feat(gui): add confirmed 99% main-account protection controls

devlog/_plan/260905_main_quota_guard/000_plan.md

@@ -35,7 +35,8 @@ Reuse existing config mutation/rollback, quota parsing, account identity reconci
 1. wp0: source-grounded docs-only roadmap and independent audit; lock before production edits.
 2. wp1 / `010_policy.md`: main quota protection contracts, admission and management, with regression coverage. Bottom PR targets dev and works without the UI layer.
 3. wp2 / `020_settings.md`: switch, confirmation, main-card state and supported Reserve compatibility documentation; depends on the policy contract. Upper PR targets the bottom branch.
-4. wp3 / `030_delivery.md`: exact-head review/CI and bottom-up authorized admin merge, followed by fetched ancestry and closure evidence.
+4. wp-reserve / `030_reserve_compatibility.md`: source-grounded explicit Reserve metadata/availability and independent quota handling; depends on the preceding identity and settings contracts.
+5. wp3 / `040_delivery.md`: exact-head review/CI and bottom-up authorized admin merge, followed by fetched ancestry and closure evidence. Pending macOS and other platform gates remain mandatory.
 
 The Reserve client gate is a separate feasibility decision, not permission to misrepresent server state. If source establishes a safe OCX-only compatibility patch, concretize it as a P amendment before writing. If it requires modifying the installed Desktop client or publishing to an unspecified upstream repository, record the boundary and ask for that specific decision after completing in-scope work; do not claim same-picker coexistence.
 

devlog/_plan/260905_main_quota_guard/021_settings_dispatch.md

@@ -0,0 +1,25 @@
+# Settings implementation stale check and ownership
+
+Consumes runtime headfe2e10e15 (PR3552). Linux full suite and behavioral criteria passed; remaining macOS checks stay in final delivery. No local test suites. Design Read/dials in020 unchanged: existing monochrome developer console, D8/V2/M1, no concept imagery.
+
+## UI worker scope
+
+NEW MainAccountHardLockSetting.tsx, MODIFY codex-set-multiauth.tsx, useCodexAccountPool.ts DTO, codex-account-pool-main-card.tsx, scoped styles-codex-set.css; NEW gui/tests/main-account-hard-lock-setting.test.tsx. No locale/doc/backend edits by the worker.
+
+The actual tab URL is #codex-set, not #codex-set/multiauth. The parent creates exactly one useCodexAccountPool(apiBase) controller and injects it into CodexAccountPool, whose fallback becomes inert. New setting receives onSaved:()=>Promise<boolean> calling controller.load(false). Invoke after acknowledged PUT for both enable/disable, not dialog open/cancel. A failed status reload does not relabel the successful PUT as failed; show a separate retryable saved-but-status-unconfirmed notice.
+
+Persisted field codexMainAccountHardLock:boolean, status mainAccountHardLock:{enabled:boolean,state:off|unknown|ready|blocked,resetAt?:milliseconds}. Main-card DTO has this optional status. Never derive status from rounded bars; ready means monitoring, not a promise that every other account restriction is absent.
+
+No optimistic protection claim before acknowledgment. GET generations are invalidated on writes; cancel/Escape makes no request. Native dialog traps/restores focus; pending submission rejects duplicates and cannot be dismissed into an ambiguous success. Load error offers retry. Save failure describes inability to confirm, keeps recoverable state, and reloads authoritative state when appropriate.
+
+Show main status when advanced settings are collapsed, and suppress the use-main button when policy blocks. Offer a link to the actual Codex settings route when the card appears elsewhere. Do not create a new event bus, duplicate account store, or force an upstream quota refresh on every settings save.
+
+## Translation contract (main owns all locales)
+
+Use only these new keys under codexAuth: mainHardLockTitle, mainHardLockDesc, mainHardLockConfirmTitle, mainHardLockConfirmBody, mainHardLockConfirm, mainHardLockEnabled, mainHardLockDisabled, mainHardLockLoadFailed, mainHardLockSaveFailed, mainHardLockRefreshFailed, mainHardLockBlocked, mainHardLockUnknown, mainHardLockMonitoring, mainHardLockManage. Reuse common.retry/common.close/codexAuth.cancel for common controls. Main can add a key only after synchronizing the worker and all locales.
+
+Copy must state5h first, weekly otherwise, monthly-only fallback; fresh0 unlocks automatically while enabled. While blocked, Reserve is unavailable too; staying below ordinary exhaustion may prevent Reserve activation. In-flight/direct/unmatched-keyring use is outside the guarantee. No claim that the Reserve picker feature has shipped in this UI layer.
+
+## Main scope and verification
+
+All locale keys, public English/Korean usage docs, isolated fixture preview and browser QA, records and PR body. Browser at390/768/1280px, Korean/English, enable/cancel/Escape/saving/savefail/loadfail/disable and current-block status. Native browser tool first; no Playwright install. Build/i18n/lint are allowed; no local suites. CI executes component regressions. Screenshots must contain fixtures only and be embedded in the upper PR.

