@rikcodes/teamclaude 1.1.20-rik.16 → 1.1.20-rik.17

package/README.md

@@ -65,6 +65,7 @@ Already logged into Claude Code? `teamclaude import` takes its credentials inste
 - Pools OpenAI Codex subscriptions alongside Claude accounts (experimental): the Codex CLI is routed through the same proxy, by config or transparently through the MITM proxy, and rotates on its own quota.
 - Takes any Anthropic-compatible API (DeepSeek, GLM) as a low-priority fallback for when the Claude accounts are done.
 - Serves OpenAI models next to Claude ones — a supervised local sidecar translates `gpt-*` requests onto a ChatGPT subscription, with real model names in `/model` and GPT subagents dispatchable from a Claude parent (`sidecars` + `customModels`, this fork).
+- Ships those subagents as a Claude Code plugin: one named agent per model **and effort level**, which the Agent tool's `model` parameter cannot express (`/plugin install rikclaude-agents@rikclaude`, this fork).
 - No dependencies. Node built-ins only.
 
 ## Everyday commands
@@ -152,10 +153,10 @@ At launch, `teamclaude run` — and the `claude` alias, which passes through `ru
 | Row field | Where it ends up |
 | --- | --- |
 | `model`, `label`, `description` | A `/model` picker row under the **real** model id (`--settings`), so `/model gpt-5.6-sol` works picked or typed |
-| `model` | A dispatchable subagent named after the model (`--agents`), so "dispatch a `gpt-5.6-terra` subagent" works from a Claude parent. Set `"customModelAgents": false` to skip these if you define your own agents in `~/.claude/agents/` |
+| `model` | Nothing by default. Set `"customModelAgents": true` and each row also becomes a plain subagent named after the model (`--agents`), so "dispatch a `gpt-5.6-terra` subagent" works from a Claude parent. Off because those agents pin no effort and outrank every agent file on disk — prefer the effort-pinned [plugin agents](docs/agents.md) |
 | `contextTokens` | `CLAUDE_CODE_MAX_CONTEXT_TOKENS`, set to the largest value across rows, so Claude Code compacts at the real window instead of assuming 200k |
 
-For tools that spawn `claude` themselves, `teamclaude env` can set only environment variables. It carries the window and `ANTHROPIC_CUSTOM_MODEL_OPTION` for the **first** row. For GPT subagents under `env`, create `~/.claude/agents/<name>.md` with `model: gpt-5.6-terra` in its frontmatter.
+For tools that spawn `claude` themselves, `teamclaude env` can set only environment variables. It carries the window and `ANTHROPIC_CUSTOM_MODEL_OPTION` for the **first** row. Agents do not depend on either mode: they are read from disk, whether they come from the [`rikclaude-agents` plugin](docs/agents.md) or from a `~/.claude/agents/<name>.md` you write with `model: gpt-5.6-terra` in its frontmatter.
 
 Each request is routed by the model name in its body, so one session can freely mix models: use `claude --model gpt-5.6-sol` for a whole session, `/model gpt-5.6-sol` during a session, or a Claude parent that dispatches a GPT subagent.
 
@@ -240,6 +241,7 @@ This feature is on by default. Each account row shows which window binds first:
 | [Routing](docs/routing.md) | Rotation, the two kinds of 429, storm control, model routes, session spreading, pinning, prompt cache |
 | [Quota](docs/quota.md) | Quota probe, keep-warm, holding on exhaustion |
 | [OpenAI models](docs/openai.md) | Codex sidecar setup, custom model registration, GPT subagents, limitations |
+| [Subagents](docs/agents.md) | The `rikclaude-agents` plugin: effort-pinned agents per model, installing it, seeding it for a team |
 | [Configuration](docs/configuration.md) | Config format, every field, environment variables, network tuning |
 | [Proxy modes](docs/proxy-modes.md) | MITM forward proxy, sx.org residential egress |
 | [Remote host](docs/remote.md) | Running the fleet on an always-on box: reaching it, moving the accounts, service supervision, pointing clients at it |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rikcodes/teamclaude",
-  "version": "1.1.20-rik.16",
+  "version": "1.1.20-rik.17",
   "description": "Multi-account proxy for Claude Code and Codex: pools Claude Max, ChatGPT/Codex, API-key and third-party backend accounts, and rotates on quota",
   "type": "module",
   "main": "src/index.js",

