[loopx-agent]

When the current Codex account is exhausted, automatic handoff now chooses the fresh allowlisted account with the most remaining subscription allowance. With B at 99% short / 5% long and C at 80% / 55%, C is selected. The lower remaining percentage across reported windows is the comparison; equal values keep the existing ring order after the current account.

接口只提供周期百分比，无法推导绝对剩余 token 或不同套餐的容量。当前账号仍可用时不抢占；登录、冷却、恢复、客户端占用、手动选择及退出/强退授权仍走原 owner。正 credits 保留既有可用性，但不增加订阅剩余百分比。

The optional provider is 0.12.3, with its manifest and module version aligned. Settings reuse contextual help for the selection rule, available on hover, focus or tap. Future-dated UI observations remain unknown. The production selection owner remains native_policy.ts; no new credential, quota or routing owner is introduced.

Validation: 10 policy cases; three new counterexamples fail on the base; 71 native account IO/transaction tests; 20 complete policy-output parity cases for disabled, ready, manual and held paths; strict native TypeScript compilation; dashboard typecheck/build; Ruff and bilingual diff check. Packaged Chinese/English, 1440/390, help/Escape, unknown quota and recovery readback passed through the shipped HTTP service and private state owner. The new integration case retains C while busy, then selects it at the existing safe boundary.

The packaged native quota/effect transport is synthetic. No live account was switched or client quit for validation. Installed qualification is now complete for merged source d3c79a6 and optional provider 0.12.3: the App reads native owner state, the contextual rule opens and closes without a settings write, and saved policy is retained. No live credential swap was performed for qualification. Percentages compare reported windows, not absolute token capacity or measured future work.

Visual evidence / 视觉证据

Primary question: which account will be selected, and why? Six synthetic accounts include exhausted, available, login-required and future/unknown observations. The default keeps quota values, current/next identity and interruption permissions visible; the rule is optional help. Desktop composition remains compact; the narrow page stacks accounts and requires scrolling for later accounts. This PR does not claim a redesign of every settings section.

Built proposal source: 6dc2bf3631ed6eb32d8e3b6c503d624a9685f0db (the rendered settings/policy source blobs match this commit); baseline e4674e814d5c73b8ce72348c1675b6f07766d3e5. Actual browser capture uses the packaged renderer, production HTTP/private IO/TS owner, synthetic allowance and simulated busy native transport. Screens contain no live account or local operating context.

Before, 1440px — ring selects B:

After, 1440px — larger limiting allowance selects C:

390px default and optional help:

[loopx-agent]

Reviewer: model_agent · gpt-6.1-sol · OpenAI · runtime_reported · max

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

动机

启用自动接续的用户，在当前订阅耗尽时需要优先用余量更足的可用订阅。 例如B短周期剩99%、长周期仅5%，C分别剩80%和55%；旧实现先选B，新实现选择C，当前A保持到既有安全边界才改变。 真实TS决策与私有状态/HTTP消费已验证候选从B改为C，忙碌等待后仍按原边界选择；设置页可按需查看排序依据。 不从百分比伪造绝对token，不抢占仍可用账号，不扩大退出/强退权限，不重放工作或更改模型。 正式安装的provider与App采用尚待合并后只读回看；真实账号切换和吞吐提升未由合成试验认证。

改动思路

不新增排序设置、余额表或凭据owner：现有TS负责资格与排序，Python/原生owner负责私有状态与效果，App只显示原投影和按需解释。 本PR只改变已获准自动切换的候选顺序和对应解释；不证明真实吞吐或绕过当前账号、占用及退出权限。 单纯在前端按额度排序不能改变真实观察器的目标，而新增优先级表或策略开关会重复现有事实与用户意图。因此就在已有候选里比较每个账号最紧张周期的剩余比例，稳定排序保留平手顺序；最多16个账号，不增加网络请求或模型调用。机器的资格与效果边界仍先执行，解释是人可按需阅读的说明，不是新的确认步骤。

