claude-usage-limits 1.40.2 → 1.40.4

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "usage-limits",
   "displayName": "Usage Limits",
-  "version": "1.40.2",
+  "version": "1.40.4",
   "description": "Puts your remaining Claude Code usage limit into Claude's context before every prompt, so it opens with what fits in the budget instead of starting work that gets cut off. Reports headroom as turns rather than percentages, prices a job before you start it, and detects your plan tier.",
   "author": {
     "name": "Ridelink",

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "usage-limits",
-  "version": "1.40.2",
+  "version": "1.40.4",
   "description": "Reports how much of your Codex usage limit is left as turns of work rather than a percentage, prices a job before you start it, and counts the other agents sharing the same budget.",
   "author": {
     "name": "Ridelink",

package/README.md

@@ -393,20 +393,20 @@ relayed run either.
 At the wall with weekly headroom, the line looks like this:
 
 ```
-If the wall offers it, /low-priority carries this session past the 5-hour limit
-at lower priority instead of stopping: it spends the weekly limit, which is at
-45% and so has room, and replies may pause while it waits for spare capacity -
-the wait and its ceiling are set by the server per request. It is a toggle: you
-type it yourself and run it again to stop, and nothing here can switch it on
-for you.
+If the wall offers it, /low-priority can carry this session past the 5-hour
+limit at lower priority instead of stopping: it spends the weekly limit, which
+is at 45% and so has room, and replies may pause while it waits for spare
+capacity - the wait and its ceiling are set by the server per request. It is a
+toggle only the user can type, and type again to stop: you cannot run a slash
+command, and nothing here can switch it on.
 ```
 
 **The recommendation has a number behind it.** It is offered only while the
 weekly is at or below **80 per cent** and the 5-hour window is the binding wall.
 Above that the brief actively says not to, and cites the figure: low-priority
 spends the weekly *and* draws on a weekly allowance whose size is exposed to no
-hook and no file, and a real user measured it emptying most of a week in a
-couple of hours. No wait time is ever printed, because the retry and the ceiling
+hook and no file, and one user has reported it burning through almost a week of
+usage in a couple of hours (anthropics/claude-code#92544). No wait time is ever printed, because the retry and the ceiling
 come from `lowPriorityRetryAfterSeconds` and `lowPriorityMaxWaitSeconds` on each
 response — any fixed "20 seconds, 20 minutes" would be invented.
 
@@ -418,6 +418,13 @@ would fire into a session that never stopped. A weekly wall still arms. The
 acknowledgement lapses by itself when the 5-hour window it was made against
 resets.
 
+A deferral is different from a wake, and is treated differently. `defer` is a
+time **you** named, so it is always scheduled — but if you defer to `reset` while
+low-priority is acknowledged, the confirmation says that this session carries
+past the 5-hour reset and waiting for it buys nothing. The mid-turn pulse follows
+the brief onto the weekly too, out of the same function, so the two can never
+report different windows.
+
 **The graceful wrap-up note.** Claude Code can inject its own "finish up"
 instruction at the wall. The mechanism is real, and the gate is
 `tengu_lantern_wick_mode` — the bundle's own normalizer keeps only `"wrap-up"`
@@ -435,13 +442,19 @@ wake. So when a resume relay is armed and this is on, the brief says so: the
 wake is the route for a session that will be **closed** at the reset, and both
 firing for the same reset would start the work twice and spend the weekly twice.
 
-**`/limit-reset`**, the once-weekly manual session reset, is detected but not
-built on: this account holds no grant (`tengu_cedar_ember` absent,
-`cachedUsageUtilization.cedar_ember` null), so a feature resting on it would be
-untestable. If a grant appears, the brief names it at the wall, says it only
-works while you are actually at a limit, and says the work it unlocks still
-spends the weekly. It never reports how many are left — `resets_left` comes from
-a live endpoint and appears in no file a hook can read.
+**`/limit-reset`** is one command behind two different server flags, and the
+brief words each in its own copy's terms. `tengu_nifty_lemur` is the
+once-a-week reset of the 5-hour session limit ("uses weekly limit · 1/week",
+"your weekly limit still applies"); `tengu_cedar_ember` is a counted grant with
+a use-by date that "refills your limits". The account this was built on carries
+`tengu_nifty_lemur` enabled and no `tengu_cedar_ember`. When the budget is tight
+and the 5-hour window is the wall, the brief names the weekly reset, says the
+work it unlocks still counts toward the weekly, and says only the user can type
+it; at a weekly wall it says nothing, because resetting the 5-hour limit cannot
+help there. It never reports whether this week's reset is used or how many
+grants are left — both come from a live endpoint and appear in no file a hook
+can read. A flag counts only when it is a plain object with `enabled: true`,
+the way the CLI reads it.
