claude-multiacc 2.0.19 → 2.0.21

package/lib/selector_policy.py

@@ -7,6 +7,7 @@ from decimal import Decimal, localcontext
 
 from selector_primitives import (
     DEFAULT_HEADROOM_BAND,
+    DEFAULT_SESSION_GATE,
     SCHEMA,
     SELECTOR_VERSION,
     canonical_sha256,
@@ -126,17 +127,39 @@ def _winner_key(row: dict) -> tuple:
         row["engine"], row["account_id"], row["runner_id"], row["runner_generation"])
 
 
+def _session_gate(rows: list[dict], gate: Decimal | None) -> list[dict]:
+    """The FIRST cut: accounts whose 5h session bucket still has room.
+
+    The operator (2026-09-03): "among accounts where high session limits it must
+    choose randomly from ones where highest weekly limits." A nearly-spent session
+    bucket is about to reject the launch whatever the weekly headroom says, so it
+    disqualifies the account outright instead of merely nudging a tie-break. The
+    gate COMPARES, it never empties the pool: when nobody clears it the caller
+    falls back to every known row. Unknown quota never clears it — a missing
+    reading is not evidence of room.
+    """
+    if gate is None:
+        return []
+    return [row for row in rows if Decimal(row["session_pct"]) <= gate]
+
+
 def _band_floor(rows: list[dict], band: Decimal) -> Decimal | None:
-    """The lowest headroom still counted as "as good as the best" this round.
+    """The lowest WEEKLY remaining still counted as "as good as the best" this round.
 
     Ranking strictly by headroom hands every task to whichever account is on top,
     which is precisely how one account's limit gets burned to zero while three
     others idle: the runner-up only ever wins after the leader has been spent
     below it. Accounts within ``band`` points of the leader are treated as equally
     good, and the tie-break below spreads work across them.
+
+    The band is measured on weekly remaining, not on min(weekly, session): session
+    headroom already had its say in ``_session_gate`` above, and letting it back in
+    here both pushed the best weekly account out of the band over a half-spent 5h
+    bucket and let a fully spent one stay in. Rows reaching here are the gated set,
+    so every one of them has a known reading.
     """
-    known = [Decimal(row["effective_headroom"]) for row in rows
-             if row["quota_known"] and row["effective_headroom"] is not None]
+    known = [Decimal(row["weekly_remaining"]) for row in rows
+             if row["quota_known"] and row["weekly_remaining"] is not None]
     return max(known) - band if known else None
 
 
@@ -197,15 +220,21 @@ def select(request: object) -> dict:
     if not eligible:
         return _error("no_candidate", {"eligible_count": 0})
     band, band_text = decimal_value(request.get("headroom_band", DEFAULT_HEADROOM_BAND))
-    floor = _band_floor(eligible, band) if band is not None else None
+    gate, gate_text = decimal_value(request.get("session_gate", DEFAULT_SESSION_GATE))
+    # Two cuts, in this order (operator's 2026-09-03 decision): the session gate says
+    # WHO may be considered, the weekly band says which of those count as equally
+    # good. "healthy or known" is the gate stepping aside when nobody clears it.
+    known = [row for row in eligible if row["quota_known"]]
+    healthy = _session_gate(known, gate)
+    ranked = healthy or known
+    floor = _band_floor(ranked, band) if band is not None else None
     if floor is None:
         # No usable quota anywhere: nothing to band, so keep the plain ordering
         # (which already ranks unknown-quota rows last and rotates on ties).
         banded = eligible
         winner = min(banded, key=_winner_key)
     else:
-        banded = [row for row in eligible if row["quota_known"]
-                  and Decimal(row["effective_headroom"]) >= floor]
+        banded = [row for row in ranked if Decimal(row["weekly_remaining"]) >= floor]
         winner = min(banded, key=_band_key(request["reservation_key"]))
     rows.sort(key=_snapshot_key)
     snapshot = canonical_sha256(rows)
@@ -214,8 +243,10 @@ def select(request: object) -> dict:
         "schema": SCHEMA, "selector_version": SELECTOR_VERSION,
         "database_now": canonical_now, "policy": request["policy"],
         "required_engine": request.get("required_engine"), "reservation_key": request["reservation_key"],
-        # The band changes which account wins, so it belongs in the proof.
+        # The band and the gate both change which account wins, so both belong in
+        # the proof. (This is why the golden digests moved on 2026-09-03.)
         "headroom_band": band_text,
+        "session_gate": gate_text,
         "candidate_snapshot_digest": snapshot, "selected_identity": chosen}
     score_fields = ("quota_known", "weekly_pct", "session_pct", "weekly_remaining",
                     "session_remaining", "effective_headroom", "last_selected_at")
@@ -228,6 +259,10 @@ def select(request: object) -> dict:
                 "headroom_band": band_text,
                 "band_floor": format(floor, "f") if floor is not None else None,
                 "band_count": len(banded),
+                # ...and how many accounts the session gate let through at all
+                # (0 means nobody cleared it and the gate stepped aside).
+                "session_gate": gate_text,
+                "session_ok_count": len(healthy),
                 "candidate_snapshot_digest": snapshot,
                 "selection_digest": canonical_sha256(digest_input)}
     if request["policy"] == "reviewer" and not alternatives and _row_identity(winner) == producer:

