ccdeck 3.43.3 → 3.44.0

package/src/server/codex-enrichment.mjs

@@ -10,6 +10,7 @@
 // (event-pipeline.mjs) hands every live event to maybeResolveCodex, and
 // session-tracking.mjs forgets a session through forgetCodexSession. The
 // bodies are unchanged.
+import { codexCostState, codexCostGap, foldCodexCost, codexCostBuckets } from "./codex-cost-usage.mjs";
 import { stat } from "node:fs/promises";
 import { join } from "node:path";
 import { STOP, rolloutNameId, walkRolloutDays } from "./codex-dir.mjs";
@@ -48,6 +49,7 @@ import { sessionReadGate } from "./session-read-gate.mjs";
 const codexRolloutPathBySid = new Map();
 const CODEX_READ_THROTTLE_MS = 2500;
 const codexUsageReads = sessionReadGate(CODEX_READ_THROTTLE_MS);
+const codexUsageRequests = new Map();
 // How many of the newest day directories a lookup reads when it is not owed
 // the whole tree: the bound listRecentCodexRollouts keeps for the watcher.
 const CODEX_RECENT_DAY_DIRS = 2;
@@ -211,6 +213,7 @@ export async function readCodexRollout(path) {
     const s = await stat(path);
     if (s.size === 0) return null;
     let text;
+    const pricing = codexCostState();
     if (s.size <= CODEX_HEAD_BYTES + CODEX_TAIL_BYTES) {
       text = await readByteRange(path, 0, s.size);
     } else {
@@ -221,7 +224,7 @@ export async function readCodexRollout(path) {
       // the loop below skips it.
       const head = await readByteRange(path, 0, CODEX_HEAD_BYTES);
       const tail = await readByteRange(path, s.size - CODEX_TAIL_BYTES, s.size);
-      text = `${head}\n${tail}`;
+      text = `${head}\n__ccdeck_gap__\n${tail}`;
     }
     let lastUsage = null;
     let model = null;
@@ -230,9 +233,11 @@ export async function readCodexRollout(path) {
     // Undefined until a turn_context is read: "no turn yet" is not "no effort".
     let effort;
     for (const line of text.split("\n")) {
+      if (line === "__ccdeck_gap__") { codexCostGap(pricing); continue; }
       if (!line) continue;
       let obj;
       try { obj = JSON.parse(line); } catch { continue; }
+      foldCodexCost(pricing, obj);
       // One record is one of these at most: each asks the record's own type.
       const meta = sessionMeta(obj);
       if (meta) {
@@ -251,28 +256,47 @@ export async function readCodexRollout(path) {
       if (obj?.type === "turn_context") effort = turnContextEffort(obj.payload);
     }
     if (!lastUsage && !model && !contextWindow) return null;
-    return { usage: lastUsage, model, contextWindow, cwd, effort };
+    const usageByModel = codexCostBuckets(pricing);
+    return { usage: lastUsage, model, contextWindow, cwd, effort,
+      ...(usageByModel ? { usageByModel } : {}) };
   } catch {
     return null;
   }
 }
 
