claude-multiacc 2.0.58 → 2.0.60

package/tests/run-tests.sh

@@ -49,6 +49,18 @@ mkdir -p "$ACC/tmp" "$FAKEBIN"
 cat > "$FAKEBIN/claude" <<'EOF'
 #!/usr/bin/env bash
 # fake real claude for tests (not a multiacc shim)
+# Global options may precede the subcommand, as commander allows (the operator's alias
+# `claude --dangerously-skip-permissions`, the shim's own `--model X`): the mcp stand-in
+# skips the two the suite types, and nothing else — `--resume mcp add x` is no mcp run.
+_fa=("$@")
+while [ "${#_fa[@]}" -gt 0 ]; do
+  case "${_fa[0]}" in
+    --dangerously-skip-permissions) _fa=("${_fa[@]:1}") ;;
+    --model) _fa=("${_fa[@]:2}") ;;
+    *) break ;;
+  esac
+done
+if [ "${_fa[0]:-}" = "mcp" ] && [ "${_fa[0]:-}" != "${1:-}" ]; then set -- "${_fa[@]}"; fi
 if [ "${1:-}" = "mcp" ] && [ -n "${CLAUDE_CONFIG_DIR:-}" ]; then
   # A stand-in for the real `claude mcp add|add-json|remove`: `-s user` edits the
   # config dir's .claude.json mcpServers, the default `local` scope edits
@@ -186,6 +198,10 @@ if [ -n "${FAKE_TUI:-}" ] && [ -n "${CLAUDE_CONFIG_DIR:-}" ]; then
   # exits 143, and a crash (SIGKILL) leaves the registry behind. The scripted error only
   # fires on a fresh launch; a `--resume <sid>` launch appends what the real client does
   # after the auto-resume prompt — a normal reply — unless FAKE_TUI_QUIET is set.
+  # FAKE_TMUX_SCREEN is the pane's screen (the fake tmux's capture-pane prints it): every
+  # launch draws its own, and FAKE_TUI=memory puts the client's critical-memory banner in
+  # its footer. FAKE_TUI_IGNORE_TERM=1 is a client that SIGTERM does not stop (only KILL).
+  [ -n "${FAKE_TMUX_SCREEN:-}" ] && : > "$FAKE_TMUX_SCREEN"
   acct="$(basename "$CLAUDE_CONFIG_DIR")"
   sid=""; prev=""
   for a in "$@"; do
@@ -212,7 +228,11 @@ if [ -n "${FAKE_TUI:-}" ] && [ -n "${CLAUDE_CONFIG_DIR:-}" ]; then
   reg="$CLAUDE_CONFIG_DIR/sessions/$$.json"
   printf '{"pid":%s,"sessionId":"%s","cwd":"%s","kind":"interactive","status":"busy","startedAt":%s000}\n' \
     "$$" "$sid" "$PWD" "$(date +%s)" > "$reg"
-  trap 'rm -f "$reg"; exit 143' TERM
+  if [ -n "${FAKE_TUI_IGNORE_TERM:-}" ]; then
+    trap '' TERM
+  else
+    trap 'rm -f "$reg"; exit 143' TERM
+  fi
   trap 'rm -f "$reg"; exit 129' HUP
   if [ "$resumed" = 0 ]; then
     sleep "${FAKE_TUI_DELAY:-0.3}"
@@ -221,6 +241,14 @@ if [ -n "${FAKE_TUI:-}" ] && [ -n "${CLAUDE_CONFIG_DIR:-}" ]; then
       auth) apierr authentication_failed ;;
       invalid) apierr invalid_request ;;
       crash) sleep 0.3; kill -9 $$ ;;
+      memory)
+        printf '{"type":"assistant","timestamp":"%s","isSidechain":false,"sessionId":"%s","message":{"model":"claude-opus-5-5","content":[{"type":"text","text":"Started the workflows."}]}}\n' \
+          "$(ts)" "$sid" >> "$tr"
+        # the prompt's row as 2.1.304 draws it: the mode indicator, then a no-break space
+        rule="────────────────────────────────────────────────────────────"
+        printf '%s\n' "⏺ Started the workflows." "" "$rule" "❯$(printf '\302\240')" "$rule" \
+          "  ⏵⏵ bypass permissions on    Critical memory usage (8.3GB) — restart and resume with claude --continue, or run /compact" \
+          > "${FAKE_TMUX_SCREEN:-/dev/null}" ;;
     esac
   fi
   # Bounded, in short sleeps so a TERM is handled within a tenth of a second.
@@ -254,11 +282,14 @@ case "${CLAUDE_CODE_OAUTH_TOKEN:-}" in
 esac
 if [ -n "${FAKE_KEYCHAIN_CLIENT:-}" ] && [ -n "${CLAUDE_CONFIG_DIR:-}" ] \
   && [ -z "${CLAUDE_CODE_OAUTH_TOKEN:-}" ]; then
-  # The real macOS client's login lookup: the Keychain item under its FA() name ONLY
-  # ($USER; Bun's "unknown" without it), then .credentials.json — nothing else.
+  # The real macOS client's login lookup (2.1.303): the document in the Keychain item
+  # under its FA() name ONLY ($USER; Bun's "unknown" without it) when it can read one,
+  # else .credentials.json — nothing else — and that document is a login only when it
+  # carries claudeAiOauth: MCP OAuth state alone (mcpOAuth) is "Not logged in".
   h="$(printf '%s' "$CLAUDE_CONFIG_DIR" | { shasum -a 256 2>/dev/null || sha256sum; } | cut -c1-8)"
-  if ! security find-generic-password -a "${USER:-unknown}" -s "Claude Code-credentials-$h" -w >/dev/null 2>&1 \
-    && [ ! -f "$CLAUDE_CONFIG_DIR/.credentials.json" ]; then
+  doc="$(security find-generic-password -a "${USER:-unknown}" -s "Claude Code-credentials-$h" -w 2>/dev/null)" \
+    || doc="$(cat "$CLAUDE_CONFIG_DIR/.credentials.json" 2>/dev/null)"
+  if ! printf '%s' "$doc" | grep -Eq '"claudeAiOauth"[[:space:]]*:[[:space:]]*[{]'; then
     echo "Not logged in · Please run /login" >&2
     exit 1
   fi
@@ -341,7 +372,15 @@ if [ -n "${FAKE_SESSION_ID:-}" ] && [ -n "${CLAUDE_CONFIG_DIR:-}" ]; then
       "$(date -u +%Y-%m-%dT%H:%M:%S.000Z)" "$FAKE_LIMIT_RESET" "$FAKE_SESSION_ID" \
       >> "$CLAUDE_CONFIG_DIR/projects/-proj/$FAKE_SESSION_ID.jsonl"
   fi
-  sleep "${FAKE_SESSION_HOLD:-4}"
+  if [ -n "${FAKE_SESSION_UNTIL:-}" ]; then
+    # held until the test says so (a loaded machine runs the steps slower than any timer)
+    fake_n=0
+    while [ ! -e "$FAKE_SESSION_UNTIL" ] && [ "$fake_n" -lt $(( ${FAKE_SESSION_HOLD:-4} * 10 )) ]; do
+      sleep 0.1; fake_n=$((fake_n + 1))
+    done
+  else
+    sleep "${FAKE_SESSION_HOLD:-4}"
+  fi
   rm -f "$CLAUDE_CONFIG_DIR/sessions/$$.json"
 fi
 # what an interactive client would inherit from the shim (auto-resume must leak nothing)
@@ -363,8 +402,12 @@ chmod +x "$FAKEBIN/security"
 
 export PATH="$REPO_DIR/bin:$FAKEBIN:$PATH"
 export FAKE_CTL="$WORK/ctl"
-# Neutralize any ambient state from the invoking environment.
-unset CLAUDE_CONFIG_DIR CLAUDE_CODE_OAUTH_TOKEN CLAUDE_ACCOUNT CLAUDE_SHIM_ACTIVE 2>/dev/null || true
+# Neutralize any ambient state from the invoking environment. A pooled session exports
+# its pool roots and config dir to every child: run from inside one, the suite's shim
+# calls resolved the REAL pools (2026-10-14: a sandbox test printed a live OAuth token),
+# so the roots go too — every test that needs one sets it explicitly.
+unset CLAUDE_CONFIG_DIR CLAUDE_CODE_OAUTH_TOKEN CLAUDE_ACCOUNT CLAUDE_SHIM_ACTIVE \
+  CLAUDE_ACCOUNTS_ROOT CODEX_ACCOUNTS_ROOT CODEX_HOME CODEX_ACCOUNT CODEX_SHIM_ACTIVE 2>/dev/null || true
 export CLAUDE_MULTIACC_NO_SYNC=1
 # Fixtures are local file:// URLs with no rate limit, so the anti-429 fetch throttle
 # is off by default here; the throttle test re-enables it explicitly.
@@ -379,12 +422,14 @@ export CLAUDE_MULTIACC_TOKEN_URL="file://$WORK/token-endpoint-missing.json"
 # Same for the usage endpoint: the SHIM's opportunistic background `limits --quiet`
 # kick inherits this default, so it can never reach a real endpoint from tests
 # (every explicit limits test overrides the URL inline). The pre-armed .limits-kick
-# throttle keeps those background kicks from racing explicit limits runs.
+# throttle keeps those background kicks from racing explicit limits runs: armed in the
+# FUTURE, since a throttle armed "now" lapses after 10 minutes, and on a loaded machine a pool
+# outlives that (a kicked pass then held the lock and left a backoff behind).
 export CLAUDE_MULTIACC_USAGE_URL="file://$WORK/usage-endpoint-missing.json"
 # Organization checks must never send synthetic tokens to a real provider. The
 # dedicated identity suite overrides this with its loopback HTTP contract server.
 export CLAUDE_MULTIACC_TOKEN_IDENTITY_URL="file://$WORK/identity-endpoint-missing.json"
-: > "$ACC/.limits-kick"
+touch -t 203001010000 "$ACC/.limits-kick"
 # Keychain lookups are OFF for the legacy sections (their pools are file-based and the
 # extra `security` process per account would only slow them down); section 17 turns
 # them on explicitly against the fake `security` above.
@@ -399,6 +444,17 @@ export CLAUDE_MULTIACC_PATH_PROBE=0
 # tmux — a watcher here would otherwise type into the developer's REAL pane.
 export CLAUDE_MULTIACC_AUTORESUME=0 CODEX_MULTIACC_AUTORESUME=0
 unset TMUX TMUX_PANE 2>/dev/null || true
+# The model catalog refresh (lib/model_catalog.py) writes <pool>/model-catalog.json: every
+# limits pass for its own pool, the verb and self-update for BOTH. Until the codex section the
+# suite has no codex root, so the claude side's "other pool" is the operator's real one. Off
+# everywhere; section 19a turns it on against its own roots (and the limits-pass backstop is
+# exercised with the switch on in tests/test_autoresume_catalog_cli.py).
+export CLAUDE_MULTIACC_MODEL_CATALOG=0 CODEX_MULTIACC_MODEL_CATALOG=0
+# MCP adoption (lib/mcp_registry.py adopt) would take whatever the operator's real
+# ~/.claude.json names — seeding copies it into every test account, this HOME being the
+# operator's — into the test pool's registry. tests/test_mcp_registry.py covers adoption in
+# disposable pools.
+export CLAUDE_MULTIACC_MCP_ADOPT=0 CODEX_MULTIACC_MCP_ADOPT=0
 
 now="$(date +%s)"
 
@@ -1188,6 +1244,451 @@ check "a model 404 reaches the caller as it is" "not available on your firstPart
   || t_fail "model 404 park" "$(tail -1 "$ACC/acct-01/.expired")"
 rm -f "$FAKE_CTL" "$ACC"/acct-*/limits.json "$ACC"/acct-*/.limited "$ACC"/acct-*/.expired
 
