claude-multiacc 2.0.46 → 2.0.48

package/README.md

@@ -141,17 +141,15 @@ this one is *down*, and handing work to it guarantees a hard failure. Reported s
   Replace it with `claude-accounts login acct-NN --token` and sync. See
   [token identity checks and recovery](docs/claude-token-identity.md).
 - **Org-blocked** (`BLOCKED`) — the account authenticates fine, but the run comes back
-  *"Your organization has disabled Claude subscription access for Claude Code"*. Handled
-  like any other dead login (`claude-accounts relogin` re-issues the grant and normally
-  clears it); if it comes back BLOCKED after a re-login, an admin has to enable Claude
-  Code for that account. Telemetry cannot see this — those accounts' usage endpoint
-  answers normally — so only a real call (`verify`, or a `-p` run) detects it, and the
-  park deliberately survives credential refreshes (a new access token says nothing about
-  an org policy). Every org park carries a 6-hour `soft_until` (a re-observed block
-  renews it), and a `verify` that the **usage limiter** refuses ("You've hit your weekly
-  limit") lifts it at once: the provider checks the org's Claude Code gate before the
-  limiter, so a limit answer proves the org lets the account through (acct-15,
-  2026-09-27: a lapsed subscription paid again stayed BLOCKED until this rule existed).
+  *"Your organization has disabled Claude subscription access for Claude Code"*. The
+  shim also detects `oauth_org_not_allowed` in that account's interactive transcript.
+  An admin must enable Claude Code access, or restore the subscription, then run
+  `claude-accounts verify`. Usage telemetry cannot see this policy, so the account stays
+  excluded until a real verification call proves access. A PASS lifts the park, and so
+  does a `verify` that the **usage limiter** refuses ("You've hit your weekly limit"):
+  the provider checks the org's Claude Code gate before the limiter, so a limit answer
+  proves the org lets the account through (acct-15, 2026-09-27: a lapsed subscription
+  paid again stayed BLOCKED until this rule existed).
   The line still reads `FAIL` — the account cannot work until the limit resets — with a
   `usage-limited` note saying which park it lifted.
 
@@ -161,13 +159,14 @@ Exclusion self-heals, but only against the evidence it was based on: a **credent
 park (dead login) clears as soon as a newer credential lands — a re-login, or a refresh
 by another process — or when a usage fetch authenticates; a **policy** park (org block)
 ignores both, because a fresh access token says nothing about whether the org re-enabled
-Claude Code: only a real call that got past the org gate (a passing `verify`, or one
-refused only by a usage limit), a re-login, or its own 6-hour `soft_until` lifts it.
-Parks the **shim** writes from a single failed run additionally carry a `soft_until`
-stamp and expire on their own — the shim's guess never outlives the evidence for it —
-while parks `claude-accounts` writes from proof of a dead credential (an `invalid_grant`
-refresh response, a real call that failed to authenticate) stay until the account works
-again. If *every* account is unusable the shim still
+Claude Code. Re-login, token replacement and elapsed time also leave a Claude org block
+intact, including old markers whose `soft_until` has passed. Only full
+`claude-accounts verify` proving access, normally or with a usage-limit refusal, lifts it.
+Recovery writes `.client-org-cleared` so old transcript errors cannot recreate the park.
+OAuth-login parks the **shim** guesses from a single failed run carry a `soft_until` stamp and
+expire on their own, while parks `claude-accounts` writes from proof of a dead credential
+(an `invalid_grant` refresh response, a real call that failed to authenticate) stay until
+the account works again. If *every* account is unusable the shim still
 fails open into stock `claude`, and logs why to `selection.log`.
 
 The shim prints nothing, logs `timestamp account cwd` (never prompt text) to
@@ -345,7 +344,13 @@ wrongly parked account is worse than a missed limit:
   hostile or unreadable index entry is skipped; `CLAUDE_MULTIACC_CLIENT_LIMITS=0` turns
   the whole scan off.
 
