tokenmaxxing 1.19.1 → 1.21.0

package/DESIGN.md

@@ -49,8 +49,8 @@ The switching path runs no long-lived daemon. The statusline pushes usage. Hooks
 The Stop hook's stdin has no usage data, but the **statusLine does** (`rate_limits.{five_hour,seven_day}.{used_percentage,resets_at}`, after every turn, 300ms debounce, zero cost). tokenmaxxing's statusLine tees that to `usage.json` (write-on-change, O(ms)) and renders its own native line (it replaced the earlier pass-through delegation on 2026-07-11: install takes the statusLine slot outright, so a pre-existing custom statusline command is overwritten). Cold-start fallback if `usage.json` is absent: `TOKENMAXXING_PROBE=1 claude -p '/usage'`, with `[ -n "$TOKENMAXXING_PROBE" ] && exit 0` as the hook's first line to stop the nested process recursing (hooks fire in `-p` too). The probe scrubs every ambient credential override claude reads before the keychain (`CLAUDE_CODE_OAUTH_TOKEN`, `CLAUDE_SECURESTORAGE_CONFIG_DIR`, etc.) so it can only meter the credential in the keychain item, and retries the transient empty-footer case (claude prints local stats with no percentages when its own usage fetch throttles).
 
 ### 3.2 Detect + swap + signal (Stop hook, per turn)
-1. Read `usage.json`; `exit 0` fast below the engagement floor (`policy.greedySessionFloor`, default 80% of the 5h window) unless a screening bar is already crossed. Engaged-but-under-every-bar runs the GREEDY convergence: stay when the current account wins or ties, else swap onto the strictly better account. A crossed bar forces the hard path (metered per live `accountUuid`; team seats share one organization, so the organization never identifies a seat).
-2. Else take a `flock` on `~/.config/tokenmaxxing/lock`, re-check under it (parallel sessions race - first winner already swapped), pick the best parked account (not rate-limited, furthest behind its own weekly pace first: highest remaining% / time-to-weekly-reset, since unused allowance is forfeited at the fixed per-account reset; tiebreak soonest expiry then lowest 7-day usage), and **swap the credential** (§3.4).
+1. Read `usage.json` and exit below the engagement floor unless a screening bar is crossed, then follow the greedy or hard path defined in the [switching policy](docs/content/docs/switching.mdx).
+2. Take the pool lock, re-check state, select a candidate under the [switching policy](docs/content/docs/switching.mdx), and attempt bounded verification of stale usage before swapping the credential.
 3. Done - the running session adopts the new credential on its own within a request or two. Only when the pool is depleted (the decision returned a `waitUntil`: pre-parked on the soonest-recovering account, or staying on the current one when it recovers first) does the hook write `respawn/<session_id>` (atomic temp+rename).
 
 ### 3.3 Depleted-pool pause (supervisor)
@@ -79,13 +79,24 @@ Each terminal ran the supervisor, so each has its own child `claude` and its own
 ---
 
 ## 5. Rotation policy
-The decision engages at `five_hour >= 80%` (policy.greedySessionFloor): from there it greedily converges on the usable account furthest behind its weekly pace, staying put whenever the current account wins or ties. The automatic greedy path adds **incumbent hysteresis** (`policy.greedySwapMargin`, default 0.15): the seat holds unless a parked account's pace pressure beats it by more than that fraction, so near-tied accounts stop trading the seat back and forth and busting the per-org prompt cache (each such swap forces a full uncached re-read next turn). The margin only gates lateral under-bar swaps, never a crossed bar or the wall; bare `tokenmaxxing switch` sets it to zero and still converges on the strictly best account. The **Layer 1 screening bars** - `five_hour >= <active rung>` (the 5h ladder `thresholds.session`, default `[90]`, a single rung: the lowest rung some pooled account still clears, the current one included) OR `seven_day >= 98%`, per org (`thresholds`) - force a switch onto a fresher account and also screen candidates. "Exhausted" is a **timestamped state** (`resets_at`), not a flag - an account is a candidate again after it resets. Optional projected threshold (`bar - policy.projectionMargin`, a fixed configured margin) so a single large turn is less likely to blow past 100% before the next Stop hook.
+The [switching policy](docs/content/docs/switching.mdx) defines engagement, screening bars, organization preference, incumbent hysteresis and the wall squeeze.
 
-**Two layers - pump the last drops.** The screening bars deliberately leave headroom, so when *every* account is over them Layer 1 alone would park the pool with 2-5% of each account's quota still unspent. **Layer 2 - the wall bars** (`hardThresholds`, default `100/100`, the server's own limit) - is the fallback reached only at that point: the session **holds its seat and squeezes** while it is under the wall, else swaps onto the best still-under-wall account (the same pace-pressure ranking as every other swap - squeeze the account whose weekly quota is most about to be forfeited first), and only parks (depleted-wait) once every account has truly walled. Recovery is then measured against the wall, not the screening bar, so an account whose 5h window drops below 100 is squeezable again even while its weekly window still sits above the Layer 1 bar. The wall reading is the statusLine's own `rate_limits` feed - the same server-side figure claude's `/rate-limit-options` renders - so when an account genuinely maxes out the tee shows 100 and Layer 2 moves on; a single-turn overshoot is caught one boundary later (the periodic `check` timer, or the next Stop hook) without needing to sniff assistant text. Set `hardThresholds` equal to `thresholds` to disable Layer 2. **Layer 2 is Claude-only:** a swap on Claude is a hot, in-place credential adoption every concurrent session follows automatically, whereas a running Codex refuses another account's credential (restart is the switch), so a last-drop-swap there would strand any sibling still on the walled account - Codex instead keeps riding its current account to the wall (its existing all-exhausted stay-put already squeezes it).
+- Automatic lateral moves stay within the incumbent organization, and a crossed bar can trigger a cross-organization handoff.
+- Organization preference requires measured headroom in every applicable window and is an optimization heuristic, not a cache-hit guarantee.
+- Manual switching retains pure pace-pressure ranking.
+- Successful candidate probes persist their results and restart selection, preserving candidates that fail a screening bar but still clear the wall.
+- Verification attempts at most two candidates with a shared 12-second deadline per candidate for identity reads and CLI execution.
+- Expiring access tokens are not refreshed for verification, and the isolated CLI receives no refresh grant.
+- Failed or budget-limited verification uses the existing cached data, so stale-target handoffs remain possible.
 
