claude-multiacc 2.0.49 → 2.0.51

package/lib/selector_policy.py

@@ -5,6 +5,9 @@ from __future__ import annotations
 from datetime import datetime
 from decimal import Decimal, localcontext
 
+from selector_funding import (
+    apply_funding, best_funding_tier, credit_rank, funding_proof, funding_score,
+)
 from selector_primitives import (
     DEFAULT_HEADROOM_BAND,
     DEFAULT_SESSION_GATE,
@@ -119,14 +122,6 @@ def _apply_policy(request: dict, rows: list[dict]) -> tuple[tuple, int]:
     return producer, alternatives
 
 
-def _winner_key(row: dict) -> tuple:
-    descending_headroom = Decimal(row["effective_headroom"] or "-1").copy_negate()
-    return (
-        not row["quota_known"], descending_headroom,
-        row["last_selected_at"] is not None, row["last_selected_at"] or "",
-        row["engine"], row["account_id"], row["runner_id"], row["runner_generation"])
-
-
 def _session_gate(rows: list[dict], gate: Decimal | None) -> list[dict]:
     """The FIRST cut: accounts whose 5h session bucket still has room.
 
@@ -215,27 +210,36 @@ def select(request: object) -> dict:
     duplicate = next((items for items in identities.values() if len(items) > 1), None)
     if duplicate:
         return _error("duplicate_candidate_identity", {"input_ordinals": duplicate})
+    credit_mode = request.get("credit_fallback") is True
+    if credit_mode:
+        apply_funding(rows, request["candidates"], now, request)
     producer, alternatives = _apply_policy(request, rows)
     eligible = [row for row in rows if row["eligible"]]
     if not eligible:
         return _error("no_candidate", {"eligible_count": 0})
+    funded = best_funding_tier(eligible) if credit_mode else eligible
     band, band_text = decimal_value(request.get("headroom_band", DEFAULT_HEADROOM_BAND))
     gate, gate_text = decimal_value(request.get("session_gate", DEFAULT_SESSION_GATE))
     # Two cuts, in this order (operator's 2026-09-03 decision): the session gate says
     # WHO may be considered, the weekly band says which of those count as equally
     # good. "healthy or known" is the gate stepping aside when nobody clears it.
-    known = [row for row in eligible if row["quota_known"]]
+    known = [row for row in funded if row["quota_known"]]
     healthy = _session_gate(known, gate)
     ranked = healthy or known
     floor = _band_floor(ranked, band) if band is not None else None
     if floor is None:
-        # No usable quota anywhere: nothing to band, so keep the plain ordering
-        # (which already ranks unknown-quota rows last and rotates on ties).
-        banded = eligible
-        winner = min(banded, key=_winner_key)
+        # No usable quota anywhere: every eligible row is an unknown peer.
+        # Keep LRU and the request spread instead of preferring a fixed identity.
+        banded = funded
     else:
         banded = [row for row in ranked if Decimal(row["weekly_remaining"]) >= floor]
-        winner = min(banded, key=_band_key(request["reservation_key"]))
+    if credit_mode and funded[0]["funding_tier"] == "credits":
+        # Subscription windows cannot rank credit-funded work. Credit capacity per
+        # identity holder decides, with the same deterministic LRU/spread for ties.
+        best_credit = min(credit_rank(row) for row in funded)
+        banded = [row for row in funded if credit_rank(row) == best_credit]
+        floor, healthy = None, []
+    winner = min(banded, key=_band_key(request["reservation_key"]))
     rows.sort(key=_snapshot_key)
     snapshot = canonical_sha256(rows)
     chosen = dict(zip(("runner_id", "runner_generation", "engine", "account_id"), _row_identity(winner)))
@@ -248,6 +252,8 @@ def select(request: object) -> dict:
         "headroom_band": band_text,
         "session_gate": gate_text,
         "candidate_snapshot_digest": snapshot, "selected_identity": chosen}
+    if credit_mode:
+        digest_input.update(funding_proof(request, winner))
     score_fields = ("quota_known", "weekly_pct", "session_pct", "weekly_remaining",
                     "session_remaining", "effective_headroom", "last_selected_at")
     response = {"schema": SCHEMA, "selector_version": SELECTOR_VERSION, "ok": True, **chosen,
@@ -265,6 +271,9 @@ def select(request: object) -> dict:
                 "session_ok_count": len(healthy),
                 "candidate_snapshot_digest": snapshot,
                 "selection_digest": canonical_sha256(digest_input)}
+    if credit_mode:
+        response.update(funding_proof(request, winner))
+        response["score_basis"].update(funding_score(winner))
     if request["policy"] == "reviewer" and not alternatives and _row_identity(winner) == producer:
         response["fallback_reason"] = "sole_eligible_account"
     return response

