claude-multiacc 2.0.34 → 2.0.35

package/bin/claude

@@ -301,6 +301,24 @@ client_marker_recovered() { # $1 account dir, $2 marker
       *) bucket="" ;;
     esac
     case "$(sel_lc "$bucket")" in *seven_day*|*7d*|*weekly*) return 1 ;; esac
+    # ...and a SESSION rejection is only disproved by a reading that actually measured
+    # the session window. `peak` below is max_percent, which is the WEEKLY buckets' peak
+    # whenever the 5h bucket says nothing — clearing a five_hour marker on it borrows
+    # across signals exactly as the writer refuses to. 2026-09-22, acct-14: telemetry
+    # fetched WHILE the client was being rejected still read the session bucket
+    # `percent: 0, resets_at: null`, so the writer flags that 0 as inferred; the marker
+    # was cleared on it, `--resume` landed on the account, and the run died in a minute.
+    # A silent session bucket proves nothing about a 429 the client actually received.
+    case "$(sel_lc "$bucket")" in
+      *five_hour*|*5h*|*session*)
+        # A literal test, not limits_field: that parser is integer-only and its
+        # `[^0-9]*` would happily skip past `true` and return a digit from the NEXT
+        # field, which would read as "inferred" on every document.
+        LC_ALL=C grep -q '"session_inferred"[[:space:]]*:[[:space:]]*true' \
+          "$1/limits.json" 2>/dev/null && return 1
+        cutoff_field "$1" session_percent >/dev/null 2>&1 || return 1
+        ;;
+    esac
     fetched="$(telem_fetched_at "$1" 2>/dev/null || echo 0)"
     # Defaulting peak to 100 when the reading is missing/stale is the second half of the
     # same rule: an UNINFORMATIVE reading must never clear a marker. It is what keeps a

package/bin/claude-accounts

@@ -1651,6 +1651,15 @@ def marker_bucket(txt):
             return part[7:]
     return ''
 
+def session_marker(txt):
+    # The self-healing 5h/session window, named the way each client writes it:
+    # claude's own type is `five_hour`, codex labels a short window `client:5h`, and a
+    # bare `session` covers the writer's own marker. Anything else (a weekly name, an
+    # unparseable line) is NOT a session marker and keeps its existing handling.
+    b = marker_bucket(txt).lower()
+    return 'five_hour' in b or '5h' in b or 'session' in b
+
+
 def weekly_marker(txt):
     # Matched the way both shims match it (bin/claude ~303, same token list): the
     # claude client writes client:seven_day / client:seven_day_opus, the codex client
@@ -2325,6 +2334,7 @@ for acct in manifest.get('accounts', []):
     # So: a session bucket that said nothing inside a document that DID answer reads 0.
     # A document where NOTHING answered still writes no signals at all (see below) —
     # the 2026-09-04 all-zero shape stays unknown, which is the whole point.
+    session_measured = bool(session)
     if sessionp is None and live:
         sessionp = 0
     # How long weekly_percent keeps meaning something. A weekly bucket only ever RISES
@@ -2345,6 +2355,16 @@ for acct in manifest.get('accounts', []):
         out['weekly_percent'] = weeklyp
     if sessionp is not None:
         out['session_percent'] = sessionp
+    if sessionp is not None and not session_measured:
+        # Ranking may use this 0 (that is the whole point — an idle account has to get
+        # back into the band), but NOTHING may treat it as proof of recovery. 2026-09-22,
+        # acct-14: a client:five_hour marker written from a real 429 at 13:06:31Z, and
+        # telemetry fetched at 13:04:16Z — WHILE the account was being rejected — still
+        # reported the session bucket `percent: 0, resets_at: null`. So a silent session
+        # bucket does NOT prove an idle account; the endpoint simply may not report the
+        # 5h window at all. The marker was cleared anyway, `--resume` landed straight on
+        # it, and the run was rejected inside a minute. Recovery has to be MEASURED.
+        out['session_inferred'] = True
     if weeklyp is not None:
         # Written with weekly_percent or not at all: the horizon describes THAT
         # reading, and the shim's degraded path needs both or neither.
@@ -2446,6 +2466,13 @@ for acct in manifest.get('accounts', []):
                     keep = True
                 elif active and is_client and weekly_marker(txt):
                     keep = True
+                elif active and is_client and session_marker(txt) and not session_measured:
+                    # Same rule as the weekly one, one window down: a rejection the CLIENT
+                    # reported is only disproved by telemetry that actually looked at the
+                    # window it names. `max_percent` here comes from the WEEKLY buckets
+                    # when the session bucket is silent, and clearing a 5h marker on it is
+                    # the cross-signal borrow the aggregation above refuses to make.
+                    keep = True
                 elif active and ('reason=error-cooldown' in txt
                                  or (is_client and recent_client)):
                     keep = True

