tokenmaxxing 1.9.1 → 1.10.0

package/DESIGN.md

@@ -1,6 +1,6 @@
 # tokenmaxxing - design
 
-Automatic Claude Code account switching. You run `claude` exactly as always; when the active account crosses its swap threshold (**95%** of the 5h session window, **98%** of a weekly window), tokenmaxxing swaps the credential to a fresh account at a safe turn boundary and **your running session adopts it in place - no restart**. Works across many concurrent sessions at once; a fully depleted pool pauses with a countdown and auto-resumes at the soonest reset when it lands within `policy.maxWaitMs` (default 1h; further out, the session stays put rather than parking for hours).
+Automatic Claude Code account switching. You run `claude` exactly as always; when the active account crosses its swap threshold (the active rung of the 5h session ladder, **50, then 80, then 95** as the pool fills, or **98%** of a weekly window), tokenmaxxing swaps the credential to a fresh account at a safe turn boundary and **your running session adopts it in place - no restart**. Works across many concurrent sessions at once; a fully depleted pool pauses with a countdown and auto-resumes at the soonest reset when it lands within `policy.maxWaitMs` (default 1h; further out, the session stays put rather than parking for hours).
 
 > Scope: **Claude Code first (macOS + Linux, the latter since 2026-07-09).** Codex support landed in 0.13.0 (2026-07-16) with its own parallel state, decision engine, and supervisor; its verified internals live in AGENTS.md's Codex sections.
 >
@@ -12,7 +12,7 @@ Automatic Claude Code account switching. You run `claude` exactly as always; whe
 
 A **running** `claude` DOES adopt an externally swapped credential (verified live 2026-07-10, correcting this document's original claim): an ensure-fresh poll re-reads the credential store around every request, so a swap lands within ~30s on macOS (raw keychain cache) and on the next request on Linux. A plain swap therefore needs no process management at all (since 0.15.0, 2026-07-16; earlier versions respawned on every swap): the Stop hook swaps the credential and the session keeps running. What adoption cannot give you is the depleted case: when every account is at the wall the session must be PAUSED until something resets, and a live `claude` cannot pause itself.
 
-So the supervisor's job is narrow: on a depleted pool it **replaces the process at a salvageable moment** - after a turn completes, the conversation is fully written to the transcript JSONL and `claude` is idle at the prompt, so killing it there loses nothing - shows an interruptible countdown to the soonest reset, and relaunches `claude --resume <session-id>` when it passes. **Thresholds still sit below 100%: the headroom is the budget to reach a clean turn boundary (plus up to one turn of adoption lag on macOS) before the account actually hits the wall.** The session window swaps at 95 (a 5h reset is cheap to sit out) while the weekly windows drain to 98 (weekly allowance is use-it-or-lose-it).
+So the supervisor's job is narrow: on a depleted pool it **replaces the process at a salvageable moment** - after a turn completes, the conversation is fully written to the transcript JSONL and `claude` is idle at the prompt, so killing it there loses nothing - shows an interruptible countdown to the soonest reset, and relaunches `claude --resume <session-id>` when it passes. **Thresholds still sit below 100%: the headroom is the budget to reach a clean turn boundary (plus up to one turn of adoption lag on macOS) before the account actually hits the wall.** The session window climbs a ladder, 50 then 80 then 95, each rung taking over once every pooled account is past the one below (a 5h reset is cheap to sit out, so the pool drains level by level), while the weekly windows drain to 98 (weekly allowance is use-it-or-lose-it).
 
 A hook can't do the pause-and-relaunch - when `claude` exits, the shell owns the terminal. So tokenmaxxing installs a **supervisor** (aliased to `claude`) that owns the process lifecycle:
 
@@ -79,7 +79,7 @@ Each terminal ran the supervisor, so each has its own child `claude` and its own
 ---
 
 ## 5. Rotation policy
-The decision engages at `five_hour >= 50%` (policy.greedySessionFloor): from there it greedily converges on the usable account furthest behind its weekly pace, staying put whenever the current account wins or ties. The **Layer 1 screening bars** - `five_hour >= 95%` OR `seven_day >= 98%`, per org (`thresholds`) - force a switch onto a fresher account and also screen candidates. "Exhausted" is a **timestamped state** (`resets_at`), not a flag - an account is a candidate again after it resets. Optional projected threshold (`bar - policy.projectionMargin`, a fixed configured margin) so a single large turn is less likely to blow past 100% before the next Stop hook.
+The decision engages at `five_hour >= 50%` (policy.greedySessionFloor): from there it greedily converges on the usable account furthest behind its weekly pace, staying put whenever the current account wins or ties. The **Layer 1 screening bars** - `five_hour >= <active rung>` (the 5h ladder `thresholds.session`, default 50/80/95: the lowest rung some pooled account still clears, the current one included) OR `seven_day >= 98%`, per org (`thresholds`) - force a switch onto a fresher account and also screen candidates. "Exhausted" is a **timestamped state** (`resets_at`), not a flag - an account is a candidate again after it resets. Optional projected threshold (`bar - policy.projectionMargin`, a fixed configured margin) so a single large turn is less likely to blow past 100% before the next Stop hook.
 
