claude-multiacc 2.0.48 → 2.0.50

package/README.md

@@ -446,8 +446,8 @@ Every other launch, including `-p` and `codex exec`, runs exactly as before.
   (`lib/autoresume.py`, which needs `python3`). It reads that run's transcript (codex: its
   rollout).
 - **Probe.** Once an error settles, the watcher asks the shim, in probe mode, whether
-  another account has headroom. If none does, it **holds** and touches nothing, and
-  Claude's own "continuing automatically at …" carries on.
+  another account has headroom, including the 90–99% fallback for quota errors. If none
+  does, it **holds** and Claude's own "continuing automatically at …" carries on.
 - **Relaunch.** Otherwise it stops the TUI with SIGTERM and waits for the pane's shell
   prompt. It then types a one-line relaunch of the shim into that **shell**. It never
   sends a keystroke to the TUI, whose limit menu can add funds or spend the one-shot

package/bin/claude

@@ -447,8 +447,8 @@ ar_relaunch_apply() {
   return 0
 }
 
-# AVOID: accounts this chain just left, each until its own epoch. Filters `eligible` only
-# — never `valid` — so a pool with nowhere else to go still reaches the all-limited
+# AVOID: accounts this chain just left, each until its own epoch. Filters `eligible` and
+# the soft fallback, never `valid`, so a pool with nowhere else to go reaches the hard
 # fallback exactly as before. Builtins only: this runs once per candidate.
 ar_avoided() { # $1 acct dir
   local rest e id until
@@ -2038,7 +2038,7 @@ else
   soft=()
   hard=()
   for d in "${valid[@]}"; do
-    if limited_hard_blocked "$d"; then hard+=("$d"); else soft+=("$d"); fi
+    if ar_avoided "$d" || limited_hard_blocked "$d"; then hard+=("$d"); else soft+=("$d"); fi
   done
   if [ "${#soft[@]}" -gt 0 ]; then
     assess_telemetry "${soft[@]}"

package/bin/codex

@@ -1157,7 +1157,7 @@ for d in "$ACC_ROOT"/acct-*; do
   fi
   over_threshold "$d" && continue
   # An auto-resume relaunch (or its probe) skips the account the session just left until
-  # the reset it was handed. `eligible` only: the all-limited fallback still sees it.
+  # the reset it was handed. The soft fallback also skips it; the hard fallback still sees it.
   ar_avoided "$d" && continue
   eligible+=("$d")
 done
@@ -1318,7 +1318,7 @@ else
   soft=()
   hard=()
   for d in "${valid[@]}"; do
-    if limited_hard_blocked "$d"; then hard+=("$d"); else soft+=("$d"); fi
+    if ar_avoided "$d" || limited_hard_blocked "$d"; then hard+=("$d"); else soft+=("$d"); fi
   done
   # A probe only ASKS: the fallback lines below would claim a pick nobody launched.
   if [ "${#soft[@]}" -gt 0 ]; then

