diff --git a/devlog/_plan/260912_unimplemented_trio_stack/020_l2_native_main_reauth_api.md b/devlog/_plan/260912_unimplemented_trio_stack/020_l2_native_main_reauth_api.md
index 3bc7a1315f..bde091a235 100644
--- a/devlog/_plan/260912_unimplemented_trio_stack/020_l2_native_main_reauth_api.md
+++ b/devlog/_plan/260912_unimplemented_trio_stack/020_l2_native_main_reauth_api.md
@@ -31,6 +31,13 @@ MODIFY `src/oauth/chatgpt-device.ts`
   poll deadline and abort. Add a service-owned per-fetch deadline (fetch +
   body) so a stuck TCP cannot hold the flow until TTL. This is the Kuhn
   blocker "poll timer does not bound fetch/body deadlines".
+  Audit-folded: one FRESH 30s timeout per fetch attempt inside the poll
+  loop (AbortSignal.any([ctrl.signal, AbortSignal.timeout(30_000)]), the
+  main-account.ts:239-241 pattern) — a single 30s signal across the whole
+  poll would kill the 15-minute grant. Abort-timeout maps to
+  device_authorization_failed. The shared helper also bounds hung POOL
+  device logins at 30s per fetch — an intended improvement, called out in
+  the PR.
 
 MODIFY `src/codex/main-account.ts`
 - New `beginNativeMainReauth`: captures the existing
@@ -43,6 +50,13 @@ MODIFY `src/codex/main-account.ts`
   together, advances the mutation epoch, and reconciles runtime/quota
   state. Old identity token is never retained beside new credentials. No
   claim held during human polling.
+  Audit-folded: do NOT reuse persistRefreshedMainAuthJson (:190-195) — it
+  spreads expected.tokens and never writes id_token, so the old identity
+  token would survive beside the new grant. The commit uses a SIBLING
+  persist that sets access_token/refresh_token/id_token/account_id
+  together and overwrites any prior id_token (adding the key is safe:
+  readMainAuthJsonCredential :122 tolerates it and
+  native-profile-store.ts:476-481 expects it).
 
 NEW `src/codex/main-device-reauth.ts`
 - One process-owned active flow (opaque UUID, AbortController, bounded
@@ -68,6 +82,12 @@ MODIFY `src/cli/account-main.ts`
   management API; reject extra args before start. Register capability/help;
   regenerate skill surface with `bun run skill:surface` if the capability
   registry changes (tests/ci-workflows/skill-ocx.test.ts gates this).
+  Audit-folded: the native-main CLI branch point is account-main.ts (:181
+  region, beside add/switch) with USAGE in src/cli/account.ts:64; the
+  management route-registry (src/server/management/route-registry.ts
+  MANAGEMENT_ROUTES) must gain the POST/GET/DELETE rows or
+  management-route-registry.test.ts and the capabilities ratchet go red —
+  do NOT grow UNDECLARED_ROUTES_2026_08_28.
 
 ## Hub fence resolution (open decision 1, resolved here for audit)
 
@@ -103,8 +123,11 @@ contract: strict keys, 400/404/409 shapes, unauthorized rejected,
 `__main__` still refused by `/api/codex-auth/login`.
 MODIFY `tests/oauth/chatgpt-device-auth.test.ts` — native result retains
 idToken in-process; per-fetch deadline fires on a hung stub fetch.
-MODIFY `tests/cli/cli-account.test.ts` — reauth --device surface, status,
-cancel, arg rejection.
+Audit-folded: native-main CLI tests land in
+tests/cli/cli-native-profile.test.ts (native-main CLI); the pool
+cli-account.test.ts keeps only the __main__ login rejection cases.
+MODIFY `tests/cli/cli-native-profile.test.ts` — reauth --device surface,
+status, cancel, arg rejection.
 All NEW files: layout.json explicit + expected-fixture entries.
 
 ## Docs / ownership
diff --git a/docs-site/src/content/docs/fr/reference/cli/providers-accounts.md b/docs-site/src/content/docs/fr/reference/cli/providers-accounts.md
index b28642e0ca..b531e1b307 100644
--- a/docs-site/src/content/docs/fr/reference/cli/providers-accounts.md
+++ b/docs-site/src/content/docs/fr/reference/cli/providers-accounts.md
@@ -315,6 +315,9 @@ ocx account main doctor [--json]
 ocx account main list [--json]
 ocx account main register <label> [--json]
 ocx account main add <label>
+ocx account main reauth --device [--no-wait] [--json]
+ocx account main reauth status --flow <id> [--json]
+ocx account main reauth cancel --flow <id> [--json]
 ocx account main switch <profile-id-or-label> --yes [--json]
 ocx account main recover [--rollback --yes] [--json]
 ```
diff --git a/docs-site/src/content/docs/ja/reference/cli/providers-accounts.md b/docs-site/src/content/docs/ja/reference/cli/providers-accounts.md
index a13a5b310e..4130980693 100644
--- a/docs-site/src/content/docs/ja/reference/cli/providers-accounts.md
+++ b/docs-site/src/content/docs/ja/reference/cli/providers-accounts.md
@@ -243,6 +243,9 @@ ocx account main doctor [--json]
 ocx account main list [--json]
 ocx account main register <label> [--json]
 ocx account main add <label>
+ocx account main reauth --device [--no-wait] [--json]
+ocx account main reauth status --flow <id> [--json]
+ocx account main reauth cancel --flow <id> [--json]
 ocx account main switch <profile-id-or-label> --yes [--json]
 ocx account main recover [--rollback --yes] [--json]
 ```
diff --git a/docs-site/src/content/docs/ko/reference/cli/providers-accounts.md b/docs-site/src/content/docs/ko/reference/cli/providers-accounts.md
index 0fc4bc2608..e35662a13e 100644
--- a/docs-site/src/content/docs/ko/reference/cli/providers-accounts.md
+++ b/docs-site/src/content/docs/ko/reference/cli/providers-accounts.md
@@ -308,6 +308,9 @@ ocx account main doctor [--json]
 ocx account main list [--json]
 ocx account main register <label> [--json]
 ocx account main add <label>
+ocx account main reauth --device [--no-wait] [--json]
+ocx account main reauth status --flow <id> [--json]
+ocx account main reauth cancel --flow <id> [--json]
 ocx account main switch <profile-id-or-label> --yes [--json]
 ocx account main recover [--rollback --yes] [--json]
 ```
diff --git a/docs-site/src/content/docs/reference/cli/providers-accounts.md b/docs-site/src/content/docs/reference/cli/providers-accounts.md
index f7e94a1833..3a68ded861 100644
--- a/docs-site/src/content/docs/reference/cli/providers-accounts.md
+++ b/docs-site/src/content/docs/reference/cli/providers-accounts.md
@@ -486,6 +486,9 @@ ocx account main doctor [--json]
 ocx account main list [--json]
 ocx account main register <label> [--json]
 ocx account main add <label>
+ocx account main reauth --device [--no-wait] [--json]
+ocx account main reauth status --flow <id> [--json]
+ocx account main reauth cancel --flow <id> [--json]
 ocx account main switch <profile-id-or-label> --yes [--json]
 ocx account main recover [--rollback --yes] [--json]
 ```
@@ -501,6 +504,8 @@ successful switch preserves local tasks and history, then requires Codex to be r
 `doctor` to inspect profile state and `recover` to finish or roll back an interrupted transition.
 `switch` accepts either the profile ID or its label.
 