 **Two layers - pump the last drops.** The screening bars deliberately leave headroom, so when *every* account is over them Layer 1 alone would park the pool with 2-5% of each account's quota still unspent. **Layer 2 - the wall bars** (`hardThresholds`, default `100/100`, the server's own limit) - is the fallback reached only at that point: the session **holds its seat and squeezes** while it is under the wall, else swaps onto the best still-under-wall account (the same pace-pressure ranking as every other swap - squeeze the account whose weekly quota is most about to be forfeited first), and only parks (depleted-wait) once every account has truly walled. Recovery is then measured against the wall, not the screening bar, so an account whose 5h window drops below 100 is squeezable again even while its weekly window still sits above the Layer 1 bar. The wall reading is the statusLine's own `rate_limits` feed - the same server-side figure claude's `/rate-limit-options` renders - so when an account genuinely maxes out the tee shows 100 and Layer 2 moves on; a single-turn overshoot is caught one boundary later (the periodic `check` timer, or the next Stop hook) without needing to sniff assistant text. Set `hardThresholds` equal to `thresholds` to disable Layer 2. **Layer 2 is Claude-only:** a swap on Claude is a hot, in-place credential adoption every concurrent session follows automatically, whereas a running Codex refuses another account's credential (restart is the switch), so a last-drop-swap there would strand any sibling still on the walled account - Codex instead keeps riding its current account to the wall (its existing all-exhausted stay-put already squeezes it).
 

package/README.md

@@ -33,12 +33,11 @@ tokenmaxxing init
 nix-darwin:
 
 ```nix
-# flake inputs: tokenmaxxing.url = "github:anaclumos/tokenmaxxing";
+inputs.tokenmaxxing.url = "github:anaclumos/tokenmaxxing";
 modules = [
   inputs.tokenmaxxing.darwinModules.withOverlay
   { programs.tokenmaxxing.enable = true; }
 ];
-# then: tokenmaxxing init
 ```
 
 Home Manager:
@@ -47,9 +46,10 @@ Home Manager:
 imports = [ inputs.tokenmaxxing.homeManagerModules.default ];
 programs.tokenmaxxing.enable = true;
 programs.tokenmaxxing.package = inputs.tokenmaxxing.packages.${pkgs.system}.default;
-# then: tokenmaxxing init
 ```
 
+With either module, run `tokenmaxxing init` afterwards.
+
 `init` imports the account you're already on, installs the `claude` supervisor + five `settings.json` entries (the tokenmaxxing statusLine, a subagentStatusLine, a Stop hook, a StopFailure hook, a SessionStart hook), and adds the supervisor's bin dir to PATH in your shell rc (idempotent; it must sit ahead of the real `claude` to intercept it). Restart your shell, then add more accounts and go:
 
 ```sh
@@ -79,12 +79,12 @@ claude                  # use claude as always
 
 ## How switching decides
 
-Switching engages (configurable) once the active account's 5-hour session window is **50% used** - from there, every evaluation greedily converges on the usable account **furthest behind its own weekly pace**, and does nothing when the current account already wins. Independent of that, crossing a hard screening bar - **95%** session or **98%** weekly - always forces a switch. The bars also screen candidates on any of:
+Switching engages (configurable) once the active account's 5-hour session window is **50% used** - from there, every evaluation greedily converges on the usable account **furthest behind its own weekly pace**, and does nothing when the current account already wins. Independent of that, crossing a screening bar always forces a switch: the session bar is the active rung of a ladder (**50**, then **80**, then **95**, each rung taking over once every pooled account is past the one below) and the weekly bar is **98%**. The bars also screen candidates on any of:
 
 - **Session** (5-hour) or **week (all models)** - the aggregate windows, fed free/push-based by the statusLine.
 - **Per-model weekly cap** - the most capable model (Fable) has its own tighter weekly limit that binds *before* the aggregate (per-model caps currently exist only for Sonnet and Fable, and Sonnet's is generous). tokenmaxxing reads it from `claude -p '/usage'` (free, 0 tokens, TTL-cached) whenever the active model is one of `policy.switchModels`, so a Fable session switches on the Fable cap while a Sonnet session rides the aggregate.
 
-The bars' headroom is deliberate: it's the budget to reach a clean turn boundary (plus up to one turn of adoption lag on macOS) before the wall. The session bar sits lower (95) because a 5-hour reset is cheap to sit out; weekly quota is use-it-or-lose-it, so it drains closer to the wall (98). The greedy engagement floor sits far below both: weekly allowance is forfeited at each account's fixed reset, so once half a session window justifies the swap, quota is best burned on whichever account has the most at risk.
+The bars' headroom is deliberate: it's the budget to reach a clean turn boundary (plus up to one turn of adoption lag on macOS) before the wall. The session ladder tops out lower (95) because a 5-hour reset is cheap to sit out, and its lower rungs keep the pool draining level by level; weekly quota is use-it-or-lose-it, so it drains closer to the wall (98). The greedy engagement floor sits far below both: weekly allowance is forfeited at each account's fixed reset, so once half a session window justifies the swap, quota is best burned on whichever account has the most at risk.
 
 The **target** is chosen greedily off each account's cached windows: among usable accounts (every window under its bar, or past its reset), the one **furthest behind its own weekly pace** - highest remaining% divided by time to its weekly reset - because unused weekly allowance is forfeited at the fixed per-account reset. Cached resets are absolute UTC epochs, so a stale snapshot still resolves correctly: a weekly reset that has passed extrapolates forward in 7-day steps, and a session window past its reset counts as empty. Both `tokenmaxxing switch` and the automatic path rank the current account too and do nothing when it already wins, so they are idempotent - evaluating periodically converges on the right account.
 
@@ -94,7 +94,7 @@ The **target** is chosen greedily off each account's cached windows: among usabl
 
 ```json
 {
-  "thresholds": { "session": 95, "weekly": 98 },
+  "thresholds": { "session": [50, 80, 95], "weekly": 98 },
   "policy": {
     "projectionMargin": 0,
     "greedySessionFloor": 50,
@@ -104,7 +104,7 @@ The **target** is chosen greedily off each account's cached windows: among usabl
 }
 ```
 
-`projectionMargin` is a fixed safety margin subtracted from each threshold bar (effective bar = threshold - margin), so a large turn is less likely to blow past a bar between checks; `greedySessionFloor` is the session-used % at which the greedy convergence engages; `switchModels` names the models whose per-model cap triggers a switch; `usagePollTtlMs` is how long a `/usage` per-model poll stays fresh; `maxWaitMs` bounds the depleted-pool countdown - a soonest reset further out than this does not pause the session (no respawn marker is written and the session simply keeps hitting its limit until an account recovers).
+`thresholds.session` is a ladder: the bar is the lowest rung some pooled account still clears, so a seat past 50 hands off while a sibling is under 50, and the bar climbs to 80 and then 95 as the whole pool fills; `projectionMargin` is a fixed safety margin subtracted from each threshold bar (effective bar = threshold - margin), so a large turn is less likely to blow past a bar between checks; `greedySessionFloor` is the session-used % at which the greedy convergence engages; `switchModels` names the models whose per-model cap triggers a switch; `usagePollTtlMs` is how long a `/usage` per-model poll stays fresh; `maxWaitMs` bounds the depleted-pool countdown - a soonest reset further out than this does not pause the session (no respawn marker is written and the session simply keeps hitting its limit until an account recovers).
 