package/bin/codex-accounts

@@ -1154,6 +1154,14 @@ def marker_bucket(txt):
             return part[7:]
     return ''
 
+def session_marker(txt):
+    # The self-healing ~5h window as each client names it: codex labels a short window
+    # `client:5h`, claude's own type is `five_hour`, and a bare `session` covers the
+    # writer's own marker. Kept identical to bin/claude-accounts' copy.
+    b = marker_bucket(txt).lower()
+    return 'five_hour' in b or '5h' in b or 'session' in b
+
+
 def weekly_marker(txt):
     # Matched the way both shims match it (bin/claude ~303, same token list): the
     # claude client writes client:seven_day / client:seven_day_opus, and the codex
@@ -1599,6 +1607,7 @@ for acct in manifest.get('accounts', []):
     # one is never silent — it reports at/near 100% with the reset it is waiting on.
     # So a missing or silent session reads 0 whenever the payload answered at all; a
     # payload where NOTHING answered still writes no signals and stays unknown below.
+    session_measured = bool(session)
     if sessionp is None and live:
         sessionp = 0
     try:
@@ -1619,6 +1628,13 @@ for acct in manifest.get('accounts', []):
         out['weekly_percent'] = weeklyp
     if sessionp is not None:
         out['session_percent'] = sessionp
+    if sessionp is not None and not session_measured:
+        # Ranking may use this 0 — an idle account has to get back into the band — but
+        # nothing may read it as proof of recovery. codex reports no window at all for a
+        # closed one, so silence here is the NORMAL shape and says nothing whatsoever
+        # about a 429 the client actually received. See the claude writer for the live
+        # case that proved it (acct-14, 2026-09-22).
+        out['session_inferred'] = True
     if not live:
         # Nothing usable in the entire payload. Keep the diagnostics (fetched_at,
         # source, plan, the raw buckets) and write NONE of the percent signals: a
@@ -1727,6 +1743,13 @@ for acct in manifest.get('accounts', []):
                     keep = True
                 elif active and is_client and weekly_marker(txt):
                     keep = True
+                elif active and is_client and session_marker(txt) and not session_measured:
+                    # Same rule one window down: a rejection the CLIENT reported is only
+                    # disproved by telemetry that looked at the window it names. With the
+                    # session window silent, max_percent is the WEEKLY peak, and clearing
+                    # a 5h marker on it is the cross-signal borrow the aggregation above
+                    # refuses to make.
+                    keep = True
                 elif active and ('reason=error-cooldown' in txt
                                  or (is_client and recent_client)):
                     keep = True

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-multiacc",
-  "version": "2.0.34",
+  "version": "2.0.35",
   "description": "Unified Claude Code and OpenAI Codex subscription pooling with quota-aware selection.",
   "type": "module",
   "bin": {

package/tests/run-tests.sh

@@ -2539,6 +2539,76 @@ EOF
 [ $? -eq 0 ] && t_ok "an all-zero payload still writes no session_percent (2026-09-04 holds)" \
   || t_fail "allzero still unknown" "see $ND/acct-01/limits.json"
 
