claude-multiacc 2.0.15 → 2.0.17

package/bin/claude

@@ -160,8 +160,119 @@ sel_log() {
   printf '%s %s\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$*" 2>/dev/null >> "$ACC_ROOT/selection.log" || true
 }
 
+# ---- model-scoped limits ------------------------------------------------------
+# A usage bucket can be scoped to ONE MODEL ("weekly_scoped:Fable"), and such a bucket
+# says nothing about the account's ability to serve a DIFFERENT model. The limits
+# refresher parks the whole account for it all the same, and the >=90% cutoff reads the
+# peak across every bucket — so on 2026-08-29 acct-02/06/07 sat at Fable 100% with their
+# session buckets at 51/23/25%, were excluded from every selection, and a pool of eleven
+# accounts offered nothing usable: the all-limited fallback handed out a
+# session-exhausted account that rejected the operator's very first request. The retry
+# layer already knew a scoped limit means "switch model, not account" (MODEL_LIMITPAT
+# below); selection has to know it too.
+FALLBACK_MODEL="${CLAUDE_MULTIACC_FALLBACK_MODEL:-claude-opus-5}"
+
+# The model THIS invocation asks for ("" when it pins none), read from the caller's own
+# argv: an explicit --model is never second-guessed, so an account whose Fable bucket is
+# full stays genuinely unusable for `--model claude-fable-5`.
+RUN_MODEL=""
+_sel_next_is_model=0
+for _sel_arg in "$@"; do
+  if [ "$_sel_next_is_model" = 1 ]; then
+    RUN_MODEL="$_sel_arg"; _sel_next_is_model=0; continue
+  fi
+  case "$_sel_arg" in
+    --model) _sel_next_is_model=1 ;;
+    --model=*) RUN_MODEL="${_sel_arg#--model=}" ;;
+  esac
+done
+unset _sel_arg _sel_next_is_model
+
+sel_lc() { printf '%s' "${1:-}" | LC_ALL=C tr 'A-Z' 'a-z'; }
+
+# The model token a `.limited` marker is scoped to ("Fable"); empty when the marker is
+# not model-scoped (session, weekly_all, client:…).
+scoped_tok_of_marker() { # $1 = acct dir
+  local line=""
+  [ -f "$1/.limited" ] && line="$(sed -n 2p "$1/.limited" 2>/dev/null)"
+  case "$line" in
+    *bucket=weekly_scoped:*) line="${line#*bucket=weekly_scoped:}"; printf '%s' "${line%% *}" ;;
+  esac
+}
+
+# Does a bucket scoped to model token $1 constrain THIS run?
+#   pinned to that model    -> yes; the caller asked for exactly it
+#   pinned to another model -> no
+#   unpinned                -> no, PROVIDED the fallback model escapes the bucket. The
+#                              pick path then pins that fallback before exec, so an
+#                              unpinned run never walks into the exhausted model.
+scoped_blocks_run() { # $1 = model token
+  local tok run fb
+  tok="$(sel_lc "$1")"
+  [ -n "$tok" ] || return 1
+  run="$(sel_lc "${RUN_MODEL:-}")"
+  if [ -n "$run" ]; then
+    case "$run" in *"$tok"*) return 0 ;; *) return 1 ;; esac
+  fi
+  fb="$(sel_lc "$FALLBACK_MODEL")"
+  case "$fb" in *"$tok"*) return 0 ;; esac    # nothing left to switch to
+  return 1
+}
+
+# Peak percent over the buckets that constrain THIS run — scoped buckets belonging to
+# other models are skipped. Prints nothing when the reading predates per-bucket
+# telemetry, so the caller falls back to the flat max_percent it used to trust.
+applicable_peak() { # $1 = acct dir
+  local f="$1/limits.json"
+  [ -f "$f" ] || return 1
+  LC_ALL=C tr '{},' '\n\n\n' < "$f" 2>/dev/null \
+    | LC_ALL=C awk -v run="$(sel_lc "${RUN_MODEL:-}")" -v fb="$(sel_lc "$FALLBACK_MODEL")" '
+    function applies(name,   tok) {
+      if (index(name, "weekly_scoped:") != 1) return 1
+      tok = substr(name, 15)
+      if (run != "") return index(run, tok) > 0
+      return index(fb, tok) > 0
+    }
+    /"name"[[:space:]]*:/ {
+      n = $0
+      sub(/.*"name"[[:space:]]*:[[:space:]]*"/, "", n); sub(/".*/, "", n)
+      name = tolower(n); next
+    }
+    /"percent"[[:space:]]*:/ {
+      p = $0
+      sub(/.*"percent"[[:space:]]*:[[:space:]]*/, "", p); sub(/[^0-9].*/, "", p)
+      if (p != "") { seen = 1; if (applies(name) && p + 0 > best) best = p + 0 }
+      next
+    }
+    END { if (seen) print best + 0 }
+  '
+}
+
+# The model token of a scoped bucket that is itself at/over the threshold ("" when
+# none) — what the pick path needs to know to pin the fallback for an unpinned run.
+scoped_over_tok() { # $1 = acct dir
+  local f="$1/limits.json"
+  [ -f "$f" ] || return 0
+  LC_ALL=C tr '{},' '\n\n\n' < "$f" 2>/dev/null \
+    | LC_ALL=C awk -v thr="${CLAUDE_MULTIACC_THRESHOLD:-90}" '
+    /"name"[[:space:]]*:/ {
+      n = $0
+      sub(/.*"name"[[:space:]]*:[[:space:]]*"/, "", n); sub(/".*/, "", n)
+      name = n; next
+    }
+    /"percent"[[:space:]]*:/ {
+      p = $0
+      sub(/.*"percent"[[:space:]]*:[[:space:]]*/, "", p); sub(/[^0-9].*/, "", p)
+      if (p != "" && p + 0 >= thr + 0 && index(tolower(name), "weekly_scoped:") == 1) {
+        print substr(name, 15); exit
+      }
+      next
+    }
+  '
+}
+
 marker_active() { # true if $1/.limited is still in force; clears cleanly-expired markers
-  local m="$1/.limited" reset=""
+  local m="$1/.limited" reset="" tok
   [ -f "$m" ] || return 1
   IFS= read -r reset < "$m" 2>/dev/null || reset=""
   if ! num_ok "$reset"; then
@@ -174,6 +285,11 @@ marker_active() { # true if $1/.limited is still in force; clears cleanly-expire
     rm -f "$m" 2>/dev/null
     return 1
   fi
+  # A park scoped to ONE model does not stop a run that will use another one.
+  tok="$(scoped_tok_of_marker "$1")"
+  if [ -n "$tok" ] && ! scoped_blocks_run "$tok"; then
+    return 1
+  fi
   return 0
 }
 