-**Model-aware trigger.** Claude subscriptions also enforce **per-model weekly caps** - currently only for Sonnet and Fable (there is no Opus-only quota), and Fable's tighter limit binds *before* the aggregate (e.g. 80% week-Fable at only 50% week-all-models). This cap isn't in statusLine stdin, so when the active model is in `policy.switchModels` we read it from `claude -p '/usage'` (free, 0 tokens, TTL-cached) and add `week(<activeModel>) >= threshold` to the trigger. A Fable session switches on the Fable cap; a Sonnet session rides the aggregate. Both layers apply the per-model gate: a burnt Fable cap screens an account out of a Layer 1 switch, and a Fable cap at the wall screens it out of the Layer 2 squeeze too.
+The [profile](docs/content/docs/switching-profile.mdx) distinguishes observed cache rewrites from pricing-weighted estimates and does not infer subscription quota savings.
+
+The [wall policy](docs/content/docs/switching.mdx#the-wall) defines Layer 2 recovery and its conditional headroom preference, with pace-only selection under default bars.
 
-**Banked resets (opt-in).** Both CLIs can reset a hit limit on the same account: Claude Code's `/limit-reset` (the `juniper_tide` server program, claimed by `POST /api/organizations/<org>/reset_rate_limits`, once a week, and the reset window still counts toward the weekly limit; the slash command is interactive-only, so tokenmaxxing makes the claim call itself with the live credential) and Codex's banked reset (`POST .../wham/rate-limit-reset-credits/consume` with an idempotency key; it refreshes the 5h and weekly windows together). `policy.preferToUseBankedReset` (a provider list, default `[]`) makes the hard path spend one before swapping, because a swap cold-starts the per-org prompt cache while a reset keeps the seat. Claude holds between the session rung and the wall only while the account still has weekly room for one more session window at its measured rate (`sessionWindowWeeklyCost`, learned from the tee within one window; unmeasured swaps), claims at the wall, and on `reset` respawns the failed turn in place. Codex rides to the wall while the usage endpoint reports a credit, consumes one, re-samples, and never restarts. Detail: `docs/switching.mdx` §Banked resets, `src/lib/bankedreset.ts`, `src/lib/codexreset.ts`.
+- Layer 2 is Claude-only because its running sessions can adopt a credential change.
+- Codex keeps its current account until the wall because a running sibling cannot adopt another account without restarting.
+
+**Model-aware trigger.** Claude subscriptions also enforce **per-model weekly caps** - currently only for Sonnet and Fable (there is no Opus-only quota), and Fable's tighter limit binds *before* the aggregate (e.g. 80% week-Fable at only 50% week-all-models). This cap isn't in statusLine stdin, so when the active model is in `policy.switchModels` we read it from `claude -p '/usage'` (free, 0 tokens, TTL-cached) and add `week(<activeModel>) >= threshold` to the trigger. A Fable session switches on the Fable cap; a Sonnet session rides the aggregate. Both layers apply the per-model gate: a burnt Fable cap screens an account out of a Layer 1 switch, and a Fable cap at the wall screens it out of the Layer 2 squeeze too.
 
 ---
 

package/README.md

@@ -87,7 +87,14 @@ Switching engages (configurable) once the active account's 5-hour session window
 
 The bars' headroom is deliberate: it's the budget to reach a clean turn boundary (plus up to one turn of adoption lag on macOS) before the wall. The session ladder tops out lower (90) because a 5-hour reset is cheap to sit out, and any lower rungs you add keep the pool draining level by level; weekly quota is use-it-or-lose-it, so it drains closer to the wall (98). The greedy engagement floor (80) sits below both: weekly allowance is forfeited at each account's fixed reset, so once most of a session window is spent, quota is best burned on whichever account has the most at risk.
 
-The **target** is chosen greedily off each account's cached windows: among usable accounts (every window under its bar, or past its reset), the one **furthest behind its own weekly pace** - highest remaining% divided by time to its weekly reset - because unused weekly allowance is forfeited at the fixed per-account reset. Cached resets are absolute UTC epochs, so a stale snapshot still resolves correctly: a weekly reset that has passed extrapolates forward in 7-day steps, and a session window past its reset counts as empty. Both `tokenmaxxing switch` and the automatic path rank the current account too and do nothing when it already wins, so they are idempotent - evaluating periodically converges on the right account.
+Automatic selection prefers same-organization candidates with measured session and weekly headroom, then uses remaining weekly percentage divided by time to reset.
+
+- Lateral moves stay within the current organization, while a crossed bar or enforced limit may trigger a cross-organization handoff.
+- Candidate verification makes at most two bounded `/usage` attempts per evaluation and re-ranks successful samples before switching.
+- Failed verification leaves cached figures in force, so it cannot guarantee a fresh target.
+- Manual `tokenmaxxing switch` retains pure pace-pressure selection.
+
+See [How switching decides](docs/content/docs/switching.mdx) for the policy and the [cache-cost profile](docs/content/docs/switching-profile.mdx) for measurements and their limits.
 
