@drakon-systems/multi-clawd 1.9.6 → 1.9.8

package/README.md

@@ -245,8 +245,9 @@ claude-cli/claude-fable-5        # main login
 - 🔁 **In-turn retry on a reactive limit** — when an account hits a model cap
   *during* a launch, the pool no longer loses that turn to the next provider in
   your chain: the refusal is swallowed before anything reaches you and the turn
-  is re-spawned on a healthy account. Fresh launches, secret-free sibling
-  accounts, one retry.
+  is re-spawned on a healthy account. Covers ongoing conversations too: the
+  session is handed to the sibling as it stood before the refused attempt.
+  Secret-free sibling accounts, one retry.
 - 📟 **Operator alerts (v0.3)** — dead logins (probed every 15 min without
   spending quota), pool rotations, whole-pool exhaustion, and watchdog
   restarts surface through your agent's next heartbeat (e.g. straight into
@@ -375,7 +376,7 @@ openclaw plugins install (Get-Location).Path
 **Or let your agent install it.** Running an OpenClaw assistant or Claude
 Code on the target machine already? Paste it this and go make coffee:
 
-> Read https://raw.githubusercontent.com/Drakon-Systems-Ltd/multi-clawd/v1.9.6/SETUP-AGENT.md
+> Read https://raw.githubusercontent.com/Drakon-Systems-Ltd/multi-clawd/v1.9.8/SETUP-AGENT.md
 > and follow it to set up multi-clawd on this machine. I own a second
 > Claude account — ask me when you need me to log in.
 

package/dist/health.js

@@ -1,4 +1,4 @@
-import { modelWindowKey } from "./shim-core.js";
+import { modelWindowApplies, modelWindowKey } from "./shim-core.js";
 const DEFAULT_UTILIZATION_THRESHOLD = 0.85;
 const DEFAULT_STALE_AFTER_MS = 6 * 60 * 60 * 1000;
 export const MODEL_REJECTED_TTL_MS = 60 * 60 * 1000;
@@ -78,8 +78,7 @@ export function classifyAccountHealth(state, options, nowMs, requestedModel) {
             if (!modelFresh)
                 continue;
             hasLiveEvidence = true;
-            const canonicalWindow = modelWindowKey(window.slice(MODEL_WINDOW_PREFIX.length));
-            if (!requestedWindowKey || canonicalWindow !== requestedWindowKey)
+            if (requestedModel === undefined || !modelWindowApplies(window, w, requestedModel))
                 continue;
             if (w.status !== "rejected")
                 continue;
@@ -88,6 +87,7 @@ export function classifyAccountHealth(state, options, nowMs, requestedModel) {
                     return {
                         verdict: "exhausted",
                         resumeAt: resetMs,
+                        observedAt: w.seenAt,
                         reason: `${requestedModel} limit rejected until ${new Date(resetMs).toISOString()}`,
                     };
                 }
@@ -96,6 +96,7 @@ export function classifyAccountHealth(state, options, nowMs, requestedModel) {
             return {
                 verdict: "exhausted",
                 resumeAt: w.seenAt + MODEL_REJECTED_TTL_MS,
+                observedAt: w.seenAt,
                 reason: `${requestedModel} limit hit ${Math.round((nowMs - w.seenAt) / 60000)}m ago (no reset time; TTL block)`,
             };
         }
@@ -114,6 +115,7 @@ export function classifyAccountHealth(state, options, nowMs, requestedModel) {
             return {
                 verdict: "exhausted",
                 resumeAt: resetMs,
+                observedAt: w.seenAt,
                 reason: `${window} rejected until ${new Date(resetMs).toISOString()}`,
             };
         }
@@ -125,6 +127,7 @@ export function classifyAccountHealth(state, options, nowMs, requestedModel) {
             return {
                 verdict: "exhausted",
                 resumeAt: w.seenAt + resetLessBlockMs(window),
+                observedAt: w.seenAt,
                 reason: `${window} rejected ${Math.round((nowMs - w.seenAt) / 60000)}m ago (no reset time; ${Math.round(resetLessBlockMs(window) / 3600000)}h block)`,
             };
         }
@@ -200,9 +203,24 @@ export function choosePoolAccount(pool) {
 export function allCredentialFailed(pool) {
     return pool.length > 0 && pool.every((a) => a.verdict === "credential_failed");
 }
-export function fallbackPoolAccount(pool) {
+export function overdueProbeAccount(pool, nowMs) {
+    let oldest;
+    for (const a of pool) {
+        if (a.verdict !== "exhausted" || a.observedAt === undefined)
+            continue;
+        if (nowMs - a.observedAt <= REJECTION_REVALIDATE_AFTER_MS)
+            continue;
+        if (!oldest || a.observedAt < oldest.observedAt)
+            oldest = a;
+    }
+    return oldest?.id;
+}
+export function fallbackPoolAccount(pool, nowMs) {
+    const probe = nowMs === undefined ? undefined : overdueProbeAccount(pool, nowMs);
+    if (probe)
+        return probe;
     return (pool.find((a) => a.verdict !== "credential_failed") ?? pool[0]).id;
 }
-export function pickPoolAccountForLaunch(pool) {
-    return choosePoolAccount(pool) ?? fallbackPoolAccount(pool);
+export function pickPoolAccountForLaunch(pool, nowMs) {
+    return choosePoolAccount(pool) ?? fallbackPoolAccount(pool, nowMs);
 }