 State lives entirely in `~/.config/tokenmaxxing/`. Per-account credentials follow the platform's Claude Code store: the login keychain on macOS (`tokenmaxxing-cred-<uuid8>` items, never plaintext on disk), 0600 files under `~/.config/tokenmaxxing/creds/` on Linux (the same plaintext model claude itself uses for `~/.claude/.credentials.json`).
 
@@ -116,19 +116,20 @@ For agents you build on the [Claude Agent SDK](https://docs.claude.com/en/api/ag
 import { query } from "@anthropic-ai/claude-agent-sdk";
 import { ensureBestAccount, pooledOptions, stopHookCheck } from "tokenmaxxing";
 
-await ensureBestAccount(); // run the switch decision before the spawn (swaps once it engages - see below)
+await ensureBestAccount();
 
 for await (const message of query({
   prompt: "...",
   options: {
-    ...pooledOptions(), // pinned real claude + scrubbed env -> the pooled live credential
-    hooks: { Stop: [{ hooks: [stopHookCheck] }] }, // re-decide at every turn boundary
+    ...pooledOptions(),
+    hooks: { Stop: [{ hooks: [stopHookCheck] }] },
   },
 })) {
-  // capture the session id from the init message if you want `resume` across swaps
 }
 ```
 
+The loop body receives the message stream; keep the session id from the init message if you want `resume` across swaps.
+
 The SDK reads credentials when it spawns the claude subprocess and has no statusLine, so none of the CLI-side supervisor machinery applies; the integration is boundary-driven instead. `ensureBestAccount()` runs the exact greedy decision the CLI hooks and timer run (screening bars, pace-pressure target, post-swap cooldown - all shared code); like them, it deliberately does nothing until the decision engages (the active session past `policy.greedySessionFloor`, or a bar crossed), so a fresh account rides instead of churning. `pooledOptions()` pins `pathToClaudeCodeExecutable` to the real claude binary and supplies a full replacement `env` with every ambient credential override (`ANTHROPIC_API_KEY`, `CLAUDE_CODE_OAUTH_TOKEN`, ...) scrubbed, so the subprocess resolves the pool's live credential and nothing else. The pooled surface requires the default Claude Code credential store: it fails fast if `CLAUDE_CONFIG_DIR` or `CLAUDE_SECURESTORAGE_CONFIG_DIR` is set in your app's environment, because a swap would write the live credential where those point while the spawned subprocess reads the default store. `stopHookCheck` re-runs the decision at turn boundaries; a swap it lands takes effect on the next subprocess spawn (it never yanks a mid-query token). If your app loads user settings (see the SDK's `settingSources`), the Stop hook `tokenmaxxing init` installed may already fire in SDK sessions too - `stopHookCheck` makes the check explicit and works when settings are restricted.
 
 This is for pooling **your own** subscription accounts in agents you run yourself - the same personal-use posture as the CLI. Anthropic does not allow third-party products to offer claude.ai login or rate limits, including agents built on the Agent SDK; don't ship this surface to third parties.

package/agent-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "tokenmaxxing",
-  "version": "1.9.1",
+  "version": "1.10.0",
   "description": "Pool Claude Code and Codex logins, switch on pace pressure, and expose safe ops tools to agent clients.",
   "author": {
     "name": "anaclumos",

package/agent-plugin/skills/safe-contribution/SKILL.md

@@ -1,15 +1,14 @@
 ---
 name: safe-contribution
-description: Safely change and ship tokenmaxxing (tests, PR window, Mac vs Linux skew, public-repo hygiene). Use when editing this repo, opening PRs, or verifying decision-path changes.
+description: Safely change and ship tokenmaxxing (verification without a test suite, PR window, Mac vs Linux skew, public-repo hygiene). Use when editing this repo, opening PRs, or verifying decision-path changes.
 ---
 
 # Safe contribution
 
 ## Verify
 
-- Default suite: `bun test`.
-- After decision-path changes, also run `bun test/e2e/swap-concurrency.ts` by hand (not part of `bun test`).
-- Hermetic CLI: `TOKENMAXXING_HOME=/tmp/xx-test bun run src/main.ts ...`.
+- The repo carries no test code and no comments (owner ruling 2026-09-02). Never add tests, a test script, or comments.
+- Verify with `bun run typecheck`, then hermetic CLI runs: `TOKENMAXXING_HOME=/tmp/xx-test bun run src/main.ts ...` (for decision-path changes, write accounts.json, usage.json, config.json, and a claude.json under that root and run `check`; point `TOKENMAXXING_KEYCHAIN_SERVICE` and `TOKENMAXXING_KEYCHAIN_ACCOUNT` at throwaway names and `TOKENMAXXING_CLAUDE_JSON` at that claude.json, because the CLI resolves claude.json from HOME, not from `TOKENMAXXING_HOME`).
 - Ask before any run that meters real quota (`status --force`, live-pool inference). Free `/usage` / plain status is fine.
 
 ## Ship

package/agent-plugin/skills/sdk-pairing/SKILL.md

@@ -19,10 +19,11 @@ for await (const message of query({
     hooks: { Stop: [{ hooks: [stopHookCheck] }] },
   },
 })) {
-  // capture session id from init for resume across swaps
 }
 ```
 
