@oh-my-pi/pi-ai 18.3.4 → 18.4.0

package/dist/types/usage/claude.d.ts

@@ -1,4 +1,10 @@
 import { type CredentialRankingStrategy, type UsageProvider, type UsageReport } from "../usage.js";
 export declare function parseClaudeRateLimitHeaders(headers: Record<string, string>, now?: number): UsageReport | null;
+/** Parse the quota evidence in one live usage response, without any additional requests. */
+export declare function parseClaudeUsagePayload(raw: unknown, identity?: {
+    accountId?: string;
+    email?: string;
+    orgId?: string;
+}, endpoint?: string, fetchedAt?: number): UsageReport | null;
 export declare const claudeUsageProvider: UsageProvider;
 export declare const claudeRankingStrategy: CredentialRankingStrategy;

package/dist/types/usage.d.ts

@@ -669,6 +669,8 @@ export interface CredentialRankingStrategy {
         limits: UsageLimit[];
         healthy?: boolean;
     }[];
+    /** Whether fresh reports can heal legacy account-wide quota backoffs. */
+    healsGlobalBlocks?: boolean;
     /** Fallback window durations (ms) when limits don't specify durationMs. */
     windowDefaults: {
         primaryMs: number;

package/dist/types/utils/proxy.d.ts

@@ -23,8 +23,8 @@ export declare function getProxyForUrl(provider: string, url: URL): string | und
 /**
  * Return `init` with `proxy: proxyUrl` set when the request should tunnel.
  * A caller-supplied `init.proxy` always wins (the innermost, most specific
- * decision); local/metadata hosts, NO_PROXY matches, and unparseable URLs
- * pass through unchanged.
+ * decision); Unix sockets, local/metadata hosts, NO_PROXY matches, and
+ * unparseable URLs pass through unchanged.
  */
 export declare function withProxyInit(input: string | URL | Request, init: RequestInit | undefined, proxyUrl: string): RequestInit | undefined;
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@oh-my-pi/pi-ai",
-	"version": "18.3.4",
+	"version": "18.4.0",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"keywords": [
 		"ai",
@@ -155,11 +155,11 @@
 		"fmt": "oxfmt --no-error-on-unmatched-pattern 'src/**/*.{ts,tsx}' '{test,bench,examples,scripts}/**/*.ts' '*.ts'"
 	},
 	"dependencies": {
-		"@oh-my-pi/omptype": "18.3.4",
-		"@oh-my-pi/pi-catalog": "18.3.4",
-		"@oh-my-pi/pi-natives": "18.3.4",
-		"@oh-my-pi/pi-utils": "18.3.4",
-		"@oh-my-pi/pi-wire": "18.3.4"
+		"@oh-my-pi/omptype": "18.4.0",
+		"@oh-my-pi/pi-catalog": "18.4.0",
+		"@oh-my-pi/pi-natives": "18.4.0",
+		"@oh-my-pi/pi-utils": "18.4.0",
+		"@oh-my-pi/pi-wire": "18.4.0"
 	},
 	"devDependencies": {
 		"@types/bun": "^1.3.14"

package/src/auth/blocks.ts

@@ -22,6 +22,12 @@ export function scopedBackoffKey(providerKey: string, blockScope: string | undef
 	return blockScope ? `${providerKey}\0${blockScope}` : providerKey;
 }
 
+/** Authentication backoffs apply to every model and cannot be healed by quota evidence. */
+export const AUTH_BLOCK_SCOPE = "auth";
+/** Account-policy backoffs apply to every model and survive quota resets. */
+export const ACCOUNT_POLICY_BLOCK_SCOPE = "account-policy";
+const PROTECTED_BLOCK_SCOPES = [AUTH_BLOCK_SCOPE, ACCOUNT_POLICY_BLOCK_SCOPE] as const;
+
 const MODEL_ACCOUNT_POLICY_BLOCK_SCOPE_PREFIX = "model-policy:";
 const MODEL_ACCOUNT_POLICY_PROVIDERS: Readonly<Record<string, true>> = {
 	"openai-codex": true,
@@ -56,7 +62,7 @@ export function credentialBlockScopesForRequest(
  * than a heuristic guess, tracking whichever deadline won the longest-wins
  * merge. `probeAfter` is the earliest time live usage reconciliation may clear it.
  */
-type CredentialBackoff = { until: number; timed: boolean; probeAfter: number };
+type CredentialBackoff = { until: number; timed: boolean; probeAfter: number; persisted?: boolean };
 
