tokenmaxxing 1.24.0 → 1.26.0

package/DESIGN.md

@@ -1,6 +1,6 @@
 # tokenmaxxing - design
 
-Automatic Claude Code account switching. You run `claude` exactly as always; when the active account crosses its swap threshold (the active rung of the 5h session ladder, **90** by default, or **98%** of a weekly window), tokenmaxxing swaps the credential to a fresh account at a safe turn boundary and **your running session adopts it in place - no restart**. Works across many concurrent sessions at once; a fully depleted pool pauses with a countdown and auto-resumes at the soonest reset when it lands within `policy.maxWaitMs` (default 1h; further out, the session stays put rather than parking for hours).
+Automatic Claude Code account switching. You run `claude` exactly as always; when the active account crosses its swap threshold (**90%** of the 5h session window or **98%** of a weekly window), tokenmaxxing swaps the credential to a fresh account at a safe turn boundary and **your running session adopts it in place - no restart**. Works across many concurrent sessions at once; a fully depleted pool pauses with a countdown and auto-resumes at the soonest reset when it lands within `policy.maxWaitMs` (default 1h; further out, the session stays put rather than parking for hours).
 
 > Scope: **Claude Code first (macOS + Linux, the latter since 2026-07-09).** Codex support landed in 0.13.0 (2026-07-16) with its own parallel state, decision engine, and supervisor; its verified internals live in AGENTS.md's Codex sections.
 >
@@ -10,9 +10,9 @@ Automatic Claude Code account switching. You run `claude` exactly as always; whe
 
 ## 1. Why there is a thin supervisor (and why that's the whole trick)
 
-A **running** `claude` DOES adopt an externally swapped credential (verified live 2026-07-10, correcting this document's original claim): an ensure-fresh poll re-reads the credential store around every request, so a swap lands within ~30s on macOS (raw keychain cache) and on the next request on Linux. A plain swap therefore needs no process management at all (since 0.15.0, 2026-07-16; earlier versions respawned on every swap): the Stop hook swaps the credential and the session keeps running. What adoption cannot give you is the depleted case: when every account is at the wall the session must be PAUSED until something resets, and a live `claude` cannot pause itself.
+A **running** `claude` DOES adopt an externally swapped credential (verified live 2026-07-10, correcting this document's original claim): an ensure-fresh poll re-reads the credential store around every request, so a swap lands within ~30s on macOS (raw keychain cache) and on the next request on Linux. A plain swap therefore needs no process management at all (since 0.15.0, 2026-07-16; earlier versions respawned on every swap): the Stop hook swaps the credential and the session keeps running. What adoption cannot give you is the depleted case: when every account is over its bar the session must be PAUSED until something resets, and a live `claude` cannot pause itself.
 
-So the supervisor's job is narrow: on a depleted pool it **replaces the process at a salvageable moment** - after a turn completes, the conversation is fully written to the transcript JSONL and `claude` is idle at the prompt, so killing it there loses nothing - shows an interruptible countdown to the soonest reset, and relaunches `claude --resume <session-id>` when it passes. **Thresholds still sit below 100%: the headroom is the budget to reach a clean turn boundary (plus up to one turn of adoption lag on macOS) before the account actually hits the wall.** The session window screens on a ladder, a single rung at 90 by default; a configured ladder like 50 then 80 then 95 has each rung take over once every pooled account is past the one below (a 5h reset is cheap to sit out, so a multi-rung pool drains level by level), while the weekly windows drain to 98 (weekly allowance is use-it-or-lose-it).
+So the supervisor's job is narrow: on a depleted pool it **replaces the process at a salvageable moment** - after a turn completes, the conversation is fully written to the transcript JSONL and `claude` is idle at the prompt, so killing it there loses nothing - shows an interruptible countdown to the soonest reset, and relaunches `claude --resume <session-id>` when it passes. **Thresholds still sit below 100%: the headroom is the budget to reach a clean turn boundary (plus up to one turn of adoption lag on macOS) before the account actually hits its real limit.** The session window swaps at 90 (a 5h reset is cheap to sit out), while the weekly windows drain to 98 (weekly allowance is use-it-or-lose-it).
 
 A hook can't do the pause-and-relaunch - when `claude` exits, the shell owns the terminal. So tokenmaxxing installs a **supervisor** (aliased to `claude`) that owns the process lifecycle:
 
@@ -49,12 +49,12 @@ The switching path runs no long-lived daemon. The statusline pushes usage. Hooks
 The Stop hook's stdin has no usage data, but the **statusLine does** (`rate_limits.{five_hour,seven_day}.{used_percentage,resets_at}`, after every turn, 300ms debounce, zero cost). tokenmaxxing's statusLine tees that to `usage.json` (write-on-change, O(ms)) and renders its own native line (it replaced the earlier pass-through delegation on 2026-07-11: install takes the statusLine slot outright, so a pre-existing custom statusline command is overwritten). Cold-start fallback if `usage.json` is absent: `TOKENMAXXING_PROBE=1 claude -p '/usage'`, with `[ -n "$TOKENMAXXING_PROBE" ] && exit 0` as the hook's first line to stop the nested process recursing (hooks fire in `-p` too). The probe scrubs every ambient credential override claude reads before the keychain (`CLAUDE_CODE_OAUTH_TOKEN`, `CLAUDE_SECURESTORAGE_CONFIG_DIR`, etc.) so it can only meter the credential in the keychain item, and retries the transient empty-footer case (claude prints local stats with no percentages when its own usage fetch throttles).
 
 ### 3.2 Detect + swap + signal (Stop hook, per turn)
-1. Read `usage.json` and exit below the engagement floor unless a screening bar is crossed, then follow the greedy or hard path defined in the [switching policy](docs/content/docs/switching.mdx).
+1. Read `usage.json` and exit while the live account is under both bars, as defined in the [switching policy](docs/content/docs/switching.mdx).
 2. Take the pool lock, re-check state, select a candidate under the [switching policy](docs/content/docs/switching.mdx), and attempt bounded verification of stale usage before swapping the credential.
 3. Done - the running session adopts the new credential on its own within a request or two. Only when the pool is depleted (the decision returned a `waitUntil`: pre-parked on the soonest-recovering account, or staying on the current one when it recovers first) does the hook write `respawn/<session_id>` (atomic temp+rename).
 
 ### 3.3 Depleted-pool pause (supervisor)
-The supervisor sees `respawn/<sid>`, SIGTERMs its child at the already-committed turn boundary, deletes the marker, resets the terminal, shows an interruptible countdown to the reset, and relaunches `claude --resume <sid>` when it passes. The resumed process reads the keychain cold → runs on the recovered account, same conversation. The `SessionStart` hook (source `resume`) re-checks the account before the first turn as a backstop.
+The supervisor sees `respawn/<sid>`, SIGTERMs its child at the already-committed turn boundary, deletes the marker, resets the terminal, shows an interruptible countdown to the reset, and relaunches `claude --resume <sid>` when it passes. The resumed process reads the keychain cold → runs on the recovered account, same conversation. The `SessionStart` hook (source `resume`) re-checks the account before the first turn as a backstop. A marker that fails to parse is never deleted and treated as absent. The supervisor stops the child, restores the terminal, and exits naming the marker path.
 
 ### 3.4 Swap sequence (under the lock)
 1. **Harvest the live credential into its TRUE owner's backup** - read the current `Claude Code-credentials` blob and resolve which account it actually belongs to via the profile endpoint (`GET /api/oauth/profile`, matched on `account.uuid`), NOT the `accounts.json` active label and NOT the organization (team seats share one). The label drifts from the live blob (a kill mid-swap, a manual `/login`), and harvesting by label once overwrote another account's backup and destroyed its only credential. Mandatory anyway: Claude rotates the refresh token in place, so older backups are dead. Refuse the swap if the live credential belongs to no pooled account.
@@ -79,24 +79,18 @@ Each terminal ran the supervisor, so each has its own child `claude` and its own
 ---
 
 ## 5. Rotation policy
-The [switching policy](docs/content/docs/switching.mdx) defines engagement, screening bars, organization preference, incumbent hysteresis and the wall squeeze.
+The [switching policy](docs/content/docs/switching.mdx) is one rule: under both bars, hold; at or over a bar, move to the usable account with the highest pace pressure; nothing usable, wait for the soonest reset.
 
