diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
index 2f0e3effa..390a01c99 100644
--- a/.github/pull_request_template.md
+++ b/.github/pull_request_template.md
@@ -8,11 +8,11 @@
 
 ## Validation
 
-- [ ] `npm run lint`
-- [ ] `npm run typecheck`
-- [ ] `npm test`
+- [ ] `npm run verify`
 - [ ] `npm test -- test/documentation.test.ts`
-- [ ] `npm run build`
+- [ ] if triaging failures, validated component gates: `npm run lint`, `npm run verify:repo`, `npm run verify:quality`, `npm run typecheck`, `npm test`, `npm run build`
+- [ ] `npm run doctor:dev` (when troubleshooting setup/environment issues)
+- [ ] `npm run setup:dev` (for first-clone reproducibility checks)
 
 ## Docs and Governance Checklist
 
diff --git a/.github/settings.yml b/.github/settings.yml
new file mode 100644
index 000000000..c3a0d1243
--- /dev/null
+++ b/.github/settings.yml
@@ -0,0 +1,23 @@
+branches:
+  - name: main
+    protection:
+      required_pull_request_reviews:
+        required_approving_review_count: 1
+        require_code_owner_reviews: false
+        dismiss_stale_reviews: true
+      required_status_checks:
+        strict: true
+        checks:
+          - context: "CI / Test on Node.js 20.x"
+          - context: "CI / Test on Node.js 22.x"
+          - context: "CI / Coverage Gate"
+          - context: "CI / Lint"
+          - context: "CI / Codex Compatibility Smoke"
+          - context: "CI / Cross-Platform Smoke (windows-latest)"
+          - context: "CI / Cross-Platform Smoke (macos-latest)"
+          - context: "CodeQL / Analyze"
+          - context: "Secret Scan / Gitleaks"
+          - context: "Supply Chain / Dependency Review"
+          - context: "Supply Chain / SCA and License Gate"
+      enforce_admins: true
+      restrictions: null
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e3c4f0b99..5e03c3b2b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -2,18 +2,28 @@ name: CI
 
 on:
   push:
-    branches: [main]
+    branches: [main, dev]
   pull_request:
-    branches: [main]
+    branches: [main, dev]
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
 jobs:
   test:
-    name: Test on Node.js ${{ matrix.node-version }}
-    runs-on: ubuntu-latest
+    name: Test on Node.js ${{ matrix.node-version }} (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 30
 
     strategy:
+      fail-fast: false
       matrix:
         node-version: [20.x, 22.x]
+        os: [ubuntu-latest]
+        include:
+          - node-version: 20.x
+            os: windows-latest
 
     steps:
       - name: Checkout code
@@ -23,37 +33,42 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: ${{ matrix.node-version }}
-          cache: 'npm'
+          cache: npm
 
       - name: Install dependencies
         run: npm ci
 
-      - name: Repository hygiene check
-        run: npm run clean:repo:check
-
-      - name: Security audit (CI policy)
-        run: npm run audit:ci
-
-      - name: Lockfile floor guard
-        run: npm run test -- test/lockfile-version-floor.test.ts
+      - name: Run CI verify pipeline
+        run: npm run verify:ci
 
       - name: Security audit (full dependency tree, non-blocking)
         continue-on-error: true
         run: npm run audit:all
 
-      - name: Run type check
-        run: npm run typecheck
+      - name: Generate and verify SBOM
+        run: |
+          npm run sbom:generate
+          npm run sbom:verify
 
-      - name: Run tests with coverage
-        run: npm run coverage
+      - name: Assert keychain mode storage contract
+        run: npm run ops:keychain-assert
 
-      - name: Build
-        run: npm run build
+      - name: Seed enterprise health fixture
+        run: |
+          node scripts/seed-health-fixture.js
+
+      - name: Enterprise health check
+        env:
+          CODEX_MULTI_AUTH_DIR: ${{ github.workspace }}/.tmp/health-fixture
+        run: npm run ops:health-check -- --require-files
+
+      - name: Performance budget check
+        run: npm run perf:budget-check
 
   lint:
     name: Lint
-
     runs-on: ubuntu-latest
+    timeout-minutes: 20
 
     steps:
       - name: Checkout code
@@ -63,17 +78,21 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: 20.x
-          cache: 'npm'
+          cache: npm
 
       - name: Install dependencies
         run: npm ci
 
-      - name: Run ESLint
+      - name: Dev doctor sanity check
+        run: npm run doctor:dev
+
+      - name: Run lint and format checks
         run: npm run lint
 
   codex-compat:
     name: Codex Compatibility Smoke
     runs-on: ubuntu-latest
+    timeout-minutes: 20
 
     steps:
       - name: Checkout code
@@ -83,10 +102,41 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: 20.x
-          cache: 'npm'
+          cache: npm
 
       - name: Install dependencies
         run: npm ci
 
       - name: Run Codex compatibility tests
         run: npm run test -- test/codex.test.ts test/host-codex-prompt.test.ts test/request-transformer.test.ts test/fetch-helpers.test.ts
+
+  cross-platform-smoke:
+    name: Cross-Platform Smoke (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [windows-latest, macos-latest]
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20.x
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Run smoke typecheck
+        run: npm run typecheck
+
+      - name: Build
+        run: npm run build
+
+      - name: Run smoke tests
+        run: npm run test -- test/runtime-paths.test.ts test/codex-bin-wrapper.test.ts test/file-lock.test.ts test/background-jobs.test.ts
diff --git a/.github/workflows/recovery-drill.yml b/.github/workflows/recovery-drill.yml
new file mode 100644
index 000000000..e74ec2905
--- /dev/null
+++ b/.github/workflows/recovery-drill.yml
@@ -0,0 +1,69 @@
+name: Recovery Drill
+
+on:
+  schedule:
+    - cron: "30 3 1 * *"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  recovery-drill:
+    name: Monthly Storage Recovery Drill
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    concurrency:
+      group: ${{ github.workflow }}-${{ github.ref }}
+      cancel-in-progress: false
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20.x
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build
+        run: npm run build
+
+      - name: Run recovery drill tests
+        run: |
+          mkdir -p .tmp
+          npm run ops:recovery-drill -- --reporter=default --reporter=json --outputFile=.tmp/recovery-drill-vitest.json
+
+      - name: Run health check snapshot
+        run: node scripts/enterprise-health-check.js > .tmp/recovery-drill-health.json 2>&1
+
+      - name: Upload recovery drill artifacts
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: recovery-drill-artifacts
+          path: |
+            .tmp/recovery-drill-vitest.json
+            .tmp/recovery-drill-health.json
+
+      - name: Notify recovery drill failure
+        if: failure()
+        env:
+          RECOVERY_DRILL_WEBHOOK_URL: ${{ secrets.RECOVERY_DRILL_WEBHOOK_URL }}
+          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        run: |
+          message="Recovery drill failed. Run: ${RUN_URL}. Artifacts: .tmp/recovery-drill-vitest.json and .tmp/recovery-drill-health.json."
+          if [[ -n "${RECOVERY_DRILL_WEBHOOK_URL:-}" ]]; then
+            payload=$(jq -n --arg msg "${message}" '{"text": $msg}')
+            curl --fail --silent --show-error \
+              --max-time 30 \
+              -X POST \
+              -H "Content-Type: application/json" \
+              --data "${payload}" \
+              "${RECOVERY_DRILL_WEBHOOK_URL}"
+          else
+            echo "::warning::${message} Configure secrets.RECOVERY_DRILL_WEBHOOK_URL for push notifications."
+          fi
diff --git a/.github/workflows/release-provenance.yml b/.github/workflows/release-provenance.yml
new file mode 100644
index 000000000..abcbed9da
--- /dev/null
+++ b/.github/workflows/release-provenance.yml
@@ -0,0 +1,59 @@
+name: Release Publish (Provenance)
+
+on:
+  workflow_dispatch:
+  release:
+    types: [published]
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  publish:
+    name: Publish with npm provenance
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20.x
+          registry-url: https://registry.npmjs.org
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Validate quality gates
+        env:
+          CODEX_MULTI_AUTH_DIR: ${{ github.workspace }}/.tmp/health-fixture
+        run: |
+          mkdir -p "${GITHUB_WORKSPACE}/.tmp/health-fixture/logs"
+          printf '{"version":3,"accounts":[],"activeIndex":0}\n' > "${GITHUB_WORKSPACE}/.tmp/health-fixture/openai-codex-accounts.json"
+          printf '{"version":1,"pluginConfig":{},"dashboardDisplaySettings":{}}\n' > "${GITHUB_WORKSPACE}/.tmp/health-fixture/settings.json"
+          printf '{"timestamp":"%s","action":"request.start","outcome":"success"}\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ)" > "${GITHUB_WORKSPACE}/.tmp/health-fixture/logs/audit.log"
+          npm run audit:ci
+          npm run ops:health-check -- --require-files
+          npm run perf:budget-check
+          npm run lint
+          npm run typecheck
+          npm run build
+          npm test
+          npm run ops:keychain-assert
+          npm run sbom:generate
+          npm run sbom:verify
+          node scripts/compliance-evidence-bundle.js --profile=quick --out-dir=.tmp/compliance-evidence-release
+
+      - name: Upload release evidence bundle
+        uses: actions/upload-artifact@v4
+        with:
+          name: release-evidence-bundle
+          path: .tmp/compliance-evidence-release
+
+      - name: Publish package with provenance
+        run: npm publish --provenance --access public
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
diff --git a/.github/workflows/retention-maintenance.yml b/.github/workflows/retention-maintenance.yml
new file mode 100644
index 000000000..aefa0ad94
--- /dev/null
+++ b/.github/workflows/retention-maintenance.yml
@@ -0,0 +1,48 @@
+name: Retention Maintenance
+
+on:
+  schedule:
+    - cron: "15 2 * * 0"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  retention:
+    name: Weekly Retention Cleanup Drill
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set retention root
+        run: echo "CODEX_MULTI_AUTH_DIR=${{ runner.temp }}/codex-retention-root" >> "$GITHUB_ENV"
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20.x
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Prepare retention fixture
+        run: |
+          node -e "const fs=require('fs'); const path=require('path'); const root=process.env.CODEX_MULTI_AUTH_DIR; const logs=path.join(root,'logs','codex-plugin'); const cache=path.join(root,'cache'); const recovery=path.join(root,'recovery'); fs.mkdirSync(logs,{recursive:true}); fs.mkdirSync(cache,{recursive:true}); fs.mkdirSync(recovery,{recursive:true}); const oldFile=path.join(logs,'old-audit.log'); const newFile=path.join(cache,'fresh-cache.json'); fs.writeFileSync(oldFile,'old'); fs.writeFileSync(newFile,'new'); const oldTime=new Date(Date.now()-120*24*60*60*1000); fs.utimesSync(oldFile,oldTime,oldTime);"
+
+      - name: Run retention cleanup
+        run: |
+          mkdir -p .tmp
+          node scripts/retention-cleanup.js --days=90 > .tmp/retention-report.json
+
+      - name: Verify retention fixture cleanup
+        run: |
+          node -e "const fs=require('fs'); const path=require('path'); const root=process.env.CODEX_MULTI_AUTH_DIR; const oldFile=path.join(root,'logs','codex-plugin','old-audit.log'); const newFile=path.join(root,'cache','fresh-cache.json'); if(fs.existsSync(oldFile)){console.error('expected old file to be deleted'); process.exit(1);} if(!fs.existsSync(newFile)){console.error('expected fresh file to remain'); process.exit(1);} console.log('retention verification passed');"
+
+      - name: Upload retention report
+        uses: actions/upload-artifact@v4
+        with:
+          name: retention-maintenance-report
+          path: .tmp/retention-report.json
diff --git a/.github/workflows/sbom-attestation.yml b/.github/workflows/sbom-attestation.yml
new file mode 100644
index 000000000..e0db3e129
--- /dev/null
+++ b/.github/workflows/sbom-attestation.yml
@@ -0,0 +1,48 @@
+name: SBOM and Dependency Attestation
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  id-token: write
+  attestations: write
+
+jobs:
+  sbom:
+    name: Generate SBOM
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20.x
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Generate SBOM
+        run: npm run sbom:generate
+
+      - name: Verify SBOM
+        run: npm run sbom:verify
+
+      - name: Upload SBOM artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: sbom-cyclonedx
+          path: .tmp/sbom.cdx.json
+
+      - name: Attest SBOM provenance
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        uses: actions/attest-build-provenance@v2
+        with:
+          subject-path: .tmp/sbom.cdx.json
diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml
new file mode 100644
index 000000000..82b9c8fcc
--- /dev/null
+++ b/.github/workflows/secret-scan.yml
@@ -0,0 +1,41 @@
+name: Secret Scan
+
+on:
+  pull_request:
+    branches: [main, dev]
+  push:
+    branches: [main, dev]
+  schedule:
+    - cron: "0 5 * * 1"
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  gitleaks:
+    name: Gitleaks
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+        with:
+          fetch-depth: 0
+
+      - name: Run gitleaks
+        uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITLEAKS_VERSION: "8.25.0"
+          GITLEAKS_CONFIG: .gitleaks.toml
+
+      - name: Verify secret-scan policy regression
+        run: bash scripts/secret-scan-regression.sh
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          EXPECTED_GITLEAKS_VERSION: v8.25.0
+          GITLEAKS_CONFIG: .gitleaks.toml
diff --git a/.github/workflows/supply-chain.yml b/.github/workflows/supply-chain.yml
new file mode 100644
index 000000000..5a461d62a
--- /dev/null
+++ b/.github/workflows/supply-chain.yml
@@ -0,0 +1,81 @@
+name: Supply Chain
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+  schedule:
+    - cron: "0 4 * * 1"
+
+env:
+  CODEX_LICENSE_DENYLIST: "GPL-2.0,GPL-3.0,AGPL-3.0"
+
+jobs:
+  dependency-review:
+    name: Dependency Review
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Dependency review
+        uses: actions/dependency-review-action@v4
+        with:
+          fail-on-severity: high
+          fail-on-scopes: runtime
+          deny-licenses: ${{ env.CODEX_LICENSE_DENYLIST }}
+
+  sca-and-license:
+    name: SCA and License Gate
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20.x
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Run vulnerability policy gate
+        run: npm run audit:ci
+
+      - name: Run license policy gate
+        run: npm run license:check
+
+  sbom:
+    name: Generate SBOM
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20.x
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Generate CycloneDX SBOM
+        run: npm run sbom
+
+      - name: Upload SBOM artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: sbom-cyclonedx
+          path: sbom.cdx.json
diff --git a/.gitleaks.toml b/.gitleaks.toml
new file mode 100644
index 000000000..be20b3bb8
--- /dev/null
+++ b/.gitleaks.toml
@@ -0,0 +1,19 @@
+title = "codex-multi-auth gitleaks config"
+
+[extend]
+useDefault = true
+
+[[allowlists]]
+description = "Allowlisted fixture/docs synthetic credentials only"
+condition = "AND"
+paths = [
+  '''^test[\\/]security[\\/]fixtures[\\/]''',
+  '''^docs[\\/]releases[\\/]''',
+  '''^docs[\\/]development[\\/]DEEP_AUDIT_2026-03-01\.md$'''
+]
+regexes = [
+  '''fake_refresh_token_[0-9]+''',
+  '''secret-(access|refresh)-token''',
+  '''top secret prompt''',
+  '''sk-test-[A-Za-z0-9]{16,}'''
+]
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index dc5ebbcd7..387c4435f 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -22,15 +22,21 @@ If a proposal conflicts with OpenAI policy boundaries, it will be declined.
 ## Local Setup
 
 ```bash
-npm ci
-npm run typecheck
-npm run lint
-npm test
-npm run build
+npm run setup:dev
+npm run verify
 ```
 
 Node requirement: `>=18`.
 
+`npm run verify` runs the full local gate: `npm run lint`, `npm run verify:repo`, and
+`npm run verify:quality` (`npm run typecheck` + `npm run coverage`, where coverage already
+runs `npm run build`).
+
+Supporting commands:
+
+- `npm run doctor:dev` for prerequisite and repo-shape checks
+- `npm run format` to apply Biome formatting for repo config files
+
 ---
 
 ## Development Standards
@@ -56,10 +62,16 @@ Documentation requirements for behavior changes:
 1. Create a focused branch from `main`.
 2. Keep commits atomic and reviewable.
 3. Run full local gate:
-   - `npm run typecheck`
-   - `npm run lint`
-   - `npm test`
-   - `npm run build`
+   - `npm run verify`
+   - `npm run test -- test/documentation.test.ts`
+   - if triaging failures, run component gates directly:
+     - `npm run lint`
+     - `npm run verify:repo`
+     - `npm run verify:quality`
+     - `npm run typecheck`
+     - `npm test`
+     - `npm run build`
+   - if troubleshooting setup or first-clone reproducibility, run `npm run doctor:dev` and `npm run setup:dev`
 4. Include command output evidence in the PR description.
 5. Document behavior changes and migration notes when needed.
 6. Ensure no secrets or local runtime data are committed.
@@ -116,4 +128,4 @@ Unacceptable behavior:
 
 ## License
 
-By contributing, you agree contributions are licensed under the project license in [LICENSE](LICENSE).
\ No newline at end of file
+By contributing, you agree contributions are licensed under the project license in [LICENSE](LICENSE).
diff --git a/README.md b/README.md
index e254c6a65..a723df249 100644
--- a/README.md
+++ b/README.md
@@ -93,6 +93,28 @@ codex auth check
 
 ---
 
+## Local Development (Contributors)
+
+From repo root:
+
+```bash
+npm run setup:dev
+```
+
+Daily validation:
+
+```bash
+npm run doctor:dev
+npm run verify
+```
+
+- `doctor:dev` validates local prerequisites and required project files.
+- `setup:dev` runs install plus the local validation gate.
+- `verify` is the canonical local and CI gate.
+- `format` applies Biome formatting for repo config files (JSON/JSONC/YAML).
+
+---
+
 ## Quick Start
 
 ```bash
@@ -128,6 +150,7 @@ codex auth doctor --fix
 | `codex auth fix --dry-run` | Preview safe repairs |
 | `codex auth fix --live --model gpt-5-codex` | Run repairs with live probe model |
 | `codex auth doctor --fix` | Diagnose and apply safe fixes |
+| `codex auth rotate-secrets --json --idempotency-key <run-id>` | Re-encrypt stored secrets with safe retry semantics for automation |
 
 ---
 
@@ -186,6 +209,7 @@ Selected runtime/environment overrides:
 | `CODEX_TUI_V2=0/1` | Disable/enable TUI v2 |
 | `CODEX_TUI_COLOR_PROFILE=truecolor|ansi256|ansi16` | TUI color profile |
 | `CODEX_TUI_GLYPHS=ascii|unicode|auto` | TUI glyph style |
+| `CODEX_SECRET_STORAGE_MODE` | Token-at-rest backend selection: `keychain`, `plaintext`, or `auto` (`keychain` default; set explicit `keychain` in enterprise deployments) |
 | `CODEX_AUTH_FETCH_TIMEOUT_MS=<ms>` | Request timeout override |
 | `CODEX_AUTH_STREAM_STALL_TIMEOUT_MS=<ms>` | Stream stall timeout override |
 
diff --git a/SECURITY.md b/SECURITY.md
index 7d7068856..4fff02e27 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -84,6 +84,10 @@ Before release and after dependency changes:
 
 ```bash
 npm run audit:ci
+npm run ops:health-check
+npm run perf:budget-check
+npm run sbom:generate
+npm run sbom:verify
 npm run lint
 npm run typecheck
 npm test
diff --git a/biome.jsonc b/biome.jsonc
index 71ef6c65e..f670f6576 100644
--- a/biome.jsonc
+++ b/biome.jsonc
@@ -6,7 +6,16 @@
 		"useIgnoreFile": true
 	},
 	"files": {
-		"includes": ["**", "!!**/dist"]
+		"includes": [
+			"package.json",
+			"biome.jsonc",
+			".github/**/*.yml",
+			".github/**/*.yaml",
+			"!!dist/**",
+			"!!coverage/**",
+			"!!node_modules/**",
+			"!!vendor/**"
+		]
 	},
 	"formatter": {
 		"enabled": true,
diff --git a/config/performance-budgets.json b/config/performance-budgets.json
new file mode 100644
index 000000000..c6a81a6ce
--- /dev/null
+++ b/config/performance-budgets.json
@@ -0,0 +1,9 @@
+{
+  "filterInput_small": 2.0,
+  "filterInput_large": 10.0,
+  "cleanupToolDefinitions_medium": 10.0,
+  "cleanupToolDefinitions_large": 20.0,
+  "accountHybridSelection_200": 30.0,
+  "resolveRequestAccountId_1000": 3.0,
+  "normalizeAccountStorage_240": 20.0
+}
diff --git a/config/performance-budgets.schema.json b/config/performance-budgets.schema.json
new file mode 100644
index 000000000..c2e13b822
--- /dev/null
+++ b/config/performance-budgets.schema.json
@@ -0,0 +1,53 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "Runtime Performance Budgets",
+  "description": "Performance budget thresholds for runtime path benchmarks. All values are milliseconds.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "filterInput_small",
+    "filterInput_large",
+    "cleanupToolDefinitions_medium",
+    "cleanupToolDefinitions_large",
+    "accountHybridSelection_200",
+    "resolveRequestAccountId_1000",
+    "normalizeAccountStorage_240"
+  ],
+  "properties": {
+    "filterInput_small": {
+      "type": "number",
+      "minimum": 0,
+      "description": "Maximum average runtime in milliseconds for small filterInput benchmark."
+    },
+    "filterInput_large": {
+      "type": "number",
+      "minimum": 0,
+      "description": "Maximum average runtime in milliseconds for large filterInput benchmark."
+    },
+    "cleanupToolDefinitions_medium": {
+      "type": "number",
+      "minimum": 0,
+      "description": "Maximum average runtime in milliseconds for medium cleanupToolDefinitions benchmark."
+    },
+    "cleanupToolDefinitions_large": {
+      "type": "number",
+      "minimum": 0,
+      "description": "Maximum average runtime in milliseconds for large cleanupToolDefinitions benchmark."
+    },
+    "accountHybridSelection_200": {
+      "type": "number",
+      "minimum": 0,
+      "description": "Maximum average runtime in milliseconds for accountHybridSelection benchmark with 200 accounts."
+    },
+    "resolveRequestAccountId_1000": {
+      "type": "number",
+      "minimum": 0,
+      "description": "Maximum average runtime in milliseconds for resolveRequestAccountId benchmark with 1000 accounts."
+    },
+    "normalizeAccountStorage_240": {
+      "type": "number",
+      "minimum": 0,
+      "description": "Maximum average runtime in milliseconds for normalizeAccountStorage benchmark with 240 accounts."
+    }
+  }
+}
diff --git a/config/slo-policy.json b/config/slo-policy.json
new file mode 100644
index 000000000..adaba5367
--- /dev/null
+++ b/config/slo-policy.json
@@ -0,0 +1,8 @@
+{
+  "windowDays": 30,
+  "objectives": {
+    "requestSuccessRatePercent": 99.5,
+    "healthCheckPassRequired": true,
+    "staleWalFindingsMax": 0
+  }
+}
diff --git a/docs/DOCUMENTATION.md b/docs/DOCUMENTATION.md
index 8e8b0edcb..8da83a02e 100644
--- a/docs/DOCUMENTATION.md
+++ b/docs/DOCUMENTATION.md
@@ -39,6 +39,8 @@ Canonical governance for repository documentation quality and consistency.
 | IA/findability audit (2026-03-01) | `docs/development/IA_FINDABILITY_AUDIT_2026-03-01.md` |
 | Config fields internals | `docs/development/CONFIG_FIELDS.md` |
 | Config flow internals | `docs/development/CONFIG_FLOW.md` |
+| Local development runbook | `docs/development/LOCAL_DEV.md` |
+| Release runbook | `docs/development/RELEASE_RUNBOOK.md` |
 | Repository ownership map | `docs/development/REPOSITORY_SCOPE.md` |
 | Testing and release gates | `docs/development/TESTING.md` |
 | TUI parity checklist | `docs/development/TUI_PARITY_CHECKLIST.md` |
diff --git a/docs/README.md b/docs/README.md
index 2accdd99f..2f492c4df 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -56,9 +56,17 @@ Canonical documentation map for `codex-multi-auth`.
 | [development/IA_FINDABILITY_AUDIT_2026-03-01.md](development/IA_FINDABILITY_AUDIT_2026-03-01.md) | IA/findability baseline, mismatches, and migration plan |
 | [development/CONFIG_FIELDS.md](development/CONFIG_FIELDS.md) | Complete field and env inventory |
 | [development/CONFIG_FLOW.md](development/CONFIG_FLOW.md) | Configuration resolution flow |
+| [development/LOCAL_DEV.md](development/LOCAL_DEV.md) | Local contributor setup and validation runbook |
+| [development/RELEASE_RUNBOOK.md](development/RELEASE_RUNBOOK.md) | Maintainer release gate and checklist |
 | [development/REPOSITORY_SCOPE.md](development/REPOSITORY_SCOPE.md) | Ownership map by repository path |
 | [development/TESTING.md](development/TESTING.md) | Validation gates and test matrix |
 | [development/TUI_PARITY_CHECKLIST.md](development/TUI_PARITY_CHECKLIST.md) | Dashboard UX parity checklist |
+| [runbooks/README.md](runbooks/README.md) | Operations and incident response playbooks |
+| [operations/incident-response.md](operations/incident-response.md) | Incident triage, containment, and recovery |
+| [operations/incident-drill-template.md](operations/incident-drill-template.md) | Monthly tabletop incident drill worksheet |
+| [operations/release-runbook.md](operations/release-runbook.md) | Release governance, provenance, and rollback |
+| [operations/slo-error-budget.md](operations/slo-error-budget.md) | Reliability objectives and budget policy |
+| [operations/audit-forwarding.md](operations/audit-forwarding.md) | SIEM forwarding controls for audit events |
 | [benchmarks/code-edit-format-benchmark.md](benchmarks/code-edit-format-benchmark.md) | Benchmark methodology and outputs |
 
 ---
diff --git a/docs/configuration.md b/docs/configuration.md
index 172296c74..2870d6840 100644
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -66,8 +66,15 @@ These are safe for most operators and frequently used in day-to-day workflows.
 | `CODEX_TUI_V2=0/1` | Disable or enable TUI v2 |
 | `CODEX_TUI_COLOR_PROFILE=truecolor|ansi256|ansi16` | Color profile selection |
 | `CODEX_TUI_GLYPHS=ascii|unicode|auto` | Glyph mode selection |
+| `CODEX_SECRET_STORAGE_MODE` | Secret-at-rest backend mode: `keychain`, `plaintext`, or `auto` (`keychain` default; enterprise profile should pin `keychain`) |
 | `CODEX_AUTH_FETCH_TIMEOUT_MS=<ms>` | HTTP request timeout override |
 | `CODEX_AUTH_STREAM_STALL_TIMEOUT_MS=<ms>` | Stream stall timeout override |
+| `CODEX_AUTH_ENCRYPTION_KEY=<32-byte-random-key>` | Enable at-rest encryption for stored account secrets (high-entropy key material only) |
+| `CODEX_AUTH_PREVIOUS_ENCRYPTION_KEY=<32-byte-random-key>` | Previous high-entropy key used during staged secret rotation |
+| `CODEX_AUTH_ROLE=admin\|operator\|viewer` | CLI authorization role baseline |
+
+For `CODEX_AUTH_ENCRYPTION_KEY` and `CODEX_AUTH_PREVIOUS_ENCRYPTION_KEY`, use 32-byte
+random key material from a secret manager. Do not use user-memorable passwords.
 
 ---
 
@@ -81,6 +88,14 @@ Use these only when debugging, controlled benchmarking, or maintainer workflows.
 - `CODEX_CLI_ACCOUNTS_PATH`
 - `CODEX_CLI_AUTH_PATH`
 - refresh lease tuning variables (`CODEX_AUTH_REFRESH_LEASE*`)
+- `CODEX_AUTH_BREAK_GLASS`
+- `CODEX_AUTH_ABAC_READ_ONLY`
+- `CODEX_AUTH_ABAC_DENY_ACTIONS`
+- `CODEX_AUTH_ABAC_DENY_COMMANDS`
+- `CODEX_AUTH_ABAC_REQUIRE_INTERACTIVE`
+- `CODEX_AUTH_ABAC_REQUIRE_IDEMPOTENCY_KEY`
+- `CODEX_AUTH_REDACT_JSON_OUTPUT`
+- retention tuning variables (`CODEX_AUTH_RETENTION_*`)
 
 Full inventory: [development/CONFIG_FIELDS.md](development/CONFIG_FIELDS.md)
 
diff --git a/docs/development/CONFIG_FIELDS.md b/docs/development/CONFIG_FIELDS.md
index 9a3ee4cf3..972c8681e 100644
--- a/docs/development/CONFIG_FIELDS.md
+++ b/docs/development/CONFIG_FIELDS.md
@@ -62,6 +62,7 @@ Used only for host plugin mode through the host runtime config file.
 | `retryAllAccountsRateLimited` | `true` |
 | `retryAllAccountsMaxWaitMs` | `0` |
 | `retryAllAccountsMaxRetries` | `Infinity` |
+| `retryAllAccountsAbsoluteCeilingMs` | `0 ms (0–24h; 0 = unlimited)` |
 | `unsupportedCodexPolicy` | `strict` |
 | `fallbackOnUnsupportedCodexModel` | `false` |
 | `fallbackToGpt52OnUnsupportedGpt53` | `true` |
@@ -193,8 +194,24 @@ Used only for host plugin mode through the host runtime config file.
 | `CODEX_TUI_V2` | Toggle TUI v2 |
 | `CODEX_TUI_COLOR_PROFILE` | TUI color profile |
 | `CODEX_TUI_GLYPHS` | TUI glyph mode |
+| `CODEX_AUTH_RETRY_ALL_ABSOLUTE_CEILING_MS` | Absolute wait ceiling in ms for retry-all-on-rate-limit loop (`0–24h`, `0 = unlimited`) |
 | `CODEX_AUTH_FETCH_TIMEOUT_MS` | Request timeout override |
 | `CODEX_AUTH_STREAM_STALL_TIMEOUT_MS` | Stream stall timeout override |
+| `CODEX_AUTH_ENCRYPTION_KEY` | Primary high-entropy 32-byte key for at-rest secret encryption |
+| `CODEX_AUTH_PREVIOUS_ENCRYPTION_KEY` | Previous high-entropy 32-byte key for staged secret rotation |
+| `CODEX_AUTH_ROLE` | Authorization role baseline (`admin`, `operator`, `viewer`) |
+| `CODEX_AUTH_BREAK_GLASS` | Emergency authorization bypass toggle |
+| `CODEX_AUTH_ABAC_READ_ONLY` | Deny mutating actions while allowing read-only command paths |
+| `CODEX_AUTH_ABAC_DENY_ACTIONS` | Comma-separated action denies (`accounts:write`, etc.) |
+| `CODEX_AUTH_ABAC_DENY_COMMANDS` | Comma-separated command denies (`rotate-secrets`, etc.) |
+| `CODEX_AUTH_ABAC_REQUIRE_INTERACTIVE` | Comma-separated actions that require interactive terminal |
+| `CODEX_AUTH_ABAC_REQUIRE_IDEMPOTENCY_KEY` | Comma-separated actions that require idempotency key context |
+| `CODEX_AUTH_REDACT_JSON_OUTPUT` | Redact sensitive values in JSON command output |
+| `CODEX_AUTH_RETENTION_LOG_DAYS` | Log retention window |
+| `CODEX_AUTH_RETENTION_CACHE_DAYS` | Cache retention window |
+| `CODEX_AUTH_RETENTION_FLAGGED_DAYS` | Flagged-account file retention window |
+| `CODEX_AUTH_RETENTION_QUOTA_CACHE_DAYS` | Quota cache retention window |
+| `CODEX_AUTH_RETENTION_DLQ_DAYS` | Dead-letter queue retention window |
 | `CODEX_MULTI_AUTH_SYNC_CODEX_CLI` | Toggle Codex CLI state sync |
 | `CODEX_MULTI_AUTH_REAL_CODEX_BIN` | Force official Codex binary path |
 | `CODEX_MULTI_AUTH_BYPASS` | Bypass local auth handling |
diff --git a/docs/development/LOCAL_DEV.md b/docs/development/LOCAL_DEV.md
new file mode 100644
index 000000000..47603d909
--- /dev/null
+++ b/docs/development/LOCAL_DEV.md
@@ -0,0 +1,85 @@
+# Local Development Runbook
+
+Canonical contributor workflow for setting up and validating this repository.
+
+---
+
+## Prerequisites
+
+- Node.js `>=18`
+- npm available in `PATH`
+- git available in `PATH`
+
+Verify environment:
+
+```bash
+npm run doctor:dev
+```
+
+---
+
+## First Clone
+
+From repo root:
+
+```bash
+npm run setup:dev
+```
+
+`setup:dev` runs:
+
+1. environment checks (`doctor:dev`)
+2. dependency install (`npm ci`)
+3. validation gate (`npm run verify`)
+4. docs integrity smoke (`npm test -- test/documentation.test.ts`)
+
+---
+
+## Daily Development
+
+```bash
+npm run verify
+```
+
+Use component commands when debugging failures:
+
+```bash
+npm run lint
+npm run typecheck
+npm test
+npm run build
+```
+
+Format repo config files (JSON/JSONC/YAML):
+
+```bash
+npm run format
+```
+
+---
+
+## Common Failure Modes
+
+- `doctor:dev` fails on missing npm/git:
+  - ensure shell `PATH` includes Node.js and git executables
+- `verify` fails on audit policy:
+  - run `npm run audit:ci` to inspect blocking advisory output
+- `setup:dev`/`doctor:dev` on Windows fails with transient `EBUSY`/`EPERM` lock errors:
+  - retry `npm ci` first (transient antivirus/file contention is common)
+  - if it persists, pause antivirus or exclude the repository, then re-run in an elevated PowerShell/CMD session
+  - if state looks corrupted, run `git clean -fdx` then run `npm ci` again
+  - if lock contention still stalls installs, try `npm ci --no-audit` or run setup from WSL2
+- `test/documentation.test.ts` fails with missing `dist/lib/*.js`:
+  - run `npm run build` and re-run the docs test
+
+---
+
+## CI Parity
+
+CI uses `npm run verify:ci` for the matrix test gate.
+
+Local equivalent:
+
+```bash
+npm run verify:ci
+```
diff --git a/docs/development/RELEASE_RUNBOOK.md b/docs/development/RELEASE_RUNBOOK.md
new file mode 100644
index 000000000..30a512b99
--- /dev/null
+++ b/docs/development/RELEASE_RUNBOOK.md
@@ -0,0 +1,57 @@
+# Release Runbook
+
+Maintainer checklist for preparing a reliable release from `main`.
+
+---
+
+## Preconditions
+
+1. Release PR merged to `main`
+2. CI checks green on latest `main`
+3. Working tree clean
+
+---
+
+## Validation Gate
+
+Run from repository root:
+
+```bash
+npm run release:check
+```
+
+This command runs:
+
+1. `npm run verify`
+2. `npm run test -- test/documentation.test.ts`
+3. `npm pack --dry-run`
+
+---
+
+## Documentation Gate
+
+Before publishing/tagging:
+
+1. update `CHANGELOG.md`
+2. add or update matching release note in `docs/releases/`
+3. verify docs links in `README.md` and `docs/README.md` point to the latest stable release note
+
+---
+
+## Publish/Tag Flow
+
+1. bump version in `package.json` and lockfile as needed
+2. commit release metadata
+3. create signed/annotated git tag
+4. push commit and tag
+5. verify package metadata and release notes in GitHub
+
+---
+
+## Rollback
+
+If release validation fails after version bump:
+
+1. revert release commit on branch
+2. re-run `npm run release:check`
+3. open a corrective PR with failure evidence
diff --git a/docs/development/TESTING.md b/docs/development/TESTING.md
index 9292b9065..54ab97845 100644
--- a/docs/development/TESTING.md
+++ b/docs/development/TESTING.md
@@ -19,11 +19,22 @@ Coverage thresholds in `vitest.config.ts`: statements/branches/functions/lines >
 
 ## Core Commands
 
+```bash
+npm run setup:dev
+npm run doctor:dev
+npm run verify
+npm run verify:ci
+```
+
+Component commands:
+
 ```bash
 npm run typecheck
 npm run lint
 npm test
 npm run build
+npm run audit:ci
+npm run license:check
 ```
 
 Optional:
@@ -39,11 +50,30 @@ npm run bench:edit-formats:smoke
 
 ## Recommended Local Gate Before PR
 
-1. `npm run typecheck`
-2. `npm run lint`
-3. `npm test`
-4. `npm run build`
+1. `npm run verify`
+2. `npm run audit:ci`
+3. `npm run license:check`
+4. `npm run test -- test/documentation.test.ts`
 5. run docs command checks for newly documented command paths
+6. for first-clone setup or environment validation: `npm run setup:dev` and `npm run doctor:dev`
+
+## Release Gate
+
+Run before version bump, tag, or publish workflow:
+
+1. `npm run release:check`
+2. `npm run audit:ci`
+3. `npm run license:check`
+4. verify changelog and release notes alignment
+5. confirm PR checks are green on the release branch
+
+### Upgrade Notes (PR #32)
+
+- Gate ordering was updated so `npm run coverage` runs before `npm run build`.
+- Two required supply-chain checks were added to the standard local sequence:
+  - `npm run audit:ci`
+  - `npm run license:check`
+- If you maintain local CI wrappers or pre-push scripts, update them to use the order above and rerun once to refresh baselines.
 
 * * *
 
diff --git a/docs/index.md b/docs/index.md
index 9a59b2d86..ecc3dbf0a 100644
--- a/docs/index.md
+++ b/docs/index.md
@@ -46,4 +46,5 @@ Legacy package/path guidance is documented in [upgrade.md](upgrade.md) and [refe
 - Command flags and hotkeys: [reference/commands.md](reference/commands.md)
 - Settings and overrides: [reference/settings.md](reference/settings.md)
 - Storage path matrix: [reference/storage-paths.md](reference/storage-paths.md)
-- Full docs portal: [README.md](README.md)
\ No newline at end of file
+- Operations runbooks: [runbooks/README.md](runbooks/README.md)
+- Full docs portal: [README.md](README.md)
diff --git a/docs/operations/audit-forwarding.md b/docs/operations/audit-forwarding.md
new file mode 100644
index 000000000..1a78e235b
--- /dev/null
+++ b/docs/operations/audit-forwarding.md
@@ -0,0 +1,79 @@
+# Audit Forwarding
+
+Forward local audit logs to a central SIEM endpoint.
+
+---
+
+## Purpose
+
+- Export append-only audit events from local log files.
+- Maintain checkpointed delivery (`audit-forwarder-checkpoint.json`) to avoid duplicate sends.
+- Support dry-run validation before production rollout.
+
+---
+
+## Required Configuration
+
+- `CODEX_SIEM_ENDPOINT` (HTTPS ingestion endpoint)
+- `CODEX_SIEM_API_KEY` (bearer token; required when the SIEM endpoint enforces authentication)
+- `CODEX_MULTI_AUTH_DIR` (optional runtime root override)
+
+---
+
+## Commands
+
+Dry run:
+
+```bash
+npm run ops:audit-forwarder -- --dry-run
+```
+
+Send batch:
+
+```bash
+npm run ops:audit-forwarder -- --batch-size=500
+```
+
+Explicit endpoint:
+
+```bash
+node scripts/audit-log-forwarder.js --endpoint=https://siem.example.com/ingest --batch-size=500
+```
+
+---
+
+## Delivery Contract
+
+Payload fields:
+
+- `source`
+- `generatedAt`
+- `count`
+- `checksum` (SHA-256 over event payload)
+- `entries` (JSON audit entries)
+
+Checkpoint fields:
+
+- `file`
+- `line`
+- `updatedAt`
+
+### Failure & Retry Behavior
+
+- Export delivery retries on HTTP `429` or `5xx`, plus timeout/network failures.
+- Retry count and timeout are configurable:
+  - `CODEX_AUDIT_FORWARDER_MAX_ATTEMPTS` (default `3`)
+  - `CODEX_AUDIT_FORWARDER_TIMEOUT_MS` (default `15000`)
+- Backoff is exponential with jitter (`250ms * 2^attempt + random(0..99ms)`).
+- Non-retryable responses and terminal retry failures stop the run and return non-zero.
+- Checkpoints are written only after a successful send batch. Failed sends keep the prior checkpoint (`file`, `line`, `updatedAt`) so operators can re-run safely.
+
+---
+
+## Alerting Recommendations
+
+Configure SIEM alerts for:
+
+1. `request.failure` spikes above baseline.
+2. auth failures crossing incident threshold.
+3. stale WAL detection events from scheduled health checks.
diff --git a/docs/operations/incident-drill-template.md b/docs/operations/incident-drill-template.md
new file mode 100644
index 000000000..827f9c891
--- /dev/null
+++ b/docs/operations/incident-drill-template.md
@@ -0,0 +1,81 @@
+# Incident Drill Template
+
+Use this template for monthly incident-response tabletop drills.
+
+---
+
+## Drill Metadata
+
+- Drill date (UTC):
+- Facilitator:
+- Participants:
+- Scenario ID:
+- Related runbook version:
+
+---
+
+## Scenario Setup
+
+1. Trigger condition:
+2. Initial symptoms:
+3. Assumed blast radius:
+4. Detection source:
+
+---
+
+## Timeline (UTC)
+
+| Timestamp | Event | Owner |
+| --- | --- | --- |
+| | | |
+| | | |
+| | | |
+
+---
+
+## Required Command Evidence
+
+```bash
+npm run ops:health-check
+codex auth report --live --json
+codex auth doctor --json
+```
+
+```powershell
+npm run ops:health-check
+codex auth report --live --json
+codex auth doctor --json
+```
+
+Attach:
+
+- command outputs
+- branch and commit SHA
+- incident severity classification
+
+---
+
+## Decision Log
+
+| Decision | Reason | Approver |
+| --- | --- | --- |
+| | | |
+| | | |
+
+---
+
+## Exit Criteria Review
+
+- [ ] health check returned `status: "pass"` (verify JSON `status` field)
+- [ ] no unresolved `SEV-1` conditions
+- [ ] rollback decision documented (if applicable)
+- [ ] prevention tasks created with owners and due dates
+
+---
+
+## Follow-ups
+
+| Action | Owner | Due date |
+| --- | --- | --- |
+| | | |
+| | | |
diff --git a/docs/operations/incident-response.md b/docs/operations/incident-response.md
new file mode 100644
index 000000000..0d731103f
--- /dev/null
+++ b/docs/operations/incident-response.md
@@ -0,0 +1,86 @@
+# Incident Response Runbook
+
+Operational incident workflow for `codex-multi-auth` deployments in enterprise environments.
+
+---
+
+## Severity Model
+
+| Severity | Definition | Initial response |
+| --- | --- | --- |
+| `SEV-1` | Auth/token failures causing broad outage or data exposure risk | Acknowledge within 15 minutes |
+| `SEV-2` | Partial degradation (intermittent auth, persistent retries, stale WAL) | Acknowledge within 30 minutes |
+| `SEV-3` | Non-critical defects with workaround available | Acknowledge within 1 business day |
+
+---
+
+## Detection Commands
+
+```bash
+npm run ops:health-check
+codex auth report --live --json
+codex auth doctor --json
+```
+
+Required evidence:
+
+- health-check JSON output
+- `codex auth report --live --json`
+- `codex auth doctor --json`
+- current commit SHA and branch
+
+---
+
+## First 30 Minutes
+
+1. Run `npm run ops:health-check` and capture output.
+2. If status is `fail`, block release or rollback active release candidate.
+3. If stale WAL is reported, run `codex auth doctor --fix --dry-run` first, then `codex auth doctor --fix`.
+4. If auth failures persist, rotate account via `codex auth switch <index>` and re-run `codex auth check`.
+5. If all accounts are exhausted/disabled, escalate immediately to `SEV-1`, stop automated retries, and switch to fallback credentials via incident commander approval.
+6. Record timeline with absolute UTC timestamps.
+
+Windows operator note:
+
+- Default path is `%USERPROFILE%\\.codex\\multi-auth`; if `CODEX_HOME` is set, use `%CODEX_HOME%\\multi-auth`.
+- When deleting WAL artifacts manually, close shells/editors first to avoid `EPERM`/`EBUSY` locks.
+
+---
+
+## Containment and Recovery
+
+1. Disable debug body logging unless actively diagnosing:
+   - ensure `CODEX_PLUGIN_LOG_BODIES` is unset
+2. Run containment commands serially (do not run concurrently):
+   - `npm run ops:retention-cleanup`
+3. Re-run verification pack:
+   - `npm run ops:health-check`
+   - `npm run audit:ci`
+   - `npm run test -- test/storage.test.ts test/fetch-helpers.test.ts`
+
+Recovery exit criteria:
+
+- `ops:health-check` status is `pass`
+- no unresolved `SEV-1` findings
+- CI checks green on remediation branch
+
+---
+
+## Post-Incident
+
+1. Publish root-cause analysis with:
+   - trigger
+   - blast radius
+   - remediation commit SHA
+   - prevention tasks with owners and due dates
+2. Add/adjust regression tests in `test/` for the failure mode.
+3. Update this runbook if manual steps were required.
+
+---
+
+## Drill Cadence
+
+- Run a tabletop drill monthly.
+- Run `npm run ops:recovery-drill` as the drill execution command and archive outputs.
+- Use [incident-drill-template.md](incident-drill-template.md) for drill evidence.
+- Track unresolved drill actions as release blockers when severity is `SEV-1` equivalent.
diff --git a/docs/operations/release-runbook.md b/docs/operations/release-runbook.md
new file mode 100644
index 000000000..7562620c1
--- /dev/null
+++ b/docs/operations/release-runbook.md
@@ -0,0 +1,82 @@
+# Release and Rollback Runbook
+
+Release governance for `codex-multi-auth` with provenance and rollback controls.
+
+---
+
+## Preconditions
+
+1. Branch is up to date with `main`.
+2. Required checks pass:
+   - `npm run lint`
+   - `npm run typecheck`
+   - `npm test`
+   - `npm run build`
+   - `npm run audit:ci`
+   - `npm run perf:budget-check`
+3. `secret-scan` workflow is green.
+
+---
+
+## Release Procedure
+
+1. Create release tag from validated commit.
+2. Publish GitHub release.
+3. Trigger workflow:
+   - `.github/workflows/release-provenance.yml`
+   - `.github/workflows/sbom-attestation.yml`
+4. Validate published package integrity:
+    - `npm view codex-multi-auth version`
+    - verify provenance is attached to the publish event.
+5. Capture compliance evidence bundle:
+   - `node scripts/compliance-evidence-bundle.js --profile=release --out-dir=.tmp/compliance-evidence-release`
+
+Required release record:
+
+- release tag
+- commit SHA
+- workflow run URL
+- test evidence timestamp
+- SBOM artifact reference
+- compliance evidence bundle path
+
+---
+
+## Rollback Procedure
+
+Use rollback when `SEV-1` or unmitigated `SEV-2` occurs after release.
+
+1. Stop further publishing.
+2. Re-point consumers to previous known-good tag.
+3. Open hotfix branch from previous stable SHA.
+4. Re-run mandatory checks and republish fixed patch.
+
+Rollback verification:
+
+```bash
+npm run ops:health-check
+npm run audit:ci
+npm run test -- test/storage.test.ts test/codex-manager-cli.test.ts
+```
+
+Rollback is complete only when:
+
+- verification commands pass
+- issue reproduction no longer occurs
+- release notes include rollback details
+
+---
+
+## Retention and Cleanup
+
+Run scheduled cleanup at least weekly:
+
+```bash
+npm run ops:retention-cleanup
+```
+
+Default retention is 90 days. Override for emergency cleanup:
+
+```bash
+npm run ops:retention-cleanup -- --days=30
+```
diff --git a/docs/operations/slo-error-budget.md b/docs/operations/slo-error-budget.md
new file mode 100644
index 000000000..411a3e252
--- /dev/null
+++ b/docs/operations/slo-error-budget.md
@@ -0,0 +1,58 @@
+# SLO and Error Budget Policy
+
+Reliability policy for enterprise operation of `codex-multi-auth`.
+
+---
+
+## Measurement Window
+
+- Rolling window: 30 days
+- Data source:
+  - audit logs (`request.success`, `request.failure`)
+  - `ops:health-check` findings
+- Policy file: `config/slo-policy.json`
+
+---
+
+## SLO Objectives
+
+| Objective | Target |
+| --- | --- |
+| Request success rate | `>= 99.5%` |
+| Health-check status | `pass` |
+| Stale WAL findings | `0` |
+
+---
+
+## Error Budget
+
+- Request error budget: `0.5%` per 30-day window.
+- Budget burn:
+  - `100 - requestSuccessRatePercent`
+- Trigger thresholds:
+  - `>= 50%` burn: freeze non-critical feature work for reliability review.
+  - `>= 100%` burn: incident review required before next release.
+
+---
+
+## Reporting
+
+Generate report:
+
+```bash
+npm run ops:slo-report
+```
+
+Enforce gate (non-zero exit on violations):
+
+```bash
+node scripts/slo-budget-report.js --enforce --output=.tmp/slo-report.json
+```
+
+---
+
+## Governance
+
+1. Review SLO report weekly.
+2. Review error budget during release readiness.
+3. If budget is exhausted, require remediation plan and owner sign-off.
diff --git a/docs/privacy.md b/docs/privacy.md
index 4fa153420..ed867f4fe 100644
--- a/docs/privacy.md
+++ b/docs/privacy.md
@@ -9,6 +9,8 @@
 - No custom analytics pipeline in this repository.
 - No project-owned remote database.
 - Network calls are limited to required OAuth/backend/update endpoints.
+- Local structured telemetry is written to `~/.codex/multi-auth/logs/product-telemetry.jsonl`.
+- Set `CODEX_AUTH_TELEMETRY_ENABLED=0` (or `telemetryEnabled: false`) to disable local telemetry writes.
 
 ---
 
@@ -20,7 +22,9 @@
 | Accounts | `~/.codex/multi-auth/openai-codex-accounts.json` | Primary saved account pool |
 | Flagged accounts | `~/.codex/multi-auth/openai-codex-flagged-accounts.json` | Accounts with hard auth failures |
 | Quota cache | `~/.codex/multi-auth/quota-cache.json` | Cached quota snapshots |
+| Background DLQ | `~/.codex/multi-auth/background-job-dlq.jsonl` | Failed background jobs after retry exhaustion |
 | Logs | `~/.codex/multi-auth/logs/codex-plugin/` | Optional diagnostics |
+| Local telemetry ledger | `~/.codex/multi-auth/logs/product-telemetry.jsonl` | Local event timeline for CLI/plugin outcomes |
 | Prompt/cache files | `~/.codex/multi-auth/cache/` | Cached prompt/template metadata |
 | Codex CLI state | `~/.codex/accounts.json`, `~/.codex/auth.json` | Official Codex CLI files |
 
@@ -48,6 +52,50 @@ Current external destinations:
 
 Raw body logs may contain sensitive payload text. Treat logs as sensitive data and rotate/delete as needed.
 
+`CODEX_AUTH_REDACT_JSON_OUTPUT=1` redacts sensitive values from JSON command output for automation logs.
+
+---
+
+## Secret Encryption and Rotation
+
+- Account refresh/access tokens can be encrypted at rest when `CODEX_AUTH_ENCRYPTION_KEY` is set.
+- Key rotation supports staged migration with `CODEX_AUTH_PREVIOUS_ENCRYPTION_KEY`.
+- Both key variables should be 32-byte high-entropy key material (not passwords).
+- Rotation command:
+
+```bash
+codex auth rotate-secrets --json
+```
+
+Store encryption keys in a secret manager or CI secret store, not in repository files.
+
+---
+
+## Retention
+
+Startup retention cleanup removes expired local artifacts based on:
+
+- `CODEX_AUTH_RETENTION_LOG_DAYS`
+- `CODEX_AUTH_RETENTION_CACHE_DAYS`
+- `CODEX_AUTH_RETENTION_FLAGGED_DAYS`
+- `CODEX_AUTH_RETENTION_QUOTA_CACHE_DAYS`
+- `CODEX_AUTH_RETENTION_DLQ_DAYS`
+
+Retention control:
+
+```bash
+npm run ops:retention-cleanup
+npm run ops:retention-cleanup -- --days=30
+```
+
+Default retention window is 90 days.
+
+Audit forwarding (for central SIEM ingestion):
+
+```bash
+npm run ops:audit-forwarder -- --dry-run
+```
+
 ---
 
 ## Data Cleanup
@@ -60,6 +108,7 @@ rm -f ~/.codex/multi-auth/openai-codex-accounts.json
 rm -f ~/.codex/multi-auth/openai-codex-flagged-accounts.json
 rm -f ~/.codex/multi-auth/quota-cache.json
 rm -rf ~/.codex/multi-auth/logs/codex-plugin
+rm -f ~/.codex/multi-auth/logs/product-telemetry.jsonl*
 rm -rf ~/.codex/multi-auth/cache
 # Override-root cleanup examples (if overrides are set):
 [ -n "${CODEX_MULTI_AUTH_DIR:-}" ] && [ -d "$CODEX_MULTI_AUTH_DIR/logs/codex-plugin" ] && rm -rf "$CODEX_MULTI_AUTH_DIR/logs/codex-plugin"
@@ -74,6 +123,7 @@ Remove-Item "$HOME\.codex\multi-auth\openai-codex-accounts.json" -Force -ErrorAc
 Remove-Item "$HOME\.codex\multi-auth\openai-codex-flagged-accounts.json" -Force -ErrorAction SilentlyContinue
 Remove-Item "$HOME\.codex\multi-auth\quota-cache.json" -Force -ErrorAction SilentlyContinue
 Remove-Item "$HOME\.codex\multi-auth\logs\codex-plugin" -Recurse -Force -ErrorAction SilentlyContinue
+Remove-Item "$HOME\.codex\multi-auth\logs\product-telemetry.jsonl*" -Force -ErrorAction SilentlyContinue
 Remove-Item "$HOME\.codex\multi-auth\cache" -Recurse -Force -ErrorAction SilentlyContinue
 # Override-root cleanup examples (if overrides are set):
 if ($env:CODEX_MULTI_AUTH_DIR) { Remove-Item "$env:CODEX_MULTI_AUTH_DIR\\*" -Recurse -Force -ErrorAction SilentlyContinue }
diff --git a/docs/reference/commands.md b/docs/reference/commands.md
index 43c877fae..ef74196a2 100644
--- a/docs/reference/commands.md
+++ b/docs/reference/commands.md
@@ -38,6 +38,8 @@ Compatibility aliases are supported:
 | `codex auth report` | Generate full health report |
 | `codex auth fix` | Apply safe account storage fixes |
 | `codex auth doctor` | Run diagnostics and optional repairs |
+| `codex auth rotate-secrets` | Re-encrypt account secrets using current encryption key |
+| `codex auth telemetry` | Show local telemetry summary and recent events |
 
 ---
 
@@ -45,13 +47,18 @@ Compatibility aliases are supported:
 
 | Flag | Applies to | Meaning |
 | --- | --- | --- |
-| `--json` | verify-flagged, forecast, report, fix, doctor | Print machine-readable output |
+| `--json` | verify-flagged, forecast, report, fix, doctor, rotate-secrets, telemetry | Print machine-readable output |
 | `--live` | forecast, report, fix | Use live probe before decisions/output |
 | `--dry-run` | verify-flagged, fix, doctor | Preview without writing storage |
 | `--model <model>` | forecast, report, fix | Specify model for live probe paths |
 | `--out <path>` | report | Write report output to file |
 | `--fix` | doctor | Apply safe repairs |
 | `--no-restore` | verify-flagged | Verify only; do not restore healthy flagged accounts |
+| `--page-size <n>` | list, status (`--json`) | Page size for JSON list output (1-200) |
+| `--cursor <cursor>` | list, status (`--json`) | Cursor token for JSON list pagination |
+| `--idempotency-key <key>` | rotate-secrets | Safe retry key for automation |
+| `--since-hours <hours>` | telemetry | Include events newer than this many hours |
+| `--limit <n>` | telemetry | Max events to include in report |
 
