diff --git a/docs-site/src/content/docs/guides/web-dashboard.md b/docs-site/src/content/docs/guides/web-dashboard.md
index 4ad5fd7c79..896a38bb9d 100644
--- a/docs-site/src/content/docs/guides/web-dashboard.md
+++ b/docs-site/src/content/docs/guides/web-dashboard.md
@@ -131,6 +131,18 @@ and other providers.
 - **Refresh quotas** re-reads account usage immediately so routing and the account cards use the same
   values.
 - Pool request logs use opaque labels such as `p3fa91c`, never account emails.
+- **Target a specific Codex account from the model picker** is an explicit opt-in. When enabled,
+  ordinary supported GPT picker rows are replaced by one entry per public account selector.
+  Choosing one locks that conversation to the mapped account: it does not rotate, fall back, or
+  change the active Pool account. The built-in Codex App login has its own selector; generated maps
+  normally use `main`, with a collision-safe suffix such as `main-2` when needed. Added accounts
+  receive stable, privacy-safe labels, and existing custom selector labels are preserved.
+  Existing conversations and saved model selections continue routing. Turning the setting off
+  hides generated picker entries without deleting accounts, selectors, or exact routes. Plain GPT
+  model ids continue to use the configured Pool or Direct behavior.
+- Account add, remove, and picker-setting changes are saved before the model catalog is refreshed.
+  If that bounded refresh cannot finish, the dashboard shows an amber success-with-recovery notice;
+  run `ocx sync` to retry. The account or setting change itself remains saved.
 
 The Providers overview separately summarizes Pool-mode usage as a display-only weighted capacity
 estimate, alongside the effective account's raw quota and the next capacity recovery. See
@@ -166,7 +178,7 @@ The GUI is a thin client over the proxy's JSON management API. Useful endpoints
 
 | Endpoint | Purpose |
 | --- | --- |
-| `GET` / `PUT /api/settings` | Read settings or toggle Codex autostart. |
+| `GET` / `PUT /api/settings` | Read settings or update Codex autostart, stream/memory settings, and account-targeting picker visibility. |
 | `GET` / `POST /api/github/star` | Read the `gh`-derived star state, or star the repository. The POST is refused with `403` `agent_consent_required` for agent-driven callers without a dashboard session. |
 | `GET /api/startup-health` | Read secret-free routing, service, shim, and restart-safety diagnostics. |
 | `POST /api/startup-action` | Install the background service or Codex launcher shim through fixed, allowlisted actions. |
diff --git a/docs-site/src/content/docs/ja/guides/web-dashboard.md b/docs-site/src/content/docs/ja/guides/web-dashboard.md
index 955b9cad51..c63c7a77e4 100644
--- a/docs-site/src/content/docs/ja/guides/web-dashboard.md
+++ b/docs-site/src/content/docs/ja/guides/web-dashboard.md
@@ -108,6 +108,15 @@ Codex タスクだけに適用され、このオプション自体が委任を
   枠のうち最も高い使用率でスコア付けし、Go/Free プランは 30 日枠のみ使います。
 - **クォータ更新**はアカウント使用量を即座に再読み込みし、ルーティングと画面のアカウントカードが同じ値を見るようにします。
 - プールリクエストログにはメールの代わりに `p3fa91c` のような不透明なラベルを使います。
+- **モデルピッカーで使用する Codex アカウントを指定** は明示的な opt-in です。有効にすると、通常の
+  GPT picker 項目が公開 account selector ごとの項目に置き換わります。選択した会話はそのアカウントに
+  固定され、Pool のローテーションや fallback は行われず、active Pool account も変わりません。組み込みの
+  Codex App login には専用 selector があり、生成 map では通常 `main`、衝突時は `main-2` のような安全な
+  suffix が使われます。追加アカウントには安定した privacy-safe label が割り当てられます。
+  既存の会話と保存済みのモデル選択は引き続きルーティングされます。無効にしても account、selector、
+  exact route は削除されず、通常の GPT id は従来どおり Pool / Direct で動作します。
+- account の追加・削除と picker 設定は catalog refresh より先に保存されます。refresh が完了できない場合は
+  amber の回復案内が表示されます。変更自体は保存済みなので、`ocx sync` で refresh を再試行してください。
 
 Providers の概要は、Pool モードの使用状況を表示専用の重み付き容量推定値として別途まとめ、現在の
 有効アカウントの生のクォータと次の容量回復も併せて表示します。表示される項目、不完全な対象範囲の
@@ -119,7 +128,7 @@ GUI はプロキシの JSON 管理 API を使うシンクライアントです
 
 | エンドポイント | 用途 |
  --- | --- |
-| `GET` / `PUT /api/settings` | 設定を読むか Codex 自動起動をオン/オフします。 |
+| `GET` / `PUT /api/settings` | 設定を読み、Codex 自動起動、stream/memory、account-targeting picker の表示を更新します。 |
 | `GET /api/startup-health` | 秘密情報を含まないルーティング、サービス、shim、再起動安全性診断を読み取ります。 |
 | `GET` / `POST /api/windows-tray` | Windows トレイの導入・表示状態を読み取り、`install`、`start`、`stop`、`uninstall` を実行します。 |
 | `POST /api/sync` | 共有モデルカタログを再構築し Codex モデルキャッシュを古い状態としてマークします。 |
diff --git a/docs-site/src/content/docs/ja/reference/cli/providers-accounts.md b/docs-site/src/content/docs/ja/reference/cli/providers-accounts.md
index 9c6e6edf7d..cab525623a 100644
--- a/docs-site/src/content/docs/ja/reference/cli/providers-accounts.md
+++ b/docs-site/src/content/docs/ja/reference/cli/providers-accounts.md
@@ -180,17 +180,20 @@ preemption が未バインドリクエストを直ちに引き上げます。既
 
 ### `ocx account login|reauth|code|cancel ...`
 
-ヘッドレス シェルからブラウザベースまたは手動コードのアカウント認証を実行します。プロバイダー固有のコマンド形式には `ocx account --help` を使用します。
+ヘッドレス シェルからブラウザベースまたは手動コードのアカウント認証を実行します。プロバイダー固有のコマンド形式には `ocx account --help` を使用します。Codex account login は保存済みでも catalog refresh が保留中なら成功終了し、human output の stderr に固定の `ocx sync` 案内を出します。`--json` は案内を混ぜず、完了 state に `catalogRefreshPending: true` を保持します。
 
 ### `ocx account remove <provider> <id|main> --yes [--json]`
 
 この保護された非対話型削除には `--yes` が必要です。削除する前に、ID が存在することが確認されます。 ID が欠落している場合は、DELETE を送信せずに 1 が終了します。メインの Codex App ログインは削除できないため、`remove openai main --yes` は拒否されます。削除後、ファミリーは再度読み取られます。固定された Codex アカウントを削除すると、ピンがクリアされ、自動選択に戻ります。 OAuth は最初に残ったアカウントを昇格させるか、何も報告しません。 API キー プールは、最初に残っているキーを昇格するか、何も報告しません。 `--json` の成功と失敗の形状は次のとおりです。
 
 ```text
-{ ok: true, provider, id, removedActive: boolean, promotedActiveId: string | null }
+{ ok: true, provider, id, removedActive: boolean, promotedActiveId: string | null, catalogRefreshPending?: boolean }
 { error: string } // stderr, exit 1
 ```
 
+`catalogRefreshPending` は Codex 削除だけに含まれます。`true` でも削除は保存済みで、human output は
+stderr に `ocx sync` の案内を出して終了コード 0 のままです。OAuth account と API key の削除形状は変わりません。
+
 ### `ocx account add-key <provider> [--label <label>] [--json]`
 
 API キー プロバイダーのキーを追加してアクティブ化します。キーは、非 TTY パイプ/リダイレクトされた標準入力からの読み取り専用です。インタラクティブ TTY 入力、空の入力、OAuth/Codex プロバイダー、および API エラー終了 1。キーがラベル内に表示される場合も含め、キーがエコーされることはありません。シークレット マネージャーまたはヒア文字列を使用することをお勧めします。
diff --git a/docs-site/src/content/docs/ja/reference/configuration/providers.md b/docs-site/src/content/docs/ja/reference/configuration/providers.md
index a618fe04d3..19c02b67a1 100644
--- a/docs-site/src/content/docs/ja/reference/configuration/providers.md
+++ b/docs-site/src/content/docs/ja/reference/configuration/providers.md
@@ -39,6 +39,11 @@ namespace 付き combo または routing-profile alias はその namespace prefi
 非公開のままにし、selector を公開名として使ってください。明示的な選択の動作と優先順位は
 [ルーティング構成](/reference/configuration/routing/)を参照してください。
 
+Codex Auth dashboard が管理する map には明示的な `codexAccountPickerEnabled` field があります。空の
+managed map を有効にすると privacy-safe selector が作られ、その後の account 追加は picker を非表示に
+している間も既存 label を変えずに map を拡張します。flag を省略した手書き map は自動拡張されません。
+account を削除しても mapping は保持され、同じ id を再追加すると新しい selector ではなく既存 selector が戻ります。
+
 ## 予約済み OpenAI プロバイダー
 
 `openai` および `openai-apikey` は固定予約 ID です。 `openai.codexAccountMode` はデフォルトでは `"pool"` で、メインアカウントと追加アカウント全体を選択します。 `"direct"` は、現在の呼び出し元/メイン ログインのみを使用します。 API は、設定された API キーまたはキー プールのみを使用します。ベア モデルまたは `openai-apikey/<model>` を使用します。クロスルート認証情報のフォールバックはありません。 API GPT-5.6 行は 1,050,000 コンテキスト / 最大 922,000 入力メタデータを伝送し、Pro 仮想 ID は `reasoning.mode: "pro"` を使用してベース ワイヤー モデルに書き換えられます。
diff --git a/docs-site/src/content/docs/ja/reference/configuration/routing.md b/docs-site/src/content/docs/ja/reference/configuration/routing.md
index 2eda8fa3c7..56f1597bcc 100644
--- a/docs-site/src/content/docs/ja/reference/configuration/routing.md
+++ b/docs-site/src/content/docs/ja/reference/configuration/routing.md
@@ -16,15 +16,16 @@ description: デフォルトのプロバイダーの選択、モデルの解決
 
 opencodex は、要求されたモデルを次の順序で解決します。
 
-1. 設定済みの `<account-selector>/<native-openai-model>` namespace。対応する保存済み Codex アカウントだけに routing され、無効または利用不能な exact target は fail closed します。
-2. 正規の `combo/<id>` または構成されたコンボ エイリアス。正規 ID は、エイリアスが一致する前に優先されます。
-3. 構成されたプロバイダーを示すプレフィックスを持つ明示的な `<provider>/<model>` 名前空間。
-4. `gpt-*`、`o1-*`、`o3-*`、`o4-*` などのベア ネイティブ OpenAI ファミリ ID。
-正規対応の `openai` プロバイダー。
-5. プロバイダーの `defaultModel` と完全に一致します。
-6. 既知のプロバイダー ファミリ モデル プレフィックス。
-7. プロバイダーの構成された `models` リスト内の正確なモデル。
-8. `defaultProvider`、要求されたモデル ID を保持します。
+1. 設定済みの `policy/<id>` または routing-profile alias。policy evaluator を実行して選択した候補へ routing します。未解決の `policy/<id>` は後続のルールへフォールスルーします。
+2. 設定済みの `<account-selector>/<native-openai-model>` namespace。対応する保存済み Codex アカウントだけに routing され、無効または利用不能な exact target は fail closed します。
+3. 正規の `combo/<id>` または構成されたコンボ エイリアス。正規 ID は、エイリアスが一致する前に優先されます。
+4. 構成されたプロバイダーを示すプレフィックスを持つ明示的な `<provider>/<model>` 名前空間。
+5. `gpt-*`、`o1-*`、`o3-*`、`o4-*` などのベア ネイティブ OpenAI ファミリ ID。
+   正規対応の `openai` プロバイダー。
+6. プロバイダーの `defaultModel` と完全に一致します。
+7. 既知のプロバイダー ファミリ モデル プレフィックス。
+8. プロバイダーの構成された `models` リスト内の正確なモデル。
+9. `defaultProvider`、要求されたモデル ID を保持します。
 
 無効なプロバイダーは除外されます。無効なプロバイダーの明示的な名前空間は、フォールスルーではなく失敗します。プロバイダー エントリは、複数のプロバイダーに一致する可能性のあるルールの JSON 挿入順序でチェックされるため、ベア モデルがあいまいな可能性がある場合は明示的な名前空間を使用します。
 
@@ -44,6 +45,11 @@ selector の後には bare native OpenAI-family id だけを指定できます
 が存在しない selector は表示されません。selector の検証、衝突規則、privacy guidance は
 [プロバイダーの構成](/reference/configuration/providers/)を参照してください。
 
+Codex Auth ページではこの picker 動作を opt-in できます。無効化すると selector-qualified row は非表示に
+なり通常の GPT row が戻りますが、mapping と exact `<selector>/<model>` routing は残るため、再有効化で
+同じ公開 label が復元されます。mutation は bounded catalog refresh より先に保存され、`ocx sync` warning は
+picker catalog の convergence だけが保留中で routing change は失われていないことを示します。
+
 ## コンボ (`config.combos`)
 
 各コンボ キーは `[A-Za-z0-9][A-Za-z0-9._-]{0,63}` に一致する ID です。これは常に `combo/<id>` として直接アドレス指定可能であり、1 つの `alias` を公開することもあります。エイリアスは一意である必要があり、`combo/` 名前空間を占有することはできず、`gpt-*`、`o1-*`、`o3-*`、`o4-*`、または `codex-*` などの予約されたベア ネイティブ ファミリを使用することはできません。
diff --git a/docs-site/src/content/docs/ja/reference/management-api.md b/docs-site/src/content/docs/ja/reference/management-api.md
index 56f23e6146..a2a8c1ddac 100644
--- a/docs-site/src/content/docs/ja/reference/management-api.md
+++ b/docs-site/src/content/docs/ja/reference/management-api.md
@@ -87,7 +87,7 @@ Authorization: Bearer <admin-token>
 | --- | --- | --- |
 | `GET /api/config` |編集された、管理上安全な構成 DTO を返します。 — |
 | `PUT /api/config` |フルコンフィグ置換ガードを無効にする | 405;代わりにフォーカスされたエンドポイントを使用してください。
-| `GET, PUT /api/settings` |ランタイム/起動設定の読み取り、または自動起動、ストリーム モード、アプリ所有のメモリ バジェットの更新 | 400 無効または空の更新 |
+| `GET, PUT /api/settings` |ランタイム/起動設定の読み取り、または自動起動、ストリーム モード、アプリ所有のメモリ バジェット、`codexAccountPickerEnabled` の更新 | 400 無効、object 以外、または空の更新 |
 | `GET /api/startup-health` |キャッシュされたサービス/シムの起動状態を読み取る | — |
 | `POST /api/startup-action` |サービスまたは Codex シムをインストールまたは修復する | 400 無効なアクション。 500 アクション失敗 |
 | `GET, POST /api/windows-tray` | Windows トレイの状態を読み取るか、インストール/起動/停止/アンインストールする | 400 のサポートされていないプラットフォーム/アクション。 500 操作失敗 |
@@ -197,11 +197,16 @@ Authorization: Bearer <admin-token>
 
 ### Codex認証の委任
 
+`GET /api/settings` は有効な `codexAccountPickerEnabled` boolean を返します。この strict boolean を
+`PUT` すると、空の map を有効化する場合は privacy-safe selector を初期化し、既存 label を保持したまま
+先に永続化し、有効な picker 表示が変わったときだけ bounded catalog convergence を 1 回要求します。
+成功応答の `catalogRefreshPending: true` は設定は保存済みだが `POST /api/sync` による再試行が必要という意味です。
+
 ルート管理ディスパッチャーは、すべての `/api/codex-auth/*` リクエストを Codex アカウント マネージャーに委任します。そのルートは次のとおりです。
 
 |メソッドとパス |目的 |注目すべきエラー |
 | --- | --- | --- |
-| `GET, POST, DELETE /api/codex-auth/accounts` | Codex アカウントの一覧表示/更新、必要に応じてインポート、削除 | 400 無効な入力。手動インポートは無効にすることができます。
+| `GET, POST, DELETE /api/codex-auth/accounts` | Codex アカウントの一覧表示/更新、必要に応じてインポート、削除。成功した POST/DELETE は `catalogRefreshPending` を返します。 | 400 無効な入力。手動インポートは無効にすることができます。 |
 | `PUT /api/codex-auth/accounts/alias` |アカウント エイリアスの設定またはクリア | 400 無効なアカウント/エイリアス |
 | `PUT /api/codex-auth/accounts/pause` | 1 つのアカウントを一時停止または再開する | 400 無効なアカウント/状態。 404 アカウントが見つかりません |
 | `PUT /api/codex-auth/accounts/pause-exhausted` |クォータを使い果たしたアカウントを一時停止する |ミューテーションロックの失敗は 503 になります |
@@ -216,10 +221,20 @@ Authorization: Bearer <admin-token>
 | `POST /api/codex-auth/login` | Codex のログインまたは再認証を開始する | 400 無効なリクエスト。競合/ビジー ログイン状態 |
 | `POST /api/codex-auth/login/code` | Codex ログイン フローの手動コードを送信する | 400 無効なフロー/コード |
 | `POST /api/codex-auth/login/cancel` | Codex ログイン フローをキャンセルする | — |
-| `GET /api/codex-auth/login-status` |フローまたはアカウントのログイン状態をポーリングする |不明なフローは `expired` を報告します。アクティブなフローは `idle` を報告しません |
+| `GET /api/codex-auth/login-status` |フローまたはアカウントのログイン状態をポーリングする。新規アカウント完了時は回復が必要な場合だけ `catalogRefreshPending: true` を含みます。 |不明なフローは `expired` を報告します。アクティブなフローは `idle` を報告しません |
+
+新規 account の config row は保存されたものの credential setup を完了できない場合、manual POST は
+HTTP 500 を返し、OAuth の `login-status` は `status: "error"` を報告します。どちらも
+`code: "codex_credential_persistence_failed"`、`accountId`、`needsReauth: true`、必要に応じて
+`catalogRefreshPending: true` を含み、storage error の詳細は公開しません。account row は保存済みなので、
+account 作成を再試行する前に再認証するか削除してください。
 
 この委任されたファミリーでの構成ライターまたは資格情報の更新ロックのタイムアウトは、コード `CONFIG_MUTATION_LOCK_UNAVAILABLE` の HTTP 503 を返します。クライアントは、その応答を永久的なアカウント障害として扱うのではなく、すぐに再試行する必要があります。
 
+アカウント作成と削除は catalog convergence より先に永続化されます。失敗または延期された catalog 処理は
+保存済み mutation をロールバックせず、内部 provider/account/path/credential detail も返しません。削除した
+account の selector binding は残るため、欠落中の exact route は fail closed し、同じ id の再追加で同じ selector が戻ります。
+
 ## クライアントの選択
 
 通常の管理では、[ウェブダッシュボード](/guides/web-dashboard/) が最も安全なガイド付きワークフローを提供します。ヘッドレス ホストとオートメーションの場合は、対応する `ocx` コマンドを使用します。これらのコマンドは、これと同じライブ API を呼び出し、プロキシに到達できない場合、または操作が失敗した場合にゼロ以外の結果を返します。ダイレクト HTTP は、上記の正確なエンドポイント コントラクトを必要とする統合に最も役立ちます。
diff --git a/docs-site/src/content/docs/ko/guides/web-dashboard.md b/docs-site/src/content/docs/ko/guides/web-dashboard.md
index cafdef8421..9ec0fe4092 100644
--- a/docs-site/src/content/docs/ko/guides/web-dashboard.md
+++ b/docs-site/src/content/docs/ko/guides/web-dashboard.md
@@ -108,6 +108,15 @@ Dashboard의 **Sub-agent delegation** 선택기는 `injectionModel`과 선택적
   30일 창으로 분류합니다. 기간이 없는 기존 응답은 이전과 동일하게 주간 창으로 해석합니다.
 - **Refresh quotas**는 계정 사용량을 즉시 다시 읽어 라우팅과 화면의 계정 카드가 같은 값을 보게 합니다.
 - 풀 요청 로그에는 이메일 대신 `p3fa91c` 같은 불투명한 라벨을 사용합니다.
+- **모델 선택기에서 사용할 Codex 계정 지정**은 명시적 opt-in입니다. 활성화하면 일반 GPT picker 항목이
+  공개 account selector별 항목으로 대체됩니다. 선택한 대화는 해당 계정에 고정되며 Pool 순환이나
+  fallback이 일어나지 않고 active Pool account도 바뀌지 않습니다. 기본 Codex App 로그인에는 자체
+  selector가 있으며, 생성된 map에서는 보통 `main`, 충돌 시 `main-2` 같은 안전한 suffix를 사용합니다.
+  추가 계정에는 안정적인 privacy-safe label이 부여됩니다. 기존 대화와 저장된 모델 선택은 계속
+  라우팅됩니다. 비활성화해도 계정, selector, exact route는 삭제되지 않으며 일반 GPT id는 기존 Pool /
+  Direct 동작을 유지합니다.
+- 계정 추가·삭제와 picker 설정은 catalog refresh보다 먼저 저장됩니다. refresh가 끝나지 않으면 amber
+  복구 안내가 표시됩니다. 변경 자체는 저장되어 있으므로 `ocx sync`로 refresh를 다시 시도하십시오.
 
 Providers 개요는 Pool 모드 사용량을 표시 전용 가중 용량 추정치로 별도 요약하고, 현재 유효 계정의
 원본 quota와 다음 용량 회복도 함께 표시합니다. 표시 필드, 불완전한 범위의 의미, 라우팅 경계는
@@ -139,7 +148,7 @@ GUI는 프록시의 JSON 관리 API를 사용하는 얇은 클라이언트입니
 
 | 엔드포인트 | 용도 |
 | --- | --- |
-| `GET` / `PUT /api/settings` | 설정을 읽거나 Codex 자동 시작을 켜고 끕니다. |
+| `GET` / `PUT /api/settings` | 설정을 읽고 Codex 자동 시작, stream/memory, account-targeting picker 표시를 업데이트합니다. |
 | `GET` / `POST /api/github/star` | `gh`로 확인한 스타 상태를 읽거나 저장소에 스타를 남깁니다. 대시보드 세션 없이 에이전트가 POST하면 `403` `agent_consent_required`로 거절합니다. |
 | `GET /api/startup-health` | 비밀값 없이 라우팅, 서비스, shim, 재부팅 안전성 진단을 읽습니다. |
 | `GET` / `POST /api/windows-tray` | Windows 트레이 설치 및 표시 상태를 읽거나 `install`, `start`, `stop`, `uninstall` 작업을 수행합니다. |
diff --git a/docs-site/src/content/docs/ko/reference/cli/providers-accounts.md b/docs-site/src/content/docs/ko/reference/cli/providers-accounts.md
index 5f9624b80a..5b7bd66ca9 100644
--- a/docs-site/src/content/docs/ko/reference/cli/providers-accounts.md
+++ b/docs-site/src/content/docs/ko/reference/cli/providers-accounts.md
@@ -179,17 +179,20 @@ Codex pool 계정 하나의 선택 순서를 읽거나 설정합니다. **값이
 
 ### `ocx account login|reauth|code|cancel ...`
 
-헤드리스 셸에서 브라우저 기반 또는 수동 코드 계정 인증을 실행합니다. 제공자별 명령 형태는 `ocx account --help`를 보십시오.
+헤드리스 셸에서 브라우저 기반 또는 수동 코드 계정 인증을 실행합니다. 제공자별 명령 형태는 `ocx account --help`를 보십시오. Codex account login이 저장되었지만 catalog refresh가 보류 중이면 성공으로 종료하고 human output의 stderr에 고정된 `ocx sync` 안내를 표시합니다. `--json`은 안내를 섞지 않고 완료 state의 `catalogRefreshPending: true`를 유지합니다.
 
 ### `ocx account remove <provider> <id|main> --yes [--json]`
 
 이 보호된 비대화형 삭제는 `--yes`를 요구합니다. 삭제하기 전에 id가 존재하는지 확인하며, 없는 id는 DELETE를 보내지 않고 종료 코드 1로 끝납니다. Codex App의 main 로그인은 제거할 수 없으므로 `remove openai main --yes`는 거부됩니다. 삭제 후에는 해당 계열을 다시 읽습니다. 고정된 Codex 계정을 제거하면 고정이 풀리고 자동 선택으로 돌아갑니다. OAuth는 남아 있는 첫 번째 계정으로 승격하거나 없다고 보고합니다. API 키 풀은 남아 있는 첫 번째 키로 승격하거나 없다고 보고합니다. `--json`의 성공 및 실패 형식은 다음과 같습니다:
 
 ```text
-{ ok: true, provider, id, removedActive: boolean, promotedActiveId: string | null }
+{ ok: true, provider, id, removedActive: boolean, promotedActiveId: string | null, catalogRefreshPending?: boolean }
 { error: string } // stderr, exit 1
 ```
 
+`catalogRefreshPending`는 Codex 삭제에만 포함됩니다. `true`여도 삭제는 이미 저장되었으며 human output은
+stderr에 `ocx sync` 안내를 표시하고 종료 코드 0을 유지합니다. OAuth account와 API key 삭제 형식은 바뀌지 않습니다.
+
 ### `ocx account add-key <provider> [--label <label>] [--json]`
 
 API 키 제공자에 키를 추가하고 활성화합니다. 키는 비TTY 파이프/리디렉션 stdin에서만 읽습니다. 대화형 TTY 입력, 빈 입력, OAuth/Codex 제공자, API 실패는 종료 코드 1로 끝납니다. 라벨 안에 들어 있더라도 키는 절대 출력되지 않습니다. 비밀 관리자나 here-string을 쓰는 편이 좋습니다:
diff --git a/docs-site/src/content/docs/ko/reference/configuration/providers.md b/docs-site/src/content/docs/ko/reference/configuration/providers.md
index 4fa263a460..1124b4481a 100644
--- a/docs-site/src/content/docs/ko/reference/configuration/providers.md
+++ b/docs-site/src/content/docs/ko/reference/configuration/providers.md
@@ -39,6 +39,11 @@ target도 selector로 재사용할 수 없습니다. raw account id와 email은
 유지하고 selector를 공개 이름으로 사용하세요. 명시적 선택 동작과 우선순위는
 [라우팅 설정](/ko/reference/configuration/routing/)을 참고하십시오.
 
+Codex Auth dashboard가 관리하는 map에는 명시적인 `codexAccountPickerEnabled` field가 있습니다. 빈
+managed map을 활성화하면 privacy-safe selector를 만들고, 이후 계정 추가는 picker가 숨겨진 동안에도
+기존 label을 바꾸지 않고 map을 확장합니다. flag가 생략된 수동 map은 자동 확장되지 않습니다. 계정을
+삭제해도 mapping은 유지되며 같은 id를 다시 추가하면 새 selector 대신 기존 selector가 복원됩니다.
+
 ## 예약된 OpenAI 공급자
 
 `openai`와 `openai-apikey`는 고정 예약 id입니다. `openai.codexAccountMode`의 기본값은 `"pool"`이며, 메인 계정과 추가된 계정 전체에서 선택합니다. `"direct"`는 현재 호출자/메인 로그인만 사용합니다. API는 설정된 API 키 또는 키 풀만 사용합니다. 모델 이름만 쓰거나 `openai-apikey/<model>`을 사용하십시오. 다른 라우트의 자격 증명으로는 대체하지 않습니다. API GPT-5.6 행에는 1,050,000 컨텍스트 / 922,000 최대 입력 메타데이터가 들어가며, Pro 가상 id는 기본 와이어 모델로 다시 쓰면서 `reasoning.mode: "pro"`를 적용합니다.
diff --git a/docs-site/src/content/docs/ko/reference/configuration/routing.md b/docs-site/src/content/docs/ko/reference/configuration/routing.md
index 4615b63620..251ce87e5a 100644
--- a/docs-site/src/content/docs/ko/reference/configuration/routing.md
+++ b/docs-site/src/content/docs/ko/reference/configuration/routing.md
@@ -16,14 +16,15 @@ description: 기본 provider 선택, model 해석 순서, combo 별칭, 대상 
 
 opencodex는 요청된 model을 다음 순서로 해석합니다:
 
-1. 설정된 `<account-selector>/<native-openai-model>` 네임스페이스입니다. 매핑된 저장 Codex 계정으로만 routing하며, exact target이 잘못되었거나 사용할 수 없으면 fail closed합니다.
-2. 정규화된 `combo/<id>` 또는 설정된 combo 별칭입니다. 정규화된 id가 별칭보다 먼저 적용됩니다.
-3. 접두사가 설정된 provider를 가리키는 명시적 `<provider>/<model>` 네임스페이스입니다.
-4. `gpt-*`, `o1-*`, `o3-*`, `o4-*` 같은 bare native OpenAI 계열 id입니다. 이 경우 정규화된 활성 `openai` provider를 통해 라우팅합니다.
-5. provider의 `defaultModel`과 정확히 일치합니다.
-6. 알려진 provider-family model prefix입니다.
-7. provider의 설정된 `models` 목록 안의 정확한 model입니다.
-8. `defaultProvider`이며, 요청한 model id를 그대로 유지합니다.
+1. 설정된 `policy/<id>` 또는 routing-profile 별칭입니다. policy evaluator를 실행해 선택된 후보로 routing합니다. 해석되지 않은 `policy/<id>`는 후속 규칙으로 넘어갑니다.
+2. 설정된 `<account-selector>/<native-openai-model>` 네임스페이스입니다. 매핑된 저장 Codex 계정으로만 routing하며, exact target이 잘못되었거나 사용할 수 없으면 fail closed합니다.
+3. 정규화된 `combo/<id>` 또는 설정된 combo 별칭입니다. 정규화된 id가 별칭보다 먼저 적용됩니다.
+4. 접두사가 설정된 provider를 가리키는 명시적 `<provider>/<model>` 네임스페이스입니다.
+5. `gpt-*`, `o1-*`, `o3-*`, `o4-*` 같은 bare native OpenAI 계열 id입니다. 이 경우 정규화된 활성 `openai` provider를 통해 라우팅합니다.
+6. provider의 `defaultModel`과 정확히 일치합니다.
+7. 알려진 provider-family model prefix입니다.
+8. provider의 설정된 `models` 목록 안의 정확한 model입니다.
+9. `defaultProvider`이며, 요청한 model id를 그대로 유지합니다.
 
 비활성화된 provider는 제외합니다. 비활성화된 provider의 명시적 네임스페이스는 다음 규칙으로 넘어가지 않고 실패합니다. 여러 provider에 걸쳐 일치할 수 있는 규칙은 JSON에 적힌 삽입 순서대로 provider 항목을 검사하므로, bare model이 애매할 수 있으면 명시적 네임스페이스를 사용하십시오.
 
@@ -43,6 +44,11 @@ Codex catalog는 bare native picker row를 숨기고 각 selector마다 별도
 selector는 표시되지 않습니다. selector 검증, 충돌 규칙, privacy guidance는
 [공급자 설정](/reference/configuration/providers/)을 참고하십시오.
 
