diff --git a/.gitignore b/.gitignore
index 37712544b..175cf6581 100644
--- a/.gitignore
+++ b/.gitignore
@@ -26,6 +26,9 @@ devlog/
 .omo/
 **/.omo/
 
+# Local development worktrees
+.worktrees/
+
 # Test-generated artifacts
 tests/.tmp-*/
 .claude/
diff --git a/README.md b/README.md
index 86b30f082..0cb00e325 100644
--- a/README.md
+++ b/README.md
@@ -56,7 +56,9 @@ opencodex is a lightweight local proxy that translates Codex's Responses API int
 It can also manage a **ChatGPT account pool** for Codex auth. Add multiple ChatGPT / Codex accounts,
 refresh their 5h / weekly / 30d quota in the dashboard, and let new sessions auto-route to the
 lowest-usage healthy account. Existing Codex threads stay pinned to the account that started them,
-so long SSH, tmux, or mobile-connected sessions do not jump accounts mid-conversation.
+so long SSH, tmux, or mobile-connected sessions do not jump accounts mid-conversation. Give the
+accounts a selection order when one of them — usually your Codex Desktop login — should only be
+reached for once the others are drained.
 
 ```
 Codex CLI / App / SDK ──/v1/responses──▶ opencodex ──▶ Any provider
diff --git a/docs-site/src/content/docs/guides/web-dashboard.md b/docs-site/src/content/docs/guides/web-dashboard.md
index 4e20b136b..e835f8874 100644
--- a/docs-site/src/content/docs/guides/web-dashboard.md
+++ b/docs-site/src/content/docs/guides/web-dashboard.md
@@ -100,8 +100,16 @@ catalog entry.
 
 The **Codex Auth** page manages the native ChatGPT/Codex route:
 
-- Manually choosing an account changes the next new Codex session; an already-bound thread keeps its
-  current account for that manual switch.
+- Manually choosing an account applies immediately: an already-bound thread moves to it on its next
+  request, and only requests already in flight keep the account they captured. A manual choice is also
+  pinned: the card shows a **PINNED** badge, and a higher selection order cannot preempt that account
+  until it is drained, you select another account, or you change any account's selection order.
+- Each account card carries a **Selection order** control (First, Earlier, Normal, Later, Last).
+  Higher order is used first, and the pool drops to a lower order only once every account above it is
+  drained or unavailable. A changed order applies from the next unbound request and never moves a
+  thread that is already bound. The Codex Desktop (main) account is ordered like any other, so it can
+  be set to **Last** and kept as the reserve. An order set from `ocx account priority` outside those
+  five presets stays visible and selectable on the card.
 - Thread affinity prevents per-request flapping. With quota auto-switch enabled, a long-running
   thread is periodically re-evaluated and may rebind after its relevant usage reaches the threshold
   and a strictly lower-usage eligible account exists.
@@ -136,6 +144,7 @@ The GUI is a thin client over the proxy's JSON management API. Useful endpoints
 | `POST /api/oauth/login` · `GET /api/oauth/status` | Start a provider OAuth flow and poll for completion. |
 | `GET /api/codex-auth/accounts?refresh=1` | List main and pool accounts, force quota refresh, and report main-account `hasCredential` / terminal `needsReauth` state. |
 | `PUT /api/codex-auth/active` · `PUT /api/codex-auth/auto-switch` · `PUT /api/codex-auth/failover` | Select the account for the next request and configure pool routing. |
+| `GET /api/codex-auth/active` · `PUT /api/codex-auth/accounts/priority` | Read the effective account (including `pinned` and which account is `pinnedAccountId`) and set one account's selection order. |
 | `POST /api/codex-auth/login` · `GET /api/codex-auth/login-status` | Add a pool account through browser login. |
 | `GET /api/logs?tail=50&provider=...&status=5xx` | Read recent request metadata with optional tail, provider, and exact/class status filters. |
 | `GET` / `PUT /api/subagent-models` | Read or set the five featured `spawn_agent` override models. |
diff --git a/docs-site/src/content/docs/ja/guides/web-dashboard.md b/docs-site/src/content/docs/ja/guides/web-dashboard.md
index 16a62950a..ceb07d7a3 100644
--- a/docs-site/src/content/docs/ja/guides/web-dashboard.md
+++ b/docs-site/src/content/docs/ja/guides/web-dashboard.md
@@ -81,8 +81,16 @@ Codex タスクだけに適用され、このオプション自体が委任を
 
 **Codex 認証**ページはネイティブ ChatGPT/Codex ルートを管理します。
 
-- アカウントを直接選ぶと次の新規 Codex セッションから変わります。すでにアカウントが紐付いた thread はこの手動切り替えだけでは
-  途中で移動しません。
+- アカウントを直接選ぶとすぐに反映されます。すでにアカウントが紐付いた thread も次のリクエストで選んだ
+  アカウントに移り、すでに送信中のリクエストだけが取得済みのアカウントを使い続けます。手動で選んだアカウントは固定もされます。
+  カードに **固定中** バッジが付き、そのアカウントが使い切られるか、別のアカウントを選ぶか、いずれかの
+  アカウントの選択順序を変更するまで、より上位の選択順序が割り込むことはありません。
+- 各アカウントカードには **選択順序** のコントロール（最初 / 早め / 標準 / 遅め / 最後）があります。
+  順序が上のものから使われ、その上にあるアカウントがすべて使い切られるか利用できなくなって初めて
+  下の順序へ下がります。順序を変更すると **次の未バインドリクエスト** から適用され、すでにアカウントに
+  紐づいた thread を移動させることはありません。Codex Desktop（メイン）アカウントも同じように
+  並べ替えられるので、**最後** にして予備に回せます。`ocx account priority` でプリセット以外の値を設定した場合も、カード上に
+  選択肢として残ります。
 - Thread affinity がリクエストごとにアカウントが揺れるのを防ぎます。クォータ自動切り替えがオンなら長く
   実行される thread も定期的に再評価します。関連使用量がしきい値以上で、使用量が確実により低い
   健全アカウントがあればそのアカウントに再紐付けできます。
@@ -112,6 +120,7 @@ GUI はプロキシの JSON 管理 API を使うシンクライアントです
 | `POST /api/oauth/login` · `GET /api/oauth/status` | プロバイダー OAuth ログインを開始し完了可否を確認します。 |
 | `GET /api/codex-auth/accounts?refresh=1` | メインおよびプールアカウントを参照しクォータを強制更新し、メインの `hasCredential` / terminal `needsReauth` 状態を返します。 |
 | `PUT /api/codex-auth/active` · `PUT /api/codex-auth/auto-switch` · `PUT /api/codex-auth/failover` | 次のリクエストで使うアカウントとプールルーティングポリシーを設定します。 |
+| `GET /api/codex-auth/active` · `PUT /api/codex-auth/accounts/priority` | 実効アカウント（固定中かどうかを示す `pinned` と、固定されているアカウントを示す `pinnedAccountId` を含む）を読み、アカウント 1 件の選択順序を設定します。 |
 | `POST /api/codex-auth/login` · `GET /api/codex-auth/login-status` | ブラウザログインでプールアカウントを追加します。 |
 | `GET /api/logs?tail=50&provider=...&status=5xx` | tail、プロバイダー、正確な状態コードまたは状態等級で最近のリクエストメタデータを参照します。 |
 | `GET` / `PUT /api/subagent-models` | `spawn_agent` に優先公開するモデル 5 つを読むか設定します。 |
diff --git a/docs-site/src/content/docs/ja/reference/cli.md b/docs-site/src/content/docs/ja/reference/cli.md
index d54e2f63c..6588485ad 100644
--- a/docs-site/src/content/docs/ja/reference/cli.md
+++ b/docs-site/src/content/docs/ja/reference/cli.md
@@ -202,7 +202,7 @@ ocx models --provider anthropic --json
 コマンド面は次のとおりです。
 
 ```text
-Usage: ocx account <list|current|use|refresh|auto-switch|remove|add-key> ...
+Usage: ocx account <list|current|use|refresh|auto-switch|priority|login|reauth|code|cancel|remove|add-key|reset-credits> ...
 
 List and switch provider accounts and API-key pools (GUI parity).
 
@@ -211,9 +211,13 @@ current <provider>  Show the active account or key.
 use <provider> <id> Switch the active credential; 'main' selects the Codex App login.
 refresh <provider>  Force-refresh Codex or provider quota reports.
 auto-switch <provider> <on|off|status|threshold N>  Control the Codex pool threshold.
+priority <provider> <id|main> [first|earlier|normal|later|last|-100..100|reset]  Selection order; omit the value to read it.
 remove <provider> <id> --yes  Remove a stored account or key after an existence check.
 add-key <provider> [--label <label>]  Add a key read only from piped stdin.
-Codex pool switches apply to new sessions; running threads keep their account.
+login/reauth/code/cancel  Run browser or manual-code auth from a headless shell.
+reset-credits <id|main> [--consume --yes]  Inspect or consume Codex reset credits.
+Switching the active account takes effect immediately; running threads move on their next request, and in-flight requests keep the account they captured.
+A selection-order change applies from the next unbound request and never moves a bound thread.
 ```
 
 すべてのサブコマンドはプロキシが実行中である必要があり、CLI が記録されたランタイムポートを自動的に探します。成功は
@@ -231,6 +235,7 @@ API エラーは終了コード 1 です。認証情報フィールドは manage
   "email": "m***@example.com",
   "plan": "plus",
   "masked": "sk-ab****wxyz",
+  "priority": 0,
   "active": true,
   "needsReauth": false,
   "quota": null
@@ -240,8 +245,8 @@ API エラーは終了コード 1 です。認証情報フィールドは manage
 #### `ocx account list [provider] [--json] [--all]`
 
 プロバイダーを省略すると Codex pool、OAuth アカウント、設定された API-key pool をすべて一覧します。空の
-プロバイダーは `--all` を指定しない限り飛ばし、プロバイダーを指定するとその認証情報 family だけを照会します。通常出力列は `PROVIDER TYPE ID PLAN/LABEL STATUS` で固定 Codex 行には
-`selected` が表示されます。保存された Kiro アカウントがある場合、ログインスロットは 1 つで再ログインすると現在のアカウントが差し替わる旨の案内が出ます。結果が空でも成功です。`--json` は次を返します。
+プロバイダーは `--all` を指定しない限り飛ばし、プロバイダーを指定するとその認証情報 family だけを照会します。通常出力列は `PROVIDER TYPE ID PLAN/LABEL PRIORITY STATUS` で固定 Codex 行には
+`selected` が表示されます。`PRIORITY` は符号付きの Codex 選択順（未設定なら `0`）で、OAuth アカウントや API key など順序が適用されない行には `-` が入ります。保存された Kiro アカウントがある場合、ログインスロットは 1 つで再ログインすると現在のアカウントが差し替わる旨の案内が出ます。結果が空でも成功です。`--json` は次を返します。
 
 ```text
 { accounts: AccountRow[], notes: string[] }
@@ -258,9 +263,9 @@ API エラーは終了コード 1 です。認証情報フィールドは manage
 #### `ocx account use <provider> <account-or-key-id|main> [--json]`
 
 既存の Codex アカウント、OAuth アカウント、または API key を選びます。`openai` で `main` は Codex App ログインを
-選択します。Codex の選択は **新しいセッション** から適用され、既存の thread は現在のアカウントを維持します。auto-switch
-threshold がオンなら後で手動 pin を上書きできます。不明なプロバイダーや id は終了
-コード 1 です。`--json` は次を返します。
+選択します。Codex の選択は **すぐに反映** されます。実行中の thread は次のリクエストで移動し、すでに送信中の
+リクエストだけが取得済みのアカウントを使い続けます。auto-switch threshold がオンなら後で手動 pin を
+上書きできます。不明なプロバイダーや id は終了コード 1 です。`--json` は次を返します。
 
 ```text
 { ok: true, provider, type, activeId }
@@ -286,6 +291,28 @@ OAuth および API-key プロバイダーでは provider quota-report endpoint
 { provider, autoSwitchThreshold: number, enabled: boolean }
 ```
 
+#### `ocx account priority <provider> <account-id|main> [<-100..100|first|earlier|normal|later|last|reset>] [--json]`
+
+Codex pool のアカウント別選択順を読み書きします。**値が大きいほど先に使われ**、既定は `0`、範囲は
+`-100` から `100` です。順序を持つのは `openai` の Codex pool だけなので、他のプロバイダーは終了コード
+1 です。`main` は Codex Desktop ログインを指し、他の pool アカウントと同じように並べ替えられます。
+`ocx account priority openai main last` とすれば予備として最後に回せます。
+
+プリセット語は小さな整数の別名です。`first` が `+2`、`earlier` が `+1`、`normal` が `0`、`later` が
+`-1`、`last` が `-2` です。`reset` は既定に戻し、保存されたエントリを削除します。**値を省略すると
+読み取り**になり、現在の順序を書き換えません。
+
+順序が決めるのは「どのアカウントから見るか」であって「どれが使えるか」ではありません。選択は引き続き
+適格なアカウントの中で行われ、まだ quota に余裕がある最上位 tier を取り、その中は
+`accountPoolStrategy` が選びます。一時停止、cooldown、再認証には影響しません。変更は新しいセッションだけでなく **次の未バインドリクエスト** から適用されます。上位の順序に余裕が戻れば
+preemption が未バインドリクエストを直ちに引き上げます。既にアカウントに紐づいた thread は、通常はそのアカウントを
+使い切るまで維持します。ただし再認証エラー、quota cooldown、一時的な失敗の連続はそれより早く紐付けを解除します。受理された書き込みは、どのアカウントの手動の「今すぐこのアカウントを使う」固定も解除します。すでに設定済みの順序を書き込んだ場合も同様で、これは現在選択中のアカウントを保ったまま固定を解除する唯一の方法です（管理 API でアクティブアカウントを解除しても固定は解除されますが、その選択自体も失われます）。プロキシに接続できない場合、
+不明なアカウント id、受け付けない値はいずれも終了コード 1 です。`--json` は次を返します。
+
+```text
+{ ok: true, provider, id, priority: number, preset: string | null }
+```
+
 #### `ocx account remove <provider> <id|main> --yes [--json]`
 
 保護された非対話型削除のため `--yes` が必須です。削除前に id の存在を確認し、不明な id は DELETE を送らずに終了コード 1 を返します。メインの Codex App ログインは削除できないため
diff --git a/docs-site/src/content/docs/ja/reference/configuration.md b/docs-site/src/content/docs/ja/reference/configuration.md
index 524131fae..c02234871 100644
--- a/docs-site/src/content/docs/ja/reference/configuration.md
+++ b/docs-site/src/content/docs/ja/reference/configuration.md
@@ -52,8 +52,9 @@ namespaced selected id を bare id に変えます。
 | `syncResumeHistory?` | `boolean` | `true` | 戻せる Codex App 履歴互換モード。opencodex は元の Codex thread metadata をバックアップし、旧 OpenAI interactive row を `opencodex` に再マッピングし、opencodex が作成した `exec` row を App に見えるソースとして一時的に昇格します。`ocx stop` / `ocx restore` はバックアップした OpenAI row を復元し、残った opencodex user thread を OpenAI に戻し、ネイティブ Codex が `config.toml` からプロキシを削除した後でも開き続けられるようにします。オフにするには `false` に設定します。 |
 | `codexAccounts?` | `CodexAccount[]` | `[]` | Codex Auth ダッシュボードが管理する ChatGPT/Codex pool アカウント metadata。secret は `codex-accounts.json` に別途置きます。 |
 | `pausedCodexAccountIds?` | `string[]` | `[]` | Codex Auth で再開するまで、今後のすべての Pool 選択から除外するアカウント ID。メインを一時停止した場合は `__main__` も含みます。 |
+| `codexAccountPriorities?` | `Record<string,number>` | — | Codex pool のアカウント別選択順。アカウント ID → `-100` から `100` の整数で、**大きいほど先に使われ**、未設定は `0` です。これは eligibility ではなく順序の境界です。選択は適格なアカウントを、まだ quota に余裕がある最上位 tier に絞り込み、その tier の中を `accountPoolStrategy` が選びます。tier が飛ばされるのは、そのメンバー全員が `autoSwitchThreshold` 超過、cooldown 中、soft-avoid、一時停止、または再認証待ちのときだけで、usage 不明が tier を drain させることはありません。順序付けが不適格なアカウントを選択可能にすることはなく、すでにアカウントが結び付いた thread を再 bind することもありません。メインの `__main__` も同じ条件で参加するため、Codex Desktop ログインを最後に使わせられます。エントリが 1 つもなければ挙動は従来どおりです。map が不正な場合は警告を出して順序付けを無効にします（config の修復処理は走りません）。`ocx account priority` と Codex Auth ページで管理します。 |
 | `codexAccountNamespaces?` | `Record<string,string>` | — | 公開 model selector namespace から保存済み Codex アカウント target への任意 map。この foundation layer は map を検証・保存しますが、picker row の追加や routing の変更は行いません。 |
-| `activeCodexAccountId?` | `string` | — | 手動選択した pool アカウント。既存 thread affinity を消去して次のリクエストから適用し、処理中のリクエストは現在のアカウントを維持します。 |
+| `activeCodexAccountId?` | `string` | — | 手動選択した pool アカウント。既存 thread affinity を消去して次のリクエストから適用し、処理中のリクエストは現在のアカウントを維持します。手動選択はその tier の上限も pin します（`activeCodexAccountPinned` に記録）。より上位の `codexAccountPriorities` tier は、drain、除外、削除、または明示的な failover/promotion で pin が解除されるまで preempt できません。同じ tier 内の通常の round-robin 移動では pin は解除されません。`codexAccountPriorities` に書き込むと pin も解除されるため、順序を設定する前に付けた pin が後から設定した順序を上回ることはありません。`GET /api/codex-auth/active` は、実効アカウントが pin されているかを `pinned`、tier 上限を保持するアカウントを `pinnedAccountId` として返します。 |
 | `autoSwitchThreshold?` | `number` | `80` | 新しいセッション自動切替用の使用量百分率 threshold。既知の 5 時間、週次、30 日 quota window のうち最も高いスコアを使います。`0` なら quota 自動切替をオフにします。`quota` 戦略と `fill-first` の drain threshold にも使います。 |
 | `accountPoolStrategy?` | `"quota" \| "round-robin" \| "fill-first"` | `"quota"` | Codex pool の新しいセッション rotation 戦略。**新しいセッションのみ**に適用され、既存 thread id は affinity を維持します。`quota`（既定）— アクティブアカウントが `autoSwitchThreshold` を超えたら既知 usage 最小を選択。`round-robin` — 適格アカウント間を smooth weighted で均等分散。`fill-first` — cooldown、使用不可、または（設定時）`autoSwitchThreshold` までアクティブアカウントを使い切り（未知 usage は強制切替しない）、安定ソート順で次へ。 |
 | `accountPoolStickyLimit?` | `number` | `1` | 1 回の round-robin 選択で次へ進む前に保持する成功的新セッション bind 数。範囲 1–100。`accountPoolStrategy` が `round-robin` のときのみ。 |
@@ -91,7 +92,7 @@ pool アカウントの追加と quota 更新はダッシュボードの **Codex
 状態は再起動後も保持され、すべてのアカウントが一時停止中なら Pool ルーティングは別のアカウントを暗黙に選ばず失敗します。
 **上限到達を一括停止** は credential がある適格アカウントだけを先に更新し、関連する quota window が今回 100% と確認できたアカウントだけを停止します。credential がないアカウントや、quota が不明、または更新に失敗したアカウントは変更しません。
 
-**rotation 戦略**（新しいセッションのみ；bound thread は不変）：`quota`（既定）— `autoSwitchThreshold` 超過時に最小 usage を選択；`round-robin` — 均等分散、`accountPoolStickyLimit`（既定 `1`、1–100）で 1 選択あたりの成功 bind 数；`fill-first` — アクティブアカウントを cooldown、再認証、または threshold まで使い切り（未知 usage は強制切替しない）後、安定ソート順で次へ。rotation は provider enforcement を回避しません — 複数アカウント利用は ToS 違反の可能性があります。
+**rotation 戦略**（新しいセッションのみ；bound thread は不変）：`quota`（既定）— `autoSwitchThreshold` 超過時に最小 usage を選択；`round-robin` — 均等分散、`accountPoolStickyLimit`（既定 `1`、1–100）で 1 選択あたりの成功 bind 数；`fill-first` — アクティブアカウントを cooldown、再認証、または threshold まで使い切り（未知 usage は強制切替しない）後、安定ソート順で次へ。いずれの戦略も、まだ quota に余裕がある `codexAccountPriorities` の最上位 tier の**中で**動作します（順序が tier を、戦略がその tier 内のアカウントを決めます）。rotation は provider enforcement を回避しません — 複数アカウント利用は ToS 違反の可能性があります。
 :::
 
 ### 管理型レコード形式
diff --git a/docs-site/src/content/docs/ko/guides/web-dashboard.md b/docs-site/src/content/docs/ko/guides/web-dashboard.md
index b5ea350c9..9328fff8b 100644
--- a/docs-site/src/content/docs/ko/guides/web-dashboard.md
+++ b/docs-site/src/content/docs/ko/guides/web-dashboard.md
@@ -81,8 +81,16 @@ Dashboard의 **Sub-agent delegation** 선택기는 `injectionModel`과 선택적
 
 **Codex Auth** 페이지는 네이티브 ChatGPT/Codex 라우트를 관리합니다.
 
-- 계정을 직접 고르면 다음 새 Codex 세션부터 바뀝니다. 이미 계정이 묶인 thread는 이 수동 전환만으로
-  중간에 이동하지 않습니다.
+- 계정을 직접 고르면 곧바로 적용됩니다. 이미 계정이 묶인 thread도 다음 요청에서 고른 계정으로
+  옮겨가고, 이미 전송 중인 요청만 가져간 계정을 그대로 씁니다. 직접 고른 계정은 고정되기도 합니다. 카드에 **고정됨** 배지가
+  붙고, 그 계정이 소진되거나, 다른 계정을 고르거나, 어느 계정의 선택 순서를 바꿀 때까지 더 높은 선택
+  순서가 끼어들지 못합니다.
+- 각 계정 카드에는 **선택 순서** 컨트롤(가장 먼저 / 먼저 / 기본 / 나중에 / 가장 마지막)이 있습니다.
+  순서가 높은 계정부터 쓰이며, 그 위의 계정이 모두 소진되거나 사용할 수 없게 된 뒤에야 낮은 순서로
+  내려갑니다. 순서를 바꾸면 **다음 미바인딩 요청** 부터 적용되며, 이미 계정에 바인딩된 thread를 옮기지
+  않습니다. Codex Desktop(메인) 계정도 똑같이 정렬되므로 **가장 마지막**으로 두어 예비로 남길 수
+  있습니다. `ocx account priority`로 프리셋 밖의 값을 지정해도 카드에서 그대로 보이고 선택할 수
+  있습니다.
 - Thread affinity가 요청마다 계정이 흔들리는 일을 막습니다. 할당량 자동 전환이 켜져 있으면 오래
   실행되는 thread도 주기적으로 다시 평가합니다. 관련 사용량이 임계값 이상이고 사용량이 확실히 더 낮은
   정상 계정이 있으면 그 계정으로 다시 묶일 수 있습니다.
@@ -114,6 +122,7 @@ GUI는 프록시의 JSON 관리 API를 사용하는 얇은 클라이언트입니
 | `POST /api/oauth/login` · `GET /api/oauth/status` | 프로바이더 OAuth 로그인을 시작하고 완료 여부를 확인합니다. |
 | `GET /api/codex-auth/accounts?refresh=1` | main 및 pool 계정을 조회하고 할당량을 강제로 갱신하며 main 계정의 `hasCredential` / terminal `needsReauth` 상태를 표시합니다. |
 | `PUT /api/codex-auth/active` · `PUT /api/codex-auth/auto-switch` · `PUT /api/codex-auth/failover` | 다음 요청에 사용할 계정과 풀 라우팅 정책을 설정합니다. |
+| `GET /api/codex-auth/active` · `PUT /api/codex-auth/accounts/priority` | 실효 계정(고정 여부를 나타내는 `pinned`와 고정된 계정을 알려주는 `pinnedAccountId` 포함)을 읽고 계정 하나의 선택 순서를 설정합니다. |
 | `POST /api/codex-auth/login` · `GET /api/codex-auth/login-status` | 브라우저 로그인으로 pool 계정을 추가합니다. |
 | `GET /api/logs?tail=50&provider=...&status=5xx` | tail, 프로바이더, 정확한 상태 코드 또는 상태 등급으로 최근 요청 메타데이터를 조회합니다. |
 | `GET` / `PUT /api/subagent-models` | `spawn_agent`에 우선 노출할 모델 5개를 읽거나 설정합니다. |
diff --git a/docs-site/src/content/docs/ko/reference/cli.md b/docs-site/src/content/docs/ko/reference/cli.md
index db267493e..5e5a00d3c 100644
--- a/docs-site/src/content/docs/ko/reference/cli.md
+++ b/docs-site/src/content/docs/ko/reference/cli.md
@@ -206,7 +206,7 @@ ocx models --provider anthropic --json
 명령 표면은 다음과 같습니다.
 
 ```text
-Usage: ocx account <list|current|use|refresh|auto-switch|remove|add-key> ...
+Usage: ocx account <list|current|use|refresh|auto-switch|priority|login|reauth|code|cancel|remove|add-key|reset-credits> ...
 
 List and switch provider accounts and API-key pools (GUI parity).
 
@@ -215,9 +215,13 @@ current <provider>  Show the active account or key.
 use <provider> <id> Switch the active credential; 'main' selects the Codex App login.
 refresh <provider>  Force-refresh Codex or provider quota reports.
 auto-switch <provider> <on|off|status|threshold N>  Control the Codex pool threshold.
+priority <provider> <id|main> [first|earlier|normal|later|last|-100..100|reset]  Selection order; omit the value to read it.
 remove <provider> <id> --yes  Remove a stored account or key after an existence check.
 add-key <provider> [--label <label>]  Add a key read only from piped stdin.
-Codex pool switches apply to new sessions; running threads keep their account.
+login/reauth/code/cancel  Run browser or manual-code auth from a headless shell.
+reset-credits <id|main> [--consume --yes]  Inspect or consume Codex reset credits.
+Switching the active account takes effect immediately; running threads move on their next request, and in-flight requests keep the account they captured.
+A selection-order change applies from the next unbound request and never moves a bound thread.
 ```
 
 모든 하위 명령은 프록시가 실행 중이어야 하며 CLI가 기록된 런타임 포트를 자동으로 찾습니다. 성공은
@@ -239,6 +243,7 @@ API 오류는 종료 코드 1입니다. 자격 증명 필드는 management API
   "email": "m***@example.com",
   "plan": "plus",
   "masked": "sk-ab****wxyz",
+  "priority": 0,
   "active": true,
   "needsReauth": false,
   "quota": null
@@ -249,8 +254,9 @@ API 오류는 종료 코드 1입니다. 자격 증명 필드는 management API
 
 프로바이더를 생략하면 Codex pool, OAuth 계정, 설정된 API-key pool을 모두 나열합니다. 빈
 프로바이더는 `--all`을 지정하지 않으면 건너뛰며, 프로바이더를 지정하면 해당 자격 증명 family만
-조회합니다. 일반 출력 열은 `PROVIDER TYPE ID PLAN/LABEL STATUS`이고 고정된 Codex 행에는
-`selected`가 표시됩니다. 저장된 Kiro 계정이 있으면 로그인 슬롯이 하나이며 다시 로그인하면 현재 계정이
+조회합니다. 일반 출력 열은 `PROVIDER TYPE ID PLAN/LABEL PRIORITY STATUS`이고 고정된 Codex 행에는
+`selected`가 표시됩니다. `PRIORITY`는 부호가 붙은 Codex 선택 순서(설정하지 않았으면 `0`)이며, OAuth
+계정이나 API key처럼 순서가 적용되지 않는 행에는 `-`가 표시됩니다. 저장된 Kiro 계정이 있으면 로그인 슬롯이 하나이며 다시 로그인하면 현재 계정이
 교체된다는 안내가 나옵니다. 결과가 비어 있어도 성공입니다. `--json`은 다음을 반환합니다.
 
 ```text
@@ -270,9 +276,9 @@ API 오류는 종료 코드 1입니다. 자격 증명 필드는 management API
 #### `ocx account use <provider> <account-or-key-id|main> [--json]`
 
 기존 Codex 계정, OAuth 계정 또는 API key를 선택합니다. `openai`에서 `main`은 Codex App 로그인을
-선택합니다. Codex 선택은 **새 세션**부터 적용되며 기존 thread는 현재 계정을 유지합니다. auto-switch
-threshold가 켜져 있으면 나중에 수동 pin을 덮어쓸 수 있습니다. 알 수 없는 프로바이더나 id는 종료
-코드 1입니다. `--json`은 다음을 반환합니다.
+선택합니다. Codex 선택은 **곧바로 적용**됩니다. 실행 중인 thread는 다음 요청에서 옮겨가고, 이미 전송
+중인 요청만 가져간 계정을 그대로 씁니다. auto-switch threshold가 켜져 있으면 나중에 수동 pin을
+덮어쓸 수 있습니다. 알 수 없는 프로바이더나 id는 종료 코드 1입니다. `--json`은 다음을 반환합니다.
 
 ```text
 { ok: true, provider, type, activeId }
@@ -302,6 +308,27 @@ OAuth 및 API-key 프로바이더에서는 provider quota-report endpoint를 강
 { provider, autoSwitchThreshold: number, enabled: boolean }
 ```
 
+#### `ocx account priority <provider> <account-id|main> [<-100..100|first|earlier|normal|later|last|reset>] [--json]`
+
+Codex pool 계정 하나의 선택 순서를 읽거나 설정합니다. **값이 클수록 먼저** 쓰이고 기본값은 `0`,
+범위는 `-100`부터 `100`까지입니다. 순서를 갖는 것은 `openai` Codex pool뿐이므로 다른 프로바이더는
+종료 코드 1입니다. `main`은 Codex Desktop 로그인을 가리키며 다른 pool 계정과 똑같이 정렬됩니다.
+`ocx account priority openai main last`로 예비 계정으로 남겨 둘 수 있습니다.
+
+프리셋 단어는 작은 정수의 다른 이름입니다. `first`는 `+2`, `earlier`는 `+1`, `normal`은 `0`,
+`later`는 `-1`, `last`는 `-2`입니다. `reset`은 기본값으로 되돌리고 저장된 항목을 지웁니다. **값을
+생략하면 읽기**가 되어 현재 순서를 바꾸지 않습니다.
+
+순서는 어떤 계정을 먼저 볼지 정할 뿐 어떤 계정을 쓸 수 있는지는 정하지 않습니다. 선택은 여전히
+적격한 계정 안에서 이루어지며, quota 여유가 남은 최상위 tier를 고른 뒤 그 안은
+`accountPoolStrategy`가 정합니다. 일시 중지, cooldown, 재인증에는 영향을 주지 않습니다. 변경은 새 세션뿐 아니라 **다음 미바인딩 요청** 부터 적용됩니다. 상위 순서에 여유가 돌아오면 preemption이
+미바인딩 요청을 곧바로 끌어올립니다. 이미 계정에 바인딩된 thread는 보통 그 계정이 소진될 때까지 유지하지만, 재인증 실패나 quota cooldown, 연속된 일시적 실패는 그보다 먼저 바인딩을 해제합니다. 받아들여진 쓰기는 어떤 계정에 걸려 있든 수동 "지금 이 계정 사용" 고정도 해제합니다. 이미 설정된 순서를 그대로 쓰는 경우에도 마찬가지이며, 이는 현재 선택된 계정을 그대로 두고 고정만 해제하는 유일한 방법입니다(관리 API로 활성 계정을 비우면 고정도 풀리지만 그 선택까지 사라집니다). 프록시에 연결할 수 없거나, 없는
+계정 id, 허용되지 않는 값은 모두 종료 코드 1입니다. `--json`은 다음을 반환합니다.
+
+```text
+{ ok: true, provider, id, priority: number, preset: string | null }
+```
+
 #### `ocx account remove <provider> <id|main> --yes [--json]`
 
 보호된 비대화형 삭제이므로 `--yes`가 필수입니다. 삭제 전에 id 존재 여부를 확인하며, 없는 id는
diff --git a/docs-site/src/content/docs/ko/reference/configuration.md b/docs-site/src/content/docs/ko/reference/configuration.md
index 73437d327..ec2e07d58 100644
--- a/docs-site/src/content/docs/ko/reference/configuration.md
+++ b/docs-site/src/content/docs/ko/reference/configuration.md
@@ -53,8 +53,9 @@ namespaced selected id를 bare id로 바꿉니다.
 | `syncResumeHistory?` | `boolean` | `true` | 되돌릴 수 있는 Codex App 기록 호환 모드. opencodex가 원래 Codex thread metadata를 백업하고, 예전 OpenAI interactive row를 `opencodex`로 재매핑하며, opencodex가 만든 `exec` row를 App에 보이는 source로 잠시 승격합니다. `ocx stop` / `ocx restore`는 백업한 OpenAI row를 복원하고 남은 opencodex user thread를 OpenAI로 돌려 네이티브 Codex가 `config.toml`에서 프록시를 제거한 뒤에도 이어서 열 수 있게 합니다. 끄려면 `false`로 설정합니다. |
 | `codexAccounts?` | `CodexAccount[]` | `[]` | Codex Auth 대시보드에서 관리하는 ChatGPT/Codex pool 계정 metadata. secret은 `codex-accounts.json`에 따로 둡니다. |
 | `pausedCodexAccountIds?` | `string[]` | `[]` | Codex Auth에서 재개할 때까지 이후의 모든 Pool 선택에서 제외할 계정 ID. 메인 계정을 일시 중지하면 `__main__`도 포함됩니다. |
+| `codexAccountPriorities?` | `Record<string,number>` | — | Codex pool의 계정별 선택 순서. 계정 ID → `-100`부터 `100`까지의 정수이며 **값이 클수록 먼저** 쓰이고, 항목이 없으면 `0`입니다. 이는 eligibility 경계가 아니라 순서 경계입니다. 선택은 이미 적격한 계정들을 quota 여유가 남은 최상위 tier로 좁히고, 그 tier 안에서 `accountPoolStrategy`가 계정을 고릅니다. tier를 건너뛰는 경우는 그 구성원 전부가 `autoSwitchThreshold` 초과, cooldown, soft-avoid, 일시 중지 또는 재인증 대기일 때뿐이며, usage를 알 수 없다고 해서 tier가 소진되지는 않습니다. 순서는 부적격 계정을 선택 가능하게 만들지 않고, 이미 계정에 묶인 thread를 다시 bind하지도 않습니다. 메인 `__main__` 계정도 동일한 조건으로 참여하므로 Codex Desktop 로그인을 마지막에 쓰도록 둘 수 있습니다. 항목이 하나도 없으면 동작은 이전과 같습니다. map이 잘못된 경우 경고를 출력하고 순서 지정을 끕니다(config 복구는 하지 않습니다). `ocx account priority`와 Codex Auth 페이지에서 관리합니다. |
 | `codexAccountNamespaces?` | `Record<string,string>` | — | 공개 model selector namespace에서 저장된 Codex 계정 target으로 연결하는 선택적 map입니다. 이 foundation layer는 map을 검증하고 저장하지만 picker row를 추가하거나 routing을 변경하지 않습니다. |
-| `activeCodexAccountId?` | `string` | — | 수동으로 선택한 pool 계정. 선택 시 기존 thread affinity를 지우고 다음 요청부터 적용하며, 진행 중인 요청은 기존 계정을 유지합니다. |
+| `activeCodexAccountId?` | `string` | — | 수동으로 선택한 pool 계정. 선택 시 기존 thread affinity를 지우고 다음 요청부터 적용하며, 진행 중인 요청은 기존 계정을 유지합니다. 수동 선택은 해당 tier의 상한도 pin합니다(`activeCodexAccountPinned`에 기록). 더 높은 `codexAccountPriorities` tier는 소진, 제외, 삭제 또는 명시적인 failover/promotion으로 pin이 해제될 때까지 preempt할 수 없습니다. 같은 tier 안의 일반 round-robin 이동은 pin을 해제하지 않습니다. `codexAccountPriorities`에 값을 쓰면 pin도 해제되므로, 순서를 정하기 전에 걸어둔 pin이 나중에 정한 순서를 이기는 일은 없습니다. `GET /api/codex-auth/active`는 실효 계정의 pin 여부를 `pinned`로, tier 상한을 가진 계정을 `pinnedAccountId`로 보고합니다. |
 | `autoSwitchThreshold?` | `number` | `80` | 새 세션 자동 전환용 사용량 백분율 threshold. 알려진 5시간, 주간, 30일 quota window 중 가장 높은 점수를 씁니다. `0`이면 quota 자동 전환을 끕니다. `quota` 전략과 `fill-first` drain threshold에도 사용됩니다. |
 | `accountPoolStrategy?` | `"quota" \| "round-robin" \| "fill-first"` | `"quota"` | Codex pool의 새 세션 rotation 전략. **새 세션에만** 적용되며 기존 thread id는 affinity를 유지합니다. `quota`(기본) — 활성 계정이 `autoSwitchThreshold`를 넘으면 알려진 usage가 가장 낮은 계정 선택. `round-robin` — 적격 계정 간 smooth weighted 균등 분배. `fill-first` — cooldown, 사용 불가 또는(설정 시) `autoSwitchThreshold`까지 활성 계정을 소진(알 수 없는 usage는 강제 전환하지 않음)한 뒤 안정 정렬 순으로 다음 계정. |
 | `accountPoolStickyLimit?` | `number` | `1` | 한 round-robin 선택이 다음으로 넘어가기 전에 유지하는 성공적 새 세션 bind 수. 범위 1–100. `accountPoolStrategy`가 `round-robin`일 때만 적용. |
@@ -96,7 +97,9 @@ cooldown, health에 따라 자동 라우팅됩니다.
 **rotation 전략**(새 세션만; bound thread는 변경 없음): `quota`(기본) — `autoSwitchThreshold` 초과 시
 최저 usage 선택; `round-robin` — 균등 분배, `accountPoolStickyLimit`(기본 `1`, 1–100)로 한 선택당
 성공 bind 수; `fill-first` — 활성 계정을 cooldown, 재인증 또는 threshold까지 소진(알 수 없는 usage는
-강제 전환하지 않음)한 뒤 안정 정렬 순으로 다음 계정. rotation은 provider enforcement를 우회하지
+강제 전환하지 않음)한 뒤 안정 정렬 순으로 다음 계정. 모든 전략은 quota 여유가 남은 최상위
+`codexAccountPriorities` tier **안에서** 동작합니다. 선택 순서가 tier를, 전략이 그 tier 안의 계정을
+정합니다. rotation은 provider enforcement를 우회하지
 않습니다 — 다계정 사용은 ToS 위반일 수 있습니다.
 :::
 
diff --git a/docs-site/src/content/docs/reference/cli.md b/docs-site/src/content/docs/reference/cli.md
index 1d37ba14b..35f38e5a9 100644
--- a/docs-site/src/content/docs/reference/cli.md
+++ b/docs-site/src/content/docs/reference/cli.md
@@ -262,7 +262,7 @@ List and switch provider accounts and API-key pools through the running proxy. T
 surface is:
 
 ```text
-Usage: ocx account <list|current|use|refresh|auto-switch|remove|add-key> ...
+Usage: ocx account <list|current|use|refresh|auto-switch|priority|login|reauth|code|cancel|remove|add-key|reset-credits> ...
 
 List and switch provider accounts and API-key pools (GUI parity).
 