package/dist/index.js

@@ -7,7 +7,7 @@ import { MODEL_ALIASES, buildCatalogEntries, canonicalModelId, isModernClaudeMod
 import { decideDegradation, matchesPin } from "./degrade.js";
 import { resolveExecMode, permissionModeArgs } from "./exec-policy.js";
 import { resolveBaseModelIds } from "./catalog-source.js";
-import { allCredentialFailed, classifyAccountHealth } from "./health.js";
+import { allCredentialFailed, classifyAccountHealth, overdueProbeAccount, } from "./health.js";
 import { decideStickySelection } from "./sticky.js";
 import { mergeHealthStates, parseStoredState, recordCredentialFailure, } from "./shim-core.js";
 import { createTokenRefResolver, isSecretRefShape, } from "./token-resolution.js";
@@ -25,6 +25,7 @@ import { execFileSync } from "node:child_process";
 import { collectDirectMembers } from "./direct-route.js";
 import { createDirectOrderController, isValidAgentId } from "./direct-sync.js";
 import { createOpenclawRunner } from "./openclaw-runner.js";
+import { materialiseRuntime } from "./runtime-home.js";
 const CLI_FRESH_WATCHDOG_DEFAULTS = {
     noOutputTimeoutRatio: 0.8,
     minMs: 180_000,
@@ -332,7 +333,12 @@ function buildRuntimeModel(account, modelId) {
         },
     };
 }
-const SHIM_PATH = fileURLToPath(new URL("./shim.js", import.meta.url));
+const SHIM_RUNTIME = materialiseRuntime(dirname(fileURLToPath(import.meta.url)), join(homedir(), ".openclaw", "state", "multi-clawd"));
+if (!SHIM_RUNTIME.stable) {
+    console.error(`[multi-clawd] could not copy the shim to a stable dir (${SHIM_RUNTIME.error}); ` +
+        `using the load path, which dies if OpenClaw prunes its plugin capture (issue #31)`);
+}
+const SHIM_PATH = SHIM_RUNTIME.shimPath;
 function knownModelsFile() {
     return join(homedir(), ".openclaw", "state", "multi-clawd", "known-models.json");
 }
@@ -672,15 +678,28 @@ export function registerPoolBackend(api, pool, accounts, registeredIds, execMode
             throw new Error(`[multi-clawd] ${text}`);
         }
         const previousSticky = readStickyEntry(stickyFile);
+        const poolVerdicts = verdicts.map((v) => ({
+            id: v.id,
+            verdict: v.health.verdict,
+            observedAt: v.health.observedAt,
+        }));
         const decision = decideStickySelection({
-            verdicts: verdicts.map((v) => ({ id: v.id, verdict: v.health.verdict })),
+            verdicts: poolVerdicts,
             sticky: previousSticky,
             nowMs: now,
             minDwellMs,
         });
         const chosen = members.find((a) => a.id === decision.account) ?? members[0];
         const previousAccount = previousSticky?.account ?? members[0].id;
-        if (decision.account !== previousAccount) {
+        const probing = overdueProbeAccount(poolVerdicts, now) === decision.account &&
+            poolVerdicts.every((v) => v.verdict === "exhausted" || v.verdict === "credential_failed");
+        if (probing) {
+            const observedAt = poolVerdicts.find((v) => v.id === decision.account)?.observedAt ?? now;
+            logger.info(`[multi-clawd] pool ${poolId}: every account is exhausted for ${requestedModel} — ` +
+                `launching on ${decision.account} to re-test a rejection last seen ` +
+                `${Math.round((now - observedAt) / 3600000)}h ago`);
+        }
+        else if (decision.account !== previousAccount) {
             const home = verdicts[0];
             const line = decision.account === members[0].id
                 ? `pool ${poolId}: returning home to ${decision.account}`