+# ---- 9g. a credentials file holding only MCP state is NO login --------------------------
+# Claude Code 2.1.303 keeps the OAuth state of the MCP servers an account signed into
+# (mcpOAuth, every entry with its own expiresAt and refreshToken) in the same document as
+# the login, and from a session that cannot open the Keychain (ssh/tmux) it writes a
+# .credentials.json holding ONLY that. Counted as the login, such accounts were picked
+# with no token exported, so every run said "Not logged in · Run /login" (2026-10-19):
+# the greedy expiry scrape read the MCP entry's future expiresAt as the login's. Own pool
+# root; FAKE_KEYCHAIN_CLIENT makes the fake client refuse a run with no login at all.
+MOP="$WORK/mcponly"
+MOP_HOME=mac; [ "$(uname -s)" = "Darwin" ] || MOP_HOME=server
+mkdir -p "$MOP/tmp" "$MOP/acct-01" "$MOP/acct-02"
+: > "$MOP/.limits-kick"
+cat > "$MOP/accounts.json" <<EOF
+{ "version": 1, "server": "root@203.0.113.1", "server_root": "/root/.claude-accounts",
+  "server_repo": "/root/claude-multiacc", "threshold": 90,
+  "accounts": [
+    {"id": "acct-01", "email": "mtok@test", "home": "$MOP_HOME", "added_at": "2026-10-19T00:00:00Z"},
+    {"id": "acct-02", "email": "mnone@test", "home": "$MOP_HOME", "added_at": "2026-10-19T00:00:00Z"}
+  ] }
+EOF
+MCP_KEY='higgsfield|0123456789abcdef'
+MCP_ENTRY='"higgsfield|0123456789abcdef":{"serverName":"higgsfield","serverUrl":"https://mcp.higgsfield.ai/mcp","accessToken":"mcp-access-higgsfield","refreshToken":"mcp-refresh-higgsfield","expiresAt":9999999999999,"scope":"openid","issuer":"https://clerk.higgsfield.ai","clientId":"https://claude.ai/oauth/claude-code-client-metadata","redirectUri":"http://localhost:1/callback","discoveryState":{"authorizationServerUrl":"https://clerk.higgsfield.ai","oauthMetadataFound":true}}'
+MCP_ONLY="{\"mcpOAuth\":{$MCP_ENTRY}}"
+MOP_TOK='sk-ant-oat01-MCPONLYTOKENMCPONLYTOKENMCPONLYTOKENMCPONLY01'
+printf '%s' "$MCP_ONLY" > "$MOP/acct-01/.credentials.json"
+printf '%s' "$MCP_ONLY" > "$MOP/acct-02/.credentials.json"
+printf '%s' "$MOP_TOK" > "$MOP/acct-01/server.token"
+ok1=1
+for _ in $(seq 1 10); do
+  out="$(CLAUDE_ACCOUNTS_DIR="$MOP" FAKE_KEYCHAIN_CLIENT=1 claude 2>&1)"
+  case "$out" in *"CFG=acct-01 TOK=$MOP_TOK"*) ;; *) ok1=0; break ;; esac
+done
+[ "$ok1" = 1 ] && t_ok "an MCP-only credentials file leaves the account to its token, which is exported" \
+  || t_fail "MCP-only file + token" "got: $(printf '%s' "$out" | head -c 160)"
+mv "$MOP/acct-01/server.token" "$WORK/mcponly-token.aside"
+out="$(CLAUDE_ACCOUNTS_DIR="$MOP" claude 2>&1)"
+check "with no token and no Keychain login, an MCP-only account is not selectable" "CFG=none" "$out"
+mv "$WORK/mcponly-token.aside" "$MOP/acct-01/server.token"
+# A DEAD login beside a live MCP entry is dead, in either key order: the scrape reads the
+# login object alone, never the entry's expiresAt or refreshToken.
+for order in login-first mcp-first; do
+  if [ "$order" = login-first ]; then
+    printf '{"claudeAiOauth":{"accessToken":"sk-ant-oat01-expired","expiresAt":1000000000000,"scopes":["user:inference"]},"mcpOAuth":{%s}}' \
+      "$MCP_ENTRY" > "$MOP/acct-01/.credentials.json"
+  else
+    printf '{"mcpOAuth":{%s},"claudeAiOauth":{"accessToken":"sk-ant-oat01-expired","expiresAt":1000000000000}}' \
+      "$MCP_ENTRY" > "$MOP/acct-01/.credentials.json"
+  fi
+  out="$(CLAUDE_ACCOUNTS_DIR="$MOP" claude 2>&1)"
+  check "a dead login beside a live MCP entry is dead ($order): the token is exported" \
+    "CFG=acct-01 TOK=$MOP_TOK" "$out"
+done
+mv "$MOP/acct-01/server.token" "$WORK/mcponly-token.aside"
+out="$(CLAUDE_ACCOUNTS_DIR="$MOP" claude 2>&1)"
+check "...and with no token it is not selected" "CFG=none" "$out"
+grep -q "skipped-expired: acct-01" "$MOP/selection.log" 2>/dev/null \
+  && t_ok "...but listed as a dead login (skipped-expired)" \
+  || t_fail "dead login beside MCP state" "no skipped-expired line for acct-01"
+out="$(CLAUDE_ACCOUNTS_DIR="$MOP" claude-accounts list 2>&1)"
+check "list flags the dead login beside MCP state" "EXPIRED-LOGIN" "$(printf '%s\n' "$out" | grep '^acct-01')"
+mv "$WORK/mcponly-token.aside" "$MOP/acct-01/server.token"
+# A credential park heals on a newer LOGIN; an MCP-only rewrite (the client saves one on
+# every MCP token refresh) is no such evidence.
+printf '%s' "$MCP_ONLY" > "$MOP/acct-01/.credentials.json"
+printf '%s\nreason=auth-error marked_at=t detail=test\n' "$now" > "$MOP/acct-01/.expired"
+touch -t 202001010101 "$MOP/acct-01/server.token"         # the token is OLDER than the park
+touch -t 202001010202 "$MOP/acct-01/.expired"
+touch "$MOP/acct-01/.credentials.json"                     # MCP state rewritten after it
+out="$(CLAUDE_ACCOUNTS_DIR="$MOP" claude 2>&1)"
+check "an MCP-only rewrite does not heal an auth park" "CFG=none" "$out"
+[ -f "$MOP/acct-01/.expired" ] && t_ok "...the park stays in force" \
+  || t_fail "MCP-only rewrite healed a park" ".expired was removed"
+out="$(CLAUDE_ACCOUNTS_DIR="$MOP" claude-accounts list 2>&1)"
+check "...for the audit too" "EXPIRED-LOGIN" "$(printf '%s\n' "$out" | grep '^acct-01')"
+printf '{"mcpOAuth":{%s},"claudeAiOauth":{"accessToken":"sk-ant-oat01-relogged","refreshToken":"r","expiresAt":9999999999999,"refreshTokenExpiresAt":9999999999999}}' \
+  "$MCP_ENTRY" > "$MOP/acct-01/.credentials.json"
+out="$(CLAUDE_ACCOUNTS_DIR="$MOP" FAKE_KEYCHAIN_CLIENT=1 claude 2>&1)"
+check "a login written after the park heals it, and runs on the login" "CFG=acct-01 TOK=none" "$out"
+[ ! -f "$MOP/acct-01/.expired" ] && t_ok "...and the park is gone" \
+  || t_fail "login write did not heal" ".expired survived a newer login"
+# list / list --json / verify: an MCP-only file is no oauth login anywhere.
+printf '%s' "$MCP_ONLY" > "$MOP/acct-01/.credentials.json"
+out="$(CLAUDE_ACCOUNTS_DIR="$MOP" claude-accounts list 2>&1)"
+line="$(printf '%s\n' "$out" | grep '^acct-01')"
+case "$line" in
+  *"auth=token "*) t_ok "list shows auth=token, not oauth+token, for an MCP-only file" ;;
+  *) t_fail "list auth column for an MCP-only file" "$line" ;;
+esac
+check "list calls the token-less MCP-only account NO-LOGIN" "auth=NONE" "$(printf '%s\n' "$out" | grep '^acct-02')"
+out="$(CLAUDE_ACCOUNTS_DIR="$MOP" claude-accounts list --json 2>&1)"
+python3 - "$out" <<'EOF'
+import json, sys
+rows = {a['id']: a for a in json.loads(sys.argv[1])['accounts']}
+a1, a2 = rows['acct-01'], rows['acct-02']
+assert a1['credentials']['oauth'] is False and a1['credentials']['oauth_store'] is None, a1['credentials']
+assert a1['credential_class'] == 'portable' and a1['selectable'] is True, a1
+assert a2['credentials']['oauth'] is False and a2['credential_class'] == 'none', a2
+assert a2['status'] == 'missing' and a2['needs_login'] is True, a2
+assert 'no Claude login' in a2['reason'], a2['reason']
+EOF
+[ $? -eq 0 ] && t_ok "list --json: an MCP-only file is no oauth login (token-backed: portable; else missing)" \
+  || t_fail "MCP-only list --json" "see assertions above"
+out="$(CLAUDE_ACCOUNTS_DIR="$MOP" FAKE_KEYCHAIN_CLIENT=1 claude-accounts verify 2>&1)"
+check "verify runs an MCP-only account on its token" "acct-01 mtok@test: PASS" "$out"
+check "verify skips an MCP-only account with nothing to authenticate by" \
+  "acct-02 mnone@test: SKIP (no auth on this machine)" "$out"
+[ ! -f "$MOP/acct-02/.expired" ] && t_ok "verify parks nothing over an MCP-only file" \
+  || t_fail "verify parked an MCP-only account" "$(tail -1 "$MOP/acct-02/.expired")"
+# limits: an MCP-only file is no login to refresh — never a dead grant to park — and the
+# pass leaves it byte-for-byte alone.
+cp "$MOP/acct-02/.credentials.json" "$WORK/mcponly-before.json"
+CLAUDE_ACCOUNTS_DIR="$MOP" claude-accounts limits --force >/dev/null 2>&1
+[ ! -f "$MOP/acct-02/.expired" ] && t_ok "limits never parks an MCP-only file as a dead grant" \
+  || t_fail "limits parked an MCP-only account" "$(tail -1 "$MOP/acct-02/.expired")"
+cmp -s "$WORK/mcponly-before.json" "$MOP/acct-02/.credentials.json" \
+  && t_ok "limits leaves the MCP state exactly as it was" \
+  || t_fail "limits rewrote an MCP-only file" "$(head -c 160 "$MOP/acct-02/.credentials.json")"
+# A refresh writes the login INTO the file as it is when it lands: the MCP token the client
+# saved while the grant was in flight survives (the endpoint stub saves one mid-flight).
+printf '{"claudeAiOauth":{"accessToken":"sk-ant-oat01-stale","refreshToken":"sk-ant-ort01-mcpkeep","expiresAt":1000,"refreshTokenExpiresAt":9999999999999},"mcpOAuth":{%s},"mcpOAuthClientConfig":{"%s":{"clientId":"cid-kept"}}}' \
+  "$MCP_ENTRY" "$MCP_KEY" > "$MOP/acct-02/.credentials.json"
+cat > "$WORK/mcp-token-server.py" <<'EOF'
+import http.server, json, os, sys
+target = sys.argv[1]
+class H(http.server.BaseHTTPRequestHandler):
+    def log_message(self, *a): pass
+    def do_POST(self):
+        try:
+            self.rfile.read(int(self.headers.get('Content-Length') or 0))
+        except Exception:
+            pass
+        doc = json.load(open(target))
+        doc['mcpOAuth']['higgsfield|0123456789abcdef']['refreshToken'] = 'mcp-refresh-SAVED-MIDFLIGHT'
+        with open(target + '.mid', 'w') as f:
+            json.dump(doc, f)
+        os.replace(target + '.mid', target)
+        raw = json.dumps({'access_token': 'sk-ant-oat01-mcprefreshed', 'refresh_token': 'sk-ant-ort01-mcprotated',
+                          'expires_in': 28800, 'refresh_token_expires_in': 2592000}).encode()
+        self.send_response(200)
+        self.send_header('Content-Type', 'application/json')
+        self.send_header('Content-Length', str(len(raw)))
+        self.end_headers()
+        self.wfile.write(raw)
+srv = http.server.HTTPServer(('127.0.0.1', 0), H)
+print(srv.server_address[1], flush=True)
+srv.serve_forever()
+EOF
+mport=""
+python3 "$WORK/mcp-token-server.py" "$MOP/acct-02/.credentials.json" > "$WORK/mcp-token-port" 2>/dev/null &
+msrv_pid=$!
+STUB_PIDS="$STUB_PIDS $msrv_pid"
+for _ in $(seq 1 20); do
+  mport="$(head -1 "$WORK/mcp-token-port" 2>/dev/null)"
+  case "$mport" in ''|*[!0-9]*) mport=""; sleep 0.2 ;; *) break ;; esac
+done
+if [ -z "$mport" ]; then
+  t_ok "mid-flight MCP save test skipped (cannot bind a loopback port here)"
+else
+  out="$(CLAUDE_ACCOUNTS_DIR="$MOP" CLAUDE_MULTIACC_TOKEN_URL="http://127.0.0.1:$mport/token" \
+    claude-accounts limits --force 2>&1)"
+  check "a login beside MCP state refreshes" "acct-02: oauth access token refreshed" "$out"
+  python3 - "$MOP/acct-02/.credentials.json" <<'EOF'
+import json, os, stat, sys
+doc = json.load(open(sys.argv[1]))
+o = doc['claudeAiOauth']
+assert o['accessToken'] == 'sk-ant-oat01-mcprefreshed' and o['refreshToken'] == 'sk-ant-ort01-mcprotated', 'login not rotated'
+entry = doc['mcpOAuth']['higgsfield|0123456789abcdef']
+assert entry['refreshToken'] == 'mcp-refresh-SAVED-MIDFLIGHT', 'the MCP token saved mid-flight was rolled back'
+assert entry['accessToken'] == 'mcp-access-higgsfield', entry
+assert doc['mcpOAuthClientConfig'] == {'higgsfield|0123456789abcdef': {'clientId': 'cid-kept'}}, doc
+assert stat.S_IMODE(os.stat(sys.argv[1]).st_mode) == 0o600
+EOF
+  [ $? -eq 0 ] && t_ok "the refresh writes the login INTO the file: MCP state saved mid-flight survives" \
+    || t_fail "refresh clobbered MCP state" "see assertions above"
+fi
+kill "$msrv_pid" 2>/dev/null; wait "$msrv_pid" 2>/dev/null || true
+# import --creds: the login lands INTO the account's file, and a file without one is refused.
+printf '%s' "$MCP_ONLY" > "$WORK/mcponly-import.json"
+out="$(CLAUDE_ACCOUNTS_DIR="$MOP" claude-accounts import mimp@test --id acct-03 --creds "$WORK/mcponly-import.json" --no-sync 2>&1)"; rc=$?
+[ "$rc" != 0 ] && [ ! -d "$MOP/acct-03" ] && t_ok "import refuses a credentials file holding no login" \
+  || t_fail "import of an MCP-only file" "rc=$rc: $(printf '%s' "$out" | head -c 160)"
+check "...and says why" "holds no Claude login" "$out"
+printf '%s' "$MCP_ONLY" > "$MOP/acct-01/.credentials.json"
+printf '{"claudeAiOauth":{"accessToken":"sk-ant-oat01-imported","refreshToken":"r","expiresAt":9999999999999,"refreshTokenExpiresAt":9999999999999}}' > "$WORK/login-import.json"
+out="$(CLAUDE_ACCOUNTS_DIR="$MOP" claude-accounts import mtok@test --id acct-01 --creds "$WORK/login-import.json" --no-sync 2>&1)"
+check "import updates an account whose file holds MCP state" "Imported acct-01" "$out"
+python3 - "$MOP/acct-01/.credentials.json" <<'EOF'
+import json, sys
+doc = json.load(open(sys.argv[1]))
+assert doc['claudeAiOauth']['accessToken'] == 'sk-ant-oat01-imported', doc
+assert doc['mcpOAuth']['higgsfield|0123456789abcdef']['refreshToken'] == 'mcp-refresh-higgsfield', doc
+EOF
+[ $? -eq 0 ] && t_ok "import writes the login INTO the file, keeping its MCP state" \
+  || t_fail "import clobbered MCP state" "see assertions above"
+# A transcript's auth failure is charged to the credential THAT run carried, never to the
+# one the account would get now. The pre-fix shim ran these accounts with no token at all
+# ("Not logged in"), so blaming their token for it parked a working token durably — and a
+# verify PASS could not stick: the very next run re-read the same record and re-parked it.
+printf '%s' "$MCP_ONLY" > "$MOP/acct-01/.credentials.json"
+printf '%s' "$MCP_ONLY" > "$MOP/acct-02/.credentials.json"   # acct-01 is the only candidate
+rm -f "$MOP"/acct-0*/.expired "$MOP"/acct-0*/.sessions-index "$MOP"/acct-0*/.client-org-cleared
+printf '%s\n' "$(printf '%s' "$MOP_TOK" | { shasum -a 256 2>/dev/null || sha256sum; } | cut -d ' ' -f1)" \
+  > "$MOP/acct-01/.server-token-verified"
+MSID="cafecafe-1111-4222-8333-444455556666"
+MSID2="cafecafe-7777-4888-8999-aaaabbbbcccc"
+mkdir -p "$MOP/acct-01/sessions" "$MOP/acct-01/projects/-proj"
+mop_iso() { date -u -r "$1" +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || date -u -d "@$1" +%Y-%m-%dT%H:%M:%SZ; }
+mop_auth() { # $1 session id, $2 epoch: the client's own authentication_failed record
+  printf '{"type":"assistant","isApiErrorMessage":true,"isSidechain":false,"error":"authentication_failed","timestamp":"%s","sessionId":"%s","message":{"content":[{"type":"text","text":"Not logged in · Please run /login"}]}}\n' \
+    "$(mop_iso "$2")" "$1" >> "$MOP/acct-01/projects/-proj/$1.jsonl"
+}
+mnow="$(date +%s)"
+printf '%s %s\n' "$MSID" "$(mop_iso $((mnow - 600)))" > "$MOP/acct-01/.sessions-index"
+mop_auth "$MSID" $((mnow - 300))
+out="$(CLAUDE_ACCOUNTS_DIR="$MOP" claude 2>&1)"
+check "an untagged run's auth failure takes the account out of the pool" "CFG=none" "$out"
+grep -q 'reason=auth-error' "$MOP/acct-01/.expired" 2>/dev/null \
+  && t_ok "...as the login's failure (auth-error), never the token's" \
+  || t_fail "untagged auth failure blamed the token" "$(tail -1 "$MOP/acct-01/.expired" 2>/dev/null)"
+[ -f "$MOP/acct-01/.server-token-verified" ] && t_ok "...and the token's proof survives it" \
+  || t_fail "untagged auth failure" "the token's .server-token-verified was dropped"
+out="$(CLAUDE_ACCOUNTS_DIR="$MOP" FAKE_KEYCHAIN_CLIENT=1 claude-accounts verify 2>&1)"
+check "verify passes the parked MCP-only account on its token" "acct-01 mtok@test: PASS" "$out"
+out="$(CLAUDE_ACCOUNTS_DIR="$MOP" claude 2>&1)"
+check "the PASS sticks: the record before it re-parks nothing, the token is exported" \
+  "CFG=acct-01 TOK=$MOP_TOK" "$out"
+[ ! -f "$MOP/acct-01/.expired" ] && t_ok "...and no park is left behind" \
+  || t_fail "verify PASS re-parked" "$(tail -1 "$MOP/acct-01/.expired")"
+# A run the shim launched on the token is tagged in the index, and ITS failure retires it.
+rm -f "$MOP/acct-01/.sessions-index"
+FAKE_SESSION_ID="$MSID2" FAKE_SESSION_HOLD=2 CLAUDE_ACCOUNTS_DIR="$MOP" claude >/dev/null 2>&1
+for _ in 1 2 3 4 5 6 7 8 9 10; do
+  grep -q -- "^$MSID2 .* token\$" "$MOP/acct-01/.sessions-index" 2>/dev/null && break
+  sleep 0.2
+done
+grep -q -- "^$MSID2 .* token\$" "$MOP/acct-01/.sessions-index" 2>/dev/null \
+  && t_ok "the shim tags the session of a run it launched on the portable token" \
+  || t_fail "token-run tag" "index: $(cat "$MOP/acct-01/.sessions-index" 2>/dev/null)"
+sleep 1                                   # a real failure postdates verify's watermark
+mop_auth "$MSID2" "$(date +%s)"
+out="$(CLAUDE_ACCOUNTS_DIR="$MOP" claude 2>&1)"
+grep -q 'reason=setup-token-invalid' "$MOP/acct-01/.expired" 2>/dev/null \
+  && t_ok "that run's auth failure parks the token (setup-token-invalid)" \
+  || t_fail "tagged auth failure" "$(tail -1 "$MOP/acct-01/.expired" 2>/dev/null)"
+[ ! -f "$MOP/acct-01/.server-token-verified" ] && t_ok "...and drops the token's proof" \
+  || t_fail "tagged auth failure" ".server-token-verified survived"
+# /clear (or /resume inside the TUI) has the SAME process run a new session id: 2.1.304
+# rewrites only the sessionId in sessions/<pid>.json, long after the capture's one look. The
+# shim keeps the credential by process (.sessions-via/<pid>, keyed by the registry's
+# startedAt), so any launch's refresh tags the new id too, and its auth failure retires the
+# token. Before, that id was sighted untagged: its failure parked the login (auth-error) of
+# an account with none, and kept the dead token's proof.
+rm -rf "$MOP/acct-01/.expired" "$MOP/acct-01/.sessions-index" "$MOP/acct-01/.sessions-via"
+printf '%s\n' "$(printf '%s' "$MOP_TOK" | { shasum -a 256 2>/dev/null || sha256sum; } | cut -d ' ' -f1)" \
+  > "$MOP/acct-01/.server-token-verified"
+MSID3="cafecafe-3333-4ccc-8ddd-eeeeffff0003"
+MSID4="cafecafe-4444-4ccc-8ddd-eeeeffff0004"
+rm -f "$WORK/mop-switch-done"
+FAKE_SESSION_ID="$MSID3" FAKE_SESSION_UNTIL="$WORK/mop-switch-done" FAKE_SESSION_HOLD=180 \
+  CLAUDE_ACCOUNTS_DIR="$MOP" claude >/dev/null 2>&1 &
+mswitch=$!
+for _ in $(seq 1 600); do
+  [ -f "$MOP/acct-01/.sessions-via/$mswitch" ] \
+    && grep -q -- "^$MSID3 .* token\$" "$MOP/acct-01/.sessions-index" 2>/dev/null && break
+  sleep 0.1
+done
+grep -q -- "^$MSID3 .* token\$" "$MOP/acct-01/.sessions-index" 2>/dev/null \
+  && t_ok "the run's first session is tagged by its capture" \
+  || t_fail "switch: first session tag" "index: $(cat "$MOP/acct-01/.sessions-index" 2>/dev/null)"
+[ -f "$MOP/acct-01/.sessions-via/$mswitch" ] \
+  && t_ok "...and its credential is on record by process (.sessions-via/<pid>)" \
+  || t_fail "switch: process record" "$(ls -a "$MOP/acct-01/.sessions-via" 2>&1 | tr '\n' ' ')"
+# What /clear does in 2.1.304: the same process and registry file, startedAt kept, a new
+# sessionId (and transcript), long after the capture is gone.
+mreg="$MOP/acct-01/sessions/$mswitch.json"
+sed "s/\"sessionId\":\"$MSID3\"/\"sessionId\":\"$MSID4\"/" "$mreg" > "$mreg.tmp" && mv -f "$mreg.tmp" "$mreg"
+printf '{"type":"mode","mode":"normal","sessionId":"%s"}\n' "$MSID4" \
+  > "$MOP/acct-01/projects/-proj/$MSID4.jsonl"
+CLAUDE_ACCOUNTS_DIR="$MOP" claude >/dev/null 2>&1     # any launch's refresh sights the new id
+grep -q -- "^$MSID4 .* token\$" "$MOP/acct-01/.sessions-index" 2>/dev/null \
+  && t_ok "a session the client switched the run to keeps the run's credential (token)" \
+  || t_fail "switch: switched-session tag" "index: $(cat "$MOP/acct-01/.sessions-index" 2>/dev/null)"
+mop_auth "$MSID4" "$(date +%s)"
+CLAUDE_ACCOUNTS_DIR="$MOP" claude >/dev/null 2>&1
+grep -q 'reason=setup-token-invalid' "$MOP/acct-01/.expired" 2>/dev/null \
+  && t_ok "...so its auth failure parks the token (setup-token-invalid)" \
+  || t_fail "switch: auth failure" "$(tail -1 "$MOP/acct-01/.expired" 2>/dev/null)"
+[ ! -f "$MOP/acct-01/.server-token-verified" ] && t_ok "...and drops the token's proof" \
+  || t_fail "switch: auth failure" ".server-token-verified survived"
+: > "$WORK/mop-switch-done"
+wait "$mswitch" 2>/dev/null
+# The record names the process it was written for: under a reused pid (another startedAt)
+# it tags nothing; the process's own record does.
+rm -f "$MOP/acct-01/.expired" "$MOP/acct-01/.sessions-index"
+MSID5="cafecafe-5555-4ccc-8ddd-eeeeffff0005"
+mkdir -p "$MOP/acct-01/.sessions-via"
+printf '{"pid":99991,"sessionId":"%s","cwd":"/proj","kind":"interactive","startedAt":1790000000000}\n' \
+  "$MSID5" > "$MOP/acct-01/sessions/99991.json"
+printf '1780000000000 token\n' > "$MOP/acct-01/.sessions-via/99991"
+CLAUDE_ACCOUNTS_DIR="$MOP" claude >/dev/null 2>&1
+{ grep -q -- "^$MSID5 " "$MOP/acct-01/.sessions-index" 2>/dev/null \
+  && ! grep -q -- "^$MSID5 .* token\$" "$MOP/acct-01/.sessions-index"; } \
+  && t_ok "a credential record of an earlier process under the same pid tags nothing" \
+  || t_fail "switch: reused pid" "index: $(cat "$MOP/acct-01/.sessions-index" 2>/dev/null)"
+printf '1790000000000 token\n' > "$MOP/acct-01/.sessions-via/99991"
+CLAUDE_ACCOUNTS_DIR="$MOP" claude >/dev/null 2>&1
+grep -q -- "^$MSID5 .* token\$" "$MOP/acct-01/.sessions-index" 2>/dev/null \
+  && t_ok "...while the process's own record tags a session it already knew" \
+  || t_fail "switch: own record" "index: $(cat "$MOP/acct-01/.sessions-index" 2>/dev/null)"
+rm -rf "$MOP/acct-01/sessions/99991.json" "$MOP/acct-01/.sessions-via" "$MOP/acct-01/.sessions-index"
+# adopt turns the account dir into a symlink to ~/.claude: never over a dir that holds a
+# credential of its own — MCP sign-ins with no login among them, or a portable token. The
+# fake HOME carries a default login, so only that guard can refuse.
+AH="$WORK/adopt-home"
+mkdir -p "$AH/.claude"
+printf '{"claudeAiOauth":{"accessToken":"sk-ant-oat01-default","refreshToken":"r","expiresAt":9999999999999}}' \
+  > "$AH/.claude/.credentials.json"
+printf '%s' "$MCP_ONLY" > "$MOP/acct-02/.credentials.json"
+out="$(HOME="$AH" CLAUDE_ACCOUNTS_DIR="$MOP" claude-accounts adopt acct-02 2>&1)"; rc=$?
+{ [ "$rc" != 0 ] && [ ! -L "$MOP/acct-02" ] \
+  && [ "$(cat "$MOP/acct-02/.credentials.json" 2>/dev/null)" = "$MCP_ONLY" ]; } \
+  && t_ok "adopt refuses a dir whose credentials file holds MCP state alone, and keeps it" \
+  || t_fail "adopt over MCP state" "rc=$rc: $(printf '%s' "$out" | head -c 160)"
+check "...saying it has credentials of its own" "already has its own credentials" "$out"
+rm -f "$MOP/acct-01/.credentials.json"
+out="$(HOME="$AH" CLAUDE_ACCOUNTS_DIR="$MOP" claude-accounts adopt acct-01 2>&1)"; rc=$?
+{ [ "$rc" != 0 ] && [ ! -L "$MOP/acct-01" ] \
+  && [ "$(cat "$MOP/acct-01/server.token" 2>/dev/null)" = "$MOP_TOK" ]; } \
+  && t_ok "adopt refuses a dir holding a portable token, and keeps the token" \
+  || t_fail "adopt over a token" "rc=$rc: $(printf '%s' "$out" | head -c 160)"
+rm -rf "$MOP" "$AH" "$WORK"/mcponly-*.json "$WORK/login-import.json" "$WORK/mcp-token-server.py" "$WORK/mcp-token-port"
+
+# ---- 9h. the limits pass's refresher writes under the client's lock --------------------
+# Claude Code takes proper-lockfile's <dir>/.storage-write.lock around every write of its
+# credential document (re-read, one change, the whole document back), and gives up after
+# about 7.5 s on a held lock. The refresher merges its rotated login into the same document:
+# a client lock held when a refresh would start skips it (no request, so nothing rotates);
+# after the POST the check-and-set and the write wait for the lock, so a client write in
+# flight is neither interleaved nor rolled back — and the rotated login is not lost to it.
+RL="$WORK/reflock"
+RL_HOME=mac; [ "$(uname -s)" = "Darwin" ] || RL_HOME=server
+mkdir -p "$RL/tmp" "$RL/acct-01"
+: > "$RL/.limits-kick"
+cat > "$RL/accounts.json" <<EOF
+{ "version": 1, "server": "root@203.0.113.1", "server_root": "/root/.claude-accounts",
+  "server_repo": "/root/claude-multiacc", "threshold": 90,
+  "accounts": [ {"id": "acct-01", "email": "rlock@test", "home": "$RL_HOME", "added_at": "2026-10-20T00:00:00Z"} ] }
+EOF
+rl_stale() { # an expired login beside one MCP login: the refresher's work, the client's state
+  printf '{"claudeAiOauth":{"accessToken":"sk-ant-oat01-rlstale","refreshToken":"sk-ant-ort01-rl%s","expiresAt":1000,"refreshTokenExpiresAt":9999999999999},"mcpOAuth":{"higgsfield|0123456789abcdef":{"serverName":"higgsfield","accessToken":"mcp-access-rl","refreshToken":"mcp-refresh-rl","expiresAt":9999999999999}}}' \
+    "$1" > "$RL/acct-01/.credentials.json"
+  chmod 600 "$RL/acct-01/.credentials.json"
+}
+cat > "$WORK/rlock-token-server.py" <<'EOF'
+import http.server, json, os, sys, threading, time
+target, mode_file, count_file = sys.argv[1], sys.argv[2], sys.argv[3]
+lock = os.path.join(os.path.dirname(target), '.storage-write.lock')
+seen = [0]
+class H(http.server.BaseHTTPRequestHandler):
+    def log_message(self, *a): pass
+    def do_POST(self):
+        self.rfile.read(int(self.headers.get('Content-Length') or 0))
+        seen[0] += 1
+        with open(count_file, 'w') as f:
+            f.write(str(seen[0]))
+        if open(mode_file).read().strip() == 'hold':
+            # a client takes its lock and reads the document now, and writes it back (an MCP
+            # token of its own refreshed) 1.5 s later, from what it read
+            os.mkdir(lock)
+            doc = json.load(open(target))
+            def later():
+                time.sleep(1.5)
+                doc['mcpOAuth']['higgsfield|0123456789abcdef']['refreshToken'] = 'mcp-refresh-CLIENT-HELD'
+                with open(target + '.client', 'w') as f:
+                    json.dump(doc, f)
+                os.replace(target + '.client', target)
+                os.rmdir(lock)
+            threading.Thread(target=later).start()
+        raw = json.dumps({'access_token': 'sk-ant-oat01-rlrotated%d' % seen[0],
+                          'refresh_token': 'sk-ant-ort01-rlrotated%d' % seen[0],
+                          'expires_in': 28800}).encode()
+        self.send_response(200)
+        self.send_header('Content-Type', 'application/json')
+        self.send_header('Content-Length', str(len(raw)))
+        self.end_headers()
+        self.wfile.write(raw)
+srv = http.server.HTTPServer(('127.0.0.1', 0), H)
+print(srv.server_address[1], flush=True)
+srv.serve_forever()
+EOF
+printf 'plain\n' > "$WORK/rlock-mode"
+printf '0' > "$WORK/rlock-count"
+rl_stale a
+python3 "$WORK/rlock-token-server.py" "$RL/acct-01/.credentials.json" "$WORK/rlock-mode" "$WORK/rlock-count" \
+  > "$WORK/rlock-port" 2>/dev/null &
+rlsrv_pid=$!
+STUB_PIDS="$STUB_PIDS $rlsrv_pid"
+rlport=""
+for _ in $(seq 1 20); do
+  rlport="$(head -1 "$WORK/rlock-port" 2>/dev/null)"
+  case "$rlport" in ''|*[!0-9]*) rlport=""; sleep 0.2 ;; *) break ;; esac
+done
+if [ -z "$rlport" ]; then
+  t_ok "refresher lock tests skipped (cannot bind a loopback port here)"
+else
+  rl_limits() { CLAUDE_ACCOUNTS_DIR="$RL" CLAUDE_MULTIACC_TOKEN_URL="http://127.0.0.1:$rlport/token" \
+    claude-accounts limits --force 2>&1; }
+  cp "$RL/acct-01/.credentials.json" "$WORK/rlock-before.json"
+  mkdir "$RL/acct-01/.storage-write.lock"                    # a client is writing right now
+  out="$(rl_limits)"
+  check "a held client lock skips the refresh" "acct-01: oauth refresh skipped" "$out"
+  { [ "$(cat "$WORK/rlock-count")" = 0 ] && cmp -s "$WORK/rlock-before.json" "$RL/acct-01/.credentials.json" \
+      && [ ! -f "$RL/acct-01/.oauth-refresh.json" ] && [ -d "$RL/acct-01/.storage-write.lock" ]; } \
+    && t_ok "...sending nothing (no rotation), writing nothing, noting no backoff, leaving the lock" \
+    || t_fail "refresh under a held lock" "requests=$(cat "$WORK/rlock-count") backoff=$([ -f "$RL/acct-01/.oauth-refresh.json" ] && echo yes || echo no)"
+  touch -t 202001010101 "$RL/acct-01/.storage-write.lock"    # its holder died long ago
+  out="$(rl_limits)"
+  check "a stale client lock is taken over and the refresh lands" "acct-01: oauth access token refreshed" "$out"
+  [ ! -e "$RL/acct-01/.storage-write.lock" ] && [ "$(cat "$WORK/rlock-count")" = 1 ] \
+    && t_ok "...and the lock is released after the write" \
+    || t_fail "stale client lock" "requests=$(cat "$WORK/rlock-count") lock=$(ls -d "$RL/acct-01/.storage-write.lock" 2>/dev/null)"
+  rl_stale b
+  rmdir "$RL/acct-01/.storage-write.lock" 2>/dev/null || true   # this case on its own
+  printf 'hold\n' > "$WORK/rlock-mode"
+  out="$(rl_limits)"
+  check "a refresh whose write window a client holds still lands" "acct-01: oauth access token refreshed" "$out"
+  for _ in $(seq 1 50); do                                   # the client's write is done
+    [ -e "$RL/acct-01/.storage-write.lock" ] || break
+    sleep 0.1
+  done
+  python3 - "$RL/acct-01/.credentials.json" <<'EOF'
+import json, os, stat, sys
+doc = json.load(open(sys.argv[1]))
+o = doc['claudeAiOauth']
+assert o['accessToken'] == 'sk-ant-oat01-rlrotated2' and o['refreshToken'] == 'sk-ant-ort01-rlrotated2', 'the rotated login was rolled back'
+assert doc['mcpOAuth']['higgsfield|0123456789abcdef']['refreshToken'] == 'mcp-refresh-CLIENT-HELD', 'the client write was lost'
+assert stat.S_IMODE(os.stat(sys.argv[1]).st_mode) == 0o600
+EOF
+  [ $? -eq 0 ] && [ ! -e "$RL/acct-01/.storage-write.lock" ] \
+    && t_ok "...after the client's write: its MCP token and the rotated login both survive" \
+    || t_fail "refresh vs a client write in flight" "see assertions above"
+fi
+kill "$rlsrv_pid" 2>/dev/null; wait "$rlsrv_pid" 2>/dev/null || true
+rm -rf "$RL" "$WORK"/rlock-*
+
 # ---- 10. token-only account exports CLAUDE_CODE_OAUTH_TOKEN ------------------
 mkdir -p "$ACC/acct-03"
 printf 'sk-ant-oat01-tok-for-03' > "$ACC/acct-03/server.token"
@@ -1558,6 +2059,21 @@ claude >/dev/null 2>&1
 [ ! -f "$ACC/acct-01/.limited" ] \
   && t_ok "a stale rival claim does not hide a newer one" \
   || t_fail "duplicate session claim" "only the first rival claim was inspected"
+# A line the shim tagged ` token` (a run it launched on the portable token, 9g) is the same
+# claim to every reader: to the conflict check above...
+rm -f "$ACC"/acct-0*/.limited "$ACC"/acct-0*/.client-scan
+printf '%s 2090-01-01T00:00:00Z token\n' "$SIDD" > "$ACC/acct-02/.sessions-index"
+claude >/dev/null 2>&1
+[ ! -f "$ACC/acct-01/.limited" ] \
+  && t_ok "a newer rival claim tagged token still conflicts" \
+  || t_fail "token-tagged rival claim" "the token field hid acct-02's newer claim"
+# ...and to the scan that marks an account off its own session's rejection
+rm -f "$ACC/acct-02/.sessions-index" "$ACC"/acct-0*/.limited "$ACC"/acct-0*/.client-scan
+printf '%s token\n' "$CLAIM1" > "$ACC/acct-01/.sessions-index"
+claude >/dev/null 2>&1
+grep -q 'reason=client-rate-limit' "$ACC/acct-01/.limited" 2>/dev/null \
+  && t_ok "a session line tagged token still attributes its own rejection" \
+  || t_fail "token-tagged index line" "client_limit_scan missed a rejection behind a tagged line"
 rm -f "$ACC/acct-02/projects/-proj" "$ACC"/acct-0*/.limited "$ACC"/acct-0*/.sessions-index "$ACC"/acct-0*/.client-scan
 rm -rf "$ACC"/acct-0*/projects "$ACC"/acct-0*/sessions
 