 
 **Grace is not weekly spend.** The allowance the wall gives you is metered in
 its own per-window meters (`anthropic-ratelimit-unified-grace-5h-utilization`
@@ -1295,7 +1308,7 @@ test/                             node --test, no dependencies
 node --test
 ```
 
-895 tests over the pricing, the window arithmetic, plan and credit detection,
+901 tests over the pricing, the window arithmetic, plan and credit detection,
 the status line, the before-prompt line, the mid-turn pulse, the after-reply tally and the session history, job forecasting,
 per-project attribution, the Codex reader and its installer, the CLI,
 packaging, the settings save/restore, and what Claude Code's own wall-time

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-usage-limits",
-  "version": "1.40.2",
+  "version": "1.40.4",
   "description": "Puts your remaining Claude Code usage limit into Claude's context before every prompt, so it opens with what fits in the budget instead of starting work that gets cut off. Reports headroom as turns rather than percentages, prices a job before you start it, and detects your plan tier.",
   "keywords": [
     "claude",

package/skills/usage-limits/SKILL.md

@@ -625,10 +625,11 @@ longer stops at. **Record it only when they said so.** Whether it is running is
 in the CLI's process memory and readable nowhere, so nothing here may infer it,
 and `mode --low-priority off` is how it is taken back.
 
-The same applies to `/limit-reset`, the once-weekly manual session reset: the
-line names it only if a grant is actually readable, it only works while you are
-at a limit, the work it unlocks still spends the weekly, and how many are left is
-not knowable from here.
+The same applies to `/limit-reset`, the manual reset: only the user can type
+it. The line names it only when the account's flags say it is set up. The
+once-a-week kind resets the 5-hour limit and its work still counts toward the
+weekly, so it is named only at a 5-hour wall; whether this week's is already
+used, and how many of the counted kind are left, is not knowable from here.
 
 And if the budget line says Claude Code is injecting its own wrap-up note at this
 wall, follow that note: it is more specific than anything here, and two

package/skills/usage-limits/scripts/brief.js

@@ -1028,53 +1028,99 @@ function briefText(input) {
   // style drops only what reads the same every turn. This does not.
   const lp = parts.lowPriority || null;
   let lowPrioritySentence = null;
-  if (lp && lp.state === 'acknowledged') {
+  // The acknowledged sentence describes the SWAP, so it may only be said when
+  // the swap really happened. wallFeatures refuses to swap unless there is a
+  // weekly window with a live percentage and a known reset, and this branch
+  // used to fire on the acknowledgement alone - so on an account with no
+  // readable weekly the brief said "binding window is 5-hour 99% used" in one
+  // clause and "the figures above are the weekly" in the next. A line that
+  // contradicts the numbers printed beside it is worse than no line: it tells
+  // the model to ignore a wall that is still there.
+  if (lp && lp.state === 'acknowledged' && lp.weeklyBinding) {
     lowPrioritySentence = (
-      'You have said /low-priority is on, so the brake is the weekly window and not the 5-hour one: ' +
+      'The user has said /low-priority is on, so the brake is the weekly window and not the 5-hour one: ' +
         (Number.isFinite(lp.fiveHourPercent)
           ? 'the 5-hour limit is at ' + lp.fiveHourPercent + '% and no longer stops this session, '
           : 'the 5-hour limit no longer stops this session, ') +
         'the figures above are the weekly, and replies may pause while lower priority waits for spare ' +
-        'capacity. Whether it is still on cannot be read from here, so if it has ended say so with ' +
-        'usage-mode --low-priority off and the 5-hour wall counts again. It also draws on a separate ' +
+        'capacity. Whether it is still on cannot be read from here, so if the user says it has ended, ' +
+        'record that with usage-mode --low-priority off and the 5-hour wall counts again. It also draws on a separate ' +
         'weekly lower-priority allowance that is exposed to no hook and no file, so nothing here can ' +
         'track how much of that is left.'
     );
+  } else if (lp && lp.state === 'acknowledged') {
+    // Acknowledged, but there is no weekly reading to brake on, so the figures
+    // above are still the window they say they are and the wall is still real.
+    lowPrioritySentence = (
+      'The user has said /low-priority is on, which spends the weekly limit instead of stopping at the ' +
+        '5-hour one - but there is no usable weekly reading here to brake on, so the figures above are ' +
+        'the window named beside them and that window is still the one to plan against. /usage (the ' +
+        'user types it) refreshes the account snapshot; until it has a weekly, treat the limit above as real.'
+    );
   } else if (lp && lp.advise && lp.advise.kind === 'offer') {
     lowPrioritySentence = (
-      'If the wall offers it, /low-priority carries this session past the 5-hour limit at lower ' +
+      'If the wall offers it, /low-priority can carry this session past the 5-hour limit at lower ' +
         'priority instead of stopping: it spends the weekly limit, which is at ' +
         lp.advise.weeklyPercent + '% and so has room, and replies may pause while it waits for spare ' +
-        'capacity - the wait and its ceiling are set by the server per request. It is a toggle: you ' +
-        'type it yourself and run it again to stop, and nothing here can switch it on for you. Say ' +
-        'in one line that it is there; if it is taken, usage-mode --low-priority on is what makes ' +
-        'this line brake on the weekly instead.'
