diff --git a/docs-site/src/content/docs/reference/cli/providers-accounts.md b/docs-site/src/content/docs/reference/cli/providers-accounts.md
index d75bc6a3b9b..11d568ab92f 100644
--- a/docs-site/src/content/docs/reference/cli/providers-accounts.md
+++ b/docs-site/src/content/docs/reference/cli/providers-accounts.md
@@ -207,7 +207,7 @@ List and switch provider accounts and API-key pools through the running proxy. T
 surface is:
 
 ```text
-Usage: ocx account <list|current|use|refresh|auto-switch|priority|login|reauth|code|cancel|remove|add-key|reset-credits|grok-reset-coupons> ...
+Usage: ocx account <list|current|use|refresh|auto-switch|priority|login|reauth|code|cancel|remove|add-key|reset-credits|grok-reset-coupons|import-orca> ...
 
 list [provider]     Codex account pool, OAuth accounts and API keys (identifiers shown masked as the API returns them).
 current <provider>  Show the active account or key.
@@ -220,11 +220,13 @@ add-key <provider> [--label <label>]  Add a key read only from piped stdin.
 login/reauth/code/cancel  Run browser or manual-code auth from a headless shell.
 reset-credits <id|main> [--consume --yes]  Inspect or consume Codex reset credits.
 grok-reset-coupons [<id>] [--consume --yes] [--token-id <token-id>] [--operation-id <uuid>]  Inspect or redeem Grok reset coupons.
+import-orca --source <dir> --registry <file> [--apply]  Preview or apply imports from Orca-managed Codex homes.
 Switching the active account takes effect immediately; running threads move on their next request, and in-flight requests keep the account they captured.
 A selection-order change applies from the next unbound request and never moves a bound thread.
 ```
 
-All subcommands require the proxy to be running; the CLI auto-resolves its recorded runtime port.
+Account subcommands require the proxy to be running and auto-resolve its recorded runtime port,
+except `import-orca`: preview is local-only, and `import-orca --apply` requires the proxy to be stopped.
 Successful operations exit 0. Invalid usage, an unknown provider or account/key id, an unreachable
 proxy, or an API failure exits 1. Credential fields are displayed exactly as the management API
 returns them (including its masking); raw API keys and OAuth tokens are never returned. Display
@@ -250,6 +252,55 @@ and the plan/label column falls back across plan, masked email, label, and maske
 }
 ```
 
+### `ocx account import-orca --source <orca-data-directory> --registry <orca-data.json> [--apply] [--json]`
+
+Reuse local Orca-managed Codex logins without another browser login. The source
+directory must contain `codex-accounts/<account>/home/auth.json`. Supply the Orca
+data directory and the chosen profile's `orca-data.json` explicitly. Only accounts
+registered in that profile are considered; leftover or removed account homes are
+not imported. Each home must carry Orca's matching `.orca-managed-home` marker.
+The command does not scan unrelated homes or remote hosts.
+
+```powershell
+# Windows: preview only; no account is registered.
+ocx account import-orca --source "$env:APPDATA\orca" --registry "$env:APPDATA\orca\profiles\local-default\orca-data.json" --json
+
+# Finish active proxy requests and stop the proxy before applying.
+ocx stop
+ocx account import-orca --source "$env:APPDATA\orca" --registry "$env:APPDATA\orca\profiles\local-default\orca-data.json" --apply
+ocx start
+```
+
+Older Orca profiles may use `orca-data.json` directly under the data directory.
+On other platforms, pass the local Orca data directory and profile registry with the same layout.
+The importer skips identities already present in the native main login, account
+pool, or credential store, including duplicates within the source. This deliberately
+uses the ChatGPT account ID as a conservative bucket: separate members sharing a
+workspace account ID are skipped too, not merged or individually imported. Repeating an
+import preserves existing accounts. If an earlier import stopped between saving
+credentials and registering the pool row, retry can finish that registration with
+the same ID only when its untouched pending record still matches the source. Invalid
+entries are counted by fixed reason code. A mixed result with at least one eligible
+account exits successfully; a result where every discovered entry is invalid exits
+nonzero. Output contains counts and reason codes, not emails, account identifiers,
+paths, or tokens.
+
+**Orca retains refresh ownership.** OpenCodex stores a read-only source link and
+an access-token snapshot, never Orca's refresh token. When resolving credentials,
+it reads the source again and verifies that it still belongs to the imported
+identity. Orca must keep that login available and refreshed. Missing, malformed,
+expired, or identity-mismatched source credentials fail closed; OpenCodex does not
+fall back to the old snapshot or refresh the source login. This is a local link,
+not a portable export or a transfer of refresh ownership.
+Requests already sent upstream keep the credentials they captured.
+
+New accounts are registered as **validation pending**. After starting the proxy,
+open **Codex Auth** and click **Refresh quotas** to authorize the existing model
+validation step, which may consume a small amount of quota. Offline import and
+JWT parsing do not establish upstream authentication. CLI quota refresh alone
+does not perform that validation. The importer never starts or stops either app,
+changes Orca files, or changes the active pool account.
+
 ### `ocx account list [provider] [--json] [--all] [--quota [--refresh]]`
 
 Without a provider, lists the Codex pool, OAuth accounts, and configured API-key pools. Empty
diff --git a/scripts/test-layout/layout.json b/scripts/test-layout/layout.json
index c361c4c0c86..bb7d7f9c251 100644
--- a/scripts/test-layout/layout.json
+++ b/scripts/test-layout/layout.json
@@ -370,6 +370,8 @@
     "claude-system-env-auto.test.ts": "claude-integration",
     "cleanup-orphaned-workflows.test.ts": "ci-workflows",
     "clearable-deadline.test.ts": "lib",
+    "cli-account-orca-import.test.ts": "cli",
+
     "cli-account-pin-drain.test.ts": "cli",
     "cli-account-pool-verbs.test.ts": "cli",
     "cli-account.test.ts": "cli",
@@ -1056,6 +1058,7 @@
     "openrouter-provider-routing.test.ts": "providers",
     "openrouter-quota-reset-cooldown-4024.test.ts": "providers",
     "optional-shutdown-hooks.test.ts": "lib",
+    "orca-import.test.ts": "codex-integration",
     "orcarouter-provider.test.ts": "providers",
     "outbound-body-guard.test.ts": "server",
     "owned-service-home.test.ts": "server",
diff --git a/skills/ocx/references/01_management_surface.md b/skills/ocx/references/01_management_surface.md
index 3854540f0b4..78d2047d1aa 100644
--- a/skills/ocx/references/01_management_surface.md
+++ b/skills/ocx/references/01_management_surface.md
@@ -560,6 +560,26 @@ JSON mode: `payload`.
 - /api/codex-auth/login stays pool-only and keeps rejecting __main__; this namespace is the only device-reauth surface for the native main slot.
 - Payloads carry only flowId, status, the verification URL, the device code, and a closed set of failure codes -- never tokens, emails, or raw account ids.
 
+### `ocx account import-orca`
+
+Preview or register read-only links to Orca-managed Codex accounts without another login.
+
+Drives no management route.
+
+| Flag | Value | Meaning |
+|---|---|---|
+| `--source` | string | Orca data directory containing codex-accounts. |
+| `--registry` | string | The chosen Orca profile's orca-data.json account registry. |
+| `--apply` | boolean | Register new accounts; requires a stopped proxy. Default is preview. |
+| `--json` | boolean | Emit counts and fixed invalid-reason codes without credentials or source paths. |
+
+JSON mode: `envelope`.
+
+- Local files only; never copies refresh tokens or changes Orca authentication files.
+- Skips existing ChatGPT identities. New accounts remain pending until dashboard validation.
+- Orca must keep the source login available and refreshed; a missing or expired source fails closed.
+- Mixed eligible and invalid entries exit successfully; an all-invalid result exits nonzero.
+
 ### `ocx account refresh`
 
 Refresh account quotas without model validation; pending Codex accounts require dashboard consent.
@@ -876,6 +896,6 @@ JSON mode: `payload`.
 
 ## Counts
 
-- declared capabilities: 47
-- of those, state-changing: 23
+- declared capabilities: 48
+- of those, state-changing: 24
 - head-resolved invocations: 2
diff --git a/src/cli/account-orca-import.ts b/src/cli/account-orca-import.ts
new file mode 100644
index 00000000000..9ddeca0ed97
--- /dev/null
+++ b/src/cli/account-orca-import.ts
@@ -0,0 +1,63 @@
+import type { importOrcaAccounts } from "../codex/orca-import";
+
+const USAGE = "Usage: ocx account import-orca --source <orca-data-directory> --registry <orca-data.json> [--apply] [--json]";
+
+export interface OrcaImportCommandDeps {
+  importAccounts?: typeof importOrcaAccounts;
+}
+
+/** Local-only: never sends source paths or credentials to a management listener. */
+export async function cmdOrcaImport(args: string[], deps: OrcaImportCommandDeps = {}): Promise<number> {
+  let sourceDir: string | undefined;
+  let registryPath: string | undefined;
+  let apply = false;
+  const wantsJson = args.includes("--json");
+  const seen = new Set<string>();
+  for (let index = 0; index < args.length; index++) {
+    const arg = args[index]!;
+    if (seen.has(arg) || !["--source", "--registry", "--apply", "--json"].includes(arg)) {
+      console.error(USAGE);
+      return 1;
+    }
+    seen.add(arg);
+    if (arg === "--source" || arg === "--registry") {
+      const value = args[++index];
+      if (!value || value.startsWith("--")) {
+        console.error(USAGE);
+        return 1;
+      }
+      if (arg === "--source") sourceDir = value;
+      else registryPath = value;
+    } else if (arg === "--apply") apply = true;
+  }
+  if (!sourceDir || !registryPath) {
+    console.error(USAGE);
+    return 1;
+  }
+  try {
+    const run = deps.importAccounts ?? (await import("../codex/orca-import")).importOrcaAccounts;
+    const result = await run({ sourceDir, registryPath, apply });
+    if (wantsJson) console.log(JSON.stringify({
+      mode: result.mode, discovered: result.discovered, eligible: result.eligible,
+      imported: result.imported, duplicates: result.duplicates, invalid: result.invalid,
+      invalidReasons: result.invalidReasons,
+    }));
+    else {
+      console.log(`Orca: ${result.discovered} discovered, ${result.eligible} eligible, ${result.imported} imported, ${result.duplicates} duplicates, ${result.invalid} invalid.`);
+      if (result.invalid > 0) {
+        const reasons = Object.entries(result.invalidReasons).map(([reason, count]) => `${reason}=${count}`).join(", ");
+        console.log(`Invalid reasons: ${reasons}`);
+      }
+      console.log(apply
+        ? "Start the proxy and use Refresh quotas in Codex Auth to validate new accounts. Orca retains refresh ownership."
