From d27ae6262a5becb2d3f58379ca7ab4d64c435253 Mon Sep 17 00:00:00 2001
From: ryoppippi <1560508+ryoppippi@users.noreply.github.com>
Date: Sat, 31 Oct 2026 20:59:01 +0000
Subject: [PATCH 1/6] feat(server): recover limited Codex threads with opted-in
 reset credits

Unattended threads currently wait for the natural allowance reset even when their account has banked reset credits. Add an off-by-default per-instance opt-in and redeem only under fresh account checks and shared manual/automatic locks.

Keep one durable attempt per account so an eligible thread can adopt a lost response with the same key, failed pre-send claims can be released, and expired windows can recover. Persist provider-confirmed outcomes separately from fresh allowance proof, preserve the armed recovery request, and give later reports and natural continuations distinct receipt identities.

Expose the preference and recovery outcome on web and mobile, restricted to one selected server. Include migration 077 and regressions for replay, Stop races, account locking, and both early and natural continuation.
---
 .../SettingsServerControlsRouteScreen.tsx     |   1 +
 .../settings/ThreadSettingsSections.tsx       |  47 +-
 .../threads/UsageLimitRecoveryCard.tsx        |  31 +-
 .../src/orchestration-v2/Orchestrator.ts      | 150 +++++-
 .../orchestration-v2/ProjectionStore.test.ts  | 338 ++++++++++++
 .../src/orchestration-v2/ProjectionStore.ts   | 132 ++++-
 .../ProviderTurnControlService.test.ts        |   4 +
 .../UsageLimitRecoveryWorker.test.ts          | 477 ++++++++++++++++-
 .../UsageLimitRecoveryWorker.ts               | 485 +++++++++++++++++-
 .../src/orchestration-v2/runtimeLayer.test.ts | 187 ++++++-
 .../src/orchestration-v2/runtimeLayer.ts      |   2 +-
 apps/server/src/persistence/Migrations.ts     |   2 +
 .../Migrations/077_CodexAutoResetAttempts.ts  |  18 +
 apps/server/src/provider/CodexProvider.ts     |  14 +-
 .../src/provider/Drivers/CodexDriver.ts       | 281 ++++++++--
 .../provider/Drivers/CodexManagedProvider.ts  |   5 +-
 .../provider/ProviderInstanceRegistry.test.ts | 130 +++++
 .../src/provider/ProviderRegistry.test.ts     |  20 +
 apps/server/src/provider/ProviderRegistry.ts  |  44 ++
 .../src/provider/codexUsageLimits.test.ts     |  87 ++++
 apps/server/src/provider/codexUsageLimits.ts  |  48 +-
 .../providerMaintenanceRunner.test.ts         |   2 +
 .../provider/resetCreditCoordinator.test.ts   | 188 +++++++
 .../src/provider/resetCreditCoordinator.ts    | 111 +++-
 .../testFixtures/codexCollabMockPeer.mjs      |  50 +-
 .../testUtils/providerRegistryMock.ts         |   2 +
 .../chat/UsageLimitRecoveryBanner.tsx         |  37 +-
 .../components/settings/SettingsPanels.tsx    |  42 +-
 docs/user/usage.md                            |  12 +
 .../contracts/src/orchestrationV2.test.ts     |  13 +
 packages/contracts/src/orchestrationV2.ts     |  33 ++
 packages/contracts/src/settings.ts            |   6 +
 packages/provider-core/src/server/driver.ts   |  33 ++
 33 files changed, 2948 insertions(+), 84 deletions(-)
 create mode 100644 apps/server/src/persistence/Migrations/077_CodexAutoResetAttempts.ts

diff --git a/apps/mobile/src/features/settings/SettingsServerControlsRouteScreen.tsx b/apps/mobile/src/features/settings/SettingsServerControlsRouteScreen.tsx
index 91b0b1b044e58..0dcf009c2e761 100644
--- a/apps/mobile/src/features/settings/SettingsServerControlsRouteScreen.tsx
+++ b/apps/mobile/src/features/settings/SettingsServerControlsRouteScreen.tsx
@@ -136,6 +136,7 @@ const AUTO_SETTLE_SETTING_KEYS: ReadonlySet<string> = new Set([
   "sidebarAutoSettleAfterDays",
   "autoResumeLimitedThreads",
   "snoozeLimitedThreads",
+  "autoRedeemCodexResetCredits",
 ]);
 
 function planServerSettingsWrites(
diff --git a/apps/mobile/src/features/settings/ThreadSettingsSections.tsx b/apps/mobile/src/features/settings/ThreadSettingsSections.tsx
index 2e77d4d3937e7..26670b9635ece 100644
--- a/apps/mobile/src/features/settings/ThreadSettingsSections.tsx
+++ b/apps/mobile/src/features/settings/ThreadSettingsSections.tsx
@@ -1,5 +1,10 @@
 import { Button } from "../../components/ui/Button";
-import { AuthSettingsWriteScope, type ServerSettingsPatch } from "@t3tools/contracts";
+import {
+  AuthSettingsWriteScope,
+  ProviderDriverKind,
+  ProviderInstanceId,
+  type ServerSettingsPatch,
+} from "@t3tools/contracts";
 import { useEnvironmentsWithScope } from "../../state/session";
 import { AutoSettleDaysField } from "./components/AutoSettleDaysField";
 import { ScreenScrollView as ScrollView } from "../../components/ui/ScreenScrollView";
@@ -76,10 +81,24 @@ export function AutoSettleSettingsRows(props: {
     return null;
   }
 
+  const codexInstances = Object.entries(referenceSettings.providerInstances).filter(
+    ([, instance]) => {
+      if (instance.driver !== ProviderDriverKind.make("codex")) return false;
+      const config = instance.config;
+      return !(
+        typeof config === "object" &&
+        config !== null &&
+        "setupMode" in config &&
+        config.setupMode === "managed"
+      );
+    },
+  );
+
   const writeToAll = (
     patch: Partial<AutoSettleSettings> & {
       autoResumeLimitedThreads?: boolean;
       snoozeLimitedThreads?: boolean;
+      autoRedeemCodexResetCredits?: ServerSettingsPatch["autoRedeemCodexResetCredits"];
     },
   ) => props.write(patch);
 
@@ -118,6 +137,32 @@ export function AutoSettleSettingsRows(props: {
             disabled={disabled}
             onValueChange={(value) => writeToAll({ snoozeLimitedThreads: value })}
           />
+          {displayTargets.length > 1 && codexInstances.length > 0 ? (
+            <Text className="text-sm text-foreground-secondary">
+              Select one server to change per-account reset settings.
+            </Text>
+          ) : displayTargets.length === 1 ? (
+            codexInstances.map(([instanceId, instance]) => (
+              <SettingsSwitchRow
+                key={instanceId}
+                icon="clock"
+                label={`Use banked Codex resets${instance.displayName ? ` for ${instance.displayName}` : ""}`}
+                value={
+                  referenceSettings.autoRedeemCodexResetCredits[
+                    ProviderInstanceId.make(instanceId)
+                  ] === true
+                }
+                disabled={disabled}
+                onValueChange={(value) =>
+                  writeToAll({
+                    autoRedeemCodexResetCredits: {
+                      [ProviderInstanceId.make(instanceId)]: value,
+                    },
+                  })
+                }
+              />
+            ))
+          ) : null}
         </SettingsSection>
       ) : null}
       <SettingsSection title="Auto-settle">
diff --git a/apps/mobile/src/features/threads/UsageLimitRecoveryCard.tsx b/apps/mobile/src/features/threads/UsageLimitRecoveryCard.tsx
index 791dc2ab5d847..a9de2921b2f4c 100644
--- a/apps/mobile/src/features/threads/UsageLimitRecoveryCard.tsx
+++ b/apps/mobile/src/features/threads/UsageLimitRecoveryCard.tsx
@@ -2,7 +2,7 @@ import { Button } from "../../components/ui/Button";
 import { squashAtomCommandFailure } from "@t3tools/client-runtime/state/runtime";
 import { AsyncResult } from "effect/reactivity";
 import type { EnvironmentThreadShell } from "@t3tools/client-runtime/state/shell";
-import type { EnvironmentId } from "@t3tools/contracts";
+import type { EnvironmentId, OrchestrationV2CodexResetRedemption } from "@t3tools/contracts";
 import * as DateTime from "effect/DateTime";
 import { useState } from "react";
 import { View } from "react-native";
@@ -28,6 +28,10 @@ export function UsageLimitRecoveryCard({
   const resetPassed = useDeadlinePassed(resetAt === null ? null : Date.parse(resetAt));
   const runId = thread.latestRun?.runId;
   const recovery = thread.limitRecovery;
+  const redemption =
+    recovery?.runId === runId && recovery?.resetAt === resetAt
+      ? recovery?.codexResetRedemption
+      : undefined;
   const scheduled =
     recovery?.runId === runId && recovery?.resetAt === resetAt && recovery?.autoResume;
   if (
@@ -75,6 +79,11 @@ export function UsageLimitRecoveryCard({
           ? `Usage limit resets ${DateTime.toDateUtc(DateTime.makeUnsafe(resetAt)).toLocaleString()}.`
           : "The provider did not report a reset time. Retry manually when your limit is available."}
       </Text>
+      {redemption ? (
+        <Text className="text-sm text-foreground-tertiary">
+          {codexResetRedemptionMessage(redemption)}
+        </Text>
+      ) : null}
       {canSchedule ? (
         <View className="flex-row flex-wrap gap-2">
           <Button
@@ -99,3 +108,23 @@ export function UsageLimitRecoveryCard({
     </View>
   );
 }
+
+function codexResetRedemptionMessage(redemption: OrchestrationV2CodexResetRedemption) {
+  const account = redemption.accountLabel ?? "this Codex account";
+  if (redemption.outcome === "reset" && redemption.allowanceCleared)
+    return `Codex reported a reset for ${account}, and a fresh check found this usage limit clear.`;
+  switch (redemption.outcome) {
+    case "pending":
+      return `Checking whether Codex applied a reset for ${account}.`;
+    case "noCredit":
+      return `No reset credits were available for ${account}; this thread remains limited.`;
+    case "nothingToReset":
+      return `No reset was used for ${account}; this thread remains limited.`;
+    case "reset":
+      return `Codex reported a reset for ${account}, but this usage limit is still active.`;
+    case "unconfirmed":
+      return `Could not confirm a reset for ${account}; this thread remains limited.`;
+    case "declined":
+      return `Auto-reset skipped for ${account}; this thread remains limited.`;
+  }
+}
diff --git a/apps/server/src/orchestration-v2/Orchestrator.ts b/apps/server/src/orchestration-v2/Orchestrator.ts
index 0a5e56d98d639..47430fd56f0d9 100644
--- a/apps/server/src/orchestration-v2/Orchestrator.ts
+++ b/apps/server/src/orchestration-v2/Orchestrator.ts
@@ -89,6 +89,8 @@ import * as Option from "effect/Option";
 import * as Ref from "effect/Ref";
 import * as Result from "effect/Result";
 import * as Schema from "effect/Schema";
+import * as Crypto from "effect/Crypto";
+import * as Hex from "effect/encoding/Hex";
 import * as Stream from "effect/Stream";
 
 import * as ProjectStore from "./ProjectStore.ts";
@@ -343,7 +345,16 @@ export interface OrchestratorV2Shape {
     readonly commandId: CommandId;
     readonly threadId: ThreadId;
     readonly limitRecovery: OrchestrationV2LimitRecoveryUpdate;
-  }) => Effect.Effect<void, OrchestratorV2Error>;
+  }) => Effect.Effect<boolean, OrchestratorV2Error>;
+  readonly recordCodexResetRedemption: (
+    input: Omit<
+      Extract<
+        OrchestrationV2InternalCommand,
+        { readonly type: "thread.limit-recovery.codex-reset" }
+      >,
+      "type"
+    >,
+  ) => Effect.Effect<boolean, OrchestratorV2Error>;
   readonly searchThreadStream: (
     input: OrchestrationV2SearchThreadInput,
   ) => Stream.Stream<OrchestrationV2SearchThreadResult, OrchestratorV2Error>;
@@ -558,6 +569,7 @@ function commandThreadId(command: OrchestrationV2ServerCommand): ThreadId {
     case "thread.created.record":
       return command.parentThreadId;
     case "secret_request.record":
+    case "thread.limit-recovery.codex-reset":
     case "link_request.record":
       return command.threadId;
     case "thread.fork":
@@ -970,7 +982,10 @@ function lastDeliveredRunForProviderThread(
   );
 }
 
+const encodeRedemptionReport = Schema.encodeSync(Schema.fromJsonString(Schema.Unknown));
+
 const makeOrchestrator = Effect.fn("orchestrationV2.Orchestrator.layer")(function* () {
+  const crypto = yield* Crypto.Crypto;
   const checkpointService = yield* CheckpointServiceV2;
   const commandPolicy = yield* CommandPolicyV2;
   const contextHandoffService = yield* ContextHandoffServiceV2;
@@ -3530,6 +3545,9 @@ const makeOrchestrator = Effect.fn("orchestrationV2.Orchestrator.layer")(functio
                     autoResume:
                       command.limitRecovery.autoResume ?? previousRecovery?.autoResume ?? false,
                     snooze: command.limitRecovery.snooze ?? previousRecovery?.snooze ?? false,
+                    ...(previousRecovery?.codexResetRedemption === undefined
+                      ? {}
+                      : { codexResetRedemption: previousRecovery.codexResetRedemption }),
                     requestId: command.commandId,
                   };
           return {
@@ -5284,6 +5302,20 @@ const makeOrchestrator = Effect.fn("orchestrationV2.Orchestrator.layer")(functio
       const failure = latestRootProviderFailure(run, projection.turnItems);
       const recovery = projection.thread.limitRecovery;
       const now = yield* DateTime.now;
+      const nowMs = DateTime.toEpochMillis(now);
+      const currentSettings = yield* serverSettings.getSettings.pipe(
+        Effect.orElseSucceed(() => null),
+      );
+      const earlyResetConfirmed =
+        currentSettings?.autoResumeLimitedThreads === true &&
+        currentSettings.autoRedeemCodexResetCredits[projection.thread.providerInstanceId] ===
+          true &&
+        recovery?.codexResetRedemption?.outcome === "reset" &&
+        recovery.codexResetRedemption.allowanceCleared === true &&
+        recovery.codexResetRedemption.checkedAt !== undefined &&
+        recovery.codexResetRedemption.providerInstanceId === run?.providerInstanceId &&
+        Date.parse(recovery.codexResetRedemption.checkedAt) >
+          Date.parse(recovery.codexResetRedemption.attemptedAt);
       if (
         run?.id !== command.usageLimitContinuationOfRunId ||
         failure?.class !== "usage_limit" ||
@@ -5292,7 +5324,7 @@ const makeOrchestrator = Effect.fn("orchestrationV2.Orchestrator.layer")(functio
         recovery.requestId !== command.usageLimitRecoveryRequestId ||
         recovery.runId !== run.id ||
         recovery.resetAt !== failure.resetAt ||
-        Date.parse(recovery.resetAt) > DateTime.toEpochMillis(now) ||
+        (Date.parse(recovery.resetAt) > nowMs && !earlyResetConfirmed) ||
         projection.thread.archivedAt !== null ||
         projection.thread.deletedAt !== null ||
         projection.thread.settledOverride === "settled" ||
@@ -8589,6 +8621,49 @@ const makeOrchestrator = Effect.fn("orchestrationV2.Orchestrator.layer")(functio
     },
   );
 
+  const dispatchCodexResetRedemption = Effect.fn("orchestrationV2.dispatch.codexResetRedemption")(
+    function* (
+      command: Extract<
+        OrchestrationV2InternalCommand,
+        { readonly type: "thread.limit-recovery.codex-reset" }
+      >,
+      events: Ref.Ref<Array<OrchestrationV2DomainEvent>>,
+    ) {
+      const thread = yield* projectionStore
+        .getThread(command.threadId)
+        .pipe(
+          Effect.mapError(
+            (cause) => new OrchestratorProjectionError({ threadId: command.threadId, cause }),
+          ),
+        );
+      const recovery = thread.limitRecovery;
+      if (
+        recovery?.runId !== command.runId ||
+        recovery.resetAt !== command.resetAt ||
+        (command.codexResetRedemption.outcome === "pending" && !recovery.autoResume) ||
+        thread.providerInstanceId !== command.codexResetRedemption.providerInstanceId
+      )
+        return;
+      const now = yield* DateTime.now;
+      yield* emit(
+        events,
+        command,
+      )({
+        type: "thread.metadata-updated",
+        threadId: command.threadId,
+        occurredAt: now,
+        payload: {
+          ...thread,
+          limitRecovery: {
+            ...recovery,
+            codexResetRedemption: command.codexResetRedemption,
+          },
+          updatedAt: now,
+        },
+      });
+    },
+  );
+
   /**
    * Records or updates the card for a link an agent asked the user to make.
    * The pairing code goes straight to the link and never through orchestration.
@@ -13223,6 +13298,9 @@ const makeOrchestrator = Effect.fn("orchestrationV2.Orchestrator.layer")(functio
       case "secret_request.record":
         yield* dispatchSecretRequestRecord(command, events);
         break;
+      case "thread.limit-recovery.codex-reset":
+        yield* dispatchCodexResetRedemption(command, events);
+        break;
       case "link_request.record":
         yield* dispatchLinkRequestRecord(command, events, effects);
         break;
@@ -13814,11 +13892,10 @@ const makeOrchestrator = Effect.fn("orchestrationV2.Orchestrator.layer")(functio
               ),
             );
           // Stop or an explicit recovery choice can commit after the sweep reads its candidate.
-          if (
+          const recoveryMatches =
             thread.limitRecovery?.runId === input.limitRecovery.runId &&
-            thread.limitRecovery.resetAt === input.limitRecovery.resetAt
-          )
-            return;
+            thread.limitRecovery.resetAt === input.limitRecovery.resetAt;
+          if (recoveryMatches) return thread.limitRecovery?.autoResume === true;
           const command = { type: "thread.metadata.update", ...input } as const;
           // A Stop that reached the run before its limit failure landed had nothing to disarm.
           const stopped = yield* stopReachedRun(command, input.threadId, input.limitRecovery.runId);
@@ -13830,9 +13907,69 @@ const makeOrchestrator = Effect.fn("orchestrationV2.Orchestrator.layer")(functio
                 }
               : command,
           );
+          return !stopped;
         }),
       );
     }),
+    recordCodexResetRedemption: Effect.fn("OrchestratorV2.recordCodexResetRedemption")(
+      function* (input) {
+        return yield* threadDispatch.withLock(
+          input.threadId,
+          Effect.gen(function* () {
+            const thread = yield* projectionStore
+              .getThread(input.threadId)
+              .pipe(
+                Effect.mapError(
+                  (cause) => new OrchestratorProjectionError({ threadId: input.threadId, cause }),
+                ),
+              );
+            const recovery = thread.limitRecovery;
+            const pending = input.codexResetRedemption.outcome === "pending";
+            if (
+              recovery?.runId !== input.runId ||
+              recovery.resetAt !== input.resetAt ||
+              (pending && !recovery.autoResume) ||
+              thread.providerInstanceId !== input.codexResetRedemption.providerInstanceId
+            )
+              return false;
+            if (pending) {
+              const currentSettings = yield* serverSettings.getSettings.pipe(
+                Effect.orElseSucceed(() => null),
+              );
+              if (
+                currentSettings?.autoResumeLimitedThreads !== true ||
+                currentSettings.autoRedeemCodexResetCredits[thread.providerInstanceId] !== true
+              )
+                return false;
+            }
+            const previousRedemption = recovery.codexResetRedemption;
+            const nextRedemption = input.codexResetRedemption;
+            if (
+              previousRedemption !== undefined &&
+              Object.keys(previousRedemption).length === Object.keys(nextRedemption).length &&
+              Object.entries(previousRedemption).every(([key, value]) =>
+                Object.is(value, nextRedemption[key as keyof typeof nextRedemption]),
+              )
+            )
+              return true;
+            const report = Object.entries(nextRedemption).sort(([a], [b]) =>
+              a < b ? -1 : a > b ? 1 : 0,
+            );
+            const digest = yield* crypto
+              .digest("SHA-256", new TextEncoder().encode(encodeRedemptionReport(report)))
+              .pipe(Effect.orDie);
+            // A later provider check is a new command even when the worker retries its run.
+            const reportId = Hex.encode(digest);
+            yield* dispatchWithReceiptEffect({
+              type: "thread.limit-recovery.codex-reset",
+              ...input,
+              commandId: CommandId.make(`${input.commandId}:${reportId}`),
+            });
+            return true;
+          }),
+        );
+      },
+    ),
     searchThreadStream: (input) =>
       projectionStore
         .searchThreadStream(input)
@@ -13986,6 +14123,7 @@ const makeOrchestrator = Effect.fn("orchestrationV2.Orchestrator.layer")(functio
 export const layer: Layer.Layer<
   OrchestratorV2,
   never,
+  | Crypto.Crypto
   | CheckpointServiceV2
   | FileSystem.FileSystem
   | Path.Path
diff --git a/apps/server/src/orchestration-v2/ProjectionStore.test.ts b/apps/server/src/orchestration-v2/ProjectionStore.test.ts
index a29d698d76daf..1da6effbae26f 100644
--- a/apps/server/src/orchestration-v2/ProjectionStore.test.ts
+++ b/apps/server/src/orchestration-v2/ProjectionStore.test.ts
@@ -32,11 +32,18 @@ import * as DateTime from "effect/DateTime";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import * as Schema from "effect/Schema";
+import * as Stream from "effect/Stream";
+import * as TestClock from "effect/testing/TestClock";
 import * as Tracer from "effect/Tracer";
 import * as SqlClient from "effect/sql/SqlClient";
 import { projectThreadAwarenessV2 } from "@t3tools/shared/agentAwareness";
 
 import * as SqlitePersistence from "../persistence/Sqlite.ts";
+import * as ServerSettings from "../serverSettings.ts";
+import * as Orchestrator from "./Orchestrator.ts";
+import * as ThreadManagement from "./ThreadManagementService.ts";
+import * as UsageLimitRecoveryWorker from "./UsageLimitRecoveryWorker.ts";
+import * as ProviderRegistry from "../provider/ProviderRegistry.ts";
 import { CodexProviderCapabilitiesV2 } from "./Adapters/CodexAdapterV2.ts";
 import * as ProjectionStore from "./ProjectionStore.ts";
 import {
@@ -1584,6 +1591,300 @@ it.effect("lists every thread in the shell snapshot past SQLite's bound variable
   }).pipe(Effect.provide(layerTest)),
 );
 
+it.effect("keeps an unresolved Codex reset attempt account-scoped and reuses its key", () =>
+  Effect.gen(function* () {
+    yield* TestClock.setTime(Date.parse("2026-10-31T10:00:00.000Z"));
+    const store = yield* ProjectionStore.ProjectionStoreV2;
+    const now = DateTime.makeUnsafe(Date.parse("2026-10-31T10:00:00.000Z"));
+    const pending: ProjectionStore.CodexResetAttempt = {
+      accountFingerprint: "codex-account:ledger-test",
+      resetAt: "2026-10-31T15:00:00.000Z",
+      idempotencyKey: "codex-auto-reset:ledger-test:first-window",
+      attemptedAt: "2026-10-31T10:00:00.000Z",
+      outcome: "pending",
+      allowanceCleared: false,
+    };
+    assert.isTrue(yield* store.claimCodexResetAttempt(pending, now));
+    assert.deepEqual(yield* store.getCodexResetAttempt(pending.accountFingerprint), pending);
+    assert.isFalse(
+      yield* store.claimCodexResetAttempt(
+        {
+          ...pending,
+          resetAt: "2026-10-31T16:00:00.000Z",
+          idempotencyKey: "codex-auto-reset:ledger-test:second-window",
+        },
+        now,
+      ),
+    );
+    yield* store.updateCodexResetAttempt({
+      ...pending,
+      outcome: "reset",
+      allowanceCleared: false,
+    });
+    assert.isFalse(
+      yield* store.claimCodexResetAttempt(
+        {
+          ...pending,
+          resetAt: "2026-10-31T16:00:00.000Z",
+          idempotencyKey: "codex-auto-reset:ledger-test:second-window",
+        },
+        now,
+      ),
+    );
+    yield* store.updateCodexResetAttempt({
+      ...pending,
+      outcome: "reset",
+      allowanceCleared: true,
+      checkedAt: "2026-10-31T10:01:00.000Z",
+    });
+    assert.isTrue(
+      yield* store.claimCodexResetAttempt(
+        {
+          ...pending,
+          resetAt: "2026-10-31T16:00:00.000Z",
+          idempotencyKey: "codex-auto-reset:ledger-test:second-window",
+        },
+        now,
+      ),
+    );
+  }).pipe(Effect.provide(layerTest)),
+);
+
+it.effect(
+  "releases only its matching Codex attempt and permits a claim after the window expires",
+  () =>
+    Effect.gen(function* () {
+      yield* TestClock.setTime(Date.parse("2026-10-31T10:00:00.000Z"));
+      const store = yield* ProjectionStore.ProjectionStoreV2;
+      const now = DateTime.makeUnsafe(Date.parse("2026-10-31T10:00:00.000Z"));
+      const first: ProjectionStore.CodexResetAttempt = {
+        accountFingerprint: "codex-account:release-test",
+        resetAt: "2026-10-31T15:00:00.000Z",
+        idempotencyKey: "codex-auto-reset:first",
+        attemptedAt: "2026-10-31T10:00:00.000Z",
+        outcome: "pending",
+        allowanceCleared: false,
+      };
+      assert.isTrue(yield* store.claimCodexResetAttempt(first, now));
+      assert.isFalse(
+        yield* store.claimCodexResetAttempt({ ...first, idempotencyKey: "other" }, now),
+      );
+      yield* store.releaseCodexResetAttempt(first.accountFingerprint, "other");
+      assert.isFalse((yield* store.getCodexResetAttempt(first.accountFingerprint)) === null);
+      yield* store.releaseCodexResetAttempt(first.accountFingerprint, first.idempotencyKey);
+      const second = { ...first, idempotencyKey: "codex-auto-reset:second" };
+      assert.isTrue(yield* store.claimCodexResetAttempt(second, now));
+      const nextWindowNow = DateTime.makeUnsafe(Date.parse("2026-10-31T15:01:00.000Z"));
+      assert.isTrue(
+        yield* store.claimCodexResetAttempt(
+          { ...second, idempotencyKey: "codex-auto-reset:next-window" },
+          nextWindowNow,
+        ),
+      );
+    }).pipe(Effect.provide(layerTest)),
+);
+
+it.effect(
+  "sweeps a real future-reset projection through one confirmed redemption and continuation",
+  () =>
+    Effect.gen(function* () {
+      const nowMs = Date.parse("2026-10-31T10:00:00.000Z");
+      yield* TestClock.setTime(nowMs);
+      const store = yield* ProjectionStore.ProjectionStoreV2;
+      const sql = yield* SqlClient.SqlClient;
+      const threadId = yield* addRolledBackRecoveryCandidate("auto-reset-sweep");
+      const sharedThreadId = yield* addRolledBackRecoveryCandidate("auto-reset-sweep-shared");
+      const projection = yield* store.getThreadProjection(threadId);
+      const sharedProjection = yield* store.getThreadProjection(sharedThreadId);
+      const run = projection.runs[0]!;
+      const sharedRun = sharedProjection.runs[0]!;
+      const now = yield* DateTime.now;
+      const resetAt = DateTime.formatIso(DateTime.makeUnsafe(nowMs + 5 * 60 * 60 * 1000));
+      const failedRun = { ...run, status: "failed" as const, completedAt: now };
+      const failureItem = {
+        id: TurnItemId.make("auto-reset-sweep:usage-limit"),
+        threadId,
+        runId: run.id,
+        nodeId: run.rootNodeId!,
+        providerThreadId: null,
+        providerTurnId: null,
+        nativeItemRef: null,
+        parentItemId: null,
+        ordinal: 2,
+        status: "failed" as const,
+        title: "Usage limit reached",
+        startedAt: now,
+        completedAt: now,
+        updatedAt: now,
+        type: "error" as const,
+        failure: {
+          class: "usage_limit" as const,
+          message: "Usage limit reached.",
+          resetAt,
+          code: "usageLimitExceeded",
+          retryable: null,
+        },
+      } satisfies OrchestrationV2TurnItem;
+      yield* store.apply({
+        id: EventId.make("auto-reset-sweep:failed-run"),
+        type: "run.updated",
+        threadId,
+        occurredAt: now,
+        payload: failedRun,
+      });
+      yield* store.apply({
+        id: EventId.make("auto-reset-sweep:usage-limit"),
+        type: "turn-item.updated",
+        threadId,
+        runId: run.id,
+        nodeId: run.rootNodeId!,
+        driver,
+        providerInstanceId,
+        occurredAt: now,
+        payload: failureItem,
+      });
+      const sharedFailureItem = {
+        ...failureItem,
+        id: TurnItemId.make("auto-reset-sweep-shared:usage-limit"),
+        threadId: sharedThreadId,
+        runId: sharedRun.id,
+        nodeId: sharedRun.rootNodeId!,
+      } satisfies OrchestrationV2TurnItem;
+      yield* store.apply({
+        id: EventId.make("auto-reset-sweep-shared:failed-run"),
+        type: "run.updated",
+        threadId: sharedThreadId,
+        occurredAt: now,
+        payload: { ...sharedRun, status: "failed" as const, completedAt: now },
+      });
+      yield* store.apply({
+        id: EventId.make("auto-reset-sweep-shared:usage-limit"),
+        type: "turn-item.updated",
+        threadId: sharedThreadId,
+        runId: sharedRun.id,
+        nodeId: sharedRun.rootNodeId!,
+        driver,
+        providerInstanceId,
+        occurredAt: now,
+        payload: sharedFailureItem,
+      });
+
+      const fingerprint = "codex-account:auto-reset-sweep";
+      const checkedAt = DateTime.formatIso(DateTime.makeUnsafe(nowMs + 2_000));
+      const provider = {
+        instanceId: providerInstanceId,
+        driver,
+        displayName: "Test Codex account",
+        auth: { email: "codex@example.test" },
+        usageLimits: {
+          credentialFingerprint: fingerprint,
+          checkedAt,
+          windows: [],
+          resetCredits: { availableCount: 1, nextCreditId: "fixture-credit-id" },
+        },
+      } as unknown as import("@t3tools/contracts").ServerProvider;
+      const autoRedeemCalls: Array<string> = [];
+      const continuationCalls: Array<string> = [];
+      const dispatchedCommandIds = new Set<string>();
+      const setRecovery = (
+        input: Parameters<Orchestrator.OrchestratorV2["Service"]["autoArmLimitRecovery"]>[0],
+      ) =>
+        Effect.gen(function* () {
+          yield* sql`UPDATE orchestration_v2_projection_threads
+          SET payload_json = json_set(payload_json, '$.limitRecovery', json(${encodeUnknownJsonString(input.limitRecovery)}))
+          WHERE thread_id = ${input.threadId}`;
+          return true;
+        }).pipe(Effect.orDie);
+      const recordRedemption = (
+        input: Parameters<Orchestrator.OrchestratorV2["Service"]["recordCodexResetRedemption"]>[0],
+      ) =>
+        Effect.gen(function* () {
+          const current = yield* store.getThread(input.threadId);
+          const recovery = current.limitRecovery!;
+          const updated = {
+            ...recovery,
+            requestId: input.commandId,
+            codexResetRedemption: input.codexResetRedemption!,
+          };
+          yield* sql`UPDATE orchestration_v2_projection_threads
+          SET payload_json = json_set(payload_json, '$.limitRecovery', json(${encodeUnknownJsonString(updated)}))
+          WHERE thread_id = ${input.threadId}`;
+          return true;
+        }).pipe(Effect.orDie);
+      const mocks = Layer.mergeAll(
+        Layer.mock(Orchestrator.OrchestratorV2)({
+          streamDomainEvents: Stream.never,
+          autoArmLimitRecovery: (input) => setRecovery(input),
+          recordCodexResetRedemption: (input) => recordRedemption(input),
+        }),
+        Layer.mock(ThreadManagement.ThreadManagementService)({
+          dispatch: (command) =>
+            Effect.sync(() => {
+              if (
+                command.type === "message.dispatch" &&
+                command.usageLimitContinuationOfRunId &&
+                !dispatchedCommandIds.has(command.commandId)
+              ) {
+                dispatchedCommandIds.add(command.commandId);
+                continuationCalls.push(command.threadId);
+              }
+              return { sequence: 1, storedEvents: [] };
+            }),
+        }),
+        Layer.mock(ServerSettings.ServerSettingsService)({
+          getSettings: Effect.succeed({
+            autoResumeLimitedThreads: true,
+            snoozeLimitedThreads: false,
+            autoRedeemCodexResetCredits: { [providerInstanceId]: true },
+          } as never),
+          streamChanges: Stream.never,
+        }),
+        Layer.mock(ProviderRegistry.ProviderRegistry)({
+          getProviders: Effect.succeed([provider]),
+          refreshInstance: () => Effect.succeed([provider]),
+          supportsAutoRedeemResetCredit: () => Effect.succeed(true),
+          autoRedeemResetCredit: (input) =>
+            Effect.gen(function* () {
+              if (!input.stillArmed || !(yield* input.stillArmed())) return null;
+              autoRedeemCalls.push(input.idempotencyKey);
+              return {
+                status: "sent",
+                accountFingerprint: fingerprint,
+                creditsBefore: 1,
+                outcome: "reset",
+                checkedAt: DateTime.formatIso(DateTime.makeUnsafe(nowMs + 1_000)),
+                allowanceCleared: true,
+                idempotencyKey: input.idempotencyKey,
+              } as const;
+            }),
+        }),
+      );
+      const sweep = yield* UsageLimitRecoveryWorker.makeSweep.pipe(Effect.provide(mocks));
+      yield* sweep();
+      assert.strictEqual((yield* store.getThread(threadId)).limitRecovery?.autoResume, true);
+      assert.isUndefined((yield* store.getThread(threadId)).limitRecovery?.codexResetRedemption);
+      yield* sweep();
+      assert.strictEqual(autoRedeemCalls.length, 1);
+      assert.strictEqual(
+        (yield* store.getThread(threadId)).limitRecovery?.codexResetRedemption?.outcome,
+        "reset",
+      );
+      assert.strictEqual(
+        (yield* store.getThread(threadId)).limitRecovery?.codexResetRedemption?.allowanceCleared,
+        true,
+      );
+      assert.strictEqual(
+        (yield* store.getThread(sharedThreadId)).limitRecovery?.codexResetRedemption
+          ?.allowanceCleared,
+        true,
+      );
+      assert.isUndefined(
+        (yield* store.getThread(threadId)).limitRecovery?.codexResetRedemption?.creditId,
+      );
+      assert.deepEqual(continuationCalls.sort(), [threadId, sharedThreadId].sort());
+    }).pipe(Effect.provide(layerTest)),
+);
+
 it.layer(layerTest)("ProjectionStoreV2", (it) => {
   // regression: #21969 keep corrupt plan JSON in the typed read error
   it.effect("returns a typed read error for malformed stored plan JSON", () =>
@@ -4366,6 +4667,8 @@ it.layer(layerTest)("ProjectionStoreV2", (it) => {
         if (lastErrorClass === "usage_limit") {
           assert.deepEqual(candidate, {
             id: sqlShell.id,
+            providerInstanceId: sqlShell.providerInstanceId,
+            modelSelection: sqlShell.modelSelection,
             status: sqlShell.status,
             lastErrorClass: sqlShell.lastErrorClass,
             usageLimitResetAt: sqlShell.usageLimitResetAt,
@@ -4549,6 +4852,41 @@ it.layer(layerTest)("ProjectionStoreV2", (it) => {
           (row) => row.id === threadId,
         ),
       );
+      const optedInRecovery = {
+        ...recoveryOptions,
+        autoResume: true,
+        autoRedeemCodexResetCreditInstanceIds: [providerInstanceId],
+      };
+      assert.strictEqual(
+        (yield* store.getLimitRecoveryCandidates(optedInRecovery)).find(
+          (row) => row.id === threadId,
+        )?.limitRecovery?.runId,
+        original.id,
+      );
+      const pendingRedemption = {
+        providerInstanceId,
+        redeemedByProviderInstanceId: providerInstanceId,
+        accountFingerprint: "codex-account:test",
+        accountLabel: "test account",
+        idempotencyKey: "attempt:pending",
+        attemptedAt: DateTime.formatIso(now),
+        creditsBefore: 1,
+        outcome: "pending" as const,
+        allowanceCleared: false,
+      };
+      const pendingRecovery = { ...recovery, codexResetRedemption: pendingRedemption };
+      yield* sql`UPDATE orchestration_v2_projection_threads
+        SET payload_json = json_set(payload_json, '$.limitRecovery', json(${encodeUnknownJsonString(pendingRecovery)}))
+        WHERE thread_id = ${threadId}`;
+      assert.strictEqual(
+        (yield* store.getLimitRecoveryCandidates(optedInRecovery)).find(
+          (row) => row.id === threadId,
+        )?.limitRecovery?.codexResetRedemption?.outcome,
+        "pending",
+      );
+      yield* sql`UPDATE orchestration_v2_projection_threads
+        SET payload_json = json_set(payload_json, '$.limitRecovery', json(${encodeUnknownJsonString(recovery)}))
+        WHERE thread_id = ${threadId}`;
       assert.strictEqual(yield* store.getLimitRecoveryWakeAt(now), DateTime.toEpochMillis(reset));
       assert.isNull(yield* store.getLimitRecoveryWakeAt(reset));
       const due = (yield* store.getLimitRecoveryCandidates({
diff --git a/apps/server/src/orchestration-v2/ProjectionStore.ts b/apps/server/src/orchestration-v2/ProjectionStore.ts
index 2e88fdc119081..e07f85b77344f 100644
--- a/apps/server/src/orchestration-v2/ProjectionStore.ts
+++ b/apps/server/src/orchestration-v2/ProjectionStore.ts
@@ -182,7 +182,8 @@ export type ProjectionLimitRecoveryCandidate = Pick<
   | "updatedAt"
   | "limitRecovery"
   | "snoozedUntil"
->;
+> &
+  Pick<OrchestrationV2AppThread, "providerInstanceId" | "modelSelection">;
 
 export type ProjectionThreadPullRequests = Pick<
   OrchestrationV2AppThread,
@@ -506,11 +507,26 @@ export interface ProjectionStoreV2Shape {
     readonly now: DateTime.Utc;
     readonly autoResume: boolean;
     readonly snooze: boolean;
+    readonly autoRedeemCodexResetCreditInstanceIds?: ReadonlyArray<ProviderInstanceId>;
   }) => Effect.Effect<ReadonlyArray<ProjectionLimitRecoveryCandidate>, ProjectionStoreV2Error>;
   /** Epoch ms of the next armed reset or snooze end after `now`, when a waiting thread becomes a candidate. */
   readonly getLimitRecoveryWakeAt: (
     now: DateTime.Utc,
   ) => Effect.Effect<number | null, ProjectionStoreV2Error>;
+  readonly getCodexResetAttempt: (
+    accountFingerprint: string,
+  ) => Effect.Effect<CodexResetAttempt | null, ProjectionStoreV2Error>;
+  readonly claimCodexResetAttempt: (
+    input: CodexResetAttempt,
+    now: DateTime.Utc,
+  ) => Effect.Effect<boolean, ProjectionStoreV2Error>;
+  readonly releaseCodexResetAttempt: (
+    accountFingerprint: string,
+    idempotencyKey: string,
+  ) => Effect.Effect<void, ProjectionStoreV2Error>;
+  readonly updateCodexResetAttempt: (
+    input: CodexResetAttempt,
+  ) => Effect.Effect<void, ProjectionStoreV2Error>;
   readonly getSettlementCandidates: (
     threadId?: ThreadId,
   ) => Effect.Effect<ReadonlyArray<ProjectionSettlementCandidate>, ProjectionStoreV2Error>;
@@ -665,6 +681,17 @@ export interface ProjectionStoreV2Shape {
   >;
 }
 
