claude-multiacc 2.0.11 → 2.0.13

package/bin/claude

@@ -280,6 +280,48 @@ sel_score_of() { # $1 = acct dir
   printf '%s\n' $((w * 1000 + s))
 }
 
+# The .limited marker's own fields (line 1: reset epoch; line 2: "bucket=…
+# percent=… … reason=…"). All tolerant: an unreadable or bare marker answers
+# "unknown", never an error — these feed the all-limited fallback only.
+limited_reset_of() { # $1 acct dir -> the marker's reset epoch, or 0 (unknown)
+  local m="$1/.limited" r=""
+  [ -f "$m" ] && { IFS= read -r r < "$m" 2>/dev/null || r=""; }
+  if num_ok "$r"; then printf '%s\n' "$r"; else printf '0\n'; fi
+}
+
+limited_percent_of() { # $1 acct dir -> the marked bucket's percent, or -1 (unknown)
+  local m="$1/.limited" line=""
+  [ -f "$m" ] && line="$(sed -n 2p "$m" 2>/dev/null)"
+  case "$line" in
+    *percent=*) line="${line#*percent=}"; line="${line%% *}" ;;
+    *) line="" ;;
+  esac
+  if num_ok "$line"; then printf '%s\n' "$line"; else printf '%s\n' "-1"; fi
+}
+
+# Rejected RIGHT NOW, not merely near the threshold: the marked bucket is exhausted
+# (100%), or the marker records a real client rejection (a 429 the server sent).
+# A bucket at 90-99% still answers requests — the difference the all-limited
+# fallback lives on, because "degraded service beats a hard failure" only holds
+# for an account that can actually serve.
+limited_hard_blocked() { # $1 acct dir
+  local m="$1/.limited" line="" p
+  if [ -f "$m" ]; then
+    line="$(sed -n 2p "$m" 2>/dev/null)"
+    case "$line" in *reason=client-rate-limit*|*reason=error-cooldown*) return 0 ;; esac
+    p="$(limited_percent_of "$1")"
+    if [ "$p" -ge 0 ] 2>/dev/null; then
+      [ "$p" -ge 100 ]
+      return
+    fi
+    return 1
+  fi
+  # No marker (the over-threshold backstop put it in valid-but-not-eligible):
+  # fresh telemetry's peak decides; stale/unknown reads as still serving.
+  p="$(cutoff_field "$1" max_percent)" || return 1
+  [ "$p" -ge 100 ]
+}
+
 # Peak of ALL buckets (session included) — the EXCLUSION signal. Stale/unknown => 50.
 util_of() {
   local v
@@ -682,6 +724,30 @@ expired_marked() { # $1 = acct dir
   local m="$1/.expired" mt f soft reason
   [ -f "$m" ] || return 1
   reason="$(LC_ALL=C sed -n 's/.*reason=\([A-Za-z0-9._-][A-Za-z0-9._-]*\).*/\1/p' "$m" 2>/dev/null | head -1)"
+  if [ "$reason" = "setup-token-invalid" ]; then
+    # A TOKEN-scoped park: it says the portable token is dead and nothing about the
+    # login beside it. Only a NEW token heals it — a login refresh rewrites
+    # .credentials.json / the Keychain item every few hours and used to lift it, so the
+    # next session that had to use the token exported the dead one, got 401 and parked
+    # it again (2026-08-29). And it only EXCLUDES the account from a session that would
+    # authenticate by that token: one that can use a live login here (a GUI terminal,
+    # the runner's LaunchAgent) runs the account on the login, token park or not.
+    mt="$(file_mtime "$m")"
+    if [ -f "$1/server.token" ] && [ "$(file_mtime "$1/server.token")" -gt "$mt" ]; then
+      rm -f "$m" 2>/dev/null
+      return 1
+    fi
+    if has_oauth "$1" && ! creds_dead "$1"; then
+      return 1                                      # the login carries this session
+    fi
+    soft="$(LC_ALL=C sed -n 's/.*soft_until=\([0-9][0-9]*\).*/\1/p' "$m" 2>/dev/null | head -1)"
