switchroom 0.18.15 → 0.18.18

package/dist/agent-scheduler/index.js

@@ -11199,6 +11199,19 @@ var TelegramChannelSchema = exports_external.object({
   approval_timeout_minutes: exports_external.number().int().nonnegative().optional().describe("Operator approval-card lifetime (minutes) for the tool-use 'Allow " + "once' card and the vault grant decision wait. After this long with " + "no operator tap, the card auto-denies (a TIMEOUT, not a denial — the " + "agent is told not to retry). Default 60. hostd-gated verbs " + "(mcp__hostd__*) keep their own longer window; the hostd " + "config-propose card is not governed by this key."),
   sub_agent_tick_interval_ms: exports_external.number().int().nonnegative().optional().describe("Heartbeat tick interval (ms) for sub-agent rendering. Forces a " + "re-render of the elapsed-time counter while sub-agents are running, " + "even during silent stretches between tool calls. Default 10000 (10 s). " + "Set to 0 to disable the elapsed-ticker path."),
   edit_budget_threshold: exports_external.number().int().nonnegative().optional().describe("Telegram API edit budget per minute before the progress-card driver " + "falls back to a slower coalesce window. When a chat accumulates more " + "than this many card edits in the trailing 60 s, the driver switches " + "to a wider coalesce interval until the rate drops back. Default 18. " + "Increase if your gateway frequently bumps the Telegram edit-rate ceiling " + "with many parallel sub-agents; decrease for a more conservative buffer."),
+  send_gate: exports_external.object({
+    enabled: exports_external.boolean().optional().describe("Master switch for the deterministic outbound send gate " + "(telegram-plugin/send-gate.ts) — the token-bucket scheduler every " + "Bot API call transits so per-surface throttles can't add up past a " + "flood ceiling. ON by default. Precedence: the operator break-glass " + "env var SWITCHROOM_TELEGRAM_SEND_GATE (0/false/off/no) ALWAYS wins " + "when explicitly set; this key only decides when that env var is " + "unset. Omit to keep the gate on."),
+    global_per_sec: exports_external.number().positive().optional().describe("Global bucket sustained rate (Bot API calls/sec across ALL chats). " + "Default 25 (headroom under Telegram's ~30/s). Must be > 0 — a zero " + "or negative rate would wedge all outbound sends. Omit to keep 25."),
+    global_burst: exports_external.number().int().positive().describe("Global bucket burst capacity. Default 4; worst-case 1s window " + "admits global_burst + global_per_sec = 29 < 30, a real margin under " + "the ceiling. Must be an integer >= 1 (a 0 capacity never admits a " + "token and wedges sends). Omit to keep 4.").optional(),
+    per_chat_per_sec: exports_external.number().positive().optional().describe("Per-chat sustained rate (calls/sec to a single chat). Default 1. " + "Must be > 0 (zero/negative wedges that chat). Omit to keep 1."),
+    per_chat_burst: exports_external.number().int().positive().optional().describe("Per-chat burst capacity. Default 3. Must be an integer >= 1 " + "(0 wedges the chat's bucket). Omit to keep 3."),
+    per_group_per_min: exports_external.number().positive().optional().describe("Per-group sustained rate (calls/min to a single group/supergroup). " + "Default 18 (headroom under Telegram's ~20/min group ceiling). Must " + "be > 0. Omit to keep 18."),
+    per_group_burst: exports_external.number().int().positive().optional().describe("Per-group burst capacity. Default 2. Must be an integer >= 1 " + "(0 wedges the group's bucket). Omit to keep 2."),
+    edit_floor_ms: exports_external.number().int().nonnegative().optional().describe("Minimum ms between successive edits of the SAME message_id " + "(last-write-wins coalescing enforces this floor). Default 1500 " + "(Telegram's ~1 edit/sec/message practical ceiling). 0 disables the " + "floor. Must be an integer >= 0. Omit to keep 1500.")
+  }).optional().describe("Tunable rate limits for the deterministic outbound send gate " + "(telegram-plugin/send-gate.ts). Every key is optional and defaults to " + "the send gate's built-in value, so omitting the whole block reproduces " + "today's exact behaviour — this is pure operator tuning, no default is " + "changed. Cascades from defaults.channels.telegram.send_gate."),
+  worker_feed: exports_external.object({
+    max_rows: exports_external.number().int().positive().optional().describe("Max live-worker rows rendered in the COMBINED worker-activity feed " + "(2+ background workers in one chat/thread coalesce into ONE message; " + "telegram-plugin/worker-activity-feed.ts) before a compact " + "'+M more working…' spill line — keeps the coalesced body compact and " + "legible (and under the rich-message wire ceiling). Default 8. A " + "single-worker chat renders the full \uD83D\uDEE0 Worker card and ignores this. " + "Must be an integer >= 1. Omit to keep 8.")
