diff --git a/gui/src/api.ts b/gui/src/api.ts
index 8cdd45652..1df043791 100644
--- a/gui/src/api.ts
+++ b/gui/src/api.ts
@@ -16,8 +16,12 @@ let promptCancelled = false;
 type AdminTokenPrompt = (verifyToken: AdminTokenVerifier) => Promise<string | null>;
 let requestAdminToken: AdminTokenPrompt = promptForAdminToken;
 
-/** Document path re-fetched to mint a fresh loopback GUI session (server injects meta tags). */
-const SESSION_REBOOTSTRAP_PATH = "/";
+/**
+ * Document path re-fetched to mint a fresh loopback GUI session (server injects meta tags).
+ * Deliberately NOT "/": the Vite dev server owns that route for the app shell, so the dev
+ * proxy forwards this dedicated extensionless path to the backend with the original host.
+ */
+const SESSION_REBOOTSTRAP_PATH = "/opencodex-session";
 /** Safe authenticated read used to validate a raw admin token before closing the sign-in form. */
 const ADMIN_TOKEN_VALIDATION_PATH = "/api/settings";
 
diff --git a/gui/src/components/CodexAccountPool.tsx b/gui/src/components/CodexAccountPool.tsx
index dcbd8d91d..f6b038676 100644
--- a/gui/src/components/CodexAccountPool.tsx
+++ b/gui/src/components/CodexAccountPool.tsx
@@ -250,6 +250,9 @@ export default function CodexAccountPool({ apiBase, accountModeState = null, ban
   const switchActionLabel = t(accountModeState === "direct" ? "codexAuth.prepareForPool" : "codexAuth.setAsNext");
   const pauseBusy = pauseUpdatingId !== null || pausingExhausted;
   const autoSwitchThreshold = autoSwitch.threshold ?? 0;
+  // The standalone Codex Auth page keeps the doctor-copy affordance; the embedded
+  // Providers workspace account surface does not.
+  const showDoctorCopy = !embedded;
 
   return (
     <div>
@@ -290,8 +293,8 @@ export default function CodexAccountPool({ apiBase, accountModeState = null, ban
             pauseUpdatingId={pauseUpdatingId}
             pauseBusy={pauseBusy}
             onOpenReset={openResetPopup}
-            onCopyDoctor={copyDoctor}
-            doctorCopyOutcomeFor={doctorCopy.outcomeFor}
+            onCopyDoctor={showDoctorCopy ? copyDoctor : undefined}
+            doctorCopyOutcomeFor={showDoctorCopy ? doctorCopy.outcomeFor : undefined}
           />
 
           <div className="section-sep">
@@ -322,8 +325,8 @@ export default function CodexAccountPool({ apiBase, accountModeState = null, ban
             onReauth={openReauth}
             onEditAlias={editAlias}
             onRemove={remove}
-            onCopyDoctor={copyDoctor}
-            doctorCopyOutcomeFor={doctorCopy.outcomeFor}
+            onCopyDoctor={showDoctorCopy ? copyDoctor : undefined}
+            doctorCopyOutcomeFor={showDoctorCopy ? doctorCopy.outcomeFor : undefined}
           />
         </>
       )}
diff --git a/gui/src/components/combo-workspace-add-modal.tsx b/gui/src/components/combo-workspace-add-modal.tsx
index aa8f7fb6a..cff828c5c 100644
--- a/gui/src/components/combo-workspace-add-modal.tsx
+++ b/gui/src/components/combo-workspace-add-modal.tsx
@@ -102,7 +102,7 @@ export function AddComboModal({
             <IconX width={16} height={16} />
           </button>
         </div>
-        <p className="muted" style={{ marginTop: 0 }}>{t("cws.addSubtitle")}</p>
+        <p className="muted" style={{ marginTop: 0, maxWidth: "62ch", overflowWrap: "anywhere" }}>{t("cws.addSubtitle")}</p>
         {error && <Notice tone="err">{error}</Notice>}
         <div className="cwi-modal-form">
           <div className="cwi-field">
@@ -118,7 +118,7 @@ export function AddComboModal({
                 model: comboPublicModelId(e.target.value, d.alias),
               }))}
             />
-            <p className="muted" style={{ fontSize: 12, margin: "4px 0 0" }}>
+            <p className="muted" style={{ fontSize: 12, margin: "8px 0 0" }}>
               {t("cws.field.idInternalHint")}
             </p>
           </div>
@@ -136,10 +136,10 @@ export function AddComboModal({
                 model: comboPublicModelId(d.id, e.target.value),
               }))}
             />
-            <p className="muted" style={{ fontSize: 12, margin: "4px 0 0" }}>
+            <p className="muted" style={{ fontSize: 12, margin: "8px 0 0" }}>
               {t("cws.field.aliasHint")}
             </p>
-            <p className="muted" style={{ fontSize: 12, margin: "4px 0 0" }}>
+            <p className="muted" style={{ fontSize: 12, margin: "8px 0 0" }}>
               {t("cws.field.idHint", {
                 model: draft.id.trim() ? comboPublicModelId(draft.id, draft.alias) : "…",
               })}
@@ -152,7 +152,7 @@ export function AddComboModal({
               disabled={busy}
               onChange={(strategy) => setDraft((d) => ({ ...d, strategy }))}
             />
-            <p className="muted" style={{ fontSize: 12, margin: "6px 0 0" }}>
+            <p className="muted" style={{ fontSize: 12, margin: "8px 0 0" }}>
               {draft.strategy === "failover" ? t("cws.strategy.failoverHint") : t("cws.strategy.roundRobinHint")}
             </p>
           </div>
@@ -165,7 +165,7 @@ export function AddComboModal({
               allowedEfforts={allowedEfforts}
               onChange={(defaultEffort) => setDraft((d) => ({ ...d, defaultEffort }))}
             />
-            <p className="muted" style={{ fontSize: 12, margin: "4px 0 0" }}>
+            <p className="muted" style={{ fontSize: 12, margin: "8px 0 0" }}>
               {t("cws.field.defaultEffortHint")}
             </p>
           </div>
@@ -186,16 +186,13 @@ export function AddComboModal({
                   setDraft((d) => ({ ...d, stickyLimit }));
                 }}
               />
-              <p className="muted" style={{ fontSize: 12, margin: "4px 0 0" }}>
+              <p className="muted" style={{ fontSize: 12, margin: "8px 0 0" }}>
                 {t("cws.field.stickyLimitHint")}
               </p>
             </div>
           )}
           <div className="cwi-field">
             <span className="field-label">{t("cws.targets")}</span>
-            <p className="muted" style={{ fontSize: 12, margin: "0 0 8px" }}>
-              {draft.strategy === "failover" ? t("cws.targets.failoverHint") : t("cws.targets.roundRobinHint")}
-            </p>
             <TargetEditor
               targets={draft.targets}
               strategy={draft.strategy}
@@ -203,6 +200,9 @@ export function AddComboModal({
               models={models}
               onChange={(targets) => setDraft((d) => ({ ...d, targets }))}
             />
+            <p className="muted" style={{ fontSize: 12, margin: "8px 0 0" }}>
+              {draft.strategy === "failover" ? t("cws.targets.failoverHint") : t("cws.targets.roundRobinHint")}
+            </p>
           </div>
         </div>
         <div className="cwi-modal-actions">
diff --git a/gui/src/components/combo-workspace-detail-panel.tsx b/gui/src/components/combo-workspace-detail-panel.tsx
index 71d36f0af..caaa05bed 100644
--- a/gui/src/components/combo-workspace-detail-panel.tsx
+++ b/gui/src/components/combo-workspace-detail-panel.tsx
@@ -187,7 +187,7 @@ export function DetailPanel({
                   model: comboPublicModelId(e.target.value, d.alias),
                 }))}
               />
-              <p className="muted" style={{ fontSize: 12, margin: "4px 0 0" }}>
+              <p className="muted" style={{ fontSize: 12, margin: "8px 0 0" }}>
                 {isCreate
                   ? t("cws.field.idInternalHint")
                   : t("cws.field.idHintEdit", { model: comboPublicModelId(draft.id, draft.alias) })}
@@ -207,7 +207,7 @@ export function DetailPanel({
                   model: comboPublicModelId(d.id, e.target.value),
                 }))}
               />
-              <p className="muted" style={{ fontSize: 12, margin: "4px 0 0" }}>
+              <p className="muted" style={{ fontSize: 12, margin: "8px 0 0" }}>
                 {t("cws.field.aliasHint")}
               </p>
             </div>
@@ -218,7 +218,7 @@ export function DetailPanel({
                 disabled={busy}
                 onChange={(strategy) => updateDraft((d) => ({ ...d, strategy }))}
               />
-              <p className="muted" style={{ fontSize: 12, margin: "6px 0 0" }}>
+              <p className="muted" style={{ fontSize: 12, margin: "8px 0 0" }}>
                 {draft.strategy === "failover" ? t("cws.strategy.failoverHint") : t("cws.strategy.roundRobinHint")}
               </p>
             </div>
@@ -231,7 +231,7 @@ export function DetailPanel({
                 allowedEfforts={allowedEfforts}
                 onChange={(defaultEffort) => updateDraft((d) => ({ ...d, defaultEffort }))}
               />
-              <p className="muted" style={{ fontSize: 12, margin: "4px 0 0" }}>
+              <p className="muted" style={{ fontSize: 12, margin: "8px 0 0" }}>
                 {t("cws.field.defaultEffortHint")}
               </p>
             </div>
@@ -256,9 +256,6 @@ export function DetailPanel({
             )}
             <div className="cwi-field">
               <span className="field-label">{t("cws.targets")}</span>
-              <p className="muted" style={{ fontSize: 12, margin: "0 0 8px" }}>
-                {draft.strategy === "failover" ? t("cws.targets.failoverHint") : t("cws.targets.roundRobinHint")}
-              </p>
               <TargetEditor
                 targets={draft.targets}
                 strategy={draft.strategy}
@@ -266,12 +263,15 @@ export function DetailPanel({
                 models={models}
                 onChange={(targets) => updateDraft((d) => ({ ...d, targets }))}
               />
+              <p className="muted" style={{ fontSize: 12, margin: "8px 0 0" }}>
+                {draft.strategy === "failover" ? t("cws.targets.failoverHint") : t("cws.targets.roundRobinHint")}
+              </p>
             </div>
           </div>
         ) : (
           <section className="pwi-section">
             <h3 className="pwi-section-title">{t("cws.aboutTitle")}</h3>
-            <p className="muted" style={{ margin: 0 }}>{t("cws.aboutBody")}</p>
+            <p className="muted" style={{ margin: 0, maxWidth: "70ch", overflowWrap: "anywhere" }}>{t("cws.aboutBody")}</p>
           </section>
         )}
       </div>
diff --git a/gui/src/components/provider-workspace/AnthropicAccountPoolSettings.tsx b/gui/src/components/provider-workspace/AnthropicAccountPoolSettings.tsx
index 243395fec..735660f2a 100644
--- a/gui/src/components/provider-workspace/AnthropicAccountPoolSettings.tsx
+++ b/gui/src/components/provider-workspace/AnthropicAccountPoolSettings.tsx
@@ -159,23 +159,24 @@ export default function AnthropicAccountPoolSettings({
                   : t("anthropicPool.disabledDesc")}
           </div>
         </div>
-        <label className="toggle" style={{ display: "inline-flex", alignItems: "center", gap: 8 }}>
-          <input
-            type="checkbox"
-            checked={enabled}
-            disabled={toggleDisabled}
-            onChange={(event) => {
-              const next = event.target.checked;
-              void save({
-                enabled: next,
-                threshold,
-                strategy,
-                stickyLimit,
-              });
-            }}
-          />
-          <span>{enabled ? t("anthropicPool.on") : t("anthropicPool.off")}</span>
-        </label>
+        <button
+          type="button"
+          className={`toggle ${enabled ? "on" : ""}`}
+          disabled={toggleDisabled}
+          aria-pressed={enabled}
+          aria-label={t("anthropicPool.title")}
+          title={enabled ? t("anthropicPool.on") : t("anthropicPool.off")}
+          onClick={() => {
+            void save({
+              enabled: !enabled,
+              threshold,
+              strategy,
+              stickyLimit,
+            });
+          }}
+        >
+          <span className="toggle-knob" />
+        </button>
       </div>
 