-function maybeResolveCodex(payload) {
+function maybeResolveCodex(payload, opts = {}) {
   if (!payload || typeof payload !== "object") return;
   if (payload.provider !== "codex") return;
   const sid = payload.session_id;
   if (!sid) return;
-  codexUsageReads.run(sid, async () => {
+  let entry = codexUsageRequests.get(sid);
+  if (!entry) {
+    entry = { revision: 0, opts: {}, timer: null };
+    codexUsageRequests.set(sid, entry);
+  }
+  entry.revision++;
+  entry.opts = { persist: opts.persist };
+  runCodexUsageRead(sid, entry);
+}
+
+function runCodexUsageRead(sid, entry) {
+  if (codexUsageRequests.get(sid) !== entry) return;
+  const revision = entry.revision;
+  const emitOpts = entry.opts;
+  const started = codexUsageReads.run(sid, async () => {
     const path = await findCodexRolloutPath(sid);
-    if (!path) return;
+    if (!path || codexUsageRequests.get(sid) !== entry || entry.revision !== revision) return;
     const r = await readCodexRollout(path);
-    if (!r) return;
+    // Watcher activity, eviction or shutdown can supersede either await.
+    // Never let a delayed snapshot overwrite newer live observations.
+    if (!r || codexUsageRequests.get(sid) !== entry || entry.revision !== revision) return;
     if (r.usage) {
       pushEvent({
         hook_event_name: "UsageObserved",
         session_id: sid,
         usage: r.usage,
-      }, "internal");
+        usageByModel: r.usageByModel ?? null,
+      }, "internal", emitOpts);
     }
     if (r.model) {
       pushEvent({
@@ -282,7 +306,7 @@ function maybeResolveCodex(payload) {
         // A hook-delivered session has no watcher to spread it, so it rides
         // here, beside the model it qualifies.
         ...(r.effort !== undefined ? { reasoning_effort: r.effort } : {}),
-      }, "internal");
+      }, "internal", emitOpts);
     }
     if (r.contextWindow) {
       // Piggy-back on the model event with the window — reducer reads
@@ -292,9 +316,21 @@ function maybeResolveCodex(payload) {
         session_id: sid,
         model: r.model ?? undefined,
         model_context_window: r.contextWindow,
-      }, "internal");
+      }, "internal", emitOpts);
     }
   });
+  if (started) {
+    clearTimeout(entry.timer);
+    entry.timer = null;
+  } else if (!entry.timer) {
+    // Keep demand until a read actually starts, including while another read
+    // is pending. At most one unref'd retry timer exists for this session.
+    entry.timer = setTimeout(() => {
+      entry.timer = null;
+      runCodexUsageRead(sid, entry);
+    }, CODEX_READ_THROTTLE_MS + 1);
+    entry.timer.unref?.();
+  }
 }
 
 /**
@@ -305,6 +341,8 @@ function maybeResolveCodex(payload) {
 function forgetCodexSession(sid) {
   codexRolloutPathBySid.delete(sid);
   codexUsageReads.forget(sid);
+  clearTimeout(codexUsageRequests.get(sid)?.timer);
+  codexUsageRequests.delete(sid);
   codexSessionModel.delete(sid);
   codexSessionApproval.delete(sid);
   codexSessionEffort.delete(sid);
@@ -316,3 +354,9 @@ function forgetCodexSession(sid) {
 // at each declaration, so the declarations read as they did where they came
 // from.
 export { findCodexRolloutPath, forgetCodexSession, maybeResolveCodex };
+
+export function stopCodexEnrichment() {
+  for (const entry of codexUsageRequests.values()) clearTimeout(entry.timer);
+  codexUsageRequests.clear();
+  codexUsageReads.forgetAll();
+}

package/src/server/codex-review-policy.d.mts

@@ -0,0 +1,4 @@
+export const AUTO_REVIEW_MODEL: string;
+export const FREE_AUTO_REVIEW_TIER: string;
+export const FREE_AUTO_REVIEW_FROM: number;
+export function isFreeAutoReview(model: unknown, creator: unknown, at: unknown): boolean;

package/src/server/codex-review-policy.mjs

@@ -0,0 +1,11 @@
+// OpenAI confirms ChatGPT auto-review checks are free:
+// https://help.openai.com/en/articles/11369540-using-codex-with-your-chatgpt-plan
+// The announcement was on Oct 6. Use the following UTC day conservatively;
+// do not infer the exact historical billing cutover from the current policy.
+export const AUTO_REVIEW_MODEL = "codex-auto-review";
+export const FREE_AUTO_REVIEW_TIER = "chatgpt-auto-review-free";
+export const FREE_AUTO_REVIEW_FROM = Date.parse("2026-10-07T00:00:00Z");
+export function isFreeAutoReview(model, creator, at) {
+  return model === AUTO_REVIEW_MODEL && typeof creator === "string" && creator.trim().length > 0
+    && typeof at === "string" && Date.parse(at) >= FREE_AUTO_REVIEW_FROM;
+}