@@ -4701,6 +5217,69 @@ out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" CLAUDE_ACCOUNT=acct-01 claude 2>&1)"
 check "the next launch on that account still runs" "CFG=acct-01" "$out"
 mcp_has acct-01 nested && t_fail "nested remove undone" "the next launch re-added nested" \
   || t_ok "a nested remove is not undone by the next launch"
+# GLOBAL OPTIONS before `mcp` (2026-10-22): the operator's alias claude='claude
+# --dangerously-skip-permissions' put a flag in front of every typed `claude mcp add`,
+# the mirror looked at $1 alone, and motionsites landed in 2 of 11 accounts. The shim
+# finds the subcommand the way commander does: a flag is skipped, a value option skips
+# its value, and an optional-value one (--resume) takes the next word as its own.
+: > "$PYLOG"
+out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" CLAUDE_MULTIACC_PYTHON="$WORK/pylog.sh" claude --dangerously-skip-permissions mcp add -s user dsp -- echo d 2>&1)"
+rc=$?
+[ "$rc" = "0" ] && check "a flag before mcp: the stock add still answers like the real client" "Added stdio MCP server dsp" "$out" \
+  || t_fail "flag-first add rc" "rc=$rc: $out"
+mcp_has acct-01 dsp && mcp_has acct-02 dsp && t_ok "'claude --dangerously-skip-permissions mcp add' lands in EVERY account" \
+  || t_fail "flag-first mirror" "$out $(cat "$MPOOL/acct-01/.claude.json" "$MPOOL/acct-02/.claude.json")"
+grep -q " learn " "$PYLOG" && t_ok "a flag-first add is mirrored through learn" || t_fail "flag-first learn" "$(cat "$PYLOG")"
+out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" claude-accounts mcp list --json 2>&1)"
+python3 -c 'import json,sys; d=json.loads(sys.argv[1]); s=d["mcpServers"].get("dsp") or {}; sys.exit(0 if s.get("command")=="echo" and s.get("args")==["d"] else 1)' "$out" \
+  && t_ok "a flag-first add reaches the registry with the client's own block" || t_fail "flag-first registry" "$out"
+out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" claude --dangerously-skip-permissions mcp remove -s user dsp 2>&1)"
+rc=$?
+[ "$rc" = "0" ] && t_ok "'claude --dangerously-skip-permissions mcp remove' exits 0" || t_fail "flag-first remove rc" "rc=$rc: $out"
+mcp_has acct-01 dsp || mcp_has acct-02 dsp \
+  && t_fail "flag-first remove mirror" "dsp survives in an account" || t_ok "a flag-first remove drops the server from EVERY account"
+out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" claude-accounts mcp list --json 2>&1)"
+python3 -c 'import json,sys; d=json.loads(sys.argv[1]); sys.exit(0 if "dsp" in d.get("retiredUser",[]) and "dsp" not in d.get("mcpServers",{}) else 1)' "$out" \
+  && t_ok "a flag-first remove leaves a user-scope tombstone" || t_fail "flag-first tombstone" "$out"
+# nested (an agent inside a pooled session, alias or not): same parse, same mirror
+out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" CLAUDE_CONFIG_DIR="$MPOOL/acct-01" CLAUDE_SHIM_ACTIVE=1 claude --dangerously-skip-permissions mcp add -s user dspn -- echo n 2>&1)"
+rc=$?
+[ "$rc" = "0" ] && t_ok "a nested flag-first 'claude mcp add' exits 0" || t_fail "nested flag-first rc" "rc=$rc: $out"
+mcp_has acct-01 dspn && mcp_has acct-02 dspn && t_ok "a nested 'claude --dangerously-skip-permissions mcp add' lands in EVERY account" \
+  || t_fail "nested flag-first mirror" "$out $(cat "$MPOOL/acct-02/.claude.json")"
+# a value option: --model's value is skipped, and add-json is a mutation like add
+out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" claude --model opus mcp add-json -s user mj '{"type":"stdio","command":"echo","args":["j"],"env":{}}' 2>&1)"
+rc=$?
+[ "$rc" = "0" ] && t_ok "'claude --model opus mcp add-json' exits 0" || t_fail "model-first add-json rc" "rc=$rc: $out"
+mcp_has acct-01 mj && mcp_has acct-02 mj && t_ok "'claude --model opus mcp add-json' lands in EVERY account" \
+  || t_fail "model-first mirror" "$out $(cat "$MPOOL/acct-01/.claude.json" "$MPOOL/acct-02/.claude.json")"
+out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" claude-accounts mcp list --json 2>&1)"
+python3 -c 'import json,sys; d=json.loads(sys.argv[1]); s=d["mcpServers"].get("mj") or {}; sys.exit(0 if s.get("args")==["j"] else 1)' "$out" \
+  && t_ok "a --model-first add-json reaches the registry" || t_fail "model-first registry" "$out"
+out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" CLAUDE_CONFIG_DIR="$MPOOL/acct-02" CLAUDE_SHIM_ACTIVE=1 claude --model opus mcp add-json -s user mjn '{"type":"stdio","command":"echo","args":["n"],"env":{}}' 2>&1)"
+mcp_has acct-01 mjn && mcp_has acct-02 mjn && t_ok "a nested 'claude --model opus mcp add-json' lands in EVERY account" \
+  || t_fail "nested model-first mirror" "$out $(cat "$MPOOL/acct-01/.claude.json")"
+# NOT a mutation: --resume takes the next word (a session id or search term) as its
+# value, and -p's prompt is one word that merely reads "mcp add …" — the shim must run
+# no snapshot and no learn, and nothing reaches any account or the registry
+: > "$PYLOG"
+out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" CLAUDE_ACCOUNT=acct-01 CLAUDE_MULTIACC_PYTHON="$WORK/pylog.sh" claude --resume mcp add rsm 2>&1 </dev/null)"
+rc=$?
+[ "$rc" = "0" ] && check "'claude --resume mcp add rsm' runs as an ordinary launch" "CFG=acct-01" "$out" \
+  || t_fail "resume-first rc" "rc=$rc: $out"
+grep -Eq " (snapshot|learn) " "$PYLOG" && t_fail "resume-first mirror attempt" "$(cat "$PYLOG")" \
+  || t_ok "'claude --resume mcp add' is no mcp mutation (no snapshot, no learn)"
+: > "$PYLOG"
+out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" CLAUDE_ACCOUNT=acct-01 CLAUDE_MULTIACC_PYTHON="$WORK/pylog.sh" claude -p "mcp add psm" 2>&1 </dev/null)"
+rc=$?
+[ "$rc" = "0" ] && check "'claude -p \"mcp add psm\"' runs as an ordinary print" "CFG=acct-01" "$out" \
+  || t_fail "print-prompt rc" "rc=$rc: $out"
+grep -Eq " (snapshot|learn) " "$PYLOG" && t_fail "print-prompt mirror attempt" "$(cat "$PYLOG")" \
+  || t_ok "a -p prompt reading 'mcp add' is no mcp mutation (no snapshot, no learn)"
+out="$(CLAUDE_ACCOUNTS_ROOT="$MPOOL" claude-accounts mcp list --json 2>&1)"
+mcp_has acct-01 rsm || mcp_has acct-01 psm || mcp_has acct-02 rsm || mcp_has acct-02 psm \
+  || python3 -c 'import json,sys; d=json.loads(sys.argv[1]); a=set(d.get("mcpServers",{}))|set(d.get("retired",[]))|set(d.get("retiredUser",[])); sys.exit(0 if a & {"rsm","psm","add","mcp"} else 1)' "$out" \
+  && t_fail "non-mutation leak" "$out" || t_ok "neither non-mutation reaches an account or the registry"
 # a CLAUDE_CONFIG_DIR OUTSIDE the pool is plain passthrough: no python, no mirror
 mkdir -p "$WORK/mcp-outside"
 : > "$PYLOG"
@@ -4939,10 +5518,67 @@ if command -v node >/dev/null 2>&1; then
   # nothing and the nightly self-update logged "npm not found; skipping" for days while
   # every Mac's copy silently froze. npm must be resolved by path — and specifically the
   # one inside the prefix that owns the RUNNING copy, never whatever a stray PATH offers.
+  # The model catalog after a self-update (lib/common.sh model_catalog_after_update): a real
+  # update refreshes it ONCE, from the tree npm just wrote; "already latest" never does; and a
+  # refresh that fails is logged while the update keeps exit 0.
+  su_catalog_calls() { grep -c '^NEW-TREE model-catalog refresh --quiet$' "$WORK/catalog-calls-$_cli.log" 2>/dev/null; }
+  su_catalog_checks() {
+    [ "$(su_catalog_calls)" = 1 ] \
+      && t_ok "$_cli: a real update refreshes the model catalog once, from the NEW tree" \
+      || t_fail "$_cli catalog refresh" "calls: $(head -3 "$WORK/catalog-calls-$_cli.log" 2>/dev/null)"
+    { [ -f "$SU_CL/model-catalog.json" ] && [ -f "$SU_CX/model-catalog.json" ]; } \
+      && t_ok "$_cli: that refresh wrote model-catalog.json into both pools" \
+      || t_fail "$_cli catalog files" "$(ls "$SU_CL" "$SU_CX" 2>&1 | tr '\n' ' ')"
+    grep -q "self-update: model catalog refreshed" "$SU_OWN/update.log" \
+      && t_ok "$_cli: update.log records the catalog refresh" \
+      || t_fail "$_cli catalog log" "$(tail -3 "$SU_OWN/update.log" 2>/dev/null)"
+    out="$(_su)"
+    check "$_cli: the next run is already latest" "already latest (9.9.9)" "$out"
+    [ "$(su_catalog_calls)" = 1 ] && t_ok "$_cli: an 'already latest' run never refreshes the catalog" \
+      || t_fail "$_cli catalog on already-latest" "calls: $(su_catalog_calls)"
+    python3 - "$NPMROOT/package.json" <<'PY'
+import json, sys
+doc = json.load(open(sys.argv[1])); doc['version'] = '0.0.1'
+json.dump(doc, open(sys.argv[1], 'w'))
+PY
+    : > "$WORK/catalog-fail-$_cli"
+    out="$(_su)"
+    rc=$?
+    [ "$rc" = 0 ] && t_ok "$_cli: a failing catalog refresh leaves self-update at exit 0" \
+      || t_fail "$_cli failing catalog rc" "rc=$rc: $(printf '%s' "$out" | head -c 200)"
+    check "$_cli: the failed refresh is reported" "model catalog refresh FAILED (rc=3)" "$out"
+    [ "$(su_catalog_calls)" = 2 ] && t_ok "$_cli: that update still ran the refresh once" \
+      || t_fail "$_cli failing catalog calls" "calls: $(su_catalog_calls)"
+  }
+  # What `npm install` does to the running copy, beyond the version: it ships a new tree. The
+  # CLI it writes records every `model-catalog` call (and fails one on request), and it lands
+  # under a NEW inode, as npm's extract does, so the bash running self-update keeps its old file.
+  SHIP="$WORK/fake-npm-ship.py"
+  cat > "$SHIP" <<'SHIPEOF'
+import json, os, sys
+root, cli, log, failflag = sys.argv[1:5]
+pkg = os.path.join(root, 'package.json')
+doc = json.load(open(pkg)); doc['version'] = '9.9.9'
+json.dump(doc, open(pkg, 'w'))
+path = os.path.join(root, 'bin', cli)
+text = open(path).read()
+mark = '# fake-npm: the new tree\n'
+if mark not in text:
+    head, rest = text.split('\n', 1)
+    probe = ('case "${1:-}" in model-catalog) printf "NEW-TREE %%s\\n" "$*" >> "%s"; '
+             '[ -e "%s" ] && exit 3 ;; esac\n' % (log, failflag))
+    text = head + '\n' + mark + probe + rest
+open(path + '.new', 'w').write(text)
+os.chmod(path + '.new', 0o755)
+os.replace(path + '.new', path)
+SHIPEOF
   for _cli in claude-accounts codex-accounts; do
     PFX="$WORK/pfx-$_cli"
     NPMROOT="$PFX/lib/node_modules/claude-multiacc"
-    mkdir -p "$NPMROOT" "$PFX/bin"
+    # Pools of its own: a real update now writes model-catalog.json into both of them.
+    SU_CL="$WORK/su-claude-$_cli"; SU_CX="$WORK/su-codex-$_cli"
+    mkdir -p "$NPMROOT" "$PFX/bin" "$SU_CL" "$SU_CX"
+    if [ "$_cli" = claude-accounts ]; then SU_OWN="$SU_CL"; else SU_OWN="$SU_CX"; fi
     cp -R "$REPO_DIR/bin" "$REPO_DIR/lib" "$REPO_DIR/package.json" "$NPMROOT/"
     # A fake npm that records how it was called and "installs" by bumping package.json.
     # Its shebang names an interpreter that exists ONLY beside it, mirroring the real
@@ -4959,13 +5595,7 @@ NODEEOF
 echo "npm \$*" >> "$WORK/npm-calls-$_cli.log"
 case "\${1:-}" in
   view) echo 9.9.9 ;;
-  install) python3 - "$NPMROOT/package.json" <<'PY'
-import json, sys
-p = sys.argv[1]
-doc = json.load(open(p)); doc['version'] = '9.9.9'
-json.dump(doc, open(p, 'w'))
-PY
-    ;;
+  install) python3 "$SHIP" "$NPMROOT" "$_cli" "$WORK/catalog-calls-$_cli.log" "$WORK/catalog-fail-$_cli" ;;
 esac
 exit 0
 NPMEOF
@@ -4975,9 +5605,11 @@ NPMEOF
     printf '#!/usr/bin/env bash\necho "WRONG-NPM \$*" >> "%s"\nexit 0\n' "$WORK/npm-calls-$_cli.log" > "$WORK/wrongbin/npm"
     chmod +x "$WORK/wrongbin/npm"
     : > "$WORK/npm-calls-$_cli.log"
-    out="$(env -i HOME="$HOME" PATH="$WORK/wrongbin:/usr/bin:/bin:/usr/sbin:/sbin" \
-      CLAUDE_ACCOUNTS_DIR="$ACC" CODEX_ACCOUNTS_DIR="$WORK/codex-accounts" \
-      "$NPMROOT/bin/$_cli" self-update 2>&1)"
+    _su() { # a scheduled agent's environment: no npm on PATH, nothing inherited
+      env -i HOME="$HOME" PATH="$WORK/wrongbin:/usr/bin:/bin:/usr/sbin:/sbin" \
+        CLAUDE_ACCOUNTS_DIR="$SU_CL" CODEX_ACCOUNTS_DIR="$SU_CX" "$NPMROOT/bin/$_cli" self-update 2>&1
+    }
+    out="$(_su)"
     rc=$?
     [ "$rc" = "0" ] && t_ok "$_cli: self-update exits 0 with no npm on PATH" \
       || t_fail "$_cli self-update rc" "rc=$rc: $(printf '%s' "$out" | head -c 200)"
@@ -4994,6 +5626,56 @@ NPMEOF
     grep -q "^npm view " "$WORK/npm-calls-$_cli.log" \
       && t_ok "$_cli: npm ran despite its interpreter being off PATH" \
       || t_fail "$_cli npm interpreter" "npm never executed — its shebang interpreter was not found"
+    su_catalog_checks
+  done
+  # ---- 19a2. self-update only ever goes UP --------------------------------------------
+  # This Mac runs builds packed by hand ahead of the registry, and app-robot runs self-update
+  # every 10 minutes: installing `latest` over such a build swapped in one that misread what
+  # the newer build had written. A newer install stays, an unreadable registry answer installs
+  # nothing, and the versions compare as numbers (2.0.10 is newer than 2.0.9).
+  for _cli in claude-accounts codex-accounts; do
+    PFX="$WORK/pfx-down-$_cli"
+    NPMROOT="$PFX/lib/node_modules/claude-multiacc"
+    SU_CL="$WORK/su-down-claude-$_cli"; SU_CX="$WORK/su-down-codex-$_cli"
+    mkdir -p "$NPMROOT" "$PFX/bin" "$SU_CL" "$SU_CX"
+    cp -R "$REPO_DIR/bin" "$REPO_DIR/lib" "$REPO_DIR/package.json" "$NPMROOT/"
+    python3 - "$NPMROOT/package.json" <<'PY'
+import json, sys
+doc = json.load(open(sys.argv[1])); doc['version'] = '2.0.10'
+json.dump(doc, open(sys.argv[1], 'w'))
+PY
+    cat > "$PFX/bin/npm" <<NPMEOF
+#!/bin/bash
+echo "npm \$*" >> "$WORK/npm-down-$_cli.log"
+case "\${1:-}" in view) cat "$WORK/npm-down-view-$_cli" 2>/dev/null ;; esac
+exit 0
+NPMEOF
+    chmod +x "$PFX/bin/npm"
+    : > "$WORK/npm-down-$_cli.log"
+    _sud() {
+      env -i HOME="$HOME" PATH="/usr/bin:/bin:/usr/sbin:/sbin" \
+        CLAUDE_ACCOUNTS_DIR="$SU_CL" CODEX_ACCOUNTS_DIR="$SU_CX" "$NPMROOT/bin/$_cli" self-update 2>&1
+    }
+    printf '2.0.9\n' > "$WORK/npm-down-view-$_cli"
+    out="$(_sud)"; rc=$?
+    check "$_cli: self-update never installs a registry version older than its own" \
+      "this install (2.0.10) is newer than the registry's 2.0.9; not downgrading" "$out"
+    { [ "$rc" = 0 ] && ! grep -q '^npm install' "$WORK/npm-down-$_cli.log"; } \
+      && t_ok "$_cli: ...exits 0 and runs no npm install" \
+      || t_fail "$_cli downgrade" "rc=$rc calls: $(tr '\n' ' ' < "$WORK/npm-down-$_cli.log")"
+    : > "$WORK/npm-down-view-$_cli"
+    out="$(_sud)"; rc=$?
+    check "$_cli: an unreadable registry version installs nothing" \
+      "could not read the registry's version (npm view); not updating" "$out"
+    { [ "$rc" = 1 ] && ! grep -q '^npm install' "$WORK/npm-down-$_cli.log"; } \
+      && t_ok "$_cli: ...reports the failed check (exit 1) and runs no npm install" \
+      || t_fail "$_cli blind install" "rc=$rc calls: $(tr '\n' ' ' < "$WORK/npm-down-$_cli.log")"
+    printf '2.0.11\n' > "$WORK/npm-down-view-$_cli"
+    out="$(_sud)"
+    check "$_cli: a newer registry version still installs" "npm 2.0.10 -> 2.0.11" "$out"
+    grep -q '^npm install -g --prefix .* claude-multiacc@latest$' "$WORK/npm-down-$_cli.log" \
+      && t_ok "$_cli: ...through npm install" \
+      || t_fail "$_cli upgrade" "calls: $(tr '\n' ' ' < "$WORK/npm-down-$_cli.log")"
   done
   # The agents install.sh writes must carry a PATH for the same reason (a future tool
   # that is not resolved by absolute path would hit exactly this again).
@@ -5042,7 +5724,7 @@ export CODEX_MULTIACC_TOKEN_URL="file://$WORK/cx-token-endpoint-missing.json"
 export CODEX_MULTIACC_USAGE_URL="file://$WORK/cx-usage-endpoint-missing.json"
 export CODEX_MULTIACC_FORCE_TTY=1
 export FAKE_CTL2="$WORK/ctl2"
-: > "$CX/.limits-kick"
+touch -t 203001010000 "$CX/.limits-kick"   # armed in the future, like the claude pool's
 
