claude-multiacc 2.0.33 → 2.0.35

package/bin/claude

@@ -301,6 +301,24 @@ client_marker_recovered() { # $1 account dir, $2 marker
       *) bucket="" ;;
     esac
     case "$(sel_lc "$bucket")" in *seven_day*|*7d*|*weekly*) return 1 ;; esac
+    # ...and a SESSION rejection is only disproved by a reading that actually measured
+    # the session window. `peak` below is max_percent, which is the WEEKLY buckets' peak
+    # whenever the 5h bucket says nothing — clearing a five_hour marker on it borrows
+    # across signals exactly as the writer refuses to. 2026-09-22, acct-14: telemetry
+    # fetched WHILE the client was being rejected still read the session bucket
+    # `percent: 0, resets_at: null`, so the writer flags that 0 as inferred; the marker
+    # was cleared on it, `--resume` landed on the account, and the run died in a minute.
+    # A silent session bucket proves nothing about a 429 the client actually received.
+    case "$(sel_lc "$bucket")" in
+      *five_hour*|*5h*|*session*)
+        # A literal test, not limits_field: that parser is integer-only and its
+        # `[^0-9]*` would happily skip past `true` and return a digit from the NEXT
+        # field, which would read as "inferred" on every document.
+        LC_ALL=C grep -q '"session_inferred"[[:space:]]*:[[:space:]]*true' \
+          "$1/limits.json" 2>/dev/null && return 1
+        cutoff_field "$1" session_percent >/dev/null 2>&1 || return 1
+        ;;
+    esac
     fetched="$(telem_fetched_at "$1" 2>/dev/null || echo 0)"
     # Defaulting peak to 100 when the reading is missing/stale is the second half of the
     # same rule: an UNINFORMATIVE reading must never clear a marker. It is what keeps a

package/bin/claude-accounts

@@ -1651,6 +1651,15 @@ def marker_bucket(txt):
             return part[7:]
     return ''
 
+def session_marker(txt):
+    # The self-healing 5h/session window, named the way each client writes it:
+    # claude's own type is `five_hour`, codex labels a short window `client:5h`, and a
+    # bare `session` covers the writer's own marker. Anything else (a weekly name, an
+    # unparseable line) is NOT a session marker and keeps its existing handling.
+    b = marker_bucket(txt).lower()
+    return 'five_hour' in b or '5h' in b or 'session' in b
+
+
 def weekly_marker(txt):
     # Matched the way both shims match it (bin/claude ~303, same token list): the
     # claude client writes client:seven_day / client:seven_day_opus, the codex client
@@ -2305,6 +2314,29 @@ for acct in manifest.get('accounts', []):
     maxp = max([b['percent'] for b in live] or [0])
     weeklyp = max(weekly) if weekly else None
     sessionp = max(session) if session else None
+    # ...but only the WEEKLY half of that rule is about a missing answer. The two kinds
+    # of bucket go silent for opposite reasons, and 2026-09-22 cost a day of picks to
+    # the difference. A weekly window always exists — it is a fixed calendar week,
+    # running whether or not the account is — so a weekly bucket with nothing to say is
+    # an endpoint that DECLINED, and inventing a number for it is the 2026-09-04 bug.
+    # The 5h SESSION window only exists while it is OPEN: leave an account alone for
+    # five hours and there is no window left to describe, so the endpoint answers
+    # `percent: 0, resets_at: null` — not silence but "nothing has been used". An
+    # exhausted session is never silent: a spent 5h bucket ALWAYS carries the window it
+    # resets in (the live pool on 2026-09-22 — every session bucket above 0% had a real
+    # resets_at, every silent one belonged to an idle account), so a silent session
+    # cannot be hiding a full one. Recording it as UNKNOWN is what broke selection:
+    # pick_best's quota_known rule needs BOTH readings, so an IDLE account — precisely
+    # the one with the most headroom — was scored weekly=100 and dropped out of the
+    # band, leaving only the busy accounts that still held an open 5h window. From
+    # selection.log at 2026-09-22T12:37:36Z: band-count=1, and that one band member was
+    # acct-17 at 95% weekly, while acct-13 and acct-14 sat at 0% and unrankable.
+    # So: a session bucket that said nothing inside a document that DID answer reads 0.
+    # A document where NOTHING answered still writes no signals at all (see below) —
+    # the 2026-09-04 all-zero shape stays unknown, which is the whole point.
+    session_measured = bool(session)
+    if sessionp is None and live:
+        sessionp = 0
     # How long weekly_percent keeps meaning something. A weekly bucket only ever RISES
     # until its reset, so before that moment a stale percent is still a valid lower
     # bound and the shim can rank on it when nothing fresher exists; after it, the
@@ -2323,6 +2355,16 @@ for acct in manifest.get('accounts', []):
         out['weekly_percent'] = weeklyp
     if sessionp is not None:
         out['session_percent'] = sessionp
+    if sessionp is not None and not session_measured:
+        # Ranking may use this 0 (that is the whole point — an idle account has to get
+        # back into the band), but NOTHING may treat it as proof of recovery. 2026-09-22,
+        # acct-14: a client:five_hour marker written from a real 429 at 13:06:31Z, and
+        # telemetry fetched at 13:04:16Z — WHILE the account was being rejected — still
+        # reported the session bucket `percent: 0, resets_at: null`. So a silent session
+        # bucket does NOT prove an idle account; the endpoint simply may not report the
+        # 5h window at all. The marker was cleared anyway, `--resume` landed straight on
+        # it, and the run was rejected inside a minute. Recovery has to be MEASURED.
+        out['session_inferred'] = True
     if weeklyp is not None:
         # Written with weekly_percent or not at all: the horizon describes THAT
         # reading, and the shim's degraded path needs both or neither.
@@ -2424,6 +2466,13 @@ for acct in manifest.get('accounts', []):
                     keep = True
                 elif active and is_client and weekly_marker(txt):
                     keep = True
+                elif active and is_client and session_marker(txt) and not session_measured:
+                    # Same rule as the weekly one, one window down: a rejection the CLIENT
+                    # reported is only disproved by telemetry that actually looked at the
+                    # window it names. `max_percent` here comes from the WEEKLY buckets
+                    # when the session bucket is silent, and clearing a 5h marker on it is
+                    # the cross-signal borrow the aggregation above refuses to make.
+                    keep = True
                 elif active and ('reason=error-cooldown' in txt
                                  or (is_client and recent_client)):
                     keep = True

