tokenmaxxing 1.2.1 → 1.4.0

package/DESIGN.md

@@ -79,9 +79,11 @@ Each terminal ran the supervisor, so each has its own child `claude` and its own
 ---
 
 ## 5. Rotation policy
-The decision engages at `five_hour >= 50%` (policy.greedySessionFloor): from there it greedily converges on the usable account furthest behind its weekly pace, staying put whenever the current account wins or ties. The hard bars - `five_hour >= 95%` OR `seven_day >= 98%`, per org - always force a switch and also screen candidates. "Exhausted" is a **timestamped state** (`resets_at`), not a flag - an account is a candidate again after it resets. Optional projected threshold (`bar - policy.projectionMargin`, a fixed configured margin) so a single large turn is less likely to blow past 100% before the next Stop hook.
+The decision engages at `five_hour >= 50%` (policy.greedySessionFloor): from there it greedily converges on the usable account furthest behind its weekly pace, staying put whenever the current account wins or ties. The **Layer 1 screening bars** - `five_hour >= 95%` OR `seven_day >= 98%`, per org (`thresholds`) - force a switch onto a fresher account and also screen candidates. "Exhausted" is a **timestamped state** (`resets_at`), not a flag - an account is a candidate again after it resets. Optional projected threshold (`bar - policy.projectionMargin`, a fixed configured margin) so a single large turn is less likely to blow past 100% before the next Stop hook.
 
-**Model-aware trigger.** Claude subscriptions also enforce **per-model weekly caps** - currently only for Sonnet and Fable (there is no Opus-only quota), and Fable's tighter limit binds *before* the aggregate (e.g. 80% week-Fable at only 50% week-all-models). This cap isn't in statusLine stdin, so when the active model is in `policy.switchModels` we read it from `claude -p '/usage'` (free, 0 tokens, TTL-cached) and add `week(<activeModel>) >= threshold` to the trigger. A Fable session switches on the Fable cap; a Sonnet session rides the aggregate.
+**Two layers - pump the last drops.** The screening bars deliberately leave headroom, so when *every* account is over them Layer 1 alone would park the pool with 2-5% of each account's quota still unspent. **Layer 2 - the wall bars** (`hardThresholds`, default `100/100`, the server's own limit) - is the fallback reached only at that point: the session **holds its seat and squeezes** while it is under the wall, else swaps onto the best still-under-wall account (the same pace-pressure ranking as every other swap - squeeze the account whose weekly quota is most about to be forfeited first), and only parks (depleted-wait) once every account has truly walled. Recovery is then measured against the wall, not the screening bar, so an account whose 5h window drops below 100 is squeezable again even while its weekly window still sits above the Layer 1 bar. The wall reading is the statusLine's own `rate_limits` feed - the same server-side figure claude's `/rate-limit-options` renders - so when an account genuinely maxes out the tee shows 100 and Layer 2 moves on; a single-turn overshoot is caught one boundary later (the periodic `check` timer, or the next Stop hook) without needing to sniff assistant text. The serve/SDK path additionally stamps an account walled the instant an *errored* turn result reports a limit (`recordObservedLimit`, gated on `is_error`), because it has no statusLine tee. Set `hardThresholds` equal to `thresholds` to disable Layer 2. **Layer 2 is Claude-only:** a swap on Claude is a hot, in-place credential adoption every concurrent session follows automatically, whereas a running Codex refuses another account's credential (restart is the switch), so a last-drop-swap there would strand any sibling still on the walled account - Codex instead keeps riding its current account to the wall (its existing all-exhausted stay-put already squeezes it).
+
+**Model-aware trigger.** Claude subscriptions also enforce **per-model weekly caps** - currently only for Sonnet and Fable (there is no Opus-only quota), and Fable's tighter limit binds *before* the aggregate (e.g. 80% week-Fable at only 50% week-all-models). This cap isn't in statusLine stdin, so when the active model is in `policy.switchModels` we read it from `claude -p '/usage'` (free, 0 tokens, TTL-cached) and add `week(<activeModel>) >= threshold` to the trigger. A Fable session switches on the Fable cap; a Sonnet session rides the aggregate. Both layers apply the per-model gate: a burnt Fable cap screens an account out of a Layer 1 switch, and a Fable cap at the wall screens it out of the Layer 2 squeeze too.
 
 ---
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tokenmaxxing",
-  "version": "1.2.1",
+  "version": "1.4.0",
   "description": "Automatic Claude Code account switching: pool multiple accounts and hot-swap when quota fills, resuming your session on the fresh account.",
   "type": "module",
   "license": "MIT",

package/src/cli/config.ts

@@ -20,6 +20,8 @@ import { c } from "./render.ts";
 export const KNOWN_KEYS = [
   "thresholds.session",
   "thresholds.weekly",
+  "hardThresholds.session",
+  "hardThresholds.weekly",
   "claudeBin",
   "codexBin",
   "policy.projectionMargin",

package/src/cli/serve.ts

@@ -15,7 +15,8 @@
 //   serve links            list links
 //   serve                  run the daemon
 
-import { existsSync, realpathSync } from "node:fs";
+import { existsSync, readFileSync, readdirSync, realpathSync } from "node:fs";
+import { join } from "node:path";
 import { delay, omit, uniq } from "es-toolkit";
 import { z } from "zod";
 import { Chat, ConsoleLogger, StreamingPlan, ThreadImpl, type StreamChunk } from "chat";
@@ -36,6 +37,7 @@ import {
   stripLeadingMention,
   upsertLink,
   SlackLinkSchema,
+  SlackThreadSchema,
   type ActiveTurn,
   type SlackConfig,
   type SlackLink,
@@ -369,6 +371,8 @@ export function buildServeRuntime(seam: {
   let draining = false;
   // channels already diagnosed as unlinked this run (see handleTurn).
   const unlinkedLogged = new Set<string>();
+  // corrupt thread records already logged as skipped this run (see nudgeSweep).
+  const sweepSkipLogged = new Set<string>();
 
