[RaviTharuma]

Summary

Reopens only the credentials-flap behavior fix from #14854 (closed), without the AGENTS.md edits and with a failing-then-passing regression test per Hard Rules #8 / #18.

Stops OmniRoute from permanently sidelining accounts on temporary unpaid / ban-looking flaps so operators can pick them back up after billing renew / re-auth without a dashboard re-enable.

• writeTerminalStatus: no longer defaults isActive=false on terminal testStatus (including credits_exhausted). Callers must pass isActive explicitly.
• chatCore: FORBIDDEN / ACCOUNT_DEACTIVATED record terminal testStatus for selection skip + alerts, and only deactivate via maybeAutoDisableBannedAccount (autoDisableBannedAccounts + scope) — the same gate auth.ts already uses.
• Unrecoverable OAuth refresh: sets testStatus=expired only (keeps is_active=1); updateProviderCredentials already skips isActive when omitted.
• Health scheduler: unchanged — never deactivates.
• Docs: BAN_DETECTION.md updated for unpaid recovery + gated isActive. No AGENTS.md changes.

Behavior after this PR

Signal	testStatus	is_active
Unpaid / credits_exhausted	set (selection skip + alert)	stays 1; recovery re-probe can clear after renew
Ban-looking FORBIDDEN / deactivated	set	0 only if autoDisableBannedAccounts allows
OAuth refresh death	expired	stays 1
Health scheduler	unchanged	never deactivates

Related Issues

• Closes fix(auth): Credentials HARD: never auto is_active=0 on unpaid/ban flaps; credits_exhausted must recover after renew #14853
• Supersedes closed fix(creds): never auto is_active=0 on unpaid/ban flaps #14854 (drops AGENTS.md edits, adds regression test)

Validation

• Change type: auth / routing behavior
• Focused tests: node --import tsx/esm --test tests/unit/terminal-status-no-auto-deactivate-14853.test.ts — RED against pre-fix terminalStatus.ts (2 fail), GREEN after fix (3 pass)
• Existing terminal/auth guards still pass: terminal-status-origin, auth-terminal-status, probe-gate-autodisable (21 pass)
• npm run typecheck:core clean
• npm run lint (eslint on changed files) clean; prettier clean
• Reconciled onto release/v3.8.51 base tip

Tests Added Or Updated

• tests/unit/terminal-status-no-auto-deactivate-14853.test.ts (new regression):
  • credits_exhausted without explicit isActive keeps is_active=1
  • banned without explicit isActive records testStatus but keeps is_active=1
  • explicit isActive=false still deactivates (gated auto-disable path honored)

Coverage Notes

• Touches open-sse/handlers/chatCore.ts and src/shared/utils/terminalStatus.ts. The new regression test directly covers the writeTerminalStatus default change; the chatCore paths now route permanent deactivation through the already-tested maybeAutoDisableBannedAccount gate.

Reviewer Notes

• The chatCore FORBIDDEN / ACCOUNT_DEACTIVATED branches now call maybeAutoDisableBannedAccount({ permanent: true }) instead of inline isActive: false, matching auth.ts. With autoDisableBannedAccounts on (+ scope), true bans still deactivate; otherwise the connection stays active with a terminal testStatus for selection skip + alerts.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[RaviTharuma]

CI follow-ups on fork head:

• e4b1339 — Hard Rules fix(oauth): prevent connection test from corrupting valid tokens #8/fix(ci): add environment for npm token access #18 unit-test alignment (gated autoDisableBannedAccounts / probeCanDisable) + flag-OFF ban-flap regression; DRY chatCore ban blocks into gatedTerminalBan.ts so check:file-size is green (6465→6425).
• 8d142f5 — error-public-boundaries fixture updated (fix(sse): Anthropic OAuth 403 "Request not allowed" is a per-request refusal — cooldown with backoff instead of an instant ban (#12859) #12864 pattern) after the extract: classifier count >=7; gatedTerminalBan.ts held to sanitize-at-write.

Fast Quality Gates remaining (baseline / unrelated): mutation-test-coverage (25 unrelated stryker tap.testFiles) and vuln-ratchet (41>27, no lockfile change). Happy to sync in a separate hygiene PR; this PR stays credentials-only.