tokenmaxxing 1.44.0 → 1.46.0

package/DESIGN.md

@@ -31,8 +31,9 @@ It is a process manager only - spawn with inherited stdio plus saved `stty -g` t
 - Five `~/.claude/settings.json` entries (merged - other settings keys are preserved, but the `statusLine` slot is taken over): the tokenmaxxing `statusLine` renderer (native since 2026-07-11; it also tees usage), a `subagentStatusLine` (per-subagent rows in the agents panel), a `Stop` hook, a `StopFailure` hook, a `SessionStart` hook.
 - **`~/.config/tokenmaxxing/`** - the single home for config and state:
   - `config.json` - SPARSE overrides only (thresholds.session/weekly, claudeBin/codexBin pins, policy.*); defaults apply at read time, `xx config` prints the path and the effective values, and edits happen in an editor.
-  - `accounts.json` - non-secret index `{id, label, email, tier, windows, lastUsageAt, lastProbeAt, enforcedUntil, needsReauth, oauthAccount}` (each cached window carries its name, duration, reset, and sample time; the same shape serves the Codex pool as `codex-accounts.json`). `activeId` is `null` for Claude: there is no pool-wide active account.
+  - `accounts.json` - non-secret index `{id, label, email, tier, windows, lastUsageAt, lastProbeAt, enforcedUntil, needsReauth, oauthAccount}` (each cached window carries its name, duration, reset, and sample time; the same shape serves the Codex pool as `codex-accounts.json`). `activeId` is `null` for both pools: there is no pool-wide active account.
   - `stores/<uuid8>/` - one Claude Code credential store per pooled account (see below).
+  - `codex-stores/<uuid8>/` - one Codex credential store per pooled account: its `auth.json`, with everything else symlinked to the shared `~/.codex` so sessions, history, and config stay shared and `codex resume` works across stores.
   - `usage/<uuid8>.json` - the statusline tee per account, written by the sessions running on it.
   - `live/<session-id>` - PID-validated presence per supervised session, naming its account; placement counts them.
   - `respawn/<session-id>` - per-session respawn markers (the hook→supervisor signal): the target account plus a `waitUntil`.
@@ -81,10 +82,10 @@ Each terminal ran the supervisor, so each has its own child `claude`, its own `-
 ## 5. Placement and rotation policy
 The [switching policy](docs/content/docs/switching.mdx) is one rule: under both bars, hold; at or over a bar, move to the usable account that ranks first; nothing usable, wait for the soonest reset. The same ranking places a session at launch.
 
-- Ranking (decided by consult for #79): greatest remaining headroom to the session bar divided by the number of sessions after placement, `(bar - used) / (sessions + 1)`, then highest weekly pace pressure (remaining weekly percent over time to the weekly reset), then soonest weekly reset, then lowest weekly usage; unknown usage ranks last. Organization membership is not an input. Codex keeps the pure pace ordering and excludes accounts running in another codex session, because a codex session cannot share a login.
+- Ranking (decided by consult for #79): greatest remaining headroom to the session bar divided by the number of sessions after placement, `(bar - used) / (sessions + 1)`, then highest weekly pace pressure (remaining weekly percent over time to the weekly reset), then soonest weekly reset, then lowest weekly usage; unknown usage ranks last. Organization membership is not an input. Codex keeps the pure pace ordering and excludes accounts running in another codex session, because codex has no cross-process refresh lock and two sessions must never share a login.
 - Selection reads the cached figures only, after folding every account's tee. Each periodic check tick samples the account whose last `/usage` attempt is oldest, skipping any attempted within `policy.usagePollTtlMs`, under that account's store, so every account is attempted about once per tick per pooled account, or once per `policy.usagePollTtlMs` plus a tick when that is longer, and its cached figure is as fresh as its last successful attempt or its sessions' latest push. The pool lock covers only the reservation and the result write, never the `/usage` child.
 - The depleted pause happens at the bar, not at 100; Codex has no pause and rides its account until the server refuses it, because a running sibling cannot adopt another account without restarting.
-- The Claude pool has no post-swap cooldown and no manual `switch`: a move is a respawn of one session under a fixed store, so nothing another session reads is invalidated by it, and placement at launch replaces the manual pick. Codex keeps both.
+- Neither pool has a post-swap cooldown or a manual `switch`: a move is a respawn of one session under a fixed store, so nothing another session reads is invalidated by it, and placement at launch replaces the manual pick.
 
 The [profile](docs/content/docs/switching-profile.mdx) records observed cache rewrites across swaps and does not infer subscription quota savings.
 
@@ -94,7 +95,7 @@ The [profile](docs/content/docs/switching-profile.mdx) records observed cache re
 
 ## 6. Honest papercuts
 - **A move restarts the process.** Every move is a `claude` stop and `--resume`; anything typed in the split second before the SIGTERM is lost, the supervisor resets terminal mode so nothing is left garbled, and the first turn on the new account re-uploads context once (prompt cache is org-scoped). A bar-triggered move compacts on the old account first so that upload is the summary, not the transcript; a move after a refusal cannot, and re-uploads the full context.
-- **Single-turn overshoot.** If one turn jumps from under the threshold straight past the wall, that turn ends rate-limited; the StopFailure hook walls the seat and moves the session, and the next prompt continues the conversation on the fresh account. Projected threshold reduces this.
+- **Single-turn overshoot.** If one turn jumps from under the threshold straight past the wall, that turn ends rate-limited; the StopFailure hook walls the seat and moves the session, and the next prompt continues the conversation on the fresh account. The static session-bar margin (`policy.projectionMargin`, default 3) reduces this.
 - **Unsupervised sessions are not moved.** A claude started outside the supervisor runs on whatever login its environment names, by default Claude Code's default store, which tokenmaxxing never writes.
 - **One shared identity file.** `~/.claude.json` keeps a single `oauthAccount`, which Claude Code rewrites after whichever session refreshed last, so `/status` can show another session's email. The store decides which credential a session uses.
 - **Dead stores.** A refresh Claude Code cannot complete dead-clears the store; the sampler and the decision recognize the empty tokens without a request, flag the account, and `auth` repairs it in place.
@@ -113,7 +114,7 @@ The [profile](docs/content/docs/switching-profile.mdx) records observed cache re
 
 **Removed (1.37.0, issue #79):** the shared live credential and everything that served it: the swap-time harvest, park, and install, tokenmaxxing's own OAuth refresh grant and its interlock with Claude Code's refresh lock, the `~/.claude.json` `oauthAccount` rewrite, the 45-second post-swap cooldown, the pool-wide depleted-wait record, the parked-credential slots (`creds/`, `tokenmaxxing-cred-*`), the ambient `CLAUDE_CONFIG_DIR` refusal, and manual `switch` for the Claude pool.
 
-**Shipped since (0.13.0):** Codex as a second pool with its own state (`codex-accounts.json`, `codex-creds/`, own flock). Since 1.35.0 the engine is one: a generic account record (`id`, `label`, `email`, `tier`, `windows`), one picker, one decision, and one set of account commands run against a `Provider` (`src/lib/provider.ts`); `src/lib/claude.ts` and `src/lib/codex.ts` hold only what differs per product (credential store, identity, usage source, presence, login and install flows), and the provider's `seats` capability (`shared` for Claude, `live` for Codex) is how the engine knows whether present accounts remain candidates and whether a move needs the caller's respawn. Codex differences that shaped it: restart IS the switch (a running codex refuses another account's credential), one live `auth.json` for every codex session, usage is a free direct GET with epoch resets and a duration-classified window set (the weekly window is primary on current plans), the refresh token rotates with reuse punished (harvest-by-true-owner, persist every rotation), and codex's Stop-hook system drives the auto-swap through a codex supervisor shim that respawns `codex resume <session-id>` (hooks must be trusted once via `/hooks`). Sibling sessions left on ANY non-live account are reconciled cross-session (owner decisions 2026-07-20): the deciding actor drops a reconcile marker addressed to the sibling's supervisor, and the sibling's own Stop hook promotes it into a respawn onto the live account at its next turn boundary - the only safe respawn point - while a blocked live seat never receives a signal.
+**Shipped since (0.13.0):** Codex as a second pool with its own state (`codex-accounts.json`, per-account `codex-stores/`, own flock). Since 1.35.0 the engine is one: a generic account record (`id`, `label`, `email`, `tier`, `windows`), one picker, one decision, and one set of account commands run against a `Provider` (`src/lib/provider.ts`); `src/lib/claude.ts` and `src/lib/codex.ts` hold only what differs per product (credential store, identity, usage source, presence, login and install flows), and the provider's `seats` capability (`shared` for Claude, `live` for Codex) is how the engine knows whether present accounts stay candidates and whether a move needs the caller's respawn. Codex differences that shaped it: restart IS the switch (a running codex refuses another account's credential), one store per pooled account with `CODEX_HOME` set per session (everything but `auth.json` symlinked to the shared home, so resume works across stores), usage is a free direct GET with epoch resets and a duration-classified window set (the weekly window is primary on current plans), the refresh token rotates with reuse punished (persisted into the account's own store the instant it returns, never refreshed for an account running in another session), and the codex Stop hook drives the auto-switch through a codex supervisor shim that respawns `codex resume <session-id>` under the target's store (hooks must be trusted once via `/hooks`).
 
 **Shipped since (1.29.0):** a Cursor Cloud relay. A cloud VM has no keychain, no pool state, and no supervisor, so the path uses what it does have (environment variables, a shell, repo files) and a different credential primitive, one-year inference-only setup tokens, minted once per pooled account by `tokenmaxxing setup-token` on the owner's machine and carried to the VM as one user-scoped Runtime Secret (`TOKENMAXXING_TOKENS`). `tokenmaxxing cursor init` writes a `claude` project subagent (`.cursor/agents/claude.md`) that forwards each task to `tokenmaxxing cloud run`, which spawns `claude -p --dangerously-skip-permissions --output-format json` under `CLAUDE_CODE_OAUTH_TOKEN` and pins the thread to that token (the API caches by exact prefix, so a rotation busts one thread, not all). A setup token carries no usage signal, so rotation is reactive. A run whose transcript gained a non-transient rate-limit row during that run (the structured row the StopFailure hook reads) walls the label until the reset the row names (five hours without one) and resumes the same session on the next token; the result's `api_error_status` alone never walls, so a transient 429 or an older row from a previous token does not cascade across the pool. The local switching engine never reads a setup token; `/usage` prints no percentages under one. Details in [Cursor Cloud](docs/content/docs/cursor-cloud.mdx).