+`reauth` re-authenticates the *existing* native main identity with an OpenAI device code (#3898) instead of enrolling a new profile. It is the headless-hub recovery path: no local Codex App, no `codex` binary, and no OS keyring are required. The device login must complete for the same ChatGPT account that already holds the native main slot; the credential write is fenced by the exclusive claim and a path/hash/inode snapshot, and the command output carries only the flow id, the verification URL, the device code, and status. The pool login route stays pool-only and keeps rejecting `__main__`; the equivalent dashboard surface is the Codex Auth main card's Re-login with device code control.
+
 The v1 recovery matrix covers an OpenCodex process exiting after a transaction file has been
 published by rename. It does not claim durability across an OS or kernel crash or sudden power
 loss: `atomicWriteFileAsync()` does not `fsync` either the file or its parent directory.
diff --git a/docs-site/src/content/docs/ru/reference/cli/providers-accounts.md b/docs-site/src/content/docs/ru/reference/cli/providers-accounts.md
index 76791eb148..928082fe6d 100644
--- a/docs-site/src/content/docs/ru/reference/cli/providers-accounts.md
+++ b/docs-site/src/content/docs/ru/reference/cli/providers-accounts.md
@@ -302,6 +302,9 @@ ocx account main doctor [--json]
 ocx account main list [--json]
 ocx account main register <label> [--json]
 ocx account main add <label>
+ocx account main reauth --device [--no-wait] [--json]
+ocx account main reauth status --flow <id> [--json]
+ocx account main reauth cancel --flow <id> [--json]
 ocx account main switch <profile-id-or-label> --yes [--json]
 ocx account main recover [--rollback --yes] [--json]
 ```
diff --git a/docs-site/src/content/docs/tr/reference/cli/providers-accounts.md b/docs-site/src/content/docs/tr/reference/cli/providers-accounts.md
index 073156cf1a..cc1f49e105 100644
--- a/docs-site/src/content/docs/tr/reference/cli/providers-accounts.md
+++ b/docs-site/src/content/docs/tr/reference/cli/providers-accounts.md
@@ -360,6 +360,9 @@ ocx account main doctor [--json]
 ocx account main list [--json]
 ocx account main register <etiket> [--json]
 ocx account main add <etiket>
+ocx account main reauth --device [--no-wait] [--json]
+ocx account main reauth status --flow <id> [--json]
+ocx account main reauth cancel --flow <id> [--json]
 ocx account main switch <profil-id-veya-etiket> --yes [--json]
 ocx account main recover [--rollback --yes] [--json]
 ```
diff --git a/docs-site/src/content/docs/zh-cn/reference/cli/providers-accounts.md b/docs-site/src/content/docs/zh-cn/reference/cli/providers-accounts.md
index 9d099c8c1b..59645d6356 100644
--- a/docs-site/src/content/docs/zh-cn/reference/cli/providers-accounts.md
+++ b/docs-site/src/content/docs/zh-cn/reference/cli/providers-accounts.md
@@ -273,6 +273,9 @@ ocx account main doctor [--json]
 ocx account main list [--json]
 ocx account main register <label> [--json]
 ocx account main add <label>
+ocx account main reauth --device [--no-wait] [--json]
+ocx account main reauth status --flow <id> [--json]
+ocx account main reauth cancel --flow <id> [--json]
 ocx account main switch <profile-id-or-label> --yes [--json]
 ocx account main recover [--rollback --yes] [--json]
 ```
diff --git a/docs-site/src/content/docs/zh-tw/reference/cli/providers-accounts.md b/docs-site/src/content/docs/zh-tw/reference/cli/providers-accounts.md
index 0e3bbe4b78..e1ad7b7653 100644
--- a/docs-site/src/content/docs/zh-tw/reference/cli/providers-accounts.md
+++ b/docs-site/src/content/docs/zh-tw/reference/cli/providers-accounts.md
@@ -222,6 +222,9 @@ ocx account main doctor [--json]
 ocx account main list [--json]
 ocx account main register <label> [--json]
 ocx account main add <label>
+ocx account main reauth --device [--no-wait] [--json]
+ocx account main reauth status --flow <id> [--json]
+ocx account main reauth cancel --flow <id> [--json]
 ocx account main switch <profile-id-or-label> --yes [--json]
 ocx account main recover [--rollback --yes] [--json]
 ```
diff --git a/scripts/test-layout/layout.json b/scripts/test-layout/layout.json
index 98f481eac0..a4031a22b7 100644
--- a/scripts/test-layout/layout.json
+++ b/scripts/test-layout/layout.json
@@ -1377,7 +1377,9 @@
     "zz-ci-api-usage-isolation.test.ts": "ci-workflows",
     "zz-ci-storage-policy-isolation.test.ts": "ci-workflows",
     "zz-pr-coderabbit-readiness-revalidation.test.ts": "ci-workflows",
-    "usage-log-ws-stage.test.ts": "usage"
+    "usage-log-ws-stage.test.ts": "usage",
+    "main-device-reauth.test.ts": "codex-integration",
+    "main-device-reauth-api.test.ts": "codex-integration"
   },
   "migrated": [
     "adapters",
diff --git a/skills/ocx/references/01_management_surface.md b/skills/ocx/references/01_management_surface.md
index f9fec70034..87e0a1ca77 100644
--- a/skills/ocx/references/01_management_surface.md
+++ b/skills/ocx/references/01_management_surface.md
@@ -455,6 +455,29 @@ JSON mode: `payload`.
 - `store` verifies every keychain write by read-back before config.json is rewritten with keychain: references; an unavailable keychain refuses with 503 and leaves the file untouched.
 - Headless services usually have no unlocked keychain session; prefer ${ENV_VAR} references there.
 
+### `ocx account main reauth`
+
+Reauthenticate the native main Codex login with a device code (#3898); headless hubs need no Codex App or keyring.
+
+| Method | Route |
+|---|---|
+| POST | `/api/codex-auth/main/reauth-device` |
+| GET | `/api/codex-auth/main/reauth-device` |
+| DELETE | `/api/codex-auth/main/reauth-device` |
+
+| Flag | Value | Meaning |
+|---|---|---|
+| `--device` | boolean | Run the device-code flow (the only reauth mode). |
+| `--no-wait` | boolean | Print the flow handle and code without waiting for completion. |
+| `--flow` | string | Flow id for status and cancel. |
+| `--json` | boolean | Emit the flow status as JSON. |
+
+JSON mode: `payload`.
+
+- Same-identity reauth only: the device login must complete for the ChatGPT account that already holds the native main slot, and the commit is fenced by the exclusive claim plus a path/hash/inode snapshot.
+- /api/codex-auth/login stays pool-only and keeps rejecting __main__; this namespace is the only device-reauth surface for the native main slot.
+- Payloads carry only flowId, status, the verification URL, the device code, and a closed set of failure codes -- never tokens, emails, or raw account ids.
+
 ### `ocx account refresh`
 
 Refresh account quotas without model validation; pending Codex accounts require dashboard consent.
@@ -769,6 +792,6 @@ JSON mode: `payload`.
 
 ## Counts
 
-- declared capabilities: 41
-- of those, state-changing: 20
+- declared capabilities: 42
+- of those, state-changing: 21
 - head-resolved invocations: 2
diff --git a/src/cli/account-main.ts b/src/cli/account-main.ts
index e6d0eafeb6..9169ab824a 100644
--- a/src/cli/account-main.ts
+++ b/src/cli/account-main.ts
@@ -17,6 +17,9 @@ const USAGE = `Usage:
   ocx account main list [--json]
   ocx account main register <label> [--json]
   ocx account main add <label>
+  ocx account main reauth --device [--no-wait] [--json]
+  ocx account main reauth status --flow <id> [--json]
+  ocx account main reauth cancel --flow <id> [--json]
   ocx account main switch <profile-id-or-label> --yes [--json]
   ocx account main recover [--rollback --yes] [--json]
 
@@ -186,6 +189,83 @@ export async function cmdNativeMainAccount(args: string[], deps: AccountDeps): P
   const baseUrl = await resolveBaseUrl(deps);
   if (!baseUrl) return proxyUnreachable();
 
+  if (sub === "reauth") {
+    // #3898: same-identity device reauth of the native __main__ slot via the
+    // dedicated management namespace; /api/codex-auth/login stays pool-only.
+    if (confirmed || rollback) return reject(args);
+    const noWait = flag(args, "--no-wait");
+    const device = flag(args, "--device");
+    const flowIndex = args.indexOf("--flow");
+    const flowId = flowIndex >= 0 ? args.splice(flowIndex, 2)[1] : undefined;
+    const action = args.shift();
+    if (args.length > 0) return reject(args);
+
+    const printStatus = (status: Record<string, unknown>): void => {
+      if (wantsJson) { console.log(JSON.stringify(status, null, 2)); return; }
+      console.log("status: " + String(status.status ?? "unknown"));
+      if (typeof status.verificationUrl === "string" && status.verificationUrl) {
+        console.log("url: " + status.verificationUrl);
+      }
+      if (typeof status.deviceCode === "string" && status.deviceCode) {
+        console.log("deviceCode: " + status.deviceCode);
+      }
+      if (typeof status.code === "string" && status.code) {
+        console.log("failure: " + status.code);
+      }
+    };
+
+    if (action === "status" || action === "cancel") {
+      if (!flowId || device || noWait) return reject(args);
+      const query = "/api/codex-auth/main/reauth-device?flowId=" + encodeURIComponent(flowId);
+      const result = action === "status"
+        ? await apiJson(deps, baseUrl, "GET", query)
+        : await apiJson(deps, baseUrl, "DELETE", query);
+      if (result.status === 0) return proxyUnreachable(result.transportError);
+      if (result.status !== 200) return apiError(result.json, "failed to " + action + " the native main reauth", result.status);
+      printStatus(result.json);
+      return 0;
+    }
+
+    if (action !== undefined || !device) return reject(args);
+    const started = await apiJson(deps, baseUrl, "POST", "/api/codex-auth/main/reauth-device");
+    if (started.status === 0) return proxyUnreachable(started.transportError);
+    if (started.status !== 200) return apiError(started.json, "failed to start the native main device reauth", started.status);
+    const startFlowId = typeof started.json.flowId === "string" ? started.json.flowId : "";
+    if (!startFlowId) {
+      console.error("The proxy returned an invalid reauth flow.");
+      return 1;
+    }
+    // The URL and human code arrive with the usercode response, a beat after start.
+    let pending = started.json;
+    const statusQuery = "/api/codex-auth/main/reauth-device?flowId=" + encodeURIComponent(startFlowId);
+    for (let attempt = 0; attempt < 50 && !pending.deviceCode; attempt += 1) {
+      await Bun.sleep(200);
+      const polled = await apiJson(deps, baseUrl, "GET", statusQuery);
+      if (polled.status === 200) pending = polled.json;
+    }
+    if (noWait) {
+      printStatus({ flowId: startFlowId, ...pending });
+      console.log("follow up: ocx account main reauth status --flow " + startFlowId);
+      return 0;
+    }
+    // Blocking wait bounded by the service flow expiry (15-minute grant + margin).
+    const deadline = Date.now() + 16 * 60_000;
+    for (;;) {
+      if (pending.status !== "pending" && pending.status !== "committing") break;
+      if (Date.now() >= deadline) {
+        console.error("The reauth flow did not finish within the device grant window; check status with --flow " + startFlowId + ".");
+        return 1;
+      }
+      await Bun.sleep(2_000);
+      const polled = await apiJson(deps, baseUrl, "GET", statusQuery);
+      if (polled.status === 0) return proxyUnreachable(polled.transportError);
+      if (polled.status !== 200) return apiError(polled.json, "failed to poll the native main reauth", polled.status);
+      pending = polled.json;
+    }
+    printStatus({ flowId: startFlowId, ...pending });
+    return pending.status === "succeeded" ? 0 : 1;
+  }
+
   if (sub === "doctor" || sub === "list") {
     if (args.length > 0 || confirmed || rollback) return reject(args);
     const path = sub === "doctor" ? "/api/native-main-profiles/doctor" : "/api/native-main-profiles";
diff --git a/src/cli/account.ts b/src/cli/account.ts
index 4a8c6a0427..f416438ed3 100644
--- a/src/cli/account.ts
+++ b/src/cli/account.ts
@@ -61,7 +61,7 @@ const ACCOUNT_USAGE = `Usage:
   ocx account cancel <provider> [--flow <flow-id>] [--json]
   ocx account reset-credits <account-id|main> [--consume --yes] [--json]
   ocx account grok-reset-coupons [<account-id>] [--consume --yes] [--token-id <token-id>] [--json]
-  ocx account main <doctor|list|register|add|switch|recover> ...
+  ocx account main <doctor|list|register|add|reauth|switch|recover> ...
 