 ## Configuration
 
@@ -101,13 +108,12 @@ The **target** is chosen greedily off each account's cached windows: among usabl
     "greedySessionFloor": 80,
     "switchModels": ["fable"],
     "usagePollTtlMs": 90000,
-    "checkIntervalMs": 60000,
-    "preferToUseBankedReset": []
+    "checkIntervalMs": 60000
   }
 }
 ```
 
-`thresholds.session` is a ladder: the bar is the lowest rung some pooled account still clears, so the default `[90]` is one bar, while with `[50, 80, 95]` a seat past 50 hands off while a sibling is under 50, and the bar climbs to 80 and then 95 as the whole pool fills; `projectionMargin` is a fixed safety margin subtracted from each threshold bar (effective bar = threshold - margin), so a large turn is less likely to blow past a bar between checks; `greedySessionFloor` is the session-used % at which the greedy convergence engages; `switchModels` names the models whose per-model cap triggers a switch; `usagePollTtlMs` is how long a `/usage` per-model poll stays fresh; `maxWaitMs` bounds the depleted-pool countdown - a soonest reset further out than this does not pause the session (no respawn marker is written and the session simply keeps hitting its limit until an account recovers); `checkIntervalMs` is the periodic check tick (default 60s), which `init` writes into the timer and which every headroom band is a multiple of, one tick near a bar up to five with plenty of headroom (a depleted wait and the post-swap cooldown sleep to their own deadlines instead) - re-run `tokenmaxxing init` after changing it so the timer unit picks up the new tick; `preferToUseBankedReset` lists the providers (`claude`, `codex`) that spend a banked limit reset (Claude Code's weekly `/limit-reset`, Codex's banked reset) on the same account before swapping, which keeps the prompt cache a swap would cold-start - on Claude the seat holds past the session rung only while the account has weekly room for one more session window at its measured rate, and claims the reset at the wall.
+`thresholds.session` is a ladder: the bar is the lowest rung some pooled account still clears, so the default `[90]` is one bar, while with `[50, 80, 95]` a seat past 50 hands off while a sibling is under 50, and the bar climbs to 80 and then 95 as the whole pool fills; `projectionMargin` is a fixed safety margin subtracted from each threshold bar (effective bar = threshold - margin), so a large turn is less likely to blow past a bar between checks; `greedySessionFloor` is the session-used % at which the greedy convergence engages; `switchModels` names the models whose per-model cap triggers a switch; `usagePollTtlMs` is how long a `/usage` per-model poll stays fresh; `maxWaitMs` bounds the depleted-pool countdown - a soonest reset further out than this does not pause the session (no respawn marker is written and the session simply keeps hitting its limit until an account recovers); `checkIntervalMs` is the periodic check tick (default 60s), which `init` writes into the timer and which every headroom band is a multiple of, one tick near a bar up to five with plenty of headroom (a depleted wait and the post-swap cooldown sleep to their own deadlines instead) - re-run `tokenmaxxing init` after changing it so the timer unit picks up the new tick.
 
 State lives entirely in `~/.config/tokenmaxxing/`. Per-account credentials follow the platform's Claude Code store: the login keychain on macOS (`tokenmaxxing-cred-<uuid8>` items, never plaintext on disk), 0600 files under `~/.config/tokenmaxxing/creds/` on Linux (the same plaintext model claude itself uses for `~/.claude/.credentials.json`).
 
@@ -149,7 +155,7 @@ codex                       # use codex as always
 
 Codex mechanics differ from Claude Code in one hard way: a running codex process refuses a credential swapped to a different account, so **a restart is the switch**. The installed Stop hook runs the same greedy pace-pressure decision at each turn boundary (usage read free from codex's own rate-limit endpoint: percentages plus absolute reset times, weekly aggregate and per-model caps alike); when it swaps, the supervisor relaunches `codex resume <session-id>` on the fresh account with the transcript intact. `tokenmaxxing switch --codex [sel]` does it manually, `status`/`watch`/`ls` show both pools.
 
-Two codex-specific facts worth knowing: codex does not run hooks it has not been told to trust, so after `init --codex` you must open codex once and trust the tokenmaxxing Stop hook via `/hooks` (auto-switching is inert until then); and codex has no cross-process lock on `auth.json`, so tokenmaxxing serializes all of its own credential writes behind its own lock and swaps only at idle turn boundaries. With `codex` in `policy.preferToUseBankedReset`, a seat at its limit consumes a banked reset credit (which refreshes both windows) and keeps running instead of restarting onto another account.
