claude-multiacc 2.0.43 → 2.0.45

package/bin/claude-accounts

@@ -635,7 +635,7 @@ cmd_add() {
     # Portable setup-token variant (works on Mac AND server; needs a recent sign-in).
     echo "Preparing $id for $elabel (portable token) — NOTHING is registered until sign-in completes."
     run_token_ceremony "$d" || die "sign-in failed or aborted — nothing was created${CEREMONY_LAST_WORDS:+ — the client said: $CEREMONY_LAST_WORDS}${CEREMONY_TRANSCRIPT:+ (transcript: $CEREMONY_TRANSCRIPT)}"
-    commit_ceremony_token "$d" "$CEREMONY_TOKEN" "$id"
+    commit_ceremony_token "$d" "$CEREMONY_TOKEN" "$id" captured "$email"
     got="$(token_email "$CEREMONY_TOKEN")"
   else
     # Default: full Claude Code login (full scopes, no long-lived-token step-up).
@@ -749,6 +749,12 @@ cmd_import() {
   fi
   local d="$ACC_ROOT/$id"
   seed_account_dir "$d"
+  if [ -n "$tok" ]; then
+    ceremony_token_identity "$d" "$tok" "$email"
+    if [ "$CEREMONY_IDENTITY_STATE" = "mismatch" ]; then
+      die "the token's organization does not match $id — nothing imported; mint a token for the named account"
+    fi
+  fi
   if [ -n "$creds" ]; then
     case "$mode" in
       copy) cp "$creds" "$d/.credentials.json" ;;
@@ -1033,11 +1039,27 @@ ceremony_token_check() { # $1 = token
   esac
 }
 
-# The ONE place a ceremony's token is written: only after ceremony_token_check, so a
-# token Claude rejects is never saved, uploaded, or distributed. $1 = acct dir,
+# A candidate must not replace the current token's identity receipt until it is saved.
+CEREMONY_IDENTITY_STATE="unknown"
+ceremony_token_identity() { # $1 = account dir, $2 = candidate token, $3 = optional named email
+  local d="$1" tok="$2" email="${3:-}" real
+  real="$(find_real_claude "$_self")" || real=""
+  set -- check "$d" --token-stdin --real "$real" --format state --no-store
+  [ -z "$email" ] || set -- "$@" --expected-email "$email"
+  CEREMONY_IDENTITY_STATE="$(printf '%s' "$tok" \
+    | "$PYBIN" "$LIB_DIR/claude_token_identity.py" "$@" 2>/dev/null)"
+  [ -n "$CEREMONY_IDENTITY_STATE" ] || CEREMONY_IDENTITY_STATE="unknown"
+}
+
+# The ONE place a ceremony's token is written: only after organization and auth checks,
+# so a known wrong-organization or rejected token is never saved or distributed. $1 = acct dir,
 # $2 = token, $3 = acct id (messages only).
 commit_ceremony_token() {
   local d="$1" tok="$2" id="$3" src="${4:-captured}" rc=0
+  ceremony_token_identity "$d" "$tok" "${5:-}"
+  if [ "$CEREMONY_IDENTITY_STATE" = "mismatch" ]; then
+    die "the token's organization does not match $id — nothing saved; sign in as the named account and mint again"
+  fi
   ceremony_token_check "$tok" || rc=$?
   # A short token is an incomplete one unless Claude itself has just answered with it:
   # the length alone convicts it, so an inconclusive probe (429, network) must not let
@@ -1055,6 +1077,7 @@ commit_ceremony_token() {
   fi
   ( umask 077; printf '%s' "$tok" > "$d/server.token" )
   chmod 600 "$d/server.token"
+  [ "$CEREMONY_IDENTITY_STATE" != "match" ] || echo "Token organization matches the account's saved OAuth profile."
   if [ "$rc" -eq 0 ]; then
     record_token_verified "$d" "$tok"
     echo "Token verified by a real inference."
@@ -1231,10 +1254,9 @@ TIP
 
