claude-multiacc 2.0.40 → 2.0.42

package/tests/run-tests.sh

@@ -5,7 +5,8 @@
 set -u
 
 REPO_DIR="$(cd "$(dirname "$0")/.." && pwd -P)"
-WORK="$(mktemp -d "${TMPDIR:-/tmp}/multiacc-test.XXXXXX")"
+WORK="$(mktemp -d "${TMPDIR:-/tmp}/multiacc-test.XXXXXX")" || exit 1
+[ -n "$WORK" ] && [ -d "$WORK" ] || exit 1
 # Loopback stub servers register their pid here. Deleting $WORK does not kill a running
 # python process, so an interrupted run (CI cancel, Ctrl-C) would otherwise leave one
 # listening until the machine goes away.
@@ -16,7 +17,13 @@ cleanup() {
     kill "$p" 2>/dev/null
     wait "$p" 2>/dev/null || true
   done
-  rm -rf "$WORK"
+  # The auto-resume sections reap their own processes; this is the backstop for an
+  # interrupted run. Every fake client and watcher they start carries $WORK in its argv.
+  # Never with an empty WORK: `pkill -f /` would match nearly every process the user owns.
+  if [ -n "${WORK:-}" ] && [ -d "$WORK" ]; then
+    pkill -KILL -f "$WORK/" 2>/dev/null || true
+    rm -rf "$WORK"
+  fi
 }
 trap cleanup EXIT
 
@@ -169,6 +176,56 @@ if [ "${1:-}" = "setup-token" ]; then
   echo "Your token: sk-ant-oat01-FAKEFAKEFAKEFAKEFAKEFAKEFAKEFAKEFAKEFAKEFAKE"
   exit 0
 fi
+if [ -n "${FAKE_TUI:-}" ] && [ -n "${CLAUDE_CONFIG_DIR:-}" ]; then
+  # The auto-resume sections' INTERACTIVE client: it behaves the way the real TUI does at
+  # an API error — registers sessions/<pid>.json in the account dir, writes the error
+  # record into the (shared) transcript and then IDLES; SIGTERM deletes the registry and
+  # exits 143, and a crash (SIGKILL) leaves the registry behind. The scripted error only
+  # fires on a fresh launch; a `--resume <sid>` launch appends what the real client does
+  # after the auto-resume prompt — a normal reply — unless FAKE_TUI_QUIET is set.
+  acct="$(basename "$CLAUDE_CONFIG_DIR")"
+  sid=""; prev=""
+  for a in "$@"; do
+    case "$prev" in -r|--resume) sid="$a" ;; esac
+    case "$a" in --resume=*) sid="${a#--resume=}" ;; esac
+    prev="$a"
+  done
+  resumed=0; [ -n "$sid" ] && resumed=1
+  [ -n "$sid" ] || sid="${FAKE_TUI_SID:-5f0c1d2e-3a4b-4c5d-8e9f-a0b1c2d3e4f5}"
+  [ -n "${FAKE_TUI_PIDS:-}" ] && echo "$$" >> "$FAKE_TUI_PIDS"
+  echo "CFG=$acct ARGS=$*" >> "${FAKE_TUI_LOG:-/dev/null}"
+  proj="$CLAUDE_CONFIG_DIR/projects/-fake-tui"
+  mkdir -p "$CLAUDE_CONFIG_DIR/sessions" "$proj"
+  tr="$proj/$sid.jsonl"
+  ts() { date -u +%Y-%m-%dT%H:%M:%S.000Z; }
+  apierr() { # $1 error code, $2 extra JSON members (with a leading comma) or empty
+    printf '{"type":"assistant","isApiErrorMessage":true,"error":"%s"%s,"timestamp":"%s","isSidechain":false,"sessionId":"%s","message":{"content":[{"type":"text","text":"API Error"}]}}\n' \
+      "$1" "${2:-}" "$(ts)" "$sid" >> "$tr"
+  }
+  if [ "$resumed" = 1 ] && [ -z "${FAKE_TUI_QUIET:-}" ]; then
+    printf '{"type":"assistant","timestamp":"%s","isSidechain":false,"sessionId":"%s","message":{"content":[{"type":"text","text":"Resumed."}]}}\n' \
+      "$(ts)" "$sid" >> "$tr"
+  fi
+  reg="$CLAUDE_CONFIG_DIR/sessions/$$.json"
+  printf '{"pid":%s,"sessionId":"%s","cwd":"%s","kind":"interactive","status":"busy","startedAt":%s000}\n' \
+    "$$" "$sid" "$PWD" "$(date +%s)" > "$reg"
+  trap 'rm -f "$reg"; exit 143' TERM
+  trap 'rm -f "$reg"; exit 129' HUP
+  if [ "$resumed" = 0 ]; then
+    sleep "${FAKE_TUI_DELAY:-0.3}"
+    case "$FAKE_TUI" in
+      quota) apierr rate_limit ",\"quotaLimits\":{\"status\":\"rejected\",\"resetsAt\":$(( $(date +%s) + 7200 )),\"rateLimitType\":\"five_hour\"}" ;;
+      auth) apierr authentication_failed ;;
+      invalid) apierr invalid_request ;;
+      crash) sleep 0.3; kill -9 $$ ;;
+    esac
+  fi
+  # Bounded, in short sleeps so a TERM is handled within a tenth of a second.
+  i=0
+  while [ "$i" -lt "${FAKE_TUI_LIFE:-400}" ]; do sleep 0.1; i=$((i + 1)); done
+  rm -f "$reg"
+  exit 0
+fi
 if [ $# -eq 0 ] && [ -n "${FAKE_DO_LOGIN:-}" ] && [ -n "${CLAUDE_CONFIG_DIR:-}" ]; then
   # simulate an interactive session in which the user completed /login
   printf '{"claudeAiOauth":{"accessToken":"sk-ant-oat01-new","refreshToken":"r","expiresAt":9999999999999,"refreshTokenExpiresAt":9999999999999}}' > "$CLAUDE_CONFIG_DIR/.credentials.json"
@@ -260,6 +317,8 @@ if [ -n "${FAKE_SESSION_ID:-}" ] && [ -n "${CLAUDE_CONFIG_DIR:-}" ]; then
   sleep "${FAKE_SESSION_HOLD:-4}"
   rm -f "$CLAUDE_CONFIG_DIR/sessions/$$.json"
 fi
+# what an interactive client would inherit from the shim (auto-resume must leak nothing)
+[ -n "${FAKE_PRINT_ENV:-}" ] && echo "AR_ENV=$(env | grep -c '^CLAUDE_MULTIACC_AR')"
 echo "CFG=$acct TOK=${CLAUDE_CODE_OAUTH_TOKEN:-none} ARGS=$*"
 EOF
 chmod +x "$FAKEBIN/claude"
@@ -352,6 +411,12 @@ export CLAUDE_MULTIACC_KEYCHAIN=0
 # runs under the operator's real HOME, whose rc files are not under test — section 18
 # turns the probe on against its own fake HOME.
 export CLAUDE_MULTIACC_PATH_PROBE=0
+# Auto-resume spawns a detached watcher for an interactive launch inside tmux. The suite
+# may itself run inside tmux, and no legacy section is about auto-resume, so it is off
+# (and the pane invisible) everywhere except the sections that turn it on against a fake
+# tmux — a watcher here would otherwise type into the developer's REAL pane.
+export CLAUDE_MULTIACC_AUTORESUME=0 CODEX_MULTIACC_AUTORESUME=0
+unset TMUX TMUX_PANE 2>/dev/null || true
 
 now="$(date +%s)"
 
@@ -4852,6 +4917,61 @@ with open(path + ".tmp", "w") as f:
 os.replace(path + ".tmp", path)
 EOF
 
+# The auto-resume sections' INTERACTIVE codex (sourced by the fake below when FAKE_TUI is
+# set): it writes a rollout the way the real TUI does — line 1 session_meta (id ==
+# session_id, cwd, originator codex-tui), held open like the native binary holds it — then
+# the scripted token_count + task_complete error, and IDLES; SIGTERM exits 0 (what the node
+# wrapper reports). A `resume <sid>` launch appends task_started (the resumed turn) to the
+# SAME rollout instead of an error.
+cat > "$WORK/fake-tui-codex.sh" <<'EOF'
+acct="$(basename "$CODEX_HOME")"
+sid=""; resumed=0
+if [ "${1:-}" = resume ]; then
+  resumed=1
+  for a in "$@"; do
+    case "$a" in
+      *' '*) ;;
+      ????????-????-????-????-????????????) [ -n "$sid" ] || sid="$a" ;;
+    esac
+  done
+fi
+[ -n "${FAKE_TUI_PIDS:-}" ] && echo "$$" >> "$FAKE_TUI_PIDS"
+echo "CFG=$acct ARGS=$*" >> "${FAKE_TUI_LOG:-/dev/null}"
+ts() { date -u +%Y-%m-%dT%H:%M:%S.000Z; }
+ro=""
+if [ -n "$sid" ]; then
+  for f in "$CODEX_HOME"/sessions/*/*/*/rollout-*-"$sid".jsonl; do [ -f "$f" ] && ro="$f"; done
+fi
+if [ -z "$ro" ]; then
+  [ -n "$sid" ] || sid="${FAKE_TUI_SID:-6a1b2c3d-4e5f-4a6b-8c7d-9e0f1a2b3c4d}"
+  day="$CODEX_HOME/sessions/$(date +%Y/%m/%d)"
+  mkdir -p "$day"
+  ro="$day/rollout-$(date +%Y-%m-%dT%H-%M-%S)-$sid.jsonl"
+  printf '{"timestamp":"%s","type":"session_meta","payload":{"id":"%s","session_id":"%s","timestamp":"%s","cwd":"%s","originator":"codex-tui","cli_version":"0.0.0","source":"cli"}}\n' \
+    "$(ts)" "$sid" "$sid" "$(ts)" "$PWD" > "$ro"
+fi
+exec 9>>"$ro"
+trap 'exit 0' TERM
+trap 'exit 0' HUP
+if [ "$resumed" = 1 ]; then
+  [ -n "${FAKE_TUI_QUIET:-}" ] \
+    || printf '{"timestamp":"%s","type":"event_msg","payload":{"type":"task_started","turn_id":"2"}}\n' "$(ts)" >&9
+else
+  sleep "${FAKE_TUI_DELAY:-0.3}"
+  case "$FAKE_TUI" in
+    quota)
+      printf '{"timestamp":"%s","type":"event_msg","payload":{"type":"token_count","info":null,"rate_limits":{"limit_id":"premium","primary":null,"secondary":null}}}\n' "$(ts)" >&9
+      printf '{"timestamp":"%s","type":"event_msg","payload":{"type":"token_count","info":null,"rate_limits":{"limit_id":"codex","primary":{"used_percent":100.0,"window_minutes":300,"resets_at":%s},"secondary":{"used_percent":40.0,"window_minutes":10080,"resets_at":%s}}}}\n' \
+        "$(ts)" "$(( $(date +%s) + 5400 ))" "$(( $(date +%s) + 500000 ))" >&9
+      printf '{"timestamp":"%s","type":"event_msg","payload":{"type":"task_complete","turn_id":"1","last_agent_message":null,"error":{"message":"You'"'"'ve hit your usage limit. Upgrade to Pro, or try again at Sep 26th, 2026 11:22 AM.","codex_error_info":"usage_limit_exceeded"},"completed_at":%s}}\n' \
+        "$(ts)" "$(date +%s)" >&9 ;;