   /** Best-effort status reaction: reaction state is decoration, so every
    *  failure (missing reactions:write until the app is reinstalled,
@@ -730,10 +734,22 @@ export function buildServeRuntime(seam: {
     return true;
   };
 
+  /** The ownership funnel for every task the daemon spawns: registration in
+   *  activeTurns so a shutdown drains it, and the daemon's terminal error
+   *  boundary. Bun kills the WHOLE process on any unhandled rejection
+   *  (default-mode exit verified 2026-07-27), so a `void tracked(...)`
+   *  fire-and-forget whose task threw would otherwise take every concurrent
+   *  session's turn down with it - one thread's bad state file must never
+   *  end another thread's half-streamed answer. Site-specific handling (the
+   *  in-thread crash notice in onMessage) stays at the site that has the
+   *  context; whatever escapes lands here, logged, and the daemon keeps
+   *  serving. */
   const tracked = async (turn: Promise<void>) => {
     activeTurns.add(turn);
     try {
       await turn;
+    } catch (e) {
+      log("serve.task_crashed", { err: (e instanceof Error ? e.message : String(e)).slice(0, 300) });
     } finally {
       activeTurns.delete(turn);
     }
@@ -775,7 +791,47 @@ export function buildServeRuntime(seam: {
   const onMessage = async (input: { thread: ServeThread; message: ServeMessage; skipped: ServeMessage[]; isMention: boolean }) => {
     const relayed = [...input.skipped, input.message].filter(relayable).map((m) => ({ text: m.text, authorId: m.author.userId, id: m.id }));
     if (relayed.length === 0) return; // outsider mentions never open a session
-    await tracked(serialized(input.thread.id, () => handleTurn({ thread: input.thread, relayed, isMention: input.isMention })));
+    await tracked(serialized(input.thread.id, async () => {
+      try {
+        await handleTurn({ thread: input.thread, relayed, isMention: input.isMention });
+      } catch (e) {
+        // an escaped handleTurn throw (a state-file parse, a Slack API
+        // rejection outside relayThread's never-throws boundary) previously
+        // died in the chat SDK's catch-and-log: the user's message vanished
+        // with no reply and no log line of ours (2026-07-27 report). Tell
+        // the thread and keep the daemon serving.
+        const detail = (e instanceof Error ? e.message : String(e)).slice(0, 300);
+        log("serve.turn_crashed", { thread: input.thread.id, err: detail });
+        // a surviving activeTurn marker means the turn is PRESERVED (a drain
+        // kill kept it for the next generation's auto-resume): a "re-send it"
+        // notice would invite a duplicate run and a failed x would misread a
+        // guaranteed retry (cubic review catch, round 3) - log only, the
+        // resume machinery owns the messaging. The read is best-effort: an
+        // unreadable record (possibly the crash itself) takes the visible
+        // crash path.
+        let preserved = false;
+        try {
+          preserved = loadSlackThread(input.thread.id)?.activeTurn !== undefined;
+        } catch { /* unreadable record: treat as not preserved */ }
+        if (preserved) return;
+        try {
+          await input.thread.post(
+            (async function* () {
+              yield `tokenmaxxing: this message's handling crashed: ${detail}. If no reply landed above, re-send it.`;
+            })(),
+          );
+        } catch (postErr) {
+          log("serve.turn_crash_notice_failed", { thread: input.thread.id, err: (postErr instanceof Error ? postErr.message : String(postErr)).slice(0, 300) });
+        }
+        // a crash after runTurn added the hourglass would otherwise read as
+        // "processing" forever (codex review catch); setStatus never throws.
+        const messageId = relayed.at(-1)?.id;
+        if (messageId) {
+          await setStatus({ threadId: input.thread.id, messageId, emoji: STATUS_EMOJI.failed, op: "add" });
+          await setStatus({ threadId: input.thread.id, messageId, emoji: STATUS_EMOJI.processing, op: "remove" });
+        }
+      }
+    }));
   };
 