 cmd_mint() {
   # The minted token is the ONLY credential that reaches the server and every peer, so a
-  # mint under the wrong browser session hands this slot another account's subscription —
-  # and nothing downstream can notice (a setup token reports no identity, see
-  # token_email). Naming the expected account before the ceremony opens is the only guard
-  # that exists; the old prompt said "THIS account" and named nobody.
+  # mint under the wrong browser session can hand this slot another subscription. Name the
+  # expected account before the ceremony and verify the token's response organization
+  # against its saved OAuth profile before accepting it. The token cannot report an email.
   require_manifest
   local id="" paste=0
   while [ $# -gt 0 ]; do
@@ -1279,7 +1301,9 @@ cmd_mint() {
   clear_auth_markers "$d"
   log_to ops.log "mint $id"
   echo "Token saved to $d/server.token"
-  [ -n "$got" ] || warn "a setup token carries no identity — $id now runs whichever account approved that grant${email:+, trusted to be $email}"
+  if [ -z "$got" ] && [ "$CEREMONY_IDENTITY_STATE" != "match" ]; then
+    warn "the token's organization could not be checked — $id is trusted to hold ${email:-the named account}"
+  fi
   auto_sync
 }
 
@@ -1314,7 +1338,9 @@ cmd_login() {
     fi
     commit_ceremony_token "$d" "$CEREMONY_TOKEN" "$id"
     clear_auth_markers "$d"
-    [ -n "$got" ] || warn "a setup token carries no identity — $id is trusted to hold $email because that is who you approved as"
+    if [ -z "$got" ] && [ "$CEREMONY_IDENTITY_STATE" != "match" ]; then
+      warn "the token's organization could not be checked — $id is trusted to hold $email as requested"
+    fi
     echo "$id token saved (portable — works on Mac and server)."
   else
     run_login_ceremony "$d" "$email" \
@@ -1546,6 +1572,26 @@ os.execv(sys.argv[1], [sys.argv[1], "limits-distribute-now"])
   return 0
 }
 
+token_identities_check() {
+  # A source may always use Keychain OAuth locally while its peers use setup tokens.
+  # Prove those tokens before distributing telemetry, even if nobody launched them here.
+  local id d real
+  real="$(find_real_claude "$_self")" || real=""
+  for id in $(account_ids); do
+    d="$ACC_ROOT/$id"
+    [ -s "$d/server.token" ] || continue
+    "$PYBIN" "$LIB_DIR/claude_token_identity.py" check "$d" --real "$real" >/dev/null 2>&1 || true
+  done
+}
+
+token_identity_receipt() { # Unknown results must never overwrite a peer's proven mismatch.
+  local verdict
+  [ -f "$1/.server-token-identity.json" ] || return 1
+  verdict="$("$PYBIN" "$LIB_DIR/claude_token_identity.py" cached "$1" 2>/dev/null)"
+  printf '%s' "$verdict" | grep -q '"cached": true' || return 1
+  printf '%s' "$verdict" | grep -qE '"state": "(match|mismatch)"'
+}
+
 limits_distribute_now() {
   local lock="$ACC_ROOT/tmp/limits-push.lock"
   mkdir -p "$ACC_ROOT/tmp" 2>/dev/null || return 0
@@ -1570,6 +1616,7 @@ limits_distribute_now() {
   list="$ACC_ROOT/tmp/limits-push.$$"
   mkdir -p "$ACC_ROOT/tmp" 2>/dev/null || return 0
   : > "$list" 2>/dev/null || return 0
+  token_identities_check
   for id in $(account_ids); do
     d="$ACC_ROOT/$id"
     [ -f "$d/limits.json" ] && printf '%s/limits.json\n' "$id" >> "$list"
@@ -1577,6 +1624,7 @@ limits_distribute_now() {
     # .limited on its own, so a stale one costs an account some eligibility and
     # never grants any. Erring toward exclusion is the safe direction here.
     [ -f "$d/.limited" ] && printf '%s/.limited\n' "$id" >> "$list"
+    token_identity_receipt "$d" && printf '%s/.server-token-identity.json\n' "$id" >> "$list"
   done
   # The MCP registry rides along: a server the shim mirrored from a stock `claude mcp
   # add` reaches every peer within one limits cadence, with no explicit sync. The
@@ -1667,7 +1715,7 @@ cmd_limits() {
 import hashlib, json, os, sys, time, urllib.request
 sys.path = [sys.argv[6]] + [p for p in sys.path if p not in ('', '.')]
 import keychain  # noqa: E402  (macOS Keychain-held logins; a no-op elsewhere)
-from audit import creds_doc_state  # noqa: E402  (one rule for "can this credential work")
+from audit import creds_doc_state, org_block_in_force  # noqa: E402  (one rule for "can this credential work")
 import claude_reset  # noqa: E402  (automatic limit-reset redemption, the codex_reset twin)
 