package/src/account-manager.js

@@ -383,6 +383,7 @@ export class AccountManager {
     // `distributeSessions` gates the behavioural change: keep each session on its
     // account for cache reuse, but spread NEW sessions across equal-priority
     // accounts by load instead of funnelling them all onto the current one.
+    /** @type {SessionTracker} */
     this.sessionTracker = sessionTracker || new SessionTracker();
     // 'off' | 'even' | 'adaptive'. `distributeSessions` stays a boolean beside
     // it ("is distribution on at all") because the status readout, the TUI
@@ -770,6 +771,12 @@ export class AccountManager {
    * bucket, so the account must be eligible for both models. When no account
    * satisfies both, selection degrades to executor-only routing so the main
    * request keeps flowing (upstream then fails just the advisor call).
+   *
+   * `sessionId` is a PIN KEY throughout this class and the session tracker: a
+   * client session narrowed to the conversation within it, since one client
+   * session fans out across many (see conversation.js). It is spelled
+   * `sessionId` because it is one for every request that names no conversation,
+   * and because the affinity it drives is the same affinity it always was.
    */
   getActiveAccount(exclude = null, model = null, advisorModel = null, sessionId = null, provider = DEFAULT_PROVIDER, decision = null) {
     // Selection reads this.currentIndex as "where the fleet is". With more than
@@ -896,11 +903,15 @@ export class AccountManager {
     // The empty set marks this call as a request's, since a poll hands none.
     // Allocated fresh: a set handed out once is one a later reader could add to.
     this.refreshExpiredQuotas(model, this.expiryRouting.enabled ? (exclude ?? new Set()) : exclude, advisorModel);
-    // Session-affinity distribution (opt-in): keep a session on its pinned
-    // account for cache reuse, and route a new session to the least-loaded
-    // account. Only when enabled, only for a real session, and only outside a
-    // manual route pin (which must still win). Falls through to the normal walk
-    // if nothing session-eligible is found (e.g. the whole tier is exhausted).
+    // Session-affinity distribution (opt-in): keep a conversation on its pinned
+    // account for cache reuse, and route a new one to the least-loaded account.
+    // The unit is the conversation rather than the client session because one
+    // session fans out — a Claude Code session and every subagent it launches
+    // share its id, and holding them together pinned a whole fan-out to one
+    // account for a cache none of them shared (see conversation.js). Only when
+    // enabled, only for a request that named one, and only outside a manual
+    // route pin (which must still win). Falls through to the normal walk if
+    // nothing eligible is found (e.g. the whole tier is exhausted).
     if (sessionId && !this._pinnedAccountForModel(model, advisorModel)) {
       if (this.distributeSessions) {
         const acc = this._selectForSession(sessionId, exclude, model, advisorModel);
@@ -1054,13 +1065,18 @@ export class AccountManager {
     // (_isAvailable, below) rather than a second key.
     const bucket = this._weeklyBucketFor(model);
     const pinIdx = this.sessionTracker.pinnedAccount(sessionId, bucket);
-    // The bucket's own pin first. Failing that, any account the session already
-    // sits on for another family: one session stays on one account unless that
-    // account cannot serve the request (the README's "pins it there"). Without
-    // this, a session's first request of a second family would go to
-    // _pickLeastLoaded, which counts the session's own pin as load and pushes
-    // the new family onto a sibling — splitting every mixed-model session
-    // across two accounts by construction, not only on a real diversion.
+    // The bucket's own pin first. Failing that, any account this conversation
+    // already sits on for another family: one conversation stays on one account
+    // unless that account cannot serve the request (the README's "pins it
+    // there"). Without this, its first request of a second family would go to
+    // _pickLeastLoaded, which counts the conversation's own pin as load and
+    // pushes the new family onto a sibling — splitting every mixed-model
+    // conversation across two accounts by construction, not only on a real
+    // diversion.
+    //
+    // Scoped to the one conversation, not to everything sharing its session id:
+    // two agents of one fan-out are not each other's affinity, and treating
+    // them as one is what funnelled them onto a single account.
     const candidates = [];
     if (pinIdx != null) candidates.push(pinIdx);
     for (const idx of this.sessionTracker.pinnedAccounts(sessionId)) {
@@ -1354,6 +1370,18 @@ export class AccountManager {
     this.sessionTracker.recordOutcome(sessionId, usable);
   }
 
