pitboard-core 0.10.0

//! `pitboard status`: who is signed in, what each account has left, and which accounts can
//! be switched to.
//!
//! Numbers are asked of each tool's own service and never read from a tool's cache. Claude
//! Code's is stamped with the account its config names, whichever login it was asked with.
//! Every account is asked at once, so the command costs one round trip, not one per account.
//!
//! Every row says which tool it belongs to. There is no such thing as "the account signed
//! in on this machine": each tool has a live login of its own or none, and a row is about
//! exactly one of them.

use crate::api::{self, ApiError, Owner};
use crate::context::Context;
use crate::error::Cause;
use crate::in_use::{self, InUse};
use crate::provider::claude::paths as claude;
use crate::provider::{ProviderError, ProviderId};
use crate::state::{Key, Park, State};
use crate::switch::identify;
use crate::usage::{Snapshot, Source};
use crate::{budget, park, readings};
use serde_json::Value;
use std::collections::{BTreeMap, HashMap};

/// Why a reading is not live.
#[derive(Debug, Clone, Copy, PartialEq, Eq, serde::Serialize)]
#[serde(rename_all = "snake_case")]
#[non_exhaustive]
pub enum Stale {
    NothingSignedIn,
    /// The tool's live login is there to be read and could not be: a keychain that is
    /// locked for the moment, a store the tool's configuration puts where Pitboard does not
    /// reach. Never the same as nothing signed in, which would tell somebody their login is
    /// gone when it is only out of reach.
    LoginUnreadable,
    /// The tool's live login was read and is not one account's login Pitboard can park or
    /// switch: signed in with an API key rather than an account, or a Codex login whose
    /// tokens belong to one account and whose account id names another. Something is
    /// signed in, so saying nobody is would send somebody to sign in again for nothing.
    LoginUnusable,
    /// The tool's own session has expired; its next call renews it.
    SessionExpired,
    /// A parked login's access token has expired and could not be renewed this time.
    ParkedAccessExpired,
    NothingParked,
    /// Nothing parked, because a sign-in outside Pitboard replaced the account's only login:
    /// its tool's store held it, and its service then named another login there, or none.
    /// Pitboard keeps no copy of a login in use, so nothing brings it back.
    LoginReplaced,
    ParkUnreadable,
    RateLimited,
    Unreachable,
    /// The service answered badly and may answer well later.
    ServerError,
    /// The service's answer was not in a shape Pitboard understands, which means the shape
    /// moved. Asking again produces the same thing.
    AnswerNotUnderstood,
    /// The service will not accept this parked login again.
    LoginRefused,
    /// Asked recently enough that the answer cannot have moved by a percentage point, so
    /// the number shown is the one already measured rather than a new request.
    AskedRecently,
    /// The thread that was asking stopped before it answered. Nothing to do with the
    /// service, which is why it used to be filed under the same code as a bad answer.
    Interrupted,
    /// Nobody was asked: this reading was taken without touching the network.
    NotAsked,
}

impl Stale {
    /// Three answers used to arrive here as one. A front end deciding whether to ask
    /// again needs to tell a bad morning at the service from an answer whose shape moved
    /// from a login that is finished, and could not.
    fn of(error: &ApiError, signed_in: bool) -> Stale {
        match Cause::of(error) {
            Cause::TokenExpired if signed_in => Stale::SessionExpired,
            Cause::TokenExpired => Stale::ParkedAccessExpired,
            Cause::RateLimited => Stale::RateLimited,
            Cause::Unreachable => Stale::Unreachable,
            Cause::ServerError => Stale::ServerError,
            Cause::AnswerNotUnderstood => Stale::AnswerNotUnderstood,
            Cause::LoginRefused => Stale::LoginRefused,
        }
    }

    /// Stable, for a program to branch on; the same as its JSON form.
    pub fn code(self) -> &'static str {
        match self {
            Stale::NothingSignedIn => "nothing_signed_in",
            Stale::LoginUnreadable => "login_unreadable",
            Stale::LoginUnusable => "login_unusable",
            Stale::SessionExpired => "session_expired",
            Stale::ParkedAccessExpired => "parked_access_expired",
            Stale::NothingParked => "nothing_parked",
            Stale::LoginReplaced => "login_replaced",
            Stale::ParkUnreadable => "park_unreadable",
            Stale::RateLimited => "rate_limited",
            Stale::Unreachable => "unreachable",
            Stale::ServerError => "server_error",
            Stale::AnswerNotUnderstood => "answer_not_understood",
            Stale::LoginRefused => "login_refused",
            Stale::AskedRecently => "asked_recently",
            Stale::Interrupted => "interrupted",
            Stale::NotAsked => "not_asked",
        }
    }

    /// What is worth a word, in the default tool's words.
    ///
    /// For a caller holding a code and nothing else. A row knows its own tool, and
    /// [`Row::explanation`] says it in that tool's words.
    pub fn explanation(self) -> Option<&'static str> {
        self.explanation_for(crate::label::DEFAULT)
    }

    /// Only what is worth a word: a parked login going quiet is how parking works.
    ///
    /// Named for the tool the row belongs to. "Anthropic could not be reached" said about a
    /// Codex account sends somebody to check the wrong service, and "`claude` renews it"
    /// said about a Codex session names a program that has nothing to do with it.
    pub fn explanation_for(self, provider: ProviderId) -> Option<&'static str> {
        // A sentence per tool rather than one assembled at run time, so every word a person
        // reads is here to be read, and Claude Code's are exactly what they always were.
        let per_tool = |claude: &'static str, codex: &'static str| match provider {
            ProviderId::Claude => claude,
            ProviderId::Codex => codex,
        };
        match self {
            Stale::NothingSignedIn => Some("nothing is signed in"),
            Stale::LoginUnreadable => Some(per_tool(
                "Claude Code's login could not be read; run `pitboard doctor`",
                "Codex's login could not be read; run `pitboard doctor`",
            )),
            Stale::LoginUnusable => Some(per_tool(
                "Claude Code's login is not one Pitboard can park or switch; run `pitboard doctor`",
                "Codex's login is not one Pitboard can park or switch; run `pitboard doctor`",
            )),
            Stale::SessionExpired => Some(per_tool(
                "Claude Code's session has expired; `claude` renews it",
                "Codex's session has expired; `codex` renews it",
            )),
            Stale::ParkedAccessExpired | Stale::NothingParked => None,
            Stale::LoginReplaced => {
                Some("its login was replaced by a sign-in outside Pitboard; sign in again")
            }
            Stale::ParkUnreadable => Some("its parked login cannot be read; run `pitboard doctor`"),
            Stale::RateLimited => Some(per_tool(
                "Anthropic is rate limiting usage checks",
                "OpenAI is rate limiting usage checks",
            )),
            Stale::Unreachable => Some(per_tool(
                "Anthropic could not be reached",
                "OpenAI could not be reached",
            )),
            Stale::ServerError => Some(per_tool(
                "Anthropic answered with an error; try again later",
                "OpenAI answered with an error; try again later",
            )),
            Stale::AnswerNotUnderstood => Some(per_tool(
                "Anthropic's answer was not understood",
                "OpenAI's answer was not understood",
            )),
            Stale::LoginRefused => Some("its parked login is no longer accepted; sign in again"),
            // Not worth a word: it is the ordinary state of a number that is
            // already as true as asking again would make it.
            Stale::AskedRecently => None,
            Stale::Interrupted => Some("the check did not finish"),
            Stale::NotAsked => Some(per_tool(
                "read without asking Anthropic",
                "read without asking OpenAI",
            )),
        }
    }
}

pub struct Row {
    /// Which tool this account belongs to, or whose live login this row is.
    ///
    /// Every row has one, including a login nobody has enrolled and a login that could not
    /// be read, so a front end can always say which tool a row is about and what to type to
    /// act on it. A hint that said `pitboard enroll work --sign-in` about a Codex account
    /// would have enrolled a Claude Code one.
    pub provider: ProviderId,
    /// `None` for a login nothing has enrolled: one that is signed in, or one Pitboard
    /// could not pin on any account (see [`Row::unplaced`]).
    pub label: Option<String>,
    pub email: String,
    /// What the account's readings and budget are filed under. Empty where
    /// [`Row::account_uuid`] is.
    pub id: String,
    pub account_uuid: String,
    /// The Claude organisation the login is for. `None` for another tool's account.
    pub organization_uuid: Option<String>,
    pub signed_in: bool,
    pub parked: Option<Park>,
    pub usage: Option<Snapshot>,
    pub stale: Option<Stale>,
}

impl Row {
    /// How long this account lasts as of `now`, from its limits' paces: the question this
    /// whole tool exists to answer is which account to use next, and a share alone does not
    /// answer it. 73% of a weekly limit is plenty on Saturday and a warning on Monday. An
    /// account not in use is not being used, so it lasts until its first reset.
    pub fn lasts(&self, now: i64) -> Option<crate::pace::Lasts<'_>> {
        let usage = self.usage.as_ref()?;
        if self.signed_in {
            crate::pace::lasts(&usage.windows, usage.observed_at.unwrap_or(now), now)
        } else {
            crate::pace::until_reset(&usage.windows, now)
        }
    }

    /// Whether `pitboard use` would switch to it now.
    pub fn switchable(&self, now: i64) -> bool {
        !self.signed_in && self.parked.as_ref().is_some_and(|p| p.restorable_at(now))
    }

    /// The account, the way Pitboard tells accounts apart. `None` for a row nothing has
    /// enrolled.
    pub fn key(&self) -> Option<Key> {
        self.label
            .as_ref()
            .map(|label| Key::new(self.provider, label.clone()))
    }

    /// What to tell a person about [`Row::stale`], in the words of this row's own tool.
    pub fn explanation(&self) -> Option<&'static str> {
        self.stale
            .and_then(|stale| stale.explanation_for(self.provider))
    }

    /// A tool's live login that Pitboard could not pin on any account: one it could not
    /// read, or read and could not use. It has no email and no account id, and nothing to
    /// type about it but `pitboard doctor`, so a front end says what it is rather than
    /// showing it as an account nobody has enrolled.
    pub fn unplaced(&self) -> bool {
        self.label.is_none()
            && !self.signed_in
            && matches!(
                self.stale,
                Some(Stale::LoginUnreadable | Stale::LoginUnusable)
            )
    }
}

pub struct Report {
    pub now: i64,
    pub rows: Vec<Row>,
    /// Who the default tool's live login belongs to, as its service says, or offline as it
    /// last said. Every tool's answer is in the rows.
    pub signed_in: Result<Owner, String>,
    /// Which credential slot this report speaks for.
    ///
    /// `CLAUDE_CONFIG_DIR` selects a different keychain item, so "who is signed in" is a
    /// fact about one slot and not about the machine. Accounts and their parked logins
    /// belong to the machine; what is in use does not. This report used to name accounts
    /// without ever saying which slot it was speaking for, so on a machine with a second
    /// config directory it was silently answering about one of them.
    pub slot: Slot,
}

