Window keeper: keep the windows, recover dead tokens, say why

Goal

Every Claude account keeps an open 5h window during active hours, even with the lid closed. When the keeper cannot open a window, the card says why and offers the fix. A dead token chain never leaves a dead token in service. The Codex account reads usage again.

Evidence (running 0.107.3 == origin/master 9def67c)

• Fleet-wide: usage_monitor.py:2114-2117 counts nominal 5s sleeps. Under clamshell dark wakes the sweep ran 15:00, 16:48, 18:14 UTC on 10-26 while the 10-min poller ran 8 times. Windows lapse for every account while the lid is closed.
• Account 1: CC invalid_grant on 10-22 10:22:14. auth.py:518-528 nulls only cc_refresh_token; the dead cc_access_token stays. Keeper pings 401 and skips recovery (usage_monitor.py:2008 needs cc_refresh_token). Poller sends the dead token every cycle (:1879); each 401/429 renews the PRIMARY chain under a cc_429 label: ~140 needless renewals/day. 10-17..10-21: 429 on every ping, body discarded, cause unrecoverable.
• Backoff: in-memory, keyed by id, survived the 22:05:51 re-auth.
• Cache lag: post-ping fetch is paced, so the card says "no active window" for an open window (145 of 148 repeat pings followed a success).
• Codex: service PATH is system-only; codex/usage.py:257 shutil.which misses ~/.local/bin/codex. Frozen since 2026-09-05. _validate_codex_account wipes the error.
• Data integrity: auth.py:498 invalid_grant live recovery imports on the stamp alone, without _live_tokens_belong_to.

Workstreams (parallel worktrees, unit tests only per builder)

A. Keeper scheduling and recovery + UI reason (PR 1)

• Wall-clock deadline sleep in the sweep loop; prewake fires once per local date (persisted marker), on the first sweep at or after prewake.
• ping_account returns a PingResult (status, error type, message[:200], request id, retry-after, unified rate-limit reset headers, transport flag); values-free log line.
• Recovery ladder: 401/403 forces rotation of the chain that owns the failing token (new force= on refresh_cc_token, explicit result enum), re-ping once, then ping with the primary token, then persist needs_reauth. 429 schedules from retry-after / reset header. Transport errors retry short and do not escalate. Per-account try/except.
• Backoff stores the token fingerprint; a changed token drops it. Re-auth / CC-token store / reconcile import clear it and set _sweep_wake.
• After a successful ping, persist the window (reset header, else an explicit bounded post-ping fetch bypass) using the token that succeeded.
• Persist per-account keeper state (last ping time/status/error type/failures/skip reason) and add it to the accounts payload.
• UI: the reset column shows the reason (re-auth needed, retrying at HH:MM, paused until 06:00, no Claude Code token, usage unreadable since DATE) with the existing re-auth control; a past reset gives no elapsed marker; stale rows render muted "last read DATE". /qa in a browser after.

B. Token chain correctness (PR 2)

• CC invalid_grant without recovery nulls cc_access_token and cc_expires_at too, and records the CC chain as needing re-auth.
• _refresh_token_flow resolves a chain (cc | primary) once under the lock and uses it for columns, invalid_grant handling, log text, and the early-return token. Per-chain breaker columns with a migration.
• Usage poller: a token rejection renews only the chain that owns that token; with no live CC chain, poll with the primary token. The 429 rotation guard spans several poll periods and N consecutive 429s.
• Live-recovery import calls _live_tokens_belong_to; one shared stamp+ownership helper for reconcile, authority guard, and this path.
• Null five_hour/seven_day or null resets_at: no AttributeError; clear the stale reset.
• Token exchange tells not-sent (DNS/connect) from reply-lost (read timeout); heal sweep does not clear a network breaker while the network is down.
• Background refresher reports exchanged vs skipped.

C. User CLIs under the service PATH (PR 3)

• All service-reachable user-CLI lookups (codex/usage.py, codex/switching.py, codex/accounts.py, codex/_fsutil.py, dcr_settings.py, skill_listing.py, memory/merge_capture.py) go through findbin.find_bin, with the WIP name guard folded in. Guard test bans new bare shutil.which for user CLIs in service modules.
• Codex usage failures live in their own fields; validation no longer wipes them.

Gates and proof

1. Builders run only the unit tests for their files.
2. Combine the three branches on one integration branch; run the full local CI pipeline once; /dcr (LARGE) and /cso beside it.
3. Live proof: install the build, close the lid 30+ min, confirm sweep heartbeats every ~5 min of wall time and open windows on wake; Codex card shows current usage; a forced-dead CC token row self-recovers or shows "re-auth needed".

Filed, not fixed here

• Why the CC chains died on 10-12 and 10-22 is not proven (network loss fits 10-22, not 10-12). The reply-lost classification above adds the evidence; an issue tracks the proof.
• Reconcile ordering by expiry only (credential_helpers.py:575) when the row token is known dead.