tokenmaxxing 1.27.0 → 1.28.0

package/DESIGN.md

@@ -50,7 +50,7 @@ The Stop hook's stdin has no usage data, but the **statusLine does** (`rate_limi
 
 ### 3.2 Detect + swap + signal (Stop hook, per turn)
 1. Read `usage.json` and exit while the live account is under both bars, as defined in the [switching policy](docs/content/docs/switching.mdx).
-2. Take the pool lock, re-check state, select a candidate under the [switching policy](docs/content/docs/switching.mdx), and attempt bounded verification of stale usage before swapping the credential.
+2. Take the pool lock, re-check state, select a candidate under the [switching policy](docs/content/docs/switching.mdx) from the cached usage figures, and swap the credential.
 3. Done - the running session adopts the new credential on its own within a request or two. Only when the pool is depleted (the decision returned a `waitUntil`: pre-parked on the soonest-recovering account, or staying on the current one when it recovers first) does the hook write `respawn/<session_id>` (atomic temp+rename).
 
 ### 3.3 Depleted-pool pause (supervisor)
@@ -82,10 +82,7 @@ Each terminal ran the supervisor, so each has its own child `claude` and its own
 The [switching policy](docs/content/docs/switching.mdx) is one rule: under both bars, hold; at or over a bar, move to the usable account with the highest pace pressure; nothing usable, wait for the soonest reset.
 
 - Automatic and manual switching rank by pace pressure alone; organization membership is not an input.
-- Successful candidate probes persist their results and restart selection.
-- Verification attempts at most two candidates with a shared 12-second deadline per candidate for identity reads and CLI execution.
-- Expiring access tokens are not refreshed for verification, and the isolated CLI receives no refresh grant.
-- Failed or budget-limited verification uses the existing cached data, so stale-target handoffs remain possible.
+- Selection reads the cached figures only. Each periodic check tick samples the parked account whose last `/usage` attempt is oldest, skipping any attempted within `policy.usagePollTtlMs`, so every parked account is attempted about once per tick per pooled account, or once per `policy.usagePollTtlMs` plus a tick when that is longer, and its cached figure is as fresh as its last successful attempt. No sample runs inside the post-swap cooldown. The pool lock covers only the reservation (its owner lookups and refresh under one 20-second deadline) and the result write, never the `/usage` child.
 - The depleted pause happens at the bar, not at 100; Codex has no pause and rides its account until the server refuses it, because a running sibling cannot adopt another account without restarting.
 
 The [profile](docs/content/docs/switching-profile.mdx) records observed cache rewrites across swaps and does not infer subscription quota savings.

package/README.md

@@ -88,8 +88,7 @@ The bars' headroom is deliberate: it's the budget to reach a clean turn boundary
 
 Selection ranks usable candidates by remaining weekly percentage divided by time to reset, highest first; organization membership is not an input, and manual `tokenmaxxing switch` uses the same ranking.
 
-- Candidate verification makes at most two bounded `/usage` attempts per evaluation and re-ranks successful samples before switching.
-- Failed verification leaves cached figures in force, so it cannot guarantee a fresh target.
+- Every periodic check tick samples the parked account whose last `/usage` attempt is oldest, skipping any attempted within `policy.usagePollTtlMs`, so every parked account is attempted about once per tick per pooled account, or once per `usagePollTtlMs` plus a tick when that is longer; the swap reads the cached figures, which are as fresh as each account's last successful attempt. No sample runs inside the 45-second post-swap cooldown.
 - When no account is usable, the session pauses until the soonest reset if that lands within `policy.maxWaitMs`, and otherwise stays put.
 
 See [How switching decides](docs/content/docs/switching.mdx) for the policy and the [cache-cost profile](docs/content/docs/switching-profile.mdx) for measurements and their limits.
