claude-multiacc 2.0.21 → 2.0.22

package/tests/run-tests.sh

@@ -1563,6 +1563,12 @@ expected="$(cat "$WORK/stdin13")"
 [ "$out" = "$expected" ] && t_ok "stdin/stdout byte fidelity (-p pipe)" || t_fail "stdin fidelity" "got: $out"
 
 # ---- 14. selection log written ------------------------------------------------
+# One COMPLETE reading first, on purpose: the pool is still carrying the session-only
+# documents an earlier limits pass wrote, and since 2026-09-04 a pool where no account
+# has BOTH percentages is BLIND (bin/claude telem_blind) and logs the blind format
+# instead. The ranked format asserted below only exists when something actually ranked.
+lj 20 10 20 > "$ACC/acct-01/limits.json"
+claude >/dev/null 2>&1
 log_pattern='^[0-9]{4}-[0-9]{2}-[0-9]{2}T.*acct-0[123] weekly=[0-9?]+% session=[0-9?]+%'
 log_pattern="$log_pattern band=30 band-count=[0-9]+ session-gate=50 session-ok=[0-9]+ pwd="
 grep -qE "$log_pattern" "$ACC/selection.log" \
@@ -2065,6 +2071,611 @@ sc="$(python3 -c "import json;d=json.load(open('$ACC/acct-01/limits.json'));prin
   || t_fail "weekly/session ranking inputs" "got $sc"
 rm -f "$ACC/acct-01/limits.json" "$ACC/acct-01/.limited"
 
+# ---- 16-nodata. a 0% bucket with NO reset window is NO DATA, not an empty account ----
+# 2026-09-04, my-mini: for acct-13/acct-14 the usage endpoint answered EVERY bucket
+# `percent: 0, resets_at: null` while Claude Code was being rejected on those same two
+# accounts with "You've hit your weekly limit · resets Sep 8 at 1am" (epoch 1788818400).
+# The writer recorded the zeros verbatim, so two provably exhausted accounts became the
+# leaders of the weekly band and absorbed 31 of the last ~60 picks — and the shim's
+# telemetry-based recovery then deleted their truthful client:seven_day markers about six
+# times a day each. A truthful bucket ALWAYS carries the window it resets in, so 0% with
+# no window is no data. These run in a pool of their own: one no-data account against one
+# honest one makes "which account ranked" unambiguous.
+ND="$WORK/nodata-pool"
+mkdir -p "$ND/acct-01" "$ND/acct-02" "$ND/tmp"
+: > "$ND/.limits-kick"
+cat > "$ND/accounts.json" <<'EOF'
+{"version":1,"server":"none","threshold":90,"accounts":[
+  {"id":"acct-01","email":"nd1@test","home":"mac","added_at":"2026-07-13T00:00:00Z"},
+  {"id":"acct-02","email":"nd2@test","home":"mac","added_at":"2026-07-13T00:00:00Z"}]}
+EOF
+for i in 01 02; do
+  printf '{"claudeAiOauth":{"accessToken":"sk-ant-oat01-nd%s","refreshToken":"r","expiresAt":9999999999999,"refreshTokenExpiresAt":9999999999999}}' \
+    "$i" > "$ND/acct-$i/.credentials.json"
+done
+ndl() { # ndl <weekly> <session> <max> -> a truthful, in-window reading on stdout
+  local t; t="$(date +%s)"
+  printf '{"fetched_at":%s,"source":"oauth","weekly_percent":%s,"session_percent":%s,"max_percent":%s,"weekly_resets_epoch":%s,"buckets":[]}' \
+    "$t" "$1" "$2" "$3" "$((t + 259200))"
+}
+ndlimits() { # ndlimits <fixture> [extra args] -> a real refresh over the whole ND pool
+  local f="$1"; shift
+  CLAUDE_ACCOUNTS_ROOT="$ND" CLAUDE_MULTIACC_USAGE_URL="file://$f" \
+    claude-accounts limits --force "$@" 2>&1
+}
+
+# the incident payload, byte-for-byte in shape: every bucket 0%, every window null
+cat > "$WORK/usage-allzero.json" <<'EOF'
+{"limits":[
+  {"kind":"session","group":"session","percent":0,"resets_at":null,"scope":null},
+  {"kind":"weekly_all","group":"weekly","percent":0,"resets_at":null,"scope":null},
+  {"kind":"weekly_scoped","group":"weekly","percent":0,"resets_at":null,"scope":{"model":{"display_name":"Fable"}}}
+]}
+EOF
+out="$(ndlimits "$WORK/usage-allzero.json")"
+check "an all-zero/no-window payload is reported as no usable telemetry" \
+  "no usable telemetry (account ranks as unknown, not as empty)" "$out"
+python3 - "$ND/acct-01/limits.json" <<'EOF'
+import json, sys
+d = json.load(open(sys.argv[1]))
+assert d.get('no_data') is True, d
+# A MISSING field is what makes the shim's fresh_field/cutoff_field reads fail, which
+# is what makes the account unknown to both cuts. Writing 0 here is the bug.
+for k in ('max_percent', 'weekly_percent', 'session_percent', 'weekly_resets_epoch'):
+    assert k not in d, (k, d)
+assert len(d['buckets']) == 3, d          # the raw buckets stay, for diagnostics
+assert d['fetched_at'] > 0 and d['source'], d
+EOF
+[ $? -eq 0 ] && t_ok "a no-data pass records no_data and NONE of the three percent signals" \
+  || t_fail "no_data document" "see $ND/acct-01/limits.json"
+
+# ONE uninformative bucket beside real ones changes nothing (the live acct-16 shape:
+# weekly_scoped:Fable 0/null next to a real session and a real weekly_all).
+cat > "$WORK/usage-mixed-nodata.json" <<'EOF'
+{"limits":[
+  {"kind":"session","group":"session","percent":12,"resets_at":"2099-01-01T00:00:00+00:00","scope":null},
+  {"kind":"weekly_all","group":"weekly","percent":40,"resets_at":"2099-01-05T00:00:00+00:00","scope":null},
+  {"kind":"weekly_scoped","group":"weekly","percent":0,"resets_at":null,"scope":{"model":{"display_name":"Fable"}}}
+]}
+EOF
+ndlimits "$WORK/usage-mixed-nodata.json" --quiet >/dev/null
+python3 - "$ND/acct-01/limits.json" <<'EOF'
+import json, sys, time, calendar
+d = json.load(open(sys.argv[1]))
+assert 'no_data' not in d, d
+assert (d['session_percent'], d['weekly_percent'], d['max_percent']) == (12, 40, 40), d
+want = calendar.timegm(time.strptime("2099-01-05T00:00:00", "%Y-%m-%dT%H:%M:%S"))
+assert d['weekly_resets_epoch'] == want, d
+assert len(d['buckets']) == 3, d          # the quiet bucket is still recorded
+EOF
+[ $? -eq 0 ] && t_ok "one uninformative bucket beside real ones leaves the ranking untouched (12/40)" \
+  || t_fail "mixed no-data payload" "see $ND/acct-01/limits.json"
+
+# 0% WITH a real window is informative: a genuinely fresh account must still rank empty.
+cat > "$WORK/usage-zero-real-windows.json" <<'EOF'
+{"limits":[
+  {"kind":"session","group":"session","percent":0,"resets_at":"2099-01-01T00:00:00+00:00","scope":null},
+  {"kind":"weekly_all","group":"weekly","percent":0,"resets_at":"2099-01-05T00:00:00+00:00","scope":null}
+]}
+EOF
+ndlimits "$WORK/usage-zero-real-windows.json" --quiet >/dev/null
+python3 - "$ND/acct-01/limits.json" <<'EOF'
+import json, sys
+d = json.load(open(sys.argv[1]))
+assert 'no_data' not in d, d
+assert (d['session_percent'], d['weekly_percent'], d['max_percent']) == (0, 0, 0), d
+EOF
+[ $? -eq 0 ] && t_ok "0% WITH real reset windows still records a real, empty 0% reading" \
+  || t_fail "zero-with-windows payload" "see $ND/acct-01/limits.json"
+
+# ...and the horizon that 0% is valid until comes from the bucket that reported one. A
+# null-window sibling's synthesized now+1h used to win the min() and shorten it.
+cat > "$WORK/usage-zero-mixed-window.json" <<'EOF'
+{"limits":[
+  {"kind":"session","group":"session","percent":0,"resets_at":"2099-01-01T00:00:00+00:00","scope":null},
+  {"kind":"weekly_all","group":"weekly","percent":0,"resets_at":"2099-01-05T00:00:00+00:00","scope":null},
+  {"kind":"weekly_scoped","group":"weekly","percent":0,"resets_at":null,"scope":{"model":{"display_name":"Fable"}}}
+]}
+EOF
+ndlimits "$WORK/usage-zero-mixed-window.json" --quiet >/dev/null
+python3 - "$ND/acct-01/limits.json" <<'EOF'
+import json, sys, time, calendar
+d = json.load(open(sys.argv[1]))
+want = calendar.timegm(time.strptime("2099-01-05T00:00:00", "%Y-%m-%dT%H:%M:%S"))
+assert d['weekly_percent'] == 0 and d['weekly_resets_epoch'] == want, d
+EOF
+[ $? -eq 0 ] && t_ok "a window-less bucket cannot shorten the horizon a real 0% reading is valid for" \
+  || t_fail "no-data horizon" "see $ND/acct-01/limits.json"
+
+# ---- 16-nodata-rank. an unknown account never leads the weekly band ------------------
+# The whole point of the rule: 0/0 ranked BETTER than a truthful 45% account, so every
+# pick went to the exhausted one. Unknown must lose to any account with a real reading.
+ndlimits "$WORK/usage-allzero.json" --quiet >/dev/null
+ndl 45 10 45 > "$ND/acct-02/limits.json"
+rm -f "$ND/.pick-seq" "$ND"/acct-0*/.last-pick "$ND"/acct-0*/.limited
+: > "$ND/selection.log"
+nd_hits=0
+for _ in $(seq 1 10); do
+  case "$(CLAUDE_ACCOUNTS_ROOT="$ND" claude 2>&1)" in *CFG=acct-01*) nd_hits=$((nd_hits+1)) ;; esac
+done
+[ "$nd_hits" = "0" ] \
+  && t_ok "a no-data account never outranks an account with real telemetry (0 of 10 picks)" \
+  || t_fail "no_data ranking" "the fake-zero account took $nd_hits of 10 picks"
+grep -q "acct-02 weekly=45% session=10% band=30 band-count=1" "$ND/selection.log" \
+  && t_ok "the pick logs the known account alone in the band" \
+  || t_fail "no_data band" "selection.log: $(tail -1 "$ND/selection.log" 2>/dev/null)"
+grep -q "acct-01 weekly=0%" "$ND/selection.log" \
+  && t_fail "no_data band leader" "the fake-zero account was logged as a 0% pick" \
+  || t_ok "the fake-zero account is never logged as the band leader"
+
+# ---- 16-nodata-marker. a client-reported WEEKLY rejection outlives any telemetry -----
+# The second half of the incident. Claude Code's own rejection wrote
+# `bucket=client:seven_day percent=100 reason=client-rate-limit` with the server's reset
+# (Sep 8); the next invocation read the fake 0%, called it newer first-hand evidence and
+# deleted the marker. A seven-day window cannot fall from a server-proven 100% to under
+# the threshold before it resets, so no reading may clear it — however fresh and however
+# informative. Here acct-01's telemetry is a REAL 5%, so only the bucket rule can save it.