+  esac
+fi
+i=0
+while [ "$i" -lt "${FAKE_TUI_LIFE:-400}" ]; do sleep 0.1; i=$((i + 1)); done
+exit 0
+EOF
+
 # Fake "real" codex: prints which CODEX_HOME it ran under; scriptable login +
 # failures via a control file. (Note: must not contain the hyphenated shim marker.)
 cat > "$FAKEBIN/codex" <<EOF
@@ -4864,6 +4984,7 @@ if [ "\${1:-}" = "mcp" ] && [ -n "\${CODEX_HOME:-}" ]; then
   [ "\$rc" = 0 ] && [ -n "\${FAKE_MCP_WRITE_THEN_FAIL:-}" ] && exit 1
   exit \$rc
 fi
+if [ -n "\${FAKE_TUI:-}" ] && [ -n "\${CODEX_HOME:-}" ]; then . "$WORK/fake-tui-codex.sh"; fi
 if [ "\${1:-}" = "login" ]; then
   shift
   # record the flags the CLI chose (device-auth default vs --browser opt-out)
@@ -4899,6 +5020,8 @@ for a in "\$@"; do
   prev="\$a"
 done
 [ -n "\$outfile" ] && printf 'OK' > "\$outfile"
+# what an interactive client would inherit from the shim (auto-resume must leak nothing)
+[ -n "\${FAKE_PRINT_ENV:-}" ] && echo "AR_ENV=\$(env | grep -c '^CODEX_MULTIACC_AR')"
 echo "CFG=\$acct"
 EOF
 chmod +x "$FAKEBIN/codex"
@@ -6117,7 +6240,7 @@ printf '%s' "$out" | grep -q "acct-01" \
   && t_fail "codex fetch throttle" "fresh account was re-fetched: $out" \
   || t_ok "codex: fresh account skipped by the fetch throttle"
 # 429 backoff honored
-python3 - "$CX/acct-02/limits.json" "$now" <<'EOF'
+python3 - "$CX/acct-02/limits.json" "$(date +%s)" <<'EOF'
 import json, sys
 json.dump({'fetched_at': 0, 'retry_after': int(sys.argv[2]) + 300, 'backoff': 120},
           open(sys.argv[1], 'w'))
@@ -7885,6 +8008,808 @@ fi
 out="$(HOME="$RCH" claude-accounts status 2>&1)"
 check "status honours CLAUDE_MULTIACC_PATH_PROBE=0" "probe disabled" "$out"
 
+# ============================ AUTO-RESUME (end to end) ============================
+# An interactive session that stops on a usage limit, a dead login or a crash is resumed
+# on another account: the shim spawns lib/autoresume.py beside its UNCHANGED exec, the
+# watcher tails the session's transcript (codex: rollout), stops the TUI and types the
+# relaunch into the pane's SHELL, and the relaunched shim marks the old account before it
+# selects. Here the TUI is the fakes' FAKE_TUI mode and tmux is a fake that never talks to
+# a server: display-message answers from the environment, and Enter runs the typed line
+# with `bash -c` in the background — the pane's shell, with the pane's environment (none
+# of the client's CLAUDE_CONFIG_DIR/CODEX_HOME exports). Every case gets its own pool, cut-
+# down timing knobs and hard timeouts, and ends in ar_reap, which kills what it started.
+ARB="$WORK/ar"
+ARH="$WORK/ar-home"          # a sandbox HOME: nothing here may touch the operator's
+ARW="$WORK/ar-work dir"      # the session's directory (with a space, on purpose)
+ARPY="$(command -v python3)"
+mkdir -p "$ARB" "$ARH" "$ARW"
+cat > "$FAKEBIN/tmux" <<'EOF'
+#!/usr/bin/env bash
+# fake tmux for the auto-resume sections (never a server; shadows any real tmux on PATH)
+st="${FAKE_TMUX_DIR:-}"
+[ -n "$st" ] && [ -d "$st" ] || exit 1
+printf '%s\n' "$*" >> "$st/calls"
+while [ $# -gt 0 ]; do
+  case "$1" in -S|-L) shift; [ $# -gt 0 ] && shift ;; *) break ;; esac
+done
+verb="${1:-}"; [ $# -gt 0 ] && shift
+case "$verb" in
+  display-message)
+    # -p answers the format the watcher asked for; without -p it is a status-line notice.
+    p=0; fmt=""
+    while [ $# -gt 0 ]; do
+      case "$1" in
+        -p) p=1; shift ;;
+        -t) shift; [ $# -gt 0 ] && shift ;;
+        *) fmt="$1"; shift ;;
+      esac
+    done
+    [ "$p" = 1 ] || exit 0
+    printf '%s\n' "$fmt" | sed -e "s/#{pane_pid}/${FAKE_TMUX_PANE_PID:-1}/g" \
+      -e "s/#{pane_current_command}/${FAKE_TMUX_PANE_CMD:-zsh}/g" \
+      -e "s/#{pane_in_mode}/${FAKE_TMUX_PANE_MODE:-0}/g" \
+      -e "s/#{synchronize-panes}/${FAKE_TMUX_PANE_SYNC:-0}/g" ;;
+  send-keys)
+    lit=0
+    while [ $# -gt 0 ]; do
+      case "$1" in
+        -t) shift; [ $# -gt 0 ] && shift; continue ;;
+        -R) shift; continue ;;
+        -l) lit=1; shift; continue ;;
+      esac
+      if [ "$lit" = 1 ]; then
+        printf '%s' "$1" >> "$st/line"
+      else
+        case "$1" in
+          C-u) : > "$st/line" ;;
+          Enter)
+            line="$(cat "$st/line" 2>/dev/null)"; : > "$st/line"
+            printf '%s\n' "$line" >> "$st/typed"
+            # The trailing `:` keeps bash from exec'ing the command in its own place: like
+            # the pane's real shell, it stays the relaunched shim's parent (its PPID).
+            ( unset CLAUDE_CONFIG_DIR CLAUDE_CODE_OAUTH_TOKEN CLAUDE_SHIM_ACTIVE CODEX_HOME CODEX_SHIM_ACTIVE
+              exec bash -c "$line; :" ) </dev/null >> "$st/shell.out" 2>&1 & ;;
+        esac
+      fi
+      shift
+    done ;;
+esac
+exit 0
+EOF
+chmod +x "$FAKEBIN/tmux"
+# Records a spawn instead of watching: the gate cases need a watcher that leaves its state
+# file in place, so "no state file" can only mean "no spawn".
+cat > "$ARB/stub-python" <<'EOF'
+#!/bin/sh
+echo "$*" >> "${FAKE_STUB_PY_LOG:-/dev/null}"
+EOF
+chmod +x "$ARB/stub-python"
+
+ar_wait() { # ar_wait <seconds> <cmd...>: poll every 0.1 s until cmd succeeds; 1 on timeout
+  local n=0 lim=$(($1 * 10))
+  shift
+  while ! "$@"; do
+    n=$((n + 1)); [ "$n" -lt "$lim" ] || return 1
+    sleep 0.1
+  done
+  return 0
+}
+ar_lines() { [ -f "$2" ] && [ "$(($(wc -l < "$2")))" -ge "$1" ]; }       # <n> <file>
+ar_logged() { grep -Eq "$2" "$1/selection.log" 2>/dev/null; }            # <pool> <ERE>
+ar_no_watcher() { ! pgrep -f "$1/tmp/autoresume/" >/dev/null 2>&1; }      # <pool>
+ar_acct_of() { printf '%s' "$1" | sed -n 's/^CFG=\(acct-[0-9]*\) .*/\1/p'; }
+# A stopped client may linger as a zombie until its parent reaps it: that is gone, not alive.
+ar_running() { kill -0 "$1" 2>/dev/null && ! ps -o stat= -p "$1" 2>/dev/null | grep -q '^Z'; }
+ar_stopped() { ! ar_running "$1"; }
+ar_start() { # ar_start [VAR=val ...] -- <cmd> [args...]: the launch typed in the pane, backgrounded
+  local pre=()
+  while [ $# -gt 0 ] && [ "$1" != "--" ]; do pre+=("$1"); shift; done
+  [ $# -gt 0 ] && shift
+  ( cd "$ARW" && exec env "${AREC[@]}" ${pre[@]+"${pre[@]}"} "$@" ) </dev/null >> "$ARB/tui.out" 2>&1 &
+  AR_PID=$!
+  # Not a job of this shell: the crash case SIGKILLs it, and bash would print a job notice.
+  # bash still reaps it (waitpid(-1) on SIGCHLD); ar_reap kills it by pid.
