Bind Cursor retry replay to the admitted OAuth account on 429 failover

[luvs01]

Motivation

• Fix a race where a concurrent manual OAuth selection could be admitted while Cursor replay/continuation ownership remained bound to the originally proposed (rejected) snapshot, allowing cross-account checkpoint/replay exposure.

Description

• Change applyFailoverSnapshot to return the admitted OAuthAccessSnapshot or null instead of a boolean so callers learn which snapshot was actually installed.
• Use the admitted snapshot when re-binding replay scope during Cursor preflight 429 recovery so bindRouteReasoningReplayScope receives the same accountId/generation that the retry will use.
• Ensure replayOAuthCredentialSnapshot, genericFailoverAccountId, and route provider fields are updated from the committed/admitted snapshot so routing metadata and bearer stay synchronized.
• Extend the existing OAuth failover test tests/oauth/adapter-event-oauth-failover.test.ts to observe credential/continuation identity and assert the retry is scoped to the admitted manual account rather than the rejected proposal.

Testing

• Ran the focused test bun test tests/oauth/adapter-event-oauth-failover.test.ts, which passed (12 tests, 0 failures).
• Ran type checking with bun run typecheck, which completed without errors.
• Ran bun run privacy:scan, which passed.
• The full repository bun run test was executed; the modified focused tests passed inside that run, but the full parallel suite exited nonzero due to unrelated/timebox-sensitive failures (existing environment/timeouts), not regressions from this change.

---

Codex Task

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-07T05:47:30.429665Z	741b108	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Team

Run ID: 973c4a91-33eb-4516-98f1-dfb7edec8da1

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[github-actions]

⏳ DRAFT

• wrong target branch (main); retarget to dev.

What to do

• Retarget this PR to dev — all contributions go to dev.

Its title has been prefixed with [WRONG BRANCH].
This pull request was already a draft. Its draft status will be preserved after every issue above is resolved.