+ndl 5 5 5 > "$ND/acct-01/limits.json"
+ndl 45 10 45 > "$ND/acct-02/limits.json"
+printf '%s\nbucket=client:seven_day percent=100 marked_at=2020-01-01T00:00:00Z reason=client-rate-limit\n' \
+  "$(( $(date +%s) + 345600 ))" > "$ND/acct-01/.limited"
+rm -f "$ND"/acct-0*/.client-limit-cleared "$ND/.pick-seq" "$ND"/acct-0*/.last-pick
+: > "$ND/selection.log"
+w_hits=0
+for _ in $(seq 1 6); do
+  case "$(CLAUDE_ACCOUNTS_ROOT="$ND" claude 2>&1)" in *CFG=acct-01*) w_hits=$((w_hits+1)) ;; esac
+done
+{ [ -f "$ND/acct-01/.limited" ] && [ "$w_hits" = "0" ]; } \
+  && t_ok "a client:seven_day marker survives fresh below-threshold telemetry" \
+  || t_fail "weekly client marker" "marker=$([ -f "$ND/acct-01/.limited" ] && echo kept || echo DELETED) hits=$w_hits"
+grep -q "client limit cleared by newer telemetry" "$ND/selection.log" \
+  && t_fail "weekly client marker" "the shim logged a recovery for a weekly rejection" \
+  || t_ok "no recovery event is logged for a weekly rejection"
+[ ! -f "$ND/acct-01/.client-limit-cleared" ] \
+  && t_ok "no recovery watermark is written for a weekly rejection" \
+  || t_fail "weekly client marker" "a watermark was written"
+# case-insensitive on the bucket name: seven_day_opus is weekly too
+printf '%s\nbucket=client:Seven_Day_Opus percent=100 marked_at=2020-01-01T00:00:00Z reason=client-rate-limit\n' \
+  "$(( $(date +%s) + 345600 ))" > "$ND/acct-01/.limited"
+CLAUDE_ACCOUNTS_ROOT="$ND" claude >/dev/null 2>&1
+[ -f "$ND/acct-01/.limited" ] && t_ok "a model-scoped weekly bucket (seven_day_opus) is weekly too" \
+  || t_fail "weekly client marker" "seven_day_opus was cleared"
+
+# ...but the 5h window self-heals within hours, so #22 (2026-09-03) still holds: a
+# five_hour marker DOES clear once a below-threshold reading was fetched after it.
+printf '%s\nbucket=client:five_hour percent=100 marked_at=2020-01-01T00:00:00Z reason=client-rate-limit\n' \
+  "$(( $(date +%s) + 1800 ))" > "$ND/acct-01/.limited"
+rm -f "$ND/acct-01/.client-limit-cleared"
+: > "$ND/selection.log"
+CLAUDE_ACCOUNTS_ROOT="$ND" claude >/dev/null 2>&1
+[ ! -f "$ND/acct-01/.limited" ] \
+  && t_ok "a client:five_hour marker still clears on newer below-threshold telemetry (#22)" \
+  || t_fail "five_hour client marker" "the 2026-09-03 recovery stopped working"
+[ -f "$ND/acct-01/.client-limit-cleared" ] \
+  && t_ok "the five_hour recovery still records its watermark" \
+  || t_fail "five_hour client marker" "watermark missing"
+grep -q "acct-01 client limit cleared by newer telemetry (5%)" "$ND/selection.log" \
+  && t_ok "the five_hour recovery still logs the reading it acted on" \
+  || t_fail "five_hour client marker" "selection.log: $(tail -2 "$ND/selection.log" 2>/dev/null | tr '\n' ' ')"
+
+# ---- 16-nodata-shorten. an offender pass must never SHORTEN a weekly client marker ---
+# The writer's offenders branch used to overwrite `.limited` unconditionally: a session
+# bucket crossing the threshold (+1h reset) replaced a client:seven_day marker four days
+# out, and after that hour the provably exhausted account was back in the pool (codex
+# review, 2026-09-04). The client's own reset reaches further and must win.
+printf '%s\nbucket=client:seven_day percent=100 marked_at=2020-01-01T00:00:00Z reason=client-rate-limit\n' \
+  "$(( $(date +%s) + 345600 ))" > "$ND/acct-01/.limited"
+keep_reset_before="$(head -1 "$ND/acct-01/.limited")"
+python3 - "$WORK/usage-shorten.json" <<'PJ'
+import json, sys, datetime
+soon = (datetime.datetime.now(datetime.timezone.utc) + datetime.timedelta(hours=1)).isoformat()
+json.dump({"limits": [
+    {"kind": "session", "percent": 95, "resets_at": soon},
+    {"kind": "seven_day", "percent": 0, "resets_at": None},
+]}, open(sys.argv[1], 'w'))
+PJ
+CLAUDE_ACCOUNTS_ROOT="$ND" CLAUDE_MULTIACC_USAGE_URL="file://$WORK/usage-shorten.json" \
+  claude-accounts limits --force --quiet >/dev/null 2>&1
+{ [ -f "$ND/acct-01/.limited" ] && [ "$(head -1 "$ND/acct-01/.limited")" = "$keep_reset_before" ] \
+  && grep -q 'reason=client-rate-limit' "$ND/acct-01/.limited"; } \
+  && t_ok "an over-threshold session pass keeps the further-reaching weekly client marker" \
+  || t_fail "marker shortened" "now: $(head -2 "$ND/acct-01/.limited" 2>/dev/null | tr '\n' ' ')"
+# ...while a LATER reset may still extend the exclusion (more caution is allowed):
+python3 - "$WORK/usage-extend.json" <<'PJ'
+import json, sys, datetime
+far = (datetime.datetime.now(datetime.timezone.utc) + datetime.timedelta(days=6)).isoformat()
+json.dump({"limits": [
+    {"kind": "seven_day", "percent": 95, "resets_at": far},
+]}, open(sys.argv[1], 'w'))
+PJ
+CLAUDE_ACCOUNTS_ROOT="$ND" CLAUDE_MULTIACC_USAGE_URL="file://$WORK/usage-extend.json" \
+  claude-accounts limits --force --quiet >/dev/null 2>&1
+{ [ -f "$ND/acct-01/.limited" ] && [ "$(head -1 "$ND/acct-01/.limited")" -gt "$keep_reset_before" ]; } \
+  && t_ok "a further-out offender may still extend the marker" \
+  || t_fail "marker extend" "now: $(head -2 "$ND/acct-01/.limited" 2>/dev/null | tr '\n' ' ')"
+rm -f "$ND"/acct-0*/.limited "$ND"/acct-0*/.client-limit-cleared
+# ...and a GARBLED client marker (a first line the shims' num_ok would refuse) must not
+# be preserved by that guard: to the shims it is an active-forever park, so the writer
+# replacing it with a valid offender marker is a repair, not a shortening.
+printf '9999999999999999999\nbucket=client:seven_day reason=client-rate-limit\n' > "$ND/acct-01/.limited"
+CLAUDE_ACCOUNTS_ROOT="$ND" CLAUDE_MULTIACC_USAGE_URL="file://$WORK/usage-shorten.json" \
+  claude-accounts limits --force --quiet >/dev/null 2>&1
+{ [ -f "$ND/acct-01/.limited" ] && grep -q 'reason=limits' "$ND/acct-01/.limited"; } \
+  && t_ok "a garbled client marker is repaired by the offender write, not preserved" \
+  || t_fail "garbled marker repair" "now: $(head -2 "$ND/acct-01/.limited" 2>/dev/null | tr '\n' ' ')"
+rm -f "$ND"/acct-0*/.limited "$ND"/acct-0*/.client-limit-cleared
+
+# ---- 16-nodata-noclear. an uninformative reading cannot clear ANY marker -------------
+# End to end, in the incident's own order: the fake-zero payload goes through the real
+# writer, then a five_hour marker (the kind that IS allowed to clear) is planted on top.
+# Pre-fix that pass wrote max_percent 0 and the very next invocation deleted the marker
+# with "client limit cleared by newer telemetry (0%)". A reading with no percent at all
+# reads as unknown, and unknown proves nothing.
+ndlimits "$WORK/usage-allzero.json" --quiet >/dev/null
+ndl 45 10 45 > "$ND/acct-02/limits.json"
+printf '%s\nbucket=client:five_hour percent=100 marked_at=2020-01-01T00:00:00Z reason=client-rate-limit\n' \
+  "$(( $(date +%s) + 1800 ))" > "$ND/acct-01/.limited"
+rm -f "$ND/acct-01/.client-limit-cleared" "$ND/.pick-seq" "$ND"/acct-0*/.last-pick
+: > "$ND/selection.log"
+for _ in 1 2 3; do CLAUDE_ACCOUNTS_ROOT="$ND" claude >/dev/null 2>&1; done
+[ -f "$ND/acct-01/.limited" ] \
+  && t_ok "a limits.json with no percent fields cannot clear even a five_hour marker" \
+  || t_fail "no_data marker clearing" "fake-zero telemetry unparked the account"
+grep -q "client limit cleared" "$ND/selection.log" \
+  && t_fail "no_data marker clearing" "a recovery was logged from a no-data reading" \
+  || t_ok "no recovery is logged from a no-data reading"
+[ ! -f "$ND/acct-01/.client-limit-cleared" ] \
+  && t_ok "no recovery watermark is written from a no-data reading" \
+  || t_fail "no_data marker clearing" "a watermark was written from a reading with no percent"
+rm -f "$ND"/acct-0*/.limited "$ND"/acct-0*/.client-limit-cleared
+
+# ---- 16-nodata-writer. the LIMITS PASS obeys the same marker rule as the shim --------
+# The shim's rule above is only half a fix. `claude-accounts limits` runs on a 15-minute
+# schedule and deletes markers itself, and until 2026-09-04 it kept a client rejection
+# only while it was newer than CLIENT_LIMIT_CONFIRM_DELAY (300s) — so five minutes after
+# the shim refused to unpark acct-13, the scheduled pass deleted the same client:seven_day
+# marker anyway, on a payload whose every bucket said `percent 0, resets_at null`. Two
+# writers with two rules is one rule: the weaker one. This is the claude twin of the codex
+# C13c block, and the pass is driven for real (fixture endpoint -> writer -> disk).
+nd_mark() { # nd_mark <acct dir> <bucket> <reset-offset-seconds> <marked_at ISO>
+  printf '%s\nbucket=%s percent=100 marked_at=%s reason=client-rate-limit\n' \
+    "$(( $(date +%s) + $3 ))" "$2" "$4" > "$1/.limited"
+}
+nd_acct01_log() { printf '%s' "$1" | grep 'acct-01' | tr '\n' ' '; }
+# A REAL, informative, below-threshold reading: the kind that IS allowed to clear a
+# five-hour marker, and the one that must never clear a weekly one.
+cat > "$WORK/usage-nd-low.json" <<'EOF'
+{"limits":[
+  {"kind":"session","group":"session","percent":5,"resets_at":"2099-01-01T00:00:00+00:00","scope":null},
+  {"kind":"weekly_all","group":"weekly","percent":5,"resets_at":"2099-01-05T00:00:00+00:00","scope":null}
+]}
+EOF
+
+# (1) A pass that reported nothing proves nothing, so it clears nothing — whatever the
+# marker says and however old it is. On origin/main this marker is 300s past its confirm
+# delay and the pass deletes it with "marker cleared (max 0%)".
