claude-multiacc 2.0.46 → 2.0.47

package/lib/claude_client_error.py

@@ -0,0 +1,81 @@
+#!/usr/bin/env python3
+"""Read attributable Claude client authentication and organization errors from JSONL.
+
+The caller supplies a bounded transcript tail and the session's account claim time.
+Only structured main-thread API error records count; message wording never does.
+"""
+
+from __future__ import annotations
+
+import argparse
+from datetime import datetime
+import json
+import math
+import sys
+
+ERRORS = {"authentication_failed": "auth", "oauth_org_not_allowed": "org-blocked"}
+
+
+def iso_epoch(value):
+    """Return an aware ISO timestamp's epoch, or None when it cannot prove timing."""
+    if not isinstance(value, str) or "T" not in value or any(c.isspace() for c in value):
+        return None
+    try:
+        parsed = datetime.fromisoformat(value.replace("Z", "+00:00"))
+        if parsed.tzinfo is None:
+            return None
+        return parsed.timestamp()
+    except (ValueError, OverflowError, OSError):
+        return None
+
+
+def newest_error(lines, claim, org_cleared=0):
+    """Return the newest org refusal, otherwise auth error, as (slug, ISO timestamp)."""
+    claimed_at = iso_epoch(claim)
+    if claimed_at is None:
+        return None
+    try:
+        cleared_at = float(org_cleared)
+    except (TypeError, ValueError, OverflowError):
+        cleared_at = 0
+    if not math.isfinite(cleared_at):
+        cleared_at = 0
+    latest = {}
+    for line in lines:
+        try:
+            record = json.loads(line)
+        except (ValueError, TypeError, RecursionError):
+            continue
+        if not isinstance(record, dict) or record.get("isSidechain") is True:
+            continue
+        if record.get("type") != "assistant" or record.get("isApiErrorMessage") is not True:
+            continue
+        code = record.get("error")
+        slug = ERRORS.get(code) if isinstance(code, str) else None
+        at = iso_epoch(record.get("timestamp"))
+        if not slug or at is None or at < claimed_at:
+            continue
+        if slug == "org-blocked" and at <= cleared_at:
+            continue
+        if at >= latest.get(slug, (float("-inf"), ""))[0]:
+            latest[slug] = (at, record["timestamp"])
+    for slug in ("org-blocked", "auth"):
+        if slug in latest:
+            return slug, latest[slug][1]
+    return None
+
+
+def main(argv=None):
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--claim", required=True)
+    parser.add_argument("--org-cleared", type=float, default=0)
+    args = parser.parse_args(argv)
+    result = newest_error(sys.stdin, args.claim, args.org_cleared)
+    if result is None:
+        return 1
+    print(*result)
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/lib/common.sh

@@ -507,6 +507,10 @@ keychain_prune() { # $1 = acct dir: drop the non-canonical items once the canoni
 mark_expired() { # mark_expired <acct dir> <reason-slug> [detail]
   local d="$1" slug="$2" detail="${3:-}"
   [ -d "$d" ] || return 0
+  if [ "$MULTIACC_PROVIDER" = "claude" ] && [ "$slug" != "org-blocked" ] \
+      && grep -q 'reason=org-blocked' "$d/.expired" 2>/dev/null; then
+    return 0
+  fi
   {
     epoch_now
     printf 'reason=%s marked_at=%s detail=%s\n' "$slug" "$(ts_utc)" "$detail"
@@ -519,6 +523,13 @@ mark_expired() { # mark_expired <acct dir> <reason-slug> [detail]
 # account is provably alive again, so both the dead-auth marker and any refresh
 # backoff must go, or it would stay parked until the next re-login.
 clear_auth_markers() { # $1 = acct dir, $2 = "keep-token-park" after a LOGIN-only ceremony
+  # A new credential says nothing about organization policy. Only inference verification
+  # can restore a Claude account whose organization disabled Claude Code access.
+  if [ "$MULTIACC_PROVIDER" = "claude" ] \
+      && grep -q 'reason=org-blocked' "$1/.expired" 2>/dev/null; then
+    rm -f "$1/.oauth-refresh.json" 2>/dev/null || true
+    return 0
+  fi
   # A fresh login proves the login; it says nothing about a portable token a real
   # call rejected, so that park outlives it — only a new token (mint / login --token)
   # or a real call through the token lifts it.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-multiacc",
-  "version": "2.0.46",
+  "version": "2.0.47",
   "description": "Unified Claude Code and OpenAI Codex subscription pooling with quota-aware selection.",
   "type": "module",
   "bin": {