+        : "Preview only. Stop the proxy before repeating with --apply. Orca authentication files stay read-only.");
+    }
+    return result.invalid > 0 && result.eligible === 0 ? 1 : 0;
+  } catch {
+    // Filesystem/JSON exceptions may contain source paths or token fragments.
+    const error = "Orca import failed. Check the source, destination config, and stopped proxy; no successful completion is confirmed.";
+    if (wantsJson) console.log(JSON.stringify({ error: "orca_import_failed" }));
+    else console.error(error);
+    return 1;
+  }
+}
diff --git a/src/cli/account.ts b/src/cli/account.ts
index f3f80fea3c0..84edce909fc 100644
--- a/src/cli/account.ts
+++ b/src/cli/account.ts
@@ -57,6 +57,7 @@ const ACCOUNT_USAGE = `Usage:
   ocx account clear-cooldown <provider> <account-id|main> [--json]
   ocx account add-key <provider> [--label <label>] [--json]
   ocx account import <provider> --format <format> (--file <path>|--stdin) [--json]
+  ocx account import-orca --source <orca-data-directory> --registry <orca-data.json> [--apply] [--json]
   ocx account login <provider> [--id <account-id>] [--reauth] [--code -] [--no-wait] [--json]
   ocx account code <provider> [--flow <flow-id>] [--json]   (reads the code from stdin)
   ocx account cancel <provider> [--flow <flow-id>] [--json]
@@ -383,6 +384,10 @@ export async function cmdAccount(args: string[], deps: AccountDeps = {}): Promis
     if (sub === "clear-cooldown") return await cmdClearCooldown(rest, deps);
     if (sub === "add-key") return await cmdAddKey(rest, deps);
     if (sub === "import") return await cmdImport(rest, deps);
+    if (sub === "import-orca") {
+      const { cmdOrcaImport } = await import("./account-orca-import");
+      return await cmdOrcaImport(rest);
+    }
     if (sub === "main") {
       const { cmdNativeMainAccount } = await import("./account-main");
       return await cmdNativeMainAccount(rest, deps);
diff --git a/src/cli/capabilities.ts b/src/cli/capabilities.ts
index a67442728a8..e67390041b9 100644
--- a/src/cli/capabilities.ts
+++ b/src/cli/capabilities.ts
@@ -360,6 +360,25 @@ export const CAPABILITIES: readonly Capability[] = [
       "`--quota` shows cached Codex windows (including 5h); `--refresh` bypasses the server TTL.",
     ],
   },
+  {
+    command: ["account", "import-orca"],
+    summary: "Preview or register read-only links to Orca-managed Codex accounts without another login.",
+    routes: [],
+    flags: [
+      { name: "--source", value: "string", required: true, summary: "Orca data directory containing codex-accounts." },
+      { name: "--registry", value: "string", required: true, summary: "The chosen Orca profile's orca-data.json account registry." },
+      { name: "--apply", value: "boolean", summary: "Register new accounts; requires a stopped proxy. Default is preview." },
+      { name: "--json", value: "boolean", summary: "Emit counts and fixed invalid-reason codes without credentials or source paths." },
+    ],
+    mutates: true,
+    json: "envelope",
+    details: [
+      "Local files only; never copies refresh tokens or changes Orca authentication files.",
+      "Skips existing ChatGPT identities. New accounts remain pending until dashboard validation.",
+      "Orca must keep the source login available and refreshed; a missing or expired source fails closed.",
+      "Mixed eligible and invalid entries exit successfully; an all-invalid result exits nonzero.",
+    ],
+  },
   {
     command: ["account", "refresh"],
     summary: "Refresh account quotas without model validation; pending Codex accounts require dashboard consent.",
diff --git a/src/codex/account-store.ts b/src/codex/account-store.ts
index f695884cf1e..f312cc73e8d 100644
--- a/src/codex/account-store.ts
+++ b/src/codex/account-store.ts
@@ -1,3 +1,4 @@
+import { readOrcaAuthSource } from "./orca-auth-source";
 import { createHash } from "node:crypto";
 import { closeSync, existsSync, fstatSync, readFileSync, mkdirSync, openSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
@@ -52,11 +53,20 @@ function isObject(value: unknown): value is Record<string, unknown> {
 }
 
 function isCredential(value: unknown): value is CodexAccountCredentials {
+  const hasNoSource = isObject(value)
+    && value.sourceAuthPath === undefined
+    && value.sourceSubject === undefined;
+  const hasCompleteSource = isObject(value)
+    && typeof value.sourceAuthPath === "string"
+    && value.sourceAuthPath.length > 0
+    && typeof value.sourceSubject === "string"
+    && value.sourceSubject.length > 0;
   return isObject(value)
     && typeof value.accessToken === "string"
     && typeof value.refreshToken === "string"
     && typeof value.expiresAt === "number"
-    && typeof value.chatgptAccountId === "string";
+    && typeof value.chatgptAccountId === "string"
+    && (hasNoSource || hasCompleteSource);
 }
 
 function isCredentialRecord(value: unknown): value is CodexAccountCredentialRecord {
@@ -78,6 +88,7 @@ export function refreshGrantFingerprintForToken(refreshToken: string): string {
 }
 
 function recordGrantFingerprint(record: CodexAccountCredentialRecord): string | undefined {
+  if (record.credential?.sourceAuthPath) return undefined;
   return record.refreshGrantFingerprint ?? (
     record.credential ? refreshGrantFingerprintForToken(record.credential.refreshToken) : undefined
   );
@@ -426,7 +437,7 @@ export function commitRefreshedCodexCredentialWithAliases(
   return withCredentialMutationLockSync(() => {
     const store = loadCodexAccountRecordStore();
     const current = store[id];
-    if (!current || current.generation !== generation || current.deletedAt != null || !current.credential) {
+    if (!current || current.generation !== generation || current.deletedAt != null || !current.credential || current.credential.sourceAuthPath) {
       return { committed: false, propagatedAliases: [] };
     }
     const priorCredential = current.credential;
@@ -458,7 +469,7 @@ export function commitRefreshedCodexCredentialWithAliases(
       && priorCredential.chatgptAccountId === cred.chatgptAccountId
     ) {
       for (const [aliasId, alias] of Object.entries(store)) {
-        if (aliasId === id || alias.deletedAt != null || !alias.credential) continue;
+        if (aliasId === id || alias.deletedAt != null || !alias.credential || alias.credential.sourceAuthPath) continue;
         if (recordGrantFingerprint(alias) !== priorFingerprint) continue;
         if (alias.credential.accessToken !== priorCredential.accessToken) continue;
         if (alias.credential.expiresAt !== priorCredential.expiresAt) continue;
@@ -776,7 +787,7 @@ function findFreshCredentialForGrant(
   // require both ids to be present and exactly equal rather than inferring identity from the grant.
   if (!expectedChatgptAccountId) return null;
   for (const [candidateId, candidate] of Object.entries(records)) {
-    if (candidateId === excludeId || candidate.deletedAt != null || !candidate.credential) continue;
+    if (candidateId === excludeId || candidate.deletedAt != null || !candidate.credential || candidate.credential.sourceAuthPath) continue;
     if (recordGrantFingerprint(candidate) !== refreshGrantFingerprint) continue;
     if (!candidate.credential.chatgptAccountId) continue;
     if (candidate.credential.chatgptAccountId !== expectedChatgptAccountId) continue;
@@ -967,6 +978,57 @@ export async function getValidCodexToken(
   };
 }
 
+/** Source credentials never join refresh flights or spend a refresh grant, including after 401. */
+function resolveOrcaSourceToken(id: string, forced?: ForcedRefreshFence): CodexRefreshResult {
+  const initial = readCodexAccountRecord(id);
+  const initialCredential = initial?.credential;
+  if (!initial || initial.deletedAt != null || !initialCredential?.sourceAuthPath || !initialCredential.sourceSubject) {
+    throw new CodexCredentialGenerationConflictError();
+  }
+  const sourceCredential = readOrcaAuthSource(initialCredential.sourceAuthPath);
+  if (sourceCredential.chatgptAccountId !== initialCredential.chatgptAccountId
+    || sourceCredential.sourceSubject !== initialCredential.sourceSubject) {
+    throw new Error("Orca credential identity changed; reimport the account explicitly.");
+  }
+  if (sourceCredential.accessToken === initialCredential.accessToken
+    && sourceCredential.expiresAt === initialCredential.expiresAt) {
+    if (forced?.rejectedAccessToken === sourceCredential.accessToken) {
+      throw new Error("Orca bearer was rejected; update the account in Orca and retry.");
+    }
+    return { accessToken: sourceCredential.accessToken, chatgptAccountId: sourceCredential.chatgptAccountId,
+      generation: initial.generation, provenance: "external-replacement" };
+  }
+
+  return withCredentialMutationLockSync(() => {
+    const store = loadCodexAccountRecordStore();
+    const record = store[id];
+    const prior = record?.credential;
+    if (!record || record.deletedAt != null || !prior?.sourceAuthPath || !prior.sourceSubject) {
+      throw new CodexCredentialGenerationConflictError();
+    }
+    if (record.generation !== initial.generation) throw new CodexCredentialGenerationConflictError();
+    const credential = readOrcaAuthSource(prior.sourceAuthPath);
+    if (credential.chatgptAccountId !== prior.chatgptAccountId || credential.sourceSubject !== prior.sourceSubject) {
+      throw new Error("Orca credential identity changed; reimport the account explicitly.");
+    }
+    if (credential.accessToken !== prior.accessToken || credential.expiresAt !== prior.expiresAt) {
+      store[id] = {
+        credential, generation: record.generation + 1, replacedAt: Date.now(),
+        // The source identity was checked above. Retire old-generation writers without
+        // splitting this same account's retained quota history on every source rotation.