+nd_mark "$ND/acct-01" client:seven_day 345600 2020-01-01T00:00:00Z
+rm -f "$ND/acct-01/.client-limit-cleared"
+out="$(ndlimits "$WORK/usage-allzero.json")"
+{ [ -f "$ND/acct-01/.limited" ] && [ ! -f "$ND/acct-01/.client-limit-cleared" ] \
+  && printf '%s' "$out" | grep -q "acct-01: marker kept (no usable telemetry)"; } \
+  && t_ok "a no-data limits pass keeps an aged client:seven_day marker, and logs that it kept it" \
+  || t_fail "writer marker: no-data pass" \
+     "marker=$([ -f "$ND/acct-01/.limited" ] && echo kept || echo DELETED) log: $(nd_acct01_log "$out")"
+
+# (2) ...and a pass that DID report something still cannot clear a weekly rejection
+# before its reset: a seven-day window cannot fall from the server-proven 100% that
+# wrote the marker to 5% while it is still open. The keep must come from the BUCKET
+# rule, not from silence, so the "no usable telemetry" line must NOT appear here.
+nd_mark "$ND/acct-01" client:seven_day 345600 2020-01-01T00:00:00Z
+rm -f "$ND/acct-01/.client-limit-cleared"
+out="$(ndlimits "$WORK/usage-nd-low.json")"
+{ [ -f "$ND/acct-01/.limited" ] && [ ! -f "$ND/acct-01/.client-limit-cleared" ] \
+  && ! printf '%s' "$out" | grep -q "acct-01: marker cleared" \
+  && ! printf '%s' "$out" | grep -q "acct-01: marker kept (no usable telemetry)"; } \
+  && t_ok "an informative 5% pass keeps a client:seven_day marker on the bucket rule alone" \
+  || t_fail "writer marker: weekly vs informative pass" \
+     "marker=$([ -f "$ND/acct-01/.limited" ] && echo kept || echo DELETED) log: $(nd_acct01_log "$out")"
+
+# (3) The 5h window self-heals in hours, so #22 (2026-09-03) still holds at the writer:
+# an aged five_hour rejection DOES clear once a pass has real numbers under the
+# threshold. This one passes on origin/main too — deliberately: it is the guard against
+# over-correcting (2) into "no client marker ever clears", which would strand accounts
+# sitting at 0% usage for days, which is the bug #22 existed to fix.
+nd_mark "$ND/acct-01" client:five_hour 1800 2020-01-01T00:00:00Z
+rm -f "$ND/acct-01/.client-limit-cleared"
+out="$(ndlimits "$WORK/usage-nd-low.json")"
+{ [ ! -f "$ND/acct-01/.limited" ] && [ -f "$ND/acct-01/.client-limit-cleared" ] \
+  && printf '%s' "$out" | grep -q "acct-01: marker cleared (max 5%)"; } \
+  && t_ok "an informative 5% pass still clears an aged client:five_hour marker (#22)" \
+  || t_fail "writer marker: five_hour recovery" \
+     "marker=$([ -f "$ND/acct-01/.limited" ] && echo kept || echo DELETED) log: $(nd_acct01_log "$out")"
+
+# (4) ...but the SAME five_hour marker survives a pass that said nothing. "0%" and "no
+# reading" are the same bytes on origin/main, and that is the whole incident.
+nd_mark "$ND/acct-01" client:five_hour 1800 2020-01-01T00:00:00Z
+rm -f "$ND/acct-01/.client-limit-cleared"
+out="$(ndlimits "$WORK/usage-allzero.json")"
+{ [ -f "$ND/acct-01/.limited" ] && [ ! -f "$ND/acct-01/.client-limit-cleared" ] \
+  && printf '%s' "$out" | grep -q "acct-01: marker kept (no usable telemetry)"; } \
+  && t_ok "a no-data pass keeps even a client:five_hour marker — the kind it may clear when informative" \
+  || t_fail "writer marker: five_hour vs no-data pass" \
+     "marker=$([ -f "$ND/acct-01/.limited" ] && echo kept || echo DELETED) log: $(nd_acct01_log "$out")"
+rm -f "$ND"/acct-0*/.limited "$ND"/acct-0*/.client-limit-cleared
+
+# ---- 16-nodata-signals. each ranking signal comes from a bucket of its OWN kind ------
+# 2026-09-04, second defect: weekly_percent fell back to the overall peak and
+# session_percent to a flat 0. So an account whose weekly buckets said nothing while its
+# 5h bucket read 40% was recorded as 40% WEEKLY — a number no bucket ever reported, on
+# the signal the band ranks on — and its mirror image was recorded as session 0%, which
+# walks straight through the session gate. A signal nobody reported must be ABSENT: the
+# shim needs BOTH readings to call an account known (pick_best's quota_known rule), so a
+# missing one costs the account its place in the band and nothing else.
+cat > "$WORK/usage-session-only.json" <<'EOF'
+{"limits":[
+  {"kind":"session","group":"session","percent":40,"resets_at":"2099-01-01T00:00:00+00:00","scope":null},
+  {"kind":"weekly_all","group":"weekly","percent":0,"resets_at":null,"scope":null},
+  {"kind":"weekly_scoped","group":"weekly","percent":0,"resets_at":null,"scope":{"model":{"display_name":"Fable"}}}
+]}
+EOF
+ndlimits "$WORK/usage-session-only.json" --quiet >/dev/null
+python3 - "$ND/acct-01/limits.json" <<'EOF'
+import json, sys
+d = json.load(open(sys.argv[1]))
+assert 'no_data' not in d, d                    # one bucket DID report: this is a reading
+assert (d['session_percent'], d['max_percent']) == (40, 40), d
+# The two weekly buckets said `0% / no window`. Recording 40 here (round 1's fallback to
+# the overall peak) or 0 (origin/main's max over silent weekly buckets) both invent the
+# only number the weekly band ranks on.
+assert 'weekly_percent' not in d, d
+assert 'weekly_resets_epoch' not in d, d        # a horizon without a reading means nothing
+EOF
+[ $? -eq 0 ] && t_ok "a session-only reading records session+max and NO weekly_percent" \
+  || t_fail "session-only signals" "see $ND/acct-01/limits.json"
+
+# ...and the shim reads that as UNKNOWN, so a truthful 30w/10s account takes every pick.
+ndl 30 10 30 > "$ND/acct-02/limits.json"
+rm -f "$ND/.pick-seq" "$ND"/acct-0*/.last-pick "$ND"/acct-0*/.limited
+: > "$ND/selection.log"
+nd_sess_hits=0
+for _ in $(seq 1 10); do
+  case "$(CLAUDE_ACCOUNTS_ROOT="$ND" claude 2>&1)" in *CFG=acct-01*) nd_sess_hits=$((nd_sess_hits+1)) ;; esac
+done
+[ "$nd_sess_hits" = "0" ] \
+  && t_ok "an account with no weekly reading never enters the band (0 of 10 picks)" \
+  || t_fail "session-only ranking" "the weekly-less account took $nd_sess_hits of 10 picks"
+
+# The mirror image: a weekly reading with nothing to say about the session bucket. Here
+# the rival is WORSE on weekly (80 against 37) and still wins every pick, because it is
+# the only candidate that can clear the session gate — which is exactly what a fabricated
+# `session_percent: 0` would have handed the silent account for free.
+cat > "$WORK/usage-weekly-only.json" <<'EOF'
+{"limits":[
+  {"kind":"session","group":"session","percent":0,"resets_at":null,"scope":null},
+  {"kind":"weekly_all","group":"weekly","percent":37,"resets_at":"2099-01-05T00:00:00+00:00","scope":null}
+]}
+EOF
+ndlimits "$WORK/usage-weekly-only.json" --quiet >/dev/null
+python3 - "$ND/acct-01/limits.json" <<'EOF'
+import json, sys, time, calendar
+d = json.load(open(sys.argv[1]))
+assert 'no_data' not in d, d
+assert (d['weekly_percent'], d['max_percent']) == (37, 37), d
+assert d['weekly_resets_epoch'] == calendar.timegm(
+    time.strptime("2099-01-05T00:00:00", "%Y-%m-%dT%H:%M:%S")), d
+assert 'session_percent' not in d, d             # the 5h bucket reported nothing at all
+EOF
+[ $? -eq 0 ] && t_ok "a weekly-only reading records weekly+max+horizon and NO session_percent" \
+  || t_fail "weekly-only signals" "see $ND/acct-01/limits.json"
+ndl 80 10 80 > "$ND/acct-02/limits.json"
+rm -f "$ND/.pick-seq" "$ND"/acct-0*/.last-pick "$ND"/acct-0*/.limited
+: > "$ND/selection.log"
+nd_wk_hits=0
+for _ in $(seq 1 6); do
+  case "$(CLAUDE_ACCOUNTS_ROOT="$ND" claude 2>&1)" in *CFG=acct-01*) nd_wk_hits=$((nd_wk_hits+1)) ;; esac
+done
+[ "$nd_wk_hits" = "0" ] \
+  && t_ok "an unknown session reading never clears the gate, even with the better weekly (0 of 6)" \
+  || t_fail "weekly-only gate" "the session-less account cleared the gate $nd_wk_hits of 6 times"
+grep -q "acct-02 weekly=80% session=10% band=30 band-count=1 session-gate=50 session-ok=1" "$ND/selection.log" \
+  && t_ok "the log shows one account clearing the gate and one band member" \
+  || t_fail "weekly-only gate log" "$(tail -1 "$ND/selection.log" 2>/dev/null)"
+
+# ---- 16-nodata-blind. a fresh timestamp is not a usable reading ---------------------
+# The third face of the same defect: blindness was judged on fetched_at alone, so a pool
+# of freshly-written no_data documents looked FRESH — selection.log carried no
+# ranking=BLIND line, `status` said nothing was wrong, and every account read as unknown,
+# which is a pool-wide coin flip. An outage that reports itself as healthy is the eleven
+# days of 2026-08-11 all over again, this time with a current timestamp on it.
+ndlimits "$WORK/usage-allzero.json" --quiet >/dev/null      # BOTH accounts: no_data
+rm -f "$ND/.pick-seq" "$ND"/acct-0*/.last-pick "$ND"/acct-0*/.limited
+: > "$ND/selection.log"
+CLAUDE_ACCOUNTS_ROOT="$ND" claude >/dev/null 2>&1
+grep -qE "ranking=BLIND telemetry-age=[0-9]{1,2}s band=30 band-count=2 session-gate=50 session-ok=0 pwd=" \
+  "$ND/selection.log" \
+  && t_ok "an all-no_data pool logs ranking=BLIND although its telemetry is seconds old" \
+  || t_fail "no_data blindness" "$(tail -1 "$ND/selection.log" 2>/dev/null)"
+out="$(CLAUDE_ACCOUNTS_ROOT="$ND" claude-accounts status 2>&1)"
+check "status calls an all-no_data pool blind" "RANKING IS BLIND" "$out"
+# ...and says which KIND of blind, because the two take opposite advice. The eleven-day
+# 2026-08 outage was stale telemetry — fetch again, then log in. This one is current
+# telemetry that says nothing: the credential is working perfectly, so sending the
+# operator to `claude-accounts login` is sending them after a fault that does not exist.