+    case "$soft" in
+      ''|*[!0-9]*) return 0 ;;
+      *) [ "$now" -lt "$soft" ] && return 0
+         rm -f "$m" 2>/dev/null
+         return 1 ;;
+    esac
+  fi
   # CREDENTIAL-scoped parks clear the moment a newer credential lands — that is the
   # evidence they were about. A POLICY park (org-blocked) is about the account, not the
   # credential: refreshing its token does not re-enable Claude Code for it. Letting a
@@ -985,19 +1051,50 @@ if [ "${#eligible[@]}" -gt 0 ]; then
     pick_best "${eligible[@]}"
   fi
 else
-  # Every account is limit-marked: degraded service beats a hard failure (100% rule).
-  assess_telemetry "${valid[@]}"
-  [ "$degraded" = 1 ] && SEL_DEGRADED=1
-  pick_best "${valid[@]}"
+  # Every account is limit-marked: degraded service beats a hard failure (100% rule) —
+  # but not every limited account is equally dead. A bucket at 90-99% still answers;
+  # one at 100% (or a real client 429) rejects every request until its reset. Ranking
+  # the fallback on weekly headroom alone handed out a session-exhausted account
+  # (weekly=7%, session=100%) over one still serving at weekly 99% — a guaranteed
+  # rejection chosen over a working session (operator report, 2026-08-29).
+  soft=()
+  hard=()
+  for d in "${valid[@]}"; do
+    if limited_hard_blocked "$d"; then hard+=("$d"); else soft+=("$d"); fi
+  done
+  if [ "${#soft[@]}" -gt 0 ]; then
+    assess_telemetry "${soft[@]}"
+    [ "$degraded" = 1 ] && SEL_DEGRADED=1
+    pick_best "${soft[@]}"
+  else
+    # Every account is exhausted RIGHT NOW: nothing serves, so hand out the one
+    # that unblocks first — its rejection window is the shortest.
+    assess_telemetry "${valid[@]}"
+    [ "$degraded" = 1 ] && SEL_DEGRADED=1
+    PICK_DIR=""
+    best_reset=0
+    for d in "${hard[@]}"; do
+      r="$(limited_reset_of "$d")"
+      if [ -z "$PICK_DIR" ]; then
+        PICK_DIR="$d"; best_reset="$r"; continue
+      fi
+      if [ "$r" -gt 0 ] && { [ "$best_reset" -eq 0 ] || [ "$r" -lt "$best_reset" ]; }; then
+        PICK_DIR="$d"; best_reset="$r"
+      fi
+    done
+    sel_log "all-limited fallback=$(basename "$PICK_DIR") all-exhausted resets_in=$((best_reset > now ? best_reset - now : 0))s"
+  fi
   # Report the number this fallback ACTUALLY ranked on. Asking fresh_field here printed
   # `weekly=?%` even when the pick was made on a perfectly good stale reading, so anyone
   # reading only this event concluded the choice had no usage input at all.
-  if [ "$degraded" = 1 ]; then
-    sel_log "all-limited fallback=$(basename "$PICK_DIR") weekly=$(stale_weekly "$PICK_DIR" || echo '?')% ranking=DEGRADED"
-  elif [ "$blind" = 1 ]; then
-    sel_log "all-limited fallback=$(basename "$PICK_DIR") weekly=?% ranking=BLIND"
-  else
-    sel_log "all-limited fallback=$(basename "$PICK_DIR") weekly=$(fresh_field "$PICK_DIR" weekly_percent || echo '?')%"
+  if [ "${#soft[@]}" -gt 0 ]; then
+    if [ "$degraded" = 1 ]; then
+      sel_log "all-limited fallback=$(basename "$PICK_DIR") weekly=$(stale_weekly "$PICK_DIR" || echo '?')% ranking=DEGRADED"
+    elif [ "$blind" = 1 ]; then
+      sel_log "all-limited fallback=$(basename "$PICK_DIR") weekly=?% ranking=BLIND"
+    else
+      sel_log "all-limited fallback=$(basename "$PICK_DIR") weekly=$(fresh_field "$PICK_DIR" weekly_percent || echo '?')%"
+    fi
   fi
 fi
 pick="$PICK_DIR"

