switchroom 0.18.14 → 0.18.17

package/dist/auth-broker/index.js

@@ -16853,6 +16853,9 @@ var TelegramChannelSchema = exports_external.object({
     window_ms: exports_external.number().int().nonnegative().optional().describe("Sliding-window (ms) for merging consecutive inbound messages from " + "the same sender+topic into ONE Claude turn. Each new message resets " + "the timer; the turn starts once the sender pauses for this long. " + "Catches forwarded bursts, pasted text the Telegram client split " + "into several messages, and mixed text+media forwards. Default 500. " + "Set 0 to disable (every message becomes its own turn). Raise for " + "users who think in multiple short messages; the trade-off is the " + "single-message turn start is delayed by this much (the \uD83D\uDC40 ack still " + "fires immediately, so perceived latency is unchanged)."),
     max_attachments: exports_external.number().int().positive().optional().describe("Maximum number of media attachments carried into ONE coalesced " + "Claude turn. Default 10 — a full Telegram album (media_group caps " + "at 10) or a text+multi-image forwarded burst arrives as a single " + "turn; the agent sees numbered attachment fields (image_path, " + "image_path_2, …). Set 1 to restore the historical " + "single-attachment-per-turn behaviour. Excess attachments beyond " + "the cap spill into the next turn. Each attachment is downloaded, " + "so a high cap on a slow link delays turn start.")
   }).optional().describe("Inbound coalescing — how the gateway groups rapid consecutive messages " + "into a single turn so a forwarded album or split paste doesn't fan out " + "into N separate turns. Cascades from defaults.channels.telegram.coalesce."),
+  litellm_notice: exports_external.object({
+    window_ms: exports_external.number().int().positive().optional().describe("Per-agent cooldown window (ms) for the litellm-local 429 notice. " + "When the agent trips the LiteLLM proxy's OWN tpm_limit/rpm_limit " + "cap (a `litellm-local` classified 429 — see docs/auth.md § " + "LiteLLM-proxy-local 429s), the gateway posts ONE calm notice " + "naming the fleet token limiter, then counts further hits silently " + "for this long; the first notice after the window expires says " + "how many were absorbed. Default 900000 (15 min). Invalid values " + "fall back to the default.")
+  }).optional().describe("Debounce tuning for the litellm-local throttle notice — the calm " + "'fleet token limiter engaged' message posted when the LiteLLM " + "proxy's own rate cap trips (never an Anthropic account limit). " + "Cascades from defaults.channels.telegram.litellm_notice."),
   interrupt: exports_external.object({
     safe_boundary: exports_external.boolean().optional().describe("When true (the default), a `!`-prefix interrupt that arrives while " + "the agent is mid-tool-call is DEFERRED: the SIGINT and the " + "replacement turn wait until the in-flight tool call finishes (a " + "clean boundary) instead of C-c'ing the agent mid-write/mid-bash. If " + "no tool is in flight the interrupt still fires immediately. Bounded " + "by max_wait_ms so a long tool never strands the user. Set false to " + "fire synchronously the moment `!` is received (historical " + "behaviour). Rapid repeated `!` while one is pending coalesce into a " + "single deferred interrupt carrying the latest body."),
     max_wait_ms: exports_external.number().int().positive().optional().describe("Upper bound (ms) the gateway waits for a safe boundary before firing " + "a deferred `!` interrupt anyway. Only consulted when safe_boundary is " + "true. Default 8000. Keep it short — the user explicitly asked to " + "interrupt, so a long in-flight tool shouldn't ghost them; the cap " + "trades a tiny risk of a mid-tool C-c for a guaranteed response.")