@@ -271,9 +271,13 @@ current <provider>  Show the active account or key.
 use <provider> <id> Switch the active credential; 'main' selects the Codex App login.
 refresh <provider>  Force-refresh Codex or provider quota reports.
 auto-switch <provider> <on|off|status|threshold N>  Control the Codex pool threshold.
+priority <provider> <id|main> [first|earlier|normal|later|last|-100..100|reset]  Selection order; omit the value to read it.
 remove <provider> <id> --yes  Remove a stored account or key after an existence check.
 add-key <provider> [--label <label>]  Add a key read only from piped stdin.
-Codex pool switches apply to new sessions; running threads keep their account.
+login/reauth/code/cancel  Run browser or manual-code auth from a headless shell.
+reset-credits <id|main> [--consume --yes]  Inspect or consume Codex reset credits.
+Switching the active account takes effect immediately; running threads move on their next request, and in-flight requests keep the account they captured.
+A selection-order change applies from the next unbound request and never moves a bound thread.
 ```
 
 All subcommands require the proxy to be running; the CLI auto-resolves its recorded runtime port.
@@ -295,6 +299,7 @@ Codex App login in the `openai` account pool, OAuth accounts without an email ap
   "email": "m***@example.com",
   "plan": "plus",
   "masked": "sk-ab****wxyz",
+  "priority": 0,
   "active": true,
   "needsReauth": false,
   "quota": null
@@ -305,7 +310,9 @@ Codex App login in the `openai` account pool, OAuth accounts without an email ap
 
 Without a provider, lists the Codex pool, OAuth accounts, and configured API-key pools. Empty
 providers are skipped unless `--all` is present. With a provider, lists only that credential family.
-Human output uses `PROVIDER TYPE ID PLAN/LABEL STATUS`; a manually chosen Codex row is marked `selected`.
+Human output uses `PROVIDER TYPE ID PLAN/LABEL PRIORITY STATUS`; a manually chosen Codex row is marked
+`selected`. `PRIORITY` is the signed Codex selection order (`0` when unset) and shows `-` for rows
+where ordering does not apply, such as OAuth accounts and API keys.
 When a stored Kiro account exists, the output notes that Kiro has one login slot and that signing in
 again replaces the current account. An empty result is still success. `--json` returns:
 
@@ -326,8 +333,9 @@ returns:
 #### `ocx account use <provider> <account-or-key-id|main> [--json]`
 
 Selects an existing Codex account, OAuth account, or API key. For `openai`, `main` selects the Codex
-App login. Codex selections apply only to **new sessions**; existing threads keep their account, and
-an enabled auto-switch threshold may later override the manual pin. Unknown providers or ids exit 1.
+App login. A Codex selection **takes effect immediately**: running threads move on their next request,
+and only requests already in flight keep the account they captured. An enabled auto-switch threshold
+may later override the manual pin. Unknown providers or ids exit 1.
 `--json` returns:
 
 ```text
@@ -357,6 +365,34 @@ exit 1. `--json` returns:
 { provider, autoSwitchThreshold: number, enabled: boolean }
 ```
 
+#### `ocx account priority <provider> <account-id|main> [<-100..100|first|earlier|normal|later|last|reset>] [--json]`
+
+Reads or sets one Codex pool account's selection order: **higher is used earlier**, the default is
+`0`, and the range is `-100` through `100`. Only the `openai` Codex pool is ordered, so other
+providers exit 1. `main` targets the Codex Desktop login, which is ordered like any other pool
+account — `ocx account priority openai main last` is how you keep it as the reserve.
+
+Preset words stand in for small integers: `first` is `+2`, `earlier` is `+1`, `normal` is `0`,
+`later` is `-1`, and `last` is `-2`. `reset` returns the account to the default and drops its stored
+entry. **Omitting the value reads** the current order instead of writing one.
+
+Ordering picks which accounts are considered first, not which are usable: selection still runs among
+eligible accounts, taking the highest order tier that still has quota headroom and leaving
+`accountPoolStrategy` to choose inside it. Pause, cooldown, and reauthentication are unaffected.
+Changes apply from the **next unbound request**, not only from newly started sessions: preemption moves
+an unbound request up as soon as a higher order regains headroom. Threads already bound to an account
+normally keep it until that account is drained; a reauthentication failure, a quota cooldown, or a
+transient-failure streak releases the binding before that. Any accepted write also releases a manual
+"use this account now" pin, on whichever account held it, including a write that stores the
+order an account already had -- this is the only way to clear a pin while keeping the account
+that is currently selected. (Clearing the active account through the management API releases a
+pin too, but it drops that selection along with it.) An unreachable proxy, an
+unknown account id, or a value outside the accepted set exits 1. `--json` returns:
+
+```text
+{ ok: true, provider, id, priority: number, preset: string | null }
+```
+
 #### `ocx account remove <provider> <id|main> --yes [--json]`
 
 This guarded, non-interactive deletion requires `--yes`. Before deleting, it verifies that the id
diff --git a/docs-site/src/content/docs/reference/configuration.md b/docs-site/src/content/docs/reference/configuration.md
index 7c2de76b3..711a3a61b 100644
--- a/docs-site/src/content/docs/reference/configuration.md
+++ b/docs-site/src/content/docs/reference/configuration.md
@@ -58,8 +58,9 @@ differing backup and rewrites known legacy namespaced selected ids to bare ids.
 | `syncResumeHistory?` | `boolean` | `true` | Reversible Codex App history compatibility mode. opencodex backs up original Codex thread metadata, remaps old OpenAI interactive rows to `opencodex`, and temporarily promotes opencodex-created `exec` rows to an app-visible source. `ocx stop` / `ocx restore` restore backed-up OpenAI rows and eject remaining opencodex user threads to OpenAI so native Codex can resume them after the proxy is removed from `config.toml`. Set `false` to opt out. |
 | `codexAccounts?` | `CodexAccount[]` | `[]` | ChatGPT/Codex pool account metadata managed by the Codex Auth dashboard. Secrets live separately in `codex-accounts.json`. |
 | `pausedCodexAccountIds?` | `string[]` | `[]` | Accounts excluded from every future Pool selection until resumed in Codex Auth. Includes the main `__main__` account when paused. |
+| `codexAccountPriorities?` | `Record<string,number>` | — | Per-account selection order for the Codex pool: account id → integer from `-100` to `100`, **higher is used earlier**, absent means `0`. This is an ordering boundary, not an eligibility one: selection narrows the already-eligible accounts to the highest tier that still has quota headroom, and `accountPoolStrategy` then picks within that tier. A tier is skipped only when every member is over `autoSwitchThreshold`, cooling down, soft-avoided, paused, or needs reauthentication — unknown quota never drains a tier. Ordering never makes an ineligible account selectable and never re-binds a thread that already has an account. The main `__main__` account participates on equal terms, which is how the Codex Desktop login can be set to drain last. With no entries the pool behaves exactly as before. A malformed map is ignored with a console warning (ordering off, no config repair). Managed by `ocx account priority` and the Codex Auth page. |
 | `codexAccountNamespaces?` | `Record<string,string>` | — | Optional public model-selector namespace → stored Codex account target map. This foundation layer validates and persists the map but does not add picker rows or change routing. |
-| `activeCodexAccountId?` | `string` | — | Manually selected Pool account. Selection clears existing thread affinity and applies to the next request; in-flight requests keep their captured account. |
+| `activeCodexAccountId?` | `string` | — | Manually selected Pool account. Selection clears existing thread affinity and applies to the next request; in-flight requests keep their captured account. Choosing an account by hand also pins its tier ceiling (recorded in `activeCodexAccountPinned`): a higher `codexAccountPriorities` tier cannot preempt it until the pin is released by drain, exclusion, deletion, or an explicit failover/promotion away. Ordinary round-robin movement inside the capped tier does not release it. Writing any `codexAccountPriorities` entry also releases the pin, so a pin made before an order existed cannot outrank one set afterwards. `GET /api/codex-auth/active` reports both whether the effective account is pinned (`pinned`) and the account carrying the ceiling (`pinnedAccountId`). |
 | `autoSwitchThreshold?` | `number` | `80` | Usage percent threshold for new-session auto-switching. The score uses the hottest known 5h, weekly, or 30d quota window. Set `0` to disable quota auto-switching. Used by the `quota` strategy and as the drain threshold for `fill-first`. |
 | `accountPoolStrategy?` | `"quota" \| "round-robin" \| "fill-first"` | `"quota"` | New-session rotation strategy for the Codex pool. Applies to **new sessions only**; existing thread ids keep affinity. `quota` — today's default: pick the lowest known usage when the active account crosses `autoSwitchThreshold`. `round-robin` — even spread across eligible accounts via smooth weighted selection. `fill-first` — keep the active account until it cools down, becomes unusable, or crosses `autoSwitchThreshold` when set (unknown usage does not force a switch), then advance to the next eligible account in stable sorted order. |
 | `accountPoolStickyLimit?` | `number` | `1` | Successful new-session binds retained on one round-robin selection before advancing. Range 1–100; only applies when `accountPoolStrategy` is `round-robin`. |
@@ -161,6 +162,9 @@ and unknown or failed quota refreshes are left unchanged.
 | `round-robin` | Even spread across eligible accounts. `accountPoolStickyLimit` (default `1`, range 1–100) keeps that many successful new-session binds on one pick before advancing. |
 | `fill-first` | Drain the active account until cooldown, reauthentication, or (when set) `autoSwitchThreshold`; unknown usage does not force a switch. Then advance to the next eligible account in stable sorted order. |
 
+Every strategy runs **within** the highest `codexAccountPriorities` tier that still has quota
+headroom: selection order chooses the tier, the strategy chooses the account inside it.
+
 Rotation strategies do not protect against provider enforcement — multi-account use may violate
 provider terms of service.
 
diff --git a/docs-site/src/content/docs/ru/guides/web-dashboard.md b/docs-site/src/content/docs/ru/guides/web-dashboard.md
index c9fde72ee..fa4afc217 100644
--- a/docs-site/src/content/docs/ru/guides/web-dashboard.md
+++ b/docs-site/src/content/docs/ru/guides/web-dashboard.md
@@ -84,8 +84,18 @@ bun run dev:gui
 
 Страница **Codex Auth** управляет нативным маршрутом ChatGPT/Codex:
 
-- Ручной выбор аккаунта меняет следующую новую сессию Codex; уже привязанный поток при таком ручном
-  переключении сохраняет текущий аккаунт.
+- Ручной выбор аккаунта применяется сразу: уже привязанный поток переходит на выбранный аккаунт со
+  следующего запроса, а захваченный аккаунт сохраняют только уже отправленные запросы. Выбранный вручную аккаунт также закрепляется:
+  на карточке появляется бейдж **ЗАКРЕПЛЁН**, и более высокий порядок выбора не может вытеснить этот
+  аккаунт, пока он не исчерпан, пока вы не выберете другой аккаунт или пока не измените порядок
+  выбора любого аккаунта.
+- На карточке каждого аккаунта есть элемент управления **Порядок выбора** (Первым, Раньше,
+  По умолчанию, Позже, Последним). Аккаунты с более высоким порядком используются раньше, а на более
+  низкий порядок пул опускается лишь тогда, когда все аккаунты выше исчерпаны или недоступны.
+  Изменённый порядок действует начиная со **следующего непривязанного запроса** и никогда не
+  перемещает уже привязанный поток. Аккаунт Codex Desktop (основной) упорядочивается наравне с
+  остальными, поэтому его можно поставить **Последним** и держать в резерве. Порядок, заданный через
+  `ocx account priority` вне этих пяти пресетов, остаётся видимым и выбираемым на карточке.
 - Привязка потока предотвращает метание между аккаунтами на каждом запросе. При включённом
   автопереключении по квоте долгоживущий поток периодически переоценивается и может
   перепривязаться, когда его релевантное использование достигает порога и существует подходящий
@@ -118,6 +128,7 @@ GUI — это тонкий клиент поверх JSON-API управлен
 | `POST /api/oauth/login` · `GET /api/oauth/status` | Запуск OAuth-процесса провайдера и опрос его завершения. |
 | `GET /api/codex-auth/accounts?refresh=1` | Список основного и пуловых аккаунтов с принудительным обновлением квот и состояниями `hasCredential` / terminal `needsReauth` основного аккаунта. |
 | `PUT /api/codex-auth/active` · `PUT /api/codex-auth/auto-switch` · `PUT /api/codex-auth/failover` | Выбор аккаунта для следующего запроса и настройка маршрутизации пула. |
+| `GET /api/codex-auth/active` · `PUT /api/codex-auth/accounts/priority` | Чтение эффективного аккаунта (включая признак закрепления `pinned` и закреплённый аккаунт `pinnedAccountId`) и установка порядка выбора для одного аккаунта. |
 | `POST /api/codex-auth/login` · `GET /api/codex-auth/login-status` | Добавление аккаунта пула через вход в браузере. |
 | `GET /api/logs?tail=50&provider=...&status=5xx` | Чтение метаданных недавних запросов с необязательными фильтрами tail, провайдера и точного/классового статуса. |
 | `GET` / `PUT /api/subagent-models` | Чтение или настройка пяти выделенных моделей переопределения `spawn_agent`. |
diff --git a/docs-site/src/content/docs/ru/reference/cli.md b/docs-site/src/content/docs/ru/reference/cli.md
index 0c1456354..3c7368dbf 100644
--- a/docs-site/src/content/docs/ru/reference/cli.md
+++ b/docs-site/src/content/docs/ru/reference/cli.md
@@ -218,7 +218,7 @@ ocx models --provider anthropic --json
 Поставляемая справка выглядит так:
 
 ```text
-Usage: ocx account <list|current|use|refresh|auto-switch|remove|add-key> ...
+Usage: ocx account <list|current|use|refresh|auto-switch|priority|login|reauth|code|cancel|remove|add-key|reset-credits> ...
 
 List and switch provider accounts and API-key pools (GUI parity).
 
@@ -227,9 +227,13 @@ current <provider>  Show the active account or key.
 use <provider> <id> Switch the active credential; 'main' selects the Codex App login.
 refresh <provider>  Force-refresh Codex or provider quota reports.
 auto-switch <provider> <on|off|status|threshold N>  Control the Codex pool threshold.
+priority <provider> <id|main> [first|earlier|normal|later|last|-100..100|reset]  Selection order; omit the value to read it.
 remove <provider> <id> --yes  Remove a stored account or key after an existence check.
 add-key <provider> [--label <label>]  Add a key read only from piped stdin.
-Codex pool switches apply to new sessions; running threads keep their account.
+login/reauth/code/cancel  Run browser or manual-code auth from a headless shell.
+reset-credits <id|main> [--consume --yes]  Inspect or consume Codex reset credits.
+Switching the active account takes effect immediately; running threads move on their next request, and in-flight requests keep the account they captured.
+A selection-order change applies from the next unbound request and never moves a bound thread.
 ```
 
 Все подкоманды требуют работающего прокси; CLI автоматически определяет записанный runtime-порт.
@@ -254,6 +258,7 @@ plan/label по цепочке фолбэков использует план, 
   "email": "m***@example.com",
   "plan": "plus",
   "masked": "sk-ab****wxyz",
+  "priority": 0,
   "active": true,
   "needsReauth": false,
   "quota": null
@@ -265,7 +270,9 @@ plan/label по цепочке фолбэков использует план, 
 Без указания провайдера перечисляет пул Codex, OAuth-аккаунты и настроенные пулы API-ключей.
 Пустые провайдеры пропускаются, если не передан `--all`. С указанным провайдером перечисляет
 только это семейство учётных данных. Человекочитаемый вывод использует столбцы
-`PROVIDER TYPE ID PLAN/LABEL STATUS`; вручную выбранная строка Codex помечается как `selected`.
+`PROVIDER TYPE ID PLAN/LABEL PRIORITY STATUS`; вручную выбранная строка Codex помечается как
+`selected`. `PRIORITY` — знаковый порядок выбора Codex (`0`, если не задан); для строк, к которым
+порядок неприменим (OAuth-аккаунты и API-ключи), выводится `-`.
 Если существует сохранённый аккаунт Kiro, вывод отмечает, что у Kiro один слот входа и что
 повторный вход заменяет текущий аккаунт. Пустой результат — по-прежнему успех. `--json`
 возвращает:
@@ -287,9 +294,10 @@ plan/label по цепочке фолбэков использует план, 
 #### `ocx account use <provider> <account-or-key-id|main> [--json]`
 
 Выбирает существующий аккаунт Codex, OAuth-аккаунт или API-ключ. Для `openai` значение `main`
-выбирает вход Codex App. Выбор для Codex применяется только к **новым сессиям**; существующие
-потоки сохраняют свой аккаунт, а включённый порог автопереключения может позже переопределить
-ручное закрепление. Неизвестные провайдеры или id завершаются с кодом 1. `--json` возвращает:
+выбирает вход Codex App. Выбор для Codex **применяется сразу**: работающие потоки переходят на новый
+аккаунт со следующего запроса, и только уже отправленные запросы сохраняют захваченный аккаунт.
+Включённый порог автопереключения может позже переопределить ручное закрепление. Неизвестные
+провайдеры или id завершаются с кодом 1. `--json` возвращает:
 
 ```text
 { ok: true, provider, type, activeId }
@@ -320,6 +328,29 @@ plan/label по цепочке фолбэков использует план, 
 { provider, autoSwitchThreshold: number, enabled: boolean }
 ```
 
+#### `ocx account priority <provider> <account-id|main> [<-100..100|first|earlier|normal|later|last|reset>] [--json]`
+
+Читает или задаёт порядок выбора одного аккаунта пула Codex: **больше — используется раньше**,
+значение по умолчанию `0`, диапазон от `-100` до `100`. Порядок есть только у пула Codex `openai`,
+поэтому другие провайдеры завершаются с кодом 1. `main` указывает на логин Codex Desktop, который
+упорядочивается наравне с остальными: `ocx account priority openai main last` оставляет его резервным.
+
+Слова-пресеты заменяют небольшие целые числа: `first` — это `+2`, `earlier` — `+1`, `normal` — `0`,
+`later` — `-1`, `last` — `-2`. `reset` возвращает значение по умолчанию и удаляет сохранённую запись.
+**Пропуск значения читает** текущий порядок, ничего не записывая.
+
+Порядок определяет, какие аккаунты рассматриваются первыми, а не какие пригодны: выбор по-прежнему
+идёт среди подходящих аккаунтов, берётся самый высокий уровень с оставшимся запасом квоты, а внутри
+него аккаунт выбирает `accountPoolStrategy`. Пауза, cooldown и повторная аутентификация не
+затрагиваются. Изменения действуют начиная со **следующего непривязанного запроса**, а не только для новых сессий:
+как только у более высокого порядка снова появляется запас, preemption сразу поднимает непривязанный
+запрос. Потоки, уже привязанные к аккаунту, обычно сохраняют его до исчерпания, но ошибка повторной аутентификации, cooldown по квоте или серия временных сбоев снимают привязку раньше. Любая принятая запись также снимает ручное закрепление "использовать этот аккаунт сейчас" с того аккаунта, на котором оно стояло, в том числе запись того же порядка, который уже был установлен, -- это единственный способ снять закрепление, сохранив выбранный аккаунт. (Сброс активного аккаунта через management API тоже снимает закрепление, но вместе с самим выбором.) Недоступный прокси, неизвестный id аккаунта или значение вне допустимого набора завершаются
+с кодом 1. `--json` возвращает:
+
+```text
+{ ok: true, provider, id, priority: number, preset: string | null }
+```
+
 #### `ocx account remove <provider> <id|main> --yes [--json]`
 
 Это защищённое неинтерактивное удаление требует `--yes`. Перед удалением команда проверяет, что
diff --git a/docs-site/src/content/docs/ru/reference/configuration.md b/docs-site/src/content/docs/ru/reference/configuration.md
index 3a0cff68a..c273834e2 100644
--- a/docs-site/src/content/docs/ru/reference/configuration.md
+++ b/docs-site/src/content/docs/ru/reference/configuration.md
@@ -57,8 +57,9 @@ opencodex настраивается файлом `~/.opencodex/config.json`. Е
 | `syncResumeHistory?` | `boolean` | `true` | Обратимый режим совместимости истории Codex App. opencodex резервирует исходные метаданные потоков Codex, переназначает старые интерактивные строки OpenAI на `opencodex` и временно повышает созданные opencodex строки `exec` до видимого в приложении источника. `ocx stop` / `ocx restore` восстанавливают зарезервированные строки OpenAI и возвращают оставшиеся пользовательские потоки opencodex обратно к OpenAI, чтобы нативный Codex мог возобновлять их после удаления прокси из `config.toml`. Установите `false`, чтобы отказаться. |
 | `codexAccounts?` | `CodexAccount[]` | `[]` | Метаданные аккаунтов пула ChatGPT/Codex, управляемые дашбордом Codex Auth. Секреты хранятся отдельно в `codex-accounts.json`. |
 | `pausedCodexAccountIds?` | `string[]` | `[]` | ID аккаунтов, исключённых из всех будущих выборов Pool до возобновления в Codex Auth. При паузе основного аккаунта включает `__main__`. |
+| `codexAccountPriorities?` | `Record<string,number>` | — | Порядок выбора для каждого аккаунта пула Codex: id аккаунта → целое число от `-100` до `100`, **больше — используется раньше**, отсутствие означает `0`. Это граница порядка, а не пригодности: выбор сужает уже подходящие аккаунты до самого высокого уровня, у которого ещё есть запас квоты, а внутри этого уровня аккаунт выбирает `accountPoolStrategy`. Уровень пропускается, только когда все его аккаунты превысили `autoSwitchThreshold`, находятся в cooldown, под soft-avoid, на паузе или требуют повторной аутентификации; неизвестный usage никогда не исчерпывает уровень. Порядок не делает выбираемым непригодный аккаунт и не перепривязывает поток, у которого аккаунт уже есть. Основной аккаунт `__main__` участвует на равных — именно так логин Codex Desktop можно оставить на самый конец. Без записей поведение остаётся прежним. Некорректная map игнорируется с предупреждением в консоли (порядок отключается, восстановление config не запускается). Управляется через `ocx account priority` и страницу Codex Auth. |
 | `codexAccountNamespaces?` | `Record<string,string>` | — | Необязательная map публичного namespace селектора модели на сохранённую цель аккаунта Codex. Этот foundation layer проверяет и сохраняет map, но не добавляет строки picker и не меняет routing. |
-| `activeCodexAccountId?` | `string` | — | Вручную выбранный аккаунт пула. Выбор очищает существующие привязки потоков и действует со следующего запроса; выполняющиеся запросы сохраняют захваченный аккаунт. |
+| `activeCodexAccountId?` | `string` | — | Вручную выбранный аккаунт пула. Выбор очищает существующие привязки потоков и действует со следующего запроса; выполняющиеся запросы сохраняют захваченный аккаунт. Ручной выбор также закрепляет потолок его уровня (в `activeCodexAccountPinned`): более высокий уровень `codexAccountPriorities` не может вытеснить его, пока закрепление не снято из-за исчерпания, исключения, удаления или явного failover/promotion на другой аккаунт. Обычное движение round-robin внутри закреплённого уровня не снимает закрепление. Запись любой записи `codexAccountPriorities` также снимает закрепление, поэтому закрепление, сделанное до появления порядка, не может пересилить порядок, заданный позже. `GET /api/codex-auth/active` сообщает, закреплён ли эффективный аккаунт, в `pinned`, а аккаунт с потолком уровня — в `pinnedAccountId`. |
 | `autoSwitchThreshold?` | `number` | `80` | Порог процента использования для автопереключения новых сессий. Оценка использует самое «горячее» из известных окон квоты — 5-часовое, недельное или 30-дневное. Установите `0`, чтобы отключить автопереключение по квоте. Используется стратегией `quota` и как порог исчерпания для `fill-first`. |
 | `accountPoolStrategy?` | `"quota" \| "round-robin" \| "fill-first"` | `"quota"` | Стратегия ротации новых сессий для пула Codex. Применяется **только к новым сессиям**; существующие id потоков сохраняют affinity. `quota` (по умолчанию) — выбор наименьшего известного usage, когда активный аккаунт превышает `autoSwitchThreshold`. `round-robin` — равномерное распределение между подходящими аккаунтами через smooth weighted selection. `fill-first` — использовать активный аккаунт до cooldown, недоступности или (если задано) `autoSwitchThreshold` (неизвестный usage не принуждает к переключению), затем переход к следующему подходящему аккаунту в стабильном отсортированном порядке. |
 | `accountPoolStickyLimit?` | `number` | `1` | Число успешных привязок новых сессий, удерживаемых на одном выборе round-robin перед переходом дальше. Диапазон 1–100; только при `accountPoolStrategy` = `round-robin`. |
@@ -106,7 +107,9 @@ raw id аккаунтов и email приватными, а селектор и
 — выбор наименьшего usage при превышении `autoSwitchThreshold`; `round-robin` — равномерное
 распределение, `accountPoolStickyLimit` (по умолчанию `1`, 1–100) задаёт число успешных bind на один
 выбор; `fill-first` — исчерпание активного аккаунта (cooldown, reauth или threshold; неизвестный
-usage не принуждает к переключению), затем переход к следующему. Ротация не защищает от enforcement
+usage не принуждает к переключению), затем переход к следующему. Любая стратегия работает **внутри**
+самого высокого уровня `codexAccountPriorities`, у которого ещё есть запас квоты: порядок выбирает
+уровень, стратегия — аккаунт внутри него. Ротация не защищает от enforcement
 провайдера — использование нескольких аккаунтов может нарушать ToS.
 :::
 
diff --git a/docs-site/src/content/docs/zh-cn/guides/web-dashboard.md b/docs-site/src/content/docs/zh-cn/guides/web-dashboard.md
index cac81c25c..865e14d88 100644
--- a/docs-site/src/content/docs/zh-cn/guides/web-dashboard.md
+++ b/docs-site/src/content/docs/zh-cn/guides/web-dashboard.md
@@ -75,8 +75,13 @@ Dashboard 的 **Sub-agent delegation** 选择器会保存 `injectionModel`，以
 
 **Codex Auth** 页面用于管理原生 ChatGPT/Codex 路由：
 
-- 手动选择账号会影响下一次新建的 Codex session；已经绑定账号的 thread 不会因为这次手动切换而
-  在中途转移。
+- 手动选择账号会立即生效：已经绑定账号的 thread 会在下一次请求时切换到所选账号，只有已经在传输中的
+  请求会继续使用它们捕获的账号。手动选择的账号还会被固定：卡片上会出现 **已固定** 徽章，在该账号被耗尽、你改选
+  其他账号，或你改动任意账号的选择顺序之前，更高的选择顺序都无法抢占它。
+- 每张账号卡片都带有 **选择顺序** 控件（最先 / 较先 / 默认 / 较后 / 最后）。顺序靠前的账号先被使用，
+  只有当它上面的账号全部耗尽或不可用时才会降到更靠后的顺序。改动顺序会从**下一个未绑定请求**起生效，
+  且不会移动已经绑定的 thread。Codex Desktop（主）账号同样参与排序，可以设为 **最后** 留作备用。
+  用 `ocx account priority` 设置的非预设值也会保留在卡片上，仍可选择。
 - Thread affinity 可避免每个请求都来回切换账号。启用配额自动切换后，长时间运行的 thread 会被
   定期重新评估；当相关 usage 达到阈值，并且存在使用率确实更低的可用账号时，该 thread 可能会
   重新绑定。
@@ -106,6 +111,7 @@ GUI 是代理 JSON 管理 API 之上的轻量客户端。常用 endpoint 包括
 | `POST /api/oauth/login` · `GET /api/oauth/status` | 启动 provider OAuth 流程并轮询完成状态。 |
 | `GET /api/codex-auth/accounts?refresh=1` | 列出主账号与池账号、强制刷新配额，并返回主账号的 `hasCredential` / terminal `needsReauth` 状态。 |
 | `PUT /api/codex-auth/active` · `PUT /api/codex-auth/auto-switch` · `PUT /api/codex-auth/failover` | 选择下一次请求使用的账号并配置账号池路由。 |
+| `GET /api/codex-auth/active` · `PUT /api/codex-auth/accounts/priority` | 读取实际生效的账号（含表示是否固定的 `pinned` 和指明被固定账号的 `pinnedAccountId`），并设置单个账号的选择顺序。 |
 | `POST /api/codex-auth/login` · `GET /api/codex-auth/login-status` | 通过浏览器登录添加池账号。 |
 | `GET /api/logs?tail=50&provider=...&status=5xx` | 使用 tail、provider、精确状态码或状态类别筛选近期请求元数据。 |
 | `GET` / `PUT /api/subagent-models` | 读取或设置五个置顶的 `spawn_agent` override 模型。 |
diff --git a/docs-site/src/content/docs/zh-cn/reference/cli.md b/docs-site/src/content/docs/zh-cn/reference/cli.md
index 4895752d3..591d01273 100644
--- a/docs-site/src/content/docs/zh-cn/reference/cli.md
+++ b/docs-site/src/content/docs/zh-cn/reference/cli.md
@@ -199,7 +199,7 @@ ocx models --provider anthropic --json
 通过正在运行的代理列出和切换提供商账号及 API key pool。已发布的帮助界面如下：
 
 ```text
-Usage: ocx account <list|current|use|refresh|auto-switch|remove|add-key> ...
+Usage: ocx account <list|current|use|refresh|auto-switch|priority|login|reauth|code|cancel|remove|add-key|reset-credits> ...
 
 List and switch provider accounts and API-key pools (GUI parity).
 
@@ -208,9 +208,13 @@ current <provider>  Show the active account or key.
 use <provider> <id> Switch the active credential; 'main' selects the Codex App login.
 refresh <provider>  Force-refresh Codex or provider quota reports.
 auto-switch <provider> <on|off|status|threshold N>  Control the Codex pool threshold.
+priority <provider> <id|main> [first|earlier|normal|later|last|-100..100|reset]  Selection order; omit the value to read it.
 remove <provider> <id> --yes  Remove a stored account or key after an existence check.
 add-key <provider> [--label <label>]  Add a key read only from piped stdin.
-Codex pool switches apply to new sessions; running threads keep their account.
+login/reauth/code/cancel  Run browser or manual-code auth from a headless shell.
+reset-credits <id|main> [--consume --yes]  Inspect or consume Codex reset credits.
+Switching the active account takes effect immediately; running threads move on their next request, and in-flight requests keep the account they captured.
+A selection-order change applies from the next unbound request and never moves a bound thread.
 ```
 
 所有子命令都要求代理正在运行；CLI 会自动解析已记录的运行时端口。成功时退出码为 0。用法错误、
@@ -230,6 +234,7 @@ OAuth 账号显示为 `Account N`，plan/label 列按 plan → 脱敏邮箱 →
   "email": "m***@example.com",
   "plan": "plus",
   "masked": "sk-ab****wxyz",
+  "priority": 0,
   "active": true,
   "needsReauth": false,
   "quota": null
@@ -240,7 +245,8 @@ OAuth 账号显示为 `Account N`，plan/label 列按 plan → 脱敏邮箱 →
 
 不指定 provider 时，会列出 Codex pool、OAuth 账号和已配置的 API-key pool。除非传入 `--all`，
 否则跳过空 provider；指定 provider 时只读取对应凭据 family。普通输出的列为
-`PROVIDER TYPE ID PLAN/LABEL STATUS`，手动选择的 Codex 行标记为 `selected`。当存在已保存的
+`PROVIDER TYPE ID PLAN/LABEL PRIORITY STATUS`，手动选择的 Codex 行标记为 `selected`。`PRIORITY` 是
+带符号的 Codex 选择顺序（未设置时为 `0`），对 OAuth 账号、API key 等不适用排序的行显示 `-`。当存在已保存的
 Kiro 账号时，输出会说明它只有一个登录 slot，再次登录会替换当前账号。结果为空仍算成功。`--json` 返回：
 
 ```text
@@ -259,8 +265,8 @@ Kiro 账号时，输出会说明它只有一个登录 slot，再次登录会替
 #### `ocx account use <provider> <account-or-key-id|main> [--json]`
 
 选择已有的 Codex 账号、OAuth 账号或 API key。对 `openai` 而言，`main` 选择 Codex App 登录。
-Codex 选择只对**新 session**生效；已有 thread 保持其账号。启用的 auto-switch threshold 之后可能
-覆盖手动 pin。未知 provider 或 id 返回退出码 1。`--json` 返回：
+Codex 选择会**立即生效**：正在运行的 thread 会在下一次请求时切换，只有已经在传输中的请求会继续使用
+它们捕获的账号。启用的 auto-switch threshold 之后可能覆盖手动 pin。未知 provider 或 id 返回退出码 1。`--json` 返回：
 
 ```text
 { ok: true, provider, type, activeId }
@@ -288,6 +294,25 @@ management API 失败返回退出码 1；upstream quota probe 失败或超时则
 { provider, autoSwitchThreshold: number, enabled: boolean }
 ```
 
+#### `ocx account priority <provider> <account-id|main> [<-100..100|first|earlier|normal|later|last|reset>] [--json]`
+
+读取或设置某个 Codex pool 账号的选择顺序：**数值越大越先使用**，默认值为 `0`，范围是 `-100` 到
+`100`。只有 `openai` 的 Codex pool 有选择顺序，其他 provider 返回退出码 1。`main` 指向 Codex Desktop
+登录账号，它与其他 pool 账号一样参与排序：`ocx account priority openai main last` 就能把它留作备用。
+
+预设词只是小整数的别名：`first` 为 `+2`，`earlier` 为 `+1`，`normal` 为 `0`，`later` 为 `-1`，
+`last` 为 `-2`。`reset` 恢复默认值并删除已保存的条目。**省略取值即为读取**，不会改写当前顺序。
+
+顺序决定的是先考虑哪些账号，而不是哪些账号可用：选择仍然只在合格账号中进行，取仍有 quota 余量的
+最高 tier，再由 `accountPoolStrategy` 在该 tier 内挑选。暂停、cooldown 和重新认证都不受影响。改动
+从**下一个未绑定请求**起生效，而不仅限于新开的 session：一旦更高顺序重新有了余量，preemption 会立即把
+未绑定请求提上去。已绑定账号的 thread 通常会保留该账号直到其用尽，但重新认证失败、quota cooldown 或连续的临时失败都会更早解除绑定。任何被接受的写入也会解除手动的“立即使用此账号”固定，无论固定在哪个账号上；写入与当前相同的顺序同样会解除，这是在保留当前所选账号的前提下解除固定的唯一方式（通过管理 API 清空活动账号同样会解除固定，但所选账号也一并丢失）。代理不可达、账号 id 不存在或取值不在
+允许范围内都会返回退出码 1。`--json` 返回：
+
+```text
+{ ok: true, provider, id, priority: number, preset: string | null }
+```
+
 #### `ocx account remove <provider> <id|main> --yes [--json]`
 
 这是受保护的非交互删除，因此必须提供 `--yes`。删除前会验证 id 是否存在；id 不存在时不会发送
diff --git a/docs-site/src/content/docs/zh-cn/reference/configuration.md b/docs-site/src/content/docs/zh-cn/reference/configuration.md
index 44c1b06f3..9cc28ccea 100644
--- a/docs-site/src/content/docs/zh-cn/reference/configuration.md
+++ b/docs-site/src/content/docs/zh-cn/reference/configuration.md
@@ -51,8 +51,9 @@ no-replace 方式创建 `config.json.pre-openai-tiers-v2.bak`，并把已知旧
 | `syncResumeHistory?` | `boolean` | `true` | 可逆的 Codex App 历史兼容模式。opencodex 会备份原始 Codex thread metadata，把旧 OpenAI interactive row 重映射到 `opencodex`，并暂时把 opencodex 创建的 `exec` row 提升成 App 可见 source。`ocx stop` / `ocx restore` 会恢复已备份的 OpenAI row，并把剩余 opencodex user thread 转回 OpenAI，使原生 Codex 在从 `config.toml` 移除代理后仍能继续这些 thread。设为 `false` 可退出该模式。 |
 | `codexAccounts?` | `CodexAccount[]` | `[]` | Codex Auth 仪表盘管理的 ChatGPT/Codex pool account metadata。secret 单独存放在 `codex-accounts.json`。 |
 | `pausedCodexAccountIds?` | `string[]` | `[]` | 在 Codex Auth 中恢复前，不参与任何后续 Pool 选择的账号 ID。暂停主账号时也包含 `__main__`。 |
+| `codexAccountPriorities?` | `Record<string,number>` | — | Codex pool 各账号的选择顺序：账号 ID → `-100` 到 `100` 的整数，**数值越大越先使用**，未设置即为 `0`。这是顺序边界而非资格边界：选择会把已经合格的账号收窄到仍有 quota 余量的最高 tier，再由 `accountPoolStrategy` 在该 tier 内挑选。只有当某个 tier 的所有成员都超过 `autoSwitchThreshold`、处于 cooldown、被 soft-avoid、已暂停或需要重新认证时，该 tier 才会被跳过；usage 未知不会让 tier 耗尽。顺序不会让不合格的账号变得可选，也不会重新绑定已经绑定账号的 thread。主账号 `__main__` 同样参与排序，因此可以让 Codex Desktop 登录账号最后才被用到。没有任何条目时，行为与以往完全一致。映射格式非法时会打印警告并关闭排序（不会触发 config 修复）。可通过 `ocx account priority` 和 Codex Auth 页面管理。 |
 | `codexAccountNamespaces?` | `Record<string,string>` | — | 可选的公开 model selector namespace 到已保存 Codex account target 的映射。此 foundation layer 只验证并持久化该映射，不会添加 picker row 或改变 routing。 |
-| `activeCodexAccountId?` | `string` | — | 手动选择的 pool account。选择时清除已有 thread affinity，并从下一次请求开始生效；进行中的请求保留原账号。 |
+| `activeCodexAccountId?` | `string` | — | 手动选择的 pool account。选择时清除已有 thread affinity，并从下一次请求开始生效；进行中的请求保留原账号。手动选择还会 pin 该账号所在 tier 的上限（记录在 `activeCodexAccountPinned`）：在因耗尽、排除、删除或显式 failover/promotion 到其他账号而解除 pin 之前，更高的 `codexAccountPriorities` tier 不能抢占它。同一 tier 内的普通 round-robin 移动不会解除 pin。写入任何 `codexAccountPriorities` 条目也会解除 pin，因此在设置顺序之前打的 pin 不会压过之后设置的顺序。`GET /api/codex-auth/active` 用 `pinned` 报告当前有效账号是否被 pin，并用 `pinnedAccountId` 报告持有 tier 上限的账号。 |
 | `autoSwitchThreshold?` | `number` | `80` | 新 session 自动切换的 usage 百分比 threshold。分数取已知 5 小时、周或 30 天 quota window 中最高的一项。设为 `0` 可禁用 quota 自动切换。`quota` 策略和 `fill-first` 的耗尽 threshold 都会用到。 |
 | `accountPoolStrategy?` | `"quota" \| "round-robin" \| "fill-first"` | `"quota"` | Codex pool 的新 session 轮换策略。仅适用于**新 session**；已有 thread id 保留 affinity。`quota`（默认）：活跃账号超过 `autoSwitchThreshold` 时选已知 usage 最低者。`round-robin`：在合格账号间平滑加权均分。`fill-first`：持续使用活跃账号，直到 cooldown、不可用或（如已设置）超过 `autoSwitchThreshold`（未知 usage 不会强制切换），再按稳定排序进入下一个合格账号。 |
 | `accountPoolStickyLimit?` | `number` | `1` | 一次 round-robin 选择在推进前保留的成功新 session 绑定数。范围 1–100；仅当 `accountPoolStrategy` 为 `round-robin` 时生效。 |
@@ -91,7 +92,8 @@ metadata；access/refresh token 存放在加固的 Codex account credential stor
 **轮换策略**（仅新 session；已绑定 thread 不变）：`quota`（默认）— 活跃账号 usage 超过
 `autoSwitchThreshold` 时选最低者；`round-robin` — 均分，`accountPoolStickyLimit`（默认 `1`，
 1–100）控制一次选择保留多少成功绑定；`fill-first` — 耗尽活跃账号（cooldown、需重新认证或
-threshold；未知 usage 不强制切换）后按稳定排序进入下一个。轮换不能规避 provider enforcement —
+threshold；未知 usage 不强制切换）后按稳定排序进入下一个。所有策略都只在仍有 quota 余量的最高
+`codexAccountPriorities` tier **之内**运行：顺序决定 tier，策略决定该 tier 里的账号。轮换不能规避 provider enforcement —
 多账号使用可能违反服务条款。
 :::
 
diff --git a/gui/src/account-priority.ts b/gui/src/account-priority.ts
new file mode 100644
index 000000000..2323529cb
--- /dev/null
+++ b/gui/src/account-priority.ts
@@ -0,0 +1,68 @@
+import type { TFn } from "./i18n/shared";
+
+/**
+ * Account selection order. Higher numbers are picked earlier; 0 is the unset default.
+ *
+ * User-visible copy never says "priority": the presets read as a sequence (First,
+ * Earlier, Normal, Later, Last) so the control describes WHEN an account is used
+ * rather than how important it is. Only identifiers use the internal name.
+ */
+
+export const ACCOUNT_PRIORITY_PRESETS: readonly number[] = [2, 1, 0, -1, -2] as const;
+
+export const DEFAULT_ACCOUNT_PRIORITY = 0;
+export const MIN_ACCOUNT_PRIORITY = -100;
+export const MAX_ACCOUNT_PRIORITY = 100;
+
+/** i18n keys for the preset names. Kept here so the select stays copy-free. */
+export type AccountPriorityPresetKey =
+  | "accountPool.priorityFirst"
+  | "accountPool.priorityEarlier"
+  | "accountPool.priorityNormal"
+  | "accountPool.priorityLater"
+  | "accountPool.priorityLast";
+
+const PRESET_LABEL_KEYS = new Map<number, AccountPriorityPresetKey>([
+  [2, "accountPool.priorityFirst"],
+  [1, "accountPool.priorityEarlier"],
+  [0, "accountPool.priorityNormal"],
+  [-1, "accountPool.priorityLater"],
+  [-2, "accountPool.priorityLast"],
+]);
+
+export function normalizeAccountPriority(value: unknown): number {
+  return typeof value === "number"
+    && Number.isInteger(value)
+    && value >= MIN_ACCOUNT_PRIORITY
+    && value <= MAX_ACCOUNT_PRIORITY
+    ? value
+    : DEFAULT_ACCOUNT_PRIORITY;
+}
+
+/**
+ * Signed rendering with an ASCII hyphen: "+2", "0", "-1". The number is always part of
+ * the label, so an operator can map the words back to what the API and CLI report.
+ */
+export function formatAccountPriority(value: unknown): string {
+  const normalized = normalizeAccountPriority(value);
+  return normalized > 0 ? `+${normalized}` : String(normalized);
+}
+
+export function isAccountPriorityPreset(value: number): boolean {
+  return PRESET_LABEL_KEYS.has(value);
+}
+
+/** Label key for a preset, or null for a value only the API or CLI can produce. */
+export function accountPriorityPresetKey(value: number): AccountPriorityPresetKey | null {
+  return PRESET_LABEL_KEYS.get(value) ?? null;
+}
+
+/** "First (+2)" for presets, "Custom (+7)" for anything else. */
+export function accountPriorityLabel(t: TFn, value: number): string {
+  const normalized = normalizeAccountPriority(value);
+  const presetKey = accountPriorityPresetKey(normalized);
+  return t("accountPool.priorityOption", {
+    name: t(presetKey ?? "accountPool.priorityCustom"),
+    value: formatAccountPriority(normalized),
+  });
+}
diff --git a/gui/src/components/AccountPoolStrategyControls.tsx b/gui/src/components/AccountPoolStrategyControls.tsx
index 8db64a0df..221d57f40 100644
--- a/gui/src/components/AccountPoolStrategyControls.tsx
+++ b/gui/src/components/AccountPoolStrategyControls.tsx
@@ -1,4 +1,5 @@
 import { useT } from "../i18n/shared";
+import { Select } from "../ui";
 import {
   ACCOUNT_POOL_STRATEGIES,
   type AccountPoolStrategy,
@@ -44,27 +45,30 @@ export default function AccountPoolStrategyControls({
   const t = useT();
   return (
     <div style={{ marginTop: 12 }}>
-      <label className="field" style={{ display: "block" }} htmlFor={strategySelectId}>
-        <span className={strategyLabelHidden ? "sr-only" : "field-label"}>
+      {/* The label sits beside the control rather than wrapping it: the trigger is a button,
+          and a button nested inside its own label can take the click twice. `htmlFor` still
+          associates the two — a button is labelable — so clicking the text focuses it. */}
+      <div className="field" style={{ display: "block" }}>
+        <label
+          className={strategyLabelHidden ? "sr-only" : "field-label"}
+          htmlFor={strategySelectId}
+        >
           {t("accountPool.strategy")}
-        </span>
-        <select
+        </label>
+        <Select
           id={strategySelectId}
-          className="input"
           value={strategy}
+          options={ACCOUNT_POOL_STRATEGIES.map((value) => ({
+            value,
+            label: t(STRATEGY_LABEL_KEYS[value]),
+          }))}
           disabled={disabled}
-          aria-label={t("accountPool.strategy")}
-          onChange={(event) => {
-            onStrategyChange(event.target.value as AccountPoolStrategy);
+          label={t("accountPool.strategy")}
+          onChange={(value) => {
+            onStrategyChange(value as AccountPoolStrategy);
           }}
-        >
-          {ACCOUNT_POOL_STRATEGIES.map((value) => (
-            <option key={value} value={value}>
-              {t(STRATEGY_LABEL_KEYS[value])}
-            </option>
-          ))}
-        </select>
-      </label>
+        />
+      </div>
       <div className="card-sub" style={{ marginTop: 4 }}>
         {t("accountPool.strategyHint")}
       </div>
diff --git a/gui/src/components/AccountPriorityControl.tsx b/gui/src/components/AccountPriorityControl.tsx
new file mode 100644
index 000000000..7db2d2060
--- /dev/null
+++ b/gui/src/components/AccountPriorityControl.tsx
@@ -0,0 +1,71 @@
+import { useT } from "../i18n/shared";
+import { Select } from "../ui";
+import {
+  ACCOUNT_PRIORITY_PRESETS,
+  accountPriorityLabel,
+  DEFAULT_ACCOUNT_PRIORITY,
+  isAccountPriorityPreset,
+  normalizeAccountPriority,
+} from "../account-priority";
+
+export interface AccountPriorityControlProps {
+  value: number;
+  disabled?: boolean;
+  /** Unique per card: several controls share one page. */
+  selectId: string;
+  onChange(priority: number): void;
+}
+
+/**
+ * Compact inline selection-order control for one account card.
+ *
+ * The presets cover every value the dashboard can create; a stored value from the API or
+ * CLI that is not a preset is prepended as a selectable peer so switching away from it is
+ * possible without losing what it currently is. The hint is a description rather than a
+ * line of its own: it would otherwise repeat on every card in the pool.
+ */
+export default function AccountPriorityControl({
+  value,
+  disabled = false,
+  selectId,
+  onChange,
+}: AccountPriorityControlProps) {
+  const t = useT();
+  const current = normalizeAccountPriority(value);
+  const hint = t("accountPool.priorityHint");
+  // eslint-disable-next-line local-i18n/no-hardcoded-ui-strings -- element id suffix, not UI text
+  const hintId = `${selectId}-hint`;
+  const presets = ACCOUNT_PRIORITY_PRESETS.map(preset => ({
+    value: String(preset),
+    label: accountPriorityLabel(t, preset),
+  }));
+  const options = isAccountPriorityPreset(current)
+    ? presets
+    : [{ value: String(current), label: accountPriorityLabel(t, current) }, ...presets];
+  return (
+    <div className="codex-account-priority">
+      <label className="codex-account-priority-label" htmlFor={selectId}>
+        {t("accountPool.priority")}
+      </label>
+      <Select
+        id={selectId}
+        value={String(current)}
+        options={options}
+        disabled={disabled}
+        label={t("accountPool.priorityAria")}
+        describedBy={hintId}
+        title={hint}
+        onChange={(next) => onChange(normalizeAccountPriority(Number.parseInt(next, 10)))}
+      />
+      <span id={hintId} className="sr-only">{hint}</span>
+    </div>
+  );
+}
+
+/** Muted card badge naming a non-default selection order. */
+export function AccountPriorityBadge({ value }: { value: number }) {
+  const t = useT();
+  const current = normalizeAccountPriority(value);
+  if (current === DEFAULT_ACCOUNT_PRIORITY) return null;
+  return <span className="badge badge-muted">{accountPriorityLabel(t, current)}</span>;
+}
diff --git a/gui/src/components/CodexAccountPool.tsx b/gui/src/components/CodexAccountPool.tsx
index c5a212e21..041f0f8fd 100644
--- a/gui/src/components/CodexAccountPool.tsx
+++ b/gui/src/components/CodexAccountPool.tsx
@@ -55,7 +55,7 @@ export default function CodexAccountPool({ apiBase, accountModeState = null, ban
   // but stays inert (no load, no polling) whenever a shared controller was injected.
   const ownController = useCodexAccountPool(apiBase, !injectedController);
   const controller = injectedController ?? ownController;
-  const { accounts, activeId, loadState, switchingId, pauseUpdatingId, pausingExhausted, load } = controller;
+  const { accounts, activeId, loadState, switchingId, pauseUpdatingId, priorityUpdatingId, pausingExhausted, activePinnedId, load } = controller;
   const [confirm, setConfirm] = useState<CodexAccountEntry | null>(null);
   const [showAdd, setShowAdd] = useState(false);
   const [reauthId, setReauthId] = useState<string | null>(null);
@@ -170,6 +170,24 @@ export default function CodexAccountPool({ apiBase, accountModeState = null, ban
     setTimeout(() => setToast(""), 5000);
   };
 