+  /**
+   * The same, for an exit that can name only the client session — every live
+   * conversation of it takes the outcome (see SessionTracker).
+   *
+   * @param {string|null} sessionId
+   * @param {boolean|null} usable
+   */
+  recordOutcomeForSession(sessionId, usable) {
+    if (!sessionId || usable === null) return;
+    this.sessionTracker.recordOutcomeForSession(sessionId, usable);
+  }
+
   /**
    * Per-account diagnostics for adaptive distribution: the profile plan tier,
    * relative score weight, and actual next target.

package/src/codex-quota.js

@@ -110,6 +110,18 @@ function classify(windows) {
   return out;
 }
 
+/**
+ * A parsed reading: the fields `account.quota` already uses, each present only
+ * when the headers stated it.
+ *
+ * @typedef {object} CodexQuota
+ * @property {number} [unified5h] Session-window utilization, 0-1.
+ * @property {number} [unified5hReset] When that window resets, ms epoch.
+ * @property {number} [unified7d] Weekly-window utilization, 0-1.
+ * @property {number} [unified7dReset] When that window resets, ms epoch.
+ * @property {{slug: string, name: string, utilization: number, resetAt: number|null}[]} [modelBuckets] Model-scoped weekly buckets.
+ */
+
 /**
  * Parse Codex rate-limit headers into the fields `account.quota` already uses.
  *
@@ -117,9 +129,12 @@ function classify(windows) {
  * an existing quota without blanking readings this response did not mention.
  * An empty object means "this response carried no quota", which is normal:
  * the catalog fetch (`/models`) has none.
+ *
+ * @returns {CodexQuota}
  */
 export function parseCodexQuota(headers) {
   const families = collectFamilies(headers);
+  /** @type {CodexQuota} */
   const quota = {};
 
   const account = classify(families.get('')?.windows || {});
@@ -172,6 +187,52 @@ export function parseCodexQuota(headers) {
   return quota;
 }
 
+/**
+ * Is a window at or past its limit?
+ *
+ * Readings are 0-1 fractions here, and the comparison is `>=` because upstream
+ * keeps counting once a window is past its limit: 104% arrives as 1.04. A
+ * window the headers did not state is not spent — `classify` has already
+ * dropped the unparseable and the zeroed.
+ *
+ * @param {number} [utilization]
+ */
+const isSpent = (utilization) => utilization != null && utilization >= 1;
+
+/**
+ * Which windows these headers report as spent — at or past their limit. Empty
+ * when none are, including when the response carried no Codex quota at all.
+ *
+ * Anthropic names a spent bucket outright, as `…-status: rejected`. This API
+ * publishes no status at all: it reports how much of each window is gone, and a
+ * window at its limit is the same fact in the other spelling. That distinction
+ * is what a 429 handler needs, because a spent window is durable — the account
+ * cannot serve again until the window resets, so waiting out `retry-after` and
+ * asking the SAME account again is futile, however momentary the 429 looked.
+ *
+ * Every family is read, not just the account-wide one. A subscription states
+ * its only 5-hour window inside a NAMED family (see parseCodexQuota), so the
+ * account-wide percentages alone would never show a spent session window; and a
+ * model-scoped weekly bucket is spent on its own terms, whatever the
+ * account-wide reading says.
+ *
+ * The labels name what is spent, for the log line that follows. A caller that
+ * only wants the verdict tests the length.
+ *
+ * @param {Record<string, string>} headers Rate-limit headers from the response.
+ * @returns {string[]} One label per spent window, e.g. `['weekly']`.
+ */
+export function codexSpentWindows(headers) {
+  const quota = parseCodexQuota(headers);
+  const spent = [];
+  if (isSpent(quota.unified5h)) spent.push('5h');
+  if (isSpent(quota.unified7d)) spent.push('weekly');
+  for (const bucket of quota.modelBuckets ?? []) {
+    if (isSpent(bucket.utilization)) spent.push(`${bucket.name} weekly`);
+  }
+  return spent;
+}
+
 /** The subscription plan upstream reports, for status output. Null when absent. */
 export function parseCodexPlanType(headers) {
   const value = headers?.['x-codex-plan-type'];

package/src/codex-reset-credits.js

@@ -50,17 +50,26 @@ export const CREDIT_EXPIRY_WINDOW_MS = 3 * 24 * 60 * 60 * 1000;
 // touches the detail endpoint before the policy has even had a chance to say no.
 const DETAIL_TTL_MS = 6 * 60 * 60 * 1000;
 