package/dist/retry-plan.js

@@ -1,4 +1,5 @@
-import { classifyAccountHealth } from "./health.js";
+import { classifyAccountHealth, overdueProbeAccount, } from "./health.js";
+import { resumeSessionId } from "./session-handover.js";
 export const RETRY_ROSTER_ENV = "MULTI_CLAWD_RETRY_ACCOUNTS";
 const CREDENTIAL_ENV_KEYS = ["CLAUDE_CONFIG_DIR", "CLAUDE_CODE_OAUTH_TOKEN"];
 export function parseRetryRoster(raw) {
@@ -33,14 +34,19 @@ export function parseRetryRoster(raw) {
     }
     return out;
 }
-export function retryArming(argv, roster) {
+export function isResumeLaunch(argv) {
+    return (resumeSessionId(argv) !== undefined ||
+        argv.some((a) => a === "--resume" || a === "-r" || a.startsWith("--resume=")));
+}
+export function retryArming(argv, roster, opts = {}) {
     if (roster.length === 0) {
         return { armed: false, reason: "no secret-free sibling account to retry onto" };
     }
-    if (argv.includes("--resume")) {
+    if (isResumeLaunch(argv) && !opts.resumeReady) {
         return {
             armed: false,
-            reason: "resumed session — its Claude session lives in this account's config dir",
+            reason: "resumed session — its transcript is not in this account's config dir in a state " +
+                "that can be handed to a sibling",
         };
     }
     if (!argv.some((a) => a === "stream-json" || a === "--output-format=stream-json")) {
@@ -49,13 +55,16 @@ export function retryArming(argv, roster) {
     return { armed: true };
 }
 export function chooseRetryAccount(params) {
+    const verdicts = [];
     for (const account of params.roster) {
         const state = params.readState(account.stateFile);
-        const verdict = classifyAccountHealth(state, params.options ?? {}, params.nowMs, params.modelId).verdict;
-        if (verdict === "ok" || verdict === "no_data")
+        const health = classifyAccountHealth(state, params.options ?? {}, params.nowMs, params.modelId);
+        if (health.verdict === "ok" || health.verdict === "no_data")
             return account;
+        verdicts.push({ id: account.id, verdict: health.verdict, observedAt: health.observedAt });
     }
-    return undefined;
+    const probe = overdueProbeAccount(verdicts, params.nowMs);
+    return probe ? params.roster.find((a) => a.id === probe) : undefined;
 }
 export function buildRetryEnv(base, account) {
     const env = { ...base };

package/dist/runtime-home.js

@@ -0,0 +1,34 @@
+import { createHash } from "node:crypto";
+import { copyFileSync, existsSync, mkdirSync, readdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+export function materialiseRuntime(srcDir, stateRoot) {
+    const fallback = join(srcDir, "shim.js");
+    try {
+        const files = readdirSync(srcDir).filter((f) => f.endsWith(".js")).sort();
+        if (!files.includes("shim.js"))
+            throw new Error(`shim.js missing from ${srcDir}`);
+        const hash = createHash("sha256");
+        for (const f of files)
+            hash.update(f).update("\0").update(readFileSync(join(srcDir, f))).update("\0");
+        const dir = join(stateRoot, "runtime", hash.digest("hex").slice(0, 16));
+        const shimPath = join(dir, "shim.js");
+        if (existsSync(shimPath))
+            return { shimPath, dir, stable: true };
+        const staging = `${dir}.staging-${process.pid}-${Date.now()}`;
+        mkdirSync(staging, { recursive: true });
+        for (const f of files)
+            copyFileSync(join(srcDir, f), join(staging, f));
+        writeFileSync(join(staging, "package.json"), JSON.stringify({ type: "module" }) + "\n");
+        try {
+            renameSync(staging, dir);
+        }
+        catch (e) {
+            if (!existsSync(shimPath))
+                throw e;
+        }
+        return { shimPath, dir, stable: true };
+    }
+    catch (e) {
+        return { shimPath: fallback, dir: srcDir, stable: false, error: e instanceof Error ? e.message : String(e) };
+    }
+}