package/src/server/codex-skills.mjs

@@ -0,0 +1,146 @@
+// Which Codex skill a rollout line shows in use, for Skill activity (#2181).
+//
+// Codex writes no record of its own that a skill ran. Two things in a rollout
+// say so anyway:
+//
+//   - the `<skill>` message Codex injects when a person picks one with `$name`
+//     or /skills, which it writes only once the skill has loaded (explicit);
+//   - the model reading a skill's SKILL.md, or running one of its scripts, which
+//     is Codex's own rule for a skill it chose itself (detected).
+//
+// A detected use counts only for a skill in the catalog Codex gave that session
+// (its `<skills_instructions>` message) and only when the command succeeded, so
+// searching for SKILL.md files or reading a Claude skill is not a use. One use
+// per turn and skill: the turn id is the row's key, which also lands a forked
+// rollout's copy of its parent's turns on the rows the parent already wrote.
+import { posix, win32 } from "node:path";
+import { noteSkillUse } from "./tool-audit.mjs";
+import { readByteRange } from "./jsonl-chunks.mjs";
+
+// The catalog sits in the first lines of a rollout, a few tens of KB in.
+const CATALOG_HEAD_BYTES = 512 * 1024;
+const slashes = path => path.replace(/\\/g, "/");
+
+/** The skills a `<skills_instructions>` message lists: SKILL.md path → name,
+ *  and each skill's folder for its scripts. Null when the text has none. */
+export function parseSkillCatalog(text) {
+  const start = typeof text === "string" ? text.indexOf("<skills_instructions>") : -1;
+  if (start < 0) return null;
+  const roots = new Map(), files = new Map(), dirs = [];
+  const end = text.indexOf("</skills_instructions>", start);
+  for (const line of text.slice(start, end < 0 ? undefined : end).split("\n")) {
+    const root = /^- `(r\d+)` = `(.+)`\s*$/.exec(line);
+    if (root) { roots.set(root[1], slashes(root[2]).replace(/\/+$/, "")); continue; }
+    const entry = /^- (\S+): .*\(file: (r\d+)\/([^()]*\/SKILL\.md)\)\s*$/.exec(line);
+    if (!entry || !roots.has(entry[2])) continue;
+    const file = `${roots.get(entry[2])}/${slashes(entry[3])}`;
+    files.set(file, entry[1]);
+    dirs.push([file.slice(0, -"SKILL.md".length), entry[1]]);
+  }
+  return files.size ? { files, dirs } : null;
+}
+
+/** The catalog a rollout began with, for a session this deck joined late. */
+export async function readCodexSkillCatalog(path) {
+  try {
+    const head = await readByteRange(path, 0, CATALOG_HEAD_BYTES);
+    for (const line of head.split("\n")) {
+      if (!line.includes("<skills_instructions>")) continue;
+      return parseSkillCatalog(messageText(JSON.parse(line)?.payload));
+    }
+  } catch {}
+  return null;
+}
+
+function messageText(payload) {
+  if (payload?.type !== "message" || !Array.isArray(payload.content)) return "";
+  return payload.content.map(part => typeof part?.text === "string" ? part.text : "").join("\n");
+}
+
+// A rollout's paths are its own machine's, so their shape picks the rules, not
+// the host reading them: `fileURLToPath` refuses a drive-less file URL on
+// Windows, and the host's `resolve` would put its own drive letter in front.
+const windowsPath = path => /^(?:[A-Za-z]:[\\/]|\\\\|\/\/)/.test(path);
+const localPath = value => {
+  if (typeof value !== "string" || !value) return null;
+  if (!value.startsWith("file://")) return value;
+  try {
+    const { host, pathname } = new URL(value);
+    const path = decodeURIComponent(pathname);
+    return host ? `//${host}${path}` : /^\/[A-Za-z]:\//.test(path) ? path.slice(1) : path;
+  } catch { return null; }
+};
+const resolveIn = (cwd, path) => (windowsPath(cwd) ? win32 : posix).resolve(cwd, path);
+