+  }).optional().describe("Tuning for the coalesced worker-activity feed " + "(telegram-plugin/worker-activity-feed.ts). Cascades from " + "defaults.channels.telegram.worker_feed."),
   stickers: exports_external.record(exports_external.string(), exports_external.string()).optional().describe("Sticker aliases for the `send_sticker` MCP tool (#576). Maps a " + "short alias name (e.g. 'happy', 'thinking') to a Telegram file_id. " + "Operator-curated — capture file_ids from inbound stickers the user " + "sends and add them here. The agent calls send_sticker(chat_id, " + "alias='happy') and the gateway resolves to the file_id at send " + "time. Aliases enable persona-flavored expressiveness without " + "exposing raw file_ids in the agent prompt. Personal-assistant / " + "health-coach personas benefit; coding agents typically don't " + "configure any."),
   voice_in: exports_external.object({
     enabled: exports_external.boolean().optional().describe("Master switch for voice-message transcription."),
@@ -11224,6 +11237,9 @@ var TelegramChannelSchema = exports_external.object({
     window_ms: exports_external.number().int().nonnegative().optional().describe("Sliding-window (ms) for merging consecutive inbound messages from " + "the same sender+topic into ONE Claude turn. Each new message resets " + "the timer; the turn starts once the sender pauses for this long. " + "Catches forwarded bursts, pasted text the Telegram client split " + "into several messages, and mixed text+media forwards. Default 500. " + "Set 0 to disable (every message becomes its own turn). Raise for " + "users who think in multiple short messages; the trade-off is the " + "single-message turn start is delayed by this much (the \uD83D\uDC40 ack still " + "fires immediately, so perceived latency is unchanged)."),
     max_attachments: exports_external.number().int().positive().optional().describe("Maximum number of media attachments carried into ONE coalesced " + "Claude turn. Default 10 — a full Telegram album (media_group caps " + "at 10) or a text+multi-image forwarded burst arrives as a single " + "turn; the agent sees numbered attachment fields (image_path, " + "image_path_2, …). Set 1 to restore the historical " + "single-attachment-per-turn behaviour. Excess attachments beyond " + "the cap spill into the next turn. Each attachment is downloaded, " + "so a high cap on a slow link delays turn start.")
   }).optional().describe("Inbound coalescing — how the gateway groups rapid consecutive messages " + "into a single turn so a forwarded album or split paste doesn't fan out " + "into N separate turns. Cascades from defaults.channels.telegram.coalesce."),
+  litellm_notice: exports_external.object({
+    window_ms: exports_external.number().int().positive().optional().describe("Per-agent cooldown window (ms) for the litellm-local 429 notice. " + "When the agent trips the LiteLLM proxy's OWN tpm_limit/rpm_limit " + "cap (a `litellm-local` classified 429 — see docs/auth.md § " + "LiteLLM-proxy-local 429s), the gateway posts ONE calm notice " + "naming the fleet token limiter, then counts further hits silently " + "for this long; the first notice after the window expires says " + "how many were absorbed. Default 900000 (15 min). Invalid values " + "fall back to the default.")
+  }).optional().describe("Debounce tuning for the litellm-local throttle notice — the calm " + "'fleet token limiter engaged' message posted when the LiteLLM " + "proxy's own rate cap trips (never an Anthropic account limit). " + "Cascades from defaults.channels.telegram.litellm_notice."),
   interrupt: exports_external.object({
     safe_boundary: exports_external.boolean().optional().describe("When true (the default), a `!`-prefix interrupt that arrives while " + "the agent is mid-tool-call is DEFERRED: the SIGINT and the " + "replacement turn wait until the in-flight tool call finishes (a " + "clean boundary) instead of C-c'ing the agent mid-write/mid-bash. If " + "no tool is in flight the interrupt still fires immediately. Bounded " + "by max_wait_ms so a long tool never strands the user. Set false to " + "fire synchronously the moment `!` is received (historical " + "behaviour). Rapid repeated `!` while one is pending coalesce into a " + "single deferred interrupt carrying the latest body."),
     max_wait_ms: exports_external.number().int().positive().optional().describe("Upper bound (ms) the gateway waits for a safe boundary before firing " + "a deferred `!` interrupt anyway. Only consulted when safe_boundary is " + "true. Default 8000. Keep it short — the user explicitly asked to " + "interrupt, so a long in-flight tool shouldn't ghost them; the cap " + "trades a tiny risk of a mid-tool C-c for a guaranteed response.")

package/dist/auth-broker/index.js

@@ -16828,6 +16828,19 @@ var TelegramChannelSchema = exports_external.object({
   approval_timeout_minutes: exports_external.number().int().nonnegative().optional().describe("Operator approval-card lifetime (minutes) for the tool-use 'Allow " + "once' card and the vault grant decision wait. After this long with " + "no operator tap, the card auto-denies (a TIMEOUT, not a denial — the " + "agent is told not to retry). Default 60. hostd-gated verbs " + "(mcp__hostd__*) keep their own longer window; the hostd " + "config-propose card is not governed by this key."),
   sub_agent_tick_interval_ms: exports_external.number().int().nonnegative().optional().describe("Heartbeat tick interval (ms) for sub-agent rendering. Forces a " + "re-render of the elapsed-time counter while sub-agents are running, " + "even during silent stretches between tool calls. Default 10000 (10 s). " + "Set to 0 to disable the elapsed-ticker path."),
   edit_budget_threshold: exports_external.number().int().nonnegative().optional().describe("Telegram API edit budget per minute before the progress-card driver " + "falls back to a slower coalesce window. When a chat accumulates more " + "than this many card edits in the trailing 60 s, the driver switches " + "to a wider coalesce interval until the rate drops back. Default 18. " + "Increase if your gateway frequently bumps the Telegram edit-rate ceiling " + "with many parallel sub-agents; decrease for a more conservative buffer."),
+  send_gate: exports_external.object({