package/lib/selector_primitives.py

@@ -39,7 +39,8 @@ REQUEST_KEYS = {
 # headroom_band from its own setting and never sends session_gate, so the gate default
 # below is what every panel launch gets (operator's 2026-09-03 decision: session
 # headroom gates FIRST, then the weekly band picks among the survivors).
-OPTIONAL_REQUEST_KEYS = {"headroom_band", "session_gate"}
+OPTIONAL_REQUEST_KEYS = {"headroom_band", "session_gate", "credit_fallback",
+                         "required_funding_tier", "credit_max_age_seconds"}
 DEFAULT_HEADROOM_BAND = "30"
 DEFAULT_SESSION_GATE = "50"
 POLICIES = {
@@ -144,8 +145,12 @@ def _identity_error(value: object, field: str) -> str | None:
 
 def _candidate_error(value: object, index: int) -> str | None:
     field = f"candidates[{index}]"
-    if not isinstance(value, dict) or set(value) != CANDIDATE_KEYS:
+    from selector_credits import OPTIONAL_CANDIDATE_FIELDS, credit_candidate_error
+    if not isinstance(value, dict) or not CANDIDATE_KEYS <= set(value) \
+            or set(value) - CANDIDATE_KEYS - OPTIONAL_CANDIDATE_FIELDS:
         return field
+    if error := credit_candidate_error(value, field):
+        return error
     for name in ("runner_id", "runner_generation"):
         item = value[name]
         if not isinstance(item, int) or isinstance(item, bool) or not 0 < item <= SAFE_INTEGER:
@@ -186,6 +191,16 @@ def request_error(request: object) -> tuple[str, dict] | None:
     keys = set(request)
     if not REQUEST_KEYS <= keys or keys - REQUEST_KEYS - OPTIONAL_REQUEST_KEYS:
         return "invalid_request", {"field": "$"}
+    if "credit_fallback" in request and not isinstance(request["credit_fallback"], bool):
+        return "invalid_request", {"field": "credit_fallback"}
+    if "required_funding_tier" in request and (not isinstance(request["required_funding_tier"], str)
+            or request["required_funding_tier"] not in {"included", "reserve", "credits"}):
+        return "invalid_request", {"field": "required_funding_tier"}
+    if "required_funding_tier" in request and request.get("credit_fallback") is not True:
+        return "invalid_request", {"field": "required_funding_tier"}
+    age = request.get("credit_max_age_seconds", 900)
+    if isinstance(age, bool) or not isinstance(age, int) or not 30 <= age <= 3600:
+        return "invalid_request", {"field": "credit_max_age_seconds"}
     for knob in ("headroom_band", "session_gate"):
         if knob not in request:
             continue
@@ -224,6 +239,9 @@ def request_error(request: object) -> tuple[str, dict] | None:
     if not isinstance(request["candidates"], list):
         return "invalid_request", {"field": "candidates"}
     for index, value in enumerate(request["candidates"]):
+        if isinstance(value, dict) and set(value) - CANDIDATE_KEYS \
+                and request.get("credit_fallback") is not True:
+            return "invalid_request", {"field": f"candidates[{index}]"}
         if error := _candidate_error(value, index):
             return "invalid_request", {"field": error}
     return None