package/dist/session-handover.js

@@ -1,4 +1,5 @@
-import { copyFileSync, mkdirSync, readdirSync, renameSync, rmSync, statSync } from "node:fs";
+import { createHash } from "node:crypto";
+import { closeSync, copyFileSync, mkdirSync, openSync, readSync, readdirSync, renameSync, rmSync, statSync, writeSync, } from "node:fs";
 import { homedir } from "node:os";
 import { basename, dirname, join } from "node:path";
 export const SESSION_DIRS_ENV = "MULTI_CLAWD_SESSION_DIRS";
@@ -115,3 +116,136 @@ export function handoverForLaunch(argv, env, deps = {}) {
         return `resume handover failed for session ${sessionId.slice(0, 8)}: ${err instanceof Error ? err.message : String(err)}`;
     }
 }
+const FINGERPRINT_HEAD_BYTES = 64 * 1024;
+const FINGERPRINT_TAIL_BYTES = 1024 * 1024;
+function readRegion(fd, position, length) {
+    const buf = Buffer.alloc(length);
+    let got = 0;
+    while (got < length) {
+        const n = readSync(fd, buf, got, length - got, position + got);
+        if (n <= 0)
+            throw new Error("the transcript ended before the snapshot point");
+        got += n;
+    }
+    return buf;
+}
+export function fingerprintPrefix(path, bytes) {
+    const fd = openSync(path, "r");
+    try {
+        const hash = createHash("sha256");
+        hash.update(`${bytes}:`);
+        const head = Math.min(FINGERPRINT_HEAD_BYTES, bytes);
+        hash.update(readRegion(fd, 0, head));
+        const tail = Math.min(FINGERPRINT_TAIL_BYTES, bytes - head);
+        if (tail > 0)
+            hash.update(readRegion(fd, bytes - tail, tail));
+        return hash.digest("hex");
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+const NEWLINE = 0x0a;
+function lastByte(path, length) {
+    if (length <= 0)
+        return undefined;
+    const fd = openSync(path, "r");
+    try {
+        const buf = Buffer.alloc(1);
+        return readSync(fd, buf, 0, 1, length - 1) === 1 ? buf[0] : undefined;
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+export function snapshotResumeTranscript(argv, env) {
+    try {
+        const sessionId = resumeSessionId(argv);
+        if (!sessionId)
+            return undefined;
+        const projects = join(effectiveConfigDir(env), "projects");
+        let newest;
+        for (const sub of nodeHandoverFs.listDirs(projects)) {
+            const path = join(projects, sub, `${sessionId}.jsonl`);
+            let st;
+            try {
+                st = statSync(path);
+            }
+            catch {
+                continue;
+            }
+            if (!st.isFile())
+                continue;
+            if (!newest || st.mtimeMs > newest.mtime) {
+                newest = { sub, path, mtime: st.mtimeMs, bytes: st.size };
+            }
+        }
+        if (!newest || newest.bytes === 0)
+            return undefined;
+        if (lastByte(newest.path, newest.bytes) !== NEWLINE)
+            return undefined;
+        return {
+            sessionId,
+            sub: newest.sub,
+            path: newest.path,
+            bytes: newest.bytes,
+            fingerprint: fingerprintPrefix(newest.path, newest.bytes),
+        };
+    }
+    catch {
+        return undefined;
+    }
+}
+const COPY_CHUNK_BYTES = 1024 * 1024;
+export function handoverSnapshotTo(snapshot, targetConfigDir) {
+    const size = statSync(snapshot.path).size;
+    if (size < snapshot.bytes) {
+        throw new Error("the transcript is shorter than when the launch began");
+    }
+    if (lastByte(snapshot.path, snapshot.bytes) !== NEWLINE) {
+        throw new Error("the transcript no longer ends on a record boundary at the snapshot point");
+    }
+    const to = join(targetConfigDir, "projects", snapshot.sub, `${snapshot.sessionId}.jsonl`);
+    if (to === snapshot.path)
+        throw new Error("the sibling shares this account's config dir");
+    mkdirSync(dirname(to), { recursive: true, mode: 0o700 });
+    const tmp = join(dirname(to), `.${basename(to)}.handover-${process.pid}`);
+    let src;
+    let dst;
+    try {
+        src = openSync(snapshot.path, "r");
+        dst = openSync(tmp, "w", 0o600);
+        const buf = Buffer.alloc(Math.min(COPY_CHUNK_BYTES, snapshot.bytes));
+        let copied = 0;
+        while (copied < snapshot.bytes) {
+            const want = Math.min(buf.length, snapshot.bytes - copied);
+            const got = readSync(src, buf, 0, want, copied);
+            if (got <= 0)
+                throw new Error("the transcript ended before the snapshot point");
+            writeSync(dst, buf, 0, got);
+            copied += got;
+        }
+        closeSync(dst);
+        dst = undefined;
+        if (fingerprintPrefix(tmp, snapshot.bytes) !== snapshot.fingerprint) {
+            throw new Error("the transcript was rewritten after the launch began");
+        }
+        renameSync(tmp, to);
+        return to;
+    }
+    catch (err) {
+        if (dst !== undefined) {
+            try {
+                closeSync(dst);
+            }
+            catch {
+            }
+        }
+        rmSync(tmp, { force: true });
+        throw err;
+    }
+    finally {
+        if (src !== undefined)
+            closeSync(src);
+    }
+}