+check "the no_data banner names the endpoint, not the login" \
+  "Those fetches authenticated; a re-login does NOT fix this" "$out"
+case "$out" in
+  *"claude-accounts login <acct-NN>"*)
+    t_fail "no_data banner fix line" "a current-but-unusable pool was told to re-login" ;;
+  *) t_ok "the no_data banner does not prescribe a re-login" ;;
+esac
+CLAUDE_ACCOUNTS_ROOT="$ND" claude-accounts list --json > "$ND/nodata.json" 2>/dev/null
+python3 - "$ND/nodata.json" <<'EOF'
+import json, sys
+d = json.load(open(sys.argv[1]))
+assert d['summary']['telemetry'] == 'blind', d['summary']
+assert d['summary']['ranking_blind'] is True, d['summary']
+for a in d['accounts']:
+    u = a['usage']
+    # The panel has to be able to tell THIS outage from the eleven-day one: the readings
+    # are current (not stale), they simply carry nothing to rank on.
+    assert u['no_data'] is True, a
+    assert u['stale'] is False, a
+    assert u['weekly_percent'] is None and u['session_percent'] is None, a
+EOF
+[ $? -eq 0 ] && t_ok "--json reports ranking_blind with per-account no_data on fresh readings" \
+  || t_fail "json no_data blindness" "see $ND/nodata.json"
+
+# One real reading is enough to rank the pool, and it must take the picks. A no_data
+# neighbour is unknown, not free.
+ndl 30 10 30 > "$ND/acct-02/limits.json"
+: > "$ND/selection.log"
+rm -f "$ND/.pick-seq" "$ND"/acct-0*/.last-pick
+nd_mix_hits=0
+for _ in $(seq 1 6); do
+  case "$(CLAUDE_ACCOUNTS_ROOT="$ND" claude 2>&1)" in *CFG=acct-02*) nd_mix_hits=$((nd_mix_hits+1)) ;; esac
+done
+{ [ "$nd_mix_hits" = "6" ] && ! grep -q "ranking=BLIND" "$ND/selection.log"; } \
+  && t_ok "one no_data account beside a real one leaves the pool ranking, and the real one wins 6/6" \
+  || t_fail "mixed no_data pool" "acct-02 took $nd_mix_hits of 6; $(tail -1 "$ND/selection.log" 2>/dev/null)"
+CLAUDE_ACCOUNTS_ROOT="$ND" claude-accounts list --json > "$ND/nodata-mixed.json" 2>/dev/null
+python3 - "$ND/nodata-mixed.json" <<'EOF'
+import json, sys
+d = json.load(open(sys.argv[1]))
+assert d['summary']['telemetry'] == 'fresh', d['summary']
+assert d['summary']['ranking_blind'] is False, d['summary']
+byid = {a['id']: a for a in d['accounts']}
+assert byid['acct-01']['usage']['no_data'] is True, byid['acct-01']
+# true-only: an ordinary reading must carry the shape every consumer already knows
+assert 'no_data' not in byid['acct-02']['usage'], byid['acct-02']
+EOF
+[ $? -eq 0 ] && t_ok "--json calls the mixed pool fresh and flags only the no_data account" \
+  || t_fail "json mixed no_data" "see $ND/nodata-mixed.json"
+
+# ...and a no_data document is never DEGRADABLE. Degraded ranking exists for stale
+# readings that are still true (a weekly bucket only rises until its reset); a document
+# with no weekly reading and no horizon has nothing to be true. It must drag the pool to
+# BLIND rather than let one neighbour's stale number rank alone.
+printf '{"fetched_at":%s,"source":"oauth","no_data":true,"buckets":[]}' "$(date +%s)" \
+  > "$ND/acct-01/limits.json"
+printf '{"fetched_at":%s,"weekly_percent":4,"session_percent":0,"max_percent":4,"weekly_resets_epoch":%s,"buckets":[]}' \
+  "$(( $(date +%s) - 950000 ))" "$(( $(date +%s) + 200000 ))" > "$ND/acct-02/limits.json"
+: > "$ND/selection.log"
+rm -f "$ND/.pick-seq" "$ND"/acct-0*/.last-pick
+CLAUDE_ACCOUNTS_ROOT="$ND" claude >/dev/null 2>&1
+{ grep -q "ranking=BLIND" "$ND/selection.log" && ! grep -q "ranking=DEGRADED" "$ND/selection.log"; } \
+  && t_ok "an in-window no_data candidate turns degraded ranking off for the whole pool" \
+  || t_fail "no_data degraded" "$(tail -1 "$ND/selection.log" 2>/dev/null)"
+# the same holds once the no_data document itself goes stale (nothing to rank, ever)
+printf '{"fetched_at":%s,"source":"oauth","no_data":true,"buckets":[]}' "$(( $(date +%s) - 950000 ))" \
+  > "$ND/acct-01/limits.json"
+: > "$ND/selection.log"
+rm -f "$ND/.pick-seq" "$ND"/acct-0*/.last-pick
+CLAUDE_ACCOUNTS_ROOT="$ND" claude >/dev/null 2>&1
+{ grep -q "ranking=BLIND" "$ND/selection.log" && ! grep -q "ranking=DEGRADED" "$ND/selection.log"; } \
+  && t_ok "a stale no_data document is not degradable either" \
+  || t_fail "stale no_data degraded" "$(tail -1 "$ND/selection.log" 2>/dev/null)"
+rm -f "$ND"/acct-0*/.limited "$ND"/acct-0*/.client-limit-cleared
+
+# ---- 16-onefield-blind. HALF a reading is not a reading -----------------------------
+# The same defect one layer in, and the one the round-2 fix walked past. Blindness was
+# taught to reject a no_data document — but it accepted one carrying EITHER percentage,
+# while pick_best has always needed BOTH (the quota_known rule) before it will call an
+# account known. The writer emits exactly those half documents, per signal, whenever one
+# group of buckets goes silent (16-nodata-signals above). So a pool whose every reading
+# was session-only tied every account, picked uniformly at RANDOM, logged no
+# ranking=BLIND, and had `status` calling the telemetry fresh — the 2026-08 outage's
+# defining symptom, with a current timestamp on it. Blind is blind however the reading
+# came up short.
+ndl_half() { # ndl_half <session pct> -> a fresh, truthful, SESSION-ONLY reading
+  printf '{"fetched_at":%s,"source":"oauth","session_percent":%s,"max_percent":%s,"buckets":[]}' \
+    "$(date +%s)" "$1" "$1"
+}
+ndl_half 12 > "$ND/acct-01/limits.json"
+ndl_half 18 > "$ND/acct-02/limits.json"
+rm -f "$ND/.pick-seq" "$ND"/acct-0*/.last-pick "$ND"/acct-0*/.limited
+: > "$ND/selection.log"
+CLAUDE_ACCOUNTS_ROOT="$ND" claude >/dev/null 2>&1
+# session-ok=0 is the point, not a detail: both readings carry a session percentage well
+# under the gate, and NEITHER clears it, because the gate is part of the same "known"
+# rule. A pool that cannot rank must not look like one that ranked and tied.
+grep -qE "ranking=BLIND telemetry-age=[0-9]{1,2}s band=30 band-count=2 session-gate=50 session-ok=0 pwd=" \
+  "$ND/selection.log" \
+  && t_ok "a pool of session-only readings logs ranking=BLIND although both are seconds old" \
+  || t_fail "one-signal blindness" "$(tail -1 "$ND/selection.log" 2>/dev/null)"
+out="$(CLAUDE_ACCOUNTS_ROOT="$ND" claude-accounts status 2>&1)"
+check "status calls a one-signal pool blind" "RANKING IS BLIND" "$out"
+check "the one-signal banner says the readings are incomplete" \
+  "ranking needs BOTH a weekly and a session percentage" "$out"
+CLAUDE_ACCOUNTS_ROOT="$ND" claude-accounts list --json > "$ND/onefield.json" 2>/dev/null
+python3 - "$ND/onefield.json" <<'EOF'
+import json, sys
+d = json.load(open(sys.argv[1]))
+assert d['summary']['telemetry'] == 'blind', d['summary']
+assert d['summary']['ranking_blind'] is True, d['summary']
+for a in d['accounts']:
+    u = a['usage']
+    # Current, well-formed, and NOT a no_data document — one real bucket did report.
+    # It simply is not enough to rank on, and the panel has to agree with the shim.
+    assert u['stale'] is False, a
+    assert 'no_data' not in u, a
+    assert u['session_percent'] is not None and u['weekly_percent'] is None, a
+EOF
+[ $? -eq 0 ] && t_ok "--json reports ranking_blind for readings that are half present" \
+  || t_fail "json one-signal blindness" "see $ND/onefield.json"
+
+# ...and the weekly-only mirror of the same rule: known needs BOTH, whichever half is
+# missing. DEGRADED must not fire either — these readings are FRESH, and degraded exists
+# for an outage of age, not for fresh emptiness (codex review, 2026-09-04).
+ndl_whalf() { # ndl_whalf <weekly pct> -> a fresh, truthful, WEEKLY-ONLY reading
+  printf '{"fetched_at":%s,"source":"oauth","weekly_percent":%s,"max_percent":%s,"weekly_resets_epoch":%s,"buckets":[]}' \
+    "$(date +%s)" "$1" "$1" "$(( $(date +%s) + 500000 ))"
+}
+ndl_whalf 4 > "$ND/acct-01/limits.json"
+ndl_whalf 80 > "$ND/acct-02/limits.json"
+rm -f "$ND/.pick-seq" "$ND"/acct-0*/.last-pick "$ND"/acct-0*/.limited
+: > "$ND/selection.log"
+CLAUDE_ACCOUNTS_ROOT="$ND" claude >/dev/null 2>&1
+grep -qE "ranking=BLIND telemetry-age=[0-9]{1,2}s .*session-ok=0 pwd=" "$ND/selection.log" \
+  && t_ok "a pool of weekly-only readings logs ranking=BLIND, not DEGRADED" \
+  || t_fail "weekly-only blindness" "$(tail -1 "$ND/selection.log" 2>/dev/null)"
+! grep -q "ranking=DEGRADED" "$ND/selection.log" \
+  && t_ok "fresh weekly-only readings never promote the pool to DEGRADED" \
+  || t_fail "fresh-degraded" "a fresh one-signal pool ranked DEGRADED"
+CLAUDE_ACCOUNTS_ROOT="$ND" claude-accounts list --json > "$ND/whalf.json" 2>/dev/null
+python3 - "$ND/whalf.json" <<'PJ'
+import json, sys
+d = json.load(open(sys.argv[1]))
+assert d['summary']['ranking_blind'] is True, d['summary']
+PJ
+[ $? -eq 0 ] && t_ok "--json calls the fresh weekly-only pool blind (not degraded)" \
+  || t_fail "json one-signal verdict" "see $ND/whalf.json"
+
+
+# One COMPLETE reading beside them is enough to rank the pool, and it must take every
+# pick — the half readings are unknown, not free. (This holds on the pre-fix tree too:
+# it is the guard against over-correcting "half is blind" into "half is excluded".)