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-multiacc",
-  "version": "2.0.49",
+  "version": "2.0.51",
   "description": "Unified Claude Code and OpenAI Codex subscription pooling with quota-aware selection.",
   "type": "module",
   "bin": {
@@ -56,7 +56,8 @@
   "scripts": {
     "postinstall": "node scripts/postinstall.mjs",
     "test": "npm run test:core && npm run test:seeding && npm run test:commands",
-    "test:core": "bash tests/run-tests.sh && python3 tests/test_selector.py && python3 tests/test_shim_path.py",
+    "test:core": "bash tests/run-tests.sh && npm run test:selector && python3 tests/test_shim_path.py",
+    "test:selector": "python3 -m unittest discover -s tests -p 'test_selector*.py'",
     "test:seeding": "python3 tests/test_account_seeding.py && python3 tests/test_mcp_registry.py && npm run test:codex-settings",
     "test:codex-settings": "python3 tests/test_codex_config_edit.py && python3 tests/test_codex_settings.py",
     "test:commands": "python3 tests/test_packaged_commands.py"

package/tests/test_codex_reset_credits.py

@@ -0,0 +1,112 @@
+"""Pure contract checks for spendable credit telemetry, separate from earned resets."""
+
+from pathlib import Path
+import sys
+import unittest
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "lib"))
+from codex_credits import collect_credits, credit_view, failed_credits, snapshot_from_usage
+
+NOW = 1791115200
+
+
+def payload(**updates):
+    return {"account_id": "account-test", "credits": {
+        "has_credits": True, "unlimited": False, "balance": "1234.5000"},
+        "rate_limit": {"allowed": False}, "spend_control_reached": False, **updates}
+
+
+class SpendableCreditsTest(unittest.TestCase):
+    def test_provider_balance_and_identity_are_preserved_without_float_rounding(self):
+        raw = payload()
+        raw["credits"]["balance"] = "12345678901234567890.123456789"
+        result = snapshot_from_usage(raw, "account-test", NOW)
+        self.assertEqual(result["balance"], "12345678901234567890.123456789")
+        self.assertEqual(result["account_id"], "account-test")
+        self.assertEqual(result["fetched_at"], "2026-10-04T12:00:00Z")
+        self.assertIs(result["ordinary_usage_allowed"], False)
+        self.assertIs(result["spend_control_reached"], False)
+
+    def test_measured_zero_unlimited_and_unknown_balance_remain_distinct(self):
+        for raw, expected in (({"has_credits": False, "unlimited": False, "balance": "0.00"}, "0"),
+                              ({"has_credits": True, "unlimited": True, "balance": None}, None),
+                              ({"has_credits": True, "unlimited": False}, None)):
+            with self.subTest(raw=raw):
+                result = snapshot_from_usage(payload(credits=raw), "account-test", NOW)
+                self.assertEqual(result["balance"], expected)
+                self.assertEqual(result["unlimited"], raw["unlimited"])
+
+    def test_earned_resets_never_become_a_spendable_balance(self):
+        self.assertIsNone(collect_credits({"rate_limit_reset_credits": {"available_count": 3}},
+                                          "account-test", NOW))
+        self.assertIsNone(collect_credits({"credits": None}, "account-test", NOW))
+
+    def test_malformed_balances_and_truthy_flags_do_not_claim_available_credit(self):
+        for invalid in (True, 12.34, -1, "-1", "NaN", "Infinity", "1e3", "1,000", "9" * 129):
+            with self.subTest(invalid=invalid):
+                raw = payload()
+                raw["credits"]["balance"] = invalid
+                self.assertIsNone(collect_credits(raw, "account-test", NOW))
+        raw = payload()
+        raw["credits"]["has_credits"] = "true"
+        self.assertIsNone(collect_credits(raw, "account-test", NOW))