+  disown "$AR_PID" 2>/dev/null || true
+}
+ar_reap() { # ar_reap <pool>: stop every client and watcher the case started, then prove it
+  local p n=0
+  : > "$1/autoresume.off" 2>/dev/null || true   # running watchers leave on their next tick
+  if [ -f "$ARB/pids" ]; then
+    while read -r p; do kill -TERM "$p" 2>/dev/null; done < "$ARB/pids"
+  fi
+  while ! ar_no_watcher "$1" && [ "$n" -lt 50 ]; do sleep 0.1; n=$((n + 1)); done
+  pkill -KILL -f "$1/tmp/autoresume/" 2>/dev/null || true
+  if [ -f "$ARB/pids" ]; then
+    while read -r p; do kill -KILL "$p" 2>/dev/null; done < "$ARB/pids"
+  fi
+  [ -n "${AR_PID:-}" ] && kill -KILL "$AR_PID" 2>/dev/null
+  AR_PID=""
+}
+AR_SID=5f0c1d2e-3a4b-4c5d-8e9f-a0b1c2d3e4f5      # the fake claude's default session id
+AR_CXSID=6a1b2c3d-4e5f-4a6b-8c7d-9e0f1a2b3c4d    # the fake codex's
+ar_typed_ok() { # ar_typed_ok <CLAUDE|CODEX> <sid> <ROOTVAR=root or ""> <shim>: exactly one line, exactly this
+  local line tok
+  [ -f "$ARB/tmux/typed" ] && [ "$(($(wc -l < "$ARB/tmux/typed")))" = 1 ] || return 1
+  line="$(cat "$ARB/tmux/typed")"
+  tok="${line#" $1_MULTIACC_AR="}"; tok="${tok%%:*}"
+  printf '%s\n' "$tok" | grep -Eqx '[A-Za-z0-9]{16,64}' || return 1
+  [ "$line" = " $1_MULTIACC_AR=$tok:$2 ${3:+$3 }$4" ]
+}
+ar_pty() { # ar_pty <both|stdin> <cmd...>: stdin on a pty; stdout on that pty too, or on a pipe
+  python3 -c '
+import pty, subprocess, sys
+m, s = pty.openpty()
+r = subprocess.run(sys.argv[2:], stdin=s, stdout=s if sys.argv[1] == "both" else subprocess.PIPE)
+if r.stdout:
+    sys.stdout.buffer.write(r.stdout)
+sys.exit(r.returncode)' "$@"
+}
+ar_plant() { # ar_plant <pool> <token> <provider> <class> <left acct> -- <argv...>: a watcher's relaunch files
+  local pool="$1" tok="$2" prov="$3" cls="$4" acct="$5" sid="$AR_SID"
+  shift 5; [ "${1:-}" = "--" ] && shift
+  [ "$prov" = codex ] && sid="$AR_CXSID"
+  mkdir -p "$pool/tmp/autoresume"
+  printf '%s\n' v=1 "provider=$prov" "class=$cls" "acct=$acct" "sid=$sid" "cwd=$ARW" depth=1 chain=PlantTst \
+    > "$pool/tmp/autoresume/r-$tok.relaunch"
+  printf '%s\0' "$@" > "$pool/tmp/autoresume/r-$tok.argv"
+}
+# A typed relaunch whose token cannot be honoured names the session and exits 2: the line
+# has no argv of its own, so running on would open a FRESH session in the stopped one's place.
+ar_dead() { # ar_dead <claude|codex> <name> <expected output> [VAR=val ...]
+  local prov="$1" name="$2" want="$3" out rc
+  shift 3
+  if [ "$prov" = claude ]; then
+    out="$(cd "$ARH" && env "${AREC[@]}" CLAUDE_MULTIACC_PYTHON="$ARB/stub-python" "$@" claude </dev/null 2>&1)"; rc=$?
+  else
+    out="$(cd "$ARH" && env "${AREX[@]}" CODEX_MULTIACC_PYTHON="$ARB/stub-python" "$@" codex </dev/null 2>&1)"; rc=$?
+  fi
+  [ "$rc" = 2 ] && [ "$out" = "$want" ] \
+    && t_ok "AR dead token ($prov): $name -> the resume hint, exit 2, nothing started" \
+    || t_fail "AR dead token ($prov): $name" "rc=$rc out=$out"
+}
+AR_DEAD_MSG="auto-resume could not continue automatically (the resume token expired)."
+
+# ---- AR1. claude: fixture pool, environment, and the gate --------------------------------
+ARC="$WORK/ar-claude"
+ar_claude_pool() { # a fresh two-account pool whose accounts share one projects tree
+  local i
+  rm -rf "$ARC" "$ARB/tmux" "$ARB/pids" "$ARB/tui.log" "$ARB/stub.log"
+  mkdir -p "$ARC/tmp" "$ARC/shared-projects" "$ARB/tmux"
+  printf '{"version": 1, "threshold": 90, "accounts": [%s, %s]}\n' \
+    '{"id": "acct-01", "email": "a@ar", "home": "mac", "added_at": "2026-09-23T00:00:00Z"}' \
+    '{"id": "acct-02", "email": "b@ar", "home": "mac", "added_at": "2026-09-23T00:00:00Z"}' \
+    > "$ARC/accounts.json"
+  for i in 01 02; do
+    mkdir -p "$ARC/acct-$i"
+    printf '{"claudeAiOauth":{"accessToken":"sk-ant-oat01-ar%s","refreshToken":"r","expiresAt":9999999999999,"refreshTokenExpiresAt":9999999999999,"scopes":["user:inference"],"subscriptionType":"max"}}' "$i" \
+      > "$ARC/acct-$i/.credentials.json"
+    printf '{"fetched_at":%s,"weekly_percent":20,"session_percent":10,"max_percent":20,"buckets":[]}' "$(date +%s)" \
+      > "$ARC/acct-$i/limits.json"
+    ln -s "$ARC/shared-projects" "$ARC/acct-$i/projects"
+  done
+  : > "$ARC/.limits-kick"
+}
+AREC=(CLAUDE_ACCOUNTS_DIR="$ARC" HOME="$ARH" TMUX="$ARB/tmux-sock,4242,0" TMUX_PANE=%1
+  CLAUDE_MULTIACC_AUTORESUME=1 CLAUDE_MULTIACC_PYTHON="$ARPY" CLAUDE_MULTIACC_AR_TEST_TTY=1
+  CLAUDE_MULTIACC_AR_TEST_TMUX_ANYPANE=1 CLAUDE_MULTIACC_AR_POLL=0.1 CLAUDE_MULTIACC_AR_GRACE=0.5
+  CLAUDE_MULTIACC_AR_TERM_GRACE=3 CLAUDE_MULTIACC_AR_PANE_WAIT=5 CLAUDE_MULTIACC_AR_PROBE_TIMEOUT=15
+  CLAUDE_MULTIACC_AR_CRASH_MIN_RUNTIME=0 CLAUDE_MULTIACC_AUTORESUME_DEBUG=1
+  FAKE_TMUX_DIR="$ARB/tmux" FAKE_TUI_LOG="$ARB/tui.log" FAKE_TUI_PIDS="$ARB/pids")
+
+# The gate: only the plain interactive exec in tmux, with an argv the relaunch can rebuild,
+# gets a watcher; everything else is exactly today's exec (same argv, no state file).
+ar_claude_pool
+ar_gate() { # ar_gate <name> <watcher|none> [VAR=val ...] -- <claude args...>
+  local name="$1" want="$2" pre=() out states
+  shift 2
+  while [ $# -gt 0 ] && [ "$1" != "--" ]; do pre+=("$1"); shift; done
+  [ $# -gt 0 ] && shift
+  rm -rf "$ARC/tmp/autoresume" "$ARB/stub.log"
+  out="$(cd "$ARW" && env "${AREC[@]}" CLAUDE_MULTIACC_PYTHON="$ARB/stub-python" \
+    FAKE_STUB_PY_LOG="$ARB/stub.log" ${pre[@]+"${pre[@]}"} claude "$@" </dev/null 2>&1)"
+  states="$(ls "$ARC/tmp/autoresume/" 2>/dev/null | grep -c '\.state$')"
+  case "$out" in
+    *"ARGS=$*") ;;
+    *) t_fail "auto-resume gate: $name execs the argv unchanged" "$out"; return ;;
+  esac
+  if [ "$want" = watcher ]; then
+    if [ "$states" = 1 ] && ar_wait 5 grep -qs -- "-I .*lib/autoresume.py watch --state $ARC/tmp/autoresume/[0-9]*\.state" "$ARB/stub.log"; then
+      t_ok "auto-resume gate: $name gets a watcher, exec unchanged"
+    else
+      t_fail "auto-resume gate: $name gets a watcher" "states=$states stub=$(cat "$ARB/stub.log" 2>/dev/null)"
+    fi
+  else
+    [ "$states" = 0 ] && [ ! -s "$ARB/stub.log" ] \
+      && t_ok "auto-resume gate: $name gets no watcher, exec unchanged" \
+      || t_fail "auto-resume gate: $name gets no watcher" "states=$states"
+  fi
+}
+ar_gate "a prompt with the permission flag" watcher -- --dangerously-skip-permissions "fix the bug please"
+ar_gate "--resume <uuid> with a model" watcher -- --model opus --resume "$AR_SID"
+ar_gate "-p" none -- -p "hi there"
+ar_gate "a pinned run" none CLAUDE_ACCOUNT=acct-01 -- --dangerously-skip-permissions
+ar_gate "outside tmux" none TMUX= -- --dangerously-skip-permissions
+ar_gate "piped stdio" none CLAUDE_MULTIACC_AR_TEST_TTY= -- --dangerously-skip-permissions
+ar_gate "an unknown flag" none -- --fork-session --dangerously-skip-permissions
+ar_gate "a single-word positional (maybe a subcommand)" none -- doctor
+ar_gate "CLAUDE_MULTIACC_AUTORESUME=0" none CLAUDE_MULTIACC_AUTORESUME=0 -- --dangerously-skip-permissions
+: > "$ARC/autoresume.off"
+ar_gate "the pool's autoresume.off" none -- --dangerously-skip-permissions
+rm -f "$ARC/autoresume.off"
+# the watcher's argv is the ORIGINAL one, before the fallback-model pin adds --model
+ar_gate "no argv at all" watcher --
+af="$(ls "$ARC/tmp/autoresume/"*.argv 2>/dev/null | head -1)"
+[ -n "$af" ] && [ ! -s "$af" ] \
+  && t_ok "auto-resume: a bare launch records an empty original argv" \
+  || t_fail "auto-resume: a bare launch records an empty original argv" "$af"
+# ...and it stays empty when the pin DOES fire: every account's Fable bucket is spent, so
+# the exec carries --model, but the watcher must rebuild from what the user typed (the
+# relaunch re-runs selection and pins again for the NEW pick).