   /** A user reaction in a tracked thread. While the thread waits on an asked
@@ -829,16 +885,47 @@ export function buildServeRuntime(seam: {
       // folds into the next turn.
       if (!draining && asked && asked.requesterIds.includes(input.userId) && afterAsk && onAskMessage) {
         log("serve.reaction_answer", { thread: input.threadId, emoji: input.emoji });
-        const { thread } = await streamable(input.threadId);
-        await handleTurn({
-          thread,
-          relayed: [{
-            text: `<@${input.userId}> answered your pending question with the Slack reaction :${input.emoji}:. Interpret the reaction as their reply and continue.`,
-            authorId: input.userId,
-            id: input.messageId,
-          }],
-          isMention: false,
-        });
+        try {
+          const { thread } = await streamable(input.threadId);
+          await handleTurn({
+            thread,
+            relayed: [{
+              text: `<@${input.userId}> answered your pending question with the Slack reaction :${input.emoji}:. Interpret the reaction as their reply and continue.`,
+              authorId: input.userId,
+              id: input.messageId,
+            }],
+            isMention: false,
+          });
+        } catch (e) {
+          // a crashed answer turn must not read as an accepted answer (codex
+          // review catch): tell the thread and settle the reacted-to
+          // message's status so it never reads as processing forever.
+          const detail = (e instanceof Error ? e.message : String(e)).slice(0, 300);
+          log("serve.reaction_crashed", { thread: input.threadId, err: detail });
+          try {
+            await seam.postToThread({ threadId: input.threadId, text: `tokenmaxxing: handling your reaction answer crashed: ${detail}. Reply in the thread to answer instead.` });
+          } catch (postErr) {
+            log("serve.reaction_crash_notice_failed", { thread: input.threadId, err: (postErr instanceof Error ? postErr.message : String(postErr)).slice(0, 300) });
+          }
+          await setStatus({ threadId: input.threadId, messageId: input.messageId, emoji: STATUS_EMOJI.failed, op: "add" });
+          await setStatus({ threadId: input.threadId, messageId: input.messageId, emoji: STATUS_EMOJI.processing, op: "remove" });
+          // handleTurn consumed the attention state (and its question mark)
+          // before the turn ran; a crashed answer must not eat the ask (cubic
+          // review catch, round 2). Restore both so the nudge sweep and the
+          // reaction-answer gates keep working; the restore itself is
+          // best-effort (the crash may BE an unreadable record).
+          try {
+            const cur = loadSlackThread(input.threadId);
+            if (cur && !cur.attention) {
+              saveSlackThread({ ...cur, attention: asked });
+              if (asked.messageId) {
+                await setStatus({ threadId: input.threadId, messageId: asked.messageId, emoji: STATUS_EMOJI.attention, op: "add" });
+              }
+            }
+          } catch (restoreErr) {
+            log("serve.attention_restore_failed", { thread: input.threadId, err: (restoreErr instanceof Error ? restoreErr.message : String(restoreErr)).slice(0, 300) });
+          }
+        }
         return;
       }
       const home = await seam.isHomeUser({ userId: input.userId });
@@ -868,7 +955,32 @@ export function buildServeRuntime(seam: {
   const nudgeSweep = async (input?: { now?: number }) => {
     if (draining) return;
     const now = input?.now ?? Date.now();
-    for (const record of listSlackThreads()) {
+    // per-record parsing, not listSlackThreads: state files that fail to
+    // parse THROW by contract, but here one corrupt record aborting the
+    // whole sweep would silence every OTHER thread's overdue nudge on every
+    // tick (codex review catch) - and before the daemon's rejection backstop
+    // existed, this bare-interval throw was a whole-daemon crash killing
+    // every in-flight turn (2026-07-27 report shape). The skip is logged
+    // once per file per daemon run; a 60s tick would repeat it forever.
+    let files: string[] = [];
+    try {
+      files = existsSync(paths.slackThreadsDir) ? readdirSync(paths.slackThreadsDir) : [];
+    } catch (e) {
+      log("serve.nudge_sweep_error", { err: (e instanceof Error ? e.message : String(e)).slice(0, 300) });
+      return;
+    }
+    for (const f of files) {
+      if (!f.endsWith(".json")) continue;
+      let record: SlackThread;
+      try {
+        record = SlackThreadSchema.parse(JSON.parse(readFileSync(join(paths.slackThreadsDir, f), "utf8")));
+      } catch (e) {
+        if (!sweepSkipLogged.has(f)) {
+          sweepSkipLogged.add(f);
+          log("serve.nudge_record_skipped", { file: f, err: (e instanceof Error ? e.message : String(e)).slice(0, 300) });
+        }
+        continue;
+      }
       const asked = record.attention;
       if (!asked || asked.nudgedAt !== undefined || now - Date.parse(asked.askedAt) < ATTENTION_NUDGE_MS) continue;
       // unlinked channels are contractually silent in Slack (review catch:
@@ -1338,6 +1450,21 @@ async function runDaemon(): Promise<number> {
   // 2s, zero API calls).
   process.on("SIGHUP", () => void shutdown("SIGHUP"));
 
+  // LAST-RESORT backstop, not the error strategy: `tracked` is the daemon's
+  // own boundary, so this should stay idle - it exists for rejections minted
+  // outside our funnels (the chat SDK's socket client, adapter internals),
+  // where Bun's default is to kill the whole process (verified 2026-07-27)
+  // and with it every concurrent session's in-flight turn, leaving
+  // half-streamed Slack messages and no daemon to resume the markers.
+  // Sync throws keep the default crash: an uncaughtException means state is
+  // undefined and the durable markers make a restart the honest recovery.
+  // message-only, like every other logged error here: a rejection minted by
+  // an auth-carrying HTTP client must not persist its request into the log
+  // (cursor review catch).
+  process.on("unhandledRejection", (reason) => {
+    log("serve.unhandled_rejection", { err: (reason instanceof Error ? reason.message : String(reason)).slice(0, 300) });
+  });
+
   // initialize() starts the PERSISTENT Socket Mode client (auto-reconnecting)
   // wired straight into event routing; the daemon only has to stay alive.
   // Never call startSocketModeListener here: that is the serverless leased

package/src/cli/switch.ts

@@ -113,7 +113,9 @@ export async function cmdSwitch(selector?: string): Promise<number> {
     // No usable target swapped in: everything is depleted, or the remaining
     // candidates' refresh tokens just died (performSwap persists needs-reauth
     // before throwing, hence the reload). Stay on / switch to whichever
-    // recovers soonest.
+    // recovers soonest. (Layer 2 - the wall squeeze - is deliberately confined
+    // to the automatic decision path in decide.ts, which decides off the live
+    // statusLine tee; bare `xx switch` stays cache-only and simply parks here.)
     const fresh = loadAccounts();
     const earliest = pickEarliestReset(fresh.accounts, everyone);
     if (!earliest) {

package/src/lib/codexdecide.ts

@@ -260,7 +260,13 @@ export async function evaluateAndMaybeSwapCodex(input: { now?: number }): Promis
 
