claude-multiacc 2.0.18 → 2.0.20

package/README.md

@@ -72,12 +72,12 @@ repo bin/ first on PATH (rc-file block)    /root/claude-multiacc/  (addon repo)
 4. Among the accounts that remain valid **on this machine** (an OAuth login —
    `.credentials.json`, or a macOS Keychain item this session can open — or a
    `server.token` that passes its first inference preflight) and not limit-excluded,
-   pick the one with the **most remaining
-   headroom** (see below). On equal headroom the pool **rotates away from the account it
-   just handed out** and samples the rest at random — so quitting a session and starting
-   another one moves you along the pool, while a burst of parallel `claude -p` runs still
-   spreads (a strict "oldest first" order would send every member of the burst to the same
-   account). `CLAUDE_SHIM_SELECT=random` restores plain uniform-random selection.
+   form a **30-percentage-point weekly-headroom band** around the account with the most
+   remaining headroom (see below). The pool **rotates away from the account it just handed
+   out** and samples the other accounts in that band at random. This prevents one nominally
+   emptiest account from taking every launch while near-peers idle, while accounts more than
+   30 points behind remain protected. `CLAUDE_MULTIACC_HEADROOM_BAND=0` restores strict
+   best-headroom selection; `CLAUDE_SHIM_SELECT=random` uses the whole eligible pool.
 5. If every account is limit-excluded → the highest-headroom *authenticable* account
    anyway + a warning in `selection.log` (degraded beats down: the 100% rule).
 6. If nothing is usable at all → stock passthrough, with the reason in `selection.log`
@@ -88,11 +88,12 @@ Fable request consumes at once: the 5-hour **session** bucket, the **weekly all-
 bucket, and the **weekly Fable** bucket. Anthropic's docs confirm these reset on very
 different horizons — the session bucket refills every ~5 hours, but weekly buckets only
 refill on the account's fixed weekly reset (days away). So the picker ranks primarily on
-**weekly headroom** (the peak of the durable buckets) and uses the self-healing session
-bucket only as a tiebreaker. An account sitting at 85% session / 10% weekly outranks one
-at 20% session / 70% weekly: the first only needs a few hours to recover, the second is
-burning headroom that's gone until next week. (`score = weekly% × 1000 + session%`,
-lowest wins.) **Exclusion** still fires on *any* bucket ≥ 90% — a full session bucket
+**weekly headroom** (the peak of the durable buckets) to form the 30-point band. Accounts
+inside that band are deliberately treated as peers and spread randomly; with a zero-width
+band the self-healing session bucket is the tiebreaker. An account at 10% weekly remains
+protected from one at 70% weekly because the latter is outside the band. (`score = weekly%
+× 1000 + session%` in strict mode, lowest wins.) **Exclusion** still fires on *any* bucket
+≥ 90% — a full session bucket
 really does block right now — but that marker expires when the session resets, not days
 later.
 

package/bin/claude

@@ -3,7 +3,7 @@
 # Every invocation runs under a randomly picked subscription account with limit headroom.
 # Self-contained on purpose: no sourcing, so a broken repo file can never break `claude`.
 # Selection: CLAUDE_CONFIG_DIR/CLAUDE_CODE_OAUTH_TOKEN passthrough > CLAUDE_ACCOUNT pin >
-# random among limit-eligible accounts > least-utilized fallback (degraded beats down).
+# random within the 30-point headroom band > least-utilized fallback (degraded beats down).
 # Accounts whose login is DEAD (expired refresh token, or a `.expired` marker from a
 # failed auth) are never selected — not even as the all-limited fallback — because they
 # fail every call outright; `claude-accounts expired` / `relogin` fix them.
@@ -271,6 +271,47 @@ scoped_over_tok() { # $1 = acct dir
   '
 }
 
+CLIENT_RECOVERY_FETCHED=0
+CLIENT_RECOVERY_PEAK=100
+client_marker_recovered() { # $1 account dir, $2 marker
+  local fetched peak delay marked mk cutoff ck newer=0
+  # A client rejection is stronger than an immediately-following usage read: that
+  # endpoint can lag or serve a cached bucket. It is not stronger forever. Once a
+  # successful, below-threshold reading was fetched at least five minutes after the
+  # marker, it is newer first-hand evidence that the account recovered (or that an
+  # old/shared transcript was attributed incorrectly). Keeping such a marker until its
+  # claimed reset stranded five 0%-usage accounts in the live pool on 2026-09-03.
+  if grep -q 'reason=client-rate-limit' "$2" 2>/dev/null; then
+    fetched="$(telem_fetched_at "$1" 2>/dev/null || echo 0)"
+    peak="$(cutoff_field "$1" max_percent 2>/dev/null || echo 100)"
+    delay="${CLAUDE_MULTIACC_CLIENT_LIMIT_CONFIRM_DELAY:-300}"
+    num_ok "$delay" || delay=300
+    [ "$delay" -gt 3600 ] && delay=3600
+    marked="$(LC_ALL=C sed -n 's/.*marked_at=\([^ ]*\).*/\1/p' "$2" 2>/dev/null | head -1)"
+    mk="$(iso_key "$marked")"
+    cutoff=0
+    if num_ok "$fetched" && [ "$fetched" -ge "$delay" ]; then
+      cutoff=$((fetched - delay))
+    fi
+    ck="$(iso_key "$(iso_of_epoch "$cutoff")")"
+    # Sync and atomic copies change mtimes, so prefer the marker's semantic timestamp.
+    # Old marker formats fall back to mtime until the next writer upgrades them.
+    if num_ok "$mk" && [ "${#mk}" -eq 14 ] && num_ok "$ck"; then
+      [ "$mk" -le "$ck" ] && newer=1
+    elif num_ok "$fetched" \
+      && [ "$(file_mtime "$2")" -le "$((fetched - delay))" ]; then
+      newer=1
+    fi
+    if [ "$newer" = 1 ] && num_ok "$peak" \
+      && [ "$peak" -lt "${CLAUDE_MULTIACC_THRESHOLD:-90}" ]; then
+      CLIENT_RECOVERY_FETCHED="$fetched"
+      CLIENT_RECOVERY_PEAK="$peak"
+      return 0
+    fi
+  fi
+  return 1
+}
+
 marker_active() { # true if $1/.limited is still in force; clears cleanly-expired markers
   local m="$1/.limited" reset="" tok
   [ -f "$m" ] || return 1
@@ -285,6 +326,14 @@ marker_active() { # true if $1/.limited is still in force; clears cleanly-expire
     rm -f "$m" 2>/dev/null
     return 1
   fi
+  if client_marker_recovered "$1" "$m"; then
+    printf '%s\n' "$CLIENT_RECOVERY_FETCHED" > "$1/.client-limit-cleared.$$" 2>/dev/null \
+      && mv -f "$1/.client-limit-cleared.$$" "$1/.client-limit-cleared" 2>/dev/null \
+      || rm -f "$1/.client-limit-cleared.$$" 2>/dev/null
+    rm -f "$m" 2>/dev/null
+    sel_log "$(basename "$1") client limit cleared by newer telemetry (${CLIENT_RECOVERY_PEAK}%)"
+    return 1
+  fi
   # A park scoped to ONE model does not stop a run that will use another one.
   tok="$(scoped_tok_of_marker "$1")"
   if [ -n "$tok" ] && ! scoped_blocks_run "$tok"; then
@@ -396,6 +445,23 @@ sel_score_of() { # $1 = acct dir
   printf '%s\n' $((w * 1000 + s))
 }
 