+ndl 30 10 30 > "$ND/acct-02/limits.json"
+rm -f "$ND/.pick-seq" "$ND"/acct-0*/.last-pick
+: > "$ND/selection.log"
+nd_half_hits=0
+for _ in $(seq 1 6); do
+  case "$(CLAUDE_ACCOUNTS_ROOT="$ND" claude 2>&1)" in *CFG=acct-02*) nd_half_hits=$((nd_half_hits+1)) ;; esac
+done
+{ [ "$nd_half_hits" = "6" ] && ! grep -q "ranking=BLIND" "$ND/selection.log"; } \
+  && t_ok "one complete reading beside a session-only one leaves the pool ranking, and wins 6/6" \
+  || t_fail "mixed one-signal pool" \
+     "acct-02 took $nd_half_hits of 6; $(tail -1 "$ND/selection.log" 2>/dev/null)"
+CLAUDE_ACCOUNTS_ROOT="$ND" claude-accounts list --json > "$ND/onefield-mixed.json" 2>/dev/null
+python3 - "$ND/onefield-mixed.json" <<'EOF'
+import json, sys
+d = json.load(open(sys.argv[1]))
+assert d['summary']['telemetry'] == 'fresh', d['summary']
+assert d['summary']['ranking_blind'] is False, d['summary']
+EOF
+[ $? -eq 0 ] && t_ok "--json calls the mixed one-signal pool fresh" \
+  || t_fail "json mixed one-signal" "see $ND/onefield-mixed.json"
+rm -f "$ND"/acct-0*/.limited "$ND"/acct-0*/.client-limit-cleared
+
 # ---- 16-marker. the marker names ONE bucket and carries THAT bucket's reset ----------
 # A 100% session bucket (resets in an hour) beside a 100% Fable-only weekly bucket
 # (resets in five days) used to produce "bucket=session … resets_at=<+1h>" on line 2
@@ -2855,6 +3466,12 @@ RACER
   # alone, and these assertions would then be measuring the gate instead of the cutoff
   # window. Nobody clearing the gate makes it step aside, so weekly alone ranks here.
   mk_cutoff_pool() { # $1 = age of both readings, in seconds
+    # A FRESH clock, not the suite-wide $now captured at startup: the 800s case leaves
+    # only 100s of headroom inside the 900s cutoff window, and the suite takes longer
+    # than that to get here — under load (2026-09-04, parallel review agents) the reading
+    # aged past the window and the assertion flipped. Ages here must mean age AT THE
+    # SHIM'S OWN CLOCK, whenever this test happens to run.
+    local now; now="$(date -u +%s)"
     printf '{"fetched_at":%s,"weekly_percent":1,"session_percent":91,"max_percent":91,"weekly_resets_epoch":%s,"buckets":[]}' \
       "$((now - $1))" "$((now + 200000))" > "$SD/acct-01/limits.json"
     printf '{"fetched_at":%s,"weekly_percent":50,"session_percent":55,"max_percent":55,"weekly_resets_epoch":%s,"buckets":[]}' \
@@ -3107,6 +3724,153 @@ else
   t_ok "sync validation tests skipped (Mac-only feature; server refuses sync by design)"
 fi
 
+# ---- 16d. every limits pass fans telemetry out to the manifest's peers ---------------
+# Why this has teeth (2026-09-04): the runner Macs mini-3..mini-8 hold only portable
+# setup tokens, and the usage endpoint refuses those for good (403, no user:profile), so
+# the ONLY telemetry they can ever rank on is the source machine's. limits_distribute
+# pushes limits.json + .limited to the manifest's `server` AND to every entry in `peers`
+# — nothing had ever proven the peer half, and it is the half that decides whether six
+# machines rank blind. Not Mac-gated like `sync`: a fake rsync on PATH records the argv
+# and the --files-from list (the caller deletes that list as soon as the last push
+# returns, so it is read at invocation time, not afterwards).
+DPOOL="$WORK/distribute-pool"
+mkdir -p "$DPOOL/acct-01" "$DPOOL/acct-02" "$DPOOL/tmp"
+: > "$DPOOL/.limits-kick"
+cat > "$DPOOL/accounts.json" <<'EOF'
+{"version":1,"server":"root@203.0.113.9","server_root":"/root/.claude-accounts",
+ "server_repo":"/root/claude-multiacc","threshold":90,
+ "peers":[
+   {"target":"gas@mini-3","root":"/Users/gas/.claude-accounts","repo":"/Users/gas/claude-multiacc"},
+   {"target":"gas@mini-4","root":"/Users/gas/.claude-accounts","repo":"/Users/gas/claude-multiacc"}],
+ "accounts":[
+   {"id":"acct-01","email":"dp1@test","home":"mac","added_at":"2026-07-13T00:00:00Z"},
+   {"id":"acct-02","email":"dp2@test","home":"mac","added_at":"2026-07-13T00:00:00Z"}]}
+EOF
+for i in 01 02; do
+  printf '{"claudeAiOauth":{"accessToken":"sk-ant-oat01-dp%s","refreshToken":"r","expiresAt":9999999999999,"refreshTokenExpiresAt":9999999999999}}' \
+    "$i" > "$DPOOL/acct-$i/.credentials.json"
+done
+# an exclusion marker rides along with the readings (this one survives a clean pass)
+printf '%s\nbucket=error-cooldown percent=? reason=error-cooldown\n' "$(( $(date +%s) + 600 ))" \
+  > "$DPOOL/acct-02/.limited"
+RSFAKE="$WORK/rsyncfake"
+export RSLOG="$WORK/rsync-push.log"
+mkdir -p "$RSFAKE"
+cat > "$RSFAKE/rsync" <<'EOF'
+#!/usr/bin/env bash
+printf 'RSYNC %s\n' "$*" >> "${RSLOG:?}"
+for a in "$@"; do
+  case "$a" in
+    --files-from=*)
+      while IFS= read -r l; do printf 'FILE %s\n' "$l" >> "$RSLOG"; done < "${a#--files-from=}" ;;
+  esac
+done
+exit 0
+EOF
+chmod +x "$RSFAKE/rsync"
+: > "$RSLOG"
+PATH="$RSFAKE:$PATH" CLAUDE_ACCOUNTS_ROOT="$DPOOL" \
+  CLAUDE_MULTIACC_USAGE_URL="file://$WORK/usage-low.json" claude-accounts limits --force --quiet
+# The push is deliberately DETACHED — a sleeping peer must never delay the next refresh —
+# so wait for it instead of assuming it finished.
+waited=0
+while [ "$waited" -lt 50 ] && [ "$(grep -c '^RSYNC ' "$RSLOG" 2>/dev/null)" -lt 3 ]; do
+  sleep 0.2; waited=$((waited + 1))
+done
+# The pushes are serialized by a lock dir, so a slow peer can never stack them up. Let
+# it drain before the next case, or that case's push would be dropped, not made.
+dp_drain() {
+  local w=0
+  while [ "$w" -lt 50 ] && [ -d "$DPOOL/tmp/limits-push.lock" ]; do sleep 0.2; w=$((w + 1)); done
+}
+dp_drain
+n_push="$(grep -c '^RSYNC ' "$RSLOG" 2>/dev/null)"
+[ "$n_push" = "3" ] && t_ok "a limits pass pushes once per target (server + 2 peers)" \
+  || t_fail "limits distribute" "expected 3 rsync calls, saw $n_push: $(tr '\n' '|' < "$RSLOG")"
+grep -q "^RSYNC .*root@203.0.113.9:/root/.claude-accounts/" "$RSLOG" \
+  && t_ok "telemetry is pushed to the manifest server" \
+  || t_fail "limits distribute server" "$(grep '^RSYNC' "$RSLOG")"
+for peer in gas@mini-3 gas@mini-4; do
+  grep -q "^RSYNC .*$peer:/Users/gas/.claude-accounts/" "$RSLOG" \
+    && t_ok "telemetry is pushed to manifest peer $peer" \
+    || t_fail "limits distribute peer" "$peer never received a push: $(grep '^RSYNC' "$RSLOG")"
+done
+# ...and every target gets the SAME list: each account's reading, plus any marker.
+for f in "acct-01/limits.json" "acct-02/limits.json" "acct-02/.limited"; do
+  [ "$(grep -c "^FILE $f\$" "$RSLOG")" = "3" ] \
+    && t_ok "the pushed file list names $f for all three targets" \
+    || t_fail "limits distribute file list" "$f appears $(grep -c "^FILE $f\$" "$RSLOG")x, want 3"
+done
+
+# A REPLICA receives telemetry and must never push it back: two writers racing over one
+# pool is last-writer-wins chaos, and a manifest carrying `peers` is itself pushed TO the
+# replicas — so the role marker is a machine-local side file, checked before anything else.
+printf 'replica\n' > "$DPOOL/sync-role"
+: > "$RSLOG"
+PATH="$RSFAKE:$PATH" CLAUDE_ACCOUNTS_ROOT="$DPOOL" \
+  CLAUDE_MULTIACC_USAGE_URL="file://$WORK/usage-low.json" claude-accounts limits --force --quiet
+sleep 1
+[ ! -s "$RSLOG" ] && t_ok "a replica pool never pushes telemetry (limits_distribute is a no-op)" \
+  || t_fail "replica distribute" "a replica pushed: $(tr '\n' '|' < "$RSLOG")"
+# only an EXACT 'replica' suppresses it — same anchor as sync
+printf 'not-replica\n' > "$DPOOL/sync-role"
+: > "$RSLOG"
+PATH="$RSFAKE:$PATH" CLAUDE_ACCOUNTS_ROOT="$DPOOL" \
+  CLAUDE_MULTIACC_USAGE_URL="file://$WORK/usage-low.json" claude-accounts limits --force --quiet
+waited=0
+while [ "$waited" -lt 50 ] && [ "$(grep -c '^RSYNC ' "$RSLOG" 2>/dev/null)" -lt 3 ]; do
+  sleep 0.2; waited=$((waited + 1))
+done
+dp_drain
+[ "$(grep -c '^RSYNC ' "$RSLOG" 2>/dev/null)" = "3" ] \
+  && t_ok "only an exact 'replica' value suppresses the telemetry push" \
+  || t_fail "replica anchor (distribute)" "'not-replica' suppressed the push"
+rm -f "$DPOOL/sync-role"
+
+# ---- 16d-lock. a distribute lock is honored while it is alive, broken once it is not -
+# The push serializes on a lock DIRECTORY, and a detached push that is killed (logout,
+# reboot, pkill) never runs its EXIT trap. `mkdir "$lock" || return 0` can then never
+# succeed again: on the live pool one stranded lock stopped ALL telemetry distribution
+# from 2026-09-03 00:29 until it was removed by hand on 2026-09-04 — 32 hours in which
+# every peer ranked on whatever limits.json it happened to already have, which is the
+# blindness this push exists to prevent, and nothing anywhere said so. A push is seconds
+# of rsync under hard timeouts, so a lock older than ten minutes belongs to a process
+# that is gone.