/// A credential slot, named.
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct Slot {
    /// The keychain item, which is what actually selects the login.
    pub service: String,
    /// Whether this is the one a `claude` with no `CLAUDE_CONFIG_DIR` reads.
    pub default: bool,
}

/// What is true of one tool's live login.
///
/// Per tool, because there is no such thing as "the account signed in on this machine": a
/// Claude Code login and a Codex login are different programs reading different stores, and
/// neither signs the other out.
#[derive(Default)]
struct LiveLogin {
    /// Whose it is. `None` means nobody is signed in to this tool, but only when
    /// [`Facts::asked`] is true: unasked and absent are different things, and reading one as
    /// the other says the account in use is gone. `Some(Err)` is a login whose owner could
    /// not be learned this time, and says why.
    signed_in: Option<Result<Owner, String>>,
    /// Whose login the store holds as far as Pitboard knows without an answer this time,
    /// which keeps the row in use from reading as though nobody is where nobody could say or
    /// nobody was asked: what its service last said, or what a login that names its own
    /// account names ([`in_use::known`]).
    known: Option<Owner>,
    usage: Option<Result<Snapshot, Stale>>,
    /// There is a login and Pitboard cannot use it: it could not be read, or it was read and
    /// is not one account's login. A tool in this state whose record names none of its
    /// accounts still gets a row, so that nobody reads its silence as nobody signed in.
    out_of_reach: bool,
}

impl LiveLogin {
    fn usage(&self) -> Result<Snapshot, Stale> {
        self.usage.clone().unwrap_or(Err(Stale::NothingSignedIn))
    }
}

/// Everything gathered from the machine and the network, so assembling it touches neither.
struct Facts {
    live: BTreeMap<ProviderId, LiveLogin>,
    asked: bool,
    /// What asking about each account's parked login came to, by the account's id. An
    /// account with none here was not asked about.
    parked: BTreeMap<String, Result<Snapshot, Stale>>,
}

impl Facts {
    fn live_for(&self, which: ProviderId) -> Option<&LiveLogin> {
        self.live.get(&which)
    }
}

/// The parked login to ask about an account with, or why there is none.
///
/// Whether the document holds what a usage call needs is the tool's own question, answered
/// when it is asked: a Codex login keeps its token somewhere a Claude Code login does not.
fn parked_document(
    ctx: &Context,
    key: &Key,
    parked: Option<&Park>,
    now: i64,
) -> Result<Value, Stale> {
    match parked {
        None => Err(Stale::NothingParked),
        Some(p) if !p.askable_at(now) => Err(Stale::ParkedAccessExpired),
        Some(p) => park::load(ctx, key, p).map_err(|_| Stale::ParkUnreadable),
    }
}

/// Which slot this machine's `claude` would read right now.
fn slot_of(ctx: &Context) -> Slot {
    Slot {
        service: claude::live_service(ctx),
        default: claude::is_default_slot(ctx),
    }
}

/// Which tools a report is about: the one a bare name means, which is what Pitboard was
/// before there was a second, and every other tool somebody has enrolled an account of.
///
/// A tool is opted into by enrolling one of its accounts. Until then Pitboard reads nothing
/// of it and asks its service nothing: somebody who uses Pitboard for Claude Code and also
/// has Codex installed has not asked for their Codex login to be read, or sent to OpenAI on
/// every refresh of a menu bar.
fn tools(state: &State) -> Vec<ProviderId> {
    ProviderId::ALL
        .iter()
        .copied()
        .filter(|&which| {
            which == crate::label::DEFAULT || state.accounts.iter().any(|a| a.provider() == which)
        })
        .collect()
}

/// What is known without asking anyone: whose login each tool has stored, as its service last
/// said, and the last numbers Pitboard measured. Touches no network, so it answers at once
/// and works on a train.
///
/// Whose a login is comes from Pitboard's record of what Anthropic last said, and from a
/// Codex login's own claims ([`in_use::known`]). Not from Claude Code's config, which a
/// Claude Code process started or signed in on another login can rewrite with its own
/// account.
pub fn gather_offline(ctx: &Context, state: &State) -> Report {
    let known: BTreeMap<ProviderId, Option<Owner>> = tools(state)
        .into_iter()
        .map(|which| (which, in_use::known(ctx, state, which).owner().cloned()))
        .collect();
    let facts = Facts {
        live: known
            .iter()
            .map(|(&which, owner)| {
                let login = LiveLogin {
                    known: owner.clone(),
                    usage: Some(Err(Stale::NotAsked)),
                    ..LiveLogin::default()
                };
                (which, login)
            })
            .collect(),
        asked: false,
        parked: BTreeMap::new(),
    };
    let remembered = readings::load(ctx);
    Report {
        now: ctx.now(),
        slot: slot_of(ctx),
        rows: assemble(
            state,
            &facts,
            |uuid| remembered.get(uuid).cloned(),
            ctx.now(),
        ),
        signed_in: known
            .get(&crate::label::DEFAULT)
            .cloned()
            .flatten()
            .ok_or_else(|| "not asked".into()),
    }
}

/// What one account's request came to: the reading, and what the budget should learn from
/// it. Recorded by the caller once every request has finished, never from the thread that
/// made it.
type Asked = (Result<Snapshot, Stale>, Option<(String, budget::Outcome)>);

/// One tool's live login as a read finds it: what the tool's own record named, read first,
/// and then the login whole, or why it could not be read.
struct LiveRead {
    named: Option<String>,
    login: Result<Option<Value>, ProviderError>,
}

/// What one tool's live login came to: what its row says, what the budget should learn
/// from asking about it, and whose login the store holds where that was found, to record.
struct Answered {
    login: LiveLogin,
    learned: Option<(String, budget::Outcome)>,
    found: Option<InUse>,
}

impl Answered {
    /// A row from a read that asked no usage, so the budget learns nothing, and found no
    /// owner of the login to record.
    fn learning_nothing(login: LiveLogin) -> Answered {
        Answered {
            login,
            learned: None,
            found: None,
        }
    }
}

/// A provider's failure as the usage path has always classified one.
fn to_api(error: crate::provider::ProviderError) -> ApiError {
    use crate::provider::ProviderError as P;
    match error {
        P::Unauthorized => ApiError::Unauthorized,
        P::RateLimited { retry_after, .. } => ApiError::RateLimited { retry_after },
        P::Network { detail, .. } => ApiError::Network(detail),
        P::Unexpected { status, .. } => ApiError::Unexpected { status },
        P::Malformed { detail, .. }
        | P::ShapeUnexpected { detail, .. }
        | P::Unsupported { reason: detail, .. } => ApiError::Malformed(detail),
        P::NoLogin { .. } => ApiError::Malformed("nothing is signed in".into()),
        P::InvalidGrant { .. } => ApiError::InvalidGrant,
    }
}

/// Ask about the account filed under `id`, or say why not.
fn ask_usage(
    ctx: &Context,
    which: ProviderId,
    id: &str,
    document: &Value,
    signed_in: bool,
    remembered: Option<&Snapshot>,
    fresh: bool,
) -> Asked {
    if let Some(held) = budget::may_ask(ctx, id, remembered, fresh) {
        let stale = match held {
            budget::Held::Fresh => Stale::AskedRecently,
            budget::Held::RateLimited => Stale::RateLimited,
            budget::Held::Unreachable => Stale::Unreachable,
        };
        return (Err(stale), None);
    }
    // Through the provider, because what a usage call needs is not the same everywhere:
    // Codex sends an account id header it reads out of the credential, and Gemini needs a
    // project id from a file the credential never mentions.
    let answer = crate::provider::of(which).usage(
        ctx,
        &crate::provider::Credential::new(which, document.clone()),
    );
    // A park that is not the shape its own tool keeps was damaged at rest, which is a fact
    // about the vault and not about the service. Said as such rather than as an answer the
    // service gave.
    if !signed_in
        && matches!(
            answer,
            Err(crate::provider::ProviderError::ShapeUnexpected { .. })
        )
    {
        return (Err(Stale::ParkUnreadable), None);
    }
    let answer = answer.map_err(to_api);
    let learned = match &answer {
        Ok(_) => Some(budget::Outcome::Answered),
        Err(api::ApiError::RateLimited { retry_after }) => {
            Some(budget::Outcome::RateLimited(*retry_after))
        }
        Err(api::ApiError::Network(_) | api::ApiError::Unexpected { .. }) => {
            Some(budget::Outcome::Unreachable)
        }
        // A token that is refused, or an answer that is not understood, is not a reason to
        // wait: waiting fixes neither.
        Err(_) => None,
    };
    (
        answer.map_err(|e| Stale::of(&e, signed_in)),
        learned.map(|outcome| (id.to_string(), outcome)),
    )
}