 ---
 
@@ -108,6 +115,7 @@ Repair and recovery:
 codex auth fix --dry-run
 codex auth fix --live --model gpt-5-codex
 codex auth doctor --fix
+codex auth rotate-secrets --json --idempotency-key "$CI_JOB_ID"
 ```
 
 ---
diff --git a/docs/reference/error-contracts.md b/docs/reference/error-contracts.md
index 62694d4f6..2196f1a7c 100644
--- a/docs/reference/error-contracts.md
+++ b/docs/reference/error-contracts.md
@@ -31,17 +31,24 @@ Examples:
 
 The following commands support `--json` and produce pretty-printed JSON objects:
 
+- `codex auth list --json`
 - `codex auth forecast --json`
 - `codex auth report --json`
 - `codex auth fix --json`
 - `codex auth doctor --json`
 - `codex auth verify-flagged --json`
+- `codex auth rotate-secrets --json`
 
 Compatibility guarantees:
 
 - Output is valid JSON.
 - `command` field identifies the command family.
+- `schemaVersion` is required for machine-consumable contracts.
 - Documented top-level sections remain stable unless a migration note is provided.
+- Optional redaction mode (`CODEX_AUTH_REDACT_JSON_OUTPUT=1`) masks sensitive fields without changing schema shape.
+- Paginated list output uses `pagination.{cursor,nextCursor,hasMore,pageSize}`.
+
+For `rotate-secrets`, automation may provide `--idempotency-key <key>` to avoid duplicate side effects on retried runs.
 
 ---
 
diff --git a/docs/reference/public-api.md b/docs/reference/public-api.md
index 865189ff9..d916a379c 100644
--- a/docs/reference/public-api.md
+++ b/docs/reference/public-api.md
@@ -63,6 +63,24 @@ Positional signatures are preserved for backward compatibility.
 
 ---
 
+## API Standards Baseline
+
+Where this repository exposes machine-readable command output or future HTTP endpoints, use these defaults:
+
+- Versioning:
+  - include `schemaVersion` in JSON command output.
+  - increment schema version only when contract shape changes.
+- Idempotency:
+  - mutating automation flows should support caller-provided idempotency keys.
+  - repeated requests with the same idempotency key should not duplicate side effects.
+- Pagination:
+  - list-style payloads should prefer cursor-based pagination (`nextCursor`, `hasMore`) over offset-only paging.
+  - response envelopes should include stable paging metadata even for empty result sets.
+
+This project currently applies the versioning baseline to JSON command outputs and documents idempotency/pagination standards for future API expansion.
+
+---
+
 ## Semver Guidance
 
 - Breaking Tier A change: `MAJOR`
diff --git a/docs/reference/settings.md b/docs/reference/settings.md
index 1466374b9..d91b8b257 100644
--- a/docs/reference/settings.md
+++ b/docs/reference/settings.md
@@ -74,6 +74,7 @@ Examples:
 - `sessionAffinityTtlMs`
 - `sessionAffinityMaxEntries`
 - `perProjectAccounts`
+- `telemetryEnabled`
 
 ### Rotation and Quota
 
@@ -86,6 +87,8 @@ Examples:
 - `retryAllAccountsRateLimited`
 - `retryAllAccountsMaxWaitMs`
 - `retryAllAccountsMaxRetries`
+- `retryAllAccountsAbsoluteCeilingMs`
+  Unit: milliseconds. Bounds: `0` to `24h`. `0` means unlimited.
 
 ### Refresh and Recovery
 
@@ -126,8 +129,22 @@ Common operator overrides:
 - `CODEX_TUI_V2`
 - `CODEX_TUI_COLOR_PROFILE`
 - `CODEX_TUI_GLYPHS`
+- `CODEX_SECRET_STORAGE_MODE`
+- `CODEX_AUTH_RETRY_ALL_ABSOLUTE_CEILING_MS`
+  Rotation & Quota override for `retryAllAccountsAbsoluteCeilingMs` (ms, `0` to `24h`, `0` = unlimited).
 - `CODEX_AUTH_FETCH_TIMEOUT_MS`
 - `CODEX_AUTH_STREAM_STALL_TIMEOUT_MS`
+- `CODEX_AUTH_TELEMETRY_ENABLED`
+- `CODEX_AUTH_ENCRYPTION_KEY`
+- `CODEX_AUTH_PREVIOUS_ENCRYPTION_KEY`
+- `CODEX_AUTH_ROLE`
+
+Encryption key variables must be high-entropy 32-byte key material (for example,
+from a secret manager). Do not use passwords.
+
+Enterprise recommendation:
+
+- pin `CODEX_SECRET_STORAGE_MODE=keychain` for production.
 
 ---
 
@@ -141,6 +158,14 @@ Maintainer/debug-focused overrides include:
 - `CODEX_CLI_ACCOUNTS_PATH`
 - `CODEX_CLI_AUTH_PATH`
 - refresh lease controls (`CODEX_AUTH_REFRESH_LEASE*`)
+- `CODEX_AUTH_BREAK_GLASS`
+- `CODEX_AUTH_ABAC_READ_ONLY`
+- `CODEX_AUTH_ABAC_DENY_ACTIONS`
+- `CODEX_AUTH_ABAC_DENY_COMMANDS`
+- `CODEX_AUTH_ABAC_REQUIRE_INTERACTIVE`
+- `CODEX_AUTH_ABAC_REQUIRE_IDEMPOTENCY_KEY`
+- `CODEX_AUTH_REDACT_JSON_OUTPUT`
+- retention controls (`CODEX_AUTH_RETENTION_*`)
 
 Full inventory: [../development/CONFIG_FIELDS.md](../development/CONFIG_FIELDS.md)
 
@@ -175,4 +200,4 @@ codex auth forecast --live
 
 - [commands.md](commands.md)
 - [storage-paths.md](storage-paths.md)
-- [../configuration.md](../configuration.md)
\ No newline at end of file
+- [../configuration.md](../configuration.md)
diff --git a/docs/reference/storage-paths.md b/docs/reference/storage-paths.md
index bae76b844..6e5690750 100644
--- a/docs/reference/storage-paths.md
+++ b/docs/reference/storage-paths.md
@@ -26,11 +26,17 @@ Override root:
 | Accounts WAL | `~/.codex/multi-auth/openai-codex-accounts.json.wal` |
 | Flagged accounts | `~/.codex/multi-auth/openai-codex-flagged-accounts.json` |
 | Quota cache | `~/.codex/multi-auth/quota-cache.json` |
+| Background job DLQ | `~/.codex/multi-auth/background-job-dlq.jsonl` |
 | Logs | `~/.codex/multi-auth/logs/codex-plugin/` |
 | Cache | `~/.codex/multi-auth/cache/` |
 | Codex CLI accounts | `~/.codex/accounts.json` |
 | Codex CLI auth | `~/.codex/auth.json` |
 
+Security note:
+
+- Current secure format (`version: 4`) stores keychain references (`refreshTokenRef`, `accessTokenRef`) instead of raw token values in account storage files.
+- Set `CODEX_SECRET_STORAGE_MODE=plaintext` only for controlled migration/testing environments.
+
 Ownership note:
 
 - `~/.codex/multi-auth/*` is managed by this project.
diff --git a/docs/runbooks/README.md b/docs/runbooks/README.md
new file mode 100644
index 000000000..7b7d5302c
--- /dev/null
+++ b/docs/runbooks/README.md
@@ -0,0 +1,12 @@
+# Runbooks
+
+Operational runbooks for `codex-multi-auth`.
+
+## Runbook Index
+
+- [operations.md](operations.md): routine operational checks, release gates, and maintenance tasks.
+- [incident-response.md](incident-response.md): severity model, containment flow, and post-incident process.
+
+## Scope
+
+These runbooks cover plugin-owned local state under `~/.codex/multi-auth` (or `CODEX_MULTI_AUTH_DIR`) and repository-level CI/security controls.
diff --git a/docs/runbooks/incident-response.md b/docs/runbooks/incident-response.md
new file mode 100644
index 000000000..230f8e24a
--- /dev/null
+++ b/docs/runbooks/incident-response.md
@@ -0,0 +1,99 @@
+# Incident Response Playbook
+
+Incident response workflow for `codex-multi-auth`.
+
+---
+
+## Severity Levels
+
+- `SEV-1`: active secret exposure, auth bypass, or broad production outage.
+- `SEV-2`: major functionality degraded, high failure rate, or persistent data corruption risk.
+- `SEV-3`: contained bug with workaround, no ongoing security impact.
+
+---
+
+## Response Timeline
+
+### 1. Detect and Declare (0-15 min)
+
+1. Open an internal incident channel.
+2. Assign incident commander and communications lead.
+3. Record:
+   - first detection timestamp
+   - affected command flows
+   - impacted storage paths/environment variables
+
+### 2. Contain (15-60 min)
+
+1. For credential exposure:
+   - rotate affected OAuth/session credentials
+   - set new `CODEX_AUTH_ENCRYPTION_KEY`
+   - run `codex auth rotate-secrets --idempotency-key <incident-id>`
+2. For unauthorized command execution:
+   - downgrade role to `CODEX_AUTH_ROLE=viewer` where possible
+   - enable `CODEX_AUTH_ABAC_READ_ONLY=1` until containment is complete
+   - deny high-risk commands with `CODEX_AUTH_ABAC_DENY_COMMANDS=rotate-secrets,fix`
+   - reserve `CODEX_AUTH_BREAK_GLASS=1` for explicit emergency changes
+3. For filesystem instability:
+   - pause mutation commands (`login`, `switch`, `fix`)
+   - inspect lock files and dead-letter entries
+
+### 3. Eradicate and Recover (within 24h)
+
+1. Patch root cause and merge behind required CI checks.
+2. Validate:
+   - `npm run typecheck`
+   - `npm run lint`
+   - `npm test`
+   - `npm run audit:ci`
+3. Re-enable normal command paths and monitor audit logs.
+
+---
+
+## Communication Template
+
+Use this internal status template:
+
+```text
+Incident: <short title>
+Severity: <SEV-1|SEV-2|SEV-3>
+Start Time: <ISO-8601>
+Current Status: <investigating|contained|mitigated|resolved>
+Impact: <who/what is affected>
+Mitigation: <actions in progress>
+Next Update: <time>
+```
+
+---
+
+## Evidence Collection
+
+Capture and retain:
+
+1. `audit.log` entries for the affected window.
+2. relevant `codex-plugin` logs.
+3. dead-letter entries from `background-job-dlq.jsonl`.
+4. CI run links for failing and fixed pipelines.
+
+Do not include raw refresh/access tokens in incident artifacts.
+
+---
+
+## Post-Incident Review (within 5 business days)
+
+1. Build a timeline with concrete timestamps.
+2. Document root cause and contributing factors.
+3. Add at least one prevention control:
+   - new test
+   - CI gate
+   - runbook update
+   - config default hardening
+4. Publish remediation status and owner commitments.
+
+---
+
+## Related
+
+- [operations.md](operations.md)
+- [../../SECURITY.md](../../SECURITY.md)
+- [../troubleshooting.md](../troubleshooting.md)
diff --git a/docs/runbooks/operations.md b/docs/runbooks/operations.md
new file mode 100644
index 000000000..fd681e32a
--- /dev/null
+++ b/docs/runbooks/operations.md
@@ -0,0 +1,99 @@
+# Operations Runbook
+
+Routine operations checklist for maintainers.
+
+---
+
+## Daily
+
+1. Review CI status for `main`:
+   - `CI`
+   - `CodeQL`
+   - `Secret Scan`
+   - `Supply Chain`
+2. Check recent audit and plugin logs:
+   - `~/.codex/multi-auth/logs/audit.log`
+   - `~/.codex/multi-auth/logs/codex-plugin/`
+   - `%USERPROFILE%\.codex\multi-auth\logs\audit.log` (Windows)
+   - `%USERPROFILE%\.codex\multi-auth\logs\codex-plugin\` (Windows)
+3. Check dead-letter queue growth:
+   - `~/.codex/multi-auth/background-job-dlq.jsonl`
+   - `%USERPROFILE%\.codex\multi-auth\background-job-dlq.jsonl` (Windows)
+
+---
+
+## Weekly
+
+1. Rotate encryption key material:
+   - set `CODEX_AUTH_ENCRYPTION_KEY` (new key)
+   - set `CODEX_AUTH_PREVIOUS_ENCRYPTION_KEY` (prior key)
+   - run `codex auth rotate-secrets --json --idempotency-key <run-id>`
+   - prefer a stable run id source (for example `weekly-YYYYMMDD` or CI `${{ github.run_id }}`)
+   - remove previous key after successful rotation validation
+2. Review dependency and license policy reports:
+   - `npm run audit:ci`
+   - `npm run license:check`
+3. Export SBOM from workflow artifacts (`sbom-cyclonedx`) and archive with release metadata.
+
+---
+
+## Monthly
+
+1. Verify retention policy values:
+   - `CODEX_AUTH_RETENTION_LOG_DAYS`
+   - `CODEX_AUTH_RETENTION_CACHE_DAYS`
+   - `CODEX_AUTH_RETENTION_FLAGGED_DAYS`
+   - `CODEX_AUTH_RETENTION_QUOTA_CACHE_DAYS`
+   - `CODEX_AUTH_RETENTION_DLQ_DAYS`
+2. Validate RBAC defaults for deployment environments:
+   - `CODEX_AUTH_ROLE=admin|operator|viewer`
+   - `CODEX_AUTH_BREAK_GLASS=1` only for emergency windows
+3. Validate ABAC guardrails for automation and production:
+   - `CODEX_AUTH_ABAC_READ_ONLY=1` for read-only diagnostics environments
+   - `CODEX_AUTH_ABAC_REQUIRE_INTERACTIVE=accounts:write,accounts:repair` for interactive-only mutation paths
+   - `CODEX_AUTH_ABAC_REQUIRE_IDEMPOTENCY_KEY=secrets:rotate` for safe retryable secret rotation
+4. Run a restore drill with exported account backups.
+
+---
+
+## Pre-Release Checklist
+
+1. `npm run typecheck`
+2. `npm run lint`
+3. `npm test`
+4. `npm run coverage`
+5. `npm run build`
+6. `npm run audit:ci`
+7. `npm run license:check`
+8. Confirm branch protection required checks remain aligned with `.github/settings.yml`.
+
+---
+
+## Failure Triage
+
+1. If auth operations fail repeatedly, inspect rate-limit diagnostics and account health:
+   - `codex auth check`
+   - `codex auth doctor --json`
+2. If writes fail under filesystem lock contention:
+   - check stale `*.lock` files under runtime root
+   - inspect DLQ entries for repeated write failures
+   - quick log triage:
+     - macOS/Linux: `tail -n 200 ~/.codex/multi-auth/logs/audit.log`
+     - Windows PowerShell: `Get-Content $env:USERPROFILE\.codex\multi-auth\logs\audit.log -Tail 200`
+   - quick DLQ triage:
+     - macOS/Linux: `tail -n 50 ~/.codex/multi-auth/background-job-dlq.jsonl`
+     - Windows PowerShell: `Get-Content $env:USERPROFILE\.codex\multi-auth\background-job-dlq.jsonl -Tail 50`
+3. If CI secret scan fails:
+   - rotate exposed secret
+   - invalidate related tokens
+   - scrub history or revoke access based on severity
+   - document in incident report
+
+---
+
+## Related
+
+- [incident-response.md](incident-response.md)
+- [../reference/commands.md](../reference/commands.md)
+- [../privacy.md](../privacy.md)
+- [../../SECURITY.md](../../SECURITY.md)
diff --git a/docs/upgrade.md b/docs/upgrade.md
index e34ecb2d4..bdf29ca83 100644
--- a/docs/upgrade.md
+++ b/docs/upgrade.md
@@ -16,36 +16,48 @@ Migrate legacy installs to the canonical `codex-multi-auth` workflow on the `0.x
 
 1. Install official Codex CLI:
 
-```bash
-npm i -g @openai/codex
-```
+   ```bash
+   npm i -g @openai/codex
+   ```
 
-1. Remove legacy scoped package if present:
+2. Remove legacy scoped package if present:
 
-```bash
-npm uninstall -g @ndycode/codex-multi-auth
-```
+   ```bash
+   npm uninstall -g @ndycode/codex-multi-auth
+   ```
 
-1. Install canonical package:
+3. Install canonical package:
 
-```bash
-npm i -g codex-multi-auth
-```
+   ```bash
+   npm i -g codex-multi-auth
+   ```
 
-1. Verify routing and status:
+4. Verify routing and status:
 
-```bash
-codex --version
-codex auth status
-```
+   ```bash
+   codex --version
+   codex auth status
+   ```
 
-1. Rebuild account health baseline:
+5. Rebuild account health baseline:
 
-```bash
-codex auth login
-codex auth check
-codex auth forecast --live --model gpt-5-codex
-```
+   ```bash
+   codex auth login
+   codex auth check
+   codex auth forecast --live --model gpt-5-codex
+   ```
+
+---
+
+## Contributor Workflow Upgrade (`doctor:dev` / `setup:dev`)
+
+Repository contributors should adopt the bootstrap workflow documented in `README.md`:
+
+- `npm run doctor:dev`: validates local prerequisites and repository shape before running gates.
+- `npm run setup:dev`: runs `doctor:dev`, installs with `npm ci`, then executes the local validation gate.
+- `npm run verify`: canonical local parity gate used by CI (`verify:ci`).
+
+After pulling this change set, run `npm run setup:dev` once per clone/worktree to align local tooling expectations.
 
 ---
 
@@ -62,6 +74,46 @@ After source selection, environment variables still override individual setting
 For day-to-day operator use, prefer stable overrides documented in [configuration.md](configuration.md).
 For maintainer/debug flows, see advanced/internal controls in [development/CONFIG_FIELDS.md](development/CONFIG_FIELDS.md).
 
+### Secret Storage Mode Migration (plaintext -> keychain)
+
+Use this flow when migrating existing deployments that were running with plaintext token storage.
+
+1. Back up runtime state before changing secret storage mode:
+
+   ```bash
+   cp -r ~/.codex/multi-auth ~/.codex/multi-auth.backup
+   ```
+
+2. Validate keychain backend availability:
+
+   ```bash
+   npm run ops:keychain-assert
+   ```
+
+   Run this from the project repository root where `package.json` defines enterprise ops scripts, or run your CI/job wrapper that exposes these scripts.
+
+3. Set `CODEX_SECRET_STORAGE_MODE=keychain` in your runtime environment (or use `auto` only after the keychain validation above passes).
+
+4. Trigger a controlled account rewrite so token refs are persisted in v4 format:
+
+   ```bash
+   codex auth check
+   codex auth report --live
+   ```
+
+5. Verify health and storage state:
+
+   ```bash
+   npm run ops:health-check -- --require-files
+   ```
+
+   Run this from the same repository checkout (or your standard CI/job wrapper).
+
+Windows migration note:
+
+- Close editors/shells that may hold handles on `%CODEX_HOME%\\multi-auth` before migration writes.
+- If you hit transient `EBUSY`/`EPERM` during migration, retry after closing locking processes; storage/settings writes use exponential backoff, but persistent locks still require operator action.
+
 ---
 
 ## Legacy Compatibility
diff --git a/index.ts b/index.ts
index 7db88088a..b5e7d5ac0 100644
--- a/index.ts
+++ b/index.ts
@@ -44,6 +44,7 @@ import {
 	getFastSessionMaxInputItems,
 	getRateLimitToastDebounceMs,
 	getRetryAllAccountsMaxRetries,
+	getRetryAllAccountsAbsoluteCeilingMs,
 	getRetryAllAccountsMaxWaitMs,
 	getRetryAllAccountsRateLimited,
 	getFallbackToGpt52OnUnsupportedGpt53,
@@ -54,6 +55,7 @@ import {
 	getAutoResume,
 	getToastDurationMs,
 	getPerProjectAccounts,
+	getTelemetryEnabled,
 	getEmptyResponseMaxRetries,
 	getEmptyResponseRetryDelayMs,
 	getPidOffsetEnabled,
@@ -99,6 +101,9 @@ import {
 	setCorrelationId,
 	clearCorrelationId,
 } from "./lib/logger.js";
+import { auditLog, AuditAction, AuditOutcome } from "./lib/audit.js";
+import { checkAuthRateLimit, recordAuthAttempt, resetAuthRateLimit } from "./lib/auth-rate-limit.js";
+import { recordTelemetryEvent } from "./lib/telemetry.js";
 import { checkAndNotify } from "./lib/auto-update-checker.js";
 import { handleContextOverflow } from "./lib/context-overflow.js";
 import {
@@ -114,9 +119,25 @@ import {
         shouldUpdateAccountIdFromToken,
         resolveRequestAccountId,
         parseRateLimitReason,
+	getQuotaKey,
 	lookupCodexCliTokensByEmail,
 	isCodexCliSyncEnabled,
 } from "./lib/accounts.js";
+import {
+	resolveActiveIndex,
+	formatRateLimitEntry,
+	formatActiveIndexByFamilyLabels,
+	formatRateLimitStatusByFamily,
+} from "./lib/accounts/account-view.js";
+import {
+	cloneAccountStorage,
+	createEmptyAccountStorage,
+} from "./lib/accounts/storage-view.js";
+import {
+	setActiveIndexForAllFamilies,
+	normalizeActiveIndexByFamily,
+	removeAccountAndReconcileActiveIndexes,
+} from "./lib/accounts/active-index.js";
 import {
 	getStoragePath,
 	loadAccounts,
@@ -151,11 +172,14 @@ import {
 import { applyFastSessionDefaults } from "./lib/request/request-transformer.js";
 import {
 	getRateLimitBackoff,
-	RATE_LIMIT_SHORT_RETRY_THRESHOLD_MS,
 	resetRateLimitBackoff,
 } from "./lib/request/rate-limit-backoff.js";
 import { isEmptyResponse } from "./lib/request/response-handler.js";
 import { addJitter } from "./lib/rotation.js";
+import {
+	decideRetryAllAccountsRateLimited,
+	type RetryAllAccountsRateLimitDecisionReason,
+} from "./lib/request/retry-governor.js";
 import { SessionAffinityStore } from "./lib/session-affinity.js";
 import { LiveAccountSync } from "./lib/live-account-sync.js";
 import { RefreshGuardian } from "./lib/refresh-guardian.js";
@@ -170,8 +194,14 @@ import {
 import {
 	PreemptiveQuotaScheduler,
 	readQuotaSchedulerSnapshot,
+	type QuotaSchedulerSnapshot,
 } from "./lib/preemptive-quota-scheduler.js";
 import { CapabilityPolicyStore } from "./lib/capability-policy.js";
+import {
+	loadQuotaCache,
+	type QuotaCacheData,
+	type QuotaCacheEntry,
+} from "./lib/quota-cache.js";
 import { withStreamingFailover } from "./lib/request/stream-failover.js";
 import { buildTableHeader, buildTableRow, type TableOptions } from "./lib/table-formatter.js";
 import { setUiRuntimeOptions, type UiRuntimeOptions } from "./lib/ui/runtime.js";
@@ -202,6 +232,7 @@ import {
 	createHashlineReadTool,
 } from "./lib/tools/hashline-tools.js";
 import { registerCleanup } from "./lib/shutdown.js";
+import { enforceDataRetention } from "./lib/data-retention.js";
 
 /**
  * OpenAI Codex OAuth authentication plugin for Codex CLI host runtime
@@ -222,6 +253,13 @@ import { registerCleanup } from "./lib/shutdown.js";
 // eslint-disable-next-line @typescript-eslint/require-await
 export const OpenAIOAuthPlugin: Plugin = async ({ client }: PluginInput) => {
 	initLogger(client);
+	void withAccountStorageTransaction(async () => {
+		await enforceDataRetention();
+	}).catch((error) => {
+		logWarn("Data retention cleanup failed", {
+			error: error instanceof Error ? error.message : String(error),
+		});
+	});
 	let cachedAccountManager: AccountManager | null = null;
 	let accountManagerPromise: Promise<AccountManager> | null = null;
 	let loaderMutex: Promise<void> | null = null;
@@ -259,6 +297,36 @@ export const OpenAIOAuthPlugin: Plugin = async ({ client }: PluginInput) => {
 		return "balanced";
 	};
 
+	const exchangeAuthorizationCodeWithRateLimit = async (
+		code: string,
+		verifier: string,
+		redirectUri: string,
+		options?: Parameters<typeof exchangeAuthorizationCode>[3],
+	): Promise<TokenResult> => {
+		try {
+			const rateLimitKey = "oauth:code-exchange";
+			checkAuthRateLimit(rateLimitKey);
+			recordAuthAttempt(rateLimitKey);
+			const tokens = await exchangeAuthorizationCode(
+				code,
+				verifier,
+				redirectUri,
+				options,
+			);
+			if (tokens.type === "success") {
+				resetAuthRateLimit(rateLimitKey);
+			}
+			return tokens;
+		} catch (error) {
+			const err = error instanceof Error ? error : new Error(String(error));
+			return {
+				type: "failed",
+				reason: "http_error",
+				message: err.message,
+			};
+		}
+	};
+
 		const parseEnvInt = (value: string | undefined): number | undefined => {
 			if (value === undefined) return undefined;
 			const parsed = Number.parseInt(value, 10);
@@ -300,6 +368,237 @@ export const OpenAIOAuthPlugin: Plugin = async ({ client }: PluginInput) => {
 			return null;
 		};
 
+	const QUOTA_CACHE_BOOTSTRAP_TTL_MS = 30 * 60_000;
+	const QUOTA_CACHE_BOOTSTRAP_MIN_WAIT_MS = 1_000;
+	const QUOTA_CACHE_BOOTSTRAP_FAILURE_COOLDOWN_MS = 60_000;
+	let quotaCacheBootstrapData: QuotaCacheData | null = null;
+	let quotaCacheBootstrapLoadedAt = 0;
+	let quotaCacheBootstrapFailureUntil = 0;
+	let quotaCacheBootstrapLoadPromise: Promise<QuotaCacheData> | null = null;
+
+	type QuotaBootstrapAccountCandidate = {
+		index: number;
+		accountId?: string;
+		email?: string;
+	};
+
+	const normalizeQuotaCacheEmail = (value: string | undefined): string | null => {
+		const normalized = sanitizeEmail(value);
+		if (typeof normalized === "string" && normalized.trim().length > 0) {
+			return normalized.trim().toLowerCase();
+		}
+		if (typeof value !== "string") return null;
+		const fallback = value.trim().toLowerCase();
+		return fallback.length > 0 ? fallback : null;
+	};
+
+	const normalizeQuotaCacheModelId = (value: string | undefined): string | null => {
+		if (typeof value !== "string") return null;
+		const trimmed = value.trim();
+		if (trimmed.length === 0) return null;
+		const withoutProvider = trimmed.includes("/") ? (trimmed.split("/").pop() ?? trimmed) : trimmed;
+		const normalized = withoutProvider.trim().toLowerCase();
+		return normalized.length > 0 ? normalized : null;
+	};
+
+	const buildQuotaScheduleKey = (
+		account: { accountId?: string; email?: string } | string,
+		model: string | undefined,
+		modelFamily: ModelFamily,
+	): string => {
+		const accountKey =
+			typeof account === "string" ? account : resolveEntitlementAccountKey(account);
+		const normalizedModel = normalizeQuotaCacheModelId(model) ?? modelFamily;
+		return `${accountKey}:${normalizedModel}`;
+	};
+
+	const createEmptyQuotaCache = (): QuotaCacheData => ({ byAccountId: {}, byEmail: {} });
+
+	const getQuotaCacheEntryForCandidate = (
+		cache: QuotaCacheData,
+		candidate: QuotaBootstrapAccountCandidate,
+	): QuotaCacheEntry | null => {
+		if (candidate.accountId) {
+			const byAccountId = cache.byAccountId[candidate.accountId];
+			if (byAccountId) return byAccountId;
+		}
+		const email = normalizeQuotaCacheEmail(candidate.email);
+		if (!email) return null;
+		return cache.byEmail[email] ?? null;
+	};
+
+	const getQuotaCacheEntryFutureResetAtMs = (
+		entry: QuotaCacheEntry,
+		now: number,
+	): number | null => {
+		const candidates = [entry.primary.resetAtMs, entry.secondary.resetAtMs]
+			.filter((value): value is number =>
+				typeof value === "number" && Number.isFinite(value) && value > now,
+			);
+		if (candidates.length === 0) return null;
+		return Math.max(...candidates);
+	};
+
+	const getQuotaCacheBootstrapWaitMs = (
+		entry: QuotaCacheEntry,
+		now: number,
+	): number => {
+		const futureResetAtMs = getQuotaCacheEntryFutureResetAtMs(entry, now);
+		if (typeof futureResetAtMs === "number") {
+			return Math.max(0, Math.floor(futureResetAtMs - now));
+		}
+		const hasKnownResetTime =
+			typeof entry.primary.resetAtMs === "number" ||
+			typeof entry.secondary.resetAtMs === "number";
+		if (hasKnownResetTime) {
+			return 0;
+		}
+		const maxAgeUntil = entry.updatedAt + QUOTA_CACHE_BOOTSTRAP_TTL_MS;
+		if (!Number.isFinite(maxAgeUntil) || maxAgeUntil <= now) {
+			return 0;
+		}
+		return Math.max(0, Math.floor(maxAgeUntil - now));
+	};
+
+	const isQuotaCacheEntryExhausted = (entry: QuotaCacheEntry): boolean => {
+		const primaryUsedPercent = entry.primary.usedPercent;
+		if (typeof primaryUsedPercent === "number" && Number.isFinite(primaryUsedPercent)) {
+			if (primaryUsedPercent >= 100) return true;
+		}
+		const secondaryUsedPercent = entry.secondary.usedPercent;
+		if (typeof secondaryUsedPercent === "number" && Number.isFinite(secondaryUsedPercent)) {
+			if (secondaryUsedPercent >= 100) return true;
+		}
+		return false;
+	};
+
+	const shouldApplyQuotaCacheEntry = (
+		entry: QuotaCacheEntry,
+		now: number,
+	): boolean => {
+		const isRateLimited = entry.status === 429;
+		if (!isRateLimited && !isQuotaCacheEntryExhausted(entry)) {
+			return false;
+		}
+		return getQuotaCacheBootstrapWaitMs(entry, now) > 0;
+	};
+
+	const toQuotaSchedulerSnapshot = (entry: QuotaCacheEntry): QuotaSchedulerSnapshot => ({
+		status: entry.status,
+		primary: {
+			usedPercent: entry.primary.usedPercent,
+			resetAtMs: entry.primary.resetAtMs,
+		},
+		secondary: {
+			usedPercent: entry.secondary.usedPercent,
+			resetAtMs: entry.secondary.resetAtMs,
+		},
+		updatedAt: entry.updatedAt,
+	});
+
+	const loadQuotaCacheForBootstrap = async (): Promise<QuotaCacheData> => {
+		const now = Date.now();
+		if (quotaCacheBootstrapData && now - quotaCacheBootstrapLoadedAt < QUOTA_CACHE_BOOTSTRAP_TTL_MS) {
+			return quotaCacheBootstrapData;
+		}
+		if (now < quotaCacheBootstrapFailureUntil) {
+			return createEmptyQuotaCache();
+		}
+		if (quotaCacheBootstrapLoadPromise) {
+			return quotaCacheBootstrapLoadPromise;
+		}
+		quotaCacheBootstrapLoadPromise = (async () => {
+			try {
+				const loaded = await loadQuotaCache();
+				quotaCacheBootstrapData = loaded;
+				quotaCacheBootstrapLoadedAt = Date.now();
+				quotaCacheBootstrapFailureUntil = 0;
+				return loaded;
+			} catch (error) {
+				const failureAt = Date.now();
+				quotaCacheBootstrapData = null;
+				quotaCacheBootstrapLoadedAt = 0;
+				quotaCacheBootstrapFailureUntil = failureAt + QUOTA_CACHE_BOOTSTRAP_FAILURE_COOLDOWN_MS;
+				logWarn(
+					`[${PLUGIN_NAME}] failed to load quota cache bootstrap data: ${
+						error instanceof Error ? error.message : String(error)
+					}`,
+				);
+				return createEmptyQuotaCache();
+			}
+		})();
+		try {
+			return await quotaCacheBootstrapLoadPromise;
+		} finally {
+			quotaCacheBootstrapLoadPromise = null;
+		}
+	};
+
+	const applyQuotaCacheBootstrapForModel = async (
+		accountManager: AccountManager,
+		accountSnapshots: QuotaBootstrapAccountCandidate[],
+		modelFamily: ModelFamily,
+		model: string | undefined,
+		enabled: boolean,
+	): Promise<void> => {
+		if (!enabled || accountSnapshots.length === 0) return;
+		const cache = await loadQuotaCacheForBootstrap();
+		const now = Date.now();
+		const requestedModel = normalizeQuotaCacheModelId(model);
+		const baseKey = getQuotaKey(modelFamily);
+
+		for (const snapshotCandidate of accountSnapshots) {
+			const entry = getQuotaCacheEntryForCandidate(cache, snapshotCandidate);
+			if (!entry) continue;
+			const entryModel = normalizeQuotaCacheModelId(entry.model);
+			if (!entryModel) continue;
+			if (getModelFamily(entryModel) !== modelFamily) {
+				continue;
+			}
+			if (requestedModel && entryModel !== requestedModel) {
+				continue;
+			}
+			if (!shouldApplyQuotaCacheEntry(entry, now)) {
+				continue;
+			}
+			const appliedModel = requestedModel ?? entryModel;
+			const appliedModelKey = getQuotaKey(modelFamily, appliedModel);
+
+			const waitMs = Math.max(
+				QUOTA_CACHE_BOOTSTRAP_MIN_WAIT_MS,
+				getQuotaCacheBootstrapWaitMs(entry, now),
+			);
+			const account = accountManager.getAccountByIndex(snapshotCandidate.index);
+			if (!account) continue;
+			account.rateLimitResetTimes = account.rateLimitResetTimes ?? {};
+
+			const existingBaseResetAt = account.rateLimitResetTimes[baseKey] ?? 0;
+			const existingModelResetAt = account.rateLimitResetTimes[appliedModelKey] ?? 0;
+			const existingResetAt = Math.max(existingBaseResetAt, existingModelResetAt);
+			const nextResetAt = now + waitMs;
+			if (existingResetAt >= nextResetAt) {
+				continue;
+			}
+
+			accountManager.markRateLimitedWithReason(
+				account,
+				waitMs,
+				modelFamily,
+				"quota",
+				appliedModel,
+			);
+			const quotaScheduleKey = buildQuotaScheduleKey(
+				snapshotCandidate,
+				requestedModel ?? undefined,
+				modelFamily,
+			);
+			preemptiveQuotaScheduler.update(
+				quotaScheduleKey,
+				toQuotaSchedulerSnapshot(entry),
+			);
+		}
+	};
+
 	const sanitizeResponseHeadersForLog = (headers: Headers): Record<string, string> => {
 		const allowed = new Set([
 			"content-type",
@@ -328,6 +627,16 @@ export const OpenAIOAuthPlugin: Plugin = async ({ client }: PluginInput) => {
 		return sanitized;
 	};
 
+	const toSafeAuditResource = (rawUrl: unknown): string => {
+		try {
+			const parsed = new URL(String(rawUrl));
+			return `${parsed.origin}${parsed.pathname}`;
+		} catch {
+			const sanitized = String(rawUrl).split(/[?#]/, 1)[0];
+			return sanitized && sanitized.length > 0 ? sanitized : "unknown";
+		}
+	};
+
 	type RuntimeMetrics = {
 		startedAt: number;
 		totalRequests: number;
@@ -344,6 +653,9 @@ export const OpenAIOAuthPlugin: Plugin = async ({ client }: PluginInput) => {
 		streamFailoverAttempts: number;
 		streamFailoverRecoveries: number;
 		streamFailoverCrossAccountRecoveries: number;
+		retryGovernorStopsWaitExceedsMax: number;
+		retryGovernorStopsRetryLimitReached: number;
+		retryGovernorStopsAbsoluteCeilingExceeded: number;
 		cumulativeLatencyMs: number;
 		lastRequestAt: number | null;
 		lastError: string | null;
@@ -365,11 +677,32 @@ export const OpenAIOAuthPlugin: Plugin = async ({ client }: PluginInput) => {
 		streamFailoverAttempts: 0,
 		streamFailoverRecoveries: 0,
 		streamFailoverCrossAccountRecoveries: 0,
+		retryGovernorStopsWaitExceedsMax: 0,
+		retryGovernorStopsRetryLimitReached: 0,
+		retryGovernorStopsAbsoluteCeilingExceeded: 0,
 		cumulativeLatencyMs: 0,
 		lastRequestAt: null,
 		lastError: null,
 	};
 
+	const recordRetryGovernorStopReason = (
+		reason: RetryAllAccountsRateLimitDecisionReason,
+	): void => {
+		switch (reason) {
+			case "wait-exceeds-max":
+				runtimeMetrics.retryGovernorStopsWaitExceedsMax += 1;
+				return;
+			case "retry-limit-reached":
+				runtimeMetrics.retryGovernorStopsRetryLimitReached += 1;
+				return;
+			case "absolute-ceiling-exceeded":
+				runtimeMetrics.retryGovernorStopsAbsoluteCeilingExceeded += 1;
+				return;
+			default:
+				return;
+		}
+	};
+
         type TokenSuccess = Extract<TokenResult, { type: "success" }>;
         type TokenSuccessWithAccount = TokenSuccess & {
                 accountIdOverride?: string;
@@ -422,6 +755,10 @@ export const OpenAIOAuthPlugin: Plugin = async ({ client }: PluginInput) => {
                 };
         };
 
+        const resolveOAuthFetchTimeoutMs = (): number => {
+                return getFetchTimeoutMs(loadPluginConfig());
+        };
+
         const buildManualOAuthFlow = (
                 pkce: { verifier: string },
                 url: string,
@@ -460,11 +797,13 @@ export const OpenAIOAuthPlugin: Plugin = async ({ client }: PluginInput) => {
                                         message: "OAuth state mismatch. Restart login and try again.",
                                 };
                         }
-                        const tokens = await exchangeAuthorizationCode(
-                                parsed.code,
-                                pkce.verifier,
-                                REDIRECT_URI,
-                        );
+						const oauthFetchTimeoutMs = resolveOAuthFetchTimeoutMs();
+						const tokens = await exchangeAuthorizationCodeWithRateLimit(
+							parsed.code,
+							pkce.verifier,
+							REDIRECT_URI,
+							{ timeoutMs: oauthFetchTimeoutMs },
+						);
                         if (tokens?.type === "success") {
                                 const resolved = resolveAccountSelection(tokens);
                                 if (onSuccess) {
@@ -509,10 +848,12 @@ export const OpenAIOAuthPlugin: Plugin = async ({ client }: PluginInput) => {
 			return { type: "failed" as const, reason: "unknown" as const, message: "OAuth callback timeout or cancelled" };
 		}
 
-                return await exchangeAuthorizationCode(
+                const oauthFetchTimeoutMs = resolveOAuthFetchTimeoutMs();
+                return await exchangeAuthorizationCodeWithRateLimit(
                         result.code,
                         pkce.verifier,
                         REDIRECT_URI,
+                        { timeoutMs: oauthFetchTimeoutMs },
                 );
         };
 
@@ -676,21 +1017,6 @@ export const OpenAIOAuthPlugin: Plugin = async ({ client }: PluginInput) => {
                 }
         };
 
-		const resolveActiveIndex = (
-				storage: {
-						activeIndex: number;
-						activeIndexByFamily?: Partial<Record<ModelFamily, number>>;
-						accounts: unknown[];
-				},
-				family: ModelFamily = "codex",
-		): number => {
-				const total = storage.accounts.length;
-				if (total === 0) return 0;
-				const rawCandidate = storage.activeIndexByFamily?.[family] ?? storage.activeIndex;
-				const raw = Number.isFinite(rawCandidate) ? rawCandidate : 0;
-				return Math.max(0, Math.min(raw, total - 1));
-		};
-
 	const hydrateEmails = async (
 			storage: AccountStorageV3 | null,
 	): Promise<AccountStorageV3 | null> => {
@@ -755,40 +1081,6 @@ export const OpenAIOAuthPlugin: Plugin = async ({ client }: PluginInput) => {
                 return storage;
         };
 
-		const getRateLimitResetTimeForFamily = (
-				account: { rateLimitResetTimes?: Record<string, number | undefined> },
-				now: number,
-				family: ModelFamily,
-		): number | null => {
-				const times = account.rateLimitResetTimes;
-				if (!times) return null;
-
-				let minReset: number | null = null;
-				const prefix = `${family}:`;
-				for (const [key, value] of Object.entries(times)) {
-						if (typeof value !== "number") continue;
-						if (value <= now) continue;
-						if (key !== family && !key.startsWith(prefix)) continue;
-						if (minReset === null || value < minReset) {
-								minReset = value;
-						}
-				}
-
-				return minReset;
-		};
-
-		const formatRateLimitEntry = (
-				account: { rateLimitResetTimes?: Record<string, number | undefined> },
-				now: number,
-				family: ModelFamily = "codex",
-		): string | null => {
-				const resetAt = getRateLimitResetTimeForFamily(account, now, family);
-				if (typeof resetAt !== "number") return null;
-				const remaining = resetAt - now;
-				if (remaining <= 0) return null;
-				return `resets in ${formatWaitTime(remaining)}`;
-		};
-
 		const applyUiRuntimeFromConfig = (
 			pluginConfig: ReturnType<typeof loadPluginConfig>,
 		): UiRuntimeOptions => {
@@ -999,11 +1291,7 @@ export const OpenAIOAuthPlugin: Plugin = async ({ client }: PluginInput) => {
                                         account.lastUsed = now;
                                         account.lastSwitchReason = "rotation";
                                 }
-                                storage.activeIndex = index;
-                                storage.activeIndexByFamily = storage.activeIndexByFamily ?? {};
-                                for (const family of MODEL_FAMILIES) {
-                                        storage.activeIndexByFamily[family] = index;
-                                }
+                                setActiveIndexForAllFamilies(storage, index);
 
                                 await saveAccounts(storage);
 				if (cachedAccountManager) {
@@ -1124,6 +1412,8 @@ export const OpenAIOAuthPlugin: Plugin = async ({ client }: PluginInput) => {
 				const retryAllAccountsRateLimited = getRetryAllAccountsRateLimited(pluginConfig);
 				const retryAllAccountsMaxWaitMs = getRetryAllAccountsMaxWaitMs(pluginConfig);
 				const retryAllAccountsMaxRetries = getRetryAllAccountsMaxRetries(pluginConfig);
+				const retryAllAccountsAbsoluteCeilingMs =
+					getRetryAllAccountsAbsoluteCeilingMs(pluginConfig);
 				const unsupportedCodexPolicy = getUnsupportedCodexPolicy(pluginConfig);
 				const fallbackOnUnsupportedCodexModel = unsupportedCodexPolicy === "fallback";
 				const fallbackToGpt52OnUnsupportedGpt53 =
@@ -1135,6 +1425,8 @@ export const OpenAIOAuthPlugin: Plugin = async ({ client }: PluginInput) => {
 				const streamStallTimeoutMs = getStreamStallTimeoutMs(pluginConfig);
 				const networkErrorCooldownMs = getNetworkErrorCooldownMs(pluginConfig);
 				const serverErrorCooldownMs = getServerErrorCooldownMs(pluginConfig);
+				const quotaCacheBootstrapEnabled =
+					(process.env.CODEX_AUTH_QUOTA_CACHE_BOOTSTRAP ?? "1").trim() !== "0";
 				const failoverMode = parseFailoverMode(process.env.CODEX_AUTH_FAILOVER_MODE);
 				const streamFailoverMax = Math.max(
 					0,
@@ -1159,6 +1451,20 @@ export const OpenAIOAuthPlugin: Plugin = async ({ client }: PluginInput) => {
 				const emptyResponseMaxRetries = getEmptyResponseMaxRetries(pluginConfig);
 				const emptyResponseRetryDelayMs = getEmptyResponseRetryDelayMs(pluginConfig);
 				const pidOffsetEnabled = getPidOffsetEnabled(pluginConfig);
+				const telemetryEnabled = getTelemetryEnabled(pluginConfig);
+				const emitPluginTelemetry = (
+					event: string,
+					outcome: "start" | "success" | "failure" | "recovery" | "info",
+					details?: Record<string, unknown>,
+				): void => {
+					if (!telemetryEnabled) return;
+					void recordTelemetryEvent({
+						source: "plugin",
+						event,
+						outcome,
+						details,
+					});
+				};
 				const effectiveUserConfig = fastSessionEnabled
 					? applyFastSessionDefaults(userConfig)
 					: userConfig;
@@ -1397,6 +1703,7 @@ export const OpenAIOAuthPlugin: Plugin = async ({ client }: PluginInput) => {
 					};
 
 							let allRateLimitedRetries = 0;
+							let accumulatedAllRateLimitedWaitMs = 0;
 							let emptyResponseRetries = 0;
 							const attemptedUnsupportedFallbackModels = new Set<string>();
 							if (model) {
@@ -1439,6 +1746,13 @@ export const OpenAIOAuthPlugin: Plugin = async ({ client }: PluginInput) => {
 												}
 											}
 										}
+										await applyQuotaCacheBootstrapForModel(
+											accountManager,
+											accountSnapshotList,
+											modelFamily,
+											model ?? undefined,
+											quotaCacheBootstrapEnabled,
+										);
 										for (const candidate of accountSnapshotList) {
 											const accountKey = resolveEntitlementAccountKey(candidate);
 											capabilityBoostByAccount[candidate.index] = capabilityPolicyStore.getBoost(
@@ -1503,6 +1817,12 @@ while (attempted.size < Math.max(1, accountCount)) {
 				runtimeMetrics.failedRequests++;
 				runtimeMetrics.accountRotations++;
 				runtimeMetrics.lastError = (err as Error)?.message ?? String(err);
+				emitPluginTelemetry("request.auth_refresh_failed", "failure", {
+					accountIndex: account.index + 1,
+					modelFamily,
+					model,
+					error: (err as Error)?.message ?? String(err),
+				});
 				const failures = accountManager.incrementAuthFailures(account);
 				const accountLabel = formatAccountLabel(account, account.index);
 
@@ -1602,9 +1922,14 @@ while (attempted.size < Math.max(1, accountCount)) {
 									{
 										model,
 										promptCacheKey: effectivePromptCacheKey,
+										idempotencyKey: requestCorrelationId,
 									},
 								);
-								const quotaScheduleKey = `${entitlementAccountKey}:${model ?? modelFamily}`;
+								const quotaScheduleKey = buildQuotaScheduleKey(
+									entitlementAccountKey,
+									model,
+									modelFamily,
+								);
 								const capabilityModelKey = model ?? modelFamily;
 								const quotaDeferral = preemptiveQuotaScheduler.getDeferral(quotaScheduleKey);
 								if (quotaDeferral.defer && quotaDeferral.waitMs > 0) {
@@ -1661,9 +1986,21 @@ while (attempted.size < Math.max(1, accountCount)) {
 								} else if (abortSignal && onUserAbort) {
 									abortSignal.addEventListener("abort", onUserAbort, { once: true });
 								}
+								const safeAuditResource = toSafeAuditResource(url);
 
 							try {
 								runtimeMetrics.totalRequests++;
+								auditLog(
+									AuditAction.REQUEST_START,
+									account.email ?? `account-${account.index + 1}`,
+									safeAuditResource,
+									AuditOutcome.SUCCESS,
+									{
+										model,
+										accountIndex: account.index + 1,
+										modelFamily,
+									},
+								);
 								response = await fetch(url, {
 									...requestInit,
 									headers,
@@ -1688,11 +2025,31 @@ while (attempted.size < Math.max(1, accountCount)) {
 										);
 									}
 								const errorMsg = networkError instanceof Error ? networkError.message : String(networkError);
+								const networkErrorType =
+									networkError instanceof Error ? networkError.name : "unknown_error";
 								logWarn(`Network error for account ${account.index + 1}: ${errorMsg}`);
+								auditLog(
+									AuditAction.REQUEST_FAILURE,
+									account.email ?? `account-${account.index + 1}`,
+									safeAuditResource,
+									AuditOutcome.FAILURE,
+									{
+										model,
+										accountIndex: account.index + 1,
+										errorType: networkErrorType,
+										stage: "network",
+									},
+								);
 								runtimeMetrics.failedRequests++;
 								runtimeMetrics.networkErrors++;
 								runtimeMetrics.accountRotations++;
 								runtimeMetrics.lastError = errorMsg;
+								emitPluginTelemetry("request.network_error", "failure", {
+									accountIndex: account.index + 1,
+									modelFamily,
+									model,
+									error: errorMsg,
+								});
 								const policy = evaluateFailurePolicy(
 									{ kind: "network", failoverMode },
 									{ networkCooldownMs: networkErrorCooldownMs },
@@ -1961,6 +2318,12 @@ while (attempted.size < Math.max(1, accountCount)) {
 							runtimeMetrics.serverErrors++;
 							runtimeMetrics.accountRotations++;
 							runtimeMetrics.lastError = `HTTP ${response.status}`;
+							emitPluginTelemetry("request.server_error", "failure", {
+								accountIndex: account.index + 1,
+								modelFamily,
+								model,
+								status: response.status,
+							});
 							const serverRetryAfterMs = parseRetryAfterHintMs(response.headers);
 							const policy = evaluateFailurePolicy(
 								{ kind: "server", failoverMode, serverRetryAfterMs: serverRetryAfterMs ?? undefined },
@@ -2005,83 +2368,68 @@ while (attempted.size < Math.max(1, accountCount)) {
 					}
 
 					if (rateLimit) {
-																														runtimeMetrics.rateLimitedResponses++;
-																															const { attempt, delayMs } = getRateLimitBackoff(
-																																account.index,
-																																quotaKey,
-																																rateLimit.retryAfterMs,
-																															);
-																															preemptiveQuotaScheduler.markRateLimited(
-																																quotaScheduleKey,
-																																delayMs,
-																															);
-																															const waitLabel = formatWaitTime(delayMs);
-
-																														if (delayMs <= RATE_LIMIT_SHORT_RETRY_THRESHOLD_MS) {
-																																if (
-																																	accountManager.shouldShowAccountToast(
-																																		account.index,
-																																		rateLimitToastDebounceMs,
-																																		)
-																																) {
-																									await showToast(
-																										`Rate limited. Retrying in ${waitLabel} (attempt ${attempt})...`,
-																										"warning",
-																										{ duration: toastDurationMs },
-																									);
-																																			accountManager.markToastShown(account.index);
-								}
-
-															await sleep(addJitter(Math.max(MIN_BACKOFF_MS, delayMs), 0.2));
-															continue;
-																																}
-
-				accountManager.markRateLimitedWithReason(
-					account,
-					delayMs,
-					modelFamily,
-					parseRateLimitReason(rateLimit.code),
-					model,
-				);
-				accountManager.recordRateLimit(account, modelFamily, model);
-				account.lastSwitchReason = "rate-limit";
-				sessionAffinityStore?.forgetSession(sessionAffinityKey);
-				runtimeMetrics.accountRotations++;
-				accountManager.saveToDiskDebounced();
+						runtimeMetrics.rateLimitedResponses++;
+						const { attempt, delayMs } = getRateLimitBackoff(
+							account.index,
+							quotaKey,
+							rateLimit.retryAfterMs,
+						);
+						preemptiveQuotaScheduler.markRateLimited(
+							quotaScheduleKey,
+							delayMs,
+						);
+						const waitLabel = formatWaitTime(delayMs);
+						accountManager.markRateLimitedWithReason(
+							account,
+							delayMs,
+							modelFamily,
+							parseRateLimitReason(rateLimit.code),
+							model,
+						);
+						accountManager.recordRateLimit(account, modelFamily, model);
+						account.lastSwitchReason = "rate-limit";
+						sessionAffinityStore?.forgetSession(sessionAffinityKey);
+						runtimeMetrics.accountRotations++;
+						accountManager.saveToDiskDebounced();
 						logWarn(
 							`Rate limited. Rotating account ${account.index + 1} (${account.email ?? "unknown"}).`,
 						);
-
-																														if (
-																															accountManager.getAccountCount() > 1 &&
-																															accountManager.shouldShowAccountToast(
-																																account.index,
-																																rateLimitToastDebounceMs,
-																																)
-																														) {
-																									await showToast(
-																										`Rate limited. Switching accounts (retry in ${waitLabel}).`,
-																										"warning",
-																										{ duration: toastDurationMs },
-																									);
-																																	accountManager.markToastShown(account.index);
-																																}
-																															break;
-																														}
-																														if (
-																															!rateLimit &&
-																															!unsupportedModelInfo.isUnsupported &&
-																															errorResponse.status !== 403
-																														) {
-																															capabilityPolicyStore.recordFailure(
-																																entitlementAccountKey,
-																																capabilityModelKey,
-																															);
-																														}
-																														runtimeMetrics.failedRequests++;
-																														runtimeMetrics.lastError = `HTTP ${response.status}`;
-																														return errorResponse;
-																											}
+						if (
+							accountManager.getAccountCount() > 1 &&
+							accountManager.shouldShowAccountToast(
+								account.index,
+								rateLimitToastDebounceMs,
+							)
+						) {
+							await showToast(
+								`Rate limited. Switching accounts (retry in ${waitLabel}, attempt ${attempt}).`,
+								"warning",
+								{ duration: toastDurationMs },
+							);
+							accountManager.markToastShown(account.index);
+						}
+						break;
+					}
+					if (
+						!rateLimit &&
+						!unsupportedModelInfo.isUnsupported &&
+						errorResponse.status !== 403
+					) {
+						capabilityPolicyStore.recordFailure(
+							entitlementAccountKey,
+							capabilityModelKey,
+						);
+					}
+					runtimeMetrics.failedRequests++;
+					runtimeMetrics.lastError = `HTTP ${response.status}`;
+					emitPluginTelemetry("request.http_error", "failure", {
+						accountIndex: account.index + 1,
+						modelFamily,
+						model,
+						status: response.status,
+					});
+					return errorResponse;
+				}
 
 						resetRateLimitBackoff(account.index, quotaKey);
 						runtimeMetrics.cumulativeLatencyMs += fetchLatencyMs;
@@ -2164,6 +2512,7 @@ while (attempted.size < Math.max(1, accountCount)) {
 											{
 												model,
 												promptCacheKey: effectivePromptCacheKey,
+												idempotencyKey: requestCorrelationId,
 											},
 										);
 
@@ -2197,7 +2546,11 @@ while (attempted.size < Math.max(1, accountCount)) {
 											);
 											if (fallbackSnapshot) {
 												preemptiveQuotaScheduler.update(
-													`${resolveEntitlementAccountKey(fallbackAccount)}:${model ?? modelFamily}`,
+													buildQuotaScheduleKey(
+														fallbackAccount,
+														model,
+														modelFamily,
+													),
 													fallbackSnapshot,
 												);
 											}
@@ -2243,6 +2596,14 @@ while (attempted.size < Math.max(1, accountCount)) {
 												`Recovered stream via failover attempt ${failoverAttempt} using account ${fallbackAccount.index + 1}.`,
 												{ emittedBytes },
 											);
+											emitPluginTelemetry("request.stream_failover_recovered", "recovery", {
+												accountIndex: fallbackAccount.index + 1,
+												fromAccountIndex: account.index + 1,
+												failoverAttempt,
+												emittedBytes,
+												modelFamily,
+												model,
+											});
 											return fallbackResponse;
 										} catch (streamFailoverError) {
 											accountManager.refundToken(fallbackAccount, modelFamily, model);
@@ -2257,10 +2618,21 @@ while (attempted.size < Math.max(1, accountCount)) {
 													emittedBytes,
 													error:
 														streamFailoverError instanceof Error
-															? streamFailoverError.message
-															: String(streamFailoverError),
+														? streamFailoverError.message
+														: String(streamFailoverError),
 												},
 											);
+											emitPluginTelemetry("request.stream_failover_attempt_failed", "failure", {
+												accountIndex: fallbackAccount.index + 1,
+												failoverAttempt,
+												emittedBytes,
+												modelFamily,
+												model,
+												error:
+													streamFailoverError instanceof Error
+														? streamFailoverError.message
+														: String(streamFailoverError),
+											});
 											continue;
 										} finally {
 											clearTimeout(fallbackTimeoutId);
@@ -2350,7 +2722,27 @@ while (attempted.size < Math.max(1, accountCount)) {
 							successAccountForResponse.index,
 						);
 					runtimeMetrics.successfulRequests++;
+					auditLog(
+						AuditAction.REQUEST_SUCCESS,
+						successAccountForResponse.email ?? `account-${successAccountForResponse.index + 1}`,
+						safeAuditResource,
+						AuditOutcome.SUCCESS,
+						{
+							model,
+							accountIndex: successAccountForResponse.index + 1,
+							latencyMs: fetchLatencyMs,
+							modelFamily,
+						},
+					);
 					runtimeMetrics.lastError = null;
+					if (sameAccountRetryCount > 0) {
+						emitPluginTelemetry("request.recovered_after_retry", "recovery", {
+							accountIndex: successAccountForResponse.index + 1,
+							retryCount: sameAccountRetryCount,
+							modelFamily,
+							model,
+						});
+					}
 					if (lastCodexCliActiveSyncIndex !== successAccountForResponse.index) {
 						void accountManager.syncCodexCliActiveSelectionForIndex(successAccountForResponse.index);
 						lastCodexCliActiveSyncIndex = successAccountForResponse.index;
@@ -2368,20 +2760,53 @@ while (attempted.size < Math.max(1, accountCount)) {
 
 										const waitMs = accountManager.getMinWaitTimeForFamily(modelFamily, model);
 										const count = accountManager.getAccountCount();
+										const jitteredWaitMs = waitMs > 0 ? addJitter(waitMs, 0.2) : 0;
+										const remainingCeilingMs =
+											retryAllAccountsAbsoluteCeilingMs > 0
+												? Math.max(
+														0,
+														retryAllAccountsAbsoluteCeilingMs - accumulatedAllRateLimitedWaitMs,
+													)
+												: Number.POSITIVE_INFINITY;
+										const plannedWaitMs = Math.min(jitteredWaitMs, remainingCeilingMs);
+										const retryDecision = decideRetryAllAccountsRateLimited({
+											enabled: retryAllAccountsRateLimited,
+											accountCount: count,
+											waitMs,
+											plannedWaitMs,
+											maxWaitMs: retryAllAccountsMaxWaitMs,
+											currentRetryCount: allRateLimitedRetries,
+											maxRetries: retryAllAccountsMaxRetries,
+											accumulatedWaitMs: accumulatedAllRateLimitedWaitMs,
+											absoluteCeilingMs: retryAllAccountsAbsoluteCeilingMs,
+										});
 
-								if (
-									retryAllAccountsRateLimited &&
-									count > 0 &&
-									waitMs > 0 &&
-									(retryAllAccountsMaxWaitMs === 0 ||
-										waitMs <= retryAllAccountsMaxWaitMs) &&
-									allRateLimitedRetries < retryAllAccountsMaxRetries
-								) {
+								if (retryDecision.shouldRetry) {
 									const countdownMessage = `All ${count} account(s) rate-limited. Waiting`;
-									await sleepWithCountdown(addJitter(waitMs, 0.2), countdownMessage);
+									await sleepWithCountdown(plannedWaitMs, countdownMessage);
 									allRateLimitedRetries++;
+									accumulatedAllRateLimitedWaitMs += plannedWaitMs;
 									continue;
 								}
+								recordRetryGovernorStopReason(retryDecision.reason);
+								if (
+									retryDecision.reason !== "disabled" &&
+									retryDecision.reason !== "no-accounts" &&
+									retryDecision.reason !== "no-wait"
+								) {
+									logDebug("Retry governor blocked all-rate-limited retry", {
+										reason: retryDecision.reason,
+										accountCount: count,
+										waitMs,
+										jitteredWaitMs,
+										plannedWaitMs,
+										retryCount: allRateLimitedRetries,
+										accumulatedWaitMs: accumulatedAllRateLimitedWaitMs,
+										maxWaitMs: retryAllAccountsMaxWaitMs,
+										maxRetries: retryAllAccountsMaxRetries,
+										absoluteCeilingMs: retryAllAccountsAbsoluteCeilingMs,
+									});
+								}
 
 								const waitLabel = waitMs > 0 ? formatWaitTime(waitMs) : "a bit";
 								const message =
@@ -2392,6 +2817,26 @@ while (attempted.size < Math.max(1, accountCount)) {
 											: `All ${count} account(s) failed (server errors or auth issues). Check account health with \`codex-health\`.`;
 								runtimeMetrics.failedRequests++;
 								runtimeMetrics.lastError = message;
+								const safePluginAuditResource = toSafeAuditResource(url);
+								auditLog(
+									AuditAction.REQUEST_FAILURE,
+									"plugin",
+									safePluginAuditResource,
+									AuditOutcome.FAILURE,
+									{
+										model,
+										accountCount: count,
+										message,
+										waitMs,
+									},
+								);
+								emitPluginTelemetry("request.accounts_exhausted", "failure", {
+									accountCount: count,
+									waitMs,
+									modelFamily,
+									model,
+									status: waitMs > 0 ? 429 : 503,
+								});
 								return new Response(JSON.stringify({ error: { message } }), {
 									status: waitMs > 0 ? 429 : 503,
 											headers: {
@@ -2432,20 +2877,9 @@ while (attempted.size < Math.max(1, accountCount)) {
 							let refreshAccountIndex: number | undefined;
 
 							const clampActiveIndices = (storage: AccountStorageV3): void => {
-								const count = storage.accounts.length;
-								if (count === 0) {
-									storage.activeIndex = 0;
-									storage.activeIndexByFamily = {};
-									return;
-								}
-								storage.activeIndex = Math.max(0, Math.min(storage.activeIndex, count - 1));
-								storage.activeIndexByFamily = storage.activeIndexByFamily ?? {};
-								for (const family of MODEL_FAMILIES) {
-									const raw = storage.activeIndexByFamily[family];
-									const candidate =
-										typeof raw === "number" && Number.isFinite(raw) ? raw : storage.activeIndex;
-									storage.activeIndexByFamily[family] = Math.max(0, Math.min(candidate, count - 1));
-								}
+								normalizeActiveIndexByFamily(storage, storage.accounts.length, {
+									clearFamilyMapWhenEmpty: true,
+								});
 							};
 
 							const isFlaggableFailure = (failure: Extract<TokenResult, { type: "failed" }>): boolean => {
@@ -2706,14 +3140,8 @@ while (attempted.size < Math.max(1, accountCount)) {
 							const runAccountCheck = async (deepProbe: boolean): Promise<void> => {
 								const loadedStorage = await hydrateEmails(await loadAccounts());
 								const workingStorage = loadedStorage
-									? {
-										...loadedStorage,
-										accounts: loadedStorage.accounts.map((account) => ({ ...account })),
-										activeIndexByFamily: loadedStorage.activeIndexByFamily
-											? { ...loadedStorage.activeIndexByFamily }
-											: {},
-									}
-									: { version: 3 as const, accounts: [], activeIndex: 0, activeIndexByFamily: {} };
+									? cloneAccountStorage(loadedStorage)
+									: createEmptyAccountStorage();
 
 								if (workingStorage.accounts.length === 0) {
 									console.log("\nNo accounts to check.\n");
@@ -3059,14 +3487,8 @@ while (attempted.size < Math.max(1, accountCount)) {
 								while (true) {
 									const loadedStorage = await hydrateEmails(await loadAccounts());
 									const workingStorage = loadedStorage
-										? {
-											...loadedStorage,
-											accounts: loadedStorage.accounts.map((account) => ({ ...account })),
-											activeIndexByFamily: loadedStorage.activeIndexByFamily
-												? { ...loadedStorage.activeIndexByFamily }
-												: {},
-										}
-										: { version: 3 as const, accounts: [], activeIndex: 0, activeIndexByFamily: {} };
+										? cloneAccountStorage(loadedStorage)
+										: createEmptyAccountStorage();
 									const flaggedStorage = await loadFlaggedAccounts();
 
 									if (workingStorage.accounts.length === 0 && flaggedStorage.accounts.length === 0) {
@@ -3566,11 +3988,7 @@ while (attempted.size < Math.max(1, accountCount)) {
                                                 account.lastSwitchReason = "rotation";
                                         }
 
-					storage.activeIndex = targetIndex;
-					storage.activeIndexByFamily = storage.activeIndexByFamily ?? {};
-					for (const family of MODEL_FAMILIES) {
-							storage.activeIndexByFamily[family] = targetIndex;
-					}
+					setActiveIndexForAllFamilies(storage, targetIndex);
 					try {
 						await saveAccounts(storage);
 					} catch (saveError) {
@@ -3647,21 +4065,14 @@ while (attempted.size < Math.max(1, accountCount)) {
 
 					lines.push("");
 					lines.push(...formatUiSection(ui, "Active index by model family"));
-					for (const family of MODEL_FAMILIES) {
-						const idx = storage.activeIndexByFamily?.[family];
-						const familyIndexLabel =
-							typeof idx === "number" && Number.isFinite(idx) ? String(idx + 1) : "-";
-						lines.push(formatUiItem(ui, `${family}: ${familyIndexLabel}`));
+					for (const line of formatActiveIndexByFamilyLabels(storage.activeIndexByFamily)) {
+						lines.push(formatUiItem(ui, line));
 					}
 
 					lines.push("");
 					lines.push(...formatUiSection(ui, "Rate limits by model family (per account)"));
 					storage.accounts.forEach((account, index) => {
-						const statuses = MODEL_FAMILIES.map((family) => {
-							const resetAt = getRateLimitResetTimeForFamily(account, now, family);
-							if (typeof resetAt !== "number") return `${family}=ok`;
-							return `${family}=${formatWaitTime(resetAt - now)}`;
-						});
+						const statuses = formatRateLimitStatusByFamily(account, now);
 						lines.push(formatUiItem(ui, `Account ${index + 1}: ${statuses.join(" | ")}`));
 					});
 
@@ -3700,21 +4111,14 @@ while (attempted.size < Math.max(1, accountCount)) {
 
 										lines.push("");
 										lines.push("Active index by model family:");
-										for (const family of MODEL_FAMILIES) {
-												const idx = storage.activeIndexByFamily?.[family];
-												const familyIndexLabel =
-													typeof idx === "number" && Number.isFinite(idx) ? String(idx + 1) : "-";
-												lines.push(`  ${family}: ${familyIndexLabel}`);
+										for (const line of formatActiveIndexByFamilyLabels(storage.activeIndexByFamily)) {
+												lines.push(`  ${line}`);
 										}
 
 										lines.push("");
 										lines.push("Rate limits by model family (per account):");
 										storage.accounts.forEach((account, index) => {
-												const statuses = MODEL_FAMILIES.map((family) => {
-														const resetAt = getRateLimitResetTimeForFamily(account, now, family);
-														if (typeof resetAt !== "number") return `${family}=ok`;
-														return `${family}=${formatWaitTime(resetAt - now)}`;
-												});
+												const statuses = formatRateLimitStatusByFamily(account, now);
 												lines.push(`  Account ${index + 1}: ${statuses.join(" | ")}`);
 										});
 
@@ -3763,6 +4167,9 @@ while (attempted.size < Math.max(1, accountCount)) {
 						`Stream failover attempts: ${runtimeMetrics.streamFailoverAttempts}`,
 						`Stream failover recoveries: ${runtimeMetrics.streamFailoverRecoveries}`,
 						`Stream failover cross-account recoveries: ${runtimeMetrics.streamFailoverCrossAccountRecoveries}`,
+						`Retry governor stops (wait>max): ${runtimeMetrics.retryGovernorStopsWaitExceedsMax}`,
+						`Retry governor stops (retry limit): ${runtimeMetrics.retryGovernorStopsRetryLimitReached}`,
+						`Retry governor stops (absolute ceiling): ${runtimeMetrics.retryGovernorStopsAbsoluteCeilingExceeded}`,
 						`Empty-response retries: ${runtimeMetrics.emptyResponseRetries}`,
 						`Session affinity entries: ${sessionAffinityEntries}`,
 						`Live sync: ${liveSyncSnapshot?.running ? "on" : "off"} (${liveSyncSnapshot?.reloadCount ?? 0} reloads)`,
@@ -3798,6 +4205,24 @@ while (attempted.size < Math.max(1, accountCount)) {
 								String(runtimeMetrics.streamFailoverCrossAccountRecoveries),
 								"accent",
 							),
+							formatUiKeyValue(
+								ui,
+								"Retry governor stops (wait>max)",
+								String(runtimeMetrics.retryGovernorStopsWaitExceedsMax),
+								"warning",
+							),
+							formatUiKeyValue(
+								ui,
+								"Retry governor stops (retry limit)",
+								String(runtimeMetrics.retryGovernorStopsRetryLimitReached),
+								"warning",
+							),
+							formatUiKeyValue(
+								ui,
+								"Retry governor stops (absolute ceiling)",
+								String(runtimeMetrics.retryGovernorStopsAbsoluteCeilingExceeded),
+								"warning",
+							),
 							formatUiKeyValue(ui, "Empty-response retries", String(runtimeMetrics.emptyResponseRetries), "warning"),
 							formatUiKeyValue(ui, "Session affinity entries", String(sessionAffinityEntries), "muted"),
 							formatUiKeyValue(
@@ -3933,31 +4358,7 @@ while (attempted.size < Math.max(1, accountCount)) {
 
 					const label = formatAccountLabel(account, targetIndex);
 
-					storage.accounts.splice(targetIndex, 1);
-
-					if (storage.accounts.length === 0) {
-						storage.activeIndex = 0;
-						storage.activeIndexByFamily = {};
-					} else {
-						if (storage.activeIndex >= storage.accounts.length) {
-							storage.activeIndex = 0;
-						} else if (storage.activeIndex > targetIndex) {
-							storage.activeIndex -= 1;
-						}
-
-						if (storage.activeIndexByFamily) {
-							for (const family of MODEL_FAMILIES) {
-								const idx = storage.activeIndexByFamily[family];
-								if (typeof idx === "number") {
-									if (idx >= storage.accounts.length) {
-										storage.activeIndexByFamily[family] = 0;
-									} else if (idx > targetIndex) {
-										storage.activeIndexByFamily[family] = idx - 1;
-									}
-								}
-							}
-						}
-					}
+					removeAccountAndReconcileActiveIndexes(storage, targetIndex);
 
 					try {
 					await saveAccounts(storage);
diff --git a/lib/accounts.ts b/lib/accounts.ts
index 40fe38da0..2134ef86c 100644
--- a/lib/accounts.ts
+++ b/lib/accounts.ts
@@ -16,13 +16,14 @@ import {
 	type AccountWithMetrics,
 	type HybridSelectionOptions,
 } from "./rotation.js";
-import { nowMs } from "./utils.js";
+import { isRecord, nowMs, sleep } from "./utils.js";
 import {
 	loadCodexCliState,
 	type CodexCliTokenCacheEntry,
 } from "./codex-cli/state.js";
 import { syncAccountStorageFromCodexCli } from "./codex-cli/sync.js";
 import { setCodexCliActiveSelection } from "./codex-cli/writer.js";
+import { runBackgroundJobWithRetry } from "./background-jobs.js";
 
 export {
 	extractAccountId,
@@ -72,6 +73,8 @@ import {
 } from "./accounts/rate-limits.js";
 
 const log = createLogger("accounts");
+type StoredAccount = AccountStorageV3["accounts"][number];
+const DISK_PREFERRED_MERGE_KEYS = new Set(["refreshToken", "accessToken", "expiresAt"]);
 
 function initFamilyState(defaultValue: number): Record<ModelFamily, number> {
 	return Object.fromEntries(
@@ -724,7 +727,7 @@ export class AccountManager {
 		return account;
 	}
 
-	async saveToDisk(): Promise<void> {
+	private buildStorageSnapshot(): AccountStorageV3 {
 		const activeIndexByFamily: Partial<Record<ModelFamily, number>> = {};
 		for (const family of MODEL_FAMILIES) {
 			const raw = this.currentAccountIndexByFamily[family];
@@ -755,8 +758,197 @@ export class AccountManager {
 			activeIndex,
 			activeIndexByFamily,
 		};
+		return storage;
+	}
+
+	private isStorageConflictError(error: unknown): boolean {
+		const code = (error as NodeJS.ErrnoException | undefined)?.code;
+		return code === "ECONFLICT";
+	}
+
+	private mergeIntoLatestStorage(
+		latest: AccountStorageV3 | null,
+		local: AccountStorageV3,
+	): AccountStorageV3 {
+		if (!latest) {
+			return local;
+		}
+
+		const mergedAccounts = latest.accounts.map((account) => ({ ...account }));
+		const claimIndex = (candidate: StoredAccount): number => {
+			const token = candidate.refreshToken.trim();
+			const accountId = candidate.accountId?.trim();
+			const email = sanitizeEmail(candidate.email);
+
+			const byToken = mergedAccounts.findIndex(
+				(account) => account.refreshToken.trim() === token,
+			);
+			if (byToken >= 0) return byToken;
+
+			if (accountId) {
+				const byAccountId = mergedAccounts.findIndex(
+					(account) => (account.accountId?.trim() ?? "") === accountId,
+				);
+				if (byAccountId >= 0) return byAccountId;
+			}
+
+			if (email) {
+				const byEmail = mergedAccounts.findIndex(
+					(account) => sanitizeEmail(account.email) === email,
+				);
+				if (byEmail >= 0) return byEmail;
+			}
+
+			return -1;
+		};
+
+		for (const account of local.accounts) {
+			const idx = claimIndex(account);
+			if (idx >= 0) {
+				const current = mergedAccounts[idx];
+				if (current) {
+					mergedAccounts[idx] = this.mergeStoredAccountRecords(current, account);
+				}
+			} else {
+				mergedAccounts.push({ ...account });
+			}
+		}
+
+		const localActiveTokensByFamily = Object.fromEntries(
+			MODEL_FAMILIES.map((family) => {
+				const localIndex = local.activeIndexByFamily?.[family];
+				const token =
+					typeof localIndex === "number" && localIndex >= 0
+						? local.accounts[localIndex]?.refreshToken
+						: undefined;
+				return [family, token];
+			}),
+		) as Partial<Record<ModelFamily, string | undefined>>;
+
+		const mergedActiveIndexByFamily: Partial<Record<ModelFamily, number>> = {};
+		for (const family of MODEL_FAMILIES) {
+			const token = localActiveTokensByFamily[family];
+			if (token) {
+				const index = mergedAccounts.findIndex(
+					(account) => account.refreshToken === token,
+				);
+				if (index >= 0) {
+					mergedActiveIndexByFamily[family] = index;
+					continue;
+				}
+			}
+			mergedActiveIndexByFamily[family] = clampNonNegativeInt(
+				latest.activeIndexByFamily?.[family],
+				0,
+			);
+		}
+
+		return {
+			version: 3,
+			accounts: mergedAccounts,
+			activeIndex: clampNonNegativeInt(mergedActiveIndexByFamily.codex, 0),
+			activeIndexByFamily: mergedActiveIndexByFamily,
+		};
+	}
+
+	private mergeStoredAccountRecords(current: StoredAccount, incoming: StoredAccount): StoredAccount {
+		const next: StoredAccount = { ...current };
+		const nextRecord = next as unknown as Record<string, unknown>;
+		for (const [rawKey, rawValue] of Object.entries(incoming)) {
+			const value = rawValue as unknown;
+			if (value === undefined) {
+				continue;
+			}
+			const currentValue = nextRecord[rawKey];
+			if (DISK_PREFERRED_MERGE_KEYS.has(rawKey) && currentValue !== undefined) {
+				continue;
+			}
+			if (
+				(rawKey === "lastUsed" || rawKey === "addedAt" || rawKey === "coolingDownUntil") &&
+				typeof currentValue === "number" &&
+				typeof value === "number"
+			) {
+				nextRecord[rawKey] = Math.max(currentValue, value);
+				continue;
+			}
+			if (rawKey === "rateLimitResetTimes" && isRecord(currentValue) && isRecord(value)) {
+				const mergedRateLimits: Record<string, unknown> = { ...currentValue };
+				for (const [resetKey, resetValue] of Object.entries(value)) {
+					if (resetValue === undefined) {
+						continue;
+					}
+					const existingResetValue = mergedRateLimits[resetKey];
+					if (typeof existingResetValue === "number" && typeof resetValue === "number") {
+						mergedRateLimits[resetKey] = Math.max(existingResetValue, resetValue);
+						continue;
+					}
+					mergedRateLimits[resetKey] = resetValue;
+				}
+				nextRecord[rawKey] = mergedRateLimits;
+				continue;
+			}
+			if (isRecord(currentValue) && isRecord(value)) {
+				nextRecord[rawKey] = {
+					...currentValue,
+					...value,
+				};
+				continue;
+			}
+			nextRecord[rawKey] = value;
+		}
+		return next;
+	}
+
+	private applyPersistedStorageSnapshot(storage: AccountStorageV3): void {
+		const previousByRefreshToken = new Map(
+			this.accounts.map((account) => [account.refreshToken, account] as const),
+		);
+		const rehydrated = new AccountManager(undefined, storage);
+		this.accounts = rehydrated.accounts.map((account) => {
+			const previous = previousByRefreshToken.get(account.refreshToken);
+			if (!previous) {
+				return account;
+			}
+			return {
+				...account,
+				lastRateLimitReason: previous.lastRateLimitReason,
+				consecutiveAuthFailures: previous.consecutiveAuthFailures,
+			};
+		});
+		this.cursorByFamily = { ...rehydrated.cursorByFamily };
+		this.currentAccountIndexByFamily = {
+			...rehydrated.currentAccountIndexByFamily,
+		};
+	}
+
+	private async persistStorageWithConflictRecovery(storage?: AccountStorageV3): Promise<void> {
+		const maxAttempts = 3;
+		const baseStorage = storage ?? this.buildStorageSnapshot();
+		let mergedCandidate = baseStorage;
+		for (let attempt = 0; attempt < maxAttempts; attempt += 1) {
+			try {
+				await saveAccounts(mergedCandidate);
+				if (attempt > 0) {
+					this.applyPersistedStorageSnapshot(mergedCandidate);
+				}
+				return;
+			} catch (error) {
+				if (!this.isStorageConflictError(error) || attempt + 1 >= maxAttempts) {
+					throw error;
+				}
+				log.warn("Account save conflict detected; retrying with merged disk snapshot", {
+					attempt: attempt + 1,
+					maxAttempts,
+				});
+				const latest = await loadAccounts();
+				mergedCandidate = this.mergeIntoLatestStorage(latest, baseStorage);
+				await sleep(20 * 2 ** attempt);
+			}
+		}
+	}
 
-		await saveAccounts(storage);
+	async saveToDisk(): Promise<void> {
+		await this.persistStorageWithConflictRecovery(this.buildStorageSnapshot());
 	}
 
 	saveToDiskDebounced(delayMs = 500): void {
@@ -768,9 +960,25 @@ export class AccountManager {
 			const doSave = async () => {
 				try {
 					if (this.pendingSave) {
-						await this.pendingSave;
+						try {
+							await this.pendingSave;
+						} catch (error) {
+							log.warn("Previous debounced save failed", {
+								error: error instanceof Error ? error.message : String(error),
+							});
+						}
 					}
-					this.pendingSave = this.saveToDisk().finally(() => {
+					this.pendingSave = runBackgroundJobWithRetry({
+						name: "accounts.saveToDiskDebounced",
+						task: () => this.saveToDisk(),
+						context: {
+							accountCount: this.accounts.length,
+							activeIndexByFamily: { ...this.currentAccountIndexByFamily },
+						},
+						maxAttempts: 4,
+						baseDelayMs: 50,
+						maxDelayMs: 1_000,
+					}).finally(() => {
 						this.pendingSave = null;
 					});
 					await this.pendingSave;
diff --git a/lib/accounts/account-view.ts b/lib/accounts/account-view.ts
new file mode 100644
index 000000000..4fec3153c
--- /dev/null
+++ b/lib/accounts/account-view.ts
@@ -0,0 +1,82 @@
+import { MODEL_FAMILIES, type ModelFamily } from "../prompts/codex.js";
+import { formatWaitTime } from "./rate-limits.js";
+
+export interface ActiveAccountStorageView {
+	activeIndex: number;
+	activeIndexByFamily?: Partial<Record<ModelFamily, number>>;
+	accounts: unknown[];
+}
+
+export interface AccountRateLimitView {
+	rateLimitResetTimes?: Record<string, number | undefined>;
+}
+
+export type ActiveIndexByFamilyView = Partial<Record<ModelFamily, number>> | undefined;
+
+export function resolveActiveIndex(
+	storage: ActiveAccountStorageView,
+	family: ModelFamily = "codex",
+): number {
+	const total = storage.accounts.length;
+	if (total === 0) return 0;
+	const rawCandidate = storage.activeIndexByFamily?.[family] ?? storage.activeIndex;
+	const raw = Number.isFinite(rawCandidate) ? rawCandidate : 0;
+	return Math.max(0, Math.min(raw, total - 1));
+}
+
+export function getRateLimitResetTimeForFamily(
+	account: AccountRateLimitView,
+	now: number,
+	family: ModelFamily,
+): number | null {
+	const times = account.rateLimitResetTimes;
+	if (!times) return null;
+
+	let minReset: number | null = null;
+	const prefix = `${family}:`;
+	for (const [key, value] of Object.entries(times)) {
+		if (typeof value !== "number") continue;
+		if (value <= now) continue;
+		if (key !== family && !key.startsWith(prefix)) continue;
+		if (minReset === null || value < minReset) {
+			minReset = value;
+		}
+	}
+
+	return minReset;
+}
+
+export function formatRateLimitEntry(
+	account: AccountRateLimitView,
+	now: number,
+	family: ModelFamily = "codex",
+): string | null {
+	const resetAt = getRateLimitResetTimeForFamily(account, now, family);
+	if (typeof resetAt !== "number") return null;
+	const remaining = resetAt - now;
+	if (remaining <= 0) return null;
+	return `resets in ${formatWaitTime(remaining)}`;
+}
+
+export function formatRateLimitStatusByFamily(
+	account: AccountRateLimitView,
+	now: number,
+	families: readonly ModelFamily[] = MODEL_FAMILIES,
+): string[] {
+	return families.map((family) => {
+		const resetAt = getRateLimitResetTimeForFamily(account, now, family);
+		if (typeof resetAt !== "number") return `${family}=ok`;
+		return `${family}=${formatWaitTime(resetAt - now)}`;
+	});
+}
+
+export function formatActiveIndexByFamilyLabels(
+	activeIndexByFamily: ActiveIndexByFamilyView,
+	families: readonly ModelFamily[] = MODEL_FAMILIES,
+): string[] {
+	return families.map((family) => {
+		const idx = activeIndexByFamily?.[family];
+		const label = typeof idx === "number" && Number.isFinite(idx) ? String(idx + 1) : "-";
+		return `${family}: ${label}`;
+	});
+}
diff --git a/lib/accounts/active-index.ts b/lib/accounts/active-index.ts
new file mode 100644
index 000000000..e0bbb8aff
--- /dev/null
+++ b/lib/accounts/active-index.ts
@@ -0,0 +1,124 @@
+import { MODEL_FAMILIES, type ModelFamily } from "../prompts/codex.js";
+
+export interface ActiveIndexFamilyStorage {
+	activeIndex: number;
+	activeIndexByFamily?: Partial<Record<ModelFamily, number>>;
+}
+
+export interface AccountListActiveIndexStorage extends ActiveIndexFamilyStorage {
+	accounts: unknown[];
+}
+
+interface NormalizeActiveIndexOptions {
+	clearFamilyMapWhenEmpty?: boolean;
+	families?: readonly ModelFamily[];
+}
+
+function clampIndex(index: number, count: number): number {
+	if (count <= 0) return 0;
+	return Math.max(0, Math.min(index, count - 1));
+}
+
+export function createActiveIndexByFamily(
+	index: number,
+	families: readonly ModelFamily[] = MODEL_FAMILIES,
+): Partial<Record<ModelFamily, number>> {
+	const byFamily: Partial<Record<ModelFamily, number>> = {};
+	for (const family of families) {
+		byFamily[family] = index;
+	}
+	return byFamily;
+}
+
+export function setActiveIndexForAllFamilies(
+	storage: ActiveIndexFamilyStorage,
+	index: number,
+	families: readonly ModelFamily[] = MODEL_FAMILIES,
+): void {
+	storage.activeIndex = index;
+	storage.activeIndexByFamily = storage.activeIndexByFamily ?? {};
+	for (const family of families) {
+		storage.activeIndexByFamily[family] = index;
+	}
+}
+
+export function normalizeActiveIndexByFamily(
+	storage: ActiveIndexFamilyStorage,
+	accountCount: number,
+	options: NormalizeActiveIndexOptions = {},
+): boolean {
+	const families = options.families ?? MODEL_FAMILIES;
+	const clearFamilyMapWhenEmpty = options.clearFamilyMapWhenEmpty === true;
+	let changed = false;
+
+	const nextActiveIndex = clampIndex(storage.activeIndex, accountCount);
+	if (storage.activeIndex !== nextActiveIndex) {
+		storage.activeIndex = nextActiveIndex;
+		changed = true;
+	}
+
+	if (accountCount === 0 && clearFamilyMapWhenEmpty) {
+		const hadKeys = !!storage.activeIndexByFamily && Object.keys(storage.activeIndexByFamily).length > 0;
+		if (storage.activeIndexByFamily === undefined || hadKeys) {
+			storage.activeIndexByFamily = {};
+			changed = true;
+		}
+		return changed;
+	}
+
+	if (!storage.activeIndexByFamily) {
+		storage.activeIndexByFamily = {};
+		changed = true;
+	}
+
+	for (const family of families) {
+		const raw = storage.activeIndexByFamily[family];
+		const fallback = storage.activeIndex;
+		const candidate = typeof raw === "number" && Number.isFinite(raw) ? raw : fallback;
+		const nextValue = accountCount === 0 ? 0 : clampIndex(candidate, accountCount);
+		if (storage.activeIndexByFamily[family] !== nextValue) {
+			storage.activeIndexByFamily[family] = nextValue;
+			changed = true;
+		}
+	}
+
+	return changed;
+}
+
+export function removeAccountAndReconcileActiveIndexes(
+	storage: AccountListActiveIndexStorage,
+	targetIndex: number,
+	families: readonly ModelFamily[] = MODEL_FAMILIES,
+): boolean {
+	if (targetIndex < 0 || targetIndex >= storage.accounts.length) {
+		return false;
+	}
+
+	storage.accounts.splice(targetIndex, 1);
+
+	if (storage.accounts.length === 0) {
+		storage.activeIndex = 0;
+		storage.activeIndexByFamily = {};
+		return true;
+	}
+
+	if (storage.activeIndex >= storage.accounts.length) {
+		storage.activeIndex = 0;
+	} else if (storage.activeIndex > targetIndex) {
+		storage.activeIndex -= 1;
+	}
+
+	if (storage.activeIndexByFamily) {
+		for (const family of families) {
+			const idx = storage.activeIndexByFamily[family];
+			if (typeof idx !== "number") continue;
+			if (idx >= storage.accounts.length) {
+				storage.activeIndexByFamily[family] = 0;
+			} else if (idx > targetIndex) {
+				storage.activeIndexByFamily[family] = idx - 1;
+			}
+		}
+	}
+
+	return true;
+}
diff --git a/lib/accounts/storage-view.ts b/lib/accounts/storage-view.ts
new file mode 100644
index 000000000..ef5feb4b9
--- /dev/null
+++ b/lib/accounts/storage-view.ts
@@ -0,0 +1,29 @@
+import type { AccountStorageV3 } from "../storage.js";
+import { createActiveIndexByFamily } from "./active-index.js";
+
+interface CreateEmptyAccountStorageOptions {
+	initializeFamilyIndexes?: boolean;
+}
+
+export function createEmptyAccountStorage(
+	options: CreateEmptyAccountStorageOptions = {},
+): AccountStorageV3 {
+	const initializeFamilyIndexes = options.initializeFamilyIndexes === true;
+	return {
+		version: 3,
+		accounts: [],
+		activeIndex: 0,
+		activeIndexByFamily: initializeFamilyIndexes ? createActiveIndexByFamily(0) : {},
+	};
+}
+
+export function cloneAccountStorage(storage: AccountStorageV3): AccountStorageV3 {
+	return {
+		version: 3,
+		accounts: storage.accounts.map((account) => ({ ...account })),
+		activeIndex: storage.activeIndex,
+		activeIndexByFamily: storage.activeIndexByFamily
+			? { ...storage.activeIndexByFamily }
+			: {},
+	};
+}
diff --git a/lib/audit.ts b/lib/audit.ts
index 937640228..8cd72357e 100644
--- a/lib/audit.ts
+++ b/lib/audit.ts
@@ -1,4 +1,13 @@
-import { writeFileSync, mkdirSync, existsSync, statSync, renameSync, readdirSync, unlinkSync } from "node:fs";
+import {
+	chmodSync,
+	writeFileSync,
+	mkdirSync,
+	existsSync,
+	statSync,
+	renameSync,
+	readdirSync,
+	unlinkSync,
+} from "node:fs";
 import { join } from "node:path";
 import { getCorrelationId, maskEmail } from "./logger.js";
 import { getCodexLogDir } from "./runtime-paths.js";
@@ -14,6 +23,7 @@ export enum AuditAction {
 	AUTH_LOGOUT = "auth.logout",
 	AUTH_REFRESH = "auth.refresh",
 	AUTH_FAILURE = "auth.failure",
+	AUTH_BREAK_GLASS = "auth.break_glass",
 	CONFIG_LOAD = "config.load",
 	CONFIG_CHANGE = "config.change",
 	REQUEST_START = "request.start",
@@ -21,6 +31,7 @@ export enum AuditAction {
 	REQUEST_FAILURE = "request.failure",
 	CIRCUIT_OPEN = "circuit.open",
 	CIRCUIT_CLOSE = "circuit.close",
+	COMMAND_RUN = "command.run",
 }
 
 export enum AuditOutcome {
@@ -44,19 +55,26 @@ export interface AuditConfig {
 	logDir: string;
 	maxFileSizeBytes: number;
 	maxFiles: number;
+	retentionDays: number;
 }
 
+const DEFAULT_AUDIT_RETENTION_DAYS = 90;
+const RETRYABLE_AUDIT_FS_CODES = new Set(["EBUSY", "EPERM", "EAGAIN"]);
+const PURGE_INTERVAL_MS = 60 * 60 * 1000;
 const DEFAULT_CONFIG: AuditConfig = {
 	enabled: true,
 	logDir: getCodexLogDir(),
 	maxFileSizeBytes: 10 * 1024 * 1024,
 	maxFiles: 5,
+	retentionDays: DEFAULT_AUDIT_RETENTION_DAYS,
 };
 
 let auditConfig: AuditConfig = { ...DEFAULT_CONFIG };
+let lastPurgeAttemptMs = 0;
 
 export function configureAudit(config: Partial<AuditConfig>): void {
 	auditConfig = { ...auditConfig, ...config };
+	lastPurgeAttemptMs = 0;
 }
 
 export function getAuditConfig(): AuditConfig {
@@ -93,6 +111,57 @@ function rotateLogsIfNeeded(): void {
 	}
 }
 
+function isRetryableAuditFsError(error: unknown): boolean {
+	const maybeCode = (error as NodeJS.ErrnoException).code;
+	return typeof maybeCode === "string" && RETRYABLE_AUDIT_FS_CODES.has(maybeCode);
+}
+
+function withRetryableAuditFsOperation<T>(operation: () => T): T {
+	let lastError: unknown;
+	for (let attempt = 0; attempt < 5; attempt += 1) {
+		try {
+			return operation();
+		} catch (error) {
+			lastError = error;
+			if (!isRetryableAuditFsError(error) || attempt === 4) {
+				throw error;
+			}
+		}
+	}
+	throw lastError;
+}
+
+function purgeExpiredLogs(): void {
+	const nowMs = Date.now();
+	if (nowMs - lastPurgeAttemptMs < PURGE_INTERVAL_MS) {
+		return;
+	}
+	const retentionDays =
+		Number.isFinite(auditConfig.retentionDays) && auditConfig.retentionDays >= 1
+			? Math.floor(auditConfig.retentionDays)
+			: DEFAULT_AUDIT_RETENTION_DAYS;
+	const cutoffMs = nowMs - retentionDays * 24 * 60 * 60 * 1000;
+	let files: string[] = [];
+	try {
+		files = withRetryableAuditFsOperation(() => readdirSync(auditConfig.logDir));
+	} catch {
+		return;
+	}
+	lastPurgeAttemptMs = nowMs;
+	for (const file of files) {
+		if (!file.startsWith("audit") || !file.endsWith(".log")) continue;
+		const target = join(auditConfig.logDir, file);
+		try {
+			const stats = withRetryableAuditFsOperation(() => statSync(target));
+			if (stats.mtimeMs < cutoffMs) {
+				withRetryableAuditFsOperation(() => unlinkSync(target));
+			}
+		} catch {
+			// Best-effort purge.
+		}
+	}
+}
+
 function sanitizeActor(actor: string): string {
 	if (actor.includes("@")) {
 		return maskEmail(actor);
@@ -131,6 +200,7 @@ export function auditLog(
 	try {
 		ensureLogDir();
 		rotateLogsIfNeeded();
+		purgeExpiredLogs();
 
 		const entry: AuditEntry = {
 			timestamp: new Date().toISOString(),
@@ -144,8 +214,17 @@ export function auditLog(
 
 		const logPath = getLogFilePath();
 		const line = JSON.stringify(entry) + "\n";
-		
-		writeFileSync(logPath, line, { flag: "a" });
+
+		withRetryableAuditFsOperation(() =>
+			writeFileSync(logPath, line, { encoding: "utf8", flag: "a", mode: 0o600 }),
+		);
+		if (process.platform !== "win32") {
+			try {
+				withRetryableAuditFsOperation(() => chmodSync(logPath, 0o600));
+			} catch {
+				// Best-effort hardening.
+			}
+		}
 	} catch {
 		// Audit logging should never break the application
 	}
diff --git a/lib/auth/auth.ts b/lib/auth/auth.ts
index 591a68ec2..408c8abbb 100644
--- a/lib/auth/auth.ts
+++ b/lib/auth/auth.ts
@@ -3,7 +3,7 @@ import { randomBytes } from "node:crypto";
 import type { PKCEPair, AuthorizationFlow, TokenResult, ParsedAuthInput, JWTPayload } from "../types.js";
 import { logError } from "../logger.js";
 import { safeParseOAuthTokenResponse } from "../schemas.js";
-import { isAbortError } from "../utils.js";
+import { fetchWithTimeout, isAbortError } from "../utils.js";
 
 // OAuth constants (from openai/codex)
 export const CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
@@ -11,6 +11,7 @@ export const AUTHORIZE_URL = "https://auth.openai.com/oauth/authorize";
 export const TOKEN_URL = "https://auth.openai.com/oauth/token";
 export const REDIRECT_URI = "http://localhost:1455/auth/callback";
 export const SCOPE = "openid profile email offline_access";
+const DEFAULT_OAUTH_EXCHANGE_TIMEOUT_MS = 60_000;
 
 const OAUTH_SENSITIVE_QUERY_PARAMS = [
 	"state",
@@ -18,6 +19,7 @@ const OAUTH_SENSITIVE_QUERY_PARAMS = [
 	"code_challenge",
 	"code_verifier",
 ] as const;
+const OAUTH_REFRESH_TIMEOUT_MS = 30_000;
 
 function getOAuthResponseLogMetadata(rawResponse: unknown): Record<string, unknown> {
 	if (Array.isArray(rawResponse)) {
@@ -111,50 +113,134 @@ export function parseAuthorizationInput(input: string): ParsedAuthInput {
  * @param redirectUri - OAuth redirect URI
  * @returns Token result
  */
+export type ExchangeAuthorizationCodeOptions = {
+	signal?: AbortSignal;
+	timeoutMs?: number;
+};
+
+function resolveExchangeTimeoutMs(timeoutMs: number | undefined): number {
+	if (typeof timeoutMs !== "number" || !Number.isFinite(timeoutMs)) {
+		return DEFAULT_OAUTH_EXCHANGE_TIMEOUT_MS;
+	}
+	return Math.max(1_000, Math.floor(timeoutMs));
+}
+
+function createAbortError(message: string): Error & { code?: string } {
+	const error = new Error(message) as Error & { code?: string };
+	error.name = "AbortError";
+	error.code = "ABORT_ERR";
+	return error;
+}
+
+function buildExchangeAbortContext(
+	options: ExchangeAuthorizationCodeOptions,
+): { signal: AbortSignal; cleanup: () => void } {
+	const controller = new AbortController();
+	const timeoutMs = resolveExchangeTimeoutMs(options.timeoutMs);
+	const upstreamSignal = options.signal;
+	let timeoutId: ReturnType<typeof setTimeout> | undefined;
+
+	const onUpstreamAbort = () => {
+		const reason = upstreamSignal?.reason;
+		controller.abort(
+			reason instanceof Error ? reason : createAbortError("Request aborted"),
+		);
+	};
+
+	if (upstreamSignal) {
+		upstreamSignal.addEventListener("abort", onUpstreamAbort, { once: true });
+		if (upstreamSignal.aborted) {
+			onUpstreamAbort();
+		}
+	}
+
+	if (!controller.signal.aborted) {
+		timeoutId = setTimeout(() => {
+			controller.abort(
+				createAbortError(
+					`OAuth token exchange timed out after ${timeoutMs}ms`,
+				),
+			);
+		}, timeoutMs);
+	}
+
+	return {
+		signal: controller.signal,
+		cleanup: () => {
+			if (timeoutId !== undefined) {
+				clearTimeout(timeoutId);
+			}
+			if (upstreamSignal) {
+				upstreamSignal.removeEventListener("abort", onUpstreamAbort);
+			}
+		},
+	};
+}
+
 export async function exchangeAuthorizationCode(
 	code: string,
 	verifier: string,
 	redirectUri: string = REDIRECT_URI,
+	options: ExchangeAuthorizationCodeOptions = {},
 ): Promise<TokenResult> {
-	const res = await fetch(TOKEN_URL, {
-		method: "POST",
-		headers: { "Content-Type": "application/x-www-form-urlencoded" },
-		body: new URLSearchParams({
-			grant_type: "authorization_code",
-			client_id: CLIENT_ID,
-			code,
-			code_verifier: verifier,
-			redirect_uri: redirectUri,
-		}),
-	});
-	if (!res.ok) {
-		const text = await res.text().catch(() => "");
-		logError(`code->token failed: ${res.status} ${text}`);
-		return { type: "failed", reason: "http_error", statusCode: res.status, message: text || undefined };
-	}
-	const rawJson = (await res.json()) as unknown;
-	const json = safeParseOAuthTokenResponse(rawJson);
-	if (!json) {
-		logError("token response validation failed", getOAuthResponseLogMetadata(rawJson));
-		return { type: "failed", reason: "invalid_response", message: "Response failed schema validation" };
-	}
-	if (!json.refresh_token || json.refresh_token.trim().length === 0) {
-		logError("token response missing refresh token", getOAuthResponseLogMetadata(rawJson));
+	const abortContext = buildExchangeAbortContext(options);
+	try {
+		const res = await fetch(TOKEN_URL, {
+			method: "POST",
+			headers: { "Content-Type": "application/x-www-form-urlencoded" },
+			signal: abortContext.signal,
+			body: new URLSearchParams({
+				grant_type: "authorization_code",
+				client_id: CLIENT_ID,
+				code,
+				code_verifier: verifier,
+				redirect_uri: redirectUri,
+			}),
+		});
+		if (!res.ok) {
+			const text = await res.text().catch(() => "");
+			logError("code->token failed", { status: res.status, bodyLength: text.length });
+			return {
+				type: "failed",
+				reason: "http_error",
+				statusCode: res.status,
+				message: text ? "OAuth token exchange failed" : undefined,
+			};
+		}
+		const rawJson = (await res.json()) as unknown;
+		const json = safeParseOAuthTokenResponse(rawJson);
+		if (!json) {
+			logError("token response validation failed", getOAuthResponseLogMetadata(rawJson));
+			return { type: "failed", reason: "invalid_response", message: "Response failed schema validation" };
+		}
+		if (!json.refresh_token || json.refresh_token.trim().length === 0) {
+			logError("token response missing refresh token", getOAuthResponseLogMetadata(rawJson));
+			return {
+				type: "failed",
+				reason: "invalid_response",
+				message: "Missing refresh token in authorization code exchange response",
+			};
+		}
+		const normalizedRefreshToken = json.refresh_token.trim();
 		return {
-			type: "failed",
-			reason: "invalid_response",
-			message: "Missing refresh token in authorization code exchange response",
+			type: "success",
+			access: json.access_token,
+			refresh: normalizedRefreshToken,
+			expires: Date.now() + json.expires_in * 1000,
+			idToken: json.id_token,
+			multiAccount: true,
 		};
+	} catch (error) {
+		const err = error as Error;
+		if (abortContext.signal.aborted || isAbortError(err)) {
+			logError("code->token aborted", { message: err?.message ?? "Request aborted" });
+			return { type: "failed", reason: "unknown", message: err?.message ?? "Request aborted" };
+		}
+		logError("code->token error", { message: err?.message ?? String(err) });
+		return { type: "failed", reason: "network_error", message: err?.message ?? "Network request failed" };
+	} finally {
+		abortContext.cleanup();
 	}
-	const normalizedRefreshToken = json.refresh_token.trim();
-	return {
-		type: "success",
-		access: json.access_token,
-		refresh: normalizedRefreshToken,
-		expires: Date.now() + json.expires_in * 1000,
-		idToken: json.id_token,
-		multiAccount: true,
-	};
 }
 
 /**
@@ -186,6 +272,7 @@ export function decodeJWT(token: string): JWTPayload | null {
  */
 type RefreshAccessTokenOptions = {
 	signal?: AbortSignal;
+	timeoutMs?: number;
 };
 
 export async function refreshAccessToken(
@@ -193,7 +280,7 @@ export async function refreshAccessToken(
 	options: RefreshAccessTokenOptions = {},
 ): Promise<TokenResult> {
 	try {
-		const response = await fetch(TOKEN_URL, {
+		const response = await fetchWithTimeout(TOKEN_URL, {
 			method: "POST",
 			headers: { "Content-Type": "application/x-www-form-urlencoded" },
 			signal: options?.signal,
@@ -202,12 +289,17 @@ export async function refreshAccessToken(
 				refresh_token: refreshToken,
 				client_id: CLIENT_ID,
 			}),
-		});
+		}, options.timeoutMs ?? OAUTH_REFRESH_TIMEOUT_MS);
 
 		if (!response.ok) {
 			const text = await response.text().catch(() => "");
-			logError(`Token refresh failed: ${response.status} ${text}`);
-			return { type: "failed", reason: "http_error", statusCode: response.status, message: text || undefined };
+			logError("Token refresh failed", { status: response.status, bodyLength: text.length });
+			return {
+				type: "failed",
+				reason: "http_error",
+				statusCode: response.status,
+				message: text ? "Token refresh failed" : undefined,
+			};
 		}
 
 		const rawJson = (await response.json()) as unknown;
@@ -233,8 +325,8 @@ export async function refreshAccessToken(
 			multiAccount: true,
 		};
 	} catch (error) {
-		const err = error as Error;
-		if (isAbortError(err)) {
+		const err = error instanceof Error ? error : new Error(String(error));
+		if (isAbortError(err) || /timeout/i.test(err.message)) {
 			return { type: "failed", reason: "unknown", message: err?.message ?? "Request aborted" };
 		}
 		logError("Token refresh error", err);
diff --git a/lib/authorization.ts b/lib/authorization.ts
new file mode 100644
index 000000000..d9228aa00
--- /dev/null
+++ b/lib/authorization.ts
@@ -0,0 +1,149 @@
+import { auditLog, AuditAction, AuditOutcome } from "./audit.js";
+
+export type AuthRole = "admin" | "operator" | "viewer";
+
+export type AuthAction =
+	| "accounts:read"
+	| "accounts:write"
+	| "accounts:repair"
+	| "secrets:rotate";
+
+export interface AuthorizationContext {
+	command?: string;
+	interactive?: boolean;
+	idempotencyKeyPresent?: boolean;
+}
+
+const ROLE_PERMISSIONS: Record<AuthRole, Set<AuthAction>> = {
+	admin: new Set(["accounts:read", "accounts:write", "accounts:repair", "secrets:rotate"]),
+	operator: new Set(["accounts:read", "accounts:write", "accounts:repair"]),
+	viewer: new Set(["accounts:read"]),
+};
+
+const ALL_AUTH_ACTIONS = new Set<AuthAction>([
+	"accounts:read",
+	"accounts:write",
+	"accounts:repair",
+	"secrets:rotate",
+]);
+
+function getRoleFromEnv(): AuthRole {
+	const rawEnv = process.env.CODEX_AUTH_ROLE;
+	if (rawEnv === undefined || rawEnv.trim().length === 0) {
+		return "admin";
+	}
+	const raw = rawEnv.trim().toLowerCase();
+	if (raw === "operator" || raw === "viewer" || raw === "admin") {
+		return raw;
+	}
+	return "viewer";
+}
+
+export function getAuthorizationRole(): AuthRole {
+	return getRoleFromEnv();
+}
+
+function isTruthyEnv(name: string): boolean {
+	const raw = (process.env[name] ?? "").trim().toLowerCase();
+	return raw === "1" || raw === "true" || raw === "yes" || raw === "on";
+}
+
+function parseActionSetFromEnv(name: string): Set<AuthAction> {
+	const raw = (process.env[name] ?? "").trim();
+	if (!raw) return new Set<AuthAction>();
+	const values = raw
+		.split(",")
+		.map((value) => value.trim().toLowerCase())
+		.filter((value) => value.length > 0);
+	const parsed = new Set<AuthAction>();
+	for (const value of values) {
+		if (ALL_AUTH_ACTIONS.has(value as AuthAction)) {
+			parsed.add(value as AuthAction);
+		}
+	}
+	return parsed;
+}
+
+function parseCommandSetFromEnv(name: string): Set<string> {
+	const raw = (process.env[name] ?? "").trim();
+	if (!raw) return new Set<string>();
+	return new Set(
+		raw
+			.split(",")
+			.map((value) => value.trim().toLowerCase())
+			.filter((value) => value.length > 0),
+	);
+}
+
+function evaluateAbacPolicy(
+	action: AuthAction,
+	context: AuthorizationContext,
+): string | null {
+	const readOnly = isTruthyEnv("CODEX_AUTH_ABAC_READ_ONLY");
+	if (readOnly && action !== "accounts:read") {
+		return "ABAC read-only mode denies mutating actions";
+	}
+
+	const deniedActions = parseActionSetFromEnv("CODEX_AUTH_ABAC_DENY_ACTIONS");
+	if (deniedActions.has(action)) {
+		return `ABAC policy denies action '${action}'`;
+	}
+
+	const deniedCommands = parseCommandSetFromEnv("CODEX_AUTH_ABAC_DENY_COMMANDS");
+	const command = context.command?.trim().toLowerCase();
+	if (command && deniedCommands.has(command)) {
+		return `ABAC policy denies command '${command}'`;
+	}
+
+	const interactiveActions = parseActionSetFromEnv("CODEX_AUTH_ABAC_REQUIRE_INTERACTIVE");
+	if (interactiveActions.has(action) && context.interactive !== true) {
+		return `ABAC policy requires an interactive terminal for '${action}'`;
+	}
+
+	const idempotencyActions = parseActionSetFromEnv("CODEX_AUTH_ABAC_REQUIRE_IDEMPOTENCY_KEY");
+	if (idempotencyActions.has(action) && context.idempotencyKeyPresent !== true) {
+		return `ABAC policy requires idempotency key for '${action}'`;
+	}
+
+	return null;
+}
+
+export function authorizeAction(
+	action: AuthAction,
+	context: AuthorizationContext = {},
+): { allowed: boolean; role: AuthRole; reason?: string } {
+	if (process.env.CODEX_AUTH_BREAK_GLASS === "1") {
+		const role = getRoleFromEnv();
+		auditLog(
+			AuditAction.AUTH_BREAK_GLASS,
+			"system",
+			action,
+			AuditOutcome.SUCCESS,
+			{
+				role,
+				breakGlass: true,
+			},
+		);
+		return { allowed: true, role };
+	}
+
+	const role = getRoleFromEnv();
+	const abacReason = evaluateAbacPolicy(action, context);
+	if (abacReason) {
+		return {
+			allowed: false,
+			role,
+			reason: abacReason,
+		};
+	}
+
+	const permissions = ROLE_PERMISSIONS[role];
+	if (permissions.has(action)) {
+		return { allowed: true, role };
+	}
+	return {
+		allowed: false,
+		role,
+		reason: `Role '${role}' does not allow '${action}'`,
+	};
+}
diff --git a/lib/auto-update-checker.ts b/lib/auto-update-checker.ts
index a948c60e3..a3c5c27a2 100644
--- a/lib/auto-update-checker.ts
+++ b/lib/auto-update-checker.ts
@@ -1,6 +1,7 @@
 import { readFileSync, writeFileSync, existsSync, mkdirSync } from "node:fs";
 import { join } from "node:path";
 import { createLogger } from "./logger.js";
+import { fetchWithTimeoutAndRetry } from "./network.js";
 import { getCodexCacheDir } from "./runtime-paths.js";
 
 const log = createLogger("update-checker");
@@ -10,6 +11,9 @@ const NPM_REGISTRY_URL = `https://registry.npmjs.org/${PACKAGE_NAME}/latest`;
 const CACHE_DIR = getCodexCacheDir();
 const CACHE_FILE = join(CACHE_DIR, "update-check-cache.json");
 const CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000;
+const UPDATE_FETCH_TIMEOUT_MS = 5_000;
+const UPDATE_FETCH_RETRIES = 2;
+const UPDATE_FETCH_RETRYABLE_STATUSES = [429, 500, 502, 503, 504] as const;
 
 interface UpdateCheckCache {
   lastCheck: number;
@@ -164,15 +168,29 @@ function compareVersions(current: string, latest: string): number {
 
 async function fetchLatestVersion(): Promise<string | null> {
   try {
-    const controller = new AbortController();
-    const timeout = setTimeout(() => controller.abort(), 5000);
-
-    const response = await fetch(NPM_REGISTRY_URL, {
-      signal: controller.signal,
-      headers: { Accept: "application/json" },
-    });
-
-    clearTimeout(timeout);
+    const { response, attempts, durationMs } = await fetchWithTimeoutAndRetry(
+      NPM_REGISTRY_URL,
+      {
+        headers: { Accept: "application/json" },
+      },
+      {
+        timeoutMs: UPDATE_FETCH_TIMEOUT_MS,
+        retries: UPDATE_FETCH_RETRIES,
+        retryOnStatuses: UPDATE_FETCH_RETRYABLE_STATUSES,
+        baseDelayMs: 100,
+        maxDelayMs: 1_000,
+        jitterMs: 100,
+        onRetry: (retry) => {
+          log.debug("Retrying npm update check", retry);
+        },
+      },
+    );
+    if (attempts > 1) {
+      log.debug("Recovered npm update check after retries", {
+        attempts,
+        durationMs,
+      });
+    }
 
     if (!response.ok) {
       log.debug("Failed to fetch npm registry", { status: response.status });
diff --git a/lib/background-jobs.ts b/lib/background-jobs.ts
new file mode 100644
index 000000000..46342dcd0
--- /dev/null
+++ b/lib/background-jobs.ts
@@ -0,0 +1,130 @@
+import { promises as fs } from "node:fs";
+import { dirname, join } from "node:path";
+import { logWarn } from "./logger.js";
+import { getCodexMultiAuthDir } from "./runtime-paths.js";
+import { sleep } from "./utils.js";
+import { acquireFileLock } from "./file-lock.js";
+import { redactForExternalOutput } from "./data-redaction.js";
+
+const DEFAULT_MAX_ATTEMPTS = 3;
+const DEFAULT_BASE_DELAY_MS = 50;
+const DEFAULT_MAX_DELAY_MS = 500;
+
+const DLQ_PATH = join(getCodexMultiAuthDir(), "background-job-dlq.jsonl");
+const DLQ_LOCK_PATH = `${DLQ_PATH}.lock`;
+
+export interface BackgroundJobRetryOptions<T> {
+	name: string;
+	task: () => Promise<T>;
+	context?: Record<string, unknown>;
+	maxAttempts?: number;
+	baseDelayMs?: number;
+	maxDelayMs?: number;
+	retryable?: (error: unknown) => boolean;
+}
+
+export interface DeadLetterEntry {
+	version: 1;
+	timestamp: string;
+	job: string;
+	attempts: number;
+	error: string;
+	context?: Record<string, unknown>;
+}
+
+function toErrorMessage(error: unknown): string {
+	return error instanceof Error ? error.message : String(error);
+}
+
+function sanitizeErrorMessage(message: string): string {
+	return message
+		.replace(/[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}/gi, "***REDACTED***")
+		.replace(/\b(?:access|refresh|id)?_?token(?:=|:)?\s*\S+/gi, "token=***REDACTED***")
+		.replace(/\b(Bearer)\s+\S+/gi, "$1 ***REDACTED***");
+}
+
+function getDelayMs(attempt: number, baseDelayMs: number, maxDelayMs: number): number {
+	const cappedDelay = Math.min(maxDelayMs, baseDelayMs * 2 ** Math.max(0, attempt - 1));
+	const jitterFactor = 1 + (Math.random() * 0.4 - 0.2);
+	return Math.max(1, Math.round(cappedDelay * jitterFactor));
+}
+
+function isRetryableByDefault(error: unknown): boolean {
+	const statusCode = (error as { statusCode?: unknown } | undefined)?.statusCode;
+	if (typeof statusCode === "number" && statusCode === 429) {
+		return true;
+	}
+	const code = (error as NodeJS.ErrnoException | undefined)?.code;
+	if (typeof code !== "string") return false;
+	return code === "EBUSY" || code === "EPERM" || code === "EAGAIN" || code === "ETIMEDOUT";
+}
+
+async function appendDeadLetter(entry: DeadLetterEntry): Promise<void> {
+	await fs.mkdir(dirname(DLQ_PATH), { recursive: true });
+	const lock = await acquireFileLock(DLQ_LOCK_PATH, {
+		maxAttempts: 80,
+		baseDelayMs: 15,
+		maxDelayMs: 800,
+		staleAfterMs: 120_000,
+	});
+	try {
+		await fs.appendFile(DLQ_PATH, `${JSON.stringify(entry)}\n`, {
+			encoding: "utf8",
+			mode: 0o600,
+		});
+	} finally {
+		await lock.release();
+	}
+}
+
+export function getBackgroundJobDlqPath(): string {
+	return DLQ_PATH;
+}
+
+export async function runBackgroundJobWithRetry<T>(options: BackgroundJobRetryOptions<T>): Promise<T> {
+	const maxAttempts = Math.max(1, Math.floor(options.maxAttempts ?? DEFAULT_MAX_ATTEMPTS));
+	const baseDelayMs = Math.max(1, Math.floor(options.baseDelayMs ?? DEFAULT_BASE_DELAY_MS));
+	const maxDelayMs = Math.max(baseDelayMs, Math.floor(options.maxDelayMs ?? DEFAULT_MAX_DELAY_MS));
+	const retryable = options.retryable ?? isRetryableByDefault;
+
+	let lastError: unknown;
+	let attemptsMade = 0;
+	for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
+		attemptsMade = attempt;
+		try {
+			return await options.task();
+		} catch (error) {
+			lastError = error;
+			if (attempt >= maxAttempts || !retryable(error)) {
+				break;
+			}
+			await sleep(getDelayMs(attempt, baseDelayMs, maxDelayMs));
+		}
+	}
+
+	const errorMessage = sanitizeErrorMessage(toErrorMessage(lastError));
+	const deadLetter: DeadLetterEntry = {
+		version: 1,
+		timestamp: new Date().toISOString(),
+		job: options.name,
+		attempts: attemptsMade,
+		error: errorMessage,
+		...(options.context ? { context: redactForExternalOutput(options.context) } : {}),
+	};
+
+	try {
+		await appendDeadLetter(deadLetter);
+	} catch (dlqError) {
+		logWarn("Failed to append background job dead-letter", {
+			job: options.name,
+			error: sanitizeErrorMessage(toErrorMessage(dlqError)),
+		});
+	}
+
+	logWarn("Background job failed after retries", {
+		job: options.name,
+		attempts: attemptsMade,
+		error: errorMessage,
+	});
+	throw (lastError instanceof Error ? lastError : new Error(errorMessage));
+}
diff --git a/lib/codex-cli/sync.ts b/lib/codex-cli/sync.ts
index 38e660501..af880fa48 100644
--- a/lib/codex-cli/sync.ts
+++ b/lib/codex-cli/sync.ts
@@ -3,7 +3,15 @@ import {
 	type AccountMetadataV3,
 	type AccountStorageV3,
 } from "../storage.js";
-import { MODEL_FAMILIES, type ModelFamily } from "../prompts/codex.js";
+import { type ModelFamily } from "../prompts/codex.js";
+import {
+	setActiveIndexForAllFamilies,
+	normalizeActiveIndexByFamily,
+} from "../accounts/active-index.js";
+import {
+	cloneAccountStorage,
+	createEmptyAccountStorage,
+} from "../accounts/storage-view.js";
 import { createLogger } from "../logger.js";
 import { loadCodexCliState, type CodexCliAccountSnapshot } from "./state.js";
 import {
@@ -20,26 +28,6 @@ function normalizeEmail(value: string | undefined): string | undefined {
 	return trimmed.length > 0 ? trimmed : undefined;
 }
 
-function createEmptyStorage(): AccountStorageV3 {
-	return {
-		version: 3,
-		accounts: [],
-		activeIndex: 0,
-		activeIndexByFamily: {},
-	};
-}
-
-function cloneStorage(storage: AccountStorageV3): AccountStorageV3 {
-	return {
-		version: 3,
-		accounts: storage.accounts.map((account) => ({ ...account })),
-		activeIndex: storage.activeIndex,
-		activeIndexByFamily: storage.activeIndexByFamily
-			? { ...storage.activeIndexByFamily }
-			: {},
-	};
-}
-
 function buildIndexByAccountId(accounts: AccountMetadataV3[]): Map<string, number> {
 	const map = new Map<string, number>();
 	for (let i = 0; i < accounts.length; i += 1) {
@@ -162,11 +150,7 @@ function writeFamilyIndexes(
 	storage: AccountStorageV3,
 	index: number,
 ): void {
-	storage.activeIndex = index;
-	storage.activeIndexByFamily = storage.activeIndexByFamily ?? {};
-	for (const family of MODEL_FAMILIES) {
-		storage.activeIndexByFamily[family] = index;
-	}
+	setActiveIndexForAllFamilies(storage, index);
 }
 
 /**
@@ -185,19 +169,7 @@ function writeFamilyIndexes(
  * @param storage - The account storage object whose indexes will be normalized and clamped
  */
 function normalizeStoredFamilyIndexes(storage: AccountStorageV3): void {
-	const count = storage.accounts.length;
-	const clamped = count === 0 ? 0 : Math.max(0, Math.min(storage.activeIndex, count - 1));
-	if (storage.activeIndex !== clamped) {
-		storage.activeIndex = clamped;
-	}
-	storage.activeIndexByFamily = storage.activeIndexByFamily ?? {};
-	for (const family of MODEL_FAMILIES) {
-		const raw = storage.activeIndexByFamily[family];
-		const resolved =
-			typeof raw === "number" && Number.isFinite(raw) ? raw : storage.activeIndex;
-		storage.activeIndexByFamily[family] =
-			count === 0 ? 0 : Math.max(0, Math.min(resolved, count - 1));
-	}
+	normalizeActiveIndexByFamily(storage, storage.accounts.length);
 }
 
 /**
@@ -280,7 +252,7 @@ export async function syncAccountStorageFromCodexCli(
 			return { storage: current, changed: false };
 		}
 
-		const next = current ? cloneStorage(current) : createEmptyStorage();
+		const next = current ? cloneAccountStorage(current) : createEmptyAccountStorage();
 		let changed = false;
 
 		for (const snapshot of state.accounts) {
diff --git a/lib/codex-manager.ts b/lib/codex-manager.ts
index 794eb7c65..9b27cc22c 100644
--- a/lib/codex-manager.ts
+++ b/lib/codex-manager.ts
@@ -22,7 +22,24 @@ import {
 	sanitizeEmail,
 	selectBestAccountCandidate,
 } from "./accounts.js";
+import {
+	resolveActiveIndex,
+	formatRateLimitEntry,
+} from "./accounts/account-view.js";
+import {
+	createActiveIndexByFamily,
+	setActiveIndexForAllFamilies,
+	normalizeActiveIndexByFamily,
+} from "./accounts/active-index.js";
+import {
+	createEmptyAccountStorage as createEmptyAccountStorageBase,
+} from "./accounts/storage-view.js";
 import { ACCOUNT_LIMITS } from "./constants.js";
+import {
+	getFetchTimeoutMs,
+	getTelemetryEnabled,
+	loadPluginConfig,
+} from "./config.js";
 import {
 	loadDashboardDisplaySettings,
 	DEFAULT_DASHBOARD_DISPLAY_SETTINGS,
@@ -36,7 +53,6 @@ import {
 	summarizeForecast,
 	type ForecastAccountResult,
 } from "./forecast.js";
-import { MODEL_FAMILIES, type ModelFamily } from "./prompts/codex.js";
 import {
 	fetchCodexQuotaSnapshot,
 	formatQuotaSnapshotLine,
@@ -49,6 +65,14 @@ import {
 	type QuotaCacheData,
 	type QuotaCacheEntry,
 } from "./quota-cache.js";
+import { maskEmail } from "./logger.js";
+import {
+	getTelemetryLogPath,
+	queryTelemetryEvents,
+	recordTelemetryEvent,
+	summarizeTelemetryEvents,
+	type TelemetryOutcome,
+} from "./telemetry.js";
 import {
 	getStoragePath,
 	loadFlaggedAccounts,
@@ -56,10 +80,12 @@ import {
 	saveFlaggedAccounts,
 	saveAccounts,
 	setStoragePath,
+	rotateStoredSecretEncryption,
 	type AccountMetadataV3,
 	type AccountStorageV3,
 	type FlaggedAccountMetadataV1,
 } from "./storage.js";
+import { checkAndRecordIdempotencyKey } from "./idempotency.js";
 import type { AccountIdSource, TokenFailure, TokenResult } from "./types.js";
 import {
 	getCodexCliAuthPath,
@@ -73,6 +99,10 @@ import { paintUiText, quotaToneFromLeftPercent } from "./ui/format.js";
 import { getUiRuntimeOptions } from "./ui/runtime.js";
 import { select, type MenuItem } from "./ui/select.js";
 import { applyUiThemeFromDashboardSettings, configureUnifiedSettings, resolveMenuLayoutMode } from "./codex-manager/settings-hub.js";
+import { auditLog, AuditAction, AuditOutcome } from "./audit.js";
+import { checkAuthRateLimit, recordAuthAttempt, resetAuthRateLimit } from "./auth-rate-limit.js";
+import { redactForExternalOutput } from "./data-redaction.js";
+import { authorizeAction, type AuthAction, type AuthorizationContext } from "./authorization.js";
 
 type TokenSuccess = Extract<TokenResult, { type: "success" }>;
 type TokenSuccessWithAccount = TokenSuccess & {
@@ -81,6 +111,87 @@ type TokenSuccessWithAccount = TokenSuccess & {
 	accountLabel?: string;
 };
 type PromptTone = "accent" | "success" | "warning" | "danger" | "muted";
+const JSON_OUTPUT_SCHEMA_VERSION = 1 as const;
+
+function getAuditActor(): string {
+	const candidate = process.env.USER || process.env.USERNAME || "local-user";
+	return candidate.trim().length > 0 ? candidate : "local-user";
+}
+
+function emitAudit(
+	action: AuditAction,
+	outcome: AuditOutcome,
+	resource: string,
+	metadata?: Record<string, unknown>,
+): void {
+	auditLog(action, getAuditActor(), resource, outcome, metadata);
+}
+
+function buildRefreshRateLimitKey(
+	refreshToken: string,
+	accountId?: string,
+	email?: string,
+): string {
+	if (accountId && accountId.trim().length > 0) {
+		return `refresh:${accountId.trim().toLowerCase()}`;
+	}
+	if (email && email.trim().length > 0) {
+		return `refresh:${email.trim().toLowerCase()}`;
+	}
+	const suffix = refreshToken.slice(-12).toLowerCase();
+	return `refresh:${suffix}`;
+}
+
+async function queuedRefreshWithAuthRateLimit(
+	refreshToken: string,
+	context: { accountId?: string; email?: string },
+): Promise<TokenResult> {
+	const rateLimitKey = buildRefreshRateLimitKey(refreshToken, context.accountId, context.email);
+	checkAuthRateLimit(rateLimitKey);
+	recordAuthAttempt(rateLimitKey);
+	const result = await queuedRefresh(refreshToken);
+	if (result.type === "success") {
+		resetAuthRateLimit(rateLimitKey);
+	}
+	return result;
+}
+
+function maybeRedactJsonOutput<T>(value: T): T {
+	const shouldRedact = process.env.CODEX_AUTH_REDACT_JSON_OUTPUT === "1";
+	return shouldRedact ? redactForExternalOutput(value) : value;
+}
+
+function looksLikeOptionToken(value: string): boolean {
+	const trimmed = value.trim();
+	if (trimmed.length === 0) return false;
+	return /^-{1,2}[A-Za-z0-9]/.test(trimmed);
+}
+
+function hasOptionFlag(args: readonly string[], flag: string): boolean {
+	for (let index = 0; index < args.length; index += 1) {
+		const arg = args[index];
+		if (arg === flag) {
+			const next = args[index + 1];
+			return (
+				typeof next === "string" &&
+				next.trim().length > 0 &&
+				!looksLikeOptionToken(next)
+			);
+		}
+		if (arg?.startsWith(`${flag}=`)) {
+			const value = arg.slice(flag.length + 1).trim();
+			return value.length > 0 && !looksLikeOptionToken(value);
+		}
+	}
+	return false;
+}
+
+function ensureAuthorized(action: AuthAction, context: AuthorizationContext = {}): boolean {
+	const auth = authorizeAction(action, context);
+	if (auth.allowed) return true;
+	console.error(`Authorization denied: ${auth.reason}`);
+	return false;
+}
 
 function stylePromptText(text: string, tone: PromptTone): string {
 	if (!output.isTTY) return text;
@@ -172,6 +283,31 @@ function normalizeFailureDetail(
 	return bounded.length > 0 ? bounded : "refresh failed";
 }
 
+function redactFreeformSecretText(message: string): string {
+	return message
+		.replace(/[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}/gi, "***REDACTED***")
+		.replace(
+			/\b(?:access|refresh|id)?_?token(?:=|:)?\s*([A-Z0-9._~+/=-]+)/gi,
+			"token=***REDACTED***",
+		)
+		.replace(/\b(Bearer)\s+[A-Z0-9._~+/=-]+\b/gi, "$1 ***REDACTED***");
+}
+
+function sanitizeCliErrorMessage(error: unknown): string {
+	const raw = error instanceof Error ? error.message : String(error);
+	const redacted = redactForExternalOutput(raw);
+	if (typeof redacted === "string") {
+		const normalized = collapseWhitespace(redactFreeformSecretText(redacted));
+		return normalized.length > 0 ? normalized : "unknown error";
+	}
+	try {
+		const normalized = collapseWhitespace(redactFreeformSecretText(JSON.stringify(redacted)));
+		return normalized.length > 0 ? normalized : "unknown error";
+	} catch {
+		return "unknown error";
+	}
+}
+
 function joinStyledSegments(parts: string[]): string {
 	if (parts.length === 0) return "";
 	const separator = stylePromptText(" | ", "muted");
@@ -287,8 +423,8 @@ function printUsage(): void {
 			"",
 			"Usage:",
 			"  codex auth login",
-			"  codex auth list",
-			"  codex auth status",
+			"  codex auth list [--json] [--page-size <n>] [--cursor <cursor>]",
+			"  codex auth status [--json] [--page-size <n>] [--cursor <cursor>]",
 			"  codex auth switch <index>",
 			"  codex auth check",
 			"  codex auth features",
@@ -297,6 +433,8 @@ function printUsage(): void {
 			"  codex auth report [--live] [--json] [--model <model>] [--out <path>]",
 			"  codex auth fix [--dry-run] [--json] [--live] [--model <model>]",
 			"  codex auth doctor [--json] [--fix] [--dry-run]",
+			"  codex auth rotate-secrets [--json] [--idempotency-key <key>]",
+			"  codex auth telemetry [--json] [--since-hours <hours>] [--limit <n>]",
 			"",
 			"Notes:",
 			"  - Uses ~/.codex/multi-auth/openai-codex-accounts.json",
@@ -362,51 +500,6 @@ function runFeaturesReport(): number {
 	return 0;
 }
 
-function resolveActiveIndex(
-	storage: AccountStorageV3,
-	family: ModelFamily = "codex",
-): number {
-	const total = storage.accounts.length;
-	if (total === 0) return 0;
-	const rawCandidate = storage.activeIndexByFamily?.[family] ?? storage.activeIndex;
-	const raw = Number.isFinite(rawCandidate) ? rawCandidate : 0;
-	return Math.max(0, Math.min(raw, total - 1));
-}
-
-function getRateLimitResetTimeForFamily(
-	account: { rateLimitResetTimes?: Record<string, number | undefined> },
-	now: number,
-	family: ModelFamily,
-): number | null {
-	const times = account.rateLimitResetTimes;
-	if (!times) return null;
-
-	let minReset: number | null = null;
-	const prefix = `${family}:`;
-	for (const [key, value] of Object.entries(times)) {
-		if (typeof value !== "number") continue;
-		if (value <= now) continue;
-		if (key !== family && !key.startsWith(prefix)) continue;
-		if (minReset === null || value < minReset) {
-			minReset = value;
-		}
-	}
-
-	return minReset;
-}
-
-function formatRateLimitEntry(
-	account: { rateLimitResetTimes?: Record<string, number | undefined> },
-	now: number,
-	family: ModelFamily = "codex",
-): string | null {
-	const resetAt = getRateLimitResetTimeForFamily(account, now, family);
-	if (typeof resetAt !== "number") return null;
-	const remaining = resetAt - now;
-	if (remaining <= 0) return null;
-	return `resets in ${formatWaitTime(remaining)}`;
-}
-
 function normalizeQuotaEmail(email: string | undefined): string | null {
 	const normalized = sanitizeEmail(email);
 	return normalized && normalized.length > 0 ? normalized : null;
@@ -602,6 +695,17 @@ function countMenuQuotaRefreshTargets(
 	return count;
 }
 
+async function persistQuotaCache(
+	cache: QuotaCacheData,
+	options: { notify?: boolean } = {},
+): Promise<boolean> {
+	const saved = await saveQuotaCache(cache);
+	if (!saved && options.notify && output.isTTY && process.env.VITEST !== "true") {
+		console.log(stylePromptText("Warning: failed to persist quota cache changes.", "warning"));
+	}
+	return saved;
+}
+
 async function refreshQuotaCacheForMenu(
 	storage: AccountStorageV3,
 	cache: QuotaCacheData,
@@ -635,7 +739,7 @@ async function refreshQuotaCacheForMenu(
 	}
 
 	if (changed) {
-		await saveQuotaCache(cache);
+		await persistQuotaCache(cache, { notify: true });
 	}
 
 	return cache;
@@ -1245,13 +1349,39 @@ async function runOAuthFlow(forceNewLogin: boolean): Promise<TokenResult> {
 	}
 
 	if (!code) {
+		emitAudit(AuditAction.AUTH_LOGIN, AuditOutcome.FAILURE, "oauth", {
+			reason: "cancelled",
+			forceNewLogin,
+		});
 		return {
 			type: "failed",
 			reason: "unknown",
 			message: UI_COPY.oauth.cancelled,
 		};
 	}
-	return exchangeAuthorizationCode(code, pkce.verifier, REDIRECT_URI);
+	const authRateLimitKey = "oauth:login";
+	const authPluginConfig = loadPluginConfig();
+	const oauthFetchTimeoutMs = getFetchTimeoutMs(authPluginConfig);
+	checkAuthRateLimit(authRateLimitKey);
+	recordAuthAttempt(authRateLimitKey);
+	const tokenResult = await exchangeAuthorizationCode(
+		code,
+		pkce.verifier,
+		REDIRECT_URI,
+		{ timeoutMs: oauthFetchTimeoutMs },
+	);
+	if (tokenResult.type === "success") {
+		resetAuthRateLimit(authRateLimitKey);
+		emitAudit(AuditAction.AUTH_LOGIN, AuditOutcome.SUCCESS, "oauth", {
+			forceNewLogin,
+		});
+	} else {
+		emitAudit(AuditAction.AUTH_FAILURE, AuditOutcome.FAILURE, "oauth", {
+			reason: tokenResult.reason,
+			message: tokenResult.message,
+		});
+	}
+	return tokenResult;
 }
 
 async function persistAccountPool(
@@ -1372,10 +1502,7 @@ async function persistAccountPool(
 		: selectedAccountIndex === null
 			? fallbackActiveIndex
 			: Math.max(0, Math.min(selectedAccountIndex, accounts.length - 1));
-	const activeIndexByFamily: Partial<Record<ModelFamily, number>> = {};
-	for (const family of MODEL_FAMILIES) {
-		activeIndexByFamily[family] = nextActiveIndex;
-	}
+	const activeIndexByFamily = createActiveIndexByFamily(nextActiveIndex);
 
 	await saveAccounts({
 		version: 3,
@@ -1383,6 +1510,17 @@ async function persistAccountPool(
 		activeIndex: nextActiveIndex,
 		activeIndexByFamily,
 	});
+	emitAudit(
+		AuditAction.ACCOUNT_ADD,
+		AuditOutcome.SUCCESS,
+		"account-pool",
+		{
+			replaceAll,
+			updatedAccounts: results.length,
+			totalAccounts: accounts.length,
+			activeIndex: nextActiveIndex + 1,
+		},
+	);
 }
 
 async function syncSelectionToCodex(tokens: TokenSuccessWithAccount): Promise<void> {
@@ -1403,18 +1541,116 @@ async function syncSelectionToCodex(tokens: TokenSuccessWithAccount): Promise<vo
 	});
 }
 
-async function showAccountStatus(): Promise<void> {
+function encodePaginationCursor(index: number): string {
+	return Buffer.from(String(index), "utf8").toString("base64");
+}
+
+function decodePaginationCursor(cursor: string): number | null {
+	try {
+		const decoded = Buffer.from(cursor, "base64").toString("utf8");
+		if (!/^\d+$/.test(decoded)) return null;
+		const parsed = Number.parseInt(decoded, 10);
+		if (!Number.isFinite(parsed) || parsed < 0) return null;
+		return parsed;
+	} catch {
+		return null;
+	}
+}
+
+async function showAccountStatus(args: string[] = []): Promise<number> {
+	const parsed = parseListArgs(args);
+	if (!parsed.ok) {
+		console.error(parsed.message);
+		return 1;
+	}
+	const options = parsed.options;
 	setStoragePath(null);
 	const storage = await loadAccounts();
 	const path = getStoragePath();
 	if (!storage || storage.accounts.length === 0) {
-		console.log("No accounts configured.");
-		console.log(`Storage: ${path}`);
-		return;
+		if (options.json) {
+			console.log(
+				JSON.stringify(
+					maybeRedactJsonOutput({
+						command: "list",
+						schemaVersion: JSON_OUTPUT_SCHEMA_VERSION,
+						total: 0,
+						storagePath: path,
+						pagination: {
+							pageSize: options.pageSize,
+							cursor: options.cursor ?? null,
+							nextCursor: null,
+							hasMore: false,
+						},
+						accounts: [],
+					}),
+					null,
+					2,
+				),
+			);
+		} else {
+			console.log("No accounts configured.");
+			console.log(`Storage: ${path}`);
+		}
+		return 0;
 	}
 
 	const now = Date.now();
 	const activeIndex = resolveActiveIndex(storage, "codex");
+	if (options.json) {
+		const startIndex = options.cursor ? decodePaginationCursor(options.cursor) : 0;
+		if (startIndex === null || startIndex > storage.accounts.length) {
+			console.error("Invalid --cursor value");
+			return 1;
+		}
+		const page = storage.accounts
+			.slice(startIndex, startIndex + options.pageSize)
+			.map((account, offset) => {
+				const index = startIndex + offset;
+				const label = formatAccountLabel(account, index);
+				const rateLimit = formatRateLimitEntry(account, now, "codex");
+				const cooldown = formatCooldown(account, now);
+				const markers: string[] = [];
+				if (index === activeIndex) markers.push("current");
+				if (account.enabled === false) markers.push("disabled");
+				if (rateLimit) markers.push("rate-limited");
+				if (cooldown) markers.push(`cooldown:${cooldown}`);
+				return {
+					index: index + 1,
+					email: account.email ?? null,
+					accountId: account.accountId ?? null,
+					label,
+					enabled: account.enabled !== false,
+					current: index === activeIndex,
+					markers,
+					lastUsedAtMs: typeof account.lastUsed === "number" ? account.lastUsed : null,
+				};
+			});
+		const nextIndex = startIndex + page.length;
+		const hasMore = nextIndex < storage.accounts.length;
+		const nextCursor = hasMore ? encodePaginationCursor(nextIndex) : null;
+		console.log(
+			JSON.stringify(
+				maybeRedactJsonOutput({
+					command: "list",
+					schemaVersion: JSON_OUTPUT_SCHEMA_VERSION,
+					total: storage.accounts.length,
+					storagePath: path,
+					pagination: {
+						pageSize: options.pageSize,
+						cursor: options.cursor ?? null,
+						nextCursor,
+						hasMore,
+					},
+					accounts: page,
+				}),
+				null,
+				2,
+			),
+		);
+		return 0;
+	}
+
 	console.log(`Accounts (${storage.accounts.length})`);
 	console.log(`Storage: ${path}`);
 	console.log("");
@@ -1435,6 +1671,7 @@ async function showAccountStatus(): Promise<void> {
 			: "never used";
 		console.log(`${i + 1}. ${label}${markerLabel} ${lastUsed}`);
 	}
+	return 0;
 }
 
 interface HealthCheckOptions {
@@ -1527,7 +1764,10 @@ async function runHealthCheck(options: HealthCheckOptions = {}): Promise<void> {
 			}
 			continue;
 		}
-		const result = await queuedRefresh(account.refreshToken);
+		const result = await queuedRefreshWithAuthRateLimit(account.refreshToken, {
+			accountId: account.accountId,
+			email: account.email,
+		});
 		if (result.type === "success") {
 			const tokenAccountId = extractAccountId(result.access);
 			const nextEmail = sanitizeEmail(extractAccountEmail(result.access, result.idToken));
@@ -1618,7 +1858,7 @@ async function runHealthCheck(options: HealthCheckOptions = {}): Promise<void> {
 		console.log(stylePromptText("Per-account lines are hidden in dashboard settings.", "muted"));
 	}
 	if (quotaCache && quotaCacheChanged) {
-		await saveQuotaCache(quotaCache);
+		await persistQuotaCache(quotaCache, { notify: true });
 	}
 
 	if (changed) {
@@ -1666,12 +1906,29 @@ interface ReportCliOptions {
 	outPath?: string;
 }
 
+interface TelemetryCliOptions {
+	json: boolean;
+	sinceHours: number;
+	limit: number;
+}
+
 interface VerifyFlaggedCliOptions {
 	dryRun: boolean;
 	json: boolean;
 	restore: boolean;
 }
 
+interface ListCliOptions {
+	json: boolean;
+	pageSize: number;
+	cursor?: string;
+}
+
+interface RotateSecretsCliOptions {
+	json: boolean;
+	idempotencyKey?: string;
+}
+
 type ParsedArgsResult<T> = { ok: true; options: T } | { ok: false; message: string };
 
 function printForecastUsage(): void {
@@ -1726,6 +1983,71 @@ function printVerifyFlaggedUsage(): void {
 	);
 }
 
+function parseListArgs(args: string[]): ParsedArgsResult<ListCliOptions> {
+	const options: ListCliOptions = {
+		json: false,
+		pageSize: 20,
+	};
+
+	for (let i = 0; i < args.length; i += 1) {
+		const arg = args[i];
+		if (!arg) continue;
+		if (arg === "--json" || arg === "-j") {
+			options.json = true;
+			continue;
+		}
+		if (arg === "--page-size") {
+			const value = args[i + 1];
+			if (!value) {
+				return { ok: false, message: "Missing value for --page-size" };
+			}
+			const normalized = value.trim();
+			if (!/^\d+$/.test(normalized)) {
+				return { ok: false, message: "--page-size must be between 1 and 200" };
+			}
+			const parsed = Number.parseInt(normalized, 10);
+			if (!Number.isFinite(parsed) || parsed < 1 || parsed > 200) {
+				return { ok: false, message: "--page-size must be between 1 and 200" };
+			}
+			options.pageSize = parsed;
+			i += 1;
+			continue;
+		}
+		if (arg.startsWith("--page-size=")) {
+			const value = arg.slice("--page-size=".length).trim();
+			if (!/^\d+$/.test(value)) {
+				return { ok: false, message: "--page-size must be between 1 and 200" };
+			}
+			const parsed = Number.parseInt(value, 10);
+			if (!Number.isFinite(parsed) || parsed < 1 || parsed > 200) {
+				return { ok: false, message: "--page-size must be between 1 and 200" };
+			}
+			options.pageSize = parsed;
+			continue;
+		}
+		if (arg === "--cursor") {
+			const value = args[i + 1];
+			if (!value || value.trim().length === 0) {
+				return { ok: false, message: "Missing value for --cursor" };
+			}
+			options.cursor = value.trim();
+			i += 1;
+			continue;
+		}
+		if (arg.startsWith("--cursor=")) {
+			const value = arg.slice("--cursor=".length).trim();
+			if (value.length === 0) {
+				return { ok: false, message: "Missing value for --cursor" };
+			}
+			options.cursor = value;
+			continue;
+		}
+		return { ok: false, message: `Unknown option: ${arg}` };
+	}
+
+	return { ok: true, options };
+}
+
 function parseForecastArgs(args: string[]): ParsedArgsResult<ForecastCliOptions> {
 	const options: ForecastCliOptions = {
 		live: false,
@@ -1888,6 +2210,37 @@ function parseDoctorArgs(args: string[]): ParsedArgsResult<DoctorCliOptions> {
 	return { ok: true, options };
 }
 
+function parseRotateSecretsArgs(args: string[]): ParsedArgsResult<RotateSecretsCliOptions> {
+	const options: RotateSecretsCliOptions = { json: false };
+	for (let i = 0; i < args.length; i += 1) {
+		const arg = args[i];
+		if (!arg) continue;
+		if (arg === "--json" || arg === "-j") {
+			options.json = true;
+			continue;
+		}
+		if (arg === "--idempotency-key") {
+			const value = args[i + 1];
+			if (!value || value.trim().length === 0 || looksLikeOptionToken(value)) {
+				return { ok: false, message: "Missing value for --idempotency-key" };
+			}
+			options.idempotencyKey = value.trim();
+			i += 1;
+			continue;
+		}
+		if (arg.startsWith("--idempotency-key=")) {
+			const value = arg.slice("--idempotency-key=".length).trim();
+			if (value.length === 0 || looksLikeOptionToken(value)) {
+				return { ok: false, message: "Missing value for --idempotency-key" };
+			}
+			options.idempotencyKey = value;
+			continue;
+		}
+		return { ok: false, message: `Unknown option: ${arg}` };
+	}
+	return { ok: true, options };
+}
+
 function printReportUsage(): void {
 	console.log(
 		[
@@ -1903,6 +2256,34 @@ function printReportUsage(): void {
 	);
 }
 
+function printTelemetryUsage(): void {
+	console.log(
+		[
+			"Usage:",
+			"  codex auth telemetry [--json] [--since-hours <hours>] [--limit <n>]",
+			"",
+			"Options:",
+			"  --json, -j            Print machine-readable JSON output",
+			"  --since-hours <hours> Include events newer than this many hours (default: 24)",
+			"  --limit <n>           Maximum events to return (default: 50, max: 500)",
+		].join("\n"),
+	);
+}
+
+function parsePositiveIntegerOption(
+	value: string | undefined,
+	optionName: string,
+): ParsedArgsResult<number> {
+	if (!value || !/^\d+$/.test(value)) {
+		return { ok: false, message: `Invalid value for ${optionName}: ${value ?? ""}` };
+	}
+	const parsed = Number.parseInt(value, 10);
+	if (!Number.isFinite(parsed) || parsed <= 0) {
+		return { ok: false, message: `Invalid value for ${optionName}: ${value}` };
+	}
+	return { ok: true, options: parsed };
+}
+
 function parseReportArgs(args: string[]): ParsedArgsResult<ReportCliOptions> {
 	const options: ReportCliOptions = {
 		live: false,
@@ -1961,6 +2342,59 @@ function parseReportArgs(args: string[]): ParsedArgsResult<ReportCliOptions> {
 	return { ok: true, options };
 }
 
+function parseTelemetryArgs(args: string[]): ParsedArgsResult<TelemetryCliOptions> {
+	const options: TelemetryCliOptions = {
+		json: false,
+		sinceHours: 24,
+		limit: 50,
+	};
+
+	for (let i = 0; i < args.length; i += 1) {
+		const arg = args[i];
+		if (!arg) continue;
+		if (arg === "--json" || arg === "-j") {
+			options.json = true;
+			continue;
+		}
+		if (arg === "--since-hours") {
+			const parsed = parsePositiveIntegerOption(args[i + 1], "--since-hours");
+			if (!parsed.ok) return parsed;
+			options.sinceHours = parsed.options;
+			i += 1;
+			continue;
+		}
+		if (arg.startsWith("--since-hours=")) {
+			const parsed = parsePositiveIntegerOption(
+				arg.slice("--since-hours=".length).trim(),
+				"--since-hours",
+			);
+			if (!parsed.ok) return parsed;
+			options.sinceHours = parsed.options;
+			continue;
+		}
+		if (arg === "--limit") {
+			const parsed = parsePositiveIntegerOption(args[i + 1], "--limit");
+			if (!parsed.ok) return parsed;
+			options.limit = parsed.options;
+			i += 1;
+			continue;
+		}
+		if (arg.startsWith("--limit=")) {
+			const parsed = parsePositiveIntegerOption(
+				arg.slice("--limit=".length).trim(),
+				"--limit",
+			);
+			if (!parsed.ok) return parsed;
+			options.limit = parsed.options;
+			continue;
+		}
+		return { ok: false, message: `Unknown option: ${arg}` };
+	}
+
+	options.limit = Math.max(1, Math.min(500, options.limit));
+	return { ok: true, options };
+}
+
 function serializeForecastResults(
 	results: ForecastAccountResult[],
 	liveQuotaByIndex: Map<number, Awaited<ReturnType<typeof fetchCodexQuotaSnapshot>>>,
@@ -2046,7 +2480,10 @@ async function runForecast(args: string[]): Promise<number> {
 		let probeAccessToken = account.accessToken;
 		let probeAccountId = account.accountId ?? extractAccountId(account.accessToken);
 		if (!hasUsableAccessToken(account, now)) {
-			const refreshResult = await queuedRefresh(account.refreshToken);
+			const refreshResult = await queuedRefreshWithAuthRateLimit(account.refreshToken, {
+				accountId: account.accountId,
+				email: account.email,
+			});
 			if (refreshResult.type !== "success") {
 				refreshFailures.set(i, {
 					...refreshResult,
@@ -2099,25 +2536,33 @@ async function runForecast(args: string[]): Promise<number> {
 	const recommendation = recommendForecastAccount(forecastResults);
 
 	if (options.json) {
+		let quotaCachePersisted = true;
 		if (quotaCache && quotaCacheChanged) {
-			await saveQuotaCache(quotaCache);
+			quotaCachePersisted = await persistQuotaCache(quotaCache);
 		}
+		const payload = {
+			command: "forecast",
+			model: options.model,
+			liveProbe: options.live,
+			summary,
+			recommendation,
+			probeErrors: quotaCachePersisted
+				? probeErrors
+				: [...probeErrors, "Failed to persist quota cache changes"],
+			quotaCachePersisted,
+			accounts: serializeForecastResults(forecastResults, liveQuotaByIndex, refreshFailures),
+		};
 		console.log(
 			JSON.stringify(
-				{
-					command: "forecast",
-					model: options.model,
-					liveProbe: options.live,
-					summary,
-					recommendation,
-					probeErrors,
-					accounts: serializeForecastResults(forecastResults, liveQuotaByIndex, refreshFailures),
-				},
+				maybeRedactJsonOutput({
+					schemaVersion: JSON_OUTPUT_SCHEMA_VERSION,
+					...payload,
+				}),
 				null,
 				2,
 			),
 		);
-		return 0;
+		return quotaCachePersisted ? 0 : 1;
 	}
 
 	console.log(
@@ -2188,10 +2633,103 @@ async function runForecast(args: string[]): Promise<number> {
 			console.log(`  ${stylePromptText("-", "warning")} ${stylePromptText(error, "muted")}`);
 		}
 	}
+	let quotaCachePersisted = true;
 	if (quotaCache && quotaCacheChanged) {
-		await saveQuotaCache(quotaCache);
+		quotaCachePersisted = await persistQuotaCache(quotaCache, { notify: true });
+	}
+
+	return quotaCachePersisted ? 0 : 1;
+}
+
+function formatTelemetryDetail(details: Record<string, unknown> | undefined): string {
+	if (!details) return "";
+	const chunks: string[] = [];
+	for (const [key, value] of Object.entries(details)) {
+		if (value === undefined || value === null) continue;
+		if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
+			chunks.push(`${key}=${String(value)}`);
+			continue;
+		}
+		const serialized = JSON.stringify(value);
+		if (serialized) {
+			chunks.push(`${key}=${serialized}`);
+		}
+	}
+	return chunks.join(" ");
+}
+
+async function runTelemetry(args: string[]): Promise<number> {
+	if (args.includes("--help") || args.includes("-h")) {
+		printTelemetryUsage();
+		return 0;
+	}
+
+	const parsedArgs = parseTelemetryArgs(args);
+	if (!parsedArgs.ok) {
+		console.error(parsedArgs.message);
+		printTelemetryUsage();
+		return 1;
 	}
+	const options = parsedArgs.options;
+	const sinceMs = Date.now() - options.sinceHours * 60 * 60_000;
+	const events = await queryTelemetryEvents({
+		sinceMs,
+		limit: options.limit,
+	});
+	const summary = summarizeTelemetryEvents(events);
+	const logPath = getTelemetryLogPath();
 
+	if (options.json) {
+		console.log(
+			JSON.stringify(
+				{
+					command: "telemetry",
+					logPath,
+					sinceHours: options.sinceHours,
+					limit: options.limit,
+					summary,
+					events,
+				},
+				null,
+				2,
+			),
+		);
+		return 0;
+	}
+
+	console.log(`Telemetry report (last ${options.sinceHours}h, limit ${options.limit})`);
+	console.log(`Log file: ${logPath}`);
+	console.log(`Total events: ${summary.total}`);
+	console.log(`By source: cli=${summary.bySource.cli}, plugin=${summary.bySource.plugin}`);
+	console.log(
+		`By outcome: start=${summary.byOutcome.start}, success=${summary.byOutcome.success}, failure=${summary.byOutcome.failure}, recovery=${summary.byOutcome.recovery}, info=${summary.byOutcome.info}`,
+	);
+	if (summary.firstTimestamp && summary.lastTimestamp) {
+		console.log(`Window: ${summary.firstTimestamp} -> ${summary.lastTimestamp}`);
+	}
+	if (summary.byEvent.length > 0) {
+		console.log("");
+		console.log("Top events:");
+		for (const item of summary.byEvent.slice(0, 5)) {
+			console.log(`  - ${item.event}: ${item.count}`);
+		}
+	}
+
+	const recent = events.slice(Math.max(0, events.length - 10));
+	if (recent.length === 0) {
+		console.log("");
+		console.log("No telemetry events found for the selected window.");
+		return 0;
+	}
+
+	console.log("");
+	console.log("Recent events:");
+	for (const event of recent) {
+		const detail = formatTelemetryDetail(event.details);
+		console.log(
+			`  - ${event.timestamp} [${event.source}] ${event.outcome} ${event.event}${detail ? ` | ${detail}` : ""}`,
+		);
+	}
 	return 0;
 }
 
@@ -2224,7 +2762,10 @@ async function runReport(args: string[]): Promise<number> {
 			const account = storage.accounts[i];
 			if (!account || account.enabled === false) continue;
 
-			const refreshResult = await queuedRefresh(account.refreshToken);
+			const refreshResult = await queuedRefreshWithAuthRateLimit(account.refreshToken, {
+				accountId: account.accountId,
+				email: account.email,
+			});
 			if (refreshResult.type !== "success") {
 				refreshFailures.set(i, {
 					...refreshResult,
@@ -2286,6 +2827,7 @@ async function runReport(args: string[]): Promise<number> {
 
 	const report = {
 		command: "report",
+		schemaVersion: JSON_OUTPUT_SCHEMA_VERSION,
 		generatedAt: new Date(now).toISOString(),
 		storagePath,
 		model: options.model,
@@ -2305,15 +2847,16 @@ async function runReport(args: string[]): Promise<number> {
 			accounts: serializeForecastResults(forecastResults, liveQuotaByIndex, refreshFailures),
 		},
 	};
+	const safeReport = maybeRedactJsonOutput(report);
 
 	if (options.outPath) {
 		const outputPath = resolve(process.cwd(), options.outPath);
 		await fs.mkdir(dirname(outputPath), { recursive: true });
-		await fs.writeFile(outputPath, `${JSON.stringify(report, null, 2)}\n`, "utf-8");
+		await fs.writeFile(outputPath, `${JSON.stringify(safeReport, null, 2)}\n`, "utf-8");
 	}
 
 	if (options.json) {
-		console.log(JSON.stringify(report, null, 2));
+		console.log(JSON.stringify(safeReport, null, 2));
 		return 0;
 	}
 
@@ -2386,16 +2929,7 @@ interface VerifyFlaggedReport {
 }
 
 function createEmptyAccountStorage(): AccountStorageV3 {
-	const activeIndexByFamily: Partial<Record<ModelFamily, number>> = {};
-	for (const family of MODEL_FAMILIES) {
-		activeIndexByFamily[family] = 0;
-	}
-	return {
-		version: 3,
-		accounts: [],
-		activeIndex: 0,
-		activeIndexByFamily,
-	};
+	return createEmptyAccountStorageBase({ initializeFamilyIndexes: true });
 }
 
 function findExistingAccountIndexForFlagged(
@@ -2537,8 +3071,9 @@ async function runVerifyFlagged(args: string[]): Promise<number> {
 		if (options.json) {
 			console.log(
 				JSON.stringify(
-					{
+					maybeRedactJsonOutput({
 						command: "verify-flagged",
+						schemaVersion: JSON_OUTPUT_SCHEMA_VERSION,
 						total: 0,
 						restored: 0,
 						healthyFlagged: 0,
@@ -2547,7 +3082,7 @@ async function runVerifyFlagged(args: string[]): Promise<number> {
 						dryRun: options.dryRun,
 						restore: options.restore,
 						reports: [] as VerifyFlaggedReport[],
-					},
+					}),
 					null,
 					2,
 				),
@@ -2572,7 +3107,10 @@ async function runVerifyFlagged(args: string[]): Promise<number> {
 		const flagged = flaggedStorage.accounts[i];
 		if (!flagged) continue;
 		const label = formatAccountLabel(flagged, i);
-		const result = await queuedRefresh(flagged.refreshToken);
+		const result = await queuedRefreshWithAuthRateLimit(flagged.refreshToken, {
+			accountId: flagged.accountId,
+			email: flagged.email,
+		});
 
 		if (result.type === "success") {
 			if (!options.restore) {
@@ -2671,13 +3209,21 @@ async function runVerifyFlagged(args: string[]): Promise<number> {
 				accounts: nextFlaggedAccounts,
 			});
 		}
+		if (changed) {
+			emitAudit(AuditAction.CONFIG_CHANGE, AuditOutcome.SUCCESS, "verify-flagged", {
+				restored,
+				stillFlagged,
+				remainingFlagged,
+			});
+		}
 	}
 
 	if (options.json) {
 		console.log(
 			JSON.stringify(
-				{
+				maybeRedactJsonOutput({
 					command: "verify-flagged",
+					schemaVersion: JSON_OUTPUT_SCHEMA_VERSION,
 					total: flaggedStorage.accounts.length,
 					restored,
 					healthyFlagged,
@@ -2687,7 +3233,7 @@ async function runVerifyFlagged(args: string[]): Promise<number> {
 					dryRun: options.dryRun,
 					restore: options.restore,
 					reports,
-				},
+				}),
 				null,
 				2,
 			),
@@ -2834,7 +3380,10 @@ async function runFix(args: string[]): Promise<number> {
 			continue;
 		}
 
-		const refreshResult = await queuedRefresh(account.refreshToken);
+		const refreshResult = await queuedRefreshWithAuthRateLimit(account.refreshToken, {
+			accountId: account.accountId,
+			email: account.email,
+		});
 		if (refreshResult.type === "success") {
 			const nextEmail = sanitizeEmail(extractAccountEmail(refreshResult.access, refreshResult.idToken));
 			const nextAccountId = extractAccountId(refreshResult.access);
@@ -2972,34 +3521,45 @@ async function runFix(args: string[]): Promise<number> {
 
 	if (changed && !options.dryRun) {
 		await saveAccounts(storage);
+		emitAudit(AuditAction.CONFIG_CHANGE, AuditOutcome.SUCCESS, "auto-fix", {
+			changedAccounts: reports.length,
+			disabledCount: reportSummary.disabled,
+			warnings: reportSummary.warnings,
+		});
 	}
 
 	if (options.json) {
+		let quotaCachePersisted = true;
 		if (quotaCache && quotaCacheChanged) {
-			await saveQuotaCache(quotaCache);
+			quotaCachePersisted = await persistQuotaCache(quotaCache);
 		}
+		const payload = {
+			command: "fix",
+			dryRun: options.dryRun,
+			liveProbe: options.live,
+			model: options.model,
+			changed,
+			summary: reportSummary,
+			recommendation,
+			recommendedSwitchCommand:
+				recommendation.recommendedIndex !== null &&
+					recommendation.recommendedIndex !== activeIndex
+					? `codex auth switch ${recommendation.recommendedIndex + 1}`
+					: null,
+			reports,
+			quotaCachePersisted,
+		};
 		console.log(
 			JSON.stringify(
-				{
-					command: "fix",
-					dryRun: options.dryRun,
-					liveProbe: options.live,
-					model: options.model,