-- Automatic lateral moves stay within the incumbent organization, and a crossed bar can trigger a cross-organization handoff.
-- Organization preference requires measured headroom in every applicable window and is an optimization heuristic, not a cache-hit guarantee.
-- Manual switching retains pure pace-pressure ranking.
-- Successful candidate probes persist their results and restart selection, preserving candidates that fail a screening bar but still clear the wall.
+- Automatic and manual switching rank by pace pressure alone; organization membership is not an input.
+- Successful candidate probes persist their results and restart selection.
 - Verification attempts at most two candidates with a shared 12-second deadline per candidate for identity reads and CLI execution.
 - Expiring access tokens are not refreshed for verification, and the isolated CLI receives no refresh grant.
 - Failed or budget-limited verification uses the existing cached data, so stale-target handoffs remain possible.
+- The depleted pause happens at the bar, not at 100; Codex has no pause and rides its account until the server refuses it, because a running sibling cannot adopt another account without restarting.
 
-The [profile](docs/content/docs/switching-profile.mdx) distinguishes observed cache rewrites from pricing-weighted estimates and does not infer subscription quota savings.
+The [profile](docs/content/docs/switching-profile.mdx) records observed cache rewrites across swaps and does not infer subscription quota savings.
 
-The [wall policy](docs/content/docs/switching.mdx#the-wall) defines Layer 2 recovery and its conditional headroom preference, with pace-only selection under default bars.
-
-- Layer 2 is Claude-only because its running sessions can adopt a credential change.
-- Codex keeps its current account until the wall because a running sibling cannot adopt another account without restarting.
-
-**Model-aware trigger.** Claude subscriptions also enforce **per-model weekly caps** - currently only for Sonnet and Fable (there is no Opus-only quota), and Fable's tighter limit binds *before* the aggregate (e.g. 80% week-Fable at only 50% week-all-models). This cap isn't in statusLine stdin, so when the active model is in `policy.switchModels` we read it from `claude -p '/usage'` (free, 0 tokens, TTL-cached) and add `week(<activeModel>) >= threshold` to the trigger. A Fable session switches on the Fable cap; a Sonnet session rides the aggregate. Both layers apply the per-model gate: a burnt Fable cap screens an account out of a Layer 1 switch, and a Fable cap at the wall screens it out of the Layer 2 squeeze too.
+**Model-aware trigger.** Claude subscriptions also enforce **per-model weekly caps** - currently only for Sonnet and Fable (there is no Opus-only quota), and Fable's tighter limit binds *before* the aggregate (e.g. 80% week-Fable at only 50% week-all-models). This cap isn't in statusLine stdin, so when the active model is in `policy.switchModels` we read it from `claude -p '/usage'` (free, 0 tokens, TTL-cached) and add `week(<activeModel>) >= threshold` to the trigger. A Fable session switches on the Fable cap; a Sonnet session rides the aggregate. Candidate screening applies the same per-model gate: a burnt Fable cap screens an account out of a switch.
 
 ---
 

package/README.md

@@ -66,7 +66,7 @@ claude                  # use claude as always
 | `tokenmaxxing add` | register an additional account (isolated login, harvested into the pool) |
 | `tokenmaxxing add --codex` | register an additional codex account (isolated login) |
 | `tokenmaxxing auth [sel \| --all]` | reauthenticate a pooled account in place: bare lists the pool (emails shown) and asks which; a selector targets one account and tells you the email to sign in with; `--all` walks every needs-reauth account one by one |
-| `tokenmaxxing switch [sel]` | switch the claude pool: bare picks the best account greedily (no-op when the current one wins), a selector targets one |
+| `tokenmaxxing switch [sel]` | switch the claude pool: bare picks the best account (no-op when the current one wins), a selector targets one |
 | `tokenmaxxing switch --codex [sel]` | switch the codex pool (takes effect on the next codex start) |
 | `tokenmaxxing ls` | list pooled accounts |
 | `tokenmaxxing status` | accounts with 5h / weekly usage bars, active + exhausted-until-reset |
@@ -80,19 +80,18 @@ claude                  # use claude as always
 
 ## How switching decides
 
-Switching engages (configurable) once the active account's 5-hour session window is **80% used** - from there, every evaluation greedily converges on the usable account **furthest behind its own weekly pace**, and does nothing when the current account already wins. Independent of that, crossing a screening bar always forces a switch: the session bar is the active rung of a ladder (a single rung at **90** by default; with more rungs configured, each takes over once every pooled account is past the one below) and the weekly bar is **98%**. The bars also screen candidates on any of:
+One rule: while the active account is under its bars, nothing happens; once it is at or over a bar, the decision moves to the usable account **furthest behind its own weekly pace**. The session bar is **90%** of the 5-hour window and the weekly bar is **98%**. The bars also screen candidates on any of:
 
 - **Session** (5-hour) or **week (all models)** - the aggregate windows, fed free/push-based by the statusLine.
 - **Per-model weekly cap** - the most capable model (Fable) has its own tighter weekly limit that binds *before* the aggregate (per-model caps currently exist only for Sonnet and Fable, and Sonnet's is generous). tokenmaxxing reads it from `claude -p '/usage'` (free, 0 tokens, TTL-cached) whenever the active model is one of `policy.switchModels`, so a Fable session switches on the Fable cap while a Sonnet session rides the aggregate.
 
-The bars' headroom is deliberate: it's the budget to reach a clean turn boundary (plus up to one turn of adoption lag on macOS) before the wall. The session ladder tops out lower (90) because a 5-hour reset is cheap to sit out, and any lower rungs you add keep the pool draining level by level; weekly quota is use-it-or-lose-it, so it drains closer to the wall (98). The greedy engagement floor (80) sits below both: weekly allowance is forfeited at each account's fixed reset, so once most of a session window is spent, quota is best burned on whichever account has the most at risk.
+The bars' headroom is deliberate: it's the budget to reach a clean turn boundary (plus up to one turn of adoption lag on macOS) before the account's real limit. The session bar sits lower (90) because a 5-hour reset is cheap to sit out; weekly quota is use-it-or-lose-it, so it drains closer to the limit (98).
 
-Automatic selection prefers same-organization candidates with measured session and weekly headroom, then uses remaining weekly percentage divided by time to reset.
+Selection ranks usable candidates by remaining weekly percentage divided by time to reset, highest first; organization membership is not an input, and manual `tokenmaxxing switch` uses the same ranking.
 
-- Lateral moves stay within the current organization, while a crossed bar or enforced limit may trigger a cross-organization handoff.
 - Candidate verification makes at most two bounded `/usage` attempts per evaluation and re-ranks successful samples before switching.
 - Failed verification leaves cached figures in force, so it cannot guarantee a fresh target.
-- Manual `tokenmaxxing switch` retains pure pace-pressure selection.
+- When no account is usable, the session pauses until the soonest reset if that lands within `policy.maxWaitMs`, and otherwise stays put.
 
 See [How switching decides](docs/content/docs/switching.mdx) for the policy and the [cache-cost profile](docs/content/docs/switching-profile.mdx) for measurements and their limits.
 