package/bin/claude-accounts

@@ -907,12 +907,20 @@ ceremony_token_check() { # $1 = token
 # token Claude rejects is never saved, uploaded, or distributed. $1 = acct dir,
 # $2 = token, $3 = acct id (messages only).
 commit_ceremony_token() {
-  local d="$1" tok="$2" id="$3" rc=0
+  local d="$1" tok="$2" id="$3" src="${4:-captured}" rc=0
   ceremony_token_check "$tok" || rc=$?
-  if [ "$rc" -eq 1 ]; then
-    if [ "${#tok}" -lt "$SETUP_TOKEN_FULL_LEN" ]; then
-      die "Claude rejected the captured token (${CEREMONY_CHECK_DETAIL:-401}) — it is ${#tok} characters and a complete setup-token is $SETUP_TOKEN_FULL_LEN: the sign-in terminal wrapped it and only its first line was captured. Nothing saved for $id. Mint again from a terminal at least $CEREMONY_TTY_MIN_COLS columns wide, or from an updated panel."
+  # A short token is an incomplete one unless Claude itself has just answered with it:
+  # the length alone convicts it, so an inconclusive probe (429, network) must not let
+  # it through as merely "unverified" — that is the exact token the fleet then rejects.
+  # The cause named depends on where the token came from: a CAPTURED one was wrapped by
+  # the ceremony's terminal; a PASTED one was cut before it reached the clipboard.
+  if [ "$rc" -ne 0 ] && [ "${#tok}" -lt "$SETUP_TOKEN_FULL_LEN" ]; then
+    if [ "$src" = "pasted" ]; then
+      die "the pasted token is ${#tok} characters and a complete setup-token is $SETUP_TOKEN_FULL_LEN (${CEREMONY_CHECK_DETAIL:-not proven by a real call}) — it was cut before it reached the clipboard (a narrow terminal wraps the token when it is shown). Nothing saved for $id. Copy the WHOLE token and paste again."
     fi
+    die "the captured token is ${#tok} characters and a complete setup-token is $SETUP_TOKEN_FULL_LEN (${CEREMONY_CHECK_DETAIL:-not proven by a real call}): the sign-in terminal wrapped it and only its first line was captured. Nothing saved for $id. Mint again from a terminal at least $CEREMONY_TTY_MIN_COLS columns wide, or from an updated panel."
+  fi
+  if [ "$rc" -eq 1 ]; then
     die "Claude rejected the captured token (${CEREMONY_CHECK_DETAIL:-401}) — nothing saved for $id; sign in again as the right account and retry"
   fi
   ( umask 077; printf '%s' "$tok" > "$d/server.token" )
@@ -1099,7 +1107,7 @@ cmd_mint() {
   if [ -n "$got" ] && [ -n "$email" ] && [ "$got" != "$email" ]; then
     die "that token authenticates as $got but $id is $email — nothing saved"
   fi
-  commit_ceremony_token "$d" "$tok" "$id"
+  commit_ceremony_token "$d" "$tok" "$id" "$([ "$paste" = "1" ] && echo pasted || echo captured)"
   clear_auth_markers "$d"
   log_to ops.log "mint $id"
   echo "Token saved to $d/server.token"
@@ -1150,7 +1158,7 @@ cmd_login() {
     if [ -z "$got" ] && [ "$force" != "1" ]; then
       die "signed in, but the account identity could not be read back — refusing to call $id fixed (retry, or pass --force)"
     fi
-    clear_auth_markers "$d"
+    clear_auth_markers "$d" keep-token-park
     if [ -s "$d/.credentials.json" ]; then
       echo "$id login saved (.credentials.json, this machine, auto-refreshing)."
     else
@@ -1515,12 +1523,20 @@ def mark_expired(d, slug, detail=''):
 
 def clear_expired(d):
     """A usage fetch that succeeded PROVES the bearer works — drop any dead-auth mark.
-    EXCEPT an org-blocked one: those accounts authenticate perfectly (telemetry works),
-    they are just barred from Claude Code inference, so telemetry says nothing about
-    them. Only a passing `verify` (a real call) or a re-login lifts that."""
+    EXCEPT:
+    - org-blocked: those accounts authenticate perfectly (telemetry works), they are
+      just barred from Claude Code inference, so telemetry says nothing about them.
+    - setup-token-invalid: the bearer behind a usage fetch or a refresh grant is the
+      machine-local OAUTH login, and its success says nothing about the PORTABLE
+      token a real inference rejected. On the one Mac holding both, this probe
+      un-parked every dead-token account minutes after the shim parked it, and every
+      fresh `claude` walked back into the same 401 all day (2026-08-29). Only a NEW
+      token (the shim's newer-file rule) or a real call that used the token lifts it.
+    Only a passing `verify` (a real call) or a re-login lifts the excepted ones."""
     mpath = os.path.join(d, '.expired')
     try:
-        if 'reason=org-blocked' in open(mpath, errors='replace').read():
+        body = open(mpath, errors='replace').read()
+        if 'reason=org-blocked' in body or 'reason=setup-token-invalid' in body:
             return False
     except OSError:
         return False
@@ -2303,11 +2319,20 @@ for acct in manifest.get('accounts', []):
     dt = time.time() - t0
     out = (r.stdout or '').strip()
     if r.returncode == 0 and 'ok' in out.lower():
-        # A real call succeeded: this account is definitively alive.
+        # A real call succeeded: this account is definitively alive — but WHICH
+        # credential answered matters. A pass on the OAuth login says nothing about a
+        # portable token a real call rejected; clearing that park here re-opened the
+        # 401 loop the marker exists to stop (the shim re-picked the account, exported
+        # the dead token, parked it again — 2026-08-29).
         try:
-            os.remove(os.path.join(d, '.expired'))
+            marker = open(os.path.join(d, '.expired'), errors='replace').read()
         except OSError:
-            pass
+            marker = ''
+        if uses_token or 'reason=setup-token-invalid' not in marker:
+            try:
+                os.remove(os.path.join(d, '.expired'))
+            except OSError:
+                pass
         if uses_token:
             try:
                 digest = hashlib.sha256(open(tpath, 'rb').read().strip()).hexdigest()