+Two codex-specific facts worth knowing: codex does not run hooks it has not been told to trust, so after `init --codex` you must open codex once and trust the tokenmaxxing Stop hook via `/hooks` (auto-switching is inert until then); and codex has no cross-process lock on `auth.json`, so tokenmaxxing serializes all of its own credential writes behind its own lock and swaps only at idle turn boundaries.
 
 ## Honest limitations
 

package/agent-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "tokenmaxxing",
-  "version": "1.19.1",
+  "version": "1.21.0",
   "description": "Pool Claude Code and Codex logins, switch on pace pressure, and expose safe ops tools to agent clients.",
   "author": {
     "name": "anaclumos",

package/agent-plugin/skills/switching-policy/SKILL.md

@@ -8,11 +8,15 @@ description: Explain and apply tokenmaxxing switch policy (greedy vs hard path,
 ## Vocabulary
 
 - **Engaged**: session used >= `policy.greedySessionFloor` (default 80) or any screening bar crossed.
-- **GREEDY path**: engaged but under every bar. Rank all accounts by pace pressure; keep seat on best-or-tie (`currentWins`); else swap to strictly better. Never depleted-waits or pre-parks. The automatic path adds incumbent hysteresis (`policy.greedySwapMargin`, default 0.15): hold the seat unless a parked account's pace pressure exceeds the current one's by more than that fraction, so near-tied accounts stop trading the seat and busting the per-org prompt cache. The margin gates lateral under-bar swaps only, never a crossed bar or the wall; bare `tokenmaxxing switch` uses margin 0 and always takes the strictly best account.
-- **HARD path**: a screening bar crossed. Swap to best usable target; if none, Layer 2 wall logic (Claude only).
+- **GREEDY path** permits lateral moves only within the incumbent organization and retains `greedySwapMargin` hysteresis.
+- **HARD path** starts at a crossed screening bar and may cross organizations, with Layer 2 as its fallback.
+- **Organization preference** requires measured headroom in session, aggregate weekly and gated model windows under the [policy](references/policy.md).
+- **Verification** attempts at most two stale candidates per evaluation, with a 12-second deadline covering identity reads and the CLI for each candidate.
+- **Probe results** are persisted and re-ranked, while screening exhaustion remains eligible for the wall squeeze and reset selection.
+- **Unavailable verification** leaves cached figures in force, and verification never spends a parked refresh grant.
+- **Manual switch** retains pure pace ranking with no organization preference or incumbent margin.
 - **Pace pressure**: remaining weekly percent / time to weekly reset (highest first). Not most-remaining.
 - **Effective bars**: `effectiveBars(cfg, pool)` = the active rung of the 5h ladder (`thresholds.session`, default `[90]`, a single rung: the lowest rung some pooled account, the current one included, still clears) and the weekly bar, each minus `policy.projectionMargin`. Trigger and screening must share these bars or swaps ping-pong. Codex reads `terminalBars(cfg)`, the top rung only. The check cadence is capped one band per rung climbed, and every band is a multiple of the tick `policy.checkIntervalMs` (default 60000).
-- **Banked reset**: opt-in via `policy.preferToUseBankedReset` (a provider list, default `[]`), hard path only. Claude: the seat holds between the session rung and the wall while a reset is believed available and the weekly windows have room for one more measured session window (`sessionWindowWeeklyCost`; unmeasured swaps), claims the `/limit-reset` server call at the wall, and keeps the seat on `reset` (the failed turn is retriggered in place). Codex: rides to the wall while a reset credit exists, consumes one, no restart. The greedy path never resets.
 
 ## Layer 2 (Claude only)
 

package/agent-plugin/skills/switching-policy/references/policy.md

@@ -2,7 +2,8 @@
 
 - `docs/content/docs/switching.mdx`
 - `src/lib/decide.ts`, `src/lib/picker.ts`
-- `src/lib/bankedreset.ts`, `src/lib/codexreset.ts` (banked limit resets)
-- `.memory/switch-policy-pace-pressure.md`
+- `.cursor/rules/switch-verification.md`
 
-Default screening bars: session ladder [90] (a single rung; add lower rungs such as [50, 80, 95] to hand off earlier) with the active rung resolved per pool, weekly 98. Engagement floor 80. Wall defaults 100. Cooldown 45s on the automatic path after a swap. Check tick `policy.checkIntervalMs` (default 60000, minimum 10000); `init` writes it into the timer unit. Check cadence ceiling per rung: five ticks, three, two, then the one-tick floor, with the headroom bands at the same multiples (40 points sleeps five ticks, 20 three, 8 two, less every tick). Banked resets off by default (`policy.preferToUseBankedReset: []`); Claude claims once a week per account at the wall, Codex consumes one credit at the wall.
+Automatic organization preference requires session usage below `greedySessionFloor` and more than `max(1, session bar - greedySessionFloor)` points below every applicable bar.
+
+The exact policy, defaults, verification limits and manual-switch behavior live in `docs/content/docs/switching.mdx`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tokenmaxxing",