 

package/README.md

@@ -63,11 +63,10 @@ claude                  # use claude as always; each session gets its own accoun
 | command | what it does |
 |---|---|
 | `tokenmaxxing init` | log the first account in (isolated) + install supervisor & hooks |
-| `tokenmaxxing init --codex` | same for codex: import login, install codex supervisor + Stop hook |
+| `tokenmaxxing init --codex` | same for codex: log in the first account (isolated), install codex supervisor + Stop hook |
 | `tokenmaxxing add` | register an additional account (isolated login, harvested once into its own store) |
 | `tokenmaxxing add --codex` | register an additional codex account (isolated login) |
 | `tokenmaxxing auth [--codex] [sel \| --all]` | reauthenticate a pooled account in place: bare lists the pool (emails shown) and asks which; a selector targets one account and tells you the email to sign in with; `--all` walks every account that is flagged or has no usable credential in its store, one by one; `--codex` does the same for the codex pool |
-| `tokenmaxxing switch --codex [sel]` | switch the codex pool (takes effect on the next codex start); the claude pool has no manual switch, each session is placed at launch |
 | `tokenmaxxing status [--cached]` | accounts with 5h / weekly usage bars, live session counts, exhausted-until-reset; `--cached` renders the stored figures without sampling |
 | `tokenmaxxing config` | the config path and the effective values; edit the file in an editor, a bad value fails the next load with the field name |
 | `tokenmaxxing doctor` | verify the supervisor + settings entries survived and every store holds its account's credential |
@@ -76,7 +75,7 @@ claude                  # use claude as always; each session gets its own accoun
 | `tokenmaxxing setup-token [--print \| rm <label\|uuid>]` | Cursor Cloud only: mint one `claude setup-token` per pooled account (a browser sign-in each) and print the `TOKENMAXXING_TOKENS` secret value; `--print` prints the stored set, `rm` drops one |
 | `tokenmaxxing cursor init [dir]` | write the Claude relay subagent and `.cursor/environment.json` into a repo |
 | `tokenmaxxing cloud run [--session <id>] [--max-turns <n>] "<prompt>"` | on a Cursor Cloud VM: run `claude -p` on a setup token, rotate to the next token on a usage limit |
-| `--json` | machine-readable output: one JSON document on stdout for `status`, `config`, `check`, and `switch` (`ok` mirrors the exit code, failures add `error`) |
+| `--json` | machine-readable output: one JSON document on stdout for `status`, `config`, and `check` (`ok` mirrors the exit code, failures add `error`) |
 
 ## How switching decides
 
@@ -102,7 +101,7 @@ See [How switching decides](docs/content/docs/switching.mdx) for the policy and
 {
   "thresholds": { "session": 90, "weekly": 98 },
   "policy": {
-    "projectionMargin": 0,
+    "projectionMargin": 3,
     "switchModels": ["fable"],
     "usagePollTtlMs": 90000,
     "checkIntervalMs": 60000
@@ -110,7 +109,7 @@ See [How switching decides](docs/content/docs/switching.mdx) for the policy and
 }
 ```
 
-`thresholds.session` and `thresholds.weekly` are the two bars, one number each (an array `thresholds.session`, the former ladder, fails config loading with a message naming the field); `projectionMargin` is a fixed safety margin subtracted from each threshold bar (effective bar = threshold - margin), so a large turn is less likely to blow past a bar between checks; `switchModels` names the models whose per-model cap triggers a move; `usagePollTtlMs` is how long a `/usage` attempt stays fresh, for a seat's per-model poll and for the account each check tick samples; `maxWaitMs` bounds the depleted-pool countdown - a soonest reset further out than this does not pause the session (no respawn marker is written and the session simply keeps hitting its limit until an account recovers); `checkIntervalMs` is the periodic check tick (default 60s), which `init` writes into the timer - re-run `tokenmaxxing init` after changing it so the timer unit picks up the new tick.
+`thresholds.session` and `thresholds.weekly` are the two bars, one number each (an array `thresholds.session`, the former ladder, fails config loading with a message naming the field); `projectionMargin` is a fixed safety margin subtracted from the session bar only (default 3), so a large turn is less likely to blow past the 5-hour bar between checks; the weekly bar takes no margin because one turn cannot overshoot a week; `switchModels` names the models whose per-model cap triggers a move; `usagePollTtlMs` is how long a `/usage` attempt stays fresh, for a seat's per-model poll and for the account each check tick samples; `maxWaitMs` bounds the depleted-pool countdown - a soonest reset further out than this does not pause the session (no respawn marker is written and the session simply keeps hitting its limit until an account recovers); `checkIntervalMs` is the periodic check tick (default 60s), which `init` writes into the timer - re-run `tokenmaxxing init` after changing it so the timer unit picks up the new tick.
 
 State lives entirely in `~/.config/tokenmaxxing/`. Each account's credential store is `stores/<uuid8>/`, which Claude Code reads and refreshes as its own: on macOS the credential is a login-keychain item keyed by the store path (never plaintext on disk), on Linux a 0600 `.credentials.json` inside the store (the same plaintext model claude itself uses for `~/.claude/.credentials.json`).
 
@@ -119,12 +118,12 @@ State lives entirely in `~/.config/tokenmaxxing/`. Each account's credential sto
 The same pooling works for OpenAI's Codex CLI (your own ChatGPT-subscription accounts):
 
 ```sh
-tokenmaxxing init --codex   # import your current codex login + install the codex supervisor & Stop hook
+tokenmaxxing init --codex   # log in the first account, isolated + install the codex supervisor & Stop hook
 tokenmaxxing add --codex    # log in another account, isolated - your primary login is untouched
 codex                       # use codex as always
 ```
 
-Codex mechanics differ from Claude Code in one hard way: a running codex process refuses a credential swapped to a different account, and codex has no per-session credential store, so **a restart is the switch** and every codex session shares one live login. The installed Stop hook runs the same pace-pressure decision at each turn boundary (usage read free from codex's own rate-limit endpoint: percentages plus absolute reset times, weekly aggregate and per-model caps alike); when it swaps, the supervisor relaunches `codex resume <session-id>` on the fresh account with the transcript intact. `tokenmaxxing switch --codex [sel]` does it manually, `status` (and `status --cached`) shows both pools.
+Codex mechanics differ from Claude Code in one hard way: a running codex process refuses a credential swapped to a different account, so **a restart is the switch**. Each codex session runs on its own account's store (`codex-stores/<uuid8>/`, only `auth.json` per account, everything else shared with `~/.codex` so resume works across stores). The installed Stop hook runs the same pace-pressure decision at each turn boundary (usage read free from codex's own rate-limit endpoint: percentages plus absolute reset times, weekly aggregate and per-model caps alike); when it moves, the supervisor relaunches `codex resume <session-id>` under the target's store with the transcript intact. `status` (and `status --cached`) shows both pools.