package/docs/AUTORESUME.md

@@ -83,9 +83,12 @@ shell:   runs the shim again → token → marker on the old account → normal
 4. **It asks before it acts.** The watcher runs the shim in *probe mode*
    (`CLAUDE_MULTIACC_AR_PROBE=1`). This is the same candidate loop and the same argv the
    relaunch will use. It prints `pick=acct-NN tier=…` and never execs.
-   - **Limit, login and refusal errors** probe with the current account excluded. They
-     rotate only when the probe finds an **unlimited account other than the current
-     one**.
+   - **Usage-limit errors** probe with the current account excluded. They prefer an
+     account below the pool's exclusion threshold (90% by default), then accept a
+     different `soft` fallback with remaining quota. An account at 90–99% can still
+     serve; an exhausted account or one with an active client rejection cannot.
+   - **Login, refusal and model-limit errors** still require a different account below
+     the exclusion threshold.
    - **Otherwise the watcher holds.** Nothing is stopped, and Claude's own "continuing
      automatically" keeps running. The probe repeats every 60 s for as long as the error
      stands.
@@ -296,9 +299,9 @@ CLAUDE_MULTIACC_AR_PROBE=1 CLAUDE_MULTIACC_AR_AVOID=acct-07:1790000000 claude
 ```
 
 - **`tier`** is one of:
-  - `eligible`: an unlimited account;
-  - `soft`: only the all-limited fallback;
-  - `hard`: only exhausted accounts are left;
+  - `eligible`: an account below the pool's exclusion threshold;
+  - `soft`: only the fallback with remaining quota, excluding accounts the chain avoids;
+  - `hard`: only exhausted accounts or accounts the chain avoids are left;
   - `none`: nothing is usable; exit 3.
 - **`resets_at`** (codex only): a `soft` or `hard` answer may end with
   ` resets_at=<epoch>`, when that tier's reset is known. For `hard` it is the soonest

package/docs/UNIFIED_SELECTOR.md

@@ -57,9 +57,10 @@ weekly limits").
    is what makes a burst of parallel launches fan out instead of stacking on one
    account, and it is deterministic: the same request always yields the same winner.
 
-With no usable quota anywhere the band cannot apply (`band_floor` is `null`) and the
-plain ordering stands: known quota ahead of unknown, then highest effective headroom,
-then least-recently-selected.
+With no usable quota anywhere the band cannot apply (`band_floor` is `null`). Every
+eligible account is then a peer: least-recently-selected wins, followed by the same
+request-key spread. Equal histories must not concentrate launches on the first provider,
+account or runner identity merely because telemetry is unknown.
 
 Success returns the concrete engine/account/runner generation, normalized score basis
 (which still reports `effective_headroom` = min(weekly, session) for observability),

package/docs/VERIFICATION.md

@@ -4,8 +4,8 @@
 
 ```bash
 tests/run-tests.sh            # sandboxed compatibility tests, no quota
-python3 tests/test_selector.py # unified selector contract
-python3 tests/test_autoresume.py # auto-resume classifier/relaunch unit tests (also run by run-tests.sh)
+python3 -m unittest discover -s tests -p 'test_selector*.py' # unified selector contract and distribution
+python3 -m unittest discover -s tests -p 'test_autoresume*.py' # watchers and fallback probes (also in run-tests.sh)
 npm run test:commands         # packed npm commands; run npm install --ignore-scripts first
 claude-accounts verify        # real matrix: `claude -p "reply OK"` per authed account
 claude-accounts verify --quick # auth presence/expiry only, no inference

package/lib/autoresume.py

@@ -55,6 +55,10 @@ import tempfile
 import time
 import traceback
 
+# -I omits the script directory; load only helpers from this installation.
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+from autoresume_probe import ACCT_RE, ROTATE, parse_probe, probe_allows, probe_env
+
 # ---- vocabulary ---------------------------------------------------------------------
 
 PROVIDERS = ("claude", "codex")
@@ -79,10 +83,6 @@ REASONS = {
     "crash": "the previous process exited unexpectedly",
 }
 
-# Classes that MOVE the session to a different account (the probe must offer an eligible
-# one that is not the current account). transient/crash may land on the same account.
-ROTATE = ("quota", "auth", "blocked", "model")
-
 # How long the chain keeps away from the account it is leaving. quota uses the server's
 # own reset instead (QUOTA_FALLBACK when it named none that is still ahead).
 AVOID_SECONDS = {"auth": 3600, "blocked": 6 * 3600, "model": 5 * 3600}
@@ -110,7 +110,6 @@ CODEX_CANCEL = ("user_message", "task_started", "turn_aborted")
 SHELLS = ("zsh", "bash", "sh", "dash", "ksh")
 
 TOKEN_ALPHABET = string.ascii_letters + string.digits
-ACCT_RE = re.compile(r"^acct-[A-Za-z0-9._-]{1,64}$")
 PANE_RE = re.compile(r"^%[0-9]{1,9}$")
 CHAIN_RE = re.compile(r"^[A-Za-z0-9]{1,64}$")
 TOKEN_RE = re.compile(r"^[A-Za-z0-9]{8,64}$")
@@ -1100,50 +1099,6 @@ def notice_argv(sock, pane, provider, sid, sticky=True):
                     "claude-multiacc: auto-resume failed — run: " + resume_hint(provider, sid))
 
