restart.test.ts            | 86 ++++++++++++++++++++++---
 2 files changed, 107 insertions(+), 11 deletions(-)

diff --git a/src/server/management/system-restart.ts b/src/server/management/system-restart.ts
index 6d815c1f3..40d8d1cb9 100644
--- a/src/server/management/system-restart.ts
+++ b/src/server/management/system-restart.ts
@@ -160,6 +160,34 @@ function spawnDetachedStart(port?: number): Promise<void> {
   });
 }
 
+async function completeDeadlineRestartHandoff(
+  io: SystemRestartIo,
+  exitProcess: (code: number) => void,
+): Promise<void> {
+  const supervised = (io.isSupervisedServiceChild ?? (() => isSupervisedServiceChild(io)))();
+  if (supervised) {
+    // Failure-only supervisors ignore exit(0); intentional non-zero triggers respawn.
+    exitProcess(1);
+    return;
+  }
+
+  const port = (io.listenPort ?? resolveListenPort)();
+  try {
+    // The pinned child has its own bounded port reclaim, so it can launch before this
+    // process exits without binding the old listener or extending the drain deadline.
+    await (io.spawnStart ?? spawnDetachedStart)(port);
+  } catch (err) {
+    console.warn(
+      `Drain-and-restart deadline spawn failed (${spawnFailureCode(err)}); exiting without replacement`,
+    );
+    delete process.env.OCX_SERVICE;
+    exitProcess(1);
+    return;
+  }
+  (io.markRecycling ?? markRecyclingForExit)();
+  exitProcess(0);
+}
+
 /**
  * Accept a drain-and-restart request. Returns immediately; the drain +
  * respawn runs on a short timer so the HTTP response can flush first.
@@ -197,8 +225,8 @@ export function acceptSystemRestart(io: SystemRestartIo = restartIo): {
       const drainOutcome = await waitForRestartDrain(drainPromise, restartDeadlineMs, now, scheduleDeadline);
       const exitProcess = io.exitProcess ?? ((code: number) => { process.exit(code); });
       if (drainOutcome === "deadline") {
-        console.warn("Drain-and-restart deadline expired; forcing terminal exit");
-        exitProcess(1);
+        console.warn("Drain-and-restart deadline expired; forcing terminal restart handoff");
+        await completeDeadlineRestartHandoff(io, exitProcess);
         return;
       }
       if (drainOutcome === "rejected") {
diff --git a/tests/system-restart.test.ts b/tests/system-restart.test.ts
index 72380ee6c..72793093f 100644
--- a/tests/system-restart.test.ts
+++ b/tests/system-restart.test.ts
@@ -80,7 +80,7 @@ describe("acceptSystemRestart", () => {
     expect(calls).toEqual(["draining:true", "drain:45000", "start:10123", "recycle", "exit:0"]);
   });
 
-  test("never-settling drain reaches one terminal exit at the original deadline", async () => {
+  test("never-settling unsupervised drain starts one replacement at the original deadline", async () => {
     const calls: string[] = [];
     let scheduled: (() => void | Promise<void>) | null = null;
     let fireDeadline: (() => void) | null = null;
@@ -89,6 +89,8 @@ describe("acceptSystemRestart", () => {
     acceptSystemRestart({
       isDraining: () => false,
       getActiveTurnCount: () => 1,
+      isSupervisedServiceChild: () => false,
+      listenPort: () => 10123,
       schedule: (fn) => { scheduled = fn; },
       scheduleDeadline: (fn, ms) => {
         expect(ms).toBe(60_000);
@@ -101,7 +103,8 @@ describe("acceptSystemRestart", () => {
         calls.push("drain");
         return new Promise<void>(() => {});
       },
-      spawnStart: () => { calls.push("start"); },
+      spawnStart: (port) => { calls.push(`start:${port}`); },
+      markRecycling: () => { calls.push("recycle"); },
       exitProcess: (code) => { calls.push(`exit:${code}`); },
     });
 
@@ -112,10 +115,10 @@ describe("acceptSystemRestart", () => {
     now += 60_000;
     fireDeadline?.();
     await running;
-    expect(calls).toEqual(["latched", "drain", "exit:1"]);
+    expect(calls).toEqual(["latched", "drain", "start:10123", "recycle", "exit:0"]);
   });
 
-  test("exactly elapsed deadline exits without waiting for late drain resolution", async () => {
+  test("exactly elapsed unsupervised deadline starts replacement without waiting for late drain resolution", async () => {
     const calls: string[] = [];
     let scheduled: (() => void | Promise<void>) | null = null;
     let resolveDrain!: () => void;
@@ -124,6 +127,8 @@ describe("acceptSystemRestart", () => {
     acceptSystemRestart({
       isDraining: () => false,
       getActiveTurnCount: () => 0,
+      isSupervisedServiceChild: () => false,
+      listenPort: () => 10123,
       schedule: (fn) => { scheduled = fn; },
       scheduleDeadline: () => { throw new Error("exact deadline must not schedule another timer"); },
       now: () => now,
@@ -132,16 +137,78 @@ describe("acceptSystemRestart", () => {
         calls.push(`drain:${timeoutMs}`);
         return new Promise<void>(resolve => { resolveDrain = resolve; });
       },
-      spawnStart: () => { calls.push("start"); },
+      spawnStart: (port) => { calls.push(`start:${port}`); },
+      markRecycling: () => { calls.push("recycle"); },
       exitProcess: (code) => { calls.push(`exit:${code}`); },
     });
 
     now += MEMORY_DRAIN_RESTART_MS;
     await scheduled!();
-    expect(calls).toEqual(["latched", "drain:0", "exit:1"]);
+    expect(calls).toEqual(["latched", "drain:0", "start:10123", "recycle", "exit:0"]);
     resolveDrain();
     await Promise.resolve();
-    expect(calls).toEqual(["latched", "drain:0", "exit:1"]);
+    expect(calls).toEqual(["latched", "drain:0", "start:10123", "recycle", "exit:0"]);
+  });
+
+  test("deadline leaves a supervised child to its failure-only supervisor", async () => {
+    const calls: string[] = [];
+    let scheduled: (() => void | Promise<void>) | null = null;
+    let fireDeadline: (() => void) | null = null;
+
+    acceptSystemRestart({
+      isDraining: () => false,
+      getActiveTurnCount: () => 0,
+      isSupervisedServiceChild: () => true,
+      schedule: (fn) => { scheduled = fn; },
+      scheduleDeadline: (fn) => { fireDeadline = fn; return () => {}; },
+      setDraining: () => { calls.push("latched"); },
+      drainAndShutdown: () => {
+        calls.push("drain");
+        return new Promise<void>(() => {});
+      },
+      spawnStart: () => { calls.push("start"); },
+      markRecycling: () => { calls.push("recycle"); },
+      exitProcess: (code) => { calls.push(`exit:${code}`); },
+    });
+
+    const running = scheduled!();
+    await Promise.resolve();
+    await Promise.resolve();
+    fireDeadline?.();
+    await running;
+    expect(calls).toEqual(["latched", "drain", "exit:1"]);
+  });
+
+  test("deadline spawn failure exits 1 without marking an unsupervised restart recyclable", async () => {
+    const calls: string[] = [];
+    let scheduled: (() => void | Promise<void>) | null = null;
+    let fireDeadline: (() => void) | null = null;
+
+    acceptSystemRestart({
+      isDraining: () => false,
+      getActiveTurnCount: () => 0,
+      isSupervisedServiceChild: () => false,
+      schedule: (fn) => { scheduled = fn; },
+      scheduleDeadline: (fn) => { fireDeadline = fn; return () => {}; },
+      setDraining: () => { calls.push("latched"); },
+      drainAndShutdown: () => {
+        calls.push("drain");
+        return new Promise<void>(() => {});
+      },
+      spawnStart: async () => {
+        calls.push("start");
+        throw Object.assign(new Error("spawn error"), { code: "EACCES" });
+      },
+      markRecycling: () => { calls.push("recycle"); },
+      exitProcess: (code) => { calls.push(`exit:${code}`); },
+    });
+
+    const running = scheduled!();
+    await Promise.resolve();
+    await Promise.resolve();
+    fireDeadline?.();
+    await running;
+    expect(calls).toEqual(["latched", "drain", "start", "exit:1"]);
   });
 
   test("late drain rejection after timeout is observed without a second terminal action", async () => {
@@ -161,6 +228,7 @@ describe("acceptSystemRestart", () => {
         return new Promise<void>((_resolve, reject) => { rejectDrain = reject; });
       },
       spawnStart: () => { calls.push("start"); },
+      markRecycling: () => { calls.push("recycle"); },
       exitProcess: (code) => { calls.push(`exit:${code}`); },
     });
 
@@ -169,11 +237,11 @@ describe("acceptSystemRestart", () => {
     await Promise.resolve();
     fireDeadline?.();
     await running;
-    expect(calls).toEqual(["latched", "drain", "exit:1"]);
+    expect(calls).toEqual(["latched", "drain", "start", "recycle", "exit:0"]);
     rejectDrain(new Error("late fixture rejection"));
     await Promise.resolve();
     await Promise.resolve();
-    expect(calls).toEqual(["latched", "drain", "exit:1"]);
+    expect(calls).toEqual(["latched", "drain", "start", "recycle", "exit:0"]);
   });
 
   test("supervised service child exits 1 so failure-only supervisors respawn", async () => {

From e05a717c8b4b08d28aff9de339b550c71af73908 Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Sun, 2 Aug 2026 16:53:58 +0900
Subject: [PATCH 27/63] fix(codex): close main gate for retained recovery

---
 src/codex/native-profile-api.ts      |  33 ++++++++-
 src/codex/native-profile-startup.ts  |  20 +++++
 tests/native-profile-api.test.ts     | 106 ++++++++++++++++++++++++++-
 tests/native-profile-startup.test.ts |  40 ++++++++++
 4 files changed, 194 insertions(+), 5 deletions(-)

diff --git a/src/codex/native-profile-api.ts b/src/codex/native-profile-api.ts
index 0ae9fffc7..90e5e72aa 100644
--- a/src/codex/native-profile-api.ts
+++ b/src/codex/native-profile-api.ts
@@ -8,7 +8,7 @@ import {
 } from "../server/management/body";
 import { NativeProfileManager } from "./native-profile-manager";
 import { NativeProfileError } from "./native-profile-types";
-import { completeNativeMainRecovery } from "./native-profile-startup";
+import { blockNativeMainRecovery, completeNativeMainRecovery } from "./native-profile-startup";
 import { probeNativeProfileRecoveryState } from "./native-profile-store";
 
 export interface NativeProfileApiDeps {
@@ -16,6 +16,7 @@ export interface NativeProfileApiDeps {
   drainTimeoutMs?: number;
   sleep?: (ms: number) => Promise<void>;
   probeRecoveryState?: typeof probeNativeProfileRecoveryState;
+  blockRecovery?: typeof blockNativeMainRecovery;
   completeRecovery?: typeof completeNativeMainRecovery;
 }
 
@@ -54,7 +55,14 @@ async function withRecoveryGateTransition<T>(
   const context = manager.context;
   if (!context) return operation();
   const probe = deps.probeRecoveryState ?? probeNativeProfileRecoveryState;
-  const before = probe(context);
+  const block = deps.blockRecovery ?? blockNativeMainRecovery;
+  let before: ReturnType<typeof probeNativeProfileRecoveryState>;
+  try {
+    before = probe(context);
+  } catch (error) {
+    try { block(context.homeId); } catch { /* preserve the probe failure */ }
+    throw error;
+  }
   let operationFailed = false;
   try {
     return await operation();
@@ -62,9 +70,26 @@ async function withRecoveryGateTransition<T>(
     operationFailed = true;
     throw error;
   } finally {
-    if (before !== "none" || (completeIfAlreadyClearAfterSuccess && !operationFailed)) {
+    let after: ReturnType<typeof probeNativeProfileRecoveryState> = "none";
+    let afterProbed = false;
+    let transitionError: unknown;
+    try {
+      after = probe(context);
+      afterProbed = true;
+    } catch (error) {
+      transitionError = error;
+      try { block(context.homeId); } catch { /* preserve the operation/probe failure */ }
+    }
+    if (!afterProbed) {
+      if (!operationFailed) throw transitionError;
+    } else if (after !== "none") {
+      try {
+        block(context.homeId, after);
+      } catch (error) {
+        if (!operationFailed) throw error;
+      }
+    } else if (before !== "none" || (completeIfAlreadyClearAfterSuccess && !operationFailed)) {
       try {
-        const after = probe(context);
         if (after === "none") {
           (deps.completeRecovery ?? completeNativeMainRecovery)(context.homeId);
         }
diff --git a/src/codex/native-profile-startup.ts b/src/codex/native-profile-startup.ts
index 5b1c73c7d..9346f1fe9 100644
--- a/src/codex/native-profile-startup.ts
+++ b/src/codex/native-profile-startup.ts
@@ -89,6 +89,26 @@ export function isNativeMainTrafficBlocked(): boolean {
   return snapshot.status === "blocked";
 }
 
+/**
+ * Close the process-wide native-main admission gate after a live transaction
+ * leaves recovery state behind. A known different home owns a different
+ * native credential file, so it must not be fenced by this transition.
+ */
+export function blockNativeMainRecovery(
+  homeId: string,
+  recoveryState?: Exclude<NativeProfileRecoveryState, "none">,
+): boolean {
+  if (snapshot.homeId !== null && snapshot.homeId !== homeId) return false;
+  epoch += 1;
+  snapshot = {
+    status: "blocked",
+    homeId,
+    reason: recoveryState === "journal" ? "recovery-pending" : "manual-recovery",
+  };
+  settled = Promise.resolve(snapshot);
+  return true;
+}
+
 export function completeNativeMainRecovery(homeId: string): boolean {
   if (snapshot.status !== "blocked" || snapshot.homeId !== homeId) return false;
   epoch += 1;
diff --git a/tests/native-profile-api.test.ts b/tests/native-profile-api.test.ts
index 89a2163ff..0f1225eec 100644
--- a/tests/native-profile-api.test.ts
+++ b/tests/native-profile-api.test.ts
@@ -7,6 +7,7 @@ import type { NativeProfileManager } from "../src/codex/native-profile-manager";
 import { NativeProfileError } from "../src/codex/native-profile-types";
 import { resetLifecycleDrainStateForTests, setDraining, tryAdmitTurn } from "../src/server/lifecycle";
 import {
+  blockNativeMainRecovery,
   completeNativeMainRecovery,
   initializeNativeMainStartupGate,
   nativeMainStartupGateSnapshot,
@@ -200,10 +201,54 @@ describe("native main profile management API", () => {
     expect(nativeMainStartupGateSnapshot()).toMatchObject({ status: "ready", homeId });
   });
 
+  test("a clean matching gate closes before drain release when a switch retains a journal", async () => {
+    const homeId = "home-clean-retained-journal";
+    await initializeNativeMainStartupGate({
+      manager: { context: { homeId } } as unknown as NativeProfileManager,
+      probeRecoveryState: () => "none",
+    });
+    let blockedWhileDraining = false;
+    const states = ["none", "journal"] as const;
+    const manager = {
+      context: { homeId, journalPath: "pending", recoveryBlockPath: "missing-block" },
+      switch: async () => { throw new NativeProfileError("RECOVERY_REQUIRED", "journal retained", 409); },
+    } as unknown as NativeProfileManager;
+    const request = new Request("http://localhost/api/native-main-profiles/switch", {
+      method: "POST",
+      body: JSON.stringify({ target: "target", confirmedStopped: true }),
+    });
+
+    const response = await handleNativeProfileAPI(request, new URL(request.url), {} as OcxConfig, {
+      manager,
+      probeRecoveryState: () => states.shift() ?? "journal",
+      blockRecovery: (id, state) => {
+        blockedWhileDraining = tryAdmitTurn() === null;
+        return blockNativeMainRecovery(id, state);
+      },
+    });
+
+    expect(response?.status).toBe(409);
+    expect(blockedWhileDraining).toBe(true);
+    expect(nativeMainStartupGateSnapshot()).toEqual({
+      status: "blocked",
+      homeId,
+      reason: "recovery-pending",
+    });
+    const admittedAfterDrain = tryAdmitTurn();
+    expect(admittedAfterDrain).not.toBeNull();
+    admittedAfterDrain?.release();
+  });
+
   test("switch without auto-recovery does not complete a blocked startup gate", async () => {
+    const homeId = "home-no-journal";
+    await initializeNativeMainStartupGate({
+      manager: { context: { homeId } } as unknown as NativeProfileManager,
+      probeRecoveryState: () => "none",
+    });
     let completions = 0;
+    let blocks = 0;
     const manager = {
-      context: { homeId: "home-no-journal", journalPath: "missing", recoveryBlockPath: "missing-block" },
+      context: { homeId, journalPath: "missing", recoveryBlockPath: "missing-block" },
       switch: async () => ({ ok: true }),
     } as unknown as NativeProfileManager;
     const request = new Request("http://localhost/api/native-main-profiles/switch", {
@@ -213,10 +258,69 @@ describe("native main profile management API", () => {
     const response = await handleNativeProfileAPI(request, new URL(request.url), {} as OcxConfig, {
       manager,
       probeRecoveryState: () => "none",
+      blockRecovery: () => { blocks += 1; return true; },
       completeRecovery: () => { completions += 1; return true; },
     });
     expect(response?.status).toBe(200);
     expect(completions).toBe(0);
+    expect(blocks).toBe(0);
+    expect(nativeMainStartupGateSnapshot()).toEqual({ status: "ready", homeId });
+  });
+
+  test("a retained recovery state cannot fence a known different native home", async () => {
+    await initializeNativeMainStartupGate({
+      manager: { context: { homeId: "home-a" } } as unknown as NativeProfileManager,
+      probeRecoveryState: () => "none",
+    });
+    const states = ["none", "manual"] as const;
+    const manager = {
+      context: { homeId: "home-b", journalPath: "missing", recoveryBlockPath: "manual" },
+      switch: async () => { throw new NativeProfileError("RECOVERY_REQUIRED", "manual marker retained", 409); },
+    } as unknown as NativeProfileManager;
+    const request = new Request("http://localhost/api/native-main-profiles/switch", {
+      method: "POST",
+      body: JSON.stringify({ target: "target", confirmedStopped: true }),
+    });
+
+    const response = await handleNativeProfileAPI(request, new URL(request.url), {} as OcxConfig, {
+      manager,
+      probeRecoveryState: () => states.shift() ?? "manual",
+    });
+
+    expect(response?.status).toBe(409);
+    expect(nativeMainStartupGateSnapshot()).toEqual({ status: "ready", homeId: "home-a" });
+  });
+
+  test("an indeterminate post-operation recovery probe closes the matching gate", async () => {
+    const homeId = "home-indeterminate";
+    await initializeNativeMainStartupGate({
+      manager: { context: { homeId } } as unknown as NativeProfileManager,
+      probeRecoveryState: () => "none",
+    });
+    let probes = 0;
+    const manager = {
+      context: { homeId, journalPath: "unknown", recoveryBlockPath: "unknown" },
+      switch: async () => ({ ok: true }),
+    } as unknown as NativeProfileManager;
+    const request = new Request("http://localhost/api/native-main-profiles/switch", {
+      method: "POST",
+      body: JSON.stringify({ target: "target", confirmedStopped: true }),
+    });
+
+    const response = await handleNativeProfileAPI(request, new URL(request.url), {} as OcxConfig, {
+      manager,
+      probeRecoveryState: () => {
+        if (probes++ === 0) return "none";
+        throw new Error("recovery state unreadable");
+      },
+    });
+
+    expect(response?.status).toBe(500);
+    expect(nativeMainStartupGateSnapshot()).toEqual({
+      status: "blocked",
+      homeId,
+      reason: "manual-recovery",
+    });
   });
 
   test("explicit recovery completes a manual marker gate only after the marker clears", async () => {
diff --git a/tests/native-profile-startup.test.ts b/tests/native-profile-startup.test.ts
index ce972e6ca..0fe149f3d 100644
--- a/tests/native-profile-startup.test.ts
+++ b/tests/native-profile-startup.test.ts
@@ -302,6 +302,46 @@ describe("native-main startup journal gate", () => {
     });
   });
 
+  test("a clean live switch that retains its journal closes the matching gate", async () => {
+    const f = await fixture("prepared", "source-exact");
+    await expect(f.manager.recover(false)).resolves.toMatchObject({ recovered: true });
+    expect(probeNativeProfileRecoveryState(f.manager.context)).toBe("none");
+
+    const faultingManager = new NativeProfileManager({
+      codexHome: f.codexHome,
+      configDir: f.configDir,
+      keyProvider: new MemoryKeyProvider(f.key),
+      hardenPath: async () => {},
+      processProbe: async () => ({ status: "clear", count: 0 }),
+      onSwitchBoundary: async boundary => {
+        if (boundary === "vault-committed") throw new Error("inject retained journal");
+      },
+    });
+    await initializeNativeMainStartupGate({ manager: faultingManager });
+    expect(nativeMainStartupGateSnapshot()).toEqual({
+      status: "ready",
+      homeId: f.manager.context.homeId,
+    });
+
+    const request = new Request("http://localhost/api/native-main-profiles/switch", {
+      method: "POST",
+      body: JSON.stringify({ target: f.targetProfileId, confirmedStopped: true }),
+    });
+    const response = await handleNativeProfileAPI(request, new URL(request.url), {} as OcxConfig, {
+      manager: faultingManager,
+    });
+
+    expect(response?.status).toBe(409);
+    expect(await response?.json()).toMatchObject({ code: "RECOVERY_REQUIRED" });
+    expect(probeNativeProfileRecoveryState(faultingManager.context)).toBe("journal");
+    expect(nativeMainStartupGateSnapshot()).toEqual({
+      status: "blocked",
+      homeId: f.manager.context.homeId,
+      reason: "recovery-pending",
+    });
+    expect(isNativeMainTrafficBlocked()).toBe(true);
+  });
+
   test("a switch error after real journal convergence preserves the selector error and reopens main", async () => {
     const f = await fixture("prepared", "source-exact");
     await initializeNativeMainStartupGate({

From f3b81b20f71e28adb811bc3adc5ddec8dbc1443e Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Sun, 2 Aug 2026 17:12:59 +0900
Subject: [PATCH 28/63] fix(codex): scope native main profile drain

---
 src/codex/auth-context.ts                 |  65 +++++++--
 src/codex/native-profile-api.ts           |   8 +-
 src/providers/openai-sidecar.ts           |   6 +-
 src/server/images.ts                      |  11 +-
 src/server/index.ts                       |  16 +--
 src/server/lifecycle.ts                   |  84 ++++++++++--
 src/server/live.ts                        |  14 +-
 src/server/responses/compact.ts           |  14 +-
 src/server/responses/core.ts              |  22 +++-
 src/server/search.ts                      |  10 +-
 tests/native-profile-api.test.ts          |  64 +++++++--
 tests/native-profile-drain-server.test.ts | 154 ++++++++++++++++++++++
 tests/shutdown-drain.test.ts              |  40 ++++++
 13 files changed, 453 insertions(+), 55 deletions(-)
 create mode 100644 tests/native-profile-drain-server.test.ts

diff --git a/src/codex/auth-context.ts b/src/codex/auth-context.ts
index b8942b7ad..aade1d5f9 100644
--- a/src/codex/auth-context.ts
+++ b/src/codex/auth-context.ts
@@ -107,6 +107,20 @@ export class CodexPoolAuthenticationError extends Error {
   }
 }
 
+export class CodexMainProfileDrainingError extends Error {
+  constructor() {
+    super("Native Codex main profile is switching; retry this request");
+    this.name = "CodexMainProfileDrainingError";
+  }
+}
+
+export function codexMainProfileDrainingResponse(): Response {
+  const response = formatErrorResponse(503, "server_busy", "Native Codex main profile is switching; retry this request");
+  const headers = new Headers(response.headers);
+  headers.set("Retry-After", "1");
+  return new Response(response.body, { status: response.status, headers });
+}
+
 export class CodexDirectAuthenticationError extends Error {
   constructor() {
     super("Codex Direct requires a caller Authorization bearer token");
@@ -198,6 +212,14 @@ export interface ResolveCodexAuthContextOptions {
   excludeAccountId?: string;
   /** Final native model selected for this request, used to select its quota group. */
   modelId?: string;
+  /** Short reservation converted to turn ownership before native `__main__` token materialization. */
+  beginCodexAccountSelection?: () => CodexAccountSelectionAdmission | undefined;
+}
+
+export interface CodexAccountSelectionAdmission {
+  readonly mainProfileDraining: boolean;
+  claimMainProfile(): boolean;
+  release(): void;
 }
 
 export async function resolveCodexAuthContext(
@@ -217,20 +239,37 @@ export async function resolveCodexAuthContext(
   if (isNativeMainTrafficBlocked() && config.activeCodexAccountId === MAIN_CODEX_ACCOUNT_ID) {
     throw new CodexPoolAuthenticationError();
   }
-  reconcileMainCodexAccountRuntimeState();
-  const threadId = headers.get("x-codex-parent-thread-id");
+  const selectionAdmission = options.beginCodexAccountSelection?.();
+  let accountId: string;
   const quotaScope = codexQuotaScopeForModel(options.modelId);
-  const resolution = options.excludeAccountId
-    ? (() => {
-        const accountId = pickAlternateCodexAccount(config, options.excludeAccountId!, Date.now(), quotaScope);
-        return accountId
-          ? { status: "selected" as const, accountId }
-          : { status: "none" as const };
-      })()
-    : resolveCodexAccountForThreadDetailed(threadId, config, Date.now(), quotaScope);
-  if (resolution.status === "expired") throw new CodexThreadAffinityExpiredError(resolution.accountId);
-  let accountId = resolution.status === "selected" ? resolution.accountId : null;
-  if (!accountId) throw new CodexPoolAuthenticationError();
+  try {
+    // A pre-drain selector reserves the native identity while reconciliation and
+    // routing inspect it. Selectors arriving after the fence skip reconciliation
+    // and may still route to non-main pool accounts without touching switch state.
+    if (!selectionAdmission?.mainProfileDraining) reconcileMainCodexAccountRuntimeState();
+    const threadId = headers.get("x-codex-parent-thread-id");
+    const resolution = options.excludeAccountId
+      ? (() => {
+          const selected = pickAlternateCodexAccount(config, options.excludeAccountId!, Date.now(), quotaScope);
+          return selected
+            ? { status: "selected" as const, accountId: selected }
+            : { status: "none" as const };
+        })()
+      : resolveCodexAccountForThreadDetailed(threadId, config, Date.now(), quotaScope);
+    if (resolution.status === "expired") throw new CodexThreadAffinityExpiredError(resolution.accountId);
+    const selected = resolution.status === "selected" ? resolution.accountId : null;
+    if (!selected) throw new CodexPoolAuthenticationError();
+    accountId = selected;
+    if (
+      accountId === MAIN_CODEX_ACCOUNT_ID
+      && selectionAdmission
+      && !selectionAdmission.claimMainProfile()
+    ) {
+      throw new CodexMainProfileDrainingError();
+    }
+  } finally {
+    selectionAdmission?.release();
+  }
   // Lazy prime: if the selected account has no quota yet, the pool is likely
   // unprimed (dashboard never opened, or startup prime was blocked). Kick a
   // best-effort prime so the NEXT routing decision has real scores. This never
diff --git a/src/codex/native-profile-api.ts b/src/codex/native-profile-api.ts
index 90e5e72aa..26c8ff706 100644
--- a/src/codex/native-profile-api.ts
+++ b/src/codex/native-profile-api.ts
@@ -1,6 +1,6 @@
 import type { OcxConfig } from "../types";
 import { jsonResponse } from "../server/auth-cors";
-import { acquireTemporaryDrain, getActiveTurnCount } from "../server/lifecycle";
+import { acquireNativeMainProfileDrain, getNativeMainProfileRequestCount } from "../server/lifecycle";
 import {
   managementBodyTooLargeResponse,
   readManagementJsonBody,
@@ -32,12 +32,12 @@ async function body(req: Request): Promise<Record<string, unknown>> {
 }
 
 async function withMainRequestDrain<T>(deps: NativeProfileApiDeps, operation: () => Promise<T>): Promise<T> {
-  const drainLease = acquireTemporaryDrain("native-main-profile");
+  const drainLease = acquireNativeMainProfileDrain("native-main-profile");
   if (!drainLease) throw new NativeProfileError("MAIN_REQUESTS_ACTIVE", "The proxy is already draining requests.", 503, true);
   try {
     const deadline = Date.now() + (deps.drainTimeoutMs ?? 10_000);
-    while (getActiveTurnCount() > 0 && Date.now() < deadline) await (deps.sleep ?? Bun.sleep)(50);
-    if (getActiveTurnCount() > 0) {
+    while (getNativeMainProfileRequestCount() > 0 && Date.now() < deadline) await (deps.sleep ?? Bun.sleep)(50);
+    if (getNativeMainProfileRequestCount() > 0) {
       throw new NativeProfileError("MAIN_REQUESTS_ACTIVE", "In-flight requests did not finish before the native-login switch deadline.", 409, true);
     }
     return await operation();
diff --git a/src/providers/openai-sidecar.ts b/src/providers/openai-sidecar.ts
index b3ca44509..f5bdadc77 100644
--- a/src/providers/openai-sidecar.ts
+++ b/src/providers/openai-sidecar.ts
@@ -4,6 +4,7 @@ import {
   hasCallerCodexBearer,
   isCodexAuthContextUsable,
   resolveCodexAuthContext,
+  type CodexAccountSelectionAdmission,
   type CodexAuthContext,
 } from "../codex/auth-context";
 import { recordCodexUpstreamOutcome, type CodexUpstreamOutcome } from "../codex/routing";
@@ -70,6 +71,7 @@ export async function resolveFirstUsableOpenAiSidecar(
   candidates: readonly OpenAiForwardSidecarCandidate[],
   incomingHeaders: Headers,
   config: OcxConfig,
+  options: { beginCodexAccountSelection?: () => CodexAccountSelectionAdmission | undefined } = {},
 ): Promise<ResolvedOpenAiForwardSidecar | undefined> {
   let callerBearerMayBeForwarded = true;
   try {
@@ -89,7 +91,9 @@ export async function resolveFirstUsableOpenAiSidecar(
         headers,
       };
     }
-    const authContext = await resolveCodexAuthContext(incomingHeaders, config, candidate.accountMode);
+    const authContext = await resolveCodexAuthContext(incomingHeaders, config, candidate.accountMode, {
+      beginCodexAccountSelection: options.beginCodexAccountSelection,
+    });
     if (!isCodexAuthContextUsable(authContext, config)) continue;
     return {
       ...candidate,
diff --git a/src/server/images.ts b/src/server/images.ts
index 533098bb1..a35ca84e6 100644
--- a/src/server/images.ts
+++ b/src/server/images.ts
@@ -15,8 +15,10 @@
 import { formatErrorResponse } from "../bridge";
 import {
   CodexAccountCooldownError,
+  codexMainProfileDrainingResponse,
   cooldownErrorResponse,
   CodexAuthContextError,
+  CodexMainProfileDrainingError,
   CodexPoolAuthenticationError,
   CodexThreadAffinityExpiredError,
 } from "../codex/auth-context";
@@ -35,6 +37,8 @@ import { safeAntigravityHttpErrorMessage } from "../adapters/google-errors";
 import { sanitizeUpstreamErrorText } from "../adapters/upstream-http-error";
 import { ANTIGRAVITY_REQUEST_UA } from "../adapters/google-antigravity-wire";
 import { decodeValidatedImageBase64, MAX_ENCODED_BYTES_PER_IMAGE } from "../images/artifacts";
+import type { AdmissionLease } from "../lib/admission";
+import { codexAccountSelectionForTurn } from "./lifecycle";
 
 export type ImagesEndpoint = "generations" | "edits";
 
@@ -323,6 +327,7 @@ export async function handleImages(
   config: OcxConfig,
   endpoint: ImagesEndpoint,
   logCtx: RequestLogContext,
+  turnAdmissionLease?: AdmissionLease,
 ): Promise<Response> {
   const candidates = selectImagesProvider(config);
   if (candidates.error) {
@@ -375,11 +380,15 @@ export async function handleImages(
   let forwardAuthError: Response | undefined;
   if (canUseOpenAiForward) {
     try {
-      forward = await resolveFirstUsableOpenAiSidecar(candidates.forwardCandidates, req.headers, config);
+      forward = await resolveFirstUsableOpenAiSidecar(candidates.forwardCandidates, req.headers, config, {
+        beginCodexAccountSelection: codexAccountSelectionForTurn(turnAdmissionLease),
+      });
       if (forward) logCtx.provider = formatCodexProviderForLog(forward.providerName, codexLogAccountId(forward.authContext), config);
     } catch (err) {
       if (err instanceof CodexAccountCooldownError) {
         forwardAuthError = cooldownErrorResponse(err);
+      } else if (err instanceof CodexMainProfileDrainingError) {
+        forwardAuthError = codexMainProfileDrainingResponse();
       } else if (err instanceof CodexThreadAffinityExpiredError) {
         forwardAuthError = formatErrorResponse(409, "invalid_request_error", "Codex thread account affinity expired; start a new session");
       } else if (err instanceof CodexAuthContextError) {
diff --git a/src/server/index.ts b/src/server/index.ts
index 510deb4b0..7ca60972c 100644
--- a/src/server/index.ts
+++ b/src/server/index.ts
@@ -610,10 +610,10 @@ export function startServer(port?: number, deps: StartServerDeps = {}) {
           ...admissionFields(admission),
           inboundProtocol: "responses",
         };
-        return runAdmittedHttpTurn(req, async () => {
+        return runAdmittedHttpTurn(req, async turnAdmissionLease => {
           let response: Response;
           try {
-            response = await handleResponsesCompact(req, config, logCtx);
+            response = await handleResponsesCompact(req, config, logCtx, turnAdmissionLease);
           } catch {
             response = formatErrorResponse(500, "server_error", "Unexpected compact request failure");
           }
@@ -644,8 +644,8 @@ export function startServer(port?: number, deps: StartServerDeps = {}) {
           ...admissionFields(admission),
         };
         const endpoint = url.pathname.endsWith("/edits") ? "edits" as const : "generations" as const;
-        return runAdmittedHttpTurn(req, async () => {
-          const response = await handleImages(req, config, endpoint, logCtx);
+        return runAdmittedHttpTurn(req, async turnAdmissionLease => {
+          const response = await handleImages(req, config, endpoint, logCtx, turnAdmissionLease);
           addFinalRequestLog(requestId, start, logCtx, response.status, response.status === 499 ? { closeReason: "client_cancel" } : undefined);
           return withCors(response, req, config);
         });
@@ -698,8 +698,8 @@ export function startServer(port?: number, deps: StartServerDeps = {}) {
           provider: "unknown",
           ...admissionFields(admission),
         };
-        return runAdmittedHttpTurn(req, async () => {
-          const response = await handleSearch(req, config, logCtx);
+        return runAdmittedHttpTurn(req, async turnAdmissionLease => {
+          const response = await handleSearch(req, config, logCtx, turnAdmissionLease);
           addFinalRequestLog(requestId, start, logCtx, response.status,
             response.status === 499 ? { closeReason: "client_cancel" } : undefined);
           return withCors(response, req, config);
@@ -848,8 +848,8 @@ export function startServer(port?: number, deps: StartServerDeps = {}) {
           provider: "unknown",
           ...admissionFields(admission),
         };
-        return runAdmittedHttpTurn(req, async () => {
-          const response = await handleLive(req, config, logCtx);
+        return runAdmittedHttpTurn(req, async turnAdmissionLease => {
+          const response = await handleLive(req, config, logCtx, turnAdmissionLease);
           addFinalRequestLog(
             requestId,
             start,
diff --git a/src/server/lifecycle.ts b/src/server/lifecycle.ts
index 90bca7805..f0d07b9fe 100644
--- a/src/server/lifecycle.ts
+++ b/src/server/lifecycle.ts
@@ -20,6 +20,7 @@ import {
   beginBackgroundShellShutdown,
   terminateAllBackgroundShells,
 } from "../adapters/cursor/native-exec-shell";
+import type { CodexAccountSelectionAdmission } from "../codex/auth-context";
 
 // ---------------------------------------------------------------------------
 // Active turn tracking + graceful shutdown drain
@@ -29,6 +30,7 @@ export const MAX_ACTIVE_TURNS = 256;
 const turnGate = createAdmissionGate("active_turns", MAX_ACTIVE_TURNS);
 export interface ActiveTurnLease extends AdmissionLease {
   bindAbortController(ac: AbortController): void;
+  beginCodexAccountSelection(): CodexAccountSelectionAdmission;
   isTransferred(): boolean;
 }
 const activeTurns = new Map<AbortController, ActiveTurnLease>();
@@ -37,7 +39,10 @@ const knownTurnControllers = new WeakSet<AbortController>();
 let turnReleaseMisses = 0;
 let shutdownDraining = false;
 const temporaryDrainOwners = new Set<symbol>();
+const nativeMainDrainOwners = new Set<symbol>();
 const temporaryDrainWaiters = new Set<() => void>();
+const nativeMainTurns = new Set<ActiveTurnLease>();
+let nativeMainSelections = 0;
 let legacyDrainLease: AdmissionLease | null = null;
 let recyclingForExit = false;
 let _serverRef: ReturnType<typeof Bun.serve> | undefined;
@@ -56,9 +61,19 @@ export function setDraining(value: boolean): void {
   }
 }
 
-/** Acquire the single owner-scoped temporary data-plane fence. */
+function temporaryDrainCount(): number {
+  return temporaryDrainOwners.size + nativeMainDrainOwners.size;
+}
+
+function notifyTemporaryDrainsSettled(): void {
+  if (temporaryDrainCount() !== 0) return;
+  for (const resolve of temporaryDrainWaiters) resolve();
+  temporaryDrainWaiters.clear();
+}
+
+/** Acquire the single owner-scoped global data-plane fence. */
 export function acquireTemporaryDrain(owner: string): AdmissionLease | null {
-  if (shutdownDraining || temporaryDrainOwners.size > 0) return null;
+  if (shutdownDraining || temporaryDrainCount() > 0) return null;
   const token = Symbol(owner);
   temporaryDrainOwners.add(token);
   let active = true;
@@ -67,10 +82,23 @@ export function acquireTemporaryDrain(owner: string): AdmissionLease | null {
       if (!active) return;
       active = false;
       temporaryDrainOwners.delete(token);
-      if (temporaryDrainOwners.size === 0) {
-        for (const resolve of temporaryDrainWaiters) resolve();
-        temporaryDrainWaiters.clear();
-      }
+      notifyTemporaryDrainsSettled();
+    },
+  };
+}
+
+/** Fence only turns that select the native Codex `__main__` account. */
+export function acquireNativeMainProfileDrain(owner: string): AdmissionLease | null {
+  if (shutdownDraining || temporaryDrainCount() > 0) return null;
+  const token = Symbol(owner);
+  nativeMainDrainOwners.add(token);
+  let active = true;
+  return {
+    release() {
+      if (!active) return;
+      active = false;
+      nativeMainDrainOwners.delete(token);
+      notifyTemporaryDrainsSettled();
     },
   };
 }
@@ -85,13 +113,13 @@ export function beginShutdownDrain(): boolean {
 export function isShutdownDraining(): boolean { return shutdownDraining; }
 
 export function waitForTemporaryDrains(): Promise<void> {
-  if (temporaryDrainOwners.size === 0) return Promise.resolve();
+  if (temporaryDrainCount() === 0) return Promise.resolve();
   return new Promise(resolve => temporaryDrainWaiters.add(resolve));
 }
 
 /** Wait for scoped drains without allowing them to outlive the shutdown deadline. */
 async function waitForTemporaryDrainsUntil(deadlineMs: number): Promise<boolean> {
-  if (temporaryDrainOwners.size === 0) return true;
+  if (temporaryDrainCount() === 0) return true;
   const remainingMs = Math.max(0, deadlineMs - Date.now());
   if (remainingMs === 0) return false;
   return new Promise<boolean>((resolve) => {
@@ -113,6 +141,9 @@ export function resetLifecycleDrainStateForTests(): void {
   legacyDrainLease?.release();
   legacyDrainLease = null;
   temporaryDrainOwners.clear();
+  nativeMainDrainOwners.clear();
+  nativeMainTurns.clear();
+  nativeMainSelections = 0;
   for (const resolve of temporaryDrainWaiters) resolve();
   temporaryDrainWaiters.clear();
   shutdownDraining = false;
@@ -124,6 +155,7 @@ export function tryAdmitTurn(): ActiveTurnLease | null {
   const controllers = new Set<AbortController>();
   let active = true;
   let transferred = false;
+  let nativeMainClaimed = false;
   const lease: ActiveTurnLease = {
     bindAbortController(ac) {
       knownTurnControllers.add(ac);
@@ -135,6 +167,31 @@ export function tryAdmitTurn(): ActiveTurnLease | null {
       controllers.add(ac);
       activeTurns.set(ac, lease);
     },
+    beginCodexAccountSelection() {
+      const mainProfileDraining = nativeMainDrainOwners.size > 0;
+      let selectionActive = !mainProfileDraining;
+      let released = false;
+      if (selectionActive) nativeMainSelections += 1;
+      return {
+        mainProfileDraining,
+        claimMainProfile() {
+          if (released || mainProfileDraining || !active) return false;
+          if (!nativeMainClaimed) {
+            nativeMainClaimed = true;
+            nativeMainTurns.add(lease);
+          }
+          return true;
+        },
+        release() {
+          if (released) return;
+          released = true;
+          if (selectionActive) {
+            selectionActive = false;
+            nativeMainSelections = Math.max(0, nativeMainSelections - 1);
+          }
+        },
+      };
+    },
     isTransferred() { return transferred; },
     release() {
       if (!active) return;
@@ -144,12 +201,20 @@ export function tryAdmitTurn(): ActiveTurnLease | null {
         if (activeTurns.get(controller) === lease) activeTurns.delete(controller);
       }
       controllers.clear();
+      nativeMainTurns.delete(lease);
       gateLease.release();
     },
   };
   admittedTurns.add(lease);
   return lease;
 }
+export function codexAccountSelectionForTurn(
+  lease?: AdmissionLease,
+): (() => CodexAccountSelectionAdmission | undefined) | undefined {
+  if (!lease || !("beginCodexAccountSelection" in lease)) return undefined;
+  const activeLease = lease as ActiveTurnLease;
+  return () => activeLease.beginCodexAccountSelection();
+}
 export function registerTurn(ac: AbortController, lease?: AdmissionLease): void {
   if (lease && "bindAbortController" in lease) (lease as ActiveTurnLease).bindAbortController(ac);
 }
@@ -164,6 +229,9 @@ export function unregisterTurn(ac: AbortController): void {
 }
 export function isDraining(): boolean { return shutdownDraining || temporaryDrainOwners.size > 0; }
 export function getActiveTurnCount(): number { return turnGate.metrics().active; }
+export function getNativeMainProfileRequestCount(): number {
+  return nativeMainSelections + nativeMainTurns.size;
+}
 export function activeRegistryMetrics(): Record<string, AdmissionMetrics> {
   const turns = turnGate.metrics();
   return {
diff --git a/src/server/live.ts b/src/server/live.ts
index b109c81b9..7beb52e0e 100644
--- a/src/server/live.ts
+++ b/src/server/live.ts
@@ -24,8 +24,10 @@ import { appendFileSync } from "node:fs";
 import { formatErrorResponse } from "../bridge";
 import {
   CodexAccountCooldownError,
+  codexMainProfileDrainingResponse,
   cooldownErrorResponse,
   CodexAuthContextError,
+  CodexMainProfileDrainingError,
   CodexPoolAuthenticationError,
   CodexThreadAffinityExpiredError,
 } from "../codex/auth-context";
@@ -37,6 +39,8 @@ import { resolveFirstUsableOpenAiSidecar, selectOpenAiImagesProvider } from "../
 import { ForwardAdmissionCredentialError, validateForwardAdmissionCredential } from "./auth-cors";
 import type { RequestLogContext } from "./request-log";
 import { codexLogAccountId } from "./responses";
+import type { AdmissionLease } from "../lib/admission";
+import { codexAccountSelectionForTurn } from "./lifecycle";
 
 /** Voice call create can wait on SDP negotiation; bound a hung upstream. */
 const LIVE_UPSTREAM_TIMEOUT_MS = 120_000;
@@ -409,6 +413,7 @@ export async function resolveLiveRelay(
   req: Request,
   config: OcxConfig,
   logCtx: RequestLogContext,
+  turnAdmissionLease?: AdmissionLease,
 ): Promise<LiveRelayTarget | Response> {
   try {
     validateForwardAdmissionCredential(req.headers, config);
@@ -433,7 +438,9 @@ export async function resolveLiveRelay(
   let forwardAuthError: Response | undefined;
   if (candidates.forwardCandidates.length > 0) {
     try {
-      forward = await resolveFirstUsableOpenAiSidecar(candidates.forwardCandidates, req.headers, config);
+      forward = await resolveFirstUsableOpenAiSidecar(candidates.forwardCandidates, req.headers, config, {
+        beginCodexAccountSelection: codexAccountSelectionForTurn(turnAdmissionLease),
+      });
       if (forward) {
         logCtx.provider = formatCodexProviderForLog(
           forward.providerName,
@@ -444,6 +451,8 @@ export async function resolveLiveRelay(
     } catch (err) {
       if (err instanceof CodexAccountCooldownError) {
         forwardAuthError = cooldownErrorResponse(err);
+      } else if (err instanceof CodexMainProfileDrainingError) {
+        forwardAuthError = codexMainProfileDrainingResponse();
       } else if (err instanceof CodexThreadAffinityExpiredError) {
         forwardAuthError = formatErrorResponse(
           409,
@@ -506,13 +515,14 @@ export async function handleLive(
   req: Request,
   config: OcxConfig,
   logCtx: RequestLogContext,
+  turnAdmissionLease?: AdmissionLease,
 ): Promise<Response> {
   const inboundContentType = req.headers.get("content-type") ?? "application/octet-stream";
   const inboundBodyOrError = await readRequestBodyCapped(req, LIVE_REQUEST_MAX_BYTES);
   if (inboundBodyOrError instanceof Response) return inboundBodyOrError;
   const inboundBody = inboundBodyOrError;
 
-  const relay = await resolveLiveRelay(req, config, logCtx);
+  const relay = await resolveLiveRelay(req, config, logCtx, turnAdmissionLease);
   if (relay instanceof Response) return relay;
 
   const headers: Record<string, string> = { ...relay.headers };
diff --git a/src/server/responses/compact.ts b/src/server/responses/compact.ts
index 25bfe5a4d..38d9fa978 100644
--- a/src/server/responses/compact.ts
+++ b/src/server/responses/compact.ts
@@ -42,9 +42,11 @@ import { createAdapterEventQueue, preflightAdapterEvents } from "../../adapters/
 import {
   applyCodexAuthContextToProvider,
   CodexAccountCooldownError,
+  codexMainProfileDrainingResponse,
   cooldownErrorResponse,
   CodexAuthContextError,
   CodexDirectAuthenticationError,
+  CodexMainProfileDrainingError,
   CodexPoolAuthenticationError,
   CodexThreadAffinityExpiredError,
   headersForCodexAuthContext,
@@ -72,7 +74,8 @@ import { hasKeyPoolFailover, rotateProviderTransportOn429 } from "../../provider
 import { shouldAttemptImageTierRetry } from "../image-retry";
 import { resolveProviderTransport } from "../../providers/xai-transport";
 import type { WsData } from "../ws-bridge";
-import { registerTurn, trackStreamLifetime, unregisterTurn } from "../lifecycle";
+import { codexAccountSelectionForTurn, registerTurn, trackStreamLifetime, unregisterTurn } from "../lifecycle";
+import type { AdmissionLease } from "../../lib/admission";
 import { redactSecretString } from "../../lib/redact";
 import { readBoundedResponseBody } from "../../lib/bounded-body";
 import { supportedLadderFor } from "../effort-policy";
@@ -162,6 +165,7 @@ export async function handleResponsesCompact(
   req: Request,
   config: OcxConfig,
   logCtx: RequestLogContext,
+  turnAdmissionLease?: AdmissionLease,
 ): Promise<Response> {
   let body: unknown;
   try {
@@ -218,7 +222,10 @@ export async function handleResponsesCompact(
     const headers = new Headers({ "content-type": "application/json" });
     try {
       if (route.codexAccountMode) {
-        authCtx = await resolveCodexAuthContext(req.headers, config, route.codexAccountMode, { modelId: selectedModelId });
+        authCtx = await resolveCodexAuthContext(req.headers, config, route.codexAccountMode, {
+          modelId: selectedModelId,
+          beginCodexAccountSelection: codexAccountSelectionForTurn(turnAdmissionLease),
+        });
         const selected = headersForCodexAuthContext(req.headers, authCtx);
         compactProvider = applyCodexAuthContextToProvider(route.provider, authCtx, route.codexAccountMode);
         for (const name of FORWARD_HEADERS) {
@@ -235,6 +242,7 @@ export async function handleResponsesCompact(
       if (err instanceof CodexAccountCooldownError) {
         return cooldownErrorResponse(err);
       }
+      if (err instanceof CodexMainProfileDrainingError) return codexMainProfileDrainingResponse();
       if (err instanceof CodexThreadAffinityExpiredError) {
         return formatErrorResponse(409, "invalid_request_error", "Codex thread account affinity expired; start a new session");
       }
@@ -337,7 +345,7 @@ export async function handleResponsesCompact(
     headers: internalHeaders,
     body: JSON.stringify(internalBody),
   });
-  const response = await handleResponses(internalReq, config, logCtx, { abortSignal: req.signal });
+  const response = await handleResponses(internalReq, config, logCtx, { abortSignal: req.signal, turnAdmissionLease });
   if (!response.ok) return response;
   let json: { output?: unknown[]; status?: unknown; error?: unknown };
   try {
diff --git a/src/server/responses/core.ts b/src/server/responses/core.ts
index 3577d85fd..63a6b14cb 100644
--- a/src/server/responses/core.ts
+++ b/src/server/responses/core.ts
@@ -64,9 +64,11 @@ import { createAdapterEventQueue, preflightAdapterEvents } from "../../adapters/
 import {
   applyCodexAuthContextToProvider,
   CodexAccountCooldownError,
+  codexMainProfileDrainingResponse,
   cooldownErrorResponse,
   CodexAuthContextError,
   CodexDirectAuthenticationError,
+  CodexMainProfileDrainingError,
   CodexPoolAuthenticationError,
   CodexThreadAffinityExpiredError,
   headersForCodexAuthContext,
@@ -100,7 +102,7 @@ import { hasKeyPoolFailover, rotateProviderTransportOn429 } from "../../provider
 import { shouldAttemptImageTierRetry } from "../image-retry";
 import { resolveProviderTransport } from "../../providers/xai-transport";
 import type { WsData } from "../ws-bridge";
-import { registerTurn, trackStreamLifetime, unregisterTurn } from "../lifecycle";
+import { codexAccountSelectionForTurn, registerTurn, trackStreamLifetime, unregisterTurn } from "../lifecycle";
 import { redactSecretString } from "../../lib/redact";
 import { readBoundedResponseBody } from "../../lib/bounded-body";
 import type { AdmissionLease } from "../../lib/admission";
@@ -265,6 +267,7 @@ interface CodexPoolAccountRetryArgs {
     // first attempt.
     inboundWire?: InboundWire;
     translatorBudget: TranslatorBudget;
+    turnAdmissionLease?: AdmissionLease;
   };
   firstAuthCtx: Extract<CodexAuthContext, { kind: "pool" | "main-pool" }>;
   firstResponse: Response;
@@ -333,13 +336,18 @@ async function retryCodexPoolOnAlternateAccount(
       req.headers,
       config,
       "pool",
-      { excludeAccountId: firstAuthCtx.accountId, modelId: route.modelId },
+      {
+        excludeAccountId: firstAuthCtx.accountId,
+        modelId: route.modelId,
+        beginCodexAccountSelection: codexAccountSelectionForTurn(options.turnAdmissionLease),
+      },
     );
   } catch (error) {
     if (
       !(error instanceof CodexPoolAuthenticationError)
       && !(error instanceof CodexAuthContextError)
       && !(error instanceof CodexAccountCooldownError)
+      && !(error instanceof CodexMainProfileDrainingError)
     ) throw error;
   }
   if (retryAuthCtx?.kind !== "pool" && retryAuthCtx?.kind !== "main-pool") {
@@ -727,7 +735,10 @@ async function resolveResponsesCodexAuth(
     if (route.codexAccountMode === "direct") validateForwardAdmissionCredential(req.headers, config);
     let authCtx: CodexAuthContext;
     if (route.codexAccountMode) {
-      authCtx = await resolveCodexAuthContext(req.headers, config, route.codexAccountMode, { modelId: route.modelId });
+      authCtx = await resolveCodexAuthContext(req.headers, config, route.codexAccountMode, {
+        modelId: route.modelId,
+        beginCodexAccountSelection: codexAccountSelectionForTurn(options.turnAdmissionLease),
+      });
       options.onCodexAuthContextResolved?.(authCtx);
     } else {
       authCtx = { kind: "main", accountId: null };
@@ -749,6 +760,9 @@ async function resolveResponsesCodexAuth(
     if (err instanceof CodexAccountCooldownError) {
       return { ok: false, response: cooldownErrorResponse(err) };
     }
+    if (err instanceof CodexMainProfileDrainingError) {
+      return { ok: false, response: codexMainProfileDrainingResponse() };
+    }
     if (err instanceof CodexThreadAffinityExpiredError) {
       return {
         ok: false,
@@ -1519,6 +1533,7 @@ async function handleResponsesInner(
         listOpenAiForwardSidecarCandidates(config),
         req.headers,
         config,
+        { beginCodexAccountSelection: codexAccountSelectionForTurn(options.turnAdmissionLease) },
       );
     } catch (err) {
       // Sidecars are optional helpers for an otherwise independent routed turn.
@@ -1529,6 +1544,7 @@ async function handleResponsesInner(
         && !(err instanceof CodexAuthContextError)
         && !(err instanceof CodexAccountCooldownError)
         && !(err instanceof CodexThreadAffinityExpiredError)
+        && !(err instanceof CodexMainProfileDrainingError)
       ) throw err;
     }
   }
diff --git a/src/server/search.ts b/src/server/search.ts
index 0e6767c13..935597399 100644
--- a/src/server/search.ts
+++ b/src/server/search.ts
@@ -11,8 +11,10 @@
 import { formatErrorResponse } from "../bridge";
 import {
   CodexAccountCooldownError,
+  codexMainProfileDrainingResponse,
   cooldownErrorResponse,
   CodexAuthContextError,
+  CodexMainProfileDrainingError,
   CodexPoolAuthenticationError,
   CodexThreadAffinityExpiredError,
 } from "../codex/auth-context";
@@ -25,6 +27,8 @@ import { readJsonRequestBody } from "./request-decompress";
 import { ForwardAdmissionCredentialError, validateForwardAdmissionCredential } from "./auth-cors";
 import type { RequestLogContext } from "./request-log";
 import { codexLogAccountId, decodeRequestErrorResponse } from "./responses";
+import type { AdmissionLease } from "../lib/admission";
+import { codexAccountSelectionForTurn } from "./lifecycle";
 
 /**
  * Default TOTAL deadline for one search relay. alpha/search is non-streaming JSON — response
@@ -40,6 +44,7 @@ export async function handleSearch(
   req: Request,
   config: OcxConfig,
   logCtx: RequestLogContext,
+  turnAdmissionLease?: AdmissionLease,
 ): Promise<Response> {
   try { validateForwardAdmissionCredential(req.headers, config); }
   catch (err) {
@@ -67,7 +72,9 @@ export async function handleSearch(
 
   let upstream: Awaited<ReturnType<typeof resolveFirstUsableOpenAiSidecar>>;
   try {
-    upstream = await resolveFirstUsableOpenAiSidecar(candidates, req.headers, config);
+    upstream = await resolveFirstUsableOpenAiSidecar(candidates, req.headers, config, {
+      beginCodexAccountSelection: codexAccountSelectionForTurn(turnAdmissionLease),
+    });
     if (!upstream) {
       return formatErrorResponse(
         401,
@@ -80,6 +87,7 @@ export async function handleSearch(
     if (err instanceof CodexAccountCooldownError) {
       return cooldownErrorResponse(err);
     }
+    if (err instanceof CodexMainProfileDrainingError) return codexMainProfileDrainingResponse();
     if (err instanceof CodexThreadAffinityExpiredError) {
       return formatErrorResponse(409, "invalid_request_error", "Codex thread account affinity expired; start a new session");
     }
diff --git a/tests/native-profile-api.test.ts b/tests/native-profile-api.test.ts
index 0f1225eec..a5d2c8ad3 100644
--- a/tests/native-profile-api.test.ts
+++ b/tests/native-profile-api.test.ts
@@ -5,7 +5,11 @@ import type { OcxConfig } from "../src/types";
 import { handleNativeProfileAPI } from "../src/codex/native-profile-api";
 import type { NativeProfileManager } from "../src/codex/native-profile-manager";
 import { NativeProfileError } from "../src/codex/native-profile-types";
-import { resetLifecycleDrainStateForTests, setDraining, tryAdmitTurn } from "../src/server/lifecycle";
+import {
+  codexAccountSelectionForTurn,
+  resetLifecycleDrainStateForTests,
+  tryAdmitTurn,
+} from "../src/server/lifecycle";
 import {
   blockNativeMainRecovery,
   completeNativeMainRecovery,
@@ -22,19 +26,42 @@ afterEach(() => {
 });
 
 describe("native main profile management API", () => {
-  test("the shared admission gate rejects new turns during a native-profile drain", () => {
-    setDraining(true);
-    expect(tryAdmitTurn()).toBeNull();
-
-    setDraining(false);
-    const lease = tryAdmitTurn();
-    expect(lease).not.toBeNull();
-    lease?.release();
+  test("long Direct/non-main work does not block switch while new main selection is fenced", async () => {
+    const longPoolTurn = tryAdmitTurn();
+    expect(longPoolTurn).not.toBeNull();
+    let checkedScopedAdmission = false;
+    const manager = {
+      switch: async () => {
+        const directOrPoolTurn = tryAdmitTurn();
+        expect(directOrPoolTurn).not.toBeNull();
+        const selection = codexAccountSelectionForTurn(directOrPoolTurn!)!();
+        expect(selection?.mainProfileDraining).toBe(true);
+        expect(selection?.claimMainProfile()).toBe(false);
+        selection?.release();
+        directOrPoolTurn?.release();
+        checkedScopedAdmission = true;
+        return { ok: true };
+      },
+    } as unknown as NativeProfileManager;
+    const request = new Request("http://localhost/api/native-main-profiles/switch", {
+      method: "POST",
+      body: JSON.stringify({ target: "target", confirmedStopped: true }),
+    });
+    try {
+      const response = await handleNativeProfileAPI(request, new URL(request.url), {} as OcxConfig, { manager });
+      expect(response?.status).toBe(200);
+      expect(checkedScopedAdmission).toBe(true);
+    } finally {
+      longPoolTurn?.release();
+    }
   });
 
   test("real drain timeout leaves an admitted HTTP response live and never enters switch", async () => {
     const lease = tryAdmitTurn();
     expect(lease).not.toBeNull();
+    const selection = codexAccountSelectionForTurn(lease!)!();
+    expect(selection?.claimMainProfile()).toBe(true);
+    selection?.release();
     let switched = 0;
     const manager = { switch: async () => { switched += 1; return { ok: true }; } } as unknown as NativeProfileManager;
     const request = new Request("http://localhost/api/native-main-profiles/switch", {
@@ -57,6 +84,9 @@ describe("native main profile management API", () => {
   test("stale HTTP/Responses-WebSocket work settles before switch and new turns stay fenced", async () => {
     const oldTurn = tryAdmitTurn();
     expect(oldTurn).not.toBeNull();
+    const oldSelection = codexAccountSelectionForTurn(oldTurn!)!();
+    expect(oldSelection?.claimMainProfile()).toBe(true);
+    oldSelection?.release();
     const order: string[] = [];
     let slept = false;
     let after: ReturnType<typeof tryAdmitTurn> = null;
@@ -74,7 +104,13 @@ describe("native main profile management API", () => {
         sleep: async () => {
           if (slept) return Bun.sleep(1);
           slept = true;
-          expect(tryAdmitTurn()).toBeNull();
+          const concurrentPool = tryAdmitTurn();
+          expect(concurrentPool).not.toBeNull();
+          const concurrentSelection = codexAccountSelectionForTurn(concurrentPool!)!();
+          expect(concurrentSelection?.mainProfileDraining).toBe(true);
+          expect(concurrentSelection?.claimMainProfile()).toBe(false);
+          concurrentSelection?.release();
+          concurrentPool?.release();
           order.push("old-http-or-ws-response-finished");
           oldTurn?.release();
         },
@@ -192,7 +228,13 @@ describe("native main profile management API", () => {
         return () => states.shift() ?? "none";
       })(),
       completeRecovery: id => {
-        completedWhileDraining = tryAdmitTurn() === null;
+        const turn = tryAdmitTurn();
+        const selection = codexAccountSelectionForTurn(turn!)!();
+        completedWhileDraining = turn !== null
+          && selection?.mainProfileDraining === true
+          && selection.claimMainProfile() === false;
+        selection?.release();
+        turn?.release();
         return completeNativeMainRecovery(id);
       },
     });
diff --git a/tests/native-profile-drain-server.test.ts b/tests/native-profile-drain-server.test.ts
new file mode 100644
index 000000000..0b6755001
--- /dev/null
+++ b/tests/native-profile-drain-server.test.ts
@@ -0,0 +1,154 @@
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { resetMainCodexAccountIdentityTrackingForTests } from "../src/codex/account-lifecycle";
+import { MAIN_CODEX_ACCOUNT_ID } from "../src/codex/account-id";
+import { clearMainAccountInfoCache } from "../src/codex/main-account-cache";
+import { clearAccountQuota, updateAccountQuota } from "../src/codex/quota";
+import { clearThreadAccountMap } from "../src/codex/routing";
+import { saveConfig } from "../src/config";
+import { startServer } from "../src/server";
+import {
+  acquireNativeMainProfileDrain,
+  resetLifecycleDrainStateForTests,
+} from "../src/server/lifecycle";
+import type { OcxConfig } from "../src/types";
+
+const originalFetch = globalThis.fetch;
+const previousOpencodexHome = process.env.OPENCODEX_HOME;
+const previousCodexHome = process.env.CODEX_HOME;
+let opencodexHome = "";
+let codexHome = "";
+
+beforeEach(() => {
+  opencodexHome = mkdtempSync(join(tmpdir(), "ocx-main-drain-server-"));
+  codexHome = mkdtempSync(join(tmpdir(), "ocx-main-drain-codex-"));
+  process.env.OPENCODEX_HOME = opencodexHome;
+  process.env.CODEX_HOME = codexHome;
+  writeFileSync(
+    join(codexHome, "auth.json"),
+    JSON.stringify({ tokens: { access_token: "main-access", account_id: "main-account" } }),
+  );
+  clearAccountQuota();
+  clearThreadAccountMap();
+  clearMainAccountInfoCache();
+  resetMainCodexAccountIdentityTrackingForTests();
+  resetLifecycleDrainStateForTests();
+});
+
+afterEach(() => {
+  globalThis.fetch = originalFetch;
+  resetLifecycleDrainStateForTests();
+  clearAccountQuota();
+  clearThreadAccountMap();
+  clearMainAccountInfoCache();
+  resetMainCodexAccountIdentityTrackingForTests();
+  if (opencodexHome) rmSync(opencodexHome, { recursive: true, force: true });
+  if (codexHome) rmSync(codexHome, { recursive: true, force: true });
+  if (previousOpencodexHome === undefined) delete process.env.OPENCODEX_HOME;
+  else process.env.OPENCODEX_HOME = previousOpencodexHome;
+  if (previousCodexHome === undefined) delete process.env.CODEX_HOME;
+  else process.env.CODEX_HOME = previousCodexHome;
+});
+
+describe("native main profile scoped server admission", () => {
+  test("HTTP and Responses WebSocket keep Direct live while main Pool frames are rejected", async () => {
+    let upstreamRequests = 0;
+    globalThis.fetch = (async (input: RequestInfo | URL, init?: RequestInit) => {
+      const url = typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
+      if (url.includes("chatgpt.com/backend-api/codex/responses")) {
+        upstreamRequests += 1;
+        return new Response(
+          'event: response.completed\ndata: {"type":"response.completed","response":{"id":"r","status":"completed","output":[]}}\n\n',
+          { headers: { "content-type": "text/event-stream" } },
+        );
+      }
+      return originalFetch(input, init);
+    }) as typeof fetch;
+    const saveMode = (codexAccountMode: "direct" | "pool") => saveConfig({
+      port: 0,
+      defaultProvider: "openai",
+      openaiProviderTierVersion: 2,
+      websockets: true,
+      providers: {
+        openai: {
+          adapter: "openai-responses",
+          baseUrl: "https://chatgpt.com/backend-api/codex",
+          authMode: "forward",
+          codexAccountMode,
+        },
+      },
+      codexAccounts: [],
+      activeCodexAccountId: MAIN_CODEX_ACCOUNT_ID,
+      autoSwitchThreshold: 0,
+    } as OcxConfig);
+    const waitForFrame = (ws: WebSocket, needle: string) => new Promise<string>((resolve, reject) => {
+      const timer = setTimeout(() => reject(new Error(`websocket timeout waiting for ${needle}`)), 2_000);
+      const onMessage = (event: MessageEvent) => {
+        const text = typeof event.data === "string" ? event.data : "";
+        if (!text.includes(needle)) return;
+        clearTimeout(timer);
+        ws.removeEventListener("message", onMessage);
+        resolve(text);
+      };
+      ws.addEventListener("message", onMessage);
+    });
+
+    saveMode("direct");
+    let server: ReturnType<typeof startServer> | undefined = startServer(0);
+    const drain = acquireNativeMainProfileDrain("test-switch");
+    expect(drain).not.toBeNull();
+    try {
+      const directHttp = await fetch(new URL("/v1/responses", server.url), {
+        method: "POST",
+        headers: { "content-type": "application/json", authorization: "Bearer caller-token" },
+        body: JSON.stringify({ model: "gpt-test", input: "hello", stream: true }),
+      });
+      expect(directHttp.status).toBe(200);
+      await directHttp.text();
+
+      const wsUrl = new URL("/v1/responses", server.url);
+      wsUrl.protocol = "ws:";
+      const directWs = new WebSocket(wsUrl, { headers: { authorization: "Bearer caller-token" } } as unknown as string[]);
+      await new Promise<void>((resolve, reject) => {
+        directWs.addEventListener("open", () => resolve(), { once: true });
+        directWs.addEventListener("error", () => reject(new Error("websocket failed to open")), { once: true });
+      });
+      const directTerminal = waitForFrame(directWs, "response.completed");
+      directWs.send(JSON.stringify({ type: "response.create", model: "gpt-test", input: "hello" }));
+      await directTerminal;
+      directWs.close();
+      await server.stop(true);
+      server = undefined;
+
+      saveMode("pool");
+      updateAccountQuota(MAIN_CODEX_ACCOUNT_ID, 1, 1);
+      server = startServer(0);
+      const mainHttp = await fetch(new URL("/v1/responses", server.url), {
+        method: "POST",
+        headers: { "content-type": "application/json", authorization: "Bearer caller-token" },
+        body: JSON.stringify({ model: "gpt-test", input: "hello", stream: false }),
+      });
+      expect(mainHttp.status).toBe(503);
+      expect(mainHttp.headers.get("retry-after")).toBe("1");
+
+      const mainWsUrl = new URL("/v1/responses", server.url);
+      mainWsUrl.protocol = "ws:";
+      const mainWs = new WebSocket(mainWsUrl, { headers: { authorization: "Bearer caller-token" } } as unknown as string[]);
+      await new Promise<void>((resolve, reject) => {
+        mainWs.addEventListener("open", () => resolve(), { once: true });
+        mainWs.addEventListener("error", () => reject(new Error("websocket failed to open")), { once: true });
+      });
+      const mainRejected = waitForFrame(mainWs, "main profile is switching");
+      mainWs.send(JSON.stringify({ type: "response.create", model: "gpt-test", input: "hello" }));
+      expect(await mainRejected).toContain("503");
+      mainWs.close();
+
+      expect(upstreamRequests).toBe(2);
+    } finally {
+      drain?.release();
+      await server?.stop(true);
+    }
+  });
+});
diff --git a/tests/shutdown-drain.test.ts b/tests/shutdown-drain.test.ts
index 5d2232d76..0898aa8c8 100644
--- a/tests/shutdown-drain.test.ts
+++ b/tests/shutdown-drain.test.ts
@@ -15,10 +15,13 @@ import {
 } from "../src/server";
 import {
   acquireTemporaryDrain,
+  acquireNativeMainProfileDrain,
   activeRegistryMetrics,
   beginShutdownDrain,
   resetLifecycleDrainStateForTests,
   tryAdmitTurn,
+  codexAccountSelectionForTurn,
+  getNativeMainProfileRequestCount,
 } from "../src/server/lifecycle";
 import {
   backgroundShellAdmissionMetrics,
@@ -90,9 +93,46 @@ describe("active turn tracking", () => {
   test("shutdown first rejects profile leases and remains latched after scoped release attempts", () => {
     expect(beginShutdownDrain()).toBe(true);
     expect(acquireTemporaryDrain("native-profile")).toBeNull();
+    expect(acquireNativeMainProfileDrain("native-main-profile")).toBeNull();
     expect(isDraining()).toBe(true);
   });
 
+  test("terminal shutdown dominates a native-main scoped drain and prevents all new traffic", () => {
+    const profileLease = acquireNativeMainProfileDrain("native-main-profile");
+    expect(profileLease).not.toBeNull();
+    expect(isDraining()).toBe(false);
+    const admitted = tryAdmitTurn();
+    expect(admitted).not.toBeNull();
+    const selection = codexAccountSelectionForTurn(admitted!)!();
+    expect(selection?.mainProfileDraining).toBe(true);
+    expect(selection?.claimMainProfile()).toBe(false);
+    selection?.release();
+    admitted?.release();
+
+    expect(beginShutdownDrain()).toBe(true);
+    expect(tryAdmitTurn()).toBeNull();
+    expect(acquireNativeMainProfileDrain("second-switch")).toBeNull();
+    profileLease?.release();
+    expect(isDraining()).toBe(true);
+  });
+
+  test("a pre-fence selector atomically converts to main turn ownership", () => {
+    const turn = tryAdmitTurn();
+    const selection = codexAccountSelectionForTurn(turn!)!();
+    expect(selection?.mainProfileDraining).toBe(false);
+    expect(getNativeMainProfileRequestCount()).toBe(1);
+
+    const profileLease = acquireNativeMainProfileDrain("native-main-profile");
+    expect(profileLease).not.toBeNull();
+    expect(selection?.claimMainProfile()).toBe(true);
+    selection?.release();
+    expect(getNativeMainProfileRequestCount()).toBe(1);
+
+    turn?.release();
+    expect(getNativeMainProfileRequestCount()).toBe(0);
+    profileLease?.release();
+  });
+
   test("deadline forces shutdown past a never-releasing profile lease and keeps the latch terminal", async () => {
     const profileLease = acquireTemporaryDrain("native-profile");
     expect(profileLease).not.toBeNull();

From 8a79d73abaa433c32ebc32451977717459806ccd Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Sun, 2 Aug 2026 17:32:04 +0900
Subject: [PATCH 29/63] fix(codex): zeroize doctor and keyring secrets

---
 src/codex/native-profile-manager.ts  |  82 ++++++++++---------
 src/codex/native-profile-store.ts    |  62 ++++++++++++---
 tests/native-profile-manager.test.ts |  22 ++++++
 tests/native-profile-store.test.ts   | 114 +++++++++++++++++++++++++++
 4 files changed, 230 insertions(+), 50 deletions(-)

diff --git a/src/codex/native-profile-manager.ts b/src/codex/native-profile-manager.ts
index fc8f40e5b..df35d3145 100644
--- a/src/codex/native-profile-manager.ts
+++ b/src/codex/native-profile-manager.ts
@@ -62,6 +62,7 @@ type AtomicWriter = (path: string, content: string) => Promise<void>;
 type TransitionApplier = (fromAccountId: string, toAccountId: string) => void;
 type EnvelopeReader = (path: string) => NativeEnvelopeSnapshot;
 type VaultReader = () => NativeMainProfileVaultV1 | null;
+type EnvelopeResultReader = (path: string) => ReturnType<typeof readNativeEnvelopeResult>;
 export type NativeProfileSwitchBoundary =
   | "journal-prepared"
   | "auth-replaced"
@@ -88,6 +89,7 @@ export interface NativeProfileManagerOptions {
   /** Test-only reader seams; production uses the native profile store directly. */
   readEnvelope?: EnvelopeReader;
   readVault?: VaultReader;
+  readEnvelopeResult?: EnvelopeResultReader;
 }
 
 export interface NativeProfileListResult {
@@ -124,6 +126,7 @@ export class NativeProfileManager {
   private readonly onSwitchBoundary: (boundary: NativeProfileSwitchBoundary) => void | Promise<void>;
   private readonly readEnvelope: EnvelopeReader;
   private readonly readVault: VaultReader;
+  private readonly readEnvelopeResult: EnvelopeResultReader;
 
   constructor(options: NativeProfileManagerOptions = {}) {
     this.context = resolveNativeProfileContext(options);
@@ -141,6 +144,7 @@ export class NativeProfileManager {
     this.onSwitchBoundary = options.onSwitchBoundary ?? (() => {});
     this.readEnvelope = options.readEnvelope ?? readNativeEnvelope;
     this.readVault = options.readVault ?? (() => readNativeProfileVault(this.context));
+    this.readEnvelopeResult = options.readEnvelopeResult ?? readNativeEnvelopeResult;
   }
 
   private async ensureRoot(): Promise<void> {
@@ -414,46 +418,50 @@ export class NativeProfileManager {
     const mode = (() => {
       try { return resolveNativeCredentialStoreMode(this.context); } catch { return "unknown"; }
     })();
-    const auth = readNativeEnvelopeResult(this.context.authPath);
-    let vault: NativeMainProfileVaultV1 | null = null;
-    let vaultStatus: "ok" | "missing" | "invalid" = "missing";
+    const auth = this.readEnvelopeResult(this.context.authPath);
     try {
-      vault = readNativeProfileVault(this.context);
-      vaultStatus = vault ? "ok" : "missing";
-    } catch {
-      vaultStatus = "invalid";
-    }
-    let keyStore: "available" | "missing-key" | "unavailable" = "available";
-    try {
-      const key = await this.keyProvider.get(this.context.homeId);
-      if (vaultStatus !== "missing" && !key) keyStore = "missing-key";
-      if (key) key.key.fill(0);
-    } catch {
-      keyStore = "unavailable";
-    }
-    let stagingCount: number | null = 0;
-    try {
-      if (existsSync(this.context.stagingRoot)) {
-        stagingCount = Array.from(new Bun.Glob("*").scanSync({ cwd: this.context.stagingRoot, onlyFiles: false })).length;
+      let vault: NativeMainProfileVaultV1 | null = null;
+      let vaultStatus: "ok" | "missing" | "invalid" = "missing";
+      try {
+        vault = this.readVault();
+        vaultStatus = vault ? "ok" : "missing";
+      } catch {
+        vaultStatus = "invalid";
       }
-    } catch {
-      stagingSweep = "unreadable";
-      stagingCount = null;
+      let keyStore: "available" | "missing-key" | "unavailable" = "available";
+      try {
+        const key = await this.keyProvider.get(this.context.homeId);
+        if (vaultStatus !== "missing" && !key) keyStore = "missing-key";
+        if (key) key.key.fill(0);
+      } catch {
+        keyStore = "unavailable";
+      }
+      let stagingCount: number | null = 0;
+      try {
+        if (existsSync(this.context.stagingRoot)) {
+          stagingCount = Array.from(new Bun.Glob("*").scanSync({ cwd: this.context.stagingRoot, onlyFiles: false })).length;
+        }
+      } catch {
+        stagingSweep = "unreadable";
+        stagingCount = null;
+      }
+      return {
+        effectiveCodexHome: this.context.codexHome,
+        credentialStoreMode: mode,
+        supported: mode === "file",
+        authStatus: auth.status,
+        keyStore,
+        vaultStatus,
+        profileCount: vaultStatus === "invalid" ? null : vault?.profiles.length ?? 0,
+        activeProfileId: vault?.activeProfileId ?? null,
+        recoveryPending: probeNativeProfileRecoveryState(this.context) !== "none",
+        recoveryState: probeNativeProfileRecoveryState(this.context),
+        stagingSweep,
+        stagingCount,
+      };
+    } finally {
+      if (auth.status === "ok") auth.envelope.raw.fill(0);
     }
-    return {
-      effectiveCodexHome: this.context.codexHome,
-      credentialStoreMode: mode,
-      supported: mode === "file",
-      authStatus: auth.status,
-      keyStore,
-      vaultStatus,
-      profileCount: vaultStatus === "invalid" ? null : vault?.profiles.length ?? 0,
-      activeProfileId: vault?.activeProfileId ?? null,
-      recoveryPending: probeNativeProfileRecoveryState(this.context) !== "none",
-      recoveryState: probeNativeProfileRecoveryState(this.context),
-      stagingSweep,
-      stagingCount,
-    };
     });
   }
 
diff --git a/src/codex/native-profile-store.ts b/src/codex/native-profile-store.ts
index b4e412a3e..74c526f36 100644
--- a/src/codex/native-profile-store.ts
+++ b/src/codex/native-profile-store.ts
@@ -78,11 +78,40 @@ export type NativeEnvelopeReadResult =
   | { status: "ok"; envelope: NativeEnvelopeSnapshot }
   | { status: "missing" | "invalid" | "unreadable" };
 
+type NativeKeyringSecret = string | Uint8Array | null;
+type NativeKeyringEntry = {
+  getSecret(signal: AbortSignal): Promise<NativeKeyringSecret>;
+  setSecret(secret: Uint8Array, signal: AbortSignal): Promise<void>;
+};
+
+function wipeKeyringSecret(value: NativeKeyringSecret | undefined): void {
+  if (!value || typeof value === "string") return;
+  try { value.fill(0); } catch { /* cleanup must not replace the primary keyring error */ }
+}
+
 export class OsNativeProfileKeyProvider implements NativeProfileKeyProvider {
-  private async entry(homeId: string): Promise<import("@napi-rs/keyring").AsyncEntry> {
+  private readonly entryFactory: (homeId: string) => Promise<NativeKeyringEntry>;
+  private readonly onSecretBufferCreated?: (buffer: Buffer) => void;
+
+  constructor(options: {
+    /** Test-only seam for deterministic keyring cleanup coverage. */
+    entryFactory?: (homeId: string) => Promise<NativeKeyringEntry>;
+    /** Test-only seam for observing internal secret-buffer ownership. */
+    onSecretBufferCreated?: (buffer: Buffer) => void;
+  } = {}) {
+    this.entryFactory = options.entryFactory ?? (homeId => this.entry(homeId));
+    this.onSecretBufferCreated = options.onSecretBufferCreated;
+  }
+
+  private trackSecretBuffer(buffer: Buffer): Buffer {
+    this.onSecretBufferCreated?.(buffer);
+    return buffer;
+  }
+
+  private async entry(homeId: string): Promise<NativeKeyringEntry> {
     try {
       const { AsyncEntry } = await import("@napi-rs/keyring");
-      return new AsyncEntry(KEYRING_SERVICE, homeId);
+      return new AsyncEntry(KEYRING_SERVICE, homeId) as unknown as NativeKeyringEntry;
     } catch {
       throw new NativeProfileError(
         "KEYRING_UNAVAILABLE",
@@ -94,16 +123,18 @@ export class OsNativeProfileKeyProvider implements NativeProfileKeyProvider {
   }
 
   async get(homeId: string): Promise<NativeProfileKey | null> {
+    let secret: NativeKeyringSecret | undefined;
+    let key: Buffer | null = null;
     try {
-      const secret = await (await this.entry(homeId)).getSecret(AbortSignal.timeout(8_000));
+      secret = await (await this.entryFactory(homeId)).getSecret(AbortSignal.timeout(8_000));
       if (!secret) return null;
-      const key = Buffer.from(secret);
+      key = this.trackSecretBuffer(Buffer.from(secret));
       if (key.byteLength !== 32) {
-        key.fill(0);
         throw new NativeProfileError("KEYRING_UNAVAILABLE", "The OS credential-store key is invalid.", 503);
       }
       return { keyRef: `${KEYRING_SERVICE}:${homeId}`, key };
     } catch (error) {
+      if (key) wipeKeyringSecret(key);
       if (error instanceof NativeProfileError) throw error;
       throw new NativeProfileError(
         "KEYRING_UNAVAILABLE",
@@ -111,25 +142,28 @@ export class OsNativeProfileKeyProvider implements NativeProfileKeyProvider {
         503,
         true,
       );
+    } finally {
+      wipeKeyringSecret(secret);
     }
   }
 
   async create(homeId: string): Promise<NativeProfileKey> {
     const existing = await this.get(homeId);
     if (existing) return existing;
-    const key = randomBytes(32);
+    const key = this.trackSecretBuffer(randomBytes(32));
+    let stored: NativeKeyringSecret | undefined;
+    let verified: Buffer | null = null;
     try {
-      const entry = await this.entry(homeId);
+      const entry = await this.entryFactory(homeId);
       await entry.setSecret(key, AbortSignal.timeout(8_000));
-      const stored = await entry.getSecret(AbortSignal.timeout(8_000));
-      const verified = stored ? Buffer.from(stored) : null;
+      stored = await entry.getSecret(AbortSignal.timeout(8_000));
+      verified = stored ? this.trackSecretBuffer(Buffer.from(stored)) : null;
       if (!verified || verified.byteLength !== key.byteLength || !timingSafeEqual(verified, key)) {
-        verified?.fill(0);
         throw new NativeProfileError("KEYRING_UNAVAILABLE", "The OS credential-store key could not be verified.", 503);
       }
-      verified.fill(0);
-      return { keyRef: `${KEYRING_SERVICE}:${homeId}`, key: Buffer.from(key) };
+      return { keyRef: `${KEYRING_SERVICE}:${homeId}`, key: this.trackSecretBuffer(Buffer.from(key)) };
     } catch (error) {
+      wipeKeyringSecret(verified);
       if (error instanceof NativeProfileError) throw error;
       throw new NativeProfileError(
         "KEYRING_UNAVAILABLE",
@@ -138,7 +172,9 @@ export class OsNativeProfileKeyProvider implements NativeProfileKeyProvider {
         true,
       );
     } finally {
-      key.fill(0);
+      wipeKeyringSecret(stored);
+      wipeKeyringSecret(verified ?? undefined);
+      wipeKeyringSecret(key);
     }
   }
 }
diff --git a/tests/native-profile-manager.test.ts b/tests/native-profile-manager.test.ts
index 23b6845fc..d0c71ef03 100644
--- a/tests/native-profile-manager.test.ts
+++ b/tests/native-profile-manager.test.ts
@@ -8,6 +8,7 @@ import {
   MAX_NATIVE_PROFILE_JOURNAL_BYTES,
   MAX_NATIVE_PROFILE_METADATA_BYTES,
   readNativeEnvelope,
+  readNativeEnvelopeResult,
   probeNativeProfileRecoveryState,
   readNativeProfileVault,
   type NativeEnvelopeSnapshot,
@@ -913,6 +914,27 @@ describe("native main profile transactions", () => {
     for (const key of f.keyProvider.issuedKeys.slice(issuedBefore)) expectZeroized(key);
   });
 
+  test("doctor zeroizes a successful auth snapshot across report degradation", async () => {
+    const f = fixture();
+    const captured: NativeEnvelopeSnapshot[] = [];
+    const manager = new NativeProfileManager({
+      ...f.options,
+      readEnvelopeResult: path => {
+        const result = readNativeEnvelopeResult(path);
+        if (result.status === "ok") captured.push(result.envelope);
+        return result;
+      },
+      readVault: () => { throw new Error("injected doctor vault failure"); },
+    });
+
+    const report = await manager.doctor();
+
+    expect(report.authStatus).toBe("ok");
+    expect(report.vaultStatus).toBe("invalid");
+    expect(captured).toHaveLength(1);
+    expectZeroized(captured[0].raw);
+  });
+
   test("non-file Codex credential stores fail before vault or auth mutation", async () => {
     const f = fixture();
     writeFileSync(join(f.codexHome, "config.toml"), 'cli_auth_credentials_store = "auto"\n');
diff --git a/tests/native-profile-store.test.ts b/tests/native-profile-store.test.ts
index 9f6f98274..bea9a370e 100644
--- a/tests/native-profile-store.test.ts
+++ b/tests/native-profile-store.test.ts
@@ -6,6 +6,7 @@ import {
   inspectNativeProfileJournal,
   MAX_NATIVE_PROFILE_JOURNAL_BYTES,
   MAX_NATIVE_PROFILE_METADATA_BYTES,
+  OsNativeProfileKeyProvider,
   readNativeProfileVault,
   serializeNativeProfileJournal,
   type NativeProfileContext,
@@ -60,6 +61,41 @@ function installBoundedReadTestSeam(store: NativeProfileContext, seam: BoundedRe
   (store as NativeProfileContext & { [key: symbol]: unknown })[BOUNDED_READ_TEST_SEAM] = seam;
 }
 
+function expectZeroized(buffer: Buffer): void {
+  expect([...buffer].every(byte => byte === 0)).toBe(true);
+}
+
+class TestKeyringEntry {
+  private written: Buffer | null = null;
+  private getCalls = 0;
+  constructor(
+    private readonly initial: Buffer | null,
+    private readonly readback?: Buffer | null,
+    private readonly readError?: Error,
+    private readonly writeError?: Error,
+  ) {}
+  async setSecret(secret: Uint8Array): Promise<void> {
+    if (this.writeError) throw this.writeError;
+    this.written = Buffer.from(secret);
+  }
+  async getSecret(): Promise<Buffer | null> {
+    if (this.readError) throw this.readError;
+    this.getCalls += 1;
+    if (this.getCalls === 1) return this.initial;
+    return this.readback ?? this.written;
+  }
+}
+
+function keyringProvider(
+  entry: TestKeyringEntry,
+  buffers: Buffer[],
+): OsNativeProfileKeyProvider {
+  return new OsNativeProfileKeyProvider({
+    entryFactory: async () => entry,
+    onSecretBufferCreated: buffer => buffers.push(buffer),
+  });
+}
+
 function payload(identityHash: string): EncryptedNativeEnvelopeV1 {
   return {
     cipher: "aes-256-gcm",
@@ -230,4 +266,82 @@ describe("native-profile recovery journal storage", () => {
     expect(allocations).toEqual([MAX_NATIVE_PROFILE_JOURNAL_BYTES + 1]);
     expect(totalBytesRead).toBe(MAX_NATIVE_PROFILE_JOURNAL_BYTES + 1);
   });
+
+  test("keyring get zeroizes the provider-owned secret after returning a copied key", async () => {
+    const original = Buffer.alloc(32, 0x2a);
+    const buffers: Buffer[] = [];
+    const key = await keyringProvider(new TestKeyringEntry(original), buffers).get(HOME_ID);
+
+    expect(key).not.toBeNull();
+    expectZeroized(original);
+    expect(buffers).toHaveLength(1);
+    expect(buffers[0]).toEqual(key!.key);
+    expect(buffers[0].some(byte => byte !== 0)).toBe(true);
+    key!.key.fill(0);
+    expectZeroized(buffers[0]);
+  });
+
+  test("keyring get zeroizes both original and copy on invalid length", async () => {
+    const original = Buffer.alloc(8, 0x2a);
+    const buffers: Buffer[] = [];
+    let caught: unknown;
+    try { await keyringProvider(new TestKeyringEntry(original), buffers).get(HOME_ID); } catch (error) { caught = error; }
+
+    expect(caught).toBeInstanceOf(NativeProfileError);
+    expect((caught as NativeProfileError).code).toBe("KEYRING_UNAVAILABLE");
+    expectZeroized(original);
+    expect(buffers).toHaveLength(1);
+    expectZeroized(buffers[0]);
+  });
+
+  test("keyring get preserves the mapped error when the provider throws", async () => {
+    const buffers: Buffer[] = [];
+    let caught: unknown;
+    try {
+      await keyringProvider(new TestKeyringEntry(null, null, new Error("injected keyring read")), buffers).get(HOME_ID);
+    } catch (error) { caught = error; }
+
+    expect(caught).toBeInstanceOf(NativeProfileError);
+    expect((caught as NativeProfileError).code).toBe("KEYRING_UNAVAILABLE");
+    expect(buffers).toHaveLength(0);
+  });
+
+  test("keyring create zeroizes originals and verification copies on readback mismatch", async () => {
+    const returned = Buffer.alloc(32, 0x2a);
+    const buffers: Buffer[] = [];
+    let caught: unknown;
+    try { await keyringProvider(new TestKeyringEntry(null, returned), buffers).create(HOME_ID); } catch (error) { caught = error; }
+
+    expect(caught).toBeInstanceOf(NativeProfileError);
+    expect((caught as NativeProfileError).code).toBe("KEYRING_UNAVAILABLE");
+    expectZeroized(returned);
+    expect(buffers.length).toBe(2);
+    for (const buffer of buffers) expectZeroized(buffer);
+  });
+
+  test("keyring create zeroizes its generated key when writing throws", async () => {
+    const buffers: Buffer[] = [];
+    let caught: unknown;
+    try {
+      await keyringProvider(new TestKeyringEntry(null, null, undefined, new Error("injected keyring write")), buffers).create(HOME_ID);
+    } catch (error) { caught = error; }
+
+    expect(caught).toBeInstanceOf(NativeProfileError);
+    expect((caught as NativeProfileError).code).toBe("KEYRING_UNAVAILABLE");
+    expect(buffers).toHaveLength(1);
+    expectZeroized(buffers[0]);
+  });
+
+  test("keyring create preserves copied key ownership on verified success", async () => {
+    const buffers: Buffer[] = [];
+    const created = await keyringProvider(new TestKeyringEntry(null), buffers).create(HOME_ID);
+
+    expect(buffers.length).toBe(3);
+    expectZeroized(buffers[0]);
+    expectZeroized(buffers[1]);
+    expect(created.key).toBe(buffers[2]);
+    expect(created.key.some(byte => byte !== 0)).toBe(true);
+    created.key.fill(0);
+    expectZeroized(buffers[2]);
+  });
 });

From e68b63b008efdb35f008e6fcec3efa5ca33758ba Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Sun, 2 Aug 2026 17:50:48 +0900
Subject: [PATCH 30/63] fix(codex): close native main drain bypasses

---
 src/codex/account-usability.ts            |  22 ++-
 src/codex/auth-context.ts                 |  41 +++--
 src/codex/routing.ts                      | 137 +++++++++++------
 src/codex/subagent-model-fallback.ts      |  20 ++-
 src/server/index.ts                       |  25 ++-
 src/server/live.ts                        |   3 +-
 src/server/responses/core.ts              |  37 +++--
 src/server/ws-bridge.ts                   |   4 +-
 tests/codex-auth-context.test.ts          | 119 +++++++++++++++
 tests/native-profile-api.test.ts          |  11 +-
 tests/native-profile-drain-server.test.ts | 178 ++++++++++++++++++++++
 tests/subagent-model-fallback.test.ts     |  13 ++
 12 files changed, 536 insertions(+), 74 deletions(-)

diff --git a/src/codex/account-usability.ts b/src/codex/account-usability.ts
index b4f9a2493..7036521d0 100644
--- a/src/codex/account-usability.ts
+++ b/src/codex/account-usability.ts
@@ -5,16 +5,32 @@ import { hasLegacyMainCodexPoolAccount, isSelectableCodexPoolAccount } from "./a
 import type { OcxConfig } from "../types";
 import { isNativeMainTrafficBlocked } from "./native-profile-startup";
 
-export function isCodexAccountUsable(config: OcxConfig, accountId: string): boolean {
+export interface CodexAccountUsabilityOptions {
+  /** Route using cached runtime state only; the caller must reject selected main before auth. */
+  nativeMainSelectionOnly?: boolean;
+  /** Test seam for proving whether routing attempted a physical native-token read. */
+  isMainAccountTokenLive?: typeof isMainAccountTokenLive;
+}
+
+export function isCodexAccountUsable(
+  config: OcxConfig,
+  accountId: string,
+  options: CodexAccountUsabilityOptions = {},
+): boolean {
   if (accountId === MAIN_CODEX_ACCOUNT_ID) {
     // Startup recovery owns the physical auth/vault boundary. Never parse or select
     // native __main__ while an encrypted switch journal is pending or inconclusive.
-    if (isNativeMainTrafficBlocked()) return false;
+    if (!options.nativeMainSelectionOnly && isNativeMainTrafficBlocked()) return false;
     // A legacy pool row with the sentinel makes an active `__main__` ambiguous.
     // Fail closed until the authenticated compatibility-delete path removes it.
     if (hasLegacyMainCodexPoolAccount(config.codexAccounts)) return false;
+    if (isAccountNeedsReauth(accountId)) return false;
+    // A selection-only caller owns the recovery/drain fence and will reject main
+    // before reservation or token materialization. Treat cached main as a routing
+    // candidate without touching the credential file so affinity is not rebound.
+    if (options.nativeMainSelectionOnly) return true;
     // Main account: credential is the read-only ~/.codex/auth.json token (Option A).
-    return isMainAccountTokenLive() && !isAccountNeedsReauth(accountId);
+    return (options.isMainAccountTokenLive ?? isMainAccountTokenLive)();
   }
   const exists = (config.codexAccounts ?? [])
     .some(account => isSelectableCodexPoolAccount(account) && account.id === accountId);
diff --git a/src/codex/auth-context.ts b/src/codex/auth-context.ts
index aade1d5f9..7f2dd3ba2 100644
--- a/src/codex/auth-context.ts
+++ b/src/codex/auth-context.ts
@@ -214,6 +214,10 @@ export interface ResolveCodexAuthContextOptions {
   modelId?: string;
   /** Short reservation converted to turn ownership before native `__main__` token materialization. */
   beginCodexAccountSelection?: () => CodexAccountSelectionAdmission | undefined;
+  /** Test-only native credential read seams. */
+  isMainAccountTokenLive?: () => boolean;
+  getMainAccountToken?: typeof getMainAccountToken;
+  primeCodexPoolQuotas?: (config: OcxConfig, reason: string) => Promise<void>;
 }
 
 export interface CodexAccountSelectionAdmission {
@@ -236,30 +240,45 @@ export async function resolveCodexAuthContext(
   // Preserve the explicit main selection while startup recovery is pending. Letting
   // normal strategy resolution run would demote/mutate it before recovery can reopen
   // the same physical account. Pool-active configurations never enter this branch.
-  if (isNativeMainTrafficBlocked() && config.activeCodexAccountId === MAIN_CODEX_ACCOUNT_ID) {
+  const nativeMainTrafficBlocked = isNativeMainTrafficBlocked();
+  if (nativeMainTrafficBlocked && config.activeCodexAccountId === MAIN_CODEX_ACCOUNT_ID) {
     throw new CodexPoolAuthenticationError();
   }
   const selectionAdmission = options.beginCodexAccountSelection?.();
+  const nativeMainReadsForbidden = nativeMainTrafficBlocked || selectionAdmission?.mainProfileDraining === true;
+  const selectionOptions = {
+    nativeMainSelectionOnly: nativeMainReadsForbidden,
+    isMainAccountTokenLive: options.isMainAccountTokenLive,
+  };
   let accountId: string;
   const quotaScope = codexQuotaScopeForModel(options.modelId);
   try {
     // A pre-drain selector reserves the native identity while reconciliation and
     // routing inspect it. Selectors arriving after the fence skip reconciliation
     // and may still route to non-main pool accounts without touching switch state.
-    if (!selectionAdmission?.mainProfileDraining) reconcileMainCodexAccountRuntimeState();
+    if (!nativeMainReadsForbidden) reconcileMainCodexAccountRuntimeState();
     const threadId = headers.get("x-codex-parent-thread-id");
     const resolution = options.excludeAccountId
       ? (() => {
-          const selected = pickAlternateCodexAccount(config, options.excludeAccountId!, Date.now(), quotaScope);
+          const selected = pickAlternateCodexAccount(
+            config,
+            options.excludeAccountId!,
+            Date.now(),
+            quotaScope,
+            selectionOptions,
+          );
           return selected
             ? { status: "selected" as const, accountId: selected }
             : { status: "none" as const };
         })()
-      : resolveCodexAccountForThreadDetailed(threadId, config, Date.now(), quotaScope);
+      : resolveCodexAccountForThreadDetailed(threadId, config, Date.now(), quotaScope, selectionOptions);
     if (resolution.status === "expired") throw new CodexThreadAffinityExpiredError(resolution.accountId);
     const selected = resolution.status === "selected" ? resolution.accountId : null;
     if (!selected) throw new CodexPoolAuthenticationError();
     accountId = selected;
+    if (accountId === MAIN_CODEX_ACCOUNT_ID && nativeMainTrafficBlocked) {
+      throw new CodexPoolAuthenticationError();
+    }
     if (
       accountId === MAIN_CODEX_ACCOUNT_ID
       && selectionAdmission
@@ -275,10 +294,14 @@ export async function resolveCodexAuthContext(
   // best-effort prime so the NEXT routing decision has real scores. This never
   // blocks the current request, and the helper's single-flight guard collapses
   // repeated triggers into one pass.
-  if (!getAccountQuota(accountId)) {
-    import("./auth-api")
-      .then(({ primeCodexPoolQuotas }) => primeCodexPoolQuotas(config, "pre-route"))
-      .catch(() => {});
+  if (!nativeMainReadsForbidden && !getAccountQuota(accountId)) {
+    if (options.primeCodexPoolQuotas) {
+      void options.primeCodexPoolQuotas(config, "pre-route").catch(() => {});
+    } else {
+      import("./auth-api")
+        .then(({ primeCodexPoolQuotas }) => primeCodexPoolQuotas(config, "pre-route"))
+        .catch(() => {});
+    }
   }
   // Snapshot (not just the deadline) so a refused request can report WHY it is cooled:
   // a literal Retry-After reads very differently to a user than a reset-derived guess.
@@ -301,7 +324,7 @@ export async function resolveCodexAuthContext(
 
   if (accountId === MAIN_CODEX_ACCOUNT_ID) {
     // Main account in rotation: inject the read-only auth.json token and fail closed if it vanished.
-    const token = getMainAccountToken();
+    const token = (options.getMainAccountToken ?? getMainAccountToken)();
     if (!token) {
       // Nothing will reach upstream, so give the probe back instead of burning it.
       if (probeLeaseId && probeQuotaScope) releaseCodexQuotaScopeProbeLease(accountId, probeQuotaScope, probeLeaseId);
diff --git a/src/codex/routing.ts b/src/codex/routing.ts
index 269f321ac..9affd1965 100644
--- a/src/codex/routing.ts
+++ b/src/codex/routing.ts
@@ -3,7 +3,7 @@ import { saveConfigPreservingClaudeCode } from "../config";
 import { isCodexAccountGenerationLive, readCodexAccountRecord } from "./account-store";
 import { codexAccountLogLabel } from "./account-label";
 import { isCodexAccountPaused } from "./account-pause";
-import { isCodexAccountUsable } from "./account-usability";
+import { isCodexAccountUsable, type CodexAccountUsabilityOptions } from "./account-usability";
 import { isAccountNeedsReauth, markAccountNeedsReauth } from "./account-runtime-state";
 import {
   POOL_KEY_CODEX,
@@ -195,8 +195,14 @@ export type CodexUpstreamOutcomeMeta = {
   writerGeneration?: number;
 };
 
-function hasConfiguredPoolAccount(config: OcxConfig, accountId: string): boolean {
-  if (accountId === MAIN_CODEX_ACCOUNT_ID) return isCodexAccountUsable(config, accountId);
+function hasConfiguredPoolAccount(
+  config: OcxConfig,
+  accountId: string,
+  selectionOptions?: CodexAccountUsabilityOptions,
+): boolean {
+  if (accountId === MAIN_CODEX_ACCOUNT_ID) {
+    return isCodexAccountUsable(config, accountId, selectionOptions);
+  }
   return (config.codexAccounts ?? [])
     .some(account => isSelectableCodexPoolAccount(account) && account.id === accountId);
 }
@@ -624,11 +630,12 @@ function isCodexAccountSelectable(
   accountId: string,
   now: number,
   quotaScope?: CodexQuotaScope,
+  selectionOptions?: CodexAccountUsabilityOptions,
 ): boolean {
   return !isCodexAccountPaused(config, accountId)
     && getCodexQuotaHealthSnapshot(accountId, quotaScope, now) === null
     && !isCodexAccountSoftAvoided(accountId, now)
-    && isCodexAccountUsable(config, accountId);
+    && isCodexAccountUsable(config, accountId, selectionOptions);
 }
 
 function threadAffinityScope(quotaScope?: CodexQuotaScope): ThreadAffinityScope {
@@ -736,6 +743,7 @@ function getEligiblePoolAccounts(
   excludeId?: string,
   now = Date.now(),
   quotaScope?: CodexQuotaScope,
+  selectionOptions?: CodexAccountUsabilityOptions,
 ): string[] {
   const ids = (config.codexAccounts ?? [])
     .filter(account => isSelectableCodexPoolAccount(account)
@@ -744,7 +752,7 @@ function getEligiblePoolAccounts(
       && !isAccountNeedsReauth(account.id))
     .filter(account => getCodexQuotaHealthSnapshot(account.id, quotaScope, now) === null)
     .filter(account => !isCodexAccountSoftAvoided(account.id, now))
-    .filter(account => isCodexAccountUsable(config, account.id))
+    .filter(account => isCodexAccountUsable(config, account.id, selectionOptions))
     .map(account => account.id);
   // The main Codex account is not stored in config.codexAccounts; include it as a
   // first-class rotation candidate when its read-only token is usable (Option A).
@@ -754,7 +762,7 @@ function getEligiblePoolAccounts(
     && !isAccountNeedsReauth(MAIN_CODEX_ACCOUNT_ID)
     && getCodexQuotaHealthSnapshot(MAIN_CODEX_ACCOUNT_ID, quotaScope, now) === null
     && !isCodexAccountSoftAvoided(MAIN_CODEX_ACCOUNT_ID, now)
-    && isCodexAccountUsable(config, MAIN_CODEX_ACCOUNT_ID)
+    && isCodexAccountUsable(config, MAIN_CODEX_ACCOUNT_ID, selectionOptions)
   ) {
     ids.unshift(MAIN_CODEX_ACCOUNT_ID);
   }
@@ -765,8 +773,9 @@ function listEligibleCodexAccountIds(
   config: OcxConfig,
   now: number,
   quotaScope?: CodexQuotaScope,
+  selectionOptions?: CodexAccountUsabilityOptions,
 ): string[] {
-  return getEligiblePoolAccounts(config, undefined, now, quotaScope);
+  return getEligiblePoolAccounts(config, undefined, now, quotaScope, selectionOptions);
 }
 
 function stickyLimitForConfig(config: OcxConfig): number {
@@ -790,8 +799,9 @@ function pickFillFirstCodexAccount(
   config: OcxConfig,
   now: number,
   quotaScope?: CodexQuotaScope,
+  selectionOptions?: CodexAccountUsabilityOptions,
 ): string | null {
-  const eligible = listEligibleCodexAccountIds(config, now, quotaScope);
+  const eligible = listEligibleCodexAccountIds(config, now, quotaScope, selectionOptions);
   if (eligible.length === 0) return null;
 
   const active = getEffectiveActiveCodexAccountId(config);
@@ -799,7 +809,7 @@ function pickFillFirstCodexAccount(
     return active;
   }
 
-  return pickNextFillFirstCodexAccount(config, active ?? null, eligible, now);
+  return pickNextFillFirstCodexAccount(config, active ?? null, eligible, now, selectionOptions);
 }
 
 /** Next eligible account in stable order after `afterId` (wrapping). */
@@ -808,6 +818,7 @@ function pickNextFillFirstCodexAccount(
   afterId: string | null,
   eligible = listEligibleCodexAccountIds(config, Date.now()),
   _now = Date.now(),
+  selectionOptions?: CodexAccountUsabilityOptions,
 ): string | null {
   if (eligible.length === 0) return null;
   const ordered = [...eligible].sort((a, b) => a.localeCompare(b));
@@ -820,7 +831,7 @@ function pickNextFillFirstCodexAccount(
   }
 
   const allConfigured = [
-    ...(isCodexAccountUsable(config, MAIN_CODEX_ACCOUNT_ID) || afterId === MAIN_CODEX_ACCOUNT_ID
+    ...(isCodexAccountUsable(config, MAIN_CODEX_ACCOUNT_ID, selectionOptions) || afterId === MAIN_CODEX_ACCOUNT_ID
       ? [MAIN_CODEX_ACCOUNT_ID]
       : []),
     ...(config.codexAccounts ?? []).filter(account => !account.isMain).map(account => account.id),
@@ -866,6 +877,7 @@ function pickUnboundStrategyAccount(
   now: number,
   commit: boolean,
   quotaScope?: CodexQuotaScope,
+  selectionOptions?: CodexAccountUsabilityOptions,
 ): string | null {
   const strategy = normalizeAccountPoolStrategy(config.accountPoolStrategy);
   if (strategy === "quota") return null;
@@ -873,7 +885,7 @@ function pickUnboundStrategyAccount(
 
   let picked: string | null = null;
   if (strategy === "round-robin") {
-    const eligible = listEligibleCodexAccountIds(config, now, quotaScope);
+    const eligible = listEligibleCodexAccountIds(config, now, quotaScope, selectionOptions);
     const limit = stickyLimitForConfig(config);
     if (!commit) {
       return peekRoundRobinAccount(poolKey, eligible, limit);
@@ -887,7 +899,7 @@ function pickUnboundStrategyAccount(
   }
 
   if (strategy === "fill-first") {
-    picked = pickFillFirstCodexAccount(config, now, quotaScope);
+    picked = pickFillFirstCodexAccount(config, now, quotaScope, selectionOptions);
     if (!picked) return null;
     if (commit) {
       if (!isIndependentCodexQuotaScope(quotaScope)) rememberActiveCodexAccount(config, picked);
@@ -911,10 +923,11 @@ function pickLowerUsageAccount(
   activeUsage: number,
   now: number,
   quotaScope?: CodexQuotaScope,
+  selectionOptions?: CodexAccountUsabilityOptions,
 ): string {
   let best = active;
   let bestUsage = activeUsage;
-  for (const id of getEligiblePoolAccounts(config, active, now, quotaScope)) {
+  for (const id of getEligiblePoolAccounts(config, active, now, quotaScope, selectionOptions)) {
     const usage = computeCodexUsageScore(getAccountQuota(id), getPoolAccountPlan(config, id));
     if (usage < bestUsage) {
       best = id;
@@ -929,10 +942,11 @@ export function pickLowestUsageCodexAccount(
   excludeId?: string,
   now = Date.now(),
   quotaScope?: CodexQuotaScope,
+  selectionOptions?: CodexAccountUsabilityOptions,
 ): string | null {
   let best: string | null = null;
   let bestUsage = Number.POSITIVE_INFINITY;
-  for (const id of getEligiblePoolAccounts(config, excludeId, now, quotaScope)) {
+  for (const id of getEligiblePoolAccounts(config, excludeId, now, quotaScope, selectionOptions)) {
     const usage = computeCodexUsageScore(getAccountQuota(id), getPoolAccountPlan(config, id));
     if (usage < bestUsage) {
       best = id;
@@ -952,17 +966,18 @@ export function pickAlternateCodexAccount(
   excludeId: string,
   now = Date.now(),
   quotaScope?: CodexQuotaScope,
+  selectionOptions?: CodexAccountUsabilityOptions,
 ): string | null {
   const strategy = normalizeAccountPoolStrategy(config.accountPoolStrategy);
   if (strategy === "round-robin") {
-    const eligible = listEligibleCodexAccountIds(config, now, quotaScope).filter(id => id !== excludeId);
+    const eligible = listEligibleCodexAccountIds(config, now, quotaScope, selectionOptions).filter(id => id !== excludeId);
     return pickRoundRobinAccount(codexPoolKeyForScope(quotaScope), eligible, stickyLimitForConfig(config));
   }
   if (strategy === "fill-first") {
-    const eligible = listEligibleCodexAccountIds(config, now, quotaScope).filter(id => id !== excludeId);
-    return pickNextFillFirstCodexAccount(config, excludeId, eligible, now);
+    const eligible = listEligibleCodexAccountIds(config, now, quotaScope, selectionOptions).filter(id => id !== excludeId);
+    return pickNextFillFirstCodexAccount(config, excludeId, eligible, now, selectionOptions);
   }
-  return pickLowestUsageCodexAccount(config, excludeId, now, quotaScope);
+  return pickLowestUsageCodexAccount(config, excludeId, now, quotaScope, selectionOptions);
 }
 
 /** Effective active: automatic runtime cursor, else operator/persisted selection. */
@@ -1027,6 +1042,7 @@ function applyQuotaAutoSwitch(
   active: string,
   now: number,
   quotaScope?: CodexQuotaScope,
+  selectionOptions?: CodexAccountUsabilityOptions,
 ): string {
   const threshold = config.autoSwitchThreshold ?? 80;
   if (threshold <= 0) return active;
@@ -1036,7 +1052,7 @@ function applyQuotaAutoSwitch(
   // threshold. Wait for quota priming instead of rotating among guesses.
   if (isUnknownUsage(activeUsage)) return active;
   if (activeUsage < threshold) return active;
-  const best = pickLowerUsageAccount(config, active, activeUsage, now, quotaScope);
+  const best = pickLowerUsageAccount(config, active, activeUsage, now, quotaScope, selectionOptions);
   if (best !== active) {
     if (!isIndependentCodexQuotaScope(quotaScope)) setActiveCodexAccount(config, best);
     return best;
@@ -1053,9 +1069,14 @@ function shouldFailover(config: OcxConfig, accountId: string, now: number): bool
   return !!health && health.consecutiveFailures >= threshold;
 }
 
-function applyFailureFailover(config: OcxConfig, active: string, now: number): string {
+function applyFailureFailover(
+  config: OcxConfig,
+  active: string,
+  now: number,
+  selectionOptions?: CodexAccountUsabilityOptions,
+): string {
   if (!shouldFailover(config, active, now)) return active;
-  const best = pickAlternateCodexAccount(config, active, now);
+  const best = pickAlternateCodexAccount(config, active, now, undefined, selectionOptions);
   if (best) {
     promoteActiveCodexAccount(config, best);
     return best;
@@ -1086,13 +1107,14 @@ export function previewCodexAccountForRequest(
   config: OcxConfig,
   now = Date.now(),
   quotaScope?: CodexQuotaScope,
+  selectionOptions?: CodexAccountUsabilityOptions,
 ): string | null {
   const entry = threadId ? getThreadAffinity(threadId, quotaScope) : undefined;
   if (threadId && entry) {
     if (
       !isThreadAffinityExpired(entry, now)
       && isThreadAffinityGenerationLive(entry)
-      && isCodexAccountSelectable(config, entry.accountId, now, quotaScope)
+      && isCodexAccountSelectable(config, entry.accountId, now, quotaScope, selectionOptions)
       && !shouldFailover(config, entry.accountId, now)
     ) {
       // Quota strategy only: non-quota strategies keep affinity for ongoing threads
@@ -1106,7 +1128,14 @@ export function previewCodexAccountForRequest(
             getPoolAccountPlan(config, entry.accountId),
           );
           if (!isUnknownUsage(usage) && usage >= threshold) {
-            const best = pickLowerUsageAccount(config, entry.accountId, usage, now, quotaScope);
+            const best = pickLowerUsageAccount(
+              config,
+              entry.accountId,
+              usage,
+              now,
+              quotaScope,
+              selectionOptions,
+            );
             if (best !== entry.accountId) return best;
           }
         }
@@ -1116,17 +1145,27 @@ export function previewCodexAccountForRequest(
     // Stale/unusable affinity is ignored for preview (no map mutation).
   }
 