package/lib/selector_primitives.py

@@ -11,13 +11,15 @@ from datetime import datetime, timezone
 from decimal import Decimal, InvalidOperation
 
 SCHEMA = "claude-multiacc/pool-selection.v2"
-# NOT bumped for the headroom band. This string is a BUILD FENCE, not a changelog:
-# a queued task records the version that reserved its account, and the claim function
-# (agent-sdk 0005_delivery_claim_functions.sql) only lets a runner advertising the same
-# string claim it — while the runner's value is a hardcoded constant shipped in its
-# bundle. With Macs routinely several builds behind, bumping this stops every lagging
-# Mac from claiming any new work until it updates. The band is additive and optional:
-# the request shape, the response shape and every consumer are unchanged.
+# NOT bumped for the headroom band, and NOT bumped for the session gate either. This
+# string is a BUILD FENCE, not a changelog: a queued task records the version that
+# reserved its account, and the claim function (agent-sdk
+# 0005_delivery_claim_functions.sql) only lets a runner advertising the same string
+# claim it — while the runner's value is a hardcoded constant shipped in its bundle.
+# With Macs routinely several builds behind, bumping this stops every lagging Mac from
+# claiming any new work until it updates. Both knobs are additive and optional: the
+# request only grows optional keys, the response only grows fields, and every existing
+# consumer keeps reading exactly what it read before.
 SELECTOR_VERSION = "2.0.1"
 TIME_RE = re.compile(
     r"^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-5][0-9]"
@@ -33,9 +35,13 @@ REQUEST_KEYS = {
     "schema", "database_now", "policy", "required_engine", "producer_identity",
     "excluded_identities", "candidates", "reservation_key"}
 # Optional because a caller pinned to an older panel build still sends exactly
-# REQUEST_KEYS; absent, the policy applies its own default band.
-OPTIONAL_REQUEST_KEYS = {"headroom_band"}
+# REQUEST_KEYS; absent, the policy applies its own defaults. app-robot's panel sends
+# headroom_band from its own setting and never sends session_gate, so the gate default
+# below is what every panel launch gets (operator's 2026-09-03 decision: session
+# headroom gates FIRST, then the weekly band picks among the survivors).
+OPTIONAL_REQUEST_KEYS = {"headroom_band", "session_gate"}
 DEFAULT_HEADROOM_BAND = "30"
+DEFAULT_SESSION_GATE = "50"
 POLICIES = {
     "default_claude", "default_codex", "default_both", "explicit", "producer_retry", "reviewer"}
 
@@ -180,13 +186,16 @@ def request_error(request: object) -> tuple[str, dict] | None:
     keys = set(request)
     if not REQUEST_KEYS <= keys or keys - REQUEST_KEYS - OPTIONAL_REQUEST_KEYS:
         return "invalid_request", {"field": "$"}
-    if "headroom_band" in request:
-        band, _text = decimal_value(request["headroom_band"])
-        # decimal_value clamps to [0,100] and rejects non-numeric shapes; a band
-        # the caller cannot express exactly must fail loudly rather than silently
-        # widen selection to the whole pool.
-        if band is None or isinstance(request["headroom_band"], bool):
-            return "invalid_request", {"field": "headroom_band"}
+    for knob in ("headroom_band", "session_gate"):
+        if knob not in request:
+            continue
+        value, _text = decimal_value(request[knob])
+        # decimal_value clamps to [0,100] and rejects non-numeric shapes; a knob the
+        # caller cannot express exactly must fail loudly rather than silently widen
+        # selection to the whole pool (band) or wave every session-heavy account
+        # through (gate). Both are validated identically so the panel can send either.
+        if value is None or isinstance(request[knob], bool):
+            return "invalid_request", {"field": knob}
     try:
         timestamp(request["database_now"])
     except ValueError:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-multiacc",
-  "version": "2.0.19",
+  "version": "2.0.21",
   "description": "Unified Claude Code and OpenAI Codex subscription pooling with quota-aware selection.",
   "type": "module",
   "bin": {