[veryCrunchy]

DNS delegation could cross tenant boundaries or remain active after revocation, while payment retries and concurrent credit updates could lose or duplicate financial effects. This change enforces DNS ownership and current organization status, makes webhook processing transactional and idempotent, and serializes balance updates.

It also catches up missed monthly billing periods, removes plaintext DNS key logging, revokes both cached platform-admin roles, creates organizations with their owner and plan atomically, and persists notification email jobs so failed sends and restarts can recover them.

Validation:

• Affected Go suites passed through Nx with the race detector.
• Isolated PostgreSQL regressions cover DNS ownership/revocation, signed synthetic Stripe requests, failed transactions, concurrent credits, billing catch-up, organization creation rollback and durable email recovery.
• SMTP timeout/cancellation and cached-admin demotion regressions pass.
• A dedicated Service Recovery Regressions workflow runs shared authentication/SMTP tests and PostgreSQL regressions for DNS, billing, organizations and notifications. The existing general CI workflow is manually disabled in repository settings, which this PR leaves unchanged.
• Codex review fixes add DNS refresh batching within both count and byte limits, and billing transactions that reuse their lock connection. Regression tests cover large DNS refreshes, one-connection billing pools, concurrent organizations and cancellation against primary/separate metrics databases.
• At b658f0b, all 30 reported checks passed, with no failures or pending checks. Both reported Codex review threads are resolved.

Rollout considerations:

• Review historical payment/credit inconsistencies and previously ownerless organizations separately; this change does not automatically repair production history.
• Review/rotate DNS keys previously exposed in logs and replace legacy keys that lack an organization association.
• Billing catch-up may generate previously missed bills. Email recovery is at least once, so loss of acknowledgement after SMTP acceptance can produce a duplicate.
• Backup storage provisioning remains deferred.

No production deployment, real payment or outbound email was performed during local validation.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-27T16:16:45.734422Z	b658f0b	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6985b17aec

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".