-  "version": "1.19.1",
+  "version": "1.21.0",
   "description": "Automatic Claude Code account switching: pool multiple accounts and hot-swap when quota fills, resuming your session on the fresh account.",
   "type": "module",
   "license": "MIT",

package/src/cli/check.ts

@@ -30,7 +30,6 @@ export async function cmdCheck(args: string[] = [], json = false): Promise<numbe
       ok: true,
       due: true,
       swapped: d.swapped,
-      reset: d.reset === true,
       account: d.account?.label ?? null,
       reason: d.reason,
       waitUntil: d.waitUntil ?? null,
@@ -41,8 +40,6 @@ export async function cmdCheck(args: string[] = [], json = false): Promise<numbe
   const next = c.dim(`next in ${Math.round(delayMs / 1000)}s`);
   if (d.swapped && d.account) {
     console.log(`${c.green("↻")} switched to ${c.bold(d.account.label)} ${next}`);
-  } else if (d.reset && d.account) {
-    console.log(`${c.green("↻")} reset the session limit on ${c.bold(d.account.label)} ${next}`);
   } else if (d.waitUntil !== undefined && d.account) {
     console.log(c.yellow(`all accounts at limit - staying on ${c.bold(d.account.label)} (${fmtReset(d.waitUntil)})`) + ` ${next}`);
   } else {

package/src/cli/config.ts

@@ -21,7 +21,6 @@ export const KNOWN_KEYS = [
   "policy.usagePollTtlMs",
   "policy.maxWaitMs",
   "policy.checkIntervalMs",
-  "policy.preferToUseBankedReset",
 ] as const;
 
 const TIMER_REWRITE_NOTE = "note: run `tokenmaxxing init` to rewrite the periodic timer at the new tick";

package/src/cli/status.ts

@@ -12,7 +12,7 @@ import { isCodexExhausted } from "../lib/codexpick.ts";
 import { codexLimitLabel, isSessionWindow } from "../lib/codexusage.ts";
 import { bar, c, claudeTierLabel, count, emitJson, fmtAgo } from "./render.ts";
 import { gatedFamilies, type FullUsage } from "../lib/usage.ts";
-import { BankedResetRecordSchema, ThresholdsSchema, UsageWindowSchema, type Account, type CodexWindow, type Config, type UsageWindow } from "../lib/types.ts";
+import { ThresholdsSchema, UsageWindowSchema, type Account, type CodexWindow, type Config, type UsageWindow } from "../lib/types.ts";
 
 const SampleReportSchema = z.discriminatedUnion("ok", [
   z.object({ ok: z.literal(true), source: z.enum(["statusline", "probe"]) }),
@@ -35,9 +35,6 @@ const ClaudeStatusAccountSchema = z.object({
   pingError: z.string().nullable(),
   pingRejected: z.boolean(),
   pinged: z.boolean(),
-  bankedReset: BankedResetRecordSchema.nullable(),
-  sessionWindowWeeklyCost: z.number().nullable(),
-  sessionWindowFamilyCosts: z.record(z.string(), z.number()).nullable(),
 });
 type ClaudeStatusAccount = z.infer<typeof ClaudeStatusAccountSchema>;
 
@@ -59,7 +56,6 @@ const CodexStatusAccountSchema = z.object({
     .nullable(),
   usageAt: z.number().nullable(),
   sample: SampleReportSchema,
-  resetCredits: z.number().int().nullable(),
 });
 type CodexStatusAccount = z.infer<typeof CodexStatusAccountSchema>;
 
@@ -158,7 +154,6 @@ async function collectClaude(input: { cfg: Config; ping: boolean; pingCount: num
         if (!outcome.ok) return;
         a.lastUsage = { fiveHour: outcome.usage.session, sevenDay: outcome.usage.weekAll };
         a.lastUsageAt = viaTee && teeAt != null ? (live?.sampledAt ?? teeAt) : Date.now();
-        if (viaTee && live?.sessionWindowWeeklyCost != null) a.sessionWindowWeeklyCost = live.sessionWindowWeeklyCost;
         if (Object.keys(outcome.usage.perModel).length > 0) {
           a.lastPerModel = outcome.usage.perModel;
           a.lastPerModelAt = viaTee && modelUsage ? (modelUsage.sampledAt ?? modelUsage.ts) : a.lastUsageAt;
@@ -178,7 +173,6 @@ async function collectClaude(input: { cfg: Config; ping: boolean; pingCount: num
   const families = gatedFamilies(loadUsage()?.model ?? null, cfg.policy.switchModels);
   const bars = effectiveBars(cfg, { accounts: idx.accounts, now, switchFamilies: families });
   const liveAccount = readOAuthAccount()?.accountUuid ?? null;
-  const liveModelUsage = loadModelUsage();
   const ordered = sortBy(idx.accounts, [(a) => (a.needsReauth ? 1 : 0), (a) => earliestReset(a, now)]);
   const accounts = ordered.map((a): ClaudeStatusAccount => {
     const sampled = samples.get(a.accountUuid) ?? { outcome: { ok: false, reason: "not sampled" }, viaTee: false };
@@ -201,9 +195,6 @@ async function collectClaude(input: { cfg: Config; ping: boolean; pingCount: num
       pingError: sampled.outcome.pingError ?? null,
       pingRejected: sampled.outcome.pingRejected === true,
       pinged: pings.has(a.accountUuid) && sampled.outcome.ok && sampled.outcome.pingError == null && aggregate != null && aggregate.fiveHour.resetsAt == null,
-      bankedReset: a.bankedReset ?? null,
-      sessionWindowWeeklyCost: a.sessionWindowWeeklyCost ?? null,
-      sessionWindowFamilyCosts: liveModelUsage && liveModelUsage.account === a.accountUuid ? (liveModelUsage.familyCosts ?? null) : null,
     };
   });
   return {
@@ -231,7 +222,7 @@ async function collectCodex(input: { cfg: Config; now: number }): Promise<Status
