claude-multiacc 2.0.20 → 2.0.21

package/CLAUDE_ACCS_TASK.md

@@ -128,11 +128,16 @@ MAC (source of truth)                      SERVER 138.197.36.107 (mirror)
 
 1. `CLAUDE_CONFIG_DIR` already set → pass straight through (scripts can pin).
 2. `CLAUDE_ACCOUNT=acct-03` set → use that account (even if limit-marked — explicit wins).
-3. Else pick uniformly at random among accounts with valid auth
-   (`.credentials.json` on Mac; `server.token` on server → also exports
-   `CLAUDE_CODE_OAUTH_TOKEN`) **that are not limit-marked** (no `.limited` marker).
-   If EVERY account is marked, fall back to the least-utilized account and log a warning —
-   degraded service beats a hard failure (the 100% rule).
+3. Else, among accounts with valid auth (`.credentials.json` on Mac; `server.token` on
+   server → also exports `CLAUDE_CODE_OAUTH_TOKEN`) **that are not limit-marked** (no
+   `.limited` marker), select in two cuts (operator decision, 2026-09-03): first the
+   **session gate** — only accounts whose fresh 5h usage is at most
+   `CLAUDE_MULTIACC_SESSION_GATE` (default 50) stay in, unless nobody clears it; then the
+   **30-point weekly headroom band** — accounts within `CLAUDE_MULTIACC_HEADROOM_BAND`
+   points of the lowest weekly usage are peers, sampled at random with the previous pick
+   avoided. If EVERY account is marked, the still-serving ones go through the same two cuts
+   with a strict (exact-tie) band and one is handed out with a warning — degraded service
+   beats a hard failure (the 100% rule). README.md is the authoritative description.
 4. Append `timestamp account cwd` to `selection.log` (never prompt text); print NOTHING;
    `exec` the dynamically-resolved real binary — stdin/stdout/exit codes pass through
    byte-identically → `-p` pipe-safe.

package/README.md

@@ -16,7 +16,7 @@ completely independent — separate manifests, credentials, telemetry, and logs
 either provider can be used, re-authenticated, or emptied without touching the other.
 
 Tested on: macOS (bash 3.2, zsh, Claude Code 2.1.207+, Codex CLI 0.147) and Ubuntu 24.04
-(bash 5.2). The compatibility suite currently covers 645 sandboxed cases with no
+(bash 5.2). The compatibility suite currently covers 834 sandboxed cases with no
 network/quota use; the unified selector has its own adversarial contract suite.
 