+    enabled: exports_external.boolean().optional().describe("Master switch for the deterministic outbound send gate " + "(telegram-plugin/send-gate.ts) — the token-bucket scheduler every " + "Bot API call transits so per-surface throttles can't add up past a " + "flood ceiling. ON by default. Precedence: the operator break-glass " + "env var SWITCHROOM_TELEGRAM_SEND_GATE (0/false/off/no) ALWAYS wins " + "when explicitly set; this key only decides when that env var is " + "unset. Omit to keep the gate on."),
+    global_per_sec: exports_external.number().positive().optional().describe("Global bucket sustained rate (Bot API calls/sec across ALL chats). " + "Default 25 (headroom under Telegram's ~30/s). Must be > 0 — a zero " + "or negative rate would wedge all outbound sends. Omit to keep 25."),
+    global_burst: exports_external.number().int().positive().describe("Global bucket burst capacity. Default 4; worst-case 1s window " + "admits global_burst + global_per_sec = 29 < 30, a real margin under " + "the ceiling. Must be an integer >= 1 (a 0 capacity never admits a " + "token and wedges sends). Omit to keep 4.").optional(),
+    per_chat_per_sec: exports_external.number().positive().optional().describe("Per-chat sustained rate (calls/sec to a single chat). Default 1. " + "Must be > 0 (zero/negative wedges that chat). Omit to keep 1."),
+    per_chat_burst: exports_external.number().int().positive().optional().describe("Per-chat burst capacity. Default 3. Must be an integer >= 1 " + "(0 wedges the chat's bucket). Omit to keep 3."),
+    per_group_per_min: exports_external.number().positive().optional().describe("Per-group sustained rate (calls/min to a single group/supergroup). " + "Default 18 (headroom under Telegram's ~20/min group ceiling). Must " + "be > 0. Omit to keep 18."),
+    per_group_burst: exports_external.number().int().positive().optional().describe("Per-group burst capacity. Default 2. Must be an integer >= 1 " + "(0 wedges the group's bucket). Omit to keep 2."),
+    edit_floor_ms: exports_external.number().int().nonnegative().optional().describe("Minimum ms between successive edits of the SAME message_id " + "(last-write-wins coalescing enforces this floor). Default 1500 " + "(Telegram's ~1 edit/sec/message practical ceiling). 0 disables the " + "floor. Must be an integer >= 0. Omit to keep 1500.")
+  }).optional().describe("Tunable rate limits for the deterministic outbound send gate " + "(telegram-plugin/send-gate.ts). Every key is optional and defaults to " + "the send gate's built-in value, so omitting the whole block reproduces " + "today's exact behaviour — this is pure operator tuning, no default is " + "changed. Cascades from defaults.channels.telegram.send_gate."),
+  worker_feed: exports_external.object({
+    max_rows: exports_external.number().int().positive().optional().describe("Max live-worker rows rendered in the COMBINED worker-activity feed " + "(2+ background workers in one chat/thread coalesce into ONE message; " + "telegram-plugin/worker-activity-feed.ts) before a compact " + "'+M more working…' spill line — keeps the coalesced body compact and " + "legible (and under the rich-message wire ceiling). Default 8. A " + "single-worker chat renders the full \uD83D\uDEE0 Worker card and ignores this. " + "Must be an integer >= 1. Omit to keep 8.")
+  }).optional().describe("Tuning for the coalesced worker-activity feed " + "(telegram-plugin/worker-activity-feed.ts). Cascades from " + "defaults.channels.telegram.worker_feed."),
   stickers: exports_external.record(exports_external.string(), exports_external.string()).optional().describe("Sticker aliases for the `send_sticker` MCP tool (#576). Maps a " + "short alias name (e.g. 'happy', 'thinking') to a Telegram file_id. " + "Operator-curated — capture file_ids from inbound stickers the user " + "sends and add them here. The agent calls send_sticker(chat_id, " + "alias='happy') and the gateway resolves to the file_id at send " + "time. Aliases enable persona-flavored expressiveness without " + "exposing raw file_ids in the agent prompt. Personal-assistant / " + "health-coach personas benefit; coding agents typically don't " + "configure any."),
   voice_in: exports_external.object({
     enabled: exports_external.boolean().optional().describe("Master switch for voice-message transcription."),
@@ -16853,6 +16866,9 @@ var TelegramChannelSchema = exports_external.object({
     window_ms: exports_external.number().int().nonnegative().optional().describe("Sliding-window (ms) for merging consecutive inbound messages from " + "the same sender+topic into ONE Claude turn. Each new message resets " + "the timer; the turn starts once the sender pauses for this long. " + "Catches forwarded bursts, pasted text the Telegram client split " + "into several messages, and mixed text+media forwards. Default 500. " + "Set 0 to disable (every message becomes its own turn). Raise for " + "users who think in multiple short messages; the trade-off is the " + "single-message turn start is delayed by this much (the \uD83D\uDC40 ack still " + "fires immediately, so perceived latency is unchanged)."),
     max_attachments: exports_external.number().int().positive().optional().describe("Maximum number of media attachments carried into ONE coalesced " + "Claude turn. Default 10 — a full Telegram album (media_group caps " + "at 10) or a text+multi-image forwarded burst arrives as a single " + "turn; the agent sees numbered attachment fields (image_path, " + "image_path_2, …). Set 1 to restore the historical " + "single-attachment-per-turn behaviour. Excess attachments beyond " + "the cap spill into the next turn. Each attachment is downloaded, " + "so a high cap on a slow link delays turn start.")
   }).optional().describe("Inbound coalescing — how the gateway groups rapid consecutive messages " + "into a single turn so a forwarded album or split paste doesn't fan out " + "into N separate turns. Cascades from defaults.channels.telegram.coalesce."),
+  litellm_notice: exports_external.object({
+    window_ms: exports_external.number().int().positive().optional().describe("Per-agent cooldown window (ms) for the litellm-local 429 notice. " + "When the agent trips the LiteLLM proxy's OWN tpm_limit/rpm_limit " + "cap (a `litellm-local` classified 429 — see docs/auth.md § " + "LiteLLM-proxy-local 429s), the gateway posts ONE calm notice " + "naming the fleet token limiter, then counts further hits silently " + "for this long; the first notice after the window expires says " + "how many were absorbed. Default 900000 (15 min). Invalid values " + "fall back to the default.")