+        quotaHistoryIdentity: record.quotaHistoryIdentity,
+        ...preservedValidationMetadata(record),
+      };
+      persistCredentialMutation(store);
+    }
+    if (forced?.rejectedAccessToken === credential.accessToken) {
+      throw new Error("Orca bearer was rejected; update the account in Orca and retry.");
+    }
+    return { accessToken: credential.accessToken, chatgptAccountId: credential.chatgptAccountId,
+      generation: store[id]!.generation, provenance: "external-replacement" };
+  });
+}
+
 async function resolveCodexToken(
   id: string,
   forced?: ForcedRefreshFence,
@@ -976,6 +1038,7 @@ async function resolveCodexToken(
   const record = readCodexAccountRecord(id);
   const cred = record?.deletedAt == null ? record?.credential : undefined;
   if (!record || !cred) throw new CodexCredentialUnavailableError();
+  if (cred.sourceAuthPath) return resolveOrcaSourceToken(id, forced);
   const refreshGrantFingerprint = recordGrantFingerprint(record);
   if (!refreshGrantFingerprint) throw new CodexCredentialUnavailableError();
 
@@ -1005,6 +1068,7 @@ async function resolveCodexToken(
       const refreshed = await awaitOwnCancellation(existing.promise, callerSignal);
       const current = readCodexAccountRecord(id);
       const currentCred = current?.deletedAt == null ? current?.credential : undefined;
+      if (currentCred?.sourceAuthPath) return resolveOrcaSourceToken(id, forced);
       // The flight owner already committed this credential, and it is the one stored
       // for this account: adopt the stored state instead of CAS-writing the identical
       // bytes, which would bump the generation a second time and invalidate the
@@ -1126,6 +1190,7 @@ async function resolveCodexToken(
     const lockedRecord = readCodexAccountRecord(id);
     const lockedCred = lockedRecord?.deletedAt == null ? lockedRecord?.credential : undefined;
     if (!lockedRecord || !lockedCred) throw new CodexCredentialGenerationConflictError();
+    if (lockedCred.sourceAuthPath) return resolveOrcaSourceToken(id, forced);
     const startGeneration = lockedRecord.generation;
     const lockedRefreshGrantFingerprint = recordGrantFingerprint(lockedRecord);
     if (lockedRefreshGrantFingerprint !== refreshGrantFingerprint) {
diff --git a/src/codex/auth-api/pool-quota-probe.ts b/src/codex/auth-api/pool-quota-probe.ts
index afa30916d4c..0fa88a209c5 100644
--- a/src/codex/auth-api/pool-quota-probe.ts
+++ b/src/codex/auth-api/pool-quota-probe.ts
@@ -476,9 +476,14 @@ export async function fetchPoolAccountQuota(
       && generation !== undefined && record.generation === generation
       && isCompleteCodexQuotaRecoverySnapshot(result.freshQuota ?? null, result.freshPlan ?? configuredPlan)) {
       try {
+        // Quota I/O may outlive the source capture. Never validate a rotated or revoked link
+        // using an older generation's observation. Explicit validation consent still applies.
+        const sourceToken = record.credential.sourceAuthPath ? await getValidToken(accountId) : null;
+        if (sourceToken && (sourceToken.generation !== generation
+          || !isCodexAccountGenerationLive(accountId, generation))) return result;
         await warmCodexAccount({
-          accessToken: record.credential.accessToken,
-          chatgptAccountId: record.credential.chatgptAccountId,
+          accessToken: sourceToken?.accessToken ?? record.credential.accessToken,
+          chatgptAccountId: sourceToken?.chatgptAccountId ?? record.credential.chatgptAccountId,
         });
         markCodexAccountValidated(accountId, Date.now(), generation);
         clearAccountNeedsReauth(accountId, generation);
diff --git a/src/codex/orca-auth-source.ts b/src/codex/orca-auth-source.ts
new file mode 100644
index 00000000000..55b5ea37cfc
--- /dev/null
+++ b/src/codex/orca-auth-source.ts
@@ -0,0 +1,94 @@
+import { closeSync, constants, fstatSync, lstatSync, openSync, readSync, realpathSync } from "node:fs";
+import { dirname, isAbsolute, join, parse, relative, resolve } from "node:path";
+
+const MAX_AUTH_BYTES = 256 * 1024;
+export const ORCA_ACCOUNT_DIRECTORY = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+
+export function sameLocalPath(left: string, right: string): boolean {
+  return process.platform === "win32" ? left.toLowerCase() === right.toLowerCase() : left === right;
+}
+
+/** Reject links at every component; never follow an external credential reference. */
+export function assertPlainLocalPath(path: string): string {
+  if (/^(?:\\\\|\/\/)/.test(path)) throw new Error("Network and device credential paths are unsupported.");
+  const absolute = resolve(path);
+  let current = parse(absolute).root;
+  for (const component of relative(current, absolute).split(/[\\/]/).filter(Boolean)) {
+    current = join(current, component);
+    if (lstatSync(current).isSymbolicLink()) throw new Error("Unsafe local credential path.");
+  }
+  if (!sameLocalPath(realpathSync(absolute), absolute)) throw new Error("Unsafe local credential path.");
+  return absolute;
+}
+
+export function readBoundedLocalFile(path: string, limit = MAX_AUTH_BYTES): string {
+  assertPlainLocalPath(path);
+  const before = lstatSync(path);
+  if (!before.isFile() || before.size > limit) throw new Error("Invalid local credential file.");
+  const fd = openSync(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0) | (constants.O_NONBLOCK ?? 0));
+  try {
+    const opened = fstatSync(fd);
+    if (!opened.isFile() || opened.size > limit || before.dev !== opened.dev || before.ino !== opened.ino) {
+      throw new Error("Local credential file changed.");
+    }
+    // The cap bounds the read, not the allocation: tiny registry files should not
+    // allocate 32 MiB on each preview/recheck. One extra byte detects concurrent growth.
+    const bytes = Buffer.alloc(opened.size + 1);
+    let length = 0;
+    while (length < bytes.length) {
+      const count = readSync(fd, bytes, length, bytes.length - length, null);
+      if (!count) break;
+      length += count;
+    }
+    if (length !== opened.size) throw new Error("Local credential file changed.");
+    assertPlainLocalPath(path);
+    const after = lstatSync(path);
+    if (after.dev !== opened.dev || after.ino !== opened.ino || after.size !== opened.size || after.mtimeMs !== opened.mtimeMs) {
+      throw new Error("Local credential file changed.");
+    }
+    return bytes.subarray(0, length).toString("utf8");
+  } finally { closeSync(fd); }
+}
+
+function object(value: unknown): Record<string, unknown> {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("Invalid local OAuth credential.");
+  return value as Record<string, unknown>;
+}
+
+export function parseOrcaAuth(raw: string, requireFresh = true) {
+  const auth = object(JSON.parse(raw));
+  if ((auth.auth_mode !== undefined && auth.auth_mode !== "chatgpt")
+    || (auth.OPENAI_API_KEY !== undefined && auth.OPENAI_API_KEY !== null && auth.OPENAI_API_KEY !== "")) {
+    throw new Error("Expected a ChatGPT OAuth credential.");
+  }
+  const tokens = object(auth.tokens);
+  if (typeof tokens.access_token !== "string" || typeof tokens.account_id !== "string" || !tokens.account_id) {
+    throw new Error("Local OAuth credential lacks account identity.");
+  }
+  const parts = tokens.access_token.split(".");
+  if (parts.length !== 3) throw new Error("Invalid local OAuth bearer.");
+  const claims = object(JSON.parse(Buffer.from(parts[1]!, "base64url").toString("utf8")));
+  const identity = object(claims["https://api.openai.com/auth"]);
+  if (identity.chatgpt_account_id !== tokens.account_id || typeof claims.sub !== "string" || !claims.sub
+    || typeof claims.exp !== "number" || !Number.isSafeInteger(claims.exp) || !Number.isSafeInteger(claims.exp * 1000)
+    || (requireFresh && claims.exp * 1000 <= Date.now() + 60_000)) {
+    throw new Error("Local OAuth identity or expiry is invalid.");
+  }
+  return { accessToken: tokens.access_token, refreshToken: "", expiresAt: claims.exp * 1000,
+    chatgptAccountId: tokens.account_id, sourceSubject: claims.sub };
+}
+
+export function readOrcaAuthSource(path: string) {
+  if (!isAbsolute(path) || !ORCA_ACCOUNT_DIRECTORY.test(dirname(dirname(path)).split(/[\\/]/).pop() ?? "")
+    || dirname(path).split(/[\\/]/).pop() !== "home"
+    || dirname(dirname(dirname(path))).split(/[\\/]/).pop() !== "codex-accounts"
+    || path.split(/[\\/]/).pop() !== "auth.json") throw new Error("Invalid Orca credential location.");
+  try {
+    const accountDirectory = dirname(dirname(path)).split(/[\\/]/).pop()!;
+    if (readBoundedLocalFile(join(dirname(path), ".orca-managed-home"), 128).trim() !== accountDirectory) {
+      throw new Error("Orca home ownership marker does not match.");
+    }
+    return { ...parseOrcaAuth(readBoundedLocalFile(path)), sourceAuthPath: path };
+  }
+  catch { throw new Error("Orca credential unavailable; update the account in Orca and retry."); }
+}
diff --git a/src/codex/orca-import.ts b/src/codex/orca-import.ts
new file mode 100644
index 00000000000..918998aae85
--- /dev/null
+++ b/src/codex/orca-import.ts
@@ -0,0 +1,219 @@
+import { randomUUID } from "node:crypto";
+import { lstatSync, unlinkSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { atomicWriteFile, getConfigDir, getConfigPath, mutatePersistedConfig, readConfigDiagnostics, withConfigMutationLockSync } from "../config";
+import { readAlivePid, readRuntimePort } from "../config/process-state";
+import { getCodexHome } from "./paths";