@@ -18118,13 +18121,51 @@ import * as constants2 from "node:constants";
 import { createHash as createHash2 } from "node:crypto";
 import { dirname as dirname3, join as join8, resolve as resolve9 } from "node:path";
 
-// src/agents/compose.ts
-import { createHash } from "node:crypto";
-
 // src/agents/scaffold.ts
 import { join as join4, resolve as resolve5 } from "node:path";
 init_atomic();
 
+// src/agents/agent-uid.ts
+import { createHash } from "node:crypto";
+
+// src/broker-common/peercred-path.ts
+function matchSocketName(socketPath, patterns, maxNameLen) {
+  if (typeof socketPath !== "string" || socketPath.length === 0)
+    return null;
+  let name = null;
+  for (const re of patterns) {
+    const m = socketPath.match(re);
+    if (m && typeof m[1] === "string") {
+      name = m[1];
+      break;
+    }
+  }
+  if (name === null || name.length === 0)
+    return null;
+  if (maxNameLen !== undefined && name.length > maxNameLen)
+    return null;
+  return name;
+}
+
+// src/vault/broker/peercred.ts
+var RESERVED_AGENT_NAMES = new Set(["operator", "hostd"]);
+function isReservedAgentName(name) {
+  return RESERVED_AGENT_NAMES.has(name);
+}
+
+// src/agents/agent-uid.ts
+var AGENT_UID_MIN = 10001;
+var AGENT_UID_MAX = 10999;
+function allocateAgentUid(name) {
+  if (isReservedAgentName(name)) {
+    throw new Error(`agent name '${name}' is reserved by switchroom for another identity kind ` + `(see vault/broker/peercred.ts:RESERVED_AGENT_NAMES). Pick a different name.`);
+  }
+  const hash = createHash("sha256").update(name).digest();
+  const u32 = hash.readUInt32BE(0);
+  const range = AGENT_UID_MAX - AGENT_UID_MIN + 1;
+  return AGENT_UID_MIN + u32 % range;
+}
+
 // src/config/timezone.ts
 var CONTAINER_DEFAULT_UTC_ZONES = new Set([
   "UTC",
@@ -18268,31 +18309,6 @@ var SCRYPT_MAXMEM = 128 * 1024 * 1024;
 import { homedir as homedir3 } from "node:os";
 import { join as join3 } from "node:path";
 
-// src/broker-common/peercred-path.ts
-function matchSocketName(socketPath, patterns, maxNameLen) {
-  if (typeof socketPath !== "string" || socketPath.length === 0)
-    return null;
-  let name = null;
-  for (const re of patterns) {
-    const m = socketPath.match(re);
-    if (m && typeof m[1] === "string") {
-      name = m[1];
-      break;
-    }
-  }
-  if (name === null || name.length === 0)
-    return null;
-  if (maxNameLen !== undefined && name.length > maxNameLen)
-    return null;
-  return name;
-}
-
-// src/vault/broker/peercred.ts
-var RESERVED_AGENT_NAMES = new Set(["operator", "hostd"]);
-function isReservedAgentName(name) {
-  return RESERVED_AGENT_NAMES.has(name);
-}
-
 // src/vault/broker/protocol.ts
 var MAX_FRAME_BYTES = 64 * 1024;
 var AgentNameSchema = exports_external.string().min(1).max(64, "agent name max 64 chars").regex(/^[a-zA-Z0-9][a-zA-Z0-9_-]*$/, "agent name must be kebab-case ASCII (alnum + _- only, first char alnum)").refine((s) => !isReservedAgentName(s), {
@@ -18634,23 +18650,20 @@ var DOCKER_TELEGRAM_PLUGIN_PATH = "/opt/switchroom/telegram-plugin";
 var DOCKER_HOOKS_PATH = `${DOCKER_TELEGRAM_PLUGIN_PATH}/hooks`;
 
 // src/agents/compose.ts
-var AGENT_UID_MIN = 10001;
-var AGENT_UID_MAX = 10999;
-function allocateAgentUid(name) {
-  if (isReservedAgentName(name)) {
-    throw new Error(`agent name '${name}' is reserved by switchroom for another identity kind ` + `(see vault/broker/peercred.ts:RESERVED_AGENT_NAMES). Pick a different name.`);
-  }
-  const hash = createHash("sha256").update(name).digest();
-  const u32 = hash.readUInt32BE(0);
-  const range = AGENT_UID_MAX - AGENT_UID_MIN + 1;
-  return AGENT_UID_MIN + u32 % range;
-}
 var BIND_MOUNT_EXACT_SOURCE_DENY = new Set(["/var/run/docker.sock"]);
 
 // src/auth/quota.ts
 var OAUTH_BETA = "oauth-2025-04-20";
 var DEFAULT_USER_AGENT = "claude-cli/1.0.0 (external, cli)";