+for i in 01 02; do
+  printf '%s\nbucket=weekly_scoped:Fable percent=100 marked_at=x reason=limits\n' "$(( $(date +%s) + 3600 ))" \
+    > "$ARC/acct-$i/.limited"
+  printf '{"fetched_at":%s,"max_percent":100,"weekly_percent":20,"session_percent":10,"buckets":[{"name":"session","percent":10},{"name":"weekly_all","percent":20},{"name":"weekly_scoped:Fable","percent":100}]}' \
+    "$(date +%s)" > "$ARC/acct-$i/limits.json"
+done
+rm -rf "$ARC/tmp/autoresume" "$ARB/stub.log"
+out="$(cd "$ARW" && env "${AREC[@]}" CLAUDE_MULTIACC_PYTHON="$ARB/stub-python" FAKE_STUB_PY_LOG="$ARB/stub.log" \
+  claude </dev/null 2>&1)"
+af="$(ls "$ARC/tmp/autoresume/"*.argv 2>/dev/null | head -1)"
+case "$out" in
+  *"ARGS=--model claude-opus-5")
+    [ -n "$af" ] && [ -f "$af" ] && [ ! -s "$af" ] \
+      && t_ok "auto-resume: the watcher gets the argv from BEFORE the fallback-model pin" \
+      || t_fail "auto-resume: the .argv file carries the pin" "$(tr '\0' ' ' < "$af" 2>/dev/null)" ;;
+  *) t_fail "auto-resume: the fallback-model pin fired" "$out" ;;
+esac
+ar_claude_pool
+ar_gate "an invalid pin (random fallback)" none CLAUDE_ACCOUNT=acct-99 -- --dangerously-skip-permissions
+# The relaunch line is typed into the shell unquoted: a pool root or a shim path that would
+# need quoting gets no watcher, and the launch itself is unchanged.
+ln -s "$ARC" "$WORK/ar claude root"
+ar_gate "a pool root that would need quoting" none CLAUDE_ACCOUNTS_DIR="$WORK/ar claude root" -- --dangerously-skip-permissions
+mkdir -p "$WORK/ar shim copy"
+cp -R "$REPO_DIR/bin" "$REPO_DIR/lib" "$WORK/ar shim copy/"
+rm -rf "$ARC/tmp/autoresume" "$ARB/stub.log"
+out="$(cd "$ARW" && env "${AREC[@]}" CLAUDE_MULTIACC_PYTHON="$ARB/stub-python" FAKE_STUB_PY_LOG="$ARB/stub.log" \
+  "$WORK/ar shim copy/bin/claude" --dangerously-skip-permissions </dev/null 2>&1)"
+case "$out" in
+  *"ARGS=--dangerously-skip-permissions")
+    [ -z "$(ls "$ARC/tmp/autoresume/" 2>/dev/null | grep '\.state$')" ] && [ ! -s "$ARB/stub.log" ] \
+      && t_ok "auto-resume gate: a shim path that would need quoting gets no watcher, exec unchanged" \
+      || t_fail "auto-resume gate: a shim path that would need quoting gets no watcher" "$(ls "$ARC/tmp/autoresume/" 2>/dev/null)" ;;
+  *) t_fail "auto-resume gate: a shim path that would need quoting execs the argv unchanged" "$out" ;;
+esac
+# stdin on a terminal but stdout piped (`claude "x y" | tee log`): no watcher. The same
+# launch with stdout on the terminal too does get one, so the pipe is what decided it.
+for mode in stdin both; do
+  rm -rf "$ARC/tmp/autoresume" "$ARB/stub.log"
+  out="$(cd "$ARW" && ar_pty "$mode" env "${AREC[@]}" CLAUDE_MULTIACC_AR_TEST_TTY= \
+    CLAUDE_MULTIACC_PYTHON="$ARB/stub-python" FAKE_STUB_PY_LOG="$ARB/stub.log" \
+    claude --dangerously-skip-permissions 2>&1)"
+  states="$(ls "$ARC/tmp/autoresume/" 2>/dev/null | grep -c '\.state$')"
+  if [ "$mode" = stdin ]; then
+    case "$out" in *"ARGS=--dangerously-skip-permissions") ;; *) states="exec:$out" ;; esac
+    [ "$states" = 0 ] && [ ! -s "$ARB/stub.log" ] \
+      && t_ok "auto-resume gate: a terminal on stdin with stdout piped gets no watcher, exec unchanged" \
+      || t_fail "auto-resume gate: stdout piped gets no watcher" "states=$states"
+  else
+    [ "$states" = 1 ] && t_ok "auto-resume gate: stdin and stdout on a terminal get a watcher (control)" \
+      || t_fail "auto-resume gate: both on a terminal get a watcher" "states=$states"
+  fi
+done
+# The client never sees an auto-resume variable (a nested claude must not inherit a probe).
+rm -rf "$ARC/tmp/autoresume"
+out="$(cd "$ARW" && env "${AREC[@]}" CLAUDE_MULTIACC_PYTHON="$ARB/stub-python" \
+  CLAUDE_MULTIACC_AR_AVOID=acct-01:9999999999 FAKE_PRINT_ENV=1 \
+  claude --dangerously-skip-permissions </dev/null 2>&1)"
+check "auto-resume: the client never sees an auto-resume variable" "AR_ENV=0" "$out"
+st="$(ls "$ARC/tmp/autoresume/"*.state 2>/dev/null | head -1)"
+grep -q "^pid=[0-9]" "$st" 2>/dev/null && grep -q "^tmux=$ARB/tmux-sock,4242,0\$" "$st" \
+  && grep -q '^pane=%1$' "$st" && grep -q "^acc_root=$ARC\$" "$st" && grep -q '^depth=0$' "$st" \
+  && t_ok "auto-resume: the state file names the pid, pane, pool and chain depth" \
+  || t_fail "auto-resume state file" "$(cat "$st" 2>/dev/null)"
+
+# ---- AR2. claude probe mode: the real candidate loop, never an exec ----------------------
+ar_claude_pool
+out="$(cd "$ARW" && env "${AREC[@]}" CLAUDE_MULTIACC_AR_PROBE=1 claude --dangerously-skip-permissions </dev/null 2>&1)"; rc=$?
+case "$rc:$out" in
+  0:pick=acct-0[12]" tier=eligible") t_ok "probe prints pick/tier and exits 0" ;;
+  *) t_fail "probe prints pick/tier" "rc=$rc out=$out" ;;
+esac
+case "$out" in *CFG=*) t_fail "probe never execs the client" "$out" ;; *) t_ok "probe never execs the client" ;; esac
+all2=1
+for _ in 1 2 3 4 5; do
+  out="$(cd "$ARW" && env "${AREC[@]}" CLAUDE_MULTIACC_AR_PROBE=1 \
+    CLAUDE_MULTIACC_AR_AVOID="acct-01:$(( $(date +%s) + 3600 )),acct-02:$(( $(date +%s) - 5 ))" \
+    claude --dangerously-skip-permissions </dev/null 2>&1)"
+  [ "$out" = "pick=acct-02 tier=eligible" ] || all2=0
+done
+[ "$all2" = 1 ] && t_ok "probe honours AVOID (an expired entry is ignored)" \
+  || t_fail "probe AVOID" "$out"
+out="$(cd "$ARW" && env "${AREC[@]}" CLAUDE_MULTIACC_AR_PROBE=1 \
+  CLAUDE_MULTIACC_AR_AVOID="acct-01:$(( $(date +%s) + 3600 )),acct-02:$(( $(date +%s) + 3600 ))" \
+  claude --dangerously-skip-permissions </dev/null 2>&1)"
+case "$out" in "pick=acct-0"[12]" tier=soft") t_ok "probe with every account avoided answers tier=soft" ;;
+  *) t_fail "probe tier=soft" "$out" ;; esac
+ar_logged "$ARC" 'all-limited fallback' \
+  && t_fail "a probe logs no fallback pick" "$(grep 'all-limited' "$ARC/selection.log")" \
+  || t_ok "a probe logs no fallback pick"
+out="$(cd "$ARW" && env "${AREC[@]}" CLAUDE_MULTIACC_AR_PROBE=1 CLAUDE_MULTIACC_DISABLE=1 claude </dev/null 2>&1)"; rc=$?
+[ "$rc:$out" = "3:pick= tier=none" ] && t_ok "probe on a passthrough answers tier=none (exit 3)" \
+  || t_fail "probe passthrough" "rc=$rc out=$out"
+[ ! -f "$ARC/.last-pick" ] && t_ok "a probe does not count as a pick (no rotation memory)" \
+  || t_fail "a probe does not count as a pick" "$(cat "$ARC/.last-pick")"
+# No valid login anywhere: a launch would fall back to the stock client — a probe must not.
+rm -f "$ARC"/acct-0*/.credentials.json
+out="$(cd "$ARW" && env "${AREC[@]}" CLAUDE_MULTIACC_AR_PROBE=1 claude --dangerously-skip-permissions </dev/null 2>&1)"; rc=$?
+[ "$rc:$out" = "3:pick= tier=none" ] && t_ok "probe on a pool with no valid login answers tier=none (exit 3), never execs" \
+  || t_fail "probe with no valid login" "rc=$rc out=$out"
+
+# ---- AR3. claude quota: stop, relaunch on the other account, same session ----------------
+# No ANYPANE here: the pane's pid is this shell, which IS the launching shim's parent. The
+# transcript scan (12f) is off, so the old account's marker can only come from the relaunch.