+# ---- 16-idle-marker. an INFERRED session 0 may rank, but it may never unpark ---------
+# 2026-09-22, the second half of the same day: with idle accounts ranking again, the
+# operator's `claude --resume` landed on acct-14 and was rejected inside a minute.
+# selection.log: "acct-14 client limit cleared by newer telemetry (0%)" one second before
+# the pick, and "LIMITED by its own session (five_hour)" 54s after it. acct-14 held a
+# client:five_hour marker from a REAL 429, and its telemetry — fetched at 13:04:16Z,
+# WHILE the client was being rejected — still reported the session bucket `percent: 0,
+# resets_at: null`. So a silent session bucket does NOT prove an idle account: the
+# endpoint may simply never report the 5h window. Recovery has to be MEASURED. The
+# clearing rule read max_percent, which is the WEEKLY peak when the session bucket is
+# silent — the cross-signal borrow the aggregation itself refuses to make.
+mk_client_marker() { # mk_client_marker <acct dir> <bucket> <age seconds> <reset in>
+  python3 - "$1" "$2" "$3" "$4" <<'PJ'
+import sys, time, os
+d, bucket, age, ahead = sys.argv[1], sys.argv[2], int(sys.argv[3]), int(sys.argv[4])
+now = int(time.time())
+marked = time.strftime('%Y-%m-%dT%H:%M:%SZ', time.gmtime(now - age))
+with open(os.path.join(d, '.limited'), 'w') as f:
+    f.write(f'{now + ahead}\n'
+            f'bucket=client:{bucket} percent=100 marked_at={marked} '
+            f'reason=client-rate-limit\n')
+PJ
+}
+# the acct-14 shape: a live 5h rejection, and telemetry whose session bucket is silent
+mk_client_marker "$ND/acct-01" five_hour 1200 7200
+ndlimits "$WORK/usage-weekly-only.json" --quiet >/dev/null
+{ [ -f "$ND/acct-01/.limited" ] \
+  && python3 -c "import json,sys; d=json.load(open('$ND/acct-01/limits.json')); sys.exit(0 if d.get('session_inferred') is True and d['session_percent'] == 0 else 1)"; } \
+  && t_ok "an inferred session 0 cannot clear a client:five_hour marker (writer)" \
+  || t_fail "inferred unpark (writer)" "marker gone, or session_inferred not recorded"
+
+# ...and the SHIM must agree, because it is the shim that logged the clear before the
+# bad pick. The rival is WORSE on weekly and must still take every launch.
+ndl 60 10 60 > "$ND/acct-02/limits.json"
+rm -f "$ND/.pick-seq" "$ND"/acct-0*/.last-pick "$ND/acct-02/.limited"
+: > "$ND/selection.log"
+nd_park_hits=0
+for _ in $(seq 1 6); do
+  case "$(CLAUDE_ACCOUNTS_ROOT="$ND" claude 2>&1)" in *CFG=acct-01*) nd_park_hits=$((nd_park_hits+1)) ;; esac
+done
+{ [ "$nd_park_hits" = "0" ] && [ -f "$ND/acct-01/.limited" ] \
+  && ! grep -q "cleared by newer telemetry" "$ND/selection.log"; } \
+  && t_ok "the shim never unparks a 5h marker on an inferred reading (0 of 6 picks)" \
+  || t_fail "inferred unpark (shim)" \
+     "the parked account took $nd_park_hits of 6; $(tail -1 "$ND/selection.log" 2>/dev/null)"
+
+# The #22 behaviour that must SURVIVE: a MEASURED low session reading still clears a 5h
+# marker. That window self-heals in hours, which is why #22 (2026-09-03) had to clear it
+# — this fix narrows the evidence, it does not park an account until its reset.
+mk_client_marker "$ND/acct-01" five_hour 1200 7200
+cat > "$WORK/usage-measured-session.json" <<'EOF'
+{"limits":[
+  {"kind":"session","group":"session","percent":5,"resets_at":"2099-01-01T00:00:00+00:00","scope":null},
+  {"kind":"weekly_all","group":"weekly","percent":37,"resets_at":"2099-01-05T00:00:00+00:00","scope":null}