-					changed,
-					summary: reportSummary,
-					recommendation,
-					recommendedSwitchCommand:
-						recommendation.recommendedIndex !== null &&
-							recommendation.recommendedIndex !== activeIndex
-							? `codex auth switch ${recommendation.recommendedIndex + 1}`
-							: null,
-					reports,
-				},
+				maybeRedactJsonOutput({
+					schemaVersion: JSON_OUTPUT_SCHEMA_VERSION,
+					...payload,
+				}),
 				null,
 				2,
 			),
 		);
-		return 0;
+		return quotaCachePersisted ? 0 : 1;
 	}
 
 	console.log(stylePromptText(`Auto-fix scan (${options.dryRun ? "preview" : "apply"})`, "accent"));
@@ -3052,8 +3612,9 @@ async function runFix(args: string[]): Promise<number> {
 			console.log(`${stylePromptText("Note:", "accent")} ${stylePromptText(recommendation.reason, "muted")}`);
 		}
 	}
+	let quotaCachePersisted = true;
 	if (quotaCache && quotaCacheChanged) {
-		await saveQuotaCache(quotaCache);
+		quotaCachePersisted = await persistQuotaCache(quotaCache, { notify: true });
 	}
 
 	if (changed && options.dryRun) {
@@ -3064,7 +3625,7 @@ async function runFix(args: string[]): Promise<number> {
 		console.log(`\n${stylePromptText("No changes were needed.", "muted")}`);
 	}
 
-	return 0;
+	return quotaCachePersisted ? 0 : 1;
 }
 
 type DoctorSeverity = "ok" | "warn" | "error";
@@ -3094,25 +3655,7 @@ function hasPlaceholderEmail(value: string | undefined): boolean {
 }
 
 function normalizeDoctorIndexes(storage: AccountStorageV3): boolean {
-	const total = storage.accounts.length;
-	const nextActive = total === 0 ? 0 : Math.max(0, Math.min(storage.activeIndex, total - 1));
-	let changed = false;
-	if (storage.activeIndex !== nextActive) {
-		storage.activeIndex = nextActive;
-		changed = true;
-	}
-	storage.activeIndexByFamily = storage.activeIndexByFamily ?? {};
-	for (const family of MODEL_FAMILIES) {
-		const raw = storage.activeIndexByFamily[family];
-		const fallback = storage.activeIndex;
-		const candidate = typeof raw === "number" && Number.isFinite(raw) ? raw : fallback;
-		const clamped = total === 0 ? 0 : Math.max(0, Math.min(candidate, total - 1));
-		if (storage.activeIndexByFamily[family] !== clamped) {
-			storage.activeIndexByFamily[family] = clamped;
-			changed = true;
-		}
-	}
-	return changed;
+	return normalizeActiveIndexByFamily(storage, storage.accounts.length);
 }
 
 function applyDoctorFixes(storage: AccountStorageV3): { changed: boolean; actions: DoctorFixAction[] } {
@@ -3520,7 +4063,10 @@ async function runDoctor(args: string[]): Promise<number> {
 							message: `Prepared active-account token refresh for account ${activeIndex + 1} (dry-run)`,
 						});
 					} else {
-						const refreshResult = await queuedRefresh(activeAccount.refreshToken);
+						const refreshResult = await queuedRefreshWithAuthRateLimit(activeAccount.refreshToken, {
+							accountId: activeAccount.accountId,
+							email: activeAccount.email,
+						});
 						if (refreshResult.type === "success") {
 							const refreshedEmail = sanitizeEmail(
 								extractAccountEmail(refreshResult.access, refreshResult.idToken),
@@ -3601,11 +4147,19 @@ async function runDoctor(args: string[]): Promise<number> {
 		{ ok: 0, warn: 0, error: 0 },
 	);
 
+	if (options.fix && fixChanged && !options.dryRun) {
+		emitAudit(AuditAction.CONFIG_CHANGE, AuditOutcome.SUCCESS, "doctor-fix", {
+			actionCount: fixActions.length,
+			summary,
+		});
+	}
+
 	if (options.json) {
 		console.log(
 			JSON.stringify(
-				{
+				maybeRedactJsonOutput({
 					command: "doctor",
+					schemaVersion: JSON_OUTPUT_SCHEMA_VERSION,
 					storagePath,
 					summary,
 					checks,
@@ -3615,7 +4169,7 @@ async function runDoctor(args: string[]): Promise<number> {
 						changed: fixChanged,
 						actions: fixActions,
 					},
-				},
+				}),
 				null,
 				2,
 			),
@@ -3649,13 +4203,116 @@ async function runDoctor(args: string[]): Promise<number> {
 	return summary.error > 0 ? 1 : 0;
 }
 
+async function runRotateSecrets(args: string[]): Promise<number> {
+	if (args.includes("--help") || args.includes("-h")) {
+		console.log([
+			"Usage: codex auth rotate-secrets [--json] [--idempotency-key <key>]",
+			"",
+			"Re-encrypts stored account and flagged-account secrets using CODEX_AUTH_ENCRYPTION_KEY.",
+			"Optional fallback key can be provided with CODEX_AUTH_PREVIOUS_ENCRYPTION_KEY.",
+			"Use --idempotency-key to make retries safe for automation.",
+		].join("\n"));
+		return 0;
+	}
+
+	const parsed = parseRotateSecretsArgs(args);
+	if (!parsed.ok) {
+		console.error(parsed.message);
+		return 1;
+	}
+	const { json: asJson, idempotencyKey } = parsed.options;
+	try {
+		if (idempotencyKey) {
+			const idempotency = await checkAndRecordIdempotencyKey(
+				"codex.auth.rotate-secrets",
+				idempotencyKey,
+			);
+			if (idempotency.replayed) {
+				if (asJson) {
+					console.log(
+						JSON.stringify(
+							maybeRedactJsonOutput({
+								command: "rotate-secrets",
+								schemaVersion: JSON_OUTPUT_SCHEMA_VERSION,
+								rotated: true,
+								replayed: true,
+								accounts: 0,
+								flaggedAccounts: 0,
+								idempotencyKey,
+							}),
+							null,
+							2,
+						),
+					);
+				} else {
+					console.log("Idempotent replay detected; skipping duplicate rotate-secrets execution.");
+				}
+				emitAudit(AuditAction.CONFIG_CHANGE, AuditOutcome.PARTIAL, "rotate-secrets", {
+					replayed: true,
+					idempotencyKey,
+				});
+				return 0;
+			}
+		}
+
+		const result = await rotateStoredSecretEncryption();
+		emitAudit(AuditAction.CONFIG_CHANGE, AuditOutcome.SUCCESS, "rotate-secrets", {
+			accounts: result.accounts,
+			flaggedAccounts: result.flaggedAccounts,
+			...(idempotencyKey ? { idempotencyKey } : {}),
+		});
+		if (asJson) {
+			console.log(
+				JSON.stringify(
+					maybeRedactJsonOutput({
+						command: "rotate-secrets",
+						schemaVersion: JSON_OUTPUT_SCHEMA_VERSION,
+						rotated: true,
+						accounts: result.accounts,
+						flaggedAccounts: result.flaggedAccounts,
+						replayed: false,
+						...(idempotencyKey ? { idempotencyKey } : {}),
+					}),
+					null,
+					2,
+				),
+			);
+			return 0;
+		}
+		console.log(
+			`Re-encrypted ${result.accounts} account(s) and ${result.flaggedAccounts} flagged account(s).`,
+		);
+		return 0;
+	} catch (error) {
+		const message = sanitizeCliErrorMessage(error);
+		emitAudit(AuditAction.CONFIG_CHANGE, AuditOutcome.FAILURE, "rotate-secrets", {
+			error: message,
+			...(idempotencyKey ? { idempotencyKey } : {}),
+		});
+		if (asJson) {
+			console.log(
+				JSON.stringify(
+					{
+						command: "rotate-secrets",
+						schemaVersion: JSON_OUTPUT_SCHEMA_VERSION,
+						rotated: false,
+						replayed: false,
+						error: message,
+						...(idempotencyKey ? { idempotencyKey } : {}),
+					},
+					null,
+					2,
+				),
+			);
+			return 1;
+		}
+		console.error(`Failed to rotate stored secrets: ${message}`);
+		return 1;
+	}
+}
+
 async function clearAccountsAndReset(): Promise<void> {
-	await saveAccounts({
-		version: 3,
-		accounts: [],
-		activeIndex: 0,
-		activeIndexByFamily: {},
-	});
+	await saveAccounts(createEmptyAccountStorageBase());
 }
 
 async function handleManageAction(
@@ -3672,11 +4329,7 @@ async function handleManageAction(
 		const idx = menuResult.deleteAccountIndex;
 		if (idx >= 0 && idx < storage.accounts.length) {
 			storage.accounts.splice(idx, 1);
-			storage.activeIndex = 0;
-			storage.activeIndexByFamily = {};
-			for (const family of MODEL_FAMILIES) {
-				storage.activeIndexByFamily[family] = 0;
-			}
+			setActiveIndexForAllFamilies(storage, 0);
 			await saveAccounts(storage);
 			console.log(`Deleted account ${idx + 1}.`);
 		}
@@ -3872,11 +4525,18 @@ async function runSwitch(args: string[]): Promise<number> {
 	const indexArg = args[0];
 	if (!indexArg) {
 		console.error("Missing index. Usage: codex auth switch <index>");
+		emitAudit(AuditAction.ACCOUNT_SWITCH, AuditOutcome.FAILURE, "account-switch", {
+			reason: "missing-index",
+		});
 		return 1;
 	}
 	const parsed = Number.parseInt(indexArg, 10);
 	if (!Number.isFinite(parsed) || parsed < 1) {
 		console.error(`Invalid index: ${indexArg}`);
+		emitAudit(AuditAction.ACCOUNT_SWITCH, AuditOutcome.FAILURE, "account-switch", {
+			reason: "invalid-index",
+			indexArg,
+		});
 		return 1;
 	}
 	const targetIndex = parsed - 1;
@@ -3884,24 +4544,31 @@ async function runSwitch(args: string[]): Promise<number> {
 	const storage = await loadAccounts();
 	if (!storage || storage.accounts.length === 0) {
 		console.error("No accounts configured.");
+		emitAudit(AuditAction.ACCOUNT_SWITCH, AuditOutcome.FAILURE, "account-switch", {
+			reason: "no-accounts",
+		});
 		return 1;
 	}
 	if (targetIndex < 0 || targetIndex >= storage.accounts.length) {
 		console.error(`Index out of range. Valid range: 1-${storage.accounts.length}`);
+		emitAudit(AuditAction.ACCOUNT_SWITCH, AuditOutcome.FAILURE, "account-switch", {
+			reason: "out-of-range",
+			targetIndex: parsed,
+		});
 		return 1;
 	}
 
 	const account = storage.accounts[targetIndex];
 	if (!account) {
 		console.error(`Account ${parsed} not found.`);
+		emitAudit(AuditAction.ACCOUNT_SWITCH, AuditOutcome.FAILURE, "account-switch", {
+			reason: "account-missing",
+			targetIndex: parsed,
+		});
 		return 1;
 	}
 
-	storage.activeIndex = targetIndex;
-	storage.activeIndexByFamily = storage.activeIndexByFamily ?? {};
-	for (const family of MODEL_FAMILIES) {
-		storage.activeIndexByFamily[family] = targetIndex;
-	}
+	setActiveIndexForAllFamilies(storage, targetIndex);
 	const wasDisabled = account.enabled === false;
 	if (wasDisabled) {
 		account.enabled = true;
@@ -3913,7 +4580,10 @@ async function runSwitch(args: string[]): Promise<number> {
 	let syncIdToken: string | undefined;
 
 	if (!hasUsableAccessToken(account, switchNow)) {
-		const refreshResult = await queuedRefresh(account.refreshToken);
+		const refreshResult = await queuedRefreshWithAuthRateLimit(account.refreshToken, {
+			accountId: account.accountId,
+			email: account.email,
+		});
 		if (refreshResult.type === "success") {
 			const tokenAccountId = extractAccountId(refreshResult.access);
 			const nextEmail = sanitizeEmail(extractAccountEmail(refreshResult.access, refreshResult.idToken));
@@ -3965,6 +4635,10 @@ async function runSwitch(args: string[]): Promise<number> {
 	console.log(
 		`Switched to account ${parsed}: ${formatAccountLabel(account, targetIndex)}${wasDisabled ? " (re-enabled)" : ""}`,
 	);
+	emitAudit(AuditAction.ACCOUNT_SWITCH, AuditOutcome.SUCCESS, "account-switch", {
+		targetIndex: parsed,
+		wasDisabled,
+	});
 	return 0;
 }
 
@@ -3993,7 +4667,10 @@ export async function autoSyncActiveAccountToCodex(): Promise<boolean> {
 	let changed = false;
 
 	if (!hasUsableAccessToken(account, now)) {
-		const refreshResult = await queuedRefresh(account.refreshToken);
+		const refreshResult = await queuedRefreshWithAuthRateLimit(account.refreshToken, {
+			accountId: account.accountId,
+			email: account.email,
+		});
 		if (refreshResult.type === "success") {
 			const tokenAccountId = extractAccountId(refreshResult.access);
 			const nextEmail = sanitizeEmail(extractAccountEmail(refreshResult.access, refreshResult.idToken));
@@ -4039,9 +4716,68 @@ export async function autoSyncActiveAccountToCodex(): Promise<boolean> {
 	});
 }
 
+function auditActionForCommand(command: string): AuditAction {
+	switch (command) {
+		case "login":
+			return AuditAction.AUTH_LOGIN;
+		case "switch":
+			return AuditAction.ACCOUNT_SWITCH;
+		case "check":
+			return AuditAction.REQUEST_START;
+		case "verify-flagged":
+			return AuditAction.ACCOUNT_REFRESH;
+		case "forecast":
+		case "report":
+		case "fix":
+		case "doctor":
+		case "list":
+		case "status":
+			return AuditAction.COMMAND_RUN;
+		default:
+			return AuditAction.COMMAND_RUN;
+	}
+}
+
+function sanitizeAuditError(error: unknown): string {
+	const raw = error instanceof Error ? `${error.name}: ${error.message}` : String(error);
+	const masked = raw
+		.replace(/\bsk-[A-Za-z0-9_-]{12,}\b/g, "***REDACTED***")
+		.replace(/\b(?:refresh|access)_token_[A-Za-z0-9_-]{8,}\b/gi, "***REDACTED***")
+		.replace(/\bsecret-(?:access|refresh)-token\b/gi, "***REDACTED***")
+		.replace(/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/g, (match) => maskEmail(match));
+	return masked.slice(0, 200);
+}
+
+async function runWithAudit(
+	command: string,
+	runner: () => Promise<number>,
+): Promise<number> {
+	const action = auditActionForCommand(command);
+	const resource = `codex auth ${command}`;
+	try {
+		const code = await runner();
+		auditLog(
+			action,
+			"cli-user",
+			resource,
+			code === 0 ? AuditOutcome.SUCCESS : AuditOutcome.FAILURE,
+			{ command, exitCode: code },
+		);
+		return code;
+	} catch (error) {
+		auditLog(action, "cli-user", resource, AuditOutcome.FAILURE, {
+			command,
+			error: sanitizeAuditError(error),
+		});
+		throw error;
+	}
+}
+
 export async function runCodexMultiAuthCli(rawArgs: string[]): Promise<number> {
 	const startupDisplaySettings = await loadDashboardDisplaySettings();
 	applyUiThemeFromDashboardSettings(startupDisplaySettings);
+	const pluginConfig = loadPluginConfig();
+	const telemetryEnabled = getTelemetryEnabled(pluginConfig);
 
 	const args = [...rawArgs];
 	if (args.length === 0) {
@@ -4060,44 +4796,137 @@ export async function runCodexMultiAuthCli(rawArgs: string[]): Promise<number> {
 	}
 
 	const command = sub ?? "login";
+	const emitTelemetry = (
+		outcome: TelemetryOutcome,
+		event: string,
+		details?: Record<string, unknown>,
+	): void => {
+		if (!telemetryEnabled) return;
+		void recordTelemetryEvent({
+			source: "cli",
+			event,
+			outcome,
+			details: {
+				command,
+				...details,
+			},
+		});
+	};
+
 	if (command === "--help" || command === "-h") {
 		printUsage();
 		return 0;
 	}
-	if (command === "login") {
-		return runAuthLogin();
-	}
-	if (command === "list" || command === "status") {
-		await showAccountStatus();
-		return 0;
-	}
-	if (command === "switch") {
-		return runSwitch(rest);
-	}
-	if (command === "check") {
-		await runHealthCheck({ liveProbe: true });
-		return 0;
-	}
-	if (command === "features") {
-		return runFeaturesReport();
-	}
-	if (command === "verify-flagged") {
-		return runVerifyFlagged(rest);
-	}
-	if (command === "forecast") {
-		return runForecast(rest);
-	}
-	if (command === "report") {
-		return runReport(rest);
-	}
-	if (command === "fix") {
-		return runFix(rest);
-	}
-	if (command === "doctor") {
-		return runDoctor(rest);
-	}
+	emitTelemetry("start", "cli.command.start", { argCount: rest.length });
+	try {
+		let exitCode = 0;
+		if (command === "login") {
+			exitCode = await runWithAudit(command, async () => {
+				if (!ensureAuthorized("accounts:write", { command, interactive: output.isTTY })) {
+					return 1;
+				}
+				return runAuthLogin();
+			});
+		} else if (command === "list" || command === "status") {
+			exitCode = await runWithAudit(command, async () => {
+				if (!ensureAuthorized("accounts:read", { command, interactive: output.isTTY })) {
+					return 1;
+				}
+				return showAccountStatus(rest);
+			});
+		} else if (command === "switch") {
+			exitCode = await runWithAudit(command, async () => {
+				if (!ensureAuthorized("accounts:write", { command, interactive: output.isTTY })) {
+					return 1;
+				}
+				return runSwitch(rest);
+			});
+		} else if (command === "check") {
+			exitCode = await runWithAudit(command, async () => {
+				if (!ensureAuthorized("accounts:read", { command, interactive: output.isTTY })) {
+					return 1;
+				}
+				await runHealthCheck({ liveProbe: true });
+				return 0;
+			});
+		} else if (command === "features") {
+			if (!ensureAuthorized("accounts:read", { command, interactive: output.isTTY })) {
+				return 1;
+			}
+			exitCode = runFeaturesReport();
+		} else if (command === "verify-flagged") {
+			exitCode = await runWithAudit(command, async () => {
+				if (!ensureAuthorized("accounts:repair", { command, interactive: output.isTTY })) {
+					return 1;
+				}
+				return runVerifyFlagged(rest);
+			});
+		} else if (command === "forecast") {
+			exitCode = await runWithAudit(command, async () => {
+				if (!ensureAuthorized("accounts:read", { command, interactive: output.isTTY })) {
+					return 1;
+				}
+				return runForecast(rest);
+			});
+		} else if (command === "report") {
+			exitCode = await runWithAudit(command, async () => {
+				if (!ensureAuthorized("accounts:read", { command, interactive: output.isTTY })) {
+					return 1;
+				}
+				return runReport(rest);
+			});
+		} else if (command === "fix") {
+			exitCode = await runWithAudit(command, async () => {
+				if (!ensureAuthorized("accounts:repair", { command, interactive: output.isTTY })) {
+					return 1;
+				}
+				return runFix(rest);
+			});
+		} else if (command === "doctor") {
+			exitCode = await runWithAudit(command, async () => {
+				if (!ensureAuthorized("accounts:read", { command, interactive: output.isTTY })) {
+					return 1;
+				}
+				if (
+					rest.includes("--fix") &&
+					!ensureAuthorized("accounts:repair", { command, interactive: output.isTTY })
+				) {
+					return 1;
+				}
+				return runDoctor(rest);
+			});
+		} else if (command === "rotate-secrets") {
+			if (
+				!ensureAuthorized("secrets:rotate", {
+					command,
+					interactive: output.isTTY,
+					idempotencyKeyPresent: hasOptionFlag(rest, "--idempotency-key"),
+				})
+			) {
+				return 1;
+			}
+			exitCode = await runRotateSecrets(rest);
+		} else if (command === "telemetry") {
+			exitCode = await runWithAudit(command, async () => {
+				if (!ensureAuthorized("accounts:read", { command, interactive: output.isTTY })) {
+					return 1;
+				}
+				return runTelemetry(rest);
+			});
+		} else {
+			console.error(`Unknown command: ${command}`);
+			printUsage();
+			exitCode = 1;
+		}
 
-	console.error(`Unknown command: ${command}`);
-	printUsage();
-	return 1;
+		emitTelemetry(exitCode === 0 ? "success" : "failure", "cli.command.finish", {
+			exitCode,
+		});
+		return exitCode;
+	} catch (error) {
+		emitTelemetry("failure", "cli.command.exception", {
+			error: error instanceof Error ? error.message : String(error),
+		});
+		throw error;
+	}
 }
diff --git a/lib/codex-manager/settings-hub.ts b/lib/codex-manager/settings-hub.ts
index 99cbdae4a..77cb9f8b7 100644
--- a/lib/codex-manager/settings-hub.ts
+++ b/lib/codex-manager/settings-hub.ts
@@ -185,6 +185,7 @@ type BackendNumberSettingKey =
 	| "proactiveRefreshBufferMs"
 	| "parallelProbingMaxConcurrency"
 	| "fastSessionMaxInputItems"
+	| "retryAllAccountsAbsoluteCeilingMs"
 	| "networkErrorCooldownMs"
 	| "serverErrorCooldownMs"
 	| "fetchTimeoutMs"
@@ -377,6 +378,15 @@ const BACKEND_NUMBER_OPTIONS: BackendNumberSettingOption[] = [
 		step: 2,
 		unit: "count",
 	},
+	{
+		key: "retryAllAccountsAbsoluteCeilingMs",
+		label: "Retry-All Absolute Wait Ceiling",
+		description: "Total max wait for retry-all-on-rate-limit. Set 0 for unlimited.",
+		min: 0,
+		max: 24 * 60 * 60_000,
+		step: 30_000,
+		unit: "ms",
+	},
 	{
 		key: "networkErrorCooldownMs",
 		label: "Network Error Cooldown",
@@ -486,6 +496,7 @@ const BACKEND_CATEGORY_OPTIONS: BackendCategoryOption[] = [
 			"preemptiveQuotaRemainingPercent5h",
 			"preemptiveQuotaRemainingPercent7d",
 			"preemptiveQuotaMaxDeferralMs",
+			"retryAllAccountsAbsoluteCeilingMs",
 		],
 	},
 	{
@@ -974,8 +985,20 @@ function buildBackendSettingsPreview(
 		config.preemptiveQuotaRemainingPercent7d ??
 		BACKEND_DEFAULTS.preemptiveQuotaRemainingPercent7d ??
 		5;
+	const retryAllAbsoluteCeilingMs =
+		config.retryAllAccountsAbsoluteCeilingMs ??
+		BACKEND_DEFAULTS.retryAllAccountsAbsoluteCeilingMs ??
+		0;
 	const fetchTimeout = config.fetchTimeoutMs ?? BACKEND_DEFAULTS.fetchTimeoutMs ?? 60_000;
 	const stallTimeout = config.streamStallTimeoutMs ?? BACKEND_DEFAULTS.streamStallTimeoutMs ?? 45_000;
+	const retryAllAbsoluteCeilingOption = BACKEND_NUMBER_OPTION_BY_KEY.get(
+		"retryAllAccountsAbsoluteCeilingMs",
+	);
+	const retryCeilingLabel = retryAllAbsoluteCeilingMs === 0
+		? "unlimited"
+		: retryAllAbsoluteCeilingOption
+			? formatBackendNumberValue(retryAllAbsoluteCeilingOption, retryAllAbsoluteCeilingMs)
+			: `${retryAllAbsoluteCeilingMs}ms`;
 	const fetchTimeoutOption = BACKEND_NUMBER_OPTION_BY_KEY.get("fetchTimeoutMs");
 	const stallTimeoutOption = BACKEND_NUMBER_OPTION_BY_KEY.get("streamStallTimeoutMs");
 
@@ -993,6 +1016,7 @@ function buildBackendSettingsPreview(
 	const hint = [
 		`thresholds 5h<=${highlightIfFocused("preemptiveQuotaRemainingPercent5h", `${threshold5h}%`)}`,
 		`7d<=${highlightIfFocused("preemptiveQuotaRemainingPercent7d", `${threshold7d}%`)}`,
+		`retry ceiling ${highlightIfFocused("retryAllAccountsAbsoluteCeilingMs", retryCeilingLabel)}`,
 		`timeouts ${highlightIfFocused("fetchTimeoutMs", fetchTimeoutOption ? formatBackendNumberValue(fetchTimeoutOption, fetchTimeout) : `${fetchTimeout}ms`)}/${highlightIfFocused("streamStallTimeoutMs", stallTimeoutOption ? formatBackendNumberValue(stallTimeoutOption, stallTimeout) : `${stallTimeout}ms`)}`,
 	].join(" | ");
 
@@ -1069,6 +1093,10 @@ function clampBackendNumberForTests(settingKey: string, value: number): number {
 	return clampBackendNumber(option, value);
 }
 
+function buildBackendSettingsPreviewForTests(config: PluginConfig): { label: string; hint: string } {
+	return buildBackendSettingsPreview(config, getUiRuntimeOptions());
+}
+
 async function withQueuedRetryForTests<T>(
 	pathKey: string,
 	task: () => Promise<T>,
@@ -1093,6 +1121,7 @@ async function persistBackendConfigSelectionForTests(
 
 const __testOnly = {
 	clampBackendNumber: clampBackendNumberForTests,
+	buildBackendSettingsPreview: buildBackendSettingsPreviewForTests,
 	formatMenuLayoutMode,
 	cloneDashboardSettings,
 	withQueuedRetry: withQueuedRetryForTests,
diff --git a/lib/config.ts b/lib/config.ts
index f9e7ecf85..a5a100c53 100644
--- a/lib/config.ts
+++ b/lib/config.ts
@@ -1,5 +1,6 @@
 import { readFileSync, existsSync, promises as fs } from "node:fs";
 import { dirname, join } from "node:path";
+import { createHash, randomUUID } from "node:crypto";
 import type { PluginConfig } from "./types.js";
 import { logWarn } from "./logger.js";
 import { PluginConfigSchema, getValidationErrors } from "./schemas.js";
@@ -34,6 +35,19 @@ const UNSUPPORTED_CODEX_POLICIES = new Set(["strict", "fallback"]);
 const emittedConfigWarnings = new Set<string>();
 const configSaveQueues = new Map<string, Promise<void>>();
 const RETRYABLE_FS_CODES = new Set(["EBUSY", "EPERM"]);
+const SECURE_DIR_MODE = 0o700;
+const SECURE_FILE_MODE = 0o600;
+const CONFIG_CONFLICT_RETRY_LIMIT = 3;
+const CONFIG_IO_RETRY_ATTEMPTS = 5;
+const CONFIG_IO_RETRY_BASE_MS = 10;
+const CONFIG_LOCK_STALE_MS = 30_000;
+const CONFIG_LOCK_WAIT_TIMEOUT_MS = 5_000;
+const RETRY_ALL_ACCOUNTS_DEFAULT_MAX_RETRIES = 12;
+const RETRY_ALL_ACCOUNTS_HARD_MAX_RETRIES = 100;
+const CONFIG_READ_MAX_ATTEMPTS = 4;
+const CONFIG_READ_RETRY_BASE_DELAY_MS = 10;
+const pluginConfigShape = PluginConfigSchema.shape;
+type PluginConfigShapeKey = keyof typeof pluginConfigShape;
 
 export type UnsupportedCodexPolicy = "strict" | "fallback";
 
@@ -124,7 +138,8 @@ export const DEFAULT_PLUGIN_CONFIG: PluginConfig = {
 	fastSessionMaxInputItems: 30,
 	retryAllAccountsRateLimited: true,
 	retryAllAccountsMaxWaitMs: 0,
-	retryAllAccountsMaxRetries: Infinity,
+	retryAllAccountsMaxRetries: RETRY_ALL_ACCOUNTS_DEFAULT_MAX_RETRIES,
+	retryAllAccountsAbsoluteCeilingMs: 0,
 	unsupportedCodexPolicy: "strict",
 	fallbackOnUnsupportedCodexModel: false,
 	fallbackToGpt52OnUnsupportedGpt53: true,
@@ -133,6 +148,7 @@ export const DEFAULT_PLUGIN_CONFIG: PluginConfig = {
 	rateLimitToastDebounceMs: 60_000,
 	toastDurationMs: 5_000,
 	perProjectAccounts: true,
+	telemetryEnabled: true,
 	sessionRecovery: true,
 	autoResume: true,
 	parallelProbing: false,
@@ -193,7 +209,7 @@ export function loadPluginConfig(): PluginConfig {
 				return { ...DEFAULT_PLUGIN_CONFIG };
 			}
 
-			const fileContent = readFileSync(configPath, "utf-8");
+			const fileContent = readFileSyncWithRetry(configPath, "utf-8");
 			const normalizedFileContent = stripUtf8Bom(fileContent);
 			userConfig = JSON.parse(normalizedFileContent) as unknown;
 			sourceKind = "file";
@@ -222,6 +238,7 @@ export function loadPluginConfig(): PluginConfig {
 				`Plugin config validation warnings: ${schemaErrors.slice(0, 3).join(", ")}`,
 			);
 		}
+		const sanitizedConfig = sanitizePluginConfigRecord(userConfig);
 
 		if (
 			sourceKind === "file" &&
@@ -235,7 +252,7 @@ export function loadPluginConfig(): PluginConfig {
 
 		return {
 			...DEFAULT_PLUGIN_CONFIG,
-			...(userConfig as Partial<PluginConfig>),
+			...sanitizedConfig,
 		};
 	} catch (error) {
 		const configPath = resolvePluginConfigPath() ?? CONFIG_PATH;
@@ -268,22 +285,147 @@ function isRecord(value: unknown): value is Record<string, unknown> {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 
+function isPluginConfigShapeKey(key: string): key is PluginConfigShapeKey {
+	return Object.hasOwn(pluginConfigShape, key);
+}
+
+function sanitizePluginConfigRecord(userConfig: unknown): Partial<PluginConfig> {
+	if (!isRecord(userConfig)) return {};
+	const sanitized: Record<string, unknown> = {};
+	for (const [key, value] of Object.entries(userConfig)) {
+		if (!isPluginConfigShapeKey(key)) continue;
+		const parsed = pluginConfigShape[key].safeParse(value);
+		if (parsed.success && parsed.data !== undefined) {
+			sanitized[key] = parsed.data;
+		}
+	}
+	return sanitized as Partial<PluginConfig>;
+}
+
 function isRetryableFsError(error: unknown): boolean {
 	const code = (error as NodeJS.ErrnoException | undefined)?.code;
 	return typeof code === "string" && RETRYABLE_FS_CODES.has(code);
 }
 
+function sleepSync(ms: number): void {
+	Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+
+function readFileSyncWithRetry(path: string, encoding: BufferEncoding): string {
+	for (let attempt = 0; attempt < CONFIG_READ_MAX_ATTEMPTS; attempt += 1) {
+		try {
+			return readFileSync(path, encoding);
+		} catch (error) {
+			if (!isRetryableFsError(error) || attempt >= CONFIG_READ_MAX_ATTEMPTS - 1) {
+				throw error;
+			}
+			sleepSync(CONFIG_READ_RETRY_BASE_DELAY_MS * 2 ** attempt);
+		}
+	}
+	throw new Error(`Failed to read config file after ${CONFIG_READ_MAX_ATTEMPTS} attempts`);
+}
+
 function sleep(ms: number): Promise<void> {
 	return new Promise((resolve) => setTimeout(resolve, ms));
 }
 
+function computeSha256(value: string): string {
+	return createHash("sha256").update(value).digest("hex");
+}
+
+function createConfigConflictError(path: string): Error & { code: string } {
+	return Object.assign(
+		new Error(
+			`Detected concurrent config modification at ${path}; reload and retry`,
+		),
+		{ code: "ECONFLICT" as const },
+	);
+}
+
+function isConfigConflictError(error: unknown): boolean {
+	const code = (error as NodeJS.ErrnoException | undefined)?.code;
+	return code === "ECONFLICT";
+}
+
+async function readFileUtf8WithRetry(path: string): Promise<string> {
+	for (let attempt = 0; attempt < CONFIG_IO_RETRY_ATTEMPTS; attempt += 1) {
+		try {
+			return await fs.readFile(path, "utf-8");
+		} catch (error) {
+			if (!isRetryableFsError(error) || attempt + 1 >= CONFIG_IO_RETRY_ATTEMPTS) {
+				throw error;
+			}
+			await sleep(CONFIG_IO_RETRY_BASE_MS * 2 ** attempt);
+		}
+	}
+	throw new Error(`Failed to read config file after ${CONFIG_IO_RETRY_ATTEMPTS} attempts`);
+}
+
+type JsonRecordSnapshot = {
+	record: Record<string, unknown> | null;
+	revision: string | null;
+};
+
+type ConfigSaveFileLock = {
+	lockPath: string;
+	token: string;
+};
+
+type ConfigSaveLockObservation = {
+	token: string | null;
+	fingerprint: string;
+};
+
+async function readConfigSnapshotFromPath(
+	configPath: string,
+): Promise<JsonRecordSnapshot> {
+	if (!existsSync(configPath)) {
+		return { record: null, revision: null };
+	}
+	let fileContent: string;
+	try {
+		fileContent = await readFileUtf8WithRetry(configPath);
+	} catch (error) {
+		const code = (error as NodeJS.ErrnoException | undefined)?.code;
+		if (code === "ENOENT") {
+			return { record: null, revision: null };
+		}
+		throw error;
+	}
+	const normalizedFileContent = stripUtf8Bom(fileContent);
+	const revision = computeSha256(normalizedFileContent);
+	let record: Record<string, unknown> | null = null;
+	try {
+		const parsed = JSON.parse(normalizedFileContent) as unknown;
+		record = isRecord(parsed) ? parsed : null;
+	} catch {
+		record = null;
+	}
+	return {
+		record,
+		revision,
+	};
+}
+
 async function writeJsonFileAtomicWithRetry(
 	filePath: string,
 	payload: Record<string, unknown>,
+	options?: { expectedRevision?: string | null },
 ): Promise<void> {
+	const expectedRevision = options?.expectedRevision;
+	if (expectedRevision !== undefined) {
+		const currentSnapshot = await readConfigSnapshotFromPath(filePath);
+		if (currentSnapshot.revision !== expectedRevision) {
+			throw createConfigConflictError(filePath);
+		}
+	}
+
 	const tempPath = `${filePath}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2, 8)}.tmp`;
-	await fs.mkdir(dirname(filePath), { recursive: true });
-	await fs.writeFile(tempPath, `${JSON.stringify(payload, null, 2)}\n`, "utf8");
+	await fs.mkdir(dirname(filePath), { recursive: true, mode: SECURE_DIR_MODE });
+	await fs.writeFile(tempPath, `${JSON.stringify(payload, null, 2)}\n`, {
+		encoding: "utf8",
+		mode: SECURE_FILE_MODE,
+	});
 	let renamed = false;
 	try {
 		for (let attempt = 0; attempt < 5; attempt += 1) {
@@ -309,9 +451,111 @@ async function writeJsonFileAtomicWithRetry(
 	}
 }
 
+function toConfigSaveLockFingerprint(raw: string): string {
+	return computeSha256(raw);
+}
+
+function parseConfigSaveLockToken(raw: string): string | null {
+	const trimmed = raw.trim();
+	if (trimmed.length === 0) {
+		return null;
+	}
+	try {
+		const parsed = JSON.parse(trimmed) as unknown;
+		if (!isRecord(parsed)) {
+			return null;
+		}
+		const token = parsed.token;
+		if (typeof token !== "string") {
+			return null;
+		}
+		const normalized = token.trim();
+		return normalized.length > 0 ? normalized : null;
+	} catch {
+		return null;
+	}
+}
+
+async function readConfigSaveLockObservation(lockPath: string): Promise<ConfigSaveLockObservation | null> {
+	try {
+		const raw = await fs.readFile(lockPath, "utf8");
+		return {
+			token: parseConfigSaveLockToken(raw),
+			fingerprint: toConfigSaveLockFingerprint(raw),
+		};
+	} catch (error) {
+		const code = (error as NodeJS.ErrnoException | undefined)?.code;
+		if (code === "ENOENT") {
+			return null;
+		}
+		throw error;
+	}
+}
+
+async function removeConfigSaveLockIfOwnerMatches(
+	lockPath: string,
+	owner: { token?: string; fingerprint?: string },
+): Promise<boolean> {
+	const observation = await readConfigSaveLockObservation(lockPath);
+	if (!observation) {
+		return true;
+	}
+
+	const tokenMatches =
+		typeof owner.token === "string" &&
+		owner.token.length > 0 &&
+		observation.token === owner.token;
+	const fingerprintMatches =
+		typeof owner.fingerprint === "string" &&
+		owner.fingerprint.length > 0 &&
+		observation.fingerprint === owner.fingerprint;
+	if (!tokenMatches && !fingerprintMatches) {
+		return false;
+	}
+
+	try {
+		await fs.unlink(lockPath);
+		return true;
+	} catch (error) {
+		const code = (error as NodeJS.ErrnoException | undefined)?.code;
+		if (code === "ENOENT") {
+			return true;
+		}
+		throw error;
+	}
+}
+
 async function withConfigSaveLock(path: string, task: () => Promise<void>): Promise<void> {
 	const previous = configSaveQueues.get(path) ?? Promise.resolve();
-	const queued = previous.catch(() => {}).then(task);
+	const queued = previous.catch(() => {}).then(async () => {
+		await fs.mkdir(dirname(path), { recursive: true });
+		const lock = await acquireConfigSaveFileLock(path);
+		let taskError: unknown;
+		try {
+			await task();
+		} catch (error) {
+			taskError = error;
+			throw error;
+		} finally {
+			try {
+				await releaseConfigSaveFileLock(lock);
+			} catch (releaseError) {
+				if (taskError !== undefined) {
+					logWarn(
+						`Failed to release config save lock after save error at ${lock.lockPath}: ${
+							releaseError instanceof Error ? releaseError.message : String(releaseError)
+						}`,
+					);
+				} else {
+					logWarn(
+						`Failed to release config save lock after successful save at ${lock.lockPath}: ${
+							releaseError instanceof Error ? releaseError.message : String(releaseError)
+						}`,
+					);
+				}
+			}
+		}
+	});
 	configSaveQueues.set(path, queued);
 	try {
 		await queued;
@@ -322,6 +566,88 @@ async function withConfigSaveLock(path: string, task: () => Promise<void>): Prom
 	}
 }
 
+async function acquireConfigSaveFileLock(path: string): Promise<ConfigSaveFileLock> {
+	const lockPath = `${path}.lock`;
+	const waitDeadline = Date.now() + CONFIG_LOCK_WAIT_TIMEOUT_MS;
+	const lockToken = randomUUID();
+	let attempt = 0;
+	while (true) {
+		try {
+			const handle = await fs.open(lockPath, "wx");
+			try {
+				await handle.writeFile(
+					`${JSON.stringify({
+						pid: process.pid,
+						token: lockToken,
+						acquiredAt: Date.now(),
+					})}\n`,
+					"utf8",
+				);
+			} finally {
+				await handle.close();
+			}
+			return { lockPath, token: lockToken };
+		} catch (error) {
+			const code = (error as NodeJS.ErrnoException | undefined)?.code;
+			if (code === "EEXIST") {
+				try {
+					const stat = await fs.stat(lockPath);
+					if (Date.now() - stat.mtimeMs >= CONFIG_LOCK_STALE_MS) {
+						const staleOwner = await readConfigSaveLockObservation(lockPath);
+						if (!staleOwner) {
+							continue;
+						}
+						const removed = await removeConfigSaveLockIfOwnerMatches(lockPath, {
+							fingerprint: staleOwner.fingerprint,
+						});
+						if (removed) {
+							continue;
+						}
+					}
+				} catch (statError) {
+					const statCode = (statError as NodeJS.ErrnoException | undefined)?.code;
+					if (statCode === "ENOENT") {
+						continue;
+					}
+					if (!isRetryableFsError(statError)) {
+						throw statError;
+					}
+				}
+				if (Date.now() >= waitDeadline) {
+					throw new Error(`Timed out waiting for config save lock at ${lockPath}`);
+				}
+				await sleep(CONFIG_IO_RETRY_BASE_MS * 2 ** Math.min(attempt, 6));
+				attempt += 1;
+				continue;
+			}
+			if (isRetryableFsError(error) && Date.now() < waitDeadline) {
+				await sleep(CONFIG_IO_RETRY_BASE_MS * 2 ** Math.min(attempt, 6));
+				attempt += 1;
+				continue;
+			}
+			throw error;
+		}
+	}
+}
+
+async function releaseConfigSaveFileLock(lock: ConfigSaveFileLock): Promise<void> {
+	for (let attempt = 0; attempt < CONFIG_IO_RETRY_ATTEMPTS; attempt += 1) {
+		try {
+			await removeConfigSaveLockIfOwnerMatches(lock.lockPath, { token: lock.token });
+			return;
+		} catch (error) {
+			const code = (error as NodeJS.ErrnoException | undefined)?.code;
+			if (code === "ENOENT") {
+				return;
+			}
+			if (!isRetryableFsError(error) || attempt + 1 >= CONFIG_IO_RETRY_ATTEMPTS) {
+				throw error;
+			}
+			await sleep(CONFIG_IO_RETRY_BASE_MS * 2 ** attempt);
+		}
+	}
+}
+
 /**
  * Read and parse a JSON configuration file and return its top-level object when present and valid.
  *
@@ -333,7 +659,7 @@ async function withConfigSaveLock(path: string, task: () => Promise<void>): Prom
 function readConfigRecordFromPath(configPath: string): Record<string, unknown> | null {
 	if (!existsSync(configPath)) return null;
 	try {
-		const fileContent = readFileSync(configPath, "utf-8");
+		const fileContent = readFileSyncWithRetry(configPath, "utf-8");
 		const normalizedFileContent = stripUtf8Bom(fileContent);
 		const parsed = JSON.parse(normalizedFileContent) as unknown;
 		return isRecord(parsed) ? parsed : null;
@@ -376,10 +702,10 @@ function sanitizePluginConfigForSave(config: Partial<PluginConfig>): Record<stri
  * Persist a partial plugin configuration to disk, merging it with existing stored settings.
  *
  * This writes the sanitized patch either to the path specified by the CODEX_MULTI_AUTH_CONFIG_PATH
- * environment variable (if set) or into the unified settings store. The function does not take
- * internal locks; callers should avoid concurrent invocations that might overwrite each other.
- * On Windows and other platforms the write behavior follows the Node.js filesystem semantics and may
- * not be atomic across processes. Callers are responsible for redacting any sensitive values
+ * environment variable (if set) or into the unified settings store. Saves are serialized both
+ * in-process and across processes with a lock file to prevent stale CAS races.
+ * On Windows and other platforms the write behavior follows Node.js filesystem semantics.
+ * Callers are responsible for redacting any sensitive values
  * (tokens, secrets) before calling if redaction is required; this function writes merged values as-is.
  *
  * @param configPatch - Partial PluginConfig containing changes to persist; undefined fields are ignored.
@@ -391,25 +717,40 @@ export async function savePluginConfig(configPatch: Partial<PluginConfig>): Prom
 
 	if (envPath.length > 0) {
 		await withConfigSaveLock(envPath, async () => {
-			const merged = {
-				...(readConfigRecordFromPath(envPath) ?? {}),
-				...sanitizedPatch,
-			};
-			await writeJsonFileAtomicWithRetry(envPath, merged);
+			let lastError: unknown;
+			for (let attempt = 0; attempt < CONFIG_CONFLICT_RETRY_LIMIT; attempt += 1) {
+				const snapshot = await readConfigSnapshotFromPath(envPath);
+				const merged = {
+					...(snapshot.record ?? {}),
+					...sanitizedPatch,
+				};
+				try {
+					await writeJsonFileAtomicWithRetry(envPath, merged, {
+						expectedRevision: snapshot.revision,
+					});
+					return;
+				} catch (error) {
+					lastError = error;
+					if (
+						!isConfigConflictError(error) ||
+						attempt >= CONFIG_CONFLICT_RETRY_LIMIT - 1
+					) {
+						throw error;
+					}
+				}
+			}
+			throw lastError instanceof Error ? lastError : new Error("Failed to save plugin config");
 		});
 		return;
 	}
 
-	const unifiedPath = getUnifiedSettingsPath();
-	await withConfigSaveLock(unifiedPath, async () => {
-		const unifiedConfig = loadUnifiedPluginConfigSync();
-		const legacyPath = unifiedConfig ? null : resolvePluginConfigPath();
-		const merged = {
-			...(unifiedConfig ?? (legacyPath ? readConfigRecordFromPath(legacyPath) : null) ?? {}),
-			...sanitizedPatch,
-		};
-		await saveUnifiedPluginConfig(merged);
-	});
+	const unifiedConfig = loadUnifiedPluginConfigSync();
+	const legacyPath = unifiedConfig ? null : resolvePluginConfigPath();
+	const merged = {
+		...(unifiedConfig ?? (legacyPath ? readConfigRecordFromPath(legacyPath) : null) ?? {}),
+		...sanitizedPatch,
+	};
+	await saveUnifiedPluginConfig(merged);
 }
 
 /**
@@ -586,8 +927,17 @@ export function getRetryAllAccountsMaxRetries(pluginConfig: PluginConfig): numbe
 	return resolveNumberSetting(
 		"CODEX_AUTH_RETRY_ALL_MAX_RETRIES",
 		pluginConfig.retryAllAccountsMaxRetries,
-		Infinity,
-		{ min: 0 },
+		RETRY_ALL_ACCOUNTS_DEFAULT_MAX_RETRIES,
+		{ min: 0, max: RETRY_ALL_ACCOUNTS_HARD_MAX_RETRIES },
+	);
+}
+
+export function getRetryAllAccountsAbsoluteCeilingMs(pluginConfig: PluginConfig): number {
+	return resolveNumberSetting(
+		"CODEX_AUTH_RETRY_ALL_ABSOLUTE_CEILING_MS",
+		pluginConfig.retryAllAccountsAbsoluteCeilingMs,
+		0,
+		{ min: 0, max: 24 * 60 * 60_000 },
 	);
 }
 
@@ -721,6 +1071,14 @@ export function getPerProjectAccounts(pluginConfig: PluginConfig): boolean {
 	);
 }
 
+export function getTelemetryEnabled(pluginConfig: PluginConfig): boolean {
+	return resolveBooleanSetting(
+		"CODEX_AUTH_TELEMETRY_ENABLED",
+		pluginConfig.telemetryEnabled,
+		true,
+	);
+}
+
 export function getParallelProbing(pluginConfig: PluginConfig): boolean {
 	return resolveBooleanSetting(
 		"CODEX_AUTH_PARALLEL_PROBING",
diff --git a/lib/data-redaction.ts b/lib/data-redaction.ts
new file mode 100644
index 000000000..97f8e86c4
--- /dev/null
+++ b/lib/data-redaction.ts
@@ -0,0 +1,77 @@
+const DEFAULT_REDACT_KEYS = new Set([
+	"token",
+	"access",
+	"accessToken",
+	"refresh",
+	"refreshToken",
+	"idToken",
+	"secret",
+	"password",
+	"authorization",
+	"apiKey",
+	"credential",
+	"email",
+	"accountId",
+]);
+
+function isObjectRecord(value: unknown): value is Record<string, unknown> {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+function shouldRedactKey(key: string): boolean {
+	const normalized = key.replace(/[_-]/g, "").toLowerCase();
+	for (const candidate of DEFAULT_REDACT_KEYS) {
+		if (normalized.includes(candidate.replace(/[_-]/g, "").toLowerCase())) {
+			return true;
+		}
+	}
+	return false;
+}
+
+function shouldRedactStringValue(value: string): boolean {
+	if (value.includes("@")) {
+		return true;
+	}
+	const normalized = value.toLowerCase();
+	return (
+		normalized.includes("token=") ||
+		normalized.includes("access_token") ||
+		normalized.includes("refresh_token") ||
+		normalized.includes("authorization:") ||
+		normalized.includes("api_key") ||
+		normalized.includes("secret")
+	);
+}
+
+export function redactForExternalOutput<T>(value: T): T {
+	const seen = new WeakSet<object>();
+	const visit = (node: unknown): unknown => {
+		if (typeof node === "string") {
+			return shouldRedactStringValue(node) ? "***REDACTED***" : node;
+		}
+		if (Array.isArray(node)) {
+			if (seen.has(node)) {
+				return "[Circular]";
+			}
+			seen.add(node);
+			return node.map((item) => visit(item));
+		}
+		if (!isObjectRecord(node)) {
+			return node;
+		}
+		if (seen.has(node)) {
+			return "[Circular]";
+		}
+		seen.add(node);
+		const next: Record<string, unknown> = {};
+		for (const [key, child] of Object.entries(node)) {
+			if (shouldRedactKey(key)) {
+				next[key] = "***REDACTED***";
+				continue;
+			}
+			next[key] = visit(child);
+		}
+		return next;
+	};
+	return visit(value) as T;
+}
diff --git a/lib/data-retention.ts b/lib/data-retention.ts
new file mode 100644
index 000000000..0e1981c75
--- /dev/null
+++ b/lib/data-retention.ts
@@ -0,0 +1,153 @@
+import { promises as fs, type Dirent } from "node:fs";
+import { join } from "node:path";
+import { getCodexCacheDir, getCodexLogDir, getCodexMultiAuthDir } from "./runtime-paths.js";
+import { createLogger } from "./logger.js";
+import { sleep } from "./utils.js";
+
+export interface RetentionPolicy {
+	logDays: number;
+	cacheDays: number;
+	flaggedDays: number;
+	quotaCacheDays: number;
+	dlqDays: number;
+}
+
+const DEFAULT_POLICY: RetentionPolicy = {
+	logDays: 14,
+	cacheDays: 30,
+	flaggedDays: 30,
+	quotaCacheDays: 14,
+	dlqDays: 30,
+};
+const logger = createLogger("data-retention");
+const RETRYABLE_RETENTION_CODES = new Set(["EBUSY", "EPERM", "EACCES", "EAGAIN", "ENOTEMPTY"]);
+
+function isRetryableRetentionError(error: unknown): boolean {
+	const code = (error as NodeJS.ErrnoException).code;
+	return typeof code === "string" && RETRYABLE_RETENTION_CODES.has(code);
+}
+
+async function withRetentionIoRetry<T>(operation: () => Promise<T>): Promise<T> {
+	for (let attempt = 0; attempt < 5; attempt += 1) {
+		try {
+			return await operation();
+		} catch (error) {
+			if (!isRetryableRetentionError(error) || attempt >= 4) {
+				throw error;
+			}
+			await sleep(10 * 2 ** attempt);
+		}
+	}
+	throw new Error("Unreachable retention retry state");
+}
+
+function parseEnvDays(name: string, fallback: number): number {
+	const raw = process.env[name];
+	if (!raw) return fallback;
+	const parsed = Number.parseInt(raw, 10);
+	if (!Number.isFinite(parsed)) return fallback;
+	return Math.max(1, parsed);
+}
+
+export function getRetentionPolicyFromEnv(): RetentionPolicy {
+	return {
+		logDays: parseEnvDays("CODEX_AUTH_RETENTION_LOG_DAYS", DEFAULT_POLICY.logDays),
+		cacheDays: parseEnvDays("CODEX_AUTH_RETENTION_CACHE_DAYS", DEFAULT_POLICY.cacheDays),
+		flaggedDays: parseEnvDays("CODEX_AUTH_RETENTION_FLAGGED_DAYS", DEFAULT_POLICY.flaggedDays),
+		quotaCacheDays: parseEnvDays(
+			"CODEX_AUTH_RETENTION_QUOTA_CACHE_DAYS",
+			DEFAULT_POLICY.quotaCacheDays,
+		),
+		dlqDays: parseEnvDays("CODEX_AUTH_RETENTION_DLQ_DAYS", DEFAULT_POLICY.dlqDays),
+	};
+}
+
+async function pruneDirectoryByAge(path: string, maxAgeMs: number): Promise<number> {
+	let removed = 0;
+	let entries: Dirent<string>[] = [];
+	try {
+		entries = await withRetentionIoRetry(() =>
+			fs.readdir(path, { withFileTypes: true, encoding: "utf8" }),
+		);
+	} catch (error) {
+		const code = (error as NodeJS.ErrnoException).code;
+		if (code === "ENOENT") return 0;
+		throw error;
+	}
+
+	const now = Date.now();
+	for (const entry of entries) {
+		const fullPath = join(path, entry.name);
+		try {
+			if (entry.isDirectory()) {
+				removed += await pruneDirectoryByAge(fullPath, maxAgeMs);
+				const childEntries = await withRetentionIoRetry(() => fs.readdir(fullPath));
+				if (childEntries.length === 0) {
+					await withRetentionIoRetry(() => fs.rmdir(fullPath));
+				}
+				continue;
+			}
+			if (!entry.isFile()) continue;
+			const stats = await withRetentionIoRetry(() => fs.stat(fullPath));
+			if (now - stats.mtimeMs <= maxAgeMs) continue;
+			await withRetentionIoRetry(() => fs.unlink(fullPath));
+			removed += 1;
+		} catch (error) {
+			const code = (error as NodeJS.ErrnoException).code;
+			if (code === "ENOENT") {
+				continue;
+			}
+			logger.warn("Skipping retention entry after retry exhaustion", {
+				path: fullPath,
+				code: code ?? "unknown",
+				error: error instanceof Error ? error.message : String(error),
+			});
+			throw error;
+		}
+	}
+	return removed;
+}
+
+async function pruneSingleFile(path: string, maxAgeMs: number): Promise<boolean> {
+	try {
+		const stats = await withRetentionIoRetry(() => fs.stat(path));
+		if (Date.now() - stats.mtimeMs <= maxAgeMs) {
+			return false;
+		}
+		await withRetentionIoRetry(() => fs.unlink(path));
+		return true;
+	} catch (error) {
+		const code = (error as NodeJS.ErrnoException).code;
+		if (code === "ENOENT") return false;
+		throw error;
+	}
+}
+
+export async function enforceDataRetention(
+	policy: RetentionPolicy = getRetentionPolicyFromEnv(),
+): Promise<{ removedLogs: number; removedCacheFiles: number; removedStateFiles: number }> {
+	const removedLogs = await pruneDirectoryByAge(getCodexLogDir(), policy.logDays * 24 * 60 * 60_000);
+	const removedCacheFiles = await pruneDirectoryByAge(
+		getCodexCacheDir(),
+		policy.cacheDays * 24 * 60 * 60_000,
+	);
+	const root = getCodexMultiAuthDir();
+	const removedFlagged = await pruneSingleFile(
+		join(root, "openai-codex-flagged-accounts.json"),
+		policy.flaggedDays * 24 * 60 * 60_000,
+	);
+	const removedQuota = await pruneSingleFile(
+		join(root, "quota-cache.json"),
+		policy.quotaCacheDays * 24 * 60 * 60_000,
+	);
+	const removedDlq = await pruneSingleFile(
+		join(root, "background-job-dlq.jsonl"),
+		policy.dlqDays * 24 * 60 * 60_000,
+	);
+
+	return {
+		removedLogs,
+		removedCacheFiles,
+		removedStateFiles: (removedFlagged ? 1 : 0) + (removedQuota ? 1 : 0) + (removedDlq ? 1 : 0),
+	};
+}
diff --git a/lib/file-lock.ts b/lib/file-lock.ts
new file mode 100644
index 000000000..306317db3
--- /dev/null
+++ b/lib/file-lock.ts
@@ -0,0 +1,294 @@
+import { openSync, writeFileSync, closeSync, unlinkSync, statSync, readFileSync, promises as fs } from "node:fs";
+
+export interface FileLockOptions {
+	maxAttempts?: number;
+	baseDelayMs?: number;
+	maxDelayMs?: number;
+	staleAfterMs?: number;
+}
+
+export interface FileLockHandle {
+	path: string;
+	release: () => Promise<void>;
+}
+
+export interface FileLockSyncHandle {
+	path: string;
+	release: () => void;
+}
+
+const DEFAULT_MAX_ATTEMPTS = 60;
+const DEFAULT_BASE_DELAY_MS = 25;
+const DEFAULT_MAX_DELAY_MS = 1_000;
+const DEFAULT_STALE_AFTER_MS = 5 * 60_000;
+const RETRYABLE_CODES = new Set(["EEXIST", "EBUSY", "EPERM"]);
+
+function isPidAlive(pid: number): boolean {
+	if (!Number.isInteger(pid) || pid <= 0) return false;
+	try {
+		process.kill(pid, 0);
+		return true;
+	} catch (error) {
+		const code = (error as NodeJS.ErrnoException | undefined)?.code;
+		return code === "EPERM";
+	}
+}
+
+function parseLockPid(rawLock: string): number | undefined {
+	const firstLine = rawLock.split(/\r?\n/, 1)[0] ?? "";
+	if (!firstLine) return undefined;
+	try {
+		const parsed = JSON.parse(firstLine) as { pid?: unknown };
+		return typeof parsed.pid === "number" && Number.isInteger(parsed.pid) ? parsed.pid : undefined;
+	} catch {
+		return undefined;
+	}
+}
+
+function sleep(ms: number): Promise<void> {
+	return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+function getRetryDelayMs(
+	attempt: number,
+	baseDelayMs: number,
+	maxDelayMs: number,
+): number {
+	const backoff = Math.min(maxDelayMs, baseDelayMs * 2 ** Math.min(attempt, 8));
+	const jitter = Math.floor(backoff * 0.15 * Math.random());
+	return Math.max(baseDelayMs, backoff - jitter);
+}
+
+async function removeIfStale(path: string, staleAfterMs: number): Promise<boolean> {
+	try {
+		const stats = await fs.stat(path);
+		if (Date.now() - stats.mtimeMs <= staleAfterMs) {
+			return false;
+		}
+		try {
+			const pid = parseLockPid(await fs.readFile(path, "utf8"));
+			if (pid !== undefined && isPidAlive(pid)) {
+				return false;
+			}
+		} catch {
+			// If metadata can't be read, fall back to age-only cleanup.
+		}
+		await fs.unlink(path);
+		return true;
+	} catch (error) {
+		const code = (error as NodeJS.ErrnoException).code;
+		if (code === "ENOENT") {
+			return true;
+		}
+		return false;
+	}
+}
+
+function throwOriginalOrCleanupError(
+	originalError: unknown,
+	cleanupError: unknown,
+): never {
+	if (originalError instanceof Error) {
+		throw originalError;
+	}
+	if (cleanupError instanceof Error) {
+		throw cleanupError;
+	}
+	throw new Error(String(originalError ?? cleanupError));
+}
+
+async function cleanupIncompleteLockFile(path: string, originalError?: unknown): Promise<void> {
+	try {
+		await fs.unlink(path);
+	} catch (error) {
+		const code = (error as NodeJS.ErrnoException).code;
+		if (code !== "ENOENT") {
+			if (originalError !== undefined) {
+				throwOriginalOrCleanupError(originalError, error);
+			}
+			throw error;
+		}
+	}
+}
+
+export async function acquireFileLock(
+	path: string,
+	options: FileLockOptions = {},
+): Promise<FileLockHandle> {
+	const maxAttempts = Math.max(1, Math.floor(options.maxAttempts ?? DEFAULT_MAX_ATTEMPTS));
+	const baseDelayMs = Math.max(5, Math.floor(options.baseDelayMs ?? DEFAULT_BASE_DELAY_MS));
+	const maxDelayMs = Math.max(baseDelayMs, Math.floor(options.maxDelayMs ?? DEFAULT_MAX_DELAY_MS));
+	const staleAfterMs = Math.max(1_000, Math.floor(options.staleAfterMs ?? DEFAULT_STALE_AFTER_MS));
+
+	for (let attempt = 0; attempt < maxAttempts; attempt += 1) {
+		try {
+			const handle = await fs.open(path, "wx", 0o600);
+			let writeError: unknown;
+			let closeError: unknown;
+			try {
+				await handle.writeFile(
+					`${JSON.stringify({ pid: process.pid, acquiredAt: Date.now() })}\n`,
+					"utf8",
+				);
+			} catch (error) {
+				writeError = error;
+			}
+			try {
+				await handle.close();
+			} catch (error) {
+				closeError = error;
+			}
+			if (writeError !== undefined || closeError !== undefined) {
+				const originalFailure = writeError ?? closeError;
+				await cleanupIncompleteLockFile(path, originalFailure);
+				throwOriginalOrCleanupError(originalFailure, originalFailure);
+			}
+			let released = false;
+			return {
+				path,
+				release: async () => {
+					if (released) return;
+					try {
+						await fs.unlink(path);
+						released = true;
+					} catch (error) {
+						const code = (error as NodeJS.ErrnoException).code;
+						if (code === "ENOENT") {
+							released = true;
+							return;
+						}
+						throw error;
+					}
+				},
+			};
+		} catch (error) {
+			const code = (error as NodeJS.ErrnoException).code ?? "UNKNOWN";
+			if (!RETRYABLE_CODES.has(code)) {
+				throw error;
+			}
+			const removed = await removeIfStale(path, staleAfterMs);
+			if (removed) {
+				continue;
+			}
+			if (attempt >= maxAttempts - 1) {
+				throw error;
+			}
+			await sleep(getRetryDelayMs(attempt, baseDelayMs, maxDelayMs));
+		}
+	}
+
+	throw new Error(`Failed to acquire lock: ${path}`);
+}
+
+function removeIfStaleSync(path: string, staleAfterMs: number): boolean {
+	try {
+		const stats = statSync(path);
+		if (Date.now() - stats.mtimeMs <= staleAfterMs) {
+			return false;
+		}
+		try {
+			const pid = parseLockPid(readFileSync(path, "utf8"));
+			if (pid !== undefined && isPidAlive(pid)) {
+				return false;
+			}
+		} catch {
+			// If metadata can't be read, fall back to age-only cleanup.
+		}
+		unlinkSync(path);
+		return true;
+	} catch (error) {
+		const code = (error as NodeJS.ErrnoException).code;
+		if (code === "ENOENT") {
+			return true;
+		}
+		return false;
+	}
+}
+
+function cleanupIncompleteLockFileSync(path: string, originalError?: unknown): void {
+	try {
+		unlinkSync(path);
+	} catch (error) {
+		const code = (error as NodeJS.ErrnoException).code;
+		if (code !== "ENOENT") {
+			if (originalError !== undefined) {
+				throwOriginalOrCleanupError(originalError, error);
+			}
+			throw error;
+		}
+	}
+}
+
+export function acquireFileLockSync(
+	path: string,
+	options: FileLockOptions = {},
+): FileLockSyncHandle {
+	const maxAttempts = Math.max(1, Math.floor(options.maxAttempts ?? DEFAULT_MAX_ATTEMPTS));
+	const baseDelayMs = Math.max(5, Math.floor(options.baseDelayMs ?? DEFAULT_BASE_DELAY_MS));
+	const maxDelayMs = Math.max(baseDelayMs, Math.floor(options.maxDelayMs ?? DEFAULT_MAX_DELAY_MS));
+	const staleAfterMs = Math.max(1_000, Math.floor(options.staleAfterMs ?? DEFAULT_STALE_AFTER_MS));
+
+	for (let attempt = 0; attempt < maxAttempts; attempt += 1) {
+		try {
+			const fd = openSync(path, "wx", 0o600);
+			let writeError: unknown;
+			let closeError: unknown;
+			try {
+				writeFileSync(
+					fd,
+					`${JSON.stringify({ pid: process.pid, acquiredAt: Date.now() })}\n`,
+					"utf8",
+				);
+			} catch (error) {
+				writeError = error;
+			}
+			try {
+				closeSync(fd);
+			} catch (error) {
+				closeError = error;
+			}
+			if (writeError !== undefined || closeError !== undefined) {
+				const originalFailure = writeError ?? closeError;
+				cleanupIncompleteLockFileSync(path, originalFailure);
+				throwOriginalOrCleanupError(originalFailure, originalFailure);
+			}
+			let released = false;
+			return {
+				path,
+				release: () => {
+					if (released) return;
+					try {
+						unlinkSync(path);
+						released = true;
+					} catch (error) {
+						const code = (error as NodeJS.ErrnoException).code;
+						if (code === "ENOENT") {
+							released = true;
+							return;
+						}
+						throw error;
+					}
+				},
+			};
+		} catch (error) {
+			const code = (error as NodeJS.ErrnoException).code ?? "UNKNOWN";
+			if (!RETRYABLE_CODES.has(code)) {
+				throw error;
+			}
+			const removed = removeIfStaleSync(path, staleAfterMs);
+			if (removed) {
+				continue;
+			}
+			if (attempt >= maxAttempts - 1) {
+				throw error;
+			}
+			Atomics.wait(
+				new Int32Array(new SharedArrayBuffer(4)),
+				0,
+				0,
+				getRetryDelayMs(attempt, baseDelayMs, maxDelayMs),
+			);
+		}
+	}
+	throw new Error(`Failed to acquire lock: ${path}`);
+}
diff --git a/lib/idempotency.ts b/lib/idempotency.ts
new file mode 100644
index 000000000..d951c6079
--- /dev/null
+++ b/lib/idempotency.ts
@@ -0,0 +1,249 @@
+import { promises as fs } from "node:fs";
+import { dirname, join } from "node:path";
+import { getCodexMultiAuthDir } from "./runtime-paths.js";
+import { acquireFileLock } from "./file-lock.js";
+
+const IDEMPOTENCY_PATH = join(getCodexMultiAuthDir(), "idempotency-keys.json");
+const IDEMPOTENCY_LOCK_PATH = `${IDEMPOTENCY_PATH}.lock`;
+const IDEMPOTENCY_TTL_MS = 24 * 60 * 60_000;
+const RETRYABLE_FS_CODES = new Set(["EBUSY", "EPERM", "EAGAIN", "ETIMEDOUT", "EACCES"]);
+const MAX_FS_IO_ATTEMPTS = 5;
+const BASE_RETRY_DELAY_MS = 10;
+
+type IdempotencyStatus = "pending" | "succeeded";
+
+interface IdempotencyEntry {
+	scope: string;
+	key: string;
+	createdAtMs: number;
+	status: IdempotencyStatus;
+}
+
+interface IdempotencyFile {
+	version: 1;
+	entries: IdempotencyEntry[];
+}
+
+const EMPTY_FILE: IdempotencyFile = {
+	version: 1,
+	entries: [],
+};
+
+function getRetryDelayMs(attempt: number): number {
+	return BASE_RETRY_DELAY_MS * 2 ** Math.max(0, attempt - 1);
+}
+
+function isRetryableFsError(error: unknown): boolean {
+	const code = (error as NodeJS.ErrnoException | undefined)?.code;
+	return typeof code === "string" && RETRYABLE_FS_CODES.has(code);
+}
+
+async function sleep(ms: number): Promise<void> {
+	await new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+async function withRetryableFsIo<T>(operation: () => Promise<T>): Promise<T> {
+	let lastError: unknown;
+	for (let attempt = 1; attempt <= MAX_FS_IO_ATTEMPTS; attempt += 1) {
+		try {
+			return await operation();
+		} catch (error) {
+			lastError = error;
+			if (!isRetryableFsError(error) || attempt >= MAX_FS_IO_ATTEMPTS) {
+				throw error;
+			}
+			await sleep(getRetryDelayMs(attempt));
+		}
+	}
+	throw lastError instanceof Error ? lastError : new Error("Idempotency filesystem retry exhausted");
+}
+
+function normalizeFile(value: unknown): IdempotencyFile {
+	if (!value || typeof value !== "object") return EMPTY_FILE;
+	const record = value as Record<string, unknown>;
+	if (record.version !== 1 || !Array.isArray(record.entries)) return EMPTY_FILE;
+	const entries = record.entries
+		.filter((entry): entry is Record<string, unknown> => !!entry && typeof entry === "object")
+		.map((entry) => {
+			const scope = typeof entry.scope === "string" ? entry.scope.trim() : "";
+			const key = typeof entry.key === "string" ? entry.key.trim() : "";
+			const createdAtMs =
+				typeof entry.createdAtMs === "number" && Number.isFinite(entry.createdAtMs)
+					? entry.createdAtMs
+					: 0;
+			const status: IdempotencyStatus =
+				entry.status === "pending" || entry.status === "succeeded"
+					? entry.status
+					: "succeeded";
+			return { scope, key, createdAtMs, status };
+		})
+		.filter((entry) => entry.scope.length > 0 && entry.key.length > 0 && entry.createdAtMs > 0);
+	return {
+		version: 1,
+		entries,
+	};
+}
+
+async function loadFile(): Promise<IdempotencyFile> {
+	try {
+		const raw = await withRetryableFsIo(() => fs.readFile(IDEMPOTENCY_PATH, "utf8"));
+		return normalizeFile(JSON.parse(raw) as unknown);
+	} catch (error) {
+		const code = (error as NodeJS.ErrnoException | undefined)?.code;
+		if (code === "ENOENT") return { ...EMPTY_FILE };
+		throw error;
+	}
+}
+
+async function saveFile(file: IdempotencyFile): Promise<void> {
+	await withRetryableFsIo(() => fs.mkdir(dirname(IDEMPOTENCY_PATH), { recursive: true }));
+	const tempPath = `${IDEMPOTENCY_PATH}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2, 8)}.tmp`;
+	await withRetryableFsIo(() =>
+		fs.writeFile(tempPath, `${JSON.stringify(file, null, 2)}\n`, {
+			encoding: "utf8",
+			mode: 0o600,
+		}),
+	);
+	try {
+		await withRetryableFsIo(() => fs.rename(tempPath, IDEMPOTENCY_PATH));
+	} finally {
+		try {
+			await withRetryableFsIo(() => fs.unlink(tempPath));
+		} catch {
+			// Best-effort temp cleanup.
+		}
+	}
+}
+
+function pruneExpired(entries: IdempotencyEntry[], nowMs: number, ttlMs: number): IdempotencyEntry[] {
+	const cutoff = nowMs - ttlMs;
+	return entries.filter((entry) => entry.createdAtMs >= cutoff);
+}
+
+export function getIdempotencyStorePath(): string {
+	return IDEMPOTENCY_PATH;
+}
+
+async function withIdempotencyFileLock<T>(handler: () => Promise<T>): Promise<T> {
+	await withRetryableFsIo(() => fs.mkdir(dirname(IDEMPOTENCY_PATH), { recursive: true }));
+	const lock = await acquireFileLock(IDEMPOTENCY_LOCK_PATH, {
+		maxAttempts: 80,
+		baseDelayMs: 15,
+		maxDelayMs: 800,
+		staleAfterMs: 120_000,
+	});
+	try {
+		return await handler();
+	} finally {
+		await lock.release();
+	}
+}
+
+function isMatchingEntry(entry: IdempotencyEntry, scope: string, key: string): boolean {
+	return entry.scope === scope && entry.key === key;
+}
+
+async function mutateEntries(
+	ttlMs: number,
+	mutator: (entries: IdempotencyEntry[], nowMs: number) => IdempotencyEntry[],
+): Promise<void> {
+	await withIdempotencyFileLock(async () => {
+		const nowMs = Date.now();
+		const file = await loadFile();
+		const entries = pruneExpired(file.entries, nowMs, Math.max(1, ttlMs));
+		const nextEntries = mutator(entries, nowMs);
+		await saveFile({ version: 1, entries: nextEntries });
+	});
+}
+
+export async function checkAndRecordIdempotencyKey(
+	scope: string,
+	key: string,
+	ttlMs = IDEMPOTENCY_TTL_MS,
+): Promise<{ replayed: boolean }> {
+	const normalizedScope = scope.trim();
+	const normalizedKey = key.trim();
+	if (normalizedScope.length === 0) {
+		throw new Error("Idempotency scope is required");
+	}
+	if (normalizedKey.length === 0) {
+		throw new Error("Idempotency key is required");
+	}
+
+	return withIdempotencyFileLock(async () => {
+		const nowMs = Date.now();
+		const file = await loadFile();
+		const entries = pruneExpired(file.entries, nowMs, Math.max(1, ttlMs));
+		const replayed = entries.some(
+			(entry) =>
+				isMatchingEntry(entry, normalizedScope, normalizedKey) &&
+				(entry.status === "pending" || entry.status === "succeeded"),
+		);
+		if (!replayed) {
+			entries.push({
+				scope: normalizedScope,
+				key: normalizedKey,
+				createdAtMs: nowMs,
+				status: "pending",
+			});
+		}
+		await saveFile({ version: 1, entries });
+		return { replayed };
+	});
+}
+
+export async function markIdempotencySucceeded(
+	scope: string,
+	key: string,
+	ttlMs = IDEMPOTENCY_TTL_MS,
+): Promise<void> {
+	const normalizedScope = scope.trim();
+	const normalizedKey = key.trim();
+	if (normalizedScope.length === 0 || normalizedKey.length === 0) {
+		return;
+	}
+	await mutateEntries(ttlMs, (entries, nowMs) => {
+		let updated = false;
+		const next: IdempotencyEntry[] = entries.map((entry): IdempotencyEntry => {
+			if (!isMatchingEntry(entry, normalizedScope, normalizedKey)) {
+				return entry;
+			}
+			updated = true;
+			return {
+				...entry,
+				status: "succeeded",
+				createdAtMs: nowMs,
+			};
+		});
+		if (!updated) {
+			next.push({
+				scope: normalizedScope,
+				key: normalizedKey,
+				createdAtMs: nowMs,
+				status: "succeeded",
+			});
+		}
+		return next;
+	});
+}
+
+export async function clearIdempotencyOnFailure(
+	scope: string,
+	key: string,
+	ttlMs = IDEMPOTENCY_TTL_MS,
+): Promise<void> {
+	const normalizedScope = scope.trim();
+	const normalizedKey = key.trim();
+	if (normalizedScope.length === 0 || normalizedKey.length === 0) {
+		return;
+	}
+	await mutateEntries(ttlMs, (entries) =>
+		entries.filter(
+			(entry) =>
+				!(
+					isMatchingEntry(entry, normalizedScope, normalizedKey) &&
+					entry.status === "pending"
+				),
+		),
+	);
+}
diff --git a/lib/index.ts b/lib/index.ts
index 0e2598468..19ba201e3 100644
--- a/lib/index.ts
+++ b/lib/index.ts
@@ -29,3 +29,11 @@ export * from "./codex-cli/state.js";
 export * from "./codex-cli/sync.js";
 export * from "./codex-cli/writer.js";
 export * from "./codex-cli/observability.js";
+export * from "./file-lock.js";
+export * from "./secrets-crypto.js";
+export * from "./data-retention.js";
+export * from "./data-redaction.js";
+export * from "./authorization.js";
+export * from "./background-jobs.js";
+export * from "./idempotency.js";
+export * from "./telemetry.js";
diff --git a/lib/keytar.d.ts b/lib/keytar.d.ts
new file mode 100644
index 000000000..da75e886d
--- /dev/null
+++ b/lib/keytar.d.ts
@@ -0,0 +1,5 @@
+declare module "keytar" {
+	export function setPassword(service: string, account: string, password: string): Promise<void>;
+	export function getPassword(service: string, account: string): Promise<string | null>;
+	export function deletePassword(service: string, account: string): Promise<boolean>;
+}
diff --git a/lib/network.ts b/lib/network.ts
new file mode 100644
index 000000000..d8b93dd02
--- /dev/null
+++ b/lib/network.ts
@@ -0,0 +1,204 @@
+import { isAbortError, sleep } from "./utils.js";
+
+export interface RetryAttemptInfo {
+	attempt: number;
+	maxAttempts: number;
+	delayMs: number;
+	reason: "error" | "status" | "timeout";
+	status?: number;
+	errorType?: string;
+}
+
+export interface ResilientFetchOptions {
+	timeoutMs: number;
+	retries?: number;
+	baseDelayMs?: number;
+	maxDelayMs?: number;
+	jitterMs?: number;
+	retryOnErrors?: boolean;
+	retryOnTimeout?: boolean;
+	retryOnStatuses?: readonly number[];
+	signal?: AbortSignal;
+	onRetry?: (info: RetryAttemptInfo) => void;
+}
+
+export interface ResilientFetchResult {
+	response: Response;
+	attempts: number;
+	durationMs: number;
+}
+
+const DEFAULT_BASE_DELAY_MS = 250;
+const DEFAULT_MAX_DELAY_MS = 5_000;
+const DEFAULT_JITTER_MS = 100;
+
+function createAbortError(message: string): Error {
+	const error = new Error(message);
+	error.name = "AbortError";
+	return error;
+}
+
+function isCallerAbort(error: unknown, callerSignal: AbortSignal | undefined): boolean {
+	if (!callerSignal?.aborted) return false;
+	if (isAbortError(error)) return true;
+	if (callerSignal.reason !== undefined) {
+		return error === callerSignal.reason;
+	}
+	return false;
+}
+
+function getRetryErrorType(error: unknown): string {
+	if (isAbortError(error)) return "AbortError";
+	if (error instanceof Error && error.name) return error.name;
+	return typeof error;
+}
+
+function getAbortReason(signal: AbortSignal): Error {
+	if (signal.reason instanceof Error) {
+		return signal.reason;
+	}
+	return createAbortError("Request aborted by caller");
+}
+
+function computeDelayMs(
+	attempt: number,
+	baseDelayMs: number,
+	maxDelayMs: number,
+	jitterMs: number,
+): number {
+	const cappedBase = Math.max(0, Math.floor(baseDelayMs));
+	const cappedMax = Math.max(0, Math.floor(maxDelayMs));
+	const cappedJitter = Math.max(0, Math.floor(jitterMs));
+	const exponential = Math.min(cappedMax, cappedBase * 2 ** Math.max(0, attempt - 1));
+	const jitter = cappedJitter > 0 ? Math.floor(Math.random() * (cappedJitter + 1)) : 0;
+	return exponential + jitter;
+}
+
+function shouldRetryStatus(status: number, retryOnStatuses: ReadonlySet<number>): boolean {
+	return retryOnStatuses.has(status);
+}
+
+function bindCallerAbortSignal(
+	callerSignal: AbortSignal | undefined,
+	controller: AbortController,
+): (() => void) | null {
+	if (!callerSignal) return null;
+	if (callerSignal.aborted) {
+		controller.abort(callerSignal.reason);
+		return null;
+	}
+	const onAbort = () => controller.abort(callerSignal.reason);
+	callerSignal.addEventListener("abort", onAbort, { once: true });
+	return () => callerSignal.removeEventListener("abort", onAbort);
+}
+
+async function sleepWithAbort(delayMs: number, signal?: AbortSignal): Promise<void> {
+	const normalizedDelayMs = Math.max(0, Math.floor(delayMs));
+	if (normalizedDelayMs === 0) return;
+	if (!signal) {
+		await sleep(normalizedDelayMs);
+		return;
+	}
+	if (signal.aborted) {
+		throw getAbortReason(signal);
+	}
+	await new Promise<void>((resolve, reject) => {
+		const timer = setTimeout(() => {
+			signal.removeEventListener("abort", onAbort);
+			resolve();
+		}, normalizedDelayMs);
+		const onAbort = () => {
+			clearTimeout(timer);
+			signal.removeEventListener("abort", onAbort);
+			reject(getAbortReason(signal));
+		};
+		signal.addEventListener("abort", onAbort, { once: true });
+		if (signal.aborted) {
+			onAbort();
+		}
+	});
+}
+
+/**
+ * Execute a fetch request with a per-attempt timeout and bounded retry/backoff.
+ * Caller-provided abort signals are always honored and never retried.
+ */
+export async function fetchWithTimeoutAndRetry(
+	input: URL | string | Request,
+	init: RequestInit = {},
+	options: ResilientFetchOptions,
+): Promise<ResilientFetchResult> {
+	const timeoutMs = Math.max(1_000, Math.floor(options.timeoutMs));
+	const maxAttempts = Math.max(1, Math.floor((options.retries ?? 0) + 1));
+	const baseDelayMs = options.baseDelayMs ?? DEFAULT_BASE_DELAY_MS;
+	const maxDelayMs = options.maxDelayMs ?? DEFAULT_MAX_DELAY_MS;
+	const jitterMs = options.jitterMs ?? DEFAULT_JITTER_MS;
+	const retryOnErrors = options.retryOnErrors ?? true;
+	const retryOnTimeout = options.retryOnTimeout ?? true;
+	const retryOnStatuses = new Set(options.retryOnStatuses ?? []);
+	const startedAt = Date.now();
+	let lastError: unknown = null;
+
+	for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
+		const controller = new AbortController();
+		const removeAbortListener = bindCallerAbortSignal(options.signal, controller);
+		const timeout = setTimeout(() => {
+			controller.abort(createAbortError(`Request timed out after ${timeoutMs}ms`));
+		}, timeoutMs);
+
+		try {
+			const response = await fetch(input, { ...init, signal: controller.signal });
+			if (attempt < maxAttempts && shouldRetryStatus(response.status, retryOnStatuses)) {
+				const delayMs = computeDelayMs(attempt, baseDelayMs, maxDelayMs, jitterMs);
+				options.onRetry?.({
+					attempt,
+					maxAttempts,
+					reason: "status",
+					status: response.status,
+					delayMs,
+				});
+				await response.body?.cancel().catch(() => {});
+				await sleepWithAbort(delayMs, options.signal);
+				continue;
+			}
+			return {
+				response,
+				attempts: attempt,
+				durationMs: Date.now() - startedAt,
+			};
+		} catch (error) {
+			lastError = error;
+			if (isCallerAbort(error, options.signal)) {
+				throw error;
+			}
+			if (attempt >= maxAttempts) {
+				throw error;
+			}
+			const retryReason: RetryAttemptInfo["reason"] = isAbortError(error)
+				? "timeout"
+				: "error";
+			if (
+				(retryReason === "timeout" && !retryOnTimeout) ||
+				(retryReason === "error" && !retryOnErrors)
+			) {
+				throw error;
+			}
+			const delayMs = computeDelayMs(attempt, baseDelayMs, maxDelayMs, jitterMs);
+			options.onRetry?.({
+				attempt,
+				maxAttempts,
+				reason: retryReason,
+				errorType: getRetryErrorType(error),
+				delayMs,
+			});
+			await sleepWithAbort(delayMs, options.signal);
+		} finally {
+			clearTimeout(timeout);
+			removeAbortListener?.();
+		}
+	}
+
+	throw (lastError instanceof Error
+		? lastError
+		: new Error("Request failed after all retry attempts"));
+}
diff --git a/lib/prompts/codex.ts b/lib/prompts/codex.ts
index 434d0ad20..0eac0b329 100644
--- a/lib/prompts/codex.ts
+++ b/lib/prompts/codex.ts
@@ -3,6 +3,7 @@ import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import type { CacheMetadata, GitHubRelease } from "../types.js";
 import { logWarn, logError, logDebug } from "../logger.js";
+import { fetchWithTimeoutAndRetry } from "../network.js";
 import { getCodexCacheDir } from "../runtime-paths.js";
 
 const GITHUB_API_RELEASES =
@@ -11,6 +12,12 @@ const GITHUB_HTML_RELEASES =
 	"https://github.com/openai/codex/releases/latest";
 const CACHE_DIR = getCodexCacheDir();
 const CACHE_TTL_MS = 15 * 60 * 1000;
+const GITHUB_FETCH_TIMEOUT_MS = 8_000;
+const GITHUB_FETCH_RETRIES = 1;
+const GITHUB_RETRYABLE_STATUSES = [429] as const;
+const GITHUB_FETCH_RETRY_BASE_DELAY_MS = 20;
+const GITHUB_FETCH_RETRY_MAX_DELAY_MS = 200;
+const GITHUB_FETCH_RETRY_JITTER_MS = 10;
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
@@ -19,6 +26,7 @@ const MAX_CACHE_SIZE = 50;
 const memoryCache = new Map<string, { content: string; timestamp: number }>();
 const refreshPromises = new Map<ModelFamily, Promise<void>>();
 const RELEASE_TAG_TTL_MS = 5 * 60 * 1000;
+const PROMPT_FETCH_TIMEOUT_MS = 15_000;
 let latestReleaseTagCache: { tag: string; checkedAt: number } | null = null;
 
 /**
@@ -142,7 +150,29 @@ async function getLatestReleaseTag(): Promise<string> {
 	}
 
 	try {
-		const response = await fetch(GITHUB_API_RELEASES);
+		const { response, attempts, durationMs } = await fetchWithTimeoutAndRetry(
+			GITHUB_API_RELEASES,
+			undefined,
+			{
+				timeoutMs: GITHUB_FETCH_TIMEOUT_MS,
+				retries: GITHUB_FETCH_RETRIES,
+				retryOnErrors: false,
+				retryOnTimeout: false,
+				retryOnStatuses: GITHUB_RETRYABLE_STATUSES,
+				baseDelayMs: GITHUB_FETCH_RETRY_BASE_DELAY_MS,
+				maxDelayMs: GITHUB_FETCH_RETRY_MAX_DELAY_MS,
+				jitterMs: GITHUB_FETCH_RETRY_JITTER_MS,
+				onRetry: (retry) => {
+					logDebug("Retrying GitHub release API fetch", retry);
+				},
+			},
+		);
+		if (attempts > 1) {
+			logDebug("Recovered GitHub release API fetch after retries", {
+				attempts,
+				durationMs,
+			});
+		}
 		if (response.ok) {
 			const data = (await response.json()) as GitHubRelease;
 			if (data.tag_name) {
@@ -157,7 +187,26 @@ async function getLatestReleaseTag(): Promise<string> {
 		// Fall through to HTML fallback
 	}
 
-	const htmlResponse = await fetch(GITHUB_HTML_RELEASES);
+	const { response: htmlResponse, attempts: htmlAttempts, durationMs: htmlDurationMs } =
+		await fetchWithTimeoutAndRetry(GITHUB_HTML_RELEASES, undefined, {
+			timeoutMs: GITHUB_FETCH_TIMEOUT_MS,
+			retries: GITHUB_FETCH_RETRIES,
+			retryOnErrors: false,
+			retryOnTimeout: false,
+			retryOnStatuses: GITHUB_RETRYABLE_STATUSES,
+			baseDelayMs: GITHUB_FETCH_RETRY_BASE_DELAY_MS,
+			maxDelayMs: GITHUB_FETCH_RETRY_MAX_DELAY_MS,
+			jitterMs: GITHUB_FETCH_RETRY_JITTER_MS,
+			onRetry: (retry) => {
+				logDebug("Retrying GitHub HTML release fetch", retry);
+			},
+		});
+	if (htmlAttempts > 1) {
+		logDebug("Recovered GitHub HTML release fetch after retries", {
+			attempts: htmlAttempts,
+			durationMs: htmlDurationMs,
+		});
+	}
 	if (!htmlResponse.ok) {
 		throw new Error(
 			`Failed to fetch latest release: ${htmlResponse.status}`,
@@ -313,7 +362,33 @@ async function fetchAndPersistInstructions(
 		headers["If-None-Match"] = cachedETag;
 	}
 
-	const response = await fetch(instructionsUrl, { headers });
+	const { response, attempts, durationMs } = await fetchWithTimeoutAndRetry(
+		instructionsUrl,
+		{ headers },
+		{
+			timeoutMs: PROMPT_FETCH_TIMEOUT_MS,
+			retries: GITHUB_FETCH_RETRIES,
+			retryOnErrors: false,
+			retryOnTimeout: false,
+			retryOnStatuses: GITHUB_RETRYABLE_STATUSES,
+			baseDelayMs: GITHUB_FETCH_RETRY_BASE_DELAY_MS,
+			maxDelayMs: GITHUB_FETCH_RETRY_MAX_DELAY_MS,
+			jitterMs: GITHUB_FETCH_RETRY_JITTER_MS,
+			onRetry: (retry) => {
+				logDebug("Retrying Codex prompt download", {
+					url: instructionsUrl,
+					...retry,
+				});
+			},
+		},
+	);
+	if (attempts > 1) {
+		logDebug("Recovered Codex prompt download after retries", {
+			url: instructionsUrl,
+			attempts,
+			durationMs,
+		});
+	}
 	if (response.status === 304) {
 		const diskContent = await readFileOrNull(cacheFile);
 		if (diskContent) {
diff --git a/lib/prompts/host-codex-prompt.ts b/lib/prompts/host-codex-prompt.ts
index 9323ea935..e8f8f0f91 100644
--- a/lib/prompts/host-codex-prompt.ts
+++ b/lib/prompts/host-codex-prompt.ts
@@ -8,6 +8,7 @@
 import { join } from "node:path";
 import { mkdir, readFile, writeFile, rename, rm } from "node:fs/promises";
 import { logDebug } from "../logger.js";
+import { fetchWithTimeoutAndRetry } from "../network.js";
 import { getCodexCacheDir } from "../runtime-paths.js";
 import { sleep } from "../utils.js";
 
@@ -37,6 +38,12 @@ const LEGACY_CACHE_FILES: ReadonlyArray<{ content: string; meta: string }> = [
 	},
 ];
 const CACHE_TTL_MS = 15 * 60 * 1000;
+const PROMPT_FETCH_TIMEOUT_MS = 15_000;
+const PROMPT_FETCH_RETRIES = 1;
+const PROMPT_RETRYABLE_STATUSES = [429] as const;
+const PROMPT_FETCH_RETRY_BASE_DELAY_MS = 20;
+const PROMPT_FETCH_RETRY_MAX_DELAY_MS = 200;
+const PROMPT_FETCH_RETRY_JITTER_MS = 10;
 const RETRYABLE_FS_ERROR_CODES = new Set(["EBUSY", "EPERM"]);
 const WRITE_RETRY_ATTEMPTS = 5;
 const WRITE_RETRY_BASE_DELAY_MS = 10;
@@ -278,7 +285,34 @@ async function refreshPrompt(
 
 		let response: Response;
 		try {
-			response = await fetch(sourceUrl, { headers });
+			const fetchResult = await fetchWithTimeoutAndRetry(
+				sourceUrl,
+				{ headers },
+				{
+					timeoutMs: PROMPT_FETCH_TIMEOUT_MS,
+					retries: PROMPT_FETCH_RETRIES,
+					retryOnErrors: false,
+					retryOnTimeout: false,
+					retryOnStatuses: PROMPT_RETRYABLE_STATUSES,
+					baseDelayMs: PROMPT_FETCH_RETRY_BASE_DELAY_MS,
+					maxDelayMs: PROMPT_FETCH_RETRY_MAX_DELAY_MS,
+					jitterMs: PROMPT_FETCH_RETRY_JITTER_MS,
+					onRetry: (retry) => {
+						logDebug("Retrying host-codex prompt source fetch", {
+							sourceUrl: redactSourceForLog(sourceUrl),
+							...retry,
+						});
+					},
+				},
+			);
+			response = fetchResult.response;
+			if (fetchResult.attempts > 1) {
+				logDebug("Recovered host-codex prompt source fetch after retries", {
+					sourceUrl: redactSourceForLog(sourceUrl),
+					attempts: fetchResult.attempts,
+					durationMs: fetchResult.durationMs,
+				});
+			}
 		} catch (error) {
 			lastFailure = `${redactSourceForLog(sourceUrl)}: ${String(error)}`;
 			logDebug("Codex prompt source fetch failed", {
diff --git a/lib/quota-cache.ts b/lib/quota-cache.ts
index 9870a2b69..da6879ca5 100644
--- a/lib/quota-cache.ts
+++ b/lib/quota-cache.ts
@@ -3,6 +3,7 @@ import { basename, join } from "node:path";
 import { logWarn } from "./logger.js";
 import { getCodexMultiAuthDir } from "./runtime-paths.js";
 import { isRecord, sleep } from "./utils.js";
+import { acquireFileLock } from "./file-lock.js";
 
 export interface QuotaCacheWindow {
 	usedPercent?: number;
@@ -31,6 +32,7 @@ interface QuotaCacheFile {
 }
 
 const QUOTA_CACHE_PATH = join(getCodexMultiAuthDir(), "quota-cache.json");
+const QUOTA_CACHE_LOCK_PATH = `${QUOTA_CACHE_PATH}.lock`;
 const QUOTA_CACHE_LABEL = basename(QUOTA_CACHE_PATH);
 const RETRYABLE_FS_CODES = new Set(["EBUSY", "EPERM"]);
 
@@ -216,7 +218,7 @@ export async function loadQuotaCache(): Promise<QuotaCacheData> {
  * @param data - The quota cache data (byAccountId and byEmail maps) to persist; callers
  *               should pass normalized QuotaCacheData.
  */
-export async function saveQuotaCache(data: QuotaCacheData): Promise<void> {
+export async function saveQuotaCache(data: QuotaCacheData): Promise<boolean> {
 	const payload: QuotaCacheFile = {
 		version: 1,
 		byAccountId: data.byAccountId,
@@ -225,37 +227,50 @@ export async function saveQuotaCache(data: QuotaCacheData): Promise<void> {
 
 	try {
 		await fs.mkdir(getCodexMultiAuthDir(), { recursive: true });
-		const tempPath = `${QUOTA_CACHE_PATH}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2, 8)}.tmp`;
-		await fs.writeFile(tempPath, `${JSON.stringify(payload, null, 2)}\n`, {
-			encoding: "utf8",
-			mode: 0o600,
+		// Integration coverage for concurrent writers lives in test/quota-cache.test.ts.
+		const lock = await acquireFileLock(QUOTA_CACHE_LOCK_PATH, {
+			maxAttempts: 80,
+			baseDelayMs: 15,
+			maxDelayMs: 800,
+			staleAfterMs: 120_000,
 		});
-		let renamed = false;
 		try {
-			for (let attempt = 0; attempt < 5; attempt += 1) {
-				try {
-					await fs.rename(tempPath, QUOTA_CACHE_PATH);
-					renamed = true;
-					break;
-				} catch (error) {
-					if (!isRetryableFsError(error) || attempt >= 4) throw error;
-					await sleep(10 * 2 ** attempt);
+			const tempPath = `${QUOTA_CACHE_PATH}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2, 8)}.tmp`;
+			await fs.writeFile(tempPath, `${JSON.stringify(payload, null, 2)}\n`, {
+				encoding: "utf8",
+				mode: 0o600,
+			});
+			let renamed = false;
+			try {
+				for (let attempt = 0; attempt < 5; attempt += 1) {
+					try {
+						await fs.rename(tempPath, QUOTA_CACHE_PATH);
+						renamed = true;
+						break;
+					} catch (error) {
+						if (!isRetryableFsError(error) || attempt >= 4) throw error;
+						await sleep(10 * 2 ** attempt);
+					}
 				}
-			}
-		} finally {
-			if (!renamed) {
-				try {
-					await fs.unlink(tempPath);
-				} catch {
-					// Best effort temp cleanup.
+			} finally {
+				if (!renamed) {
+					try {
+						await fs.unlink(tempPath);
+					} catch {
+						// Best effort temp cleanup.
+					}
 				}
 			}
+		} finally {
+			await lock.release();
 		}
+		return true;
 	} catch (error) {
 		logWarn(
 			`Failed to save quota cache to ${QUOTA_CACHE_LABEL}: ${
 				error instanceof Error ? error.message : String(error)
 			}`,
 		);
+		return false;
 	}
 }
diff --git a/lib/recovery/storage.ts b/lib/recovery/storage.ts
index 9feb1e170..bdd2d681b 100644
--- a/lib/recovery/storage.ts
+++ b/lib/recovery/storage.ts
@@ -8,8 +8,12 @@ import { existsSync, mkdirSync, readdirSync, readFileSync, unlinkSync, writeFile
 import { join } from "node:path";
 import { MESSAGE_STORAGE, PART_STORAGE, THINKING_TYPES, META_TYPES } from "./constants.js";
 import type { StoredMessageMeta, StoredPart, StoredTextPart } from "./types.js";
+import { createLogger } from "../logger.js";
+import { isRecord } from "../utils.js";
 
 const SAFE_ID_PATTERN = /^[a-zA-Z0-9_-]+$/;
+const CORRUPTION_WARNING_LIMIT = 25;
+const log = createLogger("recovery-storage");
 
 function validatePathId(id: string, name: string): void {
   if (!SAFE_ID_PATTERN.test(id)) {
@@ -17,6 +21,54 @@ function validatePathId(id: string, name: string): void {
   }
 }
 
+function isStoredMessageMeta(value: unknown): value is StoredMessageMeta {
+  if (!isRecord(value)) return false;
+  return (
+    typeof value.id === "string" &&
+    value.id.length > 0 &&
+    typeof value.sessionID === "string" &&
+    value.sessionID.length > 0 &&
+    (value.role === "assistant" || value.role === "user")
+  );
+}
+
+function isStoredPart(value: unknown): value is StoredPart {
+  if (!isRecord(value)) return false;
+  return (
+    typeof value.id === "string" &&
+    value.id.length > 0 &&
+    typeof value.sessionID === "string" &&
+    value.sessionID.length > 0 &&
+    typeof value.messageID === "string" &&
+    value.messageID.length > 0 &&
+    typeof value.type === "string" &&
+    value.type.length > 0
+  );
+}
+
+function createCorruptionLogger(): (kind: string, target: string, error?: unknown) => void {
+  let warningCount = 0;
+  let suppressionNotified = false;
+
+  return (kind: string, target: string, error?: unknown): void => {
+    if (warningCount >= CORRUPTION_WARNING_LIMIT) {
+      if (!suppressionNotified) {
+        suppressionNotified = true;
+        log.warn("Suppressing further corrupted recovery artifact warnings", {
+          limit: CORRUPTION_WARNING_LIMIT,
+        });
+      }
+      return;
+    }
+    warningCount += 1;
+    log.warn("Skipped corrupted recovery artifact", {
+      kind,
+      target,
+      error: error instanceof Error ? error.message : error ? String(error) : "invalid-shape",
+    });
+  };
+}
+
 // =============================================================================
 // ID Generation
 // =============================================================================
@@ -48,8 +100,11 @@ export function getMessageDir(sessionID: string): string {
         return sessionPath;
       }
     }
-  } catch {
-    // Ignore read errors
+  } catch (error) {
+    log.debug("Failed to enumerate message storage root", {
+      storage: MESSAGE_STORAGE,
+      error: error instanceof Error ? error.message : String(error),
+    });
   }
 
   return "";
@@ -63,18 +118,29 @@ export function readMessages(sessionID: string): StoredMessageMeta[] {
   const messageDir = getMessageDir(sessionID);
   if (!messageDir || !existsSync(messageDir)) return [];
 
+  const logCorruption = createCorruptionLogger();
   const messages: StoredMessageMeta[] = [];
   try {
     for (const file of readdirSync(messageDir)) {
       if (!file.endsWith(".json")) continue;
       try {
         const content = readFileSync(join(messageDir, file), "utf-8");
-        messages.push(JSON.parse(content));
-      } catch {
+        const parsed = JSON.parse(content) as unknown;
+        if (!isStoredMessageMeta(parsed)) {
+          logCorruption("message-meta", file);
+          continue;
+        }
+        messages.push(parsed);
+      } catch (error) {
+        logCorruption("message-meta", file, error);
         continue;
       }
     }
-  } catch {
+  } catch (error) {
+    log.debug("Failed to read message directory", {
+      messageDir,
+      error: error instanceof Error ? error.message : String(error),
+    });
     return [];
   }
 
@@ -95,18 +161,29 @@ export function readParts(messageID: string): StoredPart[] {
   const partDir = join(PART_STORAGE, messageID);
   if (!existsSync(partDir)) return [];
 
+  const logCorruption = createCorruptionLogger();
   const parts: StoredPart[] = [];
   try {
     for (const file of readdirSync(partDir)) {
       if (!file.endsWith(".json")) continue;
       try {
         const content = readFileSync(join(partDir, file), "utf-8");
-        parts.push(JSON.parse(content));
-      } catch {
+        const parsed = JSON.parse(content) as unknown;
+        if (!isStoredPart(parsed)) {
+          logCorruption("message-part", file);
+          continue;
+        }
+        parts.push(parsed);
+      } catch (error) {
+        logCorruption("message-part", file, error);
         continue;
       }
     }
-  } catch {
+  } catch (error) {
+    log.debug("Failed to read part directory", {
+      partDir,
+      error: error instanceof Error ? error.message : String(error),
+    });
     return [];
   }
 
@@ -269,6 +346,7 @@ export function stripThinkingParts(messageID: string): boolean {
   const partDir = join(PART_STORAGE, messageID);
   if (!existsSync(partDir)) return false;
 
+  const logCorruption = createCorruptionLogger();
   let anyRemoved = false;
   try {
     for (const file of readdirSync(partDir)) {
@@ -276,16 +354,26 @@ export function stripThinkingParts(messageID: string): boolean {
       try {
         const filePath = join(partDir, file);
         const content = readFileSync(filePath, "utf-8");
-        const part = JSON.parse(content) as StoredPart;
+        const parsed = JSON.parse(content) as unknown;
+        if (!isStoredPart(parsed)) {
+          logCorruption("strip-thinking", filePath);
+          continue;
+        }
+        const part = parsed as StoredPart;
         if (THINKING_TYPES.has(part.type)) {
           unlinkSync(filePath);
           anyRemoved = true;
         }
-      } catch {
+      } catch (error) {
+        logCorruption("strip-thinking", file, error);
         continue;
       }
     }
-  } catch {
+  } catch (error) {
+    log.debug("Failed to scan part directory for thinking strip", {
+      partDir,
+      error: error instanceof Error ? error.message : String(error),
+    });
     return false;
   }
 
@@ -357,6 +445,7 @@ export function replaceEmptyTextParts(messageID: string, replacementText: string
   const partDir = join(PART_STORAGE, messageID);
   if (!existsSync(partDir)) return false;
 
+  const logCorruption = createCorruptionLogger();
   let anyReplaced = false;
   try {
     for (const file of readdirSync(partDir)) {
@@ -364,7 +453,12 @@ export function replaceEmptyTextParts(messageID: string, replacementText: string
       try {
         const filePath = join(partDir, file);
         const content = readFileSync(filePath, "utf-8");
-        const part = JSON.parse(content) as StoredPart;
+        const parsed = JSON.parse(content) as unknown;
+        if (!isStoredPart(parsed)) {
+          logCorruption("replace-empty-text", filePath);
+          continue;
+        }
+        const part = parsed as StoredPart;
 
         if (part.type === "text") {
           const textPart = part as StoredTextPart;
@@ -375,11 +469,16 @@ export function replaceEmptyTextParts(messageID: string, replacementText: string
             anyReplaced = true;
           }
         }
-      } catch {
+      } catch (error) {
+        logCorruption("replace-empty-text", file, error);
         continue;
       }
     }
-  } catch {
+  } catch (error) {
+    log.debug("Failed to scan part directory for empty text replacement", {
+      partDir,
+      error: error instanceof Error ? error.message : String(error),
+    });
     return false;
   }
 
diff --git a/lib/refresh-lease.ts b/lib/refresh-lease.ts
index fe524a068..5d0973e26 100644
--- a/lib/refresh-lease.ts
+++ b/lib/refresh-lease.ts
@@ -13,6 +13,7 @@ const DEFAULT_WAIT_TIMEOUT_MS = 35_000;
 const DEFAULT_POLL_INTERVAL_MS = 150;
 const DEFAULT_RESULT_TTL_MS = 20_000;
 const RETRYABLE_IO_ERRORS = new Set(["EBUSY", "EPERM", "EMFILE", "ENFILE"]);
+export const REFRESH_LEASE_BYPASS_REASON_WAIT_TIMEOUT = "wait-timeout" as const;
 
 interface LeaseFilePayload {
 	tokenHash: string;
@@ -44,6 +45,7 @@ export interface RefreshLeaseCoordinatorOptions {
 
 export interface RefreshLeaseHandle {
 	role: "owner" | "follower" | "bypass";
+	reason?: string;
 	result?: TokenResult;
 	release: (result?: TokenResult) => Promise<void>;
 }
@@ -251,20 +253,40 @@ export class RefreshLeaseCoordinator {
 					const removed = await safeUnlink(lockPath, undefined, this.fsOps);
 					if (removed) continue;
 					if (Date.now() >= deadline) {
+						const finalResult = await this.readFreshResult(resultPath, tokenHash);
+						if (finalResult) {
+							return {
+								role: "follower",
+								result: finalResult,
+								release: async () => {
+									// Follower does not own lock.
+								},
+							};
+						}
 						log.warn("Refresh lease wait timeout while stale lock could not be removed", {
 							waitTimeoutMs: this.waitTimeoutMs,
 						});
-						return this.createBypassHandle("wait-timeout");
+						return this.createBypassHandle(REFRESH_LEASE_BYPASS_REASON_WAIT_TIMEOUT);
 					}
 					await sleep(this.pollIntervalMs);
 					continue;
 				}
 
 				if (Date.now() >= deadline) {
+					const finalResult = await this.readFreshResult(resultPath, tokenHash);
+					if (finalResult) {
+						return {
+							role: "follower",
+							result: finalResult,
+							release: async () => {
+								// Follower does not own lock.
+							},
+						};
+					}
 					log.warn("Refresh lease wait timeout; proceeding without lease", {
 						waitTimeoutMs: this.waitTimeoutMs,
 					});
-					return this.createBypassHandle("wait-timeout");
+					return this.createBypassHandle(REFRESH_LEASE_BYPASS_REASON_WAIT_TIMEOUT);
 				}
 				await sleep(this.pollIntervalMs);
 			}
@@ -275,6 +297,7 @@ export class RefreshLeaseCoordinator {
 		log.debug("Bypassing refresh lease", { reason });
 		return {
 			role: "bypass",
+			reason,
 			release: async () => {
 				// No-op
 			},
@@ -353,10 +376,10 @@ export class RefreshLeaseCoordinator {
 
 		const parsed = parseLeasePayload(raw);
 		if (!parsed) {
-			return { state: "unknown", reason: "invalid-payload" };
+			return { state: "stale", reason: "invalid-payload" };
 		}
 		if (parsed.tokenHash !== tokenHash) {
-			return { state: "unknown", reason: "token-mismatch" };
+			return { state: "stale", reason: "token-mismatch" };
 		}
 		if (parsed.expiresAt <= Date.now()) {
 			return { state: "stale", reason: "expired" };
diff --git a/lib/refresh-queue.ts b/lib/refresh-queue.ts
index 4ada4f905..df5f2ec0f 100644
--- a/lib/refresh-queue.ts
+++ b/lib/refresh-queue.ts
@@ -11,7 +11,10 @@
 import { refreshAccessToken } from "./auth/auth.js";
 import type { TokenResult } from "./types.js";
 import { createLogger } from "./logger.js";
-import { RefreshLeaseCoordinator } from "./refresh-lease.js";
+import {
+  REFRESH_LEASE_BYPASS_REASON_WAIT_TIMEOUT,
+  RefreshLeaseCoordinator,
+} from "./refresh-lease.js";
 import { isAbortError } from "./utils.js";
 
 const log = createLogger("refresh-queue");
@@ -169,6 +172,24 @@ export class RefreshQueue {
         });
         return lease.result;
       }
+      if (
+        lease.role === "bypass" &&
+        lease.reason === REFRESH_LEASE_BYPASS_REASON_WAIT_TIMEOUT
+      ) {
+        const supersedingPromise = getSupersedingPromise();
+        if (supersedingPromise) {
+          return supersedingPromise;
+        }
+        log.warn("Refresh lease timed out; refusing fail-open token refresh", {
+          tokenSuffix: refreshToken.slice(-6),
+          waitPolicy: "fail-closed",
+        });
+        return {
+          type: "failed",
+          reason: "unknown",
+          message: "Refresh lease timeout; retry shortly",
+        };
+      }
 
       try {
         const supersedingPromise = getSupersedingPromise();
diff --git a/lib/request/fetch-helpers.ts b/lib/request/fetch-helpers.ts
index 3ed9967a8..ebe9e4d2e 100644
--- a/lib/request/fetch-helpers.ts
+++ b/lib/request/fetch-helpers.ts
@@ -311,6 +311,7 @@ export interface ErrorDiagnostics {
 export interface CreateCodexHeadersOptions {
 	model?: string;
 	promptCacheKey?: string;
+	idempotencyKey?: string;
 }
 
 export interface CreateCodexHeadersParams {
@@ -568,6 +569,12 @@ export function createCodexHeaders(
         headers.delete(OPENAI_HEADERS.CONVERSATION_ID);
         headers.delete(OPENAI_HEADERS.SESSION_ID);
     }
+	const idempotencyKey = resolvedOpts?.idempotencyKey?.trim();
+	if (idempotencyKey) {
+		headers.set("Idempotency-Key", idempotencyKey);
+	} else {
+		headers.delete("Idempotency-Key");
+	}
     headers.set("accept", "text/event-stream");
     return headers;
 }
diff --git a/lib/request/response-handler.ts b/lib/request/response-handler.ts
index 76de00f68..d60bc21b6 100644
--- a/lib/request/response-handler.ts
+++ b/lib/request/response-handler.ts
@@ -1,4 +1,4 @@
-import { createLogger, logRequest, LOGGING_ENABLED } from "../logger.js";
+import { createLogger, logRequest } from "../logger.js";
 import { PLUGIN_NAME } from "../constants.js";
 
 import type { SSEEventData } from "../types.js";
@@ -75,10 +75,6 @@ export async function convertSseToJson(
 			}
 		}
 
-		if (LOGGING_ENABLED) {
-			logRequest("stream-full", { fullContent: fullText });
-		}
-
 		// Parse SSE events to extract the final response
 		const finalResponse = parseSseStream(fullText);
 
@@ -87,12 +83,21 @@ export async function convertSseToJson(
 
 			logRequest("stream-error", { error: "No response.done event found" });
 
-			// Return original stream if we can't parse
-			return new Response(fullText, {
-				status: response.status,
-				statusText: response.statusText,
-				headers: headers,
-			});
+			const jsonHeaders = new Headers(headers);
+			jsonHeaders.set("content-type", "application/json; charset=utf-8");
+			return new Response(
+				JSON.stringify({
+					error: {
+						message: "No response.done event found in SSE stream",
+						type: "stream_parse_error",
+					},
+				}),
+				{
+					status: 502,
+					statusText: "Bad Gateway",
+					headers: jsonHeaders,
+				},
+			);
 		}
 
 		// Return as plain JSON (not SSE)
diff --git a/lib/request/retry-governor.ts b/lib/request/retry-governor.ts
new file mode 100644
index 000000000..08e885699
--- /dev/null
+++ b/lib/request/retry-governor.ts
@@ -0,0 +1,78 @@
+export interface RetryAllAccountsRateLimitDecisionInput {
+	enabled: boolean;
+	accountCount: number;
+	waitMs: number;
+	plannedWaitMs?: number;
+	maxWaitMs: number;
+	currentRetryCount: number;
+	maxRetries: number;
+	accumulatedWaitMs: number;
+	absoluteCeilingMs: number;
+}
+
+export type RetryAllAccountsRateLimitDecisionReason =
+	| "allowed"
+	| "disabled"
+	| "no-accounts"
+	| "no-wait"
+	| "wait-exceeds-max"
+	| "retry-limit-reached"
+	| "absolute-ceiling-exceeded";
+
+export interface RetryAllAccountsRateLimitDecision {
+	shouldRetry: boolean;
+	reason: RetryAllAccountsRateLimitDecisionReason;
+}
+
+function clampNonNegative(value: number): number {
+	if (!Number.isFinite(value)) return 0;
+	return Math.max(0, Math.floor(value));
+}
+
+function normalizeRetryLimit(value: number): number {
+	if (!Number.isFinite(value)) return Number.POSITIVE_INFINITY;
+	return clampNonNegative(value);
+}
+
+/**
+ * Decide whether "retry all accounts when rate-limited" should run for the current loop.
+ *
+ * This helper is pure and deterministic so retry behavior can be tested without
+ * exercising the full request pipeline.
+ */
+export function decideRetryAllAccountsRateLimited(
+	input: RetryAllAccountsRateLimitDecisionInput,
+): RetryAllAccountsRateLimitDecision {
+	const accountCount = clampNonNegative(input.accountCount);
+	const waitMs = clampNonNegative(input.waitMs);
+	const plannedWaitMs = clampNonNegative(input.plannedWaitMs ?? input.waitMs);
+	const maxWaitMs = clampNonNegative(input.maxWaitMs);
+	const currentRetryCount = clampNonNegative(input.currentRetryCount);
+	const maxRetries = normalizeRetryLimit(input.maxRetries);
+	const accumulatedWaitMs = clampNonNegative(input.accumulatedWaitMs);
+	const absoluteCeilingMs = clampNonNegative(input.absoluteCeilingMs);
+	const ceilingCheckWaitMs = accumulatedWaitMs === 0 ? waitMs : plannedWaitMs;
+
+	if (!input.enabled) {
+		return { shouldRetry: false, reason: "disabled" };
+	}
+	if (accountCount === 0) {
+		return { shouldRetry: false, reason: "no-accounts" };
+	}
+	if (waitMs === 0) {
+		return { shouldRetry: false, reason: "no-wait" };
+	}
+	if (maxWaitMs > 0 && waitMs > maxWaitMs) {
+		return { shouldRetry: false, reason: "wait-exceeds-max" };
+	}
+	if (currentRetryCount >= maxRetries) {
+		return { shouldRetry: false, reason: "retry-limit-reached" };
+	}
+	if (absoluteCeilingMs > 0 && accumulatedWaitMs >= absoluteCeilingMs) {
+		return { shouldRetry: false, reason: "absolute-ceiling-exceeded" };
+	}
+	if (absoluteCeilingMs > 0 && accumulatedWaitMs + ceilingCheckWaitMs > absoluteCeilingMs) {
+		return { shouldRetry: false, reason: "absolute-ceiling-exceeded" };
+	}
+	return { shouldRetry: true, reason: "allowed" };
+}
diff --git a/lib/schemas.ts b/lib/schemas.ts
index 55028b6ed..a29d94a1f 100644
--- a/lib/schemas.ts
+++ b/lib/schemas.ts
@@ -21,6 +21,7 @@ export const PluginConfigSchema = z.object({
 	retryAllAccountsRateLimited: z.boolean().optional(),
 	retryAllAccountsMaxWaitMs: z.number().min(0).optional(),
 	retryAllAccountsMaxRetries: z.number().min(0).optional(),
+	retryAllAccountsAbsoluteCeilingMs: z.number().min(0).optional(),
 	unsupportedCodexPolicy: z.enum(["strict", "fallback"]).optional(),
 	fallbackOnUnsupportedCodexModel: z.boolean().optional(),
 	fallbackToGpt52OnUnsupportedGpt53: z.boolean().optional(),
@@ -32,6 +33,7 @@ export const PluginConfigSchema = z.object({
 	rateLimitToastDebounceMs: z.number().min(0).optional(),
 	toastDurationMs: z.number().min(1000).optional(),
 	perProjectAccounts: z.boolean().optional(),
+	telemetryEnabled: z.boolean().optional(),
 	sessionRecovery: z.boolean().optional(),
 	autoResume: z.boolean().optional(),
 	parallelProbing: z.boolean().optional(),
@@ -137,6 +139,40 @@ export const AccountStorageV3Schema = z.object({
 
 export type AccountStorageV3FromSchema = z.infer<typeof AccountStorageV3Schema>;
 
+/**
+ * Account metadata V4 - keychain-backed secret reference format.
+ */
+export const AccountMetadataV4Schema = z.object({
+	accountId: z.string().optional(),
+	accountIdSource: AccountIdSourceSchema.optional(),
+	accountLabel: z.string().optional(),
+	email: z.string().optional(),
+	refreshTokenRef: z.string().min(1),
+	accessTokenRef: z.string().min(1).optional(),
+	expiresAt: z.number().optional(),
+	enabled: z.boolean().optional(),
+	addedAt: z.number(),
+	lastUsed: z.number(),
+	lastSwitchReason: SwitchReasonSchema.optional(),
+	rateLimitResetTimes: RateLimitStateV3Schema.optional(),
+	coolingDownUntil: z.number().optional(),
+	cooldownReason: CooldownReasonSchema.optional(),
+});
+
+export type AccountMetadataV4FromSchema = z.infer<typeof AccountMetadataV4Schema>;
+
+/**
+ * Account storage V4 - current secure storage format with keychain refs.
+ */
+export const AccountStorageV4Schema = z.object({
+	version: z.literal(4),
+	accounts: z.array(AccountMetadataV4Schema),
+	activeIndex: z.number().min(0),
+	activeIndexByFamily: ActiveIndexByFamilySchema.optional(),
+});
+
+export type AccountStorageV4FromSchema = z.infer<typeof AccountStorageV4Schema>;
+
 /**
  * Legacy V1 account metadata for migration support.
  */
@@ -171,11 +207,12 @@ export const AccountStorageV1Schema = z.object({
 export type AccountStorageV1FromSchema = z.infer<typeof AccountStorageV1Schema>;
 
 /**
- * Union of V1 and V3 storage formats for migration detection.
+ * Union of V1/V3/V4 storage formats for migration detection.
  */
 export const AnyAccountStorageSchema = z.discriminatedUnion("version", [
 	AccountStorageV1Schema,
 	AccountStorageV3Schema,
+	AccountStorageV4Schema,
 ]);
 
 export type AnyAccountStorageFromSchema = z.infer<typeof AnyAccountStorageSchema>;
diff --git a/lib/secrets-crypto.ts b/lib/secrets-crypto.ts
new file mode 100644
index 000000000..8a1a5cd35
--- /dev/null
+++ b/lib/secrets-crypto.ts
@@ -0,0 +1,192 @@
+import {
+	createCipheriv,
+	createDecipheriv,
+	createHash,
+	randomBytes,
+	scryptSync,
+} from "node:crypto";
+
+const ENCRYPTED_PREFIX = "enc:";
+const LEGACY_ENCRYPTED_VERSION = "v1";
+const ENCRYPTED_VERSION = "v2";
+const AES_KEY_LENGTH = 32;
+const AES_GCM_IV_LENGTH = 12;
+const AES_GCM_TAG_LENGTH = 16;
+const SCRYPT_SALT_LENGTH = 16;
+const MIN_KEY_MATERIAL_BYTES = 32;
+
+export interface SecretEncryptionKeys {
+	primary: string | null;
+	previous: string | null;
+}
+
+function deriveLegacyAesKey(input: string): Buffer {
+	return createHash("sha256").update(input, "utf8").digest();
+}
+
+function deriveAesKey(input: string, salt: Buffer): Buffer {
+	return scryptSync(input, salt, AES_KEY_LENGTH);
+}
+
+type SecretEnvelope = {
+	version: "v1";
+	iv: Buffer;
+	tag: Buffer;
+	ciphertext: Buffer;
+	salt: null;
+} | {
+	version: "v2";
+	iv: Buffer;
+	tag: Buffer;
+	ciphertext: Buffer;
+	salt: Buffer;
+};
+
+function decodeBase64Part(value: string): Buffer | null {
+	try {
+		const decoded = Buffer.from(value, "base64");
+		return decoded.length > 0 ? decoded : null;
+	} catch {
+		return null;
+	}
+}
+
+function parseEnvelope(value: string): SecretEnvelope | null {
+	if (!value.startsWith(ENCRYPTED_PREFIX)) return null;
+	const payload = value.slice(ENCRYPTED_PREFIX.length);
+	const versionSeparator = payload.indexOf(":");
+	if (versionSeparator <= 0 || versionSeparator === payload.length - 1) return null;
+	const versionPart = payload.slice(0, versionSeparator);
+	const remainder = payload.slice(versionSeparator + 1);
+
+	if (versionPart === LEGACY_ENCRYPTED_VERSION) {
+		const [ivPart, tagPart, cipherPart] = remainder.split(":", 3);
+		if (!ivPart || !tagPart || !cipherPart) return null;
+		const iv = decodeBase64Part(ivPart);
+		const tag = decodeBase64Part(tagPart);
+		const ciphertext = decodeBase64Part(cipherPart);
+		if (!iv || !tag || !ciphertext) return null;
+		if (iv.length !== AES_GCM_IV_LENGTH) return null;
+		if (tag.length !== AES_GCM_TAG_LENGTH) return null;
+		return {
+			version: "v1",
+			iv,
+			tag,
+			ciphertext,
+			salt: null,
+		};
+	}
+
+	if (versionPart === ENCRYPTED_VERSION) {
+		const [saltPart, ivPart, tagPart, cipherPart] = remainder.split(":", 4);
+		if (!saltPart || !ivPart || !tagPart || !cipherPart) return null;
+		const salt = decodeBase64Part(saltPart);
+		const iv = decodeBase64Part(ivPart);
+		const tag = decodeBase64Part(tagPart);
+		const ciphertext = decodeBase64Part(cipherPart);
+		if (!salt || !iv || !tag || !ciphertext) return null;
+		if (salt.length !== SCRYPT_SALT_LENGTH) return null;
+		if (iv.length !== AES_GCM_IV_LENGTH) return null;
+		if (tag.length !== AES_GCM_TAG_LENGTH) return null;
+		return {
+			version: "v2",
+			salt,
+			iv,
+			tag,
+			ciphertext,
+		};
+	}
+
+	return null;
+}
+
+export function isEncryptedSecret(value: string): boolean {
+	return value.startsWith(`${ENCRYPTED_PREFIX}${LEGACY_ENCRYPTED_VERSION}:`)
+		|| value.startsWith(`${ENCRYPTED_PREFIX}${ENCRYPTED_VERSION}:`);
+}
+
+export function encryptSecret(value: string, keyMaterial: string): string {
+	if (!value) return value;
+	if (parseEnvelope(value)) return value;
+
+	const salt = randomBytes(SCRYPT_SALT_LENGTH);
+	const key = deriveAesKey(keyMaterial, salt);
+	const iv = randomBytes(AES_GCM_IV_LENGTH);
+	const cipher = createCipheriv("aes-256-gcm", key, iv);
+	const encrypted = Buffer.concat([
+		cipher.update(Buffer.from(value, "utf8")),
+		cipher.final(),
+	]);
+	const tag = cipher.getAuthTag();
+	return `${ENCRYPTED_PREFIX}${ENCRYPTED_VERSION}:${salt.toString("base64")}:${iv.toString("base64")}:${tag.toString("base64")}:${encrypted.toString("base64")}`;
+}
+
+export function decryptSecret(
+	value: string,
+	keys: SecretEncryptionKeys,
+): { value: string; usedPreviousKey: boolean } {
+	const envelope = parseEnvelope(value);
+	if (!envelope) {
+		return { value, usedPreviousKey: false };
+	}
+
+	const tryDecrypt = (keyMaterial: string | null): string | null => {
+		if (!keyMaterial) return null;
+		try {
+			const key = envelope.version === "v1"
+				? deriveLegacyAesKey(keyMaterial)
+				: deriveAesKey(keyMaterial, envelope.salt);
+			const decipher = createDecipheriv("aes-256-gcm", key, envelope.iv);
+			decipher.setAuthTag(envelope.tag);
+			const decrypted = Buffer.concat([
+				decipher.update(envelope.ciphertext),
+				decipher.final(),
+			]);
+			return decrypted.toString("utf8");
+		} catch {
+			return null;
+		}
+	};
+
+	const withPrimary = tryDecrypt(keys.primary);
+	if (withPrimary !== null) {
+		return { value: withPrimary, usedPreviousKey: false };
+	}
+
+	const withPrevious = tryDecrypt(keys.previous);
+	if (withPrevious !== null) {
+		return { value: withPrevious, usedPreviousKey: true };
+	}
+
+	throw new Error("Unable to decrypt secret with configured keys");
+}
+
+function getTrimmedEnv(name: string): string | null {
+	const raw = (process.env[name] ?? "").trim();
+	return raw.length > 0 ? raw : null;
+}
+
+function validateEnvKeyMaterial(value: string | null, envName: string): string | null {
+	if (!value) return null;
+	if (Buffer.byteLength(value, "utf8") < MIN_KEY_MATERIAL_BYTES) {
+		throw new Error(
+			`${envName} must contain at least ${MIN_KEY_MATERIAL_BYTES} bytes of key material`,
+		);
+	}
+	return value;
+}
+
+export function getSecretEncryptionKeysFromEnv(): SecretEncryptionKeys {
+	const primary = validateEnvKeyMaterial(
+		getTrimmedEnv("CODEX_AUTH_ENCRYPTION_KEY"),
+		"CODEX_AUTH_ENCRYPTION_KEY",
+	);
+	const previous = validateEnvKeyMaterial(
+		getTrimmedEnv("CODEX_AUTH_PREVIOUS_ENCRYPTION_KEY"),
+		"CODEX_AUTH_PREVIOUS_ENCRYPTION_KEY",
+	);
+	return {
+		primary,
+		previous,
+	};
+}
diff --git a/lib/secrets/token-store.ts b/lib/secrets/token-store.ts
new file mode 100644
index 000000000..9cf77761e
--- /dev/null
+++ b/lib/secrets/token-store.ts
@@ -0,0 +1,219 @@
+import { createHash } from "node:crypto";
+import { createLogger } from "../logger.js";
+import { sleep } from "../utils.js";
+
+type SecretStorageMode = "keychain" | "plaintext" | "auto";
+type EffectiveSecretStorageMode = "keychain" | "plaintext";
+
+type KeytarModule = {
+	setPassword(service: string, account: string, password: string): Promise<void>;
+	getPassword(service: string, account: string): Promise<string | null>;
+	deletePassword(service: string, account: string): Promise<boolean>;
+};
+
+interface DeleteAccountSecretsOptions {
+	force?: boolean;
+}
+
+export interface AccountSecretRefs {
+	refreshTokenRef: string;
+	accessTokenRef?: string;
+}
+
+export interface AccountSecrets {
+	refreshToken: string;
+	accessToken?: string;
+}
+
+export interface AccountSecretRefInput {
+	accountId?: string;
+	email?: string;
+	addedAt?: number;
+	refreshToken: string;
+}
+
+const log = createLogger("token-store");
+const SECRET_SERVICE = "codex-multi-auth";
+const SECRET_DELETE_RETRY_CODES = new Set(["EBUSY", "EPERM", "EAGAIN"]);
+const SECRET_DELETE_RETRY_ATTEMPTS = 4;
+let keytarLoader: Promise<KeytarModule | null> | null = null;
+
+function parseSecretStorageMode(value: string | undefined): SecretStorageMode {
+	const normalized = (value ?? "").trim().toLowerCase();
+	if (normalized === "plaintext") return "plaintext";
+	if (normalized === "auto") return "auto";
+	return "keychain";
+}
+
+async function loadKeytar(): Promise<KeytarModule | null> {
+	if (!keytarLoader) {
+		keytarLoader = (async () => {
+			try {
+				const imported = (await import("keytar")) as unknown as { default?: unknown };
+				const mod = (imported.default ?? imported) as KeytarModule;
+				if (
+					typeof mod.setPassword !== "function" ||
+					typeof mod.getPassword !== "function" ||
+					typeof mod.deletePassword !== "function"
+				) {
+					return null;
+				}
+				return mod;
+			} catch {
+				return null;
+			}
+		})();
+	}
+	return keytarLoader;
+}
+
+function isRetryableDeleteError(error: unknown): boolean {
+	const maybe = error as { code?: string; status?: number; message?: string };
+	if (typeof maybe.code === "string" && SECRET_DELETE_RETRY_CODES.has(maybe.code)) {
+		return true;
+	}
+	if (typeof maybe.status === "number" && maybe.status === 429) {
+		return true;
+	}
+	const message = typeof maybe.message === "string" ? maybe.message.toLowerCase() : "";
+	return message.includes("429") || message.includes("rate limit");
+}
+
+async function deleteSecretRefWithRetry(keytar: KeytarModule, ref: string): Promise<void> {
+	for (let attempt = 0; attempt < SECRET_DELETE_RETRY_ATTEMPTS; attempt += 1) {
+		try {
+			await keytar.deletePassword(SECRET_SERVICE, ref);
+			return;
+		} catch (error) {
+			if (!isRetryableDeleteError(error) || attempt === SECRET_DELETE_RETRY_ATTEMPTS - 1) {
+				throw error;
+			}
+			await sleep(25 * 2 ** attempt);
+		}
+	}
+}
+
+export async function getEffectiveSecretStorageMode(): Promise<EffectiveSecretStorageMode> {
+	const configured = parseSecretStorageMode(process.env.CODEX_SECRET_STORAGE_MODE);
+	if (configured === "plaintext") return "plaintext";
+	if (configured === "keychain") return "keychain";
+	const keytar = await loadKeytar();
+	return keytar ? "keychain" : "plaintext";
+}
+
+async function getKeytarOrThrow(): Promise<KeytarModule> {
+	const keytar = await loadKeytar();
+	if (keytar) return keytar;
+	throw new Error(
+		"Keychain secret storage is required but keytar is unavailable. Install optional dependency 'keytar' or set CODEX_SECRET_STORAGE_MODE=plaintext.",
+	);
+}
+
+export async function ensureSecretStorageBackendAvailable(): Promise<void> {
+	const mode = await getEffectiveSecretStorageMode();
+	if (mode === "plaintext") return;
+	await getKeytarOrThrow();
+}
+
+export function deriveAccountSecretRef(input: AccountSecretRefInput): string {
+	const normalizedEmail = typeof input.email === "string" ? input.email.trim().toLowerCase() : "";
+	const normalizedAccountId = typeof input.accountId === "string" ? input.accountId.trim() : "";
+	const stableSeed = `${normalizedAccountId}|${normalizedEmail}|${input.addedAt ?? 0}`;
+	const hasStableIdentity = normalizedAccountId.length > 0 || normalizedEmail.length > 0;
+	const fallbackSeed = createHash("sha256")
+		.update(input.refreshToken)
+		.digest("hex")
+		.slice(0, 16);
+	const seed = hasStableIdentity ? stableSeed : fallbackSeed;
+	return createHash("sha256").update(seed).digest("hex").slice(0, 24);
+}
+
+export async function persistAccountSecrets(
+	baseRef: string,
+	secrets: AccountSecrets,
+): Promise<AccountSecretRefs | null> {
+	const mode = await getEffectiveSecretStorageMode();
+	if (mode === "plaintext") return null;
+
+	const keytar = await getKeytarOrThrow();
+	const refreshTokenRef = `${baseRef}:refresh`;
+	await keytar.setPassword(SECRET_SERVICE, refreshTokenRef, secrets.refreshToken);
+
+	let accessTokenRef: string | undefined;
+	if (typeof secrets.accessToken === "string" && secrets.accessToken.trim().length > 0) {
+		accessTokenRef = `${baseRef}:access`;
+		try {
+			await keytar.setPassword(SECRET_SERVICE, accessTokenRef, secrets.accessToken);
+		} catch (error) {
+			try {
+				await deleteSecretRefWithRetry(keytar, refreshTokenRef);
+			} catch (cleanupError) {
+				log.warn("Failed to rollback refresh secret after access secret write failure", {
+					refreshTokenRef,
+					error: String(cleanupError),
+				});
+			}
+			throw error;
+		}
+	}
+
+	return {
+		refreshTokenRef,
+		accessTokenRef,
+	};
+}
+
+export async function loadAccountSecrets(
+	refs: AccountSecretRefs,
+): Promise<AccountSecrets | null> {
+	const mode = await getEffectiveSecretStorageMode();
+	if (mode === "plaintext") return null;
+
+	const keytar = await getKeytarOrThrow();
+	const refreshToken = await keytar.getPassword(SECRET_SERVICE, refs.refreshTokenRef);
+	if (!refreshToken) {
+		log.warn("Missing refresh token in keychain", { ref: refs.refreshTokenRef });
+		return null;
+	}
+	let accessToken: string | undefined;
+	if (refs.accessTokenRef) {
+		accessToken = (await keytar.getPassword(SECRET_SERVICE, refs.accessTokenRef)) ?? undefined;
+	}
+	return { refreshToken, accessToken };
+}
+
+export async function deleteAccountSecrets(
+	refs: AccountSecretRefs,
+	options: DeleteAccountSecretsOptions = {},
+): Promise<void> {
+	let keytar: KeytarModule | null = null;
+	if (options.force) {
+		keytar = await loadKeytar();
+	} else {
+		const mode = await getEffectiveSecretStorageMode();
+		if (mode === "plaintext") return;
+		keytar = await getKeytarOrThrow();
+	}
+	if (!keytar) return;
+
+	const deleteErrors: unknown[] = [];
+	try {
+		await deleteSecretRefWithRetry(keytar, refs.refreshTokenRef);
+	} catch (error) {
+		deleteErrors.push(error);
+	}
+	if (refs.accessTokenRef) {
+		try {
+			await deleteSecretRefWithRetry(keytar, refs.accessTokenRef);
+		} catch (error) {
+			deleteErrors.push(error);
+		}
+	}
+	if (deleteErrors.length > 0) {
+		throw deleteErrors[0];
+	}
+}
+
+export function resetSecretStoreCacheForTests(): void {
+	keytarLoader = null;
+}
diff --git a/lib/shutdown.ts b/lib/shutdown.ts
index 66965627e..6c7e342b1 100644
--- a/lib/shutdown.ts
+++ b/lib/shutdown.ts
@@ -2,6 +2,18 @@ type CleanupFn = () => void | Promise<void>;
 
 const cleanupFunctions: CleanupFn[] = [];
 let shutdownRegistered = false;
+let cleanupInFlight: Promise<void> | null = null;
+const DEFAULT_SHUTDOWN_TIMEOUT_MS = 8_000;
+const MAX_SHUTDOWN_TIMEOUT_MS = 120_000;
+
+function getShutdownTimeoutMs(): number {
+	const raw = process.env.CODEX_AUTH_SHUTDOWN_TIMEOUT_MS;
+	const parsed = raw ? Number.parseInt(raw, 10) : DEFAULT_SHUTDOWN_TIMEOUT_MS;
+	if (!Number.isFinite(parsed) || parsed <= 0) {
+		return DEFAULT_SHUTDOWN_TIMEOUT_MS;
+	}
+	return Math.max(1_000, Math.min(parsed, MAX_SHUTDOWN_TIMEOUT_MS));
+}
 
 export function registerCleanup(fn: CleanupFn): void {
 	cleanupFunctions.push(fn);
@@ -16,23 +28,47 @@ export function unregisterCleanup(fn: CleanupFn): void {
 }
 
 export async function runCleanup(): Promise<void> {
+	if (cleanupInFlight) {
+		await cleanupInFlight;
+		return;
+	}
+
 	const fns = [...cleanupFunctions];
 	cleanupFunctions.length = 0;
+	const timeoutMs = getShutdownTimeoutMs();
 
-	for (const fn of fns) {
-		try {
-			await fn();
-		} catch {
-			// Ignore cleanup errors during shutdown
+	const runner = (async () => {
+		for (const fn of fns) {
+			try {
+				await fn();
+			} catch {
+				// Ignore cleanup errors during shutdown
+			}
 		}
-	}
+	})();
+	let timeoutHandle: ReturnType<typeof setTimeout> | null = null;
+	const timeoutPromise = new Promise<void>((resolve) => {
+		timeoutHandle = setTimeout(resolve, timeoutMs);
+	});
+
+	cleanupInFlight = Promise.race([runner, timeoutPromise]).finally(() => {
+		if (timeoutHandle) {
+			clearTimeout(timeoutHandle);
+		}
+		cleanupInFlight = null;
+	});
+
+	await cleanupInFlight;
 }
 
 function ensureShutdownHandler(): void {
 	if (shutdownRegistered) return;
 	shutdownRegistered = true;
+	let signalHandled = false;
 
 	const handleSignal = () => {
+		if (signalHandled) return;
+		signalHandled = true;
 		void runCleanup().finally(() => {
 			process.exit(0);
 		});
diff --git a/lib/storage.ts b/lib/storage.ts
index 3453a426a..e92409c0f 100644
--- a/lib/storage.ts
+++ b/lib/storage.ts
@@ -1,10 +1,22 @@
 import { promises as fs, existsSync } from "node:fs";
 import { basename, dirname, join } from "node:path";
-import { createHash } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { ACCOUNT_LIMITS } from "./constants.js";
 import { createLogger } from "./logger.js";
+import { acquireFileLock } from "./file-lock.js";
 import { MODEL_FAMILIES, type ModelFamily } from "./prompts/codex.js";
-import { AnyAccountStorageSchema, getValidationErrors } from "./schemas.js";
+import {
+	AnyAccountStorageSchema,
+	AccountStorageV4Schema,
+	getValidationErrors,
+} from "./schemas.js";
+import {
+	decryptSecret,
+	encryptSecret,
+	getSecretEncryptionKeysFromEnv,
+	isEncryptedSecret,
+	type SecretEncryptionKeys,
+} from "./secrets-crypto.js";
 import {
 	getConfigDir,
 	getProjectConfigDir,
@@ -15,15 +27,35 @@ import {
 } from "./storage/paths.js";
 import {
   migrateV1ToV3,
+  migrateV3ToV4,
   type CooldownReason,
   type RateLimitStateV3,
   type AccountMetadataV1,
   type AccountStorageV1,
   type AccountMetadataV3,
   type AccountStorageV3,
+  type AccountMetadataV4,
+  type AccountStorageV4,
 } from "./storage/migrations.js";
-
-export type { CooldownReason, RateLimitStateV3, AccountMetadataV1, AccountStorageV1, AccountMetadataV3, AccountStorageV3 };
+import {
+	deleteAccountSecrets,
+	deriveAccountSecretRef,
+	ensureSecretStorageBackendAvailable,
+	getEffectiveSecretStorageMode,
+	loadAccountSecrets,
+	persistAccountSecrets,
+} from "./secrets/token-store.js";
+
+export type {
+	CooldownReason,
+	RateLimitStateV3,
+	AccountMetadataV1,
+	AccountStorageV1,
+	AccountMetadataV3,
+	AccountStorageV3,
+	AccountMetadataV4,
+	AccountStorageV4,
+};
 
 const log = createLogger("storage");
 const ACCOUNTS_FILE_NAME = "openai-codex-accounts.json";
@@ -34,9 +66,24 @@ const ACCOUNTS_WAL_SUFFIX = ".wal";
 const ACCOUNTS_BACKUP_HISTORY_DEPTH = 3;
 const BACKUP_COPY_MAX_ATTEMPTS = 5;
 const BACKUP_COPY_BASE_DELAY_MS = 10;
+const ACCOUNT_STORAGE_LOCK_OPTIONS = {
+	maxAttempts: 80,
+	baseDelayMs: 15,
+	maxDelayMs: 800,
+	staleAfterMs: 120_000,
+} as const;
+const STORAGE_DECRYPT_ERROR_CODE = "EDECRYPT";
+const TRANSIENT_READ_RETRY_ATTEMPTS = 5;
+const TRANSIENT_READ_RETRY_BASE_DELAY_MS = 10;
+const TRANSIENT_READ_RETRY_CODES = new Set(["EBUSY", "EPERM", "EAGAIN"]);
+const STORAGE_SAVE_LOCK_WAIT_TIMEOUT_MS = 5_000;
+const STORAGE_SAVE_LOCK_STALE_AFTER_MS = 120_000;
+const STORAGE_SAVE_LOCK_POLL_INTERVAL_MS = 25;
 
 let storageBackupEnabled = true;
 let lastAccountsSaveTimestamp = 0;
+const missingEncryptionKeyWarnings = new Set<string>();
+const knownStorageRevisionByPath = new Map<string, string | null>();
 
 export interface FlaggedAccountMetadataV1 extends AccountMetadataV3 {
 	flaggedAt: number;
@@ -94,6 +141,7 @@ export function formatStorageErrorHint(error: unknown, path: string): string {
 }
 
 let storageMutex: Promise<void> = Promise.resolve();
+let accountFileMutex: Promise<void> = Promise.resolve();
 
 function withStorageLock<T>(fn: () => Promise<T>): Promise<T> {
   const previousMutex = storageMutex;
@@ -104,7 +152,24 @@ function withStorageLock<T>(fn: () => Promise<T>): Promise<T> {
   return previousMutex.then(fn).finally(() => releaseLock());
 }
 
-type AnyAccountStorage = AccountStorageV1 | AccountStorageV3;
+function withAccountFileMutex<T>(fn: () => Promise<T>): Promise<T> {
+	const previousMutex = accountFileMutex;
+	let releaseLock: () => void;
+	accountFileMutex = new Promise<void>((resolve) => {
+		releaseLock = resolve;
+	});
+	return previousMutex.then(fn).finally(() => releaseLock());
+}
+
+async function withStorageSerializedFileLock<T>(path: string, fn: () => Promise<T>): Promise<T> {
+	// Serialize file-lock acquisition to keep save ordering deterministic.
+	// Acquisition order: file-queue mutex -> file lock -> storage mutex.
+	return withAccountFileMutex(() =>
+		withAccountFileLock(path, () => withStorageLock(fn)),
+	);
+}
+
+type AnyAccountStorage = AccountStorageV1 | AccountStorageV3 | AccountStorageV4;
 
 type AccountLike = {
   accountId?: string;
@@ -114,6 +179,91 @@ type AccountLike = {
   lastUsed?: number;
 };
 
+function getConfiguredSecretKeys(): SecretEncryptionKeys {
+	return getSecretEncryptionKeysFromEnv();
+}
+
+function warnMissingEncryptionKeyOnce(fieldName: string): void {
+	const message = `Encrypted ${fieldName} detected but CODEX_AUTH_ENCRYPTION_KEY is not configured`;
+	if (missingEncryptionKeyWarnings.has(message)) return;
+	missingEncryptionKeyWarnings.add(message);
+	log.warn(message);
+}
+
+function decryptStorageSecret(value: string, fieldName: string): { value: string; usedPreviousKey: boolean } {
+	if (!isEncryptedSecret(value)) {
+		return { value, usedPreviousKey: false };
+	}
+
+	const keys = getConfiguredSecretKeys();
+	if (!keys.primary && !keys.previous) {
+		warnMissingEncryptionKeyOnce(fieldName);
+		throw new Error(`Encrypted ${fieldName} cannot be read without CODEX_AUTH_ENCRYPTION_KEY`);
+	}
+	return decryptSecret(value, keys);
+}
+
+function encryptStorageSecret(value: string): string {
+	if (!value) return value;
+	const keys = getConfiguredSecretKeys();
+	if (!keys.primary) return value;
+	return encryptSecret(value, keys.primary);
+}
+
+function decryptAccountSensitiveFields(account: AccountMetadataV3): AccountMetadataV3 {
+	const refreshResult = decryptStorageSecret(account.refreshToken, "refresh token");
+	const accessResult =
+		typeof account.accessToken === "string" && account.accessToken.length > 0
+			? decryptStorageSecret(account.accessToken, "access token")
+			: null;
+
+	return {
+		...account,
+		refreshToken: refreshResult.value,
+		...(accessResult ? { accessToken: accessResult.value } : {}),
+	};
+}
+
+function toStorageDecryptError(cause: unknown): NodeJS.ErrnoException {
+	const message = "Failed to decrypt account storage";
+	const error = new Error(
+		message,
+		cause instanceof Error ? { cause } : undefined,
+	) as NodeJS.ErrnoException;
+	error.code = STORAGE_DECRYPT_ERROR_CODE;
+	return error;
+}
+
+function toFieldDecryptError(
+	fieldName: string,
+	cause: unknown,
+): NodeJS.ErrnoException {
+	const error = new Error(
+		`Failed to decrypt ${fieldName}`,
+		cause instanceof Error ? { cause } : undefined,
+	) as NodeJS.ErrnoException;
+	error.code = STORAGE_DECRYPT_ERROR_CODE;
+	return error;
+}
+
+function encryptAccountSensitiveFields(account: AccountMetadataV3): AccountMetadataV3 {
+	return {
+		...account,
+		refreshToken: encryptStorageSecret(account.refreshToken),
+		...(typeof account.accessToken === "string" && account.accessToken.length > 0
+			? { accessToken: encryptStorageSecret(account.accessToken) }
+			: {}),
+	};
+}
+
+function cloneStorageForPersist(storage: AccountStorageV3): AccountStorageV3 {
+	return {
+		...storage,
+		accounts: storage.accounts.map((account) => encryptAccountSensitiveFields({ ...account })),
+		activeIndexByFamily: storage.activeIndexByFamily ? { ...storage.activeIndexByFamily } : {},
+	};
+}
+
 function looksLikeSyntheticFixtureAccount(account: AccountMetadataV3): boolean {
 	const email = typeof account.email === "string" ? account.email.trim().toLowerCase() : "";
 	const refreshToken =
@@ -236,6 +386,42 @@ function getAccountsWalPath(path: string): string {
 	return `${path}${ACCOUNTS_WAL_SUFFIX}`;
 }
 
+function getAccountsLockPath(path: string): string {
+	return `${path}.queue.lock`;
+}
+
+async function releaseStorageLockFallback(lockPath: string): Promise<void> {
+	try {
+		await fs.rm(lockPath, { force: true });
+	} catch (error) {
+		log.debug("Best-effort lock cleanup fallback failed", {
+			path: lockPath,
+			error: String(error),
+		});
+	}
+}
+
+async function withAccountFileLock<T>(path: string, fn: () => Promise<T>): Promise<T> {
+	const lockPath = getAccountsLockPath(path);
+	await fs.mkdir(dirname(path), { recursive: true });
+	const lock = await acquireFileLock(lockPath, ACCOUNT_STORAGE_LOCK_OPTIONS);
+	try {
+		return await fn();
+	} finally {
+		try {
+			await lock.release();
+		} catch (error) {
+			const code = (error as NodeJS.ErrnoException).code;
+			if (code !== "ENOENT") {
+				log.warn("Failed to release account storage lock", {
+					path: lockPath,
+					error: String(error),
+				});
+				await releaseStorageLockFallback(lockPath);
+			}
+		}
+	}
+}
 async function copyFileWithRetry(
 	sourcePath: string,
 	destinationPath: string,
@@ -391,6 +577,322 @@ function computeSha256(value: string): string {
 	return createHash("sha256").update(value).digest("hex");
 }
 
+function isTransientReadError(error: unknown): boolean {
+	const code = (error as NodeJS.ErrnoException | undefined)?.code;
+	return typeof code === "string" && TRANSIENT_READ_RETRY_CODES.has(code);
+}
+
+async function readFileUtf8WithTransientRetry(path: string): Promise<string> {
+	for (let attempt = 0; attempt < TRANSIENT_READ_RETRY_ATTEMPTS; attempt += 1) {
+		try {
+			return await fs.readFile(path, "utf-8");
+		} catch (error) {
+			const code = (error as NodeJS.ErrnoException | undefined)?.code;
+			if (code === "ENOENT") {
+				throw error;
+			}
+			if (!isTransientReadError(error) || attempt + 1 >= TRANSIENT_READ_RETRY_ATTEMPTS) {
+				throw error;
+			}
+			await new Promise((resolve) =>
+				setTimeout(resolve, TRANSIENT_READ_RETRY_BASE_DELAY_MS * 2 ** attempt),
+			);
+		}
+	}
+
+	throw new Error(`Failed to read file after ${TRANSIENT_READ_RETRY_ATTEMPTS} attempts: ${path}`);
+}
+
+async function readStorageRevision(path: string): Promise<string | null> {
+	try {
+		const content = await readFileUtf8WithTransientRetry(path);
+		return computeSha256(content);
+	} catch (error) {
+		const code = (error as NodeJS.ErrnoException).code;
+		if (code === "ENOENT") {
+			return null;
+		}
+		throw error;
+	}
+}
+
+type StorageSaveFileLock = {
+	lockPath: string;
+	token: string;
+	fingerprint: string;
+};
+
+type StorageSaveLockObservation = {
+	token: string | null;
+	fingerprint: string;
+	acquiredAt: number | null;
+};
+
+function getAccountsSaveLockPath(path: string): string {
+	return `${path}.lock`;
+}
+
+function parseStorageSaveLockToken(raw: string): string | null {
+	const trimmed = raw.trim();
+	if (trimmed.length === 0) {
+		return null;
+	}
+	try {
+		const parsed = JSON.parse(trimmed) as unknown;
+		if (!parsed || typeof parsed !== "object") {
+			return null;
+		}
+		const token = (parsed as { token?: unknown }).token;
+		if (typeof token !== "string") {
+			return null;
+		}
+		const normalized = token.trim();
+		return normalized.length > 0 ? normalized : null;
+	} catch {
+		return null;
+	}
+}
+
+function parseStorageSaveLockAcquiredAt(raw: string): number | null {
+	const trimmed = raw.trim();
+	if (trimmed.length === 0) {
+		return null;
+	}
+	try {
+		const parsed = JSON.parse(trimmed) as unknown;
+		if (!parsed || typeof parsed !== "object") {
+			return null;
+		}
+		const acquiredAt = (parsed as { acquiredAt?: unknown }).acquiredAt;
+		if (typeof acquiredAt !== "number" || !Number.isFinite(acquiredAt)) {
+			return null;
+		}
+		return Math.floor(acquiredAt);
+	} catch {
+		return null;
+	}
+}
+
+async function readStorageSaveLockObservation(
+	lockPath: string,
+): Promise<StorageSaveLockObservation | null> {
+	try {
+		const raw = await readFileUtf8WithTransientRetry(lockPath);
+		return {
+			token: parseStorageSaveLockToken(raw),
+			fingerprint: computeSha256(raw),
+			acquiredAt: parseStorageSaveLockAcquiredAt(raw),
+		};
+	} catch (error) {
+		const code = (error as NodeJS.ErrnoException | undefined)?.code;
+		if (code === "ENOENT") {
+			return null;
+		}
+		throw error;
+	}
+}
+
+async function removeStorageSaveLockIfOwnerMatches(
+	lockPath: string,
+	owner: { token?: string; fingerprint?: string },
+): Promise<boolean> {
+	const observation = await readStorageSaveLockObservation(lockPath);
+	if (!observation) {
+		return true;
+	}
+
+	const tokenMatches =
+		typeof owner.token === "string" &&
+		owner.token.length > 0 &&
+		observation.token === owner.token;
+	const fingerprintMatches =
+		typeof owner.fingerprint === "string" &&
+		owner.fingerprint.length > 0 &&
+		observation.fingerprint === owner.fingerprint;
+	if (!tokenMatches && !fingerprintMatches) {
+		return false;
+	}
+
+	try {
+		await fs.unlink(lockPath);
+		return true;
+	} catch (error) {
+		const code = (error as NodeJS.ErrnoException | undefined)?.code;
+		if (code === "ENOENT") {
+			return true;
+		}
+		if (isTransientReadError(error)) {
+			throw error;
+		}
+		throw error;
+	}
+}
+
+async function acquireStorageSaveFileLock(path: string): Promise<StorageSaveFileLock> {
+	const lockPath = getAccountsSaveLockPath(path);
+	const deadline = Date.now() + STORAGE_SAVE_LOCK_WAIT_TIMEOUT_MS;
+	const token = randomUUID();
+	const payload = JSON.stringify({
+		pid: process.pid,
+		token,
+		acquiredAt: Date.now(),
+	});
+	const lockContent = `${payload}\n`;
+	const fingerprint = computeSha256(lockContent);
+
+	while (true) {
+		try {
+			const handle = await fs.open(lockPath, "wx");
+			try {
+				await handle.writeFile(lockContent, "utf8");
+			} finally {
+				await handle.close();
+			}
+			return { lockPath, token, fingerprint };
+		} catch (error) {
+			const code = (error as NodeJS.ErrnoException | undefined)?.code;
+			if (code === "EEXIST") {
+				const observation = await readStorageSaveLockObservation(lockPath);
+				const now = Date.now();
+				let staleAgeMs: number | null = null;
+				if (observation && typeof observation.acquiredAt === "number") {
+					staleAgeMs = now - observation.acquiredAt;
+				} else if (observation) {
+					try {
+						const stat = await fs.stat(lockPath);
+						staleAgeMs = now - stat.mtimeMs;
+					} catch (statError) {
+						const statCode = (statError as NodeJS.ErrnoException | undefined)?.code;
+						if (statCode === "ENOENT") {
+							continue;
+						}
+						if (!isTransientReadError(statError)) {
+							throw statError;
+						}
+					}
+				}
+				if (observation && staleAgeMs !== null && staleAgeMs > STORAGE_SAVE_LOCK_STALE_AFTER_MS) {
+					try {
+						const removed = await removeStorageSaveLockIfOwnerMatches(lockPath, {
+							token: observation.token ?? undefined,
+							fingerprint: observation.fingerprint,
+						});
+						if (removed) {
+							continue;
+						}
+					} catch (removeError) {
+						if (isTransientReadError(removeError) && now < deadline) {
+							await new Promise((resolve) => setTimeout(resolve, STORAGE_SAVE_LOCK_POLL_INTERVAL_MS));
+							continue;
+						}
+						throw removeError;
+					}
+				}
+				if (now >= deadline) {
+					break;
+				}
+				await new Promise((resolve) => setTimeout(resolve, STORAGE_SAVE_LOCK_POLL_INTERVAL_MS));
+				continue;
+			}
+			if (
+				(code === "EBUSY" || code === "EPERM" || code === "EAGAIN") &&
+				Date.now() < deadline
+			) {
+				await new Promise((resolve) => setTimeout(resolve, STORAGE_SAVE_LOCK_POLL_INTERVAL_MS));
+				continue;
+			}
+			throw error;
+		}
+	}
+
+	const lockTimeout = Object.assign(new Error("Timed out waiting for account storage lock"), {
+		code: "EBUSY",
+	});
+	throw new StorageError(
+		"Timed out waiting for account storage lock",
+		"EBUSY",
+		path,
+		formatStorageErrorHint(lockTimeout, path),
+		lockTimeout,
+	);
+}
+
+async function releaseStorageSaveFileLock(lock: StorageSaveFileLock): Promise<void> {
+	for (let attempt = 0; attempt < TRANSIENT_READ_RETRY_ATTEMPTS; attempt += 1) {
+		try {
+			const released = await removeStorageSaveLockIfOwnerMatches(lock.lockPath, {
+				token: lock.token,
+				fingerprint: lock.fingerprint,
+			});
+			if (!released) {
+				log.warn("Skipped account storage lock release because ownership changed", {
+					lockPath: lock.lockPath,
+				});
+			}
+			return;
+		} catch (error) {
+			if (!isTransientReadError(error) || attempt + 1 >= TRANSIENT_READ_RETRY_ATTEMPTS) {
+				throw error;
+			}
+			await new Promise((resolve) =>
+				setTimeout(resolve, TRANSIENT_READ_RETRY_BASE_DELAY_MS * 2 ** attempt),
+			);
+		}
+	}
+}
+
+async function withStorageSaveFileLock<T>(
+	path: string,
+	task: () => Promise<T>,
+): Promise<T> {
+	const lock = await acquireStorageSaveFileLock(path);
+	let taskError: unknown;
+	try {
+		return await task();
+	} catch (error) {
+		taskError = error;
+		throw error;
+	} finally {
+		try {
+			await releaseStorageSaveFileLock(lock);
+		} catch (releaseError) {
+			if (taskError !== undefined) {
+				log.warn("Failed to release account storage lock after save error", {
+					lockPath: lock.lockPath,
+					error: String(releaseError),
+				});
+				// Preserve the original task failure and avoid throwing from finally.
+			} else {
+				log.warn("Failed to release account storage lock after successful save", {
+					lockPath: lock.lockPath,
+					error: String(releaseError),
+				});
+			}
+		}
+	}
+}
+
+function rememberKnownStorageRevision(path: string, revision: string | null): void {
+	knownStorageRevisionByPath.set(path, revision);
+}
+
+function forgetKnownStorageRevision(path: string): void {
+	knownStorageRevisionByPath.delete(path);
+}
+
+async function rememberKnownStorageRevisionFromDisk(path: string): Promise<void> {
+	try {
+		const revision = await readStorageRevision(path);
+		rememberKnownStorageRevision(path, revision);
+	} catch (error) {
+		log.warn("Failed to refresh known storage revision from disk", {
+			path,
+			error: String(error),
+		});
+		forgetKnownStorageRevision(path);
+	}
+}
+
 type AccountsJournalEntry = {
 	version: 1;
 	createdAt: number;
@@ -404,6 +906,9 @@ export function getLastAccountsSaveTimestamp(): number {
 }
 
 export function setStoragePath(projectPath: string | null): void {
+  if (currentStoragePath) {
+    forgetKnownStorageRevision(currentStoragePath);
+  }
   if (!projectPath) {
     currentStoragePath = null;
     currentLegacyProjectStoragePath = null;
@@ -433,6 +938,9 @@ export function setStoragePath(projectPath: string | null): void {
 }
 
 export function setStoragePathDirect(path: string | null): void {
+  if (currentStoragePath) {
+    forgetKnownStorageRevision(currentStoragePath);
+  }
   currentStoragePath = path;
   currentLegacyProjectStoragePath = null;
   currentLegacyWorktreeStoragePath = null;
@@ -723,6 +1231,14 @@ function clampIndex(index: number, length: number): number {
   return Math.max(0, Math.min(index, length - 1));
 }
 
+function isStoredAccountCandidate(account: unknown): account is AccountMetadataV3 {
+	return (
+		isRecord(account) &&
+		typeof account.refreshToken === "string" &&
+		account.refreshToken.trim().length > 0
+	);
+}
+
 function toAccountKey(account: Pick<AccountMetadataV3, "accountId" | "refreshToken">): string {
   return account.accountId || account.refreshToken;
 }
@@ -782,10 +1298,17 @@ export function normalizeAccountStorage(data: unknown): AccountStorageV3 | null
       ? migrateV1ToV3(data as unknown as AccountStorageV1)
       : (data as unknown as AccountStorageV3);
 
-  const validAccounts = rawAccounts.filter(
-    (account): account is AccountMetadataV3 =>
-      isRecord(account) && typeof account.refreshToken === "string" && !!account.refreshToken.trim(),
-  );
+	const validAccounts: AccountMetadataV3[] = [];
+	for (const account of rawAccounts) {
+		if (!isStoredAccountCandidate(account)) {
+			continue;
+		}
+		try {
+			validAccounts.push(decryptAccountSensitiveFields(account));
+		} catch (error) {
+			throw toStorageDecryptError(error);
+		}
+	}
 
   const deduplicatedAccounts = deduplicateAccountsByEmail(
     deduplicateAccountsByKey(validAccounts),
@@ -849,14 +1372,87 @@ export async function loadAccounts(): Promise<AccountStorageV3 | null> {
   return loadAccountsInternal(saveAccounts);
 }
 
-function parseAndNormalizeStorage(data: unknown): {
+async function hydrateV4Storage(data: AccountStorageV4): Promise<AccountStorageV3 | null> {
+	const mode = await getEffectiveSecretStorageMode();
+	if (mode === "plaintext") {
+		log.warn("Cannot load v4 keychain-backed account storage in plaintext mode");
+		return null;
+	}
+
+	const hydratedAccounts: AccountMetadataV3[] = [];
+	let skippedBeforeActiveIndex = 0;
+	const skippedIndices: number[] = [];
+	for (let index = 0; index < data.accounts.length; index += 1) {
+		const rawAccount = data.accounts[index];
+		if (!rawAccount) continue;
+		const secrets = await loadAccountSecrets({
+			refreshTokenRef: rawAccount.refreshTokenRef,
+			accessTokenRef: rawAccount.accessTokenRef,
+		});
+		if (!secrets || !secrets.refreshToken) {
+			if (index < data.activeIndex) {
+				skippedBeforeActiveIndex += 1;
+			}
+			skippedIndices.push(index);
+			log.warn("Skipping v4 account with missing keychain secret", {
+				accountId: rawAccount.accountId,
+			});
+			continue;
+		}
+		const {
+			refreshTokenRef,
+			accessTokenRef,
+			...rest
+		} = rawAccount;
+		void refreshTokenRef;
+		void accessTokenRef;
+		hydratedAccounts.push({
+			...rest,
+			refreshToken: secrets.refreshToken,
+			accessToken: secrets.accessToken,
+		});
+	}
+	const adjustedActiveIndex = Math.max(0, data.activeIndex - skippedBeforeActiveIndex);
+	const remapFamilyIndex = (rawIndex: number): number => {
+		const droppedBefore = skippedIndices.filter((droppedIndex) => droppedIndex < rawIndex).length;
+		const remapped = Math.max(0, rawIndex - droppedBefore);
+		if (hydratedAccounts.length <= 0) return 0;
+		return Math.min(remapped, hydratedAccounts.length - 1);
+	};
+	const adjustedActiveIndexByFamily: Partial<Record<ModelFamily, number>> = {};
+	if (data.activeIndexByFamily) {
+		for (const family of MODEL_FAMILIES) {
+			const raw = data.activeIndexByFamily[family];
+			if (typeof raw === "number" && Number.isFinite(raw)) {
+				adjustedActiveIndexByFamily[family] = remapFamilyIndex(raw);
+			}
+		}
+	}
+
+	return normalizeAccountStorage({
+		version: 3,
+		accounts: hydratedAccounts,
+		activeIndex: adjustedActiveIndex,
+		activeIndexByFamily: adjustedActiveIndexByFamily,
+	});
+}
+
+async function parseAndNormalizeStorage(data: unknown): Promise<{
 	normalized: AccountStorageV3 | null;
 	storedVersion: unknown;
 	schemaErrors: string[];
-} {
+}> {
 	const schemaErrors = getValidationErrors(AnyAccountStorageSchema, data);
-	const normalized = normalizeAccountStorage(data);
 	const storedVersion = isRecord(data) ? (data as { version?: unknown }).version : undefined;
+	if (storedVersion === 4 && isRecord(data)) {
+		const parsedV4 = AccountStorageV4Schema.safeParse(data);
+		if (!parsedV4.success) {
+			return { normalized: null, storedVersion, schemaErrors };
+		}
+		const normalized = await hydrateV4Storage(parsedV4.data);
+		return { normalized, storedVersion, schemaErrors };
+	}
+	const normalized = normalizeAccountStorage(data);
 	return { normalized, storedVersion, schemaErrors };
 }
 
@@ -864,10 +1460,14 @@ async function loadAccountsFromPath(path: string): Promise<{
 	normalized: AccountStorageV3 | null;
 	storedVersion: unknown;
 	schemaErrors: string[];
+	rawChecksum: string;
 }> {
-	const content = await fs.readFile(path, "utf-8");
+	const content = await readFileUtf8WithTransientRetry(path);
 	const data = JSON.parse(content) as unknown;
-	return parseAndNormalizeStorage(data);
+	return {
+		...(await parseAndNormalizeStorage(data)),
+		rawChecksum: computeSha256(content),
+	};
 }
 
 async function loadAccountsFromJournal(path: string): Promise<AccountStorageV3 | null> {
@@ -885,7 +1485,7 @@ async function loadAccountsFromJournal(path: string): Promise<AccountStorageV3 |
 			return null;
 		}
 		const data = JSON.parse(entry.content) as unknown;
-		const { normalized } = parseAndNormalizeStorage(data);
+		const { normalized } = await parseAndNormalizeStorage(data);
 		if (!normalized) return null;
 		log.warn("Recovered account storage from WAL journal", { path, walPath });
 		return normalized;
@@ -908,11 +1508,13 @@ async function loadAccountsInternal(
 		: null;
 
   try {
-    const { normalized, storedVersion, schemaErrors } = await loadAccountsFromPath(path);
+    const { normalized, storedVersion, schemaErrors, rawChecksum } = await loadAccountsFromPath(path);
+    const requiresMigrationPersist =
+      normalized !== null && storedVersion !== normalized.version && persistMigration !== null;
     if (schemaErrors.length > 0) {
       log.warn("Account storage schema validation warnings", { errors: schemaErrors.slice(0, 5) });
     }
-    if (normalized && storedVersion !== normalized.version) {
+    if (normalized && storedVersion !== normalized.version && storedVersion !== 4) {
       log.info("Migrating account storage to v3", { from: storedVersion, to: normalized.version });
       if (persistMigration) {
         try {
@@ -949,6 +1551,7 @@ async function loadAccountsInternal(
 						});
 					}
 				}
+				await rememberKnownStorageRevisionFromDisk(path);
 				return backup.normalized;
 			} catch (backupError) {
 				const backupCode = (backupError as NodeJS.ErrnoException).code;
@@ -962,10 +1565,19 @@ async function loadAccountsInternal(
 		}
 	}
 
+	if (requiresMigrationPersist) {
+		await rememberKnownStorageRevisionFromDisk(path);
+	} else {
+		rememberKnownStorageRevision(path, rawChecksum);
+	}
     return normalized;
   } catch (error) {
     const code = (error as NodeJS.ErrnoException).code;
+    if (code === STORAGE_DECRYPT_ERROR_CODE) {
+      throw error;
+    }
     if (code === "ENOENT" && migratedLegacyStorage) {
+      rememberKnownStorageRevision(path, null);
       return migratedLegacyStorage;
     }
 
@@ -981,6 +1593,7 @@ async function loadAccountsInternal(
 				});
 			}
 		}
+		await rememberKnownStorageRevisionFromDisk(path);
 		return recoveredFromWal;
 	}
 
@@ -1007,6 +1620,7 @@ async function loadAccountsInternal(
 							});
 						}
 					}
+					await rememberKnownStorageRevisionFromDisk(path);
 					return backup.normalized;
 				}
 			} catch (backupError) {
@@ -1023,121 +1637,223 @@ async function loadAccountsInternal(
 
     if (code !== "ENOENT") {
       log.error("Failed to load account storage", { error: String(error) });
+      forgetKnownStorageRevision(path);
+      return null;
     }
+	rememberKnownStorageRevision(path, null);
     return null;
   }
 }
 
-async function saveAccountsUnlocked(storage: AccountStorageV3): Promise<void> {
-  const path = getStoragePath();