 
 Two codex-specific facts worth knowing: codex does not run hooks it has not been told to trust, so after `init --codex` you must open codex once and trust the tokenmaxxing Stop hook via `/hooks` (auto-switching is inert until then); and codex has no cross-process lock on `auth.json`, so tokenmaxxing serializes all of its own credential writes behind its own lock and swaps only at idle turn boundaries.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tokenmaxxing",
-  "version": "1.44.0",
+  "version": "1.46.0",
   "description": "Automatic Claude Code account switching: pool multiple accounts, start each session on its own account, and resume a session on a fresher account when quota fills.",
   "type": "module",
   "license": "MIT",

package/src/cli/auth.ts

@@ -100,7 +100,7 @@ async function reauthOne(p: Provider, target: Account): Promise<boolean> {
   const note = harvested.sample ? usageNote(result.account) : "";
   console.log(`${c.green("✓")} reauthed ${c.bold(result.account.email ?? result.account.label)} (${result.account.tier ?? "?"})${note}`);
   if (result.isActive) {
-    console.log(c.dim("this account is the active one: the fresh credential is parked as its backup; the live session keeps its current token until the next swap."));
+    console.log(c.dim("this account has a running session: it keeps its current login until it respawns."));
   }
   return true;
 }

package/src/cli/doctor.ts

@@ -1,10 +1,11 @@
 import { existsSync, readFileSync } from "node:fs";
 import { verifyRealClaude } from "../lib/claudebin.ts";
 import { checkSettings, installedBin } from "../lib/settings.ts";
-import { checkTimerHealthy, findClaudeShadowers, isBinDirAhead, shellRcPath, timerActivationHint } from "../lib/install.ts";
-import { claudePool, paths } from "../lib/paths.ts";
+import { checkTimerHealthy, codexStoreHookTrust, findClaudeShadowers, isBinDirAhead, shellRcPath, timerActivationHint } from "../lib/install.ts";
+import { claudePool, codexPool, paths } from "../lib/paths.ts";
 import { loadAccounts, loadConfig } from "../lib/state.ts";
 import { readStore } from "../lib/credstore.ts";
+import { codexIdentityOf, readCodexStoreAuth } from "../lib/codexauth.ts";
 import { isAccessTokenExpiring, isDeadCredential, fetchTokenIdentity, describeIdentity } from "../lib/oauth.ts";
 import { SETUP_TOKEN_STALE_MS, loadSetupTokens } from "../lib/setuptokens.ts";
 import { c, fmtAgo } from "./render.ts";
@@ -57,6 +58,36 @@ export async function cmdDoctor(): Promise<number> {
     if (a.needsReauth) check(false, `${a.label} needs re-auth`, `run \`tokenmaxxing auth ${a.label}\` to re-login`);
   }
 
+  const cidx = loadAccounts(codexPool);
+  if (cidx.accounts.length === 0) {
+    note("no codex accounts in the pool (run `tokenmaxxing init --codex` to pool codex too)");
+  }
+  for (const a of cidx.accounts) {
+    let auth = null;
+    let authErr: string | null = null;
+    try {
+      auth = readCodexStoreAuth(a.id);
+    } catch (e) {
+      authErr = (e instanceof Error ? e.message : String(e)).slice(0, 100);
+    }
+    check(auth != null, `codex store credential present for ${a.label}`, authErr ?? `run \`tokenmaxxing auth --codex ${a.label}\``);
+    if (auth) {
+      let match = false;
+      let matchHint = `run \`tokenmaxxing auth --codex ${a.label}\``;
+      try {
+        match = codexIdentityOf({ auth }).accountId === a.id;
+        if (!match) matchHint = `store credential belongs to another account - ${matchHint}`;
+      } catch (e) {
+        matchHint = (e instanceof Error ? e.message : String(e)).slice(0, 100);
+      }
+      check(match, `codex store credential identity matches ${a.label}`, matchHint);
+    }
+    if (a.needsReauth) check(false, `${a.label} (codex) needs re-auth`, `run \`tokenmaxxing auth --codex ${a.label}\` to re-login`);
+    const trust = codexStoreHookTrust(a.id);
+    if (trust === "untrusted") warn(`${a.label} (codex): Stop hook not trusted for this seat - open a supervised codex session on it, run /hooks, and trust it, or auto-switching stays inert there`);
+    else if (trust === "unknown") note(`${a.label} (codex): hook trust unknown (no hooks.json or config.toml yet - launch a supervised session once, then trust via /hooks)`);
+  }
+
   if (existsSync(paths.setupTokensJson)) {
     const setupTokens = loadSetupTokens().tokens;
     for (const a of idx.accounts) {

package/src/cli/init.ts

@@ -15,7 +15,6 @@ export function printUsage(p: Provider): void {
   }
   console.log(`    ${c.cyan("xx")}                 show the pool with usage bars (same as ${c.cyan("xx status")})`);
   console.log(`    ${c.cyan(`xx add${p.flag}`)}             log in and pool another account`);
-  console.log(`    ${c.cyan(`xx switch${p.flag}`)}          hop to the best account right now (the automatic switching needs no command)`);
   console.log(`    ${c.cyan("xx help")}            everything else`);
 }
 
@@ -27,9 +26,7 @@ export async function cmdInit(p: Provider): Promise<number> {
   const existing = loadAccounts(p.pool);
   if (existing.accounts.length > 0) {
     p.install();
-    const active = existing.accounts.find((a) => a.id === existing.activeId);
     console.log(`${c.green("✓")} re-installed (pool already has ${count({ n: existing.accounts.length, noun: "account" })} - not re-importing)`);
-    if (active && p.seats === "live") console.log(`  active: ${c.bold(active.label)}`);
     printUsage(p);
     return 0;
   }
@@ -41,7 +38,7 @@ export async function cmdInit(p: Provider): Promise<number> {
     await harvested.park();
     const idx = loadAccounts(p.pool);
     const imported = upsertAccount(idx, harvested, p.mergeWindows);
-    idx.activeId = !p.statusOnly && p.seats === "live" ? harvested.id : null;
+    idx.activeId = null;
     saveAccounts(p.pool, idx);
     return imported;
   });

package/src/entries/codexstophook.ts

@@ -1,93 +1,26 @@
 import { join } from "node:path";
-import { existsSync, mkdirSync, readFileSync, rmSync } from "node:fs";
+import { mkdirSync } from "node:fs";
 import { z } from "zod";
-import { codexPaths, codexPool } from "../lib/paths.ts";
-import { withLock } from "../lib/lock.ts";
+import { codexPaths } from "../lib/paths.ts";
 import { writeFileAtomic } from "../lib/atomic.ts";
 import { MAX_WRAP_DEPTH, WRAP_DEPTH_ENV } from "../lib/claudebin.ts";
-import { codex, codexPickCtx, reconcileSiblings } from "../lib/codex.ts";
-import { liveCodexAccountId } from "../lib/codexauth.ts";
+import { codex, codexPickCtx } from "../lib/codex.ts";
 import { resolveRealCodex } from "../lib/codexbin.ts";
 import { compactCodexThread } from "../lib/compact.ts";
 import { evaluateAndMaybeSwap } from "../lib/decide.ts";
 import { isExhausted } from "../lib/picker.ts";
-import { livingPresences } from "../lib/presence.ts";
-import { POST_SWAP_COOLDOWN_MS, loadAccounts, loadConfig, loadLastSwapAt } from "../lib/state.ts";
+import { loadAccounts, loadConfig } from "../lib/state.ts";
 import { CODEX_SUPERVISOR_ID_ENV } from "./codexsupervisor.ts";
-import { CodexReconcileMarkerSchema, CodexRespawnMarkerSchema, CodexStopStdinSchema, JsonTextSchema } from "../lib/types.ts";
+import { CodexRespawnMarkerSchema, CodexStopStdinSchema, JsonTextSchema } from "../lib/types.ts";
 import { log } from "../lib/log.ts";
 
 const SupervisorIdSchema = z.string().min(1).optional().catch(undefined);
 
-async function promoteReconcile(input: { supervisorId: string; sessionId: string | null }): Promise<boolean> {
-  const markerPath = join(codexPaths.reconcileDir, input.supervisorId);
-  if (!existsSync(markerPath)) return false;
-  return withLock(codexPool.lockFile, async () => promoteReconcileLocked(input));
-}
-
-function promoteReconcileLocked(input: { supervisorId: string; sessionId: string | null }): boolean {
-  const markerPath = join(codexPaths.reconcileDir, input.supervisorId);
-  if (!existsSync(markerPath)) return false;
-  const parsed = CodexReconcileMarkerSchema.safeParse((() => {
-    try {
-      return JSON.parse(readFileSync(markerPath, "utf8"));
-    } catch {
-      return null;
-    }
-  })());
-  if (!parsed.success) {
-    rmSync(markerPath, { force: true });
-    log("codexstop.reconcile_unparsable", {});
-    return false;
-  }
-  const presence = livingPresences(codexPaths.presenceDir).find((p) => p.id === input.supervisorId) ?? null;
-  if (presence == null || presence.accountId !== parsed.data.accountId) {
-    rmSync(markerPath, { force: true });
-    log("codexstop.reconcile_stale", {});
-    return false;
-  }
-  const liveId = liveCodexAccountId();
-  if (liveId == null || liveId === presence.accountId) {
-    rmSync(markerPath, { force: true });
-    log("codexstop.reconcile_moot", {});
-    return false;
-  }
-  const now = Date.now();
-  const liveAccount = loadAccounts(codexPool).accounts.find((a) => a.id === liveId);
-  if (!liveAccount || liveAccount.needsReauth === true || isExhausted(liveAccount, codexPickCtx(now, liveId))) {
-    rmSync(markerPath, { force: true });
-    log("codexstop.reconcile_blocked_target", {});
-    return false;
-  }
-  if (input.sessionId == null || input.sessionId.trim() === "") {
-    log("codexstop.reconcile_no_session", {});
-    return false;
-  }
-  mkdirSync(codexPaths.respawnDir, { recursive: true });
-  writeFileAtomic(
-    join(codexPaths.respawnDir, input.supervisorId),
-    JSON.stringify(CodexRespawnMarkerSchema.parse({ account: liveAccount.label, sessionId: input.sessionId, ts: now })),
-  );
-  rmSync(markerPath, { force: true });
-  log("codexstop.reconcile_respawn", { supervisorId: input.supervisorId.slice(0, 8), account: liveId.slice(0, 8) });