+export interface CodexResetAttempt {
+  readonly accountFingerprint: string;
+  readonly resetAt: string;
+  readonly idempotencyKey: string;
+  readonly attemptedAt: string;
+  readonly outcome: "pending" | "reset" | "noCredit" | "nothingToReset";
+  readonly allowanceCleared: boolean;
+  readonly checkedAt?: string;
+  readonly nextCheckAt?: string;
+}
+
 type ProjectionWindow = Omit<
   Parameters<ProjectionStoreV2Shape["getThreadSnapshotWindow"]>[1],
   "anchorThreadId"
@@ -3865,7 +3892,19 @@ export const layer: Layer.Layer<ProjectionStoreV2, never, SqlClient.SqlClient> =
                 json_extract(t.payload_json, '$.limitRecovery.runId') IS r.run_id
                 AND json_extract(t.payload_json, '$.limitRecovery.resetAt') IS json_extract(item.payload_json, '$.failure.resetAt')
                 AND json_extract(t.payload_json, '$.limitRecovery.autoResume') = 1
-                AND julianday(json_extract(item.payload_json, '$.failure.resetAt')) <= julianday(${DateTime.formatIso(options.now)})
+                AND (
+                  julianday(json_extract(item.payload_json, '$.failure.resetAt')) <= julianday(${DateTime.formatIso(options.now)})
+                  OR (
+                    t.provider_instance_id IN ${sql.in(options.autoRedeemCodexResetCreditInstanceIds ?? [])}
+                  )
+                  OR (
+                    json_extract(t.payload_json, '$.limitRecovery.codexResetRedemption.outcome') = 'reset'
+                    AND json_extract(t.payload_json, '$.limitRecovery.codexResetRedemption.allowanceCleared') = 1
+                    AND json_extract(t.payload_json, '$.limitRecovery.codexResetRedemption.providerInstanceId') = t.provider_instance_id
+                    AND julianday(json_extract(t.payload_json, '$.limitRecovery.codexResetRedemption.checkedAt')) >
+                      julianday(json_extract(t.payload_json, '$.limitRecovery.codexResetRedemption.attemptedAt'))
+                  )
+                )
                 AND (
                   json_extract(t.payload_json, '$.snoozedUntil') IS NULL
                   OR julianday(json_extract(t.payload_json, '$.snoozedUntil')) <= julianday(${DateTime.formatIso(options.now)})
@@ -3899,6 +3938,8 @@ export const layer: Layer.Layer<ProjectionStoreV2, never, SqlClient.SqlClient> =
           if (summary.lastErrorClass !== "usage_limit") continue;
           candidates.push({
             id: thread.id,
+            providerInstanceId: thread.providerInstanceId,
+            modelSelection: thread.modelSelection,
             status: "failed",
             lastErrorClass: summary.lastErrorClass,
             usageLimitResetAt: summary.usageLimitResetAt,
@@ -3946,6 +3987,89 @@ export const layer: Layer.Layer<ProjectionStoreV2, never, SqlClient.SqlClient> =
       Effect.mapError((cause) => new ProjectionStoreSetupError({ cause })),
     );
 
+    const getCodexResetAttempt = Effect.fn("ProjectionStore.getCodexResetAttempt")(
+      function* (accountFingerprint: string) {
+        const rows = yield* sql<{
+          readonly reset_at: string;
+          readonly idempotency_key: string;
+          readonly attempted_at: string;
+          readonly outcome: CodexResetAttempt["outcome"];
+          readonly allowance_cleared: number;
+          readonly checked_at: string | null;
+          readonly next_check_at: string | null;
+        }>`
+          SELECT reset_at, idempotency_key, attempted_at, outcome, allowance_cleared, checked_at,
+            next_check_at
+          FROM codex_auto_reset_attempts WHERE account_fingerprint = ${accountFingerprint}
+        `;
+        const row = rows[0];
+        return row === undefined
+          ? null
+          : ({
+              accountFingerprint,
+              resetAt: row.reset_at,
+              idempotencyKey: row.idempotency_key,
+              attemptedAt: row.attempted_at,
+              outcome: row.outcome,
+              allowanceCleared: row.allowance_cleared === 1,
+              ...(row.checked_at === null ? {} : { checkedAt: row.checked_at }),
+              ...(row.next_check_at === null ? {} : { nextCheckAt: row.next_check_at }),
+            } satisfies CodexResetAttempt);
+      },
+      Effect.mapError((cause) => new ProjectionStoreSetupError({ cause })),
+    );
+
+    const claimCodexResetAttempt = Effect.fn("ProjectionStore.claimCodexResetAttempt")(
+      function* (input: CodexResetAttempt, now: DateTime.Utc) {
+        const rows = yield* sql<{ readonly account_fingerprint: string }>`
+          INSERT INTO codex_auto_reset_attempts (
+            account_fingerprint, reset_at, idempotency_key, attempted_at, outcome,
+            allowance_cleared, checked_at, next_check_at
+          ) VALUES (
+            ${input.accountFingerprint}, ${input.resetAt}, ${input.idempotencyKey},
+            ${input.attemptedAt}, ${input.outcome}, ${Number(input.allowanceCleared)},
+            ${input.checkedAt ?? null}, ${input.nextCheckAt ?? null}
+          ) ON CONFLICT(account_fingerprint) DO UPDATE SET
+            reset_at = excluded.reset_at, idempotency_key = excluded.idempotency_key,
+            attempted_at = excluded.attempted_at, outcome = excluded.outcome,
+            allowance_cleared = excluded.allowance_cleared, checked_at = excluded.checked_at,
+            next_check_at = excluded.next_check_at
+          WHERE codex_auto_reset_attempts.outcome IN ('noCredit', 'nothingToReset')
+            OR (codex_auto_reset_attempts.outcome = 'reset'
+              AND codex_auto_reset_attempts.allowance_cleared = 1)
+            OR julianday(codex_auto_reset_attempts.reset_at) <= julianday(${DateTime.formatIso(now)})
+          RETURNING account_fingerprint
+        `;
+        return rows.length > 0;
+      },
+      Effect.mapError((cause) => new ProjectionStoreSetupError({ cause })),
+    );
+
+    const releaseCodexResetAttempt = Effect.fn("ProjectionStore.releaseCodexResetAttempt")(
+      function* (accountFingerprint: string, idempotencyKey: string) {
+        yield* sql`
+          DELETE FROM codex_auto_reset_attempts
+          WHERE account_fingerprint = ${accountFingerprint}
+            AND idempotency_key = ${idempotencyKey}
+        `;
+      },
+      Effect.mapError((cause) => new ProjectionStoreSetupError({ cause })),
+    );
+
+    const updateCodexResetAttempt = Effect.fn("ProjectionStore.updateCodexResetAttempt")(
+      function* (input: CodexResetAttempt) {
+        yield* sql`
+          UPDATE codex_auto_reset_attempts SET outcome = ${input.outcome},
+            allowance_cleared = ${Number(input.allowanceCleared)},
+            checked_at = ${input.checkedAt ?? null},
+            next_check_at = ${input.nextCheckAt ?? null}
+          WHERE account_fingerprint = ${input.accountFingerprint}
+            AND idempotency_key = ${input.idempotencyKey}
+        `;
+      },
+      Effect.mapError((cause) => new ProjectionStoreSetupError({ cause })),
+    );
+
     const getRecoveryThreadIds = Effect.fn("ProjectionStore.getRecoveryThreadIds")(
       function* (kind: ProjectionRecoveryKind) {
         const candidates = (() => {
@@ -7040,6 +7164,10 @@ export const layer: Layer.Layer<ProjectionStoreV2, never, SqlClient.SqlClient> =
       getProviderControlContext: readOnReader(getProviderControlContext),
       getLimitRecoveryCandidates: readOnReader(getLimitRecoveryCandidates),
       getLimitRecoveryWakeAt: readOnReader(getLimitRecoveryWakeAt),
+      getCodexResetAttempt,
+      claimCodexResetAttempt,
+      releaseCodexResetAttempt,
+      updateCodexResetAttempt,
       getRecoveryThreadIds: readOnReader(getRecoveryThreadIds),
       getUnreadableThreadIds: readOnReader(getUnreadableThreadIds),
       getThreadSnapshot: readOnReader(getThreadSnapshot),
diff --git a/apps/server/src/orchestration-v2/ProviderTurnControlService.test.ts b/apps/server/src/orchestration-v2/ProviderTurnControlService.test.ts
index 7932a03809c94..b1cf7c8987f15 100644
--- a/apps/server/src/orchestration-v2/ProviderTurnControlService.test.ts
+++ b/apps/server/src/orchestration-v2/ProviderTurnControlService.test.ts
@@ -211,6 +211,10 @@ it.effect(
           apply: () => Effect.void,
           getLimitRecoveryCandidates: () => Effect.die("unused getLimitRecoveryCandidates"),
           getLimitRecoveryWakeAt: () => Effect.die("unused getLimitRecoveryWakeAt"),
+          getCodexResetAttempt: () => Effect.die("unused getCodexResetAttempt"),
+          claimCodexResetAttempt: () => Effect.die("unused claimCodexResetAttempt"),
+          releaseCodexResetAttempt: () => Effect.die("unused releaseCodexResetAttempt"),
+          updateCodexResetAttempt: () => Effect.die("unused updateCodexResetAttempt"),
           getOpenRemoteDelegatedTasks: Effect.die("unused getOpenRemoteDelegatedTasks"),
           getShellSnapshot: () => Effect.die("unused getShellSnapshot"),
           listActiveSubagentThreadIds: () => Effect.die("unused listActiveSubagentThreadIds"),
diff --git a/apps/server/src/orchestration-v2/UsageLimitRecoveryWorker.test.ts b/apps/server/src/orchestration-v2/UsageLimitRecoveryWorker.test.ts
index 430018adcb06a..26b4ff52931cf 100644
--- a/apps/server/src/orchestration-v2/UsageLimitRecoveryWorker.test.ts
+++ b/apps/server/src/orchestration-v2/UsageLimitRecoveryWorker.test.ts
@@ -1,10 +1,18 @@
 import { assert, describe, it } from "@effect/vitest";
-import { RunId, ThreadId, type OrchestrationV2DomainEvent } from "@t3tools/contracts";
+import {
+  ProviderInstanceId,
+  ProviderDriverKind,
+  RunId,
+  ThreadId,
+  type ServerProvider,
+  type OrchestrationV2DomainEvent,
+} from "@t3tools/contracts";
 import * as Clock from "effect/Clock";
 import * as DateTime from "effect/DateTime";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import * as Queue from "effect/Queue";
+import * as Ref from "effect/Ref";
 import * as Stream from "effect/Stream";
 import * as TestClock from "effect/testing/TestClock";
 
@@ -15,6 +23,333 @@ import * as ProjectionStore from "./ProjectionStore.ts";
 import * as ThreadManagement from "./ThreadManagementService.ts";
 import * as UsageLimitRecoveryWorker from "./UsageLimitRecoveryWorker.ts";
 import { limitRecoveryCommand } from "./UsageLimitRecoveryWorker.ts";
+import * as ProviderRegistry from "../provider/ProviderRegistry.ts";
+
+it.effect("backs off a pending account attempt across repeated sweep ticks", () =>
+  Effect.gen(function* () {
+    yield* TestClock.setTime(nowMs);
+    const baseThread = failedThread(0, -5 * HOUR_MS);
+    const attemptedAt = DateTime.formatIso(DateTime.makeUnsafe(nowMs - 10_000));
+    const checkedAt = DateTime.formatIso(DateTime.makeUnsafe(nowMs - 5_000));
+    const thread = {
+      ...baseThread,
+      limitRecovery: {
+        runId: baseThread.latestRunId!,
+        resetAt: baseThread.usageLimitResetAt!,
+        autoResume: true,
+        codexResetRedemption: {
+          providerInstanceId: baseThread.providerInstanceId,
+          redeemedByProviderInstanceId: baseThread.providerInstanceId,
+          accountFingerprint: "codex-account:fingerprint",
+          accountLabel: "test account",
+          idempotencyKey: "attempt:pending",
+          attemptedAt,
+          creditsBefore: 1,
+          outcome: "pending",
+          allowanceCleared: false,
+        },
+      },
+    };
+    const refreshes = yield* Ref.make(0);
+    const queries = yield* Ref.make(0);
+    const provider = {
+      instanceId: baseThread.providerInstanceId,
+      driver: ProviderDriverKind.make("codex"),
+      usageLimits: {
+        credentialFingerprint: "codex-account:fingerprint",
+        checkedAt,
+        windows: [],
+        resetCredits: { availableCount: 1 },
+      },
+    } as unknown as ServerProvider;
+    const layer = Layer.mergeAll(
+      Layer.succeed(ProjectionStore.ProjectionStoreV2, {
+        getLimitRecoveryCandidates: () =>
+          Ref.updateAndGet(queries, (count) => count + 1).pipe(Effect.as([thread])),
+        getLimitRecoveryWakeAt: () => Effect.succeed(nowMs + 5 * HOUR_MS),
+        getCodexResetAttempt: () =>
+          Effect.succeed({
+            accountFingerprint: "codex-account:fingerprint",
+            resetAt: thread.usageLimitResetAt!,
+            idempotencyKey: "attempt:pending",
+            attemptedAt,
+            outcome: "pending",
+            allowanceCleared: false,
+            checkedAt,
+            nextCheckAt: DateTime.formatIso(DateTime.makeUnsafe(nowMs + 55_000)),
+          }),
+      } as never),
+      Layer.mock(ThreadManagement.ThreadManagementService)({}),
+      Layer.mock(Orchestrator.OrchestratorV2)({ streamDomainEvents: Stream.never }),
+      Layer.mock(ServerSettings.ServerSettingsService)({
+        getSettings: Effect.succeed({
+          autoResumeLimitedThreads: true,
+          snoozeLimitedThreads: false,
+          autoRedeemCodexResetCredits: { [baseThread.providerInstanceId]: true },
+        } as never),
+        streamChanges: Stream.never,
+      }),
+      Layer.mock(ProviderRegistry.ProviderRegistry)({
+        getProviders: Effect.succeed([provider]),
+        refreshInstance: () =>
+          Ref.updateAndGet(refreshes, (count) => count + 1).pipe(Effect.as([provider])),
+        supportsAutoRedeemResetCredit: () => Effect.succeed(true),
+      }),
+    );
+    const sweep = yield* UsageLimitRecoveryWorker.makeSweep.pipe(Effect.provide(layer));
+    yield* sweep();
+    yield* TestClock.adjust("5 seconds");
+    yield* sweep();
+    assert.strictEqual(yield* Ref.get(queries), 1);
+    assert.strictEqual(yield* Ref.get(refreshes), 0);
+  }),
+);
+
+it.effect(
+  "releases a first claim after a pre-send probe failure and throttles the next probe",
+  () =>
+    Effect.gen(function* () {
+      yield* TestClock.setTime(nowMs);
+      const base = failedThread(0, -5 * HOUR_MS);
+      const thread = {
+        ...base,
+        limitRecovery: {
+          runId: base.latestRunId!,
+          resetAt: base.usageLimitResetAt!,
+          autoResume: true,
+        },
+      };
+      const fingerprint = "codex-account:probe-failure";
+      const provider = {
+        instanceId: base.providerInstanceId,
+        driver: ProviderDriverKind.make("codex"),
+        usageLimits: {
+          credentialFingerprint: fingerprint,
+          checkedAt: DateTime.formatIso(DateTime.makeUnsafe(nowMs)),
+          windows: [],
+          resetCredits: { availableCount: 1 },
+        },
+      } as unknown as ServerProvider;
+      const ledger = yield* Ref.make<ProjectionStore.CodexResetAttempt | null>(null);
+      const probes = yield* Ref.make(0);
+      const releases = yield* Ref.make(0);
+      const reports = yield* Ref.make<ReadonlyArray<string>>([]);
+      const projections: Partial<ProjectionStore.ProjectionStoreV2["Service"]> = {
+        getLimitRecoveryCandidates: () => Effect.succeed([thread]),
+        getLimitRecoveryWakeAt: () => Effect.succeed(nowMs + 5 * HOUR_MS),
+        getCodexResetAttempt: () => Ref.get(ledger),
+        claimCodexResetAttempt: (input, now) =>
+          Ref.modify(ledger, (current) => {
+            const expired =
+              current !== null && Date.parse(current.resetAt) <= DateTime.toEpochMillis(now);
+            if (current !== null && !expired) return [false, current] as const;
+            return [true, input] as const;
+          }),
+        updateCodexResetAttempt: (input) =>
+          Ref.update(ledger, (current) =>
+            current?.idempotencyKey === input.idempotencyKey ? input : current,
+          ),
+        releaseCodexResetAttempt: (accountFingerprint, idempotencyKey) =>
+          Effect.gen(function* () {
+            const removed = yield* Ref.modify(ledger, (current) => {
+              if (
+                current?.accountFingerprint === accountFingerprint &&
+                current.idempotencyKey === idempotencyKey
+              )
+                return [true, null] as const;
+              return [false, current] as const;
+            });
+            if (removed) yield* Ref.update(releases, (count) => count + 1);
+          }),
+      };
+      const layer = Layer.mergeAll(
+        Layer.succeed(ProjectionStore.ProjectionStoreV2, projections as never),
+        Layer.mock(ThreadManagement.ThreadManagementService)({
+          dispatch: () => Effect.succeed({ sequence: 1, storedEvents: [] }),
+        }),
+        Layer.mock(Orchestrator.OrchestratorV2)({
+          streamDomainEvents: Stream.never,
+          recordCodexResetRedemption: (input) =>
+            Ref.update(reports, (outcomes) => [
+              ...outcomes,
+              input.codexResetRedemption.outcome,
+            ]).pipe(Effect.as(true)),
+        }),
+        Layer.mock(ServerSettings.ServerSettingsService)({
+          getSettings: Effect.succeed({
+            autoResumeLimitedThreads: true,
+            snoozeLimitedThreads: false,
+            autoRedeemCodexResetCredits: { [base.providerInstanceId]: true },
+          } as never),
+          streamChanges: Stream.never,
+        }),
+        Layer.mock(ProviderRegistry.ProviderRegistry)({
+          getProviders: Effect.succeed([provider]),
+          refreshInstance: () => Effect.succeed([provider]),
+          supportsAutoRedeemResetCredit: () => Effect.succeed(true),
+          autoRedeemResetCredit: (input) =>
+            Ref.updateAndGet(probes, (count) => count + 1).pipe(
+              Effect.as({
+                status: "notSent",
+                reason: "probeFailed",
+                accountFingerprint: fingerprint,
+                creditsBefore: 1,
+                idempotencyKey: input.idempotencyKey,
+              } as const),
+            ),
+        }),
+      );
+      const sweep = yield* UsageLimitRecoveryWorker.makeSweep.pipe(Effect.provide(layer));
+      yield* sweep();
+      assert.isNull(yield* Ref.get(ledger));
+      assert.strictEqual(yield* Ref.get(probes), 1);
+      assert.strictEqual(yield* Ref.get(releases), 1);
+      assert.deepEqual(yield* Ref.get(reports), []);
+      yield* TestClock.adjust("5 seconds");
+      yield* sweep();
+      assert.strictEqual(yield* Ref.get(probes), 1);
+      yield* TestClock.adjust("55 seconds");
+      yield* sweep();
+      assert.strictEqual(yield* Ref.get(probes), 2);
+      assert.isNull(yield* Ref.get(ledger));
+    }),
+);
+
+it.effect.each(["pending", "reset"] as const)(
+  "recovers an eligible thread after another thread has a %s account attempt",
+  (outcome) =>
+    Effect.gen(function* () {
+      yield* TestClock.setTime(nowMs);
+      const baseThread = failedThread(0, -5 * HOUR_MS);
+      const instanceId = ProviderInstanceId.make("provider-codex-second-instance");
+      const thread = {
+        ...baseThread,
+        providerInstanceId: instanceId,
+        modelSelection: { ...baseThread.modelSelection, instanceId },
+        limitRecovery: {
+          runId: baseThread.latestRunId!,
+          resetAt: baseThread.usageLimitResetAt!,
+          autoResume: true,
+        },
+      };
+      const fingerprint = "codex-account:shared-login";
+      const attemptedAt = DateTime.formatIso(DateTime.makeUnsafe(nowMs - 120_000));
+      const checkedAt = DateTime.formatIso(DateTime.makeUnsafe(nowMs - 90_000));
+      const previousAttempt = {
+        accountFingerprint: fingerprint,
+        resetAt: DateTime.formatIso(DateTime.makeUnsafe(nowMs + 2 * HOUR_MS)),
+        idempotencyKey: "codex-auto-reset:shared-login:previous-window",
+        attemptedAt,
+        outcome,
+        allowanceCleared: outcome === "reset",
+        checkedAt,
+        ...(outcome === "reset"
+          ? { nextCheckAt: DateTime.formatIso(DateTime.makeUnsafe(nowMs + 60_000)) }
+          : {}),
+      };
+      const previousAttemptRef =
+        yield* Ref.make<ProjectionStore.CodexResetAttempt>(previousAttempt);
+      const stoppedThread = {
+        ...baseThread,
+        id: ThreadId.make("thread:limited-stopped"),
+        latestRunId: RunId.make("run:limited-stopped"),
+        usageLimitResetAt: previousAttempt.resetAt,
+        providerInstanceId: ProviderInstanceId.make("provider-codex-stopped"),
+        limitRecovery: {
+          runId: RunId.make("run:limited-stopped"),
+          resetAt: previousAttempt.resetAt,
+          autoResume: false,
+          codexResetRedemption: {
+            providerInstanceId: ProviderInstanceId.make("provider-codex-stopped"),
+            redeemedByProviderInstanceId: ProviderInstanceId.make("provider-codex-stopped"),
+            accountFingerprint: fingerprint,
+            idempotencyKey: previousAttempt.idempotencyKey,
+            attemptedAt,
+            creditsBefore: 1,
+            outcome: "pending" as const,
+            allowanceCleared: false,
+          },
+        },
+      };
+      const candidates = [stoppedThread, thread].filter(
+        (candidate) => candidate.limitRecovery?.autoResume === true,
+      );
+      const provider = {
+        instanceId,
+        driver: ProviderDriverKind.make("codex"),
+        usageLimits: {
+          credentialFingerprint: fingerprint,
+          checkedAt: DateTime.formatIso(DateTime.makeUnsafe(nowMs)),
+          windows: [],
+          resetCredits: { availableCount: 1 },
+        },
+      } as unknown as ServerProvider;
+      const refreshes = yield* Ref.make(0);
+      const consumes = yield* Ref.make(0);
+      const layer = Layer.mergeAll(
+        Layer.succeed(ProjectionStore.ProjectionStoreV2, {
+          getLimitRecoveryCandidates: () => Effect.succeed(candidates),
+          getLimitRecoveryWakeAt: () => Effect.succeed(nowMs + 5 * HOUR_MS),
+          getCodexResetAttempt: () => Ref.get(previousAttemptRef),
+          claimCodexResetAttempt: (attempt: ProjectionStore.CodexResetAttempt) =>
+            Ref.set(previousAttemptRef, attempt).pipe(Effect.as(true)),
+          updateCodexResetAttempt: (attempt: ProjectionStore.CodexResetAttempt) =>
+            Ref.set(previousAttemptRef, attempt),
+        } as never),
+        Layer.mock(ThreadManagement.ThreadManagementService)({
+          dispatch: () => Effect.succeed({ sequence: 1, storedEvents: [] }),
+        }),
+        Layer.mock(Orchestrator.OrchestratorV2)({
+          streamDomainEvents: Stream.never,
+          recordCodexResetRedemption: () => Effect.succeed(true),
+        }),
+        Layer.mock(ServerSettings.ServerSettingsService)({
+          getSettings: Effect.succeed({
+            autoResumeLimitedThreads: true,
+            snoozeLimitedThreads: false,
+            autoRedeemCodexResetCredits: { [instanceId]: true },
+          } as never),
+          streamChanges: Stream.never,
+        }),
+        Layer.mock(ProviderRegistry.ProviderRegistry)({
+          getProviders: Effect.succeed([provider]),
+          refreshInstance: () =>
+            Ref.updateAndGet(refreshes, (count) => count + 1).pipe(Effect.as([provider])),
+          supportsAutoRedeemResetCredit: () => Effect.succeed(true),
+          autoRedeemResetCredit: (input) =>
+            Ref.updateAndGet(consumes, (count) => count + 1).pipe(
+              Effect.as({
+                status: "sent",
+                accountFingerprint: fingerprint,
+                creditsBefore: 1,
+                outcome: "reset",
+                allowanceCleared: true,
+                idempotencyKey: input.idempotencyKey,
+              } as const),
+            ),
+        }),
+      );
+      const sweep = yield* UsageLimitRecoveryWorker.makeSweep.pipe(Effect.provide(layer));
+      yield* sweep();
+      assert.strictEqual(yield* Ref.get(refreshes), 0);
+      assert.strictEqual(yield* Ref.get(consumes), 1);
+      assert.strictEqual(
+        (yield* Ref.get(previousAttemptRef)).idempotencyKey,
+        outcome === "pending"
+          ? previousAttempt.idempotencyKey
+          : UsageLimitRecoveryWorker.codexAutoResetIdempotencyKey(
+              fingerprint,
+              thread.usageLimitResetAt!,
+            ),
+      );
+
+      // The stopped thread is absent from candidates; a fresh worker relies on the account ledger.
+      const restartedSweep = yield* UsageLimitRecoveryWorker.makeSweep.pipe(Effect.provide(layer));
+      yield* restartedSweep();
+      assert.strictEqual(yield* Ref.get(refreshes), 0);
+      assert.strictEqual(yield* Ref.get(consumes), 1);
+    }),
+);
 
 it.effect("idle sweeps skip SQL until the next wake time or a relevant event", () =>
   Effect.gen(function* () {
@@ -49,6 +384,7 @@ it.effect("idle sweeps skip SQL until the next wake time or a relevant event", (
             } as never),
             streamChanges: Stream.never,
           }),
+          Layer.mock(ProviderRegistry.ProviderRegistry)({}),
         ),
       ),
     );
@@ -77,6 +413,11 @@ const failedThread = (failedAgoMs: number, resetAgoMs: number) => {
   const failedAt = DateTime.makeUnsafe(nowMs - failedAgoMs);
   const candidate: ProjectionStore.ProjectionLimitRecoveryCandidate = {
     id: ThreadId.make("thread:limited"),
+    providerInstanceId: ProviderInstanceId.make("provider-codex"),
+    modelSelection: {
+      instanceId: ProviderInstanceId.make("provider-codex"),
+      model: "gpt-5-codex",
+    },
     status: "failed",
     lastErrorClass: "usage_limit",
     usageLimitResetAt: DateTime.formatIso(DateTime.makeUnsafe(nowMs - resetAgoMs)),
@@ -115,4 +456,138 @@ describe("limitRecoveryCommand arming", () => {
     const thread = failedThread(30 * HOUR_MS, 24 * HOUR_MS + 1);
     assert.isNull(limitRecoveryCommand(thread, true, nowMs));
   });
+
+  it("resumes early only for a confirmed reset on the opted-in account", () => {
+    const base = failedThread(HOUR_MS, -HOUR_MS);
+    const thread = {
+      ...base,
+      limitRecovery: {
+        runId: RunId.make("run:limited"),
+        resetAt: base.usageLimitResetAt!,
+        autoResume: true,
+        snooze: false,
+        codexResetRedemption: {
+          providerInstanceId: base.providerInstanceId,
+          redeemedByProviderInstanceId: base.providerInstanceId,
+          accountFingerprint: "account-fingerprint",
+          idempotencyKey: "retry-key",
+          attemptedAt: DateTime.formatIso(DateTime.makeUnsafe(nowMs - 1_000)),
+          creditsBefore: 1,
+          outcome: "reset" as const,
+          checkedAt: DateTime.formatIso(DateTime.makeUnsafe(nowMs)),
+          allowanceCleared: true,
+        },
+      },
+    };
+
+    assert.equal(
+      limitRecoveryCommand(thread, true, nowMs, false, true, true)?.type,
+      "message.dispatch",
+    );
+    assert.isNull(limitRecoveryCommand(thread, true, nowMs, false, true));
+    assert.isNull(limitRecoveryCommand(thread, true, nowMs, false, false));
+    const redemption = thread.limitRecovery.codexResetRedemption;
+    assert.isNotNull(redemption);
+    for (const outcome of ["pending", "unconfirmed", "noCredit", "nothingToReset"] as const) {
+      assert.isNull(
+        limitRecoveryCommand(
+          {
+            ...thread,
+            limitRecovery: {
+              ...thread.limitRecovery,
+              codexResetRedemption: { ...redemption, outcome },
+            },
+          },
+          true,
+          nowMs,
+          false,
+          true,
+          true,
+        ),
+      );
+    }
+    assert.isNull(
+      limitRecoveryCommand(
+        {
+          ...thread,
+          limitRecovery: {
+            ...thread.limitRecovery,
+            codexResetRedemption: { ...redemption, outcome: "noCredit" },
+          },
+        },
+        true,
+        nowMs,
+        false,
+        true,
+      ),
+    );
+    assert.isNull(
+      limitRecoveryCommand(
+        {
+          ...thread,
+          limitRecovery: {
+            ...thread.limitRecovery,
+            codexResetRedemption: { ...redemption, allowanceCleared: false },
+          },
+        },
+        true,
+        nowMs,
+        false,
+        true,
+      ),
+    );
+    assert.isNull(
+      limitRecoveryCommand(
+        {
+          ...thread,
+          limitRecovery: {
+            ...thread.limitRecovery,
+            codexResetRedemption: { ...redemption, checkedAt: redemption.attemptedAt },
+          },
+        },
+        true,
+        nowMs,
+        false,
+        true,
+        true,
+      ),
+    );
+    assert.isNull(
+      limitRecoveryCommand(
+        {
+          ...thread,
+          limitRecovery: {
+            ...thread.limitRecovery,
+            codexResetRedemption: {
+              ...redemption,
+              providerInstanceId: ProviderInstanceId.make("provider-other"),
+            },
+          },
+        },
+        true,
+        nowMs,
+        false,
+        true,
+        true,
+      ),
+    );
+  });
+
+  it("reuses the same account-window idempotency key across threads and instances", () => {
+    const resetAt = "2026-10-19T13:00:00.000Z";
+    const first = UsageLimitRecoveryWorker.codexAutoResetIdempotencyKey("shared-account", resetAt);
+    const retry = UsageLimitRecoveryWorker.codexAutoResetIdempotencyKey("shared-account", resetAt);
+    assert.strictEqual(first, retry);
+    assert.notStrictEqual(
+      first,
+      UsageLimitRecoveryWorker.codexAutoResetIdempotencyKey("other-account", resetAt),
+    );
+    assert.notStrictEqual(
+      first,
+      UsageLimitRecoveryWorker.codexAutoResetIdempotencyKey(
+        "shared-account",
+        "2026-10-19T14:00:00.000Z",
+      ),
+    );
+  });
 });
diff --git a/apps/server/src/orchestration-v2/UsageLimitRecoveryWorker.ts b/apps/server/src/orchestration-v2/UsageLimitRecoveryWorker.ts
index e46ac34c8be61..3631e7636b2f3 100644
--- a/apps/server/src/orchestration-v2/UsageLimitRecoveryWorker.ts
+++ b/apps/server/src/orchestration-v2/UsageLimitRecoveryWorker.ts
@@ -1,8 +1,15 @@
-import { CommandId, MessageId, type OrchestrationV2Command } from "@t3tools/contracts";
+import {
+  CommandId,
+  MessageId,
+  type OrchestrationV2Command,
+  type OrchestrationV2LimitRecovery,
+  ProviderInstanceId,
+} from "@t3tools/contracts";
 import * as DateTime from "effect/DateTime";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import * as Stream from "effect/Stream";
+import { exhaustedUsageWindow } from "@t3tools/shared/usageLimits";
 import type { OrchestrationV2DomainEvent } from "@t3tools/contracts";
 import * as DueHint from "../scheduling/DueHint.ts";
 import * as Scheduler from "../scheduling/Scheduler.ts";
@@ -11,14 +18,22 @@ import * as ServerSettings from "../serverSettings.ts";
 import * as ProjectionStore from "./ProjectionStore.ts";
 import * as Orchestrator from "./Orchestrator.ts";
 import * as ThreadManagement from "./ThreadManagementService.ts";
+import * as ProviderRegistry from "../provider/ProviderRegistry.ts";
 
 const MAX_OVERDUE_ARM_MS = 24 * 60 * 60 * 1000;
+const AUTO_REDEEM_RETRY_BACKOFF_MS = 60_000;
+
+export function codexAutoResetIdempotencyKey(accountFingerprint: string, resetAt: string) {
+  return `codex-auto-reset:${accountFingerprint}:${resetAt}`;
+}
 
 export function limitRecoveryCommand(
   thread: ProjectionStore.ProjectionLimitRecoveryCandidate,
   autoResume: boolean,
   nowMs: number,
   snooze = false,
+  autoRedeemCodexResetCredit = false,
+  freshAccountMatches = false,
 ): OrchestrationV2Command | null {
   if (
     thread.status !== "failed" ||
@@ -56,11 +71,21 @@ export function limitRecoveryCommand(
   }
   if (
     !recovery.autoResume ||
-    resetMs > nowMs ||
+    (resetMs > nowMs &&
+      (!autoRedeemCodexResetCredit ||
+        !freshAccountMatches ||
+        !(
+          recovery.codexResetRedemption?.outcome === "reset" &&
+          recovery.codexResetRedemption.allowanceCleared === true &&
+          recovery.codexResetRedemption.providerInstanceId === thread.providerInstanceId &&
+          recovery.codexResetRedemption.checkedAt !== undefined &&
+          Date.parse(recovery.codexResetRedemption.checkedAt) >
+            Date.parse(recovery.codexResetRedemption.attemptedAt)
+        ))) ||
     (thread.snoozedUntil != null && DateTime.toEpochMillis(thread.snoozedUntil) > nowMs)
   )
     return null;
-  const deliveryIdentity = `${identity}:${recovery.requestId ?? "legacy"}`;
+  const deliveryIdentity = `${identity}:${recovery.requestId ?? "legacy"}:${resetMs > nowMs ? `credit:${recovery.codexResetRedemption?.idempotencyKey}:${recovery.codexResetRedemption?.checkedAt}` : "natural"}`;
   return {
     type: "message.dispatch",
     commandId: CommandId.make(`limit-resume:${deliveryIdentity}`),
@@ -87,12 +112,14 @@ const affectsLimitRecovery = (event: OrchestrationV2DomainEvent) =>
   event.type.startsWith("provider-session.") ||
   (event.type === "turn-item.updated" && event.payload.type === "error");
 