+# The direct shims use the same 30-point headroom band as pool-selection.v2. Strict
+# best-headroom selection burned one account to its limit while equally healthy
+# neighbours idled. A caller can set 0 to restore strict ranking.
+HEADROOM_BAND="${CLAUDE_MULTIACC_HEADROOM_BAND:-30}"
+case "$HEADROOM_BAND" in ''|*[!0-9]*|??????*) HEADROOM_BAND=30 ;; esac
+[ "$HEADROOM_BAND" -gt 100 ] && HEADROOM_BAND=100
+
+rank_weekly_of() { # $1 = acct dir -> comparable weekly use, or fail when unknown
+  local w
+  if w="$(fresh_field "$1" weekly_percent)" || w="$(fresh_field "$1" max_percent)"; then
+    printf '%s\n' "$w"
+    return 0
+  fi
+  [ "$SEL_DEGRADED" = 1 ] || return 1
+  stale_weekly "$1"
+}
+
 # The .limited marker's own fields (line 1: reset epoch; line 2: "bucket=…
 # percent=… … reason=…"). All tolerant: an unreadable or bare marker answers
 # "unknown", never an error — these feed the all-limited fallback only.
@@ -621,14 +687,14 @@ sess_transcript() { # $1 acct dir, $2 session id
 }
 
 # Newest still-in-force rejection this account's own sessions recorded.
-# Prints "<reset-epoch> <rateLimitType>"; fails when there is none.
+# Prints "<reset-epoch> <rateLimitType> <rejection-ISO>"; fails when there is none.
 # This runs on EVERY invocation, so it is bounded on purpose: newest session first,
 # stop at the first in-force rejection, and never read more than QUOTA_SCAN_MAX_FILES
 # transcripts. Missing an older rejection costs nothing — a limit that is still in force
 # rejects the very next request too, and that lands in a newer transcript.
 client_limit_scan() { # $1 acct dir
   local idx="$1/.sessions-index" memo="$1/.client-scan" id p line r t read_n=0 i last=""
-  local ln claim ts ck ak ttl
+  local ln claim ts ck ak ttl cleared sk
   local ids=() claims=()
   [ "${CLAUDE_MULTIACC_CLIENT_LIMITS:-1}" = "0" ] && return 1
   [ -f "$idx" ] || return 1
@@ -672,12 +738,28 @@ client_limit_scan() { # $1 acct dir
       | tail -1)"
     [ -n "$line" ] || continue
     case "$line" in *'"status":"rejected"'*|*'"status": "rejected"'*) ;; *) continue ;; esac
+    # A later successful usage read below the threshold supersedes an older rejection.
+    # Without this watermark, clearing its marker achieved nothing: the next launch
+    # scanned the same transcript and recreated the same days-long park.
+    ts="$(printf '%s' "$line" | LC_ALL=C sed -n \
+      's/.*"timestamp"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p')"
+    ck="$(iso_key "$ts")"
+    cleared=""
+    [ -f "$1/.client-limit-cleared" ] \
+      && { IFS= read -r cleared < "$1/.client-limit-cleared" 2>/dev/null || cleared=""; }
+    if num_ok "$cleared"; then
+      sk="$(iso_key "$(iso_of_epoch "$cleared")")"
+      if num_ok "$ck" && num_ok "$sk"; then
+        [ "$ck" -le "$sk" ] && continue
+      elif [ "$(file_mtime "$p")" -le "$cleared" ]; then
+        continue
+      fi
+    fi
     # A rejection recorded BEFORE this account took the session over belongs to whoever
     # was running it then, not to us. Undatable => not attributed (fail open).
     if [ -n "$claim" ]; then
-      ts="$(printf '%s' "$line" | LC_ALL=C sed -n 's/.*"timestamp"[[:space:]]*:[[:space:]]*"\([0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]T[^"]*\)".*/\1/p')"
       [ -n "$ts" ] || continue
-      ck="$(iso_key "$ts")"; ak="$(iso_key "$claim")"
+      ak="$(iso_key "$claim")"
       num_ok "$ck" || continue
       num_ok "$ak" || continue
       [ "$ck" -lt "$ak" ] && continue
@@ -687,7 +769,7 @@ client_limit_scan() { # $1 acct dir
     num_ok "$r" || continue
     [ "$r" -gt "$now" ] || continue
     t="$(printf '%s' "$line" | LC_ALL=C sed -n 's/.*"rateLimitType"[[:space:]]*:[[:space:]]*"\([A-Za-z0-9_.-]*\)".*/\1/p')"
-    printf '%s %s\n' "$r" "${t:-unknown}"
+    printf '%s %s %s\n' "$r" "${t:-unknown}" "${ts:--}"
     return 0
   done
   printf '%s\n' "$now" 2>/dev/null > "$memo.$$" \
@@ -749,8 +831,8 @@ mark_client_auth_dead() { # $1 acct dir
   fi
 }
 