     // Hard path: a bar is crossed. Land on the best usable candidate, walking
     // past dead grants; a fully depleted pool stays put (no pre-park: nothing
-    // can pause a codex session for a countdown yet).
+    // can pause a codex session for a countdown yet). Layer 2 (the wall) is
+    // deliberately claude-only: a running codex cannot hot-adopt a swapped
+    // credential (restart IS the switch), so a last-drop-swap onto a still-
+    // under-wall account would strand any concurrent sibling on the departed
+    // account (the reconcile can only signal siblings onto a Layer-1-usable
+    // seat), and a hold-only Layer 2 is identical to codex already staying put
+    // here - so codex just rides the current account to its wall.
     const tried = new Set<string>();
     while (true) {
       const current = loadCodexAccounts();

package/src/lib/decide.ts

@@ -30,7 +30,7 @@ import { paths } from "./paths.ts";
 import { loadAccounts, loadConfig, loadDepletedWait, loadLastSwapAt, loadUsage, loadModelUsage, saveAccounts, saveDepletedWait, saveModelUsage, usageTeeAt, writeUsage } from "./state.ts";
 import { readOAuthAccount } from "./claudejson.ts";
 import { chooseAndSwap, performSwap } from "./swap.ts";
-import { currentWins, effectiveBars, pickBest, pickEarliestReset, usableAt } from "./picker.ts";
+import { currentWins, effectiveBars, hardBars, isExhausted, pickBest, pickEarliestReset, usableAt } from "./picker.ts";
 import { InvalidGrantError } from "./oauth.ts";
 import { familyTokens, gatedFamilies, probeUsage } from "./usage.ts";
 import { log } from "./log.ts";
@@ -307,15 +307,44 @@ export async function evaluateAndMaybeSwap(now = Date.now(), anticipatory = fals
     const landed = await chooseAndSwap({ now, thresholds: effectiveBars(cfg), switchFamilies, currentAccountUuid: seatOf(loadAccounts())?.accountUuid ?? null });
     if (landed) return { swapped: true, account: landed, reason: "swapped" };
 
-    // Every account is depleted. Wait for whichever recovers soonest (including
-    // the current one), if that reset is within the auto-wait window. A dead
-    // grant on the chosen pre-park target must not abort the wait: performSwap
-    // persists needs-reauth before throwing, so each retry re-ranks without the
-    // dead account and the loop terminates (mirrors the greedy loop above).
+    // ── LAYER 2 (the wall). Every account is exhausted at the Layer 1
+    // screening bars, so Layer 1 alone would park the pool right here with
+    // quota still unspent on every account. Before parking, pump the last drops
+    // against the hard wall bars (default the server's own 100% limit, the same
+    // figure /rate-limit-options reads): hold the seat while it is still under
+    // its wall, else move onto the best still-under-wall account (chooseAndSwap
+    // keeps the usual pace-pressure ranking - squeeze the account whose weekly
+    // quota is most about to be forfeited first). Only when EVERY account has
+    // truly walled do we fall through to the depleted-wait park below. The wall
+    // reading is the statusLine's authoritative rate_limits tee (the same data
+    // /rate-limit-options renders); a single-turn overshoot is caught one
+    // boundary later by the check timer or the next Stop hook, and the serve/SDK
+    // path additionally stamps observed limits on errored results.
+    const hardCtx = { now, thresholds: hardBars(cfg), currentAccountUuid: null, switchFamilies };
+    const seat = seatOf(loadAccounts());
+    if (seat && !seat.needsReauth && !isExhausted(seat, hardCtx)) {
+      log("decide.last_drop_hold", { account: seat.accountUuid.slice(0, 8) });
+      return { swapped: false, account: null, reason: "last-drop-hold" };
+    }
+    const squeezed = await chooseAndSwap({ ...hardCtx, currentAccountUuid: seat?.accountUuid ?? null });
+    if (squeezed) {
+      log("decide.last_drop_swap", { account: squeezed.accountUuid.slice(0, 8) });
+      return { swapped: true, account: squeezed, reason: "last-drop-swap" };
+    }
+
+    // Every account is walled. Wait for whichever drops below its wall soonest
+    // (including the current one), if that reset is within the auto-wait window.
+    // Recovery is measured against the WALL, not the screening bars: an account
+    // whose session window resets below 100 is squeezable again even while its
+    // weekly window still sits above the Layer 1 bar, so waiting on the Layer 1
+    // reset would over-park. A dead grant on the chosen pre-park target must not
+    // abort the wait: performSwap persists needs-reauth before throwing, so each
+    // retry re-ranks without the dead account and the loop terminates (mirrors
+    // the greedy loop above).
     while (true) {
       const fresh = loadAccounts();
       const current = seatOf(fresh);
-      const ctx = { now, thresholds: effectiveBars(cfg), currentAccountUuid: current?.accountUuid ?? null, switchFamilies };
+      const ctx = { now, thresholds: hardBars(cfg), currentAccountUuid: current?.accountUuid ?? null, switchFamilies };
       const currentAt = current ? usableAt(current, ctx) : Number.POSITIVE_INFINITY;
       const other = pickEarliestReset(fresh.accounts, ctx);
 