         const outcome = await sampleCodexAccount({ account, liveAccountId: liveId, now });
         outcomes.set(account.accountId, outcome);
         if (outcome.ok) {
-          account.lastUsage = { aggregate: outcome.usage.aggregate, perLimit: outcome.usage.perLimit, resetCredits: outcome.usage.resetCredits, reachedType: outcome.usage.reachedType };
+          account.lastUsage = { aggregate: outcome.usage.aggregate, perLimit: outcome.usage.perLimit };
           account.lastUsageAt = Date.now();
           if (outcome.usage.email != null) account.email = outcome.usage.email;
           if (outcome.usage.planType != null) account.planType = outcome.usage.planType;
@@ -272,7 +263,6 @@ async function collectCodex(input: { cfg: Config; now: number }): Promise<Status
         : null,
       usageAt: account.lastUsageAt ?? null,
       sample: outcome.ok ? { ok: true, source: "probe" } : { ok: false, reason: outcome.reason },
-      resetCredits: usage?.resetCredits ?? null,
     };
   });
   return { bars, accounts };

package/src/cli/switch.ts

@@ -7,6 +7,7 @@ import { currentWins, effectiveBars, pickBest, pickEarliestReset, weeklyExpiry,
 import { InvalidGrantError } from "../lib/oauth.ts";
 import { gatedFamilies } from "../lib/usage.ts";
 import { findAccount } from "./rename.ts";
+import { log } from "../lib/log.ts";
 import { c, emitError, emitJson, fmtReset } from "./render.ts";
 import type { Account } from "../lib/types.ts";
 
@@ -44,6 +45,7 @@ export async function cmdSwitch(selector?: string, json = false): Promise<number
         }
         throw e;
       }
+      log("switch.manual", { account: target.accountUuid.slice(0, 8), reason });
       emit(`${c.green("↻")} switched to ${c.bold(target.label)}`, { switched: true, account: target.label, reason, ...extra });
       return 0;
     };
@@ -69,12 +71,12 @@ export async function cmdSwitch(selector?: string, json = false): Promise<number
     const rejected = new Set<string>();
     while (true) {
       const cur = loadAccounts();
-      const everyone = everyoneIn(cur.accounts);
       const pool = cur.accounts.filter((a) => !rejected.has(a.accountUuid));
       const active =
         (claimed != null ? cur.accounts.find((a) => a.accountUuid === claimed) : null) ??
         cur.accounts.find((a) => a.accountUuid === cur.activeAccountUuid) ??
         null;
+      const everyone = everyoneIn(cur.accounts);
       if (active != null && currentWins(active, pool, everyone)) {
         if (drifted) return swapTo(active, "drift-reconciled");
         const expiry = weeklyExpiry(active, now);
@@ -104,6 +106,7 @@ export async function cmdSwitch(selector?: string, json = false): Promise<number
         }
         throw e;
       }
+      log("switch.manual", { account: best.accountUuid.slice(0, 8), reason: "best" });
       emit(`${c.green("↻")} switched to ${c.bold(best.label)}`, { switched: true, account: best.label, reason: "best" });
       return 0;
     }
@@ -159,6 +162,7 @@ export async function cmdSwitch(selector?: string, json = false): Promise<number
         }
         throw e;
       }
+      log("switch.manual", { account: earliest.account.accountUuid.slice(0, 8), reason: "earliest-reset" });
       emit(`${c.green("↻")} switched to ${c.bold(earliest.account.label)}`, { switched: true, account: earliest.account.label, reason: "earliest-reset", availableAt, reauthNeeded: reauth });
       if (availableAt != null && !json) {
         console.log(c.yellow(`all accounts at limit - ${c.bold(earliest.account.label)} recovers soonest (${fmtReset(availableAt, now)})${reauthNote}`));

package/src/entries/codexstophook.ts

@@ -99,7 +99,6 @@ export async function handleCodexStop(input: { rawStdin: string }): Promise<void
     }
     if (await promoteReconcile({ supervisorId, sessionId })) return;
     const decision = await evaluateAndMaybeSwapCodex({});
-    if (decision.reset && decision.account) log("codexstop.reset", { account: decision.account.accountId.slice(0, 8) });
     if (decision.swapped && decision.account) {
       mkdirSync(codexPaths.respawnDir, { recursive: true });
       const payload = CodexRespawnMarkerSchema.parse({

package/src/entries/stopfailurehook.ts

@@ -4,13 +4,12 @@ import { paths } from "../lib/paths.ts";
 import { writeFileAtomic } from "../lib/atomic.ts";
 import { readOAuthAccount } from "../lib/claudejson.ts";
 import { enforcedWindowMs, evaluateAndMaybeSwap, postSwapProof, recordEnforcedLimit } from "../lib/decide.ts";
-import { loadConfig, loadLastSeatChangeAt, loadLastSwapAt } from "../lib/state.ts";
+import { loadConfig, loadLastSwapAt } from "../lib/state.ts";
 import { classifyEnforcedLimit, findEnforcedRow, parseErrorBody, readTranscriptTail } from "../lib/usage.ts";
 import { RespawnMarkerSchema, type EnforcedLimit } from "../lib/types.ts";
 import { log } from "../lib/log.ts";
 
 export const RETRIGGER_PROMPT = "Continue where the previous turn left off; it was interrupted by a usage limit and tokenmaxxing switched accounts.";