-mark_client_limit() { # $1 acct dir, $2 reset epoch, $3 rate limit type
-  local m="$1/.limited" cur=""
+mark_client_limit() { # $1 acct dir, $2 reset epoch, $3 rate limit type, $4 rejection ISO
+  local m="$1/.limited" cur="" marked="$4" mk
   # Never shorten a marker that already reaches further out (a weekly park must
   # survive a 5h report), and never rewrite the same one on every invocation.
   if [ -f "$m" ]; then
@@ -758,9 +840,13 @@ mark_client_limit() { # $1 acct dir, $2 reset epoch, $3 rate limit type
     num_ok "$cur" || cur=0
     [ "$cur" -ge "$2" ] && return 0
   fi
+  mk="$(iso_key "$marked")"
+  if ! num_ok "$mk" || [ "${#mk}" -ne 14 ]; then
+    marked="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+  fi
   {
     echo "$2"
-    echo "bucket=client:$3 percent=100 marked_at=$(date -u +%Y-%m-%dT%H:%M:%SZ) reason=client-rate-limit"
+    echo "bucket=client:$3 percent=100 marked_at=$marked reason=client-rate-limit"
   } 2>/dev/null > "$1/.limited.$$" \
     && mv -f "$1/.limited.$$" "$m" 2>/dev/null \
     || rm -f "$1/.limited.$$" 2>/dev/null || true
@@ -1023,7 +1109,11 @@ for d in "$ACC_ROOT"/acct-*; do
   # `claude-accounts status`, to a concurrent run in another terminal, and to sync.
   # The cost is bounded by the scan's own file budget and its clean-result memo.
   if lim="$(client_limit_scan "$d")"; then
-    mark_client_limit "$d" "${lim%% *}" "${lim##* }"
+    lim_reset="${lim%% *}"
+    lim_rest="${lim#* }"
+    lim_type="${lim_rest%% *}"
+    lim_marked="${lim_rest#* }"
+    mark_client_limit "$d" "$lim_reset" "$lim_type" "$lim_marked"
     continue
   fi
   over_threshold "$d" && continue
@@ -1092,44 +1182,53 @@ remember_pick() { # $1 acct dir — best effort. stderr is silenced BEFORE the r
 # user's claude arguments.
 PICK_DIR=""
 PICK_SCORE=""
+PICK_BAND_COUNT=0
+PICK_STRICT=0
 pick_best() { # args: candidate dirs
-  local d avoid best="" bestv=1000000 ties=0 i n
-  local cand=() score=()
+  local d w avoid best="" bestv=1000000 bestw=101 ceiling=100 ties=0 i n match
+  local cand=() score=() weekly=() known=() pool=()
   avoid="$(last_pick_id)"
   for d in "$@"; do
     cand+=("$d")
     score+=("$(sel_score_of "$d")")
+    if w="$(rank_weekly_of "$d")"; then weekly+=("$w"); known+=(1)
+    else weekly+=(100); known+=(0); fi
   done
   n=${#cand[@]}
   i=0
   while [ "$i" -lt "$n" ]; do
     [ "${score[$i]}" -lt "$bestv" ] && bestv="${score[$i]}"
+    [ "${known[$i]}" = 1 ] && [ "${weekly[$i]}" -lt "$bestw" ] && bestw="${weekly[$i]}"
     i=$((i + 1))
   done
-  # Reservoir-sample among the equally-best, skipping the account just handed out.
+  ceiling=$((bestw + HEADROOM_BAND)); [ "$ceiling" -gt 100 ] && ceiling=100
   i=0
   while [ "$i" -lt "$n" ]; do
-    if [ "${score[$i]}" -eq "$bestv" ] && [ "${cand[$i]##*/}" != "$avoid" ]; then
+    match=0
+    if [ "$PICK_STRICT" = 0 ] && [ "$HEADROOM_BAND" -gt 0 ] && [ "$bestw" -le 100 ]; then
+      [ "${known[$i]}" = 1 ] && [ "${weekly[$i]}" -le "$ceiling" ] && match=1
+    else
+      [ "${score[$i]}" -eq "$bestv" ] && match=1
+    fi
+    [ "$match" = 1 ] && pool+=("$i")
+    i=$((i + 1))
+  done
+  PICK_BAND_COUNT=${#pool[@]}
+  # Reservoir-sample inside the band, skipping the account just handed out.
+  for i in "${pool[@]}"; do
+    if [ "${cand[$i]##*/}" != "$avoid" ]; then
       ties=$((ties + 1))
       [ $((RANDOM % ties)) -eq 0 ] && best="${cand[$i]}"
     fi
-    i=$((i + 1))
   done
   if [ -z "$best" ]; then
-    # The only account at the best score IS the one just used — degraded rotation beats
-    # refusing to pick (and in a two-account pool this is the other half of the
-    # alternation).
-    i=0
-    while [ "$i" -lt "$n" ]; do
-      if [ "${score[$i]}" -eq "$bestv" ]; then
-        ties=$((ties + 1))
-        [ $((RANDOM % ties)) -eq 0 ] && best="${cand[$i]}"
-      fi
-      i=$((i + 1))
+    for i in "${pool[@]}"; do
+      ties=$((ties + 1))
+      [ $((RANDOM % ties)) -eq 0 ] && best="${cand[$i]}"
     done
   fi
   PICK_DIR="$best"
-  PICK_SCORE="$bestv"
+  PICK_SCORE="$(sel_score_of "$best")"
 }
 