package/src/lib/install.ts

@@ -406,8 +406,9 @@ export function findClaudeShadowers(rcText: string): ShellShadower[] {
 /** Remove ONLY the marker-tagged PATH line this tool added; a hand-added
  *  PATH entry without the marker is the user's own. A stale `# tokenmaxxing
  *  PATH` line pointing at an emptied binDir is exactly how the supervisor
- *  recursion incident started (see AGENTS.md), so uninstall must not leave
- *  one behind (closing-review catch). Returns true when a line was removed. */
+ *  recursion incident started (.memory/supervisor-recursion-guards.md), so
+ *  uninstall must not leave one behind (closing-review catch).
+ *  Returns true when a line was removed. */
 export function removePathFromRc(rc: string): boolean {
   if (!existsSync(rc)) return false;
   // same symlink + mode treatment as ensurePathInRc: write through a

package/src/lib/picker.ts

@@ -27,6 +27,23 @@ export function effectiveBars(cfg: Config): Thresholds {
   };
 }
 
+/** LAYER 2 - the wall bars. The projection margin is subtracted the SAME way
+ *  effectiveBars does it, for two reasons: (1) it keeps the documented disable
+ *  contract honest - `hardThresholds == thresholds` then yields hardBars ==
+ *  effectiveBars, so Layer 2 has no band to act in and is truly off (without
+ *  the margin here a nonzero margin left a live band between the two, review
+ *  catch PR #47); (2) at the default margin 0 the wall is still the literal 100
+ *  (the server's own figure /rate-limit-options reads). Used only in the
+ *  all-Layer-1-exhausted fallback, where an account under its wall is still
+ *  worth squeezing. Config's refine (hardThresholds >= thresholds) guarantees
+ *  hardBars >= effectiveBars, so Layer 2 is never stricter than Layer 1. */
+export function hardBars(cfg: Config): Thresholds {
+  return {
+    session: cfg.hardThresholds.session - cfg.policy.projectionMargin,
+    weekly: cfg.hardThresholds.weekly - cfg.policy.projectionMargin,
+  };
+}
+
 const PickCtxSchema = z.object({
   now: z.number(),
   thresholds: ThresholdsSchema,

package/src/lib/slackbridge.ts

@@ -75,6 +75,24 @@ const RETRY_DELAY_MS = 10_000;
 /** parks + retries per Slack message; keeps a stale usage cache from looping
  *  a thread forever. */
 export const MAX_RECOVERIES = 3;
+/** extra spawns for a NON-limit failure whose child never completed (crash,
+ *  API blip, errored result): each resumes the same session, so a retry
+ *  continues the turn instead of re-running it. Separate from MAX_RECOVERIES
+ *  on purpose - that budget bounds limit-driven parking, this one bounds
+ *  quota spent chasing a possibly-permanent error. */
+export const MAX_TRANSIENT_RETRIES = 2;
+/** Slack expires a native stream SERVER-SIDE on undocumented timers
+ *  (Slack-maintainer-confirmed in slackapi/python-slack-sdk#1859: idle
+ *  around 30s, total lifetime around 300s measured), and an expired stream
+ *  freezes in the Slack client as a grey "Something went wrong" pill - the
+ *  exact 2026-07-27 report. The salvage path recovers the CONTENT but
+ *  cannot un-freeze the pill, so the fix is to never let Slack expire a
+ *  stream we own: rotate the open segment - a clean end() that the adapter
+ *  finishes with a proper stream stop - before either timer can fire, and
+ *  let the next chunk open a fresh message, the same flow pushText's size
+ *  splits already use. Thresholds sit well inside Slack's observed margins;
+ *  read at every arm (a mutable object, the file's test seam pattern). */
+export const SEGMENT_ROTATION = { idleMs: 20_000, maxAgeMs: 240_000 };
 
