---
version: 0.8.0
date: 2026-06-18
headline: "An account-policy layer for the fleet resume/switcher tools: the break-glass backup account is tombstoned out of the switcher, accounts carry an operator-editable policy, and available capacity is surfaced even when nothing has stopped on it."
themes: ["fleet"]
highlights:
  - "Backup/break-glass accounts are no longer offered as resume targets."
  - "New tools/fleet_accounts.py classifies every account: worker / excluded / non-account."
  - "Operator-editable policy file tombstones or allowlists accounts by tag."
  - "Healthy accounts (e.g. gem8) surface as available even with no stopped session."
  - "fleet_status.ps1 gains an ACCOUNTS section: available / blocked / excluded."
---

**TL;DR** — The resume/switcher layer used to treat every `.claude*` directory as an equal, resumable account. It now runs on an explicit account policy: the break-glass backup account is tombstoned, exclusions are operator-editable and visible, and an account's live availability is surfaced independently of whether a session happened to stop on it. Operators running the multi-account fleet get a clear, single-glance roster.

## Account policy — the switcher knows which accounts to offer (#fleet)

- **New source of truth `tools/fleet_accounts.py`.** Classifies every `.claude*` dir into `worker` (offered), `excluded` (tombstoned by policy), or `non-account` (no `projects/`, or a plain file). The session tools, the watchdog, and the status board all consult it.
  - *Why:* the old behavior globbed `.claude*` and offered break-glass backup accounts as resume targets, with no operator-visible roster.
  - *How:* `discover_accounts()` / `is_worker()` / `worker_accounts()` in `tools/fleet_accounts.py`.

- **Backup account tombstoned out of the switcher.** `backup` / `breakglass` tags are excluded by default — gone from `fleet_sessions.py` rows, `stopped_sessions.py` rows, and `resume_plan.json`. The watchdog re-checks each plan entry as defense-in-depth.
  - *How:* `fleet_sessions.py:scan()` and `stopped_sessions.py:main()` skip any non-`worker` account.

- **Operator-editable policy + clear CLI.** `tools/_registry/accounts_policy.json` (gitignored, host-local) tombstones accounts by `exclude` substring or restricts to an `include_only` allowlist; the committed `accounts_policy.example.json` and built-in defaults backstop it. `python tools/fleet_accounts.py list|json|available` prints the roster — what's offered, what's blocked now, what's tombstoned.

- **Availability, not just stopped-ness.** A worker account's live availability now folds the registry throttle map and any auth/credit blocks, so a healthy account (e.g. `gem8`) is surfaced as available even when nothing has stopped on it — the gap that hid spare capacity during the resume-layer incident.
  - *How:* `runtime_status()` in `fleet_accounts.py`; `fleet_sessions.py` adds an `accounts` array to its payloads and an `ACCOUNTS AVAILABLE` block; `fleet_status.ps1` renders an `ACCOUNTS` section.

- **Robustness.** A reset string's timezone parens are preserved while banner junk is dropped (`LIMIT_RE`); a malformed `age_min` no longer crashes runtime-status ordering. Covered by `tools/fleet_accounts_test.py` (hermetic unit tests).
