claude-multiacc 2.0.1 → 2.0.3

package/README.md

@@ -16,7 +16,7 @@ completely independent — separate manifests, credentials, telemetry, and logs
 either provider can be used, re-authenticated, or emptied without touching the other.
 
 Tested on: macOS (bash 3.2, zsh, Claude Code 2.1.207+, Codex CLI 0.147) and Ubuntu 24.04
-(bash 5.2). The compatibility suite currently covers 644 sandboxed cases with no
+(bash 5.2). The compatibility suite currently covers 645 sandboxed cases with no
 network/quota use; the unified selector has its own adversarial contract suite.
 
 ## Unified selector for app-robot
@@ -39,8 +39,9 @@ database locks, retries, and launching the selected CLI.
 Successful responses also carry `eligible_count` and `eligible_alternative_count`,
 so callers can persist proof that sole-account reviewer fallback was unavoidable.
 
-Run `multiacc-select --version` for the selector protocol version. The npm package
-version is independent and remains available through `claude-multiacc --version`.
+Run `multiacc-select --version` for the selector protocol version (currently
+`2.0.1`). The npm package version is independent and remains available through
+`claude-multiacc --version`.
 See [the complete selector contract](docs/UNIFIED_SELECTOR.md) for the request fields,
 ranking rules, stable errors, and caller boundary.
 
@@ -295,6 +296,12 @@ Codex-specific notes:
   own public client id) and the rotated credential is persisted 0600. Overrides for
   tests: `CODEX_MULTIACC_TOKEN_URL`, `CODEX_MULTIACC_CLIENT_ID`,
   `CODEX_MULTIACC_USAGE_URL`.
+- **Earned usage resets are redeemed automatically at 95% used** (5% remaining) or
+  when the backend reports the limit finished. The limits refresher checks the reset
+  credits belonging to that same account, uses the soonest-expiring available credit,
+  and writes a per-account/window idempotency key before redemption so a lost response
+  or simultaneous fleet poll cannot spend a second reset. Set
+  `CODEX_MULTIACC_AUTO_RESET=0` only for emergency rollback/testing.
 - **API-key logins are rejected** — ChatGPT subscription accounts only, matching the
   addon's no-API-keys rule.
 

package/bin/codex-accounts

@@ -83,6 +83,8 @@ USAGE
                                             `codex exec` per account
   codex-accounts limits [--quiet] [--force] [--json]
       refresh usage windows from the ChatGPT usage endpoint, apply >=90% markers.
+      When a fresh bucket is at least 95% used, automatically redeems an earned
+      usage-limit reset if the account has one, using an idempotent request.
       Auto-refreshes long-expired access tokens via the OAuth refresh-token grant
       (rotated credential is persisted), so idle accounts keep fresh telemetry and
       stay selectable. Skips accounts fetched in the last 45s and honors
@@ -102,6 +104,7 @@ ENV
   CODEX_ACCOUNT         pin the shim to one account
   CODEX_SHIM_RETRY=0    disable the `codex exec` auto-retry
   CODEX_MULTIACC_DISABLE=1  bypass the shim entirely
+  CODEX_MULTIACC_AUTO_RESET=0  disable automatic usage-reset redemption
 EOF
 }
 
@@ -1051,10 +1054,13 @@ cmd_limits() {
   case "$threshold" in ''|*[!0-9]*) threshold=90 ;; esac
   [ "$threshold" -gt 90 ] && threshold=90
   [ "$threshold" -lt 1 ] && threshold=90
-  "$PYBIN" - "$ACC_ROOT" "$threshold" "$quiet" "$USAGE_URL" "$force" <<'PYEOF' 2>>"$ACC_ROOT/limits.log"
+  "$PYBIN" - "$ACC_ROOT" "$threshold" "$quiet" "$USAGE_URL" "$force" "$LIB_DIR" <<'PYEOF' 2>>"$ACC_ROOT/limits.log"
 import base64, datetime, json, os, sys, time, urllib.request
 
-root, threshold, quiet, url, force = sys.argv[1], int(sys.argv[2]), sys.argv[3] == '1', sys.argv[4], sys.argv[5] == '1'
+root, threshold, quiet, url, force, lib_dir = (sys.argv[1], int(sys.argv[2]),
+    sys.argv[3] == '1', sys.argv[4], sys.argv[5] == '1', sys.argv[6])
+sys.path.insert(0, lib_dir)
+from codex_reset import try_auto_redeem
 now = time.time()
