claude-multiacc 2.0.44 → 2.0.46

package/README.md

@@ -147,7 +147,13 @@ this one is *down*, and handing work to it guarantees a hard failure. Reported s
   Code for that account. Telemetry cannot see this — those accounts' usage endpoint
   answers normally — so only a real call (`verify`, or a `-p` run) detects it, and the
   park deliberately survives credential refreshes (a new access token says nothing about
-  an org policy).
+  an org policy). Every org park carries a 6-hour `soft_until` (a re-observed block
+  renews it), and a `verify` that the **usage limiter** refuses ("You've hit your weekly
+  limit") lifts it at once: the provider checks the org's Claude Code gate before the
+  limiter, so a limit answer proves the org lets the account through (acct-15,
+  2026-09-27: a lapsed subscription paid again stayed BLOCKED until this rule existed).
+  The line still reads `FAIL` — the account cannot work until the limit resets — with a
+  `usage-limited` note saying which park it lifted.
 
 `claude-accounts expired` lists what is excluded and also labels a token-only account
 `UNVERIFIED` until `claude-accounts verify` or the shim's first-use preflight proves it.
@@ -155,11 +161,13 @@ Exclusion self-heals, but only against the evidence it was based on: a **credent
 park (dead login) clears as soon as a newer credential lands — a re-login, or a refresh
 by another process — or when a usage fetch authenticates; a **policy** park (org block)
 ignores both, because a fresh access token says nothing about whether the org re-enabled
-Claude Code, and only a passing real call or a re-login lifts it. Parks the **shim**
-writes from a single failed run additionally carry a `soft_until` stamp and expire on
-their own — the shim's guess never outlives the evidence for it — while parks
-`claude-accounts` writes from proof (an `invalid_grant` refresh response, a failed real
-call) stay until the account works again. If *every* account is unusable the shim still
+Claude Code: only a real call that got past the org gate (a passing `verify`, or one
+refused only by a usage limit), a re-login, or its own 6-hour `soft_until` lifts it.
+Parks the **shim** writes from a single failed run additionally carry a `soft_until`
+stamp and expire on their own — the shim's guess never outlives the evidence for it —
+while parks `claude-accounts` writes from proof of a dead credential (an `invalid_grant`
+refresh response, a real call that failed to authenticate) stay until the account works
+again. If *every* account is unusable the shim still
 fails open into stock `claude`, and logs why to `selection.log`.
 
 The shim prints nothing, logs `timestamp account cwd` (never prompt text) to

package/bin/claude

@@ -1581,8 +1581,10 @@ creds_dead() { # $1 = acct dir
 # A marker written by the SHIM (a guess from one failed run) also carries
 # `soft_until=<epoch>`: once that passes the account returns to the pool by itself, so
 # a misread never costs an account permanently. Markers written by claude-accounts —
-# a refresh grant that answered "revoked", a real verify call — carry no soft_until and
-# stay until the account provably works again.
+# a refresh grant that answered "revoked", a real verify call that failed to
+# authenticate — carry no soft_until and stay until the account provably works again.
+# An org block is the exception: verify's carries the shim's 6 h soft_until too, and a
+# verify the usage limiter refused lifts it (the limiter answers only past the org gate).
 expired_marked() { # $1 = acct dir
   local m="$1/.expired" mt f soft reason
   [ -f "$m" ] || return 1
@@ -2276,11 +2278,13 @@ fi
 #   PARK_AUTH  — the credential is dead: a cooldown would just re-fail, so the account
 #                is parked until a re-login / a fetch that authenticates clears it.
 #   PARK_ORG   — the account's organization turned Claude Code access off; no re-login
-#                fixes that.
+#                fixes that. "ask your admin to enable ACCESS", never the bare prefix:
+#                the same client ends a 404 model_not_found with "…or ask your admin to
+#                enable this model", which says nothing about the organization.
 # Both shim-written parks carry a soft_until stamp, so even a false positive returns to
 # the pool on its own — the shim's guess must never outlive the evidence for it.
 PARK_AUTH='failed to authenticate|oauth (session|token)[a-z ]{0,20}(expired|invalid|revoked)|could not be refreshed|invalid api key|authentication_error|invalid bearer token|please run /login|run /login to'
-PARK_ORG='organization has disabled|subscription access[a-z ]{0,20}disabl|disabled claude subscription|ask your admin to enable|not authorized to use claude code'
+PARK_ORG='organization has disabled|subscription access[a-z ]{0,20}disabl|disabled claude subscription|ask your admin to enable access|not authorized to use claude code'
 # A usage limit can be scoped to ONE MODEL: "You've reached your Fable 5 limit.
 # Switch to another model, or manage usage credits..." — the account still has
 # capacity for every other model, and the endpoint says so in the message itself.

package/bin/claude-accounts

@@ -1715,7 +1715,7 @@ cmd_limits() {
 import hashlib, json, os, sys, time, urllib.request
 sys.path = [sys.argv[6]] + [p for p in sys.path if p not in ('', '.')]
 import keychain  # noqa: E402  (macOS Keychain-held logins; a no-op elsewhere)
-from audit import creds_doc_state  # noqa: E402  (one rule for "can this credential work")
+from audit import creds_doc_state, org_block_in_force  # noqa: E402  (one rule for "can this credential work")
 import claude_reset  # noqa: E402  (automatic limit-reset redemption, the codex_reset twin)
 
 root, threshold, quiet, url, force = sys.argv[1], int(sys.argv[2]), sys.argv[3] == '1', sys.argv[4], sys.argv[5] == '1'
@@ -1812,11 +1812,12 @@ def weekly_marker(txt):
 def mark_expired(d, slug, detail=''):
     mpath = os.path.join(d, '.expired')
     # An org-blocked marker is the strongest statement there is about an account and
-    # only `verify` or a re-login may lift it (see clear_expired). Overwriting its
-    # REASON with a weaker one is how it gets lifted by accident: the next successful
-    # fetch sees a reason clear_expired is willing to drop, and the block vanishes.
+    # telemetry can never lift it (see clear_expired). Overwriting its REASON with a
+    # weaker one is how it gets lifted by accident: the next successful fetch sees a
+    # reason clear_expired is willing to drop, and the block vanishes. One whose
+    # soft_until has run out binds nothing any more and outranks nothing either.
     try:
-        if 'reason=org-blocked' in open(mpath, errors='replace').read():
+        if org_block_in_force(open(mpath, errors='replace').read(), now):
             return
     except OSError:
         pass
@@ -1840,7 +1841,9 @@ def clear_expired(d):
       un-parked every dead-token account minutes after the shim parked it, and every
       fresh `claude` walked back into the same 401 all day (2026-08-29). Only a NEW
       token (the shim's newer-file rule) or a real call that used the token lifts it.
-    Only a passing `verify` (a real call) or a re-login lifts the excepted ones."""
+    Only a real call lifts the excepted ones — a passing `verify`, or one the usage
+    limiter refused (the limiter answers only past the credential and the org gate) —
+    or a re-login; an org block also lapses at its soft_until (6 h)."""
     mpath = os.path.join(d, '.expired')
     try:
         body = open(mpath, errors='replace').read()
@@ -2788,7 +2791,8 @@ import hashlib, json, os, re, subprocess, sys, time
 
