docs: record free-country SMS success and Codex2API region block

skill/codex-oauth-plus-onboarding/SKILL.md

@@ -48,7 +48,7 @@ These are confirmed operating rules for BOSS's environment:
 - ClawEmail creates a fresh mailbox for every run (`CLAWEMAIL_CREATE_PER_RUN=true`). Record every created mailbox locally with outcome classification: pending, success, failed. **Immediately after creation, actively set/verify the mailbox's communication settings before submitting it to OpenAI:** new sub-mailboxes can default to internal-only (`commLevel=1`, `extReceiveType=0`), which blocks OpenAI verification mail. The gate must pass with external receive enabled (`commLevel=2`, `extReceiveType=1`). Do not merely tell BOSS to do this manually: first try the logged-in ClawEmail Dashboard API `POST /api/v1/mailboxes/comm-settings?id=<mailboxId>` with `{commLevel:2, extReceiveType:1, extSendType:0}`. If the Dashboard is not logged in, open/login to it and ask BOSS only for the QQ master-mailbox 6-digit login code if the agent cannot read QQ mail. See `clawemail-operations` reference `references/clawemail-dashboard-comm-settings-openai-signup-2026-05-10.md` and this skill's `references/clawemail-external-receive-gate-openai-2026-05-10.md`.
 - Phone/SMS platform has no default. Keep `PHONE_VERIFICATION_ENABLED=false` and `PHONE_SMS_PROVIDER` empty unless BOSS configures one or approves enabling it after a phone verification appears.
 - If phone verification appears and BOSS has configured 5sim, use **SMS activation for `openai`**, not WhatsApp receive channels. The original extension's 5sim provider buys `/v1/user/buy/activation/{country}/{operator}/openai`, polls `/v1/user/check/{activationId}`, and finishes/cancels the activation. **Before buying any 5sim number, pass the identity gate:** the browser must already be confirmed on `auth.openai.com/add-phone` for a usable OpenAI account. If OpenAI returns `account_deactivated`, if ClawEmail cannot create a new sub-mailbox due to quota, or if reused sub-mailboxes only show password mismatch, stop and ask BOSS to free mailbox quota/provide the correct password/approve another mailbox provider. **Country selection priority is `FIVE_SIM_COUNTRY_ORDER` first** (comma-separated list such as `argentina,netherlands,indonesia`), then `FIVE_SIM_COUNTRY_ID`, then the original extension default `vietnam` only if both are empty. For each configured country, rotate numbers up to `PHONE_VERIFICATION_REPLACEMENT_LIMIT`; do **not** silently switch outside the configured order unless BOSS approves. Before buying/submitting a non-USA number, verify the OpenAI visible country selector is already the expected country (for example `阿根廷 (+54)`, `荷兰 (+31)`, `印度尼西亚 (+62)`, or `越南 (+84)`); if it reverted to `美国 (+1)`, fix the selector first or the number will be parsed as invalid. Use visible UI paste/click on `add-phone` when possible because CDP-only input mutation can desync React state and revert the country on submit. If a number is **not immediately rejected**, do not cancel it after one polling timeout: poll 5sim, click OpenAI `重新发送`, poll again, and retry resend at least once before canceling/rotating. If changing proxy (for example `1085` → `1083` or back), expect OpenAI auth session invalidation and restart from a fresh target OAuth URL. Codex2API env URLs may point at `/admin/accounts`; derive the API origin before calling `/api/admin/oauth/generate-auth-url`. If OpenAI returns `account_deactivated` after email verification, stop the current account and start with a new ClawEmail sub-mailbox instead of burning 5sim numbers. See `references/openai-add-phone-5sim-sms-activation-2026-05-10.md`, `references/openai-phone-verification-5sim-sms-2026-05-10.md`, `references/openai-phone-verification-proxy1083-resend-2026-05-10.md`, `references/codex-oauth-token-lite-automation-flow-2026-05-10.md`, and `references/clawemail-quota-identity-gate-before-phone-verify-2026-05-10.md` for observed behavior, resend strategy, proxy-switch recovery, identity-gate checks, and pitfalls.