-The resulting marker is tagged `reason=client-rate-limit` and outlives a clean telemetry
+The same ownership and handover checks detect Claude's interactive
+`oauth_org_not_allowed` refusal and persist an org-blocked `.expired` marker before the
+next selection. It has no automatic expiry; full `claude-accounts verify` must prove
+access after the organization enables it. `.client-org-cleared` suppresses transcript
+errors recorded before that verification.
+
+The resulting usage marker is tagged `reason=client-rate-limit` and outlives a clean telemetry
 pass while its window is still open — first-hand evidence beats a usage payload that
 disagrees. A **weekly** rejection is absolute: nothing — neither a shim invocation nor the
 scheduled `limits` pass — retires it before its reset epoch, since a weekly bucket cannot
@@ -415,10 +420,11 @@ handing the link back would hand the damage back.
 auth- or rate-limit-looking failure the shim retries once on a different account and
 marks the failed one — a **10-minute cooldown** for a rate limit (it heals on its own),
 or an **`.expired`** park for an authentication failure / org block (they do not). The
-park patterns are deliberately narrow and carry a `soft_until` stamp, because this grep
-also sees the model's own answer: a `-p` run that merely *mentions* a 403 must never cost
-an account, and if one slips through it returns to the pool by itself. Output is buffered so a retried call
-never double-emits. Only engages when stdin is finite (tty / regular file / `/dev/null`)
+park patterns are deliberately narrow, because this grep also sees the model's own
+answer: a `-p` run that merely *mentions* a 403 must never cost
+an account. Authentication parks carry a `soft_until`; Claude org blocks persist until
+full verification proves access. Output is buffered so a retried call never double-emits.
+Only engages when stdin is finite (tty / regular file / `/dev/null`)
 and ≥2 accounts are eligible; service-spawned pipes take the plain exec path untouched.
 Interactive sessions are not retried this way. They get auto-resume, described next.
 

package/bin/claude

@@ -356,7 +356,7 @@ ar_relaunch_load() { # $1 token -> 0 with AR_ARGV and the AR_R_*/chain fields se
         class) case "$v" in ''|*[!a-z_]*) ;; *) cls="$v" ;; esac ;;
         acct) case "$v" in acct-*[!0-9]*|acct-) ;; acct-*) acct="$v" ;; esac ;;
         reset) num_ok "$v" && reset="$v" ;;
-        rtype) case "$v" in five_hour|seven_day) rtype="$v" ;; esac ;;
+        rtype) case "$v" in five_hour|seven_day|oauth_org_not_allowed) rtype="$v" ;; esac ;;
         marked) case "$v" in ''|*[!0-9TZ:.+-]*) ;; *) marked="$v" ;; esac ;;
         sid) case "$v" in ''|-*|*[!0-9a-fA-F-]*) ;; *) sid="$v" ;; esac ;;
         cwd) case "$v" in /*) cwd="$v" ;; esac ;;
@@ -422,7 +422,7 @@ ar_token_dead() { # $1 session id (the token's, else the file's) or empty
 # The verdict the watcher saw, written through the SAME writers the transcript scans use
 # (never shortening a longer park), so the old account is out of the pool before this
 # very selection runs — and for every other launch too. Other classes (model-scoped,
-# transient, blocked, crash) leave no marker: the watcher's AVOID list covers them.
+# transient, billing/hold, crash) leave no marker: the watcher's AVOID list covers them.
 ar_relaunch_apply() {
   local d=""
   [ "$AR_LOADED" = 1 ] || return 0
@@ -434,6 +434,10 @@ ar_relaunch_apply() {
           mark_client_limit "$d" "$AR_R_RESET" "$AR_R_RTYPE" "$AR_R_MARKED"
         fi ;;
       auth) mark_client_auth_dead "$d" ;;
+      blocked)
+        if [ "$AR_R_RTYPE" = "oauth_org_not_allowed" ]; then
+          mark_proven_auth_dead "$d" "organization disabled Claude Code subscription access" "org-blocked"
+        fi ;;
     esac
   fi
   # Field 2 is the word `autoresume`, never an account id: lib/report.py and the
@@ -1428,13 +1432,21 @@ client_limit_scan() { # $1 acct dir
   return 1
 }
 
