claude-multiacc 2.0.14 → 2.0.16

package/bin/claude

@@ -160,8 +160,119 @@ sel_log() {
   printf '%s %s\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$*" 2>/dev/null >> "$ACC_ROOT/selection.log" || true
 }
 
+# ---- model-scoped limits ------------------------------------------------------
+# A usage bucket can be scoped to ONE MODEL ("weekly_scoped:Fable"), and such a bucket
+# says nothing about the account's ability to serve a DIFFERENT model. The limits
+# refresher parks the whole account for it all the same, and the >=90% cutoff reads the
+# peak across every bucket — so on 2026-08-29 acct-02/06/07 sat at Fable 100% with their
+# session buckets at 51/23/25%, were excluded from every selection, and a pool of eleven
+# accounts offered nothing usable: the all-limited fallback handed out a
+# session-exhausted account that rejected the operator's very first request. The retry
+# layer already knew a scoped limit means "switch model, not account" (MODEL_LIMITPAT
+# below); selection has to know it too.
+FALLBACK_MODEL="${CLAUDE_MULTIACC_FALLBACK_MODEL:-claude-opus-5}"
+
+# The model THIS invocation asks for ("" when it pins none), read from the caller's own
+# argv: an explicit --model is never second-guessed, so an account whose Fable bucket is
+# full stays genuinely unusable for `--model claude-fable-5`.
+RUN_MODEL=""
+_sel_next_is_model=0
+for _sel_arg in "$@"; do
+  if [ "$_sel_next_is_model" = 1 ]; then
+    RUN_MODEL="$_sel_arg"; _sel_next_is_model=0; continue
+  fi
+  case "$_sel_arg" in
+    --model) _sel_next_is_model=1 ;;
+    --model=*) RUN_MODEL="${_sel_arg#--model=}" ;;
+  esac
+done
+unset _sel_arg _sel_next_is_model
+
+sel_lc() { printf '%s' "${1:-}" | LC_ALL=C tr 'A-Z' 'a-z'; }
+
+# The model token a `.limited` marker is scoped to ("Fable"); empty when the marker is
+# not model-scoped (session, weekly_all, client:…).
+scoped_tok_of_marker() { # $1 = acct dir
+  local line=""
+  [ -f "$1/.limited" ] && line="$(sed -n 2p "$1/.limited" 2>/dev/null)"
+  case "$line" in
+    *bucket=weekly_scoped:*) line="${line#*bucket=weekly_scoped:}"; printf '%s' "${line%% *}" ;;
+  esac
+}
+
+# Does a bucket scoped to model token $1 constrain THIS run?
+#   pinned to that model    -> yes; the caller asked for exactly it
+#   pinned to another model -> no
+#   unpinned                -> no, PROVIDED the fallback model escapes the bucket. The
+#                              pick path then pins that fallback before exec, so an
+#                              unpinned run never walks into the exhausted model.
+scoped_blocks_run() { # $1 = model token
+  local tok run fb
+  tok="$(sel_lc "$1")"
+  [ -n "$tok" ] || return 1
+  run="$(sel_lc "${RUN_MODEL:-}")"
+  if [ -n "$run" ]; then
+    case "$run" in *"$tok"*) return 0 ;; *) return 1 ;; esac
+  fi
+  fb="$(sel_lc "$FALLBACK_MODEL")"
+  case "$fb" in *"$tok"*) return 0 ;; esac    # nothing left to switch to
+  return 1
+}
+
+# Peak percent over the buckets that constrain THIS run — scoped buckets belonging to
+# other models are skipped. Prints nothing when the reading predates per-bucket
+# telemetry, so the caller falls back to the flat max_percent it used to trust.
+applicable_peak() { # $1 = acct dir
+  local f="$1/limits.json"
+  [ -f "$f" ] || return 1
+  LC_ALL=C tr '{},' '\n\n\n' < "$f" 2>/dev/null \
+    | LC_ALL=C awk -v run="$(sel_lc "${RUN_MODEL:-}")" -v fb="$(sel_lc "$FALLBACK_MODEL")" '
+    function applies(name,   tok) {
+      if (index(name, "weekly_scoped:") != 1) return 1
+      tok = substr(name, 15)
+      if (run != "") return index(run, tok) > 0
+      return index(fb, tok) > 0
+    }
+    /"name"[[:space:]]*:/ {
+      n = $0
+      sub(/.*"name"[[:space:]]*:[[:space:]]*"/, "", n); sub(/".*/, "", n)
+      name = tolower(n); next
+    }
+    /"percent"[[:space:]]*:/ {
+      p = $0
+      sub(/.*"percent"[[:space:]]*:[[:space:]]*/, "", p); sub(/[^0-9].*/, "", p)
+      if (p != "") { seen = 1; if (applies(name) && p + 0 > best) best = p + 0 }
+      next
+    }
+    END { if (seen) print best + 0 }
+  '
+}
+
+# The model token of a scoped bucket that is itself at/over the threshold ("" when
+# none) — what the pick path needs to know to pin the fallback for an unpinned run.