 # Don't re-fetch an account whose data is younger than this (endpoint rate-limits).
 MIN_FETCH_INTERVAL = int(os.environ.get('CODEX_MULTIACC_MIN_FETCH', '240'))
@@ -1461,9 +1467,20 @@ for acct in manifest.get('accounts', []):
     session = [b['percent'] for b in buckets if b['group'] == 'session']
     weeklyp = max(weekly) if weekly else maxp
     sessionp = max(session) if session else 0
+    try:
+        reset_result = try_auto_redeem(d, aid, maxp, data, url, headers, say, int(now))
+    except Exception as e:
+        say(f'{aid}: usage reset automation failed unexpectedly ({type(e).__name__}); failing open')
+        reset_result = {'status': 'error'}
     out = {'fetched_at': int(now), 'source': 'chatgpt', 'max_percent': maxp,
            'weekly_percent': weeklyp, 'session_percent': sessionp,
            'plan': str(data.get('plan_type') or ''), 'buckets': buckets}
+    if reset_result.get('status') == 'redeemed':
+        # The response proves the reset succeeded, but the usage GET happened before
+        # it. Make that snapshot stale immediately so it cannot re-exclude the newly
+        # refreshed account; the next scheduled pass replaces it with server truth.
+        out['fetched_at'] = 0
+        out['auto_reset'] = reset_result
     tmp = lpath + '.tmp'
     with open(tmp, 'w') as f:
         json.dump(out, f, indent=1)
@@ -1471,7 +1488,8 @@ for acct in manifest.get('accounts', []):
     # The fetch went through with this account's own bearer => its auth is alive.
     if clear_expired(d):
         say(f'{aid}: dead-auth marker cleared (authenticated successfully)')
-    offenders = [b for b in buckets if b['percent'] >= threshold]
+    offenders = [] if reset_result.get('status') == 'redeemed' else [
+        b for b in buckets if b['percent'] >= threshold]
     mpath = os.path.join(d, '.limited')
     if offenders:
         worst = max(offenders, key=lambda b: b['percent'])
@@ -1498,7 +1516,8 @@ for acct in manifest.get('accounts', []):
             try:
                 txt = open(mpath).read()
                 first = txt.splitlines()[0] if txt else ''
-                if ('reason=error-cooldown' in txt or 'reason=client-rate-limit' in txt) \
+                if reset_result.get('status') != 'redeemed' \
+                        and ('reason=error-cooldown' in txt or 'reason=client-rate-limit' in txt) \
                         and first.isdigit() and int(first) > now:
                     keep = True
             except Exception:

package/docs/ACCOUNT_OPERATIONS.md

@@ -342,7 +342,7 @@ The codex shim honors the same switches spelled `CODEX_*`: `CODEX_ACCOUNT`,
 ## Verification
 
 ```bash
-tests/run-tests.sh            # 644 sandboxed compatibility tests, no quota
+tests/run-tests.sh            # 645 sandboxed compatibility tests, no quota
 claude-accounts verify        # real matrix: `claude -p "reply OK"` per authed account
 claude-accounts verify --quick# auth presence/expiry only, no inference
 claude-accounts limits        # live per-bucket usage incl. the Fable bucket

package/lib/codex_reset.py

@@ -0,0 +1,170 @@
+"""Automatic redemption of earned Codex usage-limit reset credits.
