docs(codex): call the pin a ceiling, which is what the code implements

Three comments described the pin as a tier "floor". `selectPriorityTier` names the
variable `ceiling` and skips every tier where `tier > ceiling`, so the pin
suppresses higher-ordered accounts rather than guaranteeing the pinned one -- the
opposite of what "floor" suggests. One of the three even said "floor" and
"capping" in the same sentence.

Matters beyond wording: this invariant is what the Go port has to reproduce, and
"floor" would send a porter looking for a lower bound that does not exist.

Author: XertroV

src/codex/account-priority.ts

@@ -58,8 +58,10 @@ export function codexAccountPriorityLookup(config: OcxConfig): (accountId: strin
 
 /**
  * The account an operator most recently selected by hand. While pinned, priority
- * never preempts upward: the pin is a tier floor for round-robin/fill-first and a
- * veto in the quota path, until the account crosses the auto-switch threshold.
+ * never preempts upward: the pin is a tier *ceiling* for round-robin/fill-first --
+ * `selectPriorityTier` skips every tier above the pinned account's, so higher-ordered
+ * accounts are suppressed rather than the pinned one being guaranteed -- and a veto in
+ * the quota path, until the account crosses the auto-switch threshold.
  */
 export function pinnedCodexAccountId(config: OcxConfig): string | undefined {
   return config.activeCodexAccountPinned;

src/codex/auth-api.ts

@@ -886,7 +886,7 @@ export async function handleCodexAuthAPI(
     // must release the pin rather than record one: pinning the `targetAccountId`
     // fallback would leave a pin that no effective active account matches, which
     // `isEffectiveCodexAccountPinned` reports as unpinned while the tier filter still
-    // honours it as a floor — invisibly capping the pool at the main account's tier.
+    // honours it as a ceiling — invisibly capping the pool at the main account's tier.
     if (body.accountId == null) clearCodexAccountPin(runtimeConfig);
     else setCodexAccountPin(runtimeConfig, targetAccountId);
     resetCodexRoutingForManualSelection(targetAccountId);

src/codex/routing.ts

@@ -1023,7 +1023,8 @@ export function reconcileCodexActiveAfterExclusion(
     config.activeCodexAccountId = undefined;
   }
   // Excluding an account revokes any manual pin on it even when it was not the
-  // effective active — otherwise a paused account keeps acting as a tier floor.
+  // effective active — otherwise a paused account keeps acting as a tier ceiling,
+  // suppressing every higher-ordered account while being unusable itself.
   clearCodexAccountPin(config, excludedAccountId);
   if (!wasEffective) return getEffectiveActiveCodexAccountId(config) ?? null;