+        'capacity - the wait and its ceiling are set by the server per request. It is a toggle only ' +
+        'the user can type, and type again to stop: you cannot run a slash command, and nothing here ' +
+        'can switch it on. Tell the user in one line that it is there; if the user says it is taken, ' +
+        'usage-mode --low-priority on is what makes this line brake on the weekly instead.'
     );
   } else if (lp && lp.advise && lp.advise.kind === 'hold') {
     lowPrioritySentence = (
       'The wall may offer /low-priority here, and it is not worth taking: it spends the weekly limit, ' +
         'which is already at ' + lp.advise.weeklyPercent + '% - past the ' + lp.advise.threshold +
         ' per cent this plugin will recommend it at - and it draws on a weekly lower-priority ' +
-        'allowance as well, which has been measured emptying most of a week in a couple of hours. ' +
-        'Say in one line that the answer is no and why; waiting out the 5-hour reset is the cheaper move.'
+        'allowance as well, which one user has reported burning through almost a week of usage in a ' +
+        'couple of hours. The choice is the user\'s, and only the user can type it: say in one line ' +
+        'that this plugin advises against it and why; waiting out the 5-hour reset is the cheaper move.'
     );
   }
   if (lowPrioritySentence) sentences.push(lowPrioritySentence);
-  // A manual session reset, if this account ever gets one.
+  // A manual reset behind /limit-reset, when this account holds one.
+  //
+  // Two server flags sit behind the one command and they are different offers,
+  // so each is worded in its own copy's terms and nothing is borrowed across
+  // (lowpri.sessionReset has the bundle strings):
+  //
+  //   'weekly' (tengu_nifty_lemur, which this account has): resets the 5-hour
+  //   session limit, once a week, and the work still counts toward the weekly.
+  //   So it only helps when the 5-hour window is the wall - said at a weekly
+  //   wall it would be advice that cannot work - and the first build, reading
+  //   only the other flag, never said it at all.
   //
-  // /limit-reset refills the 5-hour window, works only AT a limit, and is once a
-  // week - and the work it unlocks still spends the weekly, which is the part
-  // worth saying out loud. This account holds no grant today
-  // (tengu_cedar_ember absent, cachedUsageUtilization.cedar_ember null), so the
-  // sentence is a detector rather than a feature: nothing is claimed about how
-  // many resets are left, because resets_left is served by a live endpoint and
-  // appears in no file a hook can read.
-  if (lp && lp.resetGrant && (parts.pressure === 'tight' || parts.pressure === 'gone')) {
+  //   'grant' (tengu_cedar_ember): a counted reset with a use-by date that
+  //   "refills your limits". Its copy does not say it spends the weekly, and it
+  //   has an early-use path, so neither "once a week" nor "only at a limit" is
+  //   claimed for it.
+  //
+  // Neither is counted: whether this week's reset is already used, and how
+  // many grants are left, are served by the API and appear in no file. And the
+  // CLI refuses a reset while lower priority runs ("Resets can't be used while
+  // you continue at lower priority"), which is why the weekly variant stays
+  // silent once the brief has swapped to the weekly, and the grant says so.
+  const resetVariant = lp && lp.resetGrant ? lp.resetVariant || 'grant' : null;
+  const resetPressure = parts.pressure === 'tight' || parts.pressure === 'gone';
+  const fiveHourWall = Boolean(parts.binding && parts.binding.key === 'five_hour');
+  // Acknowledged is checked on its own as well as through the binding: with no
+  // weekly reading the brief cannot swap, the 5-hour window stays binding, and
+  // the reset would be offered to a session the CLI will not reset.
+  if (resetVariant === 'weekly' && resetPressure && fiveHourWall && lp.state !== 'acknowledged') {
+    sentences.push(
+      'This account is set up for a manual session reset (/limit-reset): once a week it resets the ' +
+        '5-hour limit, and the work it unlocks still counts toward the weekly, so it moves the 5-hour ' +
+        'wall rather than adding budget. The server decides whether it can be used right now, and ' +
+        "whether this week's is already used is not readable from here. Like /low-priority, only the user can type " +
+        'it; you cannot run a slash command.'
+    );
+  } else if (resetVariant === 'grant' && resetPressure) {
     sentences.push(
-      'A once-weekly manual session reset appears to be available on this account (/limit-reset). It ' +
-        'only works while you are actually AT a limit, and the work it unlocks still spends the weekly, ' +
-        'so it moves the 5-hour wall rather than adding budget. How many are left is not readable from ' +
-        'here - the CLI asks the server for that. It is yours to type, like /low-priority.'
+      'This account appears to hold a limit reset (/limit-reset), which the CLI describes as refilling ' +
+        'your limits while the weekly reset day stays put. How many are left and until when is not ' +
+        'readable from here - the CLI asks the server for that.' +
+        (lp.state === 'acknowledged' ? ' The CLI will not use one while lower priority is on.' : '') +
+        ' Like /low-priority, only the user can type it; you cannot run a slash command.'
