fix(codex): start opted-in idle quota windows before first reset

[luvs01]

Summary

An opted-in account that has never used its current quota window can remain idle until a retained future deadline. Its authentic usage response stays at 0% and moves the full-window reset timestamp forward on every observation, so waiting for that timestamp does not start the window promptly.

Use two fresh, credential-bound observations to recognize that moving deadline and run the existing small activation request. A fixed reset at 0% is already counting down and does not qualify. Persist the attempt before sending, retain a five-minute retry fence across restarts (including a saved deadline becoming due), and preserve pause, validation, reauthentication, pool-mode and native-main protection. Read the observation clock again after asynchronous metadata refresh. No reported usage values or reset credits are changed, and a completed request is not treated as proof of a refreshed UI.

Related: #3376 and the initial-window intent in #2969. Parallel proposal: #6020 addresses saved-deadline scheduling and reduced metadata polling; this proposal addresses initial-window observation. Their interaction still needs validation when updating to the current integration branch. Combined behavior has not been verified, and the broader scheduling issue is not fully resolved here.

Verification

• Focused quota activation/admission tests: 55 passed, 0 failed, including a fixed 0% clock, credential change, opt-out/pause, persistence failure, restart fencing and metadata timestamp advancement.
• Test-layout guards: 18 passed on this branch before the final clock regression was added to the already registered test file.
• TypeScript, file-size ratchet, structure SSOT, privacy scan and diff checks passed after the final source edits.
• Documentation build passed: 537 pages and 73,512 internal links checked.
• bun scripts/test.ts --changed=dev did not pass: the wrapper selected the older upstream/dev merge base e807e1e27b, expanded into other provider/server suites, reported failures (including a composed runtime-port startup timeout), and reached the explicit 180-second run limit with exit 124. The runner and its tracked child exited. These broader failures have not been attributed to this patch or baseline-isolated. Full-suite validation is not claimed; this remains a draft.
• Operational evidence, separate from candidate deployment: two opted-in idle accounts received one existing minimal activation request each. Their authentic reset deadlines then stayed fixed while remaining seconds decreased, including a check about 30 minutes later. This candidate has not been deployed to the live proxy, and no additional live account requests are part of these tests.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Review readiness

• Required local validation passed with its scope documented.
• Branch is based on the latest dev commit.
• All correct Codex and CodeRabbit findings are fixed.
• Ready for maintainer review.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

⚠️ Deterministic hygiene checks failed.

• missing_coauthor_credit — This pull request says it reimplements, supersedes, carries, or rebases another author's pull request, but no Co-authored-by trailer names that author. Prose in a commit body is not read by anything; the trailer is what GitHub counts. Add it to the description or a commit, or obtain attribution-approved. Paths: #6020.

[github-actions]

✅ READY

• all PR quality gates passed.

Hygiene

✅ Deterministic PR hygiene checks passed.

[lidge-jun]

리뷰 · 우선순위 64 / 80

이 변경은 할당량 창 자동 시작을 켜 둔 계정만 다뤄요. 그런 계정이 이번 창을 한 번도 안 쓰면, 사용량은 0%로 남고 리셋 시각만 볼 때마다 뒤로 밀려요. 그 시각이 올 때까지 기다려도 창은 시작되지 않아요.

같은 로그인 정보로 사용량을 두 번 새로 봐요. 리셋 시각이 본 시간만큼 같이 밀리면, 아직 안 쓴 창으로 보고 원래 있던 작은 모델 요청을 한 번 보내요. 리셋 시각이 가만히 있으면 이미 시간이 가는 중이니 보내지 않아요. 보내기 전에 시도 시각을 설정 파일에 적어요. 프록시가 다시 켜져도 5분 안에는 같은 시도를 반복하지 않아요. 일시정지, 계정 검사 대기, 다시 로그인, 풀 모드, 메인 계정 잠금은 그대로 막아요. 기준 브랜치는 dev예요.