/// Ask about one tool's live login: whose it is, and what it has left.
///
/// `read` is what reading the tool's store came to, kept whole. An error there is not
/// nothing signed in: the login may be exactly where it always was, behind a keychain that
/// is locked for the moment, and saying it is gone sends somebody to sign in again for
/// nothing. It used to be read as exactly that.
///
/// Whose a login is comes from the record where it is the login the record was made for,
/// and from the tool's service otherwise ([`identify::whose`]). Where nobody could say this
/// time, because the login could not be read or its service could not be asked, whose
/// Pitboard last recorded it to be stands in, so the account in use is not told to sign in
/// again; what it has left is not asked, since asked under an account standing in, the
/// numbers of a login a sign-in replaced would be filed under the account it replaced.
/// Where no login is stored, nobody is recorded only if the tool's own record names nobody
/// either ([`identify::nobody`]).
fn ask_live(
    ctx: &Context,
    state: &State,
    which: ProviderId,
    read: &LiveRead,
    remembered: &HashMap<String, Snapshot>,
    fresh: bool,
) -> Answered {
    let tool = crate::provider::of(which);
    let recorded = || last_known(state, which);
    let nobody = || Answered {
        found: identify::nobody(read.named.as_deref(), ctx.now()),
        ..Answered::learning_nothing(LiveLogin::default())
    };
    let document = match &read.login {
        Ok(Some(document)) => document,
        Ok(None) => return nobody(),
        Err(error) => {
            return Answered::learning_nothing(LiveLogin {
                signed_in: Some(Err(error.to_string())),
                known: recorded(),
                usage: Some(Err(Stale::LoginUnreadable)),
                out_of_reach: true,
            });
        }
    };
    match tool.slice(document) {
        Ok(_) => {}
        // A document holding no account's login at all. Claude Code's `/logout` deletes the
        // login and leaves the document behind with the machine's MCP tokens still in it;
        // asking Anthropic whose that was got an answer about a shape rather than a person,
        // and the row read as Anthropic answering badly when the truth is that nobody is
        // signed in.
        Err(ProviderError::NoLogin { .. }) => return nobody(),
        // A login that is there and is not one account's: signed in with an API key, or a
        // Codex login that a session still running from before a switch rewrote with its
        // own account's tokens under the other account's id. Something is signed in, so
        // it is not nobody; nobody is asked about it, because there is no one account's
        // token to ask with. Pitboard's record does not stand in, because what is there was
        // read and is not that account's. A login that names its own account still says
        // whose its tokens are, as Codex's ID token does.
        Err(unusable) => {
            let claimed = tool
                .identifies_by_itself()
                .then(|| {
                    tool.identify(
                        ctx,
                        &crate::provider::Credential::new(which, document.clone()),
                    )
                })
                .and_then(Result::ok)
                .map(Owner::from);
            return Answered::learning_nothing(LiveLogin {
                signed_in: Some(Err(unusable.to_string())),
                known: claimed,
                usage: Some(Err(Stale::LoginUnusable)),
                out_of_reach: true,
            });
        }
    }
    let found = match identify::whose(ctx, state, which, document) {
        Ok(found) => found,
        Err(error) => {
            let error = to_api(error);
            return Answered::learning_nothing(LiveLogin {
                signed_in: Some(Err(error.to_string())),
                known: recorded(),
                usage: Some(Err(Stale::of(&error, true))),
                out_of_reach: false,
            });
        }
    };
    let id = state.id_of(which, &found.owner);
    let (usage, learned) = ask_usage(ctx, which, &id, document, true, remembered.get(&id), fresh);
    Answered {
        login: LiveLogin {
            signed_in: Some(Ok(found.owner.clone())),
            known: None,
            usage: Some(usage),
            out_of_reach: false,
        },
        learned,
        found: Some(found.recorded(read.named.clone())),
    }
}

/// Every tool's answer, filed under the tool it was asked about.
///
/// A thread that stopped before answering stands in for its own tool and nobody else's. It
/// used to be replaced by an empty answer filed under Claude Code whichever tool it had
/// been asking about, and because answers are collected in order, a Codex thread that
/// panicked quietly erased Claude Code's signed-in row.
fn settle(
    state: &State,
    answers: Vec<(ProviderId, std::thread::Result<Answered>)>,
) -> BTreeMap<ProviderId, Answered> {
    answers
        .into_iter()
        .map(|(which, answer)| {
            let answer = answer.unwrap_or_else(|_| {
                // Whose the login is was never learned, so whose Pitboard last recorded it to
                // be stands in for it, the same as when its service cannot be reached.
                Answered::learning_nothing(LiveLogin {
                    signed_in: Some(Err("the check did not finish".into())),
                    known: last_known(state, which),
                    usage: Some(Err(Stale::Interrupted)),
                    out_of_reach: false,
                })
            });
            (which, answer)
        })
        .collect()
}

/// What asking every tool's service came to, before anything of it is recorded.
pub(crate) struct Answers {
    live: BTreeMap<ProviderId, LiveLogin>,
    parked: BTreeMap<String, Result<Snapshot, Stale>>,
    learned: Vec<(String, budget::Outcome)>,
    /// Whose login each tool has stored, where the read could tell, for
    /// [`identify::record_read`] to record.
    pub(crate) found: Vec<(ProviderId, InUse)>,
}

/// Ask every tool's service about its live login, and about every parked login, all at once,
/// so a read costs one round trip and not one per account. Nothing is recorded: what the
/// answers teach is recorded by [`report`], and whose each login is by the caller.
pub(crate) fn ask(ctx: &Context, state: &State, fresh: bool) -> Answers {
    let now = ctx.now();
    // Each tool's live login, whole, or why it could not be read. Not a token out of it:
    // what a usage call needs is not the same everywhere, and pulling one field out here
    // would decide that for all of them. What the tool's own record names is read first,
    // as `in_use::named` says why.
    let live_reads: Vec<(ProviderId, LiveRead)> = tools(state)
        .into_iter()
        .map(|which| {
            let named = in_use::named(ctx, which);
            let login = crate::provider::of(which)
                .read_live(ctx)
                .map(|found| found.map(|credential| credential.raw));
            (which, LiveRead { named, login })
        })
        .collect();
    let parked_documents: Vec<Result<Value, Stale>> = state
        .accounts
        .iter()
        .map(|a| parked_document(ctx, &a.key(), a.parked.as_ref(), now))
        .collect();
    let remembered = readings::load(ctx);

    let (answers, parked_asked): (Vec<(ProviderId, std::thread::Result<Answered>)>, Vec<Asked>) =
        std::thread::scope(|scope| {
            // Each handle stays with the tool it asks about, so a thread that panics can
            // only ever stand in for its own tool.
            let per_tool: Vec<_> = live_reads
                .iter()
                .map(|(which, read)| {
                    let remembered = &remembered;
                    let which = *which;
                    let handle =
                        scope.spawn(move || ask_live(ctx, state, which, read, remembered, fresh));
                    (which, handle)
                })
                .collect();
            let parked: Vec<_> = parked_documents
                .iter()
                .zip(state.accounts.iter())
                .map(|(token, account)| {
                    let remembered = &remembered;
                    scope.spawn(move || match token.as_ref() {
                        Err(stale) => (Err(*stale), None),
                        Ok(document) => ask_usage(
                            ctx,
                            account.provider(),
                            &account.id,
                            document,
                            false,
                            remembered.get(&account.id),
                            fresh,
                        ),
                    })
                })
                .collect();
            (
                per_tool
                    .into_iter()
                    .map(|(which, handle)| (which, handle.join()))
                    .collect(),
                parked
                    .into_iter()
                    .map(|h| h.join().unwrap_or((Err(Stale::Interrupted), None)))
                    .collect(),
            )
        });

    let mut live = BTreeMap::new();
    let mut learned = Vec::new();
    let mut found = Vec::new();
    for (which, answered) in settle(state, answers) {
        live.insert(which, answered.login);
        learned.extend(answered.learned);
        found.extend(answered.found.map(|found| (which, found)));
    }
    let mut parked = BTreeMap::new();
    for (account, (usage, outcome)) in state.accounts.iter().zip(parked_asked) {
        parked.insert(account.id.clone(), usage);
        learned.extend(outcome);
    }
    Answers {
        live,
        parked,
        learned,
        found,
    }
}

/// What `answers` came to, as rows of the accounts `state` holds, which may have changed
/// since they were asked about: whose login each tool has stored may have been recorded
/// since. What the answers teach is recorded here, once, from one thread: every account's
/// record lives in one file, so a thread each reading it, changing one entry and writing it
/// back would erase what the others learned.
pub(crate) fn report(
    ctx: &Context,
    permit: crate::service::Permit,
    state: &State,
    answers: Answers,
) -> Report {
    let now = ctx.now();
    budget::record(ctx, permit, &answers.learned);
    let signed_in_default = answers
        .live
        .get(&crate::label::DEFAULT)
        .and_then(|login| login.signed_in.clone());
    let facts = Facts {
        live: answers.live,
        asked: true,
        parked: answers.parked,
    };
    let remembered = readings::load(ctx);
    let rows = assemble(state, &facts, |uuid| remembered.get(uuid).cloned(), now);
    crate::home::remove_retired(ctx, permit);
    readings::answered(
        ctx,
        permit,
        &rows
            .iter()
            .filter_map(|r| {
                r.usage
                    .as_ref()
                    .filter(|u| u.source == Source::Live)
                    .map(|u| (r.id.clone(), u.clone()))
            })
            .collect::<Vec<_>>(),
    );

    Report {
        slot: slot_of(ctx),
        now,
        rows,
        // The default tool's answer. Every tool's is in the rows, which is where a
        // machine with more than one signed in has to be read from: there is no single
        // fact called "the account signed in on this machine" any more.
        signed_in: match signed_in_default {
            Some(Ok(owner)) => Ok(owner),
            Some(Err(why)) => Err(why),
            None => Err("nothing is signed in".into()),
        },
    }
}

/// Whose login Pitboard last recorded `which`'s store to hold.
fn last_known(state: &State, which: ProviderId) -> Option<Owner> {
    state.in_use(which)?.owner.clone()
}

/// Where a tool comes in a listing: the order [`ProviderId::ALL`] gives them.
fn rank(which: ProviderId) -> usize {
    ProviderId::ALL
        .iter()
        .position(|&known| known == which)
        .unwrap_or(usize::MAX)
}

fn assemble(
    state: &State,
    facts: &Facts,
    recall: impl Fn(&str) -> Option<Snapshot>,
    now: i64,
) -> Vec<Row> {
    // Per tool, because an account is signed in to its own tool or to nothing. Comparing
    // every account against one machine-wide answer would have marked a Codex account
    // signed in because a Claude Code account with the same uuid was.
    let in_use: BTreeMap<ProviderId, &Owner> = ProviderId::ALL
        .iter()
        .filter_map(|&which| {
            let live = facts.live_for(which)?;
            let owner = match (&live.signed_in, facts.asked) {
                (Some(Ok(owner)), _) => Some(owner),
                // Unreachable, unreadable, or never asked. The service decides who is
                // signed in; without its answer this time, what it last said stands in.
                (Some(Err(_)), _) | (None, false) => live.known.as_ref(),
                (None, true) => None,
            }?;
            Some((which, owner))
        })
        .collect();
    let live_ids: BTreeMap<ProviderId, String> = in_use
        .iter()
        .map(|(&which, owner)| (which, state.id_of(which, owner)))
        .collect();
    // The service's answer folded into what every front end has recorded, or what they
    // recorded where none came. So a row shows the one reading the status lines show, and an
    // answer that lags a session's latest response cannot take its share back.
    let reading = |id: &str, asked: &Result<Snapshot, Stale>| match asked {
        Ok(live) => (
            Some(crate::usage::answered(recall(id).as_ref(), live, now)),
            None,
        ),
        Err(stale) => (recall(id), Some(*stale)),
    };

    let mut rows: Vec<Row> = state
        .accounts
        .iter()
        .map(|account| {
            let id = account.id.as_str();
            let which = account.provider();
            let signed_in = live_ids.get(&which).is_some_and(|live| live == id);
            let (usage, stale) = if signed_in {
                let live = facts
                    .live_for(which)
                    .map_or(Err(Stale::NothingSignedIn), LiveLogin::usage);
                reading(id, &live)
            } else if account.parked.is_none() && account.replaced_at.is_some() {
                reading(id, &Err(Stale::LoginReplaced))
            } else {
                let parked = facts.parked.get(id).cloned();
                reading(id, &parked.unwrap_or(Err(Stale::NotAsked)))
            };
            Row {
                provider: which,
                label: Some(account.label.clone()),
                email: account.email.clone(),
                id: account.id.clone(),
                account_uuid: account.account_uuid.clone(),
                organization_uuid: account.claude().map(|c| c.organization_uuid.to_owned()),
                signed_in,
                parked: account.parked.clone(),
                usage,
                stale,
            }
        })
        .collect();