devlog/_plan/260905_main_quota_guard/023_ui_review.md

@@ -0,0 +1,13 @@
+# UI review and rendered feedback
+
+Rendered correction: main-card policy text initially touched the card edge. Align it with the existing16px card inset and place the manage action in a wrapping row with an adequate target. No global tokens changed.
+
+Independent reviewer Descartes found one accepted lifecycle blocker: a delayed PUT for proxyA can invoke its captured onSaved after apiBase changes toB, allowing old load(A) to advance the reused controller generation and replace B's displayed accounts.
+RCA: keying only the setting protects its local state, not the parent-owned callback/controller. Bind the parent controller and completion callback to its proxy lifetime, while still allowing refresh after Advanced collapses within the same proxy. Add a deferred-PUT A->B regression that verifies B's account/status remains authoritative and no late old-proxy reload wins. Do not suppress the existing same-proxy collapsed-save refresh.
+
+Existing source review accepted acknowledgment, cancellation, error distinctions, main-card recovery, copy in9locales and state priority. Browser already observed Escape cancellation with0PUT, one confirmed save with1PUT, policy block hiding main activation, and a fresh0 usage update returning monitoring while the switch stays enabled. These are fixture-backed real-component observations, not live account changes.
+
+The lifecycle blocker is closed by keyed parent ownership plus retiring callbacks on unmount; same-proxy Advanced collapse retains its soft reload. Reviewer Descartes returned PASS on the repair and both regressions.
+Rendered mobile feedback: keep Korean words together and use44px confirmation targets. The embedded browser could move keyboard focus out of the native dialog at the two-button boundary; explicitly wrap Tab/Shift-Tab between Cancel and Confirm. No background page control becomes a focus target. Browser capture initially inherited80% zoom; device emulation was used to verify exact390/768/1280 CSS widths, and temporary emulation will be cleared at teardown.
+
+UI CI React Doctor atfba57fcc1 flagged anchor-target-exists for the fallback href=#codex-set. This is a real application hash route, not an in-document anchor; use the existing navigateHash button convention to express that intent without a scanner suppression. Preserve the same-page callback. Artifact integrity also found native JPEG screenshot bytes with .png suffixes; rename to .jpg without altering/re-encoding any image content.

devlog/_plan/260905_main_quota_guard/024_ui_verification.md

@@ -0,0 +1,46 @@
+# UI verification checkpoint
+
+Actual React CodexSet/CodexAccountPool components were served by the existing Vite stack against an isolated fixture API on loopback15141/15142. Settings GET/PUT used the real management handler with in-memory persistence and fixture-only quota provenance. No live account, credit, installed app or port10100 was changed.
+
+## Observed interaction matrix
+
+| Scenario | Observed result |
+| --- | --- |
+| Enable attempt, Escape | Dialog closed; focus returned to toggle; fixture PUT count remained0. |
+| Confirm enable | One PUT; acknowledged enabled state; owner reloaded status. |
+| Short98 / weekly100 | Monitoring, not a99% block. |
+| Short99 | Main card showed blocked status; use-main action disappeared; status remained outside collapsed Advanced. |
+| Manage protection on same page | Advanced opened and setting section received focus/scroll. |
+| Short0 / weekly100 | Monitoring returned; configuration remained enabled. |
+| Failed disable PUT | Existing enabled value retained after authoritative reload; actionable save-confirmation error. |
+| Retry disable after failure | Confirmed off with other limits explicitly unchanged. |
+| Settings GET failure | New toggle disabled; scoped Retry restored interaction after a valid response. |
+| Successful PUT, failed account reload | Enabled stayed true; separate saved-but-status-unconfirmed notice. |
+| Retry account reload | Main status updated with no additional PUT (count remained4). |
+| Unknown selected usage | Main card showed usage-confirmation-needed, not a fabricated0 or a claim of availability. |
+| Keyboard bounds | Cancel Shift-Tab -> Confirm; Confirm Tab -> Cancel; Escape restored toggle. |
+| Responsive copy | Korean390/768/1280 CSS widths and English390/1280 inspected. Dialog remained within viewport; no horizontal overflow. |
+
+Screenshots in022_ui_evidence contain only fixture identities. Initial80% embedded-browser zoom caused capture cropping; final captures use matched viewport/device metrics atDPR1. Temporary emulation/viewport overrides were reset and the agent-created tab was closed. Ordinary pointer interactions were checked before emulation; keyboard navigation was used for exact emulated viewports.
+
+Teardown: verified the fixture Bun process and workspace Vite process before stopping them. No listener remains on15141 or15142. The running proxy on10100 was never targeted.
+
+## Source and build checks
+
+- Independent Descartes review PASS after the old-proxy completion fix; follow-up two-button focus wrap and scoped CSS also PASS.
+- GUI `bun run build`, `bun run lint:i18n`, `bun run lint`: exit0 after final source/CSS changes. Existing large-bundle advisory remains.
+- Docs `bun install --frozen-lockfile && bun run build`: exit0,425 pages. Existing bundle/404-entry advisory unchanged.
+- No local test suite executed. New component regressions are authored for exact-head CI; all CI checks remain mandatory before merge.
+- React Doctor0.9.11, run from the actual gui project against the parent branch, found no issues after expressing fallback navigation with navigateHash. No scanner rule was suppressed. Native screenshot suffixes were corrected to.jpg; the bytes are unchanged JPEGs.
+- Runtime parent PR3552 atfe2e10e15: complete Cross-platform CI33930796875 succeeded, including macOS. Parent marked ready for review; no merge yet.
+
+## Changed surfaces
+
+MainAccountHardLockSetting: strict read/acknowledgment, bounded requests, confirmation/focus/error/retry states.
+CodexSetMultiauth: one proxy-scoped controller and completion lifetime.
+CodexAccountPool: local Manage action opens Advanced.
+Main-card component and account hook: safe server-owned status contract and activation suppression while blocked.
+styles-codex-set.css: scoped card alignment, wrapping and touch targets.
+All9locale modules: matching14keys with window/zero/Reserve consequences.
+English/Korean account reference: opt-in behavior, scope and recovery guidance.
+New component test: state/lifecycle/cancel/focus and real-parent identity-race regression; CI execution pending.