 const ParkPlanSchema = z.union([
   z.object({ kind: z.literal("proceed") }),
@@ -469,6 +487,14 @@ export async function relayThread(input: {
   // a ``` split across two deltas would be invisible to per-chunk counting
   // (pullfrog review catch, PR #42).
   let segmentMeta: { text: boolean; acc: string; reopenFence: boolean } | null = null;
+  // the open segment's rotation clock (see armSegmentTimer).
+  let segmentTimer: ReturnType<typeof setTimeout> | null = null;
+  let segmentOpenedAt = 0;
+  // a timer rotation closed the segment inside a code fence: the next
+  // segment must reopen it, exactly like pushText's size splits do (codex
+  // review catch). Consumed by openSegment; the salvage handler's own
+  // delivered-prefix recomputation overrides it there.
+  let pendingReopenFence = false;
   let lastPost: Promise<unknown> = Promise.resolve();
   // Reply TEXT that died with a rejected segment and was neither salvaged into
   // a follow-on message nor re-delivered by a later text-bearing segment: the
@@ -496,6 +522,8 @@ export async function relayThread(input: {
   const openSegment = () => {
     const seg = pushableStream();
     segment = seg;
+    segmentOpenedAt = Date.now();
+    armSegmentTimer();
     // reopenFence: the delivered prefix of a REJECTED predecessor left a code
     // fence open, so the first TEXT entering this salvage segment must be
     // preceded by a reopen or it renders outside the code block. Pending
@@ -503,7 +531,8 @@ export async function relayThread(input: {
     // salvage would otherwise either skip the reopen (later text joining the
     // segment renders unfenced) or dangle an empty open fence at message end
     // when no text ever follows. Materialized by BOTH text entry points.
-    const meta = { text: false, acc: "", reopenFence: false };
+    const meta = { text: false, acc: "", reopenFence: pendingReopenFence };
+    pendingReopenFence = false;
     segmentMeta = meta;
     lastPost = input.post(seg.iterable).then(
       () => {
@@ -608,9 +637,19 @@ export async function relayThread(input: {
           // the salvage segment here keeps the salvaged content ordered ahead
           // of any push still awaiting lastPost; the salvage segment's own
           // settle then decides whether its text counts as delivered.
+          // A salvage always recomputes its fence state from the delivered
+          // prefix (the override below), so it must never CONSUME a pending
+          // rotation reopen that belongs to a different segment's
+          // continuation - a rejected notice settling after notify()
+          // restored the flag would otherwise eat it (cubic review catch,
+          // round 4). Held across the lost-chunk re-push too: the salvaged
+          // text is the dying segment's, not the continuation's.
+          const heldReopen = pendingReopenFence;
+          pendingReopenFence = false;
           const next = openSegment();
           next.meta.reopenFence = deliveredFenceOpen;
           for (const c of lost) next.pushInto(c);
+          pendingReopenFence = heldReopen;
         } else if (textRemainder !== "") {
           textLost = true;
           textLostDetail = detail;
@@ -637,6 +676,7 @@ export async function relayThread(input: {
         meta.acc += chunk;
       }
       seg.push(chunk);
+      if (segment === seg) armSegmentTimer();
     };
     return { seg, meta, pushInto };
   };
@@ -649,6 +689,17 @@ export async function relayThread(input: {
     }
     const target = segment ?? openSegment().seg;
     if (!(chunk instanceof Object)) {
+      // a pending rotation reopen can outlive its openSegment hand-off when
+      // text JOINS a segment a rejection handler opened during the wait
+      // (the salvage recomputes its own fence state without consuming the
+      // flag): adopt it here so the continuation still reopens its fence,
+      // UNLESS the joined segment already sits inside an open fence - then
+      // the state is satisfied and a second marker would close it (cubic
+      // review catch, round 4).
+      if (pendingReopenFence) {
+        pendingReopenFence = false;
+        if (!fenceOpen()) segmentMeta!.reopenFence = true;
+      }
       // materialize a salvage segment's pending fence reopen (see
       // openSegment) before the first text from this entry point too.
       if (segmentMeta!.reopenFence) {
@@ -661,14 +712,42 @@ export async function relayThread(input: {
       segmentMeta!.acc += chunk;
     }
     target.push(chunk);
+    if (segment === target) armSegmentTimer();
   };
   // parity by occurrence count over the segment's accumulated text: an odd
   // number of ``` markers means the segment currently sits inside a fence.
   const fenceOpen = () => segmentMeta !== null && (segmentMeta.acc.split("```").length - 1) % 2 === 1;
   const breakSegment = () => {
+    if (segmentTimer !== null) {
+      clearTimeout(segmentTimer);
+      segmentTimer = null;
+    }
+    // a segment dying with an armed-but-unmaterialized reopen (no text ever
+    // arrived - a card-only segment that consumed the flag at open) folds it
+    // back: the reply still logically sits inside an open fence, and the
+    // next text-bearing segment must reopen it (cubic review catch, round
+    // 4: the errored result's closing card ate the rotation's reopen).
+    if (segmentMeta?.reopenFence) pendingReopenFence = true;
     segment?.end();
     segment = null;
   };
+  const armSegmentTimer = () => {
+    if (segmentTimer !== null) clearTimeout(segmentTimer);
+    const ageLeft = segmentOpenedAt + SEGMENT_ROTATION.maxAgeMs - Date.now();
+    segmentTimer = setTimeout(() => {
+      segmentTimer = null;
+      // a rotation mid-fence closes the fence and arms the reopen, so both
+      // message halves render as code - pushText's split contract. An
+      // armed-but-unmaterialized reopen needs no close marker; breakSegment
+      // folds it forward.
+      if (segment !== null && fenceOpen()) {
+        segmentMeta!.acc += "\n```";
+        segment.push("\n```");
+        pendingReopenFence = true;
+      }
+      breakSegment();
+    }, Math.max(0, Math.min(SEGMENT_ROTATION.idleMs, ageLeft)));
+  };
   /** Reply text routed through here splits across Slack messages before the
    *  msg_too_long cap (see SEGMENT_TEXT_MAX): a break prefers the last newline
    *  inside the remaining room, and a break forced inside a code fence closes
@@ -723,8 +802,16 @@ export async function relayThread(input: {
   // streamed segment.
   const notify = async (text: string) => {
     breakSegment();
+    // a notice must never inherit a rotation's pending fence reopen: the
+    // reopen belongs to the interrupted reply's continuation, not to the
+    // status line - consuming it here would render the notice as a code
+    // block AND strand the continuation unfenced (cubic review catch,
+    // round 3). Held aside and restored for the real continuation.
+    const heldReopen = pendingReopenFence;
+    pendingReopenFence = false;
     await push(text);
     breakSegment();
+    pendingReopenFence = heldReopen;
   };
   /** notify + confirm the post actually landed in Slack. A drop notice that
    *  never reached the user must NOT count as announced. DURING A DRAIN an
@@ -759,6 +846,9 @@ export async function relayThread(input: {
   // deferral notice explains the pause; the raw line would invite a manual
   // re-send of work the daemon resumes itself - cubic catch, PR #44).
   let pendingFailureLine: string | null = null;
+  // what the next spawn submits: the original message, until a transient
+  // retry swaps in the continuation wrapper (see the retry branch).
+  let prompt = input.prompt;
   const runQueryOnce = async () => {
     postedText = false;
     pendingFailureLine = null;
@@ -777,7 +867,7 @@ export async function relayThread(input: {
       spawnOrg = readOAuthAccount()?.organizationUuid ?? null;
       const pooled = pooledOptions();
       const q = query({
-        prompt: input.prompt,
+        prompt,
         options: {
           ...pooled,
           // claude >= 2.1.142 emits the structured Task tools by default and
@@ -868,6 +958,17 @@ export async function relayThread(input: {
             // the stale pre-limit snapshot (poll TTL) and respawns the same
             // depleted account - a serve process has no statusLine tee.
             if (outcome.rateLimited) await recordObservedLimit({ text, now: Date.now(), org: spawnOrg });
+            // hold the REAL errored text for the terminal diagnostic (codex
+            // review catches: a streamed-then-errored turn used to end with
+            // a truncated answer and only the x reaction, and a no-text
+            // errored turn used to discard the reason for a generic line).
+            // The depleted-pool probe still outranks the line.
+            else {
+              const reason = text.slice(0, 200) || "no error detail";
+              pendingFailureLine = postedText
+                ? `tokenmaxxing: the turn errored before finishing (${reason}) - the reply above may be incomplete.`
+                : `tokenmaxxing: the turn errored without a result (${reason}) - trying again may help.`;
+            }
           } else {
             result = message.result;
             outcome.resultReceived = true;
@@ -880,12 +981,6 @@ export async function relayThread(input: {
       }
       // a turn that produced no streamed text (tool-only turns) still reports.
       if (!postedText && result) await pushText(result);
-      if (!postedText && !result && outcome.failed && !outcome.rateLimited) {
-        // held back until the depleted-pool probe rules: a "trying again may
-        // help" line right before a deferral notice invites a manual re-send
-        // of work the daemon is about to resume itself (cubic catch, PR #44).
-        pendingFailureLine = "the turn ended without a result - trying again may help";
-      }
     } catch (e) {
       outcome.failed = true;
       const detail = (e instanceof Error ? e.message : String(e)).slice(0, 300);
@@ -900,6 +995,7 @@ export async function relayThread(input: {
   };
 