 var DEFAULT_PROBE_MODEL = "claude-haiku-4-5-20251001";
+var DEFAULT_MODEL_TIER_PROBE_MODEL = "claude-fable-5";
+function resolveModelTierProbeModel(env = process.env) {
+  const raw = env.SWITCHROOM_MODEL_TIER_PROBE_MODEL;
+  if (typeof raw === "string" && raw.trim().length > 0)
+    return raw.trim();
+  return DEFAULT_MODEL_TIER_PROBE_MODEL;
+}
+var MODEL_TIER_REPRESENTATIVE_CLAIM = "seven_day_overage_included";
 function parseFloatHeader(headers, name) {
   const v = headers.get(name);
   if (v == null || v.trim().length === 0)
@@ -18667,15 +18680,37 @@ function parseEpochHeader(headers, name) {
     return null;
   return new Date(n * 1000);
 }
-function parseQuotaHeaders(headers) {
+function parseTierReset(headers, now) {
+  const oi = parseEpochHeader(headers, "anthropic-ratelimit-unified-7d_oi-reset");
+  if (oi != null)
+    return oi;
+  const unified = parseEpochHeader(headers, "anthropic-ratelimit-unified-reset");
+  if (unified != null)
+    return unified;
+  const ra = headers.get("retry-after");
+  if (ra != null) {
+    const secs = Number(ra);
+    if (Number.isFinite(secs) && secs > 0 && secs < 30 * 24 * 3600) {
+      return new Date(now.getTime() + secs * 1000);
+    }
+  }
+  return null;
+}
+function parseQuotaHeaders(headers, now = new Date) {
   const fiveHour = parseFloatHeader(headers, "anthropic-ratelimit-unified-5h-utilization");
   const sevenDay = parseFloatHeader(headers, "anthropic-ratelimit-unified-7d-utilization");
-  if (fiveHour == null && sevenDay == null) {
+  const unifiedStatus = headers.get("anthropic-ratelimit-unified-status");
+  const sevenDayOiStatus = headers.get("anthropic-ratelimit-unified-7d_oi-status");
+  const sevenDayOiUtil = parseFloatHeader(headers, "anthropic-ratelimit-unified-7d_oi-utilization");
+  const representativeClaim = headers.get("anthropic-ratelimit-unified-representative-claim");
+  const hasTierSignal = unifiedStatus != null || sevenDayOiStatus != null || sevenDayOiUtil != null;
+  if (fiveHour == null && sevenDay == null && !hasTierSignal) {
     return {
       ok: false,
       reason: "no unified rate-limit headers in response (API token, not OAuth?)"
     };
   }
+  const oiPresent = sevenDayOiStatus != null || sevenDayOiUtil != null;
   return {
     ok: true,
     data: {
@@ -18685,9 +18720,14 @@ function parseQuotaHeaders(headers) {
       sevenDayUtilPresent: sevenDay != null,
       fiveHourResetAt: parseEpochHeader(headers, "anthropic-ratelimit-unified-5h-reset"),
       sevenDayResetAt: parseEpochHeader(headers, "anthropic-ratelimit-unified-7d-reset"),
-      representativeClaim: headers.get("anthropic-ratelimit-unified-representative-claim"),
+      representativeClaim,
       overageStatus: headers.get("anthropic-ratelimit-unified-overage-status"),
-      overageDisabledReason: headers.get("anthropic-ratelimit-unified-overage-disabled-reason")
+      overageDisabledReason: headers.get("anthropic-ratelimit-unified-overage-disabled-reason"),
+      unifiedStatus,
+      sevenDayOiStatus,
+      sevenDayOiUtilizationPct: sevenDayOiUtil != null ? sevenDayOiUtil * 100 : null,
+      sevenDayOiResetAt: parseTierReset(headers, now),
+      sevenDayOiPresent: oiPresent
     }
   };
 }
@@ -18892,6 +18932,175 @@ function resolveConsumerProbeIntervalMs(env) {
   return DEFAULT_CONSUMER_PROBE_INTERVAL_MS;
 }
 
+// src/auth/broker/model-tier-quota.ts
+var MODEL_TIER_WALL_PCT = 99.5;
+function quotaIndicatesModelTierWall(result) {
+  const none = { walled: false, until: null, bucket: null };
+  if (!result.ok)
+    return none;
+  const d = result.data;
+  const statusRejected = d.sevenDayOiStatus === "rejected";
+  const claimRejected = d.unifiedStatus === "rejected" && d.representativeClaim === MODEL_TIER_REPRESENTATIVE_CLAIM;