+: > "$RSLOG"
+: > "$DPOOL/sync.log"
+rm -rf "$DPOOL/tmp/limits-push.lock"
+mkdir -p "$DPOOL/tmp/limits-push.lock"
+touch -t 202001010000 "$DPOOL/tmp/limits-push.lock"      # abandoned in 2020, not busy
+PATH="$RSFAKE:$PATH" CLAUDE_ACCOUNTS_ROOT="$DPOOL" \
+  CLAUDE_MULTIACC_USAGE_URL="file://$WORK/usage-low.json" claude-accounts limits --force --quiet
+waited=0
+while [ "$waited" -lt 50 ] && [ "$(grep -c '^RSYNC ' "$RSLOG" 2>/dev/null)" -lt 3 ]; do
+  sleep 0.2; waited=$((waited + 1))
+done
+dp_drain
+[ "$(grep -c '^RSYNC ' "$RSLOG" 2>/dev/null)" = "3" ] \
+  && t_ok "a stale limits-push lock is broken and the pass distributes anyway" \
+  || t_fail "stale distribute lock" "expected 3 rsync calls, saw $(grep -c '^RSYNC ' "$RSLOG" 2>/dev/null)"
+grep -q "stale limits-push lock broken" "$DPOOL/sync.log" \
+  && t_ok "breaking the lock is recorded, so a recurrence is visible instead of silent" \
+  || t_fail "stale lock log" "sync.log: $(tail -3 "$DPOOL/sync.log" 2>/dev/null | tr '\n' '|')"
+[ ! -d "$DPOOL/tmp/limits-push.lock" ] \
+  && t_ok "the retaken lock is released at the end of the push, not leaked again" \
+  || t_fail "stale lock retake" "the lock dir is still present after the push"
+
+# ...and a lock that a LIVE push is holding is still absolute: two rsyncs racing into one
+# peer is exactly what the lock exists to stop, so a fresh one skips this pass entirely.
+: > "$RSLOG"
+mkdir -p "$DPOOL/tmp/limits-push.lock"                   # mtime = now: someone is pushing
+PATH="$RSFAKE:$PATH" CLAUDE_ACCOUNTS_ROOT="$DPOOL" \
+  CLAUDE_MULTIACC_USAGE_URL="file://$WORK/usage-low.json" claude-accounts limits --force --quiet
+sleep 1
+{ [ ! -s "$RSLOG" ] && [ -d "$DPOOL/tmp/limits-push.lock" ]; } \
+  && t_ok "a fresh distribute lock is honored: no push, and the lock is left where it was" \
+  || t_fail "live distribute lock" "pushes=$(grep -c '^RSYNC ' "$RSLOG" 2>/dev/null) lock=$([ -d "$DPOOL/tmp/limits-push.lock" ] && echo held || echo REMOVED)"
+rm -rf "$DPOOL/tmp/limits-push.lock"
+unset RSLOG
+
 # API keys are never accepted as credentials (subscription-only requirement)
 printf 'sk-ant-api03-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA' > "$WORK/apikey.txt"
 out="$(claude-accounts import apikey@test --id acct-11 --token-file "$WORK/apikey.txt" --no-sync 2>&1)"
@@ -4391,6 +5155,417 @@ out="$(CODEX_MULTIACC_USAGE_URL="file://$WORK/cx-usage-low.json" codex-accounts
 check "codex: 429 backoff honored" "acct-02: backing off after 429" "$out"
 rm -f "$CX"/acct-*/limits.json
 
+# ---- C13b. codex parity: a 0% window with NO reported reset is NO DATA ---------------
+# The claude pool's 2026-09-04 incident (acct-13/acct-14 served every bucket
+# `percent: 0, resets_at: null`, ranked as the emptiest accounts in the fleet, handed
+# 31 of the last ~60 picks while the client was being rejected on them at their weekly
+# limit) is a payload failure, not a claude-specific one — this writer must refuse the
+# same way. Codex's usage payload carries reset_at INSIDE each window, and this writer
+# formats resets_at itself, so "the payload reported a window" is the distinction.
+CD="$WORK/cx-nodata-pool"
+mkdir -p "$CD/acct-01" "$CD/acct-02" "$CD/tmp"
+: > "$CD/.limits-kick"
+cat > "$CD/accounts.json" <<'EOF'
+{"version":1,"server":"none","threshold":90,"accounts":[
+  {"id":"acct-01","email":"nd1@cx","home":"mac","added_at":"2026-08-21T00:00:00Z"},
+  {"id":"acct-02","email":"nd2@cx","home":"mac","added_at":"2026-08-21T00:00:00Z"}]}
+EOF
+mk_cx_auth "$CD/acct-01/auth.json" nd1@cx "$FUTURE_EXP"
+mk_cx_auth "$CD/acct-02/auth.json" nd2@cx "$FUTURE_EXP"
+cdl() { # cdl <weekly> <session> <max> -> a truthful, in-window reading on stdout
+  printf '{"fetched_at":%s,"source":"chatgpt","weekly_percent":%s,"session_percent":%s,"max_percent":%s,"plan":"pro","buckets":[]}' \
+    "$(date +%s)" "$1" "$2" "$3"
+}
+cdlimits() { # cdlimits <fixture> [extra args] -> a real refresh over the whole CD pool
+  local f="$1"; shift
+  CODEX_ACCOUNTS_ROOT="$CD" CODEX_MULTIACC_USAGE_URL="file://$f" \
+    codex-accounts limits --force "$@" 2>&1
+}
+
+# every window 0% with no reset_at at all: nothing here says anything
+cat > "$WORK/cx-usage-allzero.json" <<'EOF'
+{"email":"nd@cx","plan_type":"pro",
+ "rate_limit":{"allowed":true,"limit_reached":false,
+   "primary_window":{"used_percent":0,"limit_window_seconds":18000},
+   "secondary_window":{"used_percent":0,"limit_window_seconds":604800}},
+ "additional_rate_limits":[]}
+EOF
+out="$(cdlimits "$WORK/cx-usage-allzero.json")"
+check "codex: an all-zero/no-window payload is reported as no usable telemetry" \
+  "no usable telemetry (account ranks as unknown, not as empty)" "$out"
+python3 - "$CD/acct-01/limits.json" <<'EOF'
+import json, sys
+d = json.load(open(sys.argv[1]))
+assert d.get('no_data') is True, d
+for k in ('max_percent', 'weekly_percent', 'session_percent'):
+    assert k not in d, (k, d)
+assert len(d['buckets']) == 2 and d['plan'] == 'pro', d      # diagnostics survive
+# the writer's internal "did the payload report this window" flag never reaches disk
+for b in d['buckets']:
+    assert '_reset_known' not in b, b
+EOF
+[ $? -eq 0 ] && t_ok "codex: a no-data pass records no_data and none of the percent signals" \
+  || t_fail "codex no_data document" "see $CD/acct-01/limits.json"
+
+# one silent model window beside real ones changes nothing
+cat > "$WORK/cx-usage-mixed-nodata.json" <<EOF
+{"email":"nd@cx","plan_type":"pro",
+ "rate_limit":{"allowed":true,"limit_reached":false,
+   "primary_window":{"used_percent":5,"limit_window_seconds":18000,"reset_at":$((now+3600))},
+   "secondary_window":{"used_percent":9,"limit_window_seconds":604800,"reset_at":$((now+90000))}},
+ "additional_rate_limits":[
+   {"limit_name":"GPT-5.3-Codex-Spark","rate_limit":{"allowed":true,"limit_reached":false,
+     "primary_window":{"used_percent":0,"limit_window_seconds":18000},
+     "secondary_window":{"used_percent":0,"limit_window_seconds":604800}}}]}
+EOF
+cdlimits "$WORK/cx-usage-mixed-nodata.json" --quiet >/dev/null
+python3 - "$CD/acct-01/limits.json" <<'EOF'
+import json, sys
+d = json.load(open(sys.argv[1]))
+assert 'no_data' not in d, d
+assert (d['session_percent'], d['weekly_percent'], d['max_percent']) == (5, 9, 9), d
+assert len(d['buckets']) == 4, d          # the two silent model windows are still recorded
+EOF
+[ $? -eq 0 ] && t_ok "codex: one silent model window beside real ones leaves the ranking untouched (5/9)" \
+  || t_fail "codex mixed no-data payload" "see $CD/acct-01/limits.json"
+
+# 0% WITH reported resets is a real, empty reading
+cat > "$WORK/cx-usage-zero-real-windows.json" <<EOF
+{"email":"nd@cx","plan_type":"pro",
+ "rate_limit":{"allowed":true,"limit_reached":false,
+   "primary_window":{"used_percent":0,"limit_window_seconds":18000,"reset_at":$((now+3600))},
+   "secondary_window":{"used_percent":0,"limit_window_seconds":604800,"reset_at":$((now+90000))}},
+ "additional_rate_limits":[]}
+EOF
+cdlimits "$WORK/cx-usage-zero-real-windows.json" --quiet >/dev/null
+python3 - "$CD/acct-01/limits.json" <<'EOF'
+import json, sys
+d = json.load(open(sys.argv[1]))
+assert 'no_data' not in d, d
+assert (d['session_percent'], d['weekly_percent'], d['max_percent']) == (0, 0, 0), d
+EOF
+[ $? -eq 0 ] && t_ok "codex: 0% WITH reported reset windows still records a real, empty reading" \
+  || t_fail "codex zero-with-windows payload" "see $CD/acct-01/limits.json"
+
+# ...and an unknown account loses to any account with a real reading
+cdlimits "$WORK/cx-usage-allzero.json" --quiet >/dev/null
+cdl 45 10 45 > "$CD/acct-02/limits.json"
+rm -f "$CD/.pick-seq" "$CD"/acct-0*/.last-pick "$CD"/acct-0*/.limited
+: > "$CD/selection.log"
+cd_hits=0
+for _ in $(seq 1 10); do
+  case "$(CODEX_ACCOUNTS_ROOT="$CD" codex 2>&1)" in *CFG=acct-01*) cd_hits=$((cd_hits+1)) ;; esac
+done
+[ "$cd_hits" = "0" ] \
+  && t_ok "codex: a no-data account never outranks one with real telemetry (0 of 10 picks)" \
+  || t_fail "codex no_data ranking" "the fake-zero account took $cd_hits of 10 picks"
+grep -q "acct-02 weekly=45% session=10% band=30 band-count=1" "$CD/selection.log" \
+  && t_ok "codex: the pick logs the known account alone in the band" \
+  || t_fail "codex no_data band" "selection.log: $(tail -1 "$CD/selection.log" 2>/dev/null)"
+
+# ---- C13c. codex parity: ONE marker rule, driven through the REAL rollout path -------
+# The codex shim has no telemetry-based clearing path at all (a marker leaves it only
+# when its own reset epoch passes), so the whole rule lives in `codex-accounts limits`.
+# Until 2026-09-04 that writer kept EVERY active client marker unconditionally, which
+# looks safe and is half wrong in each direction: a 7d rejection was safe by accident
+# rather than by rule, and a 5h rejection — a window that refills within hours — parked
+# the account until its own epoch, the exact stranding #22 (2026-09-03) had to fix on the
+# claude side.
+#
+# These cases no longer HAND the writer a marker. bin/codex writes it, from a rollout
+# transcript, the way a rejected run does — because the rule the writer applies reads a
+# token the SHIM chooses, and testing it on a hand-written marker tests a vocabulary the
+# product never produces. That is exactly what went wrong once already: the guard matched
+# seven_day/7d/weekly while the scan labelled markers `client:primary`/`client:secondary`
+# after the rollout's own rate_limits KEY names, which map to no fixed window at all
+# (live payloads report `primary` as the 10080-minute one). Weekly protection was a no-op
+# on this provider, and four green assertions said otherwise. The label is now derived
+# from the record's own `window_minutes` at write time, and these tests drive that
+# derivation end to end: rollout -> shim -> marker -> limits pass -> selection.
+# A third, healthy account: with only two, "everything was parked so the pool fell back"
+# and "the freed account was chosen" produce the same log line.
