Addresses the third review round (Codex on 31cd0e4f5 + roboomp):
- Usage-path refresh row matching no longer compares the shared
REMOTE_REFRESH_SENTINEL as a refresh-token identity — with broker-backed
rows every credential carries the same sentinel, so the comparison
matched the FIRST OAuth row and could persist another org's rotated
token into the wrong row. The sentinel is now non-identifying; matching
falls through to access token, then account/email/project/org equality.
Regression: two same-email sentinel rows, expired Max row — the refresh
persists into the Max row only.
- roboomp's status-line finding (usage context key without orgId) was
already fixed in 31cd0e4f5 — its review raced the push. Added the
requested regression: rotating orgs under one email/account invalidates
the cached usage immediately; same-org calls stay cached.
- Added a Usage.orchestration sidecar for provider-side service tokens so Responses/Codex totals and costs stay accurate without inflating visible prompt input/cache buckets.
- Updated Codex/WebSocket usage, session/status aggregates, and usage reporting to preserve orchestration-aware totals.
- Added regressions for OpenAI Responses accounting, Codex WebSocket terminal usage, cost calculation, and session aggregation.
Fixes#4469
Kept observing a status-line usage fetch after the startup timeout so late successful reports still refresh the quota segment instead of being hidden behind the timeout backoff.\n\nFixes #3057
Deferred the status-line quota refresh off the render path and raced it against a short startup timeout so slow Anthropic usage lookups cannot pin interactive startup. Added regression coverage for non-synchronous refresh startup and timeout backoff.\n\nFixes #3057
chan1103