+
+The Codex CLI exposes reset credits through the same authenticated backend as
+usage telemetry.  This module is called only after a fresh usage response says
+an account has 5% or less remaining.  A pending idempotency key is written
+before the mutation so a lost response can be retried without spending twice.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import time
+import urllib.error
+import urllib.parse
+import urllib.request
+import uuid
+
+RESET_AT_USED_PERCENT = 95
+REDEEM_COOLDOWN_SECONDS = 900
+STATE_FILE = ".usage-reset.json"
+
+
+def auto_reset_enabled() -> bool:
+    """Return whether automatic redemption is enabled (on by default)."""
+    return os.environ.get("CODEX_MULTIACC_AUTO_RESET", "1").strip().lower() \
+        not in {"0", "false", "no", "off"}
+
+
+def _load(path: str) -> dict:
+    try:
+        value = json.load(open(path, encoding="utf-8"))
+        return value if isinstance(value, dict) else {}
+    except Exception:
+        return {}
+
+
+def _write(path: str, value: dict) -> None:
+    temp = f"{path}.tmp.{os.getpid()}"
+    descriptor = os.open(temp, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
+    with os.fdopen(descriptor, "w", encoding="utf-8") as handle:
+        json.dump(value, handle, indent=2, sort_keys=True)
+        handle.write("\n")
+    os.replace(temp, path)
+
+
+def _reset_urls(usage_url: str) -> tuple[str, str]:
+    explicit_list = os.environ.get("CODEX_MULTIACC_RESET_CREDITS_URL", "").strip()
+    explicit_consume = os.environ.get("CODEX_MULTIACC_RESET_CONSUME_URL", "").strip()
+    if explicit_list and explicit_consume:
+        return explicit_list, explicit_consume
+    parsed = urllib.parse.urlsplit(usage_url)
+    path = parsed.path
+    if path.endswith("/wham/usage"):
+        prefix = path[: -len("/wham/usage")] + "/wham"
+    elif path.endswith("/api/codex/usage"):
+        prefix = path[: -len("/usage")]
+    elif "/backend-api/" in path:
+        prefix = path.split("/backend-api/", 1)[0] + "/backend-api/wham"
+    else:
+        prefix = path.rsplit("/usage", 1)[0]
+    base = urllib.parse.urlunsplit((parsed.scheme, parsed.netloc, prefix, "", ""))
+    return (explicit_list or f"{base}/rate-limit-reset-credits",
+            explicit_consume or f"{base}/rate-limit-reset-credits/consume")
+
+
+def _request(url: str, headers: dict, payload: dict | None = None) -> dict:
+    data = json.dumps(payload).encode() if payload is not None else None
+    request = urllib.request.Request(url, data=data, headers=headers,
+                                     method="POST" if data is not None else "GET")
+    response = urllib.request.urlopen(request, timeout=15)
+    value = json.loads(response.read().decode())
+    if not isinstance(value, dict):
+        raise ValueError("reset endpoint returned a non-object")
+    return value
+
+
+def _credit_to_redeem(details: dict) -> tuple[int, str | None]:
+    try:
+        available_count = max(0, int(details.get("available_count") or 0))
+    except (TypeError, ValueError):
+        available_count = 0
+    available = [item for item in details.get("credits", [])
+                 if isinstance(item, dict) and item.get("status") == "available"]
+    available.sort(key=lambda item: item.get("expires_at") or "9999-12-31T23:59:59Z")
+    credit_id = str(available[0].get("id") or "") if available else ""
+    return available_count, credit_id or None
+
+
+def _pending_request(account_dir: str, now: int) -> tuple[dict, str]:
+    state_path = os.path.join(account_dir, STATE_FILE)
+    state = _load(state_path)
+    if state.get("state") == "complete" and int(state.get("suppress_until") or 0) > now:
+        return state, "cooldown"
+    if state.get("state") == "pending" and state.get("redeem_request_id"):
+        return state, "pending"
+    return {}, "new"
+
+
+def _redeem_request_id(account_id: str, usage: dict, headers: dict, now: int) -> str:
+    """Return one fleet-stable UUID for this account's current limit windows."""