@@ -305,10 +421,15 @@ limited_percent_of() { # $1 acct dir -> the marked bucket's percent, or -1 (unkn
 # fallback lives on, because "degraded service beats a hard failure" only holds
 # for an account that can actually serve.
 limited_hard_blocked() { # $1 acct dir
-  local m="$1/.limited" line="" p
+  local m="$1/.limited" line="" p tok
   if [ -f "$m" ]; then
     line="$(sed -n 2p "$m" 2>/dev/null)"
     case "$line" in *reason=client-rate-limit*|*reason=error-cooldown*) return 0 ;; esac
+    # Exhausted for ONE model is not exhausted for the model this run will use.
+    tok="$(scoped_tok_of_marker "$1")"
+    if [ -n "$tok" ] && ! scoped_blocks_run "$tok"; then
+      return 1
+    fi
     p="$(limited_percent_of "$1")"
     if [ "$p" -ge 0 ] 2>/dev/null; then
       [ "$p" -ge 100 ]
@@ -335,7 +456,12 @@ util_of() {
 # (fail open — telemetry must never invent exclusions).
 over_threshold() { # $1 = acct dir
   local v
-  v="$(cutoff_field "$1" max_percent)" || return 1
+  within_window "$1" "$EXCLUDE_STALE_AFTER" || return 1
+  # Buckets that constrain THIS run; a reading with no bucket list falls back to the
+  # flat peak, which is what this check always used.
+  v="$(applicable_peak "$1")"
+  [ -n "$v" ] || v="$(cutoff_field "$1" max_percent)" || return 1
+  num_ok "$v" || return 1
   [ "$v" -ge "${CLAUDE_MULTIACC_THRESHOLD:-90}" ]
 }
 