@@ -102,10 +101,9 @@ See [How switching decides](docs/content/docs/switching.mdx) for the policy and
 
 ```json
 {
-  "thresholds": { "session": [90], "weekly": 98 },
+  "thresholds": { "session": 90, "weekly": 98 },
   "policy": {
     "projectionMargin": 0,
-    "greedySessionFloor": 80,
     "switchModels": ["fable"],
     "usagePollTtlMs": 90000,
     "checkIntervalMs": 60000
@@ -113,7 +111,7 @@ See [How switching decides](docs/content/docs/switching.mdx) for the policy and
 }
 ```
 
-`thresholds.session` is a ladder: the bar is the lowest rung some pooled account still clears, so the default `[90]` is one bar, while with `[50, 80, 95]` a seat past 50 hands off while a sibling is under 50, and the bar climbs to 80 and then 95 as the whole pool fills; `projectionMargin` is a fixed safety margin subtracted from each threshold bar (effective bar = threshold - margin), so a large turn is less likely to blow past a bar between checks; `greedySessionFloor` is the session-used % at which the greedy convergence engages; `switchModels` names the models whose per-model cap triggers a switch; `usagePollTtlMs` is how long a `/usage` per-model poll stays fresh; `maxWaitMs` bounds the depleted-pool countdown - a soonest reset further out than this does not pause the session (no respawn marker is written and the session simply keeps hitting its limit until an account recovers); `checkIntervalMs` is the periodic check tick (default 60s), which `init` writes into the timer - re-run `tokenmaxxing init` after changing it so the timer unit picks up the new tick.
+`thresholds.session` and `thresholds.weekly` are the two bars, one number each (an array `thresholds.session`, the former ladder, fails config loading with a message naming the field); `projectionMargin` is a fixed safety margin subtracted from each threshold bar (effective bar = threshold - margin), so a large turn is less likely to blow past a bar between checks; `switchModels` names the models whose per-model cap triggers a switch; `usagePollTtlMs` is how long a `/usage` per-model poll stays fresh; `maxWaitMs` bounds the depleted-pool countdown - a soonest reset further out than this does not pause the session (no respawn marker is written and the session simply keeps hitting its limit until an account recovers); `checkIntervalMs` is the periodic check tick (default 60s), which `init` writes into the timer - re-run `tokenmaxxing init` after changing it so the timer unit picks up the new tick.
 
 State lives entirely in `~/.config/tokenmaxxing/`. Per-account credentials follow the platform's Claude Code store: the login keychain on macOS (`tokenmaxxing-cred-<uuid8>` items, never plaintext on disk), 0600 files under `~/.config/tokenmaxxing/creds/` on Linux (the same plaintext model claude itself uses for `~/.claude/.credentials.json`).
 