+    subject = str(headers.get("chatgpt-account-id") or account_id)
+    resets = []
+    stack = [usage]
+    while stack:
+        node = stack.pop()
+        if isinstance(node, dict):
+            value = node.get("reset_at")
+            if value is not None:
+                try:
+                    resets.append(int(float(value)))
+                except (TypeError, ValueError):
+                    pass
+            stack.extend(node.values())
+        elif isinstance(node, list):
+            stack.extend(node)
+    cycle = sorted(set(resets)) or [f"hour-{now // 3600}"]
+    seed = json.dumps({"account": subject, "resets": cycle}, sort_keys=True)
+    return str(uuid.uuid5(uuid.NAMESPACE_URL, seed))
+
+
+def try_auto_redeem(account_dir: str, account_id: str, used_percent: int,
+                    usage: dict, usage_url: str, headers: dict, say,
+                    now: int | None = None) -> dict:
+    """Redeem one available reset and return a non-secret outcome document."""
+    current = int(now if now is not None else time.time())
+    if not auto_reset_enabled() or used_percent < RESET_AT_USED_PERCENT:
+        return {"status": "not_eligible"}
+    state, disposition = _pending_request(account_dir, current)
+    if disposition == "cooldown":
+        return {"status": "cooldown", "outcome": state.get("outcome")}
+    list_url, consume_url = _reset_urls(usage_url)
+    if disposition == "new":
+        summary = usage.get("rate_limit_reset_credits")
+        if isinstance(summary, dict) and int(summary.get("available_count") or 0) <= 0:
+            return {"status": "no_credit"}
+        try:
+            available_count, credit_id = _credit_to_redeem(_request(list_url, headers))
+        except Exception as error:
+            say(f"{account_id}: usage reset availability failed ({type(error).__name__}); failing open")
+            return {"status": "error"}
+        if available_count <= 0:
+            return {"status": "no_credit"}
+        request_id = _redeem_request_id(account_id, usage, headers, current)
+        state = {"schema": 1, "state": "pending", "redeem_request_id": request_id,
+                 "credit_id": credit_id, "started_at": current}
+        _write(os.path.join(account_dir, STATE_FILE), state)
+    payload = {"redeem_request_id": state["redeem_request_id"]}
+    if state.get("credit_id"):
+        payload["credit_id"] = state["credit_id"]
+    try:
+        response = _request(consume_url, headers, payload)
+    except Exception as error:
+        say(f"{account_id}: usage reset redeem failed ({type(error).__name__}); retry is idempotent")
+        return {"status": "pending"}
+    outcome = str(response.get("code") or "unknown")
+    if outcome in {"reset", "already_redeemed"}:
+        complete = {"schema": 1, "state": "complete", "outcome": outcome,
+                    "redeem_request_id": state["redeem_request_id"],
+                    "redeemed_at": current, "suppress_until": current + REDEEM_COOLDOWN_SECONDS,
+                    "windows_reset": int(response.get("windows_reset") or 0)}
+        _write(os.path.join(account_dir, STATE_FILE), complete)
+        say(f"{account_id}: usage reset redeemed automatically at {used_percent}% used")
+        return {"status": "redeemed", "outcome": outcome,
+                "windows_reset": complete["windows_reset"], "redeemed_at": current}
+    try:
+        os.remove(os.path.join(account_dir, STATE_FILE))
+    except OSError:
+        pass
+    return {"status": outcome}

package/lib/selector_primitives.py

@@ -11,7 +11,7 @@ from datetime import datetime, timezone
 from decimal import Decimal, InvalidOperation
 
 SCHEMA = "claude-multiacc/pool-selection.v2"
-SELECTOR_VERSION = "2.0.0"
+SELECTOR_VERSION = "2.0.1"
 TIME_RE = re.compile(
     r"^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-5][0-9]"
     r"(\.[0-9]{1,6})?(Z|[+-][0-9]{2}:[0-9]{2})$")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-multiacc",
-  "version": "2.0.1",
+  "version": "2.0.3",
   "description": "Unified Claude Code and OpenAI Codex subscription pooling with quota-aware selection.",
   "type": "module",
   "bin": {

package/tests/run-tests.sh

@@ -2399,6 +2399,7 @@ unset CODEX_HOME CODEX_ACCOUNT CODEX_SHIM_ACTIVE 2>/dev/null || true
 export CODEX_MULTIACC_NO_SYNC=1
 export CODEX_MULTIACC_MIN_FETCH=0
 export CODEX_MULTIACC_CLIENT_SCAN_TTL=0
+export CODEX_MULTIACC_AUTO_RESET=0
 export CODEX_MULTIACC_TOKEN_URL="file://$WORK/cx-token-endpoint-missing.json"
 # Default usage URL is an offline missing fixture: the SHIM's opportunistic
 # background `limits --quiet` kick must never reach a real endpoint from tests
@@ -4071,6 +4072,14 @@ for _bin in claude-accounts codex-accounts; do
     || t_fail "$_bin unknown verb --help" "exited 0 — the probe would accept a verb that does not exist"
 done
 
+# The reset-credit contract is easier to prove against a stateful local HTTP server
+# than file:// fixtures: it pins thresholding, credit ordering and idempotent POST retry.