-  const strategyPick = pickUnboundStrategyAccount(config, threadId, now, false, quotaScope);
+  const strategyPick = pickUnboundStrategyAccount(
+    config,
+    threadId,
+    now,
+    false,
+    quotaScope,
+    selectionOptions,
+  );
   if (strategyPick) return strategyPick;
 
   let active = getEffectiveActiveCodexAccountId(config) ?? null;
   if (!active) {
-    return pickLowestUsageCodexAccount(config, undefined, now, quotaScope);
+    return pickLowestUsageCodexAccount(config, undefined, now, quotaScope, selectionOptions);
   }
-  if (!isCodexAccountSelectable(config, active, now, quotaScope)) {
-    const fallback = pickLowestUsageCodexAccount(config, active, now, quotaScope);
+  if (!isCodexAccountSelectable(config, active, now, quotaScope, selectionOptions)) {
+    const fallback = pickLowestUsageCodexAccount(config, active, now, quotaScope, selectionOptions);
     if (fallback) active = fallback;
-    else if (hasConfiguredPoolAccount(config, active) && !isCodexAccountPaused(config, active)) return active;
+    else if (
+      hasConfiguredPoolAccount(config, active, selectionOptions)
+      && !isCodexAccountPaused(config, active)
+    ) return active;
     else return null;
   }
 
@@ -1134,19 +1173,19 @@ export function previewCodexAccountForRequest(
   if (threshold > 0) {
     const usage = computeCodexUsageScore(getAccountQuota(active), getPoolAccountPlan(config, active));
     if (!isUnknownUsage(usage) && usage >= threshold) {
-      active = pickLowerUsageAccount(config, active, usage, now, quotaScope);
+      active = pickLowerUsageAccount(config, active, usage, now, quotaScope, selectionOptions);
     }
   }
   if (shouldFailover(config, active, now)) {
-    const best = pickLowestUsageCodexAccount(config, active, now, quotaScope);
+    const best = pickLowestUsageCodexAccount(config, active, now, quotaScope, selectionOptions);
     if (best) active = best;
   }
-  if (!isCodexAccountUsable(config, active)) {
-    return hasConfiguredPoolAccount(config, active) ? active : null;
+  if (!isCodexAccountUsable(config, active, selectionOptions)) {
+    return hasConfiguredPoolAccount(config, active, selectionOptions) ? active : null;
   }
   if (isCodexAccountPaused(config, active)) return null;
   if (getCodexQuotaHealthSnapshot(active, quotaScope, now)) {
-    return hasConfiguredPoolAccount(config, active) ? active : null;
+    return hasConfiguredPoolAccount(config, active, selectionOptions) ? active : null;
   }
   return active;
 }
@@ -1156,6 +1195,7 @@ export function resolveCodexAccountForThreadDetailed(
   config: OcxConfig,
   now = Date.now(),
   quotaScope?: CodexQuotaScope,
+  selectionOptions?: CodexAccountUsabilityOptions,
 ): CodexThreadResolution {
   const entry = threadId ? getThreadAffinity(threadId, quotaScope) : undefined;
   if (threadId && entry) {
@@ -1165,7 +1205,7 @@ export function resolveCodexAccountForThreadDetailed(
     }
     if (
       isThreadAffinityGenerationLive(entry)
-      && isCodexAccountSelectable(config, entry.accountId, now, quotaScope)
+      && isCodexAccountSelectable(config, entry.accountId, now, quotaScope, selectionOptions)
       // Affined threads must leave a failing account once the streak trips failover
       // (soft-avoid covers the first-hit case; this catches post-avoid residual streaks).
       && !shouldFailover(config, entry.accountId, now)
@@ -1192,7 +1232,7 @@ export function resolveCodexAccountForThreadDetailed(
         if (overThreshold || now - entry.lastReevalAt >= CODEX_THREAD_AFFINITY_REEVAL_INTERVAL_MS) {
           entry.lastReevalAt = now;
           if (overThreshold) {
-            const best = pickLowerUsageAccount(config, entry.accountId, usage, now, quotaScope);
+            const best = pickLowerUsageAccount(config, entry.accountId, usage, now, quotaScope, selectionOptions);
             if (best !== entry.accountId) {
               if (!isIndependentCodexQuotaScope(quotaScope)) setActiveCodexAccount(config, best);
               bindThreadAffinity(threadId, best, now, quotaScope); // rebinds + resets clocks
@@ -1206,35 +1246,42 @@ export function resolveCodexAccountForThreadDetailed(
     deleteThreadAffinity(threadId, quotaScope);
   }
 
-  const strategyPick = pickUnboundStrategyAccount(config, threadId, now, true, quotaScope);
+  const strategyPick = pickUnboundStrategyAccount(config, threadId, now, true, quotaScope, selectionOptions);
   if (strategyPick) return { status: "selected", accountId: strategyPick };
 
   let active = getEffectiveActiveCodexAccountId(config);
   if (!active) {
-    const selected = pickLowestUsageCodexAccount(config, undefined, now, quotaScope);
+    const selected = pickLowestUsageCodexAccount(config, undefined, now, quotaScope, selectionOptions);
     if (!selected) return { status: "none" };
     if (!isIndependentCodexQuotaScope(quotaScope)) setActiveCodexAccount(config, selected);
     active = selected;
   }
-  if (!isCodexAccountSelectable(config, active, now, quotaScope)) {
-    const fallback = pickLowestUsageCodexAccount(config, active, now, quotaScope);
+  if (!isCodexAccountSelectable(config, active, now, quotaScope, selectionOptions)) {
+    const fallback = pickLowestUsageCodexAccount(config, active, now, quotaScope, selectionOptions);
     if (fallback) {
       if (!isIndependentCodexQuotaScope(quotaScope)) setActiveCodexAccount(config, fallback);
       active = fallback;
-    } else if (hasConfiguredPoolAccount(config, active) && !isCodexAccountPaused(config, active)) {
+    } else if (
+      hasConfiguredPoolAccount(config, active, selectionOptions)
+      && !isCodexAccountPaused(config, active)
+    ) {
       return { status: "selected", accountId: active };
     } else {
       return { status: "none" };
     }
   }
-  active = applyQuotaAutoSwitch(config, active, now, quotaScope);
-  active = applyFailureFailover(config, active, now);
-  if (!isCodexAccountUsable(config, active)) {
-    return hasConfiguredPoolAccount(config, active) ? { status: "selected", accountId: active } : { status: "none" };
+  active = applyQuotaAutoSwitch(config, active, now, quotaScope, selectionOptions);
+  active = applyFailureFailover(config, active, now, selectionOptions);
+  if (!isCodexAccountUsable(config, active, selectionOptions)) {
+    return hasConfiguredPoolAccount(config, active, selectionOptions)
+      ? { status: "selected", accountId: active }
+      : { status: "none" };
   }
   if (isCodexAccountPaused(config, active)) return { status: "none" };
   if (getCodexQuotaHealthSnapshot(active, quotaScope, now)) {
-    return hasConfiguredPoolAccount(config, active) ? { status: "selected", accountId: active } : { status: "none" };
+    return hasConfiguredPoolAccount(config, active, selectionOptions)
+      ? { status: "selected", accountId: active }
+      : { status: "none" };
   }
   if (threadId) bindThreadAffinity(threadId, active, now, quotaScope);
   return { status: "selected", accountId: active };
diff --git a/src/codex/subagent-model-fallback.ts b/src/codex/subagent-model-fallback.ts
index f86d31505..160c7d360 100644
--- a/src/codex/subagent-model-fallback.ts
+++ b/src/codex/subagent-model-fallback.ts
@@ -19,7 +19,10 @@ import {
   getPoolAccountPlan,
   isCodexAccountInCooldown,
 } from "./routing";
-import { isCodexAccountUsable } from "./account-usability";
+import {
+  isCodexAccountUsable,
+  type CodexAccountUsabilityOptions,
+} from "./account-usability";
 import { isCodexAccountPaused } from "./account-pause";
 import { slugEquals } from "../providers/slug-codec";
 import { isThreadSpawnRequest } from "../server/effort-policy";
@@ -177,6 +180,7 @@ export function isSubagentModelUnavailable(
   config: OcxConfig,
   accountId?: string | null,
   now = Date.now(),
+  accountUsabilityOptions?: CodexAccountUsabilityOptions,
 ): boolean {
   if (isDisabledFallbackModel(model, config)) return true;
   if (!isRoutableFallbackModel(model, config)) return true;
@@ -190,7 +194,7 @@ export function isSubagentModelUnavailable(
   const resolvedAccountId = resolvePoolFallbackAccountId(config, accountId);
   if (!resolvedAccountId) return true;
   if (isCodexAccountPaused(config, resolvedAccountId)) return true;
-  if (!isCodexAccountUsable(config, resolvedAccountId)) return true;
+  if (!isCodexAccountUsable(config, resolvedAccountId, accountUsabilityOptions)) return true;
   if (
     isCodexAccountInCooldown(resolvedAccountId, now)
     && !canAcquireCodexQuotaProbeLease(resolvedAccountId, now)
@@ -207,6 +211,7 @@ export function selectAvailableSubagentModel(
   accountId?: string | null,
   now = Date.now(),
   nativeFallbackOnly = false,
+  accountUsabilityOptions?: CodexAccountUsabilityOptions,
 ): { model: string; rewritten: boolean; skipped: string[] } {
   const chain = normalizedChain(primary, config, extraFallback);
   const skipped: string[] = [];
@@ -218,7 +223,7 @@ export function selectAvailableSubagentModel(
         continue;
       }
     }
-    if (isSubagentModelUnavailable(candidate, config, accountId, now)) {
+    if (isSubagentModelUnavailable(candidate, config, accountId, now, accountUsabilityOptions)) {
       skipped.push(candidate);
       continue;
     }
@@ -349,7 +354,12 @@ export function resolveAgentModelFallbackForPrimary(
  * after a successful refresh so failures remain retryable. Errors are swallowed so
  * spawn routing can continue.
  */
-export function maybePrimeSubagentQuota(config: OcxConfig, now = Date.now()): Promise<void> {
+export function maybePrimeSubagentQuota(
+  config: OcxConfig,
+  now = Date.now(),
+  options: { nativeMainReadsForbidden?: boolean } = {},
+): Promise<void> {
+  if (options.nativeMainReadsForbidden) return Promise.resolve();
   if (quotaPrimeInFlight) return quotaPrimeInFlight;
   if (!shouldPrimeSubagentQuota(config, now)) return Promise.resolve();
 
@@ -391,6 +401,7 @@ export function applySubagentModelFallback(
   accountId?: string | null,
   now = Date.now(),
   nativeFallbackOnly = false,
+  accountUsabilityOptions?: CodexAccountUsabilityOptions,
 ): { from?: string; to?: string; skipped?: string[] } | null {
   if (!isThreadSpawnRequest(headers)) return null;
   const roleFallback = resolveAgentModelFallbackForPrimary(parsed.modelId, getCodexHome());
@@ -403,6 +414,7 @@ export function applySubagentModelFallback(
     accountId,
     now,
     nativeFallbackOnly,
+    accountUsabilityOptions,
   );
   if (!selection.rewritten) return selection.skipped.length > 0
     ? { from: parsed.modelId, to: parsed.modelId, skipped: selection.skipped }
diff --git a/src/server/index.ts b/src/server/index.ts
index 7ca60972c..0f739b9d7 100644
--- a/src/server/index.ts
+++ b/src/server/index.ts
@@ -170,7 +170,13 @@ const MAX_WS_FRAME_BYTES = 50 * 1024 * 1024;
 const WEBSOCKET_IDLE_TIMEOUT_SECONDS = 0;
 const LIVE_SIDEBAND_PENDING_MAX = 32;
 
+function releaseLiveSidebandAdmission(ws: ServerWebSocket<WsData>): void {
+  ws.data.liveTurnAdmissionLease?.release();
+  ws.data.liveTurnAdmissionLease = undefined;
+}
+
 function closeLiveSideband(ws: ServerWebSocket<WsData>, code = 1000, reason = ""): void {
+  releaseLiveSidebandAdmission(ws);
   try {
     ws.data.liveUpstream?.close(code, reason);
   } catch {
@@ -236,6 +242,7 @@ function attachLiveSidebandUpstream(ws: ServerWebSocket<WsData>): void {
     }
   });
   upstream.addEventListener("close", (event) => {
+    releaseLiveSidebandAdmission(ws);
     try {
       ws.close(event.code || 1000, event.reason || "");
     } catch {
@@ -882,8 +889,17 @@ export function startServer(port?: number, deps: StartServerDeps = {}) {
           provider: "unknown",
           ...admissionFields(admission),
         };
-        const resolved = await resolveLiveSidebandUpgrade(req, config, logCtx, liveSidebandTarget);
+        const turnAdmissionLease = tryAdmitTurn();
+        if (!turnAdmissionLease) return serverBusyResponse(req, "active turns");
+        let resolved;
+        try {
+          resolved = await resolveLiveSidebandUpgrade(req, config, logCtx, liveSidebandTarget, turnAdmissionLease);
+        } catch (error) {
+          turnAdmissionLease.release();
+          throw error;
+        }
         if (resolved instanceof Response) {
+          turnAdmissionLease.release();
           addFinalRequestLog(requestId, start, logCtx, resolved.status);
           return withCors(resolved, req, config);
         }
@@ -895,8 +911,10 @@ export function startServer(port?: number, deps: StartServerDeps = {}) {
             liveUpstreamHeaders: resolved.headers,
             livePending: [],
             liveOpened: false,
+            liveTurnAdmissionLease: turnAdmissionLease,
           } satisfies WsData,
         })) return undefined as unknown as Response;
+        turnAdmissionLease.release();
         return withCors(formatErrorResponse(426, "upgrade_required", "WebSocket upgrade failed"), req, config);
       }
 
@@ -927,6 +945,10 @@ export function startServer(port?: number, deps: StartServerDeps = {}) {
       // Live sideband sockets (kind=live-sideband) are a transparent bidirectional relay instead.
       open(ws: ServerWebSocket<WsData>) {
         if (ws.data.kind === "live-sideband") {
+          if (!ws.data.liveTurnAdmissionLease) {
+            closeLiveSideband(ws, 1013, "server busy");
+            return;
+          }
           attachLiveSidebandUpstream(ws);
           return;
         }
@@ -1106,6 +1128,7 @@ export function startServer(port?: number, deps: StartServerDeps = {}) {
         if (ws.data.kind === "live-sideband") {
           ws.data.cancel?.();
           ws.data.liveUpstream = undefined;
+          releaseLiveSidebandAdmission(ws);
           return;
         }
         unregisterCodexWebSocket(ws);
diff --git a/src/server/live.ts b/src/server/live.ts
index 7beb52e0e..c430e0fdb 100644
--- a/src/server/live.ts
+++ b/src/server/live.ts
@@ -597,8 +597,9 @@ export async function resolveLiveSidebandUpgrade(
   config: OcxConfig,
   logCtx: RequestLogContext,
   target: LiveSidebandTarget,
+  turnAdmissionLease?: AdmissionLease,
 ): Promise<{ headers: Record<string, string>; upstreamWsUrl: string; recordOutcome?: LiveRelayTarget["recordOutcome"] } | Response> {
-  const relay = await resolveLiveRelay(req, config, logCtx);
+  const relay = await resolveLiveRelay(req, config, logCtx, turnAdmissionLease);
   if (relay instanceof Response) return relay;
   return {
     headers: relay.headers,
diff --git a/src/server/responses/core.ts b/src/server/responses/core.ts
index 63a6b14cb..cd27ae11b 100644
--- a/src/server/responses/core.ts
+++ b/src/server/responses/core.ts
@@ -113,6 +113,7 @@ import {
   maybePrimeSubagentQuota,
   recordSubagentQuotaFailureForThreadSpawn,
 } from "../../codex/subagent-model-fallback";
+import { isNativeMainTrafficBlocked } from "../../codex/native-profile-startup";
 import {
   beginRequestAttempt,
   catalogModelSupportsServiceTier,
@@ -1343,25 +1344,39 @@ async function handleResponsesInner(
     && parsed._previousResponseInputExpanded !== true;
   // A canonical replay miss must not poll quota upstream before the final fail-closed decision.
   // Cached fallback state can still select a provider with native continuation support below.
-  if (
-    isThreadSpawnRequest(req.headers)
-    && !(hasUnexpandedPreviousResponse && isCanonicalOpenAiForwardProvider(route.provider))
-  ) {
-    await maybePrimeSubagentQuota(config);
-  }
-
+  const threadSpawn = isThreadSpawnRequest(req.headers);
+  const previewSelectionAdmission = threadSpawn
+    ? codexAccountSelectionForTurn(options.turnAdmissionLease)?.()
+    : undefined;
+  const nativeMainReadsForbidden = isNativeMainTrafficBlocked()
+    || previewSelectionAdmission?.mainProfileDraining === true;
+  const previewSelectionOptions = { nativeMainSelectionOnly: nativeMainReadsForbidden };
   let authCtx: CodexAuthContext = { kind: "main", accountId: null };
   let selectedForwardHeaders = req.headers;
   let subagentFallbackAccountId = config.activeCodexAccountId ?? null;
   let subagentQuotaFailureModel = parsed.modelId;
 
+  try {
+    if (
+      threadSpawn
+      && !(hasUnexpandedPreviousResponse && isCanonicalOpenAiForwardProvider(route.provider))
+    ) {
+      await maybePrimeSubagentQuota(config, Date.now(), { nativeMainReadsForbidden });
+    }
+
   // Subagent fallback must settle the final model/provider BEFORE route-dependent
   // normalization (virtual models, effort caps, service tier, wire protocol).
   // Preview the preferred Codex account without acquiring a probe lease or refreshing
   // tokens — auth is resolved only after the final route is selected.
-  if (isThreadSpawnRequest(req.headers) && !options.comboAttempt) {
+  if (threadSpawn && !options.comboAttempt) {
     const threadId = req.headers.get("x-codex-parent-thread-id");
-    const previewAccountId = previewCodexAccountForRequest(threadId, config);
+    const previewAccountId = previewCodexAccountForRequest(
+      threadId,
+      config,
+      Date.now(),
+      undefined,
+      previewSelectionOptions,
+    );
     subagentFallbackAccountId = previewAccountId ?? config.activeCodexAccountId ?? null;
     const fallback = applySubagentModelFallback(
       parsed,
@@ -1370,6 +1385,7 @@ async function handleResponsesInner(
       previewAccountId,
       Date.now(),
       unreadableEncryptedAgentTask,
+      previewSelectionOptions,
     );
     if (fallback) {
       (logCtx as unknown as Record<string, unknown>).subagentModelFallbackFrom = fallback.from;
@@ -1391,6 +1407,9 @@ async function handleResponsesInner(
       }
     }
   }
+  } finally {
+    previewSelectionAdmission?.release();
+  }
 
   // Encrypted child tasks may only reach the canonical native backend. This check
   // runs against the FINAL route so native-only fallback can rescue a routed primary.
diff --git a/src/server/ws-bridge.ts b/src/server/ws-bridge.ts
index fdbf537f4..7adeb631f 100644
--- a/src/server/ws-bridge.ts
+++ b/src/server/ws-bridge.ts
@@ -4,7 +4,7 @@ import type { CodexAuthContext } from "../codex/auth-context";
 import { headersForCodexAuthContext } from "../codex/auth-context";
 import type { ResponsesTerminalStatus } from "../bridge";
 import type { DataPlaneAdmission } from "./auth-cors";
-import type { AdmissionReservation } from "../lib/admission";
+import type { AdmissionLease, AdmissionReservation } from "../lib/admission";
 
 const OPEN = 1;
 type ResponsesTerminalReporter = (status: ResponsesTerminalStatus) => void;
@@ -39,6 +39,8 @@ export interface WsData {
   liveUpstreamHeaders?: Record<string, string>;
   livePending?: Array<string | Buffer>;
   liveOpened?: boolean;
+  /** Turn/account ownership retained for the complete sideband socket lifetime. */
+  liveTurnAdmissionLease?: AdmissionLease;
   admissionLease?: AdmissionReservation<ServerWebSocket<WsData>>;
 }
 
diff --git a/tests/codex-auth-context.test.ts b/tests/codex-auth-context.test.ts
index 494d3cdd6..12849cabb 100644
--- a/tests/codex-auth-context.test.ts
+++ b/tests/codex-auth-context.test.ts
@@ -8,6 +8,7 @@ import {
   CodexAccountCooldownError,
   CodexAuthContextError,
   CodexDirectAuthenticationError,
+  CodexMainProfileDrainingError,
   CodexPoolAuthenticationError,
   CodexThreadAffinityExpiredError,
   cooldownErrorMessage,
@@ -47,6 +48,16 @@ import {
 } from "../src/codex/routing";
 import type { OcxConfig, OcxProviderConfig } from "../src/types";
 import { setIcaclsRunnerForTests } from "../src/lib/windows-secret-acl";
+import {
+  completeNativeMainRecovery,
+  initializeNativeMainStartupGate,
+} from "../src/codex/native-profile-startup";
+import type { NativeProfileManager } from "../src/codex/native-profile-manager";
+import {
+  acquireNativeMainProfileDrain,
+  codexAccountSelectionForTurn,
+  tryAdmitTurn,
+} from "../src/server/lifecycle";
 
 let testDir: string;
 let previousOpencodexHome: string | undefined;
@@ -170,6 +181,114 @@ const forwardProvider: OcxProviderConfig = {
 };
 
 describe("Codex auth context", () => {
+  test("main-profile drain routes a non-main pool account without native reads or quota priming", async () => {
+    saveCodexAccountCredential("pool-a", {
+      accessToken: "pool_token",
+      refreshToken: "pool_refresh",
+      expiresAt: Date.now() + 3_600_000,
+      chatgptAccountId: "pool_acc",
+    });
+    let nativeReads = 0;
+    let primes = 0;
+    const drain = acquireNativeMainProfileDrain("auth-context-test");
+    const turn = tryAdmitTurn();
+    expect(drain).not.toBeNull();
+    expect(turn).not.toBeNull();
+    try {
+      await expect(resolveCodexAuthContext(new Headers(), config(), "pool", {
+        beginCodexAccountSelection: codexAccountSelectionForTurn(turn!),
+        isMainAccountTokenLive: () => { nativeReads += 1; return true; },
+        getMainAccountToken: () => {
+          nativeReads += 1;
+          return { accessToken: "main", chatgptAccountId: "main-account" };
+        },
+        primeCodexPoolQuotas: async () => { primes += 1; },
+      })).resolves.toMatchObject({ kind: "pool", accountId: "pool-a" });
+      expect(nativeReads).toBe(0);
+      expect(primes).toBe(0);
+    } finally {
+      turn?.release();
+      drain?.release();
+    }
+  });
+
+  test("recovery-blocked main affinity and alternate reject after routing while pool continues without reads", async () => {
+    writeFileSync(
+      join(testDir, "auth.json"),
+      JSON.stringify({ tokens: { access_token: "main_token", account_id: "main-account" } }),
+    );
+    saveCodexAccountCredential("pool-a", {
+      accessToken: "pool_token",
+      refreshToken: "pool_refresh",
+      expiresAt: Date.now() + 3_600_000,
+      chatgptAccountId: "pool_acc",
+    });
+    const cfg = config();
+    cfg.activeCodexAccountId = MAIN_CODEX_ACCOUNT_ID;
+    const affinityHeaders = new Headers({ "x-codex-parent-thread-id": "main-affinity" });
+    await expect(resolveCodexAuthContext(affinityHeaders, cfg, "pool", {
+      primeCodexPoolQuotas: async () => {},
+    })).resolves.toMatchObject({ kind: "main-pool", accountId: MAIN_CODEX_ACCOUNT_ID });
+    cfg.activeCodexAccountId = "pool-a";
+
+    const homeId = "auth-context-recovery-gate";
+    await initializeNativeMainStartupGate({
+      manager: { context: { homeId }, recover: async () => ({}) } as unknown as NativeProfileManager,
+      probeRecoveryState: () => "manual",
+    });
+    let nativeReads = 0;
+    let primes = 0;
+    const readOptions = {
+      isMainAccountTokenLive: () => { nativeReads += 1; return true; },
+      getMainAccountToken: () => {
+        nativeReads += 1;
+        return { accessToken: "main", chatgptAccountId: "main-account" };
+      },
+      primeCodexPoolQuotas: async () => { primes += 1; },
+    };
+    try {
+      await expect(resolveCodexAuthContext(affinityHeaders, cfg, "pool", readOptions))
+        .rejects.toBeInstanceOf(CodexPoolAuthenticationError);
+      await expect(resolveCodexAuthContext(new Headers(), cfg, "pool", readOptions))
+        .resolves.toMatchObject({ kind: "pool", accountId: "pool-a" });
+      await expect(resolveCodexAuthContext(new Headers(), cfg, "pool", {
+        ...readOptions,
+        excludeAccountId: "pool-a",
+      })).rejects.toBeInstanceOf(CodexPoolAuthenticationError);
+      expect(nativeReads).toBe(0);
+      expect(primes).toBe(0);
+    } finally {
+      completeNativeMainRecovery(homeId);
+    }
+  });
+
+  test("post-fence main selection rejects before injected token materialization", async () => {
+    writeFileSync(
+      join(testDir, "auth.json"),
+      JSON.stringify({ tokens: { access_token: "main_token", account_id: "main-account" } }),
+    );
+    const cfg = config();
+    cfg.activeCodexAccountId = MAIN_CODEX_ACCOUNT_ID;
+    let nativeReads = 0;
+    const drain = acquireNativeMainProfileDrain("auth-context-main-test");
+    const turn = tryAdmitTurn();
+    try {
+      await expect(resolveCodexAuthContext(new Headers(), cfg, "pool", {
+        beginCodexAccountSelection: codexAccountSelectionForTurn(turn!),
+        isMainAccountTokenLive: () => { nativeReads += 1; return true; },
+        getMainAccountToken: () => {
+          nativeReads += 1;
+          return { accessToken: "main", chatgptAccountId: "main-account" };
+        },
+        primeCodexPoolQuotas: async () => { throw new Error("must not prime"); },
+      })).rejects.toBeInstanceOf(CodexMainProfileDrainingError);
+      expect(nativeReads).toBe(0);
+    } finally {
+      turn?.release();
+      drain?.release();
+    }
+  });
+
   test("direct mode returns caller-owned main context without touching pool selection", async () => {
     const cfg = { ...config(), activeCodexAccountId: "missing-pool-account" };
     await expect(resolveCodexAuthContext(new Headers({ authorization: "Bearer caller" }), cfg, "direct"))
diff --git a/tests/native-profile-api.test.ts b/tests/native-profile-api.test.ts
index a5d2c8ad3..23a514e23 100644
--- a/tests/native-profile-api.test.ts
+++ b/tests/native-profile-api.test.ts
@@ -403,7 +403,16 @@ describe("native main profile management API", () => {
     let completions = 0;
     const retainedManager = {
       context: { homeId, journalPath: "missing", recoveryBlockPath: "block" },
-      recover: async () => ({ ok: true, recovered: false }),
+      recover: async () => {
+        const turn = tryAdmitTurn();
+        expect(turn).not.toBeNull();
+        const selection = codexAccountSelectionForTurn(turn!)!();
+        expect(selection?.mainProfileDraining).toBe(true);
+        expect(selection?.claimMainProfile()).toBe(false);
+        selection?.release();
+        turn?.release();
+        return { ok: true, recovered: false };
+      },
     } as unknown as NativeProfileManager;
     const retainedRequest = new Request("http://localhost/api/native-main-profiles/recover", {
       method: "POST",
diff --git a/tests/native-profile-drain-server.test.ts b/tests/native-profile-drain-server.test.ts
index 0b6755001..1dd66bc89 100644
--- a/tests/native-profile-drain-server.test.ts
+++ b/tests/native-profile-drain-server.test.ts
@@ -2,18 +2,24 @@ import { afterEach, beforeEach, describe, expect, test } from "bun:test";
 import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
+import { request as httpRequest } from "node:http";
+import { saveCodexAccountCredential } from "../src/codex/account-store";
 import { resetMainCodexAccountIdentityTrackingForTests } from "../src/codex/account-lifecycle";
 import { MAIN_CODEX_ACCOUNT_ID } from "../src/codex/account-id";
 import { clearMainAccountInfoCache } from "../src/codex/main-account-cache";
 import { clearAccountQuota, updateAccountQuota } from "../src/codex/quota";
 import { clearThreadAccountMap } from "../src/codex/routing";
 import { saveConfig } from "../src/config";
+import { handleNativeProfileAPI } from "../src/codex/native-profile-api";
+import type { NativeProfileManager } from "../src/codex/native-profile-manager";
 import { startServer } from "../src/server";
 import {
   acquireNativeMainProfileDrain,
+  getNativeMainProfileRequestCount,
   resetLifecycleDrainStateForTests,
 } from "../src/server/lifecycle";
 import type { OcxConfig } from "../src/types";
+import { fakeChatGptJwt } from "./helpers/fake-chatgpt-jwt";
 
 const originalFetch = globalThis.fetch;
 const previousOpencodexHome = process.env.OPENCODEX_HOME;
@@ -151,4 +157,176 @@ describe("native main profile scoped server admission", () => {
       await server?.stop(true);
     }
   });
+
+  test("Live/Realtime sideband retains main ownership while Direct and non-main Pool continue", async () => {
+    let upstreamConnections = 0;
+    const upstream = Bun.serve({
+      port: 0,
+      fetch(req, server) {
+        if (req.headers.get("upgrade")?.toLowerCase() === "websocket") {
+          if (server.upgrade(req, { data: {} })) return undefined as unknown as Response;
+          return new Response("upgrade failed", { status: 500 });
+        }
+        return new Response("not found", { status: 404 });
+      },
+      websocket: {
+        open() { upstreamConnections += 1; },
+        message(ws, message) { ws.send(`echo:${String(message)}`); },
+      },
+    });
+    const liveProvider = (codexAccountMode: "direct" | "pool") => ({
+      adapter: "openai-responses" as const,
+      baseUrl: "https://chatgpt.com/backend-api/codex",
+      authMode: "forward" as const,
+      codexAccountMode,
+    });
+    const saveMode = (codexAccountMode: "direct" | "pool", activeCodexAccountId: string) => saveConfig({
+      port: 0,
+      defaultProvider: "openai",
+      openaiProviderTierVersion: 2,
+      providers: { openai: liveProvider(codexAccountMode) },
+      activeCodexAccountId,
+      autoSwitchThreshold: 0,
+      codexAccounts: activeCodexAccountId === "pool-a"
+        ? [
+            { id: "main", email: "main@example.test", isMain: true },
+            { id: "pool-a", email: "pool@example.test", isMain: false, chatgptAccountId: "pool-account" },
+          ]
+        : [],
+      experimentalRealtimeWsBaseUrl: upstream.url.toString(),
+    } as OcxConfig);
+    const connectEcho = async (
+      server: ReturnType<typeof startServer>,
+      path: string,
+      headers: Record<string, string> = {},
+    ): Promise<WebSocket> => {
+      const url = new URL(path, server.url);
+      url.protocol = "ws:";
+      const ws = new WebSocket(url, { headers } as unknown as string[]);
+      await new Promise<void>((resolve, reject) => {
+        const timer = setTimeout(() => reject(new Error("sideband echo timeout")), 5_000);
+        ws.addEventListener("open", () => ws.send("ping"), { once: true });
+        ws.addEventListener("message", event => {
+          if (String(event.data) !== "echo:ping") return;
+          clearTimeout(timer);
+          resolve();
+        });
+        ws.addEventListener("error", () => {
+          clearTimeout(timer);
+          reject(new Error("sideband websocket error"));
+        }, { once: true });
+      });
+      return ws;
+    };
+    const closeSocket = async (ws: WebSocket): Promise<void> => {
+      if (ws.readyState === WebSocket.CLOSED) return;
+      const closed = new Promise<void>(resolve => ws.addEventListener("close", () => resolve(), { once: true }));
+      ws.close();
+      await closed;
+      const deadline = Date.now() + 2_000;
+      while (getNativeMainProfileRequestCount() > 0 && Date.now() < deadline) await Bun.sleep(10);
+    };
+    const handshakeStatus = (server: ReturnType<typeof startServer>, path: string) => new Promise<number>((resolve, reject) => {
+      const url = new URL(path, server.url);
+      const request = httpRequest({
+        hostname: url.hostname,
+        port: url.port,
+        path: `${url.pathname}${url.search}`,
+        method: "GET",
+        headers: {
+          connection: "Upgrade",
+          upgrade: "websocket",
+          "sec-websocket-key": "dGhlIHNhbXBsZSBub25jZQ==",
+          "sec-websocket-version": "13",
+        },
+      }, response => {
+        response.resume();
+        resolve(response.statusCode ?? 0);
+      });
+      request.on("upgrade", (_response, socket) => {
+        socket.destroy();
+        resolve(101);
+      });
+      request.on("error", reject);
+      request.end();
+    });
+    const switchRequest = () => new Request("http://localhost/api/native-main-profiles/switch", {
+      method: "POST",
+      body: JSON.stringify({ target: "target", confirmedStopped: true }),
+    });
+    let switches = 0;
+    const manager = { switch: async () => { switches += 1; return { ok: true }; } } as unknown as NativeProfileManager;
+    let server: ReturnType<typeof startServer> | undefined;
+    let client: WebSocket | undefined;
+    try {
+      saveMode("pool", MAIN_CODEX_ACCOUNT_ID);
+      updateAccountQuota(MAIN_CODEX_ACCOUNT_ID, 1, 1);
+      server = startServer(0);
+      client = await connectEcho(server, "/v1/live/main-pre-fence");
+      expect(getNativeMainProfileRequestCount()).toBe(1);
+      const blocked = await handleNativeProfileAPI(
+        switchRequest(),
+        new URL("http://localhost/api/native-main-profiles/switch"),
+        {} as OcxConfig,
+        { manager, drainTimeoutMs: 0 },
+      );
+      expect(blocked?.status).toBe(409);
+      expect(switches).toBe(0);
+      await closeSocket(client);
+      client = undefined;
+      expect(getNativeMainProfileRequestCount()).toBe(0);
+      const afterClose = await handleNativeProfileAPI(
+        switchRequest(),
+        new URL("http://localhost/api/native-main-profiles/switch"),
+        {} as OcxConfig,
+        { manager, drainTimeoutMs: 0 },
+      );
+      expect(afterClose?.status).toBe(200);
+      expect(switches).toBe(1);
+
+      const mainDrain = acquireNativeMainProfileDrain("new-main-sideband");
+      expect(mainDrain).not.toBeNull();
+      expect(await handshakeStatus(server, "/v1/realtime?call_id=main-post-fence")).toBe(503);
+      expect(upstreamConnections).toBe(1);
+      mainDrain?.release();
+      await server.stop(true);
+      server = undefined;
+
+      saveMode("direct", MAIN_CODEX_ACCOUNT_ID);
+      server = startServer(0);
+      const directDrain = acquireNativeMainProfileDrain("direct-sideband");
+      const directToken = fakeChatGptJwt({ chatgpt_account_id: "direct-account" });
+      client = await connectEcho(server, "/v1/live/direct", {
+        authorization: `Bearer ${directToken}`,
+        "chatgpt-account-id": "direct-account",
+      });
+      expect(getNativeMainProfileRequestCount()).toBe(0);
+      directDrain?.release();
+      await closeSocket(client);
+      client = undefined;
+      await server.stop(true);
+      server = undefined;
+
+      saveCodexAccountCredential("pool-a", {
+        accessToken: "pool-access",
+        refreshToken: "pool-refresh",
+        expiresAt: Date.now() + 3_600_000,
+        chatgptAccountId: "pool-account",
+      });
+      updateAccountQuota("pool-a", 1, 1);
+      saveMode("pool", "pool-a");
+      server = startServer(0);
+      const poolDrain = acquireNativeMainProfileDrain("pool-sideband");
+      client = await connectEcho(server, "/v1/realtime/calls/pool");
+      expect(getNativeMainProfileRequestCount()).toBe(0);
+      poolDrain?.release();
+      await closeSocket(client);
+      client = undefined;
+      expect(upstreamConnections).toBe(3);
+    } finally {
+      if (client) await closeSocket(client).catch(() => {});
+      await server?.stop(true);
+      await upstream.stop(true);
+    }
+  });
 });
diff --git a/tests/subagent-model-fallback.test.ts b/tests/subagent-model-fallback.test.ts
index 127fae1c3..7a39fa22d 100644
--- a/tests/subagent-model-fallback.test.ts
+++ b/tests/subagent-model-fallback.test.ts
@@ -221,6 +221,19 @@ describe("subagent model fallback chain", () => {
     expect(getSubagentQuotaPrimeStateForTests().inFlight).toBe(false);
   });
 
+  test("fenced quota priming does not invoke the injected refresh", async () => {
+    resetSubagentModelFallbackStateForTests();
+    let calls = 0;
+    setSubagentQuotaPrimeForTests(async () => {
+      calls += 1;
+    });
+
+    await maybePrimeSubagentQuota(cfg(), Date.now(), { nativeMainReadsForbidden: true });
+
+    expect(calls).toBe(0);
+    expect(getSubagentQuotaPrimeStateForTests()).toEqual({ primedAt: 0, inFlight: false });
+  });
+
   test("concurrent maybePrimeSubagentQuota callers share one in-flight refresh", async () => {
     resetSubagentModelFallbackStateForTests();
     let calls = 0;

From f280a54d3e95da97d170bad7267f71a802edac84 Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Sun, 2 Aug 2026 18:29:08 +0900
Subject: [PATCH 31/63] fix(codex): fence main quota priming

---
 src/codex/auth-api.ts            |  60 +++++++--
 src/codex/auth-context.ts        |  13 +-
 src/server/responses/core.ts     |   8 +-
 tests/codex-auth-context.test.ts |  44 +++++--
 tests/codex-quota-prime.test.ts  | 214 ++++++++++++++++++++++++++++++-
 5 files changed, 308 insertions(+), 31 deletions(-)

diff --git a/src/codex/auth-api.ts b/src/codex/auth-api.ts
index a4e4c1003..1ccc18c9b 100644
--- a/src/codex/auth-api.ts
+++ b/src/codex/auth-api.ts
@@ -83,7 +83,8 @@ import {
   isValidCodexAccountId,
 } from "./account-id";
 import { codexAccountIdNamespaceCollisionError } from "./account-namespace-match";
-import { ResourceAdmissionError } from "../lib/admission";
+import { ResourceAdmissionError, type AdmissionLease } from "../lib/admission";
+import { tryAdmitTurn } from "../server/lifecycle";
 
 function jsonResponse(data: unknown, status = 200): Response {
   return new Response(JSON.stringify(data), {
@@ -694,6 +695,35 @@ async function fetchPoolAccountQuota(accountId: string, forceRefresh = false, co
 
 let primeInFlight: Promise<void> | null = null;
 
+export interface PrimeCodexPoolQuotasOptions {
+  /** Test seams for proving fenced/recovery priming performs no native-main work. */
+  reconcileMainAccount?: typeof reconcileMainCodexAccountRuntimeState;
+  readMainTokens?: typeof readCodexTokens;
+  fetchMainInfo?: typeof fetchMainAccountInfo;
+}
+
+function tryAcquireNativeMainPrimeLease(): AdmissionLease | null {
+  if (isNativeMainTrafficBlocked()) return null;
+  const turn = tryAdmitTurn();
+  if (!turn) return null;
+  const selection = turn.beginCodexAccountSelection();
+  let claimed = false;
+  try {
+    if (selection.mainProfileDraining || !selection.claimMainProfile()) return null;
+    // Recovery may be discovered after generic admission. Recheck after main
+    // ownership is established and before reconciliation or credential reads.
+    if (isNativeMainTrafficBlocked()) return null;
+    claimed = true;
+    selection.release();
+    return turn;
+  } finally {
+    if (!claimed) {
+      selection.release();
+      turn.release();
+    }
+  }
+}
+
 /**
  * Best-effort prime of pool-account (and main) quota so the rotation engine has
  * real usage scores instead of leaving every account at the unknown sentinel.
@@ -709,7 +739,11 @@ let primeInFlight: Promise<void> | null = null;
  * cost, so the worst case is one WHAM call per account per TTL window. Failures
  * are swallowed: a blocked WSL network must never crash startup or a request.
  */
-export async function primeCodexPoolQuotas(config: OcxConfig, reason: string): Promise<void> {
+export async function primeCodexPoolQuotas(
+  config: OcxConfig,
+  reason: string,
+  options: PrimeCodexPoolQuotasOptions = {},
+): Promise<void> {
   const openai = config.providers[OPENAI_CODEX_PROVIDER_ID];
   if (
     !openai
@@ -718,10 +752,6 @@ export async function primeCodexPoolQuotas(config: OcxConfig, reason: string): P
     || providerCodexAccountMode(OPENAI_CODEX_PROVIDER_ID, openai) !== "pool"
   ) return;
   if (primeInFlight) return primeInFlight;
-  // Seed the observed physical main identity before startup/lazy priming can populate quota or
-  // plan state. Otherwise the first post-startup account switch sees no previous identity and
-  // skips the purge that protects the stable __main__ alias.
-  reconcileMainCodexAccountRuntimeState();
   primeInFlight = (async () => {
     const runtimeConfig = getRuntimeConfig(config);
     const pool = (runtimeConfig.codexAccounts ?? []).filter(isSelectableCodexPoolAccount);
@@ -729,10 +759,24 @@ export async function primeCodexPoolQuotas(config: OcxConfig, reason: string): P
       const q = getAccountQuota(a.id);
       return !q || Date.now() - q.updatedAt >= POOL_CACHE_TTL;
     });
-    const primeMain = !!readCodexTokens() && !getAccountQuota(MAIN_CODEX_ACCOUNT_ID);
+    const primeMain = async () => {
+      const mainLease = tryAcquireNativeMainPrimeLease();
+      if (!mainLease) return;
+      try {
+        // Keep one main owner from physical identity reconciliation through WHAM
+        // identity retry and all cache/quota/plan publication before fetch returns.
+        if (isNativeMainTrafficBlocked()) return;
+        (options.reconcileMainAccount ?? reconcileMainCodexAccountRuntimeState)();
+        if (getAccountQuota(MAIN_CODEX_ACCOUNT_ID)) return;
+        if (!(options.readMainTokens ?? readCodexTokens)()) return;
+        await (options.fetchMainInfo ?? fetchMainAccountInfo)(false);
+      } finally {
+        mainLease.release();
+      }
+    };
     try {
       await Promise.allSettled([
-        primeMain ? fetchMainAccountInfo(false) : Promise.resolve(),
+        primeMain(),
         mapWithConcurrency(stale, POOL_QUOTA_REFRESH_CONCURRENCY, async a => {
           if (!getCodexAccountCredential(a.id)) return;
           await fetchPoolAccountQuota(a.id, false, a.plan);
diff --git a/src/codex/auth-context.ts b/src/codex/auth-context.ts
index 7f2dd3ba2..dcb9e16c4 100644
--- a/src/codex/auth-context.ts
+++ b/src/codex/auth-context.ts
@@ -237,17 +237,16 @@ export async function resolveCodexAuthContext(
     if (!hasCallerCodexBearer(headers)) throw new CodexDirectAuthenticationError();
     return { kind: "main", accountId: null };
   }
-  // Preserve the explicit main selection while startup recovery is pending. Letting
-  // normal strategy resolution run would demote/mutate it before recovery can reopen
-  // the same physical account. Pool-active configurations never enter this branch.
+  // Retained startup recovery makes the physical main identity ineligible. Routing
+  // can still preserve service by selecting a healthy configured pool account.
   const nativeMainTrafficBlocked = isNativeMainTrafficBlocked();
-  if (nativeMainTrafficBlocked && config.activeCodexAccountId === MAIN_CODEX_ACCOUNT_ID) {
-    throw new CodexPoolAuthenticationError();
-  }
   const selectionAdmission = options.beginCodexAccountSelection?.();
   const nativeMainReadsForbidden = nativeMainTrafficBlocked || selectionAdmission?.mainProfileDraining === true;
   const selectionOptions = {
-    nativeMainSelectionOnly: nativeMainReadsForbidden,
+    // Temporary switch drain keeps the candidate until the atomic claim rejects
+    // it. Retained recovery makes main wholly ineligible so pool routing continues.
+    nativeMainSelectionOnly: !nativeMainTrafficBlocked
+      && selectionAdmission?.mainProfileDraining === true,
     isMainAccountTokenLive: options.isMainAccountTokenLive,
   };
   let accountId: string;
diff --git a/src/server/responses/core.ts b/src/server/responses/core.ts
index cd27ae11b..2f27a942b 100644
--- a/src/server/responses/core.ts
+++ b/src/server/responses/core.ts
@@ -1348,9 +1348,13 @@ async function handleResponsesInner(
   const previewSelectionAdmission = threadSpawn
     ? codexAccountSelectionForTurn(options.turnAdmissionLease)?.()
     : undefined;
-  const nativeMainReadsForbidden = isNativeMainTrafficBlocked()
+  const nativeMainRecoveryBlocked = isNativeMainTrafficBlocked();
+  const nativeMainReadsForbidden = nativeMainRecoveryBlocked
     || previewSelectionAdmission?.mainProfileDraining === true;
-  const previewSelectionOptions = { nativeMainSelectionOnly: nativeMainReadsForbidden };
+  const previewSelectionOptions = {
+    nativeMainSelectionOnly: !nativeMainRecoveryBlocked
+      && previewSelectionAdmission?.mainProfileDraining === true,
+  };
   let authCtx: CodexAuthContext = { kind: "main", accountId: null };
   let selectedForwardHeaders = req.headers;
   let subagentFallbackAccountId = config.activeCodexAccountId ?? null;
diff --git a/tests/codex-auth-context.test.ts b/tests/codex-auth-context.test.ts
index 12849cabb..30c5bc41a 100644
--- a/tests/codex-auth-context.test.ts
+++ b/tests/codex-auth-context.test.ts
@@ -212,7 +212,7 @@ describe("Codex auth context", () => {
     }
   });
 
-  test("recovery-blocked main affinity and alternate reject after routing while pool continues without reads", async () => {
+  test("recovery excludes main from affinity, rotation, and retry while healthy pool continues", async () => {
     writeFileSync(
       join(testDir, "auth.json"),
       JSON.stringify({ tokens: { access_token: "main_token", account_id: "main-account" } }),
@@ -225,10 +225,14 @@ describe("Codex auth context", () => {
     });
     const cfg = config();
     cfg.activeCodexAccountId = MAIN_CODEX_ACCOUNT_ID;
-    const affinityHeaders = new Headers({ "x-codex-parent-thread-id": "main-affinity" });
-    await expect(resolveCodexAuthContext(affinityHeaders, cfg, "pool", {
-      primeCodexPoolQuotas: async () => {},
-    })).resolves.toMatchObject({ kind: "main-pool", accountId: MAIN_CODEX_ACCOUNT_ID });
+    const affinityHeaders = ["round-robin", "fill-first"].map(strategy => new Headers({
+      "x-codex-parent-thread-id": `main-affinity-${strategy}`,
+    }));
+    for (const headers of affinityHeaders) {
+      await expect(resolveCodexAuthContext(headers, cfg, "pool", {
+        primeCodexPoolQuotas: async () => {},
+      })).resolves.toMatchObject({ kind: "main-pool", accountId: MAIN_CODEX_ACCOUNT_ID });
+    }
     cfg.activeCodexAccountId = "pool-a";
 
     const homeId = "auth-context-recovery-gate";
@@ -247,14 +251,28 @@ describe("Codex auth context", () => {
       primeCodexPoolQuotas: async () => { primes += 1; },
     };
     try {
-      await expect(resolveCodexAuthContext(affinityHeaders, cfg, "pool", readOptions))
-        .rejects.toBeInstanceOf(CodexPoolAuthenticationError);
-      await expect(resolveCodexAuthContext(new Headers(), cfg, "pool", readOptions))
-        .resolves.toMatchObject({ kind: "pool", accountId: "pool-a" });
-      await expect(resolveCodexAuthContext(new Headers(), cfg, "pool", {
-        ...readOptions,
-        excludeAccountId: "pool-a",
-      })).rejects.toBeInstanceOf(CodexPoolAuthenticationError);
+      for (const [index, strategy] of ["round-robin", "fill-first"].entries()) {
+        cfg.accountPoolStrategy = strategy as "round-robin" | "fill-first";
+        cfg.activeCodexAccountId = MAIN_CODEX_ACCOUNT_ID;
+        await expect(resolveCodexAuthContext(affinityHeaders[index]!, cfg, "pool", readOptions))
+          .resolves.toMatchObject({ kind: "pool", accountId: "pool-a" });
+        cfg.activeCodexAccountId = "pool-a";
+        await expect(resolveCodexAuthContext(
+          new Headers({ "x-codex-parent-thread-id": `new-${strategy}` }),
+          cfg,
+          "pool",
+          readOptions,
+        )).resolves.toMatchObject({ kind: "pool", accountId: "pool-a" });
+        await expect(resolveCodexAuthContext(new Headers(), cfg, "pool", {
+          ...readOptions,
+          excludeAccountId: MAIN_CODEX_ACCOUNT_ID,
+        })).resolves.toMatchObject({ kind: "pool", accountId: "pool-a" });
+        await expect(resolveCodexAuthContext(new Headers(), cfg, "pool", {
+          ...readOptions,
+          excludeAccountId: "pool-a",
+        })).rejects.toBeInstanceOf(CodexPoolAuthenticationError);
+        expect(cfg.activeCodexAccountId).toBe("pool-a");
+      }
       expect(nativeReads).toBe(0);
       expect(primes).toBe(0);
     } finally {
diff --git a/tests/codex-quota-prime.test.ts b/tests/codex-quota-prime.test.ts
index a559462dc..01f02f19b 100644
--- a/tests/codex-quota-prime.test.ts
+++ b/tests/codex-quota-prime.test.ts
@@ -1,5 +1,5 @@
 import { afterEach, beforeEach, describe, expect, test } from "bun:test";
-import { existsSync, mkdirSync, rmSync } from "node:fs";
+import { existsSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import {
   primeCodexPoolQuotas,
@@ -7,9 +7,23 @@ import {
   updateAccountQuota,
   clearAccountQuota,
   clearCodexQuotaPrimeState,
+  clearMainAccountInfoCache,
 } from "../src/codex/auth-api";
 import { saveCodexAccountCredential } from "../src/codex/account-store";
+import { resetMainCodexAccountIdentityTrackingForTests } from "../src/codex/account-lifecycle";
+import { MAIN_CODEX_ACCOUNT_ID } from "../src/codex/main-account";
+import {
+  completeNativeMainRecovery,
+  initializeNativeMainStartupGate,
+} from "../src/codex/native-profile-startup";
+import { handleNativeProfileAPI } from "../src/codex/native-profile-api";
+import type { NativeProfileManager } from "../src/codex/native-profile-manager";
 import { resolveCodexAccountForThread, clearThreadAccountMap } from "../src/codex/routing";
+import {
+  acquireNativeMainProfileDrain,
+  getNativeMainProfileRequestCount,
+  resetLifecycleDrainStateForTests,
+} from "../src/server/lifecycle";
 import type { OcxConfig } from "../src/types";
 
 // Phase 20 (260630_wsl-account-autoswitch): startup/lazy quota priming.
@@ -57,6 +71,19 @@ function whamResponse(weekly: number) {
   }), { status: 200, headers: { "Content-Type": "application/json" } });
 }
 
+function seedMainAccount(accountId = "main-account", accessToken = "main-access"): void {
+  writeFileSync(join(TEST_CODEX_HOME, "auth.json"), JSON.stringify({
+    tokens: { access_token: accessToken, account_id: accountId },
+  }));
+}
+
+function switchRequest(): Request {
+  return new Request("http://localhost/api/native-main-profiles/switch", {
+    method: "POST",
+    body: JSON.stringify({ target: "replacement", confirmedStopped: true }),
+  });
+}
+
 describe("primeCodexPoolQuotas", () => {
   beforeEach(() => {
     previousOpencodexHome = process.env.OPENCODEX_HOME;
@@ -70,12 +97,18 @@ describe("primeCodexPoolQuotas", () => {
     clearAccountQuota();
     clearThreadAccountMap();
     clearCodexQuotaPrimeState();
+    clearMainAccountInfoCache();
+    resetMainCodexAccountIdentityTrackingForTests();
+    resetLifecycleDrainStateForTests();
   });
 
   afterEach(() => {
     clearAccountQuota();
     clearThreadAccountMap();
     clearCodexQuotaPrimeState();
+    clearMainAccountInfoCache();
+    resetMainCodexAccountIdentityTrackingForTests();
+    resetLifecycleDrainStateForTests();
     if (previousOpencodexHome === undefined) delete process.env.OPENCODEX_HOME;
     else process.env.OPENCODEX_HOME = previousOpencodexHome;
     if (previousCodexHome === undefined) delete process.env.CODEX_HOME;
@@ -103,6 +136,185 @@ describe("primeCodexPoolQuotas", () => {
     }
   });
 
+  test("in-flight main publication completes before a profile switch mutates state", async () => {
+    seedMainAccount();
+    const config = makeConfig({ activeCodexAccountId: MAIN_CODEX_ACCOUNT_ID });
+    const originalFetch = globalThis.fetch;
+    let releaseUsage!: () => void;
+    const usageGate = new Promise<void>(resolve => { releaseUsage = resolve; });
+    let markUsageStarted!: () => void;
+    const usageStarted = new Promise<void>(resolve => { markUsageStarted = resolve; });
+    globalThis.fetch = (async (input, init) => {
+      if (!String(input).includes("/backend-api/wham/usage")) return originalFetch(input, init);
+      markUsageStarted();
+      await usageGate;
+      return whamResponse(41);
+    }) as typeof fetch;
+    let switches = 0;
+    const manager = {
+      switch: async () => {
+        switches += 1;
+        expect(getAccountQuota(MAIN_CODEX_ACCOUNT_ID)).toMatchObject({ weeklyPercent: 41 });
+        clearAccountQuota(MAIN_CODEX_ACCOUNT_ID);
+        return { ok: true };
+      },
+    } as unknown as NativeProfileManager;
+    try {
+      const prime = primeCodexPoolQuotas(config, "in-flight-switch");
+      await usageStarted;
+      expect(getNativeMainProfileRequestCount()).toBe(1);
+      const switching = handleNativeProfileAPI(
+        switchRequest(),
+        new URL("http://localhost/api/native-main-profiles/switch"),
+        config,
+        { manager, drainTimeoutMs: 5_000 },
+      );
+      await Bun.sleep(20);
+      expect(switches).toBe(0);
+      releaseUsage();
+      await prime;
+      expect((await switching)?.status).toBe(200);
+      expect(switches).toBe(1);
+      expect(getAccountQuota(MAIN_CODEX_ACCOUNT_ID)).toBeNull();
+      expect(getNativeMainProfileRequestCount()).toBe(0);
+    } finally {
+      releaseUsage();
+      globalThis.fetch = originalFetch;
+    }
+  });
+
+  test("main prime retains ownership through identity retry and final publication", async () => {
+    seedMainAccount("main-account", "main-access");
+    const config = makeConfig({ activeCodexAccountId: MAIN_CODEX_ACCOUNT_ID });
+    const originalFetch = globalThis.fetch;
+    const requestedAccounts: string[] = [];
+    let releaseFirst!: () => void;
+    let releaseRetry!: () => void;
+    const firstGate = new Promise<void>(resolve => { releaseFirst = resolve; });
+    const retryGate = new Promise<void>(resolve => { releaseRetry = resolve; });
+    let markFirstStarted!: () => void;
+    let markRetryStarted!: () => void;
+    const firstStarted = new Promise<void>(resolve => { markFirstStarted = resolve; });
+    const retryStarted = new Promise<void>(resolve => { markRetryStarted = resolve; });
+    globalThis.fetch = (async (input, init) => {
+      if (!String(input).includes("/backend-api/wham/usage")) return originalFetch(input, init);
+      const accountId = new Headers(init?.headers).get("ChatGPT-Account-Id") ?? "";
+      requestedAccounts.push(accountId);
+      if (requestedAccounts.length === 1) {
+        markFirstStarted();
+        await firstGate;
+        return whamResponse(91);
+      }
+      markRetryStarted();
+      await retryGate;
+      return whamResponse(12);
+    }) as typeof fetch;
+    let switches = 0;
+    const manager = {
+      switch: async () => {
+        switches += 1;
+        expect(getAccountQuota(MAIN_CODEX_ACCOUNT_ID)).toMatchObject({ weeklyPercent: 12 });
+        clearAccountQuota(MAIN_CODEX_ACCOUNT_ID);
+        return { ok: true };
+      },
+    } as unknown as NativeProfileManager;
+    try {
+      const prime = primeCodexPoolQuotas(config, "identity-retry");
+      await firstStarted;
+      seedMainAccount("replacement-account", "replacement-access");
+      const switching = handleNativeProfileAPI(
+        switchRequest(),
+        new URL("http://localhost/api/native-main-profiles/switch"),
+        config,
+        { manager, drainTimeoutMs: 5_000 },
+      );
+      await Bun.sleep(20);
+      expect(switches).toBe(0);
+      releaseFirst();
+      await retryStarted;
+      expect(requestedAccounts).toEqual(["main-account", "replacement-account"]);
+      expect(getNativeMainProfileRequestCount()).toBe(1);
+      expect(switches).toBe(0);
+      releaseRetry();
+      await prime;
+      expect((await switching)?.status).toBe(200);
+      expect(switches).toBe(1);
+      expect(getAccountQuota(MAIN_CODEX_ACCOUNT_ID)).toBeNull();
+    } finally {
+      releaseFirst();
+      releaseRetry();
+      globalThis.fetch = originalFetch;
+    }
+  });
+
+  test("startup recovery skips every main operation while pool priming continues", async () => {
+    seedMainAccount();
+    const config = makeConfig({ activeCodexAccountId: MAIN_CODEX_ACCOUNT_ID });
+    seedPoolAccount(config, "p1");
+    const homeId = "quota-prime-recovery";
+    await initializeNativeMainStartupGate({
+      manager: { context: { homeId }, recover: async () => ({}) } as unknown as NativeProfileManager,
+      probeRecoveryState: () => "manual",
+    });
+    const originalFetch = globalThis.fetch;
+    let poolFetches = 0;
+    let mainOperations = 0;
+    globalThis.fetch = (async (input, init) => {
+      if (!String(input).includes("/backend-api/wham/usage")) return originalFetch(input, init);
+      if (new Headers(init?.headers).get("ChatGPT-Account-Id") === "acct-p1") poolFetches += 1;
+      return whamResponse(22);
+    }) as typeof fetch;
+    try {
+      await primeCodexPoolQuotas(config, "startup-recovery", {
+        reconcileMainAccount: () => { mainOperations += 1; return false; },
+        readMainTokens: () => { mainOperations += 1; return null; },
+        fetchMainInfo: async () => {
+          mainOperations += 1;
+          return { email: null, plan: null, quota: null };
+        },
+      });
+      expect(mainOperations).toBe(0);
+      expect(poolFetches).toBe(1);
+      expect(getAccountQuota("p1")).toMatchObject({ weeklyPercent: 22 });
+      expect(getAccountQuota(MAIN_CODEX_ACCOUNT_ID)).toBeNull();
+    } finally {
+      completeNativeMainRecovery(homeId);
+      globalThis.fetch = originalFetch;
+    }
+  });
+
+  test("active main drain skips only main priming and preserves pool continuity", async () => {
+    seedMainAccount();
+    const config = makeConfig({ activeCodexAccountId: "p1" });
+    seedPoolAccount(config, "p1");
+    const drain = acquireNativeMainProfileDrain("quota-prime-pool-only");
+    const originalFetch = globalThis.fetch;
+    let poolFetches = 0;
+    let mainOperations = 0;
+    globalThis.fetch = (async (input, init) => {
+      if (!String(input).includes("/backend-api/wham/usage")) return originalFetch(input, init);
+      if (new Headers(init?.headers).get("ChatGPT-Account-Id") === "acct-p1") poolFetches += 1;
+      return whamResponse(18);
+    }) as typeof fetch;
+    try {
+      await primeCodexPoolQuotas(config, "active-drain", {
+        reconcileMainAccount: () => { mainOperations += 1; return false; },
+        readMainTokens: () => { mainOperations += 1; return null; },
+        fetchMainInfo: async () => {
+          mainOperations += 1;
+          return { email: null, plan: null, quota: null };
+        },
+      });
+      expect(mainOperations).toBe(0);
+      expect(poolFetches).toBe(1);
+      expect(getAccountQuota("p1")).toMatchObject({ weeklyPercent: 18 });
+      expect(getNativeMainProfileRequestCount()).toBe(0);
+    } finally {
+      drain?.release();
+      globalThis.fetch = originalFetch;
+    }
+  });
+
   test("direct, API-only, and disabled OpenAI configurations never prime the Codex pool", async () => {
     const originalFetch = globalThis.fetch;
     let calls = 0;

From 39890103bee9fd0b8c3e37c13de4869095e09166 Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Sun, 2 Aug 2026 19:02:52 +0900
Subject: [PATCH 32/63] test(ci): cover keyring job timeout

---
 tests/ci-workflows.test.ts | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tests/ci-workflows.test.ts b/tests/ci-workflows.test.ts
index e4b1adc6c..e95180820 100644
--- a/tests/ci-workflows.test.ts
+++ b/tests/ci-workflows.test.ts
@@ -44,6 +44,7 @@ describe("GitHub Actions hardening", () => {
     expect(ci.jobs?.gates?.["timeout-minutes"]).toBe(15);
     expect(ci.jobs?.["platform-macos"]?.["timeout-minutes"]).toBe(30);
     expect(ci.jobs?.["platform-windows"]?.["timeout-minutes"]).toBe(30);
+    expect(ci.jobs?.["keyring-smoke"]?.["timeout-minutes"]).toBe(8);
     expect(ci.jobs?.["npm-global-smoke"]?.["timeout-minutes"]).toBe(8);
     expect(ci.jobs?.ci?.["timeout-minutes"]).toBe(5);
     // Every job must stay bounded — an unbounded job can hang a queue for hours.

From 6d4f9c5158f52595f624b48213b26981871c3f0f Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Sun, 2 Aug 2026 19:22:05 +0900
Subject: [PATCH 33/63] fix(native-profile): validate recovery journal
 invariants

---
 src/codex/native-profile-store.ts    | 80 ++++++++++++++++++++++++++++
 tests/native-profile-manager.test.ts | 24 +++++++++
 tests/native-profile-store.test.ts   | 60 ++++++++++++++++++++-
 3 files changed, 163 insertions(+), 1 deletion(-)

diff --git a/src/codex/native-profile-store.ts b/src/codex/native-profile-store.ts
index 74c526f36..d7b2b541a 100644
--- a/src/codex/native-profile-store.ts
+++ b/src/codex/native-profile-store.ts
@@ -450,6 +450,85 @@ function parseVaultObject(value: unknown, homeId: string): NativeMainProfileVaul
   return vault;
 }
 
+function encryptedPayloadsMatch(
+  left: EncryptedNativeEnvelopeV1 | null,
+  right: EncryptedNativeEnvelopeV1 | null,
+): boolean {
+  if (left === null || right === null) return left === right;
+  return left.cipher === right.cipher
+    && left.keyRef === right.keyRef
+    && left.nonce === right.nonce
+    && left.ciphertext === right.ciphertext
+    && left.tag === right.tag
+    && left.envelopeSha256 === right.envelopeSha256;
+}
+
+function profileMetadataMatches(
+  before: NativeMainProfileRecordV1,
+  after: NativeMainProfileRecordV1,
+): boolean {
+  return before.id === after.id
+    && before.label === after.label
+    && before.identityHash === after.identityHash
+    && before.identityHint === after.identityHint
+    && before.createdAt === after.createdAt;
+}
+
+function profileRecordsMatch(
+  before: NativeMainProfileRecordV1,
+  after: NativeMainProfileRecordV1,
+): boolean {
+  return profileMetadataMatches(before, after)
+    && before.state === after.state
+    && before.updatedAt === after.updatedAt
+    && encryptedPayloadsMatch(before.payload, after.payload);
+}
+
+function hasValidJournalSwitchInvariant(journal: NativeProfileSwitchJournalV1): boolean {
+  if (
+    journal.sourceProfileId === journal.targetProfileId
+    || journal.sourceIdentityHash === journal.targetIdentityHash
+    || journal.beforeVault.activeProfileId !== journal.sourceProfileId
+    || journal.afterVault.activeProfileId !== journal.targetProfileId
+    || journal.beforeVault.profiles.length !== journal.afterVault.profiles.length
+    || (
+      journal.afterVault.revision !== journal.beforeVault.revision + 1
+      && journal.afterVault.revision !== journal.beforeVault.revision
+    )
+  ) return false;
+
+  const beforeProfiles = new Map(journal.beforeVault.profiles.map(profile => [profile.id, profile]));
+  const afterProfiles = new Map(journal.afterVault.profiles.map(profile => [profile.id, profile]));
+  const beforeSource = beforeProfiles.get(journal.sourceProfileId);
+  const beforeTarget = beforeProfiles.get(journal.targetProfileId);
+  const afterSource = afterProfiles.get(journal.sourceProfileId);
+  const afterTarget = afterProfiles.get(journal.targetProfileId);
+
+  if (
+    !beforeSource || !beforeTarget || !afterSource || !afterTarget
+    || beforeSource.identityHash !== journal.sourceIdentityHash
+    || afterSource.identityHash !== journal.sourceIdentityHash
+    || beforeTarget.identityHash !== journal.targetIdentityHash
+    || afterTarget.identityHash !== journal.targetIdentityHash
+    || beforeSource.state !== "active" || beforeSource.payload !== null
+    || beforeTarget.state !== "inactive" || !encryptedPayloadsMatch(beforeTarget.payload, journal.targetPayload)
+    || afterSource.state !== "inactive" || !encryptedPayloadsMatch(afterSource.payload, journal.sourcePayload)
+    || afterTarget.state !== "active" || afterTarget.payload !== null
+    || !profileMetadataMatches(beforeSource, afterSource)
+    || !profileMetadataMatches(beforeTarget, afterTarget)
+    || afterSource.updatedAt !== afterTarget.updatedAt
+  ) return false;
+
+  for (const beforeProfile of journal.beforeVault.profiles) {
+    const afterProfile = afterProfiles.get(beforeProfile.id);
+    if (!afterProfile) return false;
+    if (beforeProfile.id !== journal.sourceProfileId
+      && beforeProfile.id !== journal.targetProfileId
+      && !profileRecordsMatch(beforeProfile, afterProfile)) return false;
+  }
+  return true;
+}
+
 export function readNativeProfileVault(context: NativeProfileContext): NativeMainProfileVaultV1 | null {
   if (!existsSync(context.vaultPath)) return null;
   try {
@@ -514,6 +593,7 @@ export function inspectNativeProfileJournal(context: NativeProfileContext): Nati
     ) throw new Error("journal");
     journal.beforeVault = parseVaultObject(journal.beforeVault, context.homeId);
     journal.afterVault = parseVaultObject(journal.afterVault, context.homeId);
+    if (!hasValidJournalSwitchInvariant(journal)) throw new Error("journal invariant");
     return { status: "valid", journal };
   } catch {
     return { status: "invalid" };
diff --git a/tests/native-profile-manager.test.ts b/tests/native-profile-manager.test.ts
index d0c71ef03..92bdc9458 100644
--- a/tests/native-profile-manager.test.ts
+++ b/tests/native-profile-manager.test.ts
@@ -577,6 +577,30 @@ describe("native main profile transactions", () => {
     expect(probeNativeProfileRecoveryState(f.manager.context)).toBe("none");
   });
 
+  test("quarantines a semantically corrupt journal without mutating auth or vault", async () => {
+    const f = await enrolledFixture();
+    await leavePendingJournal(f);
+    const journal = JSON.parse(readFileSync(f.manager.context.journalPath, "utf8")) as {
+      sourceIdentityHash: string;
+    };
+    journal.sourceIdentityHash = "d".repeat(64);
+    writeFileSync(f.manager.context.journalPath, JSON.stringify(journal) + "\n");
+    const authBefore = readFileSync(f.manager.context.authPath);
+    const vaultBefore = readFileSync(f.manager.context.vaultPath);
+
+    let caught: unknown;
+    try { await f.manager.recover(true, true); } catch (error) { caught = error; }
+
+    expect(caught).toBeInstanceOf(NativeProfileError);
+    expect((caught as NativeProfileError).code).toBe("RECOVERY_REQUIRED");
+    expect(readFileSync(f.manager.context.authPath)).toEqual(authBefore);
+    expect(readFileSync(f.manager.context.vaultPath)).toEqual(vaultBefore);
+    expect(existsSync(f.manager.context.journalPath)).toBe(false);
+    expect(existsSync(f.manager.context.recoveryBlockPath)).toBe(true);
+    expect(probeNativeProfileRecoveryState(f.manager.context)).toBe("manual");
+    expect(readdirSync(f.manager.context.rootDir).filter(name => name.includes(".journal.quarantine-"))).toHaveLength(1);
+  });
+
   test("automatic recovery reports an externally refreshed target", async () => {
     const f = await enrolledFixture();
     await leavePendingJournal(f);
diff --git a/tests/native-profile-store.test.ts b/tests/native-profile-store.test.ts
index bea9a370e..e35abcc7c 100644
--- a/tests/native-profile-store.test.ts
+++ b/tests/native-profile-store.test.ts
@@ -163,11 +163,69 @@ function journalAtExactLimit(): NativeProfileSwitchJournalV1 {
   const baseline = Buffer.byteLength(JSON.stringify(value) + "\n", "utf8");
   const paddingBytes = MAX_NATIVE_PROFILE_JOURNAL_BYTES - baseline;
   if (paddingBytes <= 0) throw new Error("journal fixture unexpectedly exceeds its target boundary");
-  value.sourcePayload.keyRef += "x".repeat(paddingBytes);
+  const correlatedPadding = Math.floor(paddingBytes / 2);
+  value.sourcePayload.keyRef += "x".repeat(correlatedPadding);
+  value.afterVault.profiles.find(profile => profile.id === SOURCE_ID)!.payload!.keyRef
+    += "x".repeat(correlatedPadding);
+  value.createdAt += "x".repeat(paddingBytes - correlatedPadding * 2);
   return value;
 }
 
+function inspectJournal(value: NativeProfileSwitchJournalV1) {
+  const store = context();
+  writeFileSync(store.journalPath, serializeNativeProfileJournal(value));
+  return inspectNativeProfileJournal(store);
+}
+
 describe("native-profile recovery journal storage", () => {
+  test("accepts correlated forward and rollback-preservation journals", () => {
+    for (const phase of ["prepared", "auth-replaced", "vault-committed"] as const) {
+      const forward = journal();
+      forward.phase = phase;
+      expect(inspectJournal(forward).status).toBe("valid");
+    }
+
+    const preservedRollback = journal();
+    const refreshedTargetPayload = payload("d".repeat(64));
+    const beforeTarget = preservedRollback.beforeVault.profiles.find(profile => profile.id === TARGET_ID)!;
+    preservedRollback.targetPayload = refreshedTargetPayload;
+    beforeTarget.payload = refreshedTargetPayload;
+    beforeTarget.updatedAt = "2026-08-02T00:01:00.000Z";
+    preservedRollback.beforeVault.revision += 1;
+
+    expect(inspectJournal(preservedRollback).status).toBe("valid");
+  });
+
+  test("rejects independently valid vault snapshots with corrupt switch correlations", () => {
+    const corruptions: Array<[string, (value: NativeProfileSwitchJournalV1) => void]> = [
+      ["source profile id", value => { value.sourceProfileId = TARGET_ID; }],
+      ["target profile id", value => { value.targetProfileId = SOURCE_ID; }],
+      ["source identity hash", value => { value.sourceIdentityHash = "d".repeat(64); }],
+      ["target identity hash", value => { value.targetIdentityHash = "e".repeat(64); }],
+      ["before active profile", value => { value.beforeVault = vault("target"); }],
+      ["after active profile", value => { value.afterVault = vault("source"); }],
+      ["swapped payloads", value => {
+        [value.sourcePayload, value.targetPayload] = [value.targetPayload, value.sourcePayload];
+      }],
+      ["missing target payload placement", value => {
+        value.beforeVault.profiles = value.beforeVault.profiles.filter(profile => profile.id !== TARGET_ID);
+      }],
+      ["missing source payload placement", value => {
+        value.afterVault.profiles = value.afterVault.profiles.filter(profile => profile.id !== SOURCE_ID);
+      }],
+      ["after profile metadata", value => {
+        value.afterVault.profiles.find(profile => profile.id === SOURCE_ID)!.label = "changed-source";
+      }],
+      ["after revision", value => { value.afterVault.revision += 1; }],
+    ];
+
+    for (const [name, corrupt] of corruptions) {
+      const value = journal();
+      corrupt(value);
+      expect(inspectJournal(value), name).toEqual({ status: "invalid" });
+    }
+  });
+
   test("accepts and reads a compact journal exactly at the 17 MiB boundary", () => {
     const store = context();
     const serialized = serializeNativeProfileJournal(journalAtExactLimit());

From 6e96aff78009b1d48fc6705b2d23dea3c091628c Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Sun, 2 Aug 2026 19:23:18 +0900
Subject: [PATCH 34/63] fix(native-profile): publish recovery gate before drain
 release

---
 src/codex/native-profile-api.ts  | 27 +++++++++++++++++++++++----
 tests/native-profile-api.test.ts | 15 ++++++++++++---
 2 files changed, 35 insertions(+), 7 deletions(-)

diff --git a/src/codex/native-profile-api.ts b/src/codex/native-profile-api.ts
index 26c8ff706..2889bec42 100644
--- a/src/codex/native-profile-api.ts
+++ b/src/codex/native-profile-api.ts
@@ -102,6 +102,25 @@ async function withRecoveryGateTransition<T>(
   }
 }
 
+/**
+ * Keep recovery-state publication inside the scoped drain. A retained journal
+ * must make the native-main account ineligible before a new selection can
+ * observe the drain lease as released; non-main pool accounts stay available.
+ */
+async function withNativeMainProfileTransition<T>(
+  manager: NativeProfileManager,
+  deps: NativeProfileApiDeps,
+  operation: () => Promise<T>,
+  completeIfAlreadyClearAfterSuccess = false,
+): Promise<T> {
+  return withMainRequestDrain(deps, () => withRecoveryGateTransition(
+    manager,
+    deps,
+    operation,
+    completeIfAlreadyClearAfterSuccess,
+  ));
+}
+
 export async function handleNativeProfileAPI(
   req: Request,
   url: URL,
@@ -141,11 +160,11 @@ export async function handleNativeProfileAPI(
     if (url.pathname === "/api/native-main-profiles/switch" && req.method === "POST") {
       const input = await body(req);
       if (typeof input.target !== "string") throw new NativeProfileError("INVALID_REQUEST", "A target profile is required.", 400);
-      const switched = await withMainRequestDrain(deps, () => withRecoveryGateTransition(
+      const switched = await withNativeMainProfileTransition(
         manager,
         deps,
         () => manager.switch(input.target as string, input.confirmedStopped === true),
-      ));
+      );
       return jsonResponse(
         switched,
         200,
@@ -155,12 +174,12 @@ export async function handleNativeProfileAPI(
     }
     if (url.pathname === "/api/native-main-profiles/recover" && req.method === "POST") {
       const input = await body(req);
-      const recovered = await withMainRequestDrain(deps, () => withRecoveryGateTransition(
+      const recovered = await withNativeMainProfileTransition(
         manager,
         deps,
         () => manager.recover(input.rollback === true, input.confirmedStopped === true),
         true,
-      ));
+      );
       return jsonResponse(recovered, 200, req, config);
     }
     return jsonResponse({ error: "Unknown native-profile operation", code: "INVALID_REQUEST" }, 404, req, config);
diff --git a/tests/native-profile-api.test.ts b/tests/native-profile-api.test.ts
index 23a514e23..f7cdc8aff 100644
--- a/tests/native-profile-api.test.ts
+++ b/tests/native-profile-api.test.ts
@@ -243,7 +243,7 @@ describe("native main profile management API", () => {
     expect(nativeMainStartupGateSnapshot()).toMatchObject({ status: "ready", homeId });
   });
 
-  test("a clean matching gate closes before drain release when a switch retains a journal", async () => {
+  test("a retained journal publishes a matching main gate before drain release while pool turns remain available", async () => {
     const homeId = "home-clean-retained-journal";
     await initializeNativeMainStartupGate({
       manager: { context: { homeId } } as unknown as NativeProfileManager,
@@ -264,8 +264,17 @@ describe("native main profile management API", () => {
       manager,
       probeRecoveryState: () => states.shift() ?? "journal",
       blockRecovery: (id, state) => {
-        blockedWhileDraining = tryAdmitTurn() === null;
-        return blockNativeMainRecovery(id, state);
+        const blocked = blockNativeMainRecovery(id, state);
+        const poolTurn = tryAdmitTurn();
+        const selection = codexAccountSelectionForTurn(poolTurn!)!();
+        blockedWhileDraining = blocked
+          && nativeMainStartupGateSnapshot().status === "blocked"
+          && poolTurn !== null
+          && selection?.mainProfileDraining === true
+          && selection.claimMainProfile() === false;
+        selection?.release();
+        poolTurn?.release();
+        return blocked;
       },
     });
 

From b854883babe145e0c81fb1beb820894aa8c25d9e Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Sun, 2 Aug 2026 19:25:18 +0900
Subject: [PATCH 35/63] test(native-profile): prove scoped recovery fence
 ordering

---
 src/codex/native-profile-api.ts  | 27 ++++-----------------------
 tests/native-profile-api.test.ts |  6 +++---
 2 files changed, 7 insertions(+), 26 deletions(-)

diff --git a/src/codex/native-profile-api.ts b/src/codex/native-profile-api.ts
index 2889bec42..26c8ff706 100644
--- a/src/codex/native-profile-api.ts
+++ b/src/codex/native-profile-api.ts
@@ -102,25 +102,6 @@ async function withRecoveryGateTransition<T>(
   }
 }
 
-/**
- * Keep recovery-state publication inside the scoped drain. A retained journal
- * must make the native-main account ineligible before a new selection can
- * observe the drain lease as released; non-main pool accounts stay available.
- */
-async function withNativeMainProfileTransition<T>(
-  manager: NativeProfileManager,
-  deps: NativeProfileApiDeps,
-  operation: () => Promise<T>,
-  completeIfAlreadyClearAfterSuccess = false,
-): Promise<T> {
-  return withMainRequestDrain(deps, () => withRecoveryGateTransition(
-    manager,
-    deps,
-    operation,
-    completeIfAlreadyClearAfterSuccess,
-  ));
-}
-
 export async function handleNativeProfileAPI(
   req: Request,
   url: URL,
@@ -160,11 +141,11 @@ export async function handleNativeProfileAPI(
     if (url.pathname === "/api/native-main-profiles/switch" && req.method === "POST") {
       const input = await body(req);
       if (typeof input.target !== "string") throw new NativeProfileError("INVALID_REQUEST", "A target profile is required.", 400);
-      const switched = await withNativeMainProfileTransition(
+      const switched = await withMainRequestDrain(deps, () => withRecoveryGateTransition(
         manager,
         deps,
         () => manager.switch(input.target as string, input.confirmedStopped === true),
-      );
+      ));
       return jsonResponse(
         switched,
         200,
@@ -174,12 +155,12 @@ export async function handleNativeProfileAPI(
     }
     if (url.pathname === "/api/native-main-profiles/recover" && req.method === "POST") {
       const input = await body(req);
-      const recovered = await withNativeMainProfileTransition(
+      const recovered = await withMainRequestDrain(deps, () => withRecoveryGateTransition(
         manager,
         deps,
         () => manager.recover(input.rollback === true, input.confirmedStopped === true),
         true,
-      );
+      ));
       return jsonResponse(recovered, 200, req, config);
     }
     return jsonResponse({ error: "Unknown native-profile operation", code: "INVALID_REQUEST" }, 404, req, config);
diff --git a/tests/native-profile-api.test.ts b/tests/native-profile-api.test.ts
index f7cdc8aff..7deb8d8ad 100644
--- a/tests/native-profile-api.test.ts
+++ b/tests/native-profile-api.test.ts
@@ -249,7 +249,7 @@ describe("native main profile management API", () => {
       manager: { context: { homeId } } as unknown as NativeProfileManager,
       probeRecoveryState: () => "none",
     });
-    let blockedWhileDraining = false;
+    let gateClosedBeforeDrainRelease = false;
     const states = ["none", "journal"] as const;
     const manager = {
       context: { homeId, journalPath: "pending", recoveryBlockPath: "missing-block" },
@@ -267,7 +267,7 @@ describe("native main profile management API", () => {
         const blocked = blockNativeMainRecovery(id, state);
         const poolTurn = tryAdmitTurn();
         const selection = codexAccountSelectionForTurn(poolTurn!)!();
-        blockedWhileDraining = blocked
+        gateClosedBeforeDrainRelease = blocked
           && nativeMainStartupGateSnapshot().status === "blocked"
           && poolTurn !== null
           && selection?.mainProfileDraining === true
@@ -279,7 +279,7 @@ describe("native main profile management API", () => {
     });
 
     expect(response?.status).toBe(409);
-    expect(blockedWhileDraining).toBe(true);
+    expect(gateClosedBeforeDrainRelease).toBe(true);
     expect(nativeMainStartupGateSnapshot()).toEqual({
       status: "blocked",
       homeId,

From 929aed97c806514c8c9c9ad6b17cfbba804b7ccb Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Sun, 2 Aug 2026 19:28:56 +0900
Subject: [PATCH 36/63] fix: claim native main credential lifetimes

---
 src/codex/auth-api.ts                   | 163 +++++++++++++-----------
 src/oauth/token-guardian.ts             |  12 +-
 src/server/chat-completions.ts          |  24 ++--
 src/server/claude-messages.ts           |  35 ++---
 src/server/lifecycle.ts                 |  23 ++++
 tests/chat-completions-endpoint.test.ts |  71 ++++++++++-
 tests/claude-messages-endpoint.test.ts  |  70 ++++++++++
 tests/codex-auth-api.test.ts            |  57 +++++++++
 tests/token-guardian.test.ts            |  67 ++++++++++
 9 files changed, 422 insertions(+), 100 deletions(-)

diff --git a/src/codex/auth-api.ts b/src/codex/auth-api.ts
index 1ccc18c9b..7dd9d23ac 100644
--- a/src/codex/auth-api.ts
+++ b/src/codex/auth-api.ts
@@ -84,7 +84,7 @@ import {
 } from "./account-id";
 import { codexAccountIdNamespaceCollisionError } from "./account-namespace-match";
 import { ResourceAdmissionError, type AdmissionLease } from "../lib/admission";
-import { tryAdmitTurn } from "../server/lifecycle";
+import { tryAcquireNativeMainProfileClaim } from "../server/lifecycle";
 
 function jsonResponse(data: unknown, status = 200): Response {
   return new Response(JSON.stringify(data), {
@@ -93,6 +93,12 @@ function jsonResponse(data: unknown, status = 200): Response {
   });
 }
 
+function nativeMainProfileBusyResponse(): Response {
+  const response = jsonResponse({ error: "server_busy", code: "server_busy" }, 503);
+  response.headers.set("Retry-After", "1");
+  return response;
+}
+
 const MANUAL_IMPORT_ENV = "OPENCODEX_ENABLE_UNVERIFIED_CODEX_IMPORT";
 
 const MAX_CODEX_LOGIN_STATE_ROWS = 32;
@@ -191,16 +197,32 @@ async function resolveResetCreditAuth(
   runtimeConfig: OcxConfig,
   accountId: string,
 ): Promise<
-  | { ok: true; isMain: boolean; accessToken: string; chatgptAccountId: string }
+  | { ok: true; isMain: boolean; accessToken: string; chatgptAccountId: string; nativeMainLease?: AdmissionLease }
   | { ok: false; response: Response }
 > {
   if (accountId === MAIN_CODEX_ACCOUNT_ID) {
     if (hasLegacyMainCodexPoolAccount(runtimeConfig.codexAccounts)) {
       return { ok: false, response: jsonResponse({ error: "Remove the legacy __main__ pool row before using the Desktop account" }, 409) };
     }
-    const tokens = readCodexTokens();
-    if (!tokens) return { ok: false, response: jsonResponse({ error: "Main Codex account not logged in" }, 401) };
-    return { ok: true, isMain: true, accessToken: tokens.access_token, chatgptAccountId: tokens.account_id };
+    const nativeMainLease = tryAcquireNativeMainProfileClaim();
+    if (!nativeMainLease) return { ok: false, response: nativeMainProfileBusyResponse() };
+    try {
+      const tokens = readCodexTokens();
+      if (!tokens) {
+        nativeMainLease.release();
+        return { ok: false, response: jsonResponse({ error: "Main Codex account not logged in" }, 401) };
+      }
+      return {
+        ok: true,
+        isMain: true,
+        accessToken: tokens.access_token,
+        chatgptAccountId: tokens.account_id,
+        nativeMainLease,
+      };
+    } catch (error) {
+      nativeMainLease.release();
+      throw error;
+    }
   }
   if (!isValidCodexAccountId(accountId)) {
     return { ok: false, response: jsonResponse({ error: "Invalid account id format" }, 400) };
@@ -704,24 +726,15 @@ export interface PrimeCodexPoolQuotasOptions {
 
 function tryAcquireNativeMainPrimeLease(): AdmissionLease | null {
   if (isNativeMainTrafficBlocked()) return null;
-  const turn = tryAdmitTurn();
-  if (!turn) return null;
-  const selection = turn.beginCodexAccountSelection();
-  let claimed = false;
-  try {
-    if (selection.mainProfileDraining || !selection.claimMainProfile()) return null;
-    // Recovery may be discovered after generic admission. Recheck after main
-    // ownership is established and before reconciliation or credential reads.
-    if (isNativeMainTrafficBlocked()) return null;
-    claimed = true;
-    selection.release();
-    return turn;
-  } finally {
-    if (!claimed) {
-      selection.release();
-      turn.release();
-    }
+  const claim = tryAcquireNativeMainProfileClaim();
+  if (!claim) return null;
+  // Recovery may be discovered after generic admission. Recheck after main
+  // ownership is established and before reconciliation or credential reads.
+  if (isNativeMainTrafficBlocked()) {
+    claim.release();
+    return null;
   }
+  return claim;
 }
 
 /**
@@ -1219,22 +1232,25 @@ export async function handleCodexAuthAPI(
     try {
       const auth = await resolveResetCreditAuth(getRuntimeConfig(config), accountId);
       if (!auth.ok) return auth.response;
-
-      const resp = await fetch(
-        "https://chatgpt.com/backend-api/wham/rate-limit-reset-credits",
-        {
-          headers: {
-            Authorization: `Bearer ${auth.accessToken}`,
-            "ChatGPT-Account-Id": auth.chatgptAccountId,
+      try {
+        const resp = await fetch(
+          "https://chatgpt.com/backend-api/wham/rate-limit-reset-credits",
+          {
+            headers: {
+              Authorization: `Bearer ${auth.accessToken}`,
+              "ChatGPT-Account-Id": auth.chatgptAccountId,
+            },
+            signal: AbortSignal.timeout(8000),
           },
-          signal: AbortSignal.timeout(8000),
-        },
-      );
-      if (!resp.ok) {
-        await resp.body?.cancel().catch(() => {});
-        return jsonResponse({ error: `Upstream error ${resp.status}` }, resp.status);
+        );
+        if (!resp.ok) {
+          await resp.body?.cancel().catch(() => {});
+          return jsonResponse({ error: `Upstream error ${resp.status}` }, resp.status);
+        }
+        return jsonResponse(safeResetCreditsDto(await resp.json()));
+      } finally {
+        auth.nativeMainLease?.release();
       }
-      return jsonResponse(safeResetCreditsDto(await resp.json()));
     } catch (e) {
       return jsonResponse({ error: e instanceof Error ? e.message : "Reset credit lookup failed" }, 500);
     }
@@ -1247,45 +1263,48 @@ export async function handleCodexAuthAPI(
     try {
       const auth = await resolveResetCreditAuth(getRuntimeConfig(config), body.accountId);
       if (!auth.ok) return auth.response;
-
-      const idempotencyKey = crypto.randomUUID();
-      const resp = await fetch(
-        "https://chatgpt.com/backend-api/wham/rate-limit-reset-credits/consume",
-        {
-          method: "POST",
-          headers: {
-            Authorization: `Bearer ${auth.accessToken}`,
-            "ChatGPT-Account-Id": auth.chatgptAccountId,
-            "Content-Type": "application/json",
+      try {
+        const idempotencyKey = crypto.randomUUID();
+        const resp = await fetch(
+          "https://chatgpt.com/backend-api/wham/rate-limit-reset-credits/consume",
+          {
+            method: "POST",
+            headers: {
+              Authorization: `Bearer ${auth.accessToken}`,
+              "ChatGPT-Account-Id": auth.chatgptAccountId,
+              "Content-Type": "application/json",
+            },
+            body: JSON.stringify({ redeem_request_id: idempotencyKey }),
+            signal: AbortSignal.timeout(10_000),
           },
-          body: JSON.stringify({ redeem_request_id: idempotencyKey }),
-          signal: AbortSignal.timeout(10_000),
-        },
-      );
-      if (!resp.ok) {
-        await resp.body?.cancel().catch(() => {});
-        return jsonResponse({ error: `Upstream error ${resp.status}` }, resp.status);
-      }
-      const result = safeResetCreditConsumeDto(await resp.json());
-      // After a successful redeem (or an idempotent already_redeemed), refresh WHAM usage
-      // and return remaining only when that refresh freshly parsed available_count.
-      // Do not fall back to a preserved cached resetCredits (failed/omitted refresh).
-      if (result.code === "reset" || result.code === "already_redeemed") {
-        let freshResetCredits: number | undefined;
-        if (auth.isMain) {
-          ({ freshResetCredits } = await fetchMainAccountInfoAttempt(true, 1));
-        } else {
-          const account = configuredPoolAccount(getRuntimeConfig(config), body.accountId);
-          ({ freshResetCredits } = await fetchPoolAccountQuota(body.accountId, true, account?.plan));
+        );
+        if (!resp.ok) {
+          await resp.body?.cancel().catch(() => {});
+          return jsonResponse({ error: `Upstream error ${resp.status}` }, resp.status);
         }
-        return jsonResponse({
-          code: result.code,
-          ...(typeof freshResetCredits === "number" && Number.isFinite(freshResetCredits)
-            ? { remaining: freshResetCredits }
-            : {}),
-        });
+        const result = safeResetCreditConsumeDto(await resp.json());
+        // After a successful redeem (or an idempotent already_redeemed), refresh WHAM usage
+        // and return remaining only when that refresh freshly parsed available_count.
+        // Do not fall back to a preserved cached resetCredits (failed/omitted refresh).
+        if (result.code === "reset" || result.code === "already_redeemed") {
+          let freshResetCredits: number | undefined;
+          if (auth.isMain) {
+            ({ freshResetCredits } = await fetchMainAccountInfoAttempt(true, 1));
+          } else {
+            const account = configuredPoolAccount(getRuntimeConfig(config), body.accountId);
+            ({ freshResetCredits } = await fetchPoolAccountQuota(body.accountId, true, account?.plan));
+          }
+          return jsonResponse({
+            code: result.code,
+            ...(typeof freshResetCredits === "number" && Number.isFinite(freshResetCredits)
+              ? { remaining: freshResetCredits }
+              : {}),
+          });
+        }
+        return jsonResponse(result);
+      } finally {
+        auth.nativeMainLease?.release();
       }
-      return jsonResponse(result);
     } catch (e) {
       if (e instanceof PoolQuotaProbeBusyError) {
         const response = jsonResponse({ error: "server_busy", code: "server_busy" }, 503);
diff --git a/src/oauth/token-guardian.ts b/src/oauth/token-guardian.ts
index f0c8b46e2..bd9b5e03d 100644
--- a/src/oauth/token-guardian.ts
+++ b/src/oauth/token-guardian.ts
@@ -30,6 +30,7 @@ import { getMainAccountToken, MAIN_CODEX_ACCOUNT_ID } from "../codex/main-accoun
 import { isCanonicalOpenAiForwardProvider, OPENAI_CODEX_PROVIDER_ID } from "../providers/openai-tiers";
 import { providerCodexAccountMode } from "../providers/registry";
 import { captureConfigGeneration, type GenerationContext } from "../lib/state-store-sweeper";
+import { tryAcquireNativeMainProfileClaim } from "../server/lifecycle";
 
 export interface TokenGuardianHandle {
   stop(): void;
@@ -175,11 +176,14 @@ export async function guardianSweep(nowMs: number = Date.now()): Promise<Guardia
   ) {
     const mode = providerCodexAccountMode(OPENAI_CODEX_PROVIDER_ID, openai) ?? "pool";
     if (opts.codexWarmupEnabled) {
-      const mainToken = getMainAccountToken();
       const key = `codex:${MAIN_CODEX_ACCOUNT_ID}`;
-      if (mainToken && !inBackoff(key, nowMs)) {
+      if (!inBackoff(key, nowMs)) {
         tasks.push(async () => {
+          const nativeMainLease = tryAcquireNativeMainProfileClaim();
+          if (!nativeMainLease) return;
           try {
+            const mainToken = getMainAccountToken();
+            if (!mainToken) return;
             await warmCodexAccount({
               accessToken: mainToken.accessToken,
               chatgptAccountId: mainToken.chatgptAccountId,
@@ -190,9 +194,11 @@ export async function guardianSweep(nowMs: number = Date.now()): Promise<Guardia
           } catch (err) {
             recordFailure(key, nowMs, opts.backoffBaseSeconds, opts.backoffMaxSeconds, false, writerGeneration);
             result.failed.push(key);
+          } finally {
+            nativeMainLease.release();
           }
         });
-      } else if (mainToken) {
+      } else {
         result.skippedBackoff.push(key);
       }
     }
diff --git a/src/server/chat-completions.ts b/src/server/chat-completions.ts
index 8b0610bbb..2f3056a14 100644
--- a/src/server/chat-completions.ts
+++ b/src/server/chat-completions.ts
@@ -32,6 +32,8 @@ import {
 import { responseWithDeferredRequestLog } from "./relay";
 import { handleResponses } from "./responses";
 import type { AdmissionLease } from "../lib/admission";
+import { codexMainProfileDrainingResponse } from "../codex/auth-context";
+import { tryClaimNativeMainProfileForTurn } from "./lifecycle";
 import {
   createTranslatorBudget,
   finalizeTranslatorBudgetResponse,
@@ -158,15 +160,21 @@ async function handleChatCompletionsWithBudget(
     if (value) headers.set(name, value);
   }
   // Prefer main ChatGPT auth so OpenAI-backed sidecars remain reachable on routed turns.
-  if (!directRoute) try {
-    const { getMainAccountToken } = await import("../codex/main-account");
-    const token = getMainAccountToken();
-    if (token) {
-      headers.set("authorization", `Bearer ${token.accessToken}`);
-      headers.set("chatgpt-account-id", token.chatgptAccountId);
+  if (!directRoute) {
+    if (!tryClaimNativeMainProfileForTurn(logIds?.turnAdmissionLease)) {
+      if (logIds) addFinalRequestLog(logIds.requestId, logIds.start, logCtx, 503, { closeReason: "non_stream" });
+      return codexMainProfileDrainingResponse();
+    }
+    try {
+      const { getMainAccountToken } = await import("../codex/main-account");
+      const token = getMainAccountToken();
+      if (token) {
+        headers.set("authorization", `Bearer ${token.accessToken}`);
+        headers.set("chatgpt-account-id", token.chatgptAccountId);
+      }
+    } catch {
+      /* optional */
     }
-  } catch {
-    /* optional */
   }
 
   const internalBodyJson = JSON.stringify(internalBody);
diff --git a/src/server/claude-messages.ts b/src/server/claude-messages.ts
index 4ad6e48fa..baebd8dc2 100644
--- a/src/server/claude-messages.ts
+++ b/src/server/claude-messages.ts
@@ -34,6 +34,7 @@ import { conversationIdFromClaudeMetadata } from "./request-log-conversation";
 import { responseWithDeferredRequestLog } from "./relay";
 import { handleResponses } from "./responses";
 import type { AdmissionLease } from "../lib/admission";
+import { tryClaimNativeMainProfileForTurn } from "./lifecycle";
 import {
   createTranslatorBudget,
   finalizeTranslatorBudgetResponse,
@@ -671,24 +672,26 @@ async function handleClaudeMessagesWithBudget(
     const value = req.headers.get(name);
     if (value) headers.set(name, value);
   }
-  if (!nativeRoute) {
-    // Routed replays need main ChatGPT auth so OpenAI-backed sidecars remain reachable.
-    const { getMainAccountToken } = await import("../codex/main-account");
-    const token = getMainAccountToken();
-    if (token) {
-      headers.set("authorization", `Bearer ${token.accessToken}`);
-      headers.set("chatgpt-account-id", token.chatgptAccountId);
-    }
+  if (!tryClaimNativeMainProfileForTurn(logIds?.turnAdmissionLease)) {
+    const response = anthropicErrorResponse(
+      503,
+      "Native Codex main profile is switching; retry this request",
+      "overloaded_error",
+    );
+    response.headers.set("Retry-After", "1");
+    if (logIds) addFinalRequestLog(logIds.requestId, logIds.start, logCtx, 503, { closeReason: "non_stream" });
+    return response;
+  }
+  // Routed replays need main ChatGPT auth so OpenAI-backed sidecars remain reachable;
+  // native replays have no caller ChatGPT credential. The turn claim above keeps any
+  // materialized main token owned through the complete translated response lifetime.
+  const { getMainAccountToken } = await import("../codex/main-account");
+  const token = getMainAccountToken();
+  if (token) {
+    headers.set("authorization", `Bearer ${token.accessToken}`);
+    headers.set("chatgpt-account-id", token.chatgptAccountId);
   }
   if (nativeRoute) {
-    // No forwarded ChatGPT auth exists on this surface. Attach the main codex login
-    // (read-only auth.json token); account-pool rotation still overrides downstream.
-    const { getMainAccountToken } = await import("../codex/main-account");
-    const token = getMainAccountToken();
-    if (token) {
-      headers.set("authorization", `Bearer ${token.accessToken}`);
-      headers.set("chatgpt-account-id", token.chatgptAccountId);
-    }
     // ChatGPT-backend prompt-cache affinity rides the session_id HEADER (codex
     // clients always send their session uuid; devlog 090 follow-up: body-level
     // prompt_cache_key alone still yielded cached_tokens:0). Claude Code never sends
diff --git a/src/server/lifecycle.ts b/src/server/lifecycle.ts
index f0d07b9fe..bb8c80e40 100644
--- a/src/server/lifecycle.ts
+++ b/src/server/lifecycle.ts
@@ -215,6 +215,29 @@ export function codexAccountSelectionForTurn(
   const activeLease = lease as ActiveTurnLease;
   return () => activeLease.beginCodexAccountSelection();
 }
+
+/** Promote a physical native-main credential read onto an already admitted turn. */
+export function tryClaimNativeMainProfileForTurn(lease?: AdmissionLease): boolean {
+  const beginSelection = codexAccountSelectionForTurn(lease);
+  if (!beginSelection) return false;
+  const selection = beginSelection();
+  if (!selection) return false;
+  try {
+    return !selection.mainProfileDraining && selection.claimMainProfile();
+  } finally {
+    selection.release();
+  }
+}
+
+/** Acquire standalone native-main ownership for management/background work. */
+export function tryAcquireNativeMainProfileClaim(): AdmissionLease | null {
+  const turn = tryAdmitTurn();
+  if (!turn) return null;
+  if (tryClaimNativeMainProfileForTurn(turn)) return turn;
+  turn.release();
+  return null;
+}
+
 export function registerTurn(ac: AbortController, lease?: AdmissionLease): void {
   if (lease && "bindAbortController" in lease) (lease as ActiveTurnLease).bindAbortController(ac);
 }
diff --git a/tests/chat-completions-endpoint.test.ts b/tests/chat-completions-endpoint.test.ts
index 2a1886433..6ff7b98e7 100644
--- a/tests/chat-completions-endpoint.test.ts
+++ b/tests/chat-completions-endpoint.test.ts
@@ -1,5 +1,5 @@
 import { afterEach, beforeEach, expect, test } from "bun:test";
-import { mkdtempSync, rmSync } from "node:fs";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { saveConfig } from "../src/config";
@@ -10,6 +10,11 @@ import { chatCompletionsToResponsesBody, ChatCompletionsRequestError } from "../
 import { chatCompletionsUsage } from "../src/chat/outbound";
 import { createTestTranslatorBudget } from "./helpers/translator-budget";
 import type { TranslatorBudget } from "../src/lib/translator-budget";
+import {
+  acquireNativeMainProfileDrain,
+  getNativeMainProfileRequestCount,
+  resetLifecycleDrainStateForTests,
+} from "../src/server/lifecycle";
 
 function budgetedChatOutbound(module: typeof import("../src/chat/outbound")) {
   const translatorBudget = createTestTranslatorBudget();
@@ -539,6 +544,70 @@ test("POST /v1/chat/completions direct mode forwards caller Authorization", asyn
   }
 });
 
+test("Chat main-token replay owns native main through the stream and rejects post-fence work", async () => {
+  resetLifecycleDrainStateForTests();
+  writeFileSync(join(isolatedCodexHome!.path, "auth.json"), JSON.stringify({
+    tokens: { access_token: "chat-main-access", account_id: "chat-main-account" },
+  }));
+  let upstreamCalls = 0;
+  let finishUpstream: (() => void) | undefined;
+  let markStarted!: () => void;
+  const started = new Promise<void>(resolve => { markStarted = resolve; });
+  const encoder = new TextEncoder();
+  const upstream = Bun.serve({
+    port: 0,
+    fetch() {
+      upstreamCalls += 1;
+      return new Response(new ReadableStream<Uint8Array>({
+        start(controller) {
+          controller.enqueue(encoder.encode('data: {"choices":[{"index":0,"delta":{"content":"held"}}]}\n\n'));
+          finishUpstream = () => {
+            finishUpstream = undefined;
+            controller.enqueue(encoder.encode('data: {"choices":[{"index":0,"delta":{},"finish_reason":"stop"}]}\n\ndata: [DONE]\n\n'));
+            controller.close();
+          };
+          markStarted();
+        },
+      }), { headers: { "content-type": "text/event-stream" } });
+    },
+  });
+  saveConfig(mockConfig(`${upstream.url.toString().replace(/\/$/, "")}/v1`));
+  const server = startServer(0);
+  const request = () => fetch(new URL("/v1/chat/completions", server.url), {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({
+      model: "mock/test-model",
+      stream: true,
+      messages: [{ role: "user", content: "hold" }],
+    }),
+  });
+  let drain: ReturnType<typeof acquireNativeMainProfileDrain> = null;
+  try {
+    const pending = request();
+    await started;
+    const response = await pending;
+    expect(response.status).toBe(200);
+    expect(getNativeMainProfileRequestCount()).toBe(1);
+    drain = acquireNativeMainProfileDrain("chat-overlap");
+    expect(drain).not.toBeNull();
+    const blocked = await request();
+    expect(blocked.status).toBe(503);
+    expect(blocked.headers.get("Retry-After")).toBe("1");
+    expect(upstreamCalls).toBe(1);
+
+    finishUpstream?.();
+    await response.text();
+    expect(getNativeMainProfileRequestCount()).toBe(0);
+  } finally {
+    drain?.release();
+    finishUpstream?.();
+    server.stop(true);
+    upstream.stop(true);
+    resetLifecycleDrainStateForTests();
+  }
+});
+
 test("POST /v1/chat/completions finalizes native passthrough request logs", async () => {
   const { clearRequestLogsForTests, getRequestLogEntries } = await import("../src/server/request-log");
   clearRequestLogsForTests();
diff --git a/tests/claude-messages-endpoint.test.ts b/tests/claude-messages-endpoint.test.ts
index 9d09e2989..b684a3212 100644
--- a/tests/claude-messages-endpoint.test.ts
+++ b/tests/claude-messages-endpoint.test.ts
@@ -19,6 +19,11 @@ import type { OcxConfig } from "../src/types";
 import { installIsolatedCodexHome, type IsolatedCodexHome } from "./helpers/isolated-codex-home";
 import { SERVER_BUDGET_MS } from "./helpers/test-budget";
 import { createTestTranslatorBudget } from "./helpers/translator-budget";
+import {
+  acquireNativeMainProfileDrain,
+  getNativeMainProfileRequestCount,
+  resetLifecycleDrainStateForTests,
+} from "../src/server/lifecycle";
 
 let testDir = "";
 let previousHome: string | undefined;
@@ -607,6 +612,71 @@ test("native openai-responses route carries prompt_cache_key + synthesized sessi
   }
 });
 
+test("Claude main-token replay owns native main through the stream and rejects post-fence work", async () => {
+  resetLifecycleDrainStateForTests();
+  writeFileSync(join(isolatedCodexHome!.path, "auth.json"), JSON.stringify({
+    tokens: { access_token: "claude-main-access", account_id: "claude-main-account" },
+  }));
+  let upstreamCalls = 0;
+  let finishUpstream: (() => void) | undefined;
+  let markStarted!: () => void;
+  const started = new Promise<void>(resolve => { markStarted = resolve; });
+  const encoder = new TextEncoder();
+  const upstream = Bun.serve({
+    port: 0,
+    fetch() {
+      upstreamCalls += 1;
+      return new Response(new ReadableStream<Uint8Array>({
+        start(controller) {
+          controller.enqueue(encoder.encode('data: {"choices":[{"index":0,"delta":{"content":"held"}}]}\n\n'));
+          finishUpstream = () => {
+            finishUpstream = undefined;
+            controller.enqueue(encoder.encode('data: {"choices":[{"index":0,"delta":{},"finish_reason":"stop"}]}\n\ndata: [DONE]\n\n'));
+            controller.close();
+          };
+          markStarted();
+        },
+      }), { headers: { "content-type": "text/event-stream" } });
+    },
+  });
+  saveConfig(mockConfig(`${upstream.url.toString().replace(/\/$/, "")}/v1`));
+  const server = startServer(0);
+  let drain: ReturnType<typeof acquireNativeMainProfileDrain> = null;
+  try {
+    const pending = postMessages(server.url.toString(), {
+      model: "mock/test-model",
+      max_tokens: 64,
+      stream: true,
+      messages: [{ role: "user", content: "hold" }],
+    });
+    await started;
+    const response = await pending;
+    expect(response.status).toBe(200);
+    expect(getNativeMainProfileRequestCount()).toBe(1);
+    drain = acquireNativeMainProfileDrain("claude-overlap");
+    expect(drain).not.toBeNull();
+    const blocked = await postMessages(server.url.toString(), {
+      model: "mock/test-model",
+      max_tokens: 64,
+      stream: true,
+      messages: [{ role: "user", content: "blocked" }],
+    });
+    expect(blocked.status).toBe(503);
+    expect(blocked.headers.get("Retry-After")).toBe("1");
+    expect(upstreamCalls).toBe(1);
+
+    finishUpstream?.();
+    await response.text();
+    expect(getNativeMainProfileRequestCount()).toBe(0);
+  } finally {
+    drain?.release();
+    finishUpstream?.();
+    server.stop(true);
+    upstream.stop(true);
+    resetLifecycleDrainStateForTests();
+  }
+});
+
 test("routed Claude requests give OpenAI sidecars main auth without leaking it to the routed provider", async () => {
   const mainAccessToken = "main-chatgpt-access";
   const mainAccountId = "main-chatgpt-account";
diff --git a/tests/codex-auth-api.test.ts b/tests/codex-auth-api.test.ts
index f8b8ef34a..b6605eccd 100644
--- a/tests/codex-auth-api.test.ts
+++ b/tests/codex-auth-api.test.ts
@@ -3,6 +3,11 @@ import type { ServerWebSocket } from "bun";
 import { Database } from "bun:sqlite";
 import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
+import {
+  acquireNativeMainProfileDrain,
+  getNativeMainProfileRequestCount,
+  resetLifecycleDrainStateForTests,
+} from "../src/server/lifecycle";
 import { CODEX_ACCOUNT_LOG_LABEL_RE } from "../src/codex/account-label";
 import {
   handleCodexAuthAPI, updateAccountQuota, getAccountQuota,
@@ -208,6 +213,7 @@ function seedPoolAccount(
 }
 
 beforeEach(() => {
+  resetLifecycleDrainStateForTests();
   previousOpencodexHome = process.env.OPENCODEX_HOME;
   previousCodexHome = process.env.CODEX_HOME;
   previousManualImportEnv = process.env[MANUAL_IMPORT_ENV];
@@ -230,6 +236,7 @@ beforeEach(() => {
 });
 
 afterEach(() => {
+  resetLifecycleDrainStateForTests();
   setPersistedConfigMutationBeforeCommitForTests(null);
   clearAccountNeedsReauth("__main__");
   clearAccountQuota();
@@ -251,6 +258,56 @@ afterEach(() => {
 });
 
 describe("codex-auth API", () => {
+  test("main reset-credit consume owns native main through destructive upstream work and rejects post-fence work", async () => {
+    writeFileSync(join(TEST_CODEX_HOME, "auth.json"), JSON.stringify({
+      tokens: { access_token: "main-reset-owned", account_id: "acct-main-reset-owned" },
+    }));
+    let consumeCalls = 0;
+    let releaseConsume!: () => void;
+    const consumeGate = new Promise<void>(resolve => { releaseConsume = resolve; });
+    let markStarted!: () => void;
+    const started = new Promise<void>(resolve => { markStarted = resolve; });
+    globalThis.fetch = (async (input: RequestInfo | URL, init?: RequestInit) => {
+      if (String(input).includes("/rate-limit-reset-credits/consume")) {
+        consumeCalls += 1;
+        markStarted();
+        await consumeGate;
+        return Response.json({ code: "noop" });
+      }
+      return previousFetch(input, init);
+    }) as typeof fetch;
+    const request = () => {
+      const req = new Request("http://localhost/api/codex-auth/reset-credits/consume", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ accountId: MAIN_CODEX_ACCOUNT_ID }),
+      });
+      return handleCodexAuthAPI(req, new URL(req.url), makeConfig());
+    };
+
+    const pending = request();
+    await started;
+    expect(getNativeMainProfileRequestCount()).toBe(1);
+    const drain = acquireNativeMainProfileDrain("reset-credit-overlap");
+    expect(drain).not.toBeNull();
+    try {
+      const blocked = await request();
+      expect(blocked?.status).toBe(503);
+      expect(blocked?.headers.get("Retry-After")).toBe("1");
+      expect(await blocked?.json()).toMatchObject({ code: "server_busy" });
+      expect(consumeCalls).toBe(1);
+
+      releaseConsume();
+      const completed = await pending;
+      expect(completed?.status).toBe(200);
+      expect(await completed?.json()).toEqual({ code: "noop" });
+      expect(getNativeMainProfileRequestCount()).toBe(0);
+    } finally {
+      releaseConsume();
+      drain?.release();
+    }
+  });
+
   test("pool-quota flight 17 total across accounts rejects before request creation while compatible generation joins", async () => {
     const clearLoginOwners = seedCodexAuthAdmissionForTests({ loginFlows: 32 });
     try {
diff --git a/tests/token-guardian.test.ts b/tests/token-guardian.test.ts
index 731401a8e..3c572e147 100644
--- a/tests/token-guardian.test.ts
+++ b/tests/token-guardian.test.ts
@@ -7,6 +7,11 @@ import { getConfigPath } from "../src/config";
 import { markCodexAccountValidated, readCodexAccountRecord, saveCodexAccountCredential } from "../src/codex/account-store";
 import { __resetGuardianState, guardianSweep } from "../src/oauth/token-guardian";
 import type { OcxConfig, OcxProviderConfig } from "../src/types";
+import {
+  acquireNativeMainProfileDrain,
+  getNativeMainProfileRequestCount,
+  resetLifecycleDrainStateForTests,
+} from "../src/server/lifecycle";
 
 const origHome = process.env.HOME;
 const origOcxHome = process.env.OPENCODEX_HOME;
@@ -29,6 +34,7 @@ function writeConfig(partial: Partial<OcxConfig>): void {
 }
 
 beforeEach(() => {
+  resetLifecycleDrainStateForTests();
   tmp = join(tmpdir(), `token-guardian-${Date.now()}-${Math.random().toString(16).slice(2)}`);
   mkdirSync(tmp, { recursive: true });
   process.env.HOME = tmp;
@@ -40,6 +46,7 @@ beforeEach(() => {
 });
 
 afterEach(() => {
+  resetLifecycleDrainStateForTests();
   if (origHome === undefined) delete process.env.HOME; else process.env.HOME = origHome;
   if (origOcxHome === undefined) delete process.env.OPENCODEX_HOME; else process.env.OPENCODEX_HOME = origOcxHome;
   if (origCodexHome === undefined) delete process.env.CODEX_HOME; else process.env.CODEX_HOME = origCodexHome;
@@ -214,4 +221,64 @@ describe("token guardian", () => {
     expect(mock.calls()).toBe(1);
     expect(readFileSync(accountStore, "utf8")).toBe("invalid-added-store");
   });
+
+  test("main warmup owns native main through async work and defers while a switch fence is active", async () => {
+    writeFileSync(join(tmp, "codex", "auth.json"), JSON.stringify({
+      tokens: { access_token: "main-owned", account_id: "main-owned-account" },
+    }));
+    writeConfig({
+      tokenGuardian: {
+        enabled: true,
+        tickSeconds: 60,
+        leadSeconds: 60,
+        codexWarmupEnabled: true,
+      },
+      providers: {
+        openai: {
+          adapter: "openai-responses",
+          baseUrl: "https://chatgpt.com/backend-api/codex",
+          authMode: "forward",
+          codexAccountMode: "direct",
+          refreshPolicy: "proactive",
+        },
+      },
+    });
+    let warmupCalls = 0;
+    let releaseWarmup!: () => void;
+    const warmupGate = new Promise<void>(resolve => { releaseWarmup = resolve; });
+    let markStarted!: () => void;
+    const started = new Promise<void>(resolve => { markStarted = resolve; });
+    globalThis.fetch = (async (input: RequestInfo | URL) => {
+      if (String(input) === "https://chatgpt.com/backend-api/codex/responses") {
+        warmupCalls += 1;
+        markStarted();
+        await warmupGate;
+        return new Response('event: response.completed\ndata: {"type":"response.completed"}\n\n', {
+          status: 200,
+          headers: { "content-type": "text/event-stream" },
+        });
+      }
+      return origFetch(input);
+    }) as typeof fetch;
+
+    const pending = guardianSweep(Date.now());
+    await started;
+    expect(getNativeMainProfileRequestCount()).toBe(1);
+    const drain = acquireNativeMainProfileDrain("guardian-overlap");
+    expect(drain).not.toBeNull();
+    try {
+      const deferred = await guardianSweep(Date.now());
+      expect(deferred.warmed).toEqual([]);
+      expect(deferred.failed).toEqual([]);
+      expect(warmupCalls).toBe(1);
+
+      releaseWarmup();
+      const completed = await pending;
+      expect(completed.warmed).toEqual(["codex:__main__"]);
+      expect(getNativeMainProfileRequestCount()).toBe(0);
+    } finally {
+      releaseWarmup();
+      drain?.release();
+    }
+  });
 });