src/codex/quota-auto-refresh.ts:341 - 처음 창 요청이 성공해도 여기서 그냥 돌아와요. 예전에 저장한 nextWeeklyResetAt과 nextFiveHourResetAt은 그대로 남아요. rememberWindows는 더 이른 시각만 남겨요. 그 시각이 아직 미래면, 진짜 리셋보다 먼저 기존 활성화가 작은 요청을 한 번 더 보내요. 테스트 tests/codex-integration/codex-quota-initial-activation.test.ts도 그 시각이 안 바뀌는 것을 통과 조건으로 잠가 두었어요.

src/codex/quota-auto-refresh.ts:316 - 처음 시도를 기록한 뒤 5분 동안 이 줄에서 계정 전체를 건너뛰어요. 그 사이에는 리셋 시각이 된 창 활성화와 사용량 새로고침도 하지 않아요.

검증 - 작성자 기록으로는 초점 테스트 55개가 통과했어요. bun scripts/test.ts --changed=dev는 실패했어요. 비교 기준이 이 저장소 dev가 아니라 upstream/dev(e807e1e27b)라서 다른 테스트까지 돌았고, 180초 제한으로 끝났어요. 실패 원인이 이 패치인지는 아직 몰라요. PR은 draft이고 리뷰 준비 칸도 비어 있어요. 하이진은 missing_coauthor_credit으로 #6020 공동 작성자 표기가 없다고 실패해요.

메인테이너의 판단이 필요한 지점
#6020도 같은 워커를 고쳐요. 어느 쪽을 먼저 합칠지 정해야 해요. 이 PR 본문은 #6020 코드를 가져오지 않았다고 해요. 하이진이 공동 작성자를 요구하는 이유가 본문의 rebase라는 말 때문인지, 실제로 코드를 가져왔는지는 사람이 봐야 해요.
처음 활성화가 성공한 뒤, 저장해 둔 이른 리셋 시각을 지울지도 정해야 해요. 두면 창 중간에 요청이 한 번 더 나가요.
보안 검토 칸이 비어 있어요. 켜 둔 계정에는 실제 모델 요청이 나가요. 리셋 크레딧은 쓰지 않는다는 설명을 그대로 둘지도 확인이 필요해요.

너의 추천
지금은 합치지 말고 draft로 두세요. 성공한 처음 활성화 뒤에는, 그 창에 저장된 리셋 시각이 방금 본 시각보다 이르면 지우거나 새 시각으로 바꾸세요. 그 경우를 테스트에 넣으세요. #6020과 겹치는 설명을 한 줄로 정리하고, 공동 작성자가 정말 필요할 때만 넣으세요. changed=dev는 이 저장소 dev 기준으로 다시 돌려 실패가 이 패치인지 확인하세요.

이 댓글은 grok-bot이 작성했습니다

[luvs01]

Author-action sweep: clarified the PR description so the parallel #6020 proposal is not described as already integrated or validated here. The code head remains 37b4b4e409bb137a77bfbee5b5f4e32146c68dda; its Cross-platform CI and React Doctor runs are successful, but this is still a draft and conflicts with the current integration branch. I did not mark the broader validation checklist complete or send live activation requests. The next code integration must preserve restart-safe retry fencing and verify the interaction between the initial moving-window observation and the saved-deadline schedule; passing old-head CI is not evidence for that combined behavior.

[lidge-jun]

Closing as superseded by #6020, which landed in #6062 (merge bf6c57c0d7). On dev the retained earliest deadline already starts an idle window exactly once (a 5.5-hour simulation with a reset that re-anchors on every observation activated once, at the first retained deadline), and #6020 stops the usage polling while deadlines are known, so the moving-reset case this PR targets no longer needs forced probes. The review also found that this branch would warm an already-started window a second time and that its 5-minute fence blocked due windows. Thank you for digging into this; if you see an idle window that still never starts on current dev, please open an issue with the quota snapshots.