fix(codex): drop expired non-blocking quota evidence

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bitkyc08/opencodex",
-  "version": "2.53.0",
+  "version": "2.52.0",
   "description": "Universal provider proxy for OpenAI Codex & Claude Code — use any LLM with Codex CLI/App/SDK and Claude Code",
   "type": "module",
   "main": "./bin/package-main.mjs",

src/codex/main-account-hard-lock.ts

@@ -1,7 +1,7 @@
 import type { OcxConfig } from "../types";
 import { getMainPolicyQuota } from "./quota";
-
-export const MAIN_ACCOUNT_HARD_LOCK_PERCENT = 99;
+export { MAIN_ACCOUNT_HARD_LOCK_PERCENT } from "./quota-types";
+import { MAIN_ACCOUNT_HARD_LOCK_PERCENT } from "./quota-types";
 
 export interface MainAccountHardLockStatus {
   enabled: boolean;

src/codex/quota-types.ts

@@ -1,4 +1,6 @@
 /** Quota wire/storage shapes. This leaf must not import credential or config owners. */
+export const MAIN_ACCOUNT_HARD_LOCK_PERCENT = 99;
+
 export type StoredAccountQuota = {
   weeklyPercent?: number;
   monthlyPercent?: number;

src/codex/quota.ts

@@ -6,7 +6,7 @@ import { isThirtyDayOnlyCodexPlan } from "./plan";
 import { MAIN_CODEX_ACCOUNT_ID } from "./account-id";
 import { getObservedMainQuotaIdentityKey, isMainQuotaWriterLive, type MainQuotaWriter } from "./main-account-cache";
 
-import type { StoredAccountQuota, WhamUsageResponse, WhamUsageWindow } from "./quota-types";
+import { MAIN_ACCOUNT_HARD_LOCK_PERCENT, type StoredAccountQuota, type WhamUsageResponse, type WhamUsageWindow } from "./quota-types";
 export type { StoredAccountQuota, WhamUsageResponse } from "./quota-types";
 
 /** Disk snapshot under OPENCODEX_HOME — quota and policy identity only, never credential tags. */
@@ -142,7 +142,7 @@ export function isCompleteCodexQuotaRecoverySnapshot(
   return quota.monthlyIsPrimaryWindow === true && finitePercent(quota.monthlyPercent);
 }
 
-function finitePercent(value: number | undefined): boolean {
+function finitePercent(value: number | undefined): value is number {
   return typeof value === "number" && Number.isFinite(value);
 }
 
@@ -241,14 +241,19 @@ function shortResetHasElapsed(resetAt: number | undefined, now: number): boolean
   return resetAtToMs(resetAt) <= now;
 }
 
-/** Display/rotation carry expires; a reset clock cannot retract hard-lock evidence. */
+/** Display/rotation carry expires; a reset clock cannot retract blocking hard-lock evidence. */
 function assignCarriedShort(
   next: StoredAccountQuota,
   existing: StoredAccountQuota | undefined,
   now: number,
   policyEvidence = false,
 ): void {
-  if (!existing || (!policyEvidence && shortResetHasElapsed(existing.shortResetAt, now))) return;
+  if (!existing) return;
+  const existingShortPercent = existing.shortPercent;
+  const preserveBlockingEvidence = policyEvidence
+    && finitePercent(existingShortPercent)
+    && existingShortPercent >= MAIN_ACCOUNT_HARD_LOCK_PERCENT;
+  if (!preserveBlockingEvidence && shortResetHasElapsed(existing.shortResetAt, now)) return;
   if (existing.shortPercent !== undefined) next.shortPercent = existing.shortPercent;
   if (existing.shortObservedAt !== undefined) next.shortObservedAt = existing.shortObservedAt;
   if (existing.shortResetAt !== undefined) next.shortResetAt = existing.shortResetAt;
@@ -349,7 +354,11 @@ function mergeAccountQuota(
     if (existing.monthlyIsPrimaryWindow === true) next.monthlyIsPrimaryWindow = true;
   }
 
