The tightened 401 token dropped 'HTTP 401: Unauthorized' (the exact shape
_summarize_api_error emits), 'returned 401.' and 'HTTP 401, ...' — every real
envelope fell to the generic 'kept failing' reply with no /login hint. Only the
lookbehind is needed for the '05:14:15,401' timestamp case: (?<![\d:,.])401(?!\d).
Control assertions cover both directions.
The gateway's private reset-seconds regex is gone: 'resets_in_seconds' joins
agent.retry_utils.RETRY_DELAY_PATTERNS and _rate_limit_reply calls
reset_delay_from_message, so 'resets in 4hr 5min' weekly-limit text now names
its window too, and format_reset_window is the one renderer.
The direct-call user_text() test is replaced by one driving TurnRunner.run_sync
with _resolve_session_agent_runtime raising the codex_rate_limited RuntimeError;
it goes red when the is_rate_limited branch is removed. (#89401)
b2af1700f3