 ## Unified selector for app-robot
@@ -32,8 +32,9 @@ claude-multiacc select --request-json - --response-json -
 
 The command reads one strict UTF-8 JSON request and emits one JSON response using
 the versioned `claude-multiacc/pool-selection.v2` protocol. It ranks the caller's
-locked candidate snapshot by usable weekly/session headroom and returns one concrete
-provider/account plus canonical snapshot and selection digests. `both` is a policy,
+locked candidate snapshot with the same two cuts as the shims — a session-headroom gate,
+then a band on weekly headroom — and returns one concrete provider/account plus canonical
+snapshot and selection digests. `both` is a policy,
 never an execution engine. The caller remains responsible for durable reservations,
 database locks, retries, and launching the selected CLI.
 Successful responses also carry `eligible_count` and `eligible_alternative_count`,
@@ -72,14 +73,26 @@ repo bin/ first on PATH (rc-file block)    /root/claude-multiacc/  (addon repo)
 4. Among the accounts that remain valid **on this machine** (an OAuth login —
    `.credentials.json`, or a macOS Keychain item this session can open — or a
    `server.token` that passes its first inference preflight) and not limit-excluded,
-   form a **30-percentage-point weekly-headroom band** around the account with the most
-   remaining headroom (see below). The pool **rotates away from the account it just handed
+   rank in two cuts (see below). **Session gate first:** keep only the accounts whose
+   5-hour bucket is known-fresh and at most 50% used — an account about to be rejected on
+   its session does not deserve a launch whatever its weekly headroom. If *nobody* clears
+   the gate it steps aside and every candidate stays in: the gate compares, it never
+   empties the pool. **Then the weekly band:** among the accounts that cleared the gate,
+   form a **30-percentage-point weekly-headroom band** around the one with the most
+   remaining weekly headroom. The pool **rotates away from the account it just handed
    out** and samples the other accounts in that band at random. This prevents one nominally
    emptiest account from taking every launch while near-peers idle, while accounts more than
-   30 points behind remain protected. `CLAUDE_MULTIACC_HEADROOM_BAND=0` restores strict
-   best-headroom selection; `CLAUDE_SHIM_SELECT=random` uses the whole eligible pool.
-5. If every account is limit-excluded → the highest-headroom *authenticable* account
-   anyway + a warning in `selection.log` (degraded beats down: the 100% rule).
+   30 points behind remain protected. `CLAUDE_MULTIACC_SESSION_GATE=100` turns the gate off
+   (default `50`); `CLAUDE_MULTIACC_HEADROOM_BAND=0` restores strict best-weekly selection
+   (default `30`); `CLAUDE_SHIM_SELECT=random` uses the whole eligible pool. Every pick
+   records both cuts in `selection.log`: `band=`/`band-count=` (the band width and how many
+   peers it held) and `session-gate=`/`session-ok=` (the gate and how many candidates
+   cleared it — `session-ok=0` means nobody did and the gate stepped aside; in
+   `CLAUDE_SHIM_SELECT=random` mode the line reads `session-gate=off`, because no cut was made).
+5. If every account is limit-excluded → the still-serving limited accounts (a bucket at
+   90–99%, not an exhausted one) go through the same two cuts — session gate, then strict
+   best-weekly — and one is handed out anyway, with an `all-limited fallback=` line in
+   `selection.log` (degraded beats down: the 100% rule).
 6. If nothing is usable at all → stock passthrough, with the reason in `selection.log`
    (and, on a terminal, one line naming the accounts to fix).
 
@@ -87,13 +100,26 @@ repo bin/ first on PATH (rc-file block)    /root/claude-multiacc/  (addon repo)
 Fable request consumes at once: the 5-hour **session** bucket, the **weekly all-models**
 bucket, and the **weekly Fable** bucket. Anthropic's docs confirm these reset on very
 different horizons — the session bucket refills every ~5 hours, but weekly buckets only
-refill on the account's fixed weekly reset (days away). So the picker ranks primarily on
-**weekly headroom** (the peak of the durable buckets) to form the 30-point band. Accounts
-inside that band are deliberately treated as peers and spread randomly; with a zero-width
-band the self-healing session bucket is the tiebreaker. An account at 10% weekly remains
-protected from one at 70% weekly because the latter is outside the band. (`score = weekly%
-× 1000 + session%` in strict mode, lowest wins.) **Exclusion** still fires on *any* bucket
-≥ 90% — a full session bucket
+refill on the account's fixed weekly reset (days away). The two buckets therefore answer
+two different questions, and the picker asks them in that order (operator's decision,
+2026-09-03: *"among accounts where high session limits it must choose randomly from ones
+where highest weekly limits"*).
+
+- **Session is a gate, not a tiebreaker.** A candidate clears the gate when its 5-hour
+  usage is *known* (fresh telemetry) and at most `CLAUDE_MULTIACC_SESSION_GATE` points
+  spent — default `50`, `100` disables the gate. Unknown session usage never clears it.
+  An account that is 85% through its session is minutes from a rejection, so it waits
+  while anyone fresher is available; if nobody clears the gate, everybody is ranked.
+- **Weekly headroom picks the winner.** Among the accounts that cleared the gate, the
+  picker ranks on **weekly headroom** (the peak of the durable buckets) and treats
+  everything within `CLAUDE_MULTIACC_HEADROOM_BAND` points of the leader — default `30`,
+  `0` is strict best-weekly-only — as a peer, spreading launches over that band at
+  random. Session usage is **not** a tiebreaker inside the band: it acts only through
+  the gate. So an account at 10% weekly stays protected from one at 70% weekly, but
+  10% weekly with an 85%-spent session loses to 70% weekly with a 20% one, because the
+  first never reaches the band.
+
+**Exclusion** still fires on *any* bucket ≥ 90% — a full session bucket
 really does block right now — but that marker expires when the session resets, not days
 later.
 