+Codex Auth 페이지에서 이 picker 동작을 opt-in할 수 있습니다. 비활성화하면 selector-qualified row를
+숨기고 일반 GPT row를 복원하지만 mapping과 exact `<selector>/<model>` routing은 유지되므로 다시
+활성화할 때 같은 공개 label이 돌아옵니다. mutation은 bounded catalog refresh보다 먼저 저장되며,
+`ocx sync` warning은 picker catalog convergence만 보류 중이고 routing 변경은 손실되지 않았음을 뜻합니다.
+
 ## Combos (`config.combos`)
 
 각 combo 키는 `[A-Za-z0-9][A-Za-z0-9._-]{0,63}`에 맞는 id입니다. 항상 `combo/<id>`로 직접 접근할 수 있고, 추가로 하나의 `alias`를 노출할 수 있습니다. alias는 유일해야 하고 `combo/` 네임스페이스를 차지할 수 없으며, `gpt-*`, `o1-*`, `o3-*`, `o4-*`, `codex-*` 같은 예약된 bare native family도 사용할 수 없습니다.
diff --git a/docs-site/src/content/docs/ko/reference/management-api.md b/docs-site/src/content/docs/ko/reference/management-api.md
index 334c73f094..a0bcc78e1c 100644
--- a/docs-site/src/content/docs/ko/reference/management-api.md
+++ b/docs-site/src/content/docs/ko/reference/management-api.md
@@ -87,7 +87,7 @@ Authorization: Bearer <admin-token>
 | --- | --- | --- |
 | `GET /api/config` | redacted된 management-safe configuration DTO를 반환합니다 | — |
 | `PUT /api/config` | 전체 구성 교체 방지 기능이 비활성화되어 있습니다 | 405; 대신 집중된 엔드포인트를 사용하십시오 |
-| `GET, PUT /api/settings` | 런타임/시작 설정을 읽거나 auto-start, stream mode, 앱 소유 memory budget을 업데이트합니다 | 400 잘못되었거나 비어 있는 업데이트 |
+| `GET, PUT /api/settings` | 런타임/시작 설정을 읽거나 auto-start, stream mode, 앱 소유 memory budget, `codexAccountPickerEnabled`를 업데이트합니다 | 400 잘못됨, object 아님, 또는 비어 있는 업데이트 |
 | `GET /api/startup-health` | 캐시된 서비스/shim 시작 상태를 읽습니다 | — |
 | `POST /api/startup-action` | 서비스 또는 Codex shim을 설치하거나 복구합니다 | 400 잘못된 작업; 500 작업 실패 |
 | `GET, POST /api/windows-tray` | Windows tray 상태를 읽거나 설치, 시작, 중지, 제거합니다 | 400 지원되지 않는 플랫폼/작업; 500 작업 실패 |
@@ -197,11 +197,16 @@ Authorization: Bearer <admin-token>
 
 ### Codex 인증 위임
 
+`GET /api/settings`는 유효한 `codexAccountPickerEnabled` boolean을 반환합니다. 이 strict boolean을
+`PUT`하면 빈 map을 활성화할 때 privacy-safe selector를 초기화하고 기존 label을 보존한 채 먼저
+영속화한 다음, 유효한 picker 표시가 바뀐 경우에만 bounded catalog convergence를 한 번 요청합니다.
+성공 응답의 `catalogRefreshPending: true`는 설정은 저장되었지만 `POST /api/sync` 재시도가 필요하다는 뜻입니다.
+
 루트 management dispatcher는 모든 `/api/codex-auth/*` 요청을 Codex account manager에 위임합니다. 해당 route는 다음과 같습니다.
 
 | Method and path | 목적 | 주요 오류 |
 | --- | --- | --- |
-| `GET, POST, DELETE /api/codex-auth/accounts` | Codex account를 나열/갱신, 선택적으로 가져오기, 또는 삭제합니다 | 400 잘못된 입력; 수동 가져오기를 비활성화할 수 있음 |
+| `GET, POST, DELETE /api/codex-auth/accounts` | Codex account를 나열/갱신, 선택적으로 가져오기, 또는 삭제합니다. 성공한 POST/DELETE는 `catalogRefreshPending`를 포함합니다. | 400 잘못된 입력; 수동 가져오기를 비활성화할 수 있음 |
 | `PUT /api/codex-auth/accounts/alias` | 계정 alias를 설정하거나 지웁니다 | 400 잘못된 account/alias |
 | `PUT /api/codex-auth/accounts/pause` | 계정 하나를 일시 중지하거나 재개합니다 | 400 잘못된 account/state; 404 누락된 account |
 | `PUT /api/codex-auth/accounts/pause-exhausted` | quota가 소진된 account를 일시 중지합니다 | mutation-lock 실패는 503이 됩니다 |
@@ -216,10 +221,20 @@ Authorization: Bearer <admin-token>
 | `POST /api/codex-auth/login` | Codex 로그인 또는 재인증을 시작합니다 | 400 잘못된 요청; 충돌/바쁨 로그인 상태 |
 | `POST /api/codex-auth/login/code` | Codex 로그인 흐름용 수동 코드를 제출합니다 | 400 잘못된 흐름/code |
 | `POST /api/codex-auth/login/cancel` | Codex 로그인 흐름을 취소합니다 | — |
-| `GET /api/codex-auth/login-status` | 흐름 또는 account 로그인 상태를 조회합니다 | 알 수 없는 흐름은 `expired`로 보고되며, 활성 흐름이 없으면 `idle`로 보고됩니다 |
+| `GET /api/codex-auth/login-status` | 흐름 또는 account 로그인 상태를 조회합니다. 새 계정 완료 시 복구가 필요할 때만 `catalogRefreshPending: true`를 포함합니다. | 알 수 없는 흐름은 `expired`로 보고되며, 활성 흐름이 없으면 `idle`로 보고됩니다 |
+
+새 account의 config row는 저장되었지만 credential setup을 완료하지 못하면 manual POST는 HTTP 500을
+반환하고 OAuth `login-status`는 `status: "error"`를 보고합니다. 두 응답 모두
+`code: "codex_credential_persistence_failed"`, `accountId`, `needsReauth: true`, 필요한 경우
+`catalogRefreshPending: true`를 포함하며 storage error 세부 정보는 노출하지 않습니다. account row는
+저장된 상태이므로 account 생성을 다시 시도하기 전에 재인증하거나 삭제하십시오.
 
 이 위임된 계열에서 configuration-writer 또는 credential-refresh lock timeout이 발생하면 HTTP 503과 `CONFIG_MUTATION_LOCK_UNAVAILABLE` 코드가 반환됩니다. 클라이언트는 이를 영구적인 계정 실패로 보지 말고 곧바로 다시 시도해야 합니다.
 
+계정 생성과 삭제는 catalog convergence보다 먼저 영속화됩니다. 실패하거나 연기된 catalog 작업은 저장된
+mutation을 되돌리지 않고 내부 provider/account/path/credential 세부 정보도 반환하지 않습니다. 삭제된
+account의 selector binding은 남아 있어 계정이 없을 때 exact route가 fail closed하고 같은 id를 다시 추가하면 같은 selector가 복원됩니다.
+
 ## 클라이언트 선택
 
 일반적인 관리 작업에는 [Web Dashboard](/guides/web-dashboard/)가 가장 안전한 안내형 워크플로를 제공합니다. 헤드리스 호스트와 자동화에는 대응하는 `ocx` 명령을 사용하십시오. 이 명령들은 동일한 실시간 API를 호출하며, 프록시에 접근할 수 없거나 작업이 실패하면 0이 아닌 결과를 반환합니다. 직접 HTTP는 위의 정확한 엔드포인트 계약이 필요한 통합에 가장 유용합니다.
diff --git a/docs-site/src/content/docs/reference/cli/providers-accounts.md b/docs-site/src/content/docs/reference/cli/providers-accounts.md
index dd6c48f2a3..6cb382df82 100644
--- a/docs-site/src/content/docs/reference/cli/providers-accounts.md
+++ b/docs-site/src/content/docs/reference/cli/providers-accounts.md
@@ -228,7 +228,10 @@ unknown account id, or a value outside the accepted set exits 1. `--json` return
 ### `ocx account login|reauth|code|cancel ...`
 
 Run browser-based or manual-code account authentication from a headless shell. Use
-`ocx account --help` for the provider-specific command shape.
+`ocx account --help` for the provider-specific command shape. If a Codex account login is saved but
+its model-catalog refresh remains pending, human output still exits successfully and prints fixed
+`ocx sync` recovery guidance on stderr. `--json` keeps stdout parseable and carries
+`catalogRefreshPending: true` in the completed login state without the human warning.
 
 ### `ocx account remove <provider> <id|main> --yes [--json]`
 
@@ -240,10 +243,14 @@ account or reports none; API-key pools promote the first remaining key or report
 success and failure shapes are:
 
 ```text
-{ ok: true, provider, id, removedActive: boolean, promotedActiveId: string | null }
+{ ok: true, provider, id, removedActive: boolean, promotedActiveId: string | null, catalogRefreshPending?: boolean }
 { error: string } // stderr, exit 1
 ```
 
+`catalogRefreshPending` is present on Codex removals only. When it is `true`, the account deletion is
+already saved; human output prints generic `ocx sync` recovery guidance on stderr and still exits 0.
+OAuth-account and API-key removal envelopes do not gain this field.
+
 ### `ocx account add-key <provider> [--label <label>] [--json]`
 
 Adds and activates a key for an API-key provider. The key is read only from non-TTY piped/redirected
diff --git a/docs-site/src/content/docs/reference/configuration/providers.md b/docs-site/src/content/docs/reference/configuration/providers.md
index 789adce413..474b8327c7 100644
--- a/docs-site/src/content/docs/reference/configuration/providers.md
+++ b/docs-site/src/content/docs/reference/configuration/providers.md
@@ -41,6 +41,13 @@ its namespace prefix, and configured pool ids or selector targets also cannot re
 raw account ids and emails private; the selector is the public name. See [Routing Configuration](/reference/configuration/routing/)
 for exact-selection behavior and precedence.
 
+The Codex Auth dashboard control owns maps that have an explicit `codexAccountPickerEnabled` field.
+Enabling an empty managed map creates privacy-safe selectors; later account additions extend that map
+even while picker rows are hidden, without renaming existing selectors. A hand-written map that omits
+the flag remains manual and is never auto-expanded. Deleting an account keeps its mapping so exact
+routes fail closed while it is missing; adding the same account id again restores the existing public
+selector instead of allocating a new one.
+
 ## Reserved OpenAI providers
 
 `openai` and `openai-apikey` are fixed reserved ids. `openai.codexAccountMode` is `"pool"` by default
diff --git a/docs-site/src/content/docs/reference/configuration/routing.md b/docs-site/src/content/docs/reference/configuration/routing.md
index 333422f061..397be60e12 100644
--- a/docs-site/src/content/docs/reference/configuration/routing.md
+++ b/docs-site/src/content/docs/reference/configuration/routing.md
@@ -17,8 +17,8 @@ Routing turns the model id sent by a client into one concrete provider and upstr
 
 opencodex resolves the requested model in this order:
 
-1. An explicit `policy/<id>` or configured routing-profile alias, executing the policy evaluator
-   and routing the selected candidate. An unknown profile id fails closed.
+1. A configured `policy/<id>` or routing-profile alias, executing the policy evaluator and routing
+   the selected candidate. An unresolved `policy/<id>` falls through to the later rules.
 2. A configured `<account-selector>/<native-openai-model>` namespace, routed through exactly the
    mapped stored Codex account. An invalid or unavailable exact target fails closed.
 3. A canonical `combo/<id>` or configured combo alias. Canonical ids win before alias matching.
@@ -50,6 +50,13 @@ routing and remain in raw `/v1/models` discovery unless explicitly disabled. Sel
 stored account is missing are not advertised. Selector validation, collision rules, and privacy guidance are documented in
 [Provider Configuration](/reference/configuration/providers/).
 
+The Codex Auth page exposes this picker behavior as an opt-in. Disabling it hides generated
+selector-qualified picker rows and restores the ordinary GPT rows, but it does not remove the
+mappings or change exact `<selector>/<model>` routing. Re-enabling therefore restores the same public
+labels. Account and setting mutations are persisted before a bounded catalog refresh; an `ocx sync`
+warning means only that the picker catalog still needs convergence, not that the routing change was
+lost.
+
 ## Combos (`config.combos`)
 
 Each combo key is an id matching `[A-Za-z0-9][A-Za-z0-9._-]{0,63}`. It is always directly addressable
diff --git a/docs-site/src/content/docs/reference/management-api.md b/docs-site/src/content/docs/reference/management-api.md
index 2635b719af..e6a7e385e8 100644
--- a/docs-site/src/content/docs/reference/management-api.md
+++ b/docs-site/src/content/docs/reference/management-api.md
@@ -102,7 +102,7 @@ See [Combos](/guides/combos/) for target strategies, cooldowns, aliases, and rou
 | --- | --- | --- |
 | `GET /api/config` | Return the redacted, management-safe configuration DTO | — |
 | `PUT /api/config` | Disabled full-config replacement guard | 405; use focused endpoints instead |
-| `GET, PUT /api/settings` | Read runtime/startup settings or update auto-start, stream mode, and app-owned memory budget | 400 invalid or empty update |
+| `GET, PUT /api/settings` | Read runtime/startup settings or update auto-start, stream mode, app-owned memory budget, and `codexAccountPickerEnabled` | 400 invalid, non-object, or empty update |
 | `GET /api/startup-health` | Read cached service/shim startup health | — |
 | `POST /api/startup-action` | Install or repair the service or Codex shim | 400 invalid action; 500 action failure |
 | `GET, POST /api/windows-tray` | Read Windows tray state or install/start/stop/uninstall it | 400 unsupported platform/action; 500 operation failure |
@@ -217,12 +217,21 @@ whether to star the repository.
 
 ### Codex authentication delegation
 
+`GET /api/settings` reports the effective `codexAccountPickerEnabled` boolean. A `PUT` containing
+that strict boolean initializes privacy-safe account selectors when enabling an empty map, preserves
+existing selector labels when disabling or re-enabling, persists first, and then requests one bounded
+catalog convergence only when effective picker visibility changed. The successful response includes
+`catalogRefreshPending`: `false` means the catalog commit completed (or no refresh was needed), while
+`true` means the setting was saved but `POST /api/sync` should be used to retry the catalog refresh.
+Persistence or selector-allocation failure rolls the in-memory settings back and does not run
+convergence.
+
 The root management dispatcher delegates every `/api/codex-auth/*` request to the Codex account
 manager. Its routes are:
 
 | Method and path | Purpose | Notable errors |
 | --- | --- | --- |
-| `GET, POST, DELETE /api/codex-auth/accounts` | List/refresh, optionally import, or delete Codex accounts | 400 invalid input; manual import can be disabled |
+| `GET, POST, DELETE /api/codex-auth/accounts` | List/refresh, optionally import, or delete Codex accounts. Successful POST/DELETE responses include `catalogRefreshPending`. | 400 invalid input; manual import can be disabled |
 | `PUT /api/codex-auth/accounts/alias` | Set or clear an account alias | 400 invalid account/alias |
 | `PUT /api/codex-auth/accounts/pause` | Pause or resume one account | 400 invalid account/state; 404 missing account |
 | `PUT /api/codex-auth/accounts/pause-exhausted` | Pause accounts whose quota is exhausted | Mutation-lock failures become 503 |
@@ -237,12 +246,24 @@ manager. Its routes are:
 | `POST /api/codex-auth/login` | Start Codex login or reauthentication | 400 invalid request; conflict/busy login states |
 | `POST /api/codex-auth/login/code` | Submit a manual code for a Codex login flow | 400 invalid flow/code |
 | `POST /api/codex-auth/login/cancel` | Cancel a Codex login flow | — |
-| `GET /api/codex-auth/login-status` | Poll a flow or account login state | Unknown flows report `expired`; no active flow reports `idle` |
+| `GET /api/codex-auth/login-status` | Poll a flow or account login state. A completed new-account flow includes `catalogRefreshPending: true` only when recovery is needed. | Unknown flows report `expired`; no active flow reports `idle` |
+
+If a new account config row is saved but credential setup cannot finish, the manual POST returns
+HTTP 500 and OAuth `login-status` reports `status: "error"`. Both use
+`code: "codex_credential_persistence_failed"`, `accountId`, `needsReauth: true`, and optional
+`catalogRefreshPending: true`; storage-error details are not exposed. The account row remains saved:
+reauthenticate or delete it before retrying account creation.
 
 Configuration-writer or credential-refresh lock timeouts under this delegated family return HTTP
 503 with code `CONFIG_MUTATION_LOCK_UNAVAILABLE`. Clients should retry shortly rather than treating
 that response as a permanent account failure.
 
+Account creation and deletion commit credentials/configuration before catalog convergence. A failed or
+deferred catalog attempt never rolls back the durable account mutation and never reflects internal
+provider, account, path, or credential details; clients receive only the completion boolean. Deleting
+an account retains its selector binding so exact routes fail closed while the account is absent and the
+same selector is restored if that account id is added again.
+
 ## Choosing a client
 
 For ordinary administration, the [Web Dashboard](/guides/web-dashboard/) gives the safest guided
diff --git a/docs-site/src/content/docs/ru/guides/web-dashboard.md b/docs-site/src/content/docs/ru/guides/web-dashboard.md
index 5ed0df3a44..58f037dfd4 100644
--- a/docs-site/src/content/docs/ru/guides/web-dashboard.md
+++ b/docs-site/src/content/docs/ru/guides/web-dashboard.md
@@ -115,6 +115,17 @@ bun run dev:gui
 - **Refresh quotas** немедленно перечитывает использование аккаунтов, чтобы маршрутизация и
   карточки аккаунтов опирались на одни и те же значения.
 - Логи запросов пула используют непрозрачные метки вида `p3fa91c` и никогда — email аккаунтов.
+- **Выбирать конкретный аккаунт Codex в списке моделей** — явная opt-in настройка. После включения
+  обычные пункты GPT заменяются отдельным пунктом для каждого публичного selector'а. Выбор закрепляет
+  разговор за сопоставленным аккаунтом: без Pool-ротации, fallback и изменения active Pool account.
+  Для встроенного логина Codex App используется отдельный selector; в созданных map он обычно
+  называется `main`, а при коллизии получает безопасный суффикс вроде `main-2`. Добавленные аккаунты
+  получают стабильные privacy-safe метки. Существующие разговоры и сохранённые варианты моделей продолжают маршрутизироваться.
+  Отключение не удаляет аккаунты, selector'ы и exact routes, а обычные GPT id продолжают использовать
+  настроенный режим Pool или Direct.
+- Добавление/удаление аккаунта и picker-настройка сохраняются до catalog refresh. Если refresh не
+  завершился, дашборд показывает amber-предупреждение с восстановлением. Изменение уже сохранено;
+  выполните `ocx sync`, чтобы повторить refresh.
 
 Обзор Providers дополнительно сводит использование Pool-режима в оценочную взвешенную ёмкость
 только для отображения, рядом с исходной квотой текущего активного аккаунта и следующим восстановлением
@@ -127,7 +138,7 @@ GUI — это тонкий клиент поверх JSON-API управлен
 
 | Эндпоинт | Назначение |
 | --- | --- |
-| `GET` / `PUT /api/settings` | Чтение настроек или переключение автозапуска Codex. |
+| `GET` / `PUT /api/settings` | Чтение настроек и изменение автозапуска Codex, stream/memory и видимости account-targeting picker. |
 | `GET /api/startup-health` | Чтение безопасной диагностики маршрутизации, службы, shim и устойчивости к перезагрузке. |
 | `GET` / `POST /api/windows-tray` | Чтение или изменение установки и видимости трея Windows; POST поддерживает `install`, `start`, `stop`, `uninstall`. |
 | `POST /api/sync` | Пересборка общего каталога моделей и инвалидация кэша моделей Codex. |
diff --git a/docs-site/src/content/docs/ru/reference/cli/providers-accounts.md b/docs-site/src/content/docs/ru/reference/cli/providers-accounts.md
index 15189c25a2..c1a27cb057 100644
--- a/docs-site/src/content/docs/ru/reference/cli/providers-accounts.md
+++ b/docs-site/src/content/docs/ru/reference/cli/providers-accounts.md
@@ -224,7 +224,11 @@ quota-bar'ов дашборда.
 ### `ocx account login|reauth|code|cancel ...`
 
 Запускать browser-based или manual-code account-authentication из headless-shell. Для
-provider-specific формы команды используйте `ocx account --help`.
+provider-specific формы команды используйте `ocx account --help`. Если login аккаунта Codex
+сохранён, но обновление каталога моделей ещё не завершилось, human-readable вывод по-прежнему
+завершается успешно и печатает в stderr фиксированную рекомендацию `ocx sync`. С `--json` stdout
+остаётся пригодным для парсинга, а завершённый login-state содержит
+`catalogRefreshPending: true` без human-readable предупреждения.
 
 ### `ocx account remove <provider> <id|main> --yes [--json]`
 
@@ -237,10 +241,14 @@ provider-specific формы команды используйте `ocx account
 Формы успеха и неудачи в `--json`:
 
 ```text
-{ ok: true, provider, id, removedActive: boolean, promotedActiveId: string | null }
+{ ok: true, provider, id, removedActive: boolean, promotedActiveId: string | null, catalogRefreshPending?: boolean }
 { error: string } // stderr, exit 1
 ```
 
+`catalogRefreshPending` присутствует только при удалении аккаунтов Codex. Значение `true` означает,
+что удаление уже сохранено; human-readable вывод печатает в stderr общую рекомендацию `ocx sync` и
+по-прежнему завершается с кодом 0. Форматы удаления OAuth-аккаунтов и API-key не меняются.
+
 ### `ocx account add-key <provider> [--label <label>] [--json]`
 
 Добавить и активировать ключ для API-key-провайдера. Ключ читается только из piped/redirected
diff --git a/docs-site/src/content/docs/ru/reference/configuration/providers.md b/docs-site/src/content/docs/ru/reference/configuration/providers.md
index a796be73f7..9960af1dd4 100644
--- a/docs-site/src/content/docs/ru/reference/configuration/providers.md
+++ b/docs-site/src/content/docs/ru/reference/configuration/providers.md
@@ -40,6 +40,14 @@ description: Записи провайдеров, аутентификация,
 raw id аккаунтов и email приватными, а селектор используйте как публичное имя. Поведение и приоритет
 явного выбора описаны в разделе [Конфигурация маршрутизации](/reference/configuration/routing/).
 
+Элемент управления на странице Codex Auth владеет map только тогда, когда в ней явно задано поле
+`codexAccountPickerEnabled`. При включении пустой управляемой map создаются privacy-safe селекторы;
+при последующем добавлении аккаунтов map расширяется даже тогда, когда строки picker'а скрыты, и
+существующие селекторы не переименовываются. Написанная вручную map без этого поля остаётся ручной и
+никогда не расширяется автоматически. При удалении аккаунта его сопоставление сохраняется: exact
+route fail closed, пока аккаунт отсутствует, а повторное добавление того же id восстанавливает
+прежний публичный селектор вместо создания нового.
+
 ## Зарезервированные провайдеры OpenAI
 
 `openai` и `openai-apikey` — это фиксированные зарезервированные id. `openai.codexAccountMode`
diff --git a/docs-site/src/content/docs/ru/reference/configuration/routing.md b/docs-site/src/content/docs/ru/reference/configuration/routing.md
index 429610c00d..34b81c1500 100644
--- a/docs-site/src/content/docs/ru/reference/configuration/routing.md
+++ b/docs-site/src/content/docs/ru/reference/configuration/routing.md
@@ -17,16 +17,18 @@ upstream.
 
 opencodex разрешает запрошенную модель в следующем порядке:
 
-1. Настроенное пространство имён `<account-selector>/<native-openai-model>`, направляемое только через
+1. Настроенный `policy/<id>` или алиас routing profile запускает policy evaluator и направляет запрос
+   к выбранному кандидату. Неразрешённый `policy/<id>` переходит к последующим правилам.
+2. Настроенное пространство имён `<account-selector>/<native-openai-model>`, направляемое только через
    сопоставленный сохранённый аккаунт Codex. Некорректная или недоступная exact target завершается fail closed.
-2. Канонический `combo/<id>` или настроенный алиас combo. Канонические id проверяются до алиасов.
-3. Явное пространство имён `<provider>/<model>`, где префикс называет настроенного провайдера.
-4. Голый id нативного семейства OpenAI, например `gpt-*`, `o1-*`, `o3-*` или `o4-*`, направляемый
+3. Канонический `combo/<id>` или настроенный алиас combo. Канонические id проверяются до алиасов.
+4. Явное пространство имён `<provider>/<model>`, где префикс называет настроенного провайдера.
+5. Голый id нативного семейства OpenAI, например `gpt-*`, `o1-*`, `o3-*` или `o4-*`, направляемый
    через канонического включённого провайдера `openai`.
-5. Точное совпадение с `defaultModel` провайдера.
-6. Известный префикс семейства моделей провайдера.
-7. Точное совпадение с моделью в настроенном списке `models` провайдера.
-8. `defaultProvider` с сохранением запрошенного id модели.
+6. Точное совпадение с `defaultModel` провайдера.
+7. Известный префикс семейства моделей провайдера.
+8. Точное совпадение с моделью в настроенном списке `models` провайдера.
+9. `defaultProvider` с сохранением запрошенного id модели.
 
 Отключённые провайдеры исключаются. Явное пространство имён отключённого провайдера завершается
 ошибкой, а не переходит к следующим правилам. Для правил, которые могут совпасть с несколькими
@@ -49,6 +51,13 @@ opencodex разрешает запрошенную модель в следую
 чей сохранённый аккаунт отсутствует, не рекламируются. Проверка selector, правила коллизий и рекомендации по privacy описаны в разделе
 [Конфигурация провайдеров](/reference/configuration/providers/).
 
+На странице Codex Auth это поведение picker'а доступно как opt-in. Отключение скрывает созданные
+selector-qualified строки и возвращает обычные GPT-строки, но не удаляет сопоставления и не меняет
+маршрутизацию точного `<selector>/<model>`. Поэтому повторное включение восстанавливает те же
+публичные метки. Изменения аккаунтов и настройки сохраняются до bounded catalog refresh;
+предупреждение с `ocx sync` означает только, что каталог picker'а ещё нужно привести в согласованное
+состояние, а не потерю изменения маршрутизации.
+
 ## Combo (`config.combos`)
 
 Каждый ключ combo — это id, соответствующий шаблону `[A-Za-z0-9][A-Za-z0-9._-]{0,63}`. Он всегда
diff --git a/docs-site/src/content/docs/ru/reference/management-api.md b/docs-site/src/content/docs/ru/reference/management-api.md
index dbd13ac09a..bac4b5de46 100644
--- a/docs-site/src/content/docs/ru/reference/management-api.md
+++ b/docs-site/src/content/docs/ru/reference/management-api.md
@@ -103,7 +103,7 @@ GUI-сессия в стиле loopback не выпускается.
 | --- | --- | --- |
 | `GET /api/config` | Вернуть redacted DTO конфигурации, безопасный для management API | — |
 | `PUT /api/config` | Отключённая защита от полной замены конфигурации | 405; используйте вместо этого узкие endpoint'ы |
-| `GET, PUT /api/settings` | Прочитать runtime/startup setting'и или обновить auto-start, stream mode и budget app-owned memory | 400 invalid or empty update |
+| `GET, PUT /api/settings` | Прочитать runtime/startup setting'и или обновить auto-start, stream mode, budget app-owned memory и `codexAccountPickerEnabled` | 400 invalid, non-object or empty update |
 | `GET /api/startup-health` | Прочитать кэшированное startup health службы/shim'а | — |
 | `POST /api/startup-action` | Установить или починить службу или Codex shim | 400 invalid action; 500 action failure |
 | `GET, POST /api/windows-tray` | Прочитать состояние Windows tray или установить/запустить/остановить/удалить её | 400 unsupported platform/action; 500 operation failure |
@@ -219,12 +219,18 @@ Management-аутентификация доказывает доступ к п
 
 ### Делегирование аутентификации Codex
 
+`GET /api/settings` возвращает эффективный boolean `codexAccountPickerEnabled`. `PUT` этого strict
+boolean при включении пустой map создаёт privacy-safe selector'ы, сохраняет существующие labels,
+сначала записывает config и лишь затем один раз запускает bounded catalog convergence, если видимость
+picker изменилась. `catalogRefreshPending: true` в успешном ответе означает, что настройка сохранена,
+но catalog refresh нужно повторить через `POST /api/sync`.
+
 Корневой dispatcher management API делегирует каждый запрос `/api/codex-auth/*` менеджеру
 аккаунтов Codex. Его маршруты таковы:
 
 | Метод и путь | Назначение | Особые ошибки |
 | --- | --- | --- |
-| `GET, POST, DELETE /api/codex-auth/accounts` | Показать/обновить список, по желанию импортировать, либо удалить аккаунты Codex | 400 invalid input; manual import can be disabled |
+| `GET, POST, DELETE /api/codex-auth/accounts` | Показать/обновить список, по желанию импортировать, либо удалить аккаунты Codex. Успешные POST/DELETE включают `catalogRefreshPending`. | 400 invalid input; manual import can be disabled |
 | `PUT /api/codex-auth/accounts/alias` | Задать или очистить alias аккаунта | 400 invalid account/alias |
 | `PUT /api/codex-auth/accounts/pause` | Поставить один аккаунт на паузу или снять её | 400 invalid account/state; 404 missing account |
 | `PUT /api/codex-auth/accounts/pause-exhausted` | Поставить на паузу аккаунты с исчерпанной квотой | Сбои mutation-lock превращаются в 503 |
@@ -239,12 +245,25 @@ Management-аутентификация доказывает доступ к п
 | `POST /api/codex-auth/login` | Запустить login или reauthentication для Codex | 400 invalid request; conflict/busy login states |
 | `POST /api/codex-auth/login/code` | Отправить manual code для login-flow Codex | 400 invalid flow/code |
 | `POST /api/codex-auth/login/cancel` | Отменить login-flow Codex | — |
-| `GET /api/codex-auth/login-status` | Опрашивать flow или login-state аккаунта | Неизвестные flow'ы сообщаются как `expired`; отсутствие активного flow — как `idle` |
+| `GET /api/codex-auth/login-status` | Опрашивать flow или login-state аккаунта. Завершение нового аккаунта включает `catalogRefreshPending: true` только при необходимости восстановления. | Неизвестные flow'ы сообщаются как `expired`; отсутствие активного flow — как `idle` |
+
+Если config row нового аккаунта сохранён, но credential setup не завершён, manual POST возвращает
+HTTP 500, а OAuth `login-status` сообщает `status: "error"`. Оба ответа содержат
+`code: "codex_credential_persistence_failed"`, `accountId`, `needsReauth: true` и при необходимости
+`catalogRefreshPending: true`; детали storage error не раскрываются. Account row остаётся сохранённым:
+перед повторным созданием аккаунта выполните reauthentication или удалите его.
 
 Если внутри этого delegated family writer конфигурации или refresh credential'ов не получает lock
 в разумное время, возвращается HTTP 503 с кодом `CONFIG_MUTATION_LOCK_UNAVAILABLE`. Клиенту нужно
 немного подождать и повторить запрос, а не трактовать это как постоянный сбой аккаунта.
 