-// After an attempt that spent nothing (upstream declined, or the request
-// failed), how long before this account may try again.
+// After an attempt that spent nothing (upstream declined, or the request never
+// got that far), how long before this account may try again. An attempt whose
+// verdict we never read holds the whole fleet for the same span — see _consume.
 const RETRY_COOLDOWN_MS = 30 * 60 * 1000;
 
-// After an attempt that DID spend a credit. Longer, and deliberately so: if the
-// weekly window still reads exhausted afterwards — a reset that only covered
-// the session window, a usage read that had not caught up — the next trigger
-// must not reach for a second credit to fix what the first one apparently did
-// not.
+// After an attempt that DID spend a credit — on the account that spent it and
+// on the fleet alike. Longer, and deliberately so: if the weekly window still
+// reads exhausted afterwards — a reset that only covered the session window, a
+// usage read that failed or had not caught up — the next trigger must not reach
+// for a second credit to fix what the first one apparently did not. And the
+// account that redeemed is not the only one that must not: the refusal behind
+// it walks the whole pool, and a sibling holding a credit is just as able to
+// spend one.
 const SUCCESS_COOLDOWN_MS = 6 * 60 * 60 * 1000;
 
+// What a refresh that outlived the attempt's budget resolves with. A sentinel
+// rather than a value, because every real outcome of a refresh — including a
+// failure — is a value the race could otherwise be confused for.
+const BUDGET_LAPSED = Symbol('redeem budget lapsed');
+
 /**
  * How long the whole redemption may take — the token refresh, the detail read
  * and the consume TOGETHER, not each.
@@ -203,8 +212,9 @@ export async function consumeResetCredit(account, { creditId = null, redeemReque
  * The 429 path cannot answer this from the flat `x-codex-*-used-percent`
  * headers: those are positions, not durations, so a spent 5-hour window looks
  * identical there. The parsed quota keeps the two apart (see codex-quota.js),
- * and the 5-hour one is explicitly NOT a trigger — it heals by itself within
- * the hour, and a "Full reset" is far too scarce to burn on that.
+ * and the 5-hour one is explicitly NOT a trigger — it comes back on its own
+ * within hours, while the weekly one is what leaves an account walled for days,
+ * and a "Full reset" is far too scarce to burn on the short window.
  *
  * @param {Record<string, any>|null|undefined} account
  * @param {number} [now]
@@ -386,6 +396,14 @@ export function shouldRedeemReset({ account, autoRedeemResets = false, pool = []
  * refusals arrives here asking the same question. Concurrent callers therefore
  * join one attempt rather than starting their own, per account and per pool.
  *
+ * Joining only answers the triggers that arrive together, though; they also
+ * arrive one after another. What bounds those is a fleet-wide hold, armed the
+ * moment an attempt has spent a credit — or may have — and read before the next
+ * attempt reads anything at all. It is deliberately not the per-account
+ * cooldown, and not the per-account join either: a pool-dry attempt walks the
+ * whole pool, so an account that has never touched the endpoint is just as able
+ * to spend the second credit as the one that did.
+ *
  * That waiting client is also what sets the time budget. The budget is ONE
  * deadline for the whole attempt (REDEEM_BUDGET_MS above), not a
  * timeout per call: what the waiting client can spare is a property of the
@@ -446,6 +464,34 @@ export class ResetCreditRedeemer {
     // out, and only one of them should spend anything about it.
     /** @type {Promise<RedeemResult>|null} */
     this.poolInFlight = null;
+    // The hold a per-account cooldown cannot express. Two outcomes are facts
+    // about the FLEET rather than about the account they happened on:
+    //
+    //  - a redemption that worked. What otherwise stops the next trigger
+    //    spending a sibling's credit is this account reading available again —
+    //    and that is a re-read, which can fail or find upstream not yet caught
+    //    up with its own reset. The hold must not depend on it having landed.
+    //  - a consume whose verdict we never read. This endpoint states a refusal
+    //    as a 200 with a `code`, so an error is never upstream saying no — only
+    //    "we do not know", over a POST that may well have spent the credit.
+    //
+    // Armed in _consume, read at the top of both entry points before anything
+    // is fetched, and it stops a pool walk mid-pool.
+    this.fleetCooldownUntil = 0;
+  }
+
+  /**
+   * Has an attempt just spent a credit, or possibly spent one, on behalf of the
+   * whole fleet? Read before any account-level state, because the answer is
+   * about none of them in particular.
+   *
+   * @returns {RedeemResult|null}
+   */
+  _fleetHold() {
+    if (this.now() < this.fleetCooldownUntil) {
+      return { redeemed: false, reason: 'the pool is cooling down after a recent redemption attempt' };
+    }
+    return null;
   }
 