     );
   }
   if (parts.session) {
@@ -1524,9 +1570,17 @@ function wallFeatures(now, binding, windows, hostName) {
       if (weekly && Number.isFinite(weekly.percentUsed) && !weekly.stale && Number.isFinite(weekly.resetsAt)) {
         out.binding = weekly;
         out.swapped = true;
-        out.lowPriority = Object.assign({}, info, { weeklyBinding: true });
       }
     }
+    // Whether the weekly really is the window the figures describe, which is
+    // what the acknowledged sentence claims. True when the swap just happened
+    // AND when the weekly was already binding on its own - the 5-hour window
+    // reading low is the ordinary case for a session that has been running at
+    // lower priority for a while. False when there was no weekly to brake on,
+    // and then the sentence has to say so instead of claiming otherwise.
+    out.lowPriority = Object.assign({}, info, {
+      weeklyBinding: Boolean(out.binding && out.binding.key === 'seven_day'),
+    });
   } catch (err) {
     // Nothing about these features is worth a failed prompt.
   }

package/skills/usage-limits/scripts/defer.js

@@ -140,7 +140,10 @@ function confirmation(parts) {
   const tail = [];
   tail.push('Nothing has been started');
   if (parts.items) tail.push(parts.items + ' saved');
-  if (parts.resetNote) tail.push(parts.resetNote);
+  // Every note, not only the first: two can apply at once.
+  for (const note of parts.notes && parts.notes.length ? parts.notes : [parts.resetNote]) {
+    if (note) tail.push(note);
+  }
   return line + tail.join('; ') + '. Run "defer cancel" to call it off.';
 }
 
@@ -154,7 +157,7 @@ function bindingReset(now) {
     usage.setHost(host.detect(process.argv.slice(2), process.env));
     const collected = usage.collect(now);
     const utilization = collected && collected.utilization;
-    if (!utilization) return { resetsAt: null, percent: null };
+    if (!utilization) return { resetsAt: null, percent: null, windowKey: null };
     let worst = null;
     for (const key of Object.keys(utilization)) {
       const window = utilization[key];
@@ -163,12 +166,24 @@ function bindingReset(now) {
       if (!Number.isFinite(percent)) continue;
       const resets = Date.parse(window.resets_at);
       if (!worst || percent > worst.percent) {
-        worst = { percent, resetsAt: Number.isFinite(resets) ? resets : null };
+        worst = { percent, resetsAt: Number.isFinite(resets) ? resets : null, windowKey: key };
       }
     }
     return worst || { resetsAt: null, percent: null };
   } catch (err) {
-    return { resetsAt: null, percent: null };
+    return { resetsAt: null, percent: null, windowKey: null };
+  }
+}
+
+// Claude Code only, like every other reader of this fact: /low-priority is its
+// slash command against its account, and Codex files a five-hour window under the
+// same key.
+function lowPriorityAcknowledged(now) {
+  try {
+    if (host.detect(process.argv.slice(2), process.env) !== host.CLAUDE) return false;
+    return Boolean(require('./lowpri.js').readAck(now));
+  } catch (err) {
+    return false;
   }
 }
 
@@ -198,13 +213,29 @@ function plan(options) {
       notes.push('note: that is before the window resets at ' + formatClock(binding.resetsAt));
     }
   }
+  // A deferral is a time the user named, so it is honoured whatever else is
+  // true - unlike an automatic relay wake, which the acknowledgement refuses.
+  // But waiting for a 5-hour reset this session carries straight past is
+  // waiting for nothing, and that is worth one line before the task is
+  // registered rather than after it fires.
+  if (options.lowPriorityAck && binding.windowKey === 'five_hour') {
+    notes.push(
+      'note: you have said /low-priority is on, so this session carries past the 5-hour reset ' +
+        'and waiting for it buys nothing - the weekly is the window that still stops work'
+    );
+  }
   return {
     ok: true,
     at: when.at,
     label: when.label,
     clock: formatClock(when.at),
     in: when.at - now,
+    // resetNote is the first of them, kept because the confirmation and the
+    // tests have always read that field. `notes` is all of them, because there
+    // can now be two and dropping the second would have hidden the one fact
+    // worth printing: that waiting for this reset buys nothing.
     resetNote: notes[0] || null,
+    notes,
   };
 }
 
@@ -256,7 +287,7 @@ function main(argv, now) {
   }
 
   const binding = bindingReset(at);
-  const decided = plan({ now: at, when: first, binding });
+  const decided = plan({ now: at, when: first, binding, lowPriorityAck: lowPriorityAcknowledged(at) });
   if (!decided.ok) return decided.error;
 
   const id = sessionId(args, process.env);
@@ -304,6 +335,7 @@ function main(argv, now) {
     in: decided.in,
     items,
     resetNote: decided.resetNote,
+    notes: decided.notes,
   });
 }
 
@@ -317,4 +349,4 @@ if (require.main === module) {
   }
 }
 
-module.exports = { parseWhen, formatClock, formatSpan, confirmation, plan, status, cancel, main, MINUTE, HOUR };
+module.exports = { lowPriorityAcknowledged, parseWhen, formatClock, formatSpan, confirmation, plan, status, cancel, main, MINUTE, HOUR };

package/skills/usage-limits/scripts/lowpri.js

@@ -39,13 +39,14 @@
 //   30-minute freshness cutoff on cached window readings, nothing to do with
 //   this.)
