claude-multiacc 2.0.34 → 2.0.36

package/README.md

@@ -177,6 +177,37 @@ buckets keep being tracked and the ≥90% rule keeps working. Unparseable entrie
 skipped, an all-legacy payload falls back to `five_hour`/`seven_day`, and a payload the
 code cannot read at all degrades that one account (fail open), never the run.
 
+**Limit resets are redeemed automatically, but only when one earns its keep.** Claude
+Code 2.1.280 added `/limit-reset`: an account can hold a *grant* (the Opus 5.5 launch gave
+every Pro/Max account one reset, usable until 2026-10-22) that refills its five-hour and
+weekly limits at once while the weekly reset day stays put. The same usage call carries the
+grant's status (`?cedar_ember=1&skip_spend=1`, Claude Code's own read, so it costs nothing
+against the endpoint's hourly budget), and the limits pass claims it with
+`POST /api/organizations/<org>/reset_rate_limits` when a **weekly** limit the grant refills
+is ≥ 95% used or reported exhausted — the codex rule, narrowed because a Claude reset is one
+irreversible shot. A full five-hour window alone never spends it (it refills in hours and the
+pool picks another account), and it is held while the account's own week refills in under
+24 h (`CLAUDE_MULTIACC_RESET_MIN_HORIZON`, seconds). The claim carries a request id derived
+from the account, grant, remaining count and week, persisted before the POST, so a lost
+response is retried with the same id and fleet peers converge on one claim; a claim whose
+answer never came back is settled by the grant's own remaining count dropping, and a claim
+the server refuses outright backs off (honouring `Retry-After`) instead of being re-sent every
+pass. A confirmed reset zeroes the pre-reset reading's `fetched_at`, withdraws its numbers,
+and drops the account's `.limited` marker — including a client-reported weekly one, which no
+telemetry can otherwise lift — with the same `.client-limit-cleared` watermark a telemetry
+clear writes. Because peers are pushed markers but never their deletion, the reset also rides
+in `limits.json` for 8 days (`reset_redeemed_at`, `reset_cleared`): every machine's shim,
+`list`/`status` and the app-robot panel treat any park written before it, for a window it
+refilled, as lifted. A reset claimed elsewhere (a peer, or `/limit-reset` by hand) enters the
+same record when one grant's own count drops. Only an OAuth login can
+claim (the same credential the usage read proved). `reset_credits_available` /
+`reset_credits_fetched_at` report the measured allowance exactly as the codex pool does. The
+server answers eligibility by client (`ineligible_reason: surface` to anything that is not
+the CLI), so the writer sends Claude Code's own User-Agent with the installed version and
+`client-app/claude-multiacc`; with no readable version it names itself plainly and claims
+nothing. `CLAUDE_MULTIACC_AUTO_RESET=0` is the kill switch. The separate `juniper_tide`
+session reset (it spends weekly budget) is never touched.
+
 **A 0% bucket with no reset window is no data, not an empty account.** Real usage always
 carries the window it resets in, so `percent: 0` with a null `resets_at` is the endpoint
 declining to answer — and taking it at face value put two weekly-exhausted accounts at the

package/bin/claude

@@ -301,6 +301,24 @@ client_marker_recovered() { # $1 account dir, $2 marker
       *) bucket="" ;;
     esac
     case "$(sel_lc "$bucket")" in *seven_day*|*7d*|*weekly*) return 1 ;; esac
+    # ...and a SESSION rejection is only disproved by a reading that actually measured
+    # the session window. `peak` below is max_percent, which is the WEEKLY buckets' peak
+    # whenever the 5h bucket says nothing — clearing a five_hour marker on it borrows
+    # across signals exactly as the writer refuses to. 2026-09-22, acct-14: telemetry
+    # fetched WHILE the client was being rejected still read the session bucket
+    # `percent: 0, resets_at: null`, so the writer flags that 0 as inferred; the marker
+    # was cleared on it, `--resume` landed on the account, and the run died in a minute.
+    # A silent session bucket proves nothing about a 429 the client actually received.
+    case "$(sel_lc "$bucket")" in
+      *five_hour*|*5h*|*session*)
+        # A literal test, not limits_field: that parser is integer-only and its
+        # `[^0-9]*` would happily skip past `true` and return a digit from the NEXT
+        # field, which would read as "inferred" on every document.
+        LC_ALL=C grep -q '"session_inferred"[[:space:]]*:[[:space:]]*true' \
+          "$1/limits.json" 2>/dev/null && return 1
+        cutoff_field "$1" session_percent >/dev/null 2>&1 || return 1
+        ;;
+    esac
     fetched="$(telem_fetched_at "$1" 2>/dev/null || echo 0)"
     # Defaulting peak to 100 when the reading is missing/stale is the second half of the
     # same rule: an UNINFORMATIVE reading must never clear a marker. It is what keeps a
@@ -335,6 +353,59 @@ client_marker_recovered() { # $1 account dir, $2 marker
   return 1
 }
 