@@ -1083,6 +1209,22 @@ else
       fi
     done
     sel_log "all-limited fallback=$(basename "$PICK_DIR") all-exhausted resets_in=$((best_reset > now ? best_reset - now : 0))s"
+    # Every candidate rejects right now, so this pick WILL fail: say so on a terminal
+    # instead of letting the operator read the client's bare limit error as a bad
+    # choice by the pool (2026-08-29). Throttled, and never on a service's stderr.
+    if [ -t 2 ]; then
+      exn="$ACC_ROOT/.exhausted-notice"
+      exlast=0
+      [ -f "$exn" ] && exlast="$(file_mtime "$exn")"
+      if [ $((now - exlast)) -gt 600 ]; then
+        : 2>/dev/null > "$exn" || true
+        exextra=""
+        [ "${#expired[@]}" -gt 0 ] \
+          && exextra=" ${#expired[@]} further account(s) are unusable — see: claude-accounts expired."
+        printf 'claude-multiacc: every usable account is at a limit right now; %s frees up in %ds and was chosen for that.%s\n' \
+          "$(basename "$PICK_DIR")" "$((best_reset > now ? best_reset - now : 0))" "$exextra" >&2
+      fi
+    fi
   fi
   # Report the number this fallback ACTUALLY ranked on. Asking fresh_field here printed
   # `weekly=?%` even when the pick was made on a perfectly good stale reading, so anyone
@@ -1113,6 +1255,20 @@ if [ -n "$tok" ] && ! token_preflight "$pick" "$tok"; then
   fi
 fi
 unset CLAUDE_MULTIACC_PREFLIGHT_DEPTH
+
+# The picked account may be eligible only because its exhausted bucket belongs to a
+# model this run did not ask for. Handing it the default model anyway would open the
+# session on "You've reached your Fable 5 limit" — the exact failure this selection
+# path exists to avoid (operator, tmux 136) — so the fallback model is pinned once,
+# before exec. An explicit --model is never touched: such a run does not get here.
+if [ -z "$RUN_MODEL" ]; then
+  sel_tok="$(scoped_tok_of_marker "$pick")"
+  [ -n "$sel_tok" ] || sel_tok="$(scoped_over_tok "$pick")"
+  if [ -n "$sel_tok" ] && ! scoped_blocks_run "$sel_tok"; then
+    set -- --model "$FALLBACK_MODEL" "$@"
+    sel_log "$(basename "$pick") -> --model $FALLBACK_MODEL (its $sel_tok bucket is full)"
+  fi
+fi
 # Remember the pick so the NEXT run does not hand back the same account. An explicit
 # CLAUDE_ACCOUNT pin deliberately does not: a pin is a caller overriding selection,
 # not a turn in the rotation.

package/bin/claude-accounts

@@ -943,69 +943,18 @@ commit_ceremony_token() {
 CEREMONY_LAST_WORDS=""
 CEREMONY_TRANSCRIPT=""
 ceremony_debrief() { # $1 = capture file, $2 = redacted transcript to write; prints the last words
-  "$PYBIN" - "$1" "$2" <<'PYEOF'
-import os, re, sys
-raw = open(sys.argv[1], 'rb').read().decode('utf-8', 'ignore')
-txt = re.sub(r'\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)', '', raw)          # OSC (hyperlink payloads)
-txt = re.sub(r'\x1b\[[0-9;?<>=]*[A-Za-z]', '', txt)                   # CSI, private modes too ([>4m, [<u)
-txt = re.sub(r'\x1b[()][A-Z0-9]|\x1b[78=>]|[\x0e\x0f]', '', txt)      # charset, save/restore cursor, SI/SO
-txt = txt.replace('\r', '\n')
-lines = []
-flat = re.sub(r'\s+', '', txt)
-api_key = bool(re.search(r'sk-ant-api\d{2}-', flat)) and not re.search(r'sk-ant-oat\d{2}-', flat)
-txt = re.sub(r'sk-ant-[A-Za-z0-9]+-[A-Za-z0-9_-]+', 'sk-ant-***', txt)
-for ln in txt.splitlines():
-    ln = ln.strip()
-    if not ln or re.fullmatch(r'[\W_]+', ln):          # spinner frames, logo art
-        continue
-    if 'https://' in ln or re.search(r'Paste\s*code\s*here', ln):   # the sign-in link, the paste prompt
-        continue
-    if lines and lines[-1] == ln:
-        continue
-    lines.append(ln)
-if api_key:
-    # Said LAST, so it is what the operator reads: the client minted an API key, not a
-    # subscription token — the browser session was signed into a Console org.
-    lines.append('the client minted an API KEY (sk-ant-api…), not a subscription setup-token: '
-                 'the browser session belongs to a Console / API-billing organization — sign in '
-                 'as the subscription account and try again')
-try:
-    fd = os.open(sys.argv[2], os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
-    with os.fdopen(fd, 'w') as f:
-        f.write('\n'.join(lines) + '\n')
-except OSError:
-    pass
-print(' | '.join(lines[-3:])[:400])
-PYEOF
+  "$PYBIN" "$LIB_DIR/ceremony.py" debrief "$1" "$2" 2>/dev/null
 }
 