   /**
@@ -525,6 +571,11 @@ export class ResetCreditRedeemer {
    * @returns {Promise<RedeemResult>}
    */
   async _poolAttempt(accounts) {
+    const held = this._fleetHold();
+    // Before a single row is read: an attempt that has just spent a credit, or
+    // may have, speaks for the whole pool rather than for the account it
+    // touched.
+    if (held) return held;
     const now = this.now();
     // ONE budget for the whole refusal, shared across every candidate: the
     // client is waiting on the refusal, not on an account, so a pool of three
@@ -551,6 +602,11 @@ export class ResetCreditRedeemer {
         state => this._decide(account, state, rows.get(account) || [], now, deadline));
       if (result.redeemed) return result;
       reason = result.reason;
+      // Two things end the walk rather than move it on to the next account: a
+      // fleet hold, armed by an attempt that may have spent something — walking
+      // on would answer a credit we cannot account for with a second one — and
+      // a budget the waiting client has nothing left of to give.
+      if (this._fleetHold() || this._timeLeft(deadline) <= 0) break;
     }
     return { redeemed: false, reason };
   }
@@ -632,6 +688,11 @@ export class ResetCreditRedeemer {
    * @returns {Promise<RedeemResult>}
    */
   async _attempt(account, state) {
+    // The same hold the pool walk reads, and for the same reason: a credit just
+    // spent — or possibly spent — elsewhere in the fleet is not this account's
+    // business to answer with another one.
+    const held = this._fleetHold();
+    if (held) return held;
     const now = this.now();
     // Everything past the free checks can touch the network, and all of it
     // shares this one deadline: what the waiting client can spare belongs to the
@@ -656,6 +717,49 @@ export class ResetCreditRedeemer {
     return deadline - this.now();
   }
 
+  /**
+   * Refresh the account's token, and never wait longer for it than the attempt
+   * has left.
+   *
+   * `ensureTokenFresh` takes no timeout of its own and joins whatever refresh is
+   * already running, so awaiting it plainly is unbounded — and reading the clock
+   * afterwards can only report a deadline already missed, with every concurrent
+   * trigger held for exactly as long. The only way to bound it is to race it.
+   *
+   * A refresh that lands late is not wrong, merely too late to act on: it
+   * carries on in the background, and whatever asks next gets the token it
+   * fetched. What must not happen is this attempt proceeding on it — an
+   * irreversible call made for a client that has already stopped waiting is the
+   * worst of both outcomes.
+   *
+   * @param {Record<string, any>} account
+   * @param {number} deadline
+   * @returns {Promise<{ok: boolean, error?: string}>}
+   */
+  async _freshToken(account, deadline) {
+    const left = this._timeLeft(deadline);
+    if (left <= 0) return { ok: false, error: 'ran out of the redeem budget before refreshing the token' };
+    /** @type {any} */
+    let timer = null;
+    /** @type {Promise<any>} */
+    const lapsed = new Promise(resolve => { timer = setTimeout(() => resolve(BUDGET_LAPSED), left); });
+    try {
+      // Wrapped so a synchronous throw arrives as a rejection like any other,
+      // and settled both ways so losing the race cannot leave one unhandled.
+      const refreshed = (async () => this.am.ensureTokenFresh(account.index))()
+        .then(() => null, (/** @type {any} */ err) => err ?? new Error('token refresh failed'));
+      const outcome = await Promise.race([refreshed, lapsed]);
+      if (outcome === BUDGET_LAPSED) return { ok: false, error: 'ran out of the redeem budget refreshing the token' };
+      // A refresh that failed is an answer, and the answer is no: the credential
+      // in hand is the one upstream has already stopped accepting, and the next
+      // call would spend the budget proving it.
+      if (outcome) return { ok: false, error: `token refresh failed (${safeLine(outcome.message || String(outcome), 80)})` };
+      return { ok: true };
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+
   /**
    * The detail rows, from cache while they are fresh.
    *
@@ -667,10 +771,11 @@ export class ResetCreditRedeemer {
    */
   async _credits(account, state, now, deadline) {
     if (state.credits && now - state.creditsAt < this.detailTtlMs) return { credits: state.credits };
-    // The refresh is inside the budget too. It is the one step here that can go
-    // to the network without being given a timeout, so the only way to bound it
-    // is to charge what it spends to the calls that follow.
-    await this.am.ensureTokenFresh(account.index);
+    // The refresh is inside the budget too, and it is the one step here with no
+    // timeout of its own, so it is raced against the deadline rather than
+    // trusted to come back inside it.
+    const fresh = await this._freshToken(account, deadline);
+    if (!fresh.ok) return { error: fresh.error };
     const timeoutMs = this._timeLeft(deadline);
     if (timeoutMs <= 0) return { error: 'ran out of the redeem budget before reading the credit rows' };
     const result = await this.detailsFn(account, { timeoutMs });
@@ -691,15 +796,21 @@ export class ResetCreditRedeemer {
    */
   async _consume(account, state, verdict, now, deadline) {
     const name = safeLine(account.name, 64);
-    await this.am.ensureTokenFresh(account.index);
-    const timeoutMs = this._timeLeft(deadline);
+    // Raced against the deadline, not merely measured after the fact: the
+    // budget exists to bound what the waiting client is held for, and a check
+    // that runs once the refresh has returned can only report a promise already
+    // broken. See _freshToken.
+    const fresh = await this._freshToken(account, deadline);
+    const timeoutMs = fresh.ok ? this._timeLeft(deadline) : 0;
     if (timeoutMs <= 0) {
       // Declined like any other attempt that spent nothing: a cooldown, so a
       // burst against a slow upstream cannot re-enter here per rejection, and
-      // no idempotency key minted for a request never made.
+      // no idempotency key minted for a request never made. Per-account only —
+      // nothing was sent, so the fleet has nothing to be careful of.
+      const why = fresh.error || 'ran out of the redeem budget';
       state.cooldownUntil = now + RETRY_COOLDOWN_MS;
-      this.log(`[TeamClaude] Codex rate-limit reset on "${name}" ran out of its time budget before redeeming — rotating instead`);
-      return { redeemed: false, reason: 'ran out of the redeem budget' };
+      this.log(`[TeamClaude] Codex rate-limit reset on "${name}" stopped before redeeming — ${why}`);
+      return { redeemed: false, reason: why };
     }
 