 # Telemetry going stale is not a per-run detail, it is a pool-wide outage: with no
@@ -1173,6 +1272,7 @@ if [ "${#eligible[@]}" -gt 0 ]; then
   [ "$degraded" = 1 ] && SEL_DEGRADED=1
   if [ "${CLAUDE_SHIM_SELECT:-headroom}" = "random" ]; then
     PICK_DIR="${eligible[$((RANDOM % ${#eligible[@]}))]}"
+    PICK_BAND_COUNT=${#eligible[@]}
   else
     pick_best "${eligible[@]}"
   fi
@@ -1191,7 +1291,9 @@ else
   if [ "${#soft[@]}" -gt 0 ]; then
     assess_telemetry "${soft[@]}"
     [ "$degraded" = 1 ] && SEL_DEGRADED=1
+    PICK_STRICT=1
     pick_best "${soft[@]}"
+    PICK_STRICT=0
   else
     # Every account is exhausted RIGHT NOW: nothing serves, so hand out the one
     # that unblocks first — its rejection window is the shortest.
@@ -1300,9 +1402,12 @@ if [ "$blind" = 1 ]; then
   # DEGRADED still ranks, on old readings that remain true; BLIND cannot rank at all and
   # is a coin flip. Calling both of them "random" would send someone hunting the wrong bug.
   if [ "$degraded" = 1 ]; then
-    sel_log "$acct weekly=$(stale_weekly "$pick" || echo '?')% session=?% ranking=DEGRADED telemetry-age=${blind_age}s pwd=$PWD"
+    sel_log "$acct weekly=$(stale_weekly "$pick" || echo '?')% session=?%" \
+      "ranking=DEGRADED telemetry-age=${blind_age}s band=${HEADROOM_BAND}" \
+      "band-count=${PICK_BAND_COUNT} pwd=$PWD"
   else
-    sel_log "$acct weekly=?% session=?% ranking=BLIND telemetry-age=${blind_age}s pwd=$PWD"
+    sel_log "$acct weekly=?% session=?% ranking=BLIND telemetry-age=${blind_age}s" \
+      "band=${HEADROOM_BAND} band-count=${PICK_BAND_COUNT} pwd=$PWD"
   fi
   # Terminal only, at most hourly — a service-spawned `claude -p` must keep its stderr
   # byte-clean, and this is advice, never a failure.
@@ -1324,7 +1429,9 @@ if [ "$blind" = 1 ]; then
     fi
   fi
 else
-  sel_log "$acct weekly=$(fresh_field "$pick" weekly_percent || echo '?')% session=$(fresh_field "$pick" session_percent || echo '?')% pwd=$PWD"
+  sel_log "$acct weekly=$(fresh_field "$pick" weekly_percent || echo '?')%" \
+    "session=$(fresh_field "$pick" session_percent || echo '?')%" \
+    "band=${HEADROOM_BAND} band-count=${PICK_BAND_COUNT} pwd=$PWD"
 fi
 
 export CLAUDE_SHIM_ACTIVE=1

package/bin/claude-accounts

@@ -1520,6 +1520,14 @@ REFRESH_DENIED_BACKOFF = 21600  # 4xx = grant likely revoked: 6h; re-login neede
 # exactly which ceremony fixes it.
 USAGE_DENIED_BACKOFF = 21600
 USAGE_FAIL_BACKOFF = 900       # anything else non-2xx: 15 min, doubling to 30
+# A real client 429 beats an immediately-following usage response, which may be cached.
+# A later successful response under the threshold is newer first-hand evidence and must
+# release the account instead of preserving a false marker until a days-away reset.
+try:
+    CLIENT_LIMIT_CONFIRM_DELAY = max(
+        0, min(3600, int(os.environ.get('CLAUDE_MULTIACC_CLIENT_LIMIT_CONFIRM_DELAY', '300'))))
+except ValueError:
+    CLIENT_LIMIT_CONFIRM_DELAY = 300
 
 def say(msg):
     if not quiet:
@@ -2207,23 +2215,37 @@ for acct in manifest.get('accounts', []):
             # A shim-written marker outlives a clean limits pass while its own window
             # is still open:
             #   error-cooldown     — the account failed a real call moments ago.
-            #   client-rate-limit  — Claude Code itself was REJECTED on this account and
-            #                        recorded the reset the API handed it. That is
-            #                        first-hand evidence; a usage payload that disagrees
-            #                        (different bucket set, cached edge) must not unpark
-            #                        the account early and send work straight back into
-            #                        the 429.
+            #   client-rate-limit  — Claude Code itself was REJECTED on this account.
+            #                        Preserve that over a possibly-cached response during
+            #                        a short grace period. A later successful low-usage
+            #                        response disproves it; otherwise false/shared-session
+            #                        markers strand recovered accounts for days.
             keep = False
+            client_recovered = False
             try:
                 txt = open(mpath).read()
                 first = txt.splitlines()[0] if txt else ''
-                if ('reason=error-cooldown' in txt or 'reason=client-rate-limit' in txt) \
-                        and first.isdigit() and int(first) > now:
+                active = first.isdigit() and int(first) > now
+                marked_at = next((part[10:] for part in txt.split()
+                                  if part.startswith('marked_at=')), '')
+                marked_epoch = parse_iso(marked_at)
+                if marked_epoch is None:
+                    marked_epoch = os.path.getmtime(mpath)
+                recent_client = now - marked_epoch < CLIENT_LIMIT_CONFIRM_DELAY
+                client_recovered = active and 'reason=client-rate-limit' in txt \
+                    and not recent_client
+                if active and ('reason=error-cooldown' in txt
+                               or ('reason=client-rate-limit' in txt and recent_client)):
                     keep = True
             except Exception:
                 pass
             if not keep:
                 os.remove(mpath)
+                if client_recovered:
+                    cleared = os.path.join(d, '.client-limit-cleared')
+                    with open(cleared + '.tmp', 'w') as f:
+                        f.write(f'{int(now)}\n')
+                    os.replace(cleared + '.tmp', cleared)
                 say(f'{aid}: marker cleared (max {maxp}%)')
         if not quiet:
             detail = '  '.join(f"{b['name']}={b['percent']}%" for b in buckets)

package/bin/codex

@@ -3,8 +3,8 @@
 # Every invocation runs under a randomly picked ChatGPT subscription account with limit
 # headroom. Self-contained on purpose: no sourcing, so a broken repo file can never
 # break `codex`.
-# Selection: CODEX_HOME passthrough > CODEX_ACCOUNT pin > most-headroom among
-# limit-eligible accounts > least-utilized fallback (degraded beats down).
+# Selection: CODEX_HOME passthrough > CODEX_ACCOUNT pin > random among limit-eligible
+# accounts in the 30-point headroom band > least-utilized fallback (degraded beats down).
 # Accounts whose login is DEAD (a `.expired` marker from a failed refresh/verify/run)
 # are never selected — not even as the all-limited fallback — because they fail every
 # call outright; `codex-accounts expired` / `relogin` fix them.
@@ -154,6 +154,19 @@ sel_score_of() { # $1 = acct dir
   printf '%s\n' $((w * 1000 + s))
 }
 