package/tests/run-tests.sh

@@ -1032,7 +1032,8 @@ printf '%s' "$HEALTHY_CREDS" > "$ACC/acct-02/.credentials.json"
 auth_sid="aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee"
 mkdir -p "$ACC/acct-01/projects/auth-regression"
 printf '%s %s\n' "$auth_sid" '2020-01-01T00:00:00Z' > "$ACC/acct-01/.sessions-index"
-auth_line='{"timestamp":"2026-08-22T20:27:29.985Z","error":"authentication_failed",'
+auth_line='{"type":"assistant","isApiErrorMessage":true,"timestamp":"2026-08-22T20:27:29.985Z",'
+auth_line="$auth_line\"error\":\"authentication_failed\","
 auth_line="$auth_line\"session_id\":\"$auth_sid\"}"
 printf '%s\n' "$auth_line" \
   > "$ACC/acct-01/projects/auth-regression/$auth_sid.jsonl"
@@ -1124,6 +1125,11 @@ rc=$?
 grep -q "reason=org-blocked" "$ACC/acct-01/.expired" 2>/dev/null \
   && t_ok "org-disabled account is parked as org-blocked" \
   || t_fail "org-block marker" "no reason=org-blocked marker"
+if grep -q 'soft_until=' "$ACC/acct-01/.expired" 2>/dev/null; then
+  t_fail "org-block park is persistent" "marker has a soft expiry"
+else
+  t_ok "org-block park is persistent until access is verified"
+fi
 rm -f "$FAKE_CTL" "$ACC"/acct-*/limits.json
 # it stays out of the pool...
 all2=1
@@ -1155,18 +1161,19 @@ claude >/dev/null 2>&1
 [ ! -f "$ACC/acct-01/.expired" ] && t_ok "a credential park still clears on a newer credential" \
   || t_fail "credential park" "marker survived a fresh credential"
 printf '%s\nreason=org-blocked detail=test\n' "$((now-100))" > "$ACC/acct-01/.expired"
-# `expired` explains it and points at the same fix as any other dead login
+# `expired` explains the organization policy and the inference check that recovers it.
 out="$(claude-accounts expired 2>&1)"
 check "expired labels an org-blocked account" "BLOCKED" "$out"
 check "expired explains the org block" "organization has disabled" "$out"
-check "expired points org blocks at relogin" "relogin acct-01" "$out"
+check "expired points org blocks at an admin" "admin" "$out"
+check "expired points org blocks at verify after access is enabled" "claude-accounts verify" "$out"
 out="$(claude-accounts list 2>&1)"
 check "list flags org-blocked accounts" "ORG-BLOCKED" "$out"
-# relogin targets them like any other dead login
+# Re-login may refresh its credential, but cannot prove the organization enabled access.
 out="$(CLAUDE_MULTIACC_FORCE_TTY=1 FAKE_EMAIL=a@test claude-accounts relogin --yes 2>&1)"
 check "relogin targets org-blocked accounts" "acct-01 login saved" "$out"
-[ ! -f "$ACC/acct-01/.expired" ] && t_ok "a successful re-login clears an org block" \
-  || t_fail "org-block relogin" "marker survived the re-login"
+[ -f "$ACC/acct-01/.expired" ] && t_ok "a successful re-login preserves an org block" \
+  || t_fail "org-block relogin" "credential-only recovery removed the org policy marker"
 rm -f "$ACC/acct-01/.expired"
 # The client's 404 model_not_found ends "…or ask your admin to enable this model". The org
 # vocabulary's bare "ask your admin to enable" matched it, parking a healthy account as
@@ -3237,7 +3244,7 @@ rm -f "$ACC/acct-05/limits.json"
 out="$(CLAUDE_MULTIACC_USAGE_URL="file://$WORK/usage-low.json" claude-accounts limits --force 2>&1)"
 [ -f "$ACC/acct-05/.expired" ] && t_ok "a usage fetch does not unpark an org-blocked account" \
   || t_fail "org-block unpark" "telemetry cleared an org block it cannot observe"
-# ...nor one verify wrote with its soft_until (every org park carries one now)
+# ...nor a legacy org marker carrying the old soft_until field.
 printf '%s\nreason=org-blocked soft_until=%s marked_at=now detail=test\n' "$now" "$(( $(date +%s) + 21600 ))" \
   > "$ACC/acct-05/.expired"
 rm -f "$ACC/acct-05/limits.json"
@@ -3803,9 +3810,8 @@ RACER
     && t_ok "a dead refresh grant never overwrites an org-blocked marker" \
     || t_fail "org block downgraded" "marker is now: $(cat "$SD/acct-01/.expired" 2>/dev/null | tail -1)"
   # The same without the portable token beside it — park_dead_grant never parks an
-  # account its token still serves, so the check above cannot see the guard. A live org
-  # block (no soft_until, or one still ahead) is never overwritten; one whose soft_until
-  # has run out binds nothing and outranks nothing, so the dead grant gets its own park.
+  # account its token still serves, so the check above cannot see the guard. Organization
+  # blocks persist, including old markers whose six-hour soft_until has already passed.
   mv "$SD/acct-01/server.token" "$SD/acct-01/server.token.aside"
   for soft in none "$(( $(date +%s) + 21600 ))" "$(( $(date +%s) - 10 ))"; do
     if [ "$soft" = none ]; then
@@ -3824,12 +3830,11 @@ RACER
     && t_ok "a dead refresh grant (no token beside it) never overwrites an org block" \
     || t_fail "org block downgraded" "$(sed -n 1p "$WORK/lapsed-org.txt")"
   [ "$(sed -n 2p "$WORK/lapsed-org.txt")" = kept ] \
-    && t_ok "a dead refresh grant never overwrites an org block inside its soft window" \
+    && t_ok "a dead refresh grant never overwrites an org block with an old soft window" \
     || t_fail "soft org block downgraded" "$(sed -n 2p "$WORK/lapsed-org.txt")"
-  case "$(sed -n 3p "$WORK/lapsed-org.txt")" in
-    reason=refresh-token-expired*) t_ok "a lapsed org block does not hide a dead refresh grant from its park" ;;
-    *) t_fail "lapsed org block shields a dead grant" "$(sed -n 3p "$WORK/lapsed-org.txt")" ;;
-  esac
+  [ "$(sed -n 3p "$WORK/lapsed-org.txt")" = kept ] \
+    && t_ok "a dead refresh grant never overwrites an org block after its old soft expiry" \
+    || t_fail "old org block downgraded" "$(sed -n 3p "$WORK/lapsed-org.txt")"
   rm -f "$SD/acct-01/.expired" "$SD/acct-01/.credentials.json"
 