+Создание и удаление аккаунта записывает credentials/config до catalog convergence. Сбой или
+отложенная попытка обновления каталога не откатывает сохранённое изменение аккаунта и не раскрывает
+в ответе внутренние сведения о provider, account, path или credentials: клиент получает только
+boolean завершения. При удалении аккаунта его selector binding сохраняется, поэтому exact routes
+fail closed, пока аккаунт отсутствует, а при повторном добавлении того же id восстанавливается тот же
+селектор.
+
 ## Как выбрать клиента
 
 Для обычного администрирования самый безопасный guided-workflow даёт
diff --git a/docs-site/src/content/docs/zh-cn/guides/web-dashboard.md b/docs-site/src/content/docs/zh-cn/guides/web-dashboard.md
index 82083c2437..e8f7e42d21 100644
--- a/docs-site/src/content/docs/zh-cn/guides/web-dashboard.md
+++ b/docs-site/src/content/docs/zh-cn/guides/web-dashboard.md
@@ -99,6 +99,16 @@ Pool 模式会在主账号和已添加的 Codex 账号之间选择；Direct 只
   评分；Go/Free 计划只使用 30d 窗口。
 - **Refresh quotas** 会立即重新读取账号 usage，使路由逻辑与页面上的账号卡片使用同一份数据。
 - 池账号的请求日志使用 `p3fa91c` 这类不透明标签，不会记录账号邮箱。
+- **从模型选择器指定 Codex 账号** 是一项显式选择加入的设置。启用后，普通 GPT picker 条目会
+  替换为每个公开账号 selector 对应的条目。选择其中一项会把该对话锁定到映射账号：不会轮换、
+  fallback，也不会更改活跃 Pool 账号。内置 Codex App 登录有自己的 selector；生成的 map 通常
+  使用 `main`，发生冲突时会使用 `main-2` 这类安全后缀。新增账号会获得稳定且保护隐私的标签，
+  已有自定义 selector 标签则会保留。现有对话和已保存的模型选择会
+  继续路由。关闭此设置只会隐藏生成的 picker 项，不会删除账号、selector 或精确路由；普通 GPT
+  model id 继续使用已配置的 Pool 或 Direct 行为。
+- 添加、删除账号或更改 picker 设置时，会先保存变更再刷新模型目录。如果有界刷新未完成，
+  仪表盘会显示琥珀色的“成功但需要恢复”提示；运行 `ocx sync` 即可重试。账号或设置变更本身
+  仍已保存。
 
 Providers 概览会单独汇总 Pool 模式的显示专用加权容量估算，并同时显示当前有效账户的原始配额和
 下一次容量恢复。可见字段、覆盖不完整的含义以及路由边界，请参阅
@@ -110,7 +120,7 @@ GUI 是代理 JSON 管理 API 之上的轻量客户端。常用 endpoint 包括
 
 | Endpoint | 用途 |
 | --- | --- |
-| `GET` / `PUT /api/settings` | 读取设置或切换 Codex 自动启动。 |
+| `GET` / `PUT /api/settings` | 读取设置，或更新 Codex 自动启动、流/内存设置以及账号定向 picker 的可见性。 |
 | `GET /api/startup-health` | 读取不含秘密信息的路由、服务、shim 和重启安全诊断。 |
 | `GET` / `POST /api/windows-tray` | 读取或更改 Windows 托盘安装和显示状态；POST 支持 `install`、`start`、`stop`、`uninstall`。 |
 | `POST /api/sync` | 重建共享模型目录，并把 Codex 模型缓存标记为过期。 |
diff --git a/docs-site/src/content/docs/zh-cn/reference/cli/providers-accounts.md b/docs-site/src/content/docs/zh-cn/reference/cli/providers-accounts.md
index aae5d66085..765c21aad6 100644
--- a/docs-site/src/content/docs/zh-cn/reference/cli/providers-accounts.md
+++ b/docs-site/src/content/docs/zh-cn/reference/cli/providers-accounts.md
@@ -201,7 +201,10 @@ token，也不是简单重读账号列表。`--json` 返回
 ### `ocx account login|reauth|code|cancel ...`
 
 在无头 shell 中运行基于浏览器或手动代码的账号认证。请使用
-`ocx account --help` 查看与提供方相关的命令形式。
+`ocx account --help` 查看与提供方相关的命令形式。如果 Codex 账号登录已保存但模型目录刷新
+仍待完成，人类可读输出仍会成功退出，并在 stderr 打印固定的 `ocx sync` 恢复指引。使用
+`--json` 时 stdout 保持可解析，已完成的登录状态会包含 `catalogRefreshPending: true`，且不会
+打印人类可读警告。
 
 ### `ocx account remove <provider> <id|main> --yes [--json]`
 
@@ -212,10 +215,14 @@ token，也不是简单重读账号列表。`--json` 返回
 提升第一个剩余密钥，或者报告不存在。`--json` 的成功和失败结构如下：
 
 ```text
-{ ok: true, provider, id, removedActive: boolean, promotedActiveId: string | null }
+{ ok: true, provider, id, removedActive: boolean, promotedActiveId: string | null, catalogRefreshPending?: boolean }
 { error: string } // stderr, exit 1
 ```
 
+`catalogRefreshPending` 只出现在 Codex 删除结果中。值为 `true` 时，账号删除已经保存；人类可读
+输出会在 stderr 打印通用的 `ocx sync` 恢复指引，并仍以 0 退出。OAuth 账号和 API 密钥删除的
+响应结构不会增加此字段。
+
 ### `ocx account add-key <provider> [--label <label>] [--json]`
 
 为 API 密钥提供方添加并激活一个密钥。该密钥只会从非 TTY 的管道/重定向 stdin
diff --git a/docs-site/src/content/docs/zh-cn/reference/configuration/providers.md b/docs-site/src/content/docs/zh-cn/reference/configuration/providers.md
index 52d2911d6f..6b0f5a4272 100644
--- a/docs-site/src/content/docs/zh-cn/reference/configuration/providers.md
+++ b/docs-site/src/content/docs/zh-cn/reference/configuration/providers.md
@@ -38,6 +38,12 @@ pool account id（不能是内部 `__main__`），或用 `"@main"` 表示 Codex
 与 email 应保持私密，selector 才是公开名称。明确选择的行为和优先级见
 [路由配置](/zh-cn/reference/configuration/routing/)。
 
+Codex Auth 仪表盘控件只管理显式包含 `codexAccountPickerEnabled` 字段的映射。启用空的受管
+映射时会创建保护隐私的 selector；之后添加账号时，即使 picker 行处于隐藏状态，也会扩展该
+映射且不会重命名已有 selector。省略此字段的手写映射保持手动管理，绝不会自动扩展。删除账号
+会保留其映射，使精确路由在账号缺失时 fail closed；以后添加相同账号 id 时会恢复已有公开
+selector，而不是分配一个新名称。
+
 ## 保留的 OpenAI 提供者
 
 `openai` 和 `openai-apikey` 是固定的保留 id。`openai.codexAccountMode` 默认是 `"pool"`，会在主账户和新增账户之间选择；`"direct"` 只使用当前调用者/主登录态。API 只使用其配置的 API key 或 key 池。请使用裸模型名或 `openai-apikey/<model>`；不存在跨路由凭据回退。API 的 GPT-5.6 行携带 1,050,000 上下文 / 922,000 最大输入元数据，而 Pro 虚拟 id 会重写为基础线协议模型并带上 `reasoning.mode: "pro"`。
diff --git a/docs-site/src/content/docs/zh-cn/reference/configuration/routing.md b/docs-site/src/content/docs/zh-cn/reference/configuration/routing.md
index 18d08cbe16..ed02e516d7 100644
--- a/docs-site/src/content/docs/zh-cn/reference/configuration/routing.md
+++ b/docs-site/src/content/docs/zh-cn/reference/configuration/routing.md
@@ -16,16 +16,18 @@ description: 默认提供方选择、模型解析顺序、组合别名、目标
 
 opencodex 按以下顺序解析请求的模型：
 
-1. 已配置的 `<account-selector>/<native-openai-model>` 命名空间，只会路由到映射的已存储 Codex
+1. 已配置的 `policy/<id>` 或路由策略配置文件别名，会执行策略评估器并路由到选定的候选。
+   未解析的 `policy/<id>` 会继续按后续规则进行常规解析。
+2. 已配置的 `<account-selector>/<native-openai-model>` 命名空间，只会路由到映射的已存储 Codex
    账户。无效或不可用的精确目标会以 fail closed 方式失败。
-2. 规范化的 `combo/<id>` 或已配置的 combo 别名。规范化 id 会优先于别名匹配。
-3. 显式的 `<provider>/<model>` 命名空间，其前缀名称对应一个已配置的提供方。
-4. 诸如 `gpt-*`、`o1-*`、`o3-*` 或 `o4-*` 之类未带前缀的原生 OpenAI 系列 id，会通过
+3. 规范化的 `combo/<id>` 或已配置的 combo 别名。规范化 id 会优先于别名匹配。
+4. 显式的 `<provider>/<model>` 命名空间，其前缀名称对应一个已配置的提供方。
+5. 诸如 `gpt-*`、`o1-*`、`o3-*` 或 `o4-*` 之类未带前缀的原生 OpenAI 系列 id，会通过
    规范化且已启用的 `openai` 提供方进行路由。
-5. 与某个提供方的 `defaultModel` 完全匹配。
-6. 已知的提供方系列模型前缀。
-7. 与某个提供方配置的 `models` 列表中的模型完全匹配。
-8. `defaultProvider`，同时保留请求的 model id。
+6. 与某个提供方的 `defaultModel` 完全匹配。
+7. 已知的提供方系列模型前缀。
+8. 与某个提供方配置的 `models` 列表中的模型完全匹配。
+9. `defaultProvider`，同时保留请求的 model id。
 
 已禁用的提供方会被排除在外。对已禁用提供方的显式命名空间会直接失败，而不会继续
 向后回退。对于可能匹配多个提供方的规则，提供方条目会按照其 JSON 插入顺序进行检查，
@@ -44,6 +46,11 @@ upstream 发送裸 `gpt-5.6-sol` model id。selector 后只能使用裸原生 Op
 Direct routing，并继续出现在 raw `/v1/models` 中。映射到缺失已保存账户的 selector 不会被展示。
 selector 校验、冲突规则和隐私说明见[提供方配置](/reference/configuration/providers/)。
 
+Codex Auth 页面将此 picker 行为作为选择加入项。关闭它会隐藏生成的 selector-qualified picker
+行并恢复普通 GPT 行，但不会移除映射，也不会改变精确 `<selector>/<model>` 路由。因此再次
+启用时会恢复相同的公开标签。账号和设置变更会在有界 catalog refresh 前持久化；出现
+`ocx sync` 警告只表示 picker 目录仍需收敛，并不表示路由变更丢失。
+
 ## Combos (`config.combos`)
 
 每个 combo 键都是一个符合 `[A-Za-z0-9][A-Za-z0-9._-]{0,63}` 的 id。它始终可以直接通过
diff --git a/docs-site/src/content/docs/zh-cn/reference/management-api.md b/docs-site/src/content/docs/zh-cn/reference/management-api.md
index 8f68041943..eb28876408 100644
--- a/docs-site/src/content/docs/zh-cn/reference/management-api.md
+++ b/docs-site/src/content/docs/zh-cn/reference/management-api.md
@@ -87,7 +87,7 @@ Authorization: Bearer <admin-token>
 | --- | --- | --- |
 | `GET /api/config` | 返回已脱敏、对管理安全的配置 DTO | — |
 | `PUT /api/config` | 禁用的完整配置替换保护 | 405；请改用聚焦端点 |
-| `GET, PUT /api/settings` | 读取运行时/启动设置，或更新自动启动、流模式和应用拥有的内存预算 | 400 无效或空更新 |
+| `GET, PUT /api/settings` | 读取运行时/启动设置，或更新自动启动、流模式、应用拥有的内存预算和 `codexAccountPickerEnabled` | 400 无效、非对象或空更新 |
 | `GET /api/startup-health` | 读取缓存的服务/shim 启动健康状态 | — |
 | `POST /api/startup-action` | 安装或修复服务或 Codex shim | 400 无效动作；500 动作失败 |
 | `GET, POST /api/windows-tray` | 读取 Windows 托盘状态，或安装、启动、停止、卸载它 | 400 不支持的平台/动作；500 操作失败 |
@@ -197,11 +197,18 @@ Authorization: Bearer <admin-token>
 
 ### Codex 身份验证委托
 
+`GET /api/settings` 会返回实际生效的 `codexAccountPickerEnabled` 布尔值。包含该严格布尔值的
+`PUT` 在启用空映射时会初始化保护隐私的账号 selector；禁用或再次启用时会保留已有标签。配置
+会先持久化，仅当 picker 的实际可见性发生变化时才请求一次有界 catalog convergence。成功响应
+中的 `catalogRefreshPending` 为 `false` 表示目录提交已完成（或无需刷新）；为 `true` 表示设置已
+保存，但应通过 `POST /api/sync` 重试目录刷新。持久化或 selector 分配失败时会回滚内存设置，且
+不会运行 convergence。
+
 根管理分发器会将每个 `/api/codex-auth/*` 请求委托给 Codex 账户管理器。其路由如下：
 
 | 方法和路径 | 用途 | 典型错误 |
 | --- | --- | --- |
-| `GET, POST, DELETE /api/codex-auth/accounts` | 列出/刷新，可选导入，或删除 Codex 账户 | 400 输入无效；手动导入可能被禁用 |
+| `GET, POST, DELETE /api/codex-auth/accounts` | 列出/刷新，可选导入，或删除 Codex 账户。成功的 POST/DELETE 响应包含 `catalogRefreshPending`。 | 400 输入无效；手动导入可能被禁用 |
 | `PUT /api/codex-auth/accounts/alias` | 设置或清除账户别名 | 400 账户/别名无效 |
 | `PUT /api/codex-auth/accounts/pause` | 暂停或恢复一个账户 | 400 账户/状态无效；404 缺少账户 |
 | `PUT /api/codex-auth/accounts/pause-exhausted` | 暂停配额已耗尽的账户 | 变更锁失败会变成 503 |
@@ -216,10 +223,21 @@ Authorization: Bearer <admin-token>
 | `POST /api/codex-auth/login` | 启动 Codex 登录或重新认证 | 400 请求无效；登录状态冲突/忙碌 |
 | `POST /api/codex-auth/login/code` | 为 Codex 登录流程提交手动代码 | 400 流程/代码无效 |
 | `POST /api/codex-auth/login/cancel` | 取消一个 Codex 登录流程 | — |
-| `GET /api/codex-auth/login-status` | 轮询某个流程或账户登录状态 | 未知流程报告为 `expired`；没有活跃流程时报告为 `idle` |
+| `GET /api/codex-auth/login-status` | 轮询某个流程或账户登录状态。新账号流程完成时，仅在需要恢复时包含 `catalogRefreshPending: true`。 | 未知流程报告为 `expired`；没有活跃流程时报告为 `idle` |
+
+如果新账号的 config row 已保存但 credential setup 未能完成，manual POST 会返回 HTTP 500，OAuth
+`login-status` 会报告 `status: "error"`。两者都包含
+`code: "codex_credential_persistence_failed"`、`accountId`、`needsReauth: true`，并在需要时包含
+`catalogRefreshPending: true`；底层 storage error 详情不会暴露。account row 会保持已保存状态；再次
+创建账号前，请重新认证或删除该账号。
 
 此委托家族下的配置写入器或凭证刷新锁超时，会返回 HTTP 503，代码为 `CONFIG_MUTATION_LOCK_UNAVAILABLE`。客户端应稍后重试，而不是把该响应视为永久性的账户失败。
 
+账号创建和删除会在 catalog convergence 之前提交凭证/配置。目录尝试失败或推迟时，持久化的
+账号变更不会回滚，响应也不会暴露内部 provider、account、path 或 credential 详情；客户端只会
+收到完成状态布尔值。删除账号时会保留 selector 绑定，因此该账号缺失期间精确路由会 fail closed，
+而以后添加相同账号 id 时会恢复同一 selector。
+
 ## 如何选择客户端
 
 对于日常管理，[Web 仪表板](/guides/web-dashboard/)提供了最安全的引导式流程。对于无头主机和自动化，请使用相应的 `ocx` 命令：它们调用的是同一个实时 API，并在代理不可达或操作失败时返回非零结果。直接 HTTP 最适合需要上述精确端点契约的集成。
diff --git a/gui/src/codex-account-mutation.ts b/gui/src/codex-account-mutation.ts
new file mode 100644
index 0000000000..1c90557cd4
--- /dev/null
+++ b/gui/src/codex-account-mutation.ts
@@ -0,0 +1,17 @@
+/** Privacy-safe completion state shared by account mutation UI flows. */
+export interface CodexAccountMutationCompletion {
+  catalogRefreshPending: boolean;
+}
+
+/** Project only the public completion flag from an account mutation response. */
+export function codexAccountMutationCompletion(value: unknown): CodexAccountMutationCompletion {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    return { catalogRefreshPending: false };
+  }
+  const descriptor = Object.getOwnPropertyDescriptor(value, "catalogRefreshPending");
+  return {
+    catalogRefreshPending: descriptor !== undefined
+      && "value" in descriptor
+      && descriptor.value === true,
+  };
+}
diff --git a/gui/src/components/AddCodexAccountModal.tsx b/gui/src/components/AddCodexAccountModal.tsx
index 0217dd3af0..1c86d910db 100644
--- a/gui/src/components/AddCodexAccountModal.tsx
+++ b/gui/src/components/AddCodexAccountModal.tsx
@@ -7,13 +7,14 @@ import {
 import { AddCodexAccountPickStep } from "./add-codex-account-pick-step";
 import { AddCodexAccountWaitingStep } from "./add-codex-account-waiting-step";
 import { useAddCodexAccountOAuth } from "./use-add-codex-account-oauth";
+import type { CodexAccountMutationCompletion } from "../codex-account-mutation";
 
 export default function AddCodexAccountModal({
   apiBase, onClose, onAdded, reauthAccountId,
 }: {
   apiBase: string;
   onClose: () => void;
-  onAdded: () => void;
+  onAdded: (completion: CodexAccountMutationCompletion) => void;
   reauthAccountId?: string;
 }) {
   const t = useT();
diff --git a/gui/src/components/CodexAccountPickerSetting.tsx b/gui/src/components/CodexAccountPickerSetting.tsx
new file mode 100644
index 0000000000..725712918a
--- /dev/null
+++ b/gui/src/components/CodexAccountPickerSetting.tsx
@@ -0,0 +1,153 @@
+import { useCallback, useEffect, useRef, useState } from "react";
+import { readJsonOrThrow } from "../fetch-json";
+import { useT } from "../i18n/shared";
+import type { NoticeTone } from "../ui";
+
+type Feedback = { tone: NoticeTone; message: string } | null;
+
+/** Opt-in control for account-qualified Codex model-picker entries. */
+export default function CodexAccountPickerSetting({ apiBase }: { apiBase: string }) {
+  const t = useT();
+  const [enabled, setEnabled] = useState(false);
+  const [hydrated, setHydrated] = useState(false);
+  const [saving, setSaving] = useState(false);
+  const [loadError, setLoadError] = useState(false);
+  const [feedback, setFeedback] = useState<Feedback>(null);
+  const enabledRef = useRef(false);
+  const savingRef = useRef(false);
+  const loadGenerationRef = useRef(0);
+
+  const load = useCallback(async () => {
+    if (savingRef.current) return;
+    const generation = ++loadGenerationRef.current;
+    try {
+      const response = await fetch(`${apiBase}/api/settings`);
+      if (!response.ok) throw new Error("load");
+      const payload = await response.json() as { codexAccountPickerEnabled?: unknown };
+      if (savingRef.current || generation !== loadGenerationRef.current) return;
+      if (typeof payload.codexAccountPickerEnabled !== "boolean") throw new Error("shape");
+      enabledRef.current = payload.codexAccountPickerEnabled;
+      setEnabled(payload.codexAccountPickerEnabled);
+      setHydrated(true);
+      setLoadError(false);
+    } catch {
+      if (!savingRef.current && generation === loadGenerationRef.current) {
+        setLoadError(true);
+      }
+    }
+  }, [apiBase]);
+
+  useEffect(() => {
+    const timeout = window.setTimeout(() => { void load(); }, 0);
+    const interval = window.setInterval(() => { void load(); }, 30_000);
+    return () => {
+      window.clearTimeout(timeout);
+      window.clearInterval(interval);
+    };
+  }, [load]);
+
+  const toggle = useCallback(async () => {
+    if (savingRef.current || !hydrated) return;
+    const previous = enabledRef.current;
+    const requested = !previous;
+    enabledRef.current = requested;
+    setEnabled(requested);
+    savingRef.current = true;
+    setSaving(true);
+    setFeedback(null);
+    loadGenerationRef.current += 1;
+    try {
+      const response = await fetch(`${apiBase}/api/settings`, {
+        method: "PUT",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ codexAccountPickerEnabled: requested }),
+      });
+      const payload = (await readJsonOrThrow<{
+        ok?: unknown;
+        codexAccountPickerEnabled?: unknown;
+        catalogRefreshPending?: unknown;
+      }>(response)) ?? {};
+      if (payload.ok !== true || typeof payload.codexAccountPickerEnabled !== "boolean") {
+        throw new Error("unconfirmed");
+      }
+      enabledRef.current = payload.codexAccountPickerEnabled;
+      setEnabled(payload.codexAccountPickerEnabled);
+      setHydrated(true);
+      setLoadError(false);
+      setFeedback(payload.catalogRefreshPending === true
+        ? { tone: "warn", message: t("codexAuth.catalogRefreshPending") }
+        : { tone: "ok", message: t("codexAuth.accountPickerUpdated") });
+    } catch {
+      enabledRef.current = previous;
+      setEnabled(previous);
+      setFeedback({ tone: "err", message: t("codexAuth.accountPickerUpdateFailed") });
+    } finally {
+      savingRef.current = false;
+      setSaving(false);
+    }
+  }, [apiBase, hydrated, t]);
+
+  const initialLoadFailed = loadError && !hydrated;
+
+  return (
+    <div
+      className="card card-row codex-account-picker-card"
+      aria-busy={saving || (!hydrated && !initialLoadFailed) || undefined}
+    >
+      <div className="codex-account-picker-copy">
+        <strong>{t("codexAuth.accountPickerTitle")}</strong>
+        <div className="card-sub" role={initialLoadFailed ? "status" : undefined}>
+          {initialLoadFailed
+            ? t("codexAuth.accountPickerLoadFailed")
+            : !hydrated
+              ? t("common.loading")
+              : t(enabled
+                ? "codexAuth.accountPickerOnDesc"
+                : "codexAuth.accountPickerOffDesc")}
+        </div>
+        {hydrated && enabled && (
+          <div className="card-sub faint">{t("codexAuth.accountPickerCompatibility")}</div>
+        )}
+        {hydrated && loadError && (
+          <div className="card-sub faint" role="status">
+            {t("codexAuth.accountPickerRefreshFailed")}
+          </div>
+        )}
+      </div>
+      <div className="codex-account-picker-controls">
+        {loadError && (
+          <button
+            type="button"
+            className="btn btn-ghost btn-sm"
+            onClick={() => { void load(); }}
+            disabled={saving}
+          >
+            {t("common.retry")}
+          </button>
+        )}
+        {hydrated && (
+          <button
+            type="button"
+            className={`toggle ${enabled ? "on" : ""}`}
+            onClick={() => { void toggle(); }}
+            disabled={saving}
+            aria-pressed={enabled}
+            aria-label={t("codexAuth.accountPickerTitle")}
+            title={t("codexAuth.accountPickerTitle")}
+          >
+            <span className="toggle-knob" />
+          </button>
+        )}
+      </div>
+      {feedback && (
+        <div
+          className={`codex-account-picker-feedback is-${feedback.tone}`}
+          role={feedback.tone === "err" ? "alert" : "status"}
+          aria-atomic="true"
+        >
+          {feedback.message}
+        </div>
+      )}
+    </div>
+  );
+}
diff --git a/gui/src/components/CodexAccountPool.tsx b/gui/src/components/CodexAccountPool.tsx
index 475362b897..0440f79e55 100644
--- a/gui/src/components/CodexAccountPool.tsx
+++ b/gui/src/components/CodexAccountPool.tsx
@@ -1,7 +1,7 @@
 import { useCallback, useEffect, useRef, useState } from "react";
 import { useT } from "../i18n/shared";
 import { IconPlus } from "../icons";
-import { EmptyState } from "../ui";
+import { EmptyState, type NoticeTone } from "../ui";
 import AddCodexAccountModal from "./AddCodexAccountModal";
 import { useCodexAccountPool, type CodexAccountPoolController } from "../hooks/useCodexAccountPool";
 import type { ReactNode } from "react";
@@ -19,6 +19,7 @@ import type { CodexAccountEntry } from "./codex-account-pool-types";
 import { accountNeedsReauth } from "../oauth-health-display";
 import { useCopyFeedback } from "./use-copy-feedback";
 import { DEFAULT_ACCOUNT_POOL_STRATEGY } from "../account-pool-strategy";
+import type { CodexAccountMutationCompletion } from "../codex-account-mutation";
 
 // Single definition lives with the controller that owns this data (WP3).
 export type { CodexAccountEntry } from "../hooks/useCodexAccountPool";
@@ -64,7 +65,7 @@ export default function CodexAccountPool({ apiBase, accountModeState = null, ban
   const [showAdd, setShowAdd] = useState(false);
   const [reauthId, setReauthId] = useState<string | null>(null);
   const [actionFeedback, setActionFeedback] = useState<string | null>(null);
-  const [actionFeedbackTone, setActionFeedbackTone] = useState<"ok" | "err" | null>(null);
+  const [actionFeedbackTone, setActionFeedbackTone] = useState<NoticeTone | null>(null);
   const feedbackTimerRef = useRef<ReturnType<typeof setTimeout> | null>(null);
   const [refreshingQuota, setRefreshingQuota] = useState(false);
   const [resetPopup, setResetPopup] = useState<CodexAccountEntry | null>(null);
@@ -74,10 +75,10 @@ export default function CodexAccountPool({ apiBase, accountModeState = null, ban
   const [creditDetailsLoading, setCreditDetailsLoading] = useState(false);
   const doctorCopy = useCopyFeedback<string>();
 
-  const showActionFeedback = useCallback((text: string, error = false) => {
+  const showActionFeedback = useCallback((text: string, tone: NoticeTone = "ok") => {
     if (feedbackTimerRef.current) clearTimeout(feedbackTimerRef.current);
     setActionFeedback(text);
-    setActionFeedbackTone(error ? "err" : "ok");
+    setActionFeedbackTone(tone);
     feedbackTimerRef.current = setTimeout(() => {
       setActionFeedback(null);
       setActionFeedbackTone(null);
@@ -139,9 +140,14 @@ export default function CodexAccountPool({ apiBase, accountModeState = null, ban
     setReauthId(null);
   }, []);
 
-  const handleAccountAdded = useCallback(() => {
+  const handleAccountAdded = useCallback((completion: CodexAccountMutationCompletion) => {
     void controller.syncAfterAccountAdded();
-    showActionFeedback(t("codexAuth.accountAdded"));
+    showActionFeedback(
+      t(completion.catalogRefreshPending
+        ? "codexAuth.catalogRefreshPending"
+        : "codexAuth.accountAdded"),
+      completion.catalogRefreshPending ? "warn" : "ok",
+    );
     closeAddModal();
   }, [closeAddModal, controller, showActionFeedback, t]);
 
@@ -149,7 +155,7 @@ export default function CodexAccountPool({ apiBase, accountModeState = null, ban
     const result = await controller.switchAccount(id);
     if (!result.ok) {
       if (result.reason === "busy") return;
-      showActionFeedback(t("codexAuth.switchFailed"), true);
+      showActionFeedback(t("codexAuth.switchFailed"), "err");
       return;
     }
     setConfirm(null);
@@ -166,7 +172,7 @@ export default function CodexAccountPool({ apiBase, accountModeState = null, ban
     const entered = window.prompt(t("prov.aliasPrompt"), account.alias ?? "");
     if (entered === null) return;
     const result = await controller.saveAlias(account.id, entered);
-    showActionFeedback(t(result.ok ? "prov.aliasSaved" : "prov.aliasSaveFailed"), !result.ok);
+    showActionFeedback(t(result.ok ? "prov.aliasSaved" : "prov.aliasSaveFailed"), result.ok ? "ok" : "err");
   };
 
   const togglePaused = async (account: CodexAccountEntry) => {
@@ -178,7 +184,7 @@ export default function CodexAccountPool({ apiBase, accountModeState = null, ban
       ? paused ? "codexAuth.pauseSucceeded" : "codexAuth.resumeSucceeded"
       : paused ? "codexAuth.pauseFailed" : "codexAuth.resumeFailed", {
       email: account.alias ?? account.email,
-    }), !result.ok);
+    }), result.ok ? "ok" : "err");
   };
 
   const changePriority = async (account: CodexAccountEntry, priority: number) => {
@@ -194,7 +200,7 @@ export default function CodexAccountPool({ apiBase, accountModeState = null, ban
     if (!result.ok && result.reason === "busy") return;
     showActionFeedback(t(result.ok ? "accountPool.priorityUpdated" : "accountPool.priorityUpdateFailed", {
       email: account.alias ?? account.email,
-    }), !result.ok);
+    }), result.ok ? "ok" : "err");
   };
 
   const remove = async (id: string) => {
@@ -202,7 +208,9 @@ export default function CodexAccountPool({ apiBase, accountModeState = null, ban
     if (!window.confirm(t("codexAuth.removeConfirm", { id: label }))) return;
     const result = await controller.removeAccount(id);
     if (!result.ok) {
-      showActionFeedback(t("codexAuth.removeFailed"), true);
+      showActionFeedback(t("codexAuth.removeFailed"), "err");
+    } else if (result.catalogRefreshPending) {
+      showActionFeedback(t("codexAuth.catalogRefreshPending"), "warn");
     }
   };
 
@@ -210,7 +218,7 @@ export default function CodexAccountPool({ apiBase, accountModeState = null, ban
     setRefreshingQuota(true);
     try {
       const ok = await load(true);
-      showActionFeedback(t(ok ? "codexAuth.quotaRefreshed" : "codexAuth.quotaRefreshFailed"), !ok);
+      showActionFeedback(t(ok ? "codexAuth.quotaRefreshed" : "codexAuth.quotaRefreshFailed"), ok ? "ok" : "err");
     } finally {
       setRefreshingQuota(false);
     }
@@ -223,7 +231,7 @@ export default function CodexAccountPool({ apiBase, accountModeState = null, ban
       ? result.pausedCount > 0
         ? t("codexAuth.pauseExhaustedSucceeded", { count: String(result.pausedCount) })
         : t("codexAuth.pauseExhaustedNone")
-      : t("codexAuth.pauseExhaustedFailed"), !result.ok);
+      : t("codexAuth.pauseExhaustedFailed"), result.ok ? "ok" : "err");
   };
 
   const openResetPopup = async (account: CodexAccountEntry) => {
@@ -253,7 +261,7 @@ export default function CodexAccountPool({ apiBase, accountModeState = null, ban
         setResetConfirm(false);
       }
       if (result.toast) {
-        showActionFeedback(result.toast, !result.ok);
+        showActionFeedback(result.toast, result.ok ? "ok" : "err");
       }
     } finally {
       setRedeeming(false);
diff --git a/gui/src/components/codex-account-pool-main-card.tsx b/gui/src/components/codex-account-pool-main-card.tsx
index abde0c9125..4889844629 100644
--- a/gui/src/components/codex-account-pool-main-card.tsx
+++ b/gui/src/components/codex-account-pool-main-card.tsx
@@ -6,6 +6,7 @@ import { CodexPauseToggleLabel, CodexTicketBadge } from "./codex-account-pool-he
 import type { CodexAccountEntry } from "./codex-account-pool-types";
 import type { CodexAccountModeState } from "../codex-multi-state";
 import type { TFn } from "../i18n/shared";
+import type { NoticeTone } from "../ui";
 import {
   doctorCopyButtonLabel,
   formatOAuthHealthLabel,
@@ -189,7 +190,7 @@ export function CodexAccountPoolPageHead({
   pausingExhausted: boolean;
   pauseBusy?: boolean;
   actionFeedback?: string | null;
-  actionFeedbackTone?: "ok" | "err" | null;
+  actionFeedbackTone?: NoticeTone | null;
   onRefresh: () => void;
   onPauseExhausted: () => void;
 }) {
@@ -201,7 +202,7 @@ export function CodexAccountPoolPageHead({
       {!embedded && <h2 className="page-title">{t("nav.codexAuth")}</h2>}
       <div className={embedded ? "row" : "codex-auth-page-head__actions"}>
         <span
-          className={`codex-auth-page-head__feedback${actionFeedbackTone === "ok" ? " is-ok" : ""}${actionFeedbackTone === "err" ? " is-err" : ""}`}
+          className={`codex-auth-page-head__feedback${actionFeedbackTone === "ok" ? " is-ok" : ""}${actionFeedbackTone === "warn" ? " is-warn" : ""}${actionFeedbackTone === "err" ? " is-err" : ""}`}
           role="status"
           aria-live="polite"
         >
diff --git a/gui/src/components/use-add-codex-account-oauth.ts b/gui/src/components/use-add-codex-account-oauth.ts
index c549a29034..84626dafff 100644
--- a/gui/src/components/use-add-codex-account-oauth.ts
+++ b/gui/src/components/use-add-codex-account-oauth.ts
@@ -7,6 +7,10 @@ import type {
 } from "./add-codex-account-reducer";
 import type { TFn } from "../i18n/shared";
 import { readJsonIfOk, readJsonOrThrow } from "../fetch-json";
+import {
+  codexAccountMutationCompletion,
+  type CodexAccountMutationCompletion,
+} from "../codex-account-mutation";
 
 export function useAddCodexAccountOAuth({
   apiBase,
@@ -37,7 +41,7 @@ export function useAddCodexAccountOAuth({
   const manualCodeStateRef = useRef(ui.manualCodeState);
   const loginAbortRef = useRef<AbortController | null>(null);
   const startedReauthRef = useRef<string | null>(null);
-  const onAddedRef = useRef<() => void>(() => {});
+  const onAddedRef = useRef<(completion: CodexAccountMutationCompletion) => void>(() => {});
   const onCloseRef = useRef<() => void>(() => {});
 
   const manualCodeBusy = ui.manualCodeState === "submitting";
@@ -104,7 +108,10 @@ export function useAddCodexAccountOAuth({
     };
   }, [apiBase, clearManualCode, dispatch, stopPolling]);
 