-# A TUI auth failure cannot use the -p retry path because the client owns the terminal.
-# Harvest the same account-owned transcripts used for quota detection so the next launch
-# parks a rejected setup-token instead of selecting it again.
-client_auth_scan() { # $1 acct dir
-  local idx="$1/.sessions-index" ln id claim p line ts ck ak read_n=0 i
+# A TUI rejection cannot use the -p retry path because the client owns the terminal.
+# Read only structured API errors belonging to this account's session claim. The JSON
+# helper runs only when the bounded grep finds an auth or organization error code.
+CLIENT_ERROR_REASON=""
+client_error_scan() { # $1 acct dir; sets CLIENT_ERROR_REASON
+  local idx="$1/.sessions-index" ln id claim p line read_n=0 i cleared=0 parser auth=""
   local ids=() claims=()
+  CLIENT_ERROR_REASON=""
+  { [ -L "$1" ] || [ -L "$1/sessions" ]; } && return 1
+  parser="$SELF_DIR/../lib/claude_client_error.py"
+  [ -f "$parser" ] || return 1
+  [ -L "$idx" ] && return 1
   [ -f "$idx" ] || return 1
+  [ -f "$1/.client-org-cleared" ] \
+    && { IFS= read -r cleared < "$1/.client-org-cleared" 2>/dev/null || cleared=0; }
   while IFS= read -r ln; do
     id="${ln%% *}"; claim=""
     case "$ln" in *' '*) claim="${ln#* }" ;; esac
@@ -1446,24 +1458,31 @@ client_auth_scan() { # $1 acct dir
     sess_transcript "$1" "$id" || continue
     p="$SESS_TRANSCRIPT"
     [ $((now - $(file_mtime "$p"))) -le "$QUOTA_SCAN_MAX_AGE" ] || continue
+    [ -n "$claim" ] || continue
     line="$(tail -c "$QUOTA_SCAN_BYTES" "$p" 2>/dev/null \
-      | LC_ALL=C grep -a '"error"[[:space:]]*:[[:space:]]*"authentication_failed"' | tail -1)"
+      | LC_ALL=C grep -aE '"error"[[:space:]]*:[[:space:]]*"(authentication_failed|oauth_org_not_allowed)"')"
     [ -n "$line" ] || continue
-    [ -n "$claim" ] || continue
-    ts="$(printf '%s' "$line" | LC_ALL=C sed -n 's/.*"timestamp"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p')"
-    ck="$(iso_key "$ts")"; ak="$(iso_key "$claim")"
-    num_ok "$ck" || continue; num_ok "$ak" || continue
-    [ "$ck" -lt "$ak" ] && continue
     claim_conflicted "$1" "$id" "$claim" && continue
-    return 0
+    line="$(printf '%s\n' "$line" | "${CLAUDE_MULTIACC_PYTHON:-python3}" -I "$parser" \
+      --claim "$claim" --org-cleared "$cleared" 2>/dev/null)" || continue
+    case "$line" in
+      org-blocked\ *) CLIENT_ERROR_REASON="org-blocked"; return 0 ;;
+      auth\ *) auth=1 ;;
+    esac
   done
+  [ -n "$auth" ] && { CLIENT_ERROR_REASON="auth"; return 0; }
   return 1
 }
 
 mark_proven_auth_dead() { # $1 acct dir, $2 fixed safe detail, $3 optional reason slug
-  local marked slug="${3:-auth-error}"
+  local marked slug="${3:-auth-error}" soft="${4:-0}" stamp=""
+  if [ "$slug" != "org-blocked" ] \
+      && grep -q 'reason=org-blocked' "$1/.expired" 2>/dev/null; then
+    return 0
+  fi
+  num_ok "$soft" && [ "$soft" -gt 0 ] && stamp="soft_until=$soft "
   marked="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
-  { echo "$now"; echo "reason=$slug marked_at=$marked detail=$2"; } \
+  { echo "$now"; echo "reason=$slug ${stamp}marked_at=$marked detail=$2"; } \
     2>/dev/null > "$1/.expired.$$" && mv -f "$1/.expired.$$" "$1/.expired" 2>/dev/null \
     || rm -f "$1/.expired.$$" 2>/dev/null || true
 }
@@ -1583,12 +1602,13 @@ creds_dead() { # $1 = acct dir
 # a misread never costs an account permanently. Markers written by claude-accounts —
 # a refresh grant that answered "revoked", a real verify call that failed to
 # authenticate — carry no soft_until and stay until the account provably works again.
-# An org block is the exception: verify's carries the shim's 6 h soft_until too, and a
-# verify the usage limiter refused lifts it (the limiter answers only past the org gate).
+# An org block stays until verify proves access, including a usage-limiter refusal.
+# Time and credential refreshes cannot prove the organization's policy changed.
 expired_marked() { # $1 = acct dir
   local m="$1/.expired" mt f soft reason
   [ -f "$m" ] || return 1
   reason="$(LC_ALL=C sed -n 's/.*reason=\([A-Za-z0-9._-][A-Za-z0-9._-]*\).*/\1/p' "$m" 2>/dev/null | head -1)"
+  [ "$reason" = "org-blocked" ] && return 0
   if [ "$reason" = "setup-token-invalid" ]; then
     # A TOKEN-scoped park: it says the portable token is dead and nothing about the
     # login beside it. Only a NEW token heals it — a login refresh rewrites
@@ -1781,8 +1801,13 @@ for d in "$ACC_ROOT"/acct-*; do
   fi
   valid+=("$d")
   sess_index_refresh "$d"
-  if client_auth_scan "$d"; then
-    mark_client_auth_dead "$d"
+  if client_error_scan "$d"; then
+    if [ "$CLIENT_ERROR_REASON" = "org-blocked" ]; then
+      mark_proven_auth_dead "$d" "organization disabled Claude Code subscription access" "org-blocked"
+      sel_log "${d##*/} parked (org-blocked) — client-reported"
+    else
+      mark_client_auth_dead "$d"
+    fi
     valid=("${valid[@]:0:${#valid[@]}-1}")
     expired+=("$d")
     continue
@@ -2281,8 +2306,7 @@ fi
 #                fixes that. "ask your admin to enable ACCESS", never the bare prefix:
 #                the same client ends a 404 model_not_found with "…or ask your admin to
 #                enable this model", which says nothing about the organization.
-# Both shim-written parks carry a soft_until stamp, so even a false positive returns to
-# the pool on its own — the shim's guess must never outlive the evidence for it.
+# Credential guesses carry a soft expiry; an organization refusal needs verified recovery.
 PARK_AUTH='failed to authenticate|oauth (session|token)[a-z ]{0,20}(expired|invalid|revoked)|could not be refreshed|invalid api key|authentication_error|invalid bearer token|please run /login|run /login to'
 PARK_ORG='organization has disabled|subscription access[a-z ]{0,20}disabl|disabled claude subscription|ask your admin to enable access|not authorized to use claude code'
 # A usage limit can be scoped to ONE MODEL: "You've reached your Fable 5 limit.
@@ -2330,7 +2354,6 @@ argv_set_model() { # $1 = model id
 }
 