+HEADROOM_BAND="${CODEX_MULTIACC_HEADROOM_BAND:-30}"
+case "$HEADROOM_BAND" in ''|*[!0-9]*|??????*) HEADROOM_BAND=30 ;; esac
+[ "$HEADROOM_BAND" -gt 100 ] && HEADROOM_BAND=100
+
+rank_weekly_of() { # $1 = acct dir -> comparable weekly use, or fail when unknown
+  local w
+  if w="$(fresh_field "$1" weekly_percent)" || w="$(fresh_field "$1" max_percent)"; then
+    printf '%s\n' "$w"
+    return 0
+  fi
+  return 1
+}
+
 # Backstop for a lost/failed marker write: fresh telemetry with ANY bucket at/over the
 # threshold excludes the account even if .limited is missing. Stale/unreadable => not
 # over (fail open — telemetry must never invent exclusions).
@@ -460,55 +473,66 @@ remember_pick() { # $1 acct dir — best effort. stderr is silenced BEFORE the r
 # user's codex arguments.
 PICK_DIR=""
 PICK_SCORE=""
+PICK_BAND_COUNT=0
+PICK_STRICT=0
 pick_best() { # args: candidate dirs
-  local d avoid best="" bestv=1000000 ties=0 i n
-  local cand=() score=()
+  local d w avoid best="" bestv=1000000 bestw=101 ceiling=100 ties=0 i n match
+  local cand=() score=() weekly=() known=() pool=()
   avoid="$(last_pick_id)"
   for d in "$@"; do
     cand+=("$d")
     score+=("$(sel_score_of "$d")")
+    if w="$(rank_weekly_of "$d")"; then weekly+=("$w"); known+=(1)
+    else weekly+=(100); known+=(0); fi
   done
   n=${#cand[@]}
   i=0
   while [ "$i" -lt "$n" ]; do
     [ "${score[$i]}" -lt "$bestv" ] && bestv="${score[$i]}"
+    [ "${known[$i]}" = 1 ] && [ "${weekly[$i]}" -lt "$bestw" ] && bestw="${weekly[$i]}"
     i=$((i + 1))
   done
-  # Reservoir-sample among the equally-best, skipping the account just handed out.
+  ceiling=$((bestw + HEADROOM_BAND)); [ "$ceiling" -gt 100 ] && ceiling=100
   i=0
   while [ "$i" -lt "$n" ]; do
-    if [ "${score[$i]}" -eq "$bestv" ] && [ "${cand[$i]##*/}" != "$avoid" ]; then
+    match=0
+    if [ "$PICK_STRICT" = 0 ] && [ "$HEADROOM_BAND" -gt 0 ] && [ "$bestw" -le 100 ]; then
+      [ "${known[$i]}" = 1 ] && [ "${weekly[$i]}" -le "$ceiling" ] && match=1
+    else
+      [ "${score[$i]}" -eq "$bestv" ] && match=1
+    fi
+    [ "$match" = 1 ] && pool+=("$i")
+    i=$((i + 1))
+  done
+  PICK_BAND_COUNT=${#pool[@]}
+  for i in "${pool[@]}"; do
+    if [ "${cand[$i]##*/}" != "$avoid" ]; then
       ties=$((ties + 1))
       [ $((RANDOM % ties)) -eq 0 ] && best="${cand[$i]}"
     fi
-    i=$((i + 1))
   done
   if [ -z "$best" ]; then
-    # The only account at the best score IS the one just used — degraded rotation beats
-    # refusing to pick (and in a two-account pool this is the other half of the
-    # alternation).
-    i=0
-    while [ "$i" -lt "$n" ]; do
-      if [ "${score[$i]}" -eq "$bestv" ]; then
-        ties=$((ties + 1))
-        [ $((RANDOM % ties)) -eq 0 ] && best="${cand[$i]}"
-      fi
-      i=$((i + 1))
+    for i in "${pool[@]}"; do
+      ties=$((ties + 1))
+      [ $((RANDOM % ties)) -eq 0 ] && best="${cand[$i]}"
     done
   fi
   PICK_DIR="$best"
-  PICK_SCORE="$bestv"
+  PICK_SCORE="$(sel_score_of "$best")"
 }
 
 if [ "${#eligible[@]}" -gt 0 ]; then
   if [ "${CODEX_SHIM_SELECT:-headroom}" = "random" ]; then
     PICK_DIR="${eligible[$((RANDOM % ${#eligible[@]}))]}"
+    PICK_BAND_COUNT=${#eligible[@]}
   else
     pick_best "${eligible[@]}"
   fi
 else
   # Every account is limit-marked: degraded service beats a hard failure (100% rule).
+  PICK_STRICT=1
   pick_best "${valid[@]}"
+  PICK_STRICT=0
   sel_log "all-limited fallback=$(basename "$PICK_DIR") weekly=$(fresh_field "$PICK_DIR" weekly_percent || echo '?')%"
 fi
 pick="$PICK_DIR"
@@ -538,7 +562,9 @@ if [ "$stale" = 1 ] && [ -x "$SELF_DIR/codex-accounts" ]; then
 fi
 
 acct="$(basename "$pick")"
-sel_log "$acct weekly=$(fresh_field "$pick" weekly_percent || echo '?')% session=$(fresh_field "$pick" session_percent || echo '?')% pwd=$PWD"
+sel_log "$acct weekly=$(fresh_field "$pick" weekly_percent || echo '?')%" \
+  "session=$(fresh_field "$pick" session_percent || echo '?')%" \
+  "band=${HEADROOM_BAND} band-count=${PICK_BAND_COUNT} pwd=$PWD"
 
 export CODEX_SHIM_ACTIVE=1
 

package/bin/codex-accounts

@@ -1492,8 +1492,17 @@ for acct in manifest.get('accounts', []):
         b for b in buckets if b['percent'] >= threshold]
     mpath = os.path.join(d, '.limited')
     if offenders:
-        worst = max(offenders, key=lambda b: b['percent'])
-        reset_epoch = max(int(b['resets_epoch']) for b in offenders)
+        # ONE bucket, described consistently: the marker's epoch is the reset of
+        # the bucket its detail line names. It used to pair the highest PERCENT
+        # with the LATEST reset over every offender, and the two came from
+        # different buckets — a 100% five-hour window resetting tonight written
+        # with a seven-day epoch — so everything that trusts the marker parked
+        # the account for days over a window that refills in hours. #20 fixed
+        # this for the claude pool and left the codex writer behind; app-robot
+        # reads both with the same rule. Among offenders the longest-lived wins,
+        # since any bucket over the threshold stays there until its own reset.
+        worst = max(offenders, key=lambda b: (int(b['resets_epoch']), b['percent']))
+        reset_epoch = int(worst['resets_epoch'])
         # Atomic: a concurrent shim must never read a half-written marker.
         with open(mpath + '.tmp', 'w') as f:
             f.write(f'{reset_epoch}\n')