-  return true;
-}
-
-async function sweepSiblings(now: number): Promise<void> {
-  try {
-    await withLock(codexPool.lockFile, () => reconcileSiblings(now));
-  } catch (e) {
-    log("codexstop.resweep_failed", { err: e instanceof Error ? e.message : String(e) });
-  }
-}
-
 async function compactBeforeMove(input: { sessionId: string | null; now: number }): Promise<void> {
   const { sessionId, now } = input;
   if (sessionId == null || sessionId.trim() === "") return;
-  const lastSwapAt = loadLastSwapAt(codexPool);
-  if (lastSwapAt != null && now - lastSwapAt < POST_SWAP_COOLDOWN_MS) return;
   const liveId = codex.liveId();
-  const live = loadAccounts(codexPool).accounts.find((a) => a.id === liveId);
+  const live = liveId == null ? undefined : loadAccounts(codex.pool).accounts.find((a) => a.id === liveId);
   if (!live || live.needsReauth === true || (live.enforcedUntil != null && live.enforcedUntil > now)) return;
   const observed = await codex.observeLive(live, loadConfig(), now, { probe: true });
   if (!observed || !isExhausted({ ...live, windows: observed.windows }, codexPickCtx(now, live.id))) return;
@@ -113,16 +46,13 @@ export async function handleCodexStop(input: { rawStdin: string }): Promise<void
       log("codexstop.unsupervised_skip", {});
       return;
     }
-    if (await promoteReconcile({ supervisorId, sessionId })) return;
     const now = Date.now();
-    await withLock(codexPool.lockFile, () => reconcileSiblings(now));
     await compactBeforeMove({ sessionId, now });
     const decision = await evaluateAndMaybeSwap(codex, now);
     if (decision.swapped && decision.account) {
-      await sweepSiblings(now);
       mkdirSync(codexPaths.respawnDir, { recursive: true });
       const payload = CodexRespawnMarkerSchema.parse({
-        account: decision.account.label,
+        accountId: decision.account.id,
         sessionId,
         ts: Date.now(),
       });
@@ -130,7 +60,6 @@ export async function handleCodexStop(input: { rawStdin: string }): Promise<void
       log("codexstop.marker", { supervisorId: supervisorId.slice(0, 8) });
       return;
     }
-    await promoteReconcile({ supervisorId, sessionId });
   } catch (e) {
     log("codexstop.error", { err: e instanceof Error ? e.message : String(e) });
   }

package/src/entries/codexsupervisor.ts

@@ -5,9 +5,11 @@ import { codexPaths, codexPool, paths } from "../lib/paths.ts";
 import { withLock } from "../lib/lock.ts";
 import { LOOP_DIAGNOSIS, MAX_WRAP_DEPTH, UNMANAGED_ENV, WRAP_DEPTH_ENV, WRAP_RATE_MAX, WRAP_RATE_WINDOW_MS, wrapDepth, wrapperEntryRateTripped } from "../lib/claudebin.ts";
 import { resolveRealCodex } from "../lib/codexbin.ts";
+import { ensureCodexStoreHome } from "../lib/codexauth.ts";
+import { pickCodexSeat } from "../lib/codex.ts";
 import { clearPresence, writePresence } from "../lib/presence.ts";
-import { liveCodexAccountId } from "../lib/codexauth.ts";
 import { saveTermios, restoreTermios } from "../lib/tty.ts";
+import { loadAccounts } from "../lib/state.ts";
 import { CodexRespawnMarkerSchema } from "../lib/types.ts";
 import { log } from "../lib/log.ts";
 
@@ -27,7 +29,7 @@ function readCodexMarker(marker: string): z.infer<typeof CodexRespawnMarkerSchem
   } catch (e) {
     log("codexsupervisor.marker_invalid", { err: e instanceof Error ? e.message : String(e) });
     throw new Error(
-      `${marker} is corrupt (unparsable JSON or off-schema) - auth.json may already hold another account, so the codex session was stopped instead of resumed on stale credentials; inspect and remove the marker, then run \`codex resume\``,
+      `${marker} is corrupt (unparsable JSON or off-schema) - the codex session was stopped instead of resumed on a stale target; inspect and remove the marker, then run \`codex resume\``,
     );
   }
 }
@@ -52,6 +54,25 @@ export function shouldManageCodex(input: { argv: string[] }): boolean {
   return firstPositional === null || !NONINTERACTIVE_SUBCMDS.has(firstPositional);
 }
 
+async function recordCodexPresence(child: { pid: number; exitCode: number | null; signalCode: string | null; kill: () => void; exited: Promise<unknown> }, supervisorId: string, seat: { id: string }, savedTermios: string | null): Promise<void> {
+  for (let attempt = 0; ; attempt++) {
+    try {
+      writePresence({ dir: codexPaths.presenceDir, id: supervisorId, accountId: seat.id, pid: child.pid });
+      return;
+    } catch (e) {
+      if (child.exitCode !== null || child.signalCode !== null) return;
+      if (attempt >= 9) {
+        log("codexsupervisor.presence_failed", { err: e instanceof Error ? e.message : String(e) });
+        child.kill();
+        await child.exited;
+        restoreTermios(savedTermios);
+        throw new Error("could not write the codex presence file - refusing to run an unprotected session (its account would look like a swap target)");
+      }
+      await Bun.sleep(100);
+    }
+  }
+}
+
 export async function runCodexSupervisor(input: { argv: string[] }): Promise<number> {
   const { argv } = input;
   const depth = wrapDepth();
@@ -91,37 +112,27 @@ export async function runCodexSupervisor(input: { argv: string[] }): Promise<num
 
   let launchArgs = argv;
   let respawns = 0;
+  let wanted: string | null = null;
   while (true) {
     if (existsSync(marker)) rmSync(marker, { force: true });
-    log("codexsupervisor.launch", { supervisorId: supervisorId.slice(0, 8), respawns, args: launchArgs.join(" ") });
 
-    const child = await withLock(codexPool.lockFile, async () => {
-      const spawnAccountId = liveCodexAccountId();
+    const launchedAt = Date.now();
+    const { child } = await withLock(codexPool.lockFile, async () => {
+      const picked = (wanted == null ? null : (loadAccounts(codexPool).accounts.find((a) => a.id === wanted) ?? null)) ?? pickCodexSeat(launchedAt, wanted);
+      log("codexsupervisor.launch", { supervisorId: supervisorId.slice(0, 8), respawns, seat: picked?.id.slice(0, 8) ?? null, args: launchArgs.join(" ") });
+      const store = picked ? ensureCodexStoreHome(picked.id) : undefined;
       const spawned = Bun.spawn([real, ...launchArgs], {
         stdin: "inherit",
         stdout: "inherit",
         stderr: "inherit",
-        env: { ...childEnv, [CODEX_SUPERVISOR_ID_ENV]: supervisorId },
+        env: {
+          ...childEnv,
+          [CODEX_SUPERVISOR_ID_ENV]: supervisorId,
+          ...(store ? { CODEX_HOME: store } : {}),
+        },
       });
-      if (spawnAccountId) {
-        for (let attempt = 0; attempt < 10; attempt++) {
-          try {
-            writePresence({ dir: codexPaths.presenceDir, id: supervisorId, accountId: spawnAccountId, pid: spawned.pid });
-            break;
-          } catch (e) {
-            if (spawned.exitCode !== null || spawned.signalCode !== null) break;
-            if (attempt === 9) {
-              log("codexsupervisor.presence_failed", { err: e instanceof Error ? e.message : String(e) });
-              spawned.kill();
-              await spawned.exited;
-              restoreTermios(savedTermios);
-              throw new Error("could not write the codex presence file - refusing to run an unprotected session (its account would look like a swap target)");
-            }
-            await Bun.sleep(100);
-          }
-        }
-      }
-      return spawned;
+      if (picked) await recordCodexPresence(spawned, supervisorId, picked, savedTermios);
+      return { child: spawned, seat: picked };
     });
 
     let done = false;
@@ -156,12 +167,13 @@ export async function runCodexSupervisor(input: { argv: string[] }): Promise<num
     if (payload) {
       rmSync(marker, { force: true });
       respawns++;
-      process.stdout.write(`\n\x1b[36m↻ tokenmaxxing: switched codex to ${payload.account} - resuming...\x1b[0m\n`);
+      const label = loadAccounts(codexPool).accounts.find((a) => a.id === payload.accountId)?.label ?? payload.accountId.slice(0, 8);
+      process.stdout.write(`\n\x1b[36m↻ tokenmaxxing: switched codex to ${label} - resuming...\x1b[0m\n`);
+      wanted = payload.accountId;
       launchArgs = payload.sessionId ? ["resume", payload.sessionId] : ["resume", "--last"];
       continue;
     }
     clearPresence({ dir: codexPaths.presenceDir, id: supervisorId });
-    rmSync(join(codexPaths.reconcileDir, supervisorId), { force: true });
     log("codexsupervisor.exit", { supervisorId: supervisorId.slice(0, 8), respawns, code: child.exitCode, signal: child.signalCode });
     return child.exitCode ?? (child.signalCode ? 1 : 0);
   }

package/src/lib/codex.ts

@@ -1,23 +1,38 @@
-import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, rmSync } from "node:fs";
 import { join } from "node:path";
 import { writeFileAtomic } from "./atomic.ts";
 import { MAX_WRAP_DEPTH, WRAP_DEPTH_ENV } from "./claudebin.ts";
-import { codexIdentityOf, deleteParkedCodexAuth, isCodexAccessExpiring, liveCodexAccountId, readCodexAuthAt, readLiveCodexAuth, readParkedCodexAuth, writeLiveCodexAuth, writeParkedCodexAuth } from "./codexauth.ts";
+import { codexIdentityOf, deleteCodexStoreAuth, isCodexAccessExpiring, readCodexAuthAt, readCodexStoreAuth, writeCodexStoreAuth } from "./codexauth.ts";
 import { resolveRealCodex, verifyRealCodex } from "./codexbin.ts";
 import { CodexInvalidGrantError, CodexRefreshFailedError, refreshCodexAuth } from "./codexoauth.ts";
-import { livingPresences, seatCounts } from "./presence.ts";
+import { seatCounts } from "./presence.ts";
 import { CodexUsageReadError, codexLimitLabel, fetchCodexUsage } from "./codexusage.ts";