+scoped_over_tok() { # $1 = acct dir
+  local f="$1/limits.json"
+  [ -f "$f" ] || return 0
+  LC_ALL=C tr '{},' '\n\n\n' < "$f" 2>/dev/null \
+    | LC_ALL=C awk -v thr="${CLAUDE_MULTIACC_THRESHOLD:-90}" '
+    /"name"[[:space:]]*:/ {
+      n = $0
+      sub(/.*"name"[[:space:]]*:[[:space:]]*"/, "", n); sub(/".*/, "", n)
+      name = n; next
+    }
+    /"percent"[[:space:]]*:/ {
+      p = $0
+      sub(/.*"percent"[[:space:]]*:[[:space:]]*/, "", p); sub(/[^0-9].*/, "", p)
+      if (p != "" && p + 0 >= thr + 0 && index(tolower(name), "weekly_scoped:") == 1) {
+        print substr(name, 15); exit
+      }
+      next
+    }
+  '
+}
+
 marker_active() { # true if $1/.limited is still in force; clears cleanly-expired markers
-  local m="$1/.limited" reset=""
+  local m="$1/.limited" reset="" tok
   [ -f "$m" ] || return 1
   IFS= read -r reset < "$m" 2>/dev/null || reset=""
   if ! num_ok "$reset"; then
@@ -174,6 +285,11 @@ marker_active() { # true if $1/.limited is still in force; clears cleanly-expire
     rm -f "$m" 2>/dev/null
     return 1
   fi
+  # A park scoped to ONE model does not stop a run that will use another one.
+  tok="$(scoped_tok_of_marker "$1")"
+  if [ -n "$tok" ] && ! scoped_blocks_run "$tok"; then
+    return 1
+  fi
   return 0
 }
 
@@ -305,10 +421,15 @@ limited_percent_of() { # $1 acct dir -> the marked bucket's percent, or -1 (unkn
 # fallback lives on, because "degraded service beats a hard failure" only holds
 # for an account that can actually serve.
 limited_hard_blocked() { # $1 acct dir
-  local m="$1/.limited" line="" p
+  local m="$1/.limited" line="" p tok
   if [ -f "$m" ]; then
     line="$(sed -n 2p "$m" 2>/dev/null)"
     case "$line" in *reason=client-rate-limit*|*reason=error-cooldown*) return 0 ;; esac
+    # Exhausted for ONE model is not exhausted for the model this run will use.
+    tok="$(scoped_tok_of_marker "$1")"
+    if [ -n "$tok" ] && ! scoped_blocks_run "$tok"; then
+      return 1
+    fi
     p="$(limited_percent_of "$1")"
     if [ "$p" -ge 0 ] 2>/dev/null; then
       [ "$p" -ge 100 ]
@@ -335,7 +456,12 @@ util_of() {
 # (fail open — telemetry must never invent exclusions).
 over_threshold() { # $1 = acct dir
   local v
-  v="$(cutoff_field "$1" max_percent)" || return 1
+  within_window "$1" "$EXCLUDE_STALE_AFTER" || return 1
+  # Buckets that constrain THIS run; a reading with no bucket list falls back to the
+  # flat peak, which is what this check always used.
+  v="$(applicable_peak "$1")"
+  [ -n "$v" ] || v="$(cutoff_field "$1" max_percent)" || return 1
+  num_ok "$v" || return 1
   [ "$v" -ge "${CLAUDE_MULTIACC_THRESHOLD:-90}" ]
 }
 
@@ -1083,6 +1209,22 @@ else
       fi
     done
     sel_log "all-limited fallback=$(basename "$PICK_DIR") all-exhausted resets_in=$((best_reset > now ? best_reset - now : 0))s"
+    # Every candidate rejects right now, so this pick WILL fail: say so on a terminal
+    # instead of letting the operator read the client's bare limit error as a bad
+    # choice by the pool (2026-08-29). Throttled, and never on a service's stderr.