   # ---- the >=90% cutoff keeps the TIGHT window --------------------------------
@@ -4451,41 +4456,41 @@ for said in "API Error: Server is temporarily limiting requests (not your usage
 done
 rm -f "$VP"/acct-*/.expired
 
-# The ORG refusal: verify's park carries the shim's 6 h soft_until, and seeing the refusal
-# again refreshes it (a stale stamp would release a still-blocked account early).
+# The ORG refusal persists until a real inference proves access. Seeing it again
+# refreshes the observation and replaces any legacy soft expiry with a persistent park.
 ORG_TEXT="Your organization has disabled Claude subscription access for Claude Code · Use an Anthropic API key instead, or ask your admin to enable access"
 t0="$(date +%s)"
 out="$(vp_verify "$ORG_TEXT")"
 t1="$(date +%s)"
 check "verify calls out the org block" "ORG BLOCKED" "$(vp_line acct-01)"
-soft="$(sed -n 's/.*soft_until=\([0-9][0-9]*\).*/\1/p' "$VP/acct-01/.expired" 2>/dev/null)"
-{ [ -n "$soft" ] && [ "$soft" -ge $((t0 + 21600)) ] && [ "$soft" -le $((t1 + 21600)) ]; } \
-  && t_ok "verify's org park carries soft_until = now + 6 h" \
-  || t_fail "verify org soft_until" "$(tail -1 "$VP/acct-01/.expired" 2>/dev/null)"
-grep -q '^reason=org-blocked soft_until=[0-9]* marked_at=' "$VP/acct-01/.expired" \
+epoch="$(head -1 "$VP/acct-01/.expired" 2>/dev/null)"
+{ [ "$epoch" -ge "$t0" ] && [ "$epoch" -le "$t1" ] \
+    && ! grep -q 'soft_until=' "$VP/acct-01/.expired"; } \
+  && t_ok "verify's org park has no automatic expiry" \
+  || t_fail "verify org persistence" "$(tail -1 "$VP/acct-01/.expired" 2>/dev/null)"
+grep -q '^reason=org-blocked marked_at=' "$VP/acct-01/.expired" \
   && t_ok "verify writes the shim's field order" || t_fail "org park shape" "$(tail -1 "$VP/acct-01/.expired")"
 printf '%s\nreason=org-blocked soft_until=%s marked_at=2026-09-27T20:42:42Z detail=x\n' \
   "$((vnow - 21000))" "$((vnow + 60))" > "$VP/acct-01/.expired"
 t0="$(date +%s)"
 out="$(vp_verify "$ORG_TEXT")"
-soft="$(sed -n 's/.*soft_until=\([0-9][0-9]*\).*/\1/p' "$VP/acct-01/.expired" 2>/dev/null)"
 epoch="$(head -1 "$VP/acct-01/.expired" 2>/dev/null)"
-{ [ -n "$soft" ] && [ "$soft" -ge $((t0 + 21600)) ] && [ "$epoch" -ge "$t0" ] \
+{ [ "$epoch" -ge "$t0" ] && ! grep -q 'soft_until=' "$VP/acct-01/.expired" \
     && ! grep -q 'marked_at=2026-09-27T20:42:42Z' "$VP/acct-01/.expired"; } \
-  && t_ok "a re-observed org refusal refreshes the park (epoch, marked_at, soft_until)" \
+  && t_ok "a re-observed org refusal refreshes the persistent park (epoch, marked_at)" \
   || t_fail "org park refresh" "$(cat "$VP/acct-01/.expired" 2>/dev/null | tr '\n' ' ')"
 # A weaker reason still never overwrites an org block that binds...
 out="$(vp_verify "Failed to authenticate. API Error: 401 OAuth access token is invalid.")"
 grep -q 'reason=org-blocked' "$VP/acct-01/.expired" \
   && t_ok "an auth failure never overwrites an org block in force" \
   || t_fail "org block outranked" "$(tail -1 "$VP/acct-01/.expired")"
-# ...while one whose soft window has run out binds nothing and outranks nothing.
+# ...including an old marker whose soft window already ran out.
 printf '%s\nreason=org-blocked soft_until=%s marked_at=2026-09-27T20:42:42Z detail=x\n' \
   "$((vnow - 30000))" "$((vnow - 10))" > "$VP/acct-01/.expired"
 out="$(vp_verify "Failed to authenticate. API Error: 401 OAuth access token is invalid.")"