package/docs/ACCOUNT_OPERATIONS.md

@@ -332,8 +332,10 @@ derived from the pool root. Uninstalling an instance removes only that instance'
 | `CLAUDE_ACCOUNT=acct-03` | pin this invocation to one account (wins over markers) |
 | `CLAUDE_CONFIG_DIR=...` | shim passes straight through (scripts can pin the old way) |
 | `CLAUDE_MULTIACC_DISABLE=1` | bypass selection entirely |
+| `CLAUDE_MULTIACC_HEADROOM_BAND=0..100` | weekly points treated as peers; default `30`, `0` is strict |
 | `CLAUDE_MULTIACC_CLIENT_LIMITS=0` | ignore the client's own rate-limit records |
 | `CLAUDE_MULTIACC_CLIENT_SCAN_TTL=<s>` | clean client-limit scan cache; default 20s |
+| `CLAUDE_MULTIACC_CLIENT_LIMIT_CONFIRM_DELAY=<s>` | low-telemetry recovery grace; default 300s |
 | `CLAUDE_SHIM_RETRY=0` | disable the `-p` auto-retry |
 | `CLAUDE_ACCOUNTS_ROOT=...` | relocate the pool; legacy spelling is `CLAUDE_ACCOUNTS_DIR` |
 | `CLAUDE_MULTIACC_SYNC_TARGET=...` | sync target, overriding the manifest; `none` = local-only |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-multiacc",
-  "version": "2.0.18",
+  "version": "2.0.20",
   "description": "Unified Claude Code and OpenAI Codex subscription pooling with quota-aware selection.",
   "type": "module",
   "bin": {

package/tests/run-tests.sh

@@ -331,6 +331,35 @@ done
 [ "$all2" = "1" ] && t_ok "picks the highest weekly-headroom account (weekly 20 over 80)" \
   || t_fail "headroom selection" "picked the more-utilized account"
 
+# The default 30-point band prevents strict headroom ranking from burning one account
+# to zero while its near-peers idle. Both boundaries participate; 31 points does not.
+lj 0 10 10 > "$ACC/acct-01/limits.json"
+lj 30 10 30 > "$ACC/acct-02/limits.json"
+hits1=0; hits2=0
+for _ in $(seq 1 20); do
+  case "$(claude 2>&1)" in
+    *CFG=acct-01*) hits1=$((hits1+1)) ;;
+    *CFG=acct-02*) hits2=$((hits2+1)) ;;
+  esac
+done
+{ [ "$hits1" -gt 0 ] && [ "$hits2" -gt 0 ]; } \
+  && t_ok "30-point headroom band spreads direct Claude launches (acct-01=$hits1 acct-02=$hits2)" \
+  || t_fail "Claude headroom band spread" "acct-01=$hits1 acct-02=$hits2"
+lj 31 10 31 > "$ACC/acct-02/limits.json"
+all1=1
+for _ in $(seq 1 10); do
+  case "$(claude 2>&1)" in *CFG=acct-01*) ;; *) all1=0 ;; esac
+done
+[ "$all1" = 1 ] && t_ok "an account 31 points behind stays outside the Claude band" \
+  || t_fail "Claude headroom band boundary" "the 31-point account was selected"
+lj 20 10 20 > "$ACC/acct-02/limits.json"
+all1=1
+for _ in $(seq 1 10); do
+  case "$(CLAUDE_MULTIACC_HEADROOM_BAND=0 claude 2>&1)" in *CFG=acct-01*) ;; *) all1=0 ;; esac
+done
+[ "$all1" = 1 ] && t_ok "Claude headroom band 0 restores strict ranking" \
+  || t_fail "Claude zero headroom band" "the runner-up was selected"
+
 # THE KEY CASE from the research: a high (but sub-threshold) SESSION bucket must NOT
 # deprioritize an account whose weekly headroom is better. acct-01: session 85, weekly 10;
 # acct-02: session 20, weekly 70. Both eligible (max<90). acct-01 is the better pick —
@@ -344,14 +373,14 @@ done
 [ "$all1" = "1" ] && t_ok "high session does NOT beat better weekly headroom (10w/85s over 70w/20s)" \
   || t_fail "weekly-over-session" "ranked the account with less weekly headroom higher"
 
-# equal weekly => session breaks the tie toward the account with more session headroom
+# In strict mode, equal weekly usage still uses session usage as its tiebreaker.
 lj 40 20 40 > "$ACC/acct-01/limits.json"
 lj 40 80 80 > "$ACC/acct-02/limits.json"
 all1=1
 for _ in $(seq 1 15); do
-  case "$(claude 2>&1)" in *CFG=acct-01*) ;; *) all1=0 ;; esac
+  case "$(CLAUDE_MULTIACC_HEADROOM_BAND=0 claude 2>&1)" in *CFG=acct-01*) ;; *) all1=0 ;; esac
 done
-[ "$all1" = "1" ] && t_ok "equal weekly: lower session wins the tiebreak" \
+[ "$all1" = "1" ] && t_ok "strict mode: equal weekly usage uses the session tiebreak" \
   || t_fail "session tiebreak" "did not use session to break a weekly tie"
 
 # fully equal scores spread load across accounts
@@ -1036,7 +1065,8 @@ mkclientlimit() { # mkclientlimit <acct dir> <session id> <resetsAt> [rejection
 }
 SID1="81bf8b20-013f-4414-8878-e0289bec9ad0"
 RESET1=$(( $(date +%s) + 1800 ))
-mkclientlimit "$ACC/acct-01" "$SID1" "$RESET1"
+REJECTED1="$(date -u +%Y-%m-%dT%H:%M:%S.000Z)"
+mkclientlimit "$ACC/acct-01" "$SID1" "$RESET1" "$REJECTED1"
 all2=1
 for _ in $(seq 1 12); do
   case "$(claude 2>&1)" in *CFG=acct-02*) ;; *) all2=0 ;; esac
@@ -1048,6 +1078,9 @@ first="$(head -1 "$ACC/acct-01/.limited" 2>/dev/null)"
   || t_fail "client marker reset" "want $RESET1, got '${first:-<none>}'"
 grep -q 'reason=client-rate-limit' "$ACC/acct-01/.limited" 2>/dev/null \
   && t_ok "marker is tagged client-rate-limit" || t_fail "client marker reason" "$(cat "$ACC/acct-01/.limited" 2>/dev/null)"
+grep -q "marked_at=$REJECTED1" "$ACC/acct-01/.limited" 2>/dev/null \
+  && t_ok "client marker preserves the rejection timestamp" \
+  || t_fail "client marker timestamp" "$(cat "$ACC/acct-01/.limited" 2>/dev/null)"
 out="$(CLAUDE_ACCOUNT=acct-01 claude 2>&1)"
 check "explicit pin still wins over a client-reported limit" "CFG=acct-01" "$out"
 