       <div
@@ -183,7 +184,7 @@ export default function AnthropicAccountPoolSettings({
         className="card-sub"
         style={{
           marginTop: 10,
-          padding: "8px 10px",
+          padding: "10px 16px",
           border: "1px solid var(--border, #c9a227)",
           borderRadius: 6,
           background: "color-mix(in srgb, var(--warn, #c9a227) 12%, transparent)",
diff --git a/gui/src/components/provider-workspace/ProviderAuthPanel.tsx b/gui/src/components/provider-workspace/ProviderAuthPanel.tsx
index ba7c6103b..6a19c5f0d 100644
--- a/gui/src/components/provider-workspace/ProviderAuthPanel.tsx
+++ b/gui/src/components/provider-workspace/ProviderAuthPanel.tsx
@@ -10,12 +10,10 @@ import type { WorkspaceItem } from "../../provider-workspace/catalog";
 import { oauthAccountDisplayLabel, providerAuthSurface } from "../../provider-workspace/auth";
 import { displayAccountId } from "../../lib/privacy";
 import {
-  doctorCopyButtonLabel,
   formatOAuthHealthLabel,
   formatOAuthHealthSummary,
   oauthHealthBadgeClass,
   oauthHealthIsCooldown,
-  oauthHealthShowsDoctor,
   oauthHealthShowsReauth,
 } from "../../oauth-health-display";
 import CodexAccountPool from "../CodexAccountPool";
@@ -26,7 +24,6 @@ import { useCopyFeedback } from "../use-copy-feedback";
 import type { CodexAccountPoolController } from "../../hooks/useCodexAccountPool";
 import type { AccountLoadState, OAuthAccountRow, ApiKeyRow, LoginHint, ProviderAuthHandlers } from "./types";
 
-const DOCTOR_CMD = "ocx doctor";
 const QUOTA_ENRICH_RESERVE_MS = 4_000;
 const EMPTY_OAUTH_ACCOUNTS: OAuthAccountRow[] = [];
 const EMPTY_API_KEYS: ApiKeyRow[] = [];
@@ -56,7 +53,6 @@ export default function ProviderAuthPanel({
   const [keyBusy, setKeyBusy] = useState(false);
   const [reserveQuotaSlots, setReserveQuotaSlots] = useState(false);
   const deviceCodeCopy = useCopyFeedback<string>();
-  const doctorCopy = useCopyFeedback<string>();
 
