diff --git a/.gitignore b/.gitignore
index d073e9d902..82fb882004 100644
--- a/.gitignore
+++ b/.gitignore
@@ -36,6 +36,9 @@ devlog/**/security-advisory-draft*
 .omo/
 **/.omo/
 
+# Local development worktrees
+.worktrees/
+
 # Test-generated artifacts
 tests/.tmp-*/
 .claude/
diff --git a/README.md b/README.md
index 044828741d..d618790973 100644
--- a/README.md
+++ b/README.md
@@ -60,6 +60,14 @@ ocx start                            # or `ocx service` to run it in the backgro
 Open **http://localhost:10100** and configure everything in the web dashboard — add providers
 (40+ built-ins, or any OpenAI-compatible endpoint), pick models, manage accounts. `ocx gui`
 re-opens the dashboard at any time.
+It can also manage a **ChatGPT account pool** for Codex auth. Add multiple ChatGPT / Codex accounts,
+refresh their 5h / weekly / 30d quota in the dashboard. Under quota routing, new sessions can use
+the lowest-usage healthy account; round-robin and fill-first use their own policies. Existing Codex
+threads normally retain affinity to the account that started them, so long SSH, tmux, or
+mobile-connected sessions do not jump accounts mid-conversation — but quota re-evaluation, failover,
+account exclusion, affinity expiry, or 401/403 and 429 recovery can rebind them. Give the accounts a
+selection order when one of them — usually your Codex Desktop login — should only be reached for
+once the others are drained.
 
 ### For agents
 
diff --git a/assets/pr715-selection-order.png b/assets/pr715-selection-order.png
new file mode 100644
index 0000000000..7d178d3739
Binary files /dev/null and b/assets/pr715-selection-order.png differ
diff --git a/docs-site/src/content/docs/guides/web-dashboard.md b/docs-site/src/content/docs/guides/web-dashboard.md
index 660fbcfdac..4ad5fd7c79 100644
--- a/docs-site/src/content/docs/guides/web-dashboard.md
+++ b/docs-site/src/content/docs/guides/web-dashboard.md
@@ -105,8 +105,21 @@ catalog entry.
 
 The **Codex Auth** page manages the native ChatGPT/Codex route:
 
-- Manually choosing an account changes the next new Codex session; an already-bound thread keeps its
-  current account for that manual switch.
+Pool mode selects across the main and added Codex accounts; Direct uses only the caller/main login.
+In-flight requests keep their captured credentials, and a 401/403 reauthentication or 429 cooldown
+may clear affinity and rotate to another eligible Pool account. This is separate from `openai-apikey`
+and other providers.
+
+- Manually choosing an account applies immediately: an already-bound thread moves to it on its next
+  request, and only requests already in flight keep the account they captured. A manual choice is also
+  pinned: the card shows a **PINNED** badge, and a higher selection order cannot preempt that account
+  until it is drained, you select another account, or you change any account's selection order.
+- Each account card carries a **Selection order** control (First, Earlier, Normal, Later, Last).
+  Higher order is used first, and the pool drops to a lower order only once every account above it is
+  drained or unavailable. A changed order applies from the next unbound request and never moves a
+  thread that is already bound. The Codex Desktop (main) account is ordered like any other, so it can
+  be set to **Last** and kept as the reserve. An order set from `ocx account priority` outside those
+  five presets stays visible and selectable on the card.
 - Thread affinity prevents per-request flapping. With quota auto-switch enabled, a long-running
   thread is periodically re-evaluated and may rebind after its relevant usage reaches the threshold
   and a strictly lower-usage eligible account exists.
@@ -170,6 +183,7 @@ The GUI is a thin client over the proxy's JSON management API. Useful endpoints
 | `POST /api/oauth/login` · `GET /api/oauth/status` | Start a provider OAuth flow and poll for completion. |
 | `GET /api/codex-auth/accounts?refresh=1` | List main and pool accounts, force quota refresh, and report main-account `hasCredential` / terminal `needsReauth` state. |
 | `PUT /api/codex-auth/active` · `PUT /api/codex-auth/auto-switch` · `PUT /api/codex-auth/failover` | Select the account for the next request and configure pool routing. |
+| `GET /api/codex-auth/active` · `PUT /api/codex-auth/accounts/priority` | Read the effective account (including `pinned` and which account is `pinnedAccountId`) and set one account's selection order. |
 | `POST /api/codex-auth/login` · `GET /api/codex-auth/login-status` | Add a pool account through browser login. |
 | `GET /api/logs?tail=50&limit=20&offset=0&provider=...&status=5xx` | Read recent request metadata with optional tail, provider, and exact/class status filters. With `limit`/`offset`, paging walks backward from the newest row (`offset=0` returns the latest page). Response shape: `{ timeZone, total, logs }` where `total` is the filtered row count before pagination. |
 | `GET` / `PUT /api/subagent-models` | Read or set the five featured `spawn_agent` override models. |
diff --git a/docs-site/src/content/docs/ja/guides/web-dashboard.md b/docs-site/src/content/docs/ja/guides/web-dashboard.md
index 5dd87b4bdd..955b9cad51 100644
--- a/docs-site/src/content/docs/ja/guides/web-dashboard.md
+++ b/docs-site/src/content/docs/ja/guides/web-dashboard.md
@@ -89,8 +89,18 @@ Codex タスクだけに適用され、このオプション自体が委任を
 
 **Codex 認証**ページはネイティブ ChatGPT/Codex ルートを管理します。
 
-- アカウントを直接選ぶと次の新規 Codex セッションから変わります。すでにアカウントが紐付いた thread はこの手動切り替えだけでは
-  途中で移動しません。
+プールモードはメインと追加した Codex アカウントを横断して選択します。Direct は呼び出し元またはメインのログインのみを使います。送信中のリクエストは取得済みの資格情報を維持し、401/403 の再認証や 429 の cooldown が affinity を解除して別の適格なプールアカウントへ切り替えることがあります。これは `openai-apikey` や他のプロバイダーとは別の仕組みです。
+
+- アカウントを直接選ぶとすぐに反映されます。すでにアカウントが紐付いた thread も次のリクエストで選んだ
+  アカウントに移り、すでに送信中のリクエストだけが取得済みのアカウントを使い続けます。手動で選んだアカウントは固定もされます。
+  カードに **固定中** バッジが付き、そのアカウントが使い切られるか、別のアカウントを選ぶか、いずれかの
+  アカウントの選択順序を変更するまで、より上位の選択順序が割り込むことはありません。
+- 各アカウントカードには **選択順序** のコントロール（最初 / 早め / 標準 / 遅め / 最後）があります。
+  順序が上のものから使われ、その上にあるアカウントがすべて使い切られるか利用できなくなって初めて
+  下の順序へ下がります。順序を変更すると **次の未バインドリクエスト** から適用され、すでにアカウントに
+  紐づいた thread を移動させることはありません。Codex Desktop（メイン）アカウントも同じように
+  並べ替えられるので、**最後** にして予備に回せます。`ocx account priority` でプリセット以外の値を設定した場合も、カード上に
+  選択肢として残ります。
 - Thread affinity がリクエストごとにアカウントが揺れるのを防ぎます。クォータ自動切り替えがオンなら長く
   実行される thread も定期的に再評価します。関連使用量がしきい値以上で、使用量が確実により低い
   健全アカウントがあればそのアカウントに再紐付けできます。
@@ -124,6 +134,7 @@ GUI はプロキシの JSON 管理 API を使うシンクライアントです
 | `POST /api/oauth/login` · `GET /api/oauth/status` | プロバイダー OAuth ログインを開始し完了可否を確認します。 |
 | `GET /api/codex-auth/accounts?refresh=1` | メインおよびプールアカウントを参照しクォータを強制更新し、メインの `hasCredential` / terminal `needsReauth` 状態を返します。 |
 | `PUT /api/codex-auth/active` · `PUT /api/codex-auth/auto-switch` · `PUT /api/codex-auth/failover` | 次のリクエストで使うアカウントとプールルーティングポリシーを設定します。 |
+| `GET /api/codex-auth/active` · `PUT /api/codex-auth/accounts/priority` | 実効アカウント（固定中かどうかを示す `pinned` と、固定されているアカウントを示す `pinnedAccountId` を含む）を読み、アカウント 1 件の選択順序を設定します。 |
 | `POST /api/codex-auth/login` · `GET /api/codex-auth/login-status` | ブラウザログインでプールアカウントを追加します。 |
 | `GET /api/logs?tail=50&limit=20&offset=0&provider=...&status=5xx` | tail、プロバイダー、正確な状態コードまたは状態等級で最近のリクエストメタデータを参照します。`limit`/`offset` は最新行から過去方向にページングします（`offset=0` が最新ページ）。応答は `{ timeZone, total, logs }` で、`total` はページング前の一致件数です。 |
 | `GET` / `PUT /api/subagent-models` | `spawn_agent` に優先公開するモデル 5 つを読むか設定します。 |
diff --git a/docs-site/src/content/docs/ja/reference/cli/providers-accounts.md b/docs-site/src/content/docs/ja/reference/cli/providers-accounts.md
index 2b3b741295..b0e0fa29f0 100644
--- a/docs-site/src/content/docs/ja/reference/cli/providers-accounts.md
+++ b/docs-site/src/content/docs/ja/reference/cli/providers-accounts.md
@@ -76,13 +76,14 @@ ocx login anthropic
 実行中のプロキシを介してプロバイダー アカウントと API キー プールを一覧表示し、切り替えます。出荷されたヘルプ画面は次のとおりです。
 
 ```text
-Usage: ocx account <list|current|use|refresh|auto-switch|login|reauth|code|cancel|remove|add-key|reset-credits> ...
+Usage: ocx account <list|current|use|refresh|auto-switch|priority|login|reauth|code|cancel|remove|add-key|reset-credits> ...
 
 list [provider]     Codex account pool, OAuth accounts and API keys (identifiers shown masked as the API returns them).
 current <provider>  Show the active account or key.
 use <provider> <id> Switch the active credential; 'main' selects the Codex App login.
 refresh <provider>  Force-refresh Codex or provider quota reports.
 auto-switch <provider> <on|off|status|threshold N>  Control the Codex pool threshold.
+priority <provider> <id|main> [first|earlier|normal|later|last|-100..100|reset]  Selection order; omit the value to read it.
 remove <provider> <id> --yes  Remove a stored account or key after an existence check.
 add-key <provider> [--label <label>]  Add a key read only from piped stdin.
 login/reauth/code/cancel  Run browser or manual-code auth from a headless shell.
@@ -102,6 +103,7 @@ Codex pool selection applies to the next request after clearing existing affinit
   "label": "plus",
   "email": "m***@example.com",
   "plan": "plus",
+  "priority": 0,
   "masked": "sk-ab****wxyz",
   "active": true,
   "needsReauth": false,
@@ -111,7 +113,7 @@ Codex pool selection applies to the next request after clearing existing affinit
 
 ### `ocx account list [provider] [--json] [--all]`
 
-プロバイダーを使用しない場合、Codex プール、OAuth アカウント、および設定された API キー プールが一覧表示されます。 `--all` が存在しない限り、空のプロバイダーはスキップされます。プロバイダーを使用すると、その資格情報ファミリーのみがリストされます。人間の出力では `PROVIDER TYPE ID PLAN/LABEL STATUS` を使用します。手動で選択した Codex 行には `selected` というマークが付けられます。保存された Kiro アカウントが存在する場合、出力には、Kiro には 1 つのログイン スロットがあり、再度サインインすると現在のアカウントが置き換えられることが示されます。結果が空であっても成功です。 `--json` は次を返します:
+プロバイダーを使用しない場合、Codex プール、OAuth アカウント、および設定された API キー プールが一覧表示されます。 `--all` が存在しない限り、空のプロバイダーはスキップされます。プロバイダーを使用すると、その資格情報ファミリーのみがリストされます。人間の出力では `PROVIDER TYPE ID PLAN/LABEL PRIORITY STATUS` を使用します。手動で選択した Codex 行には `selected` というマークが付けられます。保存された Kiro アカウントが存在する場合、出力には、Kiro には 1 つのログイン スロットがあり、再度サインインすると現在のアカウントが置き換えられることが示されます。結果が空であっても成功です。 `--json` は次を返します:
 
 ```text
 { accounts: AccountRow[], notes: string[] }
@@ -119,7 +121,7 @@ Codex pool selection applies to the next request after clearing existing affinit
 
 ### `ocx account current <provider> [--json]`
 
-アクティブなアカウントまたはキーを表示します。手動ピンのない Codex プールは、自動的に最低使用量の選択を報告します。アクティブな認証情報を持たない別のファミリーは、その状態を報告し、依然として 0 を終了します。`--json` は次を返します。
+アクティブなアカウントまたはキーを表示します。手動ピンのない Codex プールは、優先度を考慮した自動選択を報告します。最も優先度の高い適格ティアが選ばれ、そのティア内でクォータルーティングのもと最低使用量のアカウントが選ばれます。アクティブな認証情報を持たない別のファミリーは、その状態を報告し、依然として 0 を終了します。`--json` は次を返します。
 
 ```text
 { provider, type, activeId: string | null, autoSwitchThreshold?: number, account: AccountRow | null }
@@ -153,6 +155,29 @@ OAuth プロバイダーと API キー プロバイダーの場合、これに
 { provider, autoSwitchThreshold: number, enabled: boolean }
 ```
 
+### `ocx account priority <provider> <account-id|main> [<-100..100|first|earlier|normal|later|last|reset>] [--json]`
+
+Codex pool のアカウント別選択順を読み書きします。**値が大きいほど先に使われ**、既定は `0`、範囲は
+`-100` から `100` です。順序を持つのは `openai` の Codex pool だけなので、他のプロバイダーは終了コード
+1 です。`main` は Codex Desktop ログインを指し、他の pool アカウントと同じように並べ替えられます。
+`ocx account priority openai main last` とすれば予備として最後に回せます。
+
+プリセット語は小さな整数の別名です。`first` が `+2`、`earlier` が `+1`、`normal` が `0`、`later` が
+`-1`、`last` が `-2` です。`reset` は既定に戻し、保存されたエントリを削除します。**値を省略すると
+読み取り**になり、現在の順序を書き換えません。
+
+順序が決めるのは「どのアカウントから見るか」であって「どれが使えるか」ではありません。選択は引き続き
+適格なアカウントの中で行われ、まだ quota に余裕がある最上位 tier を取り、その中は
+`accountPoolStrategy` が選びます。一時停止、cooldown、再認証には影響しません。変更は新しいセッションだけでなく **次の未バインドリクエスト** から適用されます。上位の順序に余裕が戻れば
+preemption が未バインドリクエストを直ちに引き上げます。既にアカウントに紐づいた thread は、通常はそのアカウントを
+使い切るまで維持します。ただし再認証エラー、quota cooldown、一時的な失敗の連続はそれより早く紐付けを解除します。受理された書き込みは、どのアカウントの手動の「今すぐこのアカウントを使う」固定も解除します。すでに設定済みの順序を書き込んだ場合も同様で、これは現在選択中のアカウントを保ったまま固定を解除する唯一の方法です（管理 API でアクティブアカウントを解除しても固定は解除されますが、その選択自体も失われます）。プロキシに接続できない場合、
+不明なアカウント id、受け付けない値はいずれも終了コード 1 です。`--json` は次を返します。
+
+```text
+{ ok: true, provider, id, priority: number, preset: string | null }
+```
+
+
 ### `ocx account login|reauth|code|cancel ...`
 
 ヘッドレス シェルからブラウザベースまたは手動コードのアカウント認証を実行します。プロバイダー固有のコマンド形式には `ocx account --help` を使用します。
diff --git a/docs-site/src/content/docs/ja/reference/configuration/providers.md b/docs-site/src/content/docs/ja/reference/configuration/providers.md
index 19e07d53d2..b254dfcc28 100644
--- a/docs-site/src/content/docs/ja/reference/configuration/providers.md
+++ b/docs-site/src/content/docs/ja/reference/configuration/providers.md
@@ -18,6 +18,7 @@ description: プロバイダー エントリ、認証、エンドポイント、
 | `pausedCodexAccountIds?` | `string[]` | `[]` |再開するまでプールの選択から除外されるアカウント (一時停止時のメイン `__main__` アカウントを含む)。 |
 | `codexAccountNamespaces?` | `Record<string, string>` | — | 任意の公開 model selector を保存済み Codex アカウント target に対応付ける任意の map。target が存在する各 selector は Codex picker に個別の `<selector>/<native-openai-model>` row を追加し、各 row はそのアカウントだけを使用します。selector が 1 つでも有効な場合、bare native row は picker で非表示になりますが、明示的に無効化されない限り id は引き続き routing でき、raw `/v1/models` にも表示されます。 |
 | `activeCodexAccountId?` | `string` | — |次のリクエスト用に手動で選択されたプール アカウント。選択するとスレッドのアフィニティがクリアされます。実行中のリクエストでは、取得された資格情報が保持されます。 |
+| `codexAccountPriorities?` | `Record<string,number>` | — | Codex pool のアカウント別選択順。アカウント ID → `-100` から `100` の整数で、**大きいほど先に使われ**、未設定は `0` です。これは eligibility ではなく順序の境界です。選択は適格なアカウントを、まだ quota に余裕がある最上位 tier に絞り込み、その tier の中を `accountPoolStrategy` が選びます。tier が飛ばされるのは、そのメンバー全員が `autoSwitchThreshold` 超過、cooldown 中、soft-avoid、一時停止、または再認証待ちのときだけで、usage 不明が tier を drain させることはありません。順序付けが不適格なアカウントを選択可能にすることはなく、すでにアカウントが結び付いた thread を再 bind することもありません。メインの `__main__` も同じ条件で参加するため、Codex Desktop ログインを最後に使わせられます。エントリが 1 つもなければ挙動は従来どおりです。map が不正な場合は警告を出して順序付けを無効にします（config の修復処理は走りません）。`ocx account priority` と Codex Auth ページで管理します。 |
 | `autoSwitchThreshold?` | `number` | `80` | 使用量ベースのプロアクティブ切り替えしきい値。`quota` は紐付け済み/未紐付けタスクの次のリクエストを再評価でき、`fill-first` は未紐付け割り当ての使い切り基準としてのみ使用し、通常の `round-robin` 選択は使用しません。既知の 5 時間、週次、30 日 quota window の最大スコアを使います。`0` は使用量ベースの切り替えだけを無効にし、未紐付け割り当てや障害回復は無効にしません。 |
 | `accountPoolStrategy?` | `"quota" \| "round-robin" \| "fill-first"` | `"quota"` | 新規/未紐付け Codex リクエストの割り当て戦略。live な `(parent thread id, quota scope)` affinity がなければ未紐付けで、プロキシ再起動や affinity リセット後は既存の表示タスクも未紐付けになり得ます。`quota` はアクティブアカウントがなければ既知 usage 最小の適格アカウントを選び、適格なアクティブアカウントが `autoSwitchThreshold` 未満なら維持します。しきい値到達後は、未紐付けリクエストまたは紐付け済みタスクの次のリクエストを usage の低い適格アカウントへ移せます。`round-robin` は未紐付けリクエストを均等分散し、`fill-first` は cooldown、使用不可、または drain threshold までアクティブアカウントへ割り当てます。 |
 | `accountPoolStickyLimit?` | `number` | `1` | 1 回の round-robin 選択で次へ進む前に保持する新規/未紐付けタスク割り当て数。カウンターは上流の成功後ではなくタスクの紐付け時に増えます。範囲 1–100。`accountPoolStrategy` が `round-robin` のときのみ。 |
diff --git a/docs-site/src/content/docs/ko/guides/web-dashboard.md b/docs-site/src/content/docs/ko/guides/web-dashboard.md
index aedea3b6c3..cafdef8421 100644
--- a/docs-site/src/content/docs/ko/guides/web-dashboard.md
+++ b/docs-site/src/content/docs/ko/guides/web-dashboard.md
@@ -89,8 +89,16 @@ Dashboard의 **Sub-agent delegation** 선택기는 `injectionModel`과 선택적
 
 **Codex Auth** 페이지는 네이티브 ChatGPT/Codex 라우트를 관리합니다.
 
-- 계정을 직접 고르면 다음 새 Codex 세션부터 바뀝니다. 이미 계정이 묶인 thread는 이 수동 전환만으로
-  중간에 이동하지 않습니다.
+- 계정을 직접 고르면 곧바로 적용됩니다. 이미 계정이 묶인 thread도 다음 요청에서 고른 계정으로
+  옮겨가고, 이미 전송 중인 요청만 가져간 계정을 그대로 씁니다. 직접 고른 계정은 고정되기도 합니다. 카드에 **고정됨** 배지가
+  붙고, 그 계정이 소진되거나, 다른 계정을 고르거나, 어느 계정의 선택 순서를 바꿀 때까지 더 높은 선택
+  순서가 끼어들지 못합니다. 계정이 제외되거나 삭제되거나 명시적으로 failover/promotion 되면 고정도 함께 풀립니다.
+- 각 계정 카드에는 **선택 순서** 컨트롤(가장 먼저 / 먼저 / 기본 / 나중에 / 가장 마지막)이 있습니다.
+  순서가 높은 계정부터 쓰이며, 그 위의 계정이 모두 소진되거나 사용할 수 없게 된 뒤에야 낮은 순서로
+  내려갑니다. 순서를 바꾸면 **다음 미바인딩 요청** 부터 적용되며, 이미 계정에 바인딩된 thread를 옮기지
+  않습니다. Codex Desktop(메인) 계정도 똑같이 정렬되므로 **가장 마지막**으로 두어 예비로 남길 수
+  있습니다. `ocx account priority`로 프리셋 밖의 값을 지정해도 카드에서 그대로 보이고 선택할 수
+  있습니다.
 - Thread affinity가 요청마다 계정이 흔들리는 일을 막습니다. 할당량 자동 전환이 켜져 있으면 오래
   실행되는 thread도 주기적으로 다시 평가합니다. 관련 사용량이 임계값 이상이고 사용량이 확실히 더 낮은
   정상 계정이 있으면 그 계정으로 다시 묶일 수 있습니다.
@@ -147,6 +155,7 @@ GUI는 프록시의 JSON 관리 API를 사용하는 얇은 클라이언트입니
 | `POST /api/oauth/login` · `GET /api/oauth/status` | 프로바이더 OAuth 로그인을 시작하고 완료 여부를 확인합니다. |
 | `GET /api/codex-auth/accounts?refresh=1` | main 및 pool 계정을 조회하고 할당량을 강제로 갱신하며 main 계정의 `hasCredential` / terminal `needsReauth` 상태를 표시합니다. |
 | `PUT /api/codex-auth/active` · `PUT /api/codex-auth/auto-switch` · `PUT /api/codex-auth/failover` | 다음 요청에 사용할 계정과 풀 라우팅 정책을 설정합니다. |
+| `GET /api/codex-auth/active` · `PUT /api/codex-auth/accounts/priority` | 실효 계정(고정 여부를 나타내는 `pinned`와 고정된 계정을 알려주는 `pinnedAccountId` 포함)을 읽고 계정 하나의 선택 순서를 설정합니다. |
 | `POST /api/codex-auth/login` · `GET /api/codex-auth/login-status` | 브라우저 로그인으로 pool 계정을 추가합니다. |
 | `GET /api/logs?tail=50&limit=20&offset=0&provider=...&status=5xx` | tail, 프로바이더, 정확한 상태 코드 또는 상태 등급으로 최근 요청 메타데이터를 조회합니다. `limit`/`offset`은 최신 행에서 과거 방향으로 페이지네이션합니다(`offset=0`이 최신 페이지). 응답은 `{ timeZone, total, logs }`이며 `total`은 페이지네이션 전 필터 일치 건수입니다. |
 | `GET` / `PUT /api/subagent-models` | `spawn_agent`에 우선 노출할 모델 5개를 읽거나 설정합니다. |
diff --git a/docs-site/src/content/docs/ko/reference/cli/providers-accounts.md b/docs-site/src/content/docs/ko/reference/cli/providers-accounts.md
index fb63a8ca37..b761a3aed5 100644
--- a/docs-site/src/content/docs/ko/reference/cli/providers-accounts.md
+++ b/docs-site/src/content/docs/ko/reference/cli/providers-accounts.md
@@ -76,13 +76,14 @@ ocx login anthropic
 실행 중인 프록시를 통해 제공자 계정과 API 키 풀을 나열하고 전환합니다. 제공되는 도움말 표면은 다음과 같습니다:
 
 ```text
-Usage: ocx account <list|current|use|refresh|auto-switch|login|reauth|code|cancel|remove|add-key|reset-credits> ...
+Usage: ocx account <list|current|use|refresh|auto-switch|priority|login|reauth|code|cancel|remove|add-key|reset-credits> ...
 
 list [provider]     Codex account pool, OAuth accounts and API keys (identifiers shown masked as the API returns them).
 current <provider>  Show the active account or key.
 use <provider> <id> Switch the active credential; 'main' selects the Codex App login.
 refresh <provider>  Force-refresh Codex or provider quota reports.
 auto-switch <provider> <on|off|status|threshold N>  Control the Codex pool threshold.
+priority <provider> <id|main> [first|earlier|normal|later|last|-100..100|reset]  Selection order; omit the value to read it.
 remove <provider> <id> --yes  Remove a stored account or key after an existence check.
 add-key <provider> [--label <label>]  Add a key read only from piped stdin.
 login/reauth/code/cancel  Run browser or manual-code auth from a headless shell.
@@ -102,6 +103,7 @@ Codex pool selection applies to the next request after clearing existing affinit
   "label": "plus",
   "email": "m***@example.com",
   "plan": "plus",
+  "priority": 0,
   "masked": "sk-ab****wxyz",
   "active": true,
   "needsReauth": false,
@@ -111,7 +113,7 @@ Codex pool selection applies to the next request after clearing existing affinit
 
 ### `ocx account list [provider] [--json] [--all]`
 
-제공자를 지정하지 않으면 Codex 풀, OAuth 계정, 설정된 API 키 풀을 나열합니다. `--all`이 없으면 비어 있는 제공자는 건너뜁니다. 제공자를 지정하면 해당 자격 증명 계열만 나열합니다. 사람이 보는 출력은 `PROVIDER TYPE ID PLAN/LABEL STATUS` 형식을 사용하며, 수동으로 선택한 Codex 행에는 `selected`가 표시됩니다. 저장된 Kiro 계정이 있으면 출력에 Kiro에는 로그인 슬롯이 하나뿐이고 다시 로그인하면 현재 계정을 바꾼다는 점이 표시됩니다. 빈 결과도 성공입니다. `--json`은 다음을 반환합니다:
+제공자를 지정하지 않으면 Codex 풀, OAuth 계정, 설정된 API 키 풀을 나열합니다. `--all`이 없으면 비어 있는 제공자는 건너뜁니다. 제공자를 지정하면 해당 자격 증명 계열만 나열합니다. 사람이 보는 출력은 `PROVIDER TYPE ID PLAN/LABEL PRIORITY STATUS` 형식을 사용하며, 수동으로 선택한 Codex 행에는 `selected`가 표시됩니다. 저장된 Kiro 계정이 있으면 출력에 Kiro에는 로그인 슬롯이 하나뿐이고 다시 로그인하면 현재 계정을 바꾼다는 점이 표시됩니다. 빈 결과도 성공입니다. `--json`은 다음을 반환합니다:
 
 ```text
 { accounts: AccountRow[], notes: string[] }
@@ -119,7 +121,7 @@ Codex pool selection applies to the next request after clearing existing affinit
 
 ### `ocx account current <provider> [--json]`
 
-활성 계정이나 키를 보여줍니다. 수동 고정이 없는 Codex 풀은 자동으로 가장 적게 사용한 항목을 선택한다고 보고합니다. 활성 자격 증명이 없는 다른 계열은 그 상태를 보고하고도 종료 코드 0으로 끝납니다. `--json`은 다음을 반환합니다:
+활성 계정이나 키를 보여줍니다. 수동 고정이 없는 Codex 풀은 우선순위를 고려한 자동 선택을 보고합니다. 가장 우선순위가 높은 적격 tier를 고르고, 그 tier 안에서 할당량 라우팅 기준으로 가장 적게 사용한 항목을 선택합니다. 활성 자격 증명이 없는 다른 계열은 그 상태를 보고하고도 종료 코드 0으로 끝납니다. `--json`은 다음을 반환합니다:
 
 ```text
 { provider, type, activeId: string | null, autoSwitchThreshold?: number, account: AccountRow | null }
@@ -153,6 +155,28 @@ OAuth 및 API 키 제공자에는 제공자의 할당량 보고 엔드포인트
 { provider, autoSwitchThreshold: number, enabled: boolean }
 ```
 
+### `ocx account priority <provider> <account-id|main> [<-100..100|first|earlier|normal|later|last|reset>] [--json]`
+
+Codex pool 계정 하나의 선택 순서를 읽거나 설정합니다. **값이 클수록 먼저** 쓰이고 기본값은 `0`,
+범위는 `-100`부터 `100`까지입니다. 순서를 갖는 것은 `openai` Codex pool뿐이므로 다른 프로바이더는
+종료 코드 1입니다. `main`은 Codex Desktop 로그인을 가리키며 다른 pool 계정과 똑같이 정렬됩니다.
+`ocx account priority openai main last`로 예비 계정으로 남겨 둘 수 있습니다.
+
+프리셋 단어는 작은 정수의 다른 이름입니다. `first`는 `+2`, `earlier`는 `+1`, `normal`은 `0`,
+`later`는 `-1`, `last`는 `-2`입니다. `reset`은 기본값으로 되돌리고 저장된 항목을 지웁니다. **값을
+생략하면 읽기**가 되어 현재 순서를 바꾸지 않습니다.
+
+순서는 어떤 계정을 먼저 볼지 정할 뿐 어떤 계정을 쓸 수 있는지는 정하지 않습니다. 선택은 여전히
+적격한 계정 안에서 이루어지며, quota 여유가 남은 최상위 tier를 고른 뒤 그 안은
+`accountPoolStrategy`가 정합니다. 일시 중지, cooldown, 재인증에는 영향을 주지 않습니다. 변경은 새 세션뿐 아니라 **다음 미바인딩 요청** 부터 적용됩니다. 상위 순서에 여유가 돌아오면 preemption이
+미바인딩 요청을 곧바로 끌어올립니다. 이미 계정에 바인딩된 thread는 보통 그 계정이 소진될 때까지 유지하지만, 재인증 실패나 quota cooldown, 연속된 일시적 실패는 그보다 먼저 바인딩을 해제합니다. 받아들여진 쓰기는 어떤 계정에 걸려 있든 수동 "지금 이 계정 사용" 고정도 해제합니다. 이미 설정된 순서를 그대로 쓰는 경우에도 마찬가지이며, 이는 현재 선택된 계정을 그대로 두고 고정만 해제하는 유일한 방법입니다(관리 API로 활성 계정을 비우면 고정도 풀리지만 그 선택까지 사라집니다). 프록시에 연결할 수 없거나, 없는
+계정 id, 허용되지 않는 값은 모두 종료 코드 1입니다. `--json`은 다음을 반환합니다.
+
+```text
+{ ok: true, provider, id, priority: number, preset: string | null }
+```
+
+
 ### `ocx account login|reauth|code|cancel ...`
 
 헤드리스 셸에서 브라우저 기반 또는 수동 코드 계정 인증을 실행합니다. 제공자별 명령 형태는 `ocx account --help`를 보십시오.
diff --git a/docs-site/src/content/docs/ko/reference/configuration/providers.md b/docs-site/src/content/docs/ko/reference/configuration/providers.md
index 11ed1e2e74..dd72bb4ff7 100644
--- a/docs-site/src/content/docs/ko/reference/configuration/providers.md
+++ b/docs-site/src/content/docs/ko/reference/configuration/providers.md
@@ -18,6 +18,7 @@ description: 공급자 항목, 인증, 엔드포인트, 모델 카탈로그, 할
 | `pausedCodexAccountIds?` | `string[]` | `[]` | 일시 중지된 `__main__` 계정을 포함해, 재개될 때까지 Pool 선택에서 제외되는 계정입니다. |
 | `codexAccountNamespaces?` | `Record<string, string>` | — | 임의의 공개 model selector를 저장된 Codex 계정 target에 연결하는 선택적 map입니다. target이 존재하는 각 selector는 Codex picker에 별도의 `<selector>/<native-openai-model>` row를 추가하며, 각 row는 해당 계정만 사용합니다. selector가 하나라도 활성화되면 bare native row는 picker에서 숨겨지지만, 명시적으로 비활성화하지 않는 한 해당 id는 계속 routing 가능하고 raw `/v1/models`에 표시됩니다. |
 | `activeCodexAccountId?` | `string` | — | 다음 요청에 수동으로 선택한 Pool 계정입니다. 선택하면 thread 결속이 해제되며, 진행 중인 요청은 캡처한 자격 증명을 유지합니다. |
+| `codexAccountPriorities?` | `Record<string,number>` | — | Codex pool의 계정별 선택 순서. 계정 ID → `-100`부터 `100`까지의 정수이며 **값이 클수록 먼저** 쓰이고, 항목이 없으면 `0`입니다. 이는 eligibility 경계가 아니라 순서 경계입니다. 선택은 이미 적격한 계정들을 quota 여유가 남은 최상위 tier로 좁히고, 그 tier 안에서 `accountPoolStrategy`가 계정을 고릅니다. tier를 건너뛰는 경우는 그 구성원 전부가 `autoSwitchThreshold` 초과, cooldown, soft-avoid, 일시 중지 또는 재인증 대기일 때뿐이며, usage를 알 수 없다고 해서 tier가 소진되지는 않습니다. 순서는 부적격 계정을 선택 가능하게 만들지 않고, 이미 계정에 묶인 thread를 다시 bind하지도 않습니다. 메인 `__main__` 계정도 동일한 조건으로 참여하므로 Codex Desktop 로그인을 마지막에 쓰도록 둘 수 있습니다. 항목이 하나도 없으면 동작은 이전과 같습니다. map이 잘못된 경우 경고를 출력하고 순서 지정을 끕니다(config 복구는 하지 않습니다). `ocx account priority`와 Codex Auth 페이지에서 관리합니다. |
 | `autoSwitchThreshold?` | `number` | `80` | 사용량 기반 선제 전환 임계값입니다. `quota`는 바인딩된 작업과 바인딩 없는 작업의 다음 요청을 모두 재평가할 수 있고, `fill-first`는 바인딩 없는 작업 배정의 소진 기준으로만 사용하며, 기본 `round-robin` 선택은 이 값을 사용하지 않습니다. 알려진 5시간, 주간, 30일 quota window 중 가장 높은 점수를 씁니다. `0`은 사용량 기반 전환만 끄며 바인딩 없는 작업 배정이나 실패 복구는 끄지 않습니다. |
 | `accountPoolStrategy?` | `"quota" \| "round-robin" \| "fill-first"` | `"quota"` | 새 작업/바인딩 없는 Codex 요청의 계정 배정 전략입니다. `(parent thread id, quota scope)`의 live affinity가 없으면 바인딩 없는 요청이며, 프록시 재시작이나 affinity 초기화 뒤에는 기존에 보이던 작업도 바인딩이 없어질 수 있습니다. `quota`는 활성 계정이 없을 때 알려진 usage가 가장 낮은 적격 계정을 선택하고, 적격 활성 계정이 `autoSwitchThreshold` 미만이면 유지합니다. 임계값 도달 뒤에는 바인딩 없는 요청이나 바인딩된 작업의 다음 요청을 usage가 더 낮은 적격 계정으로 옮길 수 있습니다. `round-robin`은 바인딩 없는 요청을 균등 분배하고, `fill-first`는 cooldown, 사용 불가 또는 drain threshold까지 활성 계정에 배정합니다. |
 | `accountPoolStickyLimit?` | `number` | `1` | 한 round-robin 선택이 다음으로 넘어가기 전에 유지하는 새 작업/바인딩 없는 작업 배정 수입니다. 카운터는 업스트림 성공 뒤가 아니라 작업을 바인딩할 때 증가합니다. 범위 1–100이며 `accountPoolStrategy`가 `round-robin`일 때만 적용됩니다. |
diff --git a/docs-site/src/content/docs/reference/cli/providers-accounts.md b/docs-site/src/content/docs/reference/cli/providers-accounts.md
index 6074465c59..7fe2182267 100644
--- a/docs-site/src/content/docs/reference/cli/providers-accounts.md
+++ b/docs-site/src/content/docs/reference/cli/providers-accounts.md
@@ -86,18 +86,20 @@ List and switch provider accounts and API-key pools through the running proxy. T
 surface is:
 
 ```text
-Usage: ocx account <list|current|use|refresh|auto-switch|login|reauth|code|cancel|remove|add-key|reset-credits> ...
+Usage: ocx account <list|current|use|refresh|auto-switch|priority|login|reauth|code|cancel|remove|add-key|reset-credits> ...
 
 list [provider]     Codex account pool, OAuth accounts and API keys (identifiers shown masked as the API returns them).
 current <provider>  Show the active account or key.
 use <provider> <id> Switch the active credential; 'main' selects the Codex App login.
 refresh <provider>  Force-refresh Codex or provider quota reports.
 auto-switch <provider> <on|off|status|threshold N>  Control the Codex pool threshold.
+priority <provider> <id|main> [first|earlier|normal|later|last|-100..100|reset]  Selection order; omit the value to read it.
 remove <provider> <id> --yes  Remove a stored account or key after an existence check.
 add-key <provider> [--label <label>]  Add a key read only from piped stdin.
 login/reauth/code/cancel  Run browser or manual-code auth from a headless shell.
 reset-credits <id|main> [--consume --yes]  Inspect or consume Codex reset credits.
-Codex pool selection applies to the next request after clearing existing affinity; in-flight requests keep their captured account.
+Switching the active account takes effect immediately; running threads move on their next request, and in-flight requests keep the account they captured.
+A selection-order change applies from the next unbound request and never moves a bound thread.
 ```
 
 All subcommands require the proxy to be running; the CLI auto-resolves its recorded runtime port.
@@ -119,6 +121,7 @@ and the plan/label column falls back across plan, masked email, label, and maske
   "email": "m***@example.com",
   "plan": "plus",
   "masked": "sk-ab****wxyz",
+  "priority": 0,
   "active": true,
   "needsReauth": false,
   "quota": null
@@ -129,8 +132,9 @@ and the plan/label column falls back across plan, masked email, label, and maske
 
 Without a provider, lists the Codex pool, OAuth accounts, and configured API-key pools. Empty
 providers are skipped unless `--all` is present. With a provider, lists only that credential family.
-Human output uses `PROVIDER TYPE ID PLAN/LABEL STATUS`; a manually chosen Codex row is marked
-`selected`. When a stored Kiro account exists, the output notes that Kiro has one login slot and
+Human output uses `PROVIDER TYPE ID PLAN/LABEL PRIORITY STATUS`; a manually chosen Codex row is marked
+`selected`. `PRIORITY` is the signed Codex selection order (`0` when unset) and shows `-` for rows
+where ordering does not apply, such as OAuth accounts and API keys. When a stored Kiro account exists, the output notes that Kiro has one login slot and
 that signing in again replaces the current account. An empty result is still success. `--json`
 returns:
 
@@ -140,9 +144,10 @@ returns:
 
 ### `ocx account current <provider> [--json]`
 
-Shows the active account or key. A Codex pool with no manual pin reports automatic lowest-usage
-selection; another family with no active credential reports that state and still exits 0. `--json`
-returns:
+Shows the active account or key. A Codex pool with no manual pin reports the priority-aware
+automatic selection: the highest-priority eligible tier is chosen, and the lowest-usage account
+within that tier is selected under quota routing; another family with no active credential reports
+that state and still exits 0. `--json` returns:
 
 ```text
 { provider, type, activeId: string | null, autoSwitchThreshold?: number, account: AccountRow | null }
@@ -192,6 +197,34 @@ exit 1. `--json` returns:
 { provider, autoSwitchThreshold: number, enabled: boolean }
 ```
 
+### `ocx account priority <provider> <account-id|main> [<-100..100|first|earlier|normal|later|last|reset>] [--json]`
+
+Reads or sets one Codex pool account's selection order: **higher is used earlier**, the default is
+`0`, and the range is `-100` through `100`. Only the `openai` Codex pool is ordered, so other
+providers exit 1. `main` targets the Codex Desktop login, which is ordered like any other pool
+account — `ocx account priority openai main last` is how you keep it as the reserve.
+
+Preset words stand in for small integers: `first` is `+2`, `earlier` is `+1`, `normal` is `0`,
+`later` is `-1`, and `last` is `-2`. `reset` returns the account to the default and drops its stored
+entry. **Omitting the value reads** the current order instead of writing one.
+
+Ordering picks which accounts are considered first, not which are usable: selection still runs among
+eligible accounts, taking the highest order tier that still has quota headroom and leaving
+`accountPoolStrategy` to choose inside it. Pause, cooldown, and reauthentication are unaffected.
+Changes apply from the **next unbound request**, not only from newly started sessions: preemption moves
+an unbound request up as soon as a higher order regains headroom. Threads already bound to an account
+normally keep it until that account is drained; a reauthentication failure, a quota cooldown, or a
+transient-failure streak releases the binding before that. Any accepted write also releases a manual
+"use this account now" pin, on whichever account held it, including a write that stores the
+order an account already had — this is the only way to clear a pin while keeping the account
+that is currently selected. (Clearing the active account through the management API releases a
+pin too, but it drops that selection along with it.) An unreachable proxy, an
+unknown account id, or a value outside the accepted set exits 1. `--json` returns:
+
+```text
+{ ok: true, provider, id, priority: number, preset: string | null }
+```
+
 ### `ocx account login|reauth|code|cancel ...`
 