package/bin/codex-accounts

@@ -1154,6 +1154,14 @@ def marker_bucket(txt):
             return part[7:]
     return ''
 
+def session_marker(txt):
+    # The self-healing ~5h window as each client names it: codex labels a short window
+    # `client:5h`, claude's own type is `five_hour`, and a bare `session` covers the
+    # writer's own marker. Kept identical to bin/claude-accounts' copy.
+    b = marker_bucket(txt).lower()
+    return 'five_hour' in b or '5h' in b or 'session' in b
+
+
 def weekly_marker(txt):
     # Matched the way both shims match it (bin/claude ~303, same token list): the
     # claude client writes client:seven_day / client:seven_day_opus, and the codex
@@ -1585,6 +1593,23 @@ for acct in manifest.get('accounts', []):
     maxp = max([b['percent'] for b in live] or [0])
     weeklyp = max(weekly) if weekly else None
     sessionp = max(session) if session else None
+    # ...but only the WEEKLY half of that rule is about a missing answer — same
+    # asymmetry the claude writer documents, and codex feels it harder. A durable
+    # window always exists, so a silent one is an endpoint that DECLINED. A ~5h session
+    # window only exists while it is OPEN, and codex does not even keep a placeholder
+    # for a closed one: an idle account's payload carries the 7d window and NO session
+    # window whatsoever, so `session` here is empty for every quiet account. That made
+    # session_percent permanently absent across this pool, and pick_best's quota_known
+    # rule needs BOTH readings — so EVERY codex account scored unknown, bestw never left
+    # 101, and the band degenerated to the all-gated tie: codex has been picking
+    # uniformly at RANDOM rather than by headroom (selection.log: `session=?%` on every
+    # ranked line). A session window that is closed has nothing in it, and an exhausted
+    # one is never silent — it reports at/near 100% with the reset it is waiting on.
+    # So a missing or silent session reads 0 whenever the payload answered at all; a
+    # payload where NOTHING answered still writes no signals and stays unknown below.
+    session_measured = bool(session)
+    if sessionp is None and live:
+        sessionp = 0
     try:
         reset_result, reset_view = refresh_reset_credits(d, aid, maxp, data, url, headers, say, int(now))
     except Exception as e:
@@ -1603,6 +1628,13 @@ for acct in manifest.get('accounts', []):
         out['weekly_percent'] = weeklyp
     if sessionp is not None:
         out['session_percent'] = sessionp
+    if sessionp is not None and not session_measured:
+        # Ranking may use this 0 — an idle account has to get back into the band — but
+        # nothing may read it as proof of recovery. codex reports no window at all for a
+        # closed one, so silence here is the NORMAL shape and says nothing whatsoever
+        # about a 429 the client actually received. See the claude writer for the live
+        # case that proved it (acct-14, 2026-09-22).
+        out['session_inferred'] = True
     if not live:
         # Nothing usable in the entire payload. Keep the diagnostics (fetched_at,
         # source, plan, the raw buckets) and write NONE of the percent signals: a
@@ -1711,6 +1743,13 @@ for acct in manifest.get('accounts', []):
                     keep = True
                 elif active and is_client and weekly_marker(txt):
                     keep = True
+                elif active and is_client and session_marker(txt) and not session_measured:
+                    # Same rule one window down: a rejection the CLIENT reported is only
+                    # disproved by telemetry that looked at the window it names. With the
+                    # session window silent, max_percent is the WEEKLY peak, and clearing
+                    # a 5h marker on it is the cross-signal borrow the aggregation above
+                    # refuses to make.
+                    keep = True
                 elif active and ('reason=error-cooldown' in txt
                                  or (is_client and recent_client)):
                     keep = True