-const makeSweep = Effect.gen(function* () {
+export const makeSweep = Effect.gen(function* () {
   const projections = yield* ProjectionStore.ProjectionStoreV2;
   const threads = yield* ThreadManagement.ThreadManagementService;
   const orchestrator = yield* Orchestrator.OrchestratorV2;
   const settings = yield* ServerSettings.ServerSettingsService;
+  const providers = yield* ProviderRegistry.ProviderRegistry;
   const due = DueHint.make();
+  const probeNotBefore = new Map<ProviderInstanceId, number>();
   yield* forkParked(
     Stream.runForEach(orchestrator.streamDomainEvents, (event) =>
       affectsLimitRecovery(event) ? due.invalidate : Effect.void,
@@ -109,40 +136,476 @@ const makeSweep = Effect.gen(function* () {
       now,
       autoResume: preferences.autoResumeLimitedThreads,
       snooze: preferences.snoozeLimitedThreads,
+      autoRedeemCodexResetCreditInstanceIds: Object.entries(
+        preferences.autoRedeemCodexResetCredits ?? {},
+      )
+        .filter(([, enabled]) => enabled)
+        .map(([instanceId]) => ProviderInstanceId.make(instanceId)),
     });
     let acted = false;
+    let retryAt: number | undefined;
     for (const thread of candidates) {
       const command = limitRecoveryCommand(
         thread,
         preferences.autoResumeLimitedThreads,
         nowMs,
         preferences.snoozeLimitedThreads,
+        preferences.autoRedeemCodexResetCredits?.[thread.providerInstanceId] === true,
       );
       if (command === null) continue;
-      acted = true;
-      yield* Effect.gen(function* () {
+      const changed = yield* Effect.gen(function* () {
         if (command.type === "thread.metadata.update" && command.limitRecovery != null) {
-          yield* orchestrator.autoArmLimitRecovery({
+          return yield* orchestrator.autoArmLimitRecovery({
             commandId: command.commandId,
             threadId: command.threadId,
             limitRecovery: command.limitRecovery,
           });
-        } else {
-          yield* threads.dispatch(command);
         }
+        yield* threads.dispatch(command);
+        return true;
       }).pipe(
         Effect.catchCause((cause) =>
           Effect.logWarning("orchestration-v2.limit-recovery.dispatch-failed", {
             threadId: thread.id,
             cause,
-          }),
+          }).pipe(Effect.as(false)),
         ),
       );
+      if (changed) acted = true;
+    }
+
+    const limitedForAutoResume = candidates.filter(
+      (thread) =>
+        thread.lastErrorClass === "usage_limit" &&
+        thread.latestRunId !== null &&
+        typeof thread.usageLimitResetAt === "string" &&
+        Date.parse(thread.usageLimitResetAt) > nowMs &&
+        thread.limitRecovery?.runId === thread.latestRunId &&
+        thread.limitRecovery.resetAt === thread.usageLimitResetAt &&
+        thread.limitRecovery.autoResume &&
+        preferences.autoResumeLimitedThreads &&
+        preferences.autoRedeemCodexResetCredits?.[thread.providerInstanceId] === true,
+    );
+    const refreshedInstances = new Map<
+      ProviderInstanceId,
+      ReadonlyArray<import("@t3tools/contracts").ServerProvider>
+    >();
+    const knownProviders = new Map(
+      limitedForAutoResume.length === 0
+        ? []
+        : (yield* providers.getProviders).map((provider) => [provider.instanceId, provider]),
+    );
+    for (const thread of limitedForAutoResume) {
+      if (
+        knownProviders.get(thread.providerInstanceId)?.usageLimits?.credentialFingerprint ||
+        thread.limitRecovery?.codexResetRedemption?.accountFingerprint
+      )
+        continue;
+      const notBefore = probeNotBefore.get(thread.providerInstanceId) ?? 0;
+      if (notBefore > nowMs) {
+        retryAt = Math.min(retryAt ?? Infinity, notBefore);
+        continue;
+      }
+      const snapshots = yield* providers.refreshInstance(thread.providerInstanceId);
+      refreshedInstances.set(thread.providerInstanceId, snapshots);
+      const provider = snapshots.find(
+        (candidate) => candidate.instanceId === thread.providerInstanceId,
+      );
+      if (provider) knownProviders.set(thread.providerInstanceId, provider);
+      probeNotBefore.set(thread.providerInstanceId, nowMs + AUTO_REDEEM_RETRY_BACKOFF_MS);
+      retryAt = Math.min(retryAt ?? Infinity, nowMs + AUTO_REDEEM_RETRY_BACKOFF_MS);
+    }
+    const groups = new Map<string, typeof limitedForAutoResume>();
+    for (const thread of limitedForAutoResume) {
+      if (!(yield* providers.supportsAutoRedeemResetCredit(thread.providerInstanceId))) continue;
+      const fingerprint =
+        knownProviders.get(thread.providerInstanceId)?.usageLimits?.credentialFingerprint ??
+        thread.limitRecovery?.codexResetRedemption?.accountFingerprint;
+      if (!fingerprint) continue;
+      const group = groups.get(fingerprint) ?? [];
+      groups.set(fingerprint, [...group, thread]);
+    }
+
+    for (const [fingerprint, group] of groups) {
+      const attempt = yield* projections.getCodexResetAttempt(fingerprint);
+      const attemptExpired = attempt !== null && Date.parse(attempt.resetAt) <= nowMs;
+      const completedWindow =
+        attempt?.outcome === "reset" &&
+        attempt.allowanceCleared &&
+        group.some((candidate) => candidate.usageLimitResetAt !== attempt.resetAt);
+      if (attempt && !attemptExpired && !completedWindow && attempt.nextCheckAt !== undefined) {
+        const nextCheck = Date.parse(attempt.nextCheckAt);
+        if (nextCheck > nowMs) {
+          retryAt = Math.min(retryAt ?? Infinity, nextCheck);
+          continue;
+        }
+      }
+      const candidatesForGroup = [...group].sort((left, right) => {
+        if (completedWindow) {
+          const priority =
+            Number(right.usageLimitResetAt !== attempt?.resetAt) -
+            Number(left.usageLimitResetAt !== attempt?.resetAt);
+          if (priority !== 0) return priority;
+        }
+        const leftAt = Date.parse(left.limitRecovery?.codexResetRedemption?.attemptedAt ?? "");
+        const rightAt = Date.parse(right.limitRecovery?.codexResetRedemption?.attemptedAt ?? "");
+        return leftAt - rightAt;
+      });
+      const driverThread = candidatesForGroup[0];
+      if (!driverThread) continue;
+      const known = knownProviders.get(driverThread.providerInstanceId);
+      const previousReport = driverThread.limitRecovery?.codexResetRedemption;
+      const row =
+        attemptExpired ||
+        completedWindow ||
+        attempt?.outcome === "noCredit" ||
+        attempt?.outcome === "nothingToReset"
+          ? null
+          : attempt;
+      let driverProvider = known;
+      const notBefore = probeNotBefore.get(driverThread.providerInstanceId) ?? 0;
+      if (notBefore > nowMs) {
+        retryAt = Math.min(retryAt ?? Infinity, notBefore);
+        continue;
+      }
+      if (row?.outcome === "reset") {
+        const nextCheckAt = DateTime.formatIso(
+          DateTime.makeUnsafe(nowMs + AUTO_REDEEM_RETRY_BACKOFF_MS),
+        );
+        probeNotBefore.set(driverThread.providerInstanceId, nowMs + AUTO_REDEEM_RETRY_BACKOFF_MS);
+        yield* projections.updateCodexResetAttempt({ ...row, nextCheckAt });
+        const snapshots = yield* providers.refreshInstance(driverThread.providerInstanceId);
+        refreshedInstances.set(driverThread.providerInstanceId, snapshots);
+        driverProvider = snapshots.find(
+          (candidate) => candidate.instanceId === driverThread.providerInstanceId,
+        );
+      }
+      if (
+        !driverProvider ||
+        driverProvider.driver !== "codex" ||
+        (driverProvider.usageLimits?.credentialFingerprint !== undefined &&
+          driverProvider.usageLimits.credentialFingerprint !== fingerprint)
+      ) {
+        if (row && row.outcome === "reset" && !row.allowanceCleared)
+          yield* projections.updateCodexResetAttempt({
+            ...row,
+            nextCheckAt: DateTime.formatIso(
+              DateTime.makeUnsafe(nowMs + AUTO_REDEEM_RETRY_BACKOFF_MS),
+            ),
+          });
+        retryAt = Math.min(retryAt ?? Infinity, nowMs + AUTO_REDEEM_RETRY_BACKOFF_MS);
+        continue;
+      }
+
+      if (row?.outcome === "reset") {
+        const checkedAt = driverProvider.usageLimits?.checkedAt;
+        const freshAndClear =
+          driverProvider.usageLimits?.credentialFingerprint === fingerprint &&
+          checkedAt !== undefined &&
+          Date.parse(checkedAt) > Date.parse(row.attemptedAt) &&
+          driverProvider.usageLimits?.unavailable === undefined &&
+          exhaustedUsageWindow(driverProvider, nowMs, driverThread.modelSelection.model) ===
+            undefined;
+        const allowanceCleared = freshAndClear;
+        yield* projections.updateCodexResetAttempt({
+          ...row,
+          allowanceCleared,
+          ...(checkedAt === undefined ? {} : { checkedAt }),
+          nextCheckAt: DateTime.formatIso(
+            DateTime.makeUnsafe(nowMs + AUTO_REDEEM_RETRY_BACKOFF_MS),
+          ),
+        });
+        for (const candidate of candidatesForGroup) {
+          const report = {
+            providerInstanceId: candidate.providerInstanceId,
+            redeemedByProviderInstanceId:
+              previousReport?.redeemedByProviderInstanceId ?? driverThread.providerInstanceId,
+            accountFingerprint: fingerprint,
+            accountLabel:
+              driverProvider.auth?.email ?? driverProvider.displayName ?? "Codex account",
+            idempotencyKey: row.idempotencyKey,
+            attemptedAt: row.attemptedAt,
+            creditsBefore: previousReport?.creditsBefore ?? 1,
+            outcome: "reset" as const,
+            ...(checkedAt === undefined ? {} : { checkedAt }),
+            allowanceCleared:
+              allowanceCleared && candidate.providerInstanceId === driverThread.providerInstanceId,
+          };
+          const saved = yield* orchestrator.recordCodexResetRedemption({
+            commandId: CommandId.make(`limit-credit-view:${candidate.id}:${candidate.latestRunId}`),
+            threadId: candidate.id,
+            runId: candidate.latestRunId!,
+            resetAt: candidate.usageLimitResetAt!,
+            codexResetRedemption: report,
+          });
+          if (saved) acted = true;
+          if (freshAndClear && candidate.providerInstanceId === driverThread.providerInstanceId) {
+            const command = limitRecoveryCommand(
+              {
+                ...candidate,
+                limitRecovery: { ...candidate.limitRecovery!, codexResetRedemption: report },
+              },
+              preferences.autoResumeLimitedThreads,
+              nowMs,
+              preferences.snoozeLimitedThreads,
+              true,
+              true,
+            );
+            if (command?.type === "message.dispatch") {
+              yield* threads.dispatch(command);
+              acted = true;
+            }
+          }
+        }
+        retryAt = Math.min(retryAt ?? Infinity, nowMs + AUTO_REDEEM_RETRY_BACKOFF_MS);
+        continue;
+      }
+
+      const attemptedAt = row?.attemptedAt ?? DateTime.formatIso(now);
+      const idempotencyKey =
+        row?.idempotencyKey ??
+        codexAutoResetIdempotencyKey(fingerprint, driverThread.usageLimitResetAt!);
+      const pendingReport = {
+        providerInstanceId: driverThread.providerInstanceId,
+        redeemedByProviderInstanceId: row
+          ? (previousReport?.redeemedByProviderInstanceId ?? driverThread.providerInstanceId)
+          : driverThread.providerInstanceId,
+        accountFingerprint: fingerprint,
+        accountLabel:
+          driverProvider?.auth?.email ??
+          driverProvider?.displayName ??
+          previousReport?.accountLabel ??
+          "Codex account",
+        idempotencyKey,
+        attemptedAt,
+        creditsBefore: row
+          ? (previousReport?.creditsBefore ?? 0)
+          : (driverProvider?.usageLimits?.resetCredits?.availableCount ?? 0),
+        outcome: "pending" as const,
+      } satisfies NonNullable<OrchestrationV2LimitRecovery["codexResetRedemption"]>;
+      let activeRow = row;
+      if (activeRow === null) {
+        activeRow = {
+          accountFingerprint: fingerprint,
+          resetAt: driverThread.usageLimitResetAt!,
+          idempotencyKey,
+          attemptedAt,
+          outcome: "pending",
+          allowanceCleared: false,
+          nextCheckAt: DateTime.formatIso(
+            DateTime.makeUnsafe(nowMs + AUTO_REDEEM_RETRY_BACKOFF_MS),
+          ),
+        };
+        if (!(yield* projections.claimCodexResetAttempt(activeRow, now))) continue;
+      } else {
+        activeRow = {
+          ...activeRow,
+          nextCheckAt: DateTime.formatIso(
+            DateTime.makeUnsafe(nowMs + AUTO_REDEEM_RETRY_BACKOFF_MS),
+          ),
+        };
+        yield* projections.updateCodexResetAttempt(activeRow);
+      }
+      const mode = row?.outcome === "pending" ? "replay" : "first";
+      probeNotBefore.set(driverThread.providerInstanceId, nowMs + AUTO_REDEEM_RETRY_BACKOFF_MS);
+      const result = yield* providers
+        .autoRedeemResetCredit({
+          instanceId: driverThread.providerInstanceId,
+          model: driverThread.modelSelection.model,
+          idempotencyKey,
+          expectedAccountFingerprint: fingerprint,
+          mode,
+          stillArmed: Effect.fn("UsageLimitRecoveryWorker.stillArmed")(function* () {
+            return yield* Effect.catchCause(
+              Effect.gen(function* () {
+                const currentPreferences = yield* settings.getSettings;
+                if (
+                  !currentPreferences.autoResumeLimitedThreads ||
+                  currentPreferences.autoRedeemCodexResetCredits[
+                    driverThread.providerInstanceId
+                  ] !== true
+                )
+                  return false;
+                return yield* orchestrator.recordCodexResetRedemption({
+                  commandId: CommandId.make(
+                    `limit-credit-final-check:${driverThread.id}:${driverThread.latestRunId}`,
+                  ),
+                  threadId: driverThread.id,
+                  runId: driverThread.latestRunId!,
+                  resetAt: driverThread.usageLimitResetAt!,
+                  codexResetRedemption: pendingReport,
+                });
+              }),
+              () => Effect.succeed(false),
+            );
+          }),
+        })
+        .pipe(
+          Effect.catchCause((cause) =>
+            Effect.logWarning("orchestration-v2.codex-reset-redemption-failed", {
+              threadId: driverThread.id,
+              providerInstanceId: driverThread.providerInstanceId,
+              accountFingerprint: fingerprint,
+              cause,
+            }).pipe(Effect.as(null)),
+          ),
+        );
+      const nextCheckAt = DateTime.formatIso(
+        DateTime.makeUnsafe(nowMs + AUTO_REDEEM_RETRY_BACKOFF_MS),
+      );
+      if (result === null) {
+        if (mode === "first")
+          yield* projections.releaseCodexResetAttempt(fingerprint, idempotencyKey);
+        else yield* projections.updateCodexResetAttempt({ ...activeRow, nextCheckAt });
+        retryAt = Math.min(retryAt ?? Infinity, nowMs + AUTO_REDEEM_RETRY_BACKOFF_MS);
+        continue;
+      }
+      if (result.status === "notSent") {
+        if (mode === "first") {
+          yield* projections.releaseCodexResetAttempt(fingerprint, idempotencyKey);
+          if (result.reason === "notExhausted" || result.reason === "noCredit") {
+            const outcome = result.reason === "noCredit" ? "noCredit" : "nothingToReset";
+            const report = { ...pendingReport, outcome, allowanceCleared: false } as const;
+            yield* orchestrator.recordCodexResetRedemption({
+              commandId: CommandId.make(
+                `limit-credit-not-sent:${driverThread.id}:${driverThread.latestRunId}`,
+              ),
+              threadId: driverThread.id,
+              runId: driverThread.latestRunId!,
+              resetAt: driverThread.usageLimitResetAt!,
+              codexResetRedemption: report,
+            });
+          } else if (result.reason === "declined") {
+            yield* orchestrator.recordCodexResetRedemption({
+              commandId: CommandId.make(
+                `limit-credit-declined:${driverThread.id}:${driverThread.latestRunId}`,
+              ),
+              threadId: driverThread.id,
+              runId: driverThread.latestRunId!,
+              resetAt: driverThread.usageLimitResetAt!,
+              codexResetRedemption: { ...pendingReport, outcome: "declined" },
+            });
+          }
+        } else {
+          yield* projections.updateCodexResetAttempt({ ...activeRow, nextCheckAt });
+          if (result.reason === "declined")
+            yield* orchestrator.recordCodexResetRedemption({
+              commandId: CommandId.make(
+                `limit-credit-declined:${driverThread.id}:${driverThread.latestRunId}`,
+              ),
+              threadId: driverThread.id,
+              runId: driverThread.latestRunId!,
+              resetAt: driverThread.usageLimitResetAt!,
+              codexResetRedemption: { ...pendingReport, outcome: "declined" },
+            });
+        }
+        retryAt = Math.min(retryAt ?? Infinity, nowMs + AUTO_REDEEM_RETRY_BACKOFF_MS);
+        continue;
+      }
+      if (result.status === "sentUnknown") {
+        yield* projections.updateCodexResetAttempt({ ...activeRow, nextCheckAt });
+        retryAt = Math.min(retryAt ?? Infinity, nowMs + AUTO_REDEEM_RETRY_BACKOFF_MS);
+        continue;
+      }
+      const outcome =
+        result.outcome === "reset" || result.outcome === "alreadyRedeemed"
+          ? "reset"
+          : result.outcome === "noCredit"
+            ? "noCredit"
+            : "nothingToReset";
+      const confirmed =
+        outcome === "reset" && result.allowanceCleared && result.checkedAt !== undefined;
+      const report = {
+        ...pendingReport,
+        outcome,
+        ...(result.checkedAt === undefined ? {} : { checkedAt: result.checkedAt }),
+        allowanceCleared: confirmed,
+      } as const;
+      const accountResult: ProjectionStore.CodexResetAttempt = {
+        ...activeRow,
+        outcome,
+        allowanceCleared: confirmed,
+        ...(result.checkedAt === undefined ? {} : { checkedAt: result.checkedAt }),
+        nextCheckAt,
+      };
+      yield* projections.updateCodexResetAttempt(accountResult);
+      for (const candidate of candidatesForGroup) {
+        let candidateProvider = knownProviders.get(candidate.providerInstanceId);
+        if (candidate.providerInstanceId === driverThread.providerInstanceId) {
+          candidateProvider = driverProvider;
+        } else if (outcome === "reset") {
+          const candidateNotBefore = probeNotBefore.get(candidate.providerInstanceId) ?? 0;
+          if (candidateNotBefore <= nowMs) {
+            probeNotBefore.set(candidate.providerInstanceId, nowMs + AUTO_REDEEM_RETRY_BACKOFF_MS);
+            const snapshots = yield* providers
+              .refreshInstance(candidate.providerInstanceId)
+              .pipe(Effect.catchCause(() => Effect.succeed([])));
+            refreshedInstances.set(candidate.providerInstanceId, snapshots);
+            candidateProvider = snapshots.find(
+              (provider) => provider.instanceId === candidate.providerInstanceId,
+            );
+          } else {
+            retryAt = Math.min(retryAt ?? Infinity, candidateNotBefore);
+          }
+        }
+        const limits = candidateProvider?.usageLimits;
+        const candidateClear =
+          outcome === "reset" &&
+          ((candidate.providerInstanceId === driverThread.providerInstanceId &&
+            candidate.modelSelection.model === driverThread.modelSelection.model &&
+            result.allowanceCleared &&
+            result.checkedAt !== undefined) ||
+            (limits?.credentialFingerprint === fingerprint &&
+              candidate.providerInstanceId !== driverThread.providerInstanceId &&
+              limits.checkedAt !== undefined &&
+              Date.parse(limits.checkedAt) > Date.parse(attemptedAt) &&
+              limits.unavailable === undefined &&
+              candidateProvider !== undefined &&
+              exhaustedUsageWindow(candidateProvider, nowMs, candidate.modelSelection.model) ===
+                undefined));
+        const sharedReport = {
+          ...report,
+          providerInstanceId: candidate.providerInstanceId,
+          redeemedByProviderInstanceId: driverThread.providerInstanceId,
+          accountLabel:
+            candidateProvider?.auth?.email ?? candidateProvider?.displayName ?? report.accountLabel,
+          ...(candidateClear && limits?.checkedAt !== undefined
+            ? { checkedAt: limits.checkedAt }
+            : {}),
+          allowanceCleared: candidateClear,
+        } as const;
+        const saved = yield* orchestrator.recordCodexResetRedemption({
+          commandId: CommandId.make(`limit-credit-result:${candidate.id}:${candidate.latestRunId}`),
+          threadId: candidate.id,
+          runId: candidate.latestRunId!,
+          resetAt: candidate.usageLimitResetAt!,
+          codexResetRedemption: sharedReport,
+        });
+        if (saved) acted = true;
+        if (candidateClear) {
+          const command = limitRecoveryCommand(
+            {
+              ...candidate,
+              limitRecovery: { ...candidate.limitRecovery!, codexResetRedemption: sharedReport },
+            },
+            preferences.autoResumeLimitedThreads,
+            nowMs,
+            preferences.snoozeLimitedThreads,
+            true,
+            true,
+          );
+          if (command?.type === "message.dispatch") {
+            yield* threads.dispatch(command);
+            acted = true;
+          }
+        }
+      }
+      retryAt = Math.min(retryAt ?? Infinity, nowMs + AUTO_REDEEM_RETRY_BACKOFF_MS);
     }
     // A sweep that acted, or failed to, re-checks on the next tick.
     if (acted) return;
     const wakeAt = yield* projections.getLimitRecoveryWakeAt(now);
-    yield* due.record(readVersion, wakeAt ?? Infinity, nowMs);
+    yield* due.record(readVersion, Math.min(wakeAt ?? Infinity, retryAt ?? Infinity), nowMs);
   });
 });
 
diff --git a/apps/server/src/orchestration-v2/runtimeLayer.test.ts b/apps/server/src/orchestration-v2/runtimeLayer.test.ts
index 7b4a24219b2c1..8c88e9dfd9abd 100644
--- a/apps/server/src/orchestration-v2/runtimeLayer.test.ts
+++ b/apps/server/src/orchestration-v2/runtimeLayer.test.ts
@@ -286,7 +286,7 @@ const layerTest = Layer.mergeAll(
   Layer.provide(SqlitePersistence.layerMemory),
   Layer.provide(layerCheckpointStoreTest),
   Layer.provide(layerServerConfig),
-  Layer.provide(ServerSettings.layerTest()),
+  Layer.provideMerge(ServerSettings.layerTest()),
   Layer.provide(layerTestProviderInstanceRegistry),
   Layer.provide(layerGitWorkflowTest),
   Layer.provide(layerProjectServiceTest),
@@ -7719,6 +7719,11 @@ it.layer(layerTest)("usage-limit recovery", (it) => {
     "independent-patches",
     "expired-snooze",
     "wake",
+    "codex-reset-confirmed",
+    "codex-reset-natural-after-rejected-early",
+    "codex-reset-stop-before-redemption",
+    "codex-reset-stop-during-consume",
+    "codex-reset-stop-after-confirmation",
     "stop",
     "stop-before-arm",
     "stop-before-arm-mismatched-recovery",
@@ -7936,6 +7941,186 @@ it.layer(layerTest)("usage-limit recovery", (it) => {
       let armedShell = (yield* orchestrator.getShellSnapshot()).threads.find(
         (thread) => thread.id === threadId,
       )!;
+      if (scenario === "codex-reset-stop-before-redemption") {
+        const serverSettings = yield* ServerSettings.ServerSettingsService;
+        yield* serverSettings.updateSettings({
+          autoResumeLimitedThreads: true,
+          autoRedeemCodexResetCredits: { [modelSelection.instanceId]: true },
+        });
+        yield* orchestrator.dispatch({
+          type: "thread.stop",
+          commandId: CommandId.make(`recovery:stop-before-credit:${scenario}`),
+          threadId,
+        });
+        assert.isFalse(
+          yield* orchestrator.recordCodexResetRedemption({
+            commandId: CommandId.make(`recovery:codex-reset:${scenario}`),
+            threadId,
+            runId: run.id,
+            resetAt,
+            codexResetRedemption: {
+              providerInstanceId: modelSelection.instanceId,
+              redeemedByProviderInstanceId: modelSelection.instanceId,
+              accountFingerprint: "codex-account-fingerprint",
+              idempotencyKey: `codex-reset:${scenario}`,
+              attemptedAt: DateTime.formatIso(now),
+              creditsBefore: 1,
+              outcome: "pending",
+            },
+          }),
+        );
+        const stopped = yield* orchestrator.getThreadProjection(threadId);
+        assert.isFalse(stopped.thread.limitRecovery?.autoResume);
+        assert.isUndefined(stopped.thread.limitRecovery?.codexResetRedemption);
+        assert.lengthOf(stopped.runs, 1);
+        return;
+      }
+      if (scenario === "codex-reset-stop-during-consume") {
+        const serverSettings = yield* ServerSettings.ServerSettingsService;
+        yield* serverSettings.updateSettings({
+          autoResumeLimitedThreads: true,
+          autoRedeemCodexResetCredits: { [modelSelection.instanceId]: true },
+        });
+        yield* orchestrator.dispatch({
+          type: "thread.stop",
+          commandId: CommandId.make(`recovery:stop-during-credit:${scenario}`),
+          threadId,
+        });
+        yield* serverSettings.updateSettings({
+          autoResumeLimitedThreads: false,
+          autoRedeemCodexResetCredits: { [modelSelection.instanceId]: false },
+        });
+        const redemption = {
+          providerInstanceId: modelSelection.instanceId,
+          redeemedByProviderInstanceId: modelSelection.instanceId,
+          accountFingerprint: "codex-account-fingerprint",
+          accountLabel: "Codex account",
+          idempotencyKey: `codex-reset:${scenario}`,
+          attemptedAt: DateTime.formatIso(DateTime.add(now, { seconds: -1 })),
+          creditsBefore: 1,
+          outcome: "reset" as const,
+          checkedAt: DateTime.formatIso(now),
+          allowanceCleared: true,
+        };
+        assert.isTrue(
+          yield* orchestrator.recordCodexResetRedemption({
+            commandId: CommandId.make(`recovery:codex-reset:${scenario}`),
+            threadId,
+            runId: run.id,
+            resetAt,
+            codexResetRedemption: redemption,
+          }),
+        );
+        const stopped = yield* orchestrator.getThreadProjection(threadId);
+        assert.isFalse(stopped.thread.limitRecovery?.autoResume);
+        assert.deepEqual(stopped.thread.limitRecovery?.codexResetRedemption, redemption);
+        return;
+      }
+      if (
+        scenario === "codex-reset-confirmed" ||
+        scenario === "codex-reset-natural-after-rejected-early" ||
+        scenario === "codex-reset-stop-after-confirmation"
+      ) {
+        const serverSettings = yield* ServerSettings.ServerSettingsService;
+        yield* serverSettings.updateSettings({
+          autoResumeLimitedThreads: true,
+          autoRedeemCodexResetCredits: { [modelSelection.instanceId]: true },
+        });
+        const redemption = {
+          providerInstanceId: modelSelection.instanceId,
+          redeemedByProviderInstanceId: modelSelection.instanceId,
+          accountFingerprint: "codex-account-fingerprint",
+          accountLabel: "Codex account",
+          idempotencyKey: `codex-reset:${scenario}`,
+          attemptedAt: DateTime.formatIso(DateTime.add(now, { seconds: -1 })),
+          creditsBefore: 1,
+          outcome: "reset" as const,
+          checkedAt: DateTime.formatIso(now),
+          allowanceCleared: false,
+        };
+        assert.isTrue(
+          yield* orchestrator.recordCodexResetRedemption({
+            commandId: CommandId.make(`recovery:codex-reset-pending:${scenario}`),
+            threadId,
+            runId: run.id,
+            resetAt,
+            codexResetRedemption: redemption,
+          }),
+        );
+        armedShell = (yield* orchestrator.getShellSnapshot()).threads.find(
+          (thread) => thread.id === threadId,
+        )!;
+        assert.equal(armedShell.limitRecovery?.requestId, armCommand.commandId);
+        const confirmedRedemption = { ...redemption, allowanceCleared: true };
+        if (scenario === "codex-reset-natural-after-rejected-early") {
+          const rejected = limitRecoveryCommand(
+            {
+              ...armedShell,
+              limitRecovery: {
+                ...armedShell.limitRecovery!,
+                codexResetRedemption: confirmedRedemption,
+              },
+            },
+            true,
+            DateTime.toEpochMillis(now),
+            false,
+            true,
+            true,
+          );
+          assert.isNotNull(rejected);
+          yield* orchestrator.dispatch(rejected!);
+          assert.lengthOf((yield* orchestrator.getThreadProjection(threadId)).runs, 1);
+          yield* TestClock.adjust("1 minute");
+          assert.isAtLeast(DateTime.toEpochMillis(yield* DateTime.now), Date.parse(resetAt));
+          const natural = limitRecoveryCommand(armedShell, true, Date.parse(resetAt) + 1);
+          assert.isNotNull(natural);
+          assert.notEqual(natural?.commandId, rejected?.commandId);
+          yield* orchestrator.dispatch(natural!);
+          assert.lengthOf((yield* orchestrator.getThreadProjection(threadId)).runs, 2);
+          return;
+        }
+        assert.isTrue(
+          yield* orchestrator.recordCodexResetRedemption({
+            commandId: CommandId.make(`recovery:codex-reset-pending:${scenario}`),
+            threadId,
+            runId: run.id,
+            resetAt,
+            codexResetRedemption: confirmedRedemption,
+          }),
+        );
+        assert.deepEqual(
+          (yield* orchestrator.getThreadProjection(threadId)).thread.limitRecovery
+            ?.codexResetRedemption,
+          confirmedRedemption,
+        );
+        armedShell = (yield* orchestrator.getShellSnapshot()).threads.find(
+          (thread) => thread.id === threadId,
+        )!;
+        const earlyResume = limitRecoveryCommand(
+          armedShell,
+          true,
+          DateTime.toEpochMillis(now),
+          false,
+          true,
+          true,
+        );
+        assert.equal(earlyResume?.type, "message.dispatch");
+        if (scenario === "codex-reset-stop-after-confirmation") {
+          yield* orchestrator.dispatch({
+            type: "thread.stop",
+            commandId: CommandId.make(`recovery:stop-after-credit:${scenario}`),
+            threadId,
+          });
+          const stopped = yield* orchestrator.getThreadProjection(threadId);
+          assert.isFalse(stopped.thread.limitRecovery?.autoResume);
+          yield* orchestrator.dispatch(earlyResume!);
+          assert.lengthOf((yield* orchestrator.getThreadProjection(threadId)).runs, 1);
+        } else {
+          yield* orchestrator.dispatch(earlyResume!);
+          assert.lengthOf((yield* orchestrator.getThreadProjection(threadId)).runs, 2);
+        }
+        return;
+      }
       assert.deepEqual(armedShell.limitRecovery, {
         runId: run.id,
         resetAt,
diff --git a/apps/server/src/orchestration-v2/runtimeLayer.ts b/apps/server/src/orchestration-v2/runtimeLayer.ts
index 1b54627595372..7de80df45fc1d 100644
--- a/apps/server/src/orchestration-v2/runtimeLayer.ts
+++ b/apps/server/src/orchestration-v2/runtimeLayer.ts
@@ -379,7 +379,7 @@ export const layerProduction = Layer.mergeAll(
     Layer.provide(Layer.merge(layerOrchestratorProvided, layerCommandOutputHubProvided)),
   ),
   UsageLimitRecoveryWorker.layer.pipe(
-    Layer.provide(
+    Layer.provideMerge(
       Layer.mergeAll(
         ProjectionStore.layer,
         layerThreadManagementProvided,
diff --git a/apps/server/src/persistence/Migrations.ts b/apps/server/src/persistence/Migrations.ts
index e13c2b449d9e7..9a921d731fcd4 100644
--- a/apps/server/src/persistence/Migrations.ts
+++ b/apps/server/src/persistence/Migrations.ts
@@ -79,6 +79,7 @@ import Migration0073 from "./Migrations/073_ActiveTurnItemIndexes.ts";
 import Migration0074 from "./Migrations/074_ExcludeAttachmentPlaceholdersFromSearch.ts";
 import Migration0075 from "./Migrations/075_SubagentDeliveryState.ts";
 import Migration0076 from "./Migrations/076_ProjectionProjectsPinArchive.ts";
+import Migration0077 from "./Migrations/077_CodexAutoResetAttempts.ts";
 
