Gaebabi · Nov 7, 2026 · Oct 16, 2026 · Oct 19, 2026 · Oct 21, 2026 · Nov 1, 2026
@@ -20,3 +20,31 @@
 - Keep development plan/status/operations and public guides consistent when paths/build/CI change. Local/private operating context belongs outside published documents.
 - Every issue/PR needs actual application verification screenshots: before/after for changed behavior and a confirmation screen for a new feature. Repository screenshots do not substitute. Planned work shows the existing app baseline and explicitly pending confirmation. Remove private source pixels before applying blur; captions state the actual evidence scope.
 - Create automatic backup commits only after satisfaction is confirmed. A direct PR request authorizes scoped branch commits/push/PR. Merge/release/external messages need explicit scope. A direct owner release request covers only the named version, platforms and verified publication/installation scope; preserve other releases and active Codex sessions.
+
+<!-- CODEXWORK_BUILD_CACHE_POLICY_20261019 -->
+
+## VM build and cache storage
+
+CODEXWORK VM builds use `D:/Workstation/Set-ProjectEnvironment.ps1 -Project codex-switch` and the registered `PROJECT_BUILD_ROOT` / `PROJECT_CACHE_ROOT`. Read `D:/Workstation/BUILD_CACHE_POLICY.md`. Reproducible outputs belong under `W:/Builds/CODEXWORK/codex-switch`; use each tool's real output option. Do not silently create a second output on D: when W: is unavailable. Source, real Git worktrees, credentials, databases, emulator userdata, original assets and final acceptance evidence stay on D:. Keep active Unity Library/Temp and executable virtual environments local for filesystem/locking compatibility; do not move or delete active caches. W: is regenerable storage on the acknowledged HDD; only separately backed-up asset copies belong there. Large build admission requires 40 GiB free on D:; archive verified inactive checkpoints to the reliable HostSourceHistory area first, never discard unique state.
+
+<!-- CODEXWORK_REGISTERED_SHARED_BUILDS_20261019 -->
+
+## Codex shared-storage build execution
+
+Windows elevated Codex sandbox accounts have a separate drive/authentication context: they cannot directly use the interactive user's W: SMB mapping. Do not disable the sandbox, add network drives as native writable roots, or replace missing W: with local D: outputs. Submit registered operations to the ordinary-user build worker:
+
+`D:/Tools/Python311/python.exe D:/Workstation/Invoke-ProjectBuild.py --project <project> --operation <operation>`
+
+Operations: `storage-probe` (harmless write/read/delete); `npm-ci`, `npm-build`, `npm-test` (optional `--relative-path` to the package folder); `dotnet-restore`, `dotnet-build`, `dotnet-test` (`--relative-path` to the repository's csproj/sln); `reborn-windows`, `reborn-android`, `reborn-editmode`, `reborn-audit` for DragonMate-Reborn; `infinity-android` for InfinityCrystal-Unity. Only registered projects/operations are accepted; arbitrary shell commands and paths outside the project are rejected. The worker runs as the normal CodexWork user and receives build/cache routing without unrelated credentials. Build admission requires 40 GiB free on local D:.
+
+The client waits up to 30 seconds, then returns a receipt path while the same build continues. Read that receipt and its existing operation lease; do not start a duplicate. Detailed logs stay in D:/Workstation/private/shared-build-logs. Do not kill unrelated build processes. A routing probe is infrastructure evidence, not product compilation or Player acceptance.
+
+The permanent ordinary-user task is CodexWork-RegisteredSharedBuildWorker, starts at CodexWork logon, and accepts structured requests only under D:/Caches/Temp/CodexSharedBuildQueue. Preserve this active queue during temp cleanup. The only extra native sandbox writable root is this local queue, not W: or historical/private data. Normal interactive terminals may use Set-ProjectEnvironment and the project tools directly. In CodexSandbox accounts the environment loader skips user DPAPI Git credentials and uses this registered build path for shared I/O.
+
+<!-- W_ONLY_BINARY_OUTPUTS_20261022 -->
+## 사용자 지시: 빌드 산출물은 W:만 사용 (2026-10-22)
+
+- APK/AAB/Player/배포 ZIP 및 재생성 dist/bin/obj/publish는 `W:/Builds/CODEXWORK/<project>`에만 생성한다. D:/Deliverables 또는 D:/artifacts로 바이너리를 다시 복사하지 않는다. “최종 증거”/durableRoot를 빌드 복사 예외로 해석하지 않는다.
+- `D:/Workstation/BuildOutputPolicy.py --project <project> --output <W: 새 경로>`로 실제 경로와 공유 저장소 쓰기/읽기를 검사한다. W: 실패 시 중단하며 D: 대체는 금지한다. 등록 worker의 npm/.NET 출력 검사도 우회하지 않는다.
+- D: 검수 증거는 로그·manifest·해시·원본 화면/영상·장부다. 소스·DB·인증·AVD·설치된 도구·원본 에셋/복구 입력을 빌드 정리로 지우지 않는다. Unity Library/Temp와 OS TEMP는 도구 호환성상 로컬 D:를 유지한다. D: 40GiB 여유 조건은 이 로컬 중간 작업 공간 조건이며 APK 출력 위치가 아니다.
+- 자세한 정본은 `D:/Workstation/BUILD_CACHE_POLICY.md`와 `build-cache-routing.json`이다. 과거 D: 산출물은 W: 사본 SHA 검증 후 로컬 실데이터만 제거하고 필요한 옛 경로는 링크로 유지한다. 실행 중 쓰기·추적된 원본·검수 증거 혼합 폴더를 일괄 삭제하지 않는다.
diff --git a/Directory.Build.props b/Directory.Build.props
@@ -6,4 +6,8 @@
     <RuntimeFrameworkVersion>10.0.13</RuntimeFrameworkVersion>
     <TargetLatestRuntimePatch>false</TargetLatestRuntimePatch>
   </PropertyGroup>
+  <PropertyGroup Condition="'$(COMPUTERNAME)' == 'CODEXWORK'">
+    <BaseOutputPath>W:\Builds\CODEXWORK\codex-switch\$(MSBuildProjectName)\bin\</BaseOutputPath>
+    <BaseIntermediateOutputPath>W:\Caches\CODEXWORK\projects\codex-switch\msbuild\$(MSBuildProjectName)\obj\</BaseIntermediateOutputPath>
+  </PropertyGroup>
 </Project>
diff --git a/README.md b/README.md
@@ -1,7 +1,7 @@
 <p align="center"><img src="assets/macos/app-icon.png" width="88" height="88" alt="Codex Switch app icon" /></p>
-<h1 align="center">Codex Switch</h1>
+<h1 align="center">Codex Switch: OpenAI Codex account switcher and quota monitor</h1>
 