+
+    def test_response_identity_must_agree_with_authenticated_account(self):
+        previous = snapshot_from_usage(payload(), "account-test", NOW)
+        bad = collect_credits(payload(account_id="other-account"), "account-test", NOW + 10, previous)
+        self.assertEqual(bad["account_id"], "account-test")
+        self.assertEqual(bad["last_error"], "account_mismatch")
+        self.assertEqual(bad["fetched_at"], previous["fetched_at"])
+        no_response_id = snapshot_from_usage(payload(account_id=None), "account-test", NOW)
+        self.assertEqual(no_response_id["account_id"], "account-test")
+
+    def test_failure_preserves_last_observation_then_success_clears_it(self):
+        previous = snapshot_from_usage(payload(), "account-test", NOW)
+        failed = failed_credits(previous, "http_429", NOW + 10)
+        self.assertEqual(failed["balance"], "1234.5")
+        self.assertEqual(failed["fetched_at"], previous["fetched_at"])
+        self.assertTrue(failed["stale"])
+        self.assertEqual(failed["last_error"], "http_429")
+        missing = collect_credits({}, "account-test", NOW + 20, previous)
+        self.assertEqual(missing["last_error"], "missing_credits")
+        recovered = collect_credits(payload(), "account-test", NOW + 30, failed)
+        self.assertNotIn("last_error", recovered)
+        self.assertFalse(credit_view(recovered, NOW + 30)["stale"])
+
+    def test_staleness_uses_credit_timestamp_and_rejects_future_or_invalid_time(self):
+        value = snapshot_from_usage(payload(), "account-test", NOW)
+        self.assertFalse(credit_view(value, NOW + 900)["stale"])
+        self.assertTrue(credit_view(value, NOW + 901)["stale"])
+        self.assertTrue(credit_view(value, NOW - 31)["stale"])
+        self.assertIsNone(credit_view({**value, "fetched_at": "2026-10-04T12:00:00"}, NOW))
+        self.assertIsNone(credit_view({**value, "fetched_at": {}}, NOW))
+
+    def test_admission_facts_are_never_inferred_from_percentages(self):
+        raw = payload(rate_limit={"primary_window": {"used_percent": 0}})
+        snapshot = snapshot_from_usage(raw, "account-test", NOW)
+        self.assertIsNone(snapshot["ordinary_usage_allowed"])
+        raw["spend_control_reached"] = "false"
+        raw["rate_limit_reached_type"] = {"unexpected": "shape"}
+        snapshot = snapshot_from_usage(raw, "account-test", NOW)
+        self.assertIsNone(snapshot["spend_control_reached"])
+        self.assertEqual(snapshot["limit_reached_type"], "unknown")
+
+    def test_documented_raw_and_app_server_nested_admission_fields(self):
+        raw = payload(spend_control={"reached": True},
+                      rate_limit_reached_type={"type": "workspace_member_usage_limit_reached"})
+        raw.pop("spend_control_reached")
+        snapshot = snapshot_from_usage(raw, "account-test", NOW)
+        self.assertTrue(snapshot["spend_control_reached"])
+        self.assertEqual(snapshot["limit_reached_type"], "workspace_member_usage_limit_reached")
+        app_server = {"accountId": "account-test", "ordinaryUsageAllowed": False, "rateLimits": {
+            "credits": {"hasCredits": True, "unlimited": False, "balance": "12.34"},
+            "rateLimitReachedType": "rate_limit_reached", "spendControlReached": False}}
+        snapshot = snapshot_from_usage(app_server, "account-test", NOW)
+        self.assertEqual(snapshot["limit_reached_type"], "rate_limit_reached")
+        self.assertEqual(snapshot["balance"], "12.34")
+        self.assertIs(snapshot["ordinary_usage_allowed"], False)
+        self.assertIs(snapshot["spend_control_reached"], False)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/tests/test_codex_reset_credits_polling.py