状态	旧行为	本次行为
A耗尽、B剩99%/5%、C剩80%/55%	先选B	选C
候选余量相同	当前之后的环顺序	保持
当前可用、手选、未知或冷却	原有准入	保持

具体改动

按原生账号合同及design.md核对R-ORDER、R-GATES、R-UI：分别在同一owner中实现顺序、保留准入并提供按需说明；对应独立反例、真实桥接/私有状态和打包HTTP读回通过。0.12.3同步包、manifest与模块版本，修正此前模块版本落后；没有新配置、命令或状态迁移。四张公开图均为合成账号，已检查像素、来源和PNG元数据。

关键代码讲解

1. decide 保持恢复、登录、启用、当前可用和冷却这些前置分支。只从原allowlist的fresh available账号提取已有百分比，使用100减最大used得到最紧周期余量；稳定降序平手仍按原环。manual_slot继续直接遵循明确选择，credits仍表示可用而不虚增订阅余额。
2. CodexAccountSettings 在现有开关旁复用ContextHelp；按钮在label外，悬浮/聚焦/点击不改变开关。原生目标仍来自HTTP投影，短长周期值分开显示。日期在未来或超过120秒的读数保持未知；原退出和强退授权文案未弱化。
3. 忙碌后接续回归 走真实TS子进程和私有File状态，合成native transport先拒绝busy切换，断言A保持及intent为C，再放行并确认C；推进观察时钟后ready而不重复切换。策略表另覆盖单周期、平手、过期/未来、credits、禁用和手选。

对主干的风险

主要风险是把周期百分比误当不同套餐的绝对token容量，或为了偏好更满账号抢占仍可用账号。前者在帮助和合同中明确限制，后者由原早返回分支及完整输出对照约束。三个新增反例在基线失败；10项策略、71项原生账号IO与事务测试、20组完整生产决策输出对照、strict TS、dashboard实际tsc/build、Ruff与双语diff检查通过。没有用等价action码代替完整permissions/accounts/valid_until对照。

预合并5项直接及14项选中检查失败0；四项图片人工hold逐一查看，命令仍记manual_review_required，不改称自动通过。CQR cqr_617110f3d4165e33ae9c有效。CI按当前管理配置未查询。HTTP与私有状态/桥接真实运行，额度、登录及切换transport为合成；没有拿真实账号或当前用户进程试强退。需要回滚时沿原provider/停用和恢复路径，无数据转换；安装采用仍须独立读回。

语义与 CI 对齐

复用原Availability/Observation/Policy及错误状态，没有自然语言匹配或新共享语义集；比较结果是已有事实的派生，不是新authority。只改已启用自动目标顺序，所有permission及default-off不变。文档是该变化的说明，实际排序在TS强制，不能把解释当机器权限或将旧环顺序写成新实现。

我的整体评价

justified_increment，long_horizon preserved：原观察、事务、冷却、错误恢复和不重放边界保持，没有声称实际吞吐或长期收益提升。user_experience improved：偏好无需新增必答轮次或手动比完账号，选择依据在原设置一处按需解释。已检查六账号混合状态的1440px整页、390px默认与展开帮助：当前/候选及两周期数值清楚，排序解释只在帮助中出现，登录失败和未知未隐藏。窄屏账号竖排，后续账号需要滚动；没有把整份设置页重设计宣称完成。 额度与客户端占用为合成transport；真实账号切换、不同套餐绝对token容量和实际未来吞吐未资格化，安装采用另行读回。 这是一个完整、可逆的候选选择修复，维护成本集中在原owner；源码合并后继续原生安装读回，不据此关闭上层研究工作台或其他评审修复。

English verdict: APPROVE for 6dc2bf3631ed6eb32d8e3b6c503d624a9685f0db. The existing native selector now prefers the largest limiting remaining subscription percentage while preserving manual, fresh-quota and effect-authority gates. Independent base failures, complete output parity, real bridge/private-state tests and packaged HTTP views qualify this bounded change. Absolute token capacity, real-account cutover and installed adoption are separate evidence boundaries.