+ar_claude_pool
+ar_start FAKE_TUI=quota CLAUDE_MULTIACC_AR_TEST_TMUX_ANYPANE= FAKE_TMUX_PANE_PID=$$ \
+  CLAUDE_MULTIACC_CLIENT_LIMITS=0 -- claude --dangerously-skip-permissions "fix the bug please"
+first=$AR_PID
+if ar_wait 30 ar_lines 2 "$ARB/tui.log"; then
+  l1="$(sed -n 1p "$ARB/tui.log")"; l2="$(sed -n 2p "$ARB/tui.log")"
+  from="$(ar_acct_of "$l1")"; to="$(ar_acct_of "$l2")"
+  check "AR quota: the first launch ran the user's argv" \
+    "ARGS=--dangerously-skip-permissions fix the bug please" "$l1"
+  [ -n "$from" ] && [ -n "$to" ] && [ "$from" != "$to" ] \
+    && t_ok "AR quota: relaunched on the OTHER account ($from -> $to)" \
+    || t_fail "AR quota: relaunched on the other account" "$l1 | $l2"
+  check "AR quota: the relaunch resumes the same session with the auto-resume prompt" \
+    "ARGS=--dangerously-skip-permissions --resume $AR_SID (claude-multiacc auto-resume) This session was restarted automatically on another account because the previous account hit its usage limit." "$l2"
+  case "$l2" in *"fix the bug please"*) t_fail "AR quota: the original prompt is not replayed" "$l2" ;;
+    *) t_ok "AR quota: the original prompt is not replayed" ;; esac
+  ar_wait 5 ar_stopped "$first" && t_ok "AR quota: the stuck client was stopped" \
+    || t_fail "AR quota: the stuck client was stopped" "pid $first alive"
+  grep -q 'bucket=client:five_hour percent=100' "$ARC/$from/.limited" 2>/dev/null \
+    && t_ok "AR quota: the old account carries a client:five_hour marker" \
+    || t_fail "AR quota: marker on the old account" "$(cat "$ARC/$from/.limited" 2>/dev/null)"
+  ar_logged "$ARC" "autoresume switch provider=claude chain=[A-Za-z0-9]+ from=$from class=quota sid=$AR_SID depth=1 probe=$to" \
+    && t_ok "AR quota: the watcher logged the switch (field 2 = autoresume)" \
+    || t_fail "AR quota: switch log line" "$(grep autoresume "$ARC/selection.log")"
+  chain="$(sed -n 's/.*autoresume watch provider=claude chain=\([A-Za-z0-9]*\) .*/\1/p' "$ARC/selection.log" | head -1)"
+  ar_logged "$ARC" "autoresume relaunch chain=$chain from=$from class=quota depth=1\$" \
+    && t_ok "AR quota: the relaunched shim consumed the token and kept the chain" \
+    || t_fail "AR quota: relaunch log line" "$(grep autoresume "$ARC/selection.log")"
+  ar_typed_ok CLAUDE "$AR_SID" "CLAUDE_ACCOUNTS_ROOT=$(cd "$ARC" && pwd)" "$REPO_DIR/bin/claude" \
+    && t_ok "AR quota: exactly one token line was typed: token:sid, the pool root, the shim's path" \
+    || t_fail "AR quota: typed line" "$(cat "$ARB/tmux/typed" 2>/dev/null)"
+  seq_ok="$(grep -E 'display-message|send-keys' "$ARB/tmux/calls" | sed 's/ -l .*/ -l <line>/' | tr '\n' '|')"
+  case "$seq_ok" in
+    *"-S $ARB/tmux-sock display-message -p -t %1 #{pane_pid}"*"-S $ARB/tmux-sock send-keys -R -t %1|-S $ARB/tmux-sock send-keys -t %1 C-u|-S $ARB/tmux-sock send-keys -t %1 -l <line>|-S $ARB/tmux-sock send-keys -t %1 Enter|")
+      t_ok "AR quota: pane check, then -R, C-u, the line, Enter — on the launching pane" ;;
+    *) t_fail "AR quota: tmux sequence" "$seq_ok" ;;
+  esac
+  ls "$ARC/tmp/autoresume/" 2>/dev/null | grep -q '^r-' \
+    && t_fail "AR quota: the relaunch token is single use" "$(ls "$ARC/tmp/autoresume/")" \
+    || t_ok "AR quota: the relaunch token is single use (files consumed)"
+  ar_wait 10 ar_logged "$ARC" "autoresume watch provider=claude chain=$chain pid=[0-9]+ acct=$to depth=1\$" \
+    && t_ok "AR quota: the relaunched session is supervised again (same chain, depth 1)" \
+    || t_fail "AR quota: second watcher" "$(grep autoresume "$ARC/selection.log")"
+else
+  t_fail "AR quota: relaunched within 30 s" "tui=$(cat "$ARB/tui.log" 2>/dev/null) log=$(grep autoresume "$ARC/selection.log" 2>/dev/null)"
+fi
+ar_reap "$ARC"
+ar_no_watcher "$ARC" && t_ok "AR quota: no watcher left running" || t_fail "AR quota: watcher left running"
+
+# ---- AR4. claude: a pane that is not the launching shell is never typed into -----------
+ar_claude_pool
+ar_start FAKE_TUI=quota CLAUDE_MULTIACC_AR_TEST_TMUX_ANYPANE= FAKE_TMUX_PANE_PID=1 \
+  -- claude --dangerously-skip-permissions "fix the bug please"
+if ar_wait 20 ar_logged "$ARC" 'autoresume giveup provider=claude .*reason=pane'; then
+  sleep 0.3
+  ar_running "$AR_PID" && [ ! -s "$ARB/tmux/typed" ] \
+    && ! ls "$ARC/tmp/autoresume/" 2>/dev/null | grep -q '^r-' \
+    && t_ok "AR pane: another pane's process -> give up before stopping anything" \
+    || t_fail "AR pane: nothing stopped, nothing typed" "$(cat "$ARB/tmux/typed" 2>/dev/null)"
+else
+  t_fail "AR pane: giveup logged" "$(grep autoresume "$ARC/selection.log" 2>/dev/null)"
+fi
+ar_reap "$ARC"
+
+# ---- AR5. claude auth: the old login is parked, the session moves ------------------------
+ar_claude_pool
+ar_start FAKE_TUI=auth -- claude --dangerously-skip-permissions "fix the bug please"
+if ar_wait 30 ar_lines 2 "$ARB/tui.log"; then
+  l1="$(sed -n 1p "$ARB/tui.log")"; l2="$(sed -n 2p "$ARB/tui.log")"
+  from="$(ar_acct_of "$l1")"; to="$(ar_acct_of "$l2")"
+  [ -n "$from" ] && [ "$from" != "$to" ] && [ -f "$ARC/$from/.expired" ] \
+    && t_ok "AR auth: the old account is parked (.expired) and the session moved ($from -> $to)" \
+    || t_fail "AR auth: park + rotate" "$l1 | $l2 | $(ls -a "$ARC/$from" 2>/dev/null | tr '\n' ' ')"
+  check "AR auth: resumed with the login reason" \
+    "--resume $AR_SID (claude-multiacc auto-resume) This session was restarted automatically on another account because the previous account's login failed." "$l2"
+else
+  t_fail "AR auth: relaunched within 30 s" "$(grep autoresume "$ARC/selection.log" 2>/dev/null)"
+fi
+ar_reap "$ARC"
+
+# ---- AR6. claude crash: the registry left behind means a crash; relaunch in place -------
+ar_claude_pool
+ar_start FAKE_TUI=crash -- claude --dangerously-skip-permissions "fix the bug please"
+if ar_wait 30 ar_lines 2 "$ARB/tui.log"; then
+  l2="$(sed -n 2p "$ARB/tui.log")"
+  check "AR crash: resumed with the crash reason, no 'another account'" \
+    "--resume $AR_SID (claude-multiacc auto-resume) This session was restarted automatically because the previous process exited unexpectedly." "$l2"
+  ar_logged "$ARC" 'autoresume crash provider=claude .* runtime=[0-9]+' \
+    && ar_logged "$ARC" 'autoresume relaunch chain=[A-Za-z0-9]+ from=acct-0[12] class=crash depth=1$' \
+    && t_ok "AR crash: logged as a crash and relaunched (no marker class)" \
+    || t_fail "AR crash: log lines" "$(grep autoresume "$ARC/selection.log")"
+  ls "$ARC"/acct-0*/.limited >/dev/null 2>&1 \
+    && t_fail "AR crash: no account is marked" "$(ls "$ARC"/acct-0*/.limited)" \
+    || t_ok "AR crash: no account is marked"
+else
+  t_fail "AR crash: relaunched within 30 s" "$(grep autoresume "$ARC/selection.log" 2>/dev/null)"
+fi
+ar_reap "$ARC"
+
+# ---- AR7. claude: errors auto-resume must NOT act on ---------------------------------------
+# invalid_request: another account would fail the same way — logged once, left alone.
+ar_claude_pool
+ar_start FAKE_TUI=invalid -- claude --dangerously-skip-permissions "fix the bug please"
+if ar_wait 15 ar_logged "$ARC" 'autoresume never provider=claude .*code=invalid_request'; then
+  sleep 1.5
+  ar_running "$AR_PID" && [ ! -s "$ARB/tmux/typed" ] \
+    && t_ok "AR never: invalid_request is logged and the session left alone" \
+    || t_fail "AR never: the session was stopped"
+else
+  t_fail "AR never: logged" "$(grep autoresume "$ARC/selection.log" 2>/dev/null)"
+fi
+ar_reap "$ARC"
+# An OLD rejection in a resumed transcript never fires: only records from this launch count.
+ar_claude_pool
+mkdir -p "$ARC/shared-projects/-fake-tui"
+printf '{"type":"assistant","isApiErrorMessage":true,"error":"rate_limit","quotaLimits":{"status":"rejected","resetsAt":%s,"rateLimitType":"five_hour"},"timestamp":"2026-01-01T00:00:00.000Z","sessionId":"%s","message":{"content":[{"type":"text","text":"limit"}]}}\n' \
+  "$(( $(date +%s) + 3600 ))" "$AR_SID" > "$ARC/shared-projects/-fake-tui/$AR_SID.jsonl"
+ar_start FAKE_TUI=idle FAKE_TUI_QUIET=1 -- claude --dangerously-skip-permissions --resume "$AR_SID" "carry on please"
+if ar_wait 15 grep -qs "transcript .*$AR_SID.jsonl" "$ARC/tmp/autoresume/$AR_PID.log"; then
+  sleep 1.5
+  ar_logged "$ARC" 'autoresume (detect|switch)' || ! ar_running "$AR_PID" \
+    && t_fail "AR resumed transcript: an old rejection fired" "$(grep autoresume "$ARC/selection.log")" \
+    || t_ok "AR resumed transcript: an old rejection does not fire"
+else
+  t_fail "AR resumed transcript: watcher followed the transcript" "$(cat "$ARC/tmp/autoresume/$AR_PID.log" 2>/dev/null)"
+fi
+ar_reap "$ARC"
+
+# ---- AR8. claude: no account to move to -> HOLD, nothing is stopped ----------------------
+ar_claude_pool
+# acct-02 is out for the week (a weekly client marker outlives every telemetry pass).