+# A confirmed limit reset (lib/claude_reset.py) lifts every park written BEFORE it for a
+# window it refilled. The writer records it in limits.json — reset_redeemed_at (epoch) and
+# reset_cleared (comma-separated limit types) — because that document is what reaches
+# every machine: peers are pushed `.limited` files but never their deletion, so a marker
+# the source cleared lives on elsewhere until its own reset, days away for a weekly one.
+# Same rule as claude_reset.marker_superseded; a marker without marked_at never matches.
+# Note the panel's `weekly_all` can name the Fable window; the launch grant refills both.
+reset_supersedes_marker() { # $1 acct dir, $2 marker file
+  # Hot path (every account with a marker, every invocation): ONE sed for the record, the
+  # writer's precomputed UTC key instead of a date(1) fork, builtins for the rest.
+  local rec at="" key="" cleared="" line="" marked mk bucket t
+  [ -f "$1/limits.json" ] || return 1
+  # h/g restore the line between expressions, so a one-line document (every field on
+  # one line) yields all three just as the writer's indented one does.
+  rec="$(LC_ALL=C sed -n -e h \
+    -e 's/.*"reset_redeemed_at"[^0-9]*\([0-9][0-9]*\).*/A \1/p' -e g \
+    -e 's/.*"reset_redeemed_key"[^0-9]*\([0-9]\{14\}\).*/K \1/p' -e g \
+    -e 's/.*"reset_cleared"[[:space:]]*:[[:space:]]*"\([a-z0-9_,]*\)".*/C \1/p' \
+    "$1/limits.json" 2>/dev/null)"
+  [ -n "$rec" ] || return 1
+  # Split on the tags, not on newlines: sed keeps a final line's missing newline, so a
+  # one-line document runs the tagged values together.
+  case "$rec" in *"A "*) at="${rec#*A }"; at="${at%%[!0-9]*}" ;; esac
+  case "$rec" in *"K "*) key="${rec#*K }"; key="${key%%[!0-9]*}" ;; esac
+  case "$rec" in *"C "*) cleared="${rec#*C }"; cleared="${cleared%%[!a-z0-9_,]*}" ;; esac
+  num_ok "$at" && [ -n "$cleared" ] || return 1
+  [ $((now - at)) -le 691200 ] || return 1
+  if [ "${#key}" -ne 14 ]; then
+    key="$(iso_of_epoch "$at")"; key="${key//[!0-9]/}"; key="${key:0:14}"
+  fi
+  { IFS= read -r line; IFS= read -r line; } < "$2" 2>/dev/null
+  case "$line" in *marked_at=*) marked="${line#*marked_at=}"; marked="${marked%% *}" ;; *) return 1 ;; esac
+  mk="${marked%%.*}"; mk="${mk//[!0-9]/}"; mk="${mk:0:14}"
+  num_ok "$mk" && num_ok "$key" && [ "${#mk}" -eq 14 ] && [ "${#key}" -eq 14 ] || return 1
+  [ "$mk" -le "$key" ] || return 1
+  bucket=""
+  case "$line" in *bucket=*) bucket="${line#*bucket=}"; bucket="${bucket%% *}" ;; esac
+  bucket="$(sel_lc "$bucket")"
+  case "$bucket" in
+    client:*) t="${bucket#client:}" ;;
+    weekly_scoped:*fable*) t=seven_day_overage_included ;;
+    weekly_scoped:*opus*) t=seven_day_opus ;;
+    weekly_scoped:*sonnet*) t=seven_day_sonnet ;;
+    weekly_scoped:*) return 1 ;;
+    session*|five_hour|5h) t=five_hour ;;
+    weekly_all|seven_day|weekly|7d) t=seven_day ;;
+    ''|panel:observed|limit_reached|unknown) return 0 ;;
+    *) t="$bucket" ;;
+  esac
+  case ",$cleared," in *",$t,"*) return 0 ;; esac
+  return 1
+}
+
 marker_active() { # true if $1/.limited is still in force; clears cleanly-expired markers
   local m="$1/.limited" reset="" tok
   [ -f "$m" ] || return 1
@@ -349,6 +420,11 @@ marker_active() { # true if $1/.limited is still in force; clears cleanly-expire
     rm -f "$m" 2>/dev/null
     return 1
   fi
+  if reset_supersedes_marker "$1" "$m"; then
+    rm -f "$m" 2>/dev/null
+    sel_log "$(basename "$1") marker lifted — written before a confirmed limit reset"
+    return 1
+  fi
   if client_marker_recovered "$1" "$m"; then
     printf '%s\n' "$CLIENT_RECOVERY_FETCHED" > "$1/.client-limit-cleared.$$" 2>/dev/null \
       && mv -f "$1/.client-limit-cleared.$$" "$1/.client-limit-cleared" 2>/dev/null \
@@ -767,7 +843,7 @@ sess_transcript() { # $1 acct dir, $2 session id
 # rejects the very next request too, and that lands in a newer transcript.
 client_limit_scan() { # $1 acct dir
   local idx="$1/.sessions-index" memo="$1/.client-scan" id p line r t read_n=0 i last=""
-  local ln claim ts ck ak ttl cleared sk
+  local ln claim ts ck ak ttl cleared sk rr="" rr_seen=""
   local ids=() claims=()
   [ "${CLAUDE_MULTIACC_CLIENT_LIMITS:-1}" = "0" ] && return 1
   [ -f "$idx" ] || return 1
@@ -820,6 +896,15 @@ client_limit_scan() { # $1 acct dir
     cleared=""
     [ -f "$1/.client-limit-cleared" ] \
       && { IFS= read -r cleared < "$1/.client-limit-cleared" 2>/dev/null || cleared=""; }
+    # A confirmed limit reset answers every rejection before it, on every machine the
+    # writer's limits.json reaches (the local watermark file never leaves the source).
+    if [ -z "$rr_seen" ]; then
+      rr_seen=1
+      rr="$(limits_field "$1" reset_redeemed_at 2>/dev/null)" || rr=""
+    fi
+    if num_ok "$rr" && { ! num_ok "$cleared" || [ "$rr" -gt "$cleared" ]; }; then
+      cleared="$rr"
+    fi
     if num_ok "$cleared"; then
       sk="$(iso_key "$(iso_of_epoch "$cleared")")"
       if num_ok "$ck" && num_ok "$sk"; then