 /** Latch for unrecoverably corrupt persisted block stores, shared with the credential pool. */
 export class BlockStoreHealth {
@@ -132,6 +138,23 @@ export class CredentialBlocks implements BlocksApi {
 	#getCredentialBlockedUntilForKey(backoffKey: string, credentialId: number, nowMs: number): number | undefined {
 		const block = this.#credentialBackoff.get(backoffKey)?.get(credentialId);
 		if (!block) return undefined;
+		// Once mirrored successfully, the store is authoritative for cross-process
+		// deletion. A reset in a sibling must also retire this process's old map entry.
+		if (block.persisted && !this.#deps.health.damaged && this.#deps.store.getCredentialBlock) {
+			const separator = backoffKey.indexOf("\0");
+			const providerKey = separator < 0 ? backoffKey : backoffKey.slice(0, separator);
+			const scope = separator < 0 ? "" : backoffKey.slice(separator + 1);
+			try {
+				const persisted = this.#deps.store.getCredentialBlock(credentialId, providerKey, scope);
+				if (persisted === undefined) {
+					this.#deleteCredentialBackoff(backoffKey, credentialId);
+					return undefined;
+				}
+			} catch (err) {
+				// Failed reads never turn a local backoff into permission to retry.
+				this.#deps.health.handle(err);
+			}
+		}
 		if (block.until <= nowMs) {
 			this.#deleteCredentialBackoff(backoffKey, credentialId);
 			return undefined;
@@ -189,6 +212,16 @@ export class CredentialBlocks implements BlocksApi {
 		}
 	}
 
+	#exactBlockedUntil(credentialId: number, providerKey: string, scope: string | undefined): number | undefined {
+		const memory = this.#getCredentialBlockedUntilForKey(
+			scopedBackoffKey(providerKey, scope),
+			credentialId,
+			Date.now(),
+		);
+		const persisted = this.#readPersistedCredentialBlock(credentialId, providerKey, scope);
+		return memory === undefined ? persisted : persisted === undefined ? memory : Math.max(memory, persisted);
+	}
+
 	/** Returns block expiry timestamp for a credential, checking unscoped and scoped blocks. */
 	blockedUntil(
 		provider: string,
@@ -199,9 +232,10 @@ export class CredentialBlocks implements BlocksApi {
 		const nowMs = Date.now();
 		// A request honours its own scope plus any legacy catch-all scope, so a
 		// block written before backoff was scoped still applies to everything.
-		const scopes = (
-			typeof blockScopeOrScopes === "string" ? [blockScopeOrScopes] : (blockScopeOrScopes ?? [])
-		).filter(scope => scope.length > 0);
+		const scopes = [
+			...PROTECTED_BLOCK_SCOPES,
+			...(typeof blockScopeOrScopes === "string" ? [blockScopeOrScopes] : (blockScopeOrScopes ?? [])),
+		].filter(scope => scope.length > 0);
 		const credentialId = this.#deps.pool.entries(provider)[credentialIndex]?.id;
 		if (credentialId === undefined) return undefined;
 		let blockedUntil = this.#getCredentialBlockedUntilForKey(providerKey, credentialId, nowMs);
@@ -262,9 +296,10 @@ export class CredentialBlocks implements BlocksApi {
 		credentialId: number,
 		deadline: number,
 	): boolean {
-		const scopes = (
-			typeof blockScopeOrScopes === "string" ? [blockScopeOrScopes] : (blockScopeOrScopes ?? [])
-		).filter(scope => scope.length > 0);
+		const scopes = [
+			...PROTECTED_BLOCK_SCOPES,
+			...(typeof blockScopeOrScopes === "string" ? [blockScopeOrScopes] : (blockScopeOrScopes ?? [])),
+		].filter(scope => scope.length > 0);
 		for (const key of [providerKey, ...scopes.map(scope => scopedBackoffKey(providerKey, scope))]) {
 			const block = this.#credentialBackoff.get(key)?.get(credentialId);
 			if (block?.until === deadline && block.timed) return true;
@@ -290,6 +325,8 @@ export class CredentialBlocks implements BlocksApi {
 		const credentialId = this.#deps.pool.entries(provider)[credentialIndex]?.id;
 		if (credentialId === undefined) return;
 		const backoffKey = scopedBackoffKey(providerKey, blockScope);
+		// Adopt externally deleted rows before longest-wins merging a new failure.
+		this.#getCredentialBlockedUntilForKey(backoffKey, credentialId, Date.now());
 		const backoffMap = this.#credentialBackoff.get(backoffKey) ?? new Map<number, CredentialBackoff>();
 		const existing = backoffMap.get(credentialId);
 		const existingUntil = existing?.until ?? 0;
@@ -318,6 +355,8 @@ export class CredentialBlocks implements BlocksApi {
 				blockScope: blockScope ?? "",
 				blockedUntilMs: nextBlockedUntil,
 			});
+			const block = backoffMap.get(credentialId);
+			if (block) block.persisted = true;
 		} catch (err) {
 			if (this.#deps.health.handle(err)) return;
 			logger.debug("Failed to persist credential block", {
@@ -356,18 +395,17 @@ export class CredentialBlocks implements BlocksApi {
 		}
 	}
 