 PARK_SOFT_AUTH=3600      # 1h: a mis-parked healthy account is back within the hour
-PARK_SOFT_ORG=21600      # 6h: an org policy will not change in minutes
 
 # True when the tail of stdout carries a stream-json result marked is_error. Bounded
 # to the tail because that is where the final object lands, and because a task log
@@ -2387,7 +2410,6 @@ while :; do
     elif grep -qiE "$PARK_ORG" "$tmpd/out" "$tmpd/err" 2>/dev/null; then
       park_reason="org-blocked"
       park_detail="the account's organization has disabled Claude Code subscription access"
-      park_soft=$((now + PARK_SOFT_ORG))
     elif grep -qiE "$PARK_AUTH" "$tmpd/out" "$tmpd/err" 2>/dev/null; then
       if [ -n "$tok" ]; then
         park_reason="setup-token-invalid"
@@ -2406,14 +2428,9 @@ while :; do
     if [ -n "$park_reason" ]; then
       if [ "$park_reason" = "setup-token-invalid" ]; then
         rm -f "$cur/.server-token-verified" 2>/dev/null || true
-        park_line="reason=$park_reason marked_at=$(date -u +%Y-%m-%dT%H:%M:%SZ) detail=$park_detail"
-      else
-        park_line="reason=$park_reason soft_until=$park_soft marked_at=$(date -u +%Y-%m-%dT%H:%M:%SZ) detail=$park_detail"
       fi
-      { echo "$now"; echo "$park_line"; } 2>/dev/null > "$cur/.expired.$$" \
-        && mv -f "$cur/.expired.$$" "$cur/.expired" 2>/dev/null \
-        || rm -f "$cur/.expired.$$" 2>/dev/null || true
-      if [ "$park_reason" = "setup-token-invalid" ]; then
+      mark_proven_auth_dead "$cur" "$park_detail" "$park_reason" "$park_soft"
+      if [ "$park_reason" = "setup-token-invalid" ] || [ "$park_reason" = "org-blocked" ]; then
         sel_log "$(basename "$cur") parked ($park_reason, durable) — see: claude-accounts expired"
       else
         sel_log "$(basename "$cur") parked ($park_reason until $park_soft) — see: claude-accounts expired"