 
-# ---- probe --------------------------------------------------------------------------
-
-PROBE_DROP = {
-    "claude": ("CLAUDE_CONFIG_DIR", "CLAUDE_CODE_OAUTH_TOKEN", "CLAUDE_SHIM_ACTIVE",
-               "CLAUDE_ACCOUNT", "CLAUDE_MULTIACC_AR"),
-    "codex": ("CODEX_HOME", "CODEX_SHIM_ACTIVE", "CODEX_ACCOUNT", "CODEX_MULTIACC_AR"),
-}
-
-
-def probe_env(environ, provider, avoid):
-    """The watcher inherited the picked account's exports; the probe must select from
-    scratch, so they go, and probe mode + the AVOID list come in."""
-    env = {k: v for k, v in environ.items() if k not in PROBE_DROP[provider]}
-    up = provider.upper()
-    env[up + "_MULTIACC_AR_PROBE"] = "1"
-    env[up + "_MULTIACC_AR_AVOID"] = avoid or ""
-    return env
-
-
-def parse_probe(out):
-    """The probe's ``pick=<acct> tier=<eligible|soft|hard|none>`` -> (pick, tier).
-
-    Trailing ``key=value`` fields (the codex shim's ``resets_at=<epoch>``) are accepted
-    and ignored here."""
-    pick, tier = "", ""
-    for line in (out or "").split("\n"):
-        m = re.match(r"^pick=(\S*) tier=(\S+)(?:\s+\w+=\S*)*\s*$", line.strip())
-        if m:
-            pick, tier = m.group(1), m.group(2)
-    if pick and not ACCT_RE.match(pick):
-        return "", ""
-    if tier not in ("eligible", "soft", "hard", "none"):
-        return "", ""
-    return pick, tier
-
-
-def probe_allows(cls, pick, tier, current):
-    """Rotate classes need an ELIGIBLE account that is not the one being left (holding
-    beats landing on a soft/hard fallback); transient/crash may retry anywhere usable."""
-    if cls in ROTATE:
-        return tier == "eligible" and bool(pick) and pick != current
-    return tier in ("eligible", "soft") and bool(pick)
-
-
 # ---- side effects -------------------------------------------------------------------
 
 def descendants(table, pid):

package/lib/autoresume_probe.py

@@ -0,0 +1,50 @@
+"""Probe environment, wire response and restart eligibility shared by both watchers."""
+
+import re
+
+
+ACCT_RE = re.compile(r"^acct-[A-Za-z0-9._-]{1,64}$")
+# These errors require a different account; transient/crash may retry the same one.
+ROTATE = ("quota", "auth", "blocked", "model")
+PROBE_DROP = {
+    "claude": ("CLAUDE_CONFIG_DIR", "CLAUDE_CODE_OAUTH_TOKEN", "CLAUDE_SHIM_ACTIVE",
+               "CLAUDE_ACCOUNT", "CLAUDE_MULTIACC_AR"),
+    "codex": ("CODEX_HOME", "CODEX_SHIM_ACTIVE", "CODEX_ACCOUNT", "CODEX_MULTIACC_AR"),
+}
+
+
+def probe_env(environ, provider, avoid):
+    """Remove the watched account's exports so the shim selects from the whole pool."""
+    env = {k: v for k, v in environ.items() if k not in PROBE_DROP[provider]}
+    up = provider.upper()
+    env[up + "_MULTIACC_AR_PROBE"] = "1"
+    env[up + "_MULTIACC_AR_AVOID"] = avoid or ""
+    return env
+
+
+def parse_probe(out):
+    """Read pick/tier, accepting trailing fields such as Codex's resets_at epoch."""
+    pick, tier = "", ""
+    for line in (out or "").split("\n"):
+        match = re.match(r"^pick=(\S*) tier=(\S+)(?:\s+\w+=\S*)*\s*$", line.strip())
+        if match:
+            pick, tier = match.group(1), match.group(2)
+    if pick and not ACCT_RE.match(pick):
+        return "", ""
+    if tier not in ("eligible", "soft", "hard", "none"):
+        return "", ""
+    return pick, tier
+
+
+def probe_allows(cls, pick, tier, current):
+    """Quota rotations may use remaining quota, as an ordinary shim launch already does.
+
+    The shim excludes chain-avoided accounts from soft fallback, and treats exhausted
+    accounts and observed client rejections as hard. Other rotation classes keep their
+    below-threshold requirement; transient/crash may retry anywhere still usable.
+    """
+    if cls == "quota":
+        return tier in ("eligible", "soft") and bool(pick) and pick != current
+    if cls in ROTATE:
+        return tier == "eligible" and bool(pick) and pick != current
+    return tier in ("eligible", "soft") and bool(pick)

package/lib/selector_policy.py

@@ -119,14 +119,6 @@ def _apply_policy(request: dict, rows: list[dict]) -> tuple[tuple, int]:
     return producer, alternatives
 