-grep -q 'reason=auth-error' "$VP/acct-01/.expired" \
-  && t_ok "a lapsed org block no longer shields the account from an auth park" \
-  || t_fail "lapsed org block" "$(tail -1 "$VP/acct-01/.expired")"
+grep -q 'reason=org-blocked' "$VP/acct-01/.expired" \
+  && t_ok "an org block past its old soft expiry is never replaced by an auth park" \
+  || t_fail "old org block downgraded" "$(tail -1 "$VP/acct-01/.expired")"
 rm -f "$VP"/acct-*/.expired
 # The 404 model_not_found text is about a model, not the org: no park in verify either.
 out="$(vp_verify "The model claude-nope is not available on your firstParty deployment. Try switching to claude-opus-5, or ask your admin to enable this model.")"
@@ -4495,26 +4500,30 @@ case "$(vp_line acct-01)" in
   *"ORG BLOCKED"*|*usage-limited*) t_fail "verify model 404 wording" "$(vp_line acct-01)" ;;
   *) t_ok "a model 404 is neither an org block nor a usage limit" ;;
 esac
-# An org park whose soft_until has passed no longer blocks the account anywhere: the
-# audit (list/expired/status/--json) reads it the way the shim does.
+# An old org park remains blocked after soft_until: the audit (list/expired/status/JSON)
+# agrees with the shim that elapsed time alone never proves access was enabled.
 printf '%s\nreason=org-blocked soft_until=%s marked_at=x detail=x\n' "$((vnow - 30000))" "$((vnow - 10))" \
   > "$VP/acct-01/.expired"
 printf '%s\nreason=org-blocked soft_until=%s marked_at=x detail=x\n' "$vnow" "$((vnow + 21600))" \
   > "$VP/acct-02/.expired"
 rows="$(python3 "$REPO_DIR/lib/audit.py" "$VP" "$VP_MACHINE")"
-[ "$(printf '%s\n' "$rows" | awk -F'\t' '$1=="acct-01"{print $4}')" = "ok" ] \
-  && t_ok "a lapsed org park no longer reads blocked in the audit" \
-  || t_fail "lapsed org park audit" "$(printf '%s\n' "$rows" | grep acct-01)"
+[ "$(printf '%s\n' "$rows" | awk -F'\t' '$1=="acct-01"{print $4}')" = "blocked" ] \
+  && t_ok "an org park past its old soft expiry still reads blocked in the audit" \
+  || t_fail "old org park audit" "$(printf '%s\n' "$rows" | grep acct-01)"
 [ "$(printf '%s\n' "$rows" | awk -F'\t' '$1=="acct-02"{print $4}')" = "blocked" ] \
-  && t_ok "an org park inside its soft window still reads blocked" \
+  && t_ok "an org park with a future old soft expiry still reads blocked" \
   || t_fail "org park audit" "$(printf '%s\n' "$rows" | grep acct-02)"
 out="$(CLAUDE_ACCOUNTS_DIR="$VP" claude-accounts list 2>&1)"
 case "$(printf '%s\n' "$out" | grep '^acct-01 ')" in
-  *ORG-BLOCKED*) t_fail "lapsed org park list" "$(printf '%s\n' "$out" | grep '^acct-01 ')" ;;
-  *) t_ok "list does not flag a lapsed org park" ;;
+  *ORG-BLOCKED*) t_ok "list flags an org park after its old soft expiry" ;;
+  *) t_fail "old org park list" "$(printf '%s\n' "$out" | grep '^acct-01 ')" ;;
 esac
 out="$(CLAUDE_ACCOUNTS_DIR="$VP" claude-accounts expired 2>&1)"
-check "expired says when the pool re-tries an org-blocked account" "re-tried by the pool after" "$out"
+check "expired explains the inference recovery for an org-blocked account" "claude-accounts verify" "$out"
+case "$out" in
+  *"re-tried by the pool after"*) t_fail "org block has no scheduled release" "an automatic retry is advertised" ;;
+  *) t_ok "expired does not advertise an automatic org-block release" ;;
+esac
 rm -f "$WORK/ctl-verifysay"
 unset -f vp_verify vp_line vp_park
 