+mkdir -p "$CD/acct-03"
+mk_cx_auth "$CD/acct-03/auth.json" nd3@cx "$FUTURE_EXP"
+python3 - "$CD/accounts.json" <<'EOF'
+import json, sys
+d = json.load(open(sys.argv[1]))
+if not any(a['id'] == 'acct-03' for a in d['accounts']):
+    d['accounts'].append({"id": "acct-03", "email": "nd3@cx", "home": "mac",
+                          "added_at": "2026-08-21T00:00:00Z"})
+json.dump(d, open(sys.argv[1], 'w'))
+EOF
+cx_mark() { # cx_mark <acct dir> <bucket> <reset-offset-seconds> <marked_at ISO>
+  printf '%s\nbucket=%s percent=100 marked_at=%s reason=client-rate-limit\n' \
+    "$(( $(date +%s) + $3 ))" "$2" "$4" > "$1/.limited"
+}
+cx_rollout() { # cx_rollout <acct dir> <used_percent> <resets_at epoch> <window_minutes|-> <record ISO>
+  # One rollout, shaped like the real transcript: the codex CLI writes the windows the
+  # server reported into every run's JSONL, and client_limit_scan reads the newest tail.
+  # window_minutes rides in the SAME fragment as used_percent/resets_at — which is why
+  # the shim can label the marker with the window that was actually spent.
+  local day="$1/sessions/2026/09/04" f win=""
+  rm -rf "$1/sessions"
+  mkdir -p "$day"
+  f="$day/rollout-2026-09-04T01-43-21-c13c0001-7fc3-7291-a0fc-7b4e2b035f1a.jsonl"
+  [ "$4" = "-" ] || win="\"window_minutes\":$4,"
+  {
+    printf '{"timestamp":"%s","type":"session_meta","payload":{"session_id":"c13c0001","cwd":"/proj"}}\n' "$5"
+    printf '{"timestamp":"%s","type":"event_msg","payload":{"type":"token_count","info":{"model_context_window":258400},"rate_limits":{"limit_id":"codex","limit_name":null,"primary":{"used_percent":%s,%s"resets_at":%s},"secondary":null,"credits":{"has_credits":false,"unlimited":false}}}}\n' \
+      "$5" "$2" "$win" "$3"
+  } > "$f"
+  rm -f "$1/.client-scan"
+}
+cx_bucket() { # the bucket token on line 2 of <acct dir>/.limited, or '<none>'
+  local b=""
+  [ -f "$1/.limited" ] && b="$(sed -n '2s/.*bucket=\([^ ]*\).*/\1/p' "$1/.limited" 2>/dev/null)"
+  printf '%s\n' "${b:-<none>}"
+}
+cdlimits0() { # cdlimits with the confirm delay OFF — a marker kept by this pass is kept
+              # by RULE, never merely because the rejection is seconds old. (Real markers
+              # are written by the shim moments before, so there is no "aged" marker to
+              # fabricate; the delay is pinned separately below.)
+  local f="$1"; shift
+  CODEX_ACCOUNTS_ROOT="$CD" CODEX_MULTIACC_USAGE_URL="file://$f" \
+    CODEX_MULTIACC_CLIENT_LIMIT_CONFIRM_DELAY=0 codex-accounts limits --force "$@" 2>&1
+}
+cx_shim() { CODEX_ACCOUNTS_ROOT="$CD" codex >/dev/null 2>&1; }
+rm -f "$CD"/acct-0*/.limited "$CD"/acct-0*/.client-limit-cleared "$CD"/acct-0*/.client-scan
+rm -rf "$CD"/acct-0*/sessions
+cx_now="$(date +%s)"
+cx_wreset=$((cx_now + 345600))          # four days out: a weekly window, still open
+cx_sreset=$((cx_now + 1800))            # half an hour out: a five-hour window
+# A record STAMPED BEFORE any clear: the watermark tests below turn on this timestamp,
+# and a rollout the writer's clear did not supersede would prove nothing about it.
+cx_ts_old="$(python3 -c 'import time; print(time.strftime("%Y-%m-%dT%H:%M:%S.120Z", time.gmtime(time.time() - 600)))')"
+
+# (1) The marker names the WINDOW the server spent, not the key the payload happened to
+# use. 10080 minutes is the weekly bucket however the rollout labels it.
+cx_rollout "$CD/acct-01" "97.4" "$cx_wreset" 10080 "$cx_ts_old"
+: > "$CD/selection.log"
+cx_shim
+{ [ "$(cx_bucket "$CD/acct-01")" = "client:7d" ] \
+  && grep -q "acct-01 LIMITED by its own run (7d:97, resets $cx_wreset) — client-reported" \
+       "$CD/selection.log"; } \
+  && t_ok "codex: a 10080-minute rejection is marked client:7d, not after the rollout's key name" \
+  || t_fail "codex weekly marker label" \
+     "bucket=$(cx_bucket "$CD/acct-01") log: $(tail -1 "$CD/selection.log" 2>/dev/null)"
+
+# (2) ...and THAT is the token the writer's weekly guard reads. An informative pass with
+# real numbers far under the threshold, and the confirm delay switched off so nothing but
+# the bucket rule can be keeping it: the marker has to survive the pass AND the next
+# launch, because a weekly window cannot fall from the server-proven 97% that wrote it to
+# 9% while it is still open.
+out="$(cdlimits0 "$WORK/cx-usage-low.json")"
+cx_shim
+{ [ "$(cx_bucket "$CD/acct-01")" = "client:7d" ] \
+  && [ ! -f "$CD/acct-01/.client-limit-cleared" ] \
+  && ! printf '%s' "$out" | grep -q "acct-01: marker cleared"; } \
+  && t_ok "codex: the client:7d marker outlives an informative 9% pass and the launch after it" \
+  || t_fail "codex weekly marker vs informative pass" \
+     "bucket=$(cx_bucket "$CD/acct-01") log: $(printf '%s' "$out" | grep acct-01 | tr '\n' ' ')"
+
+# (3) A pass that reported nothing proves nothing, and has to SAY so — or a 32-hour
+# telemetry stall reads exactly like a healthy pool.
+out="$(cdlimits0 "$WORK/cx-usage-allzero.json")"
+{ [ "$(cx_bucket "$CD/acct-01")" = "client:7d" ] \
+  && printf '%s' "$out" | grep -q "acct-01: marker kept (no usable telemetry)"; } \
+  && t_ok "codex: a no-data pass keeps the client:7d marker, and logs that it kept it" \
+  || t_fail "codex weekly marker vs no-data pass" \
+     "bucket=$(cx_bucket "$CD/acct-01") log: $(printf '%s' "$out" | grep acct-01 | tr '\n' ' ')"
+
+# (4) The differential, from the same code path with one number changed: 300 minutes is
+# the self-healing session window, so the identical rejection on acct-02 is labelled
+# client:5h and DOES clear on an informative pass — the #22 (2026-09-03) behavior, which
+# over-correcting (2) into "no client marker ever clears" would have destroyed.
+cx_rollout "$CD/acct-02" "99.0" "$cx_sreset" 300 "$cx_ts_old"
+cx_shim
+cx_5h_bucket="$(cx_bucket "$CD/acct-02")"
+out="$(cdlimits0 "$WORK/cx-usage-low.json")"
+{ [ "$cx_5h_bucket" = "client:5h" ] && [ ! -f "$CD/acct-02/.limited" ] \
+  && printf '%s' "$out" | grep -q "acct-02: marker cleared (max 9%)" \
+  && [ "$(cx_bucket "$CD/acct-01")" = "client:7d" ]; } \
+  && t_ok "codex: a 300-minute rejection is marked client:5h and clears, beside a 7d one that does not" \
+  || t_fail "codex 5h vs 7d marker rule" \
+     "5h-marked=$cx_5h_bucket 5h-now=$(cx_bucket "$CD/acct-02") 7d=$(cx_bucket "$CD/acct-01") log: $(printf '%s' "$out" | grep 'marker' | tr '\n' ' ')"
+
+# (5) ...and it STAYS cleared. The rollout that reported the spent window is still on
+# disk and the scan re-reads its tail on every launch, so without the `.client-limit-
+# cleared` watermark the clear achieves nothing: the very next `codex` rewrites the same
+# park, once per 15-minute pass, forever. Two launches, because the first would already
+# have re-marked.
+{ [ -f "$CD/acct-02/.client-limit-cleared" ] && { cx_shim; cx_shim; true; } \
+  && [ ! -f "$CD/acct-02/.limited" ]; } \
+  && t_ok "codex: the cleared 5h marker is not re-written from the same rollout (watermark)" \
+  || t_fail "codex client-limit watermark" \
+     "watermark=$([ -f "$CD/acct-02/.client-limit-cleared" ] && echo yes || echo MISSING) bucket=$(cx_bucket "$CD/acct-02")"
+
+# (6) That decision reaches selection: the weekly-parked account stays out while the
+# freed one comes back and takes every pick (acct-03 sits 36 points outside the band, so
+# "acct-02 is eligible again" is the only thing that can produce this).
+cdl 9 5 9 > "$CD/acct-02/limits.json"
+cdl 45 10 45 > "$CD/acct-03/limits.json"
+rm -f "$CD/.pick-seq" "$CD"/acct-0*/.last-pick
+: > "$CD/selection.log"
+cw_hits=0; cw2_hits=0
+for _ in $(seq 1 6); do
+  case "$(CODEX_ACCOUNTS_ROOT="$CD" codex 2>&1)" in
+    *CFG=acct-01*) cw_hits=$((cw_hits+1)) ;;
+    *CFG=acct-02*) cw2_hits=$((cw2_hits+1)) ;;
+  esac
+done
+{ [ "$cw_hits" = "0" ] && [ "$cw2_hits" = "6" ] \
+  && [ "$(cx_bucket "$CD/acct-01")" = "client:7d" ]; } \
+  && t_ok "codex: the weekly rejection keeps its account out while the cleared 5h one returns (0 vs 6 of 6)" \
+  || t_fail "codex marker selection" \
+     "acct-01=$cw_hits acct-02=$cw2_hits of 6; 7d marker=$(cx_bucket "$CD/acct-01")"
+
+# (7) The watermark is a brake, not a mute: a rejection recorded AFTER the clear is news,
+# and parks the account again. (Stamped five seconds past the watermark the writer
+# actually wrote, so this cannot pass by clock luck.)
+cx_wm="$(head -1 "$CD/acct-02/.client-limit-cleared" 2>/dev/null)"
+cx_ts_new="$(python3 -c 'import sys, time; print(time.strftime("%Y-%m-%dT%H:%M:%S.120Z", time.gmtime(int(sys.argv[1]) + 5)))' "${cx_wm:-$cx_now}")"
+cx_rollout "$CD/acct-02" "96.0" "$cx_sreset" 300 "$cx_ts_new"
+cx_shim
+{ [ "$(cx_bucket "$CD/acct-02")" = "client:5h" ] \
+  && grep -q 'percent=96' "$CD/acct-02/.limited"; } \
+  && t_ok "codex: a rejection recorded after the clear parks the account again (a brake, not a mute)" \
+  || t_fail "codex watermark is not a mute" \
+     "bucket=$(cx_bucket "$CD/acct-02") line: $(sed -n 2p "$CD/acct-02/.limited" 2>/dev/null)"
+
+# (8) A report that names no window at all keeps the raw key name — unknown window stays
+# CLEARABLE, the #22 fail-open direction, and its own reset epoch still bounds it. It
+# must clear on an informative pass and stay cleared like any other 5h-class marker.
