v0.28.4

Multi-account rotation was disabled in the most common way Tesserae runs.

Setting CLAUDE_CONFIG_DIR or CODEX_HOME replaced the discovered account list with that one directory — and every process launched from a Claude Code session inherits CLAUDE_CONFIG_DIR. So a compile could only ever use the account of the session that started it, and when that account ran dry, rotation had nowhere to go.

Measured on this project's own graph in a single day: one compile dropped 1,531 documents to deterministic extraction while two logged-in accounts sat idle with full quota; a later run lost 1,590 more to one account's expired OAuth with a healthy account beside it. The graph had quietly shrunk from ~13,000 nodes to 5,155 before anyone noticed.

Fixes

• The env var now names the account to try first, not the only one that may be tried — for both the Claude and Codex clients.
• llm_claude_config_dirs and the new llm_codex_homes (a list, in rotation order) are authoritative when set, and beat the ambient env var.
• Codex discovery requires auth.json, which excluded 24 stray ~/.codex-*.log files on a real machine — each costing a doomed codex exec per document.
• An exhausted account no longer costs a subprocess per remaining document. Deliberately hard to trip: every account tried must be a proven dead end, and one timeout among them means the run keeps going.
• Compile reports fallbacks=N on the machine-readable summary line and escalates from note: to WARNING: past 50% — closing the silence in #92 that made all of the above invisible for a day. Recovery is tesserae compile --changed-only --retry-fallbacks; no full recompile needed.
• The Claude extractor no longer passes --max-turns 1 (it counts tool calls, not replies, so an MCP server spent the only turn).
• @jokerized/tesserae now publishes from GitHub Actions via npm OIDC trusted publishing, with provenance attestations and no long-lived token.

Upgrading: drop-in, no API or schema change. If you run multiple accounts, tesserae compile --changed-only --retry-fallbacks recovers documents earlier versions degraded — cached responses mean only the affected files cost anything.

Full notes: docs/release-notes/v0.28.4.md