+  const changePriority = async (account: CodexAccountEntry, priority: number) => {
+    // Same guard as the pool strategy control (CodexPoolStrategySetting.tsx), and here it is
+    // load-bearing rather than just thrift: `Select` calls onChange for the clicked option
+    // even when it was already selected, and commits the highlighted one on Tab-out. The
+    // route releases the pin on every accepted write — deliberately, since an explicit write
+    // is a newer statement of intent — so without this a mis-click would unpin the account
+    // the operator chose and still report success. Suppressing the no-op belongs here, at
+    // the widget, not at the route, where a same-value write really is a statement.
+    if (priority === account.priority) return;
+    const result = await controller.setAccountPriority(account.id, priority);
+    if (!result.ok && result.reason === "busy") return;
+    setToastError(!result.ok);
+    setToast(t(result.ok ? "accountPool.priorityUpdated" : "accountPool.priorityUpdateFailed", {
+      email: account.alias ?? account.email,
+    }));
+    setTimeout(() => setToast(""), 5000);
+  };
+
   const remove = async (id: string) => {
     const label = accounts.find(account => account.id === id)?.email ?? t("pws.accountOrdinal", { count: "1" });
     if (!window.confirm(t("codexAuth.removeConfirm", { id: label }))) return;
@@ -279,6 +297,10 @@ export default function CodexAccountPool({ apiBase, accountModeState = null, ban
         onTogglePause={togglePaused}
         pauseUpdatingId={pauseUpdatingId}
         pauseBusy={pauseUpdatingId !== null || pausingExhausted}
+        onPriorityChange={(entry, priority) => { void changePriority(entry, priority); }}
+        priorityUpdatingId={priorityUpdatingId}
+        switchingId={switchingId}
+        pinnedId={activePinnedId}
         onOpenReset={openResetPopup}
         onCopyDoctor={copyDoctor}
         doctorCopyOutcomeFor={doctorCopy.outcomeFor}
@@ -309,6 +331,10 @@ export default function CodexAccountPool({ apiBase, accountModeState = null, ban
         onTogglePause={togglePaused}
         pauseUpdatingId={pauseUpdatingId}
         pauseBusy={pauseUpdatingId !== null || pausingExhausted}
+        onPriorityChange={(entry, priority) => { void changePriority(entry, priority); }}
+        priorityUpdatingId={priorityUpdatingId}
+        switchingId={switchingId}
+        pinnedId={activePinnedId}
         onReauth={openReauth}
         onEditAlias={editAlias}
         onRemove={remove}
@@ -341,6 +367,7 @@ export default function CodexAccountPool({ apiBase, accountModeState = null, ban
           mainEmail={main?.email}
           accountModeState={accountModeState}
           switchingId={switchingId}
+          orderBusy={priorityUpdatingId !== null}
           onCancel={() => setConfirm(null)}
           onConfirm={() => { void setActive(confirm.id === "__main__" ? "__main__" : confirm.id); }}
         />
diff --git a/gui/src/components/CodexPoolStrategySetting.tsx b/gui/src/components/CodexPoolStrategySetting.tsx
index 86a00b81f..10d763d03 100644
--- a/gui/src/components/CodexPoolStrategySetting.tsx
+++ b/gui/src/components/CodexPoolStrategySetting.tsx
@@ -101,7 +101,7 @@ export default function CodexPoolStrategySetting({ apiBase }: { apiBase: string
   const loading = !ready && !loadError;
 
   return (
-    <div className="card" style={{ marginTop: 16 }} aria-busy={loading || saving}>
+    <div className="card codex-pool-strategy-card" style={{ marginTop: 16 }} aria-busy={loading || saving}>
       <strong>{t("accountPool.strategy")}</strong>
       <div className="card-sub" style={{ marginTop: 4 }} role={loadError ? "alert" : undefined}>
         {loadError
diff --git a/gui/src/components/codex-account-pool-cards.tsx b/gui/src/components/codex-account-pool-cards.tsx
index 605f3a458..602f5e84f 100644
--- a/gui/src/components/codex-account-pool-cards.tsx
+++ b/gui/src/components/codex-account-pool-cards.tsx
@@ -1,6 +1,7 @@
 import { useT } from "../i18n/shared";
 import { IconAlert, IconPause, IconPlay, IconX } from "../icons";
 import { displayAccountId } from "../lib/privacy";
+import AccountPriorityControl, { AccountPriorityBadge } from "./AccountPriorityControl";
 import type { CodexAccountEntry } from "./codex-account-pool-types";
 import type { CodexAccountModeState } from "../codex-multi-state";
 import QuotaBars from "./QuotaBars";
@@ -26,6 +27,10 @@ export function CodexAccountPoolCards({
   onTogglePause,
   pauseUpdatingId,
   pauseBusy,
+  onPriorityChange,
+  priorityUpdatingId,
+  switchingId,
+  pinnedId = null,
   onReauth,
   onEditAlias,
   onRemove,
@@ -42,6 +47,17 @@ export function CodexAccountPoolCards({
   onTogglePause: (account: CodexAccountEntry) => void;
   pauseUpdatingId: string | null;
   pauseBusy: boolean;
+  onPriorityChange: (account: CodexAccountEntry, priority: number) => void;
+  priorityUpdatingId: string | null;
+  /** In-flight manual switch, which writes the same pin an order write clears. */
+  switchingId: string | null;
+  /**
+   * The account an operator pinned by hand, which is not always the selected one: under
+   * round-robin and fill-first the pin caps selection at its own tier while the cursor
+   * moves inside that tier. Marking the pinned card rather than the selected one keeps the
+   * badge on the account the operator actually chose.
+   */
+  pinnedId?: string | null;
   onReauth: (id: string) => void;
   onEditAlias: (account: CodexAccountEntry) => void;
   onRemove: (id: string) => void;
@@ -67,6 +83,8 @@ export function CodexAccountPoolCards({
             <span className="card-badges">
               {a.plan && <span className="badge badge-green">{a.plan}</span>}
               {a.paused && <span className="badge badge-muted">{t("codexAuth.paused")}</span>}
+              <AccountPriorityBadge value={a.priority} />
+              {a.id === pinnedId && !a.paused && <span className="badge badge-muted">{t("codexAuth.pinned")}</span>}
               <CodexTicketBadge t={t} account={a} onClick={() => onOpenReset(a)} />
               {healthLabel && (
                 <span className={oauthHealthBadgeClass(healthStatus)}>{healthLabel}</span>
@@ -123,6 +141,18 @@ export function CodexAccountPoolCards({
           {inCooldown && (
             <div className="card-sub faint">{t("pws.healthCooldownHint")}</div>
           )}
+          {a.id === pinnedId && !a.paused && <div className="card-sub faint">{t("codexAuth.pinnedHint")}</div>}
+          <AccountPriorityControl
+            value={a.priority}
+            selectId={`codex-account-priority-${a.id}`}
+            // Every row, not just the one being written: the controller serializes order
+            // writes behind one mutation ref, so a second row's pick would come back "busy"
+            // and be dropped with no toast. Same global lock the pause button uses.
+            // A pending switch counts too — it writes the same pin this clears, so the
+            // controller refuses to overlap them, and that refusal is equally silent.
+            disabled={priorityUpdatingId !== null || switchingId !== null}
+            onChange={(priority) => onPriorityChange(a, priority)}
+          />
           {showReauth
             ? <div className="card-sub faint">{t("codexAuth.tokenExpired")}</div>
             : !inCooldown && <QuotaBars quota={a.quota} plan={a.plan} threshold={threshold} t={t} />}
diff --git a/gui/src/components/codex-account-pool-main-card.tsx b/gui/src/components/codex-account-pool-main-card.tsx
index 97fd176e5..a021c355f 100644
--- a/gui/src/components/codex-account-pool-main-card.tsx
+++ b/gui/src/components/codex-account-pool-main-card.tsx
@@ -1,5 +1,6 @@
 import type { ReactNode } from "react";
 import { IconLock, IconPause, IconPlay, IconRefresh } from "../icons";
+import AccountPriorityControl, { AccountPriorityBadge } from "./AccountPriorityControl";
 import QuotaBars from "./QuotaBars";
 import { CodexTicketBadge } from "./codex-account-pool-helpers";
 import type { CodexAccountEntry } from "./codex-account-pool-types";
@@ -26,6 +27,10 @@ export function CodexAccountPoolMainCard({
   onTogglePause,
   pauseUpdatingId,
   pauseBusy,
+  onPriorityChange,
+  priorityUpdatingId,
+  switchingId,
+  pinnedId = null,
   onOpenReset,
   onCopyDoctor,
   doctorCopyOutcomeFor,
@@ -40,6 +45,16 @@ export function CodexAccountPoolMainCard({
   onTogglePause: (entry: CodexAccountEntry) => void;
   pauseUpdatingId: string | null;
   pauseBusy: boolean;
+  onPriorityChange: (entry: CodexAccountEntry, priority: number) => void;
+  priorityUpdatingId: string | null;
+  /** In-flight manual switch, which writes the same pin an order write clears. */
+  switchingId: string | null;
+  /**
+   * The account carrying the pin, which is not always the one routing is on: the pin caps
+   * selection at its own tier, and under round-robin or fill-first the cursor still moves
+   * within that tier. Badge the account the operator chose, not wherever routing landed.
+   */
+  pinnedId?: string | null;
   onOpenReset: (account: CodexAccountEntry) => void;
   onCopyDoctor?: (accountId: string) => void;
   doctorCopyOutcomeFor?: (accountId: string) => "copied" | "unavailable" | null;
@@ -52,6 +67,7 @@ export function CodexAccountPoolMainCard({
     plan: main?.plan,
     isMain: true,
     paused: main?.paused ?? false,
+    priority: main?.priority ?? 0,
     hasCredential: true,
     quota: main?.quota ?? null,
   };
@@ -70,6 +86,8 @@ export function CodexAccountPoolMainCard({
         <span className="card-badges">
           {main && <CodexTicketBadge t={t} account={{ ...main, id: "__main__" } as CodexAccountEntry} onClick={() => onOpenReset({ ...main, id: "__main__" } as CodexAccountEntry)} />}
           {main?.paused && <span className="badge badge-muted">{t("codexAuth.paused")}</span>}
+          <AccountPriorityBadge value={mainSwitchEntry.priority} />
+          {pinnedId === "__main__" && !main?.paused && <span className="badge badge-muted">{t("codexAuth.pinned")}</span>}
           {healthLabel && (
             <span className={oauthHealthBadgeClass(main?.health?.status)}>{healthLabel}</span>
           )}
@@ -113,6 +131,23 @@ export function CodexAccountPoolMainCard({
       {inCooldown && (
         <div className="card-sub faint">{t("pws.healthCooldownHint")}</div>
       )}
+      {pinnedId === "__main__" && !main?.paused && <div className="card-sub faint">{t("codexAuth.pinnedHint")}</div>}
+      {/* Same rule as the pause button: without an app login there is no row to re-order. */}
+      {main && (
+        <AccountPriorityControl
+          value={mainSwitchEntry.priority}
+          // Derived from the synthesized id rather than hardcoded as "-main": a pool account
+          // may legitimately be named `main` (the id pattern allows it), and that account's
+          // control would then claim the same DOM id, pointing this label at its dropdown.
+          selectId={`codex-account-priority-${mainSwitchEntry.id}`}
+          // Any in-flight order write, not just this card's: order writes share one mutation
+          // ref, so a pick made during another card's write returns "busy" and is dropped
+          // silently. Mirrors pauseBusy. A pending switch counts too — it writes the same
+          // pin this clears, so the controller refuses to overlap them, just as silently.
+          disabled={priorityUpdatingId !== null || switchingId !== null}
+          onChange={(priority) => onPriorityChange(mainSwitchEntry, priority)}
+        />
+      )}
       {showReauth
         ? <div className="card-sub faint">{t("codexAuth.mainTokenExpired")}</div>
         : !inCooldown && main?.quota && <QuotaBars quota={main.quota} plan={main.plan} threshold={threshold} t={t} />}
diff --git a/gui/src/components/codex-account-switch-modal.tsx b/gui/src/components/codex-account-switch-modal.tsx
index 629b79c94..3c87f0500 100644
--- a/gui/src/components/codex-account-switch-modal.tsx
+++ b/gui/src/components/codex-account-switch-modal.tsx
@@ -9,6 +9,7 @@ export function CodexAccountSwitchModal({
   mainEmail,
   accountModeState,
   switchingId,
+  orderBusy = false,
   onCancel,
   onConfirm,
 }: {
@@ -16,6 +17,12 @@ export function CodexAccountSwitchModal({
   mainEmail?: string;
   accountModeState: CodexAccountModeState | null;
   switchingId: string | null;
+  /**
+   * An in-flight selection-order write. It clears the pin this switch would set, so the
+   * controller refuses to run the two together and drops the loser without a toast --
+   * the button has to be unavailable rather than silently ineffective.
+   */
+  orderBusy?: boolean;
   onCancel: () => void;
   onConfirm: () => void;
 }) {
@@ -59,7 +66,7 @@ export function CodexAccountSwitchModal({
         )}
         <div className="modal-actions">
           <button type="button" className="btn btn-ghost" onClick={onCancel}>{t("codexAuth.cancel")}</button>
-          <button type="button" className="btn btn-primary" disabled={Boolean(switchingId)} onClick={onConfirm}>
+          <button type="button" className="btn btn-primary" disabled={Boolean(switchingId) || orderBusy} onClick={onConfirm}>
             {switchingId ? t("pws.accountSwitching") : t(accountModeState === "direct" ? "codexAuth.prepareForPool" : "codexAuth.setAsNext")}
           </button>
         </div>
diff --git a/gui/src/hooks/useCodexAccountPool.ts b/gui/src/hooks/useCodexAccountPool.ts
index 3c1d08fd6..baaadf159 100644
--- a/gui/src/hooks/useCodexAccountPool.ts
+++ b/gui/src/hooks/useCodexAccountPool.ts
@@ -1,4 +1,5 @@
 import { useCallback, useEffect, useRef, useState } from "react";
+import { normalizeAccountPriority } from "../account-priority";
 import type { AccountQuota } from "../codex-quota-utils";
 import { accountNeedsReauth } from "../oauth-health-display";
 
@@ -23,6 +24,8 @@ export interface CodexAccountEntry {
   isMain: boolean;
   /** Persisted routing exclusion. Paused accounts remain visible but cannot be selected. */
   paused: boolean;
+  /** Selection order; higher is used earlier. Always present, 0 when unset. */
+  priority: number;
   hasCredential: boolean;
   quota: AccountQuota | null;
   needsReauth?: boolean;
@@ -59,12 +62,25 @@ export interface CodexAccountPoolController {
   loadState: CodexAccountLoadState;
   switchingId: string | null;
   pauseUpdatingId: string | null;
+  priorityUpdatingId: string | null;
   pausingExhausted: boolean;
   activeNeedsReauth: boolean;
+  /**
+   * The account carrying the pin, which is not always the active one: under round-robin
+   * and fill-first the pin caps selection at its own tier while the cursor moves inside
+   * that tier. Drives the badge so it stays on the account the operator chose.
+   *
+   * The id rather than /active's `pinned` boolean: that field answers whether routing is
+   * currently ON the pinned account, which goes false on a sibling's turn while the pin is
+   * still suppressing every higher tier — no surface here wants that question.
+   */
+  activePinnedId: string | null;
 
   load(refreshQuota?: boolean): Promise<boolean>;
   switchAccount(id: string | null): Promise<CodexAccountActionResult<{ activeId: string | null }>>;
   setAccountPaused(id: string, paused: boolean): Promise<CodexAccountActionResult>;
+  /** `null` resets the account to the default order. Accepts the `__main__` sentinel. */
+  setAccountPriority(id: string, priority: number | null): Promise<CodexAccountActionResult>;
   pauseExhaustedAccounts(): Promise<CodexAccountActionResult<{ pausedCount: number }>>;
   saveAlias(id: string, alias: string): Promise<CodexAccountActionResult>;
   removeAccount(id: string): Promise<CodexAccountActionResult>;
@@ -85,7 +101,9 @@ export function useCodexAccountPool(apiBase: string, enabled = true): CodexAccou
   const [loadState, setLoadState] = useState<CodexAccountLoadState>("loading");
   const [switchingId, setSwitchingId] = useState<string | null>(null);
   const [pauseUpdatingId, setPauseUpdatingId] = useState<string | null>(null);
+  const [priorityUpdatingId, setPriorityUpdatingId] = useState<string | null>(null);
   const [pausingExhausted, setPausingExhausted] = useState(false);
+  const [activePinnedId, setActivePinnedId] = useState<string | null>(null);
   // Pause leases live in a ref: pausing must not re-render, and the effect below reads
   // the live set rather than a captured snapshot.
   const [pauseCount, setPauseCount] = useState(0);
@@ -100,6 +118,9 @@ export function useCodexAccountPool(apiBase: string, enabled = true): CodexAccou
   const lastThresholdRef = useRef<{ value: unknown } | null>(null);
   const switchingRef = useRef<string | null>(null);
   const pauseMutationRef = useRef<"bulk" | { accountId: string } | null>(null);
+  // Its own gate, deliberately not the pause one: re-ordering one account and pausing
+  // another are independent writes, and a shared ref would make either reject the other.
+  const priorityMutationRef = useRef<{ accountId: string } | null>(null);
 
   const subscribeLoadObserver = useCallback((observer: CodexAccountLoadObserver) => {
     observersRef.current.add(observer);
@@ -122,7 +143,15 @@ export function useCodexAccountPool(apiBase: string, enabled = true): CodexAccou
         const response = await fetch(`${apiBase}/api/codex-auth/accounts${refreshQuota ? "?refresh=1" : ""}`);
         if (!response.ok) throw new Error("account load failed");
         const payload = await response.json();
-        if (loadGenerationRef.current === generation) setAccounts(payload.accounts ?? []);
+        const list = (payload.accounts ?? []) as CodexAccountEntry[];
+        // Selection order is required downstream (badge, select). Normalizing here keeps
+        // a payload without it from rendering a NaN order on every card.
+        if (loadGenerationRef.current === generation) {
+          setAccounts(list.map(account => ({
+            ...account,
+            priority: normalizeAccountPriority(account.priority),
+          })));
+        }
         return true;
       } catch {
         return false;
@@ -143,6 +172,7 @@ export function useCodexAccountPool(apiBase: string, enabled = true): CodexAccou
             pendingActiveIdRef.current = null;
             setActiveId(serverActiveId);
           }
+          setActivePinnedId(typeof active.pinnedAccountId === "string" ? active.pinnedAccountId : null);
           lastThresholdRef.current = { value: active.autoSwitchThreshold };
           for (const observer of observers) {
             observer.acceptActiveRead(active.autoSwitchThreshold, revisions.get(observer)!);
@@ -198,7 +228,12 @@ export function useCodexAccountPool(apiBase: string, enabled = true): CodexAccou
   }, []);
 
   const switchAccount = useCallback(async (id: string | null) => {
-    if (switchingRef.current) return { ok: false, reason: "busy" } as const;
+    // Cross-gated with the order write, not just with itself: both PUTs move the pin,
+    // and in opposite directions, so letting them overlap lets the client settle on
+    // the inverse of the server's final pin until a reload happens to correct it.
+    // Response order is not request order, so neither optimistic write can tell
+    // whether it is the newer statement.
+    if (switchingRef.current || priorityMutationRef.current) return { ok: false, reason: "busy" } as const;
     switchingRef.current = id ?? "__main__";
     setSwitchingId(id ?? "__main__");
     try {
@@ -212,6 +247,10 @@ export function useCodexAccountPool(apiBase: string, enabled = true): CodexAccou
       const selectedId = result.activeCodexAccountId ?? id;
       pendingActiveIdRef.current = { id: selectedId ?? null };
       setActiveId(selectedId ?? null);
+      // The active PUT is also the pin write. Reflect the accepted lifecycle edge
+      // immediately so a failed reconciliation cannot leave the badge on the old
+      // account (or absent from the newly selected one).
+      setActivePinnedId(id);
       // Reconcile in the background: the switch is already accepted upstream, so a slow
       // reload must not hold the caller's confirmation dialog open.
       void load();
@@ -262,6 +301,15 @@ export function useCodexAccountPool(apiBase: string, enabled = true): CodexAccou
         pendingActiveIdRef.current = { id: nextActiveId };
         setActiveId(nextActiveId);
       }
+      // Deliberately NOT cross-gated against the switch and order writes, even though
+      // pausing the pinned account also releases the pin. This edge is conditional on
+      // the pin still naming `id`, which makes it order-robust: whichever response
+      // lands last, the client agrees with the server. An unconditional edge is what
+      // forced the gate between those two -- each states a pin outright, so the later
+      // response wins regardless of which write the server applied last. Sharing a
+      // mutation ref here would instead make a pause and an order change on two
+      // unrelated accounts reject each other for no reason.
+      if (paused) setActivePinnedId(current => current === id ? null : current);
       void load();
       return { ok: true } as const;
     } catch {
@@ -272,6 +320,56 @@ export function useCodexAccountPool(apiBase: string, enabled = true): CodexAccou
     }
   }, [apiBase, load]);
 
+  const setAccountPriority = useCallback(async (id: string, priority: number | null) => {
+    // The other half of the cross-gate in switchAccount: an order write clears the
+    // pin that a switch sets, so the two cannot be in flight together.
+    if (priorityMutationRef.current || switchingRef.current) return { ok: false, reason: "busy" } as const;
+    priorityMutationRef.current = { accountId: id };
+    setPriorityUpdatingId(id);
+    try {
+      const response = await fetch(`${apiBase}/api/codex-auth/accounts/priority`, {
+        method: "PUT",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ id, priority }),
+      });
+      // A rejected write leaves the row alone, so the card snaps back to the last
+      // confirmed order instead of showing a value the server never accepted.
+      if (!response.ok) return { ok: false, reason: "request" } as const;
+      const raw = await response.json().catch(() => ({}));
+      const result = (raw && typeof raw === "object" ? raw : {}) as { priority?: unknown };
+      const stored = normalizeAccountPriority(result.priority ?? priority);
+      setAccounts(current => current.map(account => (
+        account.id === id || (id === "__main__" && account.isMain)
+          ? { ...account, priority: stored }
+          : account
+      )));
+      // Every accepted order write releases the manual pin, even when the numeric
+      // value was unchanged. Do not depend on the follow-up read to hide the badge.
+      setActivePinnedId(null);
+      // Unlike pause, re-ordering never reconciles the active account, so the response's
+      // activeCodexAccountId is a read rather than a transition. Adopting it here would
+      // arm pendingActiveIdRef against a value this write did not cause.
+      //
+      // A pending marker left over from an earlier switch has to go, though. It exists to
+      // hold the accepted account until a matching `/active` read arrives, and any read
+      // that disagrees is treated as stale — which never clears the marker. That is fine
+      // while the switch is the newest statement, but this write is newer: it releases the
+      // pin the switch set, so the account the switch named is no longer the one routing
+      // has to agree with. Leaving the marker armed strands `activeId` on that account for
+      // every subsequent load, because nothing else ever retires it. The switch's own
+      // in-flight reload cannot then win the race either — `loadGenerationRef` discards a
+      // response from any generation but the latest, and this write starts a newer one.
+      pendingActiveIdRef.current = null;
+      void load();
+      return { ok: true } as const;
+    } catch {
+      return { ok: false, reason: "request" } as const;
+    } finally {
+      priorityMutationRef.current = null;
+      setPriorityUpdatingId(null);
+    }
+  }, [apiBase, load]);
+
   const pauseExhaustedAccounts = useCallback(async () => {
     if (pauseMutationRef.current) return { ok: false, reason: "busy" } as const;
     pauseMutationRef.current = "bulk";
@@ -296,6 +394,10 @@ export function useCodexAccountPool(apiBase: string, enabled = true): CodexAccou
         pendingActiveIdRef.current = { id: nextActiveId };
         setActiveId(nextActiveId);
       }
+      // Conditional for the same reason as the single-account pause above: clearing
+      // outright would race the switch and order writes, which is why those two are
+      // gated against each other and these two do not need to be.
+      setActivePinnedId(current => current !== null && pausedIds.has(current) ? null : current);
       void load();
       return { ok: true, pausedCount: result.pausedCount ?? pausedIds.size } as const;
     } catch {
@@ -339,11 +441,14 @@ export function useCodexAccountPool(apiBase: string, enabled = true): CodexAccou
     loadState,
     switchingId,
     pauseUpdatingId,
+    priorityUpdatingId,
     pausingExhausted,
     activeNeedsReauth,
+    activePinnedId,
     load,
     switchAccount,
     setAccountPaused,
+    setAccountPriority,
     pauseExhaustedAccounts,
     saveAlias,
     removeAccount,
diff --git a/gui/src/i18n/de.ts b/gui/src/i18n/de.ts
index 0bdf617d1..bb3a77935 100644
--- a/gui/src/i18n/de.ts
+++ b/gui/src/i18n/de.ts
@@ -661,6 +661,8 @@ export const de: Record<TKey, string> = {
   "codexAuth.pauseFailed": "{email} konnte nicht pausiert werden. Es wurde nichts geändert.",
   "codexAuth.resumeFailed": "{email} konnte nicht fortgesetzt werden. Es wurde nichts geändert.",
   "codexAuth.pausedHint": "Bis zur Fortsetzung von automatischem Wechsel, Wiederholungen, Cooldown-Wiederherstellung und manueller Auswahl ausgeschlossen.",
+  "codexAuth.pinned": "ANGEHEFTET",
+  "codexAuth.pinnedHint": "Du hast dieses Konto von Hand ausgewählt, daher geht eine höhere Auswahlreihenfolge nicht daran vorbei. Die Fixierung gilt, bis dieses Konto aufgebraucht ist, du ein anderes auswählst oder du eine Auswahlreihenfolge änderst.",
   "codexAuth.fiveHour": "5 Std.",
   "codexAuth.weekly": "Woche",
   "codexAuth.monthly": "30d",
@@ -674,12 +676,12 @@ export const de: Record<TKey, string> = {
   "codexAuth.prepareForPool": "Für Pool vorbereiten",
   "codexAuth.poolPreparedToast": "{email} ist für den Pool-Modus vorbereitet",
   "codexAuth.switchTitle": "Aktives Konto wechseln?",
-  "codexAuth.switchDesc": "Dies gilt für die nächste Anfrage bestehender und neuer Codex-Sitzungen. Laufende Anfragen behalten ihr Konto.",
+  "codexAuth.switchDesc": "Wird sofort wirksam. Bereits laufende Anfragen behalten ihr Konto; alles andere wechselt zu diesem Konto, wobei Konten mit derselben Auswahlreihenfolge sich weiterhin abwechseln.",
   "codexAuth.cacheWarning": "Prompt-Cache wird beim Kontowechsel zurückgesetzt. Neue Sitzung startet mit leerem Cache.",
-  "codexAuth.setAsNext": "Konto auswählen",
+  "codexAuth.setAsNext": "Dieses Konto als Nächstes verwenden",
   "codexAuth.cancel": "Abbrechen",
   "codexAuth.switchBack": "Zurück zum Hauptkonto?",
-  "codexAuth.switchBackDesc": "Die nächste Anfrage bestehender und neuer Codex-Sitzungen verwendet dein App-Login-Konto.",
+  "codexAuth.switchBackDesc": "Wird sofort wirksam. Bereits laufende Anfragen behalten ihr Konto; alles andere wechselt zu deinem App-Login-Konto, wobei Konten mit derselben Auswahlreihenfolge sich weiterhin abwechseln.",
   "codexAuth.autoSwitch": "Automatischer Kontowechsel",
   "codexAuth.autoSwitchDesc": "Wechselt ab {threshold} % Auslastung, wenn ein verfügbares Konto eine niedrigere Auslastung hat; Go/Free nutzen nur das 30-Tage-Fenster",
   "codexAuth.autoSwitchOffDesc": "Der automatische Kontowechsel ist ausgeschaltet",
@@ -715,6 +717,19 @@ export const de: Record<TKey, string> = {
   "accountPool.stickyLimitInvalid": "Gib eine ganze Zahl von 1 bis 100 ein",
   "accountPool.strategyLoadFailed": "Rotationsstrategie konnte nicht geladen werden.",
   "accountPool.strategyUpdateFailed": "Rotationsstrategie konnte nicht gespeichert werden.",
+
+  "accountPool.priority": "Auswahlreihenfolge",
+  "accountPool.priorityAria": "Auswahlreihenfolge für dieses Konto",
+  "accountPool.priorityHint": "Höhere Zahlen werden zuerst verwendet. Der Pool geht erst zu einer niedrigeren Zahl über, wenn alle Konten darüber aufgebraucht oder nicht verfügbar sind.",
+  "accountPool.priorityFirst": "Zuerst",
+  "accountPool.priorityEarlier": "Früher",
+  "accountPool.priorityNormal": "Normal",
+  "accountPool.priorityLater": "Später",
+  "accountPool.priorityLast": "Zuletzt",
+  "accountPool.priorityOption": "{name} ({value})",
+  "accountPool.priorityCustom": "Benutzerdefiniert",
+  "accountPool.priorityUpdated": "Auswahlreihenfolge für {email} aktualisiert",
+  "accountPool.priorityUpdateFailed": "Die Auswahlreihenfolge für {email} konnte nicht gespeichert werden. Der zuletzt bestätigte Wert wird angezeigt.",
   "codexAuth.switched": "{email} ist für die nächste Anfrage ausgewählt",
   "codexAuth.loadFailed": "Die Codex-Kontoeinstellungen konnten nicht geladen werden.",
   "codexAuth.switchFailed": "Das Konto konnte nicht gewechselt werden. Die vorherige Auswahl bleibt erhalten.",
diff --git a/gui/src/i18n/en.ts b/gui/src/i18n/en.ts
index 07a75a705..fc3f16cf8 100644
--- a/gui/src/i18n/en.ts
+++ b/gui/src/i18n/en.ts
@@ -1075,6 +1075,8 @@ export const en = {
   "codexAuth.pauseFailed": "Could not pause {email}. Nothing was changed.",
   "codexAuth.resumeFailed": "Could not resume {email}. Nothing was changed.",
   "codexAuth.pausedHint": "Excluded from automatic switching, retries, cooldown recovery, and manual selection until resumed.",
+  "codexAuth.pinned": "PINNED",
+  "codexAuth.pinnedHint": "You selected this account by hand, so a higher selection order will not move past it. The pin lasts until this account is drained, you select another, or you change any selection order.",
   "codexAuth.fiveHour": "5h",
   "codexAuth.weekly": "Week",
   "codexAuth.monthly": "30d",
@@ -1088,12 +1090,12 @@ export const en = {
   "codexAuth.prepareForPool": "Prepare for Pool",
   "codexAuth.poolPreparedToast": "{email} is prepared for Pool mode",
   "codexAuth.switchTitle": "Switch active account?",
-  "codexAuth.switchDesc": "This applies to the next request from existing and new Codex sessions. In-flight requests keep their captured account.",
+  "codexAuth.switchDesc": "Takes effect immediately. Requests already in flight keep their captured account; everything else moves to this account, though accounts at the same selection order still take turns.",
   "codexAuth.cacheWarning": "Prompt cache resets on account switch. New session starts with empty cache.",
-  "codexAuth.setAsNext": "Select Account",
+  "codexAuth.setAsNext": "Use this account next",
   "codexAuth.cancel": "Cancel",
   "codexAuth.switchBack": "Switch back to Main?",
-  "codexAuth.switchBackDesc": "The next request from existing and new Codex sessions will use your App login account.",
+  "codexAuth.switchBackDesc": "Takes effect immediately. Requests already in flight keep their captured account; everything else moves to your App login account, though accounts at the same selection order still take turns.",
   "codexAuth.autoSwitch": "Automatic account switching",
   "codexAuth.autoSwitchDesc": "Switches at {threshold}% usage or above when an eligible account has lower usage; Go/Free use 30d only",
   "codexAuth.autoSwitchOffDesc": "Automatic account switching is off",
@@ -1131,6 +1133,21 @@ export const en = {
   "accountPool.strategyLoadFailed": "Rotation strategy could not be loaded.",
   "accountPool.strategyUpdateFailed": "Rotation strategy could not be saved.",
 