package/dist/shim-core.js

@@ -90,6 +90,7 @@ export function parseStoredState(raw) {
             seenAt: w.seenAt,
             rawInfo: typeof w.rawInfo === "string" ? w.rawInfo : undefined,
             model: typeof w.model === "string" ? w.model : undefined,
+            family: typeof w.family === "string" ? w.family : undefined,
         };
     }
     let credential;
@@ -178,6 +179,16 @@ export function canonicalizeModelWindowKeys(windows) {
     }
     return out;
 }
+const MODEL_FAMILY_RE = /^claude-([a-z]+)-/;
+export function modelFamily(modelId) {
+    return MODEL_FAMILY_RE.exec(canonicalizeModelIdForWindow(modelId))?.[1];
+}
+export function limitFamilyFor(displayName, modelId) {
+    const family = modelFamily(modelId);
+    if (!family)
+        return undefined;
+    return displayName.trim().toLowerCase() === family ? family : undefined;
+}
 const LIMIT_TEXT_RE = /reached your (.{1,40}?) limit/i;
 export function parseModelLimitError(line) {
     if (!/reached your /i.test(line))
@@ -214,7 +225,7 @@ export function parseModelLimitError(line) {
     }
     return undefined;
 }
-export function recordModelLimit(state, modelId, now, resetsAt) {
+export function recordModelLimit(state, modelId, now, resetsAt, family) {
     return {
         ...state,
         updatedAt: now,
@@ -224,10 +235,55 @@ export function recordModelLimit(state, modelId, now, resetsAt) {
                 status: "rejected",
                 resetsAt,
                 seenAt: now,
+                ...(family ? { family } : {}),
             },
         },
     };
 }
+export function modelWindowApplies(windowKey, w, requestedModel) {
+    if (!windowKey.startsWith("model:"))
+        return false;
+    if (modelWindowKey(windowKey.slice("model:".length)) === modelWindowKey(requestedModel)) {
+        return true;
+    }
+    return w.family !== undefined && w.family === modelFamily(requestedModel);
+}
+export function clearModelRejection(state, modelId, now) {
+    const windows = { ...state.windows };
+    let changed = false;
+    for (const [key, w] of Object.entries(state.windows)) {
+        if (w.status !== "rejected")
+            continue;
+        if (!modelWindowApplies(key, w, modelId))
+            continue;
+        windows[key] = { status: "allowed", seenAt: now };
+        changed = true;
+    }
+    if (!changed)
+        return { state, changed };
+    return { state: { ...state, updatedAt: now, windows }, changed };
+}
+export function parseSuccessResult(line) {
+    if (!line.includes('"result"'))
+        return false;
+    let record;
+    try {
+        record = JSON.parse(line);
+    }
+    catch {
+        return false;
+    }
+    if (typeof record !== "object" || record === null)
+        return false;
+    const r = record;
+    if (r.type !== "result")
+        return false;
+    if (r.is_error === true)
+        return false;
+    if (typeof r.subtype === "string" && r.subtype.startsWith("error"))
+        return false;
+    return true;
+}
 const AUTH_FAILURE_PATTERNS = [
     /oauth (session|token) (has )?(expired|been revoked)/i,
     /failed to authenticate/i,

