[pacocartones]

Summary

• The least-used account strategy ranked candidates by lastUsedAt only. After a 429 excluded the active account, the replacement could be an account that was merely the oldest by lastUsedAt while still carrying a backoff from its own recent rate limit; it served one request and the next request settled on a healthy account (the one-request detour with two cache misses reported on Codex). least-used now applies the same backoffLevel tie-break the round-robin fallback branch already has: lower backoff first, then the existing never-used / oldest / priority order.

Related Issues

• Closes fix(resilience): Codex accounts rotate for a single query before settling on the next account #12279

Validation

• Change type: routing
• Focused tests and category gates from the golden path: tests/unit/sse-auth.test.ts (67/67), npm run typecheck:core 0, npm run check:changelog-integrity OK, git diff --check clean
• npm run lint — repository-wide eslint exit 0 (run with --pass-on-unpruned-suppressions; the literal command reports only pre-existing unused global suppressions on this base)
• Reconciled with the current active release base release/v3.8.51@158647618; focused checks rerun afterward
• Production-code changes include a new or updated automated test in this PR
• SonarQube is temporarily opt-in while the private project has no quota; it is not a PR gate.

Tests Added Or Updated

• tests/unit/sse-auth.test.ts: new case getProviderCredentials least-used prefers an account without backoff over the least recently used one (#12279) (RED on the base: backed-off account selected; GREEN with the fix).

Coverage Notes

• src/sse/services/auth.ts: the added comparator lines are covered by the new test; the two existing least-used tests (never-used preference, oldest-timestamp preference) still pass and cover the equal-backoff path.

Reviewer Notes

• This changes selection for every provider configured with least-used, not only Codex. With all candidates at backoffLevel 0 (the common case) the order is identical to before.
• backoffLevel is auto-decayed to 0 in getProviderCredentials once rateLimitedUntil has passed, and rate-limited accounts are pre-filtered unless the caller sets allowRateLimitedConnections (combo targets with allowRateLimitedConnection). The tie-break therefore takes effect for accounts still inside their rate-limit window that a caller deliberately keeps in the pool; the test seeds exactly that shape. createProviderConnection does not persist backoffLevel, so the test writes it via updateProviderConnection.
• The Codex mid-request failover path (chatCore.ts calling the plain selector instead of the quota-preflight one) is the other half of the triage and is not changed here.