   // Soft &quota=1 enrichment lands after the local account list. Reserve stacked
   // bar height briefly so bars don't shove rows when WHAM returns.
@@ -206,12 +202,10 @@ export default function ProviderAuthPanel({
                   const switching = switchingAccountId === account.id;
                   const healthStatus = account.health?.status;
                   const showReauth = Boolean(account.needsReauth) || oauthHealthShowsReauth(healthStatus);
-                  const showDoctor = oauthHealthShowsDoctor(healthStatus);
                   const inCooldown = oauthHealthIsCooldown(healthStatus);
                   const maskedId = displayAccountId(account.id);
                   const healthLabel = formatOAuthHealthLabel(t, account.health);
                   const healthSummary = formatOAuthHealthSummary(t, item.name, account.id, account.health);
-                  const copyDoctor = () => { doctorCopy.copy(DOCTOR_CMD, account.id); };
                   return (
                   <li key={account.id} className={`pwi-auth-acct${account.active ? " pwi-auth-acct--active" : ""}`}>
                     <div className={`pwi-auth-row${account.active ? " pwi-auth-row--active" : ""}`}>
@@ -248,11 +242,6 @@ export default function ProviderAuthPanel({
                         {t("pws.reauthenticate")}
                       </button>
                     )}
-                    {showDoctor && (
-                      <button type="button" className="btn btn-ghost btn-sm codex-auth-action-btn" onClick={copyDoctor}>
-                        <span aria-live="polite">{doctorCopyButtonLabel(t, doctorCopy.outcomeFor(account.id))}</span>
-                      </button>
-                    )}
                     <button type="button" className="btn btn-ghost btn-sm"
                       onClick={() => void authHandlers.onEditAlias(item.name, "oauth", account.id, account.alias)}>
                       {t("prov.editAlias")}
diff --git a/gui/src/components/provider-workspace/ProviderCapacityQuota.tsx b/gui/src/components/provider-workspace/ProviderCapacityQuota.tsx
new file mode 100644
index 000000000..8eedc5676
--- /dev/null
+++ b/gui/src/components/provider-workspace/ProviderCapacityQuota.tsx
@@ -0,0 +1,95 @@
+/**
+ * ProviderCapacityQuota — per-provider quota bars plus the aggregation context the
+ * quota API attaches for pooled Codex providers (estimate, excluded accounts, recovery
+ * rows, current-account breakdown). Shared by the aggregate dashboard and the
+ * single-provider Overview so both surfaces present the same capacity semantics.
+ */
+import { useT, useI18n } from "../../i18n/shared";
+import {
+  accountQuotaFromReport,
+  capacityAggregationFromReport,
+  type CapacityWindowView,
+  type ProviderQuotaReportView,
+} from "../../provider-workspace/report";
+import { type QuotaWindowKey } from "../QuotaBars";
+import QuotaBars from "../QuotaBars";
+
+export function ProviderCapacityQuota({ report, pending }: { report: ProviderQuotaReportView; pending: boolean }) {
+  const t = useT();
+  const { locale } = useI18n();
+  const aggregation = capacityAggregationFromReport(report);
+  const primaryQuota = accountQuotaFromReport(report);
+  const showsAggregate = aggregation?.presentation === "aggregate";
+  const incompleteWindowKeys = new Set<QuotaWindowKey>();
+  const incompleteCustomWindowLabels = new Set<string>();
+  if (showsAggregate && aggregation) {
+    if (aggregation.fiveHour?.incomplete) incompleteWindowKeys.add("fiveHour");
+    if (aggregation.weekly?.incomplete) incompleteWindowKeys.add("weekly");
+    if (aggregation.monthly?.incomplete) incompleteWindowKeys.add("monthly");
+    for (const window of aggregation.customWindows ?? []) {
+      if (window.incomplete) incompleteCustomWindowLabels.add(window.label);
+    }
+  }
+  const recoveryRows: Array<{ key: number; label: string; window: CapacityWindowView }> = showsAggregate && aggregation ? [
+    ...(aggregation.fiveHour ? [{ key: 0, label: t("codexAuth.fiveHour"), window: aggregation.fiveHour }] : []),
+    ...(aggregation.weekly ? [{ key: 1, label: t("codexAuth.weekly"), window: aggregation.weekly }] : []),
+    ...(aggregation.monthly ? [{ key: 2, label: t("codexAuth.monthly"), window: aggregation.monthly }] : []),
+    ...(aggregation.customWindows ?? []).map((window, index) => ({ key: index + 3, label: window.label, window })),
+  ] : [];
+  const formatPercent = (value: number) => new Intl.NumberFormat(locale, { maximumFractionDigits: 1 }).format(value);
+  const formatRecoveryAt = (value: number) => new Intl.DateTimeFormat(locale, {
+    dateStyle: "medium",
+    timeStyle: "short",
+  }).format(new Date(value > 10_000_000_000 ? value : value * 1000));
+
+  return (
+    <>
+      {showsAggregate && <div className="pws-capacity-label">{t("pws.capacity.estimate")}</div>}
+      {(primaryQuota || pending) && (
+        <QuotaBars
+          quota={primaryQuota}
+          threshold={80}
+          t={t}
+          layout="stacked"
+          pending={pending}
+          incompleteWindowKeys={showsAggregate ? incompleteWindowKeys : undefined}
+          incompleteCustomWindowLabels={showsAggregate ? incompleteCustomWindowLabels : undefined}
+        />
+      )}
+      {aggregation && (
+        <div className="pws-capacity-details">
+          {recoveryRows.flatMap(({ key, label, window }) => (
+            window.nextRecoveryAt !== undefined && window.nextRecoveryPercent !== undefined
+              ? [<div className="pws-capacity-recovery" key={key}>
+                  <span>{t("pws.capacity.nextRecovery")} · {label} · {formatRecoveryAt(window.nextRecoveryAt)}</span>
+                  <strong>{t("pws.capacity.recoveryShare", { percent: formatPercent(window.nextRecoveryPercent) })}</strong>
+                </div>]
+              : []
+          ))}
+          {showsAggregate && aggregation.currentAccount?.quota && (
+            <div className="pws-capacity-current">
+              <span className="pws-capacity-label">
+                {t("pws.capacity.currentAccount")}
+                {aggregation.currentAccount.plan ? ` · ${aggregation.currentAccount.plan}` : ""}
+              </span>
+              <QuotaBars quota={aggregation.currentAccount.quota} threshold={80} t={t} layout="stacked" />
+            </div>
+          )}
+          {aggregation.incomplete && aggregation.excludedAccounts > 0 && (
+            <div className="pws-capacity-incomplete">
+              {t("pws.capacity.incomplete", {
+                excluded: aggregation.excludedAccounts,
+                unknown: aggregation.unknownPlanAccounts,
+              })}
+            </div>
+          )}
+          {aggregation.partialWindowAccounts > 0 && (
+            <div className="pws-capacity-incomplete">
+              {t("pws.capacity.partial", { count: aggregation.partialWindowAccounts })}
+            </div>
+          )}
+        </div>
+      )}
+    </>
+  );
+}
diff --git a/gui/src/components/provider-workspace/ProviderDetails.tsx b/gui/src/components/provider-workspace/ProviderDetails.tsx
index 89bcd9404..155a762ef 100644
--- a/gui/src/components/provider-workspace/ProviderDetails.tsx
+++ b/gui/src/components/provider-workspace/ProviderDetails.tsx
@@ -221,28 +221,13 @@ export default function ProviderDetails({
       >
         {tab === "overview" && (
           <ProviderOverview
-            accountPanel={authSurface ? (
-              <ProviderAuthPanel
-                item={item}
-                apiBase={apiBase}
-                oauth={oauth}
-                accounts={accounts}
-                keys={keys}
-                accountLoadState={accountLoadState}
-                switchingAccountId={switchingAccountId}
-                busy={busyProvider === item.name}
-                loginHint={loginHint}
-                authHandlers={authHandlers}
-                onCodexActiveNeedsReauthChange={onCodexActiveNeedsReauthChange}
-                codexController={codexController}
-              />
-            ) : undefined}
             item={item}
             apiBase={apiBase}
             connectionIdentity={connectionIdentity}
             usageTotals={usageTotals}
             quotaReport={quotaReport}
             oauthEmail={oauthEmail}
+            oauth={oauth}
             onEditSettings={() => switchTab("settings")}
             onViewUsage={() => switchTab("usage")}
             onUpdateProvider={onUpdateProvider}
diff --git a/gui/src/components/provider-workspace/ProviderOverview.tsx b/gui/src/components/provider-workspace/ProviderOverview.tsx
index 5e6d998c9..07019246f 100644
--- a/gui/src/components/provider-workspace/ProviderOverview.tsx
+++ b/gui/src/components/provider-workspace/ProviderOverview.tsx
@@ -2,7 +2,7 @@
  * ProviderOverview — 2-column layout: left (CONNECTION + Auth summary) / right
  * (STATS + Notes). Phase 030 of workspace design parity.
  */
-import { useCallback, useEffect, useRef, useState, type ReactNode } from "react";
+import { useCallback, useEffect, useRef, useState } from "react";
 import { readJsonOrThrow } from "../../fetch-json";
 import { useT, useI18n } from "../../i18n/shared";
 import { IconAlert, IconCheck } from "../../icons";
@@ -12,6 +12,7 @@ import { accountQuotaFromReport, formatQuotaSourceLabel, type ProviderQuotaRepor
 import type { ProviderUsageTotals } from "./types";
 import { authModeLabel } from "./ProviderRail";
 import type { ProviderUpdatePatch } from "./types";
+import { ProviderCapacityQuota } from "./ProviderCapacityQuota";
 
 type ConnectionTestResult = {
   applicable?: boolean;
@@ -29,16 +30,17 @@ type ConnectionTestState = {
 };
 
 export default function ProviderOverview({
-  item, usageTotals, quotaReport, oauthEmail,
+  item, usageTotals, quotaReport, oauthEmail, oauth,
   apiBase, connectionIdentity,
   onEditSettings, onViewUsage, onUpdateProvider,
   onReauthenticate, onCancelLogin, reauthBusy = false,
-  accountPanel,
 }: {
   item: WorkspaceItem;
   usageTotals?: ProviderUsageTotals;
   quotaReport?: ProviderQuotaReportView;
   oauthEmail?: string;
+  /** Login state for OAuth summaries that carry no email (e.g. Cursor/Kimi). */
+  oauth?: { loggedIn?: boolean };
   apiBase?: string;
   /** Opaque active credential identity used only to invalidate stale probe results. */
   connectionIdentity?: string;
@@ -48,12 +50,6 @@ export default function ProviderOverview({
   onReauthenticate?: () => void;
   onCancelLogin?: () => void;
   reauthBusy?: boolean;
-  /**
-   * WP3: the same account rows the Accounts tab renders, backed by the same shared
-   * state. Overview is the main surface, so the operations live here too; the
-   * duplication is intentional (D2) and cannot desync because both read one controller.
-   */
-  accountPanel?: ReactNode;
 }) {
   const t = useT();
   const { locale } = useI18n();
@@ -205,58 +201,62 @@ export default function ProviderOverview({
         )}
       </section>
 