     // Reused across retries of the SAME logical attempt: an attempt that failed
@@ -713,9 +824,18 @@ export class ResetCreditRedeemer {
       { timeoutMs });
 
     if (result?.error) {
-      // Key deliberately kept: see above.
+      // We do not know whether that POST was acted on, and this is the one
+      // place in the file where not knowing is expensive. Upstream states a
+      // refusal as a 200 with a `code`, so an error here is never "upstream
+      // said no" — it is a verdict we never read, over a request that may well
+      // have spent the credit. So the key is deliberately kept (the retry
+      // replays it, and `already_redeemed` is upstream answering for it), and
+      // the hold is fleet-wide: a pool walk would otherwise move straight on to
+      // a sibling, and a second credit spent over an uncertain first is exactly
+      // how one becomes two.
       state.cooldownUntil = now + RETRY_COOLDOWN_MS;
-      this.log(`[TeamClaude] Codex rate-limit reset failed on "${name}" — ${safeLine(result.error, 120)}`);
+      this.fleetCooldownUntil = Math.max(this.fleetCooldownUntil, now + RETRY_COOLDOWN_MS);
+      this.log(`[TeamClaude] Codex rate-limit reset failed on "${name}" — ${safeLine(result.error, 120)}; it may still have been spent, so the pool holds off`);
       return { redeemed: false, reason: `redeem failed (${result.error})` };
     }
 
@@ -727,6 +847,14 @@ export class ResetCreditRedeemer {
     // that did land, so it is a success with the windows already reset.
     if (result?.code === 'reset' || result?.code === 'already_redeemed') {
       state.cooldownUntil = now + SUCCESS_COOLDOWN_MS;
+      // And the fleet with it. Not because this account might redeem again —
+      // its own cooldown answers that — but because the only thing that would
+      // otherwise stop the next trigger spending a SIBLING's credit is this
+      // account reading available again, which is the re-read below: the one
+      // step here that is allowed to fail. A hold that does not depend on that
+      // reading is what keeps "at most one credit per dry pool" true when it
+      // does fail.
+      this.fleetCooldownUntil = Math.max(this.fleetCooldownUntil, now + SUCCESS_COOLDOWN_MS);
       const windows = result.windowsReset || 0;
       this.log(`[TeamClaude] Redeemed a free Codex rate-limit reset on "${name}" — ${windows} window(s) reset (${result.code})`);
       await this._refresh(account, name, deadline);