+import { advanceCodexCredentialMutationEpoch } from "./credential-mutation-epoch";
+import { assertPlainLocalPath, ORCA_ACCOUNT_DIRECTORY, parseOrcaAuth, readBoundedLocalFile, readOrcaAuthSource, sameLocalPath } from "./orca-auth-source";
+
+export class OrcaImportError extends Error {
+  constructor(message: string) { super(message); this.name = "OrcaImportError"; }
+}
+
+export interface OrcaImportResult {
+  mode: "preview" | "apply";
+  discovered: number;
+  eligible: number;
+  imported: number;
+  duplicates: number;
+  invalid: number;
+  invalidReasons: Partial<Record<OrcaImportInvalidReason, number>>;
+}
+
+export type OrcaImportInvalidReason = "unsupported_entry" | "home_mismatch" | "source_invalid";
+
+class OrcaImportEntryError extends Error {
+  constructor(readonly reason: OrcaImportInvalidReason) { super(reason); }
+}
+
+function noteInvalid(result: OrcaImportResult, error: unknown): void {
+  const reason = error instanceof OrcaImportEntryError ? error.reason : "source_invalid";
+  result.invalid++;
+  result.invalidReasons[reason] = (result.invalidReasons[reason] ?? 0) + 1;
+}
+
+function optionalFile(path: string): string | undefined {
+  try { return readBoundedLocalFile(path, 4 * 1024 * 1024); }
+  catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") return undefined;
+    throw new OrcaImportError("A target or main credential file is unreadable; import refused.");
+  }
+}
+
+function object(value: unknown): Record<string, unknown> {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new OrcaImportError("Invalid existing account state; import refused.");
+  return value as Record<string, unknown>;
+}
+
+function assertStopped(): void {
+  let running = readAlivePid() !== null;
+  const runtime = readRuntimePort();
+  if (runtime) {
+    try { process.kill(runtime.pid, 0); running = true; }
+    catch (error) { if ((error as NodeJS.ErrnoException).code !== "ESRCH") running = true; }
+  }
+  if (running) throw new OrcaImportError("Stop the opencodex proxy before applying an Orca import.");
+}
+
+function prepare(sourceDir: string, registryPath: string) {
+  const configRaw = optionalFile(getConfigPath());
+  if (!configRaw || readConfigDiagnostics().source !== "file") {
+    throw new OrcaImportError("Initialize a valid opencodex configuration before importing.");
+  }
+  const config = object(JSON.parse(configRaw));
+  const accounts = config.codexAccounts ?? [];
+  if (!Array.isArray(accounts)) throw new OrcaImportError("Invalid existing account configuration.");
+  const identities = new Set<string>();
+  const configuredIds = new Set<string>();
+  for (const entry of accounts) {
+    const row = object(entry);
+    if (typeof row.id === "string") configuredIds.add(row.id);
+    if (row.chatgptAccountId !== undefined && typeof row.chatgptAccountId !== "string") throw new OrcaImportError("Invalid existing account identity.");
+    if (typeof row.chatgptAccountId === "string" && row.chatgptAccountId) identities.add(row.chatgptAccountId);
+  }
+  const reservedIdentities = new Set(identities);
+  const storedIdentityCounts = new Map<string, number>();
+  const recoverable = new Map<string, { id: string; credential: Record<string, unknown> }>();
+  const storePath = join(getConfigDir(), "codex-accounts.json");
+  const storeRaw = optionalFile(storePath);
+  const store = storeRaw === undefined ? {} : object(JSON.parse(storeRaw));
+  for (const [id, entry] of Object.entries(store)) {
+    const record = object(entry);
+    // Retain orphan and tombstoned records; a credential is still evidence of identity.
+    if (record.credential === undefined && typeof record.generation === "number") continue;
+    const credential = object(record.credential ?? record);
+    if (typeof credential.chatgptAccountId !== "string" || !credential.chatgptAccountId
+      || typeof credential.accessToken !== "string" || typeof credential.refreshToken !== "string"
+      || typeof credential.expiresAt !== "number") throw new OrcaImportError("Invalid existing credential store.");
+    identities.add(credential.chatgptAccountId);
+    storedIdentityCounts.set(credential.chatgptAccountId, (storedIdentityCounts.get(credential.chatgptAccountId) ?? 0) + 1);
+    // A process can die after the credential rename but before config registration. Only
+    // the untouched initial record emitted by this importer may finish that registration.
+    // Older, validated, replaced, tombstoned, or independently owned orphans remain blockers.
+    if (id.startsWith("orca-") && ORCA_ACCOUNT_DIRECTORY.test(id.slice(5)) && !configuredIds.has(id)
+      && record.generation === 1 && record.codexValidationPending === true
+      && record.deletedAt === undefined && record.replacedAt === undefined
+      && record.lastCodexValidatedAt === undefined && record.lastCodexValidationStatus === undefined
+      && record.lastCodexValidationError === undefined && record.lastCodexValidationTerminal === undefined
+      && credential.refreshToken === "" && typeof credential.sourceAuthPath === "string"
+      && typeof credential.sourceSubject === "string" && credential.sourceSubject) {
+      recoverable.set(credential.chatgptAccountId, { id, credential });
+    }
+  }
+  const mainRaw = optionalFile(join(getCodexHome(), "auth.json"));
+  if (mainRaw !== undefined) {
+    const main = object(JSON.parse(mainRaw));
+    if (main.tokens !== undefined) {
+      const identity = parseOrcaAuth(mainRaw, false).chatgptAccountId;
+      identities.add(identity);
+      reservedIdentities.add(identity);
+    }
+    else if (typeof main.OPENAI_API_KEY !== "string") throw new OrcaImportError("Main Codex identity is unknown; import refused.");
+  }
+  const root = assertPlainLocalPath(resolve(sourceDir));
+  const directory = assertPlainLocalPath(join(root, "codex-accounts"));
+  if (!lstatSync(directory).isDirectory()) throw new OrcaImportError("Invalid Orca data directory.");
+  const registryRaw = readBoundedLocalFile(resolve(registryPath), 32 * 1024 * 1024);
+  const registry = object(JSON.parse(registryRaw));
+  const registered = object(registry.settings).codexManagedAccounts;
+  if (!Array.isArray(registered) || registered.length > 1024) {
+    throw new OrcaImportError("Invalid Orca account registry or account limit exceeded.");
+  }
+  const result: OrcaImportResult = {
+    mode: "preview", discovered: registered.length, eligible: 0, imported: 0,
+    duplicates: 0, invalid: 0, invalidReasons: {},
+  };
+  const candidates: { credential: ReturnType<typeof readOrcaAuthSource>; recoverId?: string }[] = [];
+  const sourceIds = new Set<string>();
+  for (const entry of registered) {
+    try {
+      const row = object(entry);
+      if (typeof row.id !== "string" || !ORCA_ACCOUNT_DIRECTORY.test(row.id)
+        || typeof row.managedHomePath !== "string"
+        || (row.managedHomeRuntime !== undefined && row.managedHomeRuntime !== "host")) {
+        throw new OrcaImportEntryError("unsupported_entry");
+      }
+      const home = join(directory, row.id, "home");
+      if (!sameLocalPath(assertPlainLocalPath(row.managedHomePath), assertPlainLocalPath(home))) {
+        throw new OrcaImportEntryError("home_mismatch");
+      }
+      if (sourceIds.has(row.id)) { result.duplicates++; continue; }
+      sourceIds.add(row.id);
+      const credential = readOrcaAuthSource(join(home, "auth.json"));
+      let recoverId: string | undefined;
+      if (identities.has(credential.chatgptAccountId)) {
+        const orphan = recoverable.get(credential.chatgptAccountId);
+        if (orphan && !reservedIdentities.has(credential.chatgptAccountId)
+          && storedIdentityCounts.get(credential.chatgptAccountId) === 1
+          && sameLocalPath(orphan.credential.sourceAuthPath as string, credential.sourceAuthPath)
+          && orphan.credential.sourceSubject === credential.sourceSubject) {
+          recoverId = orphan.id;
+          recoverable.delete(credential.chatgptAccountId);
+        } else { result.duplicates++; continue; }
+      }
+      identities.add(credential.chatgptAccountId);
+      candidates.push({ credential, recoverId });
+      result.eligible++;
+    } catch (error) { noteInvalid(result, error); }
+  }
+  return { configRaw, registryRaw, storeRaw, storePath, store, candidates, result };
+
+}
+
+/** Offline, explicit-source import. The returned report deliberately contains no identities or paths. */
+export function importOrcaAccounts(options: { sourceDir: string; registryPath: string; apply?: boolean }): OrcaImportResult {
+  try {
+    if (!options.apply) return prepare(options.sourceDir, options.registryPath).result;
+    assertStopped();
+    return withConfigMutationLockSync(() => {
+      assertStopped();
+      const state = prepare(options.sourceDir, options.registryPath);
+      state.result.mode = "apply";
+      if (!state.candidates.length) return state.result;
+      const writesCredentials = state.candidates.some(candidate => candidate.recoverId === undefined);
+      const additions = state.candidates.map(({ credential, recoverId }) => {
+        let id = recoverId;
+        if (id === undefined) {
+          do { id = `orca-${randomUUID()}`; } while (state.store[id]);
+          state.store[id] = { credential, generation: 1, codexValidationPending: true };
+        }
+        return { id, email: "", alias: "Orca account", isMain: false, chatgptAccountId: credential.chatgptAccountId };
+      });
+      // Re-read registry and sources immediately before publishing either target file.