 const migrationEntries = [
   [1, "OrchestrationEvents", Migration0001],
@@ -158,6 +159,7 @@ const migrationEntries = [
   [74, "ExcludeAttachmentPlaceholdersFromSearch", Migration0074],
   [75, "SubagentDeliveryState", Migration0075],
   [76, "ProjectionProjectsPinArchive", Migration0076],
+  [77, "CodexAutoResetAttempts", Migration0077],
 ] as const;
 
 export const migrationManifest = migrationEntries.map(([id, name]) => [id, name] as const);
diff --git a/apps/server/src/persistence/Migrations/077_CodexAutoResetAttempts.ts b/apps/server/src/persistence/Migrations/077_CodexAutoResetAttempts.ts
new file mode 100644
index 0000000000000..7db8f1e6d8fd9
--- /dev/null
+++ b/apps/server/src/persistence/Migrations/077_CodexAutoResetAttempts.ts
@@ -0,0 +1,18 @@
+import * as Effect from "effect/Effect";
+import * as SqlClient from "effect/sql/SqlClient";
+
+export default Effect.gen(function* () {
+  const sql = yield* SqlClient.SqlClient;
+  yield* sql`
+    CREATE TABLE codex_auto_reset_attempts (
+      account_fingerprint TEXT PRIMARY KEY,
+      reset_at TEXT NOT NULL,
+      idempotency_key TEXT NOT NULL,
+      attempted_at TEXT NOT NULL,
+      outcome TEXT NOT NULL,
+      allowance_cleared INTEGER NOT NULL DEFAULT 0,
+      checked_at TEXT,
+      next_check_at TEXT
+    )
+  `;
+});
diff --git a/apps/server/src/provider/CodexProvider.ts b/apps/server/src/provider/CodexProvider.ts
index ed9e3d0cde684..4edd50bf56d5a 100644
--- a/apps/server/src/provider/CodexProvider.ts
+++ b/apps/server/src/provider/CodexProvider.ts
@@ -11,6 +11,8 @@ import * as Schema from "effect/Schema";
 import * as Schedule from "effect/Schedule";
 import * as Scope from "effect/Scope";
 import * as Types from "effect/Types";
+import * as Crypto from "effect/Crypto";
+import * as Hex from "effect/encoding/Hex";
 import * as ChildProcess from "effect/process/ChildProcess";
 import * as ChildProcessSpawner from "effect/process/ChildProcessSpawner";
 import * as CodexClient from "effect-codex-app-server/client";
@@ -752,7 +754,7 @@ export const checkCodexProviderStatus = Effect.fn("checkCodexProviderStatus")(fu
 ): Effect.fn.Return<
   ServerProviderDraft,
   ServerSettingsError,
-  ChildProcessSpawner.ChildProcessSpawner | FileSystem.FileSystem | Path.Path
+  ChildProcessSpawner.ChildProcessSpawner | FileSystem.FileSystem | Path.Path | Crypto.Crypto
 > {
   const resolvedEnvironment = environment ?? process.env;
   const checkedAt = DateTime.formatIso(yield* DateTime.now);
@@ -839,6 +841,15 @@ export const checkCodexProviderStatus = Effect.fn("checkCodexProviderStatus")(fu
   }
 
   const snapshot = probeResult.success.value;
+  const accountId =
+    snapshot.rateLimits && "snapshot" in snapshot.rateLimits
+      ? snapshot.rateLimits.accountId?.trim()
+      : undefined;
+  const credentialFingerprint = accountId
+    ? yield* (yield* Crypto.Crypto)
+        .digest("SHA-256", new TextEncoder().encode(`codex-account\0${accountId}`))
+        .pipe(Effect.map(Hex.encode), Effect.orDie)
+    : undefined;
   const accountStatus = managedAuth
     ? { status: "ready" as const, auth: managedAuth, message: undefined }
     : accountProbeStatus(snapshot);
@@ -856,6 +867,7 @@ export const checkCodexProviderStatus = Effect.fn("checkCodexProviderStatus")(fu
             snapshot: snapshot.rateLimits.snapshot,
             rateLimitsByLimitId: snapshot.rateLimits.rateLimitsByLimitId,
             resetCredits: snapshot.rateLimits.resetCredits,
+            ...(credentialFingerprint === undefined ? {} : { credentialFingerprint }),
             checkedAt,
           });
 
diff --git a/apps/server/src/provider/Drivers/CodexDriver.ts b/apps/server/src/provider/Drivers/CodexDriver.ts
index 97ec4954ed840..c197bed95f588 100644
--- a/apps/server/src/provider/Drivers/CodexDriver.ts
+++ b/apps/server/src/provider/Drivers/CodexDriver.ts
@@ -1,5 +1,7 @@
 import { CodexSettings, ProviderDriverKind } from "@t3tools/contracts";
 import * as Crypto from "effect/Crypto";
+import * as DateTime from "effect/DateTime";
+import * as Result from "effect/Result";
 import * as Effect from "effect/Effect";
 import * as FileSystem from "effect/FileSystem";
 import * as Path from "effect/Path";
@@ -30,9 +32,15 @@ import { resolveCodexLaunchArgs } from "../codexLaunchArgs.ts";
 import { makeManagedServerProvider } from "@t3tools/provider-core/server/managedProvider";
 import * as ModelCatalog from "@t3tools/provider-core/server/ModelCatalog";
 import { applyCodexModelCatalog } from "../codexModelCatalog.ts";
-import type { ProviderDriver, ProviderInstance } from "@t3tools/provider-core/server/driver";
+import type {
+  ProviderAutoResetCreditResult,
+  ProviderDriver,
+  ProviderInstance,
+} from "@t3tools/provider-core/server/driver";
 import { withInstanceIdentity } from "@t3tools/provider-core/server/instanceIdentity";
 import { mergeProviderInstanceEnvironment } from "@t3tools/provider-core/server/instanceEnvironment";
+import { exhaustedUsageWindow } from "@t3tools/shared/usageLimits";
+import { canAutoRedeemCodexReset, confirmsCodexResetCredit } from "../codexUsageLimits.ts";
 import {
   enrichProviderSnapshotWithVersionAdvisory,
   makeCachedProviderMaintenanceResolution,
@@ -142,6 +150,7 @@ export const CodexDriver: ProviderDriver<
         config,
       });
     const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+    const crypto = yield* Crypto.Crypto;
     const resetCreditCoordinator = yield* ResetCreditCoordinator.ResetCreditCoordinator;
     const fileSystem = yield* FileSystem.FileSystem;
     const pathService = yield* Path.Path;
@@ -230,6 +239,7 @@ export const CodexDriver: ProviderDriver<
       Effect.provideService(ChildProcessSpawner.ChildProcessSpawner, spawner),
       Effect.provideService(FileSystem.FileSystem, fileSystem),
       Effect.provideService(Path.Path, pathService),
+      Effect.provideService(Crypto.Crypto, crypto),
     );
     const snapshotSettings = yield* makeProviderSnapshotSettingsSource(effectiveConfig);
     const snapshot = yield* makeManagedServerProvider<ProviderSnapshotSettings<CodexSettings>>({
@@ -300,29 +310,179 @@ export const CodexDriver: ProviderDriver<
             ),
           );
 
-    // Redemption spends account credit; serialize by the auth.json directory, keep one idempotency key
-    // until the outcome, and bound the wait so a hung app-server cannot hold the account lock.
     // Auth overlays use effectiveHomePath; the continuation key would conflate them with shared homes.
-    const accountKey = homeLayout.effectiveHomePath ?? homeLayout.sharedHomePath;
-    const consumeResetCredit: NonNullable<ProviderInstance["consumeResetCredit"]> = () =>
-      resetCreditCoordinator
-        .redeem(accountKey, (idempotencyKey) =>
-          Effect.gen(function* () {
-            const { client } = yield* withCodexAppServerClient({
+    const fallbackAccountKey = homeLayout.effectiveHomePath ?? homeLayout.sharedHomePath;
+    const accountKeysForFingerprint = (fingerprint: string | undefined) => [
+      fallbackAccountKey,
+      homeLayout.sharedHomePath,
+      ...(fingerprint === undefined ? [] : [`codex-account:${fingerprint}`]),
+    ];
+    const consumeWithIdempotencyKey = Effect.fn("CodexDriver.consumeResetCredit")(function* (
+      idempotencyKey: string,
+    ) {
+      const { client } = yield* withCodexAppServerClient({
+        binaryPath: effectiveConfig.binaryPath,
+        homePath: effectiveConfig.homePath,
+        launchArgs: resolveCodexLaunchArgs(effectiveConfig.launchArgs, processEnv),
+        cwd: process.cwd(),
+        environment: processEnv,
+      });
+      return (yield* client
+        .request("account/rateLimitResetCredit/consume", { idempotencyKey })
+        .pipe(Effect.timeout("20 seconds"))).outcome;
+    }, Effect.scoped);
+    const consumeResetCredit: NonNullable<ProviderInstance["consumeResetCredit"]> = Effect.fn(
+      "CodexDriver.consumeResetCredit",
+    )(function* () {
+      const beforeSnapshot = yield* snapshot.getSnapshot;
+      const before = beforeSnapshot.usageLimits?.checkedAt;
+      const accountKeys = accountKeysForFingerprint(
+        beforeSnapshot.usageLimits?.credentialFingerprint,
+      );
+      const outcome = yield* resetCreditCoordinator
+        .redeem(accountKeys, consumeWithIdempotencyKey)
+        .pipe(
+          Effect.provideService(ChildProcessSpawner.ChildProcessSpawner, spawner),
+          Effect.mapError(
+            (cause) =>
+              new ProviderDriverError({
+                driver: DRIVER_KIND,
+                instanceId,
+                detail: "Codex could not redeem the reset credit.",
+                cause,
+              }),
+          ),
+        );
+      const refreshed = yield* snapshot.refresh;
+      const after = refreshed.usageLimits?.checkedAt;
+      if (
+        outcome === "reset" &&
+        (after === undefined ||
+          (before !== undefined && Date.parse(after) <= Date.parse(before)) ||
+          refreshed.usageLimits?.unavailable !== undefined)
+      ) {
+        return yield* new ProviderDriverError({
+          driver: DRIVER_KIND,
+          instanceId,
+          detail:
+            "The reset was applied, but Codex could not confirm the new limits. Refresh to check.",
+        });
+      }
+      return outcome;
+    });
+
+    const autoRedeemResetCredit: NonNullable<ProviderInstance["autoRedeemResetCredit"]> = Effect.fn(
+      "CodexDriver.autoRedeemResetCredit",
+    )(function* (input) {
+      const consumeAutoWithIdempotencyKey = Effect.fn("CodexDriver.consumeAutoResetCredit")(
+        function* (idempotencyKey: string) {
+          const clientResult = yield* Effect.result(
+            withCodexAppServerClient({
               binaryPath: effectiveConfig.binaryPath,
               homePath: effectiveConfig.homePath,
               launchArgs: resolveCodexLaunchArgs(effectiveConfig.launchArgs, processEnv),
               cwd: process.cwd(),
               environment: processEnv,
-            });
-            const response = yield* client.request("account/rateLimitResetCredit/consume", {
-              idempotencyKey,
-            });
-            return response.outcome;
-          }).pipe(Effect.scoped, Effect.timeout("20 seconds")),
+            }).pipe(Effect.provideService(ChildProcessSpawner.ChildProcessSpawner, spawner)),
+          );
+          if (Result.isFailure(clientResult)) return { status: "notSent" as const };
+          const response = yield* Effect.result(
+            clientResult.success.client
+              .request("account/rateLimitResetCredit/consume", { idempotencyKey })
+              .pipe(Effect.timeout("20 seconds")),
+          );
+          if (Result.isFailure(response)) return { status: "sentUnknown" as const };
+          return { status: "sent" as const, outcome: response.success.outcome };
+        },
+        Effect.scoped,
+      );
+      const initial = yield* snapshot.getSnapshot;
+      const initialFingerprint = initial.usageLimits?.credentialFingerprint;
+      if (
+        initialFingerprint === undefined ||
+        initialFingerprint !== input.expectedAccountFingerprint
+      ) {
+        return {
+          status: "notSent",
+          reason: "keyConflict",
+          accountFingerprint: "",
+          creditsBefore: 0,
+          idempotencyKey: input.idempotencyKey,
+        } satisfies ProviderAutoResetCreditResult;
+      }
+      let checkedBefore: string | undefined;
+      let creditsBefore = 0;
+      let fingerprint = "";
+      let refreshedAt: string | undefined;
+      let notSentReason: "probeFailed" | "notExhausted" | "noCredit" | "declined" | "keyConflict" =
+        "probeFailed";
+      return yield* resetCreditCoordinator
+        .redeemIf(
+          accountKeysForFingerprint(initialFingerprint),
+          input.idempotencyKey,
+          () =>
+            Effect.gen(function* () {
+              const before = yield* snapshot.getSnapshot;
+              checkedBefore = before.usageLimits?.checkedAt;
+              const refreshed = yield* Effect.result(snapshot.refresh);
+              if (Result.isFailure(refreshed)) {
+                notSentReason = "probeFailed";
+                return false;
+              }
+              const fresh = refreshed.success;
+              const limits = fresh.usageLimits;
+              fingerprint = limits?.credentialFingerprint ?? "";
+              refreshedAt = limits?.checkedAt;
+              creditsBefore = limits?.resetCredits?.availableCount ?? 0;
+              const freshProbe =
+                limits !== undefined &&
+                refreshedAt !== undefined &&
+                checkedBefore !== undefined &&
+                Date.parse(refreshedAt) > Date.parse(checkedBefore) &&
+                limits.unavailable === undefined;
+              if (!freshProbe) {
+                notSentReason = "probeFailed";
+                return false;
+              }
+              if (fingerprint !== initialFingerprint) {
+                notSentReason = "keyConflict";
+                return false;
+              }
+              const now = DateTime.toEpochMillis(yield* DateTime.now);
+              const usageExhausted = exhaustedUsageWindow(fresh, now, input.model) !== undefined;
+              if (input.mode === "first" && !usageExhausted) {
+                notSentReason = "notExhausted";
+                return false;
+              }
+              if (input.mode === "first" && creditsBefore === 0) {
+                notSentReason = "noCredit";
+                return false;
+              }
+              const canRedeem = canAutoRedeemCodexReset({
+                mode: input.mode,
+                initialFingerprint,
+                freshFingerprint: fingerprint || undefined,
+                checkedBefore,
+                limits,
+                creditsAvailable: creditsBefore,
+                usageExhausted,
+              });
+              if (!canRedeem) {
+                notSentReason = "probeFailed";
+                return false;
+              }
+              if (input.stillArmed !== undefined) {
+                const armed = yield* Effect.result(input.stillArmed());
+                if (Result.isFailure(armed) || !armed.success) {
+                  notSentReason = "declined";
+                  return false;
+                }
+              }
+              return true;
+            }),
+          consumeAutoWithIdempotencyKey,
         )
         .pipe(
-          Effect.provideService(ChildProcessSpawner.ChildProcessSpawner, spawner),
           Effect.mapError(
             (cause) =>
               new ProviderDriverError({
@@ -332,31 +492,79 @@ export const CodexDriver: ProviderDriver<
                 cause,
               }),
           ),
-          // The windows just changed; re-probe so the snapshot says so. A
-          // failed probe republishes the pre-redemption limits rather than
-          // marking them failed, so "confirmed" means `checkedAt` moved past
-          // what was published before the redemption started.
-          Effect.tap((outcome) =>
+          Effect.flatMap((redemption) =>
             Effect.gen(function* () {
-              const before = (yield* snapshot.getSnapshot).usageLimits?.checkedAt;
-              const refreshed = yield* snapshot.refresh;
-              const after = refreshed.usageLimits?.checkedAt;
-              if (
-                outcome === "reset" &&
-                (after === undefined ||
-                  after === before ||
-                  refreshed.usageLimits?.unavailable?.reason === "probeFailed")
-              ) {
-                return yield* new ProviderDriverError({
-                  driver: DRIVER_KIND,
-                  instanceId,
-                  detail:
-                    "The reset was applied, but Codex could not confirm the new limits. Refresh to check.",
-                });
+              if (redemption._tag === "declined") {
+                return {
+                  status: "notSent",
+                  reason: notSentReason,
+                  accountFingerprint: fingerprint,
+                  creditsBefore,
+                  ...(refreshedAt === undefined ? {} : { checkedAt: refreshedAt }),
+                  idempotencyKey: input.idempotencyKey,
+                } satisfies ProviderAutoResetCreditResult;
               }
+              if (redemption._tag === "conflict")
+                return {
+                  status: "notSent",
+                  reason: "keyConflict",
+                  accountFingerprint: fingerprint,
+                  creditsBefore,
+                  ...(refreshedAt === undefined ? {} : { checkedAt: refreshedAt }),
+                  idempotencyKey: input.idempotencyKey,
+                } satisfies ProviderAutoResetCreditResult;
+              if (redemption.outcome.status === "notSent")
+                return {
+                  status: "notSent",
+                  reason: "probeFailed",
+                  accountFingerprint: fingerprint,
+                  creditsBefore,
+                  ...(refreshedAt === undefined ? {} : { checkedAt: refreshedAt }),
+                  idempotencyKey: input.idempotencyKey,
+                } satisfies ProviderAutoResetCreditResult;
+              if (redemption.outcome.status === "sentUnknown")
+                return {
+                  status: "sentUnknown",
+                  accountFingerprint: fingerprint,
+                  creditsBefore,
+                  ...(refreshedAt === undefined ? {} : { checkedAt: refreshedAt }),
+                  idempotencyKey: input.idempotencyKey,
+                } satisfies ProviderAutoResetCreditResult;
+              const { outcome } = redemption.outcome;
+              const refreshedResult = yield* Effect.result(snapshot.refresh);
+              if (Result.isFailure(refreshedResult))
+                return {
+                  status: "sent",
+                  accountFingerprint: fingerprint,
+                  creditsBefore,
+                  outcome,
+                  allowanceCleared: false,
+                  idempotencyKey: redemption.idempotencyKey,
+                } satisfies ProviderAutoResetCreditResult;
+              const refreshed = refreshedResult.success;
+              const limits = refreshed.usageLimits;
+              const checkedAt = limits?.checkedAt;
+              const now = DateTime.toEpochMillis(yield* DateTime.now);
+              const allowanceCleared = confirmsCodexResetCredit({
+                outcome,
+                checkedBefore: refreshedAt,
+                checkedAt,
+                limitsUnavailable: limits?.unavailable !== undefined,
+                usageExhausted: exhaustedUsageWindow(refreshed, now, input.model) !== undefined,
+              });
+              return {
+                status: "sent",
+                accountFingerprint: fingerprint,
+                creditsBefore,
+                outcome,
+                ...(checkedAt === undefined ? {} : { checkedAt }),
+                allowanceCleared,
+                idempotencyKey: redemption.idempotencyKey,
+              } satisfies ProviderAutoResetCreditResult;
             }),
           ),
         );
+    });
 
     return {
       instanceId,
@@ -368,6 +576,7 @@ export const CodexDriver: ProviderDriver<
       snapshot,
       snapshotForCwd,
       consumeResetCredit,
+      autoRedeemResetCredit,
       orchestrationAdapter,
       textGeneration,
     } satisfies ProviderInstance;
diff --git a/apps/server/src/provider/Drivers/CodexManagedProvider.ts b/apps/server/src/provider/Drivers/CodexManagedProvider.ts
index f9728f9a24973..6b8a8eff84f7a 100644
--- a/apps/server/src/provider/Drivers/CodexManagedProvider.ts
+++ b/apps/server/src/provider/Drivers/CodexManagedProvider.ts
@@ -5,6 +5,7 @@ import {
   type CodexSettings,
 } from "@t3tools/contracts";
 import * as Effect from "effect/Effect";
+import * as Crypto from "effect/Crypto";
 import * as FileSystem from "effect/FileSystem";
 import * as Path from "effect/Path";
 import * as Stream from "effect/Stream";
@@ -37,6 +38,7 @@ export const makeManagedCodexProvider = Effect.fn("makeManagedCodexProvider")(fu
 ) {
   const { instanceId, enabled, displayName, accentColor, config } = input;
   const http = yield* HttpClient.HttpClient;
+  const crypto = yield* Crypto.Crypto;
   const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
   const fileSystem = yield* FileSystem.FileSystem;
   const path = yield* Path.Path;
@@ -132,7 +134,7 @@ export const makeManagedCodexProvider = Effect.fn("makeManagedCodexProvider")(fu
             undefined,
             effective.environment,
             managedAuth,
-          );
+          ).pipe(Effect.provideService(Crypto.Crypto, crypto));
           const credentials = yield* runtime.auth.access;
           // Another server can replace the saved profile while the native probe runs.
           // Never send that account's token with the launch profile's catalog labels.
@@ -214,6 +216,7 @@ export const makeManagedCodexProvider = Effect.fn("makeManagedCodexProvider")(fu
     Effect.provideService(ChildProcessSpawner.ChildProcessSpawner, spawner),
     Effect.provideService(FileSystem.FileSystem, fileSystem),
     Effect.provideService(Path.Path, path),
+    Effect.provideService(Crypto.Crypto, crypto),
   );
   const snapshot = yield* makeManagedServerProvider({
     resolveMaintenance: () => Effect.succeed({ provider: DRIVER, packageName: null, update: null }),
diff --git a/apps/server/src/provider/ProviderInstanceRegistry.test.ts b/apps/server/src/provider/ProviderInstanceRegistry.test.ts
index af3359ea7f27d..da3a895fcdab4 100644
--- a/apps/server/src/provider/ProviderInstanceRegistry.test.ts
+++ b/apps/server/src/provider/ProviderInstanceRegistry.test.ts
@@ -414,6 +414,136 @@ describe("ProviderInstanceRegistry — multi-instance codex slice", () => {
     }).pipe(Effect.provide(layerTest)),
   );
 
+  it.live.skipIf(windowsHost)(
+    "replays a timed-out Codex consume with the same key after allowance clearance and zero credits",
+    () =>
+      Effect.gen(function* () {
+        const fixtures = yield* makeTildeProviderFixtures();
+        const fs = yield* FileSystem.FileSystem;
+        const path = yield* Path.Path;
+        const { stateDir } = yield* ServerConfig.ServerConfig;
+        const script = {
+          rootThreadId: "probe-thread",
+          notifications: [],
+          account: { type: "chatgpt", email: "fixture@example.test", planType: "pro" },
+          rateLimits: {
+            accountId: "replay-account",
+            rateLimits: {
+              primary: { usedPercent: 100, resetsAt: 4_102_444_800, windowDurationMins: 300 },
+              secondary: { usedPercent: 25, resetsAt: 4_102_444_800, windowDurationMins: 10_080 },
+            },
+            rateLimitResetCredits: { availableCount: 1 },
+          },
+          resetCreditOutcomes: ["timeout", "alreadyRedeemed"],
+          recordResetCreditConsumes: true,
+        };
+        yield* fs.writeFileString(fixtures.codexScriptPath, JSON.stringify(script));
+        const instanceId = ProviderInstanceId.make("codex_auto_replay_test");
+        const { registry } = yield* makeProviderInstanceRegistry<CodexDriverEnv>({
+          drivers: [CodexDriver],
+          configMap: {
+            [instanceId]: {
+              driver: ProviderDriverKind.make("codex"),
+              enabled: true,
+              environment: [
+                {
+                  name: "T3_CODEX_COLLAB_SCRIPT",
+                  value: fixtures.codexScriptPath,
+                  sensitive: false,
+                },
+              ],
+              config: makeCodexConfig({
+                enabled: true,
+                binaryPath: fixtures.codexBinaryPath,
+                homePath: path.join(stateDir, "codex-auto-replay-test-home"),
+              }),
+            },
+          },
+        });
+        const instance = yield* registry.getInstance(instanceId);
+        expect(instance?.autoRedeemResetCredit).toBeDefined();
+        const before = yield* instance!.snapshot.refresh;
+        const fingerprint = before.usageLimits?.credentialFingerprint;
+        expect(fingerprint).toBeDefined();
+
+        const idempotencyKey = "codex-auto-reset:fixture-account:window";
+        const first = yield* instance!.autoRedeemResetCredit!({
+          model: "gpt-5-codex",
+          idempotencyKey,
+          expectedAccountFingerprint: fingerprint!,
+          mode: "first",
+          stillArmed: () => Effect.succeed(true),
+        });
+        expect(first.status).toBe("sentUnknown");
+
+        yield* fs.writeFileString(
+          fixtures.codexScriptPath,
+          JSON.stringify({
+            ...script,
+            rateLimits: {
+              accountId: "replay-account",
+              rateLimits: {
+                primary: { usedPercent: 0, resetsAt: 4_102_444_800, windowDurationMins: 300 },
+                secondary: { usedPercent: 0, resetsAt: 4_102_444_800, windowDurationMins: 10_080 },
+              },
+              rateLimitResetCredits: { availableCount: 0 },
+            },
+          }),
+        );
+        const replay = yield* instance!.autoRedeemResetCredit!({
+          model: "gpt-5-codex",
+          idempotencyKey,
+          expectedAccountFingerprint: fingerprint!,
+          mode: "replay",
+          stillArmed: () => Effect.succeed(true),
+        });
+        expect(replay).toMatchObject({
+          status: "sent",
+          outcome: "alreadyRedeemed",
+          allowanceCleared: true,
+          idempotencyKey,
+        });
+        const consumeRows = (yield* fs.readFileString(
+          `${fixtures.codexScriptPath}.resetCreditConsumes`,
+        ))
+          .trim()
+          .split("\n")
+          .map((line) => JSON.parse(line) as { params: { idempotencyKey: string } });
+        expect(consumeRows.map((row) => row.params.idempotencyKey)).toEqual([
+          idempotencyKey,
+          idempotencyKey,
+        ]);
+        yield* fs.writeFileString(
+          fixtures.codexScriptPath,
+          JSON.stringify({
+            ...script,
+            rateLimits: {
+              accountId: "replay-account",
+              rateLimits: {
+                primary: { usedPercent: 100, resetsAt: 4_102_444_800, windowDurationMins: 300 },
+                secondary: { usedPercent: 25, resetsAt: 4_102_444_800, windowDurationMins: 10_080 },
+              },
+              rateLimitResetCredits: { availableCount: 1 },
+            },
+          }),
+        );
+        const stopped = yield* instance!.autoRedeemResetCredit!({
+          model: "gpt-5-codex",
+          idempotencyKey: "codex-auto-reset:fixture-account:stopped-window",
+          expectedAccountFingerprint: fingerprint!,
+          mode: "first",
+          stillArmed: () => Effect.succeed(false),
+        });
+        expect(stopped).toMatchObject({ status: "notSent", reason: "declined" });
+        const consumeRowsAfterStop = (yield* fs.readFileString(
+          `${fixtures.codexScriptPath}.resetCreditConsumes`,
+        ))
+          .trim()
+          .split("\n");
+        expect(consumeRowsAfterStop).toHaveLength(2);
+      }).pipe(Effect.provide(layerTest)),
+  );
+
   it.live("runs Claude instance probes in the server state dir, not the server cwd", () =>
     Effect.gen(function* () {
       if (yield* HostProcess.isWindows) return;
diff --git a/apps/server/src/provider/ProviderRegistry.test.ts b/apps/server/src/provider/ProviderRegistry.test.ts
index 5e1bc9e962b5f..e5ff0eba2106f 100644
--- a/apps/server/src/provider/ProviderRegistry.test.ts
+++ b/apps/server/src/provider/ProviderRegistry.test.ts
@@ -432,6 +432,26 @@ it.layer(
       }),
     );
 
+    it.effect("fingerprints the native account identity from app-server usage", () =>
+      Effect.gen(function* () {
+        const status = yield* checkCodexProviderStatus(defaultCodexSettings, () =>
+          Effect.succeed(
+            makeCodexProbeSnapshot({
+              rateLimits: {
+                snapshot: { planType: "plus" },
+                accountId: "workspace-123",
+                resetCredits: null,
+              },
+            }),
+          ),
+        );
+        const fingerprint = status.usageLimits?.credentialFingerprint;
+        if (fingerprint === undefined) throw new Error("Codex account fingerprint was missing.");
+        assert.notStrictEqual(fingerprint, "workspace-123");
+        assert.match(fingerprint, /^[0-9a-f]{64}$/u);
+      }),
+    );
+
     it.effect("returns unauthenticated when app-server requires OpenAI auth", () =>
       Effect.gen(function* () {
         const status = yield* checkCodexProviderStatus(defaultCodexSettings, () =>
diff --git a/apps/server/src/provider/ProviderRegistry.ts b/apps/server/src/provider/ProviderRegistry.ts
index 3234bfd61960a..122ae223d174b 100644
--- a/apps/server/src/provider/ProviderRegistry.ts
+++ b/apps/server/src/provider/ProviderRegistry.ts
@@ -38,9 +38,11 @@ import {
   writeProviderStatusCache,
 } from "./providerStatusCache.ts";
 import type {
+  ProviderAutoResetCreditResult,
   ProviderInstance,
   ProviderWorkspaceSnapshot,
 } from "@t3tools/provider-core/server/driver";
+import type { ProviderDriverError } from "@t3tools/provider-core/server/errors";
 import {
   makeManualOnlyProviderMaintenanceCapabilities,
   type ProviderMaintenanceCapabilities,
@@ -64,6 +66,19 @@ export class ProviderRegistry extends Context.Service<
       instanceId: ProviderInstanceId,
     ) => Effect.Effect<ReadonlyArray<ServerProvider>>;
 
+    readonly autoRedeemResetCredit: (input: {
+      readonly instanceId: ProviderInstanceId;
+      readonly model: string;
+      readonly idempotencyKey: string;
+      readonly expectedAccountFingerprint: string;
+      readonly mode: "first" | "replay";
+      readonly stillArmed?: () => Effect.Effect<boolean>;
+    }) => Effect.Effect<ProviderAutoResetCreditResult | null, ProviderDriverError>;
+
+    readonly supportsAutoRedeemResetCredit: (
+      instanceId: ProviderInstanceId,
+    ) => Effect.Effect<boolean>;
+
     /** Re-reads secret-backed environments first, so a fixed secret applies without a restart. */
     readonly reloadSecretsAndRefresh: (
       instanceId?: ProviderInstanceId,
@@ -672,6 +687,33 @@ export const layer = Layer.effect(
       return yield* refreshOneSource(providerSource);
     });
 
+    const autoRedeemResetCredit: ProviderRegistry["Service"]["autoRedeemResetCredit"] = Effect.fn(
+      "ProviderRegistry.autoRedeemResetCredit",
+    )(function* (input) {
+      const instance = yield* instanceRegistry.getInstance(input.instanceId);
+      if (instance === undefined || !instance.enabled) return null;
+      if (instance.driverKind !== ProviderDriverKind.make("codex")) return null;
+      if (instance.autoRedeemResetCredit === undefined) return null;
+      return yield* instance.autoRedeemResetCredit({
+        model: input.model,
+        idempotencyKey: input.idempotencyKey,
+        expectedAccountFingerprint: input.expectedAccountFingerprint,
+        mode: input.mode,
+        ...(input.stillArmed === undefined ? {} : { stillArmed: input.stillArmed }),
+      });
+    });
+
+    const supportsAutoRedeemResetCredit: ProviderRegistry["Service"]["supportsAutoRedeemResetCredit"] =
+      Effect.fn("ProviderRegistry.supportsAutoRedeemResetCredit")(function* (instanceId) {
+        const instance = yield* instanceRegistry.getInstance(instanceId);
+        return (
+          instance !== undefined &&
+          instance.enabled &&
+          instance.driverKind === ProviderDriverKind.make("codex") &&
+          instance.autoRedeemResetCredit !== undefined
+        );
+      });
+
     const reloadSecretsAndRefresh = Effect.fn("reloadSecretsAndRefresh")(function* (
       instanceId?: ProviderInstanceId,
     ) {
@@ -1031,6 +1073,8 @@ export const layer = Layer.effect(
         refresh(provider).pipe(Effect.catchCause(recoverRefreshFailure)),
       refreshInstance: (instanceId: ProviderInstanceId) =>
         refreshInstance(instanceId).pipe(Effect.catchCause(recoverRefreshFailure)),
+      autoRedeemResetCredit,
+      supportsAutoRedeemResetCredit,
       reloadSecretsAndRefresh: (instanceId?: ProviderInstanceId) =>
         reloadSecretsAndRefresh(instanceId).pipe(Effect.catchCause(recoverRefreshFailure)),
       refreshWorkspaceSnapshot: (input) =>
diff --git a/apps/server/src/provider/codexUsageLimits.test.ts b/apps/server/src/provider/codexUsageLimits.test.ts
index 9c863f54c0867..e49fff8ef6b96 100644
--- a/apps/server/src/provider/codexUsageLimits.test.ts
+++ b/apps/server/src/provider/codexUsageLimits.test.ts
@@ -2,6 +2,8 @@ import * as CodexErrors from "effect-codex-app-server/errors";
 import { describe, expect, it } from "vite-plus/test";
 
 import {
+  canAutoRedeemCodexReset,
+  confirmsCodexResetCredit,
   codexRateLimitsFailureMessage,
   codexRateLimitsToLimits,
   codexRateLimitsToUpdate,
@@ -10,6 +12,64 @@ import {
 
 const checkedAt = "2026-07-18T10:00:00.000Z";
 
