[codex] Make automatic reset reconciliation fail closed

[0thernet]

Summary

This change adds a durable, fail-closed reconciliation policy around automatic weekly Codex rate-limit resets.

• Existing signed-in profiles migrate into reconciliation_required before recovery, connection, polling, or notifications can dispatch a reset.
• The first fresh, double-verified 10,080-minute window binds the privacy-safe account fingerprint and reset boundary, then remains suppressed for that entire window.
• Only a strictly later fresh window for the same identity activates ordinary automation. Boundary wobble, stale or malformed windows, identity drift, storage failure, and ambiguous authority remain blocked.
• Identity changes return the profile to pending reconciliation and close old-identity recoverable attempts without fabricating outcomes or duplicate idempotency keys.
• Legitimate same-key ambiguous recovery remains possible only after policy activation in a later valid window.
• CLI status rendering and focused storage/service coverage make the durable policy observable.

Why

The existing automatic reset path could observe live usage immediately after a schema migration without first establishing whether that account and weekly window were safe to automate. A migrated profile near its limit with an available credit therefore needed an explicit durable reconciliation boundary before any reset preparation, recovery, or provider effect.

The risk also spans restarts and identity changes. In-memory suppression would not survive a crash, and treating an old prepared or ambiguous attempt as current could redispatch an effect under the wrong identity or window. The policy is persisted transactionally and checked at the sole automatic-reset dispatch seam before any effect authority is obtained.

Validation

• Bun 1.3.14 frozen install with lifecycle scripts disabled: 218 packages, no manifest or tracked-source drift.
• Exact focused reconciliation suite: 12 passed, 0 failed, 271 filtered, 140 assertions.
• The focused suite covered boundary-time suppression, identity drift, schema-24 migration at 99% usage with one credit, restart and notification paths, and same-key recovery after later activation.
• git diff --check passed for both the corrective commit and the complete PR diff.
• No daemon, real database, provider, account, credential, reset, restart, deployment, or broad repository gate was invoked.

Delivery guards

• Base branch: main
• Exact reviewed base: a5b36405bd52f99596e6187b7810f9b3c7e7d1de
• Exact pushed head: 7eaa064
• Corrective four-file diff SHA-256: 3f18cdec95f55d6c9c4dfc6943b72e89a4303f3692ab3f910ee5ca9e2cd339d4

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
hra	Ready	Preview	Aug 30, 2026 7:18pm