-      {accountPanel ? (
-        <section className="pws-section" aria-label={t("pws.availableAccounts")}>
-          {accountPanel}
+      {quotaReport && (
+        <section className="pws-section" aria-label={t("pws.rateLimits")}>
+          <h3 className="pws-section-title">{t("pws.rateLimits")}</h3>
+          <ProviderCapacityQuota report={quotaReport} pending={false} />
         </section>
-      ) : (
-        <section className="pws-section" aria-label={t("pws.authSummary")}>
-          <h3 className="pws-section-title">{t("pws.authSummary")}</h3>
-          {needsAttention ? (
-            <div className="pws-auth-summary pws-auth-summary--warn" role="status">
-              <IconAlert style={{ width: 14, height: 14 }} aria-hidden="true" />
-              <div className="pws-auth-summary-body">
-                <span>
-                  <strong>{t("pws.status.needsAttention")}</strong>
-                  {" — "}
-                  {item.authMode === "forward"
-                    ? t("pws.attention.reauthForward")
-                    : t("pws.attention.reauth")}
-                </span>
-                {onReauthenticate && (
-                  <button
-                    type="button"
-                    className="btn btn-primary btn-sm"
-                    disabled={reauthBusy}
-                    onClick={() => onReauthenticate()}
-                  >
-                    {reauthBusy ? t("prov.waitingBrowser") : t("pws.reauthenticate")}
-                  </button>
-                )}
-                {reauthBusy && onCancelLogin && (
-                  <button type="button" className="btn btn-ghost btn-sm" onClick={() => onCancelLogin()}>
-                    {t("common.cancel")}
-                  </button>
-                )}
-              </div>
-            </div>
-          ) : (
-            <div className="pws-auth-summary">
-              <span className="pws-auth-dot" />
+      )}
+
+      <section className="pws-section" aria-label={t("pws.authSummary")}>
+        <h3 className="pws-section-title">{t("pws.authSummary")}</h3>
+        {needsAttention ? (
+          <div className="pws-auth-summary pws-auth-summary--warn" role="status">
+            <IconAlert style={{ width: 14, height: 14 }} aria-hidden="true" />
+            <div className="pws-auth-summary-body">
               <span>
+                <strong>{t("pws.status.needsAttention")}</strong>
+                {" — "}
                 {item.authMode === "forward"
-                  ? t("pws.passthrough")
-                  : item.authMode === "oauth"
-                    ? (oauthEmail ? t("pws.loggedInAs", { email: oauthEmail }) : t("pws.notLoggedIn"))
-                    : item.hasApiKey
-                      ? t("pws.apiKeyConfigured")
-                      : authModeLabel(item, t)}
+                  ? t("pws.attention.reauthForward")
+                  : t("pws.attention.reauth")}
               </span>
+              {onReauthenticate && (
+                <button
+                  type="button"
+                  className="btn btn-primary btn-sm"
+                  disabled={reauthBusy}
+                  onClick={() => onReauthenticate()}
+                >
+                  {reauthBusy ? t("prov.waitingBrowser") : t("pws.reauthenticate")}
+                </button>
+              )}
+              {reauthBusy && onCancelLogin && (
+                <button type="button" className="btn btn-ghost btn-sm" onClick={() => onCancelLogin()}>
+                  {t("common.cancel")}
+                </button>
+              )}
             </div>
-          )}
-
-        </section>
-      )}
+          </div>
+        ) : (
+          <div className="pws-auth-summary">
+            <span className="pws-auth-dot" />
+            <span>
+              {item.authMode === "forward"
+                ? t("pws.passthrough")
+                : item.authMode === "oauth"
+                  ? (oauthEmail
+                    ? t("pws.loggedInAs", { email: oauthEmail })
+                    : oauth?.loggedIn
+                      ? t("pws.loggedInTitle")
+                      : t("pws.notLoggedIn"))
+                  : item.hasApiKey
+                    ? t("pws.apiKeyConfigured")
+                    : authModeLabel(item, t)}
+            </span>
+          </div>
+        )}
+      </section>
       </div>
 
       <aside className="pws-overview-sidebar">
diff --git a/gui/src/components/provider-workspace/ProviderOverviewDashboard.tsx b/gui/src/components/provider-workspace/ProviderOverviewDashboard.tsx
index b2741a851..410bb919a 100644
--- a/gui/src/components/provider-workspace/ProviderOverviewDashboard.tsx
+++ b/gui/src/components/provider-workspace/ProviderOverviewDashboard.tsx
@@ -10,7 +10,6 @@ import type { WorkspaceSections, WorkspaceItem } from "../../provider-workspace/
 import {
   accountQuotaFromReport,
   capacityAggregationFromReport,
-  type CapacityWindowView,
   type ProviderQuotaReportView,
 } from "../../provider-workspace/report";
 import {
@@ -22,10 +21,11 @@ import {
   relativeTimeLabelsFromT,
   type ProviderUsageTotals,
 } from "../../provider-workspace/usage";
-import { maxQuotaUtilisation, type QuotaWindowKey } from "../QuotaBars";
+import { maxQuotaUtilisation } from "../QuotaBars";
 import { ProviderIcon } from "./ProviderRail";
 import { formatProviderDisplayName } from "../../provider-icons";
 import QuotaBars from "../QuotaBars";
+import { ProviderCapacityQuota } from "./ProviderCapacityQuota";
 
 export default function ProviderOverviewDashboard({
   sections,
@@ -236,86 +236,6 @@ export default function ProviderOverviewDashboard({
   );
 }
 
-function ProviderCapacityQuota({ report, pending }: { report: ProviderQuotaReportView; pending: boolean }) {
-  const t = useT();
-  const { locale } = useI18n();
-  const aggregation = capacityAggregationFromReport(report);
-  const primaryQuota = accountQuotaFromReport(report);
-  const showsAggregate = aggregation?.presentation === "aggregate";
-  const incompleteWindowKeys = new Set<QuotaWindowKey>();
-  const incompleteCustomWindowLabels = new Set<string>();
-  if (showsAggregate && aggregation) {
-    if (aggregation.fiveHour?.incomplete) incompleteWindowKeys.add("fiveHour");
-    if (aggregation.weekly?.incomplete) incompleteWindowKeys.add("weekly");
-    if (aggregation.monthly?.incomplete) incompleteWindowKeys.add("monthly");
-    for (const window of aggregation.customWindows ?? []) {
-      if (window.incomplete) incompleteCustomWindowLabels.add(window.label);
-    }
-  }
-  const recoveryRows: Array<{ key: number; label: string; window: CapacityWindowView }> = showsAggregate && aggregation ? [
-    ...(aggregation.fiveHour ? [{ key: 0, label: t("codexAuth.fiveHour"), window: aggregation.fiveHour }] : []),
-    ...(aggregation.weekly ? [{ key: 1, label: t("codexAuth.weekly"), window: aggregation.weekly }] : []),
-    ...(aggregation.monthly ? [{ key: 2, label: t("codexAuth.monthly"), window: aggregation.monthly }] : []),
-    ...(aggregation.customWindows ?? []).map((window, index) => ({ key: index + 3, label: window.label, window })),
-  ] : [];
-  const formatPercent = (value: number) => new Intl.NumberFormat(locale, { maximumFractionDigits: 1 }).format(value);
-  const formatRecoveryAt = (value: number) => new Intl.DateTimeFormat(locale, {
-    dateStyle: "medium",
-    timeStyle: "short",
-  }).format(new Date(value > 10_000_000_000 ? value : value * 1000));
-
-  return (
-    <>
-      {showsAggregate && <div className="pws-capacity-label">{t("pws.capacity.estimate")}</div>}
-      {(primaryQuota || pending) && (
-        <QuotaBars
-          quota={primaryQuota}
-          threshold={80}
-          t={t}
-          layout="stacked"
-          pending={pending}
-          incompleteWindowKeys={showsAggregate ? incompleteWindowKeys : undefined}
-          incompleteCustomWindowLabels={showsAggregate ? incompleteCustomWindowLabels : undefined}
-        />
-      )}
-      {aggregation && (
-        <div className="pws-capacity-details">
-          {recoveryRows.flatMap(({ key, label, window }) => (
-            window.nextRecoveryAt !== undefined && window.nextRecoveryPercent !== undefined
-              ? [<div className="pws-capacity-recovery" key={key}>
-                  <span>{t("pws.capacity.nextRecovery")} · {label} · {formatRecoveryAt(window.nextRecoveryAt)}</span>
-                  <strong>{t("pws.capacity.recoveryShare", { percent: formatPercent(window.nextRecoveryPercent) })}</strong>
-                </div>]
-              : []
-          ))}
-          {showsAggregate && aggregation.currentAccount?.quota && (
-            <div className="pws-capacity-current">
-              <span className="pws-capacity-label">
-                {t("pws.capacity.currentAccount")}
-                {aggregation.currentAccount.plan ? ` · ${aggregation.currentAccount.plan}` : ""}
-              </span>
-              <QuotaBars quota={aggregation.currentAccount.quota} threshold={80} t={t} layout="stacked" />
-            </div>
-          )}
-          {aggregation.incomplete && aggregation.excludedAccounts > 0 && (
-            <div className="pws-capacity-incomplete">
-              {t("pws.capacity.incomplete", {
-                excluded: aggregation.excludedAccounts,
-                unknown: aggregation.unknownPlanAccounts,
-              })}
-            </div>
-          )}
-          {aggregation.partialWindowAccounts > 0 && (
-            <div className="pws-capacity-incomplete">
-              {t("pws.capacity.partial", { count: aggregation.partialWindowAccounts })}
-            </div>
-          )}
-        </div>
-      )}
-    </>
-  );
-}
-
 function SummaryCard({ count, label, tone }: { count: number; label: string; tone: "ok" | "warn" | "muted" }) {
   return (
     <div className={`pws-dashboard-card pws-dashboard-card--${tone}`}>
diff --git a/gui/src/pages/Combos.tsx b/gui/src/pages/Combos.tsx
index 0b84e33cc..64f671d76 100644
--- a/gui/src/pages/Combos.tsx
+++ b/gui/src/pages/Combos.tsx
@@ -1,4 +1,4 @@
-import { useCallback, useEffect, useState } from "react";
+import { useCallback, useEffect, useMemo, useState } from "react";
 import ComboWorkspace from "../components/ComboWorkspace";
 import {
   type ComboItem,
@@ -11,7 +11,7 @@ import { readSessionListCache, writeSessionListCache } from "../session-list-cac
 import { Notice } from "../ui";
 import { useT } from "../i18n/shared";
 import { useDataSurface } from "../data-surface";
-import { DataSurfaceSkeleton, DataSurfaceStatus } from "../components/data-surface";
+import { DataSurfaceSkeleton } from "../components/data-surface";
 