+    if [ -t 2 ]; then
+      exn="$ACC_ROOT/.exhausted-notice"
+      exlast=0
+      [ -f "$exn" ] && exlast="$(file_mtime "$exn")"
+      if [ $((now - exlast)) -gt 600 ]; then
+        : 2>/dev/null > "$exn" || true
+        exextra=""
+        [ "${#expired[@]}" -gt 0 ] \
+          && exextra=" ${#expired[@]} further account(s) are unusable — see: claude-accounts expired."
+        printf 'claude-multiacc: every usable account is at a limit right now; %s frees up in %ds and was chosen for that.%s\n' \
+          "$(basename "$PICK_DIR")" "$((best_reset > now ? best_reset - now : 0))" "$exextra" >&2
+      fi
+    fi
   fi
   # Report the number this fallback ACTUALLY ranked on. Asking fresh_field here printed
   # `weekly=?%` even when the pick was made on a perfectly good stale reading, so anyone
@@ -1113,6 +1255,20 @@ if [ -n "$tok" ] && ! token_preflight "$pick" "$tok"; then
   fi
 fi
 unset CLAUDE_MULTIACC_PREFLIGHT_DEPTH
+
+# The picked account may be eligible only because its exhausted bucket belongs to a
+# model this run did not ask for. Handing it the default model anyway would open the
+# session on "You've reached your Fable 5 limit" — the exact failure this selection
+# path exists to avoid (operator, tmux 136) — so the fallback model is pinned once,
+# before exec. An explicit --model is never touched: such a run does not get here.
+if [ -z "$RUN_MODEL" ]; then
+  sel_tok="$(scoped_tok_of_marker "$pick")"
+  [ -n "$sel_tok" ] || sel_tok="$(scoped_over_tok "$pick")"
+  if [ -n "$sel_tok" ] && ! scoped_blocks_run "$sel_tok"; then
+    set -- --model "$FALLBACK_MODEL" "$@"
+    sel_log "$(basename "$pick") -> --model $FALLBACK_MODEL (its $sel_tok bucket is full)"
+  fi
+fi
 # Remember the pick so the NEXT run does not hand back the same account. An explicit
 # CLAUDE_ACCOUNT pin deliberately does not: a pin is a caller overriding selection,
 # not a turn in the rotation.

package/bin/claude-accounts

@@ -946,11 +946,14 @@ ceremony_debrief() { # $1 = capture file, $2 = redacted transcript to write; pri
   "$PYBIN" - "$1" "$2" <<'PYEOF'
 import os, re, sys
 raw = open(sys.argv[1], 'rb').read().decode('utf-8', 'ignore')
-txt = re.sub(r'\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)', '', raw)      # OSC (hyperlink payloads)
-txt = re.sub(r'\x1b\[[0-9;?]*[A-Za-z]', '', txt)                  # CSI (colour, cursor)
-txt = re.sub(r'\x1b[()][A-Z0-9]', '', txt).replace('\r', '\n')
-txt = re.sub(r'sk-ant-[A-Za-z0-9]+-[A-Za-z0-9_-]+', 'sk-ant-***', txt)
+txt = re.sub(r'\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)', '', raw)          # OSC (hyperlink payloads)
+txt = re.sub(r'\x1b\[[0-9;?<>=]*[A-Za-z]', '', txt)                   # CSI, private modes too ([>4m, [<u)
+txt = re.sub(r'\x1b[()][A-Z0-9]|\x1b[78=>]|[\x0e\x0f]', '', txt)      # charset, save/restore cursor, SI/SO
+txt = txt.replace('\r', '\n')
 lines = []
+flat = re.sub(r'\s+', '', txt)
+api_key = bool(re.search(r'sk-ant-api\d{2}-', flat)) and not re.search(r'sk-ant-oat\d{2}-', flat)
+txt = re.sub(r'sk-ant-[A-Za-z0-9]+-[A-Za-z0-9_-]+', 'sk-ant-***', txt)
 for ln in txt.splitlines():
     ln = ln.strip()
     if not ln or re.fullmatch(r'[\W_]+', ln):          # spinner frames, logo art
@@ -960,6 +963,12 @@ for ln in txt.splitlines():
     if lines and lines[-1] == ln:
         continue
     lines.append(ln)
+if api_key:
+    # Said LAST, so it is what the operator reads: the client minted an API key, not a
+    # subscription token — the browser session was signed into a Console org.