+if CODEX_MULTIACC_AUTO_RESET=1 python3 "$REPO_DIR/tests/test_codex_reset.py"; then
+  t_ok "codex: automatic earned-reset integration suite"
+else
+  t_fail "codex automatic reset suite" "see unittest output above"
+fi
+
 # ---- summary ---------------------------------------------------------------------
 echo
 echo "passed: $PASS  failed: $FAIL"

package/tests/test_codex_reset.py

@@ -0,0 +1,170 @@
+#!/usr/bin/env python3
+"""Sandboxed integration tests for automatic Codex usage-reset redemption."""
+
+from __future__ import annotations
+
+import base64
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+import json
+import os
+from pathlib import Path
+import subprocess
+import tempfile
+import threading
+import time
+import unittest
+import uuid
+
+REPO = Path(__file__).resolve().parents[1]
+
+
+def jwt(claims: dict) -> str:
+    payload = base64.urlsafe_b64encode(json.dumps(claims).encode()).decode().rstrip("=")
+    return f"header.{payload}.signature"
+
+
+class ResetHandler(BaseHTTPRequestHandler):
+    def do_GET(self) -> None:  # noqa: N802 - BaseHTTPRequestHandler contract
+        state = self.server.state
+        if self.path == "/wham/usage":
+            state["usage_gets"] += 1
+            body = state["usage"]
+        elif self.path == "/wham/rate-limit-reset-credits":
+            state["credit_gets"] += 1
+            body = state["credits"]
+        else:
+            self.send_error(404)
+            return
+        encoded = json.dumps(body).encode()
+        self.send_response(200)
+        self.send_header("Content-Type", "application/json")
+        self.send_header("Content-Length", str(len(encoded)))
+        self.end_headers()
+        self.wfile.write(encoded)
+
+    def do_POST(self) -> None:  # noqa: N802 - BaseHTTPRequestHandler contract
+        state = self.server.state
+        if self.path != "/wham/rate-limit-reset-credits/consume":
+            self.send_error(404)
+            return
+        length = int(self.headers.get("Content-Length") or 0)
+        state["posts"].append(json.loads(self.rfile.read(length)))
+        status, body = state["responses"].pop(0)
+        encoded = json.dumps(body).encode()
+        self.send_response(status)
+        self.send_header("Content-Type", "application/json")
+        self.send_header("Content-Length", str(len(encoded)))
+        self.end_headers()
+        self.wfile.write(encoded)
+
+    def log_message(self, _format: str, *_args) -> None:
+        return
+
+
+class CodexResetIntegrationTest(unittest.TestCase):
+    def setUp(self) -> None:
+        self.temp = tempfile.TemporaryDirectory(prefix="multiacc-reset-")
+        self.pool = Path(self.temp.name) / "pool"
+        account = self.pool / "acct-01"
+        account.mkdir(parents=True)
+        manifest = {"version": 1, "threshold": 90, "accounts": [
+            {"id": "acct-01", "email": "test@example.invalid", "home": "mac"}]}
+        (self.pool / "accounts.json").write_text(json.dumps(manifest), encoding="utf-8")
+        claims = {"exp": int(time.time()) + 86400,
+                  "https://api.openai.com/auth": {"chatgpt_account_id": "account-test"}}
+        auth = {"auth_mode": "chatgpt", "tokens": {
+            "access_token": jwt(claims), "refresh_token": "fake-refresh",
+            "account_id": "account-test"}}
+        (account / "auth.json").write_text(json.dumps(auth), encoding="utf-8")
+        self.server = ThreadingHTTPServer(("127.0.0.1", 0), ResetHandler)
+        self.server.state = {"usage_gets": 0, "credit_gets": 0, "posts": [],