@@ -110,7 +109,7 @@ See [How switching decides](docs/content/docs/switching.mdx) for the policy and
 }
 ```
 
-`thresholds.session` and `thresholds.weekly` are the two bars, one number each (an array `thresholds.session`, the former ladder, fails config loading with a message naming the field); `projectionMargin` is a fixed safety margin subtracted from each threshold bar (effective bar = threshold - margin), so a large turn is less likely to blow past a bar between checks; `switchModels` names the models whose per-model cap triggers a switch; `usagePollTtlMs` is how long a `/usage` per-model poll stays fresh; `maxWaitMs` bounds the depleted-pool countdown - a soonest reset further out than this does not pause the session (no respawn marker is written and the session simply keeps hitting its limit until an account recovers); `checkIntervalMs` is the periodic check tick (default 60s), which `init` writes into the timer - re-run `tokenmaxxing init` after changing it so the timer unit picks up the new tick.
+`thresholds.session` and `thresholds.weekly` are the two bars, one number each (an array `thresholds.session`, the former ladder, fails config loading with a message naming the field); `projectionMargin` is a fixed safety margin subtracted from each threshold bar (effective bar = threshold - margin), so a large turn is less likely to blow past a bar between checks; `switchModels` names the models whose per-model cap triggers a switch; `usagePollTtlMs` is how long a `/usage` attempt stays fresh, for the live per-model poll and for the parked account each check tick samples; `maxWaitMs` bounds the depleted-pool countdown - a soonest reset further out than this does not pause the session (no respawn marker is written and the session simply keeps hitting its limit until an account recovers); `checkIntervalMs` is the periodic check tick (default 60s), which `init` writes into the timer - re-run `tokenmaxxing init` after changing it so the timer unit picks up the new tick.
 
 State lives entirely in `~/.config/tokenmaxxing/`. Per-account credentials follow the platform's Claude Code store: the login keychain on macOS (`tokenmaxxing-cred-<uuid8>` items, never plaintext on disk), 0600 files under `~/.config/tokenmaxxing/creds/` on Linux (the same plaintext model claude itself uses for `~/.claude/.credentials.json`).
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tokenmaxxing",
-  "version": "1.27.0",
+  "version": "1.28.0",
   "description": "Automatic Claude Code account switching: pool multiple accounts and hot-swap when quota fills, resuming your session on the fresh account.",
   "type": "module",
   "license": "MIT",

package/src/cli/check.ts

@@ -1,11 +1,15 @@
 import { evaluateAndMaybeSwap } from "../lib/decide.ts";
+import { sampleOldestParked } from "../lib/sample.ts";
+import { loadConfig } from "../lib/state.ts";
 import { log } from "../lib/log.ts";
 import { c, emitError, emitJson, fmtReset } from "./render.ts";
 
 export async function cmdCheck(json = false): Promise<number> {
+  const now = Date.now();
   let d;
   try {
-    d = await evaluateAndMaybeSwap(Date.now());
+    d = await evaluateAndMaybeSwap(now);
+    await sampleOldestParked(loadConfig());
   } catch (e) {
     const detail = e instanceof Error ? e.message : String(e);
     log("check.error", { err: detail });

package/src/cli/rm.ts

@@ -44,9 +44,11 @@ export async function cmdRm(selector?: string, json = false): Promise<number> {
       }
     }
     await deleteItem(parkedTarget(a.keychainItem));
-    const sampleDir = join(paths.sampleDir, credItemFor(a.accountUuid));
-    await deleteItem(isolatedTarget(sampleDir));