+describe("automatic Codex reset checks", () => {
+  const limits = {
+    checkedAt,
+    windows: [],
+    credentialFingerprint: "account-fingerprint",
+    resetCredits: { availableCount: 1 },
+  } as const;
+
+  it("requires the same account, a newer probe, an available credit and an exhausted window", () => {
+    const eligible = {
+      mode: "first" as const,
+      initialFingerprint: "account-fingerprint",
+      freshFingerprint: "account-fingerprint",
+      checkedBefore: "2026-07-18T09:59:00.000Z",
+      limits,
+      creditsAvailable: 1,
+      usageExhausted: true,
+    };
+    expect(canAutoRedeemCodexReset(eligible)).toBe(true);
+    expect(canAutoRedeemCodexReset({ ...eligible, freshFingerprint: "other-account" })).toBe(false);
+    expect(canAutoRedeemCodexReset({ ...eligible, checkedBefore: checkedAt })).toBe(false);
+    expect(canAutoRedeemCodexReset({ ...eligible, creditsAvailable: 0 })).toBe(false);
+    expect(canAutoRedeemCodexReset({ ...eligible, usageExhausted: false })).toBe(false);
+    expect(
+      canAutoRedeemCodexReset({
+        ...eligible,
+        mode: "replay",
+        creditsAvailable: 0,
+        usageExhausted: false,
+      }),
+    ).toBe(true);
+    expect(
+      canAutoRedeemCodexReset({
+        ...eligible,
+        limits: { ...limits, unavailable: { reason: "probeFailed" } },
+      }),
+    ).toBe(false);
+  });
+
+  it("confirms only a reset outcome with a newer, available probe and cleared limits", () => {
+    const confirmed = {
+      outcome: "reset" as const,
+      checkedBefore: "2026-07-18T09:59:00.000Z",
+      checkedAt,
+      limitsUnavailable: false,
+      usageExhausted: false,
+    };
+    expect(confirmsCodexResetCredit(confirmed)).toBe(true);
+    expect(confirmsCodexResetCredit({ ...confirmed, outcome: "alreadyRedeemed" })).toBe(true);
+    expect(confirmsCodexResetCredit({ ...confirmed, outcome: "noCredit" })).toBe(false);
+    expect(confirmsCodexResetCredit({ ...confirmed, checkedAt: confirmed.checkedBefore })).toBe(
+      false,
+    );
+    expect(confirmsCodexResetCredit({ ...confirmed, limitsUnavailable: true })).toBe(false);
+    expect(confirmsCodexResetCredit({ ...confirmed, usageExhausted: true })).toBe(false);
+  });
+});
+
 describe("codexRateLimitsToLimits", () => {
   it("shows an Enterprise monthly credit allowance in reads and notifications without a duration", () => {
     const snapshot = {
@@ -72,6 +132,33 @@ describe("codexRateLimitsToLimits", () => {
     });
   });
 
+  it("reports the next available reset credit and credential fingerprint", () => {
+    expect(
+      codexRateLimitsToLimits({
+        checkedAt,
+        snapshot: { planType: "plus" },
+        resetCredits: {
+          availableCount: 2,
+          credits: [
+            { id: "later", grantedAt: 10, status: "available", expiresAt: 500 },
+            { id: "earlier", grantedAt: 5, status: "available", expiresAt: 300 },
+            { id: "used", grantedAt: 1, status: "redeemed", expiresAt: 100 },
+          ],
+        },
+        credentialFingerprint: "account-fingerprint",
+      }),
+    ).toEqual({
+      checkedAt,
+      windows: [],
+      credentialFingerprint: "account-fingerprint",
+      resetCredits: {
+        availableCount: 2,
+        nextCreditId: "later",
+        nextExpiresAt: "1970-01-01T00:05:00.000Z",
+      },
+    });
+  });
+
   it("treats a lone duration-less primary as monthly on Free and Go", () => {
     expect(
       codexRateLimitsToLimits({
diff --git a/apps/server/src/provider/codexUsageLimits.ts b/apps/server/src/provider/codexUsageLimits.ts
index d4f9c621119df..15136d70bf4c4 100644
--- a/apps/server/src/provider/codexUsageLimits.ts
+++ b/apps/server/src/provider/codexUsageLimits.ts
@@ -1,4 +1,5 @@
 import type {
+  ProviderConsumeResetCreditOutcome,
   ProviderUsageLimitsUpdate,
   ServerProviderResetCredits,
   ServerProviderUsageLimits,
@@ -31,11 +32,50 @@ export interface CodexRateLimitSnapshot {
 export interface CodexResetCreditsSummary {
   readonly availableCount: number;
   readonly credits?: ReadonlyArray<{
+    readonly id: string;
+    readonly grantedAt?: number;
     readonly status: string;
     readonly expiresAt?: number | null;
   }> | null;
 }
 
+export function canAutoRedeemCodexReset(input: {
+  readonly mode: "first" | "replay";
+  readonly initialFingerprint: string;
+  readonly freshFingerprint: string | undefined;
+  readonly checkedBefore: string | undefined;
+  readonly limits: ServerProviderUsageLimits | undefined;
+  readonly creditsAvailable: number;
+  readonly usageExhausted: boolean;
+}) {
+  return (
+    input.freshFingerprint === input.initialFingerprint &&
+    input.checkedBefore !== undefined &&
+    input.limits !== undefined &&
+    input.limits.unavailable === undefined &&
+    input.limits.checkedAt !== undefined &&
+    Date.parse(input.limits.checkedAt) > Date.parse(input.checkedBefore) &&
+    (input.mode === "replay" || (input.creditsAvailable > 0 && input.usageExhausted))
+  );
+}
+
+export function confirmsCodexResetCredit(input: {
+  readonly outcome: ProviderConsumeResetCreditOutcome;
+  readonly checkedBefore: string | undefined;
+  readonly checkedAt: string | undefined;
+  readonly limitsUnavailable: boolean;
+  readonly usageExhausted: boolean;
+}) {
+  return (
+    (input.outcome === "reset" || input.outcome === "alreadyRedeemed") &&
+    input.checkedBefore !== undefined &&
+    input.checkedAt !== undefined &&
+    Date.parse(input.checkedAt) > Date.parse(input.checkedBefore) &&
+    !input.limitsUnavailable &&
+    !input.usageExhausted
+  );
+}
+
 const SESSION_MINS = 5 * 60;
 const WEEK_MINS = 7 * 24 * 60;
 const MONTH_MINS = 30 * 24 * 60;
@@ -101,14 +141,16 @@ function codexResetCreditsToContract(
   summary: CodexResetCreditsSummary | null | undefined,
 ): ServerProviderResetCredits | undefined {
   if (!summary) return undefined;
-  const expiries = (summary.credits ?? [])
-    .filter((credit) => credit.status === "available")
+  const available = (summary.credits ?? []).filter((credit) => credit.status === "available");
+  const expiries = available
     .map((credit) => credit.expiresAt)
     .filter((value): value is number => typeof value === "number");
   const nextExpiresAt =
     expiries.length > 0 ? isoFromEpochSeconds(Math.min(...expiries)) : undefined;
+  const nextCredit = available[0];
   return {
     availableCount: Math.max(0, summary.availableCount),
+    ...(nextCredit?.id ? { nextCreditId: nextCredit.id } : {}),
     ...(nextExpiresAt ? { nextExpiresAt } : {}),
   };
 }
@@ -120,6 +162,7 @@ export function codexRateLimitsToLimits(input: {
     | null
     | undefined;
   readonly resetCredits?: CodexResetCreditsSummary | null | undefined;
+  readonly credentialFingerprint?: string | undefined;
   readonly checkedAt: string;
 }): ServerProviderUsageLimits {
   const resetCredits = codexResetCreditsToContract(input.resetCredits);
@@ -129,6 +172,7 @@ export function codexRateLimitsToLimits(input: {
       checkedAt: input.checkedAt,
       windows,
     }),
+    ...(input.credentialFingerprint ? { credentialFingerprint: input.credentialFingerprint } : {}),
     ...(resetCredits ? { resetCredits } : {}),
   };
 }
diff --git a/apps/server/src/provider/providerMaintenanceRunner.test.ts b/apps/server/src/provider/providerMaintenanceRunner.test.ts
index 9b7d1ffb35d41..ca3646536743b 100644
--- a/apps/server/src/provider/providerMaintenanceRunner.test.ts
+++ b/apps/server/src/provider/providerMaintenanceRunner.test.ts
@@ -195,6 +195,8 @@ function makeRegistry(
       getProviders: Ref.get(providersRef),
       refresh: () => Ref.get(providersRef),
       refreshInstance: () => Ref.get(providersRef),
+      autoRedeemResetCredit: () => Effect.succeed(null),
+      supportsAutoRedeemResetCredit: () => Effect.succeed(false),
       reloadSecretsAndRefresh: () => Ref.get(providersRef),
       refreshAfterUpdate: () => {
         const version = options?.installedVersionAfterUpdate;
diff --git a/apps/server/src/provider/resetCreditCoordinator.test.ts b/apps/server/src/provider/resetCreditCoordinator.test.ts
index a7a8010a3f5f8..036e883e90a32 100644
--- a/apps/server/src/provider/resetCreditCoordinator.test.ts
+++ b/apps/server/src/provider/resetCreditCoordinator.test.ts
@@ -100,4 +100,192 @@ describe("ResetCreditCoordinator", () => {
       assert.strictEqual(yield* Ref.get(peak), 2);
     }).pipe(Effect.provide(ResetCreditCoordinator.layerTest)),
   );
+
+  it.effect("runs the fresh exhaustion check under the account lock before consuming once", () =>
+    Effect.gen(function* () {
+      const { redeemIf } = yield* ResetCreditCoordinator.ResetCreditCoordinator;
+      const exhausted = yield* Ref.make(true);
+      const consumes = yield* Ref.make(0);
+      const redeem = (key: string) =>
+        redeemIf(
+          "shared-codex-account",
+          key,
+          () => Ref.get(exhausted),
+          () =>
+            Ref.updateAndGet(consumes, (count) => count + 1).pipe(
+              Effect.tap(() => Ref.set(exhausted, false)),
+              Effect.as("reset" as const),
+            ),
+        );
+
+      const first = yield* redeem("attempt-a").pipe(Effect.forkChild);
+      const second = yield* redeem("attempt-b").pipe(Effect.forkChild);
+      const outcomes = [yield* Fiber.join(first), yield* Fiber.join(second)];
+
+      assert.deepEqual(
+        outcomes.map((result) => (result._tag === "sent" ? result.outcome : null)).sort(),
+        [null, "reset"],
+      );
+      const sent = outcomes.find((result) => result._tag === "sent");
+      assert.isTrue(sent?._tag === "sent");
+      if (sent?._tag === "sent") assert.strictEqual(sent.idempotencyKey, "attempt-a");
+      assert.strictEqual(yield* Ref.get(consumes), 1);
+    }).pipe(Effect.provide(ResetCreditCoordinator.layerTest)),
+  );
+
+  it.effect("does not consume when the fresh check shows the allowance has recovered", () =>
+    Effect.gen(function* () {
+      const { redeemIf } = yield* ResetCreditCoordinator.ResetCreditCoordinator;
+      const consumes = yield* Ref.make(0);
+      const result = yield* redeemIf(
+        "account-a",
+        "attempt-a",
+        () => Effect.succeed(false),
+        () => Ref.updateAndGet(consumes, (count) => count + 1).pipe(Effect.as("reset" as const)),
+      );
+
+      assert.deepEqual(result, { _tag: "declined" });
+      assert.strictEqual(yield* Ref.get(consumes), 0);
+    }).pipe(Effect.provide(ResetCreditCoordinator.layerTest)),
+  );
+
+  it.effect("leaves a different account untouched by the matched account's redemption", () =>
+    Effect.gen(function* () {
+      const { redeemIf } = yield* ResetCreditCoordinator.ResetCreditCoordinator;
+      const consumedAccounts = yield* Ref.make<ReadonlyArray<string>>([]);
+      const consume = (account: string) =>
+        Ref.update(consumedAccounts, (accounts) => [...accounts, account]).pipe(
+          Effect.as("reset" as const),
+        );
+      for (const account of ["matched-account", "other-account"]) {
+        yield* redeemIf(
+          account,
+          `attempt:${account}`,
+          () => Effect.succeed(account === "matched-account"),
+          () => consume(account),
+        );
+      }
+
+      assert.deepEqual(yield* Ref.get(consumedAccounts), ["matched-account"]);
+    }).pipe(Effect.provide(ResetCreditCoordinator.layerTest)),
+  );
+
+  it.effect(
+    "serialises manual home-only redemption with automatic home-and-account redemption",
+    () =>
+      Effect.gen(function* () {
+        const { redeem, redeemIf } = yield* ResetCreditCoordinator.ResetCreditCoordinator;
+        const release = yield* Deferred.make<void>();
+        const inFlight = yield* Ref.make(0);
+        const peak = yield* Ref.make(0);
+        const consume = () =>
+          Effect.gen(function* () {
+            const now = yield* Ref.updateAndGet(inFlight, (value) => value + 1);
+            yield* Ref.update(peak, (value) => Math.max(value, now));
+            yield* Deferred.await(release);
+            yield* Ref.update(inFlight, (value) => value - 1);
+            return "reset" as const;
+          });
+        const manual = yield* redeem(["home:/codex"], consume).pipe(Effect.forkChild);
+        const automatic = yield* redeemIf(
+          ["home:/codex", "codex-account:fingerprint"],
+          "automatic-attempt",
+          () => Effect.succeed(true),
+          consume,
+        ).pipe(Effect.forkChild);
+        yield* Effect.yieldNow;
+        yield* Deferred.succeed(release, undefined);
+        yield* Fiber.join(manual);
+        const result = yield* Fiber.join(automatic);
+        assert.deepEqual(result, {
+          _tag: "sent",
+          idempotencyKey: "automatic-attempt",
+          outcome: "reset",
+        });
+        assert.strictEqual(yield* Ref.get(peak), 1);
+      }).pipe(Effect.provide(ResetCreditCoordinator.layerTest)),
+  );
+
+  it.effect(
+    "does not replace an unresolved manual key when auto redemption gains account identity",
+    () =>
+      Effect.gen(function* () {
+        const { redeemWithKey, redeemIf } = yield* ResetCreditCoordinator.ResetCreditCoordinator;
+        const automaticConsumes = yield* Ref.make(0);
+        yield* redeemWithKey(["home:/codex"], "manual-pending-key", () =>
+          Effect.fail("lost response" as const),
+        ).pipe(Effect.result);
+        const result = yield* redeemIf(
+          ["home:/codex", "codex-account:fingerprint"],
+          "automatic-new-key",
+          () => Effect.succeed(true),
+          () =>
+            Ref.updateAndGet(automaticConsumes, (count) => count + 1).pipe(
+              Effect.as("reset" as const),
+            ),
+        );
+        assert.deepEqual(result, { _tag: "conflict", pendingKey: "manual-pending-key" });
+        assert.strictEqual(yield* Ref.get(automaticConsumes), 0);
+        const secondConflict = yield* redeemIf(
+          ["home:/codex", "codex-account:fingerprint"],
+          "another-auto-key",
+          () => Effect.succeed(true),
+          () =>
+            Ref.updateAndGet(automaticConsumes, (count) => count + 1).pipe(
+              Effect.as("reset" as const),
+            ),
+        );
+        assert.deepEqual(secondConflict, { _tag: "conflict", pendingKey: "manual-pending-key" });
+        const manualKeys = yield* Ref.make<ReadonlyArray<string>>([]);
+        const manualResult = yield* redeemWithKey(["home:/codex"], "manual-pending-key", () =>
+          Ref.updateAndGet(manualKeys, (keys) => [...keys, "manual-pending-key"]).pipe(
+            Effect.as("alreadyRedeemed" as const),
+          ),
+        );
+        assert.strictEqual(manualResult, "alreadyRedeemed");
+        assert.deepEqual(yield* Ref.get(manualKeys), ["manual-pending-key"]);
+        const resumed = yield* redeemIf(
+          ["home:/codex", "codex-account:fingerprint"],
+          "automatic-new-key",
+          () => Effect.succeed(true),
+          () =>
+            Ref.updateAndGet(automaticConsumes, (count) => count + 1).pipe(
+              Effect.as("reset" as const),
+            ),
+        );
+        assert.deepEqual(resumed, {
+          _tag: "sent",
+          idempotencyKey: "automatic-new-key",
+          outcome: "reset",
+        });
+      }).pipe(Effect.provide(ResetCreditCoordinator.layerTest)),
+  );
+
+  it.effect(
+    "rechecks the armed state after waiting on the account lock and immediately before consume",
+    () =>
+      Effect.gen(function* () {
+        const { redeemIf } = yield* ResetCreditCoordinator.ResetCreditCoordinator;
+        const probeEntered = yield* Deferred.make<void>();
+        const finishProbe = yield* Deferred.make<void>();
+        const stopped = yield* Ref.make(false);
+        const consumes = yield* Ref.make(0);
+        const attempt = yield* redeemIf(
+          ["home:/codex", "codex-account:fingerprint"],
+          "attempt-after-stop-check",
+          () =>
+            Deferred.succeed(probeEntered, undefined).pipe(
+              Effect.andThen(Deferred.await(finishProbe)),
+              Effect.andThen(Ref.get(stopped)),
+              Effect.map((isStopped) => !isStopped),
+            ),
+          () => Ref.updateAndGet(consumes, (count) => count + 1).pipe(Effect.as("reset" as const)),
+        ).pipe(Effect.forkChild);
+        yield* Deferred.await(probeEntered);
+        yield* Ref.set(stopped, true);
+        yield* Deferred.succeed(finishProbe, undefined);
+        assert.deepEqual(yield* Fiber.join(attempt), { _tag: "declined" });
+        assert.strictEqual(yield* Ref.get(consumes), 0);
+      }).pipe(Effect.provide(ResetCreditCoordinator.layerTest)),
+  );
 });
diff --git a/apps/server/src/provider/resetCreditCoordinator.ts b/apps/server/src/provider/resetCreditCoordinator.ts
index 189c43b54f7f6..9c5e2de9f32af 100644
--- a/apps/server/src/provider/resetCreditCoordinator.ts
+++ b/apps/server/src/provider/resetCreditCoordinator.ts
@@ -18,10 +18,33 @@ export class ResetCreditCoordinator extends Context.Service<
   {
     /** Reuse the idempotency key until an outcome or settled failure; timeouts keep it for retry. */
     readonly redeem: <E, R>(
-      accountKey: string,
+      accountKey: string | ReadonlyArray<string>,
       consume: (idempotencyKey: string) => Effect.Effect<ProviderConsumeResetCreditOutcome, E, R>,
       isSettled?: (error: E) => boolean,
     ) => Effect.Effect<ProviderConsumeResetCreditOutcome, E | PlatformError.PlatformError, R>;
+    readonly redeemWithKey: <E, R>(
+      accountKey: string | ReadonlyArray<string>,
+      idempotencyKey: string,
+      consume: (idempotencyKey: string) => Effect.Effect<ProviderConsumeResetCreditOutcome, E, R>,
+      isSettled?: (error: E) => boolean,
+    ) => Effect.Effect<ProviderConsumeResetCreditOutcome, E | PlatformError.PlatformError, R>;
+    readonly redeemIf: <A, E, R>(
+      accountKey: string | ReadonlyArray<string>,
+      idempotencyKey: string,
+      shouldRedeem: () => Effect.Effect<boolean, E, R>,
+      consume: (idempotencyKey: string) => Effect.Effect<A, E, R>,
+      isSettled?: (error: E) => boolean,
+    ) => Effect.Effect<
+      | { readonly _tag: "declined" }
+      | { readonly _tag: "conflict"; readonly pendingKey: string }
+      | {
+          readonly _tag: "sent";
+          readonly idempotencyKey: string;
+          readonly outcome: A;
+        },
+      E | PlatformError.PlatformError,
+      R
+    >;
   }
 >()("t3/provider/resetCreditCoordinator") {}
 
@@ -47,27 +70,91 @@ export const make = Effect.gen(function* () {
     });
   });
 
-  const redeem: ResetCreditCoordinator["Service"]["redeem"] = Effect.fn(
-    "resetCreditCoordinator.redeem",
-  )(function* (accountKey, consume, isSettled) {
-    const state = yield* stateFor(accountKey);
-    return yield* state.lock.withPermits(1)(
+  const withAccountLocks = <A, E, R>(
+    requested: string | ReadonlyArray<string>,
+    run: () => Effect.Effect<A, E, R>,
+  ): Effect.Effect<A, E | PlatformError.PlatformError, R> => {
+    const keys = Array.from(
+      new Set(typeof requested === "string" ? [requested] : requested),
+    ).sort();
+    const lockAt = (index: number): Effect.Effect<A, E | PlatformError.PlatformError, R> =>
+      index >= keys.length
+        ? run()
+        : Effect.gen(function* () {
+            const state = yield* stateFor(keys[index]!);
+            return yield* state.lock.withPermits(1)(lockAt(index + 1));
+          });
+    return lockAt(0);
+  };
+
+  const accountStates = (requested: string | ReadonlyArray<string>) => {
+    const keys = Array.from(
+      new Set(typeof requested === "string" ? [requested] : requested),
+    ).sort();
+    return Effect.forEach(keys, stateFor);
+  };
+  const setPendingKey = (states: ReadonlyArray<AccountRedemptionState>, key: string | null) =>
+    Effect.forEach(states, (state) => Ref.set(state.pendingKey, key), { discard: true });
+  const clearPendingKey = (states: ReadonlyArray<AccountRedemptionState>, key: string) =>
+    Effect.forEach(
+      states,
+      (state) => Ref.update(state.pendingKey, (current) => (current === key ? null : current)),
+      { discard: true },
+    );
+
+  const redeemWithKey: ResetCreditCoordinator["Service"]["redeemWithKey"] = Effect.fn(
+    "resetCreditCoordinator.redeemWithKey",
+  )(function* (accountKey, requestedKey, consume, isSettled) {
+    return yield* withAccountLocks(accountKey, () =>
       Effect.gen(function* () {
-        const existing = yield* Ref.get(state.pendingKey);
-        const idempotencyKey = existing ?? (yield* crypto.randomUUIDv4());
-        yield* Ref.set(state.pendingKey, idempotencyKey);
+        const states = yield* accountStates(accountKey);
+        const pendingKeys = yield* Effect.forEach(states, (state) => Ref.get(state.pendingKey));
+        const existing = pendingKeys.find((key) => key !== null) ?? null;
+        const idempotencyKey = existing ?? requestedKey;
+        yield* setPendingKey(states, idempotencyKey);
         const outcome = yield* consume(idempotencyKey).pipe(
           Effect.tapError((error) =>
-            isSettled?.(error) ? Ref.set(state.pendingKey, null) : Effect.void,
+            isSettled?.(error) ? setPendingKey(states, null) : Effect.void,
           ),
         );
-        yield* Ref.set(state.pendingKey, null);
+        yield* setPendingKey(states, null);
         return outcome;
       }),
     );
   });
 
-  return { redeem } satisfies ResetCreditCoordinator["Service"];
+  const redeemIf: ResetCreditCoordinator["Service"]["redeemIf"] = Effect.fn(
+    "resetCreditCoordinator.redeemIf",
+  )(function* (accountKey, requestedKey, shouldRedeem, consume, isSettled) {
+    return yield* withAccountLocks(accountKey, () =>
+      Effect.gen(function* () {
+        const states = yield* accountStates(accountKey);
+        const pendingKeys = yield* Effect.forEach(states, (state) => Ref.get(state.pendingKey));
+        const existingKeys = pendingKeys.filter((key): key is string => key !== null);
+        const conflict = existingKeys.find((key) => key !== requestedKey);
+        if (conflict !== undefined) return { _tag: "conflict" as const, pendingKey: conflict };
+        if (!(yield* shouldRedeem())) return { _tag: "declined" as const };
+        yield* setPendingKey(states, requestedKey);
+        return yield* Effect.gen(function* () {
+          const outcome = yield* consume(requestedKey).pipe(
+            Effect.tapError((error) =>
+              isSettled?.(error) ? clearPendingKey(states, requestedKey) : Effect.void,
+            ),
+          );
+          return { _tag: "sent" as const, idempotencyKey: requestedKey, outcome };
+        }).pipe(Effect.ensuring(clearPendingKey(states, requestedKey)));
+      }),
+    );
+  });
+
+  const redeem: ResetCreditCoordinator["Service"]["redeem"] = Effect.fn(
+    "ResetCreditCoordinator.redeem",
+  )(function* (accountKey, consume, isSettled) {
+    const key = yield* crypto.randomUUIDv4();
+    return yield* redeemWithKey(accountKey, key, consume, isSettled);
+  });
+
+  return { redeem, redeemWithKey, redeemIf } satisfies ResetCreditCoordinator["Service"];
 });
 
 export const layer = Layer.effect(ResetCreditCoordinator, make);
diff --git a/apps/server/src/provider/testFixtures/codexCollabMockPeer.mjs b/apps/server/src/provider/testFixtures/codexCollabMockPeer.mjs
index cae8ea2c9380d..87809eda690d8 100644
--- a/apps/server/src/provider/testFixtures/codexCollabMockPeer.mjs
+++ b/apps/server/src/provider/testFixtures/codexCollabMockPeer.mjs
@@ -76,12 +76,54 @@ rl.on("line", (line) => {
     });
     return;
   }
-  if (method === "account/rateLimits/read" && script.failRateLimitsRead) {
-    write({ id, error: { code: -32000, message: "usage unavailable" } });
+  if (
+    method === "account/rateLimits/read" &&
+    (script.failRateLimitsRead || script.rateLimits || script.recordRateLimitReads)
+  ) {
+    if (script.recordRateLimitReads) {
+      NodeFS.appendFileSync(
+        `${process.env.T3_CODEX_COLLAB_SCRIPT}.rateLimits`,
+        `${JSON.stringify({ id })}\n`,
+      );
+    }
+    if (script.failRateLimitsRead) {
+      write({ id, error: { code: -32000, message: "usage unavailable" } });
+    } else {
+      write({ id, result: script.rateLimits });
+    }
     return;
   }
-  if (method === "account/rateLimitResetCredit/consume" && script.resetCreditOutcome) {
-    write({ id, result: { outcome: script.resetCreditOutcome } });
+  if (
+    method === "account/rateLimitResetCredit/consume" &&
+    (script.resetCreditOutcome || script.resetCreditOutcomes)
+  ) {
+    const consumeLog = `${process.env.T3_CODEX_COLLAB_SCRIPT}.resetCreditConsumes`;
+    if (script.recordResetCreditConsumes) {
+      NodeFS.appendFileSync(consumeLog, `${JSON.stringify({ id, params: message.params })}\n`);
+    }
+    const consumeCount = NodeFS.existsSync(consumeLog)
+      ? NodeFS.readFileSync(consumeLog, "utf8").trim().split("\n").length
+      : 1;
+    const selectedOutcome =
+      Array.isArray(script.resetCreditOutcomes) && consumeCount <= script.resetCreditOutcomes.length
+        ? script.resetCreditOutcomes[consumeCount - 1]
+        : script.resetCreditOutcome;
+    if (selectedOutcome === null || selectedOutcome === "timeout") return;
+    if (selectedOutcome === "error") {
+      write({ id, error: { code: -32000, message: "consume response lost" } });
+      return;
+    }
+    const respond = () => {
+      if (
+        script.holdResetCreditUntilMarker &&
+        !NodeFS.existsSync(script.holdResetCreditUntilMarker)
+      ) {
+        setTimeout(respond, 10);
+      } else {
+        write({ id, result: { outcome: selectedOutcome } });
+      }
+    };
+    respond();
     return;
   }
   if (method === "skills/list" || method === "model/list") {
diff --git a/apps/server/src/provider/testUtils/providerRegistryMock.ts b/apps/server/src/provider/testUtils/providerRegistryMock.ts
index a4008acc18efb..665519fe2a335 100644
--- a/apps/server/src/provider/testUtils/providerRegistryMock.ts
+++ b/apps/server/src/provider/testUtils/providerRegistryMock.ts
@@ -11,6 +11,8 @@ const makeProviderRegistryMock = (
   getProviders: Effect.succeed(providers),
   refresh: () => Effect.succeed(providers),
   refreshInstance: () => Effect.succeed(providers),
+  autoRedeemResetCredit: () => Effect.succeed(null),
+  supportsAutoRedeemResetCredit: () => Effect.succeed(false),
   reloadSecretsAndRefresh: () => Effect.succeed(providers),
   refreshAfterUpdate: () => Effect.succeed(providers),
   refreshWorkspaceSnapshot: () => Effect.succeed(providers),
diff --git a/apps/web/src/components/chat/UsageLimitRecoveryBanner.tsx b/apps/web/src/components/chat/UsageLimitRecoveryBanner.tsx
index c99781738793d..7f5d68af0d0f1 100644
--- a/apps/web/src/components/chat/UsageLimitRecoveryBanner.tsx
+++ b/apps/web/src/components/chat/UsageLimitRecoveryBanner.tsx
@@ -1,4 +1,5 @@
 import {
+  type OrchestrationV2CodexResetRedemption,
   type OrchestrationV2LimitRecovery,
   type OrchestrationV2LimitRecoveryUpdate,
   type RunId,
@@ -26,18 +27,48 @@ type RecoveryProps = {
 export function usageLimitRecoveryBannerItem(props: RecoveryProps): ComposerBannerStackItem {
   const { runId, resetAt, stoppedAt, timestampFormat } = props;
   const canSchedule = resetAt !== null && Date.parse(resetAt) > Date.parse(stoppedAt);
+  const redemption =
+    props.recovery?.runId === runId && props.recovery.resetAt === resetAt
+      ? props.recovery.codexResetRedemption
+      : undefined;
+  const redemptionReport = redemption ? codexResetRedemptionMessage(redemption) : null;
   return {
     id: `usage-limit-recovery:${runId}`,
     variant: "warning",
     icon: <GaugeIcon />,
     title: "Usage limit reached",
-    description: resetAt
-      ? `Resets ${formatUpcomingTimestamp(resetAt, timestampFormat)}`
-      : "Reset time unavailable; retry manually",
+    description: [
+      resetAt
+        ? `Resets ${formatUpcomingTimestamp(resetAt, timestampFormat)}`
+        : "Reset time unavailable; retry manually",
+      redemptionReport,
+    ]
+      .filter((part): part is string => part !== null)
+      .join(" · "),
     actions: canSchedule ? <RecoveryActions key={`${runId}:${resetAt}`} {...props} /> : null,
   };
 }
 
+function codexResetRedemptionMessage(redemption: OrchestrationV2CodexResetRedemption) {
+  const account = redemption.accountLabel ?? "this Codex account";
+  if (redemption.outcome === "reset" && redemption.allowanceCleared)
+    return `Codex reported a reset for ${account}, and a fresh check found this usage limit clear.`;
+  switch (redemption.outcome) {
+    case "pending":
+      return `Checking whether Codex applied a reset for ${account}.`;
+    case "noCredit":
+      return `No reset credits were available for ${account}; this thread remains limited.`;
+    case "nothingToReset":
+      return `No reset was used for ${account}; this thread remains limited.`;
+    case "reset":
+      return `Codex reported a reset for ${account}, but this usage limit is still active.`;
+    case "unconfirmed":
+      return `Could not confirm a reset for ${account}; this thread remains limited.`;
+    case "declined":
+      return `Auto-reset skipped for ${account}; this thread remains limited.`;
+  }
+}
+
 function RecoveryActions({ runId, resetAt, recovery, snoozedUntil, onChange }: RecoveryProps) {
   const [pending, setPending] = useState(false);
 
diff --git a/apps/web/src/components/settings/SettingsPanels.tsx b/apps/web/src/components/settings/SettingsPanels.tsx
index dca3eabc868aa..dd37e2d9a7432 100644
--- a/apps/web/src/components/settings/SettingsPanels.tsx
+++ b/apps/web/src/components/settings/SettingsPanels.tsx
@@ -9,7 +9,7 @@ import {
   IDLE_COMPACTION_MODES,
   globalIdleCompaction,
   ProviderDriverKind,
-  type ProviderInstanceId,
+  ProviderInstanceId,
   type SidebarProjectGroupingMode,
 } from "@t3tools/contracts";
 import {
@@ -1585,6 +1585,46 @@ export function ThreadsSettingsPanel() {
             />
           }
         />
+        {scope.kind === "environment" && connectedEnvironments.length === 1
+          ? Object.entries(settings.providerInstances)
+              .filter(([, instance]) => {
+                if (instance.driver !== ProviderDriverKind.make("codex")) return false;
+                const config = instance.config;
+                return !(
+                  typeof config === "object" &&
+                  config !== null &&
+                  "setupMode" in config &&
+                  config.setupMode === "managed"
+                );
+              })
+              .map(([instanceId, instance]) => (
+                <SettingsRow
+                  key={instanceId}
+                  serverScoped
+                  title={`Use banked Codex resets${instance.displayName ? ` for ${instance.displayName}` : ""}`}
+                  description="For native Codex accounts. When an included usage limit is exhausted, redeem one banked reset and resume eligible threads after Codex reports a reset and a fresh usage check shows the limit clear."
+                  settingKeys={["autoRedeemCodexResetCredits"]}
+                  control={
+                    <ScopedSwitch
+                      settingKeys={["autoRedeemCodexResetCredits"]}
+                      checked={
+                        settings.autoRedeemCodexResetCredits[
+                          ProviderInstanceId.make(instanceId)
+                        ] === true
+                      }
+                      onCheckedChange={(checked) =>
+                        updateSettings({
+                          autoRedeemCodexResetCredits: {
+                            [ProviderInstanceId.make(instanceId)]: Boolean(checked),
+                          },
+                        })
+                      }
+                      aria-label={`Automatically redeem Codex reset for ${instance.displayName ?? "this account"}`}
+                    />
+                  }
+                />
+              ))
+          : null}
         <SettingsRow
           serverScoped
           {...searchableSetting("snooze-limited-threads")}
diff --git a/docs/user/usage.md b/docs/user/usage.md
index 447924a072eff..0e3dfd9d48093 100644
--- a/docs/user/usage.md
+++ b/docs/user/usage.md
@@ -145,6 +145,18 @@ or endpoint configurations do not report subscription limits.
 API-key accounts may not report subscription limits. This also applies to Claude connections
 using a proxy through `ANTHROPIC_AUTH_TOKEN`.
 