+/** A finished command that may have touched a skill: worth reading the catalog for. */
+const commandItem = obj => {
+  const item = obj?.type === "event_msg" && obj.payload?.type === "item_completed" ? obj.payload.item : null;
+  return item?.type === "CommandExecution" && item.exit_code === 0 && Array.isArray(item.parsed_cmd) ? item : null;
+};
+
+/** Per-rollout state: the catalog (undefined until known, null for none), the
+ *  turn the last `task_started` opened, and the turn-and-skill keys counted. */
+export const codexSkillState = () => ({ catalog: undefined, turn: null, seen: new Set(), waiting: [], loading: false });
+
+/**
+ * The skill uses one rollout line shows, as `{ key, name, origin, at }`.
+ * `skills` is the rollout's codexSkillState. A command names its own turn; the
+ * injected `<skill>` message names none and belongs to the turn just opened.
+ */
+export function codexSkillUses(obj, skills) {
+  const pl = obj?.payload;
+  const at = typeof obj?.timestamp === "string" ? Date.parse(obj.timestamp) : undefined;
+  if (obj?.type === "event_msg" && pl?.type === "task_started" && typeof pl.turn_id === "string") { skills.turn = pl.turn_id; return []; }
+  const turn = (typeof pl?.turn_id === "string" ? pl.turn_id : skills.turn) ?? `at:${obj?.timestamp ?? ""}`;
+  const use = (name, origin) => {
+    const key = `${turn}|${name}`;
+    if (skills.seen.has(key)) return [];
+    if (skills.seen.size >= 256) skills.seen.clear();
+    skills.seen.add(key);
+    return [{ key, name, origin, at }];
+  };
+  if (obj?.type === "response_item" && pl?.type === "message") {
+    const text = messageText(pl);
+    if (pl.role === "developer" && text.includes("<skills_instructions>")) { skills.catalog = parseSkillCatalog(text); return []; }
+    if (pl.role !== "user") return [];
+    return [...text.matchAll(/<skill>\s*<name>([^<]+)<\/name>/g)].flatMap(m => use(m[1].trim(), "typed"));
+  }
+  const item = commandItem(obj);
+  if (!item || !skills.catalog) return [];
+  const cwd = localPath(item.cwd);
+  const found = [];
+  for (const parsed of item.parsed_cmd) {
+    if (parsed?.type === "read" && typeof parsed.path === "string") {
+      const name = skills.catalog.files.get(slashes(cwd ? resolveIn(cwd, parsed.path) : parsed.path));
+      if (name) found.push(name);
+    } else if (parsed?.type === "unknown" && typeof parsed.cmd === "string") {
+      const cmd = slashes(parsed.cmd);
+      for (const [dir, name] of skills.catalog.dirs) if (cmd.includes(`${dir}scripts/`)) found.push(name);
+    }
+  }
+  return [...new Set(found)].flatMap(name => use(name, "detected"));
+}
+
+/**
+ * Count the skills one rollout line shows. `state` is the watcher's cursor for
+ * the rollout: its session, cwd, subagent link and path. A command that may
+ * read a skill, in a session joined after its catalog went by, waits for the
+ * catalog to be read off the head of the file.
+ */
+export function noteCodexSkills(obj, state, note = noteSkillUse) {
+  const skills = state.skills ??= codexSkillState();
+  const session = state.link?.parent_session_id ?? state.sid, cwd = state.cwd, subagent = !!state.link;
+  const send = uses => { for (const use of uses) note({ ...use, session, cwd, subagent }); };
+  if (skills.catalog === undefined && commandItem(obj) && state.path) {
+    skills.waiting.push(obj);
+    if (!skills.loading) {
+      skills.loading = true;
+      void readCodexSkillCatalog(state.path).then(catalog => {
+        if (skills.catalog === undefined) skills.catalog = catalog;
+        for (const line of skills.waiting.splice(0)) send(codexSkillUses(line, skills));
+      });
+    }
+    return;
+  }
+  send(codexSkillUses(obj, skills));
+}