package/lib/audit.py

@@ -83,7 +83,16 @@ def expired_marked(d, now=None):
     if not os.path.isfile(mpath):
         return False
     detail = marker_reason(mpath)
-    if marker_slug(detail) != 'org-blocked':
+    slug = marker_slug(detail)
+    if slug == 'setup-token-invalid':
+        # A TOKEN park heals only when a NEW token lands (bin/claude expired_marked):
+        # a login refresh rewriting .credentials.json or the Keychain item says
+        # nothing about the portable token.
+        mt = _mtime(mpath)
+        p = os.path.join(d, 'server.token')
+        if os.path.isfile(p) and _mtime(p) > mt:
+            return False
+    elif slug != 'org-blocked':
         mt = _mtime(mpath)
         for name in ('.credentials.json', 'server.token'):
             p = os.path.join(d, name)
@@ -277,6 +286,17 @@ def audit_account(root, acct, now=None, machine=None, require_verified_token=Fal
             row['reason'] = ('this account\'s organization has disabled Claude Code '
                              'subscription access')
         elif slug == 'setup-token-invalid':
+            login = oauth_login(d, now)
+            if login['state'] == 'ok':
+                # A token park says nothing about the working login beside it: the
+                # shim runs this account on the login here (bin/claude
+                # expired_marked), so this machine reads it as usable — while the
+                # token stays unproven for the fleet (token_verified False).
+                row['store'] = login['store']
+                row['state'] = 'ok'
+                row['reason'] = (f"{login['reason']}; portable setup-token was rejected "
+                                 "here and is not used")
+                return done(row)
             row['state'] = 'token-invalid'
             row['reason'] = 'portable setup-token was rejected by a real inference'
         else:

package/lib/common.sh

@@ -491,7 +491,15 @@ mark_expired() { # mark_expired <acct dir> <reason-slug> [detail]
 # Called wherever fresh auth lands (login/add/mint, successful usage fetch): the
 # account is provably alive again, so both the dead-auth marker and any refresh
 # backoff must go, or it would stay parked until the next re-login.
-clear_auth_markers() { # $1 = acct dir
+clear_auth_markers() { # $1 = acct dir, $2 = "keep-token-park" after a LOGIN-only ceremony
+  # A fresh login proves the login; it says nothing about a portable token a real
+  # call rejected, so that park outlives it — only a new token (mint / login --token)
+  # or a real call through the token lifts it.
+  if [ "${2:-}" = "keep-token-park" ] \
+      && grep -q 'reason=setup-token-invalid' "$1/.expired" 2>/dev/null; then
+    rm -f "$1/.oauth-refresh.json" 2>/dev/null || true
+    return 0
+  fi
   rm -f "$1/.expired" "$1/.oauth-refresh.json" 2>/dev/null || true
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-multiacc",
-  "version": "2.0.11",
+  "version": "2.0.13",
   "description": "Unified Claude Code and OpenAI Codex subscription pooling with quota-aware selection.",
   "type": "module",
   "bin": {

package/tests/run-tests.sh

@@ -104,6 +104,10 @@ case "${CLAUDE_CODE_OAUTH_TOKEN:-}" in
   sk-ant-oat01-WWW*)
     # The wrapped fixture above: only the COMPLETE token (with its tail) authenticates;
     # its 79-character first line is what Claude answered 401 to, fleet-wide.
+    if [ -n "${FAKE_PROBE_FLAKY:-}" ]; then
+      # Not an auth verdict at all — the API is busy. The probe is inconclusive.
+      echo "API Error: 529 Overloaded" >&2; exit 1
+    fi
     case "$CLAUDE_CODE_OAUTH_TOKEN" in
       *TAILOK) : ;;
       *) echo "Failed to authenticate. API Error: 401 OAuth access token is invalid." >&2; exit 1 ;;
@@ -432,6 +436,88 @@ grep -q "all-limited fallback=acct-02" "$ACC/selection.log" \
   && t_ok "fallback logged" || t_fail "fallback logged" "no all-limited line in selection.log"
 rm -f "$ACC/acct-01/.limited" "$ACC/acct-02/.limited"
 