+printf '%s\nbucket=client:seven_day percent=100 marked_at=%s reason=client-rate-limit\n' \
+  "$(( $(date +%s) + 86400 ))" "$(date -u +%Y-%m-%dT%H:%M:%SZ)" > "$ARC/acct-02/.limited"
+ar_start FAKE_TUI=quota -- claude --dangerously-skip-permissions "fix the bug please"
+if ar_wait 20 ar_logged "$ARC" 'autoresume hold provider=claude .*class=quota .*reason=no-room'; then
+  sleep 1
+  ar_running "$AR_PID" && [ ! -s "$ARB/tmux/typed" ] \
+    && ! ls "$ARC/tmp/autoresume/" 2>/dev/null | grep -q '^r-' \
+    && t_ok "AR hold: no eligible account -> hold, no kill, nothing typed" \
+    || t_fail "AR hold: the session was stopped"
+  grep -q 'CFG=acct-01' "$ARB/tui.log" && t_ok "AR hold: the first launch took the only eligible account" \
+    || t_fail "AR hold: first pick" "$(cat "$ARB/tui.log")"
+else
+  t_fail "AR hold: logged" "$(grep autoresume "$ARC/selection.log" 2>/dev/null)"
+fi
+ar_reap "$ARC"
+
+# ---- AR9. claude: autoresume.off stops a RUNNING watcher ---------------------------------
+ar_claude_pool
+ar_start FAKE_TUI=quota FAKE_TUI_DELAY=2.5 -- claude --dangerously-skip-permissions "fix the bug please"
+if ar_wait 15 ar_logged "$ARC" 'autoresume watch provider=claude'; then
+  : > "$ARC/autoresume.off"
+  ar_wait 5 ar_no_watcher "$ARC" && t_ok "AR off: the running watcher exits on autoresume.off" \
+    || t_fail "AR off: the running watcher exits on autoresume.off"
+  ar_wait 10 grep -qs '"rate_limit"' "$ARC/shared-projects/-fake-tui/$AR_SID.jsonl"
+  sleep 1.2
+  ar_running "$AR_PID" && [ ! -s "$ARB/tmux/typed" ] && ! ar_logged "$ARC" 'autoresume (detect|switch)' \
+    && t_ok "AR off: the limit after the kill switch stops nothing" \
+    || t_fail "AR off: the session was stopped"
+else
+  t_fail "AR off: watcher started" "$(grep autoresume "$ARC/selection.log" 2>/dev/null)"
+fi
+ar_reap "$ARC"
+
+# ---- AR11. a relaunch re-entering through the token preflight keeps its chain -----------
+# The relaunch left acct-01 on a MODEL limit (no marker: the chain's AVOID list is all that
+# keeps the session off it). acct-02 leads on headroom but its portable token is revoked,
+# so the preflight parks it and re-enters the shim with `exec "$SELF"` — the token is spent
+# by then, so the chain rides along in the environment. Without it the re-entered selection
+# takes acct-01 (the best weekly left) and the next watcher restarts at depth 0.
+ar_claude_pool
+printf '{"version": 1, "threshold": 90, "accounts": [%s, %s, %s]}\n' \
+  '{"id": "acct-01", "email": "a@ar", "home": "mac", "added_at": "2026-09-23T00:00:00Z"}' \
+  '{"id": "acct-02", "email": "b@ar", "home": "mac", "added_at": "2026-09-23T00:00:00Z"}' \
+  '{"id": "acct-03", "email": "c@ar", "home": "mac", "added_at": "2026-09-23T00:00:00Z"}' \
+  > "$ARC/accounts.json"
+mkdir -p "$ARC/acct-03"
+cp "$ARC/acct-01/.credentials.json" "$ARC/acct-03/.credentials.json"
+ln -s "$ARC/shared-projects" "$ARC/acct-03/projects"
+rm -f "$ARC/acct-02/.credentials.json"
+printf 'sk-ant-oat01-REVOKED-carry\n' > "$ARC/acct-02/server.token"
+nowc="$(date +%s)"
+for i in 01:5 02:10 03:20; do
+  printf '{"fetched_at":%s,"weekly_percent":%s,"session_percent":10,"max_percent":%s,"buckets":[]}' \
+    "$nowc" "${i#*:}" "${i#*:}" > "$ARC/acct-${i%%:*}/limits.json"
+done
+mkdir -p "$ARC/tmp/autoresume"
+tok=CarryTok0123456789
+printf '%s\n' v=1 provider=claude class=model acct=acct-01 reset= rtype= marked= "sid=$AR_SID" \
+  "cwd=$ARW" depth=2 "avoid=acct-01:$((nowc + 18000))" "hist=model:$((nowc - 100))" chain=CarryTst \
+  > "$ARC/tmp/autoresume/r-$tok.relaunch"
+printf '%s\0' --dangerously-skip-permissions --resume "$AR_SID" "(claude-multiacc auto-resume) carry on please" \
+  > "$ARC/tmp/autoresume/r-$tok.argv"
+out="$(cd "$ARH" && env "${AREC[@]}" CLAUDE_MULTIACC_PYTHON="$ARB/stub-python" FAKE_STUB_PY_LOG="$ARB/stub.log" \
+  CLAUDE_MULTIACC_HEADROOM_BAND=0 CLAUDE_MULTIACC_AR="$tok" claude </dev/null 2>&1)"
+check "AR carry: the re-entered selection still skips the account the chain left" \
+  "CFG=acct-03 TOK=none ARGS=--dangerously-skip-permissions --resume $AR_SID (claude-multiacc auto-resume) carry on please" "$out"
+ar_logged "$ARC" 'acct-02 parked \(setup-token-invalid\)' \
+  && t_ok "AR carry: the revoked token was parked by the preflight (the re-entry happened)" \
+  || t_fail "AR carry: preflight park" "$(cat "$ARC/selection.log")"
+st="$(ls "$ARC/tmp/autoresume/"*.state 2>/dev/null | head -1)"
+grep -q '^depth=2$' "$st" 2>/dev/null && grep -q '^chain=CarryTst$' "$st" \
+  && grep -q "^avoid=acct-01:$((nowc + 18000))\$" "$st" && grep -q '^cwd=/.*/ar-work dir$' "$st" \
+  && t_ok "AR carry: the next watcher inherits depth, chain, AVOID and the session's cwd" \
+  || t_fail "AR carry: state file" "$(cat "$st" 2>/dev/null)"
+[ "$(grep -c 'autoresume relaunch chain=CarryTst from=acct-01 class=model depth=2$' "$ARC/selection.log")" = 1 ] \
+  && t_ok "AR carry: the relaunch is logged once, not again by the re-entry" \
+  || t_fail "AR carry: relaunch log" "$(grep autoresume "$ARC/selection.log")"
+ar_reap "$ARC"
+
+# ---- AR12. claude relaunch tokens: the auth park, dead tokens, the trust mirror ------------
+# Planted directly (no watcher, no TUI), so each assertion can only come from the relaunch
+# entry itself. acct-01 leads on headroom and HEADROOM_BAND=0 makes the lead decisive.
+ar_claude_pool
+nowc="$(date +%s)"
+for i in 01:5 02:20; do
+  printf '{"fetched_at":%s,"weekly_percent":%s,"session_percent":10,"max_percent":%s,"buckets":[]}' \
+    "$nowc" "${i#*:}" "${i#*:}" > "$ARC/acct-${i%%:*}/limits.json"
+done
+# class=auth: no auth record in any transcript, so only the relaunch can park acct-01.
+ar_plant "$ARC" AuthTok0123456789 claude auth acct-01 -- \
+  --dangerously-skip-permissions --resume "$AR_SID" "(claude-multiacc auto-resume) carry on please"
+out="$(cd "$ARH" && env "${AREC[@]}" CLAUDE_MULTIACC_PYTHON="$ARB/stub-python" CLAUDE_MULTIACC_HEADROOM_BAND=0 \
+  CLAUDE_MULTIACC_AR="AuthTok0123456789:$AR_SID" claude </dev/null 2>&1)"
+[ -f "$ARC/acct-01/.expired" ] && ar_logged "$ARC" 'acct-01 parked \(' \
+  && t_ok "AR auth token: the relaunch parks the account it left (.expired)" \
+  || t_fail "AR auth token: park" "$(ls -a "$ARC/acct-01" | tr '\n' ' ')"
+check "AR auth token: ...and the run lands on the other account, resuming the session" \
+  "CFG=acct-02 TOK=none ARGS=--dangerously-skip-permissions --resume $AR_SID (claude-multiacc auto-resume) carry on please" "$out"
+# Dead tokens: missing, expired (older than 10 min), malformed, a FIFO in its place.
+ar_dead claude "a missing relaunch file" "claude-multiacc: $AR_DEAD_MSG Resume with: claude --resume $AR_SID" \
+  CLAUDE_MULTIACC_AR="MissingTok0123456:$AR_SID"
+ar_plant "$ARC" ExpiredTok0123456 claude quota acct-01 -- --resume "$AR_SID" "(claude-multiacc auto-resume) x y"
+touch -t 202601010000 "$ARC/tmp/autoresume/r-ExpiredTok0123456.relaunch"
+ar_dead claude "an expired relaunch file" "claude-multiacc: $AR_DEAD_MSG Resume with: claude --resume $AR_SID" \
+  CLAUDE_MULTIACC_AR="ExpiredTok0123456:$AR_SID"
+ls "$ARC/tmp/autoresume/" 2>/dev/null | grep -q '^r-ExpiredTok' \
+  && t_fail "AR dead token (claude): an expired token is consumed" "$(ls "$ARC/tmp/autoresume/")" \
+  || t_ok "AR dead token (claude): an expired token is consumed"
+ar_dead claude "a malformed token" "claude-multiacc: $AR_DEAD_MSG Resume with: claude --resume $AR_SID" \
+  CLAUDE_MULTIACC_AR="../bad/tok:$AR_SID"
+ar_dead claude "an unusable session id (no hint)" "claude-multiacc: $AR_DEAD_MSG" \
+  CLAUDE_MULTIACC_AR='MissingTok0123456:$(id)'
+mkfifo "$ARC/tmp/autoresume/r-FifoTok0123456789.relaunch"
+( cd "$ARH" && exec env "${AREC[@]}" CLAUDE_MULTIACC_PYTHON="$ARB/stub-python" \
+  CLAUDE_MULTIACC_AR="FifoTok0123456789:$AR_SID" claude ) </dev/null > "$ARB/fifo.out" 2>&1 &
+fp=$!