    // A tool signed in to an account nothing has enrolled still gets a row, so somebody can
    // see what is there and give it a name, offline as well as online. One per tool, because
    // each can have its own, and told apart by tool as well as by account: two tools'
    // identities are two namespaces, and one tool's row must never stand in for another's.
    for &which in ProviderId::ALL {
        let Some(live) = facts.live_for(which) else {
            continue;
        };
        if let Some(owner) = in_use.get(&which) {
            let id = state.id_of(which, owner);
            if rows.iter().any(|r| r.provider == which && r.id == id) {
                continue;
            }
            let (usage, stale) = reading(&id, &live.usage());
            rows.push(Row {
                provider: which,
                label: None,
                email: owner.email.clone(),
                id,
                account_uuid: owner.account_uuid.clone(),
                organization_uuid: (which == ProviderId::Claude)
                    .then(|| owner.organization_uuid.clone()),
                signed_in: true,
                parked: None,
                usage,
                stale,
            });
            continue;
        }
        // A login that could not be read, or was read and is not one account's, and that
        // nothing pins on any account. Said, rather than left out, because leaving it out
        // reads as nobody being signed in; but only for a tool somebody uses through
        // Pitboard, so a machine that has never enrolled a Codex account sees nothing about
        // Codex at all.
        let enrolled = state.accounts.iter().any(|a| a.provider() == which);
        if live.out_of_reach && enrolled {
            rows.push(Row {
                provider: which,
                label: None,
                email: String::new(),
                id: String::new(),
                account_uuid: String::new(),
                organization_uuid: None,
                signed_in: false,
                parked: None,
                usage: None,
                stale: live.usage().err(),
            });
        }
    }

    // Grouped by tool, in the order every listing uses, and the signed-in account first
    // within each. Stable, so a machine with one tool reads in exactly the order it always
    // did.
    rows.sort_by_key(|r| (rank(r.provider), !r.signed_in));
    rows
}

#[cfg(test)]
mod tests {
    use super::*;
    use crate::api::scripted::{Asked as Question, ScriptedApi, Trouble};
    use crate::host::memory::MemoryHost;
    use crate::in_use::InUse;
    use crate::service::Permit;
    use crate::state::Account;
    use crate::store::memory::Fault;
    use crate::time::{Clock, FixedClock};
    use crate::usage::Window;
    use serde_json::json;
    use std::sync::Arc;

    const NOW: i64 = 1_789_935_000;

    fn owner(uuid: &str) -> Owner {
        Owner {
            account_uuid: uuid.into(),
            email: format!("{uuid}@example.com"),
            organization_uuid: "org".into(),
        }
    }

    fn reading(percent: f64, source: Source) -> Snapshot {
        Snapshot {
            windows: vec![Window {
                kind: "session".into(),
                scope: None,
                severity: None,
                percent,
                resets_at: Some(NOW + 3_600),
                is_active: true,
                length_seconds: None,
            }],
            observed_at: Some(NOW - 7_200),
            answered_at: Some(NOW - 7_200),
            lists_every_limit: true,
            source,
        }
    }

    fn parked(refresh_expires_at: i64) -> Park {
        Park {
            service: "pitboard-park-x-1".into(),
            parked_at: NOW - 86_400,
            refresh_fingerprint: "f".into(),
            access_expires_at: Some(NOW - 3_600),
            refresh_expires_at: Some(refresh_expires_at),
        }
    }

    fn account(label: &str) -> Account {
        Account {
            last_used_at: None,
            replaced_at: None,
            label: label.into(),
            id: format!("{label}-uuid"),
            account_uuid: format!("{label}-uuid"),
            email: format!("{label}@example.com"),
            detail: crate::state::Detail::Claude {
                organization_uuid: "org".into(),
                oauth_account: json!({}),
            },
            parked: Some(parked(NOW + 20 * 86_400)),
        }
    }

    fn state(labels: &[&str]) -> State {
        State {
            accounts: labels.iter().map(|l| account(l)).collect(),
            ..State::default()
        }
    }

    fn facts(
        signed_in: &str,
        live: Result<Snapshot, Stale>,
        parked: &[(&str, Result<Snapshot, Stale>)],
    ) -> Facts {
        only_claude(
            LiveLogin {
                signed_in: Some(Ok(owner(signed_in))),
                usage: Some(live),
                ..LiveLogin::default()
            },
            parked,
        )
    }

    /// The one-tool case every test here was written for, in the shape facts now take.
    fn only_claude(live: LiveLogin, parked: &[(&str, Result<Snapshot, Stale>)]) -> Facts {
        Facts {
            live: std::iter::once((ProviderId::Claude, live)).collect(),
            asked: true,
            parked: asked_about(parked),
        }
    }

    /// What asking about parked logins came to, by the id of each account asked about.
    fn asked_about(
        answers: &[(&str, Result<Snapshot, Stale>)],
    ) -> BTreeMap<String, Result<Snapshot, Stale>> {
        answers
            .iter()
            .map(|(id, answer)| ((*id).to_owned(), answer.clone()))
            .collect()
    }

    /// Anthropic decides who is signed in, but unreachable is not absent. Without this the
    /// account in use renders as one with nothing parked, advising a sign-in it does not
    /// need.
    #[test]
    fn an_unreachable_anthropic_leaves_the_signed_in_row_signed_in() {
        let state = state(&["alpha", "beta"]);
        let facts = Facts {
            live: std::iter::once((
                ProviderId::Claude,
                LiveLogin {
                    signed_in: Some(Err("could not reach Anthropic: offline".into())),
                    known: Some(owner("alpha-uuid")),
                    usage: Some(Err(Stale::Unreachable)),
                    out_of_reach: false,
                },
            ))
            .collect(),
            asked: true,
            parked: asked_about(&[("beta-uuid", Err(Stale::Unreachable))]),
        };
        let rows = assemble(&state, &facts, nothing_remembered, NOW);
        let a = rows
            .iter()
            .find(|r| r.account_uuid == "alpha-uuid")
            .unwrap();
        assert!(
            a.signed_in,
            "the account in use is still the account in use"
        );
        let b = rows.iter().find(|r| r.account_uuid == "beta-uuid").unwrap();
        assert!(!b.signed_in);
    }

    fn nothing_remembered(_: &str) -> Option<Snapshot> {
        None
    }

    /// A read that asks, as `pitboard status` makes one, short of recording whose each
    /// tool's login is.
    fn gather(ctx: &Context, state: &State) -> Report {
        report(ctx, Permit::for_a_test(), state, ask(ctx, state, true))
    }

    /// A tool's store holding `login`, read with nothing in the tool's own record.
    fn stored(login: Value) -> LiveRead {
        LiveRead {
            named: None,
            login: Ok(Some(login)),
        }
    }

    #[test]
    fn every_stale_code_is_its_json_form() {
        for stale in [
            Stale::NothingSignedIn,
            Stale::LoginUnreadable,
            Stale::LoginUnusable,
            Stale::SessionExpired,
            Stale::ParkedAccessExpired,
            Stale::NothingParked,
            Stale::LoginReplaced,
            Stale::ParkUnreadable,
            Stale::RateLimited,
            Stale::Unreachable,
            Stale::ServerError,
            Stale::AnswerNotUnderstood,
            Stale::LoginRefused,
            Stale::Interrupted,
            Stale::NotAsked,
        ] {
            assert_eq!(serde_json::to_value(stale).unwrap(), stale.code());
        }
    }

    /// The three answers that used to arrive as one. What a front end does next differs for
    /// each: wait and ask again, stop asking because the shape moved, or tell the person
    /// their parked login is finished.
    #[test]
    fn anthropics_failures_are_told_apart() {
        use crate::api::ApiError;
        let parked = |e: &ApiError| Stale::of(e, false);
        assert_eq!(
            parked(&ApiError::Unexpected { status: 503 }),
            Stale::ServerError
        );
        assert_eq!(
            parked(&ApiError::Malformed("no windows".into())),
            Stale::AnswerNotUnderstood
        );
        assert_eq!(parked(&ApiError::InvalidGrant), Stale::LoginRefused);
        assert_eq!(
            parked(&ApiError::RateLimited { retry_after: None }),
            Stale::RateLimited
        );
        assert_eq!(
            parked(&ApiError::Network("down".into())),
            Stale::Unreachable
        );

        // The same token failure means different things for a live login and a parked one.
        assert_eq!(parked(&ApiError::Unauthorized), Stale::ParkedAccessExpired);
        assert_eq!(
            Stale::of(&ApiError::Unauthorized, true),
            Stale::SessionExpired
        );
    }

    #[test]
    fn an_expired_session_shows_what_was_remembered_and_says_why() {
        let s = state(&["work"]);
        let f = facts("work-uuid", Err(Stale::SessionExpired), &[]);
        let recorded = |_: &str| Some(reading(22.0, Source::Remembered));
        let rows = assemble(&s, &f, recorded, NOW);
        let usage = rows[0].usage.as_ref().unwrap();
        assert_eq!(usage.windows[0].percent, 22.0);
        assert_eq!(usage.source, Source::Remembered);
        assert_eq!(rows[0].stale, Some(Stale::SessionExpired));
    }

    /// What the menu bar shows between its own reads, and all it shows offline: the reading
    /// every front end and every session's status line records into, so all of them agree.
    #[test]
    fn offline_the_account_in_use_shows_the_readings() {
        let s = state(&["work"]);
        let mut f = facts("work-uuid", Err(Stale::NotAsked), &[]);
        f.asked = false;
        let recorded = |_: &str| Some(reading(22.0, Source::Remembered));
        let rows = assemble(&s, &f, recorded, NOW);
        assert!(rows[0].signed_in);
        let usage = rows[0].usage.as_ref().unwrap();
        assert_eq!(usage.windows[0].percent, 22.0);
        assert_eq!(usage.source, Source::Remembered);
        assert_eq!(rows[0].stale, Some(Stale::NotAsked));
    }