-  const bindCallbacks = useCallback((onAdded: () => void, onClose: () => void) => {
+  const bindCallbacks = useCallback((
+    onAdded: (completion: CodexAccountMutationCompletion) => void,
+    onClose: () => void,
+  ) => {
     onAddedRef.current = onAdded;
     onCloseRef.current = onClose;
   }, []);
@@ -177,7 +184,11 @@ export function useAddCodexAccountOAuth({
           ]);
           try {
             const stRes = await fetch(statusUrl, { signal: tickSignal });
-            const st = await readJsonIfOk<{ status: string; error?: string }>(stRes);
+            const st = await readJsonIfOk<{
+              status: string;
+              error?: string;
+              catalogRefreshPending?: unknown;
+            }>(stRes);
             if (!aliveRef.current || pollSession.signal.aborted) return;
             if (!st) {
               pollErrorStreakRef.current += 1;
@@ -198,7 +209,7 @@ export function useAddCodexAccountOAuth({
               flowRef.current = null;
               dispatch({ type: "set-flow-id", flowId: null });
               if (!aliveRef.current) return;
-              onAddedRef.current();
+              onAddedRef.current(codexAccountMutationCompletion(st));
               onCloseRef.current();
             } else if (st.status === "error" || st.status === "expired") {
               stopPolling();
diff --git a/gui/src/hooks/useCodexAccountPool.ts b/gui/src/hooks/useCodexAccountPool.ts
index ec846ab2f3..84e5c2eb76 100644
--- a/gui/src/hooks/useCodexAccountPool.ts
+++ b/gui/src/hooks/useCodexAccountPool.ts
@@ -3,6 +3,10 @@ import { normalizeAccountPriority } from "../account-priority";
 import { extractAutoSwitchThresholdPayload } from "../codex-auto-switch";
 import type { AccountQuota } from "../codex-quota-utils";
 import { accountNeedsReauth } from "../oauth-health-display";
+import {
+  codexAccountMutationCompletion,
+  type CodexAccountMutationCompletion,
+} from "../codex-account-mutation";
 
 /**
  * Codex account pool DATA layer (WP3 / 030_account_state_lift.md).
@@ -87,7 +91,7 @@ export interface CodexAccountPoolController {
   setAccountPriority(id: string, priority: number | null): Promise<CodexAccountActionResult>;
   pauseExhaustedAccounts(): Promise<CodexAccountActionResult<{ pausedCount: number }>>;
   saveAlias(id: string, alias: string): Promise<CodexAccountActionResult>;
-  removeAccount(id: string): Promise<CodexAccountActionResult>;
+  removeAccount(id: string): Promise<CodexAccountActionResult<CodexAccountMutationCompletion>>;
   syncAfterAccountAdded(): Promise<CodexAccountActionResult>;
 
   pauseRefresh(): PauseToken;
@@ -492,8 +496,11 @@ export function useCodexAccountPool(apiBase: string, enabled = true): CodexAccou
         { method: "DELETE" },
       );
       if (!response.ok) return { ok: false, reason: "request" } as const;
+      const completion = codexAccountMutationCompletion(
+        await response.json().catch(() => ({})),
+      );
       await load();
-      return { ok: true } as const;
+      return { ok: true, ...completion } as const;
     } catch {
       return { ok: false, reason: "request" } as const;
     }
diff --git a/gui/src/i18n/de.ts b/gui/src/i18n/de.ts
index 59322ca427..2e535c0c93 100644
--- a/gui/src/i18n/de.ts
+++ b/gui/src/i18n/de.ts
@@ -957,6 +957,15 @@ export const de: Record<TKey, string> = {
   "codexAuth.requestUserInputUpdatedRestart": "Feature-Flag aktualisiert - gilt für neue Sessions. Starte die Codex-App neu, damit es wirksam wird.",
   "codexAuth.requestUserInputUpdateFailed": "Feature-Flag konnte nicht aktualisiert werden. Es wurde nichts geändert.",
   "codexAuth.requestUserInputLoadFailed": "Feature-Flag konnte nicht aus config.toml gelesen werden.",
+  "codexAuth.accountPickerTitle": "Ein bestimmtes Codex-Konto in der Modellauswahl verwenden",
+  "codexAuth.accountPickerOffDesc": "Wenn aktiviert, werden die normalen GPT-Einträge in der Modellauswahl durch je einen Eintrag pro Kontoselektor ersetzt. So kannst du ohne Abmeldung das genaue Konto für eine Unterhaltung wählen. Beim Deaktivieren werden keine Konten entfernt.",
+  "codexAuth.accountPickerOnDesc": "Jeder Selektor ist eine öffentliche Bezeichnung für ein gespeichertes Konto. Seine Auswahl bindet die Unterhaltung an dieses Konto: keine Pool-Rotation, kein Fallback und keine Änderung des aktiven Pool-Kontos.",
+  "codexAuth.accountPickerCompatibility": "Die integrierte Codex-App-Anmeldung hat einen eigenen Selektor; generierte Zuordnungen nennen ihn normalerweise main und verwenden bei Bedarf ein kollisionssicheres Suffix wie main-2. Hinzugefügte Konten erhalten stabile, datenschutzfreundliche Bezeichnungen; eigene Selektornamen bleiben erhalten. Bestehende Unterhaltungen und gespeicherte Modellauswahlen werden weiterhin geroutet. Beim Deaktivieren werden nur generierte Einträge ausgeblendet, Selektoren und exakte Routen bleiben bestehen. Einfache GPT-Modell-IDs behalten ihr Pool- oder Direct-Verhalten.",
+  "codexAuth.accountPickerUpdated": "Kontozielauswahl aktualisiert.",
+  "codexAuth.accountPickerUpdateFailed": "Die Kontozielauswahl konnte nicht aktualisiert werden. Die zuletzt bestätigte Einstellung wird angezeigt.",
+  "codexAuth.accountPickerLoadFailed": "Die Einstellung für die Kontozielauswahl konnte nicht geladen werden.",
+  "codexAuth.accountPickerRefreshFailed": "Diese Einstellung konnte nicht aktualisiert werden. Der zuletzt bestätigte Wert wird weiterhin angezeigt.",
+  "codexAuth.catalogRefreshPending": "Die Änderung wurde gespeichert, aber die Aktualisierung des Codex-Modellkatalogs steht noch aus. Führe ocx sync aus, um es erneut zu versuchen.",
   "anthropicPool.title": "Claude-Kontenpool (experimentell)",
   "anthropicPool.enabledDesc": "Bei 429 wird das Konto gekühlt und umgeschaltet. Neue Sitzungen bevorzugen Nutzung unter {threshold}% (5-Stunden-Balken).",
   "anthropicPool.disabledDesc": "Nutzt nur das aktive Claude-Konto. Nur aktivieren, wenn experimentelles Routing akzeptabel ist.",
diff --git a/gui/src/i18n/en.ts b/gui/src/i18n/en.ts
index 529ec4d344..9ad5d576d5 100644
--- a/gui/src/i18n/en.ts
+++ b/gui/src/i18n/en.ts
@@ -1411,6 +1411,15 @@ export const en = {
   "codexAuth.requestUserInputUpdatedRestart": "Feature flag updated - applies to new sessions. Restart the Codex app to pick it up.",
   "codexAuth.requestUserInputUpdateFailed": "Could not update the feature flag. Nothing was changed.",
   "codexAuth.requestUserInputLoadFailed": "Could not read the feature flag from config.toml.",
+  "codexAuth.accountPickerTitle": "Target a specific Codex account from the model picker",
+  "codexAuth.accountPickerOffDesc": "When enabled, ordinary GPT picker rows are replaced by one entry per account selector, so you can choose the exact account for a conversation without logging out. Turning it off removes no accounts.",
+  "codexAuth.accountPickerOnDesc": "Each selector is a public label for one stored account. Choosing it locks that conversation to the mapped account: it never rotates or falls back, and it does not change the active Pool account.",
+  "codexAuth.accountPickerCompatibility": "The built-in Codex App login has its own selector; generated maps normally call it main and use a collision-safe suffix such as main-2 when needed. Added accounts receive stable privacy-safe labels, while custom selector labels stay unchanged. Existing conversations and saved model selections continue routing. Turning this off hides generated entries but preserves selectors and exact routes. Plain GPT model IDs keep their Pool or Direct behavior.",
+  "codexAuth.accountPickerUpdated": "Account targeting updated.",
+  "codexAuth.accountPickerUpdateFailed": "Could not update account targeting. The last confirmed setting is shown.",
+  "codexAuth.accountPickerLoadFailed": "Could not load the account-targeting setting.",
+  "codexAuth.accountPickerRefreshFailed": "Could not refresh this setting. The last confirmed value is still shown.",
+  "codexAuth.catalogRefreshPending": "The change was saved, but the Codex model catalog refresh is pending. Run ocx sync to retry.",
 
   "anthropicPool.title": "Claude account pool (experimental)",
   "anthropicPool.enabledDesc": "On 429, cools the account and fails over. New sessions prefer usage under {threshold}% (5-hour bar).",
diff --git a/gui/src/i18n/ja.ts b/gui/src/i18n/ja.ts
index 89d9db9c3d..12e1fb6e7b 100644
--- a/gui/src/i18n/ja.ts
+++ b/gui/src/i18n/ja.ts
@@ -1360,6 +1360,15 @@ export const ja: Record<TKey, string> = {
   "codexAuth.requestUserInputUpdatedRestart": "機能フラグを更新しました - 新しいセッションから適用されます。Codex アプリを再起動してください。",
   "codexAuth.requestUserInputUpdateFailed": "機能フラグを更新できませんでした。変更はありません。",
   "codexAuth.requestUserInputLoadFailed": "config.toml から機能フラグを読み込めませんでした。",
+  "codexAuth.accountPickerTitle": "モデルピッカーで使用する Codex アカウントを指定",
+  "codexAuth.accountPickerOffDesc": "有効にすると、通常の GPT ピッカー項目がアカウントセレクターごとの項目に置き換わり、ログアウトせずに会話で使うアカウントを明示的に選べます。無効にしてもアカウントは削除されません。",
+  "codexAuth.accountPickerOnDesc": "各セレクターは保存済みアカウント 1 つに対応する公開ラベルです。選択した会話はそのアカウントに固定され、Pool のローテーションやフォールバックは行われず、現在の Pool アカウントも変更されません。",
+  "codexAuth.accountPickerCompatibility": "組み込みの Codex App ログインには専用セレクターがあります。生成されたマップでは通常 main と呼ばれ、必要に応じて main-2 のような衝突を避けるサフィックスが使われます。追加アカウントには安定したプライバシー保護ラベルが割り当てられ、カスタムセレクター名は保持されます。既存の会話と保存済みのモデル選択は引き続きルーティングされます。無効にすると生成された項目だけが非表示になり、セレクターと完全一致ルートは保持されます。通常の GPT モデル ID は従来どおり Pool または Direct で動作します。",
+  "codexAuth.accountPickerUpdated": "アカウント指定を更新しました。",
+  "codexAuth.accountPickerUpdateFailed": "アカウント指定を更新できませんでした。最後に確認された設定を表示しています。",
+  "codexAuth.accountPickerLoadFailed": "アカウント指定の設定を読み込めませんでした。",
+  "codexAuth.accountPickerRefreshFailed": "この設定を更新できませんでした。最後に確認された値を引き続き表示しています。",
+  "codexAuth.catalogRefreshPending": "変更は保存されましたが、Codex モデルカタログの更新が保留中です。ocx sync を実行して再試行してください。",
   "anthropicPool.title": "Claude アカウントプール（実験的）",
   "anthropicPool.enabledDesc": "429 時にアカウントをクールダウンしてフェイルオーバーします。新規セッションは 5 時間使用率が {threshold}% 未満のアカウントを優先します。",
   "anthropicPool.disabledDesc": "アクティブな Claude アカウントのみを使用します。実験的ルーティングを受け入れる場合のみ有効にしてください。",
diff --git a/gui/src/i18n/ko.ts b/gui/src/i18n/ko.ts
index 47ef2b5ded..bd17b27419 100644
--- a/gui/src/i18n/ko.ts
+++ b/gui/src/i18n/ko.ts
@@ -981,6 +981,15 @@ export const ko: Record<TKey, string> = {
   "codexAuth.requestUserInputUpdatedRestart": "기능 플래그가 업데이트되었습니다 - 새 세션부터 적용됩니다. Codex 앱을 다시 시작하세요.",
   "codexAuth.requestUserInputUpdateFailed": "기능 플래그를 업데이트하지 못했습니다. 변경된 내용이 없습니다.",
   "codexAuth.requestUserInputLoadFailed": "config.toml에서 기능 플래그를 읽지 못했습니다.",
+  "codexAuth.accountPickerTitle": "모델 선택기에서 사용할 Codex 계정 지정",
+  "codexAuth.accountPickerOffDesc": "활성화하면 일반 GPT 선택기 항목이 계정 선택기별 항목으로 대체되어 로그아웃하지 않고도 대화에 사용할 정확한 계정을 선택할 수 있습니다. 비활성화해도 계정은 삭제되지 않습니다.",
+  "codexAuth.accountPickerOnDesc": "각 선택기는 저장된 계정 하나를 나타내는 공개 레이블입니다. 선택하면 해당 대화가 그 계정에 고정되며 Pool 순환이나 대체가 일어나지 않고 활성 Pool 계정도 바뀌지 않습니다.",
+  "codexAuth.accountPickerCompatibility": "기본 Codex App 로그인에는 자체 선택기가 있습니다. 생성된 맵에서는 보통 main을 사용하며, 충돌 시 main-2 같은 안전한 접미사가 붙습니다. 추가 계정에는 안정적인 개인정보 보호 레이블이 부여되고 사용자 지정 선택기 이름은 유지됩니다. 기존 대화와 저장된 모델 선택은 계속 라우팅됩니다. 비활성화하면 생성된 항목만 숨기며 선택기와 정확한 경로는 보존됩니다. 일반 GPT 모델 ID는 기존 Pool 또는 Direct 동작을 유지합니다.",
+  "codexAuth.accountPickerUpdated": "계정 지정 설정을 업데이트했습니다.",
+  "codexAuth.accountPickerUpdateFailed": "계정 지정 설정을 업데이트하지 못했습니다. 마지막으로 확인된 설정을 표시합니다.",
+  "codexAuth.accountPickerLoadFailed": "계정 지정 설정을 불러오지 못했습니다.",
+  "codexAuth.accountPickerRefreshFailed": "이 설정을 새로 고치지 못했습니다. 마지막으로 확인된 값을 계속 표시합니다.",
+  "codexAuth.catalogRefreshPending": "변경 사항은 저장되었지만 Codex 모델 카탈로그 새로 고침이 보류 중입니다. ocx sync를 실행해 다시 시도하세요.",
   "anthropicPool.title": "Claude 계정 풀(실험적)",
   "anthropicPool.enabledDesc": "429 시 계정을 쿨다운하고 장애 조치합니다. 새 세션은 5시간 사용량이 {threshold}% 미만인 계정을 우선합니다.",
   "anthropicPool.disabledDesc": "활성 Claude 계정만 사용합니다. 실험적 라우팅을 감수할 때만 켜세요.",
diff --git a/gui/src/i18n/ru.ts b/gui/src/i18n/ru.ts
index 435ddcd1e0..b02cb6e591 100644
--- a/gui/src/i18n/ru.ts
+++ b/gui/src/i18n/ru.ts
@@ -1402,6 +1402,15 @@ export const ru: Record<TKey, string> = {
   "codexAuth.requestUserInputUpdatedRestart": "Флаг обновлён - применяется к новым сеансам. Перезапустите приложение Codex.",
   "codexAuth.requestUserInputUpdateFailed": "Не удалось обновить флаг. Ничего не изменено.",
   "codexAuth.requestUserInputLoadFailed": "Не удалось прочитать флаг из config.toml.",
+  "codexAuth.accountPickerTitle": "Выбирать конкретный аккаунт Codex в списке моделей",
+  "codexAuth.accountPickerOffDesc": "После включения обычные пункты GPT в списке моделей заменяются отдельным пунктом для каждого селектора аккаунта, поэтому можно явно выбрать аккаунт для разговора без выхода из системы. Отключение не удаляет аккаунты.",
+  "codexAuth.accountPickerOnDesc": "Каждый селектор — публичная метка одного сохранённого аккаунта. Выбор закрепляет разговор за этим аккаунтом: без ротации и перехода на другой аккаунт, а активный аккаунт Pool не меняется.",
+  "codexAuth.accountPickerCompatibility": "Для встроенного входа Codex App используется отдельный селектор; в созданных map он обычно называется main, а при коллизии получает безопасный суффикс вроде main-2. Добавленные аккаунты получают стабильные метки, не раскрывающие личные данные, а пользовательские имена селекторов сохраняются. Существующие разговоры и сохранённые варианты моделей продолжают маршрутизироваться. Отключение скрывает созданные пункты, но сохраняет селекторы и точные маршруты. Обычные идентификаторы моделей GPT продолжают работать в режиме Pool или Direct.",
+  "codexAuth.accountPickerUpdated": "Выбор целевого аккаунта обновлён.",
+  "codexAuth.accountPickerUpdateFailed": "Не удалось обновить выбор целевого аккаунта. Показана последняя подтверждённая настройка.",
+  "codexAuth.accountPickerLoadFailed": "Не удалось загрузить настройку выбора аккаунта.",
+  "codexAuth.accountPickerRefreshFailed": "Не удалось обновить эту настройку. По-прежнему показано последнее подтверждённое значение.",
+  "codexAuth.catalogRefreshPending": "Изменение сохранено, но обновление каталога моделей Codex ещё не завершено. Выполните ocx sync, чтобы повторить попытку.",
   "anthropicPool.title": "Пул аккаунтов Claude (экспериментально)",
   "anthropicPool.enabledDesc": "При 429 аккаунт охлаждается и выполняется переключение. Новые сессии предпочитают использование ниже {threshold}% (полоса 5 часов).",
   "anthropicPool.disabledDesc": "Используется только активный аккаунт Claude. Включайте только если принимаете экспериментальную маршрутизацию.",
diff --git a/gui/src/i18n/zh.ts b/gui/src/i18n/zh.ts
index a45ae10c05..83d42fb0ed 100644
--- a/gui/src/i18n/zh.ts
+++ b/gui/src/i18n/zh.ts
@@ -974,6 +974,15 @@ export const zh: Record<TKey, string> = {
   "codexAuth.requestUserInputUpdatedRestart": "功能标志已更新 - 适用于新会话。请重启 Codex 应用。",
   "codexAuth.requestUserInputUpdateFailed": "无法更新功能标志。未做任何更改。",
   "codexAuth.requestUserInputLoadFailed": "无法从 config.toml 读取功能标志。",
+  "codexAuth.accountPickerTitle": "在模型选择器中指定 Codex 账号",
+  "codexAuth.accountPickerOffDesc": "启用后，普通 GPT 选择器条目会替换为每个账号选择器对应的条目，让你无需退出登录即可为对话明确选择账号。关闭此功能不会删除任何账号。",
+  "codexAuth.accountPickerOnDesc": "每个选择器都是一个已存储账号的公开标签。选择后，该对话会锁定到对应账号，不会参与 Pool 轮换或故障转移，也不会更改当前的 Pool 账号。",
+  "codexAuth.accountPickerCompatibility": "内置 Codex App 登录有自己的选择器；生成的映射通常使用 main，发生冲突时会使用 main-2 这类安全后缀。新增账号会获得稳定且保护隐私的标签，自定义选择器名称保持不变。现有对话和已保存的模型选择会继续路由。关闭后只隐藏生成的条目，选择器和精确路由仍会保留。普通 GPT 模型 ID 继续保持原有的 Pool 或 Direct 行为。",
+  "codexAuth.accountPickerUpdated": "账号指定设置已更新。",
+  "codexAuth.accountPickerUpdateFailed": "无法更新账号指定设置。当前显示的是最后一次确认的设置。",
+  "codexAuth.accountPickerLoadFailed": "无法加载账号指定设置。",
+  "codexAuth.accountPickerRefreshFailed": "无法刷新此设置。当前仍显示最后一次确认的值。",
+  "codexAuth.catalogRefreshPending": "更改已保存，但 Codex 模型目录仍待刷新。请运行 ocx sync 重试。",
   "anthropicPool.title": "Claude 账户池（实验性）",
   "anthropicPool.enabledDesc": "遇到 429 时冷却该账户并故障转移。新会话优先使用 5 小时用量低于 {threshold}% 的账户。",
   "anthropicPool.disabledDesc": "仅使用当前活跃的 Claude 账户。仅在接受实验性路由时启用。",
diff --git a/gui/src/pages/CodexAuth.tsx b/gui/src/pages/CodexAuth.tsx
index ea71df89b4..e615c7211c 100644
--- a/gui/src/pages/CodexAuth.tsx
+++ b/gui/src/pages/CodexAuth.tsx
@@ -2,6 +2,7 @@ import { useCallback, useEffect, useRef, useState } from "react";
 import { useT } from "../i18n/shared";
 import CodexAccountPool from "../components/CodexAccountPool";
 import DefaultModeRequestUserInputSetting from "../components/DefaultModeRequestUserInputSetting";
+import CodexAccountPickerSetting from "../components/CodexAccountPickerSetting";
 import { codexAccountModeState, type CodexAccountModeState } from "../codex-multi-state";
 import { ensureOpenAiProvider, openAiAccountProviderState, OpenAiEnableError } from "../provider-payload";
 import { readSessionListCache, writeSessionListCache } from "../session-list-cache";
@@ -178,6 +179,7 @@ export default function CodexAuth({ apiBase }: { apiBase: string }) {
   return (
     <>
       <CodexAccountPool apiBase={apiBase} accountModeState={accountModeState} banner={banner} />
+      <CodexAccountPickerSetting apiBase={apiBase} />
       <DefaultModeRequestUserInputSetting apiBase={apiBase} />
     </>
   );
diff --git a/gui/src/pages/Providers.tsx b/gui/src/pages/Providers.tsx
index 43e7adb67f..d51c9b58c9 100644
--- a/gui/src/pages/Providers.tsx
+++ b/gui/src/pages/Providers.tsx
@@ -4,10 +4,9 @@ import ProviderDetails from "../components/provider-workspace/ProviderDetails";
 import type { WorkspaceProvider } from "../provider-workspace/catalog";
 import { ensureOpenAiProvider, openAiAccountProviderState, OpenAiEnableError } from "../provider-payload";
 import { oauthTosRisk } from "../oauth-tos-risk";
-import { ToastNotice } from "../ui";
+import { ToastNotice, type NoticeTone } from "../ui";
 import { IconPlus } from "../icons";
 import { useT } from "../i18n/shared";
-import { formatProviderDisplayName } from "../provider-icons";
 import { useProviderAccountPools } from "../hooks/useProviderAccountPools";
 import { useCodexAccountPool } from "../hooks/useCodexAccountPool";
 import { useJsonConfigEditor } from "../hooks/useJsonConfigEditor";
@@ -19,6 +18,7 @@ import { useProvidersCrud } from "./use-providers-crud";
 import { useProvidersFetch } from "./use-providers-fetch";
 import { ProvidersPageModals } from "./providers-page-modals";
 import { buildAccountLoginStatus, buildAddModalAccountRows } from "./providers-page-utils";
+import type { CodexAccountMutationCompletion } from "../codex-account-mutation";
 
 export default function Providers({ apiBase }: { apiBase: string }) {
   const t = useT();
@@ -29,6 +29,7 @@ export default function Providers({ apiBase }: { apiBase: string }) {
   const [adding, setAdding] = useState(false);
   const [status, setStatus] = useState("");
   const [statusOk, setStatusOk] = useState(false);
+  const [statusTone, setStatusTone] = useState<NoticeTone>("err");
   /** Bumped on every notify so repeated identical success toasts restart the dismiss timer. */
   const [statusRevision, setStatusRevision] = useState(0);
   const [oauthProviders, setOauthProviders] = useState<string[]>([]);
@@ -56,14 +57,27 @@ export default function Providers({ apiBase }: { apiBase: string }) {
   const notify = useCallback((msg: string, ok: boolean = true) => {
     setStatus(msg);
     setStatusOk(ok);
+    setStatusTone(ok ? "ok" : "err");
     setStatusRevision(revision => revision + 1);
   }, []);
 
   const clearStatus = useCallback(() => {
     setStatus("");
     setStatusOk(false);
+    setStatusTone("err");
   }, []);
 
+  const notifyCodexCompletion = useCallback((completion: CodexAccountMutationCompletion) => {
+    if (completion.catalogRefreshPending) {
+      setStatus(t("codexAuth.catalogRefreshPending"));
+      setStatusOk(false);
+      setStatusTone("warn");
+      setStatusRevision(revision => revision + 1);
+      return;
+    }
+    notify(t("codexAuth.accountAdded"), true);
+  }, [notify, t]);
+
   useEffect(() => { aliveRef.current = true; return () => { aliveRef.current = false; }; }, []);
 
   // Success toasts are transient; errors stay until the next notify or dismiss.
@@ -230,7 +244,7 @@ export default function Providers({ apiBase }: { apiBase: string }) {
           <h2>{t("nav.providers")}</h2>
         </div>
         {status
-          ? <ToastNotice tone="err" onDismiss={clearStatus} dismissLabel={t("common.close")}>{status}</ToastNotice>
+          ? <ToastNotice tone={statusTone} onDismiss={clearStatus} dismissLabel={t("common.close")}>{status}</ToastNotice>
           : (
             <div className="providers-workspace providers-workspace--boot" aria-busy="true">
               <div className="providers-workspace-rail providers-workspace-rail--boot" aria-hidden="true" />
@@ -298,7 +312,7 @@ export default function Providers({ apiBase }: { apiBase: string }) {
         </div>
       </div>
       {status && (
-        <ToastNotice tone={statusOk ? "ok" : "err"} onDismiss={clearStatus} dismissLabel={t("common.close")}>{status}</ToastNotice>
+        <ToastNotice tone={statusTone} onDismiss={clearStatus} dismissLabel={t("common.close")}>{status}</ToastNotice>
       )}
       <ProviderWorkspaceShell
         onRemoveProvider={removeProvider}
@@ -409,9 +423,9 @@ export default function Providers({ apiBase }: { apiBase: string }) {
         onAccountManage={onAccountManage}
         onOpenAdd={fetchOauth}
         onCloseCodexLogin={() => setCodexLoginOpen(false)}
-        onCodexAdded={() => {
+        onCodexAdded={(completion) => {
           setCodexLoginOpen(false);
-          notify(t("prov.loginOk", { provider: formatProviderDisplayName("openai", t), cmd: "ocx sync" }), true);
+          notifyCodexCompletion(completion);
           void fetchConfig();
           void fetchOauth();
           void fetchProviderQuotas(true);
diff --git a/gui/src/pages/providers-page-modals.tsx b/gui/src/pages/providers-page-modals.tsx
index 92624f7dbf..243dd125ae 100644
--- a/gui/src/pages/providers-page-modals.tsx
+++ b/gui/src/pages/providers-page-modals.tsx
@@ -6,6 +6,7 @@ import type { AddProviderIntent } from "../components/provider-workspace/Provide
 import type { AccountLoginRow, AccountLoginStatus } from "../components/provider-catalog/ProviderCatalog";
 import type { ProvidersConfig } from "./providers-shared";
 import { oauthLabel } from "./providers-shared";
+import type { CodexAccountMutationCompletion } from "../codex-account-mutation";
 
 export function ProvidersPageModals({
   apiBase,
@@ -59,7 +60,7 @@ export function ProvidersPageModals({
   onAccountManage?: (provider: string) => void;
   onOpenAdd: () => void;
   onCloseCodexLogin: () => void;
-  onCodexAdded: () => void;
+  onCodexAdded: (completion: CodexAccountMutationCompletion) => void;
   onCancelRemove: () => void;
   onConfirmRemove: () => void;
   onCancelJsonLeave?: () => void;
diff --git a/gui/src/styles.css b/gui/src/styles.css
index b222f914f4..e671054597 100644
--- a/gui/src/styles.css
+++ b/gui/src/styles.css
@@ -1474,6 +1474,20 @@ dialog.modal-overlay::backdrop {
 .codex-request-user-input-controls > .toggle { margin-left: auto; }
 .codex-request-user-input-feedback { flex: 1 0 100%; margin-top: -8px; color: var(--muted); font-size: var(--text-label); line-height: var(--leading-body); text-align: right; }
 .codex-request-user-input-feedback.is-error { color: var(--red); }
+.codex-account-picker-card { gap: 16px; flex-wrap: wrap; margin-top: 16px; }
+.codex-account-picker-copy { flex: 1 1 34rem; min-width: 0; }
+.codex-account-picker-copy .card-sub { padding: 4px 0 0; }
+.codex-account-picker-controls { display: flex; align-items: center; gap: 12px; flex: 0 0 auto; margin-left: auto; }
+.codex-account-picker-feedback {
+  flex: 1 0 100%;
+  margin-top: -8px;
+  font-size: var(--text-label);
+  line-height: var(--leading-body);
+  text-align: right;
+}
+.codex-account-picker-feedback.is-ok { color: var(--green); }
+.codex-account-picker-feedback.is-warn { color: var(--amber); }
+.codex-account-picker-feedback.is-err { color: var(--red); }
 /* The toggle now lives in the slot below, which carries the auto margin itself. */
 /*
   Toggle slot: matches the height of the threshold compound so the 20px toggle centres against
@@ -1637,6 +1651,12 @@ dialog.modal-overlay::backdrop {
   white-space: nowrap;
 }
 .codex-auth-page-head__feedback.is-ok { color: var(--green); }
+.codex-auth-page-head__feedback.is-warn {
+  color: var(--amber);
+  overflow: visible;
+  text-overflow: clip;
+  white-space: normal;
+}
 .codex-auth-page-head__feedback.is-err { color: var(--red); }
 .codex-auth-pause-label {
   display: inline-block;
diff --git a/gui/src/ui.tsx b/gui/src/ui.tsx
index 5907ac7071..409bd3e16b 100644
--- a/gui/src/ui.tsx
+++ b/gui/src/ui.tsx
@@ -14,7 +14,10 @@ export function Switch({ on, onClick, disabled, label }: { on: boolean; onClick:
   );
 }
 