+if ar_wait 10 ar_stopped "$fp"; then
+  wait "$fp"; rc=$?
+  [ "$rc" = 2 ] && ! grep -q 'CFG=' "$ARB/fifo.out" \
+    && t_ok "AR dead token (claude): a FIFO named like a relaunch file never blocks the launch" \
+    || t_fail "AR dead token (claude): FIFO" "rc=$rc $(cat "$ARB/fifo.out")"
+else
+  kill -KILL "$fp" 2>/dev/null; wait "$fp" 2>/dev/null
+  t_fail "AR dead token (claude): a FIFO named like a relaunch file blocked the launch"
+fi
+rm -f "$ARC/tmp/autoresume/r-FifoTok0123456789.relaunch"
+# Trust: the relaunch marks its cwd trusted in the PICKED account's .claude.json (Claude
+# shows a blocking trust dialog in a new directory even with --dangerously-skip-permissions),
+# keeping every other key. The real python runs it; TMUX= keeps the watcher out of the way.
+# The key is the directory as the relaunch's own `cd` spells it, plus its physical path
+# when that differs (Claude may key projects by either; macOS TMPDIR is a symlink).
+ar_claude_pool
+nowc="$(date +%s)"
+arw_key="$(cd "$ARW" && pwd)"
+for i in 01:20 02:5; do
+  printf '{"fetched_at":%s,"weekly_percent":%s,"session_percent":10,"max_percent":%s,"buckets":[]}' \
+    "$nowc" "${i#*:}" "${i#*:}" > "$ARC/acct-${i%%:*}/limits.json"
+done
+printf '{"numStartups": 7, "projects": {"%s": {"allowedTools": ["Bash"]}, "/elsewhere": {"hasTrustDialogAccepted": false}}}\n' \
+  "$arw_key" > "$ARC/acct-02/.claude.json"
+chmod 600 "$ARC/acct-02/.claude.json"
+printf '{"numStartups": 1}\n' > "$ARC/acct-01/.claude.json"
+cp "$ARC/acct-01/.claude.json" "$ARB/acct-01.claude.json"
+ar_plant "$ARC" TrustTok0123456789 claude crash acct-01 -- \
+  --dangerously-skip-permissions --resume "$AR_SID" "(claude-multiacc auto-resume) carry on please"
+out="$(cd "$ARH" && env "${AREC[@]}" TMUX= CLAUDE_MULTIACC_HEADROOM_BAND=0 \
+  CLAUDE_MULTIACC_AR="TrustTok0123456789:$AR_SID" claude </dev/null 2>&1)"
+check "AR trust: the relaunch ran on the picked account" "CFG=acct-02 " "$out"
+if python3 - "$ARC/acct-02/.claude.json" "$arw_key" <<'PYEOF'
+import json, os, stat, sys
+path, cwd = sys.argv[1], sys.argv[2]
+d = json.load(open(path))
+p = d["projects"]
+real = os.path.realpath(cwd)
+ok = (p[cwd] == {"allowedTools": ["Bash"], "hasTrustDialogAccepted": True}
+      and (real == cwd or p.get(real) == {"hasTrustDialogAccepted": True})
+      and len(p) == (2 if real == cwd else 3) and d.get("numStartups") == 7
+      and p["/elsewhere"] == {"hasTrustDialogAccepted": False}
+      and stat.S_IMODE(os.stat(path).st_mode) == 0o600)
+sys.exit(0 if ok else 1)
+PYEOF
+then
+  t_ok "AR trust: projects[cwd].hasTrustDialogAccepted=true, every other key and the file mode kept"
+else
+  t_fail "AR trust: .claude.json after the relaunch" "$(cat "$ARC/acct-02/.claude.json")"
+fi
+cmp -s "$ARC/acct-01/.claude.json" "$ARB/acct-01.claude.json" \
+  && t_ok "AR trust: the account the session left is not touched" \
+  || t_fail "AR trust: the left account's .claude.json changed" "$(cat "$ARC/acct-01/.claude.json")"
+# A plain launch (no token) never edits trust.
+printf '{"numStartups": 7}\n' > "$ARC/acct-02/.claude.json"
+cp "$ARC/acct-02/.claude.json" "$ARB/acct-02.claude.json"
+(cd "$ARW" && env "${AREC[@]}" TMUX= claude --dangerously-skip-permissions </dev/null >/dev/null 2>&1)
+cmp -s "$ARC/acct-01/.claude.json" "$ARB/acct-01.claude.json" \
+  && cmp -s "$ARC/acct-02/.claude.json" "$ARB/acct-02.claude.json" \
+  && t_ok "AR trust: a launch that is not a relaunch never edits .claude.json" \
+  || t_fail "AR trust: a plain launch edited .claude.json" "$(cat "$ARC"/acct-0*/.claude.json)"
+ar_reap "$ARC"
+
+# ---- AR10. codex: the same machinery through bin/codex ------------------------------------
+ARX="$WORK/ar-codex"
+ar_codex_pool() { # a fresh two-account codex pool sharing one sessions tree (the installed layout)
+  local i
+  rm -rf "$ARX" "$ARB/tmux" "$ARB/pids" "$ARB/tui.log" "$ARB/stub.log"
+  mkdir -p "$ARX/tmp" "$ARX/shared-sessions" "$ARB/tmux"
+  printf '{"version": 1, "threshold": 90, "accounts": [%s, %s]}\n' \
+    '{"id": "acct-01", "email": "a@arx", "home": "mac", "added_at": "2026-09-23T00:00:00Z"}' \
+    '{"id": "acct-02", "email": "b@arx", "home": "mac", "added_at": "2026-09-23T00:00:00Z"}' \
+    > "$ARX/accounts.json"
+  for i in 01 02; do
+    mkdir -p "$ARX/acct-$i"
+    mk_cx_auth "$ARX/acct-$i/auth.json" "$i@arx" "$FUTURE_EXP"
+    printf '{"fetched_at":%s,"weekly_percent":20,"session_percent":10,"max_percent":20,"buckets":[]}' "$(date +%s)" \
+      > "$ARX/acct-$i/limits.json"
+    ln -s "$ARX/shared-sessions" "$ARX/acct-$i/sessions"
+  done
+  : > "$ARX/.limits-kick"
+}
+AREX=(CODEX_ACCOUNTS_DIR="$ARX" HOME="$ARH" TMUX="$ARB/tmux-sock,4243,0" TMUX_PANE=%2
+  CODEX_MULTIACC_AUTORESUME=1 CODEX_MULTIACC_PYTHON="$ARPY" CODEX_MULTIACC_AR_TEST_TTY=1
+  CODEX_MULTIACC_AR_TEST_TMUX_ANYPANE=1 CODEX_MULTIACC_AR_POLL=0.1 CODEX_MULTIACC_AR_GRACE=0.5
+  CODEX_MULTIACC_AR_TERM_GRACE=3 CODEX_MULTIACC_AR_PANE_WAIT=5 CODEX_MULTIACC_AR_PROBE_TIMEOUT=15
+  CODEX_MULTIACC_AR_DISCOVER_TIMEOUT=20 CODEX_MULTIACC_AUTORESUME_DEBUG=1
+  FAKE_TMUX_DIR="$ARB/tmux" FAKE_TUI_LOG="$ARB/tui.log" FAKE_TUI_PIDS="$ARB/pids")
+ar_codex_pool
+cx_gate() { # cx_gate <name> <watcher|none> [VAR=val ...] -- <codex args...>
+  local name="$1" want="$2" pre=() out states
+  shift 2
+  while [ $# -gt 0 ] && [ "$1" != "--" ]; do pre+=("$1"); shift; done
+  [ $# -gt 0 ] && shift
+  rm -rf "$ARX/tmp/autoresume" "$ARB/stub.log"
+  out="$(cd "$ARW" && env "${AREX[@]}" CODEX_MULTIACC_PYTHON="$ARB/stub-python" \
+    FAKE_STUB_PY_LOG="$ARB/stub.log" ${pre[@]+"${pre[@]}"} codex "$@" </dev/null 2>&1)"
+  states="$(ls "$ARX/tmp/autoresume/" 2>/dev/null | grep -c '\.state$')"
+  case "$out" in *CFG=acct-0*) ;; *) t_fail "codex auto-resume gate: $name execs" "$out"; return ;; esac
+  if [ "$want" = watcher ]; then
+    [ "$states" = 1 ] && ar_wait 5 grep -qs -- "-I .*lib/autoresume.py watch --state $ARX/tmp/autoresume/[0-9]*\.state" "$ARB/stub.log" \
+      && t_ok "codex auto-resume gate: $name gets a watcher" \
+      || t_fail "codex auto-resume gate: $name gets a watcher" "states=$states"
+  else
+    [ "$states" = 0 ] && [ ! -s "$ARB/stub.log" ] \
+      && t_ok "codex auto-resume gate: $name gets no watcher" \
+      || t_fail "codex auto-resume gate: $name gets no watcher" "states=$states"
+  fi
+}
+cx_gate "a prompt with the bypass flag" watcher -- --dangerously-bypass-approvals-and-sandbox "fix the bug please"
+cx_gate "resume <uuid>" watcher -- resume "$AR_CXSID"
+cx_gate "exec" none -- exec "do it now"
+cx_gate "-p (profile)" none -- -p work
+cx_gate "-c overrides" none -- -c model=o3
+cx_gate "a pinned run" none CODEX_ACCOUNT=acct-01 --
+cx_gate "an invalid pin (random fallback)" none CODEX_ACCOUNT=acct-99 --
+cx_gate "outside tmux" none TMUX_PANE= --
+cx_gate "CODEX_MULTIACC_AUTORESUME=off" none CODEX_MULTIACC_AUTORESUME=off --
+ln -s "$ARX" "$WORK/ar codex root"
+cx_gate "a pool root that would need quoting" none CODEX_ACCOUNTS_DIR="$WORK/ar codex root" -- --yolo
+# The client never sees an auto-resume variable (AREX itself exports several).