 Run browser-based or manual-code account authentication from a headless shell. Use
diff --git a/docs-site/src/content/docs/reference/configuration/providers.md b/docs-site/src/content/docs/reference/configuration/providers.md
index 70962e4c31..48ba9a0784 100644
--- a/docs-site/src/content/docs/reference/configuration/providers.md
+++ b/docs-site/src/content/docs/reference/configuration/providers.md
@@ -19,6 +19,8 @@ authenticated.
 | `pausedCodexAccountIds?` | `string[]` | `[]` | Accounts excluded from Pool selection until resumed, including the main `__main__` account when paused. |
 | `codexAccountNamespaces?` | `Record<string, string>` | — | Optional map from an arbitrary public model selector to a stored Codex account target. Each selector whose target is present adds separate `<selector>/<native-openai-model>` rows to the Codex picker; each row uses only that account. With any selector active, bare native rows are hidden in the picker, but their ids remain routable and listed by raw `/v1/models` unless explicitly disabled. |
 | `activeCodexAccountId?` | `string` | — | Manually selected Pool account for the next request. Selection clears thread affinity; in-flight requests keep captured credentials. |
+| `codexAccountPriorities?` | `Record<string, number>` | — | Per-account selection order for the Codex pool: account id → integer from `-100` to `100`, **higher is used earlier**, absent means `0`. This is an ordering boundary, not an eligibility one: selection narrows the already-eligible accounts to the highest tier that still has quota headroom, and `accountPoolStrategy` then picks within that tier. A tier is skipped only when every member is over `autoSwitchThreshold`, cooling down, soft-avoided, paused, or needs reauthentication — unknown quota never drains a tier. Ordering never makes an ineligible account selectable and never re-binds a thread that already has an account. The main `__main__` account participates on equal terms, which is how the Codex Desktop login can be set to drain last. With no entries the pool behaves exactly as before. A malformed map is ignored with a console warning (ordering off, no config repair). Managed by `ocx account priority` and the Codex Auth page. |
+| `activeCodexAccountPinned?` | `string` | — | Account id the operator last selected by hand. While set, a higher `codexAccountPriorities` tier cannot preempt it until the pin is released by drain, exclusion, deletion, or an explicit failover/promotion away. Ordinary round-robin movement inside the capped tier does not release it. Writing any `codexAccountPriorities` entry also releases the pin, so a pin made before an order existed cannot outrank one set afterward. `GET /api/codex-auth/active` reports both whether the effective account is pinned (`pinned`) and the account carrying the ceiling (`pinnedAccountId`). |
 | `autoSwitchThreshold?` | `number` | `80` | Usage threshold for proactive switching. `quota` can re-evaluate both bound and unbound tasks on their next request; `fill-first` uses it only as the drain point for unbound assignment; normal `round-robin` selection does not use it. The score uses the hottest known 5h, weekly, or 30d quota window. `0` disables usage-based proactive switching only, not unbound assignment or failure recovery. |
 | `accountPoolStrategy?` | `"quota" \| "round-robin" \| "fill-first"` | `"quota"` | Assignment strategy for new/unbound Codex requests. A request is unbound when it has no live (parent thread id, quota scope) affinity; a visible existing task can become unbound after proxy restart or affinity reset. `quota` picks the lowest-usage eligible account when no active account exists, keeps an eligible active account below `autoSwitchThreshold`, and after the threshold may move an unbound request or proactively rebind a bound task to a lower-usage eligible account. `round-robin` distributes unbound requests evenly; `fill-first` keeps assigning unbound requests to the active account until cooldown, unavailability, or the configured drain threshold. |
 | `accountPoolStickyLimit?` | `number` | `1` | New/unbound task assignments retained on one round-robin selection before advancing; the counter advances when a task is bound, not after an upstream success. Range 1–100. |
diff --git a/docs-site/src/content/docs/ru/guides/web-dashboard.md b/docs-site/src/content/docs/ru/guides/web-dashboard.md
index bb825211c2..5ed0df3a44 100644
--- a/docs-site/src/content/docs/ru/guides/web-dashboard.md
+++ b/docs-site/src/content/docs/ru/guides/web-dashboard.md
@@ -92,8 +92,19 @@ bun run dev:gui
 
 Страница **Codex Auth** управляет нативным маршрутом ChatGPT/Codex:
 
-- Ручной выбор аккаунта меняет следующую новую сессию Codex; уже привязанный поток при таком ручном
-  переключении сохраняет текущий аккаунт.
+- Ручной выбор аккаунта применяется сразу: уже привязанный поток переходит на выбранный аккаунт со
+  следующего запроса, а захваченный аккаунт сохраняют только уже отправленные запросы. Выбранный вручную аккаунт также закрепляется:
+  на карточке появляется бейдж **ЗАКРЕПЛЁН**, и более высокий порядок выбора не может вытеснить этот
+  аккаунт, пока он не исчерпан, пока вы не выберете другой аккаунт или пока не измените порядок
+  выбора любого аккаунта. Закрепление также снимается при исключении или удалении аккаунта, а также
+  при явном failover/promotion.
+- На карточке каждого аккаунта есть элемент управления **Порядок выбора** (Первым, Раньше,
+  По умолчанию, Позже, Последним). Аккаунты с более высоким порядком используются раньше, а на более
+  низкий порядок пул опускается лишь тогда, когда все аккаунты выше исчерпаны или недоступны.
+  Изменённый порядок действует начиная со **следующего непривязанного запроса** и никогда не
+  перемещает уже привязанный поток. Аккаунт Codex Desktop (основной) упорядочивается наравне с
+  остальными, поэтому его можно поставить **Последним** и держать в резерве. Порядок, заданный через
+  `ocx account priority` вне этих пяти пресетов, остаётся видимым и выбираемым на карточке.
 - Привязка потока предотвращает метание между аккаунтами на каждом запросе. При включённом
   автопереключении по квоте долгоживущий поток периодически переоценивается и может
   перепривязаться, когда его релевантное использование достигает порога и существует подходящий
@@ -131,6 +142,7 @@ GUI — это тонкий клиент поверх JSON-API управлен
 | `POST /api/oauth/login` · `GET /api/oauth/status` | Запуск OAuth-процесса провайдера и опрос его завершения. |
 | `GET /api/codex-auth/accounts?refresh=1` | Список основного и пуловых аккаунтов с принудительным обновлением квот и состояниями `hasCredential` / terminal `needsReauth` основного аккаунта. |
 | `PUT /api/codex-auth/active` · `PUT /api/codex-auth/auto-switch` · `PUT /api/codex-auth/failover` | Выбор аккаунта для следующего запроса и настройка маршрутизации пула. |
+| `GET /api/codex-auth/active` · `PUT /api/codex-auth/accounts/priority` | Чтение эффективного аккаунта (включая признак закрепления `pinned` и закреплённый аккаунт `pinnedAccountId`) и установка порядка выбора для одного аккаунта. |
 | `POST /api/codex-auth/login` · `GET /api/codex-auth/login-status` | Добавление аккаунта пула через вход в браузере. |
 | `GET /api/logs?tail=50&limit=20&offset=0&provider=...&status=5xx` | Чтение метаданных недавних запросов с необязательными фильтрами tail, провайдера и точного/классового статуса. `limit`/`offset` листают назад от самой новой строки (`offset=0` — последняя страница). Ответ: `{ timeZone, total, logs }`, где `total` — число совпадений до пагинации. |
 | `GET` / `PUT /api/subagent-models` | Чтение или настройка пяти выделенных моделей переопределения `spawn_agent`. |
diff --git a/docs-site/src/content/docs/ru/reference/cli/providers-accounts.md b/docs-site/src/content/docs/ru/reference/cli/providers-accounts.md
index e25ef9e345..a99dec555d 100644
--- a/docs-site/src/content/docs/ru/reference/cli/providers-accounts.md
+++ b/docs-site/src/content/docs/ru/reference/cli/providers-accounts.md
@@ -89,13 +89,14 @@ ocx login anthropic
 Поставляемая help-surface выглядит так:
 
 ```text
-Usage: ocx account <list|current|use|refresh|auto-switch|login|reauth|code|cancel|remove|add-key|reset-credits> ...
+Usage: ocx account <list|current|use|refresh|auto-switch|priority|login|reauth|code|cancel|remove|add-key|reset-credits> ...
 
 list [provider]     Codex account pool, OAuth accounts and API keys (identifiers shown masked as the API returns them).
 current <provider>  Show the active account or key.
 use <provider> <id> Switch the active credential; 'main' selects the Codex App login.
 refresh <provider>  Force-refresh Codex or provider quota reports.
 auto-switch <provider> <on|off|status|threshold N>  Control the Codex pool threshold.
+priority <provider> <id|main> [first|earlier|normal|later|last|-100..100|reset]  Selection order; omit the value to read it.
 remove <provider> <id> --yes  Remove a stored account or key after an existence check.
 add-key <provider> [--label <label>]  Add a key read only from piped stdin.
 login/reauth/code/cancel  Run browser or manual-code auth from a headless shell.
@@ -123,6 +124,7 @@ label и masked key.
   "label": "plus",
   "email": "m***@example.com",
   "plan": "plus",
+  "priority": 0,
   "masked": "sk-ab****wxyz",
   "active": true,
   "needsReauth": false,
@@ -135,7 +137,7 @@ label и masked key.
 Без провайдера команда показывает пул Codex, OAuth-аккаунты и настроенные API-key pool'ы.
 Пустые провайдеры пропускаются, если не задан `--all`. С провайдером выводится только это
 семейство credential'ов. Human-output использует формат
-`PROVIDER TYPE ID PLAN/LABEL STATUS`; строка Codex, выбранная вручную, помечается `selected`.
+`PROVIDER TYPE ID PLAN/LABEL PRIORITY STATUS`; строка Codex, выбранная вручную, помечается `selected`.
 Если существует сохранённый аккаунт Kiro, вывод дополнительно отмечает, что у Kiro один слот
 логина и новый вход заменит текущий аккаунт. Пустой результат всё равно считается успехом.
 `--json` возвращает:
@@ -147,7 +149,7 @@ label и masked key.
 ### `ocx account current <provider> [--json]`
 
 Показывает активный аккаунт или ключ. Если в пуле Codex нет ручного pin'а, команда сообщает об
-автоматическом выборе аккаунта с наименьшим usage; если в другом семействе нет активного
+автоматическом выборе с учётом порядка: выбирается самый высокий подходящий уровень, а внутри него при quota-маршрутизации аккаунт с наименьшим usage; если в другом семействе нет активного
 credential'а, это состояние тоже печатается, но код выхода всё равно остаётся 0. `--json`
 возвращает:
 
@@ -194,6 +196,31 @@ quota-bar'ов дашборда.
 { provider, autoSwitchThreshold: number, enabled: boolean }
 ```
 
+### `ocx account priority <provider> <account-id|main> [<-100..100|first|earlier|normal|later|last|reset>] [--json]`
+
+Читает или задаёт порядок выбора одного аккаунта пула Codex: **больше — используется раньше**,
+значение по умолчанию `0`, диапазон от `-100` до `100`. Порядок есть только у пула Codex `openai`,
+поэтому другие провайдеры завершаются с кодом 1. `main` указывает на логин Codex Desktop, который
+упорядочивается наравне с остальными: `ocx account priority openai main last` оставляет его резервным.
+
+Слова-пресеты заменяют небольшие целые числа: `first` — это `+2`, `earlier` — `+1`, `normal` — `0`,
+`later` — `-1`, `last` — `-2`. `reset` возвращает значение по умолчанию и удаляет сохранённую запись.
+**Пропуск значения читает** текущий порядок, ничего не записывая.
+
+Порядок определяет, какие аккаунты рассматриваются первыми, а не какие пригодны: выбор по-прежнему
+идёт среди подходящих аккаунтов, берётся самый высокий уровень с оставшимся запасом квоты, а внутри
+него аккаунт выбирает `accountPoolStrategy`. Пауза, cooldown и повторная аутентификация не
+затрагиваются. Изменения действуют начиная со **следующего непривязанного запроса**, а не только для новых сессий:
+как только у более высокого порядка снова появляется запас, preemption сразу поднимает непривязанный
+запрос. Потоки, уже привязанные к аккаунту, обычно сохраняют его до исчерпания, но ошибка повторной аутентификации, cooldown по квоте или серия временных сбоев снимают привязку раньше.
+Любая принятая запись также снимает ручное закрепление "использовать этот аккаунт сейчас" с того аккаунта, на котором оно стояло. Это касается и записи того же порядка, который уже был установлен. Такой способ — единственный, который снимает закрепление, сохранив выбранный аккаунт. Сброс активного аккаунта через management API тоже снимает закрепление, но вместе с самим выбором. Недоступный прокси, неизвестный id аккаунта или значение вне допустимого набора завершаются
+с кодом 1. `--json` возвращает:
+
+```text
+{ ok: true, provider, id, priority: number, preset: string | null }
+```
+
+
 ### `ocx account login|reauth|code|cancel ...`
 
 Запускать browser-based или manual-code account-authentication из headless-shell. Для
diff --git a/docs-site/src/content/docs/ru/reference/configuration/providers.md b/docs-site/src/content/docs/ru/reference/configuration/providers.md
index 7dc87358a0..5698ffc7c6 100644
--- a/docs-site/src/content/docs/ru/reference/configuration/providers.md
+++ b/docs-site/src/content/docs/ru/reference/configuration/providers.md
@@ -19,6 +19,7 @@ description: Записи провайдеров, аутентификация,
 | `pausedCodexAccountIds?` | `string[]` | `[]` | Аккаунты, исключённые из выбора Pool до снятия паузы, включая основной аккаунт `__main__`, если он поставлен на паузу. |
 | `codexAccountNamespaces?` | `Record<string, string>` | — | Необязательное сопоставление произвольного публичного селектора модели с сохранённым аккаунтом Codex. Каждый селектор с существующей целью добавляет в model picker Codex отдельные строки `<selector>/<native-openai-model>`; каждая строка использует только этот аккаунт. Если активен хотя бы один селектор, bare native-строки скрываются в picker, но их id остаются маршрутизируемыми и перечисляются raw `/v1/models`, если они не отключены явно. |
 | `activeCodexAccountId?` | `string` | — | Вручную выбранный аккаунт Pool для следующего запроса. Выбор очищает thread affinity; in-flight-запросы сохраняют уже захваченные credential'ы. |
+| `codexAccountPriorities?` | `Record<string,number>` | — | Порядок выбора для каждого аккаунта пула Codex: id аккаунта → целое число от `-100` до `100`, **больше — используется раньше**, отсутствие означает `0`. Это граница порядка, а не пригодности: выбор сужает уже подходящие аккаунты до самого высокого уровня, у которого ещё есть запас квоты, а внутри этого уровня аккаунт выбирает `accountPoolStrategy`. Уровень пропускается, только когда все его аккаунты превысили `autoSwitchThreshold`, находятся в cooldown, под soft-avoid, на паузе или требуют повторной аутентификации; неизвестный usage никогда не исчерпывает уровень. Порядок не делает выбираемым непригодный аккаунт и не перепривязывает поток, у которого аккаунт уже есть. Основной аккаунт `__main__` участвует на равных — именно так логин Codex Desktop можно оставить на самый конец. Без записей поведение остаётся прежним. Некорректная map игнорируется с предупреждением в консоли (порядок отключается, восстановление config не запускается). Управляется через `ocx account priority` и страницу Codex Auth. |
 | `autoSwitchThreshold?` | `number` | `80` | Порог проактивного переключения по использованию. `quota` может повторно оценить следующий запрос как привязанной, так и непривязанной задачи; `fill-first` использует его только как точку исчерпания для непривязанных назначений; обычный `round-robin` его не использует. Оценка берёт самое горячее из окон 5 часов, недели и 30 дней. `0` отключает только переключение по использованию, но не назначение непривязанных задач и не восстановление после сбоев. |
 | `accountPoolStrategy?` | `"quota" \| "round-robin" \| "fill-first"` | `"quota"` | Стратегия назначения для новых/непривязанных запросов Codex. Запрос непривязан, если у него нет live affinity `(parent thread id, quota scope)`; видимая существующая задача может стать непривязанной после перезапуска прокси или сброса affinity. `quota` выбирает подходящий аккаунт с наименьшим известным usage, когда активного аккаунта нет, сохраняет подходящий активный аккаунт ниже `autoSwitchThreshold`, а после порога может перевести непривязанный запрос или следующий запрос привязанной задачи на подходящий аккаунт с меньшим usage. `round-robin` равномерно распределяет непривязанные запросы; `fill-first` назначает их активному аккаунту до cooldown, недоступности или порога исчерпания. |
 | `accountPoolStickyLimit?` | `number` | `1` | Число назначений новых/непривязанных задач на одном выборе round-robin перед переходом дальше. Счётчик растёт при привязке задачи, а не после успеха upstream. Диапазон 1–100; только при `accountPoolStrategy` = `round-robin`. |
diff --git a/docs-site/src/content/docs/zh-cn/guides/web-dashboard.md b/docs-site/src/content/docs/zh-cn/guides/web-dashboard.md
index 4a3eb55053..82083c2437 100644
--- a/docs-site/src/content/docs/zh-cn/guides/web-dashboard.md
+++ b/docs-site/src/content/docs/zh-cn/guides/web-dashboard.md
@@ -83,8 +83,15 @@ Dashboard 的 **Sub-agent delegation** 选择器会保存 `injectionModel`，以
 
 **Codex Auth** 页面用于管理原生 ChatGPT/Codex 路由：
 
-- 手动选择账号会影响下一次新建的 Codex session；已经绑定账号的 thread 不会因为这次手动切换而
-  在中途转移。
+Pool 模式会在主账号和已添加的 Codex 账号之间选择；Direct 只使用调用者或主登录账号。进行中的请求会保留已获取的凭据，而 401/403 重新认证或 429 cooldown 可能清除亲和性并轮换到另一个合格的 Pool 账号。这与 `openai-apikey` 及其他 provider 相互独立。
+
+- 手动选择账号会立即生效：已经绑定账号的 thread 会在下一次请求时切换到所选账号，只有已经在传输中的
+  请求会继续使用它们捕获的账号。手动选择的账号还会被固定：卡片上会出现 **已固定** 徽章，在该账号被耗尽、你改选
+  其他账号，或你改动任意账号的选择顺序之前，更高的选择顺序都无法抢占它。
+- 每张账号卡片都带有 **选择顺序** 控件（最先 / 较先 / 默认 / 较后 / 最后）。顺序靠前的账号先被使用，
+  只有当它上面的账号全部耗尽或不可用时才会降到更靠后的顺序。改动顺序会从**下一个未绑定请求**起生效，
+  且不会移动已经绑定的 thread。Codex Desktop（主）账号同样参与排序，可以设为 **最后** 留作备用。
+  用 `ocx account priority` 设置的非预设值也会保留在卡片上，仍可选择。
 - Thread affinity 可避免每个请求都来回切换账号。启用配额自动切换后，长时间运行的 thread 会被
   定期重新评估；当相关 usage 达到阈值，并且存在使用率确实更低的可用账号时，该 thread 可能会
   重新绑定。
@@ -118,6 +125,7 @@ GUI 是代理 JSON 管理 API 之上的轻量客户端。常用 endpoint 包括
 | `POST /api/oauth/login` · `GET /api/oauth/status` | 启动 provider OAuth 流程并轮询完成状态。 |
 | `GET /api/codex-auth/accounts?refresh=1` | 列出主账号与池账号、强制刷新配额，并返回主账号的 `hasCredential` / terminal `needsReauth` 状态。 |
 | `PUT /api/codex-auth/active` · `PUT /api/codex-auth/auto-switch` · `PUT /api/codex-auth/failover` | 选择下一次请求使用的账号并配置账号池路由。 |
+| `GET /api/codex-auth/active` · `PUT /api/codex-auth/accounts/priority` | 读取实际生效的账号（含表示是否固定的 `pinned` 和指明被固定账号的 `pinnedAccountId`），并设置单个账号的选择顺序。 |
 | `POST /api/codex-auth/login` · `GET /api/codex-auth/login-status` | 通过浏览器登录添加池账号。 |
 | `GET /api/logs?tail=50&limit=20&offset=0&provider=...&status=5xx` | 使用 tail、provider、精确状态码或状态类别筛选近期请求元数据。`limit`/`offset` 从最新一行向前分页（`offset=0` 为最新一页）。响应为 `{ timeZone, total, logs }`，其中 `total` 为分页前的匹配行数。 |
 | `GET` / `PUT /api/subagent-models` | 读取或设置五个置顶的 `spawn_agent` override 模型。 |
diff --git a/docs-site/src/content/docs/zh-cn/reference/cli/providers-accounts.md b/docs-site/src/content/docs/zh-cn/reference/cli/providers-accounts.md
index 7a1f45570c..20f4205e47 100644
--- a/docs-site/src/content/docs/zh-cn/reference/cli/providers-accounts.md
+++ b/docs-site/src/content/docs/zh-cn/reference/cli/providers-accounts.md
@@ -80,13 +80,14 @@ ocx login anthropic
 通过正在运行的代理列出并切换提供方账号和 API 密钥池。随附的帮助输出如下：
 
 ```text
-Usage: ocx account <list|current|use|refresh|auto-switch|login|reauth|code|cancel|remove|add-key|reset-credits> ...
+Usage: ocx account <list|current|use|refresh|auto-switch|priority|login|reauth|code|cancel|remove|add-key|reset-credits> ...
 
 list [provider]     Codex account pool, OAuth accounts and API keys (identifiers shown masked as the API returns them).
 current <provider>  Show the active account or key.
 use <provider> <id> Switch the active credential; 'main' selects the Codex App login.
 refresh <provider>  Force-refresh Codex or provider quota reports.
 auto-switch <provider> <on|off|status|threshold N>  Control the Codex pool threshold.
+priority <provider> <id|main> [first|earlier|normal|later|last|-100..100|reset]  Selection order; omit the value to read it.
 remove <provider> <id> --yes  Remove a stored account or key after an existence check.
 add-key <provider> [--label <label>]  Add a key read only from piped stdin.
 login/reauth/code/cancel  Run browser or manual-code auth from a headless shell.
@@ -112,6 +113,7 @@ OAuth 账号会显示为 `Account N`，而 plan/label 列会在 plan、屏蔽后
   "label": "plus",
   "email": "m***@example.com",
   "plan": "plus",
+  "priority": 0,
   "masked": "sk-ab****wxyz",
   "active": true,
   "needsReauth": false,
@@ -123,7 +125,7 @@ OAuth 账号会显示为 `Account N`，而 plan/label 列会在 plan、屏蔽后
 
 不指定提供方时，会列出 Codex 池、OAuth 账号和已配置的 API 密钥池。除非提供
 `--all`，否则会跳过空的提供方。指定提供方时，只列出该凭据家族。人类可读输出
-使用 `PROVIDER TYPE ID PLAN/LABEL STATUS`；手动选中的 Codex 行会标记为 `selected`。
+使用 `PROVIDER TYPE ID PLAN/LABEL PRIORITY STATUS`；手动选中的 Codex 行会标记为 `selected`。
 当存在已存储的 Kiro 账号时，输出会提示 Kiro 只有一个登录槽位，并且再次登录会
 替换当前账号。空结果仍然算成功。`--json` 返回：
 
@@ -176,6 +178,26 @@ token，也不是简单重读账号列表。`--json` 返回
 { provider, autoSwitchThreshold: number, enabled: boolean }
 ```
 
+### `ocx account priority <provider> <account-id|main> [<-100..100|first|earlier|normal|later|last|reset>] [--json]`
+
+读取或设置某个 Codex pool 账号的选择顺序：**数值越大越先使用**，默认值为 `0`，范围是 `-100` 到
+`100`。只有 `openai` 的 Codex pool 有选择顺序，其他 provider 返回退出码 1。`main` 指向 Codex Desktop
+登录账号，它与其他 pool 账号一样参与排序：`ocx account priority openai main last` 就能把它留作备用。
+
+预设词只是小整数的别名：`first` 为 `+2`，`earlier` 为 `+1`，`normal` 为 `0`，`later` 为 `-1`，
+`last` 为 `-2`。`reset` 恢复默认值并删除已保存的条目。**省略取值即为读取**，不会改写当前顺序。
+
+顺序决定的是先考虑哪些账号，而不是哪些账号可用：选择仍然只在合格账号中进行，取仍有 quota 余量的
+最高 tier，再由 `accountPoolStrategy` 在该 tier 内挑选。暂停、cooldown 和重新认证都不受影响。改动
+从**下一个未绑定请求**起生效，而不仅限于新开的 session：一旦更高顺序重新有了余量，preemption 会立即把
+未绑定请求提上去。已绑定账号的 thread 通常会保留该账号直到其用尽，但重新认证失败、quota cooldown 或连续的临时失败都会更早解除绑定。任何被接受的写入也会解除手动的“立即使用此账号”固定，无论固定在哪个账号上；写入与当前相同的顺序同样会解除，这是在保留当前所选账号的前提下解除固定的唯一方式（通过管理 API 清空活动账号同样会解除固定，但所选账号也一并丢失）。代理不可达、账号 id 不存在或取值不在
+允许范围内都会返回退出码 1。`--json` 返回：
+
+```text
+{ ok: true, provider, id, priority: number, preset: string | null }
+```
+
+
 ### `ocx account login|reauth|code|cancel ...`
 
 在无头 shell 中运行基于浏览器或手动代码的账号认证。请使用
diff --git a/docs-site/src/content/docs/zh-cn/reference/configuration/providers.md b/docs-site/src/content/docs/zh-cn/reference/configuration/providers.md
index 450db54372..164f180152 100644
--- a/docs-site/src/content/docs/zh-cn/reference/configuration/providers.md
+++ b/docs-site/src/content/docs/zh-cn/reference/configuration/providers.md
@@ -18,6 +18,7 @@ description: 提供者条目、身份验证、端点、模型目录、配额、
 | `pausedCodexAccountIds?` | `string[]` | `[]` | 在恢复之前从 Pool 选择中排除的账户，包括被暂停时的主 `__main__` 账户。 |
 | `codexAccountNamespaces?` | `Record<string, string>` | — | 将任意公开 model selector 映射到已保存 Codex account target 的可选配置。target 存在的每个 selector 都会在 Codex picker 中添加独立的 `<selector>/<native-openai-model>` row，且每个 row 只使用对应账户。只要有 selector 生效，bare native row 就会在 picker 中隐藏；但除非显式禁用，其 id 仍可路由，并继续列在 raw `/v1/models` 中。 |
 | `activeCodexAccountId?` | `string` | — | 为下一次请求手动选定的 Pool 账户。选择会清除线程亲和性；进行中的请求会保留捕获到的凭据。 |
+| `codexAccountPriorities?` | `Record<string,number>` | — | Codex pool 各账号的选择顺序：账号 ID → `-100` 到 `100` 的整数，**数值越大越先使用**，未设置即为 `0`。这是顺序边界而非资格边界：选择会把已经合格的账号收窄到仍有 quota 余量的最高 tier，再由 `accountPoolStrategy` 在该 tier 内挑选。只有当某个 tier 的所有成员都超过 `autoSwitchThreshold`、处于 cooldown、被 soft-avoid、已暂停或需要重新认证时，该 tier 才会被跳过；usage 未知不会让 tier 耗尽。顺序不会让不合格的账号变得可选，也不会重新绑定已经绑定账号的 thread。主账号 `__main__` 同样参与排序，因此可以让 Codex Desktop 登录账号最后才被用到。没有任何条目时，行为与以往完全一致。映射格式非法时会打印警告并关闭排序（不会触发 config 修复）。可通过 `ocx account priority` 和 Codex Auth 页面管理。 |
 | `autoSwitchThreshold?` | `number` | `80` | 基于用量的主动切换阈值。`quota` 可在下一次请求中重新评估已绑定和未绑定任务；`fill-first` 仅把它用作未绑定分配的耗尽点；正常 `round-robin` 不使用它。分数取已知 5 小时、周或 30 天 quota window 的最高值。`0` 只关闭基于用量的主动切换，不关闭未绑定任务分配或故障恢复。 |
 | `accountPoolStrategy?` | `"quota" \| "round-robin" \| "fill-first"` | `"quota"` | 新建/未绑定 Codex 请求的分配策略。没有 live `(parent thread id, quota scope)` affinity 的请求属于未绑定；代理重启或 affinity 重置后，已有可见任务也可能未绑定。`quota` 在没有活跃账号时选择已知 usage 最低的合格账号；活跃账号合格且低于 `autoSwitchThreshold` 时继续使用；达到阈值后，可把未绑定请求或已绑定任务的下一次请求切换到 usage 更低的合格账号。`round-robin` 均匀分配未绑定请求；`fill-first` 在 cooldown、不可用或耗尽阈值前持续分配给活跃账号。 |
 | `accountPoolStickyLimit?` | `number` | `1` | 一次 round-robin 选择在推进前保留的新建/未绑定任务分配数。计数在任务绑定时增加，而不是在上游成功后增加。范围 1–100；仅当 `accountPoolStrategy` 为 `round-robin` 时生效。 |
diff --git a/gui/src/account-priority.ts b/gui/src/account-priority.ts
new file mode 100644
index 0000000000..2323529cb7
--- /dev/null
+++ b/gui/src/account-priority.ts
@@ -0,0 +1,68 @@
+import type { TFn } from "./i18n/shared";
+
+/**
+ * Account selection order. Higher numbers are picked earlier; 0 is the unset default.
+ *
+ * User-visible copy never says "priority": the presets read as a sequence (First,
+ * Earlier, Normal, Later, Last) so the control describes WHEN an account is used
+ * rather than how important it is. Only identifiers use the internal name.
+ */
+
+export const ACCOUNT_PRIORITY_PRESETS: readonly number[] = [2, 1, 0, -1, -2] as const;
+
+export const DEFAULT_ACCOUNT_PRIORITY = 0;
+export const MIN_ACCOUNT_PRIORITY = -100;
+export const MAX_ACCOUNT_PRIORITY = 100;
+
+/** i18n keys for the preset names. Kept here so the select stays copy-free. */
+export type AccountPriorityPresetKey =
+  | "accountPool.priorityFirst"
+  | "accountPool.priorityEarlier"
+  | "accountPool.priorityNormal"
+  | "accountPool.priorityLater"
+  | "accountPool.priorityLast";
+
+const PRESET_LABEL_KEYS = new Map<number, AccountPriorityPresetKey>([
+  [2, "accountPool.priorityFirst"],
+  [1, "accountPool.priorityEarlier"],
+  [0, "accountPool.priorityNormal"],
+  [-1, "accountPool.priorityLater"],
+  [-2, "accountPool.priorityLast"],
+]);
+
+export function normalizeAccountPriority(value: unknown): number {
+  return typeof value === "number"
+    && Number.isInteger(value)
+    && value >= MIN_ACCOUNT_PRIORITY
+    && value <= MAX_ACCOUNT_PRIORITY
+    ? value
+    : DEFAULT_ACCOUNT_PRIORITY;
+}
+
+/**
+ * Signed rendering with an ASCII hyphen: "+2", "0", "-1". The number is always part of
+ * the label, so an operator can map the words back to what the API and CLI report.
+ */
+export function formatAccountPriority(value: unknown): string {
+  const normalized = normalizeAccountPriority(value);
+  return normalized > 0 ? `+${normalized}` : String(normalized);
+}
+
+export function isAccountPriorityPreset(value: number): boolean {
+  return PRESET_LABEL_KEYS.has(value);
+}
+
+/** Label key for a preset, or null for a value only the API or CLI can produce. */
+export function accountPriorityPresetKey(value: number): AccountPriorityPresetKey | null {
+  return PRESET_LABEL_KEYS.get(value) ?? null;
+}
+
+/** "First (+2)" for presets, "Custom (+7)" for anything else. */
+export function accountPriorityLabel(t: TFn, value: number): string {
+  const normalized = normalizeAccountPriority(value);
+  const presetKey = accountPriorityPresetKey(normalized);
+  return t("accountPool.priorityOption", {
+    name: t(presetKey ?? "accountPool.priorityCustom"),
+    value: formatAccountPriority(normalized),
+  });
+}
diff --git a/gui/src/components/AccountPriorityControl.tsx b/gui/src/components/AccountPriorityControl.tsx
new file mode 100644
index 0000000000..7db2d20604
--- /dev/null
+++ b/gui/src/components/AccountPriorityControl.tsx
@@ -0,0 +1,71 @@
+import { useT } from "../i18n/shared";
+import { Select } from "../ui";
+import {
+  ACCOUNT_PRIORITY_PRESETS,
+  accountPriorityLabel,
+  DEFAULT_ACCOUNT_PRIORITY,
+  isAccountPriorityPreset,
+  normalizeAccountPriority,
+} from "../account-priority";
+
+export interface AccountPriorityControlProps {
+  value: number;
+  disabled?: boolean;
+  /** Unique per card: several controls share one page. */
+  selectId: string;
+  onChange(priority: number): void;
+}
+
+/**
+ * Compact inline selection-order control for one account card.
+ *
+ * The presets cover every value the dashboard can create; a stored value from the API or
+ * CLI that is not a preset is prepended as a selectable peer so switching away from it is
+ * possible without losing what it currently is. The hint is a description rather than a
+ * line of its own: it would otherwise repeat on every card in the pool.
+ */
+export default function AccountPriorityControl({
+  value,
+  disabled = false,
+  selectId,
+  onChange,
+}: AccountPriorityControlProps) {
+  const t = useT();
+  const current = normalizeAccountPriority(value);
+  const hint = t("accountPool.priorityHint");
+  // eslint-disable-next-line local-i18n/no-hardcoded-ui-strings -- element id suffix, not UI text
+  const hintId = `${selectId}-hint`;
+  const presets = ACCOUNT_PRIORITY_PRESETS.map(preset => ({
+    value: String(preset),
+    label: accountPriorityLabel(t, preset),
+  }));
+  const options = isAccountPriorityPreset(current)
+    ? presets
+    : [{ value: String(current), label: accountPriorityLabel(t, current) }, ...presets];
+  return (
+    <div className="codex-account-priority">
+      <label className="codex-account-priority-label" htmlFor={selectId}>
+        {t("accountPool.priority")}
+      </label>
+      <Select
+        id={selectId}
+        value={String(current)}
+        options={options}
+        disabled={disabled}
+        label={t("accountPool.priorityAria")}
+        describedBy={hintId}
+        title={hint}
+        onChange={(next) => onChange(normalizeAccountPriority(Number.parseInt(next, 10)))}
+      />
+      <span id={hintId} className="sr-only">{hint}</span>
+    </div>
+  );
+}
+
+/** Muted card badge naming a non-default selection order. */
+export function AccountPriorityBadge({ value }: { value: number }) {
+  const t = useT();
+  const current = normalizeAccountPriority(value);
+  if (current === DEFAULT_ACCOUNT_PRIORITY) return null;
+  return <span className="badge badge-muted">{accountPriorityLabel(t, current)}</span>;
+}
diff --git a/gui/src/components/CodexAccountPool.tsx b/gui/src/components/CodexAccountPool.tsx
index f6b0386764..475362b897 100644
--- a/gui/src/components/CodexAccountPool.tsx
+++ b/gui/src/components/CodexAccountPool.tsx
@@ -59,7 +59,7 @@ export default function CodexAccountPool({ apiBase, accountModeState = null, ban
   // but stays inert (no load, no polling) whenever a shared controller was injected.
   const ownController = useCodexAccountPool(apiBase, !injectedController);
   const controller = injectedController ?? ownController;
-  const { accounts, activeId, loadState, switchingId, pauseUpdatingId, pausingExhausted, load } = controller;
+  const { accounts, activeId, loadState, switchingId, pauseUpdatingId, priorityUpdatingId, pausingExhausted, activePinnedId, load } = controller;
   const [confirm, setConfirm] = useState<CodexAccountEntry | null>(null);
   const [showAdd, setShowAdd] = useState(false);
   const [reauthId, setReauthId] = useState<string | null>(null);
@@ -181,6 +181,22 @@ export default function CodexAccountPool({ apiBase, accountModeState = null, ban
     }), !result.ok);
   };
 
+  const changePriority = async (account: CodexAccountEntry, priority: number) => {
+    // Same guard as the pool strategy control (CodexPoolStrategySetting.tsx), and here it is
+    // load-bearing rather than just thrift: `Select` calls onChange for the clicked option
+    // even when it was already selected, and commits the highlighted one on Tab-out. The
+    // route releases the pin on every accepted write — deliberately, since an explicit write
+    // is a newer statement of intent — so without this a mis-click would unpin the account
+    // the operator chose and still report success. Suppressing the no-op belongs here, at
+    // the widget, not at the route, where a same-value write really is a statement.
+    if (priority === account.priority) return;
+    const result = await controller.setAccountPriority(account.id, priority);
+    if (!result.ok && result.reason === "busy") return;
+    showActionFeedback(t(result.ok ? "accountPool.priorityUpdated" : "accountPool.priorityUpdateFailed", {
+      email: account.alias ?? account.email,
+    }), !result.ok);
+  };
+
   const remove = async (id: string) => {
     const label = accounts.find(account => account.id === id)?.email ?? t("pws.accountOrdinal", { count: "1" });
     if (!window.confirm(t("codexAuth.removeConfirm", { id: label }))) return;
@@ -292,6 +308,10 @@ export default function CodexAccountPool({ apiBase, accountModeState = null, ban
             onTogglePause={togglePaused}
             pauseUpdatingId={pauseUpdatingId}
             pauseBusy={pauseBusy}
+            onPriorityChange={(entry, priority) => { void changePriority(entry, priority); }}
+            priorityUpdatingId={priorityUpdatingId}
+            switchingId={switchingId}
+            pinnedId={activePinnedId}
             onOpenReset={openResetPopup}
             onCopyDoctor={showDoctorCopy ? copyDoctor : undefined}
             doctorCopyOutcomeFor={showDoctorCopy ? doctorCopy.outcomeFor : undefined}
@@ -322,6 +342,10 @@ export default function CodexAccountPool({ apiBase, accountModeState = null, ban
             onTogglePause={togglePaused}
             pauseUpdatingId={pauseUpdatingId}
             pauseBusy={pauseBusy}
+            onPriorityChange={(entry, priority) => { void changePriority(entry, priority); }}
+            priorityUpdatingId={priorityUpdatingId}
+            switchingId={switchingId}
+            pinnedId={activePinnedId}
             onReauth={openReauth}
             onEditAlias={editAlias}
             onRemove={remove}
@@ -365,6 +389,7 @@ export default function CodexAccountPool({ apiBase, accountModeState = null, ban
           mainEmail={main?.email}
           accountModeState={accountModeState}
           switchingId={switchingId}
+          orderBusy={priorityUpdatingId !== null}
           onCancel={() => setConfirm(null)}
           onConfirm={() => { void setActive(confirm.id === "__main__" ? "__main__" : confirm.id); }}
         />
diff --git a/gui/src/components/codex-account-pool-cards.tsx b/gui/src/components/codex-account-pool-cards.tsx
index 8accb3d87d..14a68b9e25 100644
--- a/gui/src/components/codex-account-pool-cards.tsx
+++ b/gui/src/components/codex-account-pool-cards.tsx
@@ -1,6 +1,7 @@
 import { useT } from "../i18n/shared";
 import { IconAlert, IconPause, IconPlay, IconX } from "../icons";
 import { displayAccountId } from "../lib/privacy";
+import AccountPriorityControl, { AccountPriorityBadge } from "./AccountPriorityControl";
 import type { CodexAccountEntry } from "./codex-account-pool-types";
 import type { CodexAccountModeState } from "../codex-multi-state";
 import QuotaBars from "./QuotaBars";
@@ -26,6 +27,10 @@ export function CodexAccountPoolCards({
   onTogglePause,
   pauseUpdatingId,
   pauseBusy,
+  onPriorityChange,
+  priorityUpdatingId,
+  switchingId,
+  pinnedId = null,
   onReauth,
   onEditAlias,
   onRemove,
@@ -42,6 +47,17 @@ export function CodexAccountPoolCards({
   onTogglePause: (account: CodexAccountEntry) => void;
   pauseUpdatingId: string | null;
   pauseBusy: boolean;
+  onPriorityChange: (account: CodexAccountEntry, priority: number) => void;
+  priorityUpdatingId: string | null;
+  /** In-flight manual switch, which writes the same pin an order write clears. */
+  switchingId: string | null;
+  /**
+   * The account an operator pinned by hand, which is not always the selected one: under
+   * round-robin and fill-first the pin caps selection at its own tier while the cursor
+   * moves inside that tier. Marking the pinned card rather than the selected one keeps the
+   * badge on the account the operator actually chose.
+   */
+  pinnedId?: string | null;
   onReauth: (id: string) => void;
   onEditAlias: (account: CodexAccountEntry) => void;
   onRemove: (id: string) => void;
@@ -71,6 +87,8 @@ export function CodexAccountPoolCards({
                   {t("codexAuth.paused")}
                 </span>
               )}
+              <AccountPriorityBadge value={a.priority} />
+              {a.id === pinnedId && !a.paused && <span className="badge badge-muted">{t("codexAuth.pinned")}</span>}
               <CodexTicketBadge t={t} account={a} onClick={() => onOpenReset(a)} />
               {healthLabel && (
                 <span className={oauthHealthBadgeClass(healthStatus)}>{healthLabel}</span>
@@ -132,6 +150,18 @@ export function CodexAccountPoolCards({
           {inCooldown && (
             <div className="card-sub faint">{t("pws.healthCooldownHint")}</div>
           )}
+          {a.id === pinnedId && !a.paused && <div className="card-sub faint">{t("codexAuth.pinnedHint")}</div>}
+          <AccountPriorityControl
+            value={a.priority}
+            selectId={`codex-account-priority-${a.id}`}
+            // Every row, not just the one being written: the controller serializes order
+            // writes behind one mutation ref, so a second row's pick would come back "busy"
+            // and be dropped with no toast. Same global lock the pause button uses.
+            // A pending switch counts too — it writes the same pin this clears, so the
+            // controller refuses to overlap them, and that refusal is equally silent.
+            disabled={priorityUpdatingId !== null || switchingId !== null}
+            onChange={(priority) => onPriorityChange(a, priority)}
+          />
           {showReauth
             ? <div className="card-sub faint">{t("codexAuth.tokenExpired")}</div>
             : !inCooldown && (
diff --git a/gui/src/components/codex-account-pool-main-card.tsx b/gui/src/components/codex-account-pool-main-card.tsx
index c08423b95e..abde0c9125 100644
--- a/gui/src/components/codex-account-pool-main-card.tsx
+++ b/gui/src/components/codex-account-pool-main-card.tsx
@@ -1,5 +1,6 @@
 import type { ReactNode } from "react";
 import { IconLock, IconPause, IconPlay, IconPlus, IconRefresh, IconTicket } from "../icons";
+import AccountPriorityControl, { AccountPriorityBadge } from "./AccountPriorityControl";
 import QuotaBars from "./QuotaBars";
 import { CodexPauseToggleLabel, CodexTicketBadge } from "./codex-account-pool-helpers";
 import type { CodexAccountEntry } from "./codex-account-pool-types";
@@ -26,6 +27,10 @@ export function CodexAccountPoolMainCard({
   onTogglePause,
   pauseUpdatingId,
   pauseBusy,
+  onPriorityChange,
+  priorityUpdatingId,
+  switchingId,
+  pinnedId = null,
   onOpenReset,
   onCopyDoctor,
   doctorCopyOutcomeFor,
@@ -40,6 +45,16 @@ export function CodexAccountPoolMainCard({
   onTogglePause: (entry: CodexAccountEntry) => void;
   pauseUpdatingId: string | null;
   pauseBusy: boolean;
+  onPriorityChange: (entry: CodexAccountEntry, priority: number) => void;
+  priorityUpdatingId: string | null;
+  /** In-flight manual switch, which writes the same pin an order write clears. */
+  switchingId: string | null;
+  /**
+   * The account carrying the pin, which is not always the one routing is on: the pin caps
+   * selection at its own tier, and under round-robin or fill-first the cursor still moves
+   * within that tier. Badge the account the operator chose, not wherever routing landed.
+   */
+  pinnedId?: string | null;
   onOpenReset: (account: CodexAccountEntry) => void;
   onCopyDoctor?: (accountId: string) => void;
   doctorCopyOutcomeFor?: (accountId: string) => "copied" | "unavailable" | null;
@@ -52,6 +67,7 @@ export function CodexAccountPoolMainCard({
     plan: main?.plan,
     isMain: true,
     paused: main?.paused ?? false,
+    priority: main?.priority ?? 0,
     hasCredential: true,
     quota: main?.quota ?? null,
   };
@@ -74,6 +90,8 @@ export function CodexAccountPoolMainCard({
               {t("codexAuth.paused")}
             </span>
           )}
+          <AccountPriorityBadge value={mainSwitchEntry.priority} />
+          {pinnedId === "__main__" && !main?.paused && <span className="badge badge-muted">{t("codexAuth.pinned")}</span>}
           {healthLabel && (
             <span className={oauthHealthBadgeClass(main?.health?.status)}>{healthLabel}</span>
           )}
@@ -122,6 +140,23 @@ export function CodexAccountPoolMainCard({
       {inCooldown && (
         <div className="card-sub faint">{t("pws.healthCooldownHint")}</div>
       )}
+      {pinnedId === "__main__" && !main?.paused && <div className="card-sub faint">{t("codexAuth.pinnedHint")}</div>}
+      {/* Same rule as the pause button: without an app login there is no row to re-order. */}
+      {main && (
+        <AccountPriorityControl
+          value={mainSwitchEntry.priority}
+          // Derived from the synthesized id rather than hardcoded as "-main": a pool account
+          // may legitimately be named `main` (the id pattern allows it), and that account's
+          // control would then claim the same DOM id, pointing this label at its dropdown.
+          selectId={`codex-account-priority-${mainSwitchEntry.id}`}
+          // Any in-flight order write, not just this card's: order writes share one mutation
+          // ref, so a pick made during another card's write returns "busy" and is dropped
+          // silently. Mirrors pauseBusy. A pending switch counts too — it writes the same
+          // pin this clears, so the controller refuses to overlap them, just as silently.
+          disabled={priorityUpdatingId !== null || switchingId !== null}
+          onChange={(priority) => onPriorityChange(mainSwitchEntry, priority)}
+        />
+      )}
       {showReauth
         ? <div className="card-sub faint">{t("codexAuth.mainTokenExpired")}</div>
         : !inCooldown && (
diff --git a/gui/src/components/codex-account-switch-modal.tsx b/gui/src/components/codex-account-switch-modal.tsx
index 629b79c94a..3c87f0500b 100644
--- a/gui/src/components/codex-account-switch-modal.tsx
+++ b/gui/src/components/codex-account-switch-modal.tsx
@@ -9,6 +9,7 @@ export function CodexAccountSwitchModal({
   mainEmail,
   accountModeState,
   switchingId,
+  orderBusy = false,
   onCancel,
   onConfirm,
 }: {
@@ -16,6 +17,12 @@ export function CodexAccountSwitchModal({
   mainEmail?: string;
   accountModeState: CodexAccountModeState | null;
   switchingId: string | null;
+  /**
+   * An in-flight selection-order write. It clears the pin this switch would set, so the
+   * controller refuses to run the two together and drops the loser without a toast --
+   * the button has to be unavailable rather than silently ineffective.
+   */
+  orderBusy?: boolean;
   onCancel: () => void;
   onConfirm: () => void;
 }) {
@@ -59,7 +66,7 @@ export function CodexAccountSwitchModal({
         )}
         <div className="modal-actions">
           <button type="button" className="btn btn-ghost" onClick={onCancel}>{t("codexAuth.cancel")}</button>
-          <button type="button" className="btn btn-primary" disabled={Boolean(switchingId)} onClick={onConfirm}>
+          <button type="button" className="btn btn-primary" disabled={Boolean(switchingId) || orderBusy} onClick={onConfirm}>
             {switchingId ? t("pws.accountSwitching") : t(accountModeState === "direct" ? "codexAuth.prepareForPool" : "codexAuth.setAsNext")}
           </button>
         </div>
diff --git a/gui/src/hooks/useCodexAccountPool.ts b/gui/src/hooks/useCodexAccountPool.ts
index 9f610f9d60..ec846ab2f3 100644
--- a/gui/src/hooks/useCodexAccountPool.ts
+++ b/gui/src/hooks/useCodexAccountPool.ts
@@ -1,4 +1,5 @@
 import { useCallback, useEffect, useRef, useState } from "react";
+import { normalizeAccountPriority } from "../account-priority";
 import { extractAutoSwitchThresholdPayload } from "../codex-auto-switch";
 import type { AccountQuota } from "../codex-quota-utils";
 import { accountNeedsReauth } from "../oauth-health-display";
@@ -24,6 +25,8 @@ export interface CodexAccountEntry {
   isMain: boolean;
   /** Persisted routing exclusion. Paused accounts remain visible but cannot be selected. */
   paused: boolean;
+  /** Selection order; higher is used earlier. Always present, 0 when unset. */
+  priority: number;
   hasCredential: boolean;
   quota: AccountQuota | null;
   needsReauth?: boolean;
@@ -67,12 +70,21 @@ export interface CodexAccountPoolController {
   initialLoading: boolean;
   switchingId: string | null;
   pauseUpdatingId: string | null;
+  priorityUpdatingId: string | null;
   pausingExhausted: boolean;
   activeNeedsReauth: boolean;
+  /**
+   * The account carrying the pin, which is not always the active one: under round-robin
+   * and fill-first the pin caps selection at its own tier while the cursor moves inside
+   * that tier. Drives the badge so it stays on the account the operator chose.
+   */
+  activePinnedId: string | null;
 