package/dist/shim.js

@@ -1,12 +1,12 @@
 import { spawn } from "node:child_process";
 import { mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import { dirname } from "node:path";
-import { classifyStateReadFailure, clearCredentialFailure, createLineScanner, mergeHealthStates, parseAuthFailure, parseRateLimitEvent, parseStoredState, recordCredentialFailure, updateHealthState, } from "./shim-core.js";
+import { classifyStateReadFailure, clearCredentialFailure, clearModelRejection, createLineScanner, limitFamilyFor, mergeHealthStates, parseAuthFailure, parseRateLimitEvent, parseStoredState, parseSuccessResult, recordCredentialFailure, updateHealthState, } from "./shim-core.js";
 import { rewriteModelArg } from "./degrade.js";
 import { parseModelLimitError, recordModelLimit } from "./shim-core.js";
 import { canonicalModelId } from "./models.js";
 import { buildRetryEnv, chooseRetryAccount, parseRetryRoster, retryArming, RETRY_ROSTER_ENV, } from "./retry-plan.js";
-import { handoverForLaunch } from "./session-handover.js";
+import { effectiveConfigDir, handoverForLaunch, handoverSnapshotTo, parseSessionDirs, SESSION_DIRS_ENV, snapshotResumeTranscript, } from "./session-handover.js";
 function resolveClaudeCommand() {
     const override = process.env.MULTI_CLAWD_CLAUDE_BIN;
     if (override) {
@@ -95,7 +95,10 @@ if (modelOverride) {
         process.stderr.write(`[multi-clawd shim] ${note}\n`);
 }
 const retryRoster = parseRetryRoster(process.env[RETRY_ROSTER_ENV]);
-const arming = retryArming(childArgs, retryRoster);
+const resumeSnapshot = retryRoster.length > 0 && parseSessionDirs(process.env[SESSION_DIRS_ENV]).length > 0
+    ? snapshotResumeTranscript(childArgs, process.env)
+    : undefined;
+const arming = retryArming(childArgs, retryRoster, { resumeReady: resumeSnapshot !== undefined });
 let retryArmed = arming.armed;
 if (!retryArmed && retryRoster.length > 0 && arming.reason) {
     process.stderr.write(`[multi-clawd shim] in-turn retry unavailable: ${arming.reason}\n`);
@@ -148,8 +151,12 @@ function guessLimitResetsAt() {
     return undefined;
 }
 let sawAuthFailure = false;
+let sawModelLimit = false;
+let sawSuccessResult = false;
 function observeLine(line) {
     try {
+        if (parseSuccessResult(line))
+            sawSuccessResult = true;
         const event = parseRateLimitEvent(line);
         if (event) {
             state = updateHealthState(state, event, Date.now(), effectiveModelId());
@@ -157,11 +164,14 @@ function observeLine(line) {
         }
         const limitHit = parseModelLimitError(line);
         if (limitHit) {
+            sawModelLimit = true;
             const model = effectiveModelId();
             if (model) {
-                state = recordModelLimit(state, model, Date.now(), guessLimitResetsAt());
+                const family = limitFamilyFor(limitHit.displayName, model);
+                state = recordModelLimit(state, model, Date.now(), guessLimitResetsAt(), family);
                 persistState();
-                process.stderr.write(`[multi-clawd shim] model limit hit recorded: ${model} (reported as "${limitHit.displayName}")\n`);
+                process.stderr.write(`[multi-clawd shim] model limit hit recorded: ${model} (reported as "${limitHit.displayName}"` +
+                    `${family ? `, applies to every ${family} model` : ""})\n`);
             }
         }
         const authFailure = parseAuthFailure(line);
@@ -235,10 +245,23 @@ function attemptRetry() {
         releaseHeldOutput();
         return false;
     }
+    if (resumeSnapshot) {
+        try {
+            handoverSnapshotTo(resumeSnapshot, effectiveConfigDir(target.env));
+        }
+        catch (err) {
+            process.stderr.write(`[multi-clawd shim] model limit on ${accountId}, but session ` +
+                `${resumeSnapshot.sessionId.slice(0, 8)} could not be handed to ${target.id} ` +
+                `(${err instanceof Error ? err.message : String(err)}) — ` +
+                `passing the failure through to the host's chain\n`);
+            releaseHeldOutput();
+            return false;
+        }
+    }
     retryUsed = true;
     retryArmed = false;
     process.stderr.write(`[multi-clawd shim] model limit on ${accountId}${model ? ` for ${model}` : ""} — ` +
-        `retrying this turn on ${target.id} (nothing forwarded downstream yet)\n`);
+        `retrying this turn on ${target.id}${resumeSnapshot ? `, session ${resumeSnapshot.sessionId.slice(0, 8)} handed over` : ""} (nothing forwarded downstream yet)\n`);
     held = [];
     heldBytes = 0;
     holdTail = "";
@@ -255,6 +278,8 @@ function attemptRetry() {
     stateFile = target.stateFile;
     state = { accountId, windows: {} };
     sawAuthFailure = false;
+    sawModelLimit = false;
+    sawSuccessResult = false;
     child = spawn(command, childArgs, {
         stdio: ["pipe", "pipe", "inherit"],
         env: buildRetryEnv(process.env, target),
@@ -340,13 +365,41 @@ function clearRecordedAuthFailureOnSuccess() {
     catch {
     }
 }
+function clearRecordedModelRejectionOnSuccess() {
+    if (!stateFile || !sawSuccessResult || sawModelLimit)
+        return;
+    try {
+        const model = effectiveModelId();
+        if (!model)
+            return;
+        const disk = readPersistedState();
+        if (!disk)
+            return;
+        const now = Date.now();
+        const cleared = clearModelRejection(disk, model, now);
+        if (!cleared.changed)
+            return;
+        const windows = { ...state.windows };
+        for (const [key, w] of Object.entries(cleared.state.windows)) {
+            if (disk.windows[key] !== w)
+                windows[key] = w;
+        }
+        state = { ...state, updatedAt: now, windows };
+        persistState();
+        process.stderr.write(`[multi-clawd shim] ${model} served by ${accountId} — model rejection cleared\n`);
+    }
+    catch {
+    }
+}
 function onChildClose(code, signal) {
     if (signal) {
         process.kill(process.pid, signal);
         return;
     }
-    if ((code ?? 0) === 0)
+    if ((code ?? 0) === 0) {
         clearRecordedAuthFailureOnSuccess();
+        clearRecordedModelRejectionOnSuccess();
+    }
     process.exit(code ?? 0);
 }
 function onChildError(err) {

