# OpenAI phone verification: configured 5sim country order and account-deactivated recovery (2026-05-10)

## Why this note exists

During a Codex2API OAuth onboarding continuation, the agent mistakenly looked only at `FIVE_SIM_COUNTRY_ID=` and treated the empty value as permission to fall back to the original extension default `vietnam`. BOSS corrected that the active configuration already had a country allow/order list:

```bash
FIVE_SIM_COUNTRY_ORDER=argentina,netherlands,indonesia
FIVE_SIM_COUNTRY_ID=
FIVE_SIM_COUNTRY_FALLBACK=
PHONE_VERIFICATION_REPLACEMENT_LIMIT=3
```

Future runs must treat `FIVE_SIM_COUNTRY_ORDER` as the primary configuration, not as a secondary hint.

## Correct country precedence

Use this order when buying 5sim SMS activation numbers for OpenAI `add-phone`:

1. If `FIVE_SIM_COUNTRY_ORDER` is non-empty, split it by comma and try countries in that order.
2. For each country in the order, try up to `PHONE_VERIFICATION_REPLACEMENT_LIMIT` replacement numbers unless BOSS overrides.
3. Only if `FIVE_SIM_COUNTRY_ORDER` is empty, use `FIVE_SIM_COUNTRY_ID`.
4. Only if both are empty, use the extension default such as `vietnam`.
5. Do not silently switch outside the configured order; ask BOSS or update config first.

For the observed config, the correct sequence was:

```text
argentina -> netherlands -> indonesia
```

not Vietnam.

## 5sim/OpenAI retry behavior

- Use SMS activation only, not WhatsApp:
  - `GET /v1/user/buy/activation/{country}/{operator}/openai`
  - `GET /v1/user/check/{activationId}`
  - `GET /v1/user/cancel/{activationId}` when abandoning.
- For direct OpenAI rejection (`无法向此电话号码发送验证码。请稍后重试或使用其他号码。`): cancel that activation and buy a new number in the same configured country until the per-country replacement limit is hit.
- For a number that is not directly rejected: keep the activation, poll 5sim, click OpenAI `重新发送` if no SMS arrives, then poll again before canceling.
- Always confirm the visible OpenAI country selector matches the 5sim country before buying/submitting. CDP-only field mutation can desync React state and cause the page to parse a non-US number as `美国 (+1)`.

## Country selector examples from the active config

Expected visible country labels:

```text
argentina -> 阿根廷 (+54)
netherlands -> 荷兰 (+31)
indonesia -> 印度尼西亚 (+62)
```

Use visible UI selection or a DOM click on the real option element. Do not mutate hidden state only.

## Email verification recovery caveat

After repeated phone-number attempts, canceling a non-rejected activation, or changing proxy, OpenAI may settle back to:

```text
https://auth.openai.com/email-verification
电子邮件地址已验证
```

To continue, re-open a fresh Codex2API OAuth URL and complete email login again. When polling ClawEmail:

- Sort OpenAI mail candidates by message date; do not trust list order alone.
- Confirm the code visible in the page input if submission stalls.
- If `重新发送电子邮件` does not produce a new code and the page returns:

```text
糟糕，出错了！
验证过程中出错 (account_deactivated)。请重试。
```

then the current OpenAI account is deactivated and cannot continue to phone verification. Stop trying phone numbers for that email; start a new ClawEmail sub-mailbox/register flow and then apply the configured country order above.

## 1085 rollback confirmation

BOSS later requested switching the browser proxy back from `socks5://192.168.2.8:1083` to `socks5://192.168.2.8:1085` and retrying the same mailbox before giving up. The correct check sequence was:

1. Patch `BROWSER_PROXY_SERVER=socks5://192.168.2.8:1085` in `~/.hermes/env/codex_oauth_onboarding.env`.
2. Verify the LAN proxy before browser work:
   - `nc -vz -w 2 192.168.2.8 1085`
   - `curl --proxy socks5h://192.168.2.8:1085 --max-time 8 https://api.ipify.org?format=json`
3. Kill the existing `remote-debugging-port=9223` Chrome and relaunch the isolated profile with `--proxy-server=socks5://192.168.2.8:1085`.
4. Generate a fresh Codex2API OAuth URL from the API origin, not from `/admin/accounts`.
5. Repeat email login and submit the newest OpenAI code.

Observed result: `1085` was reachable and showed exit IP `13.158.3.8`, but the same mailbox still returned `account_deactivated` after submitting the newest email code. This means proxy rollback did not rescue the mailbox; do not proceed to 5sim for an account that is already deactivated.

## Session outcome

The current account reached `account_deactivated` before the corrected country-order phone test could proceed. The learned correction is still valid: future runs must honor `FIVE_SIM_COUNTRY_ORDER=argentina,netherlands,indonesia` before considering defaults.