   load(refreshQuota?: boolean): Promise<boolean>;
   switchAccount(id: string | null): Promise<CodexAccountActionResult<{ activeId: string | null }>>;
   setAccountPaused(id: string, paused: boolean): Promise<CodexAccountActionResult>;
+  /** `null` resets the account to the default order. Accepts the `__main__` sentinel. */
+  setAccountPriority(id: string, priority: number | null): Promise<CodexAccountActionResult>;
   pauseExhaustedAccounts(): Promise<CodexAccountActionResult<{ pausedCount: number }>>;
   saveAlias(id: string, alias: string): Promise<CodexAccountActionResult>;
   removeAccount(id: string): Promise<CodexAccountActionResult>;
@@ -99,7 +111,9 @@ export function useCodexAccountPool(apiBase: string, enabled = true): CodexAccou
   const [loadState, setLoadState] = useState<CodexAccountLoadState>(() => (seed != null ? "ready" : "loading"));
   const [switchingId, setSwitchingId] = useState<string | null>(null);
   const [pauseUpdatingId, setPauseUpdatingId] = useState<string | null>(null);
+  const [priorityUpdatingId, setPriorityUpdatingId] = useState<string | null>(null);
   const [pausingExhausted, setPausingExhausted] = useState(false);
+  const [activePinnedId, setActivePinnedId] = useState<string | null>(null);
   // A counter, not a boolean: the initial load, the 30s poll, quota-fill retries and explicit
   // actions can all be in flight together, and an older one settling must not clear the
   // indicator while a newer forced refresh is still running.
@@ -131,6 +145,9 @@ export function useCodexAccountPool(apiBase: string, enabled = true): CodexAccou
   // polls do not flip the UI back to the cold skeleton.
   const hasLoadedRef = useRef(seed != null);
   const pauseMutationRef = useRef<"bulk" | { accountId: string } | null>(null);
+  // Its own gate, deliberately not the pause one: re-ordering one account and pausing
+  // another are independent writes, and a shared ref would make either reject the other.
+  const priorityMutationRef = useRef<{ accountId: string } | null>(null);
 
   const subscribeLoadObserver = useCallback((observer: CodexAccountLoadObserver) => {
     observersRef.current!.add(observer);
@@ -173,7 +190,12 @@ export function useCodexAccountPool(apiBase: string, enabled = true): CodexAccou
           if (!response.ok) throw new Error("account load failed");
           const payload = await response.json();
           if (loadGenerationRef.current === generation) {
-            nextAccounts = (payload.accounts ?? []) as CodexAccountEntry[];
+            // Selection order is required downstream (badge, select). Normalizing here keeps
+            // a payload without it from rendering a NaN order on every card.
+            nextAccounts = ((payload.accounts ?? []) as CodexAccountEntry[]).map(account => ({
+              ...account,
+              priority: normalizeAccountPriority(account.priority),
+            }));
             setAccounts(nextAccounts);
             hasAccountsRef.current = nextAccounts.length > 0;
             hasLoadedRef.current = true;
@@ -202,6 +224,7 @@ export function useCodexAccountPool(apiBase: string, enabled = true): CodexAccou
               setActiveId(serverActiveId);
             }
             lastActiveRef.current = { value: active };
+            setActivePinnedId(typeof active.pinnedAccountId === "string" ? active.pinnedAccountId : null);
             for (const observer of observers) {
               observer.acceptActiveRead(active, revisions.get(observer)!);
             }
@@ -295,7 +318,10 @@ export function useCodexAccountPool(apiBase: string, enabled = true): CodexAccou
   }, []);
 
   const switchAccount = useCallback(async (id: string | null) => {
-    if (switchingRef.current) return { ok: false, reason: "busy" } as const;
+    // Cross-gated with the order write, not just with itself: both PUTs move the pin,
+    // and in opposite directions, so letting them overlap lets the client settle on
+    // the inverse of the server's final pin until a reload happens to correct it.
+    if (switchingRef.current || priorityMutationRef.current) return { ok: false, reason: "busy" } as const;
     switchingRef.current = id ?? "__main__";
     setSwitchingId(id ?? "__main__");
     try {
@@ -309,6 +335,10 @@ export function useCodexAccountPool(apiBase: string, enabled = true): CodexAccou
       const selectedId = result.activeCodexAccountId ?? id;
       pendingActiveIdRef.current = { id: selectedId ?? null };
       setActiveId(selectedId ?? null);
+      // A manual selection pins its target until the account drains or routing moves off
+      // it. The badge follows the id, not /active's `pinned` boolean, so a same-tier
+      // sibling's turn does not make the operator's choice look released.
+      setActivePinnedId(selectedId ?? "__main__");
       // Reconcile in the background: the switch is already accepted upstream, so a slow
       // reload must not hold the caller's confirmation dialog open.
       void load();
@@ -359,6 +389,11 @@ export function useCodexAccountPool(apiBase: string, enabled = true): CodexAccou
         pendingActiveIdRef.current = { id: nextActiveId };
         setActiveId(nextActiveId);
       }
+      // Deliberately NOT cross-gated against the switch and order writes, even though
+      // pausing the pinned account also releases the pin. This edge is conditional on
+      // the pin still naming `id`, which makes it order-robust: whichever response
+      // lands last, the client agrees with the server.
+      if (paused) setActivePinnedId(current => current === id ? null : current);
       void load();
       return { ok: true } as const;
     } catch {
@@ -369,6 +404,50 @@ export function useCodexAccountPool(apiBase: string, enabled = true): CodexAccou
     }
   }, [apiBase, load]);
 
+  const setAccountPriority = useCallback(async (id: string, priority: number | null) => {
+    // The other half of the cross-gate in switchAccount: an order write clears the
+    // pin that a switch sets, so the two cannot be in flight together.
+    if (priorityMutationRef.current || switchingRef.current) return { ok: false, reason: "busy" } as const;
+    priorityMutationRef.current = { accountId: id };
+    setPriorityUpdatingId(id);
+    try {
+      const response = await fetch(`${apiBase}/api/codex-auth/accounts/priority`, {
+        method: "PUT",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ id, priority }),
+      });
+      // A rejected write leaves the row alone, so the card snaps back to the last
+      // confirmed order instead of showing a value the server never accepted.
+      if (!response.ok) return { ok: false, reason: "request" } as const;
+      const raw = await response.json().catch(() => ({}));
+      const result = (raw && typeof raw === "object" ? raw : {}) as { priority?: unknown };
+      const stored = normalizeAccountPriority(result.priority ?? priority);
+      setAccounts(current => current.map(account => (
+        account.id === id || (id === "__main__" && account.isMain)
+          ? { ...account, priority: stored }
+          : account
+      )));
+      // Every accepted order write releases the manual pin, even when the numeric
+      // value was unchanged. Do not depend on the follow-up read to hide the badge.
+      setActivePinnedId(null);
+      // A pending marker left over from an earlier switch has to go. It exists to
+      // hold the accepted account until a matching `/active` read arrives, and any
+      // read that disagrees is treated as stale — which never clears the marker.
+      // This write is newer than the switch: it releases the pin the switch set, so
+      // the account the switch named is no longer the one routing has to agree with.
+      // The switch's own in-flight reload cannot win the race either —
+      // `loadGenerationRef` discards a response from any generation but the latest.
+      pendingActiveIdRef.current = null;
+      void load();
+      return { ok: true } as const;
+    } catch {
+      return { ok: false, reason: "request" } as const;
+    } finally {
+      priorityMutationRef.current = null;
+      setPriorityUpdatingId(null);
+    }
+  }, [apiBase, load]);
+
   const pauseExhaustedAccounts = useCallback(async () => {
     if (pauseMutationRef.current) return { ok: false, reason: "busy" } as const;
     pauseMutationRef.current = "bulk";
@@ -393,6 +472,9 @@ export function useCodexAccountPool(apiBase: string, enabled = true): CodexAccou
         pendingActiveIdRef.current = { id: nextActiveId };
         setActiveId(nextActiveId);
       }
+      // Conditional for the same reason as the single-account pause above: clearing
+      // outright would race the switch and order writes.
+      setActivePinnedId(current => current !== null && pausedIds.has(current) ? null : current);
       void load();
       return { ok: true, pausedCount: result.pausedCount ?? pausedIds.size } as const;
     } catch {
@@ -438,11 +520,14 @@ export function useCodexAccountPool(apiBase: string, enabled = true): CodexAccou
     initialLoading: !firstAttemptSettled,
     switchingId,
     pauseUpdatingId,
+    priorityUpdatingId,
     pausingExhausted,
     activeNeedsReauth,
+    activePinnedId,
     load,
     switchAccount,
     setAccountPaused,
+    setAccountPriority,
     pauseExhaustedAccounts,
     saveAlias,
     removeAccount,
diff --git a/gui/src/i18n/de.ts b/gui/src/i18n/de.ts
index a4d633e10a..b104d5c029 100644
--- a/gui/src/i18n/de.ts
+++ b/gui/src/i18n/de.ts
@@ -878,6 +878,8 @@ export const de: Record<TKey, string> = {
   "codexAuth.pauseFailed": "{email} konnte nicht pausiert werden. Es wurde nichts geändert.",
   "codexAuth.resumeFailed": "{email} konnte nicht fortgesetzt werden. Es wurde nichts geändert.",
   "codexAuth.pausedHint": "Bis zur Fortsetzung von automatischem Wechsel, Wiederholungen, Cooldown-Wiederherstellung und manueller Auswahl ausgeschlossen.",
+  "codexAuth.pinned": "ANGEHEFTET",
+  "codexAuth.pinnedHint": "Du hast dieses Konto von Hand ausgewählt, daher geht eine höhere Auswahlreihenfolge nicht daran vorbei. Die Fixierung gilt, bis dieses Konto aufgebraucht ist, du ein anderes auswählst oder du eine Auswahlreihenfolge änderst.",
   "codexAuth.fiveHour": "5 Std.",
   "codexAuth.weekly": "Woche",
   "codexAuth.monthly": "30d",
@@ -891,12 +893,12 @@ export const de: Record<TKey, string> = {
   "codexAuth.prepareForPool": "Für Pool vorbereiten",
   "codexAuth.poolPreparedToast": "{email} ist für den Pool-Modus vorbereitet",
   "codexAuth.switchTitle": "Aktives Konto wechseln?",
-  "codexAuth.switchDesc": "Dies gilt für die nächste Anfrage bestehender und neuer Codex-Sitzungen. Laufende Anfragen behalten ihr Konto.",
-  "codexAuth.cacheWarning": "OpenCodex spielt den Gesprächskontext nach jedem Kontowechsel erneut ab, aber der providerseitige Prompt-Cache kann kalt sein.",
-  "codexAuth.setAsNext": "Konto auswählen",
+  "codexAuth.switchDesc": "Wird sofort wirksam. Bereits laufende Anfragen behalten ihr Konto; alles andere wechselt zu diesem Konto, wobei Konten mit derselben Auswahlreihenfolge sich weiterhin abwechseln.",
+  "codexAuth.cacheWarning": "Prompt-Cache wird beim Kontowechsel zurückgesetzt. Neue Sitzung startet mit leerem Cache.",
+  "codexAuth.setAsNext": "Dieses Konto als Nächstes verwenden",
   "codexAuth.cancel": "Abbrechen",
   "codexAuth.switchBack": "Zurück zum Hauptkonto?",
-  "codexAuth.switchBackDesc": "Die nächste Anfrage bestehender und neuer Codex-Sitzungen verwendet dein App-Login-Konto.",
+  "codexAuth.switchBackDesc": "Wird sofort wirksam. Bereits laufende Anfragen behalten ihr Konto; alles andere wechselt zu deinem App-Login-Konto, wobei Konten mit derselben Auswahlreihenfolge sich weiterhin abwechseln.",
   "codexAuth.autoSwitch": "Proaktiver Wechsel nach Nutzung",
   "codexAuth.autoSwitchQuotaDesc": "Kontingent: Ab {threshold} % Nutzung kann die nächste Anfrage zu einem geeigneten Konto mit geringerer Nutzung wechseln, auch bei einer bereits gebundenen Aufgabe; Go/Free nutzen nur 30 Tage.",
   "codexAuth.autoSwitchQuotaOffDesc": "Der proaktive Wechsel nach Nutzung ist aus. Zuweisung neuer/ungebundener Aufgaben und Fehlerbehebung bleiben aktiv.",
@@ -909,6 +911,7 @@ export const de: Record<TKey, string> = {
   "codexAuth.autoSwitchThresholdInc": "Nutzungsschwelle erhöhen",
   "codexAuth.autoSwitchThresholdDec": "Nutzungsschwelle verringern",
   "codexAuth.autoSwitchLoadFailed": "Die Einstellung für den nutzungsbasierten Wechsel konnte nicht geladen werden.",
+
   "codexAuth.autoSwitchThresholdInvalid": "Gib eine ganze Zahl von 1 bis 100 ein",
   "codexAuth.autoSwitchUpdated": "Der proaktive Wechsel nach Nutzung wurde aktualisiert",
   "codexAuth.autoSwitchUpdateFailed": "Die Aktualisierung des nutzungsbasierten Wechsels konnte nicht bestätigt werden. Der zuletzt bestätigte Wert wird angezeigt.",
@@ -949,6 +952,19 @@ export const de: Record<TKey, string> = {
   "accountPool.stickyLimitInvalid": "Gib eine ganze Zahl von 1 bis 100 ein",
   "accountPool.strategyLoadFailed": "Rotationsstrategie konnte nicht geladen werden.",
   "accountPool.strategyUpdateFailed": "Rotationsstrategie konnte nicht gespeichert werden.",
+
+  "accountPool.priority": "Auswahlreihenfolge",
+  "accountPool.priorityAria": "Auswahlreihenfolge für dieses Konto",
+  "accountPool.priorityHint": "Höhere Zahlen werden zuerst verwendet. Der Pool geht erst zu einer niedrigeren Zahl über, wenn alle Konten darüber aufgebraucht oder nicht verfügbar sind.",
+  "accountPool.priorityFirst": "Zuerst",
+  "accountPool.priorityEarlier": "Früher",
+  "accountPool.priorityNormal": "Normal",
+  "accountPool.priorityLater": "Später",
+  "accountPool.priorityLast": "Zuletzt",
+  "accountPool.priorityOption": "{name} ({value})",
+  "accountPool.priorityCustom": "Benutzerdefiniert",
+  "accountPool.priorityUpdated": "Auswahlreihenfolge für {email} aktualisiert",
+  "accountPool.priorityUpdateFailed": "Die Auswahlreihenfolge für {email} konnte nicht gespeichert werden. Der zuletzt bestätigte Wert wird angezeigt.",
   "codexAuth.switched": "{email} ist für die nächste Anfrage ausgewählt",
   "codexAuth.loadFailed": "Die Codex-Kontoeinstellungen konnten nicht geladen werden.",
   "codexAuth.switchFailed": "Das Konto konnte nicht gewechselt werden. Die vorherige Auswahl bleibt erhalten.",
diff --git a/gui/src/i18n/en.ts b/gui/src/i18n/en.ts
index df67c75023..b1d0b6cb89 100644
--- a/gui/src/i18n/en.ts
+++ b/gui/src/i18n/en.ts
@@ -1333,6 +1333,8 @@ export const en = {
   "codexAuth.pauseFailed": "Could not pause {email}. Nothing was changed.",
   "codexAuth.resumeFailed": "Could not resume {email}. Nothing was changed.",
   "codexAuth.pausedHint": "Excluded from automatic switching, retries, cooldown recovery, and manual selection until resumed.",
+  "codexAuth.pinned": "PINNED",
+  "codexAuth.pinnedHint": "You selected this account by hand, so a higher selection order will not move past it. The pin lasts until this account is drained, you select another, or you change any selection order.",
   "codexAuth.fiveHour": "5h",
   "codexAuth.weekly": "Week",
   "codexAuth.monthly": "30d",
@@ -1346,12 +1348,12 @@ export const en = {
   "codexAuth.prepareForPool": "Prepare for Pool",
   "codexAuth.poolPreparedToast": "{email} is prepared for Pool mode",
   "codexAuth.switchTitle": "Switch active account?",
-  "codexAuth.switchDesc": "This applies to the next request from existing and new Codex sessions. In-flight requests keep their captured account.",
-  "codexAuth.cacheWarning": "OpenCodex replays the conversation after any account change, but the provider-side prompt cache may be cold.",
-  "codexAuth.setAsNext": "Select Account",
+  "codexAuth.switchDesc": "Takes effect immediately. Existing account-affine threads and requests already in flight keep their captured account; new or unbound requests use the selected account's order tier, and accounts at the same selection order still take turns.",
+  "codexAuth.cacheWarning": "Prompt cache resets on account switch. New session starts with empty cache.",
+  "codexAuth.setAsNext": "Use this account next",
   "codexAuth.cancel": "Cancel",
   "codexAuth.switchBack": "Switch back to Main?",
-  "codexAuth.switchBackDesc": "The next request from existing and new Codex sessions will use your App login account.",
+  "codexAuth.switchBackDesc": "Takes effect immediately. Existing account-affine threads and requests already in flight keep their captured account; new or unbound requests use your App login account's order tier, and accounts at the same selection order still take turns.",
   "codexAuth.autoSwitch": "Usage-based proactive switching",
   "codexAuth.autoSwitchQuotaDesc": "Quota: at {threshold}% usage or above, the next request may move to a lower-usage eligible account, including an already-bound task; Go/Free use 30d only.",
   "codexAuth.autoSwitchQuotaOffDesc": "Usage-based proactive switching is off. New/unbound assignment and failure recovery still apply.",
@@ -1406,6 +1408,21 @@ export const en = {
   "accountPool.strategyLoadFailed": "Rotation strategy could not be loaded.",
   "accountPool.strategyUpdateFailed": "Rotation strategy could not be saved.",
 
+  // Selection order. User-visible copy stays in sequence words (first/earlier/later/last);
+  // only identifiers use the internal "priority" name.
+  "accountPool.priority": "Selection order",
+  "accountPool.priorityAria": "Selection order for this account",
+  "accountPool.priorityHint": "Higher numbers are used first. The pool moves to a lower number only when every account above it is drained or unavailable.",
+  "accountPool.priorityFirst": "First",
+  "accountPool.priorityEarlier": "Earlier",
+  "accountPool.priorityNormal": "Normal",
+  "accountPool.priorityLater": "Later",
+  "accountPool.priorityLast": "Last",
+  "accountPool.priorityOption": "{name} ({value})",
+  "accountPool.priorityCustom": "Custom",
+  "accountPool.priorityUpdated": "Selection order updated for {email}",
+  "accountPool.priorityUpdateFailed": "Selection order for {email} could not be saved. The last confirmed value is shown.",
+
   "codexAuth.switched": "{email} is selected for the next request",
   "codexAuth.loadFailed": "Codex account settings could not be loaded.",
   "codexAuth.switchFailed": "The account could not be switched. Your previous selection is unchanged.",
diff --git a/gui/src/i18n/ja.ts b/gui/src/i18n/ja.ts
index eb98a71eb6..81e0bc0fc6 100644
--- a/gui/src/i18n/ja.ts
+++ b/gui/src/i18n/ja.ts
@@ -1281,6 +1281,8 @@ export const ja: Record<TKey, string> = {
   "codexAuth.pauseFailed": "{email} を一時停止できませんでした。変更はありません。",
   "codexAuth.resumeFailed": "{email} を再開できませんでした。変更はありません。",
   "codexAuth.pausedHint": "再開するまで、自動切り替え、再試行、クールダウン復旧、手動選択の対象外です。",
+  "codexAuth.pinned": "固定中",
+  "codexAuth.pinnedHint": "手動で選択したアカウントなので、これより高い選択順序が先に使われることはありません。固定はこのアカウントを使い切るか、別のアカウントを選ぶか、いずれかの選択順序を変更するまで続きます。",
   "codexAuth.fiveHour": "5時間",
   "codexAuth.weekly": "週",
   "codexAuth.monthly": "30日",
@@ -1294,12 +1296,12 @@ export const ja: Record<TKey, string> = {
   "codexAuth.prepareForPool": "プール用に準備",
   "codexAuth.poolPreparedToast": "{email} はプールモード用に準備されました",
   "codexAuth.switchTitle": "アクティブアカウントを切り替えますか?",
-  "codexAuth.switchDesc": "既存および新規 Codex セッションの次のリクエストから適用されます。処理中のリクエストは現在のアカウントを維持します。",
-  "codexAuth.cacheWarning": "アカウントが変わっても OpenCodex は会話コンテキストを再生しますが、プロバイダー側のプロンプトキャッシュは再ウォームアップが必要な場合があります。",
-  "codexAuth.setAsNext": "アカウントを選択",
+  "codexAuth.switchDesc": "すぐに反映されます。アカウントに紐付いた既存スレッドと処理中のリクエストは現在のアカウントを維持し、新規または未紐付けのリクエストは選択したアカウントの順序ティアを使います。同じ選択順序のアカウントは引き続き交代で使われます。",
+  "codexAuth.cacheWarning": "アカウント切り替えでプロンプトキャッシュはリセットされます。新規セッションは空のキャッシュで開始します。",
+  "codexAuth.setAsNext": "このアカウントを次に使う",
   "codexAuth.cancel": "キャンセル",
   "codexAuth.switchBack": "メインに戻しますか?",
-  "codexAuth.switchBackDesc": "既存および新規 Codex セッションの次のリクエストからアプリログインアカウントを使用します。",
+  "codexAuth.switchBackDesc": "すぐに反映されます。アカウントに紐付いた既存スレッドと処理中のリクエストは現在のアカウントを維持し、新規または未紐付けのリクエストはアプリログインアカウントの順序ティアを使います。同じ選択順序のアカウントは引き続き交代で使われます。",
   "codexAuth.autoSwitch": "使用量ベースのプロアクティブ切り替え",
   "codexAuth.autoSwitchQuotaDesc": "クォータ: 使用率が {threshold}% 以上になると、既に紐付いたタスクを含む次のリクエストが、使用率の低い適格アカウントへ移る場合があります。Go/Free は 30 日枠のみを使用します。",
   "codexAuth.autoSwitchQuotaOffDesc": "使用量ベースのプロアクティブ切り替えはオフです。新規/未紐付けタスクの割り当てと障害回復は引き続き適用されます。",
@@ -1312,6 +1314,7 @@ export const ja: Record<TKey, string> = {
   "codexAuth.autoSwitchThresholdInc": "使用量しきい値を上げる",
   "codexAuth.autoSwitchThresholdDec": "使用量しきい値を下げる",
   "codexAuth.autoSwitchLoadFailed": "使用量ベースの切り替え設定を読み込めませんでした。",
+
   "codexAuth.autoSwitchThresholdInvalid": "1 から 100 までの整数を入力してください",
   "codexAuth.autoSwitchUpdated": "使用量ベースのプロアクティブ切り替え設定を更新しました",
   "codexAuth.autoSwitchUpdateFailed": "使用量ベースの切り替え更新を確認できませんでした。最後に確認された値を表示しています。",
@@ -1352,6 +1355,19 @@ export const ja: Record<TKey, string> = {
   "accountPool.stickyLimitInvalid": "1 から 100 までの整数を入力してください",
   "accountPool.strategyLoadFailed": "ローテーション戦略を読み込めませんでした。",
   "accountPool.strategyUpdateFailed": "ローテーション戦略を保存できませんでした。",
+
+  "accountPool.priority": "選択順序",
+  "accountPool.priorityAria": "このアカウントの選択順序",
+  "accountPool.priorityHint": "数値が大きいほど先に使われます。上位のアカウントがすべて使い切られるか利用できなくなったときにのみ、より小さい数値へ移ります。",
+  "accountPool.priorityFirst": "最初",
+  "accountPool.priorityEarlier": "早め",
+  "accountPool.priorityNormal": "標準",
+  "accountPool.priorityLater": "遅め",
+  "accountPool.priorityLast": "最後",
+  "accountPool.priorityOption": "{name}（{value}）",
+  "accountPool.priorityCustom": "カスタム",
+  "accountPool.priorityUpdated": "{email} の選択順序を更新しました",
+  "accountPool.priorityUpdateFailed": "{email} の選択順序を保存できませんでした。最後に確認された値を表示しています。",
   "codexAuth.switched": "次のリクエストでは {email} を使用します",
   "codexAuth.loadFailed": "Codex アカウント設定を読み込めませんでした。",
   "codexAuth.switchFailed": "アカウントを切り替えられませんでした。以前の選択はそのままです。",
diff --git a/gui/src/i18n/ko.ts b/gui/src/i18n/ko.ts
index 339cdbe970..59c885ea23 100644
--- a/gui/src/i18n/ko.ts
+++ b/gui/src/i18n/ko.ts
@@ -902,6 +902,8 @@ export const ko: Record<TKey, string> = {
   "codexAuth.pauseFailed": "{email} 계정을 일시 중지하지 못했습니다. 변경 사항이 없습니다.",
   "codexAuth.resumeFailed": "{email} 계정을 재개하지 못했습니다. 변경 사항이 없습니다.",
   "codexAuth.pausedHint": "재개할 때까지 자동 전환, 재시도, 쿨다운 복구 및 수동 선택에서 제외됩니다.",
+  "codexAuth.pinned": "고정됨",
+  "codexAuth.pinnedHint": "직접 선택한 계정이므로 더 높은 선택 순서가 이 계정을 앞지르지 않습니다. 고정은 이 계정이 소진되거나, 다른 계정을 선택하거나, 어떤 계정이든 선택 순서를 변경할 때까지 유지됩니다.",
   "codexAuth.fiveHour": "5시간",
   "codexAuth.weekly": "주간",
   "codexAuth.monthly": "30일",
@@ -915,12 +917,12 @@ export const ko: Record<TKey, string> = {
   "codexAuth.prepareForPool": "풀 모드용으로 준비",
   "codexAuth.poolPreparedToast": "{email} 계정을 풀 모드용으로 준비했습니다",
   "codexAuth.switchTitle": "활성 계정을 변경하시겠습니까?",
-  "codexAuth.switchDesc": "기존 세션과 새 세션의 다음 요청부터 적용됩니다. 진행 중인 요청은 기존 계정을 유지합니다.",
-  "codexAuth.cacheWarning": "계정이 바뀌어도 OpenCodex는 대화 문맥을 재생하지만, 프로바이더 측 프롬프트 캐시는 다시 예열해야 할 수 있습니다.",
-  "codexAuth.setAsNext": "계정 선택",
+  "codexAuth.switchDesc": "즉시 적용됩니다. 계정에 바인딩된 기존 스레드와 이미 진행 중인 요청은 기존 계정을 유지하고, 새 요청이나 바인딩 없는 요청은 선택한 계정의 순서 티어를 사용합니다. 같은 선택 순서의 계정은 계속 번갈아 사용됩니다.",
+  "codexAuth.cacheWarning": "계정 전환 시 프롬프트 캐시가 초기화됩니다.",
+  "codexAuth.setAsNext": "이 계정을 다음에 사용",
   "codexAuth.cancel": "취소",
   "codexAuth.switchBack": "메인 계정으로 돌아가시겠습니까?",
-  "codexAuth.switchBackDesc": "기존 세션과 새 세션의 다음 요청부터 앱 로그인 계정을 사용합니다.",
+  "codexAuth.switchBackDesc": "즉시 적용됩니다. 계정에 바인딩된 기존 스레드와 이미 진행 중인 요청은 기존 계정을 유지하고, 새 요청이나 바인딩 없는 요청은 앱 로그인 계정의 순서 티어를 사용합니다. 같은 선택 순서의 계정은 계속 번갈아 사용됩니다.",
   "codexAuth.autoSwitch": "사용량 기반 선제 전환",
   "codexAuth.autoSwitchQuotaDesc": "할당량: 사용량이 {threshold}% 이상이면 이미 바인딩된 작업을 포함해 다음 요청이 사용량이 더 낮은 적격 계정으로 이동할 수 있습니다. Go/Free는 30일만 봅니다.",
   "codexAuth.autoSwitchQuotaOffDesc": "사용량 기반 선제 전환이 꺼져 있습니다. 새 작업/바인딩 없는 작업 배정과 실패 복구는 계속 적용됩니다.",
@@ -933,6 +935,7 @@ export const ko: Record<TKey, string> = {
   "codexAuth.autoSwitchThresholdInc": "사용량 임계값 증가",
   "codexAuth.autoSwitchThresholdDec": "사용량 임계값 감소",
   "codexAuth.autoSwitchLoadFailed": "사용량 기반 전환 설정을 불러오지 못했습니다.",
+
   "codexAuth.autoSwitchThresholdInvalid": "1~100 사이의 정수를 입력하세요",
   "codexAuth.autoSwitchUpdated": "사용량 기반 선제 전환 설정을 저장했습니다",
   "codexAuth.autoSwitchUpdateFailed": "사용량 기반 전환 설정 변경을 확인하지 못했습니다. 마지막으로 확인된 값을 표시합니다.",
@@ -973,6 +976,19 @@ export const ko: Record<TKey, string> = {
   "accountPool.stickyLimitInvalid": "1에서 100 사이의 정수를 입력하세요",
   "accountPool.strategyLoadFailed": "로테이션 전략을 불러오지 못했습니다.",
   "accountPool.strategyUpdateFailed": "로테이션 전략을 저장하지 못했습니다.",
+
+  "accountPool.priority": "선택 순서",
+  "accountPool.priorityAria": "이 계정의 선택 순서",
+  "accountPool.priorityHint": "숫자가 클수록 먼저 사용됩니다. 위에 있는 계정이 모두 소진되거나 사용할 수 없을 때에만 더 낮은 숫자로 넘어갑니다.",
+  "accountPool.priorityFirst": "가장 먼저",
+  "accountPool.priorityEarlier": "먼저",
+  "accountPool.priorityNormal": "기본",
+  "accountPool.priorityLater": "나중에",
+  "accountPool.priorityLast": "가장 마지막",
+  "accountPool.priorityOption": "{name} ({value})",
+  "accountPool.priorityCustom": "사용자 지정",
+  "accountPool.priorityUpdated": "{email}의 선택 순서를 업데이트했습니다",
+  "accountPool.priorityUpdateFailed": "{email}의 선택 순서를 저장하지 못했습니다. 마지막으로 확인된 값을 표시합니다.",
   "codexAuth.switched": "다음 요청에 {email}을(를) 사용합니다",
   "codexAuth.loadFailed": "Codex 계정 설정을 불러오지 못했습니다.",
   "codexAuth.switchFailed": "계정을 전환하지 못했습니다. 이전 선택은 그대로 유지됩니다.",
diff --git a/gui/src/i18n/ru.ts b/gui/src/i18n/ru.ts
index 7904e27c3e..5815500fd5 100644
--- a/gui/src/i18n/ru.ts
+++ b/gui/src/i18n/ru.ts
@@ -1323,6 +1323,8 @@ export const ru: Record<TKey, string> = {
   "codexAuth.pauseFailed": "Не удалось приостановить {email}. Изменений нет.",
   "codexAuth.resumeFailed": "Не удалось возобновить {email}. Изменений нет.",
   "codexAuth.pausedHint": "До возобновления исключён из автоматического переключения, повторов, восстановления после задержки и ручного выбора.",
+  "codexAuth.pinned": "ЗАКРЕПЛЁН",
+  "codexAuth.pinnedHint": "Этот аккаунт выбран вручную, поэтому более высокий порядок выбора не обойдёт его. Закрепление действует, пока этот аккаунт не будет исчерпан, пока вы не выберете другой или пока вы не измените порядок выбора любого аккаунта.",
   "codexAuth.fiveHour": "5 ч",
   "codexAuth.weekly": "Неделя",
   "codexAuth.monthly": "30 дн.",
@@ -1336,12 +1338,12 @@ export const ru: Record<TKey, string> = {
   "codexAuth.prepareForPool": "Подготовить для пула",
   "codexAuth.poolPreparedToast": "{email} подготовлен для режима пула",
   "codexAuth.switchTitle": "Сменить активный аккаунт?",
-  "codexAuth.switchDesc": "Изменение применяется к следующему запросу существующих и новых сессий Codex. Выполняющиеся запросы сохраняют прежний аккаунт.",
-  "codexAuth.cacheWarning": "После любой смены аккаунта OpenCodex воспроизводит контекст разговора, но кэш промптов на стороне провайдера может быть холодным.",
-  "codexAuth.setAsNext": "Выбрать аккаунт",
+  "codexAuth.switchDesc": "Применяется сразу. Существующие привязанные к аккаунту потоки и уже выполняющиеся запросы сохраняют прежний аккаунт; новые или непривязанные запросы используют порядковый уровень выбранного аккаунта. Аккаунты с тем же порядком выбора продолжают чередоваться.",
+  "codexAuth.cacheWarning": "Кэш промптов сбрасывается при смене аккаунта. Новая сессия начнётся с пустым кэшем.",
+  "codexAuth.setAsNext": "Использовать этот аккаунт следующим",
   "codexAuth.cancel": "Отмена",
   "codexAuth.switchBack": "Вернуться на основной аккаунт?",
-  "codexAuth.switchBackDesc": "Следующий запрос существующих и новых сессий Codex будет использовать аккаунт входа через приложение.",
+  "codexAuth.switchBackDesc": "Применяется сразу. Существующие привязанные к аккаунту потоки и уже выполняющиеся запросы сохраняют прежний аккаунт; новые или непривязанные запросы используют порядковый уровень аккаунта входа через приложение. Аккаунты с тем же порядком выбора продолжают чередоваться.",
   "codexAuth.autoSwitch": "Проактивное переключение по использованию",
   "codexAuth.autoSwitchQuotaDesc": "Квота: при использовании {threshold}% или выше следующий запрос может перейти на подходящий аккаунт с меньшим использованием, включая уже привязанную задачу; Go/Free используют только 30 дней.",
   "codexAuth.autoSwitchQuotaOffDesc": "Проактивное переключение по использованию выключено. Назначение новых/непривязанных задач и восстановление после сбоев остаются активными.",
@@ -1354,6 +1356,7 @@ export const ru: Record<TKey, string> = {
   "codexAuth.autoSwitchThresholdInc": "Увеличить порог использования",
   "codexAuth.autoSwitchThresholdDec": "Уменьшить порог использования",
   "codexAuth.autoSwitchLoadFailed": "Не удалось загрузить настройку переключения по использованию.",
+
   "codexAuth.autoSwitchThresholdInvalid": "Введите целое число от 1 до 100",
   "codexAuth.autoSwitchUpdated": "Проактивное переключение по использованию обновлено",
   "codexAuth.autoSwitchUpdateFailed": "Не удалось подтвердить обновление переключения по использованию. Показано последнее подтверждённое значение.",
@@ -1394,6 +1397,19 @@ export const ru: Record<TKey, string> = {
   "accountPool.stickyLimitInvalid": "Введите целое число от 1 до 100",
   "accountPool.strategyLoadFailed": "Не удалось загрузить стратегию ротации.",
   "accountPool.strategyUpdateFailed": "Не удалось сохранить стратегию ротации.",
+
+  "accountPool.priority": "Порядок выбора",
+  "accountPool.priorityAria": "Порядок выбора для этого аккаунта",
+  "accountPool.priorityHint": "Большие числа используются раньше. Пул переходит к меньшему числу только тогда, когда все аккаунты выше исчерпаны или недоступны.",
+  "accountPool.priorityFirst": "Первым",
+  "accountPool.priorityEarlier": "Раньше",
+  "accountPool.priorityNormal": "По умолчанию",
+  "accountPool.priorityLater": "Позже",
+  "accountPool.priorityLast": "Последним",
+  "accountPool.priorityOption": "{name} ({value})",
+  "accountPool.priorityCustom": "Своё значение",
+  "accountPool.priorityUpdated": "Порядок выбора для {email} обновлён",
+  "accountPool.priorityUpdateFailed": "Не удалось сохранить порядок выбора для {email}. Показано последнее подтверждённое значение.",
   "codexAuth.switched": "{email} выбран для следующего запроса",
   "codexAuth.loadFailed": "Не удалось загрузить настройки аккаунтов Codex.",
   "codexAuth.switchFailed": "Не удалось переключить аккаунт. Ваш предыдущий выбор не изменён.",
diff --git a/gui/src/i18n/zh.ts b/gui/src/i18n/zh.ts
index 8b16dbe6c8..9cf00e0652 100644
--- a/gui/src/i18n/zh.ts
+++ b/gui/src/i18n/zh.ts
@@ -895,6 +895,8 @@ export const zh: Record<TKey, string> = {
   "codexAuth.pauseFailed": "无法暂停 {email}，未做任何更改。",
   "codexAuth.resumeFailed": "无法恢复 {email}，未做任何更改。",
   "codexAuth.pausedHint": "恢复前不会参与自动切换、重试、冷却恢复或手动选择。",
+  "codexAuth.pinned": "已固定",
+  "codexAuth.pinnedHint": "这是你手动选择的账号，因此更高的选择顺序不会越过它。该固定会一直生效，直到此账号用尽、你改选其他账号，或你修改任一选择顺序。",
   "codexAuth.fiveHour": "5 小时",
   "codexAuth.weekly": "每周",
   "codexAuth.monthly": "30天",
@@ -908,12 +910,12 @@ export const zh: Record<TKey, string> = {
   "codexAuth.prepareForPool": "为账户池准备",
   "codexAuth.poolPreparedToast": "已为账户池模式准备 {email}",
   "codexAuth.switchTitle": "切换活跃账号？",
-  "codexAuth.switchDesc": "从现有和新 Codex 会话的下一次请求开始生效。进行中的请求保留原账号。",
-  "codexAuth.cacheWarning": "账号变化后 OpenCodex 会重放对话上下文，但提供商侧的提示缓存可能需要重新预热。",
-  "codexAuth.setAsNext": "选择账号",
+  "codexAuth.switchDesc": "立即生效。已在进行中的请求保留原账号，其余都会切换到此账号；不过选择顺序相同的账号仍会轮换使用。",
+  "codexAuth.cacheWarning": "切换账号会重置提示缓存。新会话从空缓存开始。",
+  "codexAuth.setAsNext": "接下来使用此账号",
   "codexAuth.cancel": "取消",
   "codexAuth.switchBack": "切换回主账号？",
-  "codexAuth.switchBackDesc": "现有和新 Codex 会话的下一次请求将使用应用登录账号。",
+  "codexAuth.switchBackDesc": "立即生效。已在进行中的请求保留原账号，其余都会切换到应用登录账号；不过选择顺序相同的账号仍会轮换使用。",
   "codexAuth.autoSwitch": "基于用量的主动切换",
   "codexAuth.autoSwitchQuotaDesc": "配额：使用率达到或超过 {threshold}% 时，包括已绑定任务在内的下一次请求可能转到用量更低的合格账号；Go/Free 仅使用 30 天窗口。",
   "codexAuth.autoSwitchQuotaOffDesc": "基于用量的主动切换已关闭。新建/未绑定任务分配和故障恢复仍然生效。",
@@ -926,6 +928,7 @@ export const zh: Record<TKey, string> = {
   "codexAuth.autoSwitchThresholdInc": "提高用量阈值",
   "codexAuth.autoSwitchThresholdDec": "降低用量阈值",
   "codexAuth.autoSwitchLoadFailed": "无法加载基于用量的切换设置。",
+
   "codexAuth.autoSwitchThresholdInvalid": "请输入 1 到 100 之间的整数",
   "codexAuth.autoSwitchUpdated": "基于用量的主动切换设置已更新",
   "codexAuth.autoSwitchUpdateFailed": "无法确认基于用量的切换更新。当前显示最后一次确认的值。",
@@ -966,6 +969,19 @@ export const zh: Record<TKey, string> = {
   "accountPool.stickyLimitInvalid": "请输入 1 到 100 之间的整数",
   "accountPool.strategyLoadFailed": "无法加载轮换策略。",
   "accountPool.strategyUpdateFailed": "无法保存轮换策略。",
+
+  "accountPool.priority": "选择顺序",
+  "accountPool.priorityAria": "此账号的选择顺序",
+  "accountPool.priorityHint": "数字越大越先使用。只有当排在前面的账号全部用尽或不可用时，账号池才会转向更小的数字。",
+  "accountPool.priorityFirst": "最先",
+  "accountPool.priorityEarlier": "较先",
+  "accountPool.priorityNormal": "默认",
+  "accountPool.priorityLater": "较后",
+  "accountPool.priorityLast": "最后",
+  "accountPool.priorityOption": "{name}（{value}）",
+  "accountPool.priorityCustom": "自定义",
+  "accountPool.priorityUpdated": "已更新 {email} 的选择顺序",
+  "accountPool.priorityUpdateFailed": "无法保存 {email} 的选择顺序。当前显示最后一次确认的值。",
   "codexAuth.switched": "下一次请求将使用 {email}",
   "codexAuth.loadFailed": "无法加载 Codex 账号设置。",
   "codexAuth.switchFailed": "无法切换账户。之前的选择保持不变。",
diff --git a/gui/src/styles.css b/gui/src/styles.css
index 6e2be3dcad..cb41c986d1 100644
--- a/gui/src/styles.css
+++ b/gui/src/styles.css
@@ -1642,6 +1642,16 @@ dialog.modal-overlay::backdrop {
 .startup-runtime-notice__fix code {
   color: inherit;
 }
+/* `.card` carries no padding of its own — `.card-row` and `.card-sub` each inset themselves,
+   so a card built from plain children leaves the title and controls flush against the border
+   while the hints sit 16px in. Pad the card and flatten the hints, as the auto-switch card does. */
+.codex-pool-strategy-card { padding: 14px 16px; }
+.codex-pool-strategy-card .card-sub { padding: 0; }
+/* Inline selection-order row on an account card: label and trigger share one line, and the
+   trigger is scaled down to the card's hint text so it reads as part of the card, not a form. */
+.codex-account-priority { display: flex; align-items: center; gap: 8px; flex-wrap: wrap; padding: 0 16px 10px; min-width: 0; }
+.codex-account-priority-label { font-size: var(--text-label); color: var(--muted); font-weight: var(--weight-medium); white-space: nowrap; }
+.codex-account-priority .select-trigger { max-width: 100%; padding: 4px 9px; font-size: var(--text-label); }
 