+  const utilWalled = d.sevenDayOiUtilizationPct != null && d.sevenDayOiUtilizationPct >= MODEL_TIER_WALL_PCT;
+  if (!statusRejected && !claimRejected && !utilWalled)
+    return none;
+  return {
+    walled: true,
+    until: d.sevenDayOiResetAt?.getTime() ?? null,
+    bucket: MODEL_TIER_REPRESENTATIVE_CLAIM
+  };
+}
+function quotaTierAllowed(result) {
+  if (!result.ok)
+    return false;
+  if (quotaIndicatesModelTierWall(result).walled)
+    return false;
+  const d = result.data;
+  return d.unifiedStatus === "allowed" || d.sevenDayOiStatus === "allowed";
+}
+function isModelTierWalled(opts) {
+  const { mark, now, snapshotTierAllowed } = opts;
+  if (snapshotTierAllowed === true)
+    return false;
+  if (mark !== undefined && mark.premium_walled_until > now)
+    return true;
+  return false;
+}
+var MODEL_TIER_WALL_DEFAULT_MS = 5 * 60 * 60 * 1000;
+
+// src/auth/broker/usage-ledger.ts
+var STANDARD_WALL_PCT = 99.5;
+var USAGE_RING_CAP_DEFAULT = 288;
+function resolveUsageRingCap(raw) {
+  if (raw == null || raw.trim().length === 0)
+    return USAGE_RING_CAP_DEFAULT;
+  const n = Number(raw);
+  return Number.isFinite(n) && n >= 1 ? Math.floor(n) : USAGE_RING_CAP_DEFAULT;
+}
+function standardSampleFromResult(result, now) {
+  if (!result.ok)
+    return null;
+  const d = result.data;
+  const fivePresent = d.fiveHourUtilPresent !== false;
+  const sevenPresent = d.sevenDayUtilPresent !== false;
+  if (!fivePresent && !sevenPresent)
+    return null;
+  const wins = [];
+  if (fivePresent) {
+    wins.push({
+      util: d.fiveHourUtilizationPct,
+      reset: d.fiveHourResetAt?.getTime() ?? null
+    });
+  }
+  if (sevenPresent) {
+    wins.push({
+      util: d.sevenDayUtilizationPct,
+      reset: d.sevenDayResetAt?.getTime() ?? null
+    });
+  }
+  const binding = wins.reduce((a, b) => b.util > a.util ? b : a);
+  return {
+    at: now,
+    utilizationPct: binding.util,
+    resetAt: binding.reset,
+    status: d.unifiedStatus ?? null,
+    walled: binding.util >= STANDARD_WALL_PCT
+  };
+}
+function premiumSampleFromResult(result, now) {
+  if (!result.ok)
+    return null;
+  const d = result.data;
+  const hasSignal = d.unifiedStatus != null || d.sevenDayOiStatus != null || d.sevenDayOiUtilizationPct != null;
+  if (!hasSignal)
+    return null;
+  const util3 = d.sevenDayOiUtilizationPct ?? null;
+  const status = d.sevenDayOiStatus ?? d.unifiedStatus ?? null;
+  const walled = d.sevenDayOiStatus === "rejected" || util3 != null && util3 >= MODEL_TIER_WALL_PCT;
+  return {
+    at: now,
+    utilizationPct: util3,
+    resetAt: d.sevenDayOiResetAt?.getTime() ?? null,
+    status,
+    walled
+  };
+}
+function recordUsageSample(ledger, account, tier, sample, ringCap = USAGE_RING_CAP_DEFAULT) {
+  if (sample == null)
+    return ledger;
+  const cap = ringCap >= 1 ? Math.floor(ringCap) : USAGE_RING_CAP_DEFAULT;
+  const acct = ledger[account] ??= {};
+  let tl = acct[tier];
+  if (tl == null) {
+    tl = {
+      tier,
+      samples: [],
+      observations: 0,
+      firstObservedAt: sample.at,
+      lastObservedAt: sample.at
+    };
+    acct[tier] = tl;
+  }
+  tl.samples.push(sample);
+  if (tl.samples.length > cap) {
+    tl.samples.splice(0, tl.samples.length - cap);
+  }
+  tl.observations += 1;
+  tl.lastObservedAt = sample.at;
+  if (sample.at < tl.firstObservedAt)
+    tl.firstObservedAt = sample.at;
+  return ledger;
+}
+function summarizeTier(tl, now) {
+  if (tl == null || tl.samples.length === 0)
+    return null;
+  const latest = tl.samples[tl.samples.length - 1];
+  const refilled = latest.resetAt != null && latest.resetAt <= now;
+  const rawUtil = latest.utilizationPct;
+  const currentUtilizationPct = rawUtil == null ? null : refilled ? 0 : rawUtil;
+  const headroomPct = currentUtilizationPct == null ? null : Math.max(0, 100 - currentUtilizationPct);