@@ -1055,6 +1088,25 @@ check "explicit pin still wins over a client-reported limit" "CFG=acct-01" "$out
 CLAUDE_MULTIACC_USAGE_URL="file://$WORK/usage-mid.json" claude-accounts limits --quiet
 [ -f "$ACC/acct-01/.limited" ] && t_ok "client-rate-limit marker survives a clean limits refresh" \
   || t_fail "client marker vs limits" "marker was cleared while the window was still open"
+# A later successful usage read under the threshold supersedes the client marker. The
+# live pool had five accounts at 0-3% hidden behind days-old client markers, leaving one
+# nominally-empty (but actually rejected) account to receive every direct launch.
+# A fleet sync refreshes the file's mtime, so recovery must use its semantic timestamp.
+{ head -1 "$ACC/acct-01/.limited"; \
+  sed 's/marked_at=[^ ]*/marked_at=2020-01-01T00:00:00Z/' "$ACC/acct-01/.limited" | tail -1; \
+} > "$ACC/acct-01/.limited.tmp"
+mv "$ACC/acct-01/.limited.tmp" "$ACC/acct-01/.limited"
+CLAUDE_MULTIACC_USAGE_URL="file://$WORK/usage-mid.json" claude-accounts limits --force --quiet
+[ ! -f "$ACC/acct-01/.limited" ] \
+  && t_ok "newer low telemetry clears an old client-rate-limit marker" \
+  || t_fail "old client marker vs limits" "marker survived confirmed recovery"
+[ -f "$ACC/acct-01/.client-limit-cleared" ] \
+  && t_ok "confirmed client-limit recovery records a transcript watermark" \
+  || t_fail "client recovery watermark" "watermark missing"
+claude >/dev/null 2>&1
+[ ! -f "$ACC/acct-01/.limited" ] \
+  && t_ok "an old transcript cannot recreate a telemetry-disproved marker" \
+  || t_fail "client recovery watermark" "old rejection recreated the marker"
 rm -f "$ACC/acct-01/.limited"
 
 # an ALREADY-ELAPSED rejection is history, not an exclusion
@@ -1386,7 +1438,9 @@ expected="$(cat "$WORK/stdin13")"
 [ "$out" = "$expected" ] && t_ok "stdin/stdout byte fidelity (-p pipe)" || t_fail "stdin fidelity" "got: $out"
 
 # ---- 14. selection log written ------------------------------------------------
-grep -qE '^[0-9]{4}-[0-9]{2}-[0-9]{2}T.*acct-0[123] weekly=[0-9?]+% session=[0-9?]+% pwd=' "$ACC/selection.log" \
+log_pattern='^[0-9]{4}-[0-9]{2}-[0-9]{2}T.*acct-0[123] weekly=[0-9?]+% session=[0-9?]+%'
+log_pattern="$log_pattern band=30 band-count=[0-9]+ pwd="
+grep -qE "$log_pattern" "$ACC/selection.log" \
   && t_ok "selection.log format" || t_fail "selection.log format" "no matching lines"
 grep -qE 'sk-ant-oat|accessToken|refreshToken' "$ACC/selection.log" \
   && t_fail "selection.log has no secrets" "a token leaked into the log" \
@@ -3302,6 +3356,27 @@ for _ in $(seq 1 15); do
 done
 [ "$all2" = "1" ] && t_ok "codex: picks the highest weekly-headroom account" \
   || t_fail "codex headroom selection" "picked the more-utilized account"
+# Keep direct-provider behavior aligned with pool-selection.v2: both accounts inside
+# the default 30-point band receive launches; a caller can set 0 for strict ranking.
+cxlj 0 10 10 > "$CX/acct-01/limits.json"
+cxlj 30 10 30 > "$CX/acct-02/limits.json"
+hits1=0; hits2=0
+for _ in $(seq 1 20); do
+  case "$(codex 2>&1)" in
+    *CFG=acct-01*) hits1=$((hits1+1)) ;;
+    *CFG=acct-02*) hits2=$((hits2+1)) ;;
+  esac
+done
+{ [ "$hits1" -gt 0 ] && [ "$hits2" -gt 0 ]; } \
+  && t_ok "codex: 30-point headroom band spreads launches (acct-01=$hits1 acct-02=$hits2)" \
+  || t_fail "codex headroom band spread" "acct-01=$hits1 acct-02=$hits2"
+cxlj 20 10 20 > "$CX/acct-02/limits.json"
+all1=1
+for _ in $(seq 1 10); do
+  case "$(CODEX_MULTIACC_HEADROOM_BAND=0 codex 2>&1)" in *CFG=acct-01*) ;; *) all1=0 ;; esac
+done
+[ "$all1" = 1 ] && t_ok "codex: headroom band 0 restores strict ranking" \
+  || t_fail "codex zero headroom band" "the runner-up was selected"
 # high session must NOT beat better weekly headroom
 cxlj 10 85 85 > "$CX/acct-01/limits.json"
 cxlj 70 20 70 > "$CX/acct-02/limits.json"
@@ -3622,13 +3697,13 @@ codex >/dev/null 2>&1
   || t_fail "codex soft park" "an elapsed soft park still excluded the account"
 