 //
-//   /limit-reset - a once-weekly manual refill of the 5-hour window, usable
-//   only AT a limit, whose work still spends the weekly. Gated on
-//   tengu_cedar_ember, which is ABSENT from this account's feature cache, with
-//   cachedUsageUtilization.utilization.cedar_ember null. So there is nothing to
-//   spend here and nothing is built on it: only a detector that starts
-//   reporting if a grant ever appears. resets_left is served by a live
-//   endpoint, never a file, so the count is never claimed.
+//   /limit-reset - a manual reset, behind two different server flags (see
+//   sessionReset below). tengu_nifty_lemur is the once-a-week reset of the
+//   5-hour session limit whose work still counts toward the weekly, and THIS
+//   ACCOUNT HAS IT (enabled:true). tengu_cedar_ember is a counted grant with a
+//   use-by date, absent here, with cachedUsageUtilization.utilization.cedar_ember
+//   null. Nothing is spent by the plugin - only the user can type the command -
+//   and whether this week's reset is used, or how many grants are left, is
+//   served by the API and never a file, so neither is ever claimed.
 //
 //   The graceful wrap-up note - the CLI injecting "finish up" at the wall. The
 //   mechanism is real and the treatment TEXT is provisioned on this machine
@@ -81,6 +82,7 @@ const atomic = require('./atomic.js');
 
 const FLAG = 'tengu_toasty_breeze';
 const RESET_FLAG = 'tengu_cedar_ember';
+const SESSION_RESET_FLAG = 'tengu_nifty_lemur';
 const WRAPUP_MODE_FLAG = 'tengu_lantern_wick_mode';
 const WRAPUP_TEXT_FLAG = 'tengu_lantern_wick_text';
 const NEAR_WALL_FLAG = 'tengu_vellum_anchor';
@@ -95,7 +97,7 @@ const MAX_COOLOFF_MINUTES = 1440;
 // The recommendation rule, in one number so it can be argued with.
 //
 // /low-priority spends the weekly and draws on a weekly allowance whose size is
-// exposed nowhere a hook can read, and a real user measured it burning "almost
+// exposed nowhere a hook can read, and one user has reported it burning "almost
 // a week of usage in a couple hours"
 // (github.com/anthropics/claude-code/issues/92544). So it is worth naming only
 // while the weekly still has real room. At or below this it is offered; above
@@ -106,6 +108,22 @@ const WEEKLY_HEADROOM_MAX = 80;
 // offers the toggle at all.
 const WALL_PERCENT = 90;
 
+// How long an acknowledgement with no readable reset time is allowed to live.
+//
+// The record is meant to lapse at the reset of the window it belongs to. When
+// that reset could not be read - a session with no account snapshot, or a
+// snapshot with no five_hour entry - the record used to be written with
+// resetsAt null, and readAck only lapsed a FINITE resetsAt. So it never lapsed:
+// a record written once went on redirecting the headroom maths at the weekly
+// for ever. Probed on 2026-09-26 with an acknowledgement three days old and the
+// 5-hour window reading 0 per cent, and the brief still said the 5-hour limit
+// "no longer stops this session".
+//
+// The window the toggle is offered at is five hours long, so an
+// acknowledgement made against it cannot honestly outlive five hours from when
+// it was made. That is the ceiling, not a guess at when it really ended.
+const ACK_MAX_MS = 5 * 60 * 60 * 1000;
+
 function configDir() {
   return process.env.CLAUDE_CONFIG_DIR || path.join(os.homedir(), '.claude');
 }
@@ -203,16 +221,53 @@ function offer(account) {
   };
 }
 
-// The manual session reset. Detected, never spent: this account holds no grant,
-// so a feature built on it would be untestable here.
+// A flag object the way the CLI reads one: a plain object whose `enabled` is
+// exactly true. The bundle's own readers are
+//   function qae(){let e=x("tengu_nifty_lemur",{});return typeof e==="object"&&e!==null&&!Array.isArray(e)?e:{}}
+//   function pme(){return qae().enabled===!0}
+// and the same shape for tengu_cedar_ember ($Z()). Truthiness is not enough:
+// `{ enabled: false }` is a truthy object, and the first build counted it as a
+// reset on offer.