+    lines.append('the client minted an API KEY (sk-ant-api…), not a subscription setup-token: '
+                 'the browser session belongs to a Console / API-billing organization — sign in '
+                 'as the subscription account and try again')
 try:
     fd = os.open(sys.argv[2], os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
     with os.fdopen(fd, 'w') as f:
@@ -970,6 +979,35 @@ print(' | '.join(lines[-3:])[:400])
 PYEOF
 }
 
+# The token, out of the transcript. The client's renderer places WORDS with cursor
+# moves instead of spaces and can emit a long token as positioned, styled segments;
+# a narrow terminal wraps it. A raw-bytes grep therefore missed a perfectly good token
+# on 2026-08-29 ("no token captured" after "token created successfully"). Every
+# terminal escape is stripped first, and the token block the client prints (between
+# "Your OAuth token …:" and "Store this token securely") is joined across spaces and
+# line breaks before matching, so neither placement nor wrapping can split it. The
+# real inference in commit_ceremony_token then proves whatever came out.
+ceremony_extract() { # $1 = capture file -> the setup-token, or nothing
+  "$PYBIN" - "$1" <<'PYEOF'
+import re, sys
+raw = open(sys.argv[1], 'rb').read().decode('utf-8', 'ignore')
+txt = re.sub(r'\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)', '', raw)          # OSC (hyperlink payloads)
+txt = re.sub(r'\x1b\[[0-9;?<>=]*[A-Za-z]', '', txt)                   # CSI, private modes too ([>4m, [<u)
+txt = re.sub(r'\x1b[()][A-Z0-9]|\x1b[78=>]|[\x0e\x0f]', '', txt)      # charset, save/restore cursor, SI/SO
+pat = re.compile(r'sk-ant-oat\d{2}-[A-Za-z0-9_-]{40,}')
+cands = []
+for m in re.finditer(r'Your\s*OAuth\s*token[^\n]{0,80}?:', txt):
+    block = txt[m.end(): m.end() + 4000]
+    stop = re.search(r'Store\s*this\s*token', block)
+    if stop:
+        block = block[: stop.start()]
+    cands += pat.findall(re.sub(r'\s+', '', block))
+cands += pat.findall(txt)
+cands += pat.findall(re.sub(r'[ \t]+', '', txt))
+print(max(cands, key=len) if cands else '')
+PYEOF
+}
+
 CEREMONY_TOKEN=""
 run_token_ceremony() { # $1 = config dir
   CEREMONY_TOKEN=""
@@ -1009,17 +1047,22 @@ TIP
     # Headless (tests / piped code): capture into the 0600 file only. Never tee the
     # raw token to stdout — a redirected run would write the secret to a plain log.
     CLAUDE_CONFIG_DIR="$d" CLAUDE_SHIM_ACTIVE=1 "$real" setup-token > "$cap" 2>&1
-    sed -E 's/sk-ant-oat[0-9]{2}-[A-Za-z0-9_-]*/sk-ant-oat**-<redacted>/g' "$cap"
+    # Every credential shape, not just setup-tokens: a Console session mints an API key.
+    sed -E 's/sk-ant-[A-Za-z0-9]+-[A-Za-z0-9_-]*/sk-ant-***-<redacted>/g' "$cap"
   fi
   umask "$old_umask"
-  # The LONGEST match, not the last: a TUI repaints its frame many times, and a
-  # frame rendered while the terminal was still narrow holds a wrapped fragment.
-  CEREMONY_TOKEN="$(grep -aoE 'sk-ant-oat[0-9]{2}-[A-Za-z0-9_-]{40,}' "$cap" \
-    | awk '{ if (length($0) > length(best)) best = $0 } END { if (best != "") print best }')"
+  CEREMONY_TOKEN="$(ceremony_extract "$cap" 2>/dev/null)"
   if [ -z "$CEREMONY_TOKEN" ]; then
-    CEREMONY_TRANSCRIPT="$ACC_ROOT/tmp/mint-failed.$(date -u +%Y%m%dT%H%M%SZ).log"
+    local stamp rawkeep
+    stamp="$(date -u +%Y%m%dT%H%M%SZ)"
+    CEREMONY_TRANSCRIPT="$ACC_ROOT/tmp/mint-failed.$stamp.log"
+    rawkeep="$ACC_ROOT/tmp/mint-failed.$stamp.raw"
     CEREMONY_LAST_WORDS="$(ceremony_debrief "$cap" "$CEREMONY_TRANSCRIPT" 2>/dev/null)"
     [ -s "$CEREMONY_TRANSCRIPT" ] || CEREMONY_TRANSCRIPT=""
+    # The raw bytes are the only record of what the renderer actually emitted, and may
+    # hold a token this extractor did not recognise: kept 0600 beside the pool, like
+    # the tokens themselves, so the next unknown shape can be read instead of guessed.