-**A desktop account switcher and quota dashboard for OpenAI Codex.** See your accounts together, choose the next one, and recover an interrupted handoff. Optional quota-based switching starts **Off**.
+**Codex Switch (`codex-switch`) is an open-source desktop account switcher and usage quota monitor for OpenAI Codex.** See your accounts together, choose the next one, and recover an interrupted handoff. Optional quota-based switching starts **Off**.
 
 Windows · macOS15+ · Linux preview · MIT open source · **1.44.0**
 

diff --git a/docs/ARCHITECTURE.md b/docs/ARCHITECTURE.md
@@ -2,6 +2,10 @@
 
 The optional model gateway uses bounded in-memory request arrays:1GiB aggregate capacity with small-request headroom,16 upload/routing slots, eight large uploads and48independent response streams. Token validation and original-byte slices avoid full JSON history copies for native and custom routes. Array growth reserves overlap; buffers and upload slots release at response headers. Overload never replays inference. [Limits](MODEL_PROVIDERS.md) / [verification](evidence/gateway-load/README.md).
 
+`GatewayUpstreamRetry` adds three bounded retries only for a streaming Responses request explicitly refused with HTTP507before a successful upstream response. Each attempt recreates a message around the same budgeted input and immutable route; retryable refusals dispose their response/content first. Backoff SSE comments detect caller disconnect and preserve one client turn, while authentication is rechecked before resubmission. After final headers the input and upload capacity release normally. Exhaustion is a terminal SSE failure; ambiguous transport/stream failures, images and compaction are never replayed. [Recovery contract](MODEL_PROVIDERS.md#automatic-http507-recovery).
+
+`DesktopStreamRecoveryMonitor` separately handles a persisted failed turn of any error type after the desktop is stopped. Eligibility uses terminal status rather than error prose, including failed completions with no message; actual interruptions remain excluded. It continues saved chat context through the current owner with inherited settings; it never replays the original HTTP request. `StreamRecoveryCoordinator` persists a three-attempt chain before each identified Continue, retaining ambiguity/exhaustion across restart. Exact SQLite metadata and bounded read-only rollout completion, current model/owner/queue and unchanged authenticated connected route gate submission. First-request failures need no fabricated successful-route record; gateway history checks still apply. Bounded fixed-code decisions expose why recovery ran or skipped without raw errors or chat text. [Stream recovery](MODEL_PROVIDERS.md#continue-after-a-failed-response-stream).
+
 Release1.43.3 adds ModelProviderManager, ModelProviderStore, ProviderCatalog and ModelGateway in the existing application assembly, with WPF/shared desktop editors. Provider keys and connection recovery use the existing native protection identity in a separate encrypted file. The loopback gateway routes each selected alias using an immutable request snapshot; OpenAI authentication is confined to its OpenAI route. Official config RPCs atomically prepare or restore only owned settings. [Compatibility, history and acceptance](MODEL_PROVIDERS.md).
 
 Source1.41.0 adds `LinuxTerminalCommands` in the UI-neutral Application assembly. The Linux host dispatches `cli` before Avalonia/native display initialization. It composes the existing vault/account/policy/native executable services, serializes with GUI and terminal operations, refuses conflicting CLI clients, and delegates exact CLI/exec session restoration to the descriptor-bound official executable. It uses no shell, permission override, desktop adoption or plaintext credential path. [Terminal contract and current evidence](development/LINUX_TERMINAL.md).
@@ -49,6 +53,7 @@ Source1.32.0 adds `src/application/CodexSwitch.Application.csproj` and `src/desk
 - Background reads stay asynchronous; login triggers an immediate read for that account. Credentials use serialized revisions to avoid overwriting newer authentication.
 - Windows vault protection is current-user DPAPI. Mac uses AES-GCM with a Keychain-held key. The existing CodexAccountDesk data paths and IPC identity are retained.
 - Desktop counts use observed root-chat state. Queue reads combine saved JSON and committed SQLite/WAL, filter desktop roots and deduplicate client/submission IDs. Observer protocol or schema failure hides unsupported counts.
+- Errors counts currently stopped observed root chats: runtime systemError, or idle with latest turn failed. It excludes active/interrupted/recovered/child chats and stays unknown until full discovery. Both desktop presentations share this ledger result; no transcript scan or cumulative request error counter is used.
 - CPU/MEM/GPU/VRAM sample every 2 seconds, drives every 15 seconds, account auto-refresh every 60 seconds. Resource warning/critical thresholds are 70/85%, released 5 percentage points lower.
 - Windows GPU usage is the busiest aggregated engine; VRAM is the highest supported adapter ratio. Mac driver limitations remain visible as unknown.
 - Only the active account animates its water surface. Menus/tooltips share theme components and stable hover targets across updates.