+  }).optional().describe("Debounce tuning for the litellm-local throttle notice — the calm " + "'fleet token limiter engaged' message posted when the LiteLLM " + "proxy's own rate cap trips (never an Anthropic account limit). " + "Cascades from defaults.channels.telegram.litellm_notice."),
   interrupt: exports_external.object({
     safe_boundary: exports_external.boolean().optional().describe("When true (the default), a `!`-prefix interrupt that arrives while " + "the agent is mid-tool-call is DEFERRED: the SIGINT and the " + "replacement turn wait until the in-flight tool call finishes (a " + "clean boundary) instead of C-c'ing the agent mid-write/mid-bash. If " + "no tool is in flight the interrupt still fires immediately. Bounded " + "by max_wait_ms so a long tool never strands the user. Set false to " + "fire synchronously the moment `!` is received (historical " + "behaviour). Rapid repeated `!` while one is pending coalesce into a " + "single deferred interrupt carrying the latest body."),
     max_wait_ms: exports_external.number().int().positive().optional().describe("Upper bound (ms) the gateway waits for a safe boundary before firing " + "a deferred `!` interrupt anyway. Only consulted when safe_boundary is " + "true. Default 8000. Keep it short — the user explicitly asked to " + "interrupt, so a long in-flight tool shouldn't ghost them; the cap " + "trades a tiny risk of a mid-tool C-c for a guaranteed response.")
@@ -18653,6 +18669,14 @@ var BIND_MOUNT_EXACT_SOURCE_DENY = new Set(["/var/run/docker.sock"]);
 var OAUTH_BETA = "oauth-2025-04-20";
 var DEFAULT_USER_AGENT = "claude-cli/1.0.0 (external, cli)";
 var DEFAULT_PROBE_MODEL = "claude-haiku-4-5-20251001";
+var DEFAULT_MODEL_TIER_PROBE_MODEL = "claude-fable-5";
+function resolveModelTierProbeModel(env = process.env) {
+  const raw = env.SWITCHROOM_MODEL_TIER_PROBE_MODEL;
+  if (typeof raw === "string" && raw.trim().length > 0)
+    return raw.trim();
+  return DEFAULT_MODEL_TIER_PROBE_MODEL;
+}
+var MODEL_TIER_REPRESENTATIVE_CLAIM = "seven_day_overage_included";
 function parseFloatHeader(headers, name) {
   const v = headers.get(name);
   if (v == null || v.trim().length === 0)
@@ -18669,15 +18693,37 @@ function parseEpochHeader(headers, name) {
     return null;
   return new Date(n * 1000);
 }
-function parseQuotaHeaders(headers) {
+function parseTierReset(headers, now) {
+  const oi = parseEpochHeader(headers, "anthropic-ratelimit-unified-7d_oi-reset");
+  if (oi != null)
+    return oi;
+  const unified = parseEpochHeader(headers, "anthropic-ratelimit-unified-reset");
+  if (unified != null)
+    return unified;
+  const ra = headers.get("retry-after");
+  if (ra != null) {
+    const secs = Number(ra);
+    if (Number.isFinite(secs) && secs > 0 && secs < 30 * 24 * 3600) {
+      return new Date(now.getTime() + secs * 1000);
+    }
+  }
+  return null;
+}
+function parseQuotaHeaders(headers, now = new Date) {
   const fiveHour = parseFloatHeader(headers, "anthropic-ratelimit-unified-5h-utilization");
   const sevenDay = parseFloatHeader(headers, "anthropic-ratelimit-unified-7d-utilization");
-  if (fiveHour == null && sevenDay == null) {
+  const unifiedStatus = headers.get("anthropic-ratelimit-unified-status");
+  const sevenDayOiStatus = headers.get("anthropic-ratelimit-unified-7d_oi-status");
+  const sevenDayOiUtil = parseFloatHeader(headers, "anthropic-ratelimit-unified-7d_oi-utilization");
+  const representativeClaim = headers.get("anthropic-ratelimit-unified-representative-claim");
+  const hasTierSignal = unifiedStatus != null || sevenDayOiStatus != null || sevenDayOiUtil != null;
+  if (fiveHour == null && sevenDay == null && !hasTierSignal) {
     return {
       ok: false,
       reason: "no unified rate-limit headers in response (API token, not OAuth?)"