+The loop body receives the message stream; keep the session id from the init message for `resume` across swaps.
+
 ## Rules
 
 - Call `ensureBestAccount()` before each `query()` spawn (no mid-query hot-swap).

package/agent-plugin/skills/switching-policy/SKILL.md

@@ -7,11 +7,11 @@ description: Explain and apply tokenmaxxing switch policy (greedy vs hard path,
 
 ## Vocabulary
 
-- **Engaged**: session used >= `policy.greedySessionFloor` (default 50) or any hard/screening bar crossed.
+- **Engaged**: session used >= `policy.greedySessionFloor` (default 50) or any screening bar crossed.
 - **GREEDY path**: engaged but under every bar. Rank all accounts by pace pressure; keep seat on best-or-tie (`currentWins`); else swap to strictly better. Never depleted-waits or pre-parks.
 - **HARD path**: a screening bar crossed. Swap to best usable target; if none, Layer 2 wall logic (Claude only).
 - **Pace pressure**: remaining weekly percent / time to weekly reset (highest first). Not most-remaining.
-- **Effective bars**: `effectiveBars(cfg)` = thresholds minus `policy.projectionMargin`. Trigger and screening must share these bars or swaps ping-pong.
+- **Effective bars**: `effectiveBars(cfg, pool)` = the active rung of the 5h ladder (`thresholds.session`, default 50/80/95: the lowest rung some pooled account, the current one included, still clears) and the weekly bar, each minus `policy.projectionMargin`. Trigger and screening must share these bars or swaps ping-pong. Codex reads `terminalBars(cfg)`, the top rung only. The check cadence is capped one band per rung climbed.
 
 ## Layer 2 (Claude only)
 

package/agent-plugin/skills/switching-policy/references/policy.md

@@ -1,7 +1,7 @@
 # Policy sources
 
 - `docs/content/docs/switching.mdx`
-- `src/lib/decide.ts`, `src/lib/picker.ts` (inline rationale)
+- `src/lib/decide.ts`, `src/lib/picker.ts`
 - `.memory/switch-policy-pace-pressure.md`
 
-Default screening bars: session 95, weekly 98. Wall defaults 100. Cooldown 45s on the automatic path after a swap.
+Default screening bars: session ladder [50, 80, 95] with the active rung resolved per pool, weekly 98. Wall defaults 100. Cooldown 45s on the automatic path after a swap. Check cadence ceiling per rung: 300s, 180s, 120s, then the 60s floor.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tokenmaxxing",
-  "version": "1.9.1",
+  "version": "1.10.0",
   "description": "Automatic Claude Code account switching: pool multiple accounts and hot-swap when quota fills, resuming your session on the fresh account.",
   "type": "module",
   "license": "MIT",
@@ -32,9 +32,8 @@
   ],
   "scripts": {
     "dev": "bun run src/main.ts",
-    "test": "bun test",
     "typecheck": "tsc --noEmit",
-    "prepublishOnly": "bun run typecheck && bun run test",
+    "prepublishOnly": "bun run typecheck",
     "nix:bun": "bunx bun2nix@2.1.2 -o bun.nix"
   },
   "devDependencies": {

package/src/cli/codexswitch.ts

@@ -7,12 +7,12 @@ import { performCodexSwap } from "../lib/codexswap.ts";
 import { CodexInvalidGrantError } from "../lib/codexoauth.ts";
 import { liveCodexAccountId } from "../lib/codexsample.ts";
 import { presentCodexAccountIds, targetableCodexAccounts } from "../lib/codexpresence.ts";
-import { effectiveBars } from "../lib/picker.ts";
+import { terminalBars } from "../lib/picker.ts";
 import { c } from "./render.ts";
 
 export async function cmdCodexSwitch(sel?: string): Promise<number> {
   const cfg = loadConfig();
-  const bars = effectiveBars(cfg);
+  const bars = terminalBars(cfg);
   const now = Date.now();
 
   return withLock(codexPaths.lockFile, async () => {

package/src/cli/status.ts

@@ -4,13 +4,13 @@ import { readOAuthAccount } from "../lib/claudejson.ts";
 import { ensureLiveTokenFresh, probeActiveUsage, probeParkedUsage, type SampleOutcome } from "../lib/sample.ts";
 import { withLock } from "../lib/lock.ts";
 import { codexPaths, paths } from "../lib/paths.ts";
-import { earliestReset, effectiveBars, isExhausted, nextWeeklyReset } from "../lib/picker.ts";
+import { earliestReset, effectiveBars, isExhausted, nextWeeklyReset, terminalBars } from "../lib/picker.ts";
 import { loadCodexAccounts, saveCodexAccounts } from "../lib/codexstate.ts";
 import { liveCodexAccountId, sampleCodexAccount, type CodexSampleOutcome } from "../lib/codexsample.ts";
 import { isCodexExhausted } from "../lib/codexpick.ts";
 import { codexLimitLabel, isSessionWindow } from "../lib/codexusage.ts";
 import { bar, c, claudeTierLabel, count, fmtAgo, fmtReset } from "./render.ts";
-import type { FullUsage } from "../lib/usage.ts";
+import { gatedFamilies, type FullUsage } from "../lib/usage.ts";
 import type { Account, Config, CodexWindow, UsageWindow } from "../lib/types.ts";
 
 export async function cmdStatus(force = false, preRender?: () => void): Promise<number> {
@@ -93,7 +93,9 @@ export async function cmdStatus(force = false, preRender?: () => void): Promise<
   });
 