-  const uniqueSuffix = `${Date.now()}.${Math.random().toString(36).slice(2, 8)}`;
-  const tempPath = `${path}.${uniqueSuffix}.tmp`;
-  const walPath = getAccountsWalPath(path);
+type PersistedSecretRef = { refreshTokenRef: string; accessTokenRef?: string };
 
-  try {
-    await fs.mkdir(dirname(path), { recursive: true });
-    await ensureGitignore(path);
+type SerializedStoragePayload = {
+	content: string;
+	persistedSecretRefs: PersistedSecretRef[];
+};
 
-	if (looksLikeSyntheticFixtureStorage(storage)) {
-		try {
-			const existing = await loadNormalizedStorageFromPath(path, "existing account storage");
-			if (existing && existing.accounts.length > 0 && !looksLikeSyntheticFixtureStorage(existing)) {
-				throw new StorageError(
-					"Refusing to overwrite non-synthetic account storage with synthetic fixture payload",
-					"EINVALID",
-					path,
-					"Detected synthetic fixture-like account payload. Use explicit account import/login commands instead.",
-				);
-			}
-		} catch (error) {
-			if (error instanceof StorageError) {
-				throw error;
-			}
-			// Ignore existing-file probe failures and continue with normal save flow.
-		}
+async function serializeStorageForPersist(storage: AccountStorageV3): Promise<SerializedStoragePayload> {
+	const mode = await getEffectiveSecretStorageMode();
+	if (mode === "plaintext") {
+		return {
+			content: JSON.stringify(cloneStorageForPersist(storage), null, 2),
+			persistedSecretRefs: [],
+		};
 	}
 
-	if (storageBackupEnabled && existsSync(path)) {
-		try {
-			await createRotatingAccountsBackup(path);
-		} catch (backupError) {
-			log.warn("Failed to create account storage backup", {
-				path,
-				backupPath: getAccountsBackupPath(path),
-				error: String(backupError),
+	await ensureSecretStorageBackendAvailable();
+	const refsByIndex: Array<PersistedSecretRef> = [];
+	const persistedSecretRefs: PersistedSecretRef[] = [];
+	try {
+		for (let index = 0; index < storage.accounts.length; index += 1) {
+			const account = storage.accounts[index];
+			if (!account) continue;
+			const baseRef = `acct-${deriveAccountSecretRef({
+				accountId: account.accountId,
+				email: account.email,
+				addedAt: account.addedAt,
+				refreshToken: account.refreshToken,
+			})}`;
+			const refs = await persistAccountSecrets(baseRef, {
+				refreshToken: account.refreshToken,
+				accessToken: account.accessToken,
 			});
+			if (!refs) {
+				throw new Error("Keychain mode selected but no secret refs were returned");
+			}
+			persistedSecretRefs.push(refs);
+			refsByIndex[index] = refs;
 		}
+
+		const storageV4 = migrateV3ToV4(storage, (_account, index) => {
+			const refs = refsByIndex[index];
+			if (!refs) {
+				throw new Error(`Missing keychain refs for account index ${index}`);
+			}
+			return refs;
+		});
+		return {
+			content: JSON.stringify(storageV4, null, 2),
+			persistedSecretRefs,
+		};
+	} catch (error) {
+		await Promise.allSettled(
+			persistedSecretRefs.map((refs) => deleteAccountSecrets(refs, { force: true })),
+		);
+		throw error;
 	}
+}
 
-    const content = JSON.stringify(storage, null, 2);
-	const journalEntry: AccountsJournalEntry = {
-		version: 1,
-		createdAt: Date.now(),
-		path,
-		checksum: computeSha256(content),
-		content,
-	};
-	await fs.writeFile(walPath, JSON.stringify(journalEntry), {
-		encoding: "utf-8",
-		mode: 0o600,
-	});
-    await fs.writeFile(tempPath, content, { encoding: "utf-8", mode: 0o600 });
+async function saveAccountsUnlocked(
+	storage: AccountStorageV3,
+	options?: { expectedRevision?: string | null },
+): Promise<void> {
+	const path = getStoragePath();
+	const uniqueSuffix = `${Date.now()}.${Math.random().toString(36).slice(2, 8)}`;
+	const tempPath = `${path}.${uniqueSuffix}.tmp`;
+	const walPath = getAccountsWalPath(path);
+	let persistedSecretRefs: PersistedSecretRef[] = [];
 
-    const stats = await fs.stat(tempPath);
-    if (stats.size === 0) {
-      const emptyError = Object.assign(new Error("File written but size is 0"), { code: "EEMPTY" });
-      throw emptyError;
-    }
+	try {
+		await fs.mkdir(dirname(path), { recursive: true, mode: 0o700 });
+		await ensureGitignore(path);
+		await withStorageSaveFileLock(path, async () => {
+			const expectedRevision =
+				options && Object.hasOwn(options, "expectedRevision")
+					? options.expectedRevision
+					: knownStorageRevisionByPath.has(path)
+						? knownStorageRevisionByPath.get(path)
+						: undefined;
+			if (expectedRevision !== undefined) {
+				const currentRevision = await readStorageRevision(path);
+				if (currentRevision !== expectedRevision) {
+					throw new StorageError(
+						"Detected concurrent account storage modification; refusing stale overwrite",
+						"ECONFLICT",
+						path,
+						"Account storage changed on disk since it was loaded. Reload accounts and retry.",
+					);
+				}
+			}
 
-    // Retry rename with exponential backoff for Windows EPERM/EBUSY
-    let lastError: NodeJS.ErrnoException | null = null;
-    for (let attempt = 0; attempt < 5; attempt++) {
-      try {
-        await fs.rename(tempPath, path);
-		lastAccountsSaveTimestamp = Date.now();
+			if (looksLikeSyntheticFixtureStorage(storage)) {
+				try {
+					const existing = await loadNormalizedStorageFromPath(path, "existing account storage");
+					if (existing && existing.accounts.length > 0 && !looksLikeSyntheticFixtureStorage(existing)) {
+						throw new StorageError(
+							"Refusing to overwrite non-synthetic account storage with synthetic fixture payload",
+							"EINVALID",
+							path,
+							"Detected synthetic fixture-like account payload. Use explicit account import/login commands instead.",
+						);
+					}
+				} catch (error) {
+					if (error instanceof StorageError) {
+						throw error;
+					}
+					// Ignore existing-file probe failures and continue with normal save flow.
+				}
+			}
+
+			if (storageBackupEnabled && existsSync(path)) {
+				try {
+					await createRotatingAccountsBackup(path);
+				} catch (backupError) {
+					log.warn("Failed to create account storage backup", {
+						path,
+						backupPath: getAccountsBackupPath(path),
+						error: String(backupError),
+					});
+				}
+			}
+
+			const serialized = await serializeStorageForPersist(storage);
+			const content = serialized.content;
+			persistedSecretRefs = serialized.persistedSecretRefs;
+			const journalEntry: AccountsJournalEntry = {
+				version: 1,
+				createdAt: Date.now(),
+				path,
+				checksum: computeSha256(content),
+				content,
+			};
+			await fs.writeFile(walPath, JSON.stringify(journalEntry), {
+				encoding: "utf-8",
+				mode: 0o600,
+			});
+			await fs.writeFile(tempPath, content, { encoding: "utf-8", mode: 0o600 });
+
+			const stats = await fs.stat(tempPath);
+			if (stats.size === 0) {
+				const emptyError = Object.assign(new Error("File written but size is 0"), {
+					code: "EEMPTY",
+				});
+				throw emptyError;
+			}
+
+			// Retry rename with exponential backoff for Windows EPERM/EBUSY
+			let lastError: NodeJS.ErrnoException | null = null;
+			for (let attempt = 0; attempt < 5; attempt++) {
+				try {
+					await fs.rename(tempPath, path);
+					lastAccountsSaveTimestamp = Date.now();
+					rememberKnownStorageRevision(path, computeSha256(content));
+					persistedSecretRefs = [];
+					try {
+						await fs.unlink(walPath);
+					} catch {
+						// Best effort cleanup.
+					}
+					return;
+				} catch (renameError) {
+					const code = (renameError as NodeJS.ErrnoException).code;
+					if (code === "EPERM" || code === "EBUSY") {
+						lastError = renameError as NodeJS.ErrnoException;
+						await new Promise((resolve) => setTimeout(resolve, 10 * Math.pow(2, attempt)));
+						continue;
+					}
+					throw renameError;
+				}
+			}
+			if (lastError) {
+				throw lastError;
+			}
+		});
+	} catch (error) {
 		try {
-			await fs.unlink(walPath);
+			await fs.unlink(tempPath);
 		} catch {
-			// Best effort cleanup.
+			// Ignore cleanup failure.
+		}
+		if (persistedSecretRefs.length > 0) {
+			await Promise.allSettled(
+				persistedSecretRefs.map((refs) => deleteAccountSecrets(refs, { force: true })),
+			);
 		}
-        return;
-      } catch (renameError) {
-        const code = (renameError as NodeJS.ErrnoException).code;
-        if (code === "EPERM" || code === "EBUSY") {
-          lastError = renameError as NodeJS.ErrnoException;
-          await new Promise(r => setTimeout(r, 10 * Math.pow(2, attempt)));
-          continue;
-        }
-        throw renameError;
-      }
-    }
-    if (lastError) throw lastError;
-  } catch (error) {
-    try {
-      await fs.unlink(tempPath);
-    } catch {
-      // Ignore cleanup failure.
-    }
 
-    const err = error as NodeJS.ErrnoException;
-    const code = err?.code || "UNKNOWN";
-    const hint = formatStorageErrorHint(error, path);
+		if (error instanceof StorageError) {
+			throw error;
+		}
 
-    log.error("Failed to save accounts", {
-      path,
-      code,
-      message: err?.message,
-      hint,
-    });
+		const err = error as NodeJS.ErrnoException;
+		const code = err?.code || "UNKNOWN";
+		const hint = formatStorageErrorHint(error, path);
 
-    throw new StorageError(
-      `Failed to save accounts: ${err?.message || "Unknown error"}`,
-      code,
-      path,
-      hint,
-      err instanceof Error ? err : undefined
-    );
-  }
+		log.error("Failed to save accounts", {
+			path,
+			code,
+			message: err?.message,
+			hint,
+		});
+
+		throw new StorageError(
+			`Failed to save accounts: ${err?.message || "Unknown error"}`,
+			code,
+			path,
+			hint,
+			err instanceof Error ? err : undefined,
+		);
+	}
 }
 
 export async function withAccountStorageTransaction<T>(
@@ -1146,12 +1862,14 @@ export async function withAccountStorageTransaction<T>(
     persist: (storage: AccountStorageV3) => Promise<void>,
   ) => Promise<T>,
 ): Promise<T> {
-  return withStorageLock(async () => {
-    const current = await loadAccountsInternal(saveAccountsUnlocked);
-    return handler(current, saveAccountsUnlocked);
-  });
+	const path = getStoragePath();
+	return withStorageSerializedFileLock(path, async () => {
+		const current = await loadAccountsInternal(saveAccountsUnlocked);
+		return handler(current, saveAccountsUnlocked);
+	});
 }
 
+
 /**
  * Persists account storage to disk using atomic write (temp file + rename).
  * Creates the Codex multi-auth storage directory if it doesn't exist.
@@ -1160,9 +1878,79 @@ export async function withAccountStorageTransaction<T>(
  * @throws StorageError with platform-aware hints on failure
  */
 export async function saveAccounts(storage: AccountStorageV3): Promise<void> {
-  return withStorageLock(async () => {
-    await saveAccountsUnlocked(storage);
-  });
+	const path = getStoragePath();
+	return withStorageSerializedFileLock(path, async () => {
+		await saveAccountsUnlocked(storage);
+	});
+}
+
+function collectSecretRefsFromV4Payload(payload: unknown): PersistedSecretRef[] {
+	if (!isRecord(payload) || payload.version !== 4 || !Array.isArray(payload.accounts)) {
+		return [];
+	}
+	const refs: PersistedSecretRef[] = [];
+	for (const rawAccount of payload.accounts) {
+		if (!isRecord(rawAccount)) continue;
+		const refreshTokenRef =
+			typeof rawAccount.refreshTokenRef === "string"
+				? rawAccount.refreshTokenRef.trim()
+				: "";
+		if (!refreshTokenRef) continue;
+		const accessTokenRef =
+			typeof rawAccount.accessTokenRef === "string"
+				? rawAccount.accessTokenRef.trim()
+				: undefined;
+		refs.push({ refreshTokenRef, accessTokenRef });
+	}
+	return refs;
+}
+
+function collectPersistedSecretRefs(payload: unknown): PersistedSecretRef[] {
+	const directRefs = collectSecretRefsFromV4Payload(payload);
+	if (directRefs.length > 0) {
+		return directRefs;
+	}
+	if (
+		!isRecord(payload) ||
+		payload.version !== 1 ||
+		typeof payload.content !== "string" ||
+		payload.content.trim().length === 0
+	) {
+		return [];
+	}
+	try {
+		const journalPayload = JSON.parse(payload.content) as unknown;
+		return collectSecretRefsFromV4Payload(journalPayload);
+	} catch {
+		return [];
+	}
+}
+
+async function clearPersistedAccountSecrets(path: string): Promise<void> {
+	try {
+		const raw = await fs.readFile(path, "utf-8");
+		const parsed = JSON.parse(raw) as unknown;
+		const refs = collectPersistedSecretRefs(parsed);
+		for (const ref of refs) {
+			try {
+				await deleteAccountSecrets(ref, { force: true });
+			} catch (error) {
+				log.warn("Failed to clear keychain secret reference", {
+					path,
+					refreshTokenRef: ref.refreshTokenRef,
+					error: String(error),
+				});
+			}
+		}
+	} catch (error) {
+		const code = (error as NodeJS.ErrnoException).code;
+		if (code !== "ENOENT") {
+			log.warn("Failed to clear persisted account secrets", {
+				path,
+				error: String(error),
+			});
+		}
+	}
 }
 
 /**
@@ -1170,10 +1958,11 @@ export async function saveAccounts(storage: AccountStorageV3): Promise<void> {
  * Silently ignores if file doesn't exist.
  */
 export async function clearAccounts(): Promise<void> {
-  return withStorageLock(async () => {
-    const path = getStoragePath();
-    const walPath = getAccountsWalPath(path);
-	const backupPaths = getAccountsBackupRecoveryCandidates(path);
+	const path = getStoragePath();
+	return withStorageSerializedFileLock(path, async () => {
+		const walPath = getAccountsWalPath(path);
+		const lockPath = getAccountsSaveLockPath(path);
+		const backupPaths = getAccountsBackupRecoveryCandidates(path);
     const clearPath = async (targetPath: string): Promise<void> => {
       try {
         await fs.unlink(targetPath);
@@ -1189,13 +1978,25 @@ export async function clearAccounts(): Promise<void> {
     };
 
     try {
-      await Promise.all([clearPath(path), clearPath(walPath), ...backupPaths.map(clearPath)]);
+      await clearPersistedAccountSecrets(path);
+      await clearPersistedAccountSecrets(walPath);
+      for (const backupPath of backupPaths) {
+        await clearPersistedAccountSecrets(backupPath);
+      }
+      await Promise.all([
+		clearPath(path),
+		clearPath(walPath),
+		clearPath(lockPath),
+		...backupPaths.map(clearPath),
+	  ]);
+	  rememberKnownStorageRevision(path, null);
     } catch {
       // Individual path cleanup is already best-effort with per-artifact logging.
     }
-  });
+	});
 }
 
+
 function normalizeFlaggedStorage(data: unknown): FlaggedAccountStorageV1 {
 	if (!isRecord(data) || data.version !== 1 || !Array.isArray(data.accounts)) {
 		return { version: 1, accounts: [] };
@@ -1204,9 +2005,15 @@ function normalizeFlaggedStorage(data: unknown): FlaggedAccountStorageV1 {
 	const byRefreshToken = new Map<string, FlaggedAccountMetadataV1>();
 	for (const rawAccount of data.accounts) {
 		if (!isRecord(rawAccount)) continue;
-		const refreshToken =
+		const refreshTokenRaw =
 			typeof rawAccount.refreshToken === "string" ? rawAccount.refreshToken.trim() : "";
-		if (!refreshToken) continue;
+		if (!refreshTokenRaw) continue;
+		let refreshToken: string;
+		try {
+			refreshToken = decryptStorageSecret(refreshTokenRaw, "flagged refresh token").value;
+		} catch (error) {
+			throw toFieldDecryptError("flagged refresh token", error);
+		}
 
 		const flaggedAt = typeof rawAccount.flaggedAt === "number" ? rawAccount.flaggedAt : Date.now();
 		const isAccountIdSource = (
@@ -1272,6 +2079,19 @@ function normalizeFlaggedStorage(data: unknown): FlaggedAccountStorageV1 {
 	};
 }
 
+function cloneFlaggedStorageForPersist(storage: FlaggedAccountStorageV1): FlaggedAccountStorageV1 {
+	return {
+		version: 1,
+		accounts: storage.accounts.map((account) => ({
+			...account,
+			refreshToken: encryptStorageSecret(account.refreshToken),
+			...(typeof account.accessToken === "string" && account.accessToken.length > 0
+				? { accessToken: encryptStorageSecret(account.accessToken) }
+				: {}),
+		})),
+	};
+}
+
 export async function loadFlaggedAccounts(): Promise<FlaggedAccountStorageV1> {
 	const path = getFlaggedAccountsPath();
 	const empty: FlaggedAccountStorageV1 = { version: 1, accounts: [] };
@@ -1282,6 +2102,9 @@ export async function loadFlaggedAccounts(): Promise<FlaggedAccountStorageV1> {
 		return normalizeFlaggedStorage(data);
 	} catch (error) {
 		const code = (error as NodeJS.ErrnoException).code;
+		if (code === STORAGE_DECRYPT_ERROR_CODE) {
+			throw error;
+		}
 		if (code !== "ENOENT") {
 			log.error("Failed to load flagged account storage", { path, error: String(error) });
 			return empty;
@@ -1312,6 +2135,10 @@ export async function loadFlaggedAccounts(): Promise<FlaggedAccountStorageV1> {
 		});
 		return migrated;
 	} catch (error) {
+		const code = (error as NodeJS.ErrnoException).code;
+		if (code === STORAGE_DECRYPT_ERROR_CODE) {
+			throw error;
+		}
 		log.error("Failed to migrate legacy flagged account storage", {
 			from: legacyPath,
 			to: path,
@@ -1329,7 +2156,8 @@ export async function saveFlaggedAccounts(storage: FlaggedAccountStorageV1): Pro
 
 		try {
 			await fs.mkdir(dirname(path), { recursive: true });
-			const content = JSON.stringify(normalizeFlaggedStorage(storage), null, 2);
+			const normalized = normalizeFlaggedStorage(storage);
+			const content = JSON.stringify(cloneFlaggedStorageForPersist(normalized), null, 2);
 			await fs.writeFile(tempPath, content, { encoding: "utf-8", mode: 0o600 });
 			await fs.rename(tempPath, path);
 		} catch (error) {
@@ -1377,7 +2205,7 @@ export async function exportAccounts(filePath: string, force = true): Promise<vo
   
   await fs.mkdir(dirname(resolvedPath), { recursive: true });
   
-  const content = JSON.stringify(storage, null, 2);
+  const content = JSON.stringify(cloneStorageForPersist(storage), null, 2);
   await fs.writeFile(resolvedPath, content, { encoding: "utf-8", mode: 0o600 });
   log.info("Exported accounts", { path: resolvedPath, count: storage.accounts.length });
 }
@@ -1446,3 +2274,34 @@ export async function importAccounts(filePath: string): Promise<{ imported: numb
 
   return { imported: importedCount, total, skipped: skippedCount };
 }
+
+export async function rotateStoredSecretEncryption(): Promise<{
+	accounts: number;
+	flaggedAccounts: number;
+}> {
+	const keys = getConfiguredSecretKeys();
+	if (!keys.primary) {
+		throw new Error("CODEX_AUTH_ENCRYPTION_KEY is required to rotate stored secrets");
+	}
+
+	const accountCount = await withAccountStorageTransaction(async (current, persist) => {
+		if (!current) {
+			return 0;
+		}
+		await persist(current);
+		return current.accounts.length;
+	});
+
+	const flagged = await loadFlaggedAccounts();
+	const flaggedCount = flagged.accounts.length;
+	if (flaggedCount > 0) {
+		await saveFlaggedAccounts(flagged);
+	}
+
+	return {
+		accounts: accountCount,
+		flaggedAccounts: flaggedCount,
+	};
+}
+
+
diff --git a/lib/storage/migrations.ts b/lib/storage/migrations.ts
index 2339d1d1f..f3f8cada7 100644
--- a/lib/storage/migrations.ts
+++ b/lib/storage/migrations.ts
@@ -63,6 +63,30 @@ export interface AccountStorageV3 {
 	activeIndexByFamily?: Partial<Record<ModelFamily, number>>;
 }
 
+export interface AccountMetadataV4 {
+	accountId?: string;
+	accountIdSource?: AccountIdSource;
+	accountLabel?: string;
+	email?: string;
+	refreshTokenRef: string;
+	accessTokenRef?: string;
+	expiresAt?: number;
+	enabled?: boolean;
+	addedAt: number;
+	lastUsed: number;
+	lastSwitchReason?: "rate-limit" | "initial" | "rotation";
+	rateLimitResetTimes?: RateLimitStateV3;
+	coolingDownUntil?: number;
+	cooldownReason?: CooldownReason;
+}
+
+export interface AccountStorageV4 {
+	version: 4;
+	accounts: AccountMetadataV4[];
+	activeIndex: number;
+	activeIndexByFamily?: Partial<Record<ModelFamily, number>>;
+}
+
 function nowMs(): number {
 	return Date.now();
 }
@@ -101,3 +125,36 @@ export function migrateV1ToV3(v1: AccountStorageV1): AccountStorageV3 {
 		) as Partial<Record<ModelFamily, number>>,
 	};
 }
+
+export function migrateV3ToV4(
+	v3: AccountStorageV3,
+	resolveRefs: (account: AccountMetadataV3, index: number) => {
+		refreshTokenRef: string;
+		accessTokenRef?: string;
+	},
+): AccountStorageV4 {
+	return {
+		version: 4,
+		activeIndex: v3.activeIndex,
+		activeIndexByFamily: v3.activeIndexByFamily,
+		accounts: v3.accounts.map((account, index) => {
+			const refs = resolveRefs(account, index);
+			return {
+				accountId: account.accountId,
+				accountIdSource: account.accountIdSource,
+				accountLabel: account.accountLabel,
+				email: account.email,
+				refreshTokenRef: refs.refreshTokenRef,
+				accessTokenRef: refs.accessTokenRef,
+				expiresAt: account.expiresAt,
+				enabled: account.enabled,
+				addedAt: account.addedAt,
+				lastUsed: account.lastUsed,
+				lastSwitchReason: account.lastSwitchReason,
+				rateLimitResetTimes: account.rateLimitResetTimes,
+				coolingDownUntil: account.coolingDownUntil,
+				cooldownReason: account.cooldownReason,
+			};
+		}),
+	};
+}
diff --git a/lib/telemetry.ts b/lib/telemetry.ts
new file mode 100644
index 000000000..70559f6aa
--- /dev/null
+++ b/lib/telemetry.ts
@@ -0,0 +1,316 @@
+import {
+	existsSync,
+	promises as fs,
+	readdirSync,
+	renameSync,
+	statSync,
+	unlinkSync,
+} from "node:fs";
+import { join } from "node:path";
+import { getCorrelationId, maskEmail } from "./logger.js";
+import { getCodexLogDir } from "./runtime-paths.js";
+
+export type TelemetrySource = "cli" | "plugin";
+export type TelemetryOutcome = "start" | "success" | "failure" | "recovery" | "info";
+
+export interface TelemetryEvent {
+	timestamp: string;
+	source: TelemetrySource;
+	event: string;
+	outcome: TelemetryOutcome;
+	correlationId: string | null;
+	details?: Record<string, unknown>;
+}
+
+export interface TelemetryEventInput {
+	source: TelemetrySource;
+	event: string;
+	outcome: TelemetryOutcome;
+	details?: Record<string, unknown>;
+}
+
+export interface TelemetryConfig {
+	enabled: boolean;
+	logDir: string;
+	fileName: string;
+	maxFileSizeBytes: number;
+	maxFiles: number;
+}
+
+export interface QueryTelemetryOptions {
+	sinceMs?: number;
+	limit?: number;
+}
+
+export interface TelemetrySummary {
+	total: number;
+	bySource: Record<TelemetrySource, number>;
+	byOutcome: Record<TelemetryOutcome, number>;
+	byEvent: Array<{ event: string; count: number }>;
+	firstTimestamp: string | null;
+	lastTimestamp: string | null;
+}
+
+const DEFAULT_TELEMETRY_CONFIG: TelemetryConfig = {
+	enabled: true,
+	logDir: getCodexLogDir(),
+	fileName: "product-telemetry.jsonl",
+	maxFileSizeBytes: 1 * 1024 * 1024,
+	maxFiles: 4,
+};
+
+const SENSITIVE_KEYS = new Set([
+	"access",
+	"accesstoken",
+	"access_token",
+	"refresh",
+	"refreshtoken",
+	"refresh_token",
+	"token",
+	"authorization",
+	"apikey",
+	"api_key",
+	"secret",
+	"password",
+	"credential",
+	"id_token",
+	"idtoken",
+]);
+
+const EMAIL_PATTERN = /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-z]{2,}/gi;
+const TOKEN_PATTERNS = [
+	/eyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g,
+	/sk-[A-Za-z0-9]{20,}/g,
+	/Bearer\s+\S+/gi,
+];
+
+let telemetryConfig: TelemetryConfig = { ...DEFAULT_TELEMETRY_CONFIG };
+let appendQueue: Promise<void> = Promise.resolve();
+
+function getTelemetryPath(): string {
+	return join(telemetryConfig.logDir, telemetryConfig.fileName);
+}
+
+async function ensureLogDir(): Promise<void> {
+	if (existsSync(telemetryConfig.logDir)) return;
+	await fs.mkdir(telemetryConfig.logDir, { recursive: true, mode: 0o700 });
+}
+
+function maskToken(value: string): string {
+	if (value.length <= 12) {
+		return "***MASKED***";
+	}
+	return `${value.slice(0, 6)}...${value.slice(-4)}`;
+}
+
+function sanitizeString(value: string): string {
+	let sanitized = value.replace(EMAIL_PATTERN, (email) => maskEmail(email));
+	for (const pattern of TOKEN_PATTERNS) {
+		sanitized = sanitized.replace(pattern, (match) => maskToken(match));
+	}
+	return sanitized;
+}
+
+function sanitizeValue(value: unknown, depth = 0): unknown {
+	if (depth > 8) return "[max depth]";
+	if (typeof value === "string") {
+		return sanitizeString(value);
+	}
+	if (Array.isArray(value)) {
+		return value.map((item) => sanitizeValue(item, depth + 1));
+	}
+	if (value !== null && typeof value === "object") {
+		const sanitized: Record<string, unknown> = {};
+		for (const [key, entry] of Object.entries(value)) {
+			const normalizedKey = key.toLowerCase().replace(/[-_]/g, "");
+			if (SENSITIVE_KEYS.has(normalizedKey)) {
+				sanitized[key] = "***MASKED***";
+				continue;
+			}
+			sanitized[key] = sanitizeValue(entry, depth + 1);
+		}
+		return sanitized;
+	}
+	return value;
+}
+
+function parseArchiveSuffix(fileName: string): number | null {
+	const base = telemetryConfig.fileName;
+	if (fileName === base) return 0;
+	if (!fileName.startsWith(`${base}.`)) return null;
+	const suffix = fileName.slice(base.length + 1).trim();
+	if (!/^\d+$/.test(suffix)) return null;
+	const parsed = Number.parseInt(suffix, 10);
+	return Number.isFinite(parsed) ? parsed : null;
+}
+
+function rotateLogsIfNeeded(): void {
+	const logPath = getTelemetryPath();
+	if (!existsSync(logPath)) return;
+
+	const size = statSync(logPath).size;
+	if (size < telemetryConfig.maxFileSizeBytes) return;
+
+	for (let i = telemetryConfig.maxFiles - 1; i >= 1; i -= 1) {
+		const target = `${logPath}.${i}`;
+		const source = i === 1 ? logPath : `${logPath}.${i - 1}`;
+		if (i === telemetryConfig.maxFiles - 1 && existsSync(target)) {
+			unlinkSync(target);
+		}
+		if (existsSync(source)) {
+			renameSync(source, target);
+		}
+	}
+}
+
+function queueAppend(task: () => Promise<void>): Promise<void> {
+	const next = appendQueue.then(task, task);
+	appendQueue = next.catch(() => {});
+	return next;
+}
+
+function isTelemetryEvent(value: unknown): value is TelemetryEvent {
+	if (!value || typeof value !== "object") return false;
+	const record = value as Record<string, unknown>;
+	return (
+		typeof record.timestamp === "string" &&
+		typeof record.source === "string" &&
+		typeof record.event === "string" &&
+		typeof record.outcome === "string"
+	);
+}
+
+async function readEventsFromFile(filePath: string): Promise<TelemetryEvent[]> {
+	try {
+		const raw = await fs.readFile(filePath, "utf8");
+		const lines = raw.split(/\r?\n/).filter((line) => line.trim().length > 0);
+		const events: TelemetryEvent[] = [];
+		for (const line of lines) {
+			try {
+				const parsed = JSON.parse(line) as unknown;
+				if (isTelemetryEvent(parsed)) {
+					events.push(parsed);
+				}
+			} catch {
+				// Ignore malformed lines.
+			}
+		}
+		return events;
+	} catch {
+		return [];
+	}
+}
+
+function listTelemetryFiles(): string[] {
+	try {
+		const entries = readdirSync(telemetryConfig.logDir);
+		const sortable = entries
+			.map((name) => {
+				const archiveIndex = parseArchiveSuffix(name);
+				if (archiveIndex === null) return null;
+				return { name, archiveIndex };
+			})
+			.filter((value): value is { name: string; archiveIndex: number } => value !== null)
+			.sort((left, right) => right.archiveIndex - left.archiveIndex);
+		return sortable.map((entry) => join(telemetryConfig.logDir, entry.name));
+	} catch {
+		return [];
+	}
+}
+
+function clampLimit(limit: number | undefined): number {
+	if (typeof limit !== "number" || !Number.isFinite(limit)) return 100;
+	return Math.max(1, Math.min(500, Math.floor(limit)));
+}
+
+export function configureTelemetry(config: Partial<TelemetryConfig>): void {
+	telemetryConfig = { ...telemetryConfig, ...config };
+}
+
+export function getTelemetryConfig(): TelemetryConfig {
+	return { ...telemetryConfig };
+}
+
+export function getTelemetryLogPath(): string {
+	return getTelemetryPath();
+}
+
+export async function recordTelemetryEvent(input: TelemetryEventInput): Promise<void> {
+	if (!telemetryConfig.enabled) return;
+	if (!input.event.trim()) return;
+
+	const entry: TelemetryEvent = {
+		timestamp: new Date().toISOString(),
+		source: input.source,
+		event: input.event,
+		outcome: input.outcome,
+		correlationId: getCorrelationId(),
+		details: input.details
+			? (sanitizeValue(input.details) as Record<string, unknown>)
+			: undefined,
+	};
+
+	try {
+		await queueAppend(async () => {
+			await ensureLogDir();
+			rotateLogsIfNeeded();
+			const line = `${JSON.stringify(entry)}\n`;
+			await fs.appendFile(getTelemetryPath(), line, "utf8");
+		});
+	} catch {
+		// Telemetry must never break runtime behavior.
+	}
+}
+
+export async function queryTelemetryEvents(
+	options: QueryTelemetryOptions = {},
+): Promise<TelemetryEvent[]> {
+	const sinceMs = options.sinceMs ?? 0;
+	const limit = clampLimit(options.limit);
+	const events: TelemetryEvent[] = [];
+
+	for (const filePath of listTelemetryFiles()) {
+		const parsed = await readEventsFromFile(filePath);
+		for (const event of parsed) {
+			const timestampMs = Date.parse(event.timestamp);
+			if (Number.isFinite(timestampMs) && timestampMs < sinceMs) {
+				continue;
+			}
+			events.push(event);
+		}
+	}
+
+	if (events.length <= limit) return events;
+	return events.slice(events.length - limit);
+}
+
+export function summarizeTelemetryEvents(events: readonly TelemetryEvent[]): TelemetrySummary {
+	const bySource: Record<TelemetrySource, number> = { cli: 0, plugin: 0 };
+	const byOutcome: Record<TelemetryOutcome, number> = {
+		start: 0,
+		success: 0,
+		failure: 0,
+		recovery: 0,
+		info: 0,
+	};
+	const eventCounts = new Map<string, number>();
+
+	for (const event of events) {
+		bySource[event.source] += 1;
+		byOutcome[event.outcome] += 1;
+		eventCounts.set(event.event, (eventCounts.get(event.event) ?? 0) + 1);
+	}
+
+	const byEvent = [...eventCounts.entries()]
+		.sort((left, right) => right[1] - left[1])
+		.map(([event, count]) => ({ event, count }));
+
+	return {
+		total: events.length,
+		bySource,
+		byOutcome,
+		byEvent,
+		firstTimestamp: events[0]?.timestamp ?? null,
+		lastTimestamp: events[events.length - 1]?.timestamp ?? null,
+	};
+}
diff --git a/lib/unified-settings.ts b/lib/unified-settings.ts
index ff63d8942..d09bd7bef 100644
--- a/lib/unified-settings.ts
+++ b/lib/unified-settings.ts
@@ -1,4 +1,5 @@
 import {
+	chmodSync,
 	existsSync,
 	mkdirSync,
 	renameSync,
@@ -8,22 +9,74 @@ import {
 	promises as fs,
 } from "node:fs";
 import { join } from "node:path";
+import { createHash } from "node:crypto";
 import { getCodexMultiAuthDir } from "./runtime-paths.js";
 import { sleep } from "./utils.js";
+import { acquireFileLock, acquireFileLockSync } from "./file-lock.js";
+import { logWarn } from "./logger.js";
 
 type JsonRecord = Record<string, unknown>;
 
 export const UNIFIED_SETTINGS_VERSION = 1 as const;
 
 const UNIFIED_SETTINGS_PATH = join(getCodexMultiAuthDir(), "settings.json");
+const UNIFIED_SETTINGS_LOCK_PATH = `${UNIFIED_SETTINGS_PATH}.lock`;
 const RETRYABLE_FS_CODES = new Set(["EBUSY", "EPERM"]);
+const SETTINGS_LOCK_OPTIONS = {
+	maxAttempts: 80,
+	baseDelayMs: 15,
+	maxDelayMs: 800,
+	staleAfterMs: 120_000,
+} as const;
+const SECURE_DIR_MODE = 0o700;
+const SECURE_FILE_MODE = 0o600;
 let settingsWriteQueue: Promise<void> = Promise.resolve();
+const SETTINGS_CONFLICT_RETRY_LIMIT = 3;
+
+type SettingsSnapshot = {
+	record: JsonRecord | null;
+	revision: string | null;
+};
 
 function isRetryableFsError(error: unknown): boolean {
 	const code = (error as NodeJS.ErrnoException | undefined)?.code;
 	return typeof code === "string" && RETRYABLE_FS_CODES.has(code);
 }
 
+function releaseUnifiedSettingsLockSync(release: () => void): void {
+	try {
+		release();
+	} catch (error) {
+		const code = (error as NodeJS.ErrnoException | undefined)?.code;
+		if (code === "ENOENT") return;
+		if (code === "EBUSY" || code === "EPERM") {
+			logWarn("Unified settings lock release failed after write", {
+				lockPath: UNIFIED_SETTINGS_LOCK_PATH,
+				code,
+			});
+			return;
+		}
+		throw error;
+	}
+}
+
+async function releaseUnifiedSettingsLockAsync(release: () => Promise<void>): Promise<void> {
+	try {
+		await release();
+	} catch (error) {
+		const code = (error as NodeJS.ErrnoException | undefined)?.code;
+		if (code === "ENOENT") return;
+		if (code === "EBUSY" || code === "EPERM") {
+			logWarn("Unified settings lock release failed after write", {
+				lockPath: UNIFIED_SETTINGS_LOCK_PATH,
+				code,
+			});
+			return;
+		}
+		throw error;
+	}
+}
+
 /**
  * Determines whether a value is a non-null object suitable for use as a JsonRecord.
  *
@@ -45,6 +98,113 @@ function cloneRecord(value: unknown): JsonRecord | null {
 	return { ...value };
 }
 
+function computeSha256(value: string): string {
+	return createHash("sha256").update(value).digest("hex");
+}
+
+function createSettingsConflictError(): Error & { code: string } {
+	return Object.assign(
+		new Error(
+			"Detected concurrent unified settings modification; reload and retry",
+		),
+		{ code: "ECONFLICT" as const },
+	);
+}
+
+function isConflictError(error: unknown): boolean {
+	const code = (error as NodeJS.ErrnoException | undefined)?.code;
+	return code === "ECONFLICT";
+}
+
+function readCurrentSettingsRevisionSync(): string | null {
+	if (!existsSync(UNIFIED_SETTINGS_PATH)) {
+		return null;
+	}
+	try {
+		const raw = readFileSync(UNIFIED_SETTINGS_PATH, "utf8");
+		return computeSha256(raw);
+	} catch (error) {
+		const code = (error as NodeJS.ErrnoException | undefined)?.code;
+		if (code === "ENOENT") {
+			return null;
+		}
+		throw error;
+	}
+}
+
+async function readCurrentSettingsRevisionAsync(): Promise<string | null> {
+	if (!existsSync(UNIFIED_SETTINGS_PATH)) {
+		return null;
+	}
+	let raw: string;
+	try {
+		raw = await fs.readFile(UNIFIED_SETTINGS_PATH, "utf8");
+	} catch (error) {
+		const code = (error as NodeJS.ErrnoException | undefined)?.code;
+		if (code === "ENOENT") {
+			return null;
+		}
+		throw error;
+	}
+	return computeSha256(raw);
+}
+
+function readSettingsSnapshotSync(): SettingsSnapshot {
+	if (!existsSync(UNIFIED_SETTINGS_PATH)) {
+		return { record: null, revision: null };
+	}
+
+	let raw: string;
+	try {
+		raw = readFileSync(UNIFIED_SETTINGS_PATH, "utf8");
+	} catch (error) {
+		const code = (error as NodeJS.ErrnoException | undefined)?.code;
+		if (code === "ENOENT") {
+			return { record: null, revision: null };
+		}
+		throw error;
+	}
+	const revision = computeSha256(raw);
+	let parsed: JsonRecord | null;
+	try {
+		parsed = cloneRecord(JSON.parse(raw));
+	} catch {
+		return { record: null, revision };
+	}
+	if (!parsed) {
+		return { record: null, revision };
+	}
+	return { record: parsed, revision };
+}
+
+async function readSettingsSnapshotAsync(): Promise<SettingsSnapshot> {
+	if (!existsSync(UNIFIED_SETTINGS_PATH)) {
+		return { record: null, revision: null };
+	}
+
+	let raw: string;
+	try {
+		raw = await fs.readFile(UNIFIED_SETTINGS_PATH, "utf8");
+	} catch (error) {
+		const code = (error as NodeJS.ErrnoException | undefined)?.code;
+		if (code === "ENOENT") {
+			return { record: null, revision: null };
+		}
+		throw error;
+	}
+	const revision = computeSha256(raw);
+	let parsed: JsonRecord | null;
+	try {
+		parsed = cloneRecord(JSON.parse(raw));
+	} catch {
+		return { record: null, revision };
+	}
+	if (!parsed) {
+		return { record: null, revision };
+	}
+	return { record: parsed, revision };
+}
+
 /**
  * Reads and parses the unified settings JSON file from disk.
  *
@@ -56,16 +216,7 @@ function cloneRecord(value: unknown): JsonRecord | null {
  * - Sensitive data: this function performs no token or secret redaction; any sensitive values present in the file are returned as-is and callers are responsible for redaction before logging or external exposure.
  */
 function readSettingsRecordSync(): JsonRecord | null {
-	if (!existsSync(UNIFIED_SETTINGS_PATH)) {
-		return null;
-	}
-
-	const raw = readFileSync(UNIFIED_SETTINGS_PATH, "utf8");
-	const parsed = cloneRecord(JSON.parse(raw));
-	if (!parsed) {
-		throw new Error("Unified settings must contain a JSON object at the root.");
-	}
-	return parsed;
+	return readSettingsSnapshotSync().record;
 }
 
 /**
@@ -76,16 +227,8 @@ function readSettingsRecordSync(): JsonRecord | null {
  * @returns The parsed settings record as an object clone, or `null` if unavailable or invalid.
  */
 async function readSettingsRecordAsync(): Promise<JsonRecord | null> {
-	if (!existsSync(UNIFIED_SETTINGS_PATH)) {
-		return null;
-	}
-
-	const raw = await fs.readFile(UNIFIED_SETTINGS_PATH, "utf8");
-	const parsed = cloneRecord(JSON.parse(raw));
-	if (!parsed) {
-		throw new Error("Unified settings must contain a JSON object at the root.");
-	}
-	return parsed;
+	const snapshot = await readSettingsSnapshotAsync();
+	return snapshot.record;
 }
 
 /**
@@ -120,17 +263,43 @@ function normalizeForWrite(record: JsonRecord): JsonRecord {
  *
  * @param record - The settings object to persist; it will be normalized to include the unified settings version.
  */
-function writeSettingsRecordSync(record: JsonRecord): void {
-	mkdirSync(getCodexMultiAuthDir(), { recursive: true });
+function writeSettingsRecordSync(
+	record: JsonRecord,
+	options?: { expectedRevision?: string | null },
+): void {
+	const expectedRevision = options?.expectedRevision;
+	if (expectedRevision !== undefined) {
+		const currentRevision = readCurrentSettingsRevisionSync();
+		if (currentRevision !== expectedRevision) {
+			throw createSettingsConflictError();
+		}
+	}
+
+	const settingsDir = getCodexMultiAuthDir();
+	mkdirSync(settingsDir, { recursive: true, mode: SECURE_DIR_MODE });
+	if (process.platform !== "win32") {
+		try {
+			chmodSync(settingsDir, SECURE_DIR_MODE);
+		} catch {
+			// Best-effort hardening.
+		}
+	}
 	const payload = normalizeForWrite(record);
 	const data = `${JSON.stringify(payload, null, 2)}\n`;
 	const tempPath = `${UNIFIED_SETTINGS_PATH}.${process.pid}.${Date.now()}.tmp`;
-	writeFileSync(tempPath, data, "utf8");
+	writeFileSync(tempPath, data, { encoding: "utf8", mode: SECURE_FILE_MODE });
 	let moved = false;
 	try {
 		for (let attempt = 0; attempt < 5; attempt += 1) {
 			try {
 				renameSync(tempPath, UNIFIED_SETTINGS_PATH);
+				if (process.platform !== "win32") {
+					try {
+						chmodSync(UNIFIED_SETTINGS_PATH, SECURE_FILE_MODE);
+					} catch {
+						// Best-effort hardening.
+					}
+				}
 				moved = true;
 				return;
 			} catch (error) {
@@ -171,17 +340,43 @@ function writeSettingsRecordSync(record: JsonRecord): void {
  *
  * @param record - The settings object to persist; it will be normalized (version set)
  */
-async function writeSettingsRecordAsync(record: JsonRecord): Promise<void> {
-	await fs.mkdir(getCodexMultiAuthDir(), { recursive: true });
+async function writeSettingsRecordAsync(
+	record: JsonRecord,
+	options?: { expectedRevision?: string | null },
+): Promise<void> {
+	const expectedRevision = options?.expectedRevision;
+	if (expectedRevision !== undefined) {
+		const currentRevision = await readCurrentSettingsRevisionAsync();
+		if (currentRevision !== expectedRevision) {
+			throw createSettingsConflictError();
+		}
+	}
+
+	const settingsDir = getCodexMultiAuthDir();
+	await fs.mkdir(settingsDir, { recursive: true, mode: SECURE_DIR_MODE });
+	if (process.platform !== "win32") {
+		try {
+			await fs.chmod(settingsDir, SECURE_DIR_MODE);
+		} catch {
+			// Best-effort hardening.
+		}
+	}
 	const payload = normalizeForWrite(record);
 	const data = `${JSON.stringify(payload, null, 2)}\n`;
 	const tempPath = `${UNIFIED_SETTINGS_PATH}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2, 8)}.tmp`;
-	await fs.writeFile(tempPath, data, "utf8");
+	await fs.writeFile(tempPath, data, { encoding: "utf8", mode: SECURE_FILE_MODE });
 	let moved = false;
 	try {
 		for (let attempt = 0; attempt < 5; attempt += 1) {
 			try {
 				await fs.rename(tempPath, UNIFIED_SETTINGS_PATH);
+				if (process.platform !== "win32") {
+					try {
+						await fs.chmod(UNIFIED_SETTINGS_PATH, SECURE_FILE_MODE);
+					} catch {
+						// Best-effort hardening.
+					}
+				}
 				moved = true;
 				return;
 			} catch (error) {
@@ -254,9 +449,27 @@ export function loadUnifiedPluginConfigSync(): JsonRecord | null {
  * @param pluginConfig - Key/value map representing plugin configuration to persist
  */
 export function saveUnifiedPluginConfigSync(pluginConfig: JsonRecord): void {
-	const record = readSettingsRecordSync() ?? {};
-	record.pluginConfig = { ...pluginConfig };
-	writeSettingsRecordSync(record);
+	const lock = acquireFileLockSync(UNIFIED_SETTINGS_LOCK_PATH, SETTINGS_LOCK_OPTIONS);
+	try {
+		let lastError: unknown;
+		for (let attempt = 0; attempt < SETTINGS_CONFLICT_RETRY_LIMIT; attempt += 1) {
+			const snapshot = readSettingsSnapshotSync();
+			const record = snapshot.record ?? {};
+			record.pluginConfig = { ...pluginConfig };
+			try {
+				writeSettingsRecordSync(record, { expectedRevision: snapshot.revision });
+				return;
+			} catch (error) {
+				lastError = error;
+				if (!isConflictError(error) || attempt >= SETTINGS_CONFLICT_RETRY_LIMIT - 1) {
+					throw error;
+				}
+			}
+		}
+		throw lastError instanceof Error ? lastError : new Error("Failed to save unified plugin config");
+	} finally {
+		releaseUnifiedSettingsLockSync(() => lock.release());
+	}
 }
 
 /**
@@ -271,9 +484,27 @@ export function saveUnifiedPluginConfigSync(pluginConfig: JsonRecord): void {
  */
 export async function saveUnifiedPluginConfig(pluginConfig: JsonRecord): Promise<void> {
 	await enqueueSettingsWrite(async () => {
-		const record = await readSettingsRecordAsync() ?? {};
-		record.pluginConfig = { ...pluginConfig };
-		await writeSettingsRecordAsync(record);
+		const lock = await acquireFileLock(UNIFIED_SETTINGS_LOCK_PATH, SETTINGS_LOCK_OPTIONS);
+		try {
+			let lastError: unknown;
+			for (let attempt = 0; attempt < SETTINGS_CONFLICT_RETRY_LIMIT; attempt += 1) {
+				const snapshot = await readSettingsSnapshotAsync();
+				const record = snapshot.record ?? {};
+				record.pluginConfig = { ...pluginConfig };
+				try {
+					await writeSettingsRecordAsync(record, { expectedRevision: snapshot.revision });
+					return;
+				} catch (error) {
+					lastError = error;
+					if (!isConflictError(error) || attempt >= SETTINGS_CONFLICT_RETRY_LIMIT - 1) {
+						throw error;
+					}
+				}
+			}
+			throw lastError instanceof Error ? lastError : new Error("Failed to save unified plugin config");
+		} finally {
+			await releaseUnifiedSettingsLockAsync(() => lock.release());
+		}
 	});
 }
 
@@ -314,8 +545,26 @@ export async function saveUnifiedDashboardSettings(
 	dashboardDisplaySettings: JsonRecord,
 ): Promise<void> {
 	await enqueueSettingsWrite(async () => {
-		const record = await readSettingsRecordAsync() ?? {};
-		record.dashboardDisplaySettings = { ...dashboardDisplaySettings };
-		await writeSettingsRecordAsync(record);
+		const lock = await acquireFileLock(UNIFIED_SETTINGS_LOCK_PATH, SETTINGS_LOCK_OPTIONS);
+		try {
+			let lastError: unknown;
+			for (let attempt = 0; attempt < SETTINGS_CONFLICT_RETRY_LIMIT; attempt += 1) {
+				const snapshot = await readSettingsSnapshotAsync();
+				const record = snapshot.record ?? {};
+				record.dashboardDisplaySettings = { ...dashboardDisplaySettings };
+				try {
+					await writeSettingsRecordAsync(record, { expectedRevision: snapshot.revision });
+					return;
+				} catch (error) {
+					lastError = error;
+					if (!isConflictError(error) || attempt >= SETTINGS_CONFLICT_RETRY_LIMIT - 1) {
+						throw error;
+					}
+				}
+			}
+			throw lastError instanceof Error ? lastError : new Error("Failed to save unified dashboard settings");
+		} finally {
+			await releaseUnifiedSettingsLockAsync(() => lock.release());
+		}
 	});
 }
diff --git a/lib/utils.ts b/lib/utils.ts
index 81e27cdde..610f0c7f1 100644
--- a/lib/utils.ts
+++ b/lib/utils.ts
@@ -65,3 +65,48 @@ export function toStringValue(value: unknown): string {
 export function sleep(ms: number): Promise<void> {
 	return new Promise((resolve) => setTimeout(resolve, ms));
 }
+
+/**
+ * Run fetch with a hard timeout while preserving caller abort signals.
+ * @param input - fetch input
+ * @param init - fetch init
+ * @param timeoutMs - timeout in milliseconds
+ * @returns fetch response
+ */
+export async function fetchWithTimeout(
+	input: Parameters<typeof fetch>[0],
+	init: Parameters<typeof fetch>[1] = {},
+	timeoutMs = 60_000,
+): Promise<Response> {
+	const timeout = Math.max(1_000, Math.floor(timeoutMs));
+	const controller = new AbortController();
+	const userSignal = init.signal;
+	const timeoutError = new Error(`Fetch timeout after ${timeout}ms`) as Error & { code?: string };
+	timeoutError.name = "AbortError";
+	timeoutError.code = "ABORT_ERR";
+	const timeoutId = setTimeout(() => {
+		controller.abort(timeoutError);
+	}, timeout);
+
+	const onAbort = () => {
+		controller.abort(userSignal?.reason ?? new Error("Aborted"));
+	};
+
+	if (userSignal?.aborted) {
+		onAbort();
+	} else if (userSignal) {
+		userSignal.addEventListener("abort", onAbort, { once: true });
+	}
+
+	try {
+		return await fetch(input, {
+			...init,
+			signal: controller.signal,
+		});
+	} finally {
+		clearTimeout(timeoutId);
+		if (userSignal) {
+			userSignal.removeEventListener("abort", onAbort);
+		}
+	}
+}
diff --git a/package-lock.json b/package-lock.json
index 93ee2ca5e..0b218c514 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -22,7 +22,9 @@
         "codex-multi-auth": "scripts/codex-multi-auth.js"
       },
       "devDependencies": {
+        "@biomejs/biome": "^2.4.2",
         "@codex-ai/sdk": "file:vendor/codex-ai-sdk",
+        "@cyclonedx/cyclonedx-npm": "4.2.0",
         "@fast-check/vitest": "^0.2.4",
         "@types/node": "^25.3.0",
         "@typescript-eslint/eslint-plugin": "^8.56.0",
@@ -40,14 +42,15 @@
       "engines": {
         "node": ">=18.0.0"
       },
+      "optionalDependencies": {
+        "keytar": "^7.9.0"
+      },
       "peerDependencies": {
         "typescript": "^5"
       }
     },
     "node_modules/@babel/helper-string-parser": {
       "version": "7.27.1",
-      "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.27.1.tgz",
-      "integrity": "sha512-qMlSxKbpRlAridDExk92nSobyDdpPijUq2DW6oDnUqd0iOGxmQjyqhMIihI9+zv4LPyZdRje2cavWPbCbWm3eA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -56,8 +59,6 @@
     },
     "node_modules/@babel/helper-validator-identifier": {
       "version": "7.28.5",
-      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.28.5.tgz",
-      "integrity": "sha512-qSs4ifwzKJSV39ucNjsvc6WVHs6b7S03sOh2OcHF9UHfVPqWWALUsNUVzhSBiItjRZoLHx7nIarVjqKVusUZ1Q==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -66,8 +67,6 @@
     },
     "node_modules/@babel/parser": {
       "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.28.6.tgz",
-      "integrity": "sha512-TeR9zWR18BvbfPmGbLampPMW+uW1NZnJlRuuHso8i87QZNq2JRF9i6RgxRqtEq+wQGsS19NNTWr2duhnE49mfQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -82,8 +81,6 @@
     },
     "node_modules/@babel/types": {
       "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.28.6.tgz",
-      "integrity": "sha512-0ZrskXVEHSWIqZM/sQZ4EV3jZJXRkio/WCxaqKZP1g//CEWEPSfeZFcms4XeKBCHU0ZKnIkdJeU/kF+eRp5lBg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -96,14 +93,183 @@
     },
     "node_modules/@bcoe/v8-coverage": {
       "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/@bcoe/v8-coverage/-/v8-coverage-1.0.2.tgz",
-      "integrity": "sha512-6zABk/ECA/QYSCQ1NGiVwwbQerUCZ+TQbp64Q3AgmfNvurHH0j8TtXa1qbShXA6qqkpAj4V5W8pP6mLe1mcMqA==",
       "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=18"
       }
     },
+    "node_modules/@biomejs/biome": {
+      "version": "2.4.5",
+      "dev": true,
+      "license": "MIT OR Apache-2.0",
+      "bin": {
+        "biome": "bin/biome"
+      },
+      "engines": {
+        "node": ">=14.21.3"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/biome"
+      },
+      "optionalDependencies": {
+        "@biomejs/cli-darwin-arm64": "2.4.5",
+        "@biomejs/cli-darwin-x64": "2.4.5",
+        "@biomejs/cli-linux-arm64": "2.4.5",
+        "@biomejs/cli-linux-arm64-musl": "2.4.5",
+        "@biomejs/cli-linux-x64": "2.4.5",
+        "@biomejs/cli-linux-x64-musl": "2.4.5",
+        "@biomejs/cli-win32-arm64": "2.4.5",
+        "@biomejs/cli-win32-x64": "2.4.5"
+      }
+    },
+    "node_modules/@biomejs/cli-darwin-arm64": {
+      "version": "2.4.5",
+      "resolved": "https://registry.npmjs.org/@biomejs/cli-darwin-arm64/-/cli-darwin-arm64-2.4.5.tgz",
+      "integrity": "sha512-lGS4Nd5O3KQJ6TeWv10mElnx1phERhBxqGP/IKq0SvZl78kcWDFMaTtVK+w3v3lusRFxJY78n07PbKplirsU5g==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT OR Apache-2.0",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=14.21.3"
+      }
+    },
+    "node_modules/@biomejs/cli-darwin-x64": {
+      "version": "2.4.5",
+      "resolved": "https://registry.npmjs.org/@biomejs/cli-darwin-x64/-/cli-darwin-x64-2.4.5.tgz",
+      "integrity": "sha512-6MoH4tyISIBNkZ2Q5T1R7dLd5BsITb2yhhhrU9jHZxnNSNMWl+s2Mxu7NBF8Y3a7JJcqq9nsk8i637z4gqkJxQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT OR Apache-2.0",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=14.21.3"
+      }
+    },
+    "node_modules/@biomejs/cli-linux-arm64": {
+      "version": "2.4.5",
+      "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-arm64/-/cli-linux-arm64-2.4.5.tgz",
+      "integrity": "sha512-U1GAG6FTjhAO04MyH4xn23wRNBkT6H7NentHh+8UxD6ShXKBm5SY4RedKJzkUThANxb9rUKIPc7B8ew9Xo/cWg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT OR Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=14.21.3"
+      }
+    },
+    "node_modules/@biomejs/cli-linux-arm64-musl": {
+      "version": "2.4.5",
+      "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-arm64-musl/-/cli-linux-arm64-musl-2.4.5.tgz",
+      "integrity": "sha512-iqLDgpzobG7gpBF0fwEVS/LT8kmN7+S0E2YKFDtqliJfzNLnAiV2Nnyb+ehCDCJgAZBASkYHR2o60VQWikpqIg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT OR Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=14.21.3"
+      }
+    },
+    "node_modules/@biomejs/cli-linux-x64": {
+      "version": "2.4.5",
+      "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-x64/-/cli-linux-x64-2.4.5.tgz",
+      "integrity": "sha512-NdODlSugMzTlENPTa4z0xB82dTUlCpsrOxc43///aNkTLblIYH4XpYflBbf5ySlQuP8AA4AZd1qXhV07IdrHdQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT OR Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=14.21.3"
+      }
+    },
+    "node_modules/@biomejs/cli-linux-x64-musl": {
+      "version": "2.4.5",
+      "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-x64-musl/-/cli-linux-x64-musl-2.4.5.tgz",
+      "integrity": "sha512-NlKa7GpbQmNhZf9kakQeddqZyT7itN7jjWdakELeXyTU3pg/83fTysRRDPJD0akTfKDl6vZYNT9Zqn4MYZVBOA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT OR Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=14.21.3"
+      }
+    },
+    "node_modules/@biomejs/cli-win32-arm64": {
+      "version": "2.4.5",
+      "resolved": "https://registry.npmjs.org/@biomejs/cli-win32-arm64/-/cli-win32-arm64-2.4.5.tgz",
+      "integrity": "sha512-EBfrTqRIWOFSd7CQb/0ttjHMR88zm3hGravnDwUA9wHAaCAYsULKDebWcN5RmrEo1KBtl/gDVJMrFjNR0pdGUw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT OR Apache-2.0",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=14.21.3"
+      }
+    },
+    "node_modules/@biomejs/cli-win32-x64": {
+      "version": "2.4.5",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT OR Apache-2.0",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=14.21.3"
+      }
+    },
     "node_modules/@codex-ai/plugin": {
       "resolved": "vendor/codex-ai-plugin",
       "link": true
@@ -112,6 +278,114 @@
       "resolved": "vendor/codex-ai-sdk",
       "link": true
     },
+    "node_modules/@cyclonedx/cyclonedx-npm": {
+      "version": "4.2.0",
+      "resolved": "https://registry.npmjs.org/@cyclonedx/cyclonedx-npm/-/cyclonedx-npm-4.2.0.tgz",
+      "integrity": "sha512-TDGb85XzPMagN8WxIGgn24sCMdgQ51UdhwvaGmAIje/3P78+vyf2s9pAU0KMSDBVz3JQ66OpHaIDpR+dpRS1Ww==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "individual",
+          "url": "https://owasp.org/donate/?reponame=www-project-cyclonedx&title=OWASP+CycloneDX"
+        }
+      ],
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@cyclonedx/cyclonedx-library": "^10.0.0",
+        "commander": "^14.0.0",
+        "normalize-package-data": "^7.0.0 || ^8.0.0",
+        "packageurl-js": "^2.0.1",
+        "spdx-expression-parse": "^3.0.1 || ^4.0.0",
+        "xmlbuilder2": "^3.0.2 || ^4.0.3"
+      },
+      "bin": {
+        "cyclonedx-npm": "bin/cyclonedx-npm-cli.js"
+      },
+      "engines": {
+        "node": ">=20.18.0",
+        "npm": ">=9"
+      },
+      "optionalDependencies": {
+        "ajv": "^8.12.0",
+        "ajv-formats": "^3.0.1",
+        "ajv-formats-draft2019": "^1.6.1",
+        "libxmljs2": "^0.35||^0.37"
+      }
+    },
+    "node_modules/@cyclonedx/cyclonedx-npm/node_modules/@cyclonedx/cyclonedx-library": {
+      "version": "10.0.0",
+      "resolved": "https://registry.npmjs.org/@cyclonedx/cyclonedx-library/-/cyclonedx-library-10.0.0.tgz",
+      "integrity": "sha512-xDXf2eqzeFHdjamj6oBV3duRSfrlmsJ5+2z9tXp7q5qxJP5Awmjf4ABSutS4qkVHHj7JzKFL/EM0V0Nihc7zPg==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "individual",
+          "url": "https://owasp.org/donate/?reponame=www-project-cyclonedx&title=OWASP+CycloneDX"
+        }
+      ],
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=20.18.0"
+      },
+      "peerDependencies": {
+        "ajv": "^8.12.0",
+        "ajv-formats": "^3.0.1",
+        "ajv-formats-draft2019": "^1.6.1",
+        "libxmljs2": "^0.35||^0.37",
+        "packageurl-js": "*",
+        "spdx-expression-parse": "*",
+        "xmlbuilder2": "^3.0.2||^4.0.0"
+      },
+      "peerDependenciesMeta": {
+        "ajv": {
+          "optional": true
+        },
+        "ajv-formats": {
+          "optional": true
+        },
+        "ajv-formats-draft2019": {
+          "optional": true
+        },
+        "libxmljs2": {
+          "optional": true
+        },
+        "packageurl-js": {
+          "optional": true
+        },
+        "spdx-expression-parse": {
+          "optional": true
+        },
+        "xmlbuilder2": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@cyclonedx/cyclonedx-npm/node_modules/ajv": {
+      "version": "8.18.0",
+      "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.18.0.tgz",
+      "integrity": "sha512-PlXPeEWMXMZ7sPYOHqmDyCJzcfNrUr3fGNKtezX14ykXOEIvyK81d+qydx89KY5O71FKMPaQ2vBfBFI5NHR63A==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "fast-deep-equal": "^3.1.3",
+        "fast-uri": "^3.0.1",
+        "json-schema-traverse": "^1.0.0",
+        "require-from-string": "^2.0.2"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/epoberezkin"
+      }
+    },
+    "node_modules/@cyclonedx/cyclonedx-npm/node_modules/json-schema-traverse": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz",
+      "integrity": "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true
+    },
     "node_modules/@esbuild/aix-ppc64": {
       "version": "0.27.2",
       "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.27.2.tgz",
@@ -539,8 +813,6 @@
     },
     "node_modules/@esbuild/win32-x64": {
       "version": "0.27.2",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.27.2.tgz",
-      "integrity": "sha512-sRdU18mcKf7F+YgheI/zGf5alZatMUTKj/jNS6l744f9u3WFu4v7twcUI9vu4mknF4Y9aDlblIie0IM+5xxaqQ==",
       "cpu": [
         "x64"
       ],
@@ -556,8 +828,6 @@
     },
     "node_modules/@eslint-community/eslint-utils": {
       "version": "4.9.1",
-      "resolved": "https://registry.npmjs.org/@eslint-community/eslint-utils/-/eslint-utils-4.9.1.tgz",
-      "integrity": "sha512-phrYmNiYppR7znFEdqgfWHXR6NCkZEK7hwWDHZUjit/2/U0r6XvkDl0SYnoM51Hq7FhCGdLDT6zxCCOY1hexsQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -575,8 +845,6 @@
     },
     "node_modules/@eslint-community/regexpp": {
       "version": "4.12.2",
-      "resolved": "https://registry.npmjs.org/@eslint-community/regexpp/-/regexpp-4.12.2.tgz",
-      "integrity": "sha512-EriSTlt5OC9/7SXkRSCAhfSxxoSUgBm33OH+IkwbdpgoqsSsUg7y3uh+IICI/Qg4BBWr3U2i39RpmycbxMq4ew==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -585,8 +853,6 @@
     },
     "node_modules/@eslint/config-array": {
       "version": "0.23.1",
-      "resolved": "https://registry.npmjs.org/@eslint/config-array/-/config-array-0.23.1.tgz",
-      "integrity": "sha512-uVSdg/V4dfQmTjJzR0szNczjOH/J+FyUMMjYtr07xFRXR7EDf9i1qdxrD0VusZH9knj1/ecxzCQQxyic5NzAiA==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -600,8 +866,6 @@
     },
     "node_modules/@eslint/config-helpers": {
       "version": "0.5.2",
-      "resolved": "https://registry.npmjs.org/@eslint/config-helpers/-/config-helpers-0.5.2.tgz",
-      "integrity": "sha512-a5MxrdDXEvqnIq+LisyCX6tQMPF/dSJpCfBgBauY+pNZ28yCtSsTvyTYrMhaI+LK26bVyCJfJkT0u8KIj2i1dQ==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -613,8 +877,6 @@
     },
     "node_modules/@eslint/core": {
       "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/@eslint/core/-/core-1.1.0.tgz",
-      "integrity": "sha512-/nr9K9wkr3P1EzFTdFdMoLuo1PmIxjmwvPozwoSodjNBdefGujXQUF93u1DDZpEaTuDvMsIQddsd35BwtrW9Xw==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -626,8 +888,6 @@
     },
     "node_modules/@eslint/object-schema": {
       "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/@eslint/object-schema/-/object-schema-3.0.1.tgz",
-      "integrity": "sha512-P9cq2dpr+LU8j3qbLygLcSZrl2/ds/pUpfnHNNuk5HW7mnngHs+6WSq5C9mO3rqRX8A1poxqLTC9cu0KOyJlBg==",
       "dev": true,
       "license": "Apache-2.0",
       "engines": {
@@ -636,8 +896,6 @@
     },
     "node_modules/@eslint/plugin-kit": {
       "version": "0.6.0",
-      "resolved": "https://registry.npmjs.org/@eslint/plugin-kit/-/plugin-kit-0.6.0.tgz",
-      "integrity": "sha512-bIZEUzOI1jkhviX2cp5vNyXQc6olzb2ohewQubuYlMXZ2Q/XjBO0x0XhGPvc9fjSIiUN0vw+0hq53BJ4eQSJKQ==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -650,8 +908,6 @@
     },
     "node_modules/@fast-check/vitest": {
       "version": "0.2.4",
-      "resolved": "https://registry.npmjs.org/@fast-check/vitest/-/vitest-0.2.4.tgz",
-      "integrity": "sha512-Ilcr+JAIPhb1s6FRm4qoglQYSGXXrS+zAupZeNuWAA3qHVGDA1d1Gb84Hb/+otL3GzVZjFJESg5/1SfIvrgssA==",
       "dev": true,
       "funding": [
         {
@@ -673,8 +929,6 @@
     },
     "node_modules/@humanfs/core": {
       "version": "0.19.1",
-      "resolved": "https://registry.npmjs.org/@humanfs/core/-/core-0.19.1.tgz",
-      "integrity": "sha512-5DyQ4+1JEUzejeK1JGICcideyfUbGixgS9jNgex5nqkW+cY7WZhxBigmieN5Qnw9ZosSNVC9KQKyb+GUaGyKUA==",
       "dev": true,
       "license": "Apache-2.0",
       "engines": {
@@ -683,8 +937,6 @@
     },
     "node_modules/@humanfs/node": {
       "version": "0.16.7",
-      "resolved": "https://registry.npmjs.org/@humanfs/node/-/node-0.16.7.tgz",
-      "integrity": "sha512-/zUx+yOsIrG4Y43Eh2peDeKCxlRt/gET6aHfaKpuq267qXdYDFViVHfMaLyygZOnl0kGWxFIgsBy8QFuTLUXEQ==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -697,8 +949,6 @@
     },
     "node_modules/@humanwhocodes/module-importer": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/@humanwhocodes/module-importer/-/module-importer-1.0.1.tgz",
-      "integrity": "sha512-bxveV4V8v5Yb4ncFTT3rPSgZBOpCkjfK0y4oVVVJwIuDVBRMDXrPyXRL988i5ap9m9bnyEEjWfm5WkBmtffLfA==",
       "dev": true,
       "license": "Apache-2.0",
       "engines": {
@@ -711,8 +961,6 @@
     },
     "node_modules/@humanwhocodes/retry": {
       "version": "0.4.3",
-      "resolved": "https://registry.npmjs.org/@humanwhocodes/retry/-/retry-0.4.3.tgz",
-      "integrity": "sha512-bV0Tgo9K4hfPCek+aMAn81RppFKv2ySDQeMoSZuvTASywNTnVJCArCZE2FWqpvIatKu7VMRLWlR1EazvVhDyhQ==",
       "dev": true,
       "license": "Apache-2.0",
       "engines": {
@@ -723,10 +971,101 @@
         "url": "https://github.com/sponsors/nzakas"
       }
     },
+    "node_modules/@isaacs/cliui": {
+      "version": "8.0.2",
+      "resolved": "https://registry.npmjs.org/@isaacs/cliui/-/cliui-8.0.2.tgz",
+      "integrity": "sha512-O8jcjabXaleOG9DQ0+ARXWZBTfnP4WNAqzuiJK7ll44AmxGKv/J2M4TPjxjY3znBCfvBXFzucm1twdyFybFqEA==",
+      "dev": true,
+      "license": "ISC",
+      "optional": true,
+      "dependencies": {
+        "string-width": "^5.1.2",
+        "string-width-cjs": "npm:string-width@^4.2.0",
+        "strip-ansi": "^7.0.1",
+        "strip-ansi-cjs": "npm:strip-ansi@^6.0.1",
+        "wrap-ansi": "^8.1.0",
+        "wrap-ansi-cjs": "npm:wrap-ansi@^7.0.0"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/@isaacs/cliui/node_modules/ansi-styles": {
+      "version": "6.2.3",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-6.2.3.tgz",
+      "integrity": "sha512-4Dj6M28JB+oAH8kFkTLUo+a2jwOFkuqb3yucU0CANcRRUbxS0cP0nZYCGjcc3BNXwRIsUVmDGgzawme7zvJHvg==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/@isaacs/cliui/node_modules/emoji-regex": {
+      "version": "9.2.2",
+      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-9.2.2.tgz",
+      "integrity": "sha512-L18DaJsXSUk2+42pv8mLs5jJT2hqFkFE4j21wOmgbUqsZ2hL72NsUU785g9RXgo3s0ZNgVl42TiHp3ZtOv/Vyg==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true
+    },
+    "node_modules/@isaacs/cliui/node_modules/string-width": {
+      "version": "5.1.2",
+      "resolved": "https://registry.npmjs.org/string-width/-/string-width-5.1.2.tgz",
+      "integrity": "sha512-HnLOCR3vjcY8beoNLtcjZ5/nxn2afmME6lhrDrebokqMap+XbeW8n9TXpPDOqdGK5qcI3oT0GKTW6wC7EMiVqA==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "eastasianwidth": "^0.2.0",
+        "emoji-regex": "^9.2.2",
+        "strip-ansi": "^7.0.1"
+      },
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/@isaacs/cliui/node_modules/wrap-ansi": {
+      "version": "8.1.0",
+      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-8.1.0.tgz",
+      "integrity": "sha512-si7QWI6zUMq56bESFvagtmzMdGOtoxfR+Sez11Mobfc7tm+VkUckk9bW2UeffTGVUbOksxmSw0AA2gs8g71NCQ==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "ansi-styles": "^6.1.0",
+        "string-width": "^5.0.1",
+        "strip-ansi": "^7.0.1"
+      },
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/wrap-ansi?sponsor=1"
+      }
+    },
+    "node_modules/@isaacs/fs-minipass": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/@isaacs/fs-minipass/-/fs-minipass-4.0.1.tgz",
+      "integrity": "sha512-wgm9Ehl2jpeqP3zw/7mo3kRHFp5MEDhqAdwy1fTGkHAwnkGOVsgpvQhL8B5n1qlb01jV3n/bI0ZfZp5lWA1k4w==",
+      "dev": true,
+      "license": "ISC",
+      "optional": true,
+      "dependencies": {
+        "minipass": "^7.0.4"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
     "node_modules/@jridgewell/resolve-uri": {
       "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/@jridgewell/resolve-uri/-/resolve-uri-3.1.2.tgz",
-      "integrity": "sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -735,15 +1074,11 @@
     },
     "node_modules/@jridgewell/sourcemap-codec": {
       "version": "1.5.5",
-      "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.5.5.tgz",
-      "integrity": "sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@jridgewell/trace-mapping": {
       "version": "0.3.31",
-      "resolved": "https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.31.tgz",
-      "integrity": "sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -751,41 +1086,117 @@
         "@jridgewell/sourcemap-codec": "^1.4.14"
       }
     },
-    "node_modules/@openauthjs/openauth": {
-      "version": "0.4.3",
-      "resolved": "https://registry.npmjs.org/@openauthjs/openauth/-/openauth-0.4.3.tgz",
-      "integrity": "sha512-RlnjqvHzqcbFVymEwhlUEuac4utA5h4nhSK/i2szZuQmxTIqbGUxZ+nM+avM+VV4Ing+/ZaNLKILoXS3yrkOOw==",
+    "node_modules/@npmcli/agent": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/@npmcli/agent/-/agent-3.0.0.tgz",
+      "integrity": "sha512-S79NdEgDQd/NGCay6TCoVzXSj74skRZIKJcpJjC5lOq34SZzyI6MqtiiWoiVWoVrTcGjNeC4ipbh1VIHlpfF5Q==",
+      "dev": true,
+      "license": "ISC",
+      "optional": true,
       "dependencies": {
-        "@standard-schema/spec": "1.0.0-beta.3",
-        "aws4fetch": "1.0.20",
-        "jose": "5.9.6"
+        "agent-base": "^7.1.0",
+        "http-proxy-agent": "^7.0.0",
+        "https-proxy-agent": "^7.0.1",
+        "lru-cache": "^10.0.1",
+        "socks-proxy-agent": "^8.0.3"
       },
-      "peerDependencies": {
-        "arctic": "^2.2.2",
-        "hono": "^4.0.0"
+      "engines": {
+        "node": "^18.17.0 || >=20.5.0"
       }
     },
-    "node_modules/@oslojs/asn1": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/@oslojs/asn1/-/asn1-1.0.0.tgz",
-      "integrity": "sha512-zw/wn0sj0j0QKbIXfIlnEcTviaCzYOY3V5rAyjR6YtOByFtJiT574+8p9Wlach0lZH9fddD4yb9laEAIl4vXQA==",
-      "license": "MIT",
-      "peer": true,
+    "node_modules/@npmcli/fs": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/@npmcli/fs/-/fs-4.0.0.tgz",
+      "integrity": "sha512-/xGlezI6xfGO9NwuJlnwz/K14qD1kCSAGtacBHnGzeAIuJGazcp45KP5NuyARXoKb7cwulAGWVsbeSxdG/cb0Q==",
+      "dev": true,
+      "license": "ISC",
+      "optional": true,
       "dependencies": {
-        "@oslojs/binary": "1.0.0"
+        "semver": "^7.3.5"
+      },
+      "engines": {
+        "node": "^18.17.0 || >=20.5.0"
       }
     },
-    "node_modules/@oslojs/binary": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/@oslojs/binary/-/binary-1.0.0.tgz",
-      "integrity": "sha512-9RCU6OwXU6p67H4NODbuxv2S3eenuQ4/WFLrsq+K/k682xrznH5EVWA7N4VFk9VYVcbFtKqur5YQQZc0ySGhsQ==",
+    "node_modules/@oozcitak/dom": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/@oozcitak/dom/-/dom-2.0.2.tgz",
+      "integrity": "sha512-GjpKhkSYC3Mj4+lfwEyI1dqnsKTgwGy48ytZEhm4A/xnH/8z9M3ZVXKr/YGQi3uCLs1AEBS+x5T2JPiueEDW8w==",
+      "dev": true,
       "license": "MIT",
-      "peer": true
+      "dependencies": {
+        "@oozcitak/infra": "^2.0.2",
+        "@oozcitak/url": "^3.0.0",
+        "@oozcitak/util": "^10.0.0"
+      },
+      "engines": {
+        "node": ">=20.0"
+      }
+    },
+    "node_modules/@oozcitak/infra": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/@oozcitak/infra/-/infra-2.0.2.tgz",
+      "integrity": "sha512-2g+E7hoE2dgCz/APPOEK5s3rMhJvNxSMBrP+U+j1OWsIbtSpWxxlUjq1lU8RIsFJNYv7NMlnVsCuHcUzJW+8vA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@oozcitak/util": "^10.0.0"
+      },
+      "engines": {
+        "node": ">=20.0"
+      }
+    },
+    "node_modules/@oozcitak/url": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/@oozcitak/url/-/url-3.0.0.tgz",
+      "integrity": "sha512-ZKfET8Ak1wsLAiLWNfFkZc/BraDccuTJKR6svTYc7sVjbR+Iu0vtXdiDMY4o6jaFl5TW2TlS7jbLl4VovtAJWQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@oozcitak/infra": "^2.0.2",
+        "@oozcitak/util": "^10.0.0"
+      },
+      "engines": {
+        "node": ">=20.0"
+      }
+    },
+    "node_modules/@oozcitak/util": {
+      "version": "10.0.0",
+      "resolved": "https://registry.npmjs.org/@oozcitak/util/-/util-10.0.0.tgz",
+      "integrity": "sha512-hAX0pT/73190NLqBPPWSdBVGtbY6VOhWYK3qqHqtXQ1gK7kS2yz4+ivsN07hpJ6I3aeMtKP6J6npsEKOAzuTLA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=20.0"
+      }
+    },
+    "node_modules/@openauthjs/openauth": {
+      "version": "0.4.3",
+      "dependencies": {
+        "@standard-schema/spec": "1.0.0-beta.3",
+        "aws4fetch": "1.0.20",
+        "jose": "5.9.6"
+      },
+      "peerDependencies": {
+        "arctic": "^2.2.2",
+        "hono": "^4.0.0"
+      }
+    },
+    "node_modules/@oslojs/asn1": {
+      "version": "1.0.0",
+      "license": "MIT",
+      "peer": true,
+      "dependencies": {
+        "@oslojs/binary": "1.0.0"
+      }
+    },
+    "node_modules/@oslojs/binary": {
+      "version": "1.0.0",
+      "license": "MIT",
+      "peer": true
     },
     "node_modules/@oslojs/crypto": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/@oslojs/crypto/-/crypto-1.0.1.tgz",
-      "integrity": "sha512-7n08G8nWjAr/Yu3vu9zzrd0L9XnrJfpMioQcvCMxBIiF5orECHe5/3J0jmXRVvgfqMm/+4oxlQ+Sq39COYLcNQ==",
       "license": "MIT",
       "peer": true,
       "dependencies": {
@@ -795,15 +1206,11 @@
     },
     "node_modules/@oslojs/encoding": {
       "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/@oslojs/encoding/-/encoding-1.1.0.tgz",
-      "integrity": "sha512-70wQhgYmndg4GCPxPPxPGevRKqTIJ2Nh4OkiMWmDAVYsTQ+Ta7Sq+rPevXyXGdzr30/qZBnyOalCszoMxlyldQ==",
       "license": "MIT",
       "peer": true
     },
     "node_modules/@oslojs/jwt": {
       "version": "0.2.0",
-      "resolved": "https://registry.npmjs.org/@oslojs/jwt/-/jwt-0.2.0.tgz",
-      "integrity": "sha512-bLE7BtHrURedCn4Mco3ma9L4Y1GR2SMBuIvjWr7rmQ4/W/4Jy70TIAgZ+0nIlk0xHz1vNP8x8DCns45Sb2XRbg==",
       "license": "MIT",
       "peer": true,
       "dependencies": {
@@ -812,15 +1219,22 @@
     },
     "node_modules/@oslojs/jwt/node_modules/@oslojs/encoding": {
       "version": "0.4.1",
-      "resolved": "https://registry.npmjs.org/@oslojs/encoding/-/encoding-0.4.1.tgz",
-      "integrity": "sha512-hkjo6MuIK/kQR5CrGNdAPZhS01ZCXuWDRJ187zh6qqF2+yMHZpD9fAYpX8q2bOO6Ryhl3XpCT6kUX76N8hhm4Q==",
       "license": "MIT",
       "peer": true
     },
+    "node_modules/@pkgjs/parseargs": {
+      "version": "0.11.0",
+      "resolved": "https://registry.npmjs.org/@pkgjs/parseargs/-/parseargs-0.11.0.tgz",
+      "integrity": "sha512-+1VkjdD0QBLPodGrJUeqarH8VAIvQODIbwh9XpP5Syisf7YoQgsJKPNFoqqLQlu+VQ/tVSshMR6loPMn8U+dPg==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "engines": {
+        "node": ">=14"
+      }
+    },
     "node_modules/@polka/url": {
       "version": "1.0.0-next.29",
-      "resolved": "https://registry.npmjs.org/@polka/url/-/url-1.0.0-next.29.tgz",
-      "integrity": "sha512-wwQAWhWSuHaag8c4q/KN/vCoeOJYshAIvMQwD4GpSb3OiZklFfvAgmj0VCBBImRpuF/aFgIRzllXlVX93Jevww==",
       "dev": true,
       "license": "MIT"
     },
@@ -916,6 +1330,9 @@
         "arm"
       ],
       "dev": true,
+      "libc": [
+        "glibc"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -930,6 +1347,9 @@
         "arm"
       ],
       "dev": true,
+      "libc": [
+        "musl"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -944,6 +1364,9 @@
         "arm64"
       ],
       "dev": true,
+      "libc": [
+        "glibc"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -958,6 +1381,9 @@
         "arm64"
       ],
       "dev": true,
+      "libc": [
+        "musl"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -972,6 +1398,9 @@
         "loong64"
       ],
       "dev": true,
+      "libc": [
+        "glibc"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -986,6 +1415,9 @@
         "loong64"
       ],
       "dev": true,
+      "libc": [
+        "musl"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1000,6 +1432,9 @@
         "ppc64"
       ],
       "dev": true,
+      "libc": [
+        "glibc"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1014,6 +1449,9 @@
         "ppc64"
       ],
       "dev": true,
+      "libc": [
+        "musl"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1028,6 +1466,9 @@
         "riscv64"
       ],
       "dev": true,
+      "libc": [
+        "glibc"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1042,6 +1483,9 @@
         "riscv64"
       ],
       "dev": true,
+      "libc": [
+        "musl"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1056,6 +1500,9 @@
         "s390x"
       ],
       "dev": true,
+      "libc": [
+        "glibc"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1070,6 +1517,9 @@
         "x64"
       ],
       "dev": true,
+      "libc": [
+        "glibc"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1084,6 +1534,9 @@
         "x64"
       ],
       "dev": true,
+      "libc": [
+        "musl"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1148,8 +1601,6 @@
     },
     "node_modules/@rollup/rollup-win32-x64-gnu": {
       "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-gnu/-/rollup-win32-x64-gnu-4.59.0.tgz",
-      "integrity": "sha512-laBkYlSS1n2L8fSo1thDNGrCTQMmxjYY5G0WFWjFFYZkKPjsMBsgJfGf4TLxXrF6RyhI60L8TMOjBMvXiTcxeA==",
       "cpu": [
         "x64"
       ],
@@ -1162,8 +1613,6 @@
     },
     "node_modules/@rollup/rollup-win32-x64-msvc": {
       "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-msvc/-/rollup-win32-x64-msvc-4.59.0.tgz",
-      "integrity": "sha512-2HRCml6OztYXyJXAvdDXPKcawukWY2GpR5/nxKp4iBgiO3wcoEGkAaqctIbZcNB6KlUQBIqt8VYkNSj2397EfA==",
       "cpu": [
         "x64"
       ],
@@ -1176,14 +1625,10 @@
     },
     "node_modules/@standard-schema/spec": {
       "version": "1.0.0-beta.3",
-      "resolved": "https://registry.npmjs.org/@standard-schema/spec/-/spec-1.0.0-beta.3.tgz",
-      "integrity": "sha512-0ifF3BjA1E8SY9C+nUew8RefNOIq0cDlYALPty4rhUm8Rrl6tCM8hBT4bhGhx7I7iXD0uAgt50lgo8dD73ACMw==",
       "license": "MIT"
     },
     "node_modules/@types/chai": {
       "version": "5.2.3",
-      "resolved": "https://registry.npmjs.org/@types/chai/-/chai-5.2.3.tgz",
-      "integrity": "sha512-Mw558oeA9fFbv65/y4mHtXDs9bPnFMZAL/jxdPFUpOHHIXX91mcgEHbS5Lahr+pwZFR8A7GQleRWeI6cGFC2UA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1193,36 +1638,26 @@
     },
     "node_modules/@types/deep-eql": {
       "version": "4.0.2",
-      "resolved": "https://registry.npmjs.org/@types/deep-eql/-/deep-eql-4.0.2.tgz",
-      "integrity": "sha512-c9h9dVVMigMPc4bwTvC5dxqtqJZwQPePsWjPlpSOnojbor6pGqdk541lfA7AqFQr5pB1BRdq0juY9db81BwyFw==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@types/esrecurse": {
       "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/@types/esrecurse/-/esrecurse-4.3.1.tgz",
-      "integrity": "sha512-xJBAbDifo5hpffDBuHl0Y8ywswbiAp/Wi7Y/GtAgSlZyIABppyurxVueOPE8LUQOxdlgi6Zqce7uoEpqNTeiUw==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@types/estree": {
       "version": "1.0.8",
-      "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.8.tgz",
-      "integrity": "sha512-dWHzHa2WqEXI/O1E9OjrocMTKJl2mSrEolh1Iomrv6U+JuNwaHXsXx9bLu5gG7BUWFIN0skIQJQ/L1rIex4X6w==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@types/json-schema": {
       "version": "7.0.15",
-      "resolved": "https://registry.npmjs.org/@types/json-schema/-/json-schema-7.0.15.tgz",
-      "integrity": "sha512-5+fP8P8MFNC+AyZCDxrB2pkZFPGzqQWUzpSeuuVLvm8VMcorNYavBqoFcxK8bQz4Qsbn4oUEEem4wDLfcysGHA==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@types/node": {
       "version": "25.3.0",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-25.3.0.tgz",
-      "integrity": "sha512-4K3bqJpXpqfg2XKGK9bpDTc6xO/xoUP/RBWS7AtRMug6zZFaRekiLzjVtAoZMquxoAbzBvy5nxQ7veS5eYzf8A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1231,8 +1666,6 @@
     },
     "node_modules/@typescript-eslint/eslint-plugin": {
       "version": "8.56.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.56.0.tgz",
-      "integrity": "sha512-lRyPDLzNCuae71A3t9NEINBiTn7swyOhvUj3MyUOxb8x6g6vPEFoOU+ZRmGMusNC3X3YMhqMIX7i8ShqhT74Pw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1260,8 +1693,6 @@
     },
     "node_modules/@typescript-eslint/parser": {
       "version": "8.56.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.56.0.tgz",
-      "integrity": "sha512-IgSWvLobTDOjnaxAfDTIHaECbkNlAlKv2j5SjpB2v7QHKv1FIfjwMy8FsDbVfDX/KjmCmYICcw7uGaXLhtsLNg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1285,8 +1716,6 @@
     },
     "node_modules/@typescript-eslint/project-service": {
       "version": "8.56.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.56.0.tgz",
-      "integrity": "sha512-M3rnyL1vIQOMeWxTWIW096/TtVP+8W3p/XnaFflhmcFp+U4zlxUxWj4XwNs6HbDeTtN4yun0GNTTDBw/SvufKg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1307,8 +1736,6 @@
     },
     "node_modules/@typescript-eslint/scope-manager": {
       "version": "8.56.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.56.0.tgz",
-      "integrity": "sha512-7UiO/XwMHquH+ZzfVCfUNkIXlp/yQjjnlYUyYz7pfvlK3/EyyN6BK+emDmGNyQLBtLGaYrTAI6KOw8tFucWL2w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1325,8 +1752,6 @@
     },
     "node_modules/@typescript-eslint/tsconfig-utils": {
       "version": "8.56.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.56.0.tgz",
-      "integrity": "sha512-bSJoIIt4o3lKXD3xmDh9chZcjCz5Lk8xS7Rxn+6l5/pKrDpkCwtQNQQwZ2qRPk7TkUYhrq3WPIHXOXlbXP0itg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -1342,8 +1767,6 @@
     },
     "node_modules/@typescript-eslint/type-utils": {
       "version": "8.56.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.56.0.tgz",
-      "integrity": "sha512-qX2L3HWOU2nuDs6GzglBeuFXviDODreS58tLY/BALPC7iu3Fa+J7EOTwnX9PdNBxUI7Uh0ntP0YWGnxCkXzmfA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1367,8 +1790,6 @@
     },
     "node_modules/@typescript-eslint/types": {
       "version": "8.56.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.56.0.tgz",
-      "integrity": "sha512-DBsLPs3GsWhX5HylbP9HNG15U0bnwut55Lx12bHB9MpXxQ+R5GC8MwQe+N1UFXxAeQDvEsEDY6ZYwX03K7Z6HQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -1381,8 +1802,6 @@
     },
     "node_modules/@typescript-eslint/typescript-estree": {
       "version": "8.56.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.56.0.tgz",
-      "integrity": "sha512-ex1nTUMWrseMltXUHmR2GAQ4d+WjkZCT4f+4bVsps8QEdh0vlBsaCokKTPlnqBFqqGaxilDNJG7b8dolW2m43Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1409,15 +1828,11 @@
     },
     "node_modules/@typescript-eslint/typescript-estree/node_modules/balanced-match": {
       "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
-      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion": {
       "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.2.tgz",
-      "integrity": "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1426,8 +1841,6 @@
     },
     "node_modules/@typescript-eslint/typescript-estree/node_modules/minimatch": {
       "version": "9.0.9",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.9.tgz",
-      "integrity": "sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -1442,8 +1855,6 @@
     },
     "node_modules/@typescript-eslint/utils": {
       "version": "8.56.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.56.0.tgz",
-      "integrity": "sha512-RZ3Qsmi2nFGsS+n+kjLAYDPVlrzf7UhTffrDIKr+h2yzAlYP/y5ZulU0yeDEPItos2Ph46JAL5P/On3pe7kDIQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1466,8 +1877,6 @@
     },
     "node_modules/@typescript-eslint/visitor-keys": {
       "version": "8.56.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.56.0.tgz",
-      "integrity": "sha512-q+SL+b+05Ud6LbEE35qe4A99P+htKTKVbyiNEe45eCbJFyh/HVK9QXwlrbz+Q4L8SOW4roxSVwXYj4DMBT7Ieg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1484,8 +1893,6 @@
     },
     "node_modules/@typescript-eslint/visitor-keys/node_modules/eslint-visitor-keys": {
       "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-5.0.0.tgz",
-      "integrity": "sha512-A0XeIi7CXU7nPlfHS9loMYEKxUaONu/hTEzHTGba9Huu94Cq1hPivf+DE5erJozZOky0LfvXAyrV/tcswpLI0Q==",
       "dev": true,
       "license": "Apache-2.0",
       "engines": {
@@ -1497,8 +1904,6 @@
     },
     "node_modules/@vitest/coverage-v8": {
       "version": "4.0.18",
-      "resolved": "https://registry.npmjs.org/@vitest/coverage-v8/-/coverage-v8-4.0.18.tgz",
-      "integrity": "sha512-7i+N2i0+ME+2JFZhfuz7Tg/FqKtilHjGyGvoHYQ6iLV0zahbsJ9sljC9OcFcPDbhYKCet+sG8SsVqlyGvPflZg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1528,8 +1933,6 @@
     },
     "node_modules/@vitest/expect": {
       "version": "4.0.18",
-      "resolved": "https://registry.npmjs.org/@vitest/expect/-/expect-4.0.18.tgz",
-      "integrity": "sha512-8sCWUyckXXYvx4opfzVY03EOiYVxyNrHS5QxX3DAIi5dpJAAkyJezHCP77VMX4HKA2LDT/Jpfo8i2r5BE3GnQQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1546,15 +1949,11 @@
     },
     "node_modules/@vitest/expect/node_modules/@standard-schema/spec": {
       "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/@standard-schema/spec/-/spec-1.1.0.tgz",
-      "integrity": "sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@vitest/mocker": {
       "version": "4.0.18",
-      "resolved": "https://registry.npmjs.org/@vitest/mocker/-/mocker-4.0.18.tgz",
-      "integrity": "sha512-HhVd0MDnzzsgevnOWCBj5Otnzobjy5wLBe4EdeeFGv8luMsGcYqDuFRMcttKWZA5vVO8RFjexVovXvAM4JoJDQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1580,8 +1979,6 @@
     },
     "node_modules/@vitest/pretty-format": {
       "version": "4.0.18",
-      "resolved": "https://registry.npmjs.org/@vitest/pretty-format/-/pretty-format-4.0.18.tgz",
-      "integrity": "sha512-P24GK3GulZWC5tz87ux0m8OADrQIUVDPIjjj65vBXYG17ZeU3qD7r+MNZ1RNv4l8CGU2vtTRqixrOi9fYk/yKw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1593,8 +1990,6 @@
     },
     "node_modules/@vitest/runner": {
       "version": "4.0.18",
-      "resolved": "https://registry.npmjs.org/@vitest/runner/-/runner-4.0.18.tgz",
-      "integrity": "sha512-rpk9y12PGa22Jg6g5M3UVVnTS7+zycIGk9ZNGN+m6tZHKQb7jrP7/77WfZy13Y/EUDd52NDsLRQhYKtv7XfPQw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1607,8 +2002,6 @@
     },
     "node_modules/@vitest/snapshot": {
       "version": "4.0.18",
-      "resolved": "https://registry.npmjs.org/@vitest/snapshot/-/snapshot-4.0.18.tgz",
-      "integrity": "sha512-PCiV0rcl7jKQjbgYqjtakly6T1uwv/5BQ9SwBLekVg/EaYeQFPiXcgrC2Y7vDMA8dM1SUEAEV82kgSQIlXNMvA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1622,8 +2015,6 @@
     },
     "node_modules/@vitest/spy": {
       "version": "4.0.18",
-      "resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-4.0.18.tgz",
-      "integrity": "sha512-cbQt3PTSD7P2OARdVW3qWER5EGq7PHlvE+QfzSC0lbwO+xnt7+XH06ZzFjFRgzUX//JmpxrCu92VdwvEPlWSNw==",
       "dev": true,
       "license": "MIT",
       "funding": {
@@ -1632,8 +2023,6 @@
     },
     "node_modules/@vitest/ui": {
       "version": "4.0.18",
-      "resolved": "https://registry.npmjs.org/@vitest/ui/-/ui-4.0.18.tgz",
-      "integrity": "sha512-CGJ25bc8fRi8Lod/3GHSvXRKi7nBo3kxh0ApW4yCjmrWmRmlT53B5E08XRSZRliygG0aVNxLrBEqPYdz/KcCtQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1654,8 +2043,6 @@
     },
     "node_modules/@vitest/utils": {
       "version": "4.0.18",
-      "resolved": "https://registry.npmjs.org/@vitest/utils/-/utils-4.0.18.tgz",
-      "integrity": "sha512-msMRKLMVLWygpK3u2Hybgi4MNjcYJvwTb0Ru09+fOyCXIgT5raYP041DRRdiJiI3k/2U6SEbAETB3YtBrUkCFA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1666,10 +2053,19 @@
         "url": "https://opencollective.com/vitest"
       }
     },
+    "node_modules/abbrev": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/abbrev/-/abbrev-3.0.1.tgz",
+      "integrity": "sha512-AO2ac6pjRB3SJmGJo+v5/aK6Omggp6fsLrs6wN9bd35ulu4cCwaAU9+7ZhXjeqHVkaHThLuzH0nZr0YpCDhygg==",
+      "dev": true,
+      "license": "ISC",
+      "optional": true,
+      "engines": {
+        "node": "^18.17.0 || >=20.5.0"
+      }
+    },
     "node_modules/acorn": {
       "version": "8.16.0",
-      "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.16.0.tgz",
-      "integrity": "sha512-UVJyE9MttOsBQIDKw1skb9nAwQuR5wuGD3+82K6JgJlm/Y+KI92oNsMNGZCYdDsVtRHSak0pcV5Dno5+4jh9sw==",
       "dev": true,
       "license": "MIT",
       "bin": {
@@ -1681,18 +2077,25 @@
     },
     "node_modules/acorn-jsx": {
       "version": "5.3.2",
-      "resolved": "https://registry.npmjs.org/acorn-jsx/-/acorn-jsx-5.3.2.tgz",
-      "integrity": "sha512-rq9s+JNhf0IChjtDXxllJ7g41oZk5SlXtp0LHwyA5cejwn7vKmKp4pPri6YEePv2PU65sAsegbXtIinmDFDXgQ==",
       "dev": true,
       "license": "MIT",
       "peerDependencies": {
         "acorn": "^6.0.0 || ^7.0.0 || ^8.0.0"
       }
     },
+    "node_modules/agent-base": {
+      "version": "7.1.4",
+      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-7.1.4.tgz",
+      "integrity": "sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "engines": {
+        "node": ">= 14"
+      }
+    },
     "node_modules/ajv": {
       "version": "6.12.6",
-      "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.12.6.tgz",
-      "integrity": "sha512-j3fVLgvTo527anyYyJOGTYJbG+vnnQYvE0m5mmkc1TK+nxAppkCLMIL0aZ4dblVCNoGShhm+kzE4ZUykBoMg4g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1706,10 +2109,70 @@
         "url": "https://github.com/sponsors/epoberezkin"
       }
     },
+    "node_modules/ajv-formats": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/ajv-formats/-/ajv-formats-3.0.1.tgz",
+      "integrity": "sha512-8iUql50EUR+uUcdRQ3HDqa6EVyo3docL8g5WJ3FNcWmu62IbkGUue/pEyLBW8VGKKucTPgqeks4fIU1DA4yowQ==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "ajv": "^8.0.0"
+      },
+      "peerDependencies": {
+        "ajv": "^8.0.0"
+      },
+      "peerDependenciesMeta": {
+        "ajv": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/ajv-formats-draft2019": {
+      "version": "1.6.1",
+      "resolved": "https://registry.npmjs.org/ajv-formats-draft2019/-/ajv-formats-draft2019-1.6.1.tgz",
+      "integrity": "sha512-JQPvavpkWDvIsBp2Z33UkYCtXCSpW4HD3tAZ+oL4iEFOk9obQZffx0yANwECt6vzr6ET+7HN5czRyqXbnq/u0Q==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "punycode": "^2.1.1",
+        "schemes": "^1.4.0",
+        "smtp-address-parser": "^1.0.3",
+        "uri-js": "^4.4.1"
+      },
+      "peerDependencies": {
+        "ajv": "*"
+      }
+    },
+    "node_modules/ajv-formats/node_modules/ajv": {
+      "version": "8.18.0",
+      "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.18.0.tgz",
+      "integrity": "sha512-PlXPeEWMXMZ7sPYOHqmDyCJzcfNrUr3fGNKtezX14ykXOEIvyK81d+qydx89KY5O71FKMPaQ2vBfBFI5NHR63A==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "fast-deep-equal": "^3.1.3",
+        "fast-uri": "^3.0.1",
+        "json-schema-traverse": "^1.0.0",
+        "require-from-string": "^2.0.2"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/epoberezkin"
+      }
+    },
+    "node_modules/ajv-formats/node_modules/json-schema-traverse": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz",
+      "integrity": "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true
+    },
     "node_modules/ansi-escapes": {
       "version": "7.2.0",
-      "resolved": "https://registry.npmjs.org/ansi-escapes/-/ansi-escapes-7.2.0.tgz",
-      "integrity": "sha512-g6LhBsl+GBPRWGWsBtutpzBYuIIdBkLEvad5C/va/74Db018+5TZiyA26cZJAr3Rft5lprVqOIPxf5Vid6tqAw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1724,8 +2187,6 @@
     },
     "node_modules/ansi-regex": {
       "version": "6.2.2",
-      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-6.2.2.tgz",
-      "integrity": "sha512-Bq3SmSpyFHaWjPk8If9yc6svM8c56dB5BAtW4Qbw5jHTwwXXcTLoRMkpDJp6VL0XzlWaCHTXrkFURMYmD0sLqg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -1735,10 +2196,25 @@
         "url": "https://github.com/chalk/ansi-regex?sponsor=1"
       }
     },
+    "node_modules/ansi-styles": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "color-convert": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
     "node_modules/arctic": {
       "version": "2.3.4",
-      "resolved": "https://registry.npmjs.org/arctic/-/arctic-2.3.4.tgz",
-      "integrity": "sha512-+p30BOWsctZp+CVYCt7oAean/hWGW42sH5LAcRQX56ttEkFJWbzXBhmSpibbzwSJkRrotmsA+oAoJoVsU0f5xA==",
       "license": "MIT",
       "peer": true,
       "dependencies": {
@@ -1747,10 +2223,15 @@
         "@oslojs/jwt": "0.2.0"
       }
     },
+    "node_modules/argparse": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz",
+      "integrity": "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==",
+      "dev": true,
+      "license": "Python-2.0"
+    },
     "node_modules/assertion-error": {
       "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/assertion-error/-/assertion-error-2.0.1.tgz",
-      "integrity": "sha512-Izi8RQcffqCeNVgFigKli1ssklIbpHnCYc6AknXGYoB6grJqyeby7jv12JUQgmTAnIDnbck1uxksT4dzN3PWBA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -1759,8 +2240,6 @@
     },
     "node_modules/ast-v8-to-istanbul": {
       "version": "0.3.10",
-      "resolved": "https://registry.npmjs.org/ast-v8-to-istanbul/-/ast-v8-to-istanbul-0.3.10.tgz",
-      "integrity": "sha512-p4K7vMz2ZSk3wN8l5o3y2bJAoZXT3VuJI5OLTATY/01CYWumWvwkUw0SqDBnNq6IiTO3qDa1eSQDibAV8g7XOQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1771,24 +2250,62 @@
     },
     "node_modules/aws4fetch": {
       "version": "1.0.20",
-      "resolved": "https://registry.npmjs.org/aws4fetch/-/aws4fetch-1.0.20.tgz",
-      "integrity": "sha512-/djoAN709iY65ETD6LKCtyyEI04XIBP5xVvfmNxsEP0uJB5tyaGBztSryRr4HqMStr9R06PisQE7m9zDTXKu6g==",
       "license": "MIT"
     },
     "node_modules/balanced-match": {
       "version": "4.0.3",
-      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.3.tgz",
-      "integrity": "sha512-1pHv8LX9CpKut1Zp4EXey7Z8OfH11ONNH6Dhi2WDUt31VVZFXZzKwXcysBgqSumFCmR+0dqjMK5v5JiFHzi0+g==",
       "dev": true,
       "license": "MIT",
       "engines": {
         "node": "20 || >=22"
       }
     },
+    "node_modules/base64-js": {
+      "version": "1.5.1",
+      "resolved": "https://registry.npmjs.org/base64-js/-/base64-js-1.5.1.tgz",
+      "integrity": "sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT",
+      "optional": true
+    },
+    "node_modules/bindings": {
+      "version": "1.5.0",
+      "resolved": "https://registry.npmjs.org/bindings/-/bindings-1.5.0.tgz",
+      "integrity": "sha512-p2q/t/mhvuOj/UeLlV6566GD/guowlr0hHxClI0W9m7MWYkL1F0hLo+0Aexs9HSPCtR1SXQ0TD3MMKrXZajbiQ==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "file-uri-to-path": "1.0.0"
+      }
+    },
+    "node_modules/bl": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/bl/-/bl-4.1.0.tgz",
+      "integrity": "sha512-1W07cM9gS6DcLperZfFSj+bWLtaPGSOHWhPiGzXmvVJbRLdG82sH/Kn8EtW1VqWVA54AKf2h5k5BbnIbwF3h6w==",
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "buffer": "^5.5.0",
+        "inherits": "^2.0.4",
+        "readable-stream": "^3.4.0"
+      }
+    },
     "node_modules/brace-expansion": {
       "version": "5.0.2",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.2.tgz",
-      "integrity": "sha512-Pdk8c9poy+YhOgVWw1JNN22/HcivgKWwpxKq04M/jTmHyCZn12WPJebZxdjSa5TmBqISrUSgNYU3eRORljfCCw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1800,8 +2317,6 @@
     },
     "node_modules/braces": {
       "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/braces/-/braces-3.0.3.tgz",
-      "integrity": "sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1811,20 +2326,77 @@
         "node": ">=8"
       }
     },
+    "node_modules/buffer": {
+      "version": "5.7.1",
+      "resolved": "https://registry.npmjs.org/buffer/-/buffer-5.7.1.tgz",
+      "integrity": "sha512-EHcyIPBQ4BSGlvjB16k5KgAJ27CIsHY/2JBmCRReo48y9rQ3MaUzWX3KVlBa4U7MyX02HdVj0K7C3WaB3ju7FQ==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "base64-js": "^1.3.1",
+        "ieee754": "^1.1.13"
+      }
+    },
+    "node_modules/cacache": {
+      "version": "19.0.1",
+      "resolved": "https://registry.npmjs.org/cacache/-/cacache-19.0.1.tgz",
+      "integrity": "sha512-hdsUxulXCi5STId78vRVYEtDAjq99ICAUktLTeTYsLoTE6Z8dS0c8pWNCxwdrk9YfJeobDZc2Y186hD/5ZQgFQ==",
+      "dev": true,
+      "license": "ISC",
+      "optional": true,
+      "dependencies": {
+        "@npmcli/fs": "^4.0.0",
+        "fs-minipass": "^3.0.0",
+        "glob": "^10.2.2",
+        "lru-cache": "^10.0.1",
+        "minipass": "^7.0.3",
+        "minipass-collect": "^2.0.1",
+        "minipass-flush": "^1.0.5",
+        "minipass-pipeline": "^1.2.4",
+        "p-map": "^7.0.2",
+        "ssri": "^12.0.0",
+        "tar": "^7.4.3",
+        "unique-filename": "^4.0.0"
+      },
+      "engines": {
+        "node": "^18.17.0 || >=20.5.0"
+      }
+    },
     "node_modules/chai": {
       "version": "6.2.2",
-      "resolved": "https://registry.npmjs.org/chai/-/chai-6.2.2.tgz",
-      "integrity": "sha512-NUPRluOfOiTKBKvWPtSD4PhFvWCqOi0BGStNWs57X9js7XGTprSmFoz5F0tWhR4WPjNeR9jXqdC7/UpSJTnlRg==",
       "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=18"
       }
     },
+    "node_modules/chownr": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/chownr/-/chownr-3.0.0.tgz",
+      "integrity": "sha512-+IxzY9BZOQd/XuYPRmrvEVjF/nqj5kgT4kEq7VofrDoM1MxoRjEWkrCC3EtLi59TVawxTAn+orJwFQcrqEN1+g==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "optional": true,
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/cli-cursor": {
       "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/cli-cursor/-/cli-cursor-5.0.0.tgz",
-      "integrity": "sha512-aCj4O5wKyszjMmDT4tZj93kxyydN/K5zPWSCe6/0AV/AA1pqe5ZBIw0a2ZfPQV7lL5/yb5HsUreJ6UFAF1tEQw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1839,8 +2411,6 @@
     },
     "node_modules/cli-truncate": {
       "version": "5.1.1",
-      "resolved": "https://registry.npmjs.org/cli-truncate/-/cli-truncate-5.1.1.tgz",
-      "integrity": "sha512-SroPvNHxUnk+vIW/dOSfNqdy1sPEFkrTk6TUtqLCnBlo3N7TNYYkzzN7uSD6+jVjrdO4+p8nH7JzH6cIvUem6A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1854,17 +2424,35 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/color-convert": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "color-name": "~1.1.4"
+      },
+      "engines": {
+        "node": ">=7.0.0"
+      }
+    },
+    "node_modules/color-name": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true
+    },
     "node_modules/colorette": {
       "version": "2.0.20",
-      "resolved": "https://registry.npmjs.org/colorette/-/colorette-2.0.20.tgz",
-      "integrity": "sha512-IfEDxwoWIjkeXL1eXcDiow4UbKjhLdq6/EuSVR9GMN7KVH3r9gQ83e73hsz1Nd1T3ijd5xv1wcWRYO+D6kCI2w==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/commander": {
       "version": "14.0.2",
-      "resolved": "https://registry.npmjs.org/commander/-/commander-14.0.2.tgz",
-      "integrity": "sha512-TywoWNNRbhoD0BXs1P3ZEScW8W5iKrnbithIl0YH+uCmBd0QpPOA8yc82DS3BIE5Ma6FnBVUsJ7wVUDz4dvOWQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -1873,8 +2461,6 @@
     },
     "node_modules/cross-spawn": {
       "version": "7.0.6",
-      "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",
-      "integrity": "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1888,8 +2474,6 @@
     },
     "node_modules/debug": {
       "version": "4.4.3",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
-      "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1904,24 +2488,102 @@
         }
       }
     },
+    "node_modules/decompress-response": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/decompress-response/-/decompress-response-6.0.0.tgz",
+      "integrity": "sha512-aW35yZM6Bb/4oJlZncMH2LCoZtJXTRxES17vE3hoRiowU2kWHaJKFkSBDnDR+cm9J+9QhXmREyIfv0pji9ejCQ==",
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "mimic-response": "^3.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/deep-extend": {
+      "version": "0.6.0",
+      "resolved": "https://registry.npmjs.org/deep-extend/-/deep-extend-0.6.0.tgz",
+      "integrity": "sha512-LOHxIOaPYdHlJRtCQfDIVZtfw/ufM8+rVj649RIHzcm/vGwQRXFt6OPqIFWsm2XEMrNIEtWR64sY1LEKD2vAOA==",
+      "license": "MIT",
+      "optional": true,
+      "engines": {
+        "node": ">=4.0.0"
+      }
+    },
     "node_modules/deep-is": {
       "version": "0.1.4",
-      "resolved": "https://registry.npmjs.org/deep-is/-/deep-is-0.1.4.tgz",
-      "integrity": "sha512-oIPzksmTg4/MriiaYGO+okXDT7ztn/w3Eptv/+gSIdMdKsJo0u4CfYNFJPy+4SKMuCqGw2wxnA+URMg3t8a/bQ==",
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/detect-libc": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.1.2.tgz",
+      "integrity": "sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==",
+      "license": "Apache-2.0",
+      "optional": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/discontinuous-range": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/discontinuous-range/-/discontinuous-range-1.0.0.tgz",
+      "integrity": "sha512-c68LpLbO+7kP/b1Hr1qs8/BJ09F5khZGTxqxZuhzxpmwJKOgRFHJWIb9/KmqnqHhLdO55aOxFH/EGBvUQbL/RQ==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true
+    },
+    "node_modules/eastasianwidth": {
+      "version": "0.2.0",
+      "resolved": "https://registry.npmjs.org/eastasianwidth/-/eastasianwidth-0.2.0.tgz",
+      "integrity": "sha512-I88TYZWc9XiYHRQ4/3c5rjjfgkjhLyW2luGIheGERbNQ6OY7yTybanSpDXZa8y7VUP9YmDcYa+eyq4ca7iLqWA==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true
+    },
     "node_modules/emoji-regex": {
       "version": "10.6.0",
-      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-10.6.0.tgz",
-      "integrity": "sha512-toUI84YS5YmxW219erniWD0CIVOo46xGKColeNQRgOzDorgBi1v4D71/OFzgD9GO2UGKIv1C3Sp8DAn0+j5w7A==",
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/encoding": {
+      "version": "0.1.13",
+      "resolved": "https://registry.npmjs.org/encoding/-/encoding-0.1.13.tgz",
+      "integrity": "sha512-ETBauow1T35Y/WZMkio9jiM0Z5xjHHmJ4XmjZOq1l/dXz3lr2sRn87nJy20RupqSh1F2m3HHPSp8ShIPQJrJ3A==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "iconv-lite": "^0.6.2"
+      }
+    },
+    "node_modules/end-of-stream": {
+      "version": "1.4.5",
+      "resolved": "https://registry.npmjs.org/end-of-stream/-/end-of-stream-1.4.5.tgz",
+      "integrity": "sha512-ooEGc6HP26xXq/N+GCGOT0JKCLDGrq2bQUZrQ7gyrJiZANJ/8YDTxTpQBXGMn+WbIQXNVpyWymm7KYVICQnyOg==",
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "once": "^1.4.0"
+      }
+    },
+    "node_modules/env-paths": {
+      "version": "2.2.1",
+      "resolved": "https://registry.npmjs.org/env-paths/-/env-paths-2.2.1.tgz",
+      "integrity": "sha512-+h1lkLKhZMTYjog1VEpJNG7NZJWcuc2DDk/qsqSTRRCOXiLjeQ1d1/udrUGhqMxUgAlwKNZ0cf2uqan5GLuS2A==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "engines": {
+        "node": ">=6"
+      }
+    },
     "node_modules/environment": {
       "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/environment/-/environment-1.1.0.tgz",
-      "integrity": "sha512-xUtoPkMggbz0MPyPiIWr1Kp4aeWJjDZ6SMvURhimjdZgsRuDplF5/s9hcgGhyXMhs+6vpnuoiZ2kFiu3FMnS8Q==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -1931,17 +2593,21 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/err-code": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/err-code/-/err-code-2.0.3.tgz",
+      "integrity": "sha512-2bmlRpNKBxT/CRmPOlyISQpNj+qSeYvcym/uT0Jx2bMOlKLtSy1ZmLuVxSEKKyor/N5yhvp/ZiG1oE3DEYMSFA==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true
+    },
     "node_modules/es-module-lexer": {
       "version": "1.7.0",
-      "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-1.7.0.tgz",
-      "integrity": "sha512-jEQoCwk8hyb2AZziIOLhDqpm5+2ww5uIE6lkO/6jcOCusfk6LhMHpXXfBLXTZ7Ydyt0j4VoUQv6uGNYbdW+kBA==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/esbuild": {
       "version": "0.27.2",
-      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.27.2.tgz",
-      "integrity": "sha512-HyNQImnsOC7X9PMNaCIeAm4ISCQXs5a5YasTXVliKv4uuBo1dKrG0A+uQS8M5eXjVMnLg3WgXaKvprHlFJQffw==",
       "dev": true,
       "hasInstallScript": true,
       "license": "MIT",
@@ -1982,8 +2648,6 @@
     },
     "node_modules/escape-string-regexp": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-4.0.0.tgz",
-      "integrity": "sha512-TtpcNJ3XAzx3Gq8sWRzJaVajRs0uVxA2YAkdb1jm2YkPz4G6egUFAyA3n5vtEIZefPk5Wa4UXbKuS5fKkJWdgA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -1995,8 +2659,6 @@
     },
     "node_modules/eslint": {
       "version": "10.0.0",
-      "resolved": "https://registry.npmjs.org/eslint/-/eslint-10.0.0.tgz",
-      "integrity": "sha512-O0piBKY36YSJhlFSG8p9VUdPV/SxxS4FYDWVpr/9GJuMaepzwlf4J8I4ov1b+ySQfDTPhc3DtLaxcT1fN0yqCg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2051,8 +2713,6 @@
     },
     "node_modules/eslint-scope": {
       "version": "9.1.0",
-      "resolved": "https://registry.npmjs.org/eslint-scope/-/eslint-scope-9.1.0.tgz",
-      "integrity": "sha512-CkWE42hOJsNj9FJRaoMX9waUFYhqY4jmyLFdAdzZr6VaCg3ynLYx4WnOdkaIifGfH4gsUcBTn4OZbHXkpLD0FQ==",
       "dev": true,
       "license": "BSD-2-Clause",
       "dependencies": {
@@ -2070,8 +2730,6 @@
     },
     "node_modules/eslint-visitor-keys": {
       "version": "3.4.3",
-      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-3.4.3.tgz",
-      "integrity": "sha512-wpc+LXeiyiisxPlEkUzU6svyS1frIO3Mgxj1fdy7Pm8Ygzguax2N3Fa/D/ag1WqbOprdI+uY6wMUl8/a2G+iag==",
       "dev": true,
       "license": "Apache-2.0",
       "engines": {
@@ -2083,8 +2741,6 @@
     },
     "node_modules/eslint/node_modules/eslint-visitor-keys": {
       "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-5.0.0.tgz",
-      "integrity": "sha512-A0XeIi7CXU7nPlfHS9loMYEKxUaONu/hTEzHTGba9Huu94Cq1hPivf+DE5erJozZOky0LfvXAyrV/tcswpLI0Q==",
       "dev": true,
       "license": "Apache-2.0",
       "engines": {
@@ -2096,8 +2752,6 @@
     },
     "node_modules/eslint/node_modules/ignore": {
       "version": "5.3.2",
-      "resolved": "https://registry.npmjs.org/ignore/-/ignore-5.3.2.tgz",
-      "integrity": "sha512-hsBTNUqQTDwkWtcdYI2i06Y/nUBEsNEDJKjWdigLvegy8kDuJAS8uRlpkkcQpyEXL0Z/pjDy5HBmMjRCJ2gq+g==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -2106,8 +2760,6 @@
     },
     "node_modules/espree": {
       "version": "11.1.0",
-      "resolved": "https://registry.npmjs.org/espree/-/espree-11.1.0.tgz",
-      "integrity": "sha512-WFWYhO1fV4iYkqOOvq8FbqIhr2pYfoDY0kCotMkDeNtGpiGGkZ1iov2u8ydjtgM8yF8rzK7oaTbw2NAzbAbehw==",
       "dev": true,
       "license": "BSD-2-Clause",
       "dependencies": {
@@ -2124,8 +2776,6 @@
     },
     "node_modules/espree/node_modules/eslint-visitor-keys": {
       "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-5.0.0.tgz",
-      "integrity": "sha512-A0XeIi7CXU7nPlfHS9loMYEKxUaONu/hTEzHTGba9Huu94Cq1hPivf+DE5erJozZOky0LfvXAyrV/tcswpLI0Q==",
       "dev": true,
       "license": "Apache-2.0",
       "engines": {
@@ -2137,8 +2787,6 @@
     },
     "node_modules/esquery": {
       "version": "1.7.0",
-      "resolved": "https://registry.npmjs.org/esquery/-/esquery-1.7.0.tgz",
-      "integrity": "sha512-Ap6G0WQwcU/LHsvLwON1fAQX9Zp0A2Y6Y/cJBl9r/JbW90Zyg4/zbG6zzKa2OTALELarYHmKu0GhpM5EO+7T0g==",
       "dev": true,
       "license": "BSD-3-Clause",
       "dependencies": {
@@ -2150,8 +2798,6 @@
     },
     "node_modules/esrecurse": {
       "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/esrecurse/-/esrecurse-4.3.0.tgz",
-      "integrity": "sha512-KmfKL3b6G+RXvP8N1vr3Tq1kL/oCFgn2NYXEtqP8/L3pKapUA4G8cFVaoF3SU323CD4XypR/ffioHmkti6/Tag==",
       "dev": true,
       "license": "BSD-2-Clause",
       "dependencies": {
@@ -2163,8 +2809,6 @@
     },
     "node_modules/estraverse": {
       "version": "5.3.0",
-      "resolved": "https://registry.npmjs.org/estraverse/-/estraverse-5.3.0.tgz",
-      "integrity": "sha512-MMdARuVEQziNTeJD8DgMqmhwR11BRQ/cBP+pLtYdSTnf3MIO8fFeiINEbX36ZdNlfU/7A9f3gUw49B3oQsvwBA==",
       "dev": true,
       "license": "BSD-2-Clause",
       "engines": {
@@ -2173,8 +2817,6 @@
     },
     "node_modules/estree-walker": {
       "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/estree-walker/-/estree-walker-3.0.3.tgz",
-      "integrity": "sha512-7RUKfXgSMMkzt6ZuXmqapOurLGPPfgj6l9uRZ7lRGolvk0y2yocc35LdcxKC5PQZdn2DMqioAQ2NoWcrTKmm6g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2183,8 +2825,6 @@
     },
     "node_modules/esutils": {
       "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/esutils/-/esutils-2.0.3.tgz",
-      "integrity": "sha512-kVscqXk4OCp68SZ0dkgEKVi6/8ij300KBWTJq32P/dYeWTSwK41WyTxalN1eRmA5Z9UU/LX9D7FWSmV9SAYx6g==",
       "dev": true,
       "license": "BSD-2-Clause",
       "engines": {
@@ -2193,25 +2833,45 @@
     },
     "node_modules/eventemitter3": {
       "version": "5.0.4",
-      "resolved": "https://registry.npmjs.org/eventemitter3/-/eventemitter3-5.0.4.tgz",
-      "integrity": "sha512-mlsTRyGaPBjPedk6Bvw+aqbsXDtoAyAzm5MO7JgU+yVRyMQ5O8bD4Kcci7BS85f93veegeCPkL8R4GLClnjLFw==",
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/expect-type": {
-      "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/expect-type/-/expect-type-1.3.0.tgz",
-      "integrity": "sha512-knvyeauYhqjOYvQ66MznSMs83wmHrCycNEN6Ao+2AeYEfxUIkuiVxdEa1qlGEPK+We3n0THiDciYSsCcgW/DoA==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "engines": {
+    "node_modules/expand-template": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/expand-template/-/expand-template-2.0.3.tgz",
+      "integrity": "sha512-XYfuKMvj4O35f/pOXLObndIRvyQ+/+6AhODh+OKWj9S9498pHHn/IMszH+gt0fBCRWMNfk1ZSp5x3AifmnI2vg==",
+      "license": "(MIT OR WTFPL)",
+      "optional": true,
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/expect-type": {
+      "version": "1.3.0",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
         "node": ">=12.0.0"
       }
     },
+    "node_modules/exponential-backoff": {
+      "version": "3.1.3",
+      "resolved": "https://registry.npmjs.org/exponential-backoff/-/exponential-backoff-3.1.3.tgz",
+      "integrity": "sha512-ZgEeZXj30q+I0EN+CbSSpIyPaJ5HVQD18Z1m+u1FXbAeT94mr1zw50q4q6jiiC447Nl/YTcIYSAftiGqetwXCA==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true
+    },
+    "node_modules/extend": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/extend/-/extend-3.0.2.tgz",
+      "integrity": "sha512-fjquC59cD7CyW6urNXK0FBufkZcoiGG80wTuPujX590cB5Ttln20E2UB4S/WARVqhXffZl2LNgS+gQdPIIim/g==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true
+    },
     "node_modules/fast-check": {
       "version": "4.5.3",
-      "resolved": "https://registry.npmjs.org/fast-check/-/fast-check-4.5.3.tgz",
-      "integrity": "sha512-IE9csY7lnhxBnA8g/WI5eg/hygA6MGWJMSNfFRrBlXUciADEhS1EDB0SIsMSvzubzIlOBbVITSsypCsW717poA==",
       "dev": true,
       "funding": [
         {
@@ -2233,36 +2893,44 @@
     },
     "node_modules/fast-deep-equal": {
       "version": "3.1.3",
-      "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
-      "integrity": "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/fast-json-stable-stringify": {
       "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/fast-json-stable-stringify/-/fast-json-stable-stringify-2.1.0.tgz",
-      "integrity": "sha512-lhd/wF+Lk98HZoTCtlVraHtfh5XYijIjalXck7saUtuanSDyLMxnHhSXEDJqHxD7msR8D0uCmqlkwjCV8xvwHw==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/fast-levenshtein": {
       "version": "2.0.6",
-      "resolved": "https://registry.npmjs.org/fast-levenshtein/-/fast-levenshtein-2.0.6.tgz",
-      "integrity": "sha512-DCXu6Ifhqcks7TZKY3Hxp3y6qphY5SJZmrWMDrKcERSOXWQdMhU9Ig/PYrzyw/ul9jOIyh0N4M0tbC5hodg8dw==",
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/fast-uri": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.0.tgz",
+      "integrity": "sha512-iPeeDKJSWf4IEOasVVrknXpaBV0IApz/gp7S2bb7Z4Lljbl2MGJRqInZiUrQwV16cpzw/D3S5j5Julj/gT52AA==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/fastify"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/fastify"
+        }
+      ],
+      "license": "BSD-3-Clause",
+      "optional": true
+    },
     "node_modules/fflate": {
       "version": "0.8.2",
-      "resolved": "https://registry.npmjs.org/fflate/-/fflate-0.8.2.tgz",
-      "integrity": "sha512-cPJU47OaAoCbg0pBvzsgpTPhmhqI5eJjh/JIu8tPj5q+T7iLvW/JAYUqmE7KOB4R1ZyEhzBaIQpQpardBF5z8A==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/file-entry-cache": {
       "version": "8.0.0",
-      "resolved": "https://registry.npmjs.org/file-entry-cache/-/file-entry-cache-8.0.0.tgz",
-      "integrity": "sha512-XXTUwCvisa5oacNGRP9SfNtYBNAMi+RPwBFmblZEF7N7swHYQS6/Zfk7SRwx4D5j3CH211YNRco1DEMNVfZCnQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2272,10 +2940,16 @@
         "node": ">=16.0.0"
       }
     },
+    "node_modules/file-uri-to-path": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/file-uri-to-path/-/file-uri-to-path-1.0.0.tgz",
+      "integrity": "sha512-0Zt+s3L7Vf1biwWZ29aARiVYLx7iMGnEUl9x33fbB/j3jR81u/O2LbqK+Bm1CDSNDKVtJ/YjwY7TUd5SkeLQLw==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true
+    },
     "node_modules/fill-range": {
       "version": "7.1.1",
-      "resolved": "https://registry.npmjs.org/fill-range/-/fill-range-7.1.1.tgz",
-      "integrity": "sha512-YsGpe3WHLK8ZYi4tWDg2Jy3ebRz2rXowDxnld4bkQB00cc/1Zw9AWnC0i9ztDJitivtQvaI9KaLyKrc+hBW0yg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2287,8 +2961,6 @@
     },
     "node_modules/find-up": {
       "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/find-up/-/find-up-5.0.0.tgz",
-      "integrity": "sha512-78/PXT1wlLLDgTzDs7sjq9hzz0vXD+zn+7wypEe4fXQxCmdmqfGsEPQxmiCSQI3ajFV91bVSsvNtrJRiW6nGng==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2304,8 +2976,6 @@
     },
     "node_modules/flat-cache": {
       "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/flat-cache/-/flat-cache-4.0.1.tgz",
-      "integrity": "sha512-f7ccFPK3SXFHpx15UIGyRJ/FJQctuKZ0zVuN3frBo4HnK3cay9VEW0R6yPYFHC0AgqhukPzKjq22t5DmAyqGyw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2318,11 +2988,48 @@
     },
     "node_modules/flatted": {
       "version": "3.3.3",
-      "resolved": "https://registry.npmjs.org/flatted/-/flatted-3.3.3.tgz",
-      "integrity": "sha512-GX+ysw4PBCz0PzosHDepZGANEuFCMLrnRTiEy9McGjmkCQYwRq4A/X786G/fjM/+OjsWSU1ZrY5qyARZmO/uwg==",
       "dev": true,
       "license": "ISC"
     },
+    "node_modules/foreground-child": {
+      "version": "3.3.1",
+      "resolved": "https://registry.npmjs.org/foreground-child/-/foreground-child-3.3.1.tgz",
+      "integrity": "sha512-gIXjKqtFuWEgzFRJA9WCQeSJLZDjgJUOMCMzxtvFq/37KojM1BFGufqsCy0r4qSQmYLsZYMeyRqzIWOMup03sw==",
+      "dev": true,
+      "license": "ISC",
+      "optional": true,
+      "dependencies": {
+        "cross-spawn": "^7.0.6",
+        "signal-exit": "^4.0.1"
+      },
+      "engines": {
+        "node": ">=14"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/fs-constants": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/fs-constants/-/fs-constants-1.0.0.tgz",
+      "integrity": "sha512-y6OAwoSIf7FyjMIv94u+b5rdheZEjzR63GTyZJm5qh4Bi+2YgwLCcI/fPFZkL5PSixOt6ZNKm+w+Hfp/Bciwow==",
+      "license": "MIT",
+      "optional": true
+    },
+    "node_modules/fs-minipass": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/fs-minipass/-/fs-minipass-3.0.3.tgz",
+      "integrity": "sha512-XUBA9XClHbnJWSfBzjkm6RvPsyg3sryZt06BEQoXcF7EK/xpGaQYJgQKDJSUH5SGZ76Y7pFx1QBnXz09rU5Fbw==",
+      "dev": true,
+      "license": "ISC",
+      "optional": true,
+      "dependencies": {
+        "minipass": "^7.0.3"
+      },
+      "engines": {
+        "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
+      }
+    },
     "node_modules/fsevents": {
       "version": "2.3.3",
       "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.3.tgz",
@@ -2340,8 +3047,6 @@
     },
     "node_modules/get-east-asian-width": {
       "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/get-east-asian-width/-/get-east-asian-width-1.4.0.tgz",
-      "integrity": "sha512-QZjmEOC+IT1uk6Rx0sX22V6uHWVwbdbxf1faPqJ1QhLdGgsRGCZoyaQBm/piRdJy/D2um6hM1UP7ZEeQ4EkP+Q==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -2351,10 +3056,38 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/github-from-package": {
+      "version": "0.0.0",
+      "resolved": "https://registry.npmjs.org/github-from-package/-/github-from-package-0.0.0.tgz",
+      "integrity": "sha512-SyHy3T1v2NUXn29OsWdxmK6RwHD+vkj3v8en8AOBZ1wBQ/hCAQ5bAQTD02kW4W9tUp/3Qh6J8r9EvntiyCmOOw==",
+      "license": "MIT",
+      "optional": true
+    },
+    "node_modules/glob": {
+      "version": "10.5.0",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-10.5.0.tgz",
+      "integrity": "sha512-DfXN8DfhJ7NH3Oe7cFmu3NCu1wKbkReJ8TorzSAFbSKrlNaQSKfIzqYqVY8zlbs2NLBbWpRiU52GX2PbaBVNkg==",
+      "deprecated": "Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me",
+      "dev": true,
+      "license": "ISC",
+      "optional": true,
+      "dependencies": {
+        "foreground-child": "^3.1.0",
+        "jackspeak": "^3.1.2",
+        "minimatch": "^9.0.4",
+        "minipass": "^7.1.2",
+        "package-json-from-dist": "^1.0.0",
+        "path-scurry": "^1.11.1"
+      },
+      "bin": {
+        "glob": "dist/esm/bin.mjs"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
     "node_modules/glob-parent": {
       "version": "6.0.2",
-      "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-6.0.2.tgz",
-      "integrity": "sha512-XxwI8EOhVQgWp6iDL+3b0r86f4d6AX6zSU55HfB4ydCEuXLXc5FcYeOu+nnGftS4TEju/11rt4KJPTMgbfmv4A==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -2364,10 +3097,16 @@
         "node": ">=10.13.0"
       }
     },
+    "node_modules/graceful-fs": {
+      "version": "4.2.11",
+      "resolved": "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.11.tgz",
+      "integrity": "sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ==",
+      "dev": true,
+      "license": "ISC",
+      "optional": true
+    },
     "node_modules/has-flag": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
-      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -2376,24 +3115,79 @@
     },
     "node_modules/hono": {
       "version": "4.12.3",
-      "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.3.tgz",
-      "integrity": "sha512-SFsVSjp8sj5UumXOOFlkZOG6XS9SJDKw0TbwFeV+AJ8xlST8kxK5Z/5EYa111UY8732lK2S/xB653ceuaoGwpg==",
       "license": "MIT",
       "engines": {
         "node": ">=16.9.0"
       }
     },
+    "node_modules/hosted-git-info": {
+      "version": "9.0.2",
+      "resolved": "https://registry.npmjs.org/hosted-git-info/-/hosted-git-info-9.0.2.tgz",
+      "integrity": "sha512-M422h7o/BR3rmCQ8UHi7cyyMqKltdP9Uo+J2fXK+RSAY+wTcKOIRyhTuKv4qn+DJf3g+PL890AzId5KZpX+CBg==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "lru-cache": "^11.1.0"
+      },
+      "engines": {
+        "node": "^20.17.0 || >=22.9.0"
+      }
+    },
+    "node_modules/hosted-git-info/node_modules/lru-cache": {
+      "version": "11.2.6",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.2.6.tgz",
+      "integrity": "sha512-ESL2CrkS/2wTPfuend7Zhkzo2u0daGJ/A2VucJOgQ/C48S/zB8MMeMHSGKYpXhIjbPxfuezITkaBH1wqv00DDQ==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "engines": {
+        "node": "20 || >=22"
+      }
+    },
     "node_modules/html-escaper": {
       "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/html-escaper/-/html-escaper-2.0.2.tgz",
-      "integrity": "sha512-H2iMtd0I4Mt5eYiapRdIDjp+XzelXQ0tFE4JS7YFwFevXXMmOp9myNrUvCg0D6ws8iqkRPBfKHgbwig1SmlLfg==",
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/http-cache-semantics": {
+      "version": "4.2.0",
+      "resolved": "https://registry.npmjs.org/http-cache-semantics/-/http-cache-semantics-4.2.0.tgz",
+      "integrity": "sha512-dTxcvPXqPvXBQpq5dUr6mEMJX4oIEFv6bwom3FDwKRDsuIjjJGANqhBuoAn9c1RQJIdAKav33ED65E2ys+87QQ==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "optional": true
+    },
+    "node_modules/http-proxy-agent": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/http-proxy-agent/-/http-proxy-agent-7.0.2.tgz",
+      "integrity": "sha512-T1gkAiYYDWYx3V5Bmyu7HcfcvL7mUrTWiM6yOfa3PIphViJ/gFPbvidQ+veqSOHci/PxBcDabeUNCzpOODJZig==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "agent-base": "^7.1.0",
+        "debug": "^4.3.4"
+      },
+      "engines": {
+        "node": ">= 14"
+      }
+    },
+    "node_modules/https-proxy-agent": {
+      "version": "7.0.6",
+      "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-7.0.6.tgz",
+      "integrity": "sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "agent-base": "^7.1.2",
+        "debug": "4"
+      },
+      "engines": {
+        "node": ">= 14"
+      }
+    },
     "node_modules/husky": {
       "version": "9.1.7",
-      "resolved": "https://registry.npmjs.org/husky/-/husky-9.1.7.tgz",
-      "integrity": "sha512-5gs5ytaNjBrh5Ow3zrvdUUY+0VxIuWVL4i9irt6friV+BqdCfmV11CQTWMiBYWHbXhco+J1kHfTOUkePhCDvMA==",
       "dev": true,
       "license": "MIT",
       "bin": {
@@ -2406,10 +3200,43 @@
         "url": "https://github.com/sponsors/typicode"
       }
     },
+    "node_modules/iconv-lite": {
+      "version": "0.6.3",
+      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.6.3.tgz",
+      "integrity": "sha512-4fCk79wshMdzMp2rH06qWrJE4iolqLhCUH+OiuIgU++RB0+94NlDL81atO7GX55uUKueo0txHNtvEyI6D7WdMw==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "safer-buffer": ">= 2.1.2 < 3.0.0"
+      },
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/ieee754": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/ieee754/-/ieee754-1.2.1.tgz",
+      "integrity": "sha512-dcyqhDvX1C46lXZcVqCpK+FtMRQVdIMN6/Df5js2zouUsqG7I6sFxitIC+7KYK29KdXOLHdu9zL4sFnoVQnqaA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "BSD-3-Clause",
+      "optional": true
+    },
     "node_modules/ignore": {
       "version": "7.0.5",
-      "resolved": "https://registry.npmjs.org/ignore/-/ignore-7.0.5.tgz",
-      "integrity": "sha512-Hs59xBNfUIunMFgWAbGX5cq6893IbWg4KnrjbYwX3tx0ztorVgTDA6B2sxf8ejHJ4wz8BqGUMYlnzNBer5NvGg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -2418,18 +3245,39 @@
     },
     "node_modules/imurmurhash": {
       "version": "0.1.4",
-      "resolved": "https://registry.npmjs.org/imurmurhash/-/imurmurhash-0.1.4.tgz",
-      "integrity": "sha512-JmXMZ6wuvDmLiHEml9ykzqO6lwFbof0GG4IkcGaENdCRDDmMVnny7s5HsIgHCbaq0w2MyPhDqkhTUgS2LU2PHA==",
       "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=0.8.19"
       }
     },
+    "node_modules/inherits": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
+      "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
+      "license": "ISC",
+      "optional": true
+    },
+    "node_modules/ini": {
+      "version": "1.3.8",
+      "resolved": "https://registry.npmjs.org/ini/-/ini-1.3.8.tgz",
+      "integrity": "sha512-JV/yugV2uzW5iMRSiZAyDtQd+nxtUnjeLt0acNdw98kKLrvuRVyB80tsREOE7yvGVgalhZ6RNXCmEHkUKBKxew==",
+      "license": "ISC",
+      "optional": true
+    },
+    "node_modules/ip-address": {
+      "version": "10.1.0",
+      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.1.0.tgz",
+      "integrity": "sha512-XXADHxXmvT9+CRxhXg56LJovE+bmWnEWB78LB83VZTprKTmaC5QfruXocxzTZ2Kl0DNwKuBdlIhjL8LeY8Sf8Q==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "engines": {
+        "node": ">= 12"
+      }
+    },
     "node_modules/is-extglob": {
       "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/is-extglob/-/is-extglob-2.1.1.tgz",
-      "integrity": "sha512-SbKbANkN603Vi4jEZv49LeVJMn4yGwsbzZworEoyEiutsN3nJYdbO36zfhGJ6QEDpOZIFkDtnq5JRxmvl3jsoQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -2438,8 +3286,6 @@
     },
     "node_modules/is-fullwidth-code-point": {
       "version": "5.1.0",
-      "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-5.1.0.tgz",
-      "integrity": "sha512-5XHYaSyiqADb4RnZ1Bdad6cPp8Toise4TzEjcOYDHZkTCbKgiUl7WTUCpNWHuxmDt91wnsZBc9xinNzopv3JMQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2454,8 +3300,6 @@
     },
     "node_modules/is-glob": {
       "version": "4.0.3",
-      "resolved": "https://registry.npmjs.org/is-glob/-/is-glob-4.0.3.tgz",
-      "integrity": "sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2467,8 +3311,6 @@
     },
     "node_modules/is-number": {
       "version": "7.0.0",
-      "resolved": "https://registry.npmjs.org/is-number/-/is-number-7.0.0.tgz",
-      "integrity": "sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -2477,15 +3319,11 @@
     },
     "node_modules/isexe": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz",
-      "integrity": "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==",
       "dev": true,
       "license": "ISC"
     },
     "node_modules/istanbul-lib-coverage": {
       "version": "3.2.2",
-      "resolved": "https://registry.npmjs.org/istanbul-lib-coverage/-/istanbul-lib-coverage-3.2.2.tgz",
-      "integrity": "sha512-O8dpsF+r0WV/8MNRKfnmrtCWhuKjxrq2w+jpzBL5UZKTi2LeVWnWOmWRxFlesJONmc+wLAGvKQZEOanko0LFTg==",
       "dev": true,
       "license": "BSD-3-Clause",
       "engines": {
@@ -2494,8 +3332,6 @@
     },
     "node_modules/istanbul-lib-report": {
       "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/istanbul-lib-report/-/istanbul-lib-report-3.0.1.tgz",
-      "integrity": "sha512-GCfE1mtsHGOELCU8e/Z7YWzpmybrx/+dSTfLrvY8qRmaY6zXTKWn6WQIjaAFw069icm6GVMNkgu0NzI4iPZUNw==",
       "dev": true,
       "license": "BSD-3-Clause",
       "dependencies": {
@@ -2509,8 +3345,6 @@
     },
     "node_modules/istanbul-reports": {
       "version": "3.2.0",
-      "resolved": "https://registry.npmjs.org/istanbul-reports/-/istanbul-reports-3.2.0.tgz",
-      "integrity": "sha512-HGYWWS/ehqTV3xN10i23tkPkpH46MLCIMFNCaaKNavAXTF1RkqxawEPtnjnGZ6XKSInBKkiOA5BKS+aZiY3AvA==",
       "dev": true,
       "license": "BSD-3-Clause",
       "dependencies": {
@@ -2521,10 +3355,25 @@
         "node": ">=8"
       }
     },
+    "node_modules/jackspeak": {
+      "version": "3.4.3",
+      "resolved": "https://registry.npmjs.org/jackspeak/-/jackspeak-3.4.3.tgz",
+      "integrity": "sha512-OGlZQpz2yfahA/Rd1Y8Cd9SIEsqvXkLVoSw/cgwhnhFMDbsQFeZYoJJ7bIZBS9BcamUW96asq/npPWugM+RQBw==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "optional": true,
+      "dependencies": {
+        "@isaacs/cliui": "^8.0.2"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      },
+      "optionalDependencies": {
+        "@pkgjs/parseargs": "^0.11.0"
+      }
+    },
     "node_modules/jose": {
       "version": "5.9.6",
-      "resolved": "https://registry.npmjs.org/jose/-/jose-5.9.6.tgz",
-      "integrity": "sha512-AMlnetc9+CV9asI19zHmrgS/WYsWUwCn2R7RzlbJWD7F9eWYUTGyBmU9o6PxngtLGOiDGPRu+Uc4fhKzbpteZQ==",
       "license": "MIT",
       "funding": {
         "url": "https://github.com/sponsors/panva"
@@ -2532,36 +3381,51 @@
     },
     "node_modules/js-tokens": {
       "version": "9.0.1",
-      "resolved": "https://registry.npmjs.org/js-tokens/-/js-tokens-9.0.1.tgz",
-      "integrity": "sha512-mxa9E9ITFOt0ban3j6L5MpjwegGz6lBQmM1IJkWeBZGcMxto50+eWdjC/52xDbS2vy0k7vIMK0Fe2wfL9OQSpQ==",
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/js-yaml": {
+      "version": "4.1.1",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz",
+      "integrity": "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "argparse": "^2.0.1"
+      },
+      "bin": {
+        "js-yaml": "bin/js-yaml.js"
+      }
+    },
     "node_modules/json-buffer": {
       "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/json-buffer/-/json-buffer-3.0.1.tgz",
-      "integrity": "sha512-4bV5BfR2mqfQTJm+V5tPPdf+ZpuhiIvTuAB5g8kcrXOZpTT/QwwVRWBywX1ozr6lEuPdbHxwaJlm9G6mI2sfSQ==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/json-schema-traverse": {
       "version": "0.4.1",
-      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-0.4.1.tgz",
-      "integrity": "sha512-xbbCH5dCYU5T8LcEhhuh7HJ88HXuW3qsI3Y0zOZFKfZEHcpWiHU/Jxzk629Brsab/mMiHQti9wMP+845RPe3Vg==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/json-stable-stringify-without-jsonify": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/json-stable-stringify-without-jsonify/-/json-stable-stringify-without-jsonify-1.0.1.tgz",
-      "integrity": "sha512-Bdboy+l7tA3OGW6FjyFHWkP5LuByj1Tk33Ljyq0axyzdk9//JSi2u3fP1QSmd1KNwq6VOKYGlAu87CisVir6Pw==",
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/keytar": {
+      "version": "7.9.0",
+      "resolved": "https://registry.npmjs.org/keytar/-/keytar-7.9.0.tgz",
+      "integrity": "sha512-VPD8mtVtm5JNtA2AErl6Chp06JBfy7diFQ7TQQhdpWOl6MrCRB+eRbvAZUsbGQS9kiMq0coJsy0W0vHpDCkWsQ==",
+      "hasInstallScript": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "node-addon-api": "^4.3.0",
+        "prebuild-install": "^7.0.1"
+      }
+    },
     "node_modules/keyv": {
       "version": "4.5.4",
-      "resolved": "https://registry.npmjs.org/keyv/-/keyv-4.5.4.tgz",
-      "integrity": "sha512-oxVHkHR/EJf2CNXnWxRLW6mg7JyCCUcG0DtEGmL2ctUo1PNTin1PUil+r/+4r5MpVgC/fn1kjsx7mjSujKqIpw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2570,8 +3434,6 @@
     },
     "node_modules/levn": {
       "version": "0.4.1",
-      "resolved": "https://registry.npmjs.org/levn/-/levn-0.4.1.tgz",
-      "integrity": "sha512-+bT2uH4E5LGE7h/n3evcS/sQlJXCpIp6ym8OWJ5eV6+67Dsql/LaaT7qJBAt2rzfoa/5QBGBhxDix1dMt2kQKQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2582,10 +3444,26 @@
         "node": ">= 0.8.0"
       }
     },
+    "node_modules/libxmljs2": {
+      "version": "0.37.0",
+      "resolved": "https://registry.npmjs.org/libxmljs2/-/libxmljs2-0.37.0.tgz",
+      "integrity": "sha512-Xb78V8GZouoZFrq8cCwx7+G3WYOcJG0xb3YUbweSyE4z2EIrQCZMr3Ye/dHn4mESs6YxUMeQeUZm5IXg+iLHog==",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "bindings": "~1.5.0",
+        "nan": "~2.22.2",
+        "node-gyp": "^11.2.0",
+        "prebuild-install": "^7.1.3"
+      },
+      "engines": {
+        "node": ">=22"
+      }
+    },
     "node_modules/lint-staged": {
       "version": "16.2.7",
-      "resolved": "https://registry.npmjs.org/lint-staged/-/lint-staged-16.2.7.tgz",
-      "integrity": "sha512-lDIj4RnYmK7/kXMya+qJsmkRFkGolciXjrsZ6PC25GdTfWOAWetR0ZbsNXRAj1EHHImRSalc+whZFg56F5DVow==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2609,8 +3487,6 @@
     },
     "node_modules/listr2": {
       "version": "9.0.5",
-      "resolved": "https://registry.npmjs.org/listr2/-/listr2-9.0.5.tgz",
-      "integrity": "sha512-ME4Fb83LgEgwNw96RKNvKV4VTLuXfoKudAmm2lP8Kk87KaMK0/Xrx/aAkMWmT8mDb+3MlFDspfbCs7adjRxA2g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2627,8 +3503,6 @@
     },
     "node_modules/locate-path": {
       "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/locate-path/-/locate-path-6.0.0.tgz",
-      "integrity": "sha512-iPZK6eYjbxRu3uB4/WZ3EsEIMJFMqAoopl3R+zuq0UjcAm/MO6KCweDgPfP3elTztoKP3KtnVHxTn2NHBSDVUw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2643,8 +3517,6 @@
     },
     "node_modules/log-update": {
       "version": "6.1.0",
-      "resolved": "https://registry.npmjs.org/log-update/-/log-update-6.1.0.tgz",
-      "integrity": "sha512-9ie8ItPR6tjY5uYJh8K/Zrv/RMZ5VOlOWvtZdEHYSTFKZfIBPQa9tOAEeAWhd+AnIneLJ22w5fjOYtoutpWq5w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2661,10 +3533,16 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/lru-cache": {
+      "version": "10.4.3",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-10.4.3.tgz",
+      "integrity": "sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==",
+      "dev": true,
+      "license": "ISC",
+      "optional": true
+    },
     "node_modules/magic-string": {
       "version": "0.30.21",
-      "resolved": "https://registry.npmjs.org/magic-string/-/magic-string-0.30.21.tgz",
-      "integrity": "sha512-vd2F4YUyEXKGcLHoq+TEyCjxueSeHnFxyyjNp80yg0XV4vUhnDer/lvvlqM/arB5bXQN5K2/3oinyCRyx8T2CQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2673,8 +3551,6 @@
     },
     "node_modules/magicast": {
       "version": "0.5.1",
-      "resolved": "https://registry.npmjs.org/magicast/-/magicast-0.5.1.tgz",
-      "integrity": "sha512-xrHS24IxaLrvuo613F719wvOIv9xPHFWQHuvGUBmPnCA/3MQxKI3b+r7n1jAoDHmsbC5bRhTZYR77invLAxVnw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2685,8 +3561,6 @@
     },
     "node_modules/make-dir": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/make-dir/-/make-dir-4.0.0.tgz",
-      "integrity": "sha512-hXdUTZYIVOt1Ex//jAQi+wTZZpUpwBj/0QsOzqegb3rGMMeJiSEu5xLHnYfBrRV4RH2+OCSOO95Is/7x1WJ4bw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2699,10 +3573,32 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/make-fetch-happen": {
+      "version": "14.0.3",
+      "resolved": "https://registry.npmjs.org/make-fetch-happen/-/make-fetch-happen-14.0.3.tgz",
+      "integrity": "sha512-QMjGbFTP0blj97EeidG5hk/QhKQ3T4ICckQGLgz38QF7Vgbk6e6FTARN8KhKxyBbWn8R0HU+bnw8aSoFPD4qtQ==",
+      "dev": true,
+      "license": "ISC",
+      "optional": true,
+      "dependencies": {
+        "@npmcli/agent": "^3.0.0",
+        "cacache": "^19.0.1",
+        "http-cache-semantics": "^4.1.1",
+        "minipass": "^7.0.2",
+        "minipass-fetch": "^4.0.0",
+        "minipass-flush": "^1.0.5",
+        "minipass-pipeline": "^1.2.4",
+        "negotiator": "^1.0.0",
+        "proc-log": "^5.0.0",
+        "promise-retry": "^2.0.1",
+        "ssri": "^12.0.0"
+      },
+      "engines": {
+        "node": "^18.17.0 || >=20.5.0"
+      }
+    },
     "node_modules/micromatch": {
       "version": "4.0.8",
-      "resolved": "https://registry.npmjs.org/micromatch/-/micromatch-4.0.8.tgz",
-      "integrity": "sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2715,8 +3611,6 @@
     },
     "node_modules/mimic-function": {
       "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/mimic-function/-/mimic-function-5.0.1.tgz",
-      "integrity": "sha512-VP79XUPxV2CigYP3jWwAUFSku2aKqBH7uTAapFWCBqutsbmDo96KY5o8uh6U+/YSIn5OxJnXp73beVkpqMIGhA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -2726,10 +3620,21 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/mimic-response": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/mimic-response/-/mimic-response-3.1.0.tgz",
+      "integrity": "sha512-z0yWI+4FDrrweS8Zmt4Ej5HdJmky15+L2e6Wgn3+iK5fWzb6T3fhNFq2+MeTRb064c6Wr4N/wv0DzQTjNzHNGQ==",
+      "license": "MIT",
+      "optional": true,
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/minimatch": {
       "version": "10.2.4",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.4.tgz",
-      "integrity": "sha512-oRjTw/97aTBN0RHbYCdtF1MQfvusSIBQM0IZEgzl6426+8jSC0nF1a/GmnVLpfB9yyr6g6FTqWqiZVbxrtaCIg==",
       "dev": true,
       "license": "BlueOak-1.0.0",
       "dependencies": {
@@ -2742,66 +3647,409 @@
         "url": "https://github.com/sponsors/isaacs"
       }
     },
-    "node_modules/mrmime": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/mrmime/-/mrmime-2.0.1.tgz",
-      "integrity": "sha512-Y3wQdFg2Va6etvQ5I82yUhGdsKrcYox6p7FfL1LbK2J4V01F9TGlepTIhnK24t7koZibmg82KGglhA1XK5IsLQ==",
-      "dev": true,
+    "node_modules/minimist": {
+      "version": "1.2.8",
+      "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.8.tgz",
+      "integrity": "sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==",
       "license": "MIT",
+      "optional": true,
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/minipass": {
+      "version": "7.1.3",
+      "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.3.tgz",
+      "integrity": "sha512-tEBHqDnIoM/1rXME1zgka9g6Q2lcoCkxHLuc7ODJ5BxbP5d4c2Z5cGgtXAku59200Cx7diuHTOYfSBD8n6mm8A==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "optional": true,
       "engines": {
-        "node": ">=10"
+        "node": ">=16 || 14 >=14.17"
       }
     },
-    "node_modules/ms": {
-      "version": "2.1.3",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
-      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
+    "node_modules/minipass-collect": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/minipass-collect/-/minipass-collect-2.0.1.tgz",
+      "integrity": "sha512-D7V8PO9oaz7PWGLbCACuI1qEOsq7UKfLotx/C0Aet43fCUB/wfQ7DYeq2oR/svFJGYDHPr38SHATeaj/ZoKHKw==",
       "dev": true,
-      "license": "MIT"
+      "license": "ISC",
+      "optional": true,
+      "dependencies": {
+        "minipass": "^7.0.3"
+      },
+      "engines": {
+        "node": ">=16 || 14 >=14.17"
+      }
     },
-    "node_modules/nano-spawn": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/nano-spawn/-/nano-spawn-2.0.0.tgz",
-      "integrity": "sha512-tacvGzUY5o2D8CBh2rrwxyNojUsZNU2zjNTzKQrkgGJQTbGAfArVWXSKMBokBeeg6C7OLRGUEyoFlYbfeWQIqw==",
+    "node_modules/minipass-fetch": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/minipass-fetch/-/minipass-fetch-4.0.1.tgz",
+      "integrity": "sha512-j7U11C5HXigVuutxebFadoYBbd7VSdZWggSe64NVdvWNBqGAiXPL2QVCehjmw7lY1oF9gOllYbORh+hiNgfPgQ==",
       "dev": true,
       "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "minipass": "^7.0.3",
+        "minipass-sized": "^1.0.3",
+        "minizlib": "^3.0.1"
+      },
       "engines": {
-        "node": ">=20.17"
+        "node": "^18.17.0 || >=20.5.0"
       },
-      "funding": {
-        "url": "https://github.com/sindresorhus/nano-spawn?sponsor=1"
+      "optionalDependencies": {
+        "encoding": "^0.1.13"
       }
     },
-    "node_modules/nanoid": {
-      "version": "3.3.11",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.11.tgz",
-      "integrity": "sha512-N8SpfPUnUp1bK+PMYW8qSWdl9U+wwNWI4QKxOYDy9JAro3WMX7p2OeVRF9v+347pnakNevPmiHhNmZ2HbFA76w==",
+    "node_modules/minipass-flush": {
+      "version": "1.0.5",
+      "resolved": "https://registry.npmjs.org/minipass-flush/-/minipass-flush-1.0.5.tgz",
+      "integrity": "sha512-JmQSYYpPUqX5Jyn1mXaRwOda1uQ8HP5KAT/oDSLCzt1BYRhQU0/hDtsB1ufZfEEzMZ9aAVmsBw8+FWsIXlClWw==",
       "dev": true,
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/ai"
-        }
-      ],
-      "license": "MIT",
-      "bin": {
-        "nanoid": "bin/nanoid.cjs"
+      "license": "ISC",
+      "optional": true,
+      "dependencies": {
+        "minipass": "^3.0.0"
       },
       "engines": {
-        "node": "^10 || ^12 || ^13.7 || ^14 || >=15.0.1"
+        "node": ">= 8"
       }
     },
-    "node_modules/natural-compare": {
-      "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/natural-compare/-/natural-compare-1.4.0.tgz",
-      "integrity": "sha512-OWND8ei3VtNC9h7V60qff3SVobHr996CTwgxubgyQYEpg290h9J0buyECNNJexkFm5sOajh5G116RYA1c8ZMSw==",
+    "node_modules/minipass-flush/node_modules/minipass": {
+      "version": "3.3.6",
+      "resolved": "https://registry.npmjs.org/minipass/-/minipass-3.3.6.tgz",
+      "integrity": "sha512-DxiNidxSEK+tHG6zOIklvNOwm3hvCrbUrdtzY74U6HKTJxvIDfOUL5W5P2Ghd3DTkhhKPYGqeNUIh5qcM4YBfw==",
       "dev": true,
-      "license": "MIT"
+      "license": "ISC",
+      "optional": true,
+      "dependencies": {
+        "yallist": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
     },
-    "node_modules/obug": {
+    "node_modules/minipass-flush/node_modules/yallist": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz",
+      "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==",
+      "dev": true,
+      "license": "ISC",
+      "optional": true
+    },
+    "node_modules/minipass-pipeline": {
+      "version": "1.2.4",
+      "resolved": "https://registry.npmjs.org/minipass-pipeline/-/minipass-pipeline-1.2.4.tgz",
+      "integrity": "sha512-xuIq7cIOt09RPRJ19gdi4b+RiNvDFYe5JH+ggNvBqGqpQXcru3PcRmOZuHBKWK1Txf9+cQ+HMVN4d6z46LZP7A==",
+      "dev": true,
+      "license": "ISC",
+      "optional": true,
+      "dependencies": {
+        "minipass": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/minipass-pipeline/node_modules/minipass": {
+      "version": "3.3.6",
+      "resolved": "https://registry.npmjs.org/minipass/-/minipass-3.3.6.tgz",
+      "integrity": "sha512-DxiNidxSEK+tHG6zOIklvNOwm3hvCrbUrdtzY74U6HKTJxvIDfOUL5W5P2Ghd3DTkhhKPYGqeNUIh5qcM4YBfw==",
+      "dev": true,
+      "license": "ISC",
+      "optional": true,
+      "dependencies": {
+        "yallist": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/minipass-pipeline/node_modules/yallist": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz",
+      "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==",
+      "dev": true,
+      "license": "ISC",
+      "optional": true
+    },
+    "node_modules/minipass-sized": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/minipass-sized/-/minipass-sized-1.0.3.tgz",
+      "integrity": "sha512-MbkQQ2CTiBMlA2Dm/5cY+9SWFEN8pzzOXi6rlM5Xxq0Yqbda5ZQy9sU75a673FE9ZK0Zsbr6Y5iP6u9nktfg2g==",
+      "dev": true,
+      "license": "ISC",
+      "optional": true,
+      "dependencies": {
+        "minipass": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/minipass-sized/node_modules/minipass": {
+      "version": "3.3.6",
+      "resolved": "https://registry.npmjs.org/minipass/-/minipass-3.3.6.tgz",
+      "integrity": "sha512-DxiNidxSEK+tHG6zOIklvNOwm3hvCrbUrdtzY74U6HKTJxvIDfOUL5W5P2Ghd3DTkhhKPYGqeNUIh5qcM4YBfw==",
+      "dev": true,
+      "license": "ISC",
+      "optional": true,
+      "dependencies": {
+        "yallist": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/minipass-sized/node_modules/yallist": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz",
+      "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==",
+      "dev": true,
+      "license": "ISC",
+      "optional": true
+    },
+    "node_modules/minizlib": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/minizlib/-/minizlib-3.1.0.tgz",
+      "integrity": "sha512-KZxYo1BUkWD2TVFLr0MQoM8vUUigWD3LlD83a/75BqC+4qE0Hb1Vo5v1FgcfaNXvfXzr+5EhQ6ing/CaBijTlw==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "minipass": "^7.1.2"
+      },
+      "engines": {
+        "node": ">= 18"
+      }
+    },
+    "node_modules/mkdirp-classic": {
+      "version": "0.5.3",
+      "resolved": "https://registry.npmjs.org/mkdirp-classic/-/mkdirp-classic-0.5.3.tgz",
+      "integrity": "sha512-gKLcREMhtuZRwRAfqP3RFW+TK4JqApVBtOIftVgjuABpAtpxhPGaDcfvbhNvD0B8iD1oUr/txX35NjcaY6Ns/A==",
+      "license": "MIT",
+      "optional": true
+    },
+    "node_modules/moo": {
+      "version": "0.5.3",
+      "resolved": "https://registry.npmjs.org/moo/-/moo-0.5.3.tgz",
+      "integrity": "sha512-m2fmM2dDm7GZQsY7KK2cme8agi+AAljILjQnof7p1ZMDe6dQ4bdnSMx0cPppudoeNv5hEFQirN6u+O4fDE0IWA==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "optional": true
+    },
+    "node_modules/mrmime": {
+      "version": "2.0.1",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/ms": {
+      "version": "2.1.3",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/nan": {
+      "version": "2.22.2",
+      "resolved": "https://registry.npmjs.org/nan/-/nan-2.22.2.tgz",
+      "integrity": "sha512-DANghxFkS1plDdRsX0X9pm0Z6SJNN6gBdtXfanwoZ8hooC5gosGFSBGRYHUVPz1asKA/kMRqDRdHrluZ61SpBQ==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true
+    },
+    "node_modules/nano-spawn": {
+      "version": "2.0.0",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=20.17"
+      },
+      "funding": {
+        "url": "https://github.com/sindresorhus/nano-spawn?sponsor=1"
+      }
+    },
+    "node_modules/nanoid": {
+      "version": "3.3.11",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "MIT",
+      "bin": {
+        "nanoid": "bin/nanoid.cjs"
+      },
+      "engines": {
+        "node": "^10 || ^12 || ^13.7 || ^14 || >=15.0.1"
+      }
+    },
+    "node_modules/napi-build-utils": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/napi-build-utils/-/napi-build-utils-2.0.0.tgz",
+      "integrity": "sha512-GEbrYkbfF7MoNaoh2iGG84Mnf/WZfB0GdGEsM8wz7Expx/LlWf5U8t9nvJKXSp3qr5IsEbK04cBGhol/KwOsWA==",
+      "license": "MIT",
+      "optional": true
+    },
+    "node_modules/natural-compare": {
+      "version": "1.4.0",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/nearley": {
+      "version": "2.20.1",
+      "resolved": "https://registry.npmjs.org/nearley/-/nearley-2.20.1.tgz",
+      "integrity": "sha512-+Mc8UaAebFzgV+KpI5n7DasuuQCHA89dmwm7JXw3TV43ukfNQ9DnBH3Mdb2g/I4Fdxc26pwimBWvjIw0UAILSQ==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "commander": "^2.19.0",
+        "moo": "^0.5.0",
+        "railroad-diagrams": "^1.0.0",
+        "randexp": "0.4.6"
+      },
+      "bin": {
+        "nearley-railroad": "bin/nearley-railroad.js",
+        "nearley-test": "bin/nearley-test.js",
+        "nearley-unparse": "bin/nearley-unparse.js",
+        "nearleyc": "bin/nearleyc.js"
+      },
+      "funding": {
+        "type": "individual",
+        "url": "https://nearley.js.org/#give-to-nearley"
+      }
+    },
+    "node_modules/nearley/node_modules/commander": {
+      "version": "2.20.3",
+      "resolved": "https://registry.npmjs.org/commander/-/commander-2.20.3.tgz",
+      "integrity": "sha512-GpVkmM8vF2vQUkj2LvZmD35JxeJOLCwJ9cUkugyk2nuhbv3+mJvpLYYt+0+USMxE+oj+ey/lJEnhZw75x/OMcQ==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true
+    },
+    "node_modules/negotiator": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/negotiator/-/negotiator-1.0.0.tgz",
+      "integrity": "sha512-8Ofs/AUQh8MaEcrlq5xOX0CQ9ypTF5dl78mjlMNfOK08fzpgTHQRQPBxcPlEtIw0yRpws+Zo/3r+5WRby7u3Gg==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/node-abi": {
+      "version": "3.87.0",
+      "resolved": "https://registry.npmjs.org/node-abi/-/node-abi-3.87.0.tgz",
+      "integrity": "sha512-+CGM1L1CgmtheLcBuleyYOn7NWPVu0s0EJH2C4puxgEZb9h8QpR9G2dBfZJOAUhi7VQxuBPMd0hiISWcTyiYyQ==",
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "semver": "^7.3.5"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/node-addon-api": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/node-addon-api/-/node-addon-api-4.3.0.tgz",
+      "integrity": "sha512-73sE9+3UaLYYFmDsFZnqCInzPyh3MqIwZO9cw58yIqAZhONrrabrYyYe3TuIqtIiOuTXVhsGau8hcrhhwSsDIQ==",
+      "license": "MIT",
+      "optional": true
+    },
+    "node_modules/node-gyp": {
+      "version": "11.5.0",
+      "resolved": "https://registry.npmjs.org/node-gyp/-/node-gyp-11.5.0.tgz",
+      "integrity": "sha512-ra7Kvlhxn5V9Slyus0ygMa2h+UqExPqUIkfk7Pc8QTLT956JLSy51uWFwHtIYy0vI8cB4BDhc/S03+880My/LQ==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "env-paths": "^2.2.0",
+        "exponential-backoff": "^3.1.1",
+        "graceful-fs": "^4.2.6",
+        "make-fetch-happen": "^14.0.3",
+        "nopt": "^8.0.0",
+        "proc-log": "^5.0.0",
+        "semver": "^7.3.5",
+        "tar": "^7.4.3",
+        "tinyglobby": "^0.2.12",
+        "which": "^5.0.0"
+      },
+      "bin": {
+        "node-gyp": "bin/node-gyp.js"
+      },
+      "engines": {
+        "node": "^18.17.0 || >=20.5.0"
+      }
+    },
+    "node_modules/node-gyp/node_modules/isexe": {