package/src/server/codex-watch.mjs

@@ -16,6 +16,7 @@ import { STOP, rolloutNameId, sidFromRolloutName, walkRolloutDays } from "./code
 // record that says whose rollout it is — see codex-translate.mjs. The watcher
 // below still decides which lines are read and where each one goes.
 import { codexObjToPayload, codexSessionModel, sessionMeta } from "./codex-translate.mjs";
+import { noteCodexSkills } from "./codex-skills.mjs";
 import { codexCwdInWorkspace, writesCodexLog } from "./log-election.mjs";
 // The one spelling of a rollout's cwd — see canonical-path.mjs.
 import { canonicalCwd } from "./canonical-path.mjs";
@@ -351,7 +352,7 @@ async function openCodexCursor(path, st, now, firstRun, recover = false) {
   // UsageObserved in the file to every tab, and re-appending the lot to
   // the shared events.jsonl if this deck is the elected writer (#981).
   const fresh = !codexSeenEver.has(path);
-  const state = { offset: fresh ? 0 : st.size, sid: header.sid, cwd: header.cwd, link: header.link, skip: false, sawBeginning: fresh, rootOpened: false, seenAt: now };
+  const state = { offset: fresh ? 0 : st.size, sid: header.sid, cwd: header.cwd, link: header.link, skip: false, sawBeginning: fresh, rootOpened: false, seenAt: now, path };
   codexFileState.set(path, state);
   rememberCodexPath(path);
   if (firstRun) {
@@ -409,6 +410,8 @@ function emitCodexLines(state, consume, persist) {
     if (!line) continue;
     let obj;
     try { obj = JSON.parse(line); } catch { continue; }
+    // Skill activity reads the line itself: what says a skill ran is not an event.
+    noteCodexSkills(obj, state);
     const prevModel = codexSessionModel.get(state.sid);
     const payload = codexObjToPayload(obj, state.sid, state.cwd);
     const link = codexThreadLink(obj, state.sid, state.cwd);
@@ -486,7 +489,7 @@ async function openGrownOlderRollouts(now) {
     // Never `sawBeginning`, whatever this process read of the file before: the
     // lines before `was` are ones this deck has either drawn already or joined
     // too late for, and either way a SessionStart now would be a false one.
-    const state = { offset: skip ? st.size : was, sid: header.sid, cwd: header.cwd, link: header.link, skip, sawBeginning: false, rootOpened: false, seenAt: now, mtimeMs: st.mtimeMs };
+    const state = { offset: skip ? st.size : was, sid: header.sid, cwd: header.cwd, link: header.link, skip, sawBeginning: false, rootOpened: false, seenAt: now, mtimeMs: st.mtimeMs, path };
     codexFileState.set(path, state);
     rememberCodexPath(path);
     opened.push({ path, st, state });

package/src/server/cswap-auto-choice.mjs

@@ -181,6 +181,23 @@ async function accountsInCswapRun(accounts) {
   return live;
 }
 