-export function Notice({ tone, children }: { tone: "ok" | "err" | "warn"; children: ReactNode }) {
+/** Shared presentation tone for success, degraded success, and failure notices. */
+export type NoticeTone = "ok" | "warn" | "err";
+
+export function Notice({ tone, children }: { tone: NoticeTone; children: ReactNode }) {
   // `warn` is degraded-but-not-failed: the action happened, something adjacent
   // did not. It must not render as the clean success the user did not get.
   const toneClass = tone === "ok" ? "notice-ok" : tone === "warn" ? "notice-warn" : "notice-err";
@@ -36,7 +39,7 @@ export function ToastNotice({
   onDismiss,
   dismissLabel,
 }: {
-  tone: "ok" | "err";
+  tone: NoticeTone;
   children: ReactNode;
   onDismiss?: () => void;
   /** Required whenever onDismiss is provided — pass t("common.close"). */
@@ -45,7 +48,7 @@ export function ToastNotice({
   return createPortal(
     <div className="toast-notice-host" role="presentation">
       <div
-        className={`toast-notice notice ${tone === "ok" ? "notice-ok" : "notice-err"}`}
+        className={`toast-notice notice ${tone === "ok" ? "notice-ok" : tone === "warn" ? "notice-warn" : "notice-err"}`}
         role="status"
         aria-live="polite"
       >
diff --git a/gui/tests/add-codex-account-oauth.test.tsx b/gui/tests/add-codex-account-oauth.test.tsx
index 5f2a9408c5..c687d5f63c 100644
--- a/gui/tests/add-codex-account-oauth.test.tsx
+++ b/gui/tests/add-codex-account-oauth.test.tsx
@@ -1,6 +1,6 @@
 import { afterEach, beforeEach, expect, test } from "bun:test";
 import { Window } from "happy-dom";
-import { act, StrictMode, useReducer } from "react";
+import { act, StrictMode, useEffect, useReducer } from "react";
 import type { Root } from "react-dom/client";
 import {
   addCodexAccountUiReducer,
@@ -8,6 +8,7 @@ import {
 } from "../src/components/add-codex-account-reducer";
 import { useAddCodexAccountOAuth } from "../src/components/use-add-codex-account-oauth";
 import { LanguageProvider } from "../src/i18n/provider";
+import type { CodexAccountMutationCompletion } from "../src/codex-account-mutation";
 
 /**
  * StrictMode reauth latch + login-status single-flight / abort contracts for
@@ -95,27 +96,37 @@ afterEach(async () => {
   await win.happyDOM?.close?.();
 });
 
-function Probe({ reauthAccountId }: { reauthAccountId: string }) {
+function Probe({
+  reauthAccountId,
+  onAdded = () => {},
+}: {
+  reauthAccountId: string;
+  onAdded?: (completion: CodexAccountMutationCompletion) => void;
+}) {
   const [ui, dispatch] = useReducer(
     addCodexAccountUiReducer,
     reauthAccountId,
     initialAddCodexAccountUiState,
   );
-  useAddCodexAccountOAuth({
+  const oauth = useAddCodexAccountOAuth({
     apiBase: "",
     reauthAccountId,
     ui,
     dispatch,
     t: ((key: string) => key) as never,
   });
+  useEffect(() => oauth.bindCallbacks(onAdded, () => {}), [oauth.bindCallbacks, onAdded]);
   return <div data-testid="oauth-probe" data-step={ui.step} />;
 }
 
-async function mountProbe(strict: boolean) {
+async function mountProbe(
+  strict: boolean,
+  onAdded?: (completion: CodexAccountMutationCompletion) => void,
+) {
   const { createRoot } = await import("react-dom/client");
   await act(async () => {
     root = createRoot(host);
-    const tree = <LanguageProvider><Probe reauthAccountId="acct-1" /></LanguageProvider>;
+    const tree = <LanguageProvider><Probe reauthAccountId="acct-1" onAdded={onAdded} /></LanguageProvider>;
     root.render(strict ? <StrictMode>{tree}</StrictMode> : tree);
   });
   await act(async () => { await new Promise((r) => setTimeout(r, 40)); });
@@ -158,3 +169,22 @@ test("slow login-status polls stay single-flight and abort on unmount", async ()
   const statusAfter = calls.filter((c) => c.path.includes("/api/codex-auth/login-status"));
   expect(statusAfter.length).toBe(1);
 }, { timeout: 20_000 });
+
+test("completed login forwards only the public catalog completion flag", async () => {
+  let completion: CodexAccountMutationCompletion | null = null;
+  await mountProbe(false, value => { completion = value; });
+  await act(async () => { await new Promise((r) => setTimeout(r, 2100)); });
+  expect(statusHolders.length).toBe(1);
+
+  await act(async () => {
+    statusHolders.shift()!.resolve(Response.json({
+      status: "done",
+      catalogRefreshPending: true,
+      privateDetail: "private-account-detail",
+    }));
+    await new Promise((r) => setTimeout(r, 40));
+  });
+
+  expect(completion).toEqual({ catalogRefreshPending: true });
+  expect(JSON.stringify(completion)).not.toContain("private-account-detail");
+}, { timeout: 10_000 });
diff --git a/gui/tests/codex-account-picker-setting.test.tsx b/gui/tests/codex-account-picker-setting.test.tsx
new file mode 100644
index 0000000000..d4590fb672
--- /dev/null
+++ b/gui/tests/codex-account-picker-setting.test.tsx
@@ -0,0 +1,280 @@
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { Window } from "happy-dom";
+import { act } from "react";
+import type { Root } from "react-dom/client";
+import CodexAccountPickerSetting from "../src/components/CodexAccountPickerSetting";
+import { LanguageProvider } from "../src/i18n/provider";
+
+const domGlobals = ["document", "window", "navigator", "fetch", "IS_REACT_ACT_ENVIRONMENT"] as const;
+let previousDomGlobals: Record<(typeof domGlobals)[number], unknown>;
+let testWindow: Window;
+let mountedRoot: Root | null;
+
+function deferred<T>(): { promise: Promise<T>; resolve(value: T): void } {
+  let resolve!: (value: T) => void;
+  const promise = new Promise<T>(res => { resolve = res; });
+  return { promise, resolve };
+}
+
+async function flush(): Promise<void> {
+  await Promise.resolve();
+  await new Promise<void>(resolve => testWindow.setTimeout(resolve, 0));
+  await Promise.resolve();
+}
+
+function response(body: unknown, status = 200): Response {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { "content-type": "application/json" },
+  });
+}
+
+describe("CodexAccountPickerSetting", () => {
+  beforeEach(() => {
+    previousDomGlobals = Object.fromEntries(
+      domGlobals.map(key => [key, Reflect.get(globalThis, key)]),
+    ) as typeof previousDomGlobals;
+    testWindow = new Window({ url: "http://localhost/" });
+    Object.defineProperty(testWindow.navigator, "language", { configurable: true, value: "en-US" });
+    Object.defineProperties(globalThis, {
+      document: { configurable: true, value: testWindow.document },
+      window: { configurable: true, value: testWindow },
+      navigator: { configurable: true, value: testWindow.navigator },
+    });
+    (globalThis as typeof globalThis & { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT = true;
+    mountedRoot = null;
+  });
+
+  afterEach(async () => {
+    if (mountedRoot) {
+      await act(async () => { mountedRoot?.unmount(); });
+      mountedRoot = null;
+    }
+    for (const key of domGlobals) {
+      Object.defineProperty(globalThis, key, { configurable: true, value: previousDomGlobals[key] });
+    }
+    await testWindow.happyDOM?.close?.();
+  });
+
+  async function mount(fetchMock: typeof fetch): Promise<HTMLElement> {
+    globalThis.fetch = fetchMock;
+    const host = testWindow.document.createElement("div");
+    testWindow.document.body.appendChild(host as never);
+    const { createRoot } = await import("react-dom/client");
+    await act(async () => {
+      mountedRoot = createRoot(host);
+      mountedRoot.render(
+        <LanguageProvider>
+          <CodexAccountPickerSetting apiBase="http://proxy" />
+        </LanguageProvider>,
+      );
+    });
+    await act(async () => { await flush(); });
+    return host;
+  }
+
+  function toggle(host: ParentNode): HTMLButtonElement {
+    const button = host.querySelector<HTMLButtonElement>("button.toggle");
+    if (!button) throw new Error("toggle missing");
+    return button;
+  }
+
+  test("explains exact account targeting generically and waits for effective state", async () => {
+    const settings = deferred<Response>();
+    const host = await mount((async () => settings.promise) as typeof fetch);
+
+    expect(host.textContent).toContain("Target a specific Codex account from the model picker");
+    expect(host.querySelector("button.toggle")).toBeNull();
+    expect(host.textContent).not.toMatch(/Personal|Work/);
+
+    await act(async () => {
+      settings.resolve(response({ codexAccountPickerEnabled: true }));
+      await flush();
+    });
+    expect(toggle(host).getAttribute("aria-pressed")).toBe("true");
+    expect(host.textContent).toContain("never rotates or falls back");
+    expect(host.textContent).toContain("stable privacy-safe labels");
+    expect(host.textContent).toContain("Existing conversations and saved model selections continue routing");
+    expect(host.textContent).toContain("Plain GPT model IDs keep their Pool or Direct behavior");
+  });
+
+  test("serializes rapid clicks and trusts the confirmed response state", async () => {
+    const pendingPut = deferred<Response>();
+    let puts = 0;
+    const host = await mount((async (_input: RequestInfo | URL, init?: RequestInit) => {
+      if (init?.method === "PUT") {
+        puts += 1;
+        return pendingPut.promise;
+      }
+      return response({ codexAccountPickerEnabled: false });
+    }) as typeof fetch);
+
+    act(() => {
+      toggle(host).click();
+      toggle(host).click();
+    });
+    expect(puts).toBe(1);
+    expect(toggle(host).disabled).toBe(true);
+    expect(toggle(host).getAttribute("aria-pressed")).toBe("true");
+
+    await act(async () => {
+      pendingPut.resolve(response({
+        ok: true,
+        codexAccountPickerEnabled: false,
+        catalogRefreshPending: false,
+      }));
+      await flush();
+    });
+    expect(toggle(host).disabled).toBe(false);
+    expect(toggle(host).getAttribute("aria-pressed")).toBe("false");
+  });
+
+  test("renders a saved pending refresh as an amber warning", async () => {
+    const host = await mount((async (_input: RequestInfo | URL, init?: RequestInit) => {
+      if (init?.method === "PUT") {
+        return response({
+          ok: true,
+          codexAccountPickerEnabled: true,
+          catalogRefreshPending: true,
+          privateDetail: "private-account-detail",
+        });
+      }
+      return response({ codexAccountPickerEnabled: false });
+    }) as typeof fetch);
+
+    await act(async () => {
+      toggle(host).click();
+      await flush();
+    });
+    const warning = host.querySelector<HTMLElement>(".codex-account-picker-feedback.is-warn");
+    expect(warning?.textContent).toContain("ocx sync");
+    expect(warning?.getAttribute("role")).toBe("status");
+    expect(host.textContent).not.toContain("private-account-detail");
+  });
+
+  test("failed saves revert the optimistic toggle and show only generic feedback", async () => {
+    const host = await mount((async (_input: RequestInfo | URL, init?: RequestInit) => {
+      if (init?.method === "PUT") return response({ error: "private server path" }, 500);
+      return response({ codexAccountPickerEnabled: false });
+    }) as typeof fetch);
+
+    await act(async () => {
+      toggle(host).click();
+      await flush();
+    });
+    expect(toggle(host).getAttribute("aria-pressed")).toBe("false");
+    expect(host.querySelector('[role="alert"]')?.textContent).toContain("last confirmed setting");
+    expect(host.textContent).not.toContain("private server path");
+  });
+
+  test("contains an initial load failure without exposing an actionable false state", async () => {
+    let shouldFail = true;
+    const host = await mount((async () => {
+      if (shouldFail) return response({ error: "private server path" }, 500);
+      return response({ codexAccountPickerEnabled: true });
+    }) as typeof fetch);
+
+    expect(host.querySelector("button.toggle")).toBeNull();
+    expect(host.querySelector('[role="alert"]')).toBeNull();
+    expect(host.querySelector('[role="status"]')?.textContent).toContain("Could not load");
+    expect(host.textContent).not.toContain("private server path");
+
+    shouldFail = false;
+    const retry = Array.from(host.querySelectorAll("button")).find(button =>
+      button.textContent === "Retry"
+    );
+    expect(retry).toBeTruthy();
+    await act(async () => {
+      retry?.click();
+      await flush();
+    });
+    expect(toggle(host).getAttribute("aria-pressed")).toBe("true");
+  });
+
+  test("keeps the last confirmed toggle actionable after a background refresh failure", async () => {
+    let getCount = 0;
+    let putCount = 0;
+    let pollCallback: (() => void) | null = null;
+    const originalSetInterval = testWindow.setInterval.bind(testWindow);
+    testWindow.setInterval = ((callback: TimerHandler, ms?: number, ...args: unknown[]) => {
+      if (typeof callback === "function") pollCallback = callback as () => void;
+      return originalSetInterval(callback, ms, ...args) as number;
+    }) as typeof testWindow.setInterval;
+    const host = await mount((async (_input: RequestInfo | URL, init?: RequestInit) => {
+      if (init?.method === "PUT") {
+        putCount += 1;
+        return response({
+          ok: true,
+          codexAccountPickerEnabled: false,
+          catalogRefreshPending: false,
+        });
+      }
+      getCount += 1;
+      return getCount === 1
+        ? response({ codexAccountPickerEnabled: true })
+        : response({ error: "temporary" }, 503);
+    }) as typeof fetch);
+
+    await act(async () => {
+      pollCallback?.();
+      await flush();
+    });
+
+    expect(toggle(host).getAttribute("aria-pressed")).toBe("true");
+    expect(toggle(host).disabled).toBe(false);
+    expect(host.textContent).toContain("Could not refresh this setting");
+    expect(Array.from(host.querySelectorAll("button")).some(button => button.textContent === "Retry")).toBe(true);
+
+    await act(async () => {
+      toggle(host).click();
+      await flush();
+    });
+
+    expect(putCount).toBe(1);
+    expect(toggle(host).getAttribute("aria-pressed")).toBe("false");
+    expect(host.textContent).not.toContain("Could not refresh this setting");
+  });
+
+  test("an older poll cannot overwrite an optimistic or confirmed mutation", async () => {
+    const stalePoll = deferred<Response>();
+    const pendingPut = deferred<Response>();
+    let getCount = 0;
+    let pollCallback: (() => void) | null = null;
+    const originalSetInterval = testWindow.setInterval.bind(testWindow);
+    testWindow.setInterval = ((callback: TimerHandler, ms?: number, ...args: unknown[]) => {
+      if (typeof callback === "function") pollCallback = callback as () => void;
+      return originalSetInterval(callback, ms, ...args) as number;
+    }) as typeof testWindow.setInterval;
+    const host = await mount((async (_input: RequestInfo | URL, init?: RequestInit) => {
+      if (init?.method === "PUT") return pendingPut.promise;
+      getCount += 1;
+      return getCount === 1
+        ? response({ codexAccountPickerEnabled: false })
+        : stalePoll.promise;
+    }) as typeof fetch);
+
+    await act(async () => {
+      pollCallback?.();
+      await flush();
+      toggle(host).click();
+      await flush();
+    });
+    expect(toggle(host).getAttribute("aria-pressed")).toBe("true");
+
+    await act(async () => {
+      stalePoll.resolve(response({ codexAccountPickerEnabled: false }));
+      await flush();
+    });
+    expect(toggle(host).getAttribute("aria-pressed")).toBe("true");
+
+    await act(async () => {
+      pendingPut.resolve(response({
+        ok: true,
+        codexAccountPickerEnabled: true,
+        catalogRefreshPending: false,
+      }));
+      await flush();
+    });
+    expect(toggle(host).getAttribute("aria-pressed")).toBe("true");
+  });
+});
diff --git a/gui/tests/codex-account-pool-behaviour.test.tsx b/gui/tests/codex-account-pool-behaviour.test.tsx
index 8d67cd146f..2f41d45627 100644
--- a/gui/tests/codex-account-pool-behaviour.test.tsx
+++ b/gui/tests/codex-account-pool-behaviour.test.tsx
@@ -35,6 +35,7 @@ let activePinned = false;
 let activePinnedAccountId: string | null = null;
 let omitPinnedAccountId = false;
 let activeGetId: string | null = null;
+let deleteCatalogRefreshPending = false;
 
 beforeEach(() => {
   previous = Object.fromEntries(globals.map((k) => [k, Reflect.get(globalThis, k)])) as typeof previous;
@@ -62,6 +63,7 @@ beforeEach(() => {
   activePinnedAccountId = null;
   omitPinnedAccountId = false;
   activeGetId = null;
+  deleteCatalogRefreshPending = false;
   accounts = [{ id: "a1", email: "account-one", isMain: true, paused: false, priority: 0, hasCredential: true, quota: null }];
   Object.defineProperty(globalThis, "fetch", {
     configurable: true,
@@ -116,6 +118,16 @@ beforeEach(() => {
           }),
         } as unknown as Response;
       }
+      if (path.startsWith("codex-auth/accounts") && init?.method === "DELETE") {
+        return {
+          ok: true,
+          json: async () => ({
+            ok: true,
+            catalogRefreshPending: deleteCatalogRefreshPending,
+            privateDetail: "private-delete-detail",
+          }),
+        } as unknown as Response;
+      }
       if (path.startsWith("codex-auth/accounts")) {
         const gate = nextAccountsResponseGate;
         nextAccountsResponseGate = null;
@@ -204,6 +216,19 @@ test("an inert controller issues no requests at all", async () => {
   expect(calls.length).toBe(0);
 });
 
+test("account removal returns only the public catalog completion flag", async () => {
+  deleteCatalogRefreshPending = true;
+  const seen = await mountController();
+
+  await act(async () => {
+    expect(await seen.current!.removeAccount("a1")).toEqual({
+      ok: true,
+      catalogRefreshPending: true,
+    });
+  });
+  expect(calls).toContain("DELETE codex-auth/accounts?id=a1");
+});
+
 test("pausing an account writes the persisted endpoint and updates shared state", async () => {
   const seen = await mountController();
 
diff --git a/gui/tests/codex-account-pool-toast-tone.test.tsx b/gui/tests/codex-account-pool-toast-tone.test.tsx
index a8b08c06be..a8e070bfc1 100644
--- a/gui/tests/codex-account-pool-toast-tone.test.tsx
+++ b/gui/tests/codex-account-pool-toast-tone.test.tsx
@@ -170,6 +170,27 @@ test("a rejected selection order reports in the error tone", async () => {
   expect(host.querySelector(".codex-auth-page-head__feedback.is-ok")).toBeNull();
 });
 
+test("a saved removal with pending catalog refresh renders a warning tone", async () => {
+  await mountPool(makeController({
+    removeAccount: async () => ({ ok: true, catalogRefreshPending: true }),
+  }));
+
+  const removeButton = [...host.querySelectorAll("button")].find(button =>
+    (button.getAttribute("aria-label") ?? "").includes("pool@example.test")
+    && (button.getAttribute("aria-label") ?? "").toLowerCase().includes("remove"),
+  );
+  expect(removeButton).toBeTruthy();
+  await act(async () => {
+    removeButton!.dispatchEvent(new win.MouseEvent("click", { bubbles: true }));
+    await new Promise(resolve => setTimeout(resolve, 20));
+  });
+
+  const warning = host.querySelector(".codex-auth-page-head__feedback.is-warn");
+  expect(warning?.textContent).toContain("ocx sync");
+  expect(warning?.textContent).not.toContain("pool@example.test");
+  expect(host.querySelector(".codex-auth-page-head__feedback.is-err")).toBeNull();
+});
+
 test("a busy selection order write shows no toast at all", async () => {
   await mountPool(makeController({
     setAccountPriority: async () => ({ ok: false, reason: "busy" }),
diff --git a/gui/tests/providers-codex-completion-toast.test.tsx b/gui/tests/providers-codex-completion-toast.test.tsx
new file mode 100644
index 0000000000..92d8eaf9d2
--- /dev/null
+++ b/gui/tests/providers-codex-completion-toast.test.tsx
@@ -0,0 +1,234 @@
+import { afterEach, beforeEach, expect, jest, test } from "bun:test";
+import { Window } from "happy-dom";
+import { act } from "react";
+import type { Root } from "react-dom/client";
+import { clearClientResourceStoresForTests } from "../src/client-resource";
+import { LanguageProvider } from "../src/i18n/provider";
+import Providers from "../src/pages/Providers";
+
+const globals = [
+  "document",
+  "window",
+  "navigator",
+  "localStorage",
+  "sessionStorage",
+  "fetch",
+  "IS_REACT_ACT_ENVIRONMENT",
+] as const;
+
+const API_BASE = "/providers-codex-completion";
+const CANONICAL_OPENAI = {
+  adapter: "openai-responses",
+  baseUrl: "https://chatgpt.com/backend-api/codex",
+  authMode: "forward",
+  codexAccountMode: "pool",
+};
+
+let previousGlobals: Record<(typeof globals)[number], unknown>;
+let testWindow: Window;
+let host: HTMLElement;
+let root: Root | null;
+let requests: Array<{ path: string; method: string }>;
+let catalogRefreshPending: boolean;
+
+function pathCount(path: string): number {
+  return requests.filter(request => request.path.startsWith(`${API_BASE}${path}`)).length;
+}
+
+async function flush(): Promise<void> {
+  await act(async () => {
+    jest.advanceTimersByTime(0);
+    await Promise.resolve();
+    await Promise.resolve();
+  });
+}
+
+beforeEach(() => {
+  previousGlobals = Object.fromEntries(
+    globals.map(key => [key, Reflect.get(globalThis, key)]),
+  ) as typeof previousGlobals;
+  clearClientResourceStoresForTests();
+  jest.useFakeTimers({ now: 1_700_000_000_000 });
+  testWindow = new Window({ url: "http://localhost/#providers" });
+  Object.defineProperty(testWindow.navigator, "language", { configurable: true, value: "en-US" });
+  Object.defineProperties(globalThis, {
+    document: { configurable: true, value: testWindow.document },
+    window: { configurable: true, value: testWindow },
+    navigator: { configurable: true, value: testWindow.navigator },
+    localStorage: { configurable: true, value: testWindow.localStorage },
+    sessionStorage: { configurable: true, value: testWindow.sessionStorage },
+  });
+  (globalThis as typeof globalThis & { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT = true;
+
+  requests = [];
+  catalogRefreshPending = true;
+  Object.defineProperty(globalThis, "fetch", {
+    configurable: true,
+    value: async (input: RequestInfo | URL, init?: RequestInit) => {
+      const url = new URL(String(input), "http://localhost");
+      const method = init?.method ?? "GET";
+      requests.push({ path: `${url.pathname}${url.search}`, method });
+
+      if (url.pathname === `${API_BASE}/api/config`) {
+        return Response.json({
+          port: 10100,
+          defaultProvider: "openai",
+          providers: { openai: CANONICAL_OPENAI },
+        });
+      }
+      if (url.pathname === `${API_BASE}/api/oauth/providers`) return Response.json({ providers: [] });
+      if (url.pathname === `${API_BASE}/api/provider-presets`) return Response.json({ providers: [] });
+      if (url.pathname === `${API_BASE}/api/provider-quotas`) return Response.json({ reports: [] });
+      if (url.pathname === `${API_BASE}/api/usage`) return Response.json({ providers: [], models: [] });
+      if (url.pathname === `${API_BASE}/api/selected-models`) return Response.json({ models: {} });
+      if (url.pathname === `${API_BASE}/api/codex-auth/accounts`) {
+        return Response.json({
+          accounts: [{
+            id: "main",
+            email: "main@example.test",
+            isMain: true,
+            paused: false,
+            priority: 0,
+            hasCredential: true,
+            quota: null,
+          }],
+        });
+      }
+      if (url.pathname === `${API_BASE}/api/codex-auth/active`) {
+        return Response.json({
+          activeCodexAccountId: null,
+          autoSwitchThreshold: 80,
+          accountPoolStrategy: "round-robin",
+          accountPoolStickyLimit: 1,
+        });
+      }
+      if (url.pathname === `${API_BASE}/api/codex-auth/login` && method === "POST") {
+        return Response.json({ url: "https://auth.example.test/login", flowId: "flow-toast" });
+      }
+      if (url.pathname === `${API_BASE}/api/codex-auth/login-status`) {
+        return Response.json({
+          status: "done",
+          catalogRefreshPending,
+          privateDetail: "private-account-detail",
+        });
+      }
+      return Response.json({});
+    },
+  });
+
+  host = testWindow.document.createElement("div") as unknown as HTMLElement;
+  testWindow.document.body.appendChild(host as never);
+  root = null;
+});
+
+afterEach(async () => {
+  if (root) {
+    const current = root;
+    await act(async () => { current.unmount(); });
+    root = null;
+  }
+  jest.useRealTimers();
+  clearClientResourceStoresForTests();
+  for (const key of globals) {
+    Object.defineProperty(globalThis, key, { configurable: true, value: previousGlobals[key] });
+  }
+  await testWindow.happyDOM?.close?.();
+});
+
+async function mountProviders(): Promise<void> {
+  const { createRoot } = await import("react-dom/client");
+  await act(async () => {
+    root = createRoot(host);
+    root.render(<LanguageProvider><Providers apiBase={API_BASE} /></LanguageProvider>);
+  });
+  await flush();
+  await flush();
+}
+
+function buttonWithText(scope: ParentNode, text: string): HTMLButtonElement {
+  const button = Array.from(scope.querySelectorAll("button")).find(candidate =>
+    candidate.textContent?.trim() === text
+  );
+  expect(button).toBeTruthy();
+  return button as HTMLButtonElement;
+}
+
+async function completeCodexLogin(): Promise<{
+  config: number;
+  oauth: number;
+  quota: number;
+  models: number;
+}> {
+  await mountProviders();
+
+  await act(async () => { buttonWithText(host, "Add Provider").click(); });
+  await flush();
+  await act(async () => { buttonWithText(testWindow.document, "Accounts").click(); });
+  await flush();
+
+  const accountRow = testWindow.document.querySelector(".provider-catalog-account-row");
+  expect(accountRow).toBeTruthy();
+  const openCodexLogin = Array.from(accountRow!.querySelectorAll("button")).find(button =>
+    button.textContent?.trim() === "Add account" || button.textContent?.trim() === "Log in"
+  );
+  expect(openCodexLogin).toBeTruthy();
+  await act(async () => { openCodexLogin!.click(); });
+  await flush();
+
+  const codexDialog = testWindow.document.querySelector('dialog[aria-label="Add Codex Account"]');
+  expect(codexDialog).toBeTruthy();
+  const before = {
+    config: pathCount("/api/config"),
+    oauth: pathCount("/api/oauth/providers"),
+    quota: pathCount("/api/provider-quotas"),
+    models: pathCount("/api/selected-models"),
+  };
+
+  const oauthButton = codexDialog!.querySelector<HTMLButtonElement>("button.list-row");
+  expect(oauthButton).toBeTruthy();
+  await act(async () => { oauthButton!.click(); });
+  await flush();
+  await act(async () => {
+    jest.advanceTimersByTime(2_000);
+    await Promise.resolve();
+    await Promise.resolve();
+  });
+  await flush();
+  return before;
+}
+
+test("pending Codex completion stays amber, private, dismissible, and refreshes Providers", async () => {
+  const before = await completeCodexLogin();
+
+  const warning = testWindow.document.querySelector<HTMLElement>(".toast-notice.notice-warn");
+  expect(warning).toBeTruthy();
+  expect(warning!.textContent).toContain("The change was saved");
+  expect(warning!.textContent).toContain("ocx sync");
+  expect(testWindow.document.body.textContent).not.toContain("private-account-detail");
+  expect(pathCount("/api/config")).toBeGreaterThan(before.config);
+  expect(pathCount("/api/oauth/providers")).toBeGreaterThan(before.oauth);
+  expect(pathCount("/api/provider-quotas")).toBeGreaterThan(before.quota);
+  expect(pathCount("/api/selected-models")).toBeGreaterThan(before.models);
+
+  await act(async () => {
+    jest.advanceTimersByTime(5_000);
+    await Promise.resolve();
+  });
+  expect(testWindow.document.querySelector(".toast-notice.notice-warn")).toBeTruthy();
+
+  const dismiss = warning!.querySelector<HTMLButtonElement>(".toast-notice-dismiss");
+  expect(dismiss?.getAttribute("aria-label")).toBe("Close");
+  await act(async () => { dismiss!.click(); });
+  expect(testWindow.document.querySelector(".toast-notice")).toBeNull();
+});
+
+test("completed Codex catalog convergence reports clean success without sync advice", async () => {
+  catalogRefreshPending = false;
+  await completeCodexLogin();
+
+  const success = testWindow.document.querySelector<HTMLElement>(".toast-notice.notice-ok");
+  expect(success).toBeTruthy();
+  expect(success!.textContent).toContain("Account added");
+  expect(success!.textContent).not.toContain("ocx sync");
+  expect(testWindow.document.querySelector(".toast-notice.notice-warn")).toBeNull();
+});
diff --git a/src/cli/account-auth.ts b/src/cli/account-auth.ts
index 8cc6c107f4..5b8d57dda8 100644
--- a/src/cli/account-auth.ts
+++ b/src/cli/account-auth.ts
@@ -1,3 +1,5 @@
+import { writeSync } from "node:fs";
+import { warnIfCodexCatalogRefreshPending } from "./account-catalog-refresh";
 import {
   CliUsageError,
   printData,
@@ -11,7 +13,6 @@ import {
   type CliStdin,
   type RuntimeApiDeps,
 } from "./runtime-api";
-import { writeSync } from "node:fs";
 