 root, quick, real = sys.argv[1], sys.argv[2] == '1', sys.argv[3]
 sys.path = [sys.argv[4]] + [p for p in sys.path if p not in ('', '.')]
-from audit import audit_account, creds_state, creds_doc_state   # noqa: E402  (shared with the shim's rule)
+from audit import (audit_account, creds_state, creds_doc_state,  # noqa: E402  (shared with the shim's rule)
+                   marker_slug, org_block_in_force)
 import keychain  # noqa: E402
 from claude_token_identity import check_identity  # noqa: E402
 from claude_reset import cli_version  # noqa: E402
@@ -2803,14 +2807,43 @@ AUTH_ERR = re.compile(
     r'401|403|unauthorized|authentication[_ ]error|invalid[_ ](bearer|token|api key)'
     r'|token (expired|revoked|invalid)|oauth.*(error|expired|invalid)|session expired'
     r'|could not be refreshed|please (run|sign in|log ?in)|re-?authenticate', re.I)
+# `ask your admin to enable ACCESS`, never the bare prefix: the same client ends a 404
+# model_not_found with "…or ask your admin to enable this model", which is about the
+# model and never about the organization (the real refusal still matches three ways).
 ORG_ERR = re.compile(
     r'organization has disabled|subscription access.*disabl|disabled claude subscription'
-    r'|ask your admin to enable|not authorized to use claude code', re.I)
+    r'|ask your admin to enable access|not authorized to use claude code', re.I)
+# A USAGE-LIMIT refusal, tested after BROKEN_CLI and BEFORE ORG_ERR/AUTH_ERR — bin/claude's
+# rule "a rate limit wins the classification". It is also EXCULPATORY: the provider checks
+# the credential, then the organization's Claude Code gate, and only then the usage
+# limiter. acct-15 (2026-09-27) proved the order: already at weekly_all 100%, a real call
+# came back with the ORG refusal, and once the subscription was paid again the same
+# call came back "You've hit your weekly limit". So a limit refusal proves the credential
+# that answered authenticated AND its organization lets Claude Code through: verify lifts
+# a park exactly as a PASS would. Before this, that answer failed with no hint, the
+# org-blocked park stayed, and every re-check on that Mac kept a paid account BLOCKED.
+#
+# The shim's LIMITPAT/MODEL_LIMITPAT, minus what proves nothing about the account: the
+# shim only picks a cooldown over a park and can afford "overloaded"/529 there; here a
+# match LIFTS a park. The client's usage-limiter texts ("You've hit your weekly limit ·
+# resets …", "You've reached your Fable limit. Switch to another model…", "You're out of
+# usage credits") are covered; a bare 429 is not — a headerless 429 is the throttle the
+# client itself prints as "Server is temporarily limiting requests (not your usage
+# limit)", which can answer before any credential is looked at. NOT_A_LIMIT vetoes those
+# (that text contains "usage limit") and the overload family outright.
+LIMIT_ERR = re.compile(
+    r"(hit|reached) your [^.\n]{0,40}(limit|budget)|out of usage|usage limit"
+    r"|limit (reached|exceeded)|rate[ _-]?limit|switch to another model", re.I)
+NOT_A_LIMIT = re.compile(
+    r'not your usage limit|temporarily limiting|overloaded|\b529\b|high load', re.I)
+# bin/claude PARK_SOFT_ORG: an org policy will not change in minutes, but a verdict that
+# never expires kept a paid-again account out of the pool until a person noticed.
+PARK_SOFT_ORG = 21600
 # EXCULPATORY, tested FIRST — the twin of BROKEN_CLI in bin/codex-accounts, and
 # it matters MORE here: AUTH_ERR above matches a bare `401` or `403`, so any
 # machine fault whose output happens to contain those three digits parks a live
-# login. `mark_expired` writes no `soft_until`, so that verdict is permanent
-# until a person clears it. These patterns say the CLI never reached the API,
+# login. `mark_expired` writes no `soft_until` for an auth park, so that verdict is
+# permanent until a person clears it. These patterns say the CLI never reached the API,
 # which is a fact about the machine and never about the login.
 # See health.log 2026-08-24: `env: node: No such file or directory` failed
 # every account in one pass.
@@ -2826,23 +2859,60 @@ def mark_expired(d, slug, detail=''):
     """Park an account the shim must stop selecting. Verify is the strongest signal
     there is — a real inference call that came back 'not authenticated'."""
     mpath = os.path.join(d, '.expired')
-    # Same rule as the limits path: an org block outranks every other reason and only
-    # a PASSING verify or a re-login may lift it. Rewriting its reason with a weaker
-    # one is how it gets lifted by accident later.
-    try:
-        if 'reason=org-blocked' in open(mpath, errors='replace').read():
-            return
-    except OSError:
-        pass
+    t = time.time()
+    # Same rule as the limits path: an org block outranks every other reason while it
+    # binds. Rewriting its reason with a weaker one is how it gets lifted by accident
+    # later. Only the org refusal itself may rewrite it — and does: a re-observed block
+    # is a fresh park with a fresh soft_until, not a stale one left to run out.
+    if slug != 'org-blocked':
+        try:
+            if org_block_in_force(open(mpath, errors='replace').read(), t):
+                return
+        except OSError:
+            pass
+    # The shim's field order (bin/claude park_line), so every reader parses one shape.
+    soft = f'soft_until={int(t) + PARK_SOFT_ORG} ' if slug == 'org-blocked' else ''
     try:
         with open(mpath + '.tmp', 'w') as f:
-            f.write(f'{int(time.time())}\n')
-            f.write(f"reason={slug} marked_at="
-                    f"{time.strftime('%Y-%m-%dT%H:%M:%SZ', time.gmtime())} detail={detail}\n")
+            f.write(f'{int(t)}\n')
+            f.write(f"reason={slug} {soft}marked_at="
+                    f"{time.strftime('%Y-%m-%dT%H:%M:%SZ', time.gmtime(t))} detail={detail}\n")
         os.replace(mpath + '.tmp', mpath)
     except Exception:
         pass
 
+def lift_park(d, uses_token):
+    """A real call reached the account: drop its park, and return the reason it had
+    ('' when nothing was removed). The PASS rule, shared with a usage-limit refusal.
+    WHICH credential answered matters: an answer on the OAuth login says nothing about
+    a portable token a real call rejected; clearing that park re-opened the 401 loop
+    the marker exists to stop (the shim re-picked the account, exported the dead
+    token, parked it again — 2026-08-29)."""
+    mpath = os.path.join(d, '.expired')
+    try:
+        marker = open(mpath, errors='replace').read()
+    except OSError:
+        marker = ''
+    if not uses_token and 'reason=setup-token-invalid' in marker:
+        return ''
+    try:
+        os.remove(mpath)
+    except OSError:
+        return ''
+    return marker_slug(marker) or 'unlabelled'
+
+def record_token_verified(d, token):
+    """Proof that a real call authenticated with exactly this portable token."""
+    try:
+        digest = hashlib.sha256(token.encode()).hexdigest()
+        temp = os.path.join(d, '.server-token-verified.tmp')
+        with open(temp, 'w') as f:
+            f.write(digest + '\n')
+        os.chmod(temp, 0o600)
+        os.replace(temp, os.path.join(d, '.server-token-verified'))
+    except OSError:
+        pass
+
 for acct in manifest.get('accounts', []):
     aid = acct['id']
     d = os.path.join(root, aid)
@@ -2933,29 +3003,10 @@ for acct in manifest.get('accounts', []):
     out = (r.stdout or '').strip()
     if r.returncode == 0 and 'ok' in out.lower():
         # A real call succeeded: this account is definitively alive — but WHICH
-        # credential answered matters. A pass on the OAuth login says nothing about a
-        # portable token a real call rejected; clearing that park here re-opened the
-        # 401 loop the marker exists to stop (the shim re-picked the account, exported
-        # the dead token, parked it again — 2026-08-29).
-        try:
-            marker = open(os.path.join(d, '.expired'), errors='replace').read()
-        except OSError:
-            marker = ''
-        if uses_token or 'reason=setup-token-invalid' not in marker:
-            try:
-                os.remove(os.path.join(d, '.expired'))
-            except OSError:
-                pass
+        # credential answered matters (lift_park).
+        lift_park(d, uses_token)
         if uses_token:
-            try:
-                digest = hashlib.sha256(env['CLAUDE_CODE_OAUTH_TOKEN'].encode()).hexdigest()
-                temp = os.path.join(d, '.server-token-verified.tmp')
-                with open(temp, 'w') as f:
-                    f.write(digest + '\n')
-                os.chmod(temp, 0o600)
-                os.replace(temp, os.path.join(d, '.server-token-verified'))
-            except OSError:
-                pass
+            record_token_verified(d, env['CLAUDE_CODE_OAUTH_TOKEN'])
         print(f'{aid} {acct["email"]}: PASS ({dt:.1f}s) -> {out[:60]!r}')
         if not uses_token and identity['state'] == 'mismatch':
             print(f'  portable setup-token belongs to a different organization; OAuth login passed; '
@@ -2964,16 +3015,32 @@ for acct in manifest.get('accounts', []):
         raw = (r.stderr or '').strip()
         err = raw[:200]
         hint = ''
+        # The limiter's refusal is printed on STDOUT (health.log 2026-09-28: out="You've
+        # hit your weekly limit · resets 1am (Europe/Istanbul)" err=''), so it is read
+        # from both streams, whole.
+        said = f'{out}\n{raw}'
         # STDERR only, and the WHOLE of it: stdout is the model's own answer,
         # and a session that merely discusses "Cannot find module" must not be
         # able to excuse a real dead login.
         if BROKEN_CLI.search(raw):
             hint = (' — the Claude CLI cannot run on this machine; not a login '
                     'problem, nothing was parked')
+        elif LIMIT_ERR.search(said) and not NOT_A_LIMIT.search(said):
+            # Still a FAIL — the account cannot serve work right now, and the runner
+            # counts it — but the usage limiter only answers a credential that
+            # authenticated for an organization that lets Claude Code through (see
+            # LIMIT_ERR), so this is the PASS path's lift, word for word.
+            lifted = lift_park(d, uses_token)
+            if uses_token:
+                record_token_verified(d, env['CLAUDE_CODE_OAUTH_TOKEN'])
+            hint = ' — usage-limited, not a login or org problem'
+            if lifted:
+                hint += f'; lifted its {lifted} park'
         elif ORG_ERR.search(out) or ORG_ERR.search(err):
             # Not an auth problem: the account authenticates fine, its organization
             # has simply turned Claude Code subscription access off. Park it — a
-            # re-login changes nothing — and say what actually helps.
+            # re-login changes nothing — and say what actually helps. The park carries
+            # the shim's 6 h soft_until, and a re-observed block refreshes it.
             mark_expired(d, 'org-blocked',
                          "the account's organization has disabled Claude Code access")
             hint = (f' — ORG BLOCKED, excluded from the pool; '