 import { codexSupervisorLink, ensurePathInRc, installCodexSupervisor, managedShellRcSkipLines, shellRcPath } from "./install.ts";
 import { withLock } from "./lock.ts";
 import { log } from "./log.ts";
-import { codexCredItemFor, codexPaths, codexPool } from "./paths.ts";
-import { isExhausted, thresholdBars, type PickCtx } from "./picker.ts";
+import { codexPaths, codexPool, codexSeatFromEnv } from "./paths.ts";
+import { isExhausted, pickBest, pickEarliestReset, thresholdBars, type PickCtx } from "./picker.ts";
 import type { Observation, Provider, SampleReport } from "./provider.ts";
-import { loadAccounts, loadConfig, pinBinOverride, saveAccounts, saveLastSwapAt, type Harvest } from "./state.ts";
+import { loadAccounts, loadConfig, pinBinOverride, saveAccounts, type Harvest } from "./state.ts";
 import { restoreTermios, saveTermios } from "./tty.ts";
-import { CodexReconcileMarkerSchema, type Account, type CodexAuthJson, type CodexUsage, type Config } from "./types.ts";
+import type { Account, CodexAuthJson, CodexUsage, Config } from "./types.ts";
 import { c } from "../cli/render.ts";
 
+class StoreUnusableError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = "StoreUnusableError";
+  }
+}
+
+function liveId(): string | null {
+  return codexSeatFromEnv(loadAccounts(codexPool).accounts.map((a) => a.id));
+}
+
+function presence(): Map<string, number> {
+  return seatCounts(codexPaths.presenceDir);
+}
+
 function applyUsage(account: Account, usage: CodexUsage, at: number): void {
   account.windows = usage.windows;
   account.lastUsageAt = at;
@@ -25,59 +40,23 @@ function applyUsage(account: Account, usage: CodexUsage, at: number): void {
   if (usage.planType != null) account.tier = usage.planType;
 }
 
-async function sampleLiveOntoOwner(now: number): Promise<void> {
-  let live = readLiveCodexAuth();
-  if (!live) return;
-  const idx = loadAccounts(codexPool);
-  const identity = codexIdentityOf({ auth: live });
-  const owner = idx.accounts.find((a) => a.id === identity.accountId);
-  if (!owner) return;
-
-  if (isCodexAccessExpiring({ auth: live, now }) && !seatCounts(codexPaths.presenceDir).has(identity.accountId)) {
-    try {
-      live = await refreshCodexAuth({ auth: live, now });
-    } catch (e) {
-      if (e instanceof CodexInvalidGrantError) {
-        owner.needsReauth = true;
-        saveAccounts(codexPool, idx);
-        log("codex.live_invalid_grant", { account: owner.id.slice(0, 8) });
-        return;
-      }
-      throw e;
-    }
-    writeLiveCodexAuth({ auth: live });
-    writeParkedCodexAuth({ credFile: codexCredItemFor(owner.id), auth: live });
-  }
-  applyUsage(owner, await fetchCodexUsage({ auth: live, at: now }), now);
-  saveAccounts(codexPool, idx);
-}
+type CodexReadOutcome = { ok: true; usage: CodexUsage; at: number } | { ok: false; reason: string; deadGrant: boolean };
 
-async function observeLive(account: Account, cfg: Config, now: number, opts: { probe: boolean }): Promise<Observation | null> {
-  if (opts.probe && (account.lastUsageAt == null || now - account.lastUsageAt > cfg.policy.usagePollTtlMs)) {
-    await withLock(codexPool.lockFile, () => sampleLiveOntoOwner(now));
+async function readCodexUsage(account: Account, now: number): Promise<CodexReadOutcome> {
+  let auth: CodexAuthJson | null;
+  try {
+    auth = readCodexStoreAuth(account.id);
+  } catch (e) {
+    return { ok: false, reason: `store credential unreadable (${(e instanceof Error ? e.message : String(e)).slice(0, 80)})`, deadGrant: false };
   }
-  const fresh = loadAccounts(codexPool).accounts.find((a) => a.id === account.id);
-  return fresh?.lastUsageAt != null ? { windows: fresh.windows, at: fresh.lastUsageAt } : null;
-}
-
-type CodexSampleOutcome = { ok: true; usage: CodexUsage; at: number } | { ok: false; reason: string; deadGrant: boolean };
-
-async function sampleAccount(account: Account, liveId: string | null, now: number): Promise<CodexSampleOutcome> {
-  const isLive = liveId != null && account.id === liveId;
-  const credFile = codexCredItemFor(account.id);
+  if (!auth) return { ok: false, reason: "no credential in this account's store - run `tokenmaxxing auth --codex`", deadGrant: false };
   try {
-    let auth = isLive ? readLiveCodexAuth() : readParkedCodexAuth({ credFile });
-    if (!auth) return { ok: false, reason: isLive ? "live auth.json vanished" : "no parked credential", deadGrant: false };
     if (isCodexAccessExpiring({ auth, now })) {
-      const running = seatCounts(codexPaths.presenceDir).has(account.id);
-      if (running && !isLive) {
-        return { ok: false, reason: "running in a live codex session (parked token refresh unsafe)", deadGrant: false };
-      }
-      if (!running) {
-        auth = await refreshCodexAuth({ auth, now });
-        if (isLive) writeLiveCodexAuth({ auth });
-        writeParkedCodexAuth({ credFile, auth });
+      if (seatCounts(codexPaths.presenceDir).has(account.id)) {
+        return { ok: false, reason: "running in a live codex session (store refresh unsafe)", deadGrant: false };
       }
+      auth = await refreshCodexAuth({ auth, now });
+      writeCodexStoreAuth(account.id, auth);
     }
     const at = Date.now();
     return { ok: true, usage: await fetchCodexUsage({ auth, at }), at };
@@ -88,11 +67,32 @@ async function sampleAccount(account: Account, liveId: string | null, now: numbe
   }
 }
 
-async function samplePool(accounts: Account[], liveId: string | null, now: number): Promise<Map<string, SampleReport>> {
+async function observeLive(account: Account, cfg: Config, now: number, opts: { probe: boolean }): Promise<Observation | null> {
+  if (opts.probe && (account.lastUsageAt == null || now - account.lastUsageAt > cfg.policy.usagePollTtlMs)) {
+    const outcome = await readCodexUsage(account, now);
+    await withLock(codexPool.lockFile, () => {
+      const idx = loadAccounts(codexPool);
+      const a = idx.accounts.find((x) => x.id === account.id);
+      if (!a) return;
+      if (outcome.ok) {
+        if (a.lastUsageAt == null || outcome.at > a.lastUsageAt) {
+          applyUsage(a, outcome.usage, outcome.at);
+        }
+      } else if (outcome.deadGrant) {
+        a.needsReauth = true;
+      }
+      saveAccounts(codexPool, idx);
+    });
+  }
+  const current = loadAccounts(codexPool).accounts.find((a) => a.id === account.id) ?? account;
+  return current.lastUsageAt != null ? { windows: current.windows, at: current.lastUsageAt } : null;
+}
+
+async function samplePool(accounts: Account[], _liveId: string | null, now: number): Promise<Map<string, SampleReport>> {
   const reports = new Map<string, SampleReport>();
   await Promise.all(
     accounts.map(async (account) => {
-      const outcome = await sampleAccount(account, liveId, now);
+      const outcome = await readCodexUsage(account, now);
       if (outcome.ok) {
         applyUsage(account, outcome.usage, outcome.at);
         reports.set(account.id, { ok: true, source: "probe" });
@@ -105,68 +105,15 @@ async function samplePool(accounts: Account[], liveId: string | null, now: numbe
   return reports;
 }
 
-async function swap(target: Account): Promise<void> {
-  const idx = loadAccounts(codexPool);
-  const live = readLiveCodexAuth();
-  let liveOwner: Account | null = null;
-  if (live) {
-    const liveIdentity = codexIdentityOf({ auth: live });
-    liveOwner = idx.accounts.find((a) => a.id === liveIdentity.accountId) ?? null;
-    if (!liveOwner) {
-      throw new Error(
-        `live codex credential belongs to ${liveIdentity.email ?? liveIdentity.accountId.slice(0, 8)}, which is not in the pool - refusing to swap over it; import it first with \`tokenmaxxing add --codex\``,
-      );
-    }
-    if (liveOwner.id !== idx.activeId) {
-      log("codexswap.harvest_drift", { labeled: idx.activeId?.slice(0, 8) ?? null, actual: liveOwner.id.slice(0, 8) });
-    }
-  }
-  const commit = (): void => {
-    idx.activeId = target.id;
-    const entry = idx.accounts.find((a) => a.id === target.id);
-    if (entry) entry.needsReauth = false;
-    saveAccounts(codexPool, idx);
-  };
-
-  if (live && liveOwner && liveOwner.id === target.id) {
-    writeParkedCodexAuth({ credFile: codexCredItemFor(target.id), auth: live });
-    commit();
-    log("codexswap.reconciled", { account: target.id.slice(0, 8) });
-    return;
-  }
-
-  const parked = readParkedCodexAuth({ credFile: codexCredItemFor(target.id) });
-  if (!parked) throw new Error(`no parked codex credential for ${target.label}`);
-
-  let fresh: CodexAuthJson;
+async function prepareMove(target: Account): Promise<void> {
+  let auth: CodexAuthJson | null;
   try {
-    fresh = await refreshCodexAuth({ auth: parked });
+    auth = readCodexStoreAuth(target.id);
   } catch (e) {
-    if (e instanceof CodexInvalidGrantError) {
-      const entry = idx.accounts.find((a) => a.id === target.id);
-      if (entry) {
-        entry.needsReauth = true;
-        saveAccounts(codexPool, idx);
-      }
-      log("codexswap.invalid_grant", { account: target.id.slice(0, 8) });
-    }
-    throw e;
-  }
-  writeParkedCodexAuth({ credFile: codexCredItemFor(target.id), auth: fresh });
-
-  if (live && liveOwner) {
-    const liveNow = readLiveCodexAuth();
-    if (!liveNow || codexIdentityOf({ auth: liveNow }).accountId !== liveOwner.id) {
-      throw new Error("live codex credential changed mid-swap - refusing to harvest under a stale identity; retry");
-    }
-    writeParkedCodexAuth({ credFile: codexCredItemFor(liveOwner.id), auth: liveNow });
-    log("codexswap.harvest", { account: liveOwner.id.slice(0, 8) });