 /**
  * Write the whole block to fd 1 synchronously (#1007). `console.log` can
@@ -127,6 +128,7 @@ async function login(argv: string[], deps: RuntimeApiDeps): Promise<void> {
       );
       if (state.status === "done") {
         printData(state, wantsJson, [`Logged in${state.email ? ` as ${String(state.email)}` : ""}.`]);
+        if (!wantsJson) warnIfCodexCatalogRefreshPending(state);
         return;
       }
       if (state.status === "error" || state.status === "expired") {
diff --git a/src/cli/account-catalog-refresh.ts b/src/cli/account-catalog-refresh.ts
new file mode 100644
index 0000000000..0f31d309e7
--- /dev/null
+++ b/src/cli/account-catalog-refresh.ts
@@ -0,0 +1,14 @@
+export const CODEX_CATALOG_REFRESH_PENDING_WARNING =
+  "Warning: the account change was saved, but the Codex model catalog refresh is pending. Run 'ocx sync' to retry.";
+
+/** Read only the public completion flag from an account mutation response. */
+export function codexCatalogRefreshPending(value: unknown): boolean {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+  const descriptor = Object.getOwnPropertyDescriptor(value, "catalogRefreshPending");
+  return descriptor !== undefined && "value" in descriptor && descriptor.value === true;
+}
+
+/** Print fixed recovery guidance without reflecting server or account details. */
+export function warnIfCodexCatalogRefreshPending(value: unknown): void {
+  if (codexCatalogRefreshPending(value)) console.error(CODEX_CATALOG_REFRESH_PENDING_WARNING);
+}
diff --git a/src/cli/account-extended.ts b/src/cli/account-extended.ts
index 014eb9b34a..afb04e3594 100644
--- a/src/cli/account-extended.ts
+++ b/src/cli/account-extended.ts
@@ -17,6 +17,10 @@ import {
   type AccountDeps, type AccountStdin, type FamilyRows,
   type ProviderQuotaDto, type ProviderQuotaReportDto,
 } from "./account-api";
+import {
+  codexCatalogRefreshPending,
+  warnIfCodexCatalogRefreshPending,
+} from "./account-catalog-refresh";
 
 const MAIN_ID = "__main__";
 const AUTO_NOTE = "auto (no pin — lowest-usage account is selected per request)";
@@ -241,18 +245,28 @@ export async function cmdRemove(args: string[], deps: AccountDeps): Promise<numb
   const response = await apiJson(deps, baseUrl, "DELETE", deletePath(classified.type, name, id));
   if (response.status === 0) return fail("Proxy not reachable. Start it with 'ocx start' or 'ocx ensure'.");
   if (response.status !== 200) return fail(errorText(response.json, `failed to remove ${requestedId}`));
+  const catalogRefreshPending = classified.type === "codex"
+    && codexCatalogRefreshPending(response.json);
   const after = await fetchRows(deps, baseUrl, name, classified.type);
   if (after.networkDown || after.errorJson) {
     const detail = after.networkDown ? "proxy not reachable" : typeof after.errorJson?.error === "string" ? after.errorJson.error : "unknown error";
     return fail(`post-delete verification failed; delete may have succeeded: ${detail}`);
   }
   const removedActive = before.activeId === id;
-  const result = { ok: true, provider: name, id, removedActive, promotedActiveId: after.activeId };
+  const result = {
+    ok: true,
+    provider: name,
+    id,
+    removedActive,
+    promotedActiveId: after.activeId,
+    ...(classified.type === "codex" ? { catalogRefreshPending } : {}),
+  };
   if (wantsJson) console.log(JSON.stringify(result, null, 2));
   else if (classified.type === "codex" && removedActive && after.activeId === null) console.log(`openai: ${AUTO_NOTE}`);
   else if (classified.type === "oauth") console.log(after.rows.length ? `${name}: active account is now ${after.activeId}` : `${name}: no accounts remaining`);
   else if (classified.type === "api-key") console.log(after.rows.length ? `${name}: active key is now ${after.activeId}` : `${name}: no keys remaining`);
   else console.log(`${name}: removed account ${requestedId}`);
+  if (!wantsJson && catalogRefreshPending) warnIfCodexCatalogRefreshPending(response.json);
   return 0;
 }
 
diff --git a/src/codex/account-lifecycle.ts b/src/codex/account-lifecycle.ts
index 598457cec1..7404089db3 100644
--- a/src/codex/account-lifecycle.ts
+++ b/src/codex/account-lifecycle.ts
@@ -8,6 +8,7 @@ import { invalidateCodexWebSocketsForAccount } from "./websocket-registry";
 import { clearMainAccountCredentialPresence, clearMainAccountInfoCache } from "./main-account-cache";
 import { forgetCodexAccountPause } from "./account-pause";
 import { clearCodexAccountPin, forgetCodexAccountPriority } from "./account-priority";
+import { codexAccountNamespaceEntries, codexAccountPickerEnabled } from "./account-namespaces";
 import type { OcxConfig } from "../types";
 
 let observedMainChatgptAccountId: string | undefined;
@@ -70,7 +71,17 @@ export function resetMainCodexAccountIdentityTrackingForTests(): void {
   clearMainAccountCredentialPresence();
 }
 
-export function deleteCodexAccount(runtimeConfig: OcxConfig, accountId: string): void {
+/**
+ * Delete a stored account while retaining its selector binding.
+ * Returns true when a picker-visible row disappeared and the catalog must converge.
+ */
+export function deleteCodexAccount(runtimeConfig: OcxConfig, accountId: string): boolean {
+  const hadStoredAccount = (runtimeConfig.codexAccounts ?? [])
+    .some(account => !account.isMain && account.id === accountId);
+  const hadVisiblePickerBinding = hadStoredAccount
+    && codexAccountPickerEnabled(runtimeConfig)
+    && codexAccountNamespaceEntries(runtimeConfig)
+      .some(([, boundAccountId]) => boundAccountId === accountId);
   removeCodexAccountCredential(accountId);
   runtimeConfig.codexAccounts = (runtimeConfig.codexAccounts ?? [])
     .filter(account => account.isMain || account.id !== accountId);
@@ -80,4 +91,5 @@ export function deleteCodexAccount(runtimeConfig: OcxConfig, accountId: string):
   if (runtimeConfig.activeCodexAccountId === accountId) runtimeConfig.activeCodexAccountId = undefined;
   purgeCodexAccountRuntimeState(accountId);
   invalidateCodexWebSocketsForAccount(accountId);
+  return hadVisiblePickerBinding;
 }
diff --git a/src/codex/auth-api.ts b/src/codex/auth-api.ts
index 043df28286..1d63a2d50f 100644
--- a/src/codex/auth-api.ts
+++ b/src/codex/auth-api.ts
@@ -1,4 +1,10 @@
-import { ConfigMutationLockError, loadConfig, mutatePersistedConfig, saveConfigPreservingClaudeCode } from "../config";
+import {
+  ConfigMutationLockError,
+  loadConfig,
+  mutatePersistedConfig,
+  saveConfigPreservingClaudeCode,
+  withConfigMutationLockSync,
+} from "../config";
 import { withCodexAccountLogLabel } from "./account-label";
 import {
   getCodexAccountCredential,
@@ -14,6 +20,14 @@ import {
   TokenRefreshError,
 } from "./account-store";
 import { deleteCodexAccount, reconcileMainCodexAccountRuntimeState } from "./account-lifecycle";
+import {
+  appendDefaultCodexAccountNamespace,
+  codexAccountPickerEnabled,
+} from "./account-namespaces";
+import {
+  catalogRefreshIsPending,
+  normalizeCatalogDisposition,
+} from "./catalog-refresh-status";
 import { isCodexAccountPaused, setCodexAccountPaused } from "./account-pause";
 import {
   clearCodexAccountPin,
@@ -85,7 +99,8 @@ export { clearMainAccountInfoCache } from "./main-account-cache";
 import { maskEmail } from "../lib/privacy";
 import { CodexWarmupError, codexWarmupFailureReason, warmCodexAccount } from "./warmup";
 export { maskEmail } from "../lib/privacy";
-import type { CodexAccount, OcxConfig } from "../types";
+import type { CodexAccount, CodexAccountCredentials, OcxConfig } from "../types";
+import type { CatalogDisposition } from "./convergence-types";
 import { isCanonicalOpenAiForwardProvider, OPENAI_CODEX_PROVIDER_ID } from "../providers/openai-tiers";
 import { providerCodexAccountMode } from "../providers/registry";
 import { readBoundedResponseBody } from "../lib/bounded-body";
@@ -131,10 +146,22 @@ function nativeMainProfileBusyResponse(): Response {
 }
 
 const MANUAL_IMPORT_ENV = "OPENCODEX_ENABLE_UNVERIFIED_CODEX_IMPORT";
+const CODEX_CREDENTIAL_PERSISTENCE_ERROR = "Account was saved, but credential setup did not complete. Reauthenticate or remove the account.";
+const CODEX_CREDENTIAL_PERSISTENCE_CODE = "codex_credential_persistence_failed";
 
 const MAX_CODEX_LOGIN_STATE_ROWS = 32;
 const CODEX_LOGIN_TERMINAL_TTL_MS = 300_000;
-interface CodexLoginStateRow { status: string; startedAt: number; accountId?: string; email?: string; error?: string; doneAt?: number }
+interface CodexLoginStateRow {
+  status: string;
+  startedAt: number;
+  accountId?: string;
+  email?: string;
+  error?: string;
+  code?: string;
+  needsReauth?: boolean;
+  catalogRefreshPending?: boolean;
+  doneAt?: number;
+}
 const codexAuthLoginState = new Map<string, CodexLoginStateRow>();
 export class CodexLoginStateBusyError extends ResourceAdmissionError {
   constructor() { super("codex_login_state_rows", MAX_CODEX_LOGIN_STATE_ROWS); this.name = "CodexLoginStateBusyError"; }
@@ -391,6 +418,100 @@ function saveRuntimeConfig(sourceConfig: OcxConfig, nextConfig: OcxConfig): void
   Object.assign(sourceConfig, nextConfig);
 }
 
+interface StagedNewCodexAccountState {
+  credential: CodexAccountCredentials;
+  validatedAt: number;
+}
+
+type PersistNewCodexAccountOutcome =
+  | { status: "committed"; pickerVisibilityChanged: boolean }
+  | { status: "publication-failed"; pickerVisibilityChanged: boolean };
+
+function codexCredentialPersistenceFailure(accountId: string, catalogRefreshPending: boolean) {
+  return {
+    error: CODEX_CREDENTIAL_PERSISTENCE_ERROR,
+    code: CODEX_CREDENTIAL_PERSISTENCE_CODE,
+    accountId,
+    needsReauth: true as const,
+    ...(catalogRefreshPending ? { catalogRefreshPending: true as const } : {}),
+  };
+}
+
+/** Persist config before publishing secret or runtime state under the shared mutation coordinator. */
+function persistNewCodexAccount(
+  sourceConfig: OcxConfig,
+  runtimeConfig: OcxConfig,
+  addedAccount: CodexAccount,
+  staged: StagedNewCodexAccountState,
+): PersistNewCodexAccountOutcome {
+  return withConfigMutationLockSync(() => {
+    const previousConfig = { ...runtimeConfig };
+    let pickerVisibilityChanged: boolean;
+    try {
+      const accounts = [...(runtimeConfig.codexAccounts ?? [])];
+      const retainedPickerBindingRestored = codexAccountPickerEnabled(runtimeConfig)
+        && Object.values(runtimeConfig.codexAccountNamespaces ?? {}).includes(addedAccount.id);
+      accounts.push(addedAccount);
+      runtimeConfig.codexAccounts = accounts;
+
+      // Presence of the explicit flag distinguishes a dashboard-managed map from
+      // a hand-authored legacy map. Preserve manual maps exactly.
+      const tracksPickerNamespaces = runtimeConfig.codexAccountPickerEnabled !== undefined;
+      if (tracksPickerNamespaces && runtimeConfig.codexAccountNamespaces) {
+        runtimeConfig.codexAccountNamespaces = { ...runtimeConfig.codexAccountNamespaces };
+      }
+      const namespaceAdded = tracksPickerNamespaces
+        && appendDefaultCodexAccountNamespace(runtimeConfig, addedAccount);
+      pickerVisibilityChanged = namespaceAdded || retainedPickerBindingRestored;
+      saveRuntimeConfig(sourceConfig, runtimeConfig);
+    } catch (error) {
+      for (const key of Object.keys(runtimeConfig) as Array<keyof OcxConfig>) {
+        delete runtimeConfig[key];
+      }
+      Object.assign(runtimeConfig, previousConfig);
+      throw error;
+    }
+
+    try {
+      saveCodexAccountCredential(addedAccount.id, staged.credential);
+      markCodexAccountValidated(addedAccount.id, staged.validatedAt);
+      clearAccountNeedsReauth(addedAccount.id);
+    } catch {
+      // Config is already durable. Return the failure outcome through the coordinator so its
+      // generation commit is not rolled back while config.json remains changed.
+      return { status: "publication-failed" as const, pickerVisibilityChanged };
+    }
+    return { status: "committed" as const, pickerVisibilityChanged };
+  });
+}
+
+/** Bounded catalog-convergence callback supplied by the management dispatcher. */
+export type CodexAuthCatalogConvergence = () => Promise<CatalogDisposition>;
+
+interface AccountNamespaceCatalogRefresh {
+  catalogRefreshPending: boolean;
+}
+
+/** Collapse post-persistence convergence into the one public recovery bit. */
+async function convergeAccountNamespaceCatalog(
+  config: OcxConfig,
+  changed: boolean,
+  convergeCodexCatalog?: CodexAuthCatalogConvergence,
+): Promise<AccountNamespaceCatalogRefresh> {
+  if (!changed || !codexAccountPickerEnabled(config)) {
+    return { catalogRefreshPending: false };
+  }
+  if (!convergeCodexCatalog) return { catalogRefreshPending: true };
+
+  try {
+    const catalogRefresh = normalizeCatalogDisposition(await convergeCodexCatalog());
+    if (!catalogRefresh) return { catalogRefreshPending: true };
+    return { catalogRefreshPending: catalogRefreshIsPending(catalogRefresh) };
+  } catch {
+    return { catalogRefreshPending: true };
+  }
+}
+
 async function mapWithConcurrency<T, R>(
   items: T[],
   concurrency: number,
@@ -1202,6 +1323,7 @@ export async function handleCodexAuthAPI(
   req: Request,
   url: URL,
   config: OcxConfig,
+  convergeCodexCatalog?: CodexAuthCatalogConvergence,
 ): Promise<Response | null> {
 
   if (url.pathname === "/api/codex-auth/accounts" && req.method === "GET") {
@@ -1240,20 +1362,38 @@ export async function handleCodexAuthAPI(
     const latestConfig = getRuntimeConfig(config);
     const commitConflict = codexAccountPersistenceConflict(latestConfig, body.id, "create");
     if (commitConflict) return jsonResponse({ error: commitConflict }, 400);
-    saveCodexAccountCredential(body.id, {
-      accessToken: body.accessToken,
-      refreshToken: body.refreshToken,
-      expiresAt: exp,
-      chatgptAccountId: derivedAccountId,
-    });
-    markCodexAccountValidated(body.id, warmup.validatedAt);
-    clearAccountNeedsReauth(body.id);
-    const accounts = latestConfig.codexAccounts ?? [];
-    accounts.push(withCodexAccountLogLabel({ id: body.id, email: body.email, plan: body.plan, isMain: false }, accounts));
-    latestConfig.codexAccounts = accounts;
-    saveRuntimeConfig(config, latestConfig);
+    const addedAccount = withCodexAccountLogLabel(
+      { id: body.id, email: body.email, plan: body.plan, isMain: false },
+      latestConfig.codexAccounts ?? [],
+    );
+    const persistence = persistNewCodexAccount(
+      config,
+      latestConfig,
+      addedAccount,
+      {
+        credential: {
+          accessToken: body.accessToken,
+          refreshToken: body.refreshToken,
+          expiresAt: exp,
+          chatgptAccountId: derivedAccountId,
+        },
+        validatedAt: warmup.validatedAt,
+      },
+    );
     reconcileLiveStateStores();
-    return jsonResponse({ ok: true });
+    if (persistence.status === "publication-failed") markAccountNeedsReauth(body.id);
+    const catalogRefresh = await convergeAccountNamespaceCatalog(
+      latestConfig,
+      persistence.pickerVisibilityChanged,
+      convergeCodexCatalog,
+    );
+    if (persistence.status === "publication-failed") {
+      return jsonResponse({
+        ok: false,
+        ...codexCredentialPersistenceFailure(body.id, catalogRefresh.catalogRefreshPending === true),
+      }, 500);
+    }
+    return jsonResponse({ ok: true, ...catalogRefresh });
   }
 
   if (url.pathname === "/api/codex-auth/accounts" && req.method === "DELETE") {
@@ -1265,10 +1405,15 @@ export async function handleCodexAuthAPI(
     if (!isValidCodexAccountId(id) && !isLegacyPoolAccount) {
       return jsonResponse({ error: "Invalid account id format" }, 400);
     }
-    deleteCodexAccount(runtimeConfig, id);
+    const pickerVisibilityChanged = deleteCodexAccount(runtimeConfig, id);
     saveRuntimeConfig(config, runtimeConfig);
     reconcileLiveStateStores();
-    return jsonResponse({ ok: true });
+    const catalogRefresh = await convergeAccountNamespaceCatalog(
+      runtimeConfig,
+      pickerVisibilityChanged,
+      convergeCodexCatalog,
+    );
+    return jsonResponse({ ok: true, ...catalogRefresh });
   }
 
   if (url.pathname === "/api/codex-auth/accounts/alias" && req.method === "PUT") {
@@ -1761,6 +1906,8 @@ export async function handleCodexAuthAPI(
                 const latestConfig = getRuntimeConfig(config);
                 const accounts = latestConfig.codexAccounts ?? [];
                 const existingIdx = accounts.findIndex(account => account.id === accountId);
+                let pickerVisibilityChanged = false;
+                let newAccountPersistence: PersistNewCodexAccountOutcome | null = null;
                 const commitConflict = codexAccountPersistenceConflict(
                   latestConfig,
                   accountId,
@@ -1776,22 +1923,21 @@ export async function handleCodexAuthAPI(
                   break;
                 }
 
-                saveCodexAccountCredential(accountId, {
+                const credential: CodexAccountCredentials = {
                   accessToken: cred.access,
                   refreshToken: cred.refresh,
                   expiresAt: cred.expires,
                   chatgptAccountId: oauthAccountId,
-                });
-                // A successful reauthentication replaces the credential generation. Do not let a
-                // failed optional WHAM probe make the replacement inherit quota from the old record.
-                if (reauth) clearAccountQuota(accountId);
-                markCodexAccountValidated(accountId, warmup.validatedAt);
-                clearAccountNeedsReauth(accountId);
-                if (quota) {
-                  setAccountQuotaFromParsed(accountId, quota);
-                }
+                };
 
                 if (existingIdx >= 0) {
+                  saveCodexAccountCredential(accountId, credential);
+                  // A successful reauthentication replaces the credential generation. Do not let a
+                  // failed optional WHAM probe make the replacement inherit quota from the old record.
+                  if (reauth) clearAccountQuota(accountId);
+                  markCodexAccountValidated(accountId, warmup.validatedAt);
+                  clearAccountNeedsReauth(accountId);
+                  if (quota) setAccountQuotaFromParsed(accountId, quota);
                   // Keep the pool id stable; refresh display metadata after a successful login/reauth.
                   accounts[existingIdx] = withCodexAccountLogLabel({
                     ...accounts[existingIdx],
@@ -1802,13 +1948,49 @@ export async function handleCodexAuthAPI(
                   latestConfig.codexAccounts = accounts;
                   saveRuntimeConfig(config, latestConfig);
                 } else {
-                  accounts.push(withCodexAccountLogLabel({ id: accountId, email, plan, isMain: false }, accounts));
-                  latestConfig.codexAccounts = accounts;
-                  saveRuntimeConfig(config, latestConfig);
+                  const addedAccount = withCodexAccountLogLabel({ id: accountId, email, plan, isMain: false }, accounts);
+                  newAccountPersistence = persistNewCodexAccount(
+                    config,
+                    latestConfig,
+                    addedAccount,
+                    {
+                      credential,
+                      validatedAt: warmup.validatedAt,
+                    },
+                  );
+                  pickerVisibilityChanged = newAccountPersistence.pickerVisibilityChanged;
                 }
                 reconcileLiveStateStores();
-                setCodexLoginState(flowId, { status: "done", accountId, email, doneAt: Date.now() });
-                completed = true;
+                if (newAccountPersistence?.status === "publication-failed") {
+                  markAccountNeedsReauth(accountId);
+                }
+                // A new quota row is generation-gated by live account ownership. Reconcile the
+                // durable config owner first so a partial prior sweep cannot reject this write.
+                if (newAccountPersistence?.status === "committed" && quota) {
+                  setAccountQuotaFromParsed(accountId, quota);
+                }
+                const { catalogRefreshPending } = await convergeAccountNamespaceCatalog(
+                  latestConfig,
+                  pickerVisibilityChanged,
+                  convergeCodexCatalog,
+                );
+                if (newAccountPersistence?.status === "publication-failed") {
+                  setCodexLoginState(flowId, {
+                    status: "error",
+                    ...codexCredentialPersistenceFailure(accountId, catalogRefreshPending),
+                    doneAt: Date.now(),
+                  });
+                  completed = true;
+                } else {
+                  setCodexLoginState(flowId, {
+                    status: "done",
+                    accountId,
+                    email,
+                    ...(catalogRefreshPending ? { catalogRefreshPending: true } : {}),
+                    doneAt: Date.now(),
+                  });
+                  completed = true;
+                }
               }
               break;
             }
@@ -1894,7 +2076,13 @@ export async function handleCodexAuthAPI(
     const reauthStatus = url.searchParams.get("reauth") === "1";
     if (flowId) {
       const st = codexAuthLoginState.get(flowId);
-      if (!st && accountId && !reauthStatus && getCodexAccountCredential(accountId)) {
+      if (
+        !st
+        && accountId
+        && !reauthStatus
+        && !isAccountNeedsReauth(accountId)
+        && getCodexAccountCredential(accountId)
+      ) {
         return jsonResponse({ status: "done", accountId });
       }
       return jsonResponse(st ? { ...st, email: maskEmail(st.email) ?? undefined } : { status: "expired" });
diff --git a/src/codex/catalog-refresh-status.ts b/src/codex/catalog-refresh-status.ts
new file mode 100644
index 0000000000..10bde7bd23
--- /dev/null
+++ b/src/codex/catalog-refresh-status.ts
@@ -0,0 +1,87 @@
+import type { CatalogDisposition, CatalogNotice } from "./convergence-types";
+
+const INVALID_CATALOG_DISPOSITION_FIELD = Symbol("invalid-catalog-disposition-field");
+
+/** Read an own data property without invoking prototype getters or accessors. */
+function ownDataProperty(value: object, key: PropertyKey): unknown {
+  const descriptor = Object.getOwnPropertyDescriptor(value, key);
+  return descriptor && "value" in descriptor
+    ? descriptor.value
+    : INVALID_CATALOG_DISPOSITION_FIELD;
+}
+
+/** Accept only the public catalog degradation codes. */
+function isCatalogNotice(value: unknown): value is CatalogNotice {
+  return value === "provider-auth" || value === "provider-network" || value === "fallback";
+}
+
+/** Copy a bounded notice array without trusting accessors or a custom iterator. */
+function normalizeCatalogNotices(value: unknown): CatalogNotice[] | null {
+  if (!Array.isArray(value)) return null;
+  const length = ownDataProperty(value, "length");
+  if (typeof length !== "number" || !Number.isInteger(length) || length < 0 || length > 3) {
+    return null;
+  }
+  const notices: CatalogNotice[] = [];
+  for (let index = 0; index < length; index += 1) {
+    const notice = ownDataProperty(value, String(index));
+    if (!isCatalogNotice(notice)) return null;
+    notices.push(notice);
+  }
+  return notices;
+}
+
+/**
+ * Rebuild a catalog disposition from a strict set of own data properties.
+ *
+ * Management callbacks are internal today, but this response is a privacy
+ * boundary. Avoid coercion, accessors, custom iterators, and `toJSON` hooks so a
+ * malformed callback cannot smuggle private provider or account detail into a
+ * management response.
+ */
+export function normalizeCatalogDisposition(value: unknown): CatalogDisposition | null {
+  if (value === null || typeof value !== "object") return null;
+  try {
+    if (Array.isArray(value)) return null;
+    const status = ownDataProperty(value, "status");
+    if (status === "committed") {
+      const changed = ownDataProperty(value, "changed");
+      const degraded = ownDataProperty(value, "degraded");
+      const notices = normalizeCatalogNotices(ownDataProperty(value, "notices"));
+      if (typeof changed !== "boolean" || typeof degraded !== "boolean" || notices === null) {
+        return null;
+      }
+      return { status, changed, degraded, notices };
+    }
+    if (status === "skipped") {
+      const reason = ownDataProperty(value, "reason");
+      const retryable = ownDataProperty(value, "retryable");
+      if ((reason !== "not-requested"
+        && reason !== "catalog-unavailable"
+        && reason !== "busy"
+        && reason !== "stale"
+        && reason !== "refused")
+        || typeof retryable !== "boolean") return null;
+      return { status, reason, retryable };
+    }
+    if (status === "failed") {
+      const reason = ownDataProperty(value, "reason");
+      const phase = ownDataProperty(value, "phase");
+      const retryable = ownDataProperty(value, "retryable");
+      const partialWrite = ownDataProperty(value, "partialWrite");
+      if ((reason !== "provider-auth" && reason !== "provider-network" && reason !== "disk")
+        || (phase !== "gather" && phase !== "commit")
+        || typeof retryable !== "boolean"
+        || typeof partialWrite !== "boolean") return null;
+      return { status, reason, phase, retryable, partialWrite };
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+
+/** Whether a persisted mutation still needs a successful catalog commit. */
+export function catalogRefreshIsPending(disposition: CatalogDisposition): boolean {
+  return disposition.status !== "committed";
+}
diff --git a/src/server/management-api.ts b/src/server/management-api.ts
index 9da81e6c6b..f5bc4c32c2 100644
--- a/src/server/management-api.ts
+++ b/src/server/management-api.ts
@@ -77,6 +77,7 @@ export type { ManagementApiDeps } from "./management/context";
 import { fetchAllModels } from "./management/shared";
 import { CatalogGatherBusyError } from "../codex/catalog/provider-fetch";
 import type { CatalogDisposition, ConvergeCodex } from "../codex/convergence-types";
+import { normalizeCatalogDisposition } from "../codex/catalog-refresh-status";
 import { managementBodyTooLargeResponse } from "./management/body";
 
 // installed npm version instead of a stale hardcode.
@@ -88,28 +89,6 @@ export const VERSION = (() => {
   }
 })();
 
-function isCatalogDisposition(value: unknown): value is CatalogDisposition {
-  if (!value || typeof value !== "object" || !("status" in value)) return false;
-  const disposition = value as Record<string, unknown>;
-  if (disposition.status === "committed") {
-    return typeof disposition.changed === "boolean"
-      && typeof disposition.degraded === "boolean"
-      && Array.isArray(disposition.notices)
-      && disposition.notices.every(notice => notice === "provider-auth" || notice === "provider-network" || notice === "fallback");
-  }
-  if (disposition.status === "skipped") {
-    return ["not-requested", "catalog-unavailable", "busy", "stale", "refused"].includes(String(disposition.reason))
-      && typeof disposition.retryable === "boolean";
-  }
-  if (disposition.status === "failed") {
-    return ["provider-auth", "provider-network", "disk"].includes(String(disposition.reason))
-      && (disposition.phase === "gather" || disposition.phase === "commit")
-      && typeof disposition.retryable === "boolean"
-      && typeof disposition.partialWrite === "boolean";
-  }
-  return false;
-}
-
 const managementConvergenceBindings = new WeakMap<object, Readonly<{
   factory: (config: Readonly<OcxConfig>) => ConvergeCodex;
   converge: ConvergeCodex;
@@ -153,10 +132,13 @@ export async function handleManagementAPI(
       const { createCatalogConvergeRequest } = await import("../codex/catalog-admission");
       convergenceInvoked = true;
       const outcome = await managementConvergeCodex(createCatalogConvergeRequest({ deadlineMs: 1_000 }));
-      if (!outcome || outcome.kind !== "catalog-only" || !isCatalogDisposition(outcome.catalogRefresh)) {
+      const catalogRefresh = outcome?.kind === "catalog-only"
+        ? normalizeCatalogDisposition(outcome.catalogRefresh)
+        : null;
+      if (!catalogRefresh) {
         throw new TypeError("Catalog convergence returned an invalid outcome.");
       }
-      return outcome.catalogRefresh;
+      return catalogRefresh;
     } catch {
       return {
         status: "failed",
@@ -263,7 +245,7 @@ export async function handleManagementAPI(
     const { ConfigMutationLockError } = await import("../config");
     const { CodexCredentialRefreshLockTimeoutError } = await import("../codex/account-store");
     try {
-      return await handleCodexAuthAPI(req, url, config);
+      return await handleCodexAuthAPI(req, url, config, convergeCodexCatalog);
     } catch (error) {
       // Credential writers remap ConfigMutationLockError to CodexCredentialRefreshLockTimeoutError;
       // treat both as the same retryable busy response.
diff --git a/src/server/management/config-routes.ts b/src/server/management/config-routes.ts
index e2f018f679..4e6ac68268 100644
--- a/src/server/management/config-routes.ts
+++ b/src/server/management/config-routes.ts
@@ -40,6 +40,11 @@ import { clearProviderQuotaCache, fetchProviderQuotaReports } from "../../provid
 import { isCanonicalOpenAiForwardProvider } from "../../providers/openai-tiers";
 import { clearThreadAccountMap } from "../../codex/routing";
 import { primeCodexPoolQuotas } from "../../codex/auth-api";
+import {
+  codexAccountPickerEnabled,
+  initializeDefaultCodexAccountNamespaces,
+} from "../../codex/account-namespaces";
+import { catalogRefreshIsPending } from "../../codex/catalog-refresh-status";
 import { DEFAULT_PROVIDER_CONTEXT_CAP, globalContextCapValue, providerContextCap, providerContextCaps, setAllProviderContextCaps, setGlobalContextCapValue, setProviderContextCap } from "../../providers/context-cap";
 import { resolveCodexHomeDir } from "../../codex/home";
 import { readUsageEntries } from "../../usage/log";
@@ -76,7 +81,7 @@ import type { ManagementContext } from "./context";
 import { readManagementJsonBody, rethrowManagementBodyTooLarge } from "./body";
 