-	/**
-	 * Clear one backoff scope. The in-memory backoff is per scope so it is
-	 * dropped directly; the persisted store deletes a credential's blocks as a
-	 * unit, so it is only purged once no other scope still holds a live block.
-	 * Leaving a persisted row behind is safe: the scope it belongs to is
-	 * unblocked in memory, and the row heals on the pass where its own meter
-	 * recovers.
-	 */
-	clearScope(provider: string, credentialId: number, providerKey: string, blockScope: string | undefined): void {
-		this.#deleteCredentialBackoff(scopedBackoffKey(providerKey, blockScope), credentialId);
+	/** Clear exactly one quota scope, preserving unrelated account and model blocks. */
+	clearScope(provider: string, credentialId: number, providerKey: string, blockScope: string | undefined): boolean {
+		// A damaged store neither holds nor reads persisted rows; memory is the whole block.
+		if (this.#deps.health.damaged) {
+			this.#deleteCredentialBackoff(scopedBackoffKey(providerKey, blockScope), credentialId);
+			return true;
+		}
 		try {
-			this.delete(credentialId, providerKey, blockScope ?? "");
+			this.delete(credentialId, providerKey, blockScope ?? "", false);
+			this.#deleteCredentialBackoff(scopedBackoffKey(providerKey, blockScope), credentialId);
+			return true;
 		} catch (err) {
 			logger.debug("Failed to clear persisted credential block", {
 				err,
@@ -375,6 +413,7 @@ export class CredentialBlocks implements BlocksApi {
 				credentialId,
 				blockScope,
 			});
+			return false;
 		}
 	}
 
@@ -386,12 +425,8 @@ export class CredentialBlocks implements BlocksApi {
 	/**
 	 * Whether a fresh report could lift what currently blocks this credential.
 	 *
-	 * A strategy that names healable scopes can only vouch for those scopes, so
-	 * a live unscoped block — an Opus/Sonnet usage limit, a refresh failure —
-	 * keeps the credential unusable whatever the report says about a tier. A
-	 * probe then cannot change the outcome and must not be spent; the tier scope
-	 * heals on a later pass, once the block that actually holds the credential
-	 * has lifted.
+	 * Claude reports can heal legacy account-wide quota blocks too. Explicit
+	 * auth/account-policy blocks never justify a usage probe.
 	 */
 	canHeal(
 		provider: Provider,
@@ -400,7 +435,15 @@ export class CredentialBlocks implements BlocksApi {
 		blockScopeOrScopes: string | readonly string[] | undefined,
 	): boolean {
 		if (!this.supportsHealing(provider)) return false;
-		if (this.blockedUntil(provider, providerKey, credentialIndex) !== undefined) return false;
+		const credentialId = this.#deps.pool.entries(provider)[credentialIndex]?.id;
+		if (credentialId === undefined) return false;
+		if (PROTECTED_BLOCK_SCOPES.some(scope => this.#exactBlockedUntil(credentialId, providerKey, scope) !== undefined))
+			return false;
+		if (
+			!this.#deps.strategies(provider)?.healsGlobalBlocks &&
+			this.blockedUntil(provider, providerKey, credentialIndex) !== undefined
+		)
+			return false;
 		return this.blockedUntil(provider, providerKey, credentialIndex, blockScopeOrScopes) !== undefined;
 	}
 