   let recoveries = 0;
+  let transientRetries = 0;
   const parkDeadline = Date.now() + PARK_MAX_MS;
   while (true) {
     // the switch decision runs at the spawn boundary, same as the CLI hooks.
@@ -956,10 +1052,14 @@ export async function relayThread(input: {
       // the evidence the error text did not carry. A completed result stays
       // terminal, and a usable pool keeps the plain failure.
       if (!outcome.resultReceived) {
+        // outranks the transient retry below even when the recovery time is
+        // unknown (cubic review catch): a depleted pool explains the failure,
+        // and respawning against it would just burn doomed attempts.
+        let probeDepleted = false;
         try {
           const verdict = await ensureBestAccount();
-          const depleted = verdict.reason === "all-depleted" || verdict.reason === "depleted-wait";
-          const wake = depleted ? verdict.waitUntil ?? null : null;
+          probeDepleted = verdict.reason === "all-depleted" || verdict.reason === "depleted-wait";
+          const wake = probeDepleted ? verdict.waitUntil ?? null : null;
           if (wake != null) {
             outcome.rateLimited = true;
             outcome.deferUntil = wake + PARK_GRACE_MS;
@@ -971,8 +1071,43 @@ export async function relayThread(input: {
           // keep the original failure; the probe must never mask it.
           log("serve.defer_probe_error", { err: (e instanceof Error ? e.message : String(e)).slice(0, 300) });
         }
+        // a transient non-limit failure (child crash, API blip, errored
+        // result) against a usable pool retries silently into the same
+        // session, mirroring the rate-limit path's invisible short retry
+        // (2026-07-27 report: these turns died terminally, telling the user
+        // "trying again may help" instead of trying again). resultReceived
+        // stays terminal above - a completed answer must never re-run - and
+        // the probe's deferral outranks a retry: an exhausted pool explains
+        // the failure better than "transient".
+        if (!probeDepleted && outcome.deferUntil === null && transientRetries < MAX_TRANSIENT_RETRIES) {
+          transientRetries += 1;
+          breakSegment();
+          log("serve.transient_retry", { attempt: transientRetries });
+          // once a session exists, the failed attempt may have executed
+          // side-effectful tools before dying, so the retry must CONTINUE,
+          // never re-instruct: replaying the original prompt verbatim into
+          // the resumed session reads as "do it again" (codex review catch).
+          // The wrapper mirrors resumeDecision's deferral resume. A pre-init
+          // death ran nothing, so the original replays verbatim there.
+          if (outcome.sessionId !== null) {
+            prompt = `Your previous turn was interrupted by an error mid-run; this session's transcript already holds any work it completed, including tool calls whose side effects already happened. Pick up exactly where you left off and finish the task without re-running completed side-effectful steps. If the work was already complete, just summarize the final state. The original request was:\n\n${input.prompt}`;
+          }
+          if (!(await sleep(RETRY_DELAY_MS))) {
+            // a drain aborted the retry sleep: same as a killed child, the
+            // marker survives (presumedKilled) and the next daemon start
+            // resumes the session where it stopped.
+            await notify("tokenmaxxing is restarting - this turn resumes after the restart.");
+            break;
+          }
+          continue;
+        }
+      }
+      if (pendingFailureLine !== null) {
+        // same fence-reopen bypass as notify: a diagnostic line opening a
+        // fresh segment must not render inside a reopened code fence.
+        pendingReopenFence = false;
+        await push(transientRetries > 0 ? `${pendingFailureLine} (after ${transientRetries + 1} attempts)` : pendingFailureLine);
       }
-      if (pendingFailureLine !== null) await push(pendingFailureLine);
       break;
     }
     if (recoveries >= MAX_RECOVERIES) {