+                             "usage": {}, "credits": {}, "responses": []}
+        self.thread = threading.Thread(target=self.server.serve_forever, daemon=True)
+        self.thread.start()
+
+    def tearDown(self) -> None:
+        self.server.shutdown()
+        self.server.server_close()
+        self.thread.join(timeout=5)
+        self.temp.cleanup()
+
+    def run_limits(self) -> subprocess.CompletedProcess:
+        base = f"http://127.0.0.1:{self.server.server_port}/wham"
+        env = os.environ.copy()
+        env.update({"CODEX_ACCOUNTS_ROOT": str(self.pool),
+                    "CODEX_MULTIACC_NO_SYNC": "1", "CODEX_MULTIACC_MIN_FETCH": "0",
+                    "CODEX_MULTIACC_AUTO_RESET": "1", "PYTHONDONTWRITEBYTECODE": "1",
+                    "CODEX_MULTIACC_USAGE_URL": f"{base}/usage"})
+        env.pop("CODEX_MULTIACC_RESET_CREDITS_URL", None)
+        env.pop("CODEX_MULTIACC_RESET_CONSUME_URL", None)
+        return subprocess.run([REPO / "bin/codex-accounts", "limits", "--force"],
+                              capture_output=True, text=True, env=env, timeout=20, check=False)
+
+    def test_redeems_at_five_percent_remaining_once(self) -> None:
+        now = int(time.time())
+        self.server.state["usage"] = {"plan_type": "pro", "rate_limit": {
+            "allowed": True, "primary_window": {"used_percent": 95,
+                "limit_window_seconds": 18000, "reset_at": now + 3600}},
+            "rate_limit_reset_credits": {"available_count": 2}}
+        self.server.state["credits"] = {"available_count": 2, "credits": [
+            {"id": "later", "status": "available", "expires_at": "2026-09-02T00:00:00Z"},
+            {"id": "sooner", "status": "available", "expires_at": "2026-09-01T00:00:00Z"}]}
+        self.server.state["responses"] = [(200, {"code": "reset", "windows_reset": 2})]
+        result = self.run_limits()
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertIn("usage reset redeemed automatically at 95% used", result.stdout)
+        self.assertEqual(len(self.server.state["posts"]), 1)
+        request = self.server.state["posts"][0]
+        self.assertEqual(request["credit_id"], "sooner")
+        uuid.UUID(request["redeem_request_id"])
+        state = json.loads((self.pool / "acct-01/.usage-reset.json").read_text())
+        self.assertEqual(state["state"], "complete")
+        marker = self.pool / "acct-01/.limited"
+        self.assertFalse(marker.exists())
+        marker.write_text(f"{now + 3600}\nreason=client-rate-limit\n", encoding="utf-8")
+        (self.pool / "acct-01/.usage-reset.json").unlink()
+        self.server.state["responses"] = [(200, {"code": "already_redeemed"})]
+        result = self.run_limits()
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertFalse(marker.exists())
+        self.assertEqual(self.server.state["posts"][0]["redeem_request_id"],
+                         self.server.state["posts"][1]["redeem_request_id"])
+        self.run_limits()
+        self.assertEqual(len(self.server.state["posts"]), 2)
+
+    def test_does_not_redeem_above_five_percent_remaining(self) -> None:
+        now = int(time.time())
+        self.server.state["usage"] = {"rate_limit": {"allowed": True,
+            "primary_window": {"used_percent": 94, "limit_window_seconds": 18000,
+                               "reset_at": now + 3600}},
+            "rate_limit_reset_credits": {"available_count": 1}}
+        result = self.run_limits()
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertEqual(self.server.state["credit_gets"], 0)