@@ -9282,6 +9291,18 @@ else
   t_fail "claude portable token identity suite" "see unittest output above"
 fi
 
+if python3 "$REPO_DIR/tests/test_claude_client_error.py"; then
+  t_ok "claude: interactive client error classification suite"
+else
+  t_fail "claude interactive client error suite" "see unittest output above"
+fi
+
+if python3 "$REPO_DIR/tests/test_claude_org_block.py"; then
+  t_ok "claude: persistent organization-block integration suite"
+else
+  t_fail "claude persistent organization-block suite" "see unittest output above"
+fi
+
 # ---- summary ---------------------------------------------------------------------
 echo
 echo "passed: $PASS  failed: $FAIL"

package/tests/test_autoresume.py

@@ -242,7 +242,9 @@ class ClaudeClassifierTests(unittest.TestCase):
             "auth")
         for code in ("oauth_org_not_allowed", "account_on_hold", "billing_error",
                      "verification_required"):
-            self.assertEqual(self.verdict(cc_api_error(self.T, code))["class"], "blocked", code)
+            verdict = self.verdict(cc_api_error(self.T, code))
+            self.assertEqual(verdict["class"], "blocked", code)
+            self.assertEqual(verdict["rtype"], code if code == "oauth_org_not_allowed" else "", code)
 
     def test_everything_else_is_never(self):
         for code in ("invalid_request", "max_output_tokens", "model_not_found",
@@ -597,7 +599,7 @@ class RelaunchFileTests(unittest.TestCase):
             "depth=3", "avoid=acct-01:1790123817", "hist=quota:1790100000,quota:17901",
             "chain=Ab3dEf9h", ""])
 
-    def test_reset_and_rtype_belong_to_a_claude_quota_only(self):
+    def test_quota_fields_stay_empty_for_auth_and_codex_rtype(self):
         kv = ar.parse_kv(ar.format_relaunch(self.fields(verdict={"class": "auth"})),
                          ar.RELAUNCH_KEYS)
         self.assertEqual((kv["class"], kv["reset"], kv["rtype"]), ("auth", "", ""))
@@ -605,6 +607,17 @@ class RelaunchFileTests(unittest.TestCase):
         self.assertEqual((kv["provider"], kv["reset"], kv["rtype"]),
                          ("codex", "1790123817", ""))
 