 root, threshold, quiet, url, force = sys.argv[1], int(sys.argv[2]), sys.argv[3] == '1', sys.argv[4], sys.argv[5] == '1'
@@ -1764,11 +1812,12 @@ def weekly_marker(txt):
 def mark_expired(d, slug, detail=''):
     mpath = os.path.join(d, '.expired')
     # An org-blocked marker is the strongest statement there is about an account and
-    # only `verify` or a re-login may lift it (see clear_expired). Overwriting its
-    # REASON with a weaker one is how it gets lifted by accident: the next successful
-    # fetch sees a reason clear_expired is willing to drop, and the block vanishes.
+    # telemetry can never lift it (see clear_expired). Overwriting its REASON with a
+    # weaker one is how it gets lifted by accident: the next successful fetch sees a
+    # reason clear_expired is willing to drop, and the block vanishes. One whose
+    # soft_until has run out binds nothing any more and outranks nothing either.
     try:
-        if 'reason=org-blocked' in open(mpath, errors='replace').read():
+        if org_block_in_force(open(mpath, errors='replace').read(), now):
             return
     except OSError:
         pass
@@ -1792,7 +1841,9 @@ def clear_expired(d):
       un-parked every dead-token account minutes after the shim parked it, and every
       fresh `claude` walked back into the same 401 all day (2026-08-29). Only a NEW
       token (the shim's newer-file rule) or a real call that used the token lifts it.
-    Only a passing `verify` (a real call) or a re-login lifts the excepted ones."""
+    Only a real call lifts the excepted ones — a passing `verify`, or one the usage
+    limiter refused (the limiter answers only past the credential and the org gate) —
+    or a re-login; an org block also lapses at its soft_until (6 h)."""
     mpath = os.path.join(d, '.expired')
     try:
         body = open(mpath, errors='replace').read()
@@ -2740,8 +2791,11 @@ import hashlib, json, os, re, subprocess, sys, time
 