 
-def _winner_key(row: dict) -> tuple:
-    descending_headroom = Decimal(row["effective_headroom"] or "-1").copy_negate()
-    return (
-        not row["quota_known"], descending_headroom,
-        row["last_selected_at"] is not None, row["last_selected_at"] or "",
-        row["engine"], row["account_id"], row["runner_id"], row["runner_generation"])
-
-
 def _session_gate(rows: list[dict], gate: Decimal | None) -> list[dict]:
     """The FIRST cut: accounts whose 5h session bucket still has room.
 
@@ -229,13 +221,12 @@ def select(request: object) -> dict:
     ranked = healthy or known
     floor = _band_floor(ranked, band) if band is not None else None
     if floor is None:
-        # No usable quota anywhere: nothing to band, so keep the plain ordering
-        # (which already ranks unknown-quota rows last and rotates on ties).
+        # No usable quota anywhere: every eligible row is an unknown peer.
+        # Keep LRU and the request spread instead of preferring a fixed identity.
         banded = eligible
-        winner = min(banded, key=_winner_key)
     else:
         banded = [row for row in ranked if Decimal(row["weekly_remaining"]) >= floor]
-        winner = min(banded, key=_band_key(request["reservation_key"]))
+    winner = min(banded, key=_band_key(request["reservation_key"]))
     rows.sort(key=_snapshot_key)
     snapshot = canonical_sha256(rows)
     chosen = dict(zip(("runner_id", "runner_generation", "engine", "account_id"), _row_identity(winner)))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-multiacc",
-  "version": "2.0.48",
+  "version": "2.0.50",
   "description": "Unified Claude Code and OpenAI Codex subscription pooling with quota-aware selection.",
   "type": "module",
   "bin": {
@@ -56,7 +56,8 @@
   "scripts": {
     "postinstall": "node scripts/postinstall.mjs",
     "test": "npm run test:core && npm run test:seeding && npm run test:commands",
-    "test:core": "bash tests/run-tests.sh && python3 tests/test_selector.py && python3 tests/test_shim_path.py",
+    "test:core": "bash tests/run-tests.sh && npm run test:selector && python3 tests/test_shim_path.py",
+    "test:selector": "python3 -m unittest discover -s tests -p 'test_selector*.py'",
     "test:seeding": "python3 tests/test_account_seeding.py && python3 tests/test_mcp_registry.py && npm run test:codex-settings",
     "test:codex-settings": "python3 tests/test_codex_config_edit.py && python3 tests/test_codex_settings.py",
     "test:commands": "python3 tests/test_packaged_commands.py"

package/tests/run-tests.sh

@@ -8773,8 +8773,8 @@ done
 out="$(cd "$ARW" && env "${AREC[@]}" CLAUDE_MULTIACC_AR_PROBE=1 \
   CLAUDE_MULTIACC_AR_AVOID="acct-01:$(( $(date +%s) + 3600 )),acct-02:$(( $(date +%s) + 3600 ))" \
   claude --dangerously-skip-permissions </dev/null 2>&1)"
-case "$out" in "pick=acct-0"[12]" tier=soft") t_ok "probe with every account avoided answers tier=soft" ;;
-  *) t_fail "probe tier=soft" "$out" ;; esac
+case "$out" in "pick=acct-0"[12]" tier=hard") t_ok "probe with every account avoided answers tier=hard" ;;
+  *) t_fail "probe tier=hard" "$out" ;; esac
 ar_logged "$ARC" 'all-limited fallback' \
   && t_fail "a probe logs no fallback pick" "$(grep 'all-limited' "$ARC/selection.log")" \
   || t_ok "a probe logs no fallback pick"
@@ -9279,7 +9279,7 @@ else
 fi
 # ...and the auto-resume watcher, unit by unit: classifiers, argv sanitizer, relaunch
 # files, budgets, tmux commands and a fake-runner walk through every stop/relaunch branch.
-if python3 -m unittest discover -s "$REPO_DIR/tests" -p 'test_autoresume.py'; then
+if python3 -m unittest discover -s "$REPO_DIR/tests" -p 'test_autoresume*.py'; then
   t_ok "auto-resume watcher unit suite"
 else
   t_fail "auto-resume watcher unit suite" "see unittest output above"