+  // Selection order. User-visible copy stays in sequence words (first/earlier/later/last);
+  // only identifiers use the internal "priority" name.
+  "accountPool.priority": "Selection order",
+  "accountPool.priorityAria": "Selection order for this account",
+  "accountPool.priorityHint": "Higher numbers are used first. The pool moves to a lower number only when every account above it is drained or unavailable.",
+  "accountPool.priorityFirst": "First",
+  "accountPool.priorityEarlier": "Earlier",
+  "accountPool.priorityNormal": "Normal",
+  "accountPool.priorityLater": "Later",
+  "accountPool.priorityLast": "Last",
+  "accountPool.priorityOption": "{name} ({value})",
+  "accountPool.priorityCustom": "Custom",
+  "accountPool.priorityUpdated": "Selection order updated for {email}",
+  "accountPool.priorityUpdateFailed": "Selection order for {email} could not be saved. The last confirmed value is shown.",
+
   "codexAuth.switched": "{email} is selected for the next request",
   "codexAuth.loadFailed": "Codex account settings could not be loaded.",
   "codexAuth.switchFailed": "The account could not be switched. Your previous selection is unchanged.",
diff --git a/gui/src/i18n/ja.ts b/gui/src/i18n/ja.ts
index 1501e2d08..2ffc5d002 100644
--- a/gui/src/i18n/ja.ts
+++ b/gui/src/i18n/ja.ts
@@ -1032,6 +1032,8 @@ export const ja: Record<TKey, string> = {
   "codexAuth.pauseFailed": "{email} を一時停止できませんでした。変更はありません。",
   "codexAuth.resumeFailed": "{email} を再開できませんでした。変更はありません。",
   "codexAuth.pausedHint": "再開するまで、自動切り替え、再試行、クールダウン復旧、手動選択の対象外です。",
+  "codexAuth.pinned": "固定中",
+  "codexAuth.pinnedHint": "手動で選択したアカウントなので、これより高い選択順序が先に使われることはありません。固定はこのアカウントを使い切るか、別のアカウントを選ぶか、いずれかの選択順序を変更するまで続きます。",
   "codexAuth.fiveHour": "5時間",
   "codexAuth.weekly": "週",
   "codexAuth.monthly": "30日",
@@ -1045,12 +1047,12 @@ export const ja: Record<TKey, string> = {
   "codexAuth.prepareForPool": "プール用に準備",
   "codexAuth.poolPreparedToast": "{email} はプールモード用に準備されました",
   "codexAuth.switchTitle": "アクティブアカウントを切り替えますか?",
-  "codexAuth.switchDesc": "既存および新規 Codex セッションの次のリクエストから適用されます。処理中のリクエストは現在のアカウントを維持します。",
+  "codexAuth.switchDesc": "すぐに反映されます。処理中のリクエストは現在のアカウントを維持し、それ以外はこのアカウントに切り替わります。ただし同じ選択順序のアカウントは引き続き交代で使われます。",
   "codexAuth.cacheWarning": "アカウント切り替えでプロンプトキャッシュはリセットされます。新規セッションは空のキャッシュで開始します。",
-  "codexAuth.setAsNext": "アカウントを選択",
+  "codexAuth.setAsNext": "このアカウントを次に使う",
   "codexAuth.cancel": "キャンセル",
   "codexAuth.switchBack": "メインに戻しますか?",
-  "codexAuth.switchBackDesc": "既存および新規 Codex セッションの次のリクエストからアプリログインアカウントを使用します。",
+  "codexAuth.switchBackDesc": "すぐに反映されます。処理中のリクエストは現在のアカウントを維持し、それ以外はアプリログインアカウントに切り替わります。ただし同じ選択順序のアカウントは引き続き交代で使われます。",
   "codexAuth.autoSwitch": "アカウントの自動切り替え",
   "codexAuth.autoSwitchDesc": "使用率が {threshold}% 以上で、より使用率の低い利用可能なアカウントがある場合に切り替えます。Go/Free は 30 日枠のみを使用します",
   "codexAuth.autoSwitchOffDesc": "アカウントの自動切り替えはオフです",
@@ -1086,6 +1088,19 @@ export const ja: Record<TKey, string> = {
   "accountPool.stickyLimitInvalid": "1 から 100 までの整数を入力してください",
   "accountPool.strategyLoadFailed": "ローテーション戦略を読み込めませんでした。",
   "accountPool.strategyUpdateFailed": "ローテーション戦略を保存できませんでした。",
+
+  "accountPool.priority": "選択順序",
+  "accountPool.priorityAria": "このアカウントの選択順序",
+  "accountPool.priorityHint": "数値が大きいほど先に使われます。上位のアカウントがすべて使い切られるか利用できなくなったときにのみ、より小さい数値へ移ります。",
+  "accountPool.priorityFirst": "最初",
+  "accountPool.priorityEarlier": "早め",
+  "accountPool.priorityNormal": "標準",
+  "accountPool.priorityLater": "遅め",
+  "accountPool.priorityLast": "最後",
+  "accountPool.priorityOption": "{name}（{value}）",
+  "accountPool.priorityCustom": "カスタム",
+  "accountPool.priorityUpdated": "{email} の選択順序を更新しました",
+  "accountPool.priorityUpdateFailed": "{email} の選択順序を保存できませんでした。最後に確認された値を表示しています。",
   "codexAuth.switched": "次のリクエストでは {email} を使用します",
   "codexAuth.loadFailed": "Codex アカウント設定を読み込めませんでした。",
   "codexAuth.switchFailed": "アカウントを切り替えられませんでした。以前の選択はそのままです。",
diff --git a/gui/src/i18n/ko.ts b/gui/src/i18n/ko.ts
index b2589b6f0..fd52b8141 100644
--- a/gui/src/i18n/ko.ts
+++ b/gui/src/i18n/ko.ts
@@ -678,6 +678,8 @@ export const ko: Record<TKey, string> = {
   "codexAuth.pauseFailed": "{email} 계정을 일시 중지하지 못했습니다. 변경 사항이 없습니다.",
   "codexAuth.resumeFailed": "{email} 계정을 재개하지 못했습니다. 변경 사항이 없습니다.",
   "codexAuth.pausedHint": "재개할 때까지 자동 전환, 재시도, 쿨다운 복구 및 수동 선택에서 제외됩니다.",
+  "codexAuth.pinned": "고정됨",
+  "codexAuth.pinnedHint": "직접 선택한 계정이므로 더 높은 선택 순서가 이 계정을 앞지르지 않습니다. 고정은 이 계정이 소진되거나, 다른 계정을 선택하거나, 어떤 계정이든 선택 순서를 변경할 때까지 유지됩니다.",
   "codexAuth.fiveHour": "5시간",
   "codexAuth.weekly": "주간",
   "codexAuth.monthly": "30일",
@@ -691,12 +693,12 @@ export const ko: Record<TKey, string> = {
   "codexAuth.prepareForPool": "풀 모드용으로 준비",
   "codexAuth.poolPreparedToast": "{email} 계정을 풀 모드용으로 준비했습니다",
   "codexAuth.switchTitle": "활성 계정을 변경하시겠습니까?",
-  "codexAuth.switchDesc": "기존 세션과 새 세션의 다음 요청부터 적용됩니다. 진행 중인 요청은 기존 계정을 유지합니다.",
+  "codexAuth.switchDesc": "즉시 적용됩니다. 이미 진행 중인 요청은 기존 계정을 유지하고, 그 외에는 이 계정으로 전환됩니다. 다만 같은 선택 순서의 계정은 계속 번갈아 사용됩니다.",
   "codexAuth.cacheWarning": "계정 전환 시 프롬프트 캐시가 초기화됩니다.",
-  "codexAuth.setAsNext": "계정 선택",
+  "codexAuth.setAsNext": "이 계정을 다음에 사용",
   "codexAuth.cancel": "취소",
   "codexAuth.switchBack": "메인 계정으로 돌아가시겠습니까?",
-  "codexAuth.switchBackDesc": "기존 세션과 새 세션의 다음 요청부터 앱 로그인 계정을 사용합니다.",
+  "codexAuth.switchBackDesc": "즉시 적용됩니다. 이미 진행 중인 요청은 기존 계정을 유지하고, 그 외에는 앱 로그인 계정으로 전환됩니다. 다만 같은 선택 순서의 계정은 계속 번갈아 사용됩니다.",
   "codexAuth.autoSwitch": "자동 계정 전환",
   "codexAuth.autoSwitchDesc": "사용량이 {threshold}% 이상이고 사용량이 더 낮은 정상 계정이 있으면 전환합니다. Go/Free는 30일만 봅니다",
   "codexAuth.autoSwitchOffDesc": "자동 계정 전환이 꺼져 있습니다",
@@ -732,6 +734,19 @@ export const ko: Record<TKey, string> = {
   "accountPool.stickyLimitInvalid": "1에서 100 사이의 정수를 입력하세요",
   "accountPool.strategyLoadFailed": "로테이션 전략을 불러오지 못했습니다.",
   "accountPool.strategyUpdateFailed": "로테이션 전략을 저장하지 못했습니다.",
+
+  "accountPool.priority": "선택 순서",
+  "accountPool.priorityAria": "이 계정의 선택 순서",
+  "accountPool.priorityHint": "숫자가 클수록 먼저 사용됩니다. 위에 있는 계정이 모두 소진되거나 사용할 수 없을 때에만 더 낮은 숫자로 넘어갑니다.",
+  "accountPool.priorityFirst": "가장 먼저",
+  "accountPool.priorityEarlier": "먼저",
+  "accountPool.priorityNormal": "기본",
+  "accountPool.priorityLater": "나중에",
+  "accountPool.priorityLast": "가장 마지막",
+  "accountPool.priorityOption": "{name} ({value})",
+  "accountPool.priorityCustom": "사용자 지정",
+  "accountPool.priorityUpdated": "{email}의 선택 순서를 업데이트했습니다",
+  "accountPool.priorityUpdateFailed": "{email}의 선택 순서를 저장하지 못했습니다. 마지막으로 확인된 값을 표시합니다.",
   "codexAuth.switched": "다음 요청에 {email}을(를) 사용합니다",
   "codexAuth.loadFailed": "Codex 계정 설정을 불러오지 못했습니다.",
   "codexAuth.switchFailed": "계정을 전환하지 못했습니다. 이전 선택은 그대로 유지됩니다.",
diff --git a/gui/src/i18n/ru.ts b/gui/src/i18n/ru.ts
index 9a21fcae7..76ebc9323 100644
--- a/gui/src/i18n/ru.ts
+++ b/gui/src/i18n/ru.ts
@@ -1074,6 +1074,8 @@ export const ru: Record<TKey, string> = {
   "codexAuth.pauseFailed": "Не удалось приостановить {email}. Изменений нет.",
   "codexAuth.resumeFailed": "Не удалось возобновить {email}. Изменений нет.",
   "codexAuth.pausedHint": "До возобновления исключён из автоматического переключения, повторов, восстановления после задержки и ручного выбора.",
+  "codexAuth.pinned": "ЗАКРЕПЛЁН",
+  "codexAuth.pinnedHint": "Этот аккаунт выбран вручную, поэтому более высокий порядок выбора не обойдёт его. Закрепление действует, пока этот аккаунт не будет исчерпан, пока вы не выберете другой или пока вы не измените порядок выбора любого аккаунта.",
   "codexAuth.fiveHour": "5 ч",
   "codexAuth.weekly": "Неделя",
   "codexAuth.monthly": "30 дн.",
@@ -1087,12 +1089,12 @@ export const ru: Record<TKey, string> = {
   "codexAuth.prepareForPool": "Подготовить для пула",
   "codexAuth.poolPreparedToast": "{email} подготовлен для режима пула",
   "codexAuth.switchTitle": "Сменить активный аккаунт?",
-  "codexAuth.switchDesc": "Изменение применяется к следующему запросу существующих и новых сессий Codex. Выполняющиеся запросы сохраняют прежний аккаунт.",
+  "codexAuth.switchDesc": "Применяется сразу. Уже выполняющиеся запросы сохраняют прежний аккаунт, остальные переходят на этот; при этом аккаунты с тем же порядком выбора продолжают чередоваться.",
   "codexAuth.cacheWarning": "Кэш промптов сбрасывается при смене аккаунта. Новая сессия начнётся с пустым кэшем.",
-  "codexAuth.setAsNext": "Выбрать аккаунт",
+  "codexAuth.setAsNext": "Использовать этот аккаунт следующим",
   "codexAuth.cancel": "Отмена",
   "codexAuth.switchBack": "Вернуться на основной аккаунт?",
-  "codexAuth.switchBackDesc": "Следующий запрос существующих и новых сессий Codex будет использовать аккаунт входа через приложение.",
+  "codexAuth.switchBackDesc": "Применяется сразу. Уже выполняющиеся запросы сохраняют прежний аккаунт, остальные переходят на аккаунт входа через приложение; при этом аккаунты с тем же порядком выбора продолжают чередоваться.",
   "codexAuth.autoSwitch": "Автоматическое переключение аккаунтов",
   "codexAuth.autoSwitchDesc": "Переключает при использовании {threshold}% или выше, если доступен аккаунт с меньшим использованием; тарифы Go/Free используют только окно 30 дней",
   "codexAuth.autoSwitchOffDesc": "Автоматическое переключение аккаунтов выключено",
@@ -1128,6 +1130,19 @@ export const ru: Record<TKey, string> = {
   "accountPool.stickyLimitInvalid": "Введите целое число от 1 до 100",
   "accountPool.strategyLoadFailed": "Не удалось загрузить стратегию ротации.",
   "accountPool.strategyUpdateFailed": "Не удалось сохранить стратегию ротации.",
+
+  "accountPool.priority": "Порядок выбора",
+  "accountPool.priorityAria": "Порядок выбора для этого аккаунта",
+  "accountPool.priorityHint": "Большие числа используются раньше. Пул переходит к меньшему числу только тогда, когда все аккаунты выше исчерпаны или недоступны.",
+  "accountPool.priorityFirst": "Первым",
+  "accountPool.priorityEarlier": "Раньше",
+  "accountPool.priorityNormal": "По умолчанию",
+  "accountPool.priorityLater": "Позже",
+  "accountPool.priorityLast": "Последним",
+  "accountPool.priorityOption": "{name} ({value})",
+  "accountPool.priorityCustom": "Своё значение",
+  "accountPool.priorityUpdated": "Порядок выбора для {email} обновлён",
+  "accountPool.priorityUpdateFailed": "Не удалось сохранить порядок выбора для {email}. Показано последнее подтверждённое значение.",
   "codexAuth.switched": "{email} выбран для следующего запроса",
   "codexAuth.loadFailed": "Не удалось загрузить настройки аккаунтов Codex.",
   "codexAuth.switchFailed": "Не удалось переключить аккаунт. Ваш предыдущий выбор не изменён.",
diff --git a/gui/src/i18n/zh.ts b/gui/src/i18n/zh.ts
index 1ccd0f8a0..474da3fba 100644
--- a/gui/src/i18n/zh.ts
+++ b/gui/src/i18n/zh.ts
@@ -678,6 +678,8 @@ export const zh: Record<TKey, string> = {
   "codexAuth.pauseFailed": "无法暂停 {email}，未做任何更改。",
   "codexAuth.resumeFailed": "无法恢复 {email}，未做任何更改。",
   "codexAuth.pausedHint": "恢复前不会参与自动切换、重试、冷却恢复或手动选择。",
+  "codexAuth.pinned": "已固定",
+  "codexAuth.pinnedHint": "这是你手动选择的账号，因此更高的选择顺序不会越过它。该固定会一直生效，直到此账号用尽、你改选其他账号，或你修改任一选择顺序。",
   "codexAuth.fiveHour": "5 小时",
   "codexAuth.weekly": "每周",
   "codexAuth.monthly": "30天",
@@ -691,12 +693,12 @@ export const zh: Record<TKey, string> = {
   "codexAuth.prepareForPool": "为账户池准备",
   "codexAuth.poolPreparedToast": "已为账户池模式准备 {email}",
   "codexAuth.switchTitle": "切换活跃账号？",
-  "codexAuth.switchDesc": "从现有和新 Codex 会话的下一次请求开始生效。进行中的请求保留原账号。",
+  "codexAuth.switchDesc": "立即生效。已在进行中的请求保留原账号，其余都会切换到此账号；不过选择顺序相同的账号仍会轮换使用。",
   "codexAuth.cacheWarning": "切换账号会重置提示缓存。新会话从空缓存开始。",
-  "codexAuth.setAsNext": "选择账号",
+  "codexAuth.setAsNext": "接下来使用此账号",
   "codexAuth.cancel": "取消",
   "codexAuth.switchBack": "切换回主账号？",
-  "codexAuth.switchBackDesc": "现有和新 Codex 会话的下一次请求将使用应用登录账号。",
+  "codexAuth.switchBackDesc": "立即生效。已在进行中的请求保留原账号，其余都会切换到应用登录账号；不过选择顺序相同的账号仍会轮换使用。",
   "codexAuth.autoSwitch": "自动切换账号",
   "codexAuth.autoSwitchDesc": "使用率达到或超过 {threshold}% 且存在使用率更低的可用账号时切换；Go/Free 仅使用 30 天窗口",
   "codexAuth.autoSwitchOffDesc": "自动切换账号已关闭",
@@ -732,6 +734,19 @@ export const zh: Record<TKey, string> = {
   "accountPool.stickyLimitInvalid": "请输入 1 到 100 之间的整数",
   "accountPool.strategyLoadFailed": "无法加载轮换策略。",
   "accountPool.strategyUpdateFailed": "无法保存轮换策略。",
+
+  "accountPool.priority": "选择顺序",
+  "accountPool.priorityAria": "此账号的选择顺序",
+  "accountPool.priorityHint": "数字越大越先使用。只有当排在前面的账号全部用尽或不可用时，账号池才会转向更小的数字。",
+  "accountPool.priorityFirst": "最先",
+  "accountPool.priorityEarlier": "较先",
+  "accountPool.priorityNormal": "默认",
+  "accountPool.priorityLater": "较后",
+  "accountPool.priorityLast": "最后",
+  "accountPool.priorityOption": "{name}（{value}）",
+  "accountPool.priorityCustom": "自定义",
+  "accountPool.priorityUpdated": "已更新 {email} 的选择顺序",
+  "accountPool.priorityUpdateFailed": "无法保存 {email} 的选择顺序。当前显示最后一次确认的值。",
   "codexAuth.switched": "下一次请求将使用 {email}",
   "codexAuth.loadFailed": "无法加载 Codex 账号设置。",
   "codexAuth.switchFailed": "无法切换账户。之前的选择保持不变。",
diff --git a/gui/src/styles.css b/gui/src/styles.css
index 29a04a56d..8f15fbc42 100644
--- a/gui/src/styles.css
+++ b/gui/src/styles.css
@@ -846,6 +846,16 @@ dialog.modal-overlay::backdrop {
 .codex-auto-switch-unit { color: var(--muted); font-size: var(--text-control); }
 .codex-auto-switch-feedback { flex: 1 0 100%; margin-top: -8px; color: var(--muted); font-size: var(--text-label); line-height: var(--leading-body); text-align: right; }
 .codex-auto-switch-feedback.is-error { color: var(--red); }
+/* `.card` carries no padding of its own — `.card-row` and `.card-sub` each inset themselves,
+   so a card built from plain children leaves the title and controls flush against the border
+   while the hints sit 16px in. Pad the card and flatten the hints, as the auto-switch card does. */
+.codex-pool-strategy-card { padding: 14px 16px; }
+.codex-pool-strategy-card .card-sub { padding: 0; }
+/* Inline selection-order row on an account card: label and trigger share one line, and the
+   trigger is scaled down to the card's hint text so it reads as part of the card, not a form. */
+.codex-account-priority { display: flex; align-items: center; gap: 8px; flex-wrap: wrap; padding: 0 16px 10px; min-width: 0; }
+.codex-account-priority-label { font-size: var(--text-label); color: var(--muted); font-weight: var(--weight-medium); white-space: nowrap; }
+.codex-account-priority .select-trigger { max-width: 100%; padding: 4px 9px; font-size: var(--text-label); }
 .notice-warn { font-size: var(--text-label); line-height: var(--leading-body); padding: 8px 10px; border-radius: var(--radius-sm); background: var(--amber-soft); color: var(--amber); display: flex; align-items: center; gap: 6px; margin-bottom: 12px; }
 .notice-warn svg { width: 14px; height: 14px; flex-shrink: 0; }
 
diff --git a/gui/src/ui.tsx b/gui/src/ui.tsx
index 9477ba79a..57df4b430 100644
--- a/gui/src/ui.tsx
+++ b/gui/src/ui.tsx
@@ -25,12 +25,16 @@ export function Notice({ tone, children }: { tone: "ok" | "err"; children: React
 
 export interface SelectOption { value: string; label: React.ReactNode }
 
-export function Select({ value, options, onChange, disabled, label, style, align, placement, dropdownStyle, portal = true }: {
+export function Select({ value, options, onChange, disabled, id, label, describedBy, title, style, align, placement, dropdownStyle, portal = true }: {
   value: string;
   options: SelectOption[];
   onChange: (value: string) => void;
   disabled?: boolean;
+  /** Put on the trigger, so a sibling `<label htmlFor>` can name it — a button is labelable. */
+  id?: string;
   label?: string;
+  describedBy?: string;
+  title?: string;
   style?: CSSProperties;
   align?: "left" | "right";
   placement?: "below" | "right";
@@ -206,6 +210,9 @@ export function Select({ value, options, onChange, disabled, label, style, align
         ref={triggerRef}
         type="button"
         role="combobox"
+        id={id}
+        title={title}
+        aria-describedby={describedBy}
         className="select-trigger"
         onClick={() => {
           if (disabled) return;
diff --git a/gui/tests/account-pool-strategy.test.tsx b/gui/tests/account-pool-strategy.test.tsx
index 15babe790..91288d306 100644
--- a/gui/tests/account-pool-strategy.test.tsx
+++ b/gui/tests/account-pool-strategy.test.tsx
@@ -143,7 +143,7 @@ describe("account pool strategy helpers", () => {
 });
 
 describe("AccountPoolStrategyControls", () => {
-  test("renders strategy options and hides sticky unless round-robin", () => {
+  test("shows the selected strategy and hides sticky unless round-robin", () => {
     const quota = renderToStaticMarkup(
       <LanguageProvider>
         <AccountPoolStrategyControls
@@ -156,8 +156,10 @@ describe("AccountPoolStrategyControls", () => {
       </LanguageProvider>,
     );
     expect(quota).toContain("Quota");
-    expect(quota).toContain("Round-robin");
-    expect(quota).toContain("Fill-first");
+    // Closed, the trigger carries only the current strategy — the options live in the
+    // portaled menu, so they are asserted where one can actually be clicked.
+    expect(quota).not.toContain("Round-robin");
+    expect(quota).not.toContain("Fill-first");
     expect(quota).toContain("Applies to new sessions only");
     expect(quota).not.toContain("Sticky successes before rotate");
 
@@ -172,6 +174,7 @@ describe("AccountPoolStrategyControls", () => {
         />
       </LanguageProvider>,
     );
+    expect(rr).toContain("Round-robin");
     expect(rr).toContain("Sticky successes before rotate");
     expect(rr).toContain('value="2"');
   });
@@ -218,6 +221,18 @@ describe("CodexPoolStrategySetting optimistic strategy select", () => {
     await teardownDom();
   });
 
+  const trigger = () => testWindow.document.querySelector<HTMLButtonElement>("#codex-pool-strategy");
+  const openMenu = async () => { await act(async () => trigger()?.click()); };
+  // The menu is portaled to document.body, so the options are not under the mount node.
+  const optionLabels = () =>
+    [...testWindow.document.querySelectorAll('[role="option"]')].map((option) => option.textContent);
+  const clickOption = async (label: string) => {
+    const option = [...testWindow.document.querySelectorAll<HTMLButtonElement>('[role="option"]')]
+      .find((candidate) => candidate.textContent === label);
+    if (!option) throw new Error(`strategy option ${label} missing`);
+    await act(async () => { option.click(); await flush(); });
+  };
+
   test("updates visible strategy before save completes", async () => {
     const put = deferred<Response>();
     globalThis.fetch = (async (input: RequestInfo | URL, init?: RequestInit) => {
@@ -247,20 +262,14 @@ describe("CodexPoolStrategySetting optimistic strategy select", () => {
     });
     await act(async () => { await flush(); });
 
-    const select = () => host.querySelector<HTMLSelectElement>("#codex-pool-strategy");
-    expect(select()?.value).toBe("quota");
+    expect(trigger()?.textContent).toContain("Quota");
 
-    await act(async () => {
-      const el = select();
-      if (!el) throw new Error("strategy select missing");
-      Object.getOwnPropertyDescriptor(testWindow.HTMLSelectElement.prototype, "value")!
-        .set!.call(el, "round-robin");
-      el.dispatchEvent(new testWindow.Event("change", { bubbles: true }));
-      await flush();
-    });
+    await openMenu();
+    expect(optionLabels()).toEqual(["Quota", "Round-robin", "Fill-first"]);
+    await clickOption("Round-robin");
 
-    expect(select()?.value).toBe("round-robin");
-    expect(select()?.disabled).toBe(true);
+    expect(trigger()?.textContent).toContain("Round-robin");
+    expect(trigger()?.disabled).toBe(true);
 
     await act(async () => {
       put.resolve(new Response(JSON.stringify({
@@ -271,8 +280,8 @@ describe("CodexPoolStrategySetting optimistic strategy select", () => {
       await flush();
     });
 
-    expect(select()?.value).toBe("round-robin");
-    expect(select()?.disabled).toBe(false);
+    expect(trigger()?.textContent).toContain("Round-robin");
+    expect(trigger()?.disabled).toBe(false);
     expect(host.textContent).toContain("Sticky successes before rotate");
   });
 
@@ -304,17 +313,10 @@ describe("CodexPoolStrategySetting optimistic strategy select", () => {
     });
     await act(async () => { await flush(); });
 
-    const select = () => host.querySelector<HTMLSelectElement>("#codex-pool-strategy");
-    await act(async () => {
-      const el = select();
-      if (!el) throw new Error("strategy select missing");
-      Object.getOwnPropertyDescriptor(testWindow.HTMLSelectElement.prototype, "value")!
-        .set!.call(el, "fill-first");
-      el.dispatchEvent(new testWindow.Event("change", { bubbles: true }));
-      await flush();
-    });
+    await openMenu();
+    await clickOption("Fill-first");
 
-    expect(select()?.value).toBe("quota");
+    expect(trigger()?.textContent).toContain("Quota");
     expect(host.textContent).toContain("Rotation strategy could not be saved");
   });
 
diff --git a/gui/tests/account-priority.test.tsx b/gui/tests/account-priority.test.tsx
new file mode 100644
index 000000000..ebfec7bf8
--- /dev/null
+++ b/gui/tests/account-priority.test.tsx
@@ -0,0 +1,243 @@
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { Window } from "happy-dom";
+import { act } from "react";
+import type { Root } from "react-dom/client";
+import { renderToStaticMarkup } from "react-dom/server";
+import {
+  ACCOUNT_PRIORITY_PRESETS,
+  accountPriorityLabel,
+  accountPriorityPresetKey,
+  DEFAULT_ACCOUNT_PRIORITY,
+  formatAccountPriority,
+  isAccountPriorityPreset,
+  normalizeAccountPriority,
+} from "../src/account-priority";
+import AccountPriorityControl, { AccountPriorityBadge } from "../src/components/AccountPriorityControl";
+import { LanguageProvider } from "../src/i18n/provider";
+
+let previousLanguage: unknown;
+
+const domGlobals = ["document", "window", "navigator", "IS_REACT_ACT_ENVIRONMENT"] as const;
+let previousDomGlobals: Record<(typeof domGlobals)[number], unknown>;
+let testWindow: Window;
+let mountedRoot: Root | null;
+
+beforeEach(() => {
+  previousLanguage = (globalThis.navigator as { language?: unknown } | undefined)?.language;
+  Object.defineProperty(globalThis.navigator, "language", {
+    configurable: true,
+    value: "en-US",
+  });
+});
+
+afterEach(() => {
+  Object.defineProperty(globalThis.navigator, "language", {
+    configurable: true,
+    value: previousLanguage,
+  });
+});
+
+function setupDom(): void {
+  previousDomGlobals = Object.fromEntries(
+    domGlobals.map((key) => [key, Reflect.get(globalThis, key)]),
+  ) as typeof previousDomGlobals;
+  testWindow = new Window({ url: "http://localhost/" });
+  Object.defineProperty(testWindow.navigator, "language", { configurable: true, value: "en-US" });
+  Object.defineProperties(globalThis, {
+    document: { configurable: true, value: testWindow.document },
+    window: { configurable: true, value: testWindow },
+    navigator: { configurable: true, value: testWindow.navigator },
+  });
+  (globalThis as typeof globalThis & { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT = true;
+  mountedRoot = null;
+}
+
+async function teardownDom(): Promise<void> {
+  if (mountedRoot) {
+    await act(async () => {
+      mountedRoot?.unmount();
+    });
+    mountedRoot = null;
+  }
+  for (const key of domGlobals) {
+    Object.defineProperty(globalThis, key, { configurable: true, value: previousDomGlobals[key] });
+  }
+  await testWindow.happyDOM?.close?.();
+}
+
+describe("account priority helpers", () => {
+  test("normalizes integers inside the API range and defaults everything else", () => {
+    expect(normalizeAccountPriority(2)).toBe(2);
+    expect(normalizeAccountPriority(-2)).toBe(-2);
+    expect(normalizeAccountPriority(100)).toBe(100);
+    expect(normalizeAccountPriority(-100)).toBe(-100);
+    for (const invalid of [101, -101, 1.5, NaN, "1", null, undefined, {}]) {
+      expect(normalizeAccountPriority(invalid)).toBe(DEFAULT_ACCOUNT_PRIORITY);
+    }
+  });
+
+  test("formats with a sign and an ASCII hyphen", () => {
+    expect(formatAccountPriority(2)).toBe("+2");
+    expect(formatAccountPriority(1)).toBe("+1");
+    expect(formatAccountPriority(0)).toBe("0");
+    expect(formatAccountPriority(-1)).toBe("-1");
+    expect(formatAccountPriority(-2)).toBe("-2");
+    // A Unicode minus would not round-trip through the API or the CLI column.
+    expect(formatAccountPriority(-7).charCodeAt(0)).toBe(0x2d);
+  });
+
+  test("presets run first to last and map to label keys", () => {
+    expect(ACCOUNT_PRIORITY_PRESETS).toEqual([2, 1, 0, -1, -2]);
+    expect(ACCOUNT_PRIORITY_PRESETS.map(accountPriorityPresetKey)).toEqual([
+      "accountPool.priorityFirst",
+      "accountPool.priorityEarlier",
+      "accountPool.priorityNormal",
+      "accountPool.priorityLater",
+      "accountPool.priorityLast",
+    ]);
+    expect(accountPriorityPresetKey(7)).toBeNull();
+    expect(isAccountPriorityPreset(0)).toBe(true);
+    expect(isAccountPriorityPreset(7)).toBe(false);
+  });
+
+  test("labels carry the signed number, and non-presets read as Custom", () => {
+    const t = ((key: string, vars?: Record<string, string | number>) => {
+      const dict: Record<string, string> = {
+        "accountPool.priorityFirst": "First",
+        "accountPool.priorityLast": "Last",
+        "accountPool.priorityCustom": "Custom",
+        "accountPool.priorityOption": "{name} ({value})",
+      };
+      const template = dict[key] ?? key;
+      return Object.entries(vars ?? {}).reduce(
+        (text, [name, value]) => text.split(`{${name}}`).join(String(value)),
+        template,
+      );
+    }) as Parameters<typeof accountPriorityLabel>[0];
+
+    expect(accountPriorityLabel(t, 2)).toBe("First (+2)");
+    expect(accountPriorityLabel(t, -2)).toBe("Last (-2)");
+    expect(accountPriorityLabel(t, 7)).toBe("Custom (+7)");
+  });
+});
+
+describe("AccountPriorityControl", () => {
+  // The trigger is all that renders while the menu is closed, so the options themselves are
+  // asserted in the interaction block below rather than against static markup.
+  test("names the control from locale keys and shows only the current order when closed", () => {
+    const markup = renderToStaticMarkup(
+      <LanguageProvider>
+        <AccountPriorityControl value={0} selectId="order-1" onChange={() => {}} />
+      </LanguageProvider>,
+    );
+    expect(markup).toContain("Selection order");
+    expect(markup).toContain('for="order-1"');
+    expect(markup).toContain('id="order-1-hint"');
+    expect(markup).toContain('aria-describedby="order-1-hint"');
+    expect(markup).toContain("Higher numbers are used first.");
+    expect(markup).toContain("Normal (0)");
+    expect(markup).not.toContain("First (+2)");
+  });
+
+  test("the badge names a non-default order and stays out of the way at zero", () => {
+    expect(renderToStaticMarkup(
+      <LanguageProvider><AccountPriorityBadge value={0} /></LanguageProvider>,
+    )).toBe("");
+    const markup = renderToStaticMarkup(
+      <LanguageProvider><AccountPriorityBadge value={-1} /></LanguageProvider>,
+    );
+    expect(markup).toContain("Later (-1)");
+    expect(markup).toContain("badge-muted");
+  });
+
+  describe("interaction", () => {
+    beforeEach(() => setupDom());
+    afterEach(async () => {
+      await teardownDom();
+    });
+
+    async function mount(props: {
+      value: number;
+      selectId: string;
+      disabled?: boolean;
+      onChange?: (priority: number) => void;
+    }): Promise<void> {
+      const host = testWindow.document.createElement("div");
+      testWindow.document.body.appendChild(host as never);
+      const { createRoot } = await import("react-dom/client");
+      await act(async () => {
+        mountedRoot = createRoot(host);
+        mountedRoot.render(
+          <LanguageProvider>
+            <AccountPriorityControl
+              value={props.value}
+              selectId={props.selectId}
+              disabled={props.disabled}
+              onChange={props.onChange ?? (() => {})}
+            />
+          </LanguageProvider>,
+        );
+      });
+    }
+
+    const trigger = (selectId: string) => {
+      const element = testWindow.document.querySelector<HTMLButtonElement>(`#${selectId}`);
+      if (!element) throw new Error(`selection order trigger ${selectId} missing`);
+      return element;
+    };
+    // The menu is portaled to document.body, so the options are not under the mount node.
+    const optionLabels = () =>
+      [...testWindow.document.querySelectorAll('[role="option"]')].map((option) => option.textContent);
+    const open = async (selectId: string) => { await act(async () => trigger(selectId).click()); };
+
+    test("offers the five presets in first-to-last order with signed numbers", async () => {
+      await mount({ value: 0, selectId: "order-live" });
+      await open("order-live");
+
+      expect(optionLabels()).toEqual(["First (+2)", "Earlier (+1)", "Normal (0)", "Later (-1)", "Last (-2)"]);
+    });
+
+    test("prepends a stored value the presets do not cover as a selectable peer", async () => {
+      await mount({ value: 7, selectId: "order-custom" });
+      expect(trigger("order-custom").textContent).toContain("Custom (+7)");
+
+      await open("order-custom");
+      // Custom sits ahead of the presets so the current value is the first option.
+      expect(optionLabels()).toEqual([
+        "Custom (+7)", "First (+2)", "Earlier (+1)", "Normal (0)", "Later (-1)", "Last (-2)",
+      ]);
+    });
+
+    test("a value outside the API range falls back to the default order", async () => {
+      await mount({ value: 9001, selectId: "order-bogus" });
+      expect(trigger("order-bogus").textContent).toContain("Normal (0)");
+
+      await open("order-bogus");
+      expect(optionLabels()).not.toContain("Custom (+9001)");
+      expect(optionLabels()).toHaveLength(ACCOUNT_PRIORITY_PRESETS.length);
+    });
+
+    test("parses the chosen option back into a number", async () => {
+      const seen: number[] = [];
+      await mount({ value: 0, selectId: "order-live", onChange: (priority) => { seen.push(priority); } });
+
+      for (const label of ["Last (-2)", "First (+2)"]) {
+        await open("order-live");
+        const option = [...testWindow.document.querySelectorAll<HTMLButtonElement>('[role="option"]')]
+          .find((candidate) => candidate.textContent === label);
+        if (!option) throw new Error(`option ${label} missing`);
+        await act(async () => option.click());
+      }
+
+      expect(seen).toEqual([-2, 2]);
+    });
+
+    test("disabled blocks the control while a save is in flight", async () => {
+      await mount({ value: 1, selectId: "order-busy", disabled: true });
+
+      expect(trigger("order-busy").disabled).toBe(true);
+      await open("order-busy");
+      expect(optionLabels()).toEqual([]);
+    });
+  });
+});
diff --git a/gui/tests/codex-account-pool-behaviour.test.tsx b/gui/tests/codex-account-pool-behaviour.test.tsx
index 2b02a4516..c8e34518a 100644
--- a/gui/tests/codex-account-pool-behaviour.test.tsx
+++ b/gui/tests/codex-account-pool-behaviour.test.tsx
@@ -26,6 +26,15 @@ let nextAccountsResponseGate: Promise<void> | null = null;
 let pauseResponseActiveId: string | null = null;
 let bulkPausedAccountIds: string[] = ["a2"];
 let bulkResponseActiveId: string | null = null;
+let priorityResponseOk = true;
+let nextPriorityResponseGate: Promise<void> | null = null;
+let nextPauseResponseGate: Promise<void> | null = null;
+let nextActiveResponseGate: Promise<void> | null = null;
+let nextActivePutGate: Promise<void> | null = null;
+let activePinned = false;
+let activePinnedAccountId: string | null = null;
+let omitPinnedAccountId = false;
+let activeGetId: string | null = null;
 
 beforeEach(() => {
   previous = Object.fromEntries(globals.map((k) => [k, Reflect.get(globalThis, k)])) as typeof previous;
@@ -44,13 +53,41 @@ beforeEach(() => {
   pauseResponseActiveId = null;
   bulkPausedAccountIds = ["a2"];
   bulkResponseActiveId = null;
-  accounts = [{ id: "a1", email: "account-one", isMain: true, paused: false, hasCredential: true, quota: null }];
+  priorityResponseOk = true;
+  nextPriorityResponseGate = null;
+  nextPauseResponseGate = null;
+  nextActiveResponseGate = null;
+  nextActivePutGate = null;
+  activePinned = false;
+  activePinnedAccountId = null;
+  omitPinnedAccountId = false;
+  activeGetId = null;
+  accounts = [{ id: "a1", email: "account-one", isMain: true, paused: false, priority: 0, hasCredential: true, quota: null }];
   Object.defineProperty(globalThis, "fetch", {
     configurable: true,
     value: async (url: string, init?: RequestInit) => {
       const path = String(url).split("/api/")[1] ?? String(url);
       calls.push(`${init?.method ?? "GET"} ${path}`);
+      if (path === "codex-auth/accounts/priority") {
+        const gate = nextPriorityResponseGate;
+        nextPriorityResponseGate = null;
+        if (gate) await gate;
+        const body = JSON.parse(String(init?.body)) as { id: string; priority: number | null };
+        if (!priorityResponseOk) return { ok: false, json: async () => ({}) } as unknown as Response;
+        const stored = body.priority ?? 0;
+        accounts = accounts.map(account => (
+          typeof account === "object" && account !== null && "id" in account
+            && (account.id === body.id || (body.id === "__main__" && "isMain" in account && account.isMain === true))
+            ? { ...account, priority: stored }
+            : account
+        ));
+        activePinnedAccountId = null;
+        return { ok: true, json: async () => ({ ok: true, id: body.id, priority: stored }) } as unknown as Response;
+      }
       if (path === "codex-auth/accounts/pause") {
+        const gate = nextPauseResponseGate;
+        nextPauseResponseGate = null;
+        if (gate) await gate;
         const body = JSON.parse(String(init?.body)) as { id: string; paused: boolean };
         accounts = accounts.map(account => (
           typeof account === "object" && account !== null && "id" in account
@@ -58,6 +95,7 @@ beforeEach(() => {
             ? { ...account, paused: body.paused }
             : account
         ));
+        if (body.paused && activePinnedAccountId === body.id) activePinnedAccountId = null;
         return { ok: true, json: async () => ({ activeCodexAccountId: pauseResponseActiveId }) } as unknown as Response;
       }
       if (path === "codex-auth/accounts/pause-exhausted") {
@@ -68,6 +106,7 @@ beforeEach(() => {
             ? { ...account, paused: true }
             : account
         ));
+        if (activePinnedAccountId && pausedIds.has(activePinnedAccountId)) activePinnedAccountId = null;
         return {
           ok: true,
           json: async () => ({
@@ -84,7 +123,29 @@ beforeEach(() => {
         return { ok: true, json: async () => ({ accounts }) } as unknown as Response;
       }
       if (path.startsWith("codex-auth/active")) {
-        return { ok: true, json: async () => ({ activeCodexAccountId: null, autoSwitchThreshold: threshold }) } as unknown as Response;
+        if (init?.method === "PUT") {
+          const body = JSON.parse(String(init.body)) as { accountId: string | null };
+          const putGate = nextActivePutGate;
+          nextActivePutGate = null;
+          if (putGate) await putGate;
+          activePinnedAccountId = body.accountId;
+          return {
+            ok: true,
+            json: async () => ({ activeCodexAccountId: body.accountId }),
+          } as unknown as Response;
+        }
+        const gate = nextActiveResponseGate;
+        nextActiveResponseGate = null;
+        if (gate) await gate;
+        return {
+          ok: true,
+          json: async () => ({
+            activeCodexAccountId: activeGetId,
+            pinned: activePinned,
+            ...(omitPinnedAccountId ? {} : { pinnedAccountId: activePinnedAccountId }),
+            autoSwitchThreshold: threshold,
+          }),
+        } as unknown as Response;
       }
       return { ok: true, json: async () => ({}) } as unknown as Response;
     },
@@ -177,8 +238,8 @@ test("pausing the main sentinel updates its distinct account row before reload",
 
 test("pausing stores the actual fallback account returned by the API", async () => {
   accounts = [
-    { id: "a1", email: "main", isMain: true, paused: false, hasCredential: true, quota: null },
-    { id: "a2", email: "next", isMain: false, paused: false, hasCredential: true, quota: null },
+    { id: "a1", email: "main", isMain: true, paused: false, priority: 0, hasCredential: true, quota: null },
+    { id: "a2", email: "next", isMain: false, paused: false, priority: 0, hasCredential: true, quota: null },
   ];
   pauseResponseActiveId = "a2";
   const seen = await mountController();
@@ -192,8 +253,8 @@ test("pausing stores the actual fallback account returned by the API", async ()
 
 test("a paused main account does not contribute active reauth state", async () => {
   accounts = [
-    { id: "a1", email: "main", isMain: true, paused: true, hasCredential: true, needsReauth: true, quota: null },
-    { id: "a2", email: "next", isMain: false, paused: false, hasCredential: true, quota: null },
+    { id: "a1", email: "main", isMain: true, paused: true, priority: 0, hasCredential: true, needsReauth: true, quota: null },
+    { id: "a2", email: "next", isMain: false, paused: false, priority: 0, hasCredential: true, quota: null },
   ];
   const seen = await mountController();
 
@@ -203,8 +264,8 @@ test("a paused main account does not contribute active reauth state", async () =
 
 test("bulk pausing writes one endpoint and updates every returned account", async () => {
   accounts = [
-    { id: "a1", email: "account-one", isMain: true, paused: false, hasCredential: true, quota: null },
-    { id: "a2", email: "account-two", isMain: false, paused: false, hasCredential: true, quota: null },
+    { id: "a1", email: "account-one", isMain: true, paused: false, priority: 0, hasCredential: true, quota: null },
+    { id: "a2", email: "account-two", isMain: false, paused: false, priority: 0, hasCredential: true, quota: null },
   ];
   const seen = await mountController();
 
@@ -220,8 +281,8 @@ test("bulk pausing writes one endpoint and updates every returned account", asyn
 
 test("bulk pausing translates the main sentinel to its distinct account row", async () => {
   accounts = [
-    { id: "a1", email: "main", isMain: true, paused: false, hasCredential: true, quota: null },
-    { id: "a2", email: "pool", isMain: false, paused: false, hasCredential: true, quota: null },
+    { id: "a1", email: "main", isMain: true, paused: false, priority: 0, hasCredential: true, quota: null },
+    { id: "a2", email: "pool", isMain: false, paused: false, priority: 0, hasCredential: true, quota: null },
   ];
   bulkPausedAccountIds = ["__main__"];
   bulkResponseActiveId = "a2";
@@ -301,11 +362,288 @@ test("subscribing never fabricates a server read", async () => {
   expect(received).toEqual([80]);
 });
 