+rm -rf "$ARX/tmp/autoresume"
+out="$(cd "$ARW" && env "${AREX[@]}" CODEX_MULTIACC_PYTHON="$ARB/stub-python" FAKE_PRINT_ENV=1 \
+  codex --yolo </dev/null 2>&1)"
+case "$out" in
+  *"AR_ENV=0"*) [ -n "$(ls "$ARX/tmp/autoresume/" 2>/dev/null | grep '\.state$')" ] \
+      && t_ok "codex auto-resume: the client never sees an auto-resume variable (watcher spawned)" \
+      || t_fail "codex auto-resume: env scrub case spawned no watcher" "$out" ;;
+  *) t_fail "codex auto-resume: the client never sees an auto-resume variable" "$out" ;;
+esac
+out="$(cd "$ARW" && env "${AREX[@]}" CODEX_MULTIACC_AR_PROBE=1 codex --yolo </dev/null 2>&1)"; rc=$?
+case "$rc:$out" in 0:pick=acct-0[12]" tier=eligible") t_ok "codex probe prints pick/tier, never execs" ;;
+  *) t_fail "codex probe" "rc=$rc out=$out" ;; esac
+all1=1
+for _ in 1 2 3 4 5; do
+  out="$(cd "$ARW" && env "${AREX[@]}" CODEX_MULTIACC_AR_PROBE=1 \
+    CODEX_MULTIACC_AR_AVOID="acct-02:$(( $(date +%s) + 3600 ))" codex --yolo </dev/null 2>&1)"
+  [ "$out" = "pick=acct-01 tier=eligible" ] || all1=0
+done
+[ "$all1" = 1 ] && t_ok "codex probe honours AVOID (5 of 5)" || t_fail "codex probe AVOID" "$out"
+# codex relaunch tokens, planted directly: acct-01 leads, so only the relaunch's own park
+# keeps the run off it (the shared sessions tree turns the rollout scan off).
+nowx="$(date +%s)"
+for i in 01:5 02:20; do
+  printf '{"fetched_at":%s,"weekly_percent":%s,"session_percent":10,"max_percent":%s,"buckets":[]}' \
+    "$nowx" "${i#*:}" "${i#*:}" > "$ARX/acct-${i%%:*}/limits.json"
+done
+rm -f "$ARX/.last-pick"
+ar_plant "$ARX" CxAuthTok01234567 codex auth acct-01 -- \
+  resume --yolo "$AR_CXSID" "(claude-multiacc auto-resume) carry on please"
+out="$(cd "$ARH" && env "${AREX[@]}" CODEX_MULTIACC_PYTHON="$ARB/stub-python" CODEX_MULTIACC_HEADROOM_BAND=0 \
+  CODEX_MULTIACC_AR="CxAuthTok01234567:$AR_CXSID" codex </dev/null 2>&1)"
+grep -q 'reason=auth-error soft_until=' "$ARX/acct-01/.expired" 2>/dev/null \
+  && t_ok "AR codex auth token: the relaunch parks the account it left (auth-error, soft)" \
+  || t_fail "AR codex auth token: park" "$(cat "$ARX/acct-01/.expired" 2>/dev/null)"
+check "AR codex auth token: ...and the run lands on the other account" "CFG=acct-02" "$out"
+ar_dead codex "a missing relaunch file" "codex-multiacc: $AR_DEAD_MSG Resume with: codex resume $AR_CXSID" \
+  CODEX_MULTIACC_AR="MissingTok0123456:$AR_CXSID"
+ar_plant "$ARX" ExpiredTok0123456 codex quota acct-01 -- resume "$AR_CXSID" "(claude-multiacc auto-resume) x y"
+touch -t 202601010000 "$ARX/tmp/autoresume/r-ExpiredTok0123456.relaunch"
+ar_dead codex "an expired relaunch file" "codex-multiacc: $AR_DEAD_MSG Resume with: codex resume $AR_CXSID" \
+  CODEX_MULTIACC_AR="ExpiredTok0123456:$AR_CXSID"
+ls "$ARX/tmp/autoresume/" 2>/dev/null | grep -q '^r-ExpiredTok' \
+  && t_fail "AR dead token (codex): an expired token is consumed" "$(ls "$ARX/tmp/autoresume/")" \
+  || t_ok "AR dead token (codex): an expired token is consumed"
+ar_dead codex "a malformed token" "codex-multiacc: $AR_DEAD_MSG Resume with: codex resume $AR_CXSID" \
+  CODEX_MULTIACC_AR="../bad/tok:$AR_CXSID"
+ar_dead codex "an unusable session id (no hint)" "codex-multiacc: $AR_DEAD_MSG" \
+  CODEX_MULTIACC_AR='MissingTok0123456:$(id)'
+# No valid login anywhere: a launch would fall back to the stock client — a probe must not.
+ar_codex_pool
+rm -f "$ARX"/acct-0*/auth.json
+out="$(cd "$ARW" && env "${AREX[@]}" CODEX_MULTIACC_AR_PROBE=1 codex --yolo </dev/null 2>&1)"; rc=$?
+[ "$rc:$out" = "3:pick= tier=none" ] && t_ok "codex probe on a pool with no valid login answers tier=none (exit 3), never execs" \
+  || t_fail "codex probe with no valid login" "rc=$rc out=$out"
+
+ar_codex_pool
+AREC=("${AREX[@]}")   # ar_start launches with AREC
+ar_start FAKE_TUI=quota -- codex --dangerously-bypass-approvals-and-sandbox "fix the bug please"
+first=$AR_PID
+if ar_wait 30 ar_lines 2 "$ARB/tui.log"; then
+  l1="$(sed -n 1p "$ARB/tui.log")"; l2="$(sed -n 2p "$ARB/tui.log")"
+  from="$(ar_acct_of "$l1")"; to="$(ar_acct_of "$l2")"
+  [ -n "$from" ] && [ -n "$to" ] && [ "$from" != "$to" ] \
+    && t_ok "AR codex quota: relaunched on the OTHER account ($from -> $to)" \
+    || t_fail "AR codex quota: relaunched on the other account" "$l1 | $l2"
+  check "AR codex quota: \`resume <opts> <sid> <prompt>\`" \
+    "ARGS=resume --dangerously-bypass-approvals-and-sandbox $AR_CXSID (claude-multiacc auto-resume) This session was restarted automatically on another account because the previous account hit its usage limit." "$l2"
+  ar_wait 5 ar_stopped "$first" && t_ok "AR codex quota: the stuck client was stopped" \
+    || t_fail "AR codex quota: the stuck client was stopped" "pid $first alive"
+  m1="$(sed -n 1p "$ARX/$from/.limited" 2>/dev/null)"; m2="$(sed -n 2p "$ARX/$from/.limited" 2>/dev/null)"
+  nowx="$(date +%s)"
+  case "$m1" in ''|*[!0-9]*) m1=0 ;; esac
+  [ "$m1" -gt "$((nowx + 500))" ] && [ "$m1" -le "$((nowx + 600))" ] \
+    && case "$m2" in "bucket=error-cooldown percent=? marked_at="*" reason=error-cooldown") true ;; *) false ;; esac \
+    && t_ok "AR codex quota: the old account gets the 10-minute error-cooldown, never client:7d" \
+    || t_fail "AR codex quota: cooldown marker" "$m1 / $m2"
+  ar_logged "$ARX" "autoresume relaunch chain=[A-Za-z0-9]+ from=$from class=quota depth=1\$" \
+    && ar_logged "$ARX" "autoresume switch provider=codex chain=[A-Za-z0-9]+ from=$from class=quota sid=$AR_CXSID depth=1 probe=$to" \
+    && t_ok "AR codex quota: switch + relaunch logged" \
+    || t_fail "AR codex quota: log lines" "$(grep autoresume "$ARX/selection.log")"
+  ar_typed_ok CODEX "$AR_CXSID" "CODEX_ACCOUNTS_ROOT=$(cd "$ARX" && pwd)" "$REPO_DIR/bin/codex" \
+    && grep -q -- "send-keys -R -t %2" "$ARB/tmux/calls" \
+    && t_ok "AR codex quota: terminal reset, then the token line typed" \
+    || t_fail "AR codex quota: typed line" "$(cat "$ARB/tmux/typed" 2>/dev/null)"
+  ar_wait 10 ar_logged "$ARX" "autoresume watch provider=codex chain=[A-Za-z0-9]+ pid=[0-9]+ acct=$to depth=1\$" \
+    && t_ok "AR codex quota: the resumed session is supervised again" \
+    || t_fail "AR codex quota: second watcher" "$(grep autoresume "$ARX/selection.log")"
+else
+  t_fail "AR codex quota: relaunched within 30 s" "tui=$(cat "$ARB/tui.log" 2>/dev/null) log=$(grep autoresume "$ARX/selection.log" 2>/dev/null)"
+fi
+ar_reap "$ARX"
+ar_no_watcher "$ARX" && t_ok "AR codex: no watcher left running" || t_fail "AR codex: watcher left running"
+
 # The reset-credit contract is easier to prove against a stateful local HTTP server
 # than file:// fixtures: it pins thresholding, credit ordering and idempotent POST retry.
 if CODEX_MULTIACC_AUTO_RESET=1 python3 -m unittest discover -s "$REPO_DIR/tests" -p 'test_codex_reset*.py'; then
@@ -7909,6 +8834,13 @@ if CLAUDE_MULTIACC_AUTO_RESET=1 python3 -m unittest discover -s "$REPO_DIR/tests
 else
   t_fail "claude automatic reset suite" "see unittest output above"
 fi
+# ...and the auto-resume watcher, unit by unit: classifiers, argv sanitizer, relaunch
+# files, budgets, tmux commands and a fake-runner walk through every stop/relaunch branch.
+if python3 -m unittest discover -s "$REPO_DIR/tests" -p 'test_autoresume.py'; then
+  t_ok "auto-resume watcher unit suite"
+else
+  t_fail "auto-resume watcher unit suite" "see unittest output above"
+fi
 
 # ---- summary ---------------------------------------------------------------------
 echo