+    ( umask 077; cp "$cap" "$rawkeep" ) 2>/dev/null || true
     rm -f "$cap"
     [ -n "$CEREMONY_LAST_WORDS" ] && warn "the sign-in ended without a token — the client said: $CEREMONY_LAST_WORDS"
     [ -n "$CEREMONY_TRANSCRIPT" ] && warn "redacted transcript kept at $CEREMONY_TRANSCRIPT"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-multiacc",
-  "version": "2.0.14",
+  "version": "2.0.16",
   "description": "Unified Claude Code and OpenAI Codex subscription pooling with quota-aware selection.",
   "type": "module",
   "bin": {

package/tests/run-tests.sh

@@ -75,16 +75,29 @@ if [ "${1:-}" = "setup-token" ]; then
   echo "Open this sign-in link: https://claude.ai/oauth/authorize?fake=1"
   [ -n "${FAKE_TOKEN_FAIL:-}" ] && { echo "${FAKE_TOKEN_FAIL_MSG:-sign-in aborted}" >&2; exit 1; }
   if [ -n "${FAKE_TOKEN_FULL:-}" ]; then
-    # The real client's shape: a 108-character token that the TUI HARD-WRAPS at the
-    # terminal's width — an unsized pty (0 columns) renders as 80, and a 79-character
-    # first line is exactly what every panel mint of 2026-08-28 saved.
+    # The real client's shape (2.1.251): a success line, the token on its own line
+    # between "Your OAuth token …:" and "Store this token securely", 108 characters.
+    # The renderer HARD-WRAPS it at the terminal's width (an unsized pty renders as 80
+    # — the 79-character first line every panel mint of 2026-08-28 saved), and even at
+    # 400 columns emits it as cursor-positioned, styled segments (my-mini, 2026-08-29).
     tok="sk-ant-oat01-$(printf '%66s' '' | tr ' ' W)$(printf '%23s' '' | tr ' ' T)TAILOK"
     cols="$(stty size 2>/dev/null | awk '{print $2}')"
-    if [ -n "${FAKE_TOKEN_WRAP:-}" ] || { [ -n "$cols" ] && [ "$cols" -lt 108 ]; }; then
+    printf 'Long-lived authentication token created successfully!\n'
+    printf 'Your\033[5GOAuth\033[11Gtoken\033[17G(valid\033[24Gfor\033[28G1\033[30Gyear):\n'
+    if [ -n "${FAKE_TOKEN_SPLIT:-}" ]; then
+      printf '\033[2G%s\033[38;5;246m\033[15G%s\033[39m\033[60G%s\033[0m\r\n' "${tok:0:13}" "${tok:13:45}" "${tok:58}"
+    elif [ -n "${FAKE_TOKEN_WRAP:-}" ] || { [ -n "$cols" ] && [ "$cols" -lt 108 ]; }; then
       printf ' %s\n%s\n' "${tok:0:79}" "${tok:79}"
     else
       printf ' %s\n' "$tok"
     fi
+    printf 'Store\033[7Gthis\033[12Gtoken\033[18Gsecurely.\n'
+    exit 0
+  fi
+  if [ -n "${FAKE_TOKEN_APIKEY:-}" ]; then
+    # A browser session signed into a Console (API-billing) org: the client mints an
+    # API key, which is not a subscription token and must not be saved.
+    printf 'Your OAuth token (valid for 1 year):\nsk-ant-api03-%s\nStore this token securely.\n' "$(printf '%80s' '' | tr ' ' K)"
     exit 0
   fi
   echo "Your token: sk-ant-oat01-FAKEFAKEFAKEFAKEFAKEFAKEFAKEFAKEFAKEFAKEFAKE"
@@ -408,7 +421,8 @@ check "pinned dead-credential account still runs under its token" "TOK=sk-ant-oa
 rm -rf "$ACC/acct-07"
 
 # ---- 7. limited marker excludes account ------------------------------------
-printf '%s\nbucket=weekly_scoped:Fable percent=95 reason=limits\n' "$((now+3600))" > "$ACC/acct-01/.limited"
+# (An account-wide bucket. A MODEL-SCOPED one deliberately does not exclude — 9a4.)