-  const preserveKnownShort = policyEvidence && quota.shortPercent === undefined && finitePercent(existing?.shortPercent);
+  const existingShortPercent = existing?.shortPercent;
+  const preserveKnownShort = policyEvidence
+    && quota.shortPercent === undefined
+    && finitePercent(existingShortPercent)
+    && existingShortPercent >= MAIN_ACCOUNT_HARD_LOCK_PERCENT;
   if (snapshotHasShort(quota) && !preserveKnownShort) {
     if (quota.shortPercent !== undefined) {
       next.shortPercent = quota.shortPercent;

structure/catalog.md

@@ -262,7 +262,7 @@ provider wire mapping; unpinned native requests retain their existing pass-throu
 
 > Decision record: [ADR-0026](decisions/ADR-0026-ultra-reasoning-level.md)
 
-Codex display-cache expiry, retained main-policy evidence, and reset history follow the
+Codex display-cache expiry, retained blocking main-policy evidence, and reset history follow the
 [quota cache contract](providers/openai-tiers.md#quota-cache-and-short-window-history).
 
 Chat helper admission in `src/server/responses/core.ts` follows the

structure/codex-home.md

@@ -224,7 +224,7 @@ a deliberate user choice:
   (`src/codex/project-config-warnings.ts`), surfaced by `ocx doctor` as a warning rather than an
   override.
 
-Codex display-cache expiry, retained main-policy evidence, and reset history follow the
+Codex display-cache expiry, retained blocking main-policy evidence, and reset history follow the
 [quota cache contract](providers/openai-tiers.md#quota-cache-and-short-window-history).
 
 ## Paginated history writer boundary

structure/config.md

@@ -193,7 +193,7 @@ the residual directory for manual review; there is no recursive-delete fallback.
 
 Client connection metadata stores a stable `apiKeyId` and a non-secret rotation `pendingOperation`. The current data secret remains only in `service-api-token`; a bounded rotation temporarily keeps the old secret in owner-only `service-api-token.prev`. Commit or recovery clears the marker before orphan cleanup. `ocx disconnect` is local-only and leaves remote revocation to the hub's **Integrations → API Keys** page. Hub and local usage stores are not mirrored.
 
-Codex display-cache expiry, retained main-policy evidence, and reset history follow the
+Codex display-cache expiry, retained blocking main-policy evidence, and reset history follow the
 [quota cache contract](providers/openai-tiers.md#quota-cache-and-short-window-history).
 
 ## Paginated history writer boundary

structure/gui-and-management-api.md

@@ -285,7 +285,7 @@ and catalog invariants documented in this folder rather than inventing parallel
 Codex quota cards consume the display cache from `src/codex/quota.ts`. A partial refresh
 removes an omitted short tuple whose reset deadline has elapsed, so a stale Spark-derived
 5h row does not persist on a weekly-only account. This is independent of the main-account
-hard-lock evidence and reset-notification history; their retention rules are documented in
+blocking hard-lock evidence and reset-notification history; their retention rules are documented in
 [OpenAI account modes](providers/openai-tiers.md#quota-cache-and-short-window-history).
 
 ## Dashboard surfaces

structure/ops/docs-and-release.md

@@ -301,7 +301,7 @@ This keeps release runs short and makes release a deployment of a verified commi
 
 The Remote Hub guide and affected CLI, server-config, management-API, and dashboard references have eight sources: root English plus `fr`, `ko`, `zh-cn`, `zh-tw`, `ru`, `ja`, and `tr`. English is canonical; commands, defaults, endpoint auth, and warnings remain exact in translations. A release requires the remote-only focused/full gates, privacy scan, GUI/docs builds, protocol compatibility receipts, and the MAINTAINERS security review for the exact head.
 
-Codex display-cache expiry, retained main-policy evidence, and reset history follow the
+Codex display-cache expiry, retained blocking main-policy evidence, and reset history follow the
 [quota cache contract](../providers/openai-tiers.md#quota-cache-and-short-window-history).
 
 The Combo guides describe the distinction between display quota and single-credential inference evidence used by routing. See [scoped provider quota](../runtime.md#scoped-provider-quota-for-combo-selection).

structure/providers/openai-tiers.md

@@ -186,9 +186,11 @@ future or missing deadlines remain carried, and explicit incoming short readings
 This stops partial weekly/Spark or credits-only refreshes from renewing obsolete Spark-derived
 5h rows through the cache-wide `updatedAt` timestamp. Plan labels do not suppress real windows.
 