@@ -127,7 +125,7 @@ tokenmaxxing add --codex    # log in another account, isolated - your primary lo
 codex                       # use codex as always
 ```
 
-Codex mechanics differ from Claude Code in one hard way: a running codex process refuses a credential swapped to a different account, so **a restart is the switch**. The installed Stop hook runs the same greedy pace-pressure decision at each turn boundary (usage read free from codex's own rate-limit endpoint: percentages plus absolute reset times, weekly aggregate and per-model caps alike); when it swaps, the supervisor relaunches `codex resume <session-id>` on the fresh account with the transcript intact. `tokenmaxxing switch --codex [sel]` does it manually, `status`/`watch`/`ls` show both pools.
+Codex mechanics differ from Claude Code in one hard way: a running codex process refuses a credential swapped to a different account, so **a restart is the switch**. The installed Stop hook runs the same pace-pressure decision at each turn boundary (usage read free from codex's own rate-limit endpoint: percentages plus absolute reset times, weekly aggregate and per-model caps alike); when it swaps, the supervisor relaunches `codex resume <session-id>` on the fresh account with the transcript intact. `tokenmaxxing switch --codex [sel]` does it manually, `status`/`watch`/`ls` show both pools.
 
 Two codex-specific facts worth knowing: codex does not run hooks it has not been told to trust, so after `init --codex` you must open codex once and trust the tokenmaxxing Stop hook via `/hooks` (auto-switching is inert until then); and codex has no cross-process lock on `auth.json`, so tokenmaxxing serializes all of its own credential writes behind its own lock and swaps only at idle turn boundaries.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tokenmaxxing",
-  "version": "1.24.0",
+  "version": "1.26.0",
   "description": "Automatic Claude Code account switching: pool multiple accounts and hot-swap when quota fills, resuming your session on the fresh account.",
   "type": "module",
   "license": "MIT",

package/src/cli/codexswitch.ts

@@ -7,7 +7,7 @@ import { performCodexSwap } from "../lib/codexswap.ts";
 import { CodexInvalidGrantError } from "../lib/codexoauth.ts";
 import { liveCodexAccountId } from "../lib/codexsample.ts";
 import { presentCodexAccountIds, targetableCodexAccounts } from "../lib/codexpresence.ts";
-import { terminalBars } from "../lib/picker.ts";
+import { thresholdBars } from "../lib/picker.ts";
 import { c, emitError, emitJson } from "./render.ts";
 
 export async function cmdCodexSwitch(sel?: string, json = false): Promise<number> {
@@ -23,7 +23,7 @@ export async function cmdCodexSwitch(sel?: string, json = false): Promise<number
   };
   const deadGrantMessage = (label: string) => `${label}'s refresh token is dead - re-add it with \`tokenmaxxing add --codex\``;
   const cfg = loadConfig();
-  const bars = terminalBars(cfg);
+  const bars = thresholdBars(cfg);
   const now = Date.now();
 
   return withLock(codexPaths.lockFile, async () => {

package/src/cli/config.ts

@@ -10,13 +10,9 @@ import { c, emitError, emitJson } from "./render.ts";
 export const KNOWN_KEYS = [
   "thresholds.session",
   "thresholds.weekly",
-  "hardThresholds.session",
-  "hardThresholds.weekly",
   "claudeBin",
   "codexBin",
   "policy.projectionMargin",
-  "policy.greedySessionFloor",
-  "policy.greedySwapMargin",
   "policy.switchModels",
   "policy.usagePollTtlMs",
   "policy.maxWaitMs",

package/src/cli/status.ts

@@ -5,7 +5,7 @@ import { readOAuthAccount } from "../lib/claudejson.ts";
 import { ensureLiveTokenFresh, probeActiveUsage, probeParkedUsage, type SampleOutcome } from "../lib/sample.ts";
 import { withLock } from "../lib/lock.ts";
 import { codexPaths, paths } from "../lib/paths.ts";
-import { earliestReset, effectiveBars, isExhausted, nextWeeklyReset, terminalBars } from "../lib/picker.ts";
+import { earliestReset, isExhausted, nextWeeklyReset, thresholdBars } from "../lib/picker.ts";
 import { loadCodexAccounts, saveCodexAccounts } from "../lib/codexstate.ts";
 import { liveCodexAccountId, sampleCodexAccount, type CodexSampleOutcome } from "../lib/codexsample.ts";
 import { isCodexExhausted } from "../lib/codexpick.ts";
@@ -62,7 +62,7 @@ type CodexStatusAccount = z.infer<typeof CodexStatusAccountSchema>;
 const StatusReportSchema = z.object({
   now: z.number(),
   claude: z.object({
-    thresholds: z.object({ session: z.array(z.number()), weekly: z.number() }),
+    thresholds: ThresholdsSchema,
     bars: ThresholdsSchema,
     projectionMargin: z.number(),
     accounts: z.array(ClaudeStatusAccountSchema),
@@ -171,7 +171,7 @@ async function collectClaude(input: { cfg: Config; ping: boolean; pingCount: num
   }
 
   const families = gatedFamilies(loadUsage()?.model ?? null, cfg.policy.switchModels);
-  const bars = effectiveBars(cfg, { accounts: idx.accounts, now, switchFamilies: families });
+  const bars = thresholdBars(cfg);
   const liveAccount = readOAuthAccount()?.accountUuid ?? null;
   const ordered = sortBy(idx.accounts, [(a) => (a.needsReauth ? 1 : 0), (a) => earliestReset(a, now)]);
   const accounts = ordered.map((a): ClaudeStatusAccount => {
@@ -207,7 +207,7 @@ async function collectClaude(input: { cfg: Config; ping: boolean; pingCount: num
 
 async function collectCodex(input: { cfg: Config; now: number }): Promise<StatusReport["codex"]> {
   const { cfg, now } = input;
-  const bars = terminalBars(cfg);
+  const bars = thresholdBars(cfg);
   let index = loadCodexAccounts();
   if (index.accounts.length === 0) return { bars, accounts: [] };
 
@@ -410,7 +410,7 @@ function renderClaude(input: { claude: StatusReport["claude"]; codexPooled: bool
     return;
   }
 
-  console.log(c.dim(`thresholds 5h ${claude.thresholds.session.join("/")}% (at ${claude.bars.session + claude.projectionMargin}%) weekly ${claude.thresholds.weekly}%  (${count({ n: claude.accounts.length, noun: "claude account" })})`));
+  console.log(c.dim(`thresholds 5h ${claude.thresholds.session}% weekly ${claude.thresholds.weekly}%  (${count({ n: claude.accounts.length, noun: "claude account" })})`));
   console.log();
   renderGrid(claude.accounts.map((a) => claudeCard(a, now, staleAfterMs)));
 }

package/src/cli/switch.ts

@@ -3,7 +3,7 @@ import { paths } from "../lib/paths.ts";
 import { loadAccounts, loadConfig, loadUsage } from "../lib/state.ts";
 import { readOAuthAccount } from "../lib/claudejson.ts";
 import { isSkippableSwapError, performSwap } from "../lib/swap.ts";
-import { currentWins, effectiveBars, pickBest, pickEarliestReset, weeklyExpiry, type PickCtx } from "../lib/picker.ts";
+import { currentWins, pickBest, pickEarliestReset, thresholdBars, weeklyExpiry, type PickCtx } from "../lib/picker.ts";
 import { InvalidGrantError } from "../lib/oauth.ts";
 import { gatedFamilies } from "../lib/usage.ts";
 import { findAccount } from "./rename.ts";
@@ -62,12 +62,7 @@ export async function cmdSwitch(selector?: string, json = false): Promise<number
     }
 
     const switchFamilies = gatedFamilies(loadUsage()?.model ?? null, cfg.policy.switchModels);
-    const everyoneIn = (accounts: Account[]): PickCtx => ({
-      now,
-      thresholds: effectiveBars(cfg, { accounts, now, switchFamilies }),
-      currentAccountUuid: null,
-      switchFamilies,
-    });
+    const everyone: PickCtx = { now, thresholds: thresholdBars(cfg), currentAccountUuid: null, switchFamilies };
     const rejected = new Set<string>();
     while (true) {
       const cur = loadAccounts();
@@ -76,7 +71,6 @@ export async function cmdSwitch(selector?: string, json = false): Promise<number
         (claimed != null ? cur.accounts.find((a) => a.accountUuid === claimed) : null) ??
         cur.accounts.find((a) => a.accountUuid === cur.activeAccountUuid) ??
         null;
-      const everyone = everyoneIn(cur.accounts);
       if (active != null && currentWins(active, pool, everyone)) {
         if (drifted) return swapTo(active, "drift-reconciled");
         const expiry = weeklyExpiry(active, now);