-export const RETRIGGER_RESET_PROMPT = "Continue where the previous turn left off; it was interrupted by the session limit and tokenmaxxing reset that limit on the same account.";
 
 const StopFailureStdin = z.looseObject({
   session_id: z.uuid().optional().catch(undefined),
@@ -53,11 +52,11 @@ export async function runStopFailureHook(): Promise<number> {
 
     let enforced: EnforcedLimit | null = null;
     if (limit && found && account) {
-      if (postSwapProof({ swapAt: limit.kind === "session" ? loadLastSeatChangeAt() : loadLastSwapAt(), launchedAt, errorAt: found.errorAt, now })) {
+      if (postSwapProof({ swapAt: loadLastSwapAt(), launchedAt, errorAt: found.errorAt, now })) {
         const stamp = await recordEnforcedLimit({ limit, account, now });
         log("stopfailure.enforced", { kind: limit.kind, family: limit.kind === "model" ? limit.family : undefined, outcome: stamp.outcome, resetsAt: stamp.resetsAt, subagent: !mainLoop });
         if (stamp.outcome !== "account-moved") {
-          enforced = { account, kind: limit.kind, family: limit.kind === "model" ? limit.family : null, resetsAt: stamp.resetsAt, windowMs: enforcedWindowMs(limit) };
+          enforced = { account, family: limit.kind === "model" ? limit.family : null, resetsAt: stamp.resetsAt, windowMs: enforcedWindowMs(limit) };
         }
       } else {
         log("stopfailure.unproven", { kind: limit.kind });
@@ -72,20 +71,18 @@ export async function runStopFailureHook(): Promise<number> {
     }
 
     const decision = await evaluateAndMaybeSwap(now, canPause && enforced != null, enforced);
-    const reset = decision.reset === true;
-    if (enforced && canPause && pinnedSid && decision.account && (decision.swapped || decision.waitUntil !== undefined || reset)) {
+    if (enforced && canPause && pinnedSid && decision.account && (decision.swapped || decision.waitUntil !== undefined)) {
       const marker = join(paths.respawnDir, pinnedSid);
       const payload = RespawnMarkerSchema.parse({
         account: decision.account.label,
         ts: Date.now(),
         waitUntil: decision.waitUntil ?? now,
         sessionId: stdinSid ?? pinnedSid,
-        prompt: reset ? RETRIGGER_RESET_PROMPT : RETRIGGER_PROMPT,
+        prompt: RETRIGGER_PROMPT,
         ...(launchedAt != null ? { launchedAt } : {}),
-        ...(reset ? { reset } : {}),
       });
       writeFileAtomic(marker, JSON.stringify(payload));
-      log("stopfailure.marker", { session: (stdinSid ?? pinnedSid).slice(0, 8), account: decision.account.accountUuid.slice(0, 8), waitUntil: payload.waitUntil, reset });
+      log("stopfailure.marker", { session: (stdinSid ?? pinnedSid).slice(0, 8), account: decision.account.accountUuid.slice(0, 8), waitUntil: payload.waitUntil });
     } else {
       log("stopfailure.decision", { reason: decision.reason, swapped: decision.swapped, account: decision.account?.accountUuid.slice(0, 8), waitUntil: decision.waitUntil });
     }

package/src/entries/stophook.ts

@@ -25,7 +25,6 @@ export async function runStopHook(): Promise<number> {
   try {
     const canPause = process.env.TOKENMAXXING_SUPERVISED === "1" && pinnedSid != null;
     const decision = await evaluateAndMaybeSwap(Date.now(), canPause);
-    if (decision.reset && decision.account) log("stop.reset", { account: decision.account.accountUuid.slice(0, 8) });
     if (decision.account && (decision.swapped || decision.waitUntil !== undefined)) {
       log(decision.swapped ? "stop.swapped" : "stop.wait", { account: decision.account.accountUuid.slice(0, 8), waitUntil: decision.waitUntil });
       if (decision.waitUntil !== undefined && canPause && pinnedSid) {

package/src/entries/supervisor.ts

@@ -286,8 +286,7 @@ export async function runSupervisor(argv: string[]): Promise<number> {
       respawns++;
       if (m.waitUntil > Date.now()) {
         if (await countdownWait(m.account, m.waitUntil)) overriddenUntil = m.waitUntil;
-      } else if (m.reset) process.stdout.write(`\n\x1b[36m↻ tokenmaxxing: reset the session limit on ${m.account} - resuming...\x1b[0m\n`);
-      else process.stdout.write(`\n\x1b[36m↻ tokenmaxxing: switched to ${m.account} - resuming...\x1b[0m\n`);
+      } else process.stdout.write(`\n\x1b[36m↻ tokenmaxxing: switched to ${m.account} - resuming...\x1b[0m\n`);
       saveSessionFlags(m.sessionId, persistable, process.cwd());
       launchArgs = ["--resume", m.sessionId, ...persistable, ...(m.prompt ? ["--", m.prompt] : [])];
       continue;

package/src/lib/codexdecide.ts

@@ -11,7 +11,6 @@ import { performCodexSwap } from "./codexswap.ts";
 import { CodexInvalidGrantError, refreshCodexAuth } from "./codexoauth.ts";
 import { fetchCodexUsage } from "./codexusage.ts";
 import { codexIdentityOf, isCodexAccessExpiring, readLiveCodexAuth, writeLiveCodexAuth, writeParkedCodexAuth } from "./codexauth.ts";
-import { codexBankedResetVerdict, consumeLiveCodexBankedReset } from "./codexreset.ts";
 import { liveCodexAccountId } from "./codexsample.ts";
 import { livingCodexPresences, presentCodexAccountIds, targetableCodexAccounts } from "./codexpresence.ts";
 import { terminalBars } from "./picker.ts";