+rm -f "$CD/acct-03/.limited" "$CD/acct-03/.client-limit-cleared"
+cx_rollout "$CD/acct-03" "97.0" "$cx_sreset" - "$cx_ts_old"
+cx_shim
+cx_nw_bucket="$(cx_bucket "$CD/acct-03")"
+cdlimits0 "$WORK/cx-usage-low.json" --quiet >/dev/null
+cx_shim
+{ [ "$cx_nw_bucket" = "client:primary" ] && [ ! -f "$CD/acct-03/.limited" ] \
+  && [ -f "$CD/acct-03/.client-limit-cleared" ]; } \
+  && t_ok "codex: a report with no window_minutes keeps the raw key name and stays clearable" \
+  || t_fail "codex windowless marker" \
+     "marked=$cx_nw_bucket now=$(cx_bucket "$CD/acct-03") watermark=$([ -f "$CD/acct-03/.client-limit-cleared" ] && echo yes || echo no)"
+
+# (9) The same holds for a marker written by an OLDER version and still on disk: it names
+# `primary`/`secondary`, which is no window, so it keeps its pre-2026-09-04 clearable
+# behavior rather than being promoted to a weekly park by accident. (Passes on the
+# pre-fix tree too — deliberately: it is the guard against reading the new guard as
+# "anything ambiguous sticks".)
+rm -rf "$CD/acct-03/sessions"
+rm -f "$CD/acct-03/.client-limit-cleared"
+cx_mark "$CD/acct-03" client:secondary 345600 2020-01-01T00:00:00Z
+cdlimits0 "$WORK/cx-usage-low.json" --quiet >/dev/null
+[ ! -f "$CD/acct-03/.limited" ] \
+  && t_ok "codex: a legacy client:secondary marker (no window in its name) is still clearable" \
+  || t_fail "codex legacy marker" "bucket=$(cx_bucket "$CD/acct-03") survived an informative pass"
+
+# (10) The confirm delay, which is what stops a cached usage response from erasing a
+# rejection the client was handed seconds ago. The shim writes marked_at=NOW, so the
+# marker below is genuinely fresh: the default 300s must keep it, and the same pass with
+# the window closed clears it — same env var, clamp and semantics as the claude writer.
+rm -f "$CD/acct-02/.limited" "$CD/acct-02/.client-limit-cleared"
+cx_rollout "$CD/acct-02" "99.0" "$cx_sreset" 300 "$cx_ts_old"
+cx_shim
+out="$(cdlimits "$WORK/cx-usage-low.json")"
+{ [ "$(cx_bucket "$CD/acct-02")" = "client:5h" ] \
+  && ! printf '%s' "$out" | grep -q "acct-02: marker cleared"; } \
+  && t_ok "codex: the default 300s confirm delay keeps a rejection handed over seconds ago" \
+  || t_fail "codex confirm delay" \
+     "bucket=$(cx_bucket "$CD/acct-02") log: $(printf '%s' "$out" | grep acct-02 | tr '\n' ' ')"
+out="$(cdlimits0 "$WORK/cx-usage-low.json")"
+{ [ ! -f "$CD/acct-02/.limited" ] \
+  && printf '%s' "$out" | grep -q "acct-02: marker cleared (max 9%)"; } \
+  && t_ok "codex: past the confirm delay the same 5h rejection clears on a real reading" \
+  || t_fail "codex confirm delay expiry" \
+     "bucket=$(cx_bucket "$CD/acct-02") log: $(printf '%s' "$out" | grep acct-02 | tr '\n' ' ')"
+
+# (11) error-cooldown is untouched by all of the above: the account failed a real call
+# moments ago, and no usage reading disproves that. (This one holds on origin/main too —
+# it is the guard against the rewritten branch quietly dropping a case.)
+rm -rf "$CD"/acct-0*/sessions
+printf '%s\nbucket=error-cooldown percent=? reason=error-cooldown\n' "$(( $(date +%s) + 600 ))" \
+  > "$CD/acct-01/.limited"
+cdlimits "$WORK/cx-usage-low.json" --quiet >/dev/null
+[ -f "$CD/acct-01/.limited" ] \
+  && t_ok "codex: an error-cooldown marker still survives an informative clean pass" \
+  || t_fail "codex cooldown vs limits" "the cooldown marker was cleared"
+rm -f "$CD"/acct-0*/.limited "$CD"/acct-0*/.client-limit-cleared "$CD"/acct-0*/.client-scan
+rm -rf "$CD"/acct-0*/sessions
+
+# ---- C13d. codex parity: each ranking signal comes from a window of its OWN kind -----
+# The claude writer's second 2026-09-04 defect, mirrored here: weekly_percent fell back
+# to the overall peak and session_percent to a flat 0, so a payload where only the 5h
+# window said anything was recorded as a WEEKLY reading, and one where only the 7d window
+# spoke walked through the session gate on a zero nobody reported. A signal no window
+# reported must be ABSENT — the shim needs both readings to call an account known.
+cat > "$WORK/cx-usage-session-only.json" <<EOF
+{"email":"nd@cx","plan_type":"pro",
+ "rate_limit":{"allowed":true,"limit_reached":false,
+   "primary_window":{"used_percent":40,"limit_window_seconds":18000,"reset_at":$((now+3600))},
+   "secondary_window":{"used_percent":0,"limit_window_seconds":604800}},
+ "additional_rate_limits":[]}
+EOF
+cdlimits "$WORK/cx-usage-session-only.json" --quiet >/dev/null
+python3 - "$CD/acct-01/limits.json" <<'EOF'
+import json, sys
+d = json.load(open(sys.argv[1]))
+assert 'no_data' not in d, d                     # one window DID report: this is a reading
+assert (d['session_percent'], d['max_percent']) == (40, 40), d
+# The 7d window reported no reset_at and 0%. Recording 40 here (the overall peak) or 0
+# (max over a silent window) both invent the number the weekly band ranks on.
+assert 'weekly_percent' not in d, d
+EOF
+[ $? -eq 0 ] && t_ok "codex: a session-only reading records session+max and NO weekly_percent" \
+  || t_fail "codex session-only signals" "see $CD/acct-01/limits.json"
+cdl 30 10 30 > "$CD/acct-02/limits.json"
+cdl 30 10 30 > "$CD/acct-03/limits.json"
+rm -f "$CD/.pick-seq" "$CD"/acct-0*/.last-pick "$CD"/acct-0*/.limited
+: > "$CD/selection.log"
+cs_hits=0
+for _ in $(seq 1 10); do
+  case "$(CODEX_ACCOUNTS_ROOT="$CD" codex 2>&1)" in *CFG=acct-01*) cs_hits=$((cs_hits+1)) ;; esac
+done
+[ "$cs_hits" = "0" ] \
+  && t_ok "codex: an account with no weekly reading never enters the band (0 of 10 picks)" \
+  || t_fail "codex session-only ranking" "the weekly-less account took $cs_hits of 10 picks"
+
+cat > "$WORK/cx-usage-weekly-only.json" <<EOF
+{"email":"nd@cx","plan_type":"pro",
+ "rate_limit":{"allowed":true,"limit_reached":false,
+   "primary_window":{"used_percent":0,"limit_window_seconds":18000},
+   "secondary_window":{"used_percent":37,"limit_window_seconds":604800,"reset_at":$((now+90000))}},
+ "additional_rate_limits":[]}
+EOF
+cdlimits "$WORK/cx-usage-weekly-only.json" --quiet >/dev/null
+python3 - "$CD/acct-01/limits.json" <<'EOF'
+import json, sys
+d = json.load(open(sys.argv[1]))
+assert 'no_data' not in d, d
+assert (d['weekly_percent'], d['max_percent']) == (37, 37), d
+assert 'session_percent' not in d, d             # the 5h window reported nothing at all
+EOF
+[ $? -eq 0 ] && t_ok "codex: a weekly-only reading records weekly+max and NO session_percent" \
+  || t_fail "codex weekly-only signals" "see $CD/acct-01/limits.json"
+# ...and the rivals are WORSE on weekly (80 against 37) and still take every pick,
+# because they are the only ones that can clear the session gate — which is exactly what
+# a fabricated `session_percent: 0` would have handed the silent account for free.
+cdl 80 10 80 > "$CD/acct-02/limits.json"
+cdl 80 10 80 > "$CD/acct-03/limits.json"
+rm -f "$CD/.pick-seq" "$CD"/acct-0*/.last-pick
+: > "$CD/selection.log"
+cwk_hits=0
+for _ in $(seq 1 6); do
+  case "$(CODEX_ACCOUNTS_ROOT="$CD" codex 2>&1)" in *CFG=acct-01*) cwk_hits=$((cwk_hits+1)) ;; esac
+done
+[ "$cwk_hits" = "0" ] \
+  && t_ok "codex: an unknown session reading never clears the gate, even with the better weekly (0 of 6)" \
+  || t_fail "codex weekly-only gate" "the session-less account cleared the gate $cwk_hits of 6 times"
+grep -q "band=30 band-count=2 session-gate=50 session-ok=2" "$CD/selection.log" \
+  && t_ok "codex: the log shows exactly the two accounts that reported a session bucket" \
+  || t_fail "codex weekly-only gate log" "$(tail -1 "$CD/selection.log" 2>/dev/null)"
+rm -f "$CD"/acct-0*/.limited
+
 # ---- C14. oauth refresh via the token endpoint --------------------------------------
 # expired bearer, missing endpoint: fail open with backoff
 mk_cx_auth "$CX/acct-01/auth.json" a@cx 1000
@@ -4912,13 +6087,22 @@ check "import refuses to land the same email in a second slot" "already register
 [ "$rc" != "0" ] && t_ok "conflicting-id import exits nonzero" || t_fail "conflicting id" "exited 0"
 
 # ---- 20c. instance isolation: the shim resolves the same root as the CLI ------------
+# The leak assertion is a BEFORE/AFTER of the default pool, taken around the instance
+# run. It used to grep $ACC/selection.log for "acct-01" — a line some earlier, unrelated
+# test had to have left there, and since picks are random that line is not guaranteed:
+# the check flaked once in five runs while proving nothing about isolation either way.
+# Nothing but bin/claude writes selection.log, and this section runs no default-pool
+# shim, so an unchanged line count is exactly "the instance run stayed in its own pool".
+iso_before="$(wc -l < "$ACC/selection.log" 2>/dev/null || echo 0)"
 out="$(CLAUDE_ACCOUNTS_ROOT="$JP2" claude 2>&1)"
 check "shim honors CLAUDE_ACCOUNTS_ROOT (instance pool)" "CFG=acct-01" "$out"
 [ -f "$JP2/selection.log" ] && t_ok "instance pool records its own selection log" \
   || t_fail "instance selection log" "missing at $JP2/selection.log"
-grep -q "acct-01" "$ACC/selection.log" && ! grep -q "portable@test" "$ACC/accounts.json" \
+iso_after="$(wc -l < "$ACC/selection.log" 2>/dev/null || echo 0)"
+{ [ "$iso_before" = "$iso_after" ] && ! grep -q "portable@test" "$ACC/accounts.json"; } \
   && t_ok "the default pool was untouched by the instance run" \
-  || t_fail "pool isolation" "the instance run leaked into $ACC"
+  || t_fail "pool isolation" \
+     "the instance run leaked into $ACC (selection.log $iso_before -> $iso_after lines)"
 
 # ---- 20d. sync target: overridable, and a local-only mode that pushes nowhere -------
 out="$(CLAUDE_ACCOUNTS_ROOT="$JP" CLAUDE_MULTIACC_NO_SYNC=0 claude-accounts sync --no-server 2>&1)"