 # Codex auth fixtures are real-shaped: auth.json carrying JWTs whose exp/email
 # claims the audit decodes offline (exactly what the CLI does).
@@ -5187,6 +5869,18 @@ cat > "$FAKEBIN/codex" <<EOF
 #!/usr/bin/env bash
 # fake real codex for tests (not a shim)
 if [ "\${1:-}" = --help ]; then echo 'Usage: legacy codex [OPTIONS]'; exit 0; fi
+# Global options may precede the subcommand, as clap allows (the operator's alias
+# \`codex --dangerously-bypass-approvals-and-sandbox\`, -c k=v, -m model): the mcp
+# stand-in skips the ones the suite types.
+_fa=("\$@")
+while [ "\${#_fa[@]}" -gt 0 ]; do
+  case "\${_fa[0]}" in
+    --dangerously-bypass-approvals-and-sandbox) _fa=("\${_fa[@]:1}") ;;
+    -c|-m) _fa=("\${_fa[@]:2}") ;;
+    *) break ;;
+  esac
+done
+if [ "\${_fa[0]:-}" = "mcp" ] && [ "\${_fa[0]:-}" != "\${1:-}" ]; then set -- "\${_fa[@]}"; fi
 if [ "\${1:-}" = "mcp" ] && [ -n "\${CODEX_HOME:-}" ]; then
   python3 "$FAKE_CODEX_MCP" "\$CODEX_HOME/config.toml" "\$@"
   rc=\$?
@@ -5267,6 +5961,9 @@ out="$(CODEX_MULTIACC_DISABLE=1 codex 2>&1)"
 check "codex: passthrough when disabled" "CFG=none" "$out"
 