+printf '%s\nbucket=session percent=95 reason=limits\n' "$((now+3600))" > "$ACC/acct-01/.limited"
 all2=1
 for _ in $(seq 1 15); do
   out="$(claude 2>&1)"
@@ -441,7 +455,7 @@ rm -f "$ACC/acct-01/.limited" "$ACC/acct-02/.limited"
 # acct-02: session at 100% — far better weekly (7%), but every request bounces until
 # the reset. Ranking on headroom alone handed out the guaranteed rejection
 # (operator report 2026-08-29: "claude keeps starting on an out-of-limits account").
-printf '%s\nbucket=weekly_scoped:Fable percent=99 marked_at=x reason=limits\n' "$((now+3600))" > "$ACC/acct-01/.limited"
+printf '%s\nbucket=weekly_all percent=99 marked_at=x reason=limits\n' "$((now+3600))" > "$ACC/acct-01/.limited"
 printf '%s\nbucket=session percent=100 marked_at=x reason=limits\n' "$((now+600))" > "$ACC/acct-02/.limited"
 printf '{"fetched_at":%s,"max_percent":99,"weekly_percent":99,"session_percent":10,"buckets":[]}' "$now" > "$ACC/acct-01/limits.json"
 printf '{"fetched_at":%s,"max_percent":100,"weekly_percent":7,"session_percent":100,"buckets":[]}' "$now" > "$ACC/acct-02/limits.json"
@@ -518,6 +532,58 @@ for f in server.token .credentials.json .expired .server-token-verified limits.j
   [ -e "$WORK/bak01/$f" ] && cp -p "$WORK/bak01/$f" "$ACC/acct-01/$f"
 done
 
+# ---- 9a4. a MODEL-scoped limit does not park the whole account ----------------------
+# "weekly_scoped:Fable at 100%" says the account cannot serve Fable — nothing more. It
+# used to park the account outright (and max_percent re-excluded it anyway), so on
+# 2026-08-29 three accounts sitting at Fable 100% with their session buckets at 51/23/25%
+# were invisible to selection, the pool offered nothing, and the fallback handed out a
+# session-exhausted account that rejected the operator's first request.
+rm -rf "$WORK/bak94"; mkdir -p "$WORK/bak94"
+for a in acct-01 acct-02; do
+  for f in .limited limits.json; do
+    [ -e "$ACC/$a/$f" ] && cp -p "$ACC/$a/$f" "$WORK/bak94/$a.$f"
+  done
+done
+# acct-01: only its Fable bucket is spent. acct-02: session spent — dead for every model.
+printf '%s\nbucket=weekly_scoped:Fable percent=100 marked_at=x reason=limits\n' "$((now+3600))" > "$ACC/acct-01/.limited"
+printf '{"fetched_at":%s,"max_percent":100,"weekly_percent":100,"session_percent":12,"buckets":[{"name":"session","percent":12},{"name":"weekly_all","percent":40},{"name":"weekly_scoped:Fable","percent":100}]}' "$now" > "$ACC/acct-01/limits.json"
+printf '%s\nbucket=session percent=100 marked_at=x reason=limits\n' "$((now+600))" > "$ACC/acct-02/.limited"
+printf '{"fetched_at":%s,"max_percent":100,"weekly_percent":30,"session_percent":100,"buckets":[{"name":"session","percent":100},{"name":"weekly_all","percent":30}]}' "$now" > "$ACC/acct-02/limits.json"
+out="$(claude 2>&1)"
+check "a Fable-only park still serves an unpinned run" "CFG=acct-01" "$out"
+check "...and that run is pinned to the fallback model up front" "ARGS=--model claude-opus-5" "$out"
+grep -q 'acct-01 -> --model claude-opus-5 (its Fable bucket is full)' "$ACC/selection.log" \
+  && t_ok "the model pin is logged with its reason" || t_fail "model pin log" "no line in selection.log"
+# A run that ASKS for the exhausted model must not be sent to that account.
+out="$(claude --model claude-fable-5 2>&1)"
+check "a run pinning the exhausted model does not get that account" "CFG=acct-02" "$out"
+# A run that pins another model uses it as-is — never pinned twice.
+out="$(claude --model claude-opus-5 2>&1)"
+check "a run pinning another model gets the Fable-spent account" "CFG=acct-01" "$out"
+case "$out" in
+  *"--model claude-opus-5 --model"*) t_fail "an explicit model is not pinned twice" "double --model" ;;
+  *) t_ok "an explicit model is not pinned twice" ;;
+esac
+# The >=90% cutoff reads the same way: no marker at all, Fable spent in telemetry only.