-    rmSync(sampleDir, { recursive: true, force: true });
+    const item = credItemFor(a.accountUuid);
+    for (const sampleDir of [join(paths.sampleDir, item), join(paths.sampleDir, `${item}-tick`)]) {
+      await deleteItem(isolatedTarget(sampleDir));
+      rmSync(sampleDir, { recursive: true, force: true });
+    }
     idx.accounts = idx.accounts.filter((x) => x.accountUuid !== a.accountUuid);
     saveAccounts(idx);
     if (json) emitJson({ ok: true, pool: "claude", removed: a.label, remaining: idx.accounts.length });

package/src/lib/decide.ts

@@ -4,9 +4,8 @@ import { withLock } from "./lock.ts";
 import { paths } from "./paths.ts";
 import { POST_SWAP_COOLDOWN_MS, loadAccounts, loadConfig, loadDepletedWait, loadLastSwapAt, loadUsage, loadUsageSnapshot, loadModelUsage, saveAccounts, saveDepletedWait, saveModelUsage, writeUsage } from "./state.ts";
 import { readOAuthAccount } from "./claudejson.ts";
-import { isSkippableSwapError, performSwap, type VerifyVerdict } from "./swap.ts";
-import { probeParkedUsage } from "./sample.ts";
-import { isExhausted, nextWeeklyReset, pickBest, pickEarliestReset, thresholdBars, usableAt, type PickCtx } from "./picker.ts";
+import { isSkippableSwapError, performSwap } from "./swap.ts";
+import { nextWeeklyReset, pickBest, pickEarliestReset, thresholdBars, usableAt } from "./picker.ts";
 import { familyTokens, gatedFamilies, probeUsage, type EnforcedClass } from "./usage.ts";
 import { log } from "./log.ts";
 import { AccountSchema, ModelUsageStateSchema, UsageStateSchema, type Account, type Config, type EnforcedLimit, type ModelUsageState, type Thresholds, type UsageState, type UsageWindow } from "./types.ts";
@@ -21,8 +20,6 @@ export type SwapDecision = z.infer<typeof SwapDecisionSchema>;
 
 const WEEK_MS = 7 * 24 * 60 * 60 * 1000;
 const FIVE_HOURS_MS = 5 * 60 * 60 * 1000;
-const VERIFY_PROBE_BUDGET = 2;
-const VERIFY_PROBE_KILL_MS = 12_000;
 
 function liveUsed(input: { window: UsageWindow; windowMs: number; sampledAt: number; now: number }): number {
   const { window: w, windowMs, sampledAt, now } = input;
@@ -186,53 +183,12 @@ export async function evaluateAndMaybeSwap(now = Date.now(), anticipatory = fals
       rejected.add(candidate.accountUuid);
       log("decide.candidate_rejected", { account: candidate.accountUuid.slice(0, 8), error: e instanceof Error ? e.message : String(e) });
     };
-    let probeBudget = VERIFY_PROBE_BUDGET;
-    const verified = async (candidate: Account, ctx: PickCtx): Promise<VerifyVerdict> => {
-      if (candidate.lastUsageAt != null && now - candidate.lastUsageAt <= cfg.policy.usagePollTtlMs) return "go";
-      const short = candidate.accountUuid.slice(0, 8);
-      const idx2 = loadAccounts();
-      const stored = idx2.accounts.find((a) => a.accountUuid === candidate.accountUuid);
-      if (!stored) return "go";
-      if (probeBudget <= 0) {
-        log("decide.verify_budget_spent", { account: short });
-        return "go";
-      }
-      probeBudget -= 1;
-      const sample = await probeParkedUsage(stored, { retries: 0, refreshParked: false, killMs: VERIFY_PROBE_KILL_MS, signal: AbortSignal.timeout(VERIFY_PROBE_KILL_MS) });
-      if (sample.ok) {
-        const at = Date.now();
-        stored.lastUsage = { fiveHour: sample.usage.session, sevenDay: sample.usage.weekAll };
-        stored.lastUsageAt = at;
-        if (Object.keys(sample.usage.perModel).length > 0) {
-          stored.lastPerModel = sample.usage.perModel;
-          stored.lastPerModelAt = at;
-        }
-      }
-      if (sample.ok || stored.needsReauth === true) saveAccounts(idx2);
-      if (stored.needsReauth === true) {