package/tests/test_autoresume_fallback.py

@@ -0,0 +1,134 @@
+#!/usr/bin/env python3
+"""Quota fallback regressions using disposable pools and simulated processes only."""
+
+import signal
+import unittest
+
+import test_autoresume as fixtures
+
+
+class QuotaFallbackTests(unittest.TestCase):
+    def scenario(self, provider):
+        case_type = fixtures.PoolCase if provider == "claude" else fixtures.CodexWatcherTests
+        case = case_type()
+        case.setUp()
+        self.addCleanup(case.tearDown)
+        reset = int(case.t0) + 7200
+        previous = "acct-03:%d" % (reset + 100)
+        if provider == "claude":
+            state = case.write_state(["--dangerously-skip-permissions"], avoid=previous)
+            case.registry()
+            path = case.transcript([fixtures.cc_quota(case.t0, resets=reset)])
+        else:
+            state = case.write_state(["--yolo", "resume", fixtures.CX_SID],
+                                     provider=provider, avoid=previous)
+            path = case.rollout([
+                fixtures.cx_meta(case.launched, cwd=str(case.work)),
+                fixtures.cx_tokens(case.t0, primary={"used_percent": 100,
+                    "window_minutes": 300, "resets_at": reset}),
+                fixtures.cx_error(case.t0, "usage_limit_exceeded")])
+        watcher, runner = case.watcher(state)
+        runner.probe_out = "pick=acct-02 tier=soft\n"
+        runner.at(case.t0 + 1500, lambda: runner.exit(case.PID))
+        return case, watcher, runner, path
+
+    def assert_rotation(self, case, watcher, runner, provider):
+        self.assertEqual(runner.signals, [(case.PID, signal.SIGTERM)])
+        case.assert_sequence(runner, provider)
+        fields, argv = case.relaunch_of(runner)
+        reset = int(case.t0) + 7200
+        avoid = "acct-01:%d,acct-03:%d" % (reset, reset + 100)
+        sid = fixtures.SID if provider == "claude" else fixtures.CX_SID
+        expected = ["--dangerously-skip-permissions", "--resume", sid] if provider == "claude" \
+            else ["resume", "--yolo", sid]
+        self.assertEqual(argv, expected + [fixtures.ar.resume_prompt("quota")])
+        self.assertEqual((fields["provider"], fields["class"], fields["acct"], fields["sid"]),
+                         (provider, "quota", "acct-01", sid))
+        self.assertEqual((fields["cwd"], fields["reset"], fields["depth"], fields["avoid"]),
+                         (str(case.work), str(reset), "1", avoid))
+        self.assertEqual(fields["rtype"], "five_hour" if provider == "claude" else "")
+        self.assertEqual(runner.probes[-1]["env"][provider.upper() + "_MULTIACC_AR_AVOID"], avoid)
+        self.assertIsNotNone(watcher.tracker.pending)
+        self.assertIn("probe=acct-02", case.log_lines()[-1])
+
+    def test_quota_uses_other_soft_account_for_both_providers(self):
+        for provider in ("claude", "codex"):
+            with self.subTest(provider=provider):
+                case, watcher, runner, _ = self.scenario(provider)
+                self.assertEqual(watcher.run(), 0)
+                self.assert_rotation(case, watcher, runner, provider)
+                self.assertEqual(len(runner.probes), 1)
+                self.assertEqual(case.events(), ["watch", "detect", "switch"])
+
+    def test_hard_same_account_and_missing_candidates_hold(self):
+        replies = ("pick=acct-02 tier=hard", "pick=acct-01 tier=soft",
+                   "pick=acct-01 tier=eligible", "pick= tier=none", "pick= tier=soft")
+        for provider in ("claude", "codex"):
+            for reply in replies:
+                with self.subTest(provider=provider, reply=reply):
+                    case, watcher, runner, _ = self.scenario(provider)
+                    runner.probe_out = reply + "\n"