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-multiacc",
-  "version": "2.0.33",
+  "version": "2.0.35",
   "description": "Unified Claude Code and OpenAI Codex subscription pooling with quota-aware selection.",
   "type": "module",
   "bin": {

package/tests/run-tests.sh

@@ -2458,10 +2458,18 @@ done
   && t_ok "an account with no weekly reading never enters the band (0 of 10 picks)" \
   || t_fail "session-only ranking" "the weekly-less account took $nd_sess_hits of 10 picks"
 
-# The mirror image: a weekly reading with nothing to say about the session bucket. Here
-# the rival is WORSE on weekly (80 against 37) and still wins every pick, because it is
-# the only candidate that can clear the session gate — which is exactly what a fabricated
-# `session_percent: 0` would have handed the silent account for free.
+# The mirror image — a weekly reading whose 5h bucket has nothing to say — is NOT the
+# same defect, and treating it as one broke selection on 2026-09-22. A weekly window
+# always exists (a fixed calendar week, running whether or not the account is), so a
+# silent weekly bucket is an endpoint that DECLINED. The 5h window only exists while it
+# is OPEN, so a silent session bucket is an account that has simply been IDLE — and an
+# exhausted session is never silent: a spent 5h bucket always reports ~100% with the
+# reset it is waiting on. Recording idle as UNKNOWN cost the pool its entire band,
+# because quota_known needs BOTH readings: the accounts with the MOST headroom
+# (acct-13/acct-14, 0% weekly) were scored 100 and dropped out, leaving acct-17 at 95%
+# weekly as the only band member — selection.log 2026-09-22T12:37:36Z, band-count=1,
+# four picks in a row onto an account already out of weekly headroom. A closed window
+# holds no usage: it reads 0.
 cat > "$WORK/usage-weekly-only.json" <<'EOF'
 {"limits":[
   {"kind":"session","group":"session","percent":0,"resets_at":null,"scope":null},
@@ -2476,10 +2484,33 @@ assert 'no_data' not in d, d
 assert (d['weekly_percent'], d['max_percent']) == (37, 37), d
 assert d['weekly_resets_epoch'] == calendar.timegm(
     time.strptime("2099-01-05T00:00:00", "%Y-%m-%dT%H:%M:%S")), d
-assert 'session_percent' not in d, d             # the 5h bucket reported nothing at all
+# The 5h window is CLOSED, not undocumented, so it holds no usage. max_percent is still
+# taken over the INFORMATIVE buckets only, so this idle 0 never becomes a bucket reading.
+assert d['session_percent'] == 0, d
 EOF
-[ $? -eq 0 ] && t_ok "a weekly-only reading records weekly+max+horizon and NO session_percent" \
-  || t_fail "weekly-only signals" "see $ND/acct-01/limits.json"
+[ $? -eq 0 ] && t_ok "an idle 5h bucket beside a real weekly one records session_percent 0" \
+  || t_fail "idle-session signals" "see $ND/acct-01/limits.json"
+
+# A payload with NO session bucket at ALL is the same story told by omission — the shape
+# every codex account produces while it is quiet. It must rank, not vanish.
+cat > "$WORK/usage-no-session-bucket.json" <<'EOF'
+{"limits":[
+  {"kind":"weekly_all","group":"weekly","percent":37,"resets_at":"2099-01-05T00:00:00+00:00","scope":null}
+]}
+EOF
+ndlimits "$WORK/usage-no-session-bucket.json" --quiet >/dev/null
+python3 - "$ND/acct-01/limits.json" <<'EOF'
+import json, sys
+d = json.load(open(sys.argv[1]))
+assert 'no_data' not in d, d
