Merge runtime token recovery and quota review fixes

Co-Authored-By: Paperclip <noreply@paperclip.ing>

doc/connections/AI-CONNECTIONS.md

@@ -546,7 +546,12 @@ key and fsynced under `<instance-root>/quota-credential-recovery/<company-id>/`
 before vault, grant, or activity writes. Storage and encryption are checked before
 exchanging a single-use refresh token. Failed saves retry without another OAuth
 exchange; persistent failures keep the encrypted record for the next quota poll,
-including after a restart. The journal is removed only after database commit (or
+including after a restart. New OpenAI subscription runtimes serialize credential
+reads with quota exchanges and recover a matching pending replacement before
+materializing an auth home. Authentication-failure handling also recovers a
+matching replacement before marking the grant invalid. A failed recovery save
+defers these actions and leaves both the active grant and journal intact.
+The journal is removed only after database commit (or
 when an authorized newer credential makes it obsolete). Replay checks the grant,
 connection, secret, and original credential fingerprint and cannot reactivate a
 revoked grant or overwrite a reconnect. Back up this directory and the instance