+rm -f "$ACC/acct-01/.limited"
+out="$(claude 2>&1)"
+check "the cutoff ignores a scoped bucket the run will not use" "CFG=acct-01" "$out"
+out="$(claude --model claude-fable-5 2>&1)"
+check "the cutoff still excludes it for the model that IS spent" "CFG=acct-02" "$out"
+# A reading with no bucket list keeps the old flat behaviour (fail closed at >=90%),
+# with a plainly healthy neighbour so nothing but that exclusion decides the pick.
+printf '{"fetched_at":%s,"max_percent":97,"weekly_percent":97,"session_percent":97}' "$now" > "$ACC/acct-01/limits.json"
+rm -f "$ACC/acct-02/.limited"
+printf '{"fetched_at":%s,"max_percent":20,"weekly_percent":20,"session_percent":20,"buckets":[{"name":"session","percent":20},{"name":"weekly_all","percent":20}]}' "$now" > "$ACC/acct-02/limits.json"
+out="$(claude 2>&1)"
+check "a bucket-less reading still excludes at the flat peak" "CFG=acct-02" "$out"
+for a in acct-01 acct-02; do
+  rm -f "$ACC/$a/.limited" "$ACC/$a/limits.json"
+  for f in .limited limits.json; do
+    [ -e "$WORK/bak94/$a.$f" ] && cp -p "$WORK/bak94/$a.$f" "$ACC/$a/$f"
+  done
+done
+
 # ---- 9b. codex-review regressions: auth/marker/threshold hardening -------------
 # empty .credentials.json must NOT count as auth (interrupted write)
 mkdir -p "$ACC/acct-06"
@@ -1383,25 +1449,54 @@ rows = {a["id"]: a for a in json.load(sys.stdin)["accounts"]}
 print(rows["acct-04"].get("token_verified"))')"
 [ "$out" = "True" ] && t_ok "list --json reports the token as verified here" \
   || t_fail "list --json token_verified" "expected True, got: $out"
-# The 2026-08-28 shape: the client's TUI wrapped the 108-character token at 80 columns
-# and only its 79-character first line was captured. Claude rejects the fragment; the
-# mint must refuse to save it and say WHY (seven fleet-wide 401s were the old answer).
+# The 2026-08-28 shape: the client's TUI wrapped the 108-character token at 80 columns.
+# The token block is joined across the break, so the capture is WHOLE — and proven.
 orig="$(cat "$ACC/acct-04/server.token")"
 out="$(FAKE_TOKEN_FULL=1 FAKE_TOKEN_WRAP=1 claude-accounts mint acct-04 2>&1 </dev/null)"
 rc=$?
-[ "$rc" != "0" ] && t_ok "a wrapped (79-char) token capture is refused" || t_fail "wrapped token rc" "rc=0"
-check "the refusal names the truncation" "79 characters" "$out"
-check "the refusal names the cause" "terminal wrapped it" "$out"
-[ "$(cat "$ACC/acct-04/server.token")" = "$orig" ] && t_ok "a refused capture leaves the old token in place" \
-  || t_fail "refused capture" "server.token was overwritten"
-# An INCONCLUSIVE probe (the API is busy) must not let a wrapped capture through as
-# merely "unverified": its length alone convicts it, and that is the exact token the
-# fleet then rejects on every Mac.
-out="$(FAKE_TOKEN_FULL=1 FAKE_TOKEN_WRAP=1 FAKE_PROBE_FLAKY=1 claude-accounts mint acct-04 2>&1 </dev/null)"
+[ "$rc" = "0" ] && t_ok "a wrapped token is reassembled from the transcript" || t_fail "wrapped token rc" "rc=$rc: $(printf '%s' "$out" | tail -c 200)"
+case "$(tr -d '[:space:]' < "$ACC/acct-04/server.token")" in
+  *TAILOK) [ "$(tr -d '[:space:]' < "$ACC/acct-04/server.token" | wc -c | tr -d ' ')" = "108" ] \
+    && t_ok "the reassembled token is the complete one" || t_fail "reassembled token" "wrong length" ;;
+  *) t_fail "reassembled token" "tail missing" ;;
+esac
+printf '%s' "$orig" > "$ACC/acct-04/server.token"; rm -f "$ACC/acct-04/.server-token-verified"
+# The 2026-08-29 shape: at 400 columns the renderer emits the token as cursor-positioned,
+# styled segments — a raw-bytes grep saw no token at all right after "token created
+# successfully". Stripped and joined, it is whole.