@@ -286,8 +312,9 @@ above about the claude pool holds for the codex pool with these translations:
 | Anthropic OAuth usage and Fable buckets | Codex usage endpoint and per-model buckets |
 | `CLAUDE_*` pool controls | equivalent `CODEX_*` controls |
 
-Same selection rule (weekly headroom primary, session tiebreak, ≥90% any-bucket
-exclusion, equal scores rotate), same marker semantics (`.limited` cooldowns, `.expired` parks with
+Same selection rule (session gate first — `CODEX_MULTIACC_SESSION_GATE`, default 50 —
+then the 30-point weekly-headroom band with random spread, ≥90% any-bucket
+exclusion, peers rotate), same marker semantics (`.limited` cooldowns, `.expired` parks with
 credential/policy scoping and soft expiry), same fail-open guarantees, same sync
 safety guards. The `codex` shim engages the buffered auto-retry only for
 `codex exec` runs with finite stdin, exactly like `-p` on the claude side.

package/bin/claude

@@ -3,7 +3,9 @@
 # Every invocation runs under a randomly picked subscription account with limit headroom.
 # Self-contained on purpose: no sourcing, so a broken repo file can never break `claude`.
 # Selection: CLAUDE_CONFIG_DIR/CLAUDE_CODE_OAUTH_TOKEN passthrough > CLAUDE_ACCOUNT pin >
-# random within the 30-point headroom band > least-utilized fallback (degraded beats down).
+# two cuts — the 50-point session gate, then random within the 30-point weekly headroom
+# band (previous pick avoided) > all-limited fallback: the same two cuts over the
+# still-serving limited accounts, strict weekly (degraded beats down).
 # Accounts whose login is DEAD (expired refresh token, or a `.expired` marker from a
 # failed auth) are never selected — not even as the all-limited fallback — because they
 # fail every call outright; `claude-accounts expired` / `relogin` fix them.
@@ -410,9 +412,9 @@ stale_weekly() { # $1 = acct dir
 }
 
 # TRUE when this account contributes nothing to ranking: no in-window telemetry at all.
-# When every candidate is blind, every score is the same neutral constant, pick_best
-# sees one enormous tie, and selection quietly becomes uniform random — the failure
-# this whole file exists to prevent.
+# When every candidate is blind, no candidate has a known reading, pick_best sees one
+# enormous tie, and selection quietly becomes uniform random — the failure this whole
+# file exists to prevent.
 telem_blind() { # $1 = acct dir
   ! within_window "$1" "$STALE_AFTER"
 }
@@ -425,36 +427,52 @@ age_human() { # $1 = seconds
   else printf '%dm\n' $((s / 60)); fi
 }
 