+    throw new StoreUnusableError(`${target.label}'s store is unreadable (${e instanceof Error ? e.message : String(e)}) - re-auth with \`tokenmaxxing auth --codex ${target.label}\``);
   }
-
-  writeLiveCodexAuth({ auth: fresh });
-  commit();
-  saveLastSwapAt(codexPool, Date.now());
-  log("codexswap.done", { account: target.id.slice(0, 8), label: target.label });
+  if (!auth) throw new StoreUnusableError(`${target.label} has no credential in its store - re-auth with \`tokenmaxxing auth --codex ${target.label}\``);
+  log("move.prepared", { account: target.id.slice(0, 8), label: target.label });
 }
 
 async function login(): Promise<Harvest | null> {
@@ -204,7 +151,7 @@ async function login(): Promise<Harvest | null> {
       email: usage?.usage.email ?? identity.email,
       tier: usage?.usage.planType ?? identity.planType,
       sample: usage ? { windows: usage.usage.windows, at: usage.at } : null,
-      park: async () => writeParkedCodexAuth({ credFile: codexCredItemFor(identity.accountId), auth }),
+      park: async () => writeCodexStoreAuth(identity.accountId, auth),
     };
   } finally {
     rmSync(onboardDir, { recursive: true, force: true });
@@ -224,36 +171,9 @@ async function sampleLogin(auth: CodexAuthJson): Promise<{ usage: CodexUsage; at
 }
 
 async function importLive(): Promise<Harvest | null> {
-  const live = readLiveCodexAuth();
-  if (!live) {
-    console.error(c.red(`no codex login found at ${codexPaths.authJson} - run \`codex login\` first, then re-run this.`));
-    return null;
-  }
-  const identity = codexIdentityOf({ auth: live });
-  const usage = await sampleLogin(live);
-
-  if (seatCounts(codexPaths.presenceDir).has(identity.accountId)) {
-    console.error(c.red("a live supervised codex session is running this account - its token rotates under us, so parking a snapshot now could poison the backup."));
-    console.error(c.dim("close that codex session (or let it exit) and re-run `tokenmaxxing init --codex`."));
-    return null;
-  }
-
-  return {
-    id: identity.accountId,
-    email: usage?.usage.email ?? identity.email,
-    tier: usage?.usage.planType ?? identity.planType,
-    sample: usage ? { windows: usage.usage.windows, at: usage.at } : null,
-    park: async () => {
-      if (seatCounts(codexPaths.presenceDir).has(identity.accountId)) {
-        throw new Error("a live supervised codex session started running this account mid-init - close it and re-run `tokenmaxxing init --codex`");
-      }
-      const fresh2 = readLiveCodexAuth();
-      if (!fresh2 || codexIdentityOf({ auth: fresh2 }).accountId !== identity.accountId) {
-        throw new Error("the live codex login changed while init was running (a concurrent swap?) - re-run `tokenmaxxing init --codex`");
-      }
-      writeParkedCodexAuth({ credFile: codexCredItemFor(identity.accountId), auth: fresh2 });
-    },
-  };
+  console.log(c.cyan("Opening an isolated codex login for your first pooled account - the login you already have stays as it is for sessions started outside the supervisor."));
+  console.log();
+  return login();
 }
 
 function storePinnedAwayFromFile(): boolean {
@@ -287,36 +207,26 @@ function install(): void {
   console.log(`${c.green("✓")} codex supervisor installed at ${codexSupervisorLink()}`);
   console.log(`${c.green("✓")} Stop hook declared in ${codexPaths.hooksJson}`);
   console.log();
-  console.log(c.bold(c.yellow("one manual step: codex skips untrusted hooks.")));
-  console.log(c.yellow("open codex, run /hooks, and trust the tokenmaxxing Stop hook - auto-switching is inert until then."));
+  console.log(c.bold(c.yellow("one manual step per seat: codex trusts hooks per store path.")));
+  console.log(c.yellow("open a supervised codex session on each pooled account, run /hooks, and trust the tokenmaxxing Stop hook - auto-switching stays inert on an untrusted seat."));
+  console.log(c.yellow("`tokenmaxxing doctor` lists seats still needing trust."));
 }
 
 export function codexPickCtx(now: number, currentId: string | null): PickCtx {
   return { now, thresholds: thresholdBars(loadConfig()), currentId, families: null, seats: null };
 }
 
-export function reconcileSiblings(now: number): void {
-  const liveId = liveCodexAccountId();
-  if (liveId == null) return;
+export function pickCodexSeat(now: number, wantedId: string | null = null): Account | null {
+  const cfg = loadConfig();
   const idx = loadAccounts(codexPool);
-  const liveAccount = idx.accounts.find((a) => a.id === liveId);
-  if (!liveAccount || liveAccount.needsReauth === true || isExhausted(liveAccount, codexPickCtx(now, liveId))) return;
-  const living = livingPresences(codexPaths.presenceDir);
-  if (existsSync(codexPaths.reconcileDir)) {
-    const alive = new Set(living.map((presence) => presence.id));
-    for (const name of readdirSync(codexPaths.reconcileDir)) {
-      if (!alive.has(name)) rmSync(join(codexPaths.reconcileDir, name), { force: true });
-    }
-  }
-  for (const presence of living) {
-    if (presence.accountId === liveId) continue;
-    if (!idx.accounts.some((a) => a.id === presence.accountId)) continue;
-    const markerPath = join(codexPaths.reconcileDir, presence.id);
-    if (existsSync(markerPath)) continue;
-    mkdirSync(codexPaths.reconcileDir, { recursive: true });
-    writeFileAtomic(markerPath, JSON.stringify(CodexReconcileMarkerSchema.parse({ accountId: presence.accountId, ts: now })));
-    log("codex.reconcile_signal", { supervisorId: presence.id.slice(0, 8), account: presence.accountId.slice(0, 8) });
+  const ctx: PickCtx = { now, thresholds: thresholdBars(cfg), currentId: null, families: null, seats: null };
+  if (wantedId != null) {
+    const wanted = idx.accounts.find((a) => a.id === wantedId && a.needsReauth !== true && !isExhausted(a, { ...ctx, currentId: wantedId }));
+    if (wanted) return wanted;
   }
+  const present = seatCounts(codexPaths.presenceDir);
+  const usable = idx.accounts.filter((a) => a.needsReauth !== true && !isExhausted(a, ctx) && !present.has(a.id));
+  return pickBest(usable, ctx) ?? pickEarliestReset(idx.accounts.filter((a) => a.needsReauth !== true && !present.has(a.id)), ctx)?.account ?? null;
 }
 
 export const codex: Provider = {
@@ -326,18 +236,18 @@ export const codex: Provider = {
   seats: "live",
   waitsWhenDepleted: false,
   statusOnly: false,
-  liveId: liveCodexAccountId,
-  presence: () => seatCounts(codexPaths.presenceDir),
+  liveId,
+  presence,
   gatedFamilies: () => null,
   observeLive,
   samplePool,
   mergeWindows: (next) => next,
-  swap,
-  classifySwapError: (e) => (e instanceof CodexInvalidGrantError ? "dead-grant" : "fatal"),
-  removeCredentials: async (a) => deleteParkedCodexAuth({ credFile: codexCredItemFor(a.id) }),
+  swap: prepareMove,
+  classifySwapError: (e) => (e instanceof CodexInvalidGrantError ? "dead-grant" : e instanceof StoreUnusableError ? "skip" : "fatal"),
+  removeCredentials: async (a) => deleteCodexStoreAuth(a.id),
   storeUsable: async (a) => {
     try {
-      return readParkedCodexAuth({ credFile: codexCredItemFor(a.id) }) != null;
+      return readCodexStoreAuth(a.id) != null;
     } catch {
       return false;
     }

package/src/lib/codexauth.ts

@@ -1,8 +1,8 @@
-import { readFileSync, rmSync } from "node:fs";
+import { existsSync, lstatSync, mkdirSync, readdirSync, readFileSync, rmSync, symlinkSync } from "node:fs";
 import { join } from "node:path";
 import { z } from "zod";
 import { writeFileAtomic } from "./atomic.ts";
-import { codexPaths } from "./paths.ts";
+import { codexAuthJsonFor, codexPaths, codexStoreDirFor } from "./paths.ts";
 import { CodexAuthJsonSchema, ErrnoSchema, type CodexAuthJson } from "./types.ts";
 
 export function readCodexAuthAt(input: { path: string }): CodexAuthJson | null {
@@ -19,41 +19,50 @@ export function readCodexAuthAt(input: { path: string }): CodexAuthJson | null {
   return CodexAuthJsonSchema.parse(parsed);
 }
 
-export function readLiveCodexAuth(): CodexAuthJson | null {
-  return readCodexAuthAt({ path: codexPaths.authJson });
+export function readCodexStoreAuth(accountId: string): CodexAuthJson | null {
+  return readCodexAuthAt({ path: codexAuthJsonFor(accountId) });
 }
 
-export function liveCodexAccountId(): string | null {
-  const live = readLiveCodexAuth();
-  if (!live) return null;
-  return codexIdentityOf({ auth: live }).accountId;
+export function writeCodexStoreAuth(accountId: string, auth: CodexAuthJson): void {
+  mkdirSync(codexStoreDirFor(accountId), { recursive: true });
+  writeFileAtomic(codexAuthJsonFor(accountId), JSON.stringify(CodexAuthJsonSchema.parse(auth), null, 2), 0o600);
 }
 
-export function writeLiveCodexAuth(input: { auth: CodexAuthJson }): void {
-  writeFileAtomic(codexPaths.authJson, JSON.stringify(CodexAuthJsonSchema.parse(input.auth), null, 2), 0o600);
+export function deleteCodexStoreAuth(accountId: string): void {
+  rmSync(codexStoreDirFor(accountId), { recursive: true, force: true });
 }
 
-function parkedPath(input: { credFile: string }): string {
-  return join(codexPaths.credsDir, `${input.credFile}.json`);
-}
-
-export function readParkedCodexAuth(input: { credFile: string }): CodexAuthJson | null {
-  let raw: string;
+export function ensureCodexStoreHome(accountId: string): string {
+  const store = codexStoreDirFor(accountId);
+  mkdirSync(store, { recursive: true });
+  mkdirSync(codexPaths.home, { recursive: true });
+  mkdirSync(join(codexPaths.home, "sessions"), { recursive: true });
+  let names: string[] = [];
   try {
-    raw = readFileSync(parkedPath(input), "utf8");
+    names = readdirSync(codexPaths.home);
   } catch (e) {