 type ProviderOption = {
   name: string;
@@ -55,7 +55,7 @@ function seedCombos(cacheKey: string): CachedCombosPage | null {
 export default function Combos({ apiBase }: { apiBase: string }) {
   const t = useT();
   const cacheKey = `ocx.combos.workspace.v1:${apiBase}`;
-  const cached = seedCombos(cacheKey);
+  const cached = useMemo(() => seedCombos(cacheKey), [cacheKey]);
   const [status, setStatus] = useState("");
   const [statusOk, setStatusOk] = useState(false);
   const [adding, setAdding] = useState(false);
@@ -158,10 +158,10 @@ export default function Combos({ apiBase }: { apiBase: string }) {
     cacheKey,
     [apiBase],
     loadCombos,
-    { isEmpty: () => false },
+    { isEmpty: () => false, initialData: cached ?? undefined },
   );
   const { state } = resource;
-  const data = state.data ?? cached;
+  const data = state.data;
   const combos = data?.combos ?? [];
   const providers = data?.providers ?? [];
   const models = data?.models ?? [];
@@ -247,8 +247,12 @@ export default function Combos({ apiBase }: { apiBase: string }) {
           <Notice tone="err">{t("cws.loadFailed")}</Notice>
         </div>
       )}
-      {state.refreshing && <DataSurfaceStatus live={!state.showError}>{t("cws.loading")}</DataSurfaceStatus>}
-      <div className="combos-workspace-shell-body">
+      {/* Revalidation is silent by design: existing combos stay visible, and the
+          shell announces the in-flight refresh to assistive tech only. */}
+      <div className="combos-workspace-shell-body" aria-busy={state.refreshing}>
+        <span className="sr-only" role="status" aria-live="polite" aria-atomic="true">
+          {state.refreshing ? t("common.loading") : ""}
+        </span>
         <ComboWorkspace
           combos={combos}
           providers={providers}
diff --git a/gui/src/pages/Models.tsx b/gui/src/pages/Models.tsx
index a9e6cdadb..e6ddb3726 100644
--- a/gui/src/pages/Models.tsx
+++ b/gui/src/pages/Models.tsx
@@ -87,6 +87,7 @@ export default function Models({ apiBase }: { apiBase: string }) {
   const loadPendingRef = useRef(false);
   // multi_agent_v2 / ultra gate. null = endpoint unavailable (older proxy build) -> section hidden.
   const [v2, setV2] = useState<V2Status | null>(null);
+  const [v2Loading, setV2Loading] = useState(true);
   const [v2Busy, setV2Busy] = useState(false);
   const [v2Note, setV2Note] = useState("");
   const v2BusyRef = useRef(false);
@@ -178,6 +179,8 @@ export default function Models({ apiBase }: { apiBase: string }) {
       });
     } catch {
       setV2(null); // old server / network: hide the section instead of guessing
+    } finally {
+      setV2Loading(false);
     }
   }, [apiBase]);
 
@@ -898,7 +901,7 @@ export default function Models({ apiBase }: { apiBase: string }) {
           </div>
         </div>
 
-        {v2 && (
+        {(v2Loading || v2) && (
           <div className="models-v2-mode-row row">
             <span className="muted text-control">{t("models.v2Label")}</span>
             <div className="segmented models-segmented" role="radiogroup" aria-label={t("models.v2Label")}>
@@ -907,10 +910,10 @@ export default function Models({ apiBase }: { apiBase: string }) {
                   key={mode}
                   type="button"
                   role="radio"
-                  aria-checked={(v2.multiAgentMode ?? "default") === mode}
-                  className={`btn btn-sm${(v2.multiAgentMode ?? "default") === mode ? " btn-primary" : " btn-ghost"}`}
-                  style={{ background: (v2.multiAgentMode ?? "default") === mode ? undefined : "transparent", color: (v2.multiAgentMode ?? "default") === mode ? undefined : "var(--muted)" }}
-                  disabled={v2Busy}
+                  aria-checked={(v2?.multiAgentMode ?? "default") === mode}
+                  className={`btn btn-sm${(v2?.multiAgentMode ?? "default") === mode ? " btn-primary" : " btn-ghost"}`}
+                  style={{ background: (v2?.multiAgentMode ?? "default") === mode ? undefined : "transparent", color: (v2?.multiAgentMode ?? "default") === mode ? undefined : "var(--muted)" }}
+                  disabled={!v2 || v2Busy}
                   onClick={() => void setMultiAgentMode(mode)}
                 >
                   {t(`models.v2Mode_${mode}` as TKey)}
@@ -921,6 +924,7 @@ export default function Models({ apiBase }: { apiBase: string }) {
               type="button"
               className="btn btn-ghost btn-sm"
               style={{ width: 24, height: 24, minWidth: 24, flex: "0 0 24px", padding: 0, borderRadius: "var(--radius-pill)", color: "var(--muted)" }}
+              disabled={!v2}
               onClick={() => setV2HelpOpen(true)}
               aria-label={t("models.v2Label")}
               aria-haspopup="dialog"
@@ -1037,19 +1041,13 @@ export default function Models({ apiBase }: { apiBase: string }) {
 
   const combosBlock = (
     <>
-      {/* Pending strut matches the empty-card chrome so a late /api/combos cannot insert a row. */}
+      {/* Silent height strut: reserves the empty-card slot so a late /api/combos
+          cannot insert a row, without a bordered "Combos · Loading…" placeholder. */}
       {combos === null && !combosError && (
-        <div className="card models-combos-card" aria-busy="true">
-          <div className="row models-combos-empty-head">
-            <div className="row models-field-row" style={{ minWidth: 0 }}>
-              <IconShuffle width={14} height={14} aria-hidden="true" style={{ flexShrink: 0 }} />
-              <strong>{t("nav.combos")}</strong>
-              <span className="muted text-label">{t("common.loading")}</span>
-            </div>
-            <a className="btn btn-sm" href="#combos" style={{ flexShrink: 0, visibility: "hidden" }} tabIndex={-1} aria-hidden="true">
-              {t("models.combosSetup")}
-            </a>
-          </div>
+        <div className="models-combos-card models-combos-card--pending" aria-busy="true">
+          <span className="sr-only" role="status" aria-live="polite" aria-atomic="true">
+            {t("common.loading")}
+          </span>
         </div>
       )}
       {combos === null && combosError && (
diff --git a/gui/src/styles-combos-workspace.css b/gui/src/styles-combos-workspace.css
index acbd804b5..f73aa3b8a 100644
--- a/gui/src/styles-combos-workspace.css
+++ b/gui/src/styles-combos-workspace.css
@@ -29,6 +29,8 @@
   padding: 10px 16px 0;
 }
 
+/* Revalidation shell: keeps the workspace body stable while aria-busy and an
+   sr-only status span announce in-flight refreshes to assistive tech. */
 .combos-workspace-shell-body {
   flex: 1 1 auto;
   min-height: 0;
@@ -60,14 +62,14 @@
 }
 
 .combos-workspace-rail-title {
-  font-size: 18px;
+  font-size: var(--text-title);
   font-weight: 600;
   color: var(--text);
 }
 
 .combos-workspace-rail-count {
   font-family: var(--mono);
-  font-size: 11px;
+  font-size: var(--text-caption);
   color: var(--faint);
 }
 
@@ -88,7 +90,7 @@
   gap: 7px;
   padding: 8px 16px 6px;
   color: var(--muted);
-  font-size: 11.5px;
+  font-size: var(--text-caption);
   font-weight: 600;
 }
 