-        rejected.add(candidate.accountUuid);
-        log("decide.candidate_rejected", { account: short, error: "needs reauth" });
-        return "skip";
-      }
-      if (!sample.ok) {
-        log("decide.candidate_unverified", { account: short });
-        return "go";
-      }
-      log(isExhausted(stored, ctx) ? "decide.candidate_walled" : "decide.candidate_verified", {
-        account: short,
-        session: sample.usage.session.usedPercentage,
-        weekly: sample.usage.weekAll.usedPercentage,
-      });
-      return "rerank";
-    };
-
     while (true) {
       const cur = loadAccounts();
       const seat = seatOf(cur);
       const ctx = { now, thresholds: bars, currentAccountUuid: seat?.accountUuid ?? null, switchFamilies };
       const best = pickBest(usable(cur.accounts), ctx);
       if (!best) break;
-      if ((await verified(best, ctx)) !== "go") continue;
       try {
         await performSwap(best);
       } catch (e) {

package/src/lib/oauth.ts

@@ -40,7 +40,7 @@ export function isDeadCredential(creds: OAuthCreds): boolean {
   return creds.refreshToken === "" || creds.accessToken === "";
 }
 
-export async function refreshCredential(creds: OAuthCreds, now = Date.now()): Promise<OAuthCreds> {
+export async function refreshCredential(creds: OAuthCreds, now = Date.now(), signal?: AbortSignal): Promise<OAuthCreds> {
   if (isDeadCredential(creds)) throw new InvalidGrantError("credential was cleared after a failed refresh");
   const scope = (creds.scopes?.length ? creds.scopes : DEFAULT_SCOPES).join(" ");
   const body = {
@@ -55,6 +55,7 @@ export async function refreshCredential(creds: OAuthCreds, now = Date.now()): Pr
     res = await http.post(TOKEN_URL, {
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify(body),
+      signal,
     });
   } catch (e) {
     throw new Error(`token endpoint unreachable: ${e instanceof Error ? e.message : String(e)}`);

package/src/lib/sample.ts

@@ -1,15 +1,18 @@
 import { mkdirSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
+import { minBy } from "es-toolkit";
 import { z } from "zod";
 import { readItem, writeItem, deleteItem, liveTarget, parkedTarget, isolatedTarget, claudeAiOauthOnly, mergeIntoLive } from "./credstore.ts";
 import { credItemFor, paths } from "./paths.ts";
 import { withClaudeRefreshLock } from "./claudelock.ts";
+import { withLock } from "./lock.ts";
+import { readOAuthAccount } from "./claudejson.ts";
 import { refreshCredential, isAccessTokenExpiring, isDeadCredential, fetchTokenIdentity, describeIdentity, IdentityUnavailableError, InvalidGrantError } from "./oauth.ts";
 import { FullUsageSchema, probeUsage } from "./usage.ts";
-import { loadAccounts } from "./state.ts";
+import { POST_SWAP_COOLDOWN_MS, loadAccounts, loadLastSwapAt, saveAccounts } from "./state.ts";
 import { keepRotatedPair } from "./swap.ts";
 import { log } from "./log.ts";
-import { CredentialBlobSchema, TokenIdentitySchema, type Account, type OAuthCreds, type TokenIdentity } from "./types.ts";
+import { CredentialBlobSchema, TokenIdentitySchema, type Account, type Config, type OAuthCreds, type TokenIdentity } from "./types.ts";
 
 const SampleOutcomeSchema = z.discriminatedUnion("ok", [
   z.object({ ok: z.literal(true), usage: FullUsageSchema }),
@@ -44,10 +47,12 @@ function refreshPlanFields(account: Account, creds: OAuthCreds): void {
   if (creds.rateLimitTier != null) account.rateLimitTier = creds.rateLimitTier;
 }
 
-export async function probeParkedUsage(
-  account: Account,
-  opts: { retries?: number; refreshParked?: boolean; killMs?: number; signal?: AbortSignal } = {},
-): Promise<SampleOutcome> {