@@ -114,7 +108,7 @@ export async function cmdSwitch(selector?: string, json = false): Promise<number
     while (true) {
       const fresh = loadAccounts();
       const pool = fresh.accounts.filter((a) => !rejected.has(a.accountUuid));
-      const earliest = pickEarliestReset(pool, everyoneIn(fresh.accounts));
+      const earliest = pickEarliestReset(pool, everyone);
       const reauth = fresh.accounts.filter((a) => a.needsReauth).map((a) => a.label);
       if (!earliest) {
         if (reauth.length > 0) {

package/src/entries/codexstophook.ts

@@ -10,7 +10,7 @@ import { livingCodexPresences } from "../lib/codexpresence.ts";
 import { liveCodexAccountId } from "../lib/codexsample.ts";
 import { loadCodexAccounts } from "../lib/codexstate.ts";
 import { loadConfig } from "../lib/state.ts";
-import { terminalBars } from "../lib/picker.ts";
+import { thresholdBars } from "../lib/picker.ts";
 import { CODEX_SUPERVISOR_ID_ENV } from "./codexsupervisor.ts";
 import { CodexReconcileMarkerSchema, CodexRespawnMarkerSchema, CodexStopStdinSchema, type CodexAccount } from "../lib/types.ts";
 import { log } from "../lib/log.ts";
@@ -51,7 +51,7 @@ function promoteReconcileLocked(input: { supervisorId: string; sessionId: string
     return false;
   }
   const now = Date.now();
-  const bars = terminalBars(loadConfig());
+  const bars = thresholdBars(loadConfig());
   const index = loadCodexAccounts();
   const unusable = (account: CodexAccount): boolean =>
     account.needsReauth === true || isCodexExhausted({ account, thresholds: bars, now });

package/src/entries/codexsupervisor.ts

@@ -21,13 +21,14 @@ const NONINTERACTIVE_SUBCMDS = new Set([
 
 const PASSTHROUGH_FLAGS = new Set(["--version", "-V", "--help", "-h"]);
 
-function consumableCodexMarker(marker: string): z.infer<typeof CodexRespawnMarkerSchema> | null {
+function readCodexMarker(marker: string): z.infer<typeof CodexRespawnMarkerSchema> {
   try {
     return CodexRespawnMarkerSchema.parse(JSON.parse(readFileSync(marker, "utf8")));
   } catch (e) {
-    rmSync(marker, { force: true });
     log("codexsupervisor.marker_invalid", { err: e instanceof Error ? e.message : String(e) });
-    return null;
+    throw new Error(
+      `${marker} is corrupt (unparsable JSON or off-schema) - auth.json may already hold another account, so the codex session was stopped instead of resumed on stale credentials; inspect and remove the marker, then run \`codex resume\``,
+    );
   }
 }
 
@@ -126,7 +127,10 @@ export async function runCodexSupervisor(input: { argv: string[] }): Promise<num
     let done = false;
     const markerWatch = (async () => {
       while (!done) {
-        if (existsSync(marker) && consumableCodexMarker(marker) != null) return true;
+        if (existsSync(marker)) {
+          readCodexMarker(marker);
+          return true;
+        }
         await Bun.sleep(150);
       }
       return false;
@@ -135,17 +139,20 @@ export async function runCodexSupervisor(input: { argv: string[] }): Promise<num
       done = true;
       return "exit";
     });
-    const winner = await Promise.race([exited, markerWatch.then((found) => (found ? "marker" : "exit"))]);
-
-    if (winner === "marker") {
+    try {
+      const winner = await Promise.race([exited, markerWatch.then((found) => (found ? "marker" : "exit"))]);
+      if (winner === "marker") child.kill();
+    } catch (e) {
       child.kill();
+      throw e;
+    } finally {
+      await child.exited;
+      done = true;
+      await markerWatch.catch(() => false);
+      restoreTermios(savedTermios);
     }
-    await child.exited;
-    done = true;
-    await markerWatch.catch(() => false);
-    restoreTermios(savedTermios);
 
-    const payload = existsSync(marker) ? consumableCodexMarker(marker) : null;
+    const payload = existsSync(marker) ? readCodexMarker(marker) : null;
     if (payload) {
       rmSync(marker, { force: true });
       respawns++;

package/src/entries/supervisor.ts

@@ -1,5 +1,5 @@
 import { existsSync, mkdirSync, readFileSync, rmSync, readdirSync, statSync } from "node:fs";
-import { join } from "node:path";
+import { basename, join } from "node:path";
 import { maxBy } from "es-toolkit";
 import { z } from "zod";
 import { paths } from "../lib/paths.ts";
@@ -152,9 +152,10 @@ function consumableMarker(marker: string, gate: MarkerGate): z.infer<typeof Resp
   try {
     m = RespawnMarkerSchema.parse(JSON.parse(readFileSync(marker, "utf8")));
   } catch (e) {
-    rmSync(marker, { force: true });
     log("supervisor.marker_invalid", { err: e instanceof Error ? e.message : String(e) });
-    return null;
+    throw new Error(
+      `${marker} is corrupt (unparsable JSON or off-schema) - the session was stopped instead of guessing whether the pool is depleted; inspect the marker, then run \`claude --resume ${basename(marker)}\` (a fresh launch clears it)`,
+    );
   }
   if (m.launchedAt !== undefined && m.launchedAt !== gate.launchedAt) {
     rmSync(marker, { force: true });
@@ -270,15 +271,18 @@ export async function runSupervisor(argv: string[]): Promise<number> {
       return false;
     })();
     const exited = child.exited.then(() => { done = true; return "exit" as const; });
-    const winner = await Promise.race([exited, markerWatch.then((m) => (m ? "marker" : "exit"))]);
-
-    if (winner === "marker") {
+    try {
+      const winner = await Promise.race([exited, markerWatch.then((m) => (m ? "marker" : "exit"))]);
+      if (winner === "marker") child.kill();
+    } catch (e) {
       child.kill();
+      throw e;
+    } finally {
+      await child.exited;
+      done = true;
+      await markerWatch.catch(() => {});
+      restoreTermios(savedTermios);
     }
-    await child.exited;
-    done = true;
-    await markerWatch.catch(() => {});
-    restoreTermios(savedTermios);
 
     const m = existsSync(marker) ? consumableMarker(marker, gate) : null;
     if (m) {

package/src/lib/codexdecide.ts

@@ -6,14 +6,14 @@ import { writeFileAtomic } from "./atomic.ts";
 import { codexPaths } from "./paths.ts";
 import { loadConfig } from "./state.ts";
 import { loadCodexAccounts, loadCodexLastSwapAt, saveCodexAccounts } from "./codexstate.ts";
-import { codexCurrentWins, isCodexEngaged, isCodexExhausted, pickBestCodex } from "./codexpick.ts";
+import { isCodexExhausted, pickBestCodex } from "./codexpick.ts";
 import { performCodexSwap } from "./codexswap.ts";
 import { CodexInvalidGrantError, refreshCodexAuth } from "./codexoauth.ts";
 import { fetchCodexUsage } from "./codexusage.ts";
 import { codexIdentityOf, isCodexAccessExpiring, readLiveCodexAuth, writeLiveCodexAuth, writeParkedCodexAuth } from "./codexauth.ts";
 import { liveCodexAccountId } from "./codexsample.ts";
 import { livingCodexPresences, presentCodexAccountIds, targetableCodexAccounts } from "./codexpresence.ts";
-import { terminalBars } from "./picker.ts";
+import { thresholdBars } from "./picker.ts";
 import { log } from "./log.ts";
 import { CodexAccountSchema, CodexReconcileMarkerSchema, type CodexAccount } from "./types.ts";
 
@@ -100,7 +100,7 @@ function postSwapResweep(input: { liveAccountId: string; bars: { session: number
 export async function evaluateAndMaybeSwapCodex(input: { now?: number }): Promise<CodexSwapDecision> {
   const now = input.now ?? Date.now();
   const cfg = loadConfig();
-  const bars = terminalBars(cfg);
+  const bars = thresholdBars(cfg);
 
   return withLock(codexPaths.lockFile, async () => {
     let index = loadCodexAccounts();
@@ -131,34 +131,9 @@ export async function evaluateAndMaybeSwapCodex(input: { now?: number }): Promis
     const active = index.accounts.find((account) => account.accountId === activeId) ?? null;
     if (!active) return { swapped: false, account: null, reason: "no-active-account" };
 
-    const engaged =
-      active.needsReauth === true ||
-      isCodexEngaged({ account: active, floor: cfg.policy.greedySessionFloor, now }) ||
-      isCodexExhausted({ account: active, thresholds: bars, now });
+    const engaged = active.needsReauth === true || isCodexExhausted({ account: active, thresholds: bars, now });