+assert (d['weekly_percent'], d['session_percent'], d['max_percent']) == (37, 0, 37), d
+EOF
+[ $? -eq 0 ] && t_ok "a payload with no session bucket at all still records session_percent 0" \
+  || t_fail "absent-session signals" "see $ND/acct-01/limits.json"
+
+# ...and that account RANKS: idle plus the better weekly must beat a busier rival — the
+# pick the pool was losing. acct-02 is worse on weekly (80 vs 37) and clears the gate
+# too, so the band alone separates them.
 ndl 80 10 80 > "$ND/acct-02/limits.json"
 rm -f "$ND/.pick-seq" "$ND"/acct-0*/.last-pick "$ND"/acct-0*/.limited
 : > "$ND/selection.log"
@@ -2487,12 +2518,96 @@ nd_wk_hits=0
 for _ in $(seq 1 6); do
   case "$(CLAUDE_ACCOUNTS_ROOT="$ND" claude 2>&1)" in *CFG=acct-01*) nd_wk_hits=$((nd_wk_hits+1)) ;; esac
 done
-[ "$nd_wk_hits" = "0" ] \
-  && t_ok "an unknown session reading never clears the gate, even with the better weekly (0 of 6)" \
-  || t_fail "weekly-only gate" "the session-less account cleared the gate $nd_wk_hits of 6 times"
-grep -q "acct-02 weekly=80% session=10% band=30 band-count=1 session-gate=50 session-ok=1" "$ND/selection.log" \
-  && t_ok "the log shows one account clearing the gate and one band member" \
-  || t_fail "weekly-only gate log" "$(tail -1 "$ND/selection.log" 2>/dev/null)"
+[ "$nd_wk_hits" = "6" ] \
+  && t_ok "an idle account with the better weekly takes every pick (6 of 6)" \
+  || t_fail "idle-session ranking" "the idle account took $nd_wk_hits of 6"
+grep -q "acct-01 weekly=37% session=0% band=30 band-count=1 session-gate=50 session-ok=2" "$ND/selection.log" \
+  && t_ok "the log shows both clearing the gate and the idle account alone in the band" \
+  || t_fail "idle-session log" "$(tail -1 "$ND/selection.log" 2>/dev/null)"
+
+# The guard that must NOT move: a document where NOTHING answered is still unknown. The
+# all-zero 2026-09-04 shape has no informative bucket anywhere, so it writes no signals
+# at all and never picks up a fabricated session 0 on the way out.
+ndlimits "$WORK/usage-allzero.json" --quiet >/dev/null
+python3 - "$ND/acct-01/limits.json" <<'EOF'
+import json, sys
+d = json.load(open(sys.argv[1]))
+assert d.get('no_data') is True, d
+for k in ('max_percent', 'weekly_percent', 'session_percent', 'weekly_resets_epoch'):
+    assert k not in d, (k, d)
+EOF
+[ $? -eq 0 ] && t_ok "an all-zero payload still writes no session_percent (2026-09-04 holds)" \
+  || t_fail "allzero still unknown" "see $ND/acct-01/limits.json"
+
+# ---- 16-idle-marker. an INFERRED session 0 may rank, but it may never unpark ---------
+# 2026-09-22, the second half of the same day: with idle accounts ranking again, the
+# operator's `claude --resume` landed on acct-14 and was rejected inside a minute.
+# selection.log: "acct-14 client limit cleared by newer telemetry (0%)" one second before
+# the pick, and "LIMITED by its own session (five_hour)" 54s after it. acct-14 held a
+# client:five_hour marker from a REAL 429, and its telemetry — fetched at 13:04:16Z,
+# WHILE the client was being rejected — still reported the session bucket `percent: 0,
+# resets_at: null`. So a silent session bucket does NOT prove an idle account: the
+# endpoint may simply never report the 5h window. Recovery has to be MEASURED. The
+# clearing rule read max_percent, which is the WEEKLY peak when the session bucket is
+# silent — the cross-signal borrow the aggregation itself refuses to make.