+# ---- 9a2. the fallback tells "still serving" from "rejected right now" --------------
+# acct-01: weekly at 99% — worse headroom, but still answering requests.
+# acct-02: session at 100% — far better weekly (7%), but every request bounces until
+# the reset. Ranking on headroom alone handed out the guaranteed rejection
+# (operator report 2026-08-29: "claude keeps starting on an out-of-limits account").
+printf '%s\nbucket=weekly_scoped:Fable percent=99 marked_at=x reason=limits\n' "$((now+3600))" > "$ACC/acct-01/.limited"
+printf '%s\nbucket=session percent=100 marked_at=x reason=limits\n' "$((now+600))" > "$ACC/acct-02/.limited"
+printf '{"fetched_at":%s,"max_percent":99,"weekly_percent":99,"session_percent":10,"buckets":[]}' "$now" > "$ACC/acct-01/limits.json"
+printf '{"fetched_at":%s,"max_percent":100,"weekly_percent":7,"session_percent":100,"buckets":[]}' "$now" > "$ACC/acct-02/limits.json"
+out="$(claude 2>&1)"
+check "a still-serving limited account beats an exhausted one with more headroom" "CFG=acct-01" "$out"
+# A real client rejection (a 429 the server sent) is exhausted whatever percent says.
+printf '%s\nbucket=five_hour marked_at=x reason=client-rate-limit\n' "$((now+600))" > "$ACC/acct-02/.limited"
+out="$(claude 2>&1)"
+check "a client-rejected account is not the fallback while another still serves" "CFG=acct-01" "$out"
+# Every account exhausted RIGHT NOW: hand out the one that unblocks first.
+printf '%s\nbucket=session percent=100 marked_at=x reason=limits\n' "$((now+7200))" > "$ACC/acct-01/.limited"
+printf '%s\nbucket=session percent=100 marked_at=x reason=limits\n' "$((now+600))" > "$ACC/acct-02/.limited"
+out="$(claude 2>&1)"
+check "all exhausted: the soonest reset is handed out" "CFG=acct-02" "$out"
+grep -q "all-exhausted resets_in=" "$ACC/selection.log" \
+  && t_ok "the all-exhausted pick is logged with its reset" || t_fail "all-exhausted log" "no line"
+rm -f "$ACC/acct-01/.limited" "$ACC/acct-02/.limited"
+printf '{"fetched_at":%s,"max_percent":97,"buckets":[]}' "$now" > "$ACC/acct-01/limits.json"
+printf '{"fetched_at":%s,"max_percent":91,"buckets":[]}' "$now" > "$ACC/acct-02/limits.json"
+
+# ---- 9a3. a token park is credential-scoped ----------------------------------------
+# A dead portable token beside a LIVE login: this session runs the account on the
+# login — the park neither excludes it nor exports the token. Only a session that
+# would have to use the token is kept away, and only a NEW token heals the park (a
+# login refresh rewriting the credential must not — that rewrite happened every few
+# hours and re-opened the 401 loop, 2026-08-29).
+rm -rf "$WORK/bak01"; mkdir -p "$WORK/bak01"
+for f in server.token .credentials.json .expired .server-token-verified limits.json; do
+  [ -e "$ACC/acct-01/$f" ] && cp -p "$ACC/acct-01/$f" "$WORK/bak01/$f"
+done
+printf '%s\nx\n' "$((now+3600))" > "$ACC/acct-02/.limited"         # acct-01 is the only free one
+printf '{"fetched_at":%s,"max_percent":10,"weekly_percent":10,"session_percent":5,"buckets":[]}' "$now" > "$ACC/acct-01/limits.json"
+printf '{"claudeAiOauth":{"accessToken":"sk-ant-oat01-live","refreshToken":"r","expiresAt":9999999999999,"refreshTokenExpiresAt":9999999999999}}' > "$ACC/acct-01/.credentials.json"
+printf 'sk-ant-oat01-REVOKEDREVOKEDREVOKEDREVOKEDREVOKEDREVOKED' > "$ACC/acct-01/server.token"
+touch -t 202001010000 "$ACC/acct-01/server.token"                 # older than the park
+rm -f "$ACC/acct-01/.server-token-verified"
+printf '%s\nreason=setup-token-invalid marked_at=x detail=portable OAuth token rejected\n' "$now" > "$ACC/acct-01/.expired"
+out="$(claude 2>&1)"
+check "a live login runs the account despite a token park" "CFG=acct-01" "$out"
+check "the parked token is not exported beside a live login" "TOK=none" "$out"
+[ -f "$ACC/acct-01/.expired" ] && t_ok "the token park stays on record for token-only sessions" \
+  || t_fail "token park record" "marker removed"
+out="$(claude-accounts list --json 2>/dev/null | python3 -c '
+import json, sys
+rows = {a["id"]: a for a in json.load(sys.stdin)["accounts"]}
+print(rows["acct-01"]["status"], rows["acct-01"].get("token_verified"))')"
+[ "$out" = "active False" ] && t_ok "the audit reads a live login beside a parked token as usable, token unproven" \
+  || t_fail "audit token park" "expected 'active False', got '$out'"
+# The login dies: now the token would carry the session, and the park excludes it.
+printf '{"claudeAiOauth":{"accessToken":"sk-ant-oat01-dead","refreshToken":"r","expiresAt":1000000000000,"refreshTokenExpiresAt":1000000000000}}' > "$ACC/acct-01/.credentials.json"
+touch -t 202101010000 "$ACC/acct-01/.expired"                     # the credential above is NEWER
+rm -f "$ACC/acct-02/.limited"
+out="$(claude 2>&1)"
+check "a dead login makes the token park bite" "CFG=acct-02" "$out"
+[ -f "$ACC/acct-01/.expired" ] && t_ok "a newer credential does not heal a token park" \