     if (!engaged) return { swapped: false, account: null, reason: "under-threshold-or-stale" };
 
-    if (!isCodexExhausted({ account: active, thresholds: bars, now })) {
-      while (true) {
-        const current = loadCodexAccounts();
-        const candidates = targetableCodexAccounts({ accounts: current.accounts, activeAccountId: activeId });
-        const cur = candidates.find((account) => account.accountId === activeId) ?? null;
-        if (codexCurrentWins({ active: cur, accounts: candidates, thresholds: bars, now })) {
-          return { swapped: false, account: null, reason: "current-best" };
-        }
-        const best = pickBestCodex({ accounts: candidates, thresholds: bars, now, currentAccountId: activeId });
-        if (!best) return { swapped: false, account: null, reason: "no-usable-target" };
-        try {
-          await performCodexSwap({ target: best });
-        } catch (e) {
-          if (e instanceof CodexInvalidGrantError) continue;
-          throw e;
-        }
-        log("codexdecide.greedy_swap", { account: best.accountId.slice(0, 8) });
-        postSwapResweep({ liveAccountId: best.accountId, bars, now });
-        return { swapped: true, account: best, reason: "swapped" };
-      }
-    }
-
     const tried = new Set<string>();
     while (true) {
       const current = loadCodexAccounts();
@@ -174,7 +149,7 @@ export async function evaluateAndMaybeSwapCodex(input: { now?: number }): Promis
         if (e instanceof CodexInvalidGrantError) continue;
         throw e;
       }
-      log("codexdecide.hard_swap", { account: best.accountId.slice(0, 8) });
+      log("codexdecide.swap", { account: best.accountId.slice(0, 8) });
       postSwapResweep({ liveAccountId: best.accountId, bars, now });
       return { swapped: true, account: best, reason: "swapped" };
     }

package/src/lib/codexoauth.ts

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { http, safeErrorDetail } from "./http.ts";
+import { http, oauthErrorCode, safeErrorDetail } from "./http.ts";
 import { CodexAuthJsonSchema, type CodexAuthJson } from "./types.ts";
 
 const EnvOverrideSchema = z.string().min(1).optional().catch(undefined);
@@ -26,12 +26,12 @@ const CodexRefreshResponseSchema = z.looseObject({
   refresh_token: z.string().optional(),
 });
 
-const DEAD_GRANT_MARKERS = [
+const DEAD_GRANT_CODES = new Set([
   "invalid_grant",
   "refresh_token_reused",
   "refresh_token_expired",
   "refresh_token_invalidated",
-];
+]);
 
 export async function refreshCodexAuth(input: { auth: CodexAuthJson; now?: number }): Promise<CodexAuthJson> {
   const { auth, now = Date.now() } = input;
@@ -53,7 +53,8 @@ export async function refreshCodexAuth(input: { auth: CodexAuthJson; now?: numbe
   const text = await res.text();
   if (!res.ok) {
     const detail = safeErrorDetail({ text });
-    if (DEAD_GRANT_MARKERS.some((marker) => text.includes(marker))) {
+    const code = oauthErrorCode({ text })?.toLowerCase();
+    if (code != null && DEAD_GRANT_CODES.has(code)) {
       throw new CodexInvalidGrantError(detail);
     }
     throw new CodexRefreshFailedError(`HTTP ${res.status}: ${detail}`);

package/src/lib/codexpick.ts

@@ -78,9 +78,3 @@ export function codexCurrentWins(input: {
   if (best == null || best.accountId === active.accountId) return true;
   return codexPacePressure({ account: best, now }) <= codexPacePressure({ account: active, now }) * CODEX_SWAP_IMPROVEMENT;
 }
-
-export function isCodexEngaged(input: { account: CodexAccount; floor: number; now: number }): boolean {
-  const { account, floor, now } = input;
-  const sampledAt = account.lastUsageAt ?? null;
-  return allWindows(account).some((window) => liveUsed({ window, now, sampledAt }) >= floor);
-}

package/src/lib/decide.ts

@@ -4,9 +4,9 @@ import { withLock } from "./lock.ts";
 import { paths } from "./paths.ts";
 import { POST_SWAP_COOLDOWN_MS, loadAccounts, loadConfig, loadDepletedWait, loadLastSwapAt, loadUsage, loadUsageSnapshot, loadModelUsage, saveAccounts, saveDepletedWait, saveModelUsage, writeUsage } from "./state.ts";
 import { readOAuthAccount } from "./claudejson.ts";
-import { chooseAndSwap, isSkippableSwapError, performSwap, type VerifyVerdict } from "./swap.ts";
+import { isSkippableSwapError, performSwap, type VerifyVerdict } from "./swap.ts";
 import { probeParkedUsage } from "./sample.ts";
-import { currentWins, effectiveBars, hardBars, isExhausted, nextWeeklyReset, pickBest, pickEarliestReset, usableAt, type PickCtx } from "./picker.ts";
+import { isExhausted, nextWeeklyReset, pickBest, pickEarliestReset, thresholdBars, usableAt, type PickCtx } from "./picker.ts";
 import { familyTokens, gatedFamilies, probeUsage, type EnforcedClass } from "./usage.ts";
 import { log } from "./log.ts";
 import { AccountSchema, ModelUsageStateSchema, UsageStateSchema, type Account, type Config, type EnforcedLimit, type ModelUsageState, type Thresholds, type UsageState, type UsageWindow } from "./types.ts";
@@ -38,15 +38,6 @@ function capForFamily(mu: ModelUsageState, family: string, now: number): UsageWi
   return maxBy(rows, (w) => liveUsed({ window: w, windowMs: WEEK_MS, sampledAt: mu.sampledAt ?? mu.ts, now }));
 }
 
-function overlayLive(accounts: Account[], u: UsageState | null, mu: ModelUsageState | null, account: string | null): Account[] {
-  return accounts.map((a) => {
-    if (account == null || a.accountUuid !== account) return a;
-    const live = u && u.account === account ? { lastUsage: { fiveHour: u.fiveHour, sevenDay: u.sevenDay }, lastUsageAt: u.ts } : {};
-    const perModel = mu && mu.account === account && Object.keys(mu.perModel).length > 0 ? { lastPerModel: mu.perModel, lastPerModelAt: mu.sampledAt ?? mu.ts } : {};
-    return { ...a, ...live, ...perModel };
-  });
-}
-
 function isOver(u: UsageState | null, mu: ModelUsageState | null, account: string | null, bars: Thresholds, cfg: Config, now: number): boolean {
   if (!u || !account || u.account !== account) return false;
   if (
@@ -66,11 +57,6 @@ function needsPerModel(u: UsageState | null, cfg: Config): boolean {
   return u != null && gatedFamilies(u.model, cfg.policy.switchModels).length > 0;
 }
 
-function isEngaged(u: UsageState | null, mu: ModelUsageState | null, account: string | null, bars: Thresholds, cfg: Config, now: number): boolean {
-  if (!u || !account || u.account !== account) return false;
-  return liveUsed({ window: u.fiveHour, windowMs: FIVE_HOURS_MS, sampledAt: u.ts, now }) >= cfg.policy.greedySessionFloor || isOver(u, mu, account, bars, cfg, now);
-}
-
 const SnapshotsSchema = z.object({
   u: UsageStateSchema.nullable(),
   mu: ModelUsageStateSchema.nullable(),
@@ -138,17 +124,13 @@ export async function evaluateAndMaybeSwap(now = Date.now(), anticipatory = fals
   }
 
   const cfg = loadConfig();
+  const bars = thresholdBars(cfg);
 
   const { u: teeUsage, mu, uAt } = await loadFreshSnapshots(cfg, activeAccount, now);
   const pool = loadAccounts();
   const usage = freshest(teeUsage, uAt, pool.accounts.find((a) => a.accountUuid === activeAccount));
-  const bars0 = effectiveBars(cfg, {
-    accounts: overlayLive(pool.accounts, usage, mu, activeAccount),
-    now,
-    switchFamilies: gatedFamilies(usage?.model ?? null, cfg.policy.switchModels),
-  });
 
-  if (!enforced0 && !isEngaged(usage, mu, activeAccount, bars0, cfg, now)) {
+  if (!enforced0 && !isOver(usage, mu, activeAccount, bars, cfg, now)) {
     const measured = usage != null && activeAccount != null && usage.account === activeAccount;
     if (!measured) {
       const replay = depletedReplay(now);
@@ -187,10 +169,8 @@ export async function evaluateAndMaybeSwap(now = Date.now(), anticipatory = fals
 
     const gated = gatedFamilies(u2?.model ?? null, cfg.policy.switchModels);
     const switchFamilies = enforced2?.family && !gated.includes(enforced2.family) ? [...gated, enforced2.family] : gated;
-    const barsOf = (accounts: Account[]): Thresholds => effectiveBars(cfg, { accounts, now, switchFamilies });
-    const bars = barsOf(idx.accounts);
 
-    if (!enforced2 && !isEngaged(u2, mu2, account2, bars, cfg, now)) {
+    if (!enforced2 && !isOver(u2, mu2, account2, bars, cfg, now)) {