+  const utilSamples = tl.samples.map((s) => s.utilizationPct).filter((u) => u != null);
+  const peakUtilizationPct = utilSamples.length > 0 ? Math.max(...utilSamples) : null;
+  return {
+    tier: tl.tier,
+    observations: tl.observations,
+    retained: tl.samples.length,
+    currentUtilizationPct,
+    headroomPct,
+    resetAt: latest.resetAt,
+    status: latest.status,
+    walled: latest.walled && !refilled,
+    refilled,
+    lastObservedAt: tl.lastObservedAt,
+    peakUtilizationPct
+  };
+}
+function summarizeAccountUsage(ledger, account, now) {
+  const acct = ledger[account];
+  return {
+    account,
+    standard: summarizeTier(acct?.standard, now),
+    premium: summarizeTier(acct?.premium, now)
+  };
+}
+function premiumHeadroomPct(ledger, account, now) {
+  return summarizeAccountUsage(ledger, account, now).premium?.headroomPct ?? null;
+}
+function bestPremiumHeadroomAccount(ledger, candidates, now) {
+  let best = null;
+  let bestHeadroom = -Infinity;
+  for (const cand of candidates) {
+    const h = premiumHeadroomPct(ledger, cand, now);
+    if (h == null)
+      continue;
+    if (h > bestHeadroom) {
+      bestHeadroom = h;
+      best = cand;
+    }
+  }
+  return best;
+}
+
 // src/auth/broker/server.ts
 init_atomic();
 
@@ -20056,7 +20265,11 @@ function cachedSnapshotToResult(s) {
       overageStatus: s.overageStatus,
       overageDisabledReason: s.overageDisabledReason,
       fiveHourUtilPresent: s.fiveHourUtilPresent,
-      sevenDayUtilPresent: s.sevenDayUtilPresent
+      sevenDayUtilPresent: s.sevenDayUtilPresent,
+      unifiedStatus: null,
+      sevenDayOiStatus: null,
+      sevenDayOiUtilizationPct: null,
+      sevenDayOiResetAt: null
     }
   };
 }
@@ -20119,6 +20332,10 @@ class AuthBroker {
   thresholdViolations = {};
   notificationClaims = {};
   lastFleetRoll = null;
+  lastTierQuotaCache = {};
+  modelTierProbeModel = resolveModelTierProbeModel();
+  usageLedger = {};
+  usageRingCap = resolveUsageRingCap(process.env.SWITCHROOM_USAGE_LEDGER_RING_CAP);
   lastWrittenExpiresAt = new Map;
   refreshInFlight = new Set;
   consumerLastSeen = {};
@@ -20584,6 +20801,112 @@ class AuthBroker {
       allowOverage: this.isOverageAllowed(account)
     });
   }
+  premiumWallMarkOf(account) {
+    const q = this.quota[account];
+    if (!q || q.premium_walled_until === undefined)
+      return;
+    return {
+      premium_walled_until: q.premium_walled_until,
+      premium_wall_bucket: q.premium_wall_bucket,
+      premium_wall_marked_at: q.premium_wall_marked_at
+    };
+  }
+  isAccountPremiumWalled(account) {
+    const mark = this.premiumWallMarkOf(account);
+    const tier = this.lastTierQuotaCache[account];
+    const tierAllowed = tier != null && tier.capturedAt >= (mark?.premium_wall_marked_at ?? 0) && this.now() - tier.capturedAt <= SNAPSHOT_STALE_AGE_MS && (tier.unifiedStatus === "allowed" || tier.sevenDayOiStatus === "allowed") && !(tier.sevenDayOiStatus === "rejected");
+    return isModelTierWalled({
+      mark,
+      now: this.now(),
+      snapshotTierAllowed: tierAllowed ? true : undefined
+    });
+  }
+  recordTierProbe(label, result) {
+    if (result.ok) {
+      const d = result.data;
+      this.lastTierQuotaCache[label] = {
+        unifiedStatus: d.unifiedStatus ?? null,
+        sevenDayOiStatus: d.sevenDayOiStatus ?? null,
+        sevenDayOiUtilizationPct: d.sevenDayOiUtilizationPct ?? null,
+        sevenDayOiResetAt: d.sevenDayOiResetAt?.toISOString() ?? null,
+        capturedAt: this.now()
+      };
+      this.persistLastTierQuotaCache();
+      this.recordUsage(label, "premium", premiumSampleFromResult(result, this.now()));
+    }
+    const entry = this.quota[label];
+    if (quotaTierAllowed(result) && entry?.premium_walled_until !== undefined) {