 List and switch provider accounts and API-key pools (masked output only).
 'main' selects the Codex App login for the openai account pool.`;
diff --git a/src/cli/capabilities.ts b/src/cli/capabilities.ts
index 63cf313676..52481b4adf 100644
--- a/src/cli/capabilities.ts
+++ b/src/cli/capabilities.ts
@@ -235,6 +235,28 @@ export const CAPABILITIES: readonly Capability[] = [
       "Headless services usually have no unlocked keychain session; prefer ${ENV_VAR} references there.",
     ],
   },
+  {
+    command: ["account", "main", "reauth"],
+    summary: "Reauthenticate the native main Codex login with a device code (#3898); headless hubs need no Codex App or keyring.",
+    routes: [
+      { method: "POST", path: "/api/codex-auth/main/reauth-device" },
+      { method: "GET", path: "/api/codex-auth/main/reauth-device" },
+      { method: "DELETE", path: "/api/codex-auth/main/reauth-device" },
+    ],
+    flags: [
+      { name: "--device", value: "boolean", summary: "Run the device-code flow (the only reauth mode)." },
+      { name: "--no-wait", value: "boolean", summary: "Print the flow handle and code without waiting for completion." },
+      { name: "--flow", value: "string", summary: "Flow id for status and cancel." },
+      { name: "--json", value: "boolean", summary: "Emit the flow status as JSON." },
+    ],
+    mutates: true,
+    json: "payload",
+    details: [
+      "Same-identity reauth only: the device login must complete for the ChatGPT account that already holds the native main slot, and the commit is fenced by the exclusive claim plus a path/hash/inode snapshot.",
+      "/api/codex-auth/login stays pool-only and keeps rejecting __main__; this namespace is the only device-reauth surface for the native main slot.",
+      "Payloads carry only flowId, status, the verification URL, the device code, and a closed set of failure codes -- never tokens, emails, or raw account ids.",
+    ],
+  },
   {
     command: ["account", "list"],
     summary: "Codex OAuth accounts with pool priority and pause state.",
diff --git a/src/codex/main-account.ts b/src/codex/main-account.ts
index a412046797..45efe351d7 100644
--- a/src/codex/main-account.ts
+++ b/src/codex/main-account.ts
@@ -21,6 +21,7 @@ import { clearAccountNeedsReauth } from "./account-runtime-state";
 import { advanceCodexCredentialMutationEpoch } from "./credential-mutation-epoch";
 import { withNativeMainExclusiveClaim } from "./native-main-claim";
 import { resolveNativeProfileContext } from "./native-profile-store";
+import { isNativeMainTrafficBlocked } from "./native-profile-startup";
 
 export { MAIN_CODEX_ACCOUNT_ID } from "./account-id";
 
@@ -218,6 +219,118 @@ export function setMainAuthJsonBeforeRenameHookForTests(hook: (() => void) | nul
   beforeMainAuthJsonRenameForTests = hook;
 }
 