+    def test_only_claude_organization_refusal_survives_in_relaunch_rtype(self):
+        for provider in ("claude", "codex"):
+            for code in ("oauth_org_not_allowed", "account_on_hold", "billing_error", "verification_required"):
+                with self.subTest(provider=provider, code=code), tempfile.TemporaryDirectory() as tmp:
+                    _, verdict = ar.classify_claude(cc_api_error(1790113018, code))
+                    fields = self.fields(provider=provider, verdict=verdict)
+                    rel, _ = ar.write_relaunch(tmp, "Tok3nTok3nTok3n0", fields, ["--resume", SID])
+                    kv = ar.parse_kv(Path(rel).read_text(), ar.RELAUNCH_KEYS)
+                    rtype = code if provider == "claude" and code == "oauth_org_not_allowed" else ""
+                    self.assertEqual((kv["class"], kv["reset"], kv["rtype"]), ("blocked", "", rtype))
+
     def test_write_is_atomic_private_and_bash_readable(self):
         argv = ["--dangerously-skip-permissions", "--resume", SID,
                 "multi\nline prompt with 'quotes' and é"]

package/tests/test_claude_client_error.py

@@ -0,0 +1,119 @@
+#!/usr/bin/env python3
+"""Structured Claude client error classification, without credentials or inference."""
+
+from __future__ import annotations
+
+import json
+from pathlib import Path
+import subprocess
+import sys
+import unittest
+
+REPO = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(REPO / "lib"))
+import claude_client_error as errors
+
+CLAIM = "2026-09-30T10:30:00.000Z"
+LATER = "2026-09-30T10:30:01.322Z"
+ORG_TEXT = ("Your organization has disabled Claude subscription access for Claude Code · "
+            "Use an Anthropic API key instead, or ask your admin to enable access")
+
+
+def api_record(code="oauth_org_not_allowed", timestamp=LATER, **extra):
+    record = {"parentUuid": "06c84ec0-a9db-4387-b695-a6e0bdf91685", "isSidechain": False,
+              "userType": "external", "cwd": "/sandbox", "sessionId": "sandbox-session",
+              "version": "2.1.285", "gitBranch": "HEAD", "type": "assistant",
+              "uuid": "3a416522-6c97-44cf-adfe-00b44d2dcad5", "timestamp": timestamp,
+              "message": {"id": "sandbox-message", "type": "message", "role": "assistant",
+                          "model": "<synthetic>", "content": [{"type": "text", "text": ORG_TEXT}],
+                          "stop_reason": "stop_sequence", "usage": {"input_tokens": 0, "output_tokens": 0}},
+              "isApiErrorMessage": True, "error": code, "apiErrorStatus": 403}
+    record.update(extra)
+    return record
+
+
+class ClaudeClientErrorTests(unittest.TestCase):
+    def test_authentic_organization_and_authentication_records(self):
+        for code, slug in errors.ERRORS.items():
+            with self.subTest(code=code):
+                self.assertEqual(errors.newest_error([json.dumps(api_record(code))], CLAIM), (slug, LATER))
+        self.assertEqual(errors.newest_error([json.dumps(api_record(timestamp=CLAIM))], CLAIM),
+                         ("org-blocked", CLAIM))
+
+    def test_claim_and_record_timing_must_be_provable(self):
+        invalid = [None, False, 1790764200, "", "invalid", "2026-09-30T10:30:00", "2026-09-30"]
+        for timestamp in invalid + ["2026-09-30T10:29:59.999Z"]:
+            with self.subTest(timestamp=timestamp):
+                self.assertIsNone(errors.newest_error([json.dumps(api_record(timestamp=timestamp))], CLAIM))
+        missing = api_record()
+        del missing["timestamp"]
+        self.assertIsNone(errors.newest_error([json.dumps(missing)], CLAIM))
+        for claim in invalid:
+            with self.subTest(claim=claim):
+                self.assertIsNone(errors.newest_error([json.dumps(api_record())], claim))
+
+    def test_message_text_and_other_api_errors_never_exclude(self):
+        message = {"content": [{"type": "text", "text": ORG_TEXT + " authentication_failed oauth_org_not_allowed"}]}
+        variants = [{"type": "user"}, {"type": "system"}, {"isApiErrorMessage": False},