 # ---- C3. headroom selection: session gate first, then the WEEKLY headroom band ------
+# The codex shim counts telemetry older than 15 minutes as unknown (bin/codex STALE_AFTER), and
+# on a loaded machine the suite's $now is older than that by here: these fixtures need a fresh one.
+now="$(date +%s)"
 cxlj() { printf '{"fetched_at":%s,"weekly_percent":%s,"session_percent":%s,"max_percent":%s,"buckets":[]}' "$now" "$1" "$2" "$3"; }
 cxlj 80 10 80 > "$CX/acct-01/limits.json"
 cxlj 20 10 20 > "$CX/acct-02/limits.json"
@@ -5703,6 +6400,7 @@ grep -q "all-limited fallback=acct-02 weekly=70%" "$CX/selection.log" \
 rm -f "$CX"/acct-*/.limited "$CX"/acct-*/limits.json
 
 # ---- C6b. the fallback tells "still serving" from "rejected right now" ----------------
+now="$(date +%s)"   # its markers lift in 10 minutes: never from a stale suite clock
 # Ported from the claude shim (2026-08-29) when the session gate reached the fallback.
 # acct-01: 7d window at 99% — worse headroom, but still answering. acct-02: 5h window at
 # 100% — far better weekly (7%), but every request bounces until the reset.
@@ -6389,7 +7087,7 @@ case "$out" in *CFG=acct-04*) t_fail "codex apikey selection" "api-key account w
 codex-accounts remove acct-04 --yes >/dev/null 2>&1
 