 root, quick, real = sys.argv[1], sys.argv[2] == '1', sys.argv[3]
 sys.path = [sys.argv[4]] + [p for p in sys.path if p not in ('', '.')]
-from audit import audit_account, creds_state, creds_doc_state   # noqa: E402  (shared with the shim's rule)
+from audit import (audit_account, creds_state, creds_doc_state,  # noqa: E402  (shared with the shim's rule)
+                   marker_slug, org_block_in_force)
 import keychain  # noqa: E402
+from claude_token_identity import check_identity  # noqa: E402
+from claude_reset import cli_version  # noqa: E402
 machine = sys.argv[5]
 now = time.time()
 manifest = json.load(open(os.path.join(root, 'accounts.json')))
@@ -2753,14 +2807,43 @@ AUTH_ERR = re.compile(
     r'401|403|unauthorized|authentication[_ ]error|invalid[_ ](bearer|token|api key)'
     r'|token (expired|revoked|invalid)|oauth.*(error|expired|invalid)|session expired'
     r'|could not be refreshed|please (run|sign in|log ?in)|re-?authenticate', re.I)
+# `ask your admin to enable ACCESS`, never the bare prefix: the same client ends a 404
+# model_not_found with "…or ask your admin to enable this model", which is about the
+# model and never about the organization (the real refusal still matches three ways).
 ORG_ERR = re.compile(
     r'organization has disabled|subscription access.*disabl|disabled claude subscription'
-    r'|ask your admin to enable|not authorized to use claude code', re.I)
+    r'|ask your admin to enable access|not authorized to use claude code', re.I)
+# A USAGE-LIMIT refusal, tested after BROKEN_CLI and BEFORE ORG_ERR/AUTH_ERR — bin/claude's
+# rule "a rate limit wins the classification". It is also EXCULPATORY: the provider checks
+# the credential, then the organization's Claude Code gate, and only then the usage
+# limiter. acct-15 (2026-09-27) proved the order: already at weekly_all 100%, a real call
+# came back with the ORG refusal, and once the subscription was paid again the same
+# call came back "You've hit your weekly limit". So a limit refusal proves the credential
+# that answered authenticated AND its organization lets Claude Code through: verify lifts
+# a park exactly as a PASS would. Before this, that answer failed with no hint, the
+# org-blocked park stayed, and every re-check on that Mac kept a paid account BLOCKED.
+#
+# The shim's LIMITPAT/MODEL_LIMITPAT, minus what proves nothing about the account: the
+# shim only picks a cooldown over a park and can afford "overloaded"/529 there; here a
+# match LIFTS a park. The client's usage-limiter texts ("You've hit your weekly limit ·
+# resets …", "You've reached your Fable limit. Switch to another model…", "You're out of
+# usage credits") are covered; a bare 429 is not — a headerless 429 is the throttle the
+# client itself prints as "Server is temporarily limiting requests (not your usage
+# limit)", which can answer before any credential is looked at. NOT_A_LIMIT vetoes those
+# (that text contains "usage limit") and the overload family outright.
+LIMIT_ERR = re.compile(
+    r"(hit|reached) your [^.\n]{0,40}(limit|budget)|out of usage|usage limit"
+    r"|limit (reached|exceeded)|rate[ _-]?limit|switch to another model", re.I)
+NOT_A_LIMIT = re.compile(
+    r'not your usage limit|temporarily limiting|overloaded|\b529\b|high load', re.I)
+# bin/claude PARK_SOFT_ORG: an org policy will not change in minutes, but a verdict that
+# never expires kept a paid-again account out of the pool until a person noticed.
+PARK_SOFT_ORG = 21600
 # EXCULPATORY, tested FIRST — the twin of BROKEN_CLI in bin/codex-accounts, and
 # it matters MORE here: AUTH_ERR above matches a bare `401` or `403`, so any
 # machine fault whose output happens to contain those three digits parks a live
-# login. `mark_expired` writes no `soft_until`, so that verdict is permanent
-# until a person clears it. These patterns say the CLI never reached the API,
+# login. `mark_expired` writes no `soft_until` for an auth park, so that verdict is
+# permanent until a person clears it. These patterns say the CLI never reached the API,
 # which is a fact about the machine and never about the login.
 # See health.log 2026-08-24: `env: node: No such file or directory` failed
 # every account in one pass.
@@ -2776,23 +2859,60 @@ def mark_expired(d, slug, detail=''):
     """Park an account the shim must stop selecting. Verify is the strongest signal
     there is — a real inference call that came back 'not authenticated'."""
     mpath = os.path.join(d, '.expired')
-    # Same rule as the limits path: an org block outranks every other reason and only
-    # a PASSING verify or a re-login may lift it. Rewriting its reason with a weaker
-    # one is how it gets lifted by accident later.
-    try:
-        if 'reason=org-blocked' in open(mpath, errors='replace').read():
-            return
-    except OSError:
-        pass
+    t = time.time()
+    # Same rule as the limits path: an org block outranks every other reason while it
+    # binds. Rewriting its reason with a weaker one is how it gets lifted by accident
+    # later. Only the org refusal itself may rewrite it — and does: a re-observed block
+    # is a fresh park with a fresh soft_until, not a stale one left to run out.
+    if slug != 'org-blocked':
+        try:
+            if org_block_in_force(open(mpath, errors='replace').read(), t):
+                return
+        except OSError:
+            pass
+    # The shim's field order (bin/claude park_line), so every reader parses one shape.
+    soft = f'soft_until={int(t) + PARK_SOFT_ORG} ' if slug == 'org-blocked' else ''
     try:
         with open(mpath + '.tmp', 'w') as f:
-            f.write(f'{int(time.time())}\n')
-            f.write(f"reason={slug} marked_at="
-                    f"{time.strftime('%Y-%m-%dT%H:%M:%SZ', time.gmtime())} detail={detail}\n")
+            f.write(f'{int(t)}\n')
+            f.write(f"reason={slug} {soft}marked_at="
+                    f"{time.strftime('%Y-%m-%dT%H:%M:%SZ', time.gmtime(t))} detail={detail}\n")
         os.replace(mpath + '.tmp', mpath)
     except Exception:
         pass
 