-    if (ErrnoSchema.safeParse(e).data?.code === "ENOENT") return null;
+    if (ErrnoSchema.safeParse(e).data?.code === "ENOENT") return store;
     throw e;
   }
-  return CodexAuthJsonSchema.parse(JSON.parse(raw));
-}
-
-export function writeParkedCodexAuth(input: { credFile: string; auth: CodexAuthJson }): void {
-  writeFileAtomic(parkedPath(input), JSON.stringify(CodexAuthJsonSchema.parse(input.auth), null, 2), 0o600);
-}
-
-export function deleteParkedCodexAuth(input: { credFile: string }): void {
-  rmSync(parkedPath(input), { force: true });
+  for (const name of names) {
+    if (name === "auth.json") continue;
+    const target = join(codexPaths.home, name);
+    const link = join(store, name);
+    if (existsSync(link)) {
+      try {
+        if (lstatSync(link).isSymbolicLink()) continue;
+      } catch {
+        continue;
+      }
+      continue;
+    }
+    try {
+      symlinkSync(target, link);
+    } catch (e) {
+      if (ErrnoSchema.safeParse(e).data?.code !== "EEXIST") throw e;
+    }
+  }
+  return store;
 }
 
 const IdClaimsSchema = z.looseObject({

package/src/lib/install.ts

@@ -2,7 +2,7 @@ import { accessSync, appendFileSync, constants, existsSync, mkdirSync, readFileS
 import { basename, dirname, join } from "node:path";
 import { escape } from "es-toolkit";
 import { z } from "zod";
-import { codexPaths, HOME, paths } from "./paths.ts";
+import { codexPaths, codexStoreDirFor, HOME, paths } from "./paths.ts";
 import { writeFileAtomic } from "./atomic.ts";
 import { installedBin, installSettings, isOurHookCommand, uninstallSettings } from "./settings.ts";
 import { resolveRealClaude } from "./claudebin.ts";
@@ -165,6 +165,40 @@ export function uninstallCodexStopHook(): void {
   writeFileAtomic(codexPaths.hooksJson, JSON.stringify(next, null, 2) + "\n");
 }
 
+export function codexStopHookGroupIndex(): number | null {
+  if (!existsSync(codexPaths.hooksJson)) return null;
+  let parsed: z.infer<typeof CodexHooksFileSchema>;
+  try {
+    parsed = CodexHooksFileSchema.parse(JSON.parse(readFileSync(codexPaths.hooksJson, "utf8")));
+  } catch {
+    return null;
+  }
+  const idx = parsed.hooks.Stop.findIndex((group) => group.hooks.some((hook) => (hook.command ?? "").includes(CODEX_STOP_HOOK_SUBCOMMAND)));
+  return idx >= 0 ? idx : null;
+}
+
+export function codexStoreHookTrust(accountId: string): "trusted" | "untrusted" | "unknown" {
+  const group = codexStopHookGroupIndex();
+  if (group == null) return "unknown";
+  const key = `${join(codexStoreDirFor(accountId), "hooks.json")}:stop:${group}:0`;
+  let text: string;
+  try {
+    text = readFileSync(join(codexPaths.home, "config.toml"), "utf8");
+  } catch {
+    return "unknown";
+  }
+  let inBlock = false;
+  for (const line of text.split("\n")) {
+    const trimmed = line.trim();
+    if (trimmed.startsWith("[")) {
+      inBlock = trimmed.startsWith("[hooks.state.") && trimmed.includes(key);
+    } else if (inBlock && trimmed.startsWith("trusted_hash")) {
+      return "trusted";
+    }
+  }
+  return "untrusted";
+}
+
 export function codexSupervisorLink(): string {
   return join(paths.binDir, "codex");
 }

package/src/lib/paths.ts

@@ -48,7 +48,7 @@ export const claudePool = {
 
 export const codexPool = {
   accountsJson: join(TM_HOME, "codex-accounts.json"),
-  lastSwapJson: join(TM_HOME, "codex-lastswap.json"),
+  lastSwapJson: null,
   lockFile: join(TM_HOME, "codex-lock"),
 } as const;
 
@@ -72,15 +72,24 @@ export const codexPaths = {
   home: CODEX_HOME,
   authJson: join(CODEX_HOME, "auth.json"),
   hooksJson: join(CODEX_HOME, "hooks.json"),
-  credsDir: join(TM_HOME, "codex-creds"),
+  storesDir: join(TM_HOME, "codex-stores"),
   onboardDir: join(TM_HOME, "codex-onboard"),
   respawnDir: join(TM_HOME, "codex-respawn"),
   presenceDir: join(TM_HOME, "codex-live"),
-  reconcileDir: join(TM_HOME, "codex-reconcile"),
 } as const;
 
-export function codexCredItemFor(accountId: string): string {
-  return `tokenmaxxing-codex-${accountId.slice(0, 8)}`;
+export function codexStoreDirFor(accountId: string): string {
+  return join(codexPaths.storesDir, shortId(accountId));
+}
+
+export function codexAuthJsonFor(accountId: string): string {
+  return join(codexStoreDirFor(accountId), "auth.json");
+}
+
+export function codexSeatFromEnv(accountIds: string[], env: Record<string, string | undefined> = process.env): string | null {
+  const home = env.CODEX_HOME;
+  if (home == null || home === "") return null;
+  return accountIds.find((id) => codexStoreDirFor(id) === home) ?? null;
 }
 
 const GROK_HOME_DEFAULT = join(HOME, ".grok");

package/src/lib/picker.ts

@@ -6,7 +6,7 @@ import { AccountSchema, ThresholdsSchema, type Account, type Config, type Thresh
 export function thresholdBars(cfg: Config): Thresholds {
   return {
     session: cfg.thresholds.session - cfg.policy.projectionMargin,
-    weekly: cfg.thresholds.weekly - cfg.policy.projectionMargin,
+    weekly: cfg.thresholds.weekly,
   };
 }
 
@@ -87,11 +87,22 @@ export function earliestReset(a: Account, now: number): number {
   return Math.min(session != null && session > now ? session : Number.POSITIVE_INFINITY, weeklyExpiry(a, now));
 }
 
-export function pacePressure(a: Account, now: number): number {
+function windowResetAt(w: Window, now: number): number | null {
+  if (w.resetsAt != null) return nextWeeklyReset(w.resetsAt, now);
+  if (w.windowSeconds != null) return w.sampledAt + w.windowSeconds * 1000;
+  return null;
+}
+
+export function pacePressure(a: Account, ctx: PickCtx): number {
+  const binding = minBy(gatedWindows(a, ctx.families), (w) => Math.max(0, 100 - liveUsed(w, ctx.now)));
+  if (binding != null) {
+    const reset = windowResetAt(binding, ctx.now);
+    if (reset != null) return Math.max(0, 100 - liveUsed(binding, ctx.now)) / Math.max(1, reset - ctx.now);
+  }
   const weekly = weeklyWindow(a);
-  const reset = nextWeeklyReset(weekly?.resetsAt ?? null, now);
+  const reset = nextWeeklyReset(weekly?.resetsAt ?? null, ctx.now);
   if (weekly == null || reset == null) return 0;
-  return Math.max(0, 100 - liveUsed(weekly, now)) / Math.max(1, reset - now);
+  return Math.max(0, 100 - liveUsed(weekly, ctx.now)) / Math.max(1, reset - ctx.now);
 }
 
 export function seatHeadroom(a: Account, ctx: PickCtx): number {
@@ -102,7 +113,7 @@ export function seatHeadroom(a: Account, ctx: PickCtx): number {
 
 const swapPreference = (ctx: PickCtx) => [
   ...(ctx.seats == null ? [] : [(a: Account) => -seatHeadroom(a, ctx)]),
-  (a: Account) => -pacePressure(a, ctx.now),
+  (a: Account) => -pacePressure(a, ctx),
   (a: Account) => weeklyExpiry(a, ctx.now),
   (a: Account) => weeklyWindow(a)?.usedPercentage ?? 101,
 ];
@@ -116,7 +127,7 @@ export function currentWins(active: Account | null, accounts: Account[], ctx: Pi
   if (!active || active.needsReauth || isExhausted(active, ctx)) return false;
   const best = pickBest(accounts, { ...ctx, currentId: null });
   if (best == null || best.id === active.id) return true;
-  if (margin > 1) return pacePressure(best, ctx.now) <= pacePressure(active, ctx.now) * margin;
+  if (margin > 1) return pacePressure(best, ctx) <= pacePressure(active, ctx) * margin;
   return swapPreference(ctx).every((k) => k(active) === k(best));
 }
 

package/src/lib/types.ts

@@ -114,7 +114,7 @@ export const ConfigSchema = z
     opencodeBin: z.string().default(""),
     policy: z
       .object({
-        projectionMargin: z.number().min(0).max(100).default(0),
+        projectionMargin: z.number().min(0).max(100).default(3),
         switchModels: z
           .array(z.string())
           .default(["fable"])
@@ -125,9 +125,9 @@ export const ConfigSchema = z
       })
       .prefault({}),
   })
-  .refine((cfg) => cfg.policy.projectionMargin < Math.min(cfg.thresholds.session, cfg.thresholds.weekly), {
+  .refine((cfg) => cfg.policy.projectionMargin < cfg.thresholds.session, {
     path: ["policy", "projectionMargin"],
-    message: "must be strictly below both thresholds (the bars would hit zero and every account would read as exhausted)",
+    message: "must be strictly below the session threshold (the session bar would hit zero and every account would read as exhausted)",
   });
 export type Config = z.infer<typeof ConfigSchema>;
 
@@ -229,13 +229,8 @@ export const CodexStopStdinSchema = z.looseObject({
 });
 
 export const CodexRespawnMarkerSchema = z.object({
-  account: z.string(),
-  sessionId: z.string().nullable(),
-  ts: z.number(),
-});
-
-export const CodexReconcileMarkerSchema = z.object({
   accountId: z.string(),
+  sessionId: z.string().nullable(),
   ts: z.number(),
 });
 

package/src/main.ts

@@ -20,7 +20,6 @@ import { cmdStatus } from "./cli/status.ts";
 import { cmdDoctor } from "./cli/doctor.ts";
 import { cmdRm } from "./cli/rm.ts";
 import { cmdRename } from "./cli/rename.ts";
-import { cmdSwitch } from "./cli/switch.ts";
 import { cmdCheck } from "./cli/check.ts";
 import { cmdConfig } from "./cli/config.ts";
 import { cmdSetupToken } from "./cli/setuptoken.ts";
@@ -34,8 +33,8 @@ const CACHED_FLAG = "--cached";
 const CODEX_FLAG = "--codex";
 const GROK_FLAG = "--grok";
 const OPENCODE_GO_FLAG = "--opencode-go";
-const JSON_COMMANDS = new Set(["status", "config", "check", "switch"]);
-const CODEX_COMMANDS = new Set(["init", "add", "auth", "switch", "rm", "rename"]);
+const JSON_COMMANDS = new Set(["status", "config", "check"]);
+const CODEX_COMMANDS = new Set(["init", "add", "auth", "rm", "rename"]);
 const STATUS_ONLY_COMMANDS = new Set(["init", "add", "auth", "rm", "rename"]);
 
 function printHelp(): void {
@@ -44,13 +43,12 @@ function printHelp(): void {