@@ -22,7 +21,6 @@ const CodexSwapDecisionSchema = z.object({
   swapped: z.boolean(),
   account: CodexAccountSchema.nullable(),
   reason: z.string(),
-  reset: z.boolean().optional(),
 });
 export type CodexSwapDecision = z.infer<typeof CodexSwapDecisionSchema>;
 
@@ -53,7 +51,7 @@ async function sampleLiveOntoOwner(input: { now: number }): Promise<string | nul
     writeParkedCodexAuth({ credFile: owner.credFile, auth: live });
   }
   const usage = await fetchCodexUsage({ auth: live });
-  owner.lastUsage = { aggregate: usage.aggregate, perLimit: usage.perLimit, resetCredits: usage.resetCredits, reachedType: usage.reachedType };
+  owner.lastUsage = { aggregate: usage.aggregate, perLimit: usage.perLimit };
   owner.lastUsageAt = now;
   if (usage.email != null) owner.email = usage.email;
   if (usage.planType != null) owner.planType = usage.planType;
@@ -139,28 +137,6 @@ export async function evaluateAndMaybeSwapCodex(input: { now?: number }): Promis
       isCodexExhausted({ account: active, thresholds: bars, now });
     if (!engaged) return { swapped: false, account: null, reason: "under-threshold-or-stale" };
 
-    if (cfg.policy.preferToUseBankedReset.includes("codex") && active.needsReauth !== true) {
-      const seat = active;
-      const verdict = codexBankedResetVerdict({ account: seat, thresholds: bars, now, pollTtlMs: cfg.policy.usagePollTtlMs });
-      if (verdict === "hold") {
-        log("codexdecide.banked_reset_hold", { account: seat.accountId.slice(0, 8) });
-        return { swapped: false, account: seat, reason: "banked-reset-hold" };
-      }
-      if (verdict === "claim") {
-        const claim = await consumeLiveCodexBankedReset({ account: seat, now });
-        if (claim === "reset") {
-          try {
-            await sampleLiveOntoOwner({ now: Date.now() });
-          } catch (e) {
-            log("codexdecide.resample_failed", { err: e instanceof Error ? e.message : String(e) });
-          }
-          const fresh = loadCodexAccounts().accounts.find((account) => account.accountId === activeId) ?? seat;
-          if (fresh.lastUsage) postSwapResweep({ liveAccountId: activeId, bars, now });
-          return { swapped: false, account: fresh, reason: "banked-reset", reset: true };
-        }
-      }
-    }
-
     if (!isCodexExhausted({ account: active, thresholds: bars, now })) {
       while (true) {
         const current = loadCodexAccounts();

package/src/lib/codexpick.ts

@@ -3,20 +3,20 @@ import { nextWeeklyReset } from "./picker.ts";
 import { isSessionWindow, weeklyWindowOf } from "./codexusage.ts";
 import type { CodexAccount, CodexWindow, Thresholds } from "./types.ts";
 
-export function liveUsed(input: { window: CodexWindow; now: number; sampledAt: number | null }): number {
+function liveUsed(input: { window: CodexWindow; now: number; sampledAt: number | null }): number {
   const { window, now, sampledAt } = input;
   if (window.resetsAt != null) return window.resetsAt <= now ? 0 : window.usedPercentage;
   if (sampledAt != null && window.windowSeconds != null && now >= sampledAt + window.windowSeconds * 1000) return 0;
   return window.usedPercentage;
 }
 
-export function allWindows(account: CodexAccount): CodexWindow[] {
+function allWindows(account: CodexAccount): CodexWindow[] {
   const usage = account.lastUsage;
   if (!usage) return [];
   return [...usage.aggregate, ...Object.values(usage.perLimit).flat()];
 }
 
-export function barFor(input: { window: CodexWindow; thresholds: Thresholds }): number {
+function barFor(input: { window: CodexWindow; thresholds: Thresholds }): number {
   return isSessionWindow({ window: input.window }) ? input.thresholds.session : input.thresholds.weekly;
 }
 

package/src/lib/codexusage.ts

@@ -25,8 +25,6 @@ const WireRateLimitSchema = z.looseObject({
   secondary_window: WireWindowSchema.nullish(),
 });
 
-const WireReachedTypeSchema = z.union([z.string(), z.looseObject({ type: z.string().nullish(), kind: z.string().nullish() })]).nullish().catch(null);
-
 const WireUsageSchema = z.looseObject({
   account_id: z.string(),
   email: z.string().nullish(),
@@ -35,8 +33,6 @@ const WireUsageSchema = z.looseObject({
   additional_rate_limits: z
     .array(z.looseObject({ limit_name: z.string(), rate_limit: WireRateLimitSchema.nullish() }))
     .nullish(),
-  rate_limit_reset_credits: z.looseObject({ available_count: z.number().int().nullish() }).nullish(),
-  rate_limit_reached_type: WireReachedTypeSchema,
 });
 
 function toWindows(rateLimit: z.infer<typeof WireRateLimitSchema> | null | undefined): CodexWindow[] {
@@ -96,11 +92,6 @@ export async function fetchCodexUsage(input: { auth: CodexAuthJson }): Promise<C
     planType: wire.plan_type ?? null,
     aggregate: toWindows(wire.rate_limit),
     perLimit,
-    resetCredits: wire.rate_limit_reset_credits?.available_count ?? null,
-    reachedType:
-      typeof wire.rate_limit_reached_type === "string"
-        ? wire.rate_limit_reached_type
-        : (wire.rate_limit_reached_type?.type ?? wire.rate_limit_reached_type?.kind ?? null),
   });
 }