+def lift_park(d, uses_token):
+    """A real call reached the account: drop its park, and return the reason it had
+    ('' when nothing was removed). The PASS rule, shared with a usage-limit refusal.
+    WHICH credential answered matters: an answer on the OAuth login says nothing about
+    a portable token a real call rejected; clearing that park re-opened the 401 loop
+    the marker exists to stop (the shim re-picked the account, exported the dead
+    token, parked it again — 2026-08-29)."""
+    mpath = os.path.join(d, '.expired')
+    try:
+        marker = open(mpath, errors='replace').read()
+    except OSError:
+        marker = ''
+    if not uses_token and 'reason=setup-token-invalid' in marker:
+        return ''
+    try:
+        os.remove(mpath)
+    except OSError:
+        return ''
+    return marker_slug(marker) or 'unlabelled'
+
+def record_token_verified(d, token):
+    """Proof that a real call authenticated with exactly this portable token."""
+    try:
+        digest = hashlib.sha256(token.encode()).hexdigest()
+        temp = os.path.join(d, '.server-token-verified.tmp')
+        with open(temp, 'w') as f:
+            f.write(digest + '\n')
+        os.chmod(temp, 0o600)
+        os.replace(temp, os.path.join(d, '.server-token-verified'))
+    except OSError:
+        pass
+
 for acct in manifest.get('accounts', []):
     aid = acct['id']
     d = os.path.join(root, aid)
@@ -2862,6 +2982,15 @@ for acct in manifest.get('accounts', []):
         env['CLAUDE_CODE_OAUTH_TOKEN'] = open(tpath).read().strip()
     t0 = time.time()
     uses_token = 'CLAUDE_CODE_OAUTH_TOKEN' in env
+    identity = {'state': 'unknown'}
+    if has_token:
+        portable = env['CLAUDE_CODE_OAUTH_TOKEN'] if uses_token else open(tpath).read().strip()
+        identity = check_identity(d, portable, version=cli_version(real))
+        if uses_token and identity['state'] == 'mismatch':
+            print(f'{aid} {acct["email"]}: FAIL (portable setup-token belongs to a different '
+                  f'organization — run: claude-accounts login {aid} --token)')
+            failures += 1
+            continue
     try:
         r = subprocess.run([real, '-p', '--output-format', 'text', '--max-turns', '1'],
                            env=env, capture_output=True, text=True, timeout=240,
@@ -2874,44 +3003,44 @@ for acct in manifest.get('accounts', []):
     out = (r.stdout or '').strip()
     if r.returncode == 0 and 'ok' in out.lower():
         # A real call succeeded: this account is definitively alive — but WHICH
-        # credential answered matters. A pass on the OAuth login says nothing about a
-        # portable token a real call rejected; clearing that park here re-opened the
-        # 401 loop the marker exists to stop (the shim re-picked the account, exported
-        # the dead token, parked it again — 2026-08-29).
-        try:
-            marker = open(os.path.join(d, '.expired'), errors='replace').read()
-        except OSError:
-            marker = ''
-        if uses_token or 'reason=setup-token-invalid' not in marker:
-            try:
-                os.remove(os.path.join(d, '.expired'))
-            except OSError:
-                pass
+        # credential answered matters (lift_park).
+        lift_park(d, uses_token)
         if uses_token:
-            try:
-                digest = hashlib.sha256(open(tpath, 'rb').read().strip()).hexdigest()
-                temp = os.path.join(d, '.server-token-verified.tmp')
-                with open(temp, 'w') as f:
-                    f.write(digest + '\n')
-                os.chmod(temp, 0o600)