+## Automatically use banked Codex resets
+
+To let T3 redeem a Codex reset automatically when an included usage limit is exhausted, enable
+**Use banked Codex resets** for that account in **Settings → Usage limits**, with its server selected. This is off by default
+and applies only to that Codex provider instance. **Resume after usage limits** must also be enabled
+for T3 to continue the thread. T3 checks the account's limits before redeeming and resumes eligible
+threads early only after Codex reports a reset and a fresh limits check shows the exhausted window
+has cleared. If no credit is available or the result cannot be confirmed, the thread stays limited
+with its existing wait and manual-resume options. Automatic redemption is available for native Codex
+instances when Codex reports an account identity and banked-credit details; managed Codex instances
+remain on the existing manual and wait flow.
+
 ## Connect a CLIProxyAPI hub
 
 To see pooled accounts, open **Settings → Providers → Usage providers → Add hub**. Choose the
diff --git a/packages/contracts/src/orchestrationV2.test.ts b/packages/contracts/src/orchestrationV2.test.ts
index 3782307171e87..4266dd305bed2 100644
--- a/packages/contracts/src/orchestrationV2.test.ts
+++ b/packages/contracts/src/orchestrationV2.test.ts
@@ -12,6 +12,7 @@ import {
   OrchestrationV2Subagent,
   OrchestrationV2ThreadShellJson,
   OrchestrationV2SubagentJson,
+  OrchestrationV2LimitRecoveryUpdate,
   OrchestrationV2ThreadHistoryPage,
   OrchestrationV2TurnItem,
   OrchestrationV2TurnItemJson,
@@ -35,6 +36,18 @@ const decodeOrchestrationV2ProviderCapabilities = Schema.decodeUnknownSync(
 );
 
 describe("orchestration V2 contracts", () => {
+  it("does not accept Codex redemption evidence from client recovery updates", () => {
+    const decode = Schema.decodeUnknownSync(OrchestrationV2LimitRecoveryUpdate);
+    const update = decode({
+      runId: "run:limited",
+      resetAt: "2026-04-20T01:00:00.000Z",
+      autoResume: true,
+      codexResetRedemption: { outcome: "reset", allowanceCleared: true },
+    });
+
+    expect("codexResetRedemption" in update).toBe(false);
+  });
+
   it("decodes thread event types from a newer server as skippable items", () => {
     const decodeWireItems = Schema.decodeUnknownSync(
       Schema.toCodecJson(Schema.Array(OrchestrationV2RpcSchemas.subscribeThread.output)),
diff --git a/packages/contracts/src/orchestrationV2.ts b/packages/contracts/src/orchestrationV2.ts
index 1c80128f8bbc5..44d71a9003f2c 100644
--- a/packages/contracts/src/orchestrationV2.ts
+++ b/packages/contracts/src/orchestrationV2.ts
@@ -394,12 +394,36 @@ export const OrchestrationV2ProviderCapabilities = Schema.Struct({
 });
 export type OrchestrationV2ProviderCapabilities = typeof OrchestrationV2ProviderCapabilities.Type;
 
+export const OrchestrationV2CodexResetRedemption = Schema.Struct({
+  providerInstanceId: ProviderInstanceId,
+  redeemedByProviderInstanceId: ProviderInstanceId,
+  accountFingerprint: TrimmedNonEmptyString,
+  accountLabel: Schema.optional(TrimmedNonEmptyString),
+  idempotencyKey: TrimmedNonEmptyString,
+  attemptedAt: IsoDateTime,
+  creditId: Schema.optional(TrimmedNonEmptyString),
+  creditsBefore: NonNegativeInt,
+  outcome: Schema.Literals([
+    "pending",
+    "reset",
+    "noCredit",
+    "nothingToReset",
+    "alreadyRedeemed",
+    "unconfirmed",
+    "declined",
+  ]),
+  checkedAt: Schema.optional(IsoDateTime),
+  allowanceCleared: Schema.optional(Schema.Boolean),
+});
+export type OrchestrationV2CodexResetRedemption = typeof OrchestrationV2CodexResetRedemption.Type;
+
 export const OrchestrationV2LimitRecovery = Schema.Struct({
   requestId: Schema.optional(CommandId),
   runId: RunId,
   resetAt: IsoDateTime,
   autoResume: Schema.Boolean,
   snooze: Schema.optional(Schema.Boolean),
+  codexResetRedemption: Schema.optional(OrchestrationV2CodexResetRedemption),
 });
 export type OrchestrationV2LimitRecovery = typeof OrchestrationV2LimitRecovery.Type;
 
@@ -3349,6 +3373,15 @@ export type OrchestrationV2Command = typeof OrchestrationV2Command.Type;
 
 // Excluded from dispatchCommand so only the server can send these.
 const OrchestrationV2InternalCommand = Schema.Union([
+  /** Server-only evidence that Codex redeemed a reset and a fresh probe cleared the limit. */
+  Schema.Struct({
+    type: Schema.Literal("thread.limit-recovery.codex-reset"),
+    commandId: CommandId,
+    threadId: ThreadId,
+    runId: RunId,
+    resetAt: IsoDateTime,
+    codexResetRedemption: OrchestrationV2CodexResetRedemption,
+  }),
   // Guest share commands the server issues after checking T3 Connect and the guest token.
   Schema.Struct({
     type: Schema.Literal("thread.guest-share.open"),
diff --git a/packages/contracts/src/settings.ts b/packages/contracts/src/settings.ts
index fff25149b2e3d..72201580300fa 100644
--- a/packages/contracts/src/settings.ts
+++ b/packages/contracts/src/settings.ts
@@ -1251,6 +1251,9 @@ export const ServerSettings = Schema.Struct({
   idleCompaction: Schema.optionalKey(IdleCompactionMode),
   snoozeLimitedThreads: Schema.Boolean.pipe(Schema.withDecodingDefault(Effect.succeed(false))),
   autoResumeLimitedThreads: Schema.Boolean.pipe(Schema.withDecodingDefault(Effect.succeed(false))),
+  autoRedeemCodexResetCredits: Schema.Record(ProviderInstanceId, Schema.Boolean).pipe(
+    Schema.withDecodingDefault(Effect.succeed({})),
+  ),
   snoozePresets: SnoozePresetSettings.pipe(
     Schema.withDecodingDefault(Effect.succeed(DEFAULT_SNOOZE_PRESETS)),
   ),
@@ -1613,6 +1616,9 @@ export const ServerSettingsPatch = Schema.Struct({
   sidebarAutoSettleKeepPullRequests: Schema.optionalKey(Schema.Boolean),
   sidebarAutoSettleOnMerge: Schema.optionalKey(Schema.Boolean),
   autoResumeLimitedThreads: Schema.optionalKey(Schema.Boolean),
+  autoRedeemCodexResetCredits: Schema.optionalKey(
+    Schema.Record(ProviderInstanceId, Schema.Boolean),
+  ),
   snoozeLimitedThreads: Schema.optionalKey(Schema.Boolean),
   snoozePresets: Schema.optionalKey(SnoozePresetSettings),
   guestSharingEnabled: Schema.optionalKey(Schema.Boolean),
diff --git a/packages/provider-core/src/server/driver.ts b/packages/provider-core/src/server/driver.ts
index a1771e2e748e9..75901eb0d7d3e 100644
--- a/packages/provider-core/src/server/driver.ts
+++ b/packages/provider-core/src/server/driver.ts
@@ -32,6 +32,32 @@ export interface ProviderDriverMetadata {
 export type ProviderWorkspaceSnapshot = ServerProvider &
   Pick<ServerProviderWorkspaceSnapshot, "slashCommandsPending" | "optionDescriptors">;
 
+export type ProviderAutoResetCreditResult =
+  | {
+      readonly status: "notSent";
+      readonly reason: "probeFailed" | "notExhausted" | "noCredit" | "declined" | "keyConflict";
+      readonly accountFingerprint: string;
+      readonly creditsBefore: number;
+      readonly checkedAt?: string;
+      readonly idempotencyKey: string;
+    }
+  | {
+      readonly status: "sentUnknown";
+      readonly accountFingerprint: string;
+      readonly creditsBefore: number;
+      readonly checkedAt?: string;
+      readonly idempotencyKey: string;
+    }
+  | {
+      readonly status: "sent";
+      readonly outcome: ProviderConsumeResetCreditOutcome;
+      readonly accountFingerprint: string;
+      readonly creditsBefore: number;
+      readonly checkedAt?: string;
+      readonly allowanceCleared: boolean;
+      readonly idempotencyKey: string;
+    };
+
 export interface ProviderInstance {
   readonly instanceId: ProviderInstanceId;
   readonly driverKind: ProviderDriverKind;
@@ -49,6 +75,13 @@ export interface ProviderInstance {
     ProviderConsumeResetCreditOutcome,
     ProviderDriverError
   >;
+  readonly autoRedeemResetCredit?: (input: {
+    readonly model: string;
+    readonly idempotencyKey: string;
+    readonly expectedAccountFingerprint: string;
+    readonly mode: "first" | "replay";
+    readonly stillArmed?: () => Effect.Effect<boolean>;
+  }) => Effect.Effect<ProviderAutoResetCreditResult, ProviderDriverError>;
   readonly orchestrationAdapter: ProviderAdapter.ProviderAdapterV2["Service"];
   readonly textGeneration: ProviderTextGeneration;
   readonly auth?: ProviderAuthController;

From d168903fe459ae4d15494a9951da19e008e97ec5 Mon Sep 17 00:00:00 2001
From: ryoppippi <1560508+ryoppippi@users.noreply.github.com>
Date: Sat, 31 Oct 2026 21:04:28 +0000
Subject: [PATCH 2/6] fix(reset-recovery): keep settings compatible with React
 Compiler

React Compiler cannot lower a function call used directly as a computed object key. Bind the validated provider instance identifier before constructing reset preference patches on both clients, preserving the existing compiler checks.

Include migration 077 in the two preview-upgrade expectations so the tests cover the new account-attempt ledger without weakening migration-history assertions.
---
 .../settings/ThreadSettingsSections.tsx       | 39 +++++++-------
 .../reconcileV2PreviewMigration.test.ts       |  2 +
 .../components/settings/SettingsPanels.tsx    | 53 +++++++++----------
 3 files changed, 47 insertions(+), 47 deletions(-)

diff --git a/apps/mobile/src/features/settings/ThreadSettingsSections.tsx b/apps/mobile/src/features/settings/ThreadSettingsSections.tsx
index 26670b9635ece..56b57c3218618 100644
--- a/apps/mobile/src/features/settings/ThreadSettingsSections.tsx
+++ b/apps/mobile/src/features/settings/ThreadSettingsSections.tsx
@@ -142,26 +142,25 @@ export function AutoSettleSettingsRows(props: {
               Select one server to change per-account reset settings.
             </Text>
           ) : displayTargets.length === 1 ? (
-            codexInstances.map(([instanceId, instance]) => (
-              <SettingsSwitchRow
-                key={instanceId}
-                icon="clock"
-                label={`Use banked Codex resets${instance.displayName ? ` for ${instance.displayName}` : ""}`}
-                value={
-                  referenceSettings.autoRedeemCodexResetCredits[
-                    ProviderInstanceId.make(instanceId)
-                  ] === true
-                }
-                disabled={disabled}
-                onValueChange={(value) =>
-                  writeToAll({
-                    autoRedeemCodexResetCredits: {
-                      [ProviderInstanceId.make(instanceId)]: value,
-                    },
-                  })
-                }
-              />
-            ))
+            codexInstances.map(([rawInstanceId, instance]) => {
+              const instanceId = ProviderInstanceId.make(rawInstanceId);
+              return (
+                <SettingsSwitchRow
+                  key={instanceId}
+                  icon="clock"
+                  label={`Use banked Codex resets${instance.displayName ? ` for ${instance.displayName}` : ""}`}
+                  value={referenceSettings.autoRedeemCodexResetCredits[instanceId] === true}
+                  disabled={disabled}
+                  onValueChange={(value) =>
+                    writeToAll({
+                      autoRedeemCodexResetCredits: {
+                        [instanceId]: value,
+                      },
+                    })
+                  }
+                />
+              );
+            })
           ) : null}
         </SettingsSection>
       ) : null}
diff --git a/apps/server/src/persistence/reconcileV2PreviewMigration.test.ts b/apps/server/src/persistence/reconcileV2PreviewMigration.test.ts
index 08c5094bf49c8..7af24621d2ce8 100644
--- a/apps/server/src/persistence/reconcileV2PreviewMigration.test.ts
+++ b/apps/server/src/persistence/reconcileV2PreviewMigration.test.ts
@@ -56,6 +56,7 @@ describe("V2 preview upgrade", () => {
         [74, "ExcludeAttachmentPlaceholdersFromSearch"],
         [75, "SubagentDeliveryState"],
         [76, "ProjectionProjectsPinArchive"],
+        [77, "CodexAutoResetAttempts"],
       ]);
       assert.deepStrictEqual(yield* runMigrations(), []);
       assert.deepStrictEqual(yield* sql`SELECT * FROM orchestration_v2_legacy_imports`, imports);
@@ -155,6 +156,7 @@ describe("V2 preview upgrade", () => {
         [74, "ExcludeAttachmentPlaceholdersFromSearch"],
         [75, "SubagentDeliveryState"],
         [76, "ProjectionProjectsPinArchive"],
+        [77, "CodexAutoResetAttempts"],
       ]);
     }).pipe(Effect.provide(NodeSqliteClient.layer({ filename: ":memory:" }))),
   );
diff --git a/apps/web/src/components/settings/SettingsPanels.tsx b/apps/web/src/components/settings/SettingsPanels.tsx
index dd37e2d9a7432..98e766d9cb847 100644
--- a/apps/web/src/components/settings/SettingsPanels.tsx
+++ b/apps/web/src/components/settings/SettingsPanels.tsx
@@ -1597,33 +1597,32 @@ export function ThreadsSettingsPanel() {
                   config.setupMode === "managed"
                 );
               })
-              .map(([instanceId, instance]) => (
-                <SettingsRow
-                  key={instanceId}
-                  serverScoped
-                  title={`Use banked Codex resets${instance.displayName ? ` for ${instance.displayName}` : ""}`}
-                  description="For native Codex accounts. When an included usage limit is exhausted, redeem one banked reset and resume eligible threads after Codex reports a reset and a fresh usage check shows the limit clear."
-                  settingKeys={["autoRedeemCodexResetCredits"]}
-                  control={
-                    <ScopedSwitch
-                      settingKeys={["autoRedeemCodexResetCredits"]}
-                      checked={
-                        settings.autoRedeemCodexResetCredits[
-                          ProviderInstanceId.make(instanceId)
-                        ] === true
-                      }
-                      onCheckedChange={(checked) =>
-                        updateSettings({
-                          autoRedeemCodexResetCredits: {
-                            [ProviderInstanceId.make(instanceId)]: Boolean(checked),
-                          },
-                        })
-                      }
-                      aria-label={`Automatically redeem Codex reset for ${instance.displayName ?? "this account"}`}
-                    />
-                  }
-                />
-              ))
+              .map(([rawInstanceId, instance]) => {
+                const instanceId = ProviderInstanceId.make(rawInstanceId);
+                return (
+                  <SettingsRow
+                    key={instanceId}
+                    serverScoped
+                    title={`Use banked Codex resets${instance.displayName ? ` for ${instance.displayName}` : ""}`}
+                    description="For native Codex accounts. When an included usage limit is exhausted, redeem one banked reset and resume eligible threads after Codex reports a reset and a fresh usage check shows the limit clear."
+                    settingKeys={["autoRedeemCodexResetCredits"]}
+                    control={
+                      <ScopedSwitch
+                        settingKeys={["autoRedeemCodexResetCredits"]}
+                        checked={settings.autoRedeemCodexResetCredits[instanceId] === true}
+                        onCheckedChange={(checked) =>
+                          updateSettings({
+                            autoRedeemCodexResetCredits: {
+                              [instanceId]: Boolean(checked),
+                            },
+                          })
+                        }
+                        aria-label={`Automatically redeem Codex reset for ${instance.displayName ?? "this account"}`}
+                      />
+                    }
+                  />
+                );
+              })
           : null}
         <SettingsRow
           serverScoped

From 8bcf676a6e6df91c9f32159ecc40b4eda3329f5d Mon Sep 17 00:00:00 2001
From: ryoppippi <1560508+ryoppippi@users.noreply.github.com>
Date: Sat, 31 Oct 2026 21:16:22 +0000
Subject: [PATCH 3/6] fix(server): preserve account-specific reset recovery
 evidence

Reset recovery trusted a post-consume allowance without checking its account, overwrote fresh result metadata with cached values, and only revisited one instance after a confirmed reset. Require matching identity and preserve fresh driver evidence while probing each linked account instance independently.

Bound client acquisition and consume together for both redemption paths. Keep ambiguous automatic keys for reconciliation by either caller, expiring them at the same window boundary as the durable ledger; unknown manual keys remain guarded until settled.

Add regressions for mismatched accounts, fresh report metadata, independent instance continuation, ambiguous key reconciliation and expiry, and an app-server that never initialises.
---
 .../UsageLimitRecoveryWorker.test.ts          | 251 ++++++++++++++++++
 .../UsageLimitRecoveryWorker.ts               | 152 +++++++----
 .../src/provider/Drivers/CodexDriver.ts       |  65 +++--
 .../provider/ProviderInstanceRegistry.test.ts |  72 ++++-
 apps/server/src/provider/ProviderRegistry.ts  |   2 +
 .../src/provider/codexUsageLimits.test.ts     |   6 +
 apps/server/src/provider/codexUsageLimits.ts  |   3 +
 .../provider/resetCreditCoordinator.test.ts   |  61 +++++
 .../src/provider/resetCreditCoordinator.ts    | 100 +++++--
 .../testFixtures/codexCollabMockPeer.mjs      |   1 +
 packages/provider-core/src/server/driver.ts   |   1 +
 11 files changed, 596 insertions(+), 118 deletions(-)

diff --git a/apps/server/src/orchestration-v2/UsageLimitRecoveryWorker.test.ts b/apps/server/src/orchestration-v2/UsageLimitRecoveryWorker.test.ts
index 26b4ff52931cf..03a68f689a46c 100644
--- a/apps/server/src/orchestration-v2/UsageLimitRecoveryWorker.test.ts
+++ b/apps/server/src/orchestration-v2/UsageLimitRecoveryWorker.test.ts
@@ -4,6 +4,7 @@ import {
   ProviderDriverKind,
   RunId,
   ThreadId,
+  type OrchestrationV2LimitRecovery,
   type ServerProvider,
   type OrchestrationV2DomainEvent,
 } from "@t3tools/contracts";
@@ -105,6 +106,256 @@ it.effect("backs off a pending account attempt across repeated sweep ticks", ()
   }),
 );
 
+it.effect("reports the driver's fresh redemption timestamp and credit count", () =>
+  Effect.gen(function* () {
+    yield* TestClock.setTime(nowMs);
+    const base = failedThread(0, -HOUR_MS);
+    const fingerprint = "codex-account:fresh-result";
+    const checkedAt = DateTime.formatIso(DateTime.makeUnsafe(nowMs + 1_000));
+    const thread = {
+      ...base,
+      limitRecovery: {
+        runId: base.latestRunId!,
+        resetAt: base.usageLimitResetAt!,
+        autoResume: true,
+      },
+    };
+    const provider = {
+      instanceId: base.providerInstanceId,
+      driver: ProviderDriverKind.make("codex"),
+      usageLimits: {
+        credentialFingerprint: fingerprint,
+        checkedAt: DateTime.formatIso(DateTime.makeUnsafe(nowMs - 60_000)),
+        windows: [],
+        resetCredits: { availableCount: 1 },
+      },
+    } as unknown as ServerProvider;
+    const ledger = yield* Ref.make<ProjectionStore.CodexResetAttempt | null>(null);
+    const reports = yield* Ref.make<
+      ReadonlyArray<{
+        readonly threadId: ThreadId;
+        readonly report: NonNullable<OrchestrationV2LimitRecovery["codexResetRedemption"]>;
+      }>
+    >([]);
+    const dispatches = yield* Ref.make<ReadonlyArray<ThreadId>>([]);
+    const layer = Layer.mergeAll(
+      Layer.succeed(ProjectionStore.ProjectionStoreV2, {
+        getLimitRecoveryCandidates: () => Effect.succeed([thread]),
+        getLimitRecoveryWakeAt: () => Effect.succeed(nowMs + HOUR_MS),
+        getCodexResetAttempt: () => Ref.get(ledger),
+        claimCodexResetAttempt: (attempt: ProjectionStore.CodexResetAttempt) =>
+          Ref.set(ledger, attempt).pipe(Effect.as(true)),
+        updateCodexResetAttempt: (attempt: ProjectionStore.CodexResetAttempt) =>
+          Ref.set(ledger, attempt),
+        releaseCodexResetAttempt: () => Ref.set(ledger, null),
+      } as never),
+      Layer.mock(ThreadManagement.ThreadManagementService)({
+        dispatch: (command) =>
+          command.type === "message.dispatch"
+            ? Ref.update(dispatches, (ids) => [...ids, command.threadId]).pipe(
+                Effect.as({ sequence: 1, storedEvents: [] }),
+              )
+            : Effect.die("expected a limit continuation"),
+      }),
+      Layer.mock(Orchestrator.OrchestratorV2)({
+        streamDomainEvents: Stream.never,
+        recordCodexResetRedemption: (input) =>
+          Ref.update(reports, (entries) => [
+            ...entries,
+            { threadId: input.threadId, report: input.codexResetRedemption },
+          ]).pipe(Effect.as(true)),
+      }),
+      Layer.mock(ServerSettings.ServerSettingsService)({
+        getSettings: Effect.succeed({
+          autoResumeLimitedThreads: true,
+          snoozeLimitedThreads: false,
+          autoRedeemCodexResetCredits: { [base.providerInstanceId]: true },
+        } as never),
+        streamChanges: Stream.never,
+      }),
+      Layer.mock(ProviderRegistry.ProviderRegistry)({
+        getProviders: Effect.succeed([provider]),
+        refreshInstance: () => Effect.succeed([provider]),
+        supportsAutoRedeemResetCredit: () => Effect.succeed(true),
+        autoRedeemResetCredit: (input) =>
+          Effect.succeed({
+            status: "sent",
+            accountFingerprint: fingerprint,
+            creditsBefore: 4,
+            outcome: "reset",
+            checkedAt,
+            allowanceCleared: true,
+            idempotencyKey: input.idempotencyKey,
+          } as const),
+      }),
+    );
+    const sweep = yield* UsageLimitRecoveryWorker.makeSweep.pipe(Effect.provide(layer));
+    yield* sweep();
+
+    const driverReport = (yield* Ref.get(reports)).find(
+      (entry) => entry.threadId === base.id && entry.report.outcome === "reset",
+    );
+    assert.isDefined(driverReport);
+    assert.equal(driverReport.report.checkedAt, checkedAt);
+    assert.equal(driverReport.report.creditsBefore, 4);
+    assert.isTrue(driverReport.report.allowanceCleared);
+    assert.deepEqual(yield* Ref.get(dispatches), [base.id]);
+  }),
+);
+
+it.effect("resumes a cleared account instance after a reset while the driver remains limited", () =>
+  Effect.gen(function* () {
+    yield* TestClock.setTime(nowMs);
+    const base = failedThread(0, -HOUR_MS);
+    const driverInstanceId = base.providerInstanceId;
+    const secondInstanceId = ProviderInstanceId.make("provider-codex-second-instance");
+    const fingerprint = "codex-account:follow-up";
+    const attemptedAt = DateTime.formatIso(DateTime.makeUnsafe(nowMs - 120_000));
+    const checkedAt = DateTime.formatIso(DateTime.makeUnsafe(nowMs - 60_000));
+    const threadFor = (input: { readonly id: string; readonly instanceId: ProviderInstanceId }) => {
+      const threadId = ThreadId.make(input.id);
+      const runId = RunId.make(`run:${input.id}`);
+      return {
+        ...base,
+        id: threadId,
+        providerInstanceId: input.instanceId,
+        modelSelection: { ...base.modelSelection, instanceId: input.instanceId },
+        latestRunId: runId,
+        limitRecovery: {
+          runId,
+          resetAt: base.usageLimitResetAt!,
+          autoResume: true,
+          codexResetRedemption: {
+            providerInstanceId: input.instanceId,
+            redeemedByProviderInstanceId: driverInstanceId,
+            accountFingerprint: fingerprint,
+            idempotencyKey: "codex-auto-reset:follow-up",
+            attemptedAt,
+            creditsBefore: 1,
+            outcome: "reset" as const,
+            checkedAt: DateTime.formatIso(DateTime.makeUnsafe(nowMs - 180_000)),
+            allowanceCleared: false,
+          },
+        },
+      };
+    };
+    const driverThread = threadFor({ id: "thread:follow-up-driver", instanceId: driverInstanceId });
+    const secondThread = threadFor({ id: "thread:follow-up-second", instanceId: secondInstanceId });
+    const candidates = [driverThread, secondThread];
+    const previousAttempt: ProjectionStore.CodexResetAttempt = {
+      accountFingerprint: fingerprint,
+      resetAt: base.usageLimitResetAt!,
+      idempotencyKey: "codex-auto-reset:follow-up",
+      attemptedAt,
+      outcome: "reset",
+      allowanceCleared: false,
+      checkedAt,
+      nextCheckAt: DateTime.formatIso(DateTime.makeUnsafe(nowMs - 1_000)),
+    };
+    const ledger = yield* Ref.make(previousAttempt);
+    const cachedProvider = (instanceId: ProviderInstanceId) =>
+      ({
+        instanceId,
+        driver: ProviderDriverKind.make("codex"),
+        usageLimits: {
+          credentialFingerprint: fingerprint,
+          checkedAt: DateTime.formatIso(DateTime.makeUnsafe(nowMs - 180_000)),
+          windows: [],
+          resetCredits: { availableCount: 1 },
+        },
+      }) as unknown as ServerProvider;
+    const refreshedDriver = {
+      ...cachedProvider(driverInstanceId),
+      usageLimits: {
+        credentialFingerprint: fingerprint,
+        checkedAt,
+        windows: [
+          {
+            id: "session",
+            label: "Session",
+            usedPercent: 100,
+            resetsAt: base.usageLimitResetAt,
+          },
+        ],
+        resetCredits: { availableCount: 1 },
+      },
+    } as unknown as ServerProvider;
+    const refreshedSecond = {
+      ...cachedProvider(secondInstanceId),
+      usageLimits: {
+        credentialFingerprint: fingerprint,
+        checkedAt,
+        windows: [],
+        resetCredits: { availableCount: 1 },
+      },
+    } as unknown as ServerProvider;
+    const reports = yield* Ref.make<
+      ReadonlyArray<{
+        readonly threadId: ThreadId;
+        readonly report: NonNullable<OrchestrationV2LimitRecovery["codexResetRedemption"]>;
+      }>
+    >([]);
+    const dispatches = yield* Ref.make<ReadonlyArray<ThreadId>>([]);
+    const layer = Layer.mergeAll(
+      Layer.succeed(ProjectionStore.ProjectionStoreV2, {
+        getLimitRecoveryCandidates: () => Effect.succeed(candidates),
+        getLimitRecoveryWakeAt: () => Effect.succeed(nowMs + HOUR_MS),
+        getCodexResetAttempt: () => Ref.get(ledger),
+        updateCodexResetAttempt: (attempt: ProjectionStore.CodexResetAttempt) =>
+          Ref.set(ledger, attempt),
+      } as never),
+      Layer.mock(ThreadManagement.ThreadManagementService)({
+        dispatch: (command) =>
+          command.type === "message.dispatch"
+            ? Ref.update(dispatches, (ids) => [...ids, command.threadId]).pipe(
+                Effect.as({ sequence: 1, storedEvents: [] }),
+              )
+            : Effect.die("expected a limit continuation"),
+      }),
+      Layer.mock(Orchestrator.OrchestratorV2)({
+        streamDomainEvents: Stream.never,
+        recordCodexResetRedemption: (input) =>
+          Ref.update(reports, (entries) => [
+            ...entries,
+            { threadId: input.threadId, report: input.codexResetRedemption },
+          ]).pipe(Effect.as(true)),
+      }),
+      Layer.mock(ServerSettings.ServerSettingsService)({
+        getSettings: Effect.succeed({
+          autoResumeLimitedThreads: true,
+          snoozeLimitedThreads: false,
+          autoRedeemCodexResetCredits: {
+            [driverInstanceId]: true,
+            [secondInstanceId]: true,
+          },
+        } as never),
+        streamChanges: Stream.never,
+      }),
+      Layer.mock(ProviderRegistry.ProviderRegistry)({
+        getProviders: Effect.succeed([
+          cachedProvider(driverInstanceId),
+          cachedProvider(secondInstanceId),
+        ]),
+        refreshInstance: (instanceId) =>
+          Effect.succeed([instanceId === driverInstanceId ? refreshedDriver : refreshedSecond]),
+        supportsAutoRedeemResetCredit: () => Effect.succeed(true),
+      }),
+    );
+    const sweep = yield* UsageLimitRecoveryWorker.makeSweep.pipe(Effect.provide(layer));
+    yield* sweep();
+
+    const results = yield* Ref.get(reports);
+    const driverReport = results.find((entry) => entry.threadId === driverThread.id);
+    const secondReport = results.find((entry) => entry.threadId === secondThread.id);
+    assert.isDefined(driverReport);
+    assert.isDefined(secondReport);
+    assert.isFalse(driverReport.report.allowanceCleared);
+    assert.isTrue(secondReport.report.allowanceCleared);
+    assert.equal(secondReport.report.checkedAt, checkedAt);
+    assert.deepEqual(yield* Ref.get(dispatches), [secondThread.id]);
+  }),
+);
+
 it.effect(
   "releases a first claim after a pre-send probe failure and throttles the next probe",
   () =>
diff --git a/apps/server/src/orchestration-v2/UsageLimitRecoveryWorker.ts b/apps/server/src/orchestration-v2/UsageLimitRecoveryWorker.ts
index 3631e7636b2f3..158ce61821db7 100644
--- a/apps/server/src/orchestration-v2/UsageLimitRecoveryWorker.ts
+++ b/apps/server/src/orchestration-v2/UsageLimitRecoveryWorker.ts
@@ -264,7 +264,7 @@ export const makeSweep = Effect.gen(function* () {
           : attempt;
       let driverProvider = known;
       const notBefore = probeNotBefore.get(driverThread.providerInstanceId) ?? 0;
-      if (notBefore > nowMs) {
+      if (notBefore > nowMs && row?.outcome !== "reset") {
         retryAt = Math.min(retryAt ?? Infinity, notBefore);
         continue;
       }
@@ -272,64 +272,67 @@ export const makeSweep = Effect.gen(function* () {
         const nextCheckAt = DateTime.formatIso(
           DateTime.makeUnsafe(nowMs + AUTO_REDEEM_RETRY_BACKOFF_MS),
         );
-        probeNotBefore.set(driverThread.providerInstanceId, nowMs + AUTO_REDEEM_RETRY_BACKOFF_MS);
         yield* projections.updateCodexResetAttempt({ ...row, nextCheckAt });
-        const snapshots = yield* providers.refreshInstance(driverThread.providerInstanceId);
-        refreshedInstances.set(driverThread.providerInstanceId, snapshots);
-        driverProvider = snapshots.find(
-          (candidate) => candidate.instanceId === driverThread.providerInstanceId,
-        );
-      }
-      if (
-        !driverProvider ||
-        driverProvider.driver !== "codex" ||
-        (driverProvider.usageLimits?.credentialFingerprint !== undefined &&
-          driverProvider.usageLimits.credentialFingerprint !== fingerprint)
-      ) {
-        if (row && row.outcome === "reset" && !row.allowanceCleared)
-          yield* projections.updateCodexResetAttempt({
-            ...row,
-            nextCheckAt: DateTime.formatIso(
-              DateTime.makeUnsafe(nowMs + AUTO_REDEEM_RETRY_BACKOFF_MS),
-            ),
-          });
-        retryAt = Math.min(retryAt ?? Infinity, nowMs + AUTO_REDEEM_RETRY_BACKOFF_MS);
-        continue;
-      }
-
-      if (row?.outcome === "reset") {
-        const checkedAt = driverProvider.usageLimits?.checkedAt;
-        const freshAndClear =
-          driverProvider.usageLimits?.credentialFingerprint === fingerprint &&
-          checkedAt !== undefined &&
-          Date.parse(checkedAt) > Date.parse(row.attemptedAt) &&
-          driverProvider.usageLimits?.unavailable === undefined &&
-          exhaustedUsageWindow(driverProvider, nowMs, driverThread.modelSelection.model) ===
-            undefined;
-        const allowanceCleared = freshAndClear;
-        yield* projections.updateCodexResetAttempt({
-          ...row,
-          allowanceCleared,
-          ...(checkedAt === undefined ? {} : { checkedAt }),
-          nextCheckAt: DateTime.formatIso(
-            DateTime.makeUnsafe(nowMs + AUTO_REDEEM_RETRY_BACKOFF_MS),
-          ),
-        });
+        let driverAllowanceCleared = false;
+        let driverCheckedAt: string | undefined;
+        let driverLimitsMatch = false;
         for (const candidate of candidatesForGroup) {
+          const instanceId = candidate.providerInstanceId;
+          let candidateProvider = knownProviders.get(instanceId);
+          const refreshed = refreshedInstances.get(instanceId);
+          if (refreshed !== undefined) {
+            candidateProvider = refreshed.find((provider) => provider.instanceId === instanceId);
+          } else {
+            const candidateNotBefore = probeNotBefore.get(instanceId) ?? 0;
+            if (candidateNotBefore <= nowMs) {
+              probeNotBefore.set(instanceId, nowMs + AUTO_REDEEM_RETRY_BACKOFF_MS);
+              retryAt = Math.min(retryAt ?? Infinity, nowMs + AUTO_REDEEM_RETRY_BACKOFF_MS);
+              const snapshots = yield* providers
+                .refreshInstance(instanceId)
+                .pipe(Effect.catchCause(() => Effect.succeed([])));
+              refreshedInstances.set(instanceId, snapshots);
+              candidateProvider = snapshots.find((provider) => provider.instanceId === instanceId);
+              if (candidateProvider) knownProviders.set(instanceId, candidateProvider);
+            } else {
+              retryAt = Math.min(retryAt ?? Infinity, candidateNotBefore);
+              candidateProvider = undefined;
+            }
+          }
+          const limits = candidateProvider?.usageLimits;
+          const checkedAt =
+            limits?.credentialFingerprint === fingerprint ? limits.checkedAt : undefined;
+          const freshAndClear =
+            candidateProvider?.driver === "codex" &&
+            limits?.credentialFingerprint === fingerprint &&
+            checkedAt !== undefined &&
+            Date.parse(checkedAt) > Date.parse(row.attemptedAt) &&
+            limits.unavailable === undefined &&
+            exhaustedUsageWindow(candidateProvider, nowMs, candidate.modelSelection.model) ===
+              undefined;
+          if (candidate.id === driverThread.id) {
+            driverAllowanceCleared = freshAndClear;
+            driverCheckedAt = checkedAt;
+            driverLimitsMatch = limits?.credentialFingerprint === fingerprint;
+          }
           const report = {
             providerInstanceId: candidate.providerInstanceId,
             redeemedByProviderInstanceId:
               previousReport?.redeemedByProviderInstanceId ?? driverThread.providerInstanceId,
             accountFingerprint: fingerprint,
             accountLabel:
-              driverProvider.auth?.email ?? driverProvider.displayName ?? "Codex account",
+              candidateProvider?.auth?.email ??
+              candidateProvider?.displayName ??
+              previousReport?.accountLabel ??
+              "Codex account",
             idempotencyKey: row.idempotencyKey,
             attemptedAt: row.attemptedAt,
-            creditsBefore: previousReport?.creditsBefore ?? 1,
+            creditsBefore:
+              candidate.limitRecovery?.codexResetRedemption?.creditsBefore ??
+              previousReport?.creditsBefore ??
+              1,
             outcome: "reset" as const,
             ...(checkedAt === undefined ? {} : { checkedAt }),
-            allowanceCleared:
-              allowanceCleared && candidate.providerInstanceId === driverThread.providerInstanceId,
+            allowanceCleared: freshAndClear,
           };
           const saved = yield* orchestrator.recordCodexResetRedemption({
             commandId: CommandId.make(`limit-credit-view:${candidate.id}:${candidate.latestRunId}`),
@@ -339,7 +342,7 @@ export const makeSweep = Effect.gen(function* () {
             codexResetRedemption: report,
           });
           if (saved) acted = true;
-          if (freshAndClear && candidate.providerInstanceId === driverThread.providerInstanceId) {
+          if (freshAndClear) {
             const command = limitRecoveryCommand(
               {
                 ...candidate,
@@ -357,6 +360,24 @@ export const makeSweep = Effect.gen(function* () {
             }
           }
         }
+        yield* projections.updateCodexResetAttempt({
+          ...row,
+          allowanceCleared: driverAllowanceCleared,
+          ...(driverLimitsMatch && driverCheckedAt !== undefined
+            ? { checkedAt: driverCheckedAt }
+            : {}),
+          nextCheckAt,
+        });
+        retryAt = Math.min(retryAt ?? Infinity, nowMs + AUTO_REDEEM_RETRY_BACKOFF_MS);
+        continue;
+      }
+
+      if (
+        !driverProvider ||
+        driverProvider.driver !== "codex" ||
+        (driverProvider.usageLimits?.credentialFingerprint !== undefined &&
+          driverProvider.usageLimits.credentialFingerprint !== fingerprint)
+      ) {
         retryAt = Math.min(retryAt ?? Infinity, nowMs + AUTO_REDEEM_RETRY_BACKOFF_MS);
         continue;
       }
@@ -413,6 +434,7 @@ export const makeSweep = Effect.gen(function* () {
           instanceId: driverThread.providerInstanceId,
           model: driverThread.modelSelection.model,
           idempotencyKey,
+          resetAt: activeRow.resetAt,
           expectedAccountFingerprint: fingerprint,
           mode,
           stillArmed: Effect.fn("UsageLimitRecoveryWorker.stillArmed")(function* () {
@@ -460,12 +482,13 @@ export const makeSweep = Effect.gen(function* () {
         retryAt = Math.min(retryAt ?? Infinity, nowMs + AUTO_REDEEM_RETRY_BACKOFF_MS);
         continue;
       }
+      const resultReport = { ...pendingReport, creditsBefore: result.creditsBefore } as const;
       if (result.status === "notSent") {
         if (mode === "first") {
           yield* projections.releaseCodexResetAttempt(fingerprint, idempotencyKey);
           if (result.reason === "notExhausted" || result.reason === "noCredit") {
             const outcome = result.reason === "noCredit" ? "noCredit" : "nothingToReset";
-            const report = { ...pendingReport, outcome, allowanceCleared: false } as const;
+            const report = { ...resultReport, outcome, allowanceCleared: false } as const;
             yield* orchestrator.recordCodexResetRedemption({
               commandId: CommandId.make(
                 `limit-credit-not-sent:${driverThread.id}:${driverThread.latestRunId}`,
@@ -483,7 +506,7 @@ export const makeSweep = Effect.gen(function* () {
               threadId: driverThread.id,
               runId: driverThread.latestRunId!,
               resetAt: driverThread.usageLimitResetAt!,
-              codexResetRedemption: { ...pendingReport, outcome: "declined" },
+              codexResetRedemption: { ...resultReport, outcome: "declined" },
             });
           }
         } else {
@@ -496,7 +519,7 @@ export const makeSweep = Effect.gen(function* () {
               threadId: driverThread.id,
               runId: driverThread.latestRunId!,
               resetAt: driverThread.usageLimitResetAt!,
-              codexResetRedemption: { ...pendingReport, outcome: "declined" },
+              codexResetRedemption: { ...resultReport, outcome: "declined" },
             });
         }
         retryAt = Math.min(retryAt ?? Infinity, nowMs + AUTO_REDEEM_RETRY_BACKOFF_MS);
@@ -514,18 +537,23 @@ export const makeSweep = Effect.gen(function* () {
             ? "noCredit"
             : "nothingToReset";
       const confirmed =
-        outcome === "reset" && result.allowanceCleared && result.checkedAt !== undefined;
+        outcome === "reset" &&
+        result.accountFingerprint === fingerprint &&
+        result.allowanceCleared &&
+        result.checkedAt !== undefined &&
+        Date.parse(result.checkedAt) > Date.parse(attemptedAt);
       const report = {
-        ...pendingReport,
+        ...resultReport,
         outcome,
-        ...(result.checkedAt === undefined ? {} : { checkedAt: result.checkedAt }),
         allowanceCleared: confirmed,
       } as const;
       const accountResult: ProjectionStore.CodexResetAttempt = {
         ...activeRow,
         outcome,
         allowanceCleared: confirmed,
-        ...(result.checkedAt === undefined ? {} : { checkedAt: result.checkedAt }),
+        ...(result.accountFingerprint === fingerprint && result.checkedAt !== undefined
+          ? { checkedAt: result.checkedAt }
+          : {}),
         nextCheckAt,
       };
       yield* projections.updateCodexResetAttempt(accountResult);
@@ -553,8 +581,10 @@ export const makeSweep = Effect.gen(function* () {
           outcome === "reset" &&
           ((candidate.providerInstanceId === driverThread.providerInstanceId &&
             candidate.modelSelection.model === driverThread.modelSelection.model &&
+            result.accountFingerprint === fingerprint &&
             result.allowanceCleared &&
-            result.checkedAt !== undefined) ||
+            result.checkedAt !== undefined &&
+            Date.parse(result.checkedAt) > Date.parse(attemptedAt)) ||
             (limits?.credentialFingerprint === fingerprint &&
               candidate.providerInstanceId !== driverThread.providerInstanceId &&
               limits.checkedAt !== undefined &&
@@ -569,9 +599,13 @@ export const makeSweep = Effect.gen(function* () {
           redeemedByProviderInstanceId: driverThread.providerInstanceId,
           accountLabel:
             candidateProvider?.auth?.email ?? candidateProvider?.displayName ?? report.accountLabel,
-          ...(candidateClear && limits?.checkedAt !== undefined
-            ? { checkedAt: limits.checkedAt }
-            : {}),
+          ...(candidate.providerInstanceId === driverThread.providerInstanceId
+            ? result.accountFingerprint !== fingerprint || result.checkedAt === undefined
+              ? {}
+              : { checkedAt: result.checkedAt }
+            : candidateClear && limits?.checkedAt !== undefined
+              ? { checkedAt: limits.checkedAt }
+              : {}),
           allowanceCleared: candidateClear,
         } as const;
         const saved = yield* orchestrator.recordCodexResetRedemption({
diff --git a/apps/server/src/provider/Drivers/CodexDriver.ts b/apps/server/src/provider/Drivers/CodexDriver.ts
index c197bed95f588..2e2746155bf1b 100644
--- a/apps/server/src/provider/Drivers/CodexDriver.ts
+++ b/apps/server/src/provider/Drivers/CodexDriver.ts
@@ -317,20 +317,30 @@ export const CodexDriver: ProviderDriver<
       homeLayout.sharedHomePath,
       ...(fingerprint === undefined ? [] : [`codex-account:${fingerprint}`]),
     ];
-    const consumeWithIdempotencyKey = Effect.fn("CodexDriver.consumeResetCredit")(function* (
-      idempotencyKey: string,
-    ) {
-      const { client } = yield* withCodexAppServerClient({
-        binaryPath: effectiveConfig.binaryPath,
-        homePath: effectiveConfig.homePath,
-        launchArgs: resolveCodexLaunchArgs(effectiveConfig.launchArgs, processEnv),
-        cwd: process.cwd(),
-        environment: processEnv,
-      });
-      return (yield* client
-        .request("account/rateLimitResetCredit/consume", { idempotencyKey })
-        .pipe(Effect.timeout("20 seconds"))).outcome;
-    }, Effect.scoped);
+    const consumeWithIdempotencyKey = Effect.fn("CodexDriver.consumeResetCredit")(
+      function* (idempotencyKey: string, onSend?: () => void) {
+        const { client } = yield* withCodexAppServerClient({
+          binaryPath: effectiveConfig.binaryPath,
+          homePath: effectiveConfig.homePath,
+          launchArgs: resolveCodexLaunchArgs(effectiveConfig.launchArgs, processEnv),
+          cwd: process.cwd(),
+          environment: processEnv,
+        });
+        onSend?.();
+        const response = yield* client.request("account/rateLimitResetCredit/consume", {
+          idempotencyKey,
+        });
+        if (response.outcome === undefined)
+          return yield* new ProviderDriverError({
+            driver: DRIVER_KIND,
+            instanceId,
+            detail: "Codex returned an unrecognised reset outcome.",
+          });
+        return response.outcome;
+      },
+      Effect.scoped,
+      Effect.timeout("20 seconds"),
+    );
     const consumeResetCredit: NonNullable<ProviderInstance["consumeResetCredit"]> = Effect.fn(
       "CodexDriver.consumeResetCredit",
     )(function* () {
@@ -376,23 +386,15 @@ export const CodexDriver: ProviderDriver<
     )(function* (input) {
       const consumeAutoWithIdempotencyKey = Effect.fn("CodexDriver.consumeAutoResetCredit")(
         function* (idempotencyKey: string) {
-          const clientResult = yield* Effect.result(
-            withCodexAppServerClient({
-              binaryPath: effectiveConfig.binaryPath,
-              homePath: effectiveConfig.homePath,
-              launchArgs: resolveCodexLaunchArgs(effectiveConfig.launchArgs, processEnv),
-              cwd: process.cwd(),
-              environment: processEnv,
-            }).pipe(Effect.provideService(ChildProcessSpawner.ChildProcessSpawner, spawner)),
-          );
-          if (Result.isFailure(clientResult)) return { status: "notSent" as const };
+          let sent = false;
           const response = yield* Effect.result(
-            clientResult.success.client
-              .request("account/rateLimitResetCredit/consume", { idempotencyKey })
-              .pipe(Effect.timeout("20 seconds")),
+            consumeWithIdempotencyKey(idempotencyKey, () => {
+              sent = true;
+            }).pipe(Effect.provideService(ChildProcessSpawner.ChildProcessSpawner, spawner)),
           );
-          if (Result.isFailure(response)) return { status: "sentUnknown" as const };
-          return { status: "sent" as const, outcome: response.success.outcome };
+          if (Result.isFailure(response))
+            return sent ? { status: "sentUnknown" as const } : { status: "notSent" as const };
+          return { status: "sent" as const, outcome: response.success };
         },
         Effect.scoped,
       );
@@ -481,6 +483,9 @@ export const CodexDriver: ProviderDriver<
               return true;
             }),
           consumeAutoWithIdempotencyKey,
+          undefined,
+          (outcome) => outcome.status !== "sentUnknown",
+          input.resetAt === undefined ? undefined : Date.parse(input.resetAt),
         )
         .pipe(
           Effect.mapError(
@@ -546,6 +551,8 @@ export const CodexDriver: ProviderDriver<
               const checkedAt = limits?.checkedAt;
               const now = DateTime.toEpochMillis(yield* DateTime.now);
               const allowanceCleared = confirmsCodexResetCredit({
+                initialFingerprint,
+                freshFingerprint: limits?.credentialFingerprint,
                 outcome,
                 checkedBefore: refreshedAt,
                 checkedAt,
diff --git a/apps/server/src/provider/ProviderInstanceRegistry.test.ts b/apps/server/src/provider/ProviderInstanceRegistry.test.ts
index da3a895fcdab4..5190af37873a7 100644
--- a/apps/server/src/provider/ProviderInstanceRegistry.test.ts
+++ b/apps/server/src/provider/ProviderInstanceRegistry.test.ts
@@ -3,7 +3,7 @@ import * as CodexInstallation from "./CodexInstallation.ts";
 import * as CodexManagedTokenBroker from "./CodexManagedTokenBroker.ts";
 import * as ServerEnvironment from "../environment/ServerEnvironment.ts";
 import * as ClaudeSdk from "@anthropic-ai/claude-agent-sdk";
-import { describe, expect, it } from "@effect/vitest";
+import { assert, describe, expect, it } from "@effect/vitest";
 import { vi } from "vite-plus/test";
 import * as NodeServices from "@effect/platform-node/NodeServices";
 import {
@@ -544,6 +544,76 @@ describe("ProviderInstanceRegistry — multi-instance codex slice", () => {
       }).pipe(Effect.provide(layerTest)),
   );
 