From 2469fb54c6e1a497c09b6b0f0620a54cdb43d1cc Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Sun, 2 Aug 2026 19:30:07 +0900
Subject: [PATCH 37/63] fix(server): retain sideband admission through upstream
 close

---
 src/server/index.ts                       | 73 +++++++++++++++++------
 src/server/ws-bridge.ts                   |  4 ++
 tests/native-profile-drain-server.test.ts | 26 +++++---
 3 files changed, 77 insertions(+), 26 deletions(-)

diff --git a/src/server/index.ts b/src/server/index.ts
index 0f739b9d7..5e5fc36ce 100644
--- a/src/server/index.ts
+++ b/src/server/index.ts
@@ -169,21 +169,60 @@ import {
 const MAX_WS_FRAME_BYTES = 50 * 1024 * 1024;
 const WEBSOCKET_IDLE_TIMEOUT_SECONDS = 0;
 const LIVE_SIDEBAND_PENDING_MAX = 32;
+const LIVE_SIDEBAND_CLOSE_FALLBACK_MS = 1_000;
 
 function releaseLiveSidebandAdmission(ws: ServerWebSocket<WsData>): void {
   ws.data.liveTurnAdmissionLease?.release();
   ws.data.liveTurnAdmissionLease = undefined;
 }
 
-function closeLiveSideband(ws: ServerWebSocket<WsData>, code = 1000, reason = ""): void {
-  releaseLiveSidebandAdmission(ws);
-  try {
-    ws.data.liveUpstream?.close(code, reason);
-  } catch {
-    /* upstream already gone */
+function finalizeLiveSideband(ws: ServerWebSocket<WsData>, upstream?: WebSocket): void {
+  if (upstream && ws.data.liveUpstream !== upstream) return;
+  if (ws.data.liveCloseFallback !== undefined) {
+    clearTimeout(ws.data.liveCloseFallback);
+    ws.data.liveCloseFallback = undefined;
   }
   ws.data.liveUpstream = undefined;
   ws.data.livePending = undefined;
+  ws.data.cancel = undefined;
+  releaseLiveSidebandAdmission(ws);
+}
+
+function armLiveSidebandCloseFallback(ws: ServerWebSocket<WsData>, upstream: WebSocket): void {
+  if (ws.data.liveCloseFallback !== undefined) return;
+  ws.data.liveCloseFallback = setTimeout(() => {
+    ws.data.liveCloseFallback = undefined;
+    if (ws.data.liveUpstream !== upstream) return;
+    // A close frame was already sent below. Retry once before releasing the
+    // drain, then force local cleanup if the peer never completes the handshake.
+    try {
+      upstream.close(1000, "upstream close timeout");
+    } catch {
+      /* upstream is already unusable */
+    }
+    finalizeLiveSideband(ws, upstream);
+  }, LIVE_SIDEBAND_CLOSE_FALLBACK_MS);
+}
+
+function closeLiveSideband(ws: ServerWebSocket<WsData>, code = 1000, reason = ""): void {
+  if (ws.data.liveClosing) return;
+  ws.data.liveClosing = true;
+  ws.data.livePending = undefined;
+  ws.data.cancel = undefined;
+  const upstream = ws.data.liveUpstream;
+  if (!upstream || upstream.readyState === WebSocket.CLOSED) {
+    finalizeLiveSideband(ws, upstream);
+  } else {
+    // The sideband holds a native-main admission lease. Do not release it just
+    // because the downstream left: its authenticated upstream remains live
+    // until this close handshake completes (or the bounded fallback runs).
+    armLiveSidebandCloseFallback(ws, upstream);
+    try {
+      upstream.close(code, reason);
+    } catch {
+      /* the fallback releases ownership if this socket never reports close */
+    }
+  }
   try {
     if (ws.readyState === WebSocket.OPEN || ws.readyState === WebSocket.CONNECTING) {
       ws.close(code, reason);
@@ -208,15 +247,11 @@ function attachLiveSidebandUpstream(ws: ServerWebSocket<WsData>): void {
     return;
   }
   ws.data.liveUpstream = upstream;
-  ws.data.cancel = () => {
-    try {
-      upstream.close(1000, "client closed");
-    } catch {
-      /* ignore */
-    }
-  };
+  ws.data.liveClosing = false;
+  ws.data.cancel = () => closeLiveSideband(ws, 1000, "client closed");
 
   upstream.addEventListener("open", () => {
+    if (ws.data.liveUpstream !== upstream || ws.data.liveClosing) return;
     ws.data.liveOpened = true;
     const pending = ws.data.livePending ?? [];
     ws.data.livePending = undefined;
@@ -230,6 +265,7 @@ function attachLiveSidebandUpstream(ws: ServerWebSocket<WsData>): void {
     }
   });
   upstream.addEventListener("message", (event) => {
+    if (ws.data.liveUpstream !== upstream || ws.data.liveClosing) return;
     try {
       logLiveSidebandFrame("u2c", event.data);
       if (typeof event.data === "string") ws.send(event.data);
@@ -242,15 +278,17 @@ function attachLiveSidebandUpstream(ws: ServerWebSocket<WsData>): void {
     }
   });
   upstream.addEventListener("close", (event) => {
-    releaseLiveSidebandAdmission(ws);
+    if (ws.data.liveUpstream !== upstream) return;
+    ws.data.liveClosing = true;
+    finalizeLiveSideband(ws, upstream);
     try {
       ws.close(event.code || 1000, event.reason || "");
     } catch {
       /* ignore */
     }
-    ws.data.liveUpstream = undefined;
   });
   upstream.addEventListener("error", () => {
+    if (ws.data.liveUpstream !== upstream) return;
     closeLiveSideband(ws, 1011, "upstream error");
   });
 }
@@ -961,6 +999,7 @@ export function startServer(port?: number, deps: StartServerDeps = {}) {
       },
       message(ws: ServerWebSocket<WsData>, raw: string | Buffer) {
         if (ws.data.kind === "live-sideband") {
+          if (ws.data.liveClosing) return;
           logLiveSidebandFrame("c2u", raw);
           const upstream = ws.data.liveUpstream;
           if (!upstream || upstream.readyState === WebSocket.CONNECTING || !ws.data.liveOpened) {
@@ -1126,9 +1165,7 @@ export function startServer(port?: number, deps: StartServerDeps = {}) {
       },
       close(ws: ServerWebSocket<WsData>) {
         if (ws.data.kind === "live-sideband") {
-          ws.data.cancel?.();
-          ws.data.liveUpstream = undefined;
-          releaseLiveSidebandAdmission(ws);
+          closeLiveSideband(ws);
           return;
         }
         unregisterCodexWebSocket(ws);
diff --git a/src/server/ws-bridge.ts b/src/server/ws-bridge.ts
index 7adeb631f..8b0337897 100644
--- a/src/server/ws-bridge.ts
+++ b/src/server/ws-bridge.ts
@@ -39,6 +39,10 @@ export interface WsData {
   liveUpstreamHeaders?: Record<string, string>;
   livePending?: Array<string | Buffer>;
   liveOpened?: boolean;
+  /** Once teardown starts, ignore new client frames until the upstream closes. */
+  liveClosing?: boolean;
+  /** Bounds an uncooperative upstream close so native-main cannot remain drained forever. */
+  liveCloseFallback?: ReturnType<typeof setTimeout>;
   /** Turn/account ownership retained for the complete sideband socket lifetime. */
   liveTurnAdmissionLease?: AdmissionLease;
   admissionLease?: AdmissionReservation<ServerWebSocket<WsData>>;
diff --git a/tests/native-profile-drain-server.test.ts b/tests/native-profile-drain-server.test.ts
index 1dd66bc89..1eb68eec5 100644
--- a/tests/native-profile-drain-server.test.ts
+++ b/tests/native-profile-drain-server.test.ts
@@ -160,6 +160,7 @@ describe("native main profile scoped server admission", () => {
 
   test("Live/Realtime sideband retains main ownership while Direct and non-main Pool continue", async () => {
     let upstreamConnections = 0;
+    let upstreamCloses = 0;
     const upstream = Bun.serve({
       port: 0,
       fetch(req, server) {
@@ -172,6 +173,7 @@ describe("native main profile scoped server admission", () => {
       websocket: {
         open() { upstreamConnections += 1; },
         message(ws, message) { ws.send(`echo:${String(message)}`); },
+        close() { upstreamCloses += 1; },
       },
     });
     const liveProvider = (codexAccountMode: "direct" | "pool") => ({
@@ -218,13 +220,18 @@ describe("native main profile scoped server admission", () => {
       });
       return ws;
     };
-    const closeSocket = async (ws: WebSocket): Promise<void> => {
-      if (ws.readyState === WebSocket.CLOSED) return;
-      const closed = new Promise<void>(resolve => ws.addEventListener("close", () => resolve(), { once: true }));
+    const closeSocket = async (ws: WebSocket): Promise<number> => {
+      if (ws.readyState === WebSocket.CLOSED) return getNativeMainProfileRequestCount();
+      let requestCountAtDownstreamClose = -1;
+      const closed = new Promise<void>(resolve => ws.addEventListener("close", () => {
+        requestCountAtDownstreamClose = getNativeMainProfileRequestCount();
+        resolve();
+      }, { once: true }));
       ws.close();
       await closed;
       const deadline = Date.now() + 2_000;
       while (getNativeMainProfileRequestCount() > 0 && Date.now() < deadline) await Bun.sleep(10);
+      return requestCountAtDownstreamClose;
     };
     const handshakeStatus = (server: ReturnType<typeof startServer>, path: string) => new Promise<number>((resolve, reject) => {
       const url = new URL(path, server.url);
@@ -270,11 +277,14 @@ describe("native main profile scoped server admission", () => {
         {} as OcxConfig,
         { manager, drainTimeoutMs: 0 },
       );
-      expect(blocked?.status).toBe(409);
-      expect(switches).toBe(0);
-      await closeSocket(client);
-      client = undefined;
-      expect(getNativeMainProfileRequestCount()).toBe(0);
+       expect(blocked?.status).toBe(409);
+       expect(switches).toBe(0);
+       // The proxy must still own native-main at the downstream close boundary,
+       // then release only after the mock authenticated upstream closes.
+       expect(await closeSocket(client)).toBe(1);
+       client = undefined;
+       expect(upstreamCloses).toBe(1);
+       expect(getNativeMainProfileRequestCount()).toBe(0);
       const afterClose = await handleNativeProfileAPI(
         switchRequest(),
         new URL("http://localhost/api/native-main-profiles/switch"),

From d3179341c950c7b8f5ae49d6a18dcf4723179c03 Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Mon, 3 Aug 2026 08:16:54 +0900
Subject: [PATCH 38/63] test: align startup journal timestamps

---
 tests/native-profile-startup.test.ts | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/tests/native-profile-startup.test.ts b/tests/native-profile-startup.test.ts
index 0fe149f3d..1a539e447 100644
--- a/tests/native-profile-startup.test.ts
+++ b/tests/native-profile-startup.test.ts
@@ -121,10 +121,13 @@ async function fixture(phase: Phase, observation: Observation, activePool = fals
   const afterVault = structuredClone(beforeVault);
   const afterSource = afterVault.profiles.find(profile => profile.id === sourceRecord.id)!;
   const afterTarget = afterVault.profiles.find(profile => profile.id === targetRecord.id)!;
+  const switchedAt = new Date().toISOString();
   afterSource.state = "inactive";
   afterSource.payload = sourcePayload;
+  afterSource.updatedAt = switchedAt;
   afterTarget.state = "active";
   afterTarget.payload = null;
+  afterTarget.updatedAt = switchedAt;
   afterVault.activeProfileId = afterTarget.id;
   afterVault.revision += 1;
 

From 3ef3881362e09a1e75faa02f621503a08d155cda Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Mon, 3 Aug 2026 08:25:55 +0900
Subject: [PATCH 39/63] test: validate startup journal fixtures

---
 tests/native-profile-startup.test.ts | 8 +++++---
 tests/native-profile-store.test.ts   | 3 +++
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/tests/native-profile-startup.test.ts b/tests/native-profile-startup.test.ts
index 1a539e447..59c839b8f 100644
--- a/tests/native-profile-startup.test.ts
+++ b/tests/native-profile-startup.test.ts
@@ -20,7 +20,8 @@ import {
   probeNativeProfileRecoveryState,
   readNativeEnvelope,
   readNativeProfileVault,
-  serializeNativeProfileMetadata,
+  inspectNativeProfileJournal,
+  serializeNativeProfileJournal,
 } from "../src/codex/native-profile-store";
 import type {
   NativeProfileKey,
@@ -144,9 +145,10 @@ async function fixture(phase: Phase, observation: Observation, activePool = fals
     targetPayload: targetRecord.payload!,
     beforeVault,
     afterVault,
-    createdAt: new Date().toISOString(),
+    createdAt: switchedAt,
   };
-  writeFileSync(manager.context.journalPath, serializeNativeProfileMetadata(journal));
+  writeFileSync(manager.context.journalPath, serializeNativeProfileJournal(journal));
+  expect(inspectNativeProfileJournal(manager.context).status).toBe("valid");
 
   const observed = observation === "source-exact" ? source
     : observation === "source-changed" ? envelope("account-source", "source-changed")
diff --git a/tests/native-profile-store.test.ts b/tests/native-profile-store.test.ts
index e35abcc7c..b4d668e66 100644
--- a/tests/native-profile-store.test.ts
+++ b/tests/native-profile-store.test.ts
@@ -216,6 +216,9 @@ describe("native-profile recovery journal storage", () => {
       ["after profile metadata", value => {
         value.afterVault.profiles.find(profile => profile.id === SOURCE_ID)!.label = "changed-source";
       }],
+      ["mismatched after profile updatedAt", value => {
+        value.afterVault.profiles.find(profile => profile.id === SOURCE_ID)!.updatedAt = "2026-08-02T00:01:00.000Z";
+      }],
       ["after revision", value => { value.afterVault.revision += 1; }],
     ];
 

From 58dee5dd9d947d4226155686db1fd74bd8f5e0d8 Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Mon, 3 Aug 2026 08:32:39 +0900
Subject: [PATCH 40/63] fix(codex): clean staged auth on finish failure

---
 src/codex/native-profile-manager.ts  | 13 ++++---
 tests/cli-native-profile.test.ts     | 31 +++++++++++++++--
 tests/native-profile-api.test.ts     | 18 ++++++++++
 tests/native-profile-manager.test.ts | 51 ++++++++++++++++++++++++++--
 4 files changed, 103 insertions(+), 10 deletions(-)

diff --git a/src/codex/native-profile-manager.ts b/src/codex/native-profile-manager.ts
index df35d3145..635fe216e 100644
--- a/src/codex/native-profile-manager.ts
+++ b/src/codex/native-profile-manager.ts
@@ -585,8 +585,12 @@ export class NativeProfileManager {
 
   async finishStage(stageId: string, labelInput: string): Promise<{ effectiveCodexHome: string; profile: NativeProfilePublic }> {
     return this.withLock(async () => {
-      this.assertNoPendingRecovery();
       this.stagePath(stageId);
+      // Establish that this stage belongs to the locked native home before
+      // claiming cleanup ownership. Freshness and every later failure are then
+      // server-authoritatively cleaned, while lock/ownership failures leave a
+      // stage that another valid operation may own untouched.
+      const ownedStagePath = this.verifiedStagePath(stageId, false);
       let target: NativeEnvelopeSnapshot | null = null;
       let current: NativeEnvelopeSnapshot | null = null;
       let key: NativeProfileKey | null = null;
@@ -595,10 +599,11 @@ export class NativeProfileManager {
       let importCommitted = false;
       let result: { effectiveCodexHome: string; profile: NativeProfilePublic } | undefined;
       try {
-        const stagePath = this.verifiedStagePath(stageId);
+        this.verifiedStagePath(stageId);
+        this.assertNoPendingRecovery();
         requireFileCredentialStore(this.context);
         const label = validateNativeProfileLabel(labelInput);
-        target = readNativeEnvelope(join(stagePath, "auth.json"));
+        target = readNativeEnvelope(join(ownedStagePath, "auth.json"));
         current = readNativeEnvelope(this.context.authPath);
         const vault = this.requireVault();
         if (vault.profiles.length >= MAX_NATIVE_PROFILES) {
@@ -662,7 +667,7 @@ export class NativeProfileManager {
       }
       let cleanupFailed = false;
       try {
-        this.deleteStageById(stageId);
+        this.deleteStage(ownedStagePath);
       } catch {
         cleanupFailed = true;
       }
diff --git a/tests/cli-native-profile.test.ts b/tests/cli-native-profile.test.ts
index 92a8c642a..3c314f6db 100644
--- a/tests/cli-native-profile.test.ts
+++ b/tests/cli-native-profile.test.ts
@@ -102,7 +102,7 @@ describe("ocx account main", () => {
     expect(requests.at(-1)?.body).toEqual({ rollback: true, confirmedStopped: true });
   });
 
-  test("add cancels server staging after a non-200 finish response", async () => {
+  test("add sends an idempotent cancel fallback after a non-200 finish response", async () => {
     const stagingHome = join(tmpdir(), "ocx-native-profile-stage-non-200");
     const requests: string[] = [];
     const errors: string[] = [];
@@ -114,7 +114,7 @@ describe("ocx account main", () => {
         return Response.json({ stageId: "22222222-2222-4222-8222-222222222222", stagingCodexHome: stagingHome });
       }
       if (path.endsWith("/stage/finish")) {
-        return Response.json({ error: "validation failed", code: "AUTH_INVALID", cleanupRequired: true }, { status: 409 });
+        return Response.json({ error: "validation failed", code: "AUTH_INVALID" }, { status: 409 });
       }
       return Response.json({ ok: true });
     };
@@ -130,7 +130,32 @@ describe("ocx account main", () => {
       "/api/native-main-profiles/stage/cancel",
     ]);
     expect(errors).toContain("Error: validation failed");
-    expect(errors).toContain("Warning: native-login staging cleanup is still required; run 'ocx account main doctor'.");
+    expect(errors).not.toContain("Warning: native-login staging cleanup is still required; run 'ocx account main doctor'.");
+  });
+
+  test("add sends an idempotent cancel fallback when the finish response disconnects", async () => {
+    const stagingHome = join(tmpdir(), "ocx-native-profile-stage-disconnect");
+    const requests: string[] = [];
+    const fetchImpl: typeof fetch = async input => {
+      const path = new URL(String(input)).pathname;
+      requests.push(path);
+      if (path.endsWith("/stage") && !path.endsWith("/finish")) {
+        return Response.json({ stageId: "44444444-4444-4444-8444-444444444444", stagingCodexHome: stagingHome });
+      }
+      if (path.endsWith("/stage/finish")) throw new TypeError("connection closed before response");
+      return Response.json({ ok: true });
+    };
+
+    expect(await cmdAccount(["main", "add", "work"], {
+      baseUrl: "http://127.0.0.1:10100",
+      fetchImpl,
+      runCodexLoginImpl: async () => 0,
+    })).toBe(1);
+    expect(requests).toEqual([
+      "/api/native-main-profiles/stage",
+      "/api/native-main-profiles/stage/finish",
+      "/api/native-main-profiles/stage/cancel",
+    ]);
   });
 
   test("add cancels server staging when official login aborts", async () => {
diff --git a/tests/native-profile-api.test.ts b/tests/native-profile-api.test.ts
index 7deb8d8ad..3e3c9b7f5 100644
--- a/tests/native-profile-api.test.ts
+++ b/tests/native-profile-api.test.ts
@@ -179,6 +179,24 @@ describe("native main profile management API", () => {
     expect("cleanupRequired" in payload).toBe(false);
   });
 
+  test("finish returns a typed non-200 after server-owned stage cleanup without a cleanup warning", async () => {
+    const message = "A native-profile recovery journal is pending. Run `ocx account main recover` before adding profiles.";
+    const manager = {
+      finishStage: async () => { throw new NativeProfileError("RECOVERY_REQUIRED", message, 409); },
+    } as unknown as NativeProfileManager;
+    const request = new Request("http://localhost/api/native-main-profiles/stage/finish", {
+      method: "POST",
+      body: JSON.stringify({ stageId: "11111111-1111-4111-8111-111111111111", label: "work" }),
+    });
+
+    const response = await handleNativeProfileAPI(request, new URL(request.url), {} as OcxConfig, { manager });
+
+    expect(response?.status).toBe(409);
+    const payload = await response?.json() as Record<string, unknown>;
+    expect(payload).toMatchObject({ code: "RECOVERY_REQUIRED", error: message });
+    expect("cleanupRequired" in payload).toBe(false);
+  });
+
   test("cleanup-required failures preserve the primary error and expose a true-only signal", async () => {
     const message = "The staged native login is invalid.";
     const manager = {
diff --git a/tests/native-profile-manager.test.ts b/tests/native-profile-manager.test.ts
index 92bdc9458..e88666d8b 100644
--- a/tests/native-profile-manager.test.ts
+++ b/tests/native-profile-manager.test.ts
@@ -262,6 +262,39 @@ describe("native main profile transactions", () => {
     expect(existsSync(stage.stagingCodexHome)).toBe(false);
   });
 
+  test("lock acquisition failure leaves a stage owned by the active operation untouched", async () => {
+    const f = fixture();
+    const manager = new NativeProfileManager(f.options);
+    await manager.register("personal");
+    const stage = await manager.prepareStage();
+    writeFileSync(join(stage.stagingCodexHome, "auth.json"), f.target);
+    let signalAcquired!: () => void;
+    const acquired = new Promise<void>(resolve => { signalAcquired = resolve; });
+    let releaseLock!: () => void;
+    const released = new Promise<void>(resolve => { releaseLock = resolve; });
+    const holder = new NativeProfileManager({
+      ...f.options,
+      onLockAcquired: async () => {
+        signalAcquired();
+        await released;
+      },
+    });
+    const holding = holder.doctor();
+    await acquired;
+    try {
+      const contender = new NativeProfileManager({ ...f.options, lockWaitMs: 0 });
+      let caught: unknown;
+      try { await contender.finishStage(stage.stageId, "work"); } catch (error) { caught = error; }
+      expect(caught).toBeInstanceOf(NativeProfileError);
+      expect((caught as NativeProfileError).code).toBe("NATIVE_PROFILE_BUSY");
+      expect(readFileSync(join(stage.stagingCodexHome, "auth.json"), "utf8")).toBe(f.target);
+    } finally {
+      releaseLock();
+      await holding;
+    }
+    await manager.cancelStage(stage.stageId);
+  });
+
   test("finish rejects a near-cap current source before importing an unusable target", async () => {
     const f = fixture();
     const largeSource = JSON.parse(f.source) as Record<string, unknown>;
@@ -341,7 +374,7 @@ describe("native main profile transactions", () => {
     }
   });
 
-  test("expired stages can be cancelled and are swept before preparing another stage", async () => {
+  test("expired stages can be cancelled, swept, and securely rejected by finish", async () => {
     const f = fixture();
     let now = Date.now();
     const manager = new NativeProfileManager({ ...f.options, now: () => now });
@@ -359,6 +392,15 @@ describe("native main profile transactions", () => {
     expect(existsSync(stale.stagingCodexHome)).toBe(false);
     expect(existsSync(fresh.stagingCodexHome)).toBe(true);
     await manager.cancelStage(fresh.stageId);
+
+    const expiredFinish = await manager.prepareStage();
+    writeFileSync(join(expiredFinish.stagingCodexHome, "auth.json"), f.target);
+    now += 31 * 60_000;
+    let caught: unknown;
+    try { await manager.finishStage(expiredFinish.stageId, "expired"); } catch (error) { caught = error; }
+    expect(caught).toBeInstanceOf(NativeProfileError);
+    expect((caught as NativeProfileError).code).toBe("STAGING_NOT_FOUND");
+    expect(existsSync(expiredFinish.stagingCodexHome)).toBe(false);
   });
 
   test("finish reports cleanup failure instead of claiming success", async () => {
@@ -381,6 +423,7 @@ describe("native main profile transactions", () => {
     expect((caught as NativeProfileError).cleanupRequired).toBeUndefined();
     expect((await manager.list()).profiles.some(profile => profile.label === "work")).toBe(true);
     expect(existsSync(stage.stagingCodexHome)).toBe(true);
+    expect(readFileSync(join(stage.stagingCodexHome, "auth.json"), "utf8")).toBe("");
     await manager.cancelStage(stage.stageId);
   });
 
@@ -402,6 +445,7 @@ describe("native main profile transactions", () => {
     expect((caught as NativeProfileError).retryable).toBe(false);
     expect((caught as NativeProfileError).cleanupRequired).toBe(true);
     expect(existsSync(stage.stagingCodexHome)).toBe(true);
+    expect(readFileSync(join(stage.stagingCodexHome, "auth.json"), "utf8")).toBe("");
     await manager.cancelStage(stage.stageId);
   });
 
@@ -429,6 +473,7 @@ describe("native main profile transactions", () => {
       stagingSweep: "cleanup-required",
       stagingCount: 1,
     });
+    expect(readFileSync(join(stage.stagingCodexHome, "auth.json"), "utf8")).toBe("");
     await manager.cancelStage(stage.stageId);
     writeFileSync(manager.context.vaultPath, "{invalid-json\n");
     expect(await manager.doctor()).toMatchObject({
@@ -795,7 +840,7 @@ describe("native main profile transactions", () => {
     expect(readFileSync(f.manager.context.journalPath, "utf8")).toBe(journalBefore);
   });
 
-  test("pending recovery blocks finishStage without deleting staged plaintext", async () => {
+  test("pending recovery blocks finishStage after securely deleting its verified stage", async () => {
     const f = await enrolledFixture();
     const stage = await f.manager.prepareStage();
     const stagedEnvelope = envelope("account-third", "third");
@@ -810,7 +855,7 @@ describe("native main profile transactions", () => {
 
     expect(caught).toBeInstanceOf(NativeProfileError);
     expect((caught as NativeProfileError).code).toBe("RECOVERY_REQUIRED");
-    expect(readFileSync(join(stage.stagingCodexHome, "auth.json"), "utf8")).toBe(stagedEnvelope);
+    expect(existsSync(stage.stagingCodexHome)).toBe(false);
     expect(readFileSync(f.manager.context.authPath, "utf8")).toBe(authBefore);
     expect(readFileSync(f.manager.context.vaultPath, "utf8")).toBe(vaultBefore);
     expect(readFileSync(f.manager.context.journalPath, "utf8")).toBe(journalBefore);

From 48fdc3c085587c5ac5b465325aa47a773e631778 Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Mon, 3 Aug 2026 10:05:03 +0900
Subject: [PATCH 41/63] fix(codex): share native profile metadata by home

---
 .../docs/reference/cli/providers-accounts.md  |  14 +
 src/codex/native-profile-manager.ts           | 340 +++++++++++++++---
 src/codex/native-profile-store.ts             | 198 +++++++++-
 src/codex/native-profile-types.ts             |   2 +
 structure/02_config-and-codex-home.md         |  12 +
 tests/native-profile-manager.test.ts          | 161 ++++++++-
 tests/native-profile-startup.test.ts          |   7 +-
 tests/native-profile-store.test.ts            |  87 ++++-
 8 files changed, 750 insertions(+), 71 deletions(-)

diff --git a/docs-site/src/content/docs/reference/cli/providers-accounts.md b/docs-site/src/content/docs/reference/cli/providers-accounts.md
index d2504380f..e5c741b03 100644
--- a/docs-site/src/content/docs/reference/cli/providers-accounts.md
+++ b/docs-site/src/content/docs/reference/cli/providers-accounts.md
@@ -230,6 +230,20 @@ successful switch preserves local tasks and history, then requires Codex to be r
 `doctor` to inspect profile state and `recover` to finish or roll back an interrupted transition.
 `switch` accepts either the profile ID or its label.
 
+The encrypted vault, switch journal, recovery marker, and journal quarantine live in the canonical
+`<real CODEX_HOME>/.opencodex-native-main-profiles` directory, so every OpenCodex instance sharing
+that Codex home observes one owner and one recovery state. Plaintext login staging remains isolated
+under each `<OPENCODEX_HOME>/native-main-profile-staging` directory.
+
+Preview builds used `<OPENCODEX_HOME>/native-main-profiles`. That layout is never imported silently.
+If `doctor` reports legacy profile state, stop every OpenCodex proxy sharing the same `CODEX_HOME`.
+Then either back up and move the matching `*.vault.json`, `*.journal.json`, recovery marker, and any
+referenced journal-quarantine file together into the canonical directory while preserving owner-only
+permissions, or remove the old preview set and run `ocx account main register` again. Do not choose
+between multiple old roots or run both layouts while any sharing proxy is active.
+On Windows, preview state keyed by the former case-folded home identity must be reset rather than
+moved because its encrypted AAD and operating-system keyring identity are intentionally not reused.
+
 ## Models
 
 ### `ocx models [subcommand]` · `ocx model <subcommand>`
diff --git a/src/codex/native-profile-manager.ts b/src/codex/native-profile-manager.ts
index 635fe216e..ebe4c3dc0 100644
--- a/src/codex/native-profile-manager.ts
+++ b/src/codex/native-profile-manager.ts
@@ -2,27 +2,35 @@ import { randomUUID } from "node:crypto";
 import { Database } from "bun:sqlite";
 import {
   chmodSync,
+  closeSync,
+  constants as fsConstants,
   existsSync,
+  fstatSync,
+  ftruncateSync,
+  linkSync,
   lstatSync,
   mkdirSync,
+  openSync,
   readFileSync,
   readdirSync,
   realpathSync,
   renameSync,
   rmSync,
   statSync,
-  truncateSync,
   unlinkSync,
   writeFileSync,
 } from "node:fs";
 import { dirname, join, relative, resolve, sep } from "node:path";
 import { atomicWriteFileAsync } from "../config";
-import { hardenSecretPathAsync } from "../lib/windows-secret-acl";
+import { hardenSecretDirAsync, hardenSecretPathAsync } from "../lib/windows-secret-acl";
 import { applyConfirmedMainCodexAccountTransition } from "./account-lifecycle";
 import { decideNativeProfileRecovery } from "./native-profile-recovery";
 import { probeNativeCodexProcesses, type NativeCodexProcessProbe } from "./native-profile-processes";
 import {
   assertUniqueNativeProfileLabel,
+  assertNativeProfileLockPath,
+  assertNativeProfileMetadataLayout,
+  assertNoLegacyNativeProfileState,
   decryptNativeEnvelope,
   encryptNativeEnvelope,
   inspectNativeProfileJournal,
@@ -58,6 +66,11 @@ const LOCK_WAIT_MS = 5_000;
 const STAGE_MAX_AGE_MS = 30 * 60_000;
 const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 
+interface PathIdentity {
+  dev: bigint;
+  ino: bigint;
+}
+
 type AtomicWriter = (path: string, content: string) => Promise<void>;
 type TransitionApplier = (fromAccountId: string, toAccountId: string) => void;
 type EnvelopeReader = (path: string) => NativeEnvelopeSnapshot;
@@ -99,10 +112,49 @@ export interface NativeProfileListResult {
 }
 
 async function hardenNativeProfilePath(path: string): Promise<void> {
-  const mode = statSync(path).isDirectory() ? 0o700 : 0o600;
+  const entry = lstatSync(path);
+  if (entry.isSymbolicLink() || (!entry.isDirectory() && !entry.isFile())) {
+    throw new NativeProfileError("PROFILE_STORAGE_UNSAFE", "A native-profile path is not a private file or directory.", 409);
+  }
+  const directory = entry.isDirectory();
+  const mode = directory ? 0o700 : 0o600;
   try { chmodSync(path, mode); } catch { /* Windows ACL below is authoritative there. */ }
   if (process.platform === "win32") {
-    await hardenSecretPathAsync(path, { required: true, timeoutMemoKey: path });
+    if (directory) await hardenSecretDirAsync(path, { required: true, timeoutMemoKey: path });
+    else await hardenSecretPathAsync(path, { required: true, timeoutMemoKey: path });
+  }
+}
+
+function samePath(left: string, right: string): boolean {
+  return resolve(left) === resolve(right);
+}
+
+function pathIdentity(path: string): PathIdentity {
+  const entry = lstatSync(path, { bigint: true });
+  return { dev: entry.dev, ino: entry.ino };
+}
+
+function sameIdentity(left: PathIdentity, right: PathIdentity): boolean {
+  return left.dev === right.dev && left.ino === right.ino;
+}
+
+function assertPathIdentity(path: string, expected: PathIdentity, label: string): void {
+  try {
+    if (!sameIdentity(pathIdentity(path), expected)) throw new Error("identity changed");
+  } catch {
+    throw new NativeProfileError("PROFILE_STORAGE_UNSAFE", `${label} was replaced during the native-profile operation.`, 409);
+  }
+}
+
+function assertSafeDirectory(path: string, label: string): string {
+  try {
+    const entry = lstatSync(path);
+    if (!entry.isDirectory() || entry.isSymbolicLink()) throw new Error("entry type");
+    const canonical = realpathSync.native(path);
+    if (!samePath(canonical, path)) throw new Error("path substitution");
+    return canonical;
+  } catch {
+    throw new NativeProfileError("PROFILE_STORAGE_UNSAFE", `${label} is not a private canonical directory.`, 409);
   }
 }
 
@@ -127,6 +179,8 @@ export class NativeProfileManager {
   private readonly readEnvelope: EnvelopeReader;
   private readonly readVault: VaultReader;
   private readonly readEnvelopeResult: EnvelopeResultReader;
+  private activeRootIdentity: PathIdentity | null = null;
+  private activeLockIdentity: PathIdentity | null = null;
 
   constructor(options: NativeProfileManagerOptions = {}) {
     this.context = resolveNativeProfileContext(options);
@@ -147,26 +201,25 @@ export class NativeProfileManager {
     this.readEnvelopeResult = options.readEnvelopeResult ?? readNativeEnvelopeResult;
   }
 
-  private async ensureRoot(): Promise<void> {
-    if (!existsSync(this.context.rootDir)) mkdirSync(this.context.rootDir, { recursive: true, mode: 0o700 });
-    await this.hardenPath(this.context.rootDir);
-  }
-
-  private async ensureLockDatabase(): Promise<void> {
-    let database: Database | undefined;
-    try {
-      database = new Database(this.context.lockPath, { create: true });
-    } catch {
-      throw new NativeProfileError("PROFILE_LOCK_UNAVAILABLE", "The native-profile lock is unavailable.", 503, true);
-    } finally {
-      try { database?.close(); } catch { /* acquisition already failed */ }
+  private async ensureRoot(): Promise<PathIdentity> {
+    assertNativeProfileMetadataLayout(this.context);
+    if (!existsSync(this.context.rootDir)) {
+      try { mkdirSync(this.context.rootDir, { mode: 0o700 }); }
+      catch (error) { if (errorCode(error) !== "EEXIST") throw error; }
     }
-    try {
-      try { chmodSync(this.context.lockPath, 0o600); } catch { /* Windows ACL below is authoritative there. */ }
-      await this.hardenPath(this.context.lockPath);
-    } catch {
-      throw new NativeProfileError("PROFILE_LOCK_UNAVAILABLE", "The native-profile lock could not be permission-hardened.", 503, true);
+    const identity = pathIdentity(this.context.rootDir);
+    assertPathIdentity(this.context.rootDir, identity, "The native-profile metadata root");
+    await this.hardenPath(this.context.rootDir);
+    assertPathIdentity(this.context.rootDir, identity, "The native-profile metadata root");
+    assertNativeProfileMetadataLayout(this.context);
+    for (const name of readdirSync(this.context.rootDir)) {
+      assertPathIdentity(this.context.rootDir, identity, "The native-profile metadata root");
+      await this.hardenPath(join(this.context.rootDir, name));
+      assertPathIdentity(this.context.rootDir, identity, "The native-profile metadata root");
     }
+    assertNativeProfileMetadataLayout(this.context);
+    assertPathIdentity(this.context.rootDir, identity, "The native-profile metadata root");
+    return identity;
   }
 
   private isLockBusy(error: unknown): boolean {
@@ -176,18 +229,69 @@ export class NativeProfileManager {
   }
 
   private async withLock<T>(operation: () => Promise<T>): Promise<T> {
-    await this.ensureRoot();
-    await this.ensureLockDatabase();
+    assertNoLegacyNativeProfileState(this.context);
+    assertNativeProfileLockPath(this.context);
     const deadline = this.now() + this.lockWaitMs;
     let database: Database | undefined;
+    let lockHandle: number | undefined;
+    let acquiredLockIdentity: PathIdentity | undefined;
     while (!database) {
       let candidate: Database | undefined;
+      let candidateHandle: number | undefined;
       try {
+        const flags = process.platform === "win32"
+          ? fsConstants.O_RDWR | fsConstants.O_CREAT
+          : fsConstants.O_RDWR | fsConstants.O_CREAT | fsConstants.O_NOFOLLOW;
+        candidateHandle = openSync(this.context.lockPath, flags, 0o600);
+        const opened = fstatSync(candidateHandle, { bigint: true });
+        const pathEntry = lstatSync(this.context.lockPath, { bigint: true });
+        if (
+          !opened.isFile()
+          || !pathEntry.isFile()
+          || pathEntry.isSymbolicLink()
+          || opened.dev !== pathEntry.dev
+          || opened.ino !== pathEntry.ino
+        ) throw new NativeProfileError("PROFILE_STORAGE_UNSAFE", "The native-profile transaction lock was replaced.", 409);
+        const candidateIdentity = { dev: opened.dev, ino: opened.ino };
         candidate = new Database(this.context.lockPath, { create: true });
+        const claim = this.uuid();
         candidate.exec("PRAGMA busy_timeout = 0; BEGIN IMMEDIATE");
+        candidate.exec("CREATE TABLE IF NOT EXISTS ocx_native_profile_lock (singleton INTEGER PRIMARY KEY CHECK (singleton = 1), claim TEXT NOT NULL)");
+        candidate.query("INSERT INTO ocx_native_profile_lock (singleton, claim) VALUES (1, ?) ON CONFLICT(singleton) DO UPDATE SET claim = excluded.claim").run(claim);
+        candidate.exec("COMMIT");
+        candidate.exec("BEGIN IMMEDIATE");
+        const candidateClaim = candidate.query("SELECT claim FROM ocx_native_profile_lock WHERE singleton = 1").get() as { claim?: unknown } | null;
+        let verifier: Database | undefined;
+        let verificationPath: string | undefined;
+        let pathClaim: { claim?: unknown } | null = null;
+        try {
+          verificationPath = `${this.context.lockPath}.verify.${process.pid}.${this.uuid()}`;
+          linkSync(this.context.lockPath, verificationPath);
+          const verificationIdentity = pathIdentity(verificationPath);
+          if (!sameIdentity(verificationIdentity, candidateIdentity)) {
+            throw new NativeProfileError("PROFILE_STORAGE_UNSAFE", "The native-profile transaction lock changed during acquisition.", 409);
+          }
+          verifier = new Database(verificationPath, { readonly: true });
+          pathClaim = verifier.query("SELECT claim FROM ocx_native_profile_lock WHERE singleton = 1").get() as { claim?: unknown } | null;
+          assertPathIdentity(verificationPath, verificationIdentity, "The native-profile transaction lock verification link");
+        } finally {
+          try { verifier?.close(); } catch { /* mismatch below is authoritative */ }
+          try { if (verificationPath !== undefined) unlinkSync(verificationPath); } catch { /* acquisition fails below if verification was incomplete */ }
+        }
+        if (candidateClaim?.claim !== claim || pathClaim?.claim !== claim) {
+          throw new NativeProfileError("PROFILE_STORAGE_UNSAFE", "The native-profile transaction lock changed during acquisition.", 409);
+        }
+        try { chmodSync(this.context.lockPath, 0o600); } catch { /* Windows ACL below is authoritative there. */ }
+        await this.hardenPath(this.context.lockPath);
+        assertNativeProfileLockPath(this.context);
+        assertPathIdentity(this.context.lockPath, candidateIdentity, "The native-profile transaction lock");
         database = candidate;
+        lockHandle = candidateHandle;
+        acquiredLockIdentity = candidateIdentity;
       } catch (error) {
         try { candidate?.close(); } catch { /* acquisition already failed */ }
+        try { if (candidateHandle !== undefined) closeSync(candidateHandle); } catch { /* acquisition already failed */ }
+        if (error instanceof NativeProfileError) throw error;
         if (!this.isLockBusy(error)) {
           throw new NativeProfileError("PROFILE_LOCK_UNAVAILABLE", "The native-profile lock is unavailable.", 503, true);
         }
@@ -198,12 +302,29 @@ export class NativeProfileManager {
       }
     }
     try {
+      this.activeLockIdentity = acquiredLockIdentity!;
+      this.activeRootIdentity = await this.ensureRoot();
       await this.onLockAcquired();
-      return await operation();
+      this.assertOperationStorageStable();
+      const result = await operation();
+      this.assertOperationStorageStable();
+      return result;
     } finally {
       try { database.exec("ROLLBACK"); } catch { /* close still releases the OS-backed lock */ }
       try { database.close(); } catch { /* transaction is already ending */ }
+      try { if (lockHandle !== undefined) closeSync(lockHandle); } catch { /* SQLite handle already released the transaction */ }
+      this.activeRootIdentity = null;
+      this.activeLockIdentity = null;
+    }
+  }
+
+  private assertOperationStorageStable(): void {
+    if (!this.activeRootIdentity || !this.activeLockIdentity) {
+      throw new NativeProfileError("PROFILE_STORAGE_UNSAFE", "Native-profile storage ownership is not active.", 409);
     }
+    assertPathIdentity(this.context.lockPath, this.activeLockIdentity, "The native-profile transaction lock");
+    assertPathIdentity(this.context.rootDir, this.activeRootIdentity, "The native-profile metadata root");
+    assertNativeProfileMetadataLayout(this.context);
   }
 
   private async assertNativeCodexStopped(confirmedStopped: boolean): Promise<void> {
@@ -226,18 +347,24 @@ export class NativeProfileManager {
   }
 
   private async writeVault(vault: NativeMainProfileVaultV1): Promise<void> {
+    this.assertOperationStorageStable();
     await this.atomicWrite(this.context.vaultPath, serializeNativeProfileMetadata(vault));
+    this.assertOperationStorageStable();
   }
 
   private async writeJournal(journal: NativeProfileSwitchJournalV1): Promise<void> {
+    this.assertOperationStorageStable();
     await this.atomicWrite(this.context.journalPath, serializeNativeProfileJournal(journal));
+    this.assertOperationStorageStable();
   }
 
   private removeJournal(): void {
+    this.assertOperationStorageStable();
     try { unlinkSync(this.context.journalPath); } catch (error) { if (errorCode(error) !== "ENOENT") throw error; }
   }
 
   private removeRecoveryBlock(): void {
+    this.assertOperationStorageStable();
     try { unlinkSync(this.context.recoveryBlockPath); } catch (error) { if (errorCode(error) !== "ENOENT") throw error; }
   }
 
@@ -281,6 +408,7 @@ export class NativeProfileManager {
   private async quarantineInvalidJournalLocked(): Promise<Record<string, unknown>> {
     const quarantineFile = this.context.homeId + ".journal.quarantine-" + this.uuid() + ".json";
     const quarantinePath = join(this.context.rootDir, quarantineFile);
+    this.assertOperationStorageStable();
     await this.atomicWrite(this.context.recoveryBlockPath, serializeNativeProfileMetadata({
       version: 1,
       homeId: this.context.homeId,
@@ -288,8 +416,11 @@ export class NativeProfileManager {
       quarantineFile,
       createdAt: new Date(this.now()).toISOString(),
     }));
+    this.assertOperationStorageStable();
     try {
       renameSync(this.context.journalPath, quarantinePath);
+      await this.hardenPath(quarantinePath);
+      this.assertOperationStorageStable();
     } catch {
       throw new NativeProfileError(
         "RECOVERY_REQUIRED",
@@ -470,37 +601,137 @@ export class NativeProfileManager {
     return join(this.context.stagingRoot, stageId);
   }
 
-  private verifiedStagePath(stageId: string, requireFresh = true): string {
+  private assertStagingLayout(requireRoot = false): void {
+    if (!existsSync(this.context.configDir)) {
+      if (requireRoot) throw new NativeProfileError("STAGING_NOT_FOUND", "The native-login staging root is missing.", 404);
+      return;
+    }
+    const configDir = assertSafeDirectory(this.context.configDir, "The OpenCodex configuration root");
+    const stagingBase = dirname(this.context.stagingRoot);
+    if (!samePath(stagingBase, join(configDir, "native-main-profile-staging"))) {
+      throw new NativeProfileError("PROFILE_STORAGE_UNSAFE", "The native-login staging root escaped OPENCODEX_HOME.", 409);
+    }
+    if (!existsSync(stagingBase)) {
+      if (requireRoot) throw new NativeProfileError("STAGING_NOT_FOUND", "The native-login staging root is missing.", 404);
+      return;
+    }
+    const canonicalBase = assertSafeDirectory(stagingBase, "The native-login staging namespace");
+    if (!samePath(dirname(this.context.stagingRoot), canonicalBase)) {
+      throw new NativeProfileError("PROFILE_STORAGE_UNSAFE", "The native-login staging root is not contained by OPENCODEX_HOME.", 409);
+    }
+    if (!existsSync(this.context.stagingRoot)) {
+      if (requireRoot) throw new NativeProfileError("STAGING_NOT_FOUND", "The native-login staging root is missing.", 404);
+      return;
+    }
+    assertSafeDirectory(this.context.stagingRoot, "The native-login staging root");
+  }
+
+  private async ensureStagingRoot(): Promise<void> {
+    if (!existsSync(this.context.configDir)) mkdirSync(this.context.configDir, { recursive: true, mode: 0o700 });
+    this.assertStagingLayout(false);
+    const stagingBase = dirname(this.context.stagingRoot);
+    if (!existsSync(stagingBase)) mkdirSync(stagingBase, { mode: 0o700 });
+    assertSafeDirectory(stagingBase, "The native-login staging namespace");
+    await this.hardenPath(stagingBase);
+    if (!existsSync(this.context.stagingRoot)) mkdirSync(this.context.stagingRoot, { mode: 0o700 });
+    assertSafeDirectory(this.context.stagingRoot, "The native-login staging root");
+    await this.hardenPath(this.context.stagingRoot);
+    this.assertStagingLayout(true);
+  }
+
+  private verifiedStagePath(stageId: string, requireFresh = true): { path: string; identity: PathIdentity } {
+    this.assertStagingLayout(true);
     const expected = resolve(this.stagePath(stageId));
     try {
-      if (lstatSync(expected).isSymbolicLink() || !lstatSync(expected).isDirectory()) throw new Error("stage type");
+      const entry = lstatSync(expected);
+      if (entry.isSymbolicLink() || !entry.isDirectory()) throw new Error("stage type");
+      const identity = pathIdentity(expected);
       const canonicalRoot = resolve(realpathSync.native(this.context.stagingRoot));
       const canonicalExpected = resolve(realpathSync.native(expected));
       const rel = relative(canonicalRoot, canonicalExpected);
       if (!rel || rel.startsWith("..") || rel.includes(sep)) throw new Error("stage root");
       const metadata = JSON.parse(readFileSync(join(canonicalExpected, "stage.json"), "utf8")) as Record<string, unknown>;
-      if (metadata.version !== 1 || metadata.stageId !== stageId || metadata.homeId !== this.context.homeId) throw new Error("stage metadata");
+      if (
+        metadata.version !== 1
+        || metadata.stageId !== stageId
+        || metadata.homeId !== this.context.homeId
+        || metadata.instanceId !== this.context.instanceId
+      ) throw new Error("stage metadata");
       if (typeof metadata.createdAt !== "number") throw new Error("stage age");
       if (requireFresh && this.now() - metadata.createdAt > STAGE_MAX_AGE_MS) throw new Error("stage age");
-      return canonicalExpected;
+      assertPathIdentity(canonicalExpected, identity, "The native-login staging directory");
+      return { path: canonicalExpected, identity };
     } catch {
       throw new NativeProfileError("STAGING_NOT_FOUND", "The native-login staging session is missing, expired, or invalid.", 404);
     }
   }
 
-  private deleteStage(path: string): void {
+  private deleteStage(path: string, identity?: PathIdentity): void {
+    if (identity) assertPathIdentity(path, identity, "The native-login staging directory");
     const authPath = join(path, "auth.json");
+    let authFd: number | undefined;
     try {
-      const authStat = lstatSync(authPath);
-      if (authStat.isFile() && !authStat.isSymbolicLink()) truncateSync(authPath, 0);
-    } catch { /* removal below is authoritative */ }
+      const flags = process.platform === "win32"
+        ? fsConstants.O_RDWR
+        : fsConstants.O_RDWR | fsConstants.O_NOFOLLOW;
+      authFd = openSync(authPath, flags);
+      const opened = fstatSync(authFd, { bigint: true });
+      const pathEntry = lstatSync(authPath, { bigint: true });
+      if (
+        !opened.isFile()
+        || !pathEntry.isFile()
+        || pathEntry.isSymbolicLink()
+        || opened.dev !== pathEntry.dev
+        || opened.ino !== pathEntry.ino
+        || opened.nlink !== 1n
+      ) throw new NativeProfileError(
+        "STAGING_CLEANUP_REQUIRED",
+        "The staged credential file is not privately owned; plaintext may remain and requires manual cleanup.",
+        500,
+        false,
+        true,
+      );
+      unlinkSync(authPath);
+      const unlinked = fstatSync(authFd, { bigint: true });
+      if (unlinked.dev !== opened.dev || unlinked.ino !== opened.ino || unlinked.nlink !== 0n) {
+        throw new NativeProfileError(
+          "STAGING_CLEANUP_REQUIRED",
+          "The staged credential file could not be exclusively unlinked; plaintext may remain and requires manual cleanup.",
+          500,
+          false,
+          true,
+        );
+      }
+      ftruncateSync(authFd, 0);
+    } catch (error) {
+      if (error instanceof NativeProfileError) throw error;
+      if (errorCode(error) !== "ENOENT") {
+        throw new NativeProfileError(
+          "STAGING_CLEANUP_REQUIRED",
+          "The staged credential file could not be securely scrubbed; plaintext may remain and requires manual cleanup.",
+          500,
+          false,
+          true,
+        );
+      }
+    } finally {
+      try { if (authFd !== undefined) closeSync(authFd); } catch { /* removal below remains required */ }
+    }
+    if (identity) assertPathIdentity(path, identity, "The native-login staging directory");
     this.removeStageTree(path);
   }
 
-  private deleteStageById(stageId: string): void {
+  private deleteStageById(stageId: string, requirePresent = false): void {
+    this.assertStagingLayout(true);
     const expected = resolve(this.stagePath(stageId));
     let stageStat: ReturnType<typeof lstatSync>;
-    try { stageStat = lstatSync(expected); } catch (error) { if (errorCode(error) === "ENOENT") return; throw error; }
+    try { stageStat = lstatSync(expected); } catch (error) {
+      if (errorCode(error) === "ENOENT") {
+        if (requirePresent) throw new NativeProfileError("STAGING_NOT_FOUND", "The native-login staging session is missing.", 404);
+        return;
+      }
+      throw error;
+    }
     if (stageStat.isSymbolicLink() || !stageStat.isDirectory()) {
       unlinkSync(expected);
       return;
@@ -511,11 +742,12 @@ export class NativeProfileManager {
     if (!rel || rel.startsWith("..") || rel.includes(sep)) {
       throw new NativeProfileError("STAGING_CLEANUP_REQUIRED", "The staging path could not be safely removed.", 500);
     }
-    this.deleteStage(canonicalExpected);
+    this.deleteStage(canonicalExpected, pathIdentity(canonicalExpected));
   }
 
   private sweepStaleStages(): number {
     if (!existsSync(this.context.stagingRoot)) return 0;
+    this.assertStagingLayout(true);
     let removed = 0;
     for (const name of readdirSync(this.context.stagingRoot)) {
       if (!UUID_RE.test(name)) continue;
@@ -527,7 +759,13 @@ export class NativeProfileManager {
         if (stageStat.isDirectory() && !stageStat.isSymbolicLink()) {
           try {
             const metadata = JSON.parse(readFileSync(join(path, "stage.json"), "utf8")) as Record<string, unknown>;
-            if (metadata.version === 1 && metadata.stageId === name && metadata.homeId === this.context.homeId && typeof metadata.createdAt === "number") {
+            if (
+              metadata.version === 1
+              && metadata.stageId === name
+              && metadata.homeId === this.context.homeId
+              && metadata.instanceId === this.context.instanceId
+              && typeof metadata.createdAt === "number"
+            ) {
               createdAt = metadata.createdAt;
             }
           } catch { /* mtime bounds malformed crash residue */ }
@@ -559,9 +797,7 @@ export class NativeProfileManager {
         key = await this.keyForVault(vault);
         current = this.readEnvelope(this.context.authPath);
         this.assertCurrentIdentity(vault, current, key);
-        if (!existsSync(this.context.stagingRoot)) mkdirSync(this.context.stagingRoot, { recursive: true, mode: 0o700 });
-        await this.hardenPath(dirname(this.context.stagingRoot));
-        await this.hardenPath(this.context.stagingRoot);
+        await this.ensureStagingRoot();
         const stageId = this.uuid();
         const path = this.stagePath(stageId);
         mkdirSync(path, { mode: 0o700 });
@@ -569,7 +805,13 @@ export class NativeProfileManager {
           await this.hardenPath(path);
           writeFileSync(join(path, "config.toml"), 'cli_auth_credentials_store = "file"\n', { mode: 0o600 });
           await this.hardenPath(join(path, "config.toml"));
-          writeFileSync(join(path, "stage.json"), serializeNativeProfileMetadata({ version: 1, stageId, homeId: this.context.homeId, createdAt: this.now() }), { mode: 0o600 });
+          writeFileSync(join(path, "stage.json"), serializeNativeProfileMetadata({
+            version: 1,
+            stageId,
+            homeId: this.context.homeId,
+            instanceId: this.context.instanceId,
+            createdAt: this.now(),
+          }), { mode: 0o600 });
           await this.hardenPath(join(path, "stage.json"));
         } catch (error) {
           try { rmSync(path, { recursive: true, force: true }); } catch { /* original error wins */ }
@@ -590,7 +832,7 @@ export class NativeProfileManager {
       // claiming cleanup ownership. Freshness and every later failure are then
       // server-authoritatively cleaned, while lock/ownership failures leave a
       // stage that another valid operation may own untouched.
-      const ownedStagePath = this.verifiedStagePath(stageId, false);
+      const ownedStage = this.verifiedStagePath(stageId, false);
       let target: NativeEnvelopeSnapshot | null = null;
       let current: NativeEnvelopeSnapshot | null = null;
       let key: NativeProfileKey | null = null;
@@ -599,11 +841,12 @@ export class NativeProfileManager {
       let importCommitted = false;
       let result: { effectiveCodexHome: string; profile: NativeProfilePublic } | undefined;
       try {
-        this.verifiedStagePath(stageId);
+        const verifiedStage = this.verifiedStagePath(stageId);
         this.assertNoPendingRecovery();
         requireFileCredentialStore(this.context);
         const label = validateNativeProfileLabel(labelInput);
-        target = readNativeEnvelope(join(ownedStagePath, "auth.json"));
+        target = readNativeEnvelope(join(verifiedStage.path, "auth.json"));
+        assertPathIdentity(verifiedStage.path, verifiedStage.identity, "The native-login staging directory");
         current = readNativeEnvelope(this.context.authPath);
         const vault = this.requireVault();
         if (vault.profiles.length >= MAX_NATIVE_PROFILES) {
@@ -667,7 +910,7 @@ export class NativeProfileManager {
       }
       let cleanupFailed = false;
       try {
-        this.deleteStage(ownedStagePath);
+        this.deleteStage(ownedStage.path, ownedStage.identity);
       } catch {
         cleanupFailed = true;
       }
@@ -707,7 +950,9 @@ export class NativeProfileManager {
 
   async cancelStage(stageId: string): Promise<void> {
     await this.withLock(async () => {
-      try { this.deleteStageById(stageId); } catch (error) {
+      try {
+        this.deleteStageById(stageId, true);
+      } catch (error) {
         if (error instanceof NativeProfileError) throw error;
         throw new NativeProfileError("STAGING_CLEANUP_REQUIRED", "The native-login staging session could not be securely removed.", 500);
       }
@@ -793,6 +1038,7 @@ export class NativeProfileManager {
         await this.writeJournal(journal);
         journalPrepared = true;
         await this.onSwitchBoundary("journal-prepared");
+        this.assertOperationStorageStable();
         await this.atomicWrite(this.context.authPath, target.text);
         const observedTarget = this.verifyWrittenEnvelope(target.digest, targetProfile.identityHash, key);
         observedTarget.raw.fill(0);
@@ -820,6 +1066,7 @@ export class NativeProfileManager {
           throw new NativeProfileError("RECOVERY_REQUIRED", "The login changed, but final transaction cleanup requires recovery.", 409);
         }
         try {
+          this.assertOperationStorageStable();
           await this.atomicWrite(this.context.authPath, source!.text);
           const restored = this.verifyWrittenEnvelope(source!.digest, nativeIdentityHash(key!.key, source!.accountId), key!);
           restored.raw.fill(0);
@@ -933,6 +1180,7 @@ export class NativeProfileManager {
           await this.writeVault(rollbackVault);
           rollbackVaultPublished = true;
         }
+        this.assertOperationStorageStable();
         await this.atomicWrite(this.context.authPath, sourceEnvelope.text);
         const restored = this.verifyWrittenEnvelope(sourceEnvelope.digest, journal.sourceIdentityHash, key);
         restored.raw.fill(0);
diff --git a/src/codex/native-profile-store.ts b/src/codex/native-profile-store.ts
index d7b2b541a..df13785c0 100644
--- a/src/codex/native-profile-store.ts
+++ b/src/codex/native-profile-store.ts
@@ -13,11 +13,12 @@ import {
   fstatSync,
   lstatSync,
   openSync,
+  readdirSync,
   readSync,
   realpathSync,
   statSync,
 } from "node:fs";
-import { join, resolve } from "node:path";
+import { basename, dirname, join, resolve } from "node:path";
 import { getConfigDir } from "../config";
 import { extractAccountId } from "../oauth/chatgpt";
 import { getCodexHome, readRootTomlString } from "./paths";
@@ -34,8 +35,12 @@ import {
 } from "./native-profile-types";
 
 const DOMAIN_HOME = "opencodex-native-profile-home-v1\0";
+const DOMAIN_INSTANCE = "opencodex-native-profile-instance-v1\0";
 const DOMAIN_IDENTITY = "opencodex-native-profile-identity-v1\0";
 const KEYRING_SERVICE = "opencodex.native-main-profile.v1";
+const SHARED_METADATA_DIR = ".opencodex-native-main-profiles";
+const INSTANCE_STAGING_DIR = "native-main-profile-staging";
+const LEGACY_METADATA_DIR = "native-main-profiles";
 const MAX_AUTH_BYTES = 4 * 1024 * 1024;
 export const MAX_NATIVE_PROFILE_METADATA_BYTES = 4 * 1024 * 1024;
 export const MAX_NATIVE_PROFILE_JOURNAL_BYTES = 17 * 1024 * 1024;
@@ -47,8 +52,11 @@ const BOUNDED_READ_TEST_SEAM = Symbol.for("opencodex.native-profile-store.bounde
 export interface NativeProfileContext {
   codexHome: string;
   configDir: string;
+  instanceId: string;
+  legacyHomeId: string | null;
   rootDir: string;
   stagingRoot: string;
+  legacyRootDir: string;
   homeId: string;
   authPath: string;
   vaultPath: string;
@@ -58,6 +66,7 @@ export interface NativeProfileContext {
 }
 
 interface BoundedReadTestSeam {
+  beforeOpen?: (path: string) => void;
   afterValidatedOpen?: (path: string, fd: number) => void;
   onBufferAllocated?: (byteLength: number) => void;
   onRead?: (requestedBytes: number, bytesRead: number, totalBytesRead: number) => void;
@@ -189,17 +198,173 @@ function canonicalExistingDirectory(path: string, label: string): string {
   }
 }
 
+function normalizedPath(path: string): string {
+  return resolve(path);
+}
+
+function canonicalizeDirectoryPath(path: string): string {
+  const unresolved: string[] = [];
+  let cursor = resolve(path);
+  for (;;) {
+    try {
+      if (!statSync(cursor).isDirectory()) throw new Error("not a directory");
+      return join(realpathSync.native(cursor), ...unresolved.reverse());
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== "ENOENT") {
+        throw new NativeProfileError("PROFILE_STORAGE_UNSAFE", "The OpenCodex configuration root is not safely accessible.", 409);
+      }
+      const parent = dirname(cursor);
+      if (parent === cursor) {
+        throw new NativeProfileError("PROFILE_STORAGE_UNSAFE", "The OpenCodex configuration root is not safely accessible.", 409);
+      }
+      unresolved.push(basename(cursor));
+      cursor = parent;
+    }
+  }
+}
+
+/** Bind keyring and encrypted AAD identity to the case-preserving canonical path. */
+export function nativeProfileHomeId(canonicalCodexHome: string): string {
+  return createHash("sha256").update(DOMAIN_HOME).update(canonicalCodexHome).digest("hex");
+}
+
+export function legacyWindowsNativeProfileHomeId(canonicalCodexHome: string): string {
+  return createHash("sha256").update(DOMAIN_HOME).update(canonicalCodexHome.toLowerCase()).digest("hex");
+}
+
+function samePath(left: string, right: string): boolean {
+  return normalizedPath(left) === normalizedPath(right);
+}
+
+function storageUnsafe(message: string): never {
+  throw new NativeProfileError("PROFILE_STORAGE_UNSAFE", message, 409);
+}
+
+function assertCanonicalDirectory(path: string, label: string): string {
+  try {
+    const entry = lstatSync(path);
+    if (!entry.isDirectory() || entry.isSymbolicLink()) storageUnsafe(`${label} is not a private directory.`);
+    const canonical = realpathSync.native(path);
+    if (!samePath(canonical, path)) storageUnsafe(`${label} contains a link or reparse-point substitution.`);
+    return canonical;
+  } catch (error) {
+    if (error instanceof NativeProfileError) throw error;
+    storageUnsafe(`${label} is not safely accessible.`);
+  }
+}
+
+function assertCanonicalFile(path: string, parent: string, label: string): void {
+  try {
+    const entry = lstatSync(path);
+    if (!entry.isFile() || entry.isSymbolicLink()) storageUnsafe(`${label} is not a private regular file.`);
+    const canonical = realpathSync.native(path);
+    if (!samePath(canonical, path) || !samePath(dirname(canonical), parent)) {
+      storageUnsafe(`${label} escaped its private metadata root.`);
+    }
+  } catch (error) {
+    if (error instanceof NativeProfileError) throw error;
+    storageUnsafe(`${label} is not safely accessible.`);
+  }
+}
+
+function pathExists(path: string): boolean {
+  try {
+    lstatSync(path);
+    return true;
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") return false;
+    storageUnsafe("Native-profile storage could not be inspected safely.");
+  }
+}
+
+function rootHasNativeProfileState(root: string, homeIds: readonly string[], includeStaging: boolean): boolean {
+  if (!pathExists(root)) return false;
+  let names: string[];
+  try {
+    const entry = lstatSync(root);
+    if (!entry.isDirectory() || entry.isSymbolicLink()) return true;
+    const canonical = realpathSync.native(root);
+    if (!samePath(canonical, root)) return true;
+    names = readdirSync(root);
+  } catch {
+    return true;
+  }
+  for (const homeId of homeIds) {
+    const exact = new Set([
+      `${homeId}.vault.json`,
+      `${homeId}.journal.json`,
+      `${homeId}.recovery-block.json`,
+    ]);
+    if (names.some(name => exact.has(name) || name.startsWith(`${homeId}.journal.quarantine-`))) return true;
+    if (includeStaging && pathExists(join(root, "staging", homeId))) return true;
+  }
+  return false;
+}
+
+function hasLegacyNativeProfileState(context: NativeProfileContext): boolean {
+  const oldIds = context.legacyHomeId && context.legacyHomeId !== context.homeId
+    ? [context.homeId, context.legacyHomeId]
+    : [context.homeId];
+  if (rootHasNativeProfileState(context.legacyRootDir, oldIds, true)) return true;
+  return context.legacyHomeId !== null
+    && context.legacyHomeId !== context.homeId
+    && rootHasNativeProfileState(context.rootDir, [context.legacyHomeId], false);
+}
+
+export function assertNoLegacyNativeProfileState(context: NativeProfileContext): void {
+  if (!hasLegacyNativeProfileState(context)) return;
+  throw new NativeProfileError(
+    "LEGACY_PROFILE_STATE",
+    "Legacy native-profile state exists under OPENCODEX_HOME. Stop every OpenCodex proxy sharing this CODEX_HOME, then migrate or reset the preview state as documented.",
+    409,
+  );
+}
+
+/**
+ * Validate the one authoritative metadata root without following links. On Windows,
+ * Node reports symlinks and junctions through lstat; the realpath equality check also
+ * rejects other path-resolving reparse-point substitutions.
+ */
+export function assertNativeProfileMetadataLayout(context: NativeProfileContext): void {
+  assertNoLegacyNativeProfileState(context);
+  const canonicalHome = assertCanonicalDirectory(context.codexHome, "The effective CODEX_HOME");
+  const expectedRoot = join(canonicalHome, SHARED_METADATA_DIR);
+  if (!samePath(context.rootDir, expectedRoot)) storageUnsafe("The native-profile metadata root is not owned by CODEX_HOME.");
+  if (!pathExists(context.rootDir)) return;
+  const canonicalRoot = assertCanonicalDirectory(context.rootDir, "The native-profile metadata root");
+  let names: string[];
+  try {
+    names = readdirSync(canonicalRoot);
+  } catch {
+    storageUnsafe("The native-profile metadata root is not safely readable.");
+  }
+  for (const name of names) {
+    assertCanonicalFile(join(canonicalRoot, name), canonicalRoot, "A native-profile metadata entry");
+  }
+}
+
+export function assertNativeProfileLockPath(context: NativeProfileContext): void {
+  const canonicalHome = assertCanonicalDirectory(context.codexHome, "The effective CODEX_HOME");
+  const expected = join(canonicalHome, ".opencodex-native-profile.lock.sqlite");
+  if (!samePath(context.lockPath, expected)) storageUnsafe("The native-profile transaction lock is outside CODEX_HOME.");
+  if (pathExists(context.lockPath)) assertCanonicalFile(context.lockPath, canonicalHome, "The native-profile transaction lock");
+}
+
 export function resolveNativeProfileContext(options: { codexHome?: string; configDir?: string } = {}): NativeProfileContext {
   const codexHome = canonicalExistingDirectory(options.codexHome ?? getCodexHome(), "The effective CODEX_HOME");
-  const configDir = resolve(options.configDir ?? getConfigDir());
-  const homeBytes = process.platform === "win32" ? codexHome.toLowerCase() : codexHome;
-  const homeId = createHash("sha256").update(DOMAIN_HOME).update(homeBytes).digest("hex");
-  const rootDir = join(configDir, "native-main-profiles");
+  const configDir = canonicalizeDirectoryPath(options.configDir ?? getConfigDir());
+  const homeId = nativeProfileHomeId(codexHome);
+  const foldedHomeId = process.platform === "win32" ? legacyWindowsNativeProfileHomeId(codexHome) : homeId;
+  const instanceId = createHash("sha256").update(DOMAIN_INSTANCE).update(configDir).digest("hex");
+  const rootDir = join(codexHome, SHARED_METADATA_DIR);
   return {
     codexHome,
     configDir,
+    instanceId,
+    legacyHomeId: foldedHomeId === homeId ? null : foldedHomeId,
     rootDir,
-    stagingRoot: join(rootDir, "staging", homeId),
+    stagingRoot: join(configDir, INSTANCE_STAGING_DIR, homeId),
+    legacyRootDir: join(configDir, LEGACY_METADATA_DIR),
     homeId,
     authPath: join(codexHome, "auth.json"),
     vaultPath: join(rootDir, `${homeId}.vault.json`),
@@ -213,6 +378,7 @@ function readBounded(path: string, limit: number, testSeam?: BoundedReadTestSeam
   let fd: number | undefined;
   let failed = false;
   try {
+    testSeam?.beforeOpen?.(path);
     const flags = process.platform === "win32"
       ? fsConstants.O_RDONLY
       : fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW;
@@ -530,16 +696,16 @@ function hasValidJournalSwitchInvariant(journal: NativeProfileSwitchJournalV1):
 }
 
 export function readNativeProfileVault(context: NativeProfileContext): NativeMainProfileVaultV1 | null {
-  if (!existsSync(context.vaultPath)) return null;
+  assertNativeProfileMetadataLayout(context);
+  let raw: Buffer;
   try {
-    return parseVaultObject(
-      JSON.parse(readBounded(
-        context.vaultPath,
-        MAX_NATIVE_PROFILE_METADATA_BYTES,
-        boundedReadTestSeam(context),
-      ).toString("utf8")),
-      context.homeId,
-    );
+    raw = readBounded(context.vaultPath, MAX_NATIVE_PROFILE_METADATA_BYTES, boundedReadTestSeam(context));
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") return null;
+    throw new NativeProfileError("VAULT_INVALID", "The encrypted native-profile vault is unreadable.", 409);
+  }
+  try {
+    return parseVaultObject(JSON.parse(raw.toString("utf8")), context.homeId);
   } catch {
     throw new NativeProfileError("VAULT_INVALID", "The encrypted native-profile vault is invalid.", 409);
   }
@@ -559,6 +725,7 @@ function privateFileState(path: string): PrivateFileState {
 export type NativeProfileRecoveryState = "none" | "journal" | "manual" | "unreadable";
 
 export function probeNativeProfileRecoveryState(context: NativeProfileContext): NativeProfileRecoveryState {
+  try { assertNativeProfileMetadataLayout(context); } catch { return "unreadable"; }
   const block = privateFileState(context.recoveryBlockPath);
   if (block === "unreadable") return "unreadable";
   if (block === "present") return "manual";
@@ -573,6 +740,7 @@ export type NativeProfileJournalInspection =
   | { status: "invalid" };
 
 export function inspectNativeProfileJournal(context: NativeProfileContext): NativeProfileJournalInspection {
+  try { assertNativeProfileMetadataLayout(context); } catch { return { status: "invalid" }; }
   const state = privateFileState(context.journalPath);
   if (state === "missing") return { status: "missing" };
   if (state === "unreadable") return { status: "invalid" };
diff --git a/src/codex/native-profile-types.ts b/src/codex/native-profile-types.ts
index 69f98efb1..567a1adb5 100644
--- a/src/codex/native-profile-types.ts
+++ b/src/codex/native-profile-types.ts
@@ -22,6 +22,8 @@ export type NativeProfileErrorCode =
   | "STAGING_NOT_FOUND"
   | "STAGING_CLEANUP_REQUIRED"
   | "PROFILE_METADATA_TOO_LARGE"
+  | "PROFILE_STORAGE_UNSAFE"
+  | "LEGACY_PROFILE_STATE"
   | "INTERNAL_ERROR"
   | "VAULT_INVALID";
 