@@ -0,0 +1,94 @@
+"""Existing Codex usage polling carries paid balances without extra provider requests."""
+
+import json
+import os
+import subprocess
+import time
+import unittest
+
+import test_codex_reset as fixtures
+
+
+class CreditPollingTest(fixtures.CodexPoolSandbox, unittest.TestCase):
+    def setUp(self):
+        super().setUp()
+        now = int(time.time())
+        self.server.state["usage"] = {
+            "account_id": "account-test", "plan_type": "pro", "rate_limit": {
+                "allowed": False, "limit_reached": True, "primary_window": {
+                    "used_percent": 100, "limit_window_seconds": 604800, "reset_at": now + 86400}},
+            "credits": {"has_credits": True, "unlimited": False, "balance": "61812.4520750000"},
+            "rate_limit_reached_type": {"type": "rate_limit_reached"}, "spend_control": {"reached": False},
+        }
+        self.server.state["credits"] = {"available_count": 2, "credits": []}
+
+    def command(self, *args, auto_reset="0"):
+        base = f"http://127.0.0.1:{self.server.server_port}/wham"
+        env = dict(os.environ, CODEX_ACCOUNTS_ROOT=str(self.pool), CODEX_MULTIACC_NO_SYNC="1",
+                   CODEX_MULTIACC_AUTO_RESET=auto_reset, CODEX_MULTIACC_USAGE_URL=f"{base}/usage",
+                   CLAUDE_MULTIACC_PATH_PROBE="0", PYTHONDONTWRITEBYTECODE="1")
+        for key in ("CODEX_MULTIACC_RESET_CREDITS_URL", "CODEX_MULTIACC_RESET_CONSUME_URL"):
+            env.pop(key, None)
+        result = subprocess.run([fixtures.REPO / "bin/codex-accounts", *args], env=env,
+                                capture_output=True, text=True, timeout=20, check=False)
+        self.assertEqual(result.returncode, 0, result.stderr)
+        return result
+
+    def test_existing_usage_read_reports_both_credit_types_without_more_calls(self):
+        answer = json.loads(self.command("limits", "--force", "--json").stdout)
+        usage = answer["accounts"][0]["usage"]
+        self.assertEqual(usage["credits"]["balance"], "61812.452075")
+        self.assertEqual(usage["credits"]["account_id"], "account-test")
+        self.assertEqual(usage["credits"]["limit_reached_type"], "rate_limit_reached")
+        self.assertIs(usage["credits"]["ordinary_usage_allowed"], False)
+        self.assertEqual(usage["reset_credits_available"], 2)
+        self.assertEqual(self.server.state["usage_gets"], 1)
+        self.assertEqual(self.server.state["credit_gets"], 1)
+        self.assertEqual(self.server.state["posts"], [])
+        self.assertTrue((self.pool / "acct-01/.limited").exists())
+        listed = json.loads(self.command("list", "--json").stdout)
+        self.assertEqual(listed["accounts"][0]["usage"]["credits"]["balance"], "61812.452075")
+        self.assertEqual(self.server.state["usage_gets"], 1)
+
+    def test_missing_credit_read_preserves_previous_amount_as_unusable(self):
+        self.command("limits", "--force", "--quiet")
+        path = self.pool / "acct-01/limits.json"
+        before = json.loads(path.read_text())["credits"]
+        self.server.state["usage"].pop("credits")
+        self.command("limits", "--force", "--quiet")
+        after = json.loads(path.read_text())["credits"]
+        self.assertEqual(after["balance"], before["balance"])
+        self.assertEqual(after["fetched_at"], before["fetched_at"])
+        self.assertEqual(after["last_error"], "missing_credits")
+        self.assertTrue(after["stale"])
+
+    def test_bad_usage_does_not_silently_keep_paid_admission_fresh(self):
+        self.command("limits", "--force", "--quiet")
+        self.server.state["usage"] = []
+        self.command("limits", "--force", "--quiet")
+        stored = json.loads((self.pool / "acct-01/limits.json").read_text())
+        self.assertEqual(stored["credits"]["last_error"], "invalid_usage")
+        self.assertTrue(stored["credits"]["stale"])
+        self.assertEqual(stored["weekly_percent"], 100)
+
+    def test_credit_snapshot_survives_unknown_quota_without_inventing_usage(self):
+        self.server.state["usage"].pop("rate_limit")
+        self.command("limits", "--force", "--quiet")
+        stored = json.loads((self.pool / "acct-01/limits.json").read_text())
+        self.assertTrue(stored["no_data"])
+        self.assertNotIn("weekly_percent", stored)
+        self.assertEqual(stored["credits"]["balance"], "61812.452075")
+        self.assertIsNone(stored["credits"]["ordinary_usage_allowed"])
+
+    def test_earned_reset_requires_new_usage_before_authorizing_paid_fallback(self):
+        self.server.state["responses"] = [(200, {"code": "reset", "windows_reset": 1})]
+        self.command("limits", "--force", "--quiet", auto_reset="1")
+        stored = json.loads((self.pool / "acct-01/limits.json").read_text())
+        self.assertEqual(stored["fetched_at"], 0)
+        self.assertEqual(stored["credits"]["balance"], "61812.452075")
+        self.assertEqual(stored["credits"]["last_error"], "usage_reset_pending")
+        self.assertFalse((self.pool / "acct-01/.limited").exists())
+
+
+if __name__ == "__main__":
+    unittest.main()