+                    {"isApiErrorMessage": "true"}, {"isApiErrorMessage": 1}, {"error": None},
+                    {"error": ["oauth_org_not_allowed"]}, {"error": "billing_error"},
+                    {"error": "model_not_found", "apiErrorStatus": 404,
+                     "message": {"content": [{"type": "text", "text": "Ask your admin to enable this model"}]}}]
+        for extra in variants:
+            with self.subTest(extra=extra):
+                record = api_record(message=message)
+                record.update(extra)
+                self.assertIsNone(errors.newest_error([json.dumps(record)], CLAIM))
+        ordinary = api_record(message=message)
+        del ordinary["isApiErrorMessage"]
+        self.assertIsNone(errors.newest_error([json.dumps(ordinary)], CLAIM))
+
+    def test_sidechains_and_malformed_records_are_ignored(self):
+        lines = ["not-json", "{", "[]", "null", "1", '"oauth_org_not_allowed"',
+                 json.dumps(api_record(isSidechain=True))]
+        self.assertIsNone(errors.newest_error(lines, CLAIM))
+        self.assertEqual(errors.newest_error(lines + [json.dumps(api_record())], CLAIM),
+                         ("org-blocked", LATER))
+        without_sidechain = api_record()
+        del without_sidechain["isSidechain"]
+        self.assertEqual(errors.newest_error([json.dumps(without_sidechain)], CLAIM), ("org-blocked", LATER))
+
+    def test_organization_recovery_watermark_does_not_clear_authentication(self):
+        at = errors.iso_epoch(LATER)
+        org = json.dumps(api_record())
+        self.assertIsNone(errors.newest_error([org], CLAIM, at))
+        self.assertIsNone(errors.newest_error([org], CLAIM, at + 1))
+        self.assertEqual(errors.newest_error([org], CLAIM, at - 0.001), ("org-blocked", LATER))
+        auth = json.dumps(api_record("authentication_failed"))
+        self.assertEqual(errors.newest_error([auth], CLAIM, at + 100), ("auth", LATER))
+
+    def test_latest_in_class_wins_and_auth_cannot_downgrade_org_refusal(self):
+        latest = "2026-09-30T13:30:02.000+03:00"
+        for code, slug in errors.ERRORS.items():
+            lines = [json.dumps(api_record(code, latest)), json.dumps(api_record(code)),
+                     json.dumps(api_record(code, None))]
+            with self.subTest(code=code):
+                self.assertEqual(errors.newest_error(lines, CLAIM), (slug, latest))
+                lines.reverse()
+                self.assertEqual(errors.newest_error(lines, CLAIM), (slug, latest))
+        lines = [json.dumps(api_record()), json.dumps(api_record("authentication_failed", latest))]
+        self.assertEqual(errors.newest_error(lines, CLAIM), ("org-blocked", LATER))
+        lines.reverse()
+        self.assertEqual(errors.newest_error(lines, CLAIM), ("org-blocked", LATER))
+        self.assertEqual(errors.newest_error(lines, CLAIM, errors.iso_epoch(LATER)), ("auth", latest))
+        self.assertEqual(errors.newest_error([json.dumps(api_record("authentication_failed", LATER)),
+                                             json.dumps(api_record())], CLAIM), ("org-blocked", LATER))
+
+    def test_cli_returns_one_safe_result_or_silent_failure(self):
+        command = [sys.executable, str(REPO / "lib" / "claude_client_error.py"), "--claim", CLAIM]
+        result = subprocess.run(command, input=json.dumps(api_record()) + "\n", text=True, capture_output=True)
+        self.assertEqual((result.returncode, result.stdout, result.stderr), (0, f"org-blocked {LATER}\n", ""))
+        for args, record in [(["--org-cleared", str(errors.iso_epoch(LATER))], api_record()),
+                             ([], api_record(isSidechain=True)), (["--claim", "invalid"], api_record())]:
+            with self.subTest(args=args):
+                result = subprocess.run(command + args, input=json.dumps(record), text=True, capture_output=True)
+                self.assertEqual((result.returncode, result.stdout, result.stderr), (1, "", ""))
+
+
+if __name__ == "__main__":
+    unittest.main()