@@ -104,7 +106,7 @@
   background: none;
   cursor: pointer;
   font: inherit;
-  font-size: 13px;
+  font-size: var(--text-control);
   color: var(--text);
   text-align: left;
   width: 100%;
@@ -141,12 +143,12 @@
   text-overflow: ellipsis;
   white-space: nowrap;
   font-family: var(--mono);
-  font-size: 12.5px;
+  font-size: var(--text-label);
 }
 
 .combos-workspace-rail-meta {
   font-family: var(--mono);
-  font-size: 11px;
+  font-size: var(--text-caption);
   color: var(--faint);
   text-align: right;
 }
@@ -200,7 +202,7 @@
 }
 
 .combos-workspace-detail-title {
-  font-size: 18px;
+  font-size: var(--text-title);
   font-weight: 600;
   font-family: var(--mono);
   margin: 0;
@@ -227,7 +229,7 @@
   border: none;
   background: none;
   font: inherit;
-  font-size: 13px;
+  font-size: var(--text-control);
   font-weight: 500;
   color: var(--muted);
   padding: 8px 12px;
@@ -302,14 +304,20 @@
 
 .cwi-count-pill strong {
   font-family: var(--mono);
-  font-size: 16px;
+  font-size: var(--text-subtitle);
 }
 
 .cwi-count-pill span {
-  font-size: 12px;
+  font-size: var(--text-label);
   color: var(--muted);
 }
 
+/* Keep helper copy on the shared prose measure (line-length bar). */
+.cwi-field > p.muted {
+  max-width: var(--prose-measure);
+  overflow-wrap: anywhere;
+}
+
 .cwi-target-list {
   display: flex;
   flex-direction: column;
@@ -401,7 +409,7 @@
 
 .cwi-copy-chip {
   font-family: var(--mono);
-  font-size: 12px;
+  font-size: var(--text-label);
   cursor: pointer;
 }
 
@@ -413,7 +421,7 @@
 
 .cwi-field label {
   display: block;
-  font-size: 12px;
+  font-size: var(--text-label);
   font-weight: 600;
   color: var(--muted);
   margin-bottom: 4px;
@@ -492,15 +500,15 @@
 .pwi-dot { flex-shrink: 0; width: 7px; height: 7px; border-radius: 50%; display: inline-block; background: var(--muted); }
 .pwi-back-overview { flex: 0 0 auto; gap: 4px; margin-right: 2px; white-space: nowrap; }
 .pwi-section { background: none; border: none; border-radius: 0; min-width: 0; padding: 0; }
-.pwi-section-title { margin: 0 0 4px; font-size: 12px; font-weight: 650; color: var(--muted); text-transform: uppercase; letter-spacing: .05em; }
+.pwi-section-title { margin: 0 0 4px; font-size: var(--text-label); font-weight: 650; color: var(--muted); text-transform: uppercase; letter-spacing: .05em; }
 .pwi-empty-right-icon { color: var(--faint); }
-.pwi-empty-right-sub { font-size: 13.5px; color: var(--muted); margin: 0; max-width: 44ch; line-height: 1.5; }
+.pwi-empty-right-sub { font-size: var(--text-control); color: var(--muted); margin: 0; max-width: 44ch; line-height: 1.5; }
 .pwi-json-unsaved-card,
 .pwi-remove-confirm-card { max-width: 420px; width: min(420px, 92vw); padding: 20px 22px 16px; }
 .pwi-json-unsaved-title,
-.pwi-remove-confirm-title { margin: 0 0 8px; font-size: 16px; font-weight: 650; color: var(--text); }
+.pwi-remove-confirm-title { margin: 0 0 8px; font-size: var(--text-subtitle); font-weight: 650; color: var(--text); }
 .pwi-json-unsaved-desc,
-.pwi-remove-confirm-desc { margin: 0 0 18px; font-size: 13.5px; line-height: 1.45; }
+.pwi-remove-confirm-desc { margin: 0 0 18px; font-size: var(--text-control); line-height: 1.45; }
 .pwi-json-unsaved-actions,
 .pwi-remove-confirm-actions { display: flex; flex-wrap: wrap; justify-content: flex-end; gap: 8px; }
 .pwi-remove-confirm-danger { background: var(--red) !important; color: #fff !important; border-color: transparent !important; }
diff --git a/gui/src/styles-dashboard-workspace.css b/gui/src/styles-dashboard-workspace.css
index c28c5503d..a7a990d32 100644
--- a/gui/src/styles-dashboard-workspace.css
+++ b/gui/src/styles-dashboard-workspace.css
@@ -32,6 +32,13 @@
   padding: 0 var(--space-2) var(--space-2);
 }
 
+/* Top inset without sticky-header leaks: margin on the table, not padding on the
+   scrollport. At rest the table sits below the shell border; while scrolled the
+   sticky thead stays flush at the scrollport top. */
+.dashboard-workspace-main .tbl {
+  margin-top: var(--space-3);
+}
+
 .dashboard-workspace-main .tbl thead th {
   position: sticky;
   top: 0;
diff --git a/gui/src/styles-models-workspace.css b/gui/src/styles-models-workspace.css
index cb309ae9b..0504ac31e 100644
--- a/gui/src/styles-models-workspace.css
+++ b/gui/src/styles-models-workspace.css
@@ -322,6 +322,11 @@
   margin-bottom: var(--space-3);
 }
 
+/* Invisible stand-in for the empty Combos card while /api/combos loads. */
+.models-combos-card--pending {
+  min-height: var(--space-12);
+}
+
 .models-combos-empty-head {
   padding: var(--space-3);
   justify-content: space-between;
diff --git a/gui/src/styles/provider-overview-dashboard.css b/gui/src/styles/provider-overview-dashboard.css
index 09f00fd1e..e25831fff 100644
--- a/gui/src/styles/provider-overview-dashboard.css
+++ b/gui/src/styles/provider-overview-dashboard.css
@@ -247,7 +247,8 @@
 }
 
 .pws-capacity-incomplete {
-  color: var(--warning, #b7791f);
+  /* Semantic amber: WCAG AA on both themes (6.26:1 light, 9.65:1 dark). */
+  color: var(--amber);
 }
 
 .pws-dashboard-section--rate-limits,
diff --git a/gui/tests/api-auth-memory.test.ts b/gui/tests/api-auth-memory.test.ts
index a735ce62e..ca70303e2 100644
--- a/gui/tests/api-auth-memory.test.ts
+++ b/gui/tests/api-auth-memory.test.ts
@@ -157,7 +157,7 @@ test("concurrent 401s share one token prompt and all retry with the stored token
     const headers = new Headers(init?.headers);
     // Session re-bootstrap probe: this fixture never mints sessions, so fail it fast
     // instead of letting it join the release queue below.
-    if (new URL(_input instanceof Request ? _input.url : String(_input), "http://localhost/").pathname === "/") {
+    if (new URL(_input instanceof Request ? _input.url : String(_input), "http://localhost/").pathname === "/opencodex-session") {
       return new Response("unauthorized", { status: 401 });
     }
     if (headers.get("X-OpenCodex-API-Key") === "shared-token") {
@@ -278,7 +278,7 @@ test("canceling the token prompt once does not reopen it for the rest of the 401
   const release401: Array<() => void> = [];
   const mockFetch = (async (_input: RequestInfo | URL, init?: RequestInit) => {
     const headers = new Headers(init?.headers);
-    if (new URL(_input instanceof Request ? _input.url : String(_input), "http://localhost/").pathname === "/") {
+    if (new URL(_input instanceof Request ? _input.url : String(_input), "http://localhost/").pathname === "/opencodex-session") {
       return new Response("unauthorized", { status: 401 });
     }
     if (headers.get("X-OpenCodex-API-Key")) {
@@ -390,7 +390,7 @@ test("expired session silently re-bootstraps from the served document without pr
     const raw = input instanceof Request ? input.url : String(input);
     const url = new URL(raw, "http://localhost/");
     const headers = new Headers(init?.headers ?? (input instanceof Request ? input.headers : undefined));
-    if (url.pathname === "/") {
+    if (url.pathname === "/opencodex-session") {
       bootstrapFetches += 1;
       return new Response(sessionDocumentHtml("ocx_session_fresh", "fresh-csrf", "http://localhost"), {
         status: 200,
@@ -427,7 +427,7 @@ test("a session minted for another origin is rejected and the prompt fallback st
     const raw = input instanceof Request ? input.url : String(input);
     const url = new URL(raw, "http://localhost/");
     const headers = new Headers(init?.headers);
-    if (url.pathname === "/") {
+    if (url.pathname === "/opencodex-session") {
       return new Response(sessionDocumentHtml("ocx_session_foreign", "foreign-csrf", "http://192.0.2.10:10100"), {
         status: 200,
         headers: { "Content-Type": "text/html" },
diff --git a/gui/tests/codex-account-pool-controller.test.ts b/gui/tests/codex-account-pool-controller.test.ts
index ae48aae3c..00411bfd9 100644
--- a/gui/tests/codex-account-pool-controller.test.ts
+++ b/gui/tests/codex-account-pool-controller.test.ts
@@ -81,8 +81,10 @@ test("Providers owns exactly one controller and shares it with both surfaces", a
   expect(details).toContain("codexController={codexController}");
   expect(panel).toContain("controller={codexController}");
 
