fix(codex): keep scope isolation after the soft avoid expires

Suppressing the shared promotion at the moment of the failure only covered
one of the two places it happens. The failure streak lives for five minutes
but the soft avoid clears in thirty seconds, so there is a window where the
account is selectable again while shouldFailover still trips. A scoped
resolve reaches applyFailureFailover in that window, and it took no
quotaScope at all -- it promoted and persisted a new shared active account,
and picked its alternate from shared-scope eligibility rather than the
scope's own.

Thread the scope through and guard the promotion. The scope still routes
away from the failing account, which is its own decision to make; it just
no longer moves the cursor every other scope resolves from.

Found by CodeRabbit on #715.

Author: XertroV

src/codex/routing.ts

@@ -1116,11 +1116,22 @@ function shouldFailover(config: OcxConfig, accountId: string, now: number): bool
   return !!health && health.consecutiveFailures >= threshold;
 }
 
-function applyFailureFailover(config: OcxConfig, active: string, now: number): string {
+function applyFailureFailover(
+  config: OcxConfig,
+  active: string,
+  now: number,
+  quotaScope?: CodexQuotaScope,
+): string {
   if (!shouldFailover(config, active, now)) return active;
-  const best = pickAlternateCodexAccount(config, active, now);
+  const best = pickAlternateCodexAccount(config, active, now, quotaScope);
   if (best) {
-    promoteActiveCodexAccount(config, best);
+    // The scope still routes away from the failing account — that is this request's
+    // own decision — but an independent one must not persist a new shared active
+    // account. recordCodexUpstreamOutcome only suppresses the promotion it makes at
+    // the moment of the failure; the streak outlives the soft avoid, so a later
+    // scoped resolve reaches here with the streak still tripped and would otherwise
+    // move the shared cursor after all.
+    if (!isIndependentCodexQuotaScope(quotaScope)) promoteActiveCodexAccount(config, best);
     return best;
   }
   return active;
@@ -1309,7 +1320,7 @@ export function resolveCodexAccountForThreadDetailed(
     active = preempted;
   }
   active = applyQuotaAutoSwitch(config, active, now, quotaScope);
-  active = applyFailureFailover(config, active, now);
+  active = applyFailureFailover(config, active, now, quotaScope);
   if (!isCodexAccountUsable(config, active)) {
     return hasConfiguredPoolAccount(config, active) ? { status: "selected", accountId: active } : { status: "none" };
   }

tests/codex-pool-rotation.test.ts

@@ -18,6 +18,7 @@ import {
 import {
   clearCodexUpstreamHealth,
   clearThreadAccountMap,
+  CODEX_TRANSIENT_SOFT_AVOID_MS,
   getEffectiveActiveCodexAccountId,
   isCodexAccountInCooldown,
   pickAlternateCodexAccount,
@@ -919,6 +920,31 @@ describe("selection order across rotation strategies", () => {
     expect(config.activeCodexAccountId).toBe("a");
   });
 
+  test("an independent scope still leaves shared routing alone once its soft avoid expires", () => {
+    // Suppressing the promotion at the moment of the failure is not enough: the
+    // failure streak outlives the soft avoid, so there is a window where the account
+    // is selectable again while shouldFailover still trips. A scoped resolve lands in
+    // applyFailureFailover there, and that is the second place shared state can move.
+    const config = makeThreeAccountConfig({
+      activeCodexAccountId: "a",
+      upstreamFailoverThreshold: 1,
+    } as Partial<OcxConfig>);
+    primeAllQuota();
+    const failedAt = Date.now();
+
+    recordCodexUpstreamOutcome(config, "a", 503, {
+      modelId: "gpt-5.3-codex-spark",
+      now: failedAt,
+    });
+
+    // Past the 30s soft avoid, inside the 5-minute failure window.
+    const afterSoftAvoid = failedAt + CODEX_TRANSIENT_SOFT_AVOID_MS + 1_000;
+    resolveCodexAccountForThread(null, config, afterSoftAvoid, "spark");
+
+    expect(getEffectiveActiveCodexAccountId(config)).toBe("a");
+    expect(config.activeCodexAccountId).toBe("a");
+  });
+
   test.each([
     ["quota", ["a", "a", "a", "a", "a", "a"]],
     ["round-robin", ["a", "b", "c", "a", "b", "c"]],