+function flagEnabled(gb, key) {
+  if (!gb || !Object.prototype.hasOwnProperty.call(gb, key)) return false;
+  const value = gb[key];
+  return Boolean(value && typeof value === 'object' && !Array.isArray(value) && value.enabled === true);
+}
+
+// The manual reset behind /limit-reset. Detected, never spent.
+//
+// There are TWO server flags behind the one command, and they describe
+// different things, so the brief must not word one in the other's terms:
+//
+//   tengu_nifty_lemur - "Reset your session limit now and keep working; once a
+//   week, still counts toward your weekly limit" (the command's description
+//   when this is the variant). Its notice: "/limit-reset to reset your session
+//   limit now · uses weekly limit · 1/week". THIS ACCOUNT HAS IT: enabled:true,
+//   version 1, read from ~/.claude.json on 2026-09-25. The first build looked
+//   only at tengu_cedar_ember, called the account grant-less, and so never said
+//   a word about a reset the account actually holds.
+//
+//   tengu_cedar_ember - "Use an available limit reset and keep working". A
+//   counted grant: "Refills your {limits} now · your weekly reset day stays
+//   {week}", "{resets} left · use by {deadline}", and an early-use path ("You
+//   haven't reached a limit yet - use your reset anyway?"). Not once a week,
+//   not only at a limit, and whether it spends the weekly is not in its copy.
+//
+// The CLI prefers cedar_ember when both are on (its description reads
+// `$Z()?"Use an available limit reset...":"Reset your session limit now..."`),
+// so this does too. Whether this week's reset is already spent, and how many
+// grants are left, come from the server and appear in no file.
 function sessionReset(account) {
   const gb = features(account);
   const util = utilization(account);
-  const flagged = Boolean(gb && Object.prototype.hasOwnProperty.call(gb, RESET_FLAG) && gb[RESET_FLAG]);
+  const grantFlag = flagEnabled(gb, RESET_FLAG);
+  const weeklyFlag = flagEnabled(gb, SESSION_RESET_FLAG);
   const grant = util && util.cedar_ember ? util.cedar_ember : null;
+  const variant = grantFlag || grant ? 'grant' : weeklyFlag ? 'weekly' : null;
   return {
     known: Boolean(gb || util),
-    present: Boolean(flagged || grant),
+    present: variant !== null,
+    variant,
     // resets_left is served from /api/organizations/<uuid>/reset_rate_limits,
     // not from any file a hook can read, so it stays unreported.
     resetsLeft: null,
@@ -276,9 +331,13 @@ function autoContinue() {
 // session where the 5-hour wall is real again.
 // ---------------------------------------------------------------------------
 
+// An array is an object too, and JSON.stringify drops a named property set on
+// one: a state file holding `[]` made acknowledge() write `[]` straight back,
+// report saved:true, and usage-mode print "Recorded" for a statement that the
+// next read could not find. Only a plain object is a state.
 function readState() {
   const parsed = readJson(stateFile());
-  return parsed && typeof parsed === 'object' ? parsed : {};
+  return parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : {};
 }
 
 function writeState(state) {
@@ -290,14 +349,20 @@ function writeState(state) {
   }
 }
 
+// `saved` is reported, never assumed. A state path that cannot be written -
+// a directory sitting where the file goes, a read-only home - used to return
+// the record anyway, so usage-mode printed "Recorded: you have switched
+// /low-priority on" and then the very next brief behaved as though nothing had
+// been said. Telling somebody their statement was recorded when it was not is
+// the one thing this module must not do.
 function acknowledge(input) {
   const options = input || {};
   const now = Number.isFinite(options.now) ? options.now : Date.now();
   if (!options.on) {
     const state = readState();
     delete state.ack;
-    writeState(state);
-    return { on: false, at: now };
+    const saved = writeState(state);
+    return { on: false, at: now, saved, file: stateFile() };
   }
   const record = {
     on: true,
@@ -307,18 +372,35 @@ function acknowledge(input) {
   };
   const state = readState();
   state.ack = record;
-  writeState(state);
-  return record;
+  const saved = writeState(state);
+  return Object.assign({}, record, { saved, file: stateFile() });
+}
+
+// When a record stops being true: the reset of the window it was stamped
+// against, or - when that could not be read - ACK_MAX_MS after it was made.
+// Both are returned as `expiresAt` so a caller never has to work it out twice
+// and get a different answer.
+function ackExpiry(ack) {
+  if (!ack) return null;
+  if (Number.isFinite(ack.resetsAt)) return ack.resetsAt;
+  if (Number.isFinite(ack.at)) return ack.at + ACK_MAX_MS;
+  return null;
 }
 
 function readAck(now) {
   const at = Number.isFinite(now) ? now : Date.now();
   const state = readState();
   const ack = state.ack;
-  if (!ack || ack.on !== true) return null;
-  // Past the reset of the window it was recorded against, the fact is spent.