-# The token, out of the transcript. The client's renderer places WORDS with cursor
-# moves instead of spaces and can emit a long token as positioned, styled segments;
-# a narrow terminal wraps it. A raw-bytes grep therefore missed a perfectly good token
-# on 2026-08-29 ("no token captured" after "token created successfully"). Every
-# terminal escape is stripped first, and the token block the client prints (between
-# "Your OAuth token …:" and "Store this token securely") is joined across spaces and
-# line breaks before matching, so neither placement nor wrapping can split it. The
-# real inference in commit_ceremony_token then proves whatever came out.
+# The token, out of the transcript. `claude setup-token` is a TUI: its renderer places
+# words with absolute cursor moves, so the bytes are terminal OPERATIONS and the token
+# exists only in the RENDERED result. Stripping escapes reassembles it wrongly — a
+# `sk-ant-\x1b[10Gat01-…` stream loses the `o` and three mints failed as "no token
+# captured" seconds after the client said the token was created (2026-08-29). lib/
+# ceremony.py replays the transcript onto a virtual screen and reads what the operator
+# saw; the real inference in commit_ceremony_token then proves whatever came out.
 ceremony_extract() { # $1 = capture file -> the setup-token, or nothing
-  "$PYBIN" - "$1" <<'PYEOF'
-import re, sys
-raw = open(sys.argv[1], 'rb').read().decode('utf-8', 'ignore')
-txt = re.sub(r'\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)', '', raw)          # OSC (hyperlink payloads)
-txt = re.sub(r'\x1b\[[0-9;?<>=]*[A-Za-z]', '', txt)                   # CSI, private modes too ([>4m, [<u)
-txt = re.sub(r'\x1b[()][A-Z0-9]|\x1b[78=>]|[\x0e\x0f]', '', txt)      # charset, save/restore cursor, SI/SO
-pat = re.compile(r'sk-ant-oat\d{2}-[A-Za-z0-9_-]{40,}')
-cands = []
-for m in re.finditer(r'Your\s*OAuth\s*token[^\n]{0,80}?:', txt):
-    block = txt[m.end(): m.end() + 4000]
-    stop = re.search(r'Store\s*this\s*token', block)
-    if stop:
-        block = block[: stop.start()]
-    cands += pat.findall(re.sub(r'\s+', '', block))
-cands += pat.findall(txt)
-cands += pat.findall(re.sub(r'[ \t]+', '', txt))
-print(max(cands, key=len) if cands else '')
-PYEOF
+  "$PYBIN" "$LIB_DIR/ceremony.py" extract "$1" 2>/dev/null
 }
 
 CEREMONY_TOKEN=""