+  || t_fail "credential heal" "the login refresh lifted the token park"
+out="$(claude-accounts list --json 2>/dev/null | python3 -c '
+import json, sys
+rows = {a["id"]: a for a in json.load(sys.stdin)["accounts"]}
+print(rows["acct-01"]["status"])')"
+[ "$out" = "token-invalid" ] && t_ok "the audit reads a parked token beside a dead login as token-invalid" \
+  || t_fail "audit token-invalid" "got '$out'"
+# A NEW token heals it — and the healed account is selected again, on the token.
+printf 'sk-ant-oat01-%s' "$(printf '%95s' '' | tr ' ' N)" > "$ACC/acct-01/server.token"
+printf '%s\nx\n' "$((now+3600))" > "$ACC/acct-02/.limited"
+out="$(claude 2>&1)"
+check "a new token heals the park" "CFG=acct-01" "$out"
+check "the healed account runs on its new token" "TOK=sk-ant-oat01-NNN" "$out"
+[ ! -f "$ACC/acct-01/.expired" ] && t_ok "the healed park is gone" || t_fail "healed park" "marker still present"
+# Hand acct-01 back exactly as it was.
+rm -f "$ACC/acct-02/.limited" "$ACC/acct-01/server.token" "$ACC/acct-01/.credentials.json" \
+  "$ACC/acct-01/.expired" "$ACC/acct-01/.server-token-verified" "$ACC/acct-01/limits.json"
+for f in server.token .credentials.json .expired .server-token-verified limits.json; do
+  [ -e "$WORK/bak01/$f" ] && cp -p "$WORK/bak01/$f" "$ACC/acct-01/$f"
+done
+
 # ---- 9b. codex-review regressions: auth/marker/threshold hardening -------------
 # empty .credentials.json must NOT count as auth (interrupted write)
 mkdir -p "$ACC/acct-06"
@@ -1308,13 +1394,48 @@ check "the refusal names the truncation" "79 characters" "$out"
 check "the refusal names the cause" "terminal wrapped it" "$out"
 [ "$(cat "$ACC/acct-04/server.token")" = "$orig" ] && t_ok "a refused capture leaves the old token in place" \
   || t_fail "refused capture" "server.token was overwritten"
+# An INCONCLUSIVE probe (the API is busy) must not let a wrapped capture through as
+# merely "unverified": its length alone convicts it, and that is the exact token the
+# fleet then rejects on every Mac.
+out="$(FAKE_TOKEN_FULL=1 FAKE_TOKEN_WRAP=1 FAKE_PROBE_FLAKY=1 claude-accounts mint acct-04 2>&1 </dev/null)"
+rc=$?
+[ "$rc" != "0" ] && t_ok "a wrapped capture is refused even when the probe is inconclusive" \
+  || t_fail "wrapped+inconclusive rc" "rc=0"
+check "the inconclusive refusal still names the cause" "terminal wrapped it" "$out"
+[ "$(cat "$ACC/acct-04/server.token")" = "$orig" ] && t_ok "an unproven fragment saves nothing" \
+  || t_fail "unproven fragment" "server.token was overwritten"
+# …while a COMPLETE token the probe cannot reach right now is saved as UNVERIFIED — the
+# shim proves it on first use — rather than blocking the operator on a busy API.
+out="$(FAKE_TOKEN_FULL=1 FAKE_PROBE_FLAKY=1 claude-accounts mint acct-04 2>&1 </dev/null)"
+rc=$?
+[ "$rc" = "0" ] && t_ok "a complete token survives an inconclusive probe" || t_fail "complete+inconclusive rc" "rc=$rc: $(printf '%s' "$out" | tail -c 200)"
+check "the inconclusive save says so" "saved as UNVERIFIED" "$out"
+[ "$(tr -d '[:space:]' < "$ACC/acct-04/server.token" | wc -c | tr -d ' ')" = "108" ] \
+  && t_ok "the complete token was saved" || t_fail "complete token save" "wrong length"
+[ ! -f "$ACC/acct-04/.server-token-verified" ] && t_ok "an unproven save records no proof" \
+  || t_fail "unproven proof marker" "marker present"
+printf '%s' "$orig" > "$ACC/acct-04/server.token"
 # A pasted token gets the same proof: a revoked one is refused, not saved.
-out="$(printf 'sk-ant-oat01-REVOKEDREVOKEDREVOKEDREVOKEDREVOKEDREVOKEDREVOKED' | claude-accounts mint acct-04 --paste 2>&1)"
+# (A complete-length token, so the verdict is the rejection itself and not the
+# length rule that catches wrapped fragments first.)
+out="$(printf 'sk-ant-oat01-REVOKED%s' "$(printf '%88s' '' | tr ' ' R)" | claude-accounts mint acct-04 --paste 2>&1)"
 rc=$?
 [ "$rc" != "0" ] && t_ok "mint --paste refuses a token Claude rejects" || t_fail "paste rejected rc" "rc=0"
 check "the paste refusal says Claude rejected it" "Claude rejected the captured token" "$out"
 [ "$(cat "$ACC/acct-04/server.token")" = "$orig" ] && t_ok "a rejected paste saves nothing" \
   || t_fail "rejected paste" "server.token was overwritten"
+# A SHORT rejected paste blames the paste — not a ceremony terminal this command
+# never opened.
+out="$(printf 'sk-ant-oat01-REVOKEDREVOKEDREVOKEDREVOKEDREVOKEDREVOKED' | claude-accounts mint acct-04 --paste 2>&1)"
+rc=$?
+[ "$rc" != "0" ] && t_ok "a short rejected paste is refused" || t_fail "short paste rc" "rc=0"
+check "the short-paste refusal blames the paste" "cut before it reached the clipboard" "$out"
+case "$out" in
+  *"sign-in terminal wrapped it"*) t_fail "short paste must not blame the ceremony terminal" "wrong provenance" ;;
+  *) t_ok "short paste must not blame the ceremony terminal" ;;
+esac
+[ "$(cat "$ACC/acct-04/server.token")" = "$orig" ] && t_ok "a short rejected paste saves nothing" \
+  || t_fail "short paste" "server.token was overwritten"
 