   ${c.cyan("tokenmaxxing")}            show the pool with usage bars (alias of ${c.cyan("status")})
   ${c.cyan("tokenmaxxing check")}      sample the account whose usage figure is oldest (run by the periodic timer)
   ${c.cyan("tokenmaxxing init")}       log in the first account (isolated) + install supervisor & hooks
-  ${c.cyan("tokenmaxxing init --codex")}  same for codex: import login, install codex supervisor + Stop hook (trust it via /hooks)
+  ${c.cyan("tokenmaxxing init --codex")}  same for codex: log in the first account, isolated, install codex supervisor + Stop hook
   ${c.cyan("tokenmaxxing init --grok")}   pool grok Build logins (status-only: no supervisor yet)
   ${c.cyan("tokenmaxxing init --opencode-go")}  pool opencode-go API keys (status-only: no supervisor yet)
   ${c.cyan("tokenmaxxing add")}        register an additional account (isolated login)
   ${c.cyan("tokenmaxxing add --codex")}   register an additional codex account (isolated login)
   ${c.cyan("tokenmaxxing auth")} [--codex | --grok | --opencode-go] [sel | --all]  reauthenticate a pooled account in place (bare = pick from a list; --all = every account that is flagged or has no usable credential in its store, one by one)
-  ${c.cyan("tokenmaxxing switch --codex")} [sel]  switch the codex pool (takes effect on next codex start)
   ${c.cyan("tokenmaxxing status")} [--cached]  accounts with 5h / weekly / per-model usage bars (--cached: the stored figures, no sampling)
   ${c.cyan("tokenmaxxing config")}     print the config path and the effective values (edit the file in an editor)
   ${c.cyan("tokenmaxxing doctor")}     verify the install is intact
@@ -61,7 +59,7 @@ function printHelp(): void {
   ${c.cyan("tokenmaxxing cursor init")} [dir]  write the Claude relay subagent (.cursor/agents/claude.md) and .cursor/environment.json into a repo
   ${c.cyan("tokenmaxxing cloud run")} [--session <id>] [--max-turns <n>] "<prompt>"  on a Cursor Cloud VM: run claude -p on a setup token from TOKENMAXXING_TOKENS, rotate to the next token on a usage limit
 
-  ${c.cyan("--json")}                  print one JSON document on stdout instead of text (status, config, check, switch); every document carries ${c.bold("ok")}, failures add ${c.bold("error")}
+  ${c.cyan("--json")}                  print one JSON document on stdout instead of text (status, config, check); every document carries ${c.bold("ok")}, failures add ${c.bold("error")}
 
   ${c.dim("(aliased as")} ${c.cyan("xx")}${c.dim(")")} - then just run ${c.bold("claude")} as always; it switches accounts near quota automatically.`);
 }
@@ -131,13 +129,6 @@ async function main(): Promise<number> {
       }
       return cmdStatus({ json, cached });
     }
-    case "switch": {
-      if (provider !== codex) {
-        emitError({ json, message: "Claude account placement is per session at launch; manual switching is available with `tokenmaxxing switch --codex`." });
-        return 2;
-      }
-      return cmdSwitch(args[1], json);
-    }
     case "check": {
       if (args.length > 1) {
         emitError({ json, message: `unknown check option: ${args[1]} (check takes no options; the timer runs a plain check every tick)` });
@@ -174,7 +165,7 @@ async function main(): Promise<number> {
       console.log(`removed ${removed.join(", ")}`);
       if (!out.timerDeactivated) console.log(c.yellow(`⚠ the check job may still be loaded - run: ${timerDeactivationHint()}`));
       if (!out.pathLineRemoved) console.log(c.dim("(no tokenmaxxing PATH line found in the shell rc)"));
-      console.log(`kept: accounts.json, config.json, and every account credential store (claude: stores/ and its keychain items on macOS; codex: codex-creds/) - remove accounts with \`xx rm\` to delete their credentials`);
+      console.log(`kept: accounts.json, config.json, and every account credential store (claude: stores/ and its keychain items on macOS; codex: codex-stores/) - remove accounts with \`xx rm\` to delete their credentials`);
       return 0;
     }
     case "help":

package/src/cli/switch.ts

@@ -1,116 +0,0 @@
-import { withLock } from "../lib/lock.ts";
-import { codex } from "../lib/codex.ts";
-import { loadAccounts, loadConfig } from "../lib/state.ts";
-import { currentWins, pickBest, thresholdBars, weeklyExpiry, type PickCtx } from "../lib/picker.ts";
-import { findAccount } from "./rename.ts";
-import { log } from "../lib/log.ts";
-import { c, emitError, emitJson, fmtReset } from "./render.ts";
-import type { Account } from "../lib/types.ts";
-
-const SWITCH_MARGIN = 1.2;
-
-export async function cmdSwitch(selector?: string, json = false): Promise<number> {
-  const p = codex;
-  const deadGrants: string[] = [];
-  const withDeadGrants = (report: Record<string, unknown>) => (deadGrants.length > 0 ? { ...report, deadGrants } : report);
-  const emit = (text: string, report: Record<string, unknown>): void => {
-    if (json) emitJson({ ok: true, ...withDeadGrants(report) });
-    else console.log(text);
-  };
-  const fail = (message: string, opts: { paint?: (s: string) => string; extra?: Record<string, unknown> } = {}): number => {
-    emitError({ json, message, paint: opts.paint, extra: withDeadGrants(opts.extra ?? {}) });
-    return 1;
-  };
-  const reauthHint = (a: Account) => `run \`tokenmaxxing auth${p.flag} ${a.label}\``;
-  const deadGrantMessage = (a: Account) => `${a.label}'s refresh token is dead - ${reauthHint(a)}`;
-  const switched = (target: Account) => `${c.green("↻")} switched to ${c.bold(target.label)} (takes effect on the next codex start)`;
-
-  const idx0 = loadAccounts(p.pool);
-  if (idx0.accounts.length < 2) return fail(`need at least 2 accounts to switch - add one with \`tokenmaxxing add${p.flag}\``, { paint: c.yellow });
-  const cfg = loadConfig();
-  const now = Date.now();
-
-  return withLock(p.pool.lockFile, async () => {
-    const idx = loadAccounts(p.pool);
-    const claimed = p.liveId();
-    const drifted = claimed != null && claimed !== idx.activeId;
-    const present = p.presence();
-
-    const swapTo = async (target: Account, reason: string, extra: Record<string, unknown> = {}): Promise<number> => {
-      try {
-        await p.swap(target);
-      } catch (e) {
-        if (p.classifySwapError(e) === "dead-grant") {
-          deadGrants.push(target.label);
-          return fail(deadGrantMessage(target));
-        }
-        throw e;
-      }
-      log("switch.manual", { account: target.id.slice(0, 8), reason });
-      emit(switched(target), { switched: true, account: target.label, reason, ...extra });
-      return 0;
-    };
-
-    if (selector) {
-      const target = findAccount(idx.accounts, selector);
-      if (!target) return fail(`no account matches "${selector}"`);
-      if (target.id === idx.activeId && !drifted) {
-        emit(`already on ${c.bold(target.label)}`, { switched: false, account: target.label, reason: "already-on" });
-        return 0;
-      }
-      if (target.id !== claimed && present.has(target.id)) {
-        return fail(`${target.label} is running in a live ${p.name} session - swapping onto it would break that session's credential`);
-      }
-      if (target.needsReauth) return fail(`${target.label} needs re-auth - ${reauthHint(target)}`);
-      return swapTo(target, "selected");
-    }
-
-    const everyone: PickCtx = { now, thresholds: thresholdBars(cfg), currentId: null, families: p.gatedFamilies(cfg), seats: null };
-    const rejected = new Set<string>();
-    const candidatesOf = (accounts: Account[]): Account[] => accounts.filter((a) => !rejected.has(a.id) && (a.id === claimed || !present.has(a.id)));
-    while (true) {
-      const cur = loadAccounts(p.pool);
-      const pool = candidatesOf(cur.accounts);
-      const active =
-        (claimed != null ? cur.accounts.find((a) => a.id === claimed) : null) ??
-        cur.accounts.find((a) => a.id === cur.activeId) ??
-        null;
-      if (active != null && currentWins(active, pool, everyone, SWITCH_MARGIN)) {
-        if (drifted) return swapTo(active, "drift-reconciled");
-        const expiry = weeklyExpiry(active, now);
-        const why = Number.isFinite(expiry) ? ` (weekly ${fmtReset(expiry, now)})` : "";
-        emit(`already on the best account: ${c.bold(active.label)}${why}`, {
-          switched: false,
-          account: active.label,
-          reason: "current-wins",
-          weeklyResetsAt: Number.isFinite(expiry) ? expiry : null,
-        });
-        return 0;
-      }
-      const best = pickBest(pool, { ...everyone, currentId: active?.id ?? null });
-      if (!best) break;
-      try {
-        await p.swap(best);
-      } catch (e) {
-        rejected.add(best.id);
-        const kind = p.classifySwapError(e);
-        if (kind === "dead-grant") {
-          deadGrants.push(best.label);
-          if (!json) console.error(c.red(deadGrantMessage(best)));
-          continue;
-        }
-        if (kind === "skip") {
-          if (!json) console.error(c.yellow(`${best.label}: ${e instanceof Error ? e.message : String(e)} - skipped for this run`));
-          continue;
-        }
-        throw e;
-      }
-      log("switch.manual", { account: best.id.slice(0, 8), reason: "best" });
-      emit(switched(best), { switched: true, account: best.label, reason: "best" });
-      return 0;
-    }
-
-    const reauth = loadAccounts(p.pool).accounts.filter((a) => a.needsReauth).map((a) => a.label);
-    return fail(`no usable ${p.name} switch target (all at their bars, unmeasured, or needing reauth)`, { paint: c.yellow, extra: { reauthNeeded: reauth } });
-  });
-}