package/lib/ceremony.py

@@ -0,0 +1,193 @@
+"""Read what the sign-in ceremony actually PUT ON THE SCREEN.
+
+`claude setup-token` is a TUI. Its renderer places words with absolute cursor
+moves rather than spaces, so the bytes it emits are terminal OPERATIONS, not
+text: on 2026-08-29 a perfectly good token arrived as
+
+    sk-ant-\x1b[10Gat01-w_C6…
+
+Stripping the escapes yields `sk-ant-at01-…` — the sequence's own final byte ate
+the token's `o` — and no amount of whitespace-joining puts it back. Three mints
+failed as "no token captured" seconds after the client printed
+"✓ Long-lived authentication token created successfully!".
+
+So the transcript is REPLAYED onto a virtual screen and the result is read, which
+is by definition what the operator saw. Only the handful of sequences this TUI
+uses are honoured; everything else is skipped, and any byte that would move the
+cursor off-screen is clamped rather than trusted.
+
+Run directly:  ceremony.py extract <capture>          -> the setup-token, or nothing
+               ceremony.py debrief <capture> <out>    -> last words; writes a
+                                                         redacted transcript (0600)
+"""
+
+import os
+import re
+import sys
+
+TOKEN = re.compile(r'sk-ant-oat\d{2}-[A-Za-z0-9_-]{40,}')
+ANY_CRED = re.compile(r'sk-ant-[A-Za-z0-9]+-[A-Za-z0-9_-]+')
+API_KEY = re.compile(r'sk-ant-api\d{2}-')
+_CSI = re.compile(r'\x1b\[([0-9;?<>=]*)([@-~])')
+_CHARSET = re.compile(r'\x1b[()][A-Z0-9]|\x1b[78=>]')
+# A screen this TUI could never legitimately need; a corrupt stream must not make
+# the renderer allocate without bound.
+MAX_ROWS = 2000
+MAX_COLS = 4000
+
+
+def render(raw):
+    """The transcript's final screen, as a list of lines."""
+    rows, cur, col = [[]], 0, 0
+
+    def put(ch):
+        nonlocal col
+        if cur >= MAX_ROWS or col >= MAX_COLS:
+            return
+        while len(rows) <= cur:
+            rows.append([])
+        row = rows[cur]
+        while len(row) <= col:
+            row.append(' ')
+        row[col] = ch
+        col += 1
+
+    i, n = 0, len(raw)
+    while i < n:
+        ch = raw[i]
+        if ch == '\x1b':
+            if raw.startswith('\x1b]', i):                 # OSC … BEL | ST
+                bel, st = raw.find('\x07', i), raw.find('\x1b\\', i)
+                ends = [x for x in ((bel, 1), (st, 2)) if x[0] != -1]
+                i = min(ends)[0] + min(ends)[1] if ends else n
+                continue
+            m = _CSI.match(raw, i)
+            if m:
+                params, fin = m.group(1), m.group(2)
+                nums = [int(p) for p in params.split(';') if p.isdigit()]
+                a = nums[0] if nums else 1
+                if fin == 'G':
+                    col = min(max(0, a - 1), MAX_COLS)
+                elif fin == 'C':
+                    col = min(col + a, MAX_COLS)
+                elif fin == 'D':
+                    col = max(0, col - a)
+                elif fin == 'A':
+                    cur = max(0, cur - a)
+                elif fin == 'B':
+                    cur = min(cur + a, MAX_ROWS)
+                elif fin == 'H':
+                    cur = min(max(0, a - 1), MAX_ROWS)
+                    col = min(max(0, (nums[1] if len(nums) > 1 else 1) - 1), MAX_COLS)
+                elif fin == 'K':
+                    while len(rows) <= cur:
+                        rows.append([])
+                    if params.startswith('2'):
+                        rows[cur] = []
+                    elif not params or params == '0':
+                        rows[cur] = rows[cur][:col]
+                elif fin == 'J' and params.startswith('2'):
+                    rows, cur, col = [[]], 0, 0
+                i = m.end()
+                continue
+            m = _CHARSET.match(raw, i)
+            i = m.end() if m else i + 1
+            continue
+        if ch == '\r':