 # ---- 15c1b. the ceremony widens an unsized pty, so the whole token is captured ------
 # The panel drives the ceremony over a pty it never sized (0x0 -> the TUI renders 80
@@ -1411,9 +1532,15 @@ check "wrong-account sign-in skips (already added)" "a@test is already added as
 
 # ---- 15f. login command completes auth for an existing auth-less account -------------
 claude-accounts import pending@test --id acct-08 --no-sync >/dev/null 2>&1
+# A parked (dead) token beside the account: a LOGIN-only ceremony must not lift that
+# park — it proves the login, not the token.
+printf 'sk-ant-oat01-REVOKEDREVOKEDREVOKEDREVOKEDREVOKEDREVOKED' > "$ACC/acct-08/server.token"
+printf '%s\nreason=setup-token-invalid marked_at=x detail=portable OAuth token rejected\n' "$now" > "$ACC/acct-08/.expired"
 out="$(CLAUDE_MULTIACC_FORCE_TTY=1 FAKE_EMAIL=pending@test claude-accounts login acct-08 2>&1)"
 check "login completes existing account (full login)" "acct-08 login saved" "$out"
 [ -f "$ACC/acct-08/.credentials.json" ] && t_ok "login writes .credentials.json" || t_fail "login creds" "missing"
+[ -f "$ACC/acct-08/.expired" ] && t_ok "a login-only ceremony keeps the token park" \
+  || t_fail "login keeps token park" "marker removed"
 out="$(CLAUDE_MULTIACC_FORCE_TTY=1 FAKE_EMAIL=other@test claude-accounts login acct-08 2>&1)"
 rc=$?
 check "login email mismatch refused" "nothing saved" "$out"
@@ -1422,6 +1549,7 @@ check "login email mismatch refused" "nothing saved" "$out"
 out="$(CLAUDE_MULTIACC_FORCE_TTY=1 FAKE_EMAIL=pending@test claude-accounts login acct-08 --token 2>&1)"
 check "login --token saves a portable token" "acct-08 token saved" "$out"
 [ -s "$ACC/acct-08/server.token" ] && t_ok "login --token writes server.token" || t_fail "login token" "missing"
+[ ! -f "$ACC/acct-08/.expired" ] && t_ok "a new token lifts the token park" || t_fail "token lifts park" "marker still present"
 claude-accounts remove acct-08 --yes >/dev/null 2>&1
 