package/bin/claude-accounts

@@ -81,7 +81,11 @@ USAGE
                                             or runner daemon distributes.
   claude-accounts verify [--quick]          auth matrix; full mode runs `-p "reply OK"` per account
   claude-accounts limits [--quiet] [--force] [--json]
-      refresh usage buckets, apply >=90% markers. Auto-refreshes long-expired
+      refresh usage buckets, apply >=90% markers. When a WEEKLY limit is at least
+      95% used or exhausted, automatically redeems the account's Claude Code limit
+      reset (/limit-reset) with an idempotent request — never for a five-hour
+      window alone, and not while the week refills on its own within 24h.
+      Auto-refreshes long-expired
       OAuth access tokens via the refresh-token grant (rotated credential is
       persisted), so idle accounts keep fresh telemetry and stay selectable.
       Skips accounts fetched in the last 45s and honors 429/refresh backoff;
@@ -100,6 +104,9 @@ ENV
   CLAUDE_ACCOUNT        pin the shim to one account
   CLAUDE_SHIM_RETRY=0   disable -p auto-retry
   CLAUDE_MULTIACC_DISABLE=1  bypass the shim entirely
+  CLAUDE_MULTIACC_AUTO_RESET=0  disable automatic limit-reset redemption
+  CLAUDE_MULTIACC_RESET_MIN_HORIZON  seconds before the natural weekly reset
+                        inside which a reset is held (default 86400)
 EOF
 }
 