+/**
+ * The slots no move may land on, whatever the rule: the ones claude-swap's
+ * engine quarantined and the ones a local `cswap run` session is using — the
+ * two `landable` skips by key. For the failover away from an expired login
+ * (autoswitch-failover.mjs), which moves without asking the rules, so it
+ * never lands on another dead login or on a login a session already holds.
+ * Roster rows in, slot numbers out.
+ */
+export async function slotsHeldBack(roster) {
+  const accounts = (Array.isArray(roster) ? roster : [])
+    .filter(a => a && a.num != null)
+    .map(a => ({ ...a, key: accountKey(a.email, a.orgUuid) }));
+  const engine = await engineState(accounts);
+  const busy = await accountsInCswapRun(accounts);
+  return new Set(accounts.filter(a => engine.quarantined.has(a.key) || busy.has(a.key)).map(a => a.num));
+}
+
 const numberOr = (v, fallback) => {
   const n = Number(v);
   return v != null && v !== "" && Number.isFinite(n) ? n : fallback;
@@ -294,3 +311,39 @@ export async function noteEngineTick(result, accounts) {
   const to = accounts.find(a => String(a.num) === String(result.to?.number));
   await updateChoice(c => ({ ...c, manual: false, lastActive: to?.key ?? null, lastMoveAt: Date.now() }));
 }
+
+/**
+ * The two rules as `ccdeck switch --best` asks them (#2183): what
+ * account-pick.mjs bestAccount hands chooseAccount, read the way
+ * chooseBeforeEngine reads it — the threshold, the counted models and the
+ * engine's strategy from claude-swap's config, the accounts its engine
+ * quarantined and the ones a local `cswap run` session holds. Null when
+ * neither rule is set, before anything else is read: `--best` is then the
+ * engine's own choice, as every tick is.
+ *
+ * `choice` and `settings` are the deck's (GET /api/cswap-auto) when a deck
+ * answered, so the rules are the ones its panel shows; with no deck they are
+ * read here. Only reads: nothing in auto-choice.json or claude-swap's store
+ * changes, so it needs no lock and takes none.
+ */
+export async function bestRules(rows, { choice = null, settings = null, now = Date.now() } = {}) {
+  const c = choice ?? await choiceStatus();
+  const next = c?.next === "weekly" ? "weekly" : "room";
+  const home = text(c?.home?.email) ? accountKey(c.home.email, c.home.orgUuid) : null;
+  if (next === "room" && !home) return null;
+  const cfg = (settings ?? await readCswapConfig()) ?? {};
+  const accounts = (Array.isArray(rows) ? rows : [])
+    .filter(a => a && a.num != null)
+    .map(a => ({ ...a, key: accountKey(a.email, a.orgUuid) }));
+  const engine = await engineState(accounts);
+  return {
+    next,
+    home,
+    threshold: numberOr(cfg["autoswitch.threshold"]?.value, 90),
+    models: countedModels(cfg["autoswitch.model"]?.value),
+    busy: await accountsInCswapRun(accounts),
+    quarantined: engine.quarantined,
+    optional: (cfg["autoswitch.strategy"]?.value ?? "best") === "best",
+    now,
+  };
+}