+            col = 0
+        elif ch == '\n':
+            cur = min(cur + 1, MAX_ROWS)
+            col = 0
+        elif ord(ch) >= 32:
+            put(ch)
+        i += 1
+    return [''.join(r).rstrip() for r in rows]
+
+
+# The block the client prints the token inside. Joining WITHIN it is what survives a
+# terminal narrow enough to wrap the token across rows, without gluing the token to
+# whatever the next paragraph happens to say.
+_BLOCK_START = re.compile(r'Your\s*OAuth\s*token[^\n]{0,80}?:')
+_BLOCK_END = re.compile(r'Store\s*this\s*token')
+
+
+def extract_token(raw):
+    """The setup-token the ceremony printed, or ''.
+
+    Every reading is a candidate and the LONGEST wins, because the two shapes fail
+    each other's method: a token painted out of order is whole only on the rendered
+    line, while one the terminal wrapped is whole only across rows. A per-line match
+    on a wrapped token returns its first 79 characters — exactly the truncation this
+    whole path exists to prevent — so the joined reading has to compete with it.
+    """
+    lines = render(raw)
+    text = '\n'.join(lines)
+    cands = [m.group(0) for ln in lines for m in [TOKEN.search(ln)] if m]
+    for m in _BLOCK_START.finditer(text):
+        block = text[m.end(): m.end() + 4000]
+        stop = _BLOCK_END.search(block)
+        if stop:
+            block = block[: stop.start()]
+        cands += TOKEN.findall(re.sub(r'\s+', '', block))
+    if not cands:                                    # a TUI this renderer misreads
+        flat = _CSI.sub('', _CHARSET.sub('', raw))
+        cands = TOKEN.findall(flat) + TOKEN.findall(re.sub(r'\s+', '', flat))
+    return max(cands, key=len) if cands else ''
+
+
+def debrief(raw):
+    """(readable lines, api_key_minted). The screen the operator was left looking
+    at, with every credential-shaped string masked."""
+    api_key = False
+    for ln in render(raw):
+        if API_KEY.search(ln):
+            api_key = True
+    if extract_token(raw):
+        api_key = False
+    lines = []
+    for ln in render(raw):
+        ln = ANY_CRED.sub('sk-ant-***', ln).strip()
+        if not ln or re.fullmatch(r'[\W_]+', ln):        # spinner frames, logo art
+            continue
+        if 'https://' in ln or re.search(r'Paste\s*code\s*here', ln):
+            continue
+        if lines and lines[-1] == ln:
+            continue
+        lines.append(ln)
+    if api_key:
+        # Said LAST, so it is what the operator reads.
+        lines.append('the client minted an API KEY (sk-ant-api…), not a subscription '
+                     'setup-token: the browser session belongs to a Console / '
+                     'API-billing organization — sign in as the subscription account '
+                     'and try again')
+    return lines, api_key
+
+
+def _read(path):
+    with open(path, 'rb') as f:
+        return f.read().decode('utf-8', 'ignore')
+
+
+def main(argv):
+    if len(argv) < 2:
+        return 2
+    verb, path = argv[0], argv[1]
+    if verb == 'extract':
+        sys.stdout.write(extract_token(_read(path)))
+        return 0
+    if verb == 'debrief':
+        lines, _ = debrief(_read(path))
+        if len(argv) > 2:
+            try:
+                fd = os.open(argv[2], os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
+                with os.fdopen(fd, 'w') as f:
+                    f.write('\n'.join(lines) + '\n')
+            except OSError:
+                pass
+        print(' | '.join(lines[-3:])[:400])
+        return 0
+    return 2
+
+
+if __name__ == '__main__':
+    sys.exit(main(sys.argv[1:]))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-multiacc",
-  "version": "2.0.15",
+  "version": "2.0.17",
   "description": "Unified Claude Code and OpenAI Codex subscription pooling with quota-aware selection.",
   "type": "module",
   "bin": {