+test("a confirmed selection-order save updates the row before the reload lands", async () => {
+  accounts = [
+    { id: "a1", email: "main", isMain: true, paused: false, priority: 0, hasCredential: true, quota: null },
+    { id: "a2", email: "pool", isMain: false, paused: false, priority: 0, hasCredential: true, quota: null },
+  ];
+  const seen = await mountController();
+  let releaseReload!: () => void;
+  nextAccountsResponseGate = new Promise<void>(resolve => { releaseReload = resolve; });
+
+  await act(async () => {
+    expect(await seen.current!.setAccountPriority("a2", 2)).toEqual({ ok: true });
+  });
+
+  expect(calls).toContain("PUT codex-auth/accounts/priority");
+  expect(seen.current!.accounts.find(account => account.id === "a2")?.priority).toBe(2);
+  expect(seen.current!.priorityUpdatingId).toBeNull();
+
+  await act(async () => {
+    releaseReload();
+    await new Promise((resolve) => setTimeout(resolve, 30));
+  });
+
+  // The reload confirms the same value rather than reverting it.
+  expect(seen.current!.accounts.find(account => account.id === "a2")?.priority).toBe(2);
+});
+
+test("an accepted selection-order write clears the pin before reconciliation lands", async () => {
+  activePinnedAccountId = "a1";
+  const seen = await mountController();
+  expect(seen.current!.activePinnedId).toBe("a1");
+  let releaseActive!: () => void;
+  nextActiveResponseGate = new Promise<void>(resolve => { releaseActive = resolve; });
+
+  await act(async () => {
+    expect(await seen.current!.setAccountPriority("a1", 2)).toEqual({ ok: true });
+  });
+  expect(seen.current!.activePinnedId).toBeNull();
+
+  await act(async () => {
+    releaseActive();
+    await new Promise((resolve) => setTimeout(resolve, 30));
+  });
+});
+
+test("an order write and a manual switch refuse to overlap in either direction", async () => {
+  // Both PUTs move the pin, in opposite directions, and each applies its edge
+  // optimistically. Response order is not request order, so overlapping them can leave
+  // the client on the inverse of the server's final pin until a reload corrects it.
+  accounts = [
+    { id: "a1", email: "main", isMain: true, paused: false, priority: 0, hasCredential: true, quota: null },
+    { id: "a2", email: "pool", isMain: false, paused: false, priority: 0, hasCredential: true, quota: null },
+  ];
+  const seen = await mountController();
+
+  let releasePriority!: () => void;
+  nextPriorityResponseGate = new Promise<void>(resolve => { releasePriority = resolve; });
+  let priorityResult: unknown;
+  let switchDuringOrder: unknown;
+  await act(async () => {
+    const orderWrite = seen.current!.setAccountPriority("a2", 2).then(r => { priorityResult = r; });
+    switchDuringOrder = await seen.current!.switchAccount("a1");
+    releasePriority();
+    await orderWrite;
+  });
+  await act(async () => { await new Promise((r) => setTimeout(r, 30)); });
+
+  expect(switchDuringOrder).toEqual({ ok: false, reason: "busy" });
+  expect(priorityResult).toEqual({ ok: true });
+
+  let releaseSwitch!: () => void;
+  nextActivePutGate = new Promise<void>(resolve => { releaseSwitch = resolve; });
+  let switchResult: unknown;
+  let orderDuringSwitch: unknown;
+  await act(async () => {
+    const switchWrite = seen.current!.switchAccount("a2").then(r => { switchResult = r; });
+    orderDuringSwitch = await seen.current!.setAccountPriority("a2", 1);
+    releaseSwitch();
+    await switchWrite;
+  });
+  await act(async () => { await new Promise((r) => setTimeout(r, 30)); });
+
+  expect(orderDuringSwitch).toEqual({ ok: false, reason: "busy" });
+  expect(switchResult).toEqual({ ok: true, activeId: "a2" });
+  // The refused order write must not have moved the row either.
+  expect(seen.current!.accounts.find(account => account.id === "a2")?.priority).toBe(2);
+});
+
+test("an accepted manual switch moves the pin before reconciliation lands", async () => {
+  activePinnedAccountId = "a1";
+  const seen = await mountController();
+  let releaseActive!: () => void;
+  nextActiveResponseGate = new Promise<void>(resolve => { releaseActive = resolve; });
+
+  await act(async () => {
+    expect(await seen.current!.switchAccount("a2")).toEqual({ ok: true, activeId: "a2" });
+  });
+  expect(seen.current!.activePinnedId).toBe("a2");
+
+  await act(async () => {
+    releaseActive();
+    await new Promise((resolve) => setTimeout(resolve, 30));
+  });
+});
+
+test("the main sentinel writes through to its distinct account row", async () => {
+  const seen = await mountController();
+
+  await act(async () => {
+    expect(await seen.current!.setAccountPriority("__main__", -1)).toEqual({ ok: true });
+  });
+
+  expect(seen.current!.accounts.find(account => account.isMain)?.id).toBe("a1");
+  expect(seen.current!.accounts.find(account => account.isMain)?.priority).toBe(-1);
+});
+
+test("null resets an account to the default order", async () => {
+  accounts = [{ id: "a1", email: "main", isMain: true, paused: false, priority: 2, hasCredential: true, quota: null }];
+  const seen = await mountController();
+  expect(seen.current!.accounts[0]?.priority).toBe(2);
+
+  await act(async () => {
+    expect(await seen.current!.setAccountPriority("a1", null)).toEqual({ ok: true });
+  });
+
+  expect(seen.current!.accounts[0]?.priority).toBe(0);
+});
+
+test("a rejected save snaps back to the last confirmed order", async () => {
+  accounts = [{ id: "a1", email: "main", isMain: true, paused: false, priority: 1, hasCredential: true, quota: null }];
+  priorityResponseOk = false;
+  const seen = await mountController();
+
+  await act(async () => {
+    expect(await seen.current!.setAccountPriority("a1", -2)).toEqual({ ok: false, reason: "request" });
+  });
+  await act(async () => { await new Promise((r) => setTimeout(r, 30)); });
+
+  expect(seen.current!.accounts[0]?.priority).toBe(1);
+  expect(seen.current!.priorityUpdatingId).toBeNull();
+});
+
+test("an in-flight order save does not block a pause on another account", async () => {
+  accounts = [
+    { id: "a1", email: "main", isMain: true, paused: false, priority: 0, hasCredential: true, quota: null },
+    { id: "a2", email: "pool", isMain: false, paused: false, priority: 0, hasCredential: true, quota: null },
+  ];
+  const seen = await mountController();
+
+  let releasePriority!: () => void;
+  nextPriorityResponseGate = new Promise<void>(resolve => { releasePriority = resolve; });
+
+  let priorityResult: unknown;
+  let pauseResult: unknown;
+  await act(async () => {
+    const priorityWrite = seen.current!.setAccountPriority("a2", 2).then(r => { priorityResult = r; });
+    // With one shared mutation ref this comes back rejected as "busy".
+    pauseResult = await seen.current!.setAccountPaused("a1", true);
+    releasePriority();
+    await priorityWrite;
+  });
+  await act(async () => { await new Promise((r) => setTimeout(r, 30)); });
+
+  expect(pauseResult).toEqual({ ok: true });
+  expect(priorityResult).toEqual({ ok: true });
+  expect(seen.current!.accounts.find(account => account.id === "a1")?.paused).toBe(true);
+  expect(seen.current!.accounts.find(account => account.id === "a2")?.priority).toBe(2);
+});
+
+test("an in-flight pause does not block an order save on another account", async () => {
+  accounts = [
+    { id: "a1", email: "main", isMain: true, paused: false, priority: 0, hasCredential: true, quota: null },
+    { id: "a2", email: "pool", isMain: false, paused: false, priority: 0, hasCredential: true, quota: null },
+  ];
+  const seen = await mountController();
+
+  let releasePause!: () => void;
+  nextPauseResponseGate = new Promise<void>(resolve => { releasePause = resolve; });
+
+  let pauseResult: unknown;
+  let priorityResult: unknown;
+  await act(async () => {
+    const pauseWrite = seen.current!.setAccountPaused("a1", true).then(r => { pauseResult = r; });
+    // The converse of the case above: each write owns its own in-flight ref, so neither
+    // direction can starve the other.
+    priorityResult = await seen.current!.setAccountPriority("a2", 2);
+    releasePause();
+    await pauseWrite;
+  });
+  await act(async () => { await new Promise((r) => setTimeout(r, 30)); });
+
+  expect(priorityResult).toEqual({ ok: true });
+  expect(pauseResult).toEqual({ ok: true });
+  expect(seen.current!.accounts.find(account => account.id === "a1")?.paused).toBe(true);
+  expect(seen.current!.accounts.find(account => account.id === "a2")?.priority).toBe(2);
+});
+
+test("a second order save while one is in flight is rejected as busy", async () => {
+  const seen = await mountController();
+  let releasePriority!: () => void;
+  nextPriorityResponseGate = new Promise<void>(resolve => { releasePriority = resolve; });
+
+  await act(async () => {
+    const first = seen.current!.setAccountPriority("a1", 2);
+    expect(await seen.current!.setAccountPriority("a1", 1)).toEqual({ ok: false, reason: "busy" });
+    releasePriority();
+    expect(await first).toEqual({ ok: true });
+  });
+  await act(async () => { await new Promise((r) => setTimeout(r, 30)); });
+
+  expect(seen.current!.accounts[0]?.priority).toBe(2);
+});
+
+// The controller tracks the pinned ACCOUNT, not /active's `pinned` boolean. That boolean
+// answers whether routing is currently on the pinned account, which goes false the moment
+// round-robin serves a same-tier sibling even though the pin is still suppressing every
+// higher tier — so the badge reads the id and the boolean has no consumer here.
+test("the pinned account id follows /active on each load, ignoring the pinned flag", async () => {
+  const seen = await mountController();
+  expect(seen.current!.activePinnedId).toBeNull();
+
+  activePinnedAccountId = "a1";
+  activePinned = false;
+  await act(async () => { await seen.current!.load(); });
+  expect(seen.current!.activePinnedId).toBe("a1");
+
+  // Releasing the pin clears it again: this is server state, not a local latch.
+  activePinnedAccountId = null;
+  activePinned = true;
+  await act(async () => { await seen.current!.load(); });
+  expect(seen.current!.activePinnedId).toBeNull();
+});
+
+test("an /active payload with no pinned account id reads as no pin", async () => {
+  // An older build's response omits the field entirely; that must not put the string
+  // "undefined" on a card, and must not latch a pin that no longer exists.
+  const seen = await mountController();
+  activePinnedAccountId = "a1";
+  await act(async () => { await seen.current!.load(); });
+  expect(seen.current!.activePinnedId).toBe("a1");
+
+  omitPinnedAccountId = true;
+  await act(async () => { await seen.current!.load(); });
+  expect(seen.current!.activePinnedId).toBeNull();
+});
+
+test("an account payload without a selection order reads as the default", async () => {
+  accounts = [{ id: "a1", email: "main", isMain: true, paused: false, hasCredential: true, quota: null }];
+  const seen = await mountController();
+  expect(seen.current!.accounts[0]?.priority).toBe(0);
+});
+
+test("an order write retires the switch's pending reconciliation", async () => {
+  accounts = [
+    { id: "a1", email: "account-one", isMain: true, priority: 0, hasCredential: true, quota: null },
+    { id: "a2", email: "account-two", isMain: false, priority: 0, hasCredential: true, quota: null },
+  ];
+  const seen = await mountController();
+
+  // The switch is accepted, so the controller holds "a2" until a matching read arrives.
+  await act(async () => { await seen.current!.switchAccount("a2"); });
+  expect(seen.current!.activeId).toBe("a2");
+
+  // Routing has since moved on -- the order write releases the pin that was capping the
+  // tier, so the account the switch named is no longer the one the server reports.
+  activeGetId = "a1";
+  await act(async () => { await seen.current!.setAccountPriority("a1", 2); });
+  await act(async () => { await new Promise((r) => setTimeout(r, 30)); });
+
+  // Every read after the switch disagrees with the pending marker, so leaving it armed
+  // strands activeId on "a2" for the rest of the session: nothing else retires it.
+  expect(seen.current!.activeId).toBe("a1");
+
+  // And it stays reconciled -- the marker is gone, not merely satisfied once.
+  await act(async () => { await seen.current!.load(); });
+  expect(seen.current!.activeId).toBe("a1");
+});
+
 test("a mutation updates the one shared controller state", async () => {
   const seen = await mountController();
   accounts = [
-    { id: "a1", email: "account-one", isMain: true, hasCredential: true, quota: null },
-    { id: "a2", email: "account-two", isMain: false, hasCredential: true, quota: null },
+    { id: "a1", email: "account-one", isMain: true, priority: 0, hasCredential: true, quota: null },
+    { id: "a2", email: "account-two", isMain: false, priority: 0, hasCredential: true, quota: null },
   ];
 
   await act(async () => { await seen.current!.switchAccount("a2"); });
diff --git a/gui/tests/codex-account-pool-controller.test.ts b/gui/tests/codex-account-pool-controller.test.ts
index ae2f65722..94ed34163 100644
--- a/gui/tests/codex-account-pool-controller.test.ts
+++ b/gui/tests/codex-account-pool-controller.test.ts
@@ -14,8 +14,10 @@ test("the controller is the single data owner and exposes the agreed contract",
 
   // Data layer (Q6): list / active / loading / switching plus the mutating actions.
   for (const member of [
-    "accounts", "activeId", "loadState", "switchingId", "pauseUpdatingId", "pausingExhausted", "activeNeedsReauth",
-    "load", "switchAccount", "setAccountPaused", "pauseExhaustedAccounts", "saveAlias", "removeAccount", "syncAfterAccountAdded",
+    "accounts", "activeId", "loadState", "switchingId", "pauseUpdatingId", "priorityUpdatingId",
+    "pausingExhausted", "activeNeedsReauth", "activePinnedId",
+    "load", "switchAccount", "setAccountPaused", "setAccountPriority", "pauseExhaustedAccounts",
+    "saveAlias", "removeAccount", "syncAfterAccountAdded",
   ]) {
     expect(hook).toContain(member);
   }
@@ -43,6 +45,60 @@ test("main and added account cards expose the same persisted pause control", asy
   expect(addedCards).toContain('t(a.paused ? "codexAuth.resume" : "codexAuth.pause")');
 });
 
+test("both cards expose the selection-order control, and pin writes cannot overlap", async () => {
+  const pool = await read("../src/components/CodexAccountPool.tsx");
+  const mainCard = await read("../src/components/codex-account-pool-main-card.tsx");
+  const addedCards = await read("../src/components/codex-account-pool-cards.tsx");
+  const hook = await read("../src/hooks/useCodexAccountPool.ts");
+
+  expect(pool).toContain("controller.setAccountPriority(account.id, priority)");
+  for (const card of [mainCard, addedCards]) {
+    expect(card).toContain("<AccountPriorityControl");
+    expect(card).toContain("<AccountPriorityBadge");
+  }
+  // The main card's synthesized entry has to carry the order, or saving from that card
+  // would post the default over whatever the account currently has.
+  expect(mainCard).toContain("priority: main?.priority ?? 0");
+
+  // A hand-picked account says so on its OWN card, not on whichever card routing landed
+  // on: under round-robin the pin caps the tier while the cursor moves inside it, so an
+  // active-card badge disappeared while the pin was still suppressing the higher tiers.
+  // The paused guard stays — pausing releases the pin, so a pin naming an excluded account
+  // is a stale read that must not be rendered.
+  // Asserted as the gate, not as exact markup: the rendered outcome is covered behaviourally
+  // in codex-account-pool-pinned-badge.test.tsx, so pinning the JSX here only adds a second
+  // place to edit when the span's classes change.
+  expect(mainCard).toMatch(/pinnedId === "__main__" && !main\?\.paused/);
+  expect(addedCards).toMatch(/a\.id === pinnedId && !a\.paused/);
+  for (const card of [mainCard, addedCards]) expect(card).toContain('t("codexAuth.pinned")');
+  for (const card of [mainCard, addedCards]) expect(card).toContain('t("codexAuth.pinnedHint")');
+  expect(pool).toContain("pinnedId={activePinnedId}");
+
+  expect(hook).toContain("/api/codex-auth/accounts/priority");
+  // Sharing pauseMutationRef would make a pause toggle and an order change on two
+  // different accounts reject each other for no reason. The manual switch is the one
+  // deliberate exception: it writes the same pin an order write clears, so overlapping
+  // them lets the client settle on the inverse of the server's final pin. Cross-gated
+  // in both directions, since either can be the newer statement.
+  const priorityMutation = hook.slice(
+    hook.indexOf("const setAccountPriority"),
+    hook.indexOf("const pauseExhaustedAccounts"),
+  );
+  expect(priorityMutation).toMatch(/if \(priorityMutationRef\.current \|\| switchingRef\.current\) return/);
+  expect(priorityMutation).not.toContain("pauseMutationRef");
+
+  const switchMutation = hook.slice(hook.indexOf("const switchAccount"), hook.indexOf("const saveAlias"));
+  expect(switchMutation).toMatch(/if \(switchingRef\.current \|\| priorityMutationRef\.current\) return/);
+
+  // A refused mutation returns "busy", which both call sites drop without a toast, so
+  // each control must be unavailable while the other is in flight rather than silently
+  // ineffective.
+  for (const card of [mainCard, addedCards]) {
+    expect(card).toContain("disabled={priorityUpdatingId !== null || switchingId !== null}");
+  }
+  expect(pool).toContain("orderBusy={priorityUpdatingId !== null}");
+});
+
 test("the pool header exposes one bulk action backed by the atomic endpoint", async () => {
   const pool = await read("../src/components/CodexAccountPool.tsx");
   const mainCard = await read("../src/components/codex-account-pool-main-card.tsx");
diff --git a/gui/tests/codex-account-pool-pinned-badge.test.tsx b/gui/tests/codex-account-pool-pinned-badge.test.tsx
new file mode 100644
index 000000000..f31d5e419
--- /dev/null
+++ b/gui/tests/codex-account-pool-pinned-badge.test.tsx
@@ -0,0 +1,201 @@
+import { afterEach, beforeEach, expect, test } from "bun:test";
+import { Window } from "happy-dom";
+import { act } from "react";
+import type { Root } from "react-dom/client";
+import CodexAccountPool from "../src/components/CodexAccountPool";
+import type { CodexAccountEntry, CodexAccountPoolController } from "../src/hooks/useCodexAccountPool";
+import { en } from "../src/i18n/en";
+import { LanguageProvider } from "../src/i18n/provider";
+
+/**
+ * The PINNED badge is a rendering rule, not a string: it belongs to the one card carrying
+ * the pin — the account the operator chose — which is not always the card routing currently
+ * sits on. Under round-robin and fill-first the pin caps selection at its own tier while the
+ * cursor moves inside that tier, so keying the badge off the active card made it blink out
+ * on a sibling's turn while the pin was still suppressing every higher tier. The sibling
+ * .ts suite greps the JSX for it, which a markup refactor breaks and a logic inversion
+ * survives, so the rule is pinned here against the mounted DOM instead.
+ */
+
+const globals = ["document", "window", "navigator", "localStorage", "IS_REACT_ACT_ENVIRONMENT"] as const;
+let previous: Record<(typeof globals)[number], unknown>;
+let win: Window;
+let host: HTMLElement;
+let root: Root | null = null;
+let originalFetch: typeof globalThis.fetch;
+
+const account: CodexAccountEntry = {
+  id: "pool-1",
+  email: "pool@example.test",
+  isMain: false,
+  paused: false,
+  priority: 0,
+  hasCredential: true,
+  quota: null,
+};
+
+const mainAccount: CodexAccountEntry = {
+  id: "main",
+  email: "main@example.test",
+  isMain: true,
+  paused: false,
+  priority: 0,
+  hasCredential: true,
+  quota: null,
+};
+
+function makeController(overrides: Partial<CodexAccountPoolController> = {}): CodexAccountPoolController {
+  return {
+    accounts: [mainAccount, account],
+    activeId: null,
+    loadState: "ready",
+    switchingId: null,
+    pauseUpdatingId: null,
+    priorityUpdatingId: null,
+    pausingExhausted: false,
+    activeNeedsReauth: false,
+    activePinnedId: null,
+    load: async () => true,
+    switchAccount: async () => ({ ok: true, activeId: null }),
+    setAccountPaused: async () => ({ ok: true }),
+    setAccountPriority: async () => ({ ok: true }),
+    pauseExhaustedAccounts: async () => ({ ok: true, pausedCount: 0 }),
+    saveAlias: async () => ({ ok: true }),
+    removeAccount: async () => ({ ok: true }),
+    syncAfterAccountAdded: async () => ({ ok: true }),
+    pauseRefresh: () => ({ __brand: "codex-pool-pause" }) as never,
+    resumeRefresh: () => {},
+    subscribeLoadObserver: () => () => {},
+    readLastThreshold: () => undefined,
+    ...overrides,
+  };
+}
+
+beforeEach(() => {
+  previous = Object.fromEntries(globals.map((k) => [k, Reflect.get(globalThis, k)])) as typeof previous;
+  win = new Window({ url: "http://localhost/" });
+  Object.defineProperty(win.navigator, "language", { configurable: true, value: "en-US" });
+  Object.defineProperties(globalThis, {
+    document: { configurable: true, value: win.document },
+    window: { configurable: true, value: win },
+    navigator: { configurable: true, value: win.navigator },
+    localStorage: { configurable: true, value: win.localStorage },
+  });
+  (globalThis as typeof globalThis & { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT = true;
+
+  originalFetch = globalThis.fetch;
+  Object.defineProperty(globalThis, "fetch", {
+    configurable: true,
+    value: async () => Response.json({ accounts: [], activeCodexAccountId: null, autoSwitchThreshold: 80 }),
+  });
+
+  host = win.document.createElement("div") as unknown as HTMLElement;
+  win.document.body.appendChild(host as never);
+});
+
+afterEach(async () => {
+  if (root) {
+    const current = root;
+    await act(async () => { current.unmount(); });
+    root = null;
+  }
+  await act(async () => { await new Promise((r) => setTimeout(r, 0)); });
+  for (const key of globals) {
+    Object.defineProperty(globalThis, key, { configurable: true, value: previous[key] });
+  }
+  Object.defineProperty(globalThis, "fetch", { configurable: true, value: originalFetch });
+  await win.happyDOM?.close?.();
+});
+
+async function mountPool(controller: CodexAccountPoolController) {
+  const { createRoot } = await import("react-dom/client");
+  await act(async () => {
+    root = createRoot(host);
+    root.render(
+      <LanguageProvider>
+        <CodexAccountPool apiBase="" controller={controller} />
+      </LanguageProvider>,
+    );
+  });
+  await act(async () => { await new Promise((r) => setTimeout(r, 40)); });
+}
+
+/** Each card is found by the email it prints, so neither card needs a test-only hook. */
+function cardFor(email: string): Element {
+  const card = [...host.querySelectorAll(".card")].find((el) => (el.textContent ?? "").includes(email));
+  expect(card).toBeTruthy();
+  return card!;
+}
+
+function hasPinnedBadge(scope: ParentNode): boolean {
+  return [...scope.querySelectorAll(".badge")].some((el) => (el.textContent ?? "").trim() === en["codexAuth.pinned"]);
+}
+
+function hasPinnedHint(scope: ParentNode): boolean {
+  return [...scope.querySelectorAll(".card-sub")].some((el) => (el.textContent ?? "").trim() === en["codexAuth.pinnedHint"]);
+}
+
+test("a pinned pool account says so, and only on its own card", async () => {
+  await mountPool(makeController({ activeId: "pool-1", activePinnedId: "pool-1" }));
+
+  const pooled = cardFor("pool@example.test");
+  expect(hasPinnedBadge(pooled)).toBe(true);
+  expect(hasPinnedHint(pooled)).toBe(true);
+
+  const main = cardFor("main@example.test");
+  expect(hasPinnedBadge(main)).toBe(false);
+  expect(hasPinnedHint(main)).toBe(false);
+});
+
+test("a pinned app login says so, and only on its own card", async () => {
+  await mountPool(makeController({ activeId: null, activePinnedId: "__main__" }));
+
+  const main = cardFor("main@example.test");
+  expect(hasPinnedBadge(main)).toBe(true);
+  expect(hasPinnedHint(main)).toBe(true);
+
+  const pooled = cardFor("pool@example.test");
+  expect(hasPinnedBadge(pooled)).toBe(false);
+  expect(hasPinnedHint(pooled)).toBe(false);
+});
+
+// The case that made the badge worth keying off the pinned id: the pin caps the tier, the
+// strategy cursor moves to a same-tier sibling, and the operator's choice is still the
+// reason every higher tier is being skipped. A badge that followed the active card would
+// vanish here and give no clue why the higher-order account is idle.
+test("the badge stays on the pinned account when rotation moves off it", async () => {
+  const sibling: CodexAccountEntry = { ...account, id: "pool-2", email: "sibling@example.test" };
+  await mountPool(makeController({
+    accounts: [mainAccount, account, sibling],
+    activeId: "pool-2",
+    activePinnedId: "pool-1",
+  }));
+
+  const pinned = cardFor("pool@example.test");
+  expect(hasPinnedBadge(pinned)).toBe(true);
+  expect(hasPinnedHint(pinned)).toBe(true);
+
+  const active = cardFor("sibling@example.test");
+  expect(hasPinnedBadge(active)).toBe(false);
+  expect(hasPinnedHint(active)).toBe(false);
+});
+
+test("an account rotation picked carries no pin", async () => {
+  await mountPool(makeController({ activeId: "pool-1", activePinnedId: null }));
+
+  expect(hasPinnedBadge(host)).toBe(false);
+  expect(hasPinnedHint(host)).toBe(false);
+});
+
+test("a paused account is never shown as pinned", async () => {
+  // Pausing releases the pin server-side, so a pin that still names an excluded account is
+  // a stale read. Routing cannot be sitting on it, so the card must not claim otherwise.
+  await mountPool(makeController({
+    accounts: [mainAccount, { ...account, paused: true }],
+    activeId: "pool-1",
+    activePinnedId: "pool-1",
+  }));
+
+  expect(hasPinnedBadge(host)).toBe(false);
+  expect(hasPinnedHint(host)).toBe(false);
+});
diff --git a/gui/tests/codex-account-pool-toast-tone.test.tsx b/gui/tests/codex-account-pool-toast-tone.test.tsx
index 45ec9fc08..05e9c70d9 100644
--- a/gui/tests/codex-account-pool-toast-tone.test.tsx
+++ b/gui/tests/codex-account-pool-toast-tone.test.tsx
@@ -2,6 +2,7 @@ import { afterEach, beforeEach, expect, test } from "bun:test";
 import { Window } from "happy-dom";
 import { act } from "react";
 import type { Root } from "react-dom/client";
+import { formatAccountPriority } from "../src/account-priority";
 import CodexAccountPool from "../src/components/CodexAccountPool";
 import type { CodexAccountEntry, CodexAccountPoolController } from "../src/hooks/useCodexAccountPool";
 import { LanguageProvider } from "../src/i18n/provider";
@@ -23,6 +24,7 @@ const account: CodexAccountEntry = {
   email: "pool@example.test",
   isMain: false,
   paused: false,
+  priority: 0,
   hasCredential: true,
   quota: { resetCredits: 2, updatedAt: 1 },
 };
@@ -30,18 +32,21 @@ const account: CodexAccountEntry = {
 function makeController(overrides: Partial<CodexAccountPoolController> = {}): CodexAccountPoolController {
   return {
     accounts: [
-      { id: "main", email: "main@example.test", isMain: true, paused: false, hasCredential: true, quota: null },
+      { id: "main", email: "main@example.test", isMain: true, paused: false, priority: 0, hasCredential: true, quota: null },
       account,
     ],
     activeId: null,
     loadState: "ready",
     switchingId: null,
     pauseUpdatingId: null,
+    priorityUpdatingId: null,
     pausingExhausted: false,
     activeNeedsReauth: false,
+    activePinnedId: null,
     load: async () => true,
     switchAccount: async () => ({ ok: true, activeId: null }),
     setAccountPaused: async () => ({ ok: true }),
+    setAccountPriority: async () => ({ ok: true }),
     pauseExhaustedAccounts: async () => ({ ok: true, pausedCount: 0 }),
     saveAlias: async () => ({ ok: true }),
     removeAccount: async () => ({ ok: false, reason: "request" }),
@@ -119,6 +124,84 @@ async function mountPool(controller: CodexAccountPoolController) {
   await act(async () => { await new Promise((r) => setTimeout(r, 40)); });
 }
 
+async function chooseOrder(selectId: string, value: string): Promise<void> {
+  const trigger = host.querySelector(`#${selectId}`) as HTMLButtonElement | null;
+  expect(trigger).toBeTruthy();
+  await act(async () => { trigger!.click(); });
+
+  // The menu is portaled to document.body, so the options are not under the mount node.
+  // Every label ends in the signed number, which is what identifies the order being picked.
+  const wanted = `(${formatAccountPriority(Number(value))})`;
+  const option = [...win.document.querySelectorAll<HTMLButtonElement>('[role="option"]')]
+    .find((candidate) => candidate.textContent?.endsWith(wanted));
+  expect(option).toBeTruthy();
+  await act(async () => {
+    option!.click();
+    await new Promise((r) => setTimeout(r, 20));
+  });
+}
+
+test("a saved selection order reports in the ok tone", async () => {
+  const saved: { id: string; priority: number | null }[] = [];
+  await mountPool(makeController({
+    setAccountPriority: async (id, priority) => {
+      saved.push({ id, priority });
+      return { ok: true };
+    },
+  }));
+
+  await chooseOrder("codex-account-priority-pool-1", "2");
+
+  expect(saved).toEqual([{ id: "pool-1", priority: 2 }]);
+  expect(host.querySelector(".notice-ok")?.textContent).toContain("pool@example.test");
+  expect(host.querySelector(".notice-err")).toBeNull();
+});
+
+test("a rejected selection order reports in the error tone", async () => {
+  await mountPool(makeController({
+    setAccountPriority: async () => ({ ok: false, reason: "request" }),
+  }));
+
+  await chooseOrder("codex-account-priority-__main__", "-1");
+
+  const error = host.querySelector(".notice-err");
+  expect(error).toBeTruthy();
+  expect(error?.textContent).toContain("main@example.test");
+  expect(host.querySelector(".notice-ok")).toBeNull();
+});
+
+test("a busy selection order write shows no toast at all", async () => {
+  await mountPool(makeController({
+    setAccountPriority: async () => ({ ok: false, reason: "busy" }),
+  }));
+
+  await chooseOrder("codex-account-priority-pool-1", "-2");
+
+  expect(host.querySelector(".notice-err")).toBeNull();
+  expect(host.querySelector(".notice-ok")).toBeNull();
+});
+
+test("picking the order an account already has writes nothing", async () => {
+  const saved: { id: string; priority: number | null }[] = [];
+  await mountPool(makeController({
+    setAccountPriority: async (id, priority) => {
+      saved.push({ id, priority });
+      return { ok: true };
+    },
+  }));
+
+  // pool-1 is already Normal (0). Select fires onChange for the clicked option whether or
+  // not it was the selected one, and commits the highlighted option on Tab-out of an open
+  // menu, so this is reachable by an ordinary mis-click. It must not reach the server: the
+  // route releases the pin on every accepted write, so a no-op order pick would silently
+  // unpin the account the operator chose, reporting success while doing it.
+  await chooseOrder("codex-account-priority-pool-1", "0");
+
+  expect(saved).toEqual([]);
+  expect(host.querySelector(".notice-ok")).toBeNull();
+  expect(host.querySelector(".notice-err")).toBeNull();
+});
+
 test("successful redeem clears a stale error toast tone", async () => {
   await mountPool(makeController());
 
diff --git a/package.json b/package.json
index f02953c8f..735df8a60 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@bitkyc08/opencodex",
-  "version": "2.7.41",
+  "version": "2.7.42",
   "description": "Universal provider proxy for OpenAI Codex & Claude Code — use any LLM with Codex CLI/App/SDK and Claude Code",
   "type": "module",
   "main": "./bin/package-main.mjs",
diff --git a/src/cli/account-api.ts b/src/cli/account-api.ts
index 03708512d..df0e16859 100644
--- a/src/cli/account-api.ts
+++ b/src/cli/account-api.ts
@@ -21,6 +21,8 @@ export interface AccountRow {
   masked?: string;
   active: boolean;
   needsReauth?: boolean;
+  /** Codex pool selection order, higher used earlier. Absent where ordering does not apply. */
+  priority?: number;
   quota?: CodexQuotaDto | null;
 }
 
@@ -148,6 +150,7 @@ interface CodexAccountDto {
   plan?: string;
   isMain?: boolean;
   needsReauth?: boolean;
+  priority?: number;
   quota?: CodexQuotaDto | null;
 }
 
@@ -195,6 +198,7 @@ export async function fetchCodexRows(
     plan: a.plan,
     active: a.id === activeId,
     needsReauth: a.needsReauth,
+    priority: typeof a.priority === "number" ? a.priority : 0,
     ...(forceRefresh ? { quota: projectQuota(a.quota) } : {}),
   }));
   return { rows, activeId, autoSwitchThreshold, status: 200 };
diff --git a/src/cli/account-extended.ts b/src/cli/account-extended.ts
index 500d407be..014eb9b34 100644
--- a/src/cli/account-extended.ts
+++ b/src/cli/account-extended.ts
@@ -1,4 +1,10 @@
 import { loadConfig } from "../config";
+import {
+  MAX_ACCOUNT_PRIORITY,
+  MIN_ACCOUNT_PRIORITY,
+  normalizeAccountPriority,
+  parseAccountPriority,
+} from "../codex/pool-rotation";
 import {
   apiError,
   apiJson,
@@ -18,6 +24,7 @@ const EXTENDED_USAGE = `Usage:
   ocx account refresh <provider> [--json]
   ocx account auto-switch <provider> <on|off|status|threshold <0-100>> [--json]
   ocx account alias <provider> <id|main> <display-name|-> [--json]
+  ocx account priority <provider> <id|main> [<-100..100|first|earlier|normal|later|last|reset>] [--json]
   ocx account remove <provider> <id|main> --yes [--json]
   ocx account clear-cooldown <provider> <id|main> [--json]
   ocx account add-key <provider> [--label <label>] [--json]`;
@@ -316,6 +323,111 @@ export async function cmdClearCooldown(args: string[], deps: AccountDeps): Promi
   return 0;
 }
 
+/**
+ * Named selection orders. The words convey sequence rather than rank because the
+ * pool moves down the list only when everything above it is drained — "high
+ * priority" would suggest the account gets more traffic, which is not what
+ * ordering does.
+ */
+const PRIORITY_PRESETS: Record<string, number> = {
+  first: 2,
+  earlier: 1,
+  normal: 0,
+  later: -1,
+  last: -2,
+};
+
+function priorityPresetName(priority: number): string | null {
+  return Object.entries(PRIORITY_PRESETS).find(([, value]) => value === priority)?.[0] ?? null;
+}
+
+function formatPriority(priority: number): string {
+  const preset = priorityPresetName(priority);
+  const signed = priority > 0 ? `+${priority}` : String(priority);
+  return preset ? `${signed} (${preset})` : signed;
+}
+
+/** `null` = reset to the default; `undefined` = unparseable. */
+function parsePriorityArgument(raw: string): number | null | undefined {
+  const word = raw.trim().toLowerCase();
+  if (word === "reset") return null;
+  // Own keys only: `in` also matches "constructor", "__proto__", and friends.
+  if (Object.hasOwn(PRIORITY_PRESETS, word)) return PRIORITY_PRESETS[word];
+  // The regex only rules out shapes Number() would coerce ("1e2", " 1 ", ""); the range
+  // itself comes from the core parser so the CLI cannot drift from what the API accepts.
+  if (!/^[+-]?\d+$/.test(word)) return undefined;
+  return parseAccountPriority(Number(word)) ?? undefined;
+}
+
+export async function cmdPriority(args: string[], deps: AccountDeps): Promise<number> {
+  const wantsJson = flag(args, "--json");
+  const name = args.shift();
+  const requestedId = args.shift();
+  const requestedPriority = args.shift();
+  if (!name || !requestedId || args.length) return usage();
+  const classified = configAndType(deps, name);
+  if ("error" in classified) return usage(`Error: ${classified.error}`);
+  if (classified.type !== "codex") {
+    return usage("Error: selection order only applies to the openai Codex account pool");
+  }
+  const id = requestedId === "main" ? MAIN_ID : requestedId;
+
+  // Validate before touching the network so a typo never reaches the proxy.
+  let priority: number | null | undefined;
+  if (requestedPriority !== undefined) {
+    priority = parsePriorityArgument(requestedPriority);
+    if (priority === undefined) {
+      return usage(`Error: selection order must be an integer ${MIN_ACCOUNT_PRIORITY}..${MAX_ACCOUNT_PRIORITY}, one of ${Object.keys(PRIORITY_PRESETS).join("/")}, or reset`);
+    }
+  }
+
+  const baseUrl = await resolveBaseUrl(deps);
+  if (!baseUrl) return proxyUnreachable();
+
+  // No value means "show" — a read must not rewrite what it is reporting.
+  if (priority === undefined) {
+    const result = await fetchCodexRows(deps, baseUrl);
+    const failed = familyFailure(result, `failed to read ${name} accounts`);
+    if (failed !== null) return failed;
+    const row = result.rows.find(candidate => candidate.id === id);
+    if (!row) return usage(`Error: no ${name} account ${requestedId}`);
+    const current = normalizeAccountPriority(row.priority);
+    if (wantsJson) {
+      console.log(JSON.stringify(
+        { ok: true, provider: name, id, priority: current, preset: priorityPresetName(current) },
+        null,
+        2,
+      ));
+    } else {
+      console.log(`${name}: ${requestedId} selection order is ${formatPriority(current)}`);
+    }
+    return 0;
+  }
+
+  const response = await apiJson(deps, baseUrl, "PUT", "/api/codex-auth/accounts/priority", { id, priority });
+  if (response.status === 0) return proxyUnreachable();
+  if (response.status !== 200) return apiError(response.json, `failed to set selection order for ${requestedId}`);
+  const applied = typeof response.json.priority === "number" ? response.json.priority : (priority ?? 0);
+  if (wantsJson) {
+    console.log(JSON.stringify(
+      { ok: true, provider: name, id, priority: applied, preset: priorityPresetName(applied) },
+      null,
+      2,
+    ));
+  } else {
+    console.log(`${name}: ${requestedId} selection order is now ${formatPriority(applied)}`);
+  }
+  // Not cmdUse's note: re-ordering takes effect on the next unbound request rather than
+  // only on new sessions, because preemption moves those requests up immediately.
+  console.error("Takes effect from the next unbound request; running threads keep their current account until drained.");
+  // The release is not optional and not conditional on the value changing, so it has to be
+  // stated: this route is the only way to clear a pin without immediately setting another,
+  // which means a write storing the order an account already had still releases it. Without
+  // this line that is a silent side effect of a command that looks purely declarative.
+  console.error('Also releases any manual "use this account now" pin, on any account.');
+  return 0;
+}
+
 export async function cmdAlias(args: string[], deps: AccountDeps): Promise<number> {
   const wantsJson = flag(args, "--json");
   const name = args.shift();
diff --git a/src/cli/account.ts b/src/cli/account.ts
index 253cf6b3a..2f04c467b 100644
--- a/src/cli/account.ts
+++ b/src/cli/account.ts
@@ -2,7 +2,7 @@
 import { loadConfig } from "../config";
 import { providerCodexAccountMode } from "../providers/registry";
 import type { OcxConfig } from "../types";
-import { cmdAddKey, cmdAlias, cmdAutoSwitch, cmdClearCooldown, cmdRefresh, cmdRemove } from "./account-extended";
+import { cmdAddKey, cmdAlias, cmdAutoSwitch, cmdClearCooldown, cmdPriority, cmdRefresh, cmdRemove } from "./account-extended";
 import { apiError, apiJson, classifyAccount, fetchRows, proxyUnreachable, resolveBaseUrl, type AccountDeps, type AccountRow, type AccountType, type ApiResult }
   from "./account-api";
 
@@ -22,6 +22,7 @@ const ACCOUNT_USAGE = `Usage:
   ocx account refresh <provider> [--json]
   ocx account auto-switch <provider> <on|off|status|threshold <0-100>> [--json]
   ocx account alias <provider> <account-or-key-id> <display-name|-> [--json]
+  ocx account priority <provider> <account-id|main> [<-100..100|first|earlier|normal|later|last|reset>] [--json]
   ocx account remove <provider> <account-or-key-id|main> --yes [--json]
   ocx account clear-cooldown <provider> <account-id|main> [--json]
   ocx account add-key <provider> [--label <label>] [--json]
@@ -66,11 +67,24 @@ function statusText(row: AccountRow): string {
   return parts.join(" ");
 }
 
+/** Signed so the sort direction reads off the column; "-" where ordering does not apply. */
+function priorityText(row: AccountRow): string {
+  if (row.priority === undefined) return "-";
+  return row.priority > 0 ? `+${row.priority}` : String(row.priority);
+}
+
 export function formatAccountTable(rows: AccountRow[]): string {
-  const header = ["PROVIDER", "TYPE", "ID", "PLAN/LABEL", "STATUS"];
+  const header = ["PROVIDER", "TYPE", "ID", "PLAN/LABEL", "PRIORITY", "STATUS"];
   const data = rows.map(r => {
     const keyLabel = r.masked && r.label !== r.masked ? `${r.masked} (${r.label})` : r.masked;
-    return [r.provider, r.type, displayId(r.id), r.type === "api-key" ? keyLabel ?? "-" : r.label ?? "-", statusText(r)];
+    return [
+      r.provider,
+      r.type,
+      displayId(r.id),
+      r.type === "api-key" ? keyLabel ?? "-" : r.label ?? "-",
+      priorityText(r),
+      statusText(r),
+    ];
   });
   const widths = header.map((h, i) => Math.max(h.length, ...data.map(d => d[i]!.length)));
   const line = (cols: string[]) => cols.map((c, i) => c.padEnd(widths[i]!)).join("  ").trimEnd();
@@ -243,7 +257,7 @@ async function cmdUse(rest: string[], deps: AccountDeps): Promise<number> {
   if (wantsJson) console.log(JSON.stringify({ ok: true, provider: name, type: c.type, activeId }, null, 2));
   else console.log(`${name}: active ${c.type === "api-key" ? "key" : "account"} is now ${displayId(activeId)}`);
   if (c.type === "codex") {
-    console.error("Applies to new Codex sessions; running threads keep their current account.");
+    console.error("Takes effect immediately; running threads move on their next request, and in-flight requests keep the account they captured.");
     const active = await apiJson(deps, baseUrl, "GET", "/api/codex-auth/active");
     if (active.status === 200 && typeof active.json.autoSwitchThreshold === "number" && active.json.autoSwitchThreshold > 0) {
       console.error(`Note: auto-switch (threshold ${active.json.autoSwitchThreshold}%) may override this pin.`);
@@ -261,6 +275,7 @@ export async function cmdAccount(args: string[], deps: AccountDeps = {}): Promis
     if (sub === "refresh") return await cmdRefresh(rest, deps);
     if (sub === "auto-switch") return await cmdAutoSwitch(rest, deps);
     if (sub === "alias" || sub === "rename") return await cmdAlias(rest, deps);
+    if (sub === "priority") return await cmdPriority(rest, deps);
     if (sub === "remove") return await cmdRemove(rest, deps);
     if (sub === "clear-cooldown") return await cmdClearCooldown(rest, deps);
     if (sub === "add-key") return await cmdAddKey(rest, deps);
diff --git a/src/cli/config-command.ts b/src/cli/config-command.ts
index f90cfec5b..6df1d0aaf 100644
--- a/src/cli/config-command.ts
+++ b/src/cli/config-command.ts
@@ -1,4 +1,5 @@
 import { readFileSync, writeFileSync } from "node:fs";
+import { clearCodexAccountPin } from "../codex/account-priority";
 import { getConfigPath, readConfigDiagnostics, saveConfig, validateConfigCandidate } from "../config";
 import type { OcxConfig } from "../types";
 import { CliUsageError, printData, rejectArgs, runCliAction, takeFlag } from "./runtime-api";
@@ -102,6 +103,14 @@ export async function handleConfigCommand(argv: string[]): Promise<number> {
       setPath(candidate, path, raw === undefined ? undefined : parseValue(raw), action === "unset");
       const config = validate(candidate);
       const savedValue = action === "unset" ? null : getPath(config, path);
+      // Setting the order here is the operator restating it, exactly as through
+      // `ocx account priority` or the management route, so it releases the manual pin
+      // for the same reason those do: a pin made before any order existed would
+      // otherwise outrank every order set afterwards, capping the pool at the pinned
+      // account's tier with nothing on any surface explaining why. `import` is
+      // deliberately not covered — that file supplies its own pin, so there is no
+      // stale one to release.
+      if (pathSegments(path)[0] === "codexAccountPriorities") clearCodexAccountPin(config);
       saveConfig(config);
       printData({ ok: true, path, value: redact(savedValue, path.split(".").at(-1)) }, wantsJson,
         [`${action === "unset" ? "Unset" : "Set"} ${path}.`]);
diff --git a/src/cli/help.ts b/src/cli/help.ts
index 71850d375..d2b98203e 100644
--- a/src/cli/help.ts
+++ b/src/cli/help.ts
@@ -110,7 +110,7 @@ const helpEntries: Record<string, HelpEntry> = {
     ],
   },
   account: {
-    usage: "ocx account <list|current|use|refresh|auto-switch|login|reauth|code|cancel|remove|add-key|reset-credits> ...",
+    usage: "ocx account <list|current|use|refresh|auto-switch|priority|login|reauth|code|cancel|remove|add-key|reset-credits> ...",
     summary: "List and switch provider accounts and API-key pools (GUI parity).",
     details: [
       "list [provider]     Codex account pool, OAuth accounts and API keys (identifiers shown masked as the API returns them).",
@@ -118,11 +118,13 @@ const helpEntries: Record<string, HelpEntry> = {
       "use <provider> <id> Switch the active credential; 'main' selects the Codex App login.",
       "refresh <provider>  Force-refresh Codex or provider quota reports.",
       "auto-switch <provider> <on|off|status|threshold N>  Control the Codex pool threshold.",
+      "priority <provider> <id|main> [first|earlier|normal|later|last|-100..100|reset]  Selection order; omit the value to read it.",
       "remove <provider> <id> --yes  Remove a stored account or key after an existence check.",
       "add-key <provider> [--label <label>]  Add a key read only from piped stdin.",
       "login/reauth/code/cancel  Run browser or manual-code auth from a headless shell.",
       "reset-credits <id|main> [--consume --yes]  Inspect or consume Codex reset credits.",
-      "Codex pool switches apply to new sessions; running threads keep their account.",
+      "Switching the active account takes effect immediately; running threads move on their next request, and in-flight requests keep the account they captured.",
+      "A selection-order change applies from the next unbound request and never moves a bound thread.",
     ],
   },
   models: {
diff --git a/src/codex/account-lifecycle.ts b/src/codex/account-lifecycle.ts
index 35831af55..34bfa7c42 100644
--- a/src/codex/account-lifecycle.ts
+++ b/src/codex/account-lifecycle.ts
@@ -7,6 +7,7 @@ import { clearCodexUpstreamHealthForAccount, clearThreadAccountMapForAccount } f
 import { invalidateCodexWebSocketsForAccount } from "./websocket-registry";
 import { clearMainAccountInfoCache } from "./main-account-cache";
 import { forgetCodexAccountPause } from "./account-pause";
+import { clearCodexAccountPin, forgetCodexAccountPriority } from "./account-priority";
 import type { OcxConfig } from "../types";
 