   preRender?.();
-  console.log(c.dim(`thresholds 5h ${cfg.thresholds.session}% weekly ${cfg.thresholds.weekly}%  (${count({ n: idx.accounts.length, noun: "claude account" })})`));
+  const families = gatedFamilies(loadUsage()?.model ?? null, cfg.policy.switchModels);
+  const bars = effectiveBars(cfg, { accounts: idx.accounts, now, switchFamilies: families });
+  console.log(c.dim(`thresholds 5h ${cfg.thresholds.session.join("/")}% (at ${bars.session + cfg.policy.projectionMargin}%) weekly ${cfg.thresholds.weekly}%  (${count({ n: idx.accounts.length, noun: "claude account" })})`));
   console.log();
 
   const displayAccounts = sortBy(idx.accounts, [(a) => (a.needsReauth ? 1 : 0), (a) => earliestReset(a, now)]);
@@ -110,7 +112,7 @@ export async function cmdStatus(force = false, preRender?: () => void): Promise<
     const badges: string[] = [];
     if (active) badges.push(c.green("active"));
     if (a.needsReauth) badges.push(c.red("needs-reauth"));
-    if (isExhausted(a, { now, thresholds: effectiveBars(cfg), currentAccountUuid: idx.activeAccountUuid, switchFamilies: cfg.policy.switchModels }))
+    if (isExhausted(a, { now, thresholds: bars, currentAccountUuid: idx.activeAccountUuid, switchFamilies: families }))
       badges.push(c.yellow("exhausted"));
 
     const tier = claudeTierLabel(a);
@@ -187,7 +189,7 @@ async function renderCodexSection(input: {
     const badges: string[] = [];
     if (active) badges.push(c.green("active"));
     if (account.needsReauth) badges.push(c.red("needs-reauth"));
-    if (isCodexExhausted({ account, thresholds: effectiveBars(cfg), now })) badges.push(c.yellow("exhausted"));
+    if (isCodexExhausted({ account, thresholds: terminalBars(cfg), now })) badges.push(c.yellow("exhausted"));
     console.log(`${marker} ${c.bold(account.label)}${account.planType ? ` ${c.dim(account.planType)}` : ""}${badges.length ? ` ${badges.join(" ")}` : ""}`);
 
     const usage = account.lastUsage;

package/src/cli/switch.ts

@@ -1,10 +1,11 @@
 import { withLock } from "../lib/lock.ts";
 import { paths } from "../lib/paths.ts";
-import { loadAccounts, loadConfig } from "../lib/state.ts";
+import { loadAccounts, loadConfig, loadUsage } from "../lib/state.ts";
 import { readOAuthAccount } from "../lib/claudejson.ts";
 import { performSwap } from "../lib/swap.ts";
 import { currentWins, effectiveBars, pickBest, pickEarliestReset, weeklyExpiry, type PickCtx } from "../lib/picker.ts";
 import { InvalidGrantError } from "../lib/oauth.ts";
+import { gatedFamilies } from "../lib/usage.ts";
 import { findAccount } from "./rename.ts";
 import { c, fmtReset } from "./render.ts";
 import type { Account } from "../lib/types.ts";
@@ -44,9 +45,16 @@ export async function cmdSwitch(selector?: string): Promise<number> {
       return swapTo(target);
     }
 
-    const everyone: PickCtx = { now, thresholds: effectiveBars(cfg), currentAccountUuid: null, switchFamilies: cfg.policy.switchModels };
+    const switchFamilies = gatedFamilies(loadUsage()?.model ?? null, cfg.policy.switchModels);
+    const everyoneIn = (accounts: Account[]): PickCtx => ({
+      now,
+      thresholds: effectiveBars(cfg, { accounts, now, switchFamilies }),
+      currentAccountUuid: null,
+      switchFamilies,
+    });
     while (true) {
       const cur = loadAccounts();
+      const everyone = everyoneIn(cur.accounts);
       const active =
         (claimedOrg != null ? cur.accounts.find((a) => a.organizationUuid === claimedOrg) : null) ??
         cur.accounts.find((a) => a.accountUuid === cur.activeAccountUuid) ??
@@ -74,7 +82,7 @@ export async function cmdSwitch(selector?: string): Promise<number> {
     }
 
     const fresh = loadAccounts();
-    const earliest = pickEarliestReset(fresh.accounts, everyone);
+    const earliest = pickEarliestReset(fresh.accounts, everyoneIn(fresh.accounts));
     if (!earliest) {
       const reauth = fresh.accounts.filter((a) => a.needsReauth).map((a) => a.label);
       if (reauth.length > 0) { console.error(c.yellow(`no switchable account - reauth needed (run \`tokenmaxxing auth --all\`): ${reauth.join(", ")}`)); return 1; }

package/src/entries/codexstophook.ts

@@ -10,7 +10,7 @@ import { livingCodexPresences } from "../lib/codexpresence.ts";
 import { liveCodexAccountId } from "../lib/codexsample.ts";
 import { loadCodexAccounts } from "../lib/codexstate.ts";
 import { loadConfig } from "../lib/state.ts";
-import { effectiveBars } from "../lib/picker.ts";
+import { terminalBars } from "../lib/picker.ts";
 import { CODEX_SUPERVISOR_ID_ENV } from "./codexsupervisor.ts";
 import { CodexReconcileMarkerSchema, CodexRespawnMarkerSchema, CodexStopStdinSchema, type CodexAccount } from "../lib/types.ts";
 import { log } from "../lib/log.ts";
@@ -51,7 +51,7 @@ function promoteReconcileLocked(input: { supervisorId: string; sessionId: string
     return false;
   }
   const now = Date.now();
-  const bars = effectiveBars(loadConfig());
+  const bars = terminalBars(loadConfig());
   const index = loadCodexAccounts();
   const unusable = (account: CodexAccount): boolean =>
     account.needsReauth === true || isCodexExhausted({ account, thresholds: bars, now });

package/src/lib/codexdecide.ts

@@ -13,7 +13,7 @@ import { fetchCodexUsage } from "./codexusage.ts";
 import { codexIdentityOf, isCodexAccessExpiring, readLiveCodexAuth, writeLiveCodexAuth, writeParkedCodexAuth } from "./codexauth.ts";
 import { liveCodexAccountId } from "./codexsample.ts";
 import { livingCodexPresences, presentCodexAccountIds, targetableCodexAccounts } from "./codexpresence.ts";
-import { effectiveBars } from "./picker.ts";
+import { terminalBars } from "./picker.ts";
 import { log } from "./log.ts";
 import { CodexAccountSchema, CodexReconcileMarkerSchema, type CodexAccount } from "./types.ts";
 