+                    runner.at(case.t0 + 15, lambda: runner.exit(case.PID))
+                    self.assertEqual(watcher.run(), 0)
+                    self.assertEqual(len(runner.probes), 1)
+                    self.assertEqual((runner.signals, runner.sends, case.relaunch_files()), ([], [], []))
+                    self.assertEqual(case.events(), ["watch", "detect", "hold"])
+
+    def test_other_rotation_classes_keep_the_eligible_requirement(self):
+        for cls in ("auth", "blocked", "model"):
+            with self.subTest(error_class=cls):
+                self.assertFalse(fixtures.ar.probe_allows(cls, "acct-02", "soft", "acct-01"))
+                self.assertFalse(fixtures.ar.probe_allows(cls, "acct-02", "hard", "acct-01"))
+                self.assertTrue(fixtures.ar.probe_allows(cls, "acct-02", "eligible", "acct-01"))
+
+    def test_user_input_during_soft_probe_cancels_rotation(self):
+        for provider in ("claude", "codex"):
+            with self.subTest(provider=provider):
+                case, watcher, runner, path = self.scenario(provider)
+                record = fixtures.cc_user(case.t0 + 5, "stop, I will continue manually") \
+                    if provider == "claude" else fixtures.cx_event(case.t0 + 5,
+                        {"type": "user_message", "message": "stop, I will continue manually"})
+                original_run = runner.run
+
+                def run(argv, timeout, env=None, cwd=None):
+                    if argv[0] == case.self_path and not runner.probes:
+                        fixtures.append(path, [record])
+                    return original_run(argv, timeout, env=env, cwd=cwd)
+
+                runner.run = run
+                registry = case.root / "acct-01" / "sessions" / ("%d.json" % case.PID)
+                if provider == "claude":
+                    runner.at(case.t0 + 15, registry.unlink)
+                runner.at(case.t0 + 15, lambda: runner.exit(case.PID))
+                self.assertEqual(watcher.run(), 0)
+                self.assertEqual(len(runner.probes), 1)
+                self.assertIsNone(watcher.tracker.pending)
+                self.assertEqual((runner.signals, runner.sends, case.relaunch_files()), ([], [], []))
+
+    def test_prolonged_hold_reprobes_and_recovers_when_soft_capacity_returns(self):
+        for provider in ("claude", "codex"):
+            with self.subTest(provider=provider):
+                case, watcher, runner, _ = self.scenario(provider)
+                runner.probe_out = "pick=acct-02 tier=hard\n"
+                runner.at(case.t0 + 600,
+                          lambda: setattr(runner, "probe_out", "pick=acct-02 tier=soft\n"))
+                self.assertEqual(watcher.run(), 0)
+                self.assert_rotation(case, watcher, runner, provider)
+                self.assertEqual([round(probe["t"] - case.t0) for probe in runner.probes],
+                                 list(range(5, 606, 60)))
+                self.assertEqual(case.events(), ["watch", "detect", "hold", "switch"])
+
+    def test_soft_capacity_does_not_bypass_rotation_budget(self):
+        for provider in ("claude", "codex"):
+            with self.subTest(provider=provider):
+                case, watcher, runner, _ = self.scenario(provider)
+                watcher.st["hist"] = ",".join("quota:%d" % (case.t0 - offset) for offset in range(8))
+                runner.at(case.t0 + 15, lambda: runner.exit(case.PID))
+                self.assertEqual(watcher.run(), 0)
+                self.assertEqual((runner.probes, runner.signals, runner.sends), ([], [], []))
+                self.assertEqual(case.relaunch_files(), [])
+                self.assertIn("reason=rotate-budget", case.log_lines()[-1])
+
+
+if __name__ == "__main__":
+    unittest.main()