 let observedMainChatgptAccountId: string | undefined;
@@ -49,6 +50,8 @@ export function deleteCodexAccount(runtimeConfig: OcxConfig, accountId: string):
   runtimeConfig.codexAccounts = (runtimeConfig.codexAccounts ?? [])
     .filter(account => account.isMain || account.id !== accountId);
   forgetCodexAccountPause(runtimeConfig, accountId);
+  forgetCodexAccountPriority(runtimeConfig, accountId);
+  clearCodexAccountPin(runtimeConfig, accountId);
   if (runtimeConfig.activeCodexAccountId === accountId) runtimeConfig.activeCodexAccountId = undefined;
   purgeCodexAccountRuntimeState(accountId);
   invalidateCodexWebSocketsForAccount(accountId);
diff --git a/src/codex/account-priority.ts b/src/codex/account-priority.ts
new file mode 100644
index 000000000..0bac71ab8
--- /dev/null
+++ b/src/codex/account-priority.ts
@@ -0,0 +1,83 @@
+import { isValidCodexAccountId, MAIN_CODEX_ACCOUNT_ID } from "./account-id";
+import { DEFAULT_ACCOUNT_PRIORITY, normalizeAccountPriority } from "./pool-rotation";
+import type { OcxConfig } from "../types";
+
+/**
+ * Which ids may carry a selection order: any pool account, plus the synthetic
+ * `__main__` Desktop login. Owned here rather than by the config schema because
+ * every writer needs it — the schema rejects a bad key on load, but the management
+ * API has to reject one before `setCodexAccountPriority` persists it as an own
+ * property that the schema would then reject, degrading the whole map.
+ */
+export function isCodexAccountPriorityKey(key: unknown): key is string {
+  return key === MAIN_CODEX_ACCOUNT_ID || isValidCodexAccountId(key);
+}
+
+/**
+ * Persisted selection order for one account: higher numbers are used earlier.
+ * Stored as a config sidecar rather than a `codexAccounts` row field because the
+ * Codex Desktop login (`__main__`) has no row and must be orderable too.
+ */
+export function getCodexAccountPriority(config: OcxConfig, accountId: string): number {
+  return codexAccountPriorityLookup(config)(accountId);
+}
+
+/**
+ * Write one account's selection order. The default is stored as absence, so a
+ * pool that was never ordered keeps no map at all and routing takes its fast path.
+ * Entries are rebuilt through `Object.fromEntries` so a reserved key such as
+ * `__proto__` becomes an own data property instead of invoking a prototype setter.
+ */
+export function setCodexAccountPriority(config: OcxConfig, accountId: string, priority: number): void {
+  const entries = new Map(Object.entries(config.codexAccountPriorities ?? {}));
+  if (priority === DEFAULT_ACCOUNT_PRIORITY) entries.delete(accountId);
+  else entries.set(accountId, priority);
+
+  if (entries.size > 0) config.codexAccountPriorities = Object.fromEntries(entries);
+  else delete config.codexAccountPriorities;
+}
+
+export function forgetCodexAccountPriority(config: OcxConfig, accountId: string): void {
+  setCodexAccountPriority(config, accountId, DEFAULT_ACCOUNT_PRIORITY);
+}
+
+/**
+ * Stable lookup for one selection pass. Routing calls this once per pick and
+ * hands the closure to `selectPriorityTier`, so a pool without stored order pays
+ * a single map read rather than one per candidate.
+ */
+export function codexAccountPriorityLookup(config: OcxConfig): (accountId: string) => number {
+  const priorities = config.codexAccountPriorities;
+  if (!priorities) return () => DEFAULT_ACCOUNT_PRIORITY;
+  return accountId => (
+    Object.hasOwn(priorities, accountId)
+      ? normalizeAccountPriority(priorities[accountId])
+      : DEFAULT_ACCOUNT_PRIORITY
+  );
+}
+
+/**
+ * The account an operator most recently selected by hand. While pinned, priority
+ * never preempts upward: the pin is a tier *ceiling* for round-robin/fill-first --
+ * `selectPriorityTier` skips every tier above the pinned account's, so higher-ordered
+ * accounts are suppressed rather than the pinned one being guaranteed -- and a veto in
+ * the quota path, until the account crosses the auto-switch threshold.
+ */
+export function pinnedCodexAccountId(config: OcxConfig): string | undefined {
+  return config.activeCodexAccountPinned;
+}
+
+export function isCodexAccountPinned(config: OcxConfig, accountId: string): boolean {
+  return config.activeCodexAccountPinned === accountId;
+}
+
+export function setCodexAccountPin(config: OcxConfig, accountId: string): void {
+  config.activeCodexAccountPinned = accountId;
+}
+
+/** Release the pin. With `accountId` given, only when it is the pinned account. */
+export function clearCodexAccountPin(config: OcxConfig, accountId?: string): void {
+  if (accountId === undefined || config.activeCodexAccountPinned === accountId) {
+    delete config.activeCodexAccountPinned;
+  }
+}
diff --git a/src/codex/auth-api.ts b/src/codex/auth-api.ts
index f2cea1bde..f4f8f023d 100644
--- a/src/codex/auth-api.ts
+++ b/src/codex/auth-api.ts
@@ -12,18 +12,31 @@ import {
 } from "./account-store";
 import { deleteCodexAccount, reconcileMainCodexAccountRuntimeState } from "./account-lifecycle";
 import { isCodexAccountPaused, setCodexAccountPaused } from "./account-pause";
+import {
+  clearCodexAccountPin,
+  getCodexAccountPriority,
+  isCodexAccountPriorityKey,
+  pinnedCodexAccountId,
+  setCodexAccountPin,
+  setCodexAccountPriority,
+} from "./account-priority";
 import {
   clearCodexAccountCooldown,
   clearThreadAccountMapForAccount,
   getEffectiveActiveCodexAccountId,
+  isEffectiveCodexAccountPinned,
   reconcileCodexActiveAfterExclusion,
   resetCodexRoutingForManualSelection,
 } from "./routing";
 import {
+  DEFAULT_ACCOUNT_PRIORITY,
+  MAX_ACCOUNT_PRIORITY,
+  MIN_ACCOUNT_PRIORITY,
   normalizeAccountPoolStickyLimit,
   normalizeAccountPoolStrategy,
   parseAccountPoolStickyLimit,
   parseAccountPoolStrategy,
+  parseAccountPriority,
 } from "./pool-rotation";
 import { checkAccountIdCollision, getMainChatgptAccountId, readCodexTokens, readCodexTokensResult } from "./auth-collision";
 export { checkAccountIdCollision, getMainChatgptAccountId } from "./auth-collision";
@@ -136,6 +149,7 @@ function poolAccountDto(
   quotaResult: PoolQuotaResult,
   hasCredential: boolean,
   paused: boolean,
+  priority: number,
 ): CodexAuthAccountDto {
   const quota = quotaForPlan(quotaResult.quota, account.plan);
   const needsReauth = !hasCredential || quotaResult.needsReauth || isAccountNeedsReauth(account.id);
@@ -148,6 +162,7 @@ function poolAccountDto(
     ...(account.logLabel !== undefined ? { logLabel: account.logLabel } : {}),
     isMain: false,
     paused,
+    priority,
     quota: quota ? { ...quota } : null,
     needsReauth,
     hasCredential,
@@ -431,6 +446,8 @@ export interface CodexAuthAccountDto {
   logLabel?: string;
   isMain: boolean;
   paused: boolean;
+  /** Selection order; higher is used earlier. Always present, 0 when unset. */
+  priority: number;
   quota: (StoredAccountQuota | (Omit<StoredAccountQuota, "updatedAt"> & { updatedAt: number })) | null;
   needsReauth?: boolean;
   hasCredential: boolean;
@@ -547,7 +564,13 @@ export async function listCodexAuthAccounts(config: OcxConfig, forceRefresh = fa
     const quotaResult = cred
       ? await fetchPoolAccountQuota(a.id, forceRefresh, a.plan)
       : { quota: null, needsReauth: true };
-    return poolAccountDto(a, quotaResult, !!cred, isCodexAccountPaused(runtimeConfig, a.id));
+    return poolAccountDto(
+      a,
+      quotaResult,
+      !!cred,
+      isCodexAccountPaused(runtimeConfig, a.id),
+      getCodexAccountPriority(runtimeConfig, a.id),
+    );
   });
   const hasMainCredential = readCodexTokens() !== null;
   const mainNeedsReauth = !hasMainCredential || isAccountNeedsReauth(MAIN_CODEX_ACCOUNT_ID);
@@ -561,6 +584,7 @@ export async function listCodexAuthAccounts(config: OcxConfig, forceRefresh = fa
     plan: mainInfo.plan,
     isMain: true,
     paused: isCodexAccountPaused(runtimeConfig, MAIN_CODEX_ACCOUNT_ID),
+    priority: getCodexAccountPriority(runtimeConfig, MAIN_CODEX_ACCOUNT_ID),
     hasCredential: hasMainCredential,
     needsReauth: mainNeedsReauth,
     quota: mainInfo.quota ? { ...quotaForPlan({ ...mainInfo.quota, updatedAt: Date.now() }, mainInfo.plan) } : null,
@@ -749,6 +773,53 @@ export async function handleCodexAuthAPI(
     });
   }
 
+  // Deliberately a route of its own rather than a field on the alias PATCH: aliases
+  // are display-only and reject __main__, while selection order is routing metadata
+  // that the Desktop account must be able to carry. Re-ordering never kicks a live
+  // thread, so there is no affinity clearing and no appliesImmediately here.
+  if (url.pathname === "/api/codex-auth/accounts/priority" && req.method === "PUT") {
+    let parsedBody: unknown;
+    try { parsedBody = await req.json(); } catch { return jsonResponse({ error: "Invalid JSON" }, 400); }
+    if (typeof parsedBody !== "object" || parsedBody === null || Array.isArray(parsedBody)) {
+      return jsonResponse({ error: "body must be an object" }, 400);
+    }
+    const body = parsedBody as { id?: unknown; priority?: unknown };
+    const id = typeof body.id === "string" ? body.id.trim() : "";
+    if (!isCodexAccountPriorityKey(id)) {
+      return jsonResponse({ error: "Invalid account id format" }, 400);
+    }
+
+    let priority = DEFAULT_ACCOUNT_PRIORITY;
+    if (body.priority !== null) {
+      const parsed = parseAccountPriority(body.priority);
+      if (parsed === null) {
+        return jsonResponse({
+          error: `priority must be null or an integer ${MIN_ACCOUNT_PRIORITY}-${MAX_ACCOUNT_PRIORITY}`,
+        }, 400);
+      }
+      priority = parsed;
+    }
+
+    const runtimeConfig = getRuntimeConfig(config);
+    const exists = id === MAIN_CODEX_ACCOUNT_ID
+      || (runtimeConfig.codexAccounts ?? []).some(account => isSelectableCodexPoolAccount(account) && account.id === id);
+    if (!exists) return jsonResponse({ error: "Account not found" }, 404);
+
+    setCodexAccountPriority(runtimeConfig, id, priority);
+    // Both a pin and an order are the operator saying which account to use, so the newer
+    // statement wins. Without this a pin made before any order existed — an ordinary
+    // account switch — would outrank the order forever: it blocks preemption and caps
+    // every eligibility list at its own tier until that account drains or is paused.
+    clearCodexAccountPin(runtimeConfig);
+    saveRuntimeConfig(config, runtimeConfig);
+    return jsonResponse({
+      ok: true,
+      id,
+      priority,
+      activeCodexAccountId: getEffectiveActiveCodexAccountId(runtimeConfig) ?? null,
+    });
+  }
+
   if (url.pathname === "/api/codex-auth/accounts/pause-exhausted" && req.method === "PUT") {
     const runtimeConfig = getRuntimeConfig(config);
     const result = await pauseExhaustedCodexAccounts(runtimeConfig);
@@ -809,6 +880,15 @@ export async function handleCodexAuthAPI(
       if (!exists) return jsonResponse({ error: "Account not found" }, 400);
     }
     runtimeConfig.activeCodexAccountId = body.accountId ?? undefined;
+    // "Use this account now" outranks selection order until the account is spent:
+    // persisted here rather than in resetCodexRoutingForManualSelection, which is
+    // runtime state only. A null id clears the selection instead of making one, so it
+    // must release the pin rather than record one: pinning the `targetAccountId`
+    // fallback would leave a pin that no effective active account matches, which
+    // `isEffectiveCodexAccountPinned` reports as unpinned while the tier filter still
+    // honours it as a ceiling — invisibly capping the pool at the main account's tier.
+    if (body.accountId == null) clearCodexAccountPin(runtimeConfig);
+    else setCodexAccountPin(runtimeConfig, targetAccountId);
     resetCodexRoutingForManualSelection(targetAccountId);
     saveRuntimeConfig(config, runtimeConfig);
     return jsonResponse({ ok: true, activeCodexAccountId: body.accountId, appliesImmediately: true });
@@ -818,6 +898,13 @@ export async function handleCodexAuthAPI(
     const runtimeConfig = getRuntimeConfig(config);
     return jsonResponse({
       activeCodexAccountId: getEffectiveActiveCodexAccountId(runtimeConfig) ?? null,
+      pinned: isEffectiveCodexAccountPinned(runtimeConfig),
+      // Which account carries the pin, not just whether the active one does. Under
+      // round-robin or fill-first the pin caps the tier ceiling at its own tier while the
+      // strategy cursor moves freely inside that tier, so `pinned` alone goes false on a
+      // sibling's turn even though the pin is still suppressing every higher tier. The id
+      // lets a surface mark the account the operator actually chose.
+      pinnedAccountId: pinnedCodexAccountId(runtimeConfig) ?? null,
       autoSwitchThreshold: runtimeConfig.autoSwitchThreshold ?? 80,
       upstreamFailoverThreshold: runtimeConfig.upstreamFailoverThreshold ?? 3,
       accountPoolStrategy: normalizeAccountPoolStrategy(runtimeConfig.accountPoolStrategy),
diff --git a/src/codex/pool-rotation.ts b/src/codex/pool-rotation.ts
index c75f6d34a..c6feee694 100644
--- a/src/codex/pool-rotation.ts
+++ b/src/codex/pool-rotation.ts
@@ -17,6 +17,11 @@ const MAX_STICKY_LIMIT = 100;
 const DEFAULT_STRATEGY: OcxAccountPoolRotationStrategy = "quota";
 const VALID_STRATEGIES = new Set<OcxAccountPoolRotationStrategy>(["quota", "round-robin", "fill-first"]);
 
+/** Selection order for an account with no stored preference: one flat tier. */
+export const DEFAULT_ACCOUNT_PRIORITY = 0;
+export const MIN_ACCOUNT_PRIORITY = -100;
+export const MAX_ACCOUNT_PRIORITY = 100;
+
 /** Strict parse for management APIs — returns null instead of defaulting. */
 export function parseAccountPoolStrategy(raw: unknown): OcxAccountPoolRotationStrategy | null {
   if (typeof raw === "string" && VALID_STRATEGIES.has(raw as OcxAccountPoolRotationStrategy)) {
@@ -41,6 +46,71 @@ export function normalizeAccountPoolStickyLimit(raw: unknown): number {
   return parseAccountPoolStickyLimit(raw) ?? DEFAULT_STICKY_LIMIT;
 }
 
+/** Strict parse for management APIs — returns null instead of defaulting. */
+export function parseAccountPriority(raw: unknown): number | null {
+  if (
+    typeof raw === "number"
+    && Number.isInteger(raw)
+    && raw >= MIN_ACCOUNT_PRIORITY
+    && raw <= MAX_ACCOUNT_PRIORITY
+  ) {
+    return raw;
+  }
+  return null;
+}
+
+export function normalizeAccountPriority(raw: unknown): number {
+  return parseAccountPriority(raw) ?? DEFAULT_ACCOUNT_PRIORITY;
+}
+
+/**
+ * Narrow an already-eligible account list to the highest selection-order tier that
+ * still has usable quota. Priority is an *ordering* boundary layered on top of
+ * eligibility: it never admits an account the caller already filtered out, and it
+ * never keeps the pool on a tier whose every member is drained.
+ *
+ * Contract (each clause is load-bearing for "no behavior change when unconfigured"):
+ * - one distinct priority across `ids` (the unconfigured case) returns `ids` unchanged,
+ *   so today's pick sequence is preserved byte for byte;
+ * - input order is preserved inside the returned tier, which keeps the `__main__`
+ *   head-of-list bias and the first-index tie-break used by SWRR/lowest-usage;
+ * - every tier drained returns `ids` unchanged, reproducing today's
+ *   stay-put-until-429 behavior rather than inventing a pick;
+ * - a `pinnedId` that is present *and* has headroom lowers the ceiling to its own
+ *   tier, which is what makes a manual "use this now" survive round-robin and
+ *   fill-first without any mutable selection state. A drained or absent pin is
+ *   ignored, so the pin expires on its own once the account crosses the threshold.
+ */
+export function selectPriorityTier(
+  ids: readonly string[],
+  priorityOf: (id: string) => number,
+  hasHeadroom: (id: string) => boolean,
+  pinnedId?: string,
+): readonly string[] {
+  // Readonly out as well as in: the no-change cases return the caller's own array, so a
+  // mutating caller would corrupt its input in exactly the cases that must not change.
+  const list = ids;
+  if (list.length <= 1) return list;
+
+  const priorities = list.map(priorityOf);
+  const firstPriority = priorities[0]!;
+  if (priorities.every(priority => priority === firstPriority)) return list;
+
+  let ceiling = Number.POSITIVE_INFINITY;
+  if (pinnedId !== undefined) {
+    const pinnedIndex = list.indexOf(pinnedId);
+    if (pinnedIndex >= 0 && hasHeadroom(pinnedId)) ceiling = priorities[pinnedIndex]!;
+  }
+
+  const tiers = [...new Set(priorities)].sort((a, b) => b - a);
+  for (const tier of tiers) {
+    if (tier > ceiling) continue;
+    const members = list.filter((_, index) => priorities[index] === tier);
+    if (members.some(hasHeadroom)) return members;
+  }
+  return list;
+}
+
 function getOrCreateState(poolKey: string): SelectionState {
   let state = selectionState.get(poolKey);
   if (!state) {
@@ -58,7 +128,7 @@ function cloneSelectionState(state: SelectionState): SelectionState {
   };
 }
 
-function smoothWeightedIndex(ids: string[], state: SelectionState): number {
+function smoothWeightedIndex(ids: readonly string[], state: SelectionState): number {
   let best = -1;
   let bestScore = Number.NEGATIVE_INFINITY;
   let total = 0;
@@ -85,7 +155,7 @@ function smoothWeightedIndex(ids: string[], state: SelectionState): number {
  * either the live map entry or a scratch/clone for dry-run peek.
  */
 function pickRoundRobinFromState(
-  eligibleIds: string[],
+  eligibleIds: readonly string[],
   stickyLimit: number,
   state: SelectionState,
   commitSticky: boolean,
@@ -116,7 +186,7 @@ function pickRoundRobinFromState(
 
 export function pickRoundRobinAccount(
   poolKey: string,
-  eligibleIds: string[],
+  eligibleIds: readonly string[],
   stickyLimit: number,
 ): string | null {
   return pickRoundRobinFromState(eligibleIds, stickyLimit, getOrCreateState(poolKey), true);
@@ -128,7 +198,7 @@ export function pickRoundRobinAccount(
  */
 export function peekRoundRobinAccount(
   poolKey: string,
-  eligibleIds: string[],
+  eligibleIds: readonly string[],
   stickyLimit: number,
 ): string | null {
   const live = selectionState.get(poolKey);
diff --git a/src/codex/routing.ts b/src/codex/routing.ts
index bbc13f844..dbe974daf 100644
--- a/src/codex/routing.ts
+++ b/src/codex/routing.ts
@@ -3,6 +3,7 @@ import { saveConfigPreservingClaudeCode } from "../config";
 import { isCodexAccountGenerationLive, readCodexAccountRecord } from "./account-store";
 import { codexAccountLogLabel } from "./account-label";
 import { isCodexAccountPaused } from "./account-pause";
+import { clearCodexAccountPin, codexAccountPriorityLookup, pinnedCodexAccountId } from "./account-priority";
 import { isCodexAccountUsable } from "./account-usability";
 import { isAccountNeedsReauth, markAccountNeedsReauth } from "./account-runtime-state";
 import {
@@ -14,6 +15,7 @@ import {
   peekRoundRobinAccount,
   pickRoundRobinAccount,
   seedPoolRotationAccount,
+  selectPriorityTier,
 } from "./pool-rotation";
 import { CODEX_UNKNOWN_USAGE_SCORE, getAccountQuota } from "./quota";
 import { MAIN_CODEX_ACCOUNT_ID, getMainAccountPlan } from "./main-account";
@@ -693,7 +695,7 @@ function getEligiblePoolAccounts(
   excludeId?: string,
   now = Date.now(),
   quotaScope?: CodexQuotaScope,
-): string[] {
+): readonly string[] {
   const ids = (config.codexAccounts ?? [])
     .filter(account => isSelectableCodexPoolAccount(account)
       && account.id !== excludeId
@@ -715,14 +717,22 @@ function getEligiblePoolAccounts(
   ) {
     ids.unshift(MAIN_CODEX_ACCOUNT_ID);
   }
-  return ids;
+  // Single choke point for selection order: every strategy, failover, and preview
+  // reaches the pool through here, so tiering applies once rather than per picker.
+  // Eligibility above is unchanged — this only narrows an already-eligible list.
+  return selectPriorityTier(
+    ids,
+    codexAccountPriorityLookup(config),
+    id => hasCodexQuotaHeadroom(config, id),
+    pinnedCodexAccountId(config),
+  );
 }
 
 function listEligibleCodexAccountIds(
   config: OcxConfig,
   now: number,
   quotaScope?: CodexQuotaScope,
-): string[] {
+): readonly string[] {
   return getEligiblePoolAccounts(config, undefined, now, quotaScope);
 }
 
@@ -730,11 +740,20 @@ function stickyLimitForConfig(config: OcxConfig): number {
   return normalizeAccountPoolStickyLimit(config.accountPoolStickyLimit);
 }
 
-function isActiveUnderFillFirstThreshold(config: OcxConfig, accountId: string): boolean {
+/**
+ * Whether an account still has quota to give under the auto-switch threshold.
+ *
+ * Fill-first and the priority tier filter share this predicate, and share both of
+ * its escape hatches. A disabled threshold means only health, pause, and reauth
+ * may drain an account; unknown usage is a guess, so it must neither force
+ * fill-first off the active account nor drain a tier that was simply never
+ * primed. A genuinely exhausted account 429s into cooldown and leaves
+ * eligibility on its own.
+ */
+function hasCodexQuotaHeadroom(config: OcxConfig, accountId: string): boolean {
   const threshold = config.autoSwitchThreshold ?? 80;
   if (threshold <= 0) return true;
   const usage = computeCodexUsageScore(getAccountQuota(accountId), getPoolAccountPlan(config, accountId));
-  // Unknown usage must not force fill-first to abandon the active account.
   if (isUnknownUsage(usage)) return true;
   return usage < threshold;
 }
@@ -752,7 +771,7 @@ function pickFillFirstCodexAccount(
   if (eligible.length === 0) return null;
 
   const active = getEffectiveActiveCodexAccountId(config);
-  if (active && eligible.includes(active) && isActiveUnderFillFirstThreshold(config, active)) {
+  if (active && eligible.includes(active) && hasCodexQuotaHeadroom(config, active)) {
     return active;
   }
 
@@ -763,7 +782,7 @@ function pickFillFirstCodexAccount(
 function pickNextFillFirstCodexAccount(
   config: OcxConfig,
   afterId: string | null,
-  eligible = listEligibleCodexAccountIds(config, Date.now()),
+  eligible: readonly string[] = listEligibleCodexAccountIds(config, Date.now()),
   _now = Date.now(),
 ): string | null {
   if (eligible.length === 0) return null;
@@ -771,7 +790,7 @@ function pickNextFillFirstCodexAccount(
   if (!afterId) {
     // Prefer an under-threshold account when starting with no active cursor.
     for (const id of ordered) {
-      if (isActiveUnderFillFirstThreshold(config, id)) return id;
+      if (hasCodexQuotaHeadroom(config, id)) return id;
     }
     return ordered[0] ?? null;
   }
@@ -786,7 +805,7 @@ function pickNextFillFirstCodexAccount(
   const startIdx = stableAll.indexOf(afterId);
   if (startIdx < 0) {
     for (const id of ordered) {
-      if (isActiveUnderFillFirstThreshold(config, id)) return id;
+      if (hasCodexQuotaHeadroom(config, id)) return id;
     }
     return ordered[0] ?? null;
   }
@@ -797,7 +816,7 @@ function pickNextFillFirstCodexAccount(
     const candidate = stableAll[(startIdx + step) % stableAll.length]!;
     if (!eligible.includes(candidate)) continue;
     if (!fallback) fallback = candidate;
-    if (isActiveUnderFillFirstThreshold(config, candidate)) return candidate;
+    if (hasCodexQuotaHeadroom(config, candidate)) return candidate;
   }
   return fallback ?? ordered[0] ?? null;
 }
@@ -881,15 +900,11 @@ function pickLowerUsageAccount(
   return best;
 }
 
-export function pickLowestUsageCodexAccount(
-  config: OcxConfig,
-  excludeId?: string,
-  now = Date.now(),
-  quotaScope?: CodexQuotaScope,
-): string | null {
+/** Coolest account in an already-selected candidate list; first index wins ties. */
+function pickLowestUsageAmong(config: OcxConfig, ids: readonly string[]): string | null {
   let best: string | null = null;
   let bestUsage = Number.POSITIVE_INFINITY;
-  for (const id of getEligiblePoolAccounts(config, excludeId, now, quotaScope)) {
+  for (const id of ids) {
     const usage = computeCodexUsageScore(getAccountQuota(id), getPoolAccountPlan(config, id));
     if (usage < bestUsage) {
       best = id;
@@ -899,6 +914,15 @@ export function pickLowestUsageCodexAccount(
   return best;
 }
 
+export function pickLowestUsageCodexAccount(
+  config: OcxConfig,
+  excludeId?: string,
+  now = Date.now(),
+  quotaScope?: CodexQuotaScope,
+): string | null {
+  return pickLowestUsageAmong(config, getEligiblePoolAccounts(config, excludeId, now, quotaScope));
+}
+
 /**
  * Strategy-aware alternate after a cooled/excluded account (same-request 429 retry
  * and active promotion). Quota keeps lowest-usage; fill-first advances stable order;
@@ -911,12 +935,16 @@ export function pickAlternateCodexAccount(
   quotaScope?: CodexQuotaScope,
 ): string | null {
   const strategy = normalizeAccountPoolStrategy(config.accountPoolStrategy);
+  // The exclusion is passed into eligibility rather than post-filtered off its
+  // result: when the excluded account is the only healthy member of the top
+  // tier, the tier walk must be free to descend instead of selecting that tier
+  // and then handing back an empty list.
   if (strategy === "round-robin") {
-    const eligible = listEligibleCodexAccountIds(config, now, quotaScope).filter(id => id !== excludeId);
+    const eligible = getEligiblePoolAccounts(config, excludeId, now, quotaScope);
     return pickRoundRobinAccount(codexPoolKeyForScope(quotaScope), eligible, stickyLimitForConfig(config));
   }
   if (strategy === "fill-first") {
-    const eligible = listEligibleCodexAccountIds(config, now, quotaScope).filter(id => id !== excludeId);
+    const eligible = getEligiblePoolAccounts(config, excludeId, now, quotaScope);
     return pickNextFillFirstCodexAccount(config, excludeId, eligible, now);
   }
   return pickLowestUsageCodexAccount(config, excludeId, now, quotaScope);
@@ -927,6 +955,17 @@ export function getEffectiveActiveCodexAccountId(config: OcxConfig): string | un
   return runtimeActiveCodexAccountId ?? config.activeCodexAccountId;
 }
 
+/**
+ * Whether the account routing is currently on is there because an operator asked
+ * for it, rather than because a strategy landed on it. Surfaces read this instead
+ * of comparing the stored pin themselves, which would report a pin that a later
+ * automatic pick has already moved past.
+ */
+export function isEffectiveCodexAccountPinned(config: OcxConfig): boolean {
+  const pinned = pinnedCodexAccountId(config);
+  return pinned !== undefined && pinned === getEffectiveActiveCodexAccountId(config);
+}
+
 /**
  * Automatic strategy / failover cursor only — never mutates `config.activeCodexAccountId`
  * so an unrelated `saveConfig` cannot persist transient rotation as operator selection.
@@ -935,10 +974,22 @@ function rememberActiveCodexAccount(_config: OcxConfig, accountId: string): void
   runtimeActiveCodexAccountId = accountId;
 }
 
+/**
+ * End the manual pin when routing moves to a different account. Returns whether
+ * the pin changed so the caller can fold it into a write it was already making.
+ */
+function releaseCodexAccountPinFor(config: OcxConfig, accountId: string): boolean {
+  const pinned = pinnedCodexAccountId(config);
+  if (pinned === undefined || pinned === accountId) return false;
+  clearCodexAccountPin(config);
+  return true;
+}
+
 /** Persist operator (or quota-strategy) active selection to config + disk. */
 function setActiveCodexAccount(config: OcxConfig, accountId: string): void {
   runtimeActiveCodexAccountId = undefined;
-  if (config.activeCodexAccountId === accountId) return;
+  const releasedPin = releaseCodexAccountPinFor(config, accountId);
+  if (config.activeCodexAccountId === accountId && !releasedPin) return;
   config.activeCodexAccountId = accountId;
   saveConfigPreservingClaudeCode(config);
 }
@@ -949,6 +1000,10 @@ function promoteActiveCodexAccount(config: OcxConfig, accountId: string): void {
     setActiveCodexAccount(config, accountId);
     return;
   }
+  // Runtime-only, like the cursor itself: a caller that persists (pause, delete)
+  // saves this release with its own write; a transient failover does not, so the
+  // pin survives a restart that also clears the failure history behind it.
+  releaseCodexAccountPinFor(config, accountId);
   rememberActiveCodexAccount(config, accountId);
 }
 
@@ -967,6 +1022,10 @@ export function reconcileCodexActiveAfterExclusion(
   if (config.activeCodexAccountId === excludedAccountId) {
     config.activeCodexAccountId = undefined;
   }
+  // Excluding an account revokes any manual pin on it even when it was not the
+  // effective active — otherwise a paused account keeps acting as a tier ceiling,
+  // suppressing every higher-ordered account while being unusable itself.
+  clearCodexAccountPin(config, excludedAccountId);
   if (!wasEffective) return getEffectiveActiveCodexAccountId(config) ?? null;
 
   runtimeActiveCodexAccountId = undefined;
@@ -979,6 +1038,53 @@ function isUnknownUsage(usage: number): boolean {
   return usage >= CODEX_UNKNOWN_USAGE_SCORE;
 }
 
+/**
+ * Move an unbound request back up when a higher tier regains headroom — the
+ * weekly-reset case. Returns null when nothing should change.
+ *
+ * Downward moves are deliberately left to {@link applyQuotaAutoSwitch}: this only
+ * fires when the tier filter has already excluded `active`, and only toward a
+ * tier that strictly outranks it. Threads bound by affinity never reach here.
+ */
+function pickPriorityPreemption(
+  config: OcxConfig,
+  active: string,
+  now: number,
+  quotaScope?: CodexQuotaScope,
+): string | null {
+  const eligible = getEligiblePoolAccounts(config, undefined, now, quotaScope);
+  if (eligible.length === 0 || eligible.includes(active)) return null;
+  const pinned = pinnedCodexAccountId(config);
+  // A live pin already lowered the tier ceiling; never preempt past an explicit
+  // operator choice. Same liveness test the tier filter applies, so preview and
+  // resolve agree even before the pin is garbage-collected.
+  if (pinned !== undefined && eligible.includes(pinned) && hasCodexQuotaHeadroom(config, pinned)) return null;
+  const priorityOf = codexAccountPriorityLookup(config);
+  if (priorityOf(eligible[0]!) <= priorityOf(active)) return null;
+  // Members without headroom are in the tier only because a sibling has some;
+  // picking one would hand the request straight back to a drained account.
+  return pickLowestUsageAmong(config, eligible.filter(id => hasCodexQuotaHeadroom(config, id)));
+}
+
+/**
+ * Release a pin whose account is durably drained. "Use this account now" ends
+ * when the account crosses the auto-switch threshold or stops being selectable
+ * at all — never on a transient cooldown or soft-avoid, which it recovers from
+ * on its own. Clearing the pin also removes the condition, so this writes at
+ * most once per pin.
+ */
+function releaseDrainedCodexAccountPin(config: OcxConfig): void {
+  const pinned = pinnedCodexAccountId(config);
+  if (pinned === undefined) return;
+  const drained = !isCodexAccountUsable(config, pinned)
+    || isAccountNeedsReauth(pinned)
+    || isCodexAccountPaused(config, pinned)
+    || !hasCodexQuotaHeadroom(config, pinned);
+  if (!drained) return;
+  clearCodexAccountPin(config);
+  saveConfigPreservingClaudeCode(config);
+}
+
 function applyQuotaAutoSwitch(
   config: OcxConfig,
   active: string,
@@ -1010,11 +1116,22 @@ function shouldFailover(config: OcxConfig, accountId: string, now: number): bool
   return !!health && health.consecutiveFailures >= threshold;
 }
 
-function applyFailureFailover(config: OcxConfig, active: string, now: number): string {
+function applyFailureFailover(
+  config: OcxConfig,
+  active: string,
+  now: number,
+  quotaScope?: CodexQuotaScope,
+): string {
   if (!shouldFailover(config, active, now)) return active;
-  const best = pickAlternateCodexAccount(config, active, now);
+  const best = pickAlternateCodexAccount(config, active, now, quotaScope);
   if (best) {
-    promoteActiveCodexAccount(config, best);
+    // The scope still routes away from the failing account — that is this request's
+    // own decision — but an independent one must not persist a new shared active
+    // account. recordCodexUpstreamOutcome only suppresses the promotion it makes at
+    // the moment of the failure; the streak outlives the soft avoid, so a later
+    // scoped resolve reaches here with the streak still tripped and would otherwise
+    // move the shared cursor after all.
+    if (!isIndependentCodexQuotaScope(quotaScope)) promoteActiveCodexAccount(config, best);
     return best;
   }
   return active;
@@ -1086,6 +1203,7 @@ export function previewCodexAccountForRequest(
     else if (hasConfiguredPoolAccount(config, active) && !isCodexAccountPaused(config, active)) return active;
     else return null;
   }
+  active = pickPriorityPreemption(config, active, now, quotaScope) ?? active;
 
   const threshold = config.autoSwitchThreshold ?? 80;
   if (threshold > 0) {
@@ -1114,6 +1232,12 @@ export function resolveCodexAccountForThreadDetailed(
   now = Date.now(),
   quotaScope?: CodexQuotaScope,
 ): CodexThreadResolution {
+  // Retiring a spent manual pin is independent of affinity: an existing thread
+  // keeps its account below, but the operator's tier ceiling must not silently
+  // revive after quota resets. Independent model scopes must never persist a
+  // change to shared routing state.
+  if (!isIndependentCodexQuotaScope(quotaScope)) releaseDrainedCodexAccountPin(config);
+
   const entry = threadId ? getThreadAffinity(threadId, quotaScope) : undefined;
   if (threadId && entry) {
     if (isThreadAffinityExpired(entry, now)) {
@@ -1184,8 +1308,19 @@ export function resolveCodexAccountForThreadDetailed(
       return { status: "none" };
     }
   }
+  // Before applyQuotaAutoSwitch: its sync disk write would otherwise persist a
+  // move inside the drained tier that preemption immediately overrides.
+  const preempted = pickPriorityPreemption(config, active, now, quotaScope);
+  if (preempted) {
+    // Runtime-only, like every other automatic pick: config.activeCodexAccountId
+    // stays the operator's selection and getEffectiveActiveCodexAccountId is what
+    // surfaces this to the API and dashboard. An independent quota group must not
+    // move the shared cursor at all — its ordering decision is its own.
+    if (!isIndependentCodexQuotaScope(quotaScope)) rememberActiveCodexAccount(config, preempted);
+    active = preempted;
+  }
   active = applyQuotaAutoSwitch(config, active, now, quotaScope);
-  active = applyFailureFailover(config, active, now);
+  active = applyFailureFailover(config, active, now, quotaScope);
   if (!isCodexAccountUsable(config, active)) {
     return hasConfiguredPoolAccount(config, active) ? { status: "selected", accountId: active } : { status: "none" };
   }
@@ -1355,16 +1490,21 @@ export function recordCodexUpstreamOutcome(
         }),
     });
     clearThreadAccountMapForAccount(accountId);
-    notePoolRotationFailure(POOL_KEY_CODEX, accountId);
-    const effectiveActive = getEffectiveActiveCodexAccountId(config);
-    if (effectiveActive === accountId) {
-      // Same-request 429 retry already picked via excludeAccountId — reuse it so
-      // round-robin does not advance the ring a second time.
-      const reused = meta.promoteAccountId && meta.promoteAccountId !== accountId
-        ? meta.promoteAccountId
-        : null;
-      const fallback = reused ?? pickAlternateCodexAccount(config, accountId, now);
-      if (fallback) promoteActiveCodexAccount(config, fallback);
+    // An independent native quota request may discover an account-wide throttle,
+    // but it still must not advance the shared RR ring or active cursor. The next
+    // shared request observes the cooldown and chooses its own fallback.
+    if (!isIndependentCodexQuotaScope(quotaScope)) {
+      notePoolRotationFailure(POOL_KEY_CODEX, accountId);
+      const effectiveActive = getEffectiveActiveCodexAccountId(config);
+      if (effectiveActive === accountId) {
+        // Same-request 429 retry already picked via excludeAccountId — reuse it so
+        // round-robin does not advance the ring a second time.
+        const reused = meta.promoteAccountId && meta.promoteAccountId !== accountId
+          ? meta.promoteAccountId
+          : null;
+        const fallback = reused ?? pickAlternateCodexAccount(config, accountId, now);
+        if (fallback) promoteActiveCodexAccount(config, fallback);
+      }
     }
     return;
   }
@@ -1417,7 +1557,12 @@ export function recordCodexUpstreamOutcome(
   if (shouldFailover(config, accountId, now)) {
     clearThreadAccountMapForAccount(accountId);
   }
-  if (getEffectiveActiveCodexAccountId(config) === accountId) applyFailureFailover(config, accountId, now);
+  if (
+    !isIndependentCodexQuotaScope(quotaScope)
+    && getEffectiveActiveCodexAccountId(config) === accountId
+  ) {
+    applyFailureFailover(config, accountId, now);
+  }
 }
 
 export function formatCodexProviderForLog(providerName: string, accountId: string | null, config: OcxConfig): string {
diff --git a/src/codex/subagent-model-fallback.ts b/src/codex/subagent-model-fallback.ts
index 6e936ec22..f426a5ef5 100644
--- a/src/codex/subagent-model-fallback.ts
+++ b/src/codex/subagent-model-fallback.ts
@@ -16,6 +16,7 @@ import { CODEX_UNKNOWN_USAGE_SCORE, getAccountQuota } from "./quota";
 import {
   canAcquireCodexQuotaProbeLease,
   computeCodexUsageScore,
+  getEffectiveActiveCodexAccountId,
   getPoolAccountPlan,
   isCodexAccountInCooldown,
 } from "./routing";
@@ -108,8 +109,14 @@ function quotaThreshold(config: OcxConfig): number {
   return threshold > 0 ? threshold : Number.POSITIVE_INFINITY;
 }
 
+/**
+ * The account routing would actually use, not just the persisted operator
+ * selection: round-robin, fill-first, failover, and priority preemption all
+ * move the cursor in memory only, so reading the raw field would check quota
+ * against an account this request is not going to touch.
+ */
 function activeCodexAccountId(config: OcxConfig): string | null {
-  return config.activeCodexAccountId ?? null;
+  return getEffectiveActiveCodexAccountId(config) ?? null;
 }
 
 /**
diff --git a/src/config.ts b/src/config.ts
index 9127897c1..5d36b216f 100644
--- a/src/config.ts
+++ b/src/config.ts
@@ -10,6 +10,8 @@ import {
   isValidCodexAccountNamespaceTarget,
   MAIN_CODEX_ACCOUNT_NAMESPACE_TARGET,
 } from "./codex/account-namespace-match";
+import { isCodexAccountPriorityKey } from "./codex/account-priority";
+import { parseAccountPriority } from "./codex/pool-rotation";
 import { COMBO_NAMESPACE, comboConfigIssues } from "./combos/types";
 import { hardenSecretDir, hardenSecretPath, hardenSecretPathAsync } from "./lib/windows-secret-acl";
 import { recordOwnedConfigPath } from "./lib/config-ownership";
@@ -665,6 +667,33 @@ const codexAccountNamespacesSchema = z.custom<Record<string, unknown>>(
   }
 }).pipe(z.record(z.string(), z.string()));
 
+const CODEX_ACCOUNT_PRIORITIES_RECORD_ERROR =
+  "codexAccountPriorities must be a plain object mapping Codex account ids to selection-order integers";
+const CODEX_ACCOUNT_PRIORITY_KEY_ERROR =
+  "selection-order keys must be a Codex pool-account id or the main Codex account and cannot be reserved JavaScript object keys";
+const CODEX_ACCOUNT_PRIORITY_VALUE_ERROR =
+  "selection order must be an integer between -100 and 100";
+
+const CODEX_ACCOUNT_PIN_PATTERN = /^[a-zA-Z0-9._-]{1,64}$/;
+
+const codexAccountPrioritiesSchema = z.custom<Record<string, unknown>>(
+  (value): value is Record<string, unknown> => !!value
+    && typeof value === "object"
+    && !Array.isArray(value)
+    && (Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null),
+  { error: CODEX_ACCOUNT_PRIORITIES_RECORD_ERROR },
+).superRefine((priorities, ctx) => {
+  // Inspect raw own entries before z.record parses them; Zod omits __proto__ record keys.
+  for (const [accountId, priority] of Object.entries(priorities)) {
+    if (!isCodexAccountPriorityKey(accountId)) {
+      ctx.addIssue({ code: "custom", path: [accountId], message: CODEX_ACCOUNT_PRIORITY_KEY_ERROR });
+    }
+    if (parseAccountPriority(priority) === null) {
+      ctx.addIssue({ code: "custom", path: [accountId], message: CODEX_ACCOUNT_PRIORITY_VALUE_ERROR });
+    }
+  }
+}).pipe(z.record(z.string(), z.number().int()));
+
 const configSchema = z.object({
   port: z.number().int().min(0).max(65535).default(10100),
   // A blank hostname degrades to undefined rather than failing the parse. `getDefaultConfig()`
@@ -690,6 +719,12 @@ const configSchema = z.object({
   codexShimAutoRestore: z.boolean().optional(),
   pausedCodexAccountIds: z.array(z.string().regex(/^[a-zA-Z0-9._-]{1,64}$/)).optional(),
   codexAccountNamespaces: codexAccountNamespacesSchema.optional(),
+  // Selection order is a preference, not a safety control like pause: a malformed
+  // map degrades to "no ordering" rather than failing the parse, so a hand-edited
+  // typo cannot trip the backup-and-defaults repair path and wipe providers or
+  // pool accounts. Warning emitted in loadConfig.
+  codexAccountPriorities: codexAccountPrioritiesSchema.optional().catch(undefined),
+  activeCodexAccountPinned: z.string().regex(CODEX_ACCOUNT_PIN_PATTERN).optional().catch(undefined),
   // Model ids excluded from the Grok Build managed block (dashboard switches).
   grokExcludedModels: z.array(z.string()).optional(),
   // Invalid values degrade to undefined ("auto") instead of failing the whole
@@ -1011,6 +1046,32 @@ function warnDegradedHostname(rawParsed: unknown, validated: OcxConfig): void {
   }
 }
 