@@ -100,7 +100,7 @@ function postSwapResweep(input: { liveAccountId: string; bars: { session: number
 export async function evaluateAndMaybeSwapCodex(input: { now?: number }): Promise<CodexSwapDecision> {
   const now = input.now ?? Date.now();
   const cfg = loadConfig();
-  const bars = effectiveBars(cfg);
+  const bars = terminalBars(cfg);
 
   return withLock(codexPaths.lockFile, async () => {
     let index = loadCodexAccounts();

package/src/lib/decide.ts

@@ -5,11 +5,11 @@ import { paths } from "./paths.ts";
 import { MAX_CHECK_DELAY_MS, loadAccounts, loadConfig, loadDepletedWait, loadLastSwapAt, loadUsage, loadModelUsage, saveAccounts, saveDepletedWait, saveModelUsage, usageTeeAt, writeUsage } from "./state.ts";
 import { readOAuthAccount } from "./claudejson.ts";
 import { chooseAndSwap, performSwap } from "./swap.ts";
-import { currentWins, effectiveBars, hardBars, isExhausted, nextWeeklyReset, pickBest, pickEarliestReset, usableAt } from "./picker.ts";
+import { currentWins, effectiveBars, hardBars, isExhausted, nextWeeklyReset, pickBest, pickEarliestReset, sessionLadder, usableAt } from "./picker.ts";
 import { InvalidGrantError } from "./oauth.ts";
 import { familyTokens, gatedFamilies, probeUsage, type EnforcedClass } from "./usage.ts";
 import { log } from "./log.ts";
-import { AccountSchema, ModelUsageStateSchema, UsageStateSchema, type Account, type Config, type EnforcedLimit, type ModelUsageState, type UsageState, type UsageWindow } from "./types.ts";
+import { AccountSchema, ModelUsageStateSchema, UsageStateSchema, type Account, type Config, type EnforcedLimit, type ModelUsageState, type Thresholds, type UsageState, type UsageWindow } from "./types.ts";
 
 const SwapDecisionSchema = z.object({
   swapped: z.boolean(),
@@ -36,9 +36,17 @@ function capForFamily(mu: ModelUsageState, family: string, now: number): UsageWi
   return maxBy(rows, (w) => liveUsed({ window: w, windowMs: WEEK_MS, sampledAt: mu.sampledAt ?? mu.ts, now }));
 }
 
-function isOver(u: UsageState | null, mu: ModelUsageState | null, org: string | null, cfg: Config, now: number): boolean {
+function overlayLive(accounts: Account[], u: UsageState | null, mu: ModelUsageState | null, org: string | null): Account[] {
+  return accounts.map((a) => {
+    if (org == null || a.organizationUuid !== org) return a;
+    const live = u && u.org === org ? { lastUsage: { fiveHour: u.fiveHour, sevenDay: u.sevenDay }, lastUsageAt: u.ts } : {};
+    const perModel = mu && mu.org === org && Object.keys(mu.perModel).length > 0 ? { lastPerModel: mu.perModel, lastPerModelAt: mu.sampledAt ?? mu.ts } : {};
+    return { ...a, ...live, ...perModel };
+  });
+}
+
+function isOver(u: UsageState | null, mu: ModelUsageState | null, org: string | null, bars: Thresholds, cfg: Config, now: number): boolean {
   if (!u || !org || u.org !== org) return false;
-  const bars = effectiveBars(cfg);
   if (
     liveUsed({ window: u.fiveHour, windowMs: FIVE_HOURS_MS, sampledAt: u.ts, now }) >= bars.session ||
     liveUsed({ window: u.sevenDay, windowMs: WEEK_MS, sampledAt: u.ts, now }) >= bars.weekly
@@ -56,9 +64,9 @@ function needsPerModel(u: UsageState | null, cfg: Config): boolean {
   return u != null && gatedFamilies(u.model, cfg.policy.switchModels).length > 0;
 }
 
-function isEngaged(u: UsageState | null, mu: ModelUsageState | null, org: string | null, cfg: Config, now: number): boolean {
+function isEngaged(u: UsageState | null, mu: ModelUsageState | null, org: string | null, bars: Thresholds, cfg: Config, now: number): boolean {
   if (!u || !org || u.org !== org) return false;
-  return liveUsed({ window: u.fiveHour, windowMs: FIVE_HOURS_MS, sampledAt: u.ts, now }) >= cfg.policy.greedySessionFloor || isOver(u, mu, org, cfg, now);
+  return liveUsed({ window: u.fiveHour, windowMs: FIVE_HOURS_MS, sampledAt: u.ts, now }) >= cfg.policy.greedySessionFloor || isOver(u, mu, org, bars, cfg, now);
 }
 
 const SnapshotsSchema = z.object({
@@ -120,8 +128,13 @@ export async function evaluateAndMaybeSwap(now = Date.now(), anticipatory = fals
   const cfg = loadConfig();
 
   const { u: usage, mu } = await loadFreshSnapshots(cfg, activeOrg, now);
+  const bars0 = effectiveBars(cfg, {
+    accounts: overlayLive(loadAccounts().accounts, usage, mu, activeOrg),
+    now,
+    switchFamilies: gatedFamilies(usage?.model ?? null, cfg.policy.switchModels),
+  });
 