-The separately retained main-policy snapshot preserves omitted short evidence even after its
-reset clock passes. Credits-only, weekly-only, and metadata-only updates cannot remove an
-existing short usage reading or release its hard lock; a fresh short reading can replace it.
+The separately retained main-policy snapshot preserves omitted blocking short evidence even after
+its reset clock passes. Credits-only, weekly-only, and metadata-only updates cannot remove an
+existing blocking short usage reading or release its hard lock; a fresh short reading can replace
+it. Expired non-blocking short evidence is dropped, so it cannot take priority over a fresh blocking
+weekly reading.
 
 The Codex writer explicitly asks `src/quota/reset-observer.ts` to retain an absent short window
 in `src/quota/reset-seen-store.ts`, with its original observation time. Detection compares only

structure/runtime.md

@@ -194,7 +194,7 @@ Routed Responses continuations whose local replay state is missing resolve their
 
 `src/remote/protocol.ts` owns pure interval/feature negotiation. `src/remote/hub-state.ts` owns the `GET|HEAD /v1/hub-state` contract, its caps, and the parser both sides share. `src/client/hub-client.ts` owns bounded, schema-validated remote catalog consumption, hub-state reads, and key-id probes; `src/client/hub-state.ts` owns the resolution and the owner-stamped 0600 cache, and a failed read reports "unavailable" rather than degrading to the client's own local provider and login state. `src/client/hub-relay.ts` is a fixed-authority management relay with URL, header, body, redirect, and stream bounds. The public data listener remains the direct client→hub path; the loopback management ingress never serves data-plane routes.
 
-Codex display-cache expiry, retained main-policy evidence, and reset history follow the
+Codex display-cache expiry, retained blocking main-policy evidence, and reset history follow the
 [quota cache contract](providers/openai-tiers.md#quota-cache-and-short-window-history).
 
 Chat helper admission in `src/server/responses/core.ts` follows the

structure/subagents.md

@@ -196,7 +196,7 @@ It orders routed output groups after alias deduplication, preserving the collisi
 base/1M/Fast siblings. Native groups and explicit Desktop profile ownership are unchanged.
 Native Codex advertisements still follow display priority; private guidance ranks do not freeze them.
 
-Codex display-cache expiry, retained main-policy evidence, and reset history follow the
+Codex display-cache expiry, retained blocking main-policy evidence, and reset history follow the
 [quota cache contract](providers/openai-tiers.md#quota-cache-and-short-window-history).
 
 Chat helper admission in `src/server/responses/core.ts` follows the

tests/codex-integration/main-account-hard-lock-policy.test.ts

@@ -89,6 +89,19 @@ describe("identity-bound main-account hard-lock policy", () => {
     expect(getMainAccountHardLockStatus(enabled).state).toBe("ready");
   });
 
+  test("an expired non-blocking short reading cannot hide a fresh weekly block", () => {
+    const elapsed = Math.floor(Date.now() / 1000) - 60;
+    observe({ shortPercent: 4, shortWindowSeconds: 18_000, shortResetAt: elapsed, weeklyPercent: 20 });
+
+    observe({ weeklyPercent: 99 });
+
+    expect(getMainPolicyQuota()).toMatchObject({ weeklyPercent: 99 });
+    expect(getMainPolicyQuota()?.shortPercent).toBeUndefined();
+    expect(getMainPolicyQuota()?.shortResetAt).toBeUndefined();
+    expect(getMainPolicyQuota()?.shortWindowSeconds).toBeUndefined();
+    expect(getMainAccountHardLockStatus(enabled).state).toBe("blocked");
+  });
+
   test("one missing reset prevents a false scheduled-unlock promise", () => {
     observe({ weeklyPercent: 99, monthlyPercent: 99, monthlyResetAt: now + 60_000 });
     expect(getMainAccountHardLockStatus(enabled, now)).toEqual({ enabled: true, state: "blocked" });