devlog/_plan/260905_main_quota_guard/025_focus_review.md

@@ -0,0 +1,11 @@
+# UI review follow-up
+
+Parent runtime rebased onto f42d86fca: fresh-only lower usage recovery, existing minute sweep, malformed-negative rejection, cold hydration and quarantine-preserving background refresh. Public English/Korean guide now describes that contract. Docs build passed425pages.
+
+External review3938946546 identified missing disable-path focus restoration. The switch now arms restoration for either action, focuses the section while authoritative reload leaves it disabled, and restores the enabled toggle after successful GET. Independent Descartes review found an additional delayed-recovery focus steal after deliberate departure; the section now cancels intent on a non-null focus target outside itself. Null-target disabled-control blur and internal navigation retain intent. ACK/save-versus-refresh semantics are unchanged.
+
+Descartes final source review PASS, blocking_issues0. Existing setting test397lines plus new focused82line departure/null-target regression authored for CI, not executed locally. GUI build/typecheck, lint and GUI-scoped React Doctor0.9.11 passed after the final fix. Existing responsive screenshots remain visually representative because this amendment changes focus behavior only.
+
+Isolated browser check used fixture ports15141/15142, not live10100. Successful disable restored focus to the toggle; failed PUT plus failed GET focused the setting section and kept the switch disabled. No real account, upstream inference or reset credits were used.
+
+Departure scenario also passed in the real browser: after failed PUT/GET, focused the separate usage-threshold input, restored the fixture GET endpoint, and let the actual30s settings poll complete. The protected switch became enabled while focus remained on the threshold input.

devlog/_plan/260905_main_quota_guard/026_ui_dev_integration.md

@@ -0,0 +1,7 @@
+# UI integration with current quota controls
+
+UI rebased onto runtime03ee2f119/latest dev593978db0. Union conflict resolution preserves the quotaAutoRefresh DTO/control props and the independent hard-lock status/Manage/navigation wiring. Aristotle read-only union review found no missing wiring; its fixture update supplies the new required quotaAutoRefresh fields/props without changing assertions.
+
+GUI build/typecheck passed. No local test suite ran. Isolated real-component browser inspection at1280x900 and390x844 verified no horizontal overflow, coexistence of the new automatic-window controls and hard-lock status, confirmation/save with toggle focus restoration, and Manage focus/scroll to the peer-level setting beneath Ultra Fast. Captured three new JPEGs in022_ui_evidence with integrated in the filenames; prior screenshots remain historical evidence.
+
+The preview used fake quota/account data, separate homes and ports15141/15142, and an explicit outbound-fetch refusal. Automatic-window switches remained off; no model warmup, real account change or live10100 mutation occurred. Viewport/CDP overrides, tab and preview processes were cleaned up. Fresh exact-head CI and maintainer review remain required after publication.