-  if (!enforced0 && !isEngaged(usage, mu, activeOrg, cfg, now)) {
+  if (!enforced0 && !isEngaged(usage, mu, activeOrg, bars0, cfg, now)) {
     const measured = usage != null && activeOrg != null && usage.org === activeOrg;
     if (!measured) {
       const replay = depletedReplay(now);
@@ -157,7 +170,12 @@ export async function evaluateAndMaybeSwap(now = Date.now(), anticipatory = fals
       if (sampled) saveAccounts(idx);
     }
 
-    if (!enforced2 && !isEngaged(u2, mu2, org2, cfg, now)) {
+    const gated = gatedFamilies(u2?.model ?? null, cfg.policy.switchModels);
+    const switchFamilies = enforced2?.family && !gated.includes(enforced2.family) ? [...gated, enforced2.family] : gated;
+    const barsOf = (accounts: Account[]): Thresholds => effectiveBars(cfg, { accounts, now, switchFamilies });
+    const bars = barsOf(idx.accounts);
+
+    if (!enforced2 && !isEngaged(u2, mu2, org2, bars, cfg, now)) {
       return depletedReplay(now) ?? { swapped: false, account: null, reason: "raced-already-swapped" };
     }
 
@@ -166,14 +184,11 @@ export async function evaluateAndMaybeSwap(now = Date.now(), anticipatory = fals
       idx2.accounts.find((a) => a.accountUuid === idx2.activeAccountUuid) ??
       null;
 
-    const gated = gatedFamilies(u2?.model ?? null, cfg.policy.switchModels);
-    const switchFamilies = enforced2?.family && !gated.includes(enforced2.family) ? [...gated, enforced2.family] : gated;
-
-    if (!enforced2 && !isOver(u2, mu2, org2, cfg, now)) {
-      const ctxAll = { now, thresholds: effectiveBars(cfg), currentAccountUuid: null, switchFamilies };
+    const greedy = async (): Promise<SwapDecision> => {
       while (true) {
         const cur = loadAccounts();
         const active = seatOf(cur);
+        const ctxAll = { now, thresholds: barsOf(cur.accounts), currentAccountUuid: null, switchFamilies };
         if (currentWins(active, cur.accounts, ctxAll)) {
           return { swapped: false, account: null, reason: "current-best" };
         }
@@ -188,10 +203,24 @@ export async function evaluateAndMaybeSwap(now = Date.now(), anticipatory = fals
         log("decide.greedy_swap", { account: best.accountUuid.slice(0, 8) });
         return { swapped: true, account: best, reason: "swapped" };
       }
-    }
+    };
+    if (!enforced2 && !isOver(u2, mu2, org2, bars, cfg, now)) return greedy();
 
-    const landed = await chooseAndSwap({ now, thresholds: effectiveBars(cfg), switchFamilies, currentAccountUuid: seatOf(loadAccounts())?.accountUuid ?? null });
-    if (landed) return { swapped: true, account: landed, reason: "swapped" };
+    while (true) {
+      const cur = loadAccounts();
+      const seat = seatOf(cur);
+      const thresholds = barsOf(cur.accounts);
+      if (!enforced2 && seat && !seat.needsReauth && !isExhausted(seat, { now, thresholds, currentAccountUuid: null, switchFamilies })) return greedy();
+      const best = pickBest(cur.accounts, { now, thresholds, currentAccountUuid: seat?.accountUuid ?? null, switchFamilies });
+      if (!best) break;
+      try {
+        await performSwap(best);
+      } catch (e) {
+        if (e instanceof InvalidGrantError) continue;
+        throw e;
+      }
+      return { swapped: true, account: best, reason: "swapped" };
+    }
 
     const hardCtx = { now, thresholds: hardBars(cfg), currentAccountUuid: null, switchFamilies };
     const seat = seatOf(loadAccounts());
@@ -315,6 +344,7 @@ export async function recordEnforcedLimit(input: { limit: EnforcedClass; org: st
 
 export const CHECK_DELAY_FLOOR_MS = 60_000;
 const CHECK_DELAY_UNKNOWN_MS = 180_000;
+const STAGE_CEILING_MS = [MAX_CHECK_DELAY_MS, 180_000, 120_000];
 
 export function checkDelayMs(input: { cfg: Config; org: string | null; now: number; decision: SwapDecision }): number {
   const { cfg, org, now, decision } = input;
@@ -323,21 +353,24 @@ export function checkDelayMs(input: { cfg: Config; org: string | null; now: numb
   if (swapAt != null && now - swapAt < POST_SWAP_COOLDOWN_MS) return swapAt + POST_SWAP_COOLDOWN_MS - now;
   const u = loadUsage();
   if (!org || !u || !usageFresh(u, org, cfg.policy.usagePollTtlMs, now)) return CHECK_DELAY_UNKNOWN_MS;
-  const bars = effectiveBars(cfg);
+  const mu = loadModelUsage();
+  const muSame = mu && mu.org === org ? mu : null;
+  const families = gatedFamilies(u.model, cfg.policy.switchModels);
+  const bars = effectiveBars(cfg, { accounts: overlayLive(loadAccounts().accounts, u, muSame, org), now, switchFamilies: families });
   const heads = [
     bars.session - liveUsed({ window: u.fiveHour, windowMs: FIVE_HOURS_MS, sampledAt: u.ts, now }),
     bars.weekly - liveUsed({ window: u.sevenDay, windowMs: WEEK_MS, sampledAt: u.ts, now }),
   ];
-  const mu = loadModelUsage();
-  const muSame = mu && mu.org === org ? mu : null;
   let capMissing = false;
   const capFresh = muSame != null && now - (muSame.sampledAt ?? muSame.ts) <= cfg.policy.usagePollTtlMs;
-  for (const family of gatedFamilies(u.model, cfg.policy.switchModels)) {
+  for (const family of families) {
     const cap = muSame && capFresh ? capForFamily(muSame, family, now) : undefined;
     if (cap && muSame) heads.push(bars.weekly - liveUsed({ window: cap, windowMs: WEEK_MS, sampledAt: muSame.sampledAt ?? muSame.ts, now }));
     else capMissing = true;
   }
   const headroom = Math.min(...heads);
   const banded = headroom >= 40 ? MAX_CHECK_DELAY_MS : headroom >= 20 ? 180_000 : headroom >= 8 ? 120_000 : CHECK_DELAY_FLOOR_MS;
-  return capMissing ? Math.min(banded, 120_000) : banded;
+  const stage = sessionLadder(cfg).indexOf(bars.session);
+  const staged = Math.min(banded, STAGE_CEILING_MS[stage] ?? CHECK_DELAY_FLOOR_MS);
+  return capMissing ? Math.min(staged, 120_000) : staged;
 }