    /// Anthropic's usage answer can be behind the numbers a session has had in its latest
    /// response: one taken before the session recorded them. Shown as it came, the menu bar
    /// read 20% while every session said 22%.
    #[test]
    fn a_live_reading_behind_what_a_session_recorded_does_not_move_the_row_back() {
        let s = state(&["work"]);
        let f = facts("work-uuid", Ok(reading(20.0, Source::Live)), &[]);
        let recorded = |_: &str| {
            let mut since = reading(22.0, Source::Remembered);
            since.observed_at = Some(NOW - 60);
            Some(since)
        };
        let rows = assemble(&s, &f, recorded, NOW);
        assert_eq!(rows[0].usage.as_ref().unwrap().windows[0].percent, 22.0);
        assert_eq!(rows[0].stale, None);

        let f = facts("work-uuid", Ok(reading(30.0, Source::Live)), &[]);
        let usage = assemble(&s, &f, recorded, NOW)[0].usage.clone().unwrap();
        assert_eq!(usage.windows[0].percent, 30.0);
        assert_eq!(
            usage.source,
            Source::Live,
            "a live reading ahead is shown as live"
        );
    }

    /// A banked reset used on claude.ai lowers a limit's share and keeps its reset, as this
    /// machine's sessions measured on 2026-09-29. Folded in by share alone, Anthropic's
    /// answer lost to the 100% recorded before it, and the row read full until the reset.
    #[test]
    fn a_live_reading_taken_after_what_was_recorded_is_shown_however_low() {
        let s = state(&["work"]);
        let mut answered = reading(14.0, Source::Live);
        answered.observed_at = Some(NOW);
        answered.answered_at = Some(NOW);
        let f = facts("work-uuid", Ok(answered), &[]);
        let recorded = |_: &str| Some(reading(100.0, Source::Remembered));
        let usage = assemble(&s, &f, recorded, NOW)[0].usage.clone().unwrap();
        assert_eq!(usage.windows[0].percent, 14.0);
        assert_eq!(usage.source, Source::Live);
    }

    #[test]
    fn a_parked_account_is_asked_with_its_own_login() {
        let s = state(&["work", "personal"]);
        let f = facts(
            "work-uuid",
            Ok(reading(30.0, Source::Live)),
            &[("personal-uuid", Ok(reading(12.0, Source::Live)))],
        );
        let rows = assemble(&s, &f, nothing_remembered, NOW);
        let personal = rows
            .iter()
            .find(|r| r.label.as_deref() == Some("personal"))
            .unwrap();
        assert_eq!(personal.usage.as_ref().unwrap().windows[0].percent, 12.0);
        assert!(personal.switchable(NOW));
    }

    /// The login signed in has a session of its own tool's to renew, and a parked one does
    /// not. The same refusal means different things on each side, and saying "parked" about
    /// the login somebody is using sends them looking for a park that is not there.
    #[test]
    fn a_refused_token_is_an_expired_session_when_it_is_the_one_signed_in() {
        let api = crate::api::scripted::ScriptedApi::new();
        api.token_trouble("t", crate::api::scripted::Trouble::Unauthorized);
        let ctx = Context::new(std::path::PathBuf::from("/nowhere"))
            .with_pitboard_home(std::env::temp_dir().join("pitboard-status-refused"))
            .with_scripted_api(api);
        let login = serde_json::json!({"claudeAiOauth": {"accessToken": "t"}});
        let ask = |signed_in| {
            ask_usage(
                &ctx,
                ProviderId::Claude,
                "t-uuid",
                &login,
                signed_in,
                None,
                true,
            )
            .0
        };
        assert_eq!(ask(true).unwrap_err(), Stale::SessionExpired);
        assert_eq!(ask(false).unwrap_err(), Stale::ParkedAccessExpired);
    }

    /// A parked Codex login keeps its token where a Claude Code login does not. Reading it
    /// with Claude Code's layout called every Codex park unreadable; what is unreadable now
    /// is decided by the tool the park belongs to.
    #[test]
    fn a_park_not_in_its_own_tools_shape_is_unreadable_rather_than_an_answer() {
        let ctx = Context::new(std::path::PathBuf::from("/nowhere"));
        let not_codex = serde_json::json!({"claudeAiOauth": {"accessToken": "t"}});
        let (answer, learned) = ask_usage(
            &ctx,
            ProviderId::Codex,
            "t-acc",
            &not_codex,
            false,
            None,
            true,
        );
        assert_eq!(answer.unwrap_err(), Stale::ParkUnreadable);
        assert!(
            learned.is_none(),
            "nothing was asked, so there is nothing to learn"
        );
    }

    #[test]
    fn a_parked_login_past_its_access_expiry_is_not_asked() {
        let ctx = Context::for_unit_test();
        let personal = Key::new(ProviderId::Claude, "personal");
        let token = parked_document(&ctx, &personal, Some(&parked(NOW + 86_400)), NOW);
        assert_eq!(token, Err(Stale::ParkedAccessExpired));
        assert_eq!(
            parked_document(&ctx, &personal, None, NOW),
            Err(Stale::NothingParked)
        );
    }

    #[test]
    fn what_cannot_be_asked_falls_back_to_what_was_remembered() {
        let s = state(&["work", "personal"]);
        let f = facts(
            "work-uuid",
            Ok(reading(30.0, Source::Live)),
            &[("personal-uuid", Err(Stale::ParkedAccessExpired))],
        );
        let remembered =
            |uuid: &str| (uuid == "personal-uuid").then(|| reading(44.0, Source::Remembered));
        let rows = assemble(&s, &f, remembered, NOW);
        let personal = rows
            .iter()
            .find(|r| r.label.as_deref() == Some("personal"))
            .unwrap();
        assert_eq!(personal.usage.as_ref().unwrap().source, Source::Remembered);
        assert_eq!(personal.stale, Some(Stale::ParkedAccessExpired));
    }

    #[test]
    fn the_signed_in_account_comes_first_and_is_taken_from_the_server_not_the_config() {
        let s = state(&["alpha", "beta"]);
        let f = facts(
            "beta-uuid",
            Ok(reading(5.0, Source::Live)),
            &[("alpha-uuid", Err(Stale::NothingParked))],
        );
        let rows = assemble(&s, &f, nothing_remembered, NOW);
        assert_eq!(rows[0].label.as_deref(), Some("beta"));
        assert!(rows[0].signed_in && !rows[0].switchable(NOW));
        assert!(!rows[1].signed_in);
    }

    /// Every stale reason, for the tests that hold each one to something.
    const EVERY_STALE: [Stale; 16] = [
        Stale::NothingSignedIn,
        Stale::LoginUnreadable,
        Stale::LoginUnusable,
        Stale::SessionExpired,
        Stale::ParkedAccessExpired,
        Stale::NothingParked,
        Stale::LoginReplaced,
        Stale::ParkUnreadable,
        Stale::RateLimited,
        Stale::Unreachable,
        Stale::ServerError,
        Stale::AnswerNotUnderstood,
        Stale::LoginRefused,
        Stale::AskedRecently,
        Stale::Interrupted,
        Stale::NotAsked,
    ];

    /// What a Claude Code row said before a row knew its tool, word for word. A person who
    /// has only ever used Claude Code must not read a single word differently.
    #[test]
    fn claude_codes_explanations_are_word_for_word_what_they_were() {
        let before = |stale: Stale| match stale {
            Stale::NothingSignedIn => Some("nothing is signed in"),
            Stale::SessionExpired => Some("Claude Code's session has expired; `claude` renews it"),
            Stale::ParkedAccessExpired | Stale::NothingParked | Stale::AskedRecently => None,
            Stale::ParkUnreadable => Some("its parked login cannot be read; run `pitboard doctor`"),
            Stale::RateLimited => Some("Anthropic is rate limiting usage checks"),
            Stale::Unreachable => Some("Anthropic could not be reached"),
            Stale::ServerError => Some("Anthropic answered with an error; try again later"),
            Stale::AnswerNotUnderstood => Some("Anthropic's answer was not understood"),
            Stale::LoginRefused => Some("its parked login is no longer accepted; sign in again"),
            Stale::Interrupted => Some("the check did not finish"),
            Stale::NotAsked => Some("read without asking Anthropic"),
            // New, so there is no before to hold them to.
            Stale::LoginReplaced => {
                Some("its login was replaced by a sign-in outside Pitboard; sign in again")
            }
            Stale::LoginUnreadable => {
                Some("Claude Code's login could not be read; run `pitboard doctor`")
            }
            Stale::LoginUnusable => Some(
                "Claude Code's login is not one Pitboard can park or switch; run `pitboard doctor`",
            ),
        };
        for stale in EVERY_STALE {
            assert_eq!(
                stale.explanation_for(ProviderId::Claude),
                before(stale),
                "{stale:?}"
            );
            assert_eq!(
                stale.explanation(),
                stale.explanation_for(ProviderId::Claude),
                "a caller with only a code gets the default tool's words"
            );
        }
    }

    /// "Anthropic could not be reached" said about a Codex account sends somebody to check
    /// the wrong service, and "`claude` renews it" names a program that has nothing to do
    /// with a Codex session.
    #[test]
    fn a_codex_row_names_openai_and_codex_never_anthropic_or_claude() {
        for stale in EVERY_STALE {
            let Some(said) = stale.explanation_for(ProviderId::Codex) else {
                assert_eq!(stale.explanation_for(ProviderId::Claude), None, "{stale:?}");
                continue;
            };
            for other in ["Anthropic", "Claude", "claude"] {
                assert!(!said.contains(other), "{stale:?}: {said}");
            }
        }
        assert_eq!(
            Stale::Unreachable.explanation_for(ProviderId::Codex),
            Some("OpenAI could not be reached")
        );
        assert_eq!(
            Stale::SessionExpired.explanation_for(ProviderId::Codex),
            Some("Codex's session has expired; `codex` renews it")
        );

        // And a row asks in its own tool's words without the caller having to know which.
        let mut codex = codex_account("work", "work-acc");
        codex.parked = None;
        let s = State {
            accounts: vec![codex],
            ..State::default()
        };
        let f = Facts {
            live: BTreeMap::new(),
            asked: true,
            parked: asked_about(&[("work-acc", Err(Stale::Unreachable))]),
        };
        let rows = assemble(&s, &f, nothing_remembered, NOW);
        assert_eq!(rows[0].explanation(), Some("OpenAI could not be reached"));
    }

    fn codex_account(label: &str, uuid: &str) -> Account {
        Account {
            last_used_at: None,
            replaced_at: None,
            label: label.into(),
            id: uuid.into(),
            account_uuid: uuid.into(),
            email: format!("{label}@example.com"),
            detail: crate::state::Detail::Codex {
                workspace_id: None,
                plan: None,
            },
            parked: Some(parked(NOW + 20 * 86_400)),
        }
    }

    fn live(owner_uuid: &str, usage: Result<Snapshot, Stale>) -> LiveLogin {
        LiveLogin {
            signed_in: Some(Ok(owner(owner_uuid))),
            usage: Some(usage),
            ..LiveLogin::default()
        }
    }