@@ -423,7 +466,7 @@ export class CredentialBlocks implements BlocksApi {
 		for (const { blockScope, limits, healthy } of strategy?.healableBlockScopes?.(report) ?? []) {
 			if (healthy === false || isUsageLimitReached(limits) || (healthy === undefined && limits.length === 0))
 				continue;
-			this.#clearHealedBlockScope(provider, providerKey, credentialId, credentialIndex, blockScope);
+			this.#clearHealedBlockScope(provider, providerKey, credentialId, blockScope, report.fetchedAt);
 		}
 	}
 
@@ -437,25 +480,23 @@ export class CredentialBlocks implements BlocksApi {
 		provider: Provider,
 		providerKey: string,
 		credentialId: number,
-		credentialIndex: number,
 		blockScope: string | undefined,
+		fetchedAt: number,
 	): void {
-		const blockedUntilMs = this.blockedUntil(provider, providerKey, credentialIndex, blockScope);
+		const blockedUntilMs = this.#exactBlockedUntil(credentialId, providerKey, blockScope);
 		if (blockedUntilMs === undefined) return;
 		const nowMs = Date.now();
 		const scopedKey = scopedBackoffKey(providerKey, blockScope);
-		const globalProbeAfterMs = this.#credentialBackoff.get(providerKey)?.get(credentialId)?.probeAfter ?? 0;
 		const scopedProbeAfterMs = this.#credentialBackoff.get(scopedKey)?.get(credentialId)?.probeAfter ?? 0;
-		const storeGlobalProbeAfterMs = this.#readPersistedCredentialBlockReconcileAfter(credentialId, providerKey, "");
 		const storeScopedProbeAfterMs = this.#readPersistedCredentialBlockReconcileAfter(
 			credentialId,
 			providerKey,
 			blockScope ?? "",
 		);
-		if (Math.max(globalProbeAfterMs, scopedProbeAfterMs, storeGlobalProbeAfterMs, storeScopedProbeAfterMs) > nowMs) {
+		if (Math.max(scopedProbeAfterMs, storeScopedProbeAfterMs) > Math.min(nowMs, fetchedAt)) {
 			return;
 		}
-		this.clearScope(provider, credentialId, providerKey, blockScope);
+		if (!this.clearScope(provider, credentialId, providerKey, blockScope)) return;
 		logger.info("Cleared stale usage-limit block after healthy live usage report", {
 			credentialId,
 			provider,
@@ -474,6 +515,7 @@ export class CredentialBlocks implements BlocksApi {
 	#findStoredCredentialIdsForUsageReport(report: UsageReport): number[] {
 		if (!this.supportsHealing(report.provider)) return [];
 		const email = usageReportMetadataValue(report, "email")?.toLowerCase();
+		const orgId = usageReportMetadataValue(report, "orgId");
 		const accountId = (
 			usageReportMetadataValue(report, "accountId") ?? usageReportScopeAccountId(report)
 		)?.toLowerCase();
@@ -484,6 +526,7 @@ export class CredentialBlocks implements BlocksApi {
 			if (credential.type !== "oauth") continue;
 			const credentialEmail = credential.email?.trim().toLowerCase();
 			const credentialAccountId = credential.accountId?.trim().toLowerCase();
+			if (orgId && credential.orgId && orgId !== credential.orgId.trim()) continue;
 			// Every identity dimension present on BOTH sides must agree — the
 			// account id is shared workspace-wide and one email can span
 			// workspaces, so a single-dimension match can cross-link siblings.
@@ -540,20 +583,19 @@ export class CredentialBlocks implements BlocksApi {
 		this.#deps.pool.bump("credential-block");
 	}
 