package/bin/codex

@@ -700,7 +700,8 @@ has_auth() {
 # `soft_until=<epoch>`: once that passes the account returns to the pool by itself, so
 # a misread never costs an account permanently. Markers written by codex-accounts —
 # a refresh grant that answered invalid_grant, a failed real call — carry no soft_until
-# and stay until the account provably works again.
+# and stay until the account provably works again; an org block is the exception and
+# carries the shim's 6 h soft_until wherever it was written.
 expired_marked() { # $1 = acct dir
   local m="$1/.expired" mt soft reason
   [ -f "$m" ] || return 1
@@ -708,8 +709,8 @@ expired_marked() { # $1 = acct dir
   # CREDENTIAL-scoped parks clear the moment a newer credential lands — that is the
   # evidence they were about. A POLICY park (org-blocked: a workspace admin turned
   # Codex off for the account) is about the account, not the credential: refreshing
-  # its token does not re-enable Codex, so only a passing real call or a re-login
-  # lifts it.
+  # its token does not re-enable Codex, so only a passing real call, a re-login or
+  # its own soft_until lifts it.
   if [ "$reason" != "org-blocked" ]; then
     mt="$(file_mtime "$m")"
     if [ -f "$1/auth.json" ] && [ "$(file_mtime "$1/auth.json")" -gt "$mt" ]; then
@@ -1362,8 +1363,21 @@ fi
 pick="$PICK_DIR"
 # A probe answers here, before anything that would count as a launch: no rotation
 # memory, no limits kick, no pick line in selection.log — and never an exec.
+# A limited tier also names when it lifts (resets_at=<epoch>, only when known): hard is
+# the soonest reset among the exhausted accounts, soft the picked account's own marker.
+# This is the machine twin of the tty-only notice above — callers read stdout, and a
+# service's stderr stays byte-clean.
 if [ "$AR_PROBE" = "1" ]; then
-  printf 'pick=%s tier=%s\n' "${pick##*/}" "$AR_TIER"
+  ar_reset=0
+  case "$AR_TIER" in
+    hard) ar_reset="$best_reset" ;;
+    soft) ar_reset="$(limited_reset_of "$pick")" ;;
+  esac
+  if [ "$ar_reset" -gt 0 ] 2>/dev/null; then
+    printf 'pick=%s tier=%s resets_at=%s\n' "${pick##*/}" "$AR_TIER" "$ar_reset"
+  else
+    printf 'pick=%s tier=%s\n' "${pick##*/}" "$AR_TIER"
+  fi
   exit 0
 fi
 # Remember the pick so the NEXT run does not hand back the same account. An explicit

package/bin/codex-accounts

@@ -1245,7 +1245,8 @@ def clear_expired(d):
     """A usage fetch that succeeded PROVES the bearer works — drop any dead-auth mark.
     EXCEPT an org-blocked one: those accounts authenticate perfectly (telemetry works),
     they are just barred from Codex inference, so telemetry says nothing about them.
-    Only a passing `verify` (a real call) or a re-login lifts that."""
+    Only a passing `verify` (a real call) or a re-login lifts that, or its own
+    soft_until (6 h) runs out."""
     mpath = os.path.join(d, '.expired')
     try:
         if 'reason=org-blocked' in open(mpath, errors='replace').read():
@@ -1886,9 +1887,9 @@ ORG_ERR = re.compile(
 # API at all — a missing native package, a missing node, an unrunnable binary —
 # so they are facts about this MACHINE, not about the login. Parking on one
 # converts an indeterminate probe into "this login is dead", and that verdict
-# does not self-heal: `mark_expired` here writes no `soft_until`, so the shim
-# reads it as proven dead and keeps it, while the panel refuses to re-import
-# the token until its fingerprint changes.
+# does not self-heal: `mark_expired` here writes no `soft_until` for an auth
+# park, so the shim reads it as proven dead and keeps it, while the panel
+# refuses to re-import the token until its fingerprint changes.
 #
 # Not hypothetical. health.log 2026-08-24T06:37:02Z: all four accounts
 # `FAIL rc=127 err='env: node: No such file or directory'` — one broken PATH
@@ -1907,15 +1908,24 @@ BROKEN_CLI = re.compile(
     r'|cannot execute binary file|bad CPU type in executable|exec format error',
     re.I | re.M)
 
+# bin/codex PARK_SOFT_ORG: a workspace policy will not change in minutes, but a verdict
+# that never expires keeps a re-enabled account out of the pool until a person notices
+# (claude side, acct-15, 2026-09-27: an org block outlived the org's own repair).
+PARK_SOFT_ORG = 21600
+
 def mark_expired(d, slug, detail=''):
     """Park an account the shim must stop selecting. Verify is the strongest signal
-    there is — a real inference call that came back 'not authenticated'."""
+    there is — a real inference call that came back 'not authenticated'. An org block
+    carries the shim's soft_until, and a re-observed one is rewritten with a fresh one."""
     mpath = os.path.join(d, '.expired')
+    t = time.time()
+    # The shim's field order (bin/codex park line), so every reader parses one shape.
+    soft = f'soft_until={int(t) + PARK_SOFT_ORG} ' if slug == 'org-blocked' else ''
     try:
         with open(mpath + '.tmp', 'w') as f:
-            f.write(f'{int(time.time())}\n')
-            f.write(f"reason={slug} marked_at="
-                    f"{time.strftime('%Y-%m-%dT%H:%M:%SZ', time.gmtime())} detail={detail}\n")
+            f.write(f'{int(t)}\n')
+            f.write(f"reason={slug} {soft}marked_at="
+                    f"{time.strftime('%Y-%m-%dT%H:%M:%SZ', time.gmtime(t))} detail={detail}\n")
         os.replace(mpath + '.tmp', mpath)
     except Exception:
         pass

package/docs/ACCOUNT_OPERATIONS.md

@@ -33,7 +33,11 @@ claude-accounts relogin acct-01 --token   # portable token instead (Mac + server
 
 `relogin` covers `BLOCKED` accounts too — a fresh sign-in re-issues the grant and usually
 clears the block. Use `claude-accounts verify` (a real `-p` call per account) to re-test
-one at any time; a PASS clears the park automatically.
+one at any time; a PASS clears the park automatically, and so does a call the usage
+limiter refuses (`FAIL … — usage-limited, not a login or org problem; lifted its
+org-blocked park`): the org's Claude Code gate answers before the limiter, so a limit
+answer proves the org lets the account through. A `BLOCKED` park also lapses on its own
+after 6 hours (`soft_until`), and the pool tries the account again.
 