 .startup-page-sub { margin-bottom: 0; }
 .startup-page-head-actions { display: flex; align-items: center; gap: 8px; flex-shrink: 0; }
diff --git a/gui/src/ui.tsx b/gui/src/ui.tsx
index d42c0fb93a..d4f672c3ea 100644
--- a/gui/src/ui.tsx
+++ b/gui/src/ui.tsx
@@ -25,19 +25,22 @@ export function Notice({ tone, children }: { tone: "ok" | "err"; children: React
 
 export interface SelectOption { value: string; label: React.ReactNode }
 
-export function Select({ value, options, onChange, disabled, label, id, style, align, placement, dropdownStyle, portal = true }: {  value: string;
+export function Select({ value, options, onChange, disabled, id, label, describedBy, title, style, align, placement, dropdownStyle, portal = true }: {
+  value: string;
   options: SelectOption[];
   onChange: (value: string) => void;
   disabled?: boolean;
+  /** Put on the trigger, so a sibling `<label htmlFor>` can name it — a button is labelable. */
+  id?: string;
   label?: string;
+  describedBy?: string;
+  title?: string;
   style?: CSSProperties;
   align?: "left" | "right";
   placement?: "below" | "right";
   dropdownStyle?: CSSProperties;
   /** When true (default), menu is portaled and flips above the trigger if it would leave the viewport. */
   portal?: boolean;
-  /** Optional id on the trigger button (tests / labels target `#codex-pool-strategy`). */
-  id?: string;
 }) {
   const listboxId = useId();
   const [open, setOpen] = useState(false);
@@ -124,6 +127,7 @@ export function Select({ value, options, onChange, disabled, label, id, style, a
   }, [activeIndex, open, optionId]);
 
   const selectIndex = (index: number) => {
+    if (disabled) return;
     const option = options[index];
     if (!option) return;
     onChange(option.value);
@@ -176,7 +180,12 @@ export function Select({ value, options, onChange, disabled, label, id, style, a
 
   const activeDescendant = open && options[activeIndex] ? optionId(activeIndex) : undefined;
 
-  const dropdown = open ? (
+  // A shared controller can flip `disabled` while the menu is already open (for
+  // example `priorityUpdatingId` starts an order write). The trigger alone being
+  // disabled must not leave the rendered option buttons able to call `onChange`
+  // and silently drop the second update, so the dropdown is not rendered (and the
+  // option buttons are disabled) whenever `disabled` is true.
+  const dropdown = open && !disabled ? (
     <div
       ref={menuRef}
       id={listboxId}
@@ -192,6 +201,7 @@ export function Select({ value, options, onChange, disabled, label, id, style, a
           type="button"
           role="option"
           tabIndex={-1}
+          disabled={disabled}
           aria-selected={o.value === value}
           className={`select-option${o.value === value ? " active" : ""}${index === activeIndex ? " select-option-active" : ""}`}
           onMouseEnter={() => setHighlightIndex(index)}
@@ -208,6 +218,8 @@ export function Select({ value, options, onChange, disabled, label, id, style, a
         id={id}
         type="button"
         role="combobox"
+        title={title}
+        aria-describedby={describedBy}
         className="select-trigger"
         onClick={() => {
           if (disabled) return;
diff --git a/gui/tests/account-priority.test.tsx b/gui/tests/account-priority.test.tsx
new file mode 100644
index 0000000000..ebfec7bf8d
--- /dev/null
+++ b/gui/tests/account-priority.test.tsx
@@ -0,0 +1,243 @@
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { Window } from "happy-dom";
+import { act } from "react";
+import type { Root } from "react-dom/client";
+import { renderToStaticMarkup } from "react-dom/server";
+import {
+  ACCOUNT_PRIORITY_PRESETS,
+  accountPriorityLabel,
+  accountPriorityPresetKey,
+  DEFAULT_ACCOUNT_PRIORITY,
+  formatAccountPriority,
+  isAccountPriorityPreset,
+  normalizeAccountPriority,
+} from "../src/account-priority";
+import AccountPriorityControl, { AccountPriorityBadge } from "../src/components/AccountPriorityControl";
+import { LanguageProvider } from "../src/i18n/provider";
+
+let previousLanguage: unknown;
+
+const domGlobals = ["document", "window", "navigator", "IS_REACT_ACT_ENVIRONMENT"] as const;
+let previousDomGlobals: Record<(typeof domGlobals)[number], unknown>;
+let testWindow: Window;
+let mountedRoot: Root | null;
+
+beforeEach(() => {
+  previousLanguage = (globalThis.navigator as { language?: unknown } | undefined)?.language;
+  Object.defineProperty(globalThis.navigator, "language", {
+    configurable: true,
+    value: "en-US",
+  });
+});
+
+afterEach(() => {
+  Object.defineProperty(globalThis.navigator, "language", {
+    configurable: true,
+    value: previousLanguage,
+  });
+});
+
+function setupDom(): void {
+  previousDomGlobals = Object.fromEntries(
+    domGlobals.map((key) => [key, Reflect.get(globalThis, key)]),
+  ) as typeof previousDomGlobals;
+  testWindow = new Window({ url: "http://localhost/" });
+  Object.defineProperty(testWindow.navigator, "language", { configurable: true, value: "en-US" });
+  Object.defineProperties(globalThis, {
+    document: { configurable: true, value: testWindow.document },
+    window: { configurable: true, value: testWindow },
+    navigator: { configurable: true, value: testWindow.navigator },
+  });
+  (globalThis as typeof globalThis & { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT = true;
+  mountedRoot = null;
+}
+
+async function teardownDom(): Promise<void> {
+  if (mountedRoot) {
+    await act(async () => {
+      mountedRoot?.unmount();
+    });
+    mountedRoot = null;
+  }
+  for (const key of domGlobals) {
+    Object.defineProperty(globalThis, key, { configurable: true, value: previousDomGlobals[key] });
+  }
+  await testWindow.happyDOM?.close?.();
+}
+
+describe("account priority helpers", () => {
+  test("normalizes integers inside the API range and defaults everything else", () => {
+    expect(normalizeAccountPriority(2)).toBe(2);
+    expect(normalizeAccountPriority(-2)).toBe(-2);
+    expect(normalizeAccountPriority(100)).toBe(100);
+    expect(normalizeAccountPriority(-100)).toBe(-100);
+    for (const invalid of [101, -101, 1.5, NaN, "1", null, undefined, {}]) {
+      expect(normalizeAccountPriority(invalid)).toBe(DEFAULT_ACCOUNT_PRIORITY);
+    }
+  });
+
+  test("formats with a sign and an ASCII hyphen", () => {
+    expect(formatAccountPriority(2)).toBe("+2");
+    expect(formatAccountPriority(1)).toBe("+1");
+    expect(formatAccountPriority(0)).toBe("0");
+    expect(formatAccountPriority(-1)).toBe("-1");
+    expect(formatAccountPriority(-2)).toBe("-2");
+    // A Unicode minus would not round-trip through the API or the CLI column.
+    expect(formatAccountPriority(-7).charCodeAt(0)).toBe(0x2d);
+  });
+
+  test("presets run first to last and map to label keys", () => {
+    expect(ACCOUNT_PRIORITY_PRESETS).toEqual([2, 1, 0, -1, -2]);
+    expect(ACCOUNT_PRIORITY_PRESETS.map(accountPriorityPresetKey)).toEqual([
+      "accountPool.priorityFirst",
+      "accountPool.priorityEarlier",
+      "accountPool.priorityNormal",
+      "accountPool.priorityLater",
+      "accountPool.priorityLast",
+    ]);
+    expect(accountPriorityPresetKey(7)).toBeNull();
+    expect(isAccountPriorityPreset(0)).toBe(true);
+    expect(isAccountPriorityPreset(7)).toBe(false);
+  });
+
+  test("labels carry the signed number, and non-presets read as Custom", () => {
+    const t = ((key: string, vars?: Record<string, string | number>) => {
+      const dict: Record<string, string> = {
+        "accountPool.priorityFirst": "First",
+        "accountPool.priorityLast": "Last",
+        "accountPool.priorityCustom": "Custom",
+        "accountPool.priorityOption": "{name} ({value})",
+      };
+      const template = dict[key] ?? key;
+      return Object.entries(vars ?? {}).reduce(
+        (text, [name, value]) => text.split(`{${name}}`).join(String(value)),
+        template,
+      );
+    }) as Parameters<typeof accountPriorityLabel>[0];
+
+    expect(accountPriorityLabel(t, 2)).toBe("First (+2)");
+    expect(accountPriorityLabel(t, -2)).toBe("Last (-2)");
+    expect(accountPriorityLabel(t, 7)).toBe("Custom (+7)");
+  });
+});
+
+describe("AccountPriorityControl", () => {
+  // The trigger is all that renders while the menu is closed, so the options themselves are
+  // asserted in the interaction block below rather than against static markup.
+  test("names the control from locale keys and shows only the current order when closed", () => {
+    const markup = renderToStaticMarkup(
+      <LanguageProvider>
+        <AccountPriorityControl value={0} selectId="order-1" onChange={() => {}} />
+      </LanguageProvider>,
+    );
+    expect(markup).toContain("Selection order");
+    expect(markup).toContain('for="order-1"');
+    expect(markup).toContain('id="order-1-hint"');
+    expect(markup).toContain('aria-describedby="order-1-hint"');
+    expect(markup).toContain("Higher numbers are used first.");
+    expect(markup).toContain("Normal (0)");
+    expect(markup).not.toContain("First (+2)");
+  });
+
+  test("the badge names a non-default order and stays out of the way at zero", () => {
+    expect(renderToStaticMarkup(
+      <LanguageProvider><AccountPriorityBadge value={0} /></LanguageProvider>,
+    )).toBe("");
+    const markup = renderToStaticMarkup(
+      <LanguageProvider><AccountPriorityBadge value={-1} /></LanguageProvider>,
+    );
+    expect(markup).toContain("Later (-1)");
+    expect(markup).toContain("badge-muted");
+  });
+
+  describe("interaction", () => {
+    beforeEach(() => setupDom());
+    afterEach(async () => {
+      await teardownDom();
+    });
+
+    async function mount(props: {
+      value: number;
+      selectId: string;
+      disabled?: boolean;
+      onChange?: (priority: number) => void;
+    }): Promise<void> {
+      const host = testWindow.document.createElement("div");
+      testWindow.document.body.appendChild(host as never);
+      const { createRoot } = await import("react-dom/client");
+      await act(async () => {
+        mountedRoot = createRoot(host);
+        mountedRoot.render(
+          <LanguageProvider>
+            <AccountPriorityControl
+              value={props.value}
+              selectId={props.selectId}
+              disabled={props.disabled}
+              onChange={props.onChange ?? (() => {})}
+            />
+          </LanguageProvider>,
+        );
+      });
+    }
+
+    const trigger = (selectId: string) => {
+      const element = testWindow.document.querySelector<HTMLButtonElement>(`#${selectId}`);
+      if (!element) throw new Error(`selection order trigger ${selectId} missing`);
+      return element;
+    };
+    // The menu is portaled to document.body, so the options are not under the mount node.
+    const optionLabels = () =>
+      [...testWindow.document.querySelectorAll('[role="option"]')].map((option) => option.textContent);
+    const open = async (selectId: string) => { await act(async () => trigger(selectId).click()); };
+
+    test("offers the five presets in first-to-last order with signed numbers", async () => {
+      await mount({ value: 0, selectId: "order-live" });
+      await open("order-live");
+
+      expect(optionLabels()).toEqual(["First (+2)", "Earlier (+1)", "Normal (0)", "Later (-1)", "Last (-2)"]);
+    });
+
+    test("prepends a stored value the presets do not cover as a selectable peer", async () => {
+      await mount({ value: 7, selectId: "order-custom" });
+      expect(trigger("order-custom").textContent).toContain("Custom (+7)");
+
+      await open("order-custom");
+      // Custom sits ahead of the presets so the current value is the first option.
+      expect(optionLabels()).toEqual([
+        "Custom (+7)", "First (+2)", "Earlier (+1)", "Normal (0)", "Later (-1)", "Last (-2)",
+      ]);
+    });
+
+    test("a value outside the API range falls back to the default order", async () => {
+      await mount({ value: 9001, selectId: "order-bogus" });
+      expect(trigger("order-bogus").textContent).toContain("Normal (0)");
+
+      await open("order-bogus");
+      expect(optionLabels()).not.toContain("Custom (+9001)");
+      expect(optionLabels()).toHaveLength(ACCOUNT_PRIORITY_PRESETS.length);
+    });
+
+    test("parses the chosen option back into a number", async () => {
+      const seen: number[] = [];
+      await mount({ value: 0, selectId: "order-live", onChange: (priority) => { seen.push(priority); } });
+
+      for (const label of ["Last (-2)", "First (+2)"]) {
+        await open("order-live");
+        const option = [...testWindow.document.querySelectorAll<HTMLButtonElement>('[role="option"]')]
+          .find((candidate) => candidate.textContent === label);
+        if (!option) throw new Error(`option ${label} missing`);
+        await act(async () => option.click());
+      }
+
+      expect(seen).toEqual([-2, 2]);
+    });
+
+    test("disabled blocks the control while a save is in flight", async () => {
+      await mount({ value: 1, selectId: "order-busy", disabled: true });
+
+      expect(trigger("order-busy").disabled).toBe(true);
+      await open("order-busy");
+      expect(optionLabels()).toEqual([]);
+    });
+  });
+});
diff --git a/gui/tests/codex-account-auto-switch.test.tsx b/gui/tests/codex-account-auto-switch.test.tsx
index 92e9c357b2..c9b4f19dca 100644
--- a/gui/tests/codex-account-auto-switch.test.tsx
+++ b/gui/tests/codex-account-auto-switch.test.tsx
@@ -148,7 +148,7 @@ describe("Codex account auto-switch threshold", () => {
     expect(fillFirst).toContain("drain point for new/unbound tasks");
     for (const html of [quota, roundRobin, fillFirst]) {
       expect(html).toContain("Failure recovery is separate");
-      expect(html).toContain("provider-side prompt cache may be cold");
+      expect(html).toContain("Prompt cache resets on account switch");
     }
   });
 
diff --git a/gui/tests/codex-account-pool-behaviour.test.tsx b/gui/tests/codex-account-pool-behaviour.test.tsx
index f897da44e6..8d67cd146f 100644
--- a/gui/tests/codex-account-pool-behaviour.test.tsx
+++ b/gui/tests/codex-account-pool-behaviour.test.tsx
@@ -26,6 +26,15 @@ let nextAccountsResponseGate: Promise<void> | null = null;
 let pauseResponseActiveId: string | null = null;
 let bulkPausedAccountIds: string[] = ["a2"];
 let bulkResponseActiveId: string | null = null;
+let priorityResponseOk = true;
+let nextPriorityResponseGate: Promise<void> | null = null;
+let nextPauseResponseGate: Promise<void> | null = null;
+let nextActiveResponseGate: Promise<void> | null = null;
+let nextActivePutGate: Promise<void> | null = null;
+let activePinned = false;
+let activePinnedAccountId: string | null = null;
+let omitPinnedAccountId = false;
+let activeGetId: string | null = null;
 
 beforeEach(() => {
   previous = Object.fromEntries(globals.map((k) => [k, Reflect.get(globalThis, k)])) as typeof previous;
@@ -44,13 +53,41 @@ beforeEach(() => {
   pauseResponseActiveId = null;
   bulkPausedAccountIds = ["a2"];
   bulkResponseActiveId = null;
-  accounts = [{ id: "a1", email: "account-one", isMain: true, paused: false, hasCredential: true, quota: null }];
+  priorityResponseOk = true;
+  nextPriorityResponseGate = null;
+  nextPauseResponseGate = null;
+  nextActiveResponseGate = null;
+  nextActivePutGate = null;
+  activePinned = false;
+  activePinnedAccountId = null;
+  omitPinnedAccountId = false;
+  activeGetId = null;
+  accounts = [{ id: "a1", email: "account-one", isMain: true, paused: false, priority: 0, hasCredential: true, quota: null }];
   Object.defineProperty(globalThis, "fetch", {
     configurable: true,
     value: async (url: string, init?: RequestInit) => {
       const path = String(url).split("/api/")[1] ?? String(url);
       calls.push(`${init?.method ?? "GET"} ${path}`);
+      if (path === "codex-auth/accounts/priority") {
+        const gate = nextPriorityResponseGate;
+        nextPriorityResponseGate = null;
+        if (gate) await gate;
+        const body = JSON.parse(String(init?.body)) as { id: string; priority: number | null };
+        if (!priorityResponseOk) return { ok: false, json: async () => ({}) } as unknown as Response;
+        const stored = body.priority ?? 0;
+        accounts = accounts.map(account => (
+          typeof account === "object" && account !== null && "id" in account
+            && (account.id === body.id || (body.id === "__main__" && "isMain" in account && account.isMain === true))
+            ? { ...account, priority: stored }
+            : account
+        ));
+        activePinnedAccountId = null;
+        return { ok: true, json: async () => ({ ok: true, id: body.id, priority: stored }) } as unknown as Response;
+      }
       if (path === "codex-auth/accounts/pause") {
+        const gate = nextPauseResponseGate;
+        nextPauseResponseGate = null;
+        if (gate) await gate;
         const body = JSON.parse(String(init?.body)) as { id: string; paused: boolean };
         accounts = accounts.map(account => (
           typeof account === "object" && account !== null && "id" in account
@@ -58,6 +95,7 @@ beforeEach(() => {
             ? { ...account, paused: body.paused }
             : account
         ));
+        if (body.paused && activePinnedAccountId === body.id) activePinnedAccountId = null;
         return { ok: true, json: async () => ({ activeCodexAccountId: pauseResponseActiveId }) } as unknown as Response;
       }
       if (path === "codex-auth/accounts/pause-exhausted") {
@@ -68,6 +106,7 @@ beforeEach(() => {
             ? { ...account, paused: true }
             : account
         ));
+        if (activePinnedAccountId && pausedIds.has(activePinnedAccountId)) activePinnedAccountId = null;
         return {
           ok: true,
           json: async () => ({
@@ -84,7 +123,29 @@ beforeEach(() => {
         return { ok: true, json: async () => ({ accounts }) } as unknown as Response;
       }
       if (path.startsWith("codex-auth/active")) {
-        return { ok: true, json: async () => ({ activeCodexAccountId: null, autoSwitchThreshold: threshold }) } as unknown as Response;
+        if (init?.method === "PUT") {
+          const body = JSON.parse(String(init.body)) as { accountId: string | null };
+          const putGate = nextActivePutGate;
+          nextActivePutGate = null;
+          if (putGate) await putGate;
+          activePinnedAccountId = body.accountId;
+          return {
+            ok: true,
+            json: async () => ({ activeCodexAccountId: body.accountId }),
+          } as unknown as Response;
+        }
+        const gate = nextActiveResponseGate;
+        nextActiveResponseGate = null;
+        if (gate) await gate;
+        return {
+          ok: true,
+          json: async () => ({
+            activeCodexAccountId: activeGetId,
+            pinned: activePinned,
+            ...(omitPinnedAccountId ? {} : { pinnedAccountId: activePinnedAccountId }),
+            autoSwitchThreshold: threshold,
+          }),
+        } as unknown as Response;
       }
       return { ok: true, json: async () => ({}) } as unknown as Response;
     },
@@ -177,8 +238,8 @@ test("pausing the main sentinel updates its distinct account row before reload",
 
 test("pausing stores the actual fallback account returned by the API", async () => {
   accounts = [
-    { id: "a1", email: "main", isMain: true, paused: false, hasCredential: true, quota: null },
-    { id: "a2", email: "next", isMain: false, paused: false, hasCredential: true, quota: null },
+    { id: "a1", email: "main", isMain: true, paused: false, priority: 0, hasCredential: true, quota: null },
+    { id: "a2", email: "next", isMain: false, paused: false, priority: 0, hasCredential: true, quota: null },
   ];
   pauseResponseActiveId = "a2";
   const seen = await mountController();
@@ -192,8 +253,8 @@ test("pausing stores the actual fallback account returned by the API", async ()
 
 test("a paused main account does not contribute active reauth state", async () => {
   accounts = [
-    { id: "a1", email: "main", isMain: true, paused: true, hasCredential: true, needsReauth: true, quota: null },
-    { id: "a2", email: "next", isMain: false, paused: false, hasCredential: true, quota: null },
+    { id: "a1", email: "main", isMain: true, paused: true, priority: 0, hasCredential: true, needsReauth: true, quota: null },
+    { id: "a2", email: "next", isMain: false, paused: false, priority: 0, hasCredential: true, quota: null },
   ];
   const seen = await mountController();
 
@@ -203,8 +264,8 @@ test("a paused main account does not contribute active reauth state", async () =
 
 test("bulk pausing writes one endpoint and updates every returned account", async () => {
   accounts = [
-    { id: "a1", email: "account-one", isMain: true, paused: false, hasCredential: true, quota: null },
-    { id: "a2", email: "account-two", isMain: false, paused: false, hasCredential: true, quota: null },
+    { id: "a1", email: "account-one", isMain: true, paused: false, priority: 0, hasCredential: true, quota: null },
+    { id: "a2", email: "account-two", isMain: false, paused: false, priority: 0, hasCredential: true, quota: null },
   ];
   const seen = await mountController();
 
@@ -220,8 +281,8 @@ test("bulk pausing writes one endpoint and updates every returned account", asyn
 
 test("bulk pausing translates the main sentinel to its distinct account row", async () => {
   accounts = [
-    { id: "a1", email: "main", isMain: true, paused: false, hasCredential: true, quota: null },
-    { id: "a2", email: "pool", isMain: false, paused: false, hasCredential: true, quota: null },
+    { id: "a1", email: "main", isMain: true, paused: false, priority: 0, hasCredential: true, quota: null },
+    { id: "a2", email: "pool", isMain: false, paused: false, priority: 0, hasCredential: true, quota: null },
   ];
   bulkPausedAccountIds = ["__main__"];
   bulkResponseActiveId = "a2";
@@ -298,14 +359,296 @@ test("subscribing never fabricates a server read", async () => {
 
   // And a real load does reach the subscriber.
   await act(async () => { await seen.current!.load(); });
-  expect(received).toEqual([{ activeCodexAccountId: null, autoSwitchThreshold: 80 }]);
+  expect(received).toEqual([{
+    activeCodexAccountId: null,
+    pinned: false,
+    pinnedAccountId: null,
+    autoSwitchThreshold: 80,
+  }]);
+});
+
+test("a confirmed selection-order save updates the row before the reload lands", async () => {
+  accounts = [
+    { id: "a1", email: "main", isMain: true, paused: false, priority: 0, hasCredential: true, quota: null },
+    { id: "a2", email: "pool", isMain: false, paused: false, priority: 0, hasCredential: true, quota: null },
+  ];
+  const seen = await mountController();
+  let releaseReload!: () => void;
+  nextAccountsResponseGate = new Promise<void>(resolve => { releaseReload = resolve; });
+
+  await act(async () => {
+    expect(await seen.current!.setAccountPriority("a2", 2)).toEqual({ ok: true });
+  });
+
+  expect(calls).toContain("PUT codex-auth/accounts/priority");
+  expect(seen.current!.accounts.find(account => account.id === "a2")?.priority).toBe(2);
+  expect(seen.current!.priorityUpdatingId).toBeNull();
+
+  await act(async () => {
+    releaseReload();
+    await new Promise((resolve) => setTimeout(resolve, 30));
+  });
+
+  // The reload confirms the same value rather than reverting it.
+  expect(seen.current!.accounts.find(account => account.id === "a2")?.priority).toBe(2);
+});
+
+test("an accepted selection-order write clears the pin before reconciliation lands", async () => {
+  activePinnedAccountId = "a1";
+  const seen = await mountController();
+  expect(seen.current!.activePinnedId).toBe("a1");
+  let releaseActive!: () => void;
+  nextActiveResponseGate = new Promise<void>(resolve => { releaseActive = resolve; });
+
+  await act(async () => {
+    expect(await seen.current!.setAccountPriority("a1", 2)).toEqual({ ok: true });
+  });
+  expect(seen.current!.activePinnedId).toBeNull();
+
+  await act(async () => {
+    releaseActive();
+    await new Promise((resolve) => setTimeout(resolve, 30));
+  });
+});
+
+test("an order write and a manual switch refuse to overlap in either direction", async () => {
+  // Both PUTs move the pin, in opposite directions, and each applies its edge
+  // optimistically. Response order is not request order, so overlapping them can leave
+  // the client on the inverse of the server's final pin until a reload corrects it.
+  accounts = [
+    { id: "a1", email: "main", isMain: true, paused: false, priority: 0, hasCredential: true, quota: null },
+    { id: "a2", email: "pool", isMain: false, paused: false, priority: 0, hasCredential: true, quota: null },
+  ];
+  const seen = await mountController();
+
+  let releasePriority!: () => void;
+  nextPriorityResponseGate = new Promise<void>(resolve => { releasePriority = resolve; });
+  let priorityResult: unknown;
+  let switchDuringOrder: unknown;
+  await act(async () => {
+    const orderWrite = seen.current!.setAccountPriority("a2", 2).then(r => { priorityResult = r; });
+    switchDuringOrder = await seen.current!.switchAccount("a1");
+    releasePriority();
+    await orderWrite;
+  });
+  await act(async () => { await new Promise((r) => setTimeout(r, 30)); });
+
+  expect(switchDuringOrder).toEqual({ ok: false, reason: "busy" });
+  expect(priorityResult).toEqual({ ok: true });
+
+  let releaseSwitch!: () => void;
+  nextActivePutGate = new Promise<void>(resolve => { releaseSwitch = resolve; });
+  let switchResult: unknown;
+  let orderDuringSwitch: unknown;
+  await act(async () => {
+    const switchWrite = seen.current!.switchAccount("a2").then(r => { switchResult = r; });
+    orderDuringSwitch = await seen.current!.setAccountPriority("a2", 1);
+    releaseSwitch();
+    await switchWrite;
+  });
+  await act(async () => { await new Promise((r) => setTimeout(r, 30)); });
+
+  expect(orderDuringSwitch).toEqual({ ok: false, reason: "busy" });
+  expect(switchResult).toEqual({ ok: true, activeId: "a2" });
+  // The refused order write must not have moved the row either.
+  expect(seen.current!.accounts.find(account => account.id === "a2")?.priority).toBe(2);
+});
+
+test("an accepted manual switch moves the pin before reconciliation lands", async () => {
+  activePinnedAccountId = "a1";
+  const seen = await mountController();
+  let releaseActive!: () => void;
+  nextActiveResponseGate = new Promise<void>(resolve => { releaseActive = resolve; });
+
+  await act(async () => {
+    expect(await seen.current!.switchAccount("a2")).toEqual({ ok: true, activeId: "a2" });
+  });
+  expect(seen.current!.activePinnedId).toBe("a2");
+
+  await act(async () => {
+    releaseActive();
+    await new Promise((resolve) => setTimeout(resolve, 30));
+  });
+});
+
+test("the main sentinel writes through to its distinct account row", async () => {
+  const seen = await mountController();
+
+  await act(async () => {
+    expect(await seen.current!.setAccountPriority("__main__", -1)).toEqual({ ok: true });
+  });
+
+  expect(seen.current!.accounts.find(account => account.isMain)?.id).toBe("a1");
+  expect(seen.current!.accounts.find(account => account.isMain)?.priority).toBe(-1);
+});
+
+test("null resets an account to the default order", async () => {
+  accounts = [{ id: "a1", email: "main", isMain: true, paused: false, priority: 2, hasCredential: true, quota: null }];
+  const seen = await mountController();
+  expect(seen.current!.accounts[0]?.priority).toBe(2);
+
+  await act(async () => {
+    expect(await seen.current!.setAccountPriority("a1", null)).toEqual({ ok: true });
+  });
+
+  expect(seen.current!.accounts[0]?.priority).toBe(0);
+});
+
+test("a rejected save snaps back to the last confirmed order", async () => {
+  accounts = [{ id: "a1", email: "main", isMain: true, paused: false, priority: 1, hasCredential: true, quota: null }];
+  priorityResponseOk = false;
+  const seen = await mountController();
+
+  await act(async () => {
+    expect(await seen.current!.setAccountPriority("a1", -2)).toEqual({ ok: false, reason: "request" });
+  });
+  await act(async () => { await new Promise((r) => setTimeout(r, 30)); });
+
+  expect(seen.current!.accounts[0]?.priority).toBe(1);
+  expect(seen.current!.priorityUpdatingId).toBeNull();
+});
+
+test("an in-flight order save does not block a pause on another account", async () => {
+  accounts = [
+    { id: "a1", email: "main", isMain: true, paused: false, priority: 0, hasCredential: true, quota: null },
+    { id: "a2", email: "pool", isMain: false, paused: false, priority: 0, hasCredential: true, quota: null },
+  ];
+  const seen = await mountController();
+
+  let releasePriority!: () => void;
+  nextPriorityResponseGate = new Promise<void>(resolve => { releasePriority = resolve; });
+
+  let priorityResult: unknown;
+  let pauseResult: unknown;
+  await act(async () => {
+    const priorityWrite = seen.current!.setAccountPriority("a2", 2).then(r => { priorityResult = r; });
+    // With one shared mutation ref this comes back rejected as "busy".
+    pauseResult = await seen.current!.setAccountPaused("a1", true);
+    releasePriority();
+    await priorityWrite;
+  });
+  await act(async () => { await new Promise((r) => setTimeout(r, 30)); });
+
+  expect(pauseResult).toEqual({ ok: true });
+  expect(priorityResult).toEqual({ ok: true });
+  expect(seen.current!.accounts.find(account => account.id === "a1")?.paused).toBe(true);
+  expect(seen.current!.accounts.find(account => account.id === "a2")?.priority).toBe(2);
+});
+
+test("an in-flight pause does not block an order save on another account", async () => {
+  accounts = [
+    { id: "a1", email: "main", isMain: true, paused: false, priority: 0, hasCredential: true, quota: null },
+    { id: "a2", email: "pool", isMain: false, paused: false, priority: 0, hasCredential: true, quota: null },
+  ];
+  const seen = await mountController();
+
+  let releasePause!: () => void;
+  nextPauseResponseGate = new Promise<void>(resolve => { releasePause = resolve; });
+
+  let pauseResult: unknown;
+  let priorityResult: unknown;
+  await act(async () => {
+    const pauseWrite = seen.current!.setAccountPaused("a1", true).then(r => { pauseResult = r; });
+    // The converse of the case above: each write owns its own in-flight ref, so neither
+    // direction can starve the other.
+    priorityResult = await seen.current!.setAccountPriority("a2", 2);
+    releasePause();
+    await pauseWrite;
+  });
+  await act(async () => { await new Promise((r) => setTimeout(r, 30)); });
+
+  expect(priorityResult).toEqual({ ok: true });
+  expect(pauseResult).toEqual({ ok: true });
+  expect(seen.current!.accounts.find(account => account.id === "a1")?.paused).toBe(true);
+  expect(seen.current!.accounts.find(account => account.id === "a2")?.priority).toBe(2);
+});
+
+test("a second order save while one is in flight is rejected as busy", async () => {
+  const seen = await mountController();
+  let releasePriority!: () => void;
+  nextPriorityResponseGate = new Promise<void>(resolve => { releasePriority = resolve; });
+
+  await act(async () => {
+    const first = seen.current!.setAccountPriority("a1", 2);
+    expect(await seen.current!.setAccountPriority("a1", 1)).toEqual({ ok: false, reason: "busy" });
+    releasePriority();
+    expect(await first).toEqual({ ok: true });
+  });
+  await act(async () => { await new Promise((r) => setTimeout(r, 30)); });
+
+  expect(seen.current!.accounts[0]?.priority).toBe(2);
+});
+
+// The controller tracks the pinned ACCOUNT, not /active's `pinned` boolean. That boolean
+// answers whether routing is currently on the pinned account, which goes false the moment
+// round-robin serves a same-tier sibling even though the pin is still suppressing every
+// higher tier — so the badge reads the id and the boolean has no consumer here.
+test("the pinned account id follows /active on each load, ignoring the pinned flag", async () => {
+  const seen = await mountController();
+  expect(seen.current!.activePinnedId).toBeNull();
+
+  activePinnedAccountId = "a1";
+  activePinned = false;
+  await act(async () => { await seen.current!.load(); });
+  expect(seen.current!.activePinnedId).toBe("a1");
+
+  // Releasing the pin clears it again: this is server state, not a local latch.
+  activePinnedAccountId = null;
+  activePinned = true;
+  await act(async () => { await seen.current!.load(); });
+  expect(seen.current!.activePinnedId).toBeNull();
+});
+
+test("an /active payload with no pinned account id reads as no pin", async () => {
+  // An older build's response omits the field entirely; that must not put the string
+  // "undefined" on a card, and must not latch a pin that no longer exists.
+  const seen = await mountController();
+  activePinnedAccountId = "a1";
+  await act(async () => { await seen.current!.load(); });
+  expect(seen.current!.activePinnedId).toBe("a1");
+
+  omitPinnedAccountId = true;
+  await act(async () => { await seen.current!.load(); });
+  expect(seen.current!.activePinnedId).toBeNull();
+});
+
+test("an account payload without a selection order reads as the default", async () => {
+  accounts = [{ id: "a1", email: "main", isMain: true, paused: false, hasCredential: true, quota: null }];
+  const seen = await mountController();
+  expect(seen.current!.accounts[0]?.priority).toBe(0);
+});
+
+test("an order write retires the switch's pending reconciliation", async () => {
+  accounts = [
+    { id: "a1", email: "account-one", isMain: true, priority: 0, hasCredential: true, quota: null },
+    { id: "a2", email: "account-two", isMain: false, priority: 0, hasCredential: true, quota: null },
+  ];
+  const seen = await mountController();
+
+  // The switch is accepted, so the controller holds "a2" until a matching read arrives.
+  await act(async () => { await seen.current!.switchAccount("a2"); });
+  expect(seen.current!.activeId).toBe("a2");
+
+  // Routing has since moved on -- the order write releases the pin that was capping the
+  // tier, so the account the switch named is no longer the one the server reports.
+  activeGetId = "a1";
+  await act(async () => { await seen.current!.setAccountPriority("a1", 2); });
+  await act(async () => { await new Promise((r) => setTimeout(r, 30)); });
+
+  // Every read after the switch disagrees with the pending marker, so leaving it armed
+  // strands activeId on "a2" for the rest of the session: nothing else retires it.
+  expect(seen.current!.activeId).toBe("a1");
+
+  // And it stays reconciled -- the marker is gone, not merely satisfied once.
+  await act(async () => { await seen.current!.load(); });
+  expect(seen.current!.activeId).toBe("a1");
 });
 
 test("a mutation updates the one shared controller state", async () => {
   const seen = await mountController();
   accounts = [
-    { id: "a1", email: "account-one", isMain: true, hasCredential: true, quota: null },
-    { id: "a2", email: "account-two", isMain: false, hasCredential: true, quota: null },
+    { id: "a1", email: "account-one", isMain: true, priority: 0, hasCredential: true, quota: null },
+    { id: "a2", email: "account-two", isMain: false, priority: 0, hasCredential: true, quota: null },
   ];
 
   await act(async () => { await seen.current!.switchAccount("a2"); });
diff --git a/gui/tests/codex-account-pool-controller.test.ts b/gui/tests/codex-account-pool-controller.test.ts
index 00411bfd9b..78ac72dd8b 100644
--- a/gui/tests/codex-account-pool-controller.test.ts
+++ b/gui/tests/codex-account-pool-controller.test.ts
@@ -14,8 +14,10 @@ test("the controller is the single data owner and exposes the agreed contract",
 
   // Data layer (Q6): list / active / loading / switching plus the mutating actions.
   for (const member of [
-    "accounts", "activeId", "loadState", "switchingId", "pauseUpdatingId", "pausingExhausted", "activeNeedsReauth",
-    "load", "switchAccount", "setAccountPaused", "pauseExhaustedAccounts", "saveAlias", "removeAccount", "syncAfterAccountAdded",
+    "accounts", "activeId", "loadState", "switchingId", "pauseUpdatingId", "priorityUpdatingId",
+    "pausingExhausted", "activeNeedsReauth", "activePinnedId",
+    "load", "switchAccount", "setAccountPaused", "setAccountPriority", "pauseExhaustedAccounts",
+    "saveAlias", "removeAccount", "syncAfterAccountAdded",
     // WP2 (260730_gui_hydration_loading_unify/010): progress is part of the contract, because a
     // forced quota refresh keeps `loadState` at "ready" and would otherwise be invisible.
     "refreshing", "initialLoading",
@@ -48,6 +50,65 @@ test("main and added account cards expose the same persisted pause control", asy
   expect(addedCards).toContain("saving={pauseUpdatingId === a.id}");
 });
 