-	/**
-	 * Broker-server seam: clear all persisted blocks for one credential and notify snapshot waiters.
-	 */
-	delete(credentialId: number, providerKey: string, blockScope: string): void {
+	/** Broker-server seam: clear exactly one persisted and local block and notify snapshot waiters. */
+	delete(credentialId: number, providerKey: string, blockScope: string, invalidateUsage = true): void {
 		this.#deps.health.assertWritable();
 		const deleteCredentialBlock = this.#deps.store.deleteCredentialBlock?.bind(this.#deps.store);
 		if (!deleteCredentialBlock) return;
 		try {
 			deleteCredentialBlock(credentialId, providerKey, blockScope);
+			this.#deleteCredentialBackoff(scopedBackoffKey(providerKey, blockScope), credentialId);
 		} catch (err) {
 			if (this.#deps.health.handle(err)) this.#deps.health.assertWritable();
 			throw err;
 		}
-		this.#deps.usageCache.invalidateProviderKey(providerKey);
+		if (invalidateUsage) this.#deps.usageCache.invalidateProviderKey(providerKey);
 		this.#deps.pool.bump("credential-block");
 	}
 

package/src/auth/cascade.ts

@@ -1,6 +1,6 @@
 import { authPolicyFor } from "@oh-my-pi/pi-catalog/compat/auth";
 import { $env, $envExact } from "@oh-my-pi/pi-utils";
-import type { ApiKeyResolver, ResolvedApiKey } from "../auth-retry";
+import { type ApiKeyResolver, markAfterSiblingWait, type ResolvedApiKey } from "../auth-retry";
 import * as AIError from "../error";
 import { isUsageLimitOutcome } from "../error/rate-limit";
 import { AUTHENTICATED_SENTINEL } from "../registry/types";
@@ -374,13 +374,13 @@ export class KeyCascade implements KeysApi {
 				});
 			}
 			if (lastChance) {
-				const switched = await this.#deps.rotate(provider, sessionId, {
+				const rotation = await this.#deps.rotate(provider, sessionId, {
 					error,
 					modelId,
 					signal,
 					apiKey: previousKey,
 				});
-				if (!switched) {
+				if (!rotation.switched) {
 					const status = AIError.status(error);
 					const message = error instanceof Error ? error.message : typeof error === "string" ? error : undefined;
 					// Preserve no-sibling quota backoff instead of re-resolving an
@@ -388,11 +388,12 @@ export class KeyCascade implements KeysApi {
 					// because a peer may have refreshed the failed bearer.
 					if (AIError.isUsageLimit(error) || isUsageLimitOutcome(status, message)) return undefined;
 				}
-				return this.getWithCredential(provider, sessionId, {
+				const resolved = await this.getWithCredential(provider, sessionId, {
 					baseUrl,
 					modelId,
 					signal,
 				});
+				return rotation.afterSiblingWait ? markAfterSiblingWait(resolved) : resolved;
 			}
 			return this.getWithCredential(provider, sessionId, {
 				baseUrl,

package/src/auth/resets.ts

@@ -5,12 +5,15 @@ import { claudeResetClearedBlockScopes, consumeClaudeResetCredit, listClaudeRese
 import { consumeCodexResetCredit, listCodexResetCredits, pickSoonestExpiringCredit } from "../usage/openai-codex-reset";
 import type { CredentialBlocks } from "./blocks";
 import { providerTypeKey } from "./blocks";
+import { raceSignal } from "./abort";
+import { isUsageLimitReached } from "./usage-report";
 import type { OAuthAccounts } from "./oauth";
 import type { CredentialPool } from "./pool";
 import type { AuthCredentialStore } from "./store";
 import type {
 	ListResetCreditsOptions,
 	OAuthAccess,
+	OAuthAccountSummary,
 	RedeemResetCreditOptions,
 	ResetCreditAccountStatus,
 	ResetCreditRedeemOutcome,
@@ -34,10 +37,11 @@ export class ResetCredits implements ResetsApi {
 	#deps: ResetCreditsDeps;
 	/** Manual and automatic attempts on one stored account share a mutation. */
 	#resetInFlight = new Map<string, { creditId?: string; promise: Promise<ResetCreditRedeemOutcome> }>();
+	#listInFlight = new Map<string, Promise<ResetCreditAccountStatus[]>>();
 	/** Ambiguous Claude claims retain their idempotency key until reconciled. */
 	#pendingClaudeResets = new Map<
 		string,
-		{ creditId: string; requestId: string; program?: string; remainingCount?: number; startedAt: number }
+		{ creditId: string; requestId: string; program?: string; remainingCount?: number }
 	>();
 