package/bin/claude-accounts

@@ -1401,7 +1401,7 @@ cmd_expired() {
     return 1
   fi
   printf '%s\n' "$rows" | awk -F'\t' '
-    BEGIN { bad = 0; ok = 0; remote = 0; relogin = 0; retoken = 0; unverified = 0 }
+    BEGIN { bad = 0; ok = 0; remote = 0; relogin = 0; retoken = 0; unverified = 0; blocked = 0 }
     NF < 4 || $1 == "" { next }          # never invent an account from a blank line
     $4 == "ok"     { ok++; next }
     $4 == "remote" { remote++; rem = rem sprintf("  %-9s %-28s %s\n", $1, $2, $6); next }
@@ -1419,6 +1419,13 @@ cmd_expired() {
       printf "  %-9s %-28s %-13s fix: %s\n", "", "", "", $7
       next
     }
+    $4 == "blocked" {
+      bad++
+      blocked++
+      printf "  %-9s %-28s %-9s %s\n", $1, $2, $5, $6
+      printf "  %-9s %-28s %-9s fix: %s\n", "", "", "", $7
+      next
+    }
     {
       bad++
       relogin++
@@ -1440,6 +1447,10 @@ cmd_expired() {
         printf "\nReplace invalid portable setup-tokens:\n"
         printf "  claude-accounts login acct-NN --token\n"
       }
+      if (blocked > 0) {
+        printf "\nEnable Claude Code subscription access through the organization admin, then verify:\n"
+        printf "  claude-accounts verify\n"
+      }
       if (relogin > 0) {
         printf "\nRe-authenticate them:\n"
         printf "  claude-accounts relogin            # every account that needs it\n"
@@ -1814,8 +1825,8 @@ def mark_expired(d, slug, detail=''):
     # An org-blocked marker is the strongest statement there is about an account and
     # telemetry can never lift it (see clear_expired). Overwriting its REASON with a
     # weaker one is how it gets lifted by accident: the next successful fetch sees a
-    # reason clear_expired is willing to drop, and the block vanishes. One whose
-    # soft_until has run out binds nothing any more and outranks nothing either.
+    # reason clear_expired is willing to drop, and the block vanishes. Legacy soft
+    # expiry stamps cannot prove organization access was enabled again either.
     try:
         if org_block_in_force(open(mpath, errors='replace').read(), now):
             return
@@ -1841,9 +1852,8 @@ def clear_expired(d):
       un-parked every dead-token account minutes after the shim parked it, and every
       fresh `claude` walked back into the same 401 all day (2026-08-29). Only a NEW
       token (the shim's newer-file rule) or a real call that used the token lifts it.
-    Only a real call lifts the excepted ones — a passing `verify`, or one the usage
-    limiter refused (the limiter answers only past the credential and the org gate) —
-    or a re-login; an org block also lapses at its soft_until (6 h)."""
+    Only inference verification lifts an org block: a passing `verify`, or one the
+    usage limiter refused (the limiter answers only past the credential and org gate)."""
     mpath = os.path.join(d, '.expired')
     try:
         body = open(mpath, errors='replace').read()
@@ -2836,9 +2846,6 @@ LIMIT_ERR = re.compile(
     r"|limit (reached|exceeded)|rate[ _-]?limit|switch to another model", re.I)
 NOT_A_LIMIT = re.compile(
     r'not your usage limit|temporarily limiting|overloaded|\b529\b|high load', re.I)
-# bin/claude PARK_SOFT_ORG: an org policy will not change in minutes, but a verdict that
-# never expires kept a paid-again account out of the pool until a person noticed.
-PARK_SOFT_ORG = 21600
 # EXCULPATORY, tested FIRST — the twin of BROKEN_CLI in bin/codex-accounts, and
 # it matters MORE here: AUTH_ERR above matches a bare `401` or `403`, so any
 # machine fault whose output happens to contain those three digits parks a live
@@ -2862,8 +2869,7 @@ def mark_expired(d, slug, detail=''):
     t = time.time()
     # Same rule as the limits path: an org block outranks every other reason while it
     # binds. Rewriting its reason with a weaker one is how it gets lifted by accident
-    # later. Only the org refusal itself may rewrite it — and does: a re-observed block
-    # is a fresh park with a fresh soft_until, not a stale one left to run out.
+    # later. Only another org refusal may refresh it; access must be verified to lift it.
     if slug != 'org-blocked':
         try:
             if org_block_in_force(open(mpath, errors='replace').read(), t):
@@ -2871,11 +2877,10 @@ def mark_expired(d, slug, detail=''):
         except OSError:
             pass
     # The shim's field order (bin/claude park_line), so every reader parses one shape.
-    soft = f'soft_until={int(t) + PARK_SOFT_ORG} ' if slug == 'org-blocked' else ''
     try:
         with open(mpath + '.tmp', 'w') as f:
             f.write(f'{int(t)}\n')
-            f.write(f"reason={slug} {soft}marked_at="
+            f.write(f"reason={slug} marked_at="
                     f"{time.strftime('%Y-%m-%dT%H:%M:%SZ', time.gmtime(t))} detail={detail}\n")
         os.replace(mpath + '.tmp', mpath)
     except Exception:
@@ -2893,6 +2898,16 @@ def lift_park(d, uses_token):
         marker = open(mpath, errors='replace').read()
     except OSError:
         marker = ''
+    # Record recovery even before a transcript rejection was harvested. Persist the
+    # watermark before removing a park so a failed write cannot cause a re-park loop.
+    try:
+        cleared = os.path.join(d, '.client-org-cleared')
+        temp = cleared + f'.tmp.{os.getpid()}'
+        with open(temp, 'w') as f:
+            f.write(f'{time.time()}\n')
+        os.replace(temp, cleared)
+    except OSError:
+        return ''
     if not uses_token and 'reason=setup-token-invalid' in marker:
         return ''
     try:
@@ -3039,12 +3054,11 @@ for acct in manifest.get('accounts', []):
         elif ORG_ERR.search(out) or ORG_ERR.search(err):
             # Not an auth problem: the account authenticates fine, its organization
             # has simply turned Claude Code subscription access off. Park it — a
-            # re-login changes nothing — and say what actually helps. The park carries
-            # the shim's 6 h soft_until, and a re-observed block refreshes it.
+            # re-login changes nothing. Keep it parked until access is verified again.
             mark_expired(d, 'org-blocked',
                          "the account's organization has disabled Claude Code access")
             hint = (f' — ORG BLOCKED, excluded from the pool; '
-                    f'try: claude-accounts relogin {aid}')
+                    'ask an admin to enable Claude Code subscription access, then run: claude-accounts verify')
         elif AUTH_ERR.search(out) or AUTH_ERR.search(err):
             try:
                 os.remove(os.path.join(d, '.server-token-verified'))