     };
   }
+  const oiPresent = sevenDayOiStatus != null || sevenDayOiUtil != null;
   return {
     ok: true,
     data: {
@@ -18687,9 +18733,14 @@ function parseQuotaHeaders(headers) {
       sevenDayUtilPresent: sevenDay != null,
       fiveHourResetAt: parseEpochHeader(headers, "anthropic-ratelimit-unified-5h-reset"),
       sevenDayResetAt: parseEpochHeader(headers, "anthropic-ratelimit-unified-7d-reset"),
-      representativeClaim: headers.get("anthropic-ratelimit-unified-representative-claim"),
+      representativeClaim,
       overageStatus: headers.get("anthropic-ratelimit-unified-overage-status"),
-      overageDisabledReason: headers.get("anthropic-ratelimit-unified-overage-disabled-reason")
+      overageDisabledReason: headers.get("anthropic-ratelimit-unified-overage-disabled-reason"),
+      unifiedStatus,
+      sevenDayOiStatus,
+      sevenDayOiUtilizationPct: sevenDayOiUtil != null ? sevenDayOiUtil * 100 : null,
+      sevenDayOiResetAt: parseTierReset(headers, now),
+      sevenDayOiPresent: oiPresent
     }
   };
 }
@@ -18894,6 +18945,175 @@ function resolveConsumerProbeIntervalMs(env) {
   return DEFAULT_CONSUMER_PROBE_INTERVAL_MS;
 }
 
+// src/auth/broker/model-tier-quota.ts
+var MODEL_TIER_WALL_PCT = 99.5;
+function quotaIndicatesModelTierWall(result) {
+  const none = { walled: false, until: null, bucket: null };
+  if (!result.ok)
+    return none;
+  const d = result.data;
+  const statusRejected = d.sevenDayOiStatus === "rejected";
+  const claimRejected = d.unifiedStatus === "rejected" && d.representativeClaim === MODEL_TIER_REPRESENTATIVE_CLAIM;
+  const utilWalled = d.sevenDayOiUtilizationPct != null && d.sevenDayOiUtilizationPct >= MODEL_TIER_WALL_PCT;
+  if (!statusRejected && !claimRejected && !utilWalled)
+    return none;
+  return {
+    walled: true,
+    until: d.sevenDayOiResetAt?.getTime() ?? null,
+    bucket: MODEL_TIER_REPRESENTATIVE_CLAIM
+  };
+}
+function quotaTierAllowed(result) {
+  if (!result.ok)
+    return false;
+  if (quotaIndicatesModelTierWall(result).walled)
+    return false;
+  const d = result.data;
+  return d.unifiedStatus === "allowed" || d.sevenDayOiStatus === "allowed";
+}
+function isModelTierWalled(opts) {
+  const { mark, now, snapshotTierAllowed } = opts;
+  if (snapshotTierAllowed === true)
+    return false;
+  if (mark !== undefined && mark.premium_walled_until > now)
+    return true;
+  return false;
+}
+var MODEL_TIER_WALL_DEFAULT_MS = 5 * 60 * 60 * 1000;
+
+// src/auth/broker/usage-ledger.ts
+var STANDARD_WALL_PCT = 99.5;
+var USAGE_RING_CAP_DEFAULT = 288;
+function resolveUsageRingCap(raw) {
+  if (raw == null || raw.trim().length === 0)
+    return USAGE_RING_CAP_DEFAULT;
+  const n = Number(raw);
+  return Number.isFinite(n) && n >= 1 ? Math.floor(n) : USAGE_RING_CAP_DEFAULT;
+}
+function standardSampleFromResult(result, now) {
+  if (!result.ok)
+    return null;
+  const d = result.data;
+  const fivePresent = d.fiveHourUtilPresent !== false;
+  const sevenPresent = d.sevenDayUtilPresent !== false;
+  if (!fivePresent && !sevenPresent)
+    return null;
+  const wins = [];
+  if (fivePresent) {
+    wins.push({
+      util: d.fiveHourUtilizationPct,
+      reset: d.fiveHourResetAt?.getTime() ?? null
+    });
+  }
+  if (sevenPresent) {
+    wins.push({
+      util: d.sevenDayUtilizationPct,
+      reset: d.sevenDayResetAt?.getTime() ?? null
+    });
+  }
+  const binding = wins.reduce((a, b) => b.util > a.util ? b : a);
+  return {
+    at: now,
+    utilizationPct: binding.util,
+    resetAt: binding.reset,
+    status: d.unifiedStatus ?? null,
+    walled: binding.util >= STANDARD_WALL_PCT
+  };
+}
+function premiumSampleFromResult(result, now) {
+  if (!result.ok)
+    return null;
+  const d = result.data;
+  const hasSignal = d.unifiedStatus != null || d.sevenDayOiStatus != null || d.sevenDayOiUtilizationPct != null;
+  if (!hasSignal)
+    return null;
+  const util3 = d.sevenDayOiUtilizationPct ?? null;
+  const status = d.sevenDayOiStatus ?? d.unifiedStatus ?? null;
+  const walled = d.sevenDayOiStatus === "rejected" || util3 != null && util3 >= MODEL_TIER_WALL_PCT;
+  return {
+    at: now,
+    utilizationPct: util3,
+    resetAt: d.sevenDayOiResetAt?.getTime() ?? null,
+    status,
+    walled
+  };
+}
+function recordUsageSample(ledger, account, tier, sample, ringCap = USAGE_RING_CAP_DEFAULT) {
+  if (sample == null)
+    return ledger;
+  const cap = ringCap >= 1 ? Math.floor(ringCap) : USAGE_RING_CAP_DEFAULT;
+  const acct = ledger[account] ??= {};
+  let tl = acct[tier];
+  if (tl == null) {
+    tl = {
+      tier,
+      samples: [],
+      observations: 0,
+      firstObservedAt: sample.at,
+      lastObservedAt: sample.at
+    };
+    acct[tier] = tl;
+  }
+  tl.samples.push(sample);
+  if (tl.samples.length > cap) {
+    tl.samples.splice(0, tl.samples.length - cap);
+  }
+  tl.observations += 1;
+  tl.lastObservedAt = sample.at;
+  if (sample.at < tl.firstObservedAt)
+    tl.firstObservedAt = sample.at;
+  return ledger;
+}
+function summarizeTier(tl, now) {
+  if (tl == null || tl.samples.length === 0)
+    return null;
+  const latest = tl.samples[tl.samples.length - 1];