    /// Every row says which tool it is for, the unenrolled one included, and the same
    /// identity on two tools is two rows. Deduplicated by identity alone, a Codex login
    /// whose id happened to match an enrolled Claude Code account vanished from the list.
    #[test]
    fn the_same_identity_on_two_tools_is_two_rows() {
        let s = state(&["same"]);
        let f = Facts {
            live: [
                (
                    ProviderId::Claude,
                    live("same-uuid", Ok(reading(10.0, Source::Live))),
                ),
                (
                    ProviderId::Codex,
                    live("same-uuid", Ok(reading(20.0, Source::Live))),
                ),
            ]
            .into_iter()
            .collect(),
            asked: true,
            parked: BTreeMap::new(),
        };
        let rows = assemble(&s, &f, nothing_remembered, NOW);
        assert_eq!(rows.len(), 2, "one row per tool");
        assert_eq!(rows[0].provider, ProviderId::Claude);
        assert_eq!(rows[0].label.as_deref(), Some("same"));
        assert_eq!(rows[1].provider, ProviderId::Codex);
        assert_eq!(rows[1].label, None, "nothing has enrolled the Codex login");
        assert!(rows[1].signed_in);
        assert_eq!(rows[1].usage.as_ref().unwrap().windows[0].percent, 20.0);
    }

    /// OpenAI's answer does not list every limit, so a window it leaves out stands on a
    /// Codex row while it runs, in its place.
    #[test]
    fn a_codex_row_keeps_a_running_window_openai_left_out() {
        let s = State {
            accounts: vec![codex_account("work", "work-acc")],
            ..State::default()
        };
        let window = |kind: &str, percent: f64| Window {
            kind: kind.into(),
            scope: None,
            severity: None,
            percent,
            resets_at: Some(NOW + 3_600),
            is_active: true,
            length_seconds: None,
        };
        let known = Snapshot {
            windows: vec![window("five_hour", 30.0), window("seven_day", 40.0)],
            observed_at: Some(NOW - 600),
            answered_at: Some(NOW - 600),
            lists_every_limit: false,
            source: Source::Remembered,
        };
        let answer = Snapshot {
            windows: vec![window("seven_day", 45.0)],
            observed_at: Some(NOW),
            answered_at: Some(NOW),
            lists_every_limit: false,
            source: Source::Live,
        };
        let f = Facts {
            live: std::iter::once((ProviderId::Codex, live("work-acc", Ok(answer)))).collect(),
            asked: true,
            parked: BTreeMap::new(),
        };
        let rows = assemble(&s, &f, |_| Some(known.clone()), NOW);
        let shares: Vec<(&str, f64)> = rows[0]
            .usage
            .as_ref()
            .unwrap()
            .windows
            .iter()
            .map(|w| (w.kind.as_str(), w.percent))
            .collect();
        assert_eq!(shares, [("five_hour", 30.0), ("seven_day", 45.0)]);
    }

    /// Grouped by tool in the order every listing uses, signed in first within each, and
    /// otherwise in the order they were enrolled.
    #[test]
    fn rows_are_grouped_by_tool_with_the_signed_in_account_first_in_each() {
        let mut s = state(&["alpha"]);
        s.accounts.push(codex_account("work", "work-acc"));
        s.accounts.push(account("beta"));
        s.accounts.push(codex_account("home", "home-acc"));
        let f = Facts {
            live: [
                (
                    ProviderId::Claude,
                    live("beta-uuid", Ok(reading(5.0, Source::Live))),
                ),
                (
                    ProviderId::Codex,
                    live("home-acc", Ok(reading(6.0, Source::Live))),
                ),
            ]
            .into_iter()
            .collect(),
            asked: true,
            parked: BTreeMap::new(),
        };
        let order: Vec<(ProviderId, String, bool)> = assemble(&s, &f, nothing_remembered, NOW)
            .into_iter()
            .map(|r| (r.provider, r.label.unwrap_or_default(), r.signed_in))
            .collect();
        assert_eq!(
            order,
            [
                (ProviderId::Claude, "beta".into(), true),
                (ProviderId::Claude, "alpha".into(), false),
                (ProviderId::Codex, "home".into(), true),
                (ProviderId::Codex, "work".into(), false),
            ]
        );
    }

    /// A thread that panicked stands in for its own tool and nobody else's. It used to be
    /// filed under Claude Code whichever tool it had been asking about, and since answers
    /// are collected in order, a Codex thread that panicked erased Claude Code's signed-in
    /// row.
    #[test]
    fn a_thread_that_stopped_stands_in_for_its_own_tool_only() {
        let claude_answer = Answered {
            learned: Some(("alpha-uuid".into(), budget::Outcome::Answered)),
            ..Answered::learning_nothing(live("alpha-uuid", Ok(reading(30.0, Source::Live))))
        };
        let panicked: Box<dyn std::any::Any + Send> = Box::new("boom");
        let settled = settle(
            &state(&["alpha"]),
            vec![
                (ProviderId::Claude, Ok(claude_answer)),
                (ProviderId::Codex, Err(panicked)),
            ],
        );
        assert_eq!(
            settled[&ProviderId::Claude].learned,
            Some(("alpha-uuid".to_string(), budget::Outcome::Answered))
        );
        let codex = &settled[&ProviderId::Codex];
        assert_eq!(codex.login.usage().err(), Some(Stale::Interrupted));
        assert!(
            matches!(codex.login.signed_in, Some(Err(_))),
            "unknown, not nobody"
        );
        assert!(codex.learned.is_none() && codex.found.is_none());

        let mut s = state(&["alpha"]);
        s.accounts.push(codex_account("work", "work-acc"));
        let f = Facts {
            live: settled
                .into_iter()
                .map(|(which, answered)| (which, answered.login))
                .collect(),
            asked: true,
            parked: BTreeMap::new(),
        };
        let rows = assemble(&s, &f, nothing_remembered, NOW);
        let alpha = rows
            .iter()
            .find(|r| r.provider == ProviderId::Claude)
            .unwrap();
        assert!(alpha.signed_in, "Claude Code's row survives Codex's thread");
        assert_eq!(alpha.usage.as_ref().unwrap().windows[0].percent, 30.0);
    }

    /// Claude Code's `/logout` deletes the login and leaves the document behind, still
    /// holding the machine's MCP tokens. That is nobody signed in. It used to be sent to
    /// Anthropic to identify, and the row read as Anthropic answering badly.
    #[test]
    #[cfg_attr(windows, ignore = "W15: files made private to the person on Windows")]
    fn a_document_holding_no_account_is_nothing_signed_in_and_nobody_is_asked() {
        let home = scratch("logged-out");
        let (ctx, _mem, api) = machine(&home.0, None);
        let logged_out = json!({"mcpOAuth": {"some-server": {"token": "unrelated"}}});
        let answered = ask_live(
            &ctx,
            &State::default(),
            ProviderId::Claude,
            &stored(logged_out),
            &HashMap::new(),
            true,
        );
        let login = &answered.login;
        assert!(login.signed_in.is_none(), "nobody, rather than unknown");
        assert_eq!(login.usage().err(), Some(Stale::NothingSignedIn));
        assert!(answered.learned.is_none());
        assert_eq!(
            answered.found.map(|found| (found.owner, found.login)),
            Some((None, String::new())),
            "found holding no login, which a read records"
        );
        assert_eq!(api.calls(), 0, "Anthropic was asked: {:?}", api.asked());
    }

    /// A keychain that is locked for the moment is not a login that is gone. Read as one,
    /// the account in use showed as parked with nothing parked, and the advice was to sign
    /// in again.
    #[test]
    #[cfg_attr(windows, ignore = "W15: files made private to the person on Windows")]
    fn a_login_that_cannot_be_read_is_said_rather_than_read_as_nobody_signed_in() {
        let home = scratch("unreadable");
        let (ctx, mem, api) = machine(&home.0, Some("alpha-uuid"));
        let service = claude::live_service(&ctx);
        mem.live().plant(
            &service,
            &json!({"claudeAiOauth": {"accessToken": "t"}}).to_string(),
        );
        mem.live()
            .fault(&service, Fault::Unreadable("the keychain is locked".into()));
        let mut s = state(&["alpha", "beta"]);
        for a in &mut s.accounts {
            a.parked = None;
        }
        let alpha = InUse::of(&s.accounts[0], "alpha-refresh", NOW);
        s.identified(ProviderId::Claude, alpha, NOW);

        let report = gather(&ctx, &s);
        let alpha = report
            .rows
            .iter()
            .find(|r| r.label.as_deref() == Some("alpha"))
            .unwrap();
        assert!(
            alpha.signed_in,
            "Pitboard's record of whose login is stored still names the account in use"
        );
        assert_eq!(alpha.stale, Some(Stale::LoginUnreadable));
        assert_eq!(
            alpha.explanation(),
            Some("Claude Code's login could not be read; run `pitboard doctor`")
        );
        let why = report.signed_in.expect_err("nobody could say whose it is");
        assert_ne!(why, "nothing is signed in");
        assert_eq!(api.calls(), 0, "a login nobody could read was sent nowhere");
    }

    /// While the login in use cannot be read, the account Anthropic last named for it stays
    /// in use, with why nothing new is shown, and is not told to sign in again. A `/login`
    /// where the keychain is locked moves Claude Code's config to another account and leaves
    /// that login in the keychain, so the config's account read as in use and the one whose
    /// login was stored read as having nothing parked.
    #[test]
    #[cfg_attr(windows, ignore = "W15: files made private to the person on Windows")]
    fn the_account_last_recorded_in_use_is_not_sent_to_sign_in_while_the_login_cannot_be_read() {
        let home = scratch("unreadable-recorded");
        let (ctx, mem, api) = machine(&home.0, Some("alpha-uuid"));
        let service = claude::live_service(&ctx);
        mem.live().plant(
            &service,
            &json!({"claudeAiOauth": {"refreshToken": "beta-refresh"}}).to_string(),
        );
        mem.live()
            .fault(&service, Fault::Unreadable("the keychain is locked".into()));
        let mut s = state(&["alpha", "beta"]);
        s.accounts[1].parked = None;
        let beta = InUse::of(&s.accounts[1], "beta-refresh", NOW);
        s.identified(ProviderId::Claude, beta, NOW);

        let report = gather(&ctx, &s);
        let row = |label: &str| {
            report
                .rows
                .iter()
                .find(|r| r.label.as_deref() == Some(label))
                .map(|r| (r.signed_in, r.stale))
                .unwrap()
        };
        assert_eq!(row("beta"), (true, Some(Stale::LoginUnreadable)));
        assert!(!row("alpha").0, "whatever Claude Code's config names");
        assert_eq!(api.calls(), 0);