+      const { premium_walled_until, premium_wall_bucket, premium_wall_marked_at, ...rest } = entry;
+      this.quota[label] = rest;
+      this.persistQuota();
+      process.stdout.write(`auth-broker: premium canary shows ${label} flagship-tier allowed — cleared model-tier wall mark
+`);
+      this.fanoutToAffectedConsumers(label);
+    }
+    if (quotaTierAllowed(result))
+      this.clearPremiumAllWalled();
+  }
+  nextPremiumEligibleAccount(from) {
+    const order = this.config.auth?.fallback_order ?? [];
+    const start = order.indexOf(from);
+    const ring = start === -1 ? [...order] : order.map((_, i) => order[(start + 1 + i) % order.length]);
+    const eligible = [];
+    for (const cand of ring) {
+      if (!cand || cand === from)
+        continue;
+      if (this.isAccountExhausted(cand))
+        continue;
+      if (this.isAccountPremiumWalled(cand))
+        continue;
+      if (!accountExists(cand, this.home))
+        continue;
+      if (!readAccountCredentials(cand, this.home))
+        continue;
+      eligible.push(cand);
+    }
+    if (eligible.length === 0)
+      return null;
+    return bestPremiumHeadroomAccount(this.usageLedger, eligible, this.now()) ?? eligible[0];
+  }
+  earliestPremiumWallReset() {
+    let earliest = null;
+    for (const label of listAccounts(this.home)) {
+      const until = this.quota[label]?.premium_walled_until;
+      if (until != null && (earliest == null || until < earliest))
+        earliest = until;
+    }
+    return earliest;
+  }
+  markPremiumWalledAndRoll(account, until, bucket) {
+    const now = this.now();
+    const premiumWalledUntil = until ?? now + MODEL_TIER_WALL_DEFAULT_MS;
+    this.quota[account] = {
+      ...this.quota[account],
+      premium_walled_until: premiumWalledUntil,
+      premium_wall_bucket: bucket ?? undefined,
+      premium_wall_marked_at: now
+    };
+    this.persistQuota();
+    const target = this.nextPremiumEligibleAccount(account);
+    if (!target) {
+      return { rolledTo: null, allWalled: true, earliestReset: this.earliestPremiumWallReset() };
+    }
+    this.fanoutFailoverTo(account, target);
+    this.fanoutToAffectedConsumers(account);
+    this.clearPremiumAllWalled();
+    if (this.config.auth?.active === account) {
+      this.config = {
+        ...this.config,
+        auth: { ...this.config.auth ?? {}, active: target }
+      };
+      this.persistActiveOverride(target);
+      this.fanoutAllConsumers();
+      this.audit({ op: "auto-promote-active", identity: { kind: "operator" }, account: target, accountKind: "claude", ok: true, reason: "model-tier-wall" });
+      process.stdout.write(`auth-broker: auto-promoted auth.active ${account} → ${target} ` + `(${account} flagship-tier walled until ${new Date(premiumWalledUntil).toISOString()}, bucket=${bucket ?? "?"}) — persisted
+`);
+    }
+    return { rolledTo: target, allWalled: false, earliestReset: null };
+  }
   softAvoidState = {};
   softAvoidRolledTo = {};
   softAvoidSnapshotOf(account) {
@@ -20762,7 +21085,12 @@ class AuthBroker {
         throttled_until: q?.throttled_until,
         threshold_violations: this.thresholdViolations[label] ?? 0,
         last_refreshed_at: meta?.lastRefreshedAt,
-        last_quota: lq ?? null
+        last_quota: lq ?? null,
+        premium_walled: this.isAccountPremiumWalled(label),
+        premium_walled_until: q?.premium_walled_until,
+        premium_wall_bucket: q?.premium_wall_bucket,
+        last_tier_quota: this.lastTierQuotaCache[label] ?? null,
+        usage_ledger: summarizeAccountUsage(this.usageLedger, label, this.now())
       };
     });
     const agents = Object.entries(this.config.agents ?? {}).map(([name, agent]) => {
@@ -20784,7 +21112,8 @@ class AuthBroker {
       agents,