+/** Complete token set a native device reauth commits into the main slot (#3898). */
+export interface NativeMainReauthTokens {
+  accessToken: string;
+  refreshToken: string;
+  idToken: string;
+  chatgptAccountId: string;
+}
+
+export class NativeMainReauthUnavailableError extends Error {
+  constructor(message = "Native main credential cannot be reauthenticated in this state") {
+    super(message);
+    this.name = "NativeMainReauthUnavailableError";
+  }
+}
+
+export class NativeMainReauthIdentityMismatchError extends Error {
+  constructor() {
+    super("Device login completed for a different ChatGPT account than the native main identity");
+    this.name = "NativeMainReauthIdentityMismatchError";
+  }
+}
+
+/**
+ * The reauth twin of persistRefreshedMainAuthJson (#3898). That function
+ * spreads expected.tokens and never writes id_token, which would keep the
+ * OLD identity token beside the new grant; this sibling sets all four
+ * credential fields together and overwrites any prior id_token. Everything
+ * else — allowed root metadata, the pre-rename snapshot guards, the
+ * mutation epoch — follows the refresh path exactly.
+ */
+function persistNativeMainReauthTokens(
+  expected: MainAuthJsonCredential,
+  tokens: NativeMainReauthTokens,
+): void {
+  assertNotRealCodexHomeUnderTest(resolveCodexHomeDir());
+  const nextTokens = {
+    ...expected.tokens,
+    access_token: tokens.accessToken,
+    refresh_token: tokens.refreshToken,
+    id_token: tokens.idToken,
+    account_id: tokens.chatgptAccountId,
+  };
+  atomicWriteFile(
+    expected.path,
+    JSON.stringify({ ...expected.root, tokens: nextTokens }, null, 2) + "\n",
+    undefined,
+    {
+      beforeRename: () => {
+        assertMainAuthJsonSnapshotUnchanged(expected);
+        const hook = beforeMainAuthJsonRenameForTests;
+        beforeMainAuthJsonRenameForTests = null;
+        hook?.();
+      },
+      validateBeforeRename: () => assertMainAuthJsonSnapshotUnchanged(expected),
+    },
+  );
+  advanceCodexCredentialMutationEpoch();
+}
+
+/**
+ * Prepare a same-identity reauth of the native __main__ slot (#3898).
+ *
+ * The existing credential snapshot is captured NOW and held only inside the
+ * closure — callers (the device-reauth service) never see the expected
+ * account id, so a flow cannot be steered toward a different identity. No
+ * claim is held while the human completes the device page. The returned
+ * commit, called once the device grant exists:
+ *
+ *  1. requires the SAME chatgpt account identity as the snapshot;
+ *  2. acquires the owner-independent exclusive claim (native-main-claim) —
+ *     deliberately NOT assertNativeMainOwner, which a headless hub cannot
+ *     satisfy;
+ *  3. re-verifies the snapshot (path + hash + dev/ino) inside the claim;
+ *  4. writes access/refresh/id token + account_id atomically and clears the
+ *     main account's reauth quarantine for the new credential generation.
+ */
+export function beginNativeMainReauth(): {
+  commit: (tokens: NativeMainReauthTokens) => Promise<{ chatgptAccountId: string }>;
+} {
+  const expected = readMainAuthJsonCredential();
+  if (!expected || !expected.chatgptAccountId) {
+    throw new NativeMainReauthUnavailableError(
+      "No native main credential exists to reauthenticate; enrollment is the native profile workflow",
+    );
+  }
+  return {
+    async commit(tokens: NativeMainReauthTokens): Promise<{ chatgptAccountId: string }> {
+      if (!tokens.accessToken || !tokens.refreshToken || !tokens.idToken) {
+        throw new NativeMainReauthUnavailableError("Device grant did not produce a complete token set");
+      }
+      if (tokens.chatgptAccountId !== expected.chatgptAccountId) {
+        throw new NativeMainReauthIdentityMismatchError();
+      }
+      return withNativeMainExclusiveClaim(resolveNativeProfileContext(), async () => {
+        // Recovery/admission recheck (080): a recovery-blocked or not-ready
+        // home fails native_main_unavailable rather than rewriting auth.json
+        // underneath the gate. The claim waits bounded like the refresh path
+        // (30s) so a busy claim is not an instant refusal.
+        if (isNativeMainTrafficBlocked()) {
+          throw new NativeMainReauthUnavailableError(
+            "Native main traffic is blocked by startup or recovery state",
+          );
+        }
+        assertMainAuthJsonSnapshotUnchanged(expected);
+        persistNativeMainReauthTokens(expected, tokens);
+        clearAccountNeedsReauth(MAIN_CODEX_ACCOUNT_ID);
+        return { chatgptAccountId: tokens.chatgptAccountId };
+      }, { waitMs: 30_000 });
+    },
+  };
+}
+
 async function resolveMainAccountToken(
   dependencies: NativeMainRefreshDependencies = {},
   rejectedAccessToken?: string,
diff --git a/src/codex/main-device-reauth-api.ts b/src/codex/main-device-reauth-api.ts
new file mode 100644
index 0000000000..538a4ead58
--- /dev/null
+++ b/src/codex/main-device-reauth-api.ts
@@ -0,0 +1,89 @@
+import type { OcxConfig } from "../types";
+import { jsonResponse } from "../server/auth-cors";
+import {
+  cancelMainDeviceReauth,
+  getMainDeviceReauthStatus,
+  MainDeviceReauthFlowBusyError,
+  startMainDeviceReauth,
+} from "./main-device-reauth";
+import { NativeMainReauthUnavailableError } from "./main-account";
+
+/**
+ * Dedicated native-main device reauth route (#3898).
+ *
+ * `/api/codex-auth/login` stays pool-only and keeps rejecting __main__;
+ * this namespace is the only device-reauth surface for the native main slot.
+ * DTOs carry flowId/status/verificationUrl/deviceCode and safe failure codes
+ * — never tokens, emails, or raw account ids. The route is registered in
+ * management-api ahead of the generic /api/codex-auth/* dispatch, so the
+ * existing management origin/auth/session controls wrap it unchanged.
+ */
+
+const ROUTE = "/api/codex-auth/main/reauth-device";
+
+function errorResponse(
+  req: Request,
+  config: OcxConfig,
+  message: string,
+  code: string,
+  status: number,
+): Response {
+  return jsonResponse({ error: message, code }, status, req, config);
+}
+
+function flowIdFromQuery(url: URL): string | null {
+  for (const key of url.searchParams.keys()) {
+    if (key !== "flowId") return null;
+  }
+  const flowId = url.searchParams.get("flowId");
+  return flowId && flowId.trim() ? flowId : null;
+}
+
+export async function handleMainDeviceReauthAPI(
+  req: Request,
+  url: URL,
+  config: OcxConfig,
+): Promise<Response | null> {
+  if (url.pathname !== ROUTE) return null;
+
+  if (req.method === "POST") {
+    // Strict body: no request keys exist for start; anything supplied is an error.
+    const text = await req.text();
+    if (text.trim()) {
+      return errorResponse(req, config, "The reauth-device start takes no request body", "invalid_request", 400);
+    }
+    try {
+      return jsonResponse(startMainDeviceReauth(), 200, req, config);
+    } catch (error) {
+      if (error instanceof MainDeviceReauthFlowBusyError) {
+        return errorResponse(req, config, error.message, error.code, 409);
+      }
+      if (error instanceof NativeMainReauthUnavailableError) {
+        return errorResponse(req, config, error.message, "native_main_unavailable", 503);
+      }
+      throw error;
+    }
+  }
+
+  if (req.method === "GET") {
+    const flowId = flowIdFromQuery(url);
+    if (!flowId) {
+      return errorResponse(req, config, "An exact flowId query is required", "invalid_request", 400);
+    }
+    const status = getMainDeviceReauthStatus(flowId);
+    if (!status) return errorResponse(req, config, "Unknown or expired reauth flow", "unknown_flow", 404);
+    return jsonResponse(status, 200, req, config);
+  }
+
+  if (req.method === "DELETE") {
+    const flowId = flowIdFromQuery(url);
+    if (!flowId) {
+      return errorResponse(req, config, "An exact flowId query is required", "invalid_request", 400);
+    }
+    const status = cancelMainDeviceReauth(flowId);
+    if (!status) return errorResponse(req, config, "Unknown or expired reauth flow", "unknown_flow", 404);
+    return jsonResponse(status, 200, req, config);
+  }
+
+  return errorResponse(req, config, "Method not allowed", "method_not_allowed", 405);
+}
diff --git a/src/codex/main-device-reauth.ts b/src/codex/main-device-reauth.ts
new file mode 100644
index 0000000000..1f6ede5215
--- /dev/null
+++ b/src/codex/main-device-reauth.ts
@@ -0,0 +1,217 @@
+import { randomUUID } from "node:crypto";
+import { loginChatGPTNativeDevice, type NativeDeviceLogin } from "../oauth/chatgpt-device";
+import type { OAuthController } from "../oauth/types";
+import {
+  beginNativeMainReauth,
+  MainAuthJsonChangedDuringRefreshError,
+  NativeMainReauthIdentityMismatchError,
+  NativeMainReauthUnavailableError,
+  type NativeMainReauthTokens,
+} from "./main-account";
+
+/**
+ * Process-owned native-main device reauth flow (#3898).
+ *
+ * Exactly one active flow per process, started from the management API or the
+ * CLI. The human-facing DTO carries only flowId, status, the verification
+ * URL and the device code: tokens, emails, and raw account ids never leave
+ * the device/grant layer, and the opaque device_auth_id never leaves
+ * chatgpt-device.ts at all. The grant runs on this flow's own
+ * AbortController — deliberately NOT through startLoginFlow("chatgpt"),
+ * which would overwrite the pool scratch slot and collide with pool logins.
+ */
+
+export type MainDeviceReauthStatus =
+  | { flowId: string; status: "pending"; verificationUrl: string; deviceCode: string }
+  | { flowId: string; status: "committing" }
+  | { flowId: string; status: "succeeded"; credentialUpdated: true }
+  | { flowId: string; status: "cancelled" }
+  | {
+      flowId: string;
+      status: "failed";
+      credentialUpdated?: true;
+      code:
+        | "identity_mismatch"
+        | "credential_changed"
+        | "native_main_unavailable"
+        | "device_authorization_failed"
+        | "publication_failed"
+        | "reconciliation_failed";
+    };
+
+export class MainDeviceReauthFlowBusyError extends Error {
+  readonly code = "flow_in_progress";
+  constructor() {
+    super("A native main device reauth is already in progress");
+    this.name = "MainDeviceReauthFlowBusyError";
+  }
+}
+
+interface ActiveFlow {
+  flowId: string;
+  controller: AbortController;
+  status: MainDeviceReauthStatus;
+  /** Set once auth.json has been replaced; cancellation can no longer win. */
+  published: boolean;
+  /** Snapshot-holding commit prepared at start; closure-private identity. */
+  prepared?: { commit: (tokens: NativeMainReauthTokens) => Promise<{ chatgptAccountId: string }> };
+}
+
+/** Bounded terminal retention so status/cancel stay answerable after completion. */
+const TERMINAL_RETENTION_MS = 300_000;
+
+let activeFlow: ActiveFlow | null = null;
+const terminalFlows = new Map<string, { status: MainDeviceReauthStatus; expiresAt: number }>();
+
+export interface MainDeviceReauthDeps {
+  login?: (ctrl: OAuthController) => Promise<NativeDeviceLogin>;
+  beginCommit?: () => { commit: (tokens: NativeMainReauthTokens) => Promise<{ chatgptAccountId: string }> };
+  flowId?: () => string;
+  now?: () => number;
+}
+
+function isTerminal(status: MainDeviceReauthStatus): boolean {
+  return status.status === "succeeded" || status.status === "cancelled" || status.status === "failed";
+}
+
+function sweepTerminal(now: number): void {
+  for (const [flowId, row] of terminalFlows) {
+    if (row.expiresAt <= now) terminalFlows.delete(flowId);
+  }
+}
+
+function finish(flow: ActiveFlow, status: MainDeviceReauthStatus, now: number): void {
+  // Publication beats a racing cancellation: once auth.json was replaced the
+  // honest terminal is succeeded, never cancelled (080). Every other terminal
+  // is first-write-wins so a superseded or cancelled completion cannot
+  // publish a later result.
+  if (isTerminal(flow.status)) {
+    if (!(flow.published && status.status === "succeeded")) return;
+  }
+  if (status.status === "succeeded") flow.published = true;
+  flow.status = status;
+  terminalFlows.set(flow.flowId, { status, expiresAt: now + TERMINAL_RETENTION_MS });
+}
+
+function mapFailure(flowId: string, error: unknown): MainDeviceReauthStatus {
+  if (error instanceof NativeMainReauthIdentityMismatchError) {
+    return { flowId, status: "failed", code: "identity_mismatch" };
+  }
+  if (error instanceof MainAuthJsonChangedDuringRefreshError) {
+    return { flowId, status: "failed", code: "credential_changed" };
+  }
+  if (error instanceof NativeMainReauthUnavailableError) {
+    return { flowId, status: "failed", code: "native_main_unavailable" };
+  }
+  const code = (error as { code?: unknown } | null)?.code;
+  if (code === "NATIVE_MAIN_CLAIM_UNAVAILABLE" || code === "NATIVE_MAIN_OWNER_UNAVAILABLE") {
+    return { flowId, status: "failed", code: "native_main_unavailable" };
+  }
+  const name = (error as { name?: unknown } | null)?.name;
+  if (name === "TimeoutError" || name === "AbortError") {
+    return { flowId, status: "failed", code: "device_authorization_failed" };
+  }
+  if (error instanceof Error && /device authorization/.test(error.message)) {
+    return { flowId, status: "failed", code: "device_authorization_failed" };
+  }
+  return { flowId, status: "failed", code: "publication_failed" };
+}
+
+/**
+ * Start the one active flow. Returns the pending status; the URL/code arrive
+ * with the usercode response and are visible through the status endpoint.
+ */
+export function startMainDeviceReauth(deps: MainDeviceReauthDeps = {}): MainDeviceReauthStatus {
+  const now = (deps.now ?? Date.now)();
+  sweepTerminal(now);
+  if (activeFlow && !isTerminal(activeFlow.status)) throw new MainDeviceReauthFlowBusyError();
+  const flowId = (deps.flowId ?? randomUUID)();
+  const flow: ActiveFlow = {
+    flowId,
+    controller: new AbortController(),
+    status: { flowId, status: "pending", verificationUrl: "", deviceCode: "" },
+    published: false,
+  };
+  // Claim the singleflight slot BEFORE preparing: two overlapping starts must
+  // not both snapshot and then have one throw flow_in_progress after the
+  // other already began polling.
+  activeFlow = flow;
+  try {
+    // Prepare NOW: the existing credential snapshot is captured at start (080),
+    // so a hub with no reauthenticatable main credential fails fast with
+    // native_main_unavailable instead of after the human completes the page.
+    flow.prepared = (deps.beginCommit ?? beginNativeMainReauth)();
+  } catch (error) {
+    activeFlow = null;
+    throw error;
+  }
+  const login = deps.login ?? loginChatGPTNativeDevice;
+  const clock = deps.now ?? Date.now;
+  void (async () => {
+    try {
+      const grant = await login({
+        signal: flow.controller.signal,
+        onAuth: info => {
+          // A superseded or cancelled flow may not publish its URL/code.
+          if (activeFlow !== flow || isTerminal(flow.status)) return;
+          flow.status = {
+            flowId,
+            status: "pending",
+            verificationUrl: info.url,
+            deviceCode: info.deviceCode ?? "",
+          };
+        },
+      });
+      if (flow.controller.signal.aborted) return;
+      if (!isTerminal(flow.status)) flow.status = { flowId, status: "committing" };
+      // Recheck immediately before the write: a cancel that landed while the
+      // grant was resolving must not reach auth.json. Once the commit DOES
+      // publish, the terminal is succeeded even if a cancel raced it (080).
+      if (activeFlow !== flow || flow.controller.signal.aborted || isTerminal(flow.status)) return;
+      await flow.prepared!.commit({
+        accessToken: grant.credential.access,
+        refreshToken: grant.credential.refresh,
+        idToken: grant.idToken,
+        chatgptAccountId: grant.credential.accountId!,
+      });
+      flow.published = true;
+      finish(flow, { flowId, status: "succeeded", credentialUpdated: true }, clock());
+    } catch (error) {
+      if (flow.controller.signal.aborted && !flow.published) return;
+      finish(flow, mapFailure(flowId, error), clock());
+    }
+  })();
+  return flow.status;
+}
+
+export function getMainDeviceReauthStatus(flowId: string, deps: MainDeviceReauthDeps = {}): MainDeviceReauthStatus | null {
+  const now = (deps.now ?? Date.now)();
+  sweepTerminal(now);
+  if (activeFlow?.flowId === flowId) return activeFlow.status;
+  return terminalFlows.get(flowId)?.status ?? null;
+}
+
+/**
+ * Cancel the flow. Cancellation after publication returns the published
+ * terminal (succeeded), never cancelled; a pending/committing flow aborts its
+ * grant and settles cancelled.
+ */
+export function cancelMainDeviceReauth(flowId: string, deps: MainDeviceReauthDeps = {}): MainDeviceReauthStatus | null {
+  const now = (deps.now ?? Date.now)();
+  sweepTerminal(now);
+  if (activeFlow?.flowId === flowId && !isTerminal(activeFlow.status)) {
+    activeFlow.controller.abort();
+    finish(activeFlow, { flowId, status: "cancelled" }, now);
+    return activeFlow.status;
+  }
+  return terminalFlows.get(flowId)?.status ?? null;
+}
+
+/** Test hook: drop all in-memory flow state. Production never calls this. */
+export function resetMainDeviceReauthForTests(): void {
+  // Abort first: a reset that only clears the maps leaves a pending grant
+  // polling against real timers for up to the 15-minute device TTL.
+  activeFlow?.controller.abort();
+  activeFlow = null;
+  terminalFlows.clear();
+}
diff --git a/src/oauth/chatgpt-device.ts b/src/oauth/chatgpt-device.ts
index 74fbeeabd9..8151a12354 100644
--- a/src/oauth/chatgpt-device.ts
+++ b/src/oauth/chatgpt-device.ts
@@ -23,6 +23,19 @@ export const DEVICE_VERIFICATION_URL = "https://auth.openai.com/codex/device";
 