+const ProbeFailureSchema = z.object({ ok: z.literal(false), reason: z.string() });
+type ProbeFailure = z.infer<typeof ProbeFailureSchema>;
+const PreparedProbeSchema = z.discriminatedUnion("ok", [z.object({ ok: z.literal(true), dir: z.string(), installed: z.string() }), ProbeFailureSchema]);
+type PreparedProbe = z.infer<typeof PreparedProbeSchema>;
+
+async function prepareParkedProbe(account: Account, dir: string, signal?: AbortSignal): Promise<PreparedProbe> {
   const backup = parkedTarget(account.keychainItem);
   const parkedRaw = await readItem(backup);
   if (!parkedRaw) return { ok: false, reason: "no parked credential - run `tokenmaxxing auth`" };
@@ -62,13 +67,11 @@ export async function probeParkedUsage(
     account.needsReauth = true;
     return { ok: false, reason: "parked credential was cleared after a failed refresh - re-auth with `tokenmaxxing auth`" };
   }
-  if (opts.refreshParked === false && isAccessTokenExpiring(creds, 300_000)) {
-    return { ok: false, reason: "parked access token is near expiry - verification requires an unexpired token" };
-  }
 
   const liveRaw = await readItem(liveTarget());
   let liveAccount: string | null = null;
   let liveToken: string | null = null;
+  let liveRefresh: string | null = null;
   if (liveRaw != null) {
     let liveCreds: OAuthCreds;
     try {
@@ -78,8 +81,9 @@ export async function probeParkedUsage(
     }
     if (!isDeadCredential(liveCreds)) {
       liveToken = liveCreds.accessToken;
+      liveRefresh = liveCreds.refreshToken;
       try {
-        liveAccount = (await fetchTokenIdentity(liveCreds.accessToken, opts.signal)).accountUuid;
+        liveAccount = (await fetchTokenIdentity(liveCreds.accessToken, signal)).accountUuid;
       } catch (e) {
         return { ok: false, reason: `cannot verify the live credential's owner (${(e instanceof Error ? e.message : String(e)).slice(0, 80)}) - refusing to sample a possibly-live account` };
       }
@@ -98,10 +102,7 @@ export async function probeParkedUsage(
   };
 
   if (isAccessTokenExpiring(creds, 300_000)) {
-    if (opts.refreshParked === false) {
-      return { ok: false, reason: "parked access token is near expiry - verification requires an unexpired token" };
-    }
-    const owner = await checkIdentity(creds, account);
+    const owner = await checkIdentity(creds, account, signal);
     if (owner.status === "mismatch") {
       const kept = await relocate(owner.owner);
       account.needsReauth = true;
@@ -110,9 +111,9 @@ export async function probeParkedUsage(
     if (owner.status === "unavailable" && !owner.stale) {
       return { ok: false, reason: `${owner.reason} - refusing to refresh a parked credential whose owner cannot be verified` };
     }
-    const rotate = async (): Promise<{ fresh: OAuthCreds } | { failed: SampleOutcome }> => {
+    const rotate = async (): Promise<{ fresh: OAuthCreds } | { failed: ProbeFailure }> => {
       try {
-        return { fresh: await refreshCredential(creds) };
+        return { fresh: await refreshCredential(creds, Date.now(), signal) };
       } catch (e) {
         if (e instanceof InvalidGrantError) {
           account.needsReauth = true;
@@ -121,16 +122,24 @@ export async function probeParkedUsage(
         return { failed: { ok: false, reason: `token refresh failed: ${e instanceof Error ? e.message : String(e)}` } };
       }
     };
-    let result: { fresh: OAuthCreds } | { failed: SampleOutcome };
+    let result: { fresh: OAuthCreds } | { failed: ProbeFailure };
     if (owner.status === "match") {
       result = await rotate();
     } else {
+      if (liveRefresh != null && creds.refreshToken === liveRefresh) {