 # ---- C8. exec auto-retry ------------------------------------------------------------
-# acct-01 gets the strictly better score so headroom selection deterministically
-# picks it FIRST; the scripted failure then forces the retry onto acct-02.
+# Strict mode makes acct-01's better score deterministic for these retry-path tests;
+# the scripted failure then forces the retry onto acct-02.
 cx_first_01() { cxlj 5 5 5 > "$CX/acct-01/limits.json"; cxlj 20 20 20 > "$CX/acct-02/limits.json"; }
 cx_first_01
 # rate limit: retry on the other account + self-expiring cooldown for the failed one
 echo "fail:acct-01" > "$FAKE_CTL2"
-out="$(codex exec "hello" < /dev/null 2>&1)"
+out="$(CODEX_MULTIACC_HEADROOM_BAND=0 codex exec "hello" < /dev/null 2>&1)"
 case "$out" in *CFG=acct-02*) t_ok "codex: exec retries a rate-limited account on another" ;;
   *) t_fail "codex retry" "did not land on acct-02: $out" ;; esac
 if [ -f "$CX/acct-01/.limited" ]; then
@@ -3642,7 +3717,7 @@ rm -f "$CX/acct-01/.limited" "$FAKE_CTL2"
 # auth failure parks (soft) instead of a cooldown
 cx_first_01
 echo "authfail:acct-01" > "$FAKE_CTL2"
-codex exec "hello" < /dev/null >/dev/null 2>&1
+CODEX_MULTIACC_HEADROOM_BAND=0 codex exec "hello" < /dev/null >/dev/null 2>&1
 if [ -f "$CX/acct-01/.expired" ]; then
   grep -q "reason=auth-error" "$CX/acct-01/.expired" && grep -q "soft_until=" "$CX/acct-01/.expired" \
     && t_ok "codex: auth failure parks the account with a soft stamp" \
@@ -3654,7 +3729,7 @@ rm -f "$CX/acct-01/.expired" "$FAKE_CTL2"
 # org-disabled failure parks as org-blocked
 cx_first_01
 echo "orgfail:acct-01" > "$FAKE_CTL2"
-codex exec "hello" < /dev/null >/dev/null 2>&1
+CODEX_MULTIACC_HEADROOM_BAND=0 codex exec "hello" < /dev/null >/dev/null 2>&1
 grep -q "reason=org-blocked" "$CX/acct-01/.expired" 2>/dev/null \
   && t_ok "codex: workspace-disabled failure parks as org-blocked" \
   || t_fail "codex org park from run" "marker: $(cat "$CX/acct-01/.expired" 2>/dev/null || echo none)"

package/tests/test_codex_reset.py

@@ -61,7 +61,9 @@ class ResetHandler(BaseHTTPRequestHandler):
         return
 
 
-class CodexResetIntegrationTest(unittest.TestCase):
+class CodexPoolSandbox:
+    """A one-account codex pool with a fake usage/credits endpoint."""
+
     def setUp(self) -> None:
         self.temp = tempfile.TemporaryDirectory(prefix="multiacc-reset-")
         self.pool = Path(self.temp.name) / "pool"
@@ -88,6 +90,8 @@ class CodexResetIntegrationTest(unittest.TestCase):
         self.thread.join(timeout=5)
         self.temp.cleanup()
 
+
+class CodexResetIntegrationTest(CodexPoolSandbox, unittest.TestCase):
     def run_limits(self) -> subprocess.CompletedProcess:
         base = f"http://127.0.0.1:{self.server.server_port}/wham"
         env = os.environ.copy()
@@ -166,5 +170,66 @@ class CodexResetIntegrationTest(unittest.TestCase):
         self.assertEqual(self.server.state["credit_gets"], 1)
 
 
+class CodexMarkerNamesOneBucketTest(CodexPoolSandbox, unittest.TestCase):
+    """The marker's epoch is the reset of the bucket its detail line NAMES.
+
+    The codex writer used to pair the highest-PERCENT bucket's name with the
+    LATEST reset over every offender, so a five-hour window at 100% resetting
+    tonight was written under a seven-day epoch — and everything that trusts the
+    marker parked the account for a week over a window that refills in hours.
+    #20 fixed this for the claude pool and left codex behind.
+    """
+
+    def run_limits(self) -> subprocess.CompletedProcess:  # no auto-reset: it clears markers
+        base = f"http://127.0.0.1:{self.server.server_port}/wham"
+        env = os.environ.copy()
+        env.update({"CODEX_ACCOUNTS_ROOT": str(self.pool),
+                    "CODEX_MULTIACC_NO_SYNC": "1", "CODEX_MULTIACC_MIN_FETCH": "0",
+                    "CODEX_MULTIACC_AUTO_RESET": "0", "PYTHONDONTWRITEBYTECODE": "1",
+                    "CODEX_MULTIACC_USAGE_URL": f"{base}/usage"})
+        return subprocess.run([REPO / "bin/codex-accounts", "limits", "--force"],
+                              capture_output=True, text=True, env=env, timeout=20, check=False)
+
+    def _marker(self):
+        text = (self.pool / "acct-01/.limited").read_text(encoding="utf-8").splitlines()
+        return int(text[0]), text[1]
+
+    def test_two_offenders_write_one_bucket_with_its_own_reset(self) -> None:
+        now = int(time.time())
+        session_reset, weekly_reset = now + 3600, now + 6 * 86400
+        self.server.state["usage"] = {"plan_type": "pro", "rate_limit": {
+            "allowed": True,
+            # 100% and back in an hour …
+            "primary_window": {"used_percent": 100, "limit_window_seconds": 18000,
+                               "reset_at": session_reset},
+            # … beside 95% that is six days out. Both are over the threshold.
+            "secondary_window": {"used_percent": 95, "limit_window_seconds": 604800,
+                                 "reset_at": weekly_reset}}}
+        self.assertEqual(self.run_limits().returncode, 0)
+        epoch, detail = self._marker()
+        # The longest-lived offender is named, and the epoch is ITS reset — the
+        # account really is excluded until then, and a reader that takes the
+        # detail's percent gets the percent of the very bucket the epoch belongs
+        # to rather than a different bucket's.
+        self.assertEqual(epoch, weekly_reset)
+        self.assertIn("percent=95", detail)
+        self.assertIn(time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime(weekly_reset)), detail)
+        self.assertNotIn("percent=100", detail)
+
+    def test_a_single_offender_still_names_itself(self) -> None:
+        now = int(time.time())
+        reset = now + 4 * 86400
+        self.server.state["usage"] = {"plan_type": "pro", "rate_limit": {
+            "allowed": True,
+            "primary_window": {"used_percent": 91, "limit_window_seconds": 604800,
+                               "reset_at": reset},
+            "secondary_window": {"used_percent": 12, "limit_window_seconds": 18000,
+                                 "reset_at": now + 900}}}
+        self.assertEqual(self.run_limits().returncode, 0)
+        epoch, detail = self._marker()
+        self.assertEqual(epoch, reset)
+        self.assertIn("percent=91", detail)
+
+
 if __name__ == "__main__":
     unittest.main()