+  const refilled = latest.resetAt != null && latest.resetAt <= now;
+  const rawUtil = latest.utilizationPct;
+  const currentUtilizationPct = rawUtil == null ? null : refilled ? 0 : rawUtil;
+  const headroomPct = currentUtilizationPct == null ? null : Math.max(0, 100 - currentUtilizationPct);
+  const utilSamples = tl.samples.map((s) => s.utilizationPct).filter((u) => u != null);
+  const peakUtilizationPct = utilSamples.length > 0 ? Math.max(...utilSamples) : null;
+  return {
+    tier: tl.tier,
+    observations: tl.observations,
+    retained: tl.samples.length,
+    currentUtilizationPct,
+    headroomPct,
+    resetAt: latest.resetAt,
+    status: latest.status,
+    walled: latest.walled && !refilled,
+    refilled,
+    lastObservedAt: tl.lastObservedAt,
+    peakUtilizationPct
+  };
+}
+function summarizeAccountUsage(ledger, account, now) {
+  const acct = ledger[account];
+  return {
+    account,
+    standard: summarizeTier(acct?.standard, now),
+    premium: summarizeTier(acct?.premium, now)
+  };
+}
+function premiumHeadroomPct(ledger, account, now) {
+  return summarizeAccountUsage(ledger, account, now).premium?.headroomPct ?? null;
+}
+function bestPremiumHeadroomAccount(ledger, candidates, now) {
+  let best = null;
+  let bestHeadroom = -Infinity;
+  for (const cand of candidates) {
+    const h = premiumHeadroomPct(ledger, cand, now);
+    if (h == null)
+      continue;
+    if (h > bestHeadroom) {
+      bestHeadroom = h;
+      best = cand;
+    }
+  }
+  return best;
+}
+
 // src/auth/broker/server.ts
 init_atomic();
 
@@ -20058,7 +20278,11 @@ function cachedSnapshotToResult(s) {
       overageStatus: s.overageStatus,
       overageDisabledReason: s.overageDisabledReason,
       fiveHourUtilPresent: s.fiveHourUtilPresent,
-      sevenDayUtilPresent: s.sevenDayUtilPresent
+      sevenDayUtilPresent: s.sevenDayUtilPresent,
+      unifiedStatus: null,
+      sevenDayOiStatus: null,
+      sevenDayOiUtilizationPct: null,
+      sevenDayOiResetAt: null
     }
   };
 }
@@ -20121,6 +20345,10 @@ class AuthBroker {
   thresholdViolations = {};
   notificationClaims = {};
   lastFleetRoll = null;
+  lastTierQuotaCache = {};
+  modelTierProbeModel = resolveModelTierProbeModel();
+  usageLedger = {};
+  usageRingCap = resolveUsageRingCap(process.env.SWITCHROOM_USAGE_LEDGER_RING_CAP);
   lastWrittenExpiresAt = new Map;
   refreshInFlight = new Set;
   consumerLastSeen = {};
@@ -20586,6 +20814,112 @@ class AuthBroker {
       allowOverage: this.isOverageAllowed(account)
     });
   }
+  premiumWallMarkOf(account) {
+    const q = this.quota[account];
+    if (!q || q.premium_walled_until === undefined)
+      return;
+    return {
+      premium_walled_until: q.premium_walled_until,
+      premium_wall_bucket: q.premium_wall_bucket,
+      premium_wall_marked_at: q.premium_wall_marked_at
+    };
+  }
+  isAccountPremiumWalled(account) {
+    const mark = this.premiumWallMarkOf(account);
+    const tier = this.lastTierQuotaCache[account];
+    const tierAllowed = tier != null && tier.capturedAt >= (mark?.premium_wall_marked_at ?? 0) && this.now() - tier.capturedAt <= SNAPSHOT_STALE_AGE_MS && (tier.unifiedStatus === "allowed" || tier.sevenDayOiStatus === "allowed") && !(tier.sevenDayOiStatus === "rejected");
+    return isModelTierWalled({
+      mark,
+      now: this.now(),
+      snapshotTierAllowed: tierAllowed ? true : undefined
+    });
+  }
+  recordTierProbe(label, result) {
+    if (result.ok) {
+      const d = result.data;
+      this.lastTierQuotaCache[label] = {
+        unifiedStatus: d.unifiedStatus ?? null,
+        sevenDayOiStatus: d.sevenDayOiStatus ?? null,
+        sevenDayOiUtilizationPct: d.sevenDayOiUtilizationPct ?? null,
+        sevenDayOiResetAt: d.sevenDayOiResetAt?.toISOString() ?? null,
+        capturedAt: this.now()
+      };
+      this.persistLastTierQuotaCache();
+      this.recordUsage(label, "premium", premiumSampleFromResult(result, this.now()));
+    }
+    const entry = this.quota[label];
+    if (quotaTierAllowed(result) && entry?.premium_walled_until !== undefined) {
+      const { premium_walled_until, premium_wall_bucket, premium_wall_marked_at, ...rest } = entry;
+      this.quota[label] = rest;
+      this.persistQuota();
+      process.stdout.write(`auth-broker: premium canary shows ${label} flagship-tier allowed — cleared model-tier wall mark
+`);
+      this.fanoutToAffectedConsumers(label);
+    }
+    if (quotaTierAllowed(result))
+      this.clearPremiumAllWalled();
+  }
+  nextPremiumEligibleAccount(from) {
+    const order = this.config.auth?.fallback_order ?? [];
+    const start = order.indexOf(from);
+    const ring = start === -1 ? [...order] : order.map((_, i) => order[(start + 1 + i) % order.length]);
+    const eligible = [];
+    for (const cand of ring) {
+      if (!cand || cand === from)
+        continue;
+      if (this.isAccountExhausted(cand))
+        continue;
+      if (this.isAccountPremiumWalled(cand))
+        continue;
+      if (!accountExists(cand, this.home))
+        continue;
+      if (!readAccountCredentials(cand, this.home))
+        continue;
+      eligible.push(cand);