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/isexe/-/isexe-3.1.5.tgz",
+      "integrity": "sha512-6B3tLtFqtQS4ekarvLVMZ+X+VlvQekbe4taUkf/rhVO3d/h0M2rfARm/pXLcPEsjjMsFgrFgSrhQIxcSVrBz8w==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "optional": true,
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/node-gyp/node_modules/which": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/which/-/which-5.0.0.tgz",
+      "integrity": "sha512-JEdGzHwwkrbWoGOlIHqQ5gtprKGOenpDHpxE9zVR1bWbOtYRyPPHMe9FaP6x61CmNaTThSkb0DAJte5jD+DmzQ==",
+      "dev": true,
+      "license": "ISC",
+      "optional": true,
+      "dependencies": {
+        "isexe": "^3.1.1"
+      },
+      "bin": {
+        "node-which": "bin/which.js"
+      },
+      "engines": {
+        "node": "^18.17.0 || >=20.5.0"
+      }
+    },
+    "node_modules/nopt": {
+      "version": "8.1.0",
+      "resolved": "https://registry.npmjs.org/nopt/-/nopt-8.1.0.tgz",
+      "integrity": "sha512-ieGu42u/Qsa4TFktmaKEwM6MQH0pOWnaB3htzh0JRtx84+Mebc0cbZYN5bC+6WTZ4+77xrL9Pn5m7CV6VIkV7A==",
+      "dev": true,
+      "license": "ISC",
+      "optional": true,
+      "dependencies": {
+        "abbrev": "^3.0.0"
+      },
+      "bin": {
+        "nopt": "bin/nopt.js"
+      },
+      "engines": {
+        "node": "^18.17.0 || >=20.5.0"
+      }
+    },
+    "node_modules/normalize-package-data": {
+      "version": "8.0.0",
+      "resolved": "https://registry.npmjs.org/normalize-package-data/-/normalize-package-data-8.0.0.tgz",
+      "integrity": "sha512-RWk+PI433eESQ7ounYxIp67CYuVsS1uYSonX3kA6ps/3LWfjVQa/ptEg6Y3T6uAMq1mWpX9PQ+qx+QaHpsc7gQ==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "dependencies": {
+        "hosted-git-info": "^9.0.0",
+        "semver": "^7.3.5",
+        "validate-npm-package-license": "^3.0.4"
+      },
+      "engines": {
+        "node": "^20.17.0 || >=22.9.0"
+      }
+    },
+    "node_modules/obug": {
       "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/obug/-/obug-2.1.1.tgz",
-      "integrity": "sha512-uTqF9MuPraAQ+IsnPf366RG4cP9RtUi7MLO1N3KEc+wb0a6yKpeL0lmk2IB1jY5KHPAlTc6T/JRdC/YqxHNwkQ==",
       "dev": true,
       "funding": [
         "https://github.com/sponsors/sxzz",
@@ -2809,10 +4057,18 @@
       ],
       "license": "MIT"
     },
+    "node_modules/once": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
+      "integrity": "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==",
+      "license": "ISC",
+      "optional": true,
+      "dependencies": {
+        "wrappy": "1"
+      }
+    },
     "node_modules/onetime": {
       "version": "7.0.0",
-      "resolved": "https://registry.npmjs.org/onetime/-/onetime-7.0.0.tgz",
-      "integrity": "sha512-VXJjc87FScF88uafS3JllDgvAm+c/Slfz06lorj2uAY34rlUu0Nt+v8wreiImcrgAjjIHp1rXpTDlLOGw29WwQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2827,8 +4083,6 @@
     },
     "node_modules/optionator": {
       "version": "0.9.4",
-      "resolved": "https://registry.npmjs.org/optionator/-/optionator-0.9.4.tgz",
-      "integrity": "sha512-6IpQ7mKUxRcZNLIObR0hz7lxsapSSIYNZJwXPGeF0mTVqGKFIXj1DQcMoT22S3ROcLyY/rz0PWaWZ9ayWmad9g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2845,8 +4099,6 @@
     },
     "node_modules/p-limit": {
       "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/p-limit/-/p-limit-3.1.0.tgz",
-      "integrity": "sha512-TYOanM3wGwNGsZN2cVTYPArw454xnXj5qmWF1bEoAc4+cU/ol7GVh7odevjp1FNHduHc3KZMcFduxU5Xc6uJRQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2861,8 +4113,6 @@
     },
     "node_modules/p-locate": {
       "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/p-locate/-/p-locate-5.0.0.tgz",
-      "integrity": "sha512-LaNjtRWUBY++zB5nE/NwcaoMylSPk+S+ZHNB1TzdbMJMny6dynpAGt7X/tl/QYq3TIeE6nxHppbo2LGymrG5Pw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2875,10 +4125,37 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/p-map": {
+      "version": "7.0.4",
+      "resolved": "https://registry.npmjs.org/p-map/-/p-map-7.0.4.tgz",
+      "integrity": "sha512-tkAQEw8ysMzmkhgw8k+1U/iPhWNhykKnSk4Rd5zLoPJCuJaGRPo6YposrZgaxHKzDHdDWWZvE/Sk7hsL2X/CpQ==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/package-json-from-dist": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/package-json-from-dist/-/package-json-from-dist-1.0.1.tgz",
+      "integrity": "sha512-UEZIS3/by4OC8vL3P2dTXRETpebLI2NiI5vIrjaD/5UtrkFX/tNbwjTSRAGC/+7CAo2pIcBaRgWmcBBHcsaCIw==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "optional": true
+    },
+    "node_modules/packageurl-js": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/packageurl-js/-/packageurl-js-2.0.1.tgz",
+      "integrity": "sha512-N5ixXjzTy4QDQH0Q9YFjqIWd6zH6936Djpl2m9QNFmDv5Fum8q8BjkpAcHNMzOFE0IwQrFhJWex3AN6kS0OSwg==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/path-exists": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/path-exists/-/path-exists-4.0.0.tgz",
-      "integrity": "sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -2887,32 +4164,42 @@
     },
     "node_modules/path-key": {
       "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz",
-      "integrity": "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==",
       "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=8"
       }
     },
+    "node_modules/path-scurry": {
+      "version": "1.11.1",
+      "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-1.11.1.tgz",
+      "integrity": "sha512-Xa4Nw17FS9ApQFJ9umLiJS4orGjm7ZzwUrwamcGQuHSzDyth9boKDaycYdDcZDuqYATXw4HFXgaqWTctW/v1HA==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "optional": true,
+      "dependencies": {
+        "lru-cache": "^10.2.0",
+        "minipass": "^5.0.0 || ^6.0.2 || ^7.0.0"
+      },
+      "engines": {
+        "node": ">=16 || 14 >=14.18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
     "node_modules/pathe": {
       "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/pathe/-/pathe-2.0.3.tgz",
-      "integrity": "sha512-WUjGcAqP1gQacoQe+OBJsFA7Ld4DyXuUIjZ5cc75cLHvJ7dtNsTugphxIADwspS+AraAUePCKrSVtPLFj/F88w==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/picocolors": {
       "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz",
-      "integrity": "sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==",
       "dev": true,
       "license": "ISC"
     },
     "node_modules/picomatch": {
       "version": "2.3.1",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.1.tgz",
-      "integrity": "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -2924,8 +4211,6 @@
     },
     "node_modules/pidtree": {
       "version": "0.6.0",
-      "resolved": "https://registry.npmjs.org/pidtree/-/pidtree-0.6.0.tgz",
-      "integrity": "sha512-eG2dWTVw5bzqGRztnHExczNxt5VGsE6OwTeCG3fdUf9KBsZzO3R5OIIIzWR+iZA0NtZ+RDVdaoE2dK1cn6jH4g==",
       "dev": true,
       "license": "MIT",
       "bin": {
@@ -2937,8 +4222,6 @@
     },
     "node_modules/postcss": {
       "version": "8.5.6",
-      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.6.tgz",
-      "integrity": "sha512-3Ybi1tAuwAP9s0r1UQ2J4n5Y0G05bJkpUIO0/bI9MhwmD70S5aTWbXGBwxHrelT+XM1k6dM0pk+SwNkpTRN7Pg==",
       "dev": true,
       "funding": [
         {
@@ -2964,20 +4247,81 @@
         "node": "^10 || ^12 || >=14"
       }
     },
+    "node_modules/prebuild-install": {
+      "version": "7.1.3",
+      "resolved": "https://registry.npmjs.org/prebuild-install/-/prebuild-install-7.1.3.tgz",
+      "integrity": "sha512-8Mf2cbV7x1cXPUILADGI3wuhfqWvtiLA1iclTDbFRZkgRQS0NqsPZphna9V+HyTEadheuPmjaJMsbzKQFOzLug==",
+      "deprecated": "No longer maintained. Please contact the author of the relevant native addon; alternatives are available.",
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "detect-libc": "^2.0.0",
+        "expand-template": "^2.0.3",
+        "github-from-package": "0.0.0",
+        "minimist": "^1.2.3",
+        "mkdirp-classic": "^0.5.3",
+        "napi-build-utils": "^2.0.0",
+        "node-abi": "^3.3.0",
+        "pump": "^3.0.0",
+        "rc": "^1.2.7",
+        "simple-get": "^4.0.0",
+        "tar-fs": "^2.0.0",
+        "tunnel-agent": "^0.6.0"
+      },
+      "bin": {
+        "prebuild-install": "bin.js"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
     "node_modules/prelude-ls": {
       "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/prelude-ls/-/prelude-ls-1.2.1.tgz",
-      "integrity": "sha512-vkcDPrRZo1QZLbn5RLGPpg/WmIQ65qoWWhcGKf/b5eplkkarX0m9z8ppCat4mlOqUsWpyNuYgO3VRyrYHSzX5g==",
       "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">= 0.8.0"
       }
     },
+    "node_modules/proc-log": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/proc-log/-/proc-log-5.0.0.tgz",
+      "integrity": "sha512-Azwzvl90HaF0aCz1JrDdXQykFakSSNPaPoiZ9fm5qJIMHioDZEi7OAdRwSm6rSoPtY3Qutnm3L7ogmg3dc+wbQ==",
+      "dev": true,
+      "license": "ISC",
+      "optional": true,
+      "engines": {
+        "node": "^18.17.0 || >=20.5.0"
+      }
+    },
+    "node_modules/promise-retry": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/promise-retry/-/promise-retry-2.0.1.tgz",
+      "integrity": "sha512-y+WKFlBR8BGXnsNlIHFGPZmyDf3DFMoLhaflAnyZgV6rG6xu+JwesTo2Q9R6XwYmtmwAFCkAk3e35jEdoeh/3g==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "err-code": "^2.0.2",
+        "retry": "^0.12.0"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/pump": {
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/pump/-/pump-3.0.4.tgz",
+      "integrity": "sha512-VS7sjc6KR7e1ukRFhQSY5LM2uBWAUPiOPa/A3mkKmiMwSmRFUITt0xuj+/lesgnCv+dPIEYlkzrcyXgquIHMcA==",
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "end-of-stream": "^1.1.0",
+        "once": "^1.3.1"
+      }
+    },
     "node_modules/punycode": {
       "version": "2.3.1",
-      "resolved": "https://registry.npmjs.org/punycode/-/punycode-2.3.1.tgz",
-      "integrity": "sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -2986,8 +4330,6 @@
     },
     "node_modules/pure-rand": {
       "version": "7.0.1",
-      "resolved": "https://registry.npmjs.org/pure-rand/-/pure-rand-7.0.1.tgz",
-      "integrity": "sha512-oTUZM/NAZS8p7ANR3SHh30kXB+zK2r2BPcEn/awJIbOvq82WoMN4p62AWWp3Hhw50G0xMsw1mhIBLqHw64EcNQ==",
       "dev": true,
       "funding": [
         {
@@ -3001,10 +4343,73 @@
       ],
       "license": "MIT"
     },
+    "node_modules/railroad-diagrams": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/railroad-diagrams/-/railroad-diagrams-1.0.0.tgz",
+      "integrity": "sha512-cz93DjNeLY0idrCNOH6PviZGRN9GJhsdm9hpn1YCS879fj4W+x5IFJhhkRZcwVgMmFF7R82UA/7Oh+R8lLZg6A==",
+      "dev": true,
+      "license": "CC0-1.0",
+      "optional": true
+    },
+    "node_modules/randexp": {
+      "version": "0.4.6",
+      "resolved": "https://registry.npmjs.org/randexp/-/randexp-0.4.6.tgz",
+      "integrity": "sha512-80WNmd9DA0tmZrw9qQa62GPPWfuXJknrmVmLcxvq4uZBdYqb1wYoKTmnlGUchvVWe0XiLupYkBoXVOxz3C8DYQ==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "discontinuous-range": "1.0.0",
+        "ret": "~0.1.10"
+      },
+      "engines": {
+        "node": ">=0.12"
+      }
+    },
+    "node_modules/rc": {
+      "version": "1.2.8",
+      "resolved": "https://registry.npmjs.org/rc/-/rc-1.2.8.tgz",
+      "integrity": "sha512-y3bGgqKj3QBdxLbLkomlohkvsA8gdAiUQlSBJnBhfn+BPxg4bc62d8TcBW15wavDfgexCgccckhcZvywyQYPOw==",
+      "license": "(BSD-2-Clause OR MIT OR Apache-2.0)",
+      "optional": true,
+      "dependencies": {
+        "deep-extend": "^0.6.0",
+        "ini": "~1.3.0",
+        "minimist": "^1.2.0",
+        "strip-json-comments": "~2.0.1"
+      },
+      "bin": {
+        "rc": "cli.js"
+      }
+    },
+    "node_modules/readable-stream": {
+      "version": "3.6.2",
+      "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-3.6.2.tgz",
+      "integrity": "sha512-9u/sniCrY3D5WdsERHzHE4G2YCXqoG5FTHUiCC4SIbr6XcLZBY05ya9EKjYek9O5xOAwjGq+1JdGBAS7Q9ScoA==",
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "inherits": "^2.0.3",
+        "string_decoder": "^1.1.1",
+        "util-deprecate": "^1.0.1"
+      },
+      "engines": {
+        "node": ">= 6"
+      }
+    },
+    "node_modules/require-from-string": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/require-from-string/-/require-from-string-2.0.2.tgz",
+      "integrity": "sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
     "node_modules/restore-cursor": {
       "version": "5.1.0",
-      "resolved": "https://registry.npmjs.org/restore-cursor/-/restore-cursor-5.1.0.tgz",
-      "integrity": "sha512-oMA2dcrw6u0YfxJQXm342bFKX/E4sG9rbTzO9ptUcR/e8A33cHuvStiYOwH7fszkZlZ1z/ta9AAoPk2F4qIOHA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3018,17 +4423,35 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/ret": {
+      "version": "0.1.15",
+      "resolved": "https://registry.npmjs.org/ret/-/ret-0.1.15.tgz",
+      "integrity": "sha512-TTlYpa+OL+vMMNG24xSlQGEJ3B/RzEfUlLct7b5G/ytav+wPrplCpVMFuwzXbkecJrb6IYo1iFb0S9v37754mg==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "engines": {
+        "node": ">=0.12"
+      }
+    },
+    "node_modules/retry": {
+      "version": "0.12.0",
+      "resolved": "https://registry.npmjs.org/retry/-/retry-0.12.0.tgz",
+      "integrity": "sha512-9LkiTwjUh6rT555DtE9rTX+BKByPfrMzEAtnlEtdEwr3Nkffwiihqe2bWADg+OQRjt9gl6ICdmB/ZFDCGAtSow==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "engines": {
+        "node": ">= 4"
+      }
+    },
     "node_modules/rfdc": {
       "version": "1.4.1",
-      "resolved": "https://registry.npmjs.org/rfdc/-/rfdc-1.4.1.tgz",
-      "integrity": "sha512-q1b3N5QkRUWUl7iyylaaj3kOpIT0N2i9MqIEQXP73GVsN9cw3fdx8X63cEmWhJGi2PPCF23Ijp7ktmd39rawIA==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/rollup": {
       "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/rollup/-/rollup-4.59.0.tgz",
-      "integrity": "sha512-2oMpl67a3zCH9H79LeMcbDhXW/UmWG/y2zuqnF2jQq5uq9TbM9TVyXvA4+t+ne2IIkBdrLpAaRQAvo7YI/Yyeg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3070,11 +4493,49 @@
         "fsevents": "~2.3.2"
       }
     },
+    "node_modules/safe-buffer": {
+      "version": "5.2.1",
+      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz",
+      "integrity": "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT",
+      "optional": true
+    },
+    "node_modules/safer-buffer": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz",
+      "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true
+    },
+    "node_modules/schemes": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/schemes/-/schemes-1.4.0.tgz",
+      "integrity": "sha512-ImFy9FbCsQlVgnE3TCWmLPCFnVzx0lHL/l+umHplDqAKd0dzFpnS6lFZIpagBlYhKwzVmlV36ec0Y1XTu8JBAQ==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "extend": "^3.0.0"
+      }
+    },
     "node_modules/semver": {
       "version": "7.7.3",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.3.tgz",
-      "integrity": "sha512-SdsKMrI9TdgjdweUSR9MweHA4EJ8YxHn8DFaDisvhVlUOe4BF1tLD7GAj0lIqWVl+dPb/rExr0Btby5loQm20Q==",
-      "dev": true,
+      "devOptional": true,
       "license": "ISC",
       "bin": {
         "semver": "bin/semver.js"
@@ -3085,8 +4546,6 @@
     },
     "node_modules/shebang-command": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-2.0.0.tgz",
-      "integrity": "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3098,8 +4557,6 @@
     },
     "node_modules/shebang-regex": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/shebang-regex/-/shebang-regex-3.0.0.tgz",
-      "integrity": "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -3108,15 +4565,11 @@
     },
     "node_modules/siginfo": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/siginfo/-/siginfo-2.0.0.tgz",
-      "integrity": "sha512-ybx0WO1/8bSBLEWXZvEd7gMW3Sn3JFlW3TvX1nREbDLRNQNaeNN8WK0meBwPdAaOI7TtRRRJn/Es1zhrrCHu7g==",
       "dev": true,
       "license": "ISC"
     },
     "node_modules/signal-exit": {
       "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-4.1.0.tgz",
-      "integrity": "sha512-bzyZ1e88w9O1iNJbKnOlvYTrWPDl46O1bG0D3XInv+9tkPrxrN8jUUTiFlDkkmKWgn1M6CfIA13SuGqOa9Korw==",
       "dev": true,
       "license": "ISC",
       "engines": {
@@ -3126,10 +4579,55 @@
         "url": "https://github.com/sponsors/isaacs"
       }
     },
+    "node_modules/simple-concat": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/simple-concat/-/simple-concat-1.0.1.tgz",
+      "integrity": "sha512-cSFtAPtRhljv69IK0hTVZQ+OfE9nePi/rtJmw5UjHeVyVroEqJXP1sFztKUy1qU+xvz3u/sfYJLa947b7nAN2Q==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT",
+      "optional": true
+    },
+    "node_modules/simple-get": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/simple-get/-/simple-get-4.0.1.tgz",
+      "integrity": "sha512-brv7p5WgH0jmQJr1ZDDfKDOSeWWg+OVypG99A/5vYGPqJ6pxiaHLy8nxtFjBA7oMa01ebA9gfh1uMCFqOuXxvA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "decompress-response": "^6.0.0",
+        "once": "^1.3.1",
+        "simple-concat": "^1.0.0"
+      }
+    },
     "node_modules/sirv": {
       "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/sirv/-/sirv-3.0.2.tgz",
-      "integrity": "sha512-2wcC/oGxHis/BoHkkPwldgiPSYcpZK3JU28WoMVv55yHJgcZ8rlXvuG9iZggz+sU1d4bRgIGASwyWqjxu3FM0g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3138,67 +4636,184 @@
         "totalist": "^3.0.0"
       },
       "engines": {
-        "node": ">=18"
+        "node": ">=18"
+      }
+    },
+    "node_modules/slice-ansi": {
+      "version": "7.1.2",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "ansi-styles": "^6.2.1",
+        "is-fullwidth-code-point": "^5.0.0"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/slice-ansi?sponsor=1"
+      }
+    },
+    "node_modules/slice-ansi/node_modules/ansi-styles": {
+      "version": "6.2.3",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/smart-buffer": {
+      "version": "4.2.0",
+      "resolved": "https://registry.npmjs.org/smart-buffer/-/smart-buffer-4.2.0.tgz",
+      "integrity": "sha512-94hK0Hh8rPqQl2xXc3HsaBoOXKV20MToPkcXvwbISWLEs+64sBq5kFgn2kJDHb1Pry9yrP0dxrCI9RRci7RXKg==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "engines": {
+        "node": ">= 6.0.0",
+        "npm": ">= 3.0.0"
+      }
+    },
+    "node_modules/smtp-address-parser": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/smtp-address-parser/-/smtp-address-parser-1.1.0.tgz",
+      "integrity": "sha512-Gz11jbNU0plrReU9Sj7fmshSBxxJ9ShdD2q4ktHIHo/rpTH6lFyQoYHYKINPJtPe8aHFnsbtW46Ls0tCCBsIZg==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "nearley": "^2.20.1"
+      },
+      "engines": {
+        "node": ">=0.10"
       }
     },
-    "node_modules/slice-ansi": {
-      "version": "7.1.2",
-      "resolved": "https://registry.npmjs.org/slice-ansi/-/slice-ansi-7.1.2.tgz",
-      "integrity": "sha512-iOBWFgUX7caIZiuutICxVgX1SdxwAVFFKwt1EvMYYec/NWO5meOJ6K5uQxhrYBdQJne4KxiqZc+KptFOWFSI9w==",
+    "node_modules/socks": {
+      "version": "2.8.7",
+      "resolved": "https://registry.npmjs.org/socks/-/socks-2.8.7.tgz",
+      "integrity": "sha512-HLpt+uLy/pxB+bum/9DzAgiKS8CX1EvbWxI4zlmgGCExImLdiad2iCwXT5Z4c9c3Eq8rP2318mPW2c+QbtjK8A==",
       "dev": true,
       "license": "MIT",
+      "optional": true,
       "dependencies": {
-        "ansi-styles": "^6.2.1",
-        "is-fullwidth-code-point": "^5.0.0"
+        "ip-address": "^10.0.1",
+        "smart-buffer": "^4.2.0"
       },
       "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/slice-ansi?sponsor=1"
+        "node": ">= 10.0.0",
+        "npm": ">= 3.0.0"
       }
     },
-    "node_modules/slice-ansi/node_modules/ansi-styles": {
-      "version": "6.2.3",
-      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-6.2.3.tgz",
-      "integrity": "sha512-4Dj6M28JB+oAH8kFkTLUo+a2jwOFkuqb3yucU0CANcRRUbxS0cP0nZYCGjcc3BNXwRIsUVmDGgzawme7zvJHvg==",
+    "node_modules/socks-proxy-agent": {
+      "version": "8.0.5",
+      "resolved": "https://registry.npmjs.org/socks-proxy-agent/-/socks-proxy-agent-8.0.5.tgz",
+      "integrity": "sha512-HehCEsotFqbPW9sJ8WVYB6UbmIMv7kUUORIF2Nncq4VQvBfNBLibW9YZR5dlYCSUhwcD628pRllm7n+E+YTzJw==",
       "dev": true,
       "license": "MIT",
-      "engines": {
-        "node": ">=12"
+      "optional": true,
+      "dependencies": {
+        "agent-base": "^7.1.2",
+        "debug": "^4.3.4",
+        "socks": "^2.8.3"
       },
-      "funding": {
-        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      "engines": {
+        "node": ">= 14"
       }
     },
     "node_modules/source-map-js": {
       "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz",
-      "integrity": "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==",
       "dev": true,
       "license": "BSD-3-Clause",
       "engines": {
         "node": ">=0.10.0"
       }
     },
+    "node_modules/spdx-correct": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/spdx-correct/-/spdx-correct-3.2.0.tgz",
+      "integrity": "sha512-kN9dJbvnySHULIluDHy32WHRUu3Og7B9sbY7tsFLctQkIqnMh3hErYgdMjTYuqmcXX+lK5T1lnUt3G7zNswmZA==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "spdx-expression-parse": "^3.0.0",
+        "spdx-license-ids": "^3.0.0"
+      }
+    },
+    "node_modules/spdx-correct/node_modules/spdx-expression-parse": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/spdx-expression-parse/-/spdx-expression-parse-3.0.1.tgz",
+      "integrity": "sha512-cbqHunsQWnJNE6KhVSMsMeH5H/L9EpymbzqTQ3uLwNCLZ1Q481oWaofqH7nO6V07xlXwY6PhQdQ2IedWx/ZK4Q==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "spdx-exceptions": "^2.1.0",
+        "spdx-license-ids": "^3.0.0"
+      }
+    },
+    "node_modules/spdx-exceptions": {
+      "version": "2.5.0",
+      "resolved": "https://registry.npmjs.org/spdx-exceptions/-/spdx-exceptions-2.5.0.tgz",
+      "integrity": "sha512-PiU42r+xO4UbUS1buo3LPJkjlO7430Xn5SVAhdpzzsPHsjbYVflnnFdATgabnLude+Cqu25p6N+g2lw/PFsa4w==",
+      "dev": true,
+      "license": "CC-BY-3.0"
+    },
+    "node_modules/spdx-expression-parse": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/spdx-expression-parse/-/spdx-expression-parse-4.0.0.tgz",
+      "integrity": "sha512-Clya5JIij/7C6bRR22+tnGXbc4VKlibKSVj2iHvVeX5iMW7s1SIQlqu699JkODJJIhh/pUu8L0/VLh8xflD+LQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "spdx-exceptions": "^2.1.0",
+        "spdx-license-ids": "^3.0.0"
+      }
+    },
+    "node_modules/spdx-license-ids": {
+      "version": "3.0.23",
+      "resolved": "https://registry.npmjs.org/spdx-license-ids/-/spdx-license-ids-3.0.23.tgz",
+      "integrity": "sha512-CWLcCCH7VLu13TgOH+r8p1O/Znwhqv/dbb6lqWy67G+pT1kHmeD/+V36AVb/vq8QMIQwVShJ6Ssl5FPh0fuSdw==",
+      "dev": true,
+      "license": "CC0-1.0"
+    },
+    "node_modules/ssri": {
+      "version": "12.0.0",
+      "resolved": "https://registry.npmjs.org/ssri/-/ssri-12.0.0.tgz",
+      "integrity": "sha512-S7iGNosepx9RadX82oimUkvr0Ct7IjJbEbs4mJcTxst8um95J3sDYU1RBEOvdu6oL1Wek2ODI5i4MAw+dZ6cAQ==",
+      "dev": true,
+      "license": "ISC",
+      "optional": true,
+      "dependencies": {
+        "minipass": "^7.0.3"
+      },
+      "engines": {
+        "node": "^18.17.0 || >=20.5.0"
+      }
+    },
     "node_modules/stackback": {
       "version": "0.0.2",
-      "resolved": "https://registry.npmjs.org/stackback/-/stackback-0.0.2.tgz",
-      "integrity": "sha512-1XMJE5fQo1jGH6Y/7ebnwPOBEkIEnT4QF32d5R1+VXdXveM0IBMJt8zfaxX1P3QhVwrYe+576+jkANtSS2mBbw==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/std-env": {
       "version": "3.10.0",
-      "resolved": "https://registry.npmjs.org/std-env/-/std-env-3.10.0.tgz",
-      "integrity": "sha512-5GS12FdOZNliM5mAOxFRg7Ir0pWz8MdpYm6AY6VPkGpbA7ZzmbzNcBJQ0GPvvyWgcY7QAhCgf9Uy89I03faLkg==",
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/string_decoder": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.3.0.tgz",
+      "integrity": "sha512-hkRX8U1WjJFd8LsDJ2yQ/wWWxaopEsABU1XfkM8A+j0+85JAGppt16cr1Whg6KIbb4okU6Mql6BOj+uup/wKeA==",
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "safe-buffer": "~5.2.0"
+      }
+    },
     "node_modules/string-argv": {
       "version": "0.3.2",
-      "resolved": "https://registry.npmjs.org/string-argv/-/string-argv-0.3.2.tgz",
-      "integrity": "sha512-aqD2Q0144Z+/RqG52NeHEkZauTAUWJO8c6yTftGJKO3Tja5tUgIfmIl6kExvhtxSDP7fXB6DvzkfMpCd/F3G+Q==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -3207,8 +4822,6 @@
     },
     "node_modules/string-width": {
       "version": "8.1.0",
-      "resolved": "https://registry.npmjs.org/string-width/-/string-width-8.1.0.tgz",
-      "integrity": "sha512-Kxl3KJGb/gxkaUMOjRsQ8IrXiGW75O4E3RPjFIINOVH8AMl2SQ/yWdTzWwF3FevIX9LcMAjJW+GRwAlAbTSXdg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3222,10 +4835,69 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/string-width-cjs": {
+      "name": "string-width",
+      "version": "4.2.3",
+      "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
+      "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "emoji-regex": "^8.0.0",
+        "is-fullwidth-code-point": "^3.0.0",
+        "strip-ansi": "^6.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/string-width-cjs/node_modules/ansi-regex": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
+      "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/string-width-cjs/node_modules/emoji-regex": {
+      "version": "8.0.0",
+      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz",
+      "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true
+    },
+    "node_modules/string-width-cjs/node_modules/is-fullwidth-code-point": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-3.0.0.tgz",
+      "integrity": "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/string-width-cjs/node_modules/strip-ansi": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
+      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "ansi-regex": "^5.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
     "node_modules/strip-ansi": {
       "version": "7.1.2",
-      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-7.1.2.tgz",
-      "integrity": "sha512-gmBGslpoQJtgnMAvOVqGZpEz9dyoKTCzy2nfz/n8aIFhN/jCE/rCmcxabB6jOOHV+0WNnylOxaxBQPSvcWklhA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3238,10 +4910,44 @@
         "url": "https://github.com/chalk/strip-ansi?sponsor=1"
       }
     },
+    "node_modules/strip-ansi-cjs": {
+      "name": "strip-ansi",
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
+      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "ansi-regex": "^5.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/strip-ansi-cjs/node_modules/ansi-regex": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
+      "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/strip-json-comments": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/strip-json-comments/-/strip-json-comments-2.0.1.tgz",
+      "integrity": "sha512-4gB8na07fecVVkOI6Rs4e7T6NOTki5EmL7TUduTs6bu3EdnSycntVJ4re8kgZA+wx9IueI2Y11bfbgwtzuE0KQ==",
+      "license": "MIT",
+      "optional": true,
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
     "node_modules/supports-color": {
       "version": "7.2.0",
-      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
-      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3251,17 +4957,68 @@
         "node": ">=8"
       }
     },
+    "node_modules/tar": {
+      "version": "7.5.10",
+      "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.10.tgz",
+      "integrity": "sha512-8mOPs1//5q/rlkNSPcCegA6hiHJYDmSLEI8aMH/CdSQJNWztHC9WHNam5zdQlfpTwB9Xp7IBEsHfV5LKMJGVAw==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "optional": true,
+      "dependencies": {
+        "@isaacs/fs-minipass": "^4.0.0",
+        "chownr": "^3.0.0",
+        "minipass": "^7.1.2",
+        "minizlib": "^3.1.0",
+        "yallist": "^5.0.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/tar-fs": {
+      "version": "2.1.4",
+      "resolved": "https://registry.npmjs.org/tar-fs/-/tar-fs-2.1.4.tgz",
+      "integrity": "sha512-mDAjwmZdh7LTT6pNleZ05Yt65HC3E+NiQzl672vQG38jIrehtJk/J3mNwIg+vShQPcLF/LV7CMnDW6vjj6sfYQ==",
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "chownr": "^1.1.1",
+        "mkdirp-classic": "^0.5.2",
+        "pump": "^3.0.0",
+        "tar-stream": "^2.1.4"
+      }
+    },
+    "node_modules/tar-fs/node_modules/chownr": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/chownr/-/chownr-1.1.4.tgz",
+      "integrity": "sha512-jJ0bqzaylmJtVnNgzTeSOs8DPavpbYgEr/b0YL8/2GO3xJEhInFmhKMUnEJQjZumK7KXGFhUy89PrsJWlakBVg==",
+      "license": "ISC",
+      "optional": true
+    },
+    "node_modules/tar-stream": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/tar-stream/-/tar-stream-2.2.0.tgz",
+      "integrity": "sha512-ujeqbceABgwMZxEJnk2HDY2DlnUZ+9oEcb1KzTVfYHio0UE6dG71n60d8D2I4qNvleWrrXpmjpt7vZeF1LnMZQ==",
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "bl": "^4.0.3",
+        "end-of-stream": "^1.4.1",
+        "fs-constants": "^1.0.0",
+        "inherits": "^2.0.3",
+        "readable-stream": "^3.1.1"
+      },
+      "engines": {
+        "node": ">=6"
+      }
+    },
     "node_modules/tinybench": {
       "version": "2.9.0",
-      "resolved": "https://registry.npmjs.org/tinybench/-/tinybench-2.9.0.tgz",
-      "integrity": "sha512-0+DUvqWMValLmha6lr4kD8iAMK1HzV0/aKnCtWb9v9641TnP/MFb7Pc2bxoxQjTXAErryXVgUOfv2YqNllqGeg==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/tinyexec": {
       "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/tinyexec/-/tinyexec-1.0.2.tgz",
-      "integrity": "sha512-W/KYk+NFhkmsYpuHq5JykngiOCnxeVL8v8dFnqxSD8qEEdRfXk1SDM6JzNqcERbcGYj9tMrDQBYV9cjgnunFIg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -3270,8 +5027,6 @@
     },
     "node_modules/tinyglobby": {
       "version": "0.2.15",
-      "resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.15.tgz",
-      "integrity": "sha512-j2Zq4NyQYG5XMST4cbs02Ak8iJUdxRM0XI5QyxXuZOzKOINmWurp3smXu3y5wDcJrptwpSjgXHzIQxR0omXljQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3287,8 +5042,6 @@
     },
     "node_modules/tinyglobby/node_modules/fdir": {
       "version": "6.5.0",
-      "resolved": "https://registry.npmjs.org/fdir/-/fdir-6.5.0.tgz",
-      "integrity": "sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -3305,8 +5058,6 @@
     },
     "node_modules/tinyglobby/node_modules/picomatch": {
       "version": "4.0.3",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.3.tgz",
-      "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -3318,8 +5069,6 @@
     },
     "node_modules/tinyrainbow": {
       "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/tinyrainbow/-/tinyrainbow-3.0.3.tgz",
-      "integrity": "sha512-PSkbLUoxOFRzJYjjxHJt9xro7D+iilgMX/C9lawzVuYiIdcihh9DXmVibBe8lmcFrRi/VzlPjBxbN7rH24q8/Q==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -3328,8 +5077,6 @@
     },
     "node_modules/to-regex-range": {
       "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/to-regex-range/-/to-regex-range-5.0.1.tgz",
-      "integrity": "sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3341,8 +5088,6 @@
     },
     "node_modules/totalist": {
       "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/totalist/-/totalist-3.0.1.tgz",
-      "integrity": "sha512-sf4i37nQ2LBx4m3wB74y+ubopq6W/dIzXg0FDGjsYnZHVa1Da8FH853wlL2gtUhg+xJXjfk3kUZS3BRoQeoQBQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -3351,8 +5096,6 @@
     },
     "node_modules/ts-api-utils": {
       "version": "2.4.0",
-      "resolved": "https://registry.npmjs.org/ts-api-utils/-/ts-api-utils-2.4.0.tgz",
-      "integrity": "sha512-3TaVTaAv2gTiMB35i3FiGJaRfwb3Pyn/j3m/bfAvGe8FB7CF6u+LMYqYlDh7reQf7UNvoTvdfAqHGmPGOSsPmA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -3362,10 +5105,21 @@
         "typescript": ">=4.8.4"
       }
     },
+    "node_modules/tunnel-agent": {
+      "version": "0.6.0",
+      "resolved": "https://registry.npmjs.org/tunnel-agent/-/tunnel-agent-0.6.0.tgz",
+      "integrity": "sha512-McnNiV1l8RYeY8tBgEpuodCC1mLUdbSN+CYBL7kJsJNInOP8UjDDEwdk6Mw60vdLLrr5NHKZhMAOSrR2NZuQ+w==",
+      "license": "Apache-2.0",
+      "optional": true,
+      "dependencies": {
+        "safe-buffer": "^5.0.1"
+      },
+      "engines": {
+        "node": "*"
+      }
+    },
     "node_modules/type-check": {
       "version": "0.4.0",
-      "resolved": "https://registry.npmjs.org/type-check/-/type-check-0.4.0.tgz",
-      "integrity": "sha512-XleUoc9uwGXqjWwXaUTZAmzMcFZ5858QA2vvx1Ur5xIcixXIP+8LnFDgRplU30us6teqdlskFfu+ae4K79Ooew==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3377,8 +5131,6 @@
     },
     "node_modules/typescript": {
       "version": "5.9.3",
-      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
-      "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
       "dev": true,
       "license": "Apache-2.0",
       "bin": {
@@ -3391,8 +5143,6 @@
     },
     "node_modules/typescript-language-server": {
       "version": "5.1.3",
-      "resolved": "https://registry.npmjs.org/typescript-language-server/-/typescript-language-server-5.1.3.tgz",
-      "integrity": "sha512-r+pAcYtWdN8tKlYZPwiiHNA2QPjXnI02NrW5Sf2cVM3TRtuQ3V9EKKwOxqwaQ0krsaEXk/CbN90I5erBuf84Vg==",
       "dev": true,
       "license": "Apache-2.0",
       "bin": {
@@ -3404,25 +5154,76 @@
     },
     "node_modules/undici-types": {
       "version": "7.18.2",
-      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.18.2.tgz",
-      "integrity": "sha512-AsuCzffGHJybSaRrmr5eHr81mwJU3kjw6M+uprWvCXiNeN9SOGwQ3Jn8jb8m3Z6izVgknn1R0FTCEAP2QrLY/w==",
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/unique-filename": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/unique-filename/-/unique-filename-4.0.0.tgz",
+      "integrity": "sha512-XSnEewXmQ+veP7xX2dS5Q4yZAvO40cBN2MWkJ7D/6sW4Dg6wYBNwM1Vrnz1FhH5AdeLIlUXRI9e28z1YZi71NQ==",
+      "dev": true,
+      "license": "ISC",
+      "optional": true,
+      "dependencies": {
+        "unique-slug": "^5.0.0"
+      },
+      "engines": {
+        "node": "^18.17.0 || >=20.5.0"
+      }
+    },
+    "node_modules/unique-slug": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/unique-slug/-/unique-slug-5.0.0.tgz",
+      "integrity": "sha512-9OdaqO5kwqR+1kVgHAhsp5vPNU0hnxRa26rBFNfNgM7M6pNtgzeBn3s/xbyCQL3dcjzOatcef6UUHpB/6MaETg==",
+      "dev": true,
+      "license": "ISC",
+      "optional": true,
+      "dependencies": {
+        "imurmurhash": "^0.1.4"
+      },
+      "engines": {
+        "node": "^18.17.0 || >=20.5.0"
+      }
+    },
     "node_modules/uri-js": {
       "version": "4.4.1",
-      "resolved": "https://registry.npmjs.org/uri-js/-/uri-js-4.4.1.tgz",
-      "integrity": "sha512-7rKUyy33Q1yc98pQ1DAmLtwX109F7TIfWlW1Ydo8Wl1ii1SeHieeh0HHfPeL2fMXK6z0s8ecKs9frCuLJvndBg==",
       "dev": true,
       "license": "BSD-2-Clause",
       "dependencies": {
         "punycode": "^2.1.0"
       }
     },
+    "node_modules/util-deprecate": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/util-deprecate/-/util-deprecate-1.0.2.tgz",
+      "integrity": "sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==",
+      "license": "MIT",
+      "optional": true
+    },
+    "node_modules/validate-npm-package-license": {
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/validate-npm-package-license/-/validate-npm-package-license-3.0.4.tgz",
+      "integrity": "sha512-DpKm2Ui/xN7/HQKCtpZxoRWBhZ9Z0kqtygG8XCgNQ8ZlDnxuQmWhj566j8fN4Cu3/JmbhsDo7fcAJq4s9h27Ew==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "spdx-correct": "^3.0.0",
+        "spdx-expression-parse": "^3.0.0"
+      }
+    },
+    "node_modules/validate-npm-package-license/node_modules/spdx-expression-parse": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/spdx-expression-parse/-/spdx-expression-parse-3.0.1.tgz",
+      "integrity": "sha512-cbqHunsQWnJNE6KhVSMsMeH5H/L9EpymbzqTQ3uLwNCLZ1Q481oWaofqH7nO6V07xlXwY6PhQdQ2IedWx/ZK4Q==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "spdx-exceptions": "^2.1.0",
+        "spdx-license-ids": "^3.0.0"
+      }
+    },
     "node_modules/vite": {
       "version": "7.3.1",
-      "resolved": "https://registry.npmjs.org/vite/-/vite-7.3.1.tgz",
-      "integrity": "sha512-w+N7Hifpc3gRjZ63vYBXA56dvvRlNWRczTdmCBBa+CotUzAPf5b7YMdMR/8CQoeYE5LX3W4wj6RYTgonm1b9DA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3496,8 +5297,6 @@
     },
     "node_modules/vite/node_modules/fdir": {
       "version": "6.5.0",
-      "resolved": "https://registry.npmjs.org/fdir/-/fdir-6.5.0.tgz",
-      "integrity": "sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -3514,8 +5313,6 @@
     },
     "node_modules/vite/node_modules/picomatch": {
       "version": "4.0.3",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.3.tgz",
-      "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -3527,8 +5324,6 @@
     },
     "node_modules/vitest": {
       "version": "4.0.18",
-      "resolved": "https://registry.npmjs.org/vitest/-/vitest-4.0.18.tgz",
-      "integrity": "sha512-hOQuK7h0FGKgBAas7v0mSAsnvrIgAvWmRFjmzpJ7SwFHH3g1k2u37JtYwOwmEKhK6ZO3v9ggDBBm0La1LCK4uQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3605,8 +5400,6 @@
     },
     "node_modules/vitest/node_modules/picomatch": {
       "version": "4.0.3",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.3.tgz",
-      "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -3618,8 +5411,6 @@
     },
     "node_modules/which": {
       "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
-      "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -3634,8 +5425,6 @@
     },
     "node_modules/why-is-node-running": {
       "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/why-is-node-running/-/why-is-node-running-2.3.0.tgz",
-      "integrity": "sha512-hUrmaWBdVDcxvYqnyh09zunKzROWjbZTiNy8dBEjkS7ehEDQibXJ7XvlmtbwuTclUiIyN+CyXQD4Vmko8fNm8w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3651,8 +5440,6 @@
     },
     "node_modules/word-wrap": {
       "version": "1.2.5",
-      "resolved": "https://registry.npmjs.org/word-wrap/-/word-wrap-1.2.5.tgz",
-      "integrity": "sha512-BN22B5eaMMI9UMtjrGd5g5eCYPpCPDUy0FJXbYsaT5zYxjFOckS53SQDE3pWkVoWpHXVb3BrYcEN4Twa55B5cA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -3661,8 +5448,6 @@
     },
     "node_modules/wrap-ansi": {
       "version": "9.0.2",
-      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-9.0.2.tgz",
-      "integrity": "sha512-42AtmgqjV+X1VpdOfyTGOYRi0/zsoLqtXQckTmqTeybT+BDIbM/Guxo7x3pE2vtpr1ok6xRqM9OpBe+Jyoqyww==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3677,10 +5462,88 @@
         "url": "https://github.com/chalk/wrap-ansi?sponsor=1"
       }
     },
+    "node_modules/wrap-ansi-cjs": {
+      "name": "wrap-ansi",
+      "version": "7.0.0",
+      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-7.0.0.tgz",
+      "integrity": "sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "ansi-styles": "^4.0.0",
+        "string-width": "^4.1.0",
+        "strip-ansi": "^6.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/wrap-ansi?sponsor=1"
+      }
+    },
+    "node_modules/wrap-ansi-cjs/node_modules/ansi-regex": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
+      "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/wrap-ansi-cjs/node_modules/emoji-regex": {
+      "version": "8.0.0",
+      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz",
+      "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true
+    },
+    "node_modules/wrap-ansi-cjs/node_modules/is-fullwidth-code-point": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-3.0.0.tgz",
+      "integrity": "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/wrap-ansi-cjs/node_modules/string-width": {
+      "version": "4.2.3",
+      "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
+      "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "emoji-regex": "^8.0.0",
+        "is-fullwidth-code-point": "^3.0.0",
+        "strip-ansi": "^6.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/wrap-ansi-cjs/node_modules/strip-ansi": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
+      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "ansi-regex": "^5.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
     "node_modules/wrap-ansi/node_modules/ansi-styles": {
       "version": "6.2.3",
-      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-6.2.3.tgz",
-      "integrity": "sha512-4Dj6M28JB+oAH8kFkTLUo+a2jwOFkuqb3yucU0CANcRRUbxS0cP0nZYCGjcc3BNXwRIsUVmDGgzawme7zvJHvg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -3692,8 +5555,6 @@
     },
     "node_modules/wrap-ansi/node_modules/string-width": {
       "version": "7.2.0",
-      "resolved": "https://registry.npmjs.org/string-width/-/string-width-7.2.0.tgz",
-      "integrity": "sha512-tsaTIkKW9b4N+AEj+SVA+WhJzV7/zMhcSu78mLKWSk7cXMOSHsBKFWUs0fWwq8QyK3MgJBQRX6Gbi4kYbdvGkQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3708,10 +5569,42 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/wrappy": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
+      "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==",
+      "license": "ISC",
+      "optional": true
+    },
+    "node_modules/xmlbuilder2": {
+      "version": "4.0.3",
+      "resolved": "https://registry.npmjs.org/xmlbuilder2/-/xmlbuilder2-4.0.3.tgz",
+      "integrity": "sha512-bx8Q1STctnNaaDymWnkfQLKofs0mGNN7rLLapJlGuV3VlvegD7Ls4ggMjE3aUSWItCCzU0PEv45lI87iSigiCA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@oozcitak/dom": "^2.0.2",
+        "@oozcitak/infra": "^2.0.2",
+        "@oozcitak/util": "^10.0.0",
+        "js-yaml": "^4.1.1"
+      },
+      "engines": {
+        "node": ">=20.0"
+      }
+    },
+    "node_modules/yallist": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/yallist/-/yallist-5.0.0.tgz",
+      "integrity": "sha512-YgvUTfwqyc7UXVMrB+SImsVYSmTS8X/tSrtdNZMImM+n7+QTriRXyXim0mBrTXNeqzVF0KWGgHPeiyViFFrNDw==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "optional": true,
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/yaml": {
       "version": "2.8.2",
-      "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.8.2.tgz",
-      "integrity": "sha512-mplynKqc1C2hTVYxd0PU2xQAc22TI1vShAYGksCCfxbn/dFwnHTNi1bvYsBTkhdUNtGIf5xNOg938rrSSYvS9A==",
       "dev": true,
       "license": "ISC",
       "bin": {
@@ -3726,8 +5619,6 @@
     },
     "node_modules/yocto-queue": {
       "version": "0.1.0",
-      "resolved": "https://registry.npmjs.org/yocto-queue/-/yocto-queue-0.1.0.tgz",
-      "integrity": "sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -3739,8 +5630,6 @@
     },
     "node_modules/zod": {
       "version": "4.3.6",
-      "resolved": "https://registry.npmjs.org/zod/-/zod-4.3.6.tgz",
-      "integrity": "sha512-rftlrkhHZOcjDwkGlnUtZZkvaPHCsDATp4pGpuOOMDaTdDDXF91wuVDJoWoPsKX/3YPQ5fHuF3STjcYyKr+Qhg==",
       "license": "MIT",
       "funding": {
         "url": "https://github.com/sponsors/colinhacks"
diff --git a/package.json b/package.json
index 6f848975f..983cbd87c 100644
--- a/package.json
+++ b/package.json
@@ -1,133 +1,162 @@
 {
-  "name": "codex-multi-auth",
-  "version": "0.1.7",
-  "description": "OpenAI Codex CLI multi-account OAuth manager with resilient routing and quota-aware diagnostics",
-  "main": "./dist/index.js",
-  "types": "./dist/index.d.ts",
-  "type": "module",
-  "license": "MIT",
-  "author": "Numman Ali",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/ndycode/codex-multi-auth.git"
-  },
-  "keywords": [
-    "openai",
-    "codex",
-    "codex-cli",
-    "chatgpt",
-    "oauth2",
-    "pkce",
-    "multi-account",
-    "account-rotation",
-    "token-refresh",
-    "session-recovery",
-    "rate-limit-handling",
-    "resilient-systems",
-    "fault-tolerance",
-    "terminal-ui",
-    "cli-tool",
-    "typescript",
-    "nodejs",
-    "developer-tools",
-    "authentication",
-    "productivity-tools"
-  ],
-  "homepage": "https://github.com/ndycode/codex-multi-auth#readme",
-  "bugs": {
-    "url": "https://github.com/ndycode/codex-multi-auth/issues"
-  },
-  "scripts": {
-    "build": "tsc && node scripts/copy-oauth-success.js",
-    "typecheck": "tsc --noEmit",
-    "lint": "npm run lint:ts && npm run lint:scripts",
-    "lint:ts": "eslint . --ext .ts",
-    "lint:scripts": "eslint scripts --ext .js",
-    "lint:fix": "npm run lint:ts:fix && npm run lint:scripts:fix",
-    "lint:ts:fix": "eslint . --ext .ts --fix",
-    "lint:scripts:fix": "eslint scripts --ext .js --fix",
-    "test": "vitest run",
-    "test:watch": "vitest",
-    "test:ui": "vitest --ui",
-    "test:model-matrix": "node scripts/test-model-matrix.js",
-    "test:model-matrix:smoke": "node scripts/test-model-matrix.js --smoke",
-    "test:model-matrix:report": "node scripts/test-model-matrix.js --smoke --report-json=.tmp/model-matrix-report.json",
-    "clean:repo": "node scripts/repo-hygiene.js clean --mode aggressive",
-    "clean:repo:check": "node scripts/repo-hygiene.js check",
-    "bench:edit-formats": "node scripts/benchmark-edit-formats.mjs --preset=codex-core",
-    "bench:edit-formats:smoke": "node scripts/benchmark-edit-formats.mjs --smoke --preset=codex-core",
-    "bench:edit-formats:render": "node scripts/benchmark-render-dashboard.mjs",
-    "bench:runtime-path": "npm run build && node scripts/benchmark-runtime-path.mjs",
-    "bench:runtime-path:quick": "node scripts/benchmark-runtime-path.mjs",
-    "test:coverage": "vitest run --coverage",
-    "coverage": "npm run build && vitest run --coverage",
-    "audit:prod": "npm audit --omit=dev --audit-level=high",
-    "audit:all": "npm audit --audit-level=high",
-    "audit:dev:allowlist": "node scripts/audit-dev-allowlist.js",
-    "audit:ci": "npm run audit:prod && npm run audit:dev:allowlist",
-    "prepublishOnly": "npm run build",
-    "prepare": "husky"
-  },
-  "bin": {
-    "codex": "scripts/codex.js",
-    "codex-multi-auth": "scripts/codex-multi-auth.js"
-  },
-  "files": [
-    "dist/",
-    "assets/",
-    "config/",
-    "scripts/",
-    "vendor/codex-ai-plugin/",
-    "vendor/codex-ai-sdk/",
-    "README.md",
-    "LICENSE"
-  ],
-  "bundleDependencies": [
-    "@codex-ai/plugin"
-  ],
-  "lint-staged": {
-    "*.ts": [
-      "eslint --max-warnings=0 --fix --no-warn-ignored"
-    ],
-    "scripts/**/*.js": [
-      "eslint --max-warnings=0 --fix --no-warn-ignored"
-    ]
-  },
-  "engines": {
-    "node": ">=18.0.0"
-  },
-  "peerDependencies": {
-    "typescript": "^5"
-  },
-  "devDependencies": {
-    "@fast-check/vitest": "^0.2.4",
-    "@codex-ai/sdk": "file:vendor/codex-ai-sdk",
-    "@types/node": "^25.3.0",
-    "@typescript-eslint/eslint-plugin": "^8.56.0",
-    "@typescript-eslint/parser": "^8.56.0",
-    "@vitest/coverage-v8": "^4.0.18",
-    "@vitest/ui": "^4.0.18",
-    "eslint": "^10.0.0",
-    "fast-check": "^4.5.3",
-    "husky": "^9.1.7",
-    "lint-staged": "^16.2.7",
-    "typescript": "^5.9.3",
-    "typescript-language-server": "^5.1.3",
-    "vitest": "^4.0.18"
-  },
-  "dependencies": {
-    "@openauthjs/openauth": "^0.4.3",
-    "@codex-ai/plugin": "file:vendor/codex-ai-plugin",
-    "hono": "4.12.3",
-    "zod": "^4.3.6"
-  },
-  "overrides": {
-    "hono": "4.12.3",
-    "minimatch": "10.2.4",
-    "rollup": "4.59.0",
-    "vite": "^7.3.1",
-    "@typescript-eslint/typescript-estree": {
-      "minimatch": "9.0.9"
-    }
-  }
+	"name": "codex-multi-auth",
+	"version": "0.1.7",
+	"description": "OpenAI Codex CLI multi-account OAuth manager with resilient routing and quota-aware diagnostics",
+	"main": "./dist/index.js",
+	"types": "./dist/index.d.ts",
+	"type": "module",
+	"license": "MIT",
+	"author": "Numman Ali",
+	"repository": {
+		"type": "git",
+		"url": "git+https://github.com/ndycode/codex-multi-auth.git"
+	},
+	"keywords": [
+		"openai",
+		"codex",
+		"codex-cli",
+		"chatgpt",
+		"oauth2",
+		"pkce",
+		"multi-account",
+		"account-rotation",
+		"token-refresh",
+		"session-recovery",
+		"rate-limit-handling",
+		"resilient-systems",
+		"fault-tolerance",
+		"terminal-ui",
+		"cli-tool",
+		"typescript",
+		"nodejs",
+		"developer-tools",
+		"authentication",
+		"productivity-tools"
+	],
+	"homepage": "https://github.com/ndycode/codex-multi-auth#readme",
+	"bugs": {
+		"url": "https://github.com/ndycode/codex-multi-auth/issues"
+	},
+	"scripts": {
+		"build": "tsc && node scripts/copy-oauth-success.js",
+		"doctor:dev": "node scripts/doctor-dev.js",
+		"setup:dev": "node scripts/setup-dev.js",
+		"typecheck": "tsc --noEmit",
+		"lint": "npm run lint:ts && npm run lint:scripts && npm run format:check",
+		"lint:ts": "eslint . --ext .ts",
+		"lint:scripts": "eslint scripts --ext .js",
+		"lint:fix": "npm run lint:ts:fix && npm run lint:scripts:fix",
+		"lint:ts:fix": "eslint . --ext .ts --fix",
+		"lint:scripts:fix": "eslint scripts --ext .js --fix",
+		"format": "biome format . --write",
+		"format:check": "biome format .",
+		"test": "vitest run",
+		"test:watch": "vitest",
+		"test:ui": "vitest --ui",
+		"test:model-matrix": "node scripts/test-model-matrix.js",
+		"test:model-matrix:smoke": "node scripts/test-model-matrix.js --smoke",
+		"test:model-matrix:report": "node scripts/test-model-matrix.js --smoke --report-json=.tmp/model-matrix-report.json",
+		"clean:repo": "node scripts/repo-hygiene.js clean --mode aggressive",
+		"clean:repo:check": "node scripts/repo-hygiene.js check",
+		"bench:edit-formats": "node scripts/benchmark-edit-formats.mjs --preset=codex-core",
+		"bench:edit-formats:smoke": "node scripts/benchmark-edit-formats.mjs --smoke --preset=codex-core",
+		"bench:edit-formats:render": "node scripts/benchmark-render-dashboard.mjs",
+		"bench:runtime-path": "npm run build && node scripts/benchmark-runtime-path.mjs",
+		"bench:runtime-path:quick": "node scripts/benchmark-runtime-path.mjs",
+		"perf:budget-check": "node scripts/performance-budget-check.js",
+		"sbom:generate": "node scripts/generate-sbom.js",
+		"sbom:verify": "node scripts/verify-sbom.js .tmp/sbom.cdx.json",
+		"test:coverage": "vitest run --coverage",
+		"coverage": "npm run build && vitest run --coverage",
+		"verify:repo": "npm run clean:repo:check && npm run audit:ci && npm run test -- test/lockfile-version-floor.test.ts",
+		"verify:quality": "npm run typecheck && npm run coverage",
+		"verify": "npm run lint && npm run verify:repo && npm run verify:quality",
+		"verify:ci": "npm run verify:repo && npm run verify:quality",
+		"ops:health-check": "node scripts/enterprise-health-check.js",
+		"ops:retention-cleanup": "node scripts/retention-cleanup.js",
+		"ops:audit-forwarder": "node scripts/audit-log-forwarder.js",
+		"ops:slo-report": "node scripts/slo-budget-report.js --output=.tmp/slo-report.json",
+		"ops:compliance-evidence": "node scripts/compliance-evidence-bundle.js --profile=release",
+		"ops:recovery-drill": "npm run test -- test/storage-recovery-paths.test.ts test/storage.test.ts",
+		"ops:keychain-assert": "node scripts/keychain-assert.js",
+		"audit:prod": "npm audit --omit=dev --audit-level=high",
+		"audit:all": "npm audit --audit-level=high",
+		"audit:dev:allowlist": "node scripts/audit-dev-allowlist.js",
+		"audit:ci": "npm run audit:prod && npm run audit:dev:allowlist",
+		"license:check": "node scripts/license-policy-check.js",
+		"sbom": "cyclonedx-npm --output-file sbom.cdx.json --omit dev",
+		"release:check": "npm run verify && npm run audit:ci && npm run license:check && npm run test -- test/documentation.test.ts && npm pack --dry-run",
+		"prepublishOnly": "npm run build",
+		"prepare": "husky"
+	},
+	"bin": {
+		"codex": "scripts/codex.js",
+		"codex-multi-auth": "scripts/codex-multi-auth.js"
+	},
+	"files": [
+		"dist/",
+		"assets/",
+		"config/",
+		"scripts/",
+		"vendor/codex-ai-plugin/",
+		"vendor/codex-ai-sdk/",
+		"README.md",
+		"LICENSE"
+	],
+	"bundleDependencies": [
+		"@codex-ai/plugin"
+	],
+	"lint-staged": {
+		"*.ts": [
+			"eslint --max-warnings=0 --fix --no-warn-ignored"
+		],
+		"scripts/**/*.js": [
+			"eslint --max-warnings=0 --fix --no-warn-ignored"
+		],
+		"*.{json,jsonc,yml,yaml}": [
+			"biome format --write --files-ignore-unknown=true"
+		]
+	},
+	"engines": {
+		"node": ">=18.0.0"
+	},
+	"peerDependencies": {
+		"typescript": "^5"
+	},
+	"devDependencies": {
+		"@biomejs/biome": "^2.4.2",
+		"@cyclonedx/cyclonedx-npm": "4.2.0",
+		"@fast-check/vitest": "^0.2.4",
+		"@codex-ai/sdk": "file:vendor/codex-ai-sdk",
+		"@types/node": "^25.3.0",
+		"@typescript-eslint/eslint-plugin": "^8.56.0",
+		"@typescript-eslint/parser": "^8.56.0",
+		"@vitest/coverage-v8": "^4.0.18",
+		"@vitest/ui": "^4.0.18",
+		"eslint": "^10.0.0",
+		"fast-check": "^4.5.3",
+		"husky": "^9.1.7",
+		"lint-staged": "^16.2.7",
+		"typescript": "^5.9.3",
+		"typescript-language-server": "^5.1.3",
+		"vitest": "^4.0.18"
+	},
+	"dependencies": {
+		"@openauthjs/openauth": "^0.4.3",
+		"@codex-ai/plugin": "file:vendor/codex-ai-plugin",
+		"hono": "4.12.3",
+		"zod": "^4.3.6"
+	},
+	"optionalDependencies": {
+		"keytar": "^7.9.0"
+	},
+	"overrides": {
+		"hono": "4.12.3",
+		"minimatch": "10.2.4",
+		"rollup": "4.59.0",
+		"vite": "^7.3.1",
+		"@typescript-eslint/typescript-estree": {
+			"minimatch": "9.0.9"
+		}
+	}
 }
diff --git a/scripts/audit-log-forwarder.js b/scripts/audit-log-forwarder.js
new file mode 100644
index 000000000..6a7294ef0
--- /dev/null
+++ b/scripts/audit-log-forwarder.js
@@ -0,0 +1,463 @@
+#!/usr/bin/env node
+
+import { createHash } from "node:crypto";
+import { existsSync } from "node:fs";
+import { mkdir, open, readFile, readdir, rename, stat, unlink, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import process from "node:process";
+
+const DEFAULT_BATCH_SIZE = 500;
+const SEND_TIMEOUT_MS = Number.parseInt(process.env.CODEX_AUDIT_FORWARDER_TIMEOUT_MS ?? "15000", 10);
+const SEND_MAX_ATTEMPTS = Number.parseInt(process.env.CODEX_AUDIT_FORWARDER_MAX_ATTEMPTS ?? "3", 10);
+const CHECKPOINT_LOCK_MAX_ATTEMPTS = parsePositiveInt(process.env.CODEX_AUDIT_FORWARDER_LOCK_MAX_ATTEMPTS, 40);
+const CHECKPOINT_LOCK_STALE_MS = parsePositiveInt(process.env.CODEX_AUDIT_FORWARDER_STALE_LOCK_MS, 5 * 60 * 1000);
+const CHECKPOINT_LOCK_MAX_WAIT_MS = parsePositiveInt(process.env.CODEX_AUDIT_FORWARDER_MAX_WAIT_MS, 60 * 1000);
+
+function sleep(ms) {
+	return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+function parsePositiveInt(value, fallback) {
+	const parsed = Number.parseInt(String(value ?? ""), 10);
+	if (!Number.isFinite(parsed) || parsed <= 0) return fallback;
+	return parsed;
+}
+
+function parseArgValue(name) {
+	const prefix = `${name}=`;
+	const hit = process.argv.slice(2).find((arg) => arg.startsWith(prefix));
+	return hit ? hit.slice(prefix.length) : undefined;
+}
+
+function hasFlag(name) {
+	return process.argv.slice(2).includes(name);
+}
+
+function parseBatchSize(value) {
+	if (!value) return DEFAULT_BATCH_SIZE;
+	const parsed = Number.parseInt(value, 10);
+	if (!Number.isFinite(parsed) || parsed <= 0) return DEFAULT_BATCH_SIZE;
+	return parsed;
+}
+
+function countNonEmptyLines(content) {
+	return content.split(/\r?\n/).reduce((count, line) => (line.trim().length > 0 ? count + 1 : count), 0);
+}
+
+function getNewestRotatedAuditFile(files) {
+	return files
+		.map((file) => {
+			const match = /^audit\.(\d+)\.log$/i.exec(file);
+			if (!match) return null;
+			return {
+				file,
+				rotation: Number.parseInt(match[1], 10),
+			};
+		})
+		.filter((entry) => entry !== null)
+		.sort((a, b) => a.rotation - b.rotation)[0]?.file ?? null;
+}
+
+function resolveRoot() {
+	const override = (process.env.CODEX_MULTI_AUTH_DIR ?? "").trim();
+	if (override.length > 0) return override;
+	return join(homedir(), ".codex", "multi-auth");
+}
+
+async function loadCheckpoint(path) {
+	if (!existsSync(path)) {
+		return { file: null, line: 0 };
+	}
+	try {
+		const raw = await readFile(path, "utf8");
+		const parsed = JSON.parse(raw);
+		if (
+			parsed &&
+			(typeof parsed.file === "string" || parsed.file === null) &&
+			typeof parsed.line === "number" &&
+			parsed.line >= 0
+		) {
+			return {
+				file: parsed.file,
+				line: parsed.line,
+			};
+		}
+	} catch {
+		// Ignore malformed checkpoint and re-seed from zero.
+	}
+	return { file: null, line: 0 };
+}
+
+async function discoverAuditFiles(logDir) {
+	let entries;
+	try {
+		entries = await readdir(logDir, { withFileTypes: true });
+	} catch (error) {
+		const code = error?.code;
+		if (code === "ENOENT" || code === "ENOTDIR") {
+			return [];
+		}
+		throw error;
+	}
+	const files = [];
+	for (const entry of entries) {
+		if (!entry.isFile()) continue;
+		if (!entry.name.startsWith("audit") || !entry.name.endsWith(".log")) continue;
+		try {
+			await stat(join(logDir, entry.name));
+		} catch (error) {
+			const code = error?.code;
+			if (code === "ENOENT" || code === "ENOTDIR") {
+				continue;
+			}
+			throw error;
+		}
+		files.push(entry.name);
+	}
+	files.sort((a, b) => {
+		const leftRotation = /^audit\.(\d+)\.log$/i.exec(a);
+		const rightRotation = /^audit\.(\d+)\.log$/i.exec(b);
+		const leftActive = a.toLowerCase() === "audit.log";
+		const rightActive = b.toLowerCase() === "audit.log";
+		if (leftActive && rightActive) return 0;
+		if (leftActive) return 1;
+		if (rightActive) return -1;
+		if (leftRotation && rightRotation) {
+			// Process older rotated files first (audit.3.log before audit.1.log).
+			return Number.parseInt(rightRotation[1], 10) - Number.parseInt(leftRotation[1], 10);
+		}
+		return a.localeCompare(b, undefined, { sensitivity: "base" });
+	});
+	return files;
+}
+
+function resolveCheckpointFile(files, checkpointFile) {
+	if (!checkpointFile) return null;
+	const newestRotated = getNewestRotatedAuditFile(files);
+	if (files.includes(checkpointFile)) {
+		return checkpointFile;
+	}
+	if (checkpointFile === "audit.log") {
+		return newestRotated;
+	}
+	const rotatedMatch = /^audit\.(\d+)\.log$/i.exec(checkpointFile);
+	if (rotatedMatch) {
+		const nextRotation = `audit.${Number.parseInt(rotatedMatch[1], 10) + 1}.log`;
+		if (files.includes(nextRotation)) return nextRotation;
+	}
+	return null;
+}
+
+async function collectBatch(logDir, files, checkpoint, batchSize) {
+	let checkpointFile = resolveCheckpointFile(files, checkpoint.file);
+	if (checkpoint.file === "audit.log" && checkpointFile === "audit.log") {
+		const newestRotated = getNewestRotatedAuditFile(files);
+		if (newestRotated) {
+			const activePath = join(logDir, "audit.log");
+			try {
+				const activeRaw = await readFile(activePath, "utf8");
+				const activeLineCount = countNonEmptyLines(activeRaw);
+				if (checkpoint.line > activeLineCount) {
+					checkpointFile = newestRotated;
+				}
+			} catch {
+				// Best effort: fall back to active audit.log checkpoint.
+			}
+		}
+	}
+	const checkpointFileIndex = checkpointFile ? files.indexOf(checkpointFile) : -1;
+	const entries = [];
+	for (let fileIndex = 0; fileIndex < files.length; fileIndex += 1) {
+		const file = files[fileIndex];
+		if (checkpointFileIndex >= 0 && fileIndex < checkpointFileIndex) {
+			continue;
+		}
+
+		const fullPath = join(logDir, file);
+		let lineNumber = 0;
+		const raw = await readFile(fullPath, "utf8");
+		const lines = raw.split(/\r?\n/);
+		for (const line of lines) {
+			if (!line.trim()) continue;
+			lineNumber += 1;
+
+			if (checkpointFile === file && lineNumber <= checkpoint.line) {
+				continue;
+			}
+			try {
+				entries.push({
+					file,
+					line: lineNumber,
+					entry: JSON.parse(line),
+				});
+			} catch {
+				entries.push({
+					file,
+					line: lineNumber,
+					entry: {
+						parseError: true,
+						raw: line,
+					},
+				});
+			}
+			if (entries.length >= batchSize) {
+				return entries;
+			}
+		}
+	}
+	return entries;
+}
+
+async function sendBatch({ endpoint, apiKey, payload }) {
+	const headers = {
+		"content-type": "application/json",
+	};
+	if (apiKey) {
+		headers.authorization = `Bearer ${apiKey}`;
+	}
+	const maxAttempts = Number.isFinite(SEND_MAX_ATTEMPTS) && SEND_MAX_ATTEMPTS > 0 ? SEND_MAX_ATTEMPTS : 3;
+	const timeoutMs = Number.isFinite(SEND_TIMEOUT_MS) && SEND_TIMEOUT_MS > 0 ? SEND_TIMEOUT_MS : 15_000;
+
+	for (let attempt = 0; attempt < maxAttempts; attempt += 1) {
+		const controller = new AbortController();
+		const timeout = setTimeout(() => controller.abort(), timeoutMs);
+		try {
+			const response = await fetch(endpoint, {
+				method: "POST",
+				headers,
+				body: JSON.stringify(payload),
+				signal: controller.signal,
+			});
+			if (response.ok) {
+				return;
+			}
+			const body = await response.text();
+			const retryableStatus = response.status === 429 || response.status >= 500;
+			if (!retryableStatus || attempt === maxAttempts - 1) {
+				throw new Error(`SIEM endpoint ${response.status}: ${body.slice(0, 500)}`);
+			}
+		} catch (error) {
+			const retryableNetworkError =
+				error instanceof Error &&
+				(error.name === "AbortError" ||
+					/timeout|network|fetch/i.test(error.message));
+			if (!retryableNetworkError || attempt === maxAttempts - 1) {
+				throw error;
+			}
+		} finally {
+			clearTimeout(timeout);
+		}
+		const backoffMs = 250 * 2 ** attempt + Math.floor(Math.random() * 100);
+		await sleep(backoffMs);
+	}
+}
+
+function isProcessAlive(pid) {
+	if (!Number.isInteger(pid) || pid <= 0) return false;
+	try {
+		process.kill(pid, 0);
+		return true;
+	} catch (error) {
+		return error?.code === "EPERM";
+	}
+}
+
+async function clearStaleCheckpointLock(lockPath) {
+	let details;
+	try {
+		details = await stat(lockPath);
+	} catch (error) {
+		if (error?.code === "ENOENT") return false;
+		return false;
+	}
+	if (Date.now() - details.mtimeMs < CHECKPOINT_LOCK_STALE_MS) {
+		return false;
+	}
+
+	let ownerPid = null;
+	try {
+		const raw = (await readFile(lockPath, "utf8")).trim();
+		const parsed = Number.parseInt(raw, 10);
+		if (Number.isFinite(parsed) && parsed > 0) {
+			ownerPid = parsed;
+		}
+	} catch {
+		// Ignore parse/read failures and treat as stale candidate.
+	}
+
+	if (ownerPid !== null && isProcessAlive(ownerPid)) {
+		return false;
+	}
+	try {
+		await unlink(lockPath);
+		return true;
+	} catch (error) {
+		if (error?.code === "ENOENT") return true;
+		return false;
+	}
+}
+
+function buildCheckpointLockTimeoutError(lockPath, elapsedMs, waitMs) {
+	const effectiveElapsed = Math.max(0, Math.floor(elapsedMs + waitMs));
+	return new Error(`Timed out acquiring checkpoint lock after ${effectiveElapsed}ms: ${lockPath}`);
+}
+
+async function withCheckpointLock(checkpointPath, action) {
+	const lockPath = `${checkpointPath}.lock`;
+	const startedAt = Date.now();
+	for (let attempt = 0; attempt < CHECKPOINT_LOCK_MAX_ATTEMPTS; attempt += 1) {
+		try {
+			const handle = await open(lockPath, "wx", 0o600);
+			try {
+				await handle.writeFile(`${process.pid}\n`, "utf8");
+			} finally {
+				await handle.close();
+			}
+			try {
+				return await action();
+			} finally {
+				await unlink(lockPath).catch(() => {});
+			}
+		} catch (error) {
+			const code = error?.code;
+			const contention = code === "EEXIST" || code === "EPERM";
+			if (!contention) {
+				throw error;
+			}
+			if (await clearStaleCheckpointLock(lockPath)) {
+				continue;
+			}
+			const backoffMs = 25 * 2 ** Math.min(attempt, 6);
+			const elapsedMs = Date.now() - startedAt;
+			if (
+				attempt === CHECKPOINT_LOCK_MAX_ATTEMPTS - 1 ||
+				elapsedMs >= CHECKPOINT_LOCK_MAX_WAIT_MS ||
+				elapsedMs + backoffMs > CHECKPOINT_LOCK_MAX_WAIT_MS
+			) {
+				throw buildCheckpointLockTimeoutError(lockPath, elapsedMs, backoffMs);
+			}
+			await sleep(backoffMs);
+		}
+	}
+	throw buildCheckpointLockTimeoutError(lockPath, Date.now() - startedAt, 0);
+}
+
+async function writeCheckpointAtomic(checkpointPath, checkpoint) {
+	const tmpPath = `${checkpointPath}.${process.pid}.${Date.now()}.tmp`;
+	await withCheckpointLock(checkpointPath, async () => {
+		try {
+			await writeFile(tmpPath, `${JSON.stringify(checkpoint, null, 2)}\n`, {
+				encoding: "utf8",
+				mode: 0o600,
+			});
+			await rename(tmpPath, checkpointPath);
+		} finally {
+			await unlink(tmpPath).catch((error) => {
+				if (error?.code !== "ENOENT") {
+					throw error;
+				}
+			});
+		}
+	});
+}
+
+async function main() {
+	const dryRun = hasFlag("--dry-run");
+	const endpoint = parseArgValue("--endpoint") ?? process.env.CODEX_SIEM_ENDPOINT;
+	const apiKey = parseArgValue("--api-key") ?? process.env.CODEX_SIEM_API_KEY;
+	const batchSize = parseBatchSize(parseArgValue("--batch-size"));
+	const root = resolveRoot();
+	const logDir = resolve(parseArgValue("--log-dir") ?? join(root, "logs"));
+	const checkpointPath = resolve(parseArgValue("--checkpoint") ?? join(root, "audit-forwarder-checkpoint.json"));
+
+	await mkdir(dirname(checkpointPath), { recursive: true });
+	const checkpoint = await loadCheckpoint(checkpointPath);
+	const files = await discoverAuditFiles(logDir);
+	const batch = await collectBatch(logDir, files, checkpoint, batchSize);
+
+	if (batch.length === 0) {
+		console.log(
+			JSON.stringify(
+				{
+					command: "audit-log-forwarder",
+					status: "noop",
+					reason: "no-new-audit-events",
+					logDir,
+					checkpoint,
+				},
+				null,
+				2,
+			),
+		);
+		return;
+	}
+
+	const data = batch.map((item) => item.entry);
+	const checksum = createHash("sha256").update(JSON.stringify(data)).digest("hex");
+	const last = batch[batch.length - 1];
+	const payload = {
+		source: "codex-multi-auth",
+		generatedAt: new Date().toISOString(),
+		count: data.length,
+		checksum,
+		entries: data,
+	};
+
+	if (!dryRun) {
+		if (!endpoint) {
+			throw new Error("Missing --endpoint (or CODEX_SIEM_ENDPOINT) for audit export.");
+		}
+		await sendBatch({ endpoint, apiKey, payload });
+	}
+
+	const checkpointNext = {
+		file: last?.file ?? checkpoint.file,
+		line: last?.line ?? checkpoint.line,
+		updatedAt: new Date().toISOString(),
+	};
+	if (!dryRun) {
+		await writeCheckpointAtomic(checkpointPath, checkpointNext);
+	}
+
+	const newestMtime = (() => {
+		const newest = files[files.length - 1];
+		return newest ? join(logDir, newest) : null;
+	})();
+	let newestLogMtimeMs = null;
+	if (newestMtime) {
+		try {
+			const metadata = await stat(newestMtime);
+			newestLogMtimeMs = metadata.mtimeMs;
+		} catch (error) {
+			const code = error?.code;
+			if (code !== "ENOENT" && code !== "ENOTDIR") {
+				throw error;
+			}
+		}
+	}
+
+	console.log(
+		JSON.stringify(
+			{
+				command: "audit-log-forwarder",
+				status: dryRun ? "dry-run" : "sent",
+				dryRun,
+				endpoint: endpoint ?? null,
+				logDir,
+				checkpointPath,
+				sent: data.length,
+				checksum,
+				checkpoint: checkpointNext,
+				newestLogMtimeMs,
+			},
+			null,
+			2,
+		),
+	);
+}
+
+main().catch((error) => {
+	console.error(`audit-log-forwarder failed: ${error instanceof Error ? error.message : String(error)}`);
+	process.exit(1);
+});
diff --git a/scripts/benchmark-runtime-path.mjs b/scripts/benchmark-runtime-path.mjs
index 2fc857ec0..24ace4063 100644
--- a/scripts/benchmark-runtime-path.mjs
+++ b/scripts/benchmark-runtime-path.mjs
@@ -7,6 +7,8 @@ import { dirname, resolve } from "node:path";
 import { filterInput } from "../dist/lib/request/request-transformer.js";
 import { cleanupToolDefinitions } from "../dist/lib/request/helpers/tool-utils.js";
 import { AccountManager } from "../dist/lib/accounts.js";
+import { resolveRequestAccountId } from "../dist/lib/auth/token-utils.js";
+import { normalizeAccountStorage } from "../dist/lib/storage.js";
 
 function argValue(args, name) {
 	const prefix = `${name}=`;
@@ -104,6 +106,33 @@ function buildManager(accountCount) {
 	});
 }
 
+function buildStoragePayload(accountCount) {
+	const now = Date.now();
+	const accounts = [];
+	for (let i = 0; i < accountCount; i += 1) {
+		accounts.push({
+			accountId: `acct_${i % 40}`,
+			email: `user${i % 35}@example.com`,
+			refreshToken: `refresh_${i}`,
+			accessToken: `access_${i}`,
+			expiresAt: now + 3_600_000,
+			enabled: true,
+			addedAt: now - i * 1_000,
+			lastUsed: now - i * 100,
+			lastSwitchReason: "rotation",
+		});
+	}
+	return {
+		version: 3,
+		accounts,
+		activeIndex: Math.floor(accountCount / 3),
+		activeIndexByFamily: {
+			codex: 0,
+			default: Math.floor(accountCount / 4),
+		},
+	};
+}
+
 function run() {
 	const args = process.argv.slice(2);
 	const iterations = parsePositiveInt(argValue(args, "--iterations"), 30);
@@ -113,6 +142,7 @@ function run() {
 	const inputLarge = buildInputItems(2000);
 	const toolsMedium = buildTools(40, 12);
 	const toolsLarge = buildTools(140, 25);
+	const storageLarge = buildStoragePayload(240);
 
 	const results = [
 		benchmarkCase("filterInput_small", iterations, () => {
@@ -137,6 +167,17 @@ function run() {
 				manager.getCurrentOrNextForFamilyHybrid("codex", "gpt-5-codex", { pidOffsetEnabled: false });
 			}
 		}),
+		benchmarkCase("resolveRequestAccountId_1000", iterations, () => {
+			for (let i = 0; i < 1_000; i += 1) {
+				resolveRequestAccountId("org_123", "org", `token_${i}`);
+				resolveRequestAccountId(undefined, "token", `token_${i}`);
+				resolveRequestAccountId("acct_manual", "manual", `token_${i}`);
+			}
+		}),
+		benchmarkCase("normalizeAccountStorage_240", iterations, () => {
+			const out = normalizeAccountStorage(storageLarge);
+			if (!out || out.version !== 3) throw new Error("normalizeAccountStorage_240 failed");
+		}),
 	];
 
 	const payload = {
diff --git a/scripts/codex.js b/scripts/codex.js
index 14487b384..6d2ee8b0b 100644
--- a/scripts/codex.js
+++ b/scripts/codex.js
@@ -194,6 +194,53 @@ function normalizeExitCode(value) {
 const WINDOWS_SHIM_MARKER = "codex-multi-auth windows shim guardian v1";
 const POWERSHELL_PROFILE_MARKER_START = "# >>> codex-multi-auth shell guard >>>";
 const POWERSHELL_PROFILE_MARKER_END = "# <<< codex-multi-auth shell guard <<<";
+const RETRYABLE_WINDOWS_FS_CODES = new Set(["EBUSY", "EPERM", "EACCES"]);
+
+function sleep(ms) {
+	return new Promise((resolve) => {
+		setTimeout(resolve, ms);
+	});
+}
+
+function getFsErrorCode(error) {
+	if (!error || typeof error !== "object" || !("code" in error)) {
+		return undefined;
+	}
+	const code = error.code;
+	return typeof code === "string" ? code : undefined;
+}
+
+async function runWithWindowsFsRetry(operation, options = {}) {
+	const {
+		maxAttempts = 4,
+		backoffMs = 50,
+	} = options;
+	for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
+		try {
+			return operation();
+		} catch (error) {
+			const code = getFsErrorCode(error);
+			const shouldRetry = code !== undefined && RETRYABLE_WINDOWS_FS_CODES.has(code);
+			if (!shouldRetry || attempt === maxAttempts) {
+				throw error;
+			}
+			await sleep(backoffMs * (2 ** (attempt - 1)));
+		}
+	}
+	return undefined;
+}
+
+async function writeFileSyncWithWindowsRetry(filePath, content, options) {
+	await runWithWindowsFsRetry(() => {
+		writeFileSync(filePath, content, options);
+	}, { maxAttempts: 4, backoffMs: 50 });
+}
+
+async function mkdirSyncWithWindowsRetry(dirPath, options) {
+	await runWithWindowsFsRetry(() => {
+		mkdirSync(dirPath, options);
+	}, { maxAttempts: 4, backoffMs: 50 });
+}
 
 function shouldInstallWindowsBatchShimGuard() {
 	if (process.platform !== "win32") return false;
@@ -320,7 +367,7 @@ function buildWindowsPowerShellShimContent() {
 	].join("\r\n");
 }
 
-function ensureWindowsShellShim(filePath, desiredContent, options = {}) {
+async function ensureWindowsShellShim(filePath, desiredContent, options = {}) {
 	const {
 		overwriteCustomShim = false,
 		shimMarker = WINDOWS_SHIM_MARKER,
@@ -336,7 +383,10 @@ function ensureWindowsShellShim(filePath, desiredContent, options = {}) {
 		if (currentContent === desiredContent || currentContent.includes(shimMarker)) {
 			if (currentContent !== desiredContent) {
 				try {
-					writeFileSync(filePath, desiredContent, { encoding: "utf8", mode: 0o755 });
+					await writeFileSyncWithWindowsRetry(filePath, desiredContent, {
+						encoding: "utf8",
+						mode: 0o755,
+					});
 					return true;
 				} catch {
 					return false;
@@ -349,7 +399,10 @@ function ensureWindowsShellShim(filePath, desiredContent, options = {}) {
 			currentContent.includes("node_modules/@openai/codex/bin/codex.js");
 		if (looksLikeStockOpenAiShim) {
 			try {
-				writeFileSync(filePath, desiredContent, { encoding: "utf8", mode: 0o755 });
+				await writeFileSyncWithWindowsRetry(filePath, desiredContent, {
+					encoding: "utf8",
+					mode: 0o755,
+				});
 				return true;
 			} catch {
 				return false;
@@ -361,7 +414,10 @@ function ensureWindowsShellShim(filePath, desiredContent, options = {}) {
 	}
 
 	try {
-		writeFileSync(filePath, desiredContent, { encoding: "utf8", mode: 0o755 });
+		await writeFileSyncWithWindowsRetry(filePath, desiredContent, {
+			encoding: "utf8",
+			mode: 0o755,
+		});
 		return true;
 	} catch {
 		return false;
@@ -400,7 +456,7 @@ function buildPowerShellProfileGuardBlock(shimDirectory) {
 	].join("\r\n");
 }
 
-function upsertPowerShellProfileGuard(profilePath, guardBlock) {
+async function upsertPowerShellProfileGuard(profilePath, guardBlock) {
 	let content = "";
 	if (existsSync(profilePath)) {
 		try {
@@ -430,15 +486,18 @@ function upsertPowerShellProfileGuard(profilePath, guardBlock) {
 	}
 
 	try {
-		mkdirSync(dirname(profilePath), { recursive: true });
-		writeFileSync(profilePath, `${nextContent}\r\n`, { encoding: "utf8", mode: 0o644 });
+		await mkdirSyncWithWindowsRetry(dirname(profilePath), { recursive: true });
+		await writeFileSyncWithWindowsRetry(profilePath, `${nextContent}\r\n`, {
+			encoding: "utf8",
+			mode: 0o644,
+		});
 		return true;
 	} catch {
 		return false;
 	}
 }
 
-function ensurePowerShellProfileGuard(shimDirectory) {
+async function ensurePowerShellProfileGuard(shimDirectory) {
 	if (!shouldInstallPowerShellProfileGuard()) return false;
 	const homeDir = resolveWindowsUserHomeDir();
 	if (!homeDir) return false;
@@ -449,12 +508,12 @@ function ensurePowerShellProfileGuard(shimDirectory) {
 	];
 	let changed = false;
 	for (const profilePath of profilePaths) {
-		changed = upsertPowerShellProfileGuard(profilePath, guardBlock) || changed;
+		changed = (await upsertPowerShellProfileGuard(profilePath, guardBlock)) || changed;
 	}
 	return changed;
 }
 
-function ensureWindowsShellShimGuards() {
+async function ensureWindowsShellShimGuards() {
 	if (!shouldInstallWindowsBatchShimGuard()) return;
 	const shimDirectory = resolveWindowsShimDirectoryFromPath();
 	if (!shimDirectory) return;
@@ -464,23 +523,23 @@ function ensureWindowsShellShimGuards() {
 
 	const overwriteCustomShim =
 		(process.env.CODEX_MULTI_AUTH_OVERWRITE_CUSTOM_BATCH_SHIM ?? "0").trim() === "1";
-	const installedBatch = ensureWindowsShellShim(
+	const installedBatch = await ensureWindowsShellShim(
 		join(shimDirectory, "codex.bat"),
 		buildWindowsBatchShimContent(),
 		{ overwriteCustomShim },
 	);
-	const installedCmd = ensureWindowsShellShim(
+	const installedCmd = await ensureWindowsShellShim(
 		join(shimDirectory, "codex.cmd"),
 		buildWindowsCmdShimContent(),
 		{ overwriteCustomShim },
 	);
-	const installedPs1 = ensureWindowsShellShim(
+	const installedPs1 = await ensureWindowsShellShim(
 		join(shimDirectory, "codex.ps1"),
 		buildWindowsPowerShellShimContent(),
 		{ overwriteCustomShim },
 	);
 	const installedAny = installedBatch || installedCmd || installedPs1;
-	const installedProfileGuard = ensurePowerShellProfileGuard(shimDirectory);
+	const installedProfileGuard = await ensurePowerShellProfileGuard(shimDirectory);
 	if (installedAny || installedProfileGuard) {
 		console.error(
 			"codex-multi-auth: installed Windows shell guards to keep multi-auth routing after codex npm updates.",
@@ -490,7 +549,7 @@ function ensureWindowsShellShimGuards() {
 
 async function main() {
 	hydrateCliVersionEnv();
-	ensureWindowsShellShimGuards();
+	await ensureWindowsShellShimGuards();
 
 	const rawArgs = process.argv.slice(2);
 	const normalizedArgs = normalizeAuthAlias(rawArgs);
diff --git a/scripts/compliance-evidence-bundle.js b/scripts/compliance-evidence-bundle.js
new file mode 100644
index 000000000..f12ea183d
--- /dev/null
+++ b/scripts/compliance-evidence-bundle.js
@@ -0,0 +1,184 @@
+#!/usr/bin/env node
+
+import { execFileSync } from "node:child_process";
+import { mkdir, writeFile } from "node:fs/promises";
+import { resolve, join } from "node:path";
+import process from "node:process";
+
+const PROFILES = {
+	quick: [
+		{ id: "typecheck", args: ["run", "typecheck"] },
+		{ id: "lint", args: ["run", "lint"] },
+		{ id: "build", args: ["run", "build"] },
+		{ id: "health-check", args: ["run", "ops:health-check"] },
+		{ id: "perf-budget", args: ["run", "perf:budget-check"] },
+	],
+	release: [
+		{ id: "typecheck", args: ["run", "typecheck"] },
+		{ id: "lint", args: ["run", "lint"] },
+		{ id: "build", args: ["run", "build"] },
+		{ id: "test", args: ["test"] },
+		{ id: "audit-ci", args: ["run", "audit:ci"] },
+		{ id: "health-check", args: ["run", "ops:health-check"] },
+		{ id: "perf-budget", args: ["run", "perf:budget-check"] },
+		{ id: "sbom-generate", args: ["run", "sbom:generate"] },
+		{ id: "sbom-verify", args: ["run", "sbom:verify"] },
+	],
+};
+const MAX_BUFFER_BYTES = 20 * 1024 * 1024;
+
+function parseArgValue(name) {
+	const prefix = `${name}=`;
+	const hit = process.argv.slice(2).find((arg) => arg.startsWith(prefix));
+	return hit ? hit.slice(prefix.length) : undefined;
+}
+
+function hasFlag(name) {
+	return process.argv.slice(2).includes(name);
+}
+
+function safeExec(command, args, cwd) {
+	try {
+		return execFileSync(command, args, {
+			cwd,
+			encoding: "utf8",
+			stdio: ["ignore", "pipe", "pipe"],
+		});
+	} catch (error) {
+		return (error?.stdout ?? error?.stderr ?? "").toString();
+	}
+}
+
+function runNpm(args, options) {
+	if (process.platform === "win32") {
+		const escaped = args
+			.map((arg) => (/\s/.test(arg) ? `"${arg.replace(/"/g, '\\"')}"` : arg))
+			.join(" ");
+		return execFileSync("cmd.exe", ["/d", "/s", "/c", `npm ${escaped}`], {
+			...options,
+			maxBuffer: MAX_BUFFER_BYTES,
+		});
+	}
+	return execFileSync("npm", args, {
+		...options,
+		maxBuffer: MAX_BUFFER_BYTES,
+	});
+}
+
+function runCheck(entry, cwd, dryRun) {
+	const startedAt = new Date().toISOString();
+	const startedMs = Date.now();
+	if (dryRun) {
+		return {
+			id: entry.id,
+			command: `npm ${entry.args.join(" ")}`,
+			startedAt,
+			durationMs: 0,
+			status: "skipped",
+			exitCode: 0,
+			output: "dry-run",
+		};
+	}
+	try {
+		const output = runNpm(entry.args, {
+			cwd,
+			encoding: "utf8",
+			stdio: ["ignore", "pipe", "pipe"],
+		});
+		return {
+			id: entry.id,
+			command: `npm ${entry.args.join(" ")}`,
+			startedAt,
+			durationMs: Date.now() - startedMs,
+			status: "pass",
+			exitCode: 0,
+			output,
+		};
+	} catch (error) {
+		const stdout = error?.stdout ? String(error.stdout) : "";
+		const stderr = error?.stderr ? String(error.stderr) : "";
+		const message = error instanceof Error ? error.message : String(error);
+		return {
+			id: entry.id,
+			command: `npm ${entry.args.join(" ")}`,
+			startedAt,
+			durationMs: Date.now() - startedMs,
+			status: "fail",
+			exitCode: typeof error?.status === "number" ? error.status : 1,
+			output: `${stdout}${stderr}${stdout || stderr ? "" : message}`,
+		};
+	}
+}
+
+function markdownSummary(payload) {
+	const lines = [
+		"# Compliance Evidence Bundle",
+		"",
+		`Generated at: ${payload.generatedAt}`,
+		`Profile: ${payload.profile}`,
+		`Branch: ${payload.git.branch}`,
+		`Commit: ${payload.git.commit}`,
+		"",
+		"| Check | Status | Exit | Duration (ms) |",
+		"| --- | --- | ---: | ---: |",
+	];
+	for (const result of payload.results) {
+		lines.push(`| ${result.id} | ${result.status} | ${result.exitCode} | ${result.durationMs} |`);
+	}
+	lines.push("", `Overall: **${payload.status.toUpperCase()}**`);
+	return `${lines.join("\n")}\n`;
+}
+
+async function main() {
+	const cwd = process.cwd();
+	const profile = parseArgValue("--profile") ?? "quick";
+	const dryRun = hasFlag("--dry-run");
+	if (!Object.hasOwn(PROFILES, profile)) {
+		throw new Error(`Unknown profile: ${profile}. Expected one of: ${Object.keys(PROFILES).join(", ")}`);
+	}
+
+	const timestamp = new Date().toISOString().replace(/[:.]/g, "-");
+	const outDir = resolve(parseArgValue("--out-dir") ?? join(cwd, ".tmp", "compliance-evidence", timestamp));
+	await mkdir(outDir, { recursive: true });
+
+	const git = {
+		branch: safeExec("git", ["branch", "--show-current"], cwd).trim(),
+		commit: safeExec("git", ["rev-parse", "HEAD"], cwd).trim(),
+	};
+
+	const checks = PROFILES[profile];
+	const results = checks.map((entry) => runCheck(entry, cwd, dryRun));
+	for (let index = 0; index < results.length; index += 1) {
+		const result = results[index];
+		const logName = `${String(index + 1).padStart(2, "0")}-${result.id}.log`;
+		await writeFile(join(outDir, logName), result.output, "utf8");
+	}
+
+	const payload = {
+		command: "compliance-evidence-bundle",
+		generatedAt: new Date().toISOString(),
+		profile,
+		dryRun,
+		outputDir: outDir,
+		git,
+		results: results.map(({ output, ...rest }) => rest),
+		status: results.every((entry) => entry.status === "pass" || entry.status === "skipped")
+			? "pass"
+			: "fail",
+	};
+
+	await writeFile(join(outDir, "manifest.json"), `${JSON.stringify(payload, null, 2)}\n`, "utf8");
+	await writeFile(join(outDir, "summary.md"), markdownSummary(payload), "utf8");
+
+	console.log(JSON.stringify(payload, null, 2));
+	if (payload.status === "fail") {
+		process.exit(1);
+	}
+}
+
+main().catch((error) => {
+	console.error(
+		`compliance-evidence-bundle failed: ${error instanceof Error ? error.message : String(error)}`,
+	);
+	process.exit(1);
+});
diff --git a/scripts/doctor-dev.js b/scripts/doctor-dev.js
new file mode 100644
index 000000000..46d1a632c
--- /dev/null
+++ b/scripts/doctor-dev.js
@@ -0,0 +1,297 @@
+import { spawnSync } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import process from "node:process";
+import { fileURLToPath } from "node:url";
+
+const REQUIRED_NODE_MAJOR = 18;
+const WINDOWS_LOCK_CODES = new Set(["EBUSY", "EPERM", "EACCES"]);
+const PACKAGE_READ_RETRY_ATTEMPTS = 4;
+const PACKAGE_READ_BASE_DELAY_MS = 40;
+
+function sleepSync(milliseconds) {
+	if (milliseconds <= 0) {
+		return;
+	}
+
+	try {
+		const sleepBuffer = new SharedArrayBuffer(4);
+		const sleepArray = new Int32Array(sleepBuffer);
+		Atomics.wait(sleepArray, 0, 0, milliseconds);
+	} catch {
+		const end = Date.now() + milliseconds;
+		while (Date.now() < end) {
+			// Synchronous fallback only used for tiny retry delays.
+		}
+	}
+}
+
+function isWindowsLockError(error) {
+	if (typeof error !== "object" || error === null) {
+		return false;
+	}
+
+	const { code } = error;
+	return typeof code === "string" && WINDOWS_LOCK_CODES.has(code.toUpperCase());
+}
+
+function runCommand(command, args = [], spawnFn = spawnSync) {
+	try {
+		return spawnFn(command, args, {
+			encoding: "utf8",
+			stdio: ["ignore", "pipe", "pipe"],
+		});
+	} catch {
+		return {
+			status: 1,
+			stdout: "",
+			stderr: "",
+		};
+	}
+}
+
+export function splitPathEntries(pathValue, platform = process.platform) {
+	if (typeof pathValue !== "string" || pathValue.trim().length === 0) {
+		return [];
+	}
+
+	const delimiter = platform === "win32" ? ";" : ":";
+	return pathValue
+		.split(delimiter)
+		.map((entry) => entry.trim())
+		.filter((entry) => entry.length > 0);
+}
+
+function commandExistsAtPath(commandPath, pathExists = existsSync) {
+	try {
+		return pathExists(commandPath);
+	} catch {
+		return false;
+	}
+}
+
+export function findCommandInPath(commandName, options = {}) {
+	const env = options.env ?? process.env;
+	const platform = options.platform ?? process.platform;
+	const pathExists = options.pathExists ?? existsSync;
+	const pathEntries = splitPathEntries(env.PATH ?? "", platform);
+	const hasExtension = /\.[A-Za-z0-9]+$/.test(commandName);
+	const windowsExtensions = (env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD;.PS1")
+		.split(";")
+		.map((ext) => ext.trim().toLowerCase())
+		.filter((ext) => ext.length > 0);
+
+	for (const entry of pathEntries) {
+		if (platform !== "win32") {
+			const candidate = join(entry, commandName);
+			if (commandExistsAtPath(candidate, pathExists)) {
+				return candidate;
+			}
+			continue;
+		}
+
+		const candidates = [];
+		if (hasExtension) {
+			candidates.push(join(entry, commandName));
+		} else {
+			candidates.push(join(entry, commandName));
+			for (const extension of windowsExtensions) {
+				candidates.push(join(entry, `${commandName}${extension.toLowerCase()}`));
+			}
+		}
+
+		for (const candidate of candidates) {
+			if (commandExistsAtPath(candidate, pathExists)) {
+				return candidate;
+			}
+		}
+	}
+
+	return null;
+}
+
+export function getNodeMajor(versionText) {
+	const clean = versionText.trim().replace(/^v/, "");
+	const major = Number.parseInt(clean.split(".")[0] ?? "", 10);
+	return Number.isFinite(major) ? major : null;
+}
+
+function parsePackageScripts(packageJsonText) {
+	const packageJson = JSON.parse(packageJsonText);
+	if (typeof packageJson !== "object" || packageJson === null) {
+		return null;
+	}
+
+	const scripts = packageJson.scripts;
+	if (typeof scripts !== "object" || scripts === null) {
+		return null;
+	}
+
+	return scripts;
+}
+
+export function readPackageScripts(repoRoot, options = {}) {
+	const platform = options.platform ?? process.platform;
+	const pathExists = options.pathExists ?? existsSync;
+	const readFile = options.readFile ?? readFileSync;
+	const maxAttempts =
+		typeof options.maxAttempts === "number"
+			? options.maxAttempts
+			: platform === "win32"
+				? PACKAGE_READ_RETRY_ATTEMPTS
+				: 1;
+	const baseDelayMs =
+		typeof options.baseDelayMs === "number"
+			? options.baseDelayMs
+			: PACKAGE_READ_BASE_DELAY_MS;
+
+	const packageJsonPath = join(repoRoot, "package.json");
+	if (!pathExists(packageJsonPath)) {
+		return null;
+	}
+
+	for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
+		try {
+			const packageJsonText = readFile(packageJsonPath, "utf8");
+			return parsePackageScripts(packageJsonText);
+		} catch (error) {
+			const shouldRetry =
+				platform === "win32" &&
+				isWindowsLockError(error) &&
+				attempt < maxAttempts;
+			if (shouldRetry) {
+				const delayMs = baseDelayMs * 2 ** (attempt - 1);
+				sleepSync(delayMs);
+				continue;
+			}
+			return null;
+		}
+	}
+
+	return null;
+}
+
+export function runDevDoctor(options = {}) {
+	const cwd = resolve(options.cwd ?? process.cwd());
+	const platform = options.platform ?? process.platform;
+	const env = options.env ?? process.env;
+	const execPath = options.execPath ?? process.execPath;
+	const nodeVersion = options.nodeVersion ?? process.version;
+	const pathExists = options.pathExists ?? existsSync;
+	const readFile = options.readFile ?? readFileSync;
+	const spawnFn = options.spawnSync ?? spawnSync;
+	const log = options.log ?? console.log;
+	const warn = options.warn ?? console.warn;
+	const error = options.error ?? console.error;
+	const failures = [];
+	const warnings = [];
+	const details = [];
+
+	const nodeMajor = getNodeMajor(nodeVersion);
+	if (nodeMajor === null || nodeMajor < REQUIRED_NODE_MAJOR) {
+		failures.push(
+			`Node.js ${REQUIRED_NODE_MAJOR}+ is required. Found ${nodeVersion}.`,
+		);
+	} else {
+		details.push(`Node.js ${nodeVersion} OK`);
+	}
+
+	const npmExecPathFromEnv = (env.npm_execpath ?? "").trim();
+	const npmPath =
+		npmExecPathFromEnv.length > 0
+			? npmExecPathFromEnv
+			: findCommandInPath("npm", { env, platform, pathExists });
+	if (!npmPath) {
+		failures.push("npm is required but was not found in PATH.");
+	} else {
+		const npmCheck =
+			npmExecPathFromEnv.length > 0
+				? runCommand(execPath, [npmExecPathFromEnv, "--version"], spawnFn)
+				: runCommand(npmPath, ["--version"], spawnFn);
+		const npmOutput = `${npmCheck.stdout ?? ""}`.trim();
+		if (npmCheck.status === 0 && npmOutput.length > 0) {
+			details.push(`npm ${npmOutput} OK`);
+		} else {
+			failures.push(`npm entrypoint detected at ${npmPath} but could not be executed.`);
+		}
+	}
+
+	const gitPath = findCommandInPath("git", { env, platform, pathExists });
+	if (!gitPath) {
+		failures.push("git is required but was not found in PATH.");
+	} else {
+		const gitCheck = runCommand(gitPath, ["--version"], spawnFn);
+		const gitOutput = `${gitCheck.stdout ?? ""}`.trim();
+		if (gitCheck.status === 0 && gitOutput.length > 0) {
+			details.push(`${gitOutput} OK`);
+		} else {
+			failures.push(`git entrypoint detected at ${gitPath} but could not be executed.`);
+		}
+	}
+
+	if (!pathExists(join(cwd, ".git"))) {
+		failures.push(`No .git entry found in ${cwd}. Run this command from repo root.`);
+	} else {
+		details.push("Git worktree root detected");
+	}
+
+	if (!pathExists(join(cwd, "package.json"))) {
+		failures.push("package.json is missing in the current directory.");
+	} else {
+		details.push("package.json detected");
+	}
+
+	if (!pathExists(join(cwd, "package-lock.json"))) {
+		failures.push("package-lock.json is missing. This repo expects npm lockfile-based installs.");
+	} else {
+		details.push("package-lock.json detected");
+	}
+
+	const scripts = readPackageScripts(cwd, { platform, pathExists, readFile });
+	const requiredScripts = ["typecheck", "lint", "test", "build", "verify"];
+	if (!scripts) {
+		failures.push(
+			"Unable to read package.json scripts. Re-run doctor:dev if Windows EBUSY/EPERM file locks are transient.",
+		);
+	} else {
+		for (const scriptName of requiredScripts) {
+			if (typeof scripts[scriptName] !== "string") {
+				failures.push(`Missing required npm script: ${scriptName}`);
+			}
+		}
+	}
+
+	if (!pathExists(join(cwd, "node_modules"))) {
+		warnings.push("node_modules is missing. Run npm ci before running local validation.");
+	}
+
+	for (const detail of details) {
+		log(`OK: ${detail}`);
+	}
+	for (const warning of warnings) {
+		warn(`WARN: ${warning}`);
+	}
+	for (const failure of failures) {
+		error(`ERROR: ${failure}`);
+	}
+
+	if (failures.length > 0) {
+		error("Dev doctor failed. Fix errors above and re-run.");
+		return 1;
+	}
+
+	log("Dev doctor passed.");
+	return 0;
+}
+
+const isDirectRun = (() => {
+	try {
+		return resolve(process.argv[1] ?? "") === fileURLToPath(import.meta.url);
+	} catch {
+		return false;
+	}
+})();
+
+if (isDirectRun) {
+	process.exitCode = runDevDoctor();
+}
diff --git a/scripts/enterprise-health-check.js b/scripts/enterprise-health-check.js
new file mode 100644
index 000000000..9c9724d86
--- /dev/null
+++ b/scripts/enterprise-health-check.js
@@ -0,0 +1,296 @@
+#!/usr/bin/env node
+
+import { existsSync, readdirSync } from "node:fs";
+import { readdir, stat } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join, win32 } from "node:path";
+
+const WAL_STALE_MS = 24 * 60 * 60 * 1000;
+const MAX_AUDIT_STALENESS_MS = 7 * 24 * 60 * 60 * 1000;
+
+function parseArgValue(flagName) {
+	for (const arg of process.argv.slice(2)) {
+		if (arg.startsWith(`${flagName}=`)) {
+			return arg.slice(flagName.length + 1).trim();
+		}
+	}
+	return "";
+}
+
+function hasFlag(flag) {
+	return process.argv.slice(2).includes(flag);
+}
+
+function firstNonEmpty(values) {
+	for (const value of values) {
+		const trimmed = (value ?? "").trim();
+		if (trimmed.length > 0) {
+			return trimmed;
+		}
+	}
+	return null;
+}
+
+function getResolvedUserHomeDir() {
+	if (process.platform === "win32") {
+		const homeDrive = (process.env.HOMEDRIVE ?? "").trim();
+		const homePath = (process.env.HOMEPATH ?? "").trim();
+		const drivePathHome =
+			homeDrive.length > 0 && homePath.length > 0
+				? win32.resolve(`${homeDrive}\\`, homePath)
+				: undefined;
+		return (
+			firstNonEmpty([
+				process.env.USERPROFILE,
+				process.env.HOME,
+				drivePathHome,
+				homedir(),
+			]) ?? homedir()
+		);
+	}
+	return firstNonEmpty([process.env.HOME, homedir()]) ?? homedir();
+}
+
+function deduplicatePaths(paths) {
+	const seen = new Set();
+	const unique = [];
+	for (const path of paths) {
+		const trimmed = (path ?? "").trim();
+		if (trimmed.length === 0) continue;
+		const key = process.platform === "win32" ? trimmed.toLowerCase() : trimmed;
+		if (seen.has(key)) continue;
+		seen.add(key);
+		unique.push(trimmed);
+	}
+	return unique;
+}
+
+function getCodexHomeDir() {
+	const fromEnv = (process.env.CODEX_HOME ?? "").trim();
+	return fromEnv.length > 0 ? fromEnv : join(getResolvedUserHomeDir(), ".codex");
+}
+
+function hasStorageSignals(dir) {
+	const signals = [
+		"openai-codex-accounts.json",
+		"codex-accounts.json",
+		"settings.json",
+		"config.json",
+		"dashboard-settings.json",
+	];
+	for (const signal of signals) {
+		if (existsSync(join(dir, signal))) {
+			return true;
+		}
+	}
+	return existsSync(join(dir, "projects"));
+}
+
+function hasAccountsStorage(dir) {
+	const accountFiles = ["openai-codex-accounts.json", "codex-accounts.json"];
+	for (const fileName of accountFiles) {
+		if (existsSync(join(dir, fileName)) || existsSync(join(dir, `${fileName}.wal`))) {
+			return true;
+		}
+	}
+	try {
+		const entries = readdirSync(dir, { withFileTypes: true });
+		for (const entry of entries) {
+			if (!entry.isFile()) continue;
+			for (const fileName of accountFiles) {
+				if (!entry.name.startsWith(`${fileName}.`)) continue;
+				if (entry.name.endsWith(".tmp")) continue;
+				if (entry.name.includes(".rotate.")) continue;
+				return true;
+			}
+		}
+	} catch {
+		// Ignore unreadable directories and fall back to known filename probes.
+	}
+	return false;
+}
+
+function getFallbackCodexHomeDirs() {
+	const userHome = getResolvedUserHomeDir();
+	return deduplicatePaths([
+		getCodexHomeDir(),
+		join(userHome, "DevTools", "config", "codex"),
+		join(userHome, ".codex"),
+	]);
+}
+
+function resolveRoot() {
+	const overrideArg = parseArgValue("--root");
+	if (overrideArg.length > 0) return overrideArg;
+
+	const overrideEnv = (process.env.CODEX_MULTI_AUTH_DIR ?? "").trim();
+	if (overrideEnv.length > 0) return overrideEnv;
+
+	const primary = join(getCodexHomeDir(), "multi-auth");
+	const fallbackCandidates = deduplicatePaths([
+		...getFallbackCodexHomeDirs().map((dir) => join(dir, "multi-auth")),
+		join(getResolvedUserHomeDir(), ".codex"),
+	]);
+	const orderedCandidates = deduplicatePaths([primary, ...fallbackCandidates]);
+
+	for (const candidate of orderedCandidates) {
+		if (hasAccountsStorage(candidate)) {
+			return candidate;
+		}
+	}
+	if (hasStorageSignals(primary)) {
+		return primary;
+	}
+	for (const candidate of fallbackCandidates) {
+		if (candidate === primary) continue;
+		if (hasStorageSignals(candidate)) {
+			return candidate;
+		}
+	}
+	return primary;
+}
+
+function getAuditDir(root) {
+	// Mirrors getCodexLogDir() from lib/runtime-paths.ts by deriving logs from the resolved multi-auth root.
+	return join(root, "logs");
+}
+
+async function newestMtimeMs(dir) {
+	if (!existsSync(dir)) return null;
+	let entries;
+	try {
+		entries = await readdir(dir, { withFileTypes: true });
+	} catch (error) {
+		const code = error?.code;
+		if (code === "ENOENT" || code === "ENOTDIR") {
+			return null;
+		}
+		throw error;
+	}
+	let newest = null;
+	for (const entry of entries) {
+		if (!entry.isFile()) continue;
+		const fullPath = join(dir, entry.name);
+		try {
+			const details = await stat(fullPath);
+			if (newest === null || details.mtimeMs > newest) {
+				newest = details.mtimeMs;
+			}
+		} catch {
+			// Ignore transient stat failures.
+		}
+	}
+	return newest;
+}
+
+async function checkSecureMode(path, findings) {
+	if (process.platform === "win32") return;
+	try {
+		const details = await stat(path);
+		const perms = details.mode & 0o777;
+		if (perms !== 0o600) {
+			findings.push({
+				severity: "high",
+				code: "insecure-file-permissions",
+				path,
+				message: `expected 0600 permissions, found ${perms.toString(8)}`,
+			});
+		}
+	} catch (error) {
+		if (error?.code === "ENOENT") return;
+		findings.push({
+			severity: "medium",
+			code: "stat-failed",
+			path,
+			message: error instanceof Error ? error.message : String(error),
+		});
+	}
+}
+
+async function run() {
+	const now = Date.now();
+	const requireFiles = hasFlag("--require-files");
+	const root = resolveRoot();
+	const findings = [];
+	const checks = [];
+
+	const storagePath = join(root, "openai-codex-accounts.json");
+	const settingsPath = join(root, "settings.json");
+	const walPath = `${storagePath}.wal`;
+	const auditDir = getAuditDir(root);
+
+	try {
+		const walStats = await stat(walPath);
+		const walAgeMs = now - walStats.mtimeMs;
+		checks.push({ name: "wal-age-ms", value: walAgeMs });
+		if (walAgeMs > WAL_STALE_MS) {
+			findings.push({
+				severity: "high",
+				code: "stale-wal",
+				path: walPath,
+				message: `WAL file older than ${WAL_STALE_MS}ms`,
+			});
+		}
+	} catch {
+		// WAL does not exist or is transiently unavailable.
+	}
+
+	await checkSecureMode(storagePath, findings);
+	await checkSecureMode(settingsPath, findings);
+
+	const newestAuditMs = await newestMtimeMs(auditDir);
+	checks.push({ name: "newest-audit-mtime-ms", value: newestAuditMs });
+	if (newestAuditMs !== null && now - newestAuditMs > MAX_AUDIT_STALENESS_MS) {
+		findings.push({
+			severity: "medium",
+			code: "stale-audit-log",
+			path: auditDir,
+			message: `no audit activity in ${MAX_AUDIT_STALENESS_MS}ms`,
+		});
+	}
+
+	if (requireFiles) {
+		const requiredArtifacts = [
+			{ path: storagePath, code: "missing-storage-file" },
+			{ path: settingsPath, code: "missing-settings-file" },
+			{ path: auditDir, code: "missing-audit-dir" },
+		];
+		for (const artifact of requiredArtifacts) {
+			if (!existsSync(artifact.path)) {
+				findings.push({
+					severity: "high",
+					code: artifact.code,
+					path: artifact.path,
+					message: "required artifact missing for enterprise health validation",
+				});
+			}
+		}
+		if (newestAuditMs === null) {
+			findings.push({
+				severity: "high",
+				code: "missing-audit-events",
+				path: auditDir,
+				message: "required audit log entries missing for enterprise health validation",
+			});
+		}
+	}
+
+	const highFindings = findings.filter((entry) => entry.severity === "high");
+	const payload = {
+		command: "enterprise-health-check",
+		root,
+		auditDir,
+		status: highFindings.length === 0 ? "pass" : "fail",
+		checks,
+		findings,
+	};
+	console.log(JSON.stringify(payload, null, 2));
+	if (highFindings.length > 0) {
+		process.exit(1);
+	}
+}
+
+run().catch((error) => {
+	console.error(`enterprise-health-check failed: ${error instanceof Error ? error.message : String(error)}`);
+	process.exit(1);
+});
diff --git a/scripts/generate-sbom.js b/scripts/generate-sbom.js
new file mode 100644
index 000000000..2f0f75ffc
--- /dev/null
+++ b/scripts/generate-sbom.js
@@ -0,0 +1,45 @@
+#!/usr/bin/env node
+
+import { execFileSync } from "node:child_process";
+import { mkdir, writeFile } from "node:fs/promises";
+import { resolve } from "node:path";
+import process from "node:process";
+
+const MAX_BUFFER_BYTES = 20 * 1024 * 1024;
+
+async function main() {
+	const npmExecPath = process.env.npm_execpath;
+	const outPath = resolve(".tmp/sbom.cdx.json");
+	await mkdir(resolve(".tmp"), { recursive: true });
+	const sbomArgs = ["sbom", "--omit=dev", "--sbom-format=cyclonedx", "--json"];
+	const sbom = npmExecPath
+		? execFileSync(process.execPath, [npmExecPath, ...sbomArgs], {
+				cwd: process.cwd(),
+				encoding: "utf8",
+				stdio: ["ignore", "pipe", "pipe"],
+				maxBuffer: MAX_BUFFER_BYTES,
+			})
+		: execFileSync(process.platform === "win32" ? "npm.cmd" : "npm", sbomArgs, {
+				cwd: process.cwd(),
+				encoding: "utf8",
+				stdio: ["ignore", "pipe", "pipe"],
+				maxBuffer: MAX_BUFFER_BYTES,
+			});
+	await writeFile(outPath, `${sbom.trim()}\n`, "utf8");
+	console.log(
+		JSON.stringify(
+			{
+				command: "generate-sbom",
+				outputPath: outPath,
+				status: "pass",
+			},
+			null,
+			2,
+		),
+	);
+}
+
+main().catch((error) => {
+	console.error(`generate-sbom failed: ${error instanceof Error ? error.message : String(error)}`);
+	process.exit(1);
+});
diff --git a/scripts/keychain-assert.js b/scripts/keychain-assert.js
new file mode 100644
index 000000000..0d80612fd
--- /dev/null
+++ b/scripts/keychain-assert.js
@@ -0,0 +1,38 @@
+#!/usr/bin/env node
+
+import { execFileSync } from "node:child_process";
+import process from "node:process";
+
+function main() {
+	const args = [
+		"run",
+		"test",
+		"--",
+		"test/storage-v4-keychain.test.ts",
+		"test/token-store.test.ts",
+	];
+	const env = {
+		...process.env,
+		CODEX_SECRET_STORAGE_MODE: "keychain",
+	};
+	if (process.env.npm_execpath) {
+		execFileSync(process.execPath, [process.env.npm_execpath, ...args], {
+			cwd: process.cwd(),
+			stdio: "inherit",
+			env,
+		});
+		return;
+	}
+	const npmBin = process.platform === "win32" ? "npm.cmd" : "npm";
+	execFileSync(npmBin, args, {
+		cwd: process.cwd(),
+		stdio: "inherit",
+		env,
+	});
+}
+
+try {
+	main();
+} catch (error) {
+	process.exit(typeof error?.status === "number" ? error.status : 1);
+}
diff --git a/scripts/license-policy-check.js b/scripts/license-policy-check.js
new file mode 100644
index 000000000..818926c2c
--- /dev/null
+++ b/scripts/license-policy-check.js
@@ -0,0 +1,106 @@
+#!/usr/bin/env node
+
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+
+const lockPath = resolve(process.cwd(), "package-lock.json");
+function normalizeSpdxToken(value) {
+	return value
+		.trim()
+		.toUpperCase()
+		.replace(/\+$/g, "")
+		.replace(/-(ONLY|OR-LATER)$/g, "");
+}
+
+const denyList = (process.env.CODEX_LICENSE_DENYLIST ?? "GPL-2.0,GPL-3.0,AGPL-3.0")
+	.split(",")
+	.map((value) => normalizeSpdxToken(value))
+	.filter((value) => value.length > 0);
+const failOnUnknown = process.env.CODEX_LICENSE_FAIL_ON_UNKNOWN === "1";
+
+const packageLock = JSON.parse(readFileSync(lockPath, "utf8"));
+const packages = packageLock.packages ?? {};
+
+const violations = [];
+const unknown = [];
+
+function normalizeLicenseValue(value) {
+	if (typeof value === "string") {
+		return value;
+	}
+	if (value && typeof value === "object" && typeof value.type === "string") {
+		return value.type;
+	}
+	return "";
+}
+
+function extractRawLicense(record) {
+	const direct = normalizeLicenseValue(record.license);
+	if (direct) return direct;
+
+	if (typeof record.licenses === "string") {
+		return record.licenses;
+	}
+	if (Array.isArray(record.licenses)) {
+		const values = record.licenses
+			.map((entry) => normalizeLicenseValue(entry))
+			.filter((entry) => entry.length > 0);
+		if (values.length > 0) {
+			return values.join(" OR ");
+		}
+	}
+
+	return "";
+}
+
+function extractLicenseTokens(rawLicense) {
+	return rawLicense
+		.toUpperCase()
+		.split(/[^A-Z0-9.+-]+/)
+		.map((value) => normalizeSpdxToken(value))
+		.filter((value) => value.length > 0);
+}
+
+for (const [packagePath, metadata] of Object.entries(packages)) {
+	if (!metadata || typeof metadata !== "object") continue;
+	if (packagePath === "") continue;
+	const record = metadata;
+	const name = typeof record.name === "string" ? record.name : packagePath;
+	const version = typeof record.version === "string" ? record.version : "0.0.0";
+	const rawLicense = extractRawLicense(record);
+	const normalized = rawLicense.trim().toUpperCase();
+	if (!normalized) {
+		unknown.push(`${name}@${version}`);
+		continue;
+	}
+	const tokens = new Set(extractLicenseTokens(normalized));
+	for (const denied of denyList) {
+		if (tokens.has(denied)) {
+			violations.push(`${name}@${version} (${rawLicense})`);
+			break;
+		}
+	}
+}
+
+if (violations.length > 0) {
+	console.error("License policy violations detected:");
+	for (const entry of violations) {
+		console.error(`- ${entry}`);
+	}
+	process.exit(1);
+}
+
+if (unknown.length > 0) {
+	console.warn(`Packages with unknown license: ${unknown.length}`);
+	for (const entry of unknown.slice(0, 20)) {
+		console.warn(`- ${entry}`);
+	}
+	if (unknown.length > 20) {
+		console.warn(`- ...and ${unknown.length - 20} more`);
+	}
+	if (failOnUnknown) {
+		process.exit(1);
+	}
+}
+
+console.log("License policy check passed.");
diff --git a/scripts/performance-budget-check.js b/scripts/performance-budget-check.js
new file mode 100644
index 000000000..4eae967d7
--- /dev/null
+++ b/scripts/performance-budget-check.js
@@ -0,0 +1,105 @@
+#!/usr/bin/env node
+
+import { execFileSync } from "node:child_process";
+import { existsSync, mkdirSync, readFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+
+// Every threshold in config/performance-budgets.json is interpreted in milliseconds.
+const projectRoot = process.cwd();
+const outputPath = resolve(projectRoot, ".tmp", "runtime-budget-report.json");
+const budgetPath = resolve(projectRoot, "config", "performance-budgets.json");
+
+function runBenchmark() {
+	if (!existsSync(resolve(projectRoot, ".tmp"))) {
+		mkdirSync(resolve(projectRoot, ".tmp"), { recursive: true });
+	}
+	execFileSync(
+		process.execPath,
+		["scripts/benchmark-runtime-path.mjs", "--iterations=10", `--output=${outputPath}`],
+		{
+			cwd: projectRoot,
+			stdio: "pipe",
+			encoding: "utf8",
+		},
+	);
+}
+
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function parseJsonFile(path, label) {
+	try {
+		return JSON.parse(readFileSync(path, "utf8"));
+	} catch (error) {
+		const message = error instanceof Error ? error.message : String(error);
+		throw new Error(`invalid ${label} json at ${path}: ${message}`);
+	}
+}
+
+function main() {
+	runBenchmark();
+	if (!existsSync(budgetPath)) {
+		throw new Error(`budget file not found: ${budgetPath}`);
+	}
+	if (!existsSync(outputPath)) {
+		throw new Error(`benchmark report not found: ${outputPath}`);
+	}
+	const budgetsRaw = parseJsonFile(budgetPath, "budget");
+	if (!isRecord(budgetsRaw)) {
+		throw new Error(`invalid budget json at ${budgetPath}: root must be an object`);
+	}
+	const reportRaw = parseJsonFile(outputPath, "benchmark report");
+	const results = isRecord(reportRaw) && Array.isArray(reportRaw.results) ? reportRaw.results : [];
+	const violations = [];
+	const seen = new Set();
+
+	for (const result of results) {
+		if (!isRecord(result) || typeof result.name !== "string") {
+			continue;
+		}
+		seen.add(result.name);
+		const budget = budgetsRaw[result.name];
+		if (typeof budget !== "number") continue;
+		if (typeof result.avgMs !== "number") continue;
+		if (result.avgMs > budget) {
+			violations.push({
+				name: result.name,
+				avgMs: result.avgMs,
+				budgetMs: budget,
+			});
+		}
+	}
+	for (const [name, budgetMs] of Object.entries(budgetsRaw)) {
+		if (typeof budgetMs !== "number") continue;
+		if (!seen.has(name)) {
+			violations.push({
+				name,
+				avgMs: null,
+				budgetMs,
+				reason: "missing benchmark metric",
+			});
+		}
+	}
+
+	const payload = {
+		command: "performance-budget-check",
+		generatedAt: new Date().toISOString(),
+		reportPath: outputPath,
+		violations,
+		status: violations.length === 0 ? "pass" : "fail",
+	};
+	console.log(JSON.stringify(payload, null, 2));
+	if (violations.length > 0) {
+		process.exit(1);
+	}
+}
+
+try {
+	main();
+} catch (error) {
+	console.error(
+		`performance-budget-check failed: ${error instanceof Error ? error.message : String(error)}`,
+	);
+	process.exit(1);
+}
diff --git a/scripts/retention-cleanup.js b/scripts/retention-cleanup.js
new file mode 100644
index 000000000..01f05cef3
--- /dev/null
+++ b/scripts/retention-cleanup.js
@@ -0,0 +1,127 @@
+#!/usr/bin/env node
+
+import { existsSync } from "node:fs";
+import { readdir, rm, stat } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+const RETRYABLE_REMOVE_CODES = new Set(["EBUSY", "EPERM", "ENOTEMPTY"]);
+const DEFAULT_RETENTION_DAYS = 90;
+
+function parseRetentionDays(raw) {
+	if (!raw) return DEFAULT_RETENTION_DAYS;
+	const parsed = Number.parseInt(raw, 10);
+	if (!Number.isFinite(parsed) || parsed <= 0) return DEFAULT_RETENTION_DAYS;
+	return parsed;
+}
+
+function parseArgDays(args) {
+	for (const arg of args) {
+		if (arg.startsWith("--days=")) {
+			return parseRetentionDays(arg.slice("--days=".length));
+		}
+	}
+	return parseRetentionDays(process.env.CODEX_RETENTION_DAYS);
+}
+
+function resolveRuntimeRoot() {
+	const override = (process.env.CODEX_MULTI_AUTH_DIR ?? "").trim();
+	if (override.length > 0) return override;
+	return join(homedir(), ".codex", "multi-auth");
+}
+
+async function removeWithRetry(targetPath, options) {
+	for (let attempt = 0; attempt < 6; attempt += 1) {
+		try {
+			await rm(targetPath, options);
+			return;
+		} catch (error) {
+			const code = error?.code;
+			if (code === "ENOENT") return;
+			if (!code || !RETRYABLE_REMOVE_CODES.has(code) || attempt === 5) {
+				throw error;
+			}
+			await new Promise((resolve) => setTimeout(resolve, 25 * 2 ** attempt));
+		}
+	}
+}
+
+async function collectExpiredFiles(rootPath, cutoffMs, output) {
+	if (!existsSync(rootPath)) return;
+	let entries;
+	try {
+		entries = await readdir(rootPath, { withFileTypes: true });
+	} catch (error) {
+		const code = error?.code;
+		if (code === "ENOENT" || code === "ENOTDIR" || code === "EPERM") {
+			return;
+		}
+		throw error;
+	}
+	for (const entry of entries) {
+		const fullPath = join(rootPath, entry.name);
+		if (entry.isDirectory()) {
+			await collectExpiredFiles(fullPath, cutoffMs, output);
+			continue;
+		}
+		if (!entry.isFile()) continue;
+		try {
+			const metadata = await stat(fullPath);
+			if (metadata.mtimeMs < cutoffMs) {
+				output.push(fullPath);
+			}
+		} catch {
+			// Ignore transient stat failures.
+		}
+	}
+}
+
+async function run() {
+	const retentionDays = parseArgDays(process.argv.slice(2));
+	const root = resolveRuntimeRoot();
+	const cutoffMs = Date.now() - retentionDays * 24 * 60 * 60 * 1000;
+	const targets = [
+		join(root, "logs"),
+		join(root, "cache"),
+		join(root, "recovery"),
+	];
+
+	const expired = [];
+	for (const target of targets) {
+		await collectExpiredFiles(target, cutoffMs, expired);
+	}
+
+	let deletedFiles = 0;
+	const failed = [];
+	for (const targetPath of expired) {
+		try {
+			await removeWithRetry(targetPath, { force: true });
+			deletedFiles += 1;
+		} catch (error) {
+			failed.push({
+				path: targetPath,
+				error: error instanceof Error ? error.message : String(error),
+			});
+		}
+	}
+
+	const payload = {
+		command: "retention-cleanup",
+		root,
+		retentionDays,
+		cutoffIso: new Date(cutoffMs).toISOString(),
+		deletedFiles,
+		failedFiles: failed.length,
+		failures: failed,
+		status: failed.length === 0 ? "pass" : "partial",
+	};
+	console.log(JSON.stringify(payload, null, 2));
+	if (failed.length > 0) {
+		process.exit(1);
+	}
+}
+
+run().catch((error) => {
+	console.error(`retention-cleanup failed: ${error instanceof Error ? error.message : String(error)}`);
+	process.exit(1);
+});
diff --git a/scripts/secret-scan-regression.sh b/scripts/secret-scan-regression.sh
new file mode 100644
index 000000000..2d04aa770
--- /dev/null
+++ b/scripts/secret-scan-regression.sh
@@ -0,0 +1,153 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+ROOT_DIR="$(git rev-parse --show-toplevel)"
+CONFIG_PATH="${GITLEAKS_CONFIG:-.gitleaks.toml}"
+EXPECTED_GITLEAKS_VERSION="${EXPECTED_GITLEAKS_VERSION:-v8.25.0}"
+if [[ "${CONFIG_PATH}" != /* ]]; then
+	CONFIG_PATH="${ROOT_DIR}/${CONFIG_PATH}"
+fi
+
+if [[ ! -f "${CONFIG_PATH}" ]]; then
+	echo "secret-scan-regression: missing gitleaks config at ${CONFIG_PATH}" >&2
+	exit 1
+fi
+
+TMP_DIR="$(mktemp -d)"
+cleanup() {
+	rm -rf "${TMP_DIR}"
+}
+trap cleanup EXIT
+
+FAIL_CASE_DIR="${TMP_DIR}/fail-case"
+PASS_CASE_DIR="${TMP_DIR}/pass-case"
+mkdir -p "${FAIL_CASE_DIR}/src" "${FAIL_CASE_DIR}/test/security/fixtures" "${PASS_CASE_DIR}/test/security/fixtures"
+
+cat > "${FAIL_CASE_DIR}/src/leak.txt" <<'EOF'
+OPENAI_API_KEY=sk-test-placeholder-leak-12345678901234567890
+EOF
+cat > "${FAIL_CASE_DIR}/test/security/fixtures/fixture.txt" <<'EOF'
+OPENAI_API_KEY=sk-test-allowlist-should-exclude-1234567890
+EOF
+cat > "${FAIL_CASE_DIR}/test/security/fixtures/real-secret.txt" <<'EOF'
+OPENAI_API_KEY=sk-test-placeholder-in-fixture-12345678901234567890
+EOF
+cat > "${PASS_CASE_DIR}/test/security/fixtures/fixture.txt" <<'EOF'
+fake_refresh_token_67890
+EOF
+
+node -e '
+const fs = require("node:fs");
+const configPath = process.argv[1];
+const config = fs.readFileSync(configPath, "utf8");
+if (!config.includes("^test[\\\\/]security[\\\\/]fixtures[\\\\/]")) {
+  throw new Error("expected fixture allowlist path for test/security/fixtures");
+}
+const windowsFixturePath = "test\\\\security\\\\fixtures\\\\fixture.txt";
+const fixturePattern = /^test[\\/]security[\\/]fixtures[\\/]/i;
+if (!fixturePattern.test(windowsFixturePath)) {
+  throw new Error("windows fixture path regex parity check failed");
+}
+' "${CONFIG_PATH}"
+
+FAIL_REPORT="${TMP_DIR}/fail-report.json"
+PASS_REPORT="${TMP_DIR}/pass-report.json"
+
+run_gitleaks_detect() {
+	local source_dir="$1"
+	local report_path="$2"
+
+	if command -v gitleaks >/dev/null 2>&1; then
+		# Native binary path should match the docker fallback major/minor behavior.
+		echo "secret-scan-regression: native gitleaks expected compatibility with ${EXPECTED_GITLEAKS_VERSION}" >/dev/null
+		gitleaks detect \
+			--source "${source_dir}" \
+			--config "${CONFIG_PATH}" \
+			--report-format json \
+			--report-path "${report_path}" \
+			--no-git
+		return
+	fi
+
+	if ! command -v docker >/dev/null 2>&1; then
+		node -e '
+const fs = require("node:fs");
+const path = require("node:path");
+const [sourceDir, reportPath] = process.argv.slice(1);
+const findings = [];
+const allowlistedFixture = /test[\\/]+security[\\/]+fixtures[\\/]+fixture\.txt$/i;
+const secretPattern = /OPENAI_API_KEY=sk-[A-Za-z0-9-]{10,}/;
+function walk(dir) {
+  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+    const full = path.join(dir, entry.name);
+    if (entry.isDirectory()) {
+      walk(full);
+      continue;
+    }
+    if (!entry.isFile()) continue;
+    const rel = path.relative(sourceDir, full).replace(/\\/g, "/");
+    const content = fs.readFileSync(full, "utf8");
+    if (!secretPattern.test(content)) continue;
+    if (allowlistedFixture.test(rel)) continue;
+    findings.push({ File: rel });
+  }
+}
+walk(sourceDir);
+fs.writeFileSync(reportPath, JSON.stringify(findings, null, 2), "utf8");
+process.exit(findings.length > 0 ? 1 : 0);
+' "${source_dir}" "${report_path}"
+		return
+	fi
+
+	docker run --rm \
+		-v "${source_dir}:/scan" \
+		-v "${CONFIG_PATH}:/config/.gitleaks.toml:ro" \
+		-v "${TMP_DIR}:/out" \
+		"zricethezav/gitleaks:${EXPECTED_GITLEAKS_VERSION}" \
+		detect \
+		--source /scan \
+		--config /config/.gitleaks.toml \
+		--report-format json \
+		--report-path "/out/$(basename "${report_path}")" \
+		--no-git
+}
+
+set +e
+run_gitleaks_detect "${FAIL_CASE_DIR}" "${FAIL_REPORT}" >/dev/null 2>&1
+FAIL_STATUS=$?
+set -e
+
+if [[ "${FAIL_STATUS}" -eq 0 ]]; then
+	echo "secret-scan-regression: expected fail-case scan to fail, but it passed" >&2
+	exit 1
+fi
+
+node -e '
+const fs = require("node:fs");
+const [reportPath] = process.argv.slice(1);
+const findings = JSON.parse(fs.readFileSync(reportPath, "utf8"));
+if (!Array.isArray(findings) || findings.length === 0) {
+  throw new Error("expected non-empty findings for fail-case scan");
+}
+if (!findings.some((f) => typeof f?.File === "string" && f.File.includes("src/leak.txt"))) {
+  throw new Error("expected finding for src/leak.txt");
+}
+if (!findings.some((f) => typeof f?.File === "string" && f.File.includes("test/security/fixtures/real-secret.txt"))) {
+  throw new Error("expected finding for non-allowlisted secret in fixture path");
+}
+if (findings.some((f) => typeof f?.File === "string" && f.File.includes("test/security/fixtures/fixture.txt"))) {
+  throw new Error("allowlisted fixture unexpectedly reported");
+}
+' "${FAIL_REPORT}"
+
+set +e
+run_gitleaks_detect "${PASS_CASE_DIR}" "${PASS_REPORT}" >/dev/null 2>&1
+PASS_STATUS=$?
+set -e
+if [[ "${PASS_STATUS}" -ne 0 ]]; then
+	echo "secret-scan-regression: expected pass-case scan to succeed, but it failed (status=${PASS_STATUS})" >&2
+	exit 1
+fi
+
+echo "secret-scan-regression: passed"
diff --git a/scripts/seed-health-fixture.js b/scripts/seed-health-fixture.js
new file mode 100644
index 000000000..1785f4e18
--- /dev/null
+++ b/scripts/seed-health-fixture.js
@@ -0,0 +1,66 @@
+#!/usr/bin/env node
+
+import { chmodSync, mkdirSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+const workspace = process.env.GITHUB_WORKSPACE ?? process.cwd();
+const root = join(workspace, ".tmp", "health-fixture");
+const logsDir = join(root, "logs");
+
+mkdirSync(logsDir, { recursive: true, mode: 0o700 });
+const accountsPath = join(root, "openai-codex-accounts.json");
+writeFileSync(
+	accountsPath,
+	`${JSON.stringify(
+		{
+			version: 4,
+			accounts: [
+				{
+					refreshTokenRef: "fixture-account:refresh",
+					accessTokenRef: "fixture-account:access",
+					addedAt: 1,
+					lastUsed: 1,
+				},
+			],
+			activeIndex: 0,
+			activeIndexByFamily: {
+				codex: 0,
+				legacy: 0,
+				gpt5: 0,
+				o3: 0,
+				o4mini: 0,
+				oss: 0,
+			},
+		},
+		null,
+		2,
+	)}\n`,
+	{ encoding: "utf8", mode: 0o600 },
+);
+try {
+	chmodSync(accountsPath, 0o600);
+} catch {
+	// Best-effort hardening for non-posix environments.
+}
+const settingsPath = join(root, "settings.json");
+writeFileSync(
+	settingsPath,
+	`${JSON.stringify({ version: 1, pluginConfig: {}, dashboardDisplaySettings: {} }, null, 2)}\n`,
+	{ encoding: "utf8", mode: 0o600 },
+);
+try {
+	chmodSync(settingsPath, 0o600);
+} catch {
+	// Best-effort hardening for non-posix environments.
+}
+const auditPath = join(logsDir, "audit.log");
+writeFileSync(
+	auditPath,
+	`${JSON.stringify({ timestamp: new Date().toISOString(), action: "request.start", outcome: "success" })}\n`,
+	{ encoding: "utf8", mode: 0o600 },
+);
+try {
+	chmodSync(auditPath, 0o600);
+} catch {
+	// Best-effort hardening for non-posix environments.
+}
diff --git a/scripts/setup-dev.js b/scripts/setup-dev.js
new file mode 100644
index 000000000..4b98e638b
--- /dev/null
+++ b/scripts/setup-dev.js
@@ -0,0 +1,155 @@
+import { spawn } from "node:child_process";
+import { resolve } from "node:path";
+import process from "node:process";
+import { fileURLToPath } from "node:url";
+import { runDevDoctor } from "./doctor-dev.js";
+
+const WINDOWS_INSTALL_RETRY_ATTEMPTS = 3;
+const WINDOWS_INSTALL_RETRY_BASE_DELAY_MS = 300;
+
+async function waitForMilliseconds(milliseconds, waitFn) {
+	if (typeof waitFn === "function") {
+		await waitFn(milliseconds);
+		return;
+	}
+	await new Promise((resolveDelay) => {
+		setTimeout(resolveDelay, milliseconds);
+	});
+}
+
+export function resolveNpmInvocation(options = {}) {
+	const platform = options.platform ?? process.platform;
+	const npmExecPath = (options.npmExecPath ?? process.env.npm_execpath ?? "").trim();
+	const execPath = options.execPath ?? process.execPath;
+
+	if (npmExecPath.length > 0) {
+		return {
+			command: execPath,
+			prefixArgs: [npmExecPath],
+		};
+	}
+
+	return {
+		command: platform === "win32" ? "npm.cmd" : "npm",
+		prefixArgs: [],
+	};
+}
+
+export function runCommand(command, args = [], cwd = process.cwd(), options = {}) {
+	const spawnFactory = options.spawnFactory ?? spawn;
+	const env = options.env ?? process.env;
+
+	return new Promise((resolveExitCode) => {
+		let settled = false;
+		const settle = (exitCode) => {
+			if (settled) {
+				return;
+			}
+			settled = true;
+			resolveExitCode(exitCode);
+		};
+
+		const child = spawnFactory(command, args, {
+			cwd,
+			stdio: "inherit",
+			env,
+		});
+
+		child.once("error", (error) => {
+			console.error(`Failed to run command: ${command} ${args.join(" ")}`);
+			console.error(String(error));
+			settle(1);
+		});
+
+		child.once("exit", (code, signal) => {
+			if (signal) {
+				settle(signal === "SIGINT" ? 130 : 1);
+				return;
+			}
+			settle(typeof code === "number" ? code : 1);
+		});
+	});
+}
+
+export async function runSetupDev(options = {}) {
+	const cwd = resolve(options.cwd ?? process.cwd());
+	const platform = options.platform ?? process.platform;
+	const runDoctor = options.runDevDoctorFn ?? runDevDoctor;
+	const runCommandFn = options.runCommandFn ?? ((command, args, commandCwd) => runCommand(command, args, commandCwd));
+	const installRetryAttempts =
+		typeof options.installRetryAttempts === "number"
+			? options.installRetryAttempts
+			: platform === "win32"
+				? WINDOWS_INSTALL_RETRY_ATTEMPTS
+				: 1;
+	const installRetryBaseDelayMs =
+		typeof options.installRetryBaseDelayMs === "number"
+			? options.installRetryBaseDelayMs
+			: WINDOWS_INSTALL_RETRY_BASE_DELAY_MS;
+	const npmInvocation =
+		options.npmInvocation ??
+		resolveNpmInvocation({
+			platform,
+			npmExecPath: options.npmExecPath,
+			execPath: options.execPath,
+		});
+
+	console.log("Running dev environment checks...");
+	const doctorExitCode = await runDoctor({ cwd });
+	if (doctorExitCode !== 0) {
+		return doctorExitCode;
+	}
+
+	const runNpm = (args) =>
+		runCommandFn(npmInvocation.command, [...npmInvocation.prefixArgs, ...args], cwd);
+
+	console.log("Installing dependencies with npm ci...");
+	let installExitCode = 1;
+	for (let attempt = 1; attempt <= installRetryAttempts; attempt += 1) {
+		installExitCode = await runNpm(["ci"]);
+		if (installExitCode === 0) {
+			break;
+		}
+		if (attempt < installRetryAttempts) {
+			const delayMs = installRetryBaseDelayMs * 2 ** (attempt - 1);
+			console.warn(
+				`npm ci failed (attempt ${attempt}/${installRetryAttempts}). Retrying in ${delayMs}ms to tolerate transient EBUSY/EPERM Windows file locks...`,
+			);
+			await waitForMilliseconds(delayMs, options.waitFn);
+		}
+	}
+	if (installExitCode !== 0) {
+		console.error("setup:dev failed during npm ci.");
+		return installExitCode;
+	}
+
+	console.log("Running local validation gate...");
+	const gateCommands = [
+		["run", "verify"],
+		["test", "--", "test/documentation.test.ts"],
+	];
+
+	for (const gateCommand of gateCommands) {
+		const gateExitCode = await runNpm(gateCommand);
+		if (gateExitCode !== 0) {
+			console.error(`setup:dev failed on: npm ${gateCommand.join(" ")}`);
+			return gateExitCode;
+		}
+	}
+
+	console.log("setup:dev completed successfully.");
+	return 0;
+}
+
+const isDirectRun = (() => {
+	try {
+		return resolve(process.argv[1] ?? "") === fileURLToPath(import.meta.url);
+	} catch {
+		return false;
+	}
+})();
+
+if (isDirectRun) {
+	const exitCode = await runSetupDev();
+	process.exitCode = exitCode;
+}
diff --git a/scripts/slo-budget-report.js b/scripts/slo-budget-report.js
new file mode 100644
index 000000000..9960fbb38
--- /dev/null
+++ b/scripts/slo-budget-report.js
@@ -0,0 +1,234 @@
+import { execFileSync } from "node:child_process";
+import { existsSync } from "node:fs";
+import { readFile, readdir, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join, resolve } from "node:path";
+import process from "node:process";
+import { pathToFileURL } from "node:url";
+
+const DEFAULT_HEALTH_CHECK_TIMEOUT_MS = 15_000;
+const DEFAULT_HEALTH_CHECK_SCRIPT = "scripts/enterprise-health-check.js";
+const HEALTH_CHECK_MAX_BUFFER_BYTES = 2 * 1024 * 1024;
+
+function parseArgValue(name) {
+	const prefix = `${name}=`;
+	const hit = process.argv.slice(2).find((arg) => arg.startsWith(prefix));
+	return hit ? hit.slice(prefix.length) : undefined;
+}
+
+function hasFlag(name) {
+	return process.argv.slice(2).includes(name);
+}
+
+function resolveRoot() {
+	const override = (process.env.CODEX_MULTI_AUTH_DIR ?? "").trim();
+	if (override.length > 0) return override;
+	return join(homedir(), ".codex", "multi-auth");
+}
+
+async function loadAuditEntries(logDir, cutoffMs) {
+	if (!existsSync(logDir)) return [];
+	let entries;
+	try {
+		entries = await readdir(logDir, { withFileTypes: true });
+	} catch (error) {
+		const code = error?.code;
+		if (code === "ENOENT" || code === "ENOTDIR") {
+			return [];
+		}
+		throw error;
+	}
+	const files = entries
+		.filter((entry) => entry.isFile() && entry.name.startsWith("audit") && entry.name.endsWith(".log"))
+		.map((entry) => entry.name)
+		.sort((a, b) => a.localeCompare(b, undefined, { sensitivity: "base" }));
+
+	const output = [];
+	for (const file of files) {
+		const fullPath = join(logDir, file);
+		let raw;
+		try {
+			raw = await readFile(fullPath, "utf8");
+		} catch (error) {
+			const code = error?.code;
+			if (code === "ENOENT" || code === "ENOTDIR") {
+				continue;
+			}
+			throw error;
+		}
+		for (const line of raw.split(/\r?\n/)) {
+			if (!line.trim()) continue;
+			try {
+				const parsed = JSON.parse(line);
+				if (!parsed || typeof parsed !== "object") continue;
+				const timestamp = Date.parse(parsed.timestamp);
+				if (Number.isFinite(timestamp) && timestamp >= cutoffMs) {
+					output.push(parsed);
+				}
+			} catch {
+				// Ignore malformed audit lines.
+			}
+		}
+	}
+	return output;
+}
+
+function parsePositiveInt(value, fallback) {
+	const parsed = Number.parseInt(String(value ?? ""), 10);
+	if (!Number.isFinite(parsed) || parsed <= 0) return fallback;
+	return parsed;
+}
+
+function resolveHealthCheckScriptPath() {
+	const override = parseArgValue("--health-script") ?? process.env.CODEX_SLO_HEALTH_CHECK_SCRIPT;
+	return override && override.trim().length > 0 ? override.trim() : DEFAULT_HEALTH_CHECK_SCRIPT;
+}
+
+export function runHealthCheck() {
+	const timeoutMs = parsePositiveInt(process.env.CODEX_HEALTH_CHECK_TIMEOUT_MS, DEFAULT_HEALTH_CHECK_TIMEOUT_MS);
+	const healthCheckScript = resolveHealthCheckScriptPath();
+	try {
+		const nodeCmd = process.execPath;
+		const raw = execFileSync(nodeCmd, [healthCheckScript], {
+			encoding: "utf8",
+			stdio: ["ignore", "pipe", "pipe"],
+			cwd: process.cwd(),
+			timeout: timeoutMs,
+			killSignal: "SIGTERM",
+			maxBuffer: HEALTH_CHECK_MAX_BUFFER_BYTES,
+		});
+		return JSON.parse(raw);
+	} catch (error) {
+		const out = `${error?.stdout ?? ""}${error?.stderr ?? ""}`.trim();
+		const fallbackMessage = error instanceof Error ? error.message : String(error);
+		return {
+			status: "fail",
+			checks: [],
+			findings: [
+				{
+					code: "health-check-exec-failed",
+					message: (out.length > 0 ? out : fallbackMessage).slice(0, 500),
+				},
+			],
+		};
+	}
+}
+
+function pct(value) {
+	if (!Number.isFinite(value)) return null;
+	return Number(value.toFixed(3));
+}
+
+async function main() {
+	const policyPath = resolve(parseArgValue("--policy") ?? "config/slo-policy.json");
+	const outputPath = parseArgValue("--output");
+	const enforce = hasFlag("--enforce");
+	const root = resolveRoot();
+	const logDir = resolve(parseArgValue("--log-dir") ?? join(root, "logs"));
+	const policy = JSON.parse(await readFile(policyPath, "utf8"));
+	const windowDays = typeof policy.windowDays === "number" ? policy.windowDays : 30;
+	const objectives = policy.objectives ?? {};
+	const cutoffMs = Date.now() - windowDays * 24 * 60 * 60 * 1000;
+	const entries = await loadAuditEntries(logDir, cutoffMs);
+	const health = runHealthCheck();
+
+	let requestSuccess = 0;
+	let requestFailure = 0;
+	for (const entry of entries) {
+		if (entry.action === "request.success") requestSuccess += 1;
+		if (entry.action === "request.failure") requestFailure += 1;
+	}
+	const requestTotal = requestSuccess + requestFailure;
+	const requestSuccessRate = requestTotal > 0 ? (requestSuccess * 100) / requestTotal : null;
+
+	const staleWalFindings = Array.isArray(health.findings)
+		? health.findings.filter(
+				(finding) =>
+					finding &&
+					(finding.code === "stale-wal" || finding.code === "stale-audit-log"),
+			).length
+		: 0;
+	const healthCheckPass = health.status === "pass";
+
+	const evaluations = [
+		{
+			id: "request-success-rate",
+			target: objectives.requestSuccessRatePercent ?? null,
+			actual: requestSuccessRate,
+			status:
+				requestSuccessRate === null || typeof objectives.requestSuccessRatePercent !== "number"
+					? "insufficient_data"
+					: requestSuccessRate >= objectives.requestSuccessRatePercent
+						? "pass"
+						: "fail",
+		},
+		{
+			id: "health-check-pass",
+			target: objectives.healthCheckPassRequired === true ? true : null,
+			actual: healthCheckPass,
+			status:
+				objectives.healthCheckPassRequired === true
+					? healthCheckPass
+						? "pass"
+						: "fail"
+					: "insufficient_data",
+		},
+		{
+			id: "stale-wal-findings",
+			target: typeof objectives.staleWalFindingsMax === "number" ? objectives.staleWalFindingsMax : null,
+			actual: staleWalFindings,
+			status:
+				typeof objectives.staleWalFindingsMax !== "number"
+					? "insufficient_data"
+					: staleWalFindings <= objectives.staleWalFindingsMax
+						? "pass"
+						: "fail",
+		},
+	];
+
+	const hardFailures = evaluations.filter((item) => item.status === "fail");
+	const payload = {
+		command: "slo-budget-report",
+		generatedAt: new Date().toISOString(),
+		windowDays,
+		root,
+		logDir,
+		entriesConsidered: entries.length,
+		requests: {
+			success: requestSuccess,
+			failure: requestFailure,
+			total: requestTotal,
+			successRatePercent: pct(requestSuccessRate),
+			errorBudgetConsumedPercent:
+				typeof objectives.requestSuccessRatePercent === "number" && requestSuccessRate !== null
+					? pct(100 - requestSuccessRate)
+					: null,
+			errorBudgetAllowedPercent:
+				typeof objectives.requestSuccessRatePercent === "number"
+					? pct(100 - objectives.requestSuccessRatePercent)
+					: null,
+		},
+		health: {
+			status: health.status,
+			staleWalFindings,
+		},
+		evaluations,
+		status: hardFailures.length === 0 ? "pass" : "fail",
+	};
+
+	if (outputPath) {
+		await writeFile(resolve(outputPath), `${JSON.stringify(payload, null, 2)}\n`, "utf8");
+	}
+	console.log(JSON.stringify(payload, null, 2));
+	if (enforce && payload.status === "fail") {
+		process.exit(1);
+	}
+}
+
+const invokedPath = process.argv[1] ? resolve(process.argv[1]) : "";
+if (invokedPath && import.meta.url === pathToFileURL(invokedPath).href) {
+	main().catch((error) => {
+		console.error(`slo-budget-report failed: ${error instanceof Error ? error.message : String(error)}`);
+		process.exit(1);
+	});
+}
diff --git a/scripts/verify-sbom.js b/scripts/verify-sbom.js
new file mode 100644
index 000000000..ede0b1287
--- /dev/null
+++ b/scripts/verify-sbom.js
@@ -0,0 +1,49 @@
+#!/usr/bin/env node
+
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+import process from "node:process";
+
+function fail(message) {
+	console.error(`verify-sbom failed: ${message}`);
+	process.exit(1);
+}
+
+function main() {
+	const inputPath = resolve(process.argv[2] ?? ".tmp/sbom.cdx.json");
+	let parsed;
+	try {
+		parsed = JSON.parse(readFileSync(inputPath, "utf8"));
+	} catch (error) {
+		fail(`unable to parse JSON from ${inputPath}: ${error instanceof Error ? error.message : String(error)}`);
+	}
+
+	if (!parsed || typeof parsed !== "object") {
+		fail("SBOM root must be a JSON object");
+	}
+	if (parsed.bomFormat !== "CycloneDX") {
+		fail(`expected bomFormat CycloneDX, got ${String(parsed.bomFormat)}`);
+	}
+	if (typeof parsed.specVersion !== "string" || parsed.specVersion.trim().length === 0) {
+		fail("specVersion is missing");
+	}
+	if (!Array.isArray(parsed.components) || parsed.components.length === 0) {
+		fail("components array is missing or empty");
+	}
+
+	const metadata = parsed.metadata && typeof parsed.metadata === "object" ? parsed.metadata : {};
+	const component = metadata.component && typeof metadata.component === "object" ? metadata.component : {};
+	const payload = {
+		command: "verify-sbom",
+		inputPath,
+		bomFormat: parsed.bomFormat,
+		specVersion: parsed.specVersion,
+		componentCount: parsed.components.length,
+		rootComponentName: typeof component.name === "string" ? component.name : null,
+		rootComponentVersion: typeof component.version === "string" ? component.version : null,
+		status: "pass",
+	};
+	console.log(JSON.stringify(payload, null, 2));
+}
+
+main();
diff --git a/test/account-storage-view.test.ts b/test/account-storage-view.test.ts
new file mode 100644
index 000000000..4c1ac5ba0
--- /dev/null
+++ b/test/account-storage-view.test.ts
@@ -0,0 +1,42 @@
+import { describe, expect, it } from "vitest";
+import { MODEL_FAMILIES } from "../lib/prompts/codex.js";
+import {
+	cloneAccountStorage,
+	createEmptyAccountStorage,
+} from "../lib/accounts/storage-view.js";
+
+describe("account storage view helpers", () => {
+	it("creates default empty storage without prefilled family indexes", () => {
+		expect(createEmptyAccountStorage()).toEqual({
+			version: 3,
+			accounts: [],
+			activeIndex: 0,
+			activeIndexByFamily: {},
+		});
+	});
+
+	it("can create empty storage with per-family indexes initialized", () => {
+		const storage = createEmptyAccountStorage({ initializeFamilyIndexes: true });
+		for (const family of MODEL_FAMILIES) {
+			expect(storage.activeIndexByFamily?.[family]).toBe(0);
+		}
+	});
+
+	it("clones account storage to isolated mutable copies", () => {
+		const original = {
+			version: 3 as const,
+			accounts: [{ refreshToken: "r1", email: "a@example.com", enabled: true }],
+			activeIndex: 0,
+			activeIndexByFamily: { codex: 0 },
+		};
+
+		const clone = cloneAccountStorage(original);
+		expect(clone).toEqual(original);
+
+		clone.accounts[0]!.email = "b@example.com";
+		clone.activeIndexByFamily.codex = 1;
+
+		expect(original.accounts[0]!.email).toBe("a@example.com");
+		expect(original.activeIndexByFamily.codex).toBe(0);
+	});
+});
diff --git a/test/account-view.test.ts b/test/account-view.test.ts
new file mode 100644
index 000000000..b33166dbd
--- /dev/null
+++ b/test/account-view.test.ts
@@ -0,0 +1,126 @@
+import { describe, expect, it } from "vitest";
+import {
+	resolveActiveIndex,
+	getRateLimitResetTimeForFamily,
+	formatRateLimitEntry,
+	formatActiveIndexByFamilyLabels,
+	formatRateLimitStatusByFamily,
+} from "../lib/accounts/account-view.js";
+
+describe("account-view helpers", () => {
+	it("resolves active index from family mapping and clamps to bounds", () => {
+		expect(
+			resolveActiveIndex({
+				activeIndex: 9,
+				activeIndexByFamily: { codex: 4 },
+				accounts: [{}, {}],
+			}),
+		).toBe(1);
+	});
+
+	it("falls back to storage active index and normalizes non-finite candidates", () => {
+		expect(
+			resolveActiveIndex({
+				activeIndex: Number.NaN,
+				activeIndexByFamily: { codex: Number.NaN },
+				accounts: [{}, {}, {}],
+			}),
+		).toBe(0);
+		expect(
+			resolveActiveIndex({
+				activeIndex: 2,
+				accounts: [{}, {}, {}],
+			}),
+		).toBe(2);
+	});
+
+	it("returns earliest future reset for matching family keys", () => {
+		const now = 1_000_000;
+		expect(
+			getRateLimitResetTimeForFamily(
+				{
+					rateLimitResetTimes: {
+						codex: now + 90_000,
+						"codex:gpt-5.2": now + 30_000,
+						"gpt-5.1": now + 10_000,
+						"codex:bad": undefined,
+					},
+				},
+				now,
+				"codex",
+			),
+		).toBe(now + 30_000);
+	});
+
+	it("returns null for missing or expired family reset state", () => {
+		const now = 5_000;
+		expect(getRateLimitResetTimeForFamily({}, now, "codex")).toBeNull();
+		expect(
+			getRateLimitResetTimeForFamily(
+				{
+					rateLimitResetTimes: {
+						codex: now,
+						"codex:gpt-5.2": now - 1,
+					},
+				},
+				now,
+				"codex",
+			),
+		).toBeNull();
+	});
+
+	it("formats wait labels only when a positive reset window exists", () => {
+		const now = 42_000;
+		expect(
+			formatRateLimitEntry(
+				{
+					rateLimitResetTimes: {
+						codex: now + 90_000,
+					},
+				},
+				now,
+			),
+		).toBe("resets in 1m 30s");
+		expect(
+			formatRateLimitEntry(
+				{
+					rateLimitResetTimes: {
+						codex: now,
+					},
+				},
+				now,
+			),
+		).toBeNull();
+	});
+
+	it("formats model-family status labels with ok and remaining times", () => {
+		const now = 1_000_000;
+		expect(
+			formatRateLimitStatusByFamily(
+				{
+					rateLimitResetTimes: {
+						codex: now + 30_000,
+						"gpt-5.1": now + 70_000,
+					},
+				},
+				now,
+				["codex", "gpt-5.1", "codex-max"],
+			),
+		).toEqual(["codex=30s", "gpt-5.1=1m 10s", "codex-max=ok"]);
+	});
+
+	it("formats active-index labels with 1-based values and fallback placeholders", () => {
+		expect(
+			formatActiveIndexByFamilyLabels({
+				codex: 0,
+				"gpt-5.1": 2,
+			}),
+		).toEqual([
+			"gpt-5-codex: -",
+			"codex-max: -",
+			"codex: 1",
+			"gpt-5.2: -",
+			"gpt-5.1: 3",
+		]);
+	});
+});
diff --git a/test/accounts-edge.test.ts b/test/accounts-edge.test.ts
index 31c34b07f..5dd904e88 100644
--- a/test/accounts-edge.test.ts
+++ b/test/accounts-edge.test.ts
@@ -415,4 +415,216 @@ describe("accounts edge branches", () => {
     expect(account?.accountIdSource).toBe("manual");
     expect(account?.email).toBe("edge@example.com");
   });
+
+  it("retries on storage conflicts and merges concurrent disk accounts", async () => {
+    const stored = buildStored([
+      buildStoredAccount({
+        refreshToken: "refresh-local",
+        email: "local@example.com",
+      }),
+    ]);
+
+    const latestDisk = buildStored([
+      buildStoredAccount({
+        refreshToken: "refresh-concurrent",
+        email: "concurrent@example.com",
+      }),
+    ]);
+
+    const conflictError = Object.assign(new Error("conflict"), {
+      code: "ECONFLICT",
+    });
+    mockSaveAccounts
+      .mockRejectedValueOnce(conflictError)
+      .mockResolvedValueOnce(undefined);
+    mockLoadAccounts.mockResolvedValueOnce(latestDisk);
+
+    const { AccountManager } = await importAccountsModule();
+    const manager = new AccountManager(undefined, stored as never);
+
+    await manager.saveToDisk();
+
+    expect(mockSaveAccounts).toHaveBeenCalledTimes(2);
+    const retriedPayload = mockSaveAccounts.mock.calls[1]?.[0] as {
+      accounts: Array<{ refreshToken: string }>;
+    };
+    const refreshTokens = retriedPayload.accounts.map((account) => account.refreshToken);
+    expect(refreshTokens).toContain("refresh-local");
+    expect(refreshTokens).toContain("refresh-concurrent");
+
+    await manager.saveToDisk();
+    const postConflictPayload = mockSaveAccounts.mock.calls[2]?.[0] as {
+      accounts: Array<{ refreshToken: string }>;
+    };
+    const persistedTokens = postConflictPayload.accounts.map((account) => account.refreshToken);
+    expect(persistedTokens).toContain("refresh-local");
+    expect(persistedTokens).toContain("refresh-concurrent");
+  });
+
+  it("does not let undefined local fields clobber concrete disk values during conflict merge", async () => {
+    const stored = buildStored([
+      buildStoredAccount({
+        refreshToken: "refresh-local",
+        email: "local@example.com",
+      }),
+    ]);
+
+    const latestDisk = buildStored([
+      buildStoredAccount({
+        refreshToken: "refresh-local",
+        email: "local@example.com",
+        enabled: false,
+        rateLimitResetTimes: {
+          "gpt-5-codex:requests": { resetAt: Date.now() + 60_000, reason: "quota-limit" },
+        },
+      }),
+    ]);
+
+    const conflictError = Object.assign(new Error("conflict"), {
+      code: "ECONFLICT",
+    });
+    mockSaveAccounts
+      .mockRejectedValueOnce(conflictError)
+      .mockResolvedValueOnce(undefined);
+    mockLoadAccounts.mockResolvedValueOnce(latestDisk);
+
+    const { AccountManager } = await importAccountsModule();
+    const manager = new AccountManager(undefined, stored as never);
+
+    await manager.saveToDisk();
+
+    const retriedPayload = mockSaveAccounts.mock.calls[1]?.[0] as {
+      accounts: Array<{
+        refreshToken: string;
+        enabled?: boolean;
+        rateLimitResetTimes?: Record<string, unknown>;
+      }>;
+    };
+    const mergedLocal = retriedPayload.accounts.find(
+      (account) => account.refreshToken === "refresh-local",
+    );
+    expect(mergedLocal?.enabled).toBe(false);
+    expect(mergedLocal?.rateLimitResetTimes).toEqual(
+      latestDisk.accounts[0]?.rateLimitResetTimes,
+    );
+  });
+
+  it("keeps disk-issued credentials when conflict merge matches by account identity", async () => {
+    const localExpiresAt = Date.now() + 1_000;
+    const rotatedExpiresAt = Date.now() + 60_000;
+    const stored = buildStored([
+      buildStoredAccount({
+        refreshToken: "refresh-stale",
+        accessToken: "access-stale",
+        expiresAt: localExpiresAt,
+        email: "identity@example.com",
+        accountId: "account-identity-1",
+      }),
+    ]);
+
+    const latestDisk = buildStored([
+      buildStoredAccount({
+        refreshToken: "refresh-rotated",
+        accessToken: "access-rotated",
+        expiresAt: rotatedExpiresAt,
+        email: "identity@example.com",
+        accountId: "account-identity-1",
+      }),
+    ]);
+
+    const conflictError = Object.assign(new Error("conflict"), {
+      code: "ECONFLICT",
+    });
+    mockSaveAccounts
+      .mockRejectedValueOnce(conflictError)
+      .mockResolvedValueOnce(undefined);
+    mockLoadAccounts.mockResolvedValueOnce(latestDisk);
+
+    const { AccountManager } = await importAccountsModule();
+    const manager = new AccountManager(undefined, stored as never);
+
+    await manager.saveToDisk();
+
+    const retriedPayload = mockSaveAccounts.mock.calls[1]?.[0] as {
+      accounts: Array<{
+        accountId?: string;
+        refreshToken: string;
+        accessToken?: string;
+        expiresAt?: number;
+      }>;
+    };
+    const mergedAccount = retriedPayload.accounts.find(
+      (account) => account.accountId === "account-identity-1",
+    );
+    expect(mergedAccount?.refreshToken).toBe("refresh-rotated");
+    expect(mergedAccount?.accessToken).toBe("access-rotated");
+    expect(mergedAccount?.expiresAt).toBe(rotatedExpiresAt);