 # ---- C13. limits: fixture endpoint, marking, classification -------------------------
-: > "$CX/.limits-kick"   # re-arm the shim-kick throttle: no background limits racing these
+touch -t 203001010000 "$CX/.limits-kick"   # re-arm the shim-kick throttle: no background limits racing these
 cat > "$WORK/cx-usage-high.json" <<EOF
 {"email":"a@cx","plan_type":"pro",
  "rate_limit":{"allowed":true,"limit_reached":false,
@@ -7405,6 +8103,57 @@ out="$(CODEX_ACCOUNTS_ROOT="$CXP" CODEX_ACCOUNT=acct-01 codex 2>&1)"
 check "codex: the next launch on that account still runs" "CFG=acct-01" "$out"
 cx_has acct-01 nested && t_fail "codex nested remove undone" "the next launch re-added nested" \
   || t_ok "codex: a nested remove is not undone by the next launch"
+# GLOBAL OPTIONS before `mcp` (2026-10-22, parity with 16e): the operator's alias
+# codex='codex --dangerously-bypass-approvals-and-sandbox' put a flag in front of every
+# typed `codex mcp add`. The shim finds the subcommand the way clap does: a flag is
+# skipped, -c/-m skip their value.
+: > "$PYLOG"
+out="$(CODEX_ACCOUNTS_ROOT="$CXP" CLAUDE_MULTIACC_PYTHON="$WORK/pylog.sh" codex --dangerously-bypass-approvals-and-sandbox mcp add dbx -- echo d 2>&1)"
+rc=$?
+[ "$rc" = "0" ] && check "codex: a flag before mcp: the stock add still answers like the real client" "Added global MCP server 'dbx'" "$out" \
+  || t_fail "codex flag-first add rc" "rc=$rc: $out"
+cx_has acct-01 dbx && cx_has acct-02 dbx && t_ok "codex: 'codex --dangerously-bypass-approvals-and-sandbox mcp add' lands in EVERY account" \
+  || t_fail "codex flag-first mirror" "$out $(cat "$CXP/acct-01/config.toml" "$CXP/acct-02/config.toml")"
+grep -q " learn " "$PYLOG" && t_ok "codex: a flag-first add is mirrored through learn" || t_fail "codex flag-first learn" "$(cat "$PYLOG")"
+out="$(CODEX_ACCOUNTS_ROOT="$CXP" codex-accounts mcp list --json 2>&1)"
+python3 -c 'import json,sys; d=json.loads(sys.argv[1]); s=d["mcpServers"].get("dbx") or {}; sys.exit(0 if s.get("command")=="echo" and s.get("args")==["d"] else 1)' "$out" \
+  && t_ok "codex: a flag-first add reaches the registry" || t_fail "codex flag-first registry" "$out"
+out="$(CODEX_ACCOUNTS_ROOT="$CXP" codex -c a=b -m o3 mcp remove dbx 2>&1)"
+rc=$?
+[ "$rc" = "0" ] && t_ok "codex: 'codex -c a=b -m o3 mcp remove' exits 0" || t_fail "codex value-first remove rc" "rc=$rc: $out"
+cx_has acct-01 dbx || cx_has acct-02 dbx \
+  && t_fail "codex value-first remove mirror" "dbx survives in an account" \
+  || t_ok "codex: 'codex -c a=b -m o3 mcp remove' drops the server from EVERY account"
+out="$(CODEX_ACCOUNTS_ROOT="$CXP" codex-accounts mcp list --json 2>&1)"
+python3 -c 'import json,sys; d=json.loads(sys.argv[1]); sys.exit(0 if ("dbx" in d.get("retiredUser",[]) or "dbx" in d.get("retired",[])) and "dbx" not in d.get("mcpServers",{}) else 1)' "$out" \
+  && t_ok "codex: a value-first remove is retired in the registry" || t_fail "codex value-first tombstone" "$out"
+# nested: the same two shapes from inside a pooled codex session
+out="$(CODEX_ACCOUNTS_ROOT="$CXP" CODEX_HOME="$CXP/acct-01" CODEX_SHIM_ACTIVE=1 codex --dangerously-bypass-approvals-and-sandbox mcp add dbxn -- echo n 2>&1)"
+rc=$?
+[ "$rc" = "0" ] && t_ok "codex: a nested flag-first 'codex mcp add' exits 0" || t_fail "codex nested flag-first rc" "rc=$rc: $out"
+cx_has acct-01 dbxn && cx_has acct-02 dbxn && t_ok "codex: a nested flag-first add lands in EVERY account" \
+  || t_fail "codex nested flag-first mirror" "$out $(cat "$CXP/acct-02/config.toml")"
+out="$(CODEX_ACCOUNTS_ROOT="$CXP" CODEX_HOME="$CXP/acct-01" CODEX_SHIM_ACTIVE=1 codex -c a=b -m o3 mcp remove dbxn 2>&1)"
+rc=$?
+[ "$rc" = "0" ] && t_ok "codex: a nested 'codex -c a=b -m o3 mcp remove' exits 0" || t_fail "codex nested value-first remove rc" "rc=$rc: $out"
+cx_has acct-01 dbxn || cx_has acct-02 dbxn \
+  && t_fail "codex nested value-first remove mirror" "dbxn survives in an account" \
+  || t_ok "codex: a nested value-first remove drops the server from EVERY account"
+# NOT a mutation (parity with 16e's --resume / -p): a one-word prompt that reads
+# "mcp add …", and -i, whose variadic value takes every word up to the next option
+: > "$PYLOG"
+out="$(CODEX_ACCOUNTS_ROOT="$CXP" CODEX_ACCOUNT=acct-01 CLAUDE_MULTIACC_PYTHON="$WORK/pylog.sh" codex "mcp add psx" 2>&1 </dev/null)"
+rc=$?
+[ "$rc" = "0" ] && check "codex: a prompt reading 'mcp add' runs as an ordinary launch" "CFG=acct-01" "$out" \
+  || t_fail "codex prompt rc" "rc=$rc: $out"
+out="$(CODEX_ACCOUNTS_ROOT="$CXP" CODEX_ACCOUNT=acct-01 CLAUDE_MULTIACC_PYTHON="$WORK/pylog.sh" codex -i shot.png mcp add psx 2>&1 </dev/null)"
+rc=$?
+[ "$rc" = "0" ] && check "codex: 'codex -i shot.png mcp add psx' runs as an ordinary launch" "CFG=acct-01" "$out" \
+  || t_fail "codex image-first rc" "rc=$rc: $out"
+grep -Eq " (snapshot|learn) " "$PYLOG" && t_fail "codex non-mutation mirror attempt" "$(cat "$PYLOG")" \
+  || t_ok "codex: neither a prompt nor -i's words are an mcp mutation (no snapshot, no learn)"
+cx_has acct-01 psx || cx_has acct-02 psx && t_fail "codex non-mutation leak" "psx in an account" \
+  || t_ok "codex: neither non-mutation reaches an account"
 mkdir -p "$WORK/cx-outside"
 : > "$PYLOG"
 out="$(CODEX_ACCOUNTS_ROOT="$CXP" CODEX_HOME="$WORK/cx-outside" CLAUDE_MULTIACC_PYTHON="$WORK/pylog.sh" codex mcp add outside -- echo o 2>&1)"
@@ -8346,6 +9095,96 @@ EOF2
 out="$(env -u USER -u LOGNAME FAKE_KEYCHAIN_CLIENT=1 CLAUDE_ACCOUNTS_DIR="$KLP" claude-accounts verify 2>&1)"
 check "and its client can use it" "acct-02 lonly@test: PASS" "$out"
 
+# 17p. a Keychain item holding only MCP state is no login either (the 9g rule): a client in
+# a keychain-capable session saves its MCP servers' OAuth state there even when its login
+# came from a portable token. The shim, list and the marker heal all read it as none, and
+# every write of a login lands INTO the item, its MCP state kept.
+KMP="$WORK/kcmcp"
+KMP_HOME=mac; [ "$(uname -s)" = "Darwin" ] || KMP_HOME=server
+mkdir -p "$KMP/tmp" "$KMP/acct-01" "$KMP/acct-02" "$KMP/acct-03"
+: > "$KMP/.limits-kick"
+cat > "$KMP/accounts.json" <<EOF2
+{ "version": 1, "server": "root@203.0.113.1", "server_root": "/root/.claude-accounts",
+  "server_repo": "/root/claude-multiacc", "threshold": 90,
+  "accounts": [
+    {"id": "acct-01", "email": "kmtok@test", "home": "$KMP_HOME", "added_at": "2026-10-19T00:00:00Z"},
+    {"id": "acct-02", "email": "kmnone@test", "home": "$KMP_HOME", "added_at": "2026-10-19T00:00:00Z"},
+    {"id": "acct-03", "email": "kmlogin@test", "home": "$KMP_HOME", "added_at": "2026-10-19T00:00:00Z"}
+  ] }
+EOF2
+KC_MCP='{"mcpOAuth":{"higgsfield|0123456789abcdef":{"serverName":"higgsfield","accessToken":"mcp-access-kc","refreshToken":"mcp-refresh-kc","expiresAt":9999999999999}}}'
+KMP_TOK='sk-ant-oat01-KCMCPTOKENKCMCPTOKENKCMCPTOKENKCMCPTOKENKC01'
+kc_put "$KMP/acct-01" "$KC_MCP"
+kc_put "$KMP/acct-02" "$KC_MCP"
+printf '%s' "$KMP_TOK" > "$KMP/acct-01/server.token"
+ok1=1
+for _ in $(seq 1 10); do
+  out="$(CLAUDE_ACCOUNTS_DIR="$KMP" FAKE_KEYCHAIN_CLIENT=1 claude 2>&1)"
+  case "$out" in *"CFG=acct-01 TOK=$KMP_TOK"*) ;; *) ok1=0; break ;; esac
+done
+[ "$ok1" = 1 ] && t_ok "an MCP-only Keychain item leaves the account to its token, which is exported" \
+  || t_fail "MCP-only keychain item + token" "got: $(printf '%s' "$out" | head -c 160)"
+out="$(CLAUDE_ACCOUNTS_DIR="$KMP" claude-accounts list --json 2>&1)"
+python3 - "$out" <<'EOF2'
+import json, sys
+rows = {a['id']: a for a in json.loads(sys.argv[1])['accounts']}
+for aid in ('acct-01', 'acct-02'):
+    c = rows[aid]['credentials']
+    assert c['oauth'] is False and c['oauth_store'] is None and c['keychain'] is None, (aid, c)
+assert rows['acct-01']['selectable'] is True, rows['acct-01']
+assert rows['acct-02']['status'] == 'missing' and rows['acct-02']['needs_login'] is True, rows['acct-02']
+EOF2
+[ $? -eq 0 ] && t_ok "list --json: an MCP-only Keychain item is no oauth login" \
+  || t_fail "MCP-only keychain list --json" "see assertions above"
+out="$(CLAUDE_ACCOUNTS_DIR="$KMP" python3 "$REPO_DIR/lib/keychain.py" probe "$KMP/acct-02" 2>&1)"
+check "keychain.py probe names the item nologin" '"state": "nologin"' "$out"
+case "$out" in *mcp-*) t_fail "keychain probe output" "an MCP token reached stdout" ;;
+  *) t_ok "keychain probe output carries no MCP token" ;; esac
+# An auth park heals on a newer Keychain LOGIN, never on a newer item holding MCP state.
+printf '%s\nreason=auth-error marked_at=t detail=test\n' "$now" > "$KMP/acct-01/.expired"
+touch -t 202001010101 "$KMP/acct-01/server.token"
+touch -t 202001010202 "$KMP/acct-01/.expired"
+kc_put "$KMP/acct-01" "$KC_MCP"                              # rewritten after the park
+out="$(CLAUDE_ACCOUNTS_DIR="$KMP" claude 2>&1)"
+[ -f "$KMP/acct-01/.expired" ] && t_ok "a newer MCP-only Keychain item does not heal an auth park" \
+  || t_fail "keychain MCP-only heal" ".expired was removed by an MCP-only item"
+check "...and the parked account is not run" "CFG=none" "$out"
+kc_put "$KMP/acct-01" "$(printf '{"claudeAiOauth":{"accessToken":"sk-ant-oat01-kmlogin","refreshToken":"r","expiresAt":9999999999999,"refreshTokenExpiresAt":9999999999999},%s' "${KC_MCP#?}")"
+CLAUDE_ACCOUNTS_DIR="$KMP" claude >/dev/null 2>&1
+[ ! -f "$KMP/acct-01/.expired" ] && t_ok "a newer Keychain login heals it" \
+  || t_fail "keychain login heal" ".expired survived a newer keychain login"
+# The refresher writes the rotated login INTO the item: its MCP state stays.
+kc_put "$KMP/acct-03" "$(printf '{"claudeAiOauth":{"accessToken":"sk-ant-oat01-kmstale","refreshToken":"sk-ant-ort01-km","expiresAt":1000,"refreshTokenExpiresAt":9999999999999},%s' "${KC_MCP#?}")"
+out="$(CLAUDE_ACCOUNTS_DIR="$KMP" CLAUDE_MULTIACC_TOKEN_URL="file://$WORK/token-ok.json" \
+  CLAUDE_MULTIACC_USAGE_URL="file://$WORK/usage-low.json" claude-accounts limits --force 2>&1)"
+check "a Keychain login beside MCP state refreshes" "acct-03: oauth access token refreshed" "$out"
+kc_secret "$KMP/acct-03" | python3 -c '
+import json, sys
+doc = json.load(sys.stdin)
+assert doc["claudeAiOauth"]["accessToken"] == "sk-ant-oat01-refreshednew", doc["claudeAiOauth"]
+assert doc["mcpOAuth"]["higgsfield|0123456789abcdef"]["refreshToken"] == "mcp-refresh-kc", doc
+' && t_ok "the Keychain write-back keeps the item's MCP state" \
+  || t_fail "keychain refresh clobbered MCP state" "item: $(kc_secret "$KMP/acct-03" | head -c 80)"
+[ "$(kc_secret "$KMP/acct-02")" = "$KC_MCP" ] && [ ! -f "$KMP/acct-02/.expired" ] \
+  && t_ok "the limits pass leaves an MCP-only item alone and parks nothing" \
+  || t_fail "limits on an MCP-only keychain item" "item: $(kc_secret "$KMP/acct-02" | head -c 80)"
+# A login stranded under another name (a USER-less sign-in, older) moves INTO the item a
+# later client filed MCP state under the canonical name.
+security delete-generic-password -a "$KC_ME" -s "Claude Code-credentials-$(kc_hash "$KMP/acct-02")" >/dev/null 2>&1
+kc_put "$KMP/acct-02" "$KC_LIVE" unknown
+kc_put "$KMP/acct-02" "$KC_MCP"
+out="$(CLAUDE_ACCOUNTS_DIR="$KMP" CLAUDE_MULTIACC_USAGE_URL="file://$WORK/usage-low.json" claude-accounts limits --force 2>&1)"
+check "the limits pass moves a stranded login beside MCP state" "acct-02: Keychain login moved under $KC_ME" "$out"
+kc_secret "$KMP/acct-02" | python3 -c '
+import json, sys
+doc = json.load(sys.stdin)
+assert doc["claudeAiOauth"]["accessToken"] == "sk-ant-oat01-slive", doc["claudeAiOauth"]
+assert doc["mcpOAuth"]["higgsfield|0123456789abcdef"]["refreshToken"] == "mcp-refresh-kc", doc
+' && [ "$(kc_items "$KMP/acct-02")" = "$KC_ME" ] \
+  && t_ok "...into the item, MCP state kept, the stranded copy gone" \
+  || t_fail "keychain move into MCP item" "items: $(kc_items "$KMP/acct-02" | tr '\n' ' ')"
+rm -rf "$KMP"
+
 export CLAUDE_MULTIACC_KEYCHAIN=0
 unset FAKE_KEYCHAIN_DIR
 