@@ -207,6 +214,22 @@ doc = json.load(open(sys.argv[1]))
 root = sys.argv[2]
 sys.path = [sys.argv[3]] + [p for p in sys.path if p not in ('', '.')]
 from audit import audit_account   # noqa: E402  (shared with the shim's rule)
+
+
+def superseded_by_reset(d):
+    """lib/report.py's rule (and the shim's reset_supersedes_marker): a park written
+    before a confirmed limit reset, for a window it refilled, no longer binds."""
+    try:
+        import claude_reset, time as _time
+        with open(os.path.join(d, '.limited'), errors='replace') as handle:
+            text = handle.read(4096)
+        try:
+            ldoc = json.load(open(os.path.join(d, 'limits.json')))
+        except Exception:
+            ldoc = {}
+        return claude_reset.marker_superseded(text, claude_reset.record_from(ldoc, _time.time()))
+    except Exception:
+        return False
 machine = sys.argv[4]
 # Only render well-formed ids — a hand-edited manifest must not surface a traversal id.
 accounts = [a for a in doc.get('accounts', [])
@@ -224,6 +247,8 @@ for a in accounts:
     if os.path.getsize(os.path.join(d, 'server.token')) > 0 if os.path.isfile(os.path.join(d, 'server.token')) else False:
         auth.append('token')
     limited = os.path.isfile(os.path.join(d, '.limited'))
+    if limited and superseded_by_reset(d):
+        limited = False   # written before a confirmed limit reset; the shim lifts it
     flags = []
     if st['state'] == 'expired':
         flags.append('EXPIRED-LOGIN')
@@ -284,6 +309,22 @@ doc = json.load(open(sys.argv[1]))
 root = sys.argv[2]
 sys.path = [sys.argv[3]] + [p for p in sys.path if p not in ('', '.')]
 from audit import audit_account, oauth_login   # noqa: E402  (shared with the shim's rule)
+
+
+def superseded_by_reset(d):
+    """lib/report.py's rule (and the shim's reset_supersedes_marker): a park written
+    before a confirmed limit reset, for a window it refilled, no longer binds."""
+    try:
+        import claude_reset, time as _time
+        with open(os.path.join(d, '.limited'), errors='replace') as handle:
+            text = handle.read(4096)
+        try:
+            ldoc = json.load(open(os.path.join(d, 'limits.json')))
+        except Exception:
+            ldoc = {}
+        return claude_reset.marker_superseded(text, claude_reset.record_from(ldoc, _time.time()))
+    except Exception:
+        return False
 machine = sys.argv[4]
 now = time.time()
 # Must match the shim's window (bin/claude), or status would call data "fresh" that
@@ -412,7 +453,9 @@ for a in doc.get('accounts', []):
     else:
         print("  limits      : never fetched")
     mpath = os.path.join(d, '.limited')
-    if os.path.isfile(mpath):
+    if os.path.isfile(mpath) and superseded_by_reset(d):
+        print("  marker      : lifted — written before a confirmed limit reset (eligible)")
+    elif os.path.isfile(mpath):
         try:
             lines = open(mpath).read().splitlines()
             reset = int(lines[0]) if lines and lines[0].isdigit() else 0
@@ -1574,13 +1617,20 @@ cmd_limits() {
   case "$threshold" in ''|*[!0-9]*) threshold=90 ;; esac
   [ "$threshold" -gt 90 ] && threshold=90
   [ "$threshold" -lt 1 ] && threshold=90
-  "$PYBIN" - "$ACC_ROOT" "$threshold" "$quiet" "$USAGE_URL" "$force" "$LIB_DIR" <<'PYEOF' 2>>"$ACC_ROOT/limits.log"
+  # Claude Code's own User-Agent (with the REAL installed version) is what makes the
+  # usage endpoint answer the limit-reset status for this account; the writer learns the
+  # version from the real binary (lib/claude_reset.py cli_version, bounded by a timeout).
+  local real_claude
+  real_claude="$(find_real_claude "$_self" 2>/dev/null)" || real_claude=""
+  "$PYBIN" - "$ACC_ROOT" "$threshold" "$quiet" "$USAGE_URL" "$force" "$LIB_DIR" "$real_claude" <<'PYEOF' 2>>"$ACC_ROOT/limits.log"
 import hashlib, json, os, sys, time, urllib.request
 sys.path = [sys.argv[6]] + [p for p in sys.path if p not in ('', '.')]
 import keychain  # noqa: E402  (macOS Keychain-held logins; a no-op elsewhere)
 from audit import creds_doc_state  # noqa: E402  (one rule for "can this credential work")
+import claude_reset  # noqa: E402  (automatic limit-reset redemption, the codex_reset twin)
 