package/tests/test_codex_reset_credits_report.py

@@ -0,0 +1,85 @@
+"""Credit report freshness, failure persistence and safe output use isolated files only."""
+
+import json
+from pathlib import Path
+import sys
+import tempfile
+import unittest
+from unittest.mock import patch
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "lib"))
+import report
+from codex_credits import record_read_failure, snapshot_from_usage
+from test_codex_reset_credits import NOW, payload
+
+
+class CreditReportTest(unittest.TestCase):
+    def setUp(self):
+        scratch = tempfile.TemporaryDirectory(prefix="multiacc-credit-report-")
+        self.addCleanup(scratch.cleanup)
+        self.account = Path(scratch.name)
+        self.path = self.account / "limits.json"
+        self.credits = snapshot_from_usage(payload(), "account-test", NOW)
+
+    def test_report_keeps_earned_resets_and_spendable_credits_separate(self):
+        self.path.write_text(json.dumps({"fetched_at": NOW, "credits": self.credits,
+            "reset_credits_available": 2, "reset_credits_fetched_at": NOW, "weekly_percent": 100}))
+        with patch("report.time.time", return_value=NOW):
+            usage = report._usage(str(self.account), 900)
+        self.assertEqual(usage["reset_credits_available"], 2)
+        self.assertEqual(usage["credits"]["balance"], "1234.5")
+        self.assertFalse(usage["credits"]["stale"])
+        self.assertEqual(usage["weekly_percent"], 100)
+
+    def test_fresh_windows_do_not_refresh_an_old_wallet(self):
+        self.path.write_text(json.dumps({"fetched_at": NOW + 901, "credits": self.credits}))
+        with patch("report.time.time", return_value=NOW + 901):
+            usage = report._usage(str(self.account), 900)
+        self.assertFalse(usage["stale"])
+        self.assertTrue(usage["credits"]["stale"])
+        self.assertEqual(usage["credits"]["age_seconds"], 901)
+
+    def test_failed_read_keeps_windows_and_backoff_without_refreshing_balance(self):
+        previous = {"fetched_at": NOW, "credits": self.credits, "weekly_percent": 100,
+                    "retry_after": NOW + 300, "reset_credits_available": 2}
+        record_read_failure(str(self.path), previous, "http_429", NOW + 10)
+        stored = json.loads(self.path.read_text())
+        self.assertEqual(stored["fetched_at"], NOW)
+        self.assertEqual(stored["retry_after"], NOW + 300)
+        self.assertEqual(stored["credits"]["fetched_at"], self.credits["fetched_at"])
+        with patch("report.time.time", return_value=NOW + 10):
+            usage = report._usage(str(self.account), 900)
+        self.assertEqual(usage["credits"]["last_error"], "http_429")
+        self.assertTrue(usage["credits"]["stale"])
+
+    def test_first_failed_read_records_unknown_and_never_zero(self):
+        record_read_failure(str(self.path), {}, "unauthenticated", NOW)
+        usage = report._usage(str(self.account), 900)
+        self.assertNotIn("credits", usage)
+        self.assertEqual(usage["last_error"], "unauthenticated")
+
+    def test_report_never_passes_arbitrary_wallet_fields_or_error_details(self):
+        credits = {**self.credits, "access_token": "must-not-leak", "last_error": "secret-detail"}
+        self.path.write_text(json.dumps({"fetched_at": NOW, "credits": credits}))
+        usage = report._usage(str(self.account), 900)
+        rendered = json.dumps(usage)
+        self.assertNotIn("must-not-leak", rendered)
+        self.assertNotIn("secret-detail", rendered)
+        self.assertEqual(usage["credits"]["last_error"], "usage_read_failed")
+
+    def test_refusal_evidence_belongs_to_the_observed_wallet_identity(self):
+        self.path.write_text(json.dumps({"fetched_at": NOW, "credits": self.credits}))
+        receipt = self.account / ".credit-refused.json"
+        refused = {"credit_blocked_at": self.credits["fetched_at"], "credit_blocked_balance": "1234.5",
+                   "limited_reason": "credits", "account_id": "account-test"}
+        receipt.write_text(json.dumps(refused))
+        usage = report._usage(str(self.account), 900)
+        self.assertEqual(usage["credit_blocked_balance"], "1234.5")
+        self.assertEqual(usage["limited_reason"], "credits")
+        receipt.write_text(json.dumps({**refused, "account_id": "another-account"}))
+        usage = report._usage(str(self.account), 900)
+        self.assertNotIn("credit_blocked_at", usage)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/tests/test_selector_credit_scope.py