+    expect(retriedPayload.accounts.some((account) => account.refreshToken === "refresh-stale")).toBe(
+      false,
+    );
+  });
+
+  it("prefers fresher timestamp and rate-limit reset values during conflict merge", async () => {
+    const localNow = Date.now();
+    const localAccount = buildStoredAccount({
+      refreshToken: "refresh-local",
+      email: "local@example.com",
+      addedAt: localNow - 10_000,
+      lastUsed: localNow - 5_000,
+      coolingDownUntil: localNow + 1_000,
+      rateLimitResetTimes: {
+        "gpt-5-codex:requests": localNow + 1_200,
+        "gpt-5.2:requests": localNow + 400,
+      },
+    });
+    const stored = buildStored([localAccount]);
+
+    const latestDisk = buildStored([
+      buildStoredAccount({
+        refreshToken: "refresh-local",
+        email: "local@example.com",
+        addedAt: localNow - 1_000,
+        lastUsed: localNow - 200,
+        coolingDownUntil: localNow + 5_000,
+        rateLimitResetTimes: {
+          "gpt-5-codex:requests": localNow + 9_000,
+          "codex-max:requests": localNow + 2_000,
+        },
+      }),
+    ]);
+
+    const conflictError = Object.assign(new Error("conflict"), {
+      code: "ECONFLICT",
+    });
+    mockSaveAccounts
+      .mockRejectedValueOnce(conflictError)
+      .mockResolvedValueOnce(undefined);
+    mockLoadAccounts.mockResolvedValueOnce(latestDisk);
+
+    const { AccountManager } = await importAccountsModule();
+    const manager = new AccountManager(undefined, stored as never);
+
+    await manager.saveToDisk();
+
+    const retriedPayload = mockSaveAccounts.mock.calls[1]?.[0] as {
+      accounts: Array<{
+        refreshToken: string;
+        addedAt?: number;
+        lastUsed?: number;
+        coolingDownUntil?: number;
+        rateLimitResetTimes?: Record<string, number>;
+      }>;
+    };
+    const mergedLocal = retriedPayload.accounts.find(
+      (account) => account.refreshToken === "refresh-local",
+    );
+    expect(mergedLocal?.addedAt).toBe(localNow - 1_000);
+    expect(mergedLocal?.lastUsed).toBe(localNow - 200);
+    expect(mergedLocal?.coolingDownUntil).toBe(localNow + 5_000);
+    expect(mergedLocal?.rateLimitResetTimes).toEqual({
+      "gpt-5-codex:requests": localNow + 9_000,
+      "gpt-5.2:requests": localNow + 400,
+      "codex-max:requests": localNow + 2_000,
+    });
+  });
 });
diff --git a/test/accounts.test.ts b/test/accounts.test.ts
index 8328909a8..e7ae3dbb4 100644
--- a/test/accounts.test.ts
+++ b/test/accounts.test.ts
@@ -1168,6 +1168,69 @@ describe("AccountManager", () => {
 
       expect(mockSaveAccounts).toHaveBeenCalledTimes(2);
     });
+
+    it("still schedules a new save after previous pending save rejects", async () => {
+      const { saveAccounts } = await import("../lib/storage.js");
+      const mockSaveAccounts = vi.mocked(saveAccounts);
+      mockSaveAccounts.mockClear();
+      mockSaveAccounts.mockResolvedValue(undefined);
+
+      const now = Date.now();
+      const stored = {
+        version: 3 as const,
+        activeIndex: 0,
+        accounts: [{ refreshToken: "token-1", addedAt: now, lastUsed: now }],
+      };
+
+      const manager = new AccountManager(undefined, stored);
+      const rejectedPending = Promise.reject(new Error("first-save-failed"));
+      Object.defineProperty(manager, "pendingSave", {
+        value: rejectedPending,
+        writable: true,
+        configurable: true,
+      });
+      await rejectedPending.catch(() => undefined);
+
+      manager.saveToDiskDebounced(50);
+      await vi.advanceTimersByTimeAsync(80);
+      await manager.flushPendingSave();
+
+      expect(mockSaveAccounts).toHaveBeenCalledTimes(1);
+    });
+
+    it("retries transient EBUSY save failures in debounced persistence", async () => {
+      const { saveAccounts } = await import("../lib/storage.js");
+      const mockSaveAccounts = vi.mocked(saveAccounts);
+      mockSaveAccounts.mockClear();
+
+      let attempts = 0;
+      mockSaveAccounts.mockImplementation(async () => {
+        attempts += 1;
+        if (attempts < 3) {
+          const error = Object.assign(new Error("EBUSY"), {
+            code: "EBUSY",
+          }) as NodeJS.ErrnoException;
+          throw error;
+        }
+      });
+
+      const now = Date.now();
+      const stored = {
+        version: 3 as const,
+        activeIndex: 0,
+        accounts: [{ refreshToken: "token-1", addedAt: now, lastUsed: now }],
+      };
+
+      const manager = new AccountManager(undefined, stored);
+      manager.saveToDiskDebounced(50);
+
+      await vi.advanceTimersByTimeAsync(60);
+      await vi.runAllTimersAsync();
+      await manager.flushPendingSave();
+
+      expect(mockSaveAccounts).toHaveBeenCalledTimes(3);
+      expect(attempts).toBe(3);
+    });
   });
 
   describe("constructor edge cases", () => {
diff --git a/test/active-index.test.ts b/test/active-index.test.ts
new file mode 100644
index 000000000..5ab421ede
--- /dev/null
+++ b/test/active-index.test.ts
@@ -0,0 +1,159 @@
+import { describe, expect, it } from "vitest";
+import { MODEL_FAMILIES } from "../lib/prompts/codex.js";
+import {
+	createActiveIndexByFamily,
+	setActiveIndexForAllFamilies,
+	normalizeActiveIndexByFamily,
+	removeAccountAndReconcileActiveIndexes,
+} from "../lib/accounts/active-index.js";
+
+describe("active-index helpers", () => {
+	it("creates a per-family active index map", () => {
+		expect(createActiveIndexByFamily(2)).toEqual({
+			"gpt-5-codex": 2,
+			"codex-max": 2,
+			codex: 2,
+			"gpt-5.2": 2,
+			"gpt-5.1": 2,
+		});
+	});
+
+	it("sets active index across all model families", () => {
+		const storage: {
+			activeIndex: number;
+			activeIndexByFamily?: Partial<Record<(typeof MODEL_FAMILIES)[number], number>>;
+		} = {
+			activeIndex: 0,
+		};
+
+		setActiveIndexForAllFamilies(storage, 3);
+
+		expect(storage.activeIndex).toBe(3);
+		for (const family of MODEL_FAMILIES) {
+			expect(storage.activeIndexByFamily?.[family]).toBe(3);
+		}
+	});
+
+	it("preserves unrelated keys when reusing existing family map objects", () => {
+		const storage: {
+			activeIndex: number;
+			activeIndexByFamily?: Record<string, number>;
+		} = {
+			activeIndex: 1,
+			activeIndexByFamily: {
+				legacy: 99,
+				codex: 1,
+			},
+		};
+
+		setActiveIndexForAllFamilies(storage, 0);
+
+		expect(storage.activeIndexByFamily?.legacy).toBe(99);
+		for (const family of MODEL_FAMILIES) {
+			expect(storage.activeIndexByFamily?.[family]).toBe(0);
+		}
+	});
+
+	it("normalizes active and per-family indexes within account bounds", () => {
+		const storage: {
+			activeIndex: number;
+			activeIndexByFamily?: Partial<Record<(typeof MODEL_FAMILIES)[number], number>>;
+		} = {
+			activeIndex: 99,
+			activeIndexByFamily: {
+				codex: Number.NaN,
+				"gpt-5.1": -3,
+			},
+		};
+
+		const changed = normalizeActiveIndexByFamily(storage, 2);
+
+		expect(changed).toBe(true);
+		expect(storage.activeIndex).toBe(1);
+		for (const family of MODEL_FAMILIES) {
+			expect(storage.activeIndexByFamily?.[family]).toBeGreaterThanOrEqual(0);
+			expect(storage.activeIndexByFamily?.[family]).toBeLessThanOrEqual(1);
+		}
+		expect(storage.activeIndexByFamily?.codex).toBe(1);
+		expect(storage.activeIndexByFamily?.["gpt-5.1"]).toBe(0);
+	});
+
+	it("clears family map when empty accounts are requested to clear", () => {
+		const storage: {
+			activeIndex: number;
+			activeIndexByFamily?: Record<string, number>;
+		} = {
+			activeIndex: 5,
+			activeIndexByFamily: {
+				codex: 2,
+				legacy: 9,
+			},
+		};
+
+		const changed = normalizeActiveIndexByFamily(storage, 0, {
+			clearFamilyMapWhenEmpty: true,
+		});
+
+		expect(changed).toBe(true);
+		expect(storage.activeIndex).toBe(0);
+		expect(storage.activeIndexByFamily).toEqual({});
+	});
+
+	it("fills model-family indexes with zero for empty account sets by default", () => {
+		const storage: {
+			activeIndex: number;
+			activeIndexByFamily?: Partial<Record<(typeof MODEL_FAMILIES)[number], number>>;
+		} = {
+			activeIndex: 3,
+			activeIndexByFamily: {},
+		};
+
+		const changed = normalizeActiveIndexByFamily(storage, 0);
+
+		expect(changed).toBe(true);
+		expect(storage.activeIndex).toBe(0);
+		for (const family of MODEL_FAMILIES) {
+			expect(storage.activeIndexByFamily?.[family]).toBe(0);
+		}
+	});
+
+	it("removes accounts and reconciles active indexes for remaining entries", () => {
+		const storage: {
+			accounts: unknown[];
+			activeIndex: number;
+			activeIndexByFamily?: Partial<Record<(typeof MODEL_FAMILIES)[number], number>>;
+		} = {
+			accounts: [{ id: 1 }, { id: 2 }, { id: 3 }],
+			activeIndex: 2,
+			activeIndexByFamily: {
+				codex: 2,
+				"gpt-5.1": 2,
+			},
+		};
+
+		const changed = removeAccountAndReconcileActiveIndexes(storage, 0);
+
+		expect(changed).toBe(true);
+		expect(storage.accounts).toHaveLength(2);
+		expect(storage.activeIndex).toBe(0);
+		expect(storage.activeIndexByFamily?.codex).toBe(0);
+		expect(storage.activeIndexByFamily?.["gpt-5.1"]).toBe(0);
+	});
+
+	it("returns false and keeps storage unchanged for out-of-range removals", () => {
+		const storage: {
+			accounts: unknown[];
+			activeIndex: number;
+			activeIndexByFamily?: Record<string, number>;
+		} = {
+			accounts: [{ id: 1 }],
+			activeIndex: 0,
+			activeIndexByFamily: { codex: 0 },
+		};
+
+		expect(removeAccountAndReconcileActiveIndexes(storage, 2)).toBe(false);
+		expect(storage.accounts).toHaveLength(1);
+		expect(storage.activeIndex).toBe(0);
+		expect(storage.activeIndexByFamily).toEqual({ codex: 0 });
+	});
+});
diff --git a/test/audit-log-forwarder.test.ts b/test/audit-log-forwarder.test.ts
new file mode 100644
index 000000000..8141a1592
--- /dev/null
+++ b/test/audit-log-forwarder.test.ts
@@ -0,0 +1,379 @@
+import { afterEach, describe, expect, it } from "vitest";
+import { mkdtempSync, utimesSync } from "node:fs";
+import { promises as fs } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import process from "node:process";
+import { createServer, type Server } from "node:http";
+import { spawn } from "node:child_process";
+import { removeWithRetry } from "./helpers/remove-with-retry.js";
+
+const scriptPath = path.resolve(process.cwd(), "scripts", "audit-log-forwarder.js");
+
+function runForwarder(
+	args: string[],
+	env: NodeJS.ProcessEnv = {},
+	timeoutMs = 10_000,
+): Promise<{ status: number | null; stdout: string; stderr: string }> {
+	return new Promise((resolve, reject) => {
+		const child = spawn(process.execPath, [scriptPath, ...args], {
+			env: { ...process.env, ...env },
+			stdio: ["ignore", "pipe", "pipe"],
+		});
+		let stdout = "";
+		let stderr = "";
+		let timedOut = false;
+		let settled = false;
+		const timeout = setTimeout(() => {
+			timedOut = true;
+			stderr += `${stderr ? "\n" : ""}runForwarder timed out after ${timeoutMs}ms`;
+			child.kill();
+		}, timeoutMs);
+		const finish = (status: number | null): void => {
+			if (settled) return;
+			settled = true;
+			clearTimeout(timeout);
+			resolve({ status, stdout, stderr });
+		};
+		child.stdout.on("data", (chunk) => {
+			stdout += chunk.toString();
+		});
+		child.stderr.on("data", (chunk) => {
+			stderr += chunk.toString();
+		});
+		child.on("error", (error) => {
+			if (timedOut) {
+				finish(null);
+				return;
+			}
+			if (settled) return;
+			settled = true;
+			clearTimeout(timeout);
+			reject(error);
+		});
+		child.on("close", (status) => {
+			finish(timedOut ? null : status);
+		});
+	});
+}
+
+function parseJsonStdout(output: string): Record<string, unknown> {
+	return JSON.parse(output) as Record<string, unknown>;
+}
+
+async function withServer(
+	handler: Parameters<typeof createServer>[0],
+	run: (url: string) => Promise<void>,
+): Promise<void> {
+	const server = createServer(handler);
+	await new Promise<void>((resolve, reject) => {
+		server.once("error", reject);
+		server.listen(0, "127.0.0.1", () => resolve());
+	});
+	const address = server.address();
+	if (!address || typeof address === "string") {
+		await new Promise<void>((resolve) => server.close(() => resolve()));
+		throw new Error("failed to resolve server address");
+	}
+	const endpoint = `http://127.0.0.1:${address.port}/ingest`;
+	try {
+		await run(endpoint);
+	} finally {
+		await new Promise<void>((resolve) => server.close(() => resolve()));
+	}
+}
+
+describe("audit-log-forwarder script", () => {
+	const fixtures: string[] = [];
+
+	afterEach(async () => {
+		while (fixtures.length > 0) {
+			const fixture = fixtures.pop();
+			if (!fixture) continue;
+			await removeWithRetry(fixture);
+		}
+	});
+
+	it("retries transient 429 responses and writes checkpoint", async () => {
+		const root = mkdtempSync(path.join(tmpdir(), "audit-forwarder-retry-"));
+		fixtures.push(root);
+		const logDir = path.join(root, "logs");
+		const checkpointPath = path.join(root, "checkpoint.json");
+		await fs.mkdir(logDir, { recursive: true });
+		await fs.writeFile(
+			path.join(logDir, "audit.log"),
+			'{"timestamp":"2026-03-01T00:00:00Z","action":"request.start"}\n{"timestamp":"2026-03-01T00:01:00Z","action":"request.success"}\n',
+			"utf8",
+		);
+
+		let requestCount = 0;
+		await withServer(async (_req, res) => {
+			requestCount += 1;
+			if (requestCount === 1) {
+				res.statusCode = 429;
+				res.end("rate limited");
+				return;
+			}
+			res.statusCode = 200;
+			res.end("ok");
+		}, async (endpoint) => {
+			const result = await runForwarder(
+				[
+					`--endpoint=${endpoint}`,
+					`--log-dir=${logDir}`,
+					`--checkpoint=${checkpointPath}`,
+					"--batch-size=25",
+				],
+				{
+					CODEX_AUDIT_FORWARDER_MAX_ATTEMPTS: "3",
+					CODEX_AUDIT_FORWARDER_TIMEOUT_MS: "500",
+				},
+			);
+
+			expect(result.status).toBe(0);
+			const payload = parseJsonStdout(result.stdout);
+			expect(payload.status).toBe("sent");
+			expect(payload.sent).toBe(2);
+			expect(requestCount).toBe(2);
+		});
+
+		const checkpoint = JSON.parse(await fs.readFile(checkpointPath, "utf8")) as {
+			file?: string;
+			line?: number;
+		};
+		expect(checkpoint.file).toBe("audit.log");
+		expect(checkpoint.line).toBe(2);
+	});
+
+	it("replays rotated tail when checkpoint line exceeds new active log length", async () => {
+		const root = mkdtempSync(path.join(tmpdir(), "audit-forwarder-rotation-"));
+		fixtures.push(root);
+		const logDir = path.join(root, "logs");
+		const checkpointPath = path.join(root, "checkpoint.json");
+		await fs.mkdir(logDir, { recursive: true });
+		await fs.writeFile(
+			path.join(logDir, "audit.1.log"),
+			'{"timestamp":"2026-03-01T00:00:00Z","id":"old-1"}\n{"timestamp":"2026-03-01T00:01:00Z","id":"old-2"}\n{"timestamp":"2026-03-01T00:02:00Z","id":"old-3"}\n',
+			"utf8",
+		);
+		await fs.writeFile(
+			path.join(logDir, "audit.log"),
+			'{"timestamp":"2026-03-01T00:03:00Z","id":"new-1"}\n',
+			"utf8",
+		);
+		await fs.writeFile(
+			checkpointPath,
+			JSON.stringify({ file: "audit.log", line: 2, updatedAt: "2026-03-01T00:02:00Z" }),
+			"utf8",
+		);
+
+		const result = await runForwarder([
+			"--dry-run",
+			`--log-dir=${logDir}`,
+			`--checkpoint=${checkpointPath}`,
+			"--batch-size=25",
+		]);
+		expect(result.status).toBe(0);
+		const payload = parseJsonStdout(result.stdout);
+		expect(payload.status).toBe("dry-run");
+		expect(payload.sent).toBe(2);
+	});
+
+	it("times out hanging endpoint requests and exits non-zero", async () => {
+		const root = mkdtempSync(path.join(tmpdir(), "audit-forwarder-timeout-"));
+		fixtures.push(root);
+		const logDir = path.join(root, "logs");
+		const checkpointPath = path.join(root, "checkpoint.json");
+		await fs.mkdir(logDir, { recursive: true });
+		await fs.writeFile(
+			path.join(logDir, "audit.log"),
+			'{"timestamp":"2026-03-01T00:00:00Z","action":"request.start"}\n',
+			"utf8",
+		);
+
+		await withServer((_req, _res) => {
+			// Intentionally never respond.
+		}, async (endpoint) => {
+			const result = await runForwarder(
+				[
+					`--endpoint=${endpoint}`,
+					`--log-dir=${logDir}`,
+					`--checkpoint=${checkpointPath}`,
+				],
+				{
+					CODEX_AUDIT_FORWARDER_MAX_ATTEMPTS: "2",
+					CODEX_AUDIT_FORWARDER_TIMEOUT_MS: "50",
+				},
+			);
+			expect(result.status).toBe(1);
+			expect(result.stderr).toContain("audit-log-forwarder failed");
+		});
+
+		await expect(fs.stat(checkpointPath)).rejects.toThrow();
+	});
+
+	it("waits for checkpoint lock release and then completes", async () => {
+		const root = mkdtempSync(path.join(tmpdir(), "audit-forwarder-lock-"));
+		fixtures.push(root);
+		const logDir = path.join(root, "logs");
+		const checkpointPath = path.join(root, "checkpoint.json");
+		const checkpointLockPath = `${checkpointPath}.lock`;
+		await fs.mkdir(logDir, { recursive: true });
+		await fs.writeFile(
+			path.join(logDir, "audit.log"),
+			'{"timestamp":"2026-03-01T00:00:00Z","action":"request.start"}\n',
+			"utf8",
+		);
+		await fs.writeFile(checkpointLockPath, "locked", "utf8");
+
+		await withServer((_req, res) => {
+			res.statusCode = 200;
+			res.end("ok");
+		}, async (endpoint) => {
+			const releaseTimer = setTimeout(async () => {
+				await fs.unlink(checkpointLockPath).catch(() => {});
+			}, 50);
+			try {
+				const result = await runForwarder(
+					[
+						`--endpoint=${endpoint}`,
+						`--log-dir=${logDir}`,
+						`--checkpoint=${checkpointPath}`,
+					],
+					{
+						CODEX_AUDIT_FORWARDER_MAX_ATTEMPTS: "2",
+						CODEX_AUDIT_FORWARDER_TIMEOUT_MS: "2000",
+						CODEX_AUDIT_FORWARDER_MAX_WAIT_MS: "2000",
+						CODEX_AUDIT_FORWARDER_LOCK_MAX_ATTEMPTS: "200",
+					},
+				);
+				expect(result.status).toBe(0);
+			} finally {
+				clearTimeout(releaseTimer);
+			}
+		});
+
+		const checkpoint = JSON.parse(await fs.readFile(checkpointPath, "utf8")) as {
+			file?: string;
+			line?: number;
+		};
+		expect(checkpoint.file).toBe("audit.log");
+		expect(checkpoint.line).toBe(1);
+	});
+
+	it("clears stale checkpoint locks and proceeds", async () => {
+		const root = mkdtempSync(path.join(tmpdir(), "audit-forwarder-stale-lock-"));
+		fixtures.push(root);
+		const logDir = path.join(root, "logs");
+		const checkpointPath = path.join(root, "checkpoint.json");
+		const checkpointLockPath = `${checkpointPath}.lock`;
+		await fs.mkdir(logDir, { recursive: true });
+		await fs.writeFile(
+			path.join(logDir, "audit.log"),
+			'{"timestamp":"2026-03-01T00:00:00Z","action":"request.start"}\n',
+			"utf8",
+		);
+		await fs.writeFile(checkpointLockPath, "999999\n", "utf8");
+		const staleDate = new Date(Date.now() - 60 * 1000);
+		utimesSync(checkpointLockPath, staleDate, staleDate);
+
+		await withServer((_req, res) => {
+			res.statusCode = 200;
+			res.end("ok");
+		}, async (endpoint) => {
+			const result = await runForwarder(
+				[
+					`--endpoint=${endpoint}`,
+					`--log-dir=${logDir}`,
+					`--checkpoint=${checkpointPath}`,
+				],
+				{
+					CODEX_AUDIT_FORWARDER_STALE_LOCK_MS: "50",
+					CODEX_AUDIT_FORWARDER_MAX_WAIT_MS: "500",
+				},
+			);
+			expect(result.status).toBe(0);
+			const payload = parseJsonStdout(result.stdout);
+			expect(payload.status).toBe("sent");
+			expect(payload.sent).toBe(1);
+		});
+
+		const checkpoint = JSON.parse(await fs.readFile(checkpointPath, "utf8")) as {
+			file?: string;
+			line?: number;
+		};
+		expect(checkpoint.file).toBe("audit.log");
+		expect(checkpoint.line).toBe(1);
+	});
+
+	it("fails with a clear timeout when checkpoint lock contention persists", async () => {
+		const root = mkdtempSync(path.join(tmpdir(), "audit-forwarder-lock-timeout-"));
+		fixtures.push(root);
+		const logDir = path.join(root, "logs");
+		const checkpointPath = path.join(root, "checkpoint.json");
+		const checkpointLockPath = `${checkpointPath}.lock`;
+		await fs.mkdir(logDir, { recursive: true });
+		await fs.writeFile(
+			path.join(logDir, "audit.log"),
+			'{"timestamp":"2026-03-01T00:00:00Z","action":"request.start"}\n',
+			"utf8",
+		);
+		await fs.writeFile(checkpointLockPath, `${process.pid}\n`, "utf8");
+
+		await withServer((_req, res) => {
+			res.statusCode = 200;
+			res.end("ok");
+		}, async (endpoint) => {
+			const result = await runForwarder(
+				[
+					`--endpoint=${endpoint}`,
+					`--log-dir=${logDir}`,
+					`--checkpoint=${checkpointPath}`,
+				],
+				{
+					CODEX_AUDIT_FORWARDER_MAX_WAIT_MS: "80",
+					CODEX_AUDIT_FORWARDER_LOCK_MAX_ATTEMPTS: "10",
+				},
+			);
+			expect(result.status).toBe(1);
+			expect(result.stderr).toContain("Timed out acquiring checkpoint lock");
+		});
+	});
+
+	it("continues when newest log disappears before final mtime stat", async () => {
+		const root = mkdtempSync(path.join(tmpdir(), "audit-forwarder-newest-race-"));
+		fixtures.push(root);
+		const logDir = path.join(root, "logs");
+		const checkpointPath = path.join(root, "checkpoint.json");
+		const newestLogPath = path.join(logDir, "audit.log");
+		await fs.mkdir(logDir, { recursive: true });
+		await fs.writeFile(
+			newestLogPath,
+			'{"timestamp":"2026-03-01T00:00:00Z","action":"request.start"}\n',
+			"utf8",
+		);
+
+		await withServer(async (_req, res) => {
+			await fs.unlink(newestLogPath).catch(() => {});
+			res.statusCode = 200;
+			res.end("ok");
+		}, async (endpoint) => {
+			const result = await runForwarder([
+				`--endpoint=${endpoint}`,
+				`--log-dir=${logDir}`,
+				`--checkpoint=${checkpointPath}`,
+			]);
+			expect(result.status).toBe(0);
+			const payload = parseJsonStdout(result.stdout);
+			expect(payload.status).toBe("sent");
+			expect(payload.newestLogMtimeMs).toBeNull();
+		});
+
+		const checkpoint = JSON.parse(await fs.readFile(checkpointPath, "utf8")) as {
+			file?: string;
+			line?: number;
+		};
+		expect(checkpoint.file).toBe("audit.log");
+		expect(checkpoint.line).toBe(1);
+	});
+});
diff --git a/test/audit-retry.test.ts b/test/audit-retry.test.ts
new file mode 100644
index 000000000..70e8e62f9
--- /dev/null
+++ b/test/audit-retry.test.ts
@@ -0,0 +1,80 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+function createBusyError(): NodeJS.ErrnoException {
+	const error = new Error("resource busy") as NodeJS.ErrnoException;
+	error.code = "EBUSY";
+	return error;
+}
+
+describe("audit purge retry handling", () => {
+	beforeEach(() => {
+		vi.resetModules();
+	});
+
+	afterEach(() => {
+		vi.doUnmock("node:fs");
+		vi.doUnmock("../lib/runtime-paths.js");
+		vi.restoreAllMocks();
+	});
+
+	it("retries stale audit log deletion on EBUSY and eventually purges", async () => {
+		const atomicsWaitSpy = vi.spyOn(Atomics, "wait");
+		const writeFileSync = vi.fn();
+		const mkdirSync = vi.fn();
+		const existsSync = vi.fn((target: string) => !target.endsWith("audit.log"));
+		const statSync = vi.fn(() => ({
+			mtimeMs: 0,
+			size: 0,
+		}));
+		const renameSync = vi.fn();
+		const readdirSync = vi.fn(() => ["audit.1.log"]);
+		const chmodSync = vi.fn();
+
+		let unlinkAttempts = 0;
+		const unlinkSync = vi.fn(() => {
+			unlinkAttempts += 1;
+			if (unlinkAttempts < 3) {
+				throw createBusyError();
+			}
+		});
+
+		vi.doMock("node:fs", () => ({
+			writeFileSync,
+			mkdirSync,
+			existsSync,
+			statSync,
+			renameSync,
+			readdirSync,
+			unlinkSync,
+			chmodSync,
+		}));
+		vi.doMock("../lib/runtime-paths.js", () => ({
+			getCodexLogDir: () => "/tmp/codex-logs",
+		}));
+
+		const audit = await import("../lib/audit.js");
+		const nowSpy = vi.spyOn(Date, "now").mockReturnValue(3_000_000_000);
+
+		try {
+			audit.configureAudit({
+				enabled: true,
+				logDir: "/tmp/codex-logs",
+				retentionDays: 1,
+				maxFileSizeBytes: 1024,
+				maxFiles: 3,
+			});
+			audit.auditLog(
+				audit.AuditAction.REQUEST_START,
+				"actor@example.com",
+				"resource",
+				audit.AuditOutcome.SUCCESS,
+			);
+		} finally {
+			nowSpy.mockRestore();
+		}
+
+		expect(unlinkSync).toHaveBeenCalledTimes(3);
+		expect(writeFileSync).toHaveBeenCalledTimes(1);
+		expect(atomicsWaitSpy).not.toHaveBeenCalled();
+	});
+});
diff --git a/test/audit.test.ts b/test/audit.test.ts
index b04038179..f85dba120 100644
--- a/test/audit.test.ts
+++ b/test/audit.test.ts
@@ -1,6 +1,6 @@
 import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
 import { join } from "node:path";
-import { mkdirSync, rmSync, existsSync, readFileSync, writeFileSync } from "node:fs";
+import { chmodSync, mkdirSync, rmSync, existsSync, readFileSync, statSync, writeFileSync, utimesSync } from "node:fs";
 import { tmpdir } from "node:os";
 import {
 	AuditAction,
@@ -207,6 +207,24 @@ describe("Audit logging", () => {
 
 			expect(lines.length).toBe(2);
 		});
+
+		it("keeps secure 0600 mode on existing audit logs (posix)", () => {
+			if (process.platform === "win32") {
+				auditLog(AuditAction.REQUEST_START, "actor", "resource", AuditOutcome.SUCCESS);
+				const content = readFileSync(getAuditLogPath(), "utf8");
+				expect(content).toContain("\"action\":\"request.start\"");
+				return;
+			}
+			const logPath = getAuditLogPath();
+			writeFileSync(logPath, "existing\n", "utf8");
+			chmodSync(logPath, 0o644);
+
+			auditLog(AuditAction.REQUEST_START, "actor", "resource", AuditOutcome.SUCCESS);
+
+			const stats = statSync(logPath);
+			expect(stats.mode & 0o777).toBe(0o600);
+		});
+
 	});
 
 	describe("log rotation", () => {
@@ -230,6 +248,55 @@ describe("Audit logging", () => {
 			const files = listAuditLogFiles();
 			expect(files.length).toBeLessThanOrEqual(3);
 		});
+
+		it("purges stale rotated logs during write cycle", () => {
+			configureAudit({ retentionDays: 1 });
+			const fixedNowMs = 2_000_000_000_000;
+			const nowSpy = vi.spyOn(Date, "now").mockReturnValue(fixedNowMs);
+			const staleLogPath = join(testLogDir, "audit.1.log");
+			writeFileSync(staleLogPath, "old\n", "utf8");
+			const staleMs = Date.now() - 3 * 24 * 60 * 60 * 1000;
+			const staleDate = new Date(staleMs);
+			utimesSync(staleLogPath, staleDate, staleDate);
+
+			try {
+				auditLog(AuditAction.REQUEST_START, "actor", "resource", AuditOutcome.SUCCESS);
+			} finally {
+				nowSpy.mockRestore();
+			}
+
+			expect(existsSync(staleLogPath)).toBe(false);
+		});
+
+		it("does not throttle purge when a prior directory read fails", () => {
+			const fixedNowMs = 2_000_000_000_000;
+			const nowSpy = vi.spyOn(Date, "now").mockReturnValue(fixedNowMs);
+			try {
+				const blockedLogDir = join(testLogDir, "blocked-log-dir");
+				writeFileSync(blockedLogDir, "not-a-directory", "utf8");
+				configureAudit({
+					enabled: true,
+					logDir: blockedLogDir,
+					maxFileSizeBytes: 1024,
+					maxFiles: 3,
+					retentionDays: 1,
+				});
+
+				auditLog(AuditAction.REQUEST_START, "actor", "resource", AuditOutcome.SUCCESS);
+
+				rmSync(blockedLogDir);
+				mkdirSync(blockedLogDir, { recursive: true });
+				const staleLogPath = join(blockedLogDir, "audit.1.log");
+				writeFileSync(staleLogPath, "stale\n", "utf8");
+				const staleDate = new Date(fixedNowMs - 3 * 24 * 60 * 60 * 1000);
+				utimesSync(staleLogPath, staleDate, staleDate);
+
+				auditLog(AuditAction.REQUEST_SUCCESS, "actor", "resource", AuditOutcome.SUCCESS);
+				expect(existsSync(staleLogPath)).toBe(false);
+			} finally {
+				nowSpy.mockRestore();
+			}
+		});
 	});
 
 	describe("listAuditLogFiles", () => {
@@ -251,9 +318,11 @@ describe("Audit logging", () => {
 		it("should have all expected actions", () => {
 			expect(AuditAction.ACCOUNT_ADD).toBe("account.add");
 			expect(AuditAction.AUTH_LOGIN).toBe("auth.login");
+			expect(AuditAction.AUTH_BREAK_GLASS).toBe("auth.break_glass");
 			expect(AuditAction.CONFIG_LOAD).toBe("config.load");
 			expect(AuditAction.REQUEST_START).toBe("request.start");
 			expect(AuditAction.CIRCUIT_OPEN).toBe("circuit.open");
+			expect(AuditAction.COMMAND_RUN).toBe("command.run");
 		});
 	});
 
diff --git a/test/auth-logging.test.ts b/test/auth-logging.test.ts
index e34e5dc39..2c64c48db 100644
--- a/test/auth-logging.test.ts
+++ b/test/auth-logging.test.ts
@@ -5,7 +5,7 @@ vi.mock('../lib/logger.js', () => ({
 }));
 
 import { logError } from '../lib/logger.js';
-import { exchangeAuthorizationCode } from '../lib/auth/auth.js';
+import { exchangeAuthorizationCode, REDIRECT_URI, refreshAccessToken } from '../lib/auth/auth.js';
 
 describe('OAuth auth logging', () => {
 	afterEach(() => {
@@ -63,4 +63,96 @@ describe('OAuth auth logging', () => {
 			globalThis.fetch = originalFetch;
 		}
 	});
+
+	it('logs timeout metadata when token exchange aborts', async () => {
+		const originalFetch = globalThis.fetch;
+		vi.useFakeTimers();
+		globalThis.fetch = vi.fn((_url, init) =>
+			new Promise<Response>((_resolve, reject) => {
+				const signal = init?.signal as AbortSignal | undefined;
+				if (signal?.aborted) {
+					reject(signal.reason);
+					return;
+				}
+				signal?.addEventListener(
+					'abort',
+					() => {
+						reject(signal.reason);
+					},
+					{ once: true },
+				);
+			}),
+		) as never;
+
+		try {
+			const resultPromise = exchangeAuthorizationCode(
+				'auth-code',
+				'verifier-123',
+				REDIRECT_URI,
+				{ timeoutMs: 1000 },
+			);
+			await vi.advanceTimersByTimeAsync(1000);
+			const result = await resultPromise;
+			expect(result.type).toBe('failed');
+
+			expect(vi.mocked(logError)).toHaveBeenCalledWith(
+				'code->token aborted',
+				{ message: 'OAuth token exchange timed out after 1000ms' },
+			);
+		} finally {
+			globalThis.fetch = originalFetch;
+			vi.useRealTimers();
+		}
+	});
+
+	it('logs only sanitized metadata for HTTP token exchange failures', async () => {
+		const originalFetch = globalThis.fetch;
+		const rawBody = JSON.stringify({
+			error: 'invalid_request',
+			refresh_token: 'secret-refresh-token',
+			access_token: 'secret-access-token',
+		});
+		globalThis.fetch = vi.fn(async () => new Response(rawBody, { status: 400 })) as never;
+
+		try {
+			const result = await exchangeAuthorizationCode('auth-code', 'verifier-123');
+			expect(result.type).toBe('failed');
+			if (result.type === 'failed') {
+				expect(result.reason).toBe('http_error');
+				expect(result.statusCode).toBe(400);
+				expect(result.message).toBe('OAuth token exchange failed');
+			}
+			expect(vi.mocked(logError)).toHaveBeenCalledWith('code->token failed', {
+				status: 400,
+				bodyLength: rawBody.length,
+			});
+		} finally {
+			globalThis.fetch = originalFetch;
+		}
+	});
+
+	it('logs only sanitized metadata for HTTP refresh failures', async () => {
+		const originalFetch = globalThis.fetch;
+		const rawBody = JSON.stringify({
+			error: 'invalid_grant',
+			refresh_token: 'secret-refresh-token',
+		});
+		globalThis.fetch = vi.fn(async () => new Response(rawBody, { status: 400 })) as never;
+
+		try {
+			const result = await refreshAccessToken('bad-refresh-token');
+			expect(result.type).toBe('failed');
+			if (result.type === 'failed') {
+				expect(result.reason).toBe('http_error');
+				expect(result.statusCode).toBe(400);
+				expect(result.message).toBe('Token refresh failed');
+			}
+			expect(vi.mocked(logError)).toHaveBeenCalledWith('Token refresh failed', {
+				status: 400,
+				bodyLength: rawBody.length,
+			});
+		} finally {
+			globalThis.fetch = originalFetch;
+		}
+	});
 });
diff --git a/test/auth.test.ts b/test/auth.test.ts
index fe7affad3..ea7797bbf 100644
--- a/test/auth.test.ts
+++ b/test/auth.test.ts
@@ -340,13 +340,226 @@ describe('Auth Module', () => {
 				if (result.type === 'failed') {
 					expect(result.reason).toBe('http_error');
 					expect(result.statusCode).toBe(400);
-					expect(result.message).toBe('Bad Request');
+					expect(result.message).toBe('OAuth token exchange failed');
 				}
 			} finally {
 				globalThis.fetch = originalFetch;
 			}
 		});
 
+		it('returns failed for network errors during code exchange', async () => {
+			const originalFetch = globalThis.fetch;
+			globalThis.fetch = vi.fn(async () => {
+				throw new Error('Network failed');
+			}) as never;
+
+			try {
+				const result = await exchangeAuthorizationCode('code', 'verifier');
+				expect(result.type).toBe('failed');
+				if (result.type === 'failed') {
+					expect(result.reason).toBe('network_error');
+					expect(result.message).toBe('Network failed');
+				}
+			} finally {
+				globalThis.fetch = originalFetch;
+			}
+		});
+
+		it('returns failed when code exchange times out', async () => {
+			const originalFetch = globalThis.fetch;
+			vi.useFakeTimers();
+			globalThis.fetch = vi.fn((_url, init) =>
+				new Promise<Response>((_resolve, reject) => {
+					const signal = init?.signal as AbortSignal | undefined;
+					if (signal?.aborted) {
+						reject(signal.reason);
+						return;
+					}
+					signal?.addEventListener(
+						'abort',
+						() => {
+							reject(signal.reason);
+						},
+						{ once: true },
+					);
+				}),
+			) as never;
+
+			try {
+				const resultPromise = exchangeAuthorizationCode(
+					'code',
+					'verifier',
+					REDIRECT_URI,
+					{ timeoutMs: 1000 },
+				);
+				await vi.advanceTimersByTimeAsync(1000);
+				const result = await resultPromise;
+				expect(result.type).toBe('failed');
+				if (result.type === 'failed') {
+					expect(result.reason).toBe('unknown');
+					expect(result.message).toContain('timed out');
+				}
+			} finally {
+				globalThis.fetch = originalFetch;
+				vi.useRealTimers();
+			}
+		});
+
+		it('short-circuits when upstream signal is already aborted', async () => {
+			const originalFetch = globalThis.fetch;
+			vi.useFakeTimers();
+			const upstream = new AbortController();
+			const abortReason = Object.assign(new Error('upstream-pre-aborted'), {
+				name: 'AbortError',
+				code: 'ABORT_ERR',
+			});
+			const setTimeoutSpy = vi.spyOn(globalThis, 'setTimeout');
+			upstream.abort(abortReason);
+			globalThis.fetch = vi.fn(async (_url, init) => {
+				const signal = init?.signal as AbortSignal | undefined;
+				if (signal?.aborted) {
+					throw signal.reason;
+				}
+				throw new Error('fetch should not continue with non-aborted signal');
+			}) as never;
+
+			try {
+				const result = await exchangeAuthorizationCode(
+					'code',
+					'verifier',
+					REDIRECT_URI,
+					{ timeoutMs: 1_000, signal: upstream.signal },
+				);
+				expect(result.type).toBe('failed');
+				if (result.type === 'failed') {
+					expect(result.reason).toBe('unknown');
+					expect(result.message).toBe('upstream-pre-aborted');
+				}
+				expect(setTimeoutSpy).not.toHaveBeenCalled();
+				await vi.advanceTimersByTimeAsync(5_000);
+				expect(setTimeoutSpy).not.toHaveBeenCalled();
+			} finally {
+				globalThis.fetch = originalFetch;
+				vi.useRealTimers();
+				vi.restoreAllMocks();
+			}
+		});
+
+		it('propagates mid-flight upstream abort reason and clears timeout', async () => {
+			const originalFetch = globalThis.fetch;
+			vi.useFakeTimers();
+			const upstream = new AbortController();
+			const setTimeoutSpy = vi.spyOn(globalThis, 'setTimeout');
+			const clearTimeoutSpy = vi.spyOn(globalThis, 'clearTimeout');
+			globalThis.fetch = vi.fn((_url, init) =>
+				new Promise<Response>((_resolve, reject) => {
+					const signal = init?.signal as AbortSignal | undefined;
+					if (signal?.aborted) {
+						reject(signal.reason);
+						return;
+					}
+					signal?.addEventListener(
+						'abort',
+						() => {
+							reject(signal.reason);
+						},
+						{ once: true },
+					);
+				}),
+			) as never;
+
+			try {
+				const resultPromise = exchangeAuthorizationCode(
+					'code',
+					'verifier',
+					REDIRECT_URI,
+					{ timeoutMs: 5_000, signal: upstream.signal },
+				);
+				upstream.abort(
+					Object.assign(new Error('upstream-mid-flight'), {
+						name: 'AbortError',
+						code: 'ABORT_ERR',
+					}),
+				);
+				const result = await resultPromise;
+				expect(result.type).toBe('failed');
+				if (result.type === 'failed') {
+					expect(result.reason).toBe('unknown');
+					expect(result.message).toBe('upstream-mid-flight');
+				}
+				expect(setTimeoutSpy).toHaveBeenCalledTimes(1);
+				expect(clearTimeoutSpy).toHaveBeenCalledTimes(1);
+			} finally {
+				globalThis.fetch = originalFetch;
+				vi.useRealTimers();
+				vi.restoreAllMocks();
+			}
+		});
+
+		it('cleans upstream listeners and timers across repeated abortable exchanges', async () => {
+			const originalFetch = globalThis.fetch;
+			vi.useFakeTimers();
+			const upstream = new AbortController();
+			const addListenerSpy = vi.spyOn(upstream.signal, 'addEventListener');
+			const removeListenerSpy = vi.spyOn(upstream.signal, 'removeEventListener');
+			const setTimeoutSpy = vi.spyOn(globalThis, 'setTimeout');
+			const clearTimeoutSpy = vi.spyOn(globalThis, 'clearTimeout');
+			globalThis.fetch = vi.fn((_url, init) =>
+				new Promise<Response>((_resolve, reject) => {
+					const signal = init?.signal as AbortSignal | undefined;
+					if (signal?.aborted) {
+						reject(signal.reason);
+						return;
+					}
+					signal?.addEventListener(
+						'abort',
+						() => {
+							reject(signal.reason);
+						},
+						{ once: true },
+					);
+				}),
+			) as never;
+
+			try {
+				const first = exchangeAuthorizationCode(
+					'code-1',
+					'verifier-1',
+					REDIRECT_URI,
+					{ timeoutMs: 2_000, signal: upstream.signal },
+				);
+				const second = exchangeAuthorizationCode(
+					'code-2',
+					'verifier-2',
+					REDIRECT_URI,
+					{ timeoutMs: 2_000, signal: upstream.signal },
+				);
+				expect(addListenerSpy).toHaveBeenCalledTimes(2);
+
+				upstream.abort(new Error('shared-upstream-abort'));
+				const [firstResult, secondResult] = await Promise.all([first, second]);
+				expect(firstResult.type).toBe('failed');
+				expect(secondResult.type).toBe('failed');
+				if (firstResult.type === 'failed') {
+					expect(firstResult.reason).toBe('unknown');
+				}
+				if (secondResult.type === 'failed') {
+					expect(secondResult.reason).toBe('unknown');
+				}
+				expect(setTimeoutSpy).toHaveBeenCalledTimes(2);
+				expect(clearTimeoutSpy).toHaveBeenCalledTimes(2);
+				expect(removeListenerSpy).toHaveBeenCalledTimes(2);
+
+				const clearTimeoutCallCount = clearTimeoutSpy.mock.calls.length;
+				await vi.advanceTimersByTimeAsync(5_000);
+				expect(clearTimeoutSpy).toHaveBeenCalledTimes(clearTimeoutCallCount);
+			} finally {
+				globalThis.fetch = originalFetch;
+				vi.useRealTimers();
+				vi.restoreAllMocks();
+			}
+		});
+
 		it('returns failed with undefined message when text read fails', async () => {
 			const originalFetch = globalThis.fetch;
 			const mockResponse = {
@@ -387,6 +600,27 @@ describe('Auth Module', () => {
 			}
 		});
 
+		it('returns failed token result for timeout/abort exchange errors', async () => {
+			const originalFetch = globalThis.fetch;
+			const abortError = Object.assign(new Error('OAuth exchange timeout'), {
+				name: 'AbortError',
+			});
+			globalThis.fetch = vi.fn(async () => {
+				throw abortError;
+			}) as never;
+
+			try {
+				const result = await exchangeAuthorizationCode('code', 'verifier');
+				expect(result.type).toBe('failed');
+				if (result.type === 'failed') {
+					expect(result.reason).toBe('unknown');
+					expect(result.message).toContain('timeout');
+				}
+			} finally {
+				globalThis.fetch = originalFetch;
+			}
+		});
+
 		it('uses custom redirect URI when provided', async () => {
 			const originalFetch = globalThis.fetch;
 			let capturedBody: URLSearchParams | undefined;
@@ -444,6 +678,8 @@ describe('Auth Module', () => {
 				expect(result.type).toBe('failed');
 				if (result.type === 'failed') {
 					expect(result.reason).toBe('http_error');
+					expect(result.statusCode).toBe(400);
+					expect(result.message).toBe('Token refresh failed');
 				}
 			} finally {
 				globalThis.fetch = originalFetch;
@@ -506,6 +742,94 @@ describe('Auth Module', () => {
 			}
 		});
 
+		it('enforces refresh timeout when refresh endpoint stalls', async () => {
+			vi.useFakeTimers();
+			const originalFetch = globalThis.fetch;
+			globalThis.fetch = vi.fn((_input: Parameters<typeof fetch>[0], init?: Parameters<typeof fetch>[1]) =>
+				new Promise<Response>((_resolve, reject) => {
+					init?.signal?.addEventListener(
+						'abort',
+						() => {
+							const reason = init.signal?.reason;
+							if (reason instanceof Error) {
+								reject(reason);
+								return;
+							}
+							reject(Object.assign(new Error('aborted'), { name: 'AbortError' }));
+						},
+						{ once: true },
+					);
+				}),
+			) as never;
+
+			try {
+				const resultPromise = refreshAccessToken('slow-token', { timeoutMs: 1_000 });
+				await vi.advanceTimersByTimeAsync(1_200);
+				const result = await resultPromise;
+				expect(result.type).toBe('failed');
+				if (result.type === 'failed') {
+					expect(result.reason).toBe('unknown');
+					expect(result.message).toContain('timeout');
+				}
+			} finally {
+				globalThis.fetch = originalFetch;
+				vi.useRealTimers();
+			}
+		});
+
+		it('concurrent refreshes with one timeout do not corrupt results', async () => {
+			vi.useFakeTimers();
+			const originalFetch = globalThis.fetch;
+			globalThis.fetch = vi.fn((_input: Parameters<typeof fetch>[0], init?: Parameters<typeof fetch>[1]) => {
+				const requestBody = init?.body;
+				const params = requestBody instanceof URLSearchParams ? requestBody : new URLSearchParams(String(requestBody ?? ""));
+				const refreshToken = params.get('refresh_token');
+				if (refreshToken === 'fast-token') {
+					return Promise.resolve(
+						new Response(JSON.stringify({
+							access_token: 'fast-access',
+							refresh_token: 'fast-refresh-next',
+							expires_in: 60,
+						}), { status: 200 }),
+					);
+				}
+				return new Promise<Response>((_resolve, reject) => {
+					init?.signal?.addEventListener(
+						'abort',
+						() => {
+							const reason = init.signal?.reason;
+							if (reason instanceof Error) {
+								reject(reason);
+								return;
+							}
+							reject(Object.assign(new Error('aborted'), { name: 'AbortError' }));
+						},
+						{ once: true },
+					);
+				});
+			}) as never;
+
+			try {
+				const fastPromise = refreshAccessToken('fast-token');
+				const slowPromise = refreshAccessToken('slow-token', { timeoutMs: 1_000 });
+				await vi.advanceTimersByTimeAsync(1_200);
+				const [fastResult, slowResult] = await Promise.all([fastPromise, slowPromise]);
+				expect(fastResult.type).toBe('success');
+				if (fastResult.type === 'success') {
+					expect(fastResult.access).toBe('fast-access');
+					expect(fastResult.refresh).toBe('fast-refresh-next');
+				}
+				expect(slowResult.type).toBe('failed');
+				if (slowResult.type === 'failed') {
+					expect(slowResult.reason).toBe('unknown');
+					expect(slowResult.message).toContain('timeout');
+				}
+			} finally {
+				globalThis.fetch = originalFetch;
+				vi.useRealTimers();
+			}
+		});
+
 		it('returns failed when response refresh token is whitespace only', async () => {
 			const originalFetch = globalThis.fetch;
 			const logErrorSpy = vi.spyOn(loggerModule, 'logError').mockImplementation(() => {});
diff --git a/test/authorization.test.ts b/test/authorization.test.ts
new file mode 100644
index 000000000..83f2e741c
--- /dev/null
+++ b/test/authorization.test.ts
@@ -0,0 +1,218 @@
+import { promises as fs } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { describe, expect, it } from "vitest";
+import { AuditAction, configureAudit, getAuditConfig } from "../lib/audit.js";
+import { authorizeAction, getAuthorizationRole } from "../lib/authorization.js";
+
+const RETRYABLE_REMOVE_CODES = new Set(["EBUSY", "EPERM", "ENOTEMPTY"]);
+const AUTH_ENV_KEYS = [
+	"CODEX_AUTH_ROLE",
+	"CODEX_AUTH_BREAK_GLASS",
+	"CODEX_AUTH_ABAC_READ_ONLY",
+	"CODEX_AUTH_ABAC_DENY_ACTIONS",
+	"CODEX_AUTH_ABAC_DENY_COMMANDS",
+	"CODEX_AUTH_ABAC_REQUIRE_INTERACTIVE",
+	"CODEX_AUTH_ABAC_REQUIRE_IDEMPOTENCY_KEY",
+] as const;
+
+function captureAuthEnv(): Record<(typeof AUTH_ENV_KEYS)[number], string | undefined> {
+	const snapshot = {} as Record<(typeof AUTH_ENV_KEYS)[number], string | undefined>;
+	for (const key of AUTH_ENV_KEYS) {
+		snapshot[key] = process.env[key];
+	}
+	return snapshot;
+}
+
+function restoreAuthEnv(snapshot: Record<(typeof AUTH_ENV_KEYS)[number], string | undefined>): void {
+	for (const key of AUTH_ENV_KEYS) {
+		const previous = snapshot[key];
+		if (previous === undefined) {
+			delete process.env[key];
+		} else {
+			process.env[key] = previous;
+		}
+	}
+}
+
+async function removeWithRetry(
+	targetPath: string,
+	options: { recursive?: boolean; force?: boolean },
+): Promise<void> {
+	for (let attempt = 0; attempt < 6; attempt += 1) {
+		try {
+			await fs.rm(targetPath, options);
+			return;
+		} catch (error) {
+			const code = (error as NodeJS.ErrnoException).code;
+			if (code === "ENOENT") return;
+			if (!code || !RETRYABLE_REMOVE_CODES.has(code) || attempt === 5) {
+				throw error;
+			}
+			await new Promise((resolve) => setTimeout(resolve, 25 * 2 ** attempt));
+		}
+	}
+}
+
+describe("authorization", () => {
+	it("defaults to admin role", () => {
+		const previous = captureAuthEnv();
+		try {
+			for (const key of AUTH_ENV_KEYS) {
+				delete process.env[key];
+			}
+			expect(getAuthorizationRole()).toBe("admin");
+			expect(authorizeAction("secrets:rotate").allowed).toBe(true);
+		} finally {
+			restoreAuthEnv(previous);
+		}
+	});
+
+	it("denies write actions for viewer role", () => {
+		const previous = captureAuthEnv();
+		try {
+			for (const key of AUTH_ENV_KEYS) {
+				delete process.env[key];
+			}
+			process.env.CODEX_AUTH_ROLE = "viewer";
+			const auth = authorizeAction("accounts:write");
+			expect(auth.allowed).toBe(false);
+			expect(auth.role).toBe("viewer");
+			expect(auth.reason).toContain("accounts:write");
+		} finally {
+			restoreAuthEnv(previous);
+		}
+	});
+
+	it("allows all actions when break-glass is enabled and audits the bypass", async () => {
+		const previous = captureAuthEnv();
+		const previousAuditConfig = getAuditConfig();
+		const auditDir = await fs.mkdtemp(join(tmpdir(), "codex-auth-audit-"));
+		try {
+			configureAudit({
+				enabled: true,
+				logDir: auditDir,
+				maxFileSizeBytes: 1024 * 1024,
+				maxFiles: 2,
+			});
+			for (const key of AUTH_ENV_KEYS) {
+				delete process.env[key];
+			}
+			process.env.CODEX_AUTH_ROLE = "viewer";
+			process.env.CODEX_AUTH_BREAK_GLASS = "1";
+			const result = authorizeAction("secrets:rotate");
+			expect(result).toEqual({
+				allowed: true,
+				role: "viewer",
+			});
+
+			const logPath = join(auditDir, "audit.log");
+			const content = await fs.readFile(logPath, "utf8");
+			const entries = content
+				.trim()
+				.split("\n")
+				.map((line) => JSON.parse(line) as {
+					action?: string;
+					resource?: string;
+					metadata?: { role?: string; breakGlass?: boolean };
+				});
+			const breakGlassEntry = entries.find((entry) => entry.action === AuditAction.AUTH_BREAK_GLASS);
+			expect(breakGlassEntry).toBeDefined();
+			expect(breakGlassEntry?.resource).toBe("secrets:rotate");
+			expect(breakGlassEntry?.metadata?.role).toBe("viewer");
+			expect(breakGlassEntry?.metadata?.breakGlass).toBe(true);
+		} finally {
+			configureAudit(previousAuditConfig);
+			await removeWithRetry(auditDir, { recursive: true, force: true });
+			restoreAuthEnv(previous);
+		}
+	});
+
+	it("applies ABAC read-only mode to deny mutating actions", () => {
+		const previous = captureAuthEnv();
+		try {
+			process.env.CODEX_AUTH_ROLE = "admin";
+			process.env.CODEX_AUTH_ABAC_READ_ONLY = "1";
+			const denied = authorizeAction("accounts:write", {
+				command: "login",
+				interactive: true,
+			});
+			expect(denied.allowed).toBe(false);
+			expect(denied.reason).toContain("read-only");
+
+			const allowed = authorizeAction("accounts:read", {
+				command: "status",
+				interactive: false,
+			});
+			expect(allowed.allowed).toBe(true);
+		} finally {
+			restoreAuthEnv(previous);
+		}
+	});
+
+	it("applies ABAC denied actions and denied commands", () => {
+		const previous = captureAuthEnv();
+		try {
+			process.env.CODEX_AUTH_ROLE = "admin";
+			process.env.CODEX_AUTH_ABAC_DENY_ACTIONS = "secrets:rotate,accounts:repair";
+			process.env.CODEX_AUTH_ABAC_DENY_COMMANDS = "rotate-secrets,doctor";
+
+			const deniedByAction = authorizeAction("secrets:rotate", {
+				command: "rotate-secrets",
+				interactive: true,
+				idempotencyKeyPresent: true,
+			});
+			expect(deniedByAction.allowed).toBe(false);
+			expect(deniedByAction.reason).toContain("denies action");
+
+			process.env.CODEX_AUTH_ABAC_DENY_ACTIONS = "";
+			const deniedByCommand = authorizeAction("accounts:repair", {
+				command: "doctor",
+				interactive: true,
+			});
+			expect(deniedByCommand.allowed).toBe(false);
+			expect(deniedByCommand.reason).toContain("denies command");
+		} finally {
+			restoreAuthEnv(previous);
+		}
+	});
+
+	it("applies ABAC interactive and idempotency-key requirements", () => {
+		const previous = captureAuthEnv();
+		try {
+			process.env.CODEX_AUTH_ROLE = "admin";
+			process.env.CODEX_AUTH_ABAC_REQUIRE_INTERACTIVE = "accounts:write";
+			process.env.CODEX_AUTH_ABAC_REQUIRE_IDEMPOTENCY_KEY = "secrets:rotate";
+
+			const nonInteractiveDenied = authorizeAction("accounts:write", {
+				command: "login",
+				interactive: false,
+			});
+			expect(nonInteractiveDenied.allowed).toBe(false);
+			expect(nonInteractiveDenied.reason).toContain("interactive terminal");
+
+			const interactiveAllowed = authorizeAction("accounts:write", {
+				command: "login",
+				interactive: true,
+			});
+			expect(interactiveAllowed.allowed).toBe(true);
+
+			const missingIdempotencyDenied = authorizeAction("secrets:rotate", {
+				command: "rotate-secrets",
+				interactive: true,
+				idempotencyKeyPresent: false,
+			});
+			expect(missingIdempotencyDenied.allowed).toBe(false);
+			expect(missingIdempotencyDenied.reason).toContain("idempotency key");
+
+			const idempotencyAllowed = authorizeAction("secrets:rotate", {
+				command: "rotate-secrets",
+				interactive: true,
+				idempotencyKeyPresent: true,
+			});
+			expect(idempotencyAllowed.allowed).toBe(true);
+		} finally {
+			restoreAuthEnv(previous);
+		}
+	});
+});
diff --git a/test/auto-update-checker.test.ts b/test/auto-update-checker.test.ts
index 615723305..29f1dd8b1 100644
--- a/test/auto-update-checker.test.ts
+++ b/test/auto-update-checker.test.ts
@@ -331,7 +331,9 @@ describe("auto-update-checker", () => {
 		it("handles fetch failure gracefully", async () => {
 			vi.mocked(globalThis.fetch).mockRejectedValue(new Error("Network error"));
 
-			const result = await checkForUpdates(true);
+			const pending = checkForUpdates(true);
+			await vi.runAllTimersAsync();
+			const result = await pending;
 
 			expect(result.hasUpdate).toBe(false);
 			expect(result.latestVersion).toBe(null);
@@ -343,12 +345,34 @@ describe("auto-update-checker", () => {
 				status: 500,
 			} as Response);
 
-			const result = await checkForUpdates(true);
+			const pending = checkForUpdates(true);
+			await vi.runAllTimersAsync();
+			const result = await pending;
 
 			expect(result.hasUpdate).toBe(false);
 			expect(result.latestVersion).toBe(null);
 		});
 
+		it("retries retryable HTTP statuses and succeeds on a later attempt", async () => {
+			vi.mocked(globalThis.fetch)
+				.mockResolvedValueOnce(new Response("busy-1", { status: 500 }))
+				.mockResolvedValueOnce(new Response("busy-2", { status: 500 }))
+				.mockResolvedValueOnce(
+					new Response(JSON.stringify({ version: "5.0.1" }), {
+						status: 200,
+						headers: { "content-type": "application/json" },
+					}),
+				);
+
+			const pending = checkForUpdates(true);
+			await vi.runAllTimersAsync();
+			const result = await pending;
+
+			expect(globalThis.fetch).toHaveBeenCalledTimes(3);
+			expect(result.latestVersion).toBe("5.0.1");
+			expect(result.hasUpdate).toBe(true);
+		});
+
 		it("saves cache after successful fetch", async () => {
 			vi.mocked(globalThis.fetch).mockResolvedValue({
 				ok: true,
@@ -457,7 +481,9 @@ describe("auto-update-checker", () => {
 			vi.mocked(globalThis.fetch).mockRejectedValue(new Error("Network error"));
 			const showToast = vi.fn().mockResolvedValue(undefined);
 
-			await expect(checkAndNotify(showToast)).resolves.toBeUndefined();
+			const pending = checkAndNotify(showToast);
+			await vi.runAllTimersAsync();
+			await expect(pending).resolves.toBeUndefined();
 			expect(showToast).not.toHaveBeenCalled();
 		});
 
diff --git a/test/background-jobs.test.ts b/test/background-jobs.test.ts
new file mode 100644
index 000000000..f3209d153
--- /dev/null
+++ b/test/background-jobs.test.ts
@@ -0,0 +1,237 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { promises as fs } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+
+const RETRYABLE_REMOVE_CODES = new Set(["EBUSY", "EPERM", "ENOTEMPTY"]);
+
+async function removeWithRetry(
+	targetPath: string,
+	options: { recursive?: boolean; force?: boolean },
+): Promise<void> {
+	for (let attempt = 0; attempt < 6; attempt += 1) {
+		try {
+			await fs.rm(targetPath, options);
+			return;
+		} catch (error) {
+			const code = (error as NodeJS.ErrnoException).code;
+			if (code === "ENOENT") return;
+			if (!code || !RETRYABLE_REMOVE_CODES.has(code) || attempt === 5) {
+				throw error;
+			}
+			await new Promise((resolve) => setTimeout(resolve, 25 * 2 ** attempt));
+		}
+	}
+}
+
+describe("background jobs", () => {
+	let tempDir: string;
+	let originalDir: string | undefined;
+
+	beforeEach(async () => {
+		originalDir = process.env.CODEX_MULTI_AUTH_DIR;
+		tempDir = await fs.mkdtemp(join(tmpdir(), "codex-bg-jobs-"));
+		process.env.CODEX_MULTI_AUTH_DIR = tempDir;
+		vi.resetModules();
+	});
+
+	afterEach(async () => {
+		if (originalDir === undefined) {
+			delete process.env.CODEX_MULTI_AUTH_DIR;
+		} else {
+			process.env.CODEX_MULTI_AUTH_DIR = originalDir;
+		}
+		await removeWithRetry(tempDir, { recursive: true, force: true });
+	});
+
+	it("retries and succeeds before exhausting attempts", async () => {
+		const { runBackgroundJobWithRetry, getBackgroundJobDlqPath } =
+			await import("../lib/background-jobs.js");
+		let attempts = 0;
+		const result = await runBackgroundJobWithRetry({
+			name: "test.retry-success",
+			task: async () => {
+				attempts += 1;
+				if (attempts < 3) {
+					const error = new Error("busy") as NodeJS.ErrnoException;
+					error.code = "EBUSY";
+					throw error;
+				}
+				return "ok";
+			},
+			maxAttempts: 4,
+			baseDelayMs: 1,
+			maxDelayMs: 2,
+		});
+
+		expect(result).toBe("ok");
+		expect(attempts).toBe(3);
+		await expect(fs.stat(getBackgroundJobDlqPath())).rejects.toMatchObject({ code: "ENOENT" });
+	});
+
+	it("writes a redacted dead-letter entry after retry exhaustion", async () => {
+		const { runBackgroundJobWithRetry, getBackgroundJobDlqPath } =
+			await import("../lib/background-jobs.js");
+		await expect(
+			runBackgroundJobWithRetry({
+				name: "test.retry-fail",
+				task: async () => {
+					const error = new Error("still locked") as NodeJS.ErrnoException;
+					error.code = "EPERM";
+					throw error;
+				},
+				context: {
+					email: "person@example.com",
+					accessToken: "sensitive-token",
+					note: "keep-visible",
+				},
+				maxAttempts: 2,
+				baseDelayMs: 1,
+				maxDelayMs: 2,
+			}),
+		).rejects.toThrow("still locked");
+
+		const dlqContent = await fs.readFile(getBackgroundJobDlqPath(), "utf8");
+		const lines = dlqContent.trim().split("\n");
+		expect(lines).toHaveLength(1);
+		const entry = JSON.parse(lines[0] ?? "{}") as {
+			job: string;
+			attempts: number;
+			context?: Record<string, unknown>;
+		};
+		expect(entry.job).toBe("test.retry-fail");
+		expect(entry.attempts).toBe(2);
+		expect(entry.context).toEqual({
+			email: "***REDACTED***",
+			accessToken: "***REDACTED***",
+			note: "keep-visible",
+		});
+	});
+
+	it("writes dead-letter after exhausting retries on 429 errors", async () => {
+		const { runBackgroundJobWithRetry, getBackgroundJobDlqPath } =
+			await import("../lib/background-jobs.js");
+		let attempts = 0;
+		await expect(
+			runBackgroundJobWithRetry({
+				name: "test.retry-429-fail",
+				task: async () => {
+					attempts += 1;
+					const error = Object.assign(new Error("rate limited"), { statusCode: 429 });
+					throw error;
+				},
+				maxAttempts: 3,
+				baseDelayMs: 1,
+				maxDelayMs: 2,
+			}),
+		).rejects.toThrow("rate limited");
+		expect(attempts).toBe(3);
+
+		const content = await fs.readFile(getBackgroundJobDlqPath(), "utf8");
+		const lines = content.trim().split("\n");
+		expect(lines).toHaveLength(1);
+		const entry = JSON.parse(lines[0] ?? "{}") as { job?: string; attempts?: number };
+		expect(entry.job).toBe("test.retry-429-fail");
+		expect(entry.attempts).toBe(3);
+	});
+
+	it("adds jitter to retry delays to avoid synchronized retries", async () => {
+		vi.resetModules();
+		const sleepMock = vi.fn(async () => {});
+		vi.doMock("../lib/utils.js", () => ({
+			sleep: sleepMock,
+		}));
+		const randomSpy = vi.spyOn(Math, "random");
+		randomSpy.mockReturnValueOnce(0).mockReturnValueOnce(1);
+
+		try {
+			const { runBackgroundJobWithRetry } = await import("../lib/background-jobs.js");
+			let attempts = 0;
+			await expect(
+				runBackgroundJobWithRetry({
+					name: "test.retry-jitter",
+					task: async () => {
+						attempts += 1;
+						const error = new Error("busy") as NodeJS.ErrnoException;
+						error.code = "EBUSY";
+						throw error;
+					},
+					maxAttempts: 3,
+					baseDelayMs: 100,
+					maxDelayMs: 100,
+				}),
+			).rejects.toThrow("busy");
+			expect(attempts).toBe(3);
+			expect(sleepMock.mock.calls.map(([ms]) => ms)).toEqual([80, 120]);
+		} finally {
+			randomSpy.mockRestore();
+			vi.doUnmock("../lib/utils.js");
+		}
+	});
+
+	it("records actual attempts for non-retryable failures", async () => {
+		const { runBackgroundJobWithRetry, getBackgroundJobDlqPath } =
+			await import("../lib/background-jobs.js");
+		let attempts = 0;
+		await expect(
+			runBackgroundJobWithRetry({
+				name: "test.non-retryable",
+				task: async () => {
+					attempts += 1;
+					const error = Object.assign(new Error("bad request"), { statusCode: 400 });
+					throw error;
+				},
+				maxAttempts: 5,
+				retryable: () => false,
+			}),
+		).rejects.toThrow("bad request");
+		expect(attempts).toBe(1);
+
+		const content = await fs.readFile(getBackgroundJobDlqPath(), "utf8");
+		const lines = content.trim().split("\n");
+		expect(lines).toHaveLength(1);
+		const entry = JSON.parse(lines[0] ?? "{}") as { job?: string; attempts?: number };
+		expect(entry.job).toBe("test.non-retryable");
+		expect(entry.attempts).toBe(1);
+	});
+
+	it("redacts sensitive error text in dead-letter entries and warning logs", async () => {
+		vi.resetModules();
+		const warnMock = vi.fn();
+		vi.doMock("../lib/logger.js", () => ({
+			logWarn: warnMock,
+		}));
+		try {
+			const { runBackgroundJobWithRetry, getBackgroundJobDlqPath } =
+				await import("../lib/background-jobs.js");
+			await expect(
+				runBackgroundJobWithRetry({
+					name: "test.retry-sensitive-error",
+					task: async () => {
+						throw new Error(
+							"network failed for person@example.com Bearer sk_test+/123== refresh_token=rt+/456==",
+						);
+					},
+					maxAttempts: 1,
+				}),
+			).rejects.toThrow("person@example.com");
+
+			const content = await fs.readFile(getBackgroundJobDlqPath(), "utf8");
+			const lines = content.trim().split("\n");
+			expect(lines).toHaveLength(1);
+			const entry = JSON.parse(lines[0] ?? "{}") as { error?: string };
+			expect(entry.error).toContain("***REDACTED***");
+			expect(entry.error).not.toContain("person@example.com");
+			expect(entry.error).not.toContain("sk_test+/123==");
+			expect(entry.error).not.toContain("rt+/456==");
+
+			const warningPayloads = warnMock.mock.calls.map((args) => args[1]);
+			const serializedWarnings = JSON.stringify(warningPayloads);
+			expect(serializedWarnings).not.toContain("person@example.com");
+			expect(serializedWarnings).not.toContain("sk_test+/123==");
+			expect(serializedWarnings).not.toContain("rt+/456==");
+		} finally {
+			vi.doUnmock("../lib/logger.js");
+		}
+	});
+});
diff --git a/test/chaos/fault-injection.test.ts b/test/chaos/fault-injection.test.ts
index 35bff25a1..80bd2b3d9 100644
--- a/test/chaos/fault-injection.test.ts
+++ b/test/chaos/fault-injection.test.ts
@@ -313,21 +313,33 @@ describe("SSE Parsing Edge Cases", () => {
 		it("handles empty stream", async () => {
 			const response = new Response("", { status: 200 });
 			const result = await convertSseToJson(response, new Headers());
-			expect(result.status).toBe(200);
+			expect(result.status).toBe(502);
+			expect(result.headers.get("content-type")).toContain("application/json");
+			await expect(result.json()).resolves.toMatchObject({
+				error: { type: "stream_parse_error" },
+			});
 		});
 
 		it("handles [DONE] marker only", async () => {
 			const sseText = "data: [DONE]\n\n";
 			const response = new Response(sseText, { status: 200 });
 			const result = await convertSseToJson(response, new Headers());
-			expect(result.status).toBe(200);
+			expect(result.status).toBe(502);
+			expect(result.headers.get("content-type")).toContain("application/json");
+			await expect(result.json()).resolves.toMatchObject({
+				error: { type: "stream_parse_error" },
+			});
 		});
 
 		it("handles malformed JSON in SSE event", async () => {
 			const sseText = 'data: {"invalid json\n\ndata: [DONE]\n\n';
 			const response = new Response(sseText, { status: 200 });
 			const result = await convertSseToJson(response, new Headers());
-			expect(result.status).toBe(200);
+			expect(result.status).toBe(502);
+			expect(result.headers.get("content-type")).toContain("application/json");
+			await expect(result.json()).resolves.toMatchObject({
+				error: { type: "stream_parse_error" },
+			});
 		});
 
 		it("handles response.done event", async () => {
@@ -359,7 +371,11 @@ describe("SSE Parsing Edge Cases", () => {
 				'data: {"type":"error","error":{"message":"Something went wrong"}}\n\n';
 			const response = new Response(sseText, { status: 200 });
 			const result = await convertSseToJson(response, new Headers());
-			expect(result.status).toBe(200);
+			expect(result.status).toBe(502);
+			expect(result.headers.get("content-type")).toContain("application/json");
+			await expect(result.json()).resolves.toMatchObject({
+				error: { type: "stream_parse_error" },
+			});
 		});
 
 		it("handles multiple events, extracts last response.done", async () => {
diff --git a/test/codex-manager-cli.test.ts b/test/codex-manager-cli.test.ts
index 27261cd27..16b671645 100644
--- a/test/codex-manager-cli.test.ts
+++ b/test/codex-manager-cli.test.ts
@@ -18,6 +18,15 @@ const saveQuotaCacheMock = vi.fn();
 const loadPluginConfigMock = vi.fn();
 const savePluginConfigMock = vi.fn();
 const selectMock = vi.fn();
+const rotateStoredSecretEncryptionMock = vi.fn();
+const checkAndRecordIdempotencyKeyMock = vi.fn();
+const auditLogMock = vi.fn();
+const recordTelemetryEventMock = vi.fn();
+const queryTelemetryEventsMock = vi.fn();
+const summarizeTelemetryEventsMock = vi.fn();
+const getTelemetryLogPathMock = vi.fn(
+	() => "/mock/logs/product-telemetry.jsonl",
+);
 
 vi.mock("../lib/logger.js", () => ({
 	createLogger: vi.fn(() => ({
@@ -27,8 +36,17 @@ vi.mock("../lib/logger.js", () => ({
 		error: vi.fn(),
 	})),
 	logWarn: vi.fn(),
+	maskEmail: vi.fn((email: string) => email.replace(/^(.).+(@.*)$/, "$1***$2")),
 }));
 
+vi.mock("../lib/audit.js", async () => {
+	const actual = await vi.importActual("../lib/audit.js");
+	return {
+		...(actual as Record<string, unknown>),
+		auditLog: auditLogMock,
+	};
+});
+
 vi.mock("../lib/auth/auth.js", () => ({
 	createAuthorizationFlow: vi.fn(),
 	exchangeAuthorizationCode: vi.fn(),
@@ -80,6 +98,11 @@ vi.mock("../lib/storage.js", () => ({
 	saveFlaggedAccounts: saveFlaggedAccountsMock,
 	setStoragePath: setStoragePathMock,
 	getStoragePath: getStoragePathMock,
+	rotateStoredSecretEncryption: rotateStoredSecretEncryptionMock,
+}));
+
+vi.mock("../lib/idempotency.js", () => ({
+	checkAndRecordIdempotencyKey: checkAndRecordIdempotencyKeyMock,
 }));
 
 vi.mock("../lib/refresh-queue.js", () => ({
@@ -131,6 +154,13 @@ vi.mock("../lib/ui/select.js", () => ({
 	select: selectMock,
 }));
 
+vi.mock("../lib/telemetry.js", () => ({
+	recordTelemetryEvent: recordTelemetryEventMock,
+	queryTelemetryEvents: queryTelemetryEventsMock,
+	summarizeTelemetryEvents: summarizeTelemetryEventsMock,
+	getTelemetryLogPath: getTelemetryLogPathMock,
+}));
+
 const stdinIsTTYDescriptor = Object.getOwnPropertyDescriptor(process.stdin, "isTTY");
 const stdoutIsTTYDescriptor = Object.getOwnPropertyDescriptor(process.stdout, "isTTY");
 
@@ -198,6 +228,13 @@ describe("codex manager cli commands", () => {
 		loadPluginConfigMock.mockReset();
 		savePluginConfigMock.mockReset();
 		selectMock.mockReset();
+		rotateStoredSecretEncryptionMock.mockReset();
+		checkAndRecordIdempotencyKeyMock.mockReset();
+		auditLogMock.mockReset();
+		recordTelemetryEventMock.mockReset();
+		queryTelemetryEventsMock.mockReset();
+		summarizeTelemetryEventsMock.mockReset();
+		getTelemetryLogPathMock.mockReset();
 		fetchCodexQuotaSnapshotMock.mockResolvedValue({
 			status: 200,
 			model: "gpt-5-codex",
@@ -226,7 +263,20 @@ describe("codex manager cli commands", () => {
 		});
 		loadPluginConfigMock.mockReturnValue({});
 		savePluginConfigMock.mockResolvedValue(undefined);
+		saveQuotaCacheMock.mockResolvedValue(true);
 		selectMock.mockResolvedValue(undefined);
+		checkAndRecordIdempotencyKeyMock.mockResolvedValue({ replayed: false });
+		recordTelemetryEventMock.mockResolvedValue(undefined);
+		queryTelemetryEventsMock.mockResolvedValue([]);
+		summarizeTelemetryEventsMock.mockReturnValue({
+			total: 0,
+			bySource: { cli: 0, plugin: 0 },
+			byOutcome: { start: 0, success: 0, failure: 0, recovery: 0, info: 0 },
+			byEvent: [],
+			firstTimestamp: null,
+			lastTimestamp: null,
+		});
+		getTelemetryLogPathMock.mockReturnValue("/mock/logs/product-telemetry.jsonl");
 		restoreTTYDescriptors();
 		setStoragePathMock.mockReset();
 		getStoragePathMock.mockReturnValue("/mock/openai-codex-accounts.json");
@@ -279,6 +329,75 @@ describe("codex manager cli commands", () => {
 		expect(payload.recommendation.recommendedIndex).toBe(0);
 	});
 
+	it("returns non-zero in forecast json mode when quota cache persistence fails", async () => {
+		const now = Date.now();
+		loadAccountsMock.mockResolvedValueOnce({
+			version: 3,
+			activeIndex: 0,
+			activeIndexByFamily: { codex: 0 },
+			accounts: [
+				{
+					accountId: "acc_live",
+					email: "live@example.com",
+					refreshToken: "refresh-live",
+					accessToken: "access-live",
+					expiresAt: now + 60 * 60 * 1000,
+					addedAt: now - 1_000,
+					lastUsed: now - 1_000,
+					enabled: true,
+				},
+			],
+		});
+		saveQuotaCacheMock.mockResolvedValueOnce(false);
+
+		const logSpy = vi.spyOn(console, "log").mockImplementation(() => {});
+		const errorSpy = vi.spyOn(console, "error").mockImplementation(() => {});
+		const { runCodexMultiAuthCli } = await import("../lib/codex-manager.js");
+
+		const exitCode = await runCodexMultiAuthCli(["auth", "forecast", "--live", "--json"]);
+		expect(exitCode).toBe(1);
+		expect(errorSpy).not.toHaveBeenCalled();
+		expect(saveQuotaCacheMock).toHaveBeenCalledTimes(1);
+
+		const payload = JSON.parse(String(logSpy.mock.calls[0]?.[0])) as {
+			command: string;
+			quotaCachePersisted: boolean;
+			probeErrors: string[];
+		};
+		expect(payload.command).toBe("forecast");
+		expect(payload.quotaCachePersisted).toBe(false);
+		expect(payload.probeErrors.some((entry) => entry.includes("Failed to persist quota cache changes"))).toBe(true);
+	});
+
+	it("returns non-zero in forecast text mode when quota cache persistence fails", async () => {
+		const now = Date.now();
+		loadAccountsMock.mockResolvedValueOnce({
+			version: 3,
+			activeIndex: 0,
+			activeIndexByFamily: { codex: 0 },
+			accounts: [
+				{
+					accountId: "acc_live",
+					email: "live@example.com",
+					refreshToken: "refresh-live",
+					accessToken: "access-live",
+					expiresAt: now + 60 * 60 * 1000,
+					addedAt: now - 1_000,
+					lastUsed: now - 1_000,
+					enabled: true,
+				},
+			],
+		});
+		saveQuotaCacheMock.mockResolvedValueOnce(false);
+
+		vi.spyOn(console, "log").mockImplementation(() => {});
+		const { runCodexMultiAuthCli } = await import("../lib/codex-manager.js");
+
+		const exitCode = await runCodexMultiAuthCli(["auth", "forecast", "--live"]);
+		expect(exitCode).toBe(1);
+		expect(saveQuotaCacheMock).toHaveBeenCalledTimes(1);
+	});
+
 	it("prints implemented 40-feature matrix", async () => {
 		const logSpy = vi.spyOn(console, "log").mockImplementation(() => {});
 		const errorSpy = vi.spyOn(console, "error").mockImplementation(() => {});
@@ -306,6 +425,97 @@ describe("codex manager cli commands", () => {
 		expect(logSpy.mock.calls[0]?.[0]).toContain("Codex Multi-Auth CLI");
 	});
 
+	it("prints telemetry report in json mode", async () => {
+		const now = Date.now();
+		const events = [
+			{
+				timestamp: new Date(now - 5_000).toISOString(),
+				source: "plugin",
+				event: "request.network_error",
+				outcome: "failure",
+				correlationId: null,
+				details: { status: 503 },
+			},
+		];
+		queryTelemetryEventsMock.mockResolvedValueOnce(events);
+		summarizeTelemetryEventsMock.mockReturnValueOnce({
+			total: 1,
+			bySource: { cli: 0, plugin: 1 },
+			byOutcome: { start: 0, success: 0, failure: 1, recovery: 0, info: 0 },
+			byEvent: [{ event: "request.network_error", count: 1 }],
+			firstTimestamp: events[0].timestamp,
+			lastTimestamp: events[0].timestamp,
+		});
+
+		const logSpy = vi.spyOn(console, "log").mockImplementation(() => {});
+		const { runCodexMultiAuthCli } = await import("../lib/codex-manager.js");
+		const exitCode = await runCodexMultiAuthCli([
+			"auth",
+			"telemetry",
+			"--json",
+			"--since-hours",
+			"12",
+			"--limit",
+			"5",
+		]);
+
+		expect(exitCode).toBe(0);
+		expect(queryTelemetryEventsMock).toHaveBeenCalledWith(
+			expect.objectContaining({
+				sinceMs: expect.any(Number),
+				limit: 5,
+			}),
+		);
+		const sinceMs = (queryTelemetryEventsMock.mock.calls[0]?.[0] as { sinceMs: number }).sinceMs;
+		expect(Math.abs(sinceMs - (now - 12 * 60 * 60_000))).toBeLessThan(5_000);
+		const payload = JSON.parse(String(logSpy.mock.calls[0]?.[0])) as {
+			command: string;
+			limit: number;
+			sinceHours: number;
+			summary: { total: number };
+		};
+		expect(payload.command).toBe("telemetry");
+		expect(payload.limit).toBe(5);
+		expect(payload.sinceHours).toBe(12);
+		expect(payload.summary.total).toBe(1);
+	});
+
+	it("validates telemetry arguments", async () => {
+		const errorSpy = vi.spyOn(console, "error").mockImplementation(() => {});
+		const logSpy = vi.spyOn(console, "log").mockImplementation(() => {});
+		const { runCodexMultiAuthCli } = await import("../lib/codex-manager.js");
+		const exitCode = await runCodexMultiAuthCli(["auth", "telemetry", "--limit", "abc"]);
+
+		expect(exitCode).toBe(1);
+		expect(errorSpy).toHaveBeenCalledWith("Invalid value for --limit: abc");
+		expect(logSpy.mock.calls[0]?.[0]).toContain("codex auth telemetry");
+	});
+
+	it("emits telemetry events for command lifecycle", async () => {
+		const logSpy = vi.spyOn(console, "log").mockImplementation(() => {});
+		const { runCodexMultiAuthCli } = await import("../lib/codex-manager.js");
+		const exitCode = await runCodexMultiAuthCli(["auth", "features"]);
+
+		expect(exitCode).toBe(0);
+		expect(logSpy).toHaveBeenCalled();
+		expect(recordTelemetryEventMock).toHaveBeenCalledWith(
+			expect.objectContaining({
+				source: "cli",
+				event: "cli.command.start",
+				outcome: "start",
+				details: expect.objectContaining({ command: "features" }),
+			}),
+		);
+		expect(recordTelemetryEventMock).toHaveBeenCalledWith(
+			expect.objectContaining({
+				source: "cli",
+				event: "cli.command.finish",
+				outcome: "success",
+				details: expect.objectContaining({ command: "features", exitCode: 0 }),
+			}),
+		);
+	});
+
 	it("restores healthy flagged accounts into active storage", async () => {
 		const now = Date.now();
 		loadFlaggedAccountsMock.mockResolvedValueOnce({
@@ -425,6 +635,71 @@ describe("codex manager cli commands", () => {
 		expect(payload.reports[0]?.outcome).toBe("warning-soft-failure");
 	});
 
+	it("returns non-zero in fix json mode when quota cache persistence fails", async () => {
+		const now = Date.now();
+		loadAccountsMock.mockResolvedValueOnce({
+			version: 3,
+			activeIndex: 0,
+			activeIndexByFamily: { codex: 0 },
+			accounts: [
+				{
+					accountId: "acc_live",
+					email: "live@example.com",
+					refreshToken: "refresh-live",
+					accessToken: "access-live",
+					expiresAt: now + 60 * 60 * 1000,
+					addedAt: now - 1_000,
+					lastUsed: now - 1_000,
+					enabled: true,
+				},
+			],
+		});
+		saveQuotaCacheMock.mockResolvedValueOnce(false);
+
+		const logSpy = vi.spyOn(console, "log").mockImplementation(() => {});
+		const { runCodexMultiAuthCli } = await import("../lib/codex-manager.js");
+
+		const exitCode = await runCodexMultiAuthCli(["auth", "fix", "--live", "--json"]);
+		expect(exitCode).toBe(1);
+		expect(saveQuotaCacheMock).toHaveBeenCalledTimes(1);
+
+		const payload = JSON.parse(String(logSpy.mock.calls[0]?.[0])) as {
+			command: string;
+			quotaCachePersisted: boolean;
+		};
+		expect(payload.command).toBe("fix");
+		expect(payload.quotaCachePersisted).toBe(false);
+	});
+
+	it("returns non-zero in fix text mode when quota cache persistence fails", async () => {
+		const now = Date.now();
+		loadAccountsMock.mockResolvedValueOnce({
+			version: 3,
+			activeIndex: 0,
+			activeIndexByFamily: { codex: 0 },
+			accounts: [
+				{
+					accountId: "acc_live",
+					email: "live@example.com",
+					refreshToken: "refresh-live",
+					accessToken: "access-live",
+					expiresAt: now + 60 * 60 * 1000,
+					addedAt: now - 1_000,
+					lastUsed: now - 1_000,
+					enabled: true,
+				},
+			],
+		});
+		saveQuotaCacheMock.mockResolvedValueOnce(false);
+
+		vi.spyOn(console, "log").mockImplementation(() => {});
+		const { runCodexMultiAuthCli } = await import("../lib/codex-manager.js");
+
+		const exitCode = await runCodexMultiAuthCli(["auth", "fix", "--live", "--dry-run"]);
+		expect(exitCode).toBe(1);
+		expect(saveQuotaCacheMock).toHaveBeenCalledTimes(1);
+	});
+
 	it("persists rotated tokens during auth check and syncs active codex selection", async () => {
 		const now = Date.now();
 		loadAccountsMock.mockResolvedValueOnce({
@@ -499,6 +774,32 @@ describe("codex manager cli commands", () => {
 		expect(logSpy.mock.calls.some((call) => String(call[0]).includes("live session OK"))).toBe(true);
 	});
 
+	it("shows rate-limit reset details in auth status output", async () => {
+		const now = Date.now();
+		loadAccountsMock.mockResolvedValueOnce({
+			version: 3,
+			activeIndex: 0,
+			activeIndexByFamily: { codex: 0 },
+			accounts: [
+				{
+					email: "rate-limited@example.com",
+					refreshToken: "refresh-rate-limited",
+					addedAt: now - 1_000,
+					lastUsed: now - 1_000,
+					rateLimitResetTimes: {
+						codex: now + 120_000,
+					},
+				},
+			],
+		});
+		const logSpy = vi.spyOn(console, "log").mockImplementation(() => {});
+		const { runCodexMultiAuthCli } = await import("../lib/codex-manager.js");
+
+		const exitCode = await runCodexMultiAuthCli(["auth", "status"]);
+		expect(exitCode).toBe(0);
+		expect(logSpy.mock.calls.some((call) => String(call[0]).includes("rate-limited"))).toBe(true);
+	});
+
 	it("runs fix apply mode and returns a switch recommendation", async () => {
 		const now = Date.now();
 		loadAccountsMock.mockResolvedValueOnce({
@@ -834,6 +1135,8 @@ describe("codex manager cli commands", () => {
 			.mockResolvedValueOnce({ mode: "add" })
 			.mockResolvedValueOnce({ mode: "cancel" });
 		promptAddAnotherAccountMock.mockResolvedValue(false);
+		const expectedTimeoutMs = 4321;
+		loadPluginConfigMock.mockReturnValue({ fetchTimeoutMs: expectedTimeoutMs });
 
 		const authModule = await import("../lib/auth/auth.js");
 		const createAuthorizationFlowMock = vi.mocked(authModule.createAuthorizationFlow);
@@ -874,6 +1177,12 @@ describe("codex manager cli commands", () => {
 		expect(storageState.activeIndex).toBe(1);
 		expect(storageState.activeIndexByFamily.codex).toBe(1);
 		expect(setCodexCliActiveSelectionMock).toHaveBeenCalledTimes(1);
+		expect(exchangeAuthorizationCodeMock).toHaveBeenCalledWith(
+			"oauth-code",
+			"pkce-verifier",
+			authModule.REDIRECT_URI,
+			{ timeoutMs: expectedTimeoutMs },
+		);
 	});
 
 	it("runs full refresh test from login menu deep-check mode", async () => {
@@ -1358,6 +1667,7 @@ describe("codex manager cli commands", () => {
 			{ type: "open-category", key: "rotation-quota" },
 			{ type: "toggle", key: "preemptiveQuotaEnabled" },
 			{ type: "bump", key: "preemptiveQuotaRemainingPercent5h", direction: 1 },
+			{ type: "bump", key: "retryAllAccountsAbsoluteCeilingMs", direction: 1 },
 			{ type: "back" },
 			{ type: "save" },
 			{ type: "back" },
@@ -1374,8 +1684,13 @@ describe("codex manager cli commands", () => {
 			expect.objectContaining({
 				preemptiveQuotaEnabled: expect.any(Boolean),
 				preemptiveQuotaRemainingPercent5h: expect.any(Number),
+				retryAllAccountsAbsoluteCeilingMs: 30_000,
 			}),
 		);
+		const savedPluginConfig = savePluginConfigMock.mock.calls[0]?.[0] as
+			| { retryAllAccountsAbsoluteCeilingMs?: number }
+			| undefined;
+		expect(savedPluginConfig?.retryAllAccountsAbsoluteCeilingMs).toBe(30_000);
 	});
 
 	it.each([
@@ -1970,6 +2285,122 @@ describe("codex manager cli commands", () => {
 		expect(saveAccountsMock.mock.calls[0]?.[0]?.accounts?.[0]?.enabled).toBe(false);
 	});
 
+	it("maps audited commands to expected actions and outcomes", async () => {
+		vi.spyOn(console, "log").mockImplementation(() => {});
+		vi.spyOn(console, "error").mockImplementation(() => {});
+		vi.spyOn(console, "warn").mockImplementation(() => {});
+		const { runCodexMultiAuthCli } = await import("../lib/codex-manager.js");
+		const { AuditAction, AuditOutcome } = await import("../lib/audit.js");
+		const { createAuthorizationFlow } = await import("../lib/auth/auth.js");
+
+		vi.mocked(createAuthorizationFlow).mockRejectedValueOnce(new Error("mock login failure"));
+		await expect(runCodexMultiAuthCli(["auth", "login"])).rejects.toThrow("mock login failure");
+		expect(auditLogMock).toHaveBeenCalledWith(
+			AuditAction.AUTH_LOGIN,
+			"cli-user",
+			"codex auth login",
+			AuditOutcome.FAILURE,
+			expect.objectContaining({ command: "login", error: expect.any(String) }),
+		);
+
+		auditLogMock.mockClear();
+		const switchCode = await runCodexMultiAuthCli(["auth", "switch"]);
+		expect(switchCode).toBe(1);
+		expect(auditLogMock).toHaveBeenCalledWith(
+			AuditAction.ACCOUNT_SWITCH,
+			"cli-user",
+			"codex auth switch",
+			AuditOutcome.FAILURE,
+			expect.objectContaining({ command: "switch", exitCode: 1 }),
+		);
+
+		auditLogMock.mockClear();
+		loadAccountsMock.mockResolvedValueOnce(null);
+		const checkCode = await runCodexMultiAuthCli(["auth", "check"]);
+		expect(checkCode).toBe(0);
+		expect(auditLogMock).toHaveBeenCalledWith(
+			AuditAction.REQUEST_START,
+			"cli-user",
+			"codex auth check",
+			AuditOutcome.SUCCESS,
+			expect.objectContaining({ command: "check", exitCode: 0 }),
+		);
+
+		auditLogMock.mockClear();
+		loadFlaggedAccountsMock.mockResolvedValueOnce({ version: 1, accounts: [] });
+		const verifyCode = await runCodexMultiAuthCli(["auth", "verify-flagged", "--json"]);
+		expect(verifyCode).toBe(0);
+		expect(auditLogMock).toHaveBeenCalledWith(
+			AuditAction.ACCOUNT_REFRESH,
+			"cli-user",
+			"codex auth verify-flagged",
+			AuditOutcome.SUCCESS,
+			expect.objectContaining({ command: "verify-flagged", exitCode: 0 }),
+		);
+
+		auditLogMock.mockClear();
+		loadAccountsMock.mockResolvedValueOnce(null);
+		const forecastCode = await runCodexMultiAuthCli(["auth", "forecast", "--json"]);
+		expect(forecastCode).toBe(0);
+		expect(auditLogMock).toHaveBeenCalledWith(
+			AuditAction.COMMAND_RUN,
+			"cli-user",
+			"codex auth forecast",
+			AuditOutcome.SUCCESS,
+			expect.objectContaining({ command: "forecast", exitCode: 0 }),
+		);
+
+		auditLogMock.mockClear();
+		loadAccountsMock.mockResolvedValueOnce(null);
+		const statusCode = await runCodexMultiAuthCli(["auth", "status"]);
+		expect(statusCode).toBe(0);
+		expect(auditLogMock).toHaveBeenCalledWith(
+			AuditAction.COMMAND_RUN,
+			"cli-user",
+			"codex auth status",
+			AuditOutcome.SUCCESS,
+			expect.objectContaining({ command: "status", exitCode: 0 }),
+		);
+	});
+
+	it("sanitizes audited thrown errors with token and email redaction", async () => {
+		vi.spyOn(console, "log").mockImplementation(() => {});
+		vi.spyOn(console, "error").mockImplementation(() => {});
+		const { runCodexMultiAuthCli } = await import("../lib/codex-manager.js");
+		const { AuditAction, AuditOutcome } = await import("../lib/audit.js");
+		const secretError = new Error(
+			[
+				"EBUSY while refreshing account",
+				"HTTP 429 from upstream",
+				"user@example.com",
+				"sk-test-secret-abcdefghijklmnopqrstuvwxyz",
+				"refresh_token_sensitive-abcdef12",
+				"access_token_sensitive-qwerty12",
+				"secret-access-token",
+				"x".repeat(260),
+			].join(" | "),
+		);
+		loadAccountsMock.mockRejectedValueOnce(secretError);
+
+		await expect(runCodexMultiAuthCli(["auth", "status"])).rejects.toThrow(secretError);
+		expect(auditLogMock).toHaveBeenCalledTimes(1);
+
+		const call = auditLogMock.mock.calls[0];
+		expect(call?.[0]).toBe(AuditAction.COMMAND_RUN);
+		expect(call?.[3]).toBe(AuditOutcome.FAILURE);
+		const metadata = call?.[4] as Record<string, unknown> | undefined;
+		const sanitizedError = typeof metadata?.error === "string" ? metadata.error : "";
+		expect(sanitizedError.length).toBeLessThanOrEqual(200);
+		expect(sanitizedError).toContain("EBUSY");
+		expect(sanitizedError).toContain("429");
+		expect(sanitizedError).not.toContain("sk-test-secret-abcdefghijklmnopqrstuvwxyz");
+		expect(sanitizedError).not.toContain("refresh_token_sensitive-abcdef12");
+		expect(sanitizedError).not.toContain("access_token_sensitive-qwerty12");
+		expect(sanitizedError).not.toContain("secret-access-token");
+		expect(sanitizedError).not.toContain("user@example.com");
+		expect(sanitizedError).toContain("***REDACTED***");
+	});
+
 	it("keeps settings unchanged in non-interactive mode and returns to menu", async () => {
 		const now = Date.now();
 		loadAccountsMock.mockResolvedValue({
@@ -2001,4 +2432,294 @@ describe("codex manager cli commands", () => {
 		expect(saveDashboardDisplaySettingsMock).not.toHaveBeenCalled();
 		expect(savePluginConfigMock).not.toHaveBeenCalled();
 	});
+
+	it("supports paginated json output for list command", async () => {
+		const now = Date.now();
+		loadAccountsMock.mockResolvedValue({
+			version: 3,
+			activeIndex: 0,
+			activeIndexByFamily: { codex: 0 },
+			accounts: [
+				{
+					email: "one@example.com",
+					accountId: "acc_one",
+					refreshToken: "refresh-one",
+					addedAt: now - 2_000,
+					lastUsed: now - 2_000,
+					enabled: true,
+				},
+				{
+					email: "two@example.com",
+					accountId: "acc_two",
+					refreshToken: "refresh-two",
+					addedAt: now - 1_000,
+					lastUsed: now - 1_000,
+					enabled: true,
+				},
+			],
+		});
+
+		const logSpy = vi.spyOn(console, "log").mockImplementation(() => {});
+		try {
+			const { runCodexMultiAuthCli } = await import("../lib/codex-manager.js");
+			const firstExitCode = await runCodexMultiAuthCli([
+				"auth",
+				"list",
+				"--json",
+				"--page-size",
+				"1",
+			]);
+			expect(firstExitCode).toBe(0);
+			const firstPayload = JSON.parse(String(logSpy.mock.calls[0]?.[0])) as {
+				schemaVersion: number;
+				accounts: Array<{ email: string }>;
+				pagination: {
+					cursor: string | null;
+					nextCursor: string | null;
+					hasMore: boolean;
+					pageSize: number;
+				};
+			};
+			expect(typeof firstPayload.schemaVersion).toBe("number");
+			expect(firstPayload.pagination.cursor).toBeNull();
+			expect(firstPayload.pagination.pageSize).toBe(1);
+			expect(firstPayload.accounts).toHaveLength(1);
+			expect(firstPayload.accounts[0]?.email).toBe("one@example.com");
+			expect(firstPayload.pagination.hasMore).toBe(true);
+			expect(firstPayload.pagination.nextCursor).toBeTruthy();
+
+			logSpy.mockClear();
+			const secondExitCode = await runCodexMultiAuthCli([
+				"auth",
+				"list",
+				"--json",
+				"--page-size",
+				"1",
+				"--cursor",
+				String(firstPayload.pagination.nextCursor),
+			]);
+			expect(secondExitCode).toBe(0);
+			const secondPayload = JSON.parse(String(logSpy.mock.calls[0]?.[0])) as {
+				schemaVersion: number;
+				accounts: Array<{ email: string }>;
+				pagination: {
+					cursor: string | null;
+					nextCursor: string | null;
+					hasMore: boolean;
+					pageSize: number;
+				};
+			};
+			expect(typeof secondPayload.schemaVersion).toBe("number");
+			expect(secondPayload.pagination.cursor).toBe(String(firstPayload.pagination.nextCursor));
+			expect(secondPayload.pagination.pageSize).toBe(1);
+			expect(secondPayload.accounts).toHaveLength(1);
+			expect(secondPayload.accounts[0]?.email).toBe("two@example.com");
+			expect(secondPayload.pagination.hasMore).toBe(false);
+			expect(secondPayload.pagination.nextCursor).toBeNull();
+		} finally {
+			logSpy.mockRestore();
+		}
+	});
+
+	it("rejects malformed pagination cursors in JSON list mode", async () => {
+		loadAccountsMock.mockResolvedValue({
+			version: 3,
+			activeIndex: 0,
+			activeIndexByFamily: {},
+			accounts: [
+				{
+					email: "one@example.com",
+					accountId: "acc_one",
+					refreshToken: "refresh-one",
+					addedAt: Date.now() - 2_000,
+					lastUsed: Date.now() - 2_000,
+					enabled: true,
+				},
+			],
+		});
+
+		const errorSpy = vi.spyOn(console, "error").mockImplementation(() => {});
+		try {
+			const { runCodexMultiAuthCli } = await import("../lib/codex-manager.js");
+			const malformedPayloadCursor = Buffer.from("12junk", "utf8").toString("base64");
+			const invalidPayloadExitCode = await runCodexMultiAuthCli([
+				"auth",
+				"list",
+				"--json",
+				"--cursor",
+				malformedPayloadCursor,
+			]);
+			expect(invalidPayloadExitCode).toBe(1);
+			expect(errorSpy).toHaveBeenCalledWith("Invalid --cursor value");
+
+			errorSpy.mockClear();
+			const invalidBase64ExitCode = await runCodexMultiAuthCli([
+				"auth",
+				"list",
+				"--json",
+				"--cursor",
+				"%%%invalid-base64%%%",
+			]);
+			expect(invalidBase64ExitCode).toBe(1);
+			expect(errorSpy).toHaveBeenCalledWith("Invalid --cursor value");
+		} finally {
+			errorSpy.mockRestore();
+		}
+	});
+
+	it("rejects partially numeric --page-size values", async () => {
+		const errorSpy = vi.spyOn(console, "error").mockImplementation(() => {});
+		try {
+			const { runCodexMultiAuthCli } = await import("../lib/codex-manager.js");
+			const exitCode = await runCodexMultiAuthCli([
+				"auth",
+				"list",
+				"--json",
+				"--page-size",
+				"10junk",
+			]);
+			expect(exitCode).toBe(1);
+			expect(errorSpy).toHaveBeenCalledWith("--page-size must be between 1 and 200");
+			expect(loadAccountsMock).not.toHaveBeenCalled();
+		} finally {
+			errorSpy.mockRestore();
+		}
+	});
+
+	it("applies idempotency key for rotate-secrets automation retries", async () => {
+		checkAndRecordIdempotencyKeyMock
+			.mockResolvedValueOnce({ replayed: false })
+			.mockResolvedValueOnce({ replayed: true });
+		rotateStoredSecretEncryptionMock.mockResolvedValue({
+			accounts: 2,
+			flaggedAccounts: 1,
+		});
+
+		const logSpy = vi.spyOn(console, "log").mockImplementation(() => {});
+		try {
+			const { runCodexMultiAuthCli } = await import("../lib/codex-manager.js");
+			const firstExitCode = await runCodexMultiAuthCli([
+				"auth",
+				"rotate-secrets",
+				"--json",
+				"--idempotency-key",
+				"rotation-001",
+			]);
+			expect(firstExitCode).toBe(0);
+			const firstPayload = JSON.parse(String(logSpy.mock.calls[0]?.[0])) as {
+				rotated: boolean;
+				replayed: boolean;
+			};
+			expect(firstPayload.rotated).toBe(true);
+			expect(firstPayload.replayed).toBe(false);
+
+			logSpy.mockClear();
+			const secondExitCode = await runCodexMultiAuthCli([
+				"auth",
+				"rotate-secrets",
+				"--json",
+				"--idempotency-key=rotation-001",
+			]);
+			expect(secondExitCode).toBe(0);
+			const secondPayload = JSON.parse(String(logSpy.mock.calls[0]?.[0])) as {
+				rotated: boolean;
+				replayed: boolean;
+			};
+			expect(secondPayload.rotated).toBe(true);
+			expect(secondPayload.replayed).toBe(true);
+			expect(rotateStoredSecretEncryptionMock).toHaveBeenCalledTimes(1);
+		} finally {
+			logSpy.mockRestore();
+		}
+	});
+
+	it("rejects option-smuggling for --idempotency-key", async () => {
+		const errorSpy = vi.spyOn(console, "error").mockImplementation(() => {});
+		try {
+			const { runCodexMultiAuthCli } = await import("../lib/codex-manager.js");
+			const exitCode = await runCodexMultiAuthCli([
+				"auth",
+				"rotate-secrets",
+				"--idempotency-key",
+				"--json",
+			]);
+			expect(exitCode).toBe(1);
+			expect(errorSpy).toHaveBeenCalledWith("Missing value for --idempotency-key");
+			expect(rotateStoredSecretEncryptionMock).not.toHaveBeenCalled();
+		} finally {
+			errorSpy.mockRestore();
+		}
+	});
+
+	it("redacts rotate-secrets failure details in non-json output", async () => {
+		rotateStoredSecretEncryptionMock.mockRejectedValue(
+			new Error(
+				"failed for person@example.com Bearer sk_test+/123== refresh_token=rt+/456==",
+			),
+		);
+		const errorSpy = vi.spyOn(console, "error").mockImplementation(() => {});
+		try {
+			const { runCodexMultiAuthCli } = await import("../lib/codex-manager.js");
+			const exitCode = await runCodexMultiAuthCli(["auth", "rotate-secrets"]);
+			expect(exitCode).toBe(1);
+			const rendered = String(errorSpy.mock.calls[0]?.[0] ?? "");
+			expect(rendered).toContain("Failed to rotate stored secrets:");
+			expect(rendered).toContain("***REDACTED***");
+			expect(rendered).not.toContain("person@example.com");
+			expect(rendered).not.toContain("sk_test+/123==");
+			expect(rendered).not.toContain("rt+/456==");
+		} finally {
+			errorSpy.mockRestore();
+		}
+	});
+
+	it("enforces ABAC idempotency-key requirement for rotate-secrets", async () => {
+		const previousRole = process.env.CODEX_AUTH_ROLE;
+		const previousAbacRequirement = process.env.CODEX_AUTH_ABAC_REQUIRE_IDEMPOTENCY_KEY;
+		process.env.CODEX_AUTH_ROLE = "admin";
+		process.env.CODEX_AUTH_ABAC_REQUIRE_IDEMPOTENCY_KEY = "secrets:rotate";
+		rotateStoredSecretEncryptionMock.mockResolvedValue({
+			accounts: 1,
+			flaggedAccounts: 0,
+		});
+
+		const errorSpy = vi.spyOn(console, "error").mockImplementation(() => {});
+		try {
+			const { runCodexMultiAuthCli } = await import("../lib/codex-manager.js");
+			const deniedExitCode = await runCodexMultiAuthCli([
+				"auth",
+				"rotate-secrets",
+				"--json",
+			]);
+			expect(deniedExitCode).toBe(1);
+			expect(rotateStoredSecretEncryptionMock).not.toHaveBeenCalled();
+			expect(errorSpy).toHaveBeenCalledWith(
+				expect.stringContaining("idempotency key"),
+			);
+
+			errorSpy.mockClear();
+			const allowedExitCode = await runCodexMultiAuthCli([
+				"auth",
+				"rotate-secrets",
+				"--json",
+				"--idempotency-key",
+				"rotation-allowed",
+			]);
+			expect(allowedExitCode).toBe(0);
+			expect(rotateStoredSecretEncryptionMock).toHaveBeenCalledTimes(1);
+			expect(errorSpy).not.toHaveBeenCalled();
+		} finally {
+			errorSpy.mockRestore();
+			if (previousRole === undefined) {
+				delete process.env.CODEX_AUTH_ROLE;
+			} else {
+				process.env.CODEX_AUTH_ROLE = previousRole;
+			}
+			if (previousAbacRequirement === undefined) {
+				delete process.env.CODEX_AUTH_ABAC_REQUIRE_IDEMPOTENCY_KEY;
+			} else {
+				process.env.CODEX_AUTH_ABAC_REQUIRE_IDEMPOTENCY_KEY = previousAbacRequirement;
+			}
+		}
+	});
 });
diff --git a/test/codex-prompts.test.ts b/test/codex-prompts.test.ts
index 17131b8f5..7ead02639 100644
--- a/test/codex-prompts.test.ts
+++ b/test/codex-prompts.test.ts
@@ -213,6 +213,65 @@ describe("Codex Prompts Module", () => {
 				const second = await getCodexInstructions("gpt-5.1-codex");
 				expect(second).toBe("new version content");
 			});
+
+			it("deduplicates background refresh for concurrent stale calls", async () => {
+				const oldTimestamp = Date.now() - 20 * 60 * 1000;
+				let resolvePromptText: ((value: string) => void) | null = null;
+				const promptText = new Promise<string>((resolve) => {
+					resolvePromptText = resolve;
+				});
+
+				mockedReadFile.mockImplementation((filePath) => {
+					if (typeof filePath === "string" && filePath.includes("-meta.json")) {
+						return Promise.resolve(
+							JSON.stringify({
+								etag: "old-etag",
+								tag: "rust-v0.40.0",
+								lastChecked: oldTimestamp,
+								url: "https://example.com",
+							}),
+						);
+					}
+					return Promise.resolve("stale disk content");
+				});
+				mockFetch.mockResolvedValueOnce({
+					ok: true,
+					json: () => Promise.resolve({ tag_name: "rust-v0.50.0" }),
+				});
+				mockFetch.mockImplementationOnce(() =>
+					Promise.resolve({
+						ok: true,
+						text: () => promptText,
+						headers: { get: () => "new-etag" },
+					}),
+				);
+				mockedMkdir.mockResolvedValue(undefined);
+				mockedWriteFile.mockResolvedValue(undefined);
+
+				const [first, second] = await Promise.all([
+					getCodexInstructions("gpt-5.1-codex"),
+					getCodexInstructions("gpt-5.1-codex"),
+				]);
+
+				expect(first).toBe("stale disk content");
+				expect(second).toBe("stale disk content");
+				await vi.waitFor(() => {
+					expect(mockFetch).toHaveBeenCalledTimes(2);
+				});
+
+				resolvePromptText?.("fresh deduped content");
+				await vi.waitFor(() => {
+					expect(mockedWriteFile).toHaveBeenCalled();
+				});
+				const settledFetchCalls = mockFetch.mock.calls.length;
+				expect(settledFetchCalls).toBe(2);
+
+				const refreshed = await getCodexInstructions("gpt-5.1-codex");
+				expect(refreshed).toBe("fresh deduped content");
+				await vi.waitFor(() => {
+					expect(mockFetch).toHaveBeenCalledTimes(settledFetchCalls);
+				});
+			});
 		});
 
 		describe("GitHub HTML fallback", () => {
@@ -239,6 +298,29 @@ describe("Codex Prompts Module", () => {
 				expect(result).toBe("fallback instructions");
 			});
 
+			it("should fall back to HTML releases page when API request times out", async () => {
+				mockedReadFile.mockRejectedValue(new Error("ENOENT"));
+				mockFetch.mockRejectedValueOnce(
+					Object.assign(new Error("request timeout"), { name: "AbortError" }),
+				);
+				mockFetch.mockResolvedValueOnce({
+					ok: true,
+					url: "https://github.com/openai/codex/releases/tag/rust-v0.55.0",
+					text: () => Promise.resolve(""),
+				});
+				mockFetch.mockResolvedValueOnce({
+					ok: true,
+					text: () => Promise.resolve("timeout fallback instructions"),
+					headers: { get: () => "fallback-timeout-etag" },
+				});
+				mockedMkdir.mockResolvedValue(undefined);
+				mockedWriteFile.mockResolvedValue(undefined);
+
+				const result = await getCodexInstructions("gpt-5.2-codex");
+				expect(result).toBe("timeout fallback instructions");
+				expect(mockFetch).toHaveBeenCalledTimes(3);
+			});
+
 			it("should parse tag from HTML content if URL parsing fails", async () => {
 				mockedReadFile.mockRejectedValue(new Error("ENOENT"));
 				mockFetch.mockResolvedValueOnce({
@@ -348,6 +430,56 @@ describe("Codex Prompts Module", () => {
 				expect(result).toBe("disk cache fallback");
 			});
 
+			it("should fall back to disk cache when prompt fetch times out", async () => {
+				mockedReadFile.mockImplementation((filePath) => {
+					if (typeof filePath === "string" && filePath.includes("-meta.json")) {
+						// malformed metadata forces the timeout path instead of stale-while-revalidate.
+						return Promise.resolve("{ malformed");
+					}
+					return Promise.resolve("disk timeout fallback");
+				});
+				mockFetch.mockResolvedValueOnce({
+					ok: true,
+					json: () => Promise.resolve({ tag_name: "rust-v0.80.0" }),
+				});
+				mockFetch.mockRejectedValueOnce(
+					Object.assign(new Error("request timeout"), { name: "AbortError" }),
+				);
+
+				const result = await getCodexInstructions("gpt-5.2");
+				expect(result).toBe("disk timeout fallback");
+				expect(mockFetch).toHaveBeenCalledTimes(2);
+			});
+
+			it("should fall back to disk cache when metadata read hits transient windows EPERM", async () => {
+				let metaReadFailures = 0;
+				mockedReadFile.mockImplementation((filePath) => {
+					const path = typeof filePath === "string" ? filePath : String(filePath);
+					if (path.includes("-meta.json")) {
+						if (metaReadFailures === 0) {
+							metaReadFailures += 1;
+							return Promise.reject(
+								Object.assign(new Error("win fs busy"), { code: "EPERM" }),
+							);
+						}
+						return Promise.resolve("{ malformed");
+					}
+					return Promise.resolve("disk timeout fallback");
+				});
+				mockFetch.mockResolvedValueOnce({
+					ok: true,
+					json: () => Promise.resolve({ tag_name: "rust-v0.80.1" }),
+				});
+				mockFetch.mockRejectedValueOnce(
+					Object.assign(new Error("request timeout"), { name: "AbortError" }),
+				);
+
+				const result = await getCodexInstructions("gpt-5.2");
+				expect(result).toBe("disk timeout fallback");
+				expect(metaReadFailures).toBe(1);
+				expect(mockFetch).toHaveBeenCalledTimes(2);
+			});
+
 			it("should fall back to bundled instructions when all else fails", async () => {
 				mockedReadFile.mockImplementation((filePath) => {
 					if (typeof filePath === "string" && filePath.includes("codex-instructions.md")) {
diff --git a/test/compliance-evidence-bundle.test.ts b/test/compliance-evidence-bundle.test.ts
new file mode 100644
index 000000000..78d43b26f
--- /dev/null
+++ b/test/compliance-evidence-bundle.test.ts
@@ -0,0 +1,140 @@
+import { afterEach, describe, expect, it } from "vitest";
+import { mkdtempSync, writeFileSync, chmodSync, mkdirSync } from "node:fs";
+import { promises as fs } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import process from "node:process";
+import { spawnSync } from "node:child_process";
+
+const scriptPath = path.resolve(process.cwd(), "scripts", "compliance-evidence-bundle.js");
+
+async function removeWithRetry(targetPath: string): Promise<void> {
+	const retryableCodes = new Set(["EBUSY", "EPERM", "ENOTEMPTY"]);
+	for (let attempt = 0; attempt < 6; attempt += 1) {
+		try {
+			await fs.rm(targetPath, { recursive: true, force: true });
+			return;
+		} catch (error) {
+			const code = (error as NodeJS.ErrnoException).code;
+			if (code === "ENOENT") return;
+			if (!code || !retryableCodes.has(code) || attempt === 5) {
+				throw error;
+			}
+			await new Promise((resolve) => setTimeout(resolve, 25 * 2 ** attempt));
+		}
+	}
+}
+
+function createFakeNpmBin(root: string): string {
+	const binDir = path.join(root, "bin");
+	mkdirSync(binDir, { recursive: true });
+	const fakeNpmPath = path.join(binDir, "fake-npm.js");
+	const npmShellPath = path.join(binDir, "npm");
+	const npmCmdPath = path.join(binDir, "npm.cmd");
+	const fakeNpmSource = `
+const fs = require("node:fs");
+const markerPath = process.env.FAKE_NPM_MARKER_PATH;
+if (markerPath) {
+  fs.writeFileSync(markerPath, process.env.FAKE_NPM_WRAPPER ?? "unknown", "utf8");
+}
+const args = process.argv.slice(2);
+if (args[0] === "sbom") {
+  process.stdout.write(JSON.stringify({ bomFormat: "CycloneDX", specVersion: "1.5", metadata: "x".repeat(1_500_000) }));
+  process.exit(0);
+}
+const chunk = "verbose-output-" + "x".repeat(300) + "\\n";
+let output = "";
+for (let index = 0; index < 5000; index += 1) {
+  output += chunk;
+}
+process.stdout.write(output);
+process.exit(0);
+`.trimStart();
+	const nodeExecPosix = process.execPath.replace(/\\/g, "/").replace(/"/g, '\\"');
+	const nodeExecWindows = process.execPath.replace(/"/g, '""');
+	const npmShellSource = `#!/usr/bin/env sh\nFAKE_NPM_WRAPPER=sh \"${nodeExecPosix}\" \"${fakeNpmPath.replace(/\\/g, "/")}\" \"$@\"\n`;
+	const npmCmdSource = `@echo off\r\nset FAKE_NPM_WRAPPER=cmd\r\n\"${nodeExecWindows}\" \"%~dp0\\fake-npm.js\" %*\r\n`;
+	writeFileSync(fakeNpmPath, fakeNpmSource, "utf8");
+	writeFileSync(npmShellPath, npmShellSource, "utf8");
+	writeFileSync(npmCmdPath, npmCmdSource, "utf8");
+	if (process.platform !== "win32") {
+		chmodSync(npmShellPath, 0o755);
+		chmodSync(fakeNpmPath, 0o755);
+	}
+	return binDir;
+}
+
+describe("compliance-evidence-bundle script", () => {
+	const fixtures: string[] = [];
+
+	afterEach(async () => {
+		while (fixtures.length > 0) {
+			const fixture = fixtures.pop();
+			if (!fixture) continue;
+			await removeWithRetry(fixture);
+		}
+	});
+
+	it("handles verbose npm output without maxBuffer overflow", async () => {
+		const root = mkdtempSync(path.join(tmpdir(), "compliance-bundle-"));
+		fixtures.push(root);
+		const outDir = path.join(root, "evidence");
+		const binDir = createFakeNpmBin(root);
+
+		const result = spawnSync(
+			process.execPath,
+			[scriptPath, "--profile=quick", `--out-dir=${outDir}`],
+			{
+				cwd: root,
+				encoding: "utf8",
+				env: {
+					...process.env,
+					PATH: `${binDir}${path.delimiter}${process.env.PATH ?? ""}`,
+				},
+			},
+		);
+
+		expect(result.status).toBe(0);
+		const payload = JSON.parse(result.stdout) as {
+			status?: string;
+		};
+		expect(payload.status).toBe("pass");
+
+		const manifest = JSON.parse(await fs.readFile(path.join(outDir, "manifest.json"), "utf8")) as {
+			status?: string;
+			results?: Array<{ id?: string }>;
+		};
+		expect(manifest.status).toBe("pass");
+		expect(Array.isArray(manifest.results)).toBe(true);
+		expect(manifest.results?.length).toBeGreaterThan(0);
+
+		const firstLogStat = await fs.stat(path.join(outDir, "01-typecheck.log"));
+		expect(firstLogStat.size).toBeGreaterThan(1_000_000);
+	});
+
+	it.skipIf(process.platform !== "win32")("uses npm.cmd wrapper on Windows for verbose runs", async () => {
+		const root = mkdtempSync(path.join(tmpdir(), "compliance-bundle-win32-"));
+		fixtures.push(root);
+		const outDir = path.join(root, "evidence");
+		const binDir = createFakeNpmBin(root);
+		const markerPath = path.join(root, "wrapper-marker.txt");
+
+		const result = spawnSync(
+			process.execPath,
+			[scriptPath, "--profile=quick", `--out-dir=${outDir}`],
+			{
+				cwd: root,
+				encoding: "utf8",
+				env: {
+					...process.env,
+					PATH: `${binDir}${path.delimiter}${process.env.PATH ?? ""}`,
+					FAKE_NPM_MARKER_PATH: markerPath,
+				},
+			},
+		);
+
+		expect(result.status).toBe(0);
+		const marker = await fs.readFile(markerPath, "utf8");
+		expect(marker.trim()).toBe("cmd");
+	});
+});
diff --git a/test/config-save.test.ts b/test/config-save.test.ts
index 2064faebd..43150d8c5 100644
--- a/test/config-save.test.ts
+++ b/test/config-save.test.ts
@@ -24,6 +24,26 @@ async function removeWithRetry(
   }
 }
 
+async function expectSecureFileMode(path: string): Promise<void> {
+  if (process.platform === "win32") return;
+  const stats = await fs.stat(path);
+  expect(stats.mode & 0o777).toBe(0o600);
+}
+
+function makeErrnoError(message: string, code: string): NodeJS.ErrnoException {
+  const error = new Error(message) as NodeJS.ErrnoException;
+  error.code = code;
+  return error;
+}
+
+function makeLockPayload(token: string): string {
+  return `${JSON.stringify({
+    pid: process.pid,
+    token,
+    acquiredAt: Date.now(),
+  })}\n`;
+}
+
 describe("plugin config save paths", () => {
   let tempDir = "";
   const envKeys = [
@@ -91,6 +111,73 @@ describe("plugin config save paths", () => {
     expect(parsed.unsupportedCodexFallbackChain).toEqual({
       "gpt-5": ["gpt-4o"],
     });
+    await expectSecureFileMode(configPath);
+  });
+
+  it("retries transient env-path read locks before merge save to prevent key loss", async () => {
+    const configPath = join(tempDir, "plugin-config.json");
+    process.env.CODEX_MULTI_AUTH_CONFIG_PATH = configPath;
+    await fs.writeFile(
+      configPath,
+      JSON.stringify({
+        codexMode: true,
+        preserved: { nested: true },
+      }),
+      "utf8",
+    );
+
+    vi.resetModules();
+    const logWarnMock = vi.fn();
+    let transientReadFailures = 0;
+
+    vi.doMock("node:fs", async () => {
+      const actual = await vi.importActual<typeof import("node:fs")>("node:fs");
+      return {
+        ...actual,
+        readFileSync: vi.fn((...args: Parameters<typeof actual.readFileSync>) => {
+          const [filePath] = args;
+          if (
+            typeof filePath === "string" &&
+            filePath === configPath &&
+            transientReadFailures < 2
+          ) {
+            transientReadFailures += 1;
+            const code = transientReadFailures === 1 ? "EBUSY" : "EPERM";
+            throw Object.assign(new Error(`Transient ${code}`), { code });
+          }
+          return actual.readFileSync(...args);
+        }),
+      };
+    });
+    vi.doMock("../lib/logger.js", async () => {
+      const actual = await vi.importActual<typeof import("../lib/logger.js")>(
+        "../lib/logger.js",
+      );
+      return {
+        ...actual,
+        logWarn: logWarnMock,
+      };
+    });
+
+    try {
+      const { savePluginConfig } = await import("../lib/config.js");
+      await savePluginConfig({ codexTuiV2: false });
+    } finally {
+      vi.doUnmock("node:fs");
+      vi.doUnmock("../lib/logger.js");
+    }
+
+    const parsed = JSON.parse(await fs.readFile(configPath, "utf8")) as Record<
+      string,
+      unknown
+    >;
+    expect(parsed.codexMode).toBe(true);
+    expect(parsed.preserved).toEqual({ nested: true });
+    expect(parsed.codexTuiV2).toBe(false);
+    const failedReadWarnings = logWarnMock.mock.calls.filter(([message]) =>
+      String(message).includes("Failed to read config from"),
+    );
+    expect(failedReadWarnings).toHaveLength(0);
   });
 
   it("recovers from malformed env-path JSON before saving", async () => {
@@ -109,6 +196,343 @@ describe("plugin config save paths", () => {
     expect(parsed.fastSession).toBe(true);
   });
 
+  it("retries transient read contention before saving env-path config", async () => {
+    const configPath = join(tempDir, "plugin-config.json");
+    process.env.CODEX_MULTI_AUTH_CONFIG_PATH = configPath;
+    await fs.writeFile(configPath, JSON.stringify({ codexMode: true }), "utf8");
+
+    const originalReadFile = fs.readFile.bind(fs);
+    let busyFailures = 0;
+    const readSpy = vi.spyOn(fs, "readFile");
+    readSpy.mockImplementation(async (...args) => {
+      const target = args[0];
+      const path = typeof target === "string" ? target : String(target);
+      if (path === configPath && busyFailures < 2) {
+        busyFailures += 1;
+        throw makeErrnoError("busy", "EBUSY");
+      }
+      return originalReadFile(...(args as Parameters<typeof fs.readFile>));
+    });
+
+    const { savePluginConfig } = await import("../lib/config.js");
+    try {
+      await savePluginConfig({ codexMode: false, retries: 3 });
+    } finally {
+      readSpy.mockRestore();
+    }
+
+    const parsed = JSON.parse(await fs.readFile(configPath, "utf8")) as Record<
+      string,
+      unknown
+    >;
+    expect(parsed.codexMode).toBe(false);
+    expect(parsed.retries).toBe(3);
+    expect(busyFailures).toBe(2);
+  });
+
+  it("recovers from exists-then-delete ENOENT race before saving env-path config", async () => {
+    const configPath = join(tempDir, "plugin-config.json");
+    process.env.CODEX_MULTI_AUTH_CONFIG_PATH = configPath;
+    await fs.writeFile(configPath, JSON.stringify({ codexMode: true }), "utf8");
+
+    const originalReadFile = fs.readFile.bind(fs);
+    let noentFailures = 0;
+    const readSpy = vi.spyOn(fs, "readFile");
+    readSpy.mockImplementation(async (...args) => {
+      const target = args[0];
+      const path = typeof target === "string" ? target : String(target);
+      if (path === configPath && noentFailures === 0) {
+        noentFailures += 1;
+        throw makeErrnoError("noent", "ENOENT");
+      }
+      return originalReadFile(...(args as Parameters<typeof fs.readFile>));
+    });
+
+    const { savePluginConfig } = await import("../lib/config.js");
+    try {
+      await savePluginConfig({ codexMode: false, retries: 3 });
+    } finally {
+      readSpy.mockRestore();
+    }
+
+    const parsed = JSON.parse(await fs.readFile(configPath, "utf8")) as Record<
+      string,
+      unknown
+    >;
+    expect(parsed.codexMode).toBe(false);
+    expect(parsed.retries).toBe(3);
+    expect(noentFailures).toBe(1);
+  });
+
+  it("retries optimistic config conflicts and eventually succeeds", async () => {
+    const configPath = join(tempDir, "plugin-config.json");
+    process.env.CODEX_MULTI_AUTH_CONFIG_PATH = configPath;
+    await fs.writeFile(configPath, JSON.stringify({ seed: "a" }), "utf8");
+
+    const originalReadFile = fs.readFile.bind(fs);
+    let configReadCount = 0;
+    const readSpy = vi.spyOn(fs, "readFile");
+    readSpy.mockImplementation(async (...args) => {
+      const target = args[0];
+      const path = typeof target === "string" ? target : String(target);
+      if (path === configPath) {
+        configReadCount += 1;
+        if (configReadCount === 2) return JSON.stringify({ seed: "b" });
+        if (configReadCount === 3) return JSON.stringify({ seed: "b" });
+        if (configReadCount === 4) return JSON.stringify({ seed: "c" });
+        if (configReadCount === 5) return JSON.stringify({ seed: "c" });
+        if (configReadCount === 6) return JSON.stringify({ seed: "c" });
+      }
+      return originalReadFile(...(args as Parameters<typeof fs.readFile>));
+    });
+
+    const { savePluginConfig } = await import("../lib/config.js");
+    try {
+      await savePluginConfig({ codexMode: false });
+    } finally {
+      readSpy.mockRestore();
+    }
+
+    const parsed = JSON.parse(await fs.readFile(configPath, "utf8")) as Record<
+      string,
+      unknown
+    >;
+    expect(parsed.seed).toBe("c");
+    expect(parsed.codexMode).toBe(false);
+    expect(configReadCount).toBeGreaterThanOrEqual(6);
+  });
+
+  it("throws after exhausting optimistic config conflict retries", async () => {
+    const configPath = join(tempDir, "plugin-config.json");
+    process.env.CODEX_MULTI_AUTH_CONFIG_PATH = configPath;
+    await fs.writeFile(configPath, JSON.stringify({ seed: "a" }), "utf8");
+
+    const originalReadFile = fs.readFile.bind(fs);
+    let configReadCount = 0;
+    const readSpy = vi.spyOn(fs, "readFile");
+    readSpy.mockImplementation(async (...args) => {
+      const target = args[0];
+      const path = typeof target === "string" ? target : String(target);
+      if (path === configPath) {
+        configReadCount += 1;
+        if (configReadCount === 2) return JSON.stringify({ seed: "b" });
+        if (configReadCount === 3) return JSON.stringify({ seed: "b" });
+        if (configReadCount === 4) return JSON.stringify({ seed: "c" });
+        if (configReadCount === 5) return JSON.stringify({ seed: "c" });
+        if (configReadCount >= 6) return JSON.stringify({ seed: "d" });
+      }
+      return originalReadFile(...(args as Parameters<typeof fs.readFile>));
+    });
+
+    const { savePluginConfig } = await import("../lib/config.js");
+    try {
+      await expect(savePluginConfig({ codexMode: false })).rejects.toMatchObject({
+        code: "ECONFLICT",
+      });
+    } finally {
+      readSpy.mockRestore();
+    }
+  });
+
+  it("handles mixed conflict and transient rename contention", async () => {
+    const configPath = join(tempDir, "plugin-config.json");
+    process.env.CODEX_MULTI_AUTH_CONFIG_PATH = configPath;
+    await fs.writeFile(configPath, JSON.stringify({ seed: "a" }), "utf8");
+
+    const originalReadFile = fs.readFile.bind(fs);
+    let configReadCount = 0;
+    const readSpy = vi.spyOn(fs, "readFile");
+    readSpy.mockImplementation(async (...args) => {
+      const target = args[0];
+      const path = typeof target === "string" ? target : String(target);
+      if (path === configPath) {
+        configReadCount += 1;
+        if (configReadCount === 2) return JSON.stringify({ seed: "b" });
+        if (configReadCount === 3) return JSON.stringify({ seed: "b" });
+        if (configReadCount >= 4) return JSON.stringify({ seed: "b" });
+      }
+      return originalReadFile(...(args as Parameters<typeof fs.readFile>));
+    });
+
+    const originalRename = fs.rename.bind(fs);
+    let renameAttempts = 0;
+    const renameSpy = vi.spyOn(fs, "rename");
+    renameSpy.mockImplementation(async (...args) => {
+      if (renameAttempts === 0) {
+        renameAttempts += 1;
+        throw makeErrnoError("busy rename", "EBUSY");
+      }
+      renameAttempts += 1;
+      return originalRename(...(args as Parameters<typeof fs.rename>));
+    });
+
+    const { savePluginConfig } = await import("../lib/config.js");
+    try {
+      await savePluginConfig({ codexMode: false, retries: 4 });
+    } finally {
+      readSpy.mockRestore();
+      renameSpy.mockRestore();
+    }
+
+    const parsed = JSON.parse(await fs.readFile(configPath, "utf8")) as Record<
+      string,
+      unknown
+    >;
+    expect(parsed.seed).toBe("b");
+    expect(parsed.codexMode).toBe(false);
+    expect(parsed.retries).toBe(4);
+    expect(renameAttempts).toBeGreaterThanOrEqual(2);
+  });
+
+  it("waits for lockfile release before persisting env-path config", async () => {
+    const configPath = join(tempDir, "plugin-config.json");
+    const lockPath = `${configPath}.lock`;
+    process.env.CODEX_MULTI_AUTH_CONFIG_PATH = configPath;
+    await fs.writeFile(configPath, JSON.stringify({ codexMode: true }), "utf8");
+    await fs.writeFile(lockPath, `${process.pid}\n`, "utf8");
+
+    const unlockPromise = (async () => {
+      await new Promise((resolve) => setTimeout(resolve, 75));
+      await fs.unlink(lockPath);
+    })();
+
+    const { savePluginConfig } = await import("../lib/config.js");
+    const startedAt = Date.now();
+    await savePluginConfig({ codexMode: false });
+    const elapsed = Date.now() - startedAt;
+    await unlockPromise;
+
+    const parsed = JSON.parse(await fs.readFile(configPath, "utf8")) as Record<
+      string,
+      unknown
+    >;
+    expect(parsed.codexMode).toBe(false);
+    expect(elapsed).toBeGreaterThanOrEqual(50);
+  });
+
+  it("does not fail successful saves when lock release throws", async () => {
+    const configPath = join(tempDir, "plugin-config.json");
+    const lockPath = `${configPath}.lock`;
+    process.env.CODEX_MULTI_AUTH_CONFIG_PATH = configPath;
+    await fs.writeFile(configPath, JSON.stringify({ codexMode: true }), "utf8");
+
+    const originalUnlink = fs.unlink.bind(fs);
+    let releaseFailureInjected = false;
+    const unlinkSpy = vi.spyOn(fs, "unlink").mockImplementation(async (...args) => {
+      const target = args[0];
+      const path =
+        typeof target === "string"
+          ? target
+          : target instanceof URL
+            ? target.pathname
+            : String(target);
+      if (path === lockPath) {
+        releaseFailureInjected = true;
+        throw makeErrnoError("release denied", "EACCES");
+      }
+      return originalUnlink(...(args as Parameters<typeof fs.unlink>));
+    });
+
+    const { savePluginConfig } = await import("../lib/config.js");
+    try {
+      await expect(savePluginConfig({ codexMode: false, retries: 9 })).resolves.toBeUndefined();
+    } finally {
+      unlinkSpy.mockRestore();
+    }
+
+    expect(releaseFailureInjected).toBe(true);
+    const parsed = JSON.parse(await fs.readFile(configPath, "utf8")) as Record<
+      string,
+      unknown
+    >;
+    expect(parsed.codexMode).toBe(false);
+    expect(parsed.retries).toBe(9);
+  });
+
+  it("fails closed when lockfile is never released before timeout", async () => {
+    const configPath = join(tempDir, "plugin-config.json");
+    const lockPath = `${configPath}.lock`;
+    process.env.CODEX_MULTI_AUTH_CONFIG_PATH = configPath;
+    await fs.writeFile(configPath, JSON.stringify({ codexMode: true }), "utf8");
+    await fs.writeFile(lockPath, makeLockPayload("stuck-owner"), "utf8");
+
+    const { savePluginConfig } = await import("../lib/config.js");
+    await expect(savePluginConfig({ codexMode: false })).rejects.toThrow(
+      "Timed out waiting for config save lock",
+    );
+
+    const parsed = JSON.parse(await fs.readFile(configPath, "utf8")) as Record<
+      string,
+      unknown
+    >;
+    expect(parsed.codexMode).toBe(true);
+  }, 15_000);
+
+  it("does not remove a lock file when lock ownership changes before release", async () => {
+    const configPath = join(tempDir, "plugin-config.json");
+    const lockPath = `${configPath}.lock`;
+    process.env.CODEX_MULTI_AUTH_CONFIG_PATH = configPath;
+    await fs.writeFile(configPath, JSON.stringify({ codexMode: true }), "utf8");
+
+    const originalRename = fs.rename.bind(fs);
+    let swappedOwnership = false;
+    const renameSpy = vi.spyOn(fs, "rename").mockImplementation(async (...args) => {
+      const result = await originalRename(...(args as Parameters<typeof fs.rename>));
+      const targetPath = args[1];
+      if (!swappedOwnership && typeof targetPath === "string" && targetPath === configPath) {
+        swappedOwnership = true;
+        await fs.writeFile(lockPath, makeLockPayload("replacement-owner"), "utf8");
+      }
+      return result;
+    });
+
+    const { savePluginConfig } = await import("../lib/config.js");
+    try {
+      await savePluginConfig({ codexMode: false });
+    } finally {
+      renameSpy.mockRestore();
+    }
+
+    expect(swappedOwnership).toBe(true);
+    await expect(fs.readFile(lockPath, "utf8")).resolves.toContain("replacement-owner");
+  });
+
+  it("does not evict stale lock when ownership changes during stale-check race", async () => {
+    const configPath = join(tempDir, "plugin-config.json");
+    const lockPath = `${configPath}.lock`;
+    process.env.CODEX_MULTI_AUTH_CONFIG_PATH = configPath;
+    await fs.writeFile(configPath, JSON.stringify({ codexMode: true }), "utf8");
+    await fs.writeFile(lockPath, makeLockPayload("stale-owner"), "utf8");
+    const staleTimestamp = new Date(Date.now() - 60_000);
+    await fs.utimes(lockPath, staleTimestamp, staleTimestamp);
+
+    const originalReadFile = fs.readFile.bind(fs);
+    let lockReadCount = 0;
+    const readSpy = vi.spyOn(fs, "readFile").mockImplementation(async (...args) => {
+      const target = args[0];
+      const path = typeof target === "string" ? target : String(target);
+      if (path === lockPath) {
+        lockReadCount += 1;
+        if (lockReadCount === 2) {
+          await fs.writeFile(lockPath, makeLockPayload("fresh-owner"), "utf8");
+          const now = new Date();
+          await fs.utimes(lockPath, now, now);
+        }
+      }
+      return originalReadFile(...(args as Parameters<typeof fs.readFile>));
+    });
+
+    const { savePluginConfig } = await import("../lib/config.js");
+    try {
+      await expect(savePluginConfig({ codexMode: false })).rejects.toThrow(
+        "Timed out waiting for config save lock",
+      );
+      await expect(fs.readFile(lockPath, "utf8")).resolves.toContain("fresh-owner");
+    } finally {
+      readSpy.mockRestore();
+    }
+  }, 15_000);
+
   it("cleans temp files when env-path rename target is invalid", async () => {
     const invalidTarget = join(tempDir, "config-target-dir");
     process.env.CODEX_MULTI_AUTH_CONFIG_PATH = invalidTarget;
@@ -132,13 +556,13 @@ describe("plugin config save paths", () => {
     await savePluginConfig({
       codexMode: false,
       parallelProbing: true,
-      parallelProbingMaxConcurrency: 7,
+      parallelProbingMaxConcurrency: 5,
     });
 
     const loaded = loadPluginConfig();
     expect(loaded.codexMode).toBe(false);
     expect(loaded.parallelProbing).toBe(true);
-    expect(loaded.parallelProbingMaxConcurrency).toBe(7);
+    expect(loaded.parallelProbingMaxConcurrency).toBe(5);
   });
 
   it("resolves parallel probing settings and clamps concurrency", async () => {
diff --git a/test/data-redaction.test.ts b/test/data-redaction.test.ts
new file mode 100644
index 000000000..521769f2c
--- /dev/null
+++ b/test/data-redaction.test.ts
@@ -0,0 +1,74 @@
+import { describe, expect, it } from "vitest";
+import { redactForExternalOutput } from "../lib/data-redaction.js";
+
+describe("data redaction", () => {
+	it("redacts sensitive keys recursively", () => {
+		const value = {
+			email: "person@example.com",
+			profile: {
+				accessToken: "abc",
+				refresh_token: "def",
+				nested: [{ accountId: "acct_123" }],
+			},
+		};
+
+		const redacted = redactForExternalOutput(value);
+		expect(redacted).toEqual({
+			email: "***REDACTED***",
+			profile: {
+				accessToken: "***REDACTED***",
+				refresh_token: "***REDACTED***",
+				nested: [{ accountId: "***REDACTED***" }],
+			},
+		});
+	});
+
+	it("keeps non-sensitive fields unchanged", () => {
+		const value = {
+			command: "report",
+			schemaVersion: 1,
+			summary: { ok: 1, warn: 0, error: 0 },
+		};
+		expect(redactForExternalOutput(value)).toEqual(value);
+	});
+
+	it("handles null/undefined and mixed arrays safely", () => {
+		const value = {
+			email: "person@example.com",
+			mixed: [1, "two", null, { accountId: "acct-123" }],
+			nested: {
+				accessToken: "secret",
+				nullable: null as null | string,
+				optional: undefined as undefined | string,
+			},
+		};
+		expect(redactForExternalOutput(value)).toEqual({
+			email: "***REDACTED***",
+			mixed: [1, "two", null, { accountId: "***REDACTED***" }],
+			nested: {
+				accessToken: "***REDACTED***",
+				nullable: null,
+				optional: undefined,
+			},
+		});
+	});
+
+	it("handles circular references without throwing", () => {
+		const cyclic: { email: string; self?: unknown; nested: { accessToken: string; parent?: unknown } } = {
+			email: "loop@example.com",
+			nested: { accessToken: "tok" },
+		};
+		cyclic.self = cyclic;
+		cyclic.nested.parent = cyclic;
+
+		const redacted = redactForExternalOutput(cyclic) as {
+			email: string;
+			self: string;
+			nested: { accessToken: string; parent: string };
+		};
+		expect(redacted.email).toBe("***REDACTED***");
+		expect(redacted.nested.accessToken).toBe("***REDACTED***");
+		expect(redacted.self).toBe("[Circular]");
+		expect(redacted.nested.parent).toBe("[Circular]");
+	});
+});
diff --git a/test/data-retention.test.ts b/test/data-retention.test.ts
new file mode 100644
index 000000000..1c95a1065
--- /dev/null
+++ b/test/data-retention.test.ts
@@ -0,0 +1,295 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { promises as fs } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import type { RetentionPolicy } from "../lib/data-retention.js";
+import { removeWithRetry } from "./helpers/remove-with-retry.js";
+
+describe("data retention", () => {
+	let tempDir: string;
+	let originalDir: string | undefined;
+
+	beforeEach(async () => {
+		originalDir = process.env.CODEX_MULTI_AUTH_DIR;
+		tempDir = await fs.mkdtemp(join(tmpdir(), "codex-retention-"));
+		process.env.CODEX_MULTI_AUTH_DIR = tempDir;
+		vi.resetModules();
+	});
+
+	afterEach(async () => {
+		if (originalDir === undefined) {
+			delete process.env.CODEX_MULTI_AUTH_DIR;
+		} else {
+			process.env.CODEX_MULTI_AUTH_DIR = originalDir;
+		}
+		await removeWithRetry(tempDir, { recursive: true, force: true });
+	});
+
+	it("prunes stale log/cache/state files", async () => {
+		const { enforceDataRetention } = await import("../lib/data-retention.js");
+		const oldDate = new Date(Date.now() - 3 * 24 * 60 * 60_000);
+
+		const logsDir = join(tempDir, "logs");
+		const cacheDir = join(tempDir, "cache");
+		const nestedLogDir = join(logsDir, "nested");
+		await fs.mkdir(nestedLogDir, { recursive: true });
+		await fs.mkdir(cacheDir, { recursive: true });
+
+		const oldLog = join(nestedLogDir, "old.log");
+		const freshLog = join(logsDir, "fresh.log");
+		const oldCache = join(cacheDir, "old.cache");
+		const freshCache = join(cacheDir, "fresh.cache");
+		const flagged = join(tempDir, "openai-codex-flagged-accounts.json");
+		const quota = join(tempDir, "quota-cache.json");
+		const dlq = join(tempDir, "background-job-dlq.jsonl");
+
+		await fs.writeFile(oldLog, "old", "utf8");
+		await fs.writeFile(freshLog, "fresh", "utf8");
+		await fs.writeFile(oldCache, "old", "utf8");
+		await fs.writeFile(freshCache, "fresh", "utf8");
+		await fs.writeFile(flagged, "{}", "utf8");
+		await fs.writeFile(quota, "{}", "utf8");
+		await fs.writeFile(dlq, "{}", "utf8");
+
+		await fs.utimes(oldLog, oldDate, oldDate);
+		await fs.utimes(oldCache, oldDate, oldDate);
+		await fs.utimes(flagged, oldDate, oldDate);
+		await fs.utimes(quota, oldDate, oldDate);
+		await fs.utimes(dlq, oldDate, oldDate);
+
+		const policy: RetentionPolicy = {
+			logDays: 1,
+			cacheDays: 1,
+			flaggedDays: 1,
+			quotaCacheDays: 1,
+			dlqDays: 1,
+		};
+		const result = await enforceDataRetention(policy);
+
+		expect(result.removedLogs).toBeGreaterThanOrEqual(1);
+		expect(result.removedCacheFiles).toBeGreaterThanOrEqual(1);
+		expect(result.removedStateFiles).toBe(3);
+		await expect(fs.stat(oldLog)).rejects.toMatchObject({ code: "ENOENT" });
+		await expect(fs.stat(oldCache)).rejects.toMatchObject({ code: "ENOENT" });
+		await expect(fs.stat(flagged)).rejects.toMatchObject({ code: "ENOENT" });
+		await expect(fs.stat(quota)).rejects.toMatchObject({ code: "ENOENT" });
+		await expect(fs.stat(dlq)).rejects.toMatchObject({ code: "ENOENT" });
+		expect(await fs.readFile(freshLog, "utf8")).toBe("fresh");
+		expect(await fs.readFile(freshCache, "utf8")).toBe("fresh");
+	});
+
+	it("retries transient EBUSY during directory entry retention pruning", async () => {
+		const { enforceDataRetention } = await import("../lib/data-retention.js");
+		const oldDate = new Date(Date.now() - 3 * 24 * 60 * 60_000);
+		const logsDir = join(tempDir, "logs");
+		const nestedDir = join(logsDir, "nested");
+		const staleLog = join(nestedDir, "stale.log");
+
+		await fs.mkdir(nestedDir, { recursive: true });
+		await fs.writeFile(staleLog, "old", "utf8");
+		await fs.utimes(staleLog, oldDate, oldDate);
+
+		const originalStat = fs.stat.bind(fs);
+		const statSpy = vi.spyOn(fs, "stat");
+		let statBusyInjected = false;
+		statSpy.mockImplementation(async (path, options) => {
+			if (!statBusyInjected && path === staleLog) {
+				statBusyInjected = true;
+				const error = new Error("busy") as NodeJS.ErrnoException;
+				error.code = "EBUSY";
+				throw error;
+			}
+			return originalStat(path, options as { bigint?: boolean });
+		});
+
+		const originalRmdir = fs.rmdir.bind(fs);
+		const rmdirSpy = vi.spyOn(fs, "rmdir");
+		let rmdirBusyInjected = false;
+		rmdirSpy.mockImplementation(async (path) => {
+			if (!rmdirBusyInjected && path === nestedDir) {
+				rmdirBusyInjected = true;
+				const error = new Error("busy") as NodeJS.ErrnoException;
+				error.code = "EBUSY";
+				throw error;
+			}
+			return originalRmdir(path);
+		});
+
+		try {
+			const policy: RetentionPolicy = {
+				logDays: 1,
+				cacheDays: 90,
+				flaggedDays: 90,
+				quotaCacheDays: 90,
+				dlqDays: 90,
+			};
+			const result = await enforceDataRetention(policy);
+			expect(result.removedLogs).toBe(1);
+			expect(statBusyInjected).toBe(true);
+			expect(rmdirBusyInjected).toBe(true);
+			await expect(fs.stat(staleLog)).rejects.toMatchObject({ code: "ENOENT" });
+			await expect(fs.stat(nestedDir)).rejects.toMatchObject({ code: "ENOENT" });
+		} finally {
+			statSpy.mockRestore();
+			rmdirSpy.mockRestore();
+		}
+	});
+
+	it.each(["EPERM", "EACCES", "EAGAIN"] as const)(
+		"retries transient %s during directory entry retention pruning",
+		async (code) => {
+			const { enforceDataRetention } = await import("../lib/data-retention.js");
+			const oldDate = new Date(Date.now() - 3 * 24 * 60 * 60_000);
+			const logsDir = join(tempDir, "logs");
+			const nestedDir = join(logsDir, "nested");
+			const staleLog = join(nestedDir, "stale.log");
+
+			await fs.mkdir(nestedDir, { recursive: true });
+			await fs.writeFile(staleLog, "old", "utf8");
+			await fs.utimes(staleLog, oldDate, oldDate);
+
+			const originalStat = fs.stat.bind(fs);
+			const statSpy = vi.spyOn(fs, "stat");
+			let injected = false;
+			statSpy.mockImplementation(async (path, options) => {
+				if (!injected && path === staleLog) {
+					injected = true;
+					const error = new Error(code.toLowerCase()) as NodeJS.ErrnoException;
+					error.code = code;
+					throw error;
+				}
+				return originalStat(path, options as { bigint?: boolean });
+			});
+
+			try {
+				const policy: RetentionPolicy = {
+					logDays: 1,
+					cacheDays: 90,
+					flaggedDays: 90,
+					quotaCacheDays: 90,
+					dlqDays: 90,
+				};
+				const result = await enforceDataRetention(policy);
+				expect(result.removedLogs).toBe(1);
+				expect(injected).toBe(true);
+				await expect(fs.stat(staleLog)).rejects.toMatchObject({ code: "ENOENT" });
+			} finally {
+				statSpy.mockRestore();
+			}
+		},
+	);
+
+	it("throws after max retries for persistent EBUSY during directory entry pruning", async () => {
+		const { enforceDataRetention } = await import("../lib/data-retention.js");
+		const oldDate = new Date(Date.now() - 3 * 24 * 60 * 60_000);
+		const logsDir = join(tempDir, "logs");
+		const nestedDir = join(logsDir, "nested");
+		const staleLog = join(nestedDir, "stale.log");
+
+		await fs.mkdir(nestedDir, { recursive: true });
+		await fs.writeFile(staleLog, "old", "utf8");
+		await fs.utimes(staleLog, oldDate, oldDate);
+
+		const originalStat = fs.stat.bind(fs);
+		const statSpy = vi.spyOn(fs, "stat");
+		statSpy.mockImplementation(async (path, options) => {
+			if (path === staleLog) {
+				const error = new Error("busy") as NodeJS.ErrnoException;
+				error.code = "EBUSY";
+				throw error;
+			}
+			return originalStat(path, options as { bigint?: boolean });
+		});
+
+		try {
+			const policy: RetentionPolicy = {
+				logDays: 1,
+				cacheDays: 90,
+				flaggedDays: 90,
+				quotaCacheDays: 90,
+				dlqDays: 90,
+			};
+			await expect(enforceDataRetention(policy)).rejects.toMatchObject({ code: "EBUSY" });
+		} finally {
+			statSpy.mockRestore();
+		}
+	});
+
+	it("retries transient unlink failures during single-file retention pruning", async () => {
+		const { enforceDataRetention } = await import("../lib/data-retention.js");
+		const oldDate = new Date(Date.now() - 3 * 24 * 60 * 60_000);
+		const flagged = join(tempDir, "openai-codex-flagged-accounts.json");
+		await fs.writeFile(flagged, "{}", "utf8");
+		await fs.utimes(flagged, oldDate, oldDate);
+
+		const originalUnlink = fs.unlink.bind(fs);
+		const unlinkSpy = vi.spyOn(fs, "unlink");
+		let injected = false;
+		unlinkSpy.mockImplementation(async (path) => {
+			if (!injected && path === flagged) {
+				injected = true;
+				const error = new Error("access denied") as NodeJS.ErrnoException;
+				error.code = "EACCES";
+				throw error;
+			}
+			return originalUnlink(path);
+		});
+
+		try {
+			const policy: RetentionPolicy = {
+				logDays: 90,
+				cacheDays: 90,
+				flaggedDays: 1,
+				quotaCacheDays: 90,
+				dlqDays: 90,
+			};
+			const result = await enforceDataRetention(policy);
+			expect(result.removedStateFiles).toBe(1);
+			expect(injected).toBe(true);
+			await expect(fs.stat(flagged)).rejects.toMatchObject({ code: "ENOENT" });
+		} finally {
+			unlinkSpy.mockRestore();
+		}
+	});
+
+	it("treats ENOTEMPTY on directory cleanup as a non-fatal race", async () => {
+		const { enforceDataRetention } = await import("../lib/data-retention.js");
+		const oldDate = new Date(Date.now() - 3 * 24 * 60 * 60_000);
+		const logsDir = join(tempDir, "logs");
+		const nestedDir = join(logsDir, "nested");
+		const staleLog = join(nestedDir, "stale.log");
+
+		await fs.mkdir(nestedDir, { recursive: true });
+		await fs.writeFile(staleLog, "old", "utf8");
+		await fs.utimes(staleLog, oldDate, oldDate);
+
+		const originalRmdir = fs.rmdir.bind(fs);
+		const rmdirSpy = vi.spyOn(fs, "rmdir");
+		let enotemptyInjected = false;
+		rmdirSpy.mockImplementation(async (path) => {
+			if (!enotemptyInjected && path === nestedDir) {
+				enotemptyInjected = true;
+				const error = new Error("directory recreated") as NodeJS.ErrnoException;
+				error.code = "ENOTEMPTY";
+				throw error;
+			}
+			return originalRmdir(path);
+		});
+
+		try {
+			const policy: RetentionPolicy = {
+				logDays: 1,
+				cacheDays: 90,
+				flaggedDays: 90,
+				quotaCacheDays: 90,
+				dlqDays: 90,
+			};
+			const result = await enforceDataRetention(policy);
+			expect(result.removedLogs).toBe(1);
+			expect(enotemptyInjected).toBe(true);
+			await expect(fs.stat(staleLog)).rejects.toMatchObject({ code: "ENOENT" });
+		} finally {
+			rmdirSpy.mockRestore();
+		}
+	});
+});
diff --git a/test/documentation.test.ts b/test/documentation.test.ts
index 9c1b49f2c..8df4e6c2e 100644
--- a/test/documentation.test.ts
+++ b/test/documentation.test.ts
@@ -254,6 +254,18 @@ describe('Documentation Integrity', () => {
     expect(changelog).not.toContain('## [4.');
   });
 
+  it('keeps verify script contract aligned across package scripts and CI wiring', () => {
+    const pkg = JSON.parse(read('package.json')) as { scripts?: Record<string, string> };
+    const scripts = pkg.scripts ?? {};
+
+    expect(scripts['verify']).toBe('npm run lint && npm run verify:repo && npm run verify:quality');
+    expect(scripts['verify:repo']).toBe(
+      'npm run clean:repo:check && npm run audit:ci && npm run test -- test/lockfile-version-floor.test.ts',
+    );
+    expect(scripts['verify:quality']).toBe('npm run typecheck && npm run coverage');
+    expect(scripts['verify:ci']).toBe('npm run verify:repo && npm run verify:quality');
+  });
+
   it('keeps legacy pre-0.1 archive headings in descending semver order', () => {
     const archive = read('docs/releases/legacy-pre-0.1-history.md');
     const versions = [...archive.matchAll(/^## \[(\d+\.\d+\.\d+)\] - /gm)].map((match) => match[1]);
@@ -325,6 +337,8 @@ describe('Documentation Integrity', () => {
 
     const prBody = read(prTemplate);
     expect(prBody).toContain('npm run lint');
+    expect(prBody).toContain('npm run verify:repo');
+    expect(prBody).toContain('npm run verify:quality');
     expect(prBody).toContain('npm run typecheck');
     expect(prBody).toContain('npm test');
     expect(prBody).toContain('npm test -- test/documentation.test.ts');
@@ -339,6 +353,8 @@ describe('Documentation Integrity', () => {
     expect(contributing).toContain('pull request process');
     expect(contributing).toContain('npm run typecheck');
     expect(contributing).toContain('npm run lint');
+    expect(contributing).toContain('npm run verify:repo');
+    expect(contributing).toContain('npm run verify:quality');
     expect(contributing).toContain('npm test');
     expect(contributing).toContain('npm run build');
   });
diff --git a/test/enterprise-health-check.test.ts b/test/enterprise-health-check.test.ts
new file mode 100644
index 000000000..160fb46d3
--- /dev/null
+++ b/test/enterprise-health-check.test.ts
@@ -0,0 +1,162 @@
+import { afterEach, describe, expect, it } from "vitest";
+import { mkdtempSync } from "node:fs";
+import { promises as fs } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import process from "node:process";
+import { spawnSync } from "node:child_process";
+import { removeWithRetry } from "./helpers/remove-with-retry.js";
+
+const scriptPath = path.resolve(process.cwd(), "scripts", "enterprise-health-check.js");
+
+function runHealthCheck(args: string[], env: NodeJS.ProcessEnv = {}) {
+	return spawnSync(process.execPath, [scriptPath, ...args], {
+		encoding: "utf8",
+		env: { ...process.env, ...env },
+	});
+}
+
+function parseJsonStdout(output: string): Record<string, unknown> {
+	return JSON.parse(output) as Record<string, unknown>;
+}
+
+function pathsEqual(left: string, right: string): boolean {
+	const normalizedLeft = process.platform === "win32" ? left.replaceAll("/", "\\").toLowerCase() : left;
+	const normalizedRight = process.platform === "win32" ? right.replaceAll("/", "\\").toLowerCase() : right;
+	return normalizedLeft === normalizedRight;
+}
+
+describe("enterprise-health-check script", () => {
+	const fixtures: string[] = [];
+
+	afterEach(async () => {
+		while (fixtures.length > 0) {
+			const fixture = fixtures.pop();
+			if (!fixture) continue;
+			await removeWithRetry(fixture);
+		}
+	});
+
+	it("fails require-files mode when runtime artifacts are missing", () => {
+		const root = mkdtempSync(path.join(tmpdir(), "health-check-missing-"));
+		fixtures.push(root);
+
+		const result = runHealthCheck(["--require-files", `--root=${root}`]);
+		expect(result.status).toBe(1);
+		expect(result.stdout).not.toBe("");
+
+		const payload = parseJsonStdout(result.stdout);
+		expect(payload.status).toBe("fail");
+		const findings = Array.isArray(payload.findings) ? payload.findings : [];
+		expect(findings.some((finding) => (finding as { code?: string }).code === "missing-storage-file")).toBe(
+			true,
+		);
+		expect(findings.some((finding) => (finding as { code?: string }).code === "missing-audit-events")).toBe(
+			true,
+		);
+	});
+
+	it("resolves fallback multi-auth root for audit checks when account storage exists there", async () => {
+		const homeRoot = mkdtempSync(path.join(tmpdir(), "health-check-home-"));
+		fixtures.push(homeRoot);
+
+		const primaryRoot = path.join(homeRoot, ".codex", "multi-auth");
+		const fallbackRoot = path.join(homeRoot, "DevTools", "config", "codex", "multi-auth");
+		await fs.mkdir(path.join(primaryRoot), { recursive: true });
+		await fs.mkdir(path.join(fallbackRoot, "logs"), { recursive: true });
+		await fs.writeFile(
+			path.join(fallbackRoot, "openai-codex-accounts.json"),
+			'{"version":3,"accounts":[],"activeIndex":0}\n',
+			"utf8",
+		);
+		await fs.writeFile(
+			path.join(fallbackRoot, "settings.json"),
+			'{"version":1,"pluginConfig":{},"dashboardDisplaySettings":{}}\n',
+			"utf8",
+		);
+		await fs.writeFile(path.join(fallbackRoot, "logs", "audit.log"), '{"timestamp":"2026-03-01T00:00:00Z"}\n');
+
+		const result = runHealthCheck([], {
+			HOME: homeRoot,
+			USERPROFILE: homeRoot,
+			CODEX_HOME: "",
+			CODEX_MULTI_AUTH_DIR: "",
+		});
+		expect(result.status).toBe(0);
+
+		const payload = parseJsonStdout(result.stdout);
+		const payloadRoot = String(payload.root ?? "");
+		if (process.platform === "win32") {
+			expect(payloadRoot.toLowerCase()).toBe(fallbackRoot.toLowerCase());
+		} else {
+			expect(payloadRoot).toBe(fallbackRoot);
+		}
+		expect(pathsEqual(String(payload.auditDir), path.join(fallbackRoot, "logs"))).toBe(true);
+		expect(payload.status).toBe("pass");
+	});
+
+	it("evaluates stale audit checks from fallback audit directory", async () => {
+		const homeRoot = mkdtempSync(path.join(tmpdir(), "health-check-stale-fallback-"));
+		fixtures.push(homeRoot);
+
+		const fallbackRoot = path.join(homeRoot, "DevTools", "config", "codex", "multi-auth");
+		const fallbackAuditDir = path.join(fallbackRoot, "logs");
+		await fs.mkdir(fallbackAuditDir, { recursive: true });
+		await fs.writeFile(
+			path.join(fallbackRoot, "openai-codex-accounts.json"),
+			'{"version":3,"accounts":[],"activeIndex":0}\n',
+			"utf8",
+		);
+		await fs.writeFile(
+			path.join(fallbackRoot, "settings.json"),
+			'{"version":1,"pluginConfig":{},"dashboardDisplaySettings":{}}\n',
+			"utf8",
+		);
+
+		const staleAuditPath = path.join(fallbackAuditDir, "audit.log");
+		await fs.writeFile(staleAuditPath, '{"timestamp":"2025-01-01T00:00:00Z"}\n', "utf8");
+		const staleMtimeMs = Date.now() - 9 * 24 * 60 * 60 * 1000;
+		const staleDate = new Date(staleMtimeMs);
+		await fs.utimes(staleAuditPath, staleDate, staleDate);
+
+		const result = runHealthCheck([], {
+			HOME: homeRoot,
+			USERPROFILE: homeRoot,
+			CODEX_HOME: "",
+			CODEX_MULTI_AUTH_DIR: "",
+		});
+
+		expect(result.status).toBe(0);
+		const payload = parseJsonStdout(result.stdout);
+		expect(pathsEqual(String(payload.auditDir), fallbackAuditDir)).toBe(true);
+
+		const findings = Array.isArray(payload.findings) ? payload.findings : [];
+		const staleAuditFinding = findings.find((entry) => (entry as { code?: string }).code === "stale-audit-log") as
+			| { path?: string }
+			| undefined;
+		expect(staleAuditFinding).toBeDefined();
+		expect(pathsEqual(String(staleAuditFinding?.path ?? ""), fallbackAuditDir)).toBe(true);
+	});
+
+	it("treats audit directory churn (ENOTDIR) as no-audit-data instead of throwing", async () => {
+		const root = mkdtempSync(path.join(tmpdir(), "health-check-churn-"));
+		fixtures.push(root);
+		const auditPath = path.join(root, "logs");
+		await fs.writeFile(auditPath, "not-a-directory", "utf8");
+
+		const result = runHealthCheck([], {
+			CODEX_MULTI_AUTH_DIR: root,
+		});
+
+		expect(result.status).toBe(0);
+		const payload = parseJsonStdout(result.stdout);
+		expect(pathsEqual(String(payload.auditDir), auditPath)).toBe(true);
+		const checks = Array.isArray(payload.checks)
+			? payload.checks
+			: [];
+		const newestAuditCheck = checks.find((entry) => (entry as { name?: string }).name === "newest-audit-mtime-ms") as
+			| { value?: unknown }
+			| undefined;
+		expect(newestAuditCheck?.value ?? null).toBeNull();
+	});
+});
diff --git a/test/fetch-helpers.test.ts b/test/fetch-helpers.test.ts
index d0c03473d..66bc82316 100644