-- If a phone-verification runner is stopped or interrupted, immediately inspect/cancel any active 5sim activation left in `RECEIVED`; killed scripts may not execute cleanup. For a UK `+44` run, use 5sim country slug `england`, OpenAI ISO `GB`, visible selector `英国 (+44)`, and dial prefix `44`. For a Europe broadened run requested as Italy/Poland/Spain/UK, use `italy -> IT -> 意大利 (+39)`, `poland -> PL -> 波兰 (+48)`, `spain -> ES -> 西班牙 (+34)`, and `england -> GB -> 英国 (+44)`. For Chile, use `chile -> CL -> 智利 (+56)` and prefix `56`; 5sim may return HTTP 200 `text/plain` body `no free phones` for `/v1/user/buy/activation/chile/any/openai`, which means no activation was created and no cancellation is needed. When BOSS says to run “10 次” across a country set, treat it as **10 total attempts across the ordered set**, not 10 per country, unless he explicitly says per-country; if BOSS says each region switches after 3 consecutive failures, schedule chunks as `country x3 -> next country`, capped by the global total. **For global budgets larger than one full pass of chunks, cycle the country chunks until the global budget is exhausted** (e.g. 20 attempts with 4 countries and chunk size 3 must continue after UK back to Italy; do not stop at 12). For the 2026-05-10 EU4 total-20 run, all 20 real activations ended with zero SMS and WhatsApp resend classification; see `references/openai-add-phone-eu4-total20-real-activations-2026-05-10.md`. Before buying any 5sim activation, enforce the `add-phone` identity gate: the active OpenAI page must already be a usable `https://auth.openai.com/add-phone`; if recovery lands on password mismatch, `invalid_state`, stale email verification, or `account_deactivated`, stop before buying numbers. One-off country test runners must hardcode/validate their effective country order at startup (e.g. `ORDER=['chile']`) and abort if it still reads a stale env order. Before opening a fresh OAuth recovery tab, close stale `auth.openai.com` / `phone-verification` / localhost callback tabs unless the current tab is already a usable `add-phone` page; this prevents tab pile-up and CDP target ambiguity. Before clicking OpenAI resend, **probe the resend channel without clicking** by reading button `value`/`aria-label`/`title`/text; if it says WhatsApp and BOSS's policy is SMS-only, cancel the SMS activation and rotate/stop instead of clicking. Classify `This page isn’t working` / `HTTP ERROR 500` / `500 Internal Server Error` after resend as `resend_server_error`, cancel the order, and recover to `add-phone`. See `references/openai-add-phone-strict-country-gate-2026-05-10.md`, `references/openai-add-phone-uk44-and-runner-cleanup-2026-05-10.md`, `references/openai-add-phone-eu4-roundrobin-correction-2026-05-10.md`, `references/openai-add-phone-eu4-3fail-switch-results-2026-05-10.md`, `references/openai-phone-country-scheduler-cyclic-chunks-2026-05-10.md`, `references/openai-add-phone-chile-no-free-phones-2026-05-10.md`, `references/openai-login-recovery-gate-before-phone-runs-2026-05-10.md`, `references/openai-oauth-tab-cleanup-before-recovery-2026-05-10.md`, and `references/official-extension-phone-update-2026-05-10.md`.