+mk_client_marker() { # mk_client_marker <acct dir> <bucket> <age seconds> <reset in>
+  python3 - "$1" "$2" "$3" "$4" <<'PJ'
+import sys, time, os
+d, bucket, age, ahead = sys.argv[1], sys.argv[2], int(sys.argv[3]), int(sys.argv[4])
+now = int(time.time())
+marked = time.strftime('%Y-%m-%dT%H:%M:%SZ', time.gmtime(now - age))
+with open(os.path.join(d, '.limited'), 'w') as f:
+    f.write(f'{now + ahead}\n'
+            f'bucket=client:{bucket} percent=100 marked_at={marked} '
+            f'reason=client-rate-limit\n')
+PJ
+}
+# the acct-14 shape: a live 5h rejection, and telemetry whose session bucket is silent
+mk_client_marker "$ND/acct-01" five_hour 1200 7200
+ndlimits "$WORK/usage-weekly-only.json" --quiet >/dev/null
+{ [ -f "$ND/acct-01/.limited" ] \
+  && python3 -c "import json,sys; d=json.load(open('$ND/acct-01/limits.json')); sys.exit(0 if d.get('session_inferred') is True and d['session_percent'] == 0 else 1)"; } \
+  && t_ok "an inferred session 0 cannot clear a client:five_hour marker (writer)" \
+  || t_fail "inferred unpark (writer)" "marker gone, or session_inferred not recorded"
+
+# ...and the SHIM must agree, because it is the shim that logged the clear before the
+# bad pick. The rival is WORSE on weekly and must still take every launch.
+ndl 60 10 60 > "$ND/acct-02/limits.json"
+rm -f "$ND/.pick-seq" "$ND"/acct-0*/.last-pick "$ND/acct-02/.limited"
+: > "$ND/selection.log"
+nd_park_hits=0
+for _ in $(seq 1 6); do
+  case "$(CLAUDE_ACCOUNTS_ROOT="$ND" claude 2>&1)" in *CFG=acct-01*) nd_park_hits=$((nd_park_hits+1)) ;; esac
+done
+{ [ "$nd_park_hits" = "0" ] && [ -f "$ND/acct-01/.limited" ] \
+  && ! grep -q "cleared by newer telemetry" "$ND/selection.log"; } \
+  && t_ok "the shim never unparks a 5h marker on an inferred reading (0 of 6 picks)" \
+  || t_fail "inferred unpark (shim)" \
+     "the parked account took $nd_park_hits of 6; $(tail -1 "$ND/selection.log" 2>/dev/null)"
+
+# The #22 behaviour that must SURVIVE: a MEASURED low session reading still clears a 5h
+# marker. That window self-heals in hours, which is why #22 (2026-09-03) had to clear it
+# — this fix narrows the evidence, it does not park an account until its reset.
+mk_client_marker "$ND/acct-01" five_hour 1200 7200
+cat > "$WORK/usage-measured-session.json" <<'EOF'
+{"limits":[
+  {"kind":"session","group":"session","percent":5,"resets_at":"2099-01-01T00:00:00+00:00","scope":null},
+  {"kind":"weekly_all","group":"weekly","percent":37,"resets_at":"2099-01-05T00:00:00+00:00","scope":null}
+]}
+EOF
+ndlimits "$WORK/usage-measured-session.json" --quiet >/dev/null
+{ [ ! -f "$ND/acct-01/.limited" ] \
+  && python3 -c "import json,sys; d=json.load(open('$ND/acct-01/limits.json')); sys.exit(0 if 'session_inferred' not in d and d['session_percent'] == 5 else 1)"; } \
+  && t_ok "a MEASURED low session reading still clears a five_hour marker (#22 holds)" \
+  || t_fail "measured recovery" "see $ND/acct-01/.limited"
+
+# A WEEKLY marker is untouched by any of this — it was already un-clearable.
+mk_client_marker "$ND/acct-01" seven_day 1200 7200
+ndlimits "$WORK/usage-measured-session.json" --quiet >/dev/null
+[ -f "$ND/acct-01/.limited" ] \
+  && t_ok "a weekly marker still outlives even a measured reading (2026-09-04 holds)" \
+  || t_fail "weekly marker cleared" "see $ND/acct-01"
+rm -f "$ND"/acct-0*/.limited "$ND"/acct-0*/.client-limit-cleared
 