       return depletedReplay(now) ?? { swapped: false, account: null, reason: "raced-already-swapped" };
     }
 
@@ -246,40 +226,11 @@ export async function evaluateAndMaybeSwap(now = Date.now(), anticipatory = fals
       return "rerank";
     };
 
-    const greedy = async (holdMargin: number): Promise<SwapDecision> => {
-      while (true) {
-        const cur = loadAccounts();
-        const active = seatOf(cur);
-        const ctxAll = { now, thresholds: barsOf(cur.accounts), currentAccountUuid: null, currentOrganizationUuid: active?.organizationUuid ?? null, orgAffinityFloor: cfg.policy.greedySessionFloor, switchFamilies, holdMargin };
-        const seatOrg = active != null && !active.needsReauth && !isExhausted(active, ctxAll) ? active.organizationUuid : null;
-        const pool = usable(cur.accounts).filter((a) => seatOrg == null || a.organizationUuid === seatOrg);
-        if (currentWins(active, pool, ctxAll)) {
-          return { swapped: false, account: null, reason: "current-best" };
-        }
-        const ctx = { ...ctxAll, currentAccountUuid: active?.accountUuid ?? null };
-        const best = pickBest(pool, ctx);
-        if (!best) return { swapped: false, account: null, reason: "no-usable-target" };
-        if ((await verified(best, ctx)) !== "go") continue;
-        try {
-          await performSwap(best);
-        } catch (e) {
-          skipOrThrow(e, best);
-          continue;
-        }
-        log("decide.greedy_swap", { account: best.accountUuid.slice(0, 8) });
-        return { swapped: true, account: best, reason: "swapped" };
-      }
-    };
-    if (!enforced2 && !isOver(u2, mu2, account2, bars, cfg, now)) return greedy(cfg.policy.greedySwapMargin);
-
     while (true) {
       const cur = loadAccounts();
       const seat = seatOf(cur);
-      const pool = usable(cur.accounts);
-      const thresholds = barsOf(cur.accounts);
-      if (!enforced2 && seat && !seat.needsReauth && !isExhausted(seat, { now, thresholds, currentAccountUuid: null, switchFamilies })) return greedy(0);
-      const ctx = { now, thresholds, currentAccountUuid: seat?.accountUuid ?? null, currentOrganizationUuid: seat?.organizationUuid ?? null, orgAffinityFloor: cfg.policy.greedySessionFloor, switchFamilies };
-      const best = pickBest(pool, ctx);
+      const ctx = { now, thresholds: bars, currentAccountUuid: seat?.accountUuid ?? null, switchFamilies };
+      const best = pickBest(usable(cur.accounts), ctx);
       if (!best) break;
       if ((await verified(best, ctx)) !== "go") continue;
       try {
@@ -288,26 +239,14 @@ export async function evaluateAndMaybeSwap(now = Date.now(), anticipatory = fals
         skipOrThrow(e, best);
         continue;
       }
-      log("decide.hard_swap", { account: best.accountUuid.slice(0, 8), enforced: enforced2 != null });
+      log("decide.swap", { account: best.accountUuid.slice(0, 8), enforced: enforced2 != null });
       return { swapped: true, account: best, reason: "swapped" };
     }
 
-    const hardCtx = { now, thresholds: hardBars(cfg), currentAccountUuid: null, switchFamilies };
-    const seat = seatOf(loadAccounts());
-    if (!enforced2 && seat && !seat.needsReauth && !isExhausted(seat, hardCtx)) {
-      log("decide.last_drop_hold", { account: seat.accountUuid.slice(0, 8) });
-      return { swapped: false, account: null, reason: "last-drop-hold" };
-    }
-    const squeezed = await chooseAndSwap({ ...hardCtx, currentAccountUuid: seat?.accountUuid ?? null, currentOrganizationUuid: seat?.organizationUuid ?? null, orgAffinityFloor: cfg.policy.greedySessionFloor }, rejected, verified);
-    if (squeezed) {
-      log("decide.last_drop_swap", { account: squeezed.accountUuid.slice(0, 8) });
-      return { swapped: true, account: squeezed, reason: "last-drop-swap" };
-    }
-
     while (true) {
       const fresh = loadAccounts();
       const current = seatOf(fresh);
-      const ctx = { now, thresholds: hardBars(cfg), currentAccountUuid: current?.accountUuid ?? null, switchFamilies };
+      const ctx = { now, thresholds: bars, currentAccountUuid: current?.accountUuid ?? null, switchFamilies };
       const enforcedUntil = enforced2 && current && current.accountUuid === enforced2.account ? (enforced2.resetsAt ?? now + enforced2.windowMs) : 0;
       const currentAt = current ? Math.max(usableAt(current, ctx), enforcedUntil) : Number.POSITIVE_INFINITY;
       const other = pickEarliestReset(usable(fresh.accounts), ctx);

package/src/lib/http.ts

@@ -7,7 +7,7 @@ const OAuthErrorBodySchema = z.looseObject({
 });
 
 const NestedErrorBodySchema = z.looseObject({
-  error: z.looseObject({ type: z.string().optional(), message: z.string().optional() }),
+  error: z.looseObject({ code: z.string().nullish(), type: z.string().optional(), message: z.string().optional() }),
   request_id: z.string().nullish(),
 });
 
@@ -31,7 +31,8 @@ function parseErrorBody(text: string): ErrorDetail | null {
   const nested = NestedErrorBodySchema.safeParse(json);
   if (nested.success) {
     const requestId = nested.data.request_id ? ` (${nested.data.request_id})` : "";
-    return { code: nested.data.error.type ?? null, fields: [nested.data.error.type ?? "", (nested.data.error.message ?? "") + requestId] };
+    const code = nested.data.error.code ?? nested.data.error.type ?? null;
+    return { code, fields: [code ?? "", (nested.data.error.message ?? "") + requestId] };
   }
   const plain = PlainErrorBodySchema.safeParse(json);
   if (plain.success) return { code: null, fields: [plain.data.detail ?? "", plain.data.message ?? ""] };

package/src/lib/picker.ts

@@ -3,41 +3,18 @@ import { z } from "zod";
 import { familyTokens } from "./usage.ts";
 import { AccountSchema, ThresholdsSchema, type Account, type Config, type Thresholds, type UsageWindow } from "./types.ts";
 
-export function sessionLadder(cfg: Config): number[] {
-  return cfg.thresholds.session.map((rung) => rung - cfg.policy.projectionMargin);
-}
-
-export function terminalBars(cfg: Config): Thresholds {
+export function thresholdBars(cfg: Config): Thresholds {
   return {
-    session: Math.max(...sessionLadder(cfg)),
+    session: cfg.thresholds.session - cfg.policy.projectionMargin,
     weekly: cfg.thresholds.weekly - cfg.policy.projectionMargin,
   };
 }
 
-export function effectiveBars(cfg: Config, pool: { accounts: Account[]; now: number; switchFamilies: string[] }): Thresholds {
-  const top = terminalBars(cfg);
-  const holdsAt = (session: number) =>
-    pool.accounts.some(
-      (a) => !a.needsReauth && !isExhausted(a, { now: pool.now, thresholds: { session, weekly: top.weekly }, currentAccountUuid: null, switchFamilies: pool.switchFamilies }),
-    );
-  return { session: sessionLadder(cfg).find(holdsAt) ?? top.session, weekly: top.weekly };
-}
-
-export function hardBars(cfg: Config): Thresholds {
-  return {
-    session: cfg.hardThresholds.session - cfg.policy.projectionMargin,
-    weekly: cfg.hardThresholds.weekly - cfg.policy.projectionMargin,
-  };
-}
-
 const PickCtxSchema = z.object({
   now: z.number(),
   thresholds: ThresholdsSchema,
   currentAccountUuid: z.string().nullable(),
-  currentOrganizationUuid: z.string().nullable().optional(),
-  orgAffinityFloor: z.number().optional(),
   switchFamilies: z.array(z.string()),
-  holdMargin: z.number().min(0).optional(),
 });
 export type PickCtx = z.infer<typeof PickCtxSchema>;
 
@@ -96,25 +73,7 @@ export function pacePressure(a: Account, now: number): number {
   return Math.max(0, 100 - used) / Math.max(1, reset - now);
 }
 
-function sessionUsed(a: Account, now: number): number {
-  const w = a.lastUsage?.fiveHour;
-  if (w == null) return 101;
-  if (w.resetsAt != null) return w.resetsAt <= now ? 0 : w.usedPercentage;
-  if (a.lastUsageAt != null && now >= a.lastUsageAt + FIVE_HOURS_MS) return 0;
-  return w.usedPercentage;
-}
-
-function orgTier(a: Account, ctx: PickCtx): number {
-  if (ctx.currentOrganizationUuid == null || a.organizationUuid !== ctx.currentOrganizationUuid) return 1;
-  if (ctx.orgAffinityFloor != null && sessionUsed(a, ctx.now) >= ctx.orgAffinityFloor) return 1;