+      if (readBoundedLocalFile(resolve(options.registryPath), 32 * 1024 * 1024) !== state.registryRaw) {
+        throw new OrcaImportError("Orca registry changed during import; retry.");
+      }
+      for (const { credential } of state.candidates) {
+        if (JSON.stringify(readOrcaAuthSource(credential.sourceAuthPath)) !== JSON.stringify(credential)) {
+          throw new OrcaImportError("Orca credentials changed during import; retry.");
+        }
+      }
+      assertStopped();
+      if (optionalFile(getConfigPath()) !== state.configRaw || optionalFile(state.storePath) !== state.storeRaw) {
+        throw new OrcaImportError("Target accounts changed during import; retry.");
+      }
+      if (writesCredentials) atomicWriteFile(state.storePath, JSON.stringify(state.store, null, 2) + "\n");
+      try {
+        const outcome = mutatePersistedConfig(config => {
+          if (optionalFile(getConfigPath()) !== state.configRaw) throw new OrcaImportError("Target configuration changed; retry.");
+          config.codexAccounts = [...(config.codexAccounts ?? []), ...additions];
+          return { changed: true, value: undefined };
+        });
+        if (outcome.status !== "committed") throw new OrcaImportError("Target configuration could not be committed.");
+      } catch (error) {
+        if (writesCredentials) {
+          if (state.storeRaw === undefined) unlinkSync(state.storePath);
+          else atomicWriteFile(state.storePath, state.storeRaw);
+        }
+        throw error;
+      }
+      advanceCodexCredentialMutationEpoch();
+      state.result.imported = additions.length;
+      return state.result;
+    });
+  } catch (error) {
+    if (error instanceof OrcaImportError) throw error;
+    throw new OrcaImportError("Orca import could not complete; verify source and target local account files.");
+  }
+}
diff --git a/src/types/accounts.ts b/src/types/accounts.ts
index 3d2ba914ec1..9948ef3576a 100644
--- a/src/types/accounts.ts
+++ b/src/types/accounts.ts
@@ -19,6 +19,10 @@ export interface CodexAccount {
 }
 
 export interface CodexAccountCredentials {
+  /** Read-only Orca auth.json link; Orca exclusively owns OAuth refresh. */
+  sourceAuthPath?: string;
+  /** Bind the link to the originally imported OAuth subject. */
+  sourceSubject?: string;
   accessToken: string;
   refreshToken: string;
   expiresAt: number;
diff --git a/structure/catalog.md b/structure/catalog.md
index b5fd3ee72d9..a8d9f926cca 100644
--- a/structure/catalog.md
+++ b/structure/catalog.md
@@ -17,6 +17,9 @@ Shared parsing and streaming follow the [request-copy](transports/byte-accountin
 
 `src/codex/catalog/remote.ts` permits loopback HTTP only when Bun fetch has no effective HTTP proxy or a matching NO_PROXY bypass. Its local matcher follows [Bun fetch semantics](https://github.com/oven-sh/bun/blob/744846f844374847c902b5e7fd59b4342a51ef99/src/dotenv/env_loader.rs#L369), including non-empty lowercase-variable priority, ASCII whitespace, literal host/port comparison and bracket-preserving IPv6. It does not normalize URL-shaped bypass entries, paths, wildcard prefixes, trailing dots or Unicode whitespace, and leaves the broader WebSocket proxy grammar unchanged. It refuses before authentication headers and fetch with a content-free `insecure_http_refused` error. ALL_PROXY and HTTPS-only settings do not affect HTTP acquisition; HTTPS and existing redirect, size, validation and coordinated-installation contracts are preserved. `tests/codex-integration/catalog-remote-pull.test.ts` covers these routing and non-disclosure boundaries.
 
+Accounts added through the [Orca import](codex-home.md#orca-source-owned-account-import) remain
+validation-pending. Import alone supplies no entitlement evidence for the model catalog.
+
 ## Shared catalog
 
 `src/codex/catalog.ts` builds a shared Codex-shaped catalog for CLI, TUI, App, and SDK. It:
diff --git a/structure/clients/claude-desktop.md b/structure/clients/claude-desktop.md
index 5d3e09e7dd0..1379264326a 100644
--- a/structure/clients/claude-desktop.md
+++ b/structure/clients/claude-desktop.md
@@ -25,6 +25,10 @@ Native main reauthentication follows the [CLI JSON output contract](../runtime.m
 
 The Codex restart command follows the [CLI restart scope contract](../runtime.md#cli-codex-restart-scope).
 
+Native OpenAI pool routing also accepts
+[Orca-linked accounts](../codex-home.md#orca-source-owned-account-import), whose source resolution
+belongs to the shared account store. The import CLI adds pool rows independently of Desktop profiles.
+
 ## Connected Claude Desktop profiles
 
 The connection's local Codex readiness check follows the [selected-runtime probe contract](../runtime.md#remote-hub-hardening-ownership); general status hands its resolved command to this check instead of probing the version twice.
diff --git a/structure/codex-home.md b/structure/codex-home.md
index 1d523e7eca6..929c7c25c2f 100644
--- a/structure/codex-home.md
+++ b/structure/codex-home.md
@@ -8,6 +8,27 @@ CLI installation inspection reason codes, including Windows deferral, follow the
 
 Explicit Codex CLI installation observation does not discover a Codex home or read/write its state. See the [read-only observation contract](runtime.md#explicit-codex-cli-installation-observation).
 
+## Orca source-owned account import
+
+`src/codex/orca-import.ts` reads only accounts listed in an explicitly selected Orca registry.
+Each host-managed home must match its UUID directory and ownership marker. Preview is offline
+and read-only; applying requires an initialized target and a stopped proxy. Existing main,
+configured and orphan credential identities participate in account-ID deduplication.
+Retry can complete an interrupted registration only for a sole, untouched importer-owned
+pending credential matching the registered source path and identity; it retains that record's ID.
+
+Imported pool records retain an access-token snapshot and a local source reference, with no
+refresh token. `src/codex/orca-auth-source.ts` bounds reads and rejects linked or nonlocal paths.
+`src/codex/account-store.ts` rereads the source before returning credentials, pins account and
+subject identity, and fails closed for missing, expired or changed-identity sources. Orca owns
+refresh; even forced refresh never exchanges its refresh token. A new source bearer advances
+the target generation while retaining validation state and the same account's quota-history identity.
+Writers captured under the old generation become stale; already retained history is not reset.
+New imports remain validation-pending.
+
+`src/codex/auth-api/pool-quota-probe.ts` also rechecks linked sources after asynchronous quota validation before
+issuing deferred inference warmups. Already dispatched requests retain their captured bearer.
+
 ## Codex home
 
 `src/codex/paths.ts` resolves Codex state from `CODEX_HOME` when set and valid, otherwise from
diff --git a/structure/config.md b/structure/config.md
index 67ee878ca69..dbf1d1f69d3 100644
--- a/structure/config.md
+++ b/structure/config.md
@@ -21,6 +21,11 @@ Native main reauthentication follows the [CLI JSON output contract](runtime.md#n
 
 The Codex restart command follows the [CLI restart scope contract](runtime.md#cli-codex-restart-scope).
 
+`src/cli/account-orca-import.ts` exposes an explicit-source, preview-first local import command.
+Apply adds pool configuration under the shared mutation lock; the
+[source-owned credential contract](codex-home.md#orca-source-owned-account-import) governs
+deduplication and credential storage separately from Codex config injection.
+
 ## Config surface
 
 ### OpenCodex home and live process state
diff --git a/structure/gui-and-management-api.md b/structure/gui-and-management-api.md
index 05e766c96ce..f749739f3b8 100644
--- a/structure/gui-and-management-api.md
+++ b/structure/gui-and-management-api.md
@@ -11,6 +11,10 @@ The shared server request path follows the Responses
 The configuration-only [plaintext V2 contract](subagents.md#plaintext-v2-agent-messages)
 is scoped to canonical ChatGPT Responses forwarding; other source-area behavior described here is unchanged. Response-attached WebSocket telemetry follows the [stage record identity contract](transports/responses.md#passthrough-sse-stream-shapes-314). Management provider-validation calls use the [initialization-independent relative send-path validation](config.md#provider-relative-send-paths) before persistence. Catalog HTTP acquisition follows the [proxy-routing contract](catalog.md#remote-catalog-http-proxy-routing). CLI installation inspection reason codes, including Windows deferral, follow the [runtime inspection contract](runtime.md#lifecycle).
 
+The [Orca importer](codex-home.md#orca-source-owned-account-import) is a local CLI operation with
+no management route. Imported accounts use existing quota validation; deferred warmups reread
+linked sources after the quota await to reject revoked or rotated captures.
+
 ## Dashboard serving
 
 Account refresh actions follow the [credential refresh-lock identity contract](catalog.md#accounts-namespaces-and-pool-rotation): a held unreadable lock is distinct from one this process may release, and path-probe errors preserve the callback outcome. Cooperating lock metadata changes serialize through the existing SQLite mutation transaction; release keeps the descriptor open through identity comparison and any unlink, then closes it. Failed metadata writes remove only a matching owned path after successful coordination; unknown identity, failed probes or unavailable coordination retain the path for stale recovery. Async refresh work holds no metadata transaction. The bundled React dashboard is built into `gui/dist` and served by the same Bun proxy. `ocx gui` starts
diff --git a/structure/ops/docs-and-release.md b/structure/ops/docs-and-release.md
index 2b35ba3a546..14c3fcd1c7c 100644
--- a/structure/ops/docs-and-release.md
+++ b/structure/ops/docs-and-release.md
@@ -25,6 +25,10 @@ Native main reauthentication follows the [CLI JSON output contract](../runtime.m
 
 The Codex restart command follows the [CLI restart scope contract](../runtime.md#cli-codex-restart-scope).
 
+The account reference documents the [Orca source-owned import](../codex-home.md#orca-source-owned-account-import).
+Its local-only command is declared in `src/cli/capabilities.ts`, and the generated skill surface
+lists its required source/registry paths and preview/apply flags.