+        return { ok: false, reason: "this slot holds a copy of the LIVE login's grant - refusing to rotate it from a parked slot; run `tokenmaxxing switch` to reconcile" };
+      }
       try {
+        signal?.throwIfAborted();
         result = await withClaudeRefreshLock(async (lock) => {
           const rotated = await rotate();
           if ("failed" in rotated) return rotated;
-          const verified = await checkIdentity(rotated.fresh, account);
-          if (verified.status !== "mismatch") return rotated;
+          const verified = await checkIdentity(rotated.fresh, account, signal);
+          if (verified.status === "match") return rotated;
+          if (verified.status === "unavailable") {
+            await writeItem(backup, JSON.stringify({ claudeAiOauth: rotated.fresh }));
+            return { failed: { ok: false, reason: `${verified.reason} - the rotated pair stays in this slot unverified until the next pass` } };
+          }
           const trueOwner = loadAccounts().accounts.find((a) => a.accountUuid === verified.owner.accountUuid) ?? null;
           const kept = await keepRotatedPair({ fresh: rotated.fresh, owner: trueOwner, fallback: account, liveOwnerUuid: liveAccount, expectedLiveToken: liveToken, lock });
           account.needsReauth = true;
@@ -145,7 +154,7 @@ export async function probeParkedUsage(
     await writeItem(backup, JSON.stringify({ claudeAiOauth: creds }));
   }
 
-  const identity = await checkIdentity(creds, account, opts.signal);
+  const identity = await checkIdentity(creds, account, signal);
   if (identity.status === "mismatch") {
     const kept = await relocate(identity.owner);
     account.needsReauth = true;
@@ -156,27 +165,100 @@ export async function probeParkedUsage(
   }
   refreshPlanFields(account, creds);
 
-  const dir = join(paths.sampleDir, credItemFor(account.accountUuid));
   rmSync(dir, { recursive: true, force: true });
   mkdirSync(dir, { recursive: true });
-  const isoTarget = isolatedTarget(dir);
-  const installed = JSON.stringify({ claudeAiOauth: opts.refreshParked === false ? { ...creds, refreshToken: "" } : creds });
-
+  const installed = JSON.stringify({ claudeAiOauth: creds });
   try {
-    await writeItem(isoTarget, installed);
+    await writeItem(isolatedTarget(dir), installed);
     writeFileSync(join(dir, ".claude.json"), JSON.stringify({ oauthAccount: account.oauthAccount, hasCompletedOnboarding: true }));
-    const usage = await probeUsage(dir, Date.now(), opts);
-    return usage ? { ok: true, usage } : { ok: false, reason: "`/usage` returned no limit data (see log)" };
+  } catch (e) {
+    await finishParkedProbe(account, { dir, installed });
+    throw e;
+  }
+  return { ok: true, dir, installed };
+}
+
+async function runParkedProbe(dir: string, opts: { retries?: number }): Promise<SampleOutcome> {
+  const usage = await probeUsage(dir, Date.now(), { retries: opts.retries });
+  return usage ? { ok: true, usage } : { ok: false, reason: "`/usage` returned no limit data (see log)" };
+}
+
+async function finishParkedProbe(account: Account, prepared: { dir: string; installed: string }): Promise<void> {
+  const isoTarget = isolatedTarget(prepared.dir);
+  const backup = parkedTarget(account.keychainItem);
+  try {
+    const afterIso = await readItem(isoTarget);
+    if (afterIso && afterIso !== prepared.installed) {
+      const parkedNow = await readItem(backup);
+      const installedToken = CredentialBlobSchema.parse(JSON.parse(prepared.installed)).claudeAiOauth.accessToken;
+      const parkedToken = parkedNow == null ? null : CredentialBlobSchema.parse(JSON.parse(parkedNow)).claudeAiOauth.accessToken;