 `relogin` runs the same verified sign-in as `login` (it refuses to save a credential for
 the wrong email), one account at a time, and syncs to the server once at the end.

package/docs/AUTORESUME.md

@@ -293,6 +293,12 @@ CLAUDE_MULTIACC_AR_PROBE=1 CLAUDE_MULTIACC_AR_AVOID=acct-07:1790000000 claude
   - `soft`: only the all-limited fallback;
   - `hard`: only exhausted accounts are left;
   - `none`: nothing is usable; exit 3.
+- **`resets_at`** (codex only): a `soft` or `hard` answer may end with
+  ` resets_at=<epoch>`, when that tier's reset is known. For `hard` it is the soonest
+  reset among the exhausted accounts. For `soft` it is the picked account's own reset.
+  An `eligible` answer never carries it. This is the machine-readable form of the
+  terminal-only "every usable account is at a limit" notice; stderr stays empty.
+  Parsers must accept trailing `key=value` fields.
 - **What the probe runs:** the same candidate loop as a launch, including marker upkeep
   and its log lines, stopping before exec.
 - **Environment:** run it with no `CLAUDE_CONFIG_DIR`, `CLAUDE_ACCOUNT` or

package/docs/VERIFICATION.md

@@ -50,6 +50,14 @@ repointed via `CLAUDE_BIN=/usr/local/bin/claude` and restarted healthy.
   before direct, TUI, or `--resume` work sees the 401. Run `claude-accounts verify` to
   check every token immediately; `claude-accounts expired` reports token-only accounts
   as `UNVERIFIED` until that proof exists.
+- **An account reads `BLOCKED` although its subscription is active again** — the park came
+  from a real call the org refused ("Your organization has disabled Claude subscription
+  access for Claude Code"), e.g. while a lapsed subscription was unpaid. Run
+  `claude-accounts verify`: a PASS lifts it, and so does a refusal from the usage limiter
+  (`FAIL … — usage-limited, not a login or org problem; lifted its org-blocked park`),
+  because the provider answers the org gate before the limiter. Without either, the park
+  lapses after its 6-hour `soft_until` and the pool tries the account again. The 404
+  "…or ask your admin to enable this model" is about a model, never an org block.
 - **A session restarted itself, or did not** — that is [auto-resume](AUTORESUME.md).
   `grep autoresume ~/.claude-accounts/selection.log` shows each step: `hold` means no
   other account had headroom, and `giveup` gives the reason nothing was relaunched. A

package/lib/audit.py

@@ -7,7 +7,9 @@ States:
   expired  has auth material that CANNOT authenticate — needs `claude-accounts relogin`
   token-invalid  a portable setup-token was rejected — needs a new setup-token, not a login
   blocked  authenticates, but its organization has disabled Claude Code subscription
-           access — a re-login cannot fix it, so it needs an admin (or removal)
+           access — a re-login cannot fix it, so it needs an admin (or removal); a
+           park with a soft_until (every one written now: 6 h) lapses on its own
+           and the pool re-tries the account
   locked   the OAuth login is in the macOS Keychain and THIS session cannot open it
            (ssh/tmux/background) — it works from the Mac's own GUI session, so it is
            neither dead nor missing; just not usable from here
@@ -73,12 +75,31 @@ def marker_slug(detail):
     return m.group(1) if m else ''
 
 
+def marker_soft_until(detail):
+    """The soft_until=<epoch> field of a marker line (None when absent)."""
+    m = re.search(r'soft_until=(\d+)', detail or '')
+    return int(m.group(1)) if m else None
+
+
+def org_block_in_force(body, now=None):
+    """True when a marker is an org-blocked park that still binds — no soft_until, or
+    one still ahead (expired_marked below and bin/claude's reading of the same line).
+    The writers use it to keep a weaker reason from overwriting a live org block; a
+    block whose soft window has run out no longer outranks anything."""
+    now = time.time() if now is None else now
+    if marker_slug(body) != 'org-blocked':
+        return False
+    soft = marker_soft_until(body)
+    return soft is None or soft > now
+
+
 def expired_marked(d, now=None):
     """True when <d>/.expired is still in force. Mirrors the shim exactly:
     a CREDENTIAL-scoped park clears as soon as a newer credential lands (re-login, or a
     refresh by another process); a POLICY park (org-blocked) does not, because a token
     refresh says nothing about whether the org re-enabled Claude Code. Either kind also
-    expires at its own soft_until when the shim wrote it from a single failed run."""
+    expires at its own soft_until when it carries one — every shim park, and every
+    org-blocked park (the shim's and verify's alike carry six hours)."""
     now = time.time() if now is None else now
     mpath = os.path.join(d, '.expired')
     if not os.path.isfile(mpath):
@@ -105,8 +126,8 @@ def expired_marked(d, now=None):
         if not os.path.isfile(os.path.join(d, '.credentials.json')) \
                 and keychain.item_mtime(d) > mt:
             return False
-    m = re.search(r'soft_until=(\d+)', detail)
-    if m and int(m.group(1)) <= now:
+    soft = marker_soft_until(detail)
+    if soft is not None and soft <= now:
         return False
     return True
 
@@ -288,6 +309,13 @@ def audit_account(root, acct, now=None, machine=None, require_verified_token=Fal
             row['state'] = 'blocked'
             row['reason'] = ('this account\'s organization has disabled Claude Code '
                              'subscription access')
+            soft = marker_soft_until(detail)
+            if soft is not None:
+                # When the pool gives it another real call on its own (the park's
+                # soft_until). A passing verify, one refused only by a usage limit, or
+                # a re-login lifts it sooner.
+                row['reason'] += time.strftime(
+                    '; re-tried by the pool after %Y-%m-%d %H:%M UTC', time.gmtime(soft))
         elif slug == 'setup-token-invalid':
             login = oauth_login(d, now)
             if login['state'] == 'ok':

package/lib/autoresume.py

@@ -1118,10 +1118,13 @@ def probe_env(environ, provider, avoid):
 
 
 def parse_probe(out):
-    """The probe's ``pick=<acct> tier=<eligible|soft|hard|none>`` -> (pick, tier)."""
+    """The probe's ``pick=<acct> tier=<eligible|soft|hard|none>`` -> (pick, tier).
+
+    Trailing ``key=value`` fields (the codex shim's ``resets_at=<epoch>``) are accepted
+    and ignored here."""
     pick, tier = "", ""
     for line in (out or "").split("\n"):
-        m = re.match(r"^pick=(\S*) tier=(\S+)\s*$", line.strip())
+        m = re.match(r"^pick=(\S*) tier=(\S+)(?:\s+\w+=\S*)*\s*$", line.strip())
         if m:
             pick, tier = m.group(1), m.group(2)
     if pick and not ACCT_RE.match(pick):

package/lib/codex_audit.py

@@ -69,7 +69,8 @@ def expired_marked(d, now=None):
     a CREDENTIAL-scoped park clears as soon as a newer auth.json lands (re-login, or a
     refresh by another process); a POLICY park (org-blocked) does not, because a token
     refresh says nothing about whether the workspace re-enabled Codex. Either kind also
-    expires at its own soft_until when the shim wrote it from a single failed run."""
+    expires at its own soft_until when it carries one — every shim park, and every
+    org-blocked park (the shim's and verify's alike carry six hours)."""
     now = time.time() if now is None else now
     mpath = os.path.join(d, '.expired')
     if not os.path.isfile(mpath):
@@ -199,6 +200,12 @@ def audit_account(root, acct, now=None, machine=None):
             row['state'] = 'blocked'
             row['reason'] = ('Codex access is disabled for this account by a '
                              'workspace admin')
+            soft = re.search(r'soft_until=(\d+)', detail)
+            if soft:
+                # When the pool gives it another real call on its own (lib/audit.py).
+                row['reason'] += time.strftime(
+                    '; re-tried by the pool after %Y-%m-%d %H:%M UTC',
+                    time.gmtime(int(soft.group(1))))
         else:
             row['state'] = 'expired'
             row['reason'] = f'marked dead by the pool ({detail or "authentication failed"})'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-multiacc",
-  "version": "2.0.44",
+  "version": "2.0.46",
   "description": "Unified Claude Code and OpenAI Codex subscription pooling with quota-aware selection.",
   "type": "module",
   "bin": {