-# RANKING score — lower is better (more headroom). Weekly headroom dominates: a weekly
-# bucket only refills on the account's fixed weekly reset (days away), while the 5h
-# session bucket self-heals, so session is a mild tiebreaker only. (Anthropic's docs
-# confirm this reset asymmetry — an account whose only near-full bucket is the cheap
-# session one must NOT rank behind one burning durable weekly headroom.)
-#   score = weekly%*1000 + session%      weekly,session in [0,100]
-# Stale/unreadable telemetry ranks LAST (weekly 100, session 100), never "free" —
-# EXCEPT in a blind pool (SEL_DEGRADED=1), where a still-valid stale weekly reading is
-# used instead. Unknown data must never beat a truthful usage reading; when every
-# candidate is unknown, the equal worst-case scores still preserve fail-open selection.
+# RANKING — two cuts, no score, no tiebreaker (operator's ask, 2026-09-03: "among
+# accounts where high session limits it must choose randomly from ones where highest
+# weekly limits"). Session used to be a mild tiebreaker inside the score, which meant an
+# account whose 5h bucket was nearly spent — about to be rejected whatever its weekly
+# headroom — ranked exactly like a fresh one. It is now the FIRST cut instead:
+#   1. SESSION GATE  — candidates with a KNOWN session reading <= SESSION_GATE are the
+#      only ones ranked further. Unknown session never clears it. If NOBODY clears it the
+#      gate steps aside and everyone is ranked: the gate compares, it never empties the
+#      pool.
+#   2. WEEKLY BAND   — among those, the lowest KNOWN weekly usage leads and everything
+#      within HEADROOM_BAND points of it is a peer; peers are sampled at random with the
+#      previous pick skipped. Weekly still dominates because a weekly bucket only refills
+#      on the account's fixed weekly reset (days away) while the 5h session bucket
+#      self-heals — the gate is about "will this run be rejected now", not about headroom.
+# Stale/unreadable telemetry ranks LAST (unknown weekly, and unknown never clears the
+# gate), never "free" — EXCEPT in a blind pool (SEL_DEGRADED=1), where a still-valid stale
+# weekly reading is used instead. Unknown data must never beat a truthful usage reading;
+# when every candidate is unknown they tie, which preserves fail-open selection.
 SEL_DEGRADED=0
-sel_score_of() { # $1 = acct dir
-  local w s
-  if ! w="$(fresh_field "$1" weekly_percent)" && ! w="$(fresh_field "$1" max_percent)"; then
-    if [ "$SEL_DEGRADED" = 1 ]; then w="$(stale_weekly "$1")" || w=100; else w=100; fi
-  fi
-  s="$(fresh_field "$1" session_percent)" || s=100
-  printf '%s\n' $((w * 1000 + s))
-}
 
-# The direct shims use the same 30-point headroom band as pool-selection.v2. Strict
-# best-headroom selection burned one account to its limit while equally healthy
-# neighbours idled. A caller can set 0 to restore strict ranking.
+# The direct shims use the same 30-point headroom band as pool-selection.v2, on WEEKLY
+# usage. Strict best-headroom selection burned one account to its limit while equally
+# healthy neighbours idled. A caller can set 0 to restore strict ranking (exact weekly
+# ties only). The operator confirmed on 2026-09-03 that the 30-point band stays.
 HEADROOM_BAND="${CLAUDE_MULTIACC_HEADROOM_BAND:-30}"
 case "$HEADROOM_BAND" in ''|*[!0-9]*|??????*) HEADROOM_BAND=30 ;; esac
 [ "$HEADROOM_BAND" -gt 100 ] && HEADROOM_BAND=100
 
+# The session gate: a candidate is "healthy enough to run now" when its KNOWN 5h usage is
+# at or under this many points. It runs BEFORE the weekly band, so a nearly-spent session
+# bucket takes an account out of contention however good its weekly headroom is. 100
+# disables the gate (every known-session account clears it).
+SESSION_GATE="${CLAUDE_MULTIACC_SESSION_GATE:-50}"
+case "$SESSION_GATE" in ''|*[!0-9]*|??????*) SESSION_GATE=50 ;; esac
+[ "$SESSION_GATE" -gt 100 ] && SESSION_GATE=100
+# What the selection log prints for the gate: "off" in random mode, where no gate ran —
+# the log must never claim a cut that was not made.
+SESSION_GATE_LOG="$SESSION_GATE"
+
+# weekly_percent ONLY. A reading without it is unknown here, exactly as it is unknown to
+# pool-selection.v2 (which never sees max_percent). The old max_percent fallback let a
+# weekly-less file rank — and, once the session gate existed, CLEAR the gate — on a number
+# that may well be the session bucket's own peak (codex review, 2026-09-04).
 rank_weekly_of() { # $1 = acct dir -> comparable weekly use, or fail when unknown
   local w
-  if w="$(fresh_field "$1" weekly_percent)" || w="$(fresh_field "$1" max_percent)"; then
+  if w="$(fresh_field "$1" weekly_percent)"; then
     printf '%s\n' "$w"
     return 0
   fi
@@ -462,6 +480,13 @@ rank_weekly_of() { # $1 = acct dir -> comparable weekly use, or fail when unknow
   stale_weekly "$1"
 }
 