--- a/test/fetch-helpers.test.ts
+++ b/test/fetch-helpers.test.ts
@@ -238,6 +238,30 @@ describe('Fetch Helpers Module', () => {
 			expect(headers.get(OPENAI_HEADERS.SESSION_ID)).toBeNull();
 		});
 
+		it('sets trimmed idempotency key and clears blank values', () => {
+			const withValue = createCodexHeaders(undefined, accountId, accessToken, {
+				model: 'gpt-5',
+				idempotencyKey: '  request-123  ',
+			});
+			expect(withValue.get('Idempotency-Key')).toBe('request-123');
+
+			const withWhitespace = createCodexHeaders(
+				{ headers: { 'Idempotency-Key': 'old-value' } } as RequestInit,
+				accountId,
+				accessToken,
+				{ model: 'gpt-5', idempotencyKey: '   ' },
+			);
+			expect(withWhitespace.get('Idempotency-Key')).toBeNull();
+
+			const withUndefined = createCodexHeaders(
+				{ headers: { 'Idempotency-Key': 'old-value' } } as RequestInit,
+				accountId,
+				accessToken,
+				{ model: 'gpt-5' },
+			);
+			expect(withUndefined.get('Idempotency-Key')).toBeNull();
+		});
+
 		it('supports named-parameter options form', () => {
 			const positional = createCodexHeaders(undefined, accountId, accessToken, {
 				model: 'gpt-5',
@@ -261,6 +285,35 @@ describe('Fetch Helpers Module', () => {
 			expect(named.has('x-api-key')).toBe(false);
 		});
 
+		it('applies idempotency-key behavior consistently for named and positional forms', () => {
+			const positional = createCodexHeaders(undefined, accountId, accessToken, {
+				model: 'gpt-5',
+				idempotencyKey: ' idem-1 ',
+			});
+			const named = createCodexHeaders({
+				init: undefined,
+				accountId,
+				accessToken,
+				opts: { model: 'gpt-5', idempotencyKey: ' idem-1 ' },
+			});
+			expect(named.get('Idempotency-Key')).toBe(positional.get('Idempotency-Key'));
+
+			const positionalBlank = createCodexHeaders(
+				{ headers: { 'Idempotency-Key': 'legacy-key' } } as RequestInit,
+				accountId,
+				accessToken,
+				{ model: 'gpt-5', idempotencyKey: '   ' },
+			);
+			const namedBlank = createCodexHeaders({
+				init: { headers: { 'Idempotency-Key': 'legacy-key' } } as RequestInit,
+				accountId,
+				accessToken,
+				opts: { model: 'gpt-5', idempotencyKey: '   ' },
+			});
+			expect(positionalBlank.get('Idempotency-Key')).toBeNull();
+			expect(namedBlank.get('Idempotency-Key')).toBeNull();
+		});
+
 		it('does not treat RequestInit-like objects as named params when keys are spread accidentally', () => {
 			const accidentalRequestInit = {
 				headers: { 'content-type': 'application/json' },
diff --git a/test/file-lock-fd-leak.test.ts b/test/file-lock-fd-leak.test.ts
new file mode 100644
index 000000000..a19533181
--- /dev/null
+++ b/test/file-lock-fd-leak.test.ts
@@ -0,0 +1,75 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+describe("file-lock descriptor safety", () => {
+	beforeEach(() => {
+		vi.resetModules();
+	});
+
+	afterEach(() => {
+		vi.doUnmock("node:fs");
+		vi.restoreAllMocks();
+	});
+
+	it("closes async file handles when metadata write fails", async () => {
+		const close = vi.fn(async () => {});
+		const writeFile = vi.fn(async () => {
+			throw new Error("disk full");
+		});
+		vi.doMock("node:fs", () => ({
+			promises: {
+				open: vi.fn(async () => ({ writeFile, close })),
+				stat: vi.fn(),
+				unlink: vi.fn(),
+				readFile: vi.fn(),
+			},
+			openSync: vi.fn(),
+			writeFileSync: vi.fn(),
+			closeSync: vi.fn(),
+			readFileSync: vi.fn(),
+			unlinkSync: vi.fn(),
+			statSync: vi.fn(),
+		}));
+
+		const { acquireFileLock } = await import("../lib/file-lock.js");
+		await expect(
+			acquireFileLock("/tmp/mock.lock", {
+				maxAttempts: 1,
+				baseDelayMs: 1,
+				maxDelayMs: 2,
+				staleAfterMs: 1_000,
+			}),
+		).rejects.toThrow("disk full");
+		expect(close).toHaveBeenCalledTimes(1);
+	});
+
+	it("closes sync file descriptors when metadata write fails", async () => {
+		const closeSync = vi.fn();
+		vi.doMock("node:fs", () => ({
+			promises: {
+				open: vi.fn(),
+				stat: vi.fn(),
+				unlink: vi.fn(),
+				readFile: vi.fn(),
+			},
+			openSync: vi.fn(() => 42),
+			writeFileSync: vi.fn(() => {
+				throw new Error("write failed");
+			}),
+			closeSync,
+			readFileSync: vi.fn(),
+			unlinkSync: vi.fn(),
+			statSync: vi.fn(),
+		}));
+
+		const { acquireFileLockSync } = await import("../lib/file-lock.js");
+		expect(() =>
+			acquireFileLockSync("/tmp/mock.lock", {
+				maxAttempts: 1,
+				baseDelayMs: 1,
+				maxDelayMs: 2,
+				staleAfterMs: 1_000,
+			}),
+		).toThrow("write failed");
+		expect(closeSync).toHaveBeenCalledTimes(1);
+	});
+});
diff --git a/test/file-lock.test.ts b/test/file-lock.test.ts
new file mode 100644
index 000000000..f8633a68a
--- /dev/null
+++ b/test/file-lock.test.ts
@@ -0,0 +1,283 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { promises as fs } from "node:fs";
+import { spawn } from "node:child_process";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { pathToFileURL } from "node:url";
+import { acquireFileLock } from "../lib/file-lock.js";
+import { removeWithRetry } from "./helpers/remove-with-retry.js";
+
+describe("file lock", () => {
+	let tempDir: string;
+
+	beforeEach(async () => {
+		tempDir = await fs.mkdtemp(join(tmpdir(), "codex-file-lock-"));
+	});
+
+	afterEach(async () => {
+		await removeWithRetry(tempDir, { recursive: true, force: true });
+	});
+
+	it("blocks concurrent lock acquisition until released", async () => {
+		const lockPath = join(tempDir, "settings.lock");
+		const first = await acquireFileLock(lockPath, {
+			maxAttempts: 5,
+			baseDelayMs: 1,
+			maxDelayMs: 2,
+			staleAfterMs: 10_000,
+		});
+
+		await expect(
+			acquireFileLock(lockPath, {
+				maxAttempts: 2,
+				baseDelayMs: 1,
+				maxDelayMs: 2,
+				staleAfterMs: 10_000,
+			}),
+		).rejects.toBeTruthy();
+
+		await first.release();
+		const second = await acquireFileLock(lockPath, {
+			maxAttempts: 2,
+			baseDelayMs: 1,
+			maxDelayMs: 2,
+			staleAfterMs: 10_000,
+		});
+		await second.release();
+	});
+
+	it("evicts stale lock files", async () => {
+		const lockPath = join(tempDir, "quota.lock");
+		await fs.writeFile(lockPath, "stale", "utf8");
+		const staleDate = new Date(Date.now() - 60_000);
+		await fs.utimes(lockPath, staleDate, staleDate);
+
+		const lock = await acquireFileLock(lockPath, {
+			maxAttempts: 3,
+			baseDelayMs: 1,
+			maxDelayMs: 2,
+			staleAfterMs: 1_000,
+		});
+		await lock.release();
+	});
+
+	it("serializes concurrent writes from multiple processes under contention", async () => {
+		const lockPath = join(tempDir, "contention.lock");
+		const sharedFilePath = join(tempDir, "shared.txt");
+		const workerScriptPath = join(tempDir, "lock-writer-worker.mjs");
+		const transpiledModulePath = join(tempDir, "file-lock-worker-module.mjs");
+		const ts = await import("typescript");
+		const sourcePath = join(process.cwd(), "lib", "file-lock.ts");
+		const source = await fs.readFile(sourcePath, "utf8");
+		const transpiled = ts.transpileModule(source, {
+			compilerOptions: {
+				module: ts.ModuleKind.ESNext,
+				target: ts.ScriptTarget.ES2022,
+			},
+		}).outputText;
+		await fs.writeFile(transpiledModulePath, transpiled, "utf8");
+		const moduleUrl = pathToFileURL(transpiledModulePath).href;
+		const workerCount = 6;
+		const iterationsPerWorker = 50;
+		await fs.writeFile(sharedFilePath, "", "utf8");
+		await fs.writeFile(
+			workerScriptPath,
+			`import { promises as fs } from "node:fs";
+const [moduleUrl, lockPath, sharedFilePath, workerId, iterationsRaw] = process.argv.slice(2);
+const iterations = Number(iterationsRaw);
+const { acquireFileLock } = await import(moduleUrl);
+for (let i = 0; i < iterations; i += 1) {
+  const lock = await acquireFileLock(lockPath, {
+    maxAttempts: 500,
+    baseDelayMs: 1,
+    maxDelayMs: 8,
+    staleAfterMs: 10_000,
+  });
+  try {
+    const existing = await fs.readFile(sharedFilePath, "utf8");
+    await fs.writeFile(sharedFilePath, existing + workerId + ":" + i + "\\n", "utf8");
+  } finally {
+    await lock.release();
+  }
+}
+`,
+			"utf8",
+		);
+
+		const runWorker = (workerId: number): Promise<void> =>
+			new Promise((resolve, reject) => {
+				const child = spawn(
+					process.execPath,
+					[
+						workerScriptPath,
+						moduleUrl,
+						lockPath,
+						sharedFilePath,
+						String(workerId),
+						String(iterationsPerWorker),
+					],
+					{ stdio: ["ignore", "pipe", "pipe"] },
+				);
+				let stderr = "";
+				child.stderr.on("data", (chunk: Buffer) => {
+					stderr += chunk.toString("utf8");
+				});
+				child.on("error", reject);
+				child.on("exit", (code) => {
+					if (code === 0) {
+						resolve();
+						return;
+					}
+					reject(new Error(`worker ${workerId} exited with code ${code}: ${stderr}`));
+				});
+			});
+
+		await Promise.all(
+			Array.from({ length: workerCount }, (_, workerId) => runWorker(workerId)),
+		);
+
+		const lines = (await fs.readFile(sharedFilePath, "utf8"))
+			.trim()
+			.split("\n")
+			.filter((line) => line.length > 0);
+		expect(lines).toHaveLength(workerCount * iterationsPerWorker);
+		expect(new Set(lines).size).toBe(lines.length);
+	});
+
+	it.each(["EBUSY", "EPERM"] as const)(
+		"allows release retries after transient unlink failures (%s)",
+		async (transientCode) => {
+			const lockPath = join(tempDir, "release-retry.lock");
+			const lock = await acquireFileLock(lockPath, {
+				maxAttempts: 3,
+				baseDelayMs: 1,
+				maxDelayMs: 2,
+				staleAfterMs: 10_000,
+			});
+
+			const originalUnlink = fs.unlink.bind(fs);
+			const unlinkSpy = vi.spyOn(fs, "unlink");
+			let injectedBusy = false;
+			unlinkSpy.mockImplementation(async (path) => {
+				if (!injectedBusy && path === lockPath) {
+					injectedBusy = true;
+					const error = new Error("busy") as NodeJS.ErrnoException;
+					error.code = transientCode;
+					throw error;
+				}
+				return originalUnlink(path);
+			});
+
+			try {
+				await expect(lock.release()).rejects.toMatchObject({ code: transientCode });
+				await expect(lock.release()).resolves.toBeUndefined();
+				expect(injectedBusy).toBe(true);
+				await expect(fs.stat(lockPath)).rejects.toMatchObject({ code: "ENOENT" });
+			} finally {
+				unlinkSpy.mockRestore();
+			}
+		},
+	);
+
+	it("does not evict stale lock files when lock owner PID is still alive", async () => {
+		const lockPath = join(tempDir, "live-owner.lock");
+		await fs.writeFile(lockPath, `${JSON.stringify({ pid: process.pid, acquiredAt: Date.now() - 120_000 })}\n`, "utf8");
+		const staleDate = new Date(Date.now() - 120_000);
+		await fs.utimes(lockPath, staleDate, staleDate);
+
+		await expect(
+			acquireFileLock(lockPath, {
+				maxAttempts: 1,
+				baseDelayMs: 1,
+				maxDelayMs: 2,
+				staleAfterMs: 1_000,
+			}),
+		).rejects.toMatchObject({ code: "EEXIST" });
+		await expect(fs.stat(lockPath)).resolves.toBeTruthy();
+	});
+
+	it("cleans up lock files when metadata write fails", async () => {
+		const lockPath = join(tempDir, "incomplete.lock");
+		const originalOpen = fs.open.bind(fs);
+		type OpenFn = typeof fs.open;
+		type OpenHandle = Awaited<ReturnType<OpenFn>>;
+		const openSpy = vi.spyOn(fs, "open");
+		const mockOpen: OpenFn = (async (...args: Parameters<OpenFn>) => {
+			const [path] = args;
+			if (String(path) === lockPath) {
+				await fs.writeFile(lockPath, "partial", "utf8");
+				return {
+					writeFile: async () => {
+						const error = new Error("metadata write failed") as NodeJS.ErrnoException;
+						error.code = "EIO";
+						throw error;
+					},
+					close: async () => {},
+				} as unknown as OpenHandle;
+			}
+			return originalOpen(...args);
+		}) as OpenFn;
+		openSpy.mockImplementation(mockOpen);
+
+		try {
+			await expect(
+				acquireFileLock(lockPath, {
+					maxAttempts: 1,
+					baseDelayMs: 1,
+					maxDelayMs: 2,
+					staleAfterMs: 10_000,
+				}),
+			).rejects.toThrow("metadata write failed");
+			await expect(fs.stat(lockPath)).rejects.toMatchObject({ code: "ENOENT" });
+		} finally {
+			openSpy.mockRestore();
+		}
+	});
+
+	it("preserves metadata write failure when cleanup unlink also fails", async () => {
+		const lockPath = join(tempDir, "cleanup-error-precedence.lock");
+		const originalOpen = fs.open.bind(fs);
+		type OpenFn = typeof fs.open;
+		type OpenHandle = Awaited<ReturnType<OpenFn>>;
+		const openSpy = vi.spyOn(fs, "open");
+		const unlinkSpy = vi.spyOn(fs, "unlink");
+		const mockOpen: OpenFn = (async (...args: Parameters<OpenFn>) => {
+			const [path] = args;
+			if (String(path) === lockPath) {
+				await fs.writeFile(lockPath, "partial", "utf8");
+				return {
+					writeFile: async () => {
+						const error = new Error("metadata write failed") as NodeJS.ErrnoException;
+						error.code = "EIO";
+						throw error;
+					},
+					close: async () => {},
+				} as unknown as OpenHandle;
+			}
+			return originalOpen(...args);
+		}) as OpenFn;
+		openSpy.mockImplementation(mockOpen);
+		unlinkSpy.mockImplementation(async (path) => {
+			if (String(path) === lockPath) {
+				const error = new Error("cleanup failed") as NodeJS.ErrnoException;
+				error.code = "EPERM";
+				throw error;
+			}
+			return Promise.resolve();
+		});
+
+		try {
+			await expect(
+				acquireFileLock(lockPath, {
+					maxAttempts: 1,
+					baseDelayMs: 1,
+					maxDelayMs: 2,
+					staleAfterMs: 10_000,
+				}),
+			).rejects.toThrow("metadata write failed");
+		} finally {
+			openSpy.mockRestore();
+			unlinkSpy.mockRestore();
+		}
+	});
+});
diff --git a/test/generate-sbom.test.ts b/test/generate-sbom.test.ts
new file mode 100644
index 000000000..fffd877ef
--- /dev/null
+++ b/test/generate-sbom.test.ts
@@ -0,0 +1,85 @@
+import { afterEach, describe, expect, it } from "vitest";
+import { chmodSync, mkdtempSync, writeFileSync, mkdirSync } from "node:fs";
+import { promises as fs } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import process from "node:process";
+import { spawnSync } from "node:child_process";
+
+const scriptPath = path.resolve(process.cwd(), "scripts", "generate-sbom.js");
+
+async function removeWithRetry(targetPath: string): Promise<void> {
+	const retryableCodes = new Set(["EBUSY", "EPERM", "ENOTEMPTY"]);
+	for (let attempt = 0; attempt < 6; attempt += 1) {
+		try {
+			await fs.rm(targetPath, { recursive: true, force: true });
+			return;
+		} catch (error) {
+			const code = (error as NodeJS.ErrnoException).code;
+			if (code === "ENOENT") return;
+			if (!code || !retryableCodes.has(code) || attempt === 5) {
+				throw error;
+			}
+			await new Promise((resolve) => setTimeout(resolve, 25 * 2 ** attempt));
+		}
+	}
+}
+
+function createFakeNpmScript(root: string): string {
+	const binDir = path.join(root, "bin");
+	mkdirSync(binDir, { recursive: true });
+	const fakeNpmPath = path.join(binDir, "fake-npm.js");
+	const fakeNpmSource = `
+const args = process.argv.slice(2);
+if (args[0] === "sbom") {
+  process.stdout.write(JSON.stringify({ bomFormat: "CycloneDX", specVersion: "1.5", metadata: "x".repeat(1_500_000), components: [] }));
+  process.exit(0);
+}
+process.stdout.write("ok\\n");
+`.trimStart();
+	writeFileSync(fakeNpmPath, fakeNpmSource, "utf8");
+	if (process.platform !== "win32") {
+		chmodSync(fakeNpmPath, 0o755);
+	}
+	return fakeNpmPath;
+}
+
+describe("generate-sbom script", () => {
+	const fixtures: string[] = [];
+
+	afterEach(async () => {
+		while (fixtures.length > 0) {
+			const fixture = fixtures.pop();
+			if (!fixture) continue;
+			await removeWithRetry(fixture);
+		}
+	});
+
+	it("writes large sbom output without hitting child-process maxBuffer", async () => {
+		const root = mkdtempSync(path.join(tmpdir(), "generate-sbom-"));
+		fixtures.push(root);
+		const fakeNpmPath = createFakeNpmScript(root);
+
+		const result = spawnSync(process.execPath, [scriptPath], {
+			cwd: root,
+			encoding: "utf8",
+			env: {
+				...process.env,
+				npm_execpath: fakeNpmPath,
+				NPM_EXECPATH: fakeNpmPath,
+			},
+		});
+
+		expect(
+			result.status,
+			`stderr: ${result.stderr}\nstdout: ${String(result.stdout).slice(0, 200)}`,
+		).toBe(0);
+		const payload = JSON.parse(result.stdout) as { status?: string; outputPath?: string };
+		expect(payload.status).toBe("pass");
+
+		const sbomPath = path.join(root, ".tmp", "sbom.cdx.json");
+		const raw = await fs.readFile(sbomPath, "utf8");
+		expect(raw.length).toBeGreaterThan(1_000_000);
+		expect(() => JSON.parse(raw)).not.toThrow();
+	});
+});
diff --git a/test/helpers/remove-with-retry.ts b/test/helpers/remove-with-retry.ts
new file mode 100644
index 000000000..18d30c0f4
--- /dev/null
+++ b/test/helpers/remove-with-retry.ts
@@ -0,0 +1,22 @@
+import { promises as fs } from "node:fs";
+
+const RETRYABLE_REMOVE_CODES = new Set(["EBUSY", "EPERM", "ENOTEMPTY", "EACCES", "EAGAIN"]);
+
+export async function removeWithRetry(
+	targetPath: string,
+	options: { recursive?: boolean; force?: boolean } = { recursive: true, force: true },
+): Promise<void> {
+	for (let attempt = 0; attempt < 6; attempt += 1) {
+		try {
+			await fs.rm(targetPath, options);
+			return;
+		} catch (error) {
+			const code = (error as NodeJS.ErrnoException).code;
+			if (code === "ENOENT") return;
+			if (!code || !RETRYABLE_REMOVE_CODES.has(code) || attempt === 5) {
+				throw error;
+			}
+			await new Promise((resolve) => setTimeout(resolve, 25 * 2 ** attempt));
+		}
+	}
+}
diff --git a/test/host-codex-prompt.test.ts b/test/host-codex-prompt.test.ts
index 59e8c98cd..d47667000 100644
--- a/test/host-codex-prompt.test.ts
+++ b/test/host-codex-prompt.test.ts
@@ -212,6 +212,162 @@ describe("host-codex-prompt", () => {
       expect(writeFile).toHaveBeenCalledTimes(2);
     });
 
+    it("falls back to next source when first source times out", async () => {
+      const { getHostCodexPrompt } = await import("../lib/prompts/host-codex-prompt.js");
+
+      vi.mocked(readFile).mockRejectedValue(new Error("ENOENT"));
+      mockFetch
+        .mockRejectedValueOnce(Object.assign(new Error("request timeout"), { name: "AbortError" }))
+        .mockResolvedValueOnce({
+          ok: true,
+          status: 200,
+          text: () => Promise.resolve("Prompt from timeout fallback source"),
+          headers: new Map([["etag", '"fallback-timeout-etag"']]),
+        });
+
+      const result = await getHostCodexPrompt();
+
+      expect(result).toBe("Prompt from timeout fallback source");
+      expect(mockFetch).toHaveBeenCalledTimes(2);
+      expect(mockFetch.mock.calls[0]?.[0]).not.toBe(mockFetch.mock.calls[1]?.[0]);
+    });
+
+    it("times out first source after 15s and then falls back deterministically", async () => {
+      vi.useFakeTimers();
+      const { getHostCodexPrompt } = await import("../lib/prompts/host-codex-prompt.js");
+      vi.mocked(readFile).mockRejectedValue(new Error("ENOENT"));
+
+      mockFetch
+        .mockImplementationOnce((_url, init) => new Promise((_, reject) => {
+          const signal = (init as RequestInit | undefined)?.signal as AbortSignal | undefined;
+          signal?.addEventListener("abort", () => {
+            const reason = signal.reason;
+            if (reason instanceof Error) {
+              reject(reason);
+              return;
+            }
+            reject(Object.assign(new Error("request timeout"), { name: "AbortError" }));
+          }, { once: true });
+        }))
+        .mockResolvedValueOnce({
+          ok: true,
+          status: 200,
+          text: () => Promise.resolve("Prompt from timeout fallback source"),
+          headers: new Map([["etag", '"fallback-timeout-etag"']]),
+        });
+
+      try {
+        const resultPromise = getHostCodexPrompt();
+        await vi.advanceTimersByTimeAsync(15_100);
+        await expect(resultPromise).resolves.toBe("Prompt from timeout fallback source");
+        expect(mockFetch).toHaveBeenCalledTimes(2);
+      } finally {
+        vi.useRealTimers();
+      }
+    });
+
+    it("keeps stale-cache concurrent callers deterministic during timeout fallback refresh", async () => {
+      vi.useFakeTimers();
+      const { getHostCodexPrompt } = await import("../lib/prompts/host-codex-prompt.js");
+      vi.mocked(readFile).mockImplementation(async (filePath) => {
+        if (String(filePath).includes("host-codex-prompt-meta.json")) {
+          return JSON.stringify({
+            etag: '"old-etag"',
+            lastChecked: Date.now() - 20 * 60 * 1000,
+          });
+        }
+        return "Old cached content";
+      });
+
+      mockFetch
+        .mockImplementationOnce((_url, init) => new Promise((_, reject) => {
+          const signal = (init as RequestInit | undefined)?.signal as AbortSignal | undefined;
+          signal?.addEventListener("abort", () => {
+            const reason = signal.reason;
+            if (reason instanceof Error) {
+              reject(reason);
+              return;
+            }
+            reject(Object.assign(new Error("request timeout"), { name: "AbortError" }));
+          }, { once: true });
+        }))
+        .mockResolvedValueOnce({
+          ok: true,
+          status: 200,
+          text: () => Promise.resolve("Prompt from timeout fallback source"),
+          headers: new Map([["etag", '"fallback-timeout-etag"']]),
+        });
+
+      try {
+        const [first, second] = await Promise.all([getHostCodexPrompt(), getHostCodexPrompt()]);
+        expect(first).toBe("Old cached content");
+        expect(second).toBe("Old cached content");
+        await vi.advanceTimersByTimeAsync(15_100);
+        await vi.waitFor(() =>
+          expect(writeFile).toHaveBeenCalledWith(
+            expect.stringContaining("host-codex-prompt.txt"),
+            "Prompt from timeout fallback source",
+            "utf-8",
+          ),
+        );
+        expect(mockFetch).toHaveBeenCalledTimes(2);
+        await expect(getHostCodexPrompt()).resolves.toBe("Prompt from timeout fallback source");
+      } finally {
+        vi.useRealTimers();
+      }
+    });
+
+    it.each(["EBUSY", "EPERM"] as const)(
+      "retries timeout-fallback cache persistence when write fails transiently with %s",
+      async (errorCode) => {
+        vi.useFakeTimers();
+        const { getHostCodexPrompt } = await import("../lib/prompts/host-codex-prompt.js");
+        vi.mocked(readFile).mockRejectedValue(new Error("ENOENT"));
+
+        mockFetch
+          .mockImplementationOnce((_url, init) => new Promise((_, reject) => {
+            const signal = (init as RequestInit | undefined)?.signal as AbortSignal | undefined;
+            signal?.addEventListener("abort", () => {
+              reject(Object.assign(new Error("request timeout"), { name: "AbortError" }));
+            }, { once: true });
+          }))
+          .mockResolvedValueOnce({
+            ok: true,
+            status: 200,
+            text: () => Promise.resolve("Prompt from timeout fallback source"),
+            headers: new Map([["etag", '"fallback-timeout-etag"']]),
+          });
+
+        const originalWrite = vi.mocked(writeFile).getMockImplementation();
+        let transientWriteFailures = 0;
+        vi.mocked(writeFile).mockImplementation(async (...args) => {
+          const filePath = String(args[0]);
+          if (
+            filePath.includes("host-codex-prompt") &&
+            transientWriteFailures === 0
+          ) {
+            transientWriteFailures += 1;
+            throw Object.assign(new Error("busy"), { code: errorCode });
+          }
+          if (originalWrite) {
+            return originalWrite(...args);
+          }
+          return undefined;
+        });
+
+        try {
+          const resultPromise = getHostCodexPrompt();
+          await vi.advanceTimersByTimeAsync(15_100);
+          await expect(resultPromise).resolves.toBe("Prompt from timeout fallback source");
+          expect(transientWriteFailures).toBe(1);
+          expect(mockFetch).toHaveBeenCalledTimes(2);
+          expect(writeFile).toHaveBeenCalled();
+        } finally {
+          vi.useRealTimers();
+        }
+      },
+    );
+
     it("uses CODEX_CODEX_PROMPT_URL override before default sources", async () => {
       const { getHostCodexPrompt } = await import("../lib/prompts/host-codex-prompt.js");
 
@@ -324,6 +480,47 @@ describe("host-codex-prompt", () => {
       );
     });
 
+    it("deduplicates concurrent stale refresh while retrying a 429 source response", async () => {
+      const { getHostCodexPrompt } = await import("../lib/prompts/host-codex-prompt.js");
+      vi.spyOn(Math, "random").mockReturnValue(0);
+
+      const staleMeta = JSON.stringify({
+        etag: '"old-etag"',
+        lastChecked: Date.now() - 20 * 60 * 1000,
+      });
+      vi.mocked(readFile).mockImplementation(async (filePath) => {
+        if (String(filePath).includes("host-codex-prompt-meta.json")) {
+          return staleMeta;
+        }
+        return "Old cached content";
+      });
+
+      mockFetch
+        .mockResolvedValueOnce(new Response("rate limited", { status: 429 }))
+        .mockResolvedValueOnce(
+          new Response("Prompt after retry", {
+            status: 200,
+            headers: { etag: '"retry-etag"' },
+          }),
+        );
+
+      const [first, second] = await Promise.all([getHostCodexPrompt(), getHostCodexPrompt()]);
+      expect(first).toBe("Old cached content");
+      expect(second).toBe("Old cached content");
+
+      await vi.waitFor(() => expect(mockFetch).toHaveBeenCalledTimes(2));
+      await vi.waitFor(() =>
+        expect(writeFile).toHaveBeenCalledWith(
+          expect.stringContaining("host-codex-prompt.txt"),
+          "Prompt after retry",
+          "utf-8",
+        ),
+      );
+      await vi.waitFor(async () => {
+        await expect(getHostCodexPrompt()).resolves.toBe("Prompt after retry");
+      });
+    });
+
     it("falls back to cache on network error", async () => {
       const { getHostCodexPrompt } = await import("../lib/prompts/host-codex-prompt.js");
       
diff --git a/test/idempotency.test.ts b/test/idempotency.test.ts
new file mode 100644
index 000000000..762430331
--- /dev/null
+++ b/test/idempotency.test.ts
@@ -0,0 +1,87 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { promises as fs } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+
+describe("idempotency store", () => {
+	let tempDir: string;
+	let originalDir: string | undefined;
+
+	beforeEach(async () => {
+		originalDir = process.env.CODEX_MULTI_AUTH_DIR;
+		tempDir = await fs.mkdtemp(join(tmpdir(), "codex-idempotency-"));
+		process.env.CODEX_MULTI_AUTH_DIR = tempDir;
+		vi.resetModules();
+	});
+
+	afterEach(async () => {
+		if (originalDir === undefined) {
+			delete process.env.CODEX_MULTI_AUTH_DIR;
+		} else {
+			process.env.CODEX_MULTI_AUTH_DIR = originalDir;
+		}
+		await fs.rm(tempDir, { recursive: true, force: true });
+	});
+
+	it("records first key use and replays duplicates", async () => {
+		const {
+			checkAndRecordIdempotencyKey,
+			markIdempotencySucceeded,
+			getIdempotencyStorePath,
+		} =
+			await import("../lib/idempotency.js");
+
+		expect(
+			await checkAndRecordIdempotencyKey("codex.auth.rotate-secrets", "key-1"),
+		).toEqual({ replayed: false });
+		await markIdempotencySucceeded("codex.auth.rotate-secrets", "key-1");
+		expect(
+			await checkAndRecordIdempotencyKey("codex.auth.rotate-secrets", "key-1"),
+		).toEqual({ replayed: true });
+
+		const content = await fs.readFile(getIdempotencyStorePath(), "utf8");
+		expect(content).toContain("codex.auth.rotate-secrets");
+	});
+
+	it("expires entries based on ttl", async () => {
+		const { checkAndRecordIdempotencyKey } = await import("../lib/idempotency.js");
+		expect(
+			await checkAndRecordIdempotencyKey("codex.auth.rotate-secrets", "key-2", 5),
+		).toEqual({ replayed: false });
+		await new Promise((resolve) => setTimeout(resolve, 10));
+		expect(
+			await checkAndRecordIdempotencyKey("codex.auth.rotate-secrets", "key-2", 5),
+		).toEqual({ replayed: false });
+	});
+
+	it("allows retry after a pending operation is cleared on failure", async () => {
+		const { checkAndRecordIdempotencyKey, clearIdempotencyOnFailure } =
+			await import("../lib/idempotency.js");
+
+		expect(
+			await checkAndRecordIdempotencyKey("codex.auth.rotate-secrets", "key-fail"),
+		).toEqual({ replayed: false });
+		expect(
+			await checkAndRecordIdempotencyKey("codex.auth.rotate-secrets", "key-fail"),
+		).toEqual({ replayed: true });
+
+		await clearIdempotencyOnFailure("codex.auth.rotate-secrets", "key-fail");
+
+		expect(
+			await checkAndRecordIdempotencyKey("codex.auth.rotate-secrets", "key-fail"),
+		).toEqual({ replayed: false });
+	});
+
+	it("ensures exactly one winner under concurrent duplicate-key races", async () => {
+		const { checkAndRecordIdempotencyKey } = await import("../lib/idempotency.js");
+		const results = await Promise.all(
+			Array.from({ length: 12 }, () =>
+				checkAndRecordIdempotencyKey("codex.auth.rotate-secrets", "key-concurrent"),
+			),
+		);
+		const replayedFalse = results.filter((entry) => entry.replayed === false).length;
+		const replayedTrue = results.filter((entry) => entry.replayed === true).length;
+		expect(replayedFalse).toBe(1);
+		expect(replayedTrue).toBe(11);
+	});
+});
diff --git a/test/index-retry.test.ts b/test/index-retry.test.ts
index 3813edc48..443bfbacd 100644
--- a/test/index-retry.test.ts
+++ b/test/index-retry.test.ts
@@ -1,6 +1,8 @@
 import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import { stripVTControlCharacters } from "node:util";
 
 process.env.CODEX_MULTI_AUTH_EXPOSE_ADMIN_TOOLS = "1";
+let mockInitialNullCalls = 1;
 
 vi.mock("@codex-ai/plugin/tool", () => {
 	const makeSchema = () => ({
@@ -26,6 +28,7 @@ vi.mock("../lib/request/fetch-helpers.js", () => ({
 	refreshAndUpdateToken: async (auth: any) => auth,
 	createCodexHeaders: () => new Headers(),
 	handleErrorResponse: async (response: Response) => ({ response }),
+	getUnsupportedCodexModelInfo: () => ({ isUnsupported: false }),
 	resolveUnsupportedCodexFallbackModel: () => undefined,
 	shouldFallbackToGpt52OnUnsupportedGpt53: () => false,
 	handleSuccessResponse: async (response: Response) => response,
@@ -35,6 +38,10 @@ vi.mock("../lib/request/request-transformer.js", () => ({
 	applyFastSessionDefaults: <T>(config: T) => config,
 }));
 
+vi.mock("../lib/quota-cache.js", () => ({
+	loadQuotaCache: vi.fn(async () => ({ byAccountId: {}, byEmail: {} })),
+}));
+
 vi.mock("../lib/accounts.js", () => {
 	class AccountManager {
 		private calls = 0;
@@ -49,7 +56,7 @@ vi.mock("../lib/accounts.js", () => {
 
 		getCurrentOrNextForFamily() {
 			this.calls += 1;
-			if (this.calls === 1) return null;
+			if (this.calls <= mockInitialNullCalls) return null;
 			return { index: 0, accountId: "account-1", email: "user@example.com" };
 		}
 
@@ -57,6 +64,11 @@ vi.mock("../lib/accounts.js", () => {
 			return this.getCurrentOrNextForFamily();
 		}
 
+		getAccountByIndex(index: number) {
+			if (index !== 0) return null;
+			return { index: 0, accountId: "account-1", email: "user@example.com" };
+		}
+
 		recordSuccess() {}
 
 		recordRateLimit() {}
@@ -120,6 +132,7 @@ vi.mock("../lib/accounts.js", () => {
 		formatWaitTime: (ms: number) => `${ms}ms`,
 		sanitizeEmail: (email: string) => email,
 		parseRateLimitReason: () => "unknown",
+		getQuotaKey: (family: string, model?: string | null) => (model ? `${family}:${model}` : family),
 		lookupCodexCliTokensByEmail: vi.fn(async () => null),
 		isCodexCliSyncEnabled: () => true,
 	};
@@ -129,6 +142,21 @@ vi.mock("../lib/storage.js", () => ({
 	getStoragePath: () => "",
 	loadAccounts: async () => null,
 	saveAccounts: async () => {},
+	withAccountStorageTransaction: async (
+		handler: (
+			storage: { version: 3; accounts: []; activeIndex: number; activeIndexByFamily: Record<string, number> },
+			persist: (next: { version: 3; accounts: []; activeIndex: number; activeIndexByFamily: Record<string, number> }) => Promise<void>,
+		) => Promise<unknown>,
+	) =>
+		handler(
+			{
+				version: 3,
+				accounts: [],
+				activeIndex: 0,
+				activeIndexByFamily: {},
+			},
+			async () => {},
+		),
 	setStoragePath: () => {},
 	setStorageBackupEnabled: () => {},
 	exportAccounts: async () => {},
@@ -146,6 +174,7 @@ describe("OpenAIAuthPlugin rate-limit retry", () => {
 		"CODEX_AUTH_RETRY_ALL_RATE_LIMITED",
 		"CODEX_AUTH_RETRY_ALL_MAX_WAIT_MS",
 		"CODEX_AUTH_RETRY_ALL_MAX_RETRIES",
+		"CODEX_AUTH_RETRY_ALL_ABSOLUTE_CEILING_MS",
 		"CODEX_AUTH_TOKEN_REFRESH_SKEW_MS",
 		"CODEX_AUTH_RATE_LIMIT_TOAST_DEBOUNCE_MS",
 		"CODEX_AUTH_PREWARM",
@@ -160,9 +189,11 @@ describe("OpenAIAuthPlugin rate-limit retry", () => {
 		process.env.CODEX_AUTH_RETRY_ALL_RATE_LIMITED = "1";
 		process.env.CODEX_AUTH_RETRY_ALL_MAX_WAIT_MS = "5000";
 		process.env.CODEX_AUTH_RETRY_ALL_MAX_RETRIES = "1";
+		process.env.CODEX_AUTH_RETRY_ALL_ABSOLUTE_CEILING_MS = "0";
 		process.env.CODEX_AUTH_TOKEN_REFRESH_SKEW_MS = "0";
 		process.env.CODEX_AUTH_RATE_LIMIT_TOAST_DEBOUNCE_MS = "0";
 		process.env.CODEX_AUTH_PREWARM = "0";
+		mockInitialNullCalls = 1;
 
 		vi.useFakeTimers();
 		originalFetch = globalThis.fetch;
@@ -209,9 +240,519 @@ describe("OpenAIAuthPlugin rate-limit retry", () => {
 
 		await vi.advanceTimersByTimeAsync(1500);
 
+	const response = await fetchPromise;
+	expect(globalThis.fetch).toHaveBeenCalledTimes(1);
+	expect(response.status).toBe(200);
+	});
+
+	it("strips query and fragment when audit URL parsing falls back", async () => {
+		vi.resetModules();
+		const auditLogMock = vi.fn();
+		vi.doMock("../lib/audit.js", async () => {
+			const actual = await vi.importActual("../lib/audit.js");
+			return {
+				...(actual as Record<string, unknown>),
+				auditLog: auditLogMock,
+			};
+		});
+
+		try {
+			const { OpenAIAuthPlugin } = await import("../index.js");
+			const client = {
+				tui: { showToast: vi.fn() },
+				auth: { set: vi.fn() },
+			} as any;
+
+			const plugin = await OpenAIAuthPlugin({ client });
+			const getAuth = async () => ({
+				type: "oauth" as const,
+				access: "a",
+				refresh: "r",
+				expires: Date.now() + 60_000,
+				multiAccount: true,
+			});
+
+			const sdk = (await plugin.auth.loader(getAuth, { options: {}, models: {} })) as any;
+			const responsePromise = sdk.fetch("relative/path?token=super-secret#frag", {});
+			await vi.advanceTimersByTimeAsync(1500);
+			const response = await responsePromise;
+			expect(response.status).toBe(200);
+
+			const resources = auditLogMock.mock.calls.map((args) => String(args[2] ?? ""));
+			expect(resources.length).toBeGreaterThan(0);
+			for (const resource of resources) {
+				expect(resource).not.toContain("?");
+				expect(resource).not.toContain("#");
+				expect(resource).not.toContain("super-secret");
+			}
+		} finally {
+			vi.doUnmock("../lib/audit.js");
+			vi.resetModules();
+		}
+	});
+
+	it("uses normalized quota scheduler keys for provider-prefixed model ids", async () => {
+		const { OpenAIAuthPlugin } = await import("../index.js");
+		const accountsModule = await import("../lib/accounts.js");
+		const fetchHelpers = await import("../lib/request/fetch-helpers.js");
+		const quotaCacheModule = await import("../lib/quota-cache.js");
+
+		const loadQuotaCacheMock = vi.mocked(quotaCacheModule.loadQuotaCache);
+		const now = Date.now();
+		const accountOne = {
+			index: 0,
+			accountId: "account-1",
+			email: "user1@example.com",
+			refreshToken: "refresh-1",
+			rateLimitResetTimes: {},
+		};
+		const accountTwo = {
+			index: 1,
+			accountId: "account-2",
+			email: "user2@example.com",
+			refreshToken: "refresh-2",
+			rateLimitResetTimes: {},
+		};
+
+		loadQuotaCacheMock.mockResolvedValueOnce({
+			byAccountId: {
+				"account-1": {
+					updatedAt: now,
+					status: 429,
+					model: "gpt-5.1",
+					primary: {
+						usedPercent: 100,
+						resetAtMs: now + 5 * 60_000,
+					},
+					secondary: {},
+				},
+			},
+			byEmail: {},
+		});
+
+		vi.spyOn(accountsModule.AccountManager.prototype, "getAccountCount").mockReturnValue(2);
+		vi.spyOn(accountsModule.AccountManager.prototype, "getAccountByIndex").mockImplementation(
+			(index: number) =>
+				(index === 0 ? accountOne : index === 1 ? accountTwo : null) as never,
+		);
+		let selectionCallCount = 0;
+		vi.spyOn(
+			accountsModule.AccountManager.prototype,
+			"getCurrentOrNextForFamilyHybrid",
+		).mockImplementation(
+			() => {
+				selectionCallCount += 1;
+				return (selectionCallCount === 1 ? accountOne : accountTwo) as never;
+			},
+		);
+		vi.spyOn(accountsModule.AccountManager.prototype, "toAuthDetails").mockImplementation(
+			(account: { index?: number; accountId?: string }) => ({
+				type: "oauth",
+				access: account.index === 0 ? "access-acc-1" : "access-acc-2",
+				refresh: `refresh-${account.accountId ?? "unknown"}`,
+				expires: Date.now() + 60_000,
+			}),
+		);
+		const markRateLimitSpy = vi.spyOn(
+			accountsModule.AccountManager.prototype,
+			"markRateLimitedWithReason",
+		);
+		vi.spyOn(fetchHelpers, "transformRequestForCodex").mockImplementationOnce(
+			async (init: unknown) => ({
+				updatedInit: init,
+				body: { model: "OPENAI/GPT-5.1" },
+			}),
+		);
+		vi.spyOn(fetchHelpers, "createCodexHeaders").mockImplementation(
+			(_init: unknown, _accountId: unknown, accessToken: unknown) =>
+				new Headers({ "x-test-access-token": String(accessToken ?? "") }),
+		);
+		const client = {
+			tui: { showToast: vi.fn() },
+			auth: { set: vi.fn() },
+		} as any;
+		const plugin = await OpenAIAuthPlugin({ client });
+		const getAuth = async () => ({
+			type: "oauth" as const,
+			access: "a",
+			refresh: "r",
+			expires: Date.now() + 60_000,
+			multiAccount: true,
+		});
+
+		const sdk = (await plugin.auth.loader(getAuth, { options: {}, models: {} })) as any;
+		const response = await sdk.fetch("https://example.com", {
+			method: "POST",
+			body: JSON.stringify({ model: "OPENAI/GPT-5.1" }),
+		});
+
+		expect(response.status).toBe(200);
+		expect(globalThis.fetch).toHaveBeenCalledTimes(1);
+		const headers = new Headers(
+			(vi.mocked(globalThis.fetch).mock.calls[0]?.[1] as RequestInit | undefined)?.headers,
+		);
+		expect(headers.get("x-test-access-token")).toBe("access-acc-2");
+		expect(markRateLimitSpy).toHaveBeenCalled();
+	});
+
+	it("stops immediately when absolute ceiling is below the raw retry wait", async () => {
+		process.env.CODEX_AUTH_RETRY_ALL_ABSOLUTE_CEILING_MS = "500";
+		const { OpenAIAuthPlugin } = await import("../index.js");
+		const client = {
+			tui: { showToast: vi.fn() },
+			auth: { set: vi.fn() },
+		} as any;
+
+		const plugin = await OpenAIAuthPlugin({ client });
+		const getAuth = async () => ({
+			type: "oauth" as const,
+			access: "a",
+			refresh: "r",
+			expires: Date.now() + 60_000,
+			multiAccount: true,
+		});
+
+		const sdk = (await plugin.auth.loader(getAuth, { options: {}, models: {} })) as any;
+		const response = await sdk.fetch("https://example.com", {});
+		expect(response.status).toBe(429);
+		expect(globalThis.fetch).not.toHaveBeenCalled();
+
+		const metrics = await plugin.tool["codex-metrics"].execute();
+		const plainMetrics = stripVTControlCharacters(String(metrics));
+		expect(plainMetrics).toContain("Retry governor stops (absolute ceiling): 1");
+	});
+
+	it("increments retry-limit stop metric when retries are disabled", async () => {
+		process.env.CODEX_AUTH_RETRY_ALL_MAX_RETRIES = "0";
+		const { OpenAIAuthPlugin } = await import("../index.js");
+		const client = {
+			tui: { showToast: vi.fn() },
+			auth: { set: vi.fn() },
+		} as any;
+
+		const plugin = await OpenAIAuthPlugin({ client });
+		const getAuth = async () => ({
+			type: "oauth" as const,
+			access: "a",
+			refresh: "r",
+			expires: Date.now() + 60_000,
+			multiAccount: true,
+		});
+
+		const sdk = (await plugin.auth.loader(getAuth, { options: {}, models: {} })) as any;
+		const response = await sdk.fetch("https://example.com", {});
+		expect(response.status).toBe(429);
+		expect(globalThis.fetch).not.toHaveBeenCalled();
+
+		const metrics = await plugin.tool["codex-metrics"].execute();
+		const plainMetrics = stripVTControlCharacters(String(metrics));
+		expect(plainMetrics).toContain("Retry governor stops (retry limit): 1");
+	});
+
+	it("caps jittered retry waits at the configured absolute ceiling", async () => {
+		process.env.CODEX_AUTH_RETRY_ALL_ABSOLUTE_CEILING_MS = "1100";
+		vi.spyOn(Math, "random").mockReturnValue(1);
+		const { OpenAIAuthPlugin } = await import("../index.js");
+		const client = {
+			tui: { showToast: vi.fn() },
+			auth: { set: vi.fn() },
+		} as any;
+
+		const plugin = await OpenAIAuthPlugin({ client });
+		const getAuth = async () => ({
+			type: "oauth" as const,
+			access: "a",
+			refresh: "r",
+			expires: Date.now() + 60_000,
+			multiAccount: true,
+		});
+
+		const sdk = (await plugin.auth.loader(getAuth, { options: {}, models: {} })) as any;
+		const fetchPromise = sdk.fetch("https://example.com", {});
+		expect(globalThis.fetch).not.toHaveBeenCalled();
+
+		await vi.advanceTimersByTimeAsync(1150);
+		expect(globalThis.fetch).toHaveBeenCalledTimes(1);
+
+		const response = await fetchPromise;
+		expect(response.status).toBe(200);
+	});
+
+	it("consumes remaining ceiling budget under -20% jitter without premature stop", async () => {
+		process.env.CODEX_AUTH_RETRY_ALL_ABSOLUTE_CEILING_MS = "1600";
+		process.env.CODEX_AUTH_RETRY_ALL_MAX_RETRIES = "2";
+		mockInitialNullCalls = 2;
+		vi.spyOn(Math, "random").mockReturnValue(0);
+		const { OpenAIAuthPlugin } = await import("../index.js");
+		const client = {
+			tui: { showToast: vi.fn() },
+			auth: { set: vi.fn() },
+		} as any;
+
+		const plugin = await OpenAIAuthPlugin({ client });
+		const getAuth = async () => ({
+			type: "oauth" as const,
+			access: "a",
+			refresh: "r",
+			expires: Date.now() + 60_000,
+			multiAccount: true,
+		});
+
+		const sdk = (await plugin.auth.loader(getAuth, { options: {}, models: {} })) as any;
+		const fetchPromise = sdk.fetch("https://example.com", {});
+		expect(globalThis.fetch).not.toHaveBeenCalled();
+
+		await vi.advanceTimersByTimeAsync(1599);
+		expect(globalThis.fetch).not.toHaveBeenCalled();
+		await vi.advanceTimersByTimeAsync(1);
+		expect(globalThis.fetch).toHaveBeenCalledTimes(1);
+
 		const response = await fetchPromise;
+		expect(response.status).toBe(200);
+
+		const metrics = await plugin.tool["codex-metrics"].execute();
+		const plainMetrics = stripVTControlCharacters(String(metrics));
+		expect(plainMetrics).toContain("Retry governor stops (absolute ceiling): 0");
+	});
+
+	it("stops once the absolute ceiling budget is exhausted instead of spinning zero-delay retries", async () => {
+		process.env.CODEX_AUTH_RETRY_ALL_ABSOLUTE_CEILING_MS = "1600";
+		process.env.CODEX_AUTH_RETRY_ALL_MAX_RETRIES = "10";
+		mockInitialNullCalls = 999;
+		vi.spyOn(Math, "random").mockReturnValue(0);
+		const { OpenAIAuthPlugin } = await import("../index.js");
+		const client = {
+			tui: { showToast: vi.fn() },
+			auth: { set: vi.fn() },
+		} as any;
+
+		const plugin = await OpenAIAuthPlugin({ client });
+		const getAuth = async () => ({
+			type: "oauth" as const,
+			access: "a",
+			refresh: "r",
+			expires: Date.now() + 60_000,
+			multiAccount: true,
+		});
+
+		const sdk = (await plugin.auth.loader(getAuth, { options: {}, models: {} })) as any;
+		const fetchPromise = sdk.fetch("https://example.com", {});
+		expect(globalThis.fetch).not.toHaveBeenCalled();
+
+		await vi.advanceTimersByTimeAsync(1600);
+		await vi.advanceTimersByTimeAsync(0);
+
+		const response = await fetchPromise;
+		expect(response.status).toBe(429);
+		expect(globalThis.fetch).not.toHaveBeenCalled();
+
+		const metrics = await plugin.tool["codex-metrics"].execute();
+		const plainMetrics = stripVTControlCharacters(String(metrics));
+		expect(plainMetrics).toContain("Retry governor stops (absolute ceiling): 1");
+		expect(plainMetrics).toContain("Retry governor stops (retry limit): 0");
+	});
+
+	it("keeps retry budgets isolated across overlapping requests", async () => {
+		process.env.CODEX_AUTH_RETRY_ALL_MAX_RETRIES = "1";
+		mockInitialNullCalls = 2;
+		vi.spyOn(Math, "random").mockReturnValue(0.5);
+		const { OpenAIAuthPlugin } = await import("../index.js");
+		const client = {
+			tui: { showToast: vi.fn() },
+			auth: { set: vi.fn() },
+		} as any;
+
+		const plugin = await OpenAIAuthPlugin({ client });
+		const getAuth = async () => ({
+			type: "oauth" as const,
+			access: "a",
+			refresh: "r",
+			expires: Date.now() + 60_000,
+			multiAccount: true,
+		});
+
+		const sdk = (await plugin.auth.loader(getAuth, { options: {}, models: {} })) as any;
+		const requestA = sdk.fetch("https://example.com/a", {});
+		const requestB = sdk.fetch("https://example.com/b", {});
+
+		await vi.advanceTimersByTimeAsync(1000);
+		const [responseA, responseB] = await Promise.all([requestA, requestB]);
+
+		expect(responseA.status).toBe(200);
+		expect(responseB.status).toBe(200);
+		expect(globalThis.fetch).toHaveBeenCalledTimes(2);
+
+		const metrics = await plugin.tool["codex-metrics"].execute();
+		const plainMetrics = stripVTControlCharacters(String(metrics));
+		expect(plainMetrics).toContain("Retry governor stops (retry limit): 0");
+	});
+
+	it("keeps max wait checks deterministic at the raw wait threshold", async () => {
+		process.env.CODEX_AUTH_RETRY_ALL_MAX_WAIT_MS = "1000";
+		process.env.CODEX_AUTH_RETRY_ALL_MAX_RETRIES = "2";
+		vi.spyOn(Math, "random").mockReturnValue(1);
+		const { OpenAIAuthPlugin } = await import("../index.js");
+		const client = {
+			tui: { showToast: vi.fn() },
+			auth: { set: vi.fn() },
+		} as any;
+
+		const plugin = await OpenAIAuthPlugin({ client });
+		const getAuth = async () => ({
+			type: "oauth" as const,
+			access: "a",
+			refresh: "r",
+			expires: Date.now() + 60_000,
+			multiAccount: true,
+		});
+
+		const sdk = (await plugin.auth.loader(getAuth, { options: {}, models: {} })) as any;
+		const fetchPromise = sdk.fetch("https://example.com", {});
+		expect(globalThis.fetch).not.toHaveBeenCalled();
+		await vi.advanceTimersByTimeAsync(1199);
+		expect(globalThis.fetch).not.toHaveBeenCalled();
+		await vi.advanceTimersByTimeAsync(1);
 		expect(globalThis.fetch).toHaveBeenCalledTimes(1);
+
+		const response = await fetchPromise;
+		expect(response.status).toBe(200);
+
+		const metrics = await plugin.tool["codex-metrics"].execute();
+		const plainMetrics = stripVTControlCharacters(String(metrics));
+		expect(plainMetrics).toContain("Retry governor stops (wait>max): 0");
+	});
+
+	it("blocks retries when raw wait exceeds max wait even under negative jitter", async () => {
+		process.env.CODEX_AUTH_RETRY_ALL_MAX_WAIT_MS = "999";
+		process.env.CODEX_AUTH_RETRY_ALL_MAX_RETRIES = "2";
+		vi.spyOn(Math, "random").mockReturnValue(0);
+		const { OpenAIAuthPlugin } = await import("../index.js");
+		const client = {
+			tui: { showToast: vi.fn() },
+			auth: { set: vi.fn() },
+		} as any;
+
+		const plugin = await OpenAIAuthPlugin({ client });
+		const getAuth = async () => ({
+			type: "oauth" as const,
+			access: "a",
+			refresh: "r",
+			expires: Date.now() + 60_000,
+			multiAccount: true,
+		});
+
+		const sdk = (await plugin.auth.loader(getAuth, { options: {}, models: {} })) as any;
+		const response = await sdk.fetch("https://example.com", {});
+		expect(response.status).toBe(429);
+		expect(globalThis.fetch).not.toHaveBeenCalled();
+
+		const metrics = await plugin.tool["codex-metrics"].execute();
+		const plainMetrics = stripVTControlCharacters(String(metrics));
+		expect(plainMetrics).toContain("Retry governor stops (wait>max): 1");
+	});
+
+	it("uses family-level scheduler keys when request model is omitted", async () => {
+		const { OpenAIAuthPlugin } = await import("../index.js");
+		const accountsModule = await import("../lib/accounts.js");
+		const fetchHelpers = await import("../lib/request/fetch-helpers.js");
+		const quotaCacheModule = await import("../lib/quota-cache.js");
+
+		const loadQuotaCacheMock = vi.mocked(quotaCacheModule.loadQuotaCache);
+		const now = Date.now();
+		const accountOne = {
+			index: 0,
+			accountId: "account-1",
+			email: "user1@example.com",
+			refreshToken: "refresh-1",
+			rateLimitResetTimes: {},
+		};
+		const accountTwo = {
+			index: 1,
+			accountId: "account-2",
+			email: "user2@example.com",
+			refreshToken: "refresh-2",
+			rateLimitResetTimes: {},
+		};
+
+		loadQuotaCacheMock.mockResolvedValueOnce({
+			byAccountId: {
+				"account-1": {
+					updatedAt: now,
+					status: 429,
+					model: "gpt-5.1",
+					primary: {
+						usedPercent: 100,
+						resetAtMs: now + 5 * 60_000,
+					},
+					secondary: {},
+				},
+			},
+			byEmail: {},
+		});
+
+		vi.spyOn(accountsModule.AccountManager.prototype, "getAccountCount").mockReturnValue(2);
+		vi.spyOn(accountsModule.AccountManager.prototype, "getAccountByIndex").mockImplementation(
+			(index: number) =>
+				(index === 0 ? accountOne : index === 1 ? accountTwo : null) as never,
+		);
+		let selectionCallCount = 0;
+		vi.spyOn(
+			accountsModule.AccountManager.prototype,
+			"getCurrentOrNextForFamilyHybrid",
+		).mockImplementation(() => {
+			selectionCallCount += 1;
+			return (selectionCallCount === 1 ? accountOne : accountTwo) as never;
+		});
+		vi.spyOn(accountsModule.AccountManager.prototype, "toAuthDetails").mockImplementation(
+			(account: { index?: number; accountId?: string }) => ({
+				type: "oauth",
+				access: account.index === 0 ? "access-acc-1" : "access-acc-2",
+				refresh: `refresh-${account.accountId ?? "unknown"}`,
+				expires: Date.now() + 60_000,
+			}),
+		);
+		const markRateLimitSpy = vi.spyOn(
+			accountsModule.AccountManager.prototype,
+			"markRateLimitedWithReason",
+		);
+		vi.spyOn(fetchHelpers, "transformRequestForCodex").mockImplementationOnce(
+			async (init: unknown) => ({
+				updatedInit: init,
+				body: {},
+			}),
+		);
+		vi.spyOn(fetchHelpers, "createCodexHeaders").mockImplementation(
+			(_init: unknown, _accountId: unknown, accessToken: unknown) =>
+				new Headers({ "x-test-access-token": String(accessToken ?? "") }),
+		);
+
+		const client = {
+			tui: { showToast: vi.fn() },
+			auth: { set: vi.fn() },
+		} as any;
+		const plugin = await OpenAIAuthPlugin({ client });
+
+		const getAuth = async () => ({
+			type: "oauth" as const,
+			access: "a",
+			refresh: "r",
+			expires: Date.now() + 60_000,
+			multiAccount: true,
+		});
+
+		const sdk = (await plugin.auth.loader(getAuth, { options: {}, models: {} })) as any;
+		const response = await sdk.fetch("https://example.com", {
+			method: "POST",
+			body: JSON.stringify({ messages: [{ role: "user", content: "hello" }] }),
+		});
+
 		expect(response.status).toBe(200);
+		expect(globalThis.fetch).toHaveBeenCalledTimes(1);
+		const headers = new Headers(
+			(vi.mocked(globalThis.fetch).mock.calls[0]?.[1] as RequestInit | undefined)?.headers,
+		);
+		expect(headers.get("x-test-access-token")).toBe("access-acc-2");
+		expect(markRateLimitSpy).toHaveBeenCalled();
 	});
 });
 
diff --git a/test/index.test.ts b/test/index.test.ts
index d6d95497f..a8a2711eb 100644
--- a/test/index.test.ts
+++ b/test/index.test.ts
@@ -2,6 +2,15 @@ import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
 
 process.env.CODEX_MULTI_AUTH_EXPOSE_ADMIN_TOOLS = "1";
 
+const checkAuthRateLimitMock = vi.fn();
+const recordAuthAttemptMock = vi.fn();
+const resetAuthRateLimitMock = vi.fn();
+const enforceDataRetentionMock = vi.fn(async () => ({
+	removedLogs: 0,
+	removedCacheFiles: 0,
+	removedStateFiles: 0,
+}));
+
 vi.mock("@codex-ai/plugin/tool", () => {
 	const makeSchema = () => ({
 		optional: () => makeSchema(),
@@ -64,6 +73,12 @@ vi.mock("../lib/auth/server.js", () => ({
 	})),
 }));
 
+vi.mock("../lib/auth-rate-limit.js", () => ({
+	checkAuthRateLimit: checkAuthRateLimitMock,
+	recordAuthAttempt: recordAuthAttemptMock,
+	resetAuthRateLimit: resetAuthRateLimitMock,
+}));
+
 vi.mock("../lib/cli.js", () => ({
 	promptLoginMode: vi.fn(async () => ({ mode: "add" })),
 	promptAddAnotherAccount: vi.fn(async () => false),
@@ -76,6 +91,7 @@ vi.mock("../lib/config.js", () => ({
 	getFastSessionMaxInputItems: () => 30,
 	getRateLimitToastDebounceMs: () => 5000,
 	getRetryAllAccountsMaxRetries: () => 3,
+	getRetryAllAccountsAbsoluteCeilingMs: () => 0,
 	getRetryAllAccountsMaxWaitMs: () => 30000,
 	getRetryAllAccountsRateLimited: () => true,
 	getUnsupportedCodexPolicy: vi.fn(() => "fallback"),
@@ -90,7 +106,7 @@ vi.mock("../lib/config.js", () => ({
 	getEmptyResponseMaxRetries: () => 2,
 	getEmptyResponseRetryDelayMs: () => 1000,
 	getPidOffsetEnabled: () => false,
-	getFetchTimeoutMs: () => 60000,
+	getFetchTimeoutMs: vi.fn(() => 60000),
 	getStreamStallTimeoutMs: () => 45000,
 	getLiveAccountSync: vi.fn(() => false),
 	getLiveAccountSyncDebounceMs: () => 250,
@@ -108,10 +124,17 @@ vi.mock("../lib/config.js", () => ({
 	getPreemptiveQuotaRemainingPercent5h: () => 5,
 	getPreemptiveQuotaRemainingPercent7d: () => 5,
 	getPreemptiveQuotaMaxDeferralMs: () => 2 * 60 * 60_000,
+	getTelemetryEnabled: () => true,
 	getCodexTuiV2: () => false,
 	getCodexTuiColorProfile: () => "ansi16",
 	getCodexTuiGlyphMode: () => "ascii",
-	loadPluginConfig: () => ({}),
+	loadPluginConfig: vi.fn(() => ({})),
+}));
+
+const recordTelemetryEventMock = vi.fn();
+
+vi.mock("../lib/telemetry.js", () => ({
+	recordTelemetryEvent: recordTelemetryEventMock,
 }));
 
 const liveAccountSyncSyncToPathMock = vi.fn(async () => {});
@@ -138,6 +161,10 @@ vi.mock("../lib/request/request-transformer.js", () => ({
 	applyFastSessionDefaults: <T>(config: T) => config,
 }));
 
+vi.mock("../lib/data-retention.js", () => ({
+	enforceDataRetention: enforceDataRetentionMock,
+}));
+
 vi.mock("../lib/logger.js", () => ({
 	initLogger: vi.fn(),
 	logRequest: vi.fn(),
@@ -197,6 +224,11 @@ vi.mock("../lib/request/rate-limit-backoff.js", () => ({
 	resetRateLimitBackoff: vi.fn(),
 }));
 
+const loadQuotaCacheMock = vi.fn(async () => ({ byAccountId: {}, byEmail: {} }));
+vi.mock("../lib/quota-cache.js", () => ({
+	loadQuotaCache: loadQuotaCacheMock,
+}));
+
 	vi.mock("../lib/request/fetch-helpers.js", () => ({
 		extractRequestUrl: (input: unknown) => (typeof input === "string" ? input : String(input)),
 		rewriteUrlForCodex: (url: string) => url,
@@ -204,7 +236,7 @@ vi.mock("../lib/request/rate-limit-backoff.js", () => ({
 		updatedInit: init,
 		body: { model: "gpt-5.1" },
 	})),
-		shouldRefreshToken: () => false,
+		shouldRefreshToken: vi.fn(() => false),
 		refreshAndUpdateToken: vi.fn(async (auth: unknown) => auth),
 		createCodexHeaders: vi.fn(() => new Headers()),
 		handleErrorResponse: vi.fn(async (response: Response) => ({ response })),
@@ -231,6 +263,10 @@ const mockStorage = {
 	activeIndex: 0,
 	activeIndexByFamily: {} as Record<string, number>,
 };
+const withAccountStorageTransactionMock = vi.fn(
+	async <T>(handler: (storage: typeof mockStorage, persist: (next: typeof mockStorage) => Promise<void>) => Promise<T>) =>
+		handler(mockStorage, async () => {}),
+);
 
 const syncCodexCliSelectionMock = vi.fn(async (_index: number) => {});
 
@@ -238,6 +274,7 @@ vi.mock("../lib/storage.js", () => ({
 	getStoragePath: () => "/mock/path/accounts.json",
 	loadAccounts: vi.fn(async () => mockStorage),
 	saveAccounts: vi.fn(async () => {}),
+	withAccountStorageTransaction: withAccountStorageTransactionMock,
 	clearAccounts: vi.fn(async () => {}),
 	setStoragePath: vi.fn(),
 	setStorageBackupEnabled: vi.fn(),
@@ -330,6 +367,10 @@ vi.mock("../lib/accounts.js", () => {
 			return this.accounts[index] ?? null;
 		}
 
+		getAccountByIndex(index: number) {
+			return this.accounts[index] ?? null;
+		}
+
 		getAccountsSnapshot() {
 			return this.accounts;
 		}
@@ -348,6 +389,7 @@ vi.mock("../lib/accounts.js", () => {
 		sanitizeEmail: (email: string) => email,
 		shouldUpdateAccountIdFromToken: () => true,
 		parseRateLimitReason: () => "unknown",
+		getQuotaKey: (family: string, model?: string | null) => (model ? `${family}:${model}` : family),
 		lookupCodexCliTokensByEmail: vi.fn(async () => null),
 		isCodexCliSyncEnabled: () => true,
 	};
@@ -420,6 +462,10 @@ describe("OpenAIOAuthPlugin", () => {
 		mockStorage.accounts = [];
 		mockStorage.activeIndex = 0;
 		mockStorage.activeIndexByFamily = {};
+		withAccountStorageTransactionMock.mockClear();
+		withAccountStorageTransactionMock.mockImplementation(async (handler) =>
+			handler(mockStorage, async () => {}),
+		);
 
 		const { OpenAIOAuthPlugin } = await import("../index.js");
 		plugin = await OpenAIOAuthPlugin({ client: mockClient } as never) as unknown as PluginType;
@@ -505,6 +551,165 @@ describe("OpenAIOAuthPlugin", () => {
 			expect(vi.mocked(authModule.exchangeAuthorizationCode)).not.toHaveBeenCalled();
 		});
 
+		it("returns failed TokenResult when auth rate-limit check throws", async () => {
+			const manualMethod = plugin.auth.methods[1] as unknown as {
+				authorize: () => Promise<{
+					callback: (input: string) => Promise<{ type: string; reason?: string; message?: string }>;
+				}>;
+			};
+			checkAuthRateLimitMock.mockImplementationOnce(() => {
+				throw new Error("rate limit exceeded");
+			});
+
+			const flow = await manualMethod.authorize();
+			const result = await flow.callback(
+				"http://127.0.0.1:1455/auth/callback?code=abc123&state=test-state",
+			);
+			expect(result.type).toBe("failed");
+			expect(result.reason).toBe("http_error");
+			expect(result.message).toContain("rate limit exceeded");
+		});
+
+		it("returns failed TokenResult when token exchange throws", async () => {
+			const authModule = await import("../lib/auth/auth.js");
+			const manualMethod = plugin.auth.methods[1] as unknown as {
+				authorize: () => Promise<{
+					callback: (input: string) => Promise<{ type: string; reason?: string; message?: string }>;
+				}>;
+			};
+			vi.mocked(authModule.exchangeAuthorizationCode).mockRejectedValueOnce(
+				new Error("network down"),
+			);
+
+			const flow = await manualMethod.authorize();
+			const result = await flow.callback(
+				"http://127.0.0.1:1455/auth/callback?code=abc123&state=test-state",
+			);
+			expect(result.type).toBe("failed");
+			expect(result.reason).toBe("http_error");
+			expect(result.message).toContain("network down");
+		});
+
+		it("passes configured timeout to manual OAuth callback exchange", async () => {
+			const authModule = await import("../lib/auth/auth.js");
+			const configModule = await import("../lib/config.js");
+			const manualMethod = plugin.auth.methods[1] as unknown as {
+				authorize: () => Promise<{
+					callback: (input: string) => Promise<{ type: string; reason?: string; message?: string }>;
+				}>;
+			};
+			const expectedTimeoutMs = 4321;
+			const pluginConfig = { fetchTimeoutMs: expectedTimeoutMs };
+			vi.mocked(configModule.loadPluginConfig).mockReturnValue(pluginConfig);
+			vi.mocked(configModule.getFetchTimeoutMs).mockReturnValue(expectedTimeoutMs);
+
+			const flow = await manualMethod.authorize();
+			await flow.callback("http://127.0.0.1:1455/auth/callback?code=abc123&state=test-state");
+
+			expect(vi.mocked(authModule.exchangeAuthorizationCode)).toHaveBeenCalledWith(
+				"abc123",
+				"test-verifier",
+				authModule.REDIRECT_URI,
+				{ timeoutMs: expectedTimeoutMs },
+			);
+			expect(vi.mocked(configModule.getFetchTimeoutMs)).toHaveBeenCalledWith(pluginConfig);
+		});
+
+		it("passes configured timeout to browser OAuth callback exchange", async () => {
+			const authModule = await import("../lib/auth/auth.js");
+			const configModule = await import("../lib/config.js");
+			const browserModule = await import("../lib/auth/browser.js");
+			const serverModule = await import("../lib/auth/server.js");
+			const expectedTimeoutMs = 6789;
+			const pluginConfig = { fetchTimeoutMs: expectedTimeoutMs };
+			vi.mocked(configModule.loadPluginConfig).mockReturnValue(pluginConfig);
+			vi.mocked(configModule.getFetchTimeoutMs).mockReturnValue(expectedTimeoutMs);
+			vi.mocked(authModule.createAuthorizationFlow).mockResolvedValue({
+				pkce: { verifier: "custom-verifier", challenge: "custom-challenge" },
+				state: "custom-state",
+				url: "https://auth.openai.com/oauth/authorize?state=custom-state",
+			});
+			vi.mocked(browserModule.openBrowserUrl).mockReturnValue(true);
+			vi.mocked(serverModule.startLocalOAuthServer).mockResolvedValue({
+				ready: true,
+				close: vi.fn(),
+				waitForCode: vi.fn(async () => ({ code: "oauth-code" })),
+			});
+
+			const autoMethod = plugin.auth.methods[0] as unknown as {
+				authorize: () => Promise<unknown>;
+			};
+			await autoMethod.authorize();
+
+			expect(vi.mocked(authModule.exchangeAuthorizationCode)).toHaveBeenCalledWith(
+				"oauth-code",
+				"custom-verifier",
+				authModule.REDIRECT_URI,
+				{ timeoutMs: expectedTimeoutMs },
+			);
+			expect(vi.mocked(configModule.getFetchTimeoutMs)).toHaveBeenCalledWith(pluginConfig);
+		});
+
+		it("keeps timeout wiring stable under concurrent OAuth authorize calls", async () => {
+			const authModule = await import("../lib/auth/auth.js");
+			const configModule = await import("../lib/config.js");
+			const browserModule = await import("../lib/auth/browser.js");
+			const serverModule = await import("../lib/auth/server.js");
+			const expectedTimeoutMs = 2468;
+			vi.mocked(configModule.loadPluginConfig).mockReturnValue({ fetchTimeoutMs: expectedTimeoutMs });
+			vi.mocked(configModule.getFetchTimeoutMs).mockReturnValue(expectedTimeoutMs);
+			vi.mocked(authModule.createAuthorizationFlow)
+				.mockResolvedValueOnce({
+					pkce: { verifier: "verifier-1", challenge: "challenge-1" },
+					state: "state-1",
+					url: "https://auth.openai.com/oauth/authorize?state=state-1",
+				})
+				.mockResolvedValueOnce({
+					pkce: { verifier: "verifier-2", challenge: "challenge-2" },
+					state: "state-2",
+					url: "https://auth.openai.com/oauth/authorize?state=state-2",
+				})
+				.mockResolvedValueOnce({
+					pkce: { verifier: "verifier-3", challenge: "challenge-3" },
+					state: "state-3",
+					url: "https://auth.openai.com/oauth/authorize?state=state-3",
+				});
+			vi.mocked(browserModule.openBrowserUrl).mockReturnValue(true);
+			vi.mocked(serverModule.startLocalOAuthServer)
+				.mockResolvedValueOnce({
+					ready: true,
+					close: vi.fn(),
+					waitForCode: vi.fn(async () => ({ code: "code-1" })),
+				})
+				.mockResolvedValueOnce({
+					ready: true,
+					close: vi.fn(),
+					waitForCode: vi.fn(async () => ({ code: "code-2" })),
+				})
+				.mockResolvedValueOnce({
+					ready: true,
+					close: vi.fn(),
+					waitForCode: vi.fn(async () => ({ code: "code-3" })),
+				});
+
+			const autoMethod = plugin.auth.methods[0] as unknown as {
+				authorize: () => Promise<unknown>;
+			};
+			await Promise.all([autoMethod.authorize(), autoMethod.authorize(), autoMethod.authorize()]);
+
+			expect(vi.mocked(authModule.exchangeAuthorizationCode)).toHaveBeenCalledTimes(3);
+			const calls = vi.mocked(authModule.exchangeAuthorizationCode).mock.calls;
+			expect(calls.map((call) => call[0])).toEqual(
+				expect.arrayContaining(["code-1", "code-2", "code-3"]),
+			);
+			expect(calls.map((call) => call[1])).toEqual(
+				expect.arrayContaining(["verifier-1", "verifier-2", "verifier-3"]),
+			);
+			for (const call of calls) {
+				expect(call[3]).toEqual({ timeoutMs: expectedTimeoutMs });
+			}
+		});
+
 		it("uses REDIRECT_URI in manual callback validation copy", async () => {
 			const authModule = await import("../lib/auth/auth.js");
 			const manualMethod = plugin.auth.methods[1] as unknown as {
@@ -518,6 +723,11 @@ describe("OpenAIOAuthPlugin", () => {
 			expect(message).toContain(authModule.REDIRECT_URI);
 		});
 
+		it("serializes startup retention cleanup through storage transaction", () => {
+			expect(withAccountStorageTransactionMock).toHaveBeenCalledTimes(1);
+			expect(enforceDataRetentionMock).toHaveBeenCalledTimes(1);
+		});
+
 		it("redacts oauth state from logged oauth URL", async () => {
 			const authModule = await import("../lib/auth/auth.js");
 			const loggerModule = await import("../lib/logger.js");
@@ -696,6 +906,11 @@ describe("OpenAIOAuthPlugin", () => {
 				{ refreshToken: "r2", email: "user2@example.com" },
 			];
 			const result = await plugin.tool["codex-switch"].execute({ index: 2 });
+			const { MODEL_FAMILIES } = await import("../lib/prompts/codex.js");
+			expect(mockStorage.activeIndex).toBe(1);
+			for (const family of MODEL_FAMILIES) {
+				expect(mockStorage.activeIndexByFamily[family]).toBe(1);
+			}
 			expect(result).toContain("Switched to account");
 		});
 
@@ -731,13 +946,20 @@ describe("OpenAIOAuthPlugin", () => {
 		});
 
 		it("shows detailed status for accounts", async () => {
+			const now = Date.now();
 			mockStorage.accounts = [
-				{ refreshToken: "r1", email: "user@example.com", lastUsed: Date.now() - 60000 },
+				{
+					refreshToken: "r1",
+					email: "user@example.com",
+					lastUsed: now - 60000,
+					rateLimitResetTimes: { codex: now + 120000 },
+				},
 			];
 			mockStorage.activeIndexByFamily = { codex: 0 };
 			const result = await plugin.tool["codex-status"].execute();
 			expect(result).toContain("Account Status");
 			expect(result).toContain("Active index by model family");
+			expect(result).toContain("resets in");
 		});
 	});
 
@@ -791,9 +1013,13 @@ describe("OpenAIOAuthPlugin", () => {
 
 		it("handles removal of last account", async () => {
 			mockStorage.accounts = [{ refreshToken: "r1", email: "user@example.com" }];
+			mockStorage.activeIndex = 3;
+			mockStorage.activeIndexByFamily = { codex: 3, "gpt-5.1": 3 };
 			const result = await plugin.tool["codex-remove"].execute({ index: 1 });
 			expect(result).toContain("Removed");
 			expect(result).toContain("No accounts remaining");
+			expect(mockStorage.activeIndex).toBe(0);
+			expect(mockStorage.activeIndexByFamily).toEqual({});
 		});
 	});
 
@@ -1017,6 +1243,8 @@ describe("OpenAIOAuthPlugin fetch handler", () => {
 	beforeEach(() => {
 		vi.clearAllMocks();
 		syncCodexCliSelectionMock.mockClear();
+		loadQuotaCacheMock.mockReset();
+		loadQuotaCacheMock.mockResolvedValue({ byAccountId: {}, byEmail: {} });
 		mockStorage.accounts = [
 			{
 				accountId: "acc-1",
@@ -1051,6 +1279,16 @@ describe("OpenAIOAuthPlugin fetch handler", () => {
 		return { plugin, sdk, mockClient };
 	};
 
+	const createDeferred = <T>() => {
+		let resolve!: (value: T) => void;
+		let reject!: (error?: unknown) => void;
+		const promise = new Promise<T>((res, rej) => {
+			resolve = res;
+			reject = rej;
+		});
+		return { promise, resolve, reject };
+	};
+
 	it("returns success response for successful fetch", async () => {
 		globalThis.fetch = vi.fn().mockResolvedValue(
 			new Response(JSON.stringify({ content: "test" }), { status: 200 }),
@@ -1169,50 +1407,183 @@ describe("OpenAIOAuthPlugin fetch handler", () => {
 			consumeSpy.mockRestore();
 		});
 
-	it("treats timeout-triggered abort as network failure", async () => {
+	it("rotates immediately to next account on short-window 429", async () => {
 		const { AccountManager } = await import("../lib/accounts.js");
-		const configModule = await import("../lib/config.js");
-		const recordFailureSpy = vi.spyOn(AccountManager.prototype, "recordFailure");
-		const timeoutSpy = vi.spyOn(configModule, "getFetchTimeoutMs").mockReturnValueOnce(5);
-			globalThis.fetch = vi.fn((_: unknown, init?: { signal?: AbortSignal }) => {
-				return new Promise((_resolve, reject) => {
-					const signal = init?.signal;
-					if (!signal) {
-						reject(new Error("missing signal"));
-						return;
-					}
-					if (signal.aborted) {
-						reject(Object.assign(new Error("timeout"), { name: "AbortError" }));
-						return;
-					}
-					signal.addEventListener(
-						"abort",
-						() => reject(Object.assign(new Error("timeout"), { name: "AbortError" })),
-						{ once: true },
-					);
-				});
-			});
+		const fetchHelpers = await import("../lib/request/fetch-helpers.js");
+		const accountOne = {
+			index: 0,
+			accountId: "acc-1",
+			email: "user1@example.com",
+			refreshToken: "refresh-1",
+			rateLimitResetTimes: {},
+		};
+		const accountTwo = {
+			index: 1,
+			accountId: "acc-2",
+			email: "user2@example.com",
+			refreshToken: "refresh-2",
+			rateLimitResetTimes: {},
+		};
+		const countSpy = vi
+			.spyOn(AccountManager.prototype, "getAccountCount")
+			.mockReturnValue(2);
+		const selectionSpy = vi
+			.spyOn(AccountManager.prototype, "getCurrentOrNextForFamilyHybrid")
+			.mockImplementationOnce(() => accountOne as never)
+			.mockImplementationOnce(() => accountTwo as never)
+			.mockImplementation(() => null as never);
+		const snapshotSpy = vi
+			.spyOn(AccountManager.prototype, "getAccountsSnapshot")
+			.mockReturnValue([accountOne, accountTwo] as never);
+		const getByIndexSpy = vi
+			.spyOn(AccountManager.prototype, "getAccountByIndex")
+			.mockImplementation((index: number) =>
+				(index === 0 ? accountOne : index === 1 ? accountTwo : null) as never,
+			);
+		const toAuthSpy = vi
+			.spyOn(AccountManager.prototype, "toAuthDetails")
+			.mockImplementation((account: { accountId?: string }) => ({
+				type: "oauth" as const,
+				access: `access-${account.accountId ?? "unknown"}`,
+				refresh: `refresh-${account.accountId ?? "unknown"}`,
+				expires: Date.now() + 60_000,
+			}));
+		const rateLimitSpy = vi.spyOn(AccountManager.prototype, "markRateLimitedWithReason");
+		vi.mocked(fetchHelpers.createCodexHeaders).mockImplementation(
+			(_init, _accountId, accessToken) =>
+				new Headers({ "x-test-access-token": String(accessToken ?? "") }),
+		);
+		vi.mocked(fetchHelpers.handleErrorResponse).mockResolvedValueOnce({
+			response: new Response("rate limited", { status: 429 }),
+			rateLimit: { retryAfterMs: 1_000, code: "rate_limit_exceeded" },
+			errorBody: {},
+		} as never);
+		globalThis.fetch = vi
+			.fn()
+			.mockResolvedValueOnce(new Response("rate limited", { status: 429 }))
+			.mockResolvedValueOnce(
+				new Response(JSON.stringify({ content: "ok" }), { status: 200 }),
+			);
 
-			const { sdk } = await setupPlugin();
+		const { sdk } = await setupPlugin();
 		const response = await sdk.fetch!("https://api.openai.com/v1/chat", {
 			method: "POST",
 			body: JSON.stringify({ model: "gpt-5.1" }),
 		});
 
-		expect(response.status).toBe(503);
-		expect(recordFailureSpy).toHaveBeenCalled();
-		recordFailureSpy.mockRestore();
-		timeoutSpy.mockRestore();
+		expect(response.status).toBe(200);
+		expect(globalThis.fetch).toHaveBeenCalledTimes(2);
+		const firstHeaders = new Headers(
+			(vi.mocked(globalThis.fetch).mock.calls[0]?.[1] as RequestInit)?.headers,
+		);
+		const secondHeaders = new Headers(
+			(vi.mocked(globalThis.fetch).mock.calls[1]?.[1] as RequestInit)?.headers,
+		);
+		expect(firstHeaders.get("x-test-access-token")).toBe("access-acc-1");
+		expect(secondHeaders.get("x-test-access-token")).toBe("access-acc-2");
+		expect(rateLimitSpy).toHaveBeenCalled();
+		countSpy.mockRestore();
+		selectionSpy.mockRestore();
+		snapshotSpy.mockRestore();
+		getByIndexSpy.mockRestore();
+		toAuthSpy.mockRestore();
+		rateLimitSpy.mockRestore();
 	});
 
-	it("uses numeric retry-after hints for server cooldown decisions", async () => {
+	it("uses quota cache bootstrap to skip an already rate-limited account via normalized email fallback", async () => {
+		const now = Date.now();
 		const { AccountManager } = await import("../lib/accounts.js");
-		const cooldownSpy = vi.spyOn(AccountManager.prototype, "markAccountCoolingDown");
+		const fetchHelpers = await import("../lib/request/fetch-helpers.js");
+		const accountOne = {
+			index: 0,
+			accountId: "missing-acc-1",
+			email: "  USER1@Example.com  ",
+			refreshToken: "refresh-1",
+			rateLimitResetTimes: {},
+		};
+		const accountTwo = {
+			index: 1,
+			accountId: "acc-2",
+			email: "user2@example.com",
+			refreshToken: "refresh-2",
+			rateLimitResetTimes: {},
+		};
+		loadQuotaCacheMock.mockResolvedValueOnce({
+			byAccountId: {},
+			byEmail: {
+				"user1@example.com": {
+					updatedAt: now,
+					status: 429,
+					model: "gpt-5.1",
+					primary: {
+						usedPercent: 100,
+						resetAtMs: now + 5 * 60_000,
+					},
+					secondary: {},
+				},
+			},
+		});
+		const countSpy = vi
+			.spyOn(AccountManager.prototype, "getAccountCount")
+			.mockReturnValue(2);
+		const selectionSpy = vi
+			.spyOn(AccountManager.prototype, "getCurrentOrNextForFamilyHybrid")
+			.mockImplementation((family: string, model?: string | null) => {
+				const nowMs = Date.now();
+				const accounts = [accountOne, accountTwo];
+				const modelKey = model ? `${family}:${model}` : family;
+				for (const candidate of accounts) {
+					const resets = candidate.rateLimitResetTimes ?? {};
+					const blockedUntil = Math.max(
+						resets[family] ?? 0,
+						resets[modelKey] ?? 0,
+					);
+					if (blockedUntil <= nowMs) {
+						return candidate as never;
+					}
+				}
+				return null as never;
+			});
+		const snapshotSpy = vi
+			.spyOn(AccountManager.prototype, "getAccountsSnapshot")
+			.mockReturnValue([accountOne, accountTwo] as never);
+		const getByIndexSpy = vi
+			.spyOn(AccountManager.prototype, "getAccountByIndex")
+			.mockImplementation((index: number) =>
+				(index === 0 ? accountOne : index === 1 ? accountTwo : null) as never,
+			);
+		const toAuthSpy = vi
+			.spyOn(AccountManager.prototype, "toAuthDetails")
+			.mockImplementation((account: { accountId?: string }) => ({
+				type: "oauth" as const,
+				access: `access-${account.accountId ?? "unknown"}`,
+				refresh: `refresh-${account.accountId ?? "unknown"}`,
+				expires: Date.now() + 60_000,
+			}));
+		const markRateLimitSpy = vi
+			.spyOn(AccountManager.prototype, "markRateLimitedWithReason")
+			.mockImplementation(
+				(
+					account: { rateLimitResetTimes?: Record<string, number> },
+					waitMs: number,
+					family: string,
+					_reason?: string,
+					model?: string | null,
+				) => {
+					const resetAt = Date.now() + waitMs;
+					account.rateLimitResetTimes = account.rateLimitResetTimes ?? {};
+					account.rateLimitResetTimes[family] = resetAt;
+					if (model) {
+						account.rateLimitResetTimes[`${family}:${model}`] = resetAt;
+					}
+				},
+			);
+		vi.mocked(fetchHelpers.createCodexHeaders).mockImplementation(
+			(_init, _accountId, accessToken) =>
+				new Headers({ "x-test-access-token": String(accessToken ?? "") }),
+		);
 		globalThis.fetch = vi.fn().mockResolvedValue(
-			new Response("server error", {
-				status: 500,
-				headers: new Headers({ "retry-after": "5" }),
-			}),
+			new Response(JSON.stringify({ content: "ok" }), { status: 200 }),
 		);
 
 		const { sdk } = await setupPlugin();
@@ -1221,76 +1592,1377 @@ describe("OpenAIOAuthPlugin fetch handler", () => {
 			body: JSON.stringify({ model: "gpt-5.1" }),
 		});
 
-		expect(response.status).toBe(503);
-		expect(cooldownSpy).toHaveBeenCalled();
-		expect(cooldownSpy.mock.calls[0]?.[1]).toBe(5000);
-		cooldownSpy.mockRestore();
+		expect(response.status).toBe(200);
+		expect(globalThis.fetch).toHaveBeenCalledTimes(1);
+		const headers = new Headers(
+			(vi.mocked(globalThis.fetch).mock.calls[0]?.[1] as RequestInit)?.headers,
+		);
+		expect(headers.get("x-test-access-token")).toBe("access-acc-2");
+		expect(loadQuotaCacheMock).toHaveBeenCalled();
+		countSpy.mockRestore();
+		selectionSpy.mockRestore();
+		snapshotSpy.mockRestore();
+		getByIndexSpy.mockRestore();
+		toAuthSpy.mockRestore();
+		markRateLimitSpy.mockRestore();
 	});
 
-	it("uses retry-after-ms hints for server cooldown decisions", async () => {
+	it("matches quota bootstrap entries when requested model ids differ by provider prefix or casing", async () => {
+		const now = Date.now();
 		const { AccountManager } = await import("../lib/accounts.js");
-		const cooldownSpy = vi.spyOn(AccountManager.prototype, "markAccountCoolingDown");
-		globalThis.fetch = vi.fn().mockResolvedValue(
-			new Response("server error", {
-				status: 500,
-				headers: new Headers({ "retry-after-ms": "4500" }),
+		const fetchHelpers = await import("../lib/request/fetch-helpers.js");
+		const accountOne = {
+			index: 0,
+			accountId: "acc-1",
+			email: "user1@example.com",
+			refreshToken: "refresh-1",
+			rateLimitResetTimes: {},
+		};
+		const accountTwo = {
+			index: 1,
+			accountId: "acc-2",
+			email: "user2@example.com",
+			refreshToken: "refresh-2",
+			rateLimitResetTimes: {},
+		};
+		loadQuotaCacheMock.mockResolvedValueOnce({
+			byAccountId: {
+				"acc-1": {
+					updatedAt: now,
+					status: 429,
+					model: "gpt-5.1",
+					primary: {
+						usedPercent: 100,
+						resetAtMs: now + 5 * 60_000,
+					},
+					secondary: {},
+				},
+			},
+			byEmail: {},
+		});
+		const countSpy = vi
+			.spyOn(AccountManager.prototype, "getAccountCount")
+			.mockReturnValue(2);
+		const selectionSpy = vi
+			.spyOn(AccountManager.prototype, "getCurrentOrNextForFamilyHybrid")
+			.mockImplementation((family: string, model?: string | null) => {
+				const nowMs = Date.now();
+				const accounts = [accountOne, accountTwo];
+				const modelKey = model ? `${family}:${model}` : family;
+				for (const candidate of accounts) {
+					const resets = candidate.rateLimitResetTimes ?? {};
+					const blockedUntil = Math.max(
+						resets[family] ?? 0,
+						resets[modelKey] ?? 0,
+					);
+					if (blockedUntil <= nowMs) {
+						return candidate as never;
+					}
+				}
+				return null as never;
+			});
+		const snapshotSpy = vi
+			.spyOn(AccountManager.prototype, "getAccountsSnapshot")
+			.mockReturnValue([accountOne, accountTwo] as never);
+		const getByIndexSpy = vi
+			.spyOn(AccountManager.prototype, "getAccountByIndex")
+			.mockImplementation((index: number) =>
+				(index === 0 ? accountOne : index === 1 ? accountTwo : null) as never,
+			);
+		const toAuthSpy = vi
+			.spyOn(AccountManager.prototype, "toAuthDetails")
+			.mockImplementation((account: { accountId?: string }) => ({
+				type: "oauth" as const,
+				access: `access-${account.accountId ?? "unknown"}`,
+				refresh: `refresh-${account.accountId ?? "unknown"}`,
+				expires: Date.now() + 60_000,
+			}));
+		const markRateLimitSpy = vi
+			.spyOn(AccountManager.prototype, "markRateLimitedWithReason")
+			.mockImplementation(
+				(
+					account: { rateLimitResetTimes?: Record<string, number> },
+					waitMs: number,
+					family: string,
+					_reason?: string,
+					model?: string | null,
+				) => {
+					const resetAt = Date.now() + waitMs;
+					account.rateLimitResetTimes = account.rateLimitResetTimes ?? {};
+					account.rateLimitResetTimes[family] = resetAt;
+					if (model) {
+						account.rateLimitResetTimes[`${family}:${model}`] = resetAt;
+					}
+				},
+			);
+		vi.mocked(fetchHelpers.transformRequestForCodex).mockImplementationOnce(
+			async (init: unknown) => ({
+				updatedInit: init,
+				body: { model: "OpenAI/GPT-5.1" },
 			}),
 		);
+		vi.mocked(fetchHelpers.createCodexHeaders).mockImplementation(
+			(_init, _accountId, accessToken) =>
+				new Headers({ "x-test-access-token": String(accessToken ?? "") }),
+		);
+		globalThis.fetch = vi.fn().mockResolvedValue(
+			new Response(JSON.stringify({ content: "ok" }), { status: 200 }),
+		);
 
 		const { sdk } = await setupPlugin();
 		const response = await sdk.fetch!("https://api.openai.com/v1/chat", {
 			method: "POST",
-			body: JSON.stringify({ model: "gpt-5.1" }),
+			body: JSON.stringify({ model: "OpenAI/GPT-5.1" }),
 		});
 
-		expect(response.status).toBe(503);
-		expect(cooldownSpy).toHaveBeenCalled();
-		expect(cooldownSpy.mock.calls[0]?.[1]).toBe(4500);
-		cooldownSpy.mockRestore();
+		expect(response.status).toBe(200);
+		expect(globalThis.fetch).toHaveBeenCalledTimes(1);
+		const headers = new Headers(
+			(vi.mocked(globalThis.fetch).mock.calls[0]?.[1] as RequestInit)?.headers,
+		);
+		expect(headers.get("x-test-access-token")).toBe("access-acc-2");
+		expect(markRateLimitSpy).toHaveBeenCalled();
+		countSpy.mockRestore();
+		selectionSpy.mockRestore();
+		snapshotSpy.mockRestore();
+		getByIndexSpy.mockRestore();
+		toAuthSpy.mockRestore();
+		markRateLimitSpy.mockRestore();
 	});
 
-	it("parses x-ratelimit-reset seconds hints for server cooldown decisions", async () => {
-		const baseNow = 1_700_000_000_000;
-		const dateNowSpy = vi.spyOn(Date, "now").mockReturnValue(baseNow);
-		const resetAtSeconds = Math.floor((baseNow + 7_000) / 1000);
+	it("ignores quota bootstrap entries for a different model in the same family", async () => {
+		const now = Date.now();
 		const { AccountManager } = await import("../lib/accounts.js");
-		const cooldownSpy = vi.spyOn(AccountManager.prototype, "markAccountCoolingDown");
-		globalThis.fetch = vi.fn().mockResolvedValue(
-			new Response("server error", {
-				status: 500,
-				headers: new Headers({ "x-ratelimit-reset": String(resetAtSeconds) }),
+		const fetchHelpers = await import("../lib/request/fetch-helpers.js");
+		const accountOne = {
+			index: 0,
+			accountId: "acc-1",
+			email: "user1@example.com",
+			refreshToken: "refresh-1",
+			rateLimitResetTimes: {},
+		};
+		const accountTwo = {
+			index: 1,
+			accountId: "acc-2",
+			email: "user2@example.com",
+			refreshToken: "refresh-2",
+			rateLimitResetTimes: {},
+		};
+		loadQuotaCacheMock.mockResolvedValueOnce({
+			byAccountId: {
+				"acc-1": {
+					updatedAt: now,
+					status: 429,
+					model: "gpt-5.1",
+					primary: {
+						usedPercent: 100,
+						resetAtMs: now + 5 * 60_000,
+					},
+					secondary: {},
+				},
+			},
+			byEmail: {},
+		});
+		const countSpy = vi
+			.spyOn(AccountManager.prototype, "getAccountCount")
+			.mockReturnValue(2);
+		const selectionSpy = vi
+			.spyOn(AccountManager.prototype, "getCurrentOrNextForFamilyHybrid")
+			.mockImplementation((family: string, model?: string | null) => {
+				const nowMs = Date.now();
+				const accounts = [accountOne, accountTwo];
+				const modelKey = model ? `${family}:${model}` : family;
+				for (const candidate of accounts) {
+					const resets = candidate.rateLimitResetTimes ?? {};
+					const blockedUntil = Math.max(
+						resets[family] ?? 0,
+						resets[modelKey] ?? 0,
+					);
+					if (blockedUntil <= nowMs) {
+						return candidate as never;
+					}
+				}
+				return null as never;
+			});
+		const snapshotSpy = vi
+			.spyOn(AccountManager.prototype, "getAccountsSnapshot")
+			.mockReturnValue([accountOne, accountTwo] as never);
+		const getByIndexSpy = vi
+			.spyOn(AccountManager.prototype, "getAccountByIndex")
+			.mockImplementation((index: number) =>
+				(index === 0 ? accountOne : index === 1 ? accountTwo : null) as never,
+			);
+		const toAuthSpy = vi
+			.spyOn(AccountManager.prototype, "toAuthDetails")
+			.mockImplementation((account: { accountId?: string }) => ({
+				type: "oauth" as const,
+				access: `access-${account.accountId ?? "unknown"}`,
+				refresh: `refresh-${account.accountId ?? "unknown"}`,
+				expires: Date.now() + 60_000,
+			}));
+		const markRateLimitSpy = vi
+			.spyOn(AccountManager.prototype, "markRateLimitedWithReason")
+			.mockImplementation(
+				(
+					account: { rateLimitResetTimes?: Record<string, number> },
+					waitMs: number,
+					family: string,
+					_reason?: string,
+					model?: string | null,
+				) => {
+					const resetAt = Date.now() + waitMs;
+					account.rateLimitResetTimes = account.rateLimitResetTimes ?? {};
+					account.rateLimitResetTimes[family] = resetAt;
+					if (model) {
+						account.rateLimitResetTimes[`${family}:${model}`] = resetAt;
+					}
+				},
+			);
+		vi.mocked(fetchHelpers.transformRequestForCodex).mockImplementationOnce(
+			async (init: unknown) => ({
+				updatedInit: init,
+				body: { model: "gpt-5.1-mini" },
 			}),
 		);
+		vi.mocked(fetchHelpers.createCodexHeaders).mockImplementation(
+			(_init, _accountId, accessToken) =>
+				new Headers({ "x-test-access-token": String(accessToken ?? "") }),
+		);
+		globalThis.fetch = vi.fn().mockResolvedValue(
+			new Response(JSON.stringify({ content: "ok" }), { status: 200 }),
+		);
 
 		const { sdk } = await setupPlugin();
 		const response = await sdk.fetch!("https://api.openai.com/v1/chat", {
 			method: "POST",
-			body: JSON.stringify({ model: "gpt-5.1" }),
+			body: JSON.stringify({ model: "gpt-5.1-mini" }),
 		});
 
-		expect(response.status).toBe(503);
-		expect(cooldownSpy).toHaveBeenCalled();
-		expect(cooldownSpy.mock.calls[0]?.[1]).toBe(7000);
-		cooldownSpy.mockRestore();
-		dateNowSpy.mockRestore();
+		expect(response.status).toBe(200);
+		expect(globalThis.fetch).toHaveBeenCalledTimes(1);
+		const headers = new Headers(
+			(vi.mocked(globalThis.fetch).mock.calls[0]?.[1] as RequestInit)?.headers,
+		);
+		expect(headers.get("x-test-access-token")).toBe("access-acc-1");
+		expect(markRateLimitSpy).not.toHaveBeenCalled();
+		countSpy.mockRestore();
+		selectionSpy.mockRestore();
+		snapshotSpy.mockRestore();
+		getByIndexSpy.mockRestore();
+		toAuthSpy.mockRestore();
+		markRateLimitSpy.mockRestore();
 	});
 
-	it("parses x-ratelimit-reset millisecond hints for server cooldown decisions", async () => {
-		const baseNow = 1_700_000_000_000;
-		const dateNowSpy = vi.spyOn(Date, "now").mockReturnValue(baseNow);
-		const resetAtMs = baseNow + 12_000;
+	it("matches semantically equivalent model ids while bootstrapping quota entries", async () => {
+		const now = Date.now();
 		const { AccountManager } = await import("../lib/accounts.js");
-		const cooldownSpy = vi.spyOn(AccountManager.prototype, "markAccountCoolingDown");
-		globalThis.fetch = vi.fn().mockResolvedValue(
-			new Response("server error", {
-				status: 500,
-				headers: new Headers({ "x-ratelimit-reset": String(resetAtMs) }),
-			}),
-		);
-
-		const { sdk } = await setupPlugin();
-		const response = await sdk.fetch!("https://api.openai.com/v1/chat", {
-			method: "POST",
+		const fetchHelpers = await import("../lib/request/fetch-helpers.js");
+		const accountOne = {
+			index: 0,
+			accountId: "acc-1",
+			email: "user1@example.com",
+			refreshToken: "refresh-1",
+			rateLimitResetTimes: {},
+		};
+		const accountTwo = {
+			index: 1,
+			accountId: "acc-2",
+			email: "user2@example.com",
+			refreshToken: "refresh-2",
+			rateLimitResetTimes: {},
+		};
+		loadQuotaCacheMock.mockResolvedValueOnce({
+			byAccountId: {
+				"acc-1": {
+					updatedAt: now,
+					status: 429,
+					model: "OPENAI/GPT-5.1",
+					primary: {
+						usedPercent: 100,
+						resetAtMs: now + 5 * 60_000,
+					},
+					secondary: {},
+				},
+			},
+			byEmail: {},
+		});
+		const countSpy = vi
+			.spyOn(AccountManager.prototype, "getAccountCount")
+			.mockReturnValue(2);
+		const selectionSpy = vi
+			.spyOn(AccountManager.prototype, "getCurrentOrNextForFamilyHybrid")
+			.mockImplementation((family: string, model?: string | null) => {
+				const nowMs = Date.now();
+				const accounts = [accountOne, accountTwo];
+				const modelKey = model ? `${family}:${model}` : family;
+				for (const candidate of accounts) {
+					const resets = candidate.rateLimitResetTimes ?? {};
+					const blockedUntil = Math.max(
+						resets[family] ?? 0,
+						resets[modelKey] ?? 0,
+					);
+					if (blockedUntil <= nowMs) {
+						return candidate as never;
+					}
+				}
+				return null as never;
+			});
+		const snapshotSpy = vi
+			.spyOn(AccountManager.prototype, "getAccountsSnapshot")
+			.mockReturnValue([accountOne, accountTwo] as never);
+		const getByIndexSpy = vi
+			.spyOn(AccountManager.prototype, "getAccountByIndex")
+			.mockImplementation((index: number) =>
+				(index === 0 ? accountOne : index === 1 ? accountTwo : null) as never,
+			);
+		const toAuthSpy = vi
+			.spyOn(AccountManager.prototype, "toAuthDetails")
+			.mockImplementation((account: { accountId?: string }) => ({
+				type: "oauth" as const,
+				access: `access-${account.accountId ?? "unknown"}`,
+				refresh: `refresh-${account.accountId ?? "unknown"}`,
+				expires: Date.now() + 60_000,
+			}));
+		const markRateLimitSpy = vi
+			.spyOn(AccountManager.prototype, "markRateLimitedWithReason")
+			.mockImplementation(
+				(
+					account: { rateLimitResetTimes?: Record<string, number> },
+					waitMs: number,
+					family: string,
+					_reason?: string,
+					model?: string | null,
+				) => {
+					const resetAt = Date.now() + waitMs;
+					account.rateLimitResetTimes = account.rateLimitResetTimes ?? {};
+					account.rateLimitResetTimes[family] = resetAt;
+					if (model) {
+						account.rateLimitResetTimes[`${family}:${model}`] = resetAt;
+					}
+				},
+			);
+		vi.mocked(fetchHelpers.transformRequestForCodex).mockImplementationOnce(
+			async (init: unknown) => ({
+				updatedInit: init,
+				body: { model: "openai/gpt-5.1" },
+			}),
+		);
+		vi.mocked(fetchHelpers.createCodexHeaders).mockImplementation(
+			(_init, _accountId, accessToken) =>
+				new Headers({ "x-test-access-token": String(accessToken ?? "") }),
+		);
+		globalThis.fetch = vi.fn().mockResolvedValue(
+			new Response(JSON.stringify({ content: "ok" }), { status: 200 }),
+		);
+
+		const { sdk } = await setupPlugin();
+		const response = await sdk.fetch!("https://api.openai.com/v1/chat", {
+			method: "POST",
+			body: JSON.stringify({ model: "openai/gpt-5.1" }),
+		});
+
+		expect(response.status).toBe(200);
+		expect(globalThis.fetch).toHaveBeenCalledTimes(1);
+		const headers = new Headers(
+			(vi.mocked(globalThis.fetch).mock.calls[0]?.[1] as RequestInit)?.headers,
+		);
+		expect(headers.get("x-test-access-token")).toBe("access-acc-2");
+		expect(markRateLimitSpy).toHaveBeenCalled();
+		countSpy.mockRestore();
+		selectionSpy.mockRestore();
+		snapshotSpy.mockRestore();
+		getByIndexSpy.mockRestore();
+		toAuthSpy.mockRestore();
+		markRateLimitSpy.mockRestore();
+	});
+
+	it("does not apply ttl fallback when quota reset timestamps are elapsed", async () => {
+		const now = Date.now();
+		const { AccountManager } = await import("../lib/accounts.js");
+		const fetchHelpers = await import("../lib/request/fetch-helpers.js");
+		const accountOne = {
+			index: 0,
+			accountId: "acc-1",
+			email: "user1@example.com",
+			refreshToken: "refresh-1",
+			rateLimitResetTimes: {},
+		};
+		const accountTwo = {
+			index: 1,
+			accountId: "acc-2",
+			email: "user2@example.com",
+			refreshToken: "refresh-2",
+			rateLimitResetTimes: {},
+		};
+		loadQuotaCacheMock.mockResolvedValueOnce({
+			byAccountId: {
+				"acc-1": {
+					updatedAt: now,
+					status: 429,
+					model: "gpt-5.1",
+					primary: {
+						usedPercent: 100,
+						resetAtMs: now - 60_000,
+					},
+					secondary: {
+						usedPercent: 100,
+						resetAtMs: now - 30_000,
+					},
+				},
+			},
+			byEmail: {},
+		});
+		const countSpy = vi
+			.spyOn(AccountManager.prototype, "getAccountCount")
+			.mockReturnValue(2);
+		const selectionSpy = vi
+			.spyOn(AccountManager.prototype, "getCurrentOrNextForFamilyHybrid")
+			.mockImplementation((family: string, model?: string | null) => {
+				const nowMs = Date.now();
+				const accounts = [accountOne, accountTwo];
+				const modelKey = model ? `${family}:${model}` : family;
+				for (const candidate of accounts) {
+					const resets = candidate.rateLimitResetTimes ?? {};
+					const blockedUntil = Math.max(
+						resets[family] ?? 0,
+						resets[modelKey] ?? 0,
+					);
+					if (blockedUntil <= nowMs) {
+						return candidate as never;
+					}
+				}
+				return null as never;
+			});
+		const snapshotSpy = vi
+			.spyOn(AccountManager.prototype, "getAccountsSnapshot")
+			.mockReturnValue([accountOne, accountTwo] as never);
+		const getByIndexSpy = vi
+			.spyOn(AccountManager.prototype, "getAccountByIndex")
+			.mockImplementation((index: number) =>
+				(index === 0 ? accountOne : index === 1 ? accountTwo : null) as never,
+			);
+		const toAuthSpy = vi
+			.spyOn(AccountManager.prototype, "toAuthDetails")
+			.mockImplementation((account: { accountId?: string }) => ({
+				type: "oauth" as const,
+				access: `access-${account.accountId ?? "unknown"}`,
+				refresh: `refresh-${account.accountId ?? "unknown"}`,
+				expires: Date.now() + 60_000,
+			}));
+		const markRateLimitSpy = vi
+			.spyOn(AccountManager.prototype, "markRateLimitedWithReason")
+			.mockImplementation(
+				(
+					account: { rateLimitResetTimes?: Record<string, number> },
+					waitMs: number,
+					family: string,
+					_reason?: string,
+					model?: string | null,
+				) => {
+					const resetAt = Date.now() + waitMs;
+					account.rateLimitResetTimes = account.rateLimitResetTimes ?? {};
+					account.rateLimitResetTimes[family] = resetAt;
+					if (model) {
+						account.rateLimitResetTimes[`${family}:${model}`] = resetAt;
+					}
+				},
+			);
+		vi.mocked(fetchHelpers.createCodexHeaders).mockImplementation(
+			(_init, _accountId, accessToken) =>
+				new Headers({ "x-test-access-token": String(accessToken ?? "") }),
+		);
+		globalThis.fetch = vi.fn().mockResolvedValue(
+			new Response(JSON.stringify({ content: "ok" }), { status: 200 }),
+		);
+
+		const { sdk } = await setupPlugin();
+		const response = await sdk.fetch!("https://api.openai.com/v1/chat", {
+			method: "POST",
+			body: JSON.stringify({ model: "gpt-5.1" }),
+		});
+
+		expect(response.status).toBe(200);
+		expect(globalThis.fetch).toHaveBeenCalledTimes(1);
+		const headers = new Headers(
+			(vi.mocked(globalThis.fetch).mock.calls[0]?.[1] as RequestInit)?.headers,
+		);
+		expect(headers.get("x-test-access-token")).toBe("access-acc-1");
+		expect(markRateLimitSpy).not.toHaveBeenCalled();
+		countSpy.mockRestore();
+		selectionSpy.mockRestore();
+		snapshotSpy.mockRestore();
+		getByIndexSpy.mockRestore();
+		toAuthSpy.mockRestore();
+		markRateLimitSpy.mockRestore();
+	});
+
+	it("does not block accounts when quota reset times are known but already elapsed", async () => {
+		const now = Date.now();
+		const { AccountManager } = await import("../lib/accounts.js");
+		const fetchHelpers = await import("../lib/request/fetch-helpers.js");
+		const accountOne = {
+			index: 0,
+			accountId: "acc-1",
+			email: "user1@example.com",
+			refreshToken: "refresh-1",
+			rateLimitResetTimes: {},
+		};
+		const accountTwo = {
+			index: 1,
+			accountId: "acc-2",
+			email: "user2@example.com",
+			refreshToken: "refresh-2",
+			rateLimitResetTimes: {},
+		};
+		loadQuotaCacheMock.mockResolvedValueOnce({
+			byAccountId: {
+				"acc-1": {
+					updatedAt: now,
+					status: 429,
+					model: "gpt-5.1",
+					primary: {
+						usedPercent: 100,
+						resetAtMs: now - 5 * 60_000,
+					},
+					secondary: {
+						usedPercent: 100,
+						resetAtMs: now - 60_000,
+					},
+				},
+			},
+			byEmail: {},
+		});
+		const countSpy = vi
+			.spyOn(AccountManager.prototype, "getAccountCount")
+			.mockReturnValue(2);
+		const selectionSpy = vi
+			.spyOn(AccountManager.prototype, "getCurrentOrNextForFamilyHybrid")
+			.mockImplementation((family: string, model?: string | null) => {
+				const nowMs = Date.now();
+				const accounts = [accountOne, accountTwo];
+				const modelKey = model ? `${family}:${model}` : family;
+				for (const candidate of accounts) {
+					const resets = candidate.rateLimitResetTimes ?? {};
+					const blockedUntil = Math.max(
+						resets[family] ?? 0,
+						resets[modelKey] ?? 0,
+					);
+					if (blockedUntil <= nowMs) {
+						return candidate as never;
+					}
+				}
+				return null as never;
+			});
+		const snapshotSpy = vi
+			.spyOn(AccountManager.prototype, "getAccountsSnapshot")
+			.mockReturnValue([accountOne, accountTwo] as never);
+		const getByIndexSpy = vi
+			.spyOn(AccountManager.prototype, "getAccountByIndex")
+			.mockImplementation((index: number) =>
+				(index === 0 ? accountOne : index === 1 ? accountTwo : null) as never,
+			);
+		const toAuthSpy = vi
+			.spyOn(AccountManager.prototype, "toAuthDetails")
+			.mockImplementation((account: { accountId?: string }) => ({
+				type: "oauth" as const,
+				access: `access-${account.accountId ?? "unknown"}`,
+				refresh: `refresh-${account.accountId ?? "unknown"}`,
+				expires: Date.now() + 60_000,
+			}));
+		const markRateLimitSpy = vi.spyOn(AccountManager.prototype, "markRateLimitedWithReason");
+		vi.mocked(fetchHelpers.createCodexHeaders).mockImplementation(
+			(_init, _accountId, accessToken) =>
+				new Headers({ "x-test-access-token": String(accessToken ?? "") }),
+		);
+		globalThis.fetch = vi.fn().mockResolvedValue(
+			new Response(JSON.stringify({ content: "ok" }), { status: 200 }),
+		);
+
+		const { sdk } = await setupPlugin();
+		const response = await sdk.fetch!("https://api.openai.com/v1/chat", {
+			method: "POST",
+			body: JSON.stringify({ model: "gpt-5.1" }),
+		});
+
+		expect(response.status).toBe(200);
+		expect(globalThis.fetch).toHaveBeenCalledTimes(1);
+		const headers = new Headers(
+			(vi.mocked(globalThis.fetch).mock.calls[0]?.[1] as RequestInit)?.headers,
+		);
+		expect(headers.get("x-test-access-token")).toBe("access-acc-1");
+		expect(markRateLimitSpy).not.toHaveBeenCalled();
+		countSpy.mockRestore();
+		selectionSpy.mockRestore();
+		snapshotSpy.mockRestore();
+		getByIndexSpy.mockRestore();
+		toAuthSpy.mockRestore();
+		markRateLimitSpy.mockRestore();
+	});
+
+	it("uses the furthest quota reset window when bootstrapping rate limits", async () => {
+		const now = Date.now();
+		const { AccountManager } = await import("../lib/accounts.js");
+		const fetchHelpers = await import("../lib/request/fetch-helpers.js");
+		const accountOne = {
+			index: 0,
+			accountId: "acc-1",
+			email: "user1@example.com",
+			refreshToken: "refresh-1",
+			rateLimitResetTimes: {},
+		};
+		const accountTwo = {
+			index: 1,
+			accountId: "acc-2",
+			email: "user2@example.com",
+			refreshToken: "refresh-2",
+			rateLimitResetTimes: {},
+		};
+		loadQuotaCacheMock.mockResolvedValueOnce({
+			byAccountId: {
+				"acc-1": {
+					updatedAt: now,
+					status: 429,
+					model: "gpt-5.1",
+					primary: {
+						usedPercent: 100,
+						resetAtMs: now + 60_000,
+					},
+					secondary: {
+						usedPercent: 100,
+						resetAtMs: now + 5 * 60_000,
+					},
+				},
+			},
+			byEmail: {},
+		});
+		const countSpy = vi
+			.spyOn(AccountManager.prototype, "getAccountCount")
+			.mockReturnValue(2);
+		const selectionSpy = vi
+			.spyOn(AccountManager.prototype, "getCurrentOrNextForFamilyHybrid")
+			.mockImplementation((family: string, model?: string | null) => {
+				const nowMs = Date.now();
+				const accounts = [accountOne, accountTwo];
+				const modelKey = model ? `${family}:${model}` : family;
+				for (const candidate of accounts) {
+					const resets = candidate.rateLimitResetTimes ?? {};
+					const blockedUntil = Math.max(
+						resets[family] ?? 0,
+						resets[modelKey] ?? 0,
+					);
+					if (blockedUntil <= nowMs) {
+						return candidate as never;
+					}
+				}
+				return null as never;
+			});
+		const snapshotSpy = vi
+			.spyOn(AccountManager.prototype, "getAccountsSnapshot")
+			.mockReturnValue([accountOne, accountTwo] as never);
+		const getByIndexSpy = vi
+			.spyOn(AccountManager.prototype, "getAccountByIndex")
+			.mockImplementation((index: number) =>
+				(index === 0 ? accountOne : index === 1 ? accountTwo : null) as never,
+			);
+		const toAuthSpy = vi
+			.spyOn(AccountManager.prototype, "toAuthDetails")
+			.mockImplementation((account: { accountId?: string }) => ({
+				type: "oauth" as const,
+				access: `access-${account.accountId ?? "unknown"}`,
+				refresh: `refresh-${account.accountId ?? "unknown"}`,
+				expires: Date.now() + 60_000,
+			}));
+		const markRateLimitSpy = vi
+			.spyOn(AccountManager.prototype, "markRateLimitedWithReason")
+			.mockImplementation(
+				(
+					account: { rateLimitResetTimes?: Record<string, number> },
+					waitMs: number,
+					family: string,
+					_reason?: string,
+					model?: string | null,
+				) => {
+					const resetAt = Date.now() + waitMs;
+					account.rateLimitResetTimes = account.rateLimitResetTimes ?? {};
+					account.rateLimitResetTimes[family] = resetAt;
+					if (model) {
+						account.rateLimitResetTimes[`${family}:${model}`] = resetAt;
+					}
+				},
+			);
+		vi.mocked(fetchHelpers.createCodexHeaders).mockImplementation(
+			(_init, _accountId, accessToken) =>
+				new Headers({ "x-test-access-token": String(accessToken ?? "") }),
+		);
+		globalThis.fetch = vi.fn().mockResolvedValue(
+			new Response(JSON.stringify({ content: "ok" }), { status: 200 }),
+		);
+
+		const { sdk } = await setupPlugin();
+		const response = await sdk.fetch!("https://api.openai.com/v1/chat", {
+			method: "POST",
+			body: JSON.stringify({ model: "gpt-5.1" }),
+		});
+
+		expect(response.status).toBe(200);
+		expect(globalThis.fetch).toHaveBeenCalledTimes(1);
+		const headers = new Headers(
+			(vi.mocked(globalThis.fetch).mock.calls[0]?.[1] as RequestInit)?.headers,
+		);
+		expect(headers.get("x-test-access-token")).toBe("access-acc-2");
+		const bootstrapWaitMs = markRateLimitSpy.mock.calls
+			.map((call) => call[1])
+			.find((value): value is number => typeof value === "number");
+		expect(bootstrapWaitMs).toBeGreaterThanOrEqual(4 * 60_000);
+		countSpy.mockRestore();
+		selectionSpy.mockRestore();
+		snapshotSpy.mockRestore();
+		getByIndexSpy.mockRestore();
+		toAuthSpy.mockRestore();
+		markRateLimitSpy.mockRestore();
+	});
+
+	it("loads quota bootstrap cache once for concurrent fetch calls", async () => {
+		const testNow = Date.now() + 31 * 60_000;
+		const nowSpy = vi.spyOn(Date, "now").mockReturnValue(testNow);
+		const fetchHelpers = await import("../lib/request/fetch-helpers.js");
+		try {
+			const deferredLoad = createDeferred<{ byAccountId: Record<string, never>; byEmail: Record<string, never> }>();
+			const bootstrapLoadStarted = createDeferred<void>();
+			loadQuotaCacheMock.mockImplementationOnce(async () => {
+				bootstrapLoadStarted.resolve();
+				return deferredLoad.promise;
+			});
+			vi.mocked(fetchHelpers.createCodexHeaders).mockImplementation(
+				(_init, _accountId, accessToken) =>
+					new Headers({ "x-test-access-token": String(accessToken ?? "") }),
+			);
+			globalThis.fetch = vi.fn().mockResolvedValue(
+				new Response(JSON.stringify({ content: "ok" }), { status: 200 }),
+			);
+
+			const { sdk } = await setupPlugin();
+			const firstRequest = sdk.fetch!("https://api.openai.com/v1/chat", {
+				method: "POST",
+				body: JSON.stringify({ model: "gpt-5.1" }),
+			});
+			const secondRequest = sdk.fetch!("https://api.openai.com/v1/chat", {
+				method: "POST",
+				body: JSON.stringify({ model: "gpt-5.1" }),
+			});
+			await bootstrapLoadStarted.promise;
+
+			expect(loadQuotaCacheMock).toHaveBeenCalledTimes(1);
+			deferredLoad.resolve({ byAccountId: {}, byEmail: {} });
+			const [firstResponse, secondResponse] = await Promise.all([firstRequest, secondRequest]);
+			expect(firstResponse.status).toBe(200);
+			expect(secondResponse.status).toBe(200);
+			expect(globalThis.fetch).toHaveBeenCalledTimes(2);
+		} finally {
+			nowSpy.mockRestore();
+		}
+	});
+
+	it("caches valid empty quota bootstrap loads within ttl", async () => {
+		const fetchHelpers = await import("../lib/request/fetch-helpers.js");
+		loadQuotaCacheMock.mockResolvedValueOnce({ byAccountId: {}, byEmail: {} });
+		vi.mocked(fetchHelpers.createCodexHeaders).mockImplementation(
+			(_init, _accountId, accessToken) =>
+				new Headers({ "x-test-access-token": String(accessToken ?? "") }),
+		);
+		globalThis.fetch = vi.fn().mockResolvedValue(
+			new Response(JSON.stringify({ content: "ok" }), { status: 200 }),
+		);
+
+		const { sdk } = await setupPlugin();
+		const firstResponse = await sdk.fetch!("https://api.openai.com/v1/chat", {
+			method: "POST",
+			body: JSON.stringify({ model: "gpt-5.1" }),
+		});
+		const secondResponse = await sdk.fetch!("https://api.openai.com/v1/chat", {
+			method: "POST",
+			body: JSON.stringify({ model: "gpt-5.1" }),
+		});
+
+		expect(firstResponse.status).toBe(200);
+		expect(secondResponse.status).toBe(200);
+		expect(loadQuotaCacheMock).toHaveBeenCalledTimes(1);
+		expect(globalThis.fetch).toHaveBeenCalledTimes(2);
+	});
+
+	it("handles token refresh races while rotating away from a bootstrap-rate-limited account", async () => {
+		const now = Date.now() + 31 * 60_000;
+		const nowSpy = vi.spyOn(Date, "now").mockReturnValue(now);
+		const { AccountManager } = await import("../lib/accounts.js");
+		const fetchHelpers = await import("../lib/request/fetch-helpers.js");
+		try {
+			const accountOne = {
+			index: 0,
+			accountId: "acc-1",
+			email: "user1@example.com",
+			refreshToken: "refresh-1",
+			rateLimitResetTimes: {},
+		};
+			const accountTwo = {
+			index: 1,
+			accountId: "acc-2",
+			email: "user2@example.com",
+			refreshToken: "refresh-2",
+			rateLimitResetTimes: {},
+		};
+			loadQuotaCacheMock.mockResolvedValueOnce({
+			byAccountId: {
+				"acc-1": {
+					updatedAt: now,
+					status: 429,
+					model: "gpt-5.1",
+					primary: {
+						usedPercent: 100,
+						resetAtMs: now + 2 * 60_000,
+					},
+					secondary: {},
+				},
+			},
+			byEmail: {},
+		});
+			const countSpy = vi
+			.spyOn(AccountManager.prototype, "getAccountCount")
+			.mockReturnValue(2);
+			const selectionSpy = vi
+			.spyOn(AccountManager.prototype, "getCurrentOrNextForFamilyHybrid")
+			.mockImplementation((family: string, model?: string | null) => {
+				const nowMs = Date.now();
+				const accounts = [accountOne, accountTwo];
+				const modelKey = model ? `${family}:${model}` : family;
+				for (const candidate of accounts) {
+					const resets = candidate.rateLimitResetTimes ?? {};
+					const blockedUntil = Math.max(
+						resets[family] ?? 0,
+						resets[modelKey] ?? 0,
+					);
+					if (blockedUntil <= nowMs) {
+						return candidate as never;
+					}
+				}
+				return null as never;
+			});
+			const snapshotSpy = vi
+			.spyOn(AccountManager.prototype, "getAccountsSnapshot")
+			.mockReturnValue([accountOne, accountTwo] as never);
+			const getByIndexSpy = vi
+			.spyOn(AccountManager.prototype, "getAccountByIndex")
+			.mockImplementation((index: number) =>
+				(index === 0 ? accountOne : index === 1 ? accountTwo : null) as never,
+			);
+			const toAuthSpy = vi
+			.spyOn(AccountManager.prototype, "toAuthDetails")
+			.mockImplementation((account: { accountId?: string }) => {
+				const accountId = account.accountId ?? "unknown";
+				return {
+					type: "oauth" as const,
+					access: `stale-${accountId}`,
+					refresh: `refresh-${accountId}`,
+					expires: Date.now() - 60_000,
+				};
+			});
+			const markRateLimitSpy = vi
+			.spyOn(AccountManager.prototype, "markRateLimitedWithReason")
+			.mockImplementation(
+				(
+					account: { rateLimitResetTimes?: Record<string, number> },
+					waitMs: number,
+					family: string,
+					_reason?: string,
+					model?: string | null,
+				) => {
+					const resetAt = Date.now() + waitMs;
+					account.rateLimitResetTimes = account.rateLimitResetTimes ?? {};
+					account.rateLimitResetTimes[family] = resetAt;
+					if (model) {
+						account.rateLimitResetTimes[`${family}:${model}`] = resetAt;
+					}
+				},
+			);
+			const blockedRefresh = createDeferred<{
+			type: "oauth";
+			access: string;
+			refresh: string;
+			expires: number;
+		}>();
+			const firstRefreshStarted = createDeferred<void>();
+			let blockedRefreshUsed = false;
+			let refreshCallCount = 0;
+			vi.mocked(fetchHelpers.shouldRefreshToken).mockImplementation(
+			(auth: { access?: string }) => auth.access?.startsWith("stale-") ?? false,
+		);
+			vi.mocked(fetchHelpers.refreshAndUpdateToken).mockImplementation(
+			async (auth: { refresh: string }) => {
+				refreshCallCount += 1;
+				if (!blockedRefreshUsed) {
+					blockedRefreshUsed = true;
+					firstRefreshStarted.resolve();
+					return blockedRefresh.promise;
+				}
+				return {
+					type: "oauth" as const,
+					access: `refreshed-${refreshCallCount}`,
+					refresh: auth.refresh,
+					expires: Date.now() + 60_000,
+				};
+			},
+		);
+			vi.mocked(fetchHelpers.createCodexHeaders).mockImplementation(
+			(_init, _accountId, accessToken) =>
+				new Headers({ "x-test-access-token": String(accessToken ?? "") }),
+		);
+			globalThis.fetch = vi.fn().mockResolvedValue(
+			new Response(JSON.stringify({ content: "ok" }), { status: 200 }),
+		);
+
+			const { sdk } = await setupPlugin();
+			const firstRequest = sdk.fetch!("https://api.openai.com/v1/chat", {
+				method: "POST",
+				body: JSON.stringify({ model: "gpt-5.1" }),
+			});
+			const secondRequest = sdk.fetch!("https://api.openai.com/v1/chat", {
+				method: "POST",
+				body: JSON.stringify({ model: "gpt-5.1" }),
+			});
+			await firstRefreshStarted.promise;
+			blockedRefresh.resolve({
+				type: "oauth",
+				access: "refreshed-blocked",
+				refresh: "refresh-acc-2",
+				expires: Date.now() + 60_000,
+			});
+
+			const [firstResponse, secondResponse] = await Promise.all([firstRequest, secondRequest]);
+			expect(firstResponse.status).toBe(200);
+			expect(secondResponse.status).toBe(200);
+			expect(refreshCallCount).toBeGreaterThanOrEqual(2);
+			expect(selectionSpy).toHaveBeenCalled();
+			expect(getByIndexSpy).toHaveBeenCalled();
+			const accessTokens = vi
+				.mocked(globalThis.fetch)
+				.mock.calls
+				.map((call) => {
+					const headers = new Headers((call[1] as RequestInit | undefined)?.headers);
+					return headers.get("x-test-access-token");
+				})
+				.filter((token): token is string => typeof token === "string");
+			expect(accessTokens.length).toBe(2);
+			expect(accessTokens.every((token) => token.startsWith("refreshed-"))).toBe(true);
+			countSpy.mockRestore();
+			selectionSpy.mockRestore();
+			snapshotSpy.mockRestore();
+			getByIndexSpy.mockRestore();
+			toAuthSpy.mockRestore();
+			markRateLimitSpy.mockRestore();
+		} finally {
+			nowSpy.mockRestore();
+		}
+	});
+
+	it("continues request flow when quota bootstrap cache reads hit EPERM/EBUSY", async () => {
+		const fetchHelpers = await import("../lib/request/fetch-helpers.js");
+		const epermError = Object.assign(new Error("locked"), { code: "EPERM" });
+		loadQuotaCacheMock.mockRejectedValueOnce(epermError);
+		vi.mocked(fetchHelpers.createCodexHeaders).mockImplementation(
+			(_init, _accountId, accessToken) =>
+				new Headers({ "x-test-access-token": String(accessToken ?? "") }),
+		);
+		globalThis.fetch = vi.fn().mockResolvedValue(
+			new Response(JSON.stringify({ content: "ok" }), { status: 200 }),
+		);
+
+		const { sdk } = await setupPlugin();
+		const firstResponse = await sdk.fetch!("https://api.openai.com/v1/chat", {
+			method: "POST",
+			body: JSON.stringify({ model: "gpt-5.1" }),
+		});
+		const secondResponse = await sdk.fetch!("https://api.openai.com/v1/chat", {
+			method: "POST",
+			body: JSON.stringify({ model: "gpt-5.1" }),
+		});
+
+		expect(firstResponse.status).toBe(200);
+		expect(secondResponse.status).toBe(200);
+		expect(loadQuotaCacheMock).toHaveBeenCalledTimes(1);
+		expect(globalThis.fetch).toHaveBeenCalledTimes(2);
+		const firstHeaders = new Headers(
+			(vi.mocked(globalThis.fetch).mock.calls[0]?.[1] as RequestInit)?.headers,
+		);
+		const secondHeaders = new Headers(
+			(vi.mocked(globalThis.fetch).mock.calls[1]?.[1] as RequestInit)?.headers,
+		);
+		expect(firstHeaders.get("x-test-access-token")).toBe("access-token");
+		expect(secondHeaders.get("x-test-access-token")).toBe("access-token");
+	});
+
+	it("retries quota bootstrap loads after the failure cooldown window and recovers", async () => {
+		vi.useFakeTimers();
+		const now = Date.now();
+		const { AccountManager } = await import("../lib/accounts.js");
+		const fetchHelpers = await import("../lib/request/fetch-helpers.js");
+		const accountOne = {
+			index: 0,
+			accountId: "acc-1",
+			email: "user1@example.com",
+			refreshToken: "refresh-1",
+			rateLimitResetTimes: {},
+		};
+		const accountTwo = {
+			index: 1,
+			accountId: "acc-2",
+			email: "user2@example.com",
+			refreshToken: "refresh-2",
+			rateLimitResetTimes: {},
+		};
+		const epermError = Object.assign(new Error("locked"), { code: "EPERM" });
+		loadQuotaCacheMock
+			.mockRejectedValueOnce(epermError)
+			.mockResolvedValueOnce({
+				byAccountId: {},
+				byEmail: {
+					"user1@example.com": {
+						updatedAt: now,
+						status: 429,
+						model: "gpt-5.1",
+						primary: {
+							usedPercent: 100,
+							resetAtMs: now + 5 * 60_000,
+						},
+						secondary: {},
+					},
+					"user@example.com": {
+						updatedAt: now,
+						status: 429,
+						model: "gpt-5.1",
+						primary: {
+							usedPercent: 100,
+							resetAtMs: now + 5 * 60_000,
+						},
+						secondary: {},
+					},
+				},
+			});
+		const countSpy = vi
+			.spyOn(AccountManager.prototype, "getAccountCount")
+			.mockReturnValue(2);
+		const selectionSpy = vi
+			.spyOn(AccountManager.prototype, "getCurrentOrNextForFamilyHybrid")
+			.mockImplementation((family: string, model?: string | null) => {
+				const nowMs = Date.now();
+				const accounts = [accountOne, accountTwo];
+				const modelKey = model ? `${family}:${model}` : family;
+				for (const candidate of accounts) {
+					const resets = candidate.rateLimitResetTimes ?? {};
+					const blockedUntil = Math.max(
+						resets[family] ?? 0,
+						resets[modelKey] ?? 0,
+					);
+					if (blockedUntil <= nowMs) {
+						return candidate as never;
+					}
+				}
+				return null as never;
+			});
+		const snapshotSpy = vi
+			.spyOn(AccountManager.prototype, "getAccountsSnapshot")
+			.mockReturnValue([accountOne, accountTwo] as never);
+		const getByIndexSpy = vi
+			.spyOn(AccountManager.prototype, "getAccountByIndex")
+			.mockImplementation((index: number) =>
+				(index === 0 ? accountOne : index === 1 ? accountTwo : null) as never,
+			);
+		const toAuthSpy = vi
+			.spyOn(AccountManager.prototype, "toAuthDetails")
+			.mockImplementation((account: { accountId?: string }) => ({
+				type: "oauth" as const,
+				access: `access-${account.accountId ?? "unknown"}`,
+				refresh: `refresh-${account.accountId ?? "unknown"}`,
+				expires: Date.now() + 60_000,
+			}));
+		const markRateLimitSpy = vi
+			.spyOn(AccountManager.prototype, "markRateLimitedWithReason")
+			.mockImplementation(
+				(
+					account: { rateLimitResetTimes?: Record<string, number> },
+					waitMs: number,
+					family: string,
+					_reason?: string,
+					model?: string | null,
+				) => {
+					const resetAt = Date.now() + waitMs;
+					account.rateLimitResetTimes = account.rateLimitResetTimes ?? {};
+					account.rateLimitResetTimes[family] = resetAt;
+					if (model) {
+						account.rateLimitResetTimes[`${family}:${model}`] = resetAt;
+					}
+				},
+			);
+		vi.mocked(fetchHelpers.createCodexHeaders).mockImplementation(
+			(_init, _accountId, accessToken) =>
+				new Headers({ "x-test-access-token": String(accessToken ?? "") }),
+		);
+		globalThis.fetch = vi.fn().mockResolvedValue(
+			new Response(JSON.stringify({ content: "ok" }), { status: 200 }),
+		);
+		try {
+			const { sdk } = await setupPlugin();
+			const firstResponse = await sdk.fetch!("https://api.openai.com/v1/chat", {
+				method: "POST",
+				body: JSON.stringify({ model: "gpt-5.1" }),
+			});
+			const secondResponse = await sdk.fetch!("https://api.openai.com/v1/chat", {
+				method: "POST",
+				body: JSON.stringify({ model: "gpt-5.1" }),
+			});
+			await vi.advanceTimersByTimeAsync(60_100);
+			const thirdResponse = await sdk.fetch!("https://api.openai.com/v1/chat", {
+				method: "POST",
+				body: JSON.stringify({ model: "gpt-5.1" }),
+			});
+
+			expect(firstResponse.status).toBe(200);
+			expect(secondResponse.status).toBe(200);
+			expect(thirdResponse.status).toBe(200);
+			expect(loadQuotaCacheMock).toHaveBeenCalledTimes(2);
+			expect(globalThis.fetch).toHaveBeenCalledTimes(3);
+			const firstHeaders = new Headers(
+				(vi.mocked(globalThis.fetch).mock.calls[0]?.[1] as RequestInit)?.headers,
+			);
+			const secondHeaders = new Headers(
+				(vi.mocked(globalThis.fetch).mock.calls[1]?.[1] as RequestInit)?.headers,
+			);
+			const thirdHeaders = new Headers(
+				(vi.mocked(globalThis.fetch).mock.calls[2]?.[1] as RequestInit)?.headers,
+			);
+			expect(firstHeaders.get("x-test-access-token")).not.toBe("access-acc-2");
+			expect(secondHeaders.get("x-test-access-token")).not.toBe("access-acc-2");
+			expect(thirdHeaders.get("x-test-access-token")).toBe("access-acc-2");
+		} finally {
+			vi.useRealTimers();
+			countSpy.mockRestore();
+			selectionSpy.mockRestore();
+			snapshotSpy.mockRestore();
+			getByIndexSpy.mockRestore();
+			toAuthSpy.mockRestore();
+			markRateLimitSpy.mockRestore();
+		}
+	});
+
+	it("disables quota cache bootstrap when CODEX_AUTH_QUOTA_CACHE_BOOTSTRAP=0", async () => {
+		const previous = process.env.CODEX_AUTH_QUOTA_CACHE_BOOTSTRAP;
+		process.env.CODEX_AUTH_QUOTA_CACHE_BOOTSTRAP = "0";
+		try {
+			const now = Date.now();
+			const { AccountManager } = await import("../lib/accounts.js");
+			const fetchHelpers = await import("../lib/request/fetch-helpers.js");
+			const accountOne = {
+				index: 0,
+				accountId: "acc-1",
+				email: "user1@example.com",
+				refreshToken: "refresh-1",
+				rateLimitResetTimes: {},
+			};
+			const accountTwo = {
+				index: 1,
+				accountId: "acc-2",
+				email: "user2@example.com",
+				refreshToken: "refresh-2",
+				rateLimitResetTimes: {},
+			};
+			loadQuotaCacheMock.mockResolvedValueOnce({
+				byAccountId: {
+					"acc-1": {
+						updatedAt: now,
+						status: 429,
+						model: "gpt-5.1",
+						primary: {
+							usedPercent: 100,
+							resetAtMs: now + 5 * 60_000,
+						},
+						secondary: {},
+					},
+				},
+				byEmail: {},
+			});
+			const countSpy = vi
+				.spyOn(AccountManager.prototype, "getAccountCount")
+				.mockReturnValue(2);
+			const selectionSpy = vi
+				.spyOn(AccountManager.prototype, "getCurrentOrNextForFamilyHybrid")
+				.mockImplementationOnce(() => accountOne as never)
+				.mockImplementationOnce(() => accountTwo as never)
+				.mockImplementation(() => null as never);
+			const snapshotSpy = vi
+				.spyOn(AccountManager.prototype, "getAccountsSnapshot")
+				.mockReturnValue([accountOne, accountTwo] as never);
+			const toAuthSpy = vi
+				.spyOn(AccountManager.prototype, "toAuthDetails")
+				.mockImplementation((account: { accountId?: string }) => ({
+					type: "oauth" as const,
+					access: `access-${account.accountId ?? "unknown"}`,
+					refresh: `refresh-${account.accountId ?? "unknown"}`,
+					expires: Date.now() + 60_000,
+				}));
+			vi.mocked(fetchHelpers.createCodexHeaders).mockImplementation(
+				(_init, _accountId, accessToken) =>
+					new Headers({ "x-test-access-token": String(accessToken ?? "") }),
+			);
+			globalThis.fetch = vi.fn().mockResolvedValue(
+				new Response(JSON.stringify({ content: "ok" }), { status: 200 }),
+			);
+
+			const { sdk } = await setupPlugin();
+			const response = await sdk.fetch!("https://api.openai.com/v1/chat", {
+				method: "POST",
+				body: JSON.stringify({ model: "gpt-5.1" }),
+			});
+
+			expect(response.status).toBe(200);
+			expect(globalThis.fetch).toHaveBeenCalledTimes(1);
+			const headers = new Headers(
+				(vi.mocked(globalThis.fetch).mock.calls[0]?.[1] as RequestInit)?.headers,
+			);
+			expect(headers.get("x-test-access-token")).toBe("access-acc-1");
+			expect(loadQuotaCacheMock).not.toHaveBeenCalled();
+			countSpy.mockRestore();
+			selectionSpy.mockRestore();
+			snapshotSpy.mockRestore();
+			toAuthSpy.mockRestore();
+		} finally {
+			if (previous === undefined) {
+				delete process.env.CODEX_AUTH_QUOTA_CACHE_BOOTSTRAP;
+			} else {
+				process.env.CODEX_AUTH_QUOTA_CACHE_BOOTSTRAP = previous;
+			}
+		}
+	});
+
+	it("treats timeout-triggered abort as network failure", async () => {
+		const { AccountManager } = await import("../lib/accounts.js");
+		const configModule = await import("../lib/config.js");
+		const recordFailureSpy = vi.spyOn(AccountManager.prototype, "recordFailure");
+		const timeoutSpy = vi.spyOn(configModule, "getFetchTimeoutMs").mockReturnValueOnce(5);
+			globalThis.fetch = vi.fn((_: unknown, init?: { signal?: AbortSignal }) => {
+				return new Promise((_resolve, reject) => {
+					const signal = init?.signal;
+					if (!signal) {
+						reject(new Error("missing signal"));
+						return;
+					}
+					if (signal.aborted) {
+						reject(Object.assign(new Error("timeout"), { name: "AbortError" }));
+						return;
+					}
+					signal.addEventListener(
+						"abort",
+						() => reject(Object.assign(new Error("timeout"), { name: "AbortError" })),
+						{ once: true },
+					);
+				});
+			});
+
+			const { sdk } = await setupPlugin();
+		const response = await sdk.fetch!("https://api.openai.com/v1/chat", {
+			method: "POST",
+			body: JSON.stringify({ model: "gpt-5.1" }),
+		});
+
+		expect(response.status).toBe(503);
+		expect(recordFailureSpy).toHaveBeenCalled();
+		recordFailureSpy.mockRestore();
+		timeoutSpy.mockRestore();
+	});
+
+	it("uses numeric retry-after hints for server cooldown decisions", async () => {
+		const { AccountManager } = await import("../lib/accounts.js");
+		const cooldownSpy = vi.spyOn(AccountManager.prototype, "markAccountCoolingDown");
+		globalThis.fetch = vi.fn().mockResolvedValue(
+			new Response("server error", {
+				status: 500,
+				headers: new Headers({ "retry-after": "5" }),
+			}),
+		);
+
+		const { sdk } = await setupPlugin();
+		const response = await sdk.fetch!("https://api.openai.com/v1/chat", {
+			method: "POST",
+			body: JSON.stringify({ model: "gpt-5.1" }),
+		});
+
+		expect(response.status).toBe(503);
+		expect(cooldownSpy).toHaveBeenCalled();
+		expect(cooldownSpy.mock.calls[0]?.[1]).toBe(5000);
+		cooldownSpy.mockRestore();
+	});
+
+	it("uses retry-after-ms hints for server cooldown decisions", async () => {
+		const { AccountManager } = await import("../lib/accounts.js");
+		const cooldownSpy = vi.spyOn(AccountManager.prototype, "markAccountCoolingDown");
+		globalThis.fetch = vi.fn().mockResolvedValue(
+			new Response("server error", {
+				status: 500,
+				headers: new Headers({ "retry-after-ms": "4500" }),
+			}),
+		);
+
+		const { sdk } = await setupPlugin();
+		const response = await sdk.fetch!("https://api.openai.com/v1/chat", {
+			method: "POST",
+			body: JSON.stringify({ model: "gpt-5.1" }),
+		});
+
+		expect(response.status).toBe(503);
+		expect(cooldownSpy).toHaveBeenCalled();
+		expect(cooldownSpy.mock.calls[0]?.[1]).toBe(4500);
+		cooldownSpy.mockRestore();
+	});
+
+	it("parses x-ratelimit-reset seconds hints for server cooldown decisions", async () => {
+		const baseNow = 1_700_000_000_000;
+		const dateNowSpy = vi.spyOn(Date, "now").mockReturnValue(baseNow);
+		const resetAtSeconds = Math.floor((baseNow + 7_000) / 1000);
+		const { AccountManager } = await import("../lib/accounts.js");
+		const cooldownSpy = vi.spyOn(AccountManager.prototype, "markAccountCoolingDown");
+		globalThis.fetch = vi.fn().mockResolvedValue(
+			new Response("server error", {
+				status: 500,
+				headers: new Headers({ "x-ratelimit-reset": String(resetAtSeconds) }),
+			}),
+		);
+
+		const { sdk } = await setupPlugin();
+		const response = await sdk.fetch!("https://api.openai.com/v1/chat", {
+			method: "POST",
+			body: JSON.stringify({ model: "gpt-5.1" }),
+		});
+
+		expect(response.status).toBe(503);
+		expect(cooldownSpy).toHaveBeenCalled();
+		expect(cooldownSpy.mock.calls[0]?.[1]).toBe(7000);
+		cooldownSpy.mockRestore();
+		dateNowSpy.mockRestore();
+	});
+
+	it("parses x-ratelimit-reset millisecond hints for server cooldown decisions", async () => {
+		const baseNow = 1_700_000_000_000;
+		const dateNowSpy = vi.spyOn(Date, "now").mockReturnValue(baseNow);
+		const resetAtMs = baseNow + 12_000;
+		const { AccountManager } = await import("../lib/accounts.js");
+		const cooldownSpy = vi.spyOn(AccountManager.prototype, "markAccountCoolingDown");
+		globalThis.fetch = vi.fn().mockResolvedValue(
+			new Response("server error", {
+				status: 500,
+				headers: new Headers({ "x-ratelimit-reset": String(resetAtMs) }),
+			}),
+		);
+
+		const { sdk } = await setupPlugin();
+		const response = await sdk.fetch!("https://api.openai.com/v1/chat", {
+			method: "POST",
 			body: JSON.stringify({ model: "gpt-5.1" }),
 		});
 
@@ -1899,6 +3571,11 @@ describe("OpenAIOAuthPlugin event handler edge cases", () => {
 		await plugin.event({
 			event: { type: "account.select", properties: { accountIndex: 1 } },
 		});
+		const { MODEL_FAMILIES } = await import("../lib/prompts/codex.js");
+		expect(mockStorage.activeIndex).toBe(1);
+		for (const family of MODEL_FAMILIES) {
+			expect(mockStorage.activeIndexByFamily[family]).toBe(1);
+		}
 	});
 
 	it("reloads account manager from disk when handling account.select", async () => {
diff --git a/test/license-policy-check.test.ts b/test/license-policy-check.test.ts
new file mode 100644
index 000000000..b97d82a37
--- /dev/null
+++ b/test/license-policy-check.test.ts
@@ -0,0 +1,87 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { promises as fs } from "node:fs";
+import { spawnSync } from "node:child_process";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { removeWithRetry } from "./helpers/remove-with-retry.js";
+
+function createRetryableFsError(code: string): NodeJS.ErrnoException {
+	const error = new Error(code.toLowerCase()) as NodeJS.ErrnoException;
+	error.code = code;
+	return error;
+}
+
+describe("license policy check", () => {
+	let tempDir: string;
+
+	beforeEach(async () => {
+		tempDir = await fs.mkdtemp(join(tmpdir(), "codex-license-policy-"));
+	});
+
+	afterEach(async () => {
+		await removeWithRetry(tempDir, { recursive: true, force: true });
+	});
+
+	it("retries transient windows rm errors before succeeding", async () => {
+		vi.useFakeTimers();
+		const rmSpy = vi.spyOn(fs, "rm");
+		rmSpy
+			.mockRejectedValueOnce(createRetryableFsError("EBUSY"))
+			.mockRejectedValueOnce(createRetryableFsError("EPERM"))
+			.mockResolvedValueOnce(undefined);
+		try {
+			const cleanupPromise = removeWithRetry("C:\\temp\\codex-license-policy", {
+				recursive: true,
+				force: true,
+			});
+			await vi.runAllTimersAsync();
+			await expect(cleanupPromise).resolves.toBeUndefined();
+			expect(rmSpy).toHaveBeenCalledTimes(3);
+		} finally {
+			rmSpy.mockRestore();
+			vi.useRealTimers();
+		}
+	});
+
+	it.each([
+		{ denyList: "GPL-2.0+", metadata: { license: "GPL-2.0+" } },
+		{ denyList: "LGPL-2.1+", metadata: { license: "MIT OR LGPL-2.1+" } },
+		{ denyList: "GPL-2.0+", metadata: { license: { type: "GPL-2.0+" } } },
+		{
+			denyList: "LGPL-2.1+",
+			metadata: { licenses: [{ type: "MIT OR LGPL-2.1+" }] },
+		},
+	])("blocks denylisted SPDX plus-form (%o)", async ({ denyList, metadata }) => {
+		const lock = {
+			name: "license-test",
+			lockfileVersion: 3,
+				packages: {
+					"": {
+						name: "license-test",
+						version: "1.0.0",
+					},
+					"node_modules/blocked-package": {
+						name: "blocked-package",
+						version: "1.0.0",
+						...metadata,
+					},
+				},
+			};
+
+		await fs.writeFile(join(tempDir, "package-lock.json"), JSON.stringify(lock, null, 2), "utf8");
+		const scriptPath = join(process.cwd(), "scripts", "license-policy-check.js");
+		const result = spawnSync(process.execPath, [scriptPath], {
+			cwd: tempDir,
+			encoding: "utf8",
+			env: {
+				...process.env,
+				CODEX_LICENSE_DENYLIST: denyList,
+			},
+		});
+
+		expect(result.status).toBe(1);
+		const stderr = String(result.stderr ?? "");
+		expect(stderr).toContain("License policy violations detected:");
+		expect(stderr).toContain("blocked-package@1.0.0");
+	});
+});
diff --git a/test/network.test.ts b/test/network.test.ts
new file mode 100644
index 000000000..f2b3face4
--- /dev/null
+++ b/test/network.test.ts
@@ -0,0 +1,221 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { fetchWithTimeoutAndRetry } from "../lib/network.js";
+
+describe("fetchWithTimeoutAndRetry", () => {
+	const originalFetch = globalThis.fetch;
+	let fetchMock: ReturnType<typeof vi.fn>;
+
+	beforeEach(() => {
+		vi.useFakeTimers();
+		fetchMock = vi.fn();
+		globalThis.fetch = fetchMock as unknown as typeof fetch;
+	});
+
+	afterEach(() => {
+		globalThis.fetch = originalFetch;
+		vi.useRealTimers();
+		vi.restoreAllMocks();
+	});
+
+	it("returns response on first successful attempt", async () => {
+		fetchMock.mockResolvedValueOnce(new Response("ok", { status: 200 }));
+
+		const promise = fetchWithTimeoutAndRetry("https://example.com", undefined, {
+			timeoutMs: 2_000,
+		});
+		await vi.runAllTimersAsync();
+		const result = await promise;
+
+		expect(result.attempts).toBe(1);
+		expect(result.response.status).toBe(200);
+		expect(fetchMock).toHaveBeenCalledTimes(1);
+	});
+
+	it("retries once after network error and recovers", async () => {
+		const onRetry = vi.fn();
+		fetchMock
+			.mockRejectedValueOnce(new Error("network down"))
+			.mockResolvedValueOnce(new Response("ok", { status: 200 }));
+
+		const promise = fetchWithTimeoutAndRetry("https://example.com", undefined, {
+			timeoutMs: 2_000,
+			retries: 1,
+			baseDelayMs: 25,
+			jitterMs: 0,
+			onRetry,
+		});
+		await vi.runAllTimersAsync();
+		const result = await promise;
+
+		expect(result.attempts).toBe(2);
+		expect(fetchMock).toHaveBeenCalledTimes(2);
+		expect(onRetry).toHaveBeenCalledWith(
+			expect.objectContaining({ reason: "error", attempt: 1, maxAttempts: 2 }),
+		);
+		const retryInfo = onRetry.mock.calls[0]?.[0];
+		expect(retryInfo).toEqual(expect.objectContaining({ errorType: "Error" }));
+		expect(retryInfo).not.toHaveProperty("error");
+	});
+
+	it("retries on configured HTTP status codes", async () => {
+		const onRetry = vi.fn();
+		fetchMock
+			.mockResolvedValueOnce(new Response("busy", { status: 503 }))
+			.mockResolvedValueOnce(new Response("ok", { status: 200 }));
+
+		const promise = fetchWithTimeoutAndRetry("https://example.com", undefined, {
+			timeoutMs: 2_000,
+			retries: 1,
+			baseDelayMs: 25,
+			jitterMs: 0,
+			retryOnStatuses: [503],
+			onRetry,
+		});
+		await vi.runAllTimersAsync();
+		const result = await promise;
+
+		expect(result.attempts).toBe(2);
+		expect(fetchMock).toHaveBeenCalledTimes(2);
+		expect(onRetry).toHaveBeenCalledWith(
+			expect.objectContaining({
+				reason: "status",
+				status: 503,
+				attempt: 1,
+				maxAttempts: 2,
+			}),
+		);
+	});
+
+	it("does not retry caller-aborted requests", async () => {
+		const controller = new AbortController();
+		const abortError = Object.assign(new Error("aborted"), { name: "AbortError" });
+		controller.abort();
+		fetchMock.mockImplementationOnce(async () => {
+			throw abortError;
+		});
+
+		const promise = fetchWithTimeoutAndRetry("https://example.com", undefined, {
+			timeoutMs: 2_000,
+			retries: 3,
+			baseDelayMs: 25,
+			jitterMs: 0,
+			signal: controller.signal,
+		});
+		const rejection = expect(promise).rejects.toThrow("aborted");
+		await vi.runAllTimersAsync();
+		await rejection;
+		expect(fetchMock).toHaveBeenCalledTimes(1);
+	});
+
+	it("retries when a fetch attempt times out", async () => {
+		const onRetry = vi.fn();
+		fetchMock
+			.mockImplementationOnce(
+				(_input: RequestInfo | URL, init?: RequestInit) =>
+					new Promise<Response>((_resolve, reject) => {
+						const signal = init?.signal as AbortSignal | undefined;
+						if (signal?.aborted) {
+							reject(signal.reason);
+							return;
+						}
+						signal?.addEventListener(
+							"abort",
+							() => {
+								reject(signal.reason);
+							},
+							{ once: true },
+						);
+					}),
+			)
+			.mockResolvedValueOnce(new Response("ok", { status: 200 }));
+
+		const pending = fetchWithTimeoutAndRetry("https://example.com", undefined, {
+			timeoutMs: 1_000,
+			retries: 1,
+			baseDelayMs: 25,
+			jitterMs: 0,
+			onRetry,
+		});
+		await vi.runAllTimersAsync();
+		const result = await pending;
+
+		expect(result.attempts).toBe(2);
+		expect(fetchMock).toHaveBeenCalledTimes(2);
+		expect(onRetry).toHaveBeenCalledWith(
+			expect.objectContaining({
+				reason: "timeout",
+				errorType: "AbortError",
+				attempt: 1,
+				maxAttempts: 2,
+			}),
+		);
+		await vi.runAllTimersAsync();
+		expect(fetchMock).toHaveBeenCalledTimes(2);
+	});
+
+	it("aborts immediately when caller aborts mid-flight", async () => {
+		const controller = new AbortController();
+		const abortError = Object.assign(new Error("caller-aborted"), {
+			name: "AbortError",
+		});
+		fetchMock.mockImplementationOnce(
+			(_input: RequestInfo | URL, init?: RequestInit) =>
+				new Promise<Response>((_resolve, reject) => {
+					const signal = init?.signal as AbortSignal | undefined;
+					if (signal?.aborted) {
+						reject(signal.reason);
+						return;
+					}
+					signal?.addEventListener(
+						"abort",
+						() => {
+							reject(signal.reason);
+						},
+						{ once: true },
+					);
+				}),
+		);
+
+		const pending = fetchWithTimeoutAndRetry("https://example.com", undefined, {
+			timeoutMs: 2_000,
+			retries: 3,
+			baseDelayMs: 25,
+			jitterMs: 0,
+			signal: controller.signal,
+		});
+		controller.abort(abortError);
+
+		await expect(pending).rejects.toThrow("caller-aborted");
+		expect(fetchMock).toHaveBeenCalledTimes(1);
+		await vi.runAllTimersAsync();
+		expect(fetchMock).toHaveBeenCalledTimes(1);
+	});
+
+	it("stops retrying when caller aborts during backoff", async () => {
+		const controller = new AbortController();
+		fetchMock.mockRejectedValueOnce(new Error("first-attempt-failed"));
+
+		const pending = fetchWithTimeoutAndRetry("https://example.com", undefined, {
+			timeoutMs: 2_000,
+			retries: 2,
+			baseDelayMs: 500,
+			jitterMs: 0,
+			signal: controller.signal,
+		});
+
+		await Promise.resolve();
+		await Promise.resolve();
+		expect(fetchMock).toHaveBeenCalledTimes(1);
+
+		controller.abort(
+			Object.assign(new Error("abort-during-backoff"), {
+				name: "AbortError",
+			}),
+		);
+
+		await expect(pending).rejects.toThrow("abort-during-backoff");
+		expect(fetchMock).toHaveBeenCalledTimes(1);
+		await vi.runAllTimersAsync();
+		expect(fetchMock).toHaveBeenCalledTimes(1);
+	});
+});
diff --git a/test/paths.test.ts b/test/paths.test.ts
index d289bf2cd..36ed7ad5d 100644
--- a/test/paths.test.ts
+++ b/test/paths.test.ts
@@ -654,6 +654,22 @@ describe("Storage Paths Module", () => {
 				expect(resolved).toBe(projectRoot);
 			});
 
+			it("falls back when .git entry exists but is neither file nor directory", () => {
+				const projectRoot = "/repo/weird";
+				const gitEntry = path.join(projectRoot, ".git");
+
+				mockedExistsSync.mockImplementation((candidate) => candidate === gitEntry);
+				mockedStatSync.mockImplementation((candidate) => {
+					expect(candidate).toBe(gitEntry);
+					return buildMockStat({ isDirectory: false, isFile: false });
+				});
+
+				const resolved = resolveProjectStorageIdentityRoot(projectRoot);
+
+				expect(resolved).toBe(projectRoot);
+				expect(mockedReadFileSync).not.toHaveBeenCalled();
+			});
+
 			it("keeps project root when .git file does not point to worktrees", () => {
 				const projectRoot = "/repo/submodule";
 				const gitEntry = path.join(projectRoot, ".git");
diff --git a/test/plugin-config.test.ts b/test/plugin-config.test.ts
index 9caebf96b..54b95939c 100644
--- a/test/plugin-config.test.ts
+++ b/test/plugin-config.test.ts
@@ -12,11 +12,13 @@ import {
 	getUnsupportedCodexPolicy,
 	getFallbackOnUnsupportedCodexModel,
 	getTokenRefreshSkewMs,
+	getRetryAllAccountsAbsoluteCeilingMs,
 	getRetryAllAccountsMaxRetries,
 	getFallbackToGpt52OnUnsupportedGpt53,
 	getUnsupportedCodexFallbackChain,
 	getFetchTimeoutMs,
 	getStreamStallTimeoutMs,
+	getTelemetryEnabled,
 	getPreemptiveQuotaEnabled,
 	getPreemptiveQuotaRemainingPercent5h,
 	getPreemptiveQuotaRemainingPercent7d,
@@ -60,9 +62,11 @@ describe('Plugin Configuration', () => {
 		'CODEX_AUTH_FAST_SESSION',
 		'CODEX_AUTH_FAST_SESSION_STRATEGY',
 		'CODEX_AUTH_FAST_SESSION_MAX_INPUT_ITEMS',
+		'CODEX_AUTH_TELEMETRY_ENABLED',
 		'CODEX_AUTH_UNSUPPORTED_MODEL_POLICY',
 		'CODEX_AUTH_FALLBACK_UNSUPPORTED_MODEL',
 		'CODEX_AUTH_FALLBACK_GPT53_TO_GPT52',
+		'CODEX_AUTH_RETRY_ALL_ABSOLUTE_CEILING_MS',
 		'CODEX_AUTH_PREEMPTIVE_QUOTA_ENABLED',
 		'CODEX_AUTH_PREEMPTIVE_QUOTA_5H_REMAINING_PCT',
 		'CODEX_AUTH_PREEMPTIVE_QUOTA_7D_REMAINING_PCT',
@@ -105,7 +109,8 @@ describe('Plugin Configuration', () => {
 				fastSessionMaxInputItems: 30,
 				retryAllAccountsRateLimited: true,
 				retryAllAccountsMaxWaitMs: 0,
-				retryAllAccountsMaxRetries: Infinity,
+				retryAllAccountsMaxRetries: 12,
+				retryAllAccountsAbsoluteCeilingMs: 0,
 				unsupportedCodexPolicy: 'strict',
 				fallbackOnUnsupportedCodexModel: false,
 				fallbackToGpt52OnUnsupportedGpt53: true,
@@ -114,6 +119,7 @@ describe('Plugin Configuration', () => {
 				rateLimitToastDebounceMs: 60_000,
 				toastDurationMs: 5_000,
 				perProjectAccounts: true,
+				telemetryEnabled: true,
 				sessionRecovery: true,
 				autoResume: true,
 				parallelProbing: false,
@@ -163,7 +169,8 @@ describe('Plugin Configuration', () => {
 				fastSessionMaxInputItems: 30,
 				retryAllAccountsRateLimited: true,
 				retryAllAccountsMaxWaitMs: 0,
-				retryAllAccountsMaxRetries: Infinity,
+				retryAllAccountsMaxRetries: 12,
+				retryAllAccountsAbsoluteCeilingMs: 0,
 				unsupportedCodexPolicy: 'strict',
 				fallbackOnUnsupportedCodexModel: false,
 				fallbackToGpt52OnUnsupportedGpt53: true,
@@ -172,6 +179,7 @@ describe('Plugin Configuration', () => {
 				rateLimitToastDebounceMs: 60_000,
 				toastDurationMs: 5_000,
 				perProjectAccounts: true,
+				telemetryEnabled: true,
 				sessionRecovery: true,
 				autoResume: true,
 				parallelProbing: false,
@@ -200,6 +208,46 @@ describe('Plugin Configuration', () => {
 			});
 		});
 
+		it('retries transient config read lock errors and succeeds', () => {
+			mockExistsSync.mockReturnValue(true);
+			const transientReadError = Object.assign(new Error('Resource busy'), { code: 'EBUSY' });
+			mockReadFileSync
+				.mockImplementationOnce(() => {
+					throw transientReadError;
+				})
+				.mockReturnValueOnce(JSON.stringify({ codexMode: false }));
+
+			const config = loadPluginConfig();
+
+			expect(config.codexMode).toBe(false);
+			expect(mockReadFileSync).toHaveBeenCalledTimes(2);
+			const failedLoadWarnings = vi
+				.mocked(logger.logWarn)
+				.mock.calls.filter(([message]) => String(message).includes('Failed to load config'));
+			expect(failedLoadWarnings).toHaveLength(0);
+		});
+
+		it('retries transient config read lock errors (EPERM) and succeeds', () => {
+			mockExistsSync.mockReturnValue(true);
+			const transientReadError = Object.assign(new Error('Operation not permitted'), {
+				code: 'EPERM',
+			});
+			mockReadFileSync
+				.mockImplementationOnce(() => {
+					throw transientReadError;
+				})
+				.mockReturnValueOnce(JSON.stringify({ codexMode: false }));
+
+			const config = loadPluginConfig();
+
+			expect(config.codexMode).toBe(false);
+			expect(mockReadFileSync).toHaveBeenCalledTimes(2);
+			const failedLoadWarnings = vi
+				.mocked(logger.logWarn)
+				.mock.calls.filter(([message]) => String(message).includes('Failed to load config'));
+			expect(failedLoadWarnings).toHaveLength(0);
+		});
+
 		it('should detect CODEX_HOME legacy auth config path before global legacy path', async () => {
 			const runWithCodexHome = async (codexHomePath: string) => {
 				vi.resetModules();
@@ -418,7 +466,8 @@ describe('Plugin Configuration', () => {
 				fastSessionMaxInputItems: 30,
 				retryAllAccountsRateLimited: true,
 				retryAllAccountsMaxWaitMs: 0,
-				retryAllAccountsMaxRetries: Infinity,
+				retryAllAccountsMaxRetries: 12,
+				retryAllAccountsAbsoluteCeilingMs: 0,
 				unsupportedCodexPolicy: 'strict',
 				fallbackOnUnsupportedCodexModel: false,
 				fallbackToGpt52OnUnsupportedGpt53: true,
@@ -427,6 +476,7 @@ describe('Plugin Configuration', () => {
 				rateLimitToastDebounceMs: 60_000,
 				toastDurationMs: 5_000,
 				perProjectAccounts: true,
+				telemetryEnabled: true,
 				sessionRecovery: true,
 				autoResume: true,
 				parallelProbing: false,
@@ -482,7 +532,8 @@ describe('Plugin Configuration', () => {
 		fastSessionMaxInputItems: 30,
 		retryAllAccountsRateLimited: true,
 		retryAllAccountsMaxWaitMs: 0,
-		retryAllAccountsMaxRetries: Infinity,
+		retryAllAccountsMaxRetries: 12,
+		retryAllAccountsAbsoluteCeilingMs: 0,
 		unsupportedCodexPolicy: 'strict',
 		fallbackOnUnsupportedCodexModel: false,
 		fallbackToGpt52OnUnsupportedGpt53: true,
@@ -491,6 +542,7 @@ describe('Plugin Configuration', () => {
 		rateLimitToastDebounceMs: 60_000,
 		toastDurationMs: 5_000,
 		perProjectAccounts: true,
+		telemetryEnabled: true,
 		sessionRecovery: true,
 		autoResume: true,
 		parallelProbing: false,
@@ -540,7 +592,8 @@ describe('Plugin Configuration', () => {
 			fastSessionMaxInputItems: 30,
 			retryAllAccountsRateLimited: true,
 			retryAllAccountsMaxWaitMs: 0,
-			retryAllAccountsMaxRetries: Infinity,
+			retryAllAccountsMaxRetries: 12,
+			retryAllAccountsAbsoluteCeilingMs: 0,
 			unsupportedCodexPolicy: 'strict',
 			fallbackOnUnsupportedCodexModel: false,
 			fallbackToGpt52OnUnsupportedGpt53: true,
@@ -549,6 +602,7 @@ describe('Plugin Configuration', () => {
 			rateLimitToastDebounceMs: 60_000,
 			toastDurationMs: 5_000,
 			perProjectAccounts: true,
+			telemetryEnabled: true,
 			sessionRecovery: true,
 			autoResume: true,
 			parallelProbing: false,
@@ -599,6 +653,43 @@ describe('Plugin Configuration', () => {
 			);
 			expect(validationWarnings).toHaveLength(1);
 		});
+
+		it('sanitizes invalid config fields while preserving valid settings', () => {
+			mockExistsSync.mockReturnValue(true);
+			mockReadFileSync.mockReturnValue(
+				JSON.stringify({
+					codexMode: false,
+					unsupportedCodexPolicy: 'fallback',
+					emptyResponseMaxRetries: 4,
+					fetchTimeoutMs: 'invalid-timeout',
+					preemptiveQuotaRemainingPercent5h: 'invalid-percent',