-  // ...and the same panel element is what Overview renders.
-  expect(details).toContain("accountPanel={authSurface ?");
+  // The full panel lives on the Accounts tab; Overview keeps the compact auth summary.
+  expect(details).not.toContain("accountPanel={authSurface ?");
+  const overview = await read("../src/components/provider-workspace/ProviderOverview.tsx");
+  expect(overview).not.toContain("accountPanel");
 });
 
 test("a nested pool cannot start a second poll loop", async () => {
diff --git a/gui/tests/page-loading-contract.test.tsx b/gui/tests/page-loading-contract.test.tsx
index ae365cd60..f59f4a28a 100644
--- a/gui/tests/page-loading-contract.test.tsx
+++ b/gui/tests/page-loading-contract.test.tsx
@@ -1,4 +1,11 @@
-import { expect, test } from "bun:test";
+import { afterEach, beforeEach, expect, test } from "bun:test";
+import { Window } from "happy-dom";
+import { act } from "react";
+import type { Root } from "react-dom/client";
+import Combos from "../src/pages/Combos";
+import { LanguageProvider } from "../src/i18n/provider";
+import { clearClientResourceStoresForTests } from "../src/client-resource";
+import { writeSessionListCache } from "../src/session-list-cache";
 
 /**
  * WP3 (devlog/_plan/260730_gui_hydration_loading_unify/020_page_migration.md).
@@ -66,7 +73,7 @@ test("every migrated surface reports a revalidation over existing content", asyn
   // These surfaces keep cached panels visible without a status line — a spinner would flash
   // over known state on revisit (Logs also polls every 2s).
   const silentRevalidation = new Set([
-    "Debug", "Startup", "Logs", "Subagents", "Usage", "Models", "ClaudeCode", "ClaudeDesktop", "ApiKeys", "Grok",
+    "Debug", "Startup", "Logs", "Subagents", "Usage", "Models", "ClaudeCode", "ClaudeDesktop", "ApiKeys", "Grok", "Combos",
   ]);
   for (const surface of MIGRATED) {
     const source = await read(surface.file);
@@ -96,7 +103,7 @@ test("a failure after a success stays visible instead of reading as settled", as
 
 test("the status line yields its live region to an error notice", async () => {
   const noStatusLine = new Set([
-    "Debug", "Startup", "Logs", "Subagents", "Usage", "Models", "ClaudeCode", "ClaudeDesktop", "ApiKeys", "Grok",
+    "Debug", "Startup", "Logs", "Subagents", "Usage", "Models", "ClaudeCode", "ClaudeDesktop", "ApiKeys", "Grok", "Combos",
   ]);
   // One announcement per transition: two live regions make a screen reader repeat itself.
   for (const surface of MIGRATED) {
@@ -108,3 +115,91 @@ test("the status line yields its live region to an error notice", async () => {
     ).toBe(true);
   }
 });
+
+const globals = ["document", "window", "navigator", "localStorage", "sessionStorage", "IS_REACT_ACT_ENVIRONMENT"] as const;
+let previousGlobals: Record<(typeof globals)[number], unknown>;
+let testWindow: Window;
+const originalFetch = globalThis.fetch;
+
+const API_BASE = "http://localhost";
+const CACHE_KEY = `ocx.combos.workspace.v1:${API_BASE}`;
+const CACHED_PAGE = {
+  combos: [],
+  providers: [{ name: "openai", disabled: false, hiddenFromPicker: false, authMode: "forward", adapter: "openai", baseUrl: "https://api.openai.com/v1", defaultModel: "gpt-5" }],
+  models: [{ provider: "openai", id: "gpt-5", namespaced: "openai/gpt-5" }],
+  cataloguedComboIds: [],
+};
+
+beforeEach(() => {
+  clearClientResourceStoresForTests();
+  previousGlobals = Object.fromEntries(globals.map(key => [key, Reflect.get(globalThis, key)])) as typeof previousGlobals;
+  testWindow = new Window({ url: "http://localhost/#combos" });
+  Object.defineProperties(globalThis, {
+    document: { configurable: true, value: testWindow.document },
+    window: { configurable: true, value: testWindow.window },
+    navigator: { configurable: true, value: testWindow.navigator },
+    localStorage: { configurable: true, value: testWindow.localStorage },
+    sessionStorage: { configurable: true, value: testWindow.sessionStorage },
+  });
+  (globalThis as typeof globalThis & { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT = true;
+  writeSessionListCache(CACHE_KEY, CACHED_PAGE);
+});
+
+afterEach(() => {
+  globalThis.fetch = originalFetch;
+  clearClientResourceStoresForTests();
+  testWindow.close();
+  for (const key of globals) {
+    Object.defineProperty(globalThis, key, { configurable: true, value: previousGlobals[key] });
+  }
+});
+
+test("Combos announces silent revalidation over cached content via aria-busy", async () => {
+  const { createRoot } = await import("react-dom/client");
+  const container = document.createElement("div");
+  document.body.append(container);
+
+  type Gate = { resolve: () => void };
+  let release!: Gate;
+  const gate = new Promise<void>(resolve => { release = { resolve }; });
+  globalThis.fetch = (async (input: RequestInfo | URL) => {
+    const url = String(input);
+    if (url.includes("/api/combos") || url.includes("/api/config") || url.includes("/api/models")) {
+      await gate;
+      if (url.includes("/api/combos")) return Response.json([]);
+      if (url.includes("/api/config")) return Response.json({ providers: CACHED_PAGE.providers });
+      return Response.json([]);
+    }
+    return new Response(null, { status: 404 });
+  }) as typeof fetch;
+
+  let root!: Root;
+  await act(async () => {
+    root = createRoot(container);
+    root.render(<LanguageProvider><Combos apiBase={API_BASE} /></LanguageProvider>);
+  });
+  await act(async () => { await new Promise<void>(r => testWindow.setTimeout(r, 0)); });
+
+  const body = container.querySelector<HTMLElement>(".combos-workspace-shell-body");
+  expect(body).not.toBeNull();
+  expect(body?.getAttribute("aria-busy")).toBe("true");
+  // The silent layout still announces: an sr-only polite status region carries the
+  // loading text while the refresh is in flight (attribute-only wiring is not enough).
+  const status = body?.querySelector<HTMLElement>('[role="status"]');
+  expect(status).not.toBeNull();
+  expect(status?.classList.contains("sr-only")).toBe(true);
+  expect(status?.getAttribute("aria-live")).toBe("polite");
+  expect(status?.textContent?.trim().length).toBeGreaterThan(0);
+
+  await act(async () => {
+    release.resolve();
+    await Promise.resolve();
+  });
+  await act(async () => { await new Promise<void>(r => testWindow.setTimeout(r, 20)); });
+
+  expect(container.querySelector<HTMLElement>(".combos-workspace-shell-body")?.getAttribute("aria-busy")).toBe("false");
+  expect(container.querySelector<HTMLElement>(".combos-workspace-shell-body [role='status']")?.textContent?.trim()).toBe("");
+
+  await act(async () => { root.unmount(); });
+  container.remove();
+});
diff --git a/gui/vite.config.ts b/gui/vite.config.ts
index 68a5045f9..2301c04fc 100644
--- a/gui/vite.config.ts
+++ b/gui/vite.config.ts
@@ -18,8 +18,11 @@ export default defineConfig({
   */
   server: proxyTarget ? {
     proxy: {
-      '/api': { target: proxyTarget, changeOrigin: true },
-      '/healthz': { target: proxyTarget, changeOrigin: true },
+      // Keep the original Host on forwarded requests: the backend mints loopback GUI
+      // sessions bound to that origin, and /api session checks must see the same origin.
+      '/opencodex-session': { target: proxyTarget, changeOrigin: false },
+      '/api': { target: proxyTarget, changeOrigin: false },
+      '/healthz': { target: proxyTarget, changeOrigin: false },
     },
   } : undefined,
 })
diff --git a/src/server/gui-static.ts b/src/server/gui-static.ts
index e314c1582..53259237c 100644
--- a/src/server/gui-static.ts
+++ b/src/server/gui-static.ts
@@ -56,16 +56,25 @@ function isFile(path: string): boolean {
   }
 }
 