package/src/server/cswap-auto-loop.mjs

@@ -18,11 +18,18 @@ import { invalidateQuotaCache } from "./quota.mjs";
 import { withStoreLock } from "./store-lock.mjs";
 // Told about every finished tick and about the switch itself, so a tick that
 // moved the account is said once on the desktop (account-notify.mjs). Both
-// doors return at once and never throw.
-import { noteAutoSwitch, noteAutoTick } from "./account-watch.mjs";
+// doors return at once and never throw. The third is the other way round: how a
+// session that stopped on a dead login asks for a tick now (tickSoon).
+import { connectEarlyTick, noteAutoSwitch, noteAutoTick } from "./account-watch.mjs";
 // The owner's two rules — a home account, and the soonest weekly reset — asked
 // before the engine, inside the same lock. With neither set, nothing.
-import { chooseBeforeEngine, forgetPicksByHand, noteEngineTick } from "./cswap-auto-choice.mjs";
+import { chooseBeforeEngine, forgetPicksByHand, noteEngineTick, slotsHeldBack } from "./cswap-auto-choice.mjs";
+// The one decision the engine cannot reach under `--once`: leaving an active
+// account whose login has died. See its header.
+import { engineLostActive, failOver } from "./autoswitch-failover.mjs";
+// And the automatic continue of stopped background sessions (#2193), which a
+// tick that moved the account is the likeliest moment for. Returns at once.
+import { noteContinueTick } from "./stop-continue.mjs";
 import { readFile, writeFile, mkdir } from "node:fs/promises";
 import { join } from "node:path";
 import { homedir } from "node:os";
@@ -55,7 +62,8 @@ function summarise(stdout) {
     // here throws away readings that cost a subprocess each.
     switched:  events.some(e => e.event === "switch" && e.dryRun !== true),
     // Why the engine moved — "proactive", "at-limit", "failover" — beside the
-    // deck's own "home" and "weekly-reset" (cswap-auto-choice.mjs).
+    // deck's own "home" and "weekly-reset" (cswap-auto-choice.mjs), and
+    // "login-expired", which the deck's failover writes here.
     trigger:   action?.trigger ?? null,
     reason:    action?.reason ?? null,
     detail:    action?.detail ?? null,
@@ -121,9 +129,13 @@ async function runAutoTick() {
       // A deck-managed `cswap switch` does not advance the engine's own
       // lastSwitchAt. Its fallback must keep our cooldown too, or a manual
       // return to the full account can immediately escape the weekly rule
-      // through the engine's most-room choice. Still allow emergency exits.
+      // through the engine's most-room choice. Still allow emergency exits:
+      // the engine's own at-limit and failover, and an active account it could
+      // not read, which may be a login that has died — the deck's failover
+      // judges that one after the tick (autoswitch-failover.mjs).
       const decision = summarise(preview.stdout);
-      if (Date.now() < chose.cooldownUntil && decision.trigger !== "at-limit" && decision.trigger !== "failover") {
+      if (Date.now() < chose.cooldownUntil && decision.trigger !== "at-limit" && decision.trigger !== "failover"
+        && !engineLostActive({ ok: true, ...decision })) {
         return { chose: {
           ok: true, ...decision, event: "no-switch", switched: false,
           trigger: null, reason: "cooldown", from: null, to: null,
@@ -134,6 +146,7 @@ async function runAutoTick() {
     const out = await run(await cswapBin(), ["auto", "--once", "--json"], { timeout: TICK_TIMEOUT_MS });
     return { ...out, accounts: chose.accounts };
   });
+  _ruleAccounts = r.accounts ?? null;
   if (r.skipped) return { event: "skipped", reason: r.skipped };
   if (r.chose) return r.chose;
   // A KILLED RUN IS NOT A QUIET ONE. `run`'s timeout path deliberately keeps an
@@ -159,6 +172,11 @@ async function runAutoTick() {
 let _timer   = null;
 let _lastTick = null;
 let _enabled  = false;
+// When the deck last switched away from a dead login, for failOver's cooldown.
+let _lastFailoverAt = null;
+// The roster the home/weekly rules decided on in this tick, or null when none
+// is set: the failover's move is a tick's, and noteEngineTick records it so.
+let _ruleAccounts = null;
 // Set the instant startLoop is entered and cleared when it settles, because
 // `_timer` cannot do that job: it is assigned AFTER an await, and the window in
 // between is what #537 was. See startLoop.
@@ -169,6 +187,9 @@ let _starting = false;
 let _restartWanted = false;
 // The tick in flight, so the interval can skip rather than stack. See tick.
 let _ticking = null;
+// When the tick in flight began, so an early tick can tell whether the one
+// running already started after it was asked for. See tickSoon.
+let _tickStartedAt = 0;
 // What every tick waits for before it runs anything: the launcher's word that
 // the claude-swap it drives is not being installed or upgraded underneath it.
 // Settled by default, so a caller with nothing to wait for — a respawn, a test,
@@ -244,7 +265,25 @@ async function runTick() {
     _lastTick = { at: Date.now(), event: "skipped", reason: "disabled" };
     return;
   }
-  const result = await runAutoTick();
+  let result = await runAutoTick();
+  // A tick that could not read the active account may be a login that has
+  // died, which the engine cannot leave under --once (autoswitch-failover.mjs).
+  // The switch asks both of this function's questions again inside the lock,
+  // for the same reason runAutoTick does (#1797).
+  const failover = await failOver(result, {
+    lastAt: _lastFailoverAt,
+    before: async () => (!_enabled ? "disabled" : (await externalAutoRunning()) ? "external-engine" : null),
+    heldBack: slotsHeldBack,
+  }).catch(() => null);
+  if (failover) {
+    result = { ...result, ...failover };
+    if (failover.switched) {
+      _lastFailoverAt = Date.now();
+      // Where the failover left the user is a tick's pick, not one made by
+      // hand, so the home/weekly rules and their cooldown go on from it.
+      await noteEngineTick(result, _ruleAccounts).catch(() => {});
+    }
+  }
   // Before `_lastTick`, not after. This is the only path in the deck that moves
   // the live account without a click behind it, so nothing else is in a position
   // to make the call — and `_lastTick` is what /api/cswap-auto reports, so
@@ -286,12 +325,63 @@ async function runTick() {
 function tick() {
   if (_ticking) return _ticking;
   // The notifier hears what every tick did, the ones that switched nothing
-  // included: a threshold notice it is holding waits for exactly that answer.
+  // included: a threshold notice it is holding waits for exactly that answer,
+  // and a stopped notice for one that began after the stop.
   // Not awaited, and caught inside: a notification never delays a tick.
-  _ticking = runTick().then(() => { noteAutoTick(_lastTick); }).finally(() => { _ticking = null; });
+  const startedAt = Date.now();
+  _tickStartedAt = startedAt;
+  _ticking = runTick().then(() => { noteAutoTick(_lastTick, { startedAt }); noteContinueTick(_lastTick); }).finally(() => { _ticking = null; });
   return _ticking;
 }
 