+rank_session_of() { # $1 = acct dir -> fresh session use, or fail when unknown
+  # Deliberately fresh-only, with no stale/degraded fallback: an old 5h reading says
+  # nothing about a bucket that self-heals every five hours, and an unknown session must
+  # not clear the gate.
+  fresh_field "$1" session_percent
+}
+
 # The .limited marker's own fields (line 1: reset epoch; line 2: "bucket=…
 # percent=… … reason=…"). All tolerant: an unreadable or bare marker answers
 # "unknown", never an error — these feed the all-limited fallback only.
@@ -1176,45 +1201,69 @@ remember_pick() { # $1 acct dir — best effort. stderr is silenced BEFORE the r
   return 0
 }
 
-# Pick the account with the MOST headroom (lowest ranking score = most weekly headroom,
-# session as tiebreaker). Ties break randomly so equally-idle accounts still spread load.
-# Sets PICK_DIR/PICK_SCORE as globals — it must never touch "$@", which holds the
-# user's claude arguments.
+# Pick an account by the two-cut rule above: the session gate first, then random among
+# the peers inside the 30-point WEEKLY band, with the account handed out last time
+# skipped. No score and no tiebreaker — the operator asked for a random choice among the
+# best-weekly accounts (2026-09-03), so session only ever acts through the gate.
+# Sets PICK_DIR/PICK_BAND_COUNT/PICK_GATE_COUNT as globals — it must never touch "$@",
+# which holds the user's claude arguments.
 PICK_DIR=""
-PICK_SCORE=""
 PICK_BAND_COUNT=0
+PICK_GATE_COUNT=0
 PICK_STRICT=0
 pick_best() { # args: candidate dirs
-  local d w avoid best="" bestv=1000000 bestw=101 ceiling=100 ties=0 i n match
-  local cand=() score=() weekly=() known=() pool=()
+  local d w s k sk avoid best="" bestw=101 band ceiling ties=0 i n
+  local cand=() weekly=() known=() gated=() pool=()
   avoid="$(last_pick_id)"
+  PICK_GATE_COUNT=0
   for d in "$@"; do
     cand+=("$d")
-    score+=("$(sel_score_of "$d")")
-    if w="$(rank_weekly_of "$d")"; then weekly+=("$w"); known+=(1)
-    else weekly+=(100); known+=(0); fi
+    w="$(rank_weekly_of "$d")" && k=1 || k=0
+    s="$(rank_session_of "$d")" && sk=1 || sk=0
+    # "Known" takes BOTH readings — pool-selection.v2's quota_known rule. A weekly figure
+    # on its own neither ranks nor clears the gate, and a session figure on its own could
+    # otherwise be the sole gate-clearer and win the all-gated tie over an account whose