+    }
+    if (eligible.length === 0)
+      return null;
+    return bestPremiumHeadroomAccount(this.usageLedger, eligible, this.now()) ?? eligible[0];
+  }
+  earliestPremiumWallReset() {
+    let earliest = null;
+    for (const label of listAccounts(this.home)) {
+      const until = this.quota[label]?.premium_walled_until;
+      if (until != null && (earliest == null || until < earliest))
+        earliest = until;
+    }
+    return earliest;
+  }
+  markPremiumWalledAndRoll(account, until, bucket) {
+    const now = this.now();
+    const premiumWalledUntil = until ?? now + MODEL_TIER_WALL_DEFAULT_MS;
+    this.quota[account] = {
+      ...this.quota[account],
+      premium_walled_until: premiumWalledUntil,
+      premium_wall_bucket: bucket ?? undefined,
+      premium_wall_marked_at: now
+    };
+    this.persistQuota();
+    const target = this.nextPremiumEligibleAccount(account);
+    if (!target) {
+      return { rolledTo: null, allWalled: true, earliestReset: this.earliestPremiumWallReset() };
+    }
+    this.fanoutFailoverTo(account, target);
+    this.fanoutToAffectedConsumers(account);
+    this.clearPremiumAllWalled();
+    if (this.config.auth?.active === account) {
+      this.config = {
+        ...this.config,
+        auth: { ...this.config.auth ?? {}, active: target }
+      };
+      this.persistActiveOverride(target);
+      this.fanoutAllConsumers();
+      this.audit({ op: "auto-promote-active", identity: { kind: "operator" }, account: target, accountKind: "claude", ok: true, reason: "model-tier-wall" });
+      process.stdout.write(`auth-broker: auto-promoted auth.active ${account} → ${target} ` + `(${account} flagship-tier walled until ${new Date(premiumWalledUntil).toISOString()}, bucket=${bucket ?? "?"}) — persisted
+`);
+    }
+    return { rolledTo: target, allWalled: false, earliestReset: null };
+  }
   softAvoidState = {};
   softAvoidRolledTo = {};
   softAvoidSnapshotOf(account) {
@@ -20764,7 +21098,12 @@ class AuthBroker {
         throttled_until: q?.throttled_until,
         threshold_violations: this.thresholdViolations[label] ?? 0,
         last_refreshed_at: meta?.lastRefreshedAt,
-        last_quota: lq ?? null
+        last_quota: lq ?? null,
+        premium_walled: this.isAccountPremiumWalled(label),
+        premium_walled_until: q?.premium_walled_until,
+        premium_wall_bucket: q?.premium_wall_bucket,
+        last_tier_quota: this.lastTierQuotaCache[label] ?? null,
+        usage_ledger: summarizeAccountUsage(this.usageLedger, label, this.now())
       };
     });
     const agents = Object.entries(this.config.agents ?? {}).map(([name, agent]) => {
@@ -20786,7 +21125,8 @@ class AuthBroker {
       agents,
       consumers,
       active_overage_serving,
-      last_fleet_roll: this.lastFleetRoll
+      last_fleet_roll: this.lastFleetRoll,
+      premium_tier_all_walled: this.premiumTierAllWalled
     }));
   }
   async opListGoogleAccounts(socket, id, identity) {
@@ -20872,6 +21212,7 @@ class AuthBroker {
     };
     this.lastQuotaCache[label] = snapshot;
     this.persistLastQuotaCache();
+    this.recordUsage(label, "standard", standardSampleFromResult(result, this.now()));
     if (snapshotShouldClearMark(snapshot, this.exhaustionMarkOf(label), this.now())) {
       delete this.quota[label];
       this.persistQuota();
@@ -20882,6 +21223,9 @@ class AuthBroker {
   }
   async fleetQuotaProbeTick() {
     const probed = [];
+    const tierWalled = new Map;
+    const canarySet = this.premiumCanarySet();
+    const canaryEnabled = process.env.SWITCHROOM_DISABLE_MODEL_TIER_PROBE !== "1";
     for (const label of listAccounts(this.home)) {
       const creds = readAccountCredentials(label, this.home);
       const token = creds?.claudeAiOauth?.accessToken;
@@ -20896,12 +21240,49 @@ class AuthBroker {
       }
       this.cacheQuotaSnapshot(label, result);
       probed.push({ label, result });
+      if (canaryEnabled && canarySet.has(label)) {
+        let tierResult;
+        try {
+          tierResult = await this.fetchQuotaImpl({ accessToken: token, model: this.modelTierProbeModel });
+        } catch (err) {
+          this.logErr(`fleet-tier-probe ${label}: ${err.message}`);
+          continue;
+        }
+        this.recordTierProbe(label, tierResult);
+        const wall = quotaIndicatesModelTierWall(tierResult);
+        if (wall.walled)
+          tierWalled.set(label, { until: wall.until, bucket: wall.bucket });
+      }
+    }
+    for (const [label, wall] of tierWalled) {
+      const now = this.now();
+      this.quota[label] = {
+        ...this.quota[label],
+        premium_walled_until: wall.until ?? now + MODEL_TIER_WALL_DEFAULT_MS,
+        premium_wall_bucket: wall.bucket ?? undefined,
+        premium_wall_marked_at: now
+      };
     }
+    if (tierWalled.size > 0)
+      this.persistQuota();
     for (const { label, result } of probed) {
       const active = this.config.auth?.active;
       const isPinnedAgentAccount = this.pinnedAgentAccounts().has(label);
       if (label !== active && !isPinnedAgentAccount)
         continue;
+      const tw = tierWalled.get(label);
+      if (tw) {