 # ---- 16-nodata-blind. a fresh timestamp is not a usable reading ---------------------
 # The third face of the same defect: blindness was judged on fetched_at alone, so a pool
@@ -5872,6 +5987,13 @@ done
   && t_ok "codex: an account with no weekly reading never enters the band (0 of 10 picks)" \
   || t_fail "codex session-only ranking" "the weekly-less account took $cs_hits of 10 picks"
 
+# The mirror image — a weekly reading whose ~5h window has nothing to say — is NOT the
+# same defect, and codex feels it hardest: an idle account's payload carries the 7d
+# window and no usable session window at all, so session_percent went permanently
+# absent across the whole pool. quota_known needs BOTH readings, so EVERY codex account
+# scored unknown, bestw never left 101, and the band collapsed into the all-gated tie —
+# codex picked uniformly at RANDOM instead of by headroom (selection.log 2026-09-22:
+# `session=?%` on every ranked line). A closed window holds no usage: it reads 0.
 cat > "$WORK/cx-usage-weekly-only.json" <<EOF
 {"email":"nd@cx","plan_type":"pro",
  "rate_limit":{"allowed":true,"limit_reached":false,
@@ -5885,13 +6007,32 @@ import json, sys
 d = json.load(open(sys.argv[1]))
 assert 'no_data' not in d, d
 assert (d['weekly_percent'], d['max_percent']) == (37, 37), d
-assert 'session_percent' not in d, d             # the 5h window reported nothing at all
+# The ~5h window is CLOSED, not undocumented, so it holds no usage. max_percent is still
+# taken over the INFORMATIVE windows only, so this idle 0 never becomes a reading.
+assert d['session_percent'] == 0, d
 EOF
-[ $? -eq 0 ] && t_ok "codex: a weekly-only reading records weekly+max and NO session_percent" \
-  || t_fail "codex weekly-only signals" "see $CD/acct-01/limits.json"
-# ...and the rivals are WORSE on weekly (80 against 37) and still take every pick,
-# because they are the only ones that can clear the session gate — which is exactly what
-# a fabricated `session_percent: 0` would have handed the silent account for free.
+[ $? -eq 0 ] && t_ok "codex: an idle 5h window beside a real weekly one records session_percent 0" \
+  || t_fail "codex idle-session signals" "see $CD/acct-01/limits.json"
+
+# The same story told by omission: no session window in the payload at all.
+cat > "$WORK/cx-usage-no-session.json" <<EOF
+{"email":"nd@cx","plan_type":"pro",
+ "rate_limit":{"allowed":true,"limit_reached":false,
+   "secondary_window":{"used_percent":37,"limit_window_seconds":604800,"reset_at":$((now+90000))}},
+ "additional_rate_limits":[]}
+EOF
+cdlimits "$WORK/cx-usage-no-session.json" --quiet >/dev/null
+python3 - "$CD/acct-01/limits.json" <<'EOF'
+import json, sys
+d = json.load(open(sys.argv[1]))
+assert 'no_data' not in d, d
+assert (d['weekly_percent'], d['session_percent'], d['max_percent']) == (37, 0, 37), d
+EOF
+[ $? -eq 0 ] && t_ok "codex: a payload with no session window at all records session_percent 0" \
+  || t_fail "codex absent-session signals" "see $CD/acct-01/limits.json"
+
+# ...and it RANKS: idle plus the better weekly (37) must beat busier rivals (80), which
+# is the pick this pool was losing on every single invocation.
 cdl 80 10 80 > "$CD/acct-02/limits.json"
 cdl 80 10 80 > "$CD/acct-03/limits.json"
 rm -f "$CD/.pick-seq" "$CD"/acct-0*/.last-pick
@@ -5900,12 +6041,53 @@ cwk_hits=0
 for _ in $(seq 1 6); do
   case "$(CODEX_ACCOUNTS_ROOT="$CD" codex 2>&1)" in *CFG=acct-01*) cwk_hits=$((cwk_hits+1)) ;; esac
 done
-[ "$cwk_hits" = "0" ] \