       consumers,
       active_overage_serving,
-      last_fleet_roll: this.lastFleetRoll
+      last_fleet_roll: this.lastFleetRoll,
+      premium_tier_all_walled: this.premiumTierAllWalled
     }));
   }
   async opListGoogleAccounts(socket, id, identity) {
@@ -20870,6 +21199,7 @@ class AuthBroker {
     };
     this.lastQuotaCache[label] = snapshot;
     this.persistLastQuotaCache();
+    this.recordUsage(label, "standard", standardSampleFromResult(result, this.now()));
     if (snapshotShouldClearMark(snapshot, this.exhaustionMarkOf(label), this.now())) {
       delete this.quota[label];
       this.persistQuota();
@@ -20880,6 +21210,9 @@ class AuthBroker {
   }
   async fleetQuotaProbeTick() {
     const probed = [];
+    const tierWalled = new Map;
+    const canarySet = this.premiumCanarySet();
+    const canaryEnabled = process.env.SWITCHROOM_DISABLE_MODEL_TIER_PROBE !== "1";
     for (const label of listAccounts(this.home)) {
       const creds = readAccountCredentials(label, this.home);
       const token = creds?.claudeAiOauth?.accessToken;
@@ -20894,12 +21227,49 @@ class AuthBroker {
       }
       this.cacheQuotaSnapshot(label, result);
       probed.push({ label, result });
+      if (canaryEnabled && canarySet.has(label)) {
+        let tierResult;
+        try {
+          tierResult = await this.fetchQuotaImpl({ accessToken: token, model: this.modelTierProbeModel });
+        } catch (err) {
+          this.logErr(`fleet-tier-probe ${label}: ${err.message}`);
+          continue;
+        }
+        this.recordTierProbe(label, tierResult);
+        const wall = quotaIndicatesModelTierWall(tierResult);
+        if (wall.walled)
+          tierWalled.set(label, { until: wall.until, bucket: wall.bucket });
+      }
     }
+    for (const [label, wall] of tierWalled) {
+      const now = this.now();
+      this.quota[label] = {
+        ...this.quota[label],
+        premium_walled_until: wall.until ?? now + MODEL_TIER_WALL_DEFAULT_MS,
+        premium_wall_bucket: wall.bucket ?? undefined,
+        premium_wall_marked_at: now
+      };
+    }
+    if (tierWalled.size > 0)
+      this.persistQuota();
     for (const { label, result } of probed) {
       const active = this.config.auth?.active;
       const isPinnedAgentAccount = this.pinnedAgentAccounts().has(label);
       if (label !== active && !isPinnedAgentAccount)
         continue;
+      const tw = tierWalled.get(label);
+      if (tw) {
+        process.stdout.write(`auth-broker: fleet-tier-probe shows ${label === active ? "ACTIVE" : "PINNED"} ${label} ` + `flagship-tier walled (bucket=${tw.bucket ?? "?"}) — model-tier failover
+`);
+        this.audit({ op: "mark-exhausted", identity: { kind: "operator" }, account: label, accountKind: "claude", ok: true, reason: "model-tier-wall" });
+        const { rolledTo, allWalled, earliestReset } = this.markPremiumWalledAndRoll(label, tw.until, tw.bucket);
+        if (rolledTo && label === active) {
+          this.recordFleetRoll(label, rolledTo, "model-tier-wall", tw.until ?? undefined, tw.bucket);
+        } else if (allWalled && label === active) {
+          this.recordPremiumAllWalled(tw.bucket, earliestReset);
+        }
+        continue;
+      }
       const decision = quotaIndicatesExhaustion(result, this.isOverageAllowed(label));
       if (decision.exhausted) {
         process.stdout.write(`auth-broker: fleet-quota-probe shows ${label === active ? "ACTIVE" : "PINNED"} ${label} exhausted — proactive failover
@@ -20914,21 +21284,52 @@ class AuthBroker {
       this.softAvoidProbeRoll(label);
     }
   }
-  recordFleetRoll(from, to, reason, exhaustedUntil) {
+  recordFleetRoll(from, to, reason, exhaustedUntil, bucket) {
     const s = this.lastQuotaCache[from];
     this.lastFleetRoll = {
       from,
       to,