+        process.stdout.write(`auth-broker: fleet-tier-probe shows ${label === active ? "ACTIVE" : "PINNED"} ${label} ` + `flagship-tier walled (bucket=${tw.bucket ?? "?"}) — model-tier failover
+`);
+        this.audit({ op: "mark-exhausted", identity: { kind: "operator" }, account: label, accountKind: "claude", ok: true, reason: "model-tier-wall" });
+        const { rolledTo, allWalled, earliestReset } = this.markPremiumWalledAndRoll(label, tw.until, tw.bucket);
+        if (rolledTo && label === active) {
+          this.recordFleetRoll(label, rolledTo, "model-tier-wall", tw.until ?? undefined, tw.bucket);
+        } else if (allWalled && label === active) {
+          this.recordPremiumAllWalled(tw.bucket, earliestReset);
+        }
+        continue;
+      }
       const decision = quotaIndicatesExhaustion(result, this.isOverageAllowed(label));
       if (decision.exhausted) {
         process.stdout.write(`auth-broker: fleet-quota-probe shows ${label === active ? "ACTIVE" : "PINNED"} ${label} exhausted — proactive failover
@@ -20916,21 +21297,52 @@ class AuthBroker {
       this.softAvoidProbeRoll(label);
     }
   }
-  recordFleetRoll(from, to, reason, exhaustedUntil) {
+  recordFleetRoll(from, to, reason, exhaustedUntil, bucket) {
     const s = this.lastQuotaCache[from];
     this.lastFleetRoll = {
       from,
       to,
       at: this.now(),
       reason,
+      ...bucket ? { bucket } : {},
       ...exhaustedUntil != null ? { exhausted_until: exhaustedUntil } : {},
-      ...s ? {
+      ...s && reason !== "model-tier-wall" ? {
         window: s.fiveHourUtilizationPct >= s.sevenDayUtilizationPct ? "5h" : "7d",
         pct: Math.max(s.fiveHourUtilizationPct, s.sevenDayUtilizationPct)
       } : {}
     };
     this.persistLastFleetRoll();
   }
+  premiumTierAllWalled = null;
+  recordPremiumAllWalled(bucket, earliestReset) {
+    this.premiumTierAllWalled = {
+      bucket,
+      ...earliestReset != null ? { earliest_reset: earliestReset } : {},
+      at: this.now()
+    };
+    atomicWriteJsonSync(join8(this.stateDir, "premium-tier-all-walled.json"), this.premiumTierAllWalled, 384);
+    process.stdout.write(`auth-broker: ALL accounts flagship-tier walled (bucket=${bucket ?? "?"}` + `${earliestReset != null ? `, earliest reset ${new Date(earliestReset).toISOString()}` : ""}) ` + `— no premium-eligible failover target
+`);
+  }
+  clearPremiumAllWalled() {
+    if (this.premiumTierAllWalled == null)
+      return;
+    this.premiumTierAllWalled = null;
+    try {
+      unlinkSync(join8(this.stateDir, "premium-tier-all-walled.json"));
+    } catch {}
+  }
+  premiumCanarySet() {
+    const set = new Set;
+    const active = this.config.auth?.active;
+    if (active)
+      set.add(active);
+    for (const cand of this.config.auth?.fallback_order ?? [])
+      set.add(cand);
+    for (const acct of this.pinnedAgentAccounts())
+      set.add(acct);
+    return set;
+  }
   pinnedAgentAccounts() {
     return new Set(Object.values(this.config.agents ?? {}).map((a) => a.auth?.override).filter((x) => typeof x === "string" && x.length > 0));
   }
@@ -21840,6 +22252,9 @@ class AuthBroker {
     this.notificationClaims = this.readJson("notification-claims.json") ?? {};
     this.lastFleetRoll = this.readJson("last-fleet-roll.json") ?? null;
     this.lastQuotaCache = this.readJson("last-quota.json") ?? {};
+    this.lastTierQuotaCache = this.readJson("last-tier-quota.json") ?? {};
+    this.premiumTierAllWalled = this.readJson("premium-tier-all-walled.json") ?? null;
+    this.usageLedger = this.readJson("usage-ledger.json") ?? {};
     this.applyActiveOverride();
   }
   applyActiveOverride() {
@@ -21893,6 +22308,22 @@ class AuthBroker {
   persistLastQuotaCache() {
     atomicWriteJsonSync(join8(this.stateDir, "last-quota.json"), this.lastQuotaCache, 384);
   }
+  persistLastTierQuotaCache() {
+    atomicWriteJsonSync(join8(this.stateDir, "last-tier-quota.json"), this.lastTierQuotaCache, 384);
+  }
+  persistUsageLedger() {
+    atomicWriteJsonSync(join8(this.stateDir, "usage-ledger.json"), this.usageLedger, 384);
+  }
+  recordUsage(label, tier, sample) {
+    if (sample == null)
+      return;
+    try {
+      recordUsageSample(this.usageLedger, label, tier, sample, this.usageRingCap);
+      this.persistUsageLedger();
+    } catch (err) {
+      this.logErr(`usage-ledger ${label}/${tier}: ${err.message}`);
+    }
+  }
   persistNotificationClaims() {
     atomicWriteJsonSync(join8(this.stateDir, "notification-claims.json"), this.notificationClaims, 384);
   }
@@ -22026,7 +22457,11 @@ class AuthBroker {
       shaIndex: { ...this.shaIndex },
       thresholdViolations: { ...this.thresholdViolations },
       listeners: [...this.listeners.keys()],
-      lastQuotaCache: structuredClone(this.lastQuotaCache)
+      lastQuotaCache: structuredClone(this.lastQuotaCache),
+      lastTierQuotaCache: structuredClone(this.lastTierQuotaCache),
+      usageLedger: structuredClone(this.usageLedger),
+      premiumTierAllWalled: this.premiumTierAllWalled ? { ...this.premiumTierAllWalled } : null,
+      activeAccount: this.config.auth?.active
     };
   }
   _fanoutAll() {