package/tests/run-tests.sh

@@ -272,8 +272,21 @@ if [ -f "$ctl" ] && grep -qx "brokencli:$acct" "$ctl" 2>/dev/null; then
   exit 1
 fi
 case " $* " in
-  *" -p --output-format text --max-turns 1 "*) echo "OK"; exit 0 ;;
+  *" -p --output-format text --max-turns 1 "*)
+    # verify's real call, refused: `verifysay:<acct>` answers FAKE_VERIFY_TEXT the way
+    # the real client prints a refusal in text mode — on STDOUT, exit 1 (health.log
+    # 2026-09-28: out="You've hit your weekly limit · resets 1am (Europe/Istanbul)" err='').
+    if [ -f "$ctl" ] && grep -qx "verifysay:$acct" "$ctl" 2>/dev/null; then
+      printf '%s\n' "${FAKE_VERIFY_TEXT:-}"
+      exit 1
+    fi
+    echo "OK"; exit 0 ;;
 esac
+if [ -f "$ctl" ] && grep -qx "model404:$acct" "$ctl" 2>/dev/null; then
+  # 2.1.283's 404 model_not_found text: about a MODEL, never the organization.
+  echo "The model claude-nope is not available on your firstParty deployment. Try switching to claude-opus-5, or ask your admin to enable this model."
+  exit 1
+fi
 if [ -f "$ctl" ] && grep -qx "fail:$acct" "$ctl" 2>/dev/null; then
   echo "API Error: 429 rate limit exceeded" >&2
   exit 1
@@ -1155,6 +1168,17 @@ check "relogin targets org-blocked accounts" "acct-01 login saved" "$out"
 [ ! -f "$ACC/acct-01/.expired" ] && t_ok "a successful re-login clears an org block" \
   || t_fail "org-block relogin" "marker survived the re-login"
 rm -f "$ACC/acct-01/.expired"
+# The client's 404 model_not_found ends "…or ask your admin to enable this model". The org
+# vocabulary's bare "ask your admin to enable" matched it, parking a healthy account as
+# org-blocked over a model name; only "…to enable access" is the org refusal.
+printf '{"fetched_at":%s,"max_percent":1,"weekly_percent":1,"session_percent":1,"buckets":[]}' "$now" > "$ACC/acct-01/limits.json"
+printf '{"fetched_at":%s,"max_percent":50,"weekly_percent":50,"session_percent":50,"buckets":[]}' "$now" > "$ACC/acct-02/limits.json"
+echo "model404:acct-01" > "$FAKE_CTL"
+out="$(claude -p hello < /dev/null 2>&1)"
+check "a model 404 reaches the caller as it is" "not available on your firstParty deployment" "$out"
+[ ! -f "$ACC/acct-01/.expired" ] && t_ok "a model 404 ('ask your admin to enable this model') parks nothing" \
+  || t_fail "model 404 park" "$(tail -1 "$ACC/acct-01/.expired")"
+rm -f "$FAKE_CTL" "$ACC"/acct-*/limits.json "$ACC"/acct-*/.limited "$ACC"/acct-*/.expired
 
 # ---- 10. token-only account exports CLAUDE_CODE_OAUTH_TOKEN ------------------
 mkdir -p "$ACC/acct-03"
@@ -3213,6 +3237,14 @@ rm -f "$ACC/acct-05/limits.json"
 out="$(CLAUDE_MULTIACC_USAGE_URL="file://$WORK/usage-low.json" claude-accounts limits --force 2>&1)"
 [ -f "$ACC/acct-05/.expired" ] && t_ok "a usage fetch does not unpark an org-blocked account" \
   || t_fail "org-block unpark" "telemetry cleared an org block it cannot observe"
+# ...nor one verify wrote with its soft_until (every org park carries one now)
+printf '%s\nreason=org-blocked soft_until=%s marked_at=now detail=test\n' "$now" "$(( $(date +%s) + 21600 ))" \
+  > "$ACC/acct-05/.expired"
+rm -f "$ACC/acct-05/limits.json"
+out="$(CLAUDE_MULTIACC_USAGE_URL="file://$WORK/usage-low.json" claude-accounts limits --force 2>&1)"
+grep -q 'reason=org-blocked soft_until=' "$ACC/acct-05/.expired" 2>/dev/null \
+  && t_ok "a usage fetch does not unpark a soft-stamped org block" \
+  || t_fail "soft org-block unpark" "telemetry cleared a soft-stamped org block"
 rm -f "$ACC/acct-05/.expired" "$ACC/acct-05/server.token"
 
 # ---- 16b6. RECENTLY-expired token is left alone (a live session owns it) --------------
@@ -3770,6 +3802,34 @@ RACER
   grep -q "reason=org-blocked" "$SD/acct-01/.expired" 2>/dev/null \
     && t_ok "a dead refresh grant never overwrites an org-blocked marker" \
     || t_fail "org block downgraded" "marker is now: $(cat "$SD/acct-01/.expired" 2>/dev/null | tail -1)"
+  # The same without the portable token beside it — park_dead_grant never parks an
+  # account its token still serves, so the check above cannot see the guard. A live org
+  # block (no soft_until, or one still ahead) is never overwritten; one whose soft_until
+  # has run out binds nothing and outranks nothing, so the dead grant gets its own park.
+  mv "$SD/acct-01/server.token" "$SD/acct-01/server.token.aside"
+  for soft in none "$(( $(date +%s) + 21600 ))" "$(( $(date +%s) - 10 ))"; do
+    if [ "$soft" = none ]; then
+      printf '%s\nreason=org-blocked marked_at=now detail=test\n' "$now" > "$SD/acct-01/.expired"
+    else
+      printf '%s\nreason=org-blocked soft_until=%s marked_at=now detail=test\n' \
+        "$((now - 30000))" "$soft" > "$SD/acct-01/.expired"
+    fi
+    rm -f "$SD/acct-01/limits.json"
+    CLAUDE_ACCOUNTS_ROOT="$SD" CLAUDE_MULTIACC_USAGE_URL="http://127.0.0.1:$uport/ok" \
+      claude-accounts limits --force >/dev/null 2>&1
+    grep -q "reason=org-blocked" "$SD/acct-01/.expired" 2>/dev/null && echo kept || echo "$(tail -1 "$SD/acct-01/.expired" 2>/dev/null)"
+  done > "$WORK/lapsed-org.txt"
+  mv "$SD/acct-01/server.token.aside" "$SD/acct-01/server.token"
+  [ "$(sed -n 1p "$WORK/lapsed-org.txt")" = kept ] \
+    && t_ok "a dead refresh grant (no token beside it) never overwrites an org block" \
+    || t_fail "org block downgraded" "$(sed -n 1p "$WORK/lapsed-org.txt")"
+  [ "$(sed -n 2p "$WORK/lapsed-org.txt")" = kept ] \
+    && t_ok "a dead refresh grant never overwrites an org block inside its soft window" \
+    || t_fail "soft org block downgraded" "$(sed -n 2p "$WORK/lapsed-org.txt")"
+  case "$(sed -n 3p "$WORK/lapsed-org.txt")" in
+    reason=refresh-token-expired*) t_ok "a lapsed org block does not hide a dead refresh grant from its park" ;;
+    *) t_fail "lapsed org block shields a dead grant" "$(sed -n 3p "$WORK/lapsed-org.txt")" ;;
+  esac
   rm -f "$SD/acct-01/.expired" "$SD/acct-01/.credentials.json"
 
   # ---- the >=90% cutoff keeps the TIGHT window --------------------------------
@@ -4293,6 +4353,171 @@ case "$out" in
 esac
 rm -f "$WORK/ctl-brokencli"
 