-                os.replace(temp, os.path.join(d, '.server-token-verified'))
-            except OSError:
-                pass
+            record_token_verified(d, env['CLAUDE_CODE_OAUTH_TOKEN'])
         print(f'{aid} {acct["email"]}: PASS ({dt:.1f}s) -> {out[:60]!r}')
+        if not uses_token and identity['state'] == 'mismatch':
+            print(f'  portable setup-token belongs to a different organization; OAuth login passed; '
+                  f'replace the token with: claude-accounts login {aid} --token')
     else:
         raw = (r.stderr or '').strip()
         err = raw[:200]
         hint = ''
+        # The limiter's refusal is printed on STDOUT (health.log 2026-09-28: out="You've
+        # hit your weekly limit · resets 1am (Europe/Istanbul)" err=''), so it is read
+        # from both streams, whole.
+        said = f'{out}\n{raw}'
         # STDERR only, and the WHOLE of it: stdout is the model's own answer,
         # and a session that merely discusses "Cannot find module" must not be
         # able to excuse a real dead login.
         if BROKEN_CLI.search(raw):
             hint = (' — the Claude CLI cannot run on this machine; not a login '
                     'problem, nothing was parked')
+        elif LIMIT_ERR.search(said) and not NOT_A_LIMIT.search(said):
+            # Still a FAIL — the account cannot serve work right now, and the runner
+            # counts it — but the usage limiter only answers a credential that
+            # authenticated for an organization that lets Claude Code through (see
+            # LIMIT_ERR), so this is the PASS path's lift, word for word.
+            lifted = lift_park(d, uses_token)
+            if uses_token:
+                record_token_verified(d, env['CLAUDE_CODE_OAUTH_TOKEN'])
+            hint = ' — usage-limited, not a login or org problem'
+            if lifted:
+                hint += f'; lifted its {lifted} park'
         elif ORG_ERR.search(out) or ORG_ERR.search(err):
             # Not an auth problem: the account authenticates fine, its organization
             # has simply turned Claude Code subscription access off. Park it — a
-            # re-login changes nothing — and say what actually helps.
+            # re-login changes nothing — and say what actually helps. The park carries
+            # the shim's 6 h soft_until, and a re-observed block refreshes it.
             mark_expired(d, 'org-blocked',
                          "the account's organization has disabled Claude Code access")
             hint = (f' — ORG BLOCKED, excluded from the pool; '
@@ -2985,7 +3114,8 @@ sync_push_target() {
     done
     # Advisory limit state for accounts the target may lack a bearer for.
     local extra
-    for extra in limits.json .limited; do
+    for extra in limits.json .limited .server-token-identity.json; do
+      if [ "$extra" = .server-token-identity.json ]; then token_identity_receipt "$d" || continue; fi
       if [ -f "$d/$extra" ]; then
         rsync -az "$d/$extra" "$server:$sroot/$id/" >>"$ACC_ROOT/sync.log" 2>&1 || true
       fi
@@ -3078,6 +3208,7 @@ cmd_sync() {
     sync_is_replica && role="replica"
     log_to sync.log "sync (local-only, role=$role): no server target${no_server:+ (--no-server)}"
     local_pool_fixup
+    [ "$role" != source ] || token_identities_check
     if [ "$role" = "replica" ]; then
       echo "sync ok (local-only, and this pool is a sync replica — nothing pushed either way)"
     else
@@ -3127,6 +3258,7 @@ EOF
     fail "manifest has zero accounts — refusing to blank the target pools (use 'sync --allow-empty' if that is really intended)"
   fi
 