-  if (Number.isFinite(ack.resetsAt) && at >= ack.resetsAt) return null;
-  return ack;
+  if (!ack || typeof ack !== 'object' || ack.on !== true) return null;
+  // A record with no usable timestamp is not a record. It printed as
+  // "acknowledged ... at Invalid Date" before this, off a hand-edited or
+  // half-written file, which is the plugin quoting garbage back as fact.
+  if (!Number.isFinite(ack.at)) return null;
+  // Past the reset of the window it was recorded against - or past the length
+  // of that window, when no reset was readable - the fact is spent.
+  const expiresAt = ackExpiry(ack);
+  if (Number.isFinite(expiresAt) && at >= expiresAt) return null;
+  return Object.assign({}, ack, { expiresAt, expiryKnown: Number.isFinite(ack.resetsAt) });
 }
 
 // Exactly three states, and activeKnown is false in every one of them.
@@ -388,6 +470,7 @@ function forBrief(input) {
     weeklyPercent: weekly && Number.isFinite(weekly.percentUsed) ? Math.round(weekly.percentUsed) : null,
     fiveHourPercent: five && Number.isFinite(five.percentUsed) ? Math.round(five.percentUsed) : null,
     resetGrant: sessionReset(account).present,
+    resetVariant: sessionReset(account).variant,
     credits: credits(account),
     autoContinue: autoContinue(),
   };
@@ -396,6 +479,7 @@ function forBrief(input) {
 module.exports = {
   FLAG,
   RESET_FLAG,
+  SESSION_RESET_FLAG,
   WRAPUP_MODE_FLAG,
   WRAPUP_TEXT_FLAG,
   NEAR_WALL_FLAG,
@@ -404,12 +488,15 @@ module.exports = {
   MAX_COOLOFF_MINUTES,
   WEEKLY_HEADROOM_MAX,
   WALL_PERCENT,
+  ACK_MAX_MS,
+  ackExpiry,
   configDir,
   stateFile,
   accountFiles,
   snapshot,
   offer,
   sessionReset,
+  flagEnabled,
   wrapUp,
   credits,
   autoContinue,

package/skills/usage-limits/scripts/mode.js

@@ -1505,7 +1505,12 @@ function main(argv) {
         const usage = require('./usage.js');
         const windows = usage.snapshotWindows(usage.collect(now), now, null) || [];
         const five = windows.find((w) => w && w.key === 'five_hour');
-        if (five && Number.isFinite(five.resetsAt)) {
+        // Only a reset still ahead. A stale snapshot carries the reset of a
+        // window that has already rolled over, and stamping that on the record
+        // printed "Recorded ... lapses at" a time already gone - and the very
+        // next read found it spent, so the statement vanished. The next reset
+        // is unknown then, and the record takes the five-hour ceiling instead.
+        if (five && Number.isFinite(five.resetsAt) && five.resetsAt > now) {
           windowKey = 'five_hour';
           resetsAt = five.resetsAt;
         }
@@ -1513,7 +1518,18 @@ function main(argv) {
         // No reading is not a reason to refuse the user's own statement; the
         // record simply has no expiry to hang on.
       }
-      lowpri.acknowledge({ on: true, windowKey, resetsAt, now });
+      const written = lowpri.acknowledge({ on: true, windowKey, resetsAt, now });
+      // A write that did not happen is never reported as one. With a directory
+      // sitting where the state file goes this said "Recorded" and the next
+      // brief behaved as though nothing had been said.
+      if (!written.saved) {
+        return [
+          'NOT recorded: ' + written.file + ' could not be written, so nothing was saved and the ' +
+            'brief will go on treating the 5-hour window as a real wall.',
+          '',
+          'Check that the path is a writable file and not a directory, then run this again.',
+        ].join('\n');
+      }
       logChange({ plane: 'mode', key: 'low-priority', from: 'unknown', to: 'on', by: 'user', reason: null }, now);
       return [
         'Recorded: you have switched /low-priority on.',
@@ -1530,14 +1546,25 @@ function main(argv) {
         '',
         resetsAt
           ? 'This lapses on its own at ' + new Date(resetsAt).toLocaleString() + ', when the 5-hour window resets.'
-          : 'No 5-hour reset time was readable, so this has no expiry: clear it by hand when it ends.',
+          : 'No 5-hour reset time was readable, so this lapses at ' +
+            new Date(now + lowpri.ACK_MAX_MS).toLocaleString() + ' instead - five hours, the length of ' +
+            'the window the toggle belongs to, which is the longest it could honestly still be true. ' +
+            'Run /usage and set it again if it is still on then.',
         '',
         detail,
       ].join('\n');
     }
     if (asked === 'off' || asked === 'no' || asked === 'false') {
       const had = lowpri.readAck(now);
-      lowpri.acknowledge({ on: false, now });
+      const cleared = lowpri.acknowledge({ on: false, now });
+      // The same rule as "on": a clear that did not reach the file is not
+      // reported as one, because the record it failed to remove still steers
+      // the brief at the weekly.