package/src/lib/state.ts

@@ -20,9 +20,14 @@ import {
 // ---- config.json (minimal, fixed schema) ---------------------------------
 
 const DEFAULT_CONFIG: Config = {
-  // Screening bars, split per window (user 2026-07-16): a session reset is
-  // cheap to sit out, weekly quota is use-it-or-lose-it so it drains to 98.
+  // LAYER 1 - screening bars, split per window (user 2026-07-16): a session
+  // reset is cheap to sit out, weekly quota is use-it-or-lose-it so it drains
+  // to 98. These drive normal account-to-account switching with headroom.
   thresholds: { session: 95, weekly: 98 },
+  // LAYER 2 - the wall bars (default the server's own 100% limit). Reached only
+  // once every account is over its Layer 1 bar: from there a session pumps the
+  // last drops up to the wall instead of parking with quota unspent.
+  hardThresholds: { session: 100, weekly: 100 },
   claudeBin: "",
   codexBin: "",
   // per-model weekly caps exist only for Sonnet and Fable (no Opus-only quota,
@@ -42,6 +47,7 @@ const PercentSchema = z.number().min(0).max(100);
 export const ConfigFileSchema = z
   .object({
     thresholds: z.object({ session: PercentSchema, weekly: PercentSchema }).partial(),
+    hardThresholds: z.object({ session: PercentSchema, weekly: PercentSchema }).partial(),
     claudeBin: z.string(),
     codexBin: z.string(),
     policy: z
@@ -69,9 +75,16 @@ export type MergeOutcome = z.infer<typeof MergeOutcomeSchema>;
  *  throw, silently disabling status/switch/hooks/statusline until the file is
  *  hand-repaired (closing-review catch). */
 export function mergeConfigFile(p: z.infer<typeof ConfigFileSchema>): MergeOutcome {
-  const cfg: Config = { ...DEFAULT_CONFIG, thresholds: { ...DEFAULT_CONFIG.thresholds }, policy: { ...DEFAULT_CONFIG.policy } };
+  const cfg: Config = {
+    ...DEFAULT_CONFIG,
+    thresholds: { ...DEFAULT_CONFIG.thresholds },
+    hardThresholds: { ...DEFAULT_CONFIG.hardThresholds },
+    policy: { ...DEFAULT_CONFIG.policy },
+  };
   cfg.thresholds.session = p.thresholds?.session ?? cfg.thresholds.session;
   cfg.thresholds.weekly = p.thresholds?.weekly ?? cfg.thresholds.weekly;
+  cfg.hardThresholds.session = p.hardThresholds?.session ?? cfg.hardThresholds.session;
+  cfg.hardThresholds.weekly = p.hardThresholds?.weekly ?? cfg.hardThresholds.weekly;
   cfg.claudeBin = p.claudeBin ?? cfg.claudeBin;
   cfg.codexBin = p.codexBin ?? cfg.codexBin;
   cfg.policy.projectionMargin = p.policy?.projectionMargin ?? cfg.policy.projectionMargin;

package/src/lib/types.ts

@@ -142,6 +142,18 @@ export type Thresholds = z.infer<typeof ThresholdsSchema>;
 export const ConfigSchema = z
   .object({
     thresholds: ThresholdsSchema,
+    /** LAYER 2 - the wall bars. `thresholds` (Layer 1) screen normal
+     *  account-to-account switching and deliberately leave headroom; these are
+     *  the true-wall bars the decision falls back to ONLY once every account is
+     *  exhausted at Layer 1. Below the wall a session holds its seat and pumps
+     *  the last drops; a window at/over the wall (default 100 = the server's own
+     *  limit, the same figure /rate-limit-options reads) is genuinely spent and
+     *  the pool moves to the next account, parking only when all are walled.
+     *  Set equal to `thresholds` to disable Layer 2 (hardBars subtracts the same
+     *  projectionMargin as effectiveBars, so equal thresholds collapse to one
+     *  effective bar and Layer 2 has no band to act in). At the default margin 0
+     *  the wall is the literal 100. */
+    hardThresholds: ThresholdsSchema,
     claudeBin: z.string(),
     /** the real codex binary (empty = resolve from PATH); pinned by `init --codex`. */
     codexBin: z.string(),
@@ -168,6 +180,14 @@ export const ConfigSchema = z
   // switch path churns. Per-field bounds alone cannot see this.
   .refine((cfg) => cfg.policy.projectionMargin < Math.min(cfg.thresholds.session, cfg.thresholds.weekly), {
     message: "policy.projectionMargin must be strictly below both thresholds (effectiveBars would hit zero and every account would read as exhausted)",
+  })
+  // The wall must sit at or above each screening bar. A wall BELOW its
+  // screening bar would make Layer 2 "usable" a stricter test than Layer 1
+  // screening - the pool could reach the wall fallback and find every account
+  // already over the (lower) wall, parking earlier than Layer 1 alone would.
+  // Equal is allowed and simply disables Layer 2 for that window.
+  .refine((cfg) => cfg.hardThresholds.session >= cfg.thresholds.session && cfg.hardThresholds.weekly >= cfg.thresholds.weekly, {
+    message: "hardThresholds (the Layer 2 wall) must be at or above thresholds (the Layer 1 screening bars) for both windows",
   });
 export type Config = z.infer<typeof ConfigSchema>;