+out="$(FAKE_TOKEN_FULL=1 FAKE_TOKEN_SPLIT=1 claude-accounts mint acct-04 2>&1 </dev/null)"
+rc=$?
+[ "$rc" = "0" ] && t_ok "a token the renderer split into positioned segments is captured" \
+  || t_fail "split token rc" "rc=$rc: $(printf '%s' "$out" | tail -c 200)"
+case "$(tr -d '[:space:]' < "$ACC/acct-04/server.token")" in
+  sk-ant-oat01-WWW*TAILOK) t_ok "the split token was joined correctly" ;;
+  *) t_fail "split token" "unexpected content" ;;
+esac
+[ -f "$ACC/acct-04/.server-token-verified" ] && t_ok "the joined token was proven by a real call" \
+  || t_fail "split token proof" "marker missing"
+printf '%s' "$orig" > "$ACC/acct-04/server.token"; rm -f "$ACC/acct-04/.server-token-verified"
+# A browser session on a Console (API-billing) org: the client mints an API KEY. Not a
+# subscription token — refused, with the cause named and the raw capture kept.
+before_raw="$(ls "$ACC"/tmp/mint-failed.*.raw 2>/dev/null | wc -l | tr -d ' ')"
+out="$(FAKE_TOKEN_APIKEY=1 claude-accounts mint acct-04 2>&1 </dev/null)"
+rc=$?
+[ "$rc" != "0" ] && t_ok "an API key minted by a Console session is refused" || t_fail "apikey rc" "rc=0"
+check "the API-key refusal names the cause" "API KEY" "$out"
+check "the API-key refusal points at the org" "Console" "$out"
+case "$out" in *sk-ant-api03-K*) t_fail "the API key never reaches the operator's screen" "leaked" ;; *) t_ok "the API key never reaches the operator's screen" ;; esac
+[ "$(cat "$ACC/acct-04/server.token")" = "$orig" ] && t_ok "an API key is never saved as the token" \
+  || t_fail "apikey save" "server.token was overwritten"
+[ "$(ls "$ACC"/tmp/mint-failed.*.raw 2>/dev/null | wc -l | tr -d ' ')" -gt "$before_raw" ] \
+  && t_ok "the raw capture is kept for a closer look" || t_fail "raw capture" "no .raw kept"
+[ "$(python3 -c 'import os, sys; print(oct(os.stat(sys.argv[1]).st_mode & 0o777))' "$(ls -t "$ACC"/tmp/mint-failed.*.raw | head -1)")" = "0o600" ] \
+  && t_ok "the raw capture is private" || t_fail "raw capture mode" "not 0600"
+# A 79-character FRAGMENT that really is all there is (a paste from a narrow terminal)
+# with a probe that cannot decide: refused, and it says why.
+out="$(printf 'sk-ant-oat01-%s' "$(printf '%66s' '' | tr ' ' W)" | FAKE_PROBE_FLAKY=1 claude-accounts mint acct-04 --paste 2>&1)"
 rc=$?
-[ "$rc" != "0" ] && t_ok "a wrapped capture is refused even when the probe is inconclusive" \
-  || t_fail "wrapped+inconclusive rc" "rc=0"
-check "the inconclusive refusal still names the cause" "terminal wrapped it" "$out"
+[ "$rc" != "0" ] && t_ok "a bare fragment is refused even when the probe is inconclusive" \
+  || t_fail "fragment+inconclusive rc" "rc=0"
+check "the fragment refusal names the truncation" "79 characters" "$out"
 [ "$(cat "$ACC/acct-04/server.token")" = "$orig" ] && t_ok "an unproven fragment saves nothing" \
   || t_fail "unproven fragment" "server.token was overwritten"
 # …while a COMPLETE token the probe cannot reach right now is saved as UNVERIFIED — the
@@ -4710,7 +4805,7 @@ out="$(CLAUDE_ACCOUNTS_DIR="$KCP" claude-accounts list 2>&1)"
 check "keychain login shown in the plain list" "auth=keychain" "$out"
 
 # 17b. the shim runs under a keychain-only account (file account parked by a limit)
-printf '%s\nbucket=weekly_scoped:Fable percent=95 reason=limits\n' "$((now+3600))" > "$KCP/acct-01/.limited"
+printf '%s\nbucket=session percent=95 reason=limits\n' "$((now+3600))" > "$KCP/acct-01/.limited"
 out="$(CLAUDE_ACCOUNTS_DIR="$KCP" claude 2>&1)"
 check "shim selects the keychain-only account" "CFG=acct-02" "$out"