diff --git a/structure/02_config-and-codex-home.md b/structure/02_config-and-codex-home.md
index ac27547e4..9610fdbb7 100644
--- a/structure/02_config-and-codex-home.md
+++ b/structure/02_config-and-codex-home.md
@@ -14,11 +14,23 @@ $CODEX_HOME/opencodex.config.toml
 $CODEX_HOME/opencodex-catalog.json
 $CODEX_HOME/opencodex-journal.json
 $CODEX_HOME/models_cache.json
+$CODEX_HOME/.opencodex-native-main-profiles/
 ```
 
 Never assume macOS-only paths. Windows, service installs, and app-launched Codex can all depend on
 the resolved `CODEX_HOME`.
 
+Native-main profile ownership is bound to the real `CODEX_HOME`, not to an OpenCodex instance.
+Its encrypted vault, transaction journal, recovery marker, and referenced quarantine files live in
+the owner-only `.opencodex-native-main-profiles` directory. The unchanged
+`.opencodex-native-profile.lock.sqlite` beside that directory serializes every process sharing the
+home. Only plaintext login staging is instance-local under
+`$OPENCODEX_HOME/native-main-profile-staging`; a stage from one instance is invalid in another.
+These paths and the OS keyring are owner-only: the operating-system account that owns them is the
+trust boundary and already has direct access to active native credentials. OpenCodex detects and
+fails closed on file identities that change during an operation, but it does not claim isolation
+from a malicious process already running as that same trusted OS account.
+
 OpenCodex never overrides an explicit `CODEX_HOME`. On Windows, `ocx doctor` and `ocx status`
 nevertheless diagnose the high-confidence Orca dual-home case: both `CODEX_HOME` and
 `ORCA_CODEX_HOME` select Orca's `orca/codex-runtime-home/home`, while the ChatGPT/Codex app uses the
diff --git a/tests/native-profile-manager.test.ts b/tests/native-profile-manager.test.ts
index e88666d8b..c733c7ffb 100644
--- a/tests/native-profile-manager.test.ts
+++ b/tests/native-profile-manager.test.ts
@@ -1,5 +1,5 @@
 import { afterEach, describe, expect, test } from "bun:test";
-import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { existsSync, linkSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 import { NativeProfileManager } from "../src/codex/native-profile-manager";
@@ -217,7 +217,13 @@ describe("native main profile transactions", () => {
     try {
       await waitForPath(ready);
       const contender = new NativeProfileManager({ ...f.options, configDir: secondConfigDir, lockWaitMs: 100 });
-      expect(contender.context.lockPath).toBe(new NativeProfileManager(f.options).context.lockPath);
+      const owner = new NativeProfileManager(f.options);
+      expect(contender.context.rootDir).toBe(owner.context.rootDir);
+      expect(contender.context.vaultPath).toBe(owner.context.vaultPath);
+      expect(contender.context.journalPath).toBe(owner.context.journalPath);
+      expect(contender.context.recoveryBlockPath).toBe(owner.context.recoveryBlockPath);
+      expect(contender.context.lockPath).toBe(owner.context.lockPath);
+      expect(contender.context.stagingRoot).not.toBe(owner.context.stagingRoot);
       let caught: unknown;
       try { await contender.recover(false); } catch (error) { caught = error; }
       expect(caught).toBeInstanceOf(NativeProfileError);
@@ -228,6 +234,157 @@ describe("native main profile transactions", () => {
     }
   }, 15_000);
 
+  test("shares one vault while preventing another OPENCODEX_HOME from finishing or cancelling a stage", async () => {
+    const f = fixture();
+    const first = new NativeProfileManager(f.options);
+    await first.register("personal");
+    const stage = await first.prepareStage();
+    writeFileSync(join(stage.stagingCodexHome, "auth.json"), f.target, { mode: 0o600 });
+    const secondConfigDir = join(f.root, "opencodex-second");
+    mkdirSync(secondConfigDir, { mode: 0o700 });
+    const second = new NativeProfileManager({ ...f.options, configDir: secondConfigDir });
+
+    expect((await second.list()).profiles.map(profile => profile.label)).toEqual(["personal"]);
+    let finishError: unknown;
+    try { await second.finishStage(stage.stageId, "work"); } catch (error) { finishError = error; }
+    expect(finishError).toBeInstanceOf(NativeProfileError);
+    expect((finishError as NativeProfileError).code).toBe("STAGING_NOT_FOUND");
+    let cancelError: unknown;
+    try { await second.cancelStage(stage.stageId); } catch (error) { cancelError = error; }
+    expect(cancelError).toBeInstanceOf(NativeProfileError);
+    expect((cancelError as NativeProfileError).code).toBe("STAGING_NOT_FOUND");
+    expect(existsSync(stage.stagingCodexHome)).toBe(true);
+
+    await first.finishStage(stage.stageId, "work");
+    expect((await second.list()).profiles.map(profile => profile.label).sort()).toEqual(["personal", "work"]);
+  });
+
+  test("shares journal quarantine and manual recovery state across OPENCODEX_HOME roots", async () => {
+    const f = await enrolledFixture();
+    const secondConfigDir = join(f.root, "opencodex-second");
+    mkdirSync(secondConfigDir, { mode: 0o700 });
+    const second = new NativeProfileManager({ ...f.options, configDir: secondConfigDir });
+    const originalAuth = readFileSync(f.manager.context.authPath, "utf8");
+    const originalVault = readFileSync(f.manager.context.vaultPath, "utf8");
+    const malformed = "{cross-instance-malformed-journal\n";
+    writeFileSync(f.manager.context.journalPath, malformed, { mode: 0o600 });
+    writeFileSync(f.manager.context.authPath, envelope("account-third", "third"), { mode: 0o600 });
+
+    expect(probeNativeProfileRecoveryState(second.context)).toBe("journal");
+    let caught: unknown;
+    try { await second.recover(true, true); } catch (error) { caught = error; }
+    expect(caught).toBeInstanceOf(NativeProfileError);
+    expect((caught as NativeProfileError).code).toBe("RECOVERY_REQUIRED");
+    expect(probeNativeProfileRecoveryState(f.manager.context)).toBe("manual");
+    expect(f.manager.context.recoveryBlockPath).toBe(second.context.recoveryBlockPath);
+    expect(readFileSync(f.manager.context.vaultPath, "utf8")).toBe(originalVault);
+    const quarantine = readdirSync(f.manager.context.rootDir).filter(name => name.includes(".journal.quarantine-"));
+    expect(quarantine).toHaveLength(1);
+    expect(readFileSync(join(f.manager.context.rootDir, quarantine[0]!), "utf8")).toBe(malformed);
+
+    writeFileSync(f.manager.context.authPath, originalAuth, { mode: 0o600 });
+    expect(await f.manager.recover(false)).toMatchObject({ recovered: true, action: "confirm-current-owner" });
+    expect(probeNativeProfileRecoveryState(second.context)).toBe("none");
+  });
+
+  test("fails closed when the shared metadata root is replaced before vault publication", async () => {
+    const f = fixture();
+    const attacker = join(f.root, "attacker");
+    const displaced = join(f.root, "displaced-metadata");
+    mkdirSync(attacker, { mode: 0o700 });
+    let manager!: NativeProfileManager;
+    manager = new NativeProfileManager({
+      ...f.options,
+      onLockAcquired: () => {
+        renameSync(manager.context.rootDir, displaced);
+        mkdirSync(manager.context.rootDir, { mode: 0o700 });
+      },
+    });
+    const authBefore = readFileSync(join(f.codexHome, "auth.json"), "utf8");
+    let caught: unknown;
+    try { await manager.register("personal"); } catch (error) { caught = error; }
+    finally {
+      try { rmSync(manager.context.rootDir, { recursive: true, force: true }); } catch { /* fixture cleanup */ }
+      if (existsSync(displaced) && !existsSync(manager.context.rootDir)) renameSync(displaced, manager.context.rootDir);
+    }
+    expect(caught).toBeInstanceOf(NativeProfileError);
+    expect((caught as NativeProfileError).code).toBe("PROFILE_STORAGE_UNSAFE");
+    expect(readFileSync(join(f.codexHome, "auth.json"), "utf8")).toBe(authBefore);
+    expect(readdirSync(attacker)).toEqual([]);
+  });
+
+  test("cancels a malformed stage without trusting its metadata", async () => {
+    const f = fixture();
+    const manager = new NativeProfileManager(f.options);
+    await manager.register("personal");
+    const stage = await manager.prepareStage();
+    writeFileSync(join(stage.stagingCodexHome, "auth.json"), f.target, { mode: 0o600 });
+    writeFileSync(join(stage.stagingCodexHome, "stage.json"), "{malformed\n", { mode: 0o600 });
+
+    await manager.cancelStage(stage.stageId);
+
+    expect(existsSync(stage.stagingCodexHome)).toBe(false);
+  });
+
+  test("refuses to truncate a hard-linked staged credential during cancellation", async () => {
+    const f = fixture();
+    const manager = new NativeProfileManager(f.options);
+    await manager.register("personal");
+    const stage = await manager.prepareStage();
+    const external = join(f.root, "external-auth.json");
+    writeFileSync(external, f.target, { mode: 0o600 });
+    linkSync(external, join(stage.stagingCodexHome, "auth.json"));
+    writeFileSync(join(stage.stagingCodexHome, "stage.json"), "{malformed\n", { mode: 0o600 });
+
+    let caught: unknown;
+    try { await manager.cancelStage(stage.stageId); } catch (error) { caught = error; }
+
+    expect(caught).toBeInstanceOf(NativeProfileError);
+    expect((caught as NativeProfileError).code).toBe("STAGING_CLEANUP_REQUIRED");
+    expect((caught as NativeProfileError).cleanupRequired).toBe(true);
+    expect(readFileSync(external, "utf8")).toBe(f.target);
+  });
+
+  test("rejects legacy config-root metadata before creating shared state", async () => {
+    const f = fixture();
+    const manager = new NativeProfileManager(f.options);
+    mkdirSync(manager.context.legacyRootDir, { recursive: true, mode: 0o700 });
+    writeFileSync(join(manager.context.legacyRootDir, `${manager.context.homeId}.vault.json`), "{}\n", { mode: 0o600 });
+    const authBefore = readFileSync(manager.context.authPath, "utf8");
+
+    let caught: unknown;
+    try { await manager.register("personal"); } catch (error) { caught = error; }
+
+    expect(caught).toBeInstanceOf(NativeProfileError);
+    expect((caught as NativeProfileError).code).toBe("LEGACY_PROFILE_STATE");
+    expect(existsSync(manager.context.rootDir)).toBe(false);
+    expect(existsSync(manager.context.lockPath)).toBe(false);
+    expect(readFileSync(manager.context.authPath, "utf8")).toBe(authBefore);
+  });
+
+  test("creates owner-only shared metadata and instance-local staging on POSIX", async () => {
+    if (process.platform === "win32") return;
+    const f = fixture();
+    const manager = new NativeProfileManager({
+      codexHome: f.codexHome,
+      configDir: f.configDir,
+      keyProvider: f.keyProvider,
+      processProbe: f.options.processProbe,
+      applyTransition: f.options.applyTransition,
+    });
+    await manager.register("personal");
+    const stage = await manager.prepareStage();
+    const mode = (path: string): number => statSync(path).mode & 0o777;
+
+    expect(mode(manager.context.rootDir)).toBe(0o700);
+    expect(mode(manager.context.vaultPath)).toBe(0o600);
+    expect(mode(dirname(manager.context.stagingRoot))).toBe(0o700);
+    expect(mode(manager.context.stagingRoot)).toBe(0o700);
+    expect(mode(stage.stagingCodexHome)).toBe(0o700);
+    expect(mode(join(stage.stagingCodexHome, "config.toml"))).toBe(0o600);
+    expect(mode(join(stage.stagingCodexHome, "stage.json"))).toBe(0o600);
+  });
+
   test("finish removes staging after auth validation failure", async () => {
     const f = fixture();
     const manager = new NativeProfileManager(f.options);
diff --git a/tests/native-profile-startup.test.ts b/tests/native-profile-startup.test.ts
index 59c839b8f..0674ed2a6 100644
--- a/tests/native-profile-startup.test.ts
+++ b/tests/native-profile-startup.test.ts
@@ -405,13 +405,18 @@ describe("native-main startup journal gate", () => {
       homeId: f.manager.context.homeId,
     });
 
+    const otherConfigDir = join(f.root, "opencodex-other");
+    mkdirSync(otherConfigDir, { mode: 0o700 });
     const otherManager = new NativeProfileManager({
       codexHome: f.codexHome,
-      configDir: f.configDir,
+      configDir: otherConfigDir,
       keyProvider: new MemoryKeyProvider(f.key),
       hardenPath: async () => {},
       processProbe: async () => ({ status: "clear", count: 0 }),
     });
+    expect(otherManager.context.journalPath).toBe(f.manager.context.journalPath);
+    expect(otherManager.context.recoveryBlockPath).toBe(f.manager.context.recoveryBlockPath);
+    expect(otherManager.context.stagingRoot).not.toBe(f.manager.context.stagingRoot);
     expect(await otherManager.recover(false)).toMatchObject({ recovered: true });
     expect(probeNativeProfileRecoveryState(f.manager.context)).toBe("none");
     expect(isNativeMainTrafficBlocked()).toBe(true);
diff --git a/tests/native-profile-store.test.ts b/tests/native-profile-store.test.ts
index b4d668e66..e8cc9d8d8 100644
--- a/tests/native-profile-store.test.ts
+++ b/tests/native-profile-store.test.ts
@@ -1,13 +1,17 @@
 import { afterEach, describe, expect, test } from "bun:test";
-import { appendFileSync, mkdtempSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { appendFileSync, mkdirSync, mkdtempSync, realpathSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import {
   inspectNativeProfileJournal,
+  assertNoLegacyNativeProfileState,
+  legacyWindowsNativeProfileHomeId,
   MAX_NATIVE_PROFILE_JOURNAL_BYTES,
   MAX_NATIVE_PROFILE_METADATA_BYTES,
+  nativeProfileHomeId,
   OsNativeProfileKeyProvider,
   readNativeProfileVault,
+  resolveNativeProfileContext,
   serializeNativeProfileJournal,
   type NativeProfileContext,
 } from "../src/codex/native-profile-store";
@@ -31,6 +35,7 @@ const REPLACEMENT_TRANSACTION_ID = "44444444-4444-4444-8444-444444444444";
 const BOUNDED_READ_TEST_SEAM = Symbol.for("opencodex.native-profile-store.bounded-read-test-seam");
 
 interface BoundedReadTestSeam {
+  beforeOpen?: (path: string) => void;
   afterValidatedOpen?: (path: string, fd: number) => void;
   onBufferAllocated?: (byteLength: number) => void;
   onRead?: (requestedBytes: number, bytesRead: number, totalBytesRead: number) => void;
@@ -41,15 +46,25 @@ afterEach(() => {
 });
 
 function context(): NativeProfileContext {
-  const rootDir = mkdtempSync(join(tmpdir(), "ocx-native-profile-store-"));
-  roots.push(rootDir);
+  const base = mkdtempSync(join(tmpdir(), "ocx-native-profile-store-"));
+  roots.push(base);
+  const requestedCodexHome = join(base, "codex");
+  const configDir = join(base, "opencodex");
+  mkdirSync(requestedCodexHome, { mode: 0o700 });
+  const codexHome = realpathSync.native(requestedCodexHome);
+  const rootDir = join(codexHome, ".opencodex-native-main-profiles");
+  mkdirSync(rootDir, { mode: 0o700 });
+  mkdirSync(configDir, { mode: 0o700 });
   return {
-    codexHome: rootDir,
-    configDir: rootDir,
+    codexHome,
+    configDir,
+    instanceId: "d".repeat(64),
+    legacyHomeId: null,
     rootDir,
-    stagingRoot: join(rootDir, "staging"),
+    stagingRoot: join(configDir, "native-main-profile-staging", HOME_ID),
+    legacyRootDir: join(configDir, "native-main-profiles"),
     homeId: HOME_ID,
-    authPath: join(rootDir, "auth.json"),
+    authPath: join(codexHome, "auth.json"),
     vaultPath: join(rootDir, "profiles.vault.json"),
     journalPath: join(rootDir, "profiles.journal.json"),
     recoveryBlockPath: join(rootDir, "recovery-block.json"),
@@ -57,6 +72,51 @@ function context(): NativeProfileContext {
   };
 }
 
+describe("native-profile path ownership", () => {
+  test("shares authoritative metadata by canonical CODEX_HOME but isolates staging by OPENCODEX_HOME", () => {
+    const root = mkdtempSync(join(tmpdir(), "ocx-native-profile-layout-"));
+    roots.push(root);
+    const codexHome = join(root, "codex");
+    const configA = join(root, "opencodex-a");
+    const configB = join(root, "opencodex-b");
+    mkdirSync(codexHome);
+    mkdirSync(configA);
+    mkdirSync(configB);
+
+    const a = resolveNativeProfileContext({ codexHome, configDir: configA });
+    const b = resolveNativeProfileContext({ codexHome, configDir: configB });
+
+    expect(a.homeId).toBe(b.homeId);
+    expect(a.rootDir).toBe(b.rootDir);
+    expect(a.vaultPath).toBe(b.vaultPath);
+    expect(a.journalPath).toBe(b.journalPath);
+    expect(a.recoveryBlockPath).toBe(b.recoveryBlockPath);
+    expect(a.lockPath).toBe(b.lockPath);
+    expect(a.stagingRoot).not.toBe(b.stagingRoot);
+    expect(a.instanceId).not.toBe(b.instanceId);
+    expect(a.rootDir).toBe(join(a.codexHome, ".opencodex-native-main-profiles"));
+    expect(a.stagingRoot).toBe(join(a.configDir, "native-main-profile-staging", a.homeId));
+    expect(nativeProfileHomeId("C:\\Users\\CaseSensitive\\.codex"))
+      .not.toBe(nativeProfileHomeId("C:\\Users\\casesensitive\\.codex"));
+    expect(legacyWindowsNativeProfileHomeId("C:\\Users\\CaseSensitive\\.codex"))
+      .toBe(legacyWindowsNativeProfileHomeId("C:\\Users\\casesensitive\\.codex"));
+
+    const requestedMissing = join(root, "missing-parent", "opencodex");
+    const beforeCreate = resolveNativeProfileContext({ codexHome, configDir: requestedMissing });
+    mkdirSync(requestedMissing, { recursive: true });
+    const afterCreate = resolveNativeProfileContext({ codexHome, configDir: requestedMissing });
+    expect(afterCreate.configDir).toBe(beforeCreate.configDir);
+    expect(afterCreate.instanceId).toBe(beforeCreate.instanceId);
+    expect(afterCreate.stagingRoot).toBe(beforeCreate.stagingRoot);
+
+    const previousWindowsId = legacyWindowsNativeProfileHomeId(a.codexHome);
+    const legacyContext = { ...a, legacyHomeId: previousWindowsId };
+    mkdirSync(legacyContext.legacyRootDir, { recursive: true });
+    writeFileSync(join(legacyContext.legacyRootDir, `${previousWindowsId}.vault.json`), "{}\n", { mode: 0o600 });
+    expect(() => assertNoLegacyNativeProfileState(legacyContext)).toThrow(NativeProfileError);
+  });
+});
+
 function installBoundedReadTestSeam(store: NativeProfileContext, seam: BoundedReadTestSeam): void {
   (store as NativeProfileContext & { [key: symbol]: unknown })[BOUNDED_READ_TEST_SEAM] = seam;
 }
@@ -309,6 +369,19 @@ describe("native-profile recovery journal storage", () => {
     expect(totalBytesRead).toBe(MAX_NATIVE_PROFILE_METADATA_BYTES + 1);
   });
 
+  test("treats vault EACCES as unreadable instead of an absent vault", () => {
+    const store = context();
+    installBoundedReadTestSeam(store, {
+      beforeOpen: () => { throw Object.assign(new Error("injected access denial"), { code: "EACCES" }); },
+    });
+
+    let caught: unknown;
+    try { readNativeProfileVault(store); } catch (error) { caught = error; }
+
+    expect(caught).toBeInstanceOf(NativeProfileError);
+    expect((caught as NativeProfileError).code).toBe("VAULT_INVALID");
+  });
+
   test("reads at most journal cap plus one when the opened journal grows after fstat", () => {
     const store = context();
     const initial = serializeNativeProfileJournal(journal());

From a80f18b9715dbab24aafa3a1c19a5a0b347c39ef Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Mon, 3 Aug 2026 10:50:02 +0900
Subject: [PATCH 42/63] fix(codex): retain native-main process ownership

---
 src/codex/native-main-claim.ts            | 161 +++++++++
 src/codex/native-main-lock-file.ts        | 107 ++++++
 src/codex/native-main-owner.ts            | 309 ++++++++++++++++
 src/codex/native-profile-api.ts           |  53 ++-
 src/codex/native-profile-startup.ts       | 161 ++++++++-
 src/codex/native-profile-types.ts         |   4 +
 src/server/index.ts                       |  31 +-
 src/server/lifecycle.ts                   |   2 +
 tests/helpers/native-main-claim-child.ts  |  19 +
 tests/helpers/native-main-owner-child.ts  | 257 +++++++++++++
 tests/native-main-claim.test.ts           | 158 ++++++++
 tests/native-main-owner-lifetime.test.ts  | 417 ++++++++++++++++++++++
 tests/native-profile-drain-server.test.ts |   2 +
 13 files changed, 1669 insertions(+), 12 deletions(-)
 create mode 100644 src/codex/native-main-claim.ts
 create mode 100644 src/codex/native-main-lock-file.ts
 create mode 100644 src/codex/native-main-owner.ts
 create mode 100644 tests/helpers/native-main-claim-child.ts
 create mode 100644 tests/helpers/native-main-owner-child.ts
 create mode 100644 tests/native-main-claim.test.ts
 create mode 100644 tests/native-main-owner-lifetime.test.ts

diff --git a/src/codex/native-main-claim.ts b/src/codex/native-main-claim.ts
new file mode 100644
index 000000000..63096425e
--- /dev/null
+++ b/src/codex/native-main-claim.ts
@@ -0,0 +1,161 @@
+import { join } from "node:path";
+
+import { Database } from "bun:sqlite";
+
+import {
+  assertStableLockFile,
+  hardenStableLockFile,
+  openStableLockFile,
+  type StableLockFile,
+} from "./native-main-lock-file";
+import { nativeMainOwnerFilesystemSupported } from "./native-main-owner";
+import type { NativeProfileContext } from "./native-profile-store";
+import { NativeProfileError } from "./native-profile-types";
+
+export const NATIVE_MAIN_CLAIM_DB = ".opencodex-native-main.claim.sqlite";
+
+export interface NativeMainClaimOptions {
+  waitMs?: number;
+  pollMs?: number;
+  hardenPath?: (path: string) => Promise<void>;
+  platform?: NodeJS.Platform;
+  env?: NodeJS.ProcessEnv;
+}
+
+const hardenedIdentities = new Map<string, string>();
+
+export function nativeMainClaimPath(context: NativeProfileContext): string {
+  return join(context.codexHome, NATIVE_MAIN_CLAIM_DB);
+}
+
+function errorCode(error: unknown): string | undefined {
+  return error && typeof error === "object" && "code" in error
+    ? String((error as { code?: unknown }).code)
+    : undefined;
+}
+
+function isBusy(error: unknown): boolean {
+  const code = errorCode(error);
+  const message = error instanceof Error ? error.message : String(error);
+  return code === "SQLITE_BUSY" || code === "SQLITE_LOCKED" || /database (?:is|table is) locked/i.test(message);
+}
+
+function busyClaimError(message: string): NativeProfileError {
+  return new NativeProfileError("NATIVE_MAIN_CLAIM_BUSY", message, 503, true);
+}
+
+function unavailableClaimError(): NativeProfileError {
+  return new NativeProfileError(
+    "NATIVE_MAIN_CLAIM_UNAVAILABLE",
+    "The native-main cross-process claim is unavailable.",
+    503,
+    true,
+  );
+}
+
+function mapClaimSetupError(error: unknown, busyMessage: string): NativeProfileError {
+  if (error instanceof NativeProfileError) return error;
+  return isBusy(error) ? busyClaimError(busyMessage) : unavailableClaimError();
+}
+
+async function openClaimDatabase(
+  context: NativeProfileContext,
+  options: NativeMainClaimOptions,
+): Promise<{ database: Database; file: StableLockFile }> {
+  const platform = options.platform ?? process.platform;
+  if (!nativeMainOwnerFilesystemSupported(context.codexHome, platform, options.env ?? process.env)) {
+    throw new NativeProfileError(
+      "NATIVE_MAIN_CLAIM_UNAVAILABLE",
+      "Native-main claims are unsupported on this CODEX_HOME filesystem.",
+      503,
+      true,
+    );
+  }
+  const path = nativeMainClaimPath(context);
+  let file: StableLockFile | undefined;
+  let database: Database | undefined;
+  try {
+    file = openStableLockFile(path, platform);
+    const identity = `${file.dev}:${file.ino}`;
+    if (hardenedIdentities.get(path) !== identity) {
+      await (options.hardenPath ?? hardenStableLockFile)(path);
+      assertStableLockFile(path, file);
+      hardenedIdentities.set(path, identity);
+    }
+    database = new Database(path, { create: true });
+    // Journal-mode negotiation itself may need a database lock. Disable
+    // SQLite's synchronous busy wait first so a contender never blocks Bun's
+    // event loop while the current shared holder is waiting for JS to release.
+    database.exec("PRAGMA busy_timeout = 0; PRAGMA locking_mode = NORMAL");
+    const mode = database.query<{ journal_mode: string }, []>("PRAGMA journal_mode = DELETE").get()?.journal_mode;
+    if (mode?.toLowerCase() !== "delete") throw new Error("native-main claim database is not in rollback-journal mode");
+    assertStableLockFile(path, file);
+    return { database, file };
+  } catch (error) {
+    try { database?.close(); } catch { /* mapped below */ }
+    try { file?.close(); } catch { /* mapped below */ }
+    throw mapClaimSetupError(error, "Native-main credentials are changing.");
+  }
+}
+
+function releaseClaim(database: Database | undefined, file: StableLockFile | undefined): void {
+  try { database?.exec("ROLLBACK"); } catch { /* close still releases the OS-backed claim */ }
+  try { database?.close(); } catch { /* operation already completed */ }
+  try { file?.close(); } catch { /* operation already completed */ }
+}
+
+export async function withNativeMainSharedClaim<T>(
+  context: NativeProfileContext,
+  operation: () => Promise<T>,
+  options: NativeMainClaimOptions = {},
+): Promise<T> {
+  let database: Database | undefined;
+  let file: StableLockFile | undefined;
+  try {
+    ({ database, file } = await openClaimDatabase(context, options));
+    database.exec("BEGIN");
+    // A deferred BEGIN alone owns no lock. Reading page 1 through sqlite_schema
+    // establishes the SHARED lock that an exclusive transition must drain.
+    database.query<{ rootpage: number }, []>("SELECT rootpage FROM sqlite_schema LIMIT 1").get();
+    assertStableLockFile(nativeMainClaimPath(context), file);
+  } catch (error) {
+    releaseClaim(database, file);
+    throw mapClaimSetupError(error, "Native-main credentials are changing.");
+  }
+  try {
+    return await operation();
+  } finally {
+    releaseClaim(database, file);
+  }
+}
+
+export async function withNativeMainExclusiveClaim<T>(
+  context: NativeProfileContext,
+  operation: () => Promise<T>,
+  options: NativeMainClaimOptions = {},
+): Promise<T> {
+  const deadline = Date.now() + Math.max(0, options.waitMs ?? 0);
+  const pollMs = Math.max(1, options.pollMs ?? 50);
+  for (;;) {
+    let database: Database | undefined;
+    let file: StableLockFile | undefined;
+    try {
+      ({ database, file } = await openClaimDatabase(context, options));
+      database.exec("BEGIN EXCLUSIVE");
+      assertStableLockFile(nativeMainClaimPath(context), file);
+    } catch (error) {
+      releaseClaim(database, file);
+      const mapped = mapClaimSetupError(error, "Native-main credentials are in use.");
+      if (mapped.code === "NATIVE_MAIN_CLAIM_BUSY" && Date.now() < deadline) {
+        await Bun.sleep(Math.min(pollMs, Math.max(1, deadline - Date.now())));
+        continue;
+      }
+      throw mapped;
+    }
+    try {
+      return await operation();
+    } finally {
+      releaseClaim(database, file);
+    }
+  }
+}
diff --git a/src/codex/native-main-lock-file.ts b/src/codex/native-main-lock-file.ts
new file mode 100644
index 000000000..381589ee0
--- /dev/null
+++ b/src/codex/native-main-lock-file.ts
@@ -0,0 +1,107 @@
+import {
+  chmodSync,
+  closeSync,
+  constants,
+  existsSync,
+  fstatSync,
+  lstatSync,
+  openSync,
+  type Stats,
+} from "node:fs";
+
+import { hardenSecretPathAsync } from "../lib/windows-secret-acl";
+
+export interface StableLockFile {
+  readonly fd: number;
+  readonly dev: number;
+  readonly ino: number;
+  close(): void;
+}
+
+interface StableLockEntry {
+  readonly fd: number;
+  readonly dev: number;
+  readonly ino: number;
+  refs: number;
+}
+
+// POSIX fcntl locks are process-associated: closing any raw descriptor for an
+// inode can release SQLite locks held through a different descriptor in this
+// process. Keep one side descriptor per canonical lock path and close it only
+// after every SQLite user has closed its connection and released its reference.
+const stableLockEntries = new Map<string, StableLockEntry>();
+
+function reference(path: string, entry: StableLockEntry): StableLockFile {
+  let closed = false;
+  return {
+    fd: entry.fd,
+    dev: entry.dev,
+    ino: entry.ino,
+    close() {
+      if (closed) return;
+      closed = true;
+      entry.refs = Math.max(0, entry.refs - 1);
+      if (entry.refs !== 0) return;
+      if (stableLockEntries.get(path) === entry) stableLockEntries.delete(path);
+      closeSync(entry.fd);
+    },
+  };
+}
+
+function assertRegular(stats: Stats, path: string): void {
+  if (!stats.isFile() || stats.isSymbolicLink()) throw new Error(`unsafe SQLite lock path: ${path}`);
+}
+
+function matches(handle: StableLockFile, stats: Stats): boolean {
+  return handle.dev === stats.dev && handle.ino === stats.ino;
+}
+
+export function openStableLockFile(path: string, platform: NodeJS.Platform = process.platform): StableLockFile {
+  const retained = stableLockEntries.get(path);
+  if (retained) {
+    retained.refs += 1;
+    const handle = reference(path, retained);
+    try {
+      assertStableLockFile(path, handle);
+      return handle;
+    } catch (error) {
+      handle.close();
+      throw error;
+    }
+  }
+  if (existsSync(path)) assertRegular(lstatSync(path), path);
+  const noFollow = platform === "win32" ? 0 : constants.O_NOFOLLOW;
+  const fd = openSync(path, constants.O_RDWR | constants.O_CREAT | noFollow, 0o600);
+  try {
+    const descriptor = fstatSync(fd);
+    assertRegular(descriptor, path);
+    const entry: StableLockEntry = {
+      fd,
+      dev: descriptor.dev,
+      ino: descriptor.ino,
+      refs: 1,
+    };
+    stableLockEntries.set(path, entry);
+    const handle = reference(path, entry);
+    assertStableLockFile(path, handle);
+    return handle;
+  } catch (error) {
+    const entry = stableLockEntries.get(path);
+    if (entry?.fd === fd) stableLockEntries.delete(path);
+    closeSync(fd);
+    throw error;
+  }
+}
+
+export function assertStableLockFile(path: string, handle: StableLockFile): void {
+  const pathStats = lstatSync(path);
+  assertRegular(pathStats, path);
+  if (!matches(handle, pathStats)) throw new Error(`SQLite lock path identity changed: ${path}`);
+}
+
+export async function hardenStableLockFile(path: string): Promise<void> {
+  try { chmodSync(path, 0o600); } catch { /* Windows ACL below is authoritative there. */ }
+  if (process.platform === "win32") {
+    await hardenSecretPathAsync(path, { required: true, timeoutMemoKey: path });
+  }
+}
diff --git a/src/codex/native-main-owner.ts b/src/codex/native-main-owner.ts
new file mode 100644
index 000000000..4736ccbe8
--- /dev/null
+++ b/src/codex/native-main-owner.ts
@@ -0,0 +1,309 @@
+import { join } from "node:path";
+
+import { Database } from "bun:sqlite";
+
+import {
+  assertStableLockFile,
+  hardenStableLockFile,
+  openStableLockFile,
+  type StableLockFile,
+} from "./native-main-lock-file";
+import type { NativeProfileContext } from "./native-profile-store";
+import { NativeProfileError } from "./native-profile-types";
+
+export const NATIVE_MAIN_OWNER_RETRY_MS = 250;
+export const NATIVE_MAIN_OWNER_DB = ".opencodex-native-main.owner.sqlite";
+
+export type NativeMainOwnerUnavailableReason = "lock-unavailable" | "unsupported-filesystem";
+
+export type NativeMainOwnerSnapshot =
+  | { status: "acquiring"; homeId: string }
+  | { status: "contended"; homeId: string }
+  | { status: "held"; homeId: string }
+  | { status: "unavailable"; homeId: string; reason: NativeMainOwnerUnavailableReason }
+  | { status: "closing"; homeId: string }
+  | { status: "released"; homeId: string };
+
+export interface NativeMainOwnerOptions {
+  retryMs?: number;
+  hardenPath?: (path: string) => Promise<void>;
+  platform?: NodeJS.Platform;
+  env?: NodeJS.ProcessEnv;
+}
+
+export interface NativeMainOwnerReference {
+  readonly homeId: string;
+  snapshot(): NativeMainOwnerSnapshot;
+  subscribe(listener: (snapshot: NativeMainOwnerSnapshot) => void): () => void;
+  release(): Promise<void>;
+}
+
+interface OwnerEntry {
+  readonly context: NativeProfileContext;
+  readonly lockPath: string;
+  readonly options: Required<Pick<NativeMainOwnerOptions, "retryMs" | "platform">>
+    & Pick<NativeMainOwnerOptions, "env" | "hardenPath">;
+  refs: number;
+  generation: number;
+  snapshot: NativeMainOwnerSnapshot;
+  listeners: Set<(snapshot: NativeMainOwnerSnapshot) => void>;
+  database?: Database;
+  file?: StableLockFile;
+  prepared: boolean;
+  timer?: ReturnType<typeof setTimeout>;
+  drive?: Promise<void>;
+  activeOperations: Set<Promise<unknown>>;
+  closing: boolean;
+}
+
+const entries = new Map<string, OwnerEntry>();
+const detachedEntries = new Set<OwnerEntry>();
+let exitHookInstalled = false;
+
+function errorCode(error: unknown): string | undefined {
+  return error && typeof error === "object" && "code" in error
+    ? String((error as { code?: unknown }).code)
+    : undefined;
+}
+
+function isBusy(error: unknown): boolean {
+  const code = errorCode(error);
+  const message = error instanceof Error ? error.message : String(error);
+  return code === "SQLITE_BUSY" || code === "SQLITE_LOCKED" || /database (?:is|table is) locked/i.test(message);
+}
+
+export function nativeMainOwnerFilesystemSupported(
+  codexHome: string,
+  platform: NodeJS.Platform = process.platform,
+  env: NodeJS.ProcessEnv = process.env,
+): boolean {
+  if (platform === "win32") {
+    const normalized = codexHome.replaceAll("/", "\\");
+    if (normalized.startsWith("\\\\?\\UNC\\")) return false;
+    if (normalized.startsWith("\\\\") && !normalized.startsWith("\\\\?\\")) return false;
+  }
+  if (
+    platform === "linux"
+    && (env.WSL_INTEROP !== undefined || env.WSL_DISTRO_NAME !== undefined)
+    && /^\/mnt\/[a-z](?:\/|$)/i.test(codexHome)
+  ) return false;
+  return true;
+}
+
+function publish(entry: OwnerEntry, snapshot: NativeMainOwnerSnapshot): void {
+  entry.snapshot = snapshot;
+  for (const listener of entry.listeners) {
+    try { listener({ ...snapshot }); } catch { /* an observer cannot forfeit process ownership */ }
+  }
+}
+
+function closeDatabase(entry: OwnerEntry): void {
+  const database = entry.database;
+  entry.database = undefined;
+  if (!database) return;
+  try { database.exec("ROLLBACK"); } catch { /* close still releases the OS-backed lock */ }
+  try { database.close(); } catch { /* the process exit path is best-effort */ }
+}
+
+function closeEntry(entry: OwnerEntry): void {
+  closeDatabase(entry);
+  try { entry.file?.close(); } catch { /* the process exit path is best-effort */ }
+  entry.file = undefined;
+}
+
+function installExitHook(): void {
+  if (exitHookInstalled) return;
+  exitHookInstalled = true;
+  process.once("exit", () => {
+    for (const entry of entries.values()) {
+      if (entry.timer) clearTimeout(entry.timer);
+      closeEntry(entry);
+    }
+    for (const entry of detachedEntries) closeEntry(entry);
+    entries.clear();
+    detachedEntries.clear();
+  });
+}
+
+function scheduleRetry(entry: OwnerEntry, generation: number): void {
+  if (entry.closing || entry.refs === 0 || entry.timer) return;
+  entry.timer = setTimeout(() => {
+    entry.timer = undefined;
+    if (entry.generation !== generation || entry.closing || entry.refs === 0) return;
+    entry.drive = drive(entry, generation).finally(() => {
+      if (entry.generation === generation) entry.drive = undefined;
+    });
+  }, entry.options.retryMs);
+  entry.timer.unref?.();
+}
+
+async function prepareOwnerDatabase(entry: OwnerEntry): Promise<void> {
+  if (entry.prepared) return;
+  let file: StableLockFile | undefined;
+  let database: Database | undefined;
+  try {
+    file = openStableLockFile(entry.lockPath, entry.options.platform);
+    database = new Database(entry.lockPath, { create: true });
+    await (entry.options.hardenPath ?? hardenStableLockFile)(entry.lockPath);
+    assertStableLockFile(entry.lockPath, file);
+    entry.file = file;
+    file = undefined;
+  } catch (error) {
+    try { file?.close(); } catch { /* mapped by caller */ }
+    throw error;
+  } finally {
+    try { database?.close(); } catch { /* the caller publishes the hard failure */ }
+  }
+  entry.prepared = true;
+}
+
+async function drive(entry: OwnerEntry, generation: number): Promise<void> {
+  if (entry.closing || entry.refs === 0 || entry.generation !== generation || entry.database) return;
+  if (!nativeMainOwnerFilesystemSupported(
+    entry.context.codexHome,
+    entry.options.platform,
+    entry.options.env ?? process.env,
+  )) {
+    publish(entry, { status: "unavailable", homeId: entry.context.homeId, reason: "unsupported-filesystem" });
+    return;
+  }
+  let candidate: Database | undefined;
+  try {
+    await prepareOwnerDatabase(entry);
+    if (entry.closing || entry.refs === 0 || entry.generation !== generation) return;
+    candidate = new Database(entry.lockPath, { create: true });
+    candidate.exec("PRAGMA locking_mode = NORMAL; PRAGMA busy_timeout = 0; BEGIN IMMEDIATE");
+    assertStableLockFile(entry.lockPath, entry.file!);
+    if (entry.closing || entry.refs === 0 || entry.generation !== generation) {
+      try { candidate.exec("ROLLBACK"); } catch { /* close below */ }
+      candidate.close();
+      return;
+    }
+    entry.database = candidate;
+    candidate = undefined;
+    publish(entry, { status: "held", homeId: entry.context.homeId });
+  } catch (error) {
+    try { candidate?.close(); } catch { /* acquisition already failed */ }
+    if (entry.closing || entry.refs === 0 || entry.generation !== generation) return;
+    if (isBusy(error)) {
+      publish(entry, { status: "contended", homeId: entry.context.homeId });
+      scheduleRetry(entry, generation);
+      return;
+    }
+    publish(entry, { status: "unavailable", homeId: entry.context.homeId, reason: "lock-unavailable" });
+  }
+}
+
+function entryFor(context: NativeProfileContext, options: NativeMainOwnerOptions): OwnerEntry {
+  const existing = entries.get(context.homeId);
+  if (existing) {
+    if (existing.context.codexHome !== context.codexHome) {
+      throw new NativeProfileError("CODEX_HOME_UNAVAILABLE", "The canonical native-main home changed unexpectedly.", 409);
+    }
+    return existing;
+  }
+  const entry: OwnerEntry = {
+    context,
+    lockPath: join(context.codexHome, NATIVE_MAIN_OWNER_DB),
+    options: {
+      retryMs: Math.max(1, options.retryMs ?? NATIVE_MAIN_OWNER_RETRY_MS),
+      platform: options.platform ?? process.platform,
+      env: options.env,
+      hardenPath: options.hardenPath,
+    },
+    refs: 0,
+    generation: 1,
+    snapshot: { status: "acquiring", homeId: context.homeId },
+    listeners: new Set(),
+    activeOperations: new Set(),
+    prepared: false,
+    closing: false,
+  };
+  entries.set(context.homeId, entry);
+  installExitHook();
+  return entry;
+}
+
+export function retainNativeMainOwner(
+  context: NativeProfileContext,
+  options: NativeMainOwnerOptions = {},
+): NativeMainOwnerReference {
+  const entry = entryFor(context, options);
+  if (entry.closing) {
+    throw new NativeProfileError("NATIVE_MAIN_OWNER_BUSY", "Native-main ownership is closing.", 503, true);
+  }
+  entry.refs += 1;
+  if (!entry.drive && !entry.database && !entry.timer) {
+    const generation = entry.generation;
+    entry.drive = drive(entry, generation).finally(() => {
+      if (entry.generation === generation) entry.drive = undefined;
+    });
+  }
+  let released = false;
+  return {
+    homeId: context.homeId,
+    snapshot: () => ({ ...entry.snapshot }),
+    subscribe(listener) {
+      entry.listeners.add(listener);
+      listener({ ...entry.snapshot });
+      return () => { entry.listeners.delete(listener); };
+    },
+    async release() {
+      if (released) return;
+      released = true;
+      entry.refs = Math.max(0, entry.refs - 1);
+      if (entry.refs !== 0 || entry.closing) return;
+      entry.closing = true;
+      entry.generation += 1;
+      if (entry.timer) clearTimeout(entry.timer);
+      entry.timer = undefined;
+      publish(entry, { status: "closing", homeId: entry.context.homeId });
+      // Detach synchronously before the first await. startServer is synchronous,
+      // so a failed listen must be able to create a fresh reference immediately;
+      // SQLite will keep that successor contended until this entry finishes close.
+      if (entries.get(entry.context.homeId) === entry) entries.delete(entry.context.homeId);
+      detachedEntries.add(entry);
+      if (entry.drive) await Promise.allSettled([entry.drive]);
+      while (entry.activeOperations.size > 0) {
+        await Promise.allSettled([...entry.activeOperations]);
+      }
+      closeEntry(entry);
+      publish(entry, { status: "released", homeId: entry.context.homeId });
+      detachedEntries.delete(entry);
+    },
+  };
+}
+
+export function nativeMainOwnerSnapshot(context: NativeProfileContext): NativeMainOwnerSnapshot | null {
+  const entry = entries.get(context.homeId);
+  return entry ? { ...entry.snapshot } : null;
+}
+
+export function assertNativeMainOwner(context: NativeProfileContext): void {
+  const entry = entries.get(context.homeId);
+  if (entry?.snapshot.status === "held" && entry.database && !entry.closing) return;
+  const unavailable = entry?.snapshot.status === "unavailable";
+  throw new NativeProfileError(
+    unavailable ? "NATIVE_MAIN_OWNER_UNAVAILABLE" : "NATIVE_MAIN_OWNER_BUSY",
+    unavailable
+      ? "This process cannot establish native-main ownership for the effective CODEX_HOME."
+      : "Another OpenCodex process owns the physical native-main login for the effective CODEX_HOME.",
+    503,
+    true,
+  );
+}
+
+export async function withNativeMainOwnerOperation<T>(
+  context: NativeProfileContext,
+  operation: () => Promise<T>,
+): Promise<T> {
+  const entry = entries.get(context.homeId);
+  // Direct manager unit tests and non-server library consumers retain the historical
+  // transaction-only behavior. Every live server registers an entry before listen.
+  if (!entry) return operation();
+  assertNativeMainOwner(context);
+  let tracked!: Promise<T>;
+  tracked = Promise.resolve().then(operation).finally(() => { entry.activeOperations.delete(tracked); });
+  entry.activeOperations.add(tracked);
+  return tracked;
+}
diff --git a/src/codex/native-profile-api.ts b/src/codex/native-profile-api.ts
index 26c8ff706..d43e981df 100644
--- a/src/codex/native-profile-api.ts
+++ b/src/codex/native-profile-api.ts
@@ -10,6 +10,8 @@ import { NativeProfileManager } from "./native-profile-manager";
 import { NativeProfileError } from "./native-profile-types";
 import { blockNativeMainRecovery, completeNativeMainRecovery } from "./native-profile-startup";
 import { probeNativeProfileRecoveryState } from "./native-profile-store";
+import { nativeMainOwnerSnapshot, withNativeMainOwnerOperation } from "./native-main-owner";
+import { withNativeMainExclusiveClaim, withNativeMainSharedClaim } from "./native-main-claim";
 
 export interface NativeProfileApiDeps {
   manager?: NativeProfileManager;
@@ -20,6 +22,28 @@ export interface NativeProfileApiDeps {
   completeRecovery?: typeof completeNativeMainRecovery;
 }
 
+type NativeMainApiClaim =
+  | { mode: "none" }
+  | { mode: "shared" }
+  | { mode: "exclusive"; waitMs: number };
+
+async function withNativeMainApiOperation<T>(
+  manager: NativeProfileManager,
+  operation: () => Promise<T>,
+  claim: NativeMainApiClaim = { mode: "none" },
+): Promise<T> {
+  // Direct handler unit tests and library callers may inject a partial manager.
+  // A live server always constructs a real manager and registers an owner entry
+  // before listen, so only that path needs the additional cross-process claim.
+  const context = (manager as Partial<NativeProfileManager>).context;
+  if (!context) return operation();
+  return withNativeMainOwnerOperation(context, () => {
+    if (!nativeMainOwnerSnapshot(context) || claim.mode === "none") return operation();
+    if (claim.mode === "shared") return withNativeMainSharedClaim(context, operation);
+    return withNativeMainExclusiveClaim(context, operation, { waitMs: claim.waitMs });
+  });
+}
+
 async function body(req: Request): Promise<Record<string, unknown>> {
   try {
     const parsed = await readManagementJsonBody(req);
@@ -115,27 +139,34 @@ export async function handleNativeProfileAPI(
       return jsonResponse(await manager.list(), 200, req, config);
     }
     if (url.pathname === "/api/native-main-profiles/doctor" && req.method === "GET") {
-      return jsonResponse(await manager.doctor(), 200, req, config);
+      return jsonResponse(await withNativeMainApiOperation(manager, () => manager.doctor(), { mode: "shared" }), 200, req, config);
     }
     if (url.pathname === "/api/native-main-profiles/register" && req.method === "POST") {
       const input = await body(req);
       if (typeof input.label !== "string") throw new NativeProfileError("INVALID_REQUEST", "A profile label is required.", 400);
-      return jsonResponse(await manager.register(input.label), 200, req, config);
+      return jsonResponse(await withNativeMainApiOperation(
+        manager,
+        () => manager.register(input.label as string),
+        { mode: "shared" },
+      ), 200, req, config);
     }
     if (url.pathname === "/api/native-main-profiles/stage" && req.method === "POST") {
-      return jsonResponse(await manager.prepareStage(), 200, req, config);
+      return jsonResponse(await withNativeMainApiOperation(manager, () => manager.prepareStage()), 200, req, config);
     }
     if (url.pathname === "/api/native-main-profiles/stage/finish" && req.method === "POST") {
       const input = await body(req);
       if (typeof input.stageId !== "string" || typeof input.label !== "string") {
         throw new NativeProfileError("INVALID_REQUEST", "A staging identifier and profile label are required.", 400);
       }
-      return jsonResponse(await manager.finishStage(input.stageId, input.label), 200, req, config);
+      return jsonResponse(await withNativeMainApiOperation(
+        manager,
+        () => manager.finishStage(input.stageId as string, input.label as string),
+      ), 200, req, config);
     }
     if (url.pathname === "/api/native-main-profiles/stage/cancel" && req.method === "POST") {
       const input = await body(req);
       if (typeof input.stageId !== "string") throw new NativeProfileError("INVALID_REQUEST", "A staging identifier is required.", 400);
-      await manager.cancelStage(input.stageId);
+      await withNativeMainApiOperation(manager, () => manager.cancelStage(input.stageId as string));
       return jsonResponse({ ok: true }, 200, req, config);
     }
     if (url.pathname === "/api/native-main-profiles/switch" && req.method === "POST") {
@@ -144,7 +175,11 @@ export async function handleNativeProfileAPI(
       const switched = await withMainRequestDrain(deps, () => withRecoveryGateTransition(
         manager,
         deps,
-        () => manager.switch(input.target as string, input.confirmedStopped === true),
+        () => withNativeMainApiOperation(
+          manager,
+          () => manager.switch(input.target as string, input.confirmedStopped === true),
+          { mode: "exclusive", waitMs: deps.drainTimeoutMs ?? 10_000 },
+        ),
       ));
       return jsonResponse(
         switched,
@@ -158,7 +193,11 @@ export async function handleNativeProfileAPI(
       const recovered = await withMainRequestDrain(deps, () => withRecoveryGateTransition(
         manager,
         deps,
-        () => manager.recover(input.rollback === true, input.confirmedStopped === true),
+        () => withNativeMainApiOperation(
+          manager,
+          () => manager.recover(input.rollback === true, input.confirmedStopped === true),
+          { mode: "exclusive", waitMs: deps.drainTimeoutMs ?? 10_000 },
+        ),
         true,
       ));
       return jsonResponse(recovered, 200, req, config);
diff --git a/src/codex/native-profile-startup.ts b/src/codex/native-profile-startup.ts
index 9346f1fe9..9fb725a49 100644
--- a/src/codex/native-profile-startup.ts
+++ b/src/codex/native-profile-startup.ts
@@ -5,21 +5,54 @@ import {
   probeNativeProfileRecoveryState,
   type NativeProfileRecoveryState,
 } from "./native-profile-store";
+import {
+  retainNativeMainOwner,
+  withNativeMainOwnerOperation,
+  type NativeMainOwnerOptions,
+  type NativeMainOwnerReference,
+  type NativeMainOwnerSnapshot,
+} from "./native-main-owner";
+import { withNativeMainExclusiveClaim } from "./native-main-claim";
 
 export type NativeMainStartupGateSnapshot =
   | { status: "ready"; homeId: string | null }
-  | { status: "blocked"; homeId: string; reason: "recovery-pending" | "manual-recovery" };
+  | {
+      status: "blocked";
+      homeId: string;
+      reason: "recovery-pending" | "manual-recovery" | "owner-conflict" | "owner-unavailable";
+    };
 
 export interface NativeMainStartupGateDeps {
   manager?: NativeProfileManager;
   /** Test-only barrier used to prove admission stays closed while startup recovery is pending. */
   beforeRecovery?: () => void | Promise<void>;
   probeRecoveryState?: typeof probeNativeProfileRecoveryState;
+  owner?: NativeMainOwnerOptions;
+}
+
+export interface NativeMainStartupLifecycle {
+  readonly homeId: string | null;
+  readonly settled: Promise<NativeMainStartupGateSnapshot>;
+  release(): Promise<void>;
 }
 
 let epoch = 0;
 let snapshot: NativeMainStartupGateSnapshot = { status: "ready", homeId: null };
 let settled: Promise<NativeMainStartupGateSnapshot> = Promise.resolve(snapshot);
+interface StartupEntry {
+  homeId: string;
+  refs: number;
+  epoch: number;
+  owner: NativeMainOwnerReference;
+  unsubscribe: () => void;
+  recoveryStarted: boolean;
+  settled: Promise<NativeMainStartupGateSnapshot>;
+  resolveAcquisition?: (value: NativeMainStartupGateSnapshot) => void;
+  deps: NativeMainStartupGateDeps;
+  manager: NativeProfileManager;
+}
+const startupEntries = new Map<string, StartupEntry>();
+const serverLifecycles = new WeakMap<object, NativeMainStartupLifecycle>();
 
 function ready(homeId: string | null): NativeMainStartupGateSnapshot {
   return { status: "ready", homeId };
@@ -85,6 +118,132 @@ export function initializeNativeMainStartupGate(
   return settled;
 }
 
+function ownerBlockedReason(owner: NativeMainOwnerSnapshot): "owner-conflict" | "owner-unavailable" {
+  return owner.status === "unavailable" ? "owner-unavailable" : "owner-conflict";
+}
+
+function convergeOwnedStartup(entry: StartupEntry): void {
+  if (entry.recoveryStarted) return;
+  entry.recoveryStarted = true;
+  const currentEpoch = entry.epoch;
+  snapshot = { status: "blocked", homeId: entry.homeId, reason: "recovery-pending" };
+  const acquisitionWaiter = entry.resolveAcquisition;
+  entry.resolveAcquisition = undefined;
+  entry.settled = settled = (async () => {
+    const probe = entry.deps.probeRecoveryState ?? probeNativeProfileRecoveryState;
+    try {
+      let recoveryState = probe(entry.manager.context);
+      if (recoveryState === "journal") {
+        await entry.deps.beforeRecovery?.();
+        await withNativeMainOwnerOperation(entry.manager.context, () => withNativeMainExclusiveClaim(
+          entry.manager.context,
+          () => entry.manager.recover(false),
+          { waitMs: 10_000 },
+        ));
+        recoveryState = probe(entry.manager.context);
+      }
+      if (startupEntries.get(entry.homeId) === entry && entry.epoch === currentEpoch && recoveryState === "none") {
+        clearAccountNeedsReauth(MAIN_CODEX_ACCOUNT_ID);
+        snapshot = ready(entry.homeId);
+      } else if (startupEntries.get(entry.homeId) === entry && entry.epoch === currentEpoch) {
+        snapshot = { status: "blocked", homeId: entry.homeId, reason: "manual-recovery" };
+      }
+    } catch {
+      if (startupEntries.get(entry.homeId) === entry && entry.epoch === currentEpoch) {
+        snapshot = { status: "blocked", homeId: entry.homeId, reason: "manual-recovery" };
+      }
+    }
+    return snapshot;
+  })();
+  if (acquisitionWaiter) void entry.settled.then(acquisitionWaiter);
+}
+
+function observeOwner(entry: StartupEntry, owner: NativeMainOwnerSnapshot): void {
+  if (startupEntries.get(entry.homeId) !== entry) return;
+  if (owner.status === "acquiring") {
+    snapshot = { status: "blocked", homeId: entry.homeId, reason: "recovery-pending" };
+    return;
+  }
+  if (owner.status === "held") {
+    convergeOwnedStartup(entry);
+    return;
+  }
+  if (owner.status === "closing" || owner.status === "released") return;
+  snapshot = { status: "blocked", homeId: entry.homeId, reason: ownerBlockedReason(owner) };
+  entry.settled = settled = Promise.resolve(snapshot);
+  entry.resolveAcquisition?.(snapshot);
+  entry.resolveAcquisition = undefined;
+}
+
+/**
+ * Retain process ownership for one live server. The first reference acquires the
+ * canonical-home SQLite lease and owns recovery; later same-process references share it.
+ */
+export function startNativeMainStartupLifecycle(
+  deps: NativeMainStartupGateDeps = {},
+): NativeMainStartupLifecycle {
+  let manager: NativeProfileManager;
+  try {
+    manager = deps.manager ?? new NativeProfileManager();
+  } catch {
+    snapshot = ready(null);
+    settled = Promise.resolve(snapshot);
+    return { homeId: null, settled, release: async () => {} };
+  }
+  const homeId = manager.context.homeId;
+  let entry = startupEntries.get(homeId);
+  if (!entry) {
+    const owner = retainNativeMainOwner(manager.context, deps.owner);
+    snapshot = { status: "blocked", homeId, reason: "recovery-pending" };
+    let resolveAcquisition!: (value: NativeMainStartupGateSnapshot) => void;
+    const acquisition = new Promise<NativeMainStartupGateSnapshot>(resolve => { resolveAcquisition = resolve; });
+    settled = acquisition;
+    entry = {
+      homeId,
+      refs: 0,
+      epoch: ++epoch,
+      owner,
+      unsubscribe: () => {},
+      recoveryStarted: false,
+      settled: acquisition,
+      resolveAcquisition,
+      deps,
+      manager,
+    };
+    startupEntries.set(homeId, entry);
+    entry.unsubscribe = owner.subscribe(ownerState => observeOwner(entry!, ownerState));
+  }
+  entry.refs += 1;
+  let released = false;
+  return {
+    homeId,
+    get settled() { return entry!.settled; },
+    async release() {
+      if (released) return;
+      released = true;
+      entry!.refs = Math.max(0, entry!.refs - 1);
+      if (entry!.refs !== 0) return;
+      entry!.epoch += 1;
+      entry!.unsubscribe();
+      startupEntries.delete(homeId);
+      entry!.resolveAcquisition?.(snapshot);
+      entry!.resolveAcquisition = undefined;
+      await entry!.owner.release();
+    },
+  };
+}
+
+export function bindNativeMainStartupLifecycle(server: object, lifecycle: NativeMainStartupLifecycle): void {
+  serverLifecycles.set(server, lifecycle);
+}
+
+export async function releaseNativeMainStartupLifecycle(server: object): Promise<void> {
+  const lifecycle = serverLifecycles.get(server);
+  if (!lifecycle) return;
+  serverLifecycles.delete(server);
+  await lifecycle.release();
+}
+
 export function isNativeMainTrafficBlocked(): boolean {
   return snapshot.status === "blocked";
 }
diff --git a/src/codex/native-profile-types.ts b/src/codex/native-profile-types.ts
index 567a1adb5..f9d3876f8 100644
--- a/src/codex/native-profile-types.ts
+++ b/src/codex/native-profile-types.ts
@@ -13,6 +13,10 @@ export type NativeProfileErrorCode =
   | "KEYRING_KEY_MISSING"
   | "PROFILE_LOCK_UNAVAILABLE"
   | "NATIVE_PROFILE_BUSY"
+  | "NATIVE_MAIN_OWNER_BUSY"
+  | "NATIVE_MAIN_OWNER_UNAVAILABLE"
+  | "NATIVE_MAIN_CLAIM_BUSY"
+  | "NATIVE_MAIN_CLAIM_UNAVAILABLE"
   | "CODEX_BUSY"
   | "CODEX_PROCESS_CHECK_UNAVAILABLE"
   | "MAIN_REQUESTS_ACTIVE"
diff --git a/src/server/index.ts b/src/server/index.ts
index 5e5fc36ce..6e815b6d2 100644
--- a/src/server/index.ts
+++ b/src/server/index.ts
@@ -153,7 +153,12 @@ import { handleChatCompletions } from "./chat-completions";
 import { anthropicErrorResponse } from "../claude/outbound";
 import { buildDesktop3pRegistry } from "../claude/desktop-3p";
 import { runClaudeAuthModeMigration } from "../claude/auth-mode-migration";
-import { initializeNativeMainStartupGate, type NativeMainStartupGateDeps } from "../codex/native-profile-startup";
+import {
+  bindNativeMainStartupLifecycle,
+  releaseNativeMainStartupLifecycle,
+  startNativeMainStartupLifecycle,
+  type NativeMainStartupGateDeps,
+} from "../codex/native-profile-startup";
 import { handleImages } from "./images";
 import { handleLive, logLiveSidebandFrame, parseLiveSidebandTarget, resolveLiveSidebandUpgrade } from "./live";
 import { handleSearch } from "./search";
@@ -340,7 +345,6 @@ export function startServer(port?: number, deps: StartServerDeps = {}) {
   const managementAuth = deps.managementAuthState ?? initializeManagementAuthState(config);
   // Arm synchronously before listen. A pending journal therefore makes __main__ unusable
   // before any request can resolve its physical credential, while health/management/Pool stay live.
-  void initializeNativeMainStartupGate(deps.nativeMainStartup);
   // Refresh OAuth provider presets (models/noReasoningModels) from the registry so a proxy update
   // adding/dropping models reaches existing configs on start — not just fresh installs.
   reconcileOAuthProviders(config);
@@ -452,7 +456,10 @@ export function startServer(port?: number, deps: StartServerDeps = {}) {
     return response;
   }
 
-  const server: Server<WsData> = Bun.serve<WsData>({
+  const nativeMainLifecycle = startNativeMainStartupLifecycle(deps.nativeMainStartup);
+  let server: Server<WsData>;
+  try {
+    server = Bun.serve<WsData>({
     port: listenPort,
     hostname: bindHost,
     idleTimeout: 255,
@@ -1174,8 +1181,24 @@ export function startServer(port?: number, deps: StartServerDeps = {}) {
         ws.data.cancel?.(); // RC2: abort the upstream when the client disconnects
       },
     },
-  });
+    });
+  } catch (error) {
+    void nativeMainLifecycle.release();
+    throw error;
+  }
 
+  bindNativeMainStartupLifecycle(server, nativeMainLifecycle);
+  const nativeStop = server.stop.bind(server);
+  Object.defineProperty(server, "stop", {
+    configurable: true,
+    value: async (closeActiveConnections?: boolean): Promise<void> => {
+      try {
+        await nativeStop(closeActiveConnections);
+      } finally {
+        await releaseNativeMainStartupLifecycle(server);
+      }
+    },
+  });
   setServerRef(server);
   const actualPort = server.port ?? listenPort;
   setCorsOrigin(actualPort);
diff --git a/src/server/lifecycle.ts b/src/server/lifecycle.ts
index bb8c80e40..04d2cd3c7 100644
--- a/src/server/lifecycle.ts
+++ b/src/server/lifecycle.ts
@@ -21,6 +21,7 @@ import {
   terminateAllBackgroundShells,
 } from "../adapters/cursor/native-exec-shell";
 import type { CodexAccountSelectionAdmission } from "../codex/auth-context";
+import { releaseNativeMainStartupLifecycle } from "../codex/native-profile-startup";
 
 // ---------------------------------------------------------------------------
 // Active turn tracking + graceful shutdown drain
@@ -395,6 +396,7 @@ export async function drainAndShutdown(
       // isolate reclaim / follow-on listen the same way unterminated Workers did.
       if (s) await s.stop(true);
     } finally {
+      if (s) await releaseNativeMainStartupLifecycle(s);
       // shutdownDraining is a process-lifetime latch. A stopped server must
       // never resume admission merely because shutdown cleanup returned.
     }
diff --git a/tests/helpers/native-main-claim-child.ts b/tests/helpers/native-main-claim-child.ts
new file mode 100644
index 000000000..70eb96633
--- /dev/null
+++ b/tests/helpers/native-main-claim-child.ts
@@ -0,0 +1,19 @@
+import { withNativeMainExclusiveClaim } from "../../src/codex/native-main-claim";
+import type { NativeProfileContext } from "../../src/codex/native-profile-store";
+
+const codexHome = process.argv[2];
+if (!codexHome) throw new Error("missing CODEX_HOME argument");
+const context = { codexHome } as NativeProfileContext;
+
+try {
+  await withNativeMainExclusiveClaim(context, async () => undefined, {
+    waitMs: 0,
+    hardenPath: async () => {},
+  });
+  console.log(JSON.stringify({ status: "acquired" }));
+} catch (error) {
+  console.log(JSON.stringify({
+    status: "rejected",
+    code: error instanceof Error && "code" in error ? String(error.code) : undefined,
+  }));
+}
diff --git a/tests/helpers/native-main-owner-child.ts b/tests/helpers/native-main-owner-child.ts
new file mode 100644
index 000000000..1881d715e
--- /dev/null
+++ b/tests/helpers/native-main-owner-child.ts
@@ -0,0 +1,257 @@
+import { appendFileSync } from "node:fs";
+import { createInterface } from "node:readline";
+
+import { MAIN_CODEX_ACCOUNT_ID } from "../../src/codex/main-account";
+import { nativeMainOwnerSnapshot } from "../../src/codex/native-main-owner";
+import { NativeProfileManager } from "../../src/codex/native-profile-manager";
+import {
+  nativeMainStartupGateSnapshot,
+} from "../../src/codex/native-profile-startup";
+import type { NativeProfileKey, NativeProfileKeyProvider } from "../../src/codex/native-profile-types";
+import { drainAndShutdown } from "../../src/server";
+import { startServer } from "../../src/server";
+
+const required = (name: string): string => {
+  const value = process.env[name];
+  if (!value) throw new Error(`missing ${name}`);
+  return value;
+};
+
+const codexHome = required("NATIVE_OWNER_CODEX_HOME");
+const configDir = required("NATIVE_OWNER_CONFIG_DIR");
+const keyBytes = Buffer.from(required("NATIVE_OWNER_KEY"), "base64");
+const keyRef = process.env.NATIVE_OWNER_KEY_REF ?? "memory:native-owner-test";
+const holdRecovery = process.env.NATIVE_OWNER_HOLD_RECOVERY === "1";
+const holdSwitchBoundary = process.env.NATIVE_OWNER_HOLD_SWITCH_BOUNDARY;
+const receiptPath = process.env.NATIVE_OWNER_RECEIPTS;
+
+const emit = (value: Record<string, unknown>): void => {
+  process.stdout.write(`@@native-owner@@${JSON.stringify(value)}\n`);
+};
+
+class EnvKeyProvider implements NativeProfileKeyProvider {
+  async get(): Promise<NativeProfileKey> { return { keyRef, key: Buffer.from(keyBytes) }; }
+  async create(): Promise<NativeProfileKey> { return { keyRef, key: Buffer.from(keyBytes) }; }
+}
+
+let releaseRecovery!: () => void;
+const recoveryBarrier = new Promise<void>(resolve => { releaseRecovery = resolve; });
+let releaseSwitch!: () => void;
+const switchBarrier = new Promise<void>(resolve => { releaseSwitch = resolve; });
+
+function managerFor(home = codexHome): NativeProfileManager {
+  return new NativeProfileManager({
+    codexHome: home,
+    configDir,
+    keyProvider: new EnvKeyProvider(),
+    hardenPath: async () => {},
+    processProbe: async () => ({ status: "clear", count: 0 }),
+    onSwitchBoundary: async boundary => {
+      if (boundary !== holdSwitchBoundary) return;
+      emit({ event: "switch-boundary", boundary });
+      await switchBarrier;
+    },
+  });
+}
+
+const realFetch = globalThis.fetch;
+const receipts: Array<{ url: string; authorization: string | null }> = [];
+globalThis.fetch = (async (input: RequestInfo | URL, init?: RequestInit): Promise<Response> => {
+  const request = input instanceof Request ? input : new Request(input, init);
+  const url = new URL(request.url);
+  if (url.hostname === "chatgpt.com" || url.hostname === "direct.example.com") {
+    const receipt = { url: url.href, authorization: request.headers.get("authorization") };
+    receipts.push(receipt);
+    if (receiptPath) appendFileSync(receiptPath, `${JSON.stringify(receipt)}\n`);
+    if (url.hostname === "direct.example.com") {
+      return new Response([
+        `data: ${JSON.stringify({
+          id: "chatcmpl-owner-direct",
+          object: "chat.completion.chunk",
+          choices: [{ index: 0, delta: { role: "assistant", content: "direct" }, finish_reason: null }],
+        })}`,
+        `data: ${JSON.stringify({
+          id: "chatcmpl-owner-direct",
+          object: "chat.completion.chunk",
+          choices: [{ index: 0, delta: {}, finish_reason: "stop" }],
+          usage: { prompt_tokens: 1, completion_tokens: 1, total_tokens: 2 },
+        })}`,
+        "data: [DONE]",
+        "",
+      ].join("\n\n"), { headers: { "content-type": "text/event-stream" } });
+    }
+    return Response.json({
+      id: "resp_native_owner",
+      object: "response",
+      status: "completed",
+      output: [],
+      usage: { input_tokens: 1, output_tokens: 1, total_tokens: 2 },
+    });
+  }
+  return realFetch(request);
+}) as typeof fetch;
+
+const primaryManager = managerFor();
+const servers: Array<ReturnType<typeof startServer> | null> = [];
+
+function start(home = codexHome): ReturnType<typeof startServer> {
+  const manager = home === codexHome ? primaryManager : managerFor(home);
+  const server = startServer(0, {
+    nativeMainStartup: {
+      manager,
+      owner: { retryMs: 25, hardenPath: async () => {} },
+      beforeRecovery: holdRecovery
+        ? async () => {
+            emit({ event: "before-recovery", homeId: manager.context.homeId });
+            await recoveryBarrier;
+          }
+        : undefined,
+    },
+    managementApi: { nativeProfileApi: { manager } },
+  });
+  servers.push(server);
+  return server;
+}
+
+const primary = start();
+emit({ event: "listening", pid: process.pid, port: primary.port, homeId: primaryManager.context.homeId });
+
+let lastGate = "";
+const gateTimer = setInterval(() => {
+  const gate = nativeMainStartupGateSnapshot();
+  const serialized = JSON.stringify(gate);
+  if (serialized === lastGate) return;
+  lastGate = serialized;
+  emit({ event: "gate", gate, owner: nativeMainOwnerSnapshot(primaryManager.context) });
+}, 10);
+gateTimer.unref?.();
+
+async function request(port: number, kind: string): Promise<{ status: number; text: string }> {
+  if (kind === "health") {
+    const response = await fetch(`http://127.0.0.1:${port}/healthz`);
+    return { status: response.status, text: await response.text() };
+  }
+  if (kind === "management-list" || kind === "management-doctor") {
+    const path = kind === "management-doctor" ? "/api/native-main-profiles/doctor" : "/api/native-main-profiles";
+    const response = await fetch(`http://127.0.0.1:${port}${path}`, {
+      headers: { "x-opencodex-api-key": process.env.OPENCODEX_ADMIN_AUTH_TOKEN ?? "" },
+    });
+    return { status: response.status, text: await response.text() };
+  }
+  if (kind === "direct") {
+    const response = await fetch(`http://127.0.0.1:${port}/v1/chat/completions`, {
+      method: "POST",
+      headers: { "content-type": "application/json", authorization: "Bearer caller-direct" },
+      body: JSON.stringify({
+        model: "direct/direct-model",
+        messages: [{ role: "user", content: "direct" }],
+        stream: false,
+      }),
+    });
+    return { status: response.status, text: await response.text() };
+  }
+  const response = await fetch(`http://127.0.0.1:${port}/v1/responses`, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ model: "gpt-5.6-sol", input: kind, stream: false }),
+  });
+  return { status: response.status, text: await response.text() };
+}
+
+const lines = createInterface({ input: process.stdin, crlfDelay: Infinity });
+for await (const line of lines) {
+  let command: Record<string, unknown>;
+  try { command = JSON.parse(line) as Record<string, unknown>; }
+  catch { emit({ event: "fatal", message: "invalid command" }); continue; }
+  const id = String(command.id ?? "");
+  try {
+    if (command.op === "snapshot") {
+      emit({
+        event: "reply",
+        id,
+        ok: true,
+        gate: nativeMainStartupGateSnapshot(),
+        owner: nativeMainOwnerSnapshot(primaryManager.context),
+        upstreamCalls: receipts.length,
+        lastReceipt: receipts.at(-1) ?? null,
+      });
+      continue;
+    }
+    if (command.op === "set-mode") {
+      const mode = String(command.mode);
+      if (mode !== "direct") {
+        const response = await fetch(`http://127.0.0.1:${primary.port}/api/codex-auth/active`, {
+          method: "PUT",
+          headers: {
+            "content-type": "application/json",
+            "x-opencodex-api-key": process.env.OPENCODEX_ADMIN_AUTH_TOKEN ?? "",
+          },
+          body: JSON.stringify({ accountId: mode === "pool" ? "pool-a" : MAIN_CODEX_ACCOUNT_ID }),
+        });
+        if (!response.ok) throw new Error(await response.text());
+      }
+      emit({ event: "reply", id, ok: true });
+      continue;
+    }
+    if (command.op === "request") {
+      const index = Number(command.index ?? 0);
+      const server = servers[index];
+      if (!server) throw new Error("server is not running");
+      const result = await request(server.port!, String(command.kind));
+      emit({
+        event: "reply",
+        id,
+        ok: true,
+        ...result,
+        upstreamCalls: receipts.length,
+        lastReceipt: receipts.at(-1) ?? null,
+      });
+      continue;
+    }
+    if (command.op === "release-recovery") {
+      releaseRecovery();
+      emit({ event: "reply", id, ok: true });
+      continue;
+    }
+    if (command.op === "release-switch") {
+      releaseSwitch();
+      emit({ event: "reply", id, ok: true });
+      continue;
+    }
+    if (command.op === "start-extra-server") {
+      const alias = String(command.codexHomeAlias ?? codexHome);
+      const server = start(alias);
+      emit({ event: "reply", id, ok: true, index: servers.length - 1, port: server.port });
+      continue;
+    }
+    if (command.op === "stop-server") {
+      const index = Number(command.index);
+      const server = servers[index];
+      if (server) {
+        await server.stop(true);
+        servers[index] = null;
+      }
+      emit({ event: "reply", id, ok: true });
+      continue;
+    }
+    if (command.op === "stop") {
+      for (let index = 0; index < servers.length; index += 1) {
+        const server = servers[index];
+        if (!server) continue;
+        await server.stop(true);
+        servers[index] = null;
+      }
+      emit({ event: "reply", id, ok: true, owner: nativeMainOwnerSnapshot(primaryManager.context) });
+      emit({ event: "stopped" });
+      break;
+    }
+    throw new Error("unknown command");
+  } catch (error) {
+    emit({ event: "reply", id, ok: false, error: error instanceof Error ? error.message : String(error) });
+  }
+}
+
+clearInterval(gateTimer);
+globalThis.fetch = realFetch;
+keyBytes.fill(0);
+lines.close();
diff --git a/tests/native-main-claim.test.ts b/tests/native-main-claim.test.ts
new file mode 100644
index 000000000..d5c76f5b1
--- /dev/null
+++ b/tests/native-main-claim.test.ts
@@ -0,0 +1,158 @@
+import { afterEach, describe, expect, test } from "bun:test";
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import {
+  nativeMainClaimPath,
+  withNativeMainExclusiveClaim,
+  withNativeMainSharedClaim,
+} from "../src/codex/native-main-claim";
+import { retainNativeMainOwner } from "../src/codex/native-main-owner";
+import type { NativeProfileContext } from "../src/codex/native-profile-store";
+
+const roots: string[] = [];
+const noHardening = async (): Promise<void> => {};
+
+function fixture(): NativeProfileContext {
+  const codexHome = mkdtempSync(join(tmpdir(), "ocx-native-claim-"));
+  roots.push(codexHome);
+  return { codexHome } as NativeProfileContext;
+}
+
+function deferred(): { promise: Promise<void>; resolve: () => void } {
+  let resolve!: () => void;
+  const promise = new Promise<void>(done => { resolve = done; });
+  return { promise, resolve };
+}
+
+afterEach(() => {
+  for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true });
+});
+
+describe("native-main shared and exclusive claims", () => {
+  test("shared readers coexist while an immediate exclusive transition fails closed", async () => {
+    const context = fixture();
+    const entered = deferred();
+    const release = deferred();
+    const first = withNativeMainSharedClaim(context, async () => {
+      entered.resolve();
+      await release.promise;
+      return "first";
+    }, { hardenPath: noHardening });
+    await entered.promise;
+
+    await expect(withNativeMainSharedClaim(
+      context,
+      async () => "second",
+      { hardenPath: noHardening },
+    )).resolves.toBe("second");
+    await expect(withNativeMainExclusiveClaim(
+      context,
+      async () => "must-not-run",
+      { waitMs: 0, hardenPath: noHardening },
+    )).rejects.toMatchObject({ code: "NATIVE_MAIN_CLAIM_BUSY", retryable: true });
+
+    release.resolve();
+    await expect(first).resolves.toBe("first");
+  });
+
+  test("closing a sibling reader cannot let another process bypass a retained shared claim", async () => {
+    const context = fixture();
+    const entered = deferred();
+    const release = deferred();
+    const retained = withNativeMainSharedClaim(context, async () => {
+      entered.resolve();
+      await release.promise;
+    }, { hardenPath: noHardening });
+    await entered.promise;
+    await withNativeMainSharedClaim(context, async () => undefined, { hardenPath: noHardening });
+
+    const child = Bun.spawn([
+      process.execPath,
+      join(import.meta.dir, "helpers", "native-main-claim-child.ts"),
+      context.codexHome,
+    ], { cwd: join(import.meta.dir, ".."), stdout: "pipe", stderr: "pipe" });
+    const [exitCode, stdout, stderr] = await Promise.all([
+      child.exited,
+      new Response(child.stdout).text(),
+      new Response(child.stderr).text(),
+    ]);
+    expect(exitCode).toBe(0);
+    expect(stderr).toBe("");
+    expect(JSON.parse(stdout)).toEqual({ status: "rejected", code: "NATIVE_MAIN_CLAIM_BUSY" });
+
+    release.resolve();
+    await retained;
+  });
+
+  test("a bounded exclusive transition waits for an existing shared reader", async () => {
+    const context = fixture();
+    const entered = deferred();
+    const release = deferred();
+    const reader = withNativeMainSharedClaim(context, async () => {
+      entered.resolve();
+      await release.promise;
+    }, { hardenPath: noHardening });
+    await entered.promise;
+
+    const writer = withNativeMainExclusiveClaim(
+      context,
+      async () => "exclusive",
+      { waitMs: 2_000, pollMs: 10, hardenPath: noHardening },
+    );
+    const releaseTimer = setTimeout(release.resolve, 50);
+    await expect(writer).resolves.toBe("exclusive");
+    clearTimeout(releaseTimer);
+    await reader;
+  });
+
+  test("a malformed claim database is preserved and reported unavailable", async () => {
+    const context = fixture();
+    mkdirSync(context.codexHome, { recursive: true });
+    const path = nativeMainClaimPath(context);
+    const malformed = Buffer.from("not-a-sqlite-database\n", "utf8");
+    writeFileSync(path, malformed);
+
+    await expect(withNativeMainSharedClaim(
+      context,
+      async () => "must-not-run",
+      { hardenPath: noHardening },
+    )).rejects.toMatchObject({ code: "NATIVE_MAIN_CLAIM_UNAVAILABLE", retryable: true });
+    expect(readFileSync(path)).toEqual(malformed);
+  });
+
+  test("operation errors are preserved after claim setup succeeds", async () => {
+    const context = fixture();
+    const failure = new Error("operation failed");
+    await expect(withNativeMainSharedClaim(
+      context,
+      async () => { throw failure; },
+      { hardenPath: noHardening },
+    )).rejects.toBe(failure);
+  });
+
+  test("release detaches an acquiring owner before asynchronous cleanup settles", async () => {
+    const context = { ...fixture(), homeId: crypto.randomUUID() } as NativeProfileContext;
+    const hardeningStarted = deferred();
+    const allowHardening = deferred();
+    const first = retainNativeMainOwner(context, {
+      retryMs: 10,
+      hardenPath: async () => {
+        hardeningStarted.resolve();
+        await allowHardening.promise;
+      },
+    });
+    await hardeningStarted.promise;
+    const closing = first.release();
+    const successor = retainNativeMainOwner(context, { retryMs: 10, hardenPath: noHardening });
+    expect(successor.snapshot().status).toBe("acquiring");
+    allowHardening.resolve();
+    await closing;
+
+    const deadline = Date.now() + 2_000;
+    while (successor.snapshot().status !== "held" && Date.now() < deadline) await Bun.sleep(10);
+    expect(successor.snapshot().status).toBe("held");
+    await successor.release();
+  });
+});
diff --git a/tests/native-main-owner-lifetime.test.ts b/tests/native-main-owner-lifetime.test.ts
new file mode 100644
index 000000000..52d909139
--- /dev/null
+++ b/tests/native-main-owner-lifetime.test.ts
@@ -0,0 +1,417 @@
+import { afterEach, describe, expect, test } from "bun:test";
+import { Database } from "bun:sqlite";
+import {
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+
+import { saveConfig } from "../src/config";
+import { saveCodexAccountCredential } from "../src/codex/account-store";
+import { MAIN_CODEX_ACCOUNT_ID } from "../src/codex/main-account";
+import {
+  NATIVE_MAIN_OWNER_DB,
+  nativeMainOwnerFilesystemSupported,
+  retainNativeMainOwner,
+  withNativeMainOwnerOperation,
+} from "../src/codex/native-main-owner";
+import { NativeProfileManager } from "../src/codex/native-profile-manager";
+import { probeNativeProfileRecoveryState } from "../src/codex/native-profile-store";
+import type { NativeProfileKey, NativeProfileKeyProvider } from "../src/codex/native-profile-types";
+import type { OcxConfig } from "../src/types";
+
+const roots: string[] = [];
+const previousCodexHome = process.env.CODEX_HOME;
+const previousOpenCodexHome = process.env.OPENCODEX_HOME;
+
+function restoreEnv(name: "CODEX_HOME" | "OPENCODEX_HOME", value: string | undefined): void {
+  if (value === undefined) delete process.env[name];
+  else process.env[name] = value;
+}
+
+afterEach(() => {
+  restoreEnv("CODEX_HOME", previousCodexHome);
+  restoreEnv("OPENCODEX_HOME", previousOpenCodexHome);
+  for (const root of roots.splice(0)) {
+    rmSync(root, { recursive: true, force: true, maxRetries: 10, retryDelay: 50 });
+  }
+});
+
+class MemoryKeyProvider implements NativeProfileKeyProvider {
+  constructor(private readonly bytes: Buffer) {}
+  async get(): Promise<NativeProfileKey> { return { keyRef: "memory:native-owner-test", key: Buffer.from(this.bytes) }; }
+  async create(): Promise<NativeProfileKey> { return { keyRef: "memory:native-owner-test", key: Buffer.from(this.bytes) }; }
+}
+
+function auth(account: string, marker: string): string {
+  return JSON.stringify({
+    auth_mode: "chatgpt",
+    tokens: {
+      id_token: `id-${marker}`,
+      access_token: `access-${marker}`,
+      refresh_token: `refresh-${marker}`,
+      account_id: account,
+    },
+  }, null, 2) + "\n";
+}
+
+interface Fixture {
+  root: string;
+  codexHome: string;
+  configDir: string;
+  key: Buffer;
+  manager: NativeProfileManager;
+}
+
+function writeConfig(
+  codexHome: string,
+  configDir: string,
+  active = MAIN_CODEX_ACCOUNT_ID,
+  includePool = true,
+): void {
+  mkdirSync(configDir, { recursive: true });
+  process.env.CODEX_HOME = codexHome;
+  process.env.OPENCODEX_HOME = configDir;
+  saveConfig({
+    port: 0,
+    hostname: "127.0.0.1",
+    defaultProvider: "openai",
+    providers: {
+      openai: {
+        adapter: "openai-responses",
+        baseUrl: "https://chatgpt.com/backend-api/codex",
+        authMode: "forward",
+        codexAccountMode: "pool",
+      },
+      direct: {
+        adapter: "openai-chat",
+        baseUrl: "https://direct.example.com/v1",
+        apiKey: "direct-test-key",
+      },
+    },
+    codexAccounts: includePool ? [{ id: "pool-a", email: "pool@example.test", isMain: false }] : [],
+    activeCodexAccountId: active,
+    autoSwitchThreshold: 0,
+  } as OcxConfig);
+  if (includePool) {
+    saveCodexAccountCredential("pool-a", {
+      accessToken: "pool-access",
+      refreshToken: "pool-refresh",
+      expiresAt: Date.now() + 60 * 60_000,
+      chatgptAccountId: "pool-account",
+    });
+  }
+  restoreEnv("CODEX_HOME", previousCodexHome);
+  restoreEnv("OPENCODEX_HOME", previousOpenCodexHome);
+}
+
+function fixture(configName = "opencodex", includePool = true): Fixture {
+  const root = mkdtempSync(join(tmpdir(), "ocx-native-owner-"));
+  roots.push(root);
+  const codexHome = join(root, "codex");
+  const configDir = join(root, configName);
+  mkdirSync(codexHome, { recursive: true });
+  writeFileSync(join(codexHome, "config.toml"), 'cli_auth_credentials_store = "file"\n');
+  writeFileSync(join(codexHome, "auth.json"), auth("account-main", "main"));
+  writeConfig(codexHome, configDir, MAIN_CODEX_ACCOUNT_ID, includePool);
+  const key = Buffer.alloc(32, 0x5c);
+  const manager = new NativeProfileManager({
+    codexHome,
+    configDir,
+    keyProvider: new MemoryKeyProvider(key),
+    hardenPath: async () => {},
+    processProbe: async () => ({ status: "clear", count: 0 }),
+  });
+  return { root, codexHome, configDir, key, manager };
+}
+
+async function waitUntil<T>(probe: () => T | null, timeoutMs = 10_000): Promise<T> {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    const value = probe();
+    if (value !== null) return value;
+    await Bun.sleep(20);
+  }
+  throw new Error("timed out waiting for owner state");
+}
+
+type Event = Record<string, unknown>;
+
+class ChildHarness {
+  readonly child: ReturnType<typeof Bun.spawn>;
+  readonly events: Event[] = [];
+  readonly stderr: Promise<string>;
+  private nextId = 0;
+  private readonly waiters = new Set<() => void>();
+
+  constructor(f: Fixture, extraEnv: Record<string, string> = {}) {
+    this.child = Bun.spawn([process.execPath, join(import.meta.dir, "helpers", "native-main-owner-child.ts")], {
+      cwd: join(import.meta.dir, ".."),
+      env: {
+        ...process.env,
+        HOME: f.root,
+        USERPROFILE: f.root,
+        CODEX_HOME: f.codexHome,
+        OPENCODEX_HOME: f.configDir,
+        OPENCODEX_ADMIN_AUTH_TOKEN: "owner-test-admin",
+        NATIVE_OWNER_CODEX_HOME: f.codexHome,
+        NATIVE_OWNER_CONFIG_DIR: f.configDir,
+        NATIVE_OWNER_KEY: f.key.toString("base64"),
+        ...extraEnv,
+      },
+      stdin: "pipe",
+      stdout: "pipe",
+      stderr: "pipe",
+      windowsHide: true,
+    });
+    this.stderr = new Response(this.child.stderr).text();
+    void (async () => {
+      const reader = this.child.stdout.getReader();
+      const decoder = new TextDecoder();
+      let buffered = "";
+      for (;;) {
+        const { done, value } = await reader.read();
+        buffered += decoder.decode(value, { stream: !done });
+        const lines = buffered.split(/\r?\n/);
+        buffered = done ? "" : lines.pop() ?? "";
+        for (const line of lines) {
+          if (!line.startsWith("@@native-owner@@")) continue;
+          this.events.push(JSON.parse(line.slice("@@native-owner@@".length)) as Event);
+          for (const wake of this.waiters) wake();
+          this.waiters.clear();
+        }
+        if (done) break;
+      }
+    })();
+  }
+
+  async waitFor(predicate: (event: Event) => boolean, timeoutMs = 10_000): Promise<Event> {
+    const deadline = Date.now() + timeoutMs;
+    for (;;) {
+      const found = this.events.find(predicate);
+      if (found) return found;
+      if (Date.now() >= deadline) {
+        throw new Error(`child event timeout; events=${JSON.stringify(this.events)} stderr=${await this.stderr}`);
+      }
+      await Promise.race([
+        new Promise<void>(resolve => this.waiters.add(resolve)),
+        Bun.sleep(50),
+      ]);
+    }
+  }
+
+  async command(op: string, fields: Record<string, unknown> = {}): Promise<Event> {
+    const id = String(++this.nextId);
+    this.child.stdin.write(`${JSON.stringify({ id, op, ...fields })}\n`);
+    await this.child.stdin.flush();
+    return this.waitFor(event => event.event === "reply" && event.id === id);
+  }
+
+  async snapshot(predicate: (event: Event) => boolean, timeoutMs = 10_000): Promise<Event> {
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+      const event = await this.command("snapshot");
+      if (predicate(event)) return event;
+      await Bun.sleep(25);
+    }
+    throw new Error(`snapshot timeout; events=${JSON.stringify(this.events)}`);
+  }
+
+  async stop(): Promise<Event | null> {
+    if (this.child.exitCode !== null) return null;
+    const reply = await this.command("stop");
+    expect(reply.ok).toBe(true);
+    const exit = await Promise.race([this.child.exited, Bun.sleep(10_000).then(() => null)]);
+    if (exit === null) throw new Error("child did not stop");
+    if (exit !== 0) throw new Error(await this.stderr);
+    return reply;
+  }
+
+  async hardKill(): Promise<void> {
+    if (this.child.exitCode === null) this.child.kill(9);
+    await this.child.exited;
+  }
+}
+
+function isHeldReady(event: Event): boolean {
+  const owner = event.owner as { status?: string } | undefined;
+  const gate = event.gate as { status?: string } | undefined;
+  return owner?.status === "held" && gate?.status === "ready";
+}
+
+function isContended(event: Event): boolean {
+  const owner = event.owner as { status?: string } | undefined;
+  const gate = event.gate as { reason?: string } | undefined;
+  return owner?.status === "contended" && gate?.reason === "owner-conflict";
+}
+
+describe("native-main process owner lease", () => {
+  test("same-process references retain one owner and do not deadlock the transaction lock", async () => {
+    const f = fixture();
+    const first = retainNativeMainOwner(f.manager.context, { retryMs: 10, hardenPath: async () => {} });
+    const second = retainNativeMainOwner(f.manager.context, { retryMs: 10, hardenPath: async () => {} });
+    await waitUntil(() => first.snapshot().status === "held" ? first.snapshot() : null);
+
+    const contender = () => {
+      const database = new Database(join(f.codexHome, NATIVE_MAIN_OWNER_DB));
+      try { database.exec("PRAGMA busy_timeout=0; BEGIN IMMEDIATE"); }
+      finally { database.close(); }
+    };
+    expect(contender).toThrow();
+    await expect(withNativeMainOwnerOperation(f.manager.context, () => f.manager.recover(false)))
+      .resolves.toMatchObject({ recovered: false });
+
+    await first.release();
+    expect(contender).toThrow();
+    await second.release();
+    expect(contender).not.toThrow();
+    expect(existsSync(join(f.codexHome, NATIVE_MAIN_OWNER_DB))).toBe(true);
+  });
+
+  test("distinct homes are independent and obvious network or WSL DrvFS paths are unsupported", async () => {
+    const firstFixture = fixture("one");
+    const secondFixture = fixture("two");
+    const first = retainNativeMainOwner(firstFixture.manager.context, { hardenPath: async () => {} });
+    const second = retainNativeMainOwner(secondFixture.manager.context, { hardenPath: async () => {} });
+    await waitUntil(() => first.snapshot().status === "held" ? true : null);
+    await waitUntil(() => second.snapshot().status === "held" ? true : null);
+    expect(first.snapshot().status).toBe("held");
+    expect(second.snapshot().status).toBe("held");
+    expect(nativeMainOwnerFilesystemSupported("\\\\server\\share\\.codex", "win32", {})).toBe(false);
+    expect(nativeMainOwnerFilesystemSupported("/mnt/c/Users/test/.codex", "linux", { WSL_INTEROP: "1" })).toBe(false);
+    expect(nativeMainOwnerFilesystemSupported("/home/test/.codex", "linux", { WSL_INTEROP: "1" })).toBe(true);
+    await first.release();
+    await second.release();
+  });
+
+  test("a contender keeps Pool, Direct, health, and metadata usable before graceful takeover", async () => {
+    const firstFixture = fixture("owner-a");
+    const secondConfig = join(firstFixture.root, "owner-b");
+    writeConfig(firstFixture.codexHome, secondConfig, MAIN_CODEX_ACCOUNT_ID, false);
+    const secondFixture = { ...firstFixture, configDir: secondConfig };
+    const first = new ChildHarness(firstFixture);
+    let second: ChildHarness | undefined;
+    let support: ChildHarness | undefined;
+    try {
+      await first.waitFor(event => event.event === "listening");
+      await first.snapshot(isHeldReady);
+      second = new ChildHarness(secondFixture);
+      await second.waitFor(event => event.event === "listening");
+      await second.snapshot(isContended);
+
+      const supportConfig = join(firstFixture.root, "owner-support");
+      writeConfig(firstFixture.codexHome, supportConfig);
+      support = new ChildHarness({ ...firstFixture, configDir: supportConfig });
+      await support.waitFor(event => event.event === "listening");
+      await support.snapshot(isContended);
+      expect((await support.command("set-mode", { mode: "pool" })).ok).toBe(true);
+      const pool = await support.command("request", { kind: "pool" });
+      expect(pool.status).toBe(200);
+      expect((pool.lastReceipt as { authorization?: string }).authorization).toBe("Bearer pool-access");
+
+      const direct = await support.command("request", { kind: "direct" });
+      expect(direct).toMatchObject({ status: 200 });
+      expect((direct.lastReceipt as { authorization?: string }).authorization).toBe("Bearer direct-test-key");
+      expect((await support.command("request", { kind: "health" })).status).toBe(200);
+      expect((await support.command("request", { kind: "management-list" })).status).toBe(200);
+      await support.stop();
+
+      const before = await second.command("snapshot");
+      const main = await second.command("request", { kind: "main" });
+      expect(Number(main.status)).toBeGreaterThanOrEqual(400);
+      expect(main.upstreamCalls).toBe(before.upstreamCalls);
+      const doctor = await second.command("request", { kind: "management-doctor" });
+      expect(doctor.status).toBe(503);
+      expect(doctor.text).toContain("NATIVE_MAIN_OWNER_BUSY");
+
+      const stopped = await first.stop();
+      expect(stopped?.owner).toBeNull();
+      await second.snapshot(isHeldReady);
+      const recoveredMain = await second.command("request", { kind: "main" });
+      expect(recoveredMain.status).toBe(200);
+      expect((recoveredMain.lastReceipt as { authorization?: string }).authorization).toBe("Bearer access-main");
+    } finally {
+      await first.stop().catch(() => first.hardKill());
+      if (second) await second.stop().catch(() => second!.hardKill());
+      if (support) await support.stop().catch(() => support!.hardKill());
+    }
+  }, 30_000);
+
+  test("a hard-killed owner releases the OS lease and the successor recovers before opening main", async () => {
+    const f = fixture("crash-a", false);
+    const source = await f.manager.register("source");
+    const stage = await f.manager.prepareStage();
+    writeFileSync(join(stage.stagingCodexHome, "auth.json"), auth("account-target", "target"));
+    const target = await f.manager.finishStage(stage.stageId, "target");
+    expect(source.profile.state).toBe("active");
+
+    const successorFixture = { ...f };
+    const owner = new ChildHarness(f, { NATIVE_OWNER_HOLD_SWITCH_BOUNDARY: "auth-replaced" });
+    let successor: ChildHarness | undefined;
+    try {
+      const listening = await owner.waitFor(event => event.event === "listening");
+      await owner.snapshot(isHeldReady);
+      const switchRequest = fetch(`http://127.0.0.1:${Number(listening.port)}/api/native-main-profiles/switch`, {
+        method: "POST",
+        headers: { "content-type": "application/json", "x-opencodex-api-key": "owner-test-admin" },
+        body: JSON.stringify({ target: target.profile.id, confirmedStopped: true }),
+      }).catch(() => null);
+      await owner.waitFor(event => event.event === "switch-boundary" && event.boundary === "auth-replaced");
+      expect(probeNativeProfileRecoveryState(f.manager.context)).toBe("journal");
+
+      successor = new ChildHarness(successorFixture);
+      await successor.waitFor(event => event.event === "listening");
+      await successor.snapshot(isContended);
+      const before = await successor.command("snapshot");
+      const blockedMain = await successor.command("request", { kind: "main" });
+      expect(Number(blockedMain.status)).toBeGreaterThanOrEqual(400);
+      expect(blockedMain.upstreamCalls).toBe(before.upstreamCalls);
+
+      await owner.hardKill();
+      await switchRequest;
+      await successor.snapshot(isHeldReady);
+      expect(probeNativeProfileRecoveryState(f.manager.context)).toBe("none");
+      const main = await successor.command("request", { kind: "main" });
+      expect(main.status).toBe(200);
+      expect((main.lastReceipt as { authorization?: string }).authorization).toBe("Bearer access-target");
+      expect(readFileSync(join(f.codexHome, "auth.json"), "utf8")).toContain("access-target");
+    } finally {
+      await owner.stop().catch(() => owner.hardKill());
+      if (successor) await successor.stop().catch(() => successor!.hardKill());
+    }
+  }, 30_000);
+
+  test("same-process server references retain ownership until the last server stops", async () => {
+    const f = fixture("refs-a");
+    const contenderConfig = join(f.root, "refs-b");
+    writeConfig(f.codexHome, contenderConfig);
+    const contenderFixture = { ...f, configDir: contenderConfig };
+    const owner = new ChildHarness(f);
+    let contender: ChildHarness | undefined;
+    try {
+      await owner.waitFor(event => event.event === "listening");
+      await owner.snapshot(isHeldReady);
+      const alias = resolve(f.codexHome, ".", "..", "codex", ".");
+      const extra = await owner.command("start-extra-server", { codexHomeAlias: alias });
+      expect(extra.ok).toBe(true);
+      contender = new ChildHarness(contenderFixture);
+      await contender.waitFor(event => event.event === "listening");
+      await contender.snapshot(isContended);
+
+      expect((await owner.command("stop-server", { index: 0 })).ok).toBe(true);
+      await Bun.sleep(150);
+      await contender.snapshot(isContended);
+
+      expect((await owner.command("stop-server", { index: 1 })).ok).toBe(true);
+      await contender.snapshot(isHeldReady);
+    } finally {
+      await owner.stop().catch(() => owner.hardKill());
+      if (contender) await contender.stop().catch(() => contender!.hardKill());
+    }
+  }, 30_000);
+});
diff --git a/tests/native-profile-drain-server.test.ts b/tests/native-profile-drain-server.test.ts
index 1eb68eec5..83cb6acad 100644
--- a/tests/native-profile-drain-server.test.ts
+++ b/tests/native-profile-drain-server.test.ts
@@ -12,6 +12,7 @@ import { clearThreadAccountMap } from "../src/codex/routing";
 import { saveConfig } from "../src/config";
 import { handleNativeProfileAPI } from "../src/codex/native-profile-api";
 import type { NativeProfileManager } from "../src/codex/native-profile-manager";
+import { waitForNativeMainStartupGate } from "../src/codex/native-profile-startup";
 import { startServer } from "../src/server";
 import {
   acquireNativeMainProfileDrain,
@@ -269,6 +270,7 @@ describe("native main profile scoped server admission", () => {
       saveMode("pool", MAIN_CODEX_ACCOUNT_ID);
       updateAccountQuota(MAIN_CODEX_ACCOUNT_ID, 1, 1);
       server = startServer(0);
+      await waitForNativeMainStartupGate();
       client = await connectEcho(server, "/v1/live/main-pre-fence");
       expect(getNativeMainProfileRequestCount()).toBe(1);
       const blocked = await handleNativeProfileAPI(

From fbe436219bf200d34fe2107e88d4778ab72a2a25 Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Mon, 3 Aug 2026 09:23:39 +0900
Subject: [PATCH 43/63] fix(cli): report effective Codex home for profile
 mutations

---
 .../ja/reference/cli/providers-accounts.md    |  4 ++
 .../ko/reference/cli/providers-accounts.md    |  4 ++
 .../docs/reference/cli/providers-accounts.md  |  4 ++
 .../ru/reference/cli/providers-accounts.md    |  4 ++
 .../zh-cn/reference/cli/providers-accounts.md |  3 +
 src/cli/account-main.ts                       | 21 +++++--
 tests/cli-native-profile.test.ts              | 62 +++++++++++++++++--
 7 files changed, 93 insertions(+), 9 deletions(-)

diff --git a/docs-site/src/content/docs/ja/reference/cli/providers-accounts.md b/docs-site/src/content/docs/ja/reference/cli/providers-accounts.md
index bf403110c..dfabda949 100644
--- a/docs-site/src/content/docs/ja/reference/cli/providers-accounts.md
+++ b/docs-site/src/content/docs/ja/reference/cli/providers-accounts.md
@@ -177,6 +177,10 @@ ocx account main switch <profile-id-or-label> --yes [--json]
 ocx account main recover [--rollback --yes] [--json]
 ```
 
+各変更コマンドは、実行中のプロキシが返す正規化済みの有効な `CODEX_HOME` を表示します。このパスは
+呼び出し元の `CODEX_HOME` と異なる場合があり、JSON 対応コマンドは同じ値を
+`effectiveCodexHome` として返します。
+
 バージョン 1 はファイルベースの Codex 認証をサポートし、保存したプロファイルを AES-256-GCM で暗号化し、暗号鍵を OS の資格情報ストアに保持します。`add` は、生成された資格情報を取り込む前に公式 Codex ログインをステージングします。プロファイルを切り替える前に Codex を終了してください。切り替えに成功するとローカルのタスクと履歴は保持されますが、続行する前に Codex の再起動が必要です。`doctor` でプロファイル状態を確認し、`recover` で中断した切り替えを完了またはロールバックできます。`switch` にはプロファイル ID またはラベルを指定できます。
 
 ## モデル
diff --git a/docs-site/src/content/docs/ko/reference/cli/providers-accounts.md b/docs-site/src/content/docs/ko/reference/cli/providers-accounts.md
index ea33bb69a..45b1ddb2e 100644
--- a/docs-site/src/content/docs/ko/reference/cli/providers-accounts.md
+++ b/docs-site/src/content/docs/ko/reference/cli/providers-accounts.md
@@ -177,6 +177,10 @@ ocx account main switch <profile-id-or-label> --yes [--json]
 ocx account main recover [--rollback --yes] [--json]
 ```
 
+각 변경 명령은 실행 중인 프록시가 반환한 정규화된 유효 `CODEX_HOME`을 표시합니다. 이 경로는
+호출자의 `CODEX_HOME`과 다를 수 있으며, JSON을 지원하는 명령은 같은 값을
+`effectiveCodexHome`으로 반환합니다.
+
 버전 1은 파일 기반 Codex 인증을 지원하고 저장된 프로필을 AES-256-GCM으로 암호화하며 암호화 키를 운영 체제 자격 증명 저장소에 보관합니다. `add`는 생성된 자격 증명을 가져오기 전에 공식 Codex 로그인을 스테이징합니다. 프로필을 전환하기 전에 Codex를 종료하십시오. 전환에 성공하면 로컬 작업과 기록은 보존되지만 계속하기 전에 Codex를 다시 시작해야 합니다. `doctor`로 프로필 상태를 확인하고 `recover`로 중단된 전환을 완료하거나 롤백할 수 있습니다. `switch`에는 프로필 ID 또는 라벨을 지정할 수 있습니다.
 
 ## 모델
diff --git a/docs-site/src/content/docs/reference/cli/providers-accounts.md b/docs-site/src/content/docs/reference/cli/providers-accounts.md
index e5c741b03..d79cd5e19 100644
--- a/docs-site/src/content/docs/reference/cli/providers-accounts.md
+++ b/docs-site/src/content/docs/reference/cli/providers-accounts.md
@@ -223,6 +223,10 @@ ocx account main switch <profile-id-or-label> --yes [--json]
 ocx account main recover [--rollback --yes] [--json]
 ```
 
+Each mutating command reports the canonical effective `CODEX_HOME` returned by the running proxy.
+This path can differ from the caller's `CODEX_HOME`; commands that support JSON expose the same
+value as `effectiveCodexHome`.
+
 Version 1 supports file-based Codex authentication, encrypts stored profiles with AES-256-GCM, and
 keeps the encryption key in the operating-system credential store. `add` stages the official Codex
 login flow before importing the resulting credential. Close Codex before switching profiles; a
diff --git a/docs-site/src/content/docs/ru/reference/cli/providers-accounts.md b/docs-site/src/content/docs/ru/reference/cli/providers-accounts.md
index bf57cb1f5..ea71870ad 100644
--- a/docs-site/src/content/docs/ru/reference/cli/providers-accounts.md
+++ b/docs-site/src/content/docs/ru/reference/cli/providers-accounts.md
@@ -228,6 +228,10 @@ ocx account main switch <profile-id-or-label> --yes [--json]
 ocx account main recover [--rollback --yes] [--json]
 ```
 
+Каждая изменяющая команда показывает канонический эффективный `CODEX_HOME`, возвращенный
+работающим прокси. Этот путь может отличаться от `CODEX_HOME` вызывающего процесса; команды с
+поддержкой JSON возвращают то же значение в `effectiveCodexHome`.
+
 Версия 1 поддерживает файловую аутентификацию Codex, шифрует сохранённые профили с помощью AES-256-GCM и хранит ключ шифрования в хранилище учётных данных операционной системы. `add` запускает официальный вход Codex в промежуточной среде перед импортом полученных учётных данных. Перед переключением профиля закройте Codex. Успешное переключение сохраняет локальные задачи и историю, после чего Codex необходимо перезапустить. Используйте `doctor` для проверки состояния профилей, а `recover` для завершения или отката прерванного перехода. `switch` принимает ID профиля или его label.
 
 ## Модели
diff --git a/docs-site/src/content/docs/zh-cn/reference/cli/providers-accounts.md b/docs-site/src/content/docs/zh-cn/reference/cli/providers-accounts.md
index 9f04dba1b..3c8a7c65c 100644
--- a/docs-site/src/content/docs/zh-cn/reference/cli/providers-accounts.md
+++ b/docs-site/src/content/docs/zh-cn/reference/cli/providers-accounts.md
@@ -211,6 +211,9 @@ ocx account main switch <profile-id-or-label> --yes [--json]
 ocx account main recover [--rollback --yes] [--json]
 ```
 
+每个变更命令都会显示运行中代理返回的规范化有效 `CODEX_HOME`。该路径可能与调用进程的
+`CODEX_HOME` 不同；支持 JSON 的命令会在 `effectiveCodexHome` 中返回相同的值。
+
 版本 1 支持基于文件的 Codex 身份验证，使用 AES-256-GCM 加密保存的配置文件，并将加密密钥保存在操作系统凭据存储中。`add` 会先在受限暂存环境中启动官方 Codex 登录，再导入生成的凭据。切换配置文件前请关闭 Codex。切换成功后会保留本地任务和历史记录，但继续使用前必须重启 Codex。使用 `doctor` 检查配置文件状态，使用 `recover` 完成或回滚中断的切换。`switch` 可接受配置文件 ID 或标签。
 
 ## 模型
diff --git a/src/cli/account-main.ts b/src/cli/account-main.ts
index 28436d6bd..7a6665279 100644
--- a/src/cli/account-main.ts
+++ b/src/cli/account-main.ts
@@ -34,6 +34,12 @@ function reject(args: string[]): number {
   return 1;
 }
 
+function effectiveCodexHome(result: Record<string, unknown>): string {
+  return typeof result.effectiveCodexHome === "string" && result.effectiveCodexHome.length > 0
+    ? result.effectiveCodexHome
+    : "the effective CODEX_HOME";
+}
+
 function printProfiles(profiles: PublicProfile[]): void {
   if (profiles.length === 0) { console.log("No native main login profiles registered."); return; }
   const rows = profiles.map(profile => [profile.state === "active" ? "*" : " ", profile.label, profile.id, profile.identityHint]);
@@ -88,7 +94,7 @@ export async function cmdNativeMainAccount(args: string[], deps: AccountDeps): P
     if (result.status === 0) return proxyUnreachable();
     if (result.status !== 200) return apiError(result.json, "failed to register the current native login");
     if (wantsJson) console.log(JSON.stringify(result.json, null, 2));
-    else console.log(`Registered '${label}' for ${String(result.json.effectiveCodexHome ?? "the effective CODEX_HOME")}.`);
+    else console.log(`Registered '${label}' for ${effectiveCodexHome(result.json)}.`);
     return 0;
   }
 
@@ -100,10 +106,12 @@ export async function cmdNativeMainAccount(args: string[], deps: AccountDeps): P
     if (stage.status !== 200) return apiError(stage.json, "failed to prepare native login staging");
     const stageId = typeof stage.json.stageId === "string" ? stage.json.stageId : "";
     const stagingHome = typeof stage.json.stagingCodexHome === "string" ? stage.json.stagingCodexHome : "";
+    const stagedEffectiveHome = effectiveCodexHome(stage.json);
     let exitCode = 1;
     let finished = false;
     try {
       if (!stageId || !isAbsolute(stagingHome)) throw new Error("The proxy returned an invalid staging session.");
+      console.error(`Effective CODEX_HOME: ${stagedEffectiveHome}`);
       console.error(`Starting official Codex login in restricted staging home: ${stagingHome}`);
       exitCode = await (deps.runCodexLoginImpl ?? runOfficialCodexLogin)(stagingHome);
       if (exitCode !== 0) throw new Error("Official Codex login did not complete successfully.");
@@ -111,7 +119,7 @@ export async function cmdNativeMainAccount(args: string[], deps: AccountDeps): P
       if (finish.status === 0) return proxyUnreachable();
       if (finish.status !== 200) return apiError(finish.json, "failed to encrypt the staged native login");
       finished = true;
-      console.log(`Added encrypted native profile '${label}'.`);
+      console.log(`Added encrypted native profile '${label}' for ${effectiveCodexHome(finish.json)}.`);
       return 0;
     } catch (error) {
       console.error(`Error: ${error instanceof Error ? error.message : "Official Codex login failed."}`);
@@ -136,7 +144,7 @@ export async function cmdNativeMainAccount(args: string[], deps: AccountDeps): P
     if (wantsJson) console.log(JSON.stringify(result.json, null, 2));
     else {
       const profile = result.json.activeProfile as PublicProfile | undefined;
-      console.log(`Native Codex login is now '${profile?.label ?? target}'. Restart Codex App/CLI before continuing.`);
+      console.log(`Native Codex login for ${effectiveCodexHome(result.json)} is now '${profile?.label ?? target}'. Restart Codex App/CLI before continuing.`);
     }
     return 0;
   }
@@ -152,7 +160,12 @@ export async function cmdNativeMainAccount(args: string[], deps: AccountDeps): P
     if (result.status === 0) return proxyUnreachable();
     if (result.status !== 200) return apiError(result.json, "failed to recover the native-profile transaction");
     if (wantsJson) console.log(JSON.stringify(result.json, null, 2));
-    else console.log(result.json.recovered === true ? `Recovery completed: ${String(result.json.action ?? "converged")}.` : "No recovery journal is pending.");
+    else {
+      const home = effectiveCodexHome(result.json);
+      console.log(result.json.recovered === true
+        ? `Recovery completed for ${home}: ${String(result.json.action ?? "converged")}.`
+        : `No recovery journal is pending for ${home}.`);
+    }
     return 0;
   }
 
diff --git a/tests/cli-native-profile.test.ts b/tests/cli-native-profile.test.ts
index 3c314f6db..66572657f 100644
--- a/tests/cli-native-profile.test.ts
+++ b/tests/cli-native-profile.test.ts
@@ -7,10 +7,13 @@ import { nativeMainCodexLoginInvocation } from "../src/cli/account-main";
 
 const originalLog = console.log;
 const originalError = console.error;
+const originalCodexHome = process.env.CODEX_HOME;
 
 afterEach(() => {
   console.log = originalLog;
   console.error = originalError;
+  if (originalCodexHome === undefined) delete process.env.CODEX_HOME;
+  else process.env.CODEX_HOME = originalCodexHome;
 });
 
 describe("ocx account main", () => {
@@ -48,8 +51,11 @@ describe("ocx account main", () => {
     expect(invocation.options).toEqual({ windowsVerbatimArguments: true });
   });
 
-  test("add keeps the auth envelope off HTTP and switch requires explicit stopped confirmation", async () => {
+  test("mutating human output uses the server's effective home while add keeps the auth envelope off HTTP", async () => {
     const stagingHome = join(tmpdir(), "ocx-native-profile-stage");
+    const effectiveHome = join(tmpdir(), "ocx-native-profile-effective-home");
+    const clientHome = join(tmpdir(), "ocx-native-profile-client-home");
+    process.env.CODEX_HOME = clientHome;
     const requests: Array<{ path: string; body?: Record<string, unknown> }> = [];
     const output: string[] = [];
     const errors: string[] = [];
@@ -60,14 +66,20 @@ describe("ocx account main", () => {
       const url = new URL(String(input));
       const requestBody = typeof init?.body === "string" ? JSON.parse(init.body) as Record<string, unknown> : undefined;
       requests.push({ path: url.pathname, body: requestBody });
+      if (url.pathname.endsWith("/register")) {
+        return Response.json({ effectiveCodexHome: effectiveHome, profile: { id: "p1", label: "personal", identityHint: "account-87654321", state: "active" } });
+      }
       if (url.pathname.endsWith("/stage") && !url.pathname.endsWith("/finish")) {
-        return Response.json({ stageId: "11111111-1111-4111-8111-111111111111", stagingCodexHome: stagingHome, effectiveCodexHome: join(tmpdir(), "codex-home") });
+        return Response.json({ stageId: "11111111-1111-4111-8111-111111111111", stagingCodexHome: stagingHome, effectiveCodexHome: effectiveHome });
       }
       if (url.pathname.endsWith("/stage/finish")) {
-        return Response.json({ effectiveCodexHome: join(tmpdir(), "codex-home"), profile: { id: "p2", label: "work", identityHint: "account-12345678", state: "inactive" } });
+        return Response.json({ effectiveCodexHome: effectiveHome, profile: { id: "p2", label: "work", identityHint: "account-12345678", state: "inactive" } });
       }
       if (url.pathname.endsWith("/switch")) {
-        return Response.json({ ok: true, activeProfile: { id: "p2", label: "work", identityHint: "account-12345678", state: "active" }, restartRequired: true });
+        return Response.json({ ok: true, effectiveCodexHome: effectiveHome, activeProfile: { id: "p2", label: "work", identityHint: "account-12345678", state: "active" }, restartRequired: true });
+      }
+      if (url.pathname.endsWith("/recover")) {
+        return Response.json({ ok: true, recovered: true, action: "rollback-source", effectiveCodexHome: effectiveHome, restartRequired: false });
       }
       return Response.json({ ok: true });
     };
@@ -77,6 +89,7 @@ describe("ocx account main", () => {
       runCodexLoginImpl: async (home: string) => { loginHome = home; return 0; },
     };
 
+    expect(await cmdAccount(["main", "register", "personal"], deps)).toBe(0);
     expect(await cmdAccount(["main", "add", "work"], deps)).toBe(0);
     expect(loginHome).toBe(stagingHome);
     expect(requests.find(request => request.path.endsWith("/stage/finish"))?.body).toEqual({
@@ -100,6 +113,41 @@ describe("ocx account main", () => {
     expect(requests).toHaveLength(recoveryBefore);
     expect(await cmdAccount(["main", "recover", "--rollback", "--yes"], deps)).toBe(0);
     expect(requests.at(-1)?.body).toEqual({ rollback: true, confirmedStopped: true });
+    expect(output).toContain(`Registered 'personal' for ${effectiveHome}.`);
+    expect(output).toContain(`Added encrypted native profile 'work' for ${effectiveHome}.`);
+    expect(output).toContain(`Native Codex login for ${effectiveHome} is now 'work'. Restart Codex App/CLI before continuing.`);
+    expect(output).toContain(`Recovery completed for ${effectiveHome}: rollback-source.`);
+    expect(errors).toContain(`Effective CODEX_HOME: ${effectiveHome}`);
+    expect([...output, ...errors].join("\n")).not.toContain(clientHome);
+  });
+
+  test("JSON mutating output preserves the server's canonical effective home", async () => {
+    const effectiveHome = join(tmpdir(), "ocx-native-profile-json-effective-home");
+    process.env.CODEX_HOME = join(tmpdir(), "ocx-native-profile-json-client-home");
+    const responses: Record<string, Record<string, unknown>> = {
+      register: { effectiveCodexHome: effectiveHome, profile: { id: "p1", label: "personal", identityHint: "account-87654321", state: "active" } },
+      switch: { ok: true, effectiveCodexHome: effectiveHome, activeProfile: { id: "p2", label: "work", identityHint: "account-12345678", state: "active" }, restartRequired: true },
+      recover: { ok: true, recovered: false, externallyRefreshed: false, effectiveCodexHome: effectiveHome },
+    };
+    const output: string[] = [];
+    console.log = (...values: unknown[]) => output.push(values.join(" "));
+    const fetchImpl: typeof fetch = async input => {
+      const operation = new URL(String(input)).pathname.split("/").at(-1)!;
+      return Response.json(responses[operation]);
+    };
+    const deps = { baseUrl: "http://127.0.0.1:10100", fetchImpl };
+
+    const commands = [
+      { args: ["main", "register", "personal", "--json"], result: responses.register },
+      { args: ["main", "switch", "work", "--yes", "--json"], result: responses.switch },
+      { args: ["main", "recover", "--json"], result: responses.recover },
+    ];
+    for (const command of commands) {
+      output.length = 0;
+      expect(await cmdAccount(command.args, deps)).toBe(0);
+      expect(JSON.parse(output.join("\n"))).toEqual(command.result);
+      expect(JSON.parse(output.join("\n")).effectiveCodexHome).toBe(effectiveHome);
+    }
   });
 
   test("add sends an idempotent cancel fallback after a non-200 finish response", async () => {
@@ -160,12 +208,15 @@ describe("ocx account main", () => {
 
   test("add cancels server staging when official login aborts", async () => {
     const stagingHome = join(tmpdir(), "ocx-native-profile-stage-abort");
+    const effectiveHome = join(tmpdir(), "ocx-native-profile-effective-home-abort");
     const requests: string[] = [];
+    const errors: string[] = [];
+    console.error = (...values: unknown[]) => errors.push(values.join(" "));
     const fetchImpl: typeof fetch = async input => {
       const path = new URL(String(input)).pathname;
       requests.push(path);
       if (path.endsWith("/stage") && !path.endsWith("/finish")) {
-        return Response.json({ stageId: "33333333-3333-4333-8333-333333333333", stagingCodexHome: stagingHome });
+        return Response.json({ stageId: "33333333-3333-4333-8333-333333333333", stagingCodexHome: stagingHome, effectiveCodexHome: effectiveHome });
       }
       return Response.json({ ok: true });
     };
@@ -179,5 +230,6 @@ describe("ocx account main", () => {
       "/api/native-main-profiles/stage",
       "/api/native-main-profiles/stage/cancel",
     ]);
+    expect(errors).toContain(`Effective CODEX_HOME: ${effectiveHome}`);
   });
 });

From 05bea5a205a149643fda5676ead2cfe6d76a620c Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Mon, 3 Aug 2026 10:13:50 +0900
Subject: [PATCH 44/63] fix(cli): use configured Codex runtime for profile
 login

---
 src/cli/account-main.ts          | 18 ++++++++--
 tests/cli-native-profile.test.ts | 62 +++++++++++++++++++++++++++-----
 2 files changed, 69 insertions(+), 11 deletions(-)

diff --git a/src/cli/account-main.ts b/src/cli/account-main.ts
index 7a6665279..2809c266f 100644
--- a/src/cli/account-main.ts
+++ b/src/cli/account-main.ts
@@ -1,5 +1,6 @@
 import { isAbsolute } from "node:path";
 import { codexExecInvocation } from "../codex/exec-invocation";
+import { resolveAndPersistCodexRuntime, type ResolveCodexRuntimeDeps } from "../codex/runtime";
 import type { ResolveDeps, SpawnInvocation } from "../lib/win-exec";
 import { apiError, apiJson, proxyUnreachable, resolveBaseUrl, type AccountDeps } from "./account-api";
 
@@ -21,6 +22,10 @@ interface PublicProfile {
   state: "active" | "inactive";
 }
 
+export type NativeMainCodexLoginInvocationDeps =
+  & ResolveDeps
+  & Pick<ResolveCodexRuntimeDeps, "existsSync" | "execFileSync" | "configDir" | "readFileSync">;
+
 function flag(args: string[], name: string): boolean {
   const index = args.indexOf(name);
   if (index < 0) return false;
@@ -51,9 +56,18 @@ function printProfiles(profiles: PublicProfile[]): void {
 
 export function nativeMainCodexLoginInvocation(
   platform: NodeJS.Platform = process.platform,
-  deps: ResolveDeps = {},
+  deps: NativeMainCodexLoginInvocationDeps = {},
 ): SpawnInvocation {
-  return codexExecInvocation("codex", ["login"], platform, deps);
+  const command = resolveAndPersistCodexRuntime({
+    env: deps.env ?? process.env,
+    platform,
+    existsSync: deps.existsSync,
+    execFileSync: deps.execFileSync,
+    configDir: deps.configDir,
+    readFileSync: deps.readFileSync,
+    discoverAlternatives: false,
+  }).runtime.command || "codex";
+  return codexExecInvocation(command, ["login"], platform, deps);
 }
 
 async function runOfficialCodexLogin(codexHome: string): Promise<number> {
diff --git a/tests/cli-native-profile.test.ts b/tests/cli-native-profile.test.ts
index 66572657f..2cf490ee9 100644
--- a/tests/cli-native-profile.test.ts
+++ b/tests/cli-native-profile.test.ts
@@ -1,4 +1,5 @@
 import { afterEach, describe, expect, test } from "bun:test";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { tmpdir } from "node:os";
 import { cmdAccount } from "../src/cli/account";
@@ -8,12 +9,20 @@ import { nativeMainCodexLoginInvocation } from "../src/cli/account-main";
 const originalLog = console.log;
 const originalError = console.error;
 const originalCodexHome = process.env.CODEX_HOME;
+const tempRoots: string[] = [];
+
+function tempConfigDir(prefix: string): string {
+  const path = mkdtempSync(join(tmpdir(), prefix));
+  tempRoots.push(path);
+  return path;
+}
 
 afterEach(() => {
   console.log = originalLog;
   console.error = originalError;
   if (originalCodexHome === undefined) delete process.env.CODEX_HOME;
   else process.env.CODEX_HOME = originalCodexHome;
+  while (tempRoots.length > 0) rmSync(tempRoots.pop()!, { recursive: true, force: true });
 });
 
 describe("ocx account main", () => {
@@ -32,25 +41,60 @@ describe("ocx account main", () => {
     expect(errors.at(-1)).toBe("Warning: native-login staging cleanup is still required; run 'ocx account main doctor'.");
   });
 
-  test("official login resolves a Windows npm shim through ComSpec", () => {
-    const npmBin = "C:\\Users\\tester\\AppData\\Roaming\\npm";
-    const codexShim = `${npmBin}\\codex.cmd`;
+  test("official login honors an explicit Windows runtime outside PATH through ComSpec", () => {
+    const codexShim = "C:\\Portable Codex\\codex.cmd";
+    const comSpec = "C:\\Windows\\System32\\cmd.exe";
+    const env = {
+      CODEX_CLI_PATH: codexShim,
+      PATH: "",
+      PATHEXT: ".CMD",
+      ComSpec: comSpec,
+    };
     const invocation = nativeMainCodexLoginInvocation("win32", {
-      env: {
-        PATH: npmBin,
-        PATHEXT: ".CMD",
-        ComSpec: "C:\\Windows\\System32\\cmd.exe",
-      },
+      env,
       exists: path => path.toLowerCase() === codexShim.toLowerCase(),
+      existsSync: path => path.toLowerCase() === codexShim.toLowerCase(),
+      execFileSync: (file, args) => {
+        expect(file).toBe(comSpec);
+        expect(args.at(-1)).toContain("codex.cmd");
+        return "codex-cli 9.9.9";
+      },
+      configDir: tempConfigDir("ocx-native-profile-explicit-runtime-"),
     });
 
-    expect(invocation.file).toBe("C:\\Windows\\System32\\cmd.exe");
+    expect(invocation.file).toBe(comSpec);
     expect(invocation.args.slice(0, 3)).toEqual(["/d", "/s", "/c"]);
     expect(invocation.args[3]).toContain("codex.cmd");
     expect(invocation.args[3]).toContain('^"login^"');
     expect(invocation.options).toEqual({ windowsVerbatimArguments: true });
   });
 
+  test("official login honors a persisted runtime outside PATH", () => {
+    const runtime = "C:\\Portable Codex\\codex.exe";
+    const configDir = tempConfigDir("ocx-native-profile-persisted-runtime-");
+    writeFileSync(join(configDir, "codex-runtime.json"), `${JSON.stringify({
+      version: 1,
+      command: runtime,
+      source: "configured",
+      selectedVersion: "8.8.8",
+      updatedAt: "2026-08-03T00:00:00.000Z",
+    })}\n`);
+
+    const invocation = nativeMainCodexLoginInvocation("win32", {
+      env: { PATH: "", PATHEXT: ".EXE" },
+      exists: path => path.toLowerCase() === runtime.toLowerCase(),
+      existsSync: path => path.toLowerCase() === runtime.toLowerCase(),
+      execFileSync: (file, args) => {
+        expect(file).toBe(runtime);
+        expect(args).toEqual(["--version"]);
+        return "codex-cli 8.8.8";
+      },
+      configDir,
+    });
+
+    expect(invocation).toEqual({ file: runtime, args: ["login"], options: {} });
+  });
+
   test("mutating human output uses the server's effective home while add keeps the auth envelope off HTTP", async () => {
     const stagingHome = join(tmpdir(), "ocx-native-profile-stage");
     const effectiveHome = join(tmpdir(), "ocx-native-profile-effective-home");

From 1d811b81a331a283d7192c1bb51ccef3f4904958 Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Mon, 3 Aug 2026 11:33:16 +0900
Subject: [PATCH 45/63] test(codex): accept removed scrubbed stage auth

---
 tests/native-profile-manager.test.ts | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/tests/native-profile-manager.test.ts b/tests/native-profile-manager.test.ts
index c733c7ffb..41800207c 100644
--- a/tests/native-profile-manager.test.ts
+++ b/tests/native-profile-manager.test.ts
@@ -580,7 +580,8 @@ describe("native main profile transactions", () => {
     expect((caught as NativeProfileError).cleanupRequired).toBeUndefined();
     expect((await manager.list()).profiles.some(profile => profile.label === "work")).toBe(true);
     expect(existsSync(stage.stagingCodexHome)).toBe(true);
-    expect(readFileSync(join(stage.stagingCodexHome, "auth.json"), "utf8")).toBe("");
+    const authPath = join(stage.stagingCodexHome, "auth.json");
+    expect(!existsSync(authPath) || readFileSync(authPath, "utf8") === "").toBe(true);
     await manager.cancelStage(stage.stageId);
   });
 
@@ -602,7 +603,8 @@ describe("native main profile transactions", () => {
     expect((caught as NativeProfileError).retryable).toBe(false);
     expect((caught as NativeProfileError).cleanupRequired).toBe(true);
     expect(existsSync(stage.stagingCodexHome)).toBe(true);
-    expect(readFileSync(join(stage.stagingCodexHome, "auth.json"), "utf8")).toBe("");
+    const authPath = join(stage.stagingCodexHome, "auth.json");
+    expect(!existsSync(authPath) || readFileSync(authPath, "utf8") === "").toBe(true);
     await manager.cancelStage(stage.stageId);
   });
 
@@ -630,7 +632,8 @@ describe("native main profile transactions", () => {
       stagingSweep: "cleanup-required",
       stagingCount: 1,
     });
-    expect(readFileSync(join(stage.stagingCodexHome, "auth.json"), "utf8")).toBe("");
+    const authPath = join(stage.stagingCodexHome, "auth.json");
+    expect(!existsSync(authPath) || readFileSync(authPath, "utf8") === "").toBe(true);
     await manager.cancelStage(stage.stageId);
     writeFileSync(manager.context.vaultPath, "{invalid-json\n");
     expect(await manager.doctor()).toMatchObject({

From 88e3cb7c136f8853624639b62792d398c2aa725e Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Mon, 3 Aug 2026 11:57:40 +0900
Subject: [PATCH 46/63] test(codex): await native-main server lifecycle

---
 tests/chat-completions-endpoint.test.ts    | 32 ++++++-------
 tests/claude-529-mapping.test.ts           |  6 +--
 tests/claude-management-api.test.ts        | 52 +++++++++++-----------
 tests/claude-messages-endpoint.test.ts     | 37 ++++++++-------
 tests/claude-models-discovery.test.ts      | 10 ++---
 tests/claude-native-passthrough.test.ts    | 20 ++++-----
 tests/grok-management-api.test.ts          | 14 +++---
 tests/native-profile-drain-server.test.ts  |  1 +
 tests/server-auth.test.ts                  |  6 ++-
 tests/server-key-failover-e2e.test.ts      | 10 ++---
 tests/server-kiro-completion-e2e.test.ts   |  4 +-
 tests/server-kiro-oauth-401-replay.test.ts | 10 ++---
 tests/server-xai-oauth-401-replay.test.ts  |  8 ++--
 tests/vision-sidecar-e2e.test.ts           |  4 +-
 14 files changed, 111 insertions(+), 103 deletions(-)

diff --git a/tests/chat-completions-endpoint.test.ts b/tests/chat-completions-endpoint.test.ts
index 6ff7b98e7..fd7e1257a 100644
--- a/tests/chat-completions-endpoint.test.ts
+++ b/tests/chat-completions-endpoint.test.ts
@@ -1,3 +1,4 @@
+import { waitForNativeMainStartupGate } from "../src/codex/native-profile-startup";
 import { afterEach, beforeEach, expect, test } from "bun:test";
 import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
@@ -298,7 +299,7 @@ test("POST /v1/chat/completions streams OpenAI-shaped chunks end to end", async
     expect(text).toContain("data: [DONE]");
     expect(text).toContain("\"finish_reason\":\"stop\"");
   } finally {
-    server.stop(true);
+    await server.stop(true);
     upstream.stop(true);
   }
 });
@@ -329,7 +330,7 @@ test("non-streaming /v1/chat/completions returns chat.completion JSON", async ()
     expect(json.choices[0]?.message.content).toContain("Hello");
     expect(json.choices[0]?.finish_reason).toBe("stop");
   } finally {
-    server.stop(true);
+    await server.stop(true);
     upstream.stop(true);
   }
 });
@@ -347,7 +348,7 @@ test("GET /v1/models returns OpenAI list shape for Copilot App discovery", async
     // Routed mock model may or may not appear depending on liveModels; list shape is the contract.
     expect(json.data.every(m => m.object === "model" && typeof m.id === "string")).toBe(true);
   } finally {
-    server.stop(true);
+    await server.stop(true);
     upstream.stop(true);
   }
 });
@@ -367,7 +368,7 @@ test("invalid chat completions body returns OpenAI-style 400", async () => {
     expect(json.error.message).toContain("model");
     expect(json.error.type).toBe("invalid_request_error");
   } finally {
-    server.stop(true);
+    await server.stop(true);
     upstream.stop(true);
   }
 });
@@ -480,7 +481,7 @@ test("POST /v1/chat/completions rejects response_format for routed openai-chat",
     expect(json.error.message).toContain("response_format");
     expect(json.error.type).toBe("invalid_request_error");
   } finally {
-    server.stop(true);
+    await server.stop(true);
     upstream.stop(true);
   }
 });
@@ -538,7 +539,7 @@ test("POST /v1/chat/completions direct mode forwards caller Authorization", asyn
     expect(response.status).toBe(200);
     expect(seen.some(hit => hit.authorization === ["Bear" + "er", "caller-direct-token"].join(" "))).toBe(true);
   } finally {
-    server.stop(true);
+    await server.stop(true);
     upstream.stop(true);
     globalThis.fetch = originalFetch;
   }
@@ -584,6 +585,7 @@ test("Chat main-token replay owns native main through the stream and rejects pos
   });
   let drain: ReturnType<typeof acquireNativeMainProfileDrain> = null;
   try {
+    await waitForNativeMainStartupGate();
     const pending = request();
     await started;
     const response = await pending;
@@ -602,7 +604,7 @@ test("Chat main-token replay owns native main through the stream and rejects pos
   } finally {
     drain?.release();
     finishUpstream?.();
-    server.stop(true);
+    await server.stop(true);
     upstream.stop(true);
     resetLifecycleDrainStateForTests();
   }
@@ -667,7 +669,7 @@ test("POST /v1/chat/completions finalizes native passthrough request logs", asyn
     expect(entry).toBeTruthy();
     expect(entry?.status).toBe(200);
   } finally {
-    server.stop(true);
+    await server.stop(true);
     upstream.stop(true);
     globalThis.fetch = originalFetch;
     clearRequestLogsForTests();
@@ -968,7 +970,7 @@ test("non-streaming /v1/chat/completions returns error status on upstream failur
     expect(json.error?.message ?? "").toContain("provider blew up");
     expect(json.choices).toBeUndefined();
   } finally {
-    server.stop(true);
+    await server.stop(true);
     upstream.stop(true);
     globalThis.fetch = originalFetch;
   }
@@ -1029,7 +1031,7 @@ test("streaming /v1/chat/completions does not clean-DONE after response.failed",
     expect(text).not.toContain("[error]");
     expect(text).not.toContain("data: [DONE]");
   } finally {
-    server.stop(true);
+    await server.stop(true);
     upstream.stop(true);
     globalThis.fetch = originalFetch;
   }
@@ -1357,7 +1359,7 @@ test("an overridden model reaches the responses wire with its hosted tool intact
     // And the hosted tool survived — the chat translation would have dropped it.
     expect(JSON.stringify(captured[0]!.body)).toContain("web_search");
   } finally {
-    server.stop(true);
+    await server.stop(true);
     upstream.stop(true);
   }
 });
@@ -1382,7 +1384,7 @@ test("a sibling model on the same provider still takes the chat wire (#404)", as
     expect(captured.length).toBe(1);
     expect(captured[0]!.pathname).toContain("/chat/completions");
   } finally {
-    server.stop(true);
+    await server.stop(true);
     upstream.stop(true);
   }
 });
@@ -1409,7 +1411,7 @@ test("inbound chat-completions honors the override when stripping sampling (#404
     // The inbound path must read the effective adapter, not the provider default.
     expect(captured[0]!.pathname).toContain("/responses");
   } finally {
-    server.stop(true);
+    await server.stop(true);
     upstream.stop(true);
   }
 });
@@ -1471,7 +1473,7 @@ test("/v1/chat/completions non-OK upstream preserves structured model_not_found"
       message: "Request failed",
     });
   } finally {
-    server.stop(true);
+    await server.stop(true);
     upstream.stop(true);
     globalThis.fetch = originalFetch;
   }
@@ -1598,7 +1600,7 @@ test("/v1/chat/completions status:failed replay preserves structured model_not_f
       message: "Request failed",
     });
   } finally {
-    server.stop(true);
+    await server.stop(true);
     upstream.stop(true);
     globalThis.fetch = originalFetch;
   }
diff --git a/tests/claude-529-mapping.test.ts b/tests/claude-529-mapping.test.ts
index b3626b893..ce70dd633 100644
--- a/tests/claude-529-mapping.test.ts
+++ b/tests/claude-529-mapping.test.ts
@@ -78,7 +78,7 @@ test("transient upstream 502 -> client 529 overloaded_error; retry fired; log ke
     const entry = getRequestLogEntries().findLast(e => e.surface === "claude");
     expect(entry?.status).toBe(502);
   } finally {
-    server.stop(true);
+    await server.stop(true);
     upstream.stop(true);
   }
 }, 15_000);
@@ -101,7 +101,7 @@ test("transient 502 without Retry-After -> fallback Retry-After 2 on the 529 res
     expect(response.status).toBe(529);
     expect(response.headers.get("retry-after")).toBe("2");
   } finally {
-    server.stop(true);
+    await server.stop(true);
     upstream.stop(true);
   }
 }, 15_000);
@@ -128,7 +128,7 @@ test("non-transient upstream 400 stays 400 invalid_request_error; no retry", asy
     const json = await response.json() as { error?: { type?: string } };
     expect(json.error?.type).toBe("invalid_request_error");
   } finally {
-    server.stop(true);
+    await server.stop(true);
     upstream.stop(true);
   }
 });
diff --git a/tests/claude-management-api.test.ts b/tests/claude-management-api.test.ts
index 0195c1f5a..4286deeac 100644
--- a/tests/claude-management-api.test.ts
+++ b/tests/claude-management-api.test.ts
@@ -73,7 +73,7 @@ test("GET /api/claude-code returns defaults + available + aliases", async () =>
     expect(d.aliases.some((a: { id: string }) => a.id === "claude-ocx-mock--test-model")).toBe(true);
     expect(typeof d.port).toBe("number");
   } finally {
-    server.stop(true);
+    await server.stop(true);
   }
 });
 
@@ -119,7 +119,7 @@ test("PUT round-trips settings and persists to config", async () => {
     expect(after.claudeCode?.smallFastModel).toBe("mock/test-model");
     expect(after.claudeCode?.enabled).toBe(false);
   } finally {
-    server.stop(true);
+    await server.stop(true);
   }
 });
 
@@ -164,7 +164,7 @@ test("PUT round-trips three-state authMode (devlog 260720 + 260726_claude_auth_a
     get = await fetch(new URL("/api/claude-code", server.url)).then(r => r.json()) as Record<string, unknown>;
     expect(get.authMode).toBe("auto");
   } finally {
-    server.stop(true);
+    await server.stop(true);
   }
 });
 
@@ -178,7 +178,7 @@ test("GET exposes the resolved marker mode and its provenance", async () => {
     // The badge must say it is daemon-side: a terminal-exported key is invisible here.
     expect(get.detectionScope).toBe("daemon");
   } finally {
-    server.stop(true);
+    await server.stop(true);
   }
 });
 
@@ -198,7 +198,7 @@ test("an unrelated PUT leaves an auto config on auto", async () => {
     const get = await fetch(new URL("/api/claude-code", server.url)).then(r => r.json()) as Record<string, unknown>;
     expect(get.authMode).toBe("auto");
   } finally {
-    server.stop(true);
+    await server.stop(true);
   }
 });
 
@@ -218,7 +218,7 @@ test("auto survives a restart instead of being migrated back to subscription", a
     expect(put.status).toBe(200);
     expect(loadConfig().claudeCode?.authMode).toBeUndefined();
   } finally {
-    first.stop(true);
+    await first.stop(true);
   }
 
   // A restart runs the startup migration against what the PUT persisted.
@@ -228,7 +228,7 @@ test("auto survives a restart instead of being migrated back to subscription", a
     const get = await fetch(new URL("/api/claude-code", second.url)).then(r => r.json()) as Record<string, unknown>;
     expect(get.authMode).toBe("auto");
   } finally {
-    second.stop(true);
+    await second.stop(true);
   }
 });
 
@@ -243,13 +243,13 @@ test("toggling Claude on does not pin a fresh install to subscription", async ()
       body: JSON.stringify({ enabled: true }),
     });
   } finally {
-    first.stop(true);
+    await first.stop(true);
   }
   const second = startServer(0);
   try {
     expect(loadConfig().claudeCode?.authMode).toBeUndefined();
   } finally {
-    second.stop(true);
+    await second.stop(true);
   }
 });
 
@@ -263,7 +263,7 @@ test("PUT rejects an unknown authMode value", async () => {
     });
     expect(bad.status).toBe(400);
   } finally {
-    server.stop(true);
+    await server.stop(true);
   }
 });
 
@@ -280,7 +280,7 @@ test("PUT rejects invalid authMode values (invalid string + non-string)", async
     }
     expect(loadConfig().claudeCode?.authMode).toBeUndefined();
   } finally {
-    server.stop(true);
+    await server.stop(true);
   }
 });
 
@@ -297,7 +297,7 @@ test("authMode-only PUT triggers system-env reconciliation (audit R2 #1)", async
     expect(applySpy).toHaveBeenCalled();
   } finally {
     applySpy.mockRestore();
-    server.stop(true);
+    await server.stop(true);
   }
 });
 
@@ -359,7 +359,7 @@ test("Claude sidecar overrides round-trip, partially update, clear, and reject u
       expect(loadConfig().claudeCode).toEqual(beforeInvalid);
     }
   } finally {
-    server.stop(true);
+    await server.stop(true);
   }
 });
 
@@ -399,7 +399,7 @@ test("PUT immediately restores generated agents after re-enable and roster chang
     expect(roster.status).toBe(200);
     expect(readdirSync(agentsDir)).toEqual(["ocx-gpt-5-6-terra.md"]);
   } finally {
-    server.stop(true);
+    await server.stop(true);
   }
 });
 
@@ -431,7 +431,7 @@ test("PUT/GET round-trips the context/effort levers (devlog 136 B6)", async () =
     expect(persisted.claudeCode?.maxContextTokens).toBeUndefined();
     expect(persisted.claudeCode?.alwaysEnableEffort).toBeUndefined();
   } finally {
-    server.stop(true);
+    await server.stop(true);
   }
 });
 
@@ -471,7 +471,7 @@ test("PUT/GET round-trips auto-context (devlog 260712 020)", async () => {
     expect(persisted.claudeCode?.autoCompactWindow).toBeUndefined();
     expect(persisted.claudeCode?.blockedSkills).toBeUndefined();
   } finally {
-    server.stop(true);
+    await server.stop(true);
   }
 });
 
@@ -509,7 +509,7 @@ test("PUT/GET round-trips tierModels and GET exposes contextWindows + effectiveM
     });
     expect(bad.status).toBe(400);
   } finally {
-    server.stop(true);
+    await server.stop(true);
   }
 });
 
@@ -549,7 +549,7 @@ test("PUT validation rejects bad shapes", async () => {
     }
     expect(loadConfig().claudeCode).toBeUndefined(); // nothing persisted on rejects
   } finally {
-    server.stop(true);
+    await server.stop(true);
   }
 });
 
@@ -562,7 +562,7 @@ test("GET /api/claude-code reports Auto-connect support on Darwin", async () =>
     const d = await r.json() as Record<string, any>;
     expect(d.autoConnectSupported).toBe(true);
   } finally {
-    server.stop(true);
+    await server.stop(true);
   }
 });
 
@@ -580,7 +580,7 @@ test("GET /api/claude-code reports Auto-connect unsupported outside Darwin", asy
     expect(d.systemEnv).toBe(true);              // raw stored preference
     expect(d.autoConnectSupported).toBe(false);  // effective capability
   } finally {
-    server.stop(true);
+    await server.stop(true);
   }
 });
 
@@ -618,7 +618,7 @@ test("Claude Desktop profile GET, PUT and apply round-trip four-family assignmen
     const appliedConfig = JSON.parse(readFileSync(result.path, "utf8")) as { inferenceGatewayBaseUrl: string };
     expect(appliedConfig.inferenceGatewayBaseUrl).toBe(new URL(server.url).origin);
   } finally {
-    server.stop(true);
+    await server.stop(true);
   }
 });
 
@@ -651,7 +651,7 @@ test("Claude Desktop apply installs the alias registry in the serving process (#
     const alias = activeDesktop3pAlias("unique859", "test-model-x");
     expect(resolveDesktop3pAlias(alias)).toBe("unique859/test-model-x");
   } finally {
-    server.stop(true);
+    await server.stop(true);
   }
 });
 
@@ -683,7 +683,7 @@ test("Claude Desktop apply honors the profile in the request body over daemon-st
     });
     expect(badProfile.status).toBe(400);
   } finally {
-    server.stop(true);
+    await server.stop(true);
   }
 });
 
@@ -707,7 +707,7 @@ test("Claude Desktop apply validates the mode body", async () => {
     const written = JSON.parse(readFileSync(result.path, "utf8")) as { modelDiscoveryEnabled: boolean };
     expect(written.modelDiscoveryEnabled).toBe(true);
   } finally {
-    server.stop(true);
+    await server.stop(true);
   }
 });
 
@@ -723,7 +723,7 @@ test("Claude Desktop PUT rejects invalid JSON profile without mutating saved con
     expect(put.status).toBe(400);
     expect(loadConfig()).toEqual(before);
   } finally {
-    server.stop(true);
+    await server.stop(true);
   }
 });
 
@@ -756,6 +756,6 @@ test("Claude Desktop PUT retains but cannot move an unavailable route", async ()
     expect((await put.json() as { error: string }).error).toContain("사용할 수 없는 모델");
     expect(loadConfig().claudeCode?.desktopProfile?.assignments["missing/old-model"]?.family).toBe("opus");
   } finally {
-    server.stop(true);
+    await server.stop(true);
   }
 });
diff --git a/tests/claude-messages-endpoint.test.ts b/tests/claude-messages-endpoint.test.ts
index b684a3212..0b27fef9b 100644
--- a/tests/claude-messages-endpoint.test.ts
+++ b/tests/claude-messages-endpoint.test.ts
@@ -1,3 +1,4 @@
+import { waitForNativeMainStartupGate } from "../src/codex/native-profile-startup";
 import { afterEach, beforeEach, expect, test } from "bun:test";
 import { managementFetch as fetch } from "./helpers/management-auth";
 import { logsFromApiBody } from "./helpers/logs-api";
@@ -145,7 +146,7 @@ test("POST /v1/messages?beta=true streams an Anthropic-shaped turn end to end",
     expect(codexUsage.surface).toBe("codex");
     expect(codexUsage.summary.requests).toBe(0);
   } finally {
-    server.stop(true);
+    await server.stop(true);
     upstream.stop(true);
   }
 }, { timeout: SERVER_BUDGET_MS });
@@ -174,7 +175,7 @@ test("non-streaming /v1/messages returns an Anthropic message JSON", async () =>
     expect(json.content[0].text).toContain("Hello");
     expect(typeof json.usage.input_tokens).toBe("number");
   } finally {
-    server.stop(true);
+    await server.stop(true);
     upstream.stop(true);
   }
 });
@@ -225,7 +226,7 @@ test("native generated-agent passthrough preserves legacy thinking", async () =>
     });
     expect(captured).not.toHaveProperty("output_config");
   } finally {
-    server.stop(true);
+    await server.stop(true);
     upstream.stop(true);
   }
 });
@@ -267,7 +268,7 @@ test("native Anthropic passthrough clears the header deadline before streaming t
     expect(response.status).toBe(200);
     expect(await response.text()).toContain("message_stop");
   } finally {
-    server.stop(true);
+    await server.stop(true);
     upstream.stop(true);
   }
 });
@@ -347,7 +348,7 @@ test("native Anthropic passthrough returns 502 when the upstream connection is r
     expect(json.error?.type).toBe("api_error");
     expect(String(json.error?.message)).toContain("anthropic passthrough failed");
   } finally {
-    server.stop(true);
+    await server.stop(true);
   }
 });
 
@@ -551,7 +552,7 @@ test("endpoint wiring: configured bodyStallSec bounds a stalled native passthrou
     expect(text).toContain("event: error");
     expect(text).toContain("timeout_error");
   } finally {
-    server.stop(true);
+    await server.stop(true);
     upstream.stop(true);
   }
 });
@@ -607,7 +608,7 @@ test("native openai-responses route carries prompt_cache_key + synthesized sessi
     expect(capture.body?.reasoning?.effort).toBe("high");
     expect(capture.headers?.["session_id"]).toMatch(/^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-8[0-9a-f]{3}-[0-9a-f]{12}$/);
   } finally {
-    server.stop(true);
+    await server.stop(true);
     upstream.stop(true);
   }
 });
@@ -643,6 +644,7 @@ test("Claude main-token replay owns native main through the stream and rejects p
   const server = startServer(0);
   let drain: ReturnType<typeof acquireNativeMainProfileDrain> = null;
   try {
+    await waitForNativeMainStartupGate();
     const pending = postMessages(server.url.toString(), {
       model: "mock/test-model",
       max_tokens: 64,
@@ -671,7 +673,7 @@ test("Claude main-token replay owns native main through the stream and rejects p
   } finally {
     drain?.release();
     finishUpstream?.();
-    server.stop(true);
+    await server.stop(true);
     upstream.stop(true);
     resetLifecycleDrainStateForTests();
   }
@@ -774,6 +776,7 @@ test("routed Claude requests give OpenAI sidecars main auth without leaking it t
     }],
   };
   try {
+    await waitForNativeMainStartupGate();
     const authenticated = await postMessages(server.url.toString(), requestBody);
     expect(authenticated.status).toBe(200);
     await authenticated.text();
@@ -804,7 +807,7 @@ test("routed Claude requests give OpenAI sidecars main auth without leaking it t
     expect(noLoginBody).toContain("[image omitted: this model is text-only and the vision sidecar is unavailable (no ChatGPT login)]");
     expect(noLoginBody).not.toContain(imageBytes);
   } finally {
-    server.stop(true);
+    await server.stop(true);
     forward.stop(true);
     routed.stop(true);
   }
@@ -826,7 +829,7 @@ test("bad body -> Anthropic-shaped 400; unknown /v1 path guard intact", async ()
     const unknown = await fetch(new URL("/v1/does-not-exist", server.url), { method: "POST" });
     expect(unknown.status).toBe(404);
   } finally {
-    server.stop(true);
+    await server.stop(true);
   }
 });
 
@@ -849,7 +852,7 @@ test("count_tokens returns a positive estimate in the exact contract shape", asy
     expect(Object.keys(json)).toEqual(["input_tokens"]);
     expect(json.input_tokens as number).toBeGreaterThan(0);
   } finally {
-    server.stop(true);
+    await server.stop(true);
   }
 });
 
@@ -868,7 +871,7 @@ test("claudeCode.enabled=false -> 403 permission_error on both routes", async ()
       expect(json.error.type).toBe("permission_error");
     }
   } finally {
-    server.stop(true);
+    await server.stop(true);
   }
 });
 
@@ -901,7 +904,7 @@ test("effort safety valve: routes with a definitive no-effort ladder get reasoni
     expect(captured.length).toBe(1);
     expect(captured[0]!.reasoning_effort).toBeUndefined();
   } finally {
-    server.stop(true);
+    await server.stop(true);
     upstream.stop(true);
   }
 });
@@ -931,7 +934,7 @@ test("generated agent effort directive restores exact xhigh and max after Claude
       { model: "test-model", effort: "max" },
     ]);
   } finally {
-    server.stop(true);
+    await server.stop(true);
     upstream.stop(true);
   }
 });
@@ -954,7 +957,7 @@ test("unknown-ladder routes keep the requested effort (no false stripping)", asy
     expect(captured.length).toBe(1);
     expect(captured[0]!.reasoning_effort).toBe("low");
   } finally {
-    server.stop(true);
+    await server.stop(true);
     upstream.stop(true);
   }
 });
@@ -975,7 +978,7 @@ test("defensive [1m] strip: a leaked context-variant marker still routes to the
     expect(captured.length).toBe(1);
     expect(captured[0]!.model).toBe("test-model");
   } finally {
-    server.stop(true);
+    await server.stop(true);
     upstream.stop(true);
   }
 });
@@ -997,6 +1000,6 @@ test("count_tokens is CJK-aware: Korean body counts more tokens than equal-lengt
     expect(korean.length).toBe(english.length);
     expect(await count(korean)).toBeGreaterThan(await count(english));
   } finally {
-    server.stop(true);
+    await server.stop(true);
   }
 });
diff --git a/tests/claude-models-discovery.test.ts b/tests/claude-models-discovery.test.ts
index 159887314..7bb0cc26b 100644
--- a/tests/claude-models-discovery.test.ts
+++ b/tests/claude-models-discovery.test.ts
@@ -78,7 +78,7 @@ test("anthropic-version header flips /v1/models to the discovery contract", asyn
     // Contract shape only: no OpenAI list fields on the top level.
     expect((json as Record<string, unknown>).object).toBeUndefined();
   } finally {
-    server.stop(true);
+    await server.stop(true);
   }
 });
 
@@ -91,7 +91,7 @@ test("?flavor=anthropic works without the header; disabled -> empty data", async
     const { desktop3pAlias } = await import("../src/claude/desktop-3p");
     expect(json.data.some(m => m.id === desktop3pAlias("mock", "other-model"))).toBe(true);
   } finally {
-    server.stop(true);
+    await server.stop(true);
   }
 
   saveConfig(configWithStaticModels({ enabled: false }));
@@ -101,7 +101,7 @@ test("?flavor=anthropic works without the header; disabled -> empty data", async
     const json = await response.json() as { data: unknown[] };
     expect(json.data).toEqual([]);
   } finally {
-    server.stop(true);
+    await server.stop(true);
   }
 });
 