+# ---- 17a3. a usage-limit refusal proves the org lets the account through --------------
+# acct-15, 2026-09-27: at weekly_all 100% a real call came back with the ORG refusal, and
+# once the lapsed subscription was paid again the same call answered "You've hit your
+# weekly limit" — the provider checks the org gate before the usage limiter. verify
+# failed that answer with no hint and kept the org-blocked park, so a paid account read
+# BLOCKED on that Mac through every re-check. A limit refusal now lifts a park by the PASS
+# rule, and the line stays FAIL (the runner counts it).
+VP="$WORK/verifylimit"
+vnow="$(date +%s)"   # the suite's $now is minutes old by here; soft windows need a fresh one
+VP_HOME=mac; VP_MACHINE=mac; [ "$(uname -s)" = "Darwin" ] || { VP_HOME=server; VP_MACHINE=linux; }
+mkdir -p "$VP/tmp" "$VP/acct-01" "$VP/acct-02" "$VP/acct-03"
+: > "$VP/.limits-kick"
+cat > "$VP/accounts.json" <<EOF2
+{ "version": 1, "threshold": 90,
+  "accounts": [
+    {"id": "acct-01", "email": "vl1@test", "home": "$VP_HOME", "added_at": "2026-09-28T00:00:00Z"},
+    {"id": "acct-02", "email": "vl2@test", "home": "$VP_HOME", "added_at": "2026-09-28T00:00:00Z"},
+    {"id": "acct-03", "email": "vl3@test", "home": "$VP_HOME", "added_at": "2026-09-28T00:00:00Z"}
+  ] }
+EOF2
+VP_LIVE='{"claudeAiOauth":{"accessToken":"sk-ant-oat01-vl","refreshToken":"r","expiresAt":9999999999999,"refreshTokenExpiresAt":9999999999999}}'
+# acct-01: OAuth login only. acct-02: a live login beside a portable token (verify runs
+# the LOGIN). acct-03: the portable token only (verify runs the TOKEN).
+printf '%s' "$VP_LIVE" > "$VP/acct-01/.credentials.json"
+printf '%s' "$VP_LIVE" > "$VP/acct-02/.credentials.json"
+printf 'sk-ant-oat01-vl-token-02' > "$VP/acct-02/server.token"
+printf 'sk-ant-oat01-vl-token-03' > "$VP/acct-03/server.token"
+printf 'verifysay:acct-01\nverifysay:acct-02\nverifysay:acct-03\n' > "$WORK/ctl-verifysay"
+vp_verify() { # $1 = what the refused call prints
+  FAKE_CTL="$WORK/ctl-verifysay" FAKE_VERIFY_TEXT="$1" CLAUDE_ACCOUNTS_DIR="$VP" \
+    claude-accounts verify 2>&1
+}
+vp_line() { printf '%s\n' "$out" | grep "^$1 " | head -1; }
+vp_park() { # $1 acct, $2 marker line 2 (reason=… fields)
+  printf '%s\n%s\n' "$((vnow - 3600))" "$2" > "$VP/$1/.expired"
+}
+vp_park acct-01 "reason=org-blocked marked_at=2026-09-27T20:42:42Z detail=the account's organization has disabled Claude Code access"
+vp_park acct-02 "reason=setup-token-invalid marked_at=2026-09-27T20:42:42Z detail=portable setup-token failed a real inference"
+vp_park acct-03 "reason=org-blocked soft_until=$((vnow + 20000)) marked_at=2026-09-27T20:42:42Z detail=x"
+rm -f "$VP/acct-03/.server-token-verified"
+out="$(vp_verify "You've hit your weekly limit · resets 1am (Europe/Istanbul)")"
+rc=$?
+check "a limit refusal still reads FAIL, in the shape the runner parses" \
+  "acct-01 vl1@test: FAIL rc=1 out=\"You've hit your weekly limit" "$out"
+check "a limit refusal is called what it is" "usage-limited, not a login or org problem" "$(vp_line acct-01)"
+check "a limit refusal names the park it lifted" "lifted its org-blocked park" "$(vp_line acct-01)"
+[ ! -f "$VP/acct-01/.expired" ] && t_ok "a limit refusal lifts an org-blocked park (the org gate answers first)" \
+  || t_fail "limit lifts org park" "$(tail -1 "$VP/acct-01/.expired")"
+[ "$rc" = 1 ] && check "limit refusals are still counted as failures" "verified 3 account(s), 3 failure(s)" "$out" \
+  || t_fail "limit refusal exit" "rc=$rc"
+n="$(printf '%s\n' "$out" | grep -cE '^(acct-[0-9]+)[[:space:]]+([^[:space:]]+):[[:space:]]+(PASS|FAIL|OK|SKIP)([^[:alnum:]_].*)?$')"
+[ "$n" = 3 ] && t_ok "every account line still matches app-robot's verdict pattern" \
+  || t_fail "verdict pattern" "matched $n of 3: $out"
+# The LOGIN answered for acct-02: that proves nothing about the portable token a real
+# call rejected, so its token park stays — the PASS rule, exactly.
+check "a limit refusal on the login is still called usage-limited" "usage-limited" "$(vp_line acct-02)"
+case "$(vp_line acct-02)" in
+  *lifted*) t_fail "login limit must not claim a lift" "$(vp_line acct-02)" ;;
+  *) t_ok "a limit refusal that lifted nothing does not claim a lift" ;;
+esac
+grep -q 'reason=setup-token-invalid' "$VP/acct-02/.expired" 2>/dev/null \
+  && t_ok "a limit refusal on the OAuth login keeps a setup-token-invalid park" \
+  || t_fail "login limit vs token park" "the token park was lifted by the login's answer"
+[ ! -f "$VP/acct-02/.server-token-verified" ] && t_ok "the login's limit answer records no token proof" \
+  || t_fail "login limit token proof" ".server-token-verified written for a token that never answered"
+# The TOKEN answered for acct-03: its park goes and the token is proven, as on a PASS.
+check "a token limit refusal names the park it lifted" "lifted its org-blocked park" "$(vp_line acct-03)"
+[ ! -f "$VP/acct-03/.expired" ] && t_ok "a limit refusal on the token lifts the park" \
+  || t_fail "token limit lift" "$(tail -1 "$VP/acct-03/.expired")"
+want="$(printf 'sk-ant-oat01-vl-token-03' | { shasum -a 256 2>/dev/null || sha256sum; } | cut -d' ' -f1)"
+[ "$(cat "$VP/acct-03/.server-token-verified" 2>/dev/null)" = "$want" ] \
+  && t_ok "a limit refusal on the token records .server-token-verified for that token" \
+  || t_fail "token limit proof" "got '$(cat "$VP/acct-03/.server-token-verified" 2>/dev/null)'"
+st="$(CLAUDE_ACCOUNTS_DIR="$VP" claude-accounts list --json 2>/dev/null \
+  | python3 -c 'import json,sys; print({a["id"]: a["status"] for a in json.load(sys.stdin)["accounts"]}.get("acct-01"))')"
+[ "$st" != "blocked" ] && t_ok "the lifted account no longer lists as blocked ($st)" \
+  || t_fail "lifted account status" "list --json still says blocked"
+# A model-scoped limit is the same limiter speaking.
+vp_park acct-01 "reason=org-blocked marked_at=2026-09-27T20:42:42Z detail=x"
+out="$(vp_verify "You've reached your Fable limit. Switch to another model, or manage usage credits at claude.ai/settings/usage?from=cc_cl to continue.")"
+[ ! -f "$VP/acct-01/.expired" ] && check "a model-scoped limit lifts the org park too" "lifted its org-blocked park" "$(vp_line acct-01)" \
+  || t_fail "model limit lift" "$(tail -1 "$VP/acct-01/.expired")"
+# ...but not the throttle the client itself calls "not your usage limit", nor an overload:
+# neither proves the org gate was passed, and both contain limit words.
+for said in "API Error: Server is temporarily limiting requests (not your usage limit) · Rate limited" \
+            "API Error: 529 Overloaded. Rate limit exceeded, try again" \
+            "Opus is experiencing high load, please use /model to switch to Sonnet"; do
+  vp_park acct-01 "reason=org-blocked marked_at=2026-09-27T20:42:42Z detail=x"
+  out="$(vp_verify "$said")"
+  if grep -q 'reason=org-blocked' "$VP/acct-01/.expired" 2>/dev/null \
+      && case "$(vp_line acct-01)" in *usage-limited*) false ;; *) true ;; esac; then
+    t_ok "no lift on a transient answer: ${said:0:48}"
+  else
+    t_fail "transient answer lifted a park" "${said:0:48} -> $(vp_line acct-01)"
+  fi
+done
+rm -f "$VP"/acct-*/.expired
+
+# The ORG refusal: verify's park carries the shim's 6 h soft_until, and seeing the refusal
+# again refreshes it (a stale stamp would release a still-blocked account early).
+ORG_TEXT="Your organization has disabled Claude subscription access for Claude Code · Use an Anthropic API key instead, or ask your admin to enable access"
+t0="$(date +%s)"
+out="$(vp_verify "$ORG_TEXT")"
+t1="$(date +%s)"
+check "verify calls out the org block" "ORG BLOCKED" "$(vp_line acct-01)"
+soft="$(sed -n 's/.*soft_until=\([0-9][0-9]*\).*/\1/p' "$VP/acct-01/.expired" 2>/dev/null)"