+
 ## Public docs
 
 The public documentation site lives in `docs-site/` and is built with Astro + Starlight. English is
diff --git a/structure/providers/openai-tiers.md b/structure/providers/openai-tiers.md
index f3fbd44cc20..745b9854527 100644
--- a/structure/providers/openai-tiers.md
+++ b/structure/providers/openai-tiers.md
@@ -7,6 +7,10 @@ Explicit Codex CLI installation observation does not identify an account, attest
 The configuration-only [plaintext V2 contract](../subagents.md#plaintext-v2-agent-messages)
 is scoped to canonical ChatGPT Responses forwarding; other source-area behavior described here is unchanged. CLI installation inspection reason codes, including Windows deferral, follow the [runtime inspection contract](../runtime.md#lifecycle).
 
+[Orca-linked pool accounts](../codex-home.md#orca-source-owned-account-import) use the current
+source access token and leave refresh ownership with Orca. They enter the pool validation-pending;
+import deduplicates by ChatGPT account ID, including shared-workspace IDs.
+
 This current contract supersedes the provider-identity and account-selection sections of
 `devlog/_fin/260717_openai_hardening`; that archived unit remains historical evidence for the
 earlier three-tier implementation. The replacement contract and its verification evidence live in
diff --git a/structure/runtime.md b/structure/runtime.md
index edf089b705a..45a24aae5c2 100644
--- a/structure/runtime.md
+++ b/structure/runtime.md
@@ -77,6 +77,10 @@ past installer identity or tool authenticity. No package-registry request, insta
 config write or process control occurs. Existing Windows `check` retains zero candidate/config
 filesystem I/O. A reported refusal can exit 0; consumers inspect `status`.
 
+The local account CLI and pool credential resolver share the
+[Orca source-owned import contract](codex-home.md#orca-source-owned-account-import): importing
+does not perform OAuth, and runtime credential resolution rereads the owned source.
+
 ## Entrypoints
 
 | Path | Responsibility |
diff --git a/structure/subagents.md b/structure/subagents.md
index 91ea815fbe6..9bcfd2a60eb 100644
--- a/structure/subagents.md
+++ b/structure/subagents.md
@@ -41,6 +41,10 @@ encryption marker when the upstream omitted it or returned a nonempty marker.
 
 Shared parsing and streaming follow the [request-copy](transports/byte-accounting.md#request-copy-accounting) and [stream-buffer accounting](transports/byte-accounting.md#stream-buffer-accounting) contracts. Response-attached WebSocket telemetry follows the [stage record identity contract](transports/responses.md#passthrough-sse-stream-shapes-314).
 
+Pool credentials used by subagent routes can be
+[linked to Orca-managed homes](codex-home.md#orca-source-owned-account-import). The account-store
+resolver enforces source identity and expiry before those credentials reach routing.
+
 ## Multi-agent surface mode (3-state)
 
 `OcxConfig.multiAgentMode` controls the `multi_agent_version` field stamped on catalog entries:
diff --git a/tests/cli/cli-account-orca-import.test.ts b/tests/cli/cli-account-orca-import.test.ts
new file mode 100644
index 00000000000..be96842dd31
--- /dev/null
+++ b/tests/cli/cli-account-orca-import.test.ts
@@ -0,0 +1,72 @@
+import { afterEach, beforeEach, describe, expect, spyOn, test } from "bun:test";
+import { cmdOrcaImport, type OrcaImportCommandDeps } from "../../src/cli/account-orca-import";
+
+const output: string[] = [];
+let log: ReturnType<typeof spyOn>;
+let error: ReturnType<typeof spyOn>;
+beforeEach(() => {
+  log = spyOn(console, "log").mockImplementation((value) => { output.push(String(value)); });
+  error = spyOn(console, "error").mockImplementation((value) => { output.push(String(value)); });
+});
+afterEach(() => { output.length = 0; log.mockRestore(); error.mockRestore(); });
+
+function deps(calls: unknown[], invalid = 0, eligible = 1): OrcaImportCommandDeps {
+  return { importAccounts: ((options) => {
+    calls.push(options);
+    return {
+      mode: options.apply ? "apply" : "preview", discovered: 2, eligible,
+      imported: options.apply ? eligible : 0, duplicates: 1, invalid,
+      invalidReasons: invalid > 0 ? { source_invalid: invalid } : {},
+    };
+  }) as NonNullable<OrcaImportCommandDeps["importAccounts"]> };
+}
+
+describe("Orca import command", () => {
+  test("defaults to preview and emits only counts in JSON", async () => {
+    const calls: unknown[] = [];
+    expect(await cmdOrcaImport(["--source", "private-source", "--registry", "private-registry", "--json"], deps(calls))).toBe(0);
+    expect(calls).toEqual([{ sourceDir: "private-source", registryPath: "private-registry", apply: false }]);
+    expect(JSON.parse(output[0]!)).toMatchObject({ mode: "preview", imported: 0 });
+    expect(output.join()).not.toContain("private-source");
+  });
+  test("only explicit apply commits and explains validation", async () => {
+    const calls: unknown[] = [];
+    expect(await cmdOrcaImport(["--source", "source", "--registry", "registry", "--apply"], deps(calls))).toBe(0);
+    expect(calls).toEqual([{ sourceDir: "source", registryPath: "registry", apply: true }]);
+    expect(output.join()).toContain("validate new accounts");
+  });
+  test.each([
+    { args: [] }, { args: ["--source"] }, { args: ["--source", "--apply"] },
+    { args: ["--source", "source", "--apply", "--apply"] },
+    { args: ["--source", "source", "--source", "other"] }, { args: ["--source", "source", "secret-extra"] },
+    { args: ["--source", "source"] },
+    { args: ["--source", "source", "--registry"] },
+    { args: ["--source", "source", "--registry", "registry", "--registry", "other"] },
+  ])("rejects invalid arguments before reading credentials: %j", async ({ args }) => {
+    const calls: unknown[] = [];
+    expect(await cmdOrcaImport(args, deps(calls))).toBe(1);
+    expect(calls).toHaveLength(0);
+    expect(output.join()).not.toContain("secret-extra");
+  });
+  test("only total invalid failure is nonzero while partial success reports safe reasons", async () => {
+    expect(await cmdOrcaImport(["--source", "source", "--registry", "registry", "--json"], deps([], 1, 0))).toBe(1);
+    expect(JSON.parse(output[0]!)).toMatchObject({ invalid: 1, invalidReasons: { source_invalid: 1 } });
+    output.length = 0;
+    expect(await cmdOrcaImport(["--source", "source", "--registry", "registry", "--json"], deps([], 1, 1))).toBe(0);
+    expect(JSON.parse(output[0]!)).toMatchObject({ eligible: 1, invalid: 1 });
+  });
+  test("never echoes filesystem or parser exceptions", async () => {
+    const throwing: OrcaImportCommandDeps = { importAccounts: () => { throw Error("secret-token private-path"); } };
+    expect(await cmdOrcaImport(["--source", "source", "--registry", "registry", "--json"], throwing)).toBe(1);
+    expect(output).toEqual(['{"error":"orca_import_failed"}']);
+  });
+  test("does not serialize extra private metadata from an importer result", async () => {
+    const withPrivateMetadata: OrcaImportCommandDeps = { importAccounts: () => ({
+      mode: "preview", discovered: 0, eligible: 0, imported: 0, duplicates: 0, invalid: 0,
+      invalidReasons: {},
+      sourcePath: "private-path", accessToken: "secret-token",
+    }) };
+    expect(await cmdOrcaImport(["--source", "source", "--registry", "registry", "--json"], withPrivateMetadata)).toBe(0);
+    expect(Object.keys(JSON.parse(output[0]!))).toEqual(["mode", "discovered", "eligible", "imported", "duplicates", "invalid", "invalidReasons"]);
+  });
+});
diff --git a/tests/codex-integration/codex-inject-integration.test.ts b/tests/codex-integration/codex-inject-integration.test.ts
index e5af4692d64..a78c16b8fd0 100644
--- a/tests/codex-integration/codex-inject-integration.test.ts
+++ b/tests/codex-integration/codex-inject-integration.test.ts
@@ -102,7 +102,9 @@ describe("injectCodexConfig integration (Design B)", () => {
       const { resolveCodexStateDbPath } = require("./src/codex/paths");
       const enabled = await injectCodexConfig(10100, {});
       if (!enabled.success) throw new Error("fixture injection failed");
-      const dbPath = join(process.env.CODEX_HOME, "state_5.sqlite");
+      // Match the runtime authority: Windows Temp may spell CODEX_HOME with an 8.3 alias,
+      // while getCodexHome resolves its long path. Manifest names bind to that path spelling.