+/**
+ * Companion to {@link warnDegradedStreamMode} for a malformed selection-order map.
+ * Priority is a preference, so the schema drops the whole map rather than failing
+ * the parse — say so once, otherwise the pool silently reverts to flat ordering.
+ */
+function degradedCodexAccountPriorityWarnings(rawParsed: unknown, validated: OcxConfig): string[] {
+  const record = rawConfigRecord(rawParsed);
+  const warnings: string[] = [];
+  // The pin degrades silently otherwise, which reads as the manual selection simply
+  // not having survived the restart.
+  if (record?.activeCodexAccountPinned !== undefined && validated.activeCodexAccountPinned === undefined) {
+    warnings.push("activeCodexAccountPinned is not a valid account id — the manually selected account is no longer pinned");
+  }
+  const raw = record?.codexAccountPriorities;
+  if (raw !== undefined && validated.codexAccountPriorities === undefined) {
+    warnings.push("codexAccountPriorities is invalid (expected account ids mapped to integers between -100 and 100) — account selection order is disabled");
+  }
+  return warnings;
+}
+
+function warnDegradedCodexAccountPriorities(rawParsed: unknown, validated: OcxConfig): void {
+  for (const warning of degradedCodexAccountPriorityWarnings(rawParsed, validated)) {
+    console.warn(`⚠️  config.json ${warning}`);
+  }
+}
+
 const CLAUDE_SUBAGENT_EFFORTS = ["low", "medium", "high", "xhigh", "max"] as const;
 
 function isClaudeSubagentEffort(value: unknown): value is NonNullable<OcxClaudeCodeConfig["subagentEffort"]> {
@@ -1123,6 +1184,7 @@ export function loadConfig(): OcxConfig {
       const config = result.data as OcxConfig;
       warnDegradedStreamMode(parsed, config);
       warnDegradedHostname(parsed, config);
+      warnDegradedCodexAccountPriorities(parsed, config);
       warnDegradedClaudeSubagentEffort(parsed);
       warnDegradedNativeSubagentConfig(parsed, config);
       return normalizeClaudeSubagentEffort(normalizeNativeSubagentSync(config, parsed), parsed);
@@ -1141,6 +1203,7 @@ export function loadConfig(): OcxConfig {
       warnConfigRepaired(configPath, result.error);
       const config = retryResult.data as OcxConfig;
       warnDegradedHostname(parsed, config);
+      warnDegradedCodexAccountPriorities(parsed, config);
       warnDegradedClaudeSubagentEffort(parsed);
       warnDegradedNativeSubagentConfig(parsed, config);
       return normalizeClaudeSubagentEffort(normalizeNativeSubagentSync(config, parsed), parsed);
@@ -1181,6 +1244,7 @@ function validFileConfigDiagnostics(config: OcxConfig, rawParsed: unknown): Conf
   const rawEffort = rawClaudeSubagentEffort(rawParsed);
   const normalized = normalizeClaudeSubagentEffort(normalizeNativeSubagentSync(config, rawParsed), rawParsed);
   const warnings = configPlaceholderWarnings(normalized);
+  warnings.push(...degradedCodexAccountPriorityWarnings(rawParsed, normalized));
   if (rawEffort !== undefined && !isClaudeSubagentEffort(rawEffort)) {
     warnings.push(`claudeCode.subagentEffort ignored: expected one of ${CLAUDE_SUBAGENT_EFFORTS.join(", ")}`);
   }
@@ -1243,9 +1307,37 @@ function claudeSubagentEffortError(value: unknown): string | null {
   return `schema_invalid: claudeCode.subagentEffort: must be one of ${CLAUDE_SUBAGENT_EFFORTS.join(", ")}`;
 }
 
+/**
+ * Same reasoning as {@link blankHostnameError}, and more urgent: the read path degrades a
+ * malformed selection-order map to undefined, which on a write would drop every entry the
+ * user had accumulated and still report success. A load-time degrade leaves the raw map in
+ * the file to be repaired by hand; a degraded write erases it. One bad `ocx config set`
+ * must not cost the whole map, so a live caller is told instead.
+ */
+function codexAccountPrioritiesError(value: unknown): string | null {
+  const raw = rawConfigRecord(value);
+  if (!raw) return null;
+  if (raw.codexAccountPriorities !== undefined) {
+    const parsed = codexAccountPrioritiesSchema.safeParse(raw.codexAccountPriorities);
+    if (!parsed.success) {
+      return schemaDiagnosticsError(parsed.error).replace("schema_invalid: ", "schema_invalid: codexAccountPriorities.");
+    }
+  }
+  // Tested as a string rather than coerced: `String(123)` matches the id pattern, so a
+  // coercing guard waves a non-string pin through to the schema, where `.catch(undefined)`
+  // drops it and reports the write as a success — the exact silent-degrade this guards.
+  const pin = raw.activeCodexAccountPinned;
+  if (pin !== undefined && (typeof pin !== "string" || !CODEX_ACCOUNT_PIN_PATTERN.test(pin))) {
+    return "schema_invalid: activeCodexAccountPinned: must be an account id";
+  }
+  return null;
+}
+
 /** Validate an in-memory config candidate without touching disk. Used by headless CLI import/set. */
 export function validateConfigCandidate(value: unknown): { ok: true; config: OcxConfig } | { ok: false; error: string } {
-  const boundaryError = blankHostnameError(value) ?? claudeSubagentEffortError(value);
+  const boundaryError = blankHostnameError(value)
+    ?? claudeSubagentEffortError(value)
+    ?? codexAccountPrioritiesError(value);
   if (boundaryError) return { ok: false, error: boundaryError };
   const result = configSchema.safeParse(value);
   if (result.success) return { ok: true, config: result.data as OcxConfig };
diff --git a/src/types.ts b/src/types.ts
index 983b483dd..0a8e3b671 100644
--- a/src/types.ts
+++ b/src/types.ts
@@ -687,6 +687,18 @@ export interface OcxConfig {
   codexAccounts?: CodexAccount[];
   /** Account ids administratively excluded from future pool selection until resumed. */
   pausedCodexAccountIds?: string[];
+  /**
+   * Selection order per account id, higher used earlier; absent = 0. Keyed by id
+   * rather than stored on `codexAccounts` rows so the Desktop login (`__main__`),
+   * which has no row, can be ordered too. Range -100..100.
+   */
+  codexAccountPriorities?: Record<string, number>;
+  /**
+   * Account id the operator last selected by hand. Suppresses upward priority
+   * preemption until that account crosses the auto-switch threshold. Stores the
+   * id (not a flag) so a stale pin cannot outlive the selection it described.
+   */
+  activeCodexAccountPinned?: string;
   /**
    * Public model-selector namespaces bound to one Codex account. Values are stored account ids;
    * `"@main"` selects the Codex Desktop/main auth.json account. Account display aliases
diff --git a/structure/05_gui-and-management-api.md b/structure/05_gui-and-management-api.md
index 0e038fde0..6cdee322b 100644
--- a/structure/05_gui-and-management-api.md
+++ b/structure/05_gui-and-management-api.md
@@ -64,7 +64,7 @@ be treated as implemented:
 | Models | Fetch routed model lists, disabled model visibility, and catalog-facing ids. |
 | OAuth | Login/status/logout for OAuth-backed providers, plus multiauth account management: `GET /api/oauth/accounts`, `PUT /api/oauth/accounts/active`, `PUT /api/oauth/accounts/alias`, `DELETE /api/oauth/accounts` list masked accounts per provider, switch the active one, edit its display-only alias, and remove one. Login accepts `addAccount: true` to force a fresh browser identity. Device flows return a structured `deviceCode`; the GUI highlights and copies it before the user opens the verification page. |
 | Key providers | Expose API-key provider presets for setup and dashboard flows. Multi-key pool per key-auth provider: `GET /api/providers/keys`, `POST /api/providers/keys`, `PUT /api/providers/keys/active`, `PUT /api/providers/keys/alias`, `DELETE /api/providers/keys` masked list, add (upsert + activate), switch, rename, and remove keys. `provider.apiKey` always mirrors the active pool entry so routing stays single-key. |
-| OpenAI account mode | Report one OpenAI Codex card with Pool/Direct controls and one API-key card. Mode PATCH persists live without restart or catalog identity changes; Pool owns account/quota controls and Direct uses caller/main login only. Main-account DTOs report real credential presence and terminal `needsReauth` state instead of treating missing/invalid native auth as an unknown quota. |
+| OpenAI account mode | Report one OpenAI Codex card with Pool/Direct controls and one API-key card. Mode PATCH persists live without restart or catalog identity changes; Pool owns account/quota controls and Direct uses caller/main login only. Main-account DTOs report real credential presence and terminal `needsReauth` state instead of treating missing/invalid native auth as an unknown quota. Selection order has its own route: `PUT /api/codex-auth/accounts/priority` takes `{ id, priority }`, where `priority` is an integer -100..100 or `null` to restore the default, accepts `__main__`, 404s an unknown id, and echoes the stored value. Re-ordering never clears thread affinity, so the response carries no `appliesImmediately`, but it does release any pin — see [`08_openai-provider-tiers.md`](08_openai-provider-tiers.md) for why. `PUT /api/codex-auth/active` with a null id releases one too, but that drops the operator's account selection along with it, so this route is the only operator-facing way to clear a pin while leaving the selected account in place. `GET /api/codex-auth/active` reports `pinned`, true only while the manually selected account is still the effective active one, plus `pinnedAccountId`, which names the pinned account whether or not it is the active one. Surfaces should render `pinnedAccountId`: under round-robin and fill-first the pin caps the tier ceiling at its own tier while the strategy cursor moves freely inside that tier, so `pinned` goes false on a sibling's turn even though the pin is still suppressing every higher tier — which is why the dashboard badges `pinnedAccountId` and the GUI controller tracks only the id. `pinned` answers the narrower question of whether routing is *currently* on the operator's choice; no surface in this repo asks it, and a new one almost certainly wants the id instead. |
 | Subagents | Read/write the featured `subagentModels` list capped at five ids. `GET/PUT /api/injection-model` manages the shared delegation model/effort selection, the independent OpenCodex guidance switch, and the default-off `syncCodexSubagentDefaults` opt-in for native Codex subagent defaults. When OpenCodex owns the active Codex routing, native `[agents]` defaults apply to newly created Codex tasks after sync/restart; external user-managed provider configs remain untouched. The defaults do not cause delegation and preserve existing user-owned defaults rather than overwriting them. PUT is partial-update: absent keys are unchanged, `null` clears, and non-object bodies are rejected with 400 before field validation. `syncCodexSubagentDefaults: true` requires a nonblank `model` and a supported Codex reasoning effort when effort is set; clearing `model` (null/empty) always clears effort and disables native-default sync even when the stored effort was invalid. |
 | V2 / Multi-agent mode | `GET/PUT /api/v2` — reports/sets the codex `multi_agent_v2` feature flag, the 3-state `multiAgentMode` override (`v1`/`default`/`v2`), and the logical maximum thread count. Selecting `v2` enables the native flag and migrates `[agents] max_threads` to the v2 key; selecting `v1` disables it and migrates the same value back. `default` leaves the native flag unchanged. PUT accepts `enabled`, `multiAgentMode`, and/or the compatibility-named `maxConcurrentThreadsPerSession`; contradictory mode/flag pairs are rejected before writes. Every transition is rollback-safe and resyncs the catalog. |
 | Logs & Debug | One sidebar entry (`/#logs`) with two tabs. Logs tab: request/runtime logs for local diagnosis. Debug tab (`/#logs/debug`; legacy `/#debug` deep links redirect there): provider + usage toggles, refresh/follow log viewer. `GET/PUT /api/debug`; `GET /api/debug/logs` and `GET /api/debug/usage-logs` (monotonic `after` cursor, legacy `since` accepted). CLI: `ocx debug provider|usage …` (both streams via running proxy API). |
@@ -86,6 +86,13 @@ User aliases are display metadata only. Codex pool aliases live on `CodexAccount
 identity, active selection, and routing never consult these fields. The matching CLI is
 `ocx account alias <provider> <id> <display-name|->` (`rename` is accepted as a synonym).
 
+Selection order is the opposite case and must not be folded into the alias route. `codexAccountPriorities`
+is routing metadata that Pool selection consults, it lives in config rather than on `CodexAccount` so the
+`__main__` Desktop login can carry one, and the alias route's rejection of `__main__` would be wrong for
+it. The matching CLI is `ocx account priority <provider> <id|main> [<value>]`, reading the current order
+when the value is omitted. Ordering invariants live in
+[`08_openai-provider-tiers.md`](08_openai-provider-tiers.md).
+
 ## Sidebar stop button
 
 The dashboard sidebar includes a stop button that calls `POST /api/stop`. The button shows a
diff --git a/structure/08_openai-provider-tiers.md b/structure/08_openai-provider-tiers.md
index 5bebbbbf8..99374b52d 100644
--- a/structure/08_openai-provider-tiers.md
+++ b/structure/08_openai-provider-tiers.md
@@ -30,6 +30,42 @@ requests keep their captured credential. An all-paused pool fails closed.
 The dashboard's bulk pause action refreshes all account quotas and mutates only accounts whose
 plan-relevant window is freshly confirmed at exactly 100%; unknown and failed refreshes are skipped.
 