+  it.live.skipIf(windowsHost)(
+    "releases the account lock when the reset client never initialises",
+    () =>
+      Effect.gen(function* () {
+        const fixtures = yield* makeTildeProviderFixtures();
+        const fs = yield* FileSystem.FileSystem;
+        const path = yield* Path.Path;
+        const { stateDir } = yield* ServerConfig.ServerConfig;
+        const script = {
+          rootThreadId: "probe-thread",
+          notifications: [],
+          account: { type: "chatgpt", email: "fixture@example.test", planType: "pro" },
+          rateLimits: {
+            accountId: "initialise-timeout-account",
+            rateLimits: {
+              primary: { usedPercent: 100, resetsAt: 4_102_444_800, windowDurationMins: 300 },
+            },
+            rateLimitResetCredits: { availableCount: 1 },
+          },
+          resetCreditOutcome: "alreadyRedeemed",
+          recordResetCreditConsumes: true,
+        };
+        yield* fs.writeFileString(fixtures.codexScriptPath, JSON.stringify(script));
+        const instanceId = ProviderInstanceId.make("codex_init_timeout_test");
+        const { registry } = yield* makeProviderInstanceRegistry<CodexDriverEnv>({
+          drivers: [CodexDriver],
+          configMap: {
+            [instanceId]: {
+              driver: ProviderDriverKind.make("codex"),
+              enabled: true,
+              environment: [
+                {
+                  name: "T3_CODEX_COLLAB_SCRIPT",
+                  value: fixtures.codexScriptPath,
+                  sensitive: false,
+                },
+              ],
+              config: makeCodexConfig({
+                enabled: true,
+                binaryPath: fixtures.codexBinaryPath,
+                homePath: path.join(stateDir, "codex-init-timeout-home"),
+              }),
+            },
+          },
+        });
+        const instance = yield* registry.getInstance(instanceId);
+        assert(instance?.autoRedeemResetCredit && instance.consumeResetCredit);
+        const before = yield* instance.snapshot.refresh;
+        const fingerprint = before.usageLimits?.credentialFingerprint;
+        assert(fingerprint);
+        const result = yield* instance.autoRedeemResetCredit({
+          model: "gpt-5-codex",
+          idempotencyKey: "auto-init-timeout",
+          expectedAccountFingerprint: fingerprint,
+          mode: "first",
+          stillArmed: () =>
+            fs
+              .writeFileString(
+                fixtures.codexScriptPath,
+                JSON.stringify({ ...script, ignoreInitialize: true }),
+              )
+              .pipe(Effect.as(true), Effect.orDie),
+        });
+        expect(result).toMatchObject({ status: "notSent", reason: "probeFailed" });
+        expect(yield* fs.exists(`${fixtures.codexScriptPath}.resetCreditConsumes`)).toBe(false);
+        yield* fs.writeFileString(fixtures.codexScriptPath, JSON.stringify(script));
+        expect(yield* instance.consumeResetCredit()).toBe("alreadyRedeemed");
+      }).pipe(Effect.provide(layerTest)),
+  );
+
   it.live("runs Claude instance probes in the server state dir, not the server cwd", () =>
     Effect.gen(function* () {
       if (yield* HostProcess.isWindows) return;
diff --git a/apps/server/src/provider/ProviderRegistry.ts b/apps/server/src/provider/ProviderRegistry.ts
index 122ae223d174b..faf177f0858e3 100644
--- a/apps/server/src/provider/ProviderRegistry.ts
+++ b/apps/server/src/provider/ProviderRegistry.ts
@@ -71,6 +71,7 @@ export class ProviderRegistry extends Context.Service<
       readonly model: string;
       readonly idempotencyKey: string;
       readonly expectedAccountFingerprint: string;
+      readonly resetAt?: string;
       readonly mode: "first" | "replay";
       readonly stillArmed?: () => Effect.Effect<boolean>;
     }) => Effect.Effect<ProviderAutoResetCreditResult | null, ProviderDriverError>;
@@ -698,6 +699,7 @@ export const layer = Layer.effect(
         model: input.model,
         idempotencyKey: input.idempotencyKey,
         expectedAccountFingerprint: input.expectedAccountFingerprint,
+        ...(input.resetAt === undefined ? {} : { resetAt: input.resetAt }),
         mode: input.mode,
         ...(input.stillArmed === undefined ? {} : { stillArmed: input.stillArmed }),
       });
diff --git a/apps/server/src/provider/codexUsageLimits.test.ts b/apps/server/src/provider/codexUsageLimits.test.ts
index e49fff8ef6b96..ed619c77573e7 100644
--- a/apps/server/src/provider/codexUsageLimits.test.ts
+++ b/apps/server/src/provider/codexUsageLimits.test.ts
@@ -54,12 +54,18 @@ describe("automatic Codex reset checks", () => {
   it("confirms only a reset outcome with a newer, available probe and cleared limits", () => {
     const confirmed = {
       outcome: "reset" as const,
+      initialFingerprint: "account-fingerprint",
+      freshFingerprint: "account-fingerprint",
       checkedBefore: "2026-07-18T09:59:00.000Z",
       checkedAt,
       limitsUnavailable: false,
       usageExhausted: false,
     };
     expect(confirmsCodexResetCredit(confirmed)).toBe(true);
+    expect(confirmsCodexResetCredit({ ...confirmed, freshFingerprint: "other-account" })).toBe(
+      false,
+    );
+    expect(confirmsCodexResetCredit({ ...confirmed, freshFingerprint: undefined })).toBe(false);
     expect(confirmsCodexResetCredit({ ...confirmed, outcome: "alreadyRedeemed" })).toBe(true);
     expect(confirmsCodexResetCredit({ ...confirmed, outcome: "noCredit" })).toBe(false);
     expect(confirmsCodexResetCredit({ ...confirmed, checkedAt: confirmed.checkedBefore })).toBe(
diff --git a/apps/server/src/provider/codexUsageLimits.ts b/apps/server/src/provider/codexUsageLimits.ts
index 15136d70bf4c4..b254d4d77462d 100644
--- a/apps/server/src/provider/codexUsageLimits.ts
+++ b/apps/server/src/provider/codexUsageLimits.ts
@@ -60,6 +60,8 @@ export function canAutoRedeemCodexReset(input: {
 }
 
 export function confirmsCodexResetCredit(input: {
+  readonly initialFingerprint: string;
+  readonly freshFingerprint: string | undefined;
   readonly outcome: ProviderConsumeResetCreditOutcome;
   readonly checkedBefore: string | undefined;
   readonly checkedAt: string | undefined;
@@ -67,6 +69,7 @@ export function confirmsCodexResetCredit(input: {
   readonly usageExhausted: boolean;
 }) {
   return (
+    input.freshFingerprint === input.initialFingerprint &&
     (input.outcome === "reset" || input.outcome === "alreadyRedeemed") &&
     input.checkedBefore !== undefined &&
     input.checkedAt !== undefined &&
diff --git a/apps/server/src/provider/resetCreditCoordinator.test.ts b/apps/server/src/provider/resetCreditCoordinator.test.ts
index 036e883e90a32..9b00b1142dfc3 100644
--- a/apps/server/src/provider/resetCreditCoordinator.test.ts
+++ b/apps/server/src/provider/resetCreditCoordinator.test.ts
@@ -3,6 +3,7 @@ import * as Deferred from "effect/Deferred";
 import * as Effect from "effect/Effect";
 import * as Fiber from "effect/Fiber";
 import * as Ref from "effect/Ref";
+import * as TestClock from "effect/testing/TestClock";
 
 import * as ResetCreditCoordinator from "./resetCreditCoordinator.ts";
 
@@ -33,6 +34,66 @@ describe("ResetCreditCoordinator", () => {
     }).pipe(Effect.provide(ResetCreditCoordinator.layerTest)),
   );
 
+  it.effect("keeps an ambiguous automatic key for both manual and automatic reconciliation", () =>
+    Effect.gen(function* () {
+      const { redeemIf, redeem } = yield* ResetCreditCoordinator.ResetCreditCoordinator;
+      const accounts = ["home:/codex", "codex-account:fingerprint"];
+      yield* redeemIf(
+        accounts,
+        "unknown-auto-key",
+        () => Effect.succeed(true),
+        () => Effect.succeed({ status: "sentUnknown" as const }),
+        undefined,
+        (outcome) => outcome.status !== "sentUnknown",
+      );
+      const conflict = yield* redeemIf(
+        accounts,
+        "different-auto-key",
+        () => Effect.succeed(true),
+        () => Effect.succeed("reset" as const),
+      );
+      assert.deepEqual(conflict, { _tag: "conflict", pendingKey: "unknown-auto-key" });
+      const keys = yield* Ref.make<ReadonlyArray<string>>([]);
+      const consume = (key: string) =>
+        Ref.update(keys, (seen) => [...seen, key]).pipe(Effect.as("alreadyRedeemed" as const));
+      yield* redeem(accounts, consume);
+      yield* redeem(accounts, consume);
+      const seen = yield* Ref.get(keys);
+      assert.strictEqual(seen[0], "unknown-auto-key");
+      assert.notStrictEqual(seen[1], "unknown-auto-key");
+    }).pipe(Effect.provide(ResetCreditCoordinator.layerTest)),
+  );
+
+  it.effect("releases an unknown automatic key only after its ledger window expires", () =>
+    Effect.gen(function* () {
+      yield* TestClock.setTime(0);
+      const { redeemIf } = yield* ResetCreditCoordinator.ResetCreditCoordinator;
+      yield* redeemIf(
+        "account",
+        "expired-auto-key",
+        () => Effect.succeed(true),
+        () => Effect.succeed({ status: "sentUnknown" as const }),
+        undefined,
+        (outcome) => outcome.status !== "sentUnknown",
+        60_000,
+      );
+      const next = () =>
+        redeemIf(
+          "account",
+          "new-window-key",
+          () => Effect.succeed(true),
+          () => Effect.succeed("reset" as const),
+        );
+      assert.deepEqual(yield* next(), { _tag: "conflict", pendingKey: "expired-auto-key" });
+      yield* TestClock.adjust("1 minute");
+      assert.deepEqual(yield* next(), {
+        _tag: "sent",
+        idempotencyKey: "new-window-key",
+        outcome: "reset",
+      });
+    }).pipe(Effect.provide(ResetCreditCoordinator.layerTest)),
+  );
+
   it.effect("starts a fresh attempt after a settled failure", () =>
     Effect.gen(function* () {
       const { redeem } = yield* ResetCreditCoordinator.ResetCreditCoordinator;
diff --git a/apps/server/src/provider/resetCreditCoordinator.ts b/apps/server/src/provider/resetCreditCoordinator.ts
index 9c5e2de9f32af..b89e413b4ff52 100644
--- a/apps/server/src/provider/resetCreditCoordinator.ts
+++ b/apps/server/src/provider/resetCreditCoordinator.ts
@@ -1,6 +1,7 @@
 /** Instances sharing a login directory share credits; serialize redemptions on that directory. */
 import type { ProviderConsumeResetCreditOutcome } from "@t3tools/contracts";
 import * as Context from "effect/Context";
+import * as Clock from "effect/Clock";
 import * as Crypto from "effect/Crypto";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
@@ -10,7 +11,7 @@ import * as Semaphore from "effect/Semaphore";
 
 interface AccountRedemptionState {
   readonly lock: Semaphore.Semaphore;
-  readonly pendingKey: Ref.Ref<string | null>;
+  readonly pendingKey: Ref.Ref<{ readonly key: string; readonly expiresAt?: number } | null>;
 }
 
 export class ResetCreditCoordinator extends Context.Service<
@@ -34,6 +35,8 @@ export class ResetCreditCoordinator extends Context.Service<
       shouldRedeem: () => Effect.Effect<boolean, E, R>,
       consume: (idempotencyKey: string) => Effect.Effect<A, E, R>,
       isSettled?: (error: E) => boolean,
+      isOutcomeSettled?: (outcome: A) => boolean,
+      expiresAt?: number,
     ) => Effect.Effect<
       | { readonly _tag: "declined" }
       | { readonly _tag: "conflict"; readonly pendingKey: string }
@@ -59,7 +62,9 @@ export const make = Effect.gen(function* () {
     if (existing) return existing;
     const candidate = {
       lock: yield* Semaphore.make(1),
-      pendingKey: yield* Ref.make<string | null>(null),
+      pendingKey: yield* Ref.make<{ readonly key: string; readonly expiresAt?: number } | null>(
+        null,
+      ),
     };
     return yield* Ref.modify(statesRef, (states) => {
       const current = states.get(accountKey);
@@ -91,14 +96,38 @@ export const make = Effect.gen(function* () {
     const keys = Array.from(
       new Set(typeof requested === "string" ? [requested] : requested),
     ).sort();
-    return Effect.forEach(keys, stateFor);
+    return Effect.gen(function* () {
+      const states = yield* Effect.forEach(keys, stateFor);
+      const now = yield* Clock.currentTimeMillis;
+      yield* Effect.forEach(
+        states,
+        (state) =>
+          Ref.update(state.pendingKey, (pending) =>
+            pending?.expiresAt !== undefined && pending.expiresAt <= now ? null : pending,
+          ),
+        { discard: true },
+      );
+      return states;
+    });
   };
-  const setPendingKey = (states: ReadonlyArray<AccountRedemptionState>, key: string | null) =>
-    Effect.forEach(states, (state) => Ref.set(state.pendingKey, key), { discard: true });
+  const setPendingKey = (
+    states: ReadonlyArray<AccountRedemptionState>,
+    key: string | null,
+    expiresAt?: number,
+  ) =>
+    Effect.forEach(
+      states,
+      (state) =>
+        Ref.set(
+          state.pendingKey,
+          key === null ? null : { key, ...(expiresAt === undefined ? {} : { expiresAt }) },
+        ),
+      { discard: true },
+    );
   const clearPendingKey = (states: ReadonlyArray<AccountRedemptionState>, key: string) =>
     Effect.forEach(
       states,
-      (state) => Ref.update(state.pendingKey, (current) => (current === key ? null : current)),
+      (state) => Ref.update(state.pendingKey, (current) => (current?.key === key ? null : current)),
       { discard: true },
     );
 
@@ -109,9 +138,9 @@ export const make = Effect.gen(function* () {
       Effect.gen(function* () {
         const states = yield* accountStates(accountKey);
         const pendingKeys = yield* Effect.forEach(states, (state) => Ref.get(state.pendingKey));
-        const existing = pendingKeys.find((key) => key !== null) ?? null;
-        const idempotencyKey = existing ?? requestedKey;
-        yield* setPendingKey(states, idempotencyKey);
+        const existing = pendingKeys.find((pending) => pending !== null) ?? null;
+        const idempotencyKey = existing?.key ?? requestedKey;
+        yield* setPendingKey(states, idempotencyKey, existing?.expiresAt);
         const outcome = yield* consume(idempotencyKey).pipe(
           Effect.tapError((error) =>
             isSettled?.(error) ? setPendingKey(states, null) : Effect.void,
@@ -125,27 +154,40 @@ export const make = Effect.gen(function* () {
 
   const redeemIf: ResetCreditCoordinator["Service"]["redeemIf"] = Effect.fn(
     "resetCreditCoordinator.redeemIf",
-  )(function* (accountKey, requestedKey, shouldRedeem, consume, isSettled) {
-    return yield* withAccountLocks(accountKey, () =>
-      Effect.gen(function* () {
-        const states = yield* accountStates(accountKey);
-        const pendingKeys = yield* Effect.forEach(states, (state) => Ref.get(state.pendingKey));
-        const existingKeys = pendingKeys.filter((key): key is string => key !== null);
-        const conflict = existingKeys.find((key) => key !== requestedKey);
-        if (conflict !== undefined) return { _tag: "conflict" as const, pendingKey: conflict };
-        if (!(yield* shouldRedeem())) return { _tag: "declined" as const };
-        yield* setPendingKey(states, requestedKey);
-        return yield* Effect.gen(function* () {
-          const outcome = yield* consume(requestedKey).pipe(
-            Effect.tapError((error) =>
-              isSettled?.(error) ? clearPendingKey(states, requestedKey) : Effect.void,
-            ),
+  )(
+    function* (
+      accountKey,
+      requestedKey,
+      shouldRedeem,
+      consume,
+      isSettled,
+      isOutcomeSettled,
+      expiresAt,
+    ) {
+      return yield* withAccountLocks(accountKey, () =>
+        Effect.gen(function* () {
+          const states = yield* accountStates(accountKey);
+          const pendingKeys = yield* Effect.forEach(states, (state) => Ref.get(state.pendingKey));
+          const existingKeys = pendingKeys.flatMap((pending) =>
+            pending === null ? [] : [pending.key],
           );
-          return { _tag: "sent" as const, idempotencyKey: requestedKey, outcome };
-        }).pipe(Effect.ensuring(clearPendingKey(states, requestedKey)));
-      }),
-    );
-  });
+          const conflict = existingKeys.find((key) => key !== requestedKey);
+          if (conflict !== undefined) return { _tag: "conflict" as const, pendingKey: conflict };
+          if (!(yield* shouldRedeem())) return { _tag: "declined" as const };
+          yield* setPendingKey(states, requestedKey, expiresAt);
+          return yield* Effect.gen(function* () {
+            const outcome = yield* consume(requestedKey).pipe(
+              Effect.tapError((error) =>
+                isSettled?.(error) ? clearPendingKey(states, requestedKey) : Effect.void,
+              ),
+            );
+            if (isOutcomeSettled?.(outcome) !== false) yield* clearPendingKey(states, requestedKey);
+            return { _tag: "sent" as const, idempotencyKey: requestedKey, outcome };
+          });
+        }),
+      );
+    },
+  );
 
   const redeem: ResetCreditCoordinator["Service"]["redeem"] = Effect.fn(
     "ResetCreditCoordinator.redeem",
diff --git a/apps/server/src/provider/testFixtures/codexCollabMockPeer.mjs b/apps/server/src/provider/testFixtures/codexCollabMockPeer.mjs
index 87809eda690d8..0b5c9fe9b1dc3 100644
--- a/apps/server/src/provider/testFixtures/codexCollabMockPeer.mjs
+++ b/apps/server/src/provider/testFixtures/codexCollabMockPeer.mjs
@@ -58,6 +58,7 @@ rl.on("line", (line) => {
     return;
   }
   if (method === "initialize") {
+    if (script.ignoreInitialize) return;
     write({
       id,
       result: {
diff --git a/packages/provider-core/src/server/driver.ts b/packages/provider-core/src/server/driver.ts
index 75901eb0d7d3e..110ed8d526cdd 100644
--- a/packages/provider-core/src/server/driver.ts
+++ b/packages/provider-core/src/server/driver.ts
@@ -79,6 +79,7 @@ export interface ProviderInstance {
     readonly model: string;
     readonly idempotencyKey: string;
     readonly expectedAccountFingerprint: string;
+    readonly resetAt?: string;
     readonly mode: "first" | "replay";
     readonly stillArmed?: () => Effect.Effect<boolean>;
   }) => Effect.Effect<ProviderAutoResetCreditResult, ProviderDriverError>;

From a5c5469b3f3b3d698801dc25d246c3c1700a811e Mon Sep 17 00:00:00 2001
From: ryoppippi <1560508+ryoppippi@users.noreply.github.com>
Date: Sat, 31 Oct 2026 21:22:03 +0000
Subject: [PATCH 4/6] fix(clients): show already-redeemed Codex reset outcomes

The recovery message switches omitted an outcome accepted by the contract, leaving mobile text empty and a dangling separator on web. Share one formatter between clients, handle alreadyRedeemed with the same fresh-clearance distinction as reset, and declare a string return type so future missing outcomes fail typechecking.