 # ---- 15f2. expired: the re-login worklist, and relogin fixes it ----------------------
@@ -2618,6 +2746,49 @@ out="$(claude-accounts verify 2>&1)"
 check "verify calls a rejected setup-token what it is" "portable setup-token is invalid" "$out"
 check "verify recommends replacing a rejected setup-token" \
   "claude-accounts login acct-01 --token" "$out"
+
+# ---- 17c. a login-proven pass never lifts a TOKEN park -------------------------------
+# One Mac can hold both credentials: a working OAuth login beside a dead portable
+# token. The limits probe's bearer is the LOGIN, and its success used to clear the
+# token's park ("dead-auth marker cleared") — the next selection exported the dead
+# token, got 401, parked it again, all day (2026-08-29).
+printf '{"claudeAiOauth":{"accessToken":"sk-ant-oat01-live","refreshToken":"r","expiresAt":9999999999999,"refreshTokenExpiresAt":9999999999999}}' > "$ACC/acct-01/.credentials.json"
+printf 'sk-ant-oat01-REVOKED%s' "$(printf '%88s' '' | tr ' ' R)" > "$ACC/acct-01/server.token"
+printf '%s\nreason=setup-token-invalid marked_at=x detail=portable OAuth token rejected\n' "$now" > "$ACC/acct-01/.expired"
+out="$(CLAUDE_MULTIACC_USAGE_URL="file://$WORK/usage-low.json" claude-accounts limits 2>&1)"
+case "$out" in
+  *"acct-01: dead-auth marker cleared"*) t_fail "limits probe must not lift a token park" "the login's success cleared the token's marker" ;;
+  *) t_ok "limits probe must not lift a token park" ;;
+esac
+[ -f "$ACC/acct-01/.expired" ] && grep -q 'setup-token-invalid' "$ACC/acct-01/.expired" \
+  && t_ok "the token park survives a login-proven probe" || t_fail "token park survival" ".expired gone"
+# ...but an ordinary login park IS lifted — a working bearer proves exactly that.
+printf '%s\nreason=auth-error marked_at=x detail=a real call came back not-authenticated\n' "$now" > "$ACC/acct-01/.expired"
+out="$(CLAUDE_MULTIACC_USAGE_URL="file://$WORK/usage-low.json" claude-accounts limits 2>&1)"
+check "an auth-error park is still lifted by a working bearer" "dead-auth marker cleared" "$out"
+[ ! -f "$ACC/acct-01/.expired" ] && t_ok "the login park was lifted" || t_fail "login park" "still present"
+# verify: a PASS on the LOGIN keeps the token park; a PASS on the TOKEN lifts it.
+printf '%s\nreason=setup-token-invalid marked_at=x detail=portable OAuth token rejected\n' "$now" > "$ACC/acct-01/.expired"
+out="$(claude-accounts verify 2>&1)"
+case "$out" in *"acct-01 a@test: PASS"*) t_ok "verify passes on the login" ;; \
+  *) t_fail "verify login pass" "$(printf '%s' "$out" | grep acct-01 | head -1)" ;; esac
+[ -f "$ACC/acct-01/.expired" ] && t_ok "a login pass does not lift the token park" \
+  || t_fail "verify token park" ".expired gone"
+# A dead login beside a fresh valid token: the pass rides the TOKEN and lifts its park.
+printf '{"claudeAiOauth":{"accessToken":"sk-ant-oat01-dead","refreshToken":"r","expiresAt":1000000000000,"refreshTokenExpiresAt":1000000000000}}' > "$ACC/acct-01/.credentials.json"
+printf 'sk-ant-oat01-%s' "$(printf '%95s' '' | tr ' ' G)" > "$ACC/acct-01/server.token"
+rm -f "$ACC/acct-01/.server-token-verified"
+out="$(claude-accounts verify 2>&1)"
+case "$out" in *"acct-01 a@test: PASS"*) t_ok "verify passes on the token" ;; \
+  *) t_fail "verify token pass" "$(printf '%s' "$out" | grep acct-01 | head -1)" ;; esac
+[ ! -f "$ACC/acct-01/.expired" ] && t_ok "a token pass lifts the token park" \
+  || t_fail "token pass park" "still present"
+# Hand back the state the next checks expect: a dead login beside a REVOKED token,
+# parked and unproven — exactly where 17b left acct-01.
+printf '{"claudeAiOauth":{"accessToken":"sk-ant-oat01-dead","refreshToken":"r","expiresAt":1000000000000,"refreshTokenExpiresAt":1000000000000}}' > "$ACC/acct-01/.credentials.json"
+printf 'sk-ant-oat01-REVOKEDREVOKEDREVOKEDREVOKEDREVOKEDREVOKED' > "$ACC/acct-01/server.token"
+rm -f "$ACC/acct-01/.server-token-verified"
+printf '%s\nreason=setup-token-invalid marked_at=x detail=portable setup-token failed a real inference\n' "$now" > "$ACC/acct-01/.expired"
 out="$(claude-accounts expired 2>&1)"
 check "verify marker retains setup-token classification" "TOKEN INVALID" "$out"
 check "verify marker retains setup-token recovery" \