 /** The grant's own lifetime. Polling past this only produces a worse error message. */
 const DEVICE_FLOW_TTL_MS = 15 * 60 * 1000;
+/**
+ * Per-fetch deadline for every device-flow HTTP call (#3898). Until this
+ * existed the only bounds were the 15-minute grant TTL and the caller's
+ * abort, so one stuck TCP connection could hold the login slot for the whole
+ * grant. A FRESH timeout per fetch attempt is required — a single timeout
+ * shared across the poll loop would kill the 15-minute grant.
+ */
+export const DEVICE_FETCH_TIMEOUT_MS = 30_000;
+
+function deviceFetchSignal(signal?: AbortSignal): AbortSignal {
+  const timeout = AbortSignal.timeout(DEVICE_FETCH_TIMEOUT_MS);
+  return signal ? AbortSignal.any([signal, timeout]) : timeout;
+}
 const DEFAULT_POLL_INTERVAL_MS = 5_000;
 const MIN_POLL_INTERVAL_MS = 1_000;
 /**
@@ -86,7 +99,7 @@ async function requestUserCode(signal?: AbortSignal): Promise<DeviceUserCode> {
     method: "POST",
     headers: { "Content-Type": "application/json" },
     body: JSON.stringify({ client_id: CHATGPT_CLIENT_ID }),
-    signal,
+    signal: deviceFetchSignal(signal),
   });
   if (!response.ok) throw deviceError("request", response.status);
   const payload = (await response.json()) as Record<string, unknown>;
@@ -123,7 +136,7 @@ async function pollForGrant(
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({ device_auth_id: device.deviceAuthId, user_code: device.userCode }),
-      signal,
+      signal: deviceFetchSignal(signal),
     });
     if (response.status === 403 || response.status === 404) {
       // Cap the wait at the time actually left. Sleeping a full interval past
@@ -149,7 +162,7 @@ async function pollForGrant(
   throw new Error("ChatGPT device authorization expired");
 }
 
-async function exchangeGrant(grant: DeviceGrant, signal?: AbortSignal): Promise<OAuthCredentials> {
+async function exchangeGrantRaw(grant: DeviceGrant, signal?: AbortSignal): Promise<Record<string, unknown>> {
   const response = await fetch(CHATGPT_TOKEN_URL, {
     method: "POST",
     headers: { "Content-Type": "application/x-www-form-urlencoded" },
@@ -160,10 +173,54 @@ async function exchangeGrant(grant: DeviceGrant, signal?: AbortSignal): Promise<
       code_verifier: grant.codeVerifier,
       redirect_uri: DEVICE_REDIRECT_URI,
     }).toString(),
-    signal,
+    signal: deviceFetchSignal(signal),
   });
   if (!response.ok) throw deviceError("token exchange", response.status);
-  return credsFromToken((await response.json()) as Record<string, unknown>);
+  return (await response.json()) as Record<string, unknown>;
+}
+
+async function exchangeGrant(grant: DeviceGrant, signal?: AbortSignal): Promise<OAuthCredentials> {
+  return credsFromToken(await exchangeGrantRaw(grant, signal));
+}
+
+/**
+ * The native-main reauth result (#3898): the projected credential PLUS the
+ * id_token the pool projection deliberately drops. The id_token is the
+ * identity document the native auth.json requires
+ * (native-profile-store.ts), and it never leaves this process — it is
+ * written to the native main slot by the caller, never serialized into a
+ * DTO, log, or error.
+ */
+export interface NativeDeviceLogin {
+  credential: OAuthCredentials;
+  idToken: string;
+}
+
+async function exchangeGrantNative(grant: DeviceGrant, signal?: AbortSignal): Promise<NativeDeviceLogin> {
+  const payload = await exchangeGrantRaw(grant, signal);
+  const credential = credsFromToken(payload);
+  const idToken = nonEmptyString(payload.id_token);
+  if (!idToken) throw new Error("ChatGPT device token response missing id_token");
+  if (!credential.refresh) throw new Error("ChatGPT device token response missing refresh token");
+  if (!credential.accountId) throw new Error("ChatGPT device token response missing account identity");
+  return { credential, idToken };
+}
+
+/**
+ * Device flow for the native __main__ slot. Same grant as the pool flow, but
+ * nothing is persisted here and no OAuth store is touched: the caller
+ * (main-device-reauth service) owns the fenced commit into CODEX_HOME
+ * auth.json.
+ */
+export async function loginChatGPTNativeDevice(ctrl: OAuthController): Promise<NativeDeviceLogin> {
+  const device = await requestUserCode(ctrl.signal);
+  ctrl.onAuth?.({
+    url: DEVICE_VERIFICATION_URL,
+    instructions: `Enter code: ${device.userCode}`,
+    deviceCode: device.userCode,
+  });
+  const grant = await pollForGrant(device, ctrl.signal);
+  return exchangeGrantNative(grant, ctrl.signal);
 }
 
 /**
diff --git a/src/server/management-api.ts b/src/server/management-api.ts
index 19b6aeec25..3eb0d775fa 100644
--- a/src/server/management-api.ts
+++ b/src/server/management-api.ts
@@ -388,6 +388,13 @@ export async function handleManagementAPI(
   }
 
   if (url.pathname.startsWith("/api/codex-auth/")) {
+    // Native-main device reauth (#3898): a dedicated namespace the generic
+    // codex-auth dispatch must not swallow (it would 404 as an unknown pool
+    // route). Same management origin/auth/session wrapping as every /api/*.
+    if (url.pathname === "/api/codex-auth/main/reauth-device") {
+      const { handleMainDeviceReauthAPI } = await import("../codex/main-device-reauth-api");
+      return handleMainDeviceReauthAPI(req, url, config);
+    }
     const { handleCodexAuthAPI } = await import("../codex/auth-api");
     const { ConfigMutationLockError } = await import("../config");
     const { CodexCredentialRefreshLockTimeoutError } = await import("../codex/account-store");
diff --git a/src/server/management/route-registry.ts b/src/server/management/route-registry.ts
index 9fb71e662c..105cdb2ba6 100644
--- a/src/server/management/route-registry.ts
+++ b/src/server/management/route-registry.ts
@@ -96,6 +96,11 @@ export const MANAGEMENT_ROUTES: readonly ManagementRoute[] = [
   { method: "POST", path: "/api/codex-auth/accounts", module: "codex/auth-api", mutates: true },
   { method: "POST", path: "/api/codex-auth/accounts/clear-cooldown", module: "codex/auth-api", mutates: true },
   { method: "POST", path: "/api/codex-auth/accounts/refresh", module: "codex/auth-api", mutates: true },
+  // codex/main-device-reauth-api (#3898): the native-main device reauth namespace;
+  // /api/codex-auth/login stays pool-only and keeps rejecting __main__.
+  { method: "POST", path: "/api/codex-auth/main/reauth-device", module: "codex/main-device-reauth-api", mutates: true },
+  { method: "GET", path: "/api/codex-auth/main/reauth-device", module: "codex/main-device-reauth-api", mutates: false },
+  { method: "DELETE", path: "/api/codex-auth/main/reauth-device", module: "codex/main-device-reauth-api", mutates: true },
   { method: "POST", path: "/api/codex-auth/login", module: "codex/auth-api", mutates: true },
   { method: "POST", path: "/api/codex-auth/login/cancel", module: "codex/auth-api", mutates: true },
   { method: "POST", path: "/api/codex-auth/login/code", module: "codex/auth-api", mutates: true },
diff --git a/structure/codex-home.md b/structure/codex-home.md
index a25eb8d326..66ef2cb583 100644
--- a/structure/codex-home.md
+++ b/structure/codex-home.md
@@ -82,6 +82,19 @@ subsystem from fencing native traffic or creating lock contention. Presence, an
 or any observation error still takes the locked sweep and fails closed; the fast path is based only
 on proven absence, never on an unreadable path.
 