@@ -8500,6 +9339,9 @@ case "$verb" in
       -e "s/#{pane_current_command}/${FAKE_TMUX_PANE_CMD:-zsh}/g" \
       -e "s/#{pane_in_mode}/${FAKE_TMUX_PANE_MODE:-0}/g" \
       -e "s/#{synchronize-panes}/${FAKE_TMUX_PANE_SYNC:-0}/g" ;;
+  capture-pane)
+    # the pane's screen: what the fake TUI drew (FAKE_TMUX_SCREEN), else a blank one
+    [ -n "${FAKE_TMUX_SCREEN:-}" ] && cat "$FAKE_TMUX_SCREEN" 2>/dev/null ;;
   send-keys)
     lit=0
     while [ $# -gt 0 ]; do
@@ -9005,10 +9847,53 @@ grep -q '^depth=2$' "$st" 2>/dev/null && grep -q '^chain=CarryTst$' "$st" \
   && grep -q "^avoid=acct-01:$((nowc + 18000))\$" "$st" && grep -q '^cwd=/.*/ar-work dir$' "$st" \
   && t_ok "AR carry: the next watcher inherits depth, chain, AVOID and the session's cwd" \
   || t_fail "AR carry: state file" "$(cat "$st" 2>/dev/null)"
+grep -q '^via=login$' "$st" 2>/dev/null \
+  && t_ok "AR state: it names the credential the run carries (the login: via=login)" \
+  || t_fail "AR state: via=login" "$(grep '^via' "$st" 2>/dev/null)"
 [ "$(grep -c 'autoresume relaunch chain=CarryTst from=acct-01 class=model depth=2$' "$ARC/selection.log")" = 1 ] \
   && t_ok "AR carry: the relaunch is logged once, not again by the re-entry" \
   || t_fail "AR carry: relaunch log" "$(grep autoresume "$ARC/selection.log")"
 ar_reap "$ARC"
+# ...and the portable token when the run carries it: an auth verdict its watcher meets in
+# any session of that run (the client switches a run's session on /clear) is the token's.
+ar_claude_pool
+rm -f "$ARC/acct-01/.credentials.json" "$ARC/acct-02/.credentials.json"
+printf '%s' sk-ant-oat01-ARVIATOKEN > "$ARC/acct-01/server.token"
+printf '%s\n' "$(printf '%s' sk-ant-oat01-ARVIATOKEN | { shasum -a 256 2>/dev/null || sha256sum; } | cut -d ' ' -f1)" \
+  > "$ARC/acct-01/.server-token-verified"
+out="$(cd "$ARH" && env "${AREC[@]}" CLAUDE_MULTIACC_PYTHON="$ARB/stub-python" FAKE_STUB_PY_LOG="$ARB/stub.log" \
+  claude --dangerously-skip-permissions </dev/null 2>&1)"
+check "AR state: a run on the portable token" "CFG=acct-01 TOK=sk-ant-oat01-ARVIATOKEN" "$out"
+st="$(ls "$ARC/tmp/autoresume/"*.state 2>/dev/null | head -1)"
+grep -q '^via=token$' "$st" 2>/dev/null \
+  && t_ok "AR state: ...names it (via=token)" \
+  || t_fail "AR state: via=token" "$(grep '^via' "$st" 2>/dev/null)"
+ar_reap "$ARC"
+
+# ---- AR11b. a relaunch keeps its session's model on a Fable-spent account -----------------
+# An unpinned run on an account whose Fable bucket is full gets the fallback model pinned (9a4).
+# A relaunch names the model its session last ran on, which --resume restores: only a session
+# that IS on Fable is pinned off it; an Opus one resumes on its own model, not the fallback.
+ar_claude_pool
+nowc="$(date +%s)"
+printf '{"fetched_at":%s,"weekly_percent":5,"session_percent":10,"max_percent":100,"buckets":[%s]}' "$nowc" \
+  '{"name":"session","percent":10},{"name":"weekly_all","percent":5},{"name":"weekly_scoped:Fable","percent":100}' \
+  > "$ARC/acct-02/limits.json"
+for case_ in OpusModelTok0123:claude-opus-5-5:keeps FableModelTok012:claude-fable-5-1:falls; do
+  tok="${case_%%:*}"; rest="${case_#*:}"; model="${rest%%:*}"
+  ar_plant "$ARC" "$tok" claude crash acct-01 -- --effort max --resume "$AR_SID" "(claude-multiacc auto-resume) carry on please"
+  printf 'model=%s\n' "$model" >> "$ARC/tmp/autoresume/r-$tok.relaunch"
+  out="$(cd "$ARH" && env "${AREC[@]}" CLAUDE_MULTIACC_PYTHON="$ARB/stub-python" CLAUDE_MULTIACC_HEADROOM_BAND=0 \
+    CLAUDE_MULTIACC_AR="$tok:$AR_SID" claude </dev/null 2>&1)"
+  if [ "${rest#*:}" = keeps ]; then
+    check "AR model: a $model session resumes on its own model on a Fable-spent account" \
+      "CFG=acct-02 TOK=none ARGS=--effort max --resume $AR_SID (claude-multiacc auto-resume) carry on please" "$out"
+  else
+    check "AR model: a $model session on a Fable-spent account gets the fallback model" \
+      "CFG=acct-02 TOK=none ARGS=--model claude-opus-5 --effort max --resume $AR_SID" "$out"
+  fi
+  ar_reap "$ARC"
+done
 
 # ---- AR12. claude relaunch tokens: the auth park, dead tokens, the trust mirror ------------
 # Planted directly (no watcher, no TUI), so each assertion can only come from the relaunch
@@ -9029,6 +9914,30 @@ out="$(cd "$ARH" && env "${AREC[@]}" CLAUDE_MULTIACC_PYTHON="$ARB/stub-python" C
   || t_fail "AR auth token: park" "$(ls -a "$ARC/acct-01" | tr '\n' ' ')"
 check "AR auth token: ...and the run lands on the other account, resuming the session" \
   "CFG=acct-02 TOK=none ARGS=--dangerously-skip-permissions --resume $AR_SID (claude-multiacc auto-resume) carry on please" "$out"
+# The relaunch names the credential the run it left carried (that watcher's state, via=):
+# the session the watcher followed may be one the client switched the run to (/clear,
+# /resume), which no index line names (none here at all). via=token retires the token and
+# its proof; via=login parks the login and keeps the token's proof.
+for v in token:setup-token-invalid login:auth-error; do
+  rm -f "$ARC/acct-01/.expired"
+  echo proof > "$ARC/acct-01/.server-token-verified"
+  ar_plant "$ARC" ViaTok0123456789A claude auth acct-01 -- \
+    --dangerously-skip-permissions --resume "$AR_SID" "(claude-multiacc auto-resume) carry on please"
+  printf 'via=%s\n' "${v%%:*}" >> "$ARC/tmp/autoresume/r-ViaTok0123456789A.relaunch"
+  out="$(cd "$ARH" && env "${AREC[@]}" CLAUDE_MULTIACC_PYTHON="$ARB/stub-python" CLAUDE_MULTIACC_HEADROOM_BAND=0 \
+    CLAUDE_MULTIACC_AR="ViaTok0123456789A:$AR_SID" claude </dev/null 2>&1)"
+  grep -q "reason=${v#*:} " "$ARC/acct-01/.expired" 2>/dev/null \
+    && t_ok "AR auth via=${v%%:*}: the relaunch parks the credential that run carried (${v#*:})" \
+    || t_fail "AR auth via=${v%%:*}" "$(tail -1 "$ARC/acct-01/.expired" 2>/dev/null) / $out"
+  if [ "${v%%:*}" = token ]; then
+    [ ! -f "$ARC/acct-01/.server-token-verified" ] && t_ok "AR auth via=token: ...and drops the token's proof" \
+      || t_fail "AR auth via=token" "the token's .server-token-verified survived"
+  else
+    [ -f "$ARC/acct-01/.server-token-verified" ] && t_ok "AR auth via=login: ...and keeps the token's proof" \
+      || t_fail "AR auth via=login" "the token's .server-token-verified was dropped"
+  fi
+done
+rm -f "$ARC/acct-01/.server-token-verified"
 # Dead tokens: missing, expired (older than 10 min), malformed, a FIFO in its place.
 ar_dead claude "a missing relaunch file" "claude-multiacc: $AR_DEAD_MSG Resume with: claude --resume $AR_SID" \
   CLAUDE_MULTIACC_AR="MissingTok0123456:$AR_SID"
@@ -9110,6 +10019,73 @@ cmp -s "$ARC/acct-01/.claude.json" "$ARB/acct-01.claude.json" \
   || t_fail "AR trust: a plain launch edited .claude.json" "$(cat "$ARC"/acct-0*/.claude.json)"
 ar_reap "$ARC"
 
+# ---- AR13. claude critical memory: restarted and resumed, nothing marked ---------------------
+# claude 2.1.304 shows "Critical memory usage (<size>) — restart and resume with claude
+# --continue" in its footer once its heap passes 2.5 GiB, and writes nothing of it to the
+# transcript; the watcher reads its own pane for it (capture-pane, never a key). A relaunch of
+# class=memory is about the PROCESS: the shim marks nothing and selects as it always does.
+# Planted first (no watcher, no TUI): acct-01 leads on headroom and is the account the session
+# left, and ordinary selection gives it straight back.
+ar_claude_pool
+nowc="$(date +%s)"
+for i in 01:5 02:20; do
+  printf '{"fetched_at":%s,"weekly_percent":%s,"session_percent":10,"max_percent":%s,"buckets":[]}' \
+    "$nowc" "${i#*:}" "${i#*:}" > "$ARC/acct-${i%%:*}/limits.json"
+done
+ar_plant "$ARC" MemTok0123456789AB claude memory acct-01 -- \
+  --dangerously-skip-permissions --resume "$AR_SID" "(claude-multiacc auto-resume) carry on please"
+out="$(cd "$ARH" && env "${AREC[@]}" CLAUDE_MULTIACC_PYTHON="$ARB/stub-python" CLAUDE_MULTIACC_HEADROOM_BAND=0 \
+  CLAUDE_MULTIACC_AR="MemTok0123456789AB:$AR_SID" claude </dev/null 2>&1)"
+check "AR memory token: the relaunch selects normally, the account it left included" \
+  "CFG=acct-01 TOK=none ARGS=--dangerously-skip-permissions --resume $AR_SID (claude-multiacc auto-resume) carry on please" "$out"
+ls -a "$ARC"/acct-0*/ | grep -Eq '^\.(limited|expired)$' \
+  && t_fail "AR memory token: nothing is marked" "$(ls -a "$ARC"/acct-0*/ | tr '\n' ' ')" \
+  || t_ok "AR memory token: nothing is marked on the account it left (no .limited, no .expired)"
+ar_logged "$ARC" 'autoresume relaunch chain=PlantTst from=acct-01 class=memory depth=1$' \
+  && t_ok "AR memory token: the relaunch is logged with its class" \
+  || t_fail "AR memory token: relaunch log" "$(grep autoresume "$ARC/selection.log")"
+ar_reap "$ARC"
+# End to end: the fake TUI draws the banner in its footer; the real watcher (MEMORY_MIN_UPTIME
+# 0 here, a scan every 0.2 s) sees it, stops the client and types the relaunch into the shell.
+# FAKE_TUI_IGNORE_TERM: like the 8.3GB client of 2026-10-20 it ignores SIGTERM, so it is
+# KILLed after TERM_GRACE, and still gets its relaunch. The relaunched client's screen is its
+# own (no banner): it is not restarted again.
+ar_claude_pool
+rm -f "$ARB/screen"
+ar_start FAKE_TUI=memory FAKE_TUI_IGNORE_TERM=1 FAKE_TMUX_SCREEN="$ARB/screen" \
+  CLAUDE_MULTIACC_AR_MEMORY_MIN_UPTIME=0 CLAUDE_MULTIACC_AR_MEMORY_SCAN=0.2 \
+  -- claude --dangerously-skip-permissions "fix the bug please"
+first=$AR_PID
+if ar_wait 40 ar_lines 2 "$ARB/tui.log"; then
+  l1="$(sed -n 1p "$ARB/tui.log")"; l2="$(sed -n 2p "$ARB/tui.log")"
+  from="$(ar_acct_of "$l1")"
+  check "AR memory: resumed in place with the memory reason and its size" \
+    "ARGS=--dangerously-skip-permissions --resume $AR_SID (claude-multiacc auto-resume) This session was restarted automatically because the previous process reached critical memory usage (8.3GB)." "$l2"
+  ar_wait 5 ar_stopped "$first" && t_ok "AR memory: the client that ignored SIGTERM was stopped (KILL)" \
+    || t_fail "AR memory: the client was stopped" "pid $first alive"
+  ar_logged "$ARC" "autoresume detect provider=claude chain=[A-Za-z0-9]+ class=memory code=critical_memory sid=$AR_SID acct=$from reset=- size=8.3GB src=pane" \
+    && ar_logged "$ARC" "autoresume switch provider=claude chain=[A-Za-z0-9]+ from=$from class=memory sid=$AR_SID depth=1 probe=acct-0[12] size=8.3GB" \
+    && ar_logged "$ARC" "autoresume relaunch chain=[A-Za-z0-9]+ from=$from class=memory depth=1\$" \
+    && t_ok "AR memory: detected on the pane, switched, relaunched with class=memory" \
+    || t_fail "AR memory: log lines" "$(grep autoresume "$ARC/selection.log")"
+  ls -a "$ARC"/acct-0*/ | grep -Eq '^\.(limited|expired)$' \
+    && t_fail "AR memory: nothing is marked" "$(ls -a "$ARC"/acct-0*/ | tr '\n' ' ')" \
+    || t_ok "AR memory: no account is marked"
+  grep -q -- "capture-pane -p -J -t %1" "$ARB/tmux/calls" 2>/dev/null \
+    && ar_typed_ok CLAUDE "$AR_SID" "CLAUDE_ACCOUNTS_ROOT=$(cd "$ARC" && pwd)" "$REPO_DIR/bin/claude" \
+    && t_ok "AR memory: the pane was read (capture-pane), and the one line typed is the relaunch" \
+    || t_fail "AR memory: pane reads and the typed line" "$(grep -c capture-pane "$ARB/tmux/calls" 2>/dev/null) / $(cat "$ARB/tmux/typed" 2>/dev/null)"
+  ar_wait 10 ar_logged "$ARC" "autoresume watch provider=claude chain=[A-Za-z0-9]+ pid=[0-9]+ acct=acct-0[12] depth=1\$"
+  sleep 1.5
+  [ "$(grep -c 'autoresume switch' "$ARC/selection.log")" = 1 ] && [ "$(($(wc -l < "$ARB/tui.log")))" = 2 ] \
+    && t_ok "AR memory: the relaunched session, its screen clear, is not restarted again" \
+    || t_fail "AR memory: restarted again" "$(grep autoresume "$ARC/selection.log")"
+else
+  t_fail "AR memory: relaunched within 40 s" "tui=$(cat "$ARB/tui.log" 2>/dev/null) log=$(grep autoresume "$ARC/selection.log" 2>/dev/null)"
+fi
+ar_reap "$ARC"
+ar_no_watcher "$ARC" && t_ok "AR memory: no watcher left running" || t_fail "AR memory: watcher left running"
+
 # ---- AR10. codex: the same machinery through bin/codex ------------------------------------
 ARX="$WORK/ar-codex"
 ar_codex_pool() { # a fresh two-account codex pool sharing one sessions tree (the installed layout)
@@ -9280,6 +10256,12 @@ if [ -x /usr/bin/python3 ] && /usr/bin/python3 -c 'import sys; sys.exit(0 if sys
   else
     t_fail "MCP registry unit suite on stock python" "/usr/bin/python3 tests/test_mcp_registry.py failed"
   fi
+  # ...and so must the MCP OAuth merge the shim runs before exec (lib/mcp_oauth.py ensure).
+  if /usr/bin/python3 "$REPO_DIR/tests/test_mcp_oauth.py" >/dev/null 2>&1; then
+    t_ok "MCP OAuth sharing unit suite on stock python $(/usr/bin/python3 -c 'import sys;print("%d.%d"%sys.version_info[:2])')"
+  else
+    t_fail "MCP OAuth sharing unit suite on stock python" "/usr/bin/python3 tests/test_mcp_oauth.py failed"
+  fi
 fi
 if CLAUDE_MULTIACC_AUTO_RESET=1 python3 -m unittest discover -s "$REPO_DIR/tests" -p 'test_claude_reset*.py'; then
   t_ok "claude: automatic limit-reset integration suite"
@@ -9318,6 +10300,172 @@ else
   t_fail "claude organization recovery report suite" "see unittest output above"
 fi
 