package/tests/test_autoresume_probe.py

@@ -0,0 +1,119 @@
+"""Real shim probes distinguish remaining quota from accounts this chain rejected.
+
+Every account, credential and provider executable is synthetic and local to a
+temporary HOME. Probe mode must never launch the provider or poll its network.
+"""
+
+import json
+import os
+from pathlib import Path
+import subprocess
+import tempfile
+import time
+import unittest
+
+
+REPO = Path(__file__).resolve().parents[1]
+
+
+class AutoresumeProbeTests(unittest.TestCase):
+    def setUp(self):
+        work = tempfile.TemporaryDirectory(prefix="multiacc-ar-probe-")
+        self.addCleanup(work.cleanup)
+        self.home = Path(work.name)
+        self.now = int(time.time())
+        self.fakebin = self.home / "bin"
+        self.fakebin.mkdir()
+        self.env = {k: v for k, v in os.environ.items()
+                    if not k.startswith(("CLAUDE_", "CODEX_", "ANTHROPIC_", "OPENAI_"))
+                    and k not in ("TMUX", "TMUX_PANE")}
+        self.env.update(HOME=str(self.home), PATH=f"{self.fakebin}:{os.environ['PATH']}",
+                        PYTHONDONTWRITEBYTECODE="1")
+        for name in ("claude", "codex", "security", "curl"):
+            script = self.fakebin / name
+            script.write_text('#!/bin/sh\nprintf "%s\\n" "$0" >> "$HOME/unexpected-calls"\nexit 79\n')
+            script.chmod(0o755)
+        for provider in ("claude", "codex"):
+            root = self.home / provider
+            root.mkdir()
+            up = provider.upper()
+            self.env[up + "_ACCOUNTS_ROOT"] = str(root)
+            for key in ("KEYCHAIN", "MCP", "AUTORESUME", "AUTO_RESET", "CLIENT_LIMITS", "PATH_PROBE"):
+                self.env[up + "_MULTIACC_" + key] = "0"
+            self.env[up + "_MULTIACC_NO_SYNC"] = "1"
+            self.env[up + "_MULTIACC_NO_DISTRIBUTE"] = "1"
+            self.env[up + "_MULTIACC_HEADROOM_BAND"] = "0"
+            accounts = [{"id": f"acct-{i:02}", "email": f"fixture-{i}@example.invalid", "home": "mac"}
+                        for i in range(1, 4)]
+            (root / "accounts.json").write_text(json.dumps({
+                "version": 1, "server": "none", "threshold": 90, "accounts": accounts}))
+            for account, used in zip(accounts, (90, 96, 99)):
+                self.seed_account(provider, account["id"], used)
+
+    def seed_account(self, provider, account, used, reason="limits"):
+        path = self.home / provider / account
+        path.mkdir(exist_ok=True)
+        if provider == "claude":
+            credential = {"claudeAiOauth": {"accessToken": "synthetic", "refreshToken": "synthetic",
+                          "expiresAt": (self.now + 86400) * 1000}}
+            filename = ".credentials.json"
+        else:
+            credential = {"tokens": {"access_token": "synthetic", "refresh_token": "synthetic"}}
+            filename = "auth.json"
+        (path / filename).write_text(json.dumps(credential))
+        (path / "limits.json").write_text(json.dumps({
+            "fetched_at": self.now, "weekly_percent": used, "session_percent": 0,
+            "max_percent": used, "weekly_resets_epoch": self.now + 86400, "buckets": []}))
+        marked = time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime(self.now))
+        (path / ".limited").write_text(f"{self.now + 86400}\n"
+            f"bucket=weekly_all percent={used} marked_at={marked} reason={reason}\n")
+
+    def probe(self, provider, avoid=""):
+        up = provider.upper()
+        env = {**self.env, up + "_MULTIACC_AR_PROBE": "1", up + "_MULTIACC_AR_AVOID": avoid}
+        result = subprocess.run([str(REPO / "bin" / provider)], env=env, cwd=self.home,
+                                capture_output=True, text=True, input="", timeout=30)
+        self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
+        self.assertFalse((self.home / "unexpected-calls").exists(), result.stderr)
+        fields = dict(field.split("=", 1) for field in result.stdout.split())
+        return fields["pick"], fields["tier"]
+
+    def test_remaining_quota_is_soft_and_strictly_ranked(self):
+        for provider in ("claude", "codex"):
+            with self.subTest(provider=provider):
+                self.assertEqual(self.probe(provider), ("acct-01", "soft"))
+
+    def test_current_and_previous_chain_accounts_cannot_win_soft_fallback(self):
+        for provider in ("claude", "codex"):
+            with self.subTest(provider=provider):
+                avoid = f"acct-01:{self.now + 3600}"
+                self.assertEqual(self.probe(provider, avoid), ("acct-02", "soft"))
+                avoid += f",acct-02:{self.now + 3600}"
+                self.assertEqual(self.probe(provider, avoid), ("acct-03", "soft"))
+
+    def test_all_avoided_accounts_cannot_be_reported_as_usable(self):
+        avoid = ",".join(f"acct-{i:02}:{self.now + 3600}" for i in range(1, 4))
+        for provider in ("claude", "codex"):
+            with self.subTest(provider=provider):
+                self.assertEqual(self.probe(provider, avoid)[1], "hard")
+
+    def test_expired_avoidance_restores_remaining_quota(self):
+        for provider in ("claude", "codex"):
+            with self.subTest(provider=provider):
+                self.assertEqual(self.probe(provider, f"acct-01:{self.now - 1}"), ("acct-01", "soft"))
+
+    def test_rejected_and_exhausted_accounts_remain_hard(self):
+        for provider in ("claude", "codex"):
+            for reason, used in (("client-rate-limit", 90), ("error-cooldown", 90), ("limits", 100)):
+                with self.subTest(provider=provider, reason=reason):
+                    self.seed_account(provider, "acct-01", used, reason)
+                    self.assertEqual(self.probe(provider), ("acct-02", "soft"))
+                    for account in ("acct-02", "acct-03"):
+                        self.seed_account(provider, account, used, reason)
+                    self.assertEqual(self.probe(provider)[1], "hard")
+                    self.seed_account(provider, "acct-02", 96)
+                    self.seed_account(provider, "acct-03", 99)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/tests/test_selector_spread.py