+The native main slot also accepts one same-identity device reauth (#3898):
+`/api/codex-auth/main/reauth-device` (start/status/cancel) plus
+`ocx account main reauth`. The grant is the OpenAI deviceauth grant already
+used for pool accounts, but nothing routes through the pool login surface —
+`/api/codex-auth/login` keeps rejecting `__main__` — and the commit is a
+sibling of the refresh write: same-identity check against the snapshot
+captured at start, owner-independent exclusive claim (a headless hub runs no
+owner lifecycle), path/hash/inode re-verification inside the claim, and one
+atomic write of access/refresh/id token + account_id. The old identity token
+is never retained beside the new grant. No claim is held while the human
+completes the device page, and no DTO, log, or error carries tokens, emails,
+or raw account ids.
+
 > Decision record: [ADR-0008](decisions/ADR-0008-codex-home.md)
 
 The native-write coordinator is keyed by the canonical `CODEX_HOME` in the effective-user runtime
diff --git a/tests/cli/cli-native-profile.test.ts b/tests/cli/cli-native-profile.test.ts
index c1930a8e27..bbd5b23204 100644
--- a/tests/cli/cli-native-profile.test.ts
+++ b/tests/cli/cli-native-profile.test.ts
@@ -167,6 +167,48 @@ describe("ocx account main", () => {
     expect([...output, ...errors].join("\n")).not.toContain(clientHome);
   });
 