 	constructor(deps: ResetCreditsDeps) {
@@ -48,34 +52,72 @@ export class ResetCredits implements ResetsApi {
 	async list(options?: ListResetCreditsOptions): Promise<ResetCreditAccountStatus[]> {
 		const provider = options?.provider ?? "openai-codex";
 		if (provider !== "openai-codex" && provider !== "anthropic") return [];
-		const accounts = this.#deps.oauth.accounts(provider, options?.sessionId);
 		const baseUrl = options?.baseUrlResolver?.(provider);
-		return Promise.all(
-			accounts.map(async (account): Promise<ResetCreditAccountStatus> => {
-				const base = { ...account, provider };
-				const access = await this.#deps.oauth.accessById(provider, account.credentialId, {
-					signal: options?.signal,
-				});
-				if (!access?.ok)
-					return {
-						...base,
-						availableCount: 0,
-						credits: [],
-						error: access?.error ?? "Account no longer available",
-					};
-				const auth = { ...access, baseUrl, fetch: this.#deps.usage.fetch, signal: options?.signal };
-				const list =
-					provider === "anthropic" ? await listClaudeResetCredits(auth) : await listCodexResetCredits(auth);
-				if (!list)
-					return {
-						...base,
-						availableCount: 0,
-						credits: [],
-						error: "Failed to load saved resets",
-					};
-				return { ...base, ...list };
-			}),
-		);
+		if (provider !== "anthropic") return this.#listAccounts(provider, baseUrl, options);
+		options?.signal?.throwIfAborted();
+		const activeId = this.#deps.oauth
+			.accounts(provider, options?.sessionId)
+			.find(account => account.active)?.credentialId;
+		// Discovery is sequential and probes the active account first, so only
+		// callers sharing that account can share one pass.
+		const key = JSON.stringify([provider, baseUrl, activeId]);
+		let pending = this.#listInFlight.get(key);
+		if (!pending) {
+			pending = this.#listAccounts(provider, baseUrl, { ...options, signal: undefined }).finally(() =>
+				this.#listInFlight.delete(key),
+			);
+			this.#listInFlight.set(key, pending);
+		}
+		return raceSignal(pending, options?.signal, "Reset discovery aborted");
+	}
+
+	async #listAccounts(
+		provider: string,
+		baseUrl: string | undefined,
+		options?: ListResetCreditsOptions,
+	): Promise<ResetCreditAccountStatus[]> {
+		const accounts = this.#deps.oauth.accounts(provider, options?.sessionId);
+		const loadAccount = async (account: OAuthAccountSummary): Promise<ResetCreditAccountStatus> => {
+			const base = { ...account, provider };
+			const access = await this.#deps.oauth.accessById(provider, account.credentialId, {
+				signal: options?.signal,
+			});
+			if (!access?.ok)
+				return {
+					...base,
+					availableCount: 0,
+					credits: [],
+					error: access?.error ?? "Account no longer available",
+				};
+			let retryAfterMs: number | undefined;
+			const auth = {
+				...access,
+				baseUrl,
+				fetch: this.#deps.usage.fetch,
+				signal: options?.signal,
+				onRateLimited: (delay: number | undefined) => {
+					retryAfterMs = delay ?? 0;
+				},
+			};
+			const list = provider === "anthropic" ? await listClaudeResetCredits(auth) : await listCodexResetCredits(auth);
+			if (!list)
+				return {
+					...base,
+					availableCount: 0,
+					credits: [],
+					error: "Failed to load saved resets",
+					...(retryAfterMs !== undefined ? { retryAfterMs } : {}),
+				};
+			return { ...base, ...list };
+		};
+		if (provider !== "anthropic") return Promise.all(accounts.map(loadAccount));
+		const results: ResetCreditAccountStatus[] = [];
+		accounts.sort((left, right) => Number(right.active) - Number(left.active));
+		for (const account of accounts) {
+			options?.signal?.throwIfAborted();
+			results.push(await loadAccount(account));
+		}
+		return results;
 	}
 