package/tests/run-tests.sh

@@ -94,6 +94,16 @@ if [ "${1:-}" = "setup-token" ]; then
     printf 'Store\033[7Gthis\033[12Gtoken\033[18Gsecurely.\n'
     exit 0
   fi
+  if [ -n "${FAKE_TOKEN_CURSOR:-}" ]; then
+    # The 2026-08-29 shape: the TUI paints the token OUT OF ORDER with absolute cursor
+    # moves, so the byte stream is `sk-ant-<ESC>[10Gat01-…` and escape-stripping loses
+    # the `o`. Only replaying the transcript onto a screen recovers it.
+    tok="sk-ant-oat01-$(printf '%66s' '' | tr ' ' W)$(printf '%23s' '' | tr ' ' T)TAILOK"
+    printf ' Your\033[6GOAuth\033[12Gtoken\033[18G(valid\033[25Gfor\033[29G1\033[31Gyear):\n'
+    printf ' %s\033[10G%s\033[9G%s\n' "${tok:0:7}" "${tok:8}" "${tok:7:1}"
+    printf ' Store\033[7Gthis\033[12Gtoken\033[18Gsecurely.\n'
+    exit 0
+  fi
   if [ -n "${FAKE_TOKEN_APIKEY:-}" ]; then
     # A browser session signed into a Console (API-billing) org: the client mints an
     # API key, which is not a subscription token and must not be saved.
@@ -421,7 +431,8 @@ check "pinned dead-credential account still runs under its token" "TOK=sk-ant-oa
 rm -rf "$ACC/acct-07"
 
 # ---- 7. limited marker excludes account ------------------------------------
-printf '%s\nbucket=weekly_scoped:Fable percent=95 reason=limits\n' "$((now+3600))" > "$ACC/acct-01/.limited"
+# (An account-wide bucket. A MODEL-SCOPED one deliberately does not exclude — 9a4.)
+printf '%s\nbucket=session percent=95 reason=limits\n' "$((now+3600))" > "$ACC/acct-01/.limited"
 all2=1
 for _ in $(seq 1 15); do
   out="$(claude 2>&1)"
@@ -454,7 +465,7 @@ rm -f "$ACC/acct-01/.limited" "$ACC/acct-02/.limited"
 # acct-02: session at 100% — far better weekly (7%), but every request bounces until
 # the reset. Ranking on headroom alone handed out the guaranteed rejection
 # (operator report 2026-08-29: "claude keeps starting on an out-of-limits account").
-printf '%s\nbucket=weekly_scoped:Fable percent=99 marked_at=x reason=limits\n' "$((now+3600))" > "$ACC/acct-01/.limited"
+printf '%s\nbucket=weekly_all percent=99 marked_at=x reason=limits\n' "$((now+3600))" > "$ACC/acct-01/.limited"
 printf '%s\nbucket=session percent=100 marked_at=x reason=limits\n' "$((now+600))" > "$ACC/acct-02/.limited"
 printf '{"fetched_at":%s,"max_percent":99,"weekly_percent":99,"session_percent":10,"buckets":[]}' "$now" > "$ACC/acct-01/limits.json"
 printf '{"fetched_at":%s,"max_percent":100,"weekly_percent":7,"session_percent":100,"buckets":[]}' "$now" > "$ACC/acct-02/limits.json"
@@ -531,6 +542,58 @@ for f in server.token .credentials.json .expired .server-token-verified limits.j
   [ -e "$WORK/bak01/$f" ] && cp -p "$WORK/bak01/$f" "$ACC/acct-01/$f"
 done
 