 export async function handleConfigRoutes(ctx: ManagementContext): Promise<Response | null> {
-  const { req, url, config, deps, syncClaudeAgentDefsBestEffort } = ctx;
+  const { req, url, config, deps, convergeCodexCatalog, syncClaudeAgentDefsBestEffort } = ctx;
   if (url.pathname === "/api/config" && req.method === "GET") {
     return jsonResponse(safeConfigDTO(config));
   }
@@ -131,6 +136,7 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
       hostname: config.hostname ?? "127.0.0.1",
       streamMode: config.streamMode ?? "auto",
       appOwnedMemoryBudgetMb: config.appOwnedMemoryBudgetMb ?? 256,
+      codexAccountPickerEnabled: codexAccountPickerEnabled(config),
       startupHealth: await getCachedStartupHealth(config),
       codexRuntime: {
         path: displayCodexRuntimePath(resolved.runtime.command),
@@ -207,10 +213,20 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
     // (a Windows service does not inherit shell env). A stream-shape
     // change applies to NEW turns only — the config object is shared by
     // reference with the request handlers, no restart needed.
-    let body: { codexAutoStart?: unknown; streamMode?: unknown; appOwnedMemoryBudgetMb?: unknown };
-    try { body = await readManagementJsonBody(req); } catch (error) { rethrowManagementBodyTooLarge(error); return jsonResponse({ error: "invalid JSON body" }, 400); }
-    if (body.codexAutoStart === undefined && body.streamMode === undefined && body.appOwnedMemoryBudgetMb === undefined) {
-      return jsonResponse({ error: "provide codexAutoStart, streamMode, or appOwnedMemoryBudgetMb" }, 400);
+    let parsedBody: unknown;
+    try { parsedBody = await readManagementJsonBody(req); } catch (error) { rethrowManagementBodyTooLarge(error); return jsonResponse({ error: "invalid JSON body" }, 400); }
+    if (!isPlainRecord(parsedBody)) return jsonResponse({ error: "settings body must be an object" }, 400);
+    const body = parsedBody as {
+      codexAutoStart?: unknown;
+      streamMode?: unknown;
+      appOwnedMemoryBudgetMb?: unknown;
+      codexAccountPickerEnabled?: unknown;
+    };
+    if (body.codexAutoStart === undefined
+      && body.streamMode === undefined
+      && body.appOwnedMemoryBudgetMb === undefined
+      && body.codexAccountPickerEnabled === undefined) {
+      return jsonResponse({ error: "provide codexAutoStart, streamMode, appOwnedMemoryBudgetMb, or codexAccountPickerEnabled" }, 400);
     }
     if (body.codexAutoStart !== undefined && typeof body.codexAutoStart !== "boolean") {
       return jsonResponse({ error: "codexAutoStart boolean is required" }, 400);
@@ -218,6 +234,10 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
     if (body.streamMode !== undefined && !isStreamMode(body.streamMode)) {
       return jsonResponse({ error: "streamMode must be auto, legacy-tee, or eager-relay" }, 400);
     }
+    if (body.codexAccountPickerEnabled !== undefined
+      && typeof body.codexAccountPickerEnabled !== "boolean") {
+      return jsonResponse({ error: "codexAccountPickerEnabled boolean is required" }, 400);
+    }
     if (body.appOwnedMemoryBudgetMb !== undefined && (
       typeof body.appOwnedMemoryBudgetMb !== "number"
       || !Number.isInteger(body.appOwnedMemoryBudgetMb)
@@ -226,30 +246,76 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
     )) {
       return jsonResponse({ error: `appOwnedMemoryBudgetMb must be an integer from ${MIN_APP_OWNED_MEMORY_BUDGET_MB} to ${MAX_APP_OWNED_MEMORY_BUDGET_MB}` }, 400);
     }
-    if (typeof body.codexAutoStart === "boolean") {
-      config.codexAutoStart = body.codexAutoStart;
-    }
-    if (body.streamMode !== undefined) {
-      if (body.streamMode === "auto") {
-        delete config.streamMode;
-      } else {
-        config.streamMode = body.streamMode as "legacy-tee" | "eager-relay";
+    const previousSettings = {
+      codexAutoStart: config.codexAutoStart,
+      hasCodexAutoStart: Object.hasOwn(config, "codexAutoStart"),
+      streamMode: config.streamMode,
+      hasStreamMode: Object.hasOwn(config, "streamMode"),
+      appOwnedMemoryBudgetMb: config.appOwnedMemoryBudgetMb,
+      hasAppOwnedMemoryBudgetMb: Object.hasOwn(config, "appOwnedMemoryBudgetMb"),
+      codexAccountNamespaces: config.codexAccountNamespaces,
+      hasCodexAccountNamespaces: Object.hasOwn(config, "codexAccountNamespaces"),
+      codexAccountPickerEnabled: config.codexAccountPickerEnabled,
+      hasCodexAccountPickerEnabled: Object.hasOwn(config, "codexAccountPickerEnabled"),
+    };
+    const pickerWasEnabled = codexAccountPickerEnabled(config);
+    let pickerIsEnabled = pickerWasEnabled;
+    try {
+      if (typeof body.codexAutoStart === "boolean") {
+        config.codexAutoStart = body.codexAutoStart;
       }
+      if (body.streamMode !== undefined) {
+        if (body.streamMode === "auto") {
+          delete config.streamMode;
+        } else {
+          config.streamMode = body.streamMode as "legacy-tee" | "eager-relay";
+        }
+      }
+      if (typeof body.appOwnedMemoryBudgetMb === "number") {
+        config.appOwnedMemoryBudgetMb = body.appOwnedMemoryBudgetMb;
+      }
+      if (body.codexAccountPickerEnabled === true) {
+        config.codexAccountPickerEnabled = true;
+        initializeDefaultCodexAccountNamespaces(config);
+      } else if (body.codexAccountPickerEnabled === false) {
+        config.codexAccountPickerEnabled = false;
+      }
+      pickerIsEnabled = codexAccountPickerEnabled(config);
+      (deps.saveConfigPreservingClaudeCode ?? saveConfigPreservingClaudeCode)(config);
+    } catch (error) {
+      if (previousSettings.hasCodexAutoStart) config.codexAutoStart = previousSettings.codexAutoStart;
+      else delete config.codexAutoStart;
+      if (previousSettings.hasStreamMode) config.streamMode = previousSettings.streamMode;
+      else delete config.streamMode;
+      if (previousSettings.hasAppOwnedMemoryBudgetMb) {
+        config.appOwnedMemoryBudgetMb = previousSettings.appOwnedMemoryBudgetMb;
+      } else delete config.appOwnedMemoryBudgetMb;
+      if (previousSettings.hasCodexAccountNamespaces) {
+        config.codexAccountNamespaces = previousSettings.codexAccountNamespaces;
+      } else delete config.codexAccountNamespaces;
+      if (previousSettings.hasCodexAccountPickerEnabled) {
+        config.codexAccountPickerEnabled = previousSettings.codexAccountPickerEnabled;
+      } else delete config.codexAccountPickerEnabled;
+      throw error;
     }
-    if (typeof body.appOwnedMemoryBudgetMb === "number") {
-      config.appOwnedMemoryBudgetMb = body.appOwnedMemoryBudgetMb;
-    }
-    saveConfigPreservingClaudeCode(config);
     if (typeof body.appOwnedMemoryBudgetMb === "number") {
       configureAppOwnedMemoryBudget(resolveAppOwnedMemoryBudgetBytes(body.appOwnedMemoryBudgetMb));
       enforceAppOwnedMemoryBudget();
     }
+    const catalogRefresh = pickerWasEnabled !== pickerIsEnabled
+      ? await convergeCodexCatalog()
+      : undefined;
+    const catalogRefreshPending = catalogRefresh
+      ? catalogRefreshIsPending(catalogRefresh)
+      : false;
     invalidateStartupHealthCache();
     return jsonResponse({
       ok: true,
       codexAutoStart: codexAutoStartEnabled(config),
       streamMode: config.streamMode ?? "auto",
       appOwnedMemoryBudgetMb: config.appOwnedMemoryBudgetMb ?? 256,
+      codexAccountPickerEnabled: pickerIsEnabled,
+      catalogRefreshPending,
       startupHealth: await getCachedStartupHealth(config),
     });
   }
diff --git a/structure/02_config-and-codex-home.md b/structure/02_config-and-codex-home.md
index 2234a3f1ad..d1fc61b2a2 100644
--- a/structure/02_config-and-codex-home.md
+++ b/structure/02_config-and-codex-home.md
@@ -92,7 +92,7 @@ matters for maintainers is which groups exist and who resolves them:
 | --- | --- | --- |
 | Listener | `port`, `hostname` | The listener owns the port; `runtime-port.json` reports where it actually landed. |
 | Routing | `defaultProvider`, `providers`, per-provider `selectedModels` | Explicit `provider/model` wins over `defaultProvider`. |
-| Catalog | `disabledModels`, `customModels`, `modelCacheTtlMs`, `providerContextCaps`, `contextCapValue` | Catalog state is derived; config only records intent. |
+| Catalog | `disabledModels`, `customModels`, `modelCacheTtlMs`, `providerContextCaps`, `contextCapValue`, `codexAccountNamespaces`, `codexAccountPickerEnabled` | Catalog state is derived; config only records intent. The picker flag is an explicit visibility override, while selector mappings remain the durable exact-routing contract. |
 | Retained state | `appOwnedMemoryBudgetMb` | Process-wide eviction target for app-owned logs, caches, blobs, and continuation payloads. Default 256 MiB, valid 64..4096; pinned state may temporarily exceed the target, but every pin-capable store has a finite local cap and their documented aggregate stays below `APP_OWNED_WORST_CASE_PINNED_BYTES` (512 MiB). Neither value caps RSS or native runtime memory. |
 | Transport | stream mode, timeouts, proxy settings, `websockets` | `streamMode` persists in config.json; Windows services need a persisted input, and macOS uses it for explicit eager-relay opt-in. |
 | Credentials | `apiKeys` | Data-plane only; never admitted to `/api/*`. |
diff --git a/structure/05_gui-and-management-api.md b/structure/05_gui-and-management-api.md
index 713379e7fb..a8ad2a8985 100644
--- a/structure/05_gui-and-management-api.md
+++ b/structure/05_gui-and-management-api.md
@@ -79,7 +79,7 @@ this document owns is which module holds which area and what invariant that area
 
 | Endpoint area | Responsibility |
 | --- | --- |
-| Config/settings | Read safe config/settings views; mutate supported settings only. Full `PUT /api/config` is disabled so masked secrets are not round-tripped. `PUT /api/settings` accepts `codexAutoStart`, `streamMode`, and/or integer `appOwnedMemoryBudgetMb` (64..4096; each optional, at least one required). Budget changes synchronously enforce the process-wide evictable retained-state cap; this is separate from RSS/native memory. `streamMode` persists the #314 stream-shape selection in config.json (Windows services need persisted input; macOS eager relay is explicit-only). |
+| Config/settings | Read safe config/settings views; mutate supported settings only. Full `PUT /api/config` is disabled so masked secrets are not round-tripped. `PUT /api/settings` accepts `codexAutoStart`, `streamMode`, integer `appOwnedMemoryBudgetMb` (64..4096), and/or strict boolean `codexAccountPickerEnabled` (each optional, at least one required). Picker enable initializes an empty UI-managed selector map, persists before one bounded catalog convergence, and reports only `catalogRefreshPending`; allocation/save failure restores every touched live field and skips convergence. Budget changes synchronously enforce the process-wide evictable retained-state cap; this is separate from RSS/native memory. `streamMode` persists the #314 stream-shape selection in config.json (Windows services need persisted input; macOS eager relay is explicit-only). |
 | Startup safety | `GET /api/startup-health` reports whether injected Codex routing is restart-safe, with secret-free service/shim diagnostics. `POST /api/startup-action` provides allowlisted one-click installation for the background service or launcher shim. On Windows a healthy script shim is CLI-only; Codex Desktop requires the background service for full protection. |
 | Windows tray | `GET/POST /api/windows-tray` controls an owned, per-user HKCU login tray. The tray delegates fixed actions to the CLI and is never a proxy supervisor or restart-protection signal. |
 | Updates | `GET /api/update/check`, `POST /api/update/run`, and `GET /api/update/status` own dashboard self-update state. A launched worker PID is persisted in `update-job.json`; dead PIDs recover immediately, while legacy active records without a PID recover only after ten minutes. Live PIDs remain exclusive regardless of record age. `GET /api/update/badge` backs the sidebar badge: it reports that an update exists and links to the update surface rather than gating other actions. |
@@ -102,7 +102,7 @@ this document owns is which module holds which area and what invariant that area
 | Effort and fallback | `src/server/management/agent-settings-routes.ts` — `GET/PUT /api/effort-caps`, `/api/subagent-models`, `/api/subagent-model-fallback`. Caps clamp; they do not reject. |
 | Grok and Claude integrations | `src/server/management/agent-settings-routes.ts` — `GET /api/grok`, `PUT /api/grok/selection`, `POST /api/grok/apply`, `GET/PUT /api/claude-desktop`, `POST /api/claude-desktop/apply`, `GET /api/claude-desktop/status`, `GET/PUT /api/claude-code`. Apply writes an external app's profile, so its status probe must read the same resolved path it writes (see [`04_transports-and-sidecars.md`](04_transports-and-sidecars.md)). |
 | Combos | `src/server/management/combo-routes.ts` — `GET/PUT/DELETE /api/combos` own provider combination and failover definitions. |
-| Codex accounts | `src/codex/auth-api.ts` — `GET/POST/DELETE /api/codex-auth/accounts`, `PUT /api/codex-auth/accounts/alias`, `PUT /api/codex-auth/accounts/pause`, `PUT /api/codex-auth/accounts/pause-exhausted`, `POST /api/codex-auth/accounts/clear-cooldown`, `GET/PUT /api/codex-auth/active`, `PUT /api/codex-auth/auto-switch`, `PUT /api/codex-auth/pool-strategy`, `PUT /api/codex-auth/failover`, `GET /api/codex-auth/quota`, `GET /api/codex-auth/reset-credits` with `POST /api/codex-auth/reset-credits/consume`, and the login flow `POST /api/codex-auth/login`, `POST /api/codex-auth/login/code`, `POST /api/codex-auth/login/cancel`, `GET /api/codex-auth/login-status`. Account ids are opaque handles and are serialized so the GUI can address an account; emails are masked and tokens are never serialized. |
+| Codex accounts | `src/codex/auth-api.ts` — `GET/POST/DELETE /api/codex-auth/accounts`, `PUT /api/codex-auth/accounts/alias`, `PUT /api/codex-auth/accounts/pause`, `PUT /api/codex-auth/accounts/pause-exhausted`, `POST /api/codex-auth/accounts/clear-cooldown`, `GET/PUT /api/codex-auth/active`, `PUT /api/codex-auth/auto-switch`, `PUT /api/codex-auth/pool-strategy`, `PUT /api/codex-auth/failover`, `GET /api/codex-auth/quota`, `GET /api/codex-auth/reset-credits` with `POST /api/codex-auth/reset-credits/consume`, and the login flow `POST /api/codex-auth/login`, `POST /api/codex-auth/login/code`, `POST /api/codex-auth/login/cancel`, `GET /api/codex-auth/login-status`. Account ids are opaque handles and are serialized so the GUI can address an account; emails are masked and tokens are never serialized. New-account config commits add UI-managed selector bindings in the same config save; deletion deliberately retains existing bindings for fail-closed exact routing and re-add stability. Account mutations request catalog convergence only after config durability and expose only the boolean `catalogRefreshPending` completion projection. |
 | Sidebar | `src/server/management/sidebar-routes.ts` — `GET/POST /api/github/star` and `GET /api/update/badge`. Sidebar state is cosmetic; a failed fetch degrades silently. |
 | Logs | `src/server/management/logs-usage-routes.ts` — `GET /api/logs`, `GET /api/claude/inbound-debug`, and `GET /api/debug/injection-logs` join the debug streams described above. |
 
@@ -240,7 +240,7 @@ single forms, and the shell pattern is the part worth keeping stable:
 | Subagents | Featured-roster selection workspace (`gui/src/components/subagents-workspace/`). |
 | Combos | Rail, detail panel, and an add flow (`gui/src/components/ComboWorkspace.tsx`). |
 | Add provider | Catalog browser plus form and OAuth panes (`gui/src/components/provider-catalog/`, `gui/src/components/AddProviderModal.tsx`). |
-| Codex accounts | Account pool cards, add-account flow, switch and reset modals (`gui/src/components/CodexAccountPool.tsx`, `gui/src/components/AddCodexAccountModal.tsx`). |
+| Codex accounts | Account pool cards, add-account flow, switch and reset modals (`gui/src/components/CodexAccountPool.tsx`, `gui/src/components/AddCodexAccountModal.tsx`), plus the generic account-targeting picker opt-in on `gui/src/pages/CodexAuth.tsx`. Add/delete/login completion is projected to one boolean before presentation; pending catalog work is a warning, not a failed account mutation. |
 | Dashboard overview | Overview, Providers, and Models tabs at the page level (`gui/src/pages/Dashboard.tsx`), the 30-day token and coverage stats in the overview head (`gui/src/pages/dashboard-overview-head.tsx`), and the effort-cap, injection, maintenance, sidecar, and memory panels below it (`gui/src/pages/dashboard-overview-panels.tsx`). |
 
 Rail selection is component-local state today, so a reload returns to the workspace's default
@@ -253,6 +253,13 @@ OAuth polling API: submit request, waiting-for-login completion, and terminal su
 `aria-live` status message that the code was accepted, and surface repeated `login-status` polling
 network failures as a visible warning instead of silently looking idle again.
 
+The account-targeting control reads the effective flag from `GET /api/settings`; it must not infer
+state from the redacted config DTO or expose selector mappings. It renders no actionable off switch
+before hydration, serializes rapid clicks, rejects stale poll results that started before a mutation,
+and accepts the server-confirmed state after PUT. Product copy describes arbitrary public selectors
+and exact account binding only—there are no built-in Personal/Work roles. A pending catalog refresh
+keeps the saved state and renders fixed `ocx sync` guidance without server/account detail.
+
 ## Usage accounting
 
 `src/usage/log.ts` writes append-only JSONL to `~/.opencodex/usage.jsonl` with file mode `0o600`.
diff --git a/tests/cli-account.test.ts b/tests/cli-account.test.ts
index 703e386154..951c27c521 100644
--- a/tests/cli-account.test.ts
+++ b/tests/cli-account.test.ts
@@ -56,6 +56,8 @@ let codexAccounts: Array<Record<string, unknown>> = [];
 let oauthAccounts: Array<Record<string, unknown>> = [];
 let oauthActiveId: string | null = "acct_1";
 let oauthLoginStatus: Record<string, unknown> = { loggedIn: false };
+let codexLoginStatus: Record<string, unknown> = { status: "pending" };
+let codexDeleteCatalogRefreshPending = false;
 let keyEntries: Array<Record<string, unknown>> = [];
 let keyActiveId: string | null = "key_1";
 let logs: string[] = [];
@@ -139,7 +141,11 @@ async function mockManagementApi(req: Request): Promise<Response> {
     codexAccounts = codexAccounts.filter(account => account.id !== id);
     if (activeCodexAccountId === id) activeCodexAccountId = null;
     lastDeletedType = "codex";
-    return json({ ok: true });
+    return json({
+      ok: true,
+      catalogRefreshPending: codexDeleteCatalogRefreshPending,
+      internalError: "private-delete-detail",
+    });
   }
 
   if (req.method === "PUT" && url.pathname === "/api/codex-auth/accounts/alias") {
@@ -302,6 +308,10 @@ async function mockManagementApi(req: Request): Promise<Response> {
     return json({ ok: true, accepted: true });
   }
 
+  if (req.method === "GET" && url.pathname === "/api/codex-auth/login-status") {
+    return json(codexLoginStatus);
+  }
+
   if (req.method === "POST" && url.pathname === "/api/oauth/login/code") {
     return json({ ok: true, accepted: true });
   }
@@ -405,6 +415,8 @@ beforeEach(() => {
   ];
   oauthActiveId = "acct_1";
   oauthLoginStatus = { loggedIn: false };
+  codexLoginStatus = { status: "pending" };
+  codexDeleteCatalogRefreshPending = false;
   keyEntries = [{
     id: "key_1",
     label: "personal",
@@ -793,6 +805,30 @@ describe("ocx account CLI (issue #180 matrix)", () => {
     )).toBe(true);
   });
 
+  test("pending Codex removal keeps success and prints generic recovery guidance", async () => {
+    codexDeleteCatalogRefreshPending = true;
+    const result = await run(["remove", "openai", "chatgpt_1", "--yes"]);
+
+    expect(result.code).toBe(0);
+    expect(result.stdout).toContain("auto (no pin");
+    expect(result.stderr).toContain("ocx sync");
+    expect(result.stderr).toContain("account change was saved");
+    expect(result.output).not.toContain("private-delete-detail");
+  });
+
+  test("JSON Codex removal retains the pending flag without a human warning", async () => {
+    codexDeleteCatalogRefreshPending = true;
+    const result = await run(["remove", "openai", "chatgpt_1", "--yes", "--json"]);
+
+    expect(result.code).toBe(0);
+    expect(JSON.parse(result.stdout)).toEqual(expect.objectContaining({
+      ok: true,
+      catalogRefreshPending: true,
+    }));
+    expect(result.stdout).not.toContain("private-delete-detail");
+    expect(result.stderr).toBe("");
+  });
+
   test("25: removing the active OAuth account reports the promoted account", async () => {
     const result = await run(["remove", "anthropic", "acct_1", "--yes"]);
 
@@ -1015,6 +1051,7 @@ describe("ocx account CLI (issue #180 matrix)", () => {
       id: "chatgpt_1",
       removedActive: true,
       promotedActiveId: null,
+      catalogRefreshPending: false,
     });
 
     deleteFailure = { status: 500, error: "json delete failed" };
@@ -1562,4 +1599,40 @@ describe("ocx account CLI (issue #180 matrix)", () => {
       sleepSpy.mockRestore();
     }
   });
+
+  test("pending Codex login keeps success and prints generic recovery guidance", async () => {
+    codexLoginStatus = {
+      status: "done",
+      catalogRefreshPending: true,
+      internalError: "private-login-detail",
+    };
+    const sleepSpy = spyOn(Bun, "sleep").mockImplementation(async () => {});
+    try {
+      const result = await run(["login", "openai"]);
+
+      expect(result.code).toBe(0);
+      expect(result.stdout).toContain("Logged in.");
+      expect(result.stderr).toContain("ocx sync");
+      expect(result.output).not.toContain("private-login-detail");
+    } finally {
+      sleepSpy.mockRestore();
+    }
+  });
+
+  test("JSON Codex login retains the pending flag without a human warning", async () => {
+    codexLoginStatus = { status: "done", catalogRefreshPending: true };
+    const sleepSpy = spyOn(Bun, "sleep").mockImplementation(async () => {});
+    try {
+      const result = await run(["login", "openai", "--json"]);
+
+      expect(result.code).toBe(0);
+      expect(JSON.parse(result.stdout)).toEqual({
+        status: "done",
+        catalogRefreshPending: true,
+      });
+      expect(result.stderr).toBe("");
+    } finally {
+      sleepSpy.mockRestore();
+    }
+  });
 });
diff --git a/tests/codex-auth-api.test.ts b/tests/codex-auth-api.test.ts
index 661309e74d..1000dc8f67 100644
--- a/tests/codex-auth-api.test.ts
+++ b/tests/codex-auth-api.test.ts
@@ -24,6 +24,7 @@ import {
   readCodexAccountRecord,
   saveCodexAccountCredential,
 } from "../src/codex/account-store";
+import * as accountStoreModule from "../src/codex/account-store";
 import {
   clearCodexUpstreamHealth,
   clearThreadAccountMap,
@@ -49,11 +50,15 @@ import {
   resetMainCodexAccountIdentityTrackingForTests,
 } from "../src/codex/account-lifecycle";
 import {
+  ConfigMutationLockError,
   getConfigPath,
   loadConfig,
+  readConfigGeneration,
   saveConfig,
   setPersistedConfigMutationBeforeCommitForTests,
 } from "../src/config";
+import * as configModule from "../src/config";
+import type { CatalogDisposition } from "../src/codex/convergence-types";
 import { captureConfigGeneration, registerStateStore } from "../src/lib/state-store-sweeper";
 import {
   reconcileLiveStateStores,
@@ -124,7 +129,18 @@ async function completeMockCodexOAuth(options: {
   email: string;
   onWarmup: () => void;
   usageResponse?: () => Response;
-}): Promise<{ startStatus: number; state: { status: string; error?: string } }> {
+  convergeCodexCatalog?: () => Promise<CatalogDisposition>;
+}): Promise<{
+  startStatus: number;
+  state: {
+    status: string;
+    error?: string;
+    code?: string;
+    accountId?: string;
+    needsReauth?: boolean;
+    catalogRefreshPending?: boolean;
+  };
+}> {
   const oauth = await import("../src/oauth");
   const oauthStore = await import("../src/oauth/store");
   const openUrlMod = await import("../src/lib/open-url");
@@ -173,7 +189,12 @@ async function completeMockCodexOAuth(options: {
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify(options.requestBody),
     });
-    const resp = await handleCodexAuthAPI(req, new URL(req.url), options.config);
+    const resp = await handleCodexAuthAPI(
+      req,
+      new URL(req.url),
+      options.config,
+      options.convergeCodexCatalog,
+    );
     const started = await resp!.json() as { flowId: string };
     for (let attempt = 0; attempt < 500; attempt += 1) {
       const statusReq = new Request(
@@ -181,7 +202,14 @@ async function completeMockCodexOAuth(options: {
         { method: "GET" },
       );
       const statusResp = await handleCodexAuthAPI(statusReq, new URL(statusReq.url), options.config);
-      const state = await statusResp!.json() as { status: string; error?: string };
+      const state = await statusResp!.json() as {
+        status: string;
+        error?: string;
+        code?: string;
+        accountId?: string;
+        needsReauth?: boolean;
+        catalogRefreshPending?: boolean;
+      };
       if (state.status !== "pending") return { startStatus: resp!.status, state };
       await new Promise<void>(resolve => queueMicrotask(resolve));
     }
@@ -2248,6 +2276,345 @@ describe("codex-auth API", () => {
     expect(warmup.calls()).toBe(1);
   });
 
+  test("manual add publishes neither account state nor a selector before config commit", async () => {
+    enableManualImport();
+    mockCodexWarmupSuccess();
+    const accountId = "manual-picker-lock-busy";
+    const config = makeConfig({
+      codexAccountNamespaces: { desktop: "@main" },
+      codexAccountPickerEnabled: true,
+    });
+    saveConfig(structuredClone(config));
+    markAccountNeedsReauth(accountId);
+    let convergenceCalls = 0;
+    const saveSpy = spyOn(configModule, "saveConfigPreservingClaudeCode")
+      .mockImplementation(candidate => {
+        expect(candidate).toBe(config);
+        expect(getCodexAccountCredential(accountId)).toBeNull();
+        expect(readCodexAccountRecord(accountId)).toBeNull();
+        expect(isAccountNeedsReauth(accountId)).toBe(true);
+        throw new ConfigMutationLockError("test config commit failed");
+      });
+
+    try {
+      const req = new Request("http://localhost/api/codex-auth/accounts", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(manualImportBody({ id: accountId })),
+      });
+      await expect(handleCodexAuthAPI(req, new URL(req.url), config, async () => {
+        convergenceCalls += 1;
+        return { status: "committed", changed: false, degraded: false, notices: [] };
+      })).rejects.toBeInstanceOf(ConfigMutationLockError);
+
+      expect(config.codexAccounts).toEqual([]);
+      expect(config.codexAccountNamespaces).toEqual({ desktop: "@main" });
+      expect(Object.values(config.codexAccountNamespaces ?? {})).not.toContain(accountId);
+      expect(loadConfig()).toMatchObject({
+        codexAccounts: [],
+        codexAccountNamespaces: { desktop: "@main" },
+      });
+      expect(getCodexAccountCredential(accountId)).toBeNull();
+      expect(readCodexAccountRecord(accountId)).toBeNull();
+      expect(isAccountNeedsReauth(accountId)).toBe(true);
+      expect(convergenceCalls).toBe(0);
+    } finally {
+      saveSpy.mockRestore();
+    }
+  });
+
+  test("manual add exposes its durable account for recovery when credential publication fails", async () => {
+    enableManualImport();
+    mockCodexWarmupSuccess();
+    const accountId = "manual-picker-credential-fail";
+    const config = makeConfig({
+      codexAccountNamespaces: { desktop: "@main" },
+      codexAccountPickerEnabled: true,
+    });
+    setLiveStateStoreConfig(config);
+    saveConfig(structuredClone(config));
+    const beforeGeneration = readConfigGeneration();
+    if (beforeGeneration.kind !== "ready") throw new Error("config generation unavailable before test");
+    let convergenceCalls = 0;
+    const credentialSpy = spyOn(accountStoreModule, "saveCodexAccountCredential")
+      .mockImplementation(() => {
+        expect(config.codexAccounts?.map(account => account.id)).toEqual([accountId]);
+        expect(Object.values(config.codexAccountNamespaces ?? {})).toContain(accountId);
+        throw new Error("private credential detail Bearer private-token /private/codex-accounts.json");
+      });
+
+    try {
+      const req = new Request("http://localhost/api/codex-auth/accounts", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(manualImportBody({ id: accountId })),
+      });
+      const response = await handleCodexAuthAPI(req, new URL(req.url), config, async () => {
+        convergenceCalls += 1;
+        expect(config.codexAccounts?.map(account => account.id)).toEqual([accountId]);
+        expect(getCodexAccountCredential(accountId)).toBeNull();
+        return { status: "skipped", reason: "busy", retryable: true };
+      });
+      expect(response!.status).toBe(500);
+      const responseBody = await response!.json();
+      expect(responseBody).toEqual({
+        ok: false,
+        error: "Account was saved, but credential setup did not complete. Reauthenticate or remove the account.",
+        code: "codex_credential_persistence_failed",
+        accountId,
+        needsReauth: true,
+        catalogRefreshPending: true,
+      });
+      expect(JSON.stringify(responseBody)).not.toContain("private-token");
+      expect(JSON.stringify(responseBody)).not.toContain("codex-accounts.json");
+
+      expect(config.codexAccounts?.map(account => account.id)).toEqual([accountId]);
+      expect(Object.values(config.codexAccountNamespaces ?? {})).toContain(accountId);
+      expect(loadConfig().codexAccounts?.map(account => account.id)).toEqual([accountId]);
+      expect(Object.values(loadConfig().codexAccountNamespaces ?? {})).toContain(accountId);
+      expect(getCodexAccountCredential(accountId)).toBeNull();
+      expect(readCodexAccountRecord(accountId)).toBeNull();
+      expect(isAccountNeedsReauth(accountId)).toBe(true);
+      expect((await listCodexAuthAccounts(config)).find(account => account.id === accountId))
+        .toMatchObject({ needsReauth: true });
+      expect(convergenceCalls).toBe(1);
+      expect(readConfigGeneration()).toEqual({
+        kind: "ready",
+        generation: { value: beforeGeneration.generation.value + 1 },
+      });
+    } finally {
+      credentialSpy.mockRestore();
+    }
+  });
+
+  test("manual add marks a partially published credential for reauthentication", async () => {
+    enableManualImport();
+    mockCodexWarmupSuccess();
+    const accountId = "manual-picker-validation-fail";
+    const config = makeConfig({
+      codexAccountNamespaces: { desktop: "@main" },
+      codexAccountPickerEnabled: true,
+    });
+    setLiveStateStoreConfig(config);
+    saveConfig(structuredClone(config));
+    let convergenceCalls = 0;
+    const validationSpy = spyOn(accountStoreModule, "markCodexAccountValidated")
+      .mockImplementation(() => {
+        throw new Error("private validation detail /private/codex-accounts.json");
+      });
+
+    try {
+      const req = new Request("http://localhost/api/codex-auth/accounts", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(manualImportBody({ id: accountId })),
+      });
+      const response = await handleCodexAuthAPI(req, new URL(req.url), config, async () => {
+        convergenceCalls += 1;
+        return { status: "committed", changed: true, degraded: false, notices: [] };
+      });
+      expect(response!.status).toBe(500);
+      const responseBody = await response!.json();
+      expect(responseBody).toEqual({
+        ok: false,
+        error: "Account was saved, but credential setup did not complete. Reauthenticate or remove the account.",
+        code: "codex_credential_persistence_failed",
+        accountId,
+        needsReauth: true,
+      });
+      expect(JSON.stringify(responseBody)).not.toContain("codex-accounts.json");
+      expect(config.codexAccounts?.map(account => account.id)).toEqual([accountId]);
+      expect(getCodexAccountCredential(accountId)).not.toBeNull();
+      expect(readCodexAccountRecord(accountId)?.lastCodexValidationStatus).toBeUndefined();
+      expect(getAccountQuota(accountId)).toBeNull();
+      expect(isAccountNeedsReauth(accountId)).toBe(true);
+      expect((await listCodexAuthAccounts(config)).find(account => account.id === accountId))
+        .toMatchObject({ needsReauth: true });
+      expect(convergenceCalls).toBe(1);
+    } finally {
+      validationSpy.mockRestore();
+    }
+  });
+
+  test.each([
+    [
+      "committed",
+      { status: "committed", changed: true, degraded: false, notices: [] } satisfies CatalogDisposition,
+      false,
+    ],
+    [
+      "deferred",
+      { status: "skipped", reason: "busy", retryable: true } satisfies CatalogDisposition,
+      true,
+    ],
+  ] as const)("UI-managed manual add is durable before %s convergence", async (_label, disposition, pending) => {
+    enableManualImport();
+    mockCodexWarmupSuccess();
+    const accountId = pending ? "manual-picker-pending" : "manual-picker-ready";
+    const config = makeConfig({
+      codexAccountNamespaces: { desktop: "@main" },
+      codexAccountPickerEnabled: true,
+    });
+    let convergenceCalls = 0;
+    const req = new Request("http://localhost/api/codex-auth/accounts", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(manualImportBody({ id: accountId })),
+    });
+    const response = await handleCodexAuthAPI(req, new URL(req.url), config, async () => {
+      convergenceCalls += 1;
+      const persisted = JSON.parse(readFileSync(getConfigPath(), "utf8")) as OcxConfig;
+      expect(persisted.codexAccounts?.some(account => account.id === accountId)).toBe(true);
+      expect(getCodexAccountCredential(accountId)).not.toBeNull();
+      return disposition;
+    });
+
+    const binding = Object.entries(config.codexAccountNamespaces ?? {})
+      .find(([, target]) => target === accountId);
+    expect(response!.status).toBe(200);
+    expect(await response!.json()).toEqual({ ok: true, catalogRefreshPending: pending });
+    expect(binding?.[0]).toMatch(CODEX_ACCOUNT_LOG_LABEL_RE);
+    expect(binding?.[0]).not.toContain(accountId);
+    expect(convergenceCalls).toBe(1);
+  });
+
+  test("manual add projects a convergence result to only the pending boolean", async () => {
+    enableManualImport();
+    mockCodexWarmupSuccess();
+    const privateDetail = "Bearer private-token acct-private /private/catalog/path";
+    const config = makeConfig({
+      codexAccountNamespaces: { desktop: "@main" },
+      codexAccountPickerEnabled: true,
+    });
+    const req = new Request("http://localhost/api/codex-auth/accounts", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(manualImportBody({ id: "manual-picker-sanitized" })),
+    });
+    const response = await handleCodexAuthAPI(req, new URL(req.url), config, async () => ({
+      status: "failed",
+      reason: "disk",
+      phase: "commit",
+      retryable: false,
+      partialWrite: true,
+      privateDetail,
+      toJSON: () => ({ privateDetail }),
+    } as unknown as CatalogDisposition));
+    const body = await response!.json();
+
+    expect(body).toEqual({ ok: true, catalogRefreshPending: true });
+    expect(JSON.stringify(body)).not.toContain(privateDetail);
+  });
+
+  test("manual maps stay manual while a disabled UI-managed map tracks new accounts", async () => {
+    enableManualImport();
+    mockCodexWarmupSuccess();
+    let convergenceCalls = 0;
+    for (const [accountId, enabled, expectedBinding] of [
+      ["manual-map-add", undefined, false],
+      ["hidden-picker-add", false, true],
+    ] as const) {
+      const config = makeConfig({
+        codexAccountNamespaces: { desktop: "@main" },
+        ...(enabled === undefined ? {} : { codexAccountPickerEnabled: enabled }),
+      });
+      const req = new Request("http://localhost/api/codex-auth/accounts", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(manualImportBody({
+          id: accountId,
+          email: `${accountId}@example.test`,
+          chatgptAccountId: `acct-${accountId}`,
+        })),
+      });
+      const response = await handleCodexAuthAPI(req, new URL(req.url), config, async () => {
+        convergenceCalls += 1;
+        return { status: "committed", changed: false, degraded: false, notices: [] };
+      });
+      expect(await response!.json()).toEqual({ ok: true, catalogRefreshPending: false });
+      expect(Object.values(config.codexAccountNamespaces ?? {}).includes(accountId)).toBe(expectedBinding);
+    }
+    expect(convergenceCalls).toBe(0);
+  });
+
+  test.each([
+    ["enabled matching binding", true, "lifecycle-delete", true],
+    ["disabled matching binding", false, "lifecycle-delete", false],
+    ["enabled orphaned binding", true, "missing-account", false],
+  ] as const)("delete lifecycle reports picker visibility for %s", (_case, enabled, target, expected) => {
+    const accountId = "lifecycle-delete";
+    const config = makeConfig({
+      codexAccounts: [{ id: accountId, email: "delete@example.test", isMain: false }],
+      codexAccountNamespaces: { team: target },
+      codexAccountPickerEnabled: enabled,
+    });
+
+    expect(deleteCodexAccount(config, accountId)).toBe(expected);
+    expect(config.codexAccounts).toEqual([]);
+    expect(config.codexAccountNamespaces).toEqual({ team: target });
+  });
+
+  test("enabled picker deletion retains its selector and converges after delete and re-add", async () => {
+    enableManualImport();
+    mockCodexWarmupSuccess();
+    const accountId = "picker-delete";
+    const config = makeConfig({
+      codexAccounts: [{ id: accountId, email: "delete@example.test", isMain: false }],
+      codexAccountNamespaces: { team: accountId },
+      codexAccountPickerEnabled: true,
+    });
+    saveCodexAccountCredential(accountId, {
+      accessToken: "delete-access",
+      refreshToken: "delete-refresh",
+      expiresAt: Date.now() + 60_000,
+      chatgptAccountId: "delete-chatgpt-id",
+    });
+    let convergences = 0;
+    const convergeCodexCatalog = async (): Promise<CatalogDisposition> => {
+      convergences += 1;
+      const persisted = JSON.parse(readFileSync(getConfigPath(), "utf8")) as OcxConfig;
+      expect(persisted.codexAccountNamespaces).toEqual({ team: accountId });
+      if (convergences === 1) {
+        expect(persisted.codexAccounts).toEqual([]);
+        expect(getCodexAccountCredential(accountId)).toBeNull();
+      } else {
+        expect(persisted.codexAccounts?.map(account => account.id)).toEqual([accountId]);
+        expect(getCodexAccountCredential(accountId)).not.toBeNull();
+      }
+      return { status: "committed", changed: true, degraded: false, notices: [] };
+    };
+
+    const deleteReq = new Request(
+      `http://localhost/api/codex-auth/accounts?id=${accountId}`,
+      { method: "DELETE" },
+    );
+    const deleted = await handleCodexAuthAPI(
+      deleteReq,
+      new URL(deleteReq.url),
+      config,
+      convergeCodexCatalog,
+    );
+    expect(await deleted!.json()).toEqual({ ok: true, catalogRefreshPending: false });
+    expect(config.codexAccountNamespaces).toEqual({ team: accountId });
+    expect(config.codexAccounts).toEqual([]);
+
+    const addReq = new Request("http://localhost/api/codex-auth/accounts", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(manualImportBody({ id: accountId })),
+    });
+    const added = await handleCodexAuthAPI(
+      addReq,
+      new URL(addReq.url),
+      config,
+      convergeCodexCatalog,
+    );
+    expect(await added!.json()).toEqual({ ok: true, catalogRefreshPending: false });
+    expect(config.codexAccountNamespaces).toEqual({ team: accountId });
+    expect(config.codexAccounts?.map(account => account.id)).toEqual([accountId]);
+    expect(convergences).toBe(2);
+  });
+
   test("POST /api/codex-auth/accounts allows a pool account matching the main login", async () => {
     enableManualImport();
     mockCodexWarmupSuccess();
@@ -3442,6 +3809,25 @@ describe("codex-auth API", () => {
     expect(data).toEqual({ status: "done", accountId: "pool-login-recovery" });
   });
 