        // Once the login can be read, nothing parked means what it says.
        let readable = only_claude(
            live("alpha-uuid", Ok(reading(5.0, Source::Live))),
            &[("beta-uuid", Err(Stale::NothingParked))],
        );
        let rows = assemble(&s, &readable, nothing_remembered, NOW);
        let beta = rows
            .iter()
            .find(|r| r.label.as_deref() == Some("beta"))
            .unwrap();
        assert_eq!(beta.stale, Some(Stale::NothingParked));
    }

    /// A tool whose login could not be read, and whose account in use as Pitboard last
    /// recorded it is none of its accounts, gets a row of its own, so its silence is not read
    /// as nobody signed in. Only for a tool somebody uses through Pitboard: a machine that has
    /// never enrolled a Codex account sees nothing about Codex.
    #[test]
    fn an_unreadable_login_gets_a_row_only_for_a_tool_with_accounts() {
        let unreadable = || LiveLogin {
            signed_in: Some(Err("the keychain is locked".into())),
            usage: Some(Err(Stale::LoginUnreadable)),
            out_of_reach: true,
            ..LiveLogin::default()
        };
        let facts = || Facts {
            live: [
                (
                    ProviderId::Claude,
                    live("alpha-uuid", Ok(reading(5.0, Source::Live))),
                ),
                (ProviderId::Codex, unreadable()),
            ]
            .into_iter()
            .collect(),
            asked: true,
            parked: BTreeMap::new(),
        };

        let claude_only = state(&["alpha"]);
        let rows = assemble(&claude_only, &facts(), nothing_remembered, NOW);
        assert_eq!(
            rows.len(),
            1,
            "nothing new for somebody who never used Codex"
        );

        let mut both = state(&["alpha"]);
        both.accounts.push(codex_account("work", "work-acc"));
        let rows = assemble(&both, &facts(), nothing_remembered, NOW);
        let said = rows
            .iter()
            .find(|r| r.provider == ProviderId::Codex && r.label.is_none())
            .expect("a row saying Codex's login could not be read");
        assert_eq!(said.stale, Some(Stale::LoginUnreadable));
        assert!(!said.signed_in && !said.switchable(NOW));
        assert_eq!(
            said.explanation(),
            Some("Codex's login could not be read; run `pitboard doctor`")
        );
        let work = rows
            .iter()
            .find(|r| r.label.as_deref() == Some("work"))
            .unwrap();
        assert!(!work.signed_in);
    }

    /// Where nobody could say whose the login is this time, what it has left is not asked
    /// either: asked under an account standing in for it, Claude Code's config before there
    /// was a second tool, the numbers of a login a sign-in replaced were filed under the
    /// account it replaced. One request is made, the one that failed, and nothing is learned
    /// for the budget or recorded of whose the login is.
    #[test]
    #[cfg_attr(windows, ignore = "W15: files made private to the person on Windows")]
    fn a_login_nobody_could_name_this_time_is_not_asked_about_usage() {
        let home = scratch("unnamed");
        let (ctx, _mem, api) = machine(&home.0, Some("acc-x"));
        api.token_trouble("access-x", Trouble::Offline);

        let answered = ask_live(
            &ctx,
            &State::default(),
            ProviderId::Claude,
            &stored(json!({"claudeAiOauth": {"accessToken": "access-x"}})),
            &HashMap::new(),
            true,
        );

        assert_eq!(answered.login.usage().err(), Some(Stale::Unreachable));
        assert!(matches!(answered.login.signed_in, Some(Err(_))));
        assert!(answered.learned.is_none() && answered.found.is_none());
        assert_eq!(api.asked(), [Question::Owner("access-x".into())]);
    }

    /// Offline, Claude Code's account in use is the one Anthropic last named for its login,
    /// whatever its config names, and Codex's the one its login names, whatever Pitboard last
    /// recorded, so on a plane a signed-in Codex account does not read as parked.
    #[test]
    #[cfg_attr(windows, ignore = "W21: switching Codex on Windows")]
    fn offline_every_tool_names_its_own_signed_in_account() {
        let home = scratch("offline");
        let (ctx, _mem, api) = machine(&home.0, Some("alpha-uuid"));
        let codex = crate::provider::of(ProviderId::Codex)
            .live(&ctx)
            .expect("Codex keeps its login in a file here");
        let login = json!({
            "auth_mode": "chatgpt",
            "tokens": {
                "id_token": crate::provider::jwt::unsigned(&json!({
                    "email": "work@example.com",
                    "https://api.openai.com/auth": {"chatgpt_account_id": "work-acc"},
                })),
                "access_token": "codex-access",
                "refresh_token": "codex-refresh",
                "account_id": "work-acc",
            },
            "last_refresh": "2026-09-15T05:05:11Z",
        });
        crate::store::write_raw(
            &codex.chain,
            Permit::for_a_test(),
            &codex.service,
            &login.to_string(),
        )
        .expect("a Codex login");

        let mut s = state(&["alpha", "beta"]);
        s.accounts.push(codex_account("work", "work-acc"));
        s.accounts.push(codex_account("home", "home-acc"));
        let beta = InUse::of(&s.accounts[1], "beta-refresh", NOW);
        s.identified(ProviderId::Claude, beta, NOW);
        let home = InUse::of(&s.accounts[3], "home-refresh", NOW);
        s.identified(ProviderId::Codex, home, NOW);
        let report = gather_offline(&ctx, &s);
        let signed_in: Vec<(ProviderId, &str)> = report
            .rows
            .iter()
            .filter(|r| r.signed_in)
            .map(|r| (r.provider, r.label.as_deref().unwrap_or_default()))
            .collect();
        assert_eq!(
            signed_in,
            [(ProviderId::Claude, "beta"), (ProviderId::Codex, "work")]
        );
        assert_eq!(
            report
                .signed_in
                .expect("what Anthropic last said")
                .account_uuid,
            "beta-uuid"
        );
        assert_eq!(api.calls(), 0, "offline asks nobody");
    }

    /// Offline, the login of an account nobody enrolled is in use where Anthropic last named
    /// it, and has its row with what was last measured, as it has online. Between the app's
    /// reads it went, and the account Claude Code's config named was in use in its place.
    #[test]
    #[cfg_attr(windows, ignore = "W15: files made private to the person on Windows")]
    fn offline_a_login_nobody_enrolled_has_its_row() {
        let home = scratch("offline-unenrolled");
        let (ctx, _mem, api) = machine(&home.0, Some("alpha-uuid"));
        let mut s = state(&["alpha"]);
        let stranger = InUse {
            owner: Some(owner("stranger-uuid")),
            login: "stranger-refresh".into(),
            known_at: NOW,
            named: in_use::named(&ctx, ProviderId::Claude),
        };
        s.identified(ProviderId::Claude, stranger, NOW);
        readings::answered(
            &ctx,
            Permit::for_a_test(),
            &[("stranger-uuid_org".into(), reading(30.0, Source::Live))],
        );

        let report = gather_offline(&ctx, &s);

        let in_use: Vec<(Option<&str>, &str, Option<f64>)> = report
            .rows
            .iter()
            .filter(|r| r.signed_in)
            .map(|r| {
                let share = r.usage.as_ref().map(|u| u.windows[0].percent);
                (r.label.as_deref(), r.email.as_str(), share)
            })
            .collect();
        assert_eq!(in_use, [(None, "stranger-uuid@example.com", Some(30.0))]);
        assert_eq!(
            report.signed_in.expect("the record's").account_uuid,
            "stranger-uuid"
        );
        assert_eq!(api.calls(), 0);
    }

    /// Put `raw` where this machine's Codex keeps its login, exactly as written.
    fn plant_codex(ctx: &Context, raw: &str) {
        let codex = crate::provider::of(ProviderId::Codex)
            .live(ctx)
            .expect("Codex keeps its login in a file here");
        crate::store::write_raw(&codex.chain, Permit::for_a_test(), &codex.service, raw)
            .expect("a Codex login");
    }

    /// A Codex login whose ID token names `tokens_of` and whose account id names
    /// `account_id`. The two are the same in every login Codex writes on its own.
    fn codex_login(tokens_of: &str, account_id: &str) -> String {
        json!({
            "auth_mode": "chatgpt",
            "tokens": {
                "id_token": crate::provider::jwt::unsigned(&json!({
                    "email": format!("{tokens_of}@example.com"),
                    "https://api.openai.com/auth": {"chatgpt_account_id": tokens_of},
                })),
                "access_token": format!("access-{tokens_of}"),
                "refresh_token": format!("refresh-{tokens_of}"),
                "account_id": account_id,
            },
            "last_refresh": "2026-09-15T05:05:11Z",
        })
        .to_string()
    }

    /// Two Codex accounts, `a` parked and `b` the one whose login Pitboard last recorded in
    /// use, which has no park because a Codex park is moved rather than copied.
    fn codex_a_parked_b_in_use() -> State {
        let mut b = codex_account("b", "acc-B");
        b.parked = None;
        let mut s = State {
            accounts: vec![codex_account("a", "acc-A"), b],
            ..State::default()
        };
        let b = InUse::of(&s.accounts[1], "refresh-acc-B", NOW);
        s.identified(ProviderId::Codex, b, NOW);
        s
    }

    fn codex_row<'a>(report: &'a Report, label: &str) -> &'a Row {
        report
            .rows
            .iter()
            .find(|r| r.provider == ProviderId::Codex && r.label.as_deref() == Some(label))
            .unwrap_or_else(|| panic!("a row for codex/{label}"))
    }

    /// What a codex still running from before a switch leaves when it refreshes in the
    /// middle of one: its own account's tokens under the other account's id. That is not
    /// nobody signed in, which is what status used to say while `status --offline` named
    /// the account the tokens belong to and `doctor` failed the login. Online, offline and
    /// doctor now agree on whose it is, and online says Pitboard cannot use it.
    #[test]
    #[cfg_attr(windows, ignore = "W21: switching Codex on Windows")]
    fn a_codex_login_that_mixes_two_accounts_is_said_rather_than_read_as_nobody() {
        let home = scratch("mixed");
        let (ctx, _mem, api) = machine(&home.0, None);
        plant_codex(&ctx, &codex_login("acc-A", "acc-B"));
        let s = codex_a_parked_b_in_use();

        let report = gather(&ctx, &s);
        let a = codex_row(&report, "a");
        assert!(a.signed_in, "the tokens are a's, as its own record says");
        assert_eq!(a.stale, Some(Stale::LoginUnusable));
        assert_eq!(
            a.explanation(),
            Some("Codex's login is not one Pitboard can park or switch; run `pitboard doctor`")
        );
        assert!(!codex_row(&report, "b").signed_in);
        assert!(
            report
                .rows
                .iter()
                .all(|r| r.stale != Some(Stale::NothingSignedIn)),
            "something is signed in"
        );
        assert!(
            report.rows.iter().all(|r| !r.unplaced()),
            "the login is pinned on a, so it needs no row of its own"
        );
        assert_eq!(
            api.calls(),
            0,
            "nobody was asked about a login mixing two accounts"
        );

        let offline = gather_offline(&ctx, &s);
        assert!(codex_row(&offline, "a").signed_in, "offline says the same");
    }