+				}),
+			);
+
+			const config = loadPluginConfig();
+
+			expect(config.codexMode).toBe(false);
+			expect(config.unsupportedCodexPolicy).toBe('fallback');
+			expect(config.emptyResponseMaxRetries).toBe(4);
+			// Invalid values should be dropped and defaulted safely.
+			expect(config.fetchTimeoutMs).toBe(60_000);
+			expect(config.preemptiveQuotaRemainingPercent5h).toBe(5);
+		});
+
+		it('sanitizes out-of-range numeric config fields to safe defaults', () => {
+			mockExistsSync.mockReturnValue(true);
+			mockReadFileSync.mockReturnValue(
+				JSON.stringify({
+					fetchTimeoutMs: 10,
+					preemptiveQuotaRemainingPercent5h: 500,
+				}),
+			);
+
+			const config = loadPluginConfig();
+
+			expect(config.fetchTimeoutMs).toBe(60_000);
+			expect(config.preemptiveQuotaRemainingPercent5h).toBe(5);
+		});
 	});
 
 	describe('getCodexMode', () => {
@@ -741,6 +832,25 @@ describe('Plugin Configuration', () => {
 		});
 	});
 
+	describe('getTelemetryEnabled', () => {
+		it('should default to true', () => {
+			delete process.env.CODEX_AUTH_TELEMETRY_ENABLED;
+			expect(getTelemetryEnabled({})).toBe(true);
+		});
+
+		it('should use config value when env var not set', () => {
+			delete process.env.CODEX_AUTH_TELEMETRY_ENABLED;
+			expect(getTelemetryEnabled({ telemetryEnabled: false })).toBe(false);
+		});
+
+		it('should prioritize env var over config', () => {
+			process.env.CODEX_AUTH_TELEMETRY_ENABLED = '0';
+			expect(getTelemetryEnabled({ telemetryEnabled: true })).toBe(false);
+			process.env.CODEX_AUTH_TELEMETRY_ENABLED = '1';
+			expect(getTelemetryEnabled({ telemetryEnabled: false })).toBe(true);
+		});
+	});
+
 	describe('getFallbackToGpt52OnUnsupportedGpt53', () => {
 		it('should default to true', () => {
 			delete process.env.CODEX_AUTH_FALLBACK_GPT53_TO_GPT52;
@@ -939,6 +1049,41 @@ describe('Plugin Configuration', () => {
 			expect(result).toBe(5);
 		});
 
+		it('should clamp all-account retry max to hard upper bound', () => {
+			process.env.CODEX_AUTH_RETRY_ALL_MAX_RETRIES = '10000';
+			const result = getRetryAllAccountsMaxRetries({});
+			expect(result).toBe(100);
+			delete process.env.CODEX_AUTH_RETRY_ALL_MAX_RETRIES;
+		});
+
+		it('should default retry-all absolute ceiling to zero', () => {
+			delete process.env.CODEX_AUTH_RETRY_ALL_ABSOLUTE_CEILING_MS;
+			expect(getRetryAllAccountsAbsoluteCeilingMs({})).toBe(0);
+		});
+
+		it('should prioritize retry-all absolute ceiling env override', () => {
+			process.env.CODEX_AUTH_RETRY_ALL_ABSOLUTE_CEILING_MS = '12000';
+			const config: PluginConfig = { retryAllAccountsAbsoluteCeilingMs: 5000 };
+			expect(getRetryAllAccountsAbsoluteCeilingMs(config)).toBe(12000);
+		});
+
+		it('should clamp retry-all absolute ceiling to 24h upper bound', () => {
+			process.env.CODEX_AUTH_RETRY_ALL_ABSOLUTE_CEILING_MS = String(48 * 60 * 60_000);
+			expect(getRetryAllAccountsAbsoluteCeilingMs({ retryAllAccountsAbsoluteCeilingMs: 5000 }))
+				.toBe(24 * 60 * 60_000);
+		});
+
+		it('clamps negative retry-all absolute ceiling env override to zero', () => {
+			process.env.CODEX_AUTH_RETRY_ALL_ABSOLUTE_CEILING_MS = '-1';
+			expect(getRetryAllAccountsAbsoluteCeilingMs({ retryAllAccountsAbsoluteCeilingMs: 5000 })).toBe(0);
+		});
+
+		it('falls back to config/default when retry-all absolute ceiling env override is invalid', () => {
+			process.env.CODEX_AUTH_RETRY_ALL_ABSOLUTE_CEILING_MS = 'not-a-number';
+			expect(getRetryAllAccountsAbsoluteCeilingMs({ retryAllAccountsAbsoluteCeilingMs: 5000 })).toBe(5000);
+			expect(getRetryAllAccountsAbsoluteCeilingMs({})).toBe(0);
+		});
+
 		it('should return env value without min constraint', () => {
 			process.env.CODEX_AUTH_TOKEN_REFRESH_SKEW_MS = '30000';
 			const config: PluginConfig = { tokenRefreshSkewMs: 60000 };
diff --git a/test/public-api-contract.test.ts b/test/public-api-contract.test.ts
index 307093f32..4e4c20d03 100644
--- a/test/public-api-contract.test.ts
+++ b/test/public-api-contract.test.ts
@@ -44,6 +44,25 @@ describe("public api contract", () => {
 		}
 	});
 
+	it("keeps tier-b barrel exports for storage/auth reliability helpers", async () => {
+		const barrel = await import("../lib/index.js");
+		const required = [
+			"acquireFileLock",
+			"acquireFileLockSync",
+			"encryptSecret",
+			"decryptSecret",
+			"enforceDataRetention",
+			"redactForExternalOutput",
+			"authorizeAction",
+			"runBackgroundJobWithRetry",
+			"checkAndRecordIdempotencyKey",
+			"markIdempotencySucceeded",
+			"clearIdempotencyOnFailure",
+		].sort();
+		const exported = required.filter((name) => name in barrel).sort();
+		expect(exported).toEqual(required);
+	});
+
 	it("keeps positional and options-object overload behavior aligned", async () => {
 		const healthTracker = new HealthScoreTracker();
 		const tokenTracker = new TokenBucketTracker();
diff --git a/test/quota-cache.test.ts b/test/quota-cache.test.ts
index 54b5ffb62..aa83a83aa 100644
--- a/test/quota-cache.test.ts
+++ b/test/quota-cache.test.ts
@@ -1,7 +1,9 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 import { promises as fs } from "node:fs";
+import { spawn } from "node:child_process";
 import { join } from "node:path";
 import { tmpdir } from "node:os";
+import { pathToFileURL } from "node:url";
 
 describe("quota cache", () => {
   let tempDir: string;
@@ -33,7 +35,7 @@ describe("quota cache", () => {
     const { loadQuotaCache, saveQuotaCache, getQuotaCachePath } =
       await import("../lib/quota-cache.js");
 
-    await saveQuotaCache({
+    const saved = await saveQuotaCache({
       byAccountId: {
         acc_1: {
           updatedAt: Date.now(),
@@ -46,6 +48,7 @@ describe("quota cache", () => {
       },
       byEmail: {},
     });
+    expect(saved).toBe(true);
 
     const loaded = await loadQuotaCache();
     expect(loaded.byAccountId.acc_1?.primary.usedPercent).toBe(40);
@@ -177,7 +180,7 @@ describe("quota cache", () => {
     });
 
     try {
-      await saveQuotaCache({
+      const saved = await saveQuotaCache({
         byAccountId: {
           acc_1: {
             updatedAt: Date.now(),
@@ -190,7 +193,11 @@ describe("quota cache", () => {
         byEmail: {},
       });
 
-      expect(unlinkSpy).toHaveBeenCalledTimes(1);
+      const tmpUnlinks = unlinkSpy.mock.calls.filter((call) =>
+        String(call[0]).endsWith(".tmp"),
+      );
+      expect(tmpUnlinks).toHaveLength(1);
+      expect(saved).toBe(false);
       const entries = await fs.readdir(tempDir);
       expect(entries.some((entry) => entry.endsWith(".tmp"))).toBe(false);
     } finally {
@@ -333,8 +340,9 @@ describe("quota cache", () => {
 
       const mkdirSpy = vi.spyOn(fs, "mkdir");
       mkdirSpy.mockRejectedValueOnce("mkdir-string-failure");
-      await saveQuotaCache({ byAccountId: {}, byEmail: {} });
+      const saved = await saveQuotaCache({ byAccountId: {}, byEmail: {} });
       mkdirSpy.mockRestore();
+      expect(saved).toBe(false);
 
       const messages = warnMock.mock.calls.map((args) => String(args[0]));
       expect(
@@ -347,4 +355,77 @@ describe("quota cache", () => {
       vi.doUnmock("../lib/logger.js");
     }
   });
+
+  it("serializes concurrent saveQuotaCache writers across processes", async () => {
+    const { loadQuotaCache } = await import("../lib/quota-cache.js");
+    const workerScriptPath = join(tempDir, "quota-cache-worker.mjs");
+    const moduleUrl = pathToFileURL(
+      join(process.cwd(), "dist", "lib", "quota-cache.js"),
+    ).href;
+    const workerCount = 4;
+    const iterations = 8;
+
+    await fs.writeFile(
+      workerScriptPath,
+      `const [moduleUrl, rootDir, workerIdRaw, workerCountRaw, iterationsRaw] = process.argv.slice(2);
+process.env.CODEX_MULTI_AUTH_DIR = rootDir;
+const workerId = Number(workerIdRaw);
+const workerCount = Number(workerCountRaw);
+const iterations = Number(iterationsRaw);
+const { saveQuotaCache } = await import(moduleUrl);
+for (let i = 0; i < iterations; i += 1) {
+  const byAccountId = {};
+  for (let w = 0; w < workerCount; w += 1) {
+    byAccountId[\`acc_\${w}\`] = {
+      updatedAt: Date.now(),
+      status: 200,
+      model: \`writer-\${workerId}-iter-\${i}\`,
+      primary: { usedPercent: w + i, windowMinutes: 300 },
+      secondary: { usedPercent: workerId, windowMinutes: 10080 },
+    };
+  }
+  await saveQuotaCache({ byAccountId, byEmail: {} });
+}
+`,
+      "utf8",
+    );
+
+    const runWorker = (workerId: number): Promise<void> =>
+      new Promise((resolve, reject) => {
+        const child = spawn(
+          process.execPath,
+          [
+            workerScriptPath,
+            moduleUrl,
+            tempDir,
+            String(workerId),
+            String(workerCount),
+            String(iterations),
+          ],
+          { stdio: ["ignore", "pipe", "pipe"] },
+        );
+        let stderr = "";
+        child.stderr.on("data", (chunk: Buffer) => {
+          stderr += chunk.toString("utf8");
+        });
+        child.on("error", reject);
+        child.on("exit", (code) => {
+          if (code === 0) {
+            resolve();
+            return;
+          }
+          reject(new Error(`quota worker ${workerId} exited with ${code}: ${stderr}`));
+        });
+      });
+
+    await Promise.all(Array.from({ length: workerCount }, (_, workerId) => runWorker(workerId)));
+
+    const loaded = await loadQuotaCache();
+    const keys = Object.keys(loaded.byAccountId).sort();
+    expect(keys).toEqual(["acc_0", "acc_1", "acc_2", "acc_3"]);
+    for (const key of keys) {
+      expect(loaded.byAccountId[key]?.model.startsWith("writer-")).toBe(true);
+      expect(typeof loaded.byAccountId[key]?.primary.usedPercent).toBe("number");
+    }
+  });
 });
diff --git a/test/recovery-storage.test.ts b/test/recovery-storage.test.ts
index 6ff7d21e4..434a133aa 100644
--- a/test/recovery-storage.test.ts
+++ b/test/recovery-storage.test.ts
@@ -24,8 +24,19 @@ const fsMock = vi.hoisted(() => ({
   writeFileSync: vi.fn(),
 }));
 
+const loggerMock = vi.hoisted(() => ({
+  debug: vi.fn(),
+  info: vi.fn(),
+  warn: vi.fn(),
+  error: vi.fn(),
+}));
+const createLoggerMock = vi.hoisted(() => vi.fn(() => loggerMock));
+
 vi.mock("fs/promises", () => fsPromisesMock);
 vi.mock("node:fs", () => fsMock);
+vi.mock("../lib/logger.js", () => ({
+  createLogger: createLoggerMock,
+}));
 vi.mock("../lib/recovery/constants.js", () => ({
   MESSAGE_STORAGE,
   PART_STORAGE,
@@ -37,6 +48,7 @@ let storage: typeof import("../lib/recovery/storage.js");
 
 beforeEach(async () => {
   vi.resetAllMocks();
+  createLoggerMock.mockImplementation(() => loggerMock);
   vi.resetModules();
   storage = await import("../lib/recovery/storage.js");
 });
@@ -138,6 +150,101 @@ describe("RecoveryStorage", () => {
 
       expect(storage.readMessages(sessionID)).toEqual([]);
     });
+
+    it("skips message files with invalid object shape", () => {
+      const sessionID = "sess";
+      const messageDir = join(MESSAGE_STORAGE, sessionID);
+
+      fsMock.existsSync.mockImplementation((path: string) => path === MESSAGE_STORAGE || path === messageDir);
+      fsMock.readdirSync.mockReturnValue(["valid.json", "invalid-shape.json"]);
+      fsMock.readFileSync.mockImplementation((path: string) => {
+        if (path === join(messageDir, "valid.json")) {
+          return JSON.stringify({ id: "a", sessionID, role: "assistant", time: { created: 1 } });
+        }
+        if (path === join(messageDir, "invalid-shape.json")) {
+          return JSON.stringify({ role: "assistant", time: { created: 2 } });
+        }
+        return "";
+      });
+
+      const result = storage.readMessages(sessionID);
+      expect(result).toHaveLength(1);
+      expect(result[0]?.id).toBe("a");
+    });
+
+    it("skips message files when parsed payload is an array", () => {
+      const sessionID = "sess";
+      const messageDir = join(MESSAGE_STORAGE, sessionID);
+
+      fsMock.existsSync.mockImplementation((path: string) => path === MESSAGE_STORAGE || path === messageDir);
+      fsMock.readdirSync.mockReturnValue(["valid.json", "array-payload.json"]);
+      fsMock.readFileSync.mockImplementation((path: string) => {
+        if (path === join(messageDir, "valid.json")) {
+          return JSON.stringify({ id: "a", sessionID, role: "assistant", time: { created: 1 } });
+        }
+        if (path === join(messageDir, "array-payload.json")) {
+          return JSON.stringify([{ id: "array-item" }]);
+        }
+        return "";
+      });
+
+      const result = storage.readMessages(sessionID);
+      expect(result).toHaveLength(1);
+      expect(result[0]?.id).toBe("a");
+    });
+
+    it("limits corruption warnings per read and emits one suppression warning", () => {
+      const sessionID = "sess";
+      const messageDir = join(MESSAGE_STORAGE, sessionID);
+      const corruptedFiles = Array.from({ length: 30 }, (_, index) => `bad-${index}.json`);
+
+      fsMock.existsSync.mockImplementation((path: string) => path === MESSAGE_STORAGE || path === messageDir);
+      fsMock.readdirSync.mockReturnValue(corruptedFiles);
+      fsMock.readFileSync.mockReturnValue("{ malformed");
+
+      const result = storage.readMessages(sessionID);
+      expect(result).toEqual([]);
+
+      const warnCalls = loggerMock.warn.mock.calls;
+      const corruptionWarns = warnCalls.filter(
+        (call) => call[0] === "Skipped corrupted recovery artifact",
+      );
+      const suppressionWarns = warnCalls.filter(
+        (call) => call[0] === "Suppressing further corrupted recovery artifact warnings",
+      );
+      expect(corruptionWarns).toHaveLength(25);
+      expect(suppressionWarns).toHaveLength(1);
+      expect(suppressionWarns[0]?.[1]).toEqual({ limit: 25 });
+    });
+
+    it("resets corruption warning budget for each read invocation", () => {
+      const sessionID = "sess";
+      const messageDir = join(MESSAGE_STORAGE, sessionID);
+      const firstBatch = Array.from({ length: 30 }, (_, index) => `bad-${index}.json`);
+      const secondBatch = ["bad-again.json"];
+      let readDirectoryCalls = 0;
+
+      fsMock.existsSync.mockImplementation((path: string) => path === MESSAGE_STORAGE || path === messageDir);
+      fsMock.readdirSync.mockImplementation((path: string) => {
+        if (path !== messageDir) return [];
+        readDirectoryCalls += 1;
+        return readDirectoryCalls === 1 ? firstBatch : secondBatch;
+      });
+      fsMock.readFileSync.mockReturnValue("{ malformed");
+
+      expect(storage.readMessages(sessionID)).toEqual([]);
+      expect(storage.readMessages(sessionID)).toEqual([]);
+
+      const warnCalls = loggerMock.warn.mock.calls;
+      const corruptionWarns = warnCalls.filter(
+        (call) => call[0] === "Skipped corrupted recovery artifact",
+      );
+      const suppressionWarns = warnCalls.filter(
+        (call) => call[0] === "Suppressing further corrupted recovery artifact warnings",
+      );
+      expect(corruptionWarns).toHaveLength(26);
+      expect(suppressionWarns).toHaveLength(1);
+    });
   });
 
   describe("readParts", () => {
@@ -181,6 +288,48 @@ describe("RecoveryStorage", () => {
 
       expect(storage.readParts(messageID)).toEqual([]);
     });
+
+    it("skips part files with invalid object shape", () => {
+      const messageID = "msg";
+      const partDir = join(PART_STORAGE, messageID);
+
+      fsMock.existsSync.mockImplementation((path: string) => path === partDir);
+      fsMock.readdirSync.mockReturnValue(["valid.json", "invalid-shape.json"]);
+      fsMock.readFileSync.mockImplementation((path: string) => {
+        if (path === join(partDir, "valid.json")) {
+          return JSON.stringify({ id: "1", messageID, sessionID: "s", type: "text", text: "hi" });
+        }
+        if (path === join(partDir, "invalid-shape.json")) {
+          return JSON.stringify({ id: "x", type: "text" });
+        }
+        return "";
+      });
+
+      const result = storage.readParts(messageID);
+      expect(result).toHaveLength(1);
+      expect(result[0]?.id).toBe("1");
+    });
+
+    it("skips part files when parsed payload is an array", () => {
+      const messageID = "msg";
+      const partDir = join(PART_STORAGE, messageID);
+
+      fsMock.existsSync.mockImplementation((path: string) => path === partDir);
+      fsMock.readdirSync.mockReturnValue(["valid.json", "array-payload.json"]);
+      fsMock.readFileSync.mockImplementation((path: string) => {
+        if (path === join(partDir, "valid.json")) {
+          return JSON.stringify({ id: "1", messageID, sessionID: "s", type: "text", text: "hi" });
+        }
+        if (path === join(partDir, "array-payload.json")) {
+          return JSON.stringify([{ id: "array-item" }]);
+        }
+        return "";
+      });
+
+      const result = storage.readParts(messageID);
+      expect(result).toHaveLength(1);
+      expect(result[0]?.id).toBe("1");
+    });
   });
 
   describe("hasContent", () => {
diff --git a/test/refresh-lease.test.ts b/test/refresh-lease.test.ts
index ef54caa54..3123c03d6 100644
--- a/test/refresh-lease.test.ts
+++ b/test/refresh-lease.test.ts
@@ -26,6 +26,7 @@ describe("RefreshLeaseCoordinator", () => {
 
   afterEach(() => {
     leaseDir = "";
+    vi.useRealTimers();
     vi.restoreAllMocks();
   });
 
@@ -107,7 +108,9 @@ describe("RefreshLeaseCoordinator", () => {
     expect(lockContent).toBe("{");
   });
 
-  it("retries stale lock cleanup when unlink is temporarily busy", async () => {
+  it.each(["EBUSY", "EPERM"] as const)(
+    "retries stale lock cleanup when unlink fails transiently with %s",
+    async (unlinkCode) => {
     const refreshToken = "token-retry";
     const tokenHash = hashToken(refreshToken);
     let busyCount = 0;
@@ -121,7 +124,7 @@ describe("RefreshLeaseCoordinator", () => {
         if (String(path).endsWith(".lock") && busyCount < 2) {
           busyCount += 1;
           const error = new Error("busy") as NodeJS.ErrnoException;
-          error.code = "EBUSY";
+          error.code = unlinkCode;
           throw error;
         }
         return originalUnlink(path);
@@ -159,7 +162,8 @@ describe("RefreshLeaseCoordinator", () => {
     expect(fsOps.unlink).toHaveBeenCalled();
     expect(busyCount).toBe(2);
     await handle.release(sampleSuccessResult);
-  });
+    },
+  );
 
   it("times out to bypass when stale lock cannot be deleted", async () => {
     const refreshToken = "token-timeout";
@@ -211,6 +215,78 @@ describe("RefreshLeaseCoordinator", () => {
     expect(fsOps.unlink).toHaveBeenCalled();
     await handle.release(sampleSuccessResult);
   });
+
+  it.each(["EBUSY", "EPERM"] as const)(
+    "returns follower on wait-timeout when a fresh result appears (%s stale lock delete)",
+    async (unlinkCode) => {
+      vi.useFakeTimers();
+      vi.setSystemTime(new Date("2026-01-01T00:00:00.000Z"));
+      const refreshToken = "token-timeout-follower";
+      const tokenHash = hashToken(refreshToken);
+      const resultPath = join(leaseDir, `${tokenHash}.result.json`);
+      const originalUnlink = fsPromises.unlink.bind(fsPromises);
+      const fsOps = {
+        mkdir: fsPromises.mkdir.bind(fsPromises),
+        open: fsPromises.open.bind(fsPromises),
+        writeFile: fsPromises.writeFile.bind(fsPromises),
+        rename: fsPromises.rename.bind(fsPromises),
+        unlink: vi.fn(async (path: Parameters<typeof fsPromises.unlink>[0]) => {
+          if (String(path).endsWith(".lock")) {
+            const error = new Error("busy") as NodeJS.ErrnoException;
+            error.code = unlinkCode;
+            throw error;
+          }
+          return originalUnlink(path);
+        }),
+        readFile: fsPromises.readFile.bind(fsPromises),
+        stat: fsPromises.stat.bind(fsPromises),
+        readdir: fsPromises.readdir.bind(fsPromises),
+      };
+
+      const coordinator = new RefreshLeaseCoordinator({
+        enabled: true,
+        leaseDir,
+        leaseTtlMs: 2_000,
+        waitTimeoutMs: 220,
+        pollIntervalMs: 25,
+        resultTtlMs: 2_000,
+        fsOps,
+      });
+
+      await mkdir(leaseDir, { recursive: true });
+      const lockPath = join(leaseDir, `${tokenHash}.lock`);
+      await writeFile(
+        lockPath,
+        JSON.stringify({
+          tokenHash,
+          pid: 3333,
+          acquiredAt: Date.now() - 10_000,
+          expiresAt: Date.now() - 5_000,
+        }),
+        "utf8",
+      );
+
+      const acquirePromise = coordinator.acquire(refreshToken);
+      await vi.advanceTimersByTimeAsync(80);
+      await writeFile(
+        resultPath,
+        JSON.stringify({
+          tokenHash,
+          createdAt: Date.now(),
+          result: sampleSuccessResult,
+        }),
+        "utf8",
+      );
+      await vi.advanceTimersByTimeAsync(1_000);
+      const handle = await acquirePromise;
+
+      expect(handle.role).toBe("follower");
+      expect(handle.result).toEqual(sampleSuccessResult);
+      await handle.release(sampleSuccessResult);
+      await expect(fsPromises.stat(lockPath)).resolves.toBeTruthy();
+    },
+    10_000,
+  );
   it("treats empty refresh token as bypass", async () => {
     const coordinator = new RefreshLeaseCoordinator({
       enabled: true,
@@ -376,7 +452,8 @@ describe("RefreshLeaseCoordinator", () => {
       pollIntervalMs: 20,
     });
     let handle = await coordinator.acquire(refreshToken);
-    expect(handle.role).toBe("bypass");
+    expect(handle.role).toBe("owner");
+    await handle.release();
 
     await writeFile(
       lockPath,
diff --git a/test/refresh-queue.test.ts b/test/refresh-queue.test.ts
index 909820442..6ed26996f 100644
--- a/test/refresh-queue.test.ts
+++ b/test/refresh-queue.test.ts
@@ -4,7 +4,10 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { RefreshQueue, getRefreshQueue, resetRefreshQueue, queuedRefresh } from "../lib/refresh-queue.js";
 import * as authModule from "../lib/auth/auth.js";
-import { RefreshLeaseCoordinator } from "../lib/refresh-lease.js";
+import {
+  REFRESH_LEASE_BYPASS_REASON_WAIT_TIMEOUT,
+  RefreshLeaseCoordinator,
+} from "../lib/refresh-lease.js";
 
 const loggerMocks = vi.hoisted(() => ({
   info: vi.fn(),
@@ -897,6 +900,90 @@ describe("RefreshQueue", () => {
 			expect(authModule.refreshAccessToken).toHaveBeenCalledTimes(1);
 		});
 
+		it("fails closed when lease returns wait-timeout bypass", async () => {
+			const leaseCoordinator = {
+				acquire: vi.fn().mockResolvedValue({
+					role: "bypass" as const,
+					reason: REFRESH_LEASE_BYPASS_REASON_WAIT_TIMEOUT,
+					release: vi.fn().mockResolvedValue(undefined),
+				}),
+			} as unknown as RefreshLeaseCoordinator;
+			vi.mocked(authModule.refreshAccessToken).mockResolvedValue({
+				type: "success",
+				access: "unexpected-access",
+				refresh: "unexpected-refresh",
+				expires: Date.now() + 3_600_000,
+			});
+
+			const queue = new RefreshQueue(30_000, leaseCoordinator);
+			const result = await queue.refresh("token-wait-timeout");
+
+			expect(result.type).toBe("failed");
+			if (result.type === "failed") {
+				expect(result.message).toContain("lease timeout");
+			}
+			expect(authModule.refreshAccessToken).not.toHaveBeenCalled();
+		});
+
+		it("joins superseding generation when wait-timeout bypass is stale", async () => {
+			vi.useFakeTimers();
+			try {
+				let resolveFirstAcquire:
+					| ((value: Awaited<ReturnType<RefreshLeaseCoordinator["acquire"]>>) => void)
+					| undefined;
+				const firstAcquire = new Promise<Awaited<ReturnType<RefreshLeaseCoordinator["acquire"]>>>(
+					(resolve) => {
+						resolveFirstAcquire = resolve;
+					},
+				);
+				const ownerLease = {
+					role: "owner" as const,
+					release: vi.fn().mockResolvedValue(undefined),
+				};
+				const leaseAcquire = vi.fn().mockReturnValueOnce(firstAcquire).mockResolvedValue(ownerLease);
+				const leaseCoordinator = {
+					acquire: leaseAcquire,
+				} as unknown as RefreshLeaseCoordinator;
+
+				const successResult = {
+					type: "success" as const,
+					access: "access-after-supersede",
+					refresh: "refresh-after-supersede",
+					expires: Date.now() + 3_600_000,
+				};
+				let resolveRefresh: ((value: typeof successResult) => void) | undefined;
+				const delayedRefresh = new Promise<typeof successResult>((resolve) => {
+					resolveRefresh = resolve;
+				});
+				vi.mocked(authModule.refreshAccessToken).mockReturnValue(delayedRefresh);
+
+				const queue = new RefreshQueue(1_000, leaseCoordinator);
+				const firstAttempt = queue.refresh("token-wait-timeout-superseded");
+				await Promise.resolve();
+				expect(queue.pendingCount).toBe(1);
+
+				await vi.advanceTimersByTimeAsync(1_200);
+				const secondAttempt = queue.refresh("token-wait-timeout-superseded");
+				await Promise.resolve();
+				expect(leaseAcquire).toHaveBeenCalledTimes(2);
+
+				resolveFirstAcquire?.({
+					role: "bypass",
+					reason: REFRESH_LEASE_BYPASS_REASON_WAIT_TIMEOUT,
+					release: vi.fn().mockResolvedValue(undefined),
+				});
+				await Promise.resolve();
+
+				resolveRefresh?.(successResult);
+				const [firstResult, secondResult] = await Promise.all([firstAttempt, secondAttempt]);
+				expect(firstResult).toEqual(successResult);
+				expect(secondResult).toEqual(successResult);
+				expect(vi.mocked(authModule.refreshAccessToken)).toHaveBeenCalledTimes(1);
+			} finally {
+				vi.useRealTimers();
+			}
+		});
+
 		it("swallows lease release errors and still returns token result", async () => {
 			const mockResult = {
 				type: "success" as const,
diff --git a/test/response-handler-logging.test.ts b/test/response-handler-logging.test.ts
index a295b7544..5949d3cd4 100644
--- a/test/response-handler-logging.test.ts
+++ b/test/response-handler-logging.test.ts
@@ -14,7 +14,8 @@ vi.mock("../lib/logger.js", () => ({
 }));
 
 describe("response handler logging branch", () => {
-	it("logs full stream content when logging is enabled", async () => {
+	it("does not log full stream content for successful SSE conversion", async () => {
+		logRequestMock.mockClear();
 		const { convertSseToJson } = await import("../lib/request/response-handler.js");
 		const response = new Response(
 			'data: {"type":"response.done","response":{"id":"resp_logging"}}\n',
@@ -23,10 +24,24 @@ describe("response handler logging branch", () => {
 		const result = await convertSseToJson(response, new Headers());
 		expect(result.status).toBe(200);
 		expect(result.headers.get("content-type")).toContain("application/json");
-		expect(logRequestMock).toHaveBeenCalledTimes(1);
-		expect(logRequestMock).toHaveBeenCalledWith(
-			"stream-full",
-			expect.objectContaining({ fullContent: expect.stringContaining("response.done") }),
+		expect(logRequestMock).not.toHaveBeenCalled();
+	});
+
+	it("logs only fixed parse error details without raw stream content", async () => {
+		logRequestMock.mockClear();
+		const { convertSseToJson } = await import("../lib/request/response-handler.js");
+		const response = new Response(
+			'data: {"type":"chunk","delta":"email=user@example.com token=sk-secret-value"}\n',
 		);
+
+		const result = await convertSseToJson(response, new Headers());
+		expect(result.status).toBe(502);
+		expect(logRequestMock).toHaveBeenCalledWith("stream-error", {
+			error: "No response.done event found",
+		});
+
+		const serializedCalls = JSON.stringify(logRequestMock.mock.calls);
+		expect(serializedCalls).not.toContain("user@example.com");
+		expect(serializedCalls).not.toContain("sk-secret-value");
 	});
 });
diff --git a/test/response-handler.test.ts b/test/response-handler.test.ts
index 2da04e9df..339967e24 100644
--- a/test/response-handler.test.ts
+++ b/test/response-handler.test.ts
@@ -61,7 +61,7 @@ data: {"type":"response.completed","response":{"id":"resp_456","output":"done"}}
 			expect(body).toEqual({ id: 'resp_456', output: 'done' });
 		});
 
-		it('should return original text if no final response found', async () => {
+		it('should return JSON stream parse error if no final response found', async () => {
 			const sseContent = `data: {"type":"response.started"}
 data: {"type":"chunk","delta":"text"}
 `;
@@ -69,9 +69,34 @@ data: {"type":"chunk","delta":"text"}
 			const headers = new Headers();
 
 			const result = await convertSseToJson(response, headers);
-			const text = await result.text();
+			const body = await result.json();
 
-			expect(text).toBe(sseContent);
+			expect(body).toEqual({
+				error: {
+					message: 'No response.done event found in SSE stream',
+					type: 'stream_parse_error',
+				},
+			});
+			expect(result.status).toBe(502);
+			expect(result.headers.get('content-type')).toBe('application/json; charset=utf-8');
+		});
+
+		it('should handle CRLF line endings for stream parse errors', async () => {
+			const sseContent = `data: {"type":"response.started"}\r\ndata: {"type":"chunk","delta":"text"}\r\n`;
+			const response = new Response(sseContent);
+			const headers = new Headers();
+
+			const result = await convertSseToJson(response, headers);
+			const body = await result.json();
+
+			expect(body).toEqual({
+				error: {
+					message: 'No response.done event found in SSE stream',
+					type: 'stream_parse_error',
+				},
+			});
+			expect(result.status).toBe(502);
+			expect(result.headers.get('content-type')).toBe('application/json; charset=utf-8');
 		});
 
 		it('should skip malformed JSON in SSE stream', async () => {
@@ -92,9 +117,16 @@ data: {"type":"response.done","response":{"id":"resp_789"}}
 			const headers = new Headers();
 
 			const result = await convertSseToJson(response, headers);
-			const text = await result.text();
+			const body = await result.json();
 
-			expect(text).toBe('');
+			expect(body).toEqual({
+				error: {
+					message: 'No response.done event found in SSE stream',
+					type: 'stream_parse_error',
+				},
+			});
+			expect(result.status).toBe(502);
+			expect(result.headers.get('content-type')).toBe('application/json; charset=utf-8');
 		});
 
 		it('should preserve response status and statusText', async () => {
diff --git a/test/retention-cleanup.test.ts b/test/retention-cleanup.test.ts
new file mode 100644
index 000000000..d50a1f9b6
--- /dev/null
+++ b/test/retention-cleanup.test.ts
@@ -0,0 +1,72 @@
+import { afterEach, describe, expect, it } from "vitest";
+import { chmodSync, mkdtempSync, utimesSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import process from "node:process";
+import { spawnSync, type SpawnSyncReturns } from "node:child_process";
+import { promises as fs } from "node:fs";
+import { removeWithRetry } from "./helpers/remove-with-retry.js";
+
+const scriptPath = path.resolve(process.cwd(), "scripts", "retention-cleanup.js");
+
+function runRetentionCleanup(root: string, extraArgs: string[] = []) {
+	return spawnSync(process.execPath, [scriptPath, ...extraArgs], {
+		encoding: "utf8",
+		env: {
+			...process.env,
+			CODEX_MULTI_AUTH_DIR: root,
+		},
+	});
+}
+
+function parseJsonStdout(output: string): Record<string, unknown> {
+	return JSON.parse(output) as Record<string, unknown>;
+}
+
+describe("retention-cleanup script", () => {
+	const fixtures: string[] = [];
+
+	afterEach(async () => {
+		while (fixtures.length > 0) {
+			const fixture = fixtures.pop();
+			if (!fixture) continue;
+			await removeWithRetry(fixture);
+		}
+	});
+
+	it("handles target directory churn (ENOTDIR) gracefully", async () => {
+		const root = mkdtempSync(path.join(tmpdir(), "retention-churn-"));
+		fixtures.push(root);
+		await fs.writeFile(path.join(root, "logs"), "not-a-dir", "utf8");
+
+		const result = runRetentionCleanup(root, ["--days=1"]);
+		expect(result.status).toBe(0);
+		const payload = parseJsonStdout(result.stdout);
+		expect(payload.status).toBe("pass");
+		expect(payload.failedFiles).toBe(0);
+	});
+
+	it.skipIf(process.platform === "win32")("exits non-zero when deletions fail", async () => {
+		const root = mkdtempSync(path.join(tmpdir(), "retention-fail-"));
+		fixtures.push(root);
+		const logsDir = path.join(root, "logs");
+		await fs.mkdir(logsDir, { recursive: true });
+		const stalePath = path.join(logsDir, "stale.log");
+		await fs.writeFile(stalePath, "stale\n", "utf8");
+		const staleDate = new Date(Date.now() - 10 * 24 * 60 * 60 * 1000);
+		utimesSync(stalePath, staleDate, staleDate);
+
+		chmodSync(logsDir, 0o500);
+		let result: SpawnSyncReturns<string>;
+		try {
+			result = runRetentionCleanup(root, ["--days=1"]);
+		} finally {
+			chmodSync(logsDir, 0o700);
+		}
+
+		expect(result.status).toBe(1);
+		const payload = parseJsonStdout(result.stdout);
+		expect(payload.status).toBe("partial");
+		expect((payload.failedFiles as number) > 0).toBe(true);
+	});
+});
diff --git a/test/retry-governor.test.ts b/test/retry-governor.test.ts
new file mode 100644
index 000000000..7ac6ac799
--- /dev/null
+++ b/test/retry-governor.test.ts
@@ -0,0 +1,177 @@
+import { describe, expect, it } from "vitest";
+import { decideRetryAllAccountsRateLimited } from "../lib/request/retry-governor.js";
+
+describe("decideRetryAllAccountsRateLimited", () => {
+	it("allows retry when all limits permit it", () => {
+		const result = decideRetryAllAccountsRateLimited({
+			enabled: true,
+			accountCount: 2,
+			waitMs: 1_000,
+			maxWaitMs: 2_000,
+			currentRetryCount: 1,
+			maxRetries: 3,
+			accumulatedWaitMs: 2_000,
+			absoluteCeilingMs: 10_000,
+		});
+
+		expect(result).toEqual({ shouldRetry: true, reason: "allowed" });
+	});
+
+	it("rejects retry when disabled", () => {
+		const result = decideRetryAllAccountsRateLimited({
+			enabled: false,
+			accountCount: 2,
+			waitMs: 1_000,
+			maxWaitMs: 0,
+			currentRetryCount: 0,
+			maxRetries: Infinity,
+			accumulatedWaitMs: 0,
+			absoluteCeilingMs: 0,
+		});
+
+		expect(result).toEqual({ shouldRetry: false, reason: "disabled" });
+	});
+
+	it("rejects retry when there are no accounts", () => {
+		const result = decideRetryAllAccountsRateLimited({
+			enabled: true,
+			accountCount: 0,
+			waitMs: 1_000,
+			maxWaitMs: 0,
+			currentRetryCount: 0,
+			maxRetries: Infinity,
+			accumulatedWaitMs: 0,
+			absoluteCeilingMs: 0,
+		});
+
+		expect(result).toEqual({ shouldRetry: false, reason: "no-accounts" });
+	});
+
+	it("rejects retry when wait time is non-positive", () => {
+		const result = decideRetryAllAccountsRateLimited({
+			enabled: true,
+			accountCount: 2,
+			waitMs: 0,
+			maxWaitMs: 0,
+			currentRetryCount: 0,
+			maxRetries: Infinity,
+			accumulatedWaitMs: 0,
+			absoluteCeilingMs: 0,
+		});
+
+		expect(result).toEqual({ shouldRetry: false, reason: "no-wait" });
+	});
+
+	it("rejects retry when wait exceeds max wait", () => {
+		const result = decideRetryAllAccountsRateLimited({
+			enabled: true,
+			accountCount: 2,
+			waitMs: 1_500,
+			maxWaitMs: 1_000,
+			currentRetryCount: 0,
+			maxRetries: Infinity,
+			accumulatedWaitMs: 0,
+			absoluteCeilingMs: 0,
+		});
+
+		expect(result).toEqual({ shouldRetry: false, reason: "wait-exceeds-max" });
+	});
+
+	it("rejects retry when max retries reached", () => {
+		const result = decideRetryAllAccountsRateLimited({
+			enabled: true,
+			accountCount: 2,
+			waitMs: 1_000,
+			maxWaitMs: 0,
+			currentRetryCount: 2,
+			maxRetries: 2,
+			accumulatedWaitMs: 0,
+			absoluteCeilingMs: 0,
+		});
+
+		expect(result).toEqual({ shouldRetry: false, reason: "retry-limit-reached" });
+	});
+
+	it("rejects retry when absolute ceiling would be exceeded", () => {
+		const result = decideRetryAllAccountsRateLimited({
+			enabled: true,
+			accountCount: 2,
+			waitMs: 1_001,
+			maxWaitMs: 0,
+			currentRetryCount: 0,
+			maxRetries: Infinity,
+			accumulatedWaitMs: 1_000,
+			absoluteCeilingMs: 2_000,
+		});
+
+		expect(result).toEqual({
+			shouldRetry: false,
+			reason: "absolute-ceiling-exceeded",
+		});
+	});
+
+	it("stops retry when accumulated wait exactly matches the absolute ceiling", () => {
+		const result = decideRetryAllAccountsRateLimited({
+			enabled: true,
+			accountCount: 2,
+			waitMs: 1_000,
+			plannedWaitMs: 0,
+			maxWaitMs: 0,
+			currentRetryCount: 0,
+			maxRetries: Infinity,
+			accumulatedWaitMs: 1_000,
+			absoluteCeilingMs: 1_000,
+		});
+
+		expect(result).toEqual({
+			shouldRetry: false,
+			reason: "absolute-ceiling-exceeded",
+		});
+	});
+
+	it("allows first retry that exactly consumes the absolute ceiling budget", () => {
+		const result = decideRetryAllAccountsRateLimited({
+			enabled: true,
+			accountCount: 2,
+			waitMs: 1_000,
+			maxWaitMs: 0,
+			currentRetryCount: 0,
+			maxRetries: Infinity,
+			accumulatedWaitMs: 0,
+			absoluteCeilingMs: 1_000,
+		});
+
+		expect(result).toEqual({ shouldRetry: true, reason: "allowed" });
+	});
+
+	it("uses planned wait for absolute ceiling checks when provided", () => {
+		const result = decideRetryAllAccountsRateLimited({
+			enabled: true,
+			accountCount: 2,
+			waitMs: 1_000,
+			plannedWaitMs: 800,
+			maxWaitMs: 0,
+			currentRetryCount: 0,
+			maxRetries: Infinity,
+			accumulatedWaitMs: 800,
+			absoluteCeilingMs: 1_600,
+		});
+
+		expect(result).toEqual({ shouldRetry: true, reason: "allowed" });
+	});
+
+	it("treats zero absolute ceiling as unlimited", () => {
+		const result = decideRetryAllAccountsRateLimited({
+			enabled: true,
+			accountCount: 2,
+			waitMs: 2_000,
+			maxWaitMs: 0,
+			currentRetryCount: 0,
+			maxRetries: Infinity,
+			accumulatedWaitMs: 100_000,
+			absoluteCeilingMs: 0,
+		});
+
+		expect(result).toEqual({ shouldRetry: true, reason: "allowed" });
+	});
+});
diff --git a/test/schemas.test.ts b/test/schemas.test.ts
index 16cd2f97d..026aad335 100644
--- a/test/schemas.test.ts
+++ b/test/schemas.test.ts
@@ -3,6 +3,7 @@ import {
 	PluginConfigSchema,
 	AccountMetadataV3Schema,
 	AccountStorageV3Schema,
+	AccountStorageV4Schema,
 	AccountStorageV1Schema,
 	AnyAccountStorageSchema,
 	TokenSuccessSchema,
@@ -30,6 +31,7 @@ describe("PluginConfigSchema", () => {
 			retryAllAccountsRateLimited: true,
 			retryAllAccountsMaxWaitMs: 5000,
 			retryAllAccountsMaxRetries: 3,
+			retryAllAccountsAbsoluteCeilingMs: 15000,
 			unsupportedCodexPolicy: "strict",
 			fallbackOnUnsupportedCodexModel: true,
 			fallbackToGpt52OnUnsupportedGpt53: false,
@@ -40,6 +42,7 @@ describe("PluginConfigSchema", () => {
 			rateLimitToastDebounceMs: 30000,
 			toastDurationMs: 5000,
 			perProjectAccounts: true,
+			telemetryEnabled: true,
 			sessionRecovery: true,
 			autoResume: false,
 			fetchTimeoutMs: 60000,
@@ -71,6 +74,7 @@ describe("PluginConfigSchema", () => {
 		["sessionAffinityMaxEntries", 7, 8],
 		["proactiveRefreshIntervalMs", 4999, 5000],
 		["proactiveRefreshBufferMs", 29_999, 30_000],
+		["retryAllAccountsAbsoluteCeilingMs", -1, 0],
 		["preemptiveQuotaMaxDeferralMs", 999, 1000],
 	] as const)("enforces minimum for %s", (key, invalidValue, validValue) => {
 		const invalidResult = PluginConfigSchema.safeParse({ [key]: invalidValue });
@@ -109,6 +113,7 @@ describe("PluginConfigSchema", () => {
 		"sessionAffinityMaxEntries",
 		"proactiveRefreshIntervalMs",
 		"proactiveRefreshBufferMs",
+		"retryAllAccountsAbsoluteCeilingMs",
 		"networkErrorCooldownMs",
 		"serverErrorCooldownMs",
 		"preemptiveQuotaRemainingPercent5h",
@@ -237,6 +242,48 @@ describe("AccountStorageV3Schema", () => {
 	});
 });
 
+describe("AccountStorageV4Schema", () => {
+	const validStorage = {
+		version: 4,
+		accounts: [
+			{ refreshTokenRef: "acct-1:refresh", accessTokenRef: "acct-1:access", addedAt: Date.now(), lastUsed: Date.now() },
+		],
+		activeIndex: 0,
+	};
+
+	it("accepts valid V4 storage", () => {
+		const result = AccountStorageV4Schema.safeParse(validStorage);
+		expect(result.success).toBe(true);
+	});
+
+	it("rejects missing refreshTokenRef", () => {
+		const result = AccountStorageV4Schema.safeParse({
+			...validStorage,
+			accounts: [{ addedAt: Date.now(), lastUsed: Date.now() }],
+		});
+		expect(result.success).toBe(false);
+	});
+
+	it("rejects empty accessTokenRef when provided", () => {
+		const result = AccountStorageV4Schema.safeParse({
+			...validStorage,
+			accounts: [{ refreshTokenRef: "acct-1:refresh", accessTokenRef: "", addedAt: Date.now(), lastUsed: Date.now() }],
+		});
+		expect(result.success).toBe(false);
+	});
+
+	it("accepts V4 storage with activeIndexByFamily", () => {
+		const result = AccountStorageV4Schema.safeParse({
+			...validStorage,
+			activeIndexByFamily: {
+				codex: 0,
+				legacy: 0,
+			},
+		});
+		expect(result.success).toBe(true);
+	});
+});
+
 describe("AccountStorageV1Schema", () => {
 	const validV1 = {
 		version: 1,
@@ -285,6 +332,18 @@ describe("AnyAccountStorageSchema (discriminated union)", () => {
 		}
 	});
 
+	it("accepts V4 storage", () => {
+		const result = AnyAccountStorageSchema.safeParse({
+			version: 4,
+			accounts: [{ refreshTokenRef: "acct-1:refresh", addedAt: 1, lastUsed: 1 }],
+			activeIndex: 0,
+		});
+		expect(result.success).toBe(true);
+		if (result.success) {
+			expect(result.data.version).toBe(4);
+		}
+	});
+
 	it("rejects unknown version", () => {
 		const result = AnyAccountStorageSchema.safeParse({
 			version: 5,
@@ -428,6 +487,16 @@ describe("safeParsePluginConfig", () => {
 });
 
 describe("safeParseAccountStorage", () => {
+	it("returns parsed V4 storage", () => {
+		const result = safeParseAccountStorage({
+			version: 4,
+			accounts: [{ refreshTokenRef: "acct-1:refresh", addedAt: 1, lastUsed: 1 }],
+			activeIndex: 0,
+		});
+		expect(result).not.toBeNull();
+		expect(result?.version).toBe(4);
+	});
+
 	it("returns parsed V1 storage", () => {
 		const result = safeParseAccountStorage({
 			version: 1,
diff --git a/test/scripts/doctor-dev.test.ts b/test/scripts/doctor-dev.test.ts
new file mode 100644
index 000000000..7785b6d45
--- /dev/null
+++ b/test/scripts/doctor-dev.test.ts
@@ -0,0 +1,177 @@
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, describe, expect, it } from "vitest";
+import {
+	readPackageScripts,
+	runDevDoctor,
+} from "../../scripts/doctor-dev.js";
+
+function createDoctorFixture(scripts: Record<string, string> = {
+	build: "echo build",
+	lint: "echo lint",
+	test: "echo test",
+	typecheck: "echo typecheck",
+	verify: "echo verify",
+}) {
+	const root = mkdtempSync(join(tmpdir(), "codex-doctor-dev-"));
+	const binDir = join(root, "bin");
+	mkdirSync(binDir, { recursive: true });
+	mkdirSync(join(root, "node_modules"), { recursive: true });
+	writeFileSync(join(root, ".git"), "");
+	writeFileSync(join(root, "package-lock.json"), "{}\n");
+	writeFileSync(
+		join(root, "package.json"),
+		`${JSON.stringify({ name: "fixture", version: "1.0.0", scripts }, null, 2)}\n`,
+	);
+	writeFileSync(join(binDir, "npm.cmd"), "");
+	writeFileSync(join(binDir, "git.cmd"), "");
+	return { root, binDir };
+}
+
+const spawnSyncVersionStub = (command: unknown) => {
+	if (String(command).toLowerCase().includes("git")) {
+		return { status: 0, stdout: "git version 2.40.0\n", stderr: "" };
+	}
+	return { status: 0, stdout: "10.9.0\n", stderr: "" };
+};
+
+describe("doctor-dev script", () => {
+	const tempDirs: string[] = [];
+
+	afterEach(() => {
+		for (const dir of tempDirs.splice(0)) {
+			rmSync(dir, { recursive: true, force: true });
+		}
+	});
+
+	it("passes on win32 when commands are found via PATHEXT lookup", () => {
+		const fixture = createDoctorFixture();
+		tempDirs.push(fixture.root);
+
+		const logs: string[] = [];
+		const warnings: string[] = [];
+		const errors: string[] = [];
+		const code = runDevDoctor({
+			cwd: fixture.root,
+			platform: "win32",
+			env: {
+				PATH: fixture.binDir,
+				PATHEXT: ".EXE;.CMD",
+				npm_execpath: "",
+			},
+			nodeVersion: "v20.9.0",
+			spawnSync: (command) => {
+				if (String(command).toLowerCase().includes("git")) {
+					return { status: 0, stdout: "git version 2.40.0\n", stderr: "" };
+				}
+				return { status: 0, stdout: "10.9.0\n", stderr: "" };
+			},
+			log: (message) => logs.push(String(message)),
+			warn: (message) => warnings.push(String(message)),
+			error: (message) => errors.push(String(message)),
+		});
+
+		expect(code).toBe(0);
+		expect(errors).toEqual([]);
+		expect(warnings).toEqual([]);
+		expect(logs.some((line) => line.includes("npm 10.9.0 OK"))).toBe(true);
+		expect(logs.some((line) => line.includes("Dev doctor passed."))).toBe(true);
+	});
+
+	it("fails when required package scripts are missing", () => {
+		const fixture = createDoctorFixture({
+			lint: "echo lint",
+			test: "echo test",
+			typecheck: "echo typecheck",
+		});
+		tempDirs.push(fixture.root);
+
+		const errors: string[] = [];
+		const code = runDevDoctor({
+			cwd: fixture.root,
+			platform: "linux",
+			env: {
+				PATH: fixture.binDir,
+				npm_execpath: "/tmp/npm-cli.js",
+			},
+			spawnSync: spawnSyncVersionStub,
+			error: (message) => errors.push(String(message)),
+			warn: () => {},
+			log: () => {},
+		});
+
+		expect(code).toBe(1);
+		expect(errors.some((line) => line.includes("Missing required npm script: build"))).toBe(true);
+	});
+
+	it("fails fast on unsupported Node major version", () => {
+		const fixture = createDoctorFixture();
+		tempDirs.push(fixture.root);
+
+		const errors: string[] = [];
+		const code = runDevDoctor({
+			cwd: fixture.root,
+			platform: "linux",
+			env: {
+				PATH: fixture.binDir,
+				npm_execpath: "/tmp/npm-cli.js",
+			},
+			nodeVersion: "v16.20.0",
+			spawnSync: spawnSyncVersionStub,
+			error: (message) => errors.push(String(message)),
+			warn: () => {},
+			log: () => {},
+		});
+
+		expect(code).toBe(1);
+		expect(errors.some((line) => line.includes("Node.js 18+ is required"))).toBe(true);
+	});
+
+	it("retries transient Windows lock errors when reading package.json", () => {
+		let attempts = 0;
+		const scripts = readPackageScripts("C:/repo", {
+			platform: "win32",
+			pathExists: () => true,
+			readFile: () => {
+				attempts += 1;
+				if (attempts === 1) {
+					throw Object.assign(new Error("busy"), { code: "EBUSY" });
+				}
+				return '{"scripts":{"build":"ok"}}';
+			},
+			baseDelayMs: 0,
+			maxAttempts: 2,
+		});
+
+		expect(scripts).toEqual({ build: "ok" });
+		expect(attempts).toBe(2);
+	});
+
+	it("fails when verify script is missing from package.json", () => {
+		const fixture = createDoctorFixture({
+			build: "echo build",
+			lint: "echo lint",
+			test: "echo test",
+			typecheck: "echo typecheck",
+		});
+		tempDirs.push(fixture.root);
+
+		const errors: string[] = [];
+		const code = runDevDoctor({
+			cwd: fixture.root,
+			platform: "linux",
+			env: {
+				PATH: fixture.binDir,
+				npm_execpath: "/tmp/npm-cli.js",
+			},
+			spawnSync: spawnSyncVersionStub,
+			error: (message) => errors.push(String(message)),
+			warn: () => {},
+			log: () => {},
+		});
+
+		expect(code).toBe(1);
+		expect(errors.some((line) => line.includes("Missing required npm script: verify"))).toBe(true);
+	});
+});
diff --git a/test/scripts/setup-dev.test.ts b/test/scripts/setup-dev.test.ts
new file mode 100644
index 000000000..37c18004d
--- /dev/null
+++ b/test/scripts/setup-dev.test.ts
@@ -0,0 +1,187 @@
+import { EventEmitter } from "node:events";
+import { describe, expect, it, vi } from "vitest";
+import {
+	resolveNpmInvocation,
+	runCommand,
+	runSetupDev,
+} from "../../scripts/setup-dev.js";
+
+describe("setup-dev script", () => {
+	it("uses process.execPath + npm_execpath when npm_execpath is set", () => {
+		expect(
+			resolveNpmInvocation({
+				npmExecPath: "/tmp/npm-cli.js",
+				execPath: "/opt/node/bin/node",
+				platform: "linux",
+			}),
+		).toEqual({
+			command: "/opt/node/bin/node",
+			prefixArgs: ["/tmp/npm-cli.js"],
+		});
+	});
+
+	it("falls back to npm.cmd on win32 when npm_execpath is absent", () => {
+		expect(
+			resolveNpmInvocation({
+				npmExecPath: "",
+				platform: "win32",
+			}),
+		).toEqual({
+			command: "npm.cmd",
+			prefixArgs: [],
+		});
+	});
+
+	it("runCommand resolves to 1 when error fires before exit", async () => {
+		const spawnFactory = vi.fn(() => {
+			const child = new EventEmitter();
+			queueMicrotask(() => {
+				child.emit("error", new Error("boom"));
+				child.emit("exit", 0, null);
+			});
+			return child;
+		});
+
+		const exitCode = await runCommand("npm", ["ci"], process.cwd(), { spawnFactory, env: {} });
+		expect(exitCode).toBe(1);
+	});
+
+	it("runCommand keeps the first result when exit fires before error", async () => {
+		const spawnFactory = vi.fn(() => {
+			const child = new EventEmitter();
+			queueMicrotask(() => {
+				child.emit("exit", 0, null);
+				child.emit("error", new Error("late error"));
+			});
+			return child;
+		});
+
+		const exitCode = await runCommand("npm", ["ci"], process.cwd(), { spawnFactory, env: {} });
+		expect(exitCode).toBe(0);
+	});
+
+	it("runCommand maps SIGINT to exit code 130", async () => {
+		const spawnFactory = vi.fn(() => {
+			const child = new EventEmitter();
+			queueMicrotask(() => {
+				child.emit("exit", null, "SIGINT");
+			});
+			return child;
+		});
+
+		const exitCode = await runCommand("npm", ["ci"], process.cwd(), { spawnFactory, env: {} });
+		expect(exitCode).toBe(130);
+	});
+
+	it("runSetupDev executes doctor, install, and validation gates in order", async () => {
+		const runDevDoctorFn = vi.fn().mockReturnValue(0);
+		const runCommandFn = vi.fn().mockResolvedValue(0);
+		const exitCode = await runSetupDev({
+			cwd: process.cwd(),
+			platform: "linux",
+			runDevDoctorFn,
+			runCommandFn,
+			npmInvocation: { command: "npm", prefixArgs: [] },
+		});
+
+		expect(exitCode).toBe(0);
+		expect(runDevDoctorFn).toHaveBeenCalledTimes(1);
+		expect(runCommandFn).toHaveBeenNthCalledWith(1, "npm", ["ci"], expect.any(String));
+		expect(runCommandFn).toHaveBeenNthCalledWith(2, "npm", ["run", "verify"], expect.any(String));
+		expect(runCommandFn).toHaveBeenNthCalledWith(
+			3,
+			"npm",
+			["test", "--", "test/documentation.test.ts"],
+			expect.any(String),
+		);
+	});
+
+	it("awaits async doctor hook before running install and validation gates", async () => {
+		const runDevDoctorFn = vi.fn(async () => 0);
+		const runCommandFn = vi.fn().mockResolvedValue(0);
+		const exitCode = await runSetupDev({
+			cwd: process.cwd(),
+			platform: "linux",
+			runDevDoctorFn,
+			runCommandFn,
+			npmInvocation: { command: "npm", prefixArgs: [] },
+		});
+
+		expect(exitCode).toBe(0);
+		expect(runDevDoctorFn).toHaveBeenCalledTimes(1);
+		expect(runCommandFn).toHaveBeenNthCalledWith(1, "npm", ["ci"], expect.any(String));
+		expect(runCommandFn).toHaveBeenNthCalledWith(2, "npm", ["run", "verify"], expect.any(String));
+		expect(runCommandFn).toHaveBeenNthCalledWith(
+			3,
+			"npm",
+			["test", "--", "test/documentation.test.ts"],
+			expect.any(String),
+		);
+	});
+
+	it("runSetupDev short-circuits when doctor fails", async () => {
+		const runDevDoctorFn = vi.fn().mockReturnValue(2);
+		const runCommandFn = vi.fn();
+		const exitCode = await runSetupDev({
+			cwd: process.cwd(),
+			runDevDoctorFn,
+			runCommandFn,
+			npmInvocation: { command: "npm", prefixArgs: [] },
+		});
+
+		expect(exitCode).toBe(2);
+		expect(runCommandFn).not.toHaveBeenCalled();
+	});
+
+	it("retries npm ci on win32 before running gates", async () => {
+		const runCommandFn = vi
+			.fn()
+			.mockResolvedValueOnce(1)
+			.mockResolvedValueOnce(1)
+			.mockResolvedValueOnce(0)
+			.mockResolvedValueOnce(0)
+			.mockResolvedValueOnce(0);
+		const waitFn = vi.fn().mockResolvedValue(undefined);
+		const exitCode = await runSetupDev({
+			cwd: process.cwd(),
+			platform: "win32",
+			runDevDoctorFn: () => 0,
+			runCommandFn,
+			waitFn,
+			npmInvocation: { command: "npm.cmd", prefixArgs: [] },
+			installRetryAttempts: 3,
+			installRetryBaseDelayMs: 10,
+		});
+
+		expect(exitCode).toBe(0);
+		expect(runCommandFn).toHaveBeenNthCalledWith(1, "npm.cmd", ["ci"], expect.any(String));
+		expect(runCommandFn).toHaveBeenNthCalledWith(2, "npm.cmd", ["ci"], expect.any(String));
+		expect(runCommandFn).toHaveBeenNthCalledWith(3, "npm.cmd", ["ci"], expect.any(String));
+		expect(waitFn).toHaveBeenCalledTimes(2);
+		expect(waitFn).toHaveBeenNthCalledWith(1, 10);
+		expect(waitFn).toHaveBeenNthCalledWith(2, 20);
+	});
+
+	it("fails setup when npm ci keeps failing after retries", async () => {
+		const runCommandFn = vi
+			.fn()
+			.mockResolvedValueOnce(1)
+			.mockResolvedValueOnce(1)
+			.mockResolvedValueOnce(1);
+		const waitFn = vi.fn().mockResolvedValue(undefined);
+		const exitCode = await runSetupDev({
+			cwd: process.cwd(),
+			platform: "win32",
+			runDevDoctorFn: () => 0,
+			runCommandFn,
+			waitFn,
+			npmInvocation: { command: "npm.cmd", prefixArgs: [] },
+			installRetryAttempts: 3,
+			installRetryBaseDelayMs: 10,
+		});
+
+		expect(exitCode).toBe(1);
+		expect(runCommandFn).toHaveBeenCalledTimes(3);
+		expect(waitFn).toHaveBeenCalledTimes(2);
+	});
+});
diff --git a/test/secrets-crypto.test.ts b/test/secrets-crypto.test.ts
new file mode 100644
index 000000000..03f6653ce
--- /dev/null
+++ b/test/secrets-crypto.test.ts
@@ -0,0 +1,132 @@
+import { createCipheriv, createHash, randomBytes } from "node:crypto";
+import { describe, expect, it } from "vitest";
+import {
+	decryptSecret,
+	encryptSecret,
+	getSecretEncryptionKeysFromEnv,
+	isEncryptedSecret,
+} from "../lib/secrets-crypto.js";
+
+function createLegacyEncryptedSecret(value: string, keyMaterial: string): string {
+	const key = createHash("sha256").update(keyMaterial, "utf8").digest();
+	const iv = randomBytes(12);
+	const cipher = createCipheriv("aes-256-gcm", key, iv);
+	const encrypted = Buffer.concat([
+		cipher.update(Buffer.from(value, "utf8")),
+		cipher.final(),
+	]);
+	const tag = cipher.getAuthTag();
+	return `enc:v1:${iv.toString("base64")}:${tag.toString("base64")}:${encrypted.toString("base64")}`;
+}
+
+describe("secrets crypto", () => {
+	it("encrypts and decrypts with the primary key", () => {
+		const encrypted = encryptSecret("refresh-token-value", "primary-key");
+		expect(encrypted.startsWith("enc:v2:")).toBe(true);
+		expect(isEncryptedSecret(encrypted)).toBe(true);
+		const decrypted = decryptSecret(encrypted, {
+			primary: "primary-key",
+			previous: null,
+		});
+		expect(decrypted).toEqual({ value: "refresh-token-value", usedPreviousKey: false });
+	});
+
+	it("decrypts legacy v1 envelopes for backward compatibility", () => {
+		const encrypted = createLegacyEncryptedSecret("legacy-token", "legacy-key");
+		const decrypted = decryptSecret(encrypted, {
+			primary: "legacy-key",
+			previous: null,
+		});
+		expect(decrypted).toEqual({ value: "legacy-token", usedPreviousKey: false });
+	});
+
+	it("uses previous key when primary cannot decrypt", () => {
+		const encrypted = encryptSecret("access-token-value", "old-key");
+		const decrypted = decryptSecret(encrypted, {
+			primary: "new-key",
+			previous: "old-key",
+		});
+		expect(decrypted).toEqual({ value: "access-token-value", usedPreviousKey: true });
+	});
+
+	it("throws when no configured key can decrypt envelope", () => {
+		const encrypted = encryptSecret("secret", "correct-key");
+		expect(() =>
+			decryptSecret(encrypted, {
+				primary: "wrong-key",
+				previous: null,
+			}),
+		).toThrow("Unable to decrypt secret with configured keys");
+	});
+
+	it("recognizes legacy and current encrypted prefixes", () => {
+		expect(isEncryptedSecret("enc:v1:abc:def:ghi")).toBe(true);
+		expect(isEncryptedSecret("enc:v2:abc:def:ghi:jkl")).toBe(true);
+		expect(isEncryptedSecret("enc:v3:abc:def:ghi:jkl")).toBe(false);
+	});
+
+	it("re-encrypts malformed prefixed plaintext inputs", () => {
+		const malformed = "enc:v2:not-a-valid-envelope";
+		const encrypted = encryptSecret(malformed, "0123456789abcdef0123456789abcdef");
+		expect(encrypted).not.toBe(malformed);
+		expect(encrypted.startsWith("enc:v2:")).toBe(true);
+		const decrypted = decryptSecret(encrypted, {
+			primary: "0123456789abcdef0123456789abcdef",
+			previous: null,
+		});
+		expect(decrypted.value).toBe(malformed);
+	});
+
+	it("reads and trims encryption keys from env", () => {
+		const previousPrimary = process.env.CODEX_AUTH_ENCRYPTION_KEY;
+		const previousSecondary = process.env.CODEX_AUTH_PREVIOUS_ENCRYPTION_KEY;
+		try {
+			process.env.CODEX_AUTH_ENCRYPTION_KEY = "  0123456789abcdef0123456789abcdef  ";
+			process.env.CODEX_AUTH_PREVIOUS_ENCRYPTION_KEY = "\tfedcba9876543210fedcba9876543210\n";
+			expect(getSecretEncryptionKeysFromEnv()).toEqual({
+				primary: "0123456789abcdef0123456789abcdef",
+				previous: "fedcba9876543210fedcba9876543210",
+			});
+		} finally {
+			if (previousPrimary === undefined) {
+				delete process.env.CODEX_AUTH_ENCRYPTION_KEY;
+			} else {
+				process.env.CODEX_AUTH_ENCRYPTION_KEY = previousPrimary;
+			}
+			if (previousSecondary === undefined) {
+				delete process.env.CODEX_AUTH_PREVIOUS_ENCRYPTION_KEY;
+			} else {
+				process.env.CODEX_AUTH_PREVIOUS_ENCRYPTION_KEY = previousSecondary;
+			}
+		}
+	});
+
+	it("rejects weak key material from environment", () => {
+		const previousPrimary = process.env.CODEX_AUTH_ENCRYPTION_KEY;
+		const previousSecondary = process.env.CODEX_AUTH_PREVIOUS_ENCRYPTION_KEY;
+		try {
+			process.env.CODEX_AUTH_ENCRYPTION_KEY = "short";
+			delete process.env.CODEX_AUTH_PREVIOUS_ENCRYPTION_KEY;
+			expect(() => getSecretEncryptionKeysFromEnv()).toThrow(
+				"CODEX_AUTH_ENCRYPTION_KEY must contain at least 32 bytes of key material",
+			);
+
+			process.env.CODEX_AUTH_ENCRYPTION_KEY = "0123456789abcdef0123456789abcdef";
+			process.env.CODEX_AUTH_PREVIOUS_ENCRYPTION_KEY = "tiny";
+			expect(() => getSecretEncryptionKeysFromEnv()).toThrow(
+				"CODEX_AUTH_PREVIOUS_ENCRYPTION_KEY must contain at least 32 bytes of key material",
+			);
+		} finally {
+			if (previousPrimary === undefined) {
+				delete process.env.CODEX_AUTH_ENCRYPTION_KEY;
+			} else {
+				process.env.CODEX_AUTH_ENCRYPTION_KEY = previousPrimary;
+			}
+			if (previousSecondary === undefined) {
+				delete process.env.CODEX_AUTH_PREVIOUS_ENCRYPTION_KEY;
+			} else {
+				process.env.CODEX_AUTH_PREVIOUS_ENCRYPTION_KEY = previousSecondary;
+			}
+		}
+	});
+});
diff --git a/test/security/secret-scan-regression.test.ts b/test/security/secret-scan-regression.test.ts
new file mode 100644
index 000000000..2382471fe
--- /dev/null
+++ b/test/security/secret-scan-regression.test.ts
@@ -0,0 +1,94 @@
+import { afterEach, describe, expect, it } from "vitest";
+import { mkdtempSync } from "node:fs";
+import { promises as fs } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import process from "node:process";
+import { removeWithRetry } from "../helpers/remove-with-retry.js";
+
+const secretPattern = /OPENAI_API_KEY=sk-[A-Za-z0-9-]{10,}/;
+const allowlistedFixture = /test[\\/]+security[\\/]+fixtures[\\/]+fixture\.txt$/i;
+
+async function collectSyntheticFindings(root: string): Promise<Array<{ File: string }>> {
+	const findings: Array<{ File: string }> = [];
+	const stack = [root];
+	while (stack.length > 0) {
+		const current = stack.pop();
+		if (!current) continue;
+		const entries = await fs.readdir(current, { withFileTypes: true });
+		for (const entry of entries) {
+			const fullPath = path.join(current, entry.name);
+			if (entry.isDirectory()) {
+				stack.push(fullPath);
+				continue;
+			}
+			if (!entry.isFile()) continue;
+			const rel = path.relative(root, fullPath).replace(/\\/g, "/");
+			const content = await fs.readFile(fullPath, "utf8");
+			if (!secretPattern.test(content)) continue;
+			if (allowlistedFixture.test(rel)) continue;
+			findings.push({ File: rel });
+		}
+	}
+	return findings;
+}
+
+describe("secret scan regression harness", () => {
+	const fixtures: string[] = [];
+
+	afterEach(async () => {
+		while (fixtures.length > 0) {
+			const fixture = fixtures.pop();
+			if (!fixture) continue;
+			await removeWithRetry(fixture);
+		}
+	});
+
+	it("fixture allowlist regex handles windows paths", () => {
+		expect(/^test[\\/]security[\\/]fixtures[\\/]/i.test("test\\security\\fixtures\\fixture.txt")).toBe(
+			true,
+		);
+		expect("test\\security\\fixtures\\fixture.txt".replace(/\\/g, "/")).toBe(
+			"test/security/fixtures/fixture.txt",
+		);
+	});
+
+	it("keeps fixture allowlist behavior and flags only non-allowlisted secrets", async () => {
+		const repoRoot = process.cwd();
+		const gitleaksConfig = await fs.readFile(path.join(repoRoot, ".gitleaks.toml"), "utf8");
+		expect(gitleaksConfig).toContain("^test[\\\\/]security[\\\\/]fixtures[\\\\/]");
+
+		const root = mkdtempSync(path.join(tmpdir(), "secret-scan-regression-"));
+		fixtures.push(root);
+		const failCase = path.join(root, "fail-case");
+		const passCase = path.join(root, "pass-case");
+		await fs.mkdir(path.join(failCase, "src"), { recursive: true });
+		await fs.mkdir(path.join(failCase, "test", "security", "fixtures"), { recursive: true });
+		await fs.mkdir(path.join(passCase, "test", "security", "fixtures"), { recursive: true });
+
+		await fs.writeFile(
+			path.join(failCase, "src", "leak.txt"),
+			"OPENAI_API_KEY=sk-test-placeholder-leak-12345678901234567890\n",
+			"utf8",
+		);
+		await fs.writeFile(
+			path.join(failCase, "test", "security", "fixtures", "fixture.txt"),
+			"OPENAI_API_KEY=sk-test-allowlist-should-exclude-1234567890\n",
+			"utf8",
+		);
+		await fs.writeFile(
+			path.join(failCase, "test", "security", "fixtures", "real-secret.txt"),
+			"OPENAI_API_KEY=sk-test-placeholder-in-fixture-12345678901234567890\n",
+			"utf8",
+		);
+		await fs.writeFile(path.join(passCase, "test", "security", "fixtures", "fixture.txt"), "fake_refresh_token_67890\n", "utf8");
+
+		const failFindings = await collectSyntheticFindings(failCase);
+		expect(failFindings.some((finding) => finding.File.includes("src/leak.txt"))).toBe(true);
+		expect(failFindings.some((finding) => finding.File.includes("test/security/fixtures/real-secret.txt"))).toBe(true);
+		expect(failFindings.some((finding) => finding.File.includes("test/security/fixtures/fixture.txt"))).toBe(false);
+
+		const passFindings = await collectSyntheticFindings(passCase);
+		expect(passFindings).toEqual([]);
+	});
+});
diff --git a/test/server.unit.test.ts b/test/server.unit.test.ts
index 560f0a35e..28aeb89e8 100644
--- a/test/server.unit.test.ts
+++ b/test/server.unit.test.ts
@@ -300,6 +300,31 @@ describe('OAuth Server Unit Tests', () => {
 			expect(code).toEqual({ code: 'the-code' });
 		});
 
+		it('waitForCode returns null when close aborts active poll loop', async () => {
+			vi.useFakeTimers();
+			try {
+				(mockServer.listen as ReturnType<typeof vi.fn>).mockImplementation(
+					(_port: number, _host: string, callback: () => void) => {
+						callback();
+						return mockServer;
+					}
+				);
+				(mockServer.on as ReturnType<typeof vi.fn>).mockReturnValue(mockServer);
+				(mockServer.close as ReturnType<typeof vi.fn>).mockImplementation(() => undefined);
+
+				const result = await startLocalOAuthServer({ state: 'test-state' });
+				const codePromise = result.waitForCode('test-state');
+				result.close();
+
+				await vi.advanceTimersByTimeAsync(200);
+
+				await expect(codePromise).resolves.toBeNull();
+				expect(logWarn).not.toHaveBeenCalledWith('OAuth poll timeout after 5 minutes');
+			} finally {
+				vi.useRealTimers();
+			}
+		});
+
 		it('should return null after 5 minute timeout', async () => {
 			vi.useFakeTimers();
 			
diff --git a/test/settings-hub-utils.test.ts b/test/settings-hub-utils.test.ts
index 24b48fbbb..8e90b2324 100644
--- a/test/settings-hub-utils.test.ts
+++ b/test/settings-hub-utils.test.ts
@@ -7,6 +7,7 @@ import type { PluginConfig } from "../lib/types.js";
 
 type SettingsHubTestApi = {
 	clampBackendNumber: (settingKey: string, value: number) => number;
+	buildBackendSettingsPreview: (config: PluginConfig) => { label: string; hint: string };
 	formatMenuLayoutMode: (mode: "compact-details" | "expanded-rows") => string;
 	cloneDashboardSettings: (settings: DashboardDisplaySettings) => DashboardDisplaySettings;
 	withQueuedRetry: <T>(pathKey: string, task: () => Promise<T>) => Promise<T>;
@@ -64,11 +65,24 @@ describe("settings-hub utility coverage", () => {
 		const api = await loadSettingsHubTestApi();
 		expect(api.clampBackendNumber("fetchTimeoutMs", 250)).toBe(1_000);
 		expect(api.clampBackendNumber("fetchTimeoutMs", 999_999)).toBe(600_000);
+		expect(api.clampBackendNumber("retryAllAccountsAbsoluteCeilingMs", -1)).toBe(0);
+		expect(api.clampBackendNumber("retryAllAccountsAbsoluteCeilingMs", 999_999_999)).toBe(
+			24 * 60 * 60_000,
+		);
 		expect(() => api.clampBackendNumber("unknown-setting", 5)).toThrow(
 			"Unknown backend numeric setting key",
 		);
 	});
 
+	it("renders retry-all absolute ceiling 0 as unlimited in preview", async () => {
+		const api = await loadSettingsHubTestApi();
+		const preview = api.buildBackendSettingsPreview({
+			retryAllAccountsAbsoluteCeilingMs: 0,
+		});
+		expect(preview.hint).toContain("retry ceiling unlimited");
+		expect(preview.hint).not.toContain("retry ceiling 0ms");
+	});
+
 	it("formats layout mode labels", async () => {
 		const api = await loadSettingsHubTestApi();
 		expect(api.formatMenuLayoutMode("expanded-rows")).toBe("Expanded Rows");
diff --git a/test/shutdown.test.ts b/test/shutdown.test.ts
index c64ecf413..36ac2f319 100644
--- a/test/shutdown.test.ts
+++ b/test/shutdown.test.ts
@@ -47,6 +47,15 @@ describe("Graceful shutdown", () => {
 		expect(fn).toHaveBeenCalledTimes(1);
 	});
 
+	it("deduplicates concurrent cleanup execution", async () => {
+		const fn = vi.fn(async () => {
+			await new Promise((resolve) => setTimeout(resolve, 10));
+		});
+		registerCleanup(fn);
+		await Promise.all([runCleanup(), runCleanup()]);
+		expect(fn).toHaveBeenCalledTimes(1);
+	});
+
 	it("continues cleanup even if one function throws", async () => {
 		const fn1 = vi.fn(() => { throw new Error("fail"); });
 		const fn2 = vi.fn();
@@ -71,6 +80,50 @@ describe("Graceful shutdown", () => {
 		expect(getCleanupCount()).toBe(0);
 	});
 
+	it("returns after configured shutdown timeout when cleanup hangs", async () => {
+		const originalTimeout = process.env.CODEX_AUTH_SHUTDOWN_TIMEOUT_MS;
+		process.env.CODEX_AUTH_SHUTDOWN_TIMEOUT_MS = "1000";
+		vi.useFakeTimers();
+		try {
+			const hangingFn = vi.fn(
+				() =>
+					new Promise<void>(() => {
+						// Intentionally unresolved.
+					}),
+			);
+			registerCleanup(hangingFn);
+			const cleanupPromise = runCleanup();
+			await vi.advanceTimersByTimeAsync(1000);
+			await cleanupPromise;
+			expect(hangingFn).toHaveBeenCalledTimes(1);
+		} finally {
+			if (originalTimeout === undefined) {
+				delete process.env.CODEX_AUTH_SHUTDOWN_TIMEOUT_MS;
+			} else {
+				process.env.CODEX_AUTH_SHUTDOWN_TIMEOUT_MS = originalTimeout;
+			}
+			vi.useRealTimers();
+		}
+	});
+
+	it("does not leave a pending shutdown timer after fast cleanup", async () => {
+		const originalTimeout = process.env.CODEX_AUTH_SHUTDOWN_TIMEOUT_MS;
+		process.env.CODEX_AUTH_SHUTDOWN_TIMEOUT_MS = "5000";
+		vi.useFakeTimers();
+		try {
+			registerCleanup(() => {});
+			await runCleanup();
+			expect(vi.getTimerCount()).toBe(0);
+		} finally {
+			if (originalTimeout === undefined) {
+				delete process.env.CODEX_AUTH_SHUTDOWN_TIMEOUT_MS;
+			} else {
+				process.env.CODEX_AUTH_SHUTDOWN_TIMEOUT_MS = originalTimeout;
+			}
+			vi.useRealTimers();
+		}
+	});
+
 	describe("process signal integration", () => {
 		it("SIGINT handler runs cleanup and exits with code 0", async () => {
 			const capturedHandlers = new Map<string, (...args: unknown[]) => void>();
diff --git a/test/slo-budget-report.test.ts b/test/slo-budget-report.test.ts
new file mode 100644
index 000000000..2250d53e7
--- /dev/null
+++ b/test/slo-budget-report.test.ts
@@ -0,0 +1,161 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { mkdtempSync, utimesSync } from "node:fs";
+import { promises as fs } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import process from "node:process";
+import { spawnSync } from "node:child_process";
+import { removeWithRetry } from "./helpers/remove-with-retry.js";
+
+const scriptPath = path.resolve(process.cwd(), "scripts", "slo-budget-report.js");
+
+describe("slo-budget-report script", () => {
+	const fixtures: string[] = [];
+
+	afterEach(async () => {
+		while (fixtures.length > 0) {
+			const fixture = fixtures.pop();
+			if (!fixture) continue;
+			await removeWithRetry(fixture);
+		}
+		vi.doUnmock("node:child_process");
+		vi.restoreAllMocks();
+		vi.resetModules();
+		delete process.env.CODEX_HEALTH_CHECK_TIMEOUT_MS;
+		delete process.env.CODEX_SLO_HEALTH_CHECK_SCRIPT;
+	});
+
+	it("counts stale-audit-log findings in staleWalFindings evaluation", async () => {
+		const root = mkdtempSync(path.join(tmpdir(), "slo-budget-"));
+		fixtures.push(root);
+		const logDir = path.join(root, "logs");
+		const policyPath = path.join(root, "policy.json");
+		await fs.mkdir(logDir, { recursive: true });
+		const staleAuditPath = path.join(logDir, "audit.log");
+		await fs.writeFile(staleAuditPath, '{"timestamp":"2025-01-01T00:00:00Z","action":"request.start"}\n', "utf8");
+		const staleDate = new Date(Date.now() - 10 * 24 * 60 * 60 * 1000);
+		utimesSync(staleAuditPath, staleDate, staleDate);
+		await fs.writeFile(
+			policyPath,
+			JSON.stringify({
+				windowDays: 30,
+				objectives: {
+					staleWalFindingsMax: 0,
+				},
+			}),
+			"utf8",
+		);
+
+		const result = spawnSync(process.execPath, [scriptPath, `--policy=${policyPath}`], {
+			encoding: "utf8",
+			env: {
+				...process.env,
+				CODEX_MULTI_AUTH_DIR: root,
+			},
+		});
+
+		expect(result.status).toBe(0);
+		const payload = JSON.parse(result.stdout) as {
+			health?: { staleWalFindings?: number };
+			evaluations?: Array<{ id?: string; status?: string }>;
+		};
+		expect(payload.health?.staleWalFindings).toBe(1);
+		const staleEval = payload.evaluations?.find((entry) => entry.id === "stale-wal-findings");
+		expect(staleEval?.status).toBe("fail");
+	});
+
+	it("runHealthCheck surfaces timeout failures and applies timeout/kill options", async () => {
+		const execError = new Error("spawn ETIMEDOUT: health check timed out");
+		Object.assign(execError, { stdout: "", stderr: "" });
+		const execFileSync = vi.fn(() => {
+			throw execError;
+		});
+		vi.doMock("node:child_process", () => ({ execFileSync }));
+		process.env.CODEX_HEALTH_CHECK_TIMEOUT_MS = "4321";
+
+		const module = await import("../scripts/slo-budget-report.js");
+		const payload = module.runHealthCheck() as {
+			status?: string;
+			findings?: Array<{ code?: string; message?: string }>;
+		};
+
+		expect(execFileSync).toHaveBeenCalledTimes(1);
+		const call = execFileSync.mock.calls[0];
+		expect(call[0]).toBe(process.execPath);
+		expect(call[1]).toEqual(["scripts/enterprise-health-check.js"]);
+		expect(call[2]).toMatchObject({
+			timeout: 4321,
+			killSignal: "SIGTERM",
+		});
+		expect(payload.status).toBe("fail");
+		expect(payload.findings?.[0]?.code).toBe("health-check-exec-failed");
+		expect(payload.findings?.[0]?.message).toContain("ETIMEDOUT");
+	});
+
+	it("runHealthCheck falls back to spawn error text when stdout/stderr are empty", async () => {
+		const execError = new Error("spawn ENOENT: missing health check script");
+		Object.assign(execError, { stdout: "", stderr: "" });
+		const execFileSync = vi.fn(() => {
+			throw execError;
+		});
+		vi.doMock("node:child_process", () => ({ execFileSync }));
+
+		const module = await import("../scripts/slo-budget-report.js");
+		const payload = module.runHealthCheck() as {
+			status?: string;
+			findings?: Array<{ message?: string }>;
+		};
+
+		expect(payload.status).toBe("fail");
+		expect(payload.findings?.[0]?.message).toContain("ENOENT");
+	});
+
+	it("runHealthCheck honors health script overrides (Windows-compatible path)", async () => {
+		const execFileSync = vi.fn(() => JSON.stringify({ status: "pass", checks: [], findings: [] }));
+		vi.doMock("node:child_process", () => ({ execFileSync }));
+		process.env.CODEX_SLO_HEALTH_CHECK_SCRIPT = "scripts\\enterprise-health-check.js";
+
+		const module = await import("../scripts/slo-budget-report.js");
+		const payload = module.runHealthCheck() as { status?: string };
+
+		expect(execFileSync).toHaveBeenCalledTimes(1);
+		expect(execFileSync.mock.calls[0][1]).toEqual(["scripts\\enterprise-health-check.js"]);
+		expect(payload.status).toBe("pass");
+	});
+
+	it("treats ENOTDIR log path churn as no audit entries instead of crashing", async () => {
+		const root = mkdtempSync(path.join(tmpdir(), "slo-budget-enotdir-"));
+		fixtures.push(root);
+		const logDirFile = path.join(root, "logs");
+		const policyPath = path.join(root, "policy.json");
+		await fs.writeFile(logDirFile, "not-a-directory\n", "utf8");
+		await fs.writeFile(
+			policyPath,
+			JSON.stringify({
+				windowDays: 7,
+				objectives: {
+					requestSuccessRatePercent: 99.9,
+				},
+			}),
+			"utf8",
+		);
+
+		const result = spawnSync(process.execPath, [scriptPath, `--policy=${policyPath}`], {
+			encoding: "utf8",
+			env: {
+				...process.env,
+				CODEX_MULTI_AUTH_DIR: root,
+			},
+		});
+
+		expect(result.status).toBe(0);
+		const payload = JSON.parse(result.stdout) as {
+			command?: string;
+			entriesConsidered?: number;
+			status?: string;
+		};
+		expect(payload.command).toBe("slo-budget-report");
+		expect(payload.entriesConsidered).toBe(0);
+		expect(payload.status).toBe("pass");
+	});
+});
diff --git a/test/storage-flagged.test.ts b/test/storage-flagged.test.ts
index 7fce9e18a..8b7fce9ae 100644
--- a/test/storage-flagged.test.ts
+++ b/test/storage-flagged.test.ts
@@ -148,6 +148,42 @@ describe("flagged account storage", () => {
     expect(existsSync(legacyPath)).toBe(true);
   });
 
+  it("fails fast when flagged refresh token cannot be decrypted", async () => {
+    const previousEncryptionKey = process.env.CODEX_AUTH_ENCRYPTION_KEY;
+    const previousPreviousKey = process.env.CODEX_AUTH_PREVIOUS_ENCRYPTION_KEY;
+    try {
+      process.env.CODEX_AUTH_ENCRYPTION_KEY = "0123456789abcdef0123456789abcdef";
+      delete process.env.CODEX_AUTH_PREVIOUS_ENCRYPTION_KEY;
+      await saveFlaggedAccounts({
+        version: 1,
+        accounts: [
+          {
+            refreshToken: "encrypted-token-value",
+            flaggedAt: 1,
+            addedAt: 1,
+            lastUsed: 1,
+          },
+        ],
+      });
+
+      process.env.CODEX_AUTH_ENCRYPTION_KEY = "fedcba9876543210fedcba9876543210";
+      await expect(loadFlaggedAccounts()).rejects.toThrow(
+        "Failed to decrypt flagged refresh token",
+      );
+    } finally {
+      if (previousEncryptionKey === undefined) {
+        delete process.env.CODEX_AUTH_ENCRYPTION_KEY;
+      } else {
+        process.env.CODEX_AUTH_ENCRYPTION_KEY = previousEncryptionKey;
+      }
+      if (previousPreviousKey === undefined) {
+        delete process.env.CODEX_AUTH_PREVIOUS_ENCRYPTION_KEY;
+      } else {
+        process.env.CODEX_AUTH_PREVIOUS_ENCRYPTION_KEY = previousPreviousKey;
+      }
+    }
+  });
+
   it("clears flagged storage and tolerates missing files", async () => {
     await saveFlaggedAccounts({
       version: 1,
diff --git a/test/storage-recovery-paths.test.ts b/test/storage-recovery-paths.test.ts
index 7e2a3f3a9..fc3d4abc7 100644
--- a/test/storage-recovery-paths.test.ts
+++ b/test/storage-recovery-paths.test.ts
@@ -1,4 +1,4 @@
-import { describe, expect, it, beforeEach, afterEach } from "vitest";
+import { describe, expect, it, beforeEach, afterEach, vi } from "vitest";
 import { promises as fs, existsSync } from "node:fs";
 import { createHash } from "node:crypto";
 import { join } from "node:path";
@@ -94,6 +94,63 @@ describe("storage recovery paths", () => {
 		expect(persisted.accounts?.[0]?.accountId).toBe("from-backup");
 	});
 
+	it("allows immediate save after backup recovery when persist write fails and primary file stays absent", async () => {
+		const backupPayload = {
+			version: 3,
+			activeIndex: 0,
+			accounts: [
+				{
+					refreshToken: "backup-refresh",
+					accountId: "from-backup",
+					addedAt: 2,
+					lastUsed: 2,
+				},
+			],
+		};
+		await fs.writeFile(`${storagePath}.bak`, JSON.stringify(backupPayload), "utf-8");
+
+		const originalRename = fs.rename.bind(fs);
+		let injectedFailure = false;
+		const renameSpy = vi.spyOn(fs, "rename").mockImplementation(async (...args) => {
+			const target = args[1];
+			const destination =
+				typeof target === "string" ? target : target instanceof URL ? target.pathname : String(target);
+			if (!injectedFailure && destination === storagePath) {
+				injectedFailure = true;
+				const error = new Error("persist denied") as NodeJS.ErrnoException;
+				error.code = "EACCES";
+				throw error;
+			}
+			return originalRename(...(args as Parameters<typeof fs.rename>));
+		});
+
+		try {
+			const recovered = await loadAccounts();
+			expect(recovered?.accounts[0]?.accountId).toBe("from-backup");
+			expect(injectedFailure).toBe(true);
+			expect(existsSync(storagePath)).toBe(false);
+		} finally {
+			renameSpy.mockRestore();
+		}
+
+		await expect(
+			saveAccounts({
+				version: 3,
+				activeIndex: 0,
+				activeIndexByFamily: {},
+				accounts: [
+					{
+						refreshToken: "backup-refresh",
+						accountId: "from-backup",
+						addedAt: 2,
+						lastUsed: 2,
+					},
+				],
+			}),
+		).resolves.toBeUndefined();
+		expect(existsSync(storagePath)).toBe(true);
+	});
+
 	it("falls back to historical backup snapshots when the latest backup is unreadable", async () => {
 		await fs.writeFile(storagePath, "{broken-primary", "utf-8");
 		await fs.writeFile(`${storagePath}.bak`, "{broken-latest-backup", "utf-8");
diff --git a/test/storage-v4-keychain.test.ts b/test/storage-v4-keychain.test.ts
new file mode 100644
index 000000000..df89dbc86
--- /dev/null
+++ b/test/storage-v4-keychain.test.ts
@@ -0,0 +1,327 @@
+import { promises as fs } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+const RETRYABLE_REMOVE_CODES = new Set(["EBUSY", "EPERM", "ENOTEMPTY"]);
+
+async function removeWithRetry(
+	targetPath: string,
+	options: { recursive?: boolean; force?: boolean },
+): Promise<void> {
+	for (let attempt = 0; attempt < 6; attempt += 1) {
+		try {
+			await fs.rm(targetPath, options);
+			return;
+		} catch (error) {
+			const code = (error as NodeJS.ErrnoException).code;
+			if (code === "ENOENT") return;
+			if (!code || !RETRYABLE_REMOVE_CODES.has(code) || attempt === 5) {
+				throw error;
+			}
+			await new Promise((resolve) => setTimeout(resolve, 25 * 2 ** attempt));
+		}
+	}
+}
+
+type KeytarMockState = {
+	secrets: Map<string, string>;
+};
+
+function installKeytarMock(): KeytarMockState {
+	const secrets = new Map<string, string>();
+	const keytarModule = {
+		setPassword: async (_service: string, account: string, password: string) => {
+			secrets.set(account, password);
+		},
+		getPassword: async (_service: string, account: string) => secrets.get(account) ?? null,
+		deletePassword: async (_service: string, account: string) => secrets.delete(account),
+	};
+	vi.doMock("keytar", () => ({
+		...keytarModule,
+		default: keytarModule,
+	}));
+	return { secrets };
+}
+
+describe("storage v4 keychain persistence", () => {
+	let tempDir = "";
+	const originalDir = process.env.CODEX_MULTI_AUTH_DIR;
+	const originalMode = process.env.CODEX_SECRET_STORAGE_MODE;
+
+	beforeEach(async () => {
+		tempDir = await fs.mkdtemp(join(tmpdir(), "codex-storage-v4-"));
+		process.env.CODEX_MULTI_AUTH_DIR = tempDir;
+		process.env.CODEX_SECRET_STORAGE_MODE = "keychain";
+		vi.resetModules();
+	});
+
+	afterEach(async () => {
+		vi.doUnmock("keytar");
+		vi.restoreAllMocks();
+		if (originalDir === undefined) {
+			delete process.env.CODEX_MULTI_AUTH_DIR;
+		} else {
+			process.env.CODEX_MULTI_AUTH_DIR = originalDir;
+		}
+		if (originalMode === undefined) {
+			delete process.env.CODEX_SECRET_STORAGE_MODE;
+		} else {
+			process.env.CODEX_SECRET_STORAGE_MODE = originalMode;
+		}
+		if (tempDir) {
+			await removeWithRetry(tempDir, { recursive: true, force: true });
+		}
+	});
+
+	it("writes refs to disk and resolves tokens from keychain", async () => {
+		installKeytarMock();
+		const { saveAccounts, loadAccounts, getStoragePath } = await import("../lib/storage.js");
+
+		await saveAccounts({
+			version: 3,
+			accounts: [
+				{
+					accountId: "acct_1",
+					email: "user@example.com",
+					refreshToken: "refresh-token-1",
+					accessToken: "access-token-1",
+					addedAt: 1,
+					lastUsed: 2,
+					enabled: true,
+				},
+			],
+			activeIndex: 0,
+		});
+
+		const filePath = getStoragePath();
+		const raw = await fs.readFile(filePath, "utf8");
+		const parsed = JSON.parse(raw) as {
+			version: number;
+			accounts: Array<Record<string, unknown>>;
+		};
+		expect(parsed.version).toBe(4);
+		expect(parsed.accounts[0]?.refreshToken).toBeUndefined();
+		expect(parsed.accounts[0]?.refreshTokenRef).toBeTypeOf("string");
+
+		const loaded = await loadAccounts();
+		expect(loaded?.accounts[0]?.refreshToken).toBe("refresh-token-1");
+		expect(loaded?.accounts[0]?.accessToken).toBe("access-token-1");
+	});
+
+	it("serializes concurrent saveAccounts calls without torn storage JSON", async () => {
+		installKeytarMock();
+		const { saveAccounts, loadAccounts, getStoragePath } = await import("../lib/storage.js");
+
+		await Promise.all([
+			saveAccounts({
+				version: 3,
+				accounts: [
+					{
+						accountId: "acct_a",
+						email: "a@example.com",
+						refreshToken: "refresh-token-a",
+						accessToken: "access-token-a",
+						addedAt: 11,
+						lastUsed: 12,
+						enabled: true,
+					},
+				],
+				activeIndex: 0,
+			}),
+			saveAccounts({
+				version: 3,
+				accounts: [
+					{
+						accountId: "acct_b",
+						email: "b@example.com",
+						refreshToken: "refresh-token-b",
+						accessToken: "access-token-b",
+						addedAt: 21,
+						lastUsed: 22,
+						enabled: true,
+					},
+				],
+				activeIndex: 0,
+			}),
+		]);
+
+		const filePath = getStoragePath();
+		const persistedRaw = await fs.readFile(filePath, "utf8");
+		const persisted = JSON.parse(persistedRaw) as {
+			version: number;
+			accounts: Array<Record<string, unknown>>;
+		};
+		expect(persisted.version).toBe(4);
+		expect(Array.isArray(persisted.accounts)).toBe(true);
+		expect(persisted.accounts[0]?.refreshToken).toBeUndefined();
+		expect(typeof persisted.accounts[0]?.refreshTokenRef).toBe("string");
+
+		const loaded = await loadAccounts();
+		const loadedTokenPair = `${loaded?.accounts[0]?.refreshToken}|${loaded?.accounts[0]?.accessToken}`;
+		expect(
+			new Set(["refresh-token-a|access-token-a", "refresh-token-b|access-token-b"]).has(loadedTokenPair),
+		).toBe(true);
+	});
+
+	it("retries save rename on windows-style EPERM and persists successfully", async () => {
+		installKeytarMock();
+		const { saveAccounts, loadAccounts } = await import("../lib/storage.js");
+		const originalRename = fs.rename.bind(fs);
+		const renameSpy = vi.spyOn(fs, "rename");
+		renameSpy.mockImplementationOnce(async () => {
+			const error = new Error("locked") as NodeJS.ErrnoException;
+			error.code = "EPERM";
+			throw error;
+		});
+		renameSpy.mockImplementation(originalRename);
+		let renameCallCount = 0;
+
+		try {
+			await saveAccounts({
+				version: 3,
+				accounts: [
+					{
+						accountId: "acct_retry",
+						email: "retry@example.com",
+						refreshToken: "refresh-token-retry",
+						accessToken: "access-token-retry",
+						addedAt: 30,
+						lastUsed: 31,
+						enabled: true,
+					},
+				],
+				activeIndex: 0,
+			});
+		} finally {
+			renameCallCount = renameSpy.mock.calls.length;
+			renameSpy.mockRestore();
+		}
+
+		expect(renameCallCount).toBeGreaterThanOrEqual(2);
+		const loaded = await loadAccounts();
+		expect(loaded?.accounts[0]?.refreshToken).toBe("refresh-token-retry");
+	});
+
+	it("rolls back keychain refs when save fails after refs are written", async () => {
+		const { secrets } = installKeytarMock();
+		const { saveAccounts } = await import("../lib/storage.js");
+		const renameSpy = vi.spyOn(fs, "rename");
+		renameSpy.mockImplementation(async () => {
+			const error = new Error("rename denied") as NodeJS.ErrnoException;
+			error.code = "EACCES";
+			throw error;
+		});
+
+		try {
+			await expect(
+				saveAccounts({
+					version: 3,
+					accounts: [
+						{
+							accountId: "acct_fail",
+							email: "fail@example.com",
+							refreshToken: "refresh-token-fail",
+							accessToken: "access-token-fail",
+							addedAt: 40,
+							lastUsed: 41,
+							enabled: true,
+						},
+					],
+					activeIndex: 0,
+				}),
+			).rejects.toThrow();
+		} finally {
+			renameSpy.mockRestore();
+		}
+
+		expect([...secrets.keys()]).toEqual([]);
+	});
+
+	it("adjusts activeIndex when v4 hydration skips accounts with missing keychain secrets", async () => {
+		const { secrets } = installKeytarMock();
+		const { getStoragePath, loadAccounts } = await import("../lib/storage.js");
+		const storagePath = getStoragePath();
+		secrets.set("acct-2:refresh", "refresh-token-2");
+		secrets.set("acct-2:access", "access-token-2");
+		await fs.writeFile(
+			storagePath,
+			JSON.stringify(
+				{
+					version: 4,
+					accounts: [
+						{
+							accountId: "acct_1",
+							email: "first@example.com",
+							refreshTokenRef: "acct-1:refresh",
+							accessTokenRef: "acct-1:access",
+							addedAt: 1,
+							lastUsed: 1,
+							enabled: true,
+						},
+						{
+							accountId: "acct_2",
+							email: "second@example.com",
+							refreshTokenRef: "acct-2:refresh",
+							accessTokenRef: "acct-2:access",
+							addedAt: 2,
+							lastUsed: 2,
+							enabled: true,
+						},
+					],
+					activeIndex: 1,
+					activeIndexByFamily: {
+						codex: 1,
+					},
+				},
+				null,
+				2,
+			),
+			"utf8",
+		);
+
+		const loaded = await loadAccounts();
+		expect(loaded?.accounts).toHaveLength(1);
+		expect(loaded?.accounts[0]?.accountId).toBe("acct_2");
+		expect(loaded?.activeIndex).toBe(0);
+		expect(loaded?.activeIndexByFamily?.codex).toBe(0);
+	});
+
+	it("clears keychain refs from WAL payload even when runtime mode flips to plaintext", async () => {
+		const { secrets } = installKeytarMock();
+		const { clearAccounts, getStoragePath } = await import("../lib/storage.js");
+		const storagePath = getStoragePath();
+		const walPath = `${storagePath}.wal`;
+		secrets.set("acct-wal:refresh", "refresh-token-wal");
+		secrets.set("acct-wal:access", "access-token-wal");
+		await fs.mkdir(tempDir, { recursive: true });
+		await fs.writeFile(
+			walPath,
+			JSON.stringify({
+				version: 1,
+				createdAt: Date.now(),
+				path: storagePath,
+				checksum: "checksum",
+				content: JSON.stringify({
+					version: 4,
+					accounts: [
+						{
+							refreshTokenRef: "acct-wal:refresh",
+							accessTokenRef: "acct-wal:access",
+							addedAt: 1,
+							lastUsed: 1,
+						},
+					],
+					activeIndex: 0,
+				}),
+			}),
+			"utf8",
+		);
+
+		process.env.CODEX_SECRET_STORAGE_MODE = "plaintext";
+		await clearAccounts();
+		expect(secrets.has("acct-wal:refresh")).toBe(false);
+		expect(secrets.has("acct-wal:access")).toBe(false);
+		await expect(fs.stat(walPath)).rejects.toThrow();
+	});
+});
diff --git a/test/storage.test.ts b/test/storage.test.ts
index 3c3157e8b..e8030bf47 100644
--- a/test/storage.test.ts
+++ b/test/storage.test.ts
@@ -2,6 +2,7 @@ import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
 import { promises as fs, existsSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { tmpdir } from "node:os";
+import * as fileLock from "../lib/file-lock.js";
 import { getConfigDir, getProjectStorageKey } from "../lib/storage/paths.js";
 import { 
   deduplicateAccounts,
@@ -18,6 +19,7 @@ import {
   exportAccounts,
   importAccounts,
   withAccountStorageTransaction,
+  type AccountStorageV3,
 } from "../lib/storage.js";
 
 // Mocking the behavior we're about to implement for TDD
@@ -676,6 +678,70 @@ describe("storage", () => {
       expect(saved.version).toBe(3);
     });
 
+    it("fails fast when encrypted account storage cannot be decrypted", async () => {
+      const previousPrimary = process.env.CODEX_AUTH_ENCRYPTION_KEY;
+      const previousSecondary = process.env.CODEX_AUTH_PREVIOUS_ENCRYPTION_KEY;
+      try {
+        process.env.CODEX_AUTH_ENCRYPTION_KEY = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";
+        delete process.env.CODEX_AUTH_PREVIOUS_ENCRYPTION_KEY;
+        await saveAccounts({
+          version: 3,
+          activeIndex: 0,
+          activeIndexByFamily: {},
+          accounts: [
+            {
+              refreshToken: "refresh-token-sensitive",
+              accountId: "encrypted-account",
+              addedAt: Date.now(),
+              lastUsed: Date.now(),
+            },
+          ],
+        });
+
+        process.env.CODEX_AUTH_ENCRYPTION_KEY = "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb";
+        await expect(loadAccounts()).rejects.toThrow("Failed to decrypt account storage");
+      } finally {
+        if (previousPrimary === undefined) {
+          delete process.env.CODEX_AUTH_ENCRYPTION_KEY;
+        } else {
+          process.env.CODEX_AUTH_ENCRYPTION_KEY = previousPrimary;
+        }
+        if (previousSecondary === undefined) {
+          delete process.env.CODEX_AUTH_PREVIOUS_ENCRYPTION_KEY;
+        } else {
+          process.env.CODEX_AUTH_PREVIOUS_ENCRYPTION_KEY = previousSecondary;
+        }
+      }
+    });
+
+    it("allows follow-up save after v1 migration without conflict", async () => {
+      const v1Storage = {
+        version: 1,
+        activeIndex: 0,
+        accounts: [{ refreshToken: "t1", accountId: "A", accessToken: "acc", expiresAt: Date.now() + 3600000 }],
+      };
+      await fs.writeFile(testStoragePath, JSON.stringify(v1Storage), "utf-8");
+
+      const migrated = await loadAccounts();
+      expect(migrated?.version).toBe(3);
+
+      const nextStorage: AccountStorageV3 = {
+        version: 3,
+        activeIndex: 0,
+        accounts: [
+          ...(migrated?.accounts ?? []),
+          { refreshToken: "t2", accountId: "B", addedAt: 2, lastUsed: 2 },
+        ],
+      };
+      await expect(saveAccounts(nextStorage)).resolves.toBeUndefined();
+
+      const persisted = JSON.parse(await fs.readFile(testStoragePath, "utf-8")) as AccountStorageV3;
+      expect(persisted.version).toBe(3);
+      const accountIds = new Set(persisted.accounts.map((account) => account.accountId));
+      expect(accountIds.has("A")).toBe(true);
+      expect(accountIds.has("B")).toBe(true);
+    });
+
     it("returns migrated data even when save fails (line 422-423 coverage)", async () => {
       const v1Storage = { 
         version: 1, 
@@ -726,6 +792,276 @@ describe("storage", () => {
       const parsed = JSON.parse(content);
       expect(parsed.version).toBe(3);
     });
+
+    it("keeps successful saves when lock release fails after write", async () => {
+      const storage = {
+        version: 3 as const,
+        activeIndex: 0,
+        accounts: [{ refreshToken: "t1", accountId: "A", addedAt: 1, lastUsed: 2 }],
+      };
+      const lockPath = `${testStoragePath}.lock`;
+      const originalUnlink = fs.unlink.bind(fs);
+      let releaseFailureInjected = false;
+      const unlinkSpy = vi.spyOn(fs, "unlink").mockImplementation(async (...args) => {
+        const target = args[0];
+        const path =
+          typeof target === "string" ? target : target instanceof URL ? target.pathname : String(target);
+        if (!releaseFailureInjected && path === lockPath) {
+          releaseFailureInjected = true;
+          throw Object.assign(new Error("lock release failed"), { code: "EACCES" });
+        }
+        return originalUnlink(...(args as Parameters<typeof fs.unlink>));
+      });
+
+      try {
+        await expect(saveAccounts(storage)).resolves.toBeUndefined();
+      } finally {
+        unlinkSpy.mockRestore();
+      }
+
+      expect(releaseFailureInjected).toBe(true);
+      const persisted = JSON.parse(await fs.readFile(testStoragePath, "utf-8")) as AccountStorageV3;
+      expect(persisted.accounts[0]?.accountId).toBe("A");
+    });
+
+    it("continues waiting when lock observation reads hit transient errors", async () => {
+      const storage: AccountStorageV3 = {
+        version: 3,
+        activeIndex: 0,
+        accounts: [{ refreshToken: "t-read-retry", accountId: "read-retry", addedAt: 1, lastUsed: 1 }],
+      };
+      const lockPath = `${testStoragePath}.lock`;
+      await fs.mkdir(dirname(testStoragePath), { recursive: true });
+      await fs.writeFile(
+        lockPath,
+        `${JSON.stringify({ pid: process.pid, token: "other-owner", acquiredAt: Date.now() })}\n`,
+        "utf-8",
+      );
+      let lockPresent = true;
+      let releaseLock: (() => void) | undefined;
+      const releaseGate = new Promise<void>((resolve) => {
+        releaseLock = resolve;
+      });
+      const unlockPromise = (async () => {
+        await releaseGate;
+        lockPresent = false;
+        await fs.unlink(lockPath);
+      })();
+
+      const originalReadFile = fs.readFile.bind(fs);
+      let transientReadFailures = 0;
+      const readSpy = vi.spyOn(fs, "readFile").mockImplementation(async (...args) => {
+        const target = args[0];
+        const path = typeof target === "string" ? target : String(target);
+        if (path === lockPath && lockPresent) {
+          transientReadFailures += 1;
+          if (transientReadFailures === 2) {
+            releaseLock?.();
+          }
+          throw Object.assign(new Error("retry"), { code: "EAGAIN" });
+        }
+        return originalReadFile(...(args as Parameters<typeof fs.readFile>));
+      });
+
+      try {
+        await expect(saveAccounts(storage)).resolves.toBeUndefined();
+      } finally {
+        readSpy.mockRestore();
+        releaseLock?.();
+        await unlockPromise;
+      }
+
+      expect(transientReadFailures).toBeGreaterThan(0);
+      const persisted = JSON.parse(await fs.readFile(testStoragePath, "utf-8")) as AccountStorageV3;
+      expect(persisted.accounts[0]?.accountId).toBe("read-retry");
+    });
+
+    it("retries stale lock eviction when transient unlink contention occurs", async () => {
+      const storage: AccountStorageV3 = {
+        version: 3,
+        activeIndex: 0,
+        accounts: [{ refreshToken: "t-unlink-retry", accountId: "unlink-retry", addedAt: 1, lastUsed: 1 }],
+      };
+      const lockPath = `${testStoragePath}.lock`;
+      await fs.mkdir(dirname(testStoragePath), { recursive: true });
+      await fs.writeFile(
+        lockPath,
+        `${JSON.stringify({
+          pid: process.pid,
+          token: "stale-owner",
+          acquiredAt: Date.now() - 240_000,
+        })}\n`,
+        "utf-8",
+      );
+      const staleTimestamp = new Date(Date.now() - 240_000);
+      await fs.utimes(lockPath, staleTimestamp, staleTimestamp);
+
+      const originalUnlink = fs.unlink.bind(fs);
+      let lockUnlinkAttempts = 0;
+      const unlinkSpy = vi.spyOn(fs, "unlink").mockImplementation(async (...args) => {
+        const target = args[0];
+        const path =
+          typeof target === "string" ? target : target instanceof URL ? target.pathname : String(target);
+        if (path === lockPath) {
+          lockUnlinkAttempts += 1;
+          if (lockUnlinkAttempts === 1) {
+            throw Object.assign(new Error("busy"), { code: "EBUSY" });
+          }
+        }
+        return originalUnlink(...(args as Parameters<typeof fs.unlink>));
+      });
+
+      try {
+        await expect(saveAccounts(storage)).resolves.toBeUndefined();
+      } finally {
+        unlinkSpy.mockRestore();
+      }
+
+      expect(lockUnlinkAttempts).toBeGreaterThanOrEqual(2);
+      const persisted = JSON.parse(await fs.readFile(testStoragePath, "utf-8")) as AccountStorageV3;
+      expect(persisted.accounts[0]?.accountId).toBe("unlink-retry");
+    });
+
+    it("evicts stale malformed lock files using file mtime fallback", async () => {
+      const storage: AccountStorageV3 = {
+        version: 3,
+        activeIndex: 0,
+        accounts: [{ refreshToken: "t-malformed-stale", accountId: "malformed-stale", addedAt: 1, lastUsed: 1 }],
+      };
+      const lockPath = `${testStoragePath}.lock`;
+      await fs.mkdir(dirname(testStoragePath), { recursive: true });
+      await fs.writeFile(lockPath, "", "utf-8");
+      const staleTimestamp = new Date(Date.now() - 240_000);
+      await fs.utimes(lockPath, staleTimestamp, staleTimestamp);
+
+      await expect(saveAccounts(storage)).resolves.toBeUndefined();
+
+      expect(existsSync(lockPath)).toBe(false);
+      const persisted = JSON.parse(await fs.readFile(testStoragePath, "utf-8")) as AccountStorageV3;
+      expect(persisted.accounts[0]?.accountId).toBe("malformed-stale");
+    });
+
+    it("retries transient lock release contention and eventually removes lock", async () => {
+      const storage: AccountStorageV3 = {
+        version: 3,
+        activeIndex: 0,
+        accounts: [{ refreshToken: "t-release-retry", accountId: "release-retry", addedAt: 1, lastUsed: 1 }],
+      };
+      const lockPath = `${testStoragePath}.lock`;
+      const originalUnlink = fs.unlink.bind(fs);
+      let lockUnlinkAttempts = 0;
+      const unlinkSpy = vi.spyOn(fs, "unlink").mockImplementation(async (...args) => {
+        const target = args[0];
+        const path =
+          typeof target === "string" ? target : target instanceof URL ? target.pathname : String(target);
+        if (path === lockPath) {
+          lockUnlinkAttempts += 1;
+          if (lockUnlinkAttempts < 3) {
+            throw Object.assign(new Error("busy"), { code: "EBUSY" });
+          }
+        }
+        return originalUnlink(...(args as Parameters<typeof fs.unlink>));
+      });
+
+      try {
+        await expect(saveAccounts(storage)).resolves.toBeUndefined();
+      } finally {
+        unlinkSpy.mockRestore();
+      }
+
+      expect(lockUnlinkAttempts).toBeGreaterThanOrEqual(3);
+      expect(existsSync(lockPath)).toBe(false);
+      const persisted = JSON.parse(await fs.readFile(testStoragePath, "utf-8")) as AccountStorageV3;
+      expect(persisted.accounts[0]?.accountId).toBe("release-retry");
+    });
+
+    it("rejects stale overwrite when storage changed on disk after load", async () => {
+      const initial: AccountStorageV3 = {
+        version: 3,
+        activeIndex: 0,
+        accounts: [{ refreshToken: "t-initial", accountId: "acct-initial", addedAt: 1, lastUsed: 1 }],
+      };
+      await saveAccounts(initial);
+
+      const loaded = await loadAccounts();
+      if (!loaded) {
+        throw new Error("expected loaded storage");
+      }
+
+      const externalUpdate: AccountStorageV3 = {
+        ...loaded,
+        accounts: [
+          ...loaded.accounts,
+          { refreshToken: "t-external", accountId: "acct-external", addedAt: 2, lastUsed: 2 },
+        ],
+      };
+      await fs.writeFile(testStoragePath, JSON.stringify(externalUpdate, null, 2), "utf-8");
+
+      const staleWrite: AccountStorageV3 = {
+        ...loaded,
+        accounts: [
+          ...loaded.accounts,
+          { refreshToken: "t-stale", accountId: "acct-stale", addedAt: 3, lastUsed: 3 },
+        ],
+      };
+
+      await expect(saveAccounts(staleWrite)).rejects.toMatchObject({
+        code: "ECONFLICT",
+        message: expect.stringContaining("Detected concurrent account storage modification"),
+      });
+
+      const persisted = JSON.parse(await fs.readFile(testStoragePath, "utf-8")) as AccountStorageV3;
+      const persistedTokens = new Set(persisted.accounts.map((account) => account.refreshToken));
+      expect(persistedTokens.has("t-external")).toBe(true);
+      expect(persistedTokens.has("t-stale")).toBe(false);
+    });
+
+    it("rejects one writer with ECONFLICT when two module instances save concurrently", async () => {
+      const initial: AccountStorageV3 = {
+        version: 3,
+        activeIndex: 0,
+        accounts: [{ refreshToken: "t-initial", accountId: "acct-initial", addedAt: 1, lastUsed: 1 }],
+      };
+      await saveAccounts(initial);
+
+      const storageA = await import("../lib/storage.js?instance=concurrency-a");
+      const storageB = await import("../lib/storage.js?instance=concurrency-b");
+      storageA.setStoragePathDirect(testStoragePath);
+      storageB.setStoragePathDirect(testStoragePath);
+
+      await storageA.loadAccounts();
+      await storageB.loadAccounts();
+
+      const writeA: AccountStorageV3 = {
+        version: 3,
+        activeIndex: 0,
+        accounts: [{ refreshToken: "t-writer-a", accountId: "acct-a", addedAt: 2, lastUsed: 2 }],
+      };
+      const writeB: AccountStorageV3 = {
+        version: 3,
+        activeIndex: 0,
+        accounts: [{ refreshToken: "t-writer-b", accountId: "acct-b", addedAt: 3, lastUsed: 3 }],
+      };
+
+      const [resultA, resultB] = await Promise.allSettled([
+        storageA.saveAccounts(writeA),
+        storageB.saveAccounts(writeB),
+      ]);
+      const rejected = [resultA, resultB].filter(
+        (result): result is PromiseRejectedResult => result.status === "rejected",
+      );
+      const fulfilled = [resultA, resultB].filter(
+        (result): result is PromiseFulfilledResult<void> => result.status === "fulfilled",
+      );
+      expect(fulfilled).toHaveLength(1);
+      expect(rejected).toHaveLength(1);
+      expect((rejected[0].reason as { code?: string } | undefined)?.code).toBe("ECONFLICT");
+
+      const persisted = JSON.parse(await fs.readFile(testStoragePath, "utf-8")) as AccountStorageV3;
+      const persistedTokens = new Set(persisted.accounts.map((account) => account.refreshToken));
+      expect(persistedTokens.size).toBe(1);
+      expect(persistedTokens.has("t-writer-a") || persistedTokens.has("t-writer-b")).toBe(true);
+    });
   });
 
   describe("clearAccounts", () => {
@@ -1060,6 +1396,71 @@ describe("storage", () => {
       expect(existsSync(legacyStoragePath)).toBe(false);
       expect(existsSync(getStoragePath())).toBe(true);
     });
+
+    it("allows follow-up save after ENOENT legacy fallback load", async () => {
+      const fakeHome = join(testWorkDir, "home");
+      const projectDir = join(testWorkDir, "project-enoent-fallback");
+      const projectGitDir = join(projectDir, ".git");
+      const legacyProjectConfigDir = join(projectDir, ".codex");
+      const legacyStoragePath = join(legacyProjectConfigDir, "openai-codex-accounts.json");
+
+      await fs.mkdir(fakeHome, { recursive: true });
+      await fs.mkdir(projectGitDir, { recursive: true });
+      await fs.mkdir(legacyProjectConfigDir, { recursive: true });
+      process.env.HOME = fakeHome;
+      process.env.USERPROFILE = fakeHome;
+      setStoragePath(projectDir);
+      const canonicalPath = getStoragePath();
+
+      await fs.writeFile(
+        legacyStoragePath,
+        JSON.stringify({
+          version: 3,
+          activeIndex: 0,
+          accounts: [{ refreshToken: "legacy-refresh", accountId: "legacy-account", addedAt: 1, lastUsed: 1 }],
+        }),
+        "utf-8",
+      );
+
+      const originalRename = fs.rename.bind(fs);
+      let forcedRenameFailure = false;
+      let blockCanonicalRename = true;
+      const renameSpy = vi.spyOn(fs, "rename").mockImplementation(async (...args) => {
+        const target = String(args[1]);
+        if (blockCanonicalRename && target === canonicalPath) {
+          forcedRenameFailure = true;
+          throw Object.assign(new Error("denied"), { code: "EACCES" });
+        }
+        return originalRename(...(args as Parameters<typeof fs.rename>));
+      });
+
+      let loaded: AccountStorageV3 | null = null;
+      try {
+        loaded = await loadAccounts();
+      } finally {
+        blockCanonicalRename = false;
+        renameSpy.mockRestore();
+      }
+
+      expect(forcedRenameFailure).toBe(true);
+      expect(loaded?.accounts[0]?.accountId).toBe("legacy-account");
+      expect(existsSync(canonicalPath)).toBe(false);
+
+      const next: AccountStorageV3 = {
+        version: 3,
+        activeIndex: 0,
+        accounts: [
+          ...(loaded?.accounts ?? []),
+          { refreshToken: "post-load-save", accountId: "post-load-save", addedAt: 2, lastUsed: 2 },
+        ],
+      };
+      await expect(saveAccounts(next)).resolves.toBeUndefined();
+
+      const persisted = JSON.parse(await fs.readFile(canonicalPath, "utf-8")) as AccountStorageV3;
+      const persistedIds = new Set(persisted.accounts.map((account) => account.accountId));
+      expect(persistedIds.has("legacy-account")).toBe(true);
+      expect(persistedIds.has("post-load-save")).toBe(true);
+    });
   });
 
   describe("worktree-scoped storage migration", () => {
@@ -1539,6 +1940,105 @@ describe("storage", () => {
       statSpy.mockRestore();
     });
 
+    it("falls back to best-effort cleanup when lock.release throws EBUSY", async () => {
+      const now = Date.now();
+      const storage = {
+        version: 3 as const,
+        activeIndex: 0,
+        accounts: [{ refreshToken: "token", addedAt: now, lastUsed: now }],
+      };
+      const lockPath = `${testStoragePath}.queue.lock`;
+
+      const acquireSpy = vi.spyOn(fileLock, "acquireFileLock").mockResolvedValue({
+        path: lockPath,
+        release: async () => {
+          const err = new Error("EBUSY release") as NodeJS.ErrnoException;
+          err.code = "EBUSY";
+          throw err;
+        },
+      });
+      const rmSpy = vi.spyOn(fs, "rm");
+      try {
+        await saveAccounts(storage);
+
+        expect(existsSync(testStoragePath)).toBe(true);
+        expect(rmSpy).toHaveBeenCalledWith(lockPath, { force: true });
+      } finally {
+        rmSpy.mockRestore();
+        acquireSpy.mockRestore();
+      }
+    });
+
+    it("falls back to best-effort cleanup when lock.release throws EPERM", async () => {
+      const now = Date.now();
+      const storage = {
+        version: 3 as const,
+        activeIndex: 0,
+        accounts: [{ refreshToken: "token", addedAt: now, lastUsed: now }],
+      };
+      const lockPath = `${testStoragePath}.queue.lock`;
+
+      const acquireSpy = vi.spyOn(fileLock, "acquireFileLock").mockResolvedValue({
+        path: lockPath,
+        release: async () => {
+          const err = new Error("EPERM release") as NodeJS.ErrnoException;
+          err.code = "EPERM";
+          throw err;
+        },
+      });
+      const rmSpy = vi.spyOn(fs, "rm");
+      try {
+        await saveAccounts(storage);
+
+        expect(existsSync(testStoragePath)).toBe(true);
+        expect(rmSpy).toHaveBeenCalledWith(lockPath, { force: true });
+      } finally {
+        rmSpy.mockRestore();
+        acquireSpy.mockRestore();
+      }
+    });
+
+    it("serializes lock acquisition across concurrent saves", async () => {
+      const now = Date.now();
+      let activeLocks = 0;
+      let maxActiveLocks = 0;
+
+      const acquireSpy = vi.spyOn(fileLock, "acquireFileLock").mockImplementation(async (path) => {
+        activeLocks += 1;
+        maxActiveLocks = Math.max(maxActiveLocks, activeLocks);
+        return {
+          path,
+          release: async () => {
+            await new Promise((resolve) => setTimeout(resolve, 20));
+            activeLocks -= 1;
+          },
+        };
+      });
+      try {
+        await Promise.all([
+          saveAccounts({
+            version: 3 as const,
+            activeIndex: 0,
+            accounts: [{ refreshToken: "token-1", addedAt: now + 1, lastUsed: now + 1 }],
+          }),
+          saveAccounts({
+            version: 3 as const,
+            activeIndex: 0,
+            accounts: [{ refreshToken: "token-2", addedAt: now + 2, lastUsed: now + 2 }],
+          }),
+          saveAccounts({
+            version: 3 as const,
+            activeIndex: 0,
+            accounts: [{ refreshToken: "token-3", addedAt: now + 3, lastUsed: now + 3 }],
+          }),
+        ]);
+
+        expect(maxActiveLocks).toBe(1);
+      } finally {
+        acquireSpy.mockRestore();
+      }
+    });
+
     it("retries backup copyFile on transient EBUSY and succeeds", async () => {
       const now = Date.now();
       const storage = {
@@ -1840,9 +2340,15 @@ describe("storage", () => {
     });
 
     it("logs error for non-ENOENT errors during clear", async () => {
-      const unlinkSpy = vi.spyOn(fs, "unlink").mockRejectedValue(
-        Object.assign(new Error("EACCES error"), { code: "EACCES" })
-      );
+      const realUnlink = fs.unlink.bind(fs);
+      const unlinkSpy = vi.spyOn(fs, "unlink").mockImplementation(async (targetPath) => {
+        const candidatePath = String(targetPath);
+        if (candidatePath.endsWith(".lock")) {
+          await realUnlink(targetPath);
+          return;
+        }
+        throw Object.assign(new Error("EACCES error"), { code: "EACCES" });
+      });
 
       await clearAccounts();
 
@@ -1850,5 +2356,93 @@ describe("storage", () => {
       unlinkSpy.mockRestore();
     });
   });
+
+  describe("read retry hardening", () => {
+    const testWorkDir = join(tmpdir(), "codex-read-retry-" + Math.random().toString(36).slice(2));
+    let testStoragePath: string;
+
+    beforeEach(async () => {
+      await fs.mkdir(testWorkDir, { recursive: true });
+      testStoragePath = join(testWorkDir, "accounts.json");
+      setStoragePathDirect(testStoragePath);
+    });
+
+    afterEach(async () => {
+      vi.restoreAllMocks();
+      setStoragePathDirect(null);
+      await fs.rm(testWorkDir, { recursive: true, force: true });
+    });
+
+    it("retries transient readFile contention when loading account storage", async () => {
+      await fs.writeFile(
+        testStoragePath,
+        JSON.stringify({
+          version: 3,
+          activeIndex: 0,
+          accounts: [{ refreshToken: "retry-token", accountId: "retry-account", addedAt: 1, lastUsed: 1 }],
+        }),
+        "utf-8",
+      );
+
+      const originalReadFile = fs.readFile.bind(fs);
+      let transientFailures = 0;
+      const readSpy = vi.spyOn(fs, "readFile").mockImplementation(async (...args) => {
+        const target = args[0];
+        const path = typeof target === "string" ? target : String(target);
+        if (path === testStoragePath && transientFailures < 2) {
+          transientFailures += 1;
+          const code = transientFailures === 1 ? "EBUSY" : "EPERM";
+          throw Object.assign(new Error(code), { code });
+        }
+        return originalReadFile(...(args as Parameters<typeof fs.readFile>));
+      });
+
+      try {
+        const loaded = await loadAccounts();
+        expect(loaded?.accounts[0]?.accountId).toBe("retry-account");
+        expect(transientFailures).toBe(2);
+      } finally {
+        readSpy.mockRestore();
+      }
+    });
+
+    it("retries transient revision reads before save conflict checks", async () => {
+      const now = Date.now();
+      await saveAccounts({
+        version: 3,
+        activeIndex: 0,
+        accounts: [{ refreshToken: "initial", accountId: "initial", addedAt: now, lastUsed: now }],
+      });
+
+      const originalReadFile = fs.readFile.bind(fs);
+      let transientFailures = 0;
+      const readSpy = vi.spyOn(fs, "readFile").mockImplementation(async (...args) => {
+        const target = args[0];
+        const path = typeof target === "string" ? target : String(target);
+        if (path === testStoragePath && transientFailures < 2) {
+          transientFailures += 1;
+          const code = transientFailures === 1 ? "EBUSY" : "EAGAIN";
+          throw Object.assign(new Error(code), { code });
+        }
+        return originalReadFile(...(args as Parameters<typeof fs.readFile>));
+      });
+
+      try {
+        await saveAccounts({
+          version: 3,
+          activeIndex: 0,
+          accounts: [{ refreshToken: "next", accountId: "next", addedAt: now + 1, lastUsed: now + 1 }],
+        });
+      } finally {
+        readSpy.mockRestore();
+      }
+
+      const persisted = JSON.parse(await fs.readFile(testStoragePath, "utf-8")) as {
+        accounts?: Array<{ accountId?: string }>;
+      };
+      expect(persisted.accounts?.[0]?.accountId).toBe("next");
+      expect(transientFailures).toBe(2);
+    });
+  });
 });
 
diff --git a/test/telemetry.test.ts b/test/telemetry.test.ts
new file mode 100644
index 000000000..65975f174
--- /dev/null
+++ b/test/telemetry.test.ts
@@ -0,0 +1,178 @@
+import { existsSync, promises as fs } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import {
+	configureTelemetry,
+	getTelemetryConfig,
+	getTelemetryLogPath,
+	queryTelemetryEvents,
+	recordTelemetryEvent,
+	summarizeTelemetryEvents,
+} from "../lib/telemetry.js";
+
+const RETRYABLE_REMOVE_CODES = new Set(["EBUSY", "EPERM", "ENOTEMPTY"]);
+
+async function removeWithRetry(
+	targetPath: string,
+	options: { recursive?: boolean; force?: boolean },
+): Promise<void> {
+	for (let attempt = 0; attempt < 6; attempt += 1) {
+		try {
+			await fs.rm(targetPath, options);
+			return;
+		} catch (error) {
+			const code = (error as NodeJS.ErrnoException).code;
+			if (code === "ENOENT") return;
+			if (!code || !RETRYABLE_REMOVE_CODES.has(code) || attempt === 5) {
+				throw error;
+			}
+			await new Promise((resolve) => setTimeout(resolve, 25 * 2 ** attempt));
+		}
+	}
+}
+
+describe("telemetry module", () => {
+	let tempDir = "";
+	const originalConfig = getTelemetryConfig();
+
+	beforeEach(async () => {
+		tempDir = await fs.mkdtemp(join(tmpdir(), "codex-telemetry-"));
+		configureTelemetry({
+			enabled: true,
+			logDir: tempDir,
+			fileName: "product-telemetry.jsonl",
+			maxFileSizeBytes: 512,
+			maxFiles: 4,
+		});
+	});
+
+	afterEach(async () => {
+		configureTelemetry(originalConfig);
+		if (tempDir) {
+			await removeWithRetry(tempDir, { recursive: true, force: true });
+		}
+	});
+
+	it("records telemetry events with redacted sensitive fields", async () => {
+		await recordTelemetryEvent({
+			source: "cli",
+			event: "cli.command.finish",
+			outcome: "failure",
+			details: {
+				email: "user@example.com",
+				accessToken: "sk-1234567890abcdefghij",
+				nested: {
+					authorization: "Bearer secret-value",
+				},
+			},
+		});
+
+		const events = await queryTelemetryEvents({ limit: 10 });
+		expect(events).toHaveLength(1);
+		expect(events[0]?.details).toEqual({
+			email: "us***@***.com",
+			accessToken: "***MASKED***",
+			nested: {
+				authorization: "***MASKED***",
+			},
+		});
+	});
+
+	it("filters telemetry events by since window and limit", async () => {
+		const now = Date.now();
+		const filePath = getTelemetryLogPath();
+		await fs.writeFile(
+			filePath,
+			[
+				JSON.stringify({
+					timestamp: new Date(now - 48 * 60 * 60_000).toISOString(),
+					source: "plugin",
+					event: "request.old",
+					outcome: "failure",
+					correlationId: null,
+				}),
+				JSON.stringify({
+					timestamp: new Date(now - 90 * 60_000).toISOString(),
+					source: "plugin",
+					event: "request.mid",
+					outcome: "failure",
+					correlationId: null,
+				}),
+				JSON.stringify({
+					timestamp: new Date(now - 30 * 60_000).toISOString(),
+					source: "cli",
+					event: "cli.new",
+					outcome: "success",
+					correlationId: null,
+				}),
+			].join("\n") + "\n",
+			"utf8",
+		);
+
+		const recent = await queryTelemetryEvents({
+			sinceMs: now - 2 * 60 * 60_000,
+			limit: 10,
+		});
+		expect(recent.map((event) => event.event)).toEqual(["request.mid", "cli.new"]);
+
+		const limited = await queryTelemetryEvents({
+			sinceMs: 0,
+			limit: 1,
+		});
+		expect(limited).toHaveLength(1);
+		expect(limited[0]?.event).toBe("cli.new");
+	});
+
+	it("summarizes telemetry events by source, outcome, and event key", () => {
+		const summary = summarizeTelemetryEvents([
+			{
+				timestamp: "2026-03-01T00:00:00.000Z",
+				source: "cli",
+				event: "cli.command.finish",
+				outcome: "success",
+				correlationId: null,
+			},
+			{
+				timestamp: "2026-03-01T00:00:01.000Z",
+				source: "plugin",
+				event: "request.server_error",
+				outcome: "failure",
+				correlationId: null,
+			},
+			{
+				timestamp: "2026-03-01T00:00:02.000Z",
+				source: "plugin",
+				event: "request.server_error",
+				outcome: "failure",
+				correlationId: null,
+			},
+		]);
+
+		expect(summary.total).toBe(3);
+		expect(summary.bySource).toEqual({ cli: 1, plugin: 2 });
+		expect(summary.byOutcome.failure).toBe(2);
+		expect(summary.byEvent[0]).toEqual({ event: "request.server_error", count: 2 });
+		expect(summary.firstTimestamp).toBe("2026-03-01T00:00:00.000Z");
+		expect(summary.lastTimestamp).toBe("2026-03-01T00:00:02.000Z");
+	});
+
+	it("rotates telemetry log files when max size is exceeded", async () => {
+		configureTelemetry({ maxFileSizeBytes: 180, maxFiles: 3 });
+
+		for (let i = 0; i < 10; i += 1) {
+			await recordTelemetryEvent({
+				source: "plugin",
+				event: "request.network_error",
+				outcome: "failure",
+				details: {
+					index: i,
+					message: "x".repeat(80),
+				},
+			});
+		}
+
+		expect(existsSync(getTelemetryLogPath())).toBe(true);
+		expect(existsSync(`${getTelemetryLogPath()}.1`)).toBe(true);
+	});
+});
diff --git a/test/token-store.test.ts b/test/token-store.test.ts
new file mode 100644
index 000000000..d686abdac
--- /dev/null
+++ b/test/token-store.test.ts
@@ -0,0 +1,303 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+type Deferred<T> = {
+	promise: Promise<T>;
+	resolve: (value: T | PromiseLike<T>) => void;
+	reject: (reason?: unknown) => void;
+};
+
+function createDeferred<T>(): Deferred<T> {
+	let resolve!: (value: T | PromiseLike<T>) => void;
+	let reject!: (reason?: unknown) => void;
+	const promise = new Promise<T>((resolvePromise, rejectPromise) => {
+		resolve = resolvePromise;
+		reject = rejectPromise;
+	});
+	return { promise, resolve, reject };
+}
+
+function mockKeytar(module: {
+	setPassword: (service: string, account: string, password: string) => Promise<void>;
+	getPassword: (service: string, account: string) => Promise<string | null>;
+	deletePassword: (service: string, account: string) => Promise<boolean>;
+}): void {
+	vi.doMock("keytar", () => ({
+		...module,
+		default: module,
+	}));
+}
+
+describe("token store", () => {
+	const originalMode = process.env.CODEX_SECRET_STORAGE_MODE;
+
+	beforeEach(() => {
+		vi.resetModules();
+	});
+
+	afterEach(() => {
+		if (originalMode === undefined) {
+			delete process.env.CODEX_SECRET_STORAGE_MODE;
+		} else {
+			process.env.CODEX_SECRET_STORAGE_MODE = originalMode;
+		}
+		vi.doUnmock("keytar");
+		vi.restoreAllMocks();
+	});
+
+	it("returns plaintext mode when explicitly configured", async () => {
+		process.env.CODEX_SECRET_STORAGE_MODE = "plaintext";
+		const tokenStore = await import("../lib/secrets/token-store.js");
+		expect(await tokenStore.getEffectiveSecretStorageMode()).toBe("plaintext");
+		expect(
+			await tokenStore.persistAccountSecrets("acct-1", {
+				refreshToken: "refresh-token",
+				accessToken: "access-token",
+			}),
+		).toBeNull();
+	});
+
+	it("supports CommonJS default export interop for keytar", async () => {
+		const secrets = new Map<string, string>();
+		mockKeytar({
+			setPassword: async (_service: string, account: string, password: string) => {
+				secrets.set(account, password);
+			},
+			getPassword: async (_service: string, account: string) => secrets.get(account) ?? null,
+			deletePassword: async (_service: string, account: string) => secrets.delete(account),
+		});
+
+		process.env.CODEX_SECRET_STORAGE_MODE = "keychain";
+		const tokenStore = await import("../lib/secrets/token-store.js");
+		await tokenStore.ensureSecretStorageBackendAvailable();
+
+		const refs = await tokenStore.persistAccountSecrets("acct-cjs", {
+			refreshToken: "refresh-cjs",
+			accessToken: "access-cjs",
+		});
+		expect(refs).toEqual({
+			refreshTokenRef: "acct-cjs:refresh",
+			accessTokenRef: "acct-cjs:access",
+		});
+		expect(
+			await tokenStore.loadAccountSecrets({
+				refreshTokenRef: "acct-cjs:refresh",
+				accessTokenRef: "acct-cjs:access",
+			}),
+		).toEqual({
+			refreshToken: "refresh-cjs",
+			accessToken: "access-cjs",
+		});
+	});
+
+	it("stores and loads secrets through keytar in keychain mode", async () => {
+		const secrets = new Map<string, string>();
+		mockKeytar({
+			setPassword: async (_service: string, account: string, password: string) => {
+				secrets.set(account, password);
+			},
+			getPassword: async (_service: string, account: string) => secrets.get(account) ?? null,
+			deletePassword: async (_service: string, account: string) => secrets.delete(account),
+		});
+
+		process.env.CODEX_SECRET_STORAGE_MODE = "keychain";
+		const tokenStore = await import("../lib/secrets/token-store.js");
+
+		await tokenStore.ensureSecretStorageBackendAvailable();
+		const refs = await tokenStore.persistAccountSecrets("acct-1", {
+			refreshToken: "refresh-token",
+			accessToken: "access-token",
+		});
+		expect(refs).toEqual({
+			refreshTokenRef: "acct-1:refresh",
+			accessTokenRef: "acct-1:access",
+		});
+
+		const loaded = await tokenStore.loadAccountSecrets({
+			refreshTokenRef: "acct-1:refresh",
+			accessTokenRef: "acct-1:access",
+		});
+		expect(loaded).toEqual({
+			refreshToken: "refresh-token",
+			accessToken: "access-token",
+		});
+	});
+
+	it("handles concurrent keychain writes for the same account ref without torn secrets", async () => {
+		const secrets = new Map<string, string>();
+		const refreshGate = createDeferred<void>();
+		const firstRefreshEntered = createDeferred<void>();
+		let refreshCallCount = 0;
+
+		mockKeytar({
+			setPassword: async (_service: string, account: string, password: string) => {
+				if (account === "acct-1:refresh") {
+					refreshCallCount += 1;
+					if (refreshCallCount === 1) {
+						firstRefreshEntered.resolve();
+						await refreshGate.promise;
+					}
+				}
+				secrets.set(account, password);
+			},
+			getPassword: async (_service: string, account: string) => secrets.get(account) ?? null,
+			deletePassword: async (_service: string, account: string) => secrets.delete(account),
+		});
+
+		process.env.CODEX_SECRET_STORAGE_MODE = "keychain";
+		const tokenStore = await import("../lib/secrets/token-store.js");
+		await tokenStore.ensureSecretStorageBackendAvailable();
+
+		const firstWrite = tokenStore.persistAccountSecrets("acct-1", {
+			refreshToken: "refresh-token-a",
+			accessToken: "access-token-a",
+		});
+		const secondWrite = tokenStore.persistAccountSecrets("acct-1", {
+			refreshToken: "refresh-token-b",
+			accessToken: "access-token-b",
+		});
+		await firstRefreshEntered.promise;
+		refreshGate.resolve();
+
+		const [firstRefs, secondRefs] = await Promise.all([firstWrite, secondWrite]);
+		expect(firstRefs).toEqual({
+			refreshTokenRef: "acct-1:refresh",
+			accessTokenRef: "acct-1:access",
+		});
+		expect(secondRefs).toEqual(firstRefs);
+
+		const loaded = await tokenStore.loadAccountSecrets({
+			refreshTokenRef: "acct-1:refresh",
+			accessTokenRef: "acct-1:access",
+		});
+		expect(loaded).toBeDefined();
+		const signature = `${loaded?.refreshToken}|${loaded?.accessToken}`;
+		expect(new Set(["refresh-token-a|access-token-a", "refresh-token-b|access-token-b"]).has(signature)).toBe(
+			true,
+		);
+	});
+
+	it("rolls back refresh ref when access ref persistence fails", async () => {
+		const secrets = new Map<string, string>();
+		const deletedRefs: string[] = [];
+		mockKeytar({
+			setPassword: async (_service: string, account: string, password: string) => {
+				if (account === "acct-rollback:access") {
+					const error = new Error("access write failed") as NodeJS.ErrnoException;
+					error.code = "EACCES";
+					throw error;
+				}
+				secrets.set(account, password);
+			},
+			getPassword: async (_service: string, account: string) => secrets.get(account) ?? null,
+			deletePassword: async (_service: string, account: string) => {
+				deletedRefs.push(account);
+				secrets.delete(account);
+				return true;
+			},
+		});
+
+		process.env.CODEX_SECRET_STORAGE_MODE = "keychain";
+		const tokenStore = await import("../lib/secrets/token-store.js");
+		await tokenStore.ensureSecretStorageBackendAvailable();
+
+		await expect(
+			tokenStore.persistAccountSecrets("acct-rollback", {
+				refreshToken: "refresh-token",
+				accessToken: "access-token",
+			}),
+		).rejects.toThrow("access write failed");
+		expect(deletedRefs).toContain("acct-rollback:refresh");
+		expect(secrets.has("acct-rollback:refresh")).toBe(false);
+	});
+
+	it("deleteAccountSecrets cleans up both refresh and access refs", async () => {
+		const secrets = new Map<string, string>();
+		const deletedRefs: string[] = [];
+		mockKeytar({
+			setPassword: async (_service: string, account: string, password: string) => {
+				secrets.set(account, password);
+			},
+			getPassword: async (_service: string, account: string) => secrets.get(account) ?? null,
+			deletePassword: async (_service: string, account: string) => {
+				deletedRefs.push(account);
+				secrets.delete(account);
+				return true;
+			},
+		});
+
+		process.env.CODEX_SECRET_STORAGE_MODE = "keychain";
+		const tokenStore = await import("../lib/secrets/token-store.js");
+		await tokenStore.ensureSecretStorageBackendAvailable();
+		await tokenStore.persistAccountSecrets("acct-delete", {
+			refreshToken: "refresh-token",
+			accessToken: "access-token",
+		});
+
+		await tokenStore.deleteAccountSecrets({
+			refreshTokenRef: "acct-delete:refresh",
+			accessTokenRef: "acct-delete:access",
+		});
+		expect(deletedRefs).toEqual(expect.arrayContaining(["acct-delete:refresh", "acct-delete:access"]));
+		expect(secrets.has("acct-delete:refresh")).toBe(false);
+		expect(secrets.has("acct-delete:access")).toBe(false);
+	});
+
+	it("attempts access-token cleanup even when refresh-token cleanup fails", async () => {
+		const deletedRefs: string[] = [];
+		mockKeytar({
+			setPassword: async () => {},
+			getPassword: async () => null,
+			deletePassword: async (_service: string, account: string) => {
+				deletedRefs.push(account);
+				if (account === "acct-partial:refresh") {
+					const error = new Error("refresh delete failed") as NodeJS.ErrnoException;
+					error.code = "EACCES";
+					throw error;
+				}
+				return true;
+			},
+		});
+
+		process.env.CODEX_SECRET_STORAGE_MODE = "keychain";
+		const tokenStore = await import("../lib/secrets/token-store.js");
+		await tokenStore.ensureSecretStorageBackendAvailable();
+
+		await expect(
+			tokenStore.deleteAccountSecrets({
+				refreshTokenRef: "acct-partial:refresh",
+				accessTokenRef: "acct-partial:access",
+			}),
+		).rejects.toThrow("refresh delete failed");
+		expect(deletedRefs).toEqual(["acct-partial:refresh", "acct-partial:access"]);
+	});
+
+	it("derives stable secret refs from account identity", async () => {
+		process.env.CODEX_SECRET_STORAGE_MODE = "plaintext";
+		const tokenStore = await import("../lib/secrets/token-store.js");
+		const first = tokenStore.deriveAccountSecretRef({
+			accountId: "acct_123",
+			email: "USER@example.com",
+			addedAt: 100,
+			refreshToken: "rt_1",
+		});
+		const second = tokenStore.deriveAccountSecretRef({
+			accountId: "acct_123",
+			email: "user@example.com",
+			addedAt: 100,
+			refreshToken: "rt_2",
+		});
+		expect(first).toBe(second);
+	});
+
+	it("falls back to token-derived refs when account identity is missing", async () => {
+		process.env.CODEX_SECRET_STORAGE_MODE = "plaintext";
+		const tokenStore = await import("../lib/secrets/token-store.js");
+		const first = tokenStore.deriveAccountSecretRef({
+			refreshToken: "rt_identity_missing_a",
+		});
+		const second = tokenStore.deriveAccountSecretRef({
+			refreshToken: "rt_identity_missing_b",
+		});
+		expect(first).not.toBe(second);
+	});
+});
diff --git a/test/unified-settings.test.ts b/test/unified-settings.test.ts
index 6eff59e61..1aa714691 100644
--- a/test/unified-settings.test.ts
+++ b/test/unified-settings.test.ts
@@ -1,7 +1,32 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 import { promises as fs } from "node:fs";
-import { join } from "node:path";
+import { basename, dirname, join } from "node:path";
 import { tmpdir } from "node:os";
+import { removeWithRetry } from "./helpers/remove-with-retry.js";
+
+async function expectSecureFileMode(path: string): Promise<void> {
+	if (process.platform === "win32") {
+		await expect(fs.readFile(path, "utf8")).resolves.toContain("\"version\": 1");
+		const entries = await fs.readdir(dirname(path));
+		const leakedTemps = entries.filter(
+			(entry) => entry.startsWith(`${basename(path)}.`) && entry.endsWith(".tmp"),
+		);
+		expect(leakedTemps).toEqual([]);
+		return;
+	}
+	const stats = await fs.stat(path);
+	expect(stats.mode & 0o777).toBe(0o600);
+}
+
+async function expectSecureDirectoryMode(path: string): Promise<void> {
+	if (process.platform === "win32") {
+		await expect(fs.access(path)).resolves.toBeUndefined();
+		return;
+	}
+	const stats = await fs.stat(path);
+	expect(stats.isDirectory()).toBe(true);
+	expect(stats.mode & 0o777).toBe(0o700);
+}
 
 describe("unified settings", () => {
 	let tempDir: string;
@@ -20,7 +45,7 @@ describe("unified settings", () => {
 		} else {
 			process.env.CODEX_MULTI_AUTH_DIR = originalDir;
 		}
-		await fs.rm(tempDir, { recursive: true, force: true });
+		await removeWithRetry(tempDir, { recursive: true, force: true });
 	});
 
 	it("merges plugin and dashboard sections into one file", async () => {
@@ -51,6 +76,8 @@ describe("unified settings", () => {
 		expect(fileContent).toContain("\"version\": 1");
 		expect(fileContent).toContain("\"pluginConfig\"");
 		expect(fileContent).toContain("\"dashboardDisplaySettings\"");
+		await expectSecureFileMode(getUnifiedSettingsPath());
+		await expectSecureDirectoryMode(dirname(getUnifiedSettingsPath()));
 	});
 
 	it("returns null sections for invalid JSON", async () => {
@@ -65,6 +92,107 @@ describe("unified settings", () => {
 		expect(await loadUnifiedDashboardSettings()).toBeNull();
 	});
 
+	it("recovers from malformed settings JSON during async plugin save", async () => {
+		const { getUnifiedSettingsPath, saveUnifiedPluginConfig, loadUnifiedPluginConfigSync } = await import(
+			"../lib/unified-settings.js"
+		);
+
+		await fs.mkdir(tempDir, { recursive: true });
+		await fs.writeFile(getUnifiedSettingsPath(), "{ malformed json", "utf8");
+
+		await expect(
+			saveUnifiedPluginConfig({ codexMode: false, requestTimeoutMs: 45_000 }),
+		).resolves.toBeUndefined();
+		expect(loadUnifiedPluginConfigSync()).toEqual({
+			codexMode: false,
+			requestTimeoutMs: 45_000,
+		});
+	});
+
+	it("recovers from valid non-object settings JSON during async plugin save", async () => {
+		const { getUnifiedSettingsPath, saveUnifiedPluginConfig, loadUnifiedPluginConfigSync } = await import(
+			"../lib/unified-settings.js"
+		);
+
+		await fs.mkdir(tempDir, { recursive: true });
+		await fs.writeFile(getUnifiedSettingsPath(), JSON.stringify([]), "utf8");
+
+		await expect(
+			saveUnifiedPluginConfig({ codexMode: false, requestTimeoutMs: 30_000 }),
+		).resolves.toBeUndefined();
+		expect(loadUnifiedPluginConfigSync()).toEqual({
+			codexMode: false,
+			requestTimeoutMs: 30_000,
+		});
+	});
+
+	it("recovers from malformed settings JSON during sync plugin save", async () => {
+		const { getUnifiedSettingsPath, saveUnifiedPluginConfigSync, loadUnifiedPluginConfigSync } = await import(
+			"../lib/unified-settings.js"
+		);
+
+		await fs.mkdir(tempDir, { recursive: true });
+		await fs.writeFile(getUnifiedSettingsPath(), "{ malformed json", "utf8");
+
+		saveUnifiedPluginConfigSync({ codexMode: true, retries: 5 });
+		expect(loadUnifiedPluginConfigSync()).toEqual({ codexMode: true, retries: 5 });
+	});
+
+	it("recovers from valid non-object settings JSON during sync plugin save", async () => {
+		const { getUnifiedSettingsPath, saveUnifiedPluginConfigSync, loadUnifiedPluginConfigSync } = await import(
+			"../lib/unified-settings.js"
+		);
+
+		await fs.mkdir(tempDir, { recursive: true });
+		await fs.writeFile(getUnifiedSettingsPath(), JSON.stringify(null), "utf8");
+
+		saveUnifiedPluginConfigSync({ codexMode: true, retries: 5 });
+		expect(loadUnifiedPluginConfigSync()).toEqual({ codexMode: true, retries: 5 });
+	});
+
+	it("handles ENOENT race between existsSync and sync read during plugin save", async () => {
+		const settingsPath = join(tempDir, "settings.json");
+		await fs.writeFile(
+			settingsPath,
+			JSON.stringify({ version: 1, pluginConfig: { codexMode: true } }),
+			"utf8",
+		);
+
+		let noentInjected = false;
+		vi.doMock("node:fs", async (importOriginal) => {
+			const actual = await importOriginal<typeof import("node:fs")>();
+			return {
+				...actual,
+				readFileSync: ((...args: Parameters<typeof actual.readFileSync>) => {
+					const target = args[0];
+					const asPath =
+						typeof target === "string" ? target : target instanceof URL ? target.pathname : "";
+					if (!noentInjected && asPath === settingsPath) {
+						noentInjected = true;
+						const error = new Error("noent") as NodeJS.ErrnoException;
+						error.code = "ENOENT";
+						throw error;
+					}
+					return actual.readFileSync(...args);
+				}) as typeof actual.readFileSync,
+			};
+		});
+
+		try {
+			const { saveUnifiedPluginConfigSync, loadUnifiedPluginConfigSync } = await import(
+				"../lib/unified-settings.js"
+			);
+			expect(() =>
+				saveUnifiedPluginConfigSync({ codexMode: false, retries: 6 }),
+			).not.toThrow();
+
+			expect(noentInjected).toBe(true);
+			expect(loadUnifiedPluginConfigSync()).toEqual({ codexMode: false, retries: 6 });
+		} finally {
+			vi.doUnmock("node:fs");
+		}
+	});
+
 	it("returns null when dashboard settings file is missing", async () => {
 		const { loadUnifiedDashboardSettings } = await import("../lib/unified-settings.js");
 		expect(await loadUnifiedDashboardSettings()).toBeNull();
@@ -82,6 +210,22 @@ describe("unified settings", () => {
 		expect(loadUnifiedPluginConfigSync()).toEqual({ codexMode: true, retries: 4 });
 		const fileContent = await fs.readFile(getUnifiedSettingsPath(), "utf8");
 		expect(fileContent).toContain("\"version\": 1");
+		await expectSecureFileMode(getUnifiedSettingsPath());
+		await expectSecureDirectoryMode(dirname(getUnifiedSettingsPath()));
+	});
+
+	it("preserves secure file mode on repeated sync writes to the same settings file", async () => {
+		const {
+			saveUnifiedPluginConfigSync,
+			loadUnifiedPluginConfigSync,
+			getUnifiedSettingsPath,
+		} = await import("../lib/unified-settings.js");
+
+		saveUnifiedPluginConfigSync({ codexMode: true, retries: 1 });
+		saveUnifiedPluginConfigSync({ codexMode: false, retries: 2 });
+
+		expect(loadUnifiedPluginConfigSync()).toEqual({ codexMode: false, retries: 2 });
+		await expectSecureFileMode(getUnifiedSettingsPath());
 	});
 
 	it("returns null for missing pluginConfig section", async () => {
@@ -225,6 +369,209 @@ describe("unified settings", () => {
 		});
 	});
 
+	it("acquires file lock before reading during plugin config updates", async () => {
+		vi.resetModules();
+		const lockState = { held: false };
+		const acquireFileLockMock = vi.fn(async () => {
+			lockState.held = true;
+			return {
+				path: "mock-settings.lock",
+				release: async () => {
+					lockState.held = false;
+				},
+			};
+		});
+		const acquireFileLockSyncMock = vi.fn(() => ({
+			path: "mock-settings.lock",
+			release: () => undefined,
+		}));
+		vi.doMock("../lib/file-lock.js", () => ({
+			acquireFileLock: acquireFileLockMock,
+			acquireFileLockSync: acquireFileLockSyncMock,
+		}));
+
+		try {
+			const { saveUnifiedPluginConfig, getUnifiedSettingsPath } = await import(
+				"../lib/unified-settings.js"
+			);
+			await fs.writeFile(
+				getUnifiedSettingsPath(),
+				JSON.stringify({
+					version: 1,
+					dashboardDisplaySettings: { menuShowLastUsed: false },
+				}),
+				"utf8",
+			);
+
+			const originalReadFile = fs.readFile.bind(fs);
+			let observedReadUnderLock = false;
+			const readSpy = vi.spyOn(fs, "readFile").mockImplementation(async (...args) => {
+				if (lockState.held) {
+					observedReadUnderLock = true;
+				}
+				return originalReadFile(...args);
+			});
+			try {
+				await saveUnifiedPluginConfig({ codexMode: true, retries: 2 });
+				expect(observedReadUnderLock).toBe(true);
+				expect(acquireFileLockMock).toHaveBeenCalledTimes(1);
+			} finally {
+				readSpy.mockRestore();
+			}
+		} finally {
+			vi.doUnmock("../lib/file-lock.js");
+			vi.resetModules();
+		}
+	});
+
+	it("does not fail async writes when lock release throws EPERM", async () => {
+		vi.resetModules();
+		const acquireFileLockMock = vi.fn(async () => ({
+			path: "mock-settings.lock",
+			release: async () => {
+				const error = new Error("perm locked") as NodeJS.ErrnoException;
+				error.code = "EPERM";
+				throw error;
+			},
+		}));
+		const acquireFileLockSyncMock = vi.fn(() => ({
+			path: "mock-settings.lock",
+			release: () => undefined,
+		}));
+		vi.doMock("../lib/file-lock.js", () => ({
+			acquireFileLock: acquireFileLockMock,
+			acquireFileLockSync: acquireFileLockSyncMock,
+		}));
+
+		try {
+			const { saveUnifiedPluginConfig, loadUnifiedPluginConfigSync } = await import(
+				"../lib/unified-settings.js"
+			);
+			await expect(saveUnifiedPluginConfig({ codexMode: true, retries: 2 })).resolves.toBeUndefined();
+			expect(loadUnifiedPluginConfigSync()).toEqual({ codexMode: true, retries: 2 });
+		} finally {
+			vi.doUnmock("../lib/file-lock.js");
+			vi.resetModules();
+		}
+	});
+
+	it("does not fail sync writes when lock release throws EBUSY", async () => {
+		vi.resetModules();
+		const acquireFileLockMock = vi.fn(async () => ({
+			path: "mock-settings.lock",
+			release: async () => undefined,
+		}));
+		const acquireFileLockSyncMock = vi.fn(() => ({
+			path: "mock-settings.lock",
+			release: () => {
+				const error = new Error("busy") as NodeJS.ErrnoException;
+				error.code = "EBUSY";
+				throw error;
+			},
+		}));
+		vi.doMock("../lib/file-lock.js", () => ({
+			acquireFileLock: acquireFileLockMock,
+			acquireFileLockSync: acquireFileLockSyncMock,
+		}));
+
+		try {
+			const { saveUnifiedPluginConfigSync, loadUnifiedPluginConfigSync } = await import(
+				"../lib/unified-settings.js"
+			);
+			expect(() => saveUnifiedPluginConfigSync({ codexMode: false, retries: 1 })).not.toThrow();
+			expect(loadUnifiedPluginConfigSync()).toEqual({ codexMode: false, retries: 1 });
+		} finally {
+			vi.doUnmock("../lib/file-lock.js");
+			vi.resetModules();
+		}
+	});
+
+	it("retries plugin save when optimistic conflict is detected", async () => {
+		const {
+			saveUnifiedPluginConfig,
+			loadUnifiedPluginConfigSync,
+			getUnifiedSettingsPath,
+		} = await import("../lib/unified-settings.js");
+		const settingsPath = getUnifiedSettingsPath();
+		await fs.writeFile(
+			settingsPath,
+			JSON.stringify({ version: 1, pluginConfig: { codexMode: true } }),
+			"utf8",
+		);
+
+		const originalReadFile = fs.readFile.bind(fs);
+		let settingsReadCount = 0;
+		const readSpy = vi.spyOn(fs, "readFile");
+		readSpy.mockImplementation(async (...args) => {
+			const target = args[0];
+			const asPath =
+				typeof target === "string" ? target : target instanceof URL ? target.pathname : "";
+			if (asPath === settingsPath) {
+				settingsReadCount += 1;
+				if (settingsReadCount === 2) {
+					return JSON.stringify({
+						version: 1,
+						pluginConfig: { codexMode: true, concurrentUpdate: true },
+					});
+				}
+			}
+			return originalReadFile(...(args as Parameters<typeof fs.readFile>));
+		});
+
+		try {
+			await saveUnifiedPluginConfig({ codexMode: false, retries: 2 });
+		} finally {
+			readSpy.mockRestore();
+		}
+
+		expect(settingsReadCount).toBeGreaterThanOrEqual(3);
+		expect(loadUnifiedPluginConfigSync()).toEqual({ codexMode: false, retries: 2 });
+	});
+
+	it("handles ENOENT race between existsSync and async read during plugin save", async () => {
+		const {
+			saveUnifiedPluginConfig,
+			loadUnifiedPluginConfigSync,
+			getUnifiedSettingsPath,
+		} = await import("../lib/unified-settings.js");
+		const settingsPath = getUnifiedSettingsPath();
+		await fs.writeFile(
+			settingsPath,
+			JSON.stringify({
+				version: 1,
+				pluginConfig: { codexMode: true },
+				dashboardDisplaySettings: { uiThemePreset: "blue" },
+			}),
+			"utf8",
+		);
+
+		const originalReadFile = fs.readFile.bind(fs);
+		let noentInjected = false;
+		const readSpy = vi.spyOn(fs, "readFile").mockImplementation(async (...args) => {
+			const target = args[0];
+			const asPath =
+				typeof target === "string" ? target : target instanceof URL ? target.pathname : "";
+			if (!noentInjected && asPath === settingsPath) {
+				noentInjected = true;
+				const error = new Error("noent") as NodeJS.ErrnoException;
+				error.code = "ENOENT";
+				throw error;
+			}
+			return originalReadFile(...(args as Parameters<typeof fs.readFile>));
+		});
+
+		try {
+			await expect(
+				saveUnifiedPluginConfig({ codexMode: false, retries: 4 }),
+			).resolves.toBeUndefined();
+		} finally {
+			readSpy.mockRestore();
+		}
+
+		expect(noentInjected).toBe(true);
+		expect(loadUnifiedPluginConfigSync()).toEqual({ codexMode: false, retries: 4 });
+	});
+
 	it("refuses overwriting settings sections when a read fails", async () => {
 		const {
 			saveUnifiedPluginConfig,
diff --git a/vitest.config.ts b/vitest.config.ts
index 929cd21d8..849676f04 100644
--- a/vitest.config.ts
+++ b/vitest.config.ts
@@ -12,6 +12,10 @@ if (forcePlainTestOutput) {
   process.env.FORCE_COLOR = '0';
 }
 
+if (!process.env.CODEX_SECRET_STORAGE_MODE) {
+  process.env.CODEX_SECRET_STORAGE_MODE = 'plaintext';
+}
+
 export default defineConfig({
   test: {
     globals: true,