package/dist/sticky.js

@@ -6,7 +6,7 @@ export function decideStickySelection(params) {
     const home = verdicts[0];
     const healthChoice = choosePoolAccount(verdicts);
     if (!healthChoice)
-        return { account: fallbackPoolAccount(verdicts) };
+        return { account: fallbackPoolAccount(verdicts, nowMs) };
     const stickyVerdict = sticky
         ? verdicts.find((v) => v.id === sticky.account)?.verdict
         : undefined;

package/openclaw.plugin.json

@@ -1,7 +1,7 @@
 {
   "id": "multi-clawd",
   "name": "multi-clawd",
-  "version": "1.9.6",
+  "version": "1.9.8",
   "description": "Register additional Claude Code logins (Max/Pro accounts) as first-class OpenClaw CLI backends for cross-account failover, keeping the full skills/MCP harness on every account.",
   "cliBackends": [
     "claw1",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@drakon-systems/multi-clawd",
-  "version": "1.9.6",
+  "version": "1.9.8",
   "description": "Multi-account Claude Code failover for OpenClaw — register additional Claude (Max/Pro) logins as first-class CLI backends and keep the full skills/MCP harness across every account. Also imports those accounts' setup tokens into Hermes Agent's Anthropic credential pool.",
   "type": "module",
   "license": "MIT",