+test("both cards expose the selection-order control, and pin writes cannot overlap", async () => {
+  const pool = await read("../src/components/CodexAccountPool.tsx");
+  const mainCard = await read("../src/components/codex-account-pool-main-card.tsx");
+  const addedCards = await read("../src/components/codex-account-pool-cards.tsx");
+  const hook = await read("../src/hooks/useCodexAccountPool.ts");
+
+  expect(pool).toContain("controller.setAccountPriority(account.id, priority)");
+  for (const card of [mainCard, addedCards]) {
+    expect(card).toContain("<AccountPriorityControl");
+    expect(card).toContain("<AccountPriorityBadge");
+  }
+  // The main card's synthesized entry has to carry the order, or saving from that card
+  // would post the default over whatever the account currently has.
+  expect(mainCard).toContain("priority: main?.priority ?? 0");
+
+  // A hand-picked account says so on its OWN card, not on whichever card routing landed
+  // on: under round-robin the pin caps the tier while the cursor moves inside it, so an
+  // active-card badge disappeared while the pin was still suppressing the higher tiers.
+  // The paused guard stays — pausing releases the pin, so a pin naming an excluded account
+  // is a stale read that must not be rendered.
+  // Asserted as the gate, not as exact markup: the rendered outcome is covered behaviourally
+  // in codex-account-pool-pinned-badge.test.tsx, so pinning the JSX here only adds a second
+  // place to edit when the span's classes change.
+  expect(mainCard).toMatch(/pinnedId === "__main__" && !main\?\.paused/);
+  expect(addedCards).toMatch(/a\.id === pinnedId && !a\.paused/);
+  for (const card of [mainCard, addedCards]) expect(card).toContain('t("codexAuth.pinned")');
+  for (const card of [mainCard, addedCards]) expect(card).toContain('t("codexAuth.pinnedHint")');
+  expect(pool).toContain("pinnedId={activePinnedId}");
+
+  expect(hook).toContain("/api/codex-auth/accounts/priority");
+  // Sharing pauseMutationRef would make a pause toggle and an order change on two
+  // different accounts reject each other for no reason. The manual switch is the one
+  // deliberate exception: it writes the same pin an order write clears, so overlapping
+  // them lets the client settle on the inverse of the server's final pin. Cross-gated
+  // in both directions, since either can be the newer statement.
+  const priorityStart = hook.indexOf("const setAccountPriority");
+  const priorityEnd = hook.indexOf("const pauseExhaustedAccounts");
+  expect(priorityStart).toBeGreaterThanOrEqual(0);
+  expect(priorityEnd).toBeGreaterThan(priorityStart);
+  const priorityMutation = hook.slice(priorityStart, priorityEnd);
+  expect(priorityMutation).toMatch(/if \(priorityMutationRef\.current \|\| switchingRef\.current\) return/);
+  expect(priorityMutation).not.toContain("pauseMutationRef");
+
+  const switchStart = hook.indexOf("const switchAccount");
+  const switchEnd = hook.indexOf("const saveAlias");
+  expect(switchStart).toBeGreaterThanOrEqual(0);
+  expect(switchEnd).toBeGreaterThan(switchStart);
+  const switchMutation = hook.slice(switchStart, switchEnd);
+  expect(switchMutation).toMatch(/if \(switchingRef\.current \|\| priorityMutationRef\.current\) return/);
+
+  // A refused mutation returns "busy", which both call sites drop without a toast, so
+  // each control must be unavailable while the other is in flight rather than silently
+  // ineffective.
+  for (const card of [mainCard, addedCards]) {
+    expect(card).toContain("disabled={priorityUpdatingId !== null || switchingId !== null}");
+  }
+  expect(pool).toContain("orderBusy={priorityUpdatingId !== null}");
+});
+
 test("the pool header exposes one bulk action backed by the atomic endpoint", async () => {
   const pool = await read("../src/components/CodexAccountPool.tsx");
   const mainCard = await read("../src/components/codex-account-pool-main-card.tsx");
diff --git a/gui/tests/codex-account-pool-pinned-badge.test.tsx b/gui/tests/codex-account-pool-pinned-badge.test.tsx
new file mode 100644
index 0000000000..f31d5e4191
--- /dev/null
+++ b/gui/tests/codex-account-pool-pinned-badge.test.tsx
@@ -0,0 +1,201 @@
+import { afterEach, beforeEach, expect, test } from "bun:test";
+import { Window } from "happy-dom";
+import { act } from "react";
+import type { Root } from "react-dom/client";
+import CodexAccountPool from "../src/components/CodexAccountPool";
+import type { CodexAccountEntry, CodexAccountPoolController } from "../src/hooks/useCodexAccountPool";
+import { en } from "../src/i18n/en";
+import { LanguageProvider } from "../src/i18n/provider";
+
+/**
+ * The PINNED badge is a rendering rule, not a string: it belongs to the one card carrying
+ * the pin — the account the operator chose — which is not always the card routing currently
+ * sits on. Under round-robin and fill-first the pin caps selection at its own tier while the
+ * cursor moves inside that tier, so keying the badge off the active card made it blink out
+ * on a sibling's turn while the pin was still suppressing every higher tier. The sibling
+ * .ts suite greps the JSX for it, which a markup refactor breaks and a logic inversion
+ * survives, so the rule is pinned here against the mounted DOM instead.
+ */
+
+const globals = ["document", "window", "navigator", "localStorage", "IS_REACT_ACT_ENVIRONMENT"] as const;
+let previous: Record<(typeof globals)[number], unknown>;
+let win: Window;
+let host: HTMLElement;
+let root: Root | null = null;
+let originalFetch: typeof globalThis.fetch;
+
+const account: CodexAccountEntry = {
+  id: "pool-1",
+  email: "pool@example.test",
+  isMain: false,
+  paused: false,
+  priority: 0,
+  hasCredential: true,
+  quota: null,
+};
+
+const mainAccount: CodexAccountEntry = {
+  id: "main",
+  email: "main@example.test",
+  isMain: true,
+  paused: false,
+  priority: 0,
+  hasCredential: true,
+  quota: null,
+};
+
+function makeController(overrides: Partial<CodexAccountPoolController> = {}): CodexAccountPoolController {
+  return {
+    accounts: [mainAccount, account],
+    activeId: null,
+    loadState: "ready",
+    switchingId: null,
+    pauseUpdatingId: null,
+    priorityUpdatingId: null,
+    pausingExhausted: false,
+    activeNeedsReauth: false,
+    activePinnedId: null,
+    load: async () => true,
+    switchAccount: async () => ({ ok: true, activeId: null }),
+    setAccountPaused: async () => ({ ok: true }),
+    setAccountPriority: async () => ({ ok: true }),
+    pauseExhaustedAccounts: async () => ({ ok: true, pausedCount: 0 }),
+    saveAlias: async () => ({ ok: true }),
+    removeAccount: async () => ({ ok: true }),
+    syncAfterAccountAdded: async () => ({ ok: true }),
+    pauseRefresh: () => ({ __brand: "codex-pool-pause" }) as never,
+    resumeRefresh: () => {},
+    subscribeLoadObserver: () => () => {},
+    readLastThreshold: () => undefined,
+    ...overrides,
+  };
+}
+
+beforeEach(() => {
+  previous = Object.fromEntries(globals.map((k) => [k, Reflect.get(globalThis, k)])) as typeof previous;
+  win = new Window({ url: "http://localhost/" });
+  Object.defineProperty(win.navigator, "language", { configurable: true, value: "en-US" });
+  Object.defineProperties(globalThis, {
+    document: { configurable: true, value: win.document },
+    window: { configurable: true, value: win },
+    navigator: { configurable: true, value: win.navigator },
+    localStorage: { configurable: true, value: win.localStorage },
+  });
+  (globalThis as typeof globalThis & { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT = true;
+
+  originalFetch = globalThis.fetch;
+  Object.defineProperty(globalThis, "fetch", {
+    configurable: true,
+    value: async () => Response.json({ accounts: [], activeCodexAccountId: null, autoSwitchThreshold: 80 }),
+  });
+
+  host = win.document.createElement("div") as unknown as HTMLElement;
+  win.document.body.appendChild(host as never);
+});
+
+afterEach(async () => {
+  if (root) {
+    const current = root;
+    await act(async () => { current.unmount(); });
+    root = null;
+  }
+  await act(async () => { await new Promise((r) => setTimeout(r, 0)); });
+  for (const key of globals) {
+    Object.defineProperty(globalThis, key, { configurable: true, value: previous[key] });
+  }
+  Object.defineProperty(globalThis, "fetch", { configurable: true, value: originalFetch });
+  await win.happyDOM?.close?.();
+});
+
+async function mountPool(controller: CodexAccountPoolController) {
+  const { createRoot } = await import("react-dom/client");
+  await act(async () => {
+    root = createRoot(host);
+    root.render(
+      <LanguageProvider>
+        <CodexAccountPool apiBase="" controller={controller} />
+      </LanguageProvider>,
+    );
+  });
+  await act(async () => { await new Promise((r) => setTimeout(r, 40)); });
+}
+
+/** Each card is found by the email it prints, so neither card needs a test-only hook. */
+function cardFor(email: string): Element {
+  const card = [...host.querySelectorAll(".card")].find((el) => (el.textContent ?? "").includes(email));
+  expect(card).toBeTruthy();
+  return card!;
+}
+
+function hasPinnedBadge(scope: ParentNode): boolean {
+  return [...scope.querySelectorAll(".badge")].some((el) => (el.textContent ?? "").trim() === en["codexAuth.pinned"]);
+}
+
+function hasPinnedHint(scope: ParentNode): boolean {
+  return [...scope.querySelectorAll(".card-sub")].some((el) => (el.textContent ?? "").trim() === en["codexAuth.pinnedHint"]);
+}
+
+test("a pinned pool account says so, and only on its own card", async () => {
+  await mountPool(makeController({ activeId: "pool-1", activePinnedId: "pool-1" }));
+
+  const pooled = cardFor("pool@example.test");
+  expect(hasPinnedBadge(pooled)).toBe(true);
+  expect(hasPinnedHint(pooled)).toBe(true);
+
+  const main = cardFor("main@example.test");
+  expect(hasPinnedBadge(main)).toBe(false);
+  expect(hasPinnedHint(main)).toBe(false);
+});
+
+test("a pinned app login says so, and only on its own card", async () => {
+  await mountPool(makeController({ activeId: null, activePinnedId: "__main__" }));
+
+  const main = cardFor("main@example.test");
+  expect(hasPinnedBadge(main)).toBe(true);
+  expect(hasPinnedHint(main)).toBe(true);
+
+  const pooled = cardFor("pool@example.test");
+  expect(hasPinnedBadge(pooled)).toBe(false);
+  expect(hasPinnedHint(pooled)).toBe(false);
+});
+
+// The case that made the badge worth keying off the pinned id: the pin caps the tier, the
+// strategy cursor moves to a same-tier sibling, and the operator's choice is still the
+// reason every higher tier is being skipped. A badge that followed the active card would
+// vanish here and give no clue why the higher-order account is idle.
+test("the badge stays on the pinned account when rotation moves off it", async () => {
+  const sibling: CodexAccountEntry = { ...account, id: "pool-2", email: "sibling@example.test" };
+  await mountPool(makeController({
+    accounts: [mainAccount, account, sibling],
+    activeId: "pool-2",
+    activePinnedId: "pool-1",
+  }));
+
+  const pinned = cardFor("pool@example.test");
+  expect(hasPinnedBadge(pinned)).toBe(true);
+  expect(hasPinnedHint(pinned)).toBe(true);
+
+  const active = cardFor("sibling@example.test");
+  expect(hasPinnedBadge(active)).toBe(false);
+  expect(hasPinnedHint(active)).toBe(false);
+});
+
+test("an account rotation picked carries no pin", async () => {
+  await mountPool(makeController({ activeId: "pool-1", activePinnedId: null }));
+
+  expect(hasPinnedBadge(host)).toBe(false);
+  expect(hasPinnedHint(host)).toBe(false);
+});
+
+test("a paused account is never shown as pinned", async () => {
+  // Pausing releases the pin server-side, so a pin that still names an excluded account is
+  // a stale read. Routing cannot be sitting on it, so the card must not claim otherwise.
+  await mountPool(makeController({
+    accounts: [mainAccount, { ...account, paused: true }],
+    activeId: "pool-1",
+    activePinnedId: "pool-1",
+  }));
+
+  expect(hasPinnedBadge(host)).toBe(false);
+  expect(hasPinnedHint(host)).toBe(false);
+});
diff --git a/gui/tests/codex-account-pool-toast-tone.test.tsx b/gui/tests/codex-account-pool-toast-tone.test.tsx
index cef08456cd..a8b08c06be 100644
--- a/gui/tests/codex-account-pool-toast-tone.test.tsx
+++ b/gui/tests/codex-account-pool-toast-tone.test.tsx
@@ -2,6 +2,7 @@ import { afterEach, beforeEach, expect, test } from "bun:test";
 import { Window } from "happy-dom";
 import { act } from "react";
 import type { Root } from "react-dom/client";
+import { formatAccountPriority } from "../src/account-priority";
 import CodexAccountPool from "../src/components/CodexAccountPool";
 import type { CodexAccountEntry, CodexAccountPoolController } from "../src/hooks/useCodexAccountPool";
 import { LanguageProvider } from "../src/i18n/provider";
@@ -23,6 +24,7 @@ const account: CodexAccountEntry = {
   email: "pool@example.test",
   isMain: false,
   paused: false,
+  priority: 0,
   hasCredential: true,
   quota: { resetCredits: 2, updatedAt: 1 },
 };
@@ -30,18 +32,21 @@ const account: CodexAccountEntry = {
 function makeController(overrides: Partial<CodexAccountPoolController> = {}): CodexAccountPoolController {
   return {
     accounts: [
-      { id: "main", email: "main@example.test", isMain: true, paused: false, hasCredential: true, quota: null },
+      { id: "main", email: "main@example.test", isMain: true, paused: false, priority: 0, hasCredential: true, quota: null },
       account,
     ],
     activeId: null,
     loadState: "ready",
     switchingId: null,
     pauseUpdatingId: null,
+    priorityUpdatingId: null,
     pausingExhausted: false,
     activeNeedsReauth: false,
+    activePinnedId: null,
     load: async () => true,
     switchAccount: async () => ({ ok: true, activeId: null }),
     setAccountPaused: async () => ({ ok: true }),
+    setAccountPriority: async () => ({ ok: true }),
     pauseExhaustedAccounts: async () => ({ ok: true, pausedCount: 0 }),
     saveAlias: async () => ({ ok: true }),
     removeAccount: async () => ({ ok: false, reason: "request" }),
@@ -119,6 +124,84 @@ async function mountPool(controller: CodexAccountPoolController) {
   await act(async () => { await new Promise((r) => setTimeout(r, 40)); });
 }
 
+async function chooseOrder(selectId: string, value: string): Promise<void> {
+  const trigger = host.querySelector(`#${selectId}`) as HTMLButtonElement | null;
+  expect(trigger).toBeTruthy();
+  await act(async () => { trigger!.click(); });
+
+  // The menu is portaled to document.body, so the options are not under the mount node.
+  // Every label ends in the signed number, which is what identifies the order being picked.
+  const wanted = `(${formatAccountPriority(Number(value))})`;
+  const option = [...win.document.querySelectorAll<HTMLButtonElement>('[role="option"]')]
+    .find((candidate) => candidate.textContent?.endsWith(wanted));
+  expect(option).toBeTruthy();
+  await act(async () => {
+    option!.click();
+    await new Promise((r) => setTimeout(r, 0));
+  });
+}
+
+test("a saved selection order reports in the ok tone", async () => {
+  const saved: { id: string; priority: number | null }[] = [];
+  await mountPool(makeController({
+    setAccountPriority: async (id, priority) => {
+      saved.push({ id, priority });
+      return { ok: true };
+    },
+  }));
+
+  await chooseOrder("codex-account-priority-pool-1", "2");
+
+  expect(saved).toEqual([{ id: "pool-1", priority: 2 }]);
+  expect(host.querySelector(".codex-auth-page-head__feedback.is-ok")?.textContent).toContain("pool@example.test");
+  expect(host.querySelector(".codex-auth-page-head__feedback.is-err")).toBeNull();
+});
+
+test("a rejected selection order reports in the error tone", async () => {
+  await mountPool(makeController({
+    setAccountPriority: async () => ({ ok: false, reason: "request" }),
+  }));
+
+  await chooseOrder("codex-account-priority-__main__", "-1");
+
+  const error = host.querySelector(".codex-auth-page-head__feedback.is-err");
+  expect(error).toBeTruthy();
+  expect(error?.textContent).toContain("main@example.test");
+  expect(host.querySelector(".codex-auth-page-head__feedback.is-ok")).toBeNull();
+});
+
+test("a busy selection order write shows no toast at all", async () => {
+  await mountPool(makeController({
+    setAccountPriority: async () => ({ ok: false, reason: "busy" }),
+  }));
+
+  await chooseOrder("codex-account-priority-pool-1", "-2");
+
+  expect(host.querySelector(".codex-auth-page-head__feedback.is-err")).toBeNull();
+  expect(host.querySelector(".codex-auth-page-head__feedback.is-ok")).toBeNull();
+});
+
+test("picking the order an account already has writes nothing", async () => {
+  const saved: { id: string; priority: number | null }[] = [];
+  await mountPool(makeController({
+    setAccountPriority: async (id, priority) => {
+      saved.push({ id, priority });
+      return { ok: true };
+    },
+  }));
+
+  // pool-1 is already Normal (0). Select fires onChange for the clicked option whether or
+  // not it was the selected one, and commits the highlighted option on Tab-out of an open
+  // menu, so this is reachable by an ordinary mis-click. It must not reach the server: the
+  // route releases the pin on every accepted write, so a no-op order pick would silently
+  // unpin the account the operator chose, reporting success while doing it.
+  await chooseOrder("codex-account-priority-pool-1", "0");
+
+  expect(saved).toEqual([]);
+  expect(host.querySelector(".codex-auth-page-head__feedback.is-ok")).toBeNull();
+  expect(host.querySelector(".codex-auth-page-head__feedback.is-err")).toBeNull();
+});
+
 test("successful redeem clears a stale error toast tone", async () => {
   await mountPool(makeController());
 
diff --git a/src/cli/account-api.ts b/src/cli/account-api.ts
index a03b29e1f8..452a000037 100644
--- a/src/cli/account-api.ts
+++ b/src/cli/account-api.ts
@@ -21,6 +21,8 @@ export interface AccountRow {
   masked?: string;
   active: boolean;
   needsReauth?: boolean;
+  /** Codex pool selection order, higher used earlier. Absent where ordering does not apply. */
+  priority?: number;
   quota?: CodexQuotaDto | null;
 }
 
@@ -172,6 +174,7 @@ interface CodexAccountDto {
   plan?: string;
   isMain?: boolean;
   needsReauth?: boolean;
+  priority?: number;
   quota?: CodexQuotaDto | null;
 }
 
@@ -219,6 +222,7 @@ export async function fetchCodexRows(
     plan: a.plan,
     active: a.id === activeId,
     needsReauth: a.needsReauth,
+    priority: typeof a.priority === "number" ? a.priority : 0,
     ...(forceRefresh ? { quota: projectQuota(a.quota) } : {}),
   }));
   return { rows, activeId, autoSwitchThreshold, status: 200 };
diff --git a/src/cli/account-extended.ts b/src/cli/account-extended.ts
index 500d407bec..014eb9b34a 100644
--- a/src/cli/account-extended.ts
+++ b/src/cli/account-extended.ts
@@ -1,4 +1,10 @@
 import { loadConfig } from "../config";
+import {
+  MAX_ACCOUNT_PRIORITY,
+  MIN_ACCOUNT_PRIORITY,
+  normalizeAccountPriority,
+  parseAccountPriority,
+} from "../codex/pool-rotation";
 import {
   apiError,
   apiJson,
@@ -18,6 +24,7 @@ const EXTENDED_USAGE = `Usage:
   ocx account refresh <provider> [--json]
   ocx account auto-switch <provider> <on|off|status|threshold <0-100>> [--json]
   ocx account alias <provider> <id|main> <display-name|-> [--json]
+  ocx account priority <provider> <id|main> [<-100..100|first|earlier|normal|later|last|reset>] [--json]
   ocx account remove <provider> <id|main> --yes [--json]
   ocx account clear-cooldown <provider> <id|main> [--json]
   ocx account add-key <provider> [--label <label>] [--json]`;
@@ -316,6 +323,111 @@ export async function cmdClearCooldown(args: string[], deps: AccountDeps): Promi
   return 0;
 }
 
+/**
+ * Named selection orders. The words convey sequence rather than rank because the
+ * pool moves down the list only when everything above it is drained — "high
+ * priority" would suggest the account gets more traffic, which is not what
+ * ordering does.
+ */
+const PRIORITY_PRESETS: Record<string, number> = {
+  first: 2,
+  earlier: 1,
+  normal: 0,
+  later: -1,
+  last: -2,
+};
+
+function priorityPresetName(priority: number): string | null {
+  return Object.entries(PRIORITY_PRESETS).find(([, value]) => value === priority)?.[0] ?? null;
+}
+
+function formatPriority(priority: number): string {
+  const preset = priorityPresetName(priority);
+  const signed = priority > 0 ? `+${priority}` : String(priority);
+  return preset ? `${signed} (${preset})` : signed;
+}
+
+/** `null` = reset to the default; `undefined` = unparseable. */
+function parsePriorityArgument(raw: string): number | null | undefined {
+  const word = raw.trim().toLowerCase();
+  if (word === "reset") return null;
+  // Own keys only: `in` also matches "constructor", "__proto__", and friends.
+  if (Object.hasOwn(PRIORITY_PRESETS, word)) return PRIORITY_PRESETS[word];
+  // The regex only rules out shapes Number() would coerce ("1e2", " 1 ", ""); the range
+  // itself comes from the core parser so the CLI cannot drift from what the API accepts.
+  if (!/^[+-]?\d+$/.test(word)) return undefined;
+  return parseAccountPriority(Number(word)) ?? undefined;
+}
+
+export async function cmdPriority(args: string[], deps: AccountDeps): Promise<number> {
+  const wantsJson = flag(args, "--json");
+  const name = args.shift();
+  const requestedId = args.shift();
+  const requestedPriority = args.shift();
+  if (!name || !requestedId || args.length) return usage();
+  const classified = configAndType(deps, name);
+  if ("error" in classified) return usage(`Error: ${classified.error}`);
+  if (classified.type !== "codex") {
+    return usage("Error: selection order only applies to the openai Codex account pool");
+  }
+  const id = requestedId === "main" ? MAIN_ID : requestedId;
+
+  // Validate before touching the network so a typo never reaches the proxy.
+  let priority: number | null | undefined;
+  if (requestedPriority !== undefined) {
+    priority = parsePriorityArgument(requestedPriority);
+    if (priority === undefined) {
+      return usage(`Error: selection order must be an integer ${MIN_ACCOUNT_PRIORITY}..${MAX_ACCOUNT_PRIORITY}, one of ${Object.keys(PRIORITY_PRESETS).join("/")}, or reset`);
+    }
+  }
+
+  const baseUrl = await resolveBaseUrl(deps);
+  if (!baseUrl) return proxyUnreachable();
+
+  // No value means "show" — a read must not rewrite what it is reporting.
+  if (priority === undefined) {
+    const result = await fetchCodexRows(deps, baseUrl);
+    const failed = familyFailure(result, `failed to read ${name} accounts`);
+    if (failed !== null) return failed;
+    const row = result.rows.find(candidate => candidate.id === id);
+    if (!row) return usage(`Error: no ${name} account ${requestedId}`);
+    const current = normalizeAccountPriority(row.priority);
+    if (wantsJson) {
+      console.log(JSON.stringify(
+        { ok: true, provider: name, id, priority: current, preset: priorityPresetName(current) },
+        null,
+        2,
+      ));
+    } else {
+      console.log(`${name}: ${requestedId} selection order is ${formatPriority(current)}`);
+    }
+    return 0;
+  }
+
+  const response = await apiJson(deps, baseUrl, "PUT", "/api/codex-auth/accounts/priority", { id, priority });
+  if (response.status === 0) return proxyUnreachable();
+  if (response.status !== 200) return apiError(response.json, `failed to set selection order for ${requestedId}`);
+  const applied = typeof response.json.priority === "number" ? response.json.priority : (priority ?? 0);
+  if (wantsJson) {
+    console.log(JSON.stringify(
+      { ok: true, provider: name, id, priority: applied, preset: priorityPresetName(applied) },
+      null,
+      2,
+    ));
+  } else {
+    console.log(`${name}: ${requestedId} selection order is now ${formatPriority(applied)}`);
+  }
+  // Not cmdUse's note: re-ordering takes effect on the next unbound request rather than
+  // only on new sessions, because preemption moves those requests up immediately.
+  console.error("Takes effect from the next unbound request; running threads keep their current account until drained.");
+  // The release is not optional and not conditional on the value changing, so it has to be
+  // stated: this route is the only way to clear a pin without immediately setting another,
+  // which means a write storing the order an account already had still releases it. Without
+  // this line that is a silent side effect of a command that looks purely declarative.
+  console.error('Also releases any manual "use this account now" pin, on any account.');
+  return 0;
+}
+
 export async function cmdAlias(args: string[], deps: AccountDeps): Promise<number> {
   const wantsJson = flag(args, "--json");
   const name = args.shift();
diff --git a/src/cli/account.ts b/src/cli/account.ts
index d9bc38687b..da8cc8099f 100644
--- a/src/cli/account.ts
+++ b/src/cli/account.ts
@@ -2,7 +2,7 @@
 import { loadConfig } from "../config";
 import { providerCodexAccountMode } from "../providers/registry";
 import type { OcxConfig } from "../types";
-import { cmdAddKey, cmdAlias, cmdAutoSwitch, cmdClearCooldown, cmdRefresh, cmdRemove } from "./account-extended";
+import { cmdAddKey, cmdAlias, cmdAutoSwitch, cmdClearCooldown, cmdPriority, cmdRefresh, cmdRemove } from "./account-extended";
 import { apiError, apiJson, classifyAccount, fetchRows, proxyUnreachable, resolveBaseUrl, type AccountDeps, type AccountRow, type AccountType, type ApiResult }
   from "./account-api";
 
@@ -22,6 +22,7 @@ const ACCOUNT_USAGE = `Usage:
   ocx account refresh <provider> [--json]
   ocx account auto-switch <provider> <on|off|status|threshold <0-100>> [--json]
   ocx account alias <provider> <account-or-key-id> <display-name|-> [--json]
+  ocx account priority <provider> <account-id|main> [<-100..100|first|earlier|normal|later|last|reset>] [--json]
   ocx account remove <provider> <account-or-key-id|main> --yes [--json]
   ocx account clear-cooldown <provider> <account-id|main> [--json]
   ocx account add-key <provider> [--label <label>] [--json]
@@ -67,11 +68,24 @@ function statusText(row: AccountRow): string {
   return parts.join(" ");
 }
 
+/** Signed so the sort direction reads off the column; "-" where ordering does not apply. */
+function priorityText(row: AccountRow): string {
+  if (row.priority === undefined) return "-";
+  return row.priority > 0 ? `+${row.priority}` : String(row.priority);
+}
+
 export function formatAccountTable(rows: AccountRow[]): string {
-  const header = ["PROVIDER", "TYPE", "ID", "PLAN/LABEL", "STATUS"];
+  const header = ["PROVIDER", "TYPE", "ID", "PLAN/LABEL", "PRIORITY", "STATUS"];
   const data = rows.map(r => {
     const keyLabel = r.masked && r.label !== r.masked ? `${r.masked} (${r.label})` : r.masked;
-    return [r.provider, r.type, displayId(r.id), r.type === "api-key" ? keyLabel ?? "-" : r.label ?? "-", statusText(r)];
+    return [
+      r.provider,
+      r.type,
+      displayId(r.id),
+      r.type === "api-key" ? keyLabel ?? "-" : r.label ?? "-",
+      priorityText(r),
+      statusText(r),
+    ];
   });
   const widths = header.map((h, i) => Math.max(h.length, ...data.map(d => d[i]!.length)));
   const line = (cols: string[]) => cols.map((c, i) => c.padEnd(widths[i]!)).join("  ").trimEnd();
@@ -244,9 +258,11 @@ async function cmdUse(rest: string[], deps: AccountDeps): Promise<number> {
   if (wantsJson) console.log(JSON.stringify({ ok: true, provider: name, type: c.type, activeId }, null, 2));
   else console.log(`${name}: active ${c.type === "api-key" ? "key" : "account"} is now ${displayId(activeId)}`);
   if (c.type === "codex") {
-    console.error("Applies to the next request after clearing existing pool affinity; in-flight requests keep their captured account.");
-    console.error("Note: pool strategy, quota/cooldown/reauthentication state, and failure recovery may later select another eligible account.");
-    console.error("Conversation context is replayed after account changes, but the provider-side prompt cache may be cold.");
+    console.error("Takes effect immediately; running threads move on their next request, and in-flight requests keep the account they captured.");
+    const active = await apiJson(deps, baseUrl, "GET", "/api/codex-auth/active");
+    if (active.status === 200 && typeof active.json.autoSwitchThreshold === "number" && active.json.autoSwitchThreshold > 0) {
+      console.error(`Note: auto-switch (threshold ${active.json.autoSwitchThreshold}%) may override this pin.`);
+    }
   }
   return 0;
 }
@@ -260,6 +276,7 @@ export async function cmdAccount(args: string[], deps: AccountDeps = {}): Promis
     if (sub === "refresh") return await cmdRefresh(rest, deps);
     if (sub === "auto-switch") return await cmdAutoSwitch(rest, deps);
     if (sub === "alias" || sub === "rename") return await cmdAlias(rest, deps);
+    if (sub === "priority") return await cmdPriority(rest, deps);
     if (sub === "remove") return await cmdRemove(rest, deps);
     if (sub === "clear-cooldown") return await cmdClearCooldown(rest, deps);
     if (sub === "add-key") return await cmdAddKey(rest, deps);
diff --git a/src/cli/config-command.ts b/src/cli/config-command.ts
index f90cfec5b3..6df1d0aaf2 100644
--- a/src/cli/config-command.ts
+++ b/src/cli/config-command.ts
@@ -1,4 +1,5 @@
 import { readFileSync, writeFileSync } from "node:fs";
+import { clearCodexAccountPin } from "../codex/account-priority";
 import { getConfigPath, readConfigDiagnostics, saveConfig, validateConfigCandidate } from "../config";
 import type { OcxConfig } from "../types";
 import { CliUsageError, printData, rejectArgs, runCliAction, takeFlag } from "./runtime-api";
@@ -102,6 +103,14 @@ export async function handleConfigCommand(argv: string[]): Promise<number> {
       setPath(candidate, path, raw === undefined ? undefined : parseValue(raw), action === "unset");
       const config = validate(candidate);
       const savedValue = action === "unset" ? null : getPath(config, path);
+      // Setting the order here is the operator restating it, exactly as through
+      // `ocx account priority` or the management route, so it releases the manual pin
+      // for the same reason those do: a pin made before any order existed would
+      // otherwise outrank every order set afterwards, capping the pool at the pinned
+      // account's tier with nothing on any surface explaining why. `import` is
+      // deliberately not covered — that file supplies its own pin, so there is no
+      // stale one to release.
+      if (pathSegments(path)[0] === "codexAccountPriorities") clearCodexAccountPin(config);
       saveConfig(config);
       printData({ ok: true, path, value: redact(savedValue, path.split(".").at(-1)) }, wantsJson,
         [`${action === "unset" ? "Unset" : "Set"} ${path}.`]);
diff --git a/src/cli/help.ts b/src/cli/help.ts
index 77a50b5166..f768494478 100644
--- a/src/cli/help.ts
+++ b/src/cli/help.ts
@@ -110,7 +110,7 @@ const helpEntries: Record<string, HelpEntry> = {
     ],
   },
   account: {
-    usage: "ocx account <list|current|use|refresh|auto-switch|login|reauth|code|cancel|remove|add-key|reset-credits|main> ...",
+    usage: "ocx account <list|current|use|refresh|auto-switch|priority|login|reauth|code|cancel|remove|add-key|reset-credits|main> ...",
     summary: "List and switch provider accounts and API-key pools (GUI parity).",
     details: [
       "list [provider]     Codex account pool, OAuth accounts and API keys (identifiers shown masked as the API returns them).",
@@ -118,12 +118,14 @@ const helpEntries: Record<string, HelpEntry> = {
       "use <provider> <id> Switch the active credential; 'main' selects the Codex App login.",
       "refresh <provider>  Force-refresh Codex or provider quota reports.",
       "auto-switch <provider> <on|off|status|threshold N>  Control the Codex pool threshold.",
+      "priority <provider> <id|main> [first|earlier|normal|later|last|-100..100|reset]  Selection order; omit the value to read it.",
       "remove <provider> <id> --yes  Remove a stored account or key after an existence check.",
       "add-key <provider> [--label <label>]  Add a key read only from piped stdin.",
       "login/reauth/code/cancel  Run browser or manual-code auth from a headless shell.",
       "reset-credits <id|main> [--consume --yes]  Inspect or consume Codex reset credits.",
       "main <subcommand>     Manage the physical native Codex login separately from Pool routing.",
-      "Codex pool selection applies to the next request after clearing existing affinity; in-flight requests keep their captured account.",
+      "Switching the active account takes effect immediately; running threads move on their next request, and in-flight requests keep the account they captured.",
+      "A selection-order change applies from the next unbound request and never moves a bound thread.",
     ],
   },
   models: {
diff --git a/src/codex/account-lifecycle.ts b/src/codex/account-lifecycle.ts
index 1d9ecee29a..598457cec1 100644
--- a/src/codex/account-lifecycle.ts
+++ b/src/codex/account-lifecycle.ts
@@ -7,6 +7,7 @@ import { clearCodexUpstreamHealthForAccount, clearThreadAccountMapForAccount } f
 import { invalidateCodexWebSocketsForAccount } from "./websocket-registry";
 import { clearMainAccountCredentialPresence, clearMainAccountInfoCache } from "./main-account-cache";
 import { forgetCodexAccountPause } from "./account-pause";
+import { clearCodexAccountPin, forgetCodexAccountPriority } from "./account-priority";
 import type { OcxConfig } from "../types";
 
 let observedMainChatgptAccountId: string | undefined;
@@ -74,6 +75,8 @@ export function deleteCodexAccount(runtimeConfig: OcxConfig, accountId: string):
   runtimeConfig.codexAccounts = (runtimeConfig.codexAccounts ?? [])
     .filter(account => account.isMain || account.id !== accountId);
   forgetCodexAccountPause(runtimeConfig, accountId);
+  forgetCodexAccountPriority(runtimeConfig, accountId);
+  clearCodexAccountPin(runtimeConfig, accountId);
   if (runtimeConfig.activeCodexAccountId === accountId) runtimeConfig.activeCodexAccountId = undefined;
   purgeCodexAccountRuntimeState(accountId);
   invalidateCodexWebSocketsForAccount(accountId);
diff --git a/src/codex/account-priority.ts b/src/codex/account-priority.ts
new file mode 100644
index 0000000000..0bac71ab85
--- /dev/null
+++ b/src/codex/account-priority.ts
@@ -0,0 +1,83 @@
+import { isValidCodexAccountId, MAIN_CODEX_ACCOUNT_ID } from "./account-id";
+import { DEFAULT_ACCOUNT_PRIORITY, normalizeAccountPriority } from "./pool-rotation";
+import type { OcxConfig } from "../types";
+
+/**
+ * Which ids may carry a selection order: any pool account, plus the synthetic
+ * `__main__` Desktop login. Owned here rather than by the config schema because
+ * every writer needs it — the schema rejects a bad key on load, but the management
+ * API has to reject one before `setCodexAccountPriority` persists it as an own
+ * property that the schema would then reject, degrading the whole map.
+ */
+export function isCodexAccountPriorityKey(key: unknown): key is string {
+  return key === MAIN_CODEX_ACCOUNT_ID || isValidCodexAccountId(key);
+}
+
+/**
+ * Persisted selection order for one account: higher numbers are used earlier.
+ * Stored as a config sidecar rather than a `codexAccounts` row field because the
+ * Codex Desktop login (`__main__`) has no row and must be orderable too.
+ */
+export function getCodexAccountPriority(config: OcxConfig, accountId: string): number {
+  return codexAccountPriorityLookup(config)(accountId);
+}
+
+/**
+ * Write one account's selection order. The default is stored as absence, so a
+ * pool that was never ordered keeps no map at all and routing takes its fast path.
+ * Entries are rebuilt through `Object.fromEntries` so a reserved key such as
+ * `__proto__` becomes an own data property instead of invoking a prototype setter.
+ */
+export function setCodexAccountPriority(config: OcxConfig, accountId: string, priority: number): void {
+  const entries = new Map(Object.entries(config.codexAccountPriorities ?? {}));
+  if (priority === DEFAULT_ACCOUNT_PRIORITY) entries.delete(accountId);
+  else entries.set(accountId, priority);
+
+  if (entries.size > 0) config.codexAccountPriorities = Object.fromEntries(entries);
+  else delete config.codexAccountPriorities;
+}
+
+export function forgetCodexAccountPriority(config: OcxConfig, accountId: string): void {
+  setCodexAccountPriority(config, accountId, DEFAULT_ACCOUNT_PRIORITY);
+}
+
+/**
+ * Stable lookup for one selection pass. Routing calls this once per pick and
+ * hands the closure to `selectPriorityTier`, so a pool without stored order pays
+ * a single map read rather than one per candidate.
+ */
+export function codexAccountPriorityLookup(config: OcxConfig): (accountId: string) => number {
+  const priorities = config.codexAccountPriorities;
+  if (!priorities) return () => DEFAULT_ACCOUNT_PRIORITY;
+  return accountId => (
+    Object.hasOwn(priorities, accountId)
+      ? normalizeAccountPriority(priorities[accountId])
+      : DEFAULT_ACCOUNT_PRIORITY
+  );
+}
+
+/**
+ * The account an operator most recently selected by hand. While pinned, priority
+ * never preempts upward: the pin is a tier *ceiling* for round-robin/fill-first --
+ * `selectPriorityTier` skips every tier above the pinned account's, so higher-ordered
+ * accounts are suppressed rather than the pinned one being guaranteed -- and a veto in
+ * the quota path, until the account crosses the auto-switch threshold.
+ */
+export function pinnedCodexAccountId(config: OcxConfig): string | undefined {
+  return config.activeCodexAccountPinned;
+}
+
+export function isCodexAccountPinned(config: OcxConfig, accountId: string): boolean {
+  return config.activeCodexAccountPinned === accountId;
+}
+
+export function setCodexAccountPin(config: OcxConfig, accountId: string): void {
+  config.activeCodexAccountPinned = accountId;
+}
+
+/** Release the pin. With `accountId` given, only when it is the pinned account. */
+export function clearCodexAccountPin(config: OcxConfig, accountId?: string): void {
+  if (accountId === undefined || config.activeCodexAccountPinned === accountId) {
+    delete config.activeCodexAccountPinned;
+  }
+}
diff --git a/src/codex/auth-api.ts b/src/codex/auth-api.ts
index 3bb6577292..043df28286 100644
--- a/src/codex/auth-api.ts
+++ b/src/codex/auth-api.ts
@@ -15,20 +15,33 @@ import {
 } from "./account-store";
 import { deleteCodexAccount, reconcileMainCodexAccountRuntimeState } from "./account-lifecycle";
 import { isCodexAccountPaused, setCodexAccountPaused } from "./account-pause";
+import {
+  clearCodexAccountPin,
+  getCodexAccountPriority,
+  isCodexAccountPriorityKey,
+  pinnedCodexAccountId,
+  setCodexAccountPin,
+  setCodexAccountPriority,
+} from "./account-priority";
 import {
   claimDueCodexQuotaRecoveryProbes,
   clearCodexAccountCooldown,
   clearThreadAccountMapForAccount,
   getEffectiveActiveCodexAccountId,
+  isEffectiveCodexAccountPinned,
   reconcileCodexActiveAfterExclusion,
   resetCodexRoutingForManualSelection,
   settleCodexQuotaRecoveryProbe,
 } from "./routing";
 import {
+  DEFAULT_ACCOUNT_PRIORITY,
+  MAX_ACCOUNT_PRIORITY,
+  MIN_ACCOUNT_PRIORITY,
   normalizeAccountPoolStickyLimit,
   normalizeAccountPoolStrategy,
   parseAccountPoolStickyLimit,
   parseAccountPoolStrategy,
+  parseAccountPriority,
 } from "./pool-rotation";
 import { checkAccountIdCollision, getMainChatgptAccountId, readCodexTokens, readCodexTokensResult } from "./auth-collision";
 export { checkAccountIdCollision, getMainChatgptAccountId } from "./auth-collision";
@@ -191,6 +204,7 @@ function poolAccountDto(
   quotaResult: PoolQuotaResult,
   hasCredential: boolean,
   paused: boolean,
+  priority: number,
 ): CodexAuthAccountDto {
   const quota = quotaForPlan(quotaResult.quota, account.plan);
   const needsReauth = !hasCredential || quotaResult.needsReauth || isAccountNeedsReauth(account.id);
@@ -203,6 +217,7 @@ function poolAccountDto(
     ...(account.logLabel !== undefined ? { logLabel: account.logLabel } : {}),
     isMain: false,
     paused,
+    priority,
     quota: quota ? { ...quota } : null,
     needsReauth,
     hasCredential,
@@ -644,6 +659,8 @@ export interface CodexAuthAccountDto {
   logLabel?: string;
   isMain: boolean;
   paused: boolean;
+  /** Selection order; higher is used earlier. Always present, 0 when unset. */
+  priority: number;
   quota: (StoredAccountQuota | (Omit<StoredAccountQuota, "updatedAt"> & { updatedAt: number })) | null;
   needsReauth?: boolean;
   hasCredential: boolean;
@@ -1017,6 +1034,7 @@ export async function listCodexAuthAccountsSnapshot(
         { quota: null, needsReauth: true },
         false,
         isCodexAccountPaused(runtimeConfig, accountId),
+        getCodexAccountPriority(runtimeConfig, accountId),
       )];
     }
     const resultGeneration = quotaResult.credentialGeneration ?? quotaResult.freshCredentialGeneration;
@@ -1035,6 +1053,7 @@ export async function listCodexAuthAccountsSnapshot(
       effectiveQuotaResult,
       true,
       isCodexAccountPaused(runtimeConfig, accountId),
+      getCodexAccountPriority(runtimeConfig, accountId),
     )];
   });
   const fetchedMainGeneration = mainResult.identityGeneration ?? captureMainAccountIdentityGeneration();
@@ -1055,6 +1074,7 @@ export async function listCodexAuthAccountsSnapshot(
     plan: mainInfo.plan,
     isMain: true,
     paused: isCodexAccountPaused(runtimeConfig, MAIN_CODEX_ACCOUNT_ID),
+    priority: getCodexAccountPriority(runtimeConfig, MAIN_CODEX_ACCOUNT_ID),
     hasCredential: hasMainCredential,
     needsReauth: mainNeedsReauth,
     quota: mainInfo.quota ? {
@@ -1297,6 +1317,53 @@ export async function handleCodexAuthAPI(
     });
   }
 