 root, threshold, quiet, url, force = sys.argv[1], int(sys.argv[2]), sys.argv[3] == '1', sys.argv[4], sys.argv[5] == '1'
+USER_AGENT = claude_reset.user_agent(claude_reset.cli_version(sys.argv[7] if len(sys.argv) > 7 else ''))
 now = time.time()
 # Don't re-fetch an account whose data is younger than this (endpoint rate-limits).
 MIN_FETCH_INTERVAL = int(os.environ.get('CLAUDE_MULTIACC_MIN_FETCH', '240'))
@@ -1651,6 +1701,15 @@ def marker_bucket(txt):
             return part[7:]
     return ''
 
+def session_marker(txt):
+    # The self-healing 5h/session window, named the way each client writes it:
+    # claude's own type is `five_hour`, codex labels a short window `client:5h`, and a
+    # bare `session` covers the writer's own marker. Anything else (a weekly name, an
+    # unparseable line) is NOT a session marker and keeps its existing handling.
+    b = marker_bucket(txt).lower()
+    return 'five_hour' in b or '5h' in b or 'session' in b
+
+
 def weekly_marker(txt):
     # Matched the way both shims match it (bin/claude ~303, same token list): the
     # claude client writes client:seven_day / client:seven_day_opus, the codex client
@@ -2075,12 +2134,13 @@ for acct in manifest.get('accounts', []):
             say(f'{aid}: no fresh bearer (expired oauth and/or no token); limits left as-is')
         continue
 