+]}
+EOF
+ndlimits "$WORK/usage-measured-session.json" --quiet >/dev/null
+{ [ ! -f "$ND/acct-01/.limited" ] \
+  && python3 -c "import json,sys; d=json.load(open('$ND/acct-01/limits.json')); sys.exit(0 if 'session_inferred' not in d and d['session_percent'] == 5 else 1)"; } \
+  && t_ok "a MEASURED low session reading still clears a five_hour marker (#22 holds)" \
+  || t_fail "measured recovery" "see $ND/acct-01/.limited"
+
+# A WEEKLY marker is untouched by any of this — it was already un-clearable.
+mk_client_marker "$ND/acct-01" seven_day 1200 7200
+ndlimits "$WORK/usage-measured-session.json" --quiet >/dev/null
+[ -f "$ND/acct-01/.limited" ] \
+  && t_ok "a weekly marker still outlives even a measured reading (2026-09-04 holds)" \
+  || t_fail "weekly marker cleared" "see $ND/acct-01"
+rm -f "$ND"/acct-0*/.limited "$ND"/acct-0*/.client-limit-cleared
+
 # ---- 16-nodata-blind. a fresh timestamp is not a usable reading ---------------------
 # The third face of the same defect: blindness was judged on fetched_at alone, so a pool
 # of freshly-written no_data documents looked FRESH — selection.log carried no
@@ -5990,6 +6060,34 @@ for k in ('max_percent', 'weekly_percent', 'session_percent'):
 EOF
 [ $? -eq 0 ] && t_ok "codex: an all-zero payload still writes no session_percent (2026-09-04 holds)" \
   || t_fail "codex allzero still unknown" "see $CD/acct-01/limits.json"
+
+# ...and the same guard one window down: an INFERRED session 0 may rank, never unpark.
+# codex reports no window at all for a closed one, so silence is its NORMAL shape and
+# says nothing about a 429 the client actually received. codex's only telemetry-driven
+# clear lives here in `limits` (the shim has none — marker_active waits for the reset),
+# so this is the single place the rule has to hold.
+mk_client_marker "$CD/acct-01" 5h 1200 7200
+cdlimits "$WORK/cx-usage-weekly-only.json" --quiet >/dev/null
+{ [ -f "$CD/acct-01/.limited" ] \
+  && python3 -c "import json,sys; d=json.load(open('$CD/acct-01/limits.json')); sys.exit(0 if d.get('session_inferred') is True and d['session_percent'] == 0 else 1)"; } \
+  && t_ok "codex: an inferred session 0 cannot clear a client:5h marker" \
+  || t_fail "codex inferred unpark" "marker gone, or session_inferred not recorded"
+
+# ...while a MEASURED short-window reading still clears it (#22 holds on codex too).
+mk_client_marker "$CD/acct-01" 5h 1200 7200
+cat > "$WORK/cx-usage-measured-session.json" <<EOF
+{"email":"nd@cx","plan_type":"pro",
+ "rate_limit":{"allowed":true,"limit_reached":false,
+   "primary_window":{"used_percent":5,"limit_window_seconds":18000,"reset_at":$((now+9000))},
+   "secondary_window":{"used_percent":37,"limit_window_seconds":604800,"reset_at":$((now+90000))}},
+ "additional_rate_limits":[]}
+EOF
+cdlimits "$WORK/cx-usage-measured-session.json" --quiet >/dev/null
+{ [ ! -f "$CD/acct-01/.limited" ] \
+  && python3 -c "import json,sys; d=json.load(open('$CD/acct-01/limits.json')); sys.exit(0 if 'session_inferred' not in d and d['session_percent'] == 5 else 1)"; } \
+  && t_ok "codex: a MEASURED low session reading still clears a 5h marker (#22 holds)" \
+  || t_fail "codex measured recovery" "see $CD/acct-01/.limited"
+rm -f "$CD"/acct-0*/.limited "$CD"/acct-0*/.client-limit-cleared
 rm -f "$CD"/acct-0*/.limited
 
 # ---- C14. oauth refresh via the token endpoint --------------------------------------