+  // Deliberately a route of its own rather than a field on the alias PATCH: aliases
+  // are display-only and reject __main__, while selection order is routing metadata
+  // that the Desktop account must be able to carry. Re-ordering never kicks a live
+  // thread, so there is no affinity clearing and no appliesImmediately here.
+  if (url.pathname === "/api/codex-auth/accounts/priority" && req.method === "PUT") {
+    let parsedBody: unknown;
+    try { parsedBody = await req.json(); } catch { return jsonResponse({ error: "Invalid JSON" }, 400); }
+    if (typeof parsedBody !== "object" || parsedBody === null || Array.isArray(parsedBody)) {
+      return jsonResponse({ error: "body must be an object" }, 400);
+    }
+    const body = parsedBody as { id?: unknown; priority?: unknown };
+    const id = typeof body.id === "string" ? body.id.trim() : "";
+    if (!isCodexAccountPriorityKey(id)) {
+      return jsonResponse({ error: "Invalid account id format" }, 400);
+    }
+
+    let priority = DEFAULT_ACCOUNT_PRIORITY;
+    if (body.priority !== null) {
+      const parsed = parseAccountPriority(body.priority);
+      if (parsed === null) {
+        return jsonResponse({
+          error: `priority must be null or an integer ${MIN_ACCOUNT_PRIORITY}-${MAX_ACCOUNT_PRIORITY}`,
+        }, 400);
+      }
+      priority = parsed;
+    }
+
+    const runtimeConfig = getRuntimeConfig(config);
+    const exists = id === MAIN_CODEX_ACCOUNT_ID
+      || (runtimeConfig.codexAccounts ?? []).some(account => isSelectableCodexPoolAccount(account) && account.id === id);
+    if (!exists) return jsonResponse({ error: "Account not found" }, 404);
+
+    setCodexAccountPriority(runtimeConfig, id, priority);
+    // Both a pin and an order are the operator saying which account to use, so the newer
+    // statement wins. Without this a pin made before any order existed — an ordinary
+    // account switch — would outrank the order forever: it blocks preemption and caps
+    // every eligibility list at its own tier until that account drains or is paused.
+    clearCodexAccountPin(runtimeConfig);
+    saveRuntimeConfig(config, runtimeConfig);
+    return jsonResponse({
+      ok: true,
+      id,
+      priority,
+      activeCodexAccountId: getEffectiveActiveCodexAccountId(runtimeConfig) ?? null,
+    });
+  }
+
   if (url.pathname === "/api/codex-auth/accounts/pause-exhausted" && req.method === "PUT") {
     const runtimeConfig = getRuntimeConfig(config);
     const result = await pauseExhaustedCodexAccounts(
@@ -1359,6 +1426,15 @@ export async function handleCodexAuthAPI(
       if (!exists) return jsonResponse({ error: "Account not found" }, 400);
     }
     runtimeConfig.activeCodexAccountId = body.accountId ?? undefined;
+    // "Use this account now" outranks selection order until the account is spent:
+    // persisted here rather than in resetCodexRoutingForManualSelection, which is
+    // runtime state only. A null id clears the selection instead of making one, so it
+    // must release the pin rather than record one: pinning the `targetAccountId`
+    // fallback would leave a pin that no effective active account matches, which
+    // `isEffectiveCodexAccountPinned` reports as unpinned while the tier filter still
+    // honours it as a ceiling — invisibly capping the pool at the main account's tier.
+    if (body.accountId == null) clearCodexAccountPin(runtimeConfig);
+    else setCodexAccountPin(runtimeConfig, targetAccountId);
     resetCodexRoutingForManualSelection(targetAccountId);
     saveRuntimeConfig(config, runtimeConfig);
     return jsonResponse({ ok: true, activeCodexAccountId: body.accountId, appliesImmediately: true });
@@ -1368,6 +1444,13 @@ export async function handleCodexAuthAPI(
     const runtimeConfig = getRuntimeConfig(config);
     return jsonResponse({
       activeCodexAccountId: getEffectiveActiveCodexAccountId(runtimeConfig) ?? null,
+      pinned: isEffectiveCodexAccountPinned(runtimeConfig),
+      // Which account carries the pin, not just whether the active one does. Under
+      // round-robin or fill-first the pin caps the tier ceiling at its own tier while the
+      // strategy cursor moves freely inside that tier, so `pinned` alone goes false on a
+      // sibling's turn even though the pin is still suppressing every higher tier. The id
+      // lets a surface mark the account the operator actually chose.
+      pinnedAccountId: pinnedCodexAccountId(runtimeConfig) ?? null,
       autoSwitchThreshold: runtimeConfig.autoSwitchThreshold ?? 80,
       upstreamFailoverThreshold: runtimeConfig.upstreamFailoverThreshold ?? 3,
       accountPoolStrategy: normalizeAccountPoolStrategy(runtimeConfig.accountPoolStrategy),
diff --git a/src/codex/pool-rotation.ts b/src/codex/pool-rotation.ts
index 47d4576a96..d0d032be06 100644
--- a/src/codex/pool-rotation.ts
+++ b/src/codex/pool-rotation.ts
@@ -19,6 +19,11 @@ const MAX_STICKY_LIMIT = 100;
 const DEFAULT_STRATEGY: OcxAccountPoolRotationStrategy = "quota";
 const VALID_STRATEGIES = new Set<OcxAccountPoolRotationStrategy>(["quota", "round-robin", "fill-first"]);
 
+/** Selection order for an account with no stored preference: one flat tier. */
+export const DEFAULT_ACCOUNT_PRIORITY = 0;
+export const MIN_ACCOUNT_PRIORITY = -100;
+export const MAX_ACCOUNT_PRIORITY = 100;
+
 /** Strict parse for management APIs — returns null instead of defaulting. */
 export function parseAccountPoolStrategy(raw: unknown): OcxAccountPoolRotationStrategy | null {
   if (typeof raw === "string" && VALID_STRATEGIES.has(raw as OcxAccountPoolRotationStrategy)) {
@@ -43,6 +48,71 @@ export function normalizeAccountPoolStickyLimit(raw: unknown): number {
   return parseAccountPoolStickyLimit(raw) ?? DEFAULT_STICKY_LIMIT;
 }
 
+/** Strict parse for management APIs — returns null instead of defaulting. */
+export function parseAccountPriority(raw: unknown): number | null {
+  if (
+    typeof raw === "number"
+    && Number.isInteger(raw)
+    && raw >= MIN_ACCOUNT_PRIORITY
+    && raw <= MAX_ACCOUNT_PRIORITY
+  ) {
+    return raw;
+  }
+  return null;
+}
+
+export function normalizeAccountPriority(raw: unknown): number {
+  return parseAccountPriority(raw) ?? DEFAULT_ACCOUNT_PRIORITY;
+}
+
+/**
+ * Narrow an already-eligible account list to the highest selection-order tier that
+ * still has usable quota. Priority is an *ordering* boundary layered on top of
+ * eligibility: it never admits an account the caller already filtered out, and it
+ * never keeps the pool on a tier whose every member is drained.
+ *
+ * Contract (each clause is load-bearing for "no behavior change when unconfigured"):
+ * - one distinct priority across `ids` (the unconfigured case) returns `ids` unchanged,
+ *   so today's pick sequence is preserved byte for byte;
+ * - input order is preserved inside the returned tier, which keeps the `__main__`
+ *   head-of-list bias and the first-index tie-break used by SWRR/lowest-usage;
+ * - every tier drained returns `ids` unchanged, reproducing today's
+ *   stay-put-until-429 behavior rather than inventing a pick;
+ * - a `pinnedId` that is present *and* has headroom lowers the ceiling to its own
+ *   tier, which is what makes a manual "use this now" survive round-robin and
+ *   fill-first without any mutable selection state. A drained or absent pin is
+ *   ignored, so the pin expires on its own once the account crosses the threshold.
+ */
+export function selectPriorityTier(
+  ids: readonly string[],
+  priorityOf: (id: string) => number,
+  hasHeadroom: (id: string) => boolean,
+  pinnedId?: string,
+): readonly string[] {
+  // Readonly out as well as in: the no-change cases return the caller's own array, so a
+  // mutating caller would corrupt its input in exactly the cases that must not change.
+  const list = ids;
+  if (list.length <= 1) return list;
+
+  const priorities = list.map(priorityOf);
+  const firstPriority = priorities[0]!;
+  if (priorities.every(priority => priority === firstPriority)) return list;
+
+  let ceiling = Number.POSITIVE_INFINITY;
+  if (pinnedId !== undefined) {
+    const pinnedIndex = list.indexOf(pinnedId);
+    if (pinnedIndex >= 0 && hasHeadroom(pinnedId)) ceiling = priorities[pinnedIndex]!;
+  }
+
+  const tiers = [...new Set(priorities)].sort((a, b) => b - a);
+  for (const tier of tiers) {
+    if (tier > ceiling) continue;
+    const members = list.filter((_, index) => priorities[index] === tier);
+    if (members.some(hasHeadroom)) return members;
+  }
+  return list;
+}
+
 function getOrCreateState(poolKey: string): SelectionState {
   let state = selectionState.get(poolKey);
   if (!state) {
@@ -60,7 +130,7 @@ function cloneSelectionState(state: SelectionState): SelectionState {
   };
 }
 
-function smoothWeightedIndex(ids: string[], state: SelectionState): number {
+function smoothWeightedIndex(ids: readonly string[], state: SelectionState): number {
   let best = -1;
   let bestScore = Number.NEGATIVE_INFINITY;
   let total = 0;
@@ -87,7 +157,7 @@ function smoothWeightedIndex(ids: string[], state: SelectionState): number {
  * either the live map entry or a scratch/clone for dry-run peek.
  */
 function pickRoundRobinFromState(
-  eligibleIds: string[],
+  eligibleIds: readonly string[],
   stickyLimit: number,
   state: SelectionState,
   commitSticky: boolean,
@@ -118,7 +188,7 @@ function pickRoundRobinFromState(
 
 export function pickRoundRobinAccount(
   poolKey: string,
-  eligibleIds: string[],
+  eligibleIds: readonly string[],
   stickyLimit: number,
 ): string | null {
   return pickRoundRobinFromState(eligibleIds, stickyLimit, getOrCreateState(poolKey), true);
@@ -130,7 +200,7 @@ export function pickRoundRobinAccount(
  */
 export function peekRoundRobinAccount(
   poolKey: string,
-  eligibleIds: string[],
+  eligibleIds: readonly string[],
   stickyLimit: number,
 ): string | null {
   const live = selectionState.get(poolKey);
diff --git a/src/codex/routing.ts b/src/codex/routing.ts
index 8510957abf..ccdb486eed 100644
--- a/src/codex/routing.ts
+++ b/src/codex/routing.ts
@@ -3,6 +3,7 @@ import { saveConfigPreservingClaudeCode } from "../config";
 import { isCodexAccountGenerationLive, readCodexAccountRecord } from "./account-store";
 import { codexAccountLogLabel } from "./account-label";
 import { isCodexAccountPaused } from "./account-pause";
+import { clearCodexAccountPin, codexAccountPriorityLookup, pinnedCodexAccountId } from "./account-priority";
 import { isCodexAccountUsable, type CodexAccountUsabilityOptions } from "./account-usability";
 import { isAccountNeedsReauth, markAccountNeedsReauth } from "./account-runtime-state";
 import {
@@ -14,6 +15,7 @@ import {
   peekRoundRobinAccount,
   pickRoundRobinAccount,
   seedPoolRotationAccount,
+  selectPriorityTier,
 } from "./pool-rotation";
 import { CODEX_UNKNOWN_USAGE_SCORE, getAccountQuota } from "./quota";
 import { MAIN_CODEX_ACCOUNT_ID, getMainAccountPlan } from "./main-account";
@@ -904,7 +906,7 @@ function getEligiblePoolAccounts(
   now = Date.now(),
   quotaScope?: CodexQuotaScope,
   selectionOptions?: CodexAccountUsabilityOptions,
-): string[] {
+): readonly string[] {
   const ids = (config.codexAccounts ?? [])
     .filter(account => isSelectableCodexPoolAccount(account)
       && account.id !== excludeId
@@ -926,7 +928,15 @@ function getEligiblePoolAccounts(
   ) {
     ids.unshift(MAIN_CODEX_ACCOUNT_ID);
   }
-  return ids;
+  // Single choke point for selection order: every strategy, failover, and preview
+  // reaches the pool through here, so tiering applies once rather than per picker.
+  // Eligibility above is unchanged — this only narrows an already-eligible list.
+  return selectPriorityTier(
+    ids,
+    codexAccountPriorityLookup(config),
+    id => hasCodexQuotaHeadroom(config, id),
+    pinnedCodexAccountId(config),
+  );
 }
 
 function listEligibleCodexAccountIds(
@@ -934,7 +944,7 @@ function listEligibleCodexAccountIds(
   now: number,
   quotaScope?: CodexQuotaScope,
   selectionOptions?: CodexAccountUsabilityOptions,
-): string[] {
+): readonly string[] {
   return getEligiblePoolAccounts(config, undefined, now, quotaScope, selectionOptions);
 }
 
@@ -942,11 +952,20 @@ function stickyLimitForConfig(config: OcxConfig): number {
   return normalizeAccountPoolStickyLimit(config.accountPoolStickyLimit);
 }
 
-function isActiveUnderFillFirstThreshold(config: OcxConfig, accountId: string): boolean {
+/**
+ * Whether an account still has quota to give under the auto-switch threshold.
+ *
+ * Fill-first and the priority tier filter share this predicate, and share both of
+ * its escape hatches. A disabled threshold means only health, pause, and reauth
+ * may drain an account; unknown usage is a guess, so it must neither force
+ * fill-first off the active account nor drain a tier that was simply never
+ * primed. A genuinely exhausted account 429s into cooldown and leaves
+ * eligibility on its own.
+ */
+function hasCodexQuotaHeadroom(config: OcxConfig, accountId: string): boolean {
   const threshold = config.autoSwitchThreshold ?? 80;
   if (threshold <= 0) return true;
   const usage = computeCodexUsageScore(getAccountQuota(accountId), getPoolAccountPlan(config, accountId));
-  // Unknown usage must not force fill-first to abandon the active account.
   if (isUnknownUsage(usage)) return true;
   return usage < threshold;
 }
@@ -965,7 +984,7 @@ function pickFillFirstCodexAccount(
   if (eligible.length === 0) return null;
 
   const active = getEffectiveActiveCodexAccountId(config);
-  if (active && eligible.includes(active) && isActiveUnderFillFirstThreshold(config, active)) {
+  if (active && eligible.includes(active) && hasCodexQuotaHeadroom(config, active)) {
     return active;
   }
 
@@ -976,7 +995,7 @@ function pickFillFirstCodexAccount(
 function pickNextFillFirstCodexAccount(
   config: OcxConfig,
   afterId: string | null,
-  eligible = listEligibleCodexAccountIds(config, Date.now()),
+  eligible: readonly string[] = listEligibleCodexAccountIds(config, Date.now()),
   _now = Date.now(),
   selectionOptions?: CodexAccountUsabilityOptions,
 ): string | null {
@@ -985,7 +1004,7 @@ function pickNextFillFirstCodexAccount(
   if (!afterId) {
     // Prefer an under-threshold account when starting with no active cursor.
     for (const id of ordered) {
-      if (isActiveUnderFillFirstThreshold(config, id)) return id;
+      if (hasCodexQuotaHeadroom(config, id)) return id;
     }
     return ordered[0] ?? null;
   }
@@ -1000,7 +1019,7 @@ function pickNextFillFirstCodexAccount(
   const startIdx = stableAll.indexOf(afterId);
   if (startIdx < 0) {
     for (const id of ordered) {
-      if (isActiveUnderFillFirstThreshold(config, id)) return id;
+      if (hasCodexQuotaHeadroom(config, id)) return id;
     }
     return ordered[0] ?? null;
   }
@@ -1011,7 +1030,7 @@ function pickNextFillFirstCodexAccount(
     const candidate = stableAll[(startIdx + step) % stableAll.length]!;
     if (!eligible.includes(candidate)) continue;
     if (!fallback) fallback = candidate;
-    if (isActiveUnderFillFirstThreshold(config, candidate)) return candidate;
+    if (hasCodexQuotaHeadroom(config, candidate)) return candidate;
   }
   return fallback ?? ordered[0] ?? null;
 }
@@ -1097,16 +1116,11 @@ function pickLowerUsageAccount(
   return best;
 }
 
-export function pickLowestUsageCodexAccount(
-  config: OcxConfig,
-  excludeId?: string,
-  now = Date.now(),
-  quotaScope?: CodexQuotaScope,
-  selectionOptions?: CodexAccountUsabilityOptions,
-): string | null {
+/** Coolest account in an already-selected candidate list; first index wins ties. */
+function pickLowestUsageAmong(config: OcxConfig, ids: readonly string[]): string | null {
   let best: string | null = null;
   let bestUsage = Number.POSITIVE_INFINITY;
-  for (const id of getEligiblePoolAccounts(config, excludeId, now, quotaScope, selectionOptions)) {
+  for (const id of ids) {
     const usage = computeCodexUsageScore(getAccountQuota(id), getPoolAccountPlan(config, id));
     if (usage < bestUsage) {
       best = id;
@@ -1116,6 +1130,16 @@ export function pickLowestUsageCodexAccount(
   return best;
 }
 
+export function pickLowestUsageCodexAccount(
+  config: OcxConfig,
+  excludeId?: string,
+  now = Date.now(),
+  quotaScope?: CodexQuotaScope,
+  selectionOptions?: CodexAccountUsabilityOptions,
+): string | null {
+  return pickLowestUsageAmong(config, getEligiblePoolAccounts(config, excludeId, now, quotaScope, selectionOptions));
+}
+
 /**
  * Strategy-aware alternate after a cooled/excluded account (same-request 429 retry
  * and active promotion). Quota keeps lowest-usage; fill-first advances stable order;
@@ -1129,12 +1153,16 @@ export function pickAlternateCodexAccount(
   selectionOptions?: CodexAccountUsabilityOptions,
 ): string | null {
   const strategy = normalizeAccountPoolStrategy(config.accountPoolStrategy);
+  // The exclusion is passed into eligibility rather than post-filtered off its
+  // result: when the excluded account is the only healthy member of the top
+  // tier, the tier walk must be free to descend instead of selecting that tier
+  // and then handing back an empty list.
   if (strategy === "round-robin") {
-    const eligible = listEligibleCodexAccountIds(config, now, quotaScope, selectionOptions).filter(id => id !== excludeId);
+    const eligible = getEligiblePoolAccounts(config, excludeId, now, quotaScope, selectionOptions);
     return pickRoundRobinAccount(codexPoolKeyForScope(quotaScope), eligible, stickyLimitForConfig(config));
   }
   if (strategy === "fill-first") {
-    const eligible = listEligibleCodexAccountIds(config, now, quotaScope, selectionOptions).filter(id => id !== excludeId);
+    const eligible = getEligiblePoolAccounts(config, excludeId, now, quotaScope, selectionOptions);
     return pickNextFillFirstCodexAccount(config, excludeId, eligible, now, selectionOptions);
   }
   return pickLowestUsageCodexAccount(config, excludeId, now, quotaScope, selectionOptions);
@@ -1145,6 +1173,17 @@ export function getEffectiveActiveCodexAccountId(config: OcxConfig): string | un
   return runtimeActiveCodexAccountId ?? config.activeCodexAccountId;
 }
 
+/**
+ * Whether the account routing is currently on is there because an operator asked
+ * for it, rather than because a strategy landed on it. Surfaces read this instead
+ * of comparing the stored pin themselves, which would report a pin that a later
+ * automatic pick has already moved past.
+ */
+export function isEffectiveCodexAccountPinned(config: OcxConfig): boolean {
+  const pinned = pinnedCodexAccountId(config);
+  return pinned !== undefined && pinned === getEffectiveActiveCodexAccountId(config);
+}
+
 /**
  * Automatic strategy / failover cursor only — never mutates `config.activeCodexAccountId`
  * so an unrelated `saveConfig` cannot persist transient rotation as operator selection.
@@ -1153,10 +1192,22 @@ function rememberActiveCodexAccount(_config: OcxConfig, accountId: string): void
   runtimeActiveCodexAccountId = accountId;
 }
 
+/**
+ * End the manual pin when routing moves to a different account. Returns whether
+ * the pin changed so the caller can fold it into a write it was already making.
+ */
+function releaseCodexAccountPinFor(config: OcxConfig, accountId: string): boolean {
+  const pinned = pinnedCodexAccountId(config);
+  if (pinned === undefined || pinned === accountId) return false;
+  clearCodexAccountPin(config);
+  return true;
+}
+
 /** Persist operator (or quota-strategy) active selection to config + disk. */
 function setActiveCodexAccount(config: OcxConfig, accountId: string): void {
   runtimeActiveCodexAccountId = undefined;
-  if (config.activeCodexAccountId === accountId) return;
+  const releasedPin = releaseCodexAccountPinFor(config, accountId);
+  if (config.activeCodexAccountId === accountId && !releasedPin) return;
   config.activeCodexAccountId = accountId;
   saveConfigPreservingClaudeCode(config);
 }
@@ -1167,6 +1218,10 @@ function promoteActiveCodexAccount(config: OcxConfig, accountId: string): void {
     setActiveCodexAccount(config, accountId);
     return;
   }
+  // Runtime-only, like the cursor itself: a caller that persists (pause, delete)
+  // saves this release with its own write; a transient failover does not, so the
+  // pin survives a restart that also clears the failure history behind it.
+  releaseCodexAccountPinFor(config, accountId);
   rememberActiveCodexAccount(config, accountId);
 }
 
@@ -1185,6 +1240,10 @@ export function reconcileCodexActiveAfterExclusion(
   if (config.activeCodexAccountId === excludedAccountId) {
     config.activeCodexAccountId = undefined;
   }
+  // Excluding an account revokes any manual pin on it even when it was not the
+  // effective active — otherwise a paused account keeps acting as a tier ceiling,
+  // suppressing every higher-ordered account while being unusable itself.
+  clearCodexAccountPin(config, excludedAccountId);
   if (!wasEffective) return getEffectiveActiveCodexAccountId(config) ?? null;
 
   runtimeActiveCodexAccountId = undefined;
@@ -1197,6 +1256,54 @@ function isUnknownUsage(usage: number): boolean {
   return usage >= CODEX_UNKNOWN_USAGE_SCORE;
 }
 
+/**
+ * Move an unbound request back up when a higher tier regains headroom — the
+ * weekly-reset case. Returns null when nothing should change.
+ *
+ * Downward moves are deliberately left to {@link applyQuotaAutoSwitch}: this only
+ * fires when the tier filter has already excluded `active`, and only toward a
+ * tier that strictly outranks it. Threads bound by affinity never reach here.
+ */
+function pickPriorityPreemption(
+  config: OcxConfig,
+  active: string,
+  now: number,
+  quotaScope?: CodexQuotaScope,
+  selectionOptions?: CodexAccountUsabilityOptions,
+): string | null {
+  const eligible = getEligiblePoolAccounts(config, undefined, now, quotaScope, selectionOptions);
+  if (eligible.length === 0 || eligible.includes(active)) return null;
+  const pinned = pinnedCodexAccountId(config);
+  // A live pin already lowered the tier ceiling; never preempt past an explicit
+  // operator choice. Same liveness test the tier filter applies, so preview and
+  // resolve agree even before the pin is garbage-collected.
+  if (pinned !== undefined && eligible.includes(pinned) && hasCodexQuotaHeadroom(config, pinned)) return null;
+  const priorityOf = codexAccountPriorityLookup(config);
+  if (priorityOf(eligible[0]!) <= priorityOf(active)) return null;
+  // Members without headroom are in the tier only because a sibling has some;
+  // picking one would hand the request straight back to a drained account.
+  return pickLowestUsageAmong(config, eligible.filter(id => hasCodexQuotaHeadroom(config, id)));
+}
+
+/**
+ * Release a pin whose account is durably drained. "Use this account now" ends
+ * when the account crosses the auto-switch threshold or stops being selectable
+ * at all — never on a transient cooldown or soft-avoid, which it recovers from
+ * on its own. Clearing the pin also removes the condition, so this writes at
+ * most once per pin.
+ */
+function releaseDrainedCodexAccountPin(config: OcxConfig): void {
+  const pinned = pinnedCodexAccountId(config);
+  if (pinned === undefined) return;
+  const drained = !isCodexAccountUsable(config, pinned)
+    || isAccountNeedsReauth(pinned)
+    || isCodexAccountPaused(config, pinned)
+    || !hasCodexQuotaHeadroom(config, pinned);
+  if (!drained) return;
+  clearCodexAccountPin(config);
+  saveConfigPreservingClaudeCode(config);
+}
+
 function applyQuotaAutoSwitch(
   config: OcxConfig,
   active: string,
@@ -1233,12 +1340,19 @@ function applyFailureFailover(
   config: OcxConfig,
   active: string,
   now: number,
+  quotaScope?: CodexQuotaScope,
   selectionOptions?: CodexAccountUsabilityOptions,
 ): string {
   if (!shouldFailover(config, active, now)) return active;
-  const best = pickAlternateCodexAccount(config, active, now, undefined, selectionOptions);
+  const best = pickAlternateCodexAccount(config, active, now, quotaScope, selectionOptions);
   if (best) {
-    promoteActiveCodexAccount(config, best);
+    // The scope still routes away from the failing account — that is this request's
+    // own decision — but an independent one must not persist a new shared active
+    // account. recordCodexUpstreamOutcome only suppresses the promotion it makes at
+    // the moment of the failure; the streak outlives the soft avoid, so a later
+    // scoped resolve reaches here with the streak still tripped and would otherwise
+    // move the shared cursor after all.
+    if (!isIndependentCodexQuotaScope(quotaScope)) promoteActiveCodexAccount(config, best);
     return best;
   }
   return active;
@@ -1328,6 +1442,7 @@ export function previewCodexAccountForRequest(
     ) return active;
     else return null;
   }
+  active = pickPriorityPreemption(config, active, now, quotaScope, selectionOptions) ?? active;
 
   const threshold = config.autoSwitchThreshold ?? 80;
   if (threshold > 0) {
@@ -1357,6 +1472,12 @@ export function resolveCodexAccountForThreadDetailed(
   quotaScope?: CodexQuotaScope,
   selectionOptions?: CodexAccountUsabilityOptions,
 ): CodexThreadResolution {
+  // Retiring a spent manual pin is independent of affinity: an existing thread
+  // keeps its account below, but the operator's tier ceiling must not silently
+  // revive after quota resets. Independent model scopes must never persist a
+  // change to shared routing state.
+  if (!isIndependentCodexQuotaScope(quotaScope)) releaseDrainedCodexAccountPin(config);
+
   const entry = threadId ? getThreadAffinity(threadId, quotaScope) : undefined;
   if (threadId && entry) {
     if (isThreadAffinityExpired(entry, now)) {
@@ -1430,8 +1551,19 @@ export function resolveCodexAccountForThreadDetailed(
       return { status: "none" };
     }
   }
+  // Before applyQuotaAutoSwitch: its sync disk write would otherwise persist a
+  // move inside the drained tier that preemption immediately overrides.
+  const preempted = pickPriorityPreemption(config, active, now, quotaScope, selectionOptions);
+  if (preempted) {
+    // Runtime-only, like every other automatic pick: config.activeCodexAccountId
+    // stays the operator's selection and getEffectiveActiveCodexAccountId is what
+    // surfaces this to the API and dashboard. An independent quota group must not
+    // move the shared cursor at all — its ordering decision is its own.
+    if (!isIndependentCodexQuotaScope(quotaScope)) rememberActiveCodexAccount(config, preempted);
+    active = preempted;
+  }
   active = applyQuotaAutoSwitch(config, active, now, quotaScope, selectionOptions);
-  active = applyFailureFailover(config, active, now, selectionOptions);
+  active = applyFailureFailover(config, active, now, quotaScope, selectionOptions);
   if (!isCodexAccountUsable(config, active, selectionOptions)) {
     return hasConfiguredPoolAccount(config, active, selectionOptions)
       ? { status: "selected", accountId: active }
@@ -1634,16 +1766,21 @@ export function recordCodexUpstreamOutcome(
     });
     if (!meta.fixedAccount) {
       clearThreadAccountMapForAccount(accountId);
-      notePoolRotationFailure(POOL_KEY_CODEX, accountId);
-      const effectiveActive = getEffectiveActiveCodexAccountId(config);
-      if (effectiveActive === accountId) {
-        // Same-request 429 retry already picked via excludeAccountId — reuse it so
-        // round-robin does not advance the ring a second time.
-        const reused = meta.promoteAccountId && meta.promoteAccountId !== accountId
-          ? meta.promoteAccountId
-          : null;
-        const fallback = reused ?? pickAlternateCodexAccount(config, accountId, now);
-        if (fallback) promoteActiveCodexAccount(config, fallback);
+      // An independent native quota request may discover an account-wide throttle,
+      // but it still must not advance the shared RR ring or active cursor. The next
+      // shared request observes the cooldown and chooses its own fallback.
+      if (!isIndependentCodexQuotaScope(quotaScope)) {
+        notePoolRotationFailure(POOL_KEY_CODEX, accountId);
+        const effectiveActive = getEffectiveActiveCodexAccountId(config);
+        if (effectiveActive === accountId) {
+          // Same-request 429 retry already picked via excludeAccountId — reuse it so
+          // round-robin does not advance the ring a second time.
+          const reused = meta.promoteAccountId && meta.promoteAccountId !== accountId
+            ? meta.promoteAccountId
+            : null;
+          const fallback = reused ?? pickAlternateCodexAccount(config, accountId, now, quotaScope);
+          if (fallback) promoteActiveCodexAccount(config, fallback);
+        }
       }
     }
     return;
@@ -1697,8 +1834,12 @@ export function recordCodexUpstreamOutcome(
   if (!meta.fixedAccount && shouldFailover(config, accountId, now)) {
     clearThreadAccountMapForAccount(accountId);
   }
-  if (!meta.fixedAccount && getEffectiveActiveCodexAccountId(config) === accountId) {
-    applyFailureFailover(config, accountId, now);
+  if (
+    !meta.fixedAccount
+    && !isIndependentCodexQuotaScope(quotaScope)
+    && getEffectiveActiveCodexAccountId(config) === accountId
+  ) {
+    applyFailureFailover(config, accountId, now, quotaScope);
   }
 }
 
diff --git a/src/codex/subagent-model-fallback.ts b/src/codex/subagent-model-fallback.ts
index 9d37829008..5e53a00431 100644
--- a/src/codex/subagent-model-fallback.ts
+++ b/src/codex/subagent-model-fallback.ts
@@ -18,6 +18,7 @@ import {
   codexQuotaScopeForModel,
   computeCodexUsageScore,
   getCodexQuotaHealthSnapshot,
+  getEffectiveActiveCodexAccountId,
   getPoolAccountPlan,
   isCodexAccountInCooldown,
 } from "./routing";
@@ -131,8 +132,14 @@ function quotaThreshold(config: OcxConfig): number {
   return threshold > 0 ? threshold : Number.POSITIVE_INFINITY;
 }
 
+/**
+ * The account routing would actually use, not just the persisted operator
+ * selection: round-robin, fill-first, failover, and priority preemption all
+ * move the cursor in memory only, so reading the raw field would check quota
+ * against an account this request is not going to touch.
+ */
 function activeCodexAccountId(config: OcxConfig): string | null {
-  return config.activeCodexAccountId ?? null;
+  return getEffectiveActiveCodexAccountId(config) ?? null;
 }
 
 /**
diff --git a/src/config.ts b/src/config.ts
index be8090c313..c962f07434 100644
--- a/src/config.ts
+++ b/src/config.ts
@@ -27,6 +27,8 @@ import {
   isValidCodexAccountNamespaceTarget,
   MAIN_CODEX_ACCOUNT_NAMESPACE_TARGET,
 } from "./codex/account-namespace-match";
+import { isCodexAccountPriorityKey } from "./codex/account-priority";
+import { parseAccountPriority } from "./codex/pool-rotation";
 import { COMBO_NAMESPACE, comboConfigIssues } from "./combos/types";
 import { routingProfileIssues } from "./routing/profile";
 import {
@@ -945,6 +947,33 @@ const codexAccountNamespacesSchema = z.custom<Record<string, unknown>>(
   }
 }).pipe(z.record(z.string(), z.string()));
 
+const CODEX_ACCOUNT_PRIORITIES_RECORD_ERROR =
+  "codexAccountPriorities must be a plain object mapping Codex account ids to selection-order integers";
+const CODEX_ACCOUNT_PRIORITY_KEY_ERROR =
+  "selection-order keys must be a Codex pool-account id or the main Codex account and cannot be reserved JavaScript object keys";
+const CODEX_ACCOUNT_PRIORITY_VALUE_ERROR =
+  "selection order must be an integer between -100 and 100";
+
+const CODEX_ACCOUNT_PIN_PATTERN = /^[a-zA-Z0-9._-]{1,64}$/;
+
+const codexAccountPrioritiesSchema = z.custom<Record<string, unknown>>(
+  (value): value is Record<string, unknown> => !!value
+    && typeof value === "object"
+    && !Array.isArray(value)
+    && (Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null),
+  { error: CODEX_ACCOUNT_PRIORITIES_RECORD_ERROR },
+).superRefine((priorities, ctx) => {
+  // Inspect raw own entries before z.record parses them; Zod omits __proto__ record keys.
+  for (const [accountId, priority] of Object.entries(priorities)) {
+    if (!isCodexAccountPriorityKey(accountId)) {
+      ctx.addIssue({ code: "custom", path: [accountId], message: CODEX_ACCOUNT_PRIORITY_KEY_ERROR });
+    }
+    if (parseAccountPriority(priority) === null) {
+      ctx.addIssue({ code: "custom", path: [accountId], message: CODEX_ACCOUNT_PRIORITY_VALUE_ERROR });
+    }
+  }
+}).pipe(z.record(z.string(), z.number().int()));
+
 /**
  * Deliberately permissive. A user's config is not ours to invalidate: a strict
  * entry fails the whole parse, and loadConfig's fallback then backs the file up
@@ -1024,6 +1053,12 @@ const configSchema = z.object({
   codexShimAutoRestore: z.boolean().optional(),
   pausedCodexAccountIds: z.array(z.string().regex(/^[a-zA-Z0-9._-]{1,64}$/)).optional(),
   codexAccountNamespaces: codexAccountNamespacesSchema.optional(),
+  // Selection order is a preference, not a safety control like pause: a malformed
+  // map degrades to "no ordering" rather than failing the parse, so a hand-edited
+  // typo cannot trip the backup-and-defaults repair path and wipe providers or
+  // pool accounts. Warning emitted in loadConfig.
+  codexAccountPriorities: codexAccountPrioritiesSchema.optional().catch(undefined),
+  activeCodexAccountPinned: z.string().regex(CODEX_ACCOUNT_PIN_PATTERN).optional().catch(undefined),
   // Model ids excluded from the Grok Build managed block (dashboard switches).
   grokExcludedModels: z.array(z.string()).optional(),
   // Invalid values degrade to undefined ("auto") instead of failing the whole
@@ -1493,6 +1528,32 @@ function warnDegradedHostname(rawParsed: unknown, validated: OcxConfig): void {
   }
 }
 
+/**
+ * Companion to {@link warnDegradedStreamMode} for a malformed selection-order map.
+ * Priority is a preference, so the schema drops the whole map rather than failing
+ * the parse — say so once, otherwise the pool silently reverts to flat ordering.
+ */
+function degradedCodexAccountPriorityWarnings(rawParsed: unknown, validated: OcxConfig): string[] {
+  const record = rawConfigRecord(rawParsed);
+  const warnings: string[] = [];
+  // The pin degrades silently otherwise, which reads as the manual selection simply
+  // not having survived the restart.
+  if (record?.activeCodexAccountPinned !== undefined && validated.activeCodexAccountPinned === undefined) {
+    warnings.push("activeCodexAccountPinned is not a valid account id — the manually selected account is no longer pinned");
+  }
+  const raw = record?.codexAccountPriorities;
+  if (raw !== undefined && validated.codexAccountPriorities === undefined) {
+    warnings.push("codexAccountPriorities is invalid (expected account ids mapped to integers between -100 and 100) — account selection order is disabled");
+  }
+  return warnings;
+}
+
+function warnDegradedCodexAccountPriorities(rawParsed: unknown, validated: OcxConfig): void {
+  for (const warning of degradedCodexAccountPriorityWarnings(rawParsed, validated)) {
+    console.warn(`⚠️  config.json ${warning}`);
+  }
+}
+
 /**
  * The apiKeys schema salvages entry by entry rather than failing the parse, so a
  * dropped key is otherwise invisible — and it will not be re-saved by the next
@@ -1698,6 +1759,7 @@ export function loadConfig(): OcxConfig {
       warnDegradedStreamMode(parsed, config);
       warnDegradedHostname(parsed, config);
       warnDegradedApiKeys(parsed, config);
+      warnDegradedCodexAccountPriorities(parsed, config);
       warnDegradedClaudeSubagentEffort(parsed);
       warnDegradedNativeSubagentConfig(parsed, config);
       return normalizeClaudeSubagentEffort(normalizeNativeSubagentSync(config, parsed), parsed);
@@ -1717,6 +1779,7 @@ export function loadConfig(): OcxConfig {
       const config = normalizeApiKeyIds(retryResult.data as OcxConfig);
       warnDegradedHostname(parsed, config);
       warnDegradedApiKeys(parsed, config);
+      warnDegradedCodexAccountPriorities(parsed, config);
       warnDegradedClaudeSubagentEffort(parsed);
       warnDegradedNativeSubagentConfig(parsed, config);
       return normalizeClaudeSubagentEffort(normalizeNativeSubagentSync(config, parsed), parsed);
@@ -1763,6 +1826,7 @@ function validFileConfigDiagnostics(config: OcxConfig, rawParsed: unknown): Conf
   const rawEffort = rawClaudeSubagentEffort(rawParsed);
   const normalized = normalizeClaudeSubagentEffort(normalizeNativeSubagentSync(config, rawParsed), rawParsed);
   const warnings = configPlaceholderWarnings(normalized);
+  warnings.push(...degradedCodexAccountPriorityWarnings(rawParsed, normalized));
   if (rawEffort !== undefined && !isClaudeSubagentEffort(rawEffort)) {
     warnings.push(`claudeCode.subagentEffort ignored: expected one of ${CLAUDE_SUBAGENT_EFFORTS.join(", ")}`);
   }
@@ -1836,6 +1900,32 @@ function appOwnedMemoryBudgetError(value: unknown): string | null {
   return null;
 }
 