+# MCP OAuth logins shared by every claude account on this machine (lib/mcp_oauth.py):
+# harvest and winner rules, merges under the client's own lock, the Keychain read-back,
+# the refresh grant against a loopback authorization server, forget, and the shim's gate.
+if python3 "$REPO_DIR/tests/test_mcp_oauth.py"; then
+  t_ok "claude: MCP OAuth sharing unit suite"
+else
+  t_fail "claude MCP OAuth sharing unit suite" "see unittest output above"
+fi
+
+# ---- 21. MCP OAuth sharing creates a credentials file for a setup-token account only ---
+# Every reader of .credentials.json — the shim (file_login), the limits pass (oauth_store),
+# the audit, report, verify — counts a document as a login only when it carries
+# claudeAiOauth (9g), so a file holding MCP state alone costs a setup-token account
+# nothing: it is the file its client writes itself once it meets an OAuth server from a
+# session that cannot open the Keychain, and all it has to read MCP logins from. Sharing
+# creates that file (0600, MCP state alone) for an account running on its token; any other
+# account keeps what it has. Own pool and keychain: acct-01 runs on a setup token, acct-02
+# holds the MCP login beside a file login, acct-03's Claude login lives in its Keychain
+# item, acct-04 has a Keychain login and a setup token, and acct-05 runs on a setup token
+# beside the file its client wrote first: a discovery stub, no login in it.
+MOP="$WORK/mcpoauth-pool"
+MOKC="$WORK/mcpoauth-keychain"
+mkdir -p "$MOP/tmp" "$MOP/acct-01" "$MOP/acct-02" "$MOP/acct-03" "$MOP/acct-04" "$MOP/acct-05" "$MOKC"
+: > "$MOP/.limits-kick"
+cat > "$MOP/accounts.json" <<EOF
+{ "version": 1, "threshold": 90,
+  "accounts": [
+    {"id": "acct-01", "email": "mo1@test", "home": "mac", "added_at": "2026-10-19T00:00:00Z"},
+    {"id": "acct-02", "email": "mo2@test", "home": "mac", "added_at": "2026-10-19T00:00:00Z"},
+    {"id": "acct-03", "email": "mo3@test", "home": "mac", "added_at": "2026-10-19T00:00:00Z"},
+    {"id": "acct-04", "email": "mo4@test", "home": "mac", "added_at": "2026-10-19T00:00:00Z"},
+    {"id": "acct-05", "email": "mo5@test", "home": "mac", "added_at": "2026-10-19T00:00:00Z"}
+  ] }
+EOF
+MO_TOK='sk-ant-oat01-MCPSHAREFAKEMCPSHAREFAKEMCPSHAREFAKEMCPSHARE00'
+MO_TOK4='sk-ant-oat01-MCPKCTOKFAKEMCPKCTOKFAKEMCPKCTOKFAKEMCPKCTOK04'
+MO_TOK5='sk-ant-oat01-MCPSTUBFAKEMCPSTUBFAKEMCPSTUBFAKEMCPSTUBFAKE05'
+printf '%s' "$MO_TOK" > "$MOP/acct-01/server.token"
+printf '%s' "$MO_TOK4" > "$MOP/acct-04/server.token"
+printf '%s' "$MO_TOK5" > "$MOP/acct-05/server.token"
+printf '{"mcpOAuth":{"higgsfield|0a1b2c3d4e5f6a7b":{"serverName":"higgsfield","serverUrl":"https://mcp.higgsfield.example/mcp","accessToken":"","discoveryState":{"authorizationServerUrl":"https://clerk.higgsfield.example"}}}}' \
+  > "$MOP/acct-05/.credentials.json"
+out="$(env CLAUDE_ACCOUNTS_DIR="$MOP" FAKE_KEYCHAIN_CLIENT=1 CLAUDE_ACCOUNT=acct-05 claude 2>&1)"
+check "a discovery-stub file beside a setup token: the token is exported" "CFG=acct-05 TOK=$MO_TOK5" "$out"
+mo_exp="$(( ($(date +%s) + 72000) * 1000 ))"
+printf '{"claudeAiOauth":{"accessToken":"sk-ant-oat01-mofile","refreshToken":"r","expiresAt":9999999999999,"refreshTokenExpiresAt":9999999999999},"mcpOAuth":{"higgsfield|0a1b2c3d4e5f6a7b":{"serverName":"higgsfield","serverUrl":"https://mcp.higgsfield.example/mcp","accessToken":"fake-mcp-access-mo","refreshToken":"fake-mcp-refresh-mo","expiresAt":%s,"clientId":"https://claude.ai/oauth/claude-code-client-metadata","discoveryState":{"authorizationServerUrl":"http://auth.example.invalid"}}}}' \
+  "$mo_exp" > "$MOP/acct-02/.credentials.json"
+mo_env() { env CLAUDE_ACCOUNTS_DIR="$MOP" CLAUDE_MULTIACC_KEYCHAIN=1 FAKE_KEYCHAIN_DIR="$MOKC" "$@"; }
+mo_svc() { printf 'Claude Code-credentials-%s' "$(printf '%s' "$MOP/$1" | { shasum -a 256 2>/dev/null || sha256sum; } | cut -c1-8)"; }
+for a in acct-03 acct-04; do
+  mo_env security add-generic-password -U -a "${USER:-$(id -un)}" -s "$(mo_svc "$a")" \
+    -X "$(printf '{"claudeAiOauth":{"accessToken":"sk-ant-oat01-mokc%s","refreshToken":"r","expiresAt":9999999999999,"refreshTokenExpiresAt":9999999999999}}' "${a#acct-}" \
+          | python3 -c 'import sys;print(sys.stdin.buffer.read().hex())')"
+done
+mo_limits() { mo_env CLAUDE_MULTIACC_MCP_OAUTH=0 CLAUDE_MULTIACC_USAGE_URL="file://$WORK/usage-low.json" "$@" claude-accounts limits 2>&1; }
+out="$(mo_limits)"
+check "MCP sharing: the Keychain logins report before any sync" "acct-03: ok" "$out"
+check "...the one beside a setup token too" "acct-04: ok" "$out"
+out="$(mo_env claude-accounts mcp auth-sync 2>&1)"
+check "MCP sharing: auth-sync shares the login" "higgsfield [higgsfield|0a1b2c3d4e5f6a7b]: login from acct-02 (file)" "$out"
+mo_mcp_only() { # $1 acct: its .credentials.json is MCP state alone (the shared login), 0600
+  python3 - "$MOP/$1/.credentials.json" <<'EOF'
+import json, os, stat, sys
+doc = json.load(open(sys.argv[1]))
+assert list(doc) == ['mcpOAuth'], list(doc)
+assert doc['mcpOAuth']['higgsfield|0a1b2c3d4e5f6a7b']['refreshToken'] == 'fake-mcp-refresh-mo', doc
+assert stat.S_IMODE(os.stat(sys.argv[1]).st_mode) == 0o600
+EOF
+}
+mo_mcp_only acct-01 && mo_mcp_only acct-04 \
+  && t_ok "MCP sharing creates a .credentials.json holding MCP state alone for each setup-token account" \
+  || t_fail "MCP sharing: the setup-token accounts' files" "$(ls -a "$MOP/acct-01" "$MOP/acct-04" | tr '\n' ' ')"
+[ ! -e "$MOP/acct-03/.credentials.json" ] \
+  && t_ok "...and none for an account whose login is in its Keychain item" \
+  || t_fail "MCP sharing created a file beside a Keychain login" "$(head -c 120 "$MOP/acct-03/.credentials.json")"
+for a in acct-03 acct-04; do
+  mo_env security find-generic-password -a "${USER:-$(id -un)}" -s "$(mo_svc "$a")" -w 2>/dev/null \
+    | python3 -c 'import json,sys; d=json.load(sys.stdin); assert d["claudeAiOauth"]["accessToken"]=="sk-ant-oat01-mokc'"${a#acct-}"'", d.keys(); assert "higgsfield|0a1b2c3d4e5f6a7b" in d["mcpOAuth"]' 2>/dev/null \
+    && t_ok "MCP sharing merges into $a's existing Keychain item and keeps its login" \
+    || t_fail "MCP sharing keychain merge ($a)" "item missing the shared login or lost its own"
+done
+# The setup-token account keeps running on its token, beside the file it was given; a
+# client that needs a login (FAKE_KEYCHAIN_CLIENT) would say "Not logged in" without one.
+for i in 1 2; do
+  out="$(mo_env FAKE_KEYCHAIN_CLIENT=1 CLAUDE_ACCOUNT=acct-01 claude 2>&1)"
+  check "setup-token account still exports its token beside its MCP-only file (launch $i)" \
+    "CFG=acct-01 TOK=$MO_TOK" "$out"
+done
+out="$(mo_env claude-accounts list 2>&1)"
+case "$(printf '%s\n' "$out" | grep '^acct-01')" in
+  *"auth=token "*) t_ok "list shows auth=token for the setup-token account beside its MCP-only file" ;;
+  *) t_fail "list auth column beside an MCP-only file" "$(printf '%s\n' "$out" | grep '^acct-01')" ;;
+esac
+out="$(mo_env claude-accounts list --json 2>&1)"
+python3 - "$out" <<'EOF'
+import json, sys
+rows = {a['id']: a for a in json.loads(sys.argv[1])['accounts']}
+c = rows['acct-01']['credentials']
+assert c['oauth'] is False and c['oauth_store'] is None, c
+assert rows['acct-01']['credential_class'] == 'portable' and rows['acct-01']['selectable'] is True
+c = rows['acct-04']['credentials']
+assert c['oauth'] is True and c['oauth_store'] == 'keychain' and c['token'] is True, c
+EOF
+[ $? -eq 0 ] && t_ok "list --json: an MCP-only file is no login (token: portable; Keychain login: keychain)" \
+  || t_fail "list --json beside created MCP files" "see assertions above"
+# The account with a Keychain login AND a token, in a session that can open the Keychain:
+# it runs on that login, and its telemetry comes from it, as before the file existed.
+out="$(mo_env FAKE_KEYCHAIN_CLIENT=1 CLAUDE_ACCOUNT=acct-04 claude 2>&1)"
+check "a Keychain login beside a created MCP file runs on that login (Keychain readable)" \
+  "CFG=acct-04 TOK=none" "$out"
+rm -f "$MOP/acct-03/limits.json" "$MOP/acct-04/limits.json"
+out="$(mo_limits)"
+check "MCP sharing: the Keychain login still reports after a sync" "acct-03: ok" "$out"
+check "...and the one beside its token and created MCP file" "acct-04: ok" "$out"
+mo_kc_alive() { # $1 acct: not parked, its telemetry from its OAuth login
+  [ ! -f "$MOP/$1/.expired" ] \
+    && python3 -c 'import json,sys; d=json.load(open(sys.argv[1])); assert d.get("source")=="oauth", d' \
+         "$MOP/$1/limits.json" 2>/dev/null
+}
+mo_kc_alive acct-03 && mo_kc_alive acct-04 \
+  && t_ok "a Keychain login beside a shared MCP login is neither parked nor dark" \
+  || t_fail "Keychain logins after MCP sharing" "$(cat "$MOP"/acct-0[34]/.expired 2>/dev/null)"
+# ...and in a session that cannot open it (ssh, tmux): the token runs, nothing is parked,
+# nothing is called dead, and the readings the readable session took stand.
+cp "$MOP/acct-04/limits.json" "$WORK/mo-limits4.json"
+out="$(mo_env FAKE_KEYCHAIN_LOCKED=1 FAKE_KEYCHAIN_CLIENT=1 CLAUDE_ACCOUNT=acct-04 claude 2>&1)"
+check "with the Keychain locked, that account runs on its token (its client reads the MCP file)" \
+  "CFG=acct-04 TOK=$MO_TOK4" "$out"
+out="$(mo_limits FAKE_KEYCHAIN_LOCKED=1)"
+check "a locked Keychain login is left for the next pass, its token never spent" \
+  "acct-04: oauth credential not usable this pass" "$out"
+{ [ ! -f "$MOP/acct-03/.expired" ] && [ ! -f "$MOP/acct-04/.expired" ] \
+    && cmp -s "$WORK/mo-limits4.json" "$MOP/acct-04/limits.json"; } \
+  && t_ok "...parked nowhere, and its telemetry kept" \
+  || t_fail "locked Keychain logins after MCP sharing" "$(cat "$MOP"/acct-0[34]/.expired 2>/dev/null)"
+out="$(mo_env FAKE_KEYCHAIN_LOCKED=1 claude-accounts list 2>&1)"
+check "list, locked: the Keychain login is locked here, not missing" "KEYCHAIN-LOCKED-HERE" \
+  "$(printf '%s\n' "$out" | grep '^acct-03')"
+case "$(printf '%s\n' "$out" | grep '^acct-04')" in
+  *EXPIRED*|*NO-LOGIN*|*INVALID*) t_fail "list, locked, acct-04" "$(printf '%s\n' "$out" | grep '^acct-04')" ;;
+  *"auth=keychain+token"*) t_ok "list, locked: the token account beside it reads keychain+token, nothing dead" ;;
+  *) t_fail "list, locked, acct-04" "$(printf '%s\n' "$out" | grep '^acct-04')" ;;
+esac
+out="$(mo_env claude-accounts mcp auth-status 2>&1)"
+check "auth-status: only the Keychain-login account has no file" "absent acct-03" "$out"
+# The setup-token account whose client wrote its file first got the shared login merged
+# into that stub, and keeps exporting its token.
+python3 - "$MOP/acct-05/.credentials.json" <<'EOF'
+import json, sys
+doc = json.load(open(sys.argv[1]))
+assert list(doc) == ['mcpOAuth'], list(doc)
+assert doc['mcpOAuth']['higgsfield|0a1b2c3d4e5f6a7b']['refreshToken'] == 'fake-mcp-refresh-mo', doc
+EOF
+[ $? -eq 0 ] && t_ok "the shared login is merged into that existing stub file" \
+  || t_fail "merge into a stub file" "$(head -c 200 "$MOP/acct-05/.credentials.json")"
+for i in 1 2; do
+  out="$(mo_env FAKE_KEYCHAIN_CLIENT=1 CLAUDE_ACCOUNT=acct-05 claude 2>&1)"
+  check "...and that account still exports its token (launch $i)" "CFG=acct-05 TOK=$MO_TOK5" "$out"
+done
+out="$(mo_env claude-accounts list 2>&1)"
+case "$(printf '%s\n' "$out" | grep '^acct-05')" in
+  *"auth=token "*) t_ok "...and list shows it auth=token" ;;
+  *) t_fail "list auth column beside a merged stub file" "$(printf '%s\n' "$out" | grep '^acct-05')" ;;
+esac
+rm -rf "$MOP" "$MOKC" "$WORK/mo-limits4.json"
+
 # ---- summary ---------------------------------------------------------------------
 echo
 echo "passed: $PASS  failed: $FAIL"