 	/**
@@ -142,7 +184,11 @@ export class ResetCredits implements ResetsApi {
 			}
 			creditId = selected.id;
 			let pending = this.#pendingClaudeResets.get(accountKey);
-			if (pending && Date.now() - pending.startedAt >= 10 * 60_000) {
+			const pendingCreditId = pending?.creditId;
+			// The ambiguous claim's credit left the live offer: it was consumed or
+			// expired. Either way its idempotency key can never settle, and the
+			// account is at a wall again now, so a new offer is a fresh claim.
+			if (pendingCreditId !== undefined && !list.credits.some(credit => credit.id === pendingCreditId)) {
 				this.#pendingClaudeResets.delete(accountKey);
 				pending = undefined;
 			}
@@ -154,20 +200,14 @@ export class ResetCredits implements ResetsApi {
 					selected.remainingCount < pending.remainingCount
 				) {
 					this.#pendingClaudeResets.delete(accountKey);
-					this.#deps.usageCache.invalidate(provider, options.baseUrl);
+					this.#deps.usageCache.invalidateAfterReset(provider, options.baseUrl);
 					return { ...identity, ok: false, code: "already_redeemed", creditId };
 				}
 				if (pending.program === "juniper_tide") {
 					return { ...identity, ok: false, code: "reset_unconfirmed", creditId };
 				}
 			}
-			const credential = this.#deps.pool.entries(provider).find(entry => entry.id === access.credentialId);
-			if (credential?.credential.type === "oauth") {
-				report = await this.#deps.usage.report(provider, credential.credential, {
-					baseUrl: options.baseUrl,
-					signal: options.signal,
-				});
-			}
+			report = list.report ?? null;
 			const requestId = pending?.requestId ?? crypto.randomUUID();
 			options.signal?.throwIfAborted();
 			this.#pendingClaudeResets.set(accountKey, {
@@ -175,7 +215,6 @@ export class ResetCredits implements ResetsApi {
 				requestId,
 				program: selected.program,
 				remainingCount: selected.remainingCount,
-				startedAt: pending?.startedAt ?? Date.now(),
 			});
 			const consumed = await consumeClaudeResetCredit({
 				...auth,
@@ -217,7 +256,7 @@ export class ResetCredits implements ResetsApi {
 			result = { ...identity, ok: consumed.ok, code: consumed.code, creditId };
 		}
 		if (result.ok) {
-			this.#deps.usageCache.invalidate(provider, options.baseUrl);
+			this.#deps.usageCache.invalidateAfterReset(provider, options.baseUrl);
 			if (this.#deps.store.invalidateUsageCache) {
 				await this.#deps.store.invalidateUsageCache(options.signal).catch(err => {
 					logger.debug("Failed to notify store of stale usage", { err });
@@ -229,11 +268,36 @@ export class ResetCredits implements ResetsApi {
 					const cleared = result.cleared ?? [];
 					if (
 						report &&
+						Number.isFinite(report.fetchedAt) &&
 						Date.now() - report.fetchedAt <= USAGE_REPORT_TTL_MS &&
 						cleared.length > 0 &&
 						this.#deps.pool.entries(provider).some(entry => entry.id === access.credentialId)
 					) {
-						for (const scope of claudeResetClearedBlockScopes(cleared, report)) {
+						const scopes = claudeResetClearedBlockScopes(cleared, report);
+						if (scopes.includes(undefined)) {
+							// A legacy global block may be the only stored evidence of a
+							// tier wall. Preserve that independent wall before lifting it.
+							for (const limit of report.limits) {
+								const tier = limit.scope.tier;
+								const reset = limit.window?.resetsAt;
+								if (
+									(tier !== "fable" && tier !== "mythos") ||
+									cleared.includes(limit.id) ||
+									!isUsageLimitReached([limit]) ||
+									typeof reset !== "number" ||
+									!Number.isFinite(reset) ||
+									reset <= Date.now()
+								)
+									continue;
+								this.#deps.blocks.upsert({
+									credentialId: access.credentialId,
+									providerKey: providerTypeKey(provider, "oauth"),
+									blockScope: `tier:${tier}`,
+									blockedUntilMs: reset,
+								});
+							}
+						}
+						for (const scope of scopes) {
 							this.#deps.blocks.clearScope(
 								provider,
 								access.credentialId,