@@ -130,7 +130,7 @@ test("per-surface id style: ?ids= wins, claude-code UA gets readable, unknown UA
     }).then(r => r.json()) as { data: { id: string }[] };
     expect(json.data.some(m => m.id === readable)).toBe(false);
   } finally {
-    server.stop(true);
+    await server.stop(true);
   }
 });
 
@@ -152,6 +152,6 @@ test("OpenAI list shape and Codex catalog shape stay unchanged", async () => {
     expect(Array.isArray(codexJson.models)).toBe(true);
     expect(codexJson.data).toBeUndefined();
   } finally {
-    server.stop(true);
+    await server.stop(true);
   }
 });
diff --git a/tests/claude-native-passthrough.test.ts b/tests/claude-native-passthrough.test.ts
index 0fd82b427..f64c4c948 100644
--- a/tests/claude-native-passthrough.test.ts
+++ b/tests/claude-native-passthrough.test.ts
@@ -143,7 +143,7 @@ test("unmapped claude model + sk-ant credential passes through verbatim", async
     expect(codexUsage.surface).toBe("codex");
     expect(codexUsage.summary.requests).toBe(0);
   } finally {
-    server.stop(true);
+    await server.stop(true);
     upstream.stop(true);
   }
 });
@@ -177,7 +177,7 @@ test("native passthrough persists conversationId from metadata.user_id", async (
     expect(logs[0]?.provider).toBe("anthropic-native");
     expect(logs[0]?.conversationId).toBe(createHash("sha256").update(userId).digest("hex").slice(0, 32));
   } finally {
-    server.stop(true);
+    await server.stop(true);
     upstream.stop(true);
   }
 });
@@ -200,7 +200,7 @@ test("count_tokens passes through with native credentials", async () => {
     expect(captured[0].path).toBe("/v1/messages/count_tokens");
     expect(captured[0].headers.get("x-api-key")).toBe("sk-ant-api03-key");
   } finally {
-    server.stop(true);
+    await server.stop(true);
     upstream.stop(true);
   }
 });
@@ -237,7 +237,7 @@ test("alias/mapped models and non-anthropic credentials do NOT pass through", as
 
     expect(captured).toHaveLength(0); // the anthropic upstream never saw any of them
   } finally {
-    server.stop(true);
+    await server.stop(true);
     upstream.stop(true);
   }
 });
@@ -256,7 +256,7 @@ test("nativePassthrough:false disables the pierce", async () => {
     expect(res.status).not.toBe(200);
     expect(captured).toHaveLength(0);
   } finally {
-    server.stop(true);
+    await server.stop(true);
     upstream.stop(true);
   }
 });
@@ -322,7 +322,7 @@ test("P1: 30-image history arrives age-tiered — newest pass through, older shr
       expect(images[i].source?.data).toBe(src);
     }
   } finally {
-    server.stop(true);
+    await server.stop(true);
     upstream.stop(true);
   }
 });
@@ -341,7 +341,7 @@ test("P2: dimension-oversized image is re-encoded (normalized), not dropped", as
     const d = sniffImageDimensions(img.source?.data ?? "");
     expect(Math.max(d!.width, d!.height)).toBeLessThanOrEqual(2000);
   } finally {
-    server.stop(true);
+    await server.stop(true);
     upstream.stop(true);
   }
 });
@@ -359,7 +359,7 @@ test("P2b: 101 images trip the guard's 100-cap — exactly one oldest textified"
     expect(blocks.filter(b => b.type === "image")).toHaveLength(100);
     expect(blocks.filter(b => b.type === "text").length).toBeGreaterThanOrEqual(2); // original text + 1 omitted note
   } finally {
-    server.stop(true);
+    await server.stop(true);
     upstream.stop(true);
   }
 });
@@ -378,7 +378,7 @@ test("P4: count_tokens body is normalized identically to the real send", async (
     const [img] = capturedBlocks(captured).filter(b => b.type === "image");
     expect(img.source?.media_type).toBe("image/jpeg");
   } finally {
-    server.stop(true);
+    await server.stop(true);
     upstream.stop(true);
   }
 });
@@ -396,7 +396,7 @@ test("P5: Files API image source passes through untouched", async () => {
     const [img] = capturedBlocks(captured).filter(b => b.type === "image");
     expect(img.source).toEqual({ type: "file", file_id: "file_abc123" });
   } finally {
-    server.stop(true);
+    await server.stop(true);
     upstream.stop(true);
   }
 });
diff --git a/tests/grok-management-api.test.ts b/tests/grok-management-api.test.ts
index 428969dff..6efe5cd6f 100644
--- a/tests/grok-management-api.test.ts
+++ b/tests/grok-management-api.test.ts
@@ -113,7 +113,7 @@ test("PUT /api/grok/selection rejects a non-array body", async () => {
     });
     expect(res.status).toBe(400);
   } finally {
-    server.stop(true);
+    await server.stop(true);
   }
 });
 
@@ -130,7 +130,7 @@ test("PUT /api/grok/selection dedupes, sorts, and persists", async () => {
     expect(body.excluded).toEqual(["a", "b"]);
     expect(loadConfig().grokExcludedModels).toEqual(["a", "b"]);
   } finally {
-    server.stop(true);
+    await server.stop(true);
   }
 });
 
@@ -149,7 +149,7 @@ test("PUT /api/grok/selection with an empty list removes the field", async () =>
     expect(res.status).toBe(200);
     expect(loadConfig().grokExcludedModels).toBeUndefined();
   } finally {
-    server.stop(true);
+    await server.stop(true);
   }
 });
 
@@ -171,7 +171,7 @@ test("GET /api/grok includes candidates and the saved exclusion list", async ()
     expect(Array.isArray(body.candidates)).toBe(true);
     expect(body.candidates.some(c => c.native)).toBe(true);
   } finally {
-    server.stop(true);
+    await server.stop(true);
   }
 });
 
@@ -188,7 +188,7 @@ test("GET /api/grok keeps native candidates when claudeCode.desktopNativeModels
     };
     expect(body.candidates.some(c => c.native)).toBe(true);
   } finally {
-    server.stop(true);
+    await server.stop(true);
   }
 });
 
@@ -204,7 +204,7 @@ test("POST /api/grok/apply reports no-grok-home as a policy skip, not an error",
     expect(body.ok).toBe(true);
     expect(body.skippedReason).toBe("no-grok-home");
   } finally {
-    server.stop(true);
+    await server.stop(true);
   }
 });
 
@@ -223,6 +223,6 @@ test("POST /api/grok/apply writes through the guarded writer and is idempotent",
     expect(secondBody.ok).toBe(true);
     expect(secondBody.changed).toBe(false);
   } finally {
-    server.stop(true);
+    await server.stop(true);
   }
 });
diff --git a/tests/native-profile-drain-server.test.ts b/tests/native-profile-drain-server.test.ts
index 83cb6acad..926e8549d 100644
--- a/tests/native-profile-drain-server.test.ts
+++ b/tests/native-profile-drain-server.test.ts
@@ -132,6 +132,7 @@ describe("native main profile scoped server admission", () => {
       saveMode("pool");
       updateAccountQuota(MAIN_CODEX_ACCOUNT_ID, 1, 1);
       server = startServer(0);
+      await waitForNativeMainStartupGate();
       const mainHttp = await fetch(new URL("/v1/responses", server.url), {
         method: "POST",
         headers: { "content-type": "application/json", authorization: "Bearer caller-token" },
diff --git a/tests/server-auth.test.ts b/tests/server-auth.test.ts
index 74923bc63..1c4fec7da 100644
--- a/tests/server-auth.test.ts
+++ b/tests/server-auth.test.ts
@@ -1,3 +1,4 @@
+import { waitForNativeMainStartupGate } from "../src/codex/native-profile-startup";
 import { afterEach, beforeEach, describe, expect, test } from "bun:test";
 import { logsFromApiBody } from "./helpers/logs-api";
 import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
@@ -1186,12 +1187,13 @@ describe("server local API auth", () => {
         clearCodexUpstreamHealth();
         const cfg = mainOnlyConfig();
         writeMainToken(state === "expired" ? `header.${expiredPayload}.signature` : "opaque-live-main-token");
-        if (state === "reauth") markAccountNeedsReauth(MAIN_CODEX_ACCOUNT_ID);
-        if (state === "cooldown") recordCodexUpstreamOutcome(cfg, MAIN_CODEX_ACCOUNT_ID, 429, { retryAfter: "60" });
         saveConfig(cfg);
         const before = seen.length;
         const unusableMain = startServer(0);
         try {
+          await waitForNativeMainStartupGate();
+          if (state === "reauth") markAccountNeedsReauth(MAIN_CODEX_ACCOUNT_ID);
+          if (state === "cooldown") recordCodexUpstreamOutcome(cfg, MAIN_CODEX_ACCOUNT_ID, 429, { retryAfter: "60" });
           expect((await request(unusableMain)).status).toBe(401);
           expect((await compact(unusableMain)).status).toBe(401);
           expect(await wsTurn(unusableMain)).toContain("401");
diff --git a/tests/server-key-failover-e2e.test.ts b/tests/server-key-failover-e2e.test.ts
index b17fff718..967647c62 100644
--- a/tests/server-key-failover-e2e.test.ts
+++ b/tests/server-key-failover-e2e.test.ts
@@ -109,7 +109,7 @@ describe("server 429 key failover (end-to-end)", () => {
         }
       }
     } finally {
-      server?.stop(true);
+      await server?.stop(true);
       globalThis.fetch = originalFetch;
     }
   });
@@ -188,7 +188,7 @@ describe("server 429 key failover (end-to-end)", () => {
       // Both attempts — the rotated retry especially — must carry the cache key.
       expect(seen.map(s => s.body.prompt_cache_key)).toEqual([promptCacheKey, promptCacheKey]);
     } finally {
-      server?.stop(true);
+      await server?.stop(true);
       globalThis.fetch = originalFetch;
     }
   });
@@ -241,7 +241,7 @@ describe("server 429 key failover (end-to-end)", () => {
       expect(seenAuth[0]).toBe("Bearer key-alpha-000111222333");
       expect(seenAuth[1]).toBe("Bearer key-beta-444555666777");
     } finally {
-      server.stop(true);
+      await server.stop(true);
     }
   });
 
@@ -292,7 +292,7 @@ describe("server 429 key failover (end-to-end)", () => {
       expect(json.error?.message).toContain("rotated retry socket reset");
       expect(json.error?.message).not.toContain("original rate limit");
     } finally {
-      server.stop(true);
+      await server.stop(true);
       globalThis.fetch = originalFetch;
     }
   });
@@ -341,7 +341,7 @@ describe("server 429 key failover (end-to-end)", () => {
       expect(upstreamBody).toContain("[image omitted");
       expect(upstreamBody).not.toContain("aGVsbG8=");
     } finally {
-      server.stop(true);
+      await server.stop(true);
     }
   });
 });
diff --git a/tests/server-kiro-completion-e2e.test.ts b/tests/server-kiro-completion-e2e.test.ts
index 60d29d3a9..803b884ca 100644
--- a/tests/server-kiro-completion-e2e.test.ts
+++ b/tests/server-kiro-completion-e2e.test.ts
@@ -168,7 +168,7 @@ describe("Kiro completion through public server endpoints", () => {
       expect(upstream.requests[1].conversationState.history.at(-1).assistantResponseMessage.content)
         .toBe("Checking the workspace.");
     } finally {
-      proxy.stop(true);
+      await proxy.stop(true);
       upstream.server.stop(true);
     }
   });
@@ -212,7 +212,7 @@ describe("Kiro completion through public server endpoints", () => {
       expect(kiroToolNames(upstream.requests[0])).toEqual(["bash", KIRO_COMPLETION_TOOL_NAME]);
       expect(kiroToolNames(upstream.requests[1])).toEqual(["bash", KIRO_COMPLETION_TOOL_NAME]);
     } finally {
-      proxy.stop(true);
+      await proxy.stop(true);
       upstream.server.stop(true);
     }
   });
diff --git a/tests/server-kiro-oauth-401-replay.test.ts b/tests/server-kiro-oauth-401-replay.test.ts
index c063169eb..471ffcc57 100644
--- a/tests/server-kiro-oauth-401-replay.test.ts
+++ b/tests/server-kiro-oauth-401-replay.test.ts
@@ -178,7 +178,7 @@ describe("Kiro OAuth upstream 401 replay", () => {
       expect(response.status).toBe(200);
       expect(observed).toEqual({ url: "https://runtime.eu-west-1.kiro.dev/", profileHeader: profileArn, profileBody: profileArn });
     } finally {
-      server.stop(true);
+      await server.stop(true);
     }
   });
 
@@ -195,7 +195,7 @@ describe("Kiro OAuth upstream 401 replay", () => {
       expect(observed.refreshCalls()).toBe(1);
       expect(observed.chatAuth).toEqual(["Bearer rejected-access", "Bearer fresh-access"]);
     } finally {
-      server.stop(true);
+      await server.stop(true);
     }
   });
 
@@ -255,7 +255,7 @@ describe("Kiro OAuth upstream 401 replay", () => {
         { url: "https://runtime.eu-west-1.kiro.dev/", auth: "Bearer concurrent-access", profile: newProfile },
       ]);
     } finally {
-      server.stop(true);
+      await server.stop(true);
     }
   });
 
@@ -270,7 +270,7 @@ describe("Kiro OAuth upstream 401 replay", () => {
       expect(observed.refreshCalls()).toBe(1);
       expect(observed.chatAuth).toEqual(["Bearer rejected-access", "Bearer fresh-access"]);
     } finally {
-      server.stop(true);
+      await server.stop(true);
     }
   });
 
@@ -316,7 +316,7 @@ describe("Kiro OAuth upstream 401 replay", () => {
       expect(refreshCalls).toBe(1);
       expect(chatAuth).toEqual(["Bearer rejected-access", "Bearer fresh-access", "Bearer fresh-access"]);
     } finally {
-      server.stop(true);
+      await server.stop(true);
     }
   });
 });
diff --git a/tests/server-xai-oauth-401-replay.test.ts b/tests/server-xai-oauth-401-replay.test.ts
index 4fbaf908b..3c79b3a3f 100644
--- a/tests/server-xai-oauth-401-replay.test.ts
+++ b/tests/server-xai-oauth-401-replay.test.ts
@@ -128,7 +128,7 @@ describe("xAI OAuth upstream 401 replay", () => {
       expect(observed.counts.refresh).toBe(1);
       expect(observed.chatAuth).toEqual(["Bearer rejected-access", "Bearer fresh-access"]);
     } finally {
-      server.stop(true);
+      await server.stop(true);
     }
   });
 
@@ -145,7 +145,7 @@ describe("xAI OAuth upstream 401 replay", () => {
       expect(observed.counts.refresh).toBe(1);
       expect(observed.chatAuth).toEqual(["Bearer rejected-access", "Bearer fresh-access"]);
     } finally {
-      server.stop(true);
+      await server.stop(true);
     }
   });
 
@@ -176,7 +176,7 @@ describe("xAI OAuth upstream 401 replay", () => {
       expect(chatCalls).toBe(1);
       expect(refreshCalls).toBe(0);
     } finally {
-      server.stop(true);
+      await server.stop(true);
     }
   });
 
@@ -237,7 +237,7 @@ describe("xAI OAuth upstream 401 replay", () => {
       expect(attemptsByBearer.get("Bearer rejected-access")).toBe(2);
       expect(attemptsByBearer.get("Bearer fresh-access")).toBe(2);
     } finally {
-      server.stop(true);
+      await server.stop(true);
     }
   });
 });
diff --git a/tests/vision-sidecar-e2e.test.ts b/tests/vision-sidecar-e2e.test.ts
index 1a68da62e..2e44ec3fb 100644
--- a/tests/vision-sidecar-e2e.test.ts
+++ b/tests/vision-sidecar-e2e.test.ts
@@ -156,7 +156,7 @@ describe("vision sidecar fallback (issue #88, end-to-end)", () => {
       expect(upstreamBody).not.toContain("aGVsbG8taW1hZ2UtYnl0ZXM=");
       expect(upstreamBody).not.toContain("image_url");
     } finally {
-      server.stop(true);
+      await server.stop(true);
     }
   });
 
@@ -192,7 +192,7 @@ describe("vision sidecar fallback (issue #88, end-to-end)", () => {
       expect(upstreamBody).toContain("aGVsbG8taW1hZ2UtYnl0ZXM=");
       expect(upstreamBody).not.toContain(CAPTION);
     } finally {
-      server.stop(true);
+      await server.stop(true);
     }
   });
 });

From fca17cd5abe55ef8583b3274d6f9b491efc678bf Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Mon, 3 Aug 2026 11:58:13 +0900
Subject: [PATCH 47/63] fix(codex): scrub crashed auth write residues

---
 .../docs/reference/cli/providers-accounts.md  |   9 +
 src/codex/native-main-auth-temp.ts            | 187 ++++++++++++++++++
 src/codex/native-profile-startup.ts           |  25 ++-
 src/codex/native-profile-types.ts             |   1 +
 src/config.ts                                 |   7 +
 tests/helpers/native-main-owner-child.ts      |  16 +-
 tests/native-main-auth-temp.test.ts           | 134 +++++++++++++
 tests/native-main-owner-lifetime.test.ts      |  82 ++++++++
 8 files changed, 450 insertions(+), 11 deletions(-)
 create mode 100644 src/codex/native-main-auth-temp.ts
 create mode 100644 tests/native-main-auth-temp.test.ts

diff --git a/docs-site/src/content/docs/reference/cli/providers-accounts.md b/docs-site/src/content/docs/reference/cli/providers-accounts.md
index d79cd5e19..392041a5c 100644
--- a/docs-site/src/content/docs/reference/cli/providers-accounts.md
+++ b/docs-site/src/content/docs/reference/cli/providers-accounts.md
@@ -239,6 +239,15 @@ The encrypted vault, switch journal, recovery marker, and journal quarantine liv
 that Codex home observes one owner and one recovery state. Plaintext login staging remains isolated
 under each `<OPENCODEX_HOME>/native-main-profile-staging` directory.
 
+Before native-main traffic or journal recovery is admitted, the lifetime owner takes the exclusive
+credential claim and removes only exact `auth.json.ocx.<pid>.<sequence>.tmp` crash residues. Each
+candidate must remain a single-linked regular file under the unchanged canonical `CODEX_HOME`; it is
+truncated, flushed, and then unlinked. Link/reparse substitutions, identity changes, and other
+ambiguity keep native-main traffic closed, while near-miss names are never removed automatically.
+This protects against cooperative OpenCodex crashes, not a malicious process already running as the
+same OS user. That user and the filesystem containing `CODEX_HOME` remain trusted, and truncation
+does not promise physical erasure from copy-on-write storage, snapshots, or SSD remanence.
+
 Preview builds used `<OPENCODEX_HOME>/native-main-profiles`. That layout is never imported silently.
 If `doctor` reports legacy profile state, stop every OpenCodex proxy sharing the same `CODEX_HOME`.
 Then either back up and move the matching `*.vault.json`, `*.journal.json`, recovery marker, and any
diff --git a/src/codex/native-main-auth-temp.ts b/src/codex/native-main-auth-temp.ts
new file mode 100644
index 000000000..fddf80ff1
--- /dev/null
+++ b/src/codex/native-main-auth-temp.ts
@@ -0,0 +1,187 @@
+import {
+  closeSync,
+  constants as fsConstants,
+  fstatSync,
+  fsyncSync,
+  ftruncateSync,
+  lstatSync,
+  openSync,
+  readdirSync,
+  realpathSync,
+  unlinkSync,
+} from "node:fs";
+import { dirname, join, resolve } from "node:path";
+
+import type { NativeProfileContext } from "./native-profile-store";
+import { NativeProfileError } from "./native-profile-types";
+
+const AUTH_TEMP_NAME = /^auth\.json\.ocx\.[1-9]\d*\.[1-9]\d*\.tmp$/;
+const MAX_AUTH_TEMP_RESIDUES = 128;
+
+interface PathIdentity {
+  readonly dev: bigint;
+  readonly ino: bigint;
+}
+
+export interface NativeMainAuthTempScrubTestSeam {
+  /** Test-only race seam. Production never supplies this callback. */
+  beforeOpen?: (path: string) => void;
+  /** Test-only removal-failure seam. Production never supplies this callback. */
+  beforeUnlink?: (path: string) => void;
+}
+
+export interface NativeMainAuthTempScrubResult {
+  scrubbed: number;
+}
+
+function cleanupRequired(): NativeProfileError {
+  return new NativeProfileError(
+    "AUTH_TEMP_CLEANUP_REQUIRED",
+    "A native-main credential write residue could not be safely removed; manual cleanup is required.",
+    500,
+    false,
+    true,
+  );
+}
+
+function errorCode(error: unknown): string | undefined {
+  return error && typeof error === "object" && "code" in error
+    ? String((error as { code?: unknown }).code)
+    : undefined;
+}
+
+function sameIdentity(stats: { dev: bigint; ino: bigint }, expected: PathIdentity): boolean {
+  return stats.dev === expected.dev && stats.ino === expected.ino;
+}
+
+function samePath(left: string, right: string): boolean {
+  return resolve(left) === resolve(right);
+}
+
+function inspectCanonicalParent(path: string, expected?: PathIdentity): PathIdentity {
+  const absolute = resolve(path);
+  const entry = lstatSync(absolute, { bigint: true });
+  if (!entry.isDirectory() || entry.isSymbolicLink()) throw cleanupRequired();
+  const canonical = realpathSync.native(absolute);
+  if (!samePath(canonical, absolute)) throw cleanupRequired();
+  if (expected && !sameIdentity(entry, expected)) throw cleanupRequired();
+  return { dev: entry.dev, ino: entry.ino };
+}
+
+function inspectExactPath(path: string, parent: string, expected?: PathIdentity): PathIdentity {
+  const absolute = resolve(path);
+  if (!samePath(dirname(absolute), parent)) throw cleanupRequired();
+  const entry = lstatSync(absolute, { bigint: true });
+  if (!entry.isFile() || entry.isSymbolicLink() || entry.nlink !== 1n) throw cleanupRequired();
+  const canonical = realpathSync.native(absolute);
+  if (!samePath(canonical, absolute) || !samePath(dirname(canonical), parent)) throw cleanupRequired();
+  if (expected && !sameIdentity(entry, expected)) throw cleanupRequired();
+  return { dev: entry.dev, ino: entry.ino };
+}
+
+function exactResidues(parent: string, parentIdentity: PathIdentity): string[] {
+  inspectCanonicalParent(parent, parentIdentity);
+  const names = readdirSync(parent).filter(name => AUTH_TEMP_NAME.test(name)).sort();
+  inspectCanonicalParent(parent, parentIdentity);
+  if (names.length > MAX_AUTH_TEMP_RESIDUES) throw cleanupRequired();
+  return names;
+}
+
+function assertOpenIdentity(
+  fd: number,
+  path: string,
+  parent: string,
+  parentIdentity: PathIdentity,
+  expected: PathIdentity,
+  expectedLinks: bigint,
+): void {
+  inspectCanonicalParent(parent, parentIdentity);
+  const opened = fstatSync(fd, { bigint: true });
+  if (
+    !opened.isFile()
+    || !sameIdentity(opened, expected)
+    || opened.nlink !== expectedLinks
+  ) throw cleanupRequired();
+  inspectExactPath(path, parent, expected);
+  inspectCanonicalParent(parent, parentIdentity);
+}
+
+function scrubOne(
+  path: string,
+  parent: string,
+  parentIdentity: PathIdentity,
+  seam: NativeMainAuthTempScrubTestSeam,
+): void {
+  const observed = inspectExactPath(path, parent);
+  inspectCanonicalParent(parent, parentIdentity);
+  seam.beforeOpen?.(path);
+
+  const flags = process.platform === "win32"
+    ? fsConstants.O_RDWR
+    : fsConstants.O_RDWR | fsConstants.O_NOFOLLOW;
+  let fd: number | undefined;
+  let failed = false;
+  try {
+    fd = openSync(path, flags);
+    assertOpenIdentity(fd, path, parent, parentIdentity, observed, 1n);
+
+    ftruncateSync(fd, 0);
+    fsyncSync(fd);
+    const truncated = fstatSync(fd, { bigint: true });
+    if (!sameIdentity(truncated, observed) || truncated.nlink !== 1n || truncated.size !== 0n) {
+      throw cleanupRequired();
+    }
+    assertOpenIdentity(fd, path, parent, parentIdentity, observed, 1n);
+    seam.beforeUnlink?.(path);
+
+    // The lifetime owner and exclusive claim exclude cooperative OpenCodex writers.
+    // A malicious process running as the same OS user can still race Node's final
+    // identity-check/unlink gap and is intentionally outside this trusted-owner boundary.
+    unlinkSync(path);
+    const unlinked = fstatSync(fd, { bigint: true });
+    if (!sameIdentity(unlinked, observed) || unlinked.nlink !== 0n || unlinked.size !== 0n) {
+      throw cleanupRequired();
+    }
+    try {
+      lstatSync(path);
+      throw cleanupRequired();
+    } catch (error) {
+      if (error instanceof NativeProfileError) throw error;
+      if (errorCode(error) !== "ENOENT") throw error;
+    }
+    inspectCanonicalParent(parent, parentIdentity);
+  } catch (error) {
+    failed = true;
+    throw error;
+  } finally {
+    if (fd !== undefined) {
+      try { closeSync(fd); }
+      catch (error) { if (!failed) throw error; }
+    }
+  }
+}
+
+/**
+ * Remove only crash residues created by atomicWriteFileAsync for canonical auth.json.
+ * The caller must hold the lifetime native-main owner and exclusive credential claim.
+ */
+export function scrubNativeMainAuthTempResidues(
+  context: NativeProfileContext,
+  seam: NativeMainAuthTempScrubTestSeam = {},
+): NativeMainAuthTempScrubResult {
+  try {
+    const parent = resolve(context.codexHome);
+    const parentIdentity = inspectCanonicalParent(parent);
+    const names = exactResidues(parent, parentIdentity);
+    for (const name of names) {
+      scrubOne(join(parent, name), parent, parentIdentity, seam);
+    }
+    // A cooperative writer cannot create a new residue while the owner and
+    // exclusive claim are held. Seeing one now is ambiguous, so admission stays closed.
+    if (exactResidues(parent, parentIdentity).length !== 0) throw cleanupRequired();
+    return { scrubbed: names.length };
+  } catch (error) {
+    if (error instanceof NativeProfileError) throw error;
+    throw cleanupRequired();
+  }
+}
diff --git a/src/codex/native-profile-startup.ts b/src/codex/native-profile-startup.ts
index 9fb725a49..9e4a54e9f 100644
--- a/src/codex/native-profile-startup.ts
+++ b/src/codex/native-profile-startup.ts
@@ -13,6 +13,7 @@ import {
   type NativeMainOwnerSnapshot,
 } from "./native-main-owner";
 import { withNativeMainExclusiveClaim } from "./native-main-claim";
+import { scrubNativeMainAuthTempResidues } from "./native-main-auth-temp";
 
 export type NativeMainStartupGateSnapshot =
   | { status: "ready"; homeId: string | null }
@@ -132,16 +133,20 @@ function convergeOwnedStartup(entry: StartupEntry): void {
   entry.settled = settled = (async () => {
     const probe = entry.deps.probeRecoveryState ?? probeNativeProfileRecoveryState;
     try {
-      let recoveryState = probe(entry.manager.context);
-      if (recoveryState === "journal") {
-        await entry.deps.beforeRecovery?.();
-        await withNativeMainOwnerOperation(entry.manager.context, () => withNativeMainExclusiveClaim(
-          entry.manager.context,
-          () => entry.manager.recover(false),
-          { waitMs: 10_000 },
-        ));
-        recoveryState = probe(entry.manager.context);
-      }
+      const recoveryState = await withNativeMainOwnerOperation(entry.manager.context, () => withNativeMainExclusiveClaim(
+        entry.manager.context,
+        async () => {
+          scrubNativeMainAuthTempResidues(entry.manager.context);
+          let state = probe(entry.manager.context);
+          if (state === "journal") {
+            await entry.deps.beforeRecovery?.();
+            await entry.manager.recover(false);
+            state = probe(entry.manager.context);
+          }
+          return state;
+        },
+        { waitMs: 10_000 },
+      ));
       if (startupEntries.get(entry.homeId) === entry && entry.epoch === currentEpoch && recoveryState === "none") {
         clearAccountNeedsReauth(MAIN_CODEX_ACCOUNT_ID);
         snapshot = ready(entry.homeId);
diff --git a/src/codex/native-profile-types.ts b/src/codex/native-profile-types.ts
index f9d3876f8..b7e879a07 100644
--- a/src/codex/native-profile-types.ts
+++ b/src/codex/native-profile-types.ts
@@ -5,6 +5,7 @@ export type NativeProfileErrorCode =
   | "AUTH_MISSING"
   | "AUTH_INVALID"
   | "AUTH_UNREADABLE"
+  | "AUTH_TEMP_CLEANUP_REQUIRED"
   | "ACTIVE_PROFILE_MISMATCH"
   | "PROFILE_NOT_FOUND"
   | "PROFILE_ALREADY_EXISTS"
diff --git a/src/config.ts b/src/config.ts
index fe523323a..4fd1cc86f 100644
--- a/src/config.ts
+++ b/src/config.ts
@@ -239,6 +239,11 @@ export interface AtomicWriteAsyncIO {
   unlink: (path: string) => void | Promise<void>;
 }
 
+/** Test-only crash seam. Production callers leave this undefined. */
+export interface AtomicWriteAsyncTestSeam {
+  afterTempWrite?: (tempPath: string) => void | Promise<void>;
+}
+
 async function renameAtomicFileAsync(source: string, destination: string): Promise<void> {
   for (let attempt = 0; ; attempt += 1) {
     try {
@@ -263,6 +268,7 @@ export async function atomicWriteFileAsync(
   path: string,
   content: string,
   io?: AtomicWriteAsyncIO,
+  testSeam?: AtomicWriteAsyncTestSeam,
 ): Promise<void> {
   const effective: AtomicWriteAsyncIO = io ?? {
     write: (target, value) => writeFileSync(target, value, { encoding: "utf-8", mode: 0o600 }),
@@ -282,6 +288,7 @@ export async function atomicWriteFileAsync(
   let hardened = false;
   try {
     await effective.write(tmp, content);
+    await testSeam?.afterTempWrite?.(tmp);
     await effective.harden(tmp);
     hardened = true;
     await effective.rename(tmp, target);
diff --git a/tests/helpers/native-main-owner-child.ts b/tests/helpers/native-main-owner-child.ts
index 1881d715e..9119d3d0b 100644
--- a/tests/helpers/native-main-owner-child.ts
+++ b/tests/helpers/native-main-owner-child.ts
@@ -1,6 +1,8 @@
-import { appendFileSync } from "node:fs";
+import { appendFileSync, realpathSync } from "node:fs";
+import { basename, join, resolve } from "node:path";
 import { createInterface } from "node:readline";
 
+import { atomicWriteFileAsync } from "../../src/config";
 import { MAIN_CODEX_ACCOUNT_ID } from "../../src/codex/main-account";
 import { nativeMainOwnerSnapshot } from "../../src/codex/native-main-owner";
 import { NativeProfileManager } from "../../src/codex/native-profile-manager";
@@ -23,6 +25,7 @@ const keyBytes = Buffer.from(required("NATIVE_OWNER_KEY"), "base64");
 const keyRef = process.env.NATIVE_OWNER_KEY_REF ?? "memory:native-owner-test";
 const holdRecovery = process.env.NATIVE_OWNER_HOLD_RECOVERY === "1";
 const holdSwitchBoundary = process.env.NATIVE_OWNER_HOLD_SWITCH_BOUNDARY;
+const holdAuthTemp = process.env.NATIVE_OWNER_HOLD_AUTH_TEMP === "1";
 const receiptPath = process.env.NATIVE_OWNER_RECEIPTS;
 
 const emit = (value: Record<string, unknown>): void => {
@@ -38,14 +41,25 @@ let releaseRecovery!: () => void;
 const recoveryBarrier = new Promise<void>(resolve => { releaseRecovery = resolve; });
 let releaseSwitch!: () => void;
 const switchBarrier = new Promise<void>(resolve => { releaseSwitch = resolve; });
+const authTempBarrier = new Promise<void>(() => {});
 
 function managerFor(home = codexHome): NativeProfileManager {
+  const canonicalAuthPath = join(realpathSync.native(home), "auth.json");
   return new NativeProfileManager({
     codexHome: home,
     configDir,
     keyProvider: new EnvKeyProvider(),
     hardenPath: async () => {},
     processProbe: async () => ({ status: "clear", count: 0 }),
+    atomicWrite: holdAuthTemp
+      ? (path, content) => atomicWriteFileAsync(path, content, undefined, {
+          afterTempWrite: async tempPath => {
+            if (resolve(path) !== resolve(canonicalAuthPath)) return;
+            emit({ event: "auth-temp-written", name: basename(tempPath) });
+            await authTempBarrier;
+          },
+        })
+      : undefined,
     onSwitchBoundary: async boundary => {
       if (boundary !== holdSwitchBoundary) return;
       emit({ event: "switch-boundary", boundary });
diff --git a/tests/native-main-auth-temp.test.ts b/tests/native-main-auth-temp.test.ts
new file mode 100644
index 000000000..55f5d59b1
--- /dev/null
+++ b/tests/native-main-auth-temp.test.ts
@@ -0,0 +1,134 @@
+import { afterEach, describe, expect, test } from "bun:test";
+import {
+  existsSync,
+  linkSync,
+  lstatSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  renameSync,
+  rmSync,
+  symlinkSync,
+  writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import { scrubNativeMainAuthTempResidues } from "../src/codex/native-main-auth-temp";
+import { resolveNativeProfileContext } from "../src/codex/native-profile-store";
+import { NativeProfileError } from "../src/codex/native-profile-types";
+
+const roots: string[] = [];
+
+afterEach(() => {
+  for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true });
+});
+
+function fixture() {
+  const root = mkdtempSync(join(tmpdir(), "ocx-auth-temp-"));
+  roots.push(root);
+  const codexHome = join(root, "codex");
+  mkdirSync(codexHome);
+  return {
+    codexHome,
+    context: resolveNativeProfileContext({ codexHome, configDir: join(root, "config") }),
+  };
+}
+
+function expectCleanupRequired(operation: () => unknown): void {
+  try {
+    operation();
+  } catch (error) {
+    expect(error).toBeInstanceOf(NativeProfileError);
+    expect((error as NativeProfileError).code).toBe("AUTH_TEMP_CLEANUP_REQUIRED");
+    return;
+  }
+  throw new Error("expected native auth temp cleanup to fail closed");
+}
+
+describe("native-main auth temp startup scrub", () => {
+  test("truncates and removes exact atomic-writer residues without touching near-miss names", () => {
+    const f = fixture();
+    const authPath = join(f.codexHome, "auth.json");
+    const authText = "current-auth-private-value";
+    writeFileSync(authPath, authText);
+    const exact = ["auth.json.ocx.123.1.tmp", "auth.json.ocx.456.27.tmp"];
+    const near = [
+      "auth.json.ocx.0.1.tmp",
+      "auth.json.ocx.01.1.tmp",
+      "auth.json.ocx.1.0.tmp",
+      "auth.json.ocx.1.01.tmp",
+      "auth.json.ocx.1.1.TMP",
+      "auth.json.ocx.1.1.tmp.bak",
+    ];
+    for (const name of [...exact, ...near]) writeFileSync(join(f.codexHome, name), `private-${name}`);
+
+    expect(scrubNativeMainAuthTempResidues(f.context)).toEqual({ scrubbed: 2 });
+    expect(readFileSync(authPath, "utf8")).toBe(authText);
+    for (const name of exact) expect(existsSync(join(f.codexHome, name))).toBe(false);
+    for (const name of near) expect(readFileSync(join(f.codexHome, name), "utf8")).toBe(`private-${name}`);
+  });
+
+  test("fails closed without following an exact-name symlink or truncating its target", () => {
+    const f = fixture();
+    const target = join(f.codexHome, "near-miss-target");
+    const residue = join(f.codexHome, "auth.json.ocx.123.1.tmp");
+    writeFileSync(target, "target-private-value");
+    symlinkSync(target, residue, "file");
+
+    expectCleanupRequired(() => scrubNativeMainAuthTempResidues(f.context));
+    expect(lstatSync(residue).isSymbolicLink()).toBe(true);
+    expect(readFileSync(target, "utf8")).toBe("target-private-value");
+  });
+
+  test("fails closed without truncating a multiply-linked exact-name file", () => {
+    const f = fixture();
+    const target = join(f.codexHome, "hardlink-target");
+    const residue = join(f.codexHome, "auth.json.ocx.123.1.tmp");
+    writeFileSync(target, "hardlink-private-value");
+    linkSync(target, residue);
+
+    expectCleanupRequired(() => scrubNativeMainAuthTempResidues(f.context));
+    expect(readFileSync(target, "utf8")).toBe("hardlink-private-value");
+    expect(readFileSync(residue, "utf8")).toBe("hardlink-private-value");
+  });
+
+  test("detects replacement between inspection and open without truncating either file", () => {
+    const f = fixture();
+    const residue = join(f.codexHome, "auth.json.ocx.123.1.tmp");
+    const moved = join(f.codexHome, "moved-residue");
+    writeFileSync(residue, "original-private-value");
+
+    expectCleanupRequired(() => scrubNativeMainAuthTempResidues(f.context, {
+      beforeOpen(path) {
+        renameSync(path, moved);
+        writeFileSync(path, "replacement-private-value");
+      },
+    }));
+    expect(readFileSync(moved, "utf8")).toBe("original-private-value");
+    expect(readFileSync(residue, "utf8")).toBe("replacement-private-value");
+  });
+
+  test("fails closed after truncate when removal cannot proceed", () => {
+    const f = fixture();
+    const residue = join(f.codexHome, "auth.json.ocx.123.1.tmp");
+    writeFileSync(residue, "private-value");
+
+    expectCleanupRequired(() => scrubNativeMainAuthTempResidues(f.context, {
+      beforeUnlink() { throw new Error("injected unlink failure"); },
+    }));
+    expect(existsSync(residue)).toBe(true);
+    expect(readFileSync(residue)).toHaveLength(0);
+  });
+
+  test("fails closed before modifying an excessive exact-residue set", () => {
+    const f = fixture();
+    for (let sequence = 1; sequence <= 129; sequence += 1) {
+      writeFileSync(join(f.codexHome, `auth.json.ocx.123.${sequence}.tmp`), "private-value");
+    }
+
+    expectCleanupRequired(() => scrubNativeMainAuthTempResidues(f.context));
+    expect(readFileSync(join(f.codexHome, "auth.json.ocx.123.1.tmp"), "utf8")).toBe("private-value");
+    expect(readFileSync(join(f.codexHome, "auth.json.ocx.123.129.tmp"), "utf8")).toBe("private-value");
+  });
+});
diff --git a/tests/native-main-owner-lifetime.test.ts b/tests/native-main-owner-lifetime.test.ts
index 52d909139..ffa2793e9 100644
--- a/tests/native-main-owner-lifetime.test.ts
+++ b/tests/native-main-owner-lifetime.test.ts
@@ -2,6 +2,7 @@ import { afterEach, describe, expect, test } from "bun:test";
 import { Database } from "bun:sqlite";
 import {
   existsSync,
+  linkSync,
   mkdirSync,
   mkdtempSync,
   readFileSync,
@@ -386,6 +387,87 @@ describe("native-main process owner lease", () => {
     }
   }, 30_000);
 
+  test("a successor scrubs a hard-killed production auth write before recovery or main admission", async () => {
+    const f = fixture("temp-crash", false);
+    const source = await f.manager.register("source");
+    const stage = await f.manager.prepareStage();
+    writeFileSync(join(stage.stagingCodexHome, "auth.json"), auth("account-target", "target"));
+    const target = await f.manager.finishStage(stage.stageId, "target");
+    expect(source.profile.state).toBe("active");
+
+    const owner = new ChildHarness(f, { NATIVE_OWNER_HOLD_AUTH_TEMP: "1" });
+    let successor: ChildHarness | undefined;
+    try {
+      const listening = await owner.waitFor(event => event.event === "listening");
+      await owner.snapshot(isHeldReady);
+      const switchRequest = fetch(`http://127.0.0.1:${Number(listening.port)}/api/native-main-profiles/switch`, {
+        method: "POST",
+        headers: { "content-type": "application/json", "x-opencodex-api-key": "owner-test-admin" },
+        body: JSON.stringify({ target: target.profile.id, confirmedStopped: true }),
+      }).catch(() => null);
+      const written = await Promise.race([
+        owner.waitFor(event => event.event === "auth-temp-written"),
+        switchRequest.then(async response => {
+          if (response === null) throw new Error("switch connection closed before the auth temp write");
+          throw new Error(`switch returned before the auth temp write: ${response.status} ${await response.text()}`);
+        }),
+      ]);
+      const tempName = String(written.name);
+      expect(tempName).toMatch(/^auth\.json\.ocx\.[1-9]\d*\.[1-9]\d*\.tmp$/);
+      const tempPath = join(f.codexHome, tempName);
+      expect(readFileSync(tempPath, "utf8")).toContain("access-target");
+      expect(probeNativeProfileRecoveryState(f.manager.context)).toBe("journal");
+
+      successor = new ChildHarness(f, { NATIVE_OWNER_HOLD_RECOVERY: "1" });
+      await successor.waitFor(event => event.event === "listening");
+      await successor.snapshot(isContended);
+      await owner.hardKill();
+      await switchRequest;
+
+      await successor.waitFor(event => event.event === "before-recovery");
+      expect(existsSync(tempPath)).toBe(false);
+      expect(probeNativeProfileRecoveryState(f.manager.context)).toBe("journal");
+      const blockedSnapshot = await successor.command("snapshot");
+      const blockedMain = await successor.command("request", { kind: "main" });
+      expect(Number(blockedMain.status)).toBeGreaterThanOrEqual(400);
+      expect(blockedMain.upstreamCalls).toBe(blockedSnapshot.upstreamCalls);
+
+      expect((await successor.command("release-recovery")).ok).toBe(true);
+      await successor.snapshot(isHeldReady);
+      expect(probeNativeProfileRecoveryState(f.manager.context)).toBe("none");
+      const main = await successor.command("request", { kind: "main" });
+      expect(main.status).toBe(200);
+      expect((main.lastReceipt as { authorization?: string }).authorization).toBe("Bearer access-main");
+    } finally {
+      await owner.hardKill();
+      if (successor) await successor.hardKill();
+    }
+  }, 45_000);
+
+  test("an ambiguous exact residue keeps native-main startup fail closed", async () => {
+    const f = fixture("unsafe-residue", false);
+    const target = join(f.codexHome, "hardlink-target");
+    const residue = join(f.codexHome, "auth.json.ocx.123.1.tmp");
+    writeFileSync(target, "hardlink-private-value");
+    linkSync(target, residue);
+    const child = new ChildHarness(f);
+    try {
+      await child.waitFor(event => event.event === "listening");
+      const blocked = await child.snapshot(event => {
+        const owner = event.owner as { status?: string } | undefined;
+        const gate = event.gate as { status?: string; reason?: string } | undefined;
+        return owner?.status === "held" && gate?.status === "blocked" && gate.reason === "manual-recovery";
+      });
+      const main = await child.command("request", { kind: "main" });
+      expect(Number(main.status)).toBeGreaterThanOrEqual(400);
+      expect(main.upstreamCalls).toBe(blocked.upstreamCalls);
+      expect(readFileSync(target, "utf8")).toBe("hardlink-private-value");
+      expect(readFileSync(residue, "utf8")).toBe("hardlink-private-value");
+    } finally {
+      await child.stop().catch(() => child.hardKill());
+    }
+  }, 30_000);
+
   test("same-process server references retain ownership until the last server stops", async () => {
     const f = fixture("refs-a");
     const contenderConfig = join(f.root, "refs-b");

From 1205668272b9bfbd093a622c888edb58f762bd6e Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Mon, 3 Aug 2026 12:38:25 +0900
Subject: [PATCH 48/63] fix(codex): lease native login staging writers

---
 src/cli/account-api.ts                        |  11 +
 src/cli/account-main.ts                       | 105 +++-
 src/codex/native-profile-api.ts               |  35 +-
 src/codex/native-profile-manager.ts           | 459 +++++++++++++-----
 src/codex/native-profile-stage-store.ts       | 387 +++++++++++++++
 src/codex/native-profile-startup.ts           |  49 +-
 src/codex/native-profile-store.ts             |   2 +
 src/codex/native-profile-types.ts             |   3 +
 tests/cli-native-profile.test.ts              |  60 ++-
 tests/native-main-owner-lifetime.test.ts      |   2 +-
 tests/native-profile-api.test.ts              |   7 +-
 tests/native-profile-crash-boundaries.test.ts |   2 +-
 tests/native-profile-manager.test.ts          |  54 +--
 tests/native-profile-route-security.test.ts   |   8 +-
 tests/native-profile-stage-lifecycle.test.ts  | 217 +++++++++
 tests/native-profile-startup.test.ts          |   2 +-
 16 files changed, 1212 insertions(+), 191 deletions(-)
 create mode 100644 src/codex/native-profile-stage-store.ts
 create mode 100644 tests/native-profile-stage-lifecycle.test.ts

diff --git a/src/cli/account-api.ts b/src/cli/account-api.ts
index 01061697c..916833be4 100644
--- a/src/cli/account-api.ts
+++ b/src/cli/account-api.ts
@@ -28,6 +28,11 @@ export type ClassifyResult = { type: AccountType } | { error: string };
 
 export type AccountStdin = NodeJS.ReadableStream & { isTTY?: boolean };
 
+export interface NativeMainLoginChild {
+  exited: Promise<number>;
+  kill(signal?: number | NodeJS.Signals): void;
+}
+
 export interface AccountDeps {
   /** Test injection: skip findLiveProxy and call the API at this base URL. */
   baseUrl?: string;
@@ -36,7 +41,11 @@ export interface AccountDeps {
   stdinImpl?: AccountStdin;
   stdinTimeoutMs?: number;
   /** Test/platform injection for the official Codex login in a restricted staging home. */
+  spawnCodexLoginImpl?: (codexHome: string) => NativeMainLoginChild;
+  /** Legacy test seam. Production always uses the spawned child handle above. */
   runCodexLoginImpl?: (codexHome: string) => Promise<number>;
+  /** Test-only heartbeat cadence floor. Production keeps the five-second floor. */
+  stageHeartbeatIntervalMinMs?: number;
 }
 
 export function classifyAccount(config: OcxConfig, name: string): ClassifyResult {
@@ -70,6 +79,7 @@ export async function apiJson(
   method: "GET" | "PUT" | "POST" | "DELETE",
   path: string,
   body?: unknown,
+  options: { signal?: AbortSignal } = {},
 ): Promise<ApiResult> {
   const fetchImpl = deps.fetchImpl ?? fetch;
   try {
@@ -77,6 +87,7 @@ export async function apiJson(
       method,
       headers: runningProxyUpdateHeaders(),
       body: body === undefined ? undefined : JSON.stringify(body),
+      signal: options.signal,
     });
     const json = (await res.json().catch(() => ({}))) as Record<string, unknown>;
     return { status: res.status, json };
diff --git a/src/cli/account-main.ts b/src/cli/account-main.ts
index 2809c266f..5d1e813b2 100644
--- a/src/cli/account-main.ts
+++ b/src/cli/account-main.ts
@@ -2,7 +2,14 @@ import { isAbsolute } from "node:path";
 import { codexExecInvocation } from "../codex/exec-invocation";
 import { resolveAndPersistCodexRuntime, type ResolveCodexRuntimeDeps } from "../codex/runtime";
 import type { ResolveDeps, SpawnInvocation } from "../lib/win-exec";
-import { apiError, apiJson, proxyUnreachable, resolveBaseUrl, type AccountDeps } from "./account-api";
+import {
+  apiError,
+  apiJson,
+  proxyUnreachable,
+  resolveBaseUrl,
+  type AccountDeps,
+  type NativeMainLoginChild,
+} from "./account-api";
 
 const USAGE = `Usage:
   ocx account main doctor [--json]
@@ -70,7 +77,7 @@ export function nativeMainCodexLoginInvocation(
   return codexExecInvocation(command, ["login"], platform, deps);
 }
 
-async function runOfficialCodexLogin(codexHome: string): Promise<number> {
+function spawnOfficialCodexLogin(codexHome: string): NativeMainLoginChild {
   const invocation = nativeMainCodexLoginInvocation();
   const child = Bun.spawn([invocation.file, ...invocation.args], {
     env: { ...process.env, CODEX_HOME: codexHome },
@@ -79,7 +86,57 @@ async function runOfficialCodexLogin(codexHome: string): Promise<number> {
     stderr: "inherit",
     ...(invocation.options.windowsVerbatimArguments ? { windowsVerbatimArguments: true } : {}),
   });
-  return child.exited;
+  return child;
+}
+
+function abortableDelay(ms: number, signal: AbortSignal): Promise<void> {
+  if (signal.aborted) return Promise.resolve();
+  return new Promise(resolve => {
+    const timer = setTimeout(done, ms);
+    timer.unref?.();
+    signal.addEventListener("abort", done, { once: true });
+    function done(): void {
+      clearTimeout(timer);
+      signal.removeEventListener("abort", done);
+      resolve();
+    }
+  });
+}
+
+async function maintainStageLease(
+  deps: AccountDeps,
+  baseUrl: string,
+  stageId: string,
+  writerToken: string,
+  initialLeaseExpiresAt: number,
+  heartbeatIntervalMs: number,
+  child: NativeMainLoginChild,
+  signal: AbortSignal,
+): Promise<{ lost: boolean }> {
+  let leaseExpiresAt = initialLeaseExpiresAt;
+  for (;;) {
+    if (signal.aborted) return { lost: false };
+    const heartbeat = await apiJson(
+      deps,
+      baseUrl,
+      "POST",
+      "/api/native-main-profiles/stage/heartbeat",
+      { stageId, writerToken },
+      { signal },
+    );
+    if (signal.aborted) return { lost: false };
+    if (heartbeat.status === 200 && typeof heartbeat.json.leaseExpiresAt === "number") {
+      leaseExpiresAt = heartbeat.json.leaseExpiresAt;
+      await abortableDelay(heartbeatIntervalMs, signal);
+      continue;
+    }
+    if (heartbeat.status === 0 && Date.now() < leaseExpiresAt - 30_000) {
+      await abortableDelay(Math.min(5_000, heartbeatIntervalMs), signal);
+      continue;
+    }
+    try { child.kill(); } catch { /* child exit below is authoritative */ }
+    return { lost: true };
+  }
 }
 
 export async function cmdNativeMainAccount(args: string[], deps: AccountDeps): Promise<number> {
@@ -119,17 +176,47 @@ export async function cmdNativeMainAccount(args: string[], deps: AccountDeps): P
     if (stage.status === 0) return proxyUnreachable();
     if (stage.status !== 200) return apiError(stage.json, "failed to prepare native login staging");
     const stageId = typeof stage.json.stageId === "string" ? stage.json.stageId : "";
+    const writerToken = typeof stage.json.writerToken === "string" ? stage.json.writerToken : "";
     const stagingHome = typeof stage.json.stagingCodexHome === "string" ? stage.json.stagingCodexHome : "";
+    const leaseExpiresAt = typeof stage.json.leaseExpiresAt === "number" ? stage.json.leaseExpiresAt : 0;
+    const heartbeatIntervalMs = typeof stage.json.heartbeatIntervalMs === "number"
+      ? Math.min(5 * 60_000, Math.max(deps.stageHeartbeatIntervalMinMs ?? 5_000, stage.json.heartbeatIntervalMs))
+      : 60_000;
     const stagedEffectiveHome = effectiveCodexHome(stage.json);
     let exitCode = 1;
     let finished = false;
+    let leaseLost = false;
     try {
-      if (!stageId || !isAbsolute(stagingHome)) throw new Error("The proxy returned an invalid staging session.");
+      if (!stageId || !writerToken || !isAbsolute(stagingHome) || leaseExpiresAt <= Date.now()) {
+        throw new Error("The proxy returned an invalid staging session.");
+      }
       console.error(`Effective CODEX_HOME: ${stagedEffectiveHome}`);
       console.error(`Starting official Codex login in restricted staging home: ${stagingHome}`);
-      exitCode = await (deps.runCodexLoginImpl ?? runOfficialCodexLogin)(stagingHome);
+      const child = deps.spawnCodexLoginImpl
+        ? deps.spawnCodexLoginImpl(stagingHome)
+        : deps.runCodexLoginImpl
+          ? { exited: deps.runCodexLoginImpl(stagingHome), kill: () => {} }
+          : spawnOfficialCodexLogin(stagingHome);
+      const heartbeatAbort = new AbortController();
+      const heartbeat = maintainStageLease(
+        deps,
+        baseUrl,
+        stageId,
+        writerToken,
+        leaseExpiresAt,
+        heartbeatIntervalMs,
+        child,
+        heartbeatAbort.signal,
+      );
+      try {
+        exitCode = await child.exited;
+      } finally {
+        heartbeatAbort.abort();
+        leaseLost = (await heartbeat).lost;
+      }
+      if (leaseLost) throw new Error("The native-login staging lease was lost before login completed.");
       if (exitCode !== 0) throw new Error("Official Codex login did not complete successfully.");
-      const finish = await apiJson(deps, baseUrl, "POST", "/api/native-main-profiles/stage/finish", { stageId, label });
+      const finish = await apiJson(deps, baseUrl, "POST", "/api/native-main-profiles/stage/finish", { stageId, writerToken, label });
       if (finish.status === 0) return proxyUnreachable();
       if (finish.status !== 200) return apiError(finish.json, "failed to encrypt the staged native login");
       finished = true;
@@ -140,8 +227,10 @@ export async function cmdNativeMainAccount(args: string[], deps: AccountDeps): P
       return exitCode === 0 ? 1 : exitCode;
     } finally {
       if (stageId && !finished) {
-        const cleanup = await apiJson(deps, baseUrl, "POST", "/api/native-main-profiles/stage/cancel", { stageId });
-        if (cleanup.status !== 200) console.error("Error: the proxy could not confirm native-login staging cleanup; run account main doctor.");
+        const cleanup = await apiJson(deps, baseUrl, "POST", "/api/native-main-profiles/stage/cancel", { stageId, writerToken });
+        if (cleanup.status !== 200 || cleanup.json.plaintextMayRemain === true) {
+          console.error("Error: the proxy could not confirm native-login staging cleanup; run account main doctor.");
+        }
       }
     }
   }
diff --git a/src/codex/native-profile-api.ts b/src/codex/native-profile-api.ts
index d43e981df..310d44512 100644
--- a/src/codex/native-profile-api.ts
+++ b/src/codex/native-profile-api.ts
@@ -151,23 +151,43 @@ export async function handleNativeProfileAPI(
       ), 200, req, config);
     }
     if (url.pathname === "/api/native-main-profiles/stage" && req.method === "POST") {
-      return jsonResponse(await withNativeMainApiOperation(manager, () => manager.prepareStage()), 200, req, config);
+      return jsonResponse(await withNativeMainApiOperation(
+        manager,
+        () => manager.prepareStage(),
+        { mode: "shared" },
+      ), 200, req, config);
+    }
+    if (url.pathname === "/api/native-main-profiles/stage/heartbeat" && req.method === "POST") {
+      const input = await body(req);
+      if (typeof input.stageId !== "string" || typeof input.writerToken !== "string") {
+        throw new NativeProfileError("INVALID_REQUEST", "A staging identifier and writer token are required.", 400);
+      }
+      return jsonResponse(await withNativeMainApiOperation(
+        manager,
+        () => manager.heartbeatStage(input.stageId as string, input.writerToken as string),
+      ), 200, req, config);
     }
     if (url.pathname === "/api/native-main-profiles/stage/finish" && req.method === "POST") {
       const input = await body(req);
-      if (typeof input.stageId !== "string" || typeof input.label !== "string") {
-        throw new NativeProfileError("INVALID_REQUEST", "A staging identifier and profile label are required.", 400);
+      if (typeof input.stageId !== "string" || typeof input.writerToken !== "string" || typeof input.label !== "string") {
+        throw new NativeProfileError("INVALID_REQUEST", "A staging identifier, writer token, and profile label are required.", 400);
       }
       return jsonResponse(await withNativeMainApiOperation(
         manager,
-        () => manager.finishStage(input.stageId as string, input.label as string),
+        () => manager.finishStage(input.stageId as string, input.writerToken as string, input.label as string),
+        { mode: "shared" },
       ), 200, req, config);
     }
     if (url.pathname === "/api/native-main-profiles/stage/cancel" && req.method === "POST") {
       const input = await body(req);
-      if (typeof input.stageId !== "string") throw new NativeProfileError("INVALID_REQUEST", "A staging identifier is required.", 400);
-      await withNativeMainApiOperation(manager, () => manager.cancelStage(input.stageId as string));
-      return jsonResponse({ ok: true }, 200, req, config);
+      if (typeof input.stageId !== "string" || typeof input.writerToken !== "string") {
+        throw new NativeProfileError("INVALID_REQUEST", "A staging identifier and writer token are required.", 400);
+      }
+      const cleanup = await withNativeMainApiOperation(
+        manager,
+        () => manager.cancelStage(input.stageId as string, input.writerToken as string),
+      );
+      return jsonResponse({ ok: true, ...cleanup }, 200, req, config);
     }
     if (url.pathname === "/api/native-main-profiles/switch" && req.method === "POST") {
       const input = await body(req);
@@ -212,6 +232,7 @@ export async function handleNativeProfileAPI(
         code: error.code,
         retryable: error.retryable,
         ...(error.cleanupRequired === true ? { cleanupRequired: true } : {}),
+        ...(typeof error.plaintextMayRemain === "boolean" ? { plaintextMayRemain: error.plaintextMayRemain } : {}),
       }, error.status, req, config);
     }
     return jsonResponse({ error: "Native-profile operation failed.", code: "INTERNAL_ERROR" }, 500, req, config);
diff --git a/src/codex/native-profile-manager.ts b/src/codex/native-profile-manager.ts
index ebe4c3dc0..d5849c686 100644
--- a/src/codex/native-profile-manager.ts
+++ b/src/codex/native-profile-manager.ts
@@ -61,9 +61,15 @@ import {
   type NativeProfilePublic,
   type NativeProfileSwitchJournalV1,
 } from "./native-profile-types";
+import {
+  NATIVE_STAGE_HEARTBEAT_INTERVAL_MS,
+  NativeProfileStageStore,
+  type NativeStageProof,
+  type NativeStageTerminalOutcome,
+} from "./native-profile-stage-store";
 
 const LOCK_WAIT_MS = 5_000;
-const STAGE_MAX_AGE_MS = 30 * 60_000;
+const LEGACY_STAGE_MAX_AGE_MS = 30 * 60_000;
 const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 
 interface PathIdentity {
@@ -97,6 +103,7 @@ export interface NativeProfileManagerOptions {
   lockWaitMs?: number;
   onLockAcquired?: () => void | Promise<void>;
   removeStageTree?: (path: string) => void;
+  stageLeaseMs?: number;
   /** Test-only crash seam; production never supplies this callback. */
   onSwitchBoundary?: (boundary: NativeProfileSwitchBoundary) => void | Promise<void>;
   /** Test-only reader seams; production uses the native profile store directly. */
@@ -111,6 +118,18 @@ export interface NativeProfileListResult {
   profiles: NativeProfilePublic[];
 }
 
+export interface NativeStageCleanupResult {
+  removed: boolean;
+  plaintextMayRemain: boolean;
+}
+
+export interface NativeStageSweepResult {
+  removed: number;
+  live: number;
+  cleanupFailed: number;
+  plaintextMayRemain: boolean;
+}
+
 async function hardenNativeProfilePath(path: string): Promise<void> {
   const entry = lstatSync(path);
   if (entry.isSymbolicLink() || (!entry.isDirectory() && !entry.isFile())) {
@@ -179,6 +198,7 @@ export class NativeProfileManager {
   private readonly readEnvelope: EnvelopeReader;
   private readonly readVault: VaultReader;
   private readonly readEnvelopeResult: EnvelopeResultReader;
+  private readonly stageStore: NativeProfileStageStore;
   private activeRootIdentity: PathIdentity | null = null;
   private activeLockIdentity: PathIdentity | null = null;
 
@@ -199,6 +219,14 @@ export class NativeProfileManager {
     this.readEnvelope = options.readEnvelope ?? readNativeEnvelope;
     this.readVault = options.readVault ?? (() => readNativeProfileVault(this.context));
     this.readEnvelopeResult = options.readEnvelopeResult ?? readNativeEnvelopeResult;
+    this.stageStore = new NativeProfileStageStore({
+      context: this.context,
+      now: this.now,
+      randomUUID: this.uuid,
+      atomicWrite: this.atomicWrite,
+      hardenPath: this.hardenPath,
+      leaseMs: options.stageLeaseMs,
+    });
   }
 
   private async ensureRoot(): Promise<PathIdentity> {
@@ -540,7 +568,8 @@ export class NativeProfileManager {
     return this.withLock(async () => {
     let stagingSweep: "ok" | "cleanup-required" | "unreadable" = "ok";
     try {
-      this.sweepStaleStages();
+      const sweep = await this.sweepStagesLocked();
+      if (sweep.cleanupFailed > 0) stagingSweep = "cleanup-required";
     } catch (error) {
       stagingSweep = error instanceof NativeProfileError && error.code === "STAGING_CLEANUP_REQUIRED"
         ? "cleanup-required"
@@ -569,9 +598,8 @@ export class NativeProfileManager {
       }
       let stagingCount: number | null = 0;
       try {
-        if (existsSync(this.context.stagingRoot)) {
-          stagingCount = Array.from(new Bun.Glob("*").scanSync({ cwd: this.context.stagingRoot, onlyFiles: false })).length;
-        }
+        stagingCount = this.stageStore.records().length;
+        if (existsSync(this.context.stagingRoot)) stagingCount += Array.from(new Bun.Glob("*").scanSync({ cwd: this.context.stagingRoot, onlyFiles: false })).filter(name => !UUID_RE.test(name) || !this.stageStore.recordForStage(name)).length;
       } catch {
         stagingSweep = "unreadable";
         stagingCount = null;
@@ -639,33 +667,6 @@ export class NativeProfileManager {
     this.assertStagingLayout(true);
   }
 
-  private verifiedStagePath(stageId: string, requireFresh = true): { path: string; identity: PathIdentity } {
-    this.assertStagingLayout(true);
-    const expected = resolve(this.stagePath(stageId));
-    try {
-      const entry = lstatSync(expected);
-      if (entry.isSymbolicLink() || !entry.isDirectory()) throw new Error("stage type");
-      const identity = pathIdentity(expected);
-      const canonicalRoot = resolve(realpathSync.native(this.context.stagingRoot));
-      const canonicalExpected = resolve(realpathSync.native(expected));
-      const rel = relative(canonicalRoot, canonicalExpected);
-      if (!rel || rel.startsWith("..") || rel.includes(sep)) throw new Error("stage root");
-      const metadata = JSON.parse(readFileSync(join(canonicalExpected, "stage.json"), "utf8")) as Record<string, unknown>;
-      if (
-        metadata.version !== 1
-        || metadata.stageId !== stageId
-        || metadata.homeId !== this.context.homeId
-        || metadata.instanceId !== this.context.instanceId
-      ) throw new Error("stage metadata");
-      if (typeof metadata.createdAt !== "number") throw new Error("stage age");
-      if (requireFresh && this.now() - metadata.createdAt > STAGE_MAX_AGE_MS) throw new Error("stage age");
-      assertPathIdentity(canonicalExpected, identity, "The native-login staging directory");
-      return { path: canonicalExpected, identity };
-    } catch {
-      throw new NativeProfileError("STAGING_NOT_FOUND", "The native-login staging session is missing, expired, or invalid.", 404);
-    }
-  }
-
   private deleteStage(path: string, identity?: PathIdentity): void {
     if (identity) assertPathIdentity(path, identity, "The native-login staging directory");
     const authPath = join(path, "auth.json");
@@ -690,6 +691,7 @@ export class NativeProfileManager {
         500,
         false,
         true,
+        true,
       );
       unlinkSync(authPath);
       const unlinked = fstatSync(authFd, { bigint: true });
@@ -700,6 +702,7 @@ export class NativeProfileManager {
           500,
           false,
           true,
+          true,
         );
       }
       ftruncateSync(authFd, 0);
@@ -712,6 +715,7 @@ export class NativeProfileManager {
           500,
           false,
           true,
+          true,
         );
       }
     } finally {
@@ -721,7 +725,7 @@ export class NativeProfileManager {
     this.removeStageTree(path);
   }
 
-  private deleteStageById(stageId: string, requirePresent = false): void {
+  private deleteLegacyStageById(stageId: string, requirePresent = false): void {
     this.assertStagingLayout(true);
     const expected = resolve(this.stagePath(stageId));
     let stageStat: ReturnType<typeof lstatSync>;
@@ -733,91 +737,236 @@ export class NativeProfileManager {
       throw error;
     }
     if (stageStat.isSymbolicLink() || !stageStat.isDirectory()) {
-      unlinkSync(expected);
-      return;
+      throw new NativeProfileError(
+        "PROFILE_STORAGE_UNSAFE",
+        "The native-login staging path is not a private directory.",
+        409,
+        false,
+        true,
+        true,
+      );
     }
     const canonicalRoot = resolve(realpathSync.native(this.context.stagingRoot));
     const canonicalExpected = resolve(realpathSync.native(expected));
     const rel = relative(canonicalRoot, canonicalExpected);
     if (!rel || rel.startsWith("..") || rel.includes(sep)) {
-      throw new NativeProfileError("STAGING_CLEANUP_REQUIRED", "The staging path could not be safely removed.", 500);
+      throw new NativeProfileError("STAGING_CLEANUP_REQUIRED", "The staging path could not be safely removed.", 500, false, true, true);
     }
     this.deleteStage(canonicalExpected, pathIdentity(canonicalExpected));
   }
 
-  private sweepStaleStages(): number {
-    if (!existsSync(this.context.stagingRoot)) return 0;
-    this.assertStagingLayout(true);
+  private async cleanupRegisteredStage(
+    proof: NativeStageProof,
+    outcome: Exclude<NativeStageTerminalOutcome, null>,
+  ): Promise<NativeStageCleanupResult> {
+    let stageRemoved = false;
+    let plaintextMayRemain = true;
+    try {
+      this.deleteStage(proof.path, proof.identity);
+      stageRemoved = true;
+      plaintextMayRemain = false;
+    } catch (error) {
+      plaintextMayRemain = error instanceof NativeProfileError
+        ? error.plaintextMayRemain !== false
+        : false;
+    }
+    if (stageRemoved) {
+      try {
+        await this.stageStore.remove(proof);
+        return { removed: true, plaintextMayRemain: false };
+      } catch {
+        try { await this.stageStore.markCleanupRequired(proof, outcome); } catch { /* the cleanup result remains authoritative */ }
+        return { removed: false, plaintextMayRemain: false };
+      }
+    }
+    try { await this.stageStore.markCleanupRequired(proof, outcome); } catch { /* preserve the plaintext signal */ }
+    return { removed: false, plaintextMayRemain };
+  }
+
+  private async sweepStagesLocked(): Promise<NativeStageSweepResult> {
     let removed = 0;
-    for (const name of readdirSync(this.context.stagingRoot)) {
-      if (!UUID_RE.test(name)) continue;
-      const path = this.stagePath(name);
-      let createdAt: number;
+    let live = 0;
+    let cleanupFailed = 0;
+    let plaintextMayRemain = false;
+    const records = this.stageStore.records();
+    const registeredHere = new Set(
+      records
+        .filter(record => samePath(record.stagingRoot, this.context.stagingRoot))
+        .map(record => record.stageId),
+    );
+
+    for (const record of records) {
+      if (record.state === "open" && this.now() <= record.leaseExpiresAt) {
+        live += 1;
+        continue;
+      }
+      const outcome = record.terminalOutcome
+        ?? (record.state === "creating" ? "cancelled" : "expired");
+      let proof: NativeStageProof | null;
       try {
-        const stageStat = lstatSync(path);
-        createdAt = stageStat.mtimeMs;
-        if (stageStat.isDirectory() && !stageStat.isSymbolicLink()) {
+        proof = this.stageStore.proofForRecord(record, record.state === "creating");
+      } catch {
+        cleanupFailed += 1;
+        plaintextMayRemain = true;
+        try {
+          await this.stageStore.markCleanupRequired({ record }, outcome);
+        } catch { /* fail closed and report the unresolved plaintext boundary */ }
+        continue;
+      }
+      if (!proof) {
+        try {
+          await this.stageStore.remove({ record });
+          removed += 1;
+        } catch {
+          cleanupFailed += 1;
+        }
+        continue;
+      }
+      const cleanup = await this.cleanupRegisteredStage(proof, outcome);
+      if (cleanup.removed) removed += 1;
+      else cleanupFailed += 1;
+      plaintextMayRemain ||= cleanup.plaintextMayRemain;
+    }
+
+    if (existsSync(this.context.stagingRoot)) {
+      this.assertStagingLayout(true);
+      for (const name of readdirSync(this.context.stagingRoot)) {
+        if (!UUID_RE.test(name) || registeredHere.has(name)) continue;
+        const path = this.stagePath(name);
+        let createdAt: number;
+        try {
+          const entry = lstatSync(path);
+          if (!entry.isDirectory() || entry.isSymbolicLink()) {
+            cleanupFailed += 1;
+            plaintextMayRemain = true;
+            continue;
+          }
+          createdAt = entry.mtimeMs;
           try {
             const metadata = JSON.parse(readFileSync(join(path, "stage.json"), "utf8")) as Record<string, unknown>;
-            if (
-              metadata.version === 1
-              && metadata.stageId === name
-              && metadata.homeId === this.context.homeId
-              && metadata.instanceId === this.context.instanceId
-              && typeof metadata.createdAt === "number"
-            ) {
-              createdAt = metadata.createdAt;
-            }
-          } catch { /* mtime bounds malformed crash residue */ }
+            if (typeof metadata.createdAt === "number") createdAt = metadata.createdAt;
+          } catch { /* mtime bounds legacy crash residue */ }
+        } catch (error) {
+          if (errorCode(error) === "ENOENT") continue;
+          cleanupFailed += 1;
+          plaintextMayRemain = true;
+          continue;
+        }
+        if (this.now() - createdAt <= LEGACY_STAGE_MAX_AGE_MS) {
+          live += 1;
+          continue;
+        }
+        try {
+          this.deleteLegacyStageById(name);
+          removed += 1;
+        } catch (error) {
+          cleanupFailed += 1;
+          plaintextMayRemain ||= error instanceof NativeProfileError
+            ? error.plaintextMayRemain !== false
+            : true;
         }
-      } catch (error) {
-        if (errorCode(error) === "ENOENT") continue;
-        throw error;
-      }
-      if (this.now() - createdAt <= STAGE_MAX_AGE_MS) continue;
-      try {
-        this.deleteStageById(name);
-        removed += 1;
-      } catch {
-        throw new NativeProfileError("STAGING_CLEANUP_REQUIRED", "An expired native-login staging session could not be securely removed.", 500);
       }
     }
-    return removed;
+
+    return { removed, live, cleanupFailed, plaintextMayRemain };
+  }
+
+  async sweepStages(): Promise<NativeStageSweepResult> {
+    return this.withLock(() => this.sweepStagesLocked());
   }
 
-  async prepareStage(): Promise<{ stageId: string; stagingCodexHome: string; effectiveCodexHome: string }> {
+  async prepareStage(): Promise<{
+    stageId: string;
+    writerToken: string;
+    stagingCodexHome: string;
+    effectiveCodexHome: string;
+    leaseExpiresAt: number;
+    heartbeatIntervalMs: number;
+  }> {
     return this.withLock(async () => {
       this.assertNoPendingRecovery();
-      this.sweepStaleStages();
+      const sweep = await this.sweepStagesLocked();
+      if (sweep.plaintextMayRemain) {
+        throw new NativeProfileError(
+          "STAGING_CLEANUP_REQUIRED",
+          "An expired native-login staging session could not be securely removed.",
+          500,
+          true,
+          true,
+          true,
+        );
+      }
       requireFileCredentialStore(this.context);
       const vault = this.requireVault();
       let key: NativeProfileKey | null = null;
       let current: NativeEnvelopeSnapshot | null = null;
+      let reservation: Awaited<ReturnType<NativeProfileStageStore["reserve"]>> | null = null;
       try {
         key = await this.keyForVault(vault);
         current = this.readEnvelope(this.context.authPath);
         this.assertCurrentIdentity(vault, current, key);
         await this.ensureStagingRoot();
-        const stageId = this.uuid();
-        const path = this.stagePath(stageId);
-        mkdirSync(path, { mode: 0o700 });
-        try {
-          await this.hardenPath(path);
-          writeFileSync(join(path, "config.toml"), 'cli_auth_credentials_store = "file"\n', { mode: 0o600 });
-          await this.hardenPath(join(path, "config.toml"));
-          writeFileSync(join(path, "stage.json"), serializeNativeProfileMetadata({
-            version: 1,
-            stageId,
-            homeId: this.context.homeId,
-            instanceId: this.context.instanceId,
-            createdAt: this.now(),
-          }), { mode: 0o600 });
-          await this.hardenPath(join(path, "stage.json"));
-        } catch (error) {
-          try { rmSync(path, { recursive: true, force: true }); } catch { /* original error wins */ }
-          throw error;
+        reservation = await this.stageStore.reserve(this.context.stagingRoot);
+        mkdirSync(reservation.stagingCodexHome, { mode: 0o700 });
+        await this.hardenPath(reservation.stagingCodexHome);
+        writeFileSync(join(reservation.stagingCodexHome, "config.toml"), 'cli_auth_credentials_store = "file"\n', { mode: 0o600 });
+        await this.hardenPath(join(reservation.stagingCodexHome, "config.toml"));
+        writeFileSync(join(reservation.stagingCodexHome, "stage.json"), `${JSON.stringify({
+          version: 2,
+          stageId: reservation.stageId,
+          leaseId: reservation.leaseId,
+          homeId: this.context.homeId,
+          createdAt: this.now(),
+        }, null, 2)}\n`, { mode: 0o600 });
+        await this.hardenPath(join(reservation.stagingCodexHome, "stage.json"));
+        await this.stageStore.activate(reservation);
+        return {
+          stageId: reservation.stageId,
+          writerToken: reservation.writerToken,
+          stagingCodexHome: reservation.stagingCodexHome,
+          effectiveCodexHome: this.context.codexHome,
+          leaseExpiresAt: reservation.leaseExpiresAt,
+          heartbeatIntervalMs: NATIVE_STAGE_HEARTBEAT_INTERVAL_MS,
+        };
+      } catch (error) {
+        let plaintextMayRemain = false;
+        if (reservation) {
+          const record = this.stageStore.recordForStage(reservation.stageId);
+          if (record) {
+            try {
+              const proof = this.stageStore.proofForRecord(record, true);
+              if (proof) {
+                const cleanup = await this.cleanupRegisteredStage(proof, "cancelled");
+                plaintextMayRemain = cleanup.plaintextMayRemain;
+              } else {
+                await this.stageStore.remove({ record });
+              }
+            } catch {
+              plaintextMayRemain = true;
+            }
+          }
+        }
+        if (error instanceof NativeProfileError) {
+          throw new NativeProfileError(
+            error.code,
+            error.message,
+            error.status,
+            error.retryable,
+            plaintextMayRemain || error.cleanupRequired === true ? true : undefined,
+            plaintextMayRemain || error.plaintextMayRemain === true,
+          );
         }
-        return { stageId, stagingCodexHome: path, effectiveCodexHome: this.context.codexHome };
+        if (plaintextMayRemain) {
+          throw new NativeProfileError(
+            "STAGING_CLEANUP_REQUIRED",
+            "Native-login staging failed and plaintext may remain.",
+            500,
+            false,
+            true,
+            true,
+          );
+        }
+        throw error;
       } finally {
         current?.raw.fill(0);
         key?.key.fill(0);
@@ -825,28 +974,56 @@ export class NativeProfileManager {
     });
   }
 
-  async finishStage(stageId: string, labelInput: string): Promise<{ effectiveCodexHome: string; profile: NativeProfilePublic }> {
+  async heartbeatStage(stageId: string, writerToken: string): Promise<{ ok: true; leaseExpiresAt: number }> {
+    return this.withLock(async () => {
+      const proof = this.stageStore.verify(stageId, writerToken);
+      if (proof.expired) {
+        const cleanup = await this.cleanupRegisteredStage(proof, "expired");
+        throw new NativeProfileError(
+          "STAGING_EXPIRED",
+          "The native-login staging lease expired.",
+          410,
+          false,
+          cleanup.removed ? undefined : true,
+          cleanup.plaintextMayRemain,
+        );
+      }
+      const leaseExpiresAt = await this.stageStore.heartbeat(proof);
+      return { ok: true, leaseExpiresAt };
+    });
+  }
+
+  async finishStage(
+    stageId: string,
+    writerToken: string,
+    labelInput: string,
+  ): Promise<{ effectiveCodexHome: string; profile: NativeProfilePublic; plaintextMayRemain: false }> {
     return this.withLock(async () => {
-      this.stagePath(stageId);
-      // Establish that this stage belongs to the locked native home before
-      // claiming cleanup ownership. Freshness and every later failure are then
-      // server-authoritatively cleaned, while lock/ownership failures leave a
-      // stage that another valid operation may own untouched.
-      const ownedStage = this.verifiedStagePath(stageId, false);
+      const ownedStage = this.stageStore.verify(stageId, writerToken);
+      if (ownedStage.expired) {
+        const cleanup = await this.cleanupRegisteredStage(ownedStage, "expired");
+        throw new NativeProfileError(
+          "STAGING_EXPIRED",
+          "The native-login staging lease expired.",
+          410,
+          false,
+          cleanup.removed ? undefined : true,
+          cleanup.plaintextMayRemain,
+        );
+      }
       let target: NativeEnvelopeSnapshot | null = null;
       let current: NativeEnvelopeSnapshot | null = null;
       let key: NativeProfileKey | null = null;
       let operationFailed = false;
       let operationError: unknown;
       let importCommitted = false;
-      let result: { effectiveCodexHome: string; profile: NativeProfilePublic } | undefined;
+      let result: { effectiveCodexHome: string; profile: NativeProfilePublic; plaintextMayRemain: false } | undefined;
       try {
-        const verifiedStage = this.verifiedStagePath(stageId);
         this.assertNoPendingRecovery();
         requireFileCredentialStore(this.context);
         const label = validateNativeProfileLabel(labelInput);
-        target = readNativeEnvelope(join(verifiedStage.path, "auth.json"));
-        assertPathIdentity(verifiedStage.path, verifiedStage.identity, "The native-login staging directory");
+        target = readNativeEnvelope(join(ownedStage.path, "auth.json"));
+        assertPathIdentity(ownedStage.path, ownedStage.identity, "The native-login staging directory");
         current = readNativeEnvelope(this.context.authPath);
         const vault = this.requireVault();
         if (vault.profiles.length >= MAX_NATIVE_PROFILES) {
@@ -899,7 +1076,11 @@ export class NativeProfileManager {
         }
         await this.writeVault(prospectiveVault);
         importCommitted = true;
-        result = { effectiveCodexHome: this.context.codexHome, profile: publicNativeProfile(profile) };
+        result = {
+          effectiveCodexHome: this.context.codexHome,
+          profile: publicNativeProfile(profile),
+          plaintextMayRemain: false,
+        };
       } catch (error) {
         operationFailed = true;
         operationError = error;
@@ -908,57 +1089,67 @@ export class NativeProfileManager {
         current?.raw.fill(0);
         key?.key.fill(0);
       }
-      let cleanupFailed = false;
-      try {
-        this.deleteStage(ownedStage.path, ownedStage.identity);
-      } catch {
-        cleanupFailed = true;
-      }
+
+      const cleanup = await this.cleanupRegisteredStage(
+        ownedStage,
+        importCommitted ? "imported" : "rejected",
+      );
       if (operationFailed) {
-        if (cleanupFailed) {
-          if (operationError instanceof NativeProfileError) {
-            throw new NativeProfileError(
-              operationError.code,
-              operationError.message,
-              operationError.status,
-              operationError.retryable,
-              true,
-            );
-          }
+        if (operationError instanceof NativeProfileError) {
           throw new NativeProfileError(
-            "INTERNAL_ERROR",
-            "The native profile import failed and its staging session could not be securely removed.",
-            500,
-            false,
-            true,
+            operationError.code,
+            operationError.message,
+            operationError.status,
+            operationError.retryable,
+            cleanup.removed ? operationError.cleanupRequired : true,
+            cleanup.plaintextMayRemain,
           );
         }
-        throw operationError;
+        throw new NativeProfileError(
+          "INTERNAL_ERROR",
+          cleanup.removed
+            ? "The native profile import failed."
+            : "The native profile import failed and its staging session could not be securely removed.",
+          500,
+          false,
+          cleanup.removed ? undefined : true,
+          cleanup.plaintextMayRemain,
+        );
       }
-      if (cleanupFailed) {
+      if (!cleanup.removed) {
         throw new NativeProfileError(
           "STAGING_CLEANUP_REQUIRED",
           importCommitted
-            ? "The native profile was imported, but its staging session could not be securely removed. Do not retry the import; fix filesystem permissions and cancel it explicitly."
-            : "The native-login staging session could not be securely removed; fix filesystem permissions and cancel it explicitly.",
+            ? "The native profile was imported, but its staging session could not be securely removed. Do not retry the import; cancel it explicitly."
+            : "The native-login staging session could not be securely removed; cancel it explicitly.",
           500,
+          false,
+          importCommitted ? undefined : true,
+          cleanup.plaintextMayRemain,
         );
       }
       return result!;
     });
   }
 
-  async cancelStage(stageId: string): Promise<void> {
-    await this.withLock(async () => {
-      try {
-        this.deleteStageById(stageId, true);
-      } catch (error) {
-        if (error instanceof NativeProfileError) throw error;
-        throw new NativeProfileError("STAGING_CLEANUP_REQUIRED", "The native-login staging session could not be securely removed.", 500);
+  async cancelStage(stageId: string, writerToken: string): Promise<NativeStageCleanupResult> {
+    return this.withLock(async () => {
+      const proof = this.stageStore.verify(stageId, writerToken, true, true);
+      const outcome = proof.record.terminalOutcome ?? "cancelled";
+      const cleanup = await this.cleanupRegisteredStage(proof, outcome);
+      if (!cleanup.removed) {
+        throw new NativeProfileError(
+          "STAGING_CLEANUP_REQUIRED",
+          "The native-login staging session could not be securely removed.",
+          500,
+          true,
+          true,
+          cleanup.plaintextMayRemain,
+        );
       }
+      return cleanup;
     });
   }
-
   private resolveTarget(vault: NativeMainProfileVaultV1, target: string): NativeMainProfileRecordV1 {
     const normalized = target.trim().toLowerCase();
     const profile = vault.profiles.find(item => item.id.toLowerCase() === normalized || item.label.toLowerCase() === normalized);
@@ -984,7 +1175,7 @@ export class NativeProfileManager {
 
   async switch(targetSelector: string, confirmedStopped = false): Promise<Record<string, unknown>> {
     return this.withLock(async () => {
-      this.sweepStaleStages();
+      await this.sweepStagesLocked();
       requireFileCredentialStore(this.context);
       await this.assertNativeCodexStopped(confirmedStopped);
       if (probeNativeProfileRecoveryState(this.context) !== "none") await this.recoverLocked(false);
diff --git a/src/codex/native-profile-stage-store.ts b/src/codex/native-profile-stage-store.ts
new file mode 100644
index 000000000..d4ee17a87
--- /dev/null
+++ b/src/codex/native-profile-stage-store.ts
@@ -0,0 +1,387 @@
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import {
+  closeSync,
+  constants as fsConstants,
+  existsSync,
+  fstatSync,
+  lstatSync,
+  openSync,
+  readFileSync,
+  realpathSync,
+} from "node:fs";
+import { isAbsolute, join, relative, resolve, sep } from "node:path";
+
+import type { NativeProfileContext } from "./native-profile-store";
+import { NativeProfileError } from "./native-profile-types";
+
+export const NATIVE_STAGE_LEASE_MS = 30 * 60_000;
+export const NATIVE_STAGE_HEARTBEAT_INTERVAL_MS = 60_000;
+export const NATIVE_STAGE_SWEEP_INTERVAL_MS = 60_000;
+const MAX_STAGE_REGISTRY_BYTES = 1024 * 1024;
+const MAX_STAGES = 32;
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+const HASH_RE = /^[0-9a-f]{64}$/;
+const TOKEN_DOMAIN = "opencodex-native-stage-writer-v1\0";
+
+export type NativeStageState = "creating" | "open" | "cleanup-required";
+export type NativeStageTerminalOutcome = null | "imported" | "rejected" | "cancelled" | "expired";
+
+export interface NativeStageRecordV1 {
+  stageId: string;
+  leaseId: string;
+  writerTokenHash: string;
+  creatorInstanceId: string;
+  stagingRoot: string;
+  stagingRootDev: string;
+  stagingRootIno: string;
+  stageDev: string | null;
+  stageIno: string | null;
+  state: NativeStageState;
+  terminalOutcome: NativeStageTerminalOutcome;
+  createdAt: number;
+  lastHeartbeatAt: number;
+  leaseExpiresAt: number;
+}
+
+interface NativeStageRegistryV1 {
+  version: 1;
+  revision: number;
+  homeId: string;
+  stages: NativeStageRecordV1[];
+}
+
+export interface NativeStageProof {
+  record: NativeStageRecordV1;
+  path: string;
+  identity: { dev: bigint; ino: bigint };
+  expired: boolean;
+}
+
+export interface NativeStageReservation {
+  stageId: string;
+  leaseId: string;
+  writerToken: string;
+  stagingCodexHome: string;
+  leaseExpiresAt: number;
+}
+
+type AtomicWriter = (path: string, content: string) => Promise<void>;
+
+export interface NativeStageStoreOptions {
+  context: NativeProfileContext;
+  now: () => number;
+  randomUUID: () => string;
+  atomicWrite: AtomicWriter;
+  hardenPath: (path: string) => Promise<void>;
+  leaseMs?: number;
+}
+
+function storageUnsafe(message: string): NativeProfileError {
+  return new NativeProfileError("PROFILE_STORAGE_UNSAFE", message, 409, false, true, true);
+}
+
+function pathIdentity(path: string): { dev: bigint; ino: bigint } {
+  const entry = lstatSync(path, { bigint: true });
+  return { dev: entry.dev, ino: entry.ino };
+}
+
+function sameIdentity(entry: { dev: bigint; ino: bigint }, dev: string, ino: string): boolean {
+  return entry.dev.toString() === dev && entry.ino.toString() === ino;
+}
+
+function boundedRead(path: string): string {
+  let fd: number | undefined;
+  try {
+    const flags = process.platform === "win32"
+      ? fsConstants.O_RDONLY
+      : fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW;
+    fd = openSync(path, flags);
+    const opened = fstatSync(fd, { bigint: true });
+    const linked = lstatSync(path, { bigint: true });
+    if (
+      !opened.isFile()
+      || !linked.isFile()
+      || linked.isSymbolicLink()
+      || opened.dev !== linked.dev
+      || opened.ino !== linked.ino
+      || opened.size > BigInt(MAX_STAGE_REGISTRY_BYTES)
+    ) throw storageUnsafe("The native-login stage registry is not a bounded private file.");
+    return readFileSync(fd, "utf8");
+  } finally {
+    if (fd !== undefined) closeSync(fd);
+  }
+}
+
+function isInteger(value: unknown): value is number {
+  return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
+}
+
+function parseRecord(value: unknown): NativeStageRecordV1 {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("record");
+  const record = value as Record<string, unknown>;
+  const state = record.state;
+  const terminal = record.terminalOutcome;
+  if (
+    typeof record.stageId !== "string" || !UUID_RE.test(record.stageId)
+    || typeof record.leaseId !== "string" || !UUID_RE.test(record.leaseId)
+    || typeof record.writerTokenHash !== "string" || !HASH_RE.test(record.writerTokenHash)
+    || typeof record.creatorInstanceId !== "string" || !HASH_RE.test(record.creatorInstanceId)
+    || typeof record.stagingRoot !== "string" || !isAbsolute(record.stagingRoot)
+    || typeof record.stagingRootDev !== "string" || !/^\d+$/.test(record.stagingRootDev)
+    || typeof record.stagingRootIno !== "string" || !/^\d+$/.test(record.stagingRootIno)
+    || (record.stageDev !== null && (typeof record.stageDev !== "string" || !/^\d+$/.test(record.stageDev)))
+    || (record.stageIno !== null && (typeof record.stageIno !== "string" || !/^\d+$/.test(record.stageIno)))
+    || !["creating", "open", "cleanup-required"].includes(String(state))
+    || ![null, "imported", "rejected", "cancelled", "expired"].includes(terminal as never)
+    || !isInteger(record.createdAt)
+    || !isInteger(record.lastHeartbeatAt)
+    || !isInteger(record.leaseExpiresAt)
+    || record.lastHeartbeatAt < record.createdAt
+    || record.leaseExpiresAt < record.lastHeartbeatAt
+  ) throw new Error("record");
+  if (state === "open" && (record.stageDev === null || record.stageIno === null || terminal !== null)) throw new Error("record state");
+  if (state === "creating" && terminal !== null) throw new Error("record state");
+  if (state === "cleanup-required" && terminal === null) throw new Error("record state");
+  return record as unknown as NativeStageRecordV1;
+}
+
+function serializeRegistry(registry: NativeStageRegistryV1): string {
+  return `${JSON.stringify(registry, null, 2)}\n`;
+}
+
+function tokenHash(context: NativeProfileContext, stageId: string, leaseId: string, token: string): Buffer {
+  return createHash("sha256")
+    .update(TOKEN_DOMAIN)
+    .update(context.homeId)
+    .update("\0")
+    .update(stageId)
+    .update("\0")
+    .update(leaseId)
+    .update("\0")
+    .update(token)
+    .digest();
+}
+
+export class NativeProfileStageStore {
+  // Trust boundary: an authenticated OS user can rewrite their own files and is
+  // not treated as an adversarial tenant. Any link, type, or inode ambiguity
+  // that this process actually observes still fails closed before credential IO.
+  private readonly context: NativeProfileContext;
+  private readonly now: () => number;
+  private readonly uuid: () => string;
+  private readonly atomicWrite: AtomicWriter;
+  private readonly hardenPath: (path: string) => Promise<void>;
+  private readonly leaseMs: number;
+
+  constructor(options: NativeStageStoreOptions) {
+    this.context = options.context;
+    this.now = options.now;
+    this.uuid = options.randomUUID;
+    this.atomicWrite = options.atomicWrite;
+    this.hardenPath = options.hardenPath;
+    this.leaseMs = Math.max(1_000, options.leaseMs ?? NATIVE_STAGE_LEASE_MS);
+  }
+
+  private read(): NativeStageRegistryV1 {
+    if (!existsSync(this.context.stageRegistryPath)) {
+      return { version: 1, revision: 0, homeId: this.context.homeId, stages: [] };
+    }
+    try {
+      const parsed = JSON.parse(boundedRead(this.context.stageRegistryPath)) as Record<string, unknown>;
+      if (
+        parsed.version !== 1
+        || !isInteger(parsed.revision)
+        || parsed.homeId !== this.context.homeId
+        || !Array.isArray(parsed.stages)
+        || parsed.stages.length > MAX_STAGES
+      ) throw new Error("registry");
+      const stages = parsed.stages.map(parseRecord);
+      if (new Set(stages.map(stage => stage.stageId)).size !== stages.length) throw new Error("duplicate stage");
+      return { version: 1, revision: parsed.revision, homeId: this.context.homeId, stages };
+    } catch (error) {
+      if (error instanceof NativeProfileError) throw error;
+      throw storageUnsafe("The native-login stage registry is invalid.");
+    }
+  }
+
+  private async write(registry: NativeStageRegistryV1): Promise<void> {
+    registry.revision += 1;
+    await this.atomicWrite(this.context.stageRegistryPath, serializeRegistry(registry));
+    await this.hardenPath(this.context.stageRegistryPath);
+  }
+
+  private record(registry: NativeStageRegistryV1, stageId: string): NativeStageRecordV1 | undefined {
+    return registry.stages.find(stage => stage.stageId === stageId);
+  }
+
+  private assertToken(record: NativeStageRecordV1 | undefined, token: string): NativeStageRecordV1 {
+    const expected = record ? Buffer.from(record.writerTokenHash, "hex") : Buffer.alloc(32);
+    const actual = tokenHash(this.context, record?.stageId ?? "00000000-0000-4000-8000-000000000000", record?.leaseId ?? "00000000-0000-4000-8000-000000000000", token);
+    const valid = timingSafeEqual(expected, actual);
+    expected.fill(0);
+    actual.fill(0);
+    if (!record || !valid) throw new NativeProfileError("STAGING_NOT_FOUND", "The native-login staging session is missing or invalid.", 404);
+    return record;
+  }
+
+  private assertRoot(record: NativeStageRecordV1): void {
+    try {
+      const entry = lstatSync(record.stagingRoot, { bigint: true });
+      if (
+        !entry.isDirectory()
+        || entry.isSymbolicLink()
+        || resolve(realpathSync.native(record.stagingRoot)) !== resolve(record.stagingRoot)
+        || !sameIdentity({ dev: entry.dev, ino: entry.ino }, record.stagingRootDev, record.stagingRootIno)
+      ) throw new Error("root identity");
+    } catch {
+      throw storageUnsafe("The native-login staging root changed identity.");
+    }
+  }
+
+  stagePath(record: NativeStageRecordV1): string {
+    const path = resolve(join(record.stagingRoot, record.stageId));
+    const rel = relative(resolve(record.stagingRoot), path);
+    if (!rel || rel.startsWith("..") || rel.includes(sep)) throw storageUnsafe("The native-login staging path escaped its registered root.");
+    return path;
+  }
+
+  proofForRecord(record: NativeStageRecordV1, allowPartial = false): NativeStageProof | null {
+    this.assertRoot(record);
+    const path = this.stagePath(record);
+    if (!existsSync(path)) return null;
+    try {
+      const entry = lstatSync(path, { bigint: true });
+      if (!entry.isDirectory() || entry.isSymbolicLink()) throw new Error("stage type");
+      if (record.stageDev !== null && record.stageIno !== null && !sameIdentity({ dev: entry.dev, ino: entry.ino }, record.stageDev, record.stageIno)) {
+        throw new Error("stage identity");
+      }
+      if (!allowPartial) {
+        const markerPath = join(path, "stage.json");
+        const markerBefore = lstatSync(markerPath, { bigint: true });
+        if (!markerBefore.isFile() || markerBefore.isSymbolicLink() || markerBefore.size > 4096n) throw new Error("stage marker type");
+        const marker = JSON.parse(readFileSync(markerPath, "utf8")) as Record<string, unknown>;
+        const markerAfter = lstatSync(markerPath, { bigint: true });
+        if (markerAfter.dev !== markerBefore.dev || markerAfter.ino !== markerBefore.ino) throw new Error("stage marker identity");
+        if (
+          marker.version !== 2
+          || marker.stageId !== record.stageId
+          || marker.leaseId !== record.leaseId
+          || marker.homeId !== this.context.homeId
+        ) throw new Error("stage marker");
+      }
+      return {
+        record,
+        path,
+        identity: { dev: entry.dev, ino: entry.ino },
+        expired: this.now() > record.leaseExpiresAt,
+      };
+    } catch {
+      throw storageUnsafe("The native-login staging directory changed identity.");
+    }
+  }
+
+  async reserve(stagingRoot: string): Promise<NativeStageReservation> {
+    const registry = this.read();
+    if (registry.stages.length >= MAX_STAGES) throw new NativeProfileError("INVALID_REQUEST", "Native-login staging is limited to 32 concurrent sessions.", 400);
+    const canonicalRoot = resolve(realpathSync.native(stagingRoot));
+    const root = lstatSync(canonicalRoot, { bigint: true });
+    if (!root.isDirectory() || root.isSymbolicLink()) throw storageUnsafe("The native-login staging root is not a private directory.");
+    let stageId = this.uuid();
+    while (this.record(registry, stageId)) stageId = this.uuid();
+    const leaseId = this.uuid();
+    const writerToken = randomBytes(32).toString("base64url");
+    const now = this.now();
+    const digest = tokenHash(this.context, stageId, leaseId, writerToken);
+    const record: NativeStageRecordV1 = {
+      stageId,
+      leaseId,
+      writerTokenHash: digest.toString("hex"),
+      creatorInstanceId: this.context.instanceId,
+      stagingRoot: canonicalRoot,
+      stagingRootDev: root.dev.toString(),
+      stagingRootIno: root.ino.toString(),
+      stageDev: null,
+      stageIno: null,
+      state: "creating",
+      terminalOutcome: null,
+      createdAt: now,
+      lastHeartbeatAt: now,
+      leaseExpiresAt: now + this.leaseMs,
+    };
+    digest.fill(0);
+    registry.stages.push(record);
+    await this.write(registry);
+    return { stageId, leaseId, writerToken, stagingCodexHome: this.stagePath(record), leaseExpiresAt: record.leaseExpiresAt };
+  }
+
+  async activate(reservation: NativeStageReservation): Promise<void> {
+    const registry = this.read();
+    const record = this.assertToken(this.record(registry, reservation.stageId), reservation.writerToken);
+    if (record.state !== "creating" || record.leaseId !== reservation.leaseId) throw storageUnsafe("The native-login stage reservation changed state.");
+    const path = this.stagePath(record);
+    const identity = pathIdentity(path);
+    record.stageDev = identity.dev.toString();
+    record.stageIno = identity.ino.toString();
+    record.state = "open";
+    await this.write(registry);
+  }
+
+  verify(
+    stageId: string,
+    writerToken: string,
+    allowCleanupRequired = false,
+    allowInvalidMarker = false,
+  ): NativeStageProof {
+    if (!UUID_RE.test(stageId) || typeof writerToken !== "string" || writerToken.length < 32) {
+      throw new NativeProfileError("STAGING_NOT_FOUND", "The native-login staging session is missing or invalid.", 404);
+    }
+    const registry = this.read();
+    const record = this.assertToken(this.record(registry, stageId), writerToken);
+    if (record.creatorInstanceId !== this.context.instanceId) {
+      throw new NativeProfileError("STAGING_NOT_FOUND", "The native-login staging session is missing or invalid.", 404);
+    }
+    if (record.state === "creating" || (!allowCleanupRequired && record.state !== "open")) {
+      throw new NativeProfileError("STAGING_TERMINAL", "The native-login staging session is no longer writable.", 409, false, record.state === "cleanup-required" ? true : undefined, record.state === "cleanup-required" ? true : undefined);
+    }
+    const proof = this.proofForRecord(record, allowInvalidMarker);
+    if (!proof) throw new NativeProfileError("STAGING_NOT_FOUND", "The native-login staging session is missing or invalid.", 404);
+    return proof;
+  }
+
+  async heartbeat(proof: NativeStageProof): Promise<number> {
+    const registry = this.read();
+    const record = this.record(registry, proof.record.stageId);
+    if (!record || record.leaseId !== proof.record.leaseId || record.state !== "open") throw storageUnsafe("The native-login stage lease changed during heartbeat.");
+    const now = this.now();
+    record.lastHeartbeatAt = now;
+    record.leaseExpiresAt = now + this.leaseMs;
+    await this.write(registry);
+    this.proofForRecord(record);
+    return record.leaseExpiresAt;
+  }
+
+  async markCleanupRequired(proof: Pick<NativeStageProof, "record">, outcome: Exclude<NativeStageTerminalOutcome, null>): Promise<void> {
+    const registry = this.read();
+    const record = this.record(registry, proof.record.stageId);
+    if (!record || record.leaseId !== proof.record.leaseId) return;
+    record.state = "cleanup-required";
+    record.terminalOutcome = outcome;
+    await this.write(registry);
+  }
+
+  async remove(proof: Pick<NativeStageProof, "record">): Promise<void> {
+    const registry = this.read();
+    const index = registry.stages.findIndex(stage => stage.stageId === proof.record.stageId && stage.leaseId === proof.record.leaseId);
+    if (index < 0) return;
+    registry.stages.splice(index, 1);
+    await this.write(registry);
+  }
+
+  records(): NativeStageRecordV1[] {
+    return this.read().stages;
+  }
+
+  recordForStage(stageId: string): NativeStageRecordV1 | undefined {
+    return this.read().stages.find(stage => stage.stageId === stageId);
+  }
+}
diff --git a/src/codex/native-profile-startup.ts b/src/codex/native-profile-startup.ts
index 9e4a54e9f..7f61680a2 100644
--- a/src/codex/native-profile-startup.ts
+++ b/src/codex/native-profile-startup.ts
@@ -14,13 +14,14 @@ import {
 } from "./native-main-owner";
 import { withNativeMainExclusiveClaim } from "./native-main-claim";
 import { scrubNativeMainAuthTempResidues } from "./native-main-auth-temp";
+import { NATIVE_STAGE_SWEEP_INTERVAL_MS } from "./native-profile-stage-store";
 
 export type NativeMainStartupGateSnapshot =
   | { status: "ready"; homeId: string | null }
   | {
       status: "blocked";
       homeId: string;
-      reason: "recovery-pending" | "manual-recovery" | "owner-conflict" | "owner-unavailable";
+      reason: "recovery-pending" | "manual-recovery" | "owner-conflict" | "owner-unavailable" | "stage-cleanup-required";
     };
 
 export interface NativeMainStartupGateDeps {
@@ -29,6 +30,7 @@ export interface NativeMainStartupGateDeps {
   beforeRecovery?: () => void | Promise<void>;
   probeRecoveryState?: typeof probeNativeProfileRecoveryState;
   owner?: NativeMainOwnerOptions;
+  stageSweepIntervalMs?: number;
 }
 
 export interface NativeMainStartupLifecycle {
@@ -51,6 +53,9 @@ interface StartupEntry {
   resolveAcquisition?: (value: NativeMainStartupGateSnapshot) => void;
   deps: NativeMainStartupGateDeps;
   manager: NativeProfileManager;
+  sweepTimer?: ReturnType<typeof setTimeout>;
+  sweepInFlight?: Promise<void>;
+  sweepStopping: boolean;
 }
 const startupEntries = new Map<string, StartupEntry>();
 const serverLifecycles = new WeakMap<object, NativeMainStartupLifecycle>();
@@ -123,6 +128,37 @@ function ownerBlockedReason(owner: NativeMainOwnerSnapshot): "owner-conflict" |
   return owner.status === "unavailable" ? "owner-unavailable" : "owner-conflict";
 }
 
+async function runOwnedStageSweep(entry: StartupEntry): Promise<boolean> {
+  if (typeof (entry.manager as Partial<NativeProfileManager>).sweepStages !== "function") return true;
+  try {
+    const result = await withNativeMainOwnerOperation(entry.manager.context, () => entry.manager.sweepStages());
+    return !result.plaintextMayRemain;
+  } catch {
+    return false;
+  }
+}
+
+function scheduleStageSweep(entry: StartupEntry): void {
+  if (entry.sweepStopping || entry.sweepTimer || startupEntries.get(entry.homeId) !== entry) return;
+  const intervalMs = Math.max(10, entry.deps.stageSweepIntervalMs ?? NATIVE_STAGE_SWEEP_INTERVAL_MS);
+  entry.sweepTimer = setTimeout(() => {
+    entry.sweepTimer = undefined;
+    if (entry.sweepStopping || startupEntries.get(entry.homeId) !== entry) return;
+    entry.sweepInFlight = (async () => {
+      const safe = await runOwnedStageSweep(entry);
+      if (entry.sweepStopping || startupEntries.get(entry.homeId) !== entry) return;
+      if (!safe) snapshot = { status: "blocked", homeId: entry.homeId, reason: "stage-cleanup-required" };
+      else if (snapshot.homeId === entry.homeId && snapshot.status === "blocked" && snapshot.reason === "stage-cleanup-required") {
+        snapshot = ready(entry.homeId);
+      }
+    })().finally(() => {
+      entry.sweepInFlight = undefined;
+      scheduleStageSweep(entry);
+    });
+  }, intervalMs);
+  entry.sweepTimer.unref?.();
+}
+
 function convergeOwnedStartup(entry: StartupEntry): void {
   if (entry.recoveryStarted) return;
   entry.recoveryStarted = true;
@@ -147,9 +183,12 @@ function convergeOwnedStartup(entry: StartupEntry): void {
         },
         { waitMs: 10_000 },
       ));
-      if (startupEntries.get(entry.homeId) === entry && entry.epoch === currentEpoch && recoveryState === "none") {
+      const stageSweepSafe = recoveryState === "none" ? await runOwnedStageSweep(entry) : false;
+      if (startupEntries.get(entry.homeId) === entry && entry.epoch === currentEpoch && recoveryState === "none" && stageSweepSafe) {
         clearAccountNeedsReauth(MAIN_CODEX_ACCOUNT_ID);
         snapshot = ready(entry.homeId);
+      } else if (startupEntries.get(entry.homeId) === entry && entry.epoch === currentEpoch && recoveryState === "none") {
+        snapshot = { status: "blocked", homeId: entry.homeId, reason: "stage-cleanup-required" };
       } else if (startupEntries.get(entry.homeId) === entry && entry.epoch === currentEpoch) {
         snapshot = { status: "blocked", homeId: entry.homeId, reason: "manual-recovery" };
       }
@@ -158,6 +197,7 @@ function convergeOwnedStartup(entry: StartupEntry): void {
         snapshot = { status: "blocked", homeId: entry.homeId, reason: "manual-recovery" };
       }
     }
+    if (startupEntries.get(entry.homeId) === entry && entry.epoch === currentEpoch) scheduleStageSweep(entry);
     return snapshot;
   })();
   if (acquisitionWaiter) void entry.settled.then(acquisitionWaiter);
@@ -214,6 +254,7 @@ export function startNativeMainStartupLifecycle(
       resolveAcquisition,
       deps,
       manager,
+      sweepStopping: false,
     };
     startupEntries.set(homeId, entry);
     entry.unsubscribe = owner.subscribe(ownerState => observeOwner(entry!, ownerState));
@@ -229,6 +270,10 @@ export function startNativeMainStartupLifecycle(
       entry!.refs = Math.max(0, entry!.refs - 1);
       if (entry!.refs !== 0) return;
       entry!.epoch += 1;
+      entry!.sweepStopping = true;
+      if (entry!.sweepTimer) clearTimeout(entry!.sweepTimer);
+      entry!.sweepTimer = undefined;
+      if (entry!.sweepInFlight) await Promise.allSettled([entry!.sweepInFlight]);
       entry!.unsubscribe();
       startupEntries.delete(homeId);
       entry!.resolveAcquisition?.(snapshot);
diff --git a/src/codex/native-profile-store.ts b/src/codex/native-profile-store.ts
index df13785c0..77f6b38cb 100644
--- a/src/codex/native-profile-store.ts
+++ b/src/codex/native-profile-store.ts
@@ -62,6 +62,7 @@ export interface NativeProfileContext {
   vaultPath: string;
   journalPath: string;
   recoveryBlockPath: string;
+  stageRegistryPath: string;
   lockPath: string;
 }
 