    /// Signed in with an API key: something is signed in, and it is no account. Not nobody,
    /// and not the account whose login Pitboard last recorded in use either, which the key
    /// replaced.
    #[test]
    #[cfg_attr(windows, ignore = "W21: switching Codex on Windows")]
    fn a_codex_login_with_an_api_key_is_said_and_pinned_on_no_account() {
        let home = scratch("api-key");
        let (ctx, _mem, api) = machine(&home.0, None);
        plant_codex(
            &ctx,
            &json!({"auth_mode": "apikey", "OPENAI_API_KEY": "sk-not-a-real-key"}).to_string(),
        );
        let s = codex_a_parked_b_in_use();

        let report = gather(&ctx, &s);
        assert!(
            report.rows.iter().all(|r| !r.signed_in),
            "no account is signed in"
        );
        let said = report
            .rows
            .iter()
            .find(|r| r.unplaced())
            .expect("a row saying what is signed in to Codex");
        assert_eq!(said.provider, ProviderId::Codex);
        assert_eq!(said.stale, Some(Stale::LoginUnusable));
        assert!(said.email.is_empty() && said.account_uuid.is_empty());
        assert_eq!(api.calls(), 0);
    }

    /// Somebody who uses Pitboard for Claude Code and also has Codex signed in has not
    /// asked for their Codex login to be read or sent anywhere. Until a Codex account is
    /// enrolled, status says nothing about Codex and asks OpenAI nothing.
    #[test]
    #[cfg_attr(windows, ignore = "W21: switching Codex on Windows")]
    fn a_tool_with_nothing_enrolled_is_neither_read_nor_asked() {
        let home = scratch("not-opted-in");
        let (ctx, _mem, api) = machine(&home.0, None);
        plant_codex(&ctx, &codex_login("acc-B", "acc-B"));
        let s = State::default();

        let report = gather(&ctx, &s);
        assert!(
            report.rows.iter().all(|r| r.provider != ProviderId::Codex),
            "no Codex row for a machine that enrolled no Codex account"
        );
        assert!(
            api.asked()
                .iter()
                .all(|asked| !matches!(asked, crate::api::scripted::Asked::Usage(t) if t.contains("acc-B"))),
            "and nothing was asked about it"
        );
        let offline = gather_offline(&ctx, &s);
        assert!(offline.rows.iter().all(|r| r.provider != ProviderId::Codex));
    }

    /// Codex writes its login with a plain truncating write, so a read can catch it half
    /// written. Codex keeps no record apart from the login, so its own record names nobody
    /// then, and Pitboard's record of whose login is stored stands in for it the way
    /// `doctor` already lets it. Without that, the account in use was told to sign in again.
    #[test]
    #[cfg_attr(windows, ignore = "W21: switching Codex on Windows")]
    fn a_codex_login_caught_half_written_still_names_the_account_in_use() {
        let home = scratch("half-written");
        let (ctx, _mem, api) = machine(&home.0, None);
        let whole = codex_login("acc-B", "acc-B");
        plant_codex(&ctx, &whole[..whole.len() / 2]);
        let s = codex_a_parked_b_in_use();
        crate::state::save(&ctx, Permit::for_a_test(), &s).expect("an account list");

        let report = gather(&ctx, &s);
        let b = codex_row(&report, "b");
        assert!(b.signed_in, "the account Pitboard last recorded in use");
        assert_eq!(b.stale, Some(Stale::LoginUnreadable));
        assert!(!codex_row(&report, "a").signed_in);
        assert!(
            report.rows.iter().all(|r| !r.unplaced()),
            "pinned, so no row of its own"
        );
        assert_eq!(api.calls(), 0);

        let doctor = crate::doctor::gather(&ctx);
        let active: Vec<&str> = doctor
            .parks
            .iter()
            .filter(|p| p.active)
            .map(|p| p.label.as_str())
            .collect();
        assert_eq!(active, ["b"], "doctor reads the same machine the same way");
    }

    /// Only nothing at all is nobody. A Claude Code document with no account in it is what
    /// `/logout` leaves; one that is not a document of Claude Code's shape at all is a login
    /// Pitboard cannot use, and is said as one.
    #[test]
    #[cfg_attr(windows, ignore = "W15: files made private to the person on Windows")]
    fn only_a_document_holding_no_login_is_nobody_signed_in() {
        let home = scratch("shapes");
        let (ctx, _mem, api) = machine(&home.0, Some("alpha-uuid"));
        let mut beta_in_use = state(&["alpha", "beta"]);
        let beta = InUse::of(&beta_in_use.accounts[1], "beta-refresh", NOW);
        beta_in_use.identified(ProviderId::Claude, beta, NOW);
        let ask = |document: Value| {
            ask_live(
                &ctx,
                &beta_in_use,
                ProviderId::Claude,
                &stored(document),
                &HashMap::new(),
                true,
            )
            .login
        };

        let nobody = ask(json!({"mcpOAuth": {}}));
        assert!(nobody.signed_in.is_none() && !nobody.out_of_reach);
        assert_eq!(nobody.usage().err(), Some(Stale::NothingSignedIn));

        let unusable = ask(json!(["a login", "that is not an object"]));
        assert!(matches!(unusable.signed_in, Some(Err(_))));
        assert!(unusable.out_of_reach);
        assert_eq!(unusable.usage().err(), Some(Stale::LoginUnusable));
        assert_eq!(
            unusable.known, None,
            "neither Claude Code's config nor Pitboard's record of whose login was stored"
        );
        assert_eq!(api.calls(), 0);
    }

    /// One person's two organisations are two rows, and the one in use is the organisation
    /// Anthropic names.
    #[test]
    fn the_row_in_use_is_the_organisation_anthropic_names() {
        let in_organisation = |label: &str, id: &str, organization: &str| Account {
            id: id.into(),
            account_uuid: "acc".into(),
            detail: crate::state::Detail::Claude {
                organization_uuid: organization.into(),
                oauth_account: json!({}),
            },
            ..account(label)
        };
        let state = State {
            accounts: vec![
                in_organisation("work", "acc", "org-a"),
                in_organisation("team", "acc_org-b", "org-b"),
            ],
            ..State::default()
        };
        let facts = only_claude(
            LiveLogin {
                signed_in: Some(Ok(Owner {
                    account_uuid: "acc".into(),
                    email: "acc@example.com".into(),
                    organization_uuid: "org-b".into(),
                })),
                usage: Some(Ok(reading(30.0, Source::Live))),
                ..LiveLogin::default()
            },
            &[],
        );

        let rows = assemble(&state, &facts, nothing_remembered, NOW);
        let said: Vec<(Option<&str>, &str, Option<&str>, bool)> = rows
            .iter()
            .map(|r| {
                (
                    r.label.as_deref(),
                    r.id.as_str(),
                    r.organization_uuid.as_deref(),
                    r.signed_in,
                )
            })
            .collect();
        assert_eq!(
            said,
            [
                (Some("team"), "acc_org-b", Some("org-b"), true),
                (Some("work"), "acc", Some("org-a"), false),
            ]
        );
    }

    /// A front end is told which rows are a login Pitboard could not pin on any account,
    /// so it can say so instead of showing an account nobody has enrolled.
    #[test]
    fn a_row_is_unplaced_only_when_it_is_a_login_on_no_account() {
        let mut row = Row {
            provider: ProviderId::Codex,
            label: None,
            email: String::new(),
            id: String::new(),
            account_uuid: String::new(),
            organization_uuid: None,
            signed_in: false,
            parked: None,
            usage: None,
            stale: Some(Stale::LoginUnreadable),
        };
        assert!(row.unplaced());
        row.stale = Some(Stale::LoginUnusable);
        assert!(row.unplaced());
        row.signed_in = true;
        row.stale = Some(Stale::SessionExpired);
        assert!(!row.unplaced(), "an unenrolled login that is signed in");
        row.signed_in = false;
        row.label = Some("work".into());
        row.stale = Some(Stale::LoginUnreadable);
        assert!(!row.unplaced(), "an account");
    }

    /// A home of this test's own, removed when the test is done with it.
    struct Scratch(std::path::PathBuf);

    impl Drop for Scratch {
        fn drop(&mut self) {
            let _ = std::fs::remove_dir_all(&self.0);
        }
    }

    fn scratch(name: &str) -> Scratch {
        let root = std::env::temp_dir().join(format!(
            "pitboard-status-{name}-{}-{:?}",
            std::process::id(),
            std::thread::current().id()
        ));
        let _ = std::fs::remove_dir_all(&root);
        std::fs::create_dir_all(&root).expect("a scratch home");
        Scratch(root)
    }

    /// A machine of this test's own: stores in memory, services from a script, a clock
    /// that stands still, every tool's home inside `root`, and Claude Code's config naming
    /// `recorded` as signed in where it names anybody.
    fn machine(
        root: &std::path::Path,
        recorded: Option<&str>,
    ) -> (Context, Arc<MemoryHost>, Arc<ScriptedApi>) {
        let mem = MemoryHost::new();
        let api = ScriptedApi::new();
        let ctx = Context::new(root.to_path_buf())
            .with_pitboard_home(root.join(".pitboard"))
            .with_codex_home(root.join("codex").to_string_lossy().into())
            // Named, so nothing here looks up this machine's own `codex` on `PATH`.
            .with_codex_program(root.join("bin").join("codex"))
            .with_memory_stores(Arc::clone(&mem))
            .with_scripted_api(Arc::clone(&api))
            .with_clock(Arc::new(FixedClock::at(NOW)) as Arc<dyn Clock>);
        crate::home::ensure(&ctx, Permit::for_a_test()).expect("a Pitboard home");
        if let Some(uuid) = recorded {
            std::fs::write(
                root.join(".claude.json"),
                json!({"oauthAccount": {
                    "accountUuid": uuid,
                    "emailAddress": format!("{uuid}@example.com"),
                    "organizationUuid": "org",
                }})
                .to_string(),
            )
            .expect("a Claude Code config");
        }
        (ctx, mem, api)
    }
}