-function htmlResponse(path: string, session?: GuiSessionBootstrap): Response {
-  let html = readFileSync(path, "utf8");
-  if (session) {
-    const bootstrap = [
-      `<meta name="opencodex-session-token" content="${session.token}">`,
-      `<meta name="opencodex-session-csrf" content="${session.csrfToken}">`,
-      `<meta name="opencodex-session-origin" content="${session.origin}">`,
-    ].join("");
-    html = html.includes("</head>") ? html.replace("</head>", `${bootstrap}</head>`) : `${bootstrap}${html}`;
-  }
+/** HTML-attribute escape for values interpolated into meta tags. */
+function escapeHtmlAttribute(value: string): string {
+  return value
+    .replaceAll("&", "&amp;")
+    .replaceAll('"', "&quot;")
+    .replaceAll("<", "&lt;")
+    .replaceAll(">", "&gt;");
+}
+
+/** Shared session meta-tag block, escaped for quoted attribute interpolation. */
+function sessionBootstrapMeta(session: GuiSessionBootstrap): string {
+  return [
+    `<meta name="opencodex-session-token" content="${escapeHtmlAttribute(session.token)}">`,
+    `<meta name="opencodex-session-csrf" content="${escapeHtmlAttribute(session.csrfToken)}">`,
+    `<meta name="opencodex-session-origin" content="${escapeHtmlAttribute(session.origin)}">`,
+  ].join("");
+}
+
+function htmlDocumentResponse(html: string): Response {
   return new Response(html, {
     headers: {
       "Content-Type": "text/html",
@@ -76,6 +85,26 @@ function htmlResponse(path: string, session?: GuiSessionBootstrap): Response {
   });
 }
 
+function htmlResponse(path: string, session?: GuiSessionBootstrap): Response {
+  let html = readFileSync(path, "utf8");
+  if (session) {
+    const bootstrap = sessionBootstrapMeta(session);
+    html = html.includes("</head>") ? html.replace("</head>", `${bootstrap}</head>`) : `${bootstrap}${html}`;
+  }
+  return htmlDocumentResponse(html);
+}
+
+/**
+ * Minimal session-bootstrap document, independent of any packaged GUI build. The dev
+ * GUI (Vite) proxies /opencodex-session to the backend with the original host so the
+ * backend can mint an origin-bound loopback session even when gui/dist does not exist.
+ */
+export function serveSessionBootstrap(session: GuiSessionBootstrap): Response {
+  const bootstrap = sessionBootstrapMeta(session);
+  const html = `<!doctype html><html><head><meta charset="utf-8">${bootstrap}</head><body></body></html>`;
+  return htmlDocumentResponse(html);
+}
+
 export function serveGuiFile(
   pathname: string,
   guiDist = findGuiDist(),
diff --git a/src/server/index.ts b/src/server/index.ts
index 57e6f6c9f..c2e10abe3 100644
--- a/src/server/index.ts
+++ b/src/server/index.ts
@@ -58,7 +58,7 @@ export {
 import { formatCodexProviderForLog } from "../codex/routing";
 import { CatalogGatherBusyError } from "../codex/catalog/provider-fetch";
 import { registerCodexWebSocket, tryReserveCodexWebSocket, unregisterCodexWebSocket, updateCodexWebSocketAuthContext } from "../codex/websocket-registry";
-import { resolveGuiFilePath, rootFallbackPayload, serveGuiFile } from "./gui-static";
+import { resolveGuiFilePath, rootFallbackPayload, serveGuiFile, serveSessionBootstrap } from "./gui-static";
 export { resolveGuiFilePath, rootFallbackPayload } from "./gui-static";
 export { resolveAdapter } from "./adapter-resolve";
 import { formatErrorResponse, type ResponsesTerminalStatus } from "../bridge";
@@ -995,6 +995,11 @@ export function startServer(port?: number, deps: StartServerDeps = {}) {
       const guiSessionCandidate = req.method === "GET" && (url.pathname === "/" || !url.pathname.includes("."))
         ? issueGuiSession(req, config, managementAuth)
         : null;
+      // Dedicated bootstrap path: answer without requiring a packaged GUI build, so the
+      // Vite dev server can mint an origin-bound loopback session on a fresh checkout.
+      if (url.pathname === "/opencodex-session" && guiSessionCandidate) {
+        return serveSessionBootstrap(guiSessionCandidate);
+      }
       const guiFile = serveGuiFile(url.pathname, undefined, guiSessionCandidate ?? undefined);
       if (guiFile) return guiFile;
       if (url.pathname === "/" && req.method === "GET") {
diff --git a/tests/provider-workspace-auth.test.ts b/tests/provider-workspace-auth.test.ts
index 4cfeb5f85..08847c797 100644
--- a/tests/provider-workspace-auth.test.ts
+++ b/tests/provider-workspace-auth.test.ts
@@ -170,6 +170,9 @@ describe("workspace account integration seam", () => {
     expect(details).toContain("authHandlers?.onReauth(item.name, active?.id)");
     expect(overview).toContain("onReauthenticate");
     expect(overview).toContain("pws.reauthenticate");
+    // OAuth providers without an email (Cursor/Kimi) still read as logged in.
+    expect(overview).toContain("oauth?.loggedIn");
+    expect(overview).toContain('t("pws.loggedInTitle")');
   });
 
   test("wires Codex active reauth health into openai rail status", async () => {
@@ -224,4 +227,14 @@ describe("workspace account integration seam", () => {
     // The panel now shares the controller instead of reporting health upward.
     expect(panel).toContain("controller={codexController}");
   });
+
+  test("keeps the doctor-copy affordance off the Providers account surfaces", async () => {
+    const [panel, pool] = await Promise.all([
+      Bun.file("gui/src/components/provider-workspace/ProviderAuthPanel.tsx").text(),
+      Bun.file("gui/src/components/CodexAccountPool.tsx").text(),
+    ]);
+    expect(panel).not.toContain("copyDoctor");
+    expect(pool).toContain("const showDoctorCopy = !embedded;");
+    expect(pool).toContain("onCopyDoctor={showDoctorCopy ? copyDoctor : undefined}");
+  });
 });
diff --git a/tests/server-management-auth.test.ts b/tests/server-management-auth.test.ts
index 076e84f0f..fe3abf191 100644
--- a/tests/server-management-auth.test.ts
+++ b/tests/server-management-auth.test.ts
@@ -6,7 +6,7 @@ import { join } from "node:path";
 import { saveConfig } from "../src/config";
 import { startServer } from "../src/server";
 import type { OcxConfig } from "../src/types";
-import { serveGuiFile } from "../src/server/gui-static";
+import { serveGuiFile, serveSessionBootstrap } from "../src/server/gui-static";
 import { isProxyAdmissionSecret } from "../src/server/auth-cors";
 import {
   initializeManagementAuthState,
@@ -381,6 +381,14 @@ describe("management and data-plane credential separation", () => {
     expect(html).toContain(`name="opencodex-session-token" content="${session?.token}"`);
     expect(html).toContain(`name="opencodex-session-csrf" content="${session?.csrfToken}"`);
 
+    // The dev GUI fetches /opencodex-session through Vite so the app shell stays
+    // Vite-owned. The backend answers that path without requiring gui/dist, so a fresh
+    // source checkout (no packaged build) can still mint an origin-bound session.
+    const bootstrapPage = serveSessionBootstrap(session!);
+    const bootstrapHtml = await bootstrapPage.text();
+    expect(bootstrapHtml).toContain(`name="opencodex-session-origin" content="${session?.origin}"`);
+    expect(bootstrapHtml).toContain(`name="opencodex-session-token" content="${session?.token}"`);
+
     const sameOriginRead = new Request("http://localhost:10100/api/config", {
       headers: {
         Host: "localhost:10100",
@@ -429,6 +437,31 @@ describe("management and data-plane credential separation", () => {
     expect(issueGuiSession(new Request("http://localhost:10100/"), config, state)).toBeNull();
   });
 
+  test("GET /opencodex-session serves the bootstrap document from a live server", async () => {
+    const config = remoteConfig();
+    config.hostname = "127.0.0.1";
+    saveConfig(config);
+    const server = startServer(0);
+    try {
+      const response = await fetch(new URL("/opencodex-session", server.url), {
+        headers: { Host: server.url.host },
+      });
+      expect(response.status).toBe(200);
+      expect(response.headers.get("content-type")).toBe("text/html");
+      expect(response.headers.get("cache-control")).toBe("no-store");
+      expect(response.headers.get("pragma")).toBe("no-cache");
+      expect(response.headers.get("x-frame-options")).toBe("DENY");
+      expect(response.headers.get("content-security-policy")).toContain("frame-ancestors 'none'");
+
+      const html = await response.text();
+      expect(html).toContain('name="opencodex-session-token"');
+      expect(html).toContain('name="opencodex-session-csrf"');
+      expect(html).toContain('name="opencodex-session-origin"');
+    } finally {
+      await server.stop(true);
+    }
+  });
+
   test("a non-loopback binding never issues a GUI session from a forged loopback Host", () => {
     const config = remoteConfig();
     const state = initializeManagementAuthState(config);