@@ -370,6 +371,7 @@ export function resolveNativeProfileContext(options: { codexHome?: string; confi
     vaultPath: join(rootDir, `${homeId}.vault.json`),
     journalPath: join(rootDir, `${homeId}.journal.json`),
     recoveryBlockPath: join(rootDir, `${homeId}.recovery-block.json`),
+    stageRegistryPath: join(rootDir, `${homeId}.stages.json`),
     lockPath: join(codexHome, ".opencodex-native-profile.lock.sqlite"),
   };
 }
diff --git a/src/codex/native-profile-types.ts b/src/codex/native-profile-types.ts
index b7e879a07..43d3bc32d 100644
--- a/src/codex/native-profile-types.ts
+++ b/src/codex/native-profile-types.ts
@@ -25,6 +25,8 @@ export type NativeProfileErrorCode =
   | "AUTH_RESTORE_FAILED"
   | "SWITCH_ROLLED_BACK"
   | "STAGING_NOT_FOUND"
+  | "STAGING_EXPIRED"
+  | "STAGING_TERMINAL"
   | "STAGING_CLEANUP_REQUIRED"
   | "PROFILE_METADATA_TOO_LARGE"
   | "PROFILE_STORAGE_UNSAFE"
@@ -39,6 +41,7 @@ export class NativeProfileError extends Error {
     readonly status = 409,
     readonly retryable = false,
     readonly cleanupRequired?: true,
+    readonly plaintextMayRemain?: boolean,
   ) {
     super(message);
     this.name = "NativeProfileError";
diff --git a/tests/cli-native-profile.test.ts b/tests/cli-native-profile.test.ts
index 2cf490ee9..9b1a63afd 100644
--- a/tests/cli-native-profile.test.ts
+++ b/tests/cli-native-profile.test.ts
@@ -114,7 +114,7 @@ describe("ocx account main", () => {
         return Response.json({ effectiveCodexHome: effectiveHome, profile: { id: "p1", label: "personal", identityHint: "account-87654321", state: "active" } });
       }
       if (url.pathname.endsWith("/stage") && !url.pathname.endsWith("/finish")) {
-        return Response.json({ stageId: "11111111-1111-4111-8111-111111111111", stagingCodexHome: stagingHome, effectiveCodexHome: effectiveHome });
+        return Response.json({ stageId: "11111111-1111-4111-8111-111111111111", writerToken: "writer-token-11111111111111111111111111111111", stagingCodexHome: stagingHome, effectiveCodexHome: effectiveHome, leaseExpiresAt: Date.now() + 30 * 60_000, heartbeatIntervalMs: 5_000 });
       }
       if (url.pathname.endsWith("/stage/finish")) {
         return Response.json({ effectiveCodexHome: effectiveHome, profile: { id: "p2", label: "work", identityHint: "account-12345678", state: "inactive" } });
@@ -138,6 +138,7 @@ describe("ocx account main", () => {
     expect(loginHome).toBe(stagingHome);
     expect(requests.find(request => request.path.endsWith("/stage/finish"))?.body).toEqual({
       stageId: "11111111-1111-4111-8111-111111111111",
+      writerToken: "writer-token-11111111111111111111111111111111",
       label: "work",
     });
     expect(JSON.stringify(requests)).not.toContain("access_token");
@@ -203,7 +204,7 @@ describe("ocx account main", () => {
       const path = new URL(String(input)).pathname;
       requests.push(path);
       if (path.endsWith("/stage") && !path.endsWith("/finish")) {
-        return Response.json({ stageId: "22222222-2222-4222-8222-222222222222", stagingCodexHome: stagingHome });
+        return Response.json({ stageId: "22222222-2222-4222-8222-222222222222", writerToken: "writer-token-22222222222222222222222222222222", stagingCodexHome: stagingHome, leaseExpiresAt: Date.now() + 30 * 60_000, heartbeatIntervalMs: 5_000 });
       }
       if (path.endsWith("/stage/finish")) {
         return Response.json({ error: "validation failed", code: "AUTH_INVALID" }, { status: 409 });
@@ -218,6 +219,7 @@ describe("ocx account main", () => {
     })).toBe(1);
     expect(requests).toEqual([
       "/api/native-main-profiles/stage",
+      "/api/native-main-profiles/stage/heartbeat",
       "/api/native-main-profiles/stage/finish",
       "/api/native-main-profiles/stage/cancel",
     ]);
@@ -232,7 +234,7 @@ describe("ocx account main", () => {
       const path = new URL(String(input)).pathname;
       requests.push(path);
       if (path.endsWith("/stage") && !path.endsWith("/finish")) {
-        return Response.json({ stageId: "44444444-4444-4444-8444-444444444444", stagingCodexHome: stagingHome });
+        return Response.json({ stageId: "44444444-4444-4444-8444-444444444444", writerToken: "writer-token-44444444444444444444444444444444", stagingCodexHome: stagingHome, leaseExpiresAt: Date.now() + 30 * 60_000, heartbeatIntervalMs: 5_000 });
       }
       if (path.endsWith("/stage/finish")) throw new TypeError("connection closed before response");
       return Response.json({ ok: true });
@@ -245,6 +247,7 @@ describe("ocx account main", () => {
     })).toBe(1);
     expect(requests).toEqual([
       "/api/native-main-profiles/stage",
+      "/api/native-main-profiles/stage/heartbeat",
       "/api/native-main-profiles/stage/finish",
       "/api/native-main-profiles/stage/cancel",
     ]);
@@ -260,7 +263,7 @@ describe("ocx account main", () => {
       const path = new URL(String(input)).pathname;
       requests.push(path);
       if (path.endsWith("/stage") && !path.endsWith("/finish")) {
-        return Response.json({ stageId: "33333333-3333-4333-8333-333333333333", stagingCodexHome: stagingHome, effectiveCodexHome: effectiveHome });
+        return Response.json({ stageId: "33333333-3333-4333-8333-333333333333", writerToken: "writer-token-33333333333333333333333333333333", stagingCodexHome: stagingHome, effectiveCodexHome: effectiveHome, leaseExpiresAt: Date.now() + 30 * 60_000, heartbeatIntervalMs: 5_000 });
       }
       return Response.json({ ok: true });
     };
@@ -272,8 +275,57 @@ describe("ocx account main", () => {
     })).toBe(1);
     expect(requests).toEqual([
       "/api/native-main-profiles/stage",
+      "/api/native-main-profiles/stage/heartbeat",
       "/api/native-main-profiles/stage/cancel",
     ]);
     expect(errors).toContain(`Effective CODEX_HOME: ${effectiveHome}`);
   });
+
+  test("heartbeats only while the configured Codex login child is alive", async () => {
+    const stagingHome = join(tmpdir(), "ocx-native-profile-stage-heartbeat-child");
+    const writerToken = "writer-token-child-lifetime-111111111111111111111111";
+    const requests: Array<{ path: string; body?: Record<string, unknown> }> = [];
+    let resolveExit!: (code: number) => void;
+    const exited = new Promise<number>(resolve => { resolveExit = resolve; });
+    let resolveTwoHeartbeats!: () => void;
+    const twoHeartbeats = new Promise<void>(resolve => { resolveTwoHeartbeats = resolve; });
+    const fetchImpl: typeof fetch = async (input, init) => {
+      const path = new URL(String(input)).pathname;
+      const body = typeof init?.body === "string" ? JSON.parse(init.body) as Record<string, unknown> : undefined;
+      requests.push({ path, body });
+      if (path.endsWith("/stage") && !path.endsWith("/finish")) {
+        return Response.json({
+          stageId: "55555555-5555-4555-8555-555555555555",
+          writerToken,
+          stagingCodexHome: stagingHome,
+          leaseExpiresAt: Date.now() + 30 * 60_000,
+          heartbeatIntervalMs: 10,
+        });
+      }
+      if (path.endsWith("/stage/heartbeat")) {
+        if (requests.filter(request => request.path.endsWith("/stage/heartbeat")).length >= 2) resolveTwoHeartbeats();
+        return Response.json({ ok: true, leaseExpiresAt: Date.now() + 30 * 60_000 });
+      }
+      if (path.endsWith("/stage/finish")) return Response.json({ effectiveCodexHome: "test-home", profile: {}, plaintextMayRemain: false });
+      return Response.json({ ok: true, removed: true, plaintextMayRemain: false });
+    };
+
+    const running = cmdAccount(["main", "add", "work"], {
+      baseUrl: "http://127.0.0.1:10100",
+      fetchImpl,
+      stageHeartbeatIntervalMinMs: 10,
+      spawnCodexLoginImpl: () => ({ exited, kill: () => {} }),
+    });
+    await twoHeartbeats;
+    resolveExit(0);
+    expect(await running).toBe(0);
+    const heartbeatCount = requests.filter(request => request.path.endsWith("/stage/heartbeat")).length;
+    await Bun.sleep(35);
+    expect(requests.filter(request => request.path.endsWith("/stage/heartbeat"))).toHaveLength(heartbeatCount);
+    expect(requests.find(request => request.path.endsWith("/stage/finish"))?.body).toEqual({
+      stageId: "55555555-5555-4555-8555-555555555555",
+      writerToken,
+      label: "work",
+    });
+  });
 });
diff --git a/tests/native-main-owner-lifetime.test.ts b/tests/native-main-owner-lifetime.test.ts
index ffa2793e9..7fd0fdd27 100644
--- a/tests/native-main-owner-lifetime.test.ts
+++ b/tests/native-main-owner-lifetime.test.ts
@@ -348,7 +348,7 @@ describe("native-main process owner lease", () => {
     const source = await f.manager.register("source");
     const stage = await f.manager.prepareStage();
     writeFileSync(join(stage.stagingCodexHome, "auth.json"), auth("account-target", "target"));
-    const target = await f.manager.finishStage(stage.stageId, "target");
+    const target = await f.manager.finishStage(stage.stageId, stage.writerToken, "target");
     expect(source.profile.state).toBe("active");
 
     const successorFixture = { ...f };
diff --git a/tests/native-profile-api.test.ts b/tests/native-profile-api.test.ts
index 3e3c9b7f5..96ea74916 100644
--- a/tests/native-profile-api.test.ts
+++ b/tests/native-profile-api.test.ts
@@ -186,7 +186,7 @@ describe("native main profile management API", () => {
     } as unknown as NativeProfileManager;
     const request = new Request("http://localhost/api/native-main-profiles/stage/finish", {
       method: "POST",
-      body: JSON.stringify({ stageId: "11111111-1111-4111-8111-111111111111", label: "work" }),
+      body: JSON.stringify({ stageId: "11111111-1111-4111-8111-111111111111", writerToken: "writer-token", label: "work" }),
     });
 
     const response = await handleNativeProfileAPI(request, new URL(request.url), {} as OcxConfig, { manager });
@@ -201,12 +201,12 @@ describe("native main profile management API", () => {
     const message = "The staged native login is invalid.";
     const manager = {
       finishStage: async () => {
-        throw new NativeProfileError("AUTH_INVALID", message, 422, true, true);
+        throw new NativeProfileError("AUTH_INVALID", message, 422, true, true, true);
       },
     } as unknown as NativeProfileManager;
     const request = new Request("http://localhost/api/native-main-profiles/stage/finish", {
       method: "POST",
-      body: JSON.stringify({ stageId: "11111111-1111-4111-8111-111111111111", label: "work" }),
+      body: JSON.stringify({ stageId: "11111111-1111-4111-8111-111111111111", writerToken: "writer-token", label: "work" }),
     });
 
     const response = await handleNativeProfileAPI(request, new URL(request.url), {} as OcxConfig, { manager });
@@ -217,6 +217,7 @@ describe("native main profile management API", () => {
       code: "AUTH_INVALID",
       retryable: true,
       cleanupRequired: true,
+      plaintextMayRemain: true,
     });
   });
 
diff --git a/tests/native-profile-crash-boundaries.test.ts b/tests/native-profile-crash-boundaries.test.ts
index 599f680b0..68abcd9f3 100644
--- a/tests/native-profile-crash-boundaries.test.ts
+++ b/tests/native-profile-crash-boundaries.test.ts
@@ -58,7 +58,7 @@ async function fixture() {
   const sourceProfile = (await manager.register("source")).profile;
   const stage = await manager.prepareStage();
   writeFileSync(join(stage.stagingCodexHome, "auth.json"), target);
-  const targetProfile = (await manager.finishStage(stage.stageId, "target")).profile;
+  const targetProfile = (await manager.finishStage(stage.stageId, stage.writerToken, "target")).profile;
   const initialRevision = readNativeProfileVault(manager.context)!.revision;
 
   process.env.OPENCODEX_HOME = configDir;
diff --git a/tests/native-profile-manager.test.ts b/tests/native-profile-manager.test.ts
index 41800207c..94814d562 100644
--- a/tests/native-profile-manager.test.ts
+++ b/tests/native-profile-manager.test.ts
@@ -98,7 +98,7 @@ async function enrolledFixture() {
   const sourceProfile = await manager.register("personal");
   const stage = await manager.prepareStage();
   writeFileSync(join(stage.stagingCodexHome, "auth.json"), f.target);
-  const targetProfile = await manager.finishStage(stage.stageId, "work");
+  const targetProfile = await manager.finishStage(stage.stageId, stage.writerToken, "work");
   return { ...f, manager, sourceProfile: sourceProfile.profile, targetProfile: targetProfile.profile, stage };
 }
 
@@ -246,16 +246,16 @@ describe("native main profile transactions", () => {
 
     expect((await second.list()).profiles.map(profile => profile.label)).toEqual(["personal"]);
     let finishError: unknown;
-    try { await second.finishStage(stage.stageId, "work"); } catch (error) { finishError = error; }
+    try { await second.finishStage(stage.stageId, stage.writerToken, "work"); } catch (error) { finishError = error; }
     expect(finishError).toBeInstanceOf(NativeProfileError);
     expect((finishError as NativeProfileError).code).toBe("STAGING_NOT_FOUND");
     let cancelError: unknown;
-    try { await second.cancelStage(stage.stageId); } catch (error) { cancelError = error; }
+    try { await second.cancelStage(stage.stageId, stage.writerToken); } catch (error) { cancelError = error; }
     expect(cancelError).toBeInstanceOf(NativeProfileError);
     expect((cancelError as NativeProfileError).code).toBe("STAGING_NOT_FOUND");
     expect(existsSync(stage.stagingCodexHome)).toBe(true);
 
-    await first.finishStage(stage.stageId, "work");
+    await first.finishStage(stage.stageId, stage.writerToken, "work");
     expect((await second.list()).profiles.map(profile => profile.label).sort()).toEqual(["personal", "work"]);
   });
 
@@ -321,7 +321,7 @@ describe("native main profile transactions", () => {
     writeFileSync(join(stage.stagingCodexHome, "auth.json"), f.target, { mode: 0o600 });
     writeFileSync(join(stage.stagingCodexHome, "stage.json"), "{malformed\n", { mode: 0o600 });
 
-    await manager.cancelStage(stage.stageId);
+    await manager.cancelStage(stage.stageId, stage.writerToken);
 
     expect(existsSync(stage.stagingCodexHome)).toBe(false);
   });
@@ -337,7 +337,7 @@ describe("native main profile transactions", () => {
     writeFileSync(join(stage.stagingCodexHome, "stage.json"), "{malformed\n", { mode: 0o600 });
 
     let caught: unknown;
-    try { await manager.cancelStage(stage.stageId); } catch (error) { caught = error; }
+    try { await manager.cancelStage(stage.stageId, stage.writerToken); } catch (error) { caught = error; }
 
     expect(caught).toBeInstanceOf(NativeProfileError);
     expect((caught as NativeProfileError).code).toBe("STAGING_CLEANUP_REQUIRED");
@@ -393,7 +393,7 @@ describe("native main profile transactions", () => {
     writeFileSync(join(stage.stagingCodexHome, "auth.json"), "{}\n");
 
     let caught: unknown;
-    try { await manager.finishStage(stage.stageId, "invalid"); } catch (error) { caught = error; }
+    try { await manager.finishStage(stage.stageId, stage.writerToken, "invalid"); } catch (error) { caught = error; }
     expect(caught).toBeInstanceOf(NativeProfileError);
     expect((caught as NativeProfileError).cleanupRequired).toBeUndefined();
     expect(existsSync(stage.stagingCodexHome)).toBe(false);
@@ -414,7 +414,7 @@ describe("native main profile transactions", () => {
     });
 
     let caught: unknown;
-    try { await failing.finishStage(stage.stageId, "work"); } catch (error) { caught = error; }
+    try { await failing.finishStage(stage.stageId, stage.writerToken, "work"); } catch (error) { caught = error; }
     expect(caught).toBeInstanceOf(Error);
     expect(existsSync(stage.stagingCodexHome)).toBe(false);
   });
@@ -441,7 +441,7 @@ describe("native main profile transactions", () => {
     try {
       const contender = new NativeProfileManager({ ...f.options, lockWaitMs: 0 });
       let caught: unknown;
-      try { await contender.finishStage(stage.stageId, "work"); } catch (error) { caught = error; }
+      try { await contender.finishStage(stage.stageId, stage.writerToken, "work"); } catch (error) { caught = error; }
       expect(caught).toBeInstanceOf(NativeProfileError);
       expect((caught as NativeProfileError).code).toBe("NATIVE_PROFILE_BUSY");
       expect(readFileSync(join(stage.stagingCodexHome, "auth.json"), "utf8")).toBe(f.target);
@@ -449,7 +449,7 @@ describe("native main profile transactions", () => {
       releaseLock();
       await holding;
     }
-    await manager.cancelStage(stage.stageId);
+    await manager.cancelStage(stage.stageId, stage.writerToken);
   });
 
   test("finish rejects a near-cap current source before importing an unusable target", async () => {
@@ -479,7 +479,7 @@ describe("native main profile transactions", () => {
     writeFileSync(join(stage.stagingCodexHome, "auth.json"), f.target);
 
     let caught: unknown;
-    try { await manager.finishStage(stage.stageId, "work"); } catch (error) { caught = error; }
+    try { await manager.finishStage(stage.stageId, stage.writerToken, "work"); } catch (error) { caught = error; }
 
     expect(caught).toBeInstanceOf(NativeProfileError);
     expect((caught as NativeProfileError).code).toBe("PROFILE_METADATA_TOO_LARGE");
@@ -505,11 +505,11 @@ describe("native main profile transactions", () => {
     const personal = await manager.register("personal");
     const workStage = await manager.prepareStage();
     writeFileSync(join(workStage.stagingCodexHome, "auth.json"), f.target);
-    const work = await manager.finishStage(workStage.stageId, "work");
+    const work = await manager.finishStage(workStage.stageId, workStage.writerToken, "work");
     const thirdStage = await manager.prepareStage();
     const thirdAuth = envelope("account-third", "third");
     writeFileSync(join(thirdStage.stagingCodexHome, "auth.json"), thirdAuth);
-    const third = await manager.finishStage(thirdStage.stageId, "third");
+    const third = await manager.finishStage(thirdStage.stageId, thirdStage.writerToken, "third");
     const expected = new Map([
       ["personal", { id: personal.profile.id, auth: f.source }],
       ["work", { id: work.profile.id, auth: f.target }],
@@ -539,7 +539,7 @@ describe("native main profile transactions", () => {
     const cancelled = await manager.prepareStage();
     writeFileSync(join(cancelled.stagingCodexHome, "auth.json"), f.target);
     now += 31 * 60_000;
-    await manager.cancelStage(cancelled.stageId);
+    await manager.cancelStage(cancelled.stageId, cancelled.writerToken);
     expect(existsSync(cancelled.stagingCodexHome)).toBe(false);
 
     const stale = await manager.prepareStage();
@@ -548,15 +548,15 @@ describe("native main profile transactions", () => {
     const fresh = await manager.prepareStage();
     expect(existsSync(stale.stagingCodexHome)).toBe(false);
     expect(existsSync(fresh.stagingCodexHome)).toBe(true);
-    await manager.cancelStage(fresh.stageId);
+    await manager.cancelStage(fresh.stageId, fresh.writerToken);
 
     const expiredFinish = await manager.prepareStage();
     writeFileSync(join(expiredFinish.stagingCodexHome, "auth.json"), f.target);
     now += 31 * 60_000;
     let caught: unknown;
-    try { await manager.finishStage(expiredFinish.stageId, "expired"); } catch (error) { caught = error; }
+    try { await manager.finishStage(expiredFinish.stageId, expiredFinish.writerToken, "expired"); } catch (error) { caught = error; }
     expect(caught).toBeInstanceOf(NativeProfileError);
-    expect((caught as NativeProfileError).code).toBe("STAGING_NOT_FOUND");
+    expect((caught as NativeProfileError).code).toBe("STAGING_EXPIRED");
     expect(existsSync(expiredFinish.stagingCodexHome)).toBe(false);
   });
 
@@ -572,7 +572,7 @@ describe("native main profile transactions", () => {
     });
 
     let caught: unknown;
-    try { await failing.finishStage(stage.stageId, "work"); } catch (error) { caught = error; }
+    try { await failing.finishStage(stage.stageId, stage.writerToken, "work"); } catch (error) { caught = error; }
     expect(caught).toBeInstanceOf(NativeProfileError);
     expect((caught as NativeProfileError).code).toBe("STAGING_CLEANUP_REQUIRED");
     expect((caught as NativeProfileError).message).toContain("was imported");
@@ -582,7 +582,7 @@ describe("native main profile transactions", () => {
     expect(existsSync(stage.stagingCodexHome)).toBe(true);
     const authPath = join(stage.stagingCodexHome, "auth.json");
     expect(!existsSync(authPath) || readFileSync(authPath, "utf8") === "").toBe(true);
-    await manager.cancelStage(stage.stageId);
+    await manager.cancelStage(stage.stageId, stage.writerToken);
   });
 
   test("finish preserves the primary validation error when cleanup also fails", async () => {
@@ -596,7 +596,7 @@ describe("native main profile transactions", () => {
       removeStageTree: () => { throw new Error("injected cleanup failure"); },
     });
     let caught: unknown;
-    try { await failing.finishStage(stage.stageId, "invalid"); } catch (error) { caught = error; }
+    try { await failing.finishStage(stage.stageId, stage.writerToken, "invalid"); } catch (error) { caught = error; }
     expect(caught).toBeInstanceOf(NativeProfileError);
     expect((caught as NativeProfileError).code).toBe("AUTH_INVALID");
     expect((caught as NativeProfileError).status).toBe(409);
@@ -605,7 +605,7 @@ describe("native main profile transactions", () => {
     expect(existsSync(stage.stagingCodexHome)).toBe(true);
     const authPath = join(stage.stagingCodexHome, "auth.json");
     expect(!existsSync(authPath) || readFileSync(authPath, "utf8") === "").toBe(true);
-    await manager.cancelStage(stage.stageId);
+    await manager.cancelStage(stage.stageId, stage.writerToken);
   });
 
   test("doctor degrades for corrupt vaults and stale-stage cleanup failures", async () => {
@@ -634,7 +634,7 @@ describe("native main profile transactions", () => {
     });
     const authPath = join(stage.stagingCodexHome, "auth.json");
     expect(!existsSync(authPath) || readFileSync(authPath, "utf8") === "").toBe(true);
-    await manager.cancelStage(stage.stageId);
+    await manager.cancelStage(stage.stageId, stage.writerToken);
     writeFileSync(manager.context.vaultPath, "{invalid-json\n");
     expect(await manager.doctor()).toMatchObject({
       vaultStatus: "invalid",
@@ -660,7 +660,7 @@ describe("native main profile transactions", () => {
     const stage = await manager.prepareStage();
     writeFileSync(join(stage.stagingCodexHome, "auth.json"), f.target);
     let duplicate: unknown;
-    try { await manager.finishStage(stage.stageId, "개인 Café"); } catch (error) { duplicate = error; }
+    try { await manager.finishStage(stage.stageId, stage.writerToken, "개인 Café"); } catch (error) { duplicate = error; }
     expect(duplicate).toBeInstanceOf(NativeProfileError);
     expect((duplicate as NativeProfileError).code).toBe("PROFILE_ALREADY_EXISTS");
   });
@@ -672,14 +672,14 @@ describe("native main profile transactions", () => {
     for (let index = 1; index < 32; index += 1) {
       const stage = await manager.prepareStage();
       writeFileSync(join(stage.stagingCodexHome, "auth.json"), envelope("account-" + index, "profile-" + index));
-      await manager.finishStage(stage.stageId, "profile-" + index);
+      await manager.finishStage(stage.stageId, stage.writerToken, "profile-" + index);
     }
     expect((await manager.list()).profiles).toHaveLength(32);
     const vaultBefore = readFileSync(manager.context.vaultPath, "utf8");
     const overflow = await manager.prepareStage();
     writeFileSync(join(overflow.stagingCodexHome, "auth.json"), envelope("account-overflow", "overflow"));
     let caught: unknown;
-    try { await manager.finishStage(overflow.stageId, "overflow"); } catch (error) { caught = error; }
+    try { await manager.finishStage(overflow.stageId, overflow.writerToken, "overflow"); } catch (error) { caught = error; }
     expect(caught).toBeInstanceOf(NativeProfileError);
     expect((caught as NativeProfileError).code).toBe("INVALID_REQUEST");
     expect(readFileSync(manager.context.vaultPath, "utf8")).toBe(vaultBefore);
@@ -696,7 +696,7 @@ describe("native main profile transactions", () => {
     large.padding = "x".repeat(Math.floor(MAX_NATIVE_PROFILE_METADATA_BYTES * 0.42));
     const largeTarget = JSON.stringify(large, null, 2) + "\n";
     writeFileSync(join(stage.stagingCodexHome, "auth.json"), largeTarget);
-    const work = await manager.finishStage(stage.stageId, "work");
+    const work = await manager.finishStage(stage.stageId, stage.writerToken, "work");
     const switched = await manager.switch("work", true);
     expect(readFileSync(manager.context.authPath, "utf8")).toBe(largeTarget);
     expect((switched.activeProfile as { id: string }).id).toBe(work.profile.id);
@@ -1011,7 +1011,7 @@ describe("native main profile transactions", () => {
     const journalBefore = readFileSync(f.manager.context.journalPath, "utf8");
 
     let caught: unknown;
-    try { await f.manager.finishStage(stage.stageId, "third"); } catch (error) { caught = error; }
+    try { await f.manager.finishStage(stage.stageId, stage.writerToken, "third"); } catch (error) { caught = error; }
 
     expect(caught).toBeInstanceOf(NativeProfileError);
     expect((caught as NativeProfileError).code).toBe("RECOVERY_REQUIRED");
diff --git a/tests/native-profile-route-security.test.ts b/tests/native-profile-route-security.test.ts
index a480bf826..7542fa6e5 100644
--- a/tests/native-profile-route-security.test.ts
+++ b/tests/native-profile-route-security.test.ts
@@ -28,8 +28,9 @@ const operations: readonly NativeOperation[] = [
   { name: "doctor", path: "/api/native-main-profiles/doctor", method: "GET" },
   { name: "register", path: "/api/native-main-profiles/register", method: "POST", body: { label: "Test profile" } },
   { name: "stage", path: "/api/native-main-profiles/stage", method: "POST" },
-  { name: "stage finish", path: "/api/native-main-profiles/stage/finish", method: "POST", body: { stageId: "stage-1", label: "Test profile" } },
-  { name: "stage cancel", path: "/api/native-main-profiles/stage/cancel", method: "POST", body: { stageId: "stage-1" } },
+  { name: "stage heartbeat", path: "/api/native-main-profiles/stage/heartbeat", method: "POST", body: { stageId: "stage-1", writerToken: "writer-token" } },
+  { name: "stage finish", path: "/api/native-main-profiles/stage/finish", method: "POST", body: { stageId: "stage-1", writerToken: "writer-token", label: "Test profile" } },
+  { name: "stage cancel", path: "/api/native-main-profiles/stage/cancel", method: "POST", body: { stageId: "stage-1", writerToken: "writer-token" } },
   { name: "switch", path: "/api/native-main-profiles/switch", method: "POST", body: { target: "profile-1", confirmedStopped: true } },
   { name: "recover", path: "/api/native-main-profiles/recover", method: "POST", body: { rollback: true, confirmedStopped: true } },
 ];
@@ -59,8 +60,9 @@ function testManager(calls: string[]): NativeProfileManager {
     doctor: async () => dispatched("doctor"),
     register: async () => dispatched("register"),
     prepareStage: async () => dispatched("stage"),
+    heartbeatStage: async () => dispatched("stage heartbeat"),
     finishStage: async () => dispatched("stage finish"),
-    cancelStage: async () => { dispatched("stage cancel"); },
+    cancelStage: async () => { dispatched("stage cancel"); return { removed: true, plaintextMayRemain: false }; },
     switch: async () => dispatched("switch"),
     recover: async () => dispatched("recover"),
   } as unknown as NativeProfileManager;
diff --git a/tests/native-profile-stage-lifecycle.test.ts b/tests/native-profile-stage-lifecycle.test.ts
new file mode 100644
index 000000000..d262d0569
--- /dev/null
+++ b/tests/native-profile-stage-lifecycle.test.ts
@@ -0,0 +1,217 @@
+import { afterEach, describe, expect, test } from "bun:test";
+import {
+  closeSync,
+  existsSync,
+  fstatSync,
+  mkdirSync,
+  mkdtempSync,
+  openSync,
+  readFileSync,
+  renameSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+
+import { NativeProfileManager } from "../src/codex/native-profile-manager";
+import {
+  startNativeMainStartupLifecycle,
+  type NativeMainStartupLifecycle,
+} from "../src/codex/native-profile-startup";
+import { NativeProfileError, type NativeProfileKey, type NativeProfileKeyProvider } from "../src/codex/native-profile-types";
+
+const roots: string[] = [];
+const lifecycles: NativeMainStartupLifecycle[] = [];
+
+afterEach(async () => {
+  while (lifecycles.length > 0) await lifecycles.pop()!.release();
+  while (roots.length > 0) rmSync(roots.pop()!, { recursive: true, force: true, maxRetries: 10, retryDelay: 25 });
+});
+
+class MemoryKeyProvider implements NativeProfileKeyProvider {
+  private readonly key = Buffer.alloc(32, 0x71);
+  async get(): Promise<NativeProfileKey> { return { keyRef: "memory:stage-lifecycle", key: Buffer.from(this.key) }; }
+  async create(): Promise<NativeProfileKey> { return { keyRef: "memory:stage-lifecycle", key: Buffer.from(this.key) }; }
+}
+
+function auth(accountId: string, marker: string): string {
+  return JSON.stringify({
+    auth_mode: "chatgpt",
+    tokens: {
+      id_token: `id-${marker}`,
+      access_token: `access-${marker}`,
+      refresh_token: `refresh-${marker}`,
+      account_id: accountId,
+    },
+  }, null, 2) + "\n";
+}
+
+async function atomic(path: string, content: string): Promise<void> {
+  mkdirSync(dirname(path), { recursive: true });
+  const temp = `${path}.stage-test.tmp`;
+  writeFileSync(temp, content, { mode: 0o600 });
+  renameSync(temp, path);
+}
+
+function fixture() {
+  const root = mkdtempSync(join(tmpdir(), "ocx-stage-lifecycle-"));
+  roots.push(root);
+  const codexHome = join(root, "codex");
+  const configDir = join(root, "opencodex");
+  mkdirSync(codexHome, { recursive: true });
+  mkdirSync(configDir, { recursive: true });
+  writeFileSync(join(codexHome, "config.toml"), 'cli_auth_credentials_store = "file"\n');
+  writeFileSync(join(codexHome, "auth.json"), auth("account-source", "source"));
+  let now = 1_800_000_000_000;
+  const manager = new NativeProfileManager({
+    codexHome,
+    configDir,
+    keyProvider: new MemoryKeyProvider(),
+    atomicWrite: atomic,
+    hardenPath: async () => {},
+    processProbe: async () => ({ status: "clear", count: 0 }),
+    now: () => now,
+    stageLeaseMs: 1_000,
+  });
+  return {
+    root,
+    manager,
+    target: auth("account-target", "target"),
+    advance(ms: number) { now += ms; },
+  };
+}
+
+async function caught(operation: () => Promise<unknown>): Promise<NativeProfileError> {
+  try {
+    await operation();
+  } catch (error) {
+    expect(error).toBeInstanceOf(NativeProfileError);
+    return error as NativeProfileError;
+  }
+  throw new Error("expected native-profile operation to fail");
+}
+
+async function waitFor(predicate: () => boolean, timeoutMs = 5_000): Promise<void> {
+  const deadline = Date.now() + timeoutMs;
+  while (!predicate() && Date.now() < deadline) await Bun.sleep(20);
+  if (!predicate()) throw new Error("timed out waiting for native stage lifecycle");
+}
+
+describe("native main stage writer lifecycle", () => {
+  test("requires the writer token and heartbeat protects a live login beyond its original lease", async () => {
+    const f = fixture();
+    await f.manager.register("source");
+    const stage = await f.manager.prepareStage();
+    const wrong = "wrong-writer-token-that-is-long-enough-for-validation";
+
+    expect((await caught(() => f.manager.heartbeatStage(stage.stageId, wrong))).code).toBe("STAGING_NOT_FOUND");
+    expect((await caught(() => f.manager.finishStage(stage.stageId, wrong, "target"))).code).toBe("STAGING_NOT_FOUND");
+    expect((await caught(() => f.manager.cancelStage(stage.stageId, wrong))).code).toBe("STAGING_NOT_FOUND");
+    expect(existsSync(stage.stagingCodexHome)).toBe(true);
+
+    const registry = readFileSync(f.manager.context.stageRegistryPath, "utf8");
+    const marker = readFileSync(join(stage.stagingCodexHome, "stage.json"), "utf8");
+    expect(registry).not.toContain(stage.writerToken);
+    expect(marker).not.toContain(stage.writerToken);
+    expect(registry).not.toContain("access-source");
+    expect(registry).not.toContain("refresh-source");
+
+    f.advance(900);
+    const renewed = await f.manager.heartbeatStage(stage.stageId, stage.writerToken);
+    expect(renewed.leaseExpiresAt).toBeGreaterThan(stage.leaseExpiresAt);
+    f.advance(200);
+    expect((await f.manager.sweepStages()).live).toBe(1);
+    expect(existsSync(stage.stagingCodexHome)).toBe(true);
+
+    writeFileSync(join(stage.stagingCodexHome, "auth.json"), f.target);
+    const finished = await f.manager.finishStage(stage.stageId, stage.writerToken, "target");
+    expect(finished.plaintextMayRemain).toBe(false);
+    expect(existsSync(stage.stagingCodexHome)).toBe(false);
+    expect((await caught(() => f.manager.heartbeatStage(stage.stageId, stage.writerToken))).code).toBe("STAGING_NOT_FOUND");
+  });
+
+  test("an abandoned writer expires, is scrubbed, and cannot revive its stage", async () => {
+    const f = fixture();
+    await f.manager.register("source");
+    const stage = await f.manager.prepareStage();
+    writeFileSync(join(stage.stagingCodexHome, "auth.json"), f.target);
+    f.advance(1_001);
+
+    const expired = await caught(() => f.manager.heartbeatStage(stage.stageId, stage.writerToken));
+    expect(expired.code).toBe("STAGING_EXPIRED");
+    expect(expired.plaintextMayRemain).toBe(false);
+    expect(existsSync(stage.stagingCodexHome)).toBe(false);
+    expect((await caught(() => f.manager.heartbeatStage(stage.stageId, stage.writerToken))).code).toBe("STAGING_NOT_FOUND");
+  });
+
+  test("a recreated stage path fails closed and is never blessed by a late heartbeat", async () => {
+    const f = fixture();
+    await f.manager.register("source");
+    const stage = await f.manager.prepareStage();
+    const marker = readFileSync(join(stage.stagingCodexHome, "stage.json"), "utf8");
+    const displaced = `${stage.stagingCodexHome}.displaced`;
+    renameSync(stage.stagingCodexHome, displaced);
+    mkdirSync(stage.stagingCodexHome, { mode: 0o700 });
+    writeFileSync(join(stage.stagingCodexHome, "stage.json"), marker, { mode: 0o600 });
+    writeFileSync(join(stage.stagingCodexHome, "auth.json"), f.target, { mode: 0o600 });
+
+    const error = await caught(() => f.manager.heartbeatStage(stage.stageId, stage.writerToken));
+    expect(error.code).toBe("PROFILE_STORAGE_UNSAFE");
+    expect(error.plaintextMayRemain).toBe(true);
+    expect(existsSync(stage.stagingCodexHome)).toBe(true);
+    expect(existsSync(displaced)).toBe(true);
+  });
+
+  test("writer-held-open cleanup either proves truncation or reports possible plaintext until retry", async () => {
+    const f = fixture();
+    await f.manager.register("source");
+    const stage = await f.manager.prepareStage();
+    const authPath = join(stage.stagingCodexHome, "auth.json");
+    writeFileSync(authPath, f.target, { mode: 0o600 });
+    const fd = openSync(authPath, "r+");
+    let closed = false;
+    try {
+      try {
+        const cleanup = await f.manager.cancelStage(stage.stageId, stage.writerToken);
+        expect(cleanup).toEqual({ removed: true, plaintextMayRemain: false });
+        expect(fstatSync(fd).size).toBe(0);
+      } catch (error) {
+        expect(error).toBeInstanceOf(NativeProfileError);
+        expect((error as NativeProfileError).code).toBe("STAGING_CLEANUP_REQUIRED");
+        expect((error as NativeProfileError).plaintextMayRemain).toBe(true);
+        closeSync(fd);
+        closed = true;
+        expect(await f.manager.cancelStage(stage.stageId, stage.writerToken)).toEqual({
+          removed: true,
+          plaintextMayRemain: false,
+        });
+      }
+    } finally {
+      if (!closed) closeSync(fd);
+    }
+  });
+
+  test("the owner performs startup and recursive scheduled sweeps", async () => {
+    const f = fixture();
+    await f.manager.register("source");
+    const startupResidue = await f.manager.prepareStage();
+    writeFileSync(join(startupResidue.stagingCodexHome, "auth.json"), f.target);
+    f.advance(1_001);
+
+    const lifecycle = startNativeMainStartupLifecycle({
+      manager: f.manager,
+      owner: { retryMs: 10, hardenPath: async () => {} },
+      stageSweepIntervalMs: 20,
+    });
+    lifecycles.push(lifecycle);
+    expect((await lifecycle.settled).status).toBe("ready");
+    expect(existsSync(startupResidue.stagingCodexHome)).toBe(false);
+
+    const scheduledResidue = await f.manager.prepareStage();
+    writeFileSync(join(scheduledResidue.stagingCodexHome, "auth.json"), f.target);
+    f.advance(1_001);
+    await waitFor(() => !existsSync(scheduledResidue.stagingCodexHome));
+    expect(readFileSync(f.manager.context.stageRegistryPath, "utf8")).not.toContain(scheduledResidue.stageId);
+  }, 10_000);
+});
diff --git a/tests/native-profile-startup.test.ts b/tests/native-profile-startup.test.ts
index 0674ed2a6..1b1f21882 100644
--- a/tests/native-profile-startup.test.ts
+++ b/tests/native-profile-startup.test.ts
@@ -105,7 +105,7 @@ async function fixture(phase: Phase, observation: Observation, activePool = fals
   const registered = await manager.register("source");
   const stage = await manager.prepareStage();
   writeFileSync(join(stage.stagingCodexHome, "auth.json"), target);
-  const added = await manager.finishStage(stage.stageId, "target");
+  const added = await manager.finishStage(stage.stageId, stage.writerToken, "target");
 
   const beforeVault = readNativeProfileVault(manager.context)!;
   const sourceRecord = beforeVault.profiles.find(profile => profile.id === registered.profile.id)!;

From 9d6ae74135b730a4262150779d377964012498dd Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Mon, 3 Aug 2026 12:48:45 +0900
Subject: [PATCH 49/63] test(codex): pass stage writer token in takeover

---
 tests/native-main-owner-lifetime.test.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/native-main-owner-lifetime.test.ts b/tests/native-main-owner-lifetime.test.ts
index 7fd0fdd27..1c7482d57 100644
--- a/tests/native-main-owner-lifetime.test.ts
+++ b/tests/native-main-owner-lifetime.test.ts
@@ -392,7 +392,7 @@ describe("native-main process owner lease", () => {
     const source = await f.manager.register("source");
     const stage = await f.manager.prepareStage();
     writeFileSync(join(stage.stagingCodexHome, "auth.json"), auth("account-target", "target"));
-    const target = await f.manager.finishStage(stage.stageId, "target");
+    const target = await f.manager.finishStage(stage.stageId, stage.writerToken, "target");
     expect(source.profile.state).toBe("active");
 
     const owner = new ChildHarness(f, { NATIVE_OWNER_HOLD_AUTH_TEMP: "1" });

From 31951a87378edc401767ab158dabc134f9be800f Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Mon, 3 Aug 2026 13:26:18 +0900
Subject: [PATCH 50/63] fix(codex): await startup convergence on release

---
 src/codex/native-profile-startup.ts | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/src/codex/native-profile-startup.ts b/src/codex/native-profile-startup.ts
index 7f61680a2..28462ea76 100644
--- a/src/codex/native-profile-startup.ts
+++ b/src/codex/native-profile-startup.ts
@@ -273,11 +273,15 @@ export function startNativeMainStartupLifecycle(
       entry!.sweepStopping = true;
       if (entry!.sweepTimer) clearTimeout(entry!.sweepTimer);
       entry!.sweepTimer = undefined;
-      if (entry!.sweepInFlight) await Promise.allSettled([entry!.sweepInFlight]);
       entry!.unsubscribe();
       startupEntries.delete(homeId);
       entry!.resolveAcquisition?.(snapshot);
       entry!.resolveAcquisition = undefined;
+      // Startup convergence can transition from the exclusive recovery claim
+      // into a stage sweep. Keep the owner registered until that entire chain
+      // settles so no cleanup transaction starts untracked after owner detach.
+      await Promise.allSettled([entry!.settled]);
+      if (entry!.sweepInFlight) await Promise.allSettled([entry!.sweepInFlight]);
       await entry!.owner.release();
     },
   };

From 897809bc85a5871832b10e1b68493d0709fedc05 Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Mon, 3 Aug 2026 13:26:18 +0900
Subject: [PATCH 51/63] test(server): budget multi-harness stream retry case

---
 tests/server-auth.test.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/server-auth.test.ts b/tests/server-auth.test.ts
index 1c4fec7da..e434430f0 100644
--- a/tests/server-auth.test.ts
+++ b/tests/server-auth.test.ts
@@ -1965,7 +1965,7 @@ describe("server local API auth", () => {
     } finally {
       if (platformDescriptor) Object.defineProperty(process, "platform", platformDescriptor);
     }
-  });
+  }, { timeout: SERVER_BUDGET_MS });
 
   test("oversized 400 body never authorizes a pool retry", async () => {
     const body = `${unsupportedModelBody()}${"x".repeat(65_536)}`;

From 26a0f431ed675a69c67bc76d57a3bd9e91a9f97f Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Mon, 3 Aug 2026 09:21:59 +0900
Subject: [PATCH 52/63] fix(codex): reject ambiguous native profile selectors

---
 src/codex/native-profile-manager.ts  | 23 +++++++--
 src/codex/native-profile-store.ts    | 30 +++++++++---
 tests/native-profile-manager.test.ts | 72 ++++++++++++++++++++++++++++
 3 files changed, 115 insertions(+), 10 deletions(-)

diff --git a/src/codex/native-profile-manager.ts b/src/codex/native-profile-manager.ts
index d5849c686..746a293a9 100644
--- a/src/codex/native-profile-manager.ts
+++ b/src/codex/native-profile-manager.ts
@@ -37,6 +37,7 @@ import {
   MAX_NATIVE_PROFILES,
   nativeIdentityHash,
   nativeIdentityHint,
+  nativeProfileSelectorKey,
   OsNativeProfileKeyProvider,
   publicNativeProfile,
   readNativeEnvelope,
@@ -523,6 +524,7 @@ export class NativeProfileManager {
         const timestamp = new Date(this.now()).toISOString();
         if (!vault) {
           const id = this.uuid();
+          assertUniqueNativeProfileLabel({ profiles: [] }, label, undefined, [id]);
           vault = {
             version: 1,
             revision: 1,
@@ -1031,13 +1033,13 @@ export class NativeProfileManager {
         }
         key = await this.keyForVault(vault);
         this.assertCurrentIdentity(vault, current, key);
-        assertUniqueNativeProfileLabel(vault, label);
+        const id = this.uuid();
+        assertUniqueNativeProfileLabel(vault, label, undefined, [id]);
         const identityHash = nativeIdentityHash(key.key, target.accountId);
         if (vault.profiles.some(profile => profile.identityHash === identityHash)) {
           throw new NativeProfileError("PROFILE_ALREADY_EXISTS", "That native identity is already registered.", 409);
         }
         const timestamp = new Date(this.now()).toISOString();
-        const id = this.uuid();
         const currentProfile = this.currentProfile(vault);
         const currentSourcePayload = encryptNativeEnvelope(
           this.context,
@@ -1151,8 +1153,21 @@ export class NativeProfileManager {
     });
   }
   private resolveTarget(vault: NativeMainProfileVaultV1, target: string): NativeMainProfileRecordV1 {
-    const normalized = target.trim().toLowerCase();
-    const profile = vault.profiles.find(item => item.id.toLowerCase() === normalized || item.label.toLowerCase() === normalized);
+    const selectors = new Map<string, NativeMainProfileRecordV1>();
+    for (const item of vault.profiles) {
+      for (const selector of [item.id, item.label]) {
+        const key = nativeProfileSelectorKey(selector);
+        if (selectors.has(key)) {
+          throw new NativeProfileError(
+            "VAULT_INVALID",
+            "The native-profile vault contains an ambiguous ID or label selector.",
+            409,
+          );
+        }
+        selectors.set(key, item);
+      }
+    }
+    const profile = selectors.get(nativeProfileSelectorKey(target));
     if (!profile) throw new NativeProfileError("PROFILE_NOT_FOUND", "The requested native profile does not exist.", 404);
     if (profile.state !== "inactive" || !profile.payload) {
       throw new NativeProfileError("INVALID_REQUEST", "The requested native profile is already active.", 400);
diff --git a/src/codex/native-profile-store.ts b/src/codex/native-profile-store.ts
index 77f6b38cb..7afba8173 100644
--- a/src/codex/native-profile-store.ts
+++ b/src/codex/native-profile-store.ts
@@ -597,12 +597,15 @@ function parseVaultObject(value: unknown, homeId: string): NativeMainProfileVaul
   const identities = new Set<string>();
   let activeCount = 0;
   for (const profile of vault.profiles) {
-    if (!profile || typeof profile !== "object" || !UUID_RE.test(profile.id) || ids.has(profile.id)) throw new Error("id");
+    if (!profile || typeof profile !== "object" || !UUID_RE.test(profile.id)) throw new Error("id");
+    const normalizedId = nativeProfileSelectorKey(profile.id);
+    if (ids.has(normalizedId) || labels.has(normalizedId)) throw new Error("id selector");
     const label = normalizedNativeProfileLabel(profile.label);
     if (!label) throw new Error("label");
     profile.label = label;
-    const normalizedLabel = label.toLowerCase();
-    if (labels.has(normalizedLabel) || !HASH_RE.test(profile.identityHash) || identities.has(profile.identityHash)) throw new Error("identity");
+    const normalizedLabel = nativeProfileSelectorKey(label);
+    if (labels.has(normalizedLabel) || ids.has(normalizedLabel)) throw new Error("label selector");
+    if (!HASH_RE.test(profile.identityHash) || identities.has(profile.identityHash)) throw new Error("identity");
     if (profile.identityHint !== nativeIdentityHint(profile.identityHash)) throw new Error("hint");
     if (profile.state === "active") {
       activeCount += 1;
@@ -610,7 +613,7 @@ function parseVaultObject(value: unknown, homeId: string): NativeMainProfileVaul
     } else if (profile.state === "inactive") {
       if (!isEncryptedPayload(profile.payload)) throw new Error("inactive payload");
     } else throw new Error("state");
-    ids.add(profile.id);
+    ids.add(normalizedId);
     labels.add(normalizedLabel);
     identities.add(profile.identityHash);
   }
@@ -807,6 +810,11 @@ export function serializeNativeProfileJournal(journal: NativeProfileSwitchJourna
 
 const FORBIDDEN_PROFILE_LABEL_RE = /[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/u;
 
+/** Canonical key shared by persisted ID/label collision checks and switch selectors. */
+export function nativeProfileSelectorKey(value: string): string {
+  return value.normalize("NFC").trim().toLowerCase();
+}
+
 function normalizedNativeProfileLabel(value: unknown): string | null {
   if (typeof value !== "string" || FORBIDDEN_PROFILE_LABEL_RE.test(value)) return null;
   const normalized = value.normalize("NFC").trim();
@@ -823,13 +831,23 @@ export function validateNativeProfileLabel(label: string): string {
 }
 
 export function assertUniqueNativeProfileLabel(
-  vault: NativeMainProfileVaultV1,
+  vault: Pick<NativeMainProfileVaultV1, "profiles">,
   label: string,
   excludeId?: string,
+  additionalIds: readonly string[] = [],
 ): void {
-  if (vault.profiles.some(profile => profile.id !== excludeId && profile.label.toLowerCase() === label.toLowerCase())) {
+  const selector = nativeProfileSelectorKey(label);
+  if (vault.profiles.some(
+    profile => profile.id !== excludeId && nativeProfileSelectorKey(profile.label) === selector,
+  )) {
     throw new NativeProfileError("PROFILE_ALREADY_EXISTS", "A native profile already uses that label.", 409);
   }
+  if (
+    vault.profiles.some(profile => nativeProfileSelectorKey(profile.id) === selector)
+    || additionalIds.some(id => nativeProfileSelectorKey(id) === selector)
+  ) {
+    throw new NativeProfileError("PROFILE_ALREADY_EXISTS", "A native profile ID already uses that selector.", 409);
+  }
 }
 
 export function publicNativeProfile(profile: NativeMainProfileRecordV1): NativeProfilePublic {
diff --git a/tests/native-profile-manager.test.ts b/tests/native-profile-manager.test.ts
index 94814d562..14b8d754a 100644
--- a/tests/native-profile-manager.test.ts
+++ b/tests/native-profile-manager.test.ts
@@ -665,6 +665,78 @@ describe("native main profile transactions", () => {
     expect((duplicate as NativeProfileError).code).toBe("PROFILE_ALREADY_EXISTS");
   });
 
+  test("rejects case- and whitespace-normalized labels that collide with any profile ID", async () => {
+    const generatedId = "11111111-1111-4111-8111-111111111111";
+    const createFixture = fixture();
+    const creating = new NativeProfileManager({
+      ...createFixture.options,
+      randomUUID: () => generatedId,
+    });
+    let createError: unknown;
+    try { await creating.register(`  ${generatedId.toUpperCase()}  `); } catch (error) { createError = error; }
+    expect(createError).toBeInstanceOf(NativeProfileError);
+    expect((createError as NativeProfileError).code).toBe("PROFILE_ALREADY_EXISTS");
+    expect(existsSync(creating.context.vaultPath)).toBe(false);
+
+    const enrolled = await enrolledFixture();
+    const beforeRename = readFileSync(enrolled.manager.context.vaultPath, "utf8");
+    let renameError: unknown;
+    try {
+      await enrolled.manager.register(`  ${enrolled.targetProfile.id.toUpperCase()}  `);
+    } catch (error) {
+      renameError = error;
+    }
+    expect(renameError).toBeInstanceOf(NativeProfileError);
+    expect((renameError as NativeProfileError).code).toBe("PROFILE_ALREADY_EXISTS");
+    expect(readFileSync(enrolled.manager.context.vaultPath, "utf8")).toBe(beforeRename);
+
+    const stage = await enrolled.manager.prepareStage();
+    writeFileSync(join(stage.stagingCodexHome, "auth.json"), envelope("account-third", "third"));
+    let importError: unknown;
+    try {
+      await enrolled.manager.finishStage(stage.stageId, `  ${enrolled.sourceProfile.id.toUpperCase()}  `);
+    } catch (error) {
+      importError = error;
+    }
+    expect(importError).toBeInstanceOf(NativeProfileError);
+    expect((importError as NativeProfileError).code).toBe("PROFILE_ALREADY_EXISTS");
+    expect(readFileSync(enrolled.manager.context.vaultPath, "utf8")).toBe(beforeRename);
+    expect(existsSync(stage.stagingCodexHome)).toBe(false);
+  });
+
+  test("resolves normalized labels and exact IDs but fails closed for a legacy ambiguous selector", async () => {
+    const f = await enrolledFixture();
+    await f.manager.register("Personal Caf\u00e9");
+
+    await f.manager.switch(`  ${f.targetProfile.id.toUpperCase()}  `, true);
+    expect((await f.manager.list()).activeProfileId).toBe(f.targetProfile.id);
+    await f.manager.switch("  PERSONAL CAFE\u0301  ", true);
+    expect((await f.manager.list()).activeProfileId).toBe(f.sourceProfile.id);
+
+    const corruptVault = readNativeProfileVault(f.manager.context)!;
+    const active = corruptVault.profiles.find(profile => profile.id === f.sourceProfile.id)!;
+    active.label = f.targetProfile.id.toUpperCase();
+    const authBefore = readFileSync(f.manager.context.authPath, "utf8");
+    const vaultBefore = readFileSync(f.manager.context.vaultPath, "utf8");
+    const injected = new NativeProfileManager({
+      ...f.options,
+      readVault: () => structuredClone(corruptVault),
+    });
+    let ambiguityError: unknown;
+    try { await injected.switch(f.targetProfile.id, true); } catch (error) { ambiguityError = error; }
+    expect(ambiguityError).toBeInstanceOf(NativeProfileError);
+    expect((ambiguityError as NativeProfileError).code).toBe("VAULT_INVALID");
+    expect(readFileSync(f.manager.context.authPath, "utf8")).toBe(authBefore);
+    expect(readFileSync(f.manager.context.vaultPath, "utf8")).toBe(vaultBefore);
+    expect(existsSync(f.manager.context.journalPath)).toBe(false);
+
+    writeFileSync(f.manager.context.vaultPath, JSON.stringify(corruptVault, null, 2) + "\n");
+    let persistedError: unknown;
+    try { readNativeProfileVault(f.manager.context); } catch (error) { persistedError = error; }
+    expect(persistedError).toBeInstanceOf(NativeProfileError);
+    expect((persistedError as NativeProfileError).code).toBe("VAULT_INVALID");
+  });
+
   test("allows 32 profiles and rejects profile 33 without changing the vault", async () => {
     const f = fixture();
     const manager = new NativeProfileManager(f.options);

From 46750d89612d787b203ff842c0227c6dd4b00bc4 Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Mon, 3 Aug 2026 08:51:52 +0900
Subject: [PATCH 53/63] fix(codex): reconcile stale recovery gates after switch

---
 src/codex/native-profile-api.ts      |  27 ++++---
 tests/native-profile-api.test.ts     | 103 +++++++++++++++++++++++++++
 tests/native-profile-manager.test.ts |   6 +-
 3 files changed, 125 insertions(+), 11 deletions(-)

diff --git a/src/codex/native-profile-api.ts b/src/codex/native-profile-api.ts
index 310d44512..36dea7359 100644
--- a/src/codex/native-profile-api.ts
+++ b/src/codex/native-profile-api.ts
@@ -8,7 +8,11 @@ import {
 } from "../server/management/body";
 import { NativeProfileManager } from "./native-profile-manager";
 import { NativeProfileError } from "./native-profile-types";
-import { blockNativeMainRecovery, completeNativeMainRecovery } from "./native-profile-startup";
+import {
+  blockNativeMainRecovery,
+  completeNativeMainRecovery,
+  nativeMainStartupGateSnapshot,
+} from "./native-profile-startup";
 import { probeNativeProfileRecoveryState } from "./native-profile-store";
 import { nativeMainOwnerSnapshot, withNativeMainOwnerOperation } from "./native-main-owner";
 import { withNativeMainExclusiveClaim, withNativeMainSharedClaim } from "./native-main-claim";
@@ -74,7 +78,6 @@ async function withRecoveryGateTransition<T>(
   manager: NativeProfileManager,
   deps: NativeProfileApiDeps,
   operation: () => Promise<T>,
-  completeIfAlreadyClearAfterSuccess = false,
 ): Promise<T> {
   const context = manager.context;
   if (!context) return operation();
@@ -112,15 +115,20 @@ async function withRecoveryGateTransition<T>(
       } catch (error) {
         if (!operationFailed) throw error;
       }
-    } else if (before !== "none" || (completeIfAlreadyClearAfterSuccess && !operationFailed)) {
-      try {
-        if (after === "none") {
+    } else {
+      const gate = nativeMainStartupGateSnapshot();
+      const matchingGateCanComplete = gate.status === "blocked"
+        && gate.homeId === context.homeId
+        && (gate.reason === "recovery-pending" || gate.reason === "manual-recovery")
+        && (before !== "none" || !operationFailed);
+      if (matchingGateCanComplete) {
+        try {
           (deps.completeRecovery ?? completeNativeMainRecovery)(context.homeId);
+        } catch (transitionError) {
+          // Preserve the operation's typed/public error. A post-operation probe or
+          // completion failure must not replace it; the gate remains fail closed.
+          if (!operationFailed) throw transitionError;
         }
-      } catch (transitionError) {
-        // Preserve the operation's typed/public error. A post-operation probe or
-        // completion failure must not replace it; the gate remains fail closed.
-        if (!operationFailed) throw transitionError;
       }
     }
   }
@@ -218,7 +226,6 @@ export async function handleNativeProfileAPI(
           () => manager.recover(input.rollback === true, input.confirmedStopped === true),
           { mode: "exclusive", waitMs: deps.drainTimeoutMs ?? 10_000 },
         ),
-        true,
       ));
       return jsonResponse(recovered, 200, req, config);
     }
diff --git a/tests/native-profile-api.test.ts b/tests/native-profile-api.test.ts
index 96ea74916..89a3ff36e 100644
--- a/tests/native-profile-api.test.ts
+++ b/tests/native-profile-api.test.ts
@@ -262,6 +262,109 @@ describe("native main profile management API", () => {
     expect(nativeMainStartupGateSnapshot()).toMatchObject({ status: "ready", homeId });
   });
 
+  test("successful switch clears a matching stale startup gate after clean recovery probes", async () => {
+    const homeId = "home-stale-blocked-clean";
+    await initializeNativeMainStartupGate({
+      manager: { context: { homeId } } as unknown as NativeProfileManager,
+      probeRecoveryState: () => { throw new Error("startup recovery state was unreadable"); },
+    });
+    expect(nativeMainStartupGateSnapshot()).toEqual({
+      status: "blocked",
+      homeId,
+      reason: "manual-recovery",
+    });
+    let completedWhileDraining = false;
+    const manager = {
+      context: { homeId, journalPath: "missing", recoveryBlockPath: "missing" },
+      switch: async () => ({ ok: true }),
+    } as unknown as NativeProfileManager;
+    const request = new Request("http://localhost/api/native-main-profiles/switch", {
+      method: "POST",
+      body: JSON.stringify({ target: "target", confirmedStopped: true }),
+    });
+
+    const response = await handleNativeProfileAPI(request, new URL(request.url), {} as OcxConfig, {
+      manager,
+      probeRecoveryState: () => "none",
+      completeRecovery: id => {
+        const turn = tryAdmitTurn();
+        const selection = codexAccountSelectionForTurn(turn!)!();
+        completedWhileDraining = turn !== null
+          && selection?.mainProfileDraining === true
+          && selection.claimMainProfile() === false;
+        selection?.release();
+        turn?.release();
+        return completeNativeMainRecovery(id);
+      },
+    });
+
+    expect(response?.status).toBe(200);
+    expect(completedWhileDraining).toBe(true);
+    expect(nativeMainStartupGateSnapshot()).toEqual({ status: "ready", homeId });
+  });
+
+  test("failed switch cannot clear a matching stale startup gate from clean probes", async () => {
+    const homeId = "home-stale-blocked-failed-switch";
+    await initializeNativeMainStartupGate({
+      manager: { context: { homeId } } as unknown as NativeProfileManager,
+      probeRecoveryState: () => { throw new Error("startup recovery state was unreadable"); },
+    });
+    let completions = 0;
+    const manager = {
+      context: { homeId, journalPath: "missing", recoveryBlockPath: "missing" },
+      switch: async () => { throw new NativeProfileError("RECOVERY_REQUIRED", "switch failed", 409); },
+    } as unknown as NativeProfileManager;
+    const request = new Request("http://localhost/api/native-main-profiles/switch", {
+      method: "POST",
+      body: JSON.stringify({ target: "target", confirmedStopped: true }),
+    });
+
+    const response = await handleNativeProfileAPI(request, new URL(request.url), {} as OcxConfig, {
+      manager,
+      probeRecoveryState: () => "none",
+      completeRecovery: () => { completions += 1; return true; },
+    });
+
+    expect(response?.status).toBe(409);
+    expect(completions).toBe(0);
+    expect(nativeMainStartupGateSnapshot()).toEqual({
+      status: "blocked",
+      homeId,
+      reason: "manual-recovery",
+    });
+  });
+
+  test("successful switch cannot clear a stale startup gate for another home", async () => {
+    const blockedHomeId = "home-stale-blocked-owner";
+    await initializeNativeMainStartupGate({
+      manager: { context: { homeId: blockedHomeId } } as unknown as NativeProfileManager,
+      probeRecoveryState: () => { throw new Error("startup recovery state was unreadable"); },
+    });
+    let completions = 0;
+    const manager = {
+      context: { homeId: "home-clean-switch", journalPath: "missing", recoveryBlockPath: "missing" },
+      switch: async () => ({ ok: true }),
+    } as unknown as NativeProfileManager;
+    const request = new Request("http://localhost/api/native-main-profiles/switch", {
+      method: "POST",
+      body: JSON.stringify({ target: "target", confirmedStopped: true }),
+    });
+
+    const response = await handleNativeProfileAPI(request, new URL(request.url), {} as OcxConfig, {
+      manager,
+      probeRecoveryState: () => "none",
+      completeRecovery: () => { completions += 1; return true; },
+    });
+
+    expect(response?.status).toBe(200);
+    expect(completions).toBe(0);
+    expect(nativeMainStartupGateSnapshot()).toEqual({
+      status: "blocked",
+      homeId: blockedHomeId,
+      reason: "manual-recovery",
+    });
+  });
+
   test("a retained journal publishes a matching main gate before drain release while pool turns remain available", async () => {
     const homeId = "home-clean-retained-journal";
     await initializeNativeMainStartupGate({
diff --git a/tests/native-profile-manager.test.ts b/tests/native-profile-manager.test.ts
index 14b8d754a..3d540a83e 100644
--- a/tests/native-profile-manager.test.ts
+++ b/tests/native-profile-manager.test.ts
@@ -694,7 +694,11 @@ describe("native main profile transactions", () => {
     writeFileSync(join(stage.stagingCodexHome, "auth.json"), envelope("account-third", "third"));
     let importError: unknown;
     try {
-      await enrolled.manager.finishStage(stage.stageId, `  ${enrolled.sourceProfile.id.toUpperCase()}  `);
+      await enrolled.manager.finishStage(
+        stage.stageId,
+        stage.writerToken,
+        `  ${enrolled.sourceProfile.id.toUpperCase()}  `,
+      );
     } catch (error) {
       importError = error;
     }

From 5931ea87ef8af4c205e40f5b0c85f096b5719ac4 Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Mon, 3 Aug 2026 08:25:23 +0900
Subject: [PATCH 54/63] fix(server): retain sideband lease until upstream
 closes

---
 src/server/index.ts                       |  37 ++++++--
 src/server/ws-bridge.ts                   |   2 +-
 tests/native-profile-drain-server.test.ts | 110 ++++++++++++++++++++++
 3 files changed, 140 insertions(+), 9 deletions(-)

diff --git a/src/server/index.ts b/src/server/index.ts
index 6e815b6d2..c9f251f1b 100644
--- a/src/server/index.ts
+++ b/src/server/index.ts
@@ -176,6 +176,11 @@ const WEBSOCKET_IDLE_TIMEOUT_SECONDS = 0;
 const LIVE_SIDEBAND_PENDING_MAX = 32;
 const LIVE_SIDEBAND_CLOSE_FALLBACK_MS = 1_000;
 
+type LiveSidebandWebSocketFactory = (
+  url: string,
+  headers: Record<string, string>,
+) => WebSocket;
+
 function releaseLiveSidebandAdmission(ws: ServerWebSocket<WsData>): void {
   ws.data.liveTurnAdmissionLease?.release();
   ws.data.liveTurnAdmissionLease = undefined;
@@ -198,14 +203,22 @@ function armLiveSidebandCloseFallback(ws: ServerWebSocket<WsData>, upstream: Web
   ws.data.liveCloseFallback = setTimeout(() => {
     ws.data.liveCloseFallback = undefined;
     if (ws.data.liveUpstream !== upstream) return;
-    // A close frame was already sent below. Retry once before releasing the
-    // drain, then force local cleanup if the peer never completes the handshake.
+    if (upstream.readyState === WebSocket.CLOSED) {
+      finalizeLiveSideband(ws, upstream);
+      return;
+    }
+    // A close frame was already sent below. Retry once, but never surrender
+    // native-main ownership while the authenticated transport remains live.
     try {
       upstream.close(1000, "upstream close timeout");
     } catch {
       /* upstream is already unusable */
     }
-    finalizeLiveSideband(ws, upstream);
+    // Some implementations transition synchronously without delivering the
+    // close event. That is still an observed CLOSED transport and is safe to
+    // finalize. CONNECTING/CLOSING peers keep the lease so profile switching
+    // fails at its own bounded drain deadline instead of racing live traffic.
+    if (upstream.readyState === WebSocket.CLOSED) finalizeLiveSideband(ws, upstream);
   }, LIVE_SIDEBAND_CLOSE_FALLBACK_MS);
 }
 
@@ -220,12 +233,13 @@ function closeLiveSideband(ws: ServerWebSocket<WsData>, code = 1000, reason = ""
   } else {
     // The sideband holds a native-main admission lease. Do not release it just
     // because the downstream left: its authenticated upstream remains live
-    // until this close handshake completes (or the bounded fallback runs).
+    // until the close event arrives or the transport is observed CLOSED. The
+    // bounded fallback only retries close; it does not release ownership.
     armLiveSidebandCloseFallback(ws, upstream);
     try {
       upstream.close(code, reason);
     } catch {
-      /* the fallback releases ownership if this socket never reports close */
+      /* the fallback retries close without releasing ownership */
     }
   }
   try {
@@ -237,7 +251,12 @@ function closeLiveSideband(ws: ServerWebSocket<WsData>, code = 1000, reason = ""
   }
 }
 
-function attachLiveSidebandUpstream(ws: ServerWebSocket<WsData>): void {
+function attachLiveSidebandUpstream(
+  ws: ServerWebSocket<WsData>,
+  createWebSocket: LiveSidebandWebSocketFactory = (url, headers) => (
+    new WebSocket(url, { headers } as unknown as string[])
+  ),
+): void {
   const url = ws.data.liveUpstreamUrl;
   if (!url) {
     closeLiveSideband(ws, 1011, "missing upstream");
@@ -246,7 +265,7 @@ function attachLiveSidebandUpstream(ws: ServerWebSocket<WsData>): void {
   let upstream: WebSocket;
   try {
     // Bun accepts per-handshake headers; the DOM lib types only list protocol arrays.
-    upstream = new WebSocket(url, { headers: ws.data.liveUpstreamHeaders ?? {} } as unknown as string[]);
+    upstream = createWebSocket(url, ws.data.liveUpstreamHeaders ?? {});
   } catch {
     closeLiveSideband(ws, 1011, "upstream connect failed");
     return;
@@ -335,6 +354,8 @@ export interface StartServerDeps {
   managementApi?: ManagementApiDeps;
   /** Test-only native-main recovery dependencies; production constructs the normal manager. */
   nativeMainStartup?: NativeMainStartupGateDeps;
+  /** Test-only seam for an upstream that cannot complete its WebSocket close handshake. */
+  liveSidebandWebSocketFactory?: LiveSidebandWebSocketFactory;
 }
 
 export function startServer(port?: number, deps: StartServerDeps = {}) {
@@ -994,7 +1015,7 @@ export function startServer(port?: number, deps: StartServerDeps = {}) {
             closeLiveSideband(ws, 1013, "server busy");
             return;
           }
-          attachLiveSidebandUpstream(ws);
+          attachLiveSidebandUpstream(ws, deps.liveSidebandWebSocketFactory);
           return;
         }
         if (!ws.data.admissionLease) {
diff --git a/src/server/ws-bridge.ts b/src/server/ws-bridge.ts
index 8b0337897..eb989d21f 100644
--- a/src/server/ws-bridge.ts
+++ b/src/server/ws-bridge.ts
@@ -41,7 +41,7 @@ export interface WsData {
   liveOpened?: boolean;
   /** Once teardown starts, ignore new client frames until the upstream closes. */
   liveClosing?: boolean;
-  /** Bounds an uncooperative upstream close so native-main cannot remain drained forever. */
+  /** Schedules one bounded close retry without surrendering native-main ownership. */
   liveCloseFallback?: ReturnType<typeof setTimeout>;
   /** Turn/account ownership retained for the complete sideband socket lifetime. */
   liveTurnAdmissionLease?: AdmissionLease;
diff --git a/tests/native-profile-drain-server.test.ts b/tests/native-profile-drain-server.test.ts
index 926e8549d..57f905636 100644
--- a/tests/native-profile-drain-server.test.ts
+++ b/tests/native-profile-drain-server.test.ts
@@ -342,4 +342,114 @@ describe("native main profile scoped server admission", () => {
       await upstream.stop(true);
     }
   });
+
+  test("uncooperative Live sideband keeps main ownership through close fallback and switch timeout", async () => {
+    class UncooperativeUpstream extends EventTarget {
+      readyState = WebSocket.CONNECTING;
+      closeCalls = 0;
+
+      open(): void {
+        this.readyState = WebSocket.OPEN;
+        this.dispatchEvent(new Event("open"));
+      }
+
+      send(): void {}
+
+      close(): void {
+        this.closeCalls += 1;
+        this.readyState = WebSocket.CLOSING;
+      }
+
+      finishClose(): void {
+        this.readyState = WebSocket.CLOSED;
+        this.dispatchEvent(new CloseEvent("close", { code: 1000, reason: "test cleanup" }));
+      }
+    }
+
+    saveConfig({
+      port: 0,
+      defaultProvider: "openai",
+      openaiProviderTierVersion: 2,
+      providers: {
+        openai: {
+          adapter: "openai-responses",
+          baseUrl: "https://chatgpt.com/backend-api/codex",
+          authMode: "forward",
+          codexAccountMode: "pool",
+        },
+      },
+      activeCodexAccountId: MAIN_CODEX_ACCOUNT_ID,
+      autoSwitchThreshold: 0,
+      codexAccounts: [],
+      experimentalRealtimeWsBaseUrl: "ws://uncooperative.invalid/",
+    } as OcxConfig);
+    updateAccountQuota(MAIN_CODEX_ACCOUNT_ID, 1, 1);
+
+    let upstream: UncooperativeUpstream | undefined;
+    let switches = 0;
+    const manager = {
+      switch: async () => {
+        switches += 1;
+        return { ok: true };
+      },
+    } as unknown as NativeProfileManager;
+    const server = startServer(0, {
+      liveSidebandWebSocketFactory: () => {
+        upstream = new UncooperativeUpstream();
+        queueMicrotask(() => upstream?.open());
+        return upstream as unknown as WebSocket;
+      },
+    });
+    const url = new URL("/v1/live/uncooperative", server.url);
+    url.protocol = "ws:";
+    const client = new WebSocket(url);
+
+    try {
+      await new Promise<void>((resolve, reject) => {
+        const timer = setTimeout(() => reject(new Error("sideband websocket open timeout")), 2_000);
+        client.addEventListener("open", () => {
+          clearTimeout(timer);
+          resolve();
+        }, { once: true });
+        client.addEventListener("error", () => {
+          clearTimeout(timer);
+          reject(new Error("sideband websocket failed to open"));
+        }, { once: true });
+      });
+      await Bun.sleep(0);
+      expect(upstream?.readyState).toBe(WebSocket.OPEN);
+      expect(getNativeMainProfileRequestCount()).toBe(1);
+
+      await new Promise<void>(resolve => {
+        client.addEventListener("close", () => resolve(), { once: true });
+        client.close();
+      });
+      await Bun.sleep(1_100);
+      expect(upstream?.closeCalls).toBe(2);
+      expect(upstream?.readyState).toBe(WebSocket.CLOSING);
+      expect(getNativeMainProfileRequestCount()).toBe(1);
+
+      const blocked = await handleNativeProfileAPI(
+        new Request("http://localhost/api/native-main-profiles/switch", {
+          method: "POST",
+          body: JSON.stringify({ target: "target", confirmedStopped: true }),
+        }),
+        new URL("http://localhost/api/native-main-profiles/switch"),
+        {} as OcxConfig,
+        { manager, drainTimeoutMs: 75 },
+      );
+      expect(blocked?.status).toBe(409);
+      expect(switches).toBe(0);
+      expect(getNativeMainProfileRequestCount()).toBe(1);
+
+      upstream?.finishClose();
+      await Bun.sleep(0);
+      expect(getNativeMainProfileRequestCount()).toBe(0);
+      upstream?.finishClose();
+      expect(getNativeMainProfileRequestCount()).toBe(0);
+    } finally {
+      upstream?.finishClose();
+      await server.stop(true);
+    }
+  });
 });

From 0491004a086318ff0165ed625fff3259eaa24d8d Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Mon, 3 Aug 2026 09:00:14 +0900
Subject: [PATCH 55/63] docs(codex): clarify process-exit recovery scope

---
 .../260801_native_main_profiles/000_design.md | 22 +++++-----
 .../001_validation.md                         | 42 +++++++++++--------
 .../002_implementation.md                     |  8 +++-
 .../ja/reference/cli/providers-accounts.md    |  2 +
 .../ko/reference/cli/providers-accounts.md    |  2 +
 .../docs/reference/cli/providers-accounts.md  |  4 ++
 .../ru/reference/cli/providers-accounts.md    |  2 +
 .../zh-cn/reference/cli/providers-accounts.md |  2 +
 tests/native-profile-crash-boundaries.test.ts |  4 +-
 tests/native-profile-manager.test.ts          |  2 +-
 10 files changed, 57 insertions(+), 33 deletions(-)

diff --git a/devlog/_plan/260801_native_main_profiles/000_design.md b/devlog/_plan/260801_native_main_profiles/000_design.md
index 763e3052f..64a6dd5ba 100644
--- a/devlog/_plan/260801_native_main_profiles/000_design.md
+++ b/devlog/_plan/260801_native_main_profiles/000_design.md
@@ -176,7 +176,7 @@ type EncryptedEnvelopeV1 = {
 format_version || home_id || profile_id || identity_hash || envelope_sha256
 ```
 
-The vault and journal use `atomicWriteFileAsync()` so Windows ACL application remains asynchronous and happens before publication by rename.
+The vault and journal use `atomicWriteFileAsync()` so Windows ACL application remains asynchronous and happens before publication by rename. In this design, "published" means that the rename completed and a later OpenCodex process can observe the transaction file. `atomicWriteFileAsync()` does not `fsync` either the file or its parent directory. Version 1 therefore covers recovery after an OpenCodex process exit at a published transaction phase; it does not claim durability across an OS or kernel crash or sudden power loss.
 
 ## Key custody
 
@@ -237,7 +237,7 @@ Two enrollment paths are needed.
 
 This keeps the current active login untouched and delegates login creation to official Codex. OpenCodex does not synthesize a native envelope from Pool credentials.
 
-A crash can leave an ACL-restricted staging directory. The next `doctor`, `add`, or `switch` command must detect it and offer deterministic cleanup without printing its contents.
+An OpenCodex process exit can leave an ACL-restricted staging directory. The next `doctor`, `add`, or `switch` command must detect it and offer deterministic cleanup without printing its contents.
 
 ## Switch transaction
 
@@ -276,9 +276,9 @@ The first implementation does not expose a force-live option.
 
 If source restoration fails, the command must retain the encrypted journal, stop all further writes, and return a manual-recovery error. It must never claim that the old login was restored.
 
-## Crash recovery state machine
+## OpenCodex process-exit recovery state machine
 
-The journal is encrypted where it carries auth bytes. Recovery compares current auth digest and identity rather than trusting the last recorded phase.
+The journal is encrypted where it carries auth bytes. Recovery after an interrupted OpenCodex process compares current auth digest and identity rather than trusting the last recorded phase. The phase names below describe transaction files already published by rename, not an OS- or power-loss durability boundary.
 
 | Journal phase | Current auth observation | Recovery action |
 | --- | --- | --- |
@@ -360,12 +360,12 @@ This is stricter than allowing existing work to continue, but it closes the rota
 Proposed first-version commands:
 