+    # truthful weekly reading merely failed the gate. The one exception is a DEGRADED pool
+    # (SEL_DEGRADED=1): nothing is fresh anywhere, the gate has necessarily stepped aside,
+    # and a still-valid stale weekly reading is the only truth there is. (Neither writer
+    # emits one field without the other; this is parity with lib/selector_policy.py.)
+    if [ "$k" = 1 ] && { [ "$sk" = 1 ] || [ "$SEL_DEGRADED" = 1 ]; }; then
+      weekly+=("$w"); known+=(1)
+    else
+      weekly+=(100); known+=(0)
+    fi
+    if [ "$k" = 1 ] && [ "$sk" = 1 ] && [ "$s" -le "$SESSION_GATE" ]; then
+      gated+=(1); PICK_GATE_COUNT=$((PICK_GATE_COUNT + 1))
+    else
+      gated+=(0)
+    fi
   done
   n=${#cand[@]}
   i=0
   while [ "$i" -lt "$n" ]; do
-    [ "${score[$i]}" -lt "$bestv" ] && bestv="${score[$i]}"
-    [ "${known[$i]}" = 1 ] && [ "${weekly[$i]}" -lt "$bestw" ] && bestw="${weekly[$i]}"
+    # Nobody clears the gate => everybody does: the gate compares, it never empties the pool.
+    [ "$PICK_GATE_COUNT" -eq 0 ] && gated[$i]=1
+    if [ "${gated[$i]}" = 1 ] && [ "${known[$i]}" = 1 ] && [ "${weekly[$i]}" -lt "$bestw" ]; then
+      bestw="${weekly[$i]}"
+    fi
     i=$((i + 1))
   done
-  ceiling=$((bestw + HEADROOM_BAND)); [ "$ceiling" -gt 100 ] && ceiling=100
+  band="$HEADROOM_BAND"
+  [ "$PICK_STRICT" = 1 ] && band=0
+  ceiling=$((bestw + band)); [ "$ceiling" -gt 100 ] && ceiling=100
   i=0
   while [ "$i" -lt "$n" ]; do
-    match=0
-    if [ "$PICK_STRICT" = 0 ] && [ "$HEADROOM_BAND" -gt 0 ] && [ "$bestw" -le 100 ]; then
-      [ "${known[$i]}" = 1 ] && [ "${weekly[$i]}" -le "$ceiling" ] && match=1
-    else
-      [ "${score[$i]}" -eq "$bestv" ] && match=1
+    if [ "${gated[$i]}" = 1 ]; then
+      if [ "$bestw" -gt 100 ]; then
+        pool+=("$i")                       # no weekly reading anywhere: all gated tie
+      elif [ "${known[$i]}" = 1 ] && [ "${weekly[$i]}" -le "$ceiling" ]; then
+        pool+=("$i")
+      fi
     fi
-    [ "$match" = 1 ] && pool+=("$i")
     i=$((i + 1))
   done
   PICK_BAND_COUNT=${#pool[@]}
-  # Reservoir-sample inside the band, skipping the account just handed out.
+  # Reservoir-sample the peers, skipping the account just handed out.
   for i in "${pool[@]}"; do
     if [ "${cand[$i]##*/}" != "$avoid" ]; then
       ties=$((ties + 1))
@@ -1228,15 +1277,15 @@ pick_best() { # args: candidate dirs
     done
   fi
   PICK_DIR="$best"
-  PICK_SCORE="$(sel_score_of "$best")"
 }
 