+      const dbPath = require("./src/codex/paths").resolveCodexStateDbPath();
       const rollout = join(process.env.CODEX_HOME, "manifest-fixture.jsonl");
       fs.appendFileSync(join(process.env.CODEX_HOME,"config.toml"), [
         "# Auto-injected by opencodex",
@@ -133,7 +135,7 @@ describe("injectCodexConfig integration (Design B)", () => {
       console.log(JSON.stringify({entries,defaultEntries,result,provider,config,historyPreserved:historyPaths.every((p,i)=>fs.readFileSync(p,"utf8")===beforeHistory[i])}));
     `;
     const child = spawnSync(process.execPath, ["--eval", script], {
-      cwd: repoRoot, env: { ...process.env, CODEX_HOME: codexHome, OPENCODEX_HOME: ocxHome },
+      cwd: repoRoot, env: { ...process.env, CODEX_HOME: codexHome, CODEX_SQLITE_HOME: "", OPENCODEX_HOME: ocxHome },
       encoding: "utf8", timeout: SPAWN_BUDGET_MS - 5_000,
     });
     expect(child.status, child.stderr).toBe(0);
diff --git a/tests/codex-integration/orca-import.test.ts b/tests/codex-integration/orca-import.test.ts
new file mode 100644
index 00000000000..b2a122ed011
--- /dev/null
+++ b/tests/codex-integration/orca-import.test.ts
@@ -0,0 +1,277 @@
+import { afterEach, beforeEach, describe, expect, spyOn, test } from "bun:test";
+import { randomUUID } from "node:crypto";
+import { mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { loadConfig, saveConfig, setPersistedConfigMutationBeforeCommitForTests } from "../../src/config";
+import { parseOrcaAuth, readBoundedLocalFile, assertPlainLocalPath } from "../../src/codex/orca-auth-source";
+import { importOrcaAccounts } from "../../src/codex/orca-import";
+import { capturePoolQuotaWriter, forceRefreshCodexPoolToken, getCodexAccountCredential, getValidCodexToken, isPoolQuotaWriterLive, markCodexAccountValidated, poolQuotaHistoryIdentity, readCodexAccountRecord } from "../../src/codex/account-store";
+import { setAsyncIcaclsRunnerForTests, setIcaclsRunnerForTests } from "../../src/lib/windows-secret-acl";
+import { flushConfigDirHardeningForTests } from "../../src/config/paths";
+import { removeTreeWithRetry } from "../helpers/remove-tree";
+
+let scratch: string;
+let source: string;
+let target: string;
+let main: string;
+let registry: string;
+let originalHome: string | undefined;
+let originalCodexHome: string | undefined;
+
+function auth(account = "synthetic-account", sequence = 1, expiry = Date.now() + 3600_000, subject = "synthetic-subject") {
+  const claims = { sub: subject, exp: Math.floor(expiry / 1000), sequence,
+    "https://api.openai.com/auth": { chatgpt_account_id: account } };
+  const access = `synthetic.${Buffer.from(JSON.stringify(claims)).toString("base64url")}.fixture`;
+  return JSON.stringify({ tokens: { account_id: account, access_token: access, refresh_token: "synthetic-refresh-never-copy" } });
+}
+function addSource(raw = auth()) {
+  const path = join(source, "codex-accounts", randomUUID(), "home", "auth.json");
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, raw);
+  const id = dirname(dirname(path)).split(/[\\/]/).pop()!;
+  writeFileSync(join(dirname(path), ".orca-managed-home"), `${id}\n`);
+  const registered = JSON.parse(readFileSync(registry, "utf8"));
+  registered.settings.codexManagedAccounts.push({ id, managedHomePath: dirname(path), managedHomeRuntime: "host" });
+  writeFileSync(registry, JSON.stringify(registered));
+  return path;
+}
+function store() { return JSON.parse(readFileSync(join(target, "codex-accounts.json"), "utf8")); }
+function importedId() { return Object.keys(store())[0]!; }
+
+beforeEach(() => {
+  originalHome = process.env.OPENCODEX_HOME;
+  originalCodexHome = process.env.CODEX_HOME;
+  const ok = { success: true, exitCode: 0, timedOut: false, stdout: "" };
+  setIcaclsRunnerForTests(() => ok);
+  setAsyncIcaclsRunnerForTests(async () => ok);
+  // Resolve the platform temp alias before testing the production no-symlink boundary.
+  scratch = realpathSync.native(mkdtempSync(join(tmpdir(), "ocx-orca-import-")));
+  target = join(scratch, "target"); source = join(scratch, "orca"); main = join(scratch, "main");
+  for (const directory of [target, main, join(source, "codex-accounts")]) mkdirSync(directory, { recursive: true });
+  registry = join(source, "orca-data.json");
+  writeFileSync(registry, JSON.stringify({ settings: { codexManagedAccounts: [] } }));
+  process.env.OPENCODEX_HOME = target; process.env.CODEX_HOME = main;
+  saveConfig(loadConfig());
+});
+afterEach(async () => {
+  await flushConfigDirHardeningForTests();
+  setIcaclsRunnerForTests(null); setAsyncIcaclsRunnerForTests(null);
+  setPersistedConfigMutationBeforeCommitForTests(null);
+  if (originalHome === undefined) delete process.env.OPENCODEX_HOME; else process.env.OPENCODEX_HOME = originalHome;
+  if (originalCodexHome === undefined) delete process.env.CODEX_HOME; else process.env.CODEX_HOME = originalCodexHome;
+  removeTreeWithRetry(scratch);
+});
+
+describe("offline Orca import", () => {
+  test("preview writes nothing and reports no identities or paths", () => {
+    const sourcePath = addSource();
+    const before = readdirSync(target).map(name => [name, readFileSync(join(target, name)).toString("base64")]);
+    const raw = readFileSync(sourcePath, "utf8");
+    expect(importOrcaAccounts({ sourceDir: source, registryPath: registry })).toEqual({
+      mode: "preview", discovered: 1, eligible: 1, imported: 0, duplicates: 0, invalid: 0, invalidReasons: {},
+    });
+    expect(readdirSync(target).map(name => [name, readFileSync(join(target, name)).toString("base64")])).toEqual(before);
+    expect(readFileSync(sourcePath, "utf8")).toBe(raw);
+  });
+  test("apply imports once, links source, excludes refresh token, and remains pending", () => {
+    const path = addSource(); addSource();
+    const originalAuth = readFileSync(path, "utf8");
+    const fetchSpy = spyOn(globalThis, "fetch").mockImplementation(() => { throw new Error("unexpected network"); });
+    try {
+      expect(importOrcaAccounts({ sourceDir: source, registryPath: registry, apply: true })).toMatchObject({ imported: 1, duplicates: 1 });
+      expect(importOrcaAccounts({ sourceDir: source, registryPath: registry, apply: true })).toMatchObject({ imported: 0, duplicates: 2 });
+      expect(readFileSync(join(target, "codex-accounts.json"), "utf8")).not.toContain("synthetic-refresh-never-copy");
+      expect(store()[importedId()]).toMatchObject({ codexValidationPending: true, credential: { refreshToken: "" } });
+      expect(readFileSync(path, "utf8")).toBe(originalAuth);
+      expect(fetchSpy).not.toHaveBeenCalled();
+    } finally { fetchSpy.mockRestore(); }
+  });
+  test("deduplicates main and orphan credential records", () => {
+    addSource(auth("main-identity")); addSource(auth("orphan-identity"));
+    writeFileSync(join(main, "auth.json"), auth("main-identity"));
+    writeFileSync(join(target, "codex-accounts.json"), JSON.stringify({ orphan: {
+      accessToken: "fixture", refreshToken: "fixture", expiresAt: 0, chatgptAccountId: "orphan-identity" } }));
+    expect(importOrcaAccounts({ sourceDir: source, registryPath: registry, apply: true })).toMatchObject({ eligible: 0, duplicates: 2, imported: 0 });
+  });
+  test("retry completes interrupted registration using the same untouched credential record", () => {
+    const path = addSource();
+    const options = { sourceDir: source, registryPath: registry };
+    const id = `orca-${randomUUID()}`;
+    // Seed the exact crash boundary directly: credentials were published, config was not.
+    // Avoid an unrelated successful import and config rewrite just to construct this fixture.
+    const credential = { ...parseOrcaAuth(readFileSync(path, "utf8")), sourceAuthPath: path };
+    const before = JSON.stringify({ [id]: { credential, generation: 1, codexValidationPending: true } }, null, 2) + "\n";
+    writeFileSync(join(target, "codex-accounts.json"), before);
+    expect(importOrcaAccounts(options)).toMatchObject({ eligible: 1, imported: 0, duplicates: 0 });
+    expect(loadConfig().codexAccounts ?? []).toEqual([]);
+    expect(importOrcaAccounts({ ...options, apply: true })).toMatchObject({ imported: 1, duplicates: 0 });
+    expect(loadConfig().codexAccounts?.map(account => account.id)).toEqual([id]);
+    expect(readFileSync(join(target, "codex-accounts.json"), "utf8")).toBe(before);
+    expect(importOrcaAccounts({ ...options, apply: true })).toMatchObject({ imported: 0, duplicates: 1 });
+  });
+  test.each(["ordinary-id", "advanced", "validated", "deleted", "subject", "path", "refresh-grant", "another-orphan", "main"])("does not recover an unrelated %s orphan", scenario => {
+    addSource();
+    const options = { sourceDir: source, registryPath: registry, apply: true };
+    importOrcaAccounts(options);
+    const id = importedId();
+    const config = loadConfig(); config.codexAccounts = []; saveConfig(config);
+    const records = store();
+    const record = records[id];
+    if (scenario === "ordinary-id") { records.ordinary = record; delete records[id]; }
+    if (scenario === "advanced") record.generation = 2;
+    if (scenario === "validated") record.lastCodexValidationStatus = "ok";
+    if (scenario === "deleted") record.deletedAt = 1;
+    if (scenario === "subject") record.credential.sourceSubject = "different-subject";
+    if (scenario === "path") record.credential.sourceAuthPath = join(source, "other", "auth.json");
+    if (scenario === "refresh-grant") record.credential.refreshToken = "synthetic-owned-grant";
+    if (scenario === "another-orphan") records.ordinary = { ...record };
+    if (scenario === "main") writeFileSync(join(main, "auth.json"), auth());
+    const before = JSON.stringify(records, null, 2) + "\n";
+    writeFileSync(join(target, "codex-accounts.json"), before);
+    expect(importOrcaAccounts(options)).toMatchObject({ imported: 0, eligible: 0, duplicates: 1 });
+    expect(loadConfig().codexAccounts).toEqual([]);
+    expect(readFileSync(join(target, "codex-accounts.json"), "utf8")).toBe(before);
+  });
+  test("invalid and expired sources are skipped; unreadable main fails closed", () => {
