[WRONG BRANCH] fix(codex): hand off affinity in refresh flight

[luvs01]

Motivation

• Prevent a detached token-refresh flight from committing a rotated credential at generation G+1 while the initiating request cancels and no caller performs the generation-dependent handoff, which could leave process-local thread affinities bound to the old generation G.
• Ensure generation-dependent side effects (affinity advancement and plan reconciliation) run exactly once for the shared refresh flight regardless of which caller opened it.

Description

• Add a lightweight registration API registerCodexRefreshGenerationHandoff and a process-local refreshGenerationHandoffs set to src/codex/account-store.ts to record callbacks that must run when a refresh advances a credential generation.
• Execute registered handoffs from the refresh flight completion path so a successful G -> G+1 commit advances process-local state before any waiter observes the result.
• Register the existing routing affinity handoff (handOffThreadAffinityGeneration) with the flight, and extend the cancel-owner regression test to assert the detached flight performs one G→G+1 handoff in tests/codex-account-store.test.ts.

Testing

• Ran the focused account-store tests with bun test tests/codex-account-store.test.ts, which passed (42 tests, 0 failures).
• Exercised routing tests with the repository Bun binary (node_modules/bun/bin/bun.exe test tests/codex-routing.test.ts) and observed they pass in that environment, while the system Bun (older) lacked a node:zlib export required by the suite.
• Ran bun run typecheck and bun run privacy:scan, both of which completed successfully.
• Executed the broader test runner; the full-suite run exposed unrelated existing Compatibility Lab failures/timeouts but the focused account-store and routing suites that validate this change passed.

---

Codex Task

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 9bb064be-5228-4484-a41a-02a953487452

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-31T01:01:57.087646Z	e875aa8	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[github-actions]

⏳ DRAFT

• wrong target branch (main); retarget to dev.

What to do

• Retarget this PR to dev — all contributions go to dev.

Its title has been prefixed with [WRONG BRANCH].
This pull request was already a draft. Its draft status will be preserved after every issue above is resolved.