+      if (parkedToken === installedToken) await writeItem(backup, claudeAiOauthOnly(afterIso));
+      else log("sample.harvest_skipped", { account: account.accountUuid.slice(0, 8) });
+    }
   } finally {
-    try {
-      if (opts.refreshParked !== false) {
-        const afterIso = await readItem(isoTarget);
-        if (afterIso && afterIso !== installed) await writeItem(backup, claudeAiOauthOnly(afterIso));
-      }
-    } finally {
-      await deleteItem(isoTarget);
-      rmSync(dir, { recursive: true, force: true });
+    await deleteItem(isoTarget);
+    rmSync(prepared.dir, { recursive: true, force: true });
+  }
+}
+
+export async function probeParkedUsage(account: Account): Promise<SampleOutcome> {
+  const prepared = await prepareParkedProbe(account, join(paths.sampleDir, credItemFor(account.accountUuid)));
+  if (!prepared.ok) return prepared;
+  try {
+    return await runParkedProbe(prepared.dir, {});
+  } finally {
+    await finishParkedProbe(account, prepared);
+  }
+}
+
+const PREPARE_DEADLINE_MS = 20_000;
+
+export async function sampleOldestParked(cfg: Config): Promise<void> {
+  const reserved = await withLock(paths.lockFile, async () => {
+    const now = Date.now();
+    const lastSwapAt = loadLastSwapAt();
+    if (lastSwapAt != null && now - lastSwapAt < POST_SWAP_COOLDOWN_MS) return null;
+    const idx = loadAccounts();
+    const live = readOAuthAccount()?.accountUuid ?? null;
+    const sampledAt = (a: Account) => Math.max(a.lastUsageAt ?? 0, a.lastProbeAt ?? 0);
+    const stale = idx.accounts.filter((a) => a.accountUuid !== live && a.needsReauth !== true && now - sampledAt(a) > cfg.policy.usagePollTtlMs);
+    const target = minBy(stale, sampledAt);
+    if (!target) return null;
+    target.lastProbeAt = now;
+    const prepared = await prepareParkedProbe(target, join(paths.sampleDir, `${credItemFor(target.accountUuid)}-tick`), AbortSignal.timeout(PREPARE_DEADLINE_MS));
+    saveAccounts(idx);
+    if (!prepared.ok) {
+      log("sample.parked_failed", { account: target.accountUuid.slice(0, 8), reason: prepared.reason.slice(0, 200) });
+      return null;
     }
+    return { account: target, prepared };
+  });
+  if (!reserved) return;
+  const { account, prepared } = reserved;
+  const startedAt = Date.now();
+  let outcome: SampleOutcome | null = null;
+  try {
+    outcome = await runParkedProbe(prepared.dir, { retries: 0 });
+  } finally {
+    await withLock(paths.lockFile, async () => {
+      await finishParkedProbe(account, prepared);
+      if (outcome == null) return;
+      const idx = loadAccounts();
+      const stored = idx.accounts.find((a) => a.accountUuid === account.accountUuid);
+      if (stored && outcome.ok && (stored.lastUsageAt == null || startedAt > stored.lastUsageAt)) {
+        stored.lastUsage = { fiveHour: outcome.usage.session, sevenDay: outcome.usage.weekAll };
+        stored.lastUsageAt = startedAt;
+        if (Object.keys(outcome.usage.perModel).length > 0) {
+          stored.lastPerModel = outcome.usage.perModel;
+          stored.lastPerModelAt = startedAt;
+        }
+        saveAccounts(idx);
+      }
+      log(outcome.ok ? "sample.parked_ok" : "sample.parked_failed", {
+        account: account.accountUuid.slice(0, 8),
+        ...(outcome.ok ? {} : { reason: outcome.reason.slice(0, 200) }),
+      });
+    });
   }
 }
 

package/src/lib/swap.ts

@@ -1,4 +1,3 @@
-import { z } from "zod";
 import { clearDepletedWait, clearUsageSnapshots, loadAccounts, saveAccounts, saveLastSwapAt } from "./state.ts";
 import { readItem, writeItem, liveTarget, parkedTarget, claudeAiOauthOnly, mergeIntoLive } from "./credstore.ts";