package/src/lib/picker.ts

@@ -3,13 +3,26 @@ import { z } from "zod";
 import { familyTokens } from "./usage.ts";
 import { AccountSchema, ThresholdsSchema, type Account, type Config, type Thresholds, type UsageWindow } from "./types.ts";
 
-export function effectiveBars(cfg: Config): Thresholds {
+export function sessionLadder(cfg: Config): number[] {
+  return cfg.thresholds.session.map((rung) => rung - cfg.policy.projectionMargin);
+}
+
+export function terminalBars(cfg: Config): Thresholds {
   return {
-    session: cfg.thresholds.session - cfg.policy.projectionMargin,
+    session: Math.max(...sessionLadder(cfg)),
     weekly: cfg.thresholds.weekly - cfg.policy.projectionMargin,
   };
 }
 
+export function effectiveBars(cfg: Config, pool: { accounts: Account[]; now: number; switchFamilies: string[] }): Thresholds {
+  const top = terminalBars(cfg);
+  const holdsAt = (session: number) =>
+    pool.accounts.some(
+      (a) => !a.needsReauth && !isExhausted(a, { now: pool.now, thresholds: { session, weekly: top.weekly }, currentAccountUuid: null, switchFamilies: pool.switchFamilies }),
+    );
+  return { session: sessionLadder(cfg).find(holdsAt) ?? top.session, weekly: top.weekly };
+}
+
 export function hardBars(cfg: Config): Thresholds {
   return {
     session: cfg.hardThresholds.session - cfg.policy.projectionMargin,

package/src/lib/state.ts

@@ -9,6 +9,7 @@ import {
   LastSwapSchema,
   ModelUsageStateSchema,
   NextCheckSchema,
+  SessionLadderSchema,
   UsageStateSchema,
   type AccountsIndex,
   type Config,
@@ -17,7 +18,7 @@ import {
 } from "./types.ts";
 
 const DEFAULT_CONFIG: Config = {
-  thresholds: { session: 95, weekly: 98 },
+  thresholds: { session: [50, 80, 95], weekly: 98 },
   hardThresholds: { session: 100, weekly: 100 },
   claudeBin: "",
   codexBin: "",
@@ -28,7 +29,7 @@ const PercentSchema = z.number().min(0).max(100);
 
 export const ConfigFileSchema = z
   .object({
-    thresholds: z.object({ session: PercentSchema, weekly: PercentSchema }).partial(),
+    thresholds: z.object({ session: SessionLadderSchema, weekly: PercentSchema }).partial(),
     hardThresholds: z.object({ session: PercentSchema, weekly: PercentSchema }).partial(),
     claudeBin: z.string(),
     codexBin: z.string(),

package/src/lib/types.ts

@@ -1,3 +1,4 @@
+import { isEqual, uniq } from "es-toolkit";
 import { z } from "zod";
 
 const OAuthCredsSchema = z.looseObject({
@@ -99,9 +100,21 @@ export const ThresholdsSchema = z.object({
 });
 export type Thresholds = z.infer<typeof ThresholdsSchema>;
 
+export const SessionLadderSchema = z
+  .array(z.number().min(0).max(100))
+  .min(1)
+  .refine((rungs) => isEqual(rungs, uniq(rungs).toSorted((a, b) => a - b)), {
+    message: "thresholds.session rungs must be strictly ascending",
+  });
+
+export const ScreeningThresholdsSchema = z.object({
+  session: SessionLadderSchema,
+  weekly: z.number().min(0).max(100),
+});
+
 export const ConfigSchema = z
   .object({
-    thresholds: ThresholdsSchema,
+    thresholds: ScreeningThresholdsSchema,
     hardThresholds: ThresholdsSchema,
     claudeBin: z.string(),
     codexBin: z.string(),
@@ -113,11 +126,11 @@ export const ConfigSchema = z
       maxWaitMs: z.number().int().positive(),
     }),
   })
-  .refine((cfg) => cfg.policy.projectionMargin < Math.min(cfg.thresholds.session, cfg.thresholds.weekly), {
-    message: "policy.projectionMargin must be strictly below both thresholds (effectiveBars would hit zero and every account would read as exhausted)",
+  .refine((cfg) => cfg.policy.projectionMargin < Math.min(...cfg.thresholds.session, cfg.thresholds.weekly), {
+    message: "policy.projectionMargin must be strictly below every threshold (effectiveBars would hit zero and every account would read as exhausted)",
   })
-  .refine((cfg) => cfg.hardThresholds.session >= cfg.thresholds.session && cfg.hardThresholds.weekly >= cfg.thresholds.weekly, {
-    message: "hardThresholds (the Layer 2 wall) must be at or above thresholds (the Layer 1 screening bars) for both windows",
+  .refine((cfg) => cfg.hardThresholds.session >= Math.max(...cfg.thresholds.session) && cfg.hardThresholds.weekly >= cfg.thresholds.weekly, {
+    message: "hardThresholds (the Layer 2 wall) must be at or above thresholds (the Layer 1 screening bars, the top session rung) for both windows",
   });
 export type Config = z.infer<typeof ConfigSchema>;