 ```text
-ocx account main doctor
-ocx account main register <label>
+ocx account main doctor [--json]
+ocx account main register <label> [--json]
 ocx account main add <label>
 ocx account main list [--json]
-ocx account main switch <profile-id-or-label>
-ocx account main recover [--rollback]
+ocx account main switch <profile-id-or-label> --yes [--json]
+ocx account main recover [--rollback --yes] [--json]
 ```
 
 Output rules:
@@ -413,7 +413,7 @@ All focused tests run once with the repository's bundled Bun and once with Bun 1
 - Rename/read-back mismatch restores the exact source bytes.
 - Restore verification failure retains the encrypted journal and reports `AUTH_RESTORE_FAILED`.
 - Vault commit failure after auth replacement is recovered deterministically.
-- Every crash phase converges correctly when recovery is repeated.
+- Every injected OpenCodex hard-exit point after a published transaction phase converges correctly when recovery is repeated.
 - A third identity or unreadable auth during recovery causes no write.
 
 ### Refresh ownership and concurrency
@@ -444,8 +444,8 @@ The first behavior-changing PR should include:
 - Full-fidelity opaque envelope handling.
 - OS-protected key-provider implementation with no plaintext fallback.
 - Encrypted inactive-profile vault.
-- Home-scoped lock and encrypted crash journal.
-- Atomic switch, exact read-back, exact restore, and recovery.
+- Home-scoped lock and encrypted switch journal for OpenCodex process-exit recovery.
+- Rename-published switch phases, exact read-back, exact restore, and recovery within the documented v1 scope.
 - Confirmed `__main__` runtime transition integration.
 - Failure-injection tests proving original-login restoration.
 - Bundled Bun and Bun 1.4 canary focused test results.
diff --git a/devlog/_plan/260801_native_main_profiles/001_validation.md b/devlog/_plan/260801_native_main_profiles/001_validation.md
index 18aece136..386a1a8dc 100644
--- a/devlog/_plan/260801_native_main_profiles/001_validation.md
+++ b/devlog/_plan/260801_native_main_profiles/001_validation.md
@@ -6,7 +6,7 @@ Branch: `experiment/656-native-profile-design`
 
 ## Validated artifact
 
-The executable part of this spike is intentionally limited to the pure crash-recovery decision model in:
+The executable part of this spike is intentionally limited to the pure interrupted-switch recovery decision model in:
 
 - `src/codex/native-profile-recovery.ts`
 - `tests/native-profile-recovery.test.ts`
@@ -52,24 +52,32 @@ The tests prove these pure decisions:
 - A third identity requires manual recovery and publishes no runtime transition.
 - A changed digest with the expected identity follows the identity-safe recovery branch rather than overwriting an external refresh blindly.
 
-## Explicitly not validated yet
+## Recovery and durability scope
 
-This spike does not claim that production native-profile switching is ready. The following work remains behind the design gates in `000_design.md`:
+The hard-exit matrix covers an OpenCodex process exiting after each transaction file has been
+published by rename. Version 1 does not claim durability across an OS or kernel crash or sudden
+power loss. In particular, `atomicWriteFileAsync()` does not `fsync` either the file or its parent
+directory. The validated claim is deterministic recovery from the published transaction phase
+that a subsequent OpenCodex process can observe.
 
-- Cross-platform OS-protected key provider selection and security review.
-- Full-fidelity encrypted envelope implementation.
-- Effective Codex credential-store mode resolution.
-- Staged official Codex login.
-- Home-scoped interprocess locking.
-- Atomic auth replacement and exact-byte restoration.
-- Encrypted crash-journal persistence and idempotent I/O recovery.
-- Native Codex process quiescence and restart behavior.
-- OpenCodex `__main__` request drain and confirmed runtime-state transition.
-- Failure injection for ACL, rename, read-back, vault commit, and restoration failures.
-- Verification that task/history and unrelated credential stores remain byte-identical.
+## Implemented validation surface
 
-No production code in this spike reads or writes a user's `auth.json`, vault, task, history, Pool, OAuth, provider, or API-key data.
+This document began as a pure decision-model spike. The implementation branch now includes and
+exercises:
 
-## PR readiness
+- A fail-closed native OS-keyring provider and full-fidelity encrypted profile envelopes.
+- Effective credential-store mode resolution and restricted official Codex login staging.
+- Home-scoped interprocess locking, exact-byte auth replacement, read-back, and restoration.
+- Encrypted switch-journal persistence and idempotent recovery after an OpenCodex process exit.
+- Native Codex process quiescence, `__main__` request drain, and confirmed runtime transition.
+- Failure injection for ACL, rename, read-back, vault commit, restoration, and journal corruption.
+- Byte-preservation checks for task/history and unrelated credential stores.
 
-The design and pure state model are suitable for maintainer discussion. A behavior-changing upstream PR is not suitable until maintainers choose the OS key-provider approach and confirm the file-only v1 boundary.
+The focused suites cover these paths with mocked failure seams and real subprocess exits. They do
+not widen the recovery and durability scope documented above.
+
+## Remaining publication evidence
+
+- Hosted cross-platform CI and live keyring smoke where each platform credential store is available.
+- Manual end-to-end staged login, account switch, and required Codex client restart on supported desktops.
+- Final integration with current `dev` and resolution of maintainer review feedback before ready-for-review status.
diff --git a/devlog/_plan/260801_native_main_profiles/002_implementation.md b/devlog/_plan/260801_native_main_profiles/002_implementation.md
index 866c3327d..f04d7bec0 100644
--- a/devlog/_plan/260801_native_main_profiles/002_implementation.md
+++ b/devlog/_plan/260801_native_main_profiles/002_implementation.md
@@ -6,8 +6,12 @@ Branch: `feat/656-native-main-profiles`
 
 This increment turns the design spike into a CLI/backend-only implementation candidate. It adds an
 OS-keyring-backed encrypted vault, restricted official-login staging, a home-scoped transaction
-lock, encrypted crash journal, exact-byte auth replacement and rollback, explicit recovery, and
-confirmed `__main__` runtime reconciliation.
+lock, encrypted switch journal for OpenCodex process-exit recovery, exact-byte auth replacement
+and rollback, explicit recovery, and confirmed `__main__` runtime reconciliation.
+
+The version 1 recovery scope is an OpenCodex process exit after a transaction file has been
+published by rename. It does not claim durability across an OS or kernel crash or sudden power
+loss. `atomicWriteFileAsync()` does not `fsync` either the file or its parent directory.
 
 The management API carries profile labels, generated profile IDs, and staging IDs only. It never
 accepts or returns auth envelopes, access tokens, refresh tokens, raw account IDs, or decrypted
diff --git a/docs-site/src/content/docs/ja/reference/cli/providers-accounts.md b/docs-site/src/content/docs/ja/reference/cli/providers-accounts.md
index dfabda949..7a8b43384 100644
--- a/docs-site/src/content/docs/ja/reference/cli/providers-accounts.md
+++ b/docs-site/src/content/docs/ja/reference/cli/providers-accounts.md
@@ -183,6 +183,8 @@ ocx account main recover [--rollback --yes] [--json]
 
 バージョン 1 はファイルベースの Codex 認証をサポートし、保存したプロファイルを AES-256-GCM で暗号化し、暗号鍵を OS の資格情報ストアに保持します。`add` は、生成された資格情報を取り込む前に公式 Codex ログインをステージングします。プロファイルを切り替える前に Codex を終了してください。切り替えに成功するとローカルのタスクと履歴は保持されますが、続行する前に Codex の再起動が必要です。`doctor` でプロファイル状態を確認し、`recover` で中断した切り替えを完了またはロールバックできます。`switch` にはプロファイル ID またはラベルを指定できます。
 
+v1 の復旧マトリクスが対象とするのは、トランザクションファイルの rename による公開後に OpenCodex プロセスが終了した場合です。OS またはカーネルのクラッシュや突然の電源断に対する永続性は保証しません。`atomicWriteFileAsync()` はファイルまたは親ディレクトリに `fsync` を実行しません。
+
 ## モデル
 
 ### `ocx models [subcommand]`・`ocx model <subcommand>`
diff --git a/docs-site/src/content/docs/ko/reference/cli/providers-accounts.md b/docs-site/src/content/docs/ko/reference/cli/providers-accounts.md
index 45b1ddb2e..a806b553c 100644
--- a/docs-site/src/content/docs/ko/reference/cli/providers-accounts.md
+++ b/docs-site/src/content/docs/ko/reference/cli/providers-accounts.md
@@ -183,6 +183,8 @@ ocx account main recover [--rollback --yes] [--json]
 
 버전 1은 파일 기반 Codex 인증을 지원하고 저장된 프로필을 AES-256-GCM으로 암호화하며 암호화 키를 운영 체제 자격 증명 저장소에 보관합니다. `add`는 생성된 자격 증명을 가져오기 전에 공식 Codex 로그인을 스테이징합니다. 프로필을 전환하기 전에 Codex를 종료하십시오. 전환에 성공하면 로컬 작업과 기록은 보존되지만 계속하기 전에 Codex를 다시 시작해야 합니다. `doctor`로 프로필 상태를 확인하고 `recover`로 중단된 전환을 완료하거나 롤백할 수 있습니다. `switch`에는 프로필 ID 또는 라벨을 지정할 수 있습니다.
 
+v1 복구 매트릭스는 트랜잭션 파일이 rename으로 게시된 뒤 OpenCodex 프로세스가 종료되는 경우를 다룹니다. 운영 체제 또는 커널 충돌이나 갑작스러운 전원 손실에 대한 내구성은 보장하지 않습니다. `atomicWriteFileAsync()`는 파일이나 부모 디렉터리에 `fsync`를 수행하지 않습니다.
+
 ## 모델
 
 ### `ocx models [subcommand]` · `ocx model <subcommand>`
diff --git a/docs-site/src/content/docs/reference/cli/providers-accounts.md b/docs-site/src/content/docs/reference/cli/providers-accounts.md
index 392041a5c..1fa5e222b 100644
--- a/docs-site/src/content/docs/reference/cli/providers-accounts.md
+++ b/docs-site/src/content/docs/reference/cli/providers-accounts.md
@@ -234,6 +234,10 @@ successful switch preserves local tasks and history, then requires Codex to be r
 `doctor` to inspect profile state and `recover` to finish or roll back an interrupted transition.
 `switch` accepts either the profile ID or its label.
 
+The v1 recovery matrix covers an OpenCodex process exiting after a transaction file has been
+published by rename. It does not claim durability across an OS or kernel crash or sudden power
+loss: `atomicWriteFileAsync()` does not `fsync` either the file or its parent directory.
+
 The encrypted vault, switch journal, recovery marker, and journal quarantine live in the canonical
 `<real CODEX_HOME>/.opencodex-native-main-profiles` directory, so every OpenCodex instance sharing
 that Codex home observes one owner and one recovery state. Plaintext login staging remains isolated
diff --git a/docs-site/src/content/docs/ru/reference/cli/providers-accounts.md b/docs-site/src/content/docs/ru/reference/cli/providers-accounts.md
index ea71870ad..0120853bb 100644
--- a/docs-site/src/content/docs/ru/reference/cli/providers-accounts.md
+++ b/docs-site/src/content/docs/ru/reference/cli/providers-accounts.md
@@ -234,6 +234,8 @@ ocx account main recover [--rollback --yes] [--json]
 
 Версия 1 поддерживает файловую аутентификацию Codex, шифрует сохранённые профили с помощью AES-256-GCM и хранит ключ шифрования в хранилище учётных данных операционной системы. `add` запускает официальный вход Codex в промежуточной среде перед импортом полученных учётных данных. Перед переключением профиля закройте Codex. Успешное переключение сохраняет локальные задачи и историю, после чего Codex необходимо перезапустить. Используйте `doctor` для проверки состояния профилей, а `recover` для завершения или отката прерванного перехода. `switch` принимает ID профиля или его label.
 
+Матрица восстановления v1 охватывает завершение процесса OpenCodex после публикации файла транзакции переименованием. Она не заявляет устойчивость при сбое ОС или ядра либо внезапном отключении питания: `atomicWriteFileAsync()` не вызывает `fsync` ни для файла, ни для родительского каталога.
+
 ## Модели
 
 ### `ocx models [subcommand]` · `ocx model <subcommand>`
diff --git a/docs-site/src/content/docs/zh-cn/reference/cli/providers-accounts.md b/docs-site/src/content/docs/zh-cn/reference/cli/providers-accounts.md
index 3c8a7c65c..328cd62b7 100644
--- a/docs-site/src/content/docs/zh-cn/reference/cli/providers-accounts.md
+++ b/docs-site/src/content/docs/zh-cn/reference/cli/providers-accounts.md
@@ -216,6 +216,8 @@ ocx account main recover [--rollback --yes] [--json]
 
 版本 1 支持基于文件的 Codex 身份验证，使用 AES-256-GCM 加密保存的配置文件，并将加密密钥保存在操作系统凭据存储中。`add` 会先在受限暂存环境中启动官方 Codex 登录，再导入生成的凭据。切换配置文件前请关闭 Codex。切换成功后会保留本地任务和历史记录，但继续使用前必须重启 Codex。使用 `doctor` 检查配置文件状态，使用 `recover` 完成或回滚中断的切换。`switch` 可接受配置文件 ID 或标签。
 
+v1 恢复矩阵覆盖的是事务文件通过重命名发布后 OpenCodex 进程退出的情况。它不声明能够在操作系统或内核崩溃、突然断电后持久保存：`atomicWriteFileAsync()` 不会对文件或父目录执行 `fsync`。
+
 ## 模型
 
 ### `ocx models [subcommand]` · `ocx model <subcommand>`
diff --git a/tests/native-profile-crash-boundaries.test.ts b/tests/native-profile-crash-boundaries.test.ts
index 68abcd9f3..4c61fc2a3 100644
--- a/tests/native-profile-crash-boundaries.test.ts
+++ b/tests/native-profile-crash-boundaries.test.ts
@@ -141,8 +141,8 @@ const boundaries: Array<{
   { boundary: "journal-deleted", auth: "target", owner: "target", phase: null },
 ];
 
-describe("native profile subprocess crash boundaries", () => {
-  test("hard process exit at every durable boundary converges exact auth, vault, journal, gate, and runtime bearer", async () => {
+describe("native profile OpenCodex process-exit phases", () => {
+  test("hard OpenCodex process exit after each published transaction phase converges exact auth, vault, journal, gate, and runtime bearer", async () => {
     for (const scenario of boundaries) {
       const f = await fixture();
       const marker = join(f.root, `crash-${scenario.boundary}`);
diff --git a/tests/native-profile-manager.test.ts b/tests/native-profile-manager.test.ts
index 3d540a83e..2702c5119 100644
--- a/tests/native-profile-manager.test.ts
+++ b/tests/native-profile-manager.test.ts
@@ -968,7 +968,7 @@ describe("native main profile transactions", () => {
     expect(journal).not.toContain("opaque-refresh-target");
   });
 
-  test("normal switch rejects a busy native Codex process before any durable write", async () => {
+  test("normal switch rejects a busy native Codex process before publishing any transaction file", async () => {
     const f = await enrolledFixture();
     const blocked = new NativeProfileManager({
       ...f.options,

From 074344ff75c53856af336ecf9288cb07bbe0178e Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Mon, 3 Aug 2026 09:33:18 +0900
Subject: [PATCH 56/63] fix(codex): make native process probe nonblocking

---
 src/codex/native-profile-processes.ts  |  82 +++++++-------
 tests/native-profile-processes.test.ts | 148 +++++++++++++++++++++----
 2 files changed, 168 insertions(+), 62 deletions(-)

diff --git a/src/codex/native-profile-processes.ts b/src/codex/native-profile-processes.ts
index 6780f01ee..d310cc2ee 100644
--- a/src/codex/native-profile-processes.ts
+++ b/src/codex/native-profile-processes.ts
@@ -1,22 +1,26 @@
-import { execFileSync } from "node:child_process";
-import { basename, win32 } from "node:path";
+import { execFile } from "node:child_process";
+import { basename } from "node:path";
+import { resolveTrustedWindowsPowerShellExe } from "../lib/windows-elevation";
 
-const DEFAULT_WINDOWS_SYSTEM_ROOT = "C:\\Windows";
 const PROCESS_LIST_MAX_BUFFER = 16 * 1024 * 1024;
 
 export interface NativeProcessExecOptions {
   encoding: "utf8";
-  stdio: ["ignore", "pipe", "ignore"];
   timeout: number;
   maxBuffer: number;
   windowsHide?: boolean;
+  shell: false;
+  killSignal: "SIGKILL";
 }
 
-export type NativeProcessExecutor = (file: string, args: string[], options: NativeProcessExecOptions) => string;
+export type NativeProcessExecutor = (
+  file: string,
+  args: string[],
+  options: NativeProcessExecOptions,
+) => Promise<string>;
 
 export interface NativeCodexProcessProbeOptions {
   platform?: NodeJS.Platform;
-  systemRoot?: string;
   execFile?: NativeProcessExecutor;
   pid?: number;
 }
@@ -26,52 +30,53 @@ export type NativeCodexProcessProbe =
   | { status: "busy"; count: number }
   | { status: "unknown"; count: 0 };
 
-const executeProcess: NativeProcessExecutor = (file, args, options) => execFileSync(file, args, options);
-
-export function resolveWindowsSystemRoot(value: string | undefined): string {
-  if (!value?.trim()) return DEFAULT_WINDOWS_SYSTEM_ROOT;
-  const normalized = win32.normalize(value.trim());
-  const parsed = win32.parse(normalized);
-  const driveRoot = /^[A-Za-z]:\\$/.test(parsed.root);
-  const directWindowsDirectory = win32.dirname(normalized).toLowerCase() === parsed.root.toLowerCase()
-    && win32.basename(normalized).toLowerCase() === "windows";
-  return driveRoot && directWindowsDirectory
-    ? `${parsed.root[0]!.toUpperCase()}:\\Windows`
-    : DEFAULT_WINDOWS_SYSTEM_ROOT;
-}
+/** Async, shell-free child execution with runtime-enforced timeout and output bounds. */
+export const executeNativeProcess: NativeProcessExecutor = (file, args, options) => new Promise((resolve, reject) => {
+  execFile(file, args, {
+    encoding: options.encoding,
+    timeout: options.timeout,
+    maxBuffer: options.maxBuffer,
+    windowsHide: options.windowsHide,
+    shell: false,
+    killSignal: options.killSignal,
+  }, (error, stdout) => {
+    if (error) {
+      reject(error);
+      return;
+    }
+    resolve(stdout);
+  });
+});
 
-function windowsProcessCount(execFile: NativeProcessExecutor, systemRoot: string | undefined): number {
-  const powershell = win32.join(
-    resolveWindowsSystemRoot(systemRoot),
-    "System32",
-    "WindowsPowerShell",
-    "v1.0",
-    "powershell.exe",
-  );
+async function windowsProcessCount(run: NativeProcessExecutor): Promise<number> {
+  const powershell = resolveTrustedWindowsPowerShellExe();
   const script = [
     "$ErrorActionPreference='Stop';",
     "$self=$PID;",
     "$items=Get-CimInstance Win32_Process | Where-Object { $_.ProcessId -ne $self -and ($_.Name -match '^(?i:codex)(?:\\.exe)?$' -or $_.CommandLine -match '(?i)(?:^|[\\\\/\"\\s])codex(?:\\.exe|\\.cmd)?(?:[\"\\s]|$)') };",
     "@($items).Count",
   ].join(" ");
-  const output = execFile(powershell, ["-NoLogo", "-NoProfile", "-NonInteractive", "-Command", script], {
+  const output = (await run(powershell, ["-NoLogo", "-NoProfile", "-NonInteractive", "-Command", script], {
     encoding: "utf8",
-    stdio: ["ignore", "pipe", "ignore"],
     timeout: 12_000,
     maxBuffer: PROCESS_LIST_MAX_BUFFER,
     windowsHide: true,
-  }).trim();
+    shell: false,
+    killSignal: "SIGKILL",
+  })).trim();
+  if (!/^\d+$/.test(output)) throw new Error("invalid process count");
   const count = Number(output);
-  if (!Number.isInteger(count) || count < 0) throw new Error("invalid process count");
+  if (!Number.isSafeInteger(count)) throw new Error("invalid process count");
   return count;
 }
 
-function unixProcessCount(execFile: NativeProcessExecutor, pid: number): number {
-  const output = execFile("ps", ["-eo", "pid=,comm=,args="], {
+async function unixProcessCount(run: NativeProcessExecutor, pid: number): Promise<number> {
+  const output = await run("ps", ["-eo", "pid=,comm=,args="], {
     encoding: "utf8",
-    stdio: ["ignore", "pipe", "ignore"],
     timeout: 5_000,
     maxBuffer: PROCESS_LIST_MAX_BUFFER,
+    shell: false,
+    killSignal: "SIGKILL",
   });
   let count = 0;
   for (const line of output.split("\n")) {
@@ -87,14 +92,13 @@ function unixProcessCount(execFile: NativeProcessExecutor, pid: number): number
 /** Best-effort, read-only process probe. It never terminates a user process. */
 export async function probeNativeCodexProcesses({
   platform = process.platform,
-  systemRoot = process.env.SystemRoot,
-  execFile = executeProcess,
+  execFile: run = executeNativeProcess,
   pid = process.pid,
 }: NativeCodexProcessProbeOptions = {}): Promise<NativeCodexProcessProbe> {
   try {
-    const count = platform === "win32"
-      ? windowsProcessCount(execFile, systemRoot)
-      : unixProcessCount(execFile, pid);
+    const count = await (platform === "win32"
+      ? windowsProcessCount(run)
+      : unixProcessCount(run, pid));
     return count > 0 ? { status: "busy", count } : { status: "clear", count: 0 };
   } catch {
     return { status: "unknown", count: 0 };
diff --git a/tests/native-profile-processes.test.ts b/tests/native-profile-processes.test.ts
index 065083d09..0b2fa4884 100644
--- a/tests/native-profile-processes.test.ts
+++ b/tests/native-profile-processes.test.ts
@@ -1,42 +1,56 @@
 import { describe, expect, test } from "bun:test";
+import { existsSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
 import {
+  executeNativeProcess,
   probeNativeCodexProcesses,
-  resolveWindowsSystemRoot,
   type NativeProcessExecutor,
 } from "../src/codex/native-profile-processes";
+import { setTrustedWindowsSystemDirectoryResolverForTests } from "../src/lib/windows-elevation";
 
-describe("native profile process probe", () => {
-  test("accepts only a drive-root Windows directory as SystemRoot", () => {
-    expect(resolveWindowsSystemRoot(undefined)).toBe("C:\\Windows");
-    expect(resolveWindowsSystemRoot("D:\\Windows")).toBe("D:\\Windows");
-    expect(resolveWindowsSystemRoot("d:\\WINDOWS\\")).toBe("D:\\Windows");
-    expect(resolveWindowsSystemRoot("C:\\Users\\runner\\Windows")).toBe("C:\\Windows");
-    expect(resolveWindowsSystemRoot("\\\\server\\share\\Windows")).toBe("C:\\Windows");
-    expect(resolveWindowsSystemRoot("relative\\Windows")).toBe("C:\\Windows");
-  });
+async function withTrustedWindowsPowerShell<T>(run: (powershell: string) => Promise<T>): Promise<T> {
+  const systemDirectory = mkdtempSync(join(tmpdir(), "ocx-system32-"));
+  const powershell = join(systemDirectory, "WindowsPowerShell", "v1.0", "powershell.exe");
+  mkdirSync(dirname(powershell), { recursive: true });
+  writeFileSync(powershell, "");
+  setTrustedWindowsSystemDirectoryResolverForTests(() => systemDirectory);
+  try {
+    return await run(powershell);
+  } finally {
+    setTrustedWindowsSystemDirectoryResolverForTests(null);
+    rmSync(systemDirectory, { recursive: true, force: true });
+  }
+}
 
-  test("uses the validated PowerShell path and an explicit process-list buffer", async () => {
+describe("native profile process probe", () => {
+  test("uses the trusted PowerShell path with shell-free bounded execution", async () => {
     const calls: Parameters<NativeProcessExecutor>[] = [];
-    const execFile: NativeProcessExecutor = (file, args, options) => {
+    const execFile: NativeProcessExecutor = async (file, args, options) => {
       calls.push([file, args, options]);
       return "2\n";
     };
+    await withTrustedWindowsPowerShell(async powershell => {
+      await expect(probeNativeCodexProcesses({
+        platform: "win32",
+        execFile,
+      })).resolves.toEqual({ status: "busy", count: 2 });
 
-    await expect(probeNativeCodexProcesses({
-      platform: "win32",
-      systemRoot: "C:\\Users\\runner\\fake-root",
-      execFile,
-    })).resolves.toEqual({ status: "busy", count: 2 });
-
-    expect(calls).toHaveLength(1);
-    expect(calls[0]![0]).toBe("C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe");
-    expect(calls[0]![2].maxBuffer).toBe(16 * 1024 * 1024);
-    expect(calls[0]![2].windowsHide).toBe(true);
+      expect(calls).toHaveLength(1);
+      expect(calls[0]![0]).toBe(powershell);
+      expect(calls[0]![1].slice(0, 4)).toEqual(["-NoLogo", "-NoProfile", "-NonInteractive", "-Command"]);
+      expect(calls[0]![1][4]).toContain("Get-CimInstance Win32_Process");
+      expect(calls[0]![2].timeout).toBe(12_000);
+      expect(calls[0]![2].maxBuffer).toBe(16 * 1024 * 1024);
+      expect(calls[0]![2].windowsHide).toBe(true);
+      expect(calls[0]![2].shell).toBe(false);
+      expect(calls[0]![2].killSignal).toBe("SIGKILL");
+    });
   });
 
   test("sets the same buffer for Unix process lists and excludes its own pid", async () => {
     const calls: Parameters<NativeProcessExecutor>[] = [];
-    const execFile: NativeProcessExecutor = (file, args, options) => {
+    const execFile: NativeProcessExecutor = async (file, args, options) => {
       calls.push([file, args, options]);
       return [
         "41 codex /usr/local/bin/codex",
@@ -55,5 +69,93 @@ describe("native profile process probe", () => {
     expect(calls[0]![0]).toBe("ps");
     expect(calls[0]![1]).toEqual(["-eo", "pid=,comm=,args="]);
     expect(calls[0]![2].maxBuffer).toBe(16 * 1024 * 1024);
+    expect(calls[0]![2].shell).toBe(false);
+    expect(calls[0]![2].killSignal).toBe("SIGKILL");
+  });
+
+  test("does not starve an unrelated timer while a probe is pending", async () => {
+    let release!: (value: string) => void;
+    const execFile: NativeProcessExecutor = () => new Promise(resolve => {
+      release = resolve;
+    });
+    const probe = probeNativeCodexProcesses({ platform: "linux", execFile, pid: 42 });
+
+    const winner = await Promise.race([
+      probe.then(() => "probe" as const),
+      new Promise<"timer">(resolve => setTimeout(() => resolve("timer"), 0)),
+    ]);
+    expect(winner).toBe("timer");
+
+    release("42 codex /usr/local/bin/codex\n");
+    await expect(probe).resolves.toEqual({ status: "clear", count: 0 });
+  });
+
+  test("the production executor remains nonblocking while its child is pending", async () => {
+    const child = executeNativeProcess(process.execPath, [
+      "-e",
+      "setTimeout(() => process.stdout.write('ok'), 150);",
+    ], {
+      encoding: "utf8",
+      timeout: 2_000,
+      maxBuffer: 1024,
+      windowsHide: true,
+      shell: false,
+      killSignal: "SIGKILL",
+    });
+
+    const winner = await Promise.race([
+      child.then(() => "child" as const),
+      new Promise<"timer">(resolve => setTimeout(() => resolve("timer"), 0)),
+    ]);
+    expect(winner).toBe("timer");
+    await expect(child).resolves.toBe("ok");
+  });
+
+  test("kills and settles a timed-out child", async () => {
+    const directory = mkdtempSync(join(tmpdir(), "ocx-native-probe-"));
+    const survived = join(directory, "survived");
+    const script = [
+      `setTimeout(() => require('node:fs').writeFileSync(${JSON.stringify(survived)}, 'alive'), 300);`,
+      "setInterval(() => {}, 1_000);",
+    ].join(" ");
+    try {
+      await expect(executeNativeProcess(process.execPath, ["-e", script], {
+        encoding: "utf8",
+        timeout: 100,
+        maxBuffer: 1024,
+        windowsHide: true,
+        shell: false,
+        killSignal: "SIGKILL",
+      })).rejects.toThrow();
+      await Bun.sleep(600);
+      expect(existsSync(survived)).toBe(false);
+    } finally {
+      rmSync(directory, { recursive: true, force: true });
+    }
+  });
+
+  test("rejects output above the configured byte cap", async () => {
+    await expect(executeNativeProcess(process.execPath, [
+      "-e",
+      "process.stdout.write('x'.repeat(4096));",
+    ], {
+      encoding: "utf8",
+      timeout: 2_000,
+      maxBuffer: 64,
+      windowsHide: true,
+      shell: false,
+      killSignal: "SIGKILL",
+    })).rejects.toThrow();
+  });
+
+  test("fails closed for non-decimal or unsafe Windows counts", async () => {
+    await withTrustedWindowsPowerShell(async () => {
+      for (const output of ["", " ", "-1", "1.0", "1e2", "0x10", "9007199254740992"]) {
+        await expect(probeNativeCodexProcesses({
+          platform: "win32",
+          execFile: async () => output,
+        })).resolves.toEqual({ status: "unknown", count: 0 });
+      }
+    });
   });
 });

From c7203bd081143343644888191182d105c184a64f Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Mon, 3 Aug 2026 12:54:58 +0900
Subject: [PATCH 57/63] test(codex): pin native process probe contract

---
 tests/native-profile-processes.test.ts | 27 +++++++++++++++++---------
 1 file changed, 18 insertions(+), 9 deletions(-)

diff --git a/tests/native-profile-processes.test.ts b/tests/native-profile-processes.test.ts
index 0b2fa4884..710d2c68e 100644
--- a/tests/native-profile-processes.test.ts
+++ b/tests/native-profile-processes.test.ts
@@ -30,21 +30,30 @@ describe("native profile process probe", () => {
       calls.push([file, args, options]);
       return "2\n";
     };
+    const script = [
+      "$ErrorActionPreference='Stop';",
+      "$self=$PID;",
+      "$items=Get-CimInstance Win32_Process | Where-Object { $_.ProcessId -ne $self -and ($_.Name -match '^(?i:codex)(?:\\.exe)?$' -or $_.CommandLine -match '(?i)(?:^|[\\\\/\"\\s])codex(?:\\.exe|\\.cmd)?(?:[\"\\s]|$)') };",
+      "@($items).Count",
+    ].join(" ");
     await withTrustedWindowsPowerShell(async powershell => {
       await expect(probeNativeCodexProcesses({
         platform: "win32",
         execFile,
       })).resolves.toEqual({ status: "busy", count: 2 });
 
-      expect(calls).toHaveLength(1);
-      expect(calls[0]![0]).toBe(powershell);
-      expect(calls[0]![1].slice(0, 4)).toEqual(["-NoLogo", "-NoProfile", "-NonInteractive", "-Command"]);
-      expect(calls[0]![1][4]).toContain("Get-CimInstance Win32_Process");
-      expect(calls[0]![2].timeout).toBe(12_000);
-      expect(calls[0]![2].maxBuffer).toBe(16 * 1024 * 1024);
-      expect(calls[0]![2].windowsHide).toBe(true);
-      expect(calls[0]![2].shell).toBe(false);
-      expect(calls[0]![2].killSignal).toBe("SIGKILL");
+      expect(calls).toEqual([[
+        powershell,
+        ["-NoLogo", "-NoProfile", "-NonInteractive", "-Command", script],
+        {
+          encoding: "utf8",
+          timeout: 12_000,
+          maxBuffer: 16 * 1024 * 1024,
+          windowsHide: true,
+          shell: false,
+          killSignal: "SIGKILL",
+        },
+      ]]);
     });
   });
 

From 161a163e91b5da8997bf6f4c9add5e311265c958 Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Mon, 3 Aug 2026 12:02:08 +0900
Subject: [PATCH 58/63] fix(codex): fence native-main metadata reads

---
 src/cli/doctor.ts                       |  76 ++++-
 src/codex/account-lifecycle.ts          |   8 +-
 src/codex/auth-api.ts                   | 402 +++++++++++++++++-------
 src/codex/auth-context.ts               |  14 +-
 src/codex/main-account-cache.ts         |  24 ++
 src/codex/native-main-admission.ts      |  47 +++
 src/oauth/token-guardian.ts             |   2 +-
 src/providers/quota.ts                  |  64 +++-
 src/server/chat-completions.ts          |  28 +-
 src/server/claude-messages.ts           |  36 +--
 tests/chat-completions-endpoint.test.ts |  72 ++++-
 tests/claude-messages-endpoint.test.ts  |  74 ++++-
 tests/codex-auth-api.test.ts            | 254 +++++++++++++++
 tests/codex-auth-context.test.ts        |  12 +-
 tests/doctor.test.ts                    |  45 +++
 tests/native-profile-startup.test.ts    |  50 +++
 tests/provider-quota.test.ts            |  33 +-
 17 files changed, 1038 insertions(+), 203 deletions(-)
 create mode 100644 src/codex/native-main-admission.ts

diff --git a/src/cli/doctor.ts b/src/cli/doctor.ts
index fb849efbb..1be5c5dc8 100644
--- a/src/cli/doctor.ts
+++ b/src/cli/doctor.ts
@@ -19,6 +19,9 @@ import { maskAccountId } from "../lib/privacy";
 import { PROXY_ENV_KEYS, proxyEnvPresent } from "../lib/proxy-env";
 import { configuredAdminToken } from "../lib/admin-secrets";
 import { readCodexTokens } from "../codex/auth-collision";
+import { withNativeMainSharedClaim } from "../codex/native-main-claim";
+import { probeNativeProfileRecoveryState, resolveNativeProfileContext } from "../codex/native-profile-store";
+import { NativeProfileError } from "../codex/native-profile-types";
 import { collectOrcaCodexHomeDiagnostic, resolveCodexHomeDir as resolveCodexHomeDirImpl, isWslRuntime, listWslWindowsCodexHomes, wslAutomountRoot, type CodexHomeDeps } from "../codex/home";
 import { findCodexOnPath, isWindowsInteropDir } from "../codex/shim";
 import { countPendingOpencodexHistory } from "../codex/history-provider";
@@ -481,36 +484,75 @@ export type WhamProbeResult = {
   authenticated: boolean;
 };
 
+type NativeMainDoctorClaim = <T>(operation: () => Promise<T>) => Promise<T>;
+
+export interface WhamProbeDeps {
+  withNativeMainClaim?: NativeMainDoctorClaim;
+  probeNativeMainRecoveryState?: typeof probeNativeProfileRecoveryState;
+}
+
 /**
  * Replicate the runtime WHAM fetch shape (same URL, 8s timeout, main-token
  * headers when present) so the probe fails exactly where the real path fails.
  * `fetchImpl` is injectable for testing.
  */
-export async function probeWham(fetchImpl: typeof fetch = fetch): Promise<WhamProbeResult> {
-  const tokens = readCodexTokens();
-  const headers: Record<string, string> = {};
-  if (tokens) {
-    headers.Authorization = `Bearer ${tokens.access_token}`;
-    headers["ChatGPT-Account-Id"] = tokens.account_id;
-  }
+export async function probeWham(
+  fetchImpl: typeof fetch = fetch,
+  deps: WhamProbeDeps = {},
+): Promise<WhamProbeResult> {
   const start = performance.now();
+  let authenticated = false;
   try {
-    const resp = await fetchImpl(WHAM_USAGE_URL, { headers, signal: AbortSignal.timeout(PROBE_TIMEOUT_MS) });
-    const durationMs = Math.round(performance.now() - start);
-    return {
-      ok: resp.ok,
-      status: resp.status,
-      durationMs,
-      classification: resp.ok ? "ok" : `http_${resp.status}`,
-      authenticated: !!tokens,
-    };
+    const context = resolveNativeProfileContext();
+    const withClaim = deps.withNativeMainClaim
+      ?? (<T>(operation: () => Promise<T>) => withNativeMainSharedClaim(context, operation));
+    return await withClaim(async () => {
+      const recoveryState = (deps.probeNativeMainRecoveryState ?? probeNativeProfileRecoveryState)(context);
+      if (recoveryState !== "none") {
+        return {
+          ok: false,
+          status: null,
+          durationMs: Math.round(performance.now() - start),
+          classification: `native_main_recovery_${recoveryState}`,
+          authenticated: false,
+        };
+      }
+      const tokens = readCodexTokens();
+      const headers: Record<string, string> = {};
+      if (tokens) {
+        headers.Authorization = `Bearer ${tokens.access_token}`;
+        headers["ChatGPT-Account-Id"] = tokens.account_id;
+      }
+      authenticated = !!tokens;
+      const resp = await fetchImpl(WHAM_USAGE_URL, { headers, signal: AbortSignal.timeout(PROBE_TIMEOUT_MS) });
+      const durationMs = Math.round(performance.now() - start);
+      return {
+        ok: resp.ok,
+        status: resp.status,
+        durationMs,
+        classification: resp.ok ? "ok" : `http_${resp.status}`,
+        authenticated,
+      };
+    });
   } catch (err) {
     const durationMs = Math.round(performance.now() - start);
+    if (
+      err instanceof NativeProfileError
+      && (err.code === "NATIVE_MAIN_CLAIM_BUSY" || err.code === "NATIVE_MAIN_CLAIM_UNAVAILABLE")
+    ) {
+      return {
+        ok: false,
+        status: null,
+        durationMs,
+        classification: err.code.toLowerCase(),
+        authenticated: false,
+      };
+    }
     const name = err instanceof Error ? err.name : String(err);
     const classification = name === "TimeoutError" || name === "AbortError"
       ? "timeout"
       : "connect_error";
-    return { ok: false, status: null, durationMs, classification, authenticated: !!tokens };
+    return { ok: false, status: null, durationMs, classification, authenticated };
   }
 }
 
diff --git a/src/codex/account-lifecycle.ts b/src/codex/account-lifecycle.ts
index 2ae99f61d..1d9ecee29 100644
--- a/src/codex/account-lifecycle.ts
+++ b/src/codex/account-lifecycle.ts
@@ -5,7 +5,7 @@ import { MAIN_CODEX_ACCOUNT_ID, setMainAccountPlan } from "./main-account";
 import { clearAccountQuota } from "./quota";
 import { clearCodexUpstreamHealthForAccount, clearThreadAccountMapForAccount } from "./routing";
 import { invalidateCodexWebSocketsForAccount } from "./websocket-registry";
-import { clearMainAccountInfoCache } from "./main-account-cache";
+import { clearMainAccountCredentialPresence, clearMainAccountInfoCache } from "./main-account-cache";
 import { forgetCodexAccountPause } from "./account-pause";
 import type { OcxConfig } from "../types";
 
@@ -16,7 +16,10 @@ export function purgeCodexAccountRuntimeState(accountId: string): void {
   clearAccountQuota(accountId);
   clearThreadAccountMapForAccount(accountId);
   clearCodexUpstreamHealthForAccount(accountId);
-  if (accountId === MAIN_CODEX_ACCOUNT_ID) clearMainAccountInfoCache();
+  if (accountId === MAIN_CODEX_ACCOUNT_ID) {
+    clearMainAccountInfoCache();
+    clearMainAccountCredentialPresence();
+  }
 }
 
 function purgeMainCodexAccountRuntimeState(): void {
@@ -63,6 +66,7 @@ export function applyConfirmedMainCodexAccountTransition(
 
 export function resetMainCodexAccountIdentityTrackingForTests(): void {
   observedMainChatgptAccountId = undefined;
+  clearMainAccountCredentialPresence();
 }
 
 export function deleteCodexAccount(runtimeConfig: OcxConfig, accountId: string): void {
diff --git a/src/codex/auth-api.ts b/src/codex/auth-api.ts
index 7dd9d23ac..43fa17d1b 100644
--- a/src/codex/auth-api.ts
+++ b/src/codex/auth-api.ts
@@ -14,7 +14,6 @@ import {
   TokenRefreshError,
 } from "./account-store";
 import { deleteCodexAccount, reconcileMainCodexAccountRuntimeState } from "./account-lifecycle";
-import { isNativeMainTrafficBlocked } from "./native-profile-startup";
 import { isCodexAccountPaused, setCodexAccountPaused } from "./account-pause";
 import {
   clearCodexAccountCooldown,
@@ -57,8 +56,12 @@ import { getMainAccountPlan, MAIN_CODEX_ACCOUNT_ID, setMainAccountPlan } from ".
 import { captureConfigGeneration } from "../lib/state-store-sweeper";
 import { reconcileLiveStateStores } from "../lib/state-store-registrations";
 import {
+  captureMainAccountIdentityGeneration,
   clearMainAccountInfoCache,
+  getMainAccountCredentialPresence,
   getMainAccountInfoCache,
+  isMainAccountIdentityGenerationLive,
+  setMainAccountCredentialPresence,
   setMainAccountInfoCache,
   type MainAccountInfo,
 } from "./main-account-cache";
@@ -84,7 +87,19 @@ import {
 } from "./account-id";
 import { codexAccountIdNamespaceCollisionError } from "./account-namespace-match";
 import { ResourceAdmissionError, type AdmissionLease } from "../lib/admission";
-import { tryAcquireNativeMainProfileClaim } from "../server/lifecycle";
+import { tryAcquireNativeMainProfileClaim } from "./native-main-admission";
+import { withNativeMainSharedClaim } from "./native-main-claim";
+import { resolveNativeProfileContext } from "./native-profile-store";
+import { NativeProfileError } from "./native-profile-types";
+
+function isNativeMainClaimUnavailable(error: unknown): error is NativeProfileError {
+  return error instanceof NativeProfileError
+    && (error.code === "NATIVE_MAIN_CLAIM_BUSY" || error.code === "NATIVE_MAIN_CLAIM_UNAVAILABLE");
+}
+
+function withNativeMainCredentialClaim<T>(operation: () => Promise<T>): Promise<T> {
+  return withNativeMainSharedClaim(resolveNativeProfileContext(), operation);
+}
 
 function jsonResponse(data: unknown, status = 200): Response {
   return new Response(JSON.stringify(data), {
@@ -193,13 +208,19 @@ function poolAccountDto(
   };
 }
 
-async function resolveResetCreditAuth(
+interface ResetCreditAuth {
+  isMain: boolean;
+  accessToken: string;
+  chatgptAccountId: string;
+  nativeMainLease?: AdmissionLease;
+  nativeMainSharedClaimHeld?: true;
+}
+
+async function withResetCreditAuth<T>(
   runtimeConfig: OcxConfig,
   accountId: string,
-): Promise<
-  | { ok: true; isMain: boolean; accessToken: string; chatgptAccountId: string; nativeMainLease?: AdmissionLease }
-  | { ok: false; response: Response }
-> {
+  operation: (auth: ResetCreditAuth) => Promise<T>,
+): Promise<{ ok: true; value: T } | { ok: false; response: Response }> {
   if (accountId === MAIN_CODEX_ACCOUNT_ID) {
     if (hasLegacyMainCodexPoolAccount(runtimeConfig.codexAccounts)) {
       return { ok: false, response: jsonResponse({ error: "Remove the legacy __main__ pool row before using the Desktop account" }, 409) };
@@ -207,21 +228,31 @@ async function resolveResetCreditAuth(
     const nativeMainLease = tryAcquireNativeMainProfileClaim();
     if (!nativeMainLease) return { ok: false, response: nativeMainProfileBusyResponse() };
     try {
-      const tokens = readCodexTokens();
-      if (!tokens) {
-        nativeMainLease.release();
-        return { ok: false, response: jsonResponse({ error: "Main Codex account not logged in" }, 401) };
+      try {
+        return await withNativeMainCredentialClaim(async () => {
+          const tokens = readCodexTokens();
+          if (!tokens) {
+            return { ok: false, response: jsonResponse({ error: "Main Codex account not logged in" }, 401) };
+          }
+          return {
+            ok: true,
+            value: await operation({
+              isMain: true,
+              accessToken: tokens.access_token,
+              chatgptAccountId: tokens.account_id,
+              nativeMainLease,
+              nativeMainSharedClaimHeld: true,
+            }),
+          };
+        });
+      } catch (error) {
+        if (isNativeMainClaimUnavailable(error)) {
+          return { ok: false, response: nativeMainProfileBusyResponse() };
+        }
+        throw error;
       }
-      return {
-        ok: true,
-        isMain: true,
-        accessToken: tokens.access_token,
-        chatgptAccountId: tokens.account_id,
-        nativeMainLease,
-      };
-    } catch (error) {
+    } finally {
       nativeMainLease.release();
-      throw error;
     }
   }
   if (!isValidCodexAccountId(accountId)) {
@@ -231,7 +262,14 @@ async function resolveResetCreditAuth(
     return { ok: false, response: jsonResponse({ error: "Unknown Codex account" }, 404) };
   }
   const cred = await getValidCodexToken(accountId);
-  return { ok: true, isMain: false, accessToken: cred.accessToken, chatgptAccountId: cred.chatgptAccountId };
+  return {
+    ok: true,
+    value: await operation({
+      isMain: false,
+      accessToken: cred.accessToken,
+      chatgptAccountId: cred.chatgptAccountId,
+    }),
+  };
 }
 
 function safeResetCreditsDto(input: unknown): { credits: { granted_at: string; expires_at: string }[]; available_count?: number } {
@@ -381,15 +419,33 @@ async function isTerminalMainAuthResponse(resp: Response): Promise<boolean> {
 
 interface MainAccountInfoFetchResult {
   info: MainAccountInfo;
+  /** Whether this attempt safely inspected the physical native-main credential. */
+  credentialChecked: boolean;
+  /** Meaningful only when credentialChecked is true. */
+  hasCredential: boolean;
+  /** Main identity generation captured while the native-main claim was held. */
+  identityGeneration?: number;
   /** Present only when this call freshly parsed a WHAM usage response. */
   freshQuota?: Omit<StoredAccountQuota, "updatedAt">;
   /** Present only when this call's WHAM response included `rate_limit_reset_credits.available_count`. */
   freshResetCredits?: number;
 }
 
+export interface MainAccountInfoSnapshot {
+  info: MainAccountInfo;
+  mainIdentityGeneration: number;
+}
+
+export async function fetchMainAccountInfoSnapshot(forceRefresh = false): Promise<MainAccountInfoSnapshot> {
+  const result = await fetchMainAccountInfoAttempt(forceRefresh, 1);
+  return {
+    info: result.info,
+    mainIdentityGeneration: result.identityGeneration ?? captureMainAccountIdentityGeneration(),
+  };
+}
+
 export async function fetchMainAccountInfo(forceRefresh = false): Promise<MainAccountInfo> {
-  const { info } = await fetchMainAccountInfoAttempt(forceRefresh, 1);
-  return info;
+  return (await fetchMainAccountInfoSnapshot(forceRefresh)).info;
 }
 
 const EMPTY_MAIN_ACCOUNT_INFO: MainAccountInfo = { email: null, plan: null, quota: null };
@@ -397,22 +453,64 @@ const EMPTY_MAIN_ACCOUNT_INFO: MainAccountInfo = { email: null, plan: null, quot
 async function retryMainAccountInfoIfIdentityChanged(
   requestAccountId: string | null,
   retriesRemaining: number,
+  nativeMainLease: AdmissionLease,
 ): Promise<MainAccountInfoFetchResult | null> {
   const currentAccountId = getMainChatgptAccountId();
   if (currentAccountId === null || currentAccountId === requestAccountId) return null;
   reconcileMainCodexAccountRuntimeState();
   return retriesRemaining > 0
-    ? fetchMainAccountInfoAttempt(true, retriesRemaining - 1)
-    : { info: EMPTY_MAIN_ACCOUNT_INFO };
+    ? fetchMainAccountInfoWhileOwned(true, retriesRemaining - 1, nativeMainLease)
+    : { info: EMPTY_MAIN_ACCOUNT_INFO, credentialChecked: true, hasCredential: true };
 }
 
-async function fetchMainAccountInfoAttempt(forceRefresh: boolean, retriesRemaining: number): Promise<MainAccountInfoFetchResult> {
-  // Startup journal recovery is the credential ownership boundary. Do not let a
-  // best-effort quota probe read or quarantine __main__ while that boundary is closed.
-  if (isNativeMainTrafficBlocked()) return { info: EMPTY_MAIN_ACCOUNT_INFO };
+async function fetchMainAccountInfoAttempt(
+  forceRefresh: boolean,
+  retriesRemaining: number,
+  existingNativeMainLease?: AdmissionLease,
+  nativeMainSharedClaimHeld = false,
+): Promise<MainAccountInfoFetchResult> {
+  const nativeMainLease = existingNativeMainLease ?? tryAcquireNativeMainProfileClaim();
+  if (!nativeMainLease) {
+    return {
+      info: EMPTY_MAIN_ACCOUNT_INFO,
+      credentialChecked: false,
+      hasCredential: false,
+      identityGeneration: captureMainAccountIdentityGeneration(),
+    };
+  }
+  try {
+    const operation = async () => ({
+      ...await fetchMainAccountInfoWhileOwned(forceRefresh, retriesRemaining, nativeMainLease),
+      identityGeneration: captureMainAccountIdentityGeneration(),
+    });
+    if (nativeMainSharedClaimHeld) return await operation();
+    try {
+      return await withNativeMainCredentialClaim(operation);
+    } catch (error) {
+      if (isNativeMainClaimUnavailable(error)) {
+        return {
+          info: EMPTY_MAIN_ACCOUNT_INFO,
+          credentialChecked: false,
+          hasCredential: false,
+          identityGeneration: captureMainAccountIdentityGeneration(),
+        };
+      }
+      throw error;
+    }
+  } finally {
+    if (!existingNativeMainLease) nativeMainLease.release();
+  }
+}
+
+async function fetchMainAccountInfoWhileOwned(
+  forceRefresh: boolean,
+  retriesRemaining: number,
+  nativeMainLease: AdmissionLease,
+): Promise<MainAccountInfoFetchResult> {
   const writerGeneration = captureConfigGeneration();
   reconcileMainCodexAccountRuntimeState();
   const tokenRead = readCodexTokensResult();
+  setMainAccountCredentialPresence(tokenRead.status === "ok");
   if (tokenRead.status !== "ok") {
     // A local read failure is NOT proof of sign-out: a missing file can be a non-atomic rewrite
     // gap, and malformed JSON can be a half-written file. Clearing the cache and marking the
@@ -421,13 +519,13 @@ async function fetchMainAccountInfoAttempt(forceRefresh: boolean, retriesRemaini
     // routing stays fail-closed because getMainAccountToken() re-reads the file itself, and the
     // account DTO still reports hasCredential=false while the file is unreadable.
     const preserved = getMainAccountInfoCache();
-    return { info: preserved ?? EMPTY_MAIN_ACCOUNT_INFO };
+    return { info: preserved ?? EMPTY_MAIN_ACCOUNT_INFO, credentialChecked: true, hasCredential: false };
   }
   const tokens = tokenRead.tokens;
   const requestAccountId = extractAccountId(tokens.id_token, tokens.access_token) ?? (tokens.account_id || null);
   const cached = getMainAccountInfoCache();
   if (!forceRefresh && cached && Date.now() - cached.ts < MAIN_CACHE_TTL) {
-    return { info: cached };
+    return { info: cached, credentialChecked: true, hasCredential: true };
   }
   try {
     const resp = await fetch("https://chatgpt.com/backend-api/wham/usage", {
@@ -436,16 +534,16 @@ async function fetchMainAccountInfoAttempt(forceRefresh: boolean, retriesRemaini
     });
     if (!resp.ok) {
       const terminalAuthFailure = await isTerminalMainAuthResponse(resp);
-      const retried = await retryMainAccountInfoIfIdentityChanged(requestAccountId, retriesRemaining);
+      const retried = await retryMainAccountInfoIfIdentityChanged(requestAccountId, retriesRemaining, nativeMainLease);
       if (retried) return retried;
       if (terminalAuthFailure) {
         clearMainAccountInfoCache();
         markAccountNeedsReauth(MAIN_CODEX_ACCOUNT_ID, writerGeneration);
       }
-      return { info: EMPTY_MAIN_ACCOUNT_INFO };
+      return { info: EMPTY_MAIN_ACCOUNT_INFO, credentialChecked: true, hasCredential: true };
     }
     const data = (await resp.json()) as WhamUsageResponse;
-    const retried = await retryMainAccountInfoIfIdentityChanged(requestAccountId, retriesRemaining);
+    const retried = await retryMainAccountInfoIfIdentityChanged(requestAccountId, retriesRemaining, nativeMainLease);
     if (retried) return retried;
     const plan = nonEmptyPlan(data.plan_type) ?? nonEmptyPlan(cached?.plan) ?? nonEmptyPlan(getMainAccountPlan());
     const quota = parseUsageQuota({ ...data, ...(plan ? { plan_type: plan } : {}) });
@@ -466,12 +564,14 @@ async function fetchMainAccountInfoAttempt(forceRefresh: boolean, retriesRemaini
     }
     return {
       info: result,
+      credentialChecked: true,
+      hasCredential: true,
       ...(quota ? { freshQuota: quota } : {}),
       ...(freshResetCredits !== undefined ? { freshResetCredits } : {}),
     };
   } catch {
-    const retried = await retryMainAccountInfoIfIdentityChanged(requestAccountId, retriesRemaining);
-    return retried ?? { info: EMPTY_MAIN_ACCOUNT_INFO };
+    const retried = await retryMainAccountInfoIfIdentityChanged(requestAccountId, retriesRemaining, nativeMainLease);
+    return retried ?? { info: EMPTY_MAIN_ACCOUNT_INFO, credentialChecked: true, hasCredential: true };
   }
 }
 
@@ -725,16 +825,7 @@ export interface PrimeCodexPoolQuotasOptions {
 }
 
 function tryAcquireNativeMainPrimeLease(): AdmissionLease | null {
-  if (isNativeMainTrafficBlocked()) return null;
-  const claim = tryAcquireNativeMainProfileClaim();
-  if (!claim) return null;
-  // Recovery may be discovered after generic admission. Recheck after main
-  // ownership is established and before reconciliation or credential reads.
-  if (isNativeMainTrafficBlocked()) {
-    claim.release();
-    return null;
-  }
-  return claim;
+  return tryAcquireNativeMainProfileClaim();
 }
 
 /**
@@ -776,13 +867,19 @@ export async function primeCodexPoolQuotas(
       const mainLease = tryAcquireNativeMainPrimeLease();
       if (!mainLease) return;
       try {
-        // Keep one main owner from physical identity reconciliation through WHAM
-        // identity retry and all cache/quota/plan publication before fetch returns.
-        if (isNativeMainTrafficBlocked()) return;
-        (options.reconcileMainAccount ?? reconcileMainCodexAccountRuntimeState)();
-        if (getAccountQuota(MAIN_CODEX_ACCOUNT_ID)) return;
-        if (!(options.readMainTokens ?? readCodexTokens)()) return;
-        await (options.fetchMainInfo ?? fetchMainAccountInfo)(false);
+        try {
+          await withNativeMainCredentialClaim(async () => {
+            // Keep one local owner and one cross-process reader from physical
+            // identity reconciliation through WHAM and all quota publication.
+            (options.reconcileMainAccount ?? reconcileMainCodexAccountRuntimeState)();
+            if (getAccountQuota(MAIN_CODEX_ACCOUNT_ID)) return;
+            if (!(options.readMainTokens ?? readCodexTokens)()) return;
+            if (options.fetchMainInfo) await options.fetchMainInfo(false);
+            else await fetchMainAccountInfoAttempt(false, 1, mainLease, true);
+          });
+        } catch (error) {
+          if (!isNativeMainClaimUnavailable(error)) throw error;
+        }
       } finally {
         mainLease.release();
       }
@@ -811,10 +908,18 @@ export function clearCodexQuotaPrimeState(): void {
   primeInFlight = null;
 }
 
-export async function listCodexAuthAccounts(config: OcxConfig, forceRefresh = false): Promise<CodexAuthAccountDto[]> {
+export interface CodexAuthAccountsSnapshot {
+  accounts: CodexAuthAccountDto[];
+  mainIdentityGeneration: number;
+}
+
+export async function listCodexAuthAccountsSnapshot(
+  config: OcxConfig,
+  forceRefresh = false,
+): Promise<CodexAuthAccountsSnapshot> {
   const runtimeConfig = getRuntimeConfig(config);
   const poolAccounts = (runtimeConfig.codexAccounts ?? []).filter(isSelectableCodexPoolAccount);
-  const mainInfo = await fetchMainAccountInfo(forceRefresh);
+  const mainResult = await fetchMainAccountInfoAttempt(forceRefresh, 1);
   const refreshedPool = await mapWithConcurrency(poolAccounts, POOL_QUOTA_REFRESH_CONCURRENCY, async account => {
     const cred = getCodexAccountCredential(account.id);
     let quotaResult: PoolQuotaResult;
@@ -877,8 +982,14 @@ export async function listCodexAuthAccounts(config: OcxConfig, forceRefresh = fa
       isCodexAccountPaused(runtimeConfig, accountId),
     )];
   });
-  const hasMainCredential = readCodexTokens() !== null;
-  const mainNeedsReauth = !hasMainCredential || isAccountNeedsReauth(MAIN_CODEX_ACCOUNT_ID);
+  const fetchedMainGeneration = mainResult.identityGeneration ?? captureMainAccountIdentityGeneration();
+  const mainSnapshotLive = isMainAccountIdentityGenerationLive(fetchedMainGeneration);
+  const mainInfo = mainSnapshotLive ? mainResult.info : EMPTY_MAIN_ACCOUNT_INFO;
+  const hasMainCredential = mainSnapshotLive && mainResult.credentialChecked
+    ? mainResult.hasCredential
+    : getMainAccountCredentialPresence() ?? false;
+  const mainNeedsReauth = (mainSnapshotLive && mainResult.credentialChecked && !hasMainCredential)
+    || isAccountNeedsReauth(MAIN_CODEX_ACCOUNT_ID);
   const mainHealth = projectCodexAccountHealth({
     accountId: MAIN_CODEX_ACCOUNT_ID,
     needsReauth: mainNeedsReauth,
@@ -894,7 +1005,16 @@ export async function listCodexAuthAccounts(config: OcxConfig, forceRefresh = fa
     quota: mainInfo.quota ? { ...quotaForPlan({ ...mainInfo.quota, updatedAt: Date.now() }, mainInfo.plan) } : null,
     ...oauthAccountHealthFields("codex", MAIN_CODEX_ACCOUNT_ID, mainHealth),
   };
-  return [main, ...withQuota];
+  return {
+    accounts: [main, ...withQuota],
+    mainIdentityGeneration: mainSnapshotLive
+      ? fetchedMainGeneration
+      : captureMainAccountIdentityGeneration(),
+  };
+}
+
+export async function listCodexAuthAccounts(config: OcxConfig, forceRefresh = false): Promise<CodexAuthAccountDto[]> {
+  return (await listCodexAuthAccountsSnapshot(config, forceRefresh)).accounts;
 }
 
 interface PauseExhaustedResult {
@@ -907,57 +1027,95 @@ function selectFallbackAfterPause(config: OcxConfig, pausedActiveId: string): vo
   reconcileCodexActiveAfterExclusion(config, pausedActiveId);
 }
 
-async function pauseExhaustedCodexAccounts(config: OcxConfig): Promise<PauseExhaustedResult> {
+async function pauseExhaustedCodexAccounts(
+  config: OcxConfig,
+  persistPausedAccounts: () => void,
+): Promise<PauseExhaustedResult> {
   const poolAccounts = (config.codexAccounts ?? []).filter(account => !account.isMain);
-  const mainAttempted = readCodexTokens() !== null;
-  const [mainResult, poolResults] = await Promise.all([
-    fetchMainAccountInfoAttempt(true, 1),
-    mapWithConcurrency(poolAccounts, POOL_QUOTA_REFRESH_CONCURRENCY, async account => {
-      if (!getCodexAccountCredential(account.id)) return { account, quotaResult: null };
-      return {
-        account,
-        quotaResult: await fetchPoolAccountQuota(account.id, true, account.plan),
+  const nativeMainLease = tryAcquireNativeMainProfileClaim();
+  try {
+    const performPause = async (mainLease?: AdmissionLease): Promise<PauseExhaustedResult> => {
+      const mainWork = async (): Promise<{
+        shouldPause: boolean;
+        checkedAccountCount: number;
+        failedAccountCount: number;
+      }> => {
+        if (!mainLease) return { shouldPause: false, checkedAccountCount: 0, failedAccountCount: 1 };
+        const mainResult = await fetchMainAccountInfoAttempt(true, 1, mainLease, true);
+        if (!mainResult.credentialChecked || !mainResult.hasCredential) {
+          return { shouldPause: false, checkedAccountCount: 0, failedAccountCount: 0 };
+        }
+        if (!mainResult.freshQuota || !mainResult.info.plan) {
+          return { shouldPause: false, checkedAccountCount: 0, failedAccountCount: 1 };
+        }
+        return {
+          shouldPause: !isCodexAccountPaused(config, MAIN_CODEX_ACCOUNT_ID)
+            && isCodexQuotaExhausted(mainResult.freshQuota, mainResult.info.plan),
+          checkedAccountCount: 1,
+          failedAccountCount: 0,
+        };
       };
-    }),
-  ]);
-
-  let checkedAccountCount = 0;
-  let failedAccountCount = 0;
-  const exhaustedIds: string[] = [];
-  if (mainAttempted) {
-    if (mainResult.freshQuota && mainResult.info.plan) {
-      checkedAccountCount += 1;
-      if (
-        !isCodexAccountPaused(config, MAIN_CODEX_ACCOUNT_ID)
-        && isCodexQuotaExhausted(mainResult.freshQuota, mainResult.info.plan)
-      ) {
-        exhaustedIds.push(MAIN_CODEX_ACCOUNT_ID);
+      const [mainResult, poolResults] = await Promise.all([
+        mainWork(),
+        mapWithConcurrency(poolAccounts, POOL_QUOTA_REFRESH_CONCURRENCY, async account => {
+          if (!getCodexAccountCredential(account.id)) return { account, quotaResult: null };
+          try {
+            return {
+              account,
+              quotaResult: await fetchPoolAccountQuota(account.id, true, account.plan),
+            };
+          } catch {
+            // Settle each pool probe independently so a busy/failing account cannot
+            // abandon an already-confirmed main decision before atomic publication.
+            return { account, quotaResult: null };
+          }
+        }),
+      ]);
+
+      let checkedAccountCount = mainResult.checkedAccountCount;
+      let failedAccountCount = mainResult.failedAccountCount;
+      const exhaustedIds: string[] = mainResult.shouldPause ? [MAIN_CODEX_ACCOUNT_ID] : [];
+      for (const { account, quotaResult } of poolResults) {
+        const currentAccount = (config.codexAccounts ?? []).find(candidate => candidate.id === account.id && !candidate.isMain);
+        if (!currentAccount) continue;
+        const generation = quotaResult?.freshCredentialGeneration;
+        const plan = quotaResult?.freshPlan ?? currentAccount.plan;
+        if (!quotaResult?.freshQuota || generation === undefined || !isCodexAccountGenerationLive(account.id, generation) || !plan) {
+          failedAccountCount += 1;
+          continue;
+        }
+        checkedAccountCount += 1;
+        if (!isCodexAccountPaused(config, account.id) && isCodexQuotaExhausted(quotaResult.freshQuota, plan)) {
+          exhaustedIds.push(account.id);
+        }
       }
-    } else {
-      failedAccountCount += 1;
-    }
-  }
-  for (const { account, quotaResult } of poolResults) {
-    const currentAccount = (config.codexAccounts ?? []).find(candidate => candidate.id === account.id && !candidate.isMain);
-    if (!currentAccount) continue;
-    const generation = quotaResult?.freshCredentialGeneration;
-    const plan = quotaResult?.freshPlan ?? currentAccount.plan;
-    if (!quotaResult?.freshQuota || generation === undefined || !isCodexAccountGenerationLive(account.id, generation) || !plan) {
-      failedAccountCount += 1;
-      continue;
-    }
-    checkedAccountCount += 1;
-    if (!isCodexAccountPaused(config, account.id) && isCodexQuotaExhausted(quotaResult.freshQuota, plan)) {
-      exhaustedIds.push(account.id);
-    }
-  }
 
-  for (const id of exhaustedIds) {
-    setCodexAccountPaused(config, id, true);
-    clearThreadAccountMapForAccount(id);
+      for (const id of exhaustedIds) {
+        setCodexAccountPaused(config, id, true);
+        clearThreadAccountMapForAccount(id);
+      }
+      for (const id of exhaustedIds) selectFallbackAfterPause(config, id);
+      const result = {
+        pausedAccountIds: exhaustedIds,
+        checkedAccountCount,
+        failedAccountCount,
+      };
+      // Persist while both the in-process admission and cross-process shared
+      // claim still own the physical-main identity used for the decision.
+      if (result.pausedAccountIds.length > 0) persistPausedAccounts();
+      return result;
+    };
+
+    if (!nativeMainLease) return await performPause();
+    try {
+      return await withNativeMainCredentialClaim(() => performPause(nativeMainLease));
+    } catch (error) {
+      if (isNativeMainClaimUnavailable(error)) return await performPause();
+      throw error;
+    }
+  } finally {
+    nativeMainLease?.release();
   }
-  for (const id of exhaustedIds) selectFallbackAfterPause(config, id);
-  return { pausedAccountIds: exhaustedIds, checkedAccountCount, failedAccountCount };
 }
 
 export async function handleCodexAuthAPI(
@@ -1081,7 +1239,10 @@ export async function handleCodexAuthAPI(
 
   if (url.pathname === "/api/codex-auth/accounts/pause-exhausted" && req.method === "PUT") {
     const runtimeConfig = getRuntimeConfig(config);
-    const result = await pauseExhaustedCodexAccounts(runtimeConfig);
+    const result = await pauseExhaustedCodexAccounts(
+      runtimeConfig,
+      () => saveRuntimeConfig(config, runtimeConfig),
+    );
     const { pausedAccountIds, checkedAccountCount, failedAccountCount } = result;
     if (checkedAccountCount === 0 && failedAccountCount > 0) {
       return jsonResponse({
@@ -1091,7 +1252,6 @@ export async function handleCodexAuthAPI(
         failedAccountCount,
       }, 502);
     }
-    if (pausedAccountIds.length > 0) saveRuntimeConfig(config, runtimeConfig);
     return jsonResponse({
       ok: true,
       pausedAccountIds,
@@ -1230,9 +1390,7 @@ export async function handleCodexAuthAPI(
     if (!accountId) return jsonResponse({ error: "accountId required" }, 400);
 
     try {
-      const auth = await resolveResetCreditAuth(getRuntimeConfig(config), accountId);
-      if (!auth.ok) return auth.response;
-      try {
+      const result = await withResetCreditAuth(getRuntimeConfig(config), accountId, async auth => {
         const resp = await fetch(
           "https://chatgpt.com/backend-api/wham/rate-limit-reset-credits",
           {
@@ -1248,9 +1406,8 @@ export async function handleCodexAuthAPI(
           return jsonResponse({ error: `Upstream error ${resp.status}` }, resp.status);
         }
         return jsonResponse(safeResetCreditsDto(await resp.json()));
-      } finally {
-        auth.nativeMainLease?.release();
-      }
+      });
+      return result.ok ? result.value : result.response;
     } catch (e) {
       return jsonResponse({ error: e instanceof Error ? e.message : "Reset credit lookup failed" }, 500);
     }
@@ -1259,11 +1416,10 @@ export async function handleCodexAuthAPI(
   if (url.pathname === "/api/codex-auth/reset-credits/consume" && req.method === "POST") {
     const body = (await req.json().catch(() => ({}))) as { accountId?: string };
     if (!body.accountId) return jsonResponse({ error: "accountId required" }, 400);
+    const accountId = body.accountId;
 
     try {
-      const auth = await resolveResetCreditAuth(getRuntimeConfig(config), body.accountId);
-      if (!auth.ok) return auth.response;
-      try {
+      const operation = await withResetCreditAuth(getRuntimeConfig(config), accountId, async auth => {
         const idempotencyKey = crypto.randomUUID();
         const resp = await fetch(
           "https://chatgpt.com/backend-api/wham/rate-limit-reset-credits/consume",
@@ -1289,10 +1445,15 @@ export async function handleCodexAuthAPI(
         if (result.code === "reset" || result.code === "already_redeemed") {
           let freshResetCredits: number | undefined;
           if (auth.isMain) {
-            ({ freshResetCredits } = await fetchMainAccountInfoAttempt(true, 1));
+            ({ freshResetCredits } = await fetchMainAccountInfoAttempt(
+              true,
+              1,
+              auth.nativeMainLease,
+              auth.nativeMainSharedClaimHeld === true,
+            ));
           } else {
-            const account = configuredPoolAccount(getRuntimeConfig(config), body.accountId);
-            ({ freshResetCredits } = await fetchPoolAccountQuota(body.accountId, true, account?.plan));
+            const account = configuredPoolAccount(getRuntimeConfig(config), accountId);
+            ({ freshResetCredits } = await fetchPoolAccountQuota(accountId, true, account?.plan));
           }
           return jsonResponse({
             code: result.code,
@@ -1302,9 +1463,8 @@ export async function handleCodexAuthAPI(
           });
         }
         return jsonResponse(result);
-      } finally {
-        auth.nativeMainLease?.release();
-      }
+      });
+      return operation.ok ? operation.value : operation.response;
     } catch (e) {
       if (e instanceof PoolQuotaProbeBusyError) {
         const response = jsonResponse({ error: "server_busy", code: "server_busy" }, 503);
diff --git a/src/codex/auth-context.ts b/src/codex/auth-context.ts
index dcb9e16c4..160043061 100644
--- a/src/codex/auth-context.ts
+++ b/src/codex/auth-context.ts
@@ -273,10 +273,20 @@ export async function resolveCodexAuthContext(
       : resolveCodexAccountForThreadDetailed(threadId, config, Date.now(), quotaScope, selectionOptions);
     if (resolution.status === "expired") throw new CodexThreadAffinityExpiredError(resolution.accountId);
     const selected = resolution.status === "selected" ? resolution.accountId : null;
-    if (!selected) throw new CodexPoolAuthenticationError();
+    if (!selected) {
+      // Recovery deliberately makes physical main ineligible. If no healthy
+      // pool route is configured and main is the intended route, report the
+      // temporary fence rather than misclassifying that credential as invalid.
+      // A configured pool retry/exclusion that finds no alternate preserves its
+      // ordinary pool-auth failure instead of being mislabeled as a main fence.
+      if (nativeMainTrafficBlocked && !options.excludeAccountId) {
+        throw new CodexMainProfileDrainingError();
+      }
+      throw new CodexPoolAuthenticationError();
+    }
     accountId = selected;
     if (accountId === MAIN_CODEX_ACCOUNT_ID && nativeMainTrafficBlocked) {
-      throw new CodexPoolAuthenticationError();
+      throw new CodexMainProfileDrainingError();
     }
     if (
       accountId === MAIN_CODEX_ACCOUNT_ID
diff --git a/src/codex/main-account-cache.ts b/src/codex/main-account-cache.ts
index d11f7d84e..0eb837b4f 100644
--- a/src/codex/main-account-cache.ts
+++ b/src/codex/main-account-cache.ts
@@ -14,6 +14,16 @@ export interface CachedMainAccountInfo extends MainAccountInfo {
 }
 
 let cachedMainAccountInfo: CachedMainAccountInfo | null = null;
+let cachedMainCredentialPresence: boolean | null = null;
+let mainAccountIdentityGeneration = 0;
+
+export function captureMainAccountIdentityGeneration(): number {
+  return mainAccountIdentityGeneration;
+}
+
+export function isMainAccountIdentityGenerationLive(generation: number): boolean {
+  return generation === mainAccountIdentityGeneration;
+}
 
 export function getMainAccountInfoCache(): CachedMainAccountInfo | null {
   return cachedMainAccountInfo;
@@ -29,4 +39,18 @@ export function setMainAccountInfoCache(value: CachedMainAccountInfo): void {
 
 export function clearMainAccountInfoCache(): void {
   cachedMainAccountInfo = null;
+  mainAccountIdentityGeneration += 1;
+}
+
+/** Last physical credential presence observed while native-main ownership was held. */
+export function getMainAccountCredentialPresence(): boolean | null {
+  return cachedMainCredentialPresence;
+}
+
+export function setMainAccountCredentialPresence(present: boolean): void {
+  cachedMainCredentialPresence = present;
+}
+
+export function clearMainAccountCredentialPresence(): void {
+  cachedMainCredentialPresence = null;
 }
diff --git a/src/codex/native-main-admission.ts b/src/codex/native-main-admission.ts
new file mode 100644
index 000000000..f5c7e809c
--- /dev/null
+++ b/src/codex/native-main-admission.ts
@@ -0,0 +1,47 @@
+import type { AdmissionLease } from "../lib/admission";
+import {
+  tryAcquireNativeMainProfileClaim as tryAcquireLifecycleNativeMainProfileClaim,
+  tryClaimNativeMainProfileForTurn as tryClaimLifecycleNativeMainProfileForTurn,
+} from "../server/lifecycle";
+import { isNativeMainTrafficBlocked } from "./native-profile-startup";
+
+export interface NativeMainTurnClaimDeps {
+  /** Test seams for the synchronous precheck/claim/postcheck transition. */
+  isTrafficBlocked?: typeof isNativeMainTrafficBlocked;
+  claimTurn?: typeof tryClaimLifecycleNativeMainProfileForTurn;
+}
+
+/**
+ * Admit a physical native-main credential read on an existing turn.
+ *
+ * Lifecycle admission owns the scoped switch/shutdown fence while the startup
+ * gate owns retained journal/manual recovery. Keep their composition here so
+ * low-level server lifecycle code does not import NativeProfileManager through
+ * native-profile-startup and create a fragile dependency cycle.
+ */
+export function tryClaimNativeMainProfileForTurn(
+  lease?: AdmissionLease,
+  deps: NativeMainTurnClaimDeps = {},
+): boolean {
+  const isBlocked = deps.isTrafficBlocked ?? isNativeMainTrafficBlocked;
+  const claimTurn = deps.claimTurn ?? tryClaimLifecycleNativeMainProfileForTurn;
+  if (isBlocked()) return false;
+  if (!claimTurn(lease)) return false;
+  if (!isBlocked()) return true;
+
+  // Recovery became visible between the precheck and lifecycle claim. This
+  // request must not read auth.json. Keep the caller-owned turn claimed until
+  // normal request cleanup: optional routed work may continue, and releasing
+  // the whole turn here would let shutdown/profile switching overlap it.
+  return false;
+}
+
+/** Acquire standalone ownership only when both native-main gates admit work. */
+export function tryAcquireNativeMainProfileClaim(): AdmissionLease | null {
+  if (isNativeMainTrafficBlocked()) return null;
+  const claim = tryAcquireLifecycleNativeMainProfileClaim();
+  if (!claim) return null;
+  if (!isNativeMainTrafficBlocked()) return claim;
+  claim.release();
+  return null;
+}
diff --git a/src/oauth/token-guardian.ts b/src/oauth/token-guardian.ts
index bd9b5e03d..a84d68a7c 100644
--- a/src/oauth/token-guardian.ts
+++ b/src/oauth/token-guardian.ts
@@ -30,7 +30,7 @@ import { getMainAccountToken, MAIN_CODEX_ACCOUNT_ID } from "../codex/main-accoun
 import { isCanonicalOpenAiForwardProvider, OPENAI_CODEX_PROVIDER_ID } from "../providers/openai-tiers";
 import { providerCodexAccountMode } from "../providers/registry";
 import { captureConfigGeneration, type GenerationContext } from "../lib/state-store-sweeper";
-import { tryAcquireNativeMainProfileClaim } from "../server/lifecycle";
+import { tryAcquireNativeMainProfileClaim } from "../codex/native-main-admission";
 
 export interface TokenGuardianHandle {
   stop(): void;
diff --git a/src/providers/quota.ts b/src/providers/quota.ts
index 131bc1358..a49e89d72 100644
--- a/src/providers/quota.ts
+++ b/src/providers/quota.ts
@@ -1,4 +1,5 @@
-import { fetchMainAccountInfo, listCodexAuthAccounts } from "../codex/auth-api";
+import { fetchMainAccountInfoSnapshot, listCodexAuthAccountsSnapshot } from "../codex/auth-api";
+import { isMainAccountIdentityGenerationLive } from "../codex/main-account-cache";
 import { MAIN_CODEX_ACCOUNT_ID } from "../codex/main-account";
 import { resolveEnvValue } from "../config";
 import { getValidAccessToken, getValidAccessTokenForAccount } from "../oauth";
@@ -22,6 +23,15 @@ const KIMI_CODE_BASE_URL = "https://api.kimi.com/coding/v1";
 const KIMI_CODE_USAGE_URL = `${KIMI_CODE_BASE_URL}/usages`;
 /** Keep a failed probe's previous row at most this long before dropping it. */
 const LAST_GOOD_MAX_AGE_MS = 30 * 60_000;
+const nativeMainReportGenerations = new WeakMap<ProviderQuotaReport, number>();
+let providerQuotaBeforePublishForTests: (() => void | Promise<void>) | null = null;
+
+/** Test-only seam for identity/config invalidation after probes but before publication. */
+export function setProviderQuotaBeforePublishForTests(
+  hook: (() => void | Promise<void>) | null,
+): void {
+  providerQuotaBeforePublishForTests = hook;
+}
 
 export interface ProviderQuotaWindow {
   label: string;
@@ -134,6 +144,19 @@ function report(provider: string, source: string, quota: ProviderQuota): Provide
   };
 }
 
+function tagNativeMainReport(
+  value: ProviderQuotaReport | null,
+  generation: number,
+): ProviderQuotaReport | null {
+  if (value) nativeMainReportGenerations.set(value, generation);
+  return value;
+}
+
+function isProviderQuotaReportCurrent(value: ProviderQuotaReport): boolean {
+  const generation = nativeMainReportGenerations.get(value);
+  return generation === undefined || isMainAccountIdentityGenerationLive(generation);
+}
+
 async function fetchChatGptForwardQuota(
   config: OcxConfig,
   provider: string,
@@ -141,17 +164,25 @@ async function fetchChatGptForwardQuota(
   forceRefresh: boolean,
 ): Promise<ProviderQuotaReport | null> {
   if (providerCodexAccountMode(provider, providerConfig) === "direct") {
-    const main = await fetchMainAccountInfo(forceRefresh);
-    const quota = main.quota ? { ...main.quota, updatedAt: Date.now() } as ProviderQuota : null;
-    return quota ? report(provider, "chatgpt:wham", quota) : null;
+    const snapshot = await fetchMainAccountInfoSnapshot(forceRefresh);
+    const quota = snapshot.info.quota
+      ? { ...snapshot.info.quota, updatedAt: Date.now() } as ProviderQuota
+      : null;
+    return quota
+      ? tagNativeMainReport(report(provider, "chatgpt:wham", quota), snapshot.mainIdentityGeneration)
+      : null;
   }
-  const accounts = await listCodexAuthAccounts(config, forceRefresh);
+  const snapshot = await listCodexAuthAccountsSnapshot(config, forceRefresh);
+  const accounts = snapshot.accounts;
   const activeId = config.activeCodexAccountId || MAIN_CODEX_ACCOUNT_ID;
   const active = accounts.find(account => account.id === activeId)
     ?? accounts.find(account => account.id === MAIN_CODEX_ACCOUNT_ID)
     ?? accounts[0];
   const quota = active?.quota ? { ...active.quota, updatedAt: active.quota.updatedAt ?? Date.now() } as ProviderQuota : null;
-  return quota ? report(provider, "chatgpt:wham", quota) : null;
+  const value = quota ? report(provider, "chatgpt:wham", quota) : null;
+  return active?.id === MAIN_CODEX_ACCOUNT_ID
+    ? tagNativeMainReport(value, snapshot.mainIdentityGeneration)
+    : value;
 }
 
 function centsValue(value: unknown): number | undefined {
@@ -923,7 +954,8 @@ export async function fetchProviderQuotaReports(config: OcxConfig, forceRefresh
   // The cache fast path must not extend a preserved last-good row past its 30-minute bound:
   // a row preserved at age 29:59 plus a full 5-minute TTL would otherwise serve until ~35min.
   const cacheFresh = cache && cache.key === key && now - cache.ts < CACHE_TTL_MS
-    && cache.response.reports.every(item => now - item.updatedAt < LAST_GOOD_MAX_AGE_MS);
+    && cache.response.reports.every(item =>
+      now - item.updatedAt < LAST_GOOD_MAX_AGE_MS && isProviderQuotaReportCurrent(item));
   if (!forceRefresh && cacheFresh) return cache!.response;
   const joinable = inflight.get(key);
   if (!forceRefresh && joinable && joinable.epoch === invalidationEpoch) return joinable.promise;
@@ -936,6 +968,7 @@ export async function fetchProviderQuotaReports(config: OcxConfig, forceRefresh
     const fresh = (await Promise.all(
       Object.entries(config.providers).map(([name, provider]) => maybeFetchProviderQuota(name, provider, config, forceRefresh)),
     )).filter((item): item is ProviderQuotaReport => item !== null);
+    await providerQuotaBeforePublishForTests?.();
 
     // Keep bounded last-good rows when a probe fails (e.g. transient upstream flake); never
     // re-stamp their timestamps, and drop rows older than LAST_GOOD_MAX_AGE_MS.
@@ -944,14 +977,25 @@ export async function fetchProviderQuotaReports(config: OcxConfig, forceRefresh
     // disabled or removed provider changes the key and starts from an empty previous set.
     const cutoff = Date.now() - LAST_GOOD_MAX_AGE_MS;
     const byProvider = new Map<string, ProviderQuotaReport>();
+    const generationMismatchedProviders = new Set<string>();
     for (const item of previous) {
-      if (item.updatedAt >= cutoff) byProvider.set(item.provider, item);
+      if (item.updatedAt < cutoff) continue;
+      if (isProviderQuotaReportCurrent(item)) byProvider.set(item.provider, item);
+      else generationMismatchedProviders.add(item.provider);
+    }
+    for (const item of fresh) {
+      if (isProviderQuotaReportCurrent(item)) {
+        byProvider.set(item.provider, item);
+        generationMismatchedProviders.delete(item.provider);
+      } else {
+        byProvider.delete(item.provider);
+        generationMismatchedProviders.add(item.provider);
+      }
     }
-    for (const item of fresh) byProvider.set(item.provider, item);
 
     const response = { generatedAt: Date.now(), reports: [...byProvider.values()] };
     // Commit only when this probe still holds authority (no clear/force superseded it).
-    if (epoch === invalidationEpoch) {
+    if (epoch === invalidationEpoch && generationMismatchedProviders.size === 0) {
       const reports = response.reports.filter(item => mayCommitProviderQuotaKey(item.provider, writerGeneration));
       cache = { key, ts: Date.now(), response: { ...response, reports } };
     }
diff --git a/src/server/chat-completions.ts b/src/server/chat-completions.ts
index 2f3056a14..a4489d591 100644
--- a/src/server/chat-completions.ts
+++ b/src/server/chat-completions.ts
@@ -32,8 +32,7 @@ import {
 import { responseWithDeferredRequestLog } from "./relay";
 import { handleResponses } from "./responses";
 import type { AdmissionLease } from "../lib/admission";
-import { codexMainProfileDrainingResponse } from "../codex/auth-context";
-import { tryClaimNativeMainProfileForTurn } from "./lifecycle";
+import { tryClaimNativeMainProfileForTurn } from "../codex/native-main-admission";
 import {
   createTranslatorBudget,
   finalizeTranslatorBudgetResponse,
@@ -161,19 +160,20 @@ async function handleChatCompletionsWithBudget(
   }
   // Prefer main ChatGPT auth so OpenAI-backed sidecars remain reachable on routed turns.
   if (!directRoute) {
-    if (!tryClaimNativeMainProfileForTurn(logIds?.turnAdmissionLease)) {
-      if (logIds) addFinalRequestLog(logIds.requestId, logIds.start, logCtx, 503, { closeReason: "non_stream" });
-      return codexMainProfileDrainingResponse();
-    }
-    try {
-      const { getMainAccountToken } = await import("../codex/main-account");
-      const token = getMainAccountToken();
-      if (token) {
-        headers.set("authorization", `Bearer ${token.accessToken}`);
-        headers.set("chatgpt-account-id", token.chatgptAccountId);
+    // This enrichment is optional for routed/non-main providers. If native main
+    // is fenced, omit it and let auth-context reject only a final physical-main
+    // selection while healthy pool/provider routes continue.
+    if (tryClaimNativeMainProfileForTurn(logIds?.turnAdmissionLease)) {
+      try {
+        const { getMainAccountToken } = await import("../codex/main-account");
+        const token = getMainAccountToken();
+        if (token) {
+          headers.set("authorization", `Bearer ${token.accessToken}`);
+          headers.set("chatgpt-account-id", token.chatgptAccountId);
+        }
+      } catch {
+        /* optional */
       }
-    } catch {
-      /* optional */
     }
   }
 
diff --git a/src/server/claude-messages.ts b/src/server/claude-messages.ts
index baebd8dc2..0d6711e00 100644
--- a/src/server/claude-messages.ts
+++ b/src/server/claude-messages.ts
@@ -34,7 +34,7 @@ import { conversationIdFromClaudeMetadata } from "./request-log-conversation";
 import { responseWithDeferredRequestLog } from "./relay";
 import { handleResponses } from "./responses";
 import type { AdmissionLease } from "../lib/admission";
-import { tryClaimNativeMainProfileForTurn } from "./lifecycle";
+import { tryClaimNativeMainProfileForTurn } from "../codex/native-main-admission";
 import {
   createTranslatorBudget,
   finalizeTranslatorBudgetResponse,
@@ -672,24 +672,17 @@ async function handleClaudeMessagesWithBudget(
     const value = req.headers.get(name);
     if (value) headers.set(name, value);
   }
-  if (!tryClaimNativeMainProfileForTurn(logIds?.turnAdmissionLease)) {
-    const response = anthropicErrorResponse(
-      503,
-      "Native Codex main profile is switching; retry this request",
-      "overloaded_error",
-    );
-    response.headers.set("Retry-After", "1");
-    if (logIds) addFinalRequestLog(logIds.requestId, logIds.start, logCtx, 503, { closeReason: "non_stream" });
-    return response;
-  }
   // Routed replays need main ChatGPT auth so OpenAI-backed sidecars remain reachable;
-  // native replays have no caller ChatGPT credential. The turn claim above keeps any
-  // materialized main token owned through the complete translated response lifetime.
-  const { getMainAccountToken } = await import("../codex/main-account");
-  const token = getMainAccountToken();
-  if (token) {
-    headers.set("authorization", `Bearer ${token.accessToken}`);
-    headers.set("chatgpt-account-id", token.chatgptAccountId);
+  // native replays have no caller ChatGPT credential. This enrichment is optional:
+  // auth-context later rejects a real physical-main selection, while routed/pool
+  // traffic continues without reading native credentials during a fence/recovery.
+  if (tryClaimNativeMainProfileForTurn(logIds?.turnAdmissionLease)) {
+    const { getMainAccountToken } = await import("../codex/main-account");
+    const token = getMainAccountToken();
+    if (token) {
+      headers.set("authorization", `Bearer ${token.accessToken}`);
+      headers.set("chatgpt-account-id", token.chatgptAccountId);
+    }
   }
   if (nativeRoute) {
     // ChatGPT-backend prompt-cache affinity rides the session_id HEADER (codex
@@ -766,8 +759,11 @@ async function handleClaudeMessagesWithBudget(
     // rewrite): log = upstream truth, client = retry signal.
     // Retryable 429s also get Retry-After (#507) so Codex-shaped clients and Claude Code
     // share a backoff hint when the upstream omitted the header.
-    const transient = isTransientUpstreamStatus(response.status);
-    const outStatus = transient ? 529 : response.status;
+    const nativeMainFence = response.status === 503
+      && upstreamRetryAfter?.trim() === "1"
+      && message === "Native Codex main profile is switching; retry this request";
+    const transient = !nativeMainFence && isTransientUpstreamStatus(response.status);
+    const outStatus = nativeMainFence ? 503 : transient ? 529 : response.status;
     const out = new Response(JSON.stringify(anthropicErrorBody(outStatus, message)), {
       status: outStatus,
       headers: {
diff --git a/tests/chat-completions-endpoint.test.ts b/tests/chat-completions-endpoint.test.ts
index fd7e1257a..765bc9c51 100644
--- a/tests/chat-completions-endpoint.test.ts
+++ b/tests/chat-completions-endpoint.test.ts
@@ -16,6 +16,12 @@ import {
   getNativeMainProfileRequestCount,
   resetLifecycleDrainStateForTests,
 } from "../src/server/lifecycle";
+import {
+  blockNativeMainRecovery,
+  completeNativeMainRecovery,
+  nativeMainStartupGateSnapshot,
+  waitForNativeMainStartupGate,
+} from "../src/codex/native-profile-startup";
 
 function budgetedChatOutbound(module: typeof import("../src/chat/outbound")) {
   const translatorBudget = createTestTranslatorBudget();
@@ -545,7 +551,7 @@ test("POST /v1/chat/completions direct mode forwards caller Authorization", asyn
   }
 });
 
-test("Chat main-token replay owns native main through the stream and rejects post-fence work", async () => {
+test("Chat replay owns optional main enrichment while routed work survives drain and recovery", async () => {
   resetLifecycleDrainStateForTests();
   writeFileSync(join(isolatedCodexHome!.path, "auth.json"), JSON.stringify({
     tokens: { access_token: "chat-main-access", account_id: "chat-main-account" },
@@ -559,6 +565,11 @@ test("Chat main-token replay owns native main through the stream and rejects pos
     port: 0,
     fetch() {
       upstreamCalls += 1;
+      if (upstreamCalls > 1) {
+        return new Response('data: {"choices":[{"index":0,"delta":{},"finish_reason":"stop"}]}\n\ndata: [DONE]\n\n', {
+          headers: { "content-type": "text/event-stream" },
+        });
+      }
       return new Response(new ReadableStream<Uint8Array>({
         start(controller) {
           controller.enqueue(encoder.encode('data: {"choices":[{"index":0,"delta":{"content":"held"}}]}\n\n'));
@@ -573,7 +584,8 @@ test("Chat main-token replay owns native main through the stream and rejects pos
     },
   });
   saveConfig(mockConfig(`${upstream.url.toString().replace(/\/$/, "")}/v1`));
-  const server = startServer(0);
+  let server = startServer(0);
+  await waitForNativeMainStartupGate();
   const request = () => fetch(new URL("/v1/chat/completions", server.url), {
     method: "POST",
     headers: { "content-type": "application/json" },
@@ -584,6 +596,7 @@ test("Chat main-token replay owns native main through the stream and rejects pos
     }),
   });
   let drain: ReturnType<typeof acquireNativeMainProfileDrain> = null;
+  let recoveryHomeId: string | null = null;
   try {
     await waitForNativeMainStartupGate();
     const pending = request();
@@ -593,15 +606,60 @@ test("Chat main-token replay owns native main through the stream and rejects pos
     expect(getNativeMainProfileRequestCount()).toBe(1);
     drain = acquireNativeMainProfileDrain("chat-overlap");
     expect(drain).not.toBeNull();
-    const blocked = await request();
-    expect(blocked.status).toBe(503);
-    expect(blocked.headers.get("Retry-After")).toBe("1");
-    expect(upstreamCalls).toBe(1);
+    const routedDuringDrain = await request();
+    expect(routedDuringDrain.status).toBe(200);
+    await routedDuringDrain.text();
+    expect(upstreamCalls).toBe(2);
 
     finishUpstream?.();
     await response.text();
     expect(getNativeMainProfileRequestCount()).toBe(0);
+    drain?.release();
+    drain = null;
+
+    recoveryHomeId = nativeMainStartupGateSnapshot().homeId ?? "chat-recovery-home";
+    expect(blockNativeMainRecovery(recoveryHomeId, "manual")).toBe(true);
+    const routedDuringRecovery = await request();
+    expect(routedDuringRecovery.status).toBe(200);
+    await routedDuringRecovery.text();
+    expect(upstreamCalls).toBe(3);
+
+    completeNativeMainRecovery(recoveryHomeId);
+    recoveryHomeId = null;
+    await server.stop(true);
+    saveConfig({
+      port: 0,
+      openaiProviderTierVersion: 2,
+      defaultProvider: "openai",
+      providers: {
+        openai: {
+          adapter: "openai-responses",
+          baseUrl: "https://chatgpt.com/backend-api/codex",
+          authMode: "forward",
+          codexAccountMode: "pool",
+        },
+      },
+      codexAccounts: [],
+      activeCodexAccountId: "__main__",
+      autoSwitchThreshold: 0,
+    } as OcxConfig);
+    server = startServer(0);
+    await waitForNativeMainStartupGate();
+    recoveryHomeId = nativeMainStartupGateSnapshot().homeId ?? "chat-main-recovery-home";
+    expect(blockNativeMainRecovery(recoveryHomeId, "manual")).toBe(true);
+    const mainBlocked = await fetch(new URL("/v1/chat/completions", server.url), {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({
+        model: "openai/gpt-test",
+        stream: false,
+        messages: [{ role: "user", content: "main blocked" }],
+      }),
+    });
+    expect(mainBlocked.status).toBe(503);
+    expect(upstreamCalls).toBe(3);
   } finally {
+    if (recoveryHomeId) completeNativeMainRecovery(recoveryHomeId);
     drain?.release();
     finishUpstream?.();
     await server.stop(true);
@@ -1535,7 +1593,7 @@ test("/v1/chat/completions status:failed replay normalizes translation_buffer_li
     const json = await response.json() as { error?: { code?: string; type?: string } };
     expect(json.error).toMatchObject({ code: "translation_buffer_limit", type: "upstream_error" });
   } finally {
-    server.stop(true);
+    await server.stop(true);
     upstream.stop(true);
     globalThis.fetch = originalFetch;
   }
diff --git a/tests/claude-messages-endpoint.test.ts b/tests/claude-messages-endpoint.test.ts
index 0b27fef9b..2695ff162 100644
--- a/tests/claude-messages-endpoint.test.ts
+++ b/tests/claude-messages-endpoint.test.ts
@@ -25,6 +25,12 @@ import {
   getNativeMainProfileRequestCount,
   resetLifecycleDrainStateForTests,
 } from "../src/server/lifecycle";
+import {
+  blockNativeMainRecovery,
+  completeNativeMainRecovery,
+  nativeMainStartupGateSnapshot,
+  waitForNativeMainStartupGate,
+} from "../src/codex/native-profile-startup";
 
 let testDir = "";
 let previousHome: string | undefined;
@@ -613,7 +619,7 @@ test("native openai-responses route carries prompt_cache_key + synthesized sessi
   }
 });
 
-test("Claude main-token replay owns native main through the stream and rejects post-fence work", async () => {
+test("Claude replay owns optional main enrichment while routed work survives drain and recovery", async () => {
   resetLifecycleDrainStateForTests();
   writeFileSync(join(isolatedCodexHome!.path, "auth.json"), JSON.stringify({
     tokens: { access_token: "claude-main-access", account_id: "claude-main-account" },
@@ -627,6 +633,11 @@ test("Claude main-token replay owns native main through the stream and rejects p
     port: 0,
     fetch() {
       upstreamCalls += 1;
+      if (upstreamCalls > 1) {
+        return new Response('data: {"choices":[{"index":0,"delta":{},"finish_reason":"stop"}]}\n\ndata: [DONE]\n\n', {
+          headers: { "content-type": "text/event-stream" },
+        });
+      }
       return new Response(new ReadableStream<Uint8Array>({
         start(controller) {
           controller.enqueue(encoder.encode('data: {"choices":[{"index":0,"delta":{"content":"held"}}]}\n\n'));
@@ -641,8 +652,10 @@ test("Claude main-token replay owns native main through the stream and rejects p
     },
   });
   saveConfig(mockConfig(`${upstream.url.toString().replace(/\/$/, "")}/v1`));
-  const server = startServer(0);
+  let server = startServer(0);
+  await waitForNativeMainStartupGate();
   let drain: ReturnType<typeof acquireNativeMainProfileDrain> = null;
+  let recoveryHomeId: string | null = null;
   try {
     await waitForNativeMainStartupGate();
     const pending = postMessages(server.url.toString(), {
@@ -657,20 +670,66 @@ test("Claude main-token replay owns native main through the stream and rejects p
     expect(getNativeMainProfileRequestCount()).toBe(1);
     drain = acquireNativeMainProfileDrain("claude-overlap");
     expect(drain).not.toBeNull();
-    const blocked = await postMessages(server.url.toString(), {
+    const routedDuringDrain = await postMessages(server.url.toString(), {
       model: "mock/test-model",
       max_tokens: 64,
       stream: true,
-      messages: [{ role: "user", content: "blocked" }],
+      messages: [{ role: "user", content: "routed during drain" }],
     });
-    expect(blocked.status).toBe(503);
-    expect(blocked.headers.get("Retry-After")).toBe("1");
-    expect(upstreamCalls).toBe(1);
+    expect(routedDuringDrain.status).toBe(200);
+    await routedDuringDrain.text();
+    expect(upstreamCalls).toBe(2);
 
     finishUpstream?.();
     await response.text();
     expect(getNativeMainProfileRequestCount()).toBe(0);
+    drain?.release();
+    drain = null;
+
+    recoveryHomeId = nativeMainStartupGateSnapshot().homeId ?? "claude-recovery-home";
+    expect(blockNativeMainRecovery(recoveryHomeId, "manual")).toBe(true);
+    const routedDuringRecovery = await postMessages(server.url.toString(), {
+      model: "mock/test-model",
+      max_tokens: 64,
+      stream: false,
+      messages: [{ role: "user", content: "routed during recovery" }],
+    });
+    expect(routedDuringRecovery.status).toBe(200);
+    expect(upstreamCalls).toBe(3);
+
+    completeNativeMainRecovery(recoveryHomeId);
+    recoveryHomeId = null;
+    await server.stop(true);
+    saveConfig({
+      port: 0,
+      openaiProviderTierVersion: 2,
+      defaultProvider: "openai",
+      providers: {
+        openai: {
+          adapter: "openai-responses",
+          baseUrl: "https://chatgpt.com/backend-api/codex",
+          authMode: "forward",
+          codexAccountMode: "pool",
+        },
+      },
+      codexAccounts: [],
+      activeCodexAccountId: "__main__",
+      autoSwitchThreshold: 0,
+    } as OcxConfig);
+    server = startServer(0);
+    await waitForNativeMainStartupGate();
+    recoveryHomeId = nativeMainStartupGateSnapshot().homeId ?? "claude-main-recovery-home";
+    expect(blockNativeMainRecovery(recoveryHomeId, "manual")).toBe(true);
+    const mainBlocked = await postMessages(server.url.toString(), {
+      model: "openai/gpt-test",
+      max_tokens: 64,
+      stream: false,
+      messages: [{ role: "user", content: "main blocked" }],
+    });
+    expect(mainBlocked.status).toBe(503);
+    expect(upstreamCalls).toBe(3);
   } finally {
+    if (recoveryHomeId) completeNativeMainRecovery(recoveryHomeId);
     drain?.release();
     finishUpstream?.();
     await server.stop(true);
@@ -762,6 +821,7 @@ test("routed Claude requests give OpenAI sidecars main auth without leaking it t
     tokens: { access_token: mainAccessToken, account_id: mainAccountId },
   }));
   const server = startServer(0);
+  await waitForNativeMainStartupGate();
   const requestBody = {
     model: "routed/text-model",
     max_tokens: 128,
diff --git a/tests/codex-auth-api.test.ts b/tests/codex-auth-api.test.ts
index b6605eccd..ad98cce5a 100644
--- a/tests/codex-auth-api.test.ts
+++ b/tests/codex-auth-api.test.ts
@@ -39,6 +39,8 @@ import {
 } from "../src/codex/websocket-registry";
 import type { OcxConfig } from "../src/types";
 import type { WsData } from "../src/server/ws-bridge";
+import { handleNativeProfileAPI } from "../src/codex/native-profile-api";
+import type { NativeProfileManager } from "../src/codex/native-profile-manager";
 import { MAIN_CODEX_ACCOUNT_ID, setMainAccountPlan } from "../src/codex/main-account";
 import {
   deleteCodexAccount,
@@ -258,6 +260,258 @@ afterEach(() => {
 });
 
 describe("codex-auth API", () => {
+  test("account polling owns native main through publication so switch and rollback wait", async () => {
+    writeFileSync(join(TEST_CODEX_HOME, "auth.json"), JSON.stringify({
+      tokens: { access_token: "main-poll-owned", account_id: "acct-main-poll-owned" },
+    }));
+
+    for (const scenario of [
+      { path: "/api/native-main-profiles/switch", body: { target: "target", confirmedStopped: true }, method: "switch" as const },
+      { path: "/api/native-main-profiles/recover", body: { rollback: true, confirmedStopped: true }, method: "recover" as const },
+    ]) {
+      clearMainAccountInfoCache();
+      clearAccountQuota();
+      setMainAccountPlan(null);
+      let releaseUsage!: () => void;
+      const usageGate = new Promise<void>(resolve => { releaseUsage = resolve; });
+      let markUsageStarted!: () => void;
+      const usageStarted = new Promise<void>(resolve => { markUsageStarted = resolve; });
+      globalThis.fetch = (async (input: RequestInfo | URL, init?: RequestInit) => {
+        if (String(input) === "https://chatgpt.com/backend-api/wham/usage") {
+          markUsageStarted();
+          await usageGate;
+          return Response.json({
+            email: "owned@example.test",
+            plan_type: "plus",
+            rate_limit: { primary_window: { used_percent: 37 } },
+          });
+        }
+        return previousFetch(input, init);
+      }) as typeof fetch;
+
+      const pollRequest = new Request("http://localhost/api/codex-auth/accounts?refresh=1");
+      const polling = handleCodexAuthAPI(pollRequest, new URL(pollRequest.url), makeConfig());
+      await usageStarted;
+      expect(getNativeMainProfileRequestCount()).toBe(1);
+
+      let operations = 0;
+      const manager = {
+        context: undefined,
+        switch: async () => { operations += 1; return { switched: true }; },
+        recover: async () => { operations += 1; return { recovered: true }; },
+      } as unknown as NativeProfileManager;
+      const profileRequest = () => new Request(`http://localhost${scenario.path}`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify(scenario.body),
+      });
+      const blockedRequest = profileRequest();
+      const blocked = await handleNativeProfileAPI(
+        blockedRequest,
+        new URL(blockedRequest.url),
+        makeConfig(),
+        { manager, drainTimeoutMs: 0 },
+      );
+      expect(blocked?.status).toBe(409);
+      expect(operations).toBe(0);
+
+      releaseUsage();
+      const pollResponse = await polling;
+      expect(pollResponse?.status).toBe(200);
+      const body = await pollResponse?.json() as { accounts: CodexAuthAccountDto[] };
+      expect(body.accounts.find(account => account.id === MAIN_CODEX_ACCOUNT_ID)).toMatchObject({
+        plan: "plus",
+        hasCredential: true,
+        quota: { weeklyPercent: 37 },
+      });
+      expect(getAccountQuota(MAIN_CODEX_ACCOUNT_ID)).toMatchObject({ weeklyPercent: 37 });
+      expect(getNativeMainProfileRequestCount()).toBe(0);
+
+      const allowedRequest = profileRequest();
+      const allowed = await handleNativeProfileAPI(
+        allowedRequest,
+        new URL(allowedRequest.url),
+        makeConfig(),
+        { manager, drainTimeoutMs: 0 },
+      );
+      expect(allowed?.status).toBe(200);
+      expect(operations).toBe(1);
+    }
+  });
+
+  test("account list discards a main snapshot invalidated while pool publication is pending", async () => {
+    writeFileSync(join(TEST_CODEX_HOME, "auth.json"), JSON.stringify({
+      tokens: { access_token: "main-generation", account_id: "acct-main-generation" },
+    }));
+    const config = makeConfig();
+    seedPoolAccount(config, {
+      id: "publication-pool",
+      email: "publication-pool@example.test",
+      plan: "plus",
+      chatgptAccountId: "acct-publication-pool",
+    });
+    let releasePool!: () => void;
+    const poolGate = new Promise<void>(resolve => { releasePool = resolve; });
+    let markPoolStarted!: () => void;
+    const poolStarted = new Promise<void>(resolve => { markPoolStarted = resolve; });
+    globalThis.fetch = (async (input: RequestInfo | URL, init?: RequestInit) => {
+      if (String(input) !== "https://chatgpt.com/backend-api/wham/usage") {
+        return previousFetch(input, init);
+      }
+      const accountId = new Headers(init?.headers).get("ChatGPT-Account-Id");
+      if (accountId === "acct-main-generation") {
+        return Response.json({
+          email: "stale-main@example.test",
+          plan_type: "plus",
+          rate_limit: { primary_window: { used_percent: 44 } },
+        });
+      }
+      markPoolStarted();
+      await poolGate;
+      return Response.json({
+        plan_type: "plus",
+        rate_limit: { primary_window: { used_percent: 12 } },
+      });
+    }) as typeof fetch;
+
+    try {
+      const request = new Request("http://localhost/api/codex-auth/accounts?refresh=1");
+      const pending = handleCodexAuthAPI(request, new URL(request.url), config);
+      await poolStarted;
+      clearMainAccountInfoCache();
+      releasePool();
+      const response = await pending;
+      const body = await response?.json() as { accounts: CodexAuthAccountDto[] };
+      expect(body.accounts.find(account => account.id === MAIN_CODEX_ACCOUNT_ID)).toMatchObject({
+        email: "Codex App login",
+        plan: null,
+        quota: null,
+      });
+    } finally {
+      releasePool();
+    }
+  });
+
+  test("account list preserves only the last claim-owned credential snapshot while main is fenced", async () => {
+    writeFileSync(join(TEST_CODEX_HOME, "auth.json"), JSON.stringify({
+      tokens: { access_token: "main-snapshot", account_id: "acct-main-snapshot" },
+    }));
+    globalThis.fetch = (async () => Response.json({
+      email: "snapshot@example.test",
+      plan_type: "plus",
+      rate_limit: { primary_window: { used_percent: 12 } },
+    })) as typeof fetch;
+    const listMain = async () => {
+      const req = new Request("http://localhost/api/codex-auth/accounts?refresh=1");
+      const response = await handleCodexAuthAPI(req, new URL(req.url), makeConfig());
+      const body = await response?.json() as { accounts: CodexAuthAccountDto[] };
+      return body.accounts.find(account => account.id === MAIN_CODEX_ACCOUNT_ID)!;
+    };
+
+    expect((await listMain()).hasCredential).toBe(true);
+    clearMainAccountInfoCache();
+    let drain = acquireNativeMainProfileDrain("credential-snapshot-cold-cache");
+    try {
+      expect((await listMain()).hasCredential).toBe(true);
+    } finally {
+      drain?.release();
+    }
+
+    await listMain();
+    rmSync(join(TEST_CODEX_HOME, "auth.json"));
+    expect((await listMain()).hasCredential).toBe(false);
+    drain = acquireNativeMainProfileDrain("credential-snapshot-warm-cache");
+    try {
+      expect((await listMain()).hasCredential).toBe(false);
+    } finally {
+      drain?.release();
+    }
+  });
+
+  test("bulk pause retains native-main ownership through pool settlement and persisted publication", async () => {
+    writeFileSync(join(TEST_CODEX_HOME, "auth.json"), JSON.stringify({
+      tokens: { access_token: "main-pause-owned", account_id: "acct-main-pause-owned" },
+    }));
+    const config = makeConfig();
+    seedPoolAccount(config, { id: "pause-pool", email: "pool@example.test", plan: "plus" });
+    let releasePool!: () => void;
+    const poolGate = new Promise<void>(resolve => { releasePool = resolve; });
+    let markMainDone!: () => void;
+    const mainDone = new Promise<void>(resolve => { markMainDone = resolve; });
+    let markPoolStarted!: () => void;
+    const poolStarted = new Promise<void>(resolve => { markPoolStarted = resolve; });
+    globalThis.fetch = (async (_input: RequestInfo | URL, init?: RequestInit) => {
+      const accountId = new Headers(init?.headers).get("ChatGPT-Account-Id");
+      if (accountId === "acct-main-pause-owned") {
+        markMainDone();
+        return Response.json({
+          plan_type: "plus",
+          rate_limit: { primary_window: { used_percent: 100 } },
+        });
+      }
+      markPoolStarted();
+      await poolGate;
+      return Response.json({
+        plan_type: "plus",
+        rate_limit: { primary_window: { used_percent: 10 } },
+      });
+    }) as typeof fetch;
+
+    const pauseReq = new Request("http://localhost/api/codex-auth/accounts/pause-exhausted", { method: "PUT" });
+    const pending = handleCodexAuthAPI(pauseReq, new URL(pauseReq.url), config);
+    await Promise.all([mainDone, poolStarted]);
+    expect(getNativeMainProfileRequestCount()).toBe(1);
+    const manager = {
+      context: undefined,
+      switch: async () => ({ switched: true }),
+    } as unknown as NativeProfileManager;
+    const switchReq = new Request("http://localhost/api/native-main-profiles/switch", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ target: "target", confirmedStopped: true }),
+    });
+    const blocked = await handleNativeProfileAPI(switchReq, new URL(switchReq.url), makeConfig(), {
+      manager,
+      drainTimeoutMs: 0,
+    });
+    expect(blocked?.status).toBe(409);
+
+    releasePool();
+    const response = await pending;
+    expect(response?.status).toBe(200);
+    expect((await response?.json() as { pausedAccountIds: string[] }).pausedAccountIds).toContain(MAIN_CODEX_ACCOUNT_ID);
+    expect(loadConfig().pausedCodexAccountIds).toContain(MAIN_CODEX_ACCOUNT_ID);
+    expect(getNativeMainProfileRequestCount()).toBe(0);
+  });
+
+  test("bulk pause settles a rejected pool probe before atomically publishing main pause", async () => {
+    writeFileSync(join(TEST_CODEX_HOME, "auth.json"), JSON.stringify({
+      tokens: { access_token: "main-pause-settled", account_id: "acct-main-pause-settled" },
+    }));
+    const config = makeConfig();
+    seedPoolAccount(config, { id: "busy-pool", email: "busy@example.test", plan: "plus" });
+    const clearAdmission = seedCodexAuthAdmissionForTests({ quotaFlights: 16 });
+    globalThis.fetch = (async () => Response.json({
+      plan_type: "plus",
+      rate_limit: { primary_window: { used_percent: 100 } },
+    })) as typeof fetch;
+    try {
+      const request = new Request("http://localhost/api/codex-auth/accounts/pause-exhausted", { method: "PUT" });
+      const response = await handleCodexAuthAPI(request, new URL(request.url), config);
+      expect(response?.status).toBe(200);
+      expect(await response?.json()).toMatchObject({
+        pausedAccountIds: [MAIN_CODEX_ACCOUNT_ID],
+        checkedAccountCount: 1,
+        failedAccountCount: 1,
+        complete: false,
+      });
+      expect(loadConfig().pausedCodexAccountIds).toContain(MAIN_CODEX_ACCOUNT_ID);
+      expect(getNativeMainProfileRequestCount()).toBe(0);
+    } finally {
+      clearAdmission();
+    }
+  });
+
   test("main reset-credit consume owns native main through destructive upstream work and rejects post-fence work", async () => {
     writeFileSync(join(TEST_CODEX_HOME, "auth.json"), JSON.stringify({
       tokens: { access_token: "main-reset-owned", account_id: "acct-main-reset-owned" },
diff --git a/tests/codex-auth-context.test.ts b/tests/codex-auth-context.test.ts
index 30c5bc41a..1951530de 100644
--- a/tests/codex-auth-context.test.ts
+++ b/tests/codex-auth-context.test.ts
@@ -140,7 +140,9 @@ function guardianConfig(): OcxConfig {
 async function waitFor(predicate: () => boolean): Promise<void> {
   for (let attempt = 0; attempt < 1_000; attempt += 1) {
     if (predicate()) return;
-    await Promise.resolve();
+    // SQLite-backed native-main claims may need an actual event-loop turn;
+    // a microtask-only spin can starve the operation this helper is observing.
+    await Bun.sleep(1);
   }
   throw new Error("condition did not become true");
 }
@@ -273,6 +275,14 @@ describe("Codex auth context", () => {
         })).rejects.toBeInstanceOf(CodexPoolAuthenticationError);
         expect(cfg.activeCodexAccountId).toBe("pool-a");
       }
+      cfg.pausedCodexAccountIds = ["pool-a"];
+      cfg.activeCodexAccountId = "pool-a";
+      await expect(resolveCodexAuthContext(new Headers(), cfg, "pool", readOptions))
+        .rejects.toBeInstanceOf(CodexMainProfileDrainingError);
+      await expect(resolveCodexAuthContext(new Headers(), cfg, "pool", {
+        ...readOptions,
+        excludeAccountId: "pool-a",
+      })).rejects.toBeInstanceOf(CodexPoolAuthenticationError);
       expect(nativeReads).toBe(0);
       expect(primes).toBe(0);
     } finally {
diff --git a/tests/doctor.test.ts b/tests/doctor.test.ts
index ff781972e..e8af480df 100644
--- a/tests/doctor.test.ts
+++ b/tests/doctor.test.ts
@@ -18,6 +18,7 @@ import {
   type ServiceMemoryData,
 } from "../src/cli/doctor";
 import { collectOrcaCodexHomeDiagnostic } from "../src/codex/home";
+import { NativeProfileError } from "../src/codex/native-profile-types";
 
 const TEST_DIR = join(import.meta.dir, ".tmp-doctor-test");
 const TEST_CODEX_HOME = join(TEST_DIR, "codex");
@@ -320,6 +321,50 @@ describe("doctor", () => {
     }) as typeof fetch);
     expect(connect.classification).toBe("connect_error");
   });
+
+  test("probeWham suppresses credential and network reads when the cross-process claim is unavailable", async () => {
+    let fetchCalls = 0;
+    const result = await probeWham((async () => {
+      fetchCalls += 1;
+      return new Response("{}", { status: 200 });
+    }) as typeof fetch, {
+      withNativeMainClaim: async () => {
+        throw new NativeProfileError(
+          "NATIVE_MAIN_CLAIM_BUSY",
+          "Native-main credentials are in use.",
+          503,
+          true,
+        );
+      },
+    });
+
+    expect(fetchCalls).toBe(0);
+    expect(result).toMatchObject({
+      ok: false,
+      status: null,
+      classification: "native_main_claim_busy",
+      authenticated: false,
+    });
+  });
+
+  test("probeWham suppresses credential and network reads during retained recovery", async () => {
+    let fetchCalls = 0;
+    const result = await probeWham((async () => {
+      fetchCalls += 1;
+      return new Response("{}", { status: 200 });
+    }) as typeof fetch, {
+      withNativeMainClaim: operation => operation(),
+      probeNativeMainRecoveryState: () => "manual",
+    });
+
+    expect(fetchCalls).toBe(0);
+    expect(result).toMatchObject({
+      ok: false,
+      status: null,
+      classification: "native_main_recovery_manual",
+      authenticated: false,
+    });
+  });
 });
 
 describe("service memory section (#314 WP4)", () => {
diff --git a/tests/native-profile-startup.test.ts b/tests/native-profile-startup.test.ts
index 1b1f21882..b7a25f13a 100644
--- a/tests/native-profile-startup.test.ts
+++ b/tests/native-profile-startup.test.ts
@@ -34,6 +34,15 @@ import {
   isNativeMainTrafficBlocked,
   nativeMainStartupGateSnapshot,
 } from "../src/codex/native-profile-startup";
+import {
+  tryAcquireNativeMainProfileClaim,
+  tryClaimNativeMainProfileForTurn,
+} from "../src/codex/native-main-admission";
+import {
+  getNativeMainProfileRequestCount,
+  resetLifecycleDrainStateForTests,
+  tryAdmitTurn,
+} from "../src/server/lifecycle";
 
 const roots: string[] = [];
 const previousOpencodexHome = process.env.OPENCODEX_HOME;
@@ -259,6 +268,47 @@ const recoverable: Array<{ phase: Phase; observation: Observation; active: "sour
 ];
 
 describe("native-main startup journal gate", () => {
+  test("combined turn and standalone claims reject retained recovery before native-main reads", async () => {
+    const homeId = "home-combined-admission";
+    resetLifecycleDrainStateForTests();
+    await initializeNativeMainStartupGate({
+      manager: { context: { homeId }, recover: async () => ({}) } as unknown as NativeProfileManager,
+      probeRecoveryState: () => "manual",
+    });
+    const turn = tryAdmitTurn();
+    expect(turn).not.toBeNull();
+    try {
+      expect(tryClaimNativeMainProfileForTurn(turn ?? undefined)).toBe(false);
+      expect(tryAcquireNativeMainProfileClaim()).toBeNull();
+      expect(getNativeMainProfileRequestCount()).toBe(0);
+    } finally {
+      turn?.release();
+      await initializeNativeMainStartupGate({
+        manager: { context: { homeId }, recover: async () => ({}) } as unknown as NativeProfileManager,
+        probeRecoveryState: () => "none",
+      });
+      resetLifecycleDrainStateForTests();
+    }
+
+    const allowed = tryAcquireNativeMainProfileClaim();
+    expect(allowed).not.toBeNull();
+    allowed?.release();
+  });
+
+  test("post-claim recovery race keeps the caller-owned turn alive while skipping native reads", () => {
+    let checks = 0;
+    let releases = 0;
+    const lease = { release: () => { releases += 1; } };
+    const claimed = tryClaimNativeMainProfileForTurn(lease, {
+      isTrafficBlocked: () => checks++ > 0,
+      claimTurn: () => true,
+    });
+
+    expect(claimed).toBe(false);
+    expect(checks).toBe(2);
+    expect(releases).toBe(0);
+  });
+
   test("manual and unreadable recovery states close the main gate without automatic recovery", async () => {
     let recoverCalls = 0;
     for (const state of ["manual", "unreadable"] as const) {
diff --git a/tests/provider-quota.test.ts b/tests/provider-quota.test.ts
index 11e22aaa4..af9fa9b42 100644
--- a/tests/provider-quota.test.ts
+++ b/tests/provider-quota.test.ts
@@ -3,9 +3,14 @@ import { existsSync, mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { clearAccountQuota } from "../src/codex/quota";
+import { clearMainAccountInfoCache } from "../src/codex/main-account-cache";
 import { saveCodexAccountCredential } from "../src/codex/account-store";
 import { saveCredential } from "../src/oauth/store";
-import { clearProviderQuotaCache, fetchProviderQuotaReports } from "../src/providers/quota";
+import {
+  clearProviderQuotaCache,
+  fetchProviderQuotaReports,
+  setProviderQuotaBeforePublishForTests,
+} from "../src/providers/quota";
 import type { OcxConfig } from "../src/types";
 
 const originalFetch = globalThis.fetch;
@@ -71,12 +76,14 @@ beforeEach(() => {
   }));
   clearAccountQuota();
   clearProviderQuotaCache();
+  setProviderQuotaBeforePublishForTests(null);
 });
 
 afterEach(() => {
   globalThis.fetch = originalFetch;
   clearAccountQuota();
   clearProviderQuotaCache();
+  setProviderQuotaBeforePublishForTests(null);
   if (previousOpencodexHome === undefined) delete process.env.OPENCODEX_HOME;
   else process.env.OPENCODEX_HOME = previousOpencodexHome;
   if (previousCodexHome === undefined) delete process.env.CODEX_HOME;
@@ -633,6 +640,30 @@ describe("fetchProviderQuotaReports", () => {
     expect(result.reports[0]?.quota.monthlyResetAt).toBe(Date.UTC(2027, 0, 31));
   });
 
+  test("main identity invalidation drops the stale report without negative-caching the new identity", async () => {
+    const full = testConfig();
+    const config = {
+      ...full,
+      providers: {
+        openai: full.providers.openai!,
+      },
+    } as OcxConfig;
+    globalThis.fetch = (async () => Response.json({
+      plan_type: "plus",
+      rate_limit: { secondary_window: { used_percent: 61 } },
+    })) as typeof fetch;
+    setProviderQuotaBeforePublishForTests(() => {
+      clearMainAccountInfoCache();
+      setProviderQuotaBeforePublishForTests(null);
+    });
+
+    const response = await fetchProviderQuotaReports(config, true);
+    expect(response.reports.some(item => item.provider === "openai")).toBe(false);
+
+    const retried = await fetchProviderQuotaReports(config, false);
+    expect(retried.reports.some(item => item.provider === "openai")).toBe(true);
+  });
+
   test("clearing the cache mid-flight revokes commit authority", async () => {
     await saveCredential("cursor", { access: "cursor-access-secret", refresh: "cursor-refresh-secret", expires: Date.now() + 3600_000 });
     let release: (() => void) | undefined;

From 927333765cf4bfa43b8b8fff9559a04975099b29 Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Mon, 3 Aug 2026 14:59:01 +0900
Subject: [PATCH 59/63] fix(codex): close final integration gate gaps

---
 .github/workflows/ci.yml                  |  2 +
 tests/claude-messages-endpoint.test.ts    | 45 ++++++++++++++++-------
 tests/native-profile-drain-server.test.ts |  1 +
 3 files changed, 35 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a1b0956e3..d906bc01e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -452,6 +452,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
diff --git a/tests/claude-messages-endpoint.test.ts b/tests/claude-messages-endpoint.test.ts
index 2695ff162..01a74e455 100644
--- a/tests/claude-messages-endpoint.test.ts
+++ b/tests/claude-messages-endpoint.test.ts
@@ -1,4 +1,3 @@
-import { waitForNativeMainStartupGate } from "../src/codex/native-profile-startup";
 import { afterEach, beforeEach, expect, test } from "bun:test";
 import { managementFetch as fetch } from "./helpers/management-auth";
 import { logsFromApiBody } from "./helpers/logs-api";
@@ -12,6 +11,7 @@ import type { RequestLogContext } from "../src/server/request-log";
 import { startServer } from "../src/server";
 import {
   fetchWithHeaderDeadline,
+  handleClaudeMessages,
   readBoundedPassthroughBody,
   resolvePassthroughBodyGuard,
   tapAnthropicSseForLog,
@@ -24,6 +24,7 @@ import {
   acquireNativeMainProfileDrain,
   getNativeMainProfileRequestCount,
   resetLifecycleDrainStateForTests,
+  tryAdmitTurn,
 } from "../src/server/lifecycle";
 import {
   blockNativeMainRecovery,
@@ -820,8 +821,7 @@ test("routed Claude requests give OpenAI sidecars main auth without leaking it t
   writeFileSync(join(isolatedCodexHome!.path, "auth.json"), JSON.stringify({
     tokens: { access_token: mainAccessToken, account_id: mainAccountId },
   }));
-  const server = startServer(0);
-  await waitForNativeMainStartupGate();
+  let requestSequence = 0;
   const requestBody = {
     model: "routed/text-model",
     max_tokens: 128,
@@ -835,11 +835,33 @@ test("routed Claude requests give OpenAI sidecars main auth without leaking it t
       ],
     }],
   };
+  const invokeMessages = async (): Promise<number> => {
+    const turnAdmissionLease = tryAdmitTurn();
+    if (!turnAdmissionLease) throw new Error("test turn admission unavailable");
+    const start = Date.now();
+    try {
+      const response = await handleClaudeMessages(
+        new Request("http://localhost/v1/messages", {
+          method: "POST",
+          headers: {
+            "content-type": "application/json",
+            "x-api-key": "placeholder",
+            "anthropic-version": "2023-06-01",
+          },
+          body: JSON.stringify(requestBody),
+        }),
+        config,
+        { model: "unknown", provider: "unknown", inboundProtocol: "messages" } as RequestLogContext,
+        { requestId: `claude-sidecar-test-${++requestSequence}`, start, turnAdmissionLease },
+      );
+      await response.text();
+      return response.status;
+    } finally {
+      turnAdmissionLease.release();
+    }
+  };
   try {
-    await waitForNativeMainStartupGate();
-    const authenticated = await postMessages(server.url.toString(), requestBody);
-    expect(authenticated.status).toBe(200);
-    await authenticated.text();
+    expect(await invokeMessages()).toBe(200);
 
     expect(sidecarCalls.map(call => call.kind).sort()).toEqual(["vision", "web-search"]);
     for (const call of sidecarCalls) {
@@ -857,9 +879,7 @@ test("routed Claude requests give OpenAI sidecars main auth without leaking it t
 
     rmSync(join(isolatedCodexHome!.path, "auth.json"));
     const sidecarCountBeforeNoLogin = sidecarCalls.length;
-    const noLogin = await postMessages(server.url.toString(), requestBody);
-    expect(noLogin.status).toBe(200);
-    await noLogin.text();
+    expect(await invokeMessages()).toBe(200);
 
     expect(sidecarCalls.length).toBe(sidecarCountBeforeNoLogin);
     expect(routedCalls.at(-1)?.authorization).toBe("Bearer routed-provider-key");
@@ -867,9 +887,8 @@ test("routed Claude requests give OpenAI sidecars main auth without leaking it t
     expect(noLoginBody).toContain("[image omitted: this model is text-only and the vision sidecar is unavailable (no ChatGPT login)]");
     expect(noLoginBody).not.toContain(imageBytes);
   } finally {
-    await server.stop(true);
-    forward.stop(true);
-    routed.stop(true);
+    await forward.stop(true);
+    await routed.stop(true);
   }
 });
 
diff --git a/tests/native-profile-drain-server.test.ts b/tests/native-profile-drain-server.test.ts
index 57f905636..a59256c17 100644
--- a/tests/native-profile-drain-server.test.ts
+++ b/tests/native-profile-drain-server.test.ts
@@ -400,6 +400,7 @@ describe("native main profile scoped server admission", () => {
         return upstream as unknown as WebSocket;
       },
     });
+    await waitForNativeMainStartupGate();
     const url = new URL("/v1/live/uncooperative", server.url);
     url.protocol = "ws:";
     const client = new WebSocket(url);

From 0f24f313845981e487e5052d53630edc1ee49e1f Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Tue, 4 Aug 2026 00:26:53 +0900
Subject: [PATCH 60/63] fix(native-main): address review follow-ups

---
 .github/workflows/ci.yml                   |   8 +-
 .github/workflows/release.yml              |   8 +-
 src/cli/account-main.ts                    |   1 -
 src/codex/native-main-lock-file.ts         |  31 ++-
 src/codex/native-profile-manager.ts        | 122 ++++++---
 src/codex/native-profile-processes.ts      |  19 +-
 src/server/lifecycle.ts                    |  50 +++-
 src/server/management/system-restart.ts    | 227 +++++++++++++---
 src/server/responses/compact.ts            |  13 +-
 tests/api-storage.test.ts                  |  53 +++-
 tests/ci-workflows.test.ts                 |  51 ++++
 tests/codex-main-rotation.test.ts          |  20 +-
 tests/helpers/native-profile-lock-child.ts |  55 ++--
 tests/native-profile-manager.test.ts       | 142 ++++++++++
 tests/native-profile-processes.test.ts     |  37 ++-
 tests/responses-compaction-routing.test.ts |  53 +++-
 tests/shutdown-drain.test.ts               |  89 +++++-
 tests/system-restart.test.ts               | 300 +++++++++++++++++++--
 18 files changed, 1148 insertions(+), 131 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d906bc01e..542ae19a8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -484,11 +484,15 @@ jobs:
 
           keyring_home="$(mktemp -d)"
           runtime_dir="$(mktemp -d)"
-          cleanup() { rm -rf "$keyring_home" "$runtime_dir"; }
+          cleanup() { rm -rf -- "$keyring_home" "$runtime_dir"; }
           trap cleanup EXIT
           chmod 700 "$keyring_home" "$runtime_dir"
           HOME="$keyring_home" XDG_RUNTIME_DIR="$runtime_dir" dbus-run-session -- bash -euo pipefail -c '
-            eval "$(gnome-keyring-daemon --start --components=secrets)"
+            # Create and unlock the isolated login keyring without putting its
+            # ephemeral password in argv, the environment, or the job log.
+            od -An -N32 -tx1 /dev/urandom |
+              tr -d "[:space:]" |
+              gnome-keyring-daemon --unlock --components=secrets >/dev/null
             bun run scripts/keyring-smoke.ts
           '
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 1588c6216..b49dd93b6 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -111,11 +111,15 @@ jobs:
           set -euo pipefail
           keyring_home="$(mktemp -d)"
           runtime_dir="$(mktemp -d)"
-          cleanup() { rm -rf "$keyring_home" "$runtime_dir"; }
+          cleanup() { rm -rf -- "$keyring_home" "$runtime_dir"; }
           trap cleanup EXIT
           chmod 700 "$keyring_home" "$runtime_dir"
           HOME="$keyring_home" XDG_RUNTIME_DIR="$runtime_dir" dbus-run-session -- bash -euo pipefail -c '
-            eval "$(gnome-keyring-daemon --start --components=secrets)"
+            # Create and unlock the isolated login keyring without putting its
+            # ephemeral password in argv, the environment, or the job log.
+            od -An -N32 -tx1 /dev/urandom |
+              tr -d "[:space:]" |
+              gnome-keyring-daemon --unlock --components=secrets >/dev/null
             bun run scripts/keyring-smoke.ts
           '
 
diff --git a/src/cli/account-main.ts b/src/cli/account-main.ts
index 5d1e813b2..0b29d7b5f 100644
--- a/src/cli/account-main.ts
+++ b/src/cli/account-main.ts
@@ -93,7 +93,6 @@ function abortableDelay(ms: number, signal: AbortSignal): Promise<void> {
   if (signal.aborted) return Promise.resolve();
   return new Promise(resolve => {
     const timer = setTimeout(done, ms);
-    timer.unref?.();
     signal.addEventListener("abort", done, { once: true });
     function done(): void {
       clearTimeout(timer);
diff --git a/src/codex/native-main-lock-file.ts b/src/codex/native-main-lock-file.ts
index 381589ee0..92021562b 100644
--- a/src/codex/native-main-lock-file.ts
+++ b/src/codex/native-main-lock-file.ts
@@ -18,6 +18,13 @@ export interface StableLockFile {
   close(): void;
 }
 
+export class StableLockPathUnsafeError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = "StableLockPathUnsafeError";
+  }
+}
+
 interface StableLockEntry {
   readonly fd: number;
   readonly dev: number;
@@ -49,7 +56,15 @@ function reference(path: string, entry: StableLockEntry): StableLockFile {
 }
 
 function assertRegular(stats: Stats, path: string): void {
-  if (!stats.isFile() || stats.isSymbolicLink()) throw new Error(`unsafe SQLite lock path: ${path}`);
+  if (!stats.isFile() || stats.isSymbolicLink()) {
+    throw new StableLockPathUnsafeError(`unsafe SQLite lock path: ${path}`);
+  }
+}
+