-    req = urllib.request.Request(url, headers={
+    headers = {
         'Authorization': 'Bearer ' + bearer,
         'anthropic-beta': 'oauth-2025-04-20',
         'Content-Type': 'application/json',
-        'User-Agent': 'claude-multiacc/1.0',
-    })
+        'User-Agent': USER_AGENT,
+    }
+    req = urllib.request.Request(url, headers=headers)
     try:
         resp = urllib.request.urlopen(req, timeout=15)
         data = json.loads(resp.read().decode())
@@ -2325,6 +2385,7 @@ for acct in manifest.get('accounts', []):
     # So: a session bucket that said nothing inside a document that DID answer reads 0.
     # A document where NOTHING answered still writes no signals at all (see below) —
     # the 2026-09-04 all-zero shape stays unknown, which is the whole point.
+    session_measured = bool(session)
     if sessionp is None and live:
         sessionp = 0
     # How long weekly_percent keeps meaning something. A weekly bucket only ever RISES
@@ -2338,13 +2399,39 @@ for acct in manifest.get('accounts', []):
     wresets = [int(b['resets_epoch']) for b in live
                if b['group'] != 'session' and b['percent'] == weeklyp
                and isinstance(b.get('resets_epoch'), int)]
+    # Limit resets ride on this very response (the usage URL asks for the cedar_ember
+    # status block), so reading the allowance costs no call against the endpoint's
+    # hourly budget. Same policy as codex: a limit the grant refills at >=95%, or one
+    # the server reports exhausted, spends the grant. Only an OAuth login can claim —
+    # the same credential this fetch just proved works. Fail OPEN like everything else.
+    reset_result, reset_view = {'status': 'not_eligible'}, {}
+    if source == 'oauth':
+        try:
+            reset_result, reset_view = claude_reset.refresh_reset_credits(
+                d, aid, data, url, headers, say, int(now))
+        except Exception as e:
+            say(f'{aid}: limit reset automation failed unexpectedly ({type(e).__name__}); '
+                f'failing open')
+            reset_result, reset_view = {'status': 'error'}, {}
+    redeemed = reset_result.get('status') == 'redeemed'
     out = {'fetched_at': int(now), 'source': source}
+    out.update(reset_view)
     if live:
         out['max_percent'] = maxp
     if weeklyp is not None:
         out['weekly_percent'] = weeklyp
     if sessionp is not None:
         out['session_percent'] = sessionp
+    if sessionp is not None and not session_measured:
+        # Ranking may use this 0 (that is the whole point — an idle account has to get
+        # back into the band), but NOTHING may treat it as proof of recovery. 2026-09-22,
+        # acct-14: a client:five_hour marker written from a real 429 at 13:06:31Z, and
+        # telemetry fetched at 13:04:16Z — WHILE the account was being rejected — still
+        # reported the session bucket `percent: 0, resets_at: null`. So a silent session
+        # bucket does NOT prove an idle account; the endpoint simply may not report the
+        # 5h window at all. The marker was cleared anyway, `--resume` landed straight on
+        # it, and the run was rejected inside a minute. Recovery has to be MEASURED.
+        out['session_inferred'] = True
     if weeklyp is not None:
         # Written with weekly_percent or not at all: the horizon describes THAT
         # reading, and the shim's degraded path needs both or neither.
@@ -2361,6 +2448,52 @@ for acct in manifest.get('accounts', []):
         say(f'{aid}: usage endpoint returned all-zero buckets with no reset windows — '
             f'no usable telemetry (account ranks as unknown, not as empty)')
     out['buckets'] = buckets
+    reset_record = None
+    reset_status = claude_reset.parse_status(data) if source == 'oauth' else None
+    if reset_status is not None:
+        out['reset_grants_seen'] = claude_reset.grants_seen(
+            reset_status, now, reset_result if redeemed else None)
+    elif isinstance(prev.get('reset_grants_seen'), dict):
+        out['reset_grants_seen'] = prev['reset_grants_seen']
+    observed = None
+    if redeemed:
+        # The claim response proves the limits refilled, but this usage GET happened
+        # BEFORE it. Make the snapshot stale at once so it cannot re-exclude the account
+        # (the codex writer's rule), and take the pre-reset numbers OUT of it: several
+        # readers ignore freshness — the shim's forced-fallback check reads buckets
+        # directly, the degraded path trusts a stale weekly until its horizon, and the
+        # app-robot panel reads session/weekly percentages with no age test at all — and
+        # every one of them would keep parking an account that was just refilled. The
+        # buckets the reset did not touch stay; the next pass reads server truth.
+        cleared = set(reset_result.get('cleared') or [])
+        out['fetched_at'] = 0
+        for key in ('weekly_resets_epoch', 'max_percent', 'weekly_percent',
+                    'session_percent', 'session_inferred', 'no_data'):
+            out.pop(key, None)
+        out['buckets'] = [b for b in buckets
+                          if claude_reset.bucket_limit_type(b['name']) not in cleared]
+        out['auto_reset'] = reset_result
+        reset_record = (int(reset_result['redeemed_at']), sorted(cleared))
+    else:
+        # A reset is honoured fleet-wide through THIS document (peers never see a marker
+        # deleted), so the record rides along on every later pass until nothing it could
+        # supersede can still exist. A reset this machine did not claim (a peer's, or a
+        # human's /limit-reset) enters it here, from the grant's own count dropping; this
+        # GET already came after it, so its numbers stand.
+        observed = claude_reset.observed_reset(prev, reset_status, now)
+        reset_record = claude_reset.latest(claude_reset.record_from(prev, now), observed,
+                                           claude_reset.local_record(d, now))
+        if observed and reset_record is observed:
+            say(f"{aid}: limit reset observed (a grant's count dropped; "
+                f"refilled {', '.join(observed[1])}) — lifting older parks")
+        else:
+            observed = None
+    if reset_record:
+        out['reset_redeemed_at'] = reset_record[0]
+        # The same moment as a UTC YYYYmmddHHMMSS key: the shim compares marked_at
+        # against it with builtins, no date(1) fork on the per-invocation path.
+        out['reset_redeemed_key'] = time.strftime('%Y%m%d%H%M%S', time.gmtime(reset_record[0]))
+        out['reset_cleared'] = ','.join(reset_record[1])
     tmp = lpath + '.tmp'
     with open(tmp, 'w') as f:
         json.dump(out, f, indent=1)
@@ -2368,7 +2501,19 @@ for acct in manifest.get('accounts', []):
     # The fetch went through with this account's own bearer => its auth is alive.
     if clear_expired(d):
         say(f'{aid}: dead-auth marker cleared (authenticated successfully)')
-    offenders = [b for b in buckets if b['percent'] >= threshold]
+    if redeemed or observed:
+        # The shim's transcript scan would otherwise re-create a park from the very
+        # rejection the reset just answered — whether or not a marker exists right now
+        # and whatever wrote it. Never move the watermark backwards.
+        cleared_path = os.path.join(d, '.client-limit-cleared')
+        try:
+            prior = int(open(cleared_path).read().split()[0])
+        except Exception:
+            prior = 0
+        with open(cleared_path + '.tmp', 'w') as f:
+            f.write(f'{max(prior, reset_record[0])}\n')
+        os.replace(cleared_path + '.tmp', cleared_path)
+    offenders = [] if redeemed else [b for b in buckets if b['percent'] >= threshold]
     mpath = os.path.join(d, '.limited')
     if offenders:
         # ONE bucket, described consistently: the marker's epoch is the reset of
@@ -2402,7 +2547,8 @@ for acct in manifest.get('accounts', []):
             if first.isdigit() and len(first) <= 18:
                 cur_reset = int(first)
                 keep_client = ('reason=client-rate-limit' in cur
-                               and cur_reset > now and cur_reset >= reset_epoch)
+                               and cur_reset > now and cur_reset >= reset_epoch
+                               and not claude_reset.marker_superseded(cur, reset_record))
         except Exception:
             pass
         if keep_client:
@@ -2429,6 +2575,7 @@ for acct in manifest.get('accounts', []):
             #                        markers strand recovered accounts for days.
             keep = False
             client_recovered = False
+            txt = ''
             try:
                 txt = open(mpath).read()
                 first = txt.splitlines()[0] if txt else ''
@@ -2442,10 +2589,23 @@ for acct in manifest.get('accounts', []):
                 is_client = 'reason=client-rate-limit' in txt
                 # See weekly_marker() above for why these three come first and in
                 # this order; the shim applies the identical test per invocation.
-                if active and not live:
+                if redeemed or claude_reset.marker_superseded(txt, reset_record):
+                    # A confirmed reset is first-hand proof the limits refilled — the
+                    # one thing that outranks even a client-reported weekly rejection
+                    # (the codex writer's identical rule). A marker written before it,
+                    # for a window it refilled, describes a state that no longer exists.
+                    keep = False
+                elif active and not live:
                     keep = True
                 elif active and is_client and weekly_marker(txt):
                     keep = True
+                elif active and is_client and session_marker(txt) and not session_measured:
+                    # Same rule as the weekly one, one window down: a rejection the CLIENT
+                    # reported is only disproved by telemetry that actually looked at the
+                    # window it names. `max_percent` here comes from the WEEKLY buckets
+                    # when the session bucket is silent, and clearing a 5h marker on it is
+                    # the cross-signal borrow the aggregation above refuses to make.
+                    keep = True
                 elif active and ('reason=error-cooldown' in txt
                                  or (is_client and recent_client)):
                     keep = True
@@ -2456,14 +2616,24 @@ for acct in manifest.get('accounts', []):
                 os.remove(mpath)
                 if client_recovered:
                     cleared = os.path.join(d, '.client-limit-cleared')
+                    try:
+                        prior = int(open(cleared).read().split()[0])
+                    except Exception:
+                        prior = 0
+                    # Never backwards: a reset confirmed earlier in this same pass has
+                    # already stamped a later moment than the pass's start.
                     with open(cleared + '.tmp', 'w') as f:
-                        f.write(f'{int(now)}\n')
+                        f.write(f'{max(prior, int(now))}\n')
                     os.replace(cleared + '.tmp', cleared)
                 # On a no-data pass `live` is empty and maxp is 0 only because
                 # nothing was reported (see informative() above). Log that, instead
                 # of a "0%" that reads like a proven-empty account — the exact
                 # misreading behind the 2026-09-04 incident.
                 seen = f'max {maxp}%' if live else 'no usable telemetry'
+                if redeemed:
+                    seen = 'limit reset confirmed'
+                elif claude_reset.marker_superseded(txt, reset_record):
+                    seen = 'written before a confirmed limit reset'
                 say(f'{aid}: marker cleared ({seen})')
             elif not live:
                 # One line per account, so a no-data pass is legible in limits.log:

package/bin/codex-accounts

@@ -1154,6 +1154,23 @@ def marker_bucket(txt):
             return part[7:]
     return ''
 
+def session_marker(txt):
+    # The self-healing ~5h window as each client names it: codex labels a short window
+    # `client:5h`, claude's own type is `five_hour`, and a bare `session` covers the
+    # writer's own marker. Kept identical to bin/claude-accounts' copy.
+    b = marker_bucket(txt).lower()
+    return 'five_hour' in b or '5h' in b or 'session' in b
+
+
+def _prior_mark(path):
+    """The existing .client-limit-cleared epoch (0 when absent/garbled): the watermark
+    only ever moves forward, so a reset stamped earlier in a pass is never undone."""
+    try:
+        return int(open(path).read().split()[0])
+    except Exception:
+        return 0
+
+
 def weekly_marker(txt):
     # Matched the way both shims match it (bin/claude ~303, same token list): the
     # claude client writes client:seven_day / client:seven_day_opus, and the codex
@@ -1599,6 +1616,7 @@ for acct in manifest.get('accounts', []):
     # one is never silent — it reports at/near 100% with the reset it is waiting on.
     # So a missing or silent session reads 0 whenever the payload answered at all; a
     # payload where NOTHING answered still writes no signals and stays unknown below.
+    session_measured = bool(session)
     if sessionp is None and live:
         sessionp = 0
     try:
@@ -1619,6 +1637,13 @@ for acct in manifest.get('accounts', []):
         out['weekly_percent'] = weeklyp
     if sessionp is not None:
         out['session_percent'] = sessionp
+    if sessionp is not None and not session_measured:
+        # Ranking may use this 0 — an idle account has to get back into the band — but
+        # nothing may read it as proof of recovery. codex reports no window at all for a
+        # closed one, so silence here is the NORMAL shape and says nothing whatsoever
+        # about a 429 the client actually received. See the claude writer for the live
+        # case that proved it (acct-14, 2026-09-22).
+        out['session_inferred'] = True
     if not live:
         # Nothing usable in the entire payload. Keep the diagnostics (fetched_at,
         # source, plan, the raw buckets) and write NONE of the percent signals: a
@@ -1645,6 +1670,19 @@ for acct in manifest.get('accounts', []):
     # The fetch went through with this account's own bearer => its auth is alive.
     if clear_expired(d):
         say(f'{aid}: dead-auth marker cleared (authenticated successfully)')
+    if reset_result.get('status') == 'redeemed':
+        # bin/codex's rollout scan would otherwise re-create a park from the very
+        # rejection this reset answered — whether or not a marker exists right now. The
+        # clean pass below only stamps this for an active client marker; a redemption
+        # needs it unconditionally (same rule as the claude writer). Never backwards.
+        cleared_path = os.path.join(d, '.client-limit-cleared')
+        try:
+            prior = int(open(cleared_path).read().split()[0])
+        except Exception:
+            prior = 0
+        with open(cleared_path + '.tmp', 'w') as f:
+            f.write(f'{max(prior, int(time.time()))}\n')
+        os.replace(cleared_path + '.tmp', cleared_path)
     offenders = [] if reset_result.get('status') == 'redeemed' else [
         b for b in buckets if b['percent'] >= threshold]
     mpath = os.path.join(d, '.limited')
@@ -1727,6 +1765,13 @@ for acct in manifest.get('accounts', []):
                     keep = True
                 elif active and is_client and weekly_marker(txt):
                     keep = True
+                elif active and is_client and session_marker(txt) and not session_measured:
+                    # Same rule one window down: a rejection the CLIENT reported is only
+                    # disproved by telemetry that looked at the window it names. With the
+                    # session window silent, max_percent is the WEEKLY peak, and clearing
+                    # a 5h marker on it is the cross-signal borrow the aggregation above
+                    # refuses to make.
+                    keep = True
                 elif active and ('reason=error-cooldown' in txt
                                  or (is_client and recent_client)):
                     keep = True
@@ -1746,7 +1791,7 @@ for acct in manifest.get('accounts', []):
                     # 2026-09-04 and needed the identical brake with it.
                     cleared = os.path.join(d, '.client-limit-cleared')
                     with open(cleared + '.tmp', 'w') as f:
-                        f.write(f'{int(now)}\n')
+                        f.write(f'{max(_prior_mark(cleared), int(now))}\n')
                     os.replace(cleared + '.tmp', cleared)
                 # On a no-data pass `live` is empty and maxp is 0 only because
                 # nothing was reported (see informative() above). Log that, instead