+`codexAccountPriorities` is a persisted Pool *ordering* boundary and never an eligibility one. It maps
+an account id to an integer from -100 to 100, higher used earlier, with absence meaning 0. Selection
+narrows the already-eligible list to the highest tier that still holds an account with quota headroom
+and lets the configured strategy pick within that tier. A tier drains only when every member is over
+the auto-switch threshold, cooling down, soft-avoided, paused, or needs reauth; unknown quota never
+drains a tier, and every tier drained leaves the eligible list untouched. Ordering never admits an
+account that pause, cooldown, health, or reauth already excluded, and never overrides those
+exclusions. It adds no new rebind cause for a bound thread, which still moves only for the reasons it
+already had: a quota-strategy threshold re-evaluation, a failover streak, an account that stopped
+being selectable, or affinity expiry. The stable `__main__` alias carries an order on equal terms with
+added accounts, which is what lets the Desktop login be ordered last. An absent or empty map
+reproduces the prior selection sequence exactly.
+
+Preemption moves unbound requests back up when a higher tier regains headroom, and it holds the
+runtime cursor only. Under an independent quota scope it must never touch the shared active cursor,
+because the scopes track separate native quota groups and a scoped request has no standing to move
+the account every other scope resolves from.
+
+A manual activation pins its account and lowers the tier ceiling to that account's own tier. The pin
+is released by drain, exclusion, deletion, an explicit failover/promotion away, and any write to
+`codexAccountPriorities` — a pin and an order are both the operator naming an account to use, so the
+newer statement wins. Ordinary round-robin movement inside the capped tier does not release it.
+Without that last rule a pin made before any order existed, which is just an ordinary account switch,
+would outrank every order set afterwards for as long as the account kept headroom.
+
+Only an actual selection pins. Clearing the active account states that no account is chosen, so it
+releases the pin instead of recording one against the `__main__` fallback that the same handler uses
+for its paused check. A pin no effective active account matches is invisible — `pinned` compares the
+two and reports false — while the tier filter still honours it, which would silently cap the pool at
+the main account's tier.
+
+The pin is a ceiling, not a selection: inside the capped tier the strategy cursor still moves. So the
+pinned account and the effective active account are different questions, and the management API answers
+both (`pinned` and `pinnedAccountId`). A surface that marks only the active account loses the pin from
+view exactly when it is doing the most work — suppressing every higher tier.
+
 ```text
 gpt-5.6-sol                         # openai; Pool or Direct follows the provider option
 openai-apikey/gpt-5.6-sol           # OpenAI API key
diff --git a/tests/cli-account.test.ts b/tests/cli-account.test.ts
index b692ddb85..3c69b178d 100644
--- a/tests/cli-account.test.ts
+++ b/tests/cli-account.test.ts
@@ -3,6 +3,18 @@ import { PassThrough, Readable } from "node:stream";
 import { cmdAccount, classifyAccount, formatAccountTable, type AccountDeps } from "../src/cli/account";
 import type { AccountStdin } from "../src/cli/account-api";
 import { printSubcommandUsage } from "../src/cli/help";
+import {
+  DEFAULT_ACCOUNT_PRIORITY,
+  MAX_ACCOUNT_PRIORITY,
+  MIN_ACCOUNT_PRIORITY,
+} from "../src/codex/pool-rotation";
+import {
+  ACCOUNT_PRIORITY_PRESETS,
+  accountPriorityPresetKey,
+  DEFAULT_ACCOUNT_PRIORITY as GUI_DEFAULT_PRIORITY,
+  MAX_ACCOUNT_PRIORITY as GUI_MAX_PRIORITY,
+  MIN_ACCOUNT_PRIORITY as GUI_MIN_PRIORITY,
+} from "../gui/src/account-priority";
 import type { OcxConfig } from "../src/types";
 
 const RAW_SENTINEL = "test-key-rawsentinel1234567890";
@@ -138,6 +150,14 @@ async function mockManagementApi(req: Request): Promise<Response> {
     return json({ ok: true, id: payload.id, alias: payload.alias || null });
   }
 
+  if (req.method === "PUT" && url.pathname === "/api/codex-auth/accounts/priority") {
+    const payload = body as { id: string; priority: number | null };
+    const account = codexAccounts.find(entry => entry.id === payload.id);
+    if (!account) return json({ error: "account not found" }, 404);
+    account.priority = payload.priority ?? 0;
+    return json({ ok: true, id: payload.id, priority: account.priority });
+  }
+
   if (url.pathname === "/api/codex-auth/active") {
     if (req.method === "PUT") {
       const accountId = (body as { accountId?: string }).accountId;
@@ -346,7 +366,7 @@ beforeEach(() => {
         monthlyResetAt: 1_900_000_000,
       },
     },
-    { id: "chatgpt_1", email: "j***@example.com", plan: "pro", needsReauth: true, quota: null },
+    { id: "chatgpt_1", email: "j***@example.com", plan: "pro", needsReauth: true, priority: 1, quota: null },
   ];
   oauthAccounts = [
     { id: "acct_1", email: "a***@example.com" },
@@ -380,10 +400,14 @@ describe("ocx account CLI (issue #180 matrix)", () => {
     const result = await run(["list"]);
 
     expect(result.code).toBe(0);
-    expect(result.stdout).toMatch(/^PROVIDER\s{2,}TYPE\s{2,}ID\s{2,}PLAN\/LABEL\s{2,}STATUS/m);
-    expect(result.stdout).toMatch(/^openai\s+codex\s+main\s+plus/m);
-    expect(result.stdout).toMatch(/^anthropic\s+oauth\s+acct_1\s+a\*\*\*@example\.com\s+active/m);
-    expect(result.stdout).toMatch(/^openrouter\s+api-key\s+key_1\s+test\*\*\*\*7890 \(personal\)\s+active/m);
+    expect(result.stdout).toMatch(/^PROVIDER\s{2,}TYPE\s{2,}ID\s{2,}PLAN\/LABEL\s{2,}PRIORITY\s{2,}STATUS/m);
+    expect(result.stdout).toMatch(/^openai\s+codex\s+main\s+plus\s+0/m);
+    // The sign, not just the header: an order above the default must render "+1" so the
+    // column reads as a position on an axis rather than a magnitude. Without this the
+    // whole suite passes with priorityText's `+${n}` branch collapsed to String(n).
+    expect(result.stdout).toMatch(/^openai\s+codex\s+chatgpt_1\s+\S+\s+\+1\s/m);
+    expect(result.stdout).toMatch(/^anthropic\s+oauth\s+acct_1\s+a\*\*\*@example\.com\s+-\s+active/m);
+    expect(result.stdout).toMatch(/^openrouter\s+api-key\s+key_1\s+test\*\*\*\*7890 \(personal\)\s+-\s+active/m);
     expect(result.stdout).not.toContain("__main__");
 
     const lines = result.stdout.split("\n");
@@ -580,12 +604,19 @@ describe("ocx account CLI (issue #180 matrix)", () => {
     expect(result.stdout).toContain("needs-reauth");
   });
 
-  test("WP2 regression: use openai main prints next-session and auto-switch override notes", async () => {
+  test("WP2 regression: use openai main prints takes-effect-immediately and auto-switch override notes", async () => {
     const result = await run(["use", "openai", "main"]);
 
     expect(result.code).toBe(0);
-    expect(result.stderr).toContain("new Codex sessions");
-    expect(result.stderr).toContain("running threads keep their current account");
+    // A manual switch clears thread affinity outright (resetCodexRoutingForManualSelection
+    // calls clearThreadAccountMap as its first statement), so running threads do NOT keep
+    // their account -- they rebind on their next request, and the route reports
+    // appliesImmediately: true. Only requests already in flight keep what they captured.
+    // Do not reword back toward "new sessions" or "running threads keep their account":
+    // this test previously asserted that clause, which is what kept it alive.
+    expect(result.stderr).toContain("Takes effect immediately");
+    expect(result.stderr).toContain("in-flight requests keep the account they captured");
+    expect(result.stderr).not.toContain("running threads keep their current account");
     expect(result.stderr).toContain("auto-switch (threshold 80%) may override this pin");
   });
 
@@ -975,6 +1006,209 @@ describe("ocx account CLI (issue #180 matrix)", () => {
     expect(requests).toContainEqual(expect.objectContaining({ method: "PUT", path: "/api/providers/keys/alias" }));
   });
 
+  describe("37b: account priority sets and reads Codex selection order", () => {
+    const priorityRequests = () => requests.filter(r => r.path === "/api/codex-auth/accounts/priority");
+    const unreachableDeps = (): AccountDeps => ({
+      ...defaultDeps(),
+      fetchImpl: async () => { throw new TypeError("connection refused"); },
+    });
+
+    test("a numeric value is sent as an integer and echoed back signed", async () => {
+      const result = await run(["priority", "openai", "chatgpt_1", "-1"]);
+
+      expect(result.code).toBe(0);
+      expect(result.stdout).toBe("openai: chatgpt_1 selection order is now -1 (later)");
+      expect(priorityRequests()).toEqual([
+        expect.objectContaining({ method: "PUT", body: { id: "chatgpt_1", priority: -1 } }),
+      ]);
+    });
+
+    // The signed form is what the command itself prints back, so it has to round-trip.
+    test("a leading-plus integer parses to the same value as the bare spelling", async () => {
+      const result = await run(["priority", "openai", "chatgpt_1", "+2"]);
+
+      expect(result.code).toBe(0);
+      expect(result.stdout).toBe("openai: chatgpt_1 selection order is now +2 (first)");
+      expect(priorityRequests()).toEqual([
+        expect.objectContaining({ method: "PUT", body: { id: "chatgpt_1", priority: 2 } }),
+      ]);
+    });
+
+    test.each([
+      ["first", 2],
+      ["Earlier", 1],
+      ["normal", 0],
+      ["later", -1],
+      ["LAST", -2],
+    ] as const)("the preset word %s maps to %d", async (word, expected) => {
+      const result = await run(["priority", "openai", "chatgpt_1", word]);
+
+      expect(result.code).toBe(0);
+      expect(priorityRequests()).toEqual([
+        expect.objectContaining({ body: { id: "chatgpt_1", priority: expected } }),
+      ]);
+    });
+
+    // The five presets live in three places that cannot import one another: the dashboard
+    // select, the CLI's preset words, and the core range. Driving the CLI from the GUI's own
+    // list means a change to either side fails here instead of silently disagreeing about
+    // what "First" means.
+    test("the dashboard select and the CLI preset words describe the same five orders", async () => {
+      const presets = ACCOUNT_PRIORITY_PRESETS.map(value => ({
+        value,
+        word: accountPriorityPresetKey(value)?.replace("accountPool.priority", "").toLowerCase(),
+      }));
+      expect(presets.map(preset => preset.word)).toEqual(["first", "earlier", "normal", "later", "last"]);
+
+      for (const { value, word } of presets) {
+        requests.length = 0;
+        const result = await run(["priority", "openai", "chatgpt_1", word!]);
+
+        expect(result.code).toBe(0);
+        expect(priorityRequests()).toEqual([
+          expect.objectContaining({ body: { id: "chatgpt_1", priority: value } }),
+        ]);
+      }
+    });
+
+    test("the dashboard mirrors the core priority range", () => {
+      expect({ fallback: GUI_DEFAULT_PRIORITY, min: GUI_MIN_PRIORITY, max: GUI_MAX_PRIORITY }).toEqual({
+        fallback: DEFAULT_ACCOUNT_PRIORITY,
+        min: MIN_ACCOUNT_PRIORITY,
+        max: MAX_ACCOUNT_PRIORITY,
+      });
+    });
+
+    test("main is translated to the internal id the API expects", async () => {
+      const result = await run(["priority", "openai", "main", "last", "--json"]);
+
+      expect(result.code).toBe(0);
+      expect(JSON.parse(result.stdout)).toEqual({
+        ok: true,
+        provider: "openai",
+        id: "__main__",
+        priority: -2,
+        preset: "last",
+      });
+    });
+
+    test("reset sends null", async () => {
+      await run(["priority", "openai", "chatgpt_1", "reset"]);
+
+      expect(priorityRequests()).toEqual([
+        expect.objectContaining({ body: { id: "chatgpt_1", priority: null } }),
+      ]);
+    });
+
+    test("an omitted value reads the stored order without writing", async () => {
+      const result = await run(["priority", "openai", "chatgpt_1"]);
+
+      expect(result.code).toBe(0);
+      expect(result.stdout).toBe("openai: chatgpt_1 selection order is +1 (earlier)");
+      expect(priorityRequests()).toEqual([]);
+    });
+
+    test("the read emits the same JSON envelope as the write", async () => {
+      const result = await run(["priority", "openai", "chatgpt_1", "--json"]);
+
+      expect(result.code).toBe(0);
+      expect(JSON.parse(result.stdout)).toEqual({
+        ok: true,
+        provider: "openai",
+        id: "chatgpt_1",
+        priority: 1,
+        preset: "earlier",
+      });
+      expect(priorityRequests()).toEqual([]);
+    });
+
+    test("reading main resolves the alias and reports the unset default", async () => {
+      const result = await run(["priority", "openai", "main"]);
+
+      expect(result.code).toBe(0);
+      expect(result.stdout).toBe("openai: main selection order is 0 (normal)");
+      expect(priorityRequests()).toEqual([]);
+    });
+
+    test("reading an unknown id exits one and names the account", async () => {
+      const result = await run(["priority", "openai", "nope"]);
+
+      expect(result.code).toBe(1);
+      expect(result.stdout).toBe("");
+      expect(result.stderr).toContain("no openai account nope");
+      expect(result.stderr).toContain("Usage:");
+    });
+
+    // The inherited names guard the preset lookup: `word in PRIORITY_PRESETS` would
+    // resolve them off Object.prototype and send a non-number to the proxy.
+    test.each(["2.5", "abc", "101", "-101", "constructor", "__proto__", "toString"])(
+      "rejects %s before any HTTP call",
+      async value => {
+        const recording: Array<string> = [];
+        const result = await run(["priority", "openai", "chatgpt_1", value], {
+          ...defaultDeps(),
+          fetchImpl: (async (input: RequestInfo | URL) => {
+            recording.push(String(input));
+            throw new Error("must not be called");
+          }) as typeof fetch,
+        });
+
+        expect(result.code).toBe(1);
+        expect(recording).toEqual([]);
+      },
+    );
+
+    test("a trailing extra argument falls through to usage", async () => {
+      const result = await run(["priority", "openai", "chatgpt_1", "first", "extra"]);
+
+      expect(result.code).toBe(1);
+      expect(result.stderr).toContain("Usage:");
+      expect(result.stderr).toContain("ocx account priority");
+      expect(priorityRequests()).toEqual([]);
+    });
+
+    test("non-Codex providers are rejected", async () => {
+      const result = await run(["priority", "anthropic", "acct_1", "first"]);
+
+      expect(result.code).toBe(1);
+      expect(result.stderr).toContain("only applies to the openai Codex account pool");
+    });
+
+    // Both paths reach the proxy through different helpers — the read through
+    // fetchCodexRows, the write through apiJson — so each needs its own guard.
+    test.each([
+      ["the read", ["priority", "openai", "chatgpt_1"]],
+      ["the write", ["priority", "openai", "chatgpt_1", "first"]],
+    ] as const)("%s reports an unreachable proxy instead of throwing", async (_label, args) => {
+      const result = await run([...args], unreachableDeps());
+
+      expect(result.code).toBe(1);
+      expect(result.stdout).toBe("");
+      expect(result.stderr).toContain("Proxy not reachable");
+      expect(result.stderr).toContain("ocx start");
+      expect(result.stderr).toContain("ocx ensure");
+    });
+
+    test("the advisory note goes to stderr so --json stdout stays parseable", async () => {
+      const result = await run(["priority", "openai", "chatgpt_1", "later", "--json"]);
+
+      expect(result.code).toBe(0);
+      // Both advisory lines, asserted exactly: the pin release is a side effect of a command
+      // that reads as purely declarative, so it has to stay stated rather than drift out.
+      expect(result.stderr).toBe([
+        "Takes effect from the next unbound request; running threads keep their current account until drained.",
+        'Also releases any manual "use this account now" pin, on any account.',
+      ].join("\n"));
+      expect(JSON.parse(result.stdout)).toEqual({
+        ok: true,
+        provider: "openai",
+        id: "chatgpt_1",
+        priority: -1,
+        preset: "later",
+      });
+    });
+  });
+
   describe("38: the authorization code never has to travel through argv", () => {
     // An OAuth redirect URL carries a short-lived credential. Passed as an
     // argument it lands in shell history and is readable via `ps` for as long
diff --git a/tests/cli-headless-parity.test.ts b/tests/cli-headless-parity.test.ts
index 78b030a85..3a07a21d9 100644
--- a/tests/cli-headless-parity.test.ts
+++ b/tests/cli-headless-parity.test.ts
@@ -178,4 +178,41 @@ describe("headless GUI parity CLI", () => {
       rmSync(home, { recursive: true, force: true });
     }
   });
+
+  test("config set releases the manual pin when it writes the selection order", async () => {
+    const home = mkdtempSync(join(tmpdir(), "ocx-cli-priority-pin-"));
+    const previous = process.env.OPENCODEX_HOME;
+    process.env.OPENCODEX_HOME = home;
+    const configPath = join(home, "config.json");
+    const base = {
+      port: 10100,
+      providers: { openai: { adapter: "openai-responses", baseUrl: "https://chatgpt.com/backend-api/codex", authMode: "forward" } },
+      defaultProvider: "openai",
+      activeCodexAccountPinned: "work",
+    };
+    const readPin = () => JSON.parse(readFileSync(configPath, "utf8")).activeCodexAccountPinned;
+    try {
+      // The whole map, one entry, and a removal are all the operator restating the
+      // order, so each releases the pin -- otherwise it keeps capping the tier
+      // ceiling at "work" and the order just written has no visible effect.
+      for (const argv of [
+        ["set", "codexAccountPriorities", '{"work":1}'],
+        ["set", "codexAccountPriorities.work", "2"],
+        ["unset", "codexAccountPriorities"],
+      ]) {
+        writeFileSync(configPath, JSON.stringify({ ...base, codexAccountPriorities: { work: 0 } }));
+        expect(await handleConfigCommand([...argv, "--json"])).toBe(0);
+        expect(readPin()).toBeUndefined();
+      }
+
+      // An unrelated field is not a statement about ordering, so the pin survives.
+      writeFileSync(configPath, JSON.stringify({ ...base, codexAccountPriorities: { work: 1 } }));
+      expect(await handleConfigCommand(["set", "autoSwitchThreshold", "50", "--json"])).toBe(0);
+      expect(readPin()).toBe("work");
+    } finally {
+      if (previous === undefined) delete process.env.OPENCODEX_HOME;
+      else process.env.OPENCODEX_HOME = previous;
+      rmSync(home, { recursive: true, force: true });
+    }
+  });
 });
diff --git a/tests/codex-auth-api.test.ts b/tests/codex-auth-api.test.ts
index 0b7fa9654..12f4c6231 100644
--- a/tests/codex-auth-api.test.ts
+++ b/tests/codex-auth-api.test.ts
@@ -7,7 +7,7 @@ import {
   handleCodexAuthAPI, updateAccountQuota, getAccountQuota,
   checkAccountIdCollision, getMainChatgptAccountId,
   markAccountNeedsReauth, isAccountNeedsReauth, clearAccountNeedsReauth, clearAccountQuota,
-  clearMainAccountInfoCache, maskEmail,
+  clearMainAccountInfoCache, maskEmail, listCodexAuthAccounts,
 } from "../src/codex/auth-api";
 import {
   getCodexAccountCredential,
@@ -549,6 +549,8 @@ describe("codex-auth API", () => {
     const data = await resp!.json() as { activeCodexAccountId: string | null; autoSwitchThreshold: number };
     expect(data).toEqual({
       activeCodexAccountId: "pool-live",
+      pinned: false,
+      pinnedAccountId: null,
       autoSwitchThreshold: 55,
       upstreamFailoverThreshold: 3,
       accountPoolStrategy: "quota",
@@ -1398,6 +1400,244 @@ describe("codex-auth API", () => {
     expect(resolveCodexAccountForThread("runtime-selection", config)).toBe("pool-runtime");
   });
 
+  async function putPriority(config: OcxConfig, body: unknown): Promise<Response> {
+    const req = new Request("http://localhost/api/codex-auth/accounts/priority", {
+      method: "PUT",
+      headers: { "Content-Type": "application/json" },
+      body: typeof body === "string" ? body : JSON.stringify(body),
+    });
+    return (await handleCodexAuthAPI(req, new URL(req.url), config))!;
+  }
+
+  test("PUT /api/codex-auth/accounts/priority persists a pool account's selection order", async () => {
+    const config = makeConfig();
+    seedPoolAccount(config, { id: "work", email: "work@example.test" });
+
+    const resp = await putPriority(config, { id: "work", priority: 2 });
+
+    expect(resp.status).toBe(200);
+    expect(await resp.json()).toMatchObject({ ok: true, id: "work", priority: 2 });
+    expect(config.codexAccountPriorities).toEqual({ work: 2 });
+  });
+
+  test("PUT /api/codex-auth/accounts/priority accepts the main Codex account", async () => {
+    const config = makeConfig();
+
+    const resp = await putPriority(config, { id: MAIN_CODEX_ACCOUNT_ID, priority: -2 });
+
+    expect(resp.status).toBe(200);
+    expect(await resp.json()).toMatchObject({ id: MAIN_CODEX_ACCOUNT_ID, priority: -2 });
+    expect(config.codexAccountPriorities).toEqual({ [MAIN_CODEX_ACCOUNT_ID]: -2 });
+  });
+
+  // The id guard is the one rejection branch with no coverage: the priority-value and
+  // request-body tables below already cover theirs. It is also the load-bearing guard --
+  // it is what keeps a prototype key out of the priorities map -- and neither the CLI
+  // (which validates ids before issuing the PUT) nor the dashboard (which can only name
+  // accounts it just listed) can reach it, so only a direct request exercises it.
+  test.each([
+    ["a prototype key", "__proto__"],
+    ["the prototype property", "prototype"],
+    ["the constructor property", "constructor"],
+    ["an id containing a space", "has space"],
+    ["an over-long id", "a".repeat(65)],
+    ["an empty id", ""],
+    ["a non-string id", 123],
+    ["a null id", null],
+  ] as const)("rejects %s before any write", async (_label, id) => {
+    const config = makeConfig();
+    seedPoolAccount(config, { id: "work", email: "work@example.test" });
+
+    const resp = await putPriority(config, { id, priority: 1 });
+
+    expect(resp.status).toBe(400);
+    expect(await resp.json()).toMatchObject({ error: "Invalid account id format" });
+    expect(config.codexAccountPriorities).toBeUndefined();
+  });
+
+  // A pin predating any stored order would otherwise outrank it forever: it blocks
+  // preemption and caps every eligibility list at its own tier. Setting an order is the
+  // newer statement of intent, so it releases the pin rather than losing to it.
+  test("setting a selection order releases a pin, whichever account was pinned", async () => {
+    const config = makeConfig({ activeCodexAccountPinned: "side" });
+    seedPoolAccount(config, { id: "work", email: "work@example.test" });
+    seedPoolAccount(config, { id: "side", email: "side@example.test" });
+
+    const resp = await putPriority(config, { id: "work", priority: 1 });
+
+    expect(resp.status).toBe(200);
+    expect(config.codexAccountPriorities).toEqual({ work: 1 });
+    expect(config.activeCodexAccountPinned).toBeUndefined();
+  });
+
+  test("a null priority resets the account and drops an emptied map", async () => {
+    const config = makeConfig({ codexAccountPriorities: { work: 2 } });
+    seedPoolAccount(config, { id: "work", email: "work@example.test" });
+
+    const resp = await putPriority(config, { id: "work", priority: null });
+
+    expect(resp.status).toBe(200);
+    expect(await resp.json()).toMatchObject({ id: "work", priority: 0 });
+    expect(config.codexAccountPriorities).toBeUndefined();
+  });
+
+  test.each([
+    ["a fraction", 1.5],
+    ["a numeric string", "2"],
+    ["a boolean", true],
+    ["an array", []],
+    ["an object", {}],
+    ["above the range", 101],
+    ["below the range", -101],
+    // An omitted key, which JSON cannot distinguish from an explicit undefined. Only `null`
+    // means reset; a body with no priority at all is a malformed request, not a reset.
+    // Deliberately no NaN case: JSON.stringify turns NaN into null, which this route
+    // legitimately reads as a reset, so asserting a 400 would assert something unreachable.
+    // NaN is covered where it can occur, against parseAccountPriority in
+    // tests/codex-pool-rotation.test.ts.
+    ["a missing value", undefined],
+  ] as const)("rejects %s as a selection order", async (_label, priority) => {
+    const config = makeConfig();
+    seedPoolAccount(config, { id: "work", email: "work@example.test" });
+
+    const resp = await putPriority(config, { id: "work", priority });
+
+    expect(resp.status).toBe(400);
+    // The message too, not just the status: the id guard and the exists check also answer
+    // 400/404 here, so a status-only assertion would pass if validation order regressed.
+    expect(await resp.json()).toMatchObject({
+      error: expect.stringContaining("priority must be null or an integer"),
+    });
+    expect(config.codexAccountPriorities).toBeUndefined();
+  });
+
+  test.each([
+    ["a JSON array", "[1]"],
+    ["a JSON string", '"work"'],
+    ["a bare number", "7"],
+    ["JSON null", "null"],
+  ] as const)("rejects %s as a request body", async (_label, body) => {
+    const resp = await putPriority(makeConfig(), body);
+    expect(resp.status).toBe(400);
+    expect(await resp.json()).toMatchObject({ error: "body must be an object" });
+  });
+
+  test("rejects malformed JSON as a request body", async () => {
+    const config = makeConfig();
+
+    const resp = await putPriority(config, "{not json");
+
+    expect(resp.status).toBe(400);
+    // A distinct message from the not-an-object case: the parse fails before the shape
+    // check, and collapsing the two would hide a body that parsed but was the wrong type.
+    expect(await resp.json()).toMatchObject({ error: "Invalid JSON" });
+    expect(config.codexAccountPriorities).toBeUndefined();
+  });
+
+  test("an unknown account id is a 404 and writes nothing", async () => {
+    const config = makeConfig();
+
+    const resp = await putPriority(config, { id: "missing", priority: 1 });
+
+    expect(resp.status).toBe(404);
+    expect(config.codexAccountPriorities).toBeUndefined();
+  });
+
+  test("selection order is independent of alias, pause, and active selection", async () => {
+    const config = makeConfig({ activeCodexAccountId: "work" });
+    seedPoolAccount(config, { id: "work", email: "work@example.test" });
+
+    await putPriority(config, { id: "work", priority: 1 });
+
+    expect(config.codexAccountPriorities).toEqual({ work: 1 });
+    expect(config.pausedCodexAccountIds).toBeUndefined();
+    expect(config.activeCodexAccountId).toBe("work");
+    expect(config.codexAccounts?.[0]?.alias).toBeUndefined();
+  });
+
+  test("the account list reports selection order, defaulting to zero", async () => {
+    const config = makeConfig({ codexAccountPriorities: { work: 2 } });
+    seedPoolAccount(config, { id: "work", email: "work@example.test" });
+    seedPoolAccount(config, { id: "side", email: "side@example.test" });
+
+    const accounts = await listCodexAuthAccounts(config);
+
+    expect(accounts.find(a => a.id === "work")?.priority).toBe(2);
+    expect(accounts.find(a => a.id === "side")?.priority).toBe(0);
+    expect(accounts.find(a => a.isMain)?.priority).toBe(0);
+  });
+
+  test("GET /api/codex-auth/active reports an operator pin but not an automatic pick", async () => {
+    const config = makeConfig({ activeCodexAccountId: "work" });
+    seedPoolAccount(config, { id: "work", email: "work@example.test" });
+
+    const read = async () => {
+      const req = new Request("http://localhost/api/codex-auth/active");
+      return (await (await handleCodexAuthAPI(req, new URL(req.url), config))!.json()) as { pinned: boolean };
+    };
+    expect((await read()).pinned).toBe(false);
+
+    const selectReq = new Request("http://localhost/api/codex-auth/active", {
+      method: "PUT",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ accountId: "work" }),
+    });
+    await handleCodexAuthAPI(selectReq, new URL(selectReq.url), config);
+
+    expect(config.activeCodexAccountPinned).toBe("work");
+    expect((await read()).pinned).toBe(true);
+  });
+
+  // Under round-robin the pin caps the tier while the cursor moves inside it, so `pinned`
+  // alone cannot tell a surface which card to mark. The id is reported independently.
+  test("GET /api/codex-auth/active names the pinned account even when it is not active", async () => {
+    const config = makeConfig({ activeCodexAccountId: "side", activeCodexAccountPinned: "work" });
+    seedPoolAccount(config, { id: "work", email: "work@example.test" });
+    seedPoolAccount(config, { id: "side", email: "side@example.test" });
+
+    const req = new Request("http://localhost/api/codex-auth/active");
+    const data = await (await handleCodexAuthAPI(req, new URL(req.url), config))!.json() as
+      { pinned: boolean; pinnedAccountId: string | null };
+
+    expect(data.pinned).toBe(false);
+    expect(data.pinnedAccountId).toBe("work");
+  });
+
+  // A null id clears the selection rather than making one, so it must not leave a pin
+  // behind. Pinning the __main__ fallback would produce a pin no effective active
+  // account matches: GET reports pinned:false while selectPriorityTier still honours it
+  // as a floor, silently capping the pool at the main account's tier — the exact
+  // inverse of ordering main last, with no surface that shows or clears it.
+  test("clearing the active account releases the pin instead of pinning main", async () => {
+    const config = makeConfig({
+      activeCodexAccountId: "work",
+      codexAccountPriorities: { [MAIN_CODEX_ACCOUNT_ID]: -2 },
+    });
+    seedPoolAccount(config, { id: "work", email: "work@example.test" });
+
+    const select = new Request("http://localhost/api/codex-auth/active", {
+      method: "PUT",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ accountId: "work" }),
+    });
+    await handleCodexAuthAPI(select, new URL(select.url), config);
+    expect(config.activeCodexAccountPinned).toBe("work");
+
+    const clear = new Request("http://localhost/api/codex-auth/active", {
+      method: "PUT",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ accountId: null }),
+    });
+    const resp = await handleCodexAuthAPI(clear, new URL(clear.url), config);
+
+    expect(resp!.status).toBe(200);
+    expect(config.activeCodexAccountId).toBeUndefined();
+    expect(config.activeCodexAccountPinned).toBeUndefined();
+    const req = new Request("http://localhost/api/codex-auth/active");
+    expect(await (await handleCodexAuthAPI(req, new URL(req.url), config))!.json())
+      .toMatchObject({ pinned: false });
+  });
+
   test("PUT /api/codex-auth/accounts/pause-exhausted pauses only freshly confirmed exhausted accounts", async () => {
     const config = makeConfig({
       codexAccounts: [
diff --git a/tests/codex-pool-rotation.test.ts b/tests/codex-pool-rotation.test.ts
index f16f84dfb..79a67a91b 100644
--- a/tests/codex-pool-rotation.test.ts
+++ b/tests/codex-pool-rotation.test.ts
@@ -1,12 +1,24 @@
 import {
   clearPoolRotationState,
+  DEFAULT_ACCOUNT_PRIORITY,
+  normalizeAccountPriority,
   notePoolRotationSuccess,
+  parseAccountPriority,
   peekRoundRobinAccount,
   pickRoundRobinAccount,
+  selectPriorityTier,
 } from "../src/codex/pool-rotation";
+import {
+  clearCodexAccountPin,
+  codexAccountPriorityLookup,
+  forgetCodexAccountPriority,
+  getCodexAccountPriority,
+  setCodexAccountPriority,
+} from "../src/codex/account-priority";
 import {
   clearCodexUpstreamHealth,
   clearThreadAccountMap,
+  CODEX_TRANSIENT_SOFT_AVOID_MS,
   getEffectiveActiveCodexAccountId,
   isCodexAccountInCooldown,
   pickAlternateCodexAccount,
@@ -72,6 +84,187 @@ function shareSpreadPercent(counts: Record<string, number>, total: number): numb
   return Math.max(...shares) - Math.min(...shares);
 }
 
+describe("account selection order parsing", () => {
+  test("parseAccountPriority accepts integers inside the configurable range", () => {
+    expect(parseAccountPriority(0)).toBe(0);
+    expect(parseAccountPriority(2)).toBe(2);
+    expect(parseAccountPriority(-2)).toBe(-2);
+    expect(parseAccountPriority(100)).toBe(100);
+    expect(parseAccountPriority(-100)).toBe(-100);
+  });
+
+  test("parseAccountPriority rejects non-integers, wrong types, and out-of-range values", () => {
+    for (const raw of [1.5, "2", true, null, undefined, [], {}, Number.NaN, 101, -101, Number.POSITIVE_INFINITY]) {
+      expect(parseAccountPriority(raw)).toBeNull();
+    }
+  });
+
+  test("normalizeAccountPriority degrades anything unparseable to the default tier", () => {
+    expect(normalizeAccountPriority(3)).toBe(3);
+    expect(normalizeAccountPriority("3")).toBe(DEFAULT_ACCOUNT_PRIORITY);
+    expect(normalizeAccountPriority(undefined)).toBe(DEFAULT_ACCOUNT_PRIORITY);
+  });
+});
+
+describe("selectPriorityTier", () => {
+  const withHeadroom = () => true;
+  const noHeadroom = () => false;
+  const flat = () => 0;
+
+  test("returns the input untouched when every account shares one tier", () => {
+    const ids = ["a", "b", "c"];
+    expect(selectPriorityTier(ids, flat, withHeadroom)).toBe(ids);
+  });
+
+  test("keeps only the highest tier that still has headroom", () => {
+    const priorities: Record<string, number> = { a: 1, b: 0, c: 1 };
+    const selected = selectPriorityTier(["a", "b", "c"], id => priorities[id]!, withHeadroom);
+    expect(selected).toEqual(["a", "c"]);
+  });
+
+  test("preserves input order inside the selected tier", () => {
+    const priorities: Record<string, number> = { __main__: 0, a: 0, b: -1 };
+    const selected = selectPriorityTier(["__main__", "a", "b"], id => priorities[id]!, withHeadroom);
+    expect(selected).toEqual(["__main__", "a"]);
+  });
+
+  test("falls through to the next tier once the tier above is drained", () => {
+    const priorities: Record<string, number> = { a: 1, b: 0 };
+    const selected = selectPriorityTier(["a", "b"], id => priorities[id]!, id => id !== "a");
+    expect(selected).toEqual(["b"]);
+  });
+
+  test("returns the input unchanged when every tier is drained", () => {
+    const priorities: Record<string, number> = { a: 1, b: 0 };
+    const ids = ["a", "b"];
+    expect(selectPriorityTier(ids, id => priorities[id]!, noHeadroom)).toBe(ids);
+  });
+
+  test("a pinned account with headroom lowers the ceiling to its own tier", () => {
+    const priorities: Record<string, number> = { a: 1, b: 0, c: 0 };
+    const selected = selectPriorityTier(["a", "b", "c"], id => priorities[id]!, withHeadroom, "b");
+    expect(selected).toEqual(["b", "c"]);
+  });
+
+  test("a drained pin is ignored so ordering resumes on its own", () => {
+    const priorities: Record<string, number> = { a: 1, b: 0 };
+    const selected = selectPriorityTier(["a", "b"], id => priorities[id]!, id => id !== "b", "b");
+    expect(selected).toEqual(["a"]);
+  });
+
+  test("a pin that is no longer eligible is ignored", () => {
+    const priorities: Record<string, number> = { a: 1, b: 0 };
+    const selected = selectPriorityTier(["a", "b"], id => priorities[id]!, withHeadroom, "gone");
+    expect(selected).toEqual(["a"]);
+  });
+
+  // The ceiling picks a tier, it does not pick accounts: a drained member stays in
+  // the returned list so the strategy behind it still sees the whole tier.
+  test("the pinned tier comes back whole, drained siblings included", () => {
+    const priorities: Record<string, number> = { a: 1, b: 0, c: 0 };
+    const selected = selectPriorityTier(["a", "b", "c"], id => priorities[id]!, id => id !== "c", "b");
+    expect(selected).toEqual(["b", "c"]);
+  });
+});
+
+describe("setCodexAccountPriority", () => {
+  test("stores a non-default order under the account id", () => {
+    const config = makeConfig();
+    setCodexAccountPriority(config, "a", 2);
+    expect(config.codexAccountPriorities).toEqual({ a: 2 });
+    expect(getCodexAccountPriority(config, "a")).toBe(2);
+  });
+
+  test("writing the default order removes that account's entry", () => {
+    const config = makeConfig({ codexAccountPriorities: { a: 1, b: 2 } } as Partial<OcxConfig>);
+    setCodexAccountPriority(config, "a", DEFAULT_ACCOUNT_PRIORITY);
+    expect(config.codexAccountPriorities).toEqual({ b: 2 });
+    expect(getCodexAccountPriority(config, "a")).toBe(DEFAULT_ACCOUNT_PRIORITY);
+  });
+
+  // An empty map would still be a stored map, and routing's fast path keys off the
+  // key being absent — a pool that was ordered and then reset must look unordered.
+  test("emptying the map drops the config key entirely", () => {
+    const config = makeConfig({ codexAccountPriorities: { a: 1 } } as Partial<OcxConfig>);
+    setCodexAccountPriority(config, "a", DEFAULT_ACCOUNT_PRIORITY);
+    expect(Object.hasOwn(config, "codexAccountPriorities")).toBe(false);
+  });
+
+  test("forgetCodexAccountPriority leaves the other accounts' order alone", () => {
+    const config = makeConfig({ codexAccountPriorities: { a: 1, b: -3 } } as Partial<OcxConfig>);
+    forgetCodexAccountPriority(config, "b");
+    expect(config.codexAccountPriorities).toEqual({ a: 1 });
+  });
+
+  // A plain assignment to a reserved key hits Object.prototype's setter and stores
+  // nothing; the entry must land as an own data property with the map's own shape intact.
+  test("a reserved key is stored as an own data property", () => {
+    const config = makeConfig();
+    setCodexAccountPriority(config, "__proto__", 3);
+
+    const priorities = config.codexAccountPriorities!;
+    expect(Object.hasOwn(priorities, "__proto__")).toBe(true);
+    expect(Object.getPrototypeOf(priorities)).toBe(Object.prototype);
+    expect(getCodexAccountPriority(config, "__proto__")).toBe(3);
+  });
+});
+
+describe("codexAccountPriorityLookup", () => {
+  test("reports the stored order for a configured account", () => {
+    const config = makeConfig({ codexAccountPriorities: { a: 2 } } as Partial<OcxConfig>);
+    const priorityOf = codexAccountPriorityLookup(config);
+    expect(priorityOf("a")).toBe(2);
+    expect(priorityOf("b")).toBe(DEFAULT_ACCOUNT_PRIORITY);
+  });
+
+  // `constructor` resolves on Object.prototype, so an ungated read would hand a
+  // function to normalization instead of reporting "this account has no order".
+  test("inherited members of the map are not a selection order", () => {
+    const config = makeConfig({ codexAccountPriorities: { a: 2 } } as Partial<OcxConfig>);
+    const priorityOf = codexAccountPriorityLookup(config);
+    expect(priorityOf("constructor")).toBe(DEFAULT_ACCOUNT_PRIORITY);
+    expect(priorityOf("toString")).toBe(DEFAULT_ACCOUNT_PRIORITY);
+  });
+
+  test("an unordered pool answers with the default for every account", () => {
+    const priorityOf = codexAccountPriorityLookup(makeConfig());
+    expect(priorityOf("a")).toBe(DEFAULT_ACCOUNT_PRIORITY);
+    expect(priorityOf("constructor")).toBe(DEFAULT_ACCOUNT_PRIORITY);
+  });
+
+  test("an unparseable stored order degrades to the default tier", () => {
+    const config = makeConfig({ codexAccountPriorities: { a: 1.5, b: 999 } } as Partial<OcxConfig>);
+    const priorityOf = codexAccountPriorityLookup(config);
+    expect(priorityOf("a")).toBe(DEFAULT_ACCOUNT_PRIORITY);
+    expect(priorityOf("b")).toBe(DEFAULT_ACCOUNT_PRIORITY);
+  });
+});
+
+describe("clearCodexAccountPin", () => {
+  test("releases whatever is pinned when no account is named", () => {
+    const config = makeConfig({ activeCodexAccountPinned: "a" } as Partial<OcxConfig>);
+    clearCodexAccountPin(config);
+    expect(config.activeCodexAccountPinned).toBeUndefined();
+    // Deleted rather than set to undefined, so the saved config carries no key.
+    expect(Object.hasOwn(config, "activeCodexAccountPinned")).toBe(false);
+  });
+
+  test("releases only the named account", () => {
+    const config = makeConfig({ activeCodexAccountPinned: "a" } as Partial<OcxConfig>);
+    clearCodexAccountPin(config, "b");
+    expect(config.activeCodexAccountPinned).toBe("a");
+
+    clearCodexAccountPin(config, "a");
+    expect(config.activeCodexAccountPinned).toBeUndefined();
+  });
+
+  test("is a no-op when nothing is pinned", () => {
+    const config = makeConfig();
+    clearCodexAccountPin(config, "a");
+    expect(config.activeCodexAccountPinned).toBeUndefined();
+  });
+});
+
 describe("pickRoundRobinAccount", () => {
   beforeEach(() => clearPoolRotationState());
 
@@ -525,3 +718,280 @@ describe("accountPoolStrategy new-session routing", () => {
     expect(config.activeCodexAccountId).toBe("a");
   });
 });
+
+describe("selection order across rotation strategies", () => {
+  beforeEach(() => {
+    previousOpencodexHome = process.env.OPENCODEX_HOME;
+    if (existsSync(TEST_DIR)) rmSync(TEST_DIR, { recursive: true });
+    mkdirSync(TEST_DIR, { recursive: true });
+    process.env.OPENCODEX_HOME = TEST_DIR;
+    previousCodexHome = process.env.CODEX_HOME;
+    process.env.CODEX_HOME = TEST_DIR;
+    clearThreadAccountMap();
+    clearCodexUpstreamHealth();
+    clearAccountQuota();
+    clearPoolRotationState();
+  });
+
+  afterEach(() => {
+    clearAccountQuota();
+    clearCodexUpstreamHealth();
+    clearThreadAccountMap();
+    clearPoolRotationState();
+    if (previousOpencodexHome === undefined) delete process.env.OPENCODEX_HOME;
+    else process.env.OPENCODEX_HOME = previousOpencodexHome;
+    if (previousCodexHome === undefined) delete process.env.CODEX_HOME;
+    else process.env.CODEX_HOME = previousCodexHome;
+    if (existsSync(TEST_DIR)) rmSync(TEST_DIR, { recursive: true });
+  });
+
+  function primeAllQuota(usage = 10): void {
+    for (const id of THREE_ACCOUNT_IDS) updateAccountQuota(id, usage);
+  }
+
+  test("round-robin spreads only across the highest tier", () => {
+    const config = makeThreeAccountConfig({
+      accountPoolStrategy: "round-robin",
+      codexAccountPriorities: { a: 1, b: 1 },
+    } as Partial<OcxConfig>);
+    primeAllQuota();
+
+    const picks = Array.from({ length: 12 }, () => resolveCodexAccountForThread(null, config));
+    expect(countPicks(picks, THREE_ACCOUNT_IDS)).toEqual({ a: 6, b: 6, c: 0 });
+  });
+
+  test("round-robin falls through to the next tier when the one above drains", () => {
+    const config = makeThreeAccountConfig({
+      accountPoolStrategy: "round-robin",
+      codexAccountPriorities: { a: 1, b: 1 },
+    } as Partial<OcxConfig>);
+    primeAllQuota();
+    updateAccountQuota("a", 95);
+    updateAccountQuota("b", 95);
+
+    const picks = Array.from({ length: 4 }, () => resolveCodexAccountForThread(null, config));
+    expect(countPicks(picks, THREE_ACCOUNT_IDS)).toEqual({ a: 0, b: 0, c: 4 });
+  });
+
+  test("round-robin returns to the higher tier after its quota resets", () => {
+    const config = makeThreeAccountConfig({
+      accountPoolStrategy: "round-robin",
+      codexAccountPriorities: { a: 1 },
+    } as Partial<OcxConfig>);
+    primeAllQuota();
+    updateAccountQuota("a", 95);
+    expect(resolveCodexAccountForThread(null, config)).not.toBe("a");
+
+    updateAccountQuota("a", 5);
+    expect(resolveCodexAccountForThread(null, config)).toBe("a");
+  });
+
+  test("a pinned account holds round-robin until it crosses the threshold", () => {
+    const config = makeThreeAccountConfig({
+      accountPoolStrategy: "round-robin",
+      codexAccountPriorities: { a: 1, b: 1 },
+      activeCodexAccountPinned: "c",
+    } as Partial<OcxConfig>);
+    primeAllQuota();
+
+    const held = Array.from({ length: 4 }, () => resolveCodexAccountForThread(null, config));
+    expect(countPicks(held, THREE_ACCOUNT_IDS)).toEqual({ a: 0, b: 0, c: 4 });
+
+    updateAccountQuota("c", 95);
+    expect(resolveCodexAccountForThread(null, config)).not.toBe("c");
+  });
+
+  test("fill-first drains the highest tier before descending", () => {
+    const config = makeThreeAccountConfig({
+      accountPoolStrategy: "fill-first",
+      activeCodexAccountId: undefined,
+      codexAccountPriorities: { c: 1 },
+    } as Partial<OcxConfig>);
+    primeAllQuota();
+
+    expect(resolveCodexAccountForThread(null, config)).toBe("c");
+    updateAccountQuota("c", 95);
+    expect(resolveCodexAccountForThread(null, config)).toBe("a");
+  });
+
+  test("an alternate crosses tiers when the exclusion empties the tier above", () => {
+    const config = makeThreeAccountConfig({ codexAccountPriorities: { a: 1 } } as Partial<OcxConfig>);
+    primeAllQuota();
+
+    // Without the exclusion reaching eligibility the tier walk would select
+    // ["a"] and the caller's post-filter would leave nothing to fail over to.
+    expect(pickAlternateCodexAccount(config, "a")).toBe("b");
+  });
+
+  test("an independent native scope tiers on its own health snapshot", () => {
+    const config = makeThreeAccountConfig({
+      codexAccountPriorities: { a: 1 },
+    } as Partial<OcxConfig>);
+    const now = 1_800_000_000_000;
+    primeAllQuota();
+
+    expect(resolveCodexAccountForThread(null, config, now, "shared")).toBe("a");
+    recordCodexUpstreamOutcome(config, "a", 429, {
+      now: now + 1,
+      resetAt: Math.floor((now + 4 * 24 * 60 * 60_000) / 1_000),
+      modelId: "gpt-5.3-codex-spark",
+    });
+
+    expect(resolveCodexAccountForThread(null, config, now + 2, "spark")).toBe("b");
+    expect(resolveCodexAccountForThread(null, config, now + 3, "shared")).toBe("a");
+  });
+
+  test("preemption inside an independent scope leaves the shared cursor alone", () => {
+    const config = makeThreeAccountConfig({
+      activeCodexAccountId: "b",
+      codexAccountPriorities: { a: 1 },
+    } as Partial<OcxConfig>);
+    const now = 1_800_000_000_000;
+    primeAllQuota();
+
+    expect(resolveCodexAccountForThread(null, config, now, "spark")).toBe("a");
+    expect(getEffectiveActiveCodexAccountId(config)).toBe("b");
+  });
+
+  test("an affined thread keeps its account while retiring a drained manual pin", () => {
+    const config = makeThreeAccountConfig({
+      accountPoolStrategy: "round-robin",
+      activeCodexAccountId: "a",
+      activeCodexAccountPinned: "a",
+      codexAccountPriorities: { b: 1 },
+    } as Partial<OcxConfig>);
+    primeAllQuota();
+
+    expect(resolveCodexAccountForThread("pinned-thread", config)).toBe("a");
+    updateAccountQuota("a", 95);
+
+    // Affinity wins, but the spent operator ceiling is durably over.
+    expect(resolveCodexAccountForThread("pinned-thread", config)).toBe("a");
+    expect(config.activeCodexAccountPinned).toBeUndefined();
+
+    // If the stale pin had survived, restoring A's quota would cap the pool at
+    // A's lower tier again and suppress B.
+    updateAccountQuota("a", 5);
+    expect(resolveCodexAccountForThread(null, config)).toBe("b");
+  });
+
+  test("an independent scope does not retire the shared manual pin", () => {
+    const config = makeThreeAccountConfig({
+      activeCodexAccountId: "a",
+      activeCodexAccountPinned: "a",
+      codexAccountPriorities: { b: 1 },
+    } as Partial<OcxConfig>);
+    primeAllQuota();
+    updateAccountQuota("a", 95);
+
+    expect(resolveCodexAccountForThread(null, config, Date.now(), "spark")).toBe("b");
+    expect(config.activeCodexAccountPinned).toBe("a");
+    expect(getEffectiveActiveCodexAccountId(config)).toBe("a");
+  });
+
+  test("an independent-scope account-wide 429 leaves shared routing state alone", () => {
+    const config = makeThreeAccountConfig({
+      accountPoolStrategy: "round-robin",
+      activeCodexAccountId: "a",
+    });
+    primeAllQuota();
+
+    recordCodexUpstreamOutcome(config, "a", 429, {
+      modelId: "gpt-5.3-codex-spark",
+    });
+
+    expect(getEffectiveActiveCodexAccountId(config)).toBe("a");
+    expect(config.activeCodexAccountId).toBe("a");
+  });
+
+  test("an independent-scope transient failover leaves shared routing state alone", () => {
+    const config = makeThreeAccountConfig({
+      accountPoolStrategy: "round-robin",
+      activeCodexAccountId: "a",
+      upstreamFailoverThreshold: 1,
+    });
+    primeAllQuota();
+
+    recordCodexUpstreamOutcome(config, "a", 503, {
+      modelId: "gpt-5.3-codex-spark",
+    });
+
+    expect(getEffectiveActiveCodexAccountId(config)).toBe("a");
+    expect(config.activeCodexAccountId).toBe("a");
+  });
+
+  test("an independent scope still leaves shared routing alone once its soft avoid expires", () => {
+    // Suppressing the promotion at the moment of the failure is not enough: the
+    // failure streak outlives the soft avoid, so there is a window where the account
+    // is selectable again while shouldFailover still trips. A scoped resolve lands in
+    // applyFailureFailover there, and that is the second place shared state can move.
+    const config = makeThreeAccountConfig({
+      activeCodexAccountId: "a",
+      upstreamFailoverThreshold: 1,
+    } as Partial<OcxConfig>);
+    primeAllQuota();
+    const failedAt = Date.now();
+
+    recordCodexUpstreamOutcome(config, "a", 503, {
+      modelId: "gpt-5.3-codex-spark",
+      now: failedAt,
+    });
+
+    // Past the 30s soft avoid, inside the 5-minute failure window.
+    const afterSoftAvoid = failedAt + CODEX_TRANSIENT_SOFT_AVOID_MS + 1_000;
+    const routed = resolveCodexAccountForThread(null, config, afterSoftAvoid, "spark");
+
+    // Asserted first because it is what proves the resolve reached applyFailureFailover
+    // at all: "a" is selectable again by now, so only the still-tripped streak routes
+    // away from it. Without this the two shared-state assertions would also hold if the
+    // request never got that far, and the guard under test would go unexercised.
+    expect(routed).toBe("b");
+    expect(getEffectiveActiveCodexAccountId(config)).toBe("a");
+    expect(config.activeCodexAccountId).toBe("a");
+  });
+
+  test.each([
+    ["quota", ["a", "a", "a", "a", "a", "a"]],
+    ["round-robin", ["a", "b", "c", "a", "b", "c"]],
+    ["fill-first", ["b", "c", "a", "b", "c", "a"]],
+  ] as const)(
+    "%s preserves its pre-feature fallback when every ordered tier is drained",
+    (strategy, expected) => {
+      const config = makeThreeAccountConfig({
+        accountPoolStrategy: strategy,
+        codexAccountPriorities: { a: 2, b: 1 },
+      } as Partial<OcxConfig>);
+      primeAllQuota(95);
+
+      const picks = Array.from({ length: 6 }, () => resolveCodexAccountForThread(null, config));
+      expect(picks).toEqual([...expected]);
+    },
+  );
+
+  // The expected sequences are the pre-feature ones, recorded literally. Comparing an
+  // unset config against an all-zero one only proves the two agree — both take the
+  // same fast path — so the literal is what actually guards against a regression.
+  test.each([
+    ["quota", ["a", "a", "a", "a", "a", "a"]],
+    ["round-robin", ["a", "b", "c", "a", "b", "c"]],
+    ["fill-first", ["a", "a", "a", "a", "a", "a"]],
+  ] as const)(
+    "%s picks the same sequence with no stored order as before the feature",
+    (strategy, expected) => {
+      const config = makeThreeAccountConfig({ accountPoolStrategy: strategy });
+      primeAllQuota();
+      const picks = Array.from({ length: 6 }, () => resolveCodexAccountForThread(null, config));
+
+      clearPoolRotationState();
+      clearThreadAccountMap();
+      const flat = makeThreeAccountConfig({
+        accountPoolStrategy: strategy,
+        codexAccountPriorities: { a: 0, b: 0, c: 0 },
+      } as Partial<OcxConfig>);
+      const flatPicks = Array.from({ length: 6 }, () => resolveCodexAccountForThread(null, flat));
+
+      expect(picks).toEqual([...expected]);
+      expect(flatPicks).toEqual([...expected]);
+    },
+  );
+});
diff --git a/tests/codex-routing.test.ts b/tests/codex-routing.test.ts
index 351e98e84..1c421bffb 100644
--- a/tests/codex-routing.test.ts
+++ b/tests/codex-routing.test.ts
@@ -24,12 +24,15 @@ import {
   isCodexAccountSoftAvoided,
   pickLowestUsageCodexAccount,
   parseRetryAfterMs,
+  previewCodexAccountForRequest,
+  reconcileCodexActiveAfterExclusion,
   recordCodexUpstreamOutcome,
   resetCodexRoutingForManualSelection,
   resolveCodexAccountForThread,
   resolveCodexAccountForThreadDetailed,
   tryAcquireCodexQuotaProbeLease,
 } from "../src/codex/routing";
+import { clearPoolRotationState } from "../src/codex/pool-rotation";
 import { removeCodexAccountCredential, saveCodexAccountCredential } from "../src/codex/account-store";
 import {
   clearAccountNeedsReauth,
@@ -1426,3 +1429,248 @@ describe("codex routing", () => {
     expect(resolveCodexAccountForThread("t2", config, now + 6)).toBe("b");
   });
 });
+
+describe("codex account selection order", () => {
+  beforeEach(() => {
+    previousOpencodexHome = process.env.OPENCODEX_HOME;
+    if (existsSync(TEST_DIR)) rmSync(TEST_DIR, { recursive: true });
+    mkdirSync(TEST_DIR, { recursive: true });
+    process.env.OPENCODEX_HOME = TEST_DIR;
+    previousCodexHome = process.env.CODEX_HOME;
+    process.env.CODEX_HOME = TEST_DIR;
+    clearThreadAccountMap();
+    clearCodexUpstreamHealth();
+    clearAccountQuota();
+    clearPoolRotationState();
+    clearAccountNeedsReauth("a");
+    clearAccountNeedsReauth("b");
+    saveTestCredential("a");
+    saveTestCredential("b");
+  });
+
+  afterEach(() => {
+    clearAccountQuota();
+    clearCodexUpstreamHealth();
+    clearThreadAccountMap();
+    clearPoolRotationState();
+    clearAccountNeedsReauth("a");
+    clearAccountNeedsReauth("b");
+    if (previousOpencodexHome === undefined) delete process.env.OPENCODEX_HOME;
+    else process.env.OPENCODEX_HOME = previousOpencodexHome;
+    if (previousCodexHome === undefined) delete process.env.CODEX_HOME;
+    else process.env.CODEX_HOME = previousCodexHome;
+    if (existsSync(TEST_DIR)) rmSync(TEST_DIR, { recursive: true });
+  });
+
+  /** `a` is ordered above `b`; the persisted operator selection is the lower tier. */
+  function orderedConfig(overrides: Partial<OcxConfig> = {}): OcxConfig {
+    return makeConfig({
+      activeCodexAccountId: "b",
+      codexAccountPriorities: { a: 1 },
+      ...overrides,
+    } as Partial<OcxConfig>);
+  }
+
+  test("an unbound request moves back up to the higher tier even when it is hotter", () => {
+    const config = orderedConfig();
+    updateAccountQuota("a", 70);
+    updateAccountQuota("b", 10);
+
+    expect(resolveCodexAccountForThread(null, config)).toBe("a");
+  });
+
+  test("preemption keeps the operator's persisted selection intact", () => {
+    const config = orderedConfig();
+    updateAccountQuota("a", 10);
+    updateAccountQuota("b", 10);
+
+    expect(resolveCodexAccountForThread(null, config)).toBe("a");
+    expect(config.activeCodexAccountId).toBe("b");
+    expect(getEffectiveActiveCodexAccountId(config)).toBe("a");
+  });
+
+  test("falls through to the lower tier once the higher one is over threshold", () => {
+    const config = orderedConfig();
+    updateAccountQuota("a", 90);
+    updateAccountQuota("b", 10);
+
+    expect(resolveCodexAccountForThread(null, config)).toBe("b");
+  });
+
+  test("returns to the higher tier as soon as its quota window resets", () => {
+    const config = orderedConfig();
+    updateAccountQuota("a", 90);
+    updateAccountQuota("b", 10);
+    expect(resolveCodexAccountForThread(null, config)).toBe("b");
+
+    updateAccountQuota("a", 5);
+    expect(resolveCodexAccountForThread(null, config)).toBe("a");
+  });
+
+  test("unknown usage never drains a tier", () => {
+    const config = orderedConfig();
+    updateAccountQuota("b", 10);
+
+    expect(resolveCodexAccountForThread(null, config)).toBe("a");
+  });
+
+  test("every tier over threshold reproduces the stay-put behaviour", () => {
+    const config = orderedConfig();
+    updateAccountQuota("a", 95);
+    updateAccountQuota("b", 95);
+
+    expect(resolveCodexAccountForThread(null, config)).toBe("b");
+  });
+
+  test("a disabled auto-switch threshold makes ordering strict", () => {
+    const config = orderedConfig({ autoSwitchThreshold: 0 });
+    updateAccountQuota("a", 99);
+    updateAccountQuota("b", 1);
+
+    expect(resolveCodexAccountForThread(null, config)).toBe("a");
+  });
+
+  test("preview and resolve agree under tiering", () => {
+    const config = orderedConfig();
+    updateAccountQuota("a", 70);
+    updateAccountQuota("b", 10);
+
+    expect(previewCodexAccountForRequest(null, config)).toBe("a");
+    expect(resolveCodexAccountForThread(null, config)).toBe("a");
+  });
+
+  test("a manually pinned account outranks selection order", () => {
+    const config = orderedConfig({ activeCodexAccountPinned: "b" } as Partial<OcxConfig>);
+    updateAccountQuota("a", 10);
+    updateAccountQuota("b", 10);
+
+    expect(resolveCodexAccountForThread(null, config)).toBe("b");
+    expect(previewCodexAccountForRequest(null, config)).toBe("b");
+  });
+
+  test("the pin is spent once the pinned account crosses the threshold", () => {
+    const config = orderedConfig({ activeCodexAccountPinned: "b" } as Partial<OcxConfig>);
+    updateAccountQuota("a", 10);
+    updateAccountQuota("b", 90);
+
+    expect(resolveCodexAccountForThread(null, config)).toBe("a");
+    expect(config.activeCodexAccountPinned).toBeUndefined();
+  });
+
+  test("a cooldown on the pinned account hands routing back to selection order", () => {
+    const config = orderedConfig({ activeCodexAccountPinned: "b" } as Partial<OcxConfig>);
+    updateAccountQuota("a", 10);
+    updateAccountQuota("b", 10);
+    recordCodexUpstreamOutcome(config, "b", 429, { retryAfter: "600" });
+
+    expect(resolveCodexAccountForThread(null, config)).toBe("a");
+    expect(config.activeCodexAccountPinned).toBeUndefined();
+  });
+
+  // Preview cannot clear a spent pin, so it has to reach the same account by testing
+  // pin liveness — the case the resolve-side release was built to converge with.
+  test("preview and resolve agree while a drained pin is still stored", () => {
+    const config = orderedConfig({ activeCodexAccountPinned: "b" } as Partial<OcxConfig>);
+    updateAccountQuota("a", 10);
+    updateAccountQuota("b", 90);
+
+    const previewed = previewCodexAccountForRequest(null, config);
+    expect(config.activeCodexAccountPinned).toBe("b");
+    expect(previewed).toBe("a");
+    expect(resolveCodexAccountForThread(null, config)).toBe(previewed);
+    expect(config.activeCodexAccountPinned).toBeUndefined();
+  });
+
+  test("a pinned account holds fill-first on its own tier", () => {
+    const config = orderedConfig({
+      accountPoolStrategy: "fill-first",
+      activeCodexAccountPinned: "b",
+    } as Partial<OcxConfig>);
+    updateAccountQuota("a", 10);
+    updateAccountQuota("b", 10);
+
+    const picks = Array.from({ length: 3 }, () => resolveCodexAccountForThread(null, config));
+    expect(picks).toEqual(["b", "b", "b"]);
+    expect(config.activeCodexAccountPinned).toBe("b");
+  });
+
+  test("fill-first descends to the next tier once the pinned account drains", () => {
+    const config = orderedConfig({
+      accountPoolStrategy: "fill-first",
+      activeCodexAccountPinned: "a",
+    } as Partial<OcxConfig>);
+    updateAccountQuota("a", 10);
+    updateAccountQuota("b", 10);
+    expect(resolveCodexAccountForThread(null, config)).toBe("a");
+
+    updateAccountQuota("a", 90);
+    expect(resolveCodexAccountForThread(null, config)).toBe("b");
+    expect(config.activeCodexAccountPinned).toBeUndefined();
+  });
+
+  test("a 429 on the pinned account releases the pin under round-robin", () => {
+    const config = orderedConfig({
+      accountPoolStrategy: "round-robin",
+      accountPoolStickyLimit: 1,
+      activeCodexAccountPinned: "b",
+    } as Partial<OcxConfig>);
+    updateAccountQuota("a", 10);
+    updateAccountQuota("b", 10);
+    expect(resolveCodexAccountForThread(null, config)).toBe("b");
+
+    recordCodexUpstreamOutcome(config, "b", 429, { retryAfter: "600" });
+
+    expect(config.activeCodexAccountPinned).toBeUndefined();
+    expect(getEffectiveActiveCodexAccountId(config)).toBe("a");
+    // Rotation promotes through the runtime cursor, so the release is in memory only.
+    expect(config.activeCodexAccountId).toBe("b");
+  });
+
+  test("a pin the request never moves off survives in config", () => {
+    const config = orderedConfig({ activeCodexAccountPinned: "b" } as Partial<OcxConfig>);
+    updateAccountQuota("a", 10);
+    updateAccountQuota("b", 10);
+
+    expect(resolveCodexAccountForThread(null, config)).toBe("b");
+    expect(config.activeCodexAccountPinned).toBe("b");
+  });
+
+  test("excluding the pinned account releases the pin", () => {
+    const config = orderedConfig({ activeCodexAccountPinned: "b" } as Partial<OcxConfig>);
+    updateAccountQuota("a", 10);
+    updateAccountQuota("b", 10);
+
+    reconcileCodexActiveAfterExclusion(config, "b");
+    expect(config.activeCodexAccountPinned).toBeUndefined();
+  });
+
+  test("a bound thread keeps its lower-tier account when ordering changes", () => {
+    const config = makeConfig({ activeCodexAccountId: "b" });
+    updateAccountQuota("a", 10);
+    updateAccountQuota("b", 10);
+    expect(resolveCodexAccountForThread("thread-1", config)).toBe("b");
+
+    config.codexAccountPriorities = { a: 1 };
+    expect(resolveCodexAccountForThread("thread-1", config)).toBe("b");
+  });
+
+  test("a bound thread over threshold moves to the highest tier with headroom", () => {
+    const config = makeConfig({ activeCodexAccountId: "b" });
+    updateAccountQuota("a", 10);
+    updateAccountQuota("b", 10);
+    expect(resolveCodexAccountForThread("thread-1", config)).toBe("b");
+
+    config.codexAccountPriorities = { a: 1 };
+    updateAccountQuota("b", 90);
+    expect(resolveCodexAccountForThread("thread-1", config)).toBe("a");
+  });
+
+  test("no stored order leaves the pick sequence untouched", () => {
+    const ordered = makeConfig({ activeCodexAccountId: "b" });
+    updateAccountQuota("a", 5);
+    updateAccountQuota("b", 50);
+
+    expect(resolveCodexAccountForThread(null, ordered)).toBe("b");
+    expect(pickLowestUsageCodexAccount(ordered)).toBe("a");
+  });
+});
diff --git a/tests/config.test.ts b/tests/config.test.ts
index 5057bc565..336b117df 100644
--- a/tests/config.test.ts
+++ b/tests/config.test.ts
@@ -142,6 +142,45 @@ describe("opencodex config defaults", () => {
     });
   });
 
+  // A write must not inherit the read path's degrade-to-undefined: dropping a malformed
+  // map on load leaves the raw entries in the file to be repaired by hand, but dropping
+  // it on a write erases every order the user had set and still reports success.
+  test("config candidates reject a malformed selection-order map instead of erasing it", () => {
+    const base = getDefaultConfig();
+
+    expect(validateConfigCandidate({ ...base, codexAccountPriorities: { work: 2, side: 200 } })).toMatchObject({
+      ok: false,
+      error: expect.stringContaining("codexAccountPriorities"),
+    });
+    expect(validateConfigCandidate({ ...base, codexAccountPriorities: { "bad id!": 1 } })).toMatchObject({
+      ok: false,
+      error: expect.stringContaining("codexAccountPriorities"),
+    });
+    expect(validateConfigCandidate({ ...base, activeCodexAccountPinned: "not a valid id" })).toMatchObject({
+      ok: false,
+      error: expect.stringContaining("activeCodexAccountPinned"),
+    });
+    // A coercing guard lets these through — String(123) matches the id pattern — and the
+    // schema's .catch(undefined) then drops the pin while reporting the write as a success.
+    for (const pin of [123, true, ["work"]]) {
+      expect(validateConfigCandidate({ ...base, activeCodexAccountPinned: pin })).toMatchObject({
+        ok: false,
+        error: expect.stringContaining("activeCodexAccountPinned"),
+      });
+    }
+    expect(validateConfigCandidate({
+      ...base,
+      codexAccountPriorities: { work: 2, __main__: -2 },
+      activeCodexAccountPinned: "work",
+    })).toMatchObject({
+      ok: true,
+      config: expect.objectContaining({
+        codexAccountPriorities: { work: 2, __main__: -2 },
+        activeCodexAccountPinned: "work",
+      }),
+    });
+  });
+
   test("config candidates validate Claude Code subagent effort levels", () => {
     const base = getDefaultConfig();
     for (const subagentEffort of ["low", "medium", "high", "xhigh", "max"]) {
@@ -1516,3 +1555,100 @@ describe("config.ts – Windows ACL hardening integration", () => {
     spy.mockRestore();
   });
 });
+
+describe("codex account selection order", () => {
+  function writePriorityConfig(
+    codexAccountPriorities: unknown,
+    overrides: Record<string, unknown> = {},
+  ): void {
+    writeConfig({
+      port: 10100,
+      providers: {
+        openai: {
+          adapter: "openai-responses",
+          baseUrl: "https://chatgpt.com/backend-api/codex",
+          authMode: "forward",
+        },
+      },
+      defaultProvider: "openai",
+      codexAccountPriorities,
+      ...overrides,
+    });
+  }
+
+  test("round-trips pool ids, the main account, and negative order", () => {
+    const priorities = { work: 2, side: 1, __main__: -2 };
+    writePriorityConfig(priorities);
+
+    const diagnostics = readConfigDiagnostics();
+    expect(diagnostics.error).toBeNull();
+    expect(diagnostics.source).toBe("file");
+    expect(diagnostics.config.codexAccountPriorities).toEqual(priorities);
+    expect(Object.hasOwn(getDefaultConfig(), "codexAccountPriorities")).toBe(false);
+  });
+
+  test.each([
+    ["null", null],
+    ["an array", []],
+    ["a string", "work"],
+    ["a fractional value", { work: 1.5 }],
+    ["a stringified number", { work: "2" }],
+    ["a boolean", { work: true }],
+    ["an above-range value", { work: 101 }],
+    ["a below-range value", { work: -101 }],
+    ["a reserved constructor key", { constructor: 1 }],
+    ["a slash in the key", { "work/account": 1 }],
+  ] as const)("degrades %s to no ordering without discarding the rest of the config", (_label, priorities) => {
+    writePriorityConfig(priorities);
+
+    const diagnostics = readConfigDiagnostics();
+    // Selection order is a preference: a malformed map must never trip the
+    // backup-and-defaults repair path that would reset providers.
+    expect(diagnostics.source).toBe("file");
+    expect(diagnostics.error).toBeNull();
+    expect(diagnostics.config.codexAccountPriorities).toBeUndefined();
+    expect(Object.keys(diagnostics.config.providers)).toContain("openai");
+    expect(backupNames()).toHaveLength(0);
+    expect(diagnostics.warnings).toContainEqual(expect.stringContaining("account selection order is disabled"));
+  });
+
+  test("degrades a literal __proto__ entry, which JSON.parse materializes as an own key", () => {
+    writeConfig(
+      '{"port":10100,"providers":{"openai":{"adapter":"openai-responses",'
+      + '"baseUrl":"https://chatgpt.com/backend-api/codex","authMode":"forward"}},'
+      + '"defaultProvider":"openai","codexAccountPriorities":{"__proto__":1,"work":2}}',
+    );
+
+    const diagnostics = readConfigDiagnostics();
+    expect(diagnostics.source).toBe("file");
+    expect(diagnostics.config.codexAccountPriorities).toBeUndefined();
+    expect(Object.keys(diagnostics.config.providers)).toContain("openai");
+    expect(diagnostics.warnings).toContainEqual(expect.stringContaining("account selection order is disabled"));
+  });
+
+  test("warns when load degrades a malformed selection-order map", () => {
+    writePriorityConfig({ work: 101 });
+    const warnSpy = spyOn(console, "warn").mockImplementation(() => {});
+
+    try {
+      const loaded = loadConfig();
+      expect(loaded.codexAccountPriorities).toBeUndefined();
+      expect(warnSpy).toHaveBeenCalledWith(expect.stringContaining("account selection order is disabled"));
+      expect(backupNames()).toHaveLength(0);
+    } finally {
+      warnSpy.mockRestore();
+    }
+  });
+
+  test("keeps a valid pin and degrades a malformed one", () => {
+    writePriorityConfig({ work: 1 }, { activeCodexAccountPinned: "work" });
+    expect(readConfigDiagnostics().config.activeCodexAccountPinned).toBe("work");
+
+    writePriorityConfig({ work: 1 }, { activeCodexAccountPinned: "work/account" });
+    const degraded = readConfigDiagnostics();
+    expect(degraded.source).toBe("file");
+    expect(degraded.config.activeCodexAccountPinned).toBeUndefined();
+    expect(degraded.config.codexAccountPriorities).toEqual({ work: 1 });
+    expect(degraded.warnings).toContainEqual(expect.stringContaining("no longer pinned"));
+  });
+});