-  if (!a.lastUsage || ctx.switchFamilies.some((family) => gatedPerModelWindows(a, [family]).length === 0)) return 1;
-  const headroom = Math.max(1, ctx.thresholds.session - (ctx.orgAffinityFloor ?? ctx.thresholds.session));
-  if (isExhausted(a, { ...ctx, thresholds: { session: ctx.thresholds.session - headroom, weekly: ctx.thresholds.weekly - headroom } })) return 1;
-  return 0;
-}
-
 const swapPreference = (ctx: PickCtx) => [
-  (a: Account) => orgTier(a, ctx),
   (a: Account) => -pacePressure(a, ctx.now),
   (a: Account) => weeklyExpiry(a, ctx.now),
   (a: Account) => a.lastUsage?.sevenDay.usedPercentage ?? 101,
@@ -131,9 +90,6 @@ export function currentWins(active: Account | null, accounts: Account[], ctx: Pi
   if (!active || active.needsReauth || isExhausted(active, ctx)) return false;
   const best = pickBest(accounts, { ...ctx, currentAccountUuid: null });
   if (best == null || best.accountUuid === active.accountUuid) return true;
-  const margin = ctx.holdMargin ?? 0;
-  const bestPace = pacePressure(best, ctx.now);
-  if (margin > 0 && bestPace > 0 && bestPace <= pacePressure(active, ctx.now) * (1 + margin)) return true;
   return swapPreference(ctx).every((k) => k(active) === k(best));
 }
 

package/src/lib/state.ts

@@ -8,7 +8,6 @@ import {
   ConfigSchema,
   LastSwapSchema,
   ModelUsageStateSchema,
-  SessionLadderSchema,
   UsageStateSchema,
   type AccountsIndex,
   type Config,
@@ -17,14 +16,11 @@ import {
 } from "./types.ts";
 
 const DEFAULT_CONFIG: Config = {
-  thresholds: { session: [90], weekly: 98 },
-  hardThresholds: { session: 100, weekly: 100 },
+  thresholds: { session: 90, weekly: 98 },
   claudeBin: "",
   codexBin: "",
   policy: {
     projectionMargin: 0,
-    greedySessionFloor: 80,
-    greedySwapMargin: 0.15,
     switchModels: ["fable"],
     usagePollTtlMs: 90_000,
     maxWaitMs: 3_600_000,
@@ -36,15 +32,12 @@ const PercentSchema = z.number().min(0).max(100);
 
 export const ConfigFileSchema = z
   .object({
-    thresholds: z.object({ session: SessionLadderSchema, weekly: PercentSchema }).partial(),
-    hardThresholds: z.object({ session: PercentSchema, weekly: PercentSchema }).partial(),
+    thresholds: z.object({ session: PercentSchema, weekly: PercentSchema }).partial(),
     claudeBin: z.string(),
     codexBin: z.string(),
     policy: z
       .object({
         projectionMargin: PercentSchema,
-        greedySessionFloor: PercentSchema,
-        greedySwapMargin: z.number().min(0).max(1),
         switchModels: z.array(z.string()),
         usagePollTtlMs: z.number().int().positive(),
         maxWaitMs: z.number().int().positive(),
@@ -64,18 +57,13 @@ export function mergeConfigFile(p: z.infer<typeof ConfigFileSchema>): MergeOutco
   const cfg: Config = {
     ...DEFAULT_CONFIG,
     thresholds: { ...DEFAULT_CONFIG.thresholds },
-    hardThresholds: { ...DEFAULT_CONFIG.hardThresholds },
     policy: { ...DEFAULT_CONFIG.policy },
   };
   cfg.thresholds.session = p.thresholds?.session ?? cfg.thresholds.session;
   cfg.thresholds.weekly = p.thresholds?.weekly ?? cfg.thresholds.weekly;
-  cfg.hardThresholds.session = p.hardThresholds?.session ?? cfg.hardThresholds.session;
-  cfg.hardThresholds.weekly = p.hardThresholds?.weekly ?? cfg.hardThresholds.weekly;
   cfg.claudeBin = p.claudeBin ?? cfg.claudeBin;
   cfg.codexBin = p.codexBin ?? cfg.codexBin;
   cfg.policy.projectionMargin = p.policy?.projectionMargin ?? cfg.policy.projectionMargin;
-  cfg.policy.greedySessionFloor = p.policy?.greedySessionFloor ?? cfg.policy.greedySessionFloor;
-  cfg.policy.greedySwapMargin = p.policy?.greedySwapMargin ?? cfg.policy.greedySwapMargin;
   cfg.policy.usagePollTtlMs = p.policy?.usagePollTtlMs ?? cfg.policy.usagePollTtlMs;
   cfg.policy.maxWaitMs = p.policy?.maxWaitMs ?? cfg.policy.maxWaitMs;
   cfg.policy.checkIntervalMs = p.policy?.checkIntervalMs ?? cfg.policy.checkIntervalMs;
@@ -104,7 +92,7 @@ export function loadConfig(): Config {
     }
     const parsed = ConfigFileSchema.safeParse(raw);
     if (!parsed.success) {
-      const fields = parsed.error.issues.map((issue) => issue.path.join(".")).join(", ");
+      const fields = parsed.error.issues.map((issue) => `${issue.path.join(".")}: ${issue.message}`).join(", ");
       throw new Error(`${paths.configJson} has wrong-typed values (${fields}) - fix or remove them`);
     }
     fileData = parsed.data;

package/src/lib/swap.ts

@@ -5,7 +5,6 @@ import { refreshCredential, isAccessTokenExpiring, isDeadCredential, fetchTokenI
 import { swapOAuthAccount } from "./claudejson.ts";
 import { withClaudeRefreshLock } from "./claudelock.ts";
 import { log } from "./log.ts";
-import { pickBest, type PickCtx } from "./picker.ts";
 import { CredentialBlobSchema, type Account, type OAuthCreds, type TokenIdentity } from "./types.ts";
 
 function parseBlob(raw: string) {
@@ -198,34 +197,3 @@ export async function keepRotatedPair(input: {
 export function isSkippableSwapError(e: unknown): boolean {
   return e instanceof InvalidGrantError || e instanceof RefreshRejectedError || e instanceof IdentityUnavailableError;
 }
-
-export async function chooseAndSwap(
-  ctx: PickCtx,
-  exclude: ReadonlySet<string> = new Set(),
-  verify?: (candidate: Account, ctx: PickCtx) => Promise<VerifyVerdict>,
-): Promise<Account | null> {
-  const tried = new Set<string>(exclude);
-  while (true) {
-    const idx = loadAccounts();
-    const candidates = idx.accounts.filter((a) => !tried.has(a.accountUuid));
-    const best = pickBest(candidates, ctx);
-    if (!best) return null;
-    if (verify) {
-      const verdict = await verify(best, ctx);
-      if (verdict === "rerank") continue;
-      if (verdict === "skip") {
-        tried.add(best.accountUuid);
-        continue;
-      }
-    }
-    tried.add(best.accountUuid);
-    try {
-      await performSwap(best);
-      return best;
-    } catch (e) {
-      if (isSkippableSwapError(e)) continue;
-      throw e;
-    }
-  }
-}
-

package/src/lib/types.ts

@@ -1,4 +1,3 @@
-import { isEqual, uniq } from "es-toolkit";
 import { z } from "zod";
 
 const OAuthCredsSchema = z.looseObject({
@@ -99,39 +98,21 @@ export const ThresholdsSchema = z.object({
 });
 export type Thresholds = z.infer<typeof ThresholdsSchema>;
 
-export const SessionLadderSchema = z
-  .array(z.number().min(0).max(100))
-  .min(1)
-  .refine((rungs) => isEqual(rungs, uniq(rungs).toSorted((a, b) => a - b)), {
-    message: "thresholds.session rungs must be strictly ascending",
-  });
-
-export const ScreeningThresholdsSchema = z.object({
-  session: SessionLadderSchema,
-  weekly: z.number().min(0).max(100),
-});
-
 export const ConfigSchema = z
   .object({
-    thresholds: ScreeningThresholdsSchema,
-    hardThresholds: ThresholdsSchema,
+    thresholds: ThresholdsSchema,
     claudeBin: z.string(),
     codexBin: z.string(),
     policy: z.object({
       projectionMargin: z.number().min(0).max(100),
-      greedySessionFloor: z.number().min(0).max(100),
-      greedySwapMargin: z.number().min(0).max(1),
       switchModels: z.array(z.string()),
       usagePollTtlMs: z.number().int().positive(),
       maxWaitMs: z.number().int().positive(),
       checkIntervalMs: z.number().int().min(10_000),
     }),
   })
-  .refine((cfg) => cfg.policy.projectionMargin < Math.min(...cfg.thresholds.session, cfg.thresholds.weekly), {
-    message: "policy.projectionMargin must be strictly below every threshold (effectiveBars would hit zero and every account would read as exhausted)",
-  })
-  .refine((cfg) => cfg.hardThresholds.session >= Math.max(...cfg.thresholds.session) && cfg.hardThresholds.weekly >= cfg.thresholds.weekly, {
-    message: "hardThresholds (the Layer 2 wall) must be at or above thresholds (the Layer 1 screening bars, the top session rung) for both windows",
+  .refine((cfg) => cfg.policy.projectionMargin < Math.min(cfg.thresholds.session, cfg.thresholds.weekly), {
+    message: "policy.projectionMargin must be strictly below both thresholds (the bars would hit zero and every account would read as exhausted)",
   });
 export type Config = z.infer<typeof ConfigSchema>;