+        self.assertEqual(self.server.state["posts"], [])
+        self.assertFalse((self.pool / "acct-01/.usage-reset.json").exists())
+
+    def test_retries_a_lost_response_with_the_same_idempotency_key(self) -> None:
+        now = int(time.time())
+        self.server.state["usage"] = {"rate_limit": {"allowed": False,
+            "limit_reached": True, "primary_window": {"used_percent": 100,
+                "limit_window_seconds": 604800, "reset_at": now + 86400}},
+            "rate_limit_reset_credits": {"available_count": 1}}
+        self.server.state["credits"] = {"available_count": 1, "credits": []}
+        self.server.state["responses"] = [
+            (500, {"error": "response lost"}),
+            (200, {"code": "already_redeemed", "windows_reset": 2})]
+        first = self.run_limits()
+        self.assertIn("retry is idempotent", first.stdout)
+        self.assertEqual(json.loads((self.pool / "acct-01/.usage-reset.json").read_text())
+                         ["state"], "pending")
+        second = self.run_limits()
+        self.assertEqual(second.returncode, 0, second.stderr)
+        self.assertEqual(len(self.server.state["posts"]), 2)
+        keys = [request["redeem_request_id"] for request in self.server.state["posts"]]
+        self.assertEqual(keys[0], keys[1])
+        self.assertEqual(self.server.state["credit_gets"], 1)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/tests/test_selector.py

@@ -54,7 +54,7 @@ class SelectorTests(unittest.TestCase):
             "e8ef0b4bc7b95e76231ee6da79616d92bd9251c1c991845c8c0524fcbfb6593a")
         self.assertEqual(
             response["selection_digest"],
-            "66179083753e967bbe3914692103c1b4a30966a86ecf85cd62e14f3511c78cc3")
+            "2c9607e3dc1fde3ddf4e4469fbe48cf0e6a3c8114ef0c6b5f3c82f8ed4f78e3e")
 
     def test_unicode_and_active_reservation_proof(self):
         busy = {"active_expires_at": "2026-08-25T09:00:00.000001Z", "last_selected_at": None}
@@ -68,7 +68,7 @@ class SelectorTests(unittest.TestCase):
             "29e8e7d1a611f38ee0be43622102b33875e7ff75ff9024aa43d16151575071d4")
         self.assertEqual(
             response["selection_digest"],
-            "eaea620082bb0882a12598b8cc46e79090da07be0b307f34f0a68f555a6c9d3e")
+            "2f018ab0e308a8465898e75a867e18d8620c03b4a49109edc1d2d590bf0d1121")
 
     def test_both_chooses_each_provider_and_survives_provider_loss(self):
         codex = select(_request([
@@ -155,7 +155,7 @@ class SelectorTests(unittest.TestCase):
         self.assertEqual(overflow_seen["error_code"], "no_candidate")
         self.assertEqual(overflow_history["error_detail"], {
             "field": "candidates[0].reservation_history.active_expires_at"})
-        self.assertEqual(invalid, {"schema": SCHEMA, "selector_version": "2.0.0", "ok": False,
+        self.assertEqual(invalid, {"schema": SCHEMA, "selector_version": "2.0.1", "ok": False,
                                    "error_code": "invalid_request", "error_detail": {"field": "$"}})
 
     def test_rfc8785_digest_vectors(self):
@@ -206,7 +206,7 @@ class SelectorTests(unittest.TestCase):
         self.assertTrue(all(json.loads(item.stdout)["error_code"] == "invalid_request"
                             for item in bad))
         self.assertEqual(json.loads(decimal_response.stdout)["account_id"], "z-lower")
-        self.assertEqual(version, "2.0.0")
+        self.assertEqual(version, "2.0.1")
         self.assertEqual(versions, ["2.0.0", "2.0.1"])