+function errorCode(error: unknown): string | undefined {
+  return error && typeof error === "object" && "code" in error
+    ? String((error as { code?: unknown }).code)
+    : undefined;
 }
 
 function matches(handle: StableLockFile, stats: Stats): boolean {
@@ -94,9 +109,19 @@ export function openStableLockFile(path: string, platform: NodeJS.Platform = pro
 }
 
 export function assertStableLockFile(path: string, handle: StableLockFile): void {
-  const pathStats = lstatSync(path);
+  let pathStats: Stats;
+  try {
+    pathStats = lstatSync(path);
+  } catch (error) {
+    if (errorCode(error) === "ENOENT") {
+      throw new StableLockPathUnsafeError(`SQLite lock path identity changed: ${path}`);
+    }
+    throw error;
+  }
   assertRegular(pathStats, path);
-  if (!matches(handle, pathStats)) throw new Error(`SQLite lock path identity changed: ${path}`);
+  if (!matches(handle, pathStats)) {
+    throw new StableLockPathUnsafeError(`SQLite lock path identity changed: ${path}`);
+  }
 }
 
 export async function hardenStableLockFile(path: string): Promise<void> {
diff --git a/src/codex/native-profile-manager.ts b/src/codex/native-profile-manager.ts
index 746a293a9..e4dd68db1 100644
--- a/src/codex/native-profile-manager.ts
+++ b/src/codex/native-profile-manager.ts
@@ -7,7 +7,6 @@ import {
   existsSync,
   fstatSync,
   ftruncateSync,
-  linkSync,
   lstatSync,
   mkdirSync,
   openSync,
@@ -24,6 +23,12 @@ import { dirname, join, relative, resolve, sep } from "node:path";
 import { atomicWriteFileAsync } from "../config";
 import { hardenSecretDirAsync, hardenSecretPathAsync } from "../lib/windows-secret-acl";
 import { applyConfirmedMainCodexAccountTransition } from "./account-lifecycle";
+import {
+  assertStableLockFile,
+  openStableLockFile,
+  StableLockPathUnsafeError,
+  type StableLockFile,
+} from "./native-main-lock-file";
 import { decideNativeProfileRecovery } from "./native-profile-recovery";
 import { probeNativeCodexProcesses, type NativeCodexProcessProbe } from "./native-profile-processes";
 import {
@@ -83,6 +88,8 @@ type TransitionApplier = (fromAccountId: string, toAccountId: string) => void;
 type EnvelopeReader = (path: string) => NativeEnvelopeSnapshot;
 type VaultReader = () => NativeMainProfileVaultV1 | null;
 type EnvelopeResultReader = (path: string) => ReturnType<typeof readNativeEnvelopeResult>;
+type StableLockOpener = (path: string) => StableLockFile;
+type StableLockAsserter = (path: string, file: StableLockFile) => void;
 export type NativeProfileSwitchBoundary =
   | "journal-prepared"
   | "auth-replaced"
@@ -111,6 +118,9 @@ export interface NativeProfileManagerOptions {
   readEnvelope?: EnvelopeReader;
   readVault?: VaultReader;
   readEnvelopeResult?: EnvelopeResultReader;
+  /** Test-only stable-path seams; production uses the native stable-lock helpers directly. */
+  stableLockOpen?: StableLockOpener;
+  stableLockAssert?: StableLockAsserter;
 }
 
 export interface NativeProfileListResult {
@@ -199,9 +209,11 @@ export class NativeProfileManager {
   private readonly readEnvelope: EnvelopeReader;
   private readonly readVault: VaultReader;
   private readonly readEnvelopeResult: EnvelopeResultReader;
+  private readonly stableLockOpen: StableLockOpener;
+  private readonly stableLockAssert: StableLockAsserter;
   private readonly stageStore: NativeProfileStageStore;
   private activeRootIdentity: PathIdentity | null = null;
-  private activeLockIdentity: PathIdentity | null = null;
+  private activeLockFile: StableLockFile | null = null;
 
   constructor(options: NativeProfileManagerOptions = {}) {
     this.context = resolveNativeProfileContext(options);
@@ -220,6 +232,8 @@ export class NativeProfileManager {
     this.readEnvelope = options.readEnvelope ?? readNativeEnvelope;
     this.readVault = options.readVault ?? (() => readNativeProfileVault(this.context));
     this.readEnvelopeResult = options.readEnvelopeResult ?? readNativeEnvelopeResult;
+    this.stableLockOpen = options.stableLockOpen ?? openStableLockFile;
+    this.stableLockAssert = options.stableLockAssert ?? assertStableLockFile;
     this.stageStore = new NativeProfileStageStore({
       context: this.context,
       now: this.now,
@@ -257,31 +271,57 @@ export class NativeProfileManager {
     return code === "SQLITE_BUSY" || code === "SQLITE_LOCKED" || /database (?:is|table is) locked/i.test(message);
   }
 
+  private profileLockStorageUnsafe(): NativeProfileError {
+    return new NativeProfileError("PROFILE_STORAGE_UNSAFE", "The native-profile transaction lock was replaced.", 409);
+  }
+
+  private profileLockUnavailable(): NativeProfileError {
+    return new NativeProfileError("PROFILE_LOCK_UNAVAILABLE", "The native-profile lock is unavailable.", 503, true);
+  }
+
+  private isExplicitProfileLockStorageUnsafe(error: unknown): boolean {
+    const code = errorCode(error);
+    const message = error instanceof Error ? error.message : String(error);
+    return error instanceof StableLockPathUnsafeError
+      || code === "ELOOP"
+      || code === "EISDIR"
+      || code === "ENOTDIR"
+      || message.startsWith("unsafe SQLite lock path:")
+      || message.startsWith("SQLite lock path identity changed:");
+  }
+
+  private openStableProfileLockFile(): StableLockFile {
+    try {
+      return this.stableLockOpen(this.context.lockPath);
+    } catch (error) {
+      if (this.isExplicitProfileLockStorageUnsafe(error)) throw this.profileLockStorageUnsafe();
+      throw this.profileLockUnavailable();
+    }
+  }
+
+  private assertStableProfileLockFile(file: StableLockFile): void {
+    try {
+      this.stableLockAssert(this.context.lockPath, file);
+    } catch (error) {
+      if (errorCode(error) === "ENOENT" || this.isExplicitProfileLockStorageUnsafe(error)) {
+        throw this.profileLockStorageUnsafe();
+      }
+      throw this.profileLockUnavailable();
+    }
+  }
+
   private async withLock<T>(operation: () => Promise<T>): Promise<T> {
     assertNoLegacyNativeProfileState(this.context);
     assertNativeProfileLockPath(this.context);
     const deadline = this.now() + this.lockWaitMs;
     let database: Database | undefined;
-    let lockHandle: number | undefined;
-    let acquiredLockIdentity: PathIdentity | undefined;
+    let lockFile: StableLockFile | undefined;
     while (!database) {
       let candidate: Database | undefined;
-      let candidateHandle: number | undefined;
+      let candidateFile: StableLockFile | undefined;
       try {
-        const flags = process.platform === "win32"
-          ? fsConstants.O_RDWR | fsConstants.O_CREAT
-          : fsConstants.O_RDWR | fsConstants.O_CREAT | fsConstants.O_NOFOLLOW;
-        candidateHandle = openSync(this.context.lockPath, flags, 0o600);
-        const opened = fstatSync(candidateHandle, { bigint: true });
-        const pathEntry = lstatSync(this.context.lockPath, { bigint: true });
-        if (
-          !opened.isFile()
-          || !pathEntry.isFile()
-          || pathEntry.isSymbolicLink()
-          || opened.dev !== pathEntry.dev
-          || opened.ino !== pathEntry.ino
-        ) throw new NativeProfileError("PROFILE_STORAGE_UNSAFE", "The native-profile transaction lock was replaced.", 409);
-        const candidateIdentity = { dev: opened.dev, ino: opened.ino };
+        candidateFile = this.openStableProfileLockFile();
+        this.assertStableProfileLockFile(candidateFile);
         candidate = new Database(this.context.lockPath, { create: true });
         const claim = this.uuid();
         candidate.exec("PRAGMA busy_timeout = 0; BEGIN IMMEDIATE");
@@ -291,38 +331,38 @@ export class NativeProfileManager {
         candidate.exec("BEGIN IMMEDIATE");
         const candidateClaim = candidate.query("SELECT claim FROM ocx_native_profile_lock WHERE singleton = 1").get() as { claim?: unknown } | null;
         let verifier: Database | undefined;
-        let verificationPath: string | undefined;
         let pathClaim: { claim?: unknown } | null = null;
         try {
-          verificationPath = `${this.context.lockPath}.verify.${process.pid}.${this.uuid()}`;
-          linkSync(this.context.lockPath, verificationPath);
-          const verificationIdentity = pathIdentity(verificationPath);
-          if (!sameIdentity(verificationIdentity, candidateIdentity)) {
-            throw new NativeProfileError("PROFILE_STORAGE_UNSAFE", "The native-profile transaction lock changed during acquisition.", 409);
-          }
-          verifier = new Database(verificationPath, { readonly: true });
+          this.assertStableProfileLockFile(candidateFile);
+          verifier = new Database(this.context.lockPath, { readonly: true });
           pathClaim = verifier.query("SELECT claim FROM ocx_native_profile_lock WHERE singleton = 1").get() as { claim?: unknown } | null;
-          assertPathIdentity(verificationPath, verificationIdentity, "The native-profile transaction lock verification link");
         } finally {
           try { verifier?.close(); } catch { /* mismatch below is authoritative */ }
-          try { if (verificationPath !== undefined) unlinkSync(verificationPath); } catch { /* acquisition fails below if verification was incomplete */ }
         }
+        this.assertStableProfileLockFile(candidateFile);
         if (candidateClaim?.claim !== claim || pathClaim?.claim !== claim) {
           throw new NativeProfileError("PROFILE_STORAGE_UNSAFE", "The native-profile transaction lock changed during acquisition.", 409);
         }
         try { chmodSync(this.context.lockPath, 0o600); } catch { /* Windows ACL below is authoritative there. */ }
         await this.hardenPath(this.context.lockPath);
         assertNativeProfileLockPath(this.context);
-        assertPathIdentity(this.context.lockPath, candidateIdentity, "The native-profile transaction lock");
+        this.assertStableProfileLockFile(candidateFile);
         database = candidate;
-        lockHandle = candidateHandle;
-        acquiredLockIdentity = candidateIdentity;
+        candidate = undefined;
+        lockFile = candidateFile;
+        candidateFile = undefined;
       } catch (error) {
+        let mappedError = error;
+        if (!(mappedError instanceof NativeProfileError) && candidateFile) {
+          try { this.assertStableProfileLockFile(candidateFile); }
+          catch (storageError) { mappedError = storageError; }
+        }
+        try { candidate?.exec("ROLLBACK"); } catch { /* acquisition already failed */ }
         try { candidate?.close(); } catch { /* acquisition already failed */ }
-        try { if (candidateHandle !== undefined) closeSync(candidateHandle); } catch { /* acquisition already failed */ }
-        if (error instanceof NativeProfileError) throw error;
-        if (!this.isLockBusy(error)) {
-          throw new NativeProfileError("PROFILE_LOCK_UNAVAILABLE", "The native-profile lock is unavailable.", 503, true);
+        try { candidateFile?.close(); } catch { /* acquisition already failed */ }
+        if (mappedError instanceof NativeProfileError) throw mappedError;
+        if (!this.isLockBusy(mappedError)) {
+          throw this.profileLockUnavailable();
         }
         if (this.now() >= deadline) {
           throw new NativeProfileError("NATIVE_PROFILE_BUSY", "Another native-profile operation is still running.", 503, true);
@@ -331,7 +371,7 @@ export class NativeProfileManager {
       }
     }
     try {
-      this.activeLockIdentity = acquiredLockIdentity!;
+      this.activeLockFile = lockFile ?? null;
       this.activeRootIdentity = await this.ensureRoot();
       await this.onLockAcquired();
       this.assertOperationStorageStable();
@@ -341,17 +381,17 @@ export class NativeProfileManager {
     } finally {
       try { database.exec("ROLLBACK"); } catch { /* close still releases the OS-backed lock */ }
       try { database.close(); } catch { /* transaction is already ending */ }
-      try { if (lockHandle !== undefined) closeSync(lockHandle); } catch { /* SQLite handle already released the transaction */ }
+      try { lockFile?.close(); } catch { /* SQLite handle already released the transaction */ }
       this.activeRootIdentity = null;
-      this.activeLockIdentity = null;
+      this.activeLockFile = null;
     }
   }
 
   private assertOperationStorageStable(): void {
-    if (!this.activeRootIdentity || !this.activeLockIdentity) {
+    if (!this.activeRootIdentity || !this.activeLockFile) {
       throw new NativeProfileError("PROFILE_STORAGE_UNSAFE", "Native-profile storage ownership is not active.", 409);
     }
-    assertPathIdentity(this.context.lockPath, this.activeLockIdentity, "The native-profile transaction lock");
+    this.assertStableProfileLockFile(this.activeLockFile);
     assertPathIdentity(this.context.rootDir, this.activeRootIdentity, "The native-profile metadata root");
     assertNativeProfileMetadataLayout(this.context);
   }
diff --git a/src/codex/native-profile-processes.ts b/src/codex/native-profile-processes.ts
index d310cc2ee..8eb27f871 100644
--- a/src/codex/native-profile-processes.ts
+++ b/src/codex/native-profile-processes.ts
@@ -3,6 +3,15 @@ import { basename } from "node:path";
 import { resolveTrustedWindowsPowerShellExe } from "../lib/windows-elevation";
 
 const PROCESS_LIST_MAX_BUFFER = 16 * 1024 * 1024;
+const DIRECT_CODEX_BASENAMES = new Set(["codex", "codex.exe"]);
+const CODEX_INTERPRETER_BASENAMES = new Set(["node", "nodejs", "bun"]);
+const CODEX_ENTRYPOINT_BASENAMES = new Set([
+  "codex",
+  "codex.js",
+  "codex.mjs",
+  "codex.cjs",
+  "codex.ts",
+]);
 
 export interface NativeProcessExecOptions {
   encoding: "utf8";
@@ -83,8 +92,14 @@ async function unixProcessCount(run: NativeProcessExecutor, pid: number): Promis
     const match = line.trim().match(/^(\d+)\s+(\S+)\s*(.*)$/);
     if (!match || Number(match[1]) === pid) continue;
     const command = basename(match[2]!).toLowerCase();
-    const firstArg = basename(match[3]!.trim().split(/\s+/, 1)[0] ?? "").toLowerCase();
-    if (command === "codex" || command === "codex.exe" || firstArg === "codex" || firstArg === "codex.exe") count += 1;
+    const [rawArgv0 = "", rawEntrypoint = ""] = match[3]!.trim().split(/\s+/, 2);
+    const argv0 = basename(rawArgv0).toLowerCase();
+    const entrypoint = basename(rawEntrypoint).toLowerCase();
+    const isDirectCodex = DIRECT_CODEX_BASENAMES.has(command)
+      || DIRECT_CODEX_BASENAMES.has(argv0);
+    const isInterpreterWrappedCodex = CODEX_INTERPRETER_BASENAMES.has(argv0)
+      && CODEX_ENTRYPOINT_BASENAMES.has(entrypoint);
+    if (isDirectCodex || isInterpreterWrappedCodex) count += 1;
   }
   return count;
 }
diff --git a/src/server/lifecycle.ts b/src/server/lifecycle.ts
index 04d2cd3c7..b4825044b 100644
--- a/src/server/lifecycle.ts
+++ b/src/server/lifecycle.ts
@@ -47,6 +47,9 @@ let nativeMainSelections = 0;
 let legacyDrainLease: AdmissionLease | null = null;
 let recyclingForExit = false;
 let _serverRef: ReturnType<typeof Bun.serve> | undefined;
+let serverStopFlights = new WeakMap<ReturnType<typeof Bun.serve>, Promise<void>>();
+let serverStartupReleaseFlights = new WeakMap<ReturnType<typeof Bun.serve>, Promise<void>>();
+let releaseServerStartupLifecycleImpl: typeof releaseNativeMainStartupLifecycle = releaseNativeMainStartupLifecycle;
 
 export function setServerRef(server: ReturnType<typeof Bun.serve> | undefined): void { _serverRef = server; }
 /**
@@ -148,6 +151,9 @@ export function resetLifecycleDrainStateForTests(): void {
   for (const resolve of temporaryDrainWaiters) resolve();
   temporaryDrainWaiters.clear();
   shutdownDraining = false;
+  serverStopFlights = new WeakMap<ReturnType<typeof Bun.serve>, Promise<void>>();
+  serverStartupReleaseFlights = new WeakMap<ReturnType<typeof Bun.serve>, Promise<void>>();
+  releaseServerStartupLifecycleImpl = releaseNativeMainStartupLifecycle;
 }
 export function tryAdmitTurn(): ActiveTurnLease | null {
   if (isDraining()) return null;
@@ -280,6 +286,44 @@ export function getServerListenPort(): number | undefined {
   const port = _serverRef?.port;
   return typeof port === "number" && port > 0 ? port : undefined;
 }
+
+/**
+ * Stop one concrete listener exactly once. Deadline restart handoff can race the
+ * ordinary drain's finally block; both callers must observe the same stop result
+ * before any replacement process is allowed to bind the port.
+ */
+export function stopServerListener(
+  server: ReturnType<typeof Bun.serve> | undefined = _serverRef,
+): Promise<void> {
+  if (!server) return Promise.resolve();
+  const existing = serverStopFlights.get(server);
+  if (existing) return existing;
+  // Bun's Server.stop returns Promise<void>; fire-and-forget races a
+  // follow-on listen and can leave the replacement seeing the old proxy.
+  const flight = Promise.resolve().then(() => server.stop(true));
+  serverStopFlights.set(server, flight);
+  return flight;
+}
+
+/** Native-main startup ownership cleanup, separate from the listen socket flight. */
+export function releaseServerStartupLifecycle(
+  server: ReturnType<typeof Bun.serve> | undefined = _serverRef,
+): Promise<void> {
+  if (!server) return Promise.resolve();
+  const existing = serverStartupReleaseFlights.get(server);
+  if (existing) return existing;
+  const flight = Promise.resolve().then(() => releaseServerStartupLifecycleImpl(server));
+  serverStartupReleaseFlights.set(server, flight);
+  return flight;
+}
+
+/** Test seam for a held/rejected startup lifecycle release. */
+export function setServerStartupLifecycleReleaseForTests(
+  release: typeof releaseNativeMainStartupLifecycle | undefined,
+): void {
+  releaseServerStartupLifecycleImpl = release ?? releaseNativeMainStartupLifecycle;
+  serverStartupReleaseFlights = new WeakMap<ReturnType<typeof Bun.serve>, Promise<void>>();
+}
 /**
  * Mark this process as a recycle (dashboard drain-and-restart). Exit cleanup
  * must keep Codex/Grok/system-env injection so the replacement process inherits
@@ -392,11 +436,9 @@ export async function drainAndShutdown(
     setStorageCleanupPolicyJobLiveApply(null);
   } finally {
     try {
-      // Bun's Server.stop returns Promise<void>; fire-and-forget races the next
-      // isolate reclaim / follow-on listen the same way unterminated Workers did.
-      if (s) await s.stop(true);
+      await stopServerListener(s);
     } finally {
-      if (s) await releaseNativeMainStartupLifecycle(s);
+      await releaseServerStartupLifecycle(s);
       // shutdownDraining is a process-lifetime latch. A stopped server must
       // never resume admission merely because shutdown cleanup returned.
     }
diff --git a/src/server/management/system-restart.ts b/src/server/management/system-restart.ts
index 40d8d1cb9..a302db306 100644
--- a/src/server/management/system-restart.ts
+++ b/src/server/management/system-restart.ts
@@ -30,21 +30,36 @@ import {
   isDraining,
   isShutdownDraining,
   markRecyclingForExit,
+  stopServerListener,
 } from "../lifecycle";
 import { isServiceViable } from "../../service";
 import { readRuntimePort } from "../../config";
 import { withProcessRuntimeProvenance } from "../../lib/bun-runtime";
+import { findLiveProxy } from "../proxy-liveness";
 
 /** Fixed v1 drain window for the memory-card action (not config-driven). */
 export const MEMORY_DRAIN_RESTART_MS = 60_000;
+// Ordinary pinned-port start can spend 60s reclaiming a Windows ghost listener
+// and another 5s settling it. Keep one polling/scheduler margin beyond that.
+export const REPLACEMENT_READY_TIMEOUT_MS = 70_000;
+export const DEADLINE_LISTENER_STOP_TIMEOUT_MS = 5_000;
+const REPLACEMENT_READY_POLL_MS = 150;
+
+export interface ReplacementReadinessIo {
+  findLive?: typeof findLiveProxy;
+  now?: () => number;
+  sleep?: (ms: number) => Promise<void>;
+}
 
 export interface SystemRestartIo {
   drainAndShutdown?: typeof drainAndShutdown;
   /** True when a background service can actually respawn this process after exit(1). */
   isServiceViable?: () => boolean;
   isSupervisedServiceChild?: () => boolean;
-  /** Must resolve only after the replacement process has actually started. */
-  spawnStart?: (port?: number) => void | Promise<void>;
+  /** Ordinary start; deadline handoff may defer health until parent exit releases OS locks. */
+  spawnStart?: (port?: number, waitForHealthBeforeParentExit?: boolean) => void | Promise<void>;
+  /** Idempotent listener close; must settle before an ordinary start is spawned. */
+  stopListener?: () => void | Promise<void>;
   markRecycling?: () => void;
   exitProcess?: (code: number) => void;
   schedule?: (fn: () => void | Promise<void>, ms: number) => void;
@@ -63,6 +78,7 @@ let restartIo: SystemRestartIo = {};
 let restartAccepted = false;
 
 type RestartDrainOutcome = "completed" | "rejected" | "deadline";
+type BoundedSettlementOutcome = "completed" | "rejected" | "deadline";
 
 function waitForRestartDrain(
   drainPromise: Promise<void>,
@@ -94,6 +110,29 @@ function waitForRestartDrain(
   });
 }
 
+function waitForBoundedSettlement(
+  promise: Promise<void>,
+  timeoutMs: number,
+  scheduleDeadline: NonNullable<SystemRestartIo["scheduleDeadline"]>,
+): Promise<BoundedSettlementOutcome> {
+  return new Promise<BoundedSettlementOutcome>((resolve) => {
+    let settled = false;
+    let cancelDeadline: (() => void) | undefined;
+    const finish = (outcome: BoundedSettlementOutcome) => {
+      if (settled) return;
+      settled = true;
+      cancelDeadline?.();
+      resolve(outcome);
+    };
+    cancelDeadline = scheduleDeadline(() => finish("deadline"), timeoutMs);
+    if (settled) cancelDeadline();
+    void promise.then(
+      () => finish("completed"),
+      () => finish("rejected"),
+    );
+  });
+}
+
 /** Test seam — reset between tests. */
 export function setSystemRestartIoForTests(io: SystemRestartIo = {}): void {
   restartIo = io;
@@ -124,10 +163,62 @@ function spawnFailureCode(err: unknown): string {
   return "spawn_failed";
 }
 
-function spawnDetachedStart(port?: number): Promise<void> {
+function handoffError(code: string): NodeJS.ErrnoException {
+  const error = new Error(code) as NodeJS.ErrnoException;
+  error.code = code;
+  return error;
+}
+
+export async function waitForReplacementReady(
+  expectedPid: number | undefined,
+  parentPid: number,
+  expectedPort: number | undefined,
+  io: ReplacementReadinessIo = {},
+): Promise<boolean> {
+  const findLive = io.findLive ?? findLiveProxy;
+  const now = io.now ?? Date.now;
+  const sleep = io.sleep ?? Bun.sleep;
+  const deadline = now() + REPLACEMENT_READY_TIMEOUT_MS;
+  while (now() < deadline) {
+    try {
+      const live = await findLive({
+        deadlineAt: deadline,
+        nowFn: now,
+        sleepFn: sleep,
+      });
+      // A probe that began within budget can still return after it. Never accept
+      // delayed health as proof once the shared absolute handoff budget expired.
+      if (now() >= deadline) return false;
+      if (
+        live
+        && live.pid !== null
+        && live.pid !== parentPid
+        && (expectedPid === undefined || live.pid === expectedPid)
+        && (expectedPort === undefined || live.port === expectedPort)
+      ) {
+        return true;
+      }
+    } catch {
+      // A not-yet-bound replacement is indistinguishable from a transient
+      // liveness failure here; keep polling inside the one bounded window.
+    }
+    const remainingMs = deadline - now();
+    if (remainingMs <= 0) break;
+    await sleep(Math.min(REPLACEMENT_READY_POLL_MS, remainingMs));
+  }
+  return false;
+}
+
+function spawnDetachedStart(
+  port?: number,
+  waitForHealthBeforeParentExit = true,
+): Promise<void> {
   const args = [process.argv[1], "start"];
-  if (typeof port === "number" && Number.isFinite(port) && port > 0 && port <= 65535) {
-    args.push("--port", String(Math.trunc(port)));
+  const expectedPort = typeof port === "number" && Number.isFinite(port) && port > 0 && port <= 65535
+    ? Math.trunc(port)
+    : undefined;
+  if (expectedPort !== undefined) {
+    args.push("--port", String(expectedPort));
   }
   return new Promise<void>((resolve, reject) => {
     let child: ReturnType<typeof spawn>;
@@ -143,42 +234,66 @@ function spawnDetachedStart(port?: number): Promise<void> {
       return;
     }
     let settled = false;
-    const finish = (fn: () => void) => {
+    const cleanup = () => {
+      child.off("error", onError);
+      child.off("exit", onExit);
+      child.off("spawn", onSpawn);
+    };
+    const finish = (error?: unknown) => {
       if (settled) return;
       settled = true;
-      fn();
+      cleanup();
+      if (error !== undefined) {
+        if (child.exitCode === null && child.signalCode === null) {
+          try { child.kill(); } catch { /* best-effort failed-start cleanup */ }
+        }
+        try { child.unref(); } catch { /* best-effort */ }
+        reject(error);
+        return;
+      }
+      child.unref();
+      resolve();
     };
-    child.once("error", (err) => {
-      finish(() => reject(err));
-    });
-    child.once("spawn", () => {
-      finish(() => {
-        child.unref();
-        resolve();
-      });
-    });
+    const onError = (err: Error) => { finish(err); };
+    const onExit = () => { finish(handoffError("child_exit")); };
+    const onSpawn = () => {
+      if (!waitForHealthBeforeParentExit) {
+        // A deadline may have been caused by native-main ownership cleanup.
+        // Let the ordinary child survive parent exit, which releases those OS locks.
+        finish();
+        return;
+      }
+      void waitForReplacementReady(child.pid, process.pid, expectedPort).then(
+        ready => {
+          if (!ready) {
+            console.warn(
+              "Drain-and-restart replacement is still alive after the readiness window; allowing it to continue after parent exit",
+            );
+          }
+          // Never kill a live ordinary start at its valid reclaim boundary. Parent
+          // exit is the final resource release the child may still be waiting for.
+          finish();
+        },
+        err => finish(err),
+      );
+    };
+    child.once("error", onError);
+    child.once("exit", onExit);
+    child.once("spawn", onSpawn);
   });
 }
 
-async function completeDeadlineRestartHandoff(
+async function completeDeferredParentExitHandoff(
   io: SystemRestartIo,
   exitProcess: (code: number) => void,
+  port: number | undefined,
+  phase: "deadline" | "listener-stop fallback",
 ): Promise<void> {
-  const supervised = (io.isSupervisedServiceChild ?? (() => isSupervisedServiceChild(io)))();
-  if (supervised) {
-    // Failure-only supervisors ignore exit(0); intentional non-zero triggers respawn.
-    exitProcess(1);
-    return;
-  }
-
-  const port = (io.listenPort ?? resolveListenPort)();
   try {
-    // The pinned child has its own bounded port reclaim, so it can launch before this
-    // process exits without binding the old listener or extending the drain deadline.
-    await (io.spawnStart ?? spawnDetachedStart)(port);
+    await (io.spawnStart ?? spawnDetachedStart)(port, false);
   } catch (err) {
     console.warn(
-      `Drain-and-restart deadline spawn failed (${spawnFailureCode(err)}); exiting without replacement`,
+      `Drain-and-restart ${phase} spawn failed (${spawnFailureCode(err)}); exiting without replacement`,
     );
     delete process.env.OCX_SERVICE;
     exitProcess(1);
@@ -188,6 +303,37 @@ async function completeDeadlineRestartHandoff(
   exitProcess(0);
 }
 
+async function completeDeadlineRestartHandoff(
+  io: SystemRestartIo,
+  exitProcess: (code: number) => void,
+  port: number | undefined,
+  scheduleDeadline: NonNullable<SystemRestartIo["scheduleDeadline"]>,
+): Promise<void> {
+  const supervised = (io.isSupervisedServiceChild ?? (() => isSupervisedServiceChild(io)))();
+  if (supervised) {
+    // Failure-only supervisors ignore exit(0); intentional non-zero triggers respawn.
+    exitProcess(1);
+    return;
+  }
+
+  const stopPromise = Promise.resolve().then(
+    () => (io.stopListener ?? (() => stopServerListener()))(),
+  );
+  const stopOutcome = await waitForBoundedSettlement(
+    stopPromise,
+    DEADLINE_LISTENER_STOP_TIMEOUT_MS,
+    scheduleDeadline,
+  );
+  if (stopOutcome === "rejected") {
+    console.warn("Drain-and-restart deadline listener stop failed; continuing parent-exit handoff");
+  } else if (stopOutcome === "deadline") {
+    console.warn("Drain-and-restart deadline listener stop timed out; continuing parent-exit handoff");
+  }
+  // The ordinary child must survive parent exit: a failed/pending socket close
+  // or overdue cleanup is completed by process teardown, without a hidden mode.
+  await completeDeferredParentExitHandoff(io, exitProcess, port, "deadline");
+}
+
 /**
  * Accept a drain-and-restart request. Returns immediately; the drain +
  * respawn runs on a short timer so the HTTP response can flush first.
@@ -215,6 +361,9 @@ export function acceptSystemRestart(io: SystemRestartIo = restartIo): {
     else if (io.setDraining) io.setDraining(true);
     else beginShutdownDrain();
     schedule(async () => {
+      // Preserve the live binding before drainAndShutdown (or its deadline race)
+      // closes the listener and makes both the server ref and runtime metadata stale.
+      const restartPort = (io.listenPort ?? resolveListenPort)();
       const drain = io.drainAndShutdown ?? drainAndShutdown;
       const remainingMs = Math.max(0, restartDeadlineMs - now());
       const drainPromise = Promise.resolve().then(() => drain(undefined, remainingMs));
@@ -226,7 +375,7 @@ export function acceptSystemRestart(io: SystemRestartIo = restartIo): {
       const exitProcess = io.exitProcess ?? ((code: number) => { process.exit(code); });
       if (drainOutcome === "deadline") {
         console.warn("Drain-and-restart deadline expired; forcing terminal restart handoff");
-        await completeDeadlineRestartHandoff(io, exitProcess);
+        await completeDeadlineRestartHandoff(io, exitProcess, restartPort, scheduleDeadline);
         return;
       }
       if (drainOutcome === "rejected") {
@@ -240,9 +389,23 @@ export function acceptSystemRestart(io: SystemRestartIo = restartIo): {
         (io.exitProcess ?? ((code: number) => { process.exit(code); }))(1);
         return;
       }
-      const port = (io.listenPort ?? resolveListenPort)();
       try {
-        await (io.spawnStart ?? spawnDetachedStart)(port);
+        await (io.stopListener ?? (() => stopServerListener()))();
+      } catch {
+        console.warn("Drain-and-restart listener stop failed; continuing parent-exit handoff");
+        await completeDeferredParentExitHandoff(
+          io,
+          exitProcess,
+          restartPort,
+          "listener-stop fallback",
+        );
+        return;
+      }
+      try {
+        // A rejected drain has uncertain cleanup ownership, so it uses the same
+        // parent-exit handoff as a deadline. Only a fully completed drain waits
+        // for replacement health in the old process.
+        await (io.spawnStart ?? spawnDetachedStart)(restartPort, drainOutcome === "completed");
       } catch (err) {
         console.warn(
           `⚠️  Drain-and-restart spawn failed (${spawnFailureCode(err)}); exiting without replacement`,
diff --git a/src/server/responses/compact.ts b/src/server/responses/compact.ts
index fcac8dc7f..6cbe75028 100644
--- a/src/server/responses/compact.ts
+++ b/src/server/responses/compact.ts
@@ -141,13 +141,15 @@ async function resolveAlternateCompactContext(args: {
   route: { provider: OcxProviderConfig; codexAccountMode?: CodexAccountMode };
   selectedModelId: string | undefined;
   excludeAccountId: string | null;
+  turnAdmissionLease?: AdmissionLease;
 }): Promise<{ authCtx: CodexAuthContext; provider: OcxProviderConfig; headers: Headers } | null> {
-  const { req, config, route, selectedModelId, excludeAccountId } = args;
+  const { req, config, route, selectedModelId, excludeAccountId, turnAdmissionLease } = args;
   if (!route.codexAccountMode || !excludeAccountId) return null;
   try {
     const authCtx = await resolveCodexAuthContext(req.headers, config, route.codexAccountMode, {
       ...(selectedModelId ? { modelId: selectedModelId } : {}),
       excludeAccountId,
+      beginCodexAccountSelection: codexAccountSelectionForTurn(turnAdmissionLease),
     });
     if (!authCtx.accountId || authCtx.accountId === excludeAccountId) return null;
     const provider = applyCodexAuthContextToProvider(route.provider, authCtx, route.codexAccountMode);
@@ -164,7 +166,13 @@ async function resolveAlternateCompactContext(args: {
     }
     if (provider.apiKey) headers.set("authorization", `Bearer ${resolveEnvValue(provider.apiKey)}`);
     return { authCtx, provider, headers };
-  } catch {
+  } catch (err) {
+    if (err instanceof CodexMainProfileDrainingError) {
+      // The native-main fence can start after account A has already rejected the
+      // request. Treat the now-fenced main profile as no alternate and preserve A's
+      // real rejection instead of replacing it with a synthetic drain response.
+      return null;
+    }
     // No eligible alternate (all cooled, affinity expired, reauth needed) — the caller
     // returns the first account's rejection unchanged, which is today's behavior.
     return null;
@@ -431,6 +439,7 @@ export async function handleResponsesCompact(
         route,
         selectedModelId,
         excludeAccountId: authCtx.accountId,
+        turnAdmissionLease,
       });
       // Resolution can await a credential refresh, so the client may have gone away
       // while we were choosing B. Re-check before spending anything: recording A,
diff --git a/tests/api-storage.test.ts b/tests/api-storage.test.ts
index 9b94dd18e..74367a009 100644
--- a/tests/api-storage.test.ts
+++ b/tests/api-storage.test.ts
@@ -1,6 +1,6 @@
 import { afterEach, beforeEach, describe, expect, test } from "bun:test";
 import { managementFetch as fetch } from "./helpers/management-auth";
-import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { mkdirSync, mkdtempSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { saveConfig } from "../src/config";
@@ -35,6 +35,27 @@ function writeSessionsFixture(codexHome: string): void {
   writeFileSync(join(codexHome, "archived_sessions", "rollout-y.jsonl"), "y".repeat(120));
 }
 
+function inventoryCodexHome(codexHome: string): { bytes: number; fileCount: number; paths: string[] } {
+  const inventory = { bytes: 0, fileCount: 0, paths: [] as string[] };
+  const walk = (dir: string, relPrefix = "", root = false): void => {
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+      if (root && entry.name === ".trash") continue;
+      const filePath = join(dir, entry.name);
+      const relPath = relPrefix ? `${relPrefix}/${entry.name}` : entry.name;
+      if (entry.isDirectory()) {
+        walk(filePath, relPath);
+      } else if (entry.isFile()) {
+        inventory.bytes += statSync(filePath).size;
+        inventory.fileCount += 1;
+        inventory.paths.push(relPath);
+      }
+    }
+  };
+  walk(codexHome, "", true);
+  inventory.paths.sort();
+  return inventory;
+}
+
 beforeEach(() => {
   previousHome = process.env.OPENCODEX_HOME;
   isolatedCodexHome = installIsolatedCodexHome("ocx-api-storage-codex-");
@@ -70,8 +91,34 @@ describe("GET /api/storage", () => {
       expect(sessions.fileCount).toBe(1);
       const archived = body.buckets.find((b: { key: string }) => b.key === "archived_sessions");
       expect(archived.bytes).toBe(120);
-      // config.toml written by the isolated-home helper lands in "other".
-      expect(body.total.fileCount).toBe(3);
+      expect(archived.fileCount).toBe(1);
+      const other = body.buckets.find((b: { key: string }) => b.key === "other");
+      expect(other).toBeDefined();
+      expect(other.fileCount).toBeGreaterThanOrEqual(1);
+
+      // config.toml and live native-main coordination files legitimately land in
+      // "other"; compare against the filesystem without fixing their exact count.
+      const inventory = inventoryCodexHome(isolatedCodexHome!.path);
+      expect(body.total).toEqual({ bytes: inventory.bytes, fileCount: inventory.fileCount });
+      const fixturePaths = [
+        "archived_sessions/rollout-y.jsonl",
+        "config.toml",
+        "sessions/2026/07/01/rollout-x.jsonl",
+      ];
+      const coordinationDatabases = [
+        ".opencodex-native-main.claim.sqlite",
+        ".opencodex-native-main.owner.sqlite",
+        ".opencodex-native-profile.lock.sqlite",
+      ];
+      const sqliteSidecars = ["-journal", "-wal", "-shm"];
+      expect(inventory.paths).toEqual(expect.arrayContaining(fixturePaths));
+      expect(inventory.paths.filter(path =>
+        !fixturePaths.includes(path)
+        && !coordinationDatabases.some(database =>
+          path === database || sqliteSidecars.some(suffix => path === `${database}${suffix}`)
+        )
+      )).toEqual([]);
+      expect(body.total.fileCount).toBeGreaterThanOrEqual(3);
       expect(body.total.bytes).toBeGreaterThan(620);
     } finally {
       await server.stop(true);
diff --git a/tests/ci-workflows.test.ts b/tests/ci-workflows.test.ts
index 293a01b8a..20c0ca5c9 100644
--- a/tests/ci-workflows.test.ts
+++ b/tests/ci-workflows.test.ts
@@ -27,10 +27,32 @@ function count(text: string, fragment: string): number {
   return text.split(fragment).length - 1;
 }
 
+function expectSecureLinuxKeyringBootstrap(workflow: string): void {
+  const smokeStep = workflow
+    .split("- name: OS keyring create/read/delete smoke")[1]
+    ?.split(/\n(?: {6}- name:| {2}[A-Za-z0-9_-]+:)/)[0];
+
+  expect(smokeStep).toBeDefined();
+  expect(smokeStep).toContain('keyring_home="$(mktemp -d)"');
+  expect(smokeStep).toContain('runtime_dir="$(mktemp -d)"');
+  expect(smokeStep).toContain('cleanup() { rm -rf -- "$keyring_home" "$runtime_dir"; }');
+  expect(smokeStep).toContain("trap cleanup EXIT");
+  expect(smokeStep).toContain('chmod 700 "$keyring_home" "$runtime_dir"');
+  expect(smokeStep).toContain(
+    'HOME="$keyring_home" XDG_RUNTIME_DIR="$runtime_dir" dbus-run-session',
+  );
+  expect(smokeStep).toMatch(
+    /od -An -N32 -tx1 \/dev\/urandom \|\s+tr -d "\[:space:\]" \|\s+gnome-keyring-daemon --unlock --components=secrets >\/dev\/null/,
+  );
+  expect(smokeStep).not.toContain("eval ");
+  expect(smokeStep).not.toContain("gnome-keyring-daemon --start");
+}
+
 describe("GitHub Actions hardening", () => {
   test("cross-platform CI keeps bounded jobs and immutable action references", async () => {
     const workflow = await readText(".github/workflows/ci.yml");
     const ci = Bun.YAML.parse(workflow) as {
+      permissions?: Record<string, string>;
       jobs?: Record<string, { "timeout-minutes"?: number } | undefined>;
     };
 
@@ -47,6 +69,23 @@ describe("GitHub Actions hardening", () => {
     expect(ci.jobs?.["keyring-smoke"]?.["timeout-minutes"]).toBe(8);
     expect(ci.jobs?.["npm-global-smoke"]?.["timeout-minutes"]).toBe(8);
     expect(ci.jobs?.ci?.["timeout-minutes"]).toBe(5);
+    expect(ci.permissions).toEqual({ contents: "read" });
+
+    const keyringJob = ci.jobs?.["keyring-smoke"] as {
+      "runs-on"?: string;
+      strategy?: {
+        matrix?: {
+          include?: Array<{ name: string; runner: string }>;
+        };
+      };
+    } | undefined;
+    expect(keyringJob?.["runs-on"]).toBe("${{ matrix.runner }}");
+    expect(keyringJob?.strategy?.matrix?.include).toEqual([
+      { name: "ubuntu", runner: "ubuntu-latest" },
+      { name: "windows", runner: "windows-latest" },
+      { name: "macos", runner: "macos-latest" },
+    ]);
+    expectSecureLinuxKeyringBootstrap(workflow);
     // Every job must stay bounded — an unbounded job can hang a queue for hours.
     // Asserted structurally rather than by counting the string: a count passes if
     // a job is added while another loses its bound in the same edit. Iterating the
@@ -363,8 +402,20 @@ describe("GitHub Actions hardening", () => {
 
   test("release workflow gates the exact SHA, channel, and service surface without injection", async () => {
     const workflow = await readText(".github/workflows/release.yml");
+    const release = Bun.YAML.parse(workflow) as {
+      permissions?: Record<string, string>;
+      jobs?: { publish?: { "runs-on"?: string } };
+    };
 
     // Least privilege + never cancel a publish mid-flight.
+    expect(release.permissions).toEqual({
+      contents: "write",
+      actions: "read",
+      "pull-requests": "read",
+      "id-token": "write",
+    });
+    expect(release.jobs?.publish?.["runs-on"]).toBe("ubuntu-latest");
+    expectSecureLinuxKeyringBootstrap(workflow);
     expect(workflow).toContain("actions: read");
     expect(workflow).toContain("pull-requests: read");
     expect(workflow).toContain("id-token: write");
diff --git a/tests/codex-main-rotation.test.ts b/tests/codex-main-rotation.test.ts
index a42f16c45..65c52b9f9 100644
--- a/tests/codex-main-rotation.test.ts
+++ b/tests/codex-main-rotation.test.ts
@@ -72,6 +72,12 @@ function makeConfig(overrides: Partial<OcxConfig> = {}): OcxConfig {
   } as OcxConfig;
 }
 
+function deferred(): { promise: Promise<void>; resolve: () => void } {
+  let resolve!: () => void;
+  const promise = new Promise<void>(done => { resolve = done; });
+  return { promise, resolve };
+}
+
 describe("main account rotation (Option A)", () => {
   beforeEach(() => {
     prevOpencodexHome = process.env.OPENCODEX_HOME;
@@ -320,13 +326,17 @@ describe("main account rotation (Option A)", () => {
   test("discards an in-flight usage response after the main identity changes", async () => {
     expect(reconcileMainCodexAccountRuntimeState()).toBe(false);
     const originalFetch = globalThis.fetch;
+    const firstUsageEntered = deferred();
     let resolveFirstUsage!: (response: Response) => void;
     const requestedAccountIds: string[] = [];
     globalThis.fetch = (async (input, init) => {
       if (!String(input).includes("/backend-api/wham/usage")) return originalFetch(input, init);
       requestedAccountIds.push(new Headers(init?.headers).get("ChatGPT-Account-Id") ?? "");
       if (requestedAccountIds.length === 1) {
-        return new Promise<Response>(resolve => { resolveFirstUsage = resolve; });
+        return new Promise<Response>(resolve => {
+          resolveFirstUsage = resolve;
+          firstUsageEntered.resolve();
+        });
       }
       return new Response(JSON.stringify({
         email: "b@example.test",
@@ -336,6 +346,7 @@ describe("main account rotation (Option A)", () => {
     }) as typeof fetch;
     try {
       const infoPromise = fetchMainAccountInfo(true);
+      await firstUsageEntered.promise;
       expect(requestedAccountIds).toEqual(["main_acct"]);
 
       writeFileSync(
@@ -366,16 +377,21 @@ describe("main account rotation (Option A)", () => {
   test("does not retry an in-flight usage response when the current identity is temporarily unknown", async () => {
     expect(reconcileMainCodexAccountRuntimeState()).toBe(false);
     const originalFetch = globalThis.fetch;
+    const usageEntered = deferred();
     let resolveUsage!: (response: Response) => void;
     let usageCalls = 0;
     globalThis.fetch = (async (input, init) => {
       if (!String(input).includes("/backend-api/wham/usage")) return originalFetch(input, init);
       usageCalls++;
       expect(new Headers(init?.headers).get("ChatGPT-Account-Id")).toBe("main_acct");
-      return new Promise<Response>(resolve => { resolveUsage = resolve; });
+      return new Promise<Response>(resolve => {
+        resolveUsage = resolve;
+        usageEntered.resolve();
+      });
     }) as typeof fetch;
     try {
       const infoPromise = fetchMainAccountInfo(true);
+      await usageEntered.promise;
       rmSync(join(CODEX_DIR, "auth.json"));
       resolveUsage(new Response(JSON.stringify({
         email: "a@example.test",
diff --git a/tests/helpers/native-profile-lock-child.ts b/tests/helpers/native-profile-lock-child.ts
index 52707cd6a..ec51075a5 100644
--- a/tests/helpers/native-profile-lock-child.ts
+++ b/tests/helpers/native-profile-lock-child.ts
@@ -1,31 +1,52 @@
 import { existsSync, writeFileSync } from "node:fs";
 
 import { NativeProfileManager } from "../../src/codex/native-profile-manager";
+import { NativeProfileError } from "../../src/codex/native-profile-types";
 
 const codexHome = process.env.NATIVE_PROFILE_TEST_CODEX_HOME;
 const configDir = process.env.NATIVE_PROFILE_TEST_CONFIG_DIR;
 const readyPath = process.env.NATIVE_PROFILE_TEST_READY;
 const releasePath = process.env.NATIVE_PROFILE_TEST_RELEASE;
 const contentionPath = process.env.NATIVE_PROFILE_TEST_CONTENTION;
+const probeResultPath = process.env.NATIVE_PROFILE_TEST_PROBE_RESULT;
 
-if (!codexHome || !configDir || !readyPath || !releasePath) {
+if (!codexHome || !configDir) {
   throw new Error("native-profile lock child is missing required test paths");
 }
 
-const manager = new NativeProfileManager({
-  codexHome,
-  configDir,
-  hardenPath: async () => {},
-  lockWaitMs: 5_000,
-  sleep: async ms => {
-    if (contentionPath) writeFileSync(contentionPath, "contended");
-    await Bun.sleep(ms);
-  },
-  onLockAcquired: async () => {
-    writeFileSync(readyPath, "ready");
-    if (process.env.NATIVE_PROFILE_TEST_CRASH === "1") process.exit(87);
-    while (!existsSync(releasePath)) await Bun.sleep(10);
-  },
-});
+if (probeResultPath) {
+  const probe = new NativeProfileManager({
+    codexHome,
+    configDir,
+    hardenPath: async () => {},
+    lockWaitMs: 0,
+  });
+  try {
+    await probe.recover(false);
+    writeFileSync(probeResultPath, "acquired");
+  } catch (error) {
+    if (!(error instanceof NativeProfileError) || error.code !== "NATIVE_PROFILE_BUSY") throw error;
+    writeFileSync(probeResultPath, "busy");
+  }
+} else {
+  if (!readyPath || !releasePath) {
+    throw new Error("native-profile lock child is missing required holder paths");
+  }
+  const manager = new NativeProfileManager({
+    codexHome,
+    configDir,
+    hardenPath: async () => {},
+    lockWaitMs: 5_000,
+    sleep: async ms => {
+      if (contentionPath) writeFileSync(contentionPath, "contended");
+      await Bun.sleep(ms);
+    },
+    onLockAcquired: async () => {
+      writeFileSync(readyPath, "ready");
+      if (process.env.NATIVE_PROFILE_TEST_CRASH === "1") process.exit(87);
+      while (!existsSync(releasePath)) await Bun.sleep(10);
+    },
+  });
 
-await manager.recover(false);
+  await manager.recover(false);
+}
diff --git a/tests/native-profile-manager.test.ts b/tests/native-profile-manager.test.ts
index 2702c5119..3a929cfd1 100644
--- a/tests/native-profile-manager.test.ts
+++ b/tests/native-profile-manager.test.ts
@@ -156,6 +156,24 @@ function spawnLockHolder(
   });
 }
 
+function spawnLockProbe(
+  f: ReturnType<typeof fixture>,
+  resultPath: string,
+): ReturnType<typeof Bun.spawn> {
+  return Bun.spawn([process.execPath, join(import.meta.dir, "helpers", "native-profile-lock-child.ts")], {
+    cwd: join(import.meta.dir, ".."),
+    env: {
+      ...process.env,
+      NATIVE_PROFILE_TEST_CODEX_HOME: f.codexHome,
+      NATIVE_PROFILE_TEST_CONFIG_DIR: f.configDir,
+      NATIVE_PROFILE_TEST_PROBE_RESULT: resultPath,
+    },
+    stdin: "ignore",
+    stdout: "pipe",
+    stderr: "pipe",
+  });
+}
+
 describe("native main profile transactions", () => {
   test("an abruptly exited child releases the OS-backed profile transaction", async () => {
     const f = fixture();
@@ -168,6 +186,57 @@ describe("native main profile transactions", () => {
     expect((await successor.recover(false)).recovered).toBe(false);
   }, 15_000);
 
+  test("a losing same-process contender cannot release another transaction's POSIX lock", async () => {
+    if (process.platform === "win32") return;
+    const f = fixture();
+    let signalHeld!: () => void;
+    const held = new Promise<void>(resolve => { signalHeld = resolve; });
+    let releaseOwner!: () => void;
+    const released = new Promise<void>(resolve => { releaseOwner = resolve; });
+    let ownerReleased = false;
+    let busyProbe: ReturnType<typeof Bun.spawn> | undefined;
+    let acquiredProbe: ReturnType<typeof Bun.spawn> | undefined;
+    const owner = new NativeProfileManager({
+      ...f.options,
+      onLockAcquired: async () => {
+        signalHeld();
+        await released;
+      },
+    });
+    const holding = owner.doctor();
+    try {
+      await held;
+      const contender = new NativeProfileManager({ ...f.options, lockWaitMs: 0 });
+      let caught: unknown;
+      try { await contender.recover(false); } catch (error) { caught = error; }
+      expect(caught).toBeInstanceOf(NativeProfileError);
+      expect((caught as NativeProfileError).code).toBe("NATIVE_PROFILE_BUSY");
+
+      const busyResult = join(f.root, "third-pid-busy");
+      busyProbe = spawnLockProbe(f, busyResult);
+      expect(await busyProbe.exited).toBe(0);
+      expect(readFileSync(busyResult, "utf8")).toBe("busy");
+
+      releaseOwner();
+      ownerReleased = true;
+      await holding;
+
+      const acquiredResult = join(f.root, "third-pid-acquired");
+      acquiredProbe = spawnLockProbe(f, acquiredResult);
+      expect(await acquiredProbe.exited).toBe(0);
+      expect(readFileSync(acquiredResult, "utf8")).toBe("acquired");
+    } finally {
+      if (!ownerReleased) releaseOwner();
+      if (busyProbe?.exitCode === null) busyProbe.kill();
+      if (acquiredProbe?.exitCode === null) acquiredProbe.kill();
+      await Promise.allSettled([
+        holding,
+        ...(busyProbe ? [busyProbe.exited] : []),
+        ...(acquiredProbe ? [acquiredProbe.exited] : []),
+      ]);
+    }
+  }, 15_000);
+
   test("two processes exclude each other and predecessor release cannot delete a successor lock", async () => {
     const f = fixture();
     const firstReady = join(f.root, "first-ready");
@@ -313,6 +382,79 @@ describe("native main profile transactions", () => {
     expect(readdirSync(attacker)).toEqual([]);
   });
 
+  test("reports a replaced stable transaction lock as unsafe instead of retryable unavailable", async () => {
+    const f = fixture();
+    let assertions = 0;
+    const manager = new NativeProfileManager({
+      ...f.options,
+      stableLockAssert: path => {
+        assertions += 1;
+        if (assertions === 5) throw new Error(`SQLite lock path identity changed: ${path}`);
+      },
+    });
+
+    let caught: unknown;
+    try { await manager.recover(false); } catch (error) { caught = error; }
+
+    expect(caught).toBeInstanceOf(NativeProfileError);
+    expect((caught as NativeProfileError).code).toBe("PROFILE_STORAGE_UNSAFE");
+    expect((caught as NativeProfileError).retryable).not.toBe(true);
+    expect(assertions).toBe(5);
+  });
+
+  test("keeps transient stable-lock access failures retryable and unavailable", async () => {
+    for (const code of ["EIO", "EACCES", "ESTALE"]) {
+      const f = fixture();
+      const transient = Object.assign(new Error(`injected ${code} stable-lock access failure`), { code });
+      let assertions = 0;
+      const manager = new NativeProfileManager({
+        ...f.options,
+        stableLockAssert: () => {
+          assertions += 1;
+          if (assertions === 5) throw transient;
+        },
+      });
+
+      let caught: unknown;
+      try { await manager.recover(false); } catch (error) { caught = error; }
+
+      expect(caught).toBeInstanceOf(NativeProfileError);
+      expect((caught as NativeProfileError).code).toBe("PROFILE_LOCK_UNAVAILABLE");
+      expect((caught as NativeProfileError).retryable).toBe(true);
+      expect(assertions).toBe(5);
+    }
+  });
+
+  test("distinguishes initial ENOENT availability from post-open identity loss", async () => {
+    const f = fixture();
+    const initialMissing = Object.assign(new Error("injected initial lock open ENOENT"), { code: "ENOENT" });
+    const unavailable = new NativeProfileManager({
+      ...f.options,
+      stableLockOpen: () => { throw initialMissing; },
+    });
+    let unavailableError: unknown;
+    try { await unavailable.recover(false); } catch (error) { unavailableError = error; }
+    expect(unavailableError).toBeInstanceOf(NativeProfileError);
+    expect((unavailableError as NativeProfileError).code).toBe("PROFILE_LOCK_UNAVAILABLE");
+    expect((unavailableError as NativeProfileError).retryable).toBe(true);
+
+    let assertions = 0;
+    const identityLost = Object.assign(new Error("injected post-open lock ENOENT"), { code: "ENOENT" });
+    const unsafe = new NativeProfileManager({
+      ...f.options,
+      stableLockAssert: () => {
+        assertions += 1;
+        if (assertions === 5) throw identityLost;
+      },
+    });
+    let unsafeError: unknown;
+    try { await unsafe.recover(false); } catch (error) { unsafeError = error; }
+    expect(unsafeError).toBeInstanceOf(NativeProfileError);
+    expect((unsafeError as NativeProfileError).code).toBe("PROFILE_STORAGE_UNSAFE");
+    expect((unsafeError as NativeProfileError).retryable).not.toBe(true);
+    expect(assertions).toBe(5);
+  });
+
   test("cancels a malformed stage without trusting its metadata", async () => {
     const f = fixture();
     const manager = new NativeProfileManager(f.options);
diff --git a/tests/native-profile-processes.test.ts b/tests/native-profile-processes.test.ts
index 710d2c68e..a62dc0b27 100644
--- a/tests/native-profile-processes.test.ts
+++ b/tests/native-profile-processes.test.ts
@@ -63,7 +63,7 @@ describe("native profile process probe", () => {
       calls.push([file, args, options]);
       return [
         "41 codex /usr/local/bin/codex",
-        "42 codex /usr/local/bin/codex",
+        "42 MainThread bun /opt/tools/codex/bin/codex.js",
         "43 bun /opt/tools/codex --serve",
       ].join("\n");
     };
@@ -82,6 +82,41 @@ describe("native profile process probe", () => {
     expect(calls[0]![2].killSignal).toBe("SIGKILL");
   });
 
+  test("detects Codex as the immediate entrypoint of known Unix interpreters", async () => {
+    const execFile: NativeProcessExecutor = async () => [
+      "43 node /usr/bin/node /usr/lib/node_modules/@openai/codex/bin/codex.js",
+      "44 MainThread /home/user/.bun/bin/bun /opt/codex/bin/codex",
+      "45 nodejs /usr/bin/nodejs /opt/codex/bin/codex.mjs",
+      "46 bun /usr/bin/bun /opt/codex/bin/codex.cjs",
+      "47 bun /usr/bin/bun /opt/codex/bin/codex.ts",
+    ].join("\n");
+
+    await expect(probeNativeCodexProcesses({
+      platform: "linux",
+      execFile,
+      pid: 42,
+    })).resolves.toEqual({ status: "busy", count: 5 });
+  });
+
+  test("does not scan beyond an exact immediate Unix interpreter entrypoint", async () => {
+    const execFile: NativeProcessExecutor = async () => [
+      "51 node /usr/bin/node /srv/app.js --label codex",
+      "52 bun /usr/bin/bun /srv/app.ts /opt/codex.js",
+      "53 node /usr/bin/node /srv/codex-helper.js",
+      "54 bash /bin/bash /opt/codex",
+      "55 node /usr/bin/node --require /opt/codex.js",
+      "56 worker /srv/app /opt/codex",
+      "57 node /usr/bin/node /srv/codex.js.backup",
+      "58 codex-helper /usr/local/bin/codex-helper",
+    ].join("\n");
+
+    await expect(probeNativeCodexProcesses({
+      platform: "linux",
+      execFile,
+      pid: 42,
+    })).resolves.toEqual({ status: "clear", count: 0 });
+  });
+
   test("does not starve an unrelated timer while a probe is pending", async () => {
     let release!: (value: string) => void;
     const execFile: NativeProcessExecutor = () => new Promise(resolve => {
diff --git a/tests/responses-compaction-routing.test.ts b/tests/responses-compaction-routing.test.ts
index 33b1b50fb..8475575e4 100644
--- a/tests/responses-compaction-routing.test.ts
+++ b/tests/responses-compaction-routing.test.ts
@@ -5,7 +5,7 @@
  * fatals on a compaction turn that came back as an ordinary message.
  */
 import { afterEach, describe, expect, test } from "bun:test";
-import { mkdtempSync, rmSync } from "node:fs";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { handleResponses, handleResponsesCompact } from "../src/server/responses";
@@ -18,11 +18,13 @@ import {
   resolveCodexAccountForThread,
 } from "../src/codex/routing";
 import { updateAccountQuota } from "../src/codex/auth-api";
+import { MAIN_CODEX_ACCOUNT_ID } from "../src/codex/main-account";
 import {
   releaseCodexAuthContextProbeLease,
   resolveCodexAuthContext,
 } from "../src/codex/auth-context";
 import { supportsNativeResponsesCompactEndpoint } from "../src/providers/openai-tiers";
+import { acquireNativeMainProfileDrain, tryAdmitTurn } from "../src/server/lifecycle";
 import type { OcxConfig, OcxProviderConfig } from "../src/types";
 
 const originalFetch = globalThis.fetch;
@@ -618,6 +620,55 @@ describe("compact alternate-account attempt (#913)", () => {
     });
   }
 
+  test("a native-main drain starting between attempts preserves the first rejection", async () => {
+    await withPoolEnv("ocx-compact-alt-main-drain-", async config => {
+      // Keep native main as A's only alternate. This makes the fixture fail closed
+      // only when the second auth selection receives the same admitted-turn lease.
+      config.codexAccounts = [config.codexAccounts![0]!];
+      config.activeCodexAccountId = "pool-a";
+      writeFileSync(join(process.env.CODEX_HOME!, "auth.json"), JSON.stringify({
+        tokens: {
+          access_token: "main-access-token",
+          account_id: "main-account",
+        },
+      }));
+      updateAccountQuota(MAIN_CODEX_ACCOUNT_ID, 0);
+
+      const turn = tryAdmitTurn();
+      expect(turn).not.toBeNull();
+      let profileDrain: ReturnType<typeof acquireNativeMainProfileDrain> = null;
+      const accounts: Array<string | null> = [];
+      globalThis.fetch = (async (_url: string, init?: RequestInit) => {
+        accounts.push(new Headers(init?.headers).get("chatgpt-account-id"));
+        if (accounts.length === 1) {
+          profileDrain = acquireNativeMainProfileDrain("compact-between-attempts");
+          expect(profileDrain).not.toBeNull();
+          return Response.json({ error: { message: "pool exhausted" } }, {
+            status: 429,
+            headers: { "retry-after": "47" },
+          });
+        }
+        return jsonResponse(completedPayload("unexpected native-main alternate"));
+      }) as typeof fetch;
+
+      try {
+        const res = await handleResponsesCompact(
+          compactionRequest(baseCompactionBody({})),
+          config,
+          { model: "", provider: "" },
+          turn!,
+        );
+
+        expect(accounts).toEqual(["pool_acc_a"]);
+        expect(res.status).toBe(429);
+        expect(res.headers.get("retry-after")).toBe("47");
+      } finally {
+        profileDrain?.release();
+        turn?.release();
+      }
+    });
+  });
+
   test("a bound thread at 100% local quota still sends once, with no alternate attempt", async () => {
     // The scope guard. The alternate path must trigger on an actual upstream 429/402,
     // never on a local quota reading: a cached 100% is what the affined account looked
diff --git a/tests/shutdown-drain.test.ts b/tests/shutdown-drain.test.ts
index 0898aa8c8..bc3829a63 100644
--- a/tests/shutdown-drain.test.ts
+++ b/tests/shutdown-drain.test.ts
@@ -18,7 +18,10 @@ import {
   acquireNativeMainProfileDrain,
   activeRegistryMetrics,
   beginShutdownDrain,
+  releaseServerStartupLifecycle,
   resetLifecycleDrainStateForTests,
+  setServerStartupLifecycleReleaseForTests,
+  stopServerListener,
   tryAdmitTurn,
   codexAccountSelectionForTurn,
   getNativeMainProfileRequestCount,
@@ -60,14 +63,95 @@ function installShutdownShell() {
   return child;
 }
 
-function fakeServer() {
+function fakeServer(stopImpl?: (closeActiveConnections?: boolean) => void | Promise<void>) {
   let stops = 0;
+  const stopArgs: Array<boolean | undefined> = [];
   return {
-    server: { stop() { stops++; } } as unknown as ReturnType<typeof Bun.serve>,
+    server: {
+      stop(closeActiveConnections?: boolean) {
+        stops++;
+        stopArgs.push(closeActiveConnections);
+        return stopImpl?.(closeActiveConnections);
+      },
+    } as unknown as ReturnType<typeof Bun.serve>,
     stops: () => stops,
+    stopArgs: () => stopArgs,
   };
 }
 
+describe("server listener shutdown", () => {
+  test("single-flights stop(true) and keeps every waiter pending until close completes", async () => {
+    let resolveStop!: () => void;
+    const fake = fakeServer(() => new Promise<void>(resolve => { resolveStop = resolve; }));
+    let firstSettled = false;
+    let secondSettled = false;
+
+    const first = stopServerListener(fake.server).then(() => { firstSettled = true; });
+    const second = stopServerListener(fake.server).then(() => { secondSettled = true; });
+    await Promise.resolve();
+
+    expect(fake.stops()).toBe(1);
+    expect(fake.stopArgs()).toEqual([true]);
+    expect(firstSettled).toBe(false);
+    expect(secondSettled).toBe(false);
+
+    resolveStop();
+    await Promise.all([first, second]);
+    expect(firstSettled).toBe(true);
+    expect(secondSettled).toBe(true);
+    expect(fake.stops()).toBe(1);
+  });
+
+  test("retains a rejected stop flight instead of retrying an uncertain listener", async () => {
+    const failure = new Error("fixture listener stop rejection");
+    const fake = fakeServer(async () => { throw failure; });
+
+    const first = stopServerListener(fake.server);
+    const second = stopServerListener(fake.server);
+    await expect(first).rejects.toBe(failure);
+    await expect(second).rejects.toBe(failure);
+    await expect(stopServerListener(fake.server)).rejects.toBe(failure);
+    expect(fake.stops()).toBe(1);
+    expect(fake.stopArgs()).toEqual([true]);
+  });
+
+  test("keeps socket close available while normal drain waits on held startup cleanup", async () => {
+    let signalReleaseStarted!: () => void;
+    const releaseStarted = new Promise<void>(resolve => { signalReleaseStarted = resolve; });
+    let allowRelease!: () => void;
+    const releaseGate = new Promise<void>(resolve => { allowRelease = resolve; });
+    let releases = 0;
+    setServerStartupLifecycleReleaseForTests(async () => {
+      releases += 1;
+      signalReleaseStarted();
+      await releaseGate;
+    });
+    const fake = fakeServer();
+    let drainSettled = false;
+    const draining = drainAndShutdown(fake.server, 0).then(() => { drainSettled = true; });
+
+    await releaseStarted;
+    expect(fake.stops()).toBe(1);
+    expect(fake.stopArgs()).toEqual([true]);
+    await stopServerListener(fake.server);
+    expect(drainSettled).toBe(false);
+
+    let secondReleaseSettled = false;
+    const secondRelease = releaseServerStartupLifecycle(fake.server).then(() => {
+      secondReleaseSettled = true;
+    });
+    await Promise.resolve();
+    expect(releases).toBe(1);
+    expect(secondReleaseSettled).toBe(false);
+
+    allowRelease();
+    await Promise.all([draining, secondRelease]);
+    expect(drainSettled).toBe(true);
+    expect(secondReleaseSettled).toBe(true);
+    expect(releases).toBe(1);
+  });
+});
+
 describe("active turn tracking", () => {
   test("admit/bind/unregister tracks active turns through the boundary lease", () => {
     const ac1 = new AbortController();
@@ -141,6 +225,7 @@ describe("active turn tracking", () => {
     await drainAndShutdown(fake.server, 0);
 
     expect(fake.stops()).toBe(1);
+    expect(fake.stopArgs()).toEqual([true]);
     expect(isDraining()).toBe(true);
     profileLease?.release();
     expect(isDraining()).toBe(true);
diff --git a/tests/system-restart.test.ts b/tests/system-restart.test.ts
index 72793093f..dd95ee28c 100644
--- a/tests/system-restart.test.ts
+++ b/tests/system-restart.test.ts
@@ -5,9 +5,12 @@ import { afterEach, describe, expect, test } from "bun:test";
 import { handleManagementAPI } from "../src/server/management-api";
 import { resetLifecycleDrainStateForTests, setDraining } from "../src/server/lifecycle";
 import {
+  DEADLINE_LISTENER_STOP_TIMEOUT_MS,
   MEMORY_DRAIN_RESTART_MS,
+  REPLACEMENT_READY_TIMEOUT_MS,
   acceptSystemRestart,
   setSystemRestartIoForTests,
+  waitForReplacementReady,
 } from "../src/server/management/system-restart";
 import type { OcxConfig } from "../src/types";
 
@@ -56,7 +59,8 @@ describe("acceptSystemRestart", () => {
       drainAndShutdown: async (_server, timeoutMs) => {
         calls.push(`drain:${timeoutMs}`);
       },
-      spawnStart: (port) => { calls.push(`start:${port}`); },
+      stopListener: () => { calls.push("stop"); },
+      spawnStart: (port, waitForHealth) => { calls.push(`start:${port}:${waitForHealth ? "ready" : "deferred"}`); },
       markRecycling: () => { calls.push("recycle"); },
       exitProcess: (code) => { calls.push(`exit:${code}`); },
     });
@@ -73,17 +77,63 @@ describe("acceptSystemRestart", () => {
     expect(scheduled).not.toBeNull();
     now += 15_000;
     await scheduled!();
-    expect(calls).toEqual(["draining:true", "drain:45000", "start:10123", "recycle", "exit:0"]);
+    expect(calls).toEqual(["draining:true", "drain:45000", "stop", "start:10123:ready", "recycle", "exit:0"]);
     expect(deadlineDelay).toBe(45_000);
     expect(deadlineCancellations).toBe(1);
     deadlineCallback?.();
-    expect(calls).toEqual(["draining:true", "drain:45000", "start:10123", "recycle", "exit:0"]);
+    expect(calls).toEqual(["draining:true", "drain:45000", "stop", "start:10123:ready", "recycle", "exit:0"]);
+  });
+
+  test("snapshots the restart port before normal drain invalidates listener metadata", async () => {
+    const calls: string[] = [];
+    let scheduled: (() => void | Promise<void>) | null = null;
+    let portAvailable = true;
+
+    acceptSystemRestart({
+      isDraining: () => false,
+      getActiveTurnCount: () => 0,
+      isSupervisedServiceChild: () => false,
+      listenPort: () => {
+        calls.push(`port:${portAvailable ? 10123 : "gone"}`);
+        return portAvailable ? 10123 : undefined;
+      },
+      schedule: (fn) => { scheduled = fn; },
+      scheduleDeadline: () => () => {},
+      setDraining: () => { calls.push("latched"); },
+      drainAndShutdown: async () => {
+        calls.push("drain");
+        portAvailable = false;
+      },
+      stopListener: () => {
+        calls.push("stop");
+        portAvailable = false;
+      },
+      spawnStart: (port) => { calls.push(`start:${port}`); },
+      markRecycling: () => { calls.push("recycle"); },
+      exitProcess: (code) => { calls.push(`exit:${code}`); },
+    });
+
+    await scheduled!();
+    expect(calls).toEqual([
+      "latched",
+      "port:10123",
+      "drain",
+      "stop",
+      "start:10123",
+      "recycle",
+      "exit:0",
+    ]);
   });
 
   test("never-settling unsupervised drain starts one replacement at the original deadline", async () => {
     const calls: string[] = [];
     let scheduled: (() => void | Promise<void>) | null = null;
     let fireDeadline: (() => void) | null = null;
+    let resolveStop!: () => void;
+    let resolveStart!: () => void;
+    let signalStartEntered!: () => void;
+    const startEntered = new Promise<void>(resolve => { signalStartEntered = resolve; });
+    let deadlineSchedules = 0;
     let now = 1_000;
 
     acceptSystemRestart({
@@ -93,8 +143,13 @@ describe("acceptSystemRestart", () => {
       listenPort: () => 10123,
       schedule: (fn) => { scheduled = fn; },
       scheduleDeadline: (fn, ms) => {
-        expect(ms).toBe(60_000);
-        fireDeadline = fn;
+        deadlineSchedules += 1;
+        if (deadlineSchedules === 1) {
+          expect(ms).toBe(60_000);
+          fireDeadline = fn;
+        } else {
+          expect(ms).toBe(DEADLINE_LISTENER_STOP_TIMEOUT_MS);
+        }
         return () => {};
       },
       now: () => now,
@@ -103,7 +158,15 @@ describe("acceptSystemRestart", () => {
         calls.push("drain");
         return new Promise<void>(() => {});
       },
-      spawnStart: (port) => { calls.push(`start:${port}`); },
+      stopListener: () => {
+        calls.push("stop");
+        return new Promise<void>(resolve => { resolveStop = resolve; });
+      },
+      spawnStart: (port, waitForHealth) => {
+        calls.push(`start:${port}:${waitForHealth ? "ready" : "deferred"}`);
+        signalStartEntered();
+        return new Promise<void>(resolve => { resolveStart = resolve; });
+      },
       markRecycling: () => { calls.push("recycle"); },
       exitProcess: (code) => { calls.push(`exit:${code}`); },
     });
@@ -114,8 +177,15 @@ describe("acceptSystemRestart", () => {
     expect(calls).toEqual(["latched", "drain"]);
     now += 60_000;
     fireDeadline?.();
+    await Promise.resolve();
+    await Promise.resolve();
+    expect(calls).toEqual(["latched", "drain", "stop"]);
+    resolveStop();
+    await startEntered;
+    expect(calls).toEqual(["latched", "drain", "stop", "start:10123:deferred"]);
+    resolveStart();
     await running;
-    expect(calls).toEqual(["latched", "drain", "start:10123", "recycle", "exit:0"]);
+    expect(calls).toEqual(["latched", "drain", "stop", "start:10123:deferred", "recycle", "exit:0"]);
   });
 
   test("exactly elapsed unsupervised deadline starts replacement without waiting for late drain resolution", async () => {
@@ -130,13 +200,17 @@ describe("acceptSystemRestart", () => {
       isSupervisedServiceChild: () => false,
       listenPort: () => 10123,
       schedule: (fn) => { scheduled = fn; },
-      scheduleDeadline: () => { throw new Error("exact deadline must not schedule another timer"); },
+      scheduleDeadline: (_fn, ms) => {
+        expect(ms).toBe(DEADLINE_LISTENER_STOP_TIMEOUT_MS);
+        return () => {};
+      },
       now: () => now,
       setDraining: () => { calls.push("latched"); },
       drainAndShutdown: (_server, timeoutMs) => {
         calls.push(`drain:${timeoutMs}`);
         return new Promise<void>(resolve => { resolveDrain = resolve; });
       },
+      stopListener: () => { calls.push("stop"); },
       spawnStart: (port) => { calls.push(`start:${port}`); },
       markRecycling: () => { calls.push("recycle"); },
       exitProcess: (code) => { calls.push(`exit:${code}`); },
@@ -144,10 +218,10 @@ describe("acceptSystemRestart", () => {
 
     now += MEMORY_DRAIN_RESTART_MS;
     await scheduled!();
-    expect(calls).toEqual(["latched", "drain:0", "start:10123", "recycle", "exit:0"]);
+    expect(calls).toEqual(["latched", "drain:0", "stop", "start:10123", "recycle", "exit:0"]);
     resolveDrain();
     await Promise.resolve();
-    expect(calls).toEqual(["latched", "drain:0", "start:10123", "recycle", "exit:0"]);
+    expect(calls).toEqual(["latched", "drain:0", "stop", "start:10123", "recycle", "exit:0"]);
   });
 
   test("deadline leaves a supervised child to its failure-only supervisor", async () => {
@@ -166,6 +240,7 @@ describe("acceptSystemRestart", () => {
         calls.push("drain");
         return new Promise<void>(() => {});
       },
+      stopListener: () => { calls.push("stop"); },
       spawnStart: () => { calls.push("start"); },
       markRecycling: () => { calls.push("recycle"); },
       exitProcess: (code) => { calls.push(`exit:${code}`); },
@@ -195,6 +270,7 @@ describe("acceptSystemRestart", () => {
         calls.push("drain");
         return new Promise<void>(() => {});
       },
+      stopListener: () => { calls.push("stop"); },
       spawnStart: async () => {
         calls.push("start");
         throw Object.assign(new Error("spawn error"), { code: "EACCES" });
@@ -208,7 +284,143 @@ describe("acceptSystemRestart", () => {
     await Promise.resolve();
     fireDeadline?.();
     await running;
-    expect(calls).toEqual(["latched", "drain", "start", "exit:1"]);
+    expect(calls).toEqual(["latched", "drain", "stop", "start", "exit:1"]);
+  });
+
+  test("deadline listener-stop failure still hands off to a deferred replacement", async () => {
+    const calls: string[] = [];
+    let scheduled: (() => void | Promise<void>) | null = null;
+    let fireDeadline: (() => void) | null = null;
+
+    acceptSystemRestart({
+      isDraining: () => false,
+      getActiveTurnCount: () => 0,
+      isSupervisedServiceChild: () => false,
+      schedule: (fn) => { scheduled = fn; },
+      scheduleDeadline: (fn) => { fireDeadline = fn; return () => {}; },
+      setDraining: () => { calls.push("latched"); },
+      drainAndShutdown: () => {
+        calls.push("drain");
+        return new Promise<void>(() => {});
+      },
+      stopListener: async () => {
+        calls.push("stop");
+        throw new Error("fixture stop failure");
+      },
+      spawnStart: (_port, waitForHealth) => {
+        calls.push(`start:${waitForHealth ? "ready" : "deferred"}`);
+      },
+      markRecycling: () => { calls.push("recycle"); },
+      exitProcess: (code) => { calls.push(`exit:${code}`); },
+    });
+
+    const running = scheduled!();
+    await Promise.resolve();
+    await Promise.resolve();
+    fireDeadline?.();
+    await running;
+    expect(calls).toEqual(["latched", "drain", "stop", "start:deferred", "recycle", "exit:0"]);
+  });
+
+  test("deadline bounds a never-settling listener stop and ignores its late rejection", async () => {
+    const calls: string[] = [];
+    let scheduled: (() => void | Promise<void>) | null = null;
+    const timers: Array<{ fn: () => void; ms: number; cancelled: boolean }> = [];
+    let rejectStop!: (reason?: unknown) => void;
+
+    acceptSystemRestart({
+      isDraining: () => false,
+      getActiveTurnCount: () => 0,
+      isSupervisedServiceChild: () => false,
+      listenPort: () => 10123,
+      schedule: (fn) => { scheduled = fn; },
+      scheduleDeadline: (fn, ms) => {
+        const timer = { fn, ms, cancelled: false };
+        timers.push(timer);
+        return () => { timer.cancelled = true; };
+      },
+      setDraining: () => { calls.push("latched"); },
+      drainAndShutdown: () => {
+        calls.push("drain");
+        return new Promise<void>(() => {});
+      },
+      stopListener: () => {
+        calls.push("stop");
+        return new Promise<void>((_resolve, reject) => { rejectStop = reject; });
+      },
+      spawnStart: (port, waitForHealth) => {
+        calls.push(`start:${port}:${waitForHealth ? "ready" : "deferred"}`);
+      },
+      markRecycling: () => { calls.push("recycle"); },
+      exitProcess: (code) => { calls.push(`exit:${code}`); },
+    });
+
+    const running = scheduled!();
+    await Promise.resolve();
+    await Promise.resolve();
+    expect(timers[0]?.ms).toBe(MEMORY_DRAIN_RESTART_MS);
+    timers[0]!.fn();
+    await Promise.resolve();
+    await Promise.resolve();
+    expect(timers[1]?.ms).toBe(DEADLINE_LISTENER_STOP_TIMEOUT_MS);
+    expect(calls).toEqual(["latched", "drain", "stop"]);
+
+    timers[1]!.fn();
+    await running;
+    expect(calls).toEqual([
+      "latched",
+      "drain",
+      "stop",
+      "start:10123:deferred",
+      "recycle",
+      "exit:0",
+    ]);
+
+    rejectStop(new Error("late fixture stop rejection"));
+    await Promise.resolve();
+    await Promise.resolve();
+    expect(calls).toEqual([
+      "latched",
+      "drain",
+      "stop",
+      "start:10123:deferred",
+      "recycle",
+      "exit:0",
+    ]);
+  });
+
+  test("normal unsupervised stop rejection also preserves a replacement", async () => {
+    const calls: string[] = [];
+    let scheduled: (() => void | Promise<void>) | null = null;
+
+    acceptSystemRestart({
+      isDraining: () => false,
+      getActiveTurnCount: () => 0,
+      isSupervisedServiceChild: () => false,
+      listenPort: () => 10123,
+      schedule: (fn) => { scheduled = fn; },
+      scheduleDeadline: () => () => {},
+      setDraining: () => {},
+      drainAndShutdown: async () => { calls.push("drain"); },
+      stopListener: async () => {
+        calls.push("stop");
+        throw new Error("fixture stop rejection");
+      },
+      spawnStart: (port, waitForHealth) => {
+        calls.push(`start:${port}:${waitForHealth ? "ready" : "deferred"}`);
+      },
+      markRecycling: () => { calls.push("recycle"); },
+      exitProcess: (code) => { calls.push(`exit:${code}`); },
+    });
+
+    await scheduled!();
+    expect(calls).toEqual([
+      "drain",
+      "stop",
+      "start:10123:deferred",
+      "recycle",
+      "exit:0",
+    ]);
   });
 
   test("late drain rejection after timeout is observed without a second terminal action", async () => {
@@ -227,6 +439,7 @@ describe("acceptSystemRestart", () => {
         calls.push("drain");
         return new Promise<void>((_resolve, reject) => { rejectDrain = reject; });
       },
+      stopListener: () => { calls.push("stop"); },
       spawnStart: () => { calls.push("start"); },
       markRecycling: () => { calls.push("recycle"); },
       exitProcess: (code) => { calls.push(`exit:${code}`); },
@@ -237,11 +450,11 @@ describe("acceptSystemRestart", () => {
     await Promise.resolve();
     fireDeadline?.();
     await running;
-    expect(calls).toEqual(["latched", "drain", "start", "recycle", "exit:0"]);
+    expect(calls).toEqual(["latched", "drain", "stop", "start", "recycle", "exit:0"]);
     rejectDrain(new Error("late fixture rejection"));
     await Promise.resolve();
     await Promise.resolve();
-    expect(calls).toEqual(["latched", "drain", "start", "recycle", "exit:0"]);
+    expect(calls).toEqual(["latched", "drain", "stop", "start", "recycle", "exit:0"]);
   });
 
   test("supervised service child exits 1 so failure-only supervisors respawn", async () => {
@@ -254,6 +467,7 @@ describe("acceptSystemRestart", () => {
       isSupervisedServiceChild: () => true,
       schedule: (fn) => { scheduled = fn; },
       drainAndShutdown: async () => { calls.push("drain"); },
+      stopListener: () => { calls.push("stop"); },
       spawnStart: () => { calls.push("start"); },
       markRecycling: () => { calls.push("recycle"); },
       exitProcess: (code) => { calls.push(`exit:${code}`); },
@@ -357,7 +571,7 @@ describe("acceptSystemRestart", () => {
     }
   });
 
-  test("spawn async rejection exits 1 without marking recycle", async () => {
+  test("replacement readiness rejection exits 1 without marking recycle", async () => {
     const calls: string[] = [];
     let scheduled: (() => void | Promise<void>) | null = null;
 
@@ -371,7 +585,7 @@ describe("acceptSystemRestart", () => {
       drainAndShutdown: async () => { calls.push("drain"); },
       spawnStart: async () => {
         calls.push("start");
-        throw new Error("spawn error before start");
+        throw Object.assign(new Error("replacement never became healthy"), { code: "readiness_timeout" });
       },
       markRecycling: () => { calls.push("recycle"); },
       exitProcess: (code) => { calls.push(`exit:${code}`); },
@@ -396,13 +610,14 @@ describe("acceptSystemRestart", () => {
         calls.push("drain");
         throw new Error("fixture cleanup rejection");
       },
+      stopListener: () => { calls.push("stop"); },
       spawnStart: (port) => { calls.push(`start:${port}`); },
       markRecycling: () => { calls.push("recycle"); },
       exitProcess: (code) => { calls.push(`exit:${code}`); },
     });
 
     await scheduled!();
-    expect(calls).toEqual(["latched", "drain", "start:10123", "recycle", "exit:0"]);
+    expect(calls).toEqual(["latched", "drain", "stop", "start:10123", "recycle", "exit:0"]);
   });
 
   test("spawn failure clears OCX_SERVICE so exit cleanup can restore fences", async () => {
@@ -489,6 +704,59 @@ describe("acceptSystemRestart", () => {
   });
 });
 
+describe("replacement readiness budget", () => {
+  test("allows the ordinary 65s Windows reclaim boundary without wall-clock delay", async () => {
+    let now = 0;
+    const ready = await waitForReplacementReady(222, 111, 10123, {
+      now: () => now,
+      sleep: async (ms) => { now += ms; },
+      findLive: async () => now >= 65_000
+        ? { pid: 222, port: 10123, source: "runtime" }
+        : null,
+    });
+
+    expect(REPLACEMENT_READY_TIMEOUT_MS).toBeGreaterThanOrEqual(65_000);
+    expect(ready).toBe(true);
+    expect(now).toBeGreaterThanOrEqual(65_000);
+    expect(now).toBeLessThan(REPLACEMENT_READY_TIMEOUT_MS);
+  });
+
+  test("ends the readiness probe at its exact virtual deadline", async () => {
+    let now = 0;
+    const ready = await waitForReplacementReady(222, 111, 10123, {
+      now: () => now,
+      sleep: async (ms) => { now += ms; },
+      findLive: async () => null,
+    });
+
+    expect(ready).toBe(false);
+    expect(now).toBe(REPLACEMENT_READY_TIMEOUT_MS);
+  });
+
+  test("passes the absolute readiness deadline into a delayed internal probe", async () => {
+    let now = 0;
+    let probes = 0;
+    let forwardedDeadline: number | undefined;
+    const ready = await waitForReplacementReady(222, 111, 10123, {
+      now: () => now,
+      sleep: async (ms) => { now += ms; },
+      findLive: async (probeIo) => {
+        probes += 1;
+        forwardedDeadline = probeIo?.deadlineAt;
+        expect(probeIo?.nowFn?.()).toBe(now);
+        expect(typeof probeIo?.sleepFn).toBe("function");
+        now = probeIo!.deadlineAt! + 1;
+        return { pid: 222, port: 10123, source: "runtime" };
+      },
+    });
+
+    expect(ready).toBe(false);
+    expect(probes).toBe(1);
+    expect(forwardedDeadline).toBe(REPLACEMENT_READY_TIMEOUT_MS);
+    expect(now).toBe(REPLACEMENT_READY_TIMEOUT_MS + 1);
+  });
+});
+
 describe("POST /api/system/restart", () => {
   test("returns 202 with drain timeout and does not tear down injection", async () => {
     setSystemRestartIoForTests({

From 6cf016f8d5b31a10ba34d420f14b8dfddc37db95 Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Tue, 4 Aug 2026 02:26:02 +0900
Subject: [PATCH 61/63] fix(native-main): address final review follow-ups

---
 .github/workflows/ci.yml                      |  6 +-
 .github/workflows/release.yml                 | 42 ++--------
 .../ja/reference/cli/providers-accounts.md    |  6 ++
 .../ko/reference/cli/providers-accounts.md    |  6 ++
 .../ru/reference/cli/providers-accounts.md    |  6 ++
 .../zh-cn/reference/cli/providers-accounts.md |  6 ++
 gui/bun.lock                                  |  8 +-
 gui/package.json                              |  4 +
 package.json                                  |  2 +-
 scripts/keyring-smoke.ts                      |  5 +-
 scripts/release.ts                            |  2 +-
 src/cli/account-api.ts                        |  8 ++
 src/cli/account-main.ts                       | 60 +++++++++++---
 tests/ci-workflows.test.ts                    | 31 +++++++-
 tests/cli-native-profile.test.ts              | 79 +++++++++++++++++++
 tests/keyring-smoke.test.ts                   | 16 ++++
 tests/release-helper.test.ts                  |  6 +-
 17 files changed, 238 insertions(+), 55 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 542ae19a8..420c22944 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -432,9 +432,9 @@ jobs:
       - name: CLI help smoke
         run: bun run src/cli/index.ts help
 
-  # Keep OS credential-store checks on disposable GitHub-hosted machines. The
-  # Windows platform leg may use the persistent ocx-home runner for trusted push
-  # events; a force-cancelled process cannot run its in-process finally cleanup.
+  # Keep every OS credential-store check on a disposable GitHub-hosted machine.
+  # A force-cancelled process cannot run its in-process finally cleanup, so no
+  # keyring matrix leg may use the persistent self-hosted Windows runner.
   keyring-smoke:
     name: keyring ${{ matrix.name }}
     runs-on: ${{ matrix.runner }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b49dd93b6..0bc641bc8 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -93,35 +93,7 @@ jobs:
         run: bun install --frozen-lockfile
 
       - name: Dependency audit (high severity)
-        run: bun audit --audit-level=high
-
-      # Release runs on Linux, whose hosted image has no user keyring session.
-      # Use an isolated HOME and D-Bus session so this validates Secret Service
-      # without touching persistent runner state or silently skipping the check.
-      - name: Install Secret Service dependencies
-        shell: bash
-        run: |
-          set -euo pipefail
-          sudo apt-get update
-          sudo apt-get install --yes --no-install-recommends dbus-x11 gnome-keyring
-
-      - name: OS keyring create/read/delete smoke
-        shell: bash
-        run: |
-          set -euo pipefail
-          keyring_home="$(mktemp -d)"
-          runtime_dir="$(mktemp -d)"
-          cleanup() { rm -rf -- "$keyring_home" "$runtime_dir"; }
-          trap cleanup EXIT
-          chmod 700 "$keyring_home" "$runtime_dir"
-          HOME="$keyring_home" XDG_RUNTIME_DIR="$runtime_dir" dbus-run-session -- bash -euo pipefail -c '
-            # Create and unlock the isolated login keyring without putting its
-            # ephemeral password in argv, the environment, or the job log.
-            od -An -N32 -tx1 /dev/urandom |
-              tr -d "[:space:]" |
-              gnome-keyring-daemon --unlock --components=secrets >/dev/null
-            bun run scripts/keyring-smoke.ts
-          '
+        run: bun run audit:high
 
       - name: Verify version matches package.json
         env:
@@ -134,6 +106,8 @@ jobs:
             exit 1;
           }
 
+      # The exact-SHA CI gate includes the hosted Linux, Windows, and macOS
+      # keyring smoke matrix. Do not duplicate its Linux bootstrap here.
       - name: Require successful Cross-platform CI for this commit
         env:
           GH_TOKEN: ${{ github.token }}
@@ -169,17 +143,15 @@ jobs:
           fi
 
           ci_url="$(
-            # shellcheck disable=SC2016
-            # `$branch` is a jq variable bound by --arg, not a shell variable, so
-            # the filter must stay single-quoted.
             gh run list \
               --workflow ci.yml \
+              --branch "${GITHUB_REF#refs/heads/}" \
               --commit "$GITHUB_SHA" \
+              --event push \
               --status success \
               --limit 10 \
-              --json conclusion,headSha,url,workflowName,event,headBranch \
-              --jq --arg branch "${GITHUB_REF#refs/heads/}" \
-                'map(select(.event == "push" and .headBranch == $branch)) | .[0].url // ""'
+              --json url \
+              --jq '.[0].url // ""'
           )"
 
           if [ -z "$ci_url" ]; then
diff --git a/docs-site/src/content/docs/ja/reference/cli/providers-accounts.md b/docs-site/src/content/docs/ja/reference/cli/providers-accounts.md
index 7a8b43384..26876baca 100644
--- a/docs-site/src/content/docs/ja/reference/cli/providers-accounts.md
+++ b/docs-site/src/content/docs/ja/reference/cli/providers-accounts.md
@@ -185,6 +185,12 @@ ocx account main recover [--rollback --yes] [--json]
 
 v1 の復旧マトリクスが対象とするのは、トランザクションファイルの rename による公開後に OpenCodex プロセスが終了した場合です。OS またはカーネルのクラッシュや突然の電源断に対する永続性は保証しません。`atomicWriteFileAsync()` はファイルまたは親ディレクトリに `fsync` を実行しません。
 
+暗号化された vault、切り替えジャーナル、復旧マーカー、および journal-quarantine ファイルは、正規の `<real CODEX_HOME>/.opencodex-native-main-profiles` ディレクトリに保存されます。そのため、その Codex ホームを共有するすべての OpenCodex インスタンスは、同じ 1 つの所有者と同じ 1 つの復旧状態を参照します。平文のログインステージングは、各 `<OPENCODEX_HOME>/native-main-profile-staging` ディレクトリ配下にそれぞれ分離されたままです。
+
+native-main トラフィックまたはジャーナル復旧を受け入れる前に、ライフタイム所有者が資格情報に対する排他的な権利を取得し、名前が正確に `auth.json.ocx.<pid>.<sequence>.tmp` と一致するクラッシュ残留ファイルだけを削除します。各候補は、変更されていない正規の `CODEX_HOME` 配下にあり、ハードリンク数が 1 の通常ファイルであり続けなければなりません。その内容を切り詰め、フラッシュしてからリンクを解除します。リンクまたは再解析ポイントへのすり替え、ファイル識別情報の変化、その他の曖昧さがある場合は native-main トラフィックを引き続き拒否し、名前が似ているだけのファイルは自動的には決して削除しません。これは、協調動作する OpenCodex のクラッシュから保護するためのものであり、同じ OS ユーザーとしてすでに実行中の悪意あるプロセスから保護するものではありません。そのユーザーと `CODEX_HOME` を格納するファイルシステムは引き続き信頼対象であり、切り詰めによってコピーオンライト方式のストレージ、スナップショット、または SSD の残留データから物理的に消去されることは保証されません。
+
+プレビュー版では `<OPENCODEX_HOME>/native-main-profiles` を使用していました。このレイアウトが暗黙にインポートされることはありません。`doctor` が旧形式のプロファイル状態を報告した場合は、同じ `CODEX_HOME` を共有するすべての OpenCodex プロキシを停止してください。そのうえで、該当する `*.vault.json`、`*.journal.json`、復旧マーカー、および参照されている journal-quarantine ファイルをバックアップし、所有者だけがアクセスできる権限を維持したまま、すべて一緒に正規ディレクトリへ移動してください。別の方法として、古いプレビュー版の一式を削除し、`ocx account main register` を再度実行することもできます。同じ `CODEX_HOME` を共有するプロキシが 1 つでも稼働している間は、複数の旧ルートから 1 つを選ぶことも、両方のレイアウトを併用することも避けてください。Windows では、以前の大文字小文字を区別しないホーム識別子に紐付いたプレビュー状態は、移動せずリセットする必要があります。暗号化された AAD と OS キーリングの識別子は、意図的に再利用されないためです。
+
 ## モデル
 
 ### `ocx models [subcommand]`・`ocx model <subcommand>`
diff --git a/docs-site/src/content/docs/ko/reference/cli/providers-accounts.md b/docs-site/src/content/docs/ko/reference/cli/providers-accounts.md
index a806b553c..d1679cd46 100644
--- a/docs-site/src/content/docs/ko/reference/cli/providers-accounts.md
+++ b/docs-site/src/content/docs/ko/reference/cli/providers-accounts.md
@@ -185,6 +185,12 @@ ocx account main recover [--rollback --yes] [--json]
 
 v1 복구 매트릭스는 트랜잭션 파일이 rename으로 게시된 뒤 OpenCodex 프로세스가 종료되는 경우를 다룹니다. 운영 체제 또는 커널 충돌이나 갑작스러운 전원 손실에 대한 내구성은 보장하지 않습니다. `atomicWriteFileAsync()`는 파일이나 부모 디렉터리에 `fsync`를 수행하지 않습니다.
 
+암호화된 볼트, 전환 저널, 복구 마커 및 저널 격리 파일은 정규 `<real CODEX_HOME>/.opencodex-native-main-profiles` 디렉터리에 저장됩니다. 따라서 해당 Codex 홈을 공유하는 모든 OpenCodex 인스턴스는 동일한 단일 소유자와 단일 복구 상태를 관찰합니다. 평문 로그인 스테이징은 각 `<OPENCODEX_HOME>/native-main-profile-staging` 디렉터리 아래에 서로 분리된 채 유지됩니다.
+
+native-main 트래픽이나 저널 복구를 허용하기 전에 수명 주기 소유자가 자격 증명에 대한 배타적 점유권을 획득하고, 이름이 정확히 `auth.json.ocx.<pid>.<sequence>.tmp`인 충돌 잔여 파일만 제거합니다. 각 후보는 변경되지 않은 정규 `CODEX_HOME` 아래에서 하드 링크 수가 1인 일반 파일로 유지되어야 하며, 내용을 잘라내고 flush한 다음 unlink합니다. 링크나 재분석 지점(reparse point)으로의 바꿔치기, 파일 식별 정보 변경 또는 그 밖의 모호성이 있으면 native-main 트래픽은 계속 차단되며, 이름이 비슷할 뿐 정확히 일치하지 않는 파일은 자동으로 제거하지 않습니다. 이는 정상적으로 협력하는 OpenCodex 프로세스의 충돌을 방어하지만, 이미 같은 운영 체제 사용자로 실행 중인 악의적 프로세스까지 방어하지는 않습니다. 해당 사용자와 `CODEX_HOME`이 있는 파일 시스템은 계속 신뢰 대상으로 간주되며, 내용을 잘라내더라도 copy-on-write 저장소, 스냅샷 또는 SSD 잔류 데이터에서 물리적으로 지워진다고 보장할 수 없습니다.
+
+프리뷰 빌드는 `<OPENCODEX_HOME>/native-main-profiles`를 사용했습니다. 이 레이아웃은 절대로 자동으로 가져오지 않습니다. `doctor`가 레거시 프로필 상태를 보고하면 동일한 `CODEX_HOME`을 공유하는 모든 OpenCodex 프록시를 중지하십시오. 그런 다음 해당하는 `*.vault.json`, `*.journal.json`, 복구 마커 및 참조된 journal-quarantine 파일을 백업하고, 소유자 전용 권한을 유지한 채 모두 함께 정규 디렉터리로 옮기십시오. 또는 이전 프리뷰 파일 세트를 제거하고 `ocx account main register`를 다시 실행하십시오. 동일한 `CODEX_HOME`을 공유하는 프록시가 하나라도 실행 중인 동안에는 여러 이전 루트 중 하나를 선택하거나 두 레이아웃을 동시에 사용하지 마십시오. Windows에서는 이전의 대소문자를 구분하지 않는 홈 식별자를 키로 사용한 프리뷰 상태를 옮기지 말고 재설정해야 합니다. 암호화된 AAD와 운영 체제 키링 식별자는 의도적으로 재사용하지 않기 때문입니다.
+
 ## 모델
 
 ### `ocx models [subcommand]` · `ocx model <subcommand>`
diff --git a/docs-site/src/content/docs/ru/reference/cli/providers-accounts.md b/docs-site/src/content/docs/ru/reference/cli/providers-accounts.md
index 0120853bb..35d84e020 100644
--- a/docs-site/src/content/docs/ru/reference/cli/providers-accounts.md
+++ b/docs-site/src/content/docs/ru/reference/cli/providers-accounts.md
@@ -236,6 +236,12 @@ ocx account main recover [--rollback --yes] [--json]
 
 Матрица восстановления v1 охватывает завершение процесса OpenCodex после публикации файла транзакции переименованием. Она не заявляет устойчивость при сбое ОС или ядра либо внезапном отключении питания: `atomicWriteFileAsync()` не вызывает `fsync` ни для файла, ни для родительского каталога.
 
+Зашифрованное хранилище (vault), журнал переключения, маркер восстановления и файл карантина журнала находятся в каноническом каталоге `<real CODEX_HOME>/.opencodex-native-main-profiles`. Поэтому все экземпляры OpenCodex, использующие один и тот же Codex home, видят одного владельца и одно состояние восстановления. Промежуточные данные входа в незашифрованном виде остаются изолированными в каталоге `<OPENCODEX_HOME>/native-main-profile-staging` каждого экземпляра.
+
+До допуска трафика native-main или восстановления по журналу владелец на весь срок жизни получает исключительное право на учётные данные и удаляет только остаточные после сбоя файлы, имена которых точно соответствуют `auth.json.ocx.<pid>.<sequence>.tmp`. Каждый файл-кандидат должен оставаться обычным файлом ровно с одной жёсткой ссылкой внутри неизменившегося канонического `CODEX_HOME`; его усекают, сбрасывают его буферы, а затем удаляют ссылку на него (unlink). Подмена ссылкой или точкой повторной обработки (reparse point), изменение идентификационных данных файла или любая другая неоднозначность сохраняют запрет на трафик native-main; файлы с лишь похожими именами никогда не удаляются автоматически. Эта защита рассчитана на сбои добросовестно взаимодействующих экземпляров OpenCodex, а не на вредоносный процесс, уже запущенный от имени того же пользователя ОС. Этот пользователь и файловая система, содержащая `CODEX_HOME`, остаются доверенными, а усечение файла не гарантирует физического стирания данных из хранилища с копированием при записи, снимков или остаточных данных SSD.
+
+Предварительные сборки использовали `<OPENCODEX_HOME>/native-main-profiles`. Эта схема никогда не импортируется без явного действия. Если `doctor` сообщает о состоянии профилей старого формата, остановите все прокси OpenCodex, использующие тот же `CODEX_HOME`. Затем создайте резервную копию и вместе переместите соответствующие `*.vault.json`, `*.journal.json`, маркер восстановления и любой указанный файл карантина журнала в канонический каталог, сохранив права доступа только для владельца. Либо удалите старый набор файлов предварительной версии и снова выполните `ocx account main register`. Пока работает хотя бы один прокси, использующий тот же `CODEX_HOME`, не выбирайте один из нескольких старых корневых каталогов и не используйте обе схемы одновременно. В Windows состояние предварительной версии, привязанное к прежнему идентификатору домашнего каталога без учёта регистра, необходимо сбросить, а не перемещать, поскольку его зашифрованные AAD и идентификатор в системном хранилище ключей намеренно не используются повторно.
+
 ## Модели
 
 ### `ocx models [subcommand]` · `ocx model <subcommand>`
diff --git a/docs-site/src/content/docs/zh-cn/reference/cli/providers-accounts.md b/docs-site/src/content/docs/zh-cn/reference/cli/providers-accounts.md
index 328cd62b7..31446c048 100644
--- a/docs-site/src/content/docs/zh-cn/reference/cli/providers-accounts.md
+++ b/docs-site/src/content/docs/zh-cn/reference/cli/providers-accounts.md
@@ -218,6 +218,12 @@ ocx account main recover [--rollback --yes] [--json]
 
 v1 恢复矩阵覆盖的是事务文件通过重命名发布后 OpenCodex 进程退出的情况。它不声明能够在操作系统或内核崩溃、突然断电后持久保存：`atomicWriteFileAsync()` 不会对文件或父目录执行 `fsync`。
 
+加密保管库、切换日志、恢复标记和日志隔离文件位于规范的 `<real CODEX_HOME>/.opencodex-native-main-profiles` 目录中。因此，共用该 Codex 主目录的所有 OpenCodex 实例都会看到同一个所有者和同一份恢复状态。明文登录暂存数据仍分别隔离在各自的 `<OPENCODEX_HOME>/native-main-profile-staging` 目录下。
+
+在允许 native-main 流量或日志恢复之前，生命周期所有者会取得凭据的独占占用权，并且只删除名称与 `auth.json.ocx.<pid>.<sequence>.tmp` 完全匹配的崩溃残留文件。每个候选文件在整个过程中都必须位于未发生变化的规范 `CODEX_HOME` 下，并保持为硬链接计数为 1 的普通文件；系统会先将其截断，再刷新其内容，最后取消链接（unlink）。若发生链接或重解析点替换、文件标识发生变化或存在其他歧义，native-main 流量将继续保持关闭；名称仅近似匹配的文件绝不会被自动删除。这项防护针对正常协作的 OpenCodex 发生崩溃的情况，并不能抵御已经以同一操作系统用户身份运行的恶意进程。该用户以及承载 `CODEX_HOME` 的文件系统仍属于信任范围；截断文件也不保证从写时复制存储、快照或 SSD 残留数据中实现物理擦除。
+
+预览版使用 `<OPENCODEX_HOME>/native-main-profiles`。该布局绝不会被静默导入。如果 `doctor` 报告旧版配置文件状态，请停止所有共用同一 `CODEX_HOME` 的 OpenCodex 代理。然后，请先备份，并在保留仅所有者可访问权限的情况下，将相应的 `*.vault.json`、`*.journal.json`、恢复标记以及任何被引用的日志隔离文件一起移动到规范目录中；或者删除旧的预览版文件集，再次运行 `ocx account main register`。只要仍有任何共用该 `CODEX_HOME` 的代理正在运行，就不要在多个旧根目录之间选择其一，也不要同时使用两种布局。在 Windows 上，按以前不区分大小写的主目录标识索引的预览状态必须重置，而不能直接移动，因为其加密 AAD 和操作系统密钥环标识被有意设计为不再复用。
+
 ## 模型
 
 ### `ocx models [subcommand]` · `ocx model <subcommand>`
diff --git a/gui/bun.lock b/gui/bun.lock
index 1ed75c2ac..6b98430c1 100644
--- a/gui/bun.lock
+++ b/gui/bun.lock
@@ -26,6 +26,10 @@
       },
     },
   },
+  "overrides": {
+    "brace-expansion": "5.0.8",
+    "postcss": "8.5.18",
+  },
   "packages": {
     "@babel/code-frame": ["@babel/code-frame@7.29.7", "", { "dependencies": { "@babel/helper-validator-identifier": "^7.29.7", "js-tokens": "^4.0.0", "picocolors": "^1.1.1" } }, "sha512-Aup7aUOfpbAUg2ROOJN6Iw5f9DMBlzu0mIkm/malLQFN/YQgO48wCj0Kxa3sEHJvPVFg7siR+qRInwXd2qhQKw=="],
 
@@ -191,7 +195,7 @@
 
     "baseline-browser-mapping": ["baseline-browser-mapping@2.10.38", "", { "bin": { "baseline-browser-mapping": "dist/cli.cjs" } }, "sha512-31/02mVB4yuQU6adKk5SlY6m+mxDwUq5KZkyYgnLrrKl7TEm1+3PyDtDBz2kOv/wxZz41GHsvV1A/u6RmiyBvw=="],
 
-    "brace-expansion": ["brace-expansion@5.0.6", "", { "dependencies": { "balanced-match": "^4.0.2" } }, "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g=="],
+    "brace-expansion": ["brace-expansion@5.0.8", "", { "dependencies": { "balanced-match": "^4.0.2" } }, "sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg=="],
 
     "browserslist": ["browserslist@4.28.2", "", { "dependencies": { "baseline-browser-mapping": "^2.10.12", "caniuse-lite": "^1.0.30001782", "electron-to-chromium": "^1.5.328", "node-releases": "^2.0.36", "update-browserslist-db": "^1.2.3" }, "bin": { "browserslist": "cli.js" } }, "sha512-48xSriZYYg+8qXna9kwqjIVzuQxi+KYWp2+5nCYnYKPTr0LvD89Jqk2Or5ogxz0NUMfIjhh2lIUX/LyX9B4oIg=="],
 
@@ -347,7 +351,7 @@
 
     "picomatch": ["picomatch@4.0.4", "", {}, "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A=="],
 
-    "postcss": ["postcss@8.5.15", "", { "dependencies": { "nanoid": "^3.3.12", "picocolors": "^1.1.1", "source-map-js": "^1.2.1" } }, "sha512-FfR8sjd4em2T6fb3I2MwAJU7HWVMr9zba+enmQeeWFfCbm+UOC/0X4DS8XtpUTMwWMGbjKYP7xjfNekzyGmB3A=="],
+    "postcss": ["postcss@8.5.18", "", { "dependencies": { "nanoid": "^3.3.12", "picocolors": "^1.1.1", "source-map-js": "^1.2.1" } }, "sha512-xdB1oSLHbz1vRWgCDalrCqEFTWzFlhqFC5tIHLMOSUIjhm3XXQ1qrFy8S/ESr1JYRRXqM3c1QFiMZUJdUTqyMQ=="],
 
     "prelude-ls": ["prelude-ls@1.2.1", "", {}, "sha512-vkcDPrRZo1QZLbn5RLGPpg/WmIQ65qoWWhcGKf/b5eplkkarX0m9z8ppCat4mlOqUsWpyNuYgO3VRyrYHSzX5g=="],
 
diff --git a/gui/package.json b/gui/package.json
index 6655ff8ac..1417bd5b3 100644
--- a/gui/package.json
+++ b/gui/package.json
@@ -32,5 +32,9 @@
     "typescript": "~6.0.2",
     "typescript-eslint": "^8.59.2",
     "vite": "^8.1.0"
+  },
+  "overrides": {
+    "brace-expansion": "5.0.8",
+    "postcss": "8.5.18"
   }
 }
diff --git a/package.json b/package.json
index 2879e58e8..32d7b7a98 100644
--- a/package.json
+++ b/package.json
@@ -39,7 +39,7 @@
     "start": "bun run src/cli/index.ts start",
     "test": "bun scripts/test.ts",
     "typecheck": "bun x tsc --noEmit",
-    "audit:high": "bun audit --audit-level=high",
+    "audit:high": "bun audit --audit-level=high && cd gui && bun audit --audit-level=high",
     "privacy:scan": "bun scripts/privacy-scan.ts",
     "generate:jawcode-metadata": "bun scripts/generate-jawcode-metadata.ts",
     "build:gui": "cd gui && bun install --frozen-lockfile && bun run build && cd .. && bun run prepare:package",
diff --git a/scripts/keyring-smoke.ts b/scripts/keyring-smoke.ts
index cf49dd7cf..113588745 100644
--- a/scripts/keyring-smoke.ts
+++ b/scripts/keyring-smoke.ts
@@ -29,6 +29,7 @@ export async function runKeyringSmoke({
   const account = `ci-${createId()}`;
   const secret = createRandomBytes(32);
   let entry: KeyringSmokeEntry | null = null;
+  let readback: Uint8Array | null = null;
   let stored: Buffer | null = null;
   let operationFailed = false;
   let operationError: unknown;
@@ -36,7 +37,7 @@ export async function runKeyringSmoke({
   try {
     entry = await createEntry(service, account);
     await entry.setSecret(secret, AbortSignal.timeout(timeoutMs));
-    const readback = await entry.getSecret(AbortSignal.timeout(timeoutMs));
+    readback = await entry.getSecret(AbortSignal.timeout(timeoutMs));
     stored = readback ? Buffer.from(readback) : null;
     if (!stored || stored.byteLength !== secret.byteLength || !timingSafeEqual(stored, secret)) {
       throw new Error("OS keyring smoke readback did not match the stored value.");
@@ -59,6 +60,7 @@ export async function runKeyringSmoke({
     }
   }
 
+  readback?.fill(0);
   stored?.fill(0);
   secret.fill(0);
 
@@ -66,6 +68,7 @@ export async function runKeyringSmoke({
     if (cleanupFailed && operationError instanceof Error) {
       Object.defineProperty(operationError, "cleanupError", {
         configurable: true,
+        enumerable: true,
         value: cleanupError,
       });
     }
diff --git a/scripts/release.ts b/scripts/release.ts
index 20d59e7a1..e4c78199d 100644
--- a/scripts/release.ts
+++ b/scripts/release.ts
@@ -299,7 +299,7 @@ const packageName = await readPackageName();
 console.log(`→ release metadata preflight (${packageName}@${version})`);
 await assertUnusedReleaseVersion(packageName, version);
 console.log("→ dependency audit");
-await runLoud(["bun", "audit", "--audit-level=high"]);
+await runLoud(["bun", "run", "audit:high"]);
 console.log("→ typecheck");
 await runLoud(["bun", "x", "tsc", "--noEmit"]);
 console.log("→ test suite");
diff --git a/src/cli/account-api.ts b/src/cli/account-api.ts
index 916833be4..a03b29e1f 100644
--- a/src/cli/account-api.ts
+++ b/src/cli/account-api.ts
@@ -33,6 +33,12 @@ export interface NativeMainLoginChild {
   kill(signal?: number | NodeJS.Signals): void;
 }
 
+export interface StageLeaseClock {
+  now(): number;
+  setTimeout(callback: () => void, ms: number): ReturnType<typeof setTimeout>;
+  clearTimeout(timer: ReturnType<typeof setTimeout>): void;
+}
+
 export interface AccountDeps {
   /** Test injection: skip findLiveProxy and call the API at this base URL. */
   baseUrl?: string;
@@ -46,6 +52,8 @@ export interface AccountDeps {
   runCodexLoginImpl?: (codexHome: string) => Promise<number>;
   /** Test-only heartbeat cadence floor. Production keeps the five-second floor. */
   stageHeartbeatIntervalMinMs?: number;
+  /** Test-only clock for deterministic native-profile lease deadline coverage. */
+  stageLeaseClock?: StageLeaseClock;
 }
 
 export function classifyAccount(config: OcxConfig, name: string): ClassifyResult {
diff --git a/src/cli/account-main.ts b/src/cli/account-main.ts
index 0b29d7b5f..2741a51aa 100644
--- a/src/cli/account-main.ts
+++ b/src/cli/account-main.ts
@@ -9,6 +9,7 @@ import {
   resolveBaseUrl,
   type AccountDeps,
   type NativeMainLoginChild,
+  type StageLeaseClock,
 } from "./account-api";
 
 const USAGE = `Usage:
@@ -22,6 +23,14 @@ const USAGE = `Usage:
 Native main login profiles change the physical Codex App/CLI login in the effective CODEX_HOME.
 They are independent from the OpenCodex Pool selected by 'ocx account use openai'.`;
 
+const STAGE_LEASE_SAFETY_MARGIN_MS = 30_000;
+
+const systemStageLeaseClock: StageLeaseClock = {
+  now: Date.now,
+  setTimeout: (callback, ms) => setTimeout(callback, ms),
+  clearTimeout: timer => clearTimeout(timer),
+};
+
 interface PublicProfile {
   id: string;
   label: string;
@@ -89,13 +98,13 @@ function spawnOfficialCodexLogin(codexHome: string): NativeMainLoginChild {
   return child;
 }
 
-function abortableDelay(ms: number, signal: AbortSignal): Promise<void> {
+function abortableDelay(ms: number, signal: AbortSignal, clock: StageLeaseClock): Promise<void> {
   if (signal.aborted) return Promise.resolve();
   return new Promise(resolve => {
-    const timer = setTimeout(done, ms);
+    const timer = clock.setTimeout(done, ms);
     signal.addEventListener("abort", done, { once: true });
     function done(): void {
-      clearTimeout(timer);
+      clock.clearTimeout(timer);
       signal.removeEventListener("abort", done);
       resolve();
     }
@@ -111,26 +120,57 @@ async function maintainStageLease(
   heartbeatIntervalMs: number,
   child: NativeMainLoginChild,
   signal: AbortSignal,
+  clock: StageLeaseClock,
 ): Promise<{ lost: boolean }> {
   let leaseExpiresAt = initialLeaseExpiresAt;
   for (;;) {
     if (signal.aborted) return { lost: false };
-    const heartbeat = await apiJson(
+    const deadlineAt = leaseExpiresAt - STAGE_LEASE_SAFETY_MARGIN_MS;
+    if (clock.now() >= deadlineAt) {
+      try { child.kill(); } catch { /* child exit below is authoritative */ }
+      return { lost: true };
+    }
+
+    const heartbeatAbort = new AbortController();
+    const deadlineReached = Symbol("heartbeat-deadline");
+    const parentCancelled = Symbol("heartbeat-parent-cancelled");
+    let resolveInterruption!: (result: typeof deadlineReached | typeof parentCancelled) => void;
+    const interruption = new Promise<typeof deadlineReached | typeof parentCancelled>(resolve => {
+      resolveInterruption = resolve;
+    });
+    const cancelHeartbeat = () => {
+      heartbeatAbort.abort();
+      resolveInterruption(parentCancelled);
+    };
+    signal.addEventListener("abort", cancelHeartbeat, { once: true });
+    const deadlineTimer = clock.setTimeout(() => {
+      heartbeatAbort.abort();
+      resolveInterruption(deadlineReached);
+    }, Math.max(0, deadlineAt - clock.now()));
+    const heartbeatRequest = apiJson(
       deps,
       baseUrl,
       "POST",
       "/api/native-main-profiles/stage/heartbeat",
       { stageId, writerToken },
-      { signal },
+      { signal: heartbeatAbort.signal },
     );
+    const heartbeat = await Promise.race([heartbeatRequest, interruption]);
+    clock.clearTimeout(deadlineTimer);
+    signal.removeEventListener("abort", cancelHeartbeat);
     if (signal.aborted) return { lost: false };
+    if (heartbeat === parentCancelled) return { lost: false };
+    if (heartbeat === deadlineReached) {
+      try { child.kill(); } catch { /* child exit below is authoritative */ }
+      return { lost: true };
+    }
     if (heartbeat.status === 200 && typeof heartbeat.json.leaseExpiresAt === "number") {
       leaseExpiresAt = heartbeat.json.leaseExpiresAt;
-      await abortableDelay(heartbeatIntervalMs, signal);
+      await abortableDelay(Math.min(heartbeatIntervalMs, Math.max(0, leaseExpiresAt - STAGE_LEASE_SAFETY_MARGIN_MS - clock.now())), signal, clock);
       continue;
     }
-    if (heartbeat.status === 0 && Date.now() < leaseExpiresAt - 30_000) {
-      await abortableDelay(Math.min(5_000, heartbeatIntervalMs), signal);
+    if (heartbeat.status === 0 && clock.now() < leaseExpiresAt - STAGE_LEASE_SAFETY_MARGIN_MS) {
+      await abortableDelay(Math.min(5_000, heartbeatIntervalMs, leaseExpiresAt - STAGE_LEASE_SAFETY_MARGIN_MS - clock.now()), signal, clock);
       continue;
     }
     try { child.kill(); } catch { /* child exit below is authoritative */ }
@@ -181,12 +221,13 @@ export async function cmdNativeMainAccount(args: string[], deps: AccountDeps): P
     const heartbeatIntervalMs = typeof stage.json.heartbeatIntervalMs === "number"
       ? Math.min(5 * 60_000, Math.max(deps.stageHeartbeatIntervalMinMs ?? 5_000, stage.json.heartbeatIntervalMs))
       : 60_000;
+    const stageLeaseClock = deps.stageLeaseClock ?? systemStageLeaseClock;
     const stagedEffectiveHome = effectiveCodexHome(stage.json);
     let exitCode = 1;
     let finished = false;
     let leaseLost = false;
     try {
-      if (!stageId || !writerToken || !isAbsolute(stagingHome) || leaseExpiresAt <= Date.now()) {
+      if (!stageId || !writerToken || !isAbsolute(stagingHome) || leaseExpiresAt <= stageLeaseClock.now()) {
         throw new Error("The proxy returned an invalid staging session.");
       }
       console.error(`Effective CODEX_HOME: ${stagedEffectiveHome}`);
@@ -206,6 +247,7 @@ export async function cmdNativeMainAccount(args: string[], deps: AccountDeps): P
         heartbeatIntervalMs,
         child,
         heartbeatAbort.signal,
+        stageLeaseClock,
       );
       try {
         exitCode = await child.exited;
diff --git a/tests/ci-workflows.test.ts b/tests/ci-workflows.test.ts
index 20c0ca5c9..62fa074f6 100644
--- a/tests/ci-workflows.test.ts
+++ b/tests/ci-workflows.test.ts
@@ -415,13 +415,42 @@ describe("GitHub Actions hardening", () => {
       "id-token": "write",
     });
     expect(release.jobs?.publish?.["runs-on"]).toBe("ubuntu-latest");
-    expectSecureLinuxKeyringBootstrap(workflow);
     expect(workflow).toContain("actions: read");
     expect(workflow).toContain("pull-requests: read");
     expect(workflow).toContain("id-token: write");
     expect(workflow).toContain("cancel-in-progress: false");
     expect(workflow).toContain("timeout-minutes: 15");
 
+    // The exact-SHA CI gate already includes the three hosted keyring legs. The
+    // release workflow must not duplicate the Linux bootstrap and drift from CI.
+    expect(workflow).not.toContain("- name: OS keyring create/read/delete smoke");
+    expect(workflow).not.toContain("gnome-keyring-daemon");
+
+    // Root and GUI dependency trees share one audit definition across local and
+    // workflow release paths.
+    const packageJson = JSON.parse(await readText("package.json")) as {
+      scripts?: Record<string, string>;
+    };
+    expect(packageJson.scripts?.["audit:high"]).toBe(
+      "bun audit --audit-level=high && cd gui && bun audit --audit-level=high",
+    );
+    expect(workflow).toContain("run: bun run audit:high");
+    expect(workflow).not.toContain("run: bun audit --audit-level=high");
+
+    // gh embeds a jq expression but does not expose jq's --arg flag. Keep the
+    // branch and event filters on gh's native, documented flag surface.
+    const ciLookup = workflow.split('ci_url="$(')[1]?.split('\n          )"')[0];
+    expect(ciLookup).toBeDefined();
+    expect(ciLookup).toContain("--workflow ci.yml");
+    expect(ciLookup).toContain('--branch "${GITHUB_REF#refs/heads/}"');
+    expect(ciLookup).toContain('--commit "$GITHUB_SHA"');
+    expect(ciLookup).toContain("--event push");
+    expect(ciLookup).toContain("--status success");
+    expect(ciLookup).toContain("--json url");
+    expect(ciLookup).toContain("--jq '.[0].url // \"\"'");
+    expect(ciLookup).not.toContain("--arg");
+    expect(ciLookup).not.toContain("$branch");
+
     // Dry-run first by default; tokenless trusted publishing only.
     expect(workflow).toMatch(/dry-run:[\s\S]*?default: true/);
     expect(workflow).not.toContain("secrets.NPM_TOKEN");
diff --git a/tests/cli-native-profile.test.ts b/tests/cli-native-profile.test.ts
index 9b1a63afd..8f37cd367 100644
--- a/tests/cli-native-profile.test.ts
+++ b/tests/cli-native-profile.test.ts
@@ -328,4 +328,83 @@ describe("ocx account main", () => {
       label: "work",
     });
   });
+
+  test("a stalled heartbeat is aborted before lease expiry, kills login, and cancels staging", async () => {
+    const stagingHome = join(tmpdir(), "ocx-native-profile-stage-heartbeat-deadline");
+    const requests: string[] = [];
+    let now = 10_000;
+    const leaseExpiresAt = now + 60_000;
+    let deadlineCallback!: () => void;
+    let scheduledDeadlineMs = -1;
+    let deadlineCleared = false;
+    const timerHandle = {} as ReturnType<typeof setTimeout>;
+    const stageLeaseClock = {
+      now: () => now,
+      setTimeout: (callback: () => void, ms: number) => {
+        deadlineCallback = callback;
+        scheduledDeadlineMs = ms;
+        return timerHandle;
+      },
+      clearTimeout: (timer: ReturnType<typeof setTimeout>) => {
+        expect(timer).toBe(timerHandle);
+        deadlineCleared = true;
+      },
+    };
+    let heartbeatSignal: AbortSignal | undefined;
+    let resolveHeartbeatStarted!: () => void;
+    const heartbeatStarted = new Promise<void>(resolve => { resolveHeartbeatStarted = resolve; });
+    let resolveExit!: (code: number) => void;
+    const exited = new Promise<number>(resolve => { resolveExit = resolve; });
+    let killCount = 0;
+    const fetchImpl: typeof fetch = async (input, init) => {
+      const path = new URL(String(input)).pathname;
+      requests.push(path);
+      if (path.endsWith("/stage") && !path.endsWith("/finish")) {
+        return Response.json({
+          stageId: "66666666-6666-4666-8666-666666666666",
+          writerToken: "writer-token-heartbeat-deadline-11111111111111111111",
+          stagingCodexHome: stagingHome,
+          leaseExpiresAt,
+          heartbeatIntervalMs: 10,
+        });
+      }
+      if (path.endsWith("/stage/heartbeat")) {
+        heartbeatSignal = init?.signal ?? undefined;
+        resolveHeartbeatStarted();
+        return new Promise<Response>(() => {});
+      }
+      if (path.endsWith("/stage/cancel")) {
+        return Response.json({ ok: true, removed: true, plaintextMayRemain: false });
+      }
+      throw new Error(`Unexpected request: ${path}`);
+    };
+
+    const running = cmdAccount(["main", "add", "work"], {
+      baseUrl: "http://127.0.0.1:10100",
+      fetchImpl,
+      stageHeartbeatIntervalMinMs: 10,
+      stageLeaseClock,
+      spawnCodexLoginImpl: () => ({
+        exited,
+        kill: () => {
+          killCount += 1;
+          resolveExit(1);
+        },
+      }),
+    });
+    await heartbeatStarted;
+    expect(scheduledDeadlineMs).toBe(30_000);
+    now = leaseExpiresAt - 30_000;
+    deadlineCallback();
+
+    expect(await running).toBe(1);
+    expect(deadlineCleared).toBeTrue();
+    expect(killCount).toBe(1);
+    expect(heartbeatSignal?.aborted).toBeTrue();
+    expect(requests).toEqual([
+      "/api/native-main-profiles/stage",
+      "/api/native-main-profiles/stage/heartbeat",
+      "/api/native-main-profiles/stage/cancel",
+    ]);
+  });
 });
diff --git a/tests/keyring-smoke.test.ts b/tests/keyring-smoke.test.ts
index 30efa122c..580ea4631 100644
--- a/tests/keyring-smoke.test.ts
+++ b/tests/keyring-smoke.test.ts
@@ -55,6 +55,20 @@ describe("runKeyringSmoke", () => {
     expect(entry.secret).toBeNull();
   });
 
+  test("zeros the buffer returned by the keyring", async () => {
+    const entry = new MemoryKeyringEntry();
+    const readback = Buffer.alloc(32, 0x5a);
+    entry.getSecret = async () => readback;
+
+    await runKeyringSmoke({
+      createEntry: async () => entry,
+      createRandomBytes: (size) => Buffer.alloc(size, 0x5a),
+      createId: () => "test-id",
+    });
+
+    expect(readback.equals(Buffer.alloc(32))).toBe(true);
+  });
+
   test("preserves a readback error when deletion returns false", async () => {
     const entry = new MemoryKeyringEntry();
     const generated = Buffer.alloc(32, 0x5a);
@@ -73,6 +87,8 @@ describe("runKeyringSmoke", () => {
     expect(error).toBeInstanceOf(Error);
     expect((error as Error).message).toContain("readback did not match");
     expect((error as Error & { cleanupError?: unknown }).cleanupError).toBeInstanceOf(Error);
+    expect(Object.keys(error as Error)).toContain("cleanupError");
+    expect(Bun.inspect(error)).toContain("could not delete the temporary entry");
     expect(entry.deletes).toBe(1);
     expect(generated.equals(Buffer.alloc(32))).toBe(true);
   });
diff --git a/tests/release-helper.test.ts b/tests/release-helper.test.ts
index f2370b330..8f2a58e73 100644
--- a/tests/release-helper.test.ts
+++ b/tests/release-helper.test.ts
@@ -226,7 +226,7 @@ function runRelease(version: string, scenario: ReleaseScenario = {}) {
 }
 
 describe("release helper", () => {
-  test("preflight runs typecheck, test suite, and privacy scan before version bump on main dry-runs", () => {
+  test("preflight runs the shared audit, typecheck, test suite, and privacy scan before version bump", () => {
     const { calls, result } = runRelease("9.9.9");
 
     // Report what the script actually said. A bare status assertion turned a
@@ -234,6 +234,7 @@ describe("release helper", () => {
     // which cost a full CI round to diagnose.
     expect(`${result.status}\n${result.stderr ?? ""}`.trim()).toBe("0");
 
+    const auditIndex = findCallIndex(calls, "bun", call => call.args.join(" ") === "run audit:high");
     const typecheckIndex = findCallIndex(calls, "bun", call => call.args.join(" ") === "x tsc --noEmit");
     const testIndex = findCallIndex(calls, "bun", call => call.args.join(" ") === "test --isolate tests");
     const privacyIndex = findCallIndex(calls, "bun", call => call.args.join(" ") === "run privacy:scan");
@@ -246,7 +247,8 @@ describe("release helper", () => {
       && call.args.includes("dry-run=true"),
     );
 
-    expect(typecheckIndex).toBeGreaterThanOrEqual(0);
+    expect(auditIndex).toBeGreaterThanOrEqual(0);
+    expect(typecheckIndex).toBeGreaterThan(auditIndex);
     expect(testIndex).toBeGreaterThan(typecheckIndex);
     expect(privacyIndex).toBeGreaterThan(testIndex);
     expect(versionIndex).toBeGreaterThan(privacyIndex);

From 7e6bcc1e81202160b32a99d23002faf2e93a7aaf Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Tue, 4 Aug 2026 02:31:48 +0900
Subject: [PATCH 62/63] fix(gui): update brace-expansion security override

---
 gui/bun.lock     | 4 ++--
 gui/package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/gui/bun.lock b/gui/bun.lock
index 6b98430c1..1c7e030ba 100644
--- a/gui/bun.lock
+++ b/gui/bun.lock
@@ -27,7 +27,7 @@
     },
   },
   "overrides": {
-    "brace-expansion": "5.0.8",
+    "brace-expansion": "5.0.9",
     "postcss": "8.5.18",
   },
   "packages": {
@@ -195,7 +195,7 @@
 
     "baseline-browser-mapping": ["baseline-browser-mapping@2.10.38", "", { "bin": { "baseline-browser-mapping": "dist/cli.cjs" } }, "sha512-31/02mVB4yuQU6adKk5SlY6m+mxDwUq5KZkyYgnLrrKl7TEm1+3PyDtDBz2kOv/wxZz41GHsvV1A/u6RmiyBvw=="],
 
-    "brace-expansion": ["brace-expansion@5.0.8", "", { "dependencies": { "balanced-match": "^4.0.2" } }, "sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg=="],
+    "brace-expansion": ["brace-expansion@5.0.9", "", { "dependencies": { "balanced-match": "^4.0.2" } }, "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg=="],
 
     "browserslist": ["browserslist@4.28.2", "", { "dependencies": { "baseline-browser-mapping": "^2.10.12", "caniuse-lite": "^1.0.30001782", "electron-to-chromium": "^1.5.328", "node-releases": "^2.0.36", "update-browserslist-db": "^1.2.3" }, "bin": { "browserslist": "cli.js" } }, "sha512-48xSriZYYg+8qXna9kwqjIVzuQxi+KYWp2+5nCYnYKPTr0LvD89Jqk2Or5ogxz0NUMfIjhh2lIUX/LyX9B4oIg=="],
 
diff --git a/gui/package.json b/gui/package.json
index 1417bd5b3..1556402dc 100644
--- a/gui/package.json
+++ b/gui/package.json
@@ -34,7 +34,7 @@
     "vite": "^8.1.0"
   },
   "overrides": {
-    "brace-expansion": "5.0.8",
+    "brace-expansion": "5.0.9",
     "postcss": "8.5.18"
   }
 }

From 2736ae11419aa05cb488a5c8b6efbd6c0b0f26ae Mon Sep 17 00:00:00 2001
From: luvs01 <27862058+luvs01@users.noreply.github.com>
Date: Tue, 4 Aug 2026 03:07:00 +0900
Subject: [PATCH 63/63] fix(native-main): address latest review feedback

---
 src/providers/quota.ts       |  8 ++++----
 tests/keyring-smoke.test.ts  |  7 +++++--
 tests/provider-quota.test.ts | 32 +++++++++++++++++++++++++++++++-
 3 files changed, 40 insertions(+), 7 deletions(-)

diff --git a/src/providers/quota.ts b/src/providers/quota.ts
index b7989df4f..8e0228ec6 100644
--- a/src/providers/quota.ts
+++ b/src/providers/quota.ts
@@ -1102,10 +1102,10 @@ async function maybeFetchProviderQuota(
 }
 
 export async function fetchProviderQuotaReports(config: OcxConfig, forceRefresh = false): Promise<ProviderQuotaResponse> {
-  // A forced Pool refresh must share one account-list probe between the pre-signature and
-  // provider fetch. The commit-time signature still re-reads current state to reject races.
-  const prefetchedCodexSnapshot = forceRefresh && hasCodexPoolProvider(config)
-    ? listCodexAuthAccountsSnapshot(config, true)
+  // A Pool report's cache signature and provider fetch must share one account snapshot.
+  // Preserve force semantics when deciding whether that snapshot refreshes upstream data.
+  const prefetchedCodexSnapshot = hasCodexPoolProvider(config)
+    ? listCodexAuthAccountsSnapshot(config, forceRefresh)
     : undefined;
   const keyCandidate = cacheKeyWithAggregationState(config, prefetchedCodexSnapshot);
   const key = typeof keyCandidate === "string" ? keyCandidate : await keyCandidate;
diff --git a/tests/keyring-smoke.test.ts b/tests/keyring-smoke.test.ts
index 580ea4631..5f2cf7b5a 100644
--- a/tests/keyring-smoke.test.ts
+++ b/tests/keyring-smoke.test.ts
@@ -58,15 +58,17 @@ describe("runKeyringSmoke", () => {
   test("zeros the buffer returned by the keyring", async () => {
     const entry = new MemoryKeyringEntry();
     const readback = Buffer.alloc(32, 0x5a);
+    const generated = Buffer.alloc(32, 0x5a);
     entry.getSecret = async () => readback;
 
     await runKeyringSmoke({
       createEntry: async () => entry,
-      createRandomBytes: (size) => Buffer.alloc(size, 0x5a),
+      createRandomBytes: () => generated,
       createId: () => "test-id",
     });
 
     expect(readback.equals(Buffer.alloc(32))).toBe(true);
+    expect(generated.equals(Buffer.alloc(32))).toBe(true);
   });
 
   test("preserves a readback error when deletion returns false", async () => {
@@ -88,7 +90,8 @@ describe("runKeyringSmoke", () => {
     expect((error as Error).message).toContain("readback did not match");
     expect((error as Error & { cleanupError?: unknown }).cleanupError).toBeInstanceOf(Error);
     expect(Object.keys(error as Error)).toContain("cleanupError");
-    expect(Bun.inspect(error)).toContain("could not delete the temporary entry");
+    expect((error as Error & { cleanupError: Error }).cleanupError.message)
+      .toContain("could not delete the temporary entry");
     expect(entry.deletes).toBe(1);
     expect(generated.equals(Buffer.alloc(32))).toBe(true);
   });
diff --git a/tests/provider-quota.test.ts b/tests/provider-quota.test.ts
index 106703b81..da77da257 100644
--- a/tests/provider-quota.test.ts
+++ b/tests/provider-quota.test.ts
@@ -1,7 +1,8 @@
-import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { afterEach, beforeEach, describe, expect, spyOn, test } from "bun:test";
 import { existsSync, mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
+import * as authApi from "../src/codex/auth-api";
 import { clearAccountNeedsReauth, markAccountNeedsReauth } from "../src/codex/account-runtime-state";
 import { clearMainAccountInfoCache } from "../src/codex/main-account-cache";
 import { clearAccountQuota, updateAccountQuota } from "../src/codex/quota";
@@ -544,6 +545,35 @@ describe("fetchProviderQuotaReports", () => {
     expect(calls).toEqual(new Map([["chatgpt-main-account", 1], ["added-chatgpt-id", 1]]));
   });
 
+  test("one non-forced Pool refresh shares its probe snapshot before the commit recheck", async () => {
+    saveCodexAccountCredential("added", {
+      accessToken: "added-access", refreshToken: "added-refresh",
+      expiresAt: Date.now() + 3600_000, chatgptAccountId: "added-chatgpt-id",
+    });
+    const config = testConfig();
+    config.providers = { openai: config.providers.openai };
+    config.codexAccounts = [{ id: "added", email: "a@example.test", plan: "prolite", isMain: false }];
+    globalThis.fetch = (async (_input: RequestInfo | URL, init?: RequestInit) => {
+      const accountId = (init?.headers as Record<string, string> | undefined)?.["ChatGPT-Account-Id"];
+      return new Response(JSON.stringify({
+        plan_type: accountId === "added-chatgpt-id" ? "prolite" : "plus",
+        rate_limit: { secondary_window: { used_percent: 25, reset_at: 1_999_000_000 } },
+      }), { status: 200, headers: { "content-type": "application/json" } });
+    }) as typeof fetch;
+
+    const snapshotSpy = spyOn(authApi, "listCodexAuthAccountsSnapshot");
+    try {
+      await fetchProviderQuotaReports(config);
+
+      // The cache-key and provider phases share call 1; call 2 is the intentional
+      // post-probe commit-key recheck. Before the fix there were 3 calls.
+      expect(snapshotSpy).toHaveBeenCalledTimes(2);
+      expect(snapshotSpy.mock.calls.map(call => call[1] ?? false)).toEqual([false, false]);
+    } finally {
+      snapshotSpy.mockRestore();
+    }
+  });
+
   test("all-excluded pool still returns a coverage-only OpenAI report", async () => {
     rmSync(join(codexHome, "auth.json"), { force: true });
     clearMainAccountInfoCache();