+      if (had && !cleared.saved) {
+        return 'NOT cleared: ' + cleared.file + ' could not be written, so the acknowledgement is still ' +
+          'there and the brief will go on braking on the weekly until it lapses at ' +
+          new Date(had.expiresAt).toLocaleString() + '. Check that the file is writable, then run this again.';
+      }
       logChange({ plane: 'mode', key: 'low-priority', from: had ? 'on' : 'unknown', to: 'off', by: 'user', reason: null }, now);
       return had
         ? 'Cleared: low-priority is off again, so the 5-hour window counts as a wall from the next prompt.'
@@ -1550,9 +1577,15 @@ function main(argv) {
     const wrap = lowpri.wrapUp(account);
     const auto = lowpri.autoContinue();
     return [
+      // readAck drops a record with no usable timestamp, so there is no longer
+      // a path that prints "at Invalid Date" here, and the expiry is always a
+      // real time: the window's reset, or five hours from the statement.
       ack
         ? 'You have acknowledged low-priority ON, at ' + new Date(ack.at).toLocaleString() +
-          (Number.isFinite(ack.resetsAt) ? ', lapsing at ' + new Date(ack.resetsAt).toLocaleString() : ', with no expiry') + '.'
+          (Number.isFinite(ack.expiresAt)
+            ? ', lapsing at ' + new Date(ack.expiresAt).toLocaleString() +
+              (ack.expiryKnown ? ' when the 5-hour window resets' : ' (no reset time was readable, so this is five hours from the statement)')
+            : '') + '.'
         : 'Low-priority has not been acknowledged, so the plugin treats the 5-hour window as a real wall.',
       '',
       'It is a toggle you type yourself. The model cannot run a slash command, and /low-priority is ' +

package/skills/usage-limits/scripts/relay.js

@@ -1496,11 +1496,30 @@ async function armByHand(rest) {
   });
   if (!result.ok) return 'Could not arm: ' + result.error;
   if (text) saveContinuation(sessionId, text);
+  // armable() refuses a 5-hour wake while low-priority is acknowledged, and
+  // this path never went through it: `relay arm --session <id>` booked the wake
+  // anyway and said nothing, which is the double-start the whole gate exists to
+  // prevent. An explicit command is still honoured - it is what somebody typed
+  // - but it says what `defer reset` says, so the person deciding has the fact.
+  let lowPriorityNote = '';
+  if (binding.key === 'five_hour' && usage.currentHost() === host.CLAUDE) {
+    try {
+      if (lowpri.readAck(now)) {
+        lowPriorityNote =
+          ' Note: you have said /low-priority is on, so this session carries past the 5-hour reset ' +
+          'on its own and this wake would start the work a second time. Arm against the weekly ' +
+          'instead, or say usage-mode --low-priority off if it has ended; "relay cancel" calls this one off.';
+      }
+    } catch (err) {
+      // A missing or unreadable record is not a reason to refuse a command.
+    }
+  }
   return (
     'Armed by hand for session ' + sessionId.slice(0, 8) + ': wake at ' +
       new Date(result.record.wakeAt).toLocaleString() + ' via ' + result.record.how + '.' +
       (result.record.preflight && result.record.preflight.length ? ' Pre-answered: ' + result.record.preflight.join(', ') + '.' : '') +
-      (text ? ' Continuation saved.' : ' No continuation yet - add one with: relay note "<text>"')
+      (text ? ' Continuation saved.' : ' No continuation yet - add one with: relay note "<text>"') +
+      lowPriorityNote
   );
 }
 

package/skills/usage-limits/scripts/wake.js

@@ -559,8 +559,17 @@ function mine(held, record) {
 }
 
 async function run(now, argv, overrides) {
+  // `reachable` belongs in here with the rest. Left out, the preflight below
+  // called the real network on every run of the retry tests, so the whole
+  // launch-failure suite passed only on a machine that could reach
+  // api.anthropic.com - and went red, in the offline branch, on a laptop with
+  // its wifi off or behind a TLS-inspecting proxy. That is the exact condition
+  // the relay is built for, so it is the last thing its tests should need.
   const deps = Object.assign(
-    { windowReopened, deliverClaude, deliverCodex, toast, userIsPresent, arm: relay.arm, capabilities: relay.capabilities },
+    {
+      windowReopened, deliverClaude, deliverCodex, toast, userIsPresent,
+      arm: relay.arm, capabilities: relay.capabilities, reachable: net.reachable,
+    },
     overrides || null
   );
   const id = argOf(argv, '--id');
@@ -618,7 +627,7 @@ async function run(now, argv, overrides) {
   // So: ask first, before spending a launch on it, and give being offline its
   // own much longer budget. A machine that cannot reach the API has not failed.
   // It is waiting, and waiting is free.
-  const link = await net.reachable({ timeoutMs: 8000 });
+  const link = await deps.reachable({ timeoutMs: 8000 });
   if (!link.online) {
     const offlineAttempt = (record.offlineAttempt || 0) + 1;
     if (offlineAttempt <= config.offlineAttempts) {