package/docs/ACCOUNT_OPERATIONS.md

@@ -5,8 +5,8 @@
 ```bash
 claude-accounts list      # pool at a glance
 claude-accounts status    # per-account auth health, per-bucket limits incl. Fable, markers, last pick
-claude-accounts expired   # ONLY the accounts that cannot authenticate, and why (exit 1 if any)
-claude-accounts relogin   # sign those back in, one at a time (ids or --all to pick your own)
+claude-accounts expired   # accounts with broken credentials or blocked access, and why (exit 1 if any)
+claude-accounts relogin   # repair expired logins, one at a time (ids or --all to pick your own)
 ```
 
 Every account in the pool is authenticated — `add` cannot register one otherwise.
@@ -24,20 +24,24 @@ claude-accounts expired
 #                                             fix: claude-accounts relogin acct-01
 #   acct-08   dev@example.com       BLOCKED   this account's organization has disabled
 #                                             Claude Code subscription access
-#                                             fix: claude-accounts relogin acct-08
+#                                             fix: enable Claude Code access, then claude-accounts verify
 
 claude-accounts relogin              # re-authenticate everything a sign-in can fix
 claude-accounts relogin acct-01      # or just one
 claude-accounts relogin acct-01 --token   # portable token instead (Mac + server)
 ```
 
-`relogin` covers `BLOCKED` accounts too — a fresh sign-in re-issues the grant and usually
-clears the block. Use `claude-accounts verify` (a real `-p` call per account) to re-test
-one at any time; a PASS clears the park automatically, and so does a call the usage
-limiter refuses (`FAIL … — usage-limited, not a login or org problem; lifted its
+For `BLOCKED`, ask the admin to enable Claude Code access or restore the subscription,
+then run `claude-accounts verify` (a real `-p` call per account). A PASS clears the park
+automatically, and so does a call the usage limiter refuses
+(`FAIL … — usage-limited, not a login or org problem; lifted its
 org-blocked park`): the org's Claude Code gate answers before the limiter, so a limit
-answer proves the org lets the account through. A `BLOCKED` park also lapses on its own
-after 6 hours (`soft_until`), and the pool tries the account again.
+answer proves the org lets the account through. Claude org blocks stay excluded until
+that proof, including old markers with elapsed `soft_until`. Re-login, credential refresh,
+token replacement and clean usage telemetry cannot lift them. Interactive transcript
+refusals are attributed to the account that ran the session; successful verification
+writes `.client-org-cleared` so old errors cannot park it again. `verify --quick` checks
+credentials only and cannot establish organization recovery.
 
 `relogin` runs the same verified sign-in as `login` (it refuses to save a credential for
 the wrong email), one account at a time, and syncs to the server once at the end.
@@ -275,7 +279,7 @@ providers (`lib/report.py`), so a consumer writes one parser:
     "portable": true,
     "credentials": {"oauth": true, "token": true, "oauth_expires_at": "…Z",
                     "oauth_refresh_expires_at": "…Z", "token_minted_at": "…Z",
-                    "token_age_days": 39},
+                    "token_age_days": 39, "org_access_verified_at": 1790765000.125},
     "limited": false, "limit_reset_at": null, "limit_detail": null,
     "usage": {"fetched_at": "…Z", "age_seconds": 41, "source": "oauth",
               // a null percent = that signal had no informative bucket; all three
@@ -302,6 +306,12 @@ A consumer that only distinguishes *usable / parked / needs-a-human* can read
 without the limit overlay. `limited` follows the shim's marker rule exactly — a marker
 whose reset time has passed does not count, an unreadable one does.
 
+Claude's optional `credentials.org_access_verified_at` is a Unix timestamp from the
+last real verification that passed the organisation access gate (a successful inference
+or a genuine usage-limit refusal). Missing or invalid proof is omitted. Consumers can
+use newer proof to lift an older organisation hold; a later refusal still keeps the
+account blocked. Usage telemetry, login and token verification alone are not recovery proof.
+
 A percent field is **null** when that signal had no informative bucket to aggregate. The
 writers keep the signals separate: `weekly_percent` comes from informative weekly buckets,
 `session_percent` from informative session ones, and each is omitted on its own when its

package/docs/AUTORESUME.md

@@ -180,11 +180,18 @@ The prompt is submitted automatically:
 | quota | `rate_limit`, `quotaLimits.status: rejected`, `rateLimitType` `five_hour` / `seven_day` | `.limited` `client:<type>` until `resetsAt`, the marker the transcript scan writes | until that reset |
 | model | `rate_limit` for any other limit type (a per-model weekly), "reached your … limit" / "switch to another model", `model_requires_usage_credits` | nothing: the limit covers one model | 5 h |
 | auth | `authentication_failed` | `.expired`, the shim's client-reported auth park | 1 h |
-| blocked | `oauth_org_not_allowed`, `account_on_hold`, `billing_error`, `verification_required` | nothing: one transcript record only makes this chain avoid it | 6 h |
+| blocked | `oauth_org_not_allowed` | persistent `.expired` `org-blocked` park | 6 h in this chain |
+| blocked | `account_on_hold`, `billing_error`, `verification_required` | nothing: only this chain avoids it | 6 h |
 | transient | `overloaded`, `server_error`, `unknown`, any other `rate_limit` | nothing | none, so the same account may continue |
 | crash | the process ended on its own after ≥ 60 s, leaving its session registry behind | nothing | none, so normal selection applies |
 | never | anything else (`invalid_request`, `max_output_tokens`, `model_not_found`, …) | nothing | not restarted; logged once |
 
+An organization refusal carries `rtype=oauth_org_not_allowed` into the relaunch file,
+so the shim parks the old account even if its earlier session-index capture missed it.
+An admin must enable access, then full `claude-accounts verify` must prove it; a PASS
+or a usage-limit refusal lifts the park and records `.client-org-cleared`. Billing,
+hold and verification errors retain their existing chain avoidance without an org park.
+
 **Codex**, from `task_complete` events' `error.codex_error_info`:
 
 | Class | `codex_error_info` | Old account | Avoided for |

package/docs/VERIFICATION.md

@@ -55,8 +55,11 @@ repointed via `CLAUDE_BIN=/usr/local/bin/claude` and restarted healthy.
   access for Claude Code"), e.g. while a lapsed subscription was unpaid. Run
   `claude-accounts verify`: a PASS lifts it, and so does a refusal from the usage limiter
   (`FAIL … — usage-limited, not a login or org problem; lifted its org-blocked park`),
-  because the provider answers the org gate before the limiter. Without either, the park
-  lapses after its 6-hour `soft_until` and the pool tries the account again. The 404
+  because the provider answers the org gate before the limiter. Until full verification
+  proves access, the account stays excluded even after re-login, token replacement,
+  clean usage telemetry or an old marker's `soft_until`. `verify --quick` cannot lift it.
+  Interactive `oauth_org_not_allowed` transcript errors also create this park;
+  verification records `.client-org-cleared` to prevent old errors from restoring it. The 404
   "…or ask your admin to enable this model" is about a model, never an org block.
 - **A session restarted itself, or did not** — that is [auto-resume](AUTORESUME.md).
   `grep autoresume ~/.claude-accounts/selection.log` shows each step: `hold` means no

package/lib/audit.py

@@ -8,8 +8,7 @@ States:
   token-invalid  a portable setup-token was rejected — needs a new setup-token, not a login
   blocked  authenticates, but its organization has disabled Claude Code subscription
            access — a re-login cannot fix it, so it needs an admin (or removal); a
-           park with a soft_until (every one written now: 6 h) lapses on its own
-           and the pool re-tries the account
+           park stays until a real verification call proves access was enabled again
   locked   the OAuth login is in the macOS Keychain and THIS session cannot open it
            (ssh/tmux/background) — it works from the Mac's own GUI session, so it is
            neither dead nor missing; just not usable from here
@@ -82,30 +81,24 @@ def marker_soft_until(detail):
 
 
 def org_block_in_force(body, now=None):
-    """True when a marker is an org-blocked park that still binds — no soft_until, or
-    one still ahead (expired_marked below and bin/claude's reading of the same line).
-    The writers use it to keep a weaker reason from overwriting a live org block; a
-    block whose soft window has run out no longer outranks anything."""
-    now = time.time() if now is None else now
-    if marker_slug(body) != 'org-blocked':
-        return False
-    soft = marker_soft_until(body)
-    return soft is None or soft > now
+    """Organization policy outlives credentials and legacy soft expiry stamps."""
+    return marker_slug(body) == 'org-blocked'
 
 