+/**
+ * Same reasoning as {@link blankHostnameError}, and more urgent: the read path degrades a
+ * malformed selection-order map to undefined, which on a write would drop every entry the
+ * user had accumulated and still report success. A load-time degrade leaves the raw map in
+ * the file to be repaired by hand; a degraded write erases it. One bad `ocx config set`
+ * must not cost the whole map, so a live caller is told instead.
+ */
+function codexAccountPrioritiesError(value: unknown): string | null {
+  const raw = rawConfigRecord(value);
+  if (!raw) return null;
+  if (raw.codexAccountPriorities !== undefined) {
+    const parsed = codexAccountPrioritiesSchema.safeParse(raw.codexAccountPriorities);
+    if (!parsed.success) {
+      return schemaDiagnosticsError(parsed.error).replace("schema_invalid: ", "schema_invalid: codexAccountPriorities.");
+    }
+  }
+  // Tested as a string rather than coerced: `String(123)` matches the id pattern, so a
+  // coercing guard waves a non-string pin through to the schema, where `.catch(undefined)`
+  // drops it and reports the write as a success — the exact silent-degrade this guards.
+  const pin = raw.activeCodexAccountPinned;
+  if (pin !== undefined && (typeof pin !== "string" || !CODEX_ACCOUNT_PIN_PATTERN.test(pin))) {
+    return "schema_invalid: activeCodexAccountPinned: must be an account id";
+  }
+  return null;
+}
+
 function googleAntigravityStaticCatalogVersionError(value: unknown): string | null {
   const raw = rawConfigRecord(value);
   if (!raw || !Object.hasOwn(raw, "googleAntigravityStaticCatalogVersion")) return null;
@@ -1849,7 +1939,8 @@ export function validateConfigCandidate(value: unknown): { ok: true; config: Ocx
   const boundaryError = blankHostnameError(value)
     ?? claudeSubagentEffortError(value)
     ?? appOwnedMemoryBudgetError(value)
-    ?? googleAntigravityStaticCatalogVersionError(value);
+    ?? googleAntigravityStaticCatalogVersionError(value)
+    ?? codexAccountPrioritiesError(value);
   if (boundaryError) return { ok: false, error: boundaryError };
   const result = configSchema.safeParse(value);
   if (result.success) return { ok: true, config: normalizeApiKeyIds(result.data as OcxConfig) };
diff --git a/src/types.ts b/src/types.ts
index 171628caff..d38fbc1896 100644
--- a/src/types.ts
+++ b/src/types.ts
@@ -762,6 +762,18 @@ export interface OcxConfig {
   codexAccounts?: CodexAccount[];
   /** Account ids administratively excluded from future pool selection until resumed. */
   pausedCodexAccountIds?: string[];
+  /**
+   * Selection order per account id, higher used earlier; absent = 0. Keyed by id
+   * rather than stored on `codexAccounts` rows so the Desktop login (`__main__`),
+   * which has no row, can be ordered too. Range -100..100.
+   */
+  codexAccountPriorities?: Record<string, number>;
+  /**
+   * Account id the operator last selected by hand. Suppresses upward priority
+   * preemption until that account crosses the auto-switch threshold. Stores the
+   * id (not a flag) so a stale pin cannot outlive the selection it described.
+   */
+  activeCodexAccountPinned?: string;
   /**
    * Public model-selector namespaces bound to one Codex account. Values are stored account ids;
    * `"@main"` selects the Codex Desktop/main auth.json account. Account display aliases
diff --git a/structure/05_gui-and-management-api.md b/structure/05_gui-and-management-api.md
index 4901a3c51e..7b78eb7361 100644
--- a/structure/05_gui-and-management-api.md
+++ b/structure/05_gui-and-management-api.md
@@ -87,7 +87,7 @@ this document owns is which module holds which area and what invariant that area
 | Models | Fetch routed model lists, disabled model visibility, and catalog-facing ids. |
 | OAuth | Login/status/logout for OAuth-backed providers, plus multiauth account management: `GET /api/oauth/accounts`, `PUT /api/oauth/accounts/active`, `PUT /api/oauth/accounts/alias`, `DELETE /api/oauth/accounts` list masked accounts per provider, switch the active one, edit its display-only alias, and remove one. The login flow itself is `GET /api/oauth/providers`, `POST /api/oauth/login`, `POST /api/oauth/login/code`, `POST /api/oauth/login/cancel`, `POST /api/oauth/logout`, and `GET /api/oauth/status`; pool controls are `GET/PUT/PATCH /api/oauth/accounts/pool` and `POST /api/oauth/accounts/clear-cooldown`. Login accepts `addAccount: true` to force a fresh browser identity. Device flows return a structured `deviceCode`; the GUI highlights and copies it before the user opens the verification page. |
 | Key providers | `GET /api/key-providers` exposes API-key provider presets for setup and dashboard flows, and `GET/POST/DELETE /api/keys` owns the proxy's own admission keys. Multi-key pool per key-auth provider: `GET /api/providers/keys`, `POST /api/providers/keys`, `PUT /api/providers/keys/active`, `PUT /api/providers/keys/alias`, `DELETE /api/providers/keys` masked list, add (upsert + activate), switch, rename, and remove keys. `provider.apiKey` always mirrors the active pool entry so routing stays single-key. |
-| OpenAI account mode | Report one OpenAI Codex card with Pool/Direct controls and one API-key card. Mode PATCH persists live without restart or catalog identity changes; Pool owns account/quota controls and Direct uses caller/main login only. Main-account DTOs report real credential presence and terminal `needsReauth` state instead of treating missing/invalid native auth as an unknown quota. |
+| OpenAI account mode | Report one OpenAI Codex card with Pool/Direct controls and one API-key card. Mode PATCH persists live without restart or catalog identity changes; Pool owns account/quota controls and Direct uses caller/main login only. Main-account DTOs report real credential presence and terminal `needsReauth` state instead of treating missing/invalid native auth as an unknown quota. Selection order has its own route: `PUT /api/codex-auth/accounts/priority` takes `{ id, priority }`, where `priority` is an integer -100..100 or `null` to restore the default, accepts `__main__`, 404s an unknown id, and echoes the stored value. Re-ordering never clears thread affinity, so the response carries no `appliesImmediately`, but it does release any pin — see [`08_openai-provider-tiers.md`](08_openai-provider-tiers.md) for why. `PUT /api/codex-auth/active` with a null id releases one too, but that drops the operator's account selection along with it, so this route is the only operator-facing way to clear a pin while leaving the selected account in place. `GET /api/codex-auth/active` reports `pinned`, true only while the manually selected account is still the effective active one, plus `pinnedAccountId`, which names the pinned account whether or not it is the active one. Surfaces should render `pinnedAccountId`: under round-robin and fill-first the pin caps the tier ceiling at its own tier while the strategy cursor moves freely inside that tier, so `pinned` goes false on a sibling's turn even though the pin is still suppressing every higher tier — which is why the dashboard badges `pinnedAccountId` and the GUI controller tracks only the id. `pinned` answers the narrower question of whether routing is *currently* on the operator's choice; no surface in this repo asks it, and a new one almost certainly wants the id instead. |
 | Subagents | Read/write the featured `subagentModels` list capped at five ids. `GET/PUT /api/injection-model` manages the shared delegation model/effort selection, the independent OpenCodex guidance switch, and the default-off `syncCodexSubagentDefaults` opt-in for native Codex subagent defaults. When OpenCodex owns the active Codex routing, native `[agents]` defaults apply to newly created Codex tasks after sync/restart; external user-managed provider configs remain untouched. The defaults do not cause delegation and preserve existing user-owned defaults rather than overwriting them. PUT is partial-update: absent keys are unchanged, `null` clears, and non-object bodies are rejected with 400 before field validation. `syncCodexSubagentDefaults: true` requires a nonblank `model` and a supported Codex reasoning effort when effort is set; clearing `model` (null/empty) always clears effort and disables native-default sync even when the stored effort was invalid. |
 | V2 / Multi-agent mode | `GET/PUT /api/v2` — reports/sets the codex `multi_agent_v2` feature flag, the 3-state `multiAgentMode` override (`v1`/`default`/`v2`), and the logical maximum thread count. Selecting `v2` enables the native flag and migrates `[agents] max_threads` to the v2 key; selecting `v1` disables it and migrates the same value back. `default` leaves the native flag unchanged. PUT accepts `enabled`, `multiAgentMode`, and/or the compatibility-named `maxConcurrentThreadsPerSession`; contradictory mode/flag pairs are rejected before writes. Every transition is rollback-safe and resyncs the catalog. |
 | Logs & Debug | One sidebar entry (`/#logs`) with two tabs. Logs tab: request/runtime logs for local diagnosis. Debug tab (`/#logs/debug`; legacy `/#debug` deep links redirect there): provider + usage toggles, refresh/follow log viewer. `GET/PUT /api/debug`; `GET /api/debug/logs` and `GET /api/debug/usage-logs` (monotonic `after` cursor, legacy `since` accepted). CLI: `ocx debug provider|usage …` (both streams via running proxy API). |
@@ -120,6 +120,13 @@ User aliases are display metadata only. Codex pool aliases live on `CodexAccount
 identity, active selection, and routing never consult these fields. The matching CLI is
 `ocx account alias <provider> <id> <display-name|->` (`rename` is accepted as a synonym).
 
+Selection order is the opposite case and must not be folded into the alias route. `codexAccountPriorities`
+is routing metadata that Pool selection consults, it lives in config rather than on `CodexAccount` so the
+`__main__` Desktop login can carry one, and the alias route's rejection of `__main__` would be wrong for
+it. The matching CLI is `ocx account priority <provider> <id|main> [<value>]`, reading the current order
+when the value is omitted. Ordering invariants live in
+[`08_openai-provider-tiers.md`](08_openai-provider-tiers.md).
+
 ## Sidebar stop button
 
 The dashboard sidebar includes a stop button that calls `POST /api/stop`. The button shows a
diff --git a/structure/08_openai-provider-tiers.md b/structure/08_openai-provider-tiers.md
index 7f50e4a063..5a42416ba1 100644
--- a/structure/08_openai-provider-tiers.md
+++ b/structure/08_openai-provider-tiers.md
@@ -30,6 +30,42 @@ requests keep their captured credential. An all-paused pool fails closed.
 The dashboard's bulk pause action refreshes all account quotas and mutates only accounts whose
 plan-relevant window is freshly confirmed at exactly 100%; unknown and failed refreshes are skipped.
 