+  token_identities_check
   sync_push_target "$server" "$sroot" "$srepo"
   local npeers=0
   if [ -n "$peers" ]; then

package/bin/codex

@@ -700,7 +700,8 @@ has_auth() {
 # `soft_until=<epoch>`: once that passes the account returns to the pool by itself, so
 # a misread never costs an account permanently. Markers written by codex-accounts —
 # a refresh grant that answered invalid_grant, a failed real call — carry no soft_until
-# and stay until the account provably works again.
+# and stay until the account provably works again; an org block is the exception and
+# carries the shim's 6 h soft_until wherever it was written.
 expired_marked() { # $1 = acct dir
   local m="$1/.expired" mt soft reason
   [ -f "$m" ] || return 1
@@ -708,8 +709,8 @@ expired_marked() { # $1 = acct dir
   # CREDENTIAL-scoped parks clear the moment a newer credential lands — that is the
   # evidence they were about. A POLICY park (org-blocked: a workspace admin turned
   # Codex off for the account) is about the account, not the credential: refreshing
-  # its token does not re-enable Codex, so only a passing real call or a re-login
-  # lifts it.
+  # its token does not re-enable Codex, so only a passing real call, a re-login or
+  # its own soft_until lifts it.
   if [ "$reason" != "org-blocked" ]; then
     mt="$(file_mtime "$m")"
     if [ -f "$1/auth.json" ] && [ "$(file_mtime "$1/auth.json")" -gt "$mt" ]; then

package/bin/codex-accounts

@@ -1245,7 +1245,8 @@ def clear_expired(d):
     """A usage fetch that succeeded PROVES the bearer works — drop any dead-auth mark.
     EXCEPT an org-blocked one: those accounts authenticate perfectly (telemetry works),
     they are just barred from Codex inference, so telemetry says nothing about them.
-    Only a passing `verify` (a real call) or a re-login lifts that."""
+    Only a passing `verify` (a real call) or a re-login lifts that, or its own
+    soft_until (6 h) runs out."""
     mpath = os.path.join(d, '.expired')
     try:
         if 'reason=org-blocked' in open(mpath, errors='replace').read():
@@ -1886,9 +1887,9 @@ ORG_ERR = re.compile(
 # API at all — a missing native package, a missing node, an unrunnable binary —
 # so they are facts about this MACHINE, not about the login. Parking on one
 # converts an indeterminate probe into "this login is dead", and that verdict
-# does not self-heal: `mark_expired` here writes no `soft_until`, so the shim
-# reads it as proven dead and keeps it, while the panel refuses to re-import
-# the token until its fingerprint changes.
+# does not self-heal: `mark_expired` here writes no `soft_until` for an auth
+# park, so the shim reads it as proven dead and keeps it, while the panel
+# refuses to re-import the token until its fingerprint changes.
 #
 # Not hypothetical. health.log 2026-08-24T06:37:02Z: all four accounts
 # `FAIL rc=127 err='env: node: No such file or directory'` — one broken PATH
@@ -1907,15 +1908,24 @@ BROKEN_CLI = re.compile(
     r'|cannot execute binary file|bad CPU type in executable|exec format error',
     re.I | re.M)
 