+# ---- 9a4. a MODEL-scoped limit does not park the whole account ----------------------
+# "weekly_scoped:Fable at 100%" says the account cannot serve Fable — nothing more. It
+# used to park the account outright (and max_percent re-excluded it anyway), so on
+# 2026-08-29 three accounts sitting at Fable 100% with their session buckets at 51/23/25%
+# were invisible to selection, the pool offered nothing, and the fallback handed out a
+# session-exhausted account that rejected the operator's first request.
+rm -rf "$WORK/bak94"; mkdir -p "$WORK/bak94"
+for a in acct-01 acct-02; do
+  for f in .limited limits.json; do
+    [ -e "$ACC/$a/$f" ] && cp -p "$ACC/$a/$f" "$WORK/bak94/$a.$f"
+  done
+done
+# acct-01: only its Fable bucket is spent. acct-02: session spent — dead for every model.
+printf '%s\nbucket=weekly_scoped:Fable percent=100 marked_at=x reason=limits\n' "$((now+3600))" > "$ACC/acct-01/.limited"
+printf '{"fetched_at":%s,"max_percent":100,"weekly_percent":100,"session_percent":12,"buckets":[{"name":"session","percent":12},{"name":"weekly_all","percent":40},{"name":"weekly_scoped:Fable","percent":100}]}' "$now" > "$ACC/acct-01/limits.json"
+printf '%s\nbucket=session percent=100 marked_at=x reason=limits\n' "$((now+600))" > "$ACC/acct-02/.limited"
+printf '{"fetched_at":%s,"max_percent":100,"weekly_percent":30,"session_percent":100,"buckets":[{"name":"session","percent":100},{"name":"weekly_all","percent":30}]}' "$now" > "$ACC/acct-02/limits.json"
+out="$(claude 2>&1)"
+check "a Fable-only park still serves an unpinned run" "CFG=acct-01" "$out"
+check "...and that run is pinned to the fallback model up front" "ARGS=--model claude-opus-5" "$out"
+grep -q 'acct-01 -> --model claude-opus-5 (its Fable bucket is full)' "$ACC/selection.log" \
+  && t_ok "the model pin is logged with its reason" || t_fail "model pin log" "no line in selection.log"
+# A run that ASKS for the exhausted model must not be sent to that account.
+out="$(claude --model claude-fable-5 2>&1)"
+check "a run pinning the exhausted model does not get that account" "CFG=acct-02" "$out"
+# A run that pins another model uses it as-is — never pinned twice.
+out="$(claude --model claude-opus-5 2>&1)"
+check "a run pinning another model gets the Fable-spent account" "CFG=acct-01" "$out"
+case "$out" in
+  *"--model claude-opus-5 --model"*) t_fail "an explicit model is not pinned twice" "double --model" ;;
+  *) t_ok "an explicit model is not pinned twice" ;;
+esac
+# The >=90% cutoff reads the same way: no marker at all, Fable spent in telemetry only.
+rm -f "$ACC/acct-01/.limited"
+out="$(claude 2>&1)"
+check "the cutoff ignores a scoped bucket the run will not use" "CFG=acct-01" "$out"
+out="$(claude --model claude-fable-5 2>&1)"
+check "the cutoff still excludes it for the model that IS spent" "CFG=acct-02" "$out"
+# A reading with no bucket list keeps the old flat behaviour (fail closed at >=90%),
+# with a plainly healthy neighbour so nothing but that exclusion decides the pick.
+printf '{"fetched_at":%s,"max_percent":97,"weekly_percent":97,"session_percent":97}' "$now" > "$ACC/acct-01/limits.json"
+rm -f "$ACC/acct-02/.limited"
+printf '{"fetched_at":%s,"max_percent":20,"weekly_percent":20,"session_percent":20,"buckets":[{"name":"session","percent":20},{"name":"weekly_all","percent":20}]}' "$now" > "$ACC/acct-02/limits.json"
+out="$(claude 2>&1)"
+check "a bucket-less reading still excludes at the flat peak" "CFG=acct-02" "$out"
+for a in acct-01 acct-02; do
+  rm -f "$ACC/$a/.limited" "$ACC/$a/limits.json"
+  for f in .limited limits.json; do
+    [ -e "$WORK/bak94/$a.$f" ] && cp -p "$WORK/bak94/$a.$f" "$ACC/$a/$f"
+  done
+done
+
 # ---- 9b. codex-review regressions: auth/marker/threshold hardening -------------
 # empty .credentials.json must NOT count as auth (interrupted write)
 mkdir -p "$ACC/acct-06"
@@ -1422,6 +1485,28 @@ esac
 [ -f "$ACC/acct-04/.server-token-verified" ] && t_ok "the joined token was proven by a real call" \
   || t_fail "split token proof" "marker missing"
 printf '%s' "$orig" > "$ACC/acct-04/server.token"; rm -f "$ACC/acct-04/.server-token-verified"
+# The token painted OUT OF ORDER with absolute cursor moves — the shape that made three
+# real mints fail as "no token captured" right after "token created successfully".
+out="$(FAKE_TOKEN_CURSOR=1 claude-accounts mint acct-04 2>&1 </dev/null)"
+rc=$?
+[ "$rc" = "0" ] && t_ok "a cursor-painted token is read off the rendered screen" \
+  || t_fail "cursor-painted mint rc" "rc=$rc: $(printf '%s' "$out" | tail -c 220)"
+case "$(tr -d '[:space:]' < "$ACC/acct-04/server.token")" in
+  sk-ant-oat01-WWW*TAILOK) [ "$(tr -d '[:space:]' < "$ACC/acct-04/server.token" | wc -c | tr -d ' ')" = "108" ] \
+    && t_ok "the rendered token is complete and in order" || t_fail "rendered token" "wrong length" ;;
+  *) t_fail "rendered token" "wrong content — escape-stripping order bug" ;;
+esac
+printf '%s' "$orig" > "$ACC/acct-04/server.token"; rm -f "$ACC/acct-04/.server-token-verified"
+# The renderer itself, on the exact byte pattern from the field.
+printf ' sk-ant-\033[10Gat01-%s\033[9Go\n' "$(printf '%95s' '' | tr ' ' Z)" > "$WORK/painted.raw"
+n="$(python3 "$REPO_DIR/lib/ceremony.py" extract "$WORK/painted.raw" | wc -c | tr -d ' ')"
+[ "$n" = "108" ] && t_ok "ceremony.py renders a cursor-painted token whole" \
+  || t_fail "ceremony.py extract" "got $n characters, expected 108"
+# ...and the debrief reads as prose, not as words jammed together by the stripping.
+printf ' Store\033[8Gthis\033[13Gtoken\033[19Gsecurely.\n' > "$WORK/prose.raw"
+out="$(python3 "$REPO_DIR/lib/ceremony.py" debrief "$WORK/prose.raw" "$WORK/prose.out")"
+check "the debrief renders readable words" "Store this token securely." "$out"
+
 # A browser session on a Console (API-billing) org: the client mints an API KEY. Not a
 # subscription token — refused, with the cause named and the raw capture kept.
 before_raw="$(ls "$ACC"/tmp/mint-failed.*.raw 2>/dev/null | wc -l | tr -d ' ')"
@@ -4752,7 +4837,7 @@ out="$(CLAUDE_ACCOUNTS_DIR="$KCP" claude-accounts list 2>&1)"
 check "keychain login shown in the plain list" "auth=keychain" "$out"
 
 # 17b. the shim runs under a keychain-only account (file account parked by a limit)
-printf '%s\nbucket=weekly_scoped:Fable percent=95 reason=limits\n' "$((now+3600))" > "$KCP/acct-01/.limited"
+printf '%s\nbucket=session percent=95 reason=limits\n' "$((now+3600))" > "$KCP/acct-01/.limited"
 out="$(CLAUDE_ACCOUNTS_DIR="$KCP" claude 2>&1)"
 check "shim selects the keychain-only account" "CFG=acct-02" "$out"