+{ [ -n "$soft" ] && [ "$soft" -ge $((t0 + 21600)) ] && [ "$soft" -le $((t1 + 21600)) ]; } \
+  && t_ok "verify's org park carries soft_until = now + 6 h" \
+  || t_fail "verify org soft_until" "$(tail -1 "$VP/acct-01/.expired" 2>/dev/null)"
+grep -q '^reason=org-blocked soft_until=[0-9]* marked_at=' "$VP/acct-01/.expired" \
+  && t_ok "verify writes the shim's field order" || t_fail "org park shape" "$(tail -1 "$VP/acct-01/.expired")"
+printf '%s\nreason=org-blocked soft_until=%s marked_at=2026-09-27T20:42:42Z detail=x\n' \
+  "$((vnow - 21000))" "$((vnow + 60))" > "$VP/acct-01/.expired"
+t0="$(date +%s)"
+out="$(vp_verify "$ORG_TEXT")"
+soft="$(sed -n 's/.*soft_until=\([0-9][0-9]*\).*/\1/p' "$VP/acct-01/.expired" 2>/dev/null)"
+epoch="$(head -1 "$VP/acct-01/.expired" 2>/dev/null)"
+{ [ -n "$soft" ] && [ "$soft" -ge $((t0 + 21600)) ] && [ "$epoch" -ge "$t0" ] \
+    && ! grep -q 'marked_at=2026-09-27T20:42:42Z' "$VP/acct-01/.expired"; } \
+  && t_ok "a re-observed org refusal refreshes the park (epoch, marked_at, soft_until)" \
+  || t_fail "org park refresh" "$(cat "$VP/acct-01/.expired" 2>/dev/null | tr '\n' ' ')"
+# A weaker reason still never overwrites an org block that binds...
+out="$(vp_verify "Failed to authenticate. API Error: 401 OAuth access token is invalid.")"
+grep -q 'reason=org-blocked' "$VP/acct-01/.expired" \
+  && t_ok "an auth failure never overwrites an org block in force" \
+  || t_fail "org block outranked" "$(tail -1 "$VP/acct-01/.expired")"
+# ...while one whose soft window has run out binds nothing and outranks nothing.
+printf '%s\nreason=org-blocked soft_until=%s marked_at=2026-09-27T20:42:42Z detail=x\n' \
+  "$((vnow - 30000))" "$((vnow - 10))" > "$VP/acct-01/.expired"
+out="$(vp_verify "Failed to authenticate. API Error: 401 OAuth access token is invalid.")"
+grep -q 'reason=auth-error' "$VP/acct-01/.expired" \
+  && t_ok "a lapsed org block no longer shields the account from an auth park" \
+  || t_fail "lapsed org block" "$(tail -1 "$VP/acct-01/.expired")"
+rm -f "$VP"/acct-*/.expired
+# The 404 model_not_found text is about a model, not the org: no park in verify either.
+out="$(vp_verify "The model claude-nope is not available on your firstParty deployment. Try switching to claude-opus-5, or ask your admin to enable this model.")"
+[ ! -f "$VP/acct-01/.expired" ] && t_ok "verify does not park on 'ask your admin to enable this model'" \
+  || t_fail "verify model 404" "$(tail -1 "$VP/acct-01/.expired")"
+case "$(vp_line acct-01)" in
+  *"ORG BLOCKED"*|*usage-limited*) t_fail "verify model 404 wording" "$(vp_line acct-01)" ;;
+  *) t_ok "a model 404 is neither an org block nor a usage limit" ;;
+esac
+# An org park whose soft_until has passed no longer blocks the account anywhere: the
+# audit (list/expired/status/--json) reads it the way the shim does.
+printf '%s\nreason=org-blocked soft_until=%s marked_at=x detail=x\n' "$((vnow - 30000))" "$((vnow - 10))" \
+  > "$VP/acct-01/.expired"
+printf '%s\nreason=org-blocked soft_until=%s marked_at=x detail=x\n' "$vnow" "$((vnow + 21600))" \
+  > "$VP/acct-02/.expired"
+rows="$(python3 "$REPO_DIR/lib/audit.py" "$VP" "$VP_MACHINE")"
+[ "$(printf '%s\n' "$rows" | awk -F'\t' '$1=="acct-01"{print $4}')" = "ok" ] \
+  && t_ok "a lapsed org park no longer reads blocked in the audit" \
+  || t_fail "lapsed org park audit" "$(printf '%s\n' "$rows" | grep acct-01)"
+[ "$(printf '%s\n' "$rows" | awk -F'\t' '$1=="acct-02"{print $4}')" = "blocked" ] \
+  && t_ok "an org park inside its soft window still reads blocked" \
+  || t_fail "org park audit" "$(printf '%s\n' "$rows" | grep acct-02)"
+out="$(CLAUDE_ACCOUNTS_DIR="$VP" claude-accounts list 2>&1)"
+case "$(printf '%s\n' "$out" | grep '^acct-01 ')" in
+  *ORG-BLOCKED*) t_fail "lapsed org park list" "$(printf '%s\n' "$out" | grep '^acct-01 ')" ;;
+  *) t_ok "list does not flag a lapsed org park" ;;
+esac
+out="$(CLAUDE_ACCOUNTS_DIR="$VP" claude-accounts expired 2>&1)"
+check "expired says when the pool re-tries an org-blocked account" "re-tried by the pool after" "$out"
+rm -f "$WORK/ctl-verifysay"
+unset -f vp_verify vp_line vp_park
+
 # ---- 16e. MCP servers for every account ---------------------------------------------
 # Claude Code keeps MCP servers in the CONFIG DIR, so under the pool a stock `claude mcp
 # add` used to land in ONE random account — appinspire was connected in some sessions
@@ -5470,6 +5695,10 @@ cxlj 99 10 99 > "$CX/acct-01/limits.json"
 cxlj 7 100 100 > "$CX/acct-02/limits.json"
 out="$(codex 2>&1)"
 check "codex: a still-serving limited account beats an exhausted one with more headroom" "CFG=acct-01" "$out"
+out="$(CODEX_MULTIACC_AR_PROBE=1 codex 2>&1)"; rc=$?
+[ "$rc:$out" = "0:pick=acct-01 tier=soft resets_at=$((now+3600))" ] \
+  && t_ok "codex probe: a soft pick carries its own marker's resets_at" \
+  || t_fail "codex probe soft resets_at" "rc=$rc out=$out"
 # The codex-review case (2026-09-04): the exhausted account is the only one INSIDE the
 # session gate; the gate must not resurrect it over a still-serving account outside it.
 printf '%s\nbucket=7d percent=100 marked_at=x reason=limits\n' "$((now+3600))" > "$CX/acct-01/.limited"
@@ -5488,6 +5717,12 @@ printf '%s\nbucket=5h percent=100 marked_at=x reason=limits\n' "$((now+7200))" >
 printf '%s\nbucket=5h percent=100 marked_at=x reason=limits\n' "$((now+600))" > "$CX/acct-02/.limited"
 out="$(codex 2>&1)"
 check "codex: all exhausted: the soonest reset is handed out" "CFG=acct-02" "$out"
+# The probe is the machine channel for the tty-only notice: it names the soonest reset,
+# and its stderr stays empty.
+out="$(CODEX_MULTIACC_AR_PROBE=1 codex 2>"$WORK/cx-probe.err")"; rc=$?
+[ "$rc:$out" = "0:pick=acct-02 tier=hard resets_at=$((now+600))" ] && [ ! -s "$WORK/cx-probe.err" ] \
+  && t_ok "codex probe: all exhausted answers tier=hard resets_at=<soonest reset>, stderr clean" \
+  || t_fail "codex probe hard resets_at" "rc=$rc out=$out err=$(cat "$WORK/cx-probe.err")"
 grep -q "all-exhausted resets_in=" "$CX/selection.log" \
   && t_ok "codex: the all-exhausted pick is logged with its reset" || t_fail "codex all-exhausted log" "no line"
 rm -f "$CX"/acct-*/.limited "$CX"/acct-*/limits.json
@@ -6886,6 +7121,23 @@ out="$(codex-accounts verify 2>&1)"
 check "codex: verify calls out the workspace block" "ORG BLOCKED" "$out"
 grep -q "reason=org-blocked" "$CX/acct-02/.expired" 2>/dev/null \
   && t_ok "codex: verify parks the org-blocked account" || t_fail "codex verify org park" "no marker"
+# ...with bin/codex's 6 h soft_until, in the shim's field order, refreshed when seen again
+t0="$(date +%s)"
+soft="$(sed -n 's/.*soft_until=\([0-9][0-9]*\).*/\1/p' "$CX/acct-02/.expired" 2>/dev/null)"
+{ [ -n "$soft" ] && [ "$soft" -gt $((t0 + 21000)) ] && [ "$soft" -le $((t0 + 21600)) ] \
+    && grep -q '^reason=org-blocked soft_until=[0-9]* marked_at=' "$CX/acct-02/.expired"; } \
+  && t_ok "codex: verify's org park carries soft_until = now + 6 h" \
+  || t_fail "codex verify org soft_until" "$(tail -1 "$CX/acct-02/.expired" 2>/dev/null)"
+printf '%s\nreason=org-blocked soft_until=%s marked_at=2026-09-27T20:42:42Z detail=x\n' \
+  "$((t0 - 21000))" "$((t0 + 60))" > "$CX/acct-02/.expired"
+out="$(codex-accounts verify 2>&1)"
+soft="$(sed -n 's/.*soft_until=\([0-9][0-9]*\).*/\1/p' "$CX/acct-02/.expired" 2>/dev/null)"
+{ [ -n "$soft" ] && [ "$soft" -ge $((t0 + 21600)) ] \
+    && ! grep -q 'marked_at=2026-09-27T20:42:42Z' "$CX/acct-02/.expired"; } \
+  && t_ok "codex: a re-observed workspace block refreshes the park" \
+  || t_fail "codex org park refresh" "$(cat "$CX/acct-02/.expired" 2>/dev/null | tr '\n' ' ')"
+out="$(codex-accounts expired 2>&1)"
+check "codex: expired says when the pool re-tries a blocked account" "re-tried by the pool after" "$out"
 rm -f "$FAKE_CTL2" "$CX/acct-02/.expired"
 