+  test("main reauth drives the dedicated native device namespace (#3898)", async () => {
+    const requests: Array<{ method?: string; path: string }> = [];
+    const output: string[] = [];
+    const errors: string[] = [];
+    console.log = (...values: unknown[]) => output.push(values.join(" "));
+    console.error = (...values: unknown[]) => errors.push(values.join(" "));
+    const fetchImpl: typeof fetch = async (input, init) => {
+      const url = new URL(String(input));
+      requests.push({ method: init?.method, path: url.pathname + url.search });
+      if (url.pathname.endsWith("/main/reauth-device") && init?.method === "POST") {
+        return Response.json({ flowId: "flow-1", status: "pending", verificationUrl: "https://auth.openai.com/codex/device", deviceCode: "ABCD-1234" });
+      }
+      if (url.pathname.endsWith("/main/reauth-device") && init?.method === "GET") {
+        return Response.json({ flowId: "flow-1", status: "succeeded", credentialUpdated: true });
+      }
+      if (url.pathname.endsWith("/main/reauth-device") && init?.method === "DELETE") {
+        return Response.json({ flowId: "flow-1", status: "cancelled" });
+      }
+      return Response.json({ error: "unexpected" }, { status: 500 });
+    };
+    const deps = { baseUrl: "http://127.0.0.1:10100", fetchImpl };
+
+    expect(await cmdAccount(["main", "reauth", "--device", "--no-wait"], deps)).toBe(0);
+    expect(requests[0]).toEqual({ method: "POST", path: "/api/codex-auth/main/reauth-device" });
+    expect(output.join(" ")).toContain("ABCD-1234");
+    expect(output.join(" ")).toContain("auth.openai.com/codex/device");
+    expect(output.join(" ")).toContain("--flow flow-1");
+
+    expect(await cmdAccount(["main", "reauth", "status", "--flow", "flow-1"], deps)).toBe(0);
+    expect(requests.at(-1)).toEqual({ method: "GET", path: "/api/codex-auth/main/reauth-device?flowId=flow-1" });
+    expect(output.join(" ")).toContain("succeeded");
+
+    expect(await cmdAccount(["main", "reauth", "cancel", "--flow", "flow-1"], deps)).toBe(0);
+    expect(requests.at(-1)).toEqual({ method: "DELETE", path: "/api/codex-auth/main/reauth-device?flowId=flow-1" });
+    expect(output.join(" ")).toContain("cancelled");
+
+    expect(await cmdAccount(["main", "reauth", "--device", "extra"], deps)).toBe(1);
+    expect(await cmdAccount(["main", "reauth"], deps)).toBe(1);
+    // The pool login route is never touched for __main__.
+    expect(JSON.stringify(requests)).not.toContain("/api/codex-auth/login");
+    expect(errors.join(" ")).not.toContain("access_token");
+  });
   test("JSON mutating output preserves the server's canonical effective home", async () => {
     const effectiveHome = join(tmpdir(), "ocx-native-profile-json-effective-home");
     process.env.CODEX_HOME = join(tmpdir(), "ocx-native-profile-json-client-home");
diff --git a/tests/codex-integration/main-device-reauth-api.test.ts b/tests/codex-integration/main-device-reauth-api.test.ts
new file mode 100644
index 0000000000..64b6d35fba
--- /dev/null
+++ b/tests/codex-integration/main-device-reauth-api.test.ts
@@ -0,0 +1,146 @@
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { mkdtempSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { handleMainDeviceReauthAPI } from "../../src/codex/main-device-reauth-api";
+import { resetMainDeviceReauthForTests } from "../../src/codex/main-device-reauth";
+import type { OcxConfig } from "../../src/types";
+import { removeTreeWithRetry } from "../helpers/remove-tree";
+
+/**
+ * #3898 route contract: /api/codex-auth/main/reauth-device is the only
+ * device-reauth surface for the native main slot. Safe 400/404/405/409/503
+ * shapes, strict request keys, and no token material in any payload.
+ */
+
+const ROUTE = "http://localhost/api/codex-auth/main/reauth-device";
+const USERCODE = "https://auth.openai.com/api/accounts/deviceauth/usercode";
+const DEVICE_TOKEN = "https://auth.openai.com/api/accounts/deviceauth/token";
+
+const realFetch = globalThis.fetch;
+let home: string;
+let previousCodexHome: string | undefined;
+
+const config = { port: 0 } as OcxConfig;
+
+function call(method: string, query = "", body?: string): Promise<Response | null> {
+  const url = new URL(ROUTE + query);
+  const req = body === undefined
+    ? new Request(url, { method })
+    : new Request(url, { method, body, headers: { "content-type": "application/json" } });
+  return handleMainDeviceReauthAPI(req, url, config);
+}
+
+/** Device endpoints that stay pending forever, so the flow never leaves pending. */
+function stubPendingDevice(): void {
+  globalThis.fetch = (async (input: RequestInfo | URL) => {
+    const url = typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
+    if (url === USERCODE) {
+      return new Response(JSON.stringify({
+        device_auth_id: "auth-id-opaque",
+        user_code: "ABCD-1234",
+      }), { status: 200, headers: { "Content-Type": "application/json" } });
+    }
+    if (url === DEVICE_TOKEN) {
+      return new Response("{}", { status: 403, headers: { "Content-Type": "application/json" } });
+    }
+    throw new Error(`unexpected fetch: ${url}`);
+  }) as typeof fetch;
+}
+
+beforeEach(() => {
+  resetMainDeviceReauthForTests();
+  home = mkdtempSync(join(tmpdir(), "ocx-main-reauth-api-"));
+  previousCodexHome = process.env.CODEX_HOME;
+  process.env.CODEX_HOME = home;
+});
+
+afterEach(() => {
+  globalThis.fetch = realFetch;
+  resetMainDeviceReauthForTests();
+  if (previousCodexHome === undefined) delete process.env.CODEX_HOME;
+  else process.env.CODEX_HOME = previousCodexHome;
+  removeTreeWithRetry(home);
+});
+
+function writeMainCredential(): void {
+  writeFileSync(join(home, "auth.json"), JSON.stringify({
+    auth_mode: "chatgpt",
+    tokens: {
+      access_token: "old-access",
+      refresh_token: "old-refresh",
+      account_id: "acct-main-1",
+    },
+  }));
+}
+
+describe("native main device reauth route (#3898)", () => {
+  test("other paths fall through", async () => {
+    const url = new URL("http://localhost/api/codex-auth/login");
+    const handled = await handleMainDeviceReauthAPI(new Request(url, { method: "POST" }), url, config);
+    expect(handled).toBeNull();
+  });
+
+  test("start without a native credential answers 503 native_main_unavailable", async () => {
+    const response = await call("POST");
+    expect(response?.status).toBe(503);
+    const body = await response!.json() as { code: string };
+    expect(body.code).toBe("native_main_unavailable");
+  });
+
+  test("start rejects an unexpected body", async () => {
+    writeMainCredential();
+    const response = await call("POST", "", JSON.stringify({ id: "__main__" }));
+    expect(response?.status).toBe(400);
+  });
+
+  test("status requires an exact flowId query", async () => {
+    expect((await call("GET"))?.status).toBe(400);
+    expect((await call("GET", "?flowId="))?.status).toBe(400);
+    expect((await call("GET", "?flowId=x&extra=1"))?.status).toBe(400);
+  });
+
+  test("unknown flows answer 404 for status and cancel", async () => {
+    expect((await call("GET", "?flowId=nope"))?.status).toBe(404);
+    expect((await call("DELETE", "?flowId=nope"))?.status).toBe(404);
+  });
+
+  test("unsupported methods answer 405", async () => {
+    expect((await call("PUT"))?.status).toBe(405);
+  });
+
+  test("start, poll and cancel round trip with a pending device grant", async () => {
+    writeMainCredential();
+    stubPendingDevice();
+    const started = await call("POST");
+    expect(started?.status).toBe(200);
+    const pending = await started!.json() as { flowId: string; status: string };
+    expect(pending.status).toBe("pending");
+    // The URL/code arrive with the usercode response; give the microtask a turn.
+    await Bun.sleep(20);
+    const polled = await call("GET", `?flowId=${pending.flowId}`);
+    const polledBody = await polled!.json() as Record<string, unknown>;
+    expect(polledBody.status).toBe("pending");
+    expect(polledBody.deviceCode).toBe("ABCD-1234");
+    expect(String(polledBody.verificationUrl)).toContain("codex/device");
+    const cancelled = await call("DELETE", `?flowId=${pending.flowId}`);
+    expect(cancelled?.status).toBe(200);
+    expect(await cancelled!.json() as Record<string, unknown>).toMatchObject({ status: "cancelled" });
+    for (const payload of [pending, polledBody, await (await call("GET", `?flowId=${pending.flowId}`))!.json()]) {
+      const json = JSON.stringify(payload);
+      expect(json).not.toContain("old-access");
+      expect(json).not.toContain("old-refresh");
+      expect(json).not.toContain("acct-main-1");
+    }
+  });
+
+  test("a second start while active answers 409 flow_in_progress", async () => {
+    writeMainCredential();
+    stubPendingDevice();
+    const first = await call("POST");
+    expect(first?.status).toBe(200);
+    const second = await call("POST");
+    expect(second?.status).toBe(409);
+    expect((await second!.json() as { code: string }).code).toBe("flow_in_progress");
+  });
+});
diff --git a/tests/codex-integration/main-device-reauth.test.ts b/tests/codex-integration/main-device-reauth.test.ts
new file mode 100644
index 0000000000..48bef3bf84
--- /dev/null
+++ b/tests/codex-integration/main-device-reauth.test.ts
@@ -0,0 +1,327 @@
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { mkdtempSync, readFileSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import {
+  cancelMainDeviceReauth,
+  getMainDeviceReauthStatus,
+  MainDeviceReauthFlowBusyError,
+  resetMainDeviceReauthForTests,
+  startMainDeviceReauth,
+  type MainDeviceReauthStatus,
+} from "../../src/codex/main-device-reauth";
+import {
+  beginNativeMainReauth,
+  MainAuthJsonChangedDuringRefreshError,
+  NativeMainReauthIdentityMismatchError,
+  NativeMainReauthUnavailableError,
+  setMainAuthJsonBeforeRenameHookForTests,
+} from "../../src/codex/main-account";
+import type { NativeDeviceLogin } from "../../src/oauth/chatgpt-device";
+import type { OAuthController } from "../../src/oauth/types";
+import { removeTreeWithRetry } from "../helpers/remove-tree";
+
+/**
+ * #3898: the headless-hub native-main device reauth. One process-owned flow,
+ * same-identity fenced commit, and a DTO that can never carry tokens.
+ */
+
+function grant(accountId = "acct-main-1"): NativeDeviceLogin {
+  return {
+    credential: {
+      access: "new-access-token",
+      refresh: "new-refresh-token",
+      expires: Date.now() + 3600_000,
+      accountId,
+    } as NativeDeviceLogin["credential"],
+    idToken: "new-id-token",
+  };
+}
+
+function loginStub(
+  behavior: (ctrl: OAuthController) => Promise<NativeDeviceLogin>,
+): (ctrl: OAuthController) => Promise<NativeDeviceLogin> {
+  return behavior;
+}
+
+async function waitForTerminal(flowId: string, timeoutMs = 2_000): Promise<MainDeviceReauthStatus> {
+  const deadline = Date.now() + timeoutMs;
+  for (;;) {
+    const status = getMainDeviceReauthStatus(flowId);
+    if (status && status.status !== "pending" && status.status !== "committing") return status;
+    if (Date.now() > deadline) throw new Error(`flow ${flowId} never settled: ${JSON.stringify(status)}`);
+    await Bun.sleep(5);
+  }
+}
+
+beforeEach(() => resetMainDeviceReauthForTests());
+afterEach(() => resetMainDeviceReauthForTests());
+
+describe("native main device reauth flow (#3898)", () => {
+  test("start publishes the verification URL and human code, then succeeds", async () => {
+    const started = startMainDeviceReauth({
+      login: loginStub(async ctrl => {
+        ctrl.onAuth?.({ url: "https://auth.openai.com/codex/device", deviceCode: "ABCD-1234" });
+        return grant();
+      }),
+      beginCommit: () => ({ commit: async () => ({ chatgptAccountId: "acct-main-1" }) }),
+    });
+    expect(started.status).toBe("pending");
+    const pending = getMainDeviceReauthStatus(started.flowId);
+    expect(pending).toMatchObject({ status: "pending", deviceCode: "ABCD-1234" });
+    expect((pending as { verificationUrl?: string }).verificationUrl).toContain("codex/device");
+    const terminal = await waitForTerminal(started.flowId);
+    expect(terminal).toMatchObject({ status: "succeeded", credentialUpdated: true });
+  });
+
+  test("a second start while active is refused", () => {
+    let release!: (value: NativeDeviceLogin) => void;
+    const gate = new Promise<NativeDeviceLogin>(resolve => { release = resolve; });
+    startMainDeviceReauth({
+      login: loginStub(() => gate),
+      beginCommit: () => ({ commit: async () => ({ chatgptAccountId: "acct-main-1" }) }),
+    });
+    expect(() => startMainDeviceReauth({
+      login: loginStub(async () => grant()),
+      beginCommit: () => ({ commit: async () => ({ chatgptAccountId: "acct-main-1" }) }),
+    })).toThrow(MainDeviceReauthFlowBusyError);
+    release(grant());
+  });
+
+  test("identity mismatch fails without touching the credential", async () => {
+    const started = startMainDeviceReauth({
+      login: loginStub(async () => grant("acct-OTHER")),
+      beginCommit: () => ({
+        commit: async () => { throw new NativeMainReauthIdentityMismatchError(); },
+      }),
+    });
+    const terminal = await waitForTerminal(started.flowId);
+    expect(terminal).toMatchObject({ status: "failed", code: "identity_mismatch" });
+    expect((terminal as { credentialUpdated?: boolean }).credentialUpdated).toBeUndefined();
+  });
+
+  test("a cancelled flow cannot publish a late grant", async () => {
+    let release!: (value: NativeDeviceLogin) => void;
+    const gate = new Promise<NativeDeviceLogin>(resolve => { release = resolve; });
+    let commitCalled = false;
+    const started = startMainDeviceReauth({
+      login: loginStub(() => gate),
+      beginCommit: () => ({ commit: async () => { commitCalled = true; return { chatgptAccountId: "acct-main-1" }; } }),
+    });
+    const cancelled = cancelMainDeviceReauth(started.flowId);
+    expect(cancelled).toMatchObject({ status: "cancelled" });
+    release(grant());
+    await Bun.sleep(20);
+    expect(getMainDeviceReauthStatus(started.flowId)).toMatchObject({ status: "cancelled" });
+    expect(commitCalled).toBe(false);
+  });
+
+  test("a cancel landing as the grant resolves skips the commit entirely", async () => {
+    let commitCalled = false;
+    const started = startMainDeviceReauth({
+      flowId: () => "flow-cancel-at-resolve",
+      login: loginStub(async () => {
+        // The cancel lands after the grant exists but before the commit
+        // window: the write must not happen.
+        cancelMainDeviceReauth("flow-cancel-at-resolve");
+        return grant();
+      }),
+      beginCommit: () => ({
+        commit: async () => { commitCalled = true; return { chatgptAccountId: "acct-main-1" }; },
+      }),
+    });
+    await Bun.sleep(20);
+    expect(getMainDeviceReauthStatus(started.flowId)).toMatchObject({ status: "cancelled" });
+    expect(commitCalled).toBe(false);
+  });
+
+  test("a commit already in flight publishes; the cancel loses", async () => {
+    let releaseCommit!: () => void;
+    const commitGate = new Promise<void>(resolve => { releaseCommit = resolve; });
+    const started = startMainDeviceReauth({
+      login: loginStub(async () => grant()),
+      beginCommit: () => ({
+        commit: async () => { await commitGate; return { chatgptAccountId: "acct-main-1" }; },
+      }),
+    });
+    // Wait until the flow is committing, then cancel; the publication wins.
+    const deadline = Date.now() + 2_000;
+    while (getMainDeviceReauthStatus(started.flowId)?.status !== "committing") {
+      if (Date.now() > deadline) throw new Error("flow never reached committing");
+      await Bun.sleep(5);
+    }
+    cancelMainDeviceReauth(started.flowId);
+    releaseCommit();
+    // Publication beats the racing cancellation — but the flip lands when the
+    // commit resolves, so a transient cancelled read is allowed between the
+    // cancel and the commit's return.
+    let terminal: MainDeviceReauthStatus | null = null;
+    const settleDeadline = Date.now() + 2_000;
+    while (Date.now() < settleDeadline) {
+      terminal = getMainDeviceReauthStatus(started.flowId);
+      if (terminal?.status === "succeeded") break;
+      await Bun.sleep(5);
+    }
+    expect(terminal).toMatchObject({ status: "succeeded", credentialUpdated: true });
+  });
+
+  test("cancellation after publication returns succeeded, never cancelled", async () => {
+    const started = startMainDeviceReauth({
+      login: loginStub(async ctrl => {
+        ctrl.onAuth?.({ url: "https://auth.openai.com/codex/device", deviceCode: "WXYZ-9999" });
+        return grant();
+      }),
+      beginCommit: () => ({ commit: async () => ({ chatgptAccountId: "acct-main-1" }) }),
+    });
+    await waitForTerminal(started.flowId);
+    expect(cancelMainDeviceReauth(started.flowId)).toMatchObject({ status: "succeeded" });
+  });
+
+  test("claim-unavailable maps to native_main_unavailable", async () => {
+    const started = startMainDeviceReauth({
+      login: loginStub(async () => grant()),
+      beginCommit: () => ({
+        commit: async () => {
+          const error = new Error("claim held elsewhere") as Error & { code: string };
+          error.code = "NATIVE_MAIN_CLAIM_UNAVAILABLE";
+          throw error;
+        },
+      }),
+    });
+    expect(await waitForTerminal(started.flowId)).toMatchObject({
+      status: "failed",
+      code: "native_main_unavailable",
+    });
+  });
+
+  test("device authorization failures map to device_authorization_failed", async () => {
+    const started = startMainDeviceReauth({
+      login: loginStub(async () => { throw new Error("ChatGPT device authorization poll failed: HTTP 500"); }),
+      beginCommit: () => ({ commit: async () => ({ chatgptAccountId: "acct-main-1" }) }),
+    });
+    expect(await waitForTerminal(started.flowId)).toMatchObject({
+      status: "failed",
+      code: "device_authorization_failed",
+    });
+  });
+
+  test("no DTO ever carries token material", async () => {
+    const started = startMainDeviceReauth({
+      login: loginStub(async ctrl => {
+        ctrl.onAuth?.({ url: "https://auth.openai.com/codex/device", deviceCode: "ABCD-1234" });
+        return grant();
+      }),
+      beginCommit: () => ({ commit: async () => ({ chatgptAccountId: "acct-main-1" }) }),
+    });
+    const terminal = await waitForTerminal(started.flowId);
+    for (const dto of [started, getMainDeviceReauthStatus(started.flowId), terminal]) {
+      const json = JSON.stringify(dto);
+      expect(json).not.toContain("new-access-token");
+      expect(json).not.toContain("new-refresh-token");
+      expect(json).not.toContain("new-id-token");
+      expect(json).not.toContain("acct-main-1");
+    }
+  });
+});
+
+describe("beginNativeMainReauth commit (#3898)", () => {
+  let home: string;
+  let previousCodexHome: string | undefined;
+  let authPath: string;
+
+  const original = {
+    auth_mode: "chatgpt",
+    tokens: {
+      access_token: "old-access",
+      refresh_token: "old-refresh",
+      id_token: "old-id-token",
+      account_id: "acct-main-1",
+      future_token_field: "preserve-token",
+    },
+    future_root_field: { preserve: true },
+  };
+
+  beforeEach(() => {
+    home = mkdtempSync(join(tmpdir(), "ocx-main-reauth-"));
+    previousCodexHome = process.env.CODEX_HOME;
+    process.env.CODEX_HOME = home;
+    authPath = join(home, "auth.json");
+    writeFileSync(authPath, JSON.stringify(original));
+  });
+
+  afterEach(() => {
+    setMainAuthJsonBeforeRenameHookForTests(null);
+    if (previousCodexHome === undefined) delete process.env.CODEX_HOME;
+    else process.env.CODEX_HOME = previousCodexHome;
+    removeTreeWithRetry(home);
+  });
+
+  function readTokens(): Record<string, unknown> {
+    return (JSON.parse(readFileSync(authPath, "utf8")) as { tokens: Record<string, unknown> }).tokens;
+  }
+
+  test("same-identity commit writes all four token fields and preserves metadata", async () => {
+    const prepared = beginNativeMainReauth();
+    const result = await prepared.commit({
+      accessToken: "new-access",
+      refreshToken: "new-refresh",
+      idToken: "new-id-token",
+      chatgptAccountId: "acct-main-1",
+    });
+    expect(result.chatgptAccountId).toBe("acct-main-1");
+    const tokens = readTokens();
+    expect(tokens.access_token).toBe("new-access");
+    expect(tokens.refresh_token).toBe("new-refresh");
+    expect(tokens.id_token).toBe("new-id-token");
+    expect(tokens.account_id).toBe("acct-main-1");
+    expect(tokens.future_token_field).toBe("preserve-token");
+    expect(JSON.parse(readFileSync(authPath, "utf8")).future_root_field).toEqual({ preserve: true });
+  });
+
+  test("a different account identity is refused and the file is untouched", async () => {
+    const before = readFileSync(authPath, "utf8");
+    const prepared = beginNativeMainReauth();
+    await expect(prepared.commit({
+      accessToken: "new-access",
+      refreshToken: "new-refresh",
+      idToken: "new-id-token",
+      chatgptAccountId: "acct-someone-else",
+    })).rejects.toThrow(NativeMainReauthIdentityMismatchError);
+    expect(readFileSync(authPath, "utf8")).toBe(before);
+  });
+
+  test("an incomplete token set is refused before any claim work", async () => {
+    const before = readFileSync(authPath, "utf8");
+    const prepared = beginNativeMainReauth();
+    await expect(prepared.commit({
+      accessToken: "new-access",
+      refreshToken: "",
+      idToken: "new-id-token",
+      chatgptAccountId: "acct-main-1",
+    })).rejects.toThrow(NativeMainReauthUnavailableError);
+    expect(readFileSync(authPath, "utf8")).toBe(before);
+  });
+
+  test("a concurrent writer during publish fails the commit closed", async () => {
+    const before = readFileSync(authPath, "utf8");
+    setMainAuthJsonBeforeRenameHookForTests(() => {
+      writeFileSync(authPath, JSON.stringify({ tokens: { refresh_token: "foreign-writer" } }));
+    });
+    const prepared = beginNativeMainReauth();
+    await expect(prepared.commit({
+      accessToken: "new-access",
+      refreshToken: "new-refresh",
+      idToken: "new-id-token",
+      chatgptAccountId: "acct-main-1",
+    })).rejects.toThrow(MainAuthJsonChangedDuringRefreshError);
+    expect(readFileSync(authPath, "utf8")).not.toBe(before);
+    expect(readTokens().refresh_token).toBe("foreign-writer");
+  });
+
+  test("preparation without an existing credential fails fast", () => {
+    removeTreeWithRetry(home);
+    home = mkdtempSync(join(tmpdir(), "ocx-main-reauth-empty-"));
+    process.env.CODEX_HOME = home;
+    expect(() => beginNativeMainReauth()).toThrow(NativeMainReauthUnavailableError);
+  });
+});
diff --git a/tests/fixtures/test-layout-expected.json b/tests/fixtures/test-layout-expected.json
index fe0b2f0f2d..0b37651495 100644
--- a/tests/fixtures/test-layout-expected.json
+++ b/tests/fixtures/test-layout-expected.json
@@ -1209,5 +1209,7 @@
   "zz-pr-coderabbit-readiness-revalidation.test.ts": "ci-workflows",
   "devin-cli-login.test.ts": "providers",
   "devin-cli-authmode-migration.test.ts": "providers",
-  "usage-log-ws-stage.test.ts": "usage"
+  "usage-log-ws-stage.test.ts": "usage",
+  "main-device-reauth.test.ts": "codex-integration",
+  "main-device-reauth-api.test.ts": "codex-integration"
 }
diff --git a/tests/oauth/chatgpt-device-auth.test.ts b/tests/oauth/chatgpt-device-auth.test.ts
index 533f4da015..59a91f2271 100644
--- a/tests/oauth/chatgpt-device-auth.test.ts
+++ b/tests/oauth/chatgpt-device-auth.test.ts
@@ -1,6 +1,6 @@
-import { afterEach, describe, expect, test } from "bun:test";
+import { afterEach, describe, expect, jest, test } from "bun:test";
 import { loginChatGPT } from "../../src/oauth/chatgpt";
-import { loginChatGPTDevice } from "../../src/oauth/chatgpt-device";
+import { DEVICE_FETCH_TIMEOUT_MS, loginChatGPTDevice, loginChatGPTNativeDevice } from "../../src/oauth/chatgpt-device";
 import type { OAuthController } from "../../src/oauth/types";
 