       at: this.now(),
       reason,
+      ...bucket ? { bucket } : {},
       ...exhaustedUntil != null ? { exhausted_until: exhaustedUntil } : {},
-      ...s ? {
+      ...s && reason !== "model-tier-wall" ? {
         window: s.fiveHourUtilizationPct >= s.sevenDayUtilizationPct ? "5h" : "7d",
         pct: Math.max(s.fiveHourUtilizationPct, s.sevenDayUtilizationPct)
       } : {}
     };
     this.persistLastFleetRoll();
   }
+  premiumTierAllWalled = null;
+  recordPremiumAllWalled(bucket, earliestReset) {
+    this.premiumTierAllWalled = {
+      bucket,
+      ...earliestReset != null ? { earliest_reset: earliestReset } : {},
+      at: this.now()
+    };
+    atomicWriteJsonSync(join8(this.stateDir, "premium-tier-all-walled.json"), this.premiumTierAllWalled, 384);
+    process.stdout.write(`auth-broker: ALL accounts flagship-tier walled (bucket=${bucket ?? "?"}` + `${earliestReset != null ? `, earliest reset ${new Date(earliestReset).toISOString()}` : ""}) ` + `— no premium-eligible failover target
+`);
+  }
+  clearPremiumAllWalled() {
+    if (this.premiumTierAllWalled == null)
+      return;
+    this.premiumTierAllWalled = null;
+    try {
+      unlinkSync(join8(this.stateDir, "premium-tier-all-walled.json"));
+    } catch {}
+  }
+  premiumCanarySet() {
+    const set = new Set;
+    const active = this.config.auth?.active;
+    if (active)
+      set.add(active);
+    for (const cand of this.config.auth?.fallback_order ?? [])
+      set.add(cand);
+    for (const acct of this.pinnedAgentAccounts())
+      set.add(acct);
+    return set;
+  }
   pinnedAgentAccounts() {
     return new Set(Object.values(this.config.agents ?? {}).map((a) => a.auth?.override).filter((x) => typeof x === "string" && x.length > 0));
   }
@@ -21838,6 +22239,9 @@ class AuthBroker {
     this.notificationClaims = this.readJson("notification-claims.json") ?? {};
     this.lastFleetRoll = this.readJson("last-fleet-roll.json") ?? null;
     this.lastQuotaCache = this.readJson("last-quota.json") ?? {};
+    this.lastTierQuotaCache = this.readJson("last-tier-quota.json") ?? {};
+    this.premiumTierAllWalled = this.readJson("premium-tier-all-walled.json") ?? null;
+    this.usageLedger = this.readJson("usage-ledger.json") ?? {};
     this.applyActiveOverride();
   }
   applyActiveOverride() {
@@ -21891,6 +22295,22 @@ class AuthBroker {
   persistLastQuotaCache() {
     atomicWriteJsonSync(join8(this.stateDir, "last-quota.json"), this.lastQuotaCache, 384);
   }
+  persistLastTierQuotaCache() {
+    atomicWriteJsonSync(join8(this.stateDir, "last-tier-quota.json"), this.lastTierQuotaCache, 384);
+  }
+  persistUsageLedger() {
+    atomicWriteJsonSync(join8(this.stateDir, "usage-ledger.json"), this.usageLedger, 384);
+  }
+  recordUsage(label, tier, sample) {
+    if (sample == null)
+      return;
+    try {
+      recordUsageSample(this.usageLedger, label, tier, sample, this.usageRingCap);
+      this.persistUsageLedger();
+    } catch (err) {
+      this.logErr(`usage-ledger ${label}/${tier}: ${err.message}`);
+    }
+  }
   persistNotificationClaims() {
     atomicWriteJsonSync(join8(this.stateDir, "notification-claims.json"), this.notificationClaims, 384);
   }
@@ -22024,7 +22444,11 @@ class AuthBroker {
       shaIndex: { ...this.shaIndex },
       thresholdViolations: { ...this.thresholdViolations },
       listeners: [...this.listeners.keys()],
-      lastQuotaCache: structuredClone(this.lastQuotaCache)
+      lastQuotaCache: structuredClone(this.lastQuotaCache),
+      lastTierQuotaCache: structuredClone(this.lastTierQuotaCache),
+      usageLedger: structuredClone(this.usageLedger),
+      premiumTierAllWalled: this.premiumTierAllWalled ? { ...this.premiumTierAllWalled } : null,
+      activeAccount: this.config.auth?.active
     };
   }
   _fanoutAll() {