-  && t_ok "codex: an unknown session reading never clears the gate, even with the better weekly (0 of 6)" \
-  || t_fail "codex weekly-only gate" "the session-less account cleared the gate $cwk_hits of 6 times"
-grep -q "band=30 band-count=2 session-gate=50 session-ok=2" "$CD/selection.log" \
-  && t_ok "codex: the log shows exactly the two accounts that reported a session bucket" \
-  || t_fail "codex weekly-only gate log" "$(tail -1 "$CD/selection.log" 2>/dev/null)"
+[ "$cwk_hits" = "6" ] \
+  && t_ok "codex: an idle account with the better weekly takes every pick (6 of 6)" \
+  || t_fail "codex idle-session ranking" "the idle account took $cwk_hits of 6"
+grep -q "acct-01 weekly=37% session=0% band=30 band-count=1 session-gate=50 session-ok=3" "$CD/selection.log" \
+  && t_ok "codex: all three clear the gate and the idle account is alone in the band" \
+  || t_fail "codex idle-session log" "$(tail -1 "$CD/selection.log" 2>/dev/null)"
+
+# The guard that must NOT move: a payload where NOTHING answered stays unknown, and
+# never picks up a fabricated session 0 on the way out.
+cdlimits "$WORK/cx-usage-allzero.json" --quiet >/dev/null
+python3 - "$CD/acct-01/limits.json" <<'EOF'
+import json, sys
+d = json.load(open(sys.argv[1]))
+assert d.get('no_data') is True, d
+for k in ('max_percent', 'weekly_percent', 'session_percent'):
+    assert k not in d, (k, d)
+EOF
+[ $? -eq 0 ] && t_ok "codex: an all-zero payload still writes no session_percent (2026-09-04 holds)" \
+  || t_fail "codex allzero still unknown" "see $CD/acct-01/limits.json"
+
+# ...and the same guard one window down: an INFERRED session 0 may rank, never unpark.
+# codex reports no window at all for a closed one, so silence is its NORMAL shape and
+# says nothing about a 429 the client actually received. codex's only telemetry-driven
+# clear lives here in `limits` (the shim has none — marker_active waits for the reset),
+# so this is the single place the rule has to hold.
+mk_client_marker "$CD/acct-01" 5h 1200 7200
+cdlimits "$WORK/cx-usage-weekly-only.json" --quiet >/dev/null
+{ [ -f "$CD/acct-01/.limited" ] \
+  && python3 -c "import json,sys; d=json.load(open('$CD/acct-01/limits.json')); sys.exit(0 if d.get('session_inferred') is True and d['session_percent'] == 0 else 1)"; } \
+  && t_ok "codex: an inferred session 0 cannot clear a client:5h marker" \
+  || t_fail "codex inferred unpark" "marker gone, or session_inferred not recorded"
+
+# ...while a MEASURED short-window reading still clears it (#22 holds on codex too).
+mk_client_marker "$CD/acct-01" 5h 1200 7200
+cat > "$WORK/cx-usage-measured-session.json" <<EOF
+{"email":"nd@cx","plan_type":"pro",
+ "rate_limit":{"allowed":true,"limit_reached":false,
+   "primary_window":{"used_percent":5,"limit_window_seconds":18000,"reset_at":$((now+9000))},
+   "secondary_window":{"used_percent":37,"limit_window_seconds":604800,"reset_at":$((now+90000))}},
+ "additional_rate_limits":[]}
+EOF
+cdlimits "$WORK/cx-usage-measured-session.json" --quiet >/dev/null
+{ [ ! -f "$CD/acct-01/.limited" ] \
+  && python3 -c "import json,sys; d=json.load(open('$CD/acct-01/limits.json')); sys.exit(0 if 'session_inferred' not in d and d['session_percent'] == 5 else 1)"; } \
+  && t_ok "codex: a MEASURED low session reading still clears a 5h marker (#22 holds)" \
+  || t_fail "codex measured recovery" "see $CD/acct-01/.limited"
+rm -f "$CD"/acct-0*/.limited "$CD"/acct-0*/.client-limit-cleared
 rm -f "$CD"/acct-0*/.limited
 
 # ---- C14. oauth refresh via the token endpoint --------------------------------------