+# bin/codex PARK_SOFT_ORG: a workspace policy will not change in minutes, but a verdict
+# that never expires keeps a re-enabled account out of the pool until a person notices
+# (claude side, acct-15, 2026-09-27: an org block outlived the org's own repair).
+PARK_SOFT_ORG = 21600
+
 def mark_expired(d, slug, detail=''):
     """Park an account the shim must stop selecting. Verify is the strongest signal
-    there is — a real inference call that came back 'not authenticated'."""
+    there is — a real inference call that came back 'not authenticated'. An org block
+    carries the shim's soft_until, and a re-observed one is rewritten with a fresh one."""
     mpath = os.path.join(d, '.expired')
+    t = time.time()
+    # The shim's field order (bin/codex park line), so every reader parses one shape.
+    soft = f'soft_until={int(t) + PARK_SOFT_ORG} ' if slug == 'org-blocked' else ''
     try:
         with open(mpath + '.tmp', 'w') as f:
-            f.write(f'{int(time.time())}\n')
-            f.write(f"reason={slug} marked_at="
-                    f"{time.strftime('%Y-%m-%dT%H:%M:%SZ', time.gmtime())} detail={detail}\n")
+            f.write(f'{int(t)}\n')
+            f.write(f"reason={slug} {soft}marked_at="
+                    f"{time.strftime('%Y-%m-%dT%H:%M:%SZ', time.gmtime(t))} detail={detail}\n")
         os.replace(mpath + '.tmp', mpath)
     except Exception:
         pass

package/docs/ACCOUNT_OPERATIONS.md

@@ -33,7 +33,11 @@ claude-accounts relogin acct-01 --token   # portable token instead (Mac + server
 
 `relogin` covers `BLOCKED` accounts too — a fresh sign-in re-issues the grant and usually
 clears the block. Use `claude-accounts verify` (a real `-p` call per account) to re-test
-one at any time; a PASS clears the park automatically.
+one at any time; a PASS clears the park automatically, and so does a call the usage
+limiter refuses (`FAIL … — usage-limited, not a login or org problem; lifted its
+org-blocked park`): the org's Claude Code gate answers before the limiter, so a limit
+answer proves the org lets the account through. A `BLOCKED` park also lapses on its own
+after 6 hours (`soft_until`), and the pool tries the account again.
 
 `relogin` runs the same verified sign-in as `login` (it refuses to save a credential for
 the wrong email), one account at a time, and syncs to the server once at the end.

package/docs/VERIFICATION.md

@@ -50,6 +50,14 @@ repointed via `CLAUDE_BIN=/usr/local/bin/claude` and restarted healthy.
   before direct, TUI, or `--resume` work sees the 401. Run `claude-accounts verify` to
   check every token immediately; `claude-accounts expired` reports token-only accounts
   as `UNVERIFIED` until that proof exists.
+- **An account reads `BLOCKED` although its subscription is active again** — the park came
+  from a real call the org refused ("Your organization has disabled Claude subscription
+  access for Claude Code"), e.g. while a lapsed subscription was unpaid. Run
+  `claude-accounts verify`: a PASS lifts it, and so does a refusal from the usage limiter
+  (`FAIL … — usage-limited, not a login or org problem; lifted its org-blocked park`),
+  because the provider answers the org gate before the limiter. Without either, the park
+  lapses after its 6-hour `soft_until` and the pool tries the account again. The 404
+  "…or ask your admin to enable this model" is about a model, never an org block.
 - **A session restarted itself, or did not** — that is [auto-resume](AUTORESUME.md).
   `grep autoresume ~/.claude-accounts/selection.log` shows each step: `hold` means no
   other account had headroom, and `giveup` gives the reason nothing was relaunched. A