 def expired_marked(d, now=None):
     """True when <d>/.expired is still in force. Mirrors the shim exactly:
     a CREDENTIAL-scoped park clears as soon as a newer credential lands (re-login, or a
     refresh by another process); a POLICY park (org-blocked) does not, because a token
-    refresh says nothing about whether the org re-enabled Claude Code. Either kind also
-    expires at its own soft_until when it carries one — every shim park, and every
-    org-blocked park (the shim's and verify's alike carry six hours)."""
+    refresh says nothing about whether the org re-enabled Claude Code. Only credential
+    parks expire at their soft_until; legacy org expiry stamps are ignored."""
     now = time.time() if now is None else now
     mpath = os.path.join(d, '.expired')
     if not os.path.isfile(mpath):
         return False
     detail = marker_reason(mpath)
     slug = marker_slug(detail)
+    if slug == 'org-blocked':
+        return True
     if slug == 'setup-token-invalid':
         # A TOKEN park heals only when a NEW token lands (bin/claude expired_marked):
         # a login refresh rewriting .credentials.json or the Keychain item says
@@ -252,11 +245,7 @@ def _fix_for(state, aid):
     if state == 'token-invalid':
         return f'claude-accounts login {aid} --token'
     if state == 'blocked':
-        # A fresh sign-in re-issues the grant and in practice clears this, so it is
-        # handled like any other dead login. If it comes back BLOCKED after a re-login,
-        # the org really has Claude Code switched off and an admin has to enable it.
-        return (f'claude-accounts relogin {aid}   '
-                f'(if it stays BLOCKED, an admin must enable Claude Code for it)')
+        return 'ask an admin to enable Claude Code subscription access, then run: claude-accounts verify'
     if state in ('expired', 'missing'):
         return f'claude-accounts relogin {aid}'
     if state == 'locked':
@@ -309,13 +298,6 @@ def audit_account(root, acct, now=None, machine=None, require_verified_token=Fal
             row['state'] = 'blocked'
             row['reason'] = ('this account\'s organization has disabled Claude Code '
                              'subscription access')
-            soft = marker_soft_until(detail)
-            if soft is not None:
-                # When the pool gives it another real call on its own (the park's
-                # soft_until). A passing verify, one refused only by a usage limit, or
-                # a re-login lifts it sooner.
-                row['reason'] += time.strftime(
-                    '; re-tried by the pool after %Y-%m-%d %H:%M UTC', time.gmtime(soft))
         elif slug == 'setup-token-invalid':
             login = oauth_login(d, now)
             if login['state'] == 'ok':

package/lib/autoresume.py

@@ -440,7 +440,8 @@ def classify_claude(rec, prefixes=(PROMPT_PREFIX,)):
     if code == "authentication_failed":
         return ("error", _verdict("auth", code, at))
     if code in CLAUDE_BLOCKED:
-        return ("error", _verdict("blocked", code, at))
+        rtype = code if code == "oauth_org_not_allowed" else ""
+        return ("error", _verdict("blocked", code, at, rtype=rtype))
     # invalid_request, max_output_tokens, model_not_found, ...: another account would
     # fail the same way, so it is logged once and left alone.
     return ("never", code or "?")
@@ -873,15 +874,16 @@ def remove_quietly(*paths):
 
 
 def relaunch_fields(provider, verdict, acct, sid, cwd, depth, avoid, hist, chain):
-    """The relaunch file's fields for one verdict. reset/rtype/marked only mean something
-    to the shim for a quota verdict (claude marks ``client:<rtype>`` until ``reset``;
-    codex writes its fixed cooldown)."""
+    """The relaunch fields for a verdict. Claude quota carries its bucket and reset;
+    its organization refusal carries only the known error code in rtype. Codex quota
+    uses its fixed cooldown."""
     cls = verdict["class"]
     quota = cls == "quota"
+    org_block = cls == "blocked" and verdict.get("rtype") == "oauth_org_not_allowed"
     return {
         "v": "1", "provider": provider, "class": cls, "acct": acct,
         "reset": str(int(verdict["reset"])) if quota and verdict.get("reset") else "",
-        "rtype": verdict.get("rtype", "") if quota and provider == "claude" else "",
+        "rtype": verdict.get("rtype", "") if (quota or org_block) and provider == "claude" else "",
         "marked": verdict.get("marked") or "",
         "sid": sid, "cwd": cwd, "depth": str(int(depth) + 1), "avoid": avoid,
         "hist": hist, "chain": chain,