package/scripts/doctor.mjs

@@ -284,9 +284,10 @@ const { checkAccountCredential, keychainServiceForConfigDir } = await importDist
   "checkAccountCredential",
   "keychainServiceForConfigDir",
 ]);
-const { summarizeWindowUsage, classifyAccountHealth } = await importDist("health.js", [
+const { summarizeWindowUsage, classifyAccountHealth, overdueProbeAccount } = await importDist("health.js", [
   "summarizeWindowUsage",
   "classifyAccountHealth",
+  "overdueProbeAccount",
 ]);
 // "cli", like the chain audits: resolving WHICH login backs an account is
 // doctor's own diagnostic, not a description of the running plugin's
@@ -458,17 +459,15 @@ else {
   // sticky can be about to expire, and health outranks both.
   if (members.length > 0) {
     const now = Date.now();
+    const healthOptions = {
+      staleAfterMs: pool.staleAfterMs,
+      utilizationThreshold: pool.utilizationThreshold,
+      rotateOnOverage: pool.rotateOnOverage,
+    };
     const verdicts = members.map((id) => ({
       id,
-      verdict: classifyAccountHealth(
-        readJson(join(STATE_DIR, `${id}.json`)),
-        {
-          staleAfterMs: pool.staleAfterMs,
-          utilizationThreshold: pool.utilizationThreshold,
-          rotateOnOverage: pool.rotateOnOverage,
-        },
-        now,
-      ).verdict,
+      verdict: classifyAccountHealth(readJson(join(STATE_DIR, `${id}.json`)), healthOptions, now)
+        .verdict,
     }));
     const decision = decideStickySelection({
       verdicts,
@@ -499,8 +498,54 @@ else {
       );
     }
     // The launch decision is model-aware (a 429 can bench one account for one
-    // model only); doctor has no model in hand, so this is the account-wide
-    // answer. Say so rather than let a model-scoped exception read as a lie.
+    // model only); doctor has no model in hand, so the line above is the
+    // account-wide answer. A model limit is therefore reported separately, per
+    // model, from the same classifier the launch uses — "health ok" beside an
+    // account that refuses every turn for one model read as a clean bill of
+    // health during the very outage it should have named (#26).
+    const limitedModels = new Set();
+    for (const id of members) {
+      const state = readJson(join(STATE_DIR, `${id}.json`));
+      for (const key of Object.keys(state?.windows ?? {})) {
+        if (key.startsWith("model:")) limitedModels.add(key.slice("model:".length));
+      }
+    }
+    for (const model of [...limitedModels].sort()) {
+      const perAccount = members.map((id) => {
+        const health = classifyAccountHealth(
+          readJson(join(STATE_DIR, `${id}.json`)),
+          healthOptions,
+          now,
+          model,
+        );
+        return { id, verdict: health.verdict, observedAt: health.observedAt, resumeAt: health.resumeAt };
+      });
+      const limited = perAccount.filter((v) => v.verdict === "exhausted");
+      if (limited.length === 0) continue;
+      const detail = limited
+        .map((v) => {
+          const ageMin = typeof v.observedAt === "number" ? Math.round((now - v.observedAt) / 60000) : undefined;
+          const seen =
+            ageMin === undefined
+              ? ""
+              : `, seen ${ageMin < 90 ? `${ageMin}m` : `${Math.round(ageMin / 60)}h`} ago`;
+          const until =
+            typeof v.resumeAt === "number" ? ` until ${new Date(v.resumeAt).toISOString()}` : "";
+          return `${v.id}${until}${seen}`;
+        })
+        .join("; ");
+      if (limited.length === perAccount.length) {
+        const probe = overdueProbeAccount(perAccount, now);
+        bad(
+          `${model}: EVERY account is limited (${detail}) — turns for this model fall through to ` +
+            `the host's chain${
+              probe ? `; the next launch re-tests ${probe}, whose rejection is the oldest` : ""
+            }`,
+        );
+      } else {
+        warn(`${model}: limited on ${detail} — served by the remaining account(s)`);
+      }
+    }
     if (VERBOSE) {
       note(`account-wide verdicts: ${verdicts.map((v) => `${v.id}:${v.verdict}`).join(" ")}`);
     }