+/** How long an early tick waits for the rest of a burst: sessions sharing a
+ *  login stop within a second or two of each other. */
+export const SOON_MS = 1_500;
+
+/** The least time between two early ticks. The stops arrive on `/api/event`,
+ *  which takes a post without the deck's token, so this is what keeps a loop
+ *  of fake ones from running `cswap auto --once` back to back — the interval's
+ *  own floor is fifteen seconds, and this is twice that. */
+export const SOON_GAP_MS = 30_000;
+
+let _soon = null;
+let _soonAskedAt = -Infinity;
+
+/**
+ * Run one tick now rather than at the next interval, because a session has
+ * just stopped on an expired login or a usage limit (account-watch.mjs
+ * `noteHookStop`). The same tick the interval runs, through the same guards,
+ * so nothing about what the engine decides changes — only when it is asked.
+ *
+ * COALESCED: the first ask arms one tick SOON_MS later and every ask until it
+ * runs joins it, so ten sessions stopping in the same second cause one tick;
+ * after it, asks inside SOON_GAP_MS are dropped, and the interval carries on.
+ * NEVER BESIDE A RUNNING TICK: one in flight is waited for, and is enough by
+ * itself when it began after the ask. Off, this does nothing.
+ *
+ * Returns whether a tick was armed, for the suite.
+ */
+export function tickSoon() {
+  if (!_enabled || _soon) return false;
+  const askedAt = Date.now();
+  if (askedAt - _soonAskedAt < SOON_GAP_MS) return false;
+  _soonAskedAt = askedAt;
+  _soon = setTimeout(async () => {
+    _soon = null;
+    try {
+      if (_ticking) {
+        const covered = _tickStartedAt >= askedAt;
+        await _ticking;
+        if (covered) return;
+      }
+      if (_enabled) await tick();
+    } catch { /* a tick reports its own failures in _lastTick */ }
+  }, SOON_MS);
+  _soon.unref?.();
+  return true;
+}
+connectEarlyTick(tickSoon);
+
 /**
  * Start the deck-managed loop, at most once.
  *
@@ -354,6 +444,7 @@ async function startLoop() {
 
 function stopLoop() {
   if (_timer) { clearInterval(_timer); _timer = null; }
+  if (_soon) { clearTimeout(_soon); _soon = null; }
 }
 
 /** Put a new interval into effect: the timer goes, and a fresh read of the