 /**
@@ -243,4 +243,98 @@ describe("ChatGPT device auth", () => {
     expect(calls.urls[0]).toBe(USERCODE);
     expect(creds.accountId).toBe("acct_device_123");
   });
+
+  test("loginChatGPTNativeDevice retains the id_token the pool projection drops (#3898)", async () => {
+    routeFetch();
+    const result = await loginChatGPTNativeDevice({});
+    expect(result.credential.accountId).toBe("acct_device_123");
+    expect(result.credential.refresh).toBe("refresh-value");
+    expect(result.idToken).toBe(idToken());
+  });
+
+  test("loginChatGPTNativeDevice refuses a grant without id_token", async () => {
+    routeFetch({ tokenBody: { access_token: "access-value", refresh_token: "refresh-value" } });
+    await expect(loginChatGPTNativeDevice({})).rejects.toThrow(/missing id_token/);
+  });
+
+  test("loginChatGPTNativeDevice refuses a grant without account identity", async () => {
+    routeFetch({ tokenBody: { access_token: "access-value", refresh_token: "refresh-value", id_token: "header.e30.sig" } });
+    await expect(loginChatGPTNativeDevice({})).rejects.toThrow(/missing account identity/);
+  });
+
+  test("every device fetch carries a fresh bounded signal (#3898)", async () => {
+    const signals: (AbortSignal | null | undefined)[] = [];
+    const urls: string[] = [];
+    globalThis.fetch = (async (input: RequestInfo | URL, init?: RequestInit) => {
+      const url = typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
+      urls.push(url);
+      signals.push(init?.signal);
+      if (url === USERCODE) {
+        return jsonResponse({ device_auth_id: "auth-id-opaque", user_code: "ABCD-EFGH" });
+      }
+      if (url === DEVICE_TOKEN) {
+        return jsonResponse({ authorization_code: "auth-code", code_verifier: "server-verifier" });
+      }
+      if (url === OAUTH_TOKEN) {
+        return jsonResponse({ access_token: "a", refresh_token: "r", id_token: idToken() });
+      }
+      throw new Error(`unexpected fetch: ${url}`);
+    }) as typeof fetch;
+    await loginChatGPTNativeDevice({});
+    expect(urls).toEqual([USERCODE, DEVICE_TOKEN, OAUTH_TOKEN]);
+    for (const signal of signals) {
+      expect(signal).toBeInstanceOf(AbortSignal);
+      expect(signal?.aborted).toBe(false);
+    }
+  });
+
+  test("the pool device login also carries the bounded per-fetch signal", async () => {
+    const signals: (AbortSignal | null | undefined)[] = [];
+    globalThis.fetch = (async (input: RequestInfo | URL, init?: RequestInit) => {
+      const url = typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
+      signals.push(init?.signal);
+      if (url === USERCODE) {
+        return jsonResponse({ device_auth_id: "auth-id-opaque", user_code: "ABCD-EFGH" });
+      }
+      if (url === DEVICE_TOKEN) {
+        return jsonResponse({ authorization_code: "auth-code", code_verifier: "server-verifier" });
+      }
+      if (url === OAUTH_TOKEN) {
+        return jsonResponse({ access_token: "a", refresh_token: "r", id_token: idToken() });
+      }
+      throw new Error(`unexpected fetch: ${url}`);
+    }) as typeof fetch;
+    await loginChatGPTDevice({});
+    expect(signals.length).toBe(3);
+    for (const signal of signals) expect(signal).toBeInstanceOf(AbortSignal);
+  });
+
+  test("the per-fetch signal is a fresh composite whose abort fails the login (#3898)", async () => {
+    // The deadline itself is a named, bounded constant — far from the 15-minute
+    // grant TTL. bun's fake timers spin on AbortSignal.timeout in this suite,
+    // so the firing proof is the composition: a FRESH signal per fetch (never
+    // the caller's own), and its abort fails the login.
+    expect(DEVICE_FETCH_TIMEOUT_MS).toBeGreaterThan(0);
+    expect(DEVICE_FETCH_TIMEOUT_MS).toBeLessThanOrEqual(60_000);
+    // The 30s per-fetch deadline is an AbortSignal.timeout composed into every
+    // fetch; bun's fake timers drive AbortSignal.timeout (verified), but the
+    // combination spins inside this suite's fake-clock, so this test proves
+    // the composition instead: the signal the fetch receives is a FRESH
+    // composite (not the caller's own), and aborting it fails the login.
+    const caller = new AbortController();
+    const seen: (AbortSignal | null | undefined)[] = [];
+    globalThis.fetch = (async (_input: RequestInfo | URL, init?: RequestInit) => {
+      seen.push(init?.signal);
+      return await new Promise<Response>((_resolve, reject) => {
+        init?.signal?.addEventListener("abort", () => reject(new DOMException("The operation was aborted.", "AbortError")));
+      });
+    }) as typeof fetch;
+    const pending = loginChatGPTNativeDevice({ signal: caller.signal });
+    await Bun.sleep(10);
+    expect(seen).toHaveLength(1);
+    expect(seen[0]).toBeInstanceOf(AbortSignal);
+    expect(seen[0]).not.toBe(caller.signal);
+    caller.abort();
+    await expect(pending).rejects.toThrow(/abort/i);
+  });
 });