Cover both already-redeemed clearance states and retain the client compiler checks.
---
 .../threads/UsageLimitRecoveryCard.tsx        | 23 +----------
 .../chat/UsageLimitRecoveryBanner.tsx         | 22 +---------
 packages/shared/src/usageFormat.test.ts       | 40 ++++++++++++++++++-
 packages/shared/src/usageFormat.ts            | 27 +++++++++++++
 4 files changed, 68 insertions(+), 44 deletions(-)

diff --git a/apps/mobile/src/features/threads/UsageLimitRecoveryCard.tsx b/apps/mobile/src/features/threads/UsageLimitRecoveryCard.tsx
index a9de2921b2f4c..313f9798c8acb 100644
--- a/apps/mobile/src/features/threads/UsageLimitRecoveryCard.tsx
+++ b/apps/mobile/src/features/threads/UsageLimitRecoveryCard.tsx
@@ -1,8 +1,9 @@
+import { codexResetRedemptionMessage } from "@t3tools/shared/usageFormat";
 import { Button } from "../../components/ui/Button";
 import { squashAtomCommandFailure } from "@t3tools/client-runtime/state/runtime";
 import { AsyncResult } from "effect/reactivity";
 import type { EnvironmentThreadShell } from "@t3tools/client-runtime/state/shell";
-import type { EnvironmentId, OrchestrationV2CodexResetRedemption } from "@t3tools/contracts";
+import type { EnvironmentId } from "@t3tools/contracts";
 import * as DateTime from "effect/DateTime";
 import { useState } from "react";
 import { View } from "react-native";
@@ -108,23 +109,3 @@ export function UsageLimitRecoveryCard({
     </View>
   );
 }
-
-function codexResetRedemptionMessage(redemption: OrchestrationV2CodexResetRedemption) {
-  const account = redemption.accountLabel ?? "this Codex account";
-  if (redemption.outcome === "reset" && redemption.allowanceCleared)
-    return `Codex reported a reset for ${account}, and a fresh check found this usage limit clear.`;
-  switch (redemption.outcome) {
-    case "pending":
-      return `Checking whether Codex applied a reset for ${account}.`;
-    case "noCredit":
-      return `No reset credits were available for ${account}; this thread remains limited.`;
-    case "nothingToReset":
-      return `No reset was used for ${account}; this thread remains limited.`;
-    case "reset":
-      return `Codex reported a reset for ${account}, but this usage limit is still active.`;
-    case "unconfirmed":
-      return `Could not confirm a reset for ${account}; this thread remains limited.`;
-    case "declined":
-      return `Auto-reset skipped for ${account}; this thread remains limited.`;
-  }
-}
diff --git a/apps/web/src/components/chat/UsageLimitRecoveryBanner.tsx b/apps/web/src/components/chat/UsageLimitRecoveryBanner.tsx
index 7f5d68af0d0f1..5052050716a39 100644
--- a/apps/web/src/components/chat/UsageLimitRecoveryBanner.tsx
+++ b/apps/web/src/components/chat/UsageLimitRecoveryBanner.tsx
@@ -1,5 +1,5 @@
+import { codexResetRedemptionMessage } from "@t3tools/shared/usageFormat";
 import {
-  type OrchestrationV2CodexResetRedemption,
   type OrchestrationV2LimitRecovery,
   type OrchestrationV2LimitRecoveryUpdate,
   type RunId,
@@ -49,26 +49,6 @@ export function usageLimitRecoveryBannerItem(props: RecoveryProps): ComposerBann
   };
 }
 
-function codexResetRedemptionMessage(redemption: OrchestrationV2CodexResetRedemption) {
-  const account = redemption.accountLabel ?? "this Codex account";
-  if (redemption.outcome === "reset" && redemption.allowanceCleared)
-    return `Codex reported a reset for ${account}, and a fresh check found this usage limit clear.`;
-  switch (redemption.outcome) {
-    case "pending":
-      return `Checking whether Codex applied a reset for ${account}.`;
-    case "noCredit":
-      return `No reset credits were available for ${account}; this thread remains limited.`;
-    case "nothingToReset":
-      return `No reset was used for ${account}; this thread remains limited.`;
-    case "reset":
-      return `Codex reported a reset for ${account}, but this usage limit is still active.`;
-    case "unconfirmed":
-      return `Could not confirm a reset for ${account}; this thread remains limited.`;
-    case "declined":
-      return `Auto-reset skipped for ${account}; this thread remains limited.`;
-  }
-}
-
 function RecoveryActions({ runId, resetAt, recovery, snoozedUntil, onChange }: RecoveryProps) {
   const [pending, setPending] = useState(false);
 
diff --git a/packages/shared/src/usageFormat.test.ts b/packages/shared/src/usageFormat.test.ts
index 6682a194ab278..bcf5145beacf4 100644
--- a/packages/shared/src/usageFormat.test.ts
+++ b/packages/shared/src/usageFormat.test.ts
@@ -1,8 +1,13 @@
 // @effect-diagnostics globalDate:off -- A fixed instant keeps calendar-window assertions deterministic.
 import { describe, expect, it, vi } from "vite-plus/test";
-import type { UsageSource } from "@t3tools/contracts";
+import { ProviderInstanceId, type UsageSource } from "@t3tools/contracts";
 
-import { formatHourShort, makeWindow, usageSourceMessages } from "./usageFormat.ts";
+import {
+  codexResetRedemptionMessage,
+  formatHourShort,
+  makeWindow,
+  usageSourceMessages,
+} from "./usageFormat.ts";
 
 function malformedSource(count: number, overrides: Partial<UsageSource> = {}): UsageSource {
   return {
@@ -177,3 +182,34 @@ describe("hourly usage formatting", () => {
     }
   });
 });
+
+describe("Codex reset redemption messages", () => {
+  it.each([
+    {
+      allowanceCleared: false,
+      expected: "Codex reported a reset for Test account, but this usage limit is still active.",
+    },
+    {
+      allowanceCleared: true,
+      expected:
+        "Codex reported a reset for Test account, and a fresh check found this usage limit clear.",
+    },
+  ])(
+    "describes an already-redeemed reset with clearance $allowanceCleared",
+    ({ allowanceCleared, expected }) => {
+      expect(
+        codexResetRedemptionMessage({
+          providerInstanceId: ProviderInstanceId.make("codex"),
+          redeemedByProviderInstanceId: ProviderInstanceId.make("codex"),
+          accountFingerprint: "test-fingerprint",
+          accountLabel: "Test account",
+          idempotencyKey: "test-key",
+          attemptedAt: "2026-10-31T12:00:00.000Z",
+          creditsBefore: 1,
+          outcome: "alreadyRedeemed",
+          allowanceCleared,
+        }),
+      ).toBe(expected);
+    },
+  );
+});
diff --git a/packages/shared/src/usageFormat.ts b/packages/shared/src/usageFormat.ts
index 51398982e04c8..3c0dbbfe862a4 100644
--- a/packages/shared/src/usageFormat.ts
+++ b/packages/shared/src/usageFormat.ts
@@ -1,6 +1,7 @@
 // @effect-diagnostics globalDate:off -- Usage windows are calendar days in the viewer's zone, derived from wall-clock "now" via Intl.
 import {
   UsageDay,
+  type OrchestrationV2CodexResetRedemption,
   type UsageResolution,
   type UsageSource,
   type UsageSummaryInput,
@@ -295,3 +296,29 @@ export function makeWindow(
     resolution,
   };
 }
+
+export function codexResetRedemptionMessage(
+  redemption: OrchestrationV2CodexResetRedemption,
+): string {
+  const account = redemption.accountLabel ?? "this Codex account";
+  if (
+    (redemption.outcome === "reset" || redemption.outcome === "alreadyRedeemed") &&
+    redemption.allowanceCleared
+  )
+    return `Codex reported a reset for ${account}, and a fresh check found this usage limit clear.`;
+  switch (redemption.outcome) {
+    case "pending":
+      return `Checking whether Codex applied a reset for ${account}.`;
+    case "noCredit":
+      return `No reset credits were available for ${account}; this thread remains limited.`;
+    case "nothingToReset":
+      return `No reset was used for ${account}; this thread remains limited.`;
+    case "reset":
+    case "alreadyRedeemed":
+      return `Codex reported a reset for ${account}, but this usage limit is still active.`;
+    case "unconfirmed":
+      return `Could not confirm a reset for ${account}; this thread remains limited.`;
+    case "declined":
+      return `Auto-reset skipped for ${account}; this thread remains limited.`;
+  }
+}

From 8bb60695cca1e164f9e68e674b27afae627abac0 Mon Sep 17 00:00:00 2001
From: ryoppippi <1560508+ryoppippi@users.noreply.github.com>
Date: Sat, 31 Oct 2026 21:33:09 +0000
Subject: [PATCH 5/6] fix(reset-recovery): retain implicit instances and
 confirmed evidence

Reset preferences enumerated only stored instance overrides, omitting the enabled default Codex instance. Share eligible instance enumeration across clients and include that implicit default without replacing explicit disabled, managed or other-driver configurations.

A missing or stale refresh also erased the account ledger clearance proof. Keep the stored proof when no matching fresh probe exists, while still reporting current uncertainty on the thread and replacing clearance when a fresh check finds exhaustion.

Cover implicit instance discovery and both failed and stale probes, retaining independent continuation for another clear instance.
---
 .../settings/ThreadSettingsSections.tsx       |  24 +-
 .../UsageLimitRecoveryWorker.test.ts          | 298 +++++++++---------
 .../UsageLimitRecoveryWorker.ts               |  19 +-
 .../components/settings/SettingsPanels.tsx    |  65 ++--
 packages/shared/src/serverSettings.test.ts    |  27 ++
 packages/shared/src/serverSettings.ts         |  30 ++
 6 files changed, 254 insertions(+), 209 deletions(-)

diff --git a/apps/mobile/src/features/settings/ThreadSettingsSections.tsx b/apps/mobile/src/features/settings/ThreadSettingsSections.tsx
index 56b57c3218618..0dbc24eafbd8d 100644
--- a/apps/mobile/src/features/settings/ThreadSettingsSections.tsx
+++ b/apps/mobile/src/features/settings/ThreadSettingsSections.tsx
@@ -1,10 +1,6 @@
+import { codexAutoResetSettingsInstances } from "@t3tools/shared/serverSettings";
 import { Button } from "../../components/ui/Button";
-import {
-  AuthSettingsWriteScope,
-  ProviderDriverKind,
-  ProviderInstanceId,
-  type ServerSettingsPatch,
-} from "@t3tools/contracts";
+import { AuthSettingsWriteScope, type ServerSettingsPatch } from "@t3tools/contracts";
 import { useEnvironmentsWithScope } from "../../state/session";
 import { AutoSettleDaysField } from "./components/AutoSettleDaysField";
 import { ScreenScrollView as ScrollView } from "../../components/ui/ScreenScrollView";
@@ -81,18 +77,7 @@ export function AutoSettleSettingsRows(props: {
     return null;
   }
 
-  const codexInstances = Object.entries(referenceSettings.providerInstances).filter(
-    ([, instance]) => {
-      if (instance.driver !== ProviderDriverKind.make("codex")) return false;
-      const config = instance.config;
-      return !(
-        typeof config === "object" &&
-        config !== null &&
-        "setupMode" in config &&
-        config.setupMode === "managed"
-      );
-    },
-  );
+  const codexInstances = codexAutoResetSettingsInstances(referenceSettings);
 
   const writeToAll = (
     patch: Partial<AutoSettleSettings> & {
@@ -142,8 +127,7 @@ export function AutoSettleSettingsRows(props: {
               Select one server to change per-account reset settings.
             </Text>
           ) : displayTargets.length === 1 ? (
-            codexInstances.map(([rawInstanceId, instance]) => {
-              const instanceId = ProviderInstanceId.make(rawInstanceId);
+            codexInstances.map(([instanceId, instance]) => {
               return (
                 <SettingsSwitchRow
                   key={instanceId}
diff --git a/apps/server/src/orchestration-v2/UsageLimitRecoveryWorker.test.ts b/apps/server/src/orchestration-v2/UsageLimitRecoveryWorker.test.ts
index 03a68f689a46c..dfe897931b467 100644
--- a/apps/server/src/orchestration-v2/UsageLimitRecoveryWorker.test.ts
+++ b/apps/server/src/orchestration-v2/UsageLimitRecoveryWorker.test.ts
@@ -203,157 +203,173 @@ it.effect("reports the driver's fresh redemption timestamp and credit count", ()
   }),
 );
 
-it.effect("resumes a cleared account instance after a reset while the driver remains limited", () =>
-  Effect.gen(function* () {
-    yield* TestClock.setTime(nowMs);
-    const base = failedThread(0, -HOUR_MS);
-    const driverInstanceId = base.providerInstanceId;
-    const secondInstanceId = ProviderInstanceId.make("provider-codex-second-instance");
-    const fingerprint = "codex-account:follow-up";
-    const attemptedAt = DateTime.formatIso(DateTime.makeUnsafe(nowMs - 120_000));
-    const checkedAt = DateTime.formatIso(DateTime.makeUnsafe(nowMs - 60_000));
-    const threadFor = (input: { readonly id: string; readonly instanceId: ProviderInstanceId }) => {
-      const threadId = ThreadId.make(input.id);
-      const runId = RunId.make(`run:${input.id}`);
-      return {
-        ...base,
-        id: threadId,
-        providerInstanceId: input.instanceId,
-        modelSelection: { ...base.modelSelection, instanceId: input.instanceId },
-        latestRunId: runId,
-        limitRecovery: {
-          runId,
-          resetAt: base.usageLimitResetAt!,
-          autoResume: true,
-          codexResetRedemption: {
-            providerInstanceId: input.instanceId,
-            redeemedByProviderInstanceId: driverInstanceId,
-            accountFingerprint: fingerprint,
-            idempotencyKey: "codex-auto-reset:follow-up",
-            attemptedAt,
-            creditsBefore: 1,
-            outcome: "reset" as const,
+it.effect.each(["limited", "probeFailed", "stale"] as const)(
+  "resumes another instance and preserves ledger proof when the driver is %s",
+  (probe) =>
+    Effect.gen(function* () {
+      yield* TestClock.setTime(nowMs);
+      const base = failedThread(0, -HOUR_MS);
+      const driverInstanceId = base.providerInstanceId;
+      const secondInstanceId = ProviderInstanceId.make("provider-codex-second-instance");
+      const fingerprint = "codex-account:follow-up";
+      const attemptedAt = DateTime.formatIso(DateTime.makeUnsafe(nowMs - 120_000));
+      const checkedAt = DateTime.formatIso(DateTime.makeUnsafe(nowMs - 60_000));
+      const threadFor = (input: {
+        readonly id: string;
+        readonly instanceId: ProviderInstanceId;
+      }) => {
+        const threadId = ThreadId.make(input.id);
+        const runId = RunId.make(`run:${input.id}`);
+        return {
+          ...base,
+          id: threadId,
+          providerInstanceId: input.instanceId,
+          modelSelection: { ...base.modelSelection, instanceId: input.instanceId },
+          latestRunId: runId,
+          limitRecovery: {
+            runId,
+            resetAt: base.usageLimitResetAt!,
+            autoResume: true,
+            codexResetRedemption: {
+              providerInstanceId: input.instanceId,
+              redeemedByProviderInstanceId: driverInstanceId,
+              accountFingerprint: fingerprint,
+              idempotencyKey: "codex-auto-reset:follow-up",
+              attemptedAt,
+              creditsBefore: 1,
+              outcome: "reset" as const,
+              checkedAt: DateTime.formatIso(DateTime.makeUnsafe(nowMs - 180_000)),
+              allowanceCleared: false,
+            },
+          },
+        };
+      };
+      const driverThread = threadFor({
+        id: "thread:follow-up-driver",
+        instanceId: driverInstanceId,
+      });
+      const secondThread = threadFor({
+        id: "thread:follow-up-second",
+        instanceId: secondInstanceId,
+      });
+      const candidates = [driverThread, secondThread];
+      const previousAttempt: ProjectionStore.CodexResetAttempt = {
+        accountFingerprint: fingerprint,
+        resetAt: base.usageLimitResetAt!,
+        idempotencyKey: "codex-auto-reset:follow-up",
+        attemptedAt,
+        outcome: "reset",
+        allowanceCleared: true,
+        checkedAt,
+        nextCheckAt: DateTime.formatIso(DateTime.makeUnsafe(nowMs - 1_000)),
+      };
+      const ledger = yield* Ref.make(previousAttempt);
+      const cachedProvider = (instanceId: ProviderInstanceId) =>
+        ({
+          instanceId,
+          driver: ProviderDriverKind.make("codex"),
+          usageLimits: {
+            credentialFingerprint: fingerprint,
             checkedAt: DateTime.formatIso(DateTime.makeUnsafe(nowMs - 180_000)),
-            allowanceCleared: false,
+            windows: [],
+            resetCredits: { availableCount: 1 },
           },
+        }) as unknown as ServerProvider;
+      const refreshedDriver = {
+        ...cachedProvider(driverInstanceId),
+        usageLimits: {
+          credentialFingerprint: fingerprint,
+          checkedAt,
+          windows: [
+            {
+              id: "session",
+              label: "Session",
+              usedPercent: 100,
+              resetsAt: base.usageLimitResetAt,
+            },
+          ],
+          resetCredits: { availableCount: 1 },
         },
-      };
-    };
-    const driverThread = threadFor({ id: "thread:follow-up-driver", instanceId: driverInstanceId });
-    const secondThread = threadFor({ id: "thread:follow-up-second", instanceId: secondInstanceId });
-    const candidates = [driverThread, secondThread];
-    const previousAttempt: ProjectionStore.CodexResetAttempt = {
-      accountFingerprint: fingerprint,
-      resetAt: base.usageLimitResetAt!,
-      idempotencyKey: "codex-auto-reset:follow-up",
-      attemptedAt,
-      outcome: "reset",
-      allowanceCleared: false,
-      checkedAt,
-      nextCheckAt: DateTime.formatIso(DateTime.makeUnsafe(nowMs - 1_000)),
-    };
-    const ledger = yield* Ref.make(previousAttempt);
-    const cachedProvider = (instanceId: ProviderInstanceId) =>
-      ({
-        instanceId,
-        driver: ProviderDriverKind.make("codex"),
+      } as unknown as ServerProvider;
+      const refreshedSecond = {
+        ...cachedProvider(secondInstanceId),
         usageLimits: {
           credentialFingerprint: fingerprint,
-          checkedAt: DateTime.formatIso(DateTime.makeUnsafe(nowMs - 180_000)),
+          checkedAt,
           windows: [],
           resetCredits: { availableCount: 1 },
         },
-      }) as unknown as ServerProvider;
-    const refreshedDriver = {
-      ...cachedProvider(driverInstanceId),
-      usageLimits: {
-        credentialFingerprint: fingerprint,
-        checkedAt,
-        windows: [
-          {
-            id: "session",
-            label: "Session",
-            usedPercent: 100,
-            resetsAt: base.usageLimitResetAt,
-          },
-        ],
-        resetCredits: { availableCount: 1 },
-      },
-    } as unknown as ServerProvider;
-    const refreshedSecond = {
-      ...cachedProvider(secondInstanceId),
-      usageLimits: {
-        credentialFingerprint: fingerprint,
-        checkedAt,
-        windows: [],
-        resetCredits: { availableCount: 1 },
-      },
-    } as unknown as ServerProvider;
-    const reports = yield* Ref.make<
-      ReadonlyArray<{
-        readonly threadId: ThreadId;
-        readonly report: NonNullable<OrchestrationV2LimitRecovery["codexResetRedemption"]>;
-      }>
-    >([]);
-    const dispatches = yield* Ref.make<ReadonlyArray<ThreadId>>([]);
-    const layer = Layer.mergeAll(
-      Layer.succeed(ProjectionStore.ProjectionStoreV2, {
-        getLimitRecoveryCandidates: () => Effect.succeed(candidates),
-        getLimitRecoveryWakeAt: () => Effect.succeed(nowMs + HOUR_MS),
-        getCodexResetAttempt: () => Ref.get(ledger),
-        updateCodexResetAttempt: (attempt: ProjectionStore.CodexResetAttempt) =>
-          Ref.set(ledger, attempt),
-      } as never),
-      Layer.mock(ThreadManagement.ThreadManagementService)({
-        dispatch: (command) =>
-          command.type === "message.dispatch"
-            ? Ref.update(dispatches, (ids) => [...ids, command.threadId]).pipe(
-                Effect.as({ sequence: 1, storedEvents: [] }),
-              )
-            : Effect.die("expected a limit continuation"),
-      }),
-      Layer.mock(Orchestrator.OrchestratorV2)({
-        streamDomainEvents: Stream.never,
-        recordCodexResetRedemption: (input) =>
-          Ref.update(reports, (entries) => [
-            ...entries,
-            { threadId: input.threadId, report: input.codexResetRedemption },
-          ]).pipe(Effect.as(true)),
-      }),
-      Layer.mock(ServerSettings.ServerSettingsService)({
-        getSettings: Effect.succeed({
-          autoResumeLimitedThreads: true,
-          snoozeLimitedThreads: false,
-          autoRedeemCodexResetCredits: {
-            [driverInstanceId]: true,
-            [secondInstanceId]: true,
-          },
+      } as unknown as ServerProvider;
+      const reports = yield* Ref.make<
+        ReadonlyArray<{
+          readonly threadId: ThreadId;
+          readonly report: NonNullable<OrchestrationV2LimitRecovery["codexResetRedemption"]>;
+        }>
+      >([]);
+      const dispatches = yield* Ref.make<ReadonlyArray<ThreadId>>([]);
+      const layer = Layer.mergeAll(
+        Layer.succeed(ProjectionStore.ProjectionStoreV2, {
+          getLimitRecoveryCandidates: () => Effect.succeed(candidates),
+          getLimitRecoveryWakeAt: () => Effect.succeed(nowMs + HOUR_MS),
+          getCodexResetAttempt: () => Ref.get(ledger),
+          updateCodexResetAttempt: (attempt: ProjectionStore.CodexResetAttempt) =>
+            Ref.set(ledger, attempt),
         } as never),
-        streamChanges: Stream.never,
-      }),
-      Layer.mock(ProviderRegistry.ProviderRegistry)({
-        getProviders: Effect.succeed([
-          cachedProvider(driverInstanceId),
-          cachedProvider(secondInstanceId),
-        ]),
-        refreshInstance: (instanceId) =>
-          Effect.succeed([instanceId === driverInstanceId ? refreshedDriver : refreshedSecond]),
-        supportsAutoRedeemResetCredit: () => Effect.succeed(true),
-      }),
-    );
-    const sweep = yield* UsageLimitRecoveryWorker.makeSweep.pipe(Effect.provide(layer));
-    yield* sweep();
+        Layer.mock(ThreadManagement.ThreadManagementService)({
+          dispatch: (command) =>
+            command.type === "message.dispatch"
+              ? Ref.update(dispatches, (ids) => [...ids, command.threadId]).pipe(
+                  Effect.as({ sequence: 1, storedEvents: [] }),
+                )
+              : Effect.die("expected a limit continuation"),
+        }),
+        Layer.mock(Orchestrator.OrchestratorV2)({
+          streamDomainEvents: Stream.never,
+          recordCodexResetRedemption: (input) =>
+            Ref.update(reports, (entries) => [
+              ...entries,
+              { threadId: input.threadId, report: input.codexResetRedemption },
+            ]).pipe(Effect.as(true)),
+        }),
+        Layer.mock(ServerSettings.ServerSettingsService)({
+          getSettings: Effect.succeed({
+            autoResumeLimitedThreads: true,
+            snoozeLimitedThreads: false,
+            autoRedeemCodexResetCredits: {
+              [driverInstanceId]: true,
+              [secondInstanceId]: true,
+            },
+          } as never),
+          streamChanges: Stream.never,
+        }),
+        Layer.mock(ProviderRegistry.ProviderRegistry)({
+          getProviders: Effect.succeed([
+            cachedProvider(driverInstanceId),
+            cachedProvider(secondInstanceId),
+          ]),
+          refreshInstance: (instanceId) =>
+            instanceId === driverInstanceId
+              ? probe === "probeFailed"
+                ? Effect.die("fixture probe failed")
+                : Effect.succeed([probe === "stale" ? cachedProvider(instanceId) : refreshedDriver])
+              : Effect.succeed([refreshedSecond]),
+          supportsAutoRedeemResetCredit: () => Effect.succeed(true),
+        }),
+      );
+      const sweep = yield* UsageLimitRecoveryWorker.makeSweep.pipe(Effect.provide(layer));
+      yield* sweep();
 
-    const results = yield* Ref.get(reports);
-    const driverReport = results.find((entry) => entry.threadId === driverThread.id);
-    const secondReport = results.find((entry) => entry.threadId === secondThread.id);
-    assert.isDefined(driverReport);
-    assert.isDefined(secondReport);
-    assert.isFalse(driverReport.report.allowanceCleared);
-    assert.isTrue(secondReport.report.allowanceCleared);
-    assert.equal(secondReport.report.checkedAt, checkedAt);
-    assert.deepEqual(yield* Ref.get(dispatches), [secondThread.id]);
-  }),
+      const results = yield* Ref.get(reports);
+      const driverReport = results.find((entry) => entry.threadId === driverThread.id);
+      const secondReport = results.find((entry) => entry.threadId === secondThread.id);
+      assert.isDefined(driverReport);
+      assert.isDefined(secondReport);
+      assert.isFalse(driverReport.report.allowanceCleared);
+      assert.isTrue(secondReport.report.allowanceCleared);
+      assert.equal(secondReport.report.checkedAt, checkedAt);
+      assert.deepEqual(yield* Ref.get(dispatches), [secondThread.id]);
+      assert.equal((yield* Ref.get(ledger)).allowanceCleared, probe !== "limited");
+    }),
 );
 
 it.effect(
diff --git a/apps/server/src/orchestration-v2/UsageLimitRecoveryWorker.ts b/apps/server/src/orchestration-v2/UsageLimitRecoveryWorker.ts
index 158ce61821db7..0dae64f7ee29b 100644
--- a/apps/server/src/orchestration-v2/UsageLimitRecoveryWorker.ts
+++ b/apps/server/src/orchestration-v2/UsageLimitRecoveryWorker.ts
@@ -273,9 +273,8 @@ export const makeSweep = Effect.gen(function* () {
           DateTime.makeUnsafe(nowMs + AUTO_REDEEM_RETRY_BACKOFF_MS),
         );
         yield* projections.updateCodexResetAttempt({ ...row, nextCheckAt });
-        let driverAllowanceCleared = false;
-        let driverCheckedAt: string | undefined;
-        let driverLimitsMatch = false;
+        let driverAllowanceCleared = row.allowanceCleared;
+        let driverCheckedAt = row.checkedAt;
         for (const candidate of candidatesForGroup) {
           const instanceId = candidate.providerInstanceId;
           let candidateProvider = knownProviders.get(instanceId);
@@ -301,18 +300,20 @@ export const makeSweep = Effect.gen(function* () {
           const limits = candidateProvider?.usageLimits;
           const checkedAt =
             limits?.credentialFingerprint === fingerprint ? limits.checkedAt : undefined;
-          const freshAndClear =
+          const freshCheck =
             candidateProvider?.driver === "codex" &&
             limits?.credentialFingerprint === fingerprint &&
             checkedAt !== undefined &&
             Date.parse(checkedAt) > Date.parse(row.attemptedAt) &&
-            limits.unavailable === undefined &&
+            limits.unavailable === undefined;
+          const freshAndClear =
+            freshCheck &&
+            candidateProvider !== undefined &&
             exhaustedUsageWindow(candidateProvider, nowMs, candidate.modelSelection.model) ===
               undefined;
-          if (candidate.id === driverThread.id) {
+          if (candidate.id === driverThread.id && freshCheck) {
             driverAllowanceCleared = freshAndClear;
             driverCheckedAt = checkedAt;
-            driverLimitsMatch = limits?.credentialFingerprint === fingerprint;
           }
           const report = {
             providerInstanceId: candidate.providerInstanceId,
@@ -363,9 +364,7 @@ export const makeSweep = Effect.gen(function* () {
         yield* projections.updateCodexResetAttempt({
           ...row,
           allowanceCleared: driverAllowanceCleared,
-          ...(driverLimitsMatch && driverCheckedAt !== undefined
-            ? { checkedAt: driverCheckedAt }
-            : {}),
+          ...(driverCheckedAt !== undefined ? { checkedAt: driverCheckedAt } : {}),
           nextCheckAt,
         });
         retryAt = Math.min(retryAt ?? Infinity, nowMs + AUTO_REDEEM_RETRY_BACKOFF_MS);
diff --git a/apps/web/src/components/settings/SettingsPanels.tsx b/apps/web/src/components/settings/SettingsPanels.tsx
index 98e766d9cb847..6ad6ee876960c 100644
--- a/apps/web/src/components/settings/SettingsPanels.tsx
+++ b/apps/web/src/components/settings/SettingsPanels.tsx
@@ -1,3 +1,4 @@
+import { codexAutoResetSettingsInstances } from "@t3tools/shared/serverSettings";
 import { useAtomValue } from "@effect/atom-react";
 import { NotificationSettings } from "./NotificationSettings";
 import { PRIVACY_POLICY_URL } from "../../legalLinks";
@@ -9,7 +10,7 @@ import {
   IDLE_COMPACTION_MODES,
   globalIdleCompaction,
   ProviderDriverKind,
-  ProviderInstanceId,
+  type ProviderInstanceId,
   type SidebarProjectGroupingMode,
 } from "@t3tools/contracts";
 import {
@@ -1586,43 +1587,31 @@ export function ThreadsSettingsPanel() {
           }
         />
         {scope.kind === "environment" && connectedEnvironments.length === 1
-          ? Object.entries(settings.providerInstances)
-              .filter(([, instance]) => {
-                if (instance.driver !== ProviderDriverKind.make("codex")) return false;
-                const config = instance.config;
-                return !(
-                  typeof config === "object" &&
-                  config !== null &&
-                  "setupMode" in config &&
-                  config.setupMode === "managed"
-                );
-              })
-              .map(([rawInstanceId, instance]) => {
-                const instanceId = ProviderInstanceId.make(rawInstanceId);
-                return (
-                  <SettingsRow
-                    key={instanceId}
-                    serverScoped
-                    title={`Use banked Codex resets${instance.displayName ? ` for ${instance.displayName}` : ""}`}
-                    description="For native Codex accounts. When an included usage limit is exhausted, redeem one banked reset and resume eligible threads after Codex reports a reset and a fresh usage check shows the limit clear."
-                    settingKeys={["autoRedeemCodexResetCredits"]}
-                    control={
-                      <ScopedSwitch
-                        settingKeys={["autoRedeemCodexResetCredits"]}
-                        checked={settings.autoRedeemCodexResetCredits[instanceId] === true}
-                        onCheckedChange={(checked) =>
-                          updateSettings({
-                            autoRedeemCodexResetCredits: {
-                              [instanceId]: Boolean(checked),
-                            },
-                          })
-                        }
-                        aria-label={`Automatically redeem Codex reset for ${instance.displayName ?? "this account"}`}
-                      />
-                    }
-                  />
-                );
-              })
+          ? codexAutoResetSettingsInstances(settings).map(([instanceId, instance]) => {
+              return (
+                <SettingsRow
+                  key={instanceId}
+                  serverScoped
+                  title={`Use banked Codex resets${instance.displayName ? ` for ${instance.displayName}` : ""}`}
+                  description="For native Codex accounts. When an included usage limit is exhausted, redeem one banked reset and resume eligible threads after Codex reports a reset and a fresh usage check shows the limit clear."
+                  settingKeys={["autoRedeemCodexResetCredits"]}
+                  control={
+                    <ScopedSwitch
+                      settingKeys={["autoRedeemCodexResetCredits"]}
+                      checked={settings.autoRedeemCodexResetCredits[instanceId] === true}
+                      onCheckedChange={(checked) =>
+                        updateSettings({
+                          autoRedeemCodexResetCredits: {
+                            [instanceId]: Boolean(checked),
+                          },
+                        })
+                      }
+                      aria-label={`Automatically redeem Codex reset for ${instance.displayName ?? "this account"}`}
+                    />
+                  }
+                />
+              );
+            })
           : null}
         <SettingsRow
           serverScoped
diff --git a/packages/shared/src/serverSettings.test.ts b/packages/shared/src/serverSettings.test.ts
index a897f3d427a34..5a599b31e6724 100644
--- a/packages/shared/src/serverSettings.test.ts
+++ b/packages/shared/src/serverSettings.test.ts
@@ -18,6 +18,7 @@ import { createModelSelection } from "./model.ts";
 import { resolveProjectScripts } from "./projectScripts.ts";
 import {
   applyServerSettingsPatch,
+  codexAutoResetSettingsInstances,
   fallbackTextGenerationModelSelection,
   modelPreferencesMigrationPatch,
   resolveModelPreferences,
@@ -31,6 +32,32 @@ const decodeServerSettingsPatch = Schema.decodeUnknownSync(ServerSettingsPatch);
 
 const FOLDED_SERVER_SETTINGS = { ...DEFAULT_SERVER_SETTINGS, projectSettingsFolded: true };
 
+describe("Codex auto-reset settings instances", () => {
+  it("includes the enabled implicit Codex alongside named instances", () => {
+    expect(
+      codexAutoResetSettingsInstances({
+        providerInstances: {
+          [ProviderInstanceId.make("work-codex")]: {
+            driver: ProviderDriverKind.make("codex"),
+            displayName: "Work",
+          },
+        },
+      }).map(([id]) => id),
+    ).toEqual(["work-codex", "codex"]);
+  });
+  it.each([
+    { driver: ProviderDriverKind.make("codex"), enabled: false },
+    { driver: ProviderDriverKind.make("codex"), config: { setupMode: "managed" } },
+    { driver: ProviderDriverKind.make("claudeAgent") },
+  ])("does not replace an ineligible explicit default %j", (config) => {
+    expect(
+      codexAutoResetSettingsInstances({
+        providerInstances: { [ProviderInstanceId.make("codex")]: config },
+      }),
+    ).toEqual([]);
+  });
+});
+
 describe("fallbackTextGenerationModelSelection", () => {
   it("uses Big Pickle when only OpenCode is enabled", () => {
     expect(
diff --git a/packages/shared/src/serverSettings.ts b/packages/shared/src/serverSettings.ts
index e936c9f83acba..41572e10ec574 100644
--- a/packages/shared/src/serverSettings.ts
+++ b/packages/shared/src/serverSettings.ts
@@ -17,6 +17,7 @@ import {
   ProjectSettingsOverrides,
   ProviderDriverKind,
   ProviderInstanceId,
+  type ProviderInstanceConfig,
   type ServerProvider,
   ServerSettings,
   type ServerSettingsPatch,
@@ -49,6 +50,35 @@ export function isModelSelectionProviderEnabled(
   return isUnconfiguredDefaultInstanceEnabled(selection.instanceId);
 }
 
+export function codexAutoResetSettingsInstances(
+  settings: Pick<ServerSettings, "providerInstances">,
+) {
+  const instances = new Map<ProviderInstanceId, ProviderInstanceConfig>(
+    Object.entries(settings.providerInstances).map(([id, config]) => [
+      ProviderInstanceId.make(id),
+      config,
+    ]),
+  );
+  const codex = ProviderDriverKind.make("codex");
+  const defaultId = defaultInstanceIdForDriver(codex);
+  if (!instances.has(defaultId) && isUnconfiguredDefaultInstanceEnabled(defaultId))
+    instances.set(defaultId, { driver: codex });
+  return Array.from(instances.entries()).filter(([, instance]) => {
+    if (
+      instance.driver !== ProviderDriverKind.make("codex") ||
+      !resolveProviderInstanceEnabled(instance)
+    )
+      return false;
+    const config = instance.config;
+    return !(
+      typeof config === "object" &&
+      config !== null &&
+      "setupMode" in config &&
+      config.setupMode === "managed"
+    );
+  });
+}
+
 const TEXT_GENERATION_FALLBACK_DRIVERS = [
   "codex",
   "claudeAgent",

From 75c8be998f6e7a69dde299b75506bfba63dde28d Mon Sep 17 00:00:00 2001
From: ryoppippi <1560508+ryoppippi@users.noreply.github.com>
Date: Sat, 31 Oct 2026 21:42:11 +0000
Subject: [PATCH 6/6] fix(settings): explain the prerequisite for banked resets

Automatic redemption only runs for threads eligible for automatic continuation, but the independent reset switches did not describe that prerequisite. State that Resume after usage limits must be enabled on both clients while preserving the user-selected preferences.
---
 apps/mobile/src/features/settings/ThreadSettingsSections.tsx | 1 +
 apps/web/src/components/settings/SettingsPanels.tsx          | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/apps/mobile/src/features/settings/ThreadSettingsSections.tsx b/apps/mobile/src/features/settings/ThreadSettingsSections.tsx
index 0dbc24eafbd8d..b0ba2fde900ea 100644
--- a/apps/mobile/src/features/settings/ThreadSettingsSections.tsx
+++ b/apps/mobile/src/features/settings/ThreadSettingsSections.tsx
@@ -133,6 +133,7 @@ export function AutoSettleSettingsRows(props: {
                   key={instanceId}
                   icon="clock"
                   label={`Use banked Codex resets${instance.displayName ? ` for ${instance.displayName}` : ""}`}
+                  subtitle="Requires Resume after usage limits to be enabled."
                   value={referenceSettings.autoRedeemCodexResetCredits[instanceId] === true}
                   disabled={disabled}
                   onValueChange={(value) =>
diff --git a/apps/web/src/components/settings/SettingsPanels.tsx b/apps/web/src/components/settings/SettingsPanels.tsx
index 6ad6ee876960c..64012bfd89cc8 100644
--- a/apps/web/src/components/settings/SettingsPanels.tsx
+++ b/apps/web/src/components/settings/SettingsPanels.tsx
@@ -1593,7 +1593,7 @@ export function ThreadsSettingsPanel() {
                   key={instanceId}
                   serverScoped
                   title={`Use banked Codex resets${instance.displayName ? ` for ${instance.displayName}` : ""}`}
-                  description="For native Codex accounts. When an included usage limit is exhausted, redeem one banked reset and resume eligible threads after Codex reports a reset and a fresh usage check shows the limit clear."
+                  description="Requires Resume after usage limits to be enabled. For native Codex accounts, redeem one banked reset when an included usage limit is exhausted and resume eligible threads after Codex reports a reset and a fresh usage check shows the limit clear."
                   settingKeys={["autoRedeemCodexResetCredits"]}
                   control={
                     <ScopedSwitch