 import { refreshCredential, isAccessTokenExpiring, isDeadCredential, fetchTokenIdentity, describeIdentity, IdentityUnavailableError, InvalidGrantError, RefreshRejectedError } from "./oauth.ts";
@@ -11,9 +10,6 @@ function parseBlob(raw: string) {
   return CredentialBlobSchema.parse(JSON.parse(raw));
 }
 
-const VerifyVerdictSchema = z.enum(["go", "rerank", "skip"]);
-export type VerifyVerdict = z.infer<typeof VerifyVerdictSchema>;
-
 export async function performSwap(target: Account): Promise<void> {
   const idx = loadAccounts();
 

package/src/lib/types.ts

@@ -68,6 +68,7 @@ export const AccountSchema = z.object({
   lastPerModel: z.record(z.string(), UsageWindowSchema).optional(),
   lastPerModelAt: z.number().optional(),
   lastUsageAt: z.number().optional(),
+  lastProbeAt: z.number().optional(),
   enforcedUntil: z.number().optional(),
   needsReauth: z.boolean().optional(),
   subscriptionType: z.string().optional(),

package/src/lib/usage.ts

@@ -280,17 +280,9 @@ const SpawnResultSchema = z.object({
 });
 type SpawnResult = z.infer<typeof SpawnResultSchema>;
 
-async function spawnClaudeBounded(
-  cmd: string[],
-  env: Record<string, string>,
-  killMs = PROBE_KILL_MS,
-  signal?: AbortSignal,
-): Promise<SpawnResult | null> {
-  signal?.throwIfAborted();
+async function spawnClaudeBounded(cmd: string[], env: Record<string, string>): Promise<SpawnResult | null> {
   const p = Bun.spawn(cmd, { env, stdout: "pipe", stderr: "pipe" });
-  const abort = () => p.kill("SIGKILL");
-  signal?.addEventListener("abort", abort, { once: true });
-  const killer = setTimeout(() => p.kill("SIGKILL"), killMs);
+  const killer = setTimeout(() => p.kill("SIGKILL"), PROBE_KILL_MS);
   try {
     const reads = Promise.all([new Response(p.stdout).text(), new Response(p.stderr).text()]);
     const settled = await Promise.race([
@@ -303,14 +295,13 @@ async function spawnClaudeBounded(
     return { exitCode: p.exitCode, stdout, stderr };
   } finally {
     clearTimeout(killer);
-    signal?.removeEventListener("abort", abort);
   }
 }
 
-async function probeUsageOnce(env: Record<string, string>, now: number, killMs: number, signal?: AbortSignal): Promise<FullUsage | null> {
+async function probeUsageOnce(env: Record<string, string>, now: number): Promise<FullUsage | null> {
   let out: string;
   try {
-    const r = await spawnClaudeBounded([resolveRealClaude(), "-p", "/usage", "--output-format", "json"], env, killMs, signal);
+    const r = await spawnClaudeBounded([resolveRealClaude(), "-p", "/usage", "--output-format", "json"], env);
     if (r === null) {
       log("usage.probe_failed", { err: "output pipes still open after child exit (leaked descendant)" });
       return null;
@@ -348,13 +339,13 @@ function probeEnv(configDir?: string): Record<string, string> {
   return env;
 }
 
-export async function probeUsage(configDir?: string, now = Date.now(), opts: { retries?: number; killMs?: number; signal?: AbortSignal } = {}): Promise<FullUsage | null> {
+export async function probeUsage(configDir?: string, now = Date.now(), opts: { retries?: number } = {}): Promise<FullUsage | null> {
   const env = probeEnv(configDir);
 
   for (let attempt = 0; ; attempt++) {
-    const full = await probeUsageOnce(env, now, opts.killMs ?? PROBE_KILL_MS, opts.signal);
+    const full = await probeUsageOnce(env, now);
     if (full) return full;
-    if (attempt >= (opts.retries ?? PROBE_RETRY_DELAYS_MS.length) || opts.signal?.aborted) {
+    if (attempt >= (opts.retries ?? PROBE_RETRY_DELAYS_MS.length)) {
       log("usage.probe_gave_up", { attempts: attempt + 1 });
       return null;
     }