 # Telemetry going stale is not a per-run detail, it is a pool-wide outage: with no
-# in-window data ANYWHERE every account scores the identical NEUTRAL value, the tie
-# spans the whole pool, and "pick the account with the most headroom" silently becomes
-# "pick any account at all". That is how a fresh session lands on the one account
-# already at 80% of its weekly limit while `claude-accounts status` still shows a
-# reassuring 2% from eleven days ago. It cost eleven days of blind picks once.
+# in-window data ANYWHERE every account reads as UNKNOWN — no weekly, and nothing that
+# can clear the session gate — so the tie spans the whole pool and "pick the account with
+# the most headroom" silently becomes "pick any account at all". That is how a fresh
+# session lands on the one account already at 80% of its weekly limit while
+# `claude-accounts status` still shows a reassuring 2% from eleven days ago. It cost
+# eleven days of blind picks once.
 # Two answers, and the order matters: rank on whatever old readings are still true
 # BEFORE picking, and say out loud which of the two happened.
 blind=1           # 1 = no candidate has in-window telemetry
@@ -1256,10 +1305,10 @@ assess_telemetry() { # args: the dirs actually being chosen between
     stale_weekly "$d" >/dev/null && stale_ok=$((stale_ok + 1))
   done
   # All or nothing. A candidate whose reading has no horizon — a limits.json written
-  # before this field existed, or one whose week has already turned — scores neutral
-  # 50, and 50 would beat a NEIGHBOUR's true-but-worse 70. Mixing the two makes the
-  # degraded ranking actively wrong, so it is only used when every candidate can be
-  # compared on the same footing.
+  # before this field existed, or one whose week has already turned — stays UNKNOWN even
+  # in degraded mode, so it would drop out of the band entirely while its neighbours rank
+  # on stale numbers. Mixing the two makes the degraded ranking actively wrong, so it is
+  # only used when every candidate can be compared on the same footing.
   [ "$n" -gt 0 ] && [ "$stale_ok" -eq "$n" ] && degraded=1
   return 0
 }
@@ -1273,6 +1322,8 @@ if [ "${#eligible[@]}" -gt 0 ]; then
   if [ "${CLAUDE_SHIM_SELECT:-headroom}" = "random" ]; then
     PICK_DIR="${eligible[$((RANDOM % ${#eligible[@]}))]}"
     PICK_BAND_COUNT=${#eligible[@]}
+    PICK_GATE_COUNT=${#eligible[@]}
+    SESSION_GATE_LOG=off
   else
     pick_best "${eligible[@]}"
   fi
@@ -1404,10 +1455,12 @@ if [ "$blind" = 1 ]; then
   if [ "$degraded" = 1 ]; then
     sel_log "$acct weekly=$(stale_weekly "$pick" || echo '?')% session=?%" \
       "ranking=DEGRADED telemetry-age=${blind_age}s band=${HEADROOM_BAND}" \
-      "band-count=${PICK_BAND_COUNT} pwd=$PWD"
+      "band-count=${PICK_BAND_COUNT} session-gate=${SESSION_GATE_LOG}" \
+      "session-ok=${PICK_GATE_COUNT} pwd=$PWD"
   else
     sel_log "$acct weekly=?% session=?% ranking=BLIND telemetry-age=${blind_age}s" \
-      "band=${HEADROOM_BAND} band-count=${PICK_BAND_COUNT} pwd=$PWD"
+      "band=${HEADROOM_BAND} band-count=${PICK_BAND_COUNT}" \
+      "session-gate=${SESSION_GATE_LOG} session-ok=${PICK_GATE_COUNT} pwd=$PWD"
   fi
   # Terminal only, at most hourly — a service-spawned `claude -p` must keep its stderr
   # byte-clean, and this is advice, never a failure.
@@ -1431,7 +1484,8 @@ if [ "$blind" = 1 ]; then
 else
   sel_log "$acct weekly=$(fresh_field "$pick" weekly_percent || echo '?')%" \
     "session=$(fresh_field "$pick" session_percent || echo '?')%" \
-    "band=${HEADROOM_BAND} band-count=${PICK_BAND_COUNT} pwd=$PWD"
+    "band=${HEADROOM_BAND} band-count=${PICK_BAND_COUNT}" \
+    "session-gate=${SESSION_GATE_LOG} session-ok=${PICK_GATE_COUNT} pwd=$PWD"
 fi
 
 export CLAUDE_SHIM_ACTIVE=1

package/bin/claude-accounts

@@ -2156,7 +2156,10 @@ for acct in manifest.get('accounts', []):
     #   weekly_percent — peak of the durable (weekly/monthly) buckets; the PRIMARY
     #                    ranking signal, because weekly headroom only returns on the
     #                    account's fixed weekly reset (days away).
-    #   session_percent— peak of the self-healing 5h bucket; a soft tiebreaker only.
+    #   session_percent— peak of the self-healing 5h bucket; the session GATE's input:
+    #                    the shim ranks only accounts at/under CLAUDE_MULTIACC_SESSION_GATE
+    #                    (default 50) while any clear it. (A soft tiebreaker until
+    #                    2026-09-03 — the operator asked for session FIRST, then weekly.)
     maxp = max([b['percent'] for b in buckets] or [0])
     weekly = [b['percent'] for b in buckets if b['group'] != 'session']
     session = [b['percent'] for b in buckets if b['group'] == 'session']