@@ -0,0 +1,65 @@
+"""Unknown quota must not turn a launch burst into a fixed-identity preference."""
+
+from collections import Counter
+import unittest
+
+from test_selector import _candidate, _request
+from selector_policy import select
+
+
+class UnknownQuotaSpreadTests(unittest.TestCase):
+    def test_unknown_and_partial_quota_spread_across_accounts_and_providers(self):
+        for weekly, session in ((None, None), (0, None), (None, 0)):
+            with self.subTest(weekly=weekly, session=session):
+                pool = [_candidate(engine=engine, account_id=f"acct-{index:02d}",
+                                   weekly_pct=weekly, session_pct=session)
+                        for engine in ("claude", "codex") for index in range(4)]
+                counts = Counter()
+                for index in range(120):
+                    response = select(_request(pool, reservation_key=f"burst-{index}"))
+                    self.assertTrue(response["ok"])
+                    self.assertIsNone(response["band_floor"])
+                    self.assertEqual(response["session_ok_count"], 0)
+                    counts[(response["engine"], response["account_id"])] += 1
+                self.assertEqual(len(counts), len(pool), counts)
+                self.assertLess(max(counts.values()), 40, counts)
+
+    def test_equal_history_spreads_same_account_id_across_runner_identities(self):
+        pool = [_candidate(runner_id=index, engine="codex", account_id="acct-01",
+                           weekly_pct=None, session_pct=None,
+                           reservation_history={"active_expires_at": None,
+                                                "last_selected_at": "2026-08-25T08:00:00Z"})
+                for index in range(1, 9)]
+        counts = Counter(select(_request(pool, reservation_key=f"burst-{index}"))["runner_id"]
+                         for index in range(120))
+        self.assertEqual(len(counts), len(pool), counts)
+        self.assertLess(max(counts.values()), 40, counts)
+
+    def test_unknown_quota_preserves_lru_and_active_reservation_exclusion(self):
+        pool = [_candidate(account_id=name, weekly_pct=None, session_pct=None,
+                           reservation_history={"active_expires_at": expiry,
+                                                "last_selected_at": last})
+                for name, expiry, last in (
+                    ("reserved", "2026-08-25T09:10:00Z", None),
+                    ("unused", None, None),
+                    ("old", None, "2026-08-25T08:00:00Z"),
+                    ("recent", None, "2026-08-25T08:50:00Z"))]
+        for index in range(20):
+            response = select(_request(pool, reservation_key=f"burst-{index}"))
+            self.assertEqual(response["account_id"], "unused")
+            self.assertEqual(response["eligible_count"], 3)
+        for index in range(20):
+            response = select(_request(pool[2:], reservation_key=f"burst-{index}"))
+            self.assertEqual(response["account_id"], "old")
+
+    def test_unknown_quota_remains_deterministic_and_input_order_independent(self):
+        pool = [_candidate(account_id=f"acct-{index:02d}", weekly_pct=None, session_pct=None)
+                for index in range(8)]
+        response = select(_request(pool, reservation_key="stable"))
+        self.assertEqual(response, select(_request(pool, reservation_key="stable")))
+        reversed_response = select(_request(list(reversed(pool)), reservation_key="stable"))
+        self.assertEqual(response["account_id"], reversed_response["account_id"])
+
+
+if __name__ == "__main__":
+    unittest.main()