+`codexAccountPriorities` is a persisted Pool *ordering* boundary and never an eligibility one. It maps
+an account id to an integer from -100 to 100, higher used earlier, with absence meaning 0. Selection
+narrows the already-eligible list to the highest tier that still holds an account with quota headroom
+and lets the configured strategy pick within that tier. A tier drains only when every member is over
+the auto-switch threshold, cooling down, soft-avoided, paused, or needs reauth; unknown quota never
+drains a tier, and every tier drained leaves the eligible list untouched. Ordering never admits an
+account that pause, cooldown, health, or reauth already excluded, and never overrides those
+exclusions. It adds no new rebind cause for a bound thread, which still moves only for the reasons it
+already had: a quota-strategy threshold re-evaluation, a failover streak, an account that stopped
+being selectable, or affinity expiry. The stable `__main__` alias carries an order on equal terms with
+added accounts, which is what lets the Desktop login be ordered last. An absent or empty map
+reproduces the prior selection sequence exactly.
+
+Preemption moves unbound requests back up when a higher tier regains headroom, and it holds the
+runtime cursor only. Under an independent quota scope it must never touch the shared active cursor,
+because the scopes track separate native quota groups and a scoped request has no standing to move
+the account every other scope resolves from.
+
+A manual activation pins its account and lowers the tier ceiling to that account's own tier. The pin
+is released by drain, exclusion, deletion, an explicit failover/promotion away, and any write to
+`codexAccountPriorities` — a pin and an order are both the operator naming an account to use, so the
+newer statement wins. Ordinary round-robin movement inside the capped tier does not release it.
+Without that last rule a pin made before any order existed, which is just an ordinary account switch,
+would outrank every order set afterwards for as long as the account kept headroom.
+
+Only an actual selection pins. Clearing the active account states that no account is chosen, so it
+releases the pin instead of recording one against the `__main__` fallback that the same handler uses
+for its paused check. A pin no effective active account matches is invisible — `pinned` compares the
+two and reports false — while the tier filter still honours it, which would silently cap the pool at
+the main account's tier.
+
+The pin is a ceiling, not a selection: inside the capped tier the strategy cursor still moves. So the
+pinned account and the effective active account are different questions, and the management API answers
+both (`pinned` and `pinnedAccountId`). A surface that marks only the active account loses the pin from
+view exactly when it is doing the most work — suppressing every higher tier.
+
 ```text
 gpt-5.6-sol                         # openai; Pool or Direct follows the provider option
 openai-apikey/gpt-5.6-sol           # OpenAI API key
diff --git a/tests/cli-account.test.ts b/tests/cli-account.test.ts
index c767aad8a4..703e386154 100644
--- a/tests/cli-account.test.ts
+++ b/tests/cli-account.test.ts
@@ -3,6 +3,18 @@ import { PassThrough, Readable } from "node:stream";
 import { cmdAccount, classifyAccount, formatAccountTable, type AccountDeps } from "../src/cli/account";
 import type { AccountStdin } from "../src/cli/account-api";
 import { printSubcommandUsage } from "../src/cli/help";
+import {
+  DEFAULT_ACCOUNT_PRIORITY,
+  MAX_ACCOUNT_PRIORITY,
+  MIN_ACCOUNT_PRIORITY,
+} from "../src/codex/pool-rotation";
+import {
+  ACCOUNT_PRIORITY_PRESETS,
+  accountPriorityPresetKey,
+  DEFAULT_ACCOUNT_PRIORITY as GUI_DEFAULT_PRIORITY,
+  MAX_ACCOUNT_PRIORITY as GUI_MAX_PRIORITY,
+  MIN_ACCOUNT_PRIORITY as GUI_MIN_PRIORITY,
+} from "../gui/src/account-priority";
 import type { OcxConfig } from "../src/types";
 
 const RAW_SENTINEL = "test-key-rawsentinel1234567890";
@@ -138,6 +150,14 @@ async function mockManagementApi(req: Request): Promise<Response> {
     return json({ ok: true, id: payload.id, alias: payload.alias || null });
   }
 
+  if (req.method === "PUT" && url.pathname === "/api/codex-auth/accounts/priority") {
+    const payload = body as { id: string; priority: number | null };
+    const account = codexAccounts.find(entry => entry.id === payload.id);
+    if (!account) return json({ error: "account not found" }, 404);
+    account.priority = payload.priority ?? 0;
+    return json({ ok: true, id: payload.id, priority: account.priority });
+  }
+
   if (url.pathname === "/api/codex-auth/active") {
     if (req.method === "PUT") {
       const accountId = (body as { accountId?: string }).accountId;
@@ -377,7 +397,7 @@ beforeEach(() => {
         monthlyResetAt: 1_900_000_000,
       },
     },
-    { id: "chatgpt_1", email: "j***@example.com", plan: "pro", needsReauth: true, quota: null },
+    { id: "chatgpt_1", email: "j***@example.com", plan: "pro", needsReauth: true, priority: 1, quota: null },
   ];
   oauthAccounts = [
     { id: "acct_1", email: "a***@example.com" },
@@ -411,10 +431,14 @@ describe("ocx account CLI (issue #180 matrix)", () => {
     const result = await run(["list"]);
 
     expect(result.code).toBe(0);
-    expect(result.stdout).toMatch(/^PROVIDER\s{2,}TYPE\s{2,}ID\s{2,}PLAN\/LABEL\s{2,}STATUS/m);
-    expect(result.stdout).toMatch(/^openai\s+codex\s+main\s+plus/m);
-    expect(result.stdout).toMatch(/^anthropic\s+oauth\s+acct_1\s+a\*\*\*@example\.com\s+active/m);
-    expect(result.stdout).toMatch(/^openrouter\s+api-key\s+key_1\s+test\*\*\*\*7890 \(personal\)\s+active/m);
+    expect(result.stdout).toMatch(/^PROVIDER\s{2,}TYPE\s{2,}ID\s{2,}PLAN\/LABEL\s{2,}PRIORITY\s{2,}STATUS/m);
+    expect(result.stdout).toMatch(/^openai\s+codex\s+main\s+plus\s+0/m);
+    // The sign, not just the header: an order above the default must render "+1" so the
+    // column reads as a position on an axis rather than a magnitude. Without this the
+    // whole suite passes with priorityText's `+${n}` branch collapsed to String(n).
+    expect(result.stdout).toMatch(/^openai\s+codex\s+chatgpt_1\s+\S+\s+\+1\s/m);
+    expect(result.stdout).toMatch(/^anthropic\s+oauth\s+acct_1\s+a\*\*\*@example\.com\s+-\s+active/m);
+    expect(result.stdout).toMatch(/^openrouter\s+api-key\s+key_1\s+test\*\*\*\*7890 \(personal\)\s+-\s+active/m);
     expect(result.stdout).not.toContain("__main__");
 
     const lines = result.stdout.split("\n");
@@ -611,14 +635,20 @@ describe("ocx account CLI (issue #180 matrix)", () => {
     expect(result.stdout).toContain("needs-reauth");
   });
 
-  test("WP2 regression: use openai main explains next-request routing and cache continuity", async () => {
+  test("WP2 regression: use openai main prints takes-effect-immediately and auto-switch override notes", async () => {
     const result = await run(["use", "openai", "main"]);
 
     expect(result.code).toBe(0);
-    expect(result.stderr).toContain("next request after clearing existing pool affinity");
-    expect(result.stderr).toContain("in-flight requests keep their captured account");
-    expect(result.stderr).toContain("failure recovery may later select another eligible account");
-    expect(result.stderr).toContain("provider-side prompt cache may be cold");
+    // A manual switch clears thread affinity outright (resetCodexRoutingForManualSelection
+    // calls clearThreadAccountMap as its first statement), so running threads do NOT keep
+    // their account -- they rebind on their next request, and the route reports
+    // appliesImmediately: true. Only requests already in flight keep what they captured.
+    // Do not reword back toward "new sessions" or "running threads keep their account":
+    // this test previously asserted that clause, which is what kept it alive.
+    expect(result.stderr).toContain("Takes effect immediately");
+    expect(result.stderr).toContain("in-flight requests keep the account they captured");
+    expect(result.stderr).not.toContain("running threads keep their current account");
+    expect(result.stderr).toContain("auto-switch (threshold 80%) may override this pin");
   });
 
   test("WP2 regression: classifyAccount routes a key-overridden OAuth provider to api-key", () => {
@@ -1007,6 +1037,209 @@ describe("ocx account CLI (issue #180 matrix)", () => {
     expect(requests).toContainEqual(expect.objectContaining({ method: "PUT", path: "/api/providers/keys/alias" }));
   });
 
+  describe("37b: account priority sets and reads Codex selection order", () => {
+    const priorityRequests = () => requests.filter(r => r.path === "/api/codex-auth/accounts/priority");
+    const unreachableDeps = (): AccountDeps => ({
+      ...defaultDeps(),
+      fetchImpl: async () => { throw new TypeError("connection refused"); },
+    });
+
+    test("a numeric value is sent as an integer and echoed back signed", async () => {
+      const result = await run(["priority", "openai", "chatgpt_1", "-1"]);
+
+      expect(result.code).toBe(0);
+      expect(result.stdout).toBe("openai: chatgpt_1 selection order is now -1 (later)");
+      expect(priorityRequests()).toEqual([
+        expect.objectContaining({ method: "PUT", body: { id: "chatgpt_1", priority: -1 } }),
+      ]);
+    });
+
+    // The signed form is what the command itself prints back, so it has to round-trip.
+    test("a leading-plus integer parses to the same value as the bare spelling", async () => {
+      const result = await run(["priority", "openai", "chatgpt_1", "+2"]);
+
+      expect(result.code).toBe(0);
+      expect(result.stdout).toBe("openai: chatgpt_1 selection order is now +2 (first)");
+      expect(priorityRequests()).toEqual([
+        expect.objectContaining({ method: "PUT", body: { id: "chatgpt_1", priority: 2 } }),
+      ]);
+    });
+
+    test.each([
+      ["first", 2],
+      ["Earlier", 1],
+      ["normal", 0],
+      ["later", -1],
+      ["LAST", -2],
+    ] as const)("the preset word %s maps to %d", async (word, expected) => {
+      const result = await run(["priority", "openai", "chatgpt_1", word]);
+
+      expect(result.code).toBe(0);
+      expect(priorityRequests()).toEqual([
+        expect.objectContaining({ body: { id: "chatgpt_1", priority: expected } }),
+      ]);
+    });
+
+    // The five presets live in three places that cannot import one another: the dashboard
+    // select, the CLI's preset words, and the core range. Driving the CLI from the GUI's own
+    // list means a change to either side fails here instead of silently disagreeing about
+    // what "First" means.
+    test("the dashboard select and the CLI preset words describe the same five orders", async () => {
+      const presets = ACCOUNT_PRIORITY_PRESETS.map(value => ({
+        value,
+        word: accountPriorityPresetKey(value)?.replace("accountPool.priority", "").toLowerCase(),
+      }));
+      expect(presets.map(preset => preset.word)).toEqual(["first", "earlier", "normal", "later", "last"]);
+
+      for (const { value, word } of presets) {
+        requests.length = 0;
+        const result = await run(["priority", "openai", "chatgpt_1", word!]);
+
+        expect(result.code).toBe(0);
+        expect(priorityRequests()).toEqual([
+          expect.objectContaining({ body: { id: "chatgpt_1", priority: value } }),
+        ]);
+      }
+    });
+
+    test("the dashboard mirrors the core priority range", () => {
+      expect({ fallback: GUI_DEFAULT_PRIORITY, min: GUI_MIN_PRIORITY, max: GUI_MAX_PRIORITY }).toEqual({
+        fallback: DEFAULT_ACCOUNT_PRIORITY,
+        min: MIN_ACCOUNT_PRIORITY,
+        max: MAX_ACCOUNT_PRIORITY,
+      });
+    });
+
+    test("main is translated to the internal id the API expects", async () => {
+      const result = await run(["priority", "openai", "main", "last", "--json"]);
+
+      expect(result.code).toBe(0);
+      expect(JSON.parse(result.stdout)).toEqual({
+        ok: true,
+        provider: "openai",
+        id: "__main__",
+        priority: -2,
+        preset: "last",
+      });
+    });
+
+    test("reset sends null", async () => {
+      await run(["priority", "openai", "chatgpt_1", "reset"]);
+
+      expect(priorityRequests()).toEqual([
+        expect.objectContaining({ body: { id: "chatgpt_1", priority: null } }),
+      ]);
+    });
+
+    test("an omitted value reads the stored order without writing", async () => {
+      const result = await run(["priority", "openai", "chatgpt_1"]);
+
+      expect(result.code).toBe(0);
+      expect(result.stdout).toBe("openai: chatgpt_1 selection order is +1 (earlier)");
+      expect(priorityRequests()).toEqual([]);
+    });
+
+    test("the read emits the same JSON envelope as the write", async () => {
+      const result = await run(["priority", "openai", "chatgpt_1", "--json"]);
+
+      expect(result.code).toBe(0);
+      expect(JSON.parse(result.stdout)).toEqual({
+        ok: true,
+        provider: "openai",
+        id: "chatgpt_1",
+        priority: 1,
+        preset: "earlier",
+      });
+      expect(priorityRequests()).toEqual([]);
+    });
+
+    test("reading main resolves the alias and reports the unset default", async () => {
+      const result = await run(["priority", "openai", "main"]);
+
+      expect(result.code).toBe(0);
+      expect(result.stdout).toBe("openai: main selection order is 0 (normal)");
+      expect(priorityRequests()).toEqual([]);
+    });
+
+    test("reading an unknown id exits one and names the account", async () => {
+      const result = await run(["priority", "openai", "nope"]);
+
+      expect(result.code).toBe(1);
+      expect(result.stdout).toBe("");
+      expect(result.stderr).toContain("no openai account nope");
+      expect(result.stderr).toContain("Usage:");
+    });
+
+    // The inherited names guard the preset lookup: `word in PRIORITY_PRESETS` would
+    // resolve them off Object.prototype and send a non-number to the proxy.
+    test.each(["2.5", "abc", "101", "-101", "constructor", "__proto__", "toString"])(
+      "rejects %s before any HTTP call",
+      async value => {
+        const recording: Array<string> = [];
+        const result = await run(["priority", "openai", "chatgpt_1", value], {
+          ...defaultDeps(),
+          fetchImpl: (async (input: RequestInfo | URL) => {
+            recording.push(String(input));
+            throw new Error("must not be called");
+          }) as typeof fetch,
+        });
+
+        expect(result.code).toBe(1);
+        expect(recording).toEqual([]);
+      },
+    );
+
+    test("a trailing extra argument falls through to usage", async () => {
+      const result = await run(["priority", "openai", "chatgpt_1", "first", "extra"]);
+
+      expect(result.code).toBe(1);
+      expect(result.stderr).toContain("Usage:");
+      expect(result.stderr).toContain("ocx account priority");
+      expect(priorityRequests()).toEqual([]);
+    });
+
+    test("non-Codex providers are rejected", async () => {
+      const result = await run(["priority", "anthropic", "acct_1", "first"]);
+
+      expect(result.code).toBe(1);
+      expect(result.stderr).toContain("only applies to the openai Codex account pool");
+    });
+
+    // Both paths reach the proxy through different helpers — the read through
+    // fetchCodexRows, the write through apiJson — so each needs its own guard.
+    test.each([
+      ["the read", ["priority", "openai", "chatgpt_1"]],
+      ["the write", ["priority", "openai", "chatgpt_1", "first"]],
+    ] as const)("%s reports an unreachable proxy instead of throwing", async (_label, args) => {
+      const result = await run([...args], unreachableDeps());
+
+      expect(result.code).toBe(1);
+      expect(result.stdout).toBe("");
+      expect(result.stderr).toContain("Proxy not reachable");
+      expect(result.stderr).toContain("ocx start");
+      expect(result.stderr).toContain("ocx ensure");
+    });
+
+    test("the advisory note goes to stderr so --json stdout stays parseable", async () => {
+      const result = await run(["priority", "openai", "chatgpt_1", "later", "--json"]);
+
+      expect(result.code).toBe(0);
+      // Both advisory lines, asserted exactly: the pin release is a side effect of a command
+      // that reads as purely declarative, so it has to stay stated rather than drift out.
+      expect(result.stderr).toBe([
+        "Takes effect from the next unbound request; running threads keep their current account until drained.",
+        'Also releases any manual "use this account now" pin, on any account.',
+      ].join("\n"));
+      expect(JSON.parse(result.stdout)).toEqual({
+        ok: true,
+        provider: "openai",
+        id: "chatgpt_1",
+        priority: -1,
+        preset: "later",
+      });
+    });
+  });
+
   describe("38: the authorization code never has to travel through argv", () => {
     // An OAuth redirect URL carries a short-lived credential. Passed as an
     // argument it lands in shell history and is readable via `ps` for as long
diff --git a/tests/cli-headless-parity.test.ts b/tests/cli-headless-parity.test.ts
index 3761e68e1c..8a976bd576 100644
--- a/tests/cli-headless-parity.test.ts
+++ b/tests/cli-headless-parity.test.ts
@@ -342,4 +342,43 @@ describe("headless GUI parity CLI", () => {
       rmSync(home, { recursive: true, force: true });
     }
   });
+
+  test("config set releases the manual pin when it writes the selection order", async () => {
+    const home = mkdtempSync(join(tmpdir(), "ocx-cli-priority-pin-"));
+    const previous = process.env.OPENCODEX_HOME;
+    process.env.OPENCODEX_HOME = home;
+    const configPath = join(home, "config.json");
+    const base = {
+      port: 10100,
+      providers: { openai: { adapter: "openai-responses", baseUrl: "https://chatgpt.com/backend-api/codex", authMode: "forward" } },
+      defaultProvider: "openai",
+      activeCodexAccountPinned: "work",
+    };
+    const readConfig = () => JSON.parse(readFileSync(configPath, "utf8"));
+    const readPin = () => readConfig().activeCodexAccountPinned;
+    try {
+      // The whole map, one entry, and a removal are all the operator restating the
+      // order, so each releases the pin -- otherwise it keeps capping the tier
+      // ceiling at "work" and the order just written has no visible effect.
+      for (const { argv, expected } of [
+        { argv: ["set", "codexAccountPriorities", '{"work":1}'], expected: { work: 1 } },
+        { argv: ["set", "codexAccountPriorities.work", "2"], expected: { work: 2 } },
+        { argv: ["unset", "codexAccountPriorities"], expected: undefined },
+      ]) {
+        writeFileSync(configPath, JSON.stringify({ ...base, codexAccountPriorities: { work: 0 } }));
+        expect(await handleConfigCommand([...argv, "--json"])).toBe(0);
+        expect(readPin()).toBeUndefined();
+        expect(readConfig().codexAccountPriorities).toEqual(expected);
+      }
+
+      // An unrelated field is not a statement about ordering, so the pin survives.
+      writeFileSync(configPath, JSON.stringify({ ...base, codexAccountPriorities: { work: 1 } }));
+      expect(await handleConfigCommand(["set", "autoSwitchThreshold", "50", "--json"])).toBe(0);
+      expect(readPin()).toBe("work");
+    } finally {
+      if (previous === undefined) delete process.env.OPENCODEX_HOME;
+      else process.env.OPENCODEX_HOME = previous;
+      rmSync(home, { recursive: true, force: true });
+    }
+  });
 });
diff --git a/tests/codex-auth-api.test.ts b/tests/codex-auth-api.test.ts
index 65ee1e553d..661309e74d 100644
--- a/tests/codex-auth-api.test.ts
+++ b/tests/codex-auth-api.test.ts
@@ -16,6 +16,7 @@ import {
   clearMainAccountInfoCache, maskEmail,
   clearCodexQuotaPrimeState, primeCodexPoolQuotas, seedCodexAuthAdmissionForTests,
   type CodexAuthAccountDto,
+  listCodexAuthAccounts,
 } from "../src/codex/auth-api";
 import {
   getCodexAccountCredential,
@@ -1010,6 +1011,8 @@ describe("codex-auth API", () => {
     const data = await resp!.json() as { activeCodexAccountId: string | null; autoSwitchThreshold: number };
     expect(data).toEqual({
       activeCodexAccountId: "pool-live",
+      pinned: false,
+      pinnedAccountId: null,
       autoSwitchThreshold: 55,
       upstreamFailoverThreshold: 3,
       accountPoolStrategy: "quota",
@@ -2550,6 +2553,244 @@ describe("codex-auth API", () => {
     expect(resolveCodexAccountForThread("runtime-selection", config)).toBe("pool-runtime");
   });
 
+  async function putPriority(config: OcxConfig, body: unknown): Promise<Response> {
+    const req = new Request("http://localhost/api/codex-auth/accounts/priority", {
+      method: "PUT",
+      headers: { "Content-Type": "application/json" },
+      body: typeof body === "string" ? body : JSON.stringify(body),
+    });
+    return (await handleCodexAuthAPI(req, new URL(req.url), config))!;
+  }
+
+  test("PUT /api/codex-auth/accounts/priority persists a pool account's selection order", async () => {
+    const config = makeConfig();
+    seedPoolAccount(config, { id: "work", email: "work@example.test" });
+
+    const resp = await putPriority(config, { id: "work", priority: 2 });
+
+    expect(resp.status).toBe(200);
+    expect(await resp.json()).toMatchObject({ ok: true, id: "work", priority: 2 });
+    expect(config.codexAccountPriorities).toEqual({ work: 2 });
+  });
+
+  test("PUT /api/codex-auth/accounts/priority accepts the main Codex account", async () => {
+    const config = makeConfig();
+
+    const resp = await putPriority(config, { id: MAIN_CODEX_ACCOUNT_ID, priority: -2 });
+
+    expect(resp.status).toBe(200);
+    expect(await resp.json()).toMatchObject({ id: MAIN_CODEX_ACCOUNT_ID, priority: -2 });
+    expect(config.codexAccountPriorities).toEqual({ [MAIN_CODEX_ACCOUNT_ID]: -2 });
+  });
+
+  // The id guard is the one rejection branch with no coverage: the priority-value and
+  // request-body tables below already cover theirs. It is also the load-bearing guard --
+  // it is what keeps a prototype key out of the priorities map -- and neither the CLI
+  // (which validates ids before issuing the PUT) nor the dashboard (which can only name
+  // accounts it just listed) can reach it, so only a direct request exercises it.
+  test.each([
+    ["a prototype key", "__proto__"],
+    ["the prototype property", "prototype"],
+    ["the constructor property", "constructor"],
+    ["an id containing a space", "has space"],
+    ["an over-long id", "a".repeat(65)],
+    ["an empty id", ""],
+    ["a non-string id", 123],
+    ["a null id", null],
+  ] as const)("rejects %s before any write", async (_label, id) => {
+    const config = makeConfig();
+    seedPoolAccount(config, { id: "work", email: "work@example.test" });
+
+    const resp = await putPriority(config, { id, priority: 1 });
+
+    expect(resp.status).toBe(400);
+    expect(await resp.json()).toMatchObject({ error: "Invalid account id format" });
+    expect(config.codexAccountPriorities).toBeUndefined();
+  });
+
+  // A pin predating any stored order would otherwise outrank it forever: it blocks
+  // preemption and caps every eligibility list at its own tier. Setting an order is the
+  // newer statement of intent, so it releases the pin rather than losing to it.
+  test("setting a selection order releases a pin, whichever account was pinned", async () => {
+    const config = makeConfig({ activeCodexAccountPinned: "side" });
+    seedPoolAccount(config, { id: "work", email: "work@example.test" });
+    seedPoolAccount(config, { id: "side", email: "side@example.test" });
+
+    const resp = await putPriority(config, { id: "work", priority: 1 });
+
+    expect(resp.status).toBe(200);
+    expect(config.codexAccountPriorities).toEqual({ work: 1 });
+    expect(config.activeCodexAccountPinned).toBeUndefined();
+  });
+
+  test("a null priority resets the account and drops an emptied map", async () => {
+    const config = makeConfig({ codexAccountPriorities: { work: 2 } });
+    seedPoolAccount(config, { id: "work", email: "work@example.test" });
+
+    const resp = await putPriority(config, { id: "work", priority: null });
+
+    expect(resp.status).toBe(200);
+    expect(await resp.json()).toMatchObject({ id: "work", priority: 0 });
+    expect(config.codexAccountPriorities).toBeUndefined();
+  });
+
+  test.each([
+    ["a fraction", 1.5],
+    ["a numeric string", "2"],
+    ["a boolean", true],
+    ["an array", []],
+    ["an object", {}],
+    ["above the range", 101],
+    ["below the range", -101],
+    // An omitted key, which JSON cannot distinguish from an explicit undefined. Only `null`
+    // means reset; a body with no priority at all is a malformed request, not a reset.
+    // Deliberately no NaN case: JSON.stringify turns NaN into null, which this route
+    // legitimately reads as a reset, so asserting a 400 would assert something unreachable.
+    // NaN is covered where it can occur, against parseAccountPriority in
+    // tests/codex-pool-rotation.test.ts.
+    ["a missing value", undefined],
+  ] as const)("rejects %s as a selection order", async (_label, priority) => {
+    const config = makeConfig();
+    seedPoolAccount(config, { id: "work", email: "work@example.test" });
+
+    const resp = await putPriority(config, { id: "work", priority });
+
+    expect(resp.status).toBe(400);
+    // The message too, not just the status: the id guard and the exists check also answer
+    // 400/404 here, so a status-only assertion would pass if validation order regressed.
+    expect(await resp.json()).toMatchObject({
+      error: expect.stringContaining("priority must be null or an integer"),
+    });
+    expect(config.codexAccountPriorities).toBeUndefined();
+  });
+
+  test.each([
+    ["a JSON array", "[1]"],
+    ["a JSON string", '"work"'],
+    ["a bare number", "7"],
+    ["JSON null", "null"],
+  ] as const)("rejects %s as a request body", async (_label, body) => {
+    const resp = await putPriority(makeConfig(), body);
+    expect(resp.status).toBe(400);
+    expect(await resp.json()).toMatchObject({ error: "body must be an object" });
+  });
+
+  test("rejects malformed JSON as a request body", async () => {
+    const config = makeConfig();
+
+    const resp = await putPriority(config, "{not json");
+
+    expect(resp.status).toBe(400);
+    // A distinct message from the not-an-object case: the parse fails before the shape
+    // check, and collapsing the two would hide a body that parsed but was the wrong type.
+    expect(await resp.json()).toMatchObject({ error: "Invalid JSON" });
+    expect(config.codexAccountPriorities).toBeUndefined();
+  });
+
+  test("an unknown account id is a 404 and writes nothing", async () => {
+    const config = makeConfig();
+
+    const resp = await putPriority(config, { id: "missing", priority: 1 });
+
+    expect(resp.status).toBe(404);
+    expect(config.codexAccountPriorities).toBeUndefined();
+  });
+
+  test("selection order is independent of alias, pause, and active selection", async () => {
+    const config = makeConfig({ activeCodexAccountId: "work" });
+    seedPoolAccount(config, { id: "work", email: "work@example.test" });
+
+    await putPriority(config, { id: "work", priority: 1 });
+
+    expect(config.codexAccountPriorities).toEqual({ work: 1 });
+    expect(config.pausedCodexAccountIds).toBeUndefined();
+    expect(config.activeCodexAccountId).toBe("work");
+    expect(config.codexAccounts?.[0]?.alias).toBeUndefined();
+  });
+
+  test("the account list reports selection order, defaulting to zero", async () => {
+    const config = makeConfig({ codexAccountPriorities: { work: 2 } });
+    seedPoolAccount(config, { id: "work", email: "work@example.test" });
+    seedPoolAccount(config, { id: "side", email: "side@example.test" });
+
+    const accounts = await listCodexAuthAccounts(config);
+
+    expect(accounts.find(a => a.id === "work")?.priority).toBe(2);
+    expect(accounts.find(a => a.id === "side")?.priority).toBe(0);
+    expect(accounts.find(a => a.isMain)?.priority).toBe(0);
+  });
+
+  test("GET /api/codex-auth/active reports an operator pin but not an automatic pick", async () => {
+    const config = makeConfig({ activeCodexAccountId: "work" });
+    seedPoolAccount(config, { id: "work", email: "work@example.test" });
+
+    const read = async () => {
+      const req = new Request("http://localhost/api/codex-auth/active");
+      return (await (await handleCodexAuthAPI(req, new URL(req.url), config))!.json()) as { pinned: boolean };
+    };
+    expect((await read()).pinned).toBe(false);
+
+    const selectReq = new Request("http://localhost/api/codex-auth/active", {
+      method: "PUT",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ accountId: "work" }),
+    });
+    await handleCodexAuthAPI(selectReq, new URL(selectReq.url), config);
+
+    expect(config.activeCodexAccountPinned).toBe("work");
+    expect((await read()).pinned).toBe(true);
+  });
+
+  // Under round-robin the pin caps the tier while the cursor moves inside it, so `pinned`
+  // alone cannot tell a surface which card to mark. The id is reported independently.
+  test("GET /api/codex-auth/active names the pinned account even when it is not active", async () => {
+    const config = makeConfig({ activeCodexAccountId: "side", activeCodexAccountPinned: "work" });
+    seedPoolAccount(config, { id: "work", email: "work@example.test" });
+    seedPoolAccount(config, { id: "side", email: "side@example.test" });
+
+    const req = new Request("http://localhost/api/codex-auth/active");
+    const data = await (await handleCodexAuthAPI(req, new URL(req.url), config))!.json() as
+      { pinned: boolean; pinnedAccountId: string | null };
+
+    expect(data.pinned).toBe(false);
+    expect(data.pinnedAccountId).toBe("work");
+  });
+
+  // A null id clears the selection rather than making one, so it must not leave a pin
+  // behind. Pinning the __main__ fallback would produce a pin no effective active
+  // account matches: GET reports pinned:false while selectPriorityTier still honours it
+  // as a floor, silently capping the pool at the main account's tier — the exact
+  // inverse of ordering main last, with no surface that shows or clears it.
+  test("clearing the active account releases the pin instead of pinning main", async () => {
+    const config = makeConfig({
+      activeCodexAccountId: "work",
+      codexAccountPriorities: { [MAIN_CODEX_ACCOUNT_ID]: -2 },
+    });
+    seedPoolAccount(config, { id: "work", email: "work@example.test" });
+
+    const select = new Request("http://localhost/api/codex-auth/active", {
+      method: "PUT",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ accountId: "work" }),
+    });
+    await handleCodexAuthAPI(select, new URL(select.url), config);
+    expect(config.activeCodexAccountPinned).toBe("work");
+
+    const clear = new Request("http://localhost/api/codex-auth/active", {
+      method: "PUT",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ accountId: null }),
+    });
+    const resp = await handleCodexAuthAPI(clear, new URL(clear.url), config);
+
+    expect(resp!.status).toBe(200);
+    expect(config.activeCodexAccountId).toBeUndefined();
+    expect(config.activeCodexAccountPinned).toBeUndefined();
+    const req = new Request("http://localhost/api/codex-auth/active");
+    expect(await (await handleCodexAuthAPI(req, new URL(req.url), config))!.json())
+      .toMatchObject({ pinned: false });
+  });
+
   test("PUT /api/codex-auth/accounts/pause-exhausted pauses only freshly confirmed exhausted accounts", async () => {
     const config = makeConfig({
       codexAccounts: [
diff --git a/tests/codex-auth-context.test.ts b/tests/codex-auth-context.test.ts
index 55504ed658..c3210902c6 100644
--- a/tests/codex-auth-context.test.ts
+++ b/tests/codex-auth-context.test.ts
@@ -368,6 +368,55 @@ describe("Codex auth context", () => {
       .resolves.toMatchObject({ kind: "pool", accountId: "pool-b" });
   });
 
+  test("selection order never bypasses an exact account selector", async () => {
+    // Regression: `codexAccountPriorities` narrows the pool to the highest tier, but it
+    // is an ordering boundary over the pool path only. A request that names an account
+    // exactly must resolve to exactly that account, no matter how another account is
+    // ordered — otherwise the selector itself would be overridden by routing metadata.
+    const cfg = config();
+    cfg.activeCodexAccountId = "pool-b";
+    cfg.codexAccountPriorities = { "pool-b": 2, "pool-a": 1 };
+    // A live pin is the stronger case than priority alone: `selectPriorityTier`
+    // treats it as a hard ceiling and `pickPriorityPreemption` returns null while
+    // it has headroom. An exact selector must bypass it all the same.
+    cfg.activeCodexAccountPinned = "pool-b";
+    cfg.codexAccounts?.push({ id: "pool-b", email: "pool-b@example.test", isMain: false });
+    saveCodexAccountCredential("pool-a", {
+      accessToken: "pool_a_token",
+      refreshToken: "pool_a_refresh",
+      expiresAt: Date.now() + 5 * 60_000,
+      chatgptAccountId: "pool_a_acc",
+    });
+    saveCodexAccountCredential("pool-b", {
+      accessToken: "pool_b_token",
+      refreshToken: "pool_b_refresh",
+      expiresAt: Date.now() + 5 * 60_000,
+      chatgptAccountId: "pool_b_acc",
+    });
+
+    // The pool path honors the order: pool-b outranks pool-a, so an unbound request
+    // prefers pool-b.
+    await expect(resolveCodexAuthContext(new Headers(), cfg, "pool", { modelId: "gpt-5.6-sol" }))
+      .resolves.toMatchObject({ kind: "pool", accountId: "pool-b" });
+
+    // An exact selector names pool-a: it must resolve to pool-a even though pool-b is
+    // ordered earlier. Selection order is a tiebreak inside the eligible pool, never a
+    // way to redirect a request that already named its account.
+    await expect(resolveCodexAuthContext(new Headers(), cfg, "pool", {
+      accountId: "pool-a",
+      modelId: "gpt-5.6-sol",
+    })).resolves.toMatchObject({
+      kind: "pool",
+      accountId: "pool-a",
+      accessToken: "pool_a_token",
+      chatgptAccountId: "pool_a_acc",
+      fixedAccount: true,
+    });
+    expect(cfg.activeCodexAccountId).toBe("pool-b");
+    // An exact selector must not release an operator pin either.
+    expect(cfg.activeCodexAccountPinned).toBe("pool-b");
+  });
+
   test("exact main-account resolution reads auth.json without consulting the active Pool account", async () => {
     const cfg = config();
     writeFileSync(join(testDir, "auth.json"), JSON.stringify({
diff --git a/tests/codex-pool-rotation.test.ts b/tests/codex-pool-rotation.test.ts
index f16f84dfbe..e50b106440 100644
--- a/tests/codex-pool-rotation.test.ts
+++ b/tests/codex-pool-rotation.test.ts
@@ -1,21 +1,34 @@
 import {
   clearPoolRotationState,
+  DEFAULT_ACCOUNT_PRIORITY,
+  normalizeAccountPriority,
   notePoolRotationSuccess,
+  parseAccountPriority,
   peekRoundRobinAccount,
   pickRoundRobinAccount,
+  selectPriorityTier,
 } from "../src/codex/pool-rotation";
+import {
+  clearCodexAccountPin,
+  codexAccountPriorityLookup,
+  forgetCodexAccountPriority,
+  getCodexAccountPriority,
+  setCodexAccountPriority,
+} from "../src/codex/account-priority";
 import {
   clearCodexUpstreamHealth,
   clearThreadAccountMap,
+  CODEX_TRANSIENT_SOFT_AVOID_MS,
+  previewCodexAccountForRequest,
   getEffectiveActiveCodexAccountId,
   isCodexAccountInCooldown,
   pickAlternateCodexAccount,
-  previewCodexAccountForRequest,
   recordCodexUpstreamOutcome,
   resetCodexRoutingForManualSelection,
   resolveCodexAccountForThread,
 } from "../src/codex/routing";
 import { saveCodexAccountCredential } from "../src/codex/account-store";
+import { MAIN_CODEX_ACCOUNT_ID } from "../src/codex/account-id";
 import { clearAccountQuota, updateAccountQuota } from "../src/codex/auth-api";
 import { getConfigPath } from "../src/config";
 import type { OcxConfig } from "../src/types";
@@ -72,6 +85,187 @@ function shareSpreadPercent(counts: Record<string, number>, total: number): numb
   return Math.max(...shares) - Math.min(...shares);
 }
 
+describe("account selection order parsing", () => {
+  test("parseAccountPriority accepts integers inside the configurable range", () => {
+    expect(parseAccountPriority(0)).toBe(0);
+    expect(parseAccountPriority(2)).toBe(2);
+    expect(parseAccountPriority(-2)).toBe(-2);
+    expect(parseAccountPriority(100)).toBe(100);
+    expect(parseAccountPriority(-100)).toBe(-100);
+  });
+
+  test("parseAccountPriority rejects non-integers, wrong types, and out-of-range values", () => {
+    for (const raw of [1.5, "2", true, null, undefined, [], {}, Number.NaN, 101, -101, Number.POSITIVE_INFINITY]) {
+      expect(parseAccountPriority(raw)).toBeNull();
+    }
+  });
+
+  test("normalizeAccountPriority degrades anything unparseable to the default tier", () => {
+    expect(normalizeAccountPriority(3)).toBe(3);
+    expect(normalizeAccountPriority("3")).toBe(DEFAULT_ACCOUNT_PRIORITY);
+    expect(normalizeAccountPriority(undefined)).toBe(DEFAULT_ACCOUNT_PRIORITY);
+  });
+});
+
+describe("selectPriorityTier", () => {
+  const withHeadroom = () => true;
+  const noHeadroom = () => false;
+  const flat = () => 0;
+
+  test("returns the input untouched when every account shares one tier", () => {
+    const ids = ["a", "b", "c"];
+    expect(selectPriorityTier(ids, flat, withHeadroom)).toBe(ids);
+  });
+
+  test("keeps only the highest tier that still has headroom", () => {
+    const priorities: Record<string, number> = { a: 1, b: 0, c: 1 };
+    const selected = selectPriorityTier(["a", "b", "c"], id => priorities[id]!, withHeadroom);
+    expect(selected).toEqual(["a", "c"]);
+  });
+
+  test("preserves input order inside the selected tier", () => {
+    const priorities: Record<string, number> = { __main__: 0, a: 0, b: -1 };
+    const selected = selectPriorityTier(["__main__", "a", "b"], id => priorities[id]!, withHeadroom);
+    expect(selected).toEqual(["__main__", "a"]);
+  });
+
+  test("falls through to the next tier once the tier above is drained", () => {
+    const priorities: Record<string, number> = { a: 1, b: 0 };
+    const selected = selectPriorityTier(["a", "b"], id => priorities[id]!, id => id !== "a");
+    expect(selected).toEqual(["b"]);
+  });
+
+  test("returns the input unchanged when every tier is drained", () => {
+    const priorities: Record<string, number> = { a: 1, b: 0 };
+    const ids = ["a", "b"];
+    expect(selectPriorityTier(ids, id => priorities[id]!, noHeadroom)).toBe(ids);
+  });
+
+  test("a pinned account with headroom lowers the ceiling to its own tier", () => {
+    const priorities: Record<string, number> = { a: 1, b: 0, c: 0 };
+    const selected = selectPriorityTier(["a", "b", "c"], id => priorities[id]!, withHeadroom, "b");
+    expect(selected).toEqual(["b", "c"]);
+  });
+
+  test("a drained pin is ignored so ordering resumes on its own", () => {
+    const priorities: Record<string, number> = { a: 1, b: 0 };
+    const selected = selectPriorityTier(["a", "b"], id => priorities[id]!, id => id !== "b", "b");
+    expect(selected).toEqual(["a"]);
+  });
+
+  test("a pin that is no longer eligible is ignored", () => {
+    const priorities: Record<string, number> = { a: 1, b: 0 };
+    const selected = selectPriorityTier(["a", "b"], id => priorities[id]!, withHeadroom, "gone");
+    expect(selected).toEqual(["a"]);
+  });
+
+  // The ceiling picks a tier, it does not pick accounts: a drained member stays in
+  // the returned list so the strategy behind it still sees the whole tier.
+  test("the pinned tier comes back whole, drained siblings included", () => {
+    const priorities: Record<string, number> = { a: 1, b: 0, c: 0 };
+    const selected = selectPriorityTier(["a", "b", "c"], id => priorities[id]!, id => id !== "c", "b");
+    expect(selected).toEqual(["b", "c"]);
+  });
+});
+
+describe("setCodexAccountPriority", () => {
+  test("stores a non-default order under the account id", () => {
+    const config = makeConfig();
+    setCodexAccountPriority(config, "a", 2);
+    expect(config.codexAccountPriorities).toEqual({ a: 2 });
+    expect(getCodexAccountPriority(config, "a")).toBe(2);
+  });
+
+  test("writing the default order removes that account's entry", () => {
+    const config = makeConfig({ codexAccountPriorities: { a: 1, b: 2 } } as Partial<OcxConfig>);
+    setCodexAccountPriority(config, "a", DEFAULT_ACCOUNT_PRIORITY);
+    expect(config.codexAccountPriorities).toEqual({ b: 2 });
+    expect(getCodexAccountPriority(config, "a")).toBe(DEFAULT_ACCOUNT_PRIORITY);
+  });
+
+  // An empty map would still be a stored map, and routing's fast path keys off the
+  // key being absent — a pool that was ordered and then reset must look unordered.
+  test("emptying the map drops the config key entirely", () => {
+    const config = makeConfig({ codexAccountPriorities: { a: 1 } } as Partial<OcxConfig>);
+    setCodexAccountPriority(config, "a", DEFAULT_ACCOUNT_PRIORITY);
+    expect(Object.hasOwn(config, "codexAccountPriorities")).toBe(false);
+  });
+
+  test("forgetCodexAccountPriority leaves the other accounts' order alone", () => {
+    const config = makeConfig({ codexAccountPriorities: { a: 1, b: -3 } } as Partial<OcxConfig>);
+    forgetCodexAccountPriority(config, "b");
+    expect(config.codexAccountPriorities).toEqual({ a: 1 });
+  });
+
+  // A plain assignment to a reserved key hits Object.prototype's setter and stores
+  // nothing; the entry must land as an own data property with the map's own shape intact.
+  test("a reserved key is stored as an own data property", () => {
+    const config = makeConfig();
+    setCodexAccountPriority(config, "__proto__", 3);
+
+    const priorities = config.codexAccountPriorities!;
+    expect(Object.hasOwn(priorities, "__proto__")).toBe(true);
+    expect(Object.getPrototypeOf(priorities)).toBe(Object.prototype);
+    expect(getCodexAccountPriority(config, "__proto__")).toBe(3);
+  });
+});
+
+describe("codexAccountPriorityLookup", () => {
+  test("reports the stored order for a configured account", () => {
+    const config = makeConfig({ codexAccountPriorities: { a: 2 } } as Partial<OcxConfig>);
+    const priorityOf = codexAccountPriorityLookup(config);
+    expect(priorityOf("a")).toBe(2);
+    expect(priorityOf("b")).toBe(DEFAULT_ACCOUNT_PRIORITY);
+  });
+
+  // `constructor` resolves on Object.prototype, so an ungated read would hand a
+  // function to normalization instead of reporting "this account has no order".
+  test("inherited members of the map are not a selection order", () => {
+    const config = makeConfig({ codexAccountPriorities: { a: 2 } } as Partial<OcxConfig>);
+    const priorityOf = codexAccountPriorityLookup(config);
+    expect(priorityOf("constructor")).toBe(DEFAULT_ACCOUNT_PRIORITY);
+    expect(priorityOf("toString")).toBe(DEFAULT_ACCOUNT_PRIORITY);
+  });
+
+  test("an unordered pool answers with the default for every account", () => {
+    const priorityOf = codexAccountPriorityLookup(makeConfig());
+    expect(priorityOf("a")).toBe(DEFAULT_ACCOUNT_PRIORITY);
+    expect(priorityOf("constructor")).toBe(DEFAULT_ACCOUNT_PRIORITY);
+  });
+
+  test("an unparseable stored order degrades to the default tier", () => {
+    const config = makeConfig({ codexAccountPriorities: { a: 1.5, b: 999 } } as Partial<OcxConfig>);
+    const priorityOf = codexAccountPriorityLookup(config);
+    expect(priorityOf("a")).toBe(DEFAULT_ACCOUNT_PRIORITY);
+    expect(priorityOf("b")).toBe(DEFAULT_ACCOUNT_PRIORITY);
+  });
+});
+
+describe("clearCodexAccountPin", () => {
+  test("releases whatever is pinned when no account is named", () => {
+    const config = makeConfig({ activeCodexAccountPinned: "a" } as Partial<OcxConfig>);
+    clearCodexAccountPin(config);
+    expect(config.activeCodexAccountPinned).toBeUndefined();
+    // Deleted rather than set to undefined, so the saved config carries no key.
+    expect(Object.hasOwn(config, "activeCodexAccountPinned")).toBe(false);
+  });
+
+  test("releases only the named account", () => {
+    const config = makeConfig({ activeCodexAccountPinned: "a" } as Partial<OcxConfig>);
+    clearCodexAccountPin(config, "b");
+    expect(config.activeCodexAccountPinned).toBe("a");
+
+    clearCodexAccountPin(config, "a");
+    expect(config.activeCodexAccountPinned).toBeUndefined();
+  });
+
+  test("is a no-op when nothing is pinned", () => {
+    const config = makeConfig();
+    clearCodexAccountPin(config, "a");
+    expect(config.activeCodexAccountPinned).toBeUndefined();
+  });
+});
+
 describe("pickRoundRobinAccount", () => {
   beforeEach(() => clearPoolRotationState());
 
@@ -525,3 +719,305 @@ describe("accountPoolStrategy new-session routing", () => {
     expect(config.activeCodexAccountId).toBe("a");
   });
 });
+
+describe("selection order across rotation strategies", () => {
+  beforeEach(() => {
+    previousOpencodexHome = process.env.OPENCODEX_HOME;
+    if (existsSync(TEST_DIR)) rmSync(TEST_DIR, { recursive: true });
+    mkdirSync(TEST_DIR, { recursive: true });
+    process.env.OPENCODEX_HOME = TEST_DIR;
+    previousCodexHome = process.env.CODEX_HOME;
+    process.env.CODEX_HOME = TEST_DIR;
+    clearThreadAccountMap();
+    clearCodexUpstreamHealth();
+    clearAccountQuota();
+    clearPoolRotationState();
+  });
+
+  afterEach(() => {
+    clearAccountQuota();
+    clearCodexUpstreamHealth();
+    clearThreadAccountMap();
+    clearPoolRotationState();
+    if (previousOpencodexHome === undefined) delete process.env.OPENCODEX_HOME;
+    else process.env.OPENCODEX_HOME = previousOpencodexHome;
+    if (previousCodexHome === undefined) delete process.env.CODEX_HOME;
+    else process.env.CODEX_HOME = previousCodexHome;
+    if (existsSync(TEST_DIR)) rmSync(TEST_DIR, { recursive: true });
+  });
+
+  function primeAllQuota(usage = 10): void {
+    for (const id of THREE_ACCOUNT_IDS) updateAccountQuota(id, usage);
+  }
+
+  test("round-robin spreads only across the highest tier", () => {
+    const config = makeThreeAccountConfig({
+      accountPoolStrategy: "round-robin",
+      codexAccountPriorities: { a: 1, b: 1 },
+    } as Partial<OcxConfig>);
+    primeAllQuota();
+
+    const picks = Array.from({ length: 12 }, () => resolveCodexAccountForThread(null, config));
+    expect(countPicks(picks, THREE_ACCOUNT_IDS)).toEqual({ a: 6, b: 6, c: 0 });
+  });
+
+  test("round-robin falls through to the next tier when the one above drains", () => {
+    const config = makeThreeAccountConfig({
+      accountPoolStrategy: "round-robin",
+      codexAccountPriorities: { a: 1, b: 1 },
+    } as Partial<OcxConfig>);
+    primeAllQuota();
+    updateAccountQuota("a", 95);
+    updateAccountQuota("b", 95);
+
+    const picks = Array.from({ length: 4 }, () => resolveCodexAccountForThread(null, config));
+    expect(countPicks(picks, THREE_ACCOUNT_IDS)).toEqual({ a: 0, b: 0, c: 4 });
+  });
+
+  test("round-robin returns to the higher tier after its quota resets", () => {
+    const config = makeThreeAccountConfig({
+      accountPoolStrategy: "round-robin",
+      codexAccountPriorities: { a: 1 },
+    } as Partial<OcxConfig>);
+    primeAllQuota();
+    updateAccountQuota("a", 95);
+    expect(resolveCodexAccountForThread(null, config)).not.toBe("a");
+
+    updateAccountQuota("a", 5);
+    expect(resolveCodexAccountForThread(null, config)).toBe("a");
+  });
+
+  test("a pinned account holds round-robin until it crosses the threshold", () => {
+    const config = makeThreeAccountConfig({
+      accountPoolStrategy: "round-robin",
+      codexAccountPriorities: { a: 1, b: 1 },
+      activeCodexAccountPinned: "c",
+    } as Partial<OcxConfig>);
+    primeAllQuota();
+
+    const held = Array.from({ length: 4 }, () => resolveCodexAccountForThread(null, config));
+    expect(countPicks(held, THREE_ACCOUNT_IDS)).toEqual({ a: 0, b: 0, c: 4 });
+
+    updateAccountQuota("c", 95);
+    expect(resolveCodexAccountForThread(null, config)).not.toBe("c");
+  });
+
+  test("fill-first drains the highest tier before descending", () => {
+    const config = makeThreeAccountConfig({
+      accountPoolStrategy: "fill-first",
+      activeCodexAccountId: undefined,
+      codexAccountPriorities: { c: 1 },
+    } as Partial<OcxConfig>);
+    primeAllQuota();
+
+    expect(resolveCodexAccountForThread(null, config)).toBe("c");
+    updateAccountQuota("c", 95);
+    expect(resolveCodexAccountForThread(null, config)).toBe("a");
+  });
+
+  test("an alternate crosses tiers when the exclusion empties the tier above", () => {
+    const config = makeThreeAccountConfig({ codexAccountPriorities: { a: 1 } } as Partial<OcxConfig>);
+    primeAllQuota();
+
+    // Without the exclusion reaching eligibility the tier walk would select
+    // ["a"] and the caller's post-filter would leave nothing to fail over to.
+    expect(pickAlternateCodexAccount(config, "a")).toBe("b");
+  });
+
+  test("an independent native scope tiers on its own health snapshot", () => {
+    const config = makeThreeAccountConfig({
+      codexAccountPriorities: { a: 1 },
+    } as Partial<OcxConfig>);
+    const now = 1_800_000_000_000;
+    primeAllQuota();
+
+    expect(resolveCodexAccountForThread(null, config, now, "shared")).toBe("a");
+    recordCodexUpstreamOutcome(config, "a", 429, {
+      now: now + 1,
+      resetAt: Math.floor((now + 4 * 24 * 60 * 60_000) / 1_000),
+      modelId: "gpt-5.3-codex-spark",
+    });
+
+    expect(resolveCodexAccountForThread(null, config, now + 2, "spark")).toBe("b");
+    expect(resolveCodexAccountForThread(null, config, now + 3, "shared")).toBe("a");
+  });
+
+  test("preemption inside an independent scope leaves the shared cursor alone", () => {
+    const config = makeThreeAccountConfig({
+      activeCodexAccountId: "b",
+      codexAccountPriorities: { a: 1 },
+    } as Partial<OcxConfig>);
+    const now = 1_800_000_000_000;
+    primeAllQuota();
+
+    expect(resolveCodexAccountForThread(null, config, now, "spark")).toBe("a");
+    expect(getEffectiveActiveCodexAccountId(config)).toBe("b");
+  });
+
+  test("an affined thread keeps its account while retiring a drained manual pin", () => {
+    const config = makeThreeAccountConfig({
+      accountPoolStrategy: "round-robin",
+      activeCodexAccountId: "a",
+      activeCodexAccountPinned: "a",
+      codexAccountPriorities: { b: 1 },
+    } as Partial<OcxConfig>);
+    primeAllQuota();
+
+    expect(resolveCodexAccountForThread("pinned-thread", config)).toBe("a");
+    updateAccountQuota("a", 95);
+
+    // Affinity wins, but the spent operator ceiling is durably over.
+    expect(resolveCodexAccountForThread("pinned-thread", config)).toBe("a");
+    expect(config.activeCodexAccountPinned).toBeUndefined();
+
+    // If the stale pin had survived, restoring A's quota would cap the pool at
+    // A's lower tier again and suppress B.
+    updateAccountQuota("a", 5);
+    expect(resolveCodexAccountForThread(null, config)).toBe("b");
+  });
+
+  test("an independent scope does not retire the shared manual pin", () => {
+    const config = makeThreeAccountConfig({
+      activeCodexAccountId: "a",
+      activeCodexAccountPinned: "a",
+      codexAccountPriorities: { b: 1 },
+    } as Partial<OcxConfig>);
+    primeAllQuota();
+    updateAccountQuota("a", 95);
+
+    expect(resolveCodexAccountForThread(null, config, Date.now(), "spark")).toBe("b");
+    expect(config.activeCodexAccountPinned).toBe("a");
+    expect(getEffectiveActiveCodexAccountId(config)).toBe("a");
+  });
+
+  test("an independent-scope account-wide 429 leaves shared routing state alone", () => {
+    const config = makeThreeAccountConfig({
+      accountPoolStrategy: "round-robin",
+      activeCodexAccountId: "a",
+    });
+    primeAllQuota();
+
+    recordCodexUpstreamOutcome(config, "a", 429, {
+      modelId: "gpt-5.3-codex-spark",
+    });
+
+    expect(getEffectiveActiveCodexAccountId(config)).toBe("a");
+    expect(config.activeCodexAccountId).toBe("a");
+  });
+
+  test("an independent-scope transient failover leaves shared routing state alone", () => {
+    const config = makeThreeAccountConfig({
+      accountPoolStrategy: "round-robin",
+      activeCodexAccountId: "a",
+      upstreamFailoverThreshold: 1,
+    });
+    primeAllQuota();
+
+    recordCodexUpstreamOutcome(config, "a", 503, {
+      modelId: "gpt-5.3-codex-spark",
+    });
+
+    expect(getEffectiveActiveCodexAccountId(config)).toBe("a");
+    expect(config.activeCodexAccountId).toBe("a");
+  });
+
+  test("an independent scope still leaves shared routing alone once its soft avoid expires", () => {
+    // Suppressing the promotion at the moment of the failure is not enough: the
+    // failure streak outlives the soft avoid, so there is a window where the account
+    // is selectable again while shouldFailover still trips. A scoped resolve lands in
+    // applyFailureFailover there, and that is the second place shared state can move.
+    const config = makeThreeAccountConfig({
+      activeCodexAccountId: "a",
+      upstreamFailoverThreshold: 1,
+    } as Partial<OcxConfig>);
+    primeAllQuota();
+    const failedAt = Date.now();
+
+    recordCodexUpstreamOutcome(config, "a", 503, {
+      modelId: "gpt-5.3-codex-spark",
+      now: failedAt,
+    });
+
+    // Past the 30s soft avoid, inside the 5-minute failure window.
+    const afterSoftAvoid = failedAt + CODEX_TRANSIENT_SOFT_AVOID_MS + 1_000;
+    const routed = resolveCodexAccountForThread(null, config, afterSoftAvoid, "spark");
+
+    // Asserted first because it is what proves the resolve reached applyFailureFailover
+    // at all: "a" is selectable again by now, so only the still-tripped streak routes
+    // away from it. Without this the two shared-state assertions would also hold if the
+    // request never got that far, and the guard under test would go unexercised.
+    expect(routed).toBe("b");
+    expect(getEffectiveActiveCodexAccountId(config)).toBe("a");
+    expect(config.activeCodexAccountId).toBe("a");
+  });
+
+  test.each([
+    ["quota", ["a", "a", "a", "a", "a", "a"]],
+    ["round-robin", ["a", "b", "c", "a", "b", "c"]],
+    ["fill-first", ["b", "c", "a", "b", "c", "a"]],
+  ] as const)(
+    "%s preserves its pre-feature fallback when every ordered tier is drained",
+    (strategy, expected) => {
+      const config = makeThreeAccountConfig({
+        accountPoolStrategy: strategy,
+        codexAccountPriorities: { a: 2, b: 1 },
+      } as Partial<OcxConfig>);
+      primeAllQuota(95);
+
+      const picks = Array.from({ length: 6 }, () => resolveCodexAccountForThread(null, config));
+      expect(picks).toEqual([...expected]);
+    },
+  );
+
+  // The expected sequences are the pre-feature ones, recorded literally. Comparing an
+  // unset config against an all-zero one only proves the two agree — both take the
+  // same fast path — so the literal is what actually guards against a regression.
+  test.each([
+    ["quota", ["a", "a", "a", "a", "a", "a"]],
+    ["round-robin", ["a", "b", "c", "a", "b", "c"]],
+    ["fill-first", ["a", "a", "a", "a", "a", "a"]],
+  ] as const)(
+    "%s picks the same sequence with no stored order as before the feature",
+    (strategy, expected) => {
+      const config = makeThreeAccountConfig({ accountPoolStrategy: strategy });
+      primeAllQuota();
+      const picks = Array.from({ length: 6 }, () => resolveCodexAccountForThread(null, config));
+
+      clearPoolRotationState();
+      clearThreadAccountMap();
+      const flat = makeThreeAccountConfig({
+        accountPoolStrategy: strategy,
+        codexAccountPriorities: { a: 0, b: 0, c: 0 },
+      } as Partial<OcxConfig>);
+      const flatPicks = Array.from({ length: 6 }, () => resolveCodexAccountForThread(null, flat));
+
+      expect(picks).toEqual([...expected]);
+      expect(flatPicks).toEqual([...expected]);
+    },
+  );
+
+  test("selection options reach the tier and alternate paths, so main draining is honored everywhere", () => {
+    // Regression for the exact-selector rebase integration: `CodexAccountUsabilityOptions`
+    // (notably `nativeMainSelectionOnly`) must reach `getEligiblePoolAccounts` through
+    // every tier-aware path. During main-profile draining the caller routes on cached
+    // main state only, and `__main__` stays a candidate without a live token read. The
+    // preemption and alternate paths must agree with the quota path about that.
+    const config = makeThreeAccountConfig({
+      activeCodexAccountId: "a",
+      codexAccountPriorities: { __main__: 2, a: 1, b: 1, c: 1 },
+    } as Partial<OcxConfig>);
+    primeAllQuota();
+    // No auth.json exists in this harness, so a live-token read for __main__ would fail.
+    const selectionOptions = { nativeMainSelectionOnly: true as const };
+
+    // Preemption sees __main__ as the highest eligible tier and moves the unbound
+    // request up to it — only possible because selectionOptions reached the tier walk.
+    expect(previewCodexAccountForRequest(null, config, Date.now(), "shared", selectionOptions))
+      .toBe(MAIN_CODEX_ACCOUNT_ID);
+
+    // The alternate path excludes the active account and still honors the option: __main__
+    // is the top remaining candidate rather than being dropped for the live-token rule.
+    expect(pickAlternateCodexAccount(config, "a", Date.now(), "shared", selectionOptions))
+      .toBe(MAIN_CODEX_ACCOUNT_ID);
+  });
+});
diff --git a/tests/codex-routing.test.ts b/tests/codex-routing.test.ts
index 8b889cb819..1802aa8c5b 100644
--- a/tests/codex-routing.test.ts
+++ b/tests/codex-routing.test.ts
@@ -24,12 +24,15 @@ import {
   isCodexAccountSoftAvoided,
   pickLowestUsageCodexAccount,
   parseRetryAfterMs,
+  previewCodexAccountForRequest,
+  reconcileCodexActiveAfterExclusion,
   recordCodexUpstreamOutcome,
   resetCodexRoutingForManualSelection,
   resolveCodexAccountForThread,
   resolveCodexAccountForThreadDetailed,
   tryAcquireCodexQuotaProbeLease,
 } from "../src/codex/routing";
+import { clearPoolRotationState } from "../src/codex/pool-rotation";
 import { removeCodexAccountCredential, saveCodexAccountCredential } from "../src/codex/account-store";
 import {
   clearAccountNeedsReauth,
@@ -1504,3 +1507,248 @@ describe("codex routing", () => {
     expect(resolveCodexAccountForThread("t2", config, now + 6)).toBe("b");
   });
 });
+
+describe("codex account selection order", () => {
+  beforeEach(() => {
+    previousOpencodexHome = process.env.OPENCODEX_HOME;
+    if (existsSync(TEST_DIR)) rmSync(TEST_DIR, { recursive: true });
+    mkdirSync(TEST_DIR, { recursive: true });
+    process.env.OPENCODEX_HOME = TEST_DIR;
+    previousCodexHome = process.env.CODEX_HOME;
+    process.env.CODEX_HOME = TEST_DIR;
+    clearThreadAccountMap();
+    clearCodexUpstreamHealth();
+    clearAccountQuota();
+    clearPoolRotationState();
+    clearAccountNeedsReauth("a");
+    clearAccountNeedsReauth("b");
+    saveTestCredential("a");
+    saveTestCredential("b");
+  });
+
+  afterEach(() => {
+    clearAccountQuota();
+    clearCodexUpstreamHealth();
+    clearThreadAccountMap();
+    clearPoolRotationState();
+    clearAccountNeedsReauth("a");
+    clearAccountNeedsReauth("b");
+    if (previousOpencodexHome === undefined) delete process.env.OPENCODEX_HOME;
+    else process.env.OPENCODEX_HOME = previousOpencodexHome;
+    if (previousCodexHome === undefined) delete process.env.CODEX_HOME;
+    else process.env.CODEX_HOME = previousCodexHome;
+    if (existsSync(TEST_DIR)) rmSync(TEST_DIR, { recursive: true });
+  });
+
+  /** `a` is ordered above `b`; the persisted operator selection is the lower tier. */
+  function orderedConfig(overrides: Partial<OcxConfig> = {}): OcxConfig {
+    return makeConfig({
+      activeCodexAccountId: "b",
+      codexAccountPriorities: { a: 1 },
+      ...overrides,
+    } as Partial<OcxConfig>);
+  }
+
+  test("an unbound request moves back up to the higher tier even when it is hotter", () => {
+    const config = orderedConfig();
+    updateAccountQuota("a", 70);
+    updateAccountQuota("b", 10);
+
+    expect(resolveCodexAccountForThread(null, config)).toBe("a");
+  });
+
+  test("preemption keeps the operator's persisted selection intact", () => {
+    const config = orderedConfig();
+    updateAccountQuota("a", 10);
+    updateAccountQuota("b", 10);
+
+    expect(resolveCodexAccountForThread(null, config)).toBe("a");
+    expect(config.activeCodexAccountId).toBe("b");
+    expect(getEffectiveActiveCodexAccountId(config)).toBe("a");
+  });
+
+  test("falls through to the lower tier once the higher one is over threshold", () => {
+    const config = orderedConfig();
+    updateAccountQuota("a", 90);
+    updateAccountQuota("b", 10);
+
+    expect(resolveCodexAccountForThread(null, config)).toBe("b");
+  });
+
+  test("returns to the higher tier as soon as its quota window resets", () => {
+    const config = orderedConfig();
+    updateAccountQuota("a", 90);
+    updateAccountQuota("b", 10);
+    expect(resolveCodexAccountForThread(null, config)).toBe("b");
+
+    updateAccountQuota("a", 5);
+    expect(resolveCodexAccountForThread(null, config)).toBe("a");
+  });
+
+  test("unknown usage never drains a tier", () => {
+    const config = orderedConfig();
+    updateAccountQuota("b", 10);
+
+    expect(resolveCodexAccountForThread(null, config)).toBe("a");
+  });
+
+  test("every tier over threshold reproduces the stay-put behaviour", () => {
+    const config = orderedConfig();
+    updateAccountQuota("a", 95);
+    updateAccountQuota("b", 95);
+
+    expect(resolveCodexAccountForThread(null, config)).toBe("b");
+  });
+
+  test("a disabled auto-switch threshold makes ordering strict", () => {
+    const config = orderedConfig({ autoSwitchThreshold: 0 });
+    updateAccountQuota("a", 99);
+    updateAccountQuota("b", 1);
+
+    expect(resolveCodexAccountForThread(null, config)).toBe("a");
+  });
+
+  test("preview and resolve agree under tiering", () => {
+    const config = orderedConfig();
+    updateAccountQuota("a", 70);
+    updateAccountQuota("b", 10);
+
+    expect(previewCodexAccountForRequest(null, config)).toBe("a");
+    expect(resolveCodexAccountForThread(null, config)).toBe("a");
+  });
+
+  test("a manually pinned account outranks selection order", () => {
+    const config = orderedConfig({ activeCodexAccountPinned: "b" } as Partial<OcxConfig>);
+    updateAccountQuota("a", 10);
+    updateAccountQuota("b", 10);
+
+    expect(resolveCodexAccountForThread(null, config)).toBe("b");
+    expect(previewCodexAccountForRequest(null, config)).toBe("b");
+  });
+
+  test("the pin is spent once the pinned account crosses the threshold", () => {
+    const config = orderedConfig({ activeCodexAccountPinned: "b" } as Partial<OcxConfig>);
+    updateAccountQuota("a", 10);
+    updateAccountQuota("b", 90);
+
+    expect(resolveCodexAccountForThread(null, config)).toBe("a");
+    expect(config.activeCodexAccountPinned).toBeUndefined();
+  });
+
+  test("a cooldown on the pinned account hands routing back to selection order", () => {
+    const config = orderedConfig({ activeCodexAccountPinned: "b" } as Partial<OcxConfig>);
+    updateAccountQuota("a", 10);
+    updateAccountQuota("b", 10);
+    recordCodexUpstreamOutcome(config, "b", 429, { retryAfter: "600" });
+
+    expect(resolveCodexAccountForThread(null, config)).toBe("a");
+    expect(config.activeCodexAccountPinned).toBeUndefined();
+  });
+
+  // Preview cannot clear a spent pin, so it has to reach the same account by testing
+  // pin liveness — the case the resolve-side release was built to converge with.
+  test("preview and resolve agree while a drained pin is still stored", () => {
+    const config = orderedConfig({ activeCodexAccountPinned: "b" } as Partial<OcxConfig>);
+    updateAccountQuota("a", 10);
+    updateAccountQuota("b", 90);
+
+    const previewed = previewCodexAccountForRequest(null, config);
+    expect(config.activeCodexAccountPinned).toBe("b");
+    expect(previewed).toBe("a");
+    expect(resolveCodexAccountForThread(null, config)).toBe(previewed);
+    expect(config.activeCodexAccountPinned).toBeUndefined();
+  });
+
+  test("a pinned account holds fill-first on its own tier", () => {
+    const config = orderedConfig({
+      accountPoolStrategy: "fill-first",
+      activeCodexAccountPinned: "b",
+    } as Partial<OcxConfig>);
+    updateAccountQuota("a", 10);
+    updateAccountQuota("b", 10);
+
+    const picks = Array.from({ length: 3 }, () => resolveCodexAccountForThread(null, config));
+    expect(picks).toEqual(["b", "b", "b"]);
+    expect(config.activeCodexAccountPinned).toBe("b");
+  });
+
+  test("fill-first descends to the next tier once the pinned account drains", () => {
+    const config = orderedConfig({
+      accountPoolStrategy: "fill-first",
+      activeCodexAccountPinned: "a",
+    } as Partial<OcxConfig>);
+    updateAccountQuota("a", 10);
+    updateAccountQuota("b", 10);
+    expect(resolveCodexAccountForThread(null, config)).toBe("a");
+
+    updateAccountQuota("a", 90);
+    expect(resolveCodexAccountForThread(null, config)).toBe("b");
+    expect(config.activeCodexAccountPinned).toBeUndefined();
+  });
+
+  test("a 429 on the pinned account releases the pin under round-robin", () => {
+    const config = orderedConfig({
+      accountPoolStrategy: "round-robin",
+      accountPoolStickyLimit: 1,
+      activeCodexAccountPinned: "b",
+    } as Partial<OcxConfig>);
+    updateAccountQuota("a", 10);
+    updateAccountQuota("b", 10);
+    expect(resolveCodexAccountForThread(null, config)).toBe("b");
+
+    recordCodexUpstreamOutcome(config, "b", 429, { retryAfter: "600" });
+
+    expect(config.activeCodexAccountPinned).toBeUndefined();
+    expect(getEffectiveActiveCodexAccountId(config)).toBe("a");
+    // Rotation promotes through the runtime cursor, so the release is in memory only.
+    expect(config.activeCodexAccountId).toBe("b");
+  });
+
+  test("a pin the request never moves off survives in config", () => {
+    const config = orderedConfig({ activeCodexAccountPinned: "b" } as Partial<OcxConfig>);
+    updateAccountQuota("a", 10);
+    updateAccountQuota("b", 10);
+
+    expect(resolveCodexAccountForThread(null, config)).toBe("b");
+    expect(config.activeCodexAccountPinned).toBe("b");
+  });
+
+  test("excluding the pinned account releases the pin", () => {
+    const config = orderedConfig({ activeCodexAccountPinned: "b" } as Partial<OcxConfig>);
+    updateAccountQuota("a", 10);
+    updateAccountQuota("b", 10);
+
+    reconcileCodexActiveAfterExclusion(config, "b");
+    expect(config.activeCodexAccountPinned).toBeUndefined();
+  });
+
+  test("a bound thread keeps its lower-tier account when ordering changes", () => {
+    const config = makeConfig({ activeCodexAccountId: "b" });
+    updateAccountQuota("a", 10);
+    updateAccountQuota("b", 10);
+    expect(resolveCodexAccountForThread("thread-1", config)).toBe("b");
+
+    config.codexAccountPriorities = { a: 1 };
+    expect(resolveCodexAccountForThread("thread-1", config)).toBe("b");
+  });
+
+  test("a bound thread over threshold moves to the highest tier with headroom", () => {
+    const config = makeConfig({ activeCodexAccountId: "b" });
+    updateAccountQuota("a", 10);
+    updateAccountQuota("b", 10);
+    expect(resolveCodexAccountForThread("thread-1", config)).toBe("b");
+
+    config.codexAccountPriorities = { a: 1 };
+    updateAccountQuota("b", 90);
+    expect(resolveCodexAccountForThread("thread-1", config)).toBe("a");
+  });
+
+  test("no stored order leaves the pick sequence untouched", () => {
+    const ordered = makeConfig({ activeCodexAccountId: "b" });
+    updateAccountQuota("a", 5);
+    updateAccountQuota("b", 50);
+
+    expect(resolveCodexAccountForThread(null, ordered)).toBe("b");
+    expect(pickLowestUsageCodexAccount(ordered)).toBe("a");
+  });
+});
diff --git a/tests/config.test.ts b/tests/config.test.ts
index 121eacc937..0f233a52d8 100644
--- a/tests/config.test.ts
+++ b/tests/config.test.ts
@@ -203,6 +203,45 @@ describe("opencodex config defaults", () => {
     });
   });
 
+  // A write must not inherit the read path's degrade-to-undefined: dropping a malformed
+  // map on load leaves the raw entries in the file to be repaired by hand, but dropping
+  // it on a write erases every order the user had set and still reports success.
+  test("config candidates reject a malformed selection-order map instead of erasing it", () => {
+    const base = getDefaultConfig();
+
+    expect(validateConfigCandidate({ ...base, codexAccountPriorities: { work: 2, side: 200 } })).toMatchObject({
+      ok: false,
+      error: expect.stringContaining("codexAccountPriorities"),
+    });
+    expect(validateConfigCandidate({ ...base, codexAccountPriorities: { "bad id!": 1 } })).toMatchObject({
+      ok: false,
+      error: expect.stringContaining("codexAccountPriorities"),
+    });
+    expect(validateConfigCandidate({ ...base, activeCodexAccountPinned: "not a valid id" })).toMatchObject({
+      ok: false,
+      error: expect.stringContaining("activeCodexAccountPinned"),
+    });
+    // A coercing guard lets these through — String(123) matches the id pattern — and the
+    // schema's .catch(undefined) then drops the pin while reporting the write as a success.
+    for (const pin of [123, true, ["work"]]) {
+      expect(validateConfigCandidate({ ...base, activeCodexAccountPinned: pin })).toMatchObject({
+        ok: false,
+        error: expect.stringContaining("activeCodexAccountPinned"),
+      });
+    }
+    expect(validateConfigCandidate({
+      ...base,
+      codexAccountPriorities: { work: 2, __main__: -2 },
+      activeCodexAccountPinned: "work",
+    })).toMatchObject({
+      ok: true,
+      config: expect.objectContaining({
+        codexAccountPriorities: { work: 2, __main__: -2 },
+        activeCodexAccountPinned: "work",
+      }),
+    });
+  });
+
   test("config candidates validate Claude Code subagent effort levels", () => {
     const base = getDefaultConfig();
     for (const subagentEffort of ["low", "medium", "high", "xhigh", "max"]) {
@@ -2098,3 +2137,100 @@ describe("config.ts – async atomic writes preserve symlinked destinations", ()
     expect(existsSync(join(testDir, "gone-async"))).toBe(false);
   });
 });
+
+describe("codex account selection order", () => {
+  function writePriorityConfig(
+    codexAccountPriorities: unknown,
+    overrides: Record<string, unknown> = {},
+  ): void {
+    writeConfig({
+      port: 10100,
+      providers: {
+        openai: {
+          adapter: "openai-responses",
+          baseUrl: "https://chatgpt.com/backend-api/codex",
+          authMode: "forward",
+        },
+      },
+      defaultProvider: "openai",
+      codexAccountPriorities,
+      ...overrides,
+    });
+  }
+
+  test("round-trips pool ids, the main account, and negative order", () => {
+    const priorities = { work: 2, side: 1, __main__: -2 };
+    writePriorityConfig(priorities);
+
+    const diagnostics = readConfigDiagnostics();
+    expect(diagnostics.error).toBeNull();
+    expect(diagnostics.source).toBe("file");
+    expect(diagnostics.config.codexAccountPriorities).toEqual(priorities);
+    expect(Object.hasOwn(getDefaultConfig(), "codexAccountPriorities")).toBe(false);
+  });
+
+  test.each([
+    ["null", null],
+    ["an array", []],
+    ["a string", "work"],
+    ["a fractional value", { work: 1.5 }],
+    ["a stringified number", { work: "2" }],
+    ["a boolean", { work: true }],
+    ["an above-range value", { work: 101 }],
+    ["a below-range value", { work: -101 }],
+    ["a reserved constructor key", { constructor: 1 }],
+    ["a slash in the key", { "work/account": 1 }],
+  ] as const)("degrades %s to no ordering without discarding the rest of the config", (_label, priorities) => {
+    writePriorityConfig(priorities);
+
+    const diagnostics = readConfigDiagnostics();
+    // Selection order is a preference: a malformed map must never trip the
+    // backup-and-defaults repair path that would reset providers.
+    expect(diagnostics.source).toBe("file");
+    expect(diagnostics.error).toBeNull();
+    expect(diagnostics.config.codexAccountPriorities).toBeUndefined();
+    expect(Object.keys(diagnostics.config.providers)).toContain("openai");
+    expect(backupNames()).toHaveLength(0);
+    expect(diagnostics.warnings).toContainEqual(expect.stringContaining("account selection order is disabled"));
+  });
+
+  test("degrades a literal __proto__ entry, which JSON.parse materializes as an own key", () => {
+    writeConfig(
+      '{"port":10100,"providers":{"openai":{"adapter":"openai-responses",'
+      + '"baseUrl":"https://chatgpt.com/backend-api/codex","authMode":"forward"}},'
+      + '"defaultProvider":"openai","codexAccountPriorities":{"__proto__":1,"work":2}}',
+    );
+
+    const diagnostics = readConfigDiagnostics();
+    expect(diagnostics.source).toBe("file");
+    expect(diagnostics.config.codexAccountPriorities).toBeUndefined();
+    expect(Object.keys(diagnostics.config.providers)).toContain("openai");
+    expect(diagnostics.warnings).toContainEqual(expect.stringContaining("account selection order is disabled"));
+  });
+
+  test("warns when load degrades a malformed selection-order map", () => {
+    writePriorityConfig({ work: 101 });
+    const warnSpy = spyOn(console, "warn").mockImplementation(() => {});
+
+    try {
+      const loaded = loadConfig();
+      expect(loaded.codexAccountPriorities).toBeUndefined();
+      expect(warnSpy).toHaveBeenCalledWith(expect.stringContaining("account selection order is disabled"));
+      expect(backupNames()).toHaveLength(0);
+    } finally {
+      warnSpy.mockRestore();
+    }
+  });
+
+  test("keeps a valid pin and degrades a malformed one", () => {
+    writePriorityConfig({ work: 1 }, { activeCodexAccountPinned: "work" });
+    expect(readConfigDiagnostics().config.activeCodexAccountPinned).toBe("work");
+
+    writePriorityConfig({ work: 1 }, { activeCodexAccountPinned: "work/account" });
+    const degraded = readConfigDiagnostics();
+    expect(degraded.source).toBe("file");
+    expect(degraded.config.activeCodexAccountPinned).toBeUndefined();
+    expect(degraded.config.codexAccountPriorities).toEqual({ work: 1 });
+    expect(degraded.warnings).toContainEqual(expect.stringContaining("no longer pinned"));
+  });
+});