+    addSource("{}"); addSource(auth("expired", 1, 0));
+    expect(importOrcaAccounts({ sourceDir: source, registryPath: registry })).toMatchObject({
+      invalid: 2, eligible: 0, invalidReasons: { source_invalid: 2 },
+    });
+    writeFileSync(join(main, "auth.json"), "not json");
+    expect(() => importOrcaAccounts({ sourceDir: source, registryPath: registry, apply: true })).toThrow();
+  });
+  test("reports fixed reason codes without source details", () => {
+    addSource();
+    const registered = JSON.parse(readFileSync(registry, "utf8"));
+    registered.settings.codexManagedAccounts.push({ id: "invalid", managedHomePath: "private-path" });
+    registered.settings.codexManagedAccounts[0].managedHomePath = source;
+    writeFileSync(registry, JSON.stringify(registered));
+    const result = importOrcaAccounts({ sourceDir: source, registryPath: registry });
+    expect(result.invalidReasons).toEqual({ home_mismatch: 1, unsupported_entry: 1 });
+    expect(JSON.stringify(result)).not.toContain("private-path");
+  });
+  test("rejects source credentials with only one source identity field", () => {
+    const base = { accessToken: "fixture", refreshToken: "", expiresAt: Date.now() + 60_000, chatgptAccountId: "fixture" };
+    writeFileSync(join(target, "codex-accounts.json"), JSON.stringify({
+      pathOnly: { generation: 1, credential: { ...base, sourceAuthPath: "/private/auth.json" } },
+      subjectOnly: { generation: 1, credential: { ...base, sourceSubject: "subject" } },
+    }));
+    expect(getCodexAccountCredential("pathOnly")).toBeNull();
+    expect(getCodexAccountCredential("subjectOnly")).toBeNull();
+  });
+  test("live proxy blocks apply", () => {
+    addSource(); writeFileSync(join(target, "ocx.pid"), String(process.pid));
+    expect(() => importOrcaAccounts({ sourceDir: source, registryPath: registry, apply: true })).toThrow("Stop the opencodex proxy");
+  });
+  test("failed config commit restores the exact previous credential store", () => {
+    addSource();
+    const path = join(target, "codex-accounts.json");
+    const original = '{"retained": {"generation": 7, "deletedAt": 1}}\n';
+    writeFileSync(path, original);
+    const configBefore = readFileSync(join(target, "config.json"), "utf8");
+    setPersistedConfigMutationBeforeCommitForTests(() => { throw new Error("synthetic commit failure"); });
+    expect(() => importOrcaAccounts({ sourceDir: source, registryPath: registry, apply: true })).toThrow();
+    expect(readFileSync(path, "utf8")).toBe(original);
+    expect(readFileSync(join(target, "config.json"), "utf8")).toBe(configBefore);
+    expect(importOrcaAccounts({ sourceDir: source, registryPath: registry, apply: true }).imported).toBe(1);
+  });
+  test("rejects mixed modes, network paths and files above the bounded read limit", () => {
+    const parsed = JSON.parse(auth());
+    expect(() => parseOrcaAuth(JSON.stringify({ ...parsed, auth_mode: "apikey" }))).toThrow();
+    expect(() => parseOrcaAuth(JSON.stringify({ ...parsed, OPENAI_API_KEY: "synthetic-key" }))).toThrow();
+    expect(() => assertPlainLocalPath("\\\\synthetic-server\\share\\auth.json")).toThrow();
+    const path = addSource("x".repeat(32));
+    expect(() => readBoundedLocalFile(path, 16)).toThrow();
+  });
+  test("imports only registered host homes with matching ownership markers", () => {
+    const path = addSource();
+    const registered = readFileSync(registry, "utf8");
+    writeFileSync(registry, JSON.stringify({ settings: { codexManagedAccounts: [] } }));
+    expect(importOrcaAccounts({ sourceDir: source, registryPath: registry })).toMatchObject({ discovered: 0, eligible: 0 });
+    writeFileSync(registry, registered);
+    writeFileSync(join(dirname(path), ".orca-managed-home"), "wrong-owner");
+    expect(importOrcaAccounts({ sourceDir: source, registryPath: registry })).toMatchObject({ invalid: 1, eligible: 0 });
+    unlinkSync(registry);
+    expect(() => importOrcaAccounts({ sourceDir: source, registryPath: registry })).toThrow();
+  });
+  test.skipIf(process.platform !== "win32")("accepts Windows registry home path capitalization", () => {
+    addSource();
+    const registered = JSON.parse(readFileSync(registry, "utf8"));
+    registered.settings.codexManagedAccounts[0].managedHomePath = registered.settings.codexManagedAccounts[0].managedHomePath.toUpperCase();
+    writeFileSync(registry, JSON.stringify(registered));
+    expect(importOrcaAccounts({ sourceDir: source, registryPath: registry })).toMatchObject({ eligible: 1, invalid: 0 });
+  });
+  test("rejects directory junctions without reading linked credentials", () => {
+    const path = addSource();
+    const link = join(scratch, "linked-source");
+    symlinkSync(source, link, process.platform === "win32" ? "junction" : "dir");
+    expect(() => readBoundedLocalFile(path.replace(source, link))).toThrow();
+  });
+  test("a validated source retains validation across same-identity rotation", async () => {
+    const path = addSource(); importOrcaAccounts({ sourceDir: source, registryPath: registry, apply: true });
+    const id = importedId();
+    const first = await getValidCodexToken(id);
+    markCodexAccountValidated(id, Date.now(), first.generation);
+    const oldWriter = capturePoolQuotaWriter(id, first);
+    if (!oldWriter) throw new Error("fixture quota writer was not captured");
+    writeFileSync(path, auth("synthetic-account", 2));
+    const second = await getValidCodexToken(id);
+    expect(second.generation).toBe(first.generation + 1);
+    expect(poolQuotaHistoryIdentity(id)).toBe(oldWriter.historyIdentity);
+    expect(isPoolQuotaWriterLive(oldWriter)).toBe(false);
+    const newWriter = capturePoolQuotaWriter(id, second);
+    if (!newWriter) throw new Error("rotated fixture quota writer was not captured");
+    expect(newWriter.historyIdentity).toBe(oldWriter.historyIdentity);
+    expect(isPoolQuotaWriterLive(newWriter)).toBe(true);
+    expect(readCodexAccountRecord(id)).toMatchObject({ lastCodexValidationStatus: "ok" });
+    expect(readCodexAccountRecord(id)?.codexValidationPending).toBeUndefined();
+  });
+  test("runtime follows source rotation with generation fence and never refreshes after 401", async () => {
+    const path = addSource(); importOrcaAccounts({ sourceDir: source, registryPath: registry, apply: true });
+    const id = importedId();
+    const fetchSpy = spyOn(globalThis, "fetch").mockImplementation(() => { throw new Error("unexpected network"); });
+    try {
+      const first = await getValidCodexToken(id);
+      await expect(forceRefreshCodexPoolToken(id, { rejectedGeneration: first.generation, rejectedAccessToken: first.accessToken })).rejects.toThrow("Orca bearer was rejected");
+      writeFileSync(path, auth("synthetic-account", 2));
+      const second = await getValidCodexToken(id);
+      expect(second.generation).toBe(first.generation + 1);
+      expect(second.accessToken).not.toBe(first.accessToken);
+      markCodexAccountValidated(id, Date.now(), first.generation);
+      expect(readCodexAccountRecord(id)?.codexValidationPending).toBe(true);
+      writeFileSync(path, auth("synthetic-account", 3, Date.now() + 3600_000, "different-subject"));
+      await expect(getValidCodexToken(id)).rejects.toThrow("identity changed");
+      writeFileSync(path, auth("synthetic-account", 3, 0));
+      await expect(getValidCodexToken(id)).rejects.toThrow("Orca credential unavailable");
+      writeFileSync(path, auth("other-account", 3));
+      await expect(getValidCodexToken(id)).rejects.toThrow("identity changed");
+      unlinkSync(path);
+      await expect(getValidCodexToken(id)).rejects.toThrow("Orca credential unavailable");
+      expect(fetchSpy).not.toHaveBeenCalled();
+    } finally { fetchSpy.mockRestore(); }
+  });
+  test.each(["removed", "rotated", "unchanged"])("deferred validation rereads a %s source after WHAM", async change => {
+    const { fetchPoolAccountQuota } = await import("../../src/codex/auth-api");
+    const path = addSource(); importOrcaAccounts({ sourceDir: source, registryPath: registry, apply: true });
+    const id = importedId();
+    let warmups = 0;
+    const fetchSpy = spyOn(globalThis, "fetch").mockImplementation(async input => {
+      if (String(input).endsWith("/wham/usage")) {
+        if (change === "removed") unlinkSync(path);
+        if (change === "rotated") writeFileSync(path, auth("synthetic-account", 2));
+        return Response.json({ plan_type: "pro", rate_limit: { secondary_window: { used_percent: 0, limit_window_seconds: 604800 } } });
+      }
+      if (String(input).endsWith("/codex/responses")) {
+        warmups++;
+        return new Response('data: {"type":"response.completed"}\n\n');
+      }
+      throw new Error("unexpected network request");
+    });
+    try {
+      await fetchPoolAccountQuota(id, true, "pro", getValidCodexToken, true);
+      expect(warmups).toBe(change === "unchanged" ? 1 : 0);
+      expect(readCodexAccountRecord(id)?.codexValidationPending).toBe(change === "unchanged" ? undefined : true);
+    } finally { fetchSpy.mockRestore(); }
+  });
+});
diff --git a/tests/fixtures/test-layout-expected.json b/tests/fixtures/test-layout-expected.json
index d59eeb0c836..e37f4d960fa 100644
--- a/tests/fixtures/test-layout-expected.json
+++ b/tests/fixtures/test-layout-expected.json
@@ -202,6 +202,8 @@
   "claude-system-env-auto.test.ts": "claude-integration",
   "cleanup-orphaned-workflows.test.ts": "ci-workflows",
   "clearable-deadline.test.ts": "lib",
+  "cli-account-orca-import.test.ts": "cli",
+
   "cli-account-pin-drain.test.ts": "cli",
   "cli-account-pool-verbs.test.ts": "cli",
   "cli-account.test.ts": "cli",
@@ -882,6 +884,7 @@
   "openrouter-provider-routing.test.ts": "providers",
   "openrouter-quota-reset-cooldown-4024.test.ts": "providers",
   "optional-shutdown-hooks.test.ts": "lib",
+  "orca-import.test.ts": "codex-integration",
   "orcarouter-provider.test.ts": "providers",
   "outbound-body-guard.test.ts": "server",
   "owned-service-home.test.ts": "server",