 # ---- C16. audit vocabulary + empty pool ---------------------------------------------

package/tests/test_autoresume.py

@@ -11,6 +11,7 @@ PATH and a fake probe script. Runs under python3.9+.
 
 from __future__ import annotations
 
+import calendar
 import contextlib
 import importlib.util
 import json
@@ -128,6 +129,27 @@ def cx_error(ts, info, message="boom", completed_at=None):
 
 LIMIT_MSG = ("You’ve hit your usage limit. Visit https://chatgpt.com/codex/settings/usage "
              "to purchase more credits or try again at Sep 26th, 2026 12:39 AM.")
+_MONTH_ABBR = ("Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug", "Sep", "Oct", "Nov",
+               "Dec")
+
+
+def limit_msg(epoch):
+    """LIMIT_MSG with its "try again at" date set to ``epoch``, rendered in UTC the way
+    the codex CLI prints it (read it back with TZ=UTC). A walk on the real clock needs this:
+    the classifier ignores a "try again at" that is already past, and a fixed date goes stale
+    (LIMIT_MSG's Sep 26th, 2026 did on that day, which failed the Publish run)."""
+    t = time.gmtime(epoch)
+    day = t.tm_mday
+    nth = "th" if 11 <= day <= 13 else {1: "st", 2: "nd", 3: "rd"}.get(day % 10, "th")
+    return ("You’ve hit your usage limit. Visit https://chatgpt.com/codex/settings/usage "
+            "to purchase more credits or try again at %s %d%s, %d %d:%02d %s."
+            % (_MONTH_ABBR[t.tm_mon - 1], day, nth, t.tm_year, t.tm_hour % 12 or 12,
+               t.tm_min, "AM" if t.tm_hour < 12 else "PM"))
+
+
+def future_reset(now):
+    """A minute-aligned "try again at" three days after ``now``."""
+    return (int(now) // 60 + 3 * 24 * 60) * 60
 
 
 def cx_tokens(ts, primary=None, secondary=None, limit_id="codex", info=None):
@@ -434,6 +456,12 @@ class CodexClassifierTests(unittest.TestCase):
                              1793631600)
             self.assertEqual(ar.parse_try_again("try again at December 3rd, 2026 9:15 AM"),
                              1796289300)
+            self.assertEqual(limit_msg(1790383140), LIMIT_MSG)  # the helper renders it
+            for stamp in ((2026, 10, 1, 12, 5), (2026, 11, 2, 15, 0), (2026, 12, 3, 9, 15),
+                          (2026, 9, 11, 0, 0), (2026, 9, 12, 23, 59), (2026, 9, 13, 12, 0),
+                          (2026, 9, 21, 1, 1), (2026, 9, 22, 13, 30), (2026, 9, 23, 11, 59)):
+                when = calendar.timegm(stamp + (0,))
+                self.assertEqual(ar.parse_try_again(limit_msg(when)), when, limit_msg(when))
         if os.path.exists("/usr/share/zoneinfo/America/New_York"):
             with local_tz("America/New_York"):  # EDT, UTC-4
                 self.assertEqual(ar.parse_try_again(LIMIT_MSG), 1790383140 + 4 * 3600)
@@ -669,7 +697,13 @@ class StateTests(unittest.TestCase):
         self.assertEqual(ar.parse_probe("noise\npick=acct-02 tier=eligible\n"),
                          ("acct-02", "eligible"))
         self.assertEqual(ar.parse_probe("pick= tier=none\n"), ("", "none"))
-        for bad in ("", "pick=acct-02", "pick=../x tier=eligible", "pick=acct-02 tier=great"):
+        # The codex shim appends resets_at=<epoch> to a limited tier; old lines still parse.
+        self.assertEqual(ar.parse_probe("pick=acct-03 tier=hard resets_at=1790000000\n"),
+                         ("acct-03", "hard"))
+        self.assertEqual(ar.parse_probe("pick=acct-03 tier=soft resets_at=1790000000"),
+                         ("acct-03", "soft"))
+        for bad in ("", "pick=acct-02", "pick=../x tier=eligible", "pick=acct-02 tier=great",
+                    "pick=acct-02 tier=hard resets_at", "pick=acct-02 tier=hard x y"):
             self.assertEqual(ar.parse_probe(bad), ("", ""), bad)
         self.assertTrue(ar.probe_allows("quota", "acct-02", "eligible", "acct-01"))
         self.assertFalse(ar.probe_allows("quota", "acct-01", "eligible", "acct-01"))
@@ -1973,16 +2007,17 @@ class CodexWatcherTests(PoolCase):
         return rc, w, r, path
 
     def test_quota_rotates_with_resume_and_the_message_date(self):
+        reset = future_reset(self.t0)  # the message's date, read in the local (UTC) zone
+        msg = limit_msg(reset)
         with local_tz("UTC"):
             rc, w, r, _ = self.run_codex(
                 ["--yolo", "resume", CX_SID], [
                     cx_meta(self.launched - 7200, cwd=str(self.work)),
-                    cx_error(self.launched - 7000, "usage_limit_exceeded", LIMIT_MSG),
+                    cx_error(self.launched - 7000, "usage_limit_exceeded", msg),
                     cx_event(self.t0 - 2, {"type": "task_started"}),
                     cx_tokens(self.t0 - 1, limit_id="premium"),
-                    cx_error(self.t0 - 1, "usage_limit_exceeded", LIMIT_MSG)])
+                    cx_error(self.t0 - 1, "usage_limit_exceeded", msg)])
         self.assertEqual(rc, 0)
-        reset = 1790383140  # Sep 26th, 2026 12:39 AM, read in the local (UTC) zone
         prompt = ar.resume_prompt("quota")
         probe = r.probes[0]
         self.assertEqual(probe["argv"], [self.self_path, "resume", "--yolo", CX_SID, prompt])
@@ -2234,13 +2269,15 @@ class CliTests(PoolCase):
         self.assertEqual(doc["events"][0]["kind"], "verdict")  # no --since: everything counts
 
     def test_classify_codex(self):
+        reset = future_reset(self.t0)
         path = self.tmp / "r.jsonl"
         path.write_text(jl([cx_meta(self.t0), cx_tokens(self.t0, limit_id="premium"),
-                            cx_error(self.t0, {"usage_limit_exceeded": None}, LIMIT_MSG)]))
+                            cx_error(self.t0, {"usage_limit_exceeded": None},
+                                     limit_msg(reset))]))
         doc = json.loads(self.cli("classify", "--provider", "codex", str(path),
                                   env={"TZ": "UTC"}).stdout)
         self.assertEqual(doc["pending"]["class"], "quota")
-        self.assertEqual(doc["pending"]["reset"], 1790383140)
+        self.assertEqual(doc["pending"]["reset"], reset)
         self.assertNotIn("_message", doc["pending"])
         self.assertNotIn("usage limit", json.dumps(doc))