+- If a phone-verification runner is stopped or interrupted, immediately inspect/cancel any active 5sim activation left in `RECEIVED`; killed scripts may not execute cleanup. For a UK `+44` run, use 5sim country slug `england`, OpenAI ISO `GB`, visible selector `英国 (+44)`, and dial prefix `44`. For a Europe broadened run requested as Italy/Poland/Spain/UK, use `italy -> IT -> 意大利 (+39)`, `poland -> PL -> 波兰 (+48)`, `spain -> ES -> 西班牙 (+34)`, and `england -> GB -> 英国 (+44)`. For Chile, use `chile -> CL -> 智利 (+56)` and prefix `56`; 5sim may return HTTP 200 `text/plain` body `no free phones` for `/v1/user/buy/activation/chile/any/openai`, which means no activation was created and no cancellation is needed. When BOSS says to run “10 次” across a country set, treat it as **10 total attempts across the ordered set**, not 10 per country, unless he explicitly says per-country; if BOSS says each region switches after 3 consecutive failures, schedule chunks as `country x3 -> next country`, capped by the global total. **For global budgets larger than one full pass of chunks, cycle the country chunks until the global budget is exhausted** (e.g. 20 attempts with 4 countries and chunk size 3 must continue after UK back to Italy; do not stop at 12). When BOSS asks for free-country exploration, ignore stale `FIVE_SIM_COUNTRY_ORDER`, use a broad OpenAI-supported candidate map, cap each country (for example 2 real activations), and count only successful 5sim buys with activation ids toward the global budget; `no free phones`, country-gate/CDP errors before buying, and OAuth recovery failures are not real attempts. 5sim may return HTTP 200 `text/plain` such as `no free phones` from buy endpoints; classify it as inventory miss, no cancellation needed. For the 2026-05-10 EU4 total-20 run, all 20 real activations ended with zero SMS and WhatsApp resend classification; see `references/openai-add-phone-eu4-total20-real-activations-2026-05-10.md`. For the 2026-05-10 free-country run, Vietnam succeeded with a 5sim `openai` SMS activation, OpenAI phone verification passed, and OAuth consent produced a callback; the remaining blocker was Codex2API server-side token exchange returning `unsupported_country_region_territory` even after setting admin `proxy_url`, so inspect/fix Codex2API outbound proxy use for token exchange before retrying final callback. See `references/openai-phone-free-country-vietnam-sms-success-codex2api-region-block-2026-05-10.md`. For free-country runner policy and 5sim inventory quirks, see `references/openai-add-phone-free-country-runner-policy-2026-05-10.md`. Before buying any 5sim activation, enforce the `add-phone` identity gate: the active OpenAI page must already be a usable `https://auth.openai.com/add-phone`; if recovery lands on password mismatch, `invalid_state`, stale email verification, or `account_deactivated`, stop before buying numbers. One-off country test runners must hardcode/validate their effective country order at startup (e.g. `ORDER=['chile']`) and abort if it still reads a stale env order. Before opening a fresh OAuth recovery tab, close stale `auth.openai.com` / `phone-verification` / localhost callback tabs unless the current tab is already a usable `add-phone` page; this prevents tab pile-up and CDP target ambiguity. Before clicking OpenAI resend, **probe the resend channel without clicking** by reading button `value`/`aria-label`/`title`/text; if it says WhatsApp and BOSS's policy is SMS-only, cancel the SMS activation and rotate/stop instead of clicking. Classify `This page isn’t working` / `HTTP ERROR 500` / `500 Internal Server Error` after resend as `resend_server_error`, cancel the order, and recover to `add-phone`. See `references/openai-add-phone-strict-country-gate-2026-05-10.md`, `references/openai-add-phone-uk44-and-runner-cleanup-2026-05-10.md`, `references/openai-add-phone-eu4-roundrobin-correction-2026-05-10.md`, `references/openai-add-phone-eu4-3fail-switch-results-2026-05-10.md`, `references/openai-phone-country-scheduler-cyclic-chunks-2026-05-10.md`, `references/openai-add-phone-chile-no-free-phones-2026-05-10.md`, `references/openai-login-recovery-gate-before-phone-runs-2026-05-10.md`, `references/openai-oauth-tab-cleanup-before-recovery-2026-05-10.md`, and `references/official-extension-phone-update-2026-05-10.md`.
 - Plus mode uses `PLUS_PAYMENT_METHOD=gopay`. Any paid GoPay action still requires explicit confirmation immediately before payment/approval.
 - GoPay WhatsApp OTP uses **方案 A / manual checkpoint**: set `GOPAY_OTP_SOURCE=manual`. The extension detects OTP input and opens a side-panel prompt (`requestGoPayOtpInput` / “输入 GoPay 验证码”); BOSS pastes the WhatsApp code, then the extension fills OTP, fills `GOPAY_PIN`, and continues.
 - `GOPAY_OTP` should normally stay empty before the run. It is only a temporary prefill/cache for the current OTP dialog, not a durable secret.