+  test("GET /api/codex-auth/login-status does not recover a partially published account as done", async () => {
+    const accountId = "pool-login-partial";
+    saveCodexAccountCredential(accountId, {
+      accessToken: "tok",
+      refreshToken: "ref",
+      expiresAt: Date.now() + 5 * 60_000,
+      chatgptAccountId: "acc-pool-login-partial",
+    });
+    markAccountNeedsReauth(accountId);
+
+    const req = new Request(
+      `http://localhost/api/codex-auth/login-status?flowId=missing&accountId=${accountId}`,
+      { method: "GET" },
+    );
+    const resp = await handleCodexAuthAPI(req, new URL(req.url), {} as any);
+    const data = await resp!.json() as { status: string; accountId?: string };
+    expect(data).toEqual({ status: "expired" });
+  });
+
   test("GET /api/codex-auth/login-status does not false-complete reauth from a stale credential", async () => {
     saveCodexAccountCredential("pool-reauth-stale", {
       accessToken: "tok",
@@ -3665,6 +4051,168 @@ describe("codex-auth API", () => {
     expect(getCodexAccountCredential("oauth-race")).toBeNull();
   });
 
+  test("OAuth creation reports a durable add when catalog convergence is pending", async () => {
+    const accountId = "oauth-picker-pending";
+    const config = makeConfig({
+      codexAccountNamespaces: { desktop: "@main" },
+      codexAccountPickerEnabled: true,
+    });
+    setLiveStateStoreConfig(config);
+    markAccountNeedsReauth(accountId);
+    let convergenceCalls = 0;
+    const result = await completeMockCodexOAuth({
+      config,
+      requestBody: { id: accountId },
+      oauthAccountId: "oauth-picker-chatgpt-id",
+      email: "oauth-picker@example.test",
+      onWarmup: () => {},
+      usageResponse: () => new Response(JSON.stringify({
+        email: "oauth-picker@example.test",
+        plan_type: "pro",
+        rate_limit: { primary_window: { used_percent: 73, reset_at: 1782628379 } },
+      }), { status: 200 }),
+      convergeCodexCatalog: async () => {
+        convergenceCalls += 1;
+        expect(config.codexAccounts?.some(account => account.id === accountId)).toBe(true);
+        expect(getCodexAccountCredential(accountId)).not.toBeNull();
+        expect(readCodexAccountRecord(accountId)?.lastCodexValidationStatus).toBe("ok");
+        expect(isAccountNeedsReauth(accountId)).toBe(false);
+        expect(getAccountQuota(accountId)?.weeklyPercent).toBe(73);
+        throw new Error("private oauth refresh details Bearer private-token /private/path");
+      },
+    });
+
+    expect(result.startStatus).toBe(200);
+    expect(result.state).toMatchObject({ status: "done", catalogRefreshPending: true });
+    expect(JSON.stringify(result.state)).not.toContain("private oauth refresh details");
+    expect(config.codexAccounts?.some(account => account.id === accountId)).toBe(true);
+    expect(Object.values(config.codexAccountNamespaces ?? {})).toContain(accountId);
+    expect(getCodexAccountCredential(accountId)).not.toBeNull();
+    expect(readCodexAccountRecord(accountId)?.lastCodexValidationStatus).toBe("ok");
+    expect(isAccountNeedsReauth(accountId)).toBe(false);
+    expect(getAccountQuota(accountId)?.weeklyPercent).toBe(73);
+    expect(convergenceCalls).toBe(1);
+  });
+
+  test("OAuth creation exposes its durable account for recovery when credential publication fails", async () => {
+    const accountId = "oauth-picker-credential-fail";
+    const config = makeConfig({
+      codexAccountNamespaces: { desktop: "@main" },
+      codexAccountPickerEnabled: true,
+    });
+    setLiveStateStoreConfig(config);
+    let convergenceCalls = 0;
+    const credentialSpy = spyOn(accountStoreModule, "saveCodexAccountCredential")
+      .mockImplementation(() => {
+        throw new Error("private OAuth detail Bearer private-token /private/codex-accounts.json");
+      });
+
+    try {
+      const result = await completeMockCodexOAuth({
+        config,
+        requestBody: { id: accountId },
+        oauthAccountId: "oauth-picker-credential-fail-chatgpt-id",
+        email: "oauth-picker-credential-fail@example.test",
+        onWarmup: () => {},
+        usageResponse: () => new Response(JSON.stringify({
+          email: "oauth-picker-credential-fail@example.test",
+          plan_type: "pro",
+          rate_limit: { primary_window: { used_percent: 73, reset_at: 1782628379 } },
+        }), { status: 200 }),
+        convergeCodexCatalog: async () => {
+          convergenceCalls += 1;
+          expect(config.codexAccounts?.map(account => account.id)).toEqual([accountId]);
+          expect(getCodexAccountCredential(accountId)).toBeNull();
+          expect(getAccountQuota(accountId)).toBeNull();
+          return { status: "skipped", reason: "busy", retryable: true };
+        },
+      });
+
+      expect(result.startStatus).toBe(200);
+      expect(result.state).toMatchObject({
+        status: "error",
+        error: "Account was saved, but credential setup did not complete. Reauthenticate or remove the account.",
+        code: "codex_credential_persistence_failed",
+        accountId,
+        needsReauth: true,
+        catalogRefreshPending: true,
+      });
+      expect(JSON.stringify(result.state)).not.toContain("private-token");
+      expect(JSON.stringify(result.state)).not.toContain("codex-accounts.json");
+      expect(config.codexAccounts?.map(account => account.id)).toEqual([accountId]);
+      expect(Object.values(config.codexAccountNamespaces ?? {})).toContain(accountId);
+      expect(loadConfig().codexAccounts?.map(account => account.id)).toEqual([accountId]);
+      expect(getCodexAccountCredential(accountId)).toBeNull();
+      expect(getAccountQuota(accountId)).toBeNull();
+      expect(isAccountNeedsReauth(accountId)).toBe(true);
+      expect((await listCodexAuthAccounts(config)).find(account => account.id === accountId))
+        .toMatchObject({ needsReauth: true });
+      expect(convergenceCalls).toBe(1);
+    } finally {
+      credentialSpy.mockRestore();
+    }
+  });
+
+  test("OAuth add publishes neither account state nor a selector before config commit", async () => {
+    const accountId = "oauth-picker-lock-busy";
+    const config = makeConfig({
+      codexAccountNamespaces: { desktop: "@main" },
+      codexAccountPickerEnabled: true,
+    });
+    saveConfig(structuredClone(config));
+    markAccountNeedsReauth(accountId);
+    updateAccountQuota(accountId, 11);
+    let convergenceCalls = 0;
+    const saveSpy = spyOn(configModule, "saveConfigPreservingClaudeCode")
+      .mockImplementation(candidate => {
+        expect(candidate).toBe(config);
+        expect(getCodexAccountCredential(accountId)).toBeNull();
+        expect(readCodexAccountRecord(accountId)).toBeNull();
+        expect(isAccountNeedsReauth(accountId)).toBe(true);
+        expect(getAccountQuota(accountId)?.weeklyPercent).toBe(11);
+        throw new ConfigMutationLockError("test config commit failed");
+      });
+
+    try {
+      const result = await completeMockCodexOAuth({
+        config,
+        requestBody: { id: accountId },
+        oauthAccountId: "oauth-picker-lock-chatgpt-id",
+        email: "oauth-picker-lock@example.test",
+        onWarmup: () => {},
+        usageResponse: () => new Response(JSON.stringify({
+          email: "oauth-picker-lock@example.test",
+          plan_type: "pro",
+          rate_limit: { primary_window: { used_percent: 73, reset_at: 1782628379 } },
+        }), { status: 200 }),
+        convergeCodexCatalog: async () => {
+          convergenceCalls += 1;
+          return { status: "committed", changed: false, degraded: false, notices: [] };
+        },
+      });
+
+      expect(result.startStatus).toBe(200);
+      expect(result.state).toMatchObject({
+        status: "error",
+        error: "Configuration is busy; retry login shortly.",
+      });
+      expect(config.codexAccounts).toEqual([]);
+      expect(config.codexAccountNamespaces).toEqual({ desktop: "@main" });
+      expect(Object.values(config.codexAccountNamespaces ?? {})).not.toContain(accountId);
+      expect(loadConfig()).toMatchObject({
+        codexAccounts: [],
+        codexAccountNamespaces: { desktop: "@main" },
+      });
+      expect(getCodexAccountCredential(accountId)).toBeNull();
+      expect(readCodexAccountRecord(accountId)).toBeNull();
+      expect(isAccountNeedsReauth(accountId)).toBe(true);
+      expect(getAccountQuota(accountId)?.weeklyPercent).toBe(11);
+      expect(convergenceCalls).toBe(0);
+    } finally {
+      saveSpy.mockRestore();
+    }
+  });
+
   test("OAuth reauth cannot recreate an account deleted during warmup", async () => {
     const config = makeConfig({
       codexAccounts: [{ id: "reauth-race", email: "reauth-race@example.test", isMain: false }],
@@ -3756,12 +4304,6 @@ describe("codex-auth API", () => {
     expect(source).toContain("Cannot verify account identity for reauth. Remove this account and add it again.");
   });
 
-  test("login-status reauth polling refuses credential-exists shortcut", async () => {
-    const source = await Bun.file("src/codex/auth-api.ts").text();
-    expect(source).toContain('url.searchParams.get("reauth") === "1"');
-    expect(source).toContain("!st && accountId && !reauthStatus && getCodexAccountCredential(accountId)");
-  });
-
   test("OAuth pool login waits for the current flow to finish, not stale credentials", async () => {
     const source = await Bun.file("src/codex/auth-api.ts").text();
     expect(source).toContain("st.done && st.loggedIn");
diff --git a/tests/codex-catalog-refresh-status.test.ts b/tests/codex-catalog-refresh-status.test.ts
new file mode 100644
index 0000000000..85e0d299cf
--- /dev/null
+++ b/tests/codex-catalog-refresh-status.test.ts
@@ -0,0 +1,109 @@
+import { describe, expect, test } from "bun:test";
+import {
+  catalogRefreshIsPending,
+  normalizeCatalogDisposition,
+} from "../src/codex/catalog-refresh-status";
+import type { CatalogDisposition } from "../src/codex/convergence-types";
+
+describe("catalogRefreshIsPending", () => {
+  test("only committed catalog state is complete", () => {
+    const committed: CatalogDisposition = {
+      status: "committed",
+      changed: false,
+      degraded: false,
+      notices: [],
+    };
+    expect(catalogRefreshIsPending(committed)).toBe(false);
+    expect(catalogRefreshIsPending({ status: "skipped", reason: "busy", retryable: true })).toBe(true);
+    expect(catalogRefreshIsPending({
+      status: "failed",
+      reason: "disk",
+      phase: "commit",
+      retryable: false,
+      partialWrite: true,
+    })).toBe(true);
+  });
+});
+
+describe("normalizeCatalogDisposition", () => {
+  test("rebuilds only public disposition fields", () => {
+    const privateDetail = "Bearer private-token acct-private /private/catalog/path";
+    const normalized = normalizeCatalogDisposition({
+      status: "failed",
+      reason: "disk",
+      phase: "commit",
+      retryable: false,
+      partialWrite: true,
+      privateDetail,
+      toJSON: () => ({ privateDetail }),
+    });
+
+    expect(normalized).toEqual({
+      status: "failed",
+      reason: "disk",
+      phase: "commit",
+      retryable: false,
+      partialWrite: true,
+    });
+    expect(JSON.stringify(normalized)).not.toContain(privateDetail);
+  });
+
+  test("rejects coercive and accessor-backed fields without invoking them", () => {
+    let coercions = 0;
+    const coerciveReason = {
+      toString: () => {
+        coercions += 1;
+        return "disk";
+      },
+    };
+    expect(normalizeCatalogDisposition({
+      status: "failed",
+      reason: coerciveReason,
+      phase: "commit",
+      retryable: false,
+      partialWrite: true,
+    })).toBeNull();
+    expect(coercions).toBe(0);
+
+    let getterReads = 0;
+    const accessorDisposition: Record<string, unknown> = {
+      status: "failed",
+      phase: "commit",
+      retryable: false,
+      partialWrite: true,
+    };
+    Object.defineProperty(accessorDisposition, "reason", {
+      enumerable: true,
+      get: () => {
+        getterReads += 1;
+        return "disk";
+      },
+    });
+    expect(normalizeCatalogDisposition(accessorDisposition)).toBeNull();
+    expect(getterReads).toBe(0);
+  });
+
+  test("copies notices without trusting a custom iterator", () => {
+    let iteratorCalls = 0;
+    const notices = ["provider-auth", "fallback"];
+    Object.defineProperty(notices, Symbol.iterator, {
+      value: () => {
+        iteratorCalls += 1;
+        throw new Error("private iterator detail");
+      },
+    });
+
+    expect(normalizeCatalogDisposition({
+      status: "committed",
+      changed: true,
+      degraded: true,
+      notices,
+    })).toEqual({
+      status: "committed",
+      changed: true,
+      degraded: true,
+      notices: ["provider-auth", "fallback"],
+    });
+    expect(iteratorCalls).toBe(0);
+  });
+});
diff --git a/tests/helpers/catalog-convergence.ts b/tests/helpers/catalog-convergence.ts
index c75d53ec75..f97d3b7013 100644
--- a/tests/helpers/catalog-convergence.ts
+++ b/tests/helpers/catalog-convergence.ts
@@ -1,15 +1,21 @@
 import { projectCatalogOnlyOutcome } from "../../src/codex/management-convergence";
-import type { ConvergeCodex } from "../../src/codex/convergence-types";
+import type { CatalogDisposition, ConvergeCodex } from "../../src/codex/convergence-types";
 import type { OcxConfig } from "../../src/types";
 
 export function catalogConvergenceFactory(
   run: () => Promise<void> | void = () => {},
+  catalogRefresh: CatalogDisposition = {
+    status: "committed",
+    changed: false,
+    degraded: false,
+    notices: [],
+  },
 ): (config: Readonly<OcxConfig>) => ConvergeCodex {
   return () => async () => {
     await run();
     return projectCatalogOnlyOutcome({
       changed: false,
-      catalogRefresh: { status: "committed", changed: false, degraded: false, notices: [] },
+      catalogRefresh,
     });
   };
 }
diff --git a/tests/provider-workspace-auth.test.ts b/tests/provider-workspace-auth.test.ts
index 08847c797c..cf61ba8fb6 100644
--- a/tests/provider-workspace-auth.test.ts
+++ b/tests/provider-workspace-auth.test.ts
@@ -120,10 +120,8 @@ describe("workspace account integration seam", () => {
     expect(page).toContain('notify(t("prov.logoutFail"');
     expect(page).toContain('notify(t("prov.accountRemoveFail"');
     expect(page).toContain("await fetchAccountSets([provider])");
-    // Upstream replaced the setToast state with showActionFeedback; the contract this
-    // pins is unchanged and slightly tighter — the failure path must surface
-    // codexAuth.removeFailed AND mark it as an error tone via the second argument.
-    expect(codexPool).toContain('showActionFeedback(t("codexAuth.removeFailed"), true)');
+    // The failure path must surface codexAuth.removeFailed and mark it as an error tone.
+    expect(codexPool).toContain('showActionFeedback(t("codexAuth.removeFailed"), "err")');
     expect(hook).toContain("pauseTokensRef");
   });
 
diff --git a/tests/settings-stream-mode.test.ts b/tests/settings-stream-mode.test.ts
index 7b2320fa7e..b079ff61cb 100644
--- a/tests/settings-stream-mode.test.ts
+++ b/tests/settings-stream-mode.test.ts
@@ -12,7 +12,7 @@ import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { getConfigPath, loadConfig, saveConfig } from "../src/config";
-import { handleManagementAPI } from "../src/server/management-api";
+import { handleManagementAPI, type ManagementApiDeps } from "../src/server/management-api";
 import { invalidateStartupHealthCache } from "../src/server/startup-health-cache";
 import type { OcxConfig } from "../src/types";
 import {
@@ -28,6 +28,7 @@ import {
   setUsageSummaryCacheEntry,
   usageSummaryRetainedStoreSnapshot,
 } from "../src/server/management/usage-summary-cache";
+import { catalogConvergenceFactory } from "./helpers/catalog-convergence";
 
 let TEST_DIR = "";
 const previousHome = process.env.OPENCODEX_HOME;
@@ -47,13 +48,17 @@ function baseConfig(): OcxConfig {
   };
 }
 
-function putSettings(config: OcxConfig, body: unknown): Promise<Response | null> {
+function putSettings(
+  config: OcxConfig,
+  body: unknown,
+  deps: ManagementApiDeps = {},
+): Promise<Response | null> {
   const req = new Request("http://127.0.0.1:10100/api/settings", {
     method: "PUT",
     headers: { "content-type": "application/json" },
     body: JSON.stringify(body),
   });
-  return handleManagementAPI(req, new URL(req.url), config);
+  return handleManagementAPI(req, new URL(req.url), config, deps);
 }
 
 function getSettings(config: OcxConfig): Promise<Response | null> {
@@ -104,6 +109,25 @@ describe("GET /api/settings", () => {
     expect(body.appOwnedMemoryBudgetMb).toBe(256);
   });
 
+  test("reports the effective account-picker state", async () => {
+    const absent = await (await getSettings(baseConfig()))!.json() as {
+      codexAccountPickerEnabled?: boolean;
+    };
+    const inferred = await (await getSettings({
+      ...baseConfig(),
+      codexAccountNamespaces: { side: "stored-account" },
+    }))!.json() as { codexAccountPickerEnabled?: boolean };
+    const hidden = await (await getSettings({
+      ...baseConfig(),
+      codexAccountNamespaces: { side: "stored-account" },
+      codexAccountPickerEnabled: false,
+    }))!.json() as { codexAccountPickerEnabled?: boolean };
+
+    expect(absent.codexAccountPickerEnabled).toBe(false);
+    expect(inferred.codexAccountPickerEnabled).toBe(true);
+    expect(hidden.codexAccountPickerEnabled).toBe(false);
+  });
+
   test("reports redacted codexRuntime diagnostics and clamp correlation", async () => {
     const { chmodSync } = await import("node:fs");
     const {
@@ -260,6 +284,202 @@ describe("PUT /api/settings", () => {
     expect(res!.status).toBe(400);
   });
 
+  test.each([[null], [[]], ["settings"], [42]] as const)(
+    "rejects a non-object settings body with 400 (%j)",
+    async body => {
+      const response = await putSettings(baseConfig(), body);
+      expect(response!.status).toBe(400);
+      expect(await response!.json()).toEqual({ error: "settings body must be an object" });
+    },
+  );
+
+  test("account-picker enable persists before one catalog convergence", async () => {
+    const config = baseConfig();
+    let persisted = false;
+    let convergences = 0;
+    const response = await putSettings(config, { codexAccountPickerEnabled: true }, {
+      saveConfigPreservingClaudeCode: saved => {
+        persisted = true;
+        expect(saved.codexAccountPickerEnabled).toBe(true);
+        expect(saved.codexAccountNamespaces).toEqual({ main: "@main" });
+      },
+      createManagementConvergeCodex: catalogConvergenceFactory(() => {
+        expect(persisted).toBe(true);
+        convergences += 1;
+      }),
+    });
+
+    expect(response!.status).toBe(200);
+    expect(await response!.json()).toMatchObject({
+      codexAccountPickerEnabled: true,
+      catalogRefreshPending: false,
+    });
+    expect(convergences).toBe(1);
+    expect(config.codexAccountNamespaces).toEqual({ main: "@main" });
+  });
+
+  test("account-picker disable does not initialize an empty namespace map", async () => {
+    const config = baseConfig();
+    let convergences = 0;
+    const response = await putSettings(config, { codexAccountPickerEnabled: false }, {
+      saveConfigPreservingClaudeCode: () => {},
+      createManagementConvergeCodex: catalogConvergenceFactory(() => { convergences += 1; }),
+    });
+
+    expect(response!.status).toBe(200);
+    expect(await response!.json()).toMatchObject({
+      codexAccountPickerEnabled: false,
+      catalogRefreshPending: false,
+    });
+    expect(config.codexAccountNamespaces).toBeUndefined();
+    expect(convergences).toBe(0);
+  });
+
+  test("account-picker convergence failure remains a successful persisted mutation", async () => {
+    const config = {
+      ...baseConfig(),
+      codexAccountNamespaces: { main: "@main" },
+      codexAccountPickerEnabled: false,
+    };
+    let persisted = false;
+    let convergences = 0;
+    const response = await putSettings(config, { codexAccountPickerEnabled: true }, {
+      saveConfigPreservingClaudeCode: () => { persisted = true; },
+      createManagementConvergeCodex: catalogConvergenceFactory(() => {
+        expect(persisted).toBe(true);
+        convergences += 1;
+        throw new Error("private refresh failure detail");
+      }),
+    });
+
+    expect(response!.status).toBe(200);
+    const payload = await response!.json();
+    expect(payload).toMatchObject({
+      ok: true,
+      codexAccountPickerEnabled: true,
+      catalogRefreshPending: true,
+    });
+    expect(JSON.stringify(payload)).not.toContain("private refresh failure detail");
+    expect(config.codexAccountPickerEnabled).toBe(true);
+    expect(convergences).toBe(1);
+  });
+
+  test.each([
+    ["unavailable", { status: "skipped", reason: "catalog-unavailable", retryable: false }],
+    ["busy", { status: "skipped", reason: "busy", retryable: true }],
+    ["disk failure", {
+      status: "failed",
+      reason: "disk",
+      phase: "commit",
+      retryable: false,
+      partialWrite: true,
+    }],
+  ] as const)("account-picker treats a non-committed %s catalog as pending", async (_state, result) => {
+    const config = {
+      ...baseConfig(),
+      codexAccountNamespaces: { main: "@main" },
+      codexAccountPickerEnabled: false,
+    };
+    let convergences = 0;
+    const response = await putSettings(config, { codexAccountPickerEnabled: true }, {
+      saveConfigPreservingClaudeCode: () => {},
+      createManagementConvergeCodex: catalogConvergenceFactory(
+        () => { convergences += 1; },
+        result,
+      ),
+    });
+
+    expect(response!.status).toBe(200);
+    expect(await response!.json()).toMatchObject({
+      codexAccountPickerEnabled: true,
+      catalogRefreshPending: true,
+    });
+    expect(convergences).toBe(1);
+  });
+
+  test("account-picker disable and re-enable preserve custom namespace order", async () => {
+    const namespaces = { side: "stored-account", main: "@main" };
+    const config = { ...baseConfig(), codexAccountNamespaces: namespaces };
+    const persistedOrders: string[][] = [];
+    let convergences = 0;
+    const deps: ManagementApiDeps = {
+      saveConfigPreservingClaudeCode: saved => {
+        persistedOrders.push(Object.keys(saved.codexAccountNamespaces ?? {}));
+      },
+      createManagementConvergeCodex: catalogConvergenceFactory(() => { convergences += 1; }),
+    };
+
+    const disabled = await putSettings(config, { codexAccountPickerEnabled: false }, deps);
+    expect(await disabled!.json()).toMatchObject({ codexAccountPickerEnabled: false });
+    const reenabled = await putSettings(config, { codexAccountPickerEnabled: true }, deps);
+    expect(await reenabled!.json()).toMatchObject({ codexAccountPickerEnabled: true });
+
+    expect(config.codexAccountNamespaces).toBe(namespaces);
+    expect(persistedOrders).toEqual([["side", "main"], ["side", "main"]]);
+    expect(convergences).toBe(2);
+  });
+
+  test("account-picker rejects non-boolean values before persistence or refresh", async () => {
+    let persisted = false;
+    let refreshed = false;
+    const response = await putSettings(baseConfig(), { codexAccountPickerEnabled: "yes" }, {
+      saveConfigPreservingClaudeCode: () => { persisted = true; },
+      createManagementConvergeCodex: catalogConvergenceFactory(() => { refreshed = true; }),
+    });
+
+    expect(response!.status).toBe(400);
+    expect(persisted).toBe(false);
+    expect(refreshed).toBe(false);
+  });
+
+  test("failed persistence rolls back picker and other settings", async () => {
+    const config = baseConfig();
+    const before = structuredClone(config);
+    let refreshed = false;
+    const request = putSettings(config, {
+      codexAutoStart: false,
+      streamMode: "legacy-tee",
+      appOwnedMemoryBudgetMb: 128,
+      codexAccountPickerEnabled: true,
+    }, {
+      saveConfigPreservingClaudeCode: () => { throw new Error("save failed"); },
+      createManagementConvergeCodex: catalogConvergenceFactory(() => { refreshed = true; }),
+    });
+
+    await expect(request).rejects.toThrow("save failed");
+    expect(config).toEqual(before);
+    expect(refreshed).toBe(false);
+  });
+
+  test("selector allocation failure rolls back before persistence", async () => {
+    const config = baseConfig();
+    Object.defineProperty(config, "codexAccounts", {
+      configurable: true,
+      get: () => { throw new Error("selector allocation failed"); },
+    });
+    let persisted = false;
+    let refreshed = false;
+
+    const request = putSettings(config, {
+      codexAutoStart: false,
+      streamMode: "legacy-tee",
+      appOwnedMemoryBudgetMb: 128,
+      codexAccountPickerEnabled: true,
+    }, {
+      saveConfigPreservingClaudeCode: () => { persisted = true; },
+      createManagementConvergeCodex: catalogConvergenceFactory(() => { refreshed = true; }),
+    });
+
+    await expect(request).rejects.toThrow("selector allocation failed");
+    expect(Object.hasOwn(config, "codexAutoStart")).toBe(false);
+    expect(Object.hasOwn(config, "streamMode")).toBe(false);
+    expect(Object.hasOwn(config, "appOwnedMemoryBudgetMb")).toBe(false);
+    expect(Object.hasOwn(config, "codexAccountNamespaces")).toBe(false);
+    expect(Object.hasOwn(config, "codexAccountPickerEnabled")).toBe(false);
+    expect(persisted).toBe(false);
+    expect(refreshed).toBe(false);
+  });
+
   test("settings PUT rejects below above fractional and nonnumeric budget values", async () => {
     for (const value of [63, 4097, 64.5, "64"]) {
       const res = await putSettings(baseConfig(), { appOwnedMemoryBudgetMb: value });