@@ -0,0 +1,118 @@
+"""Shared wallets never erase actor permissions, authentication or paid refusals."""
+
+import ast
+import json
+import os
+import time
+import unittest
+
+from test_selector import ROOT, _request
+from test_selector_credits import _paid
+from selector_policy import select
+import test_selector_credit_shim as shim_fixtures
+from codex_credit_selection import record_launch, record_refusal
+
+
+class CreditScopeTests(unittest.TestCase):
+    def test_refusal_follows_same_actor_across_slots_but_not_other_members(self):
+        blocked, peer = _paid(account_id="blocked"), _paid(account_id="peer")
+        blocked.update(credit_actor_email=" Person@Example.COM ", limited_reason="credits",
+                       credit_blocked_at="2026-08-25T08:59:59Z", credit_blocked_balance="61812.452075")
+        peer["credit_actor_email"] = "person@example.com"
+        self.assertFalse(select(_request([blocked, peer], credit_fallback=True))["ok"])
+        peer["credit_actor_email"] = "other@example.com"
+        response = select(_request([blocked, peer], credit_fallback=True))
+        self.assertEqual(response["account_id"], "peer")
+        self.assertEqual(response["score_basis"]["credit_actor_email"], "other@example.com")
+
+    def test_unknown_actor_refusal_remains_with_its_runner_and_slot(self):
+        blocked, peer = _paid(account_id="blocked"), _paid(account_id="peer")
+        blocked.update(limited_reason="credits", credit_blocked_at="2026-08-25T08:59:59Z",
+                       credit_blocked_balance="61812.452075")
+        self.assertEqual(select(_request([blocked, peer], credit_fallback=True))["account_id"], "peer")
+        peer.update(runner_id=4, account_id="blocked")
+        self.assertEqual(select(_request([blocked, peer], credit_fallback=True))["runner_id"], 4)
+
+    def test_peer_wallet_cannot_erase_local_auth_identity_or_read_failure(self):
+        failed, busy = _paid(account_id="failed"), _paid(account_id="busy")
+        busy["reservation_history"]["active_expires_at"] = "2026-08-25T09:05:00Z"
+        for error in ("account_mismatch", "unauthenticated", "http_401", "usage_read_failed"):
+            with self.subTest(error=error):
+                failed["credits"].update(last_error=error, fetched_at="2026-08-25T08:59:00Z")
+                self.assertFalse(select(_request([failed, busy], credit_fallback=True))["ok"])
+
+    def test_peer_wallet_cannot_erase_member_spend_controls_or_share_them(self):
+        blocked, healthy = _paid(account_id="blocked"), _paid(account_id="healthy")
+        blocked["credits"]["spend_control_reached"] = True
+        blocked["credit_actor_email"], healthy["credit_actor_email"] = "a@example.com", "b@example.com"
+        response = select(_request([blocked, healthy], credit_fallback=True))
+        self.assertEqual(response["account_id"], "healthy")
+        healthy["reservation_history"]["active_expires_at"] = "2026-08-25T09:05:00Z"
+        self.assertFalse(select(_request([blocked, healthy], credit_fallback=True))["ok"])
+
+    def test_peer_observation_cannot_end_actor_cooldown_without_new_actor_read(self):
+        blocked, busy = _paid(account_id="blocked"), _paid(account_id="busy")
+        blocked.update(credit_actor_email="a@example.com", limited_reason="credits",
+                       credit_blocked_at="2026-08-25T08:49:00Z", credit_blocked_balance="61812.452075")
+        blocked["credits"]["fetched_at"] = "2026-08-25T08:48:00Z"
+        busy["credit_actor_email"] = "b@example.com"
+        busy["reservation_history"]["active_expires_at"] = "2026-08-25T09:05:00Z"
+        self.assertFalse(select(_request([blocked, busy], credit_fallback=True))["ok"])
+
+    def test_latest_failed_financial_observation_does_not_revive_old_positive_balance(self):
+        old, failed = _paid(account_id="old"), _paid(account_id="failed")
+        old["credits"]["fetched_at"] = "2026-08-25T08:59:00Z"
+        failed["credits"].update(fetched_at="2026-08-25T08:58:00Z", last_error="usage_read_failed",
+                                  last_error_at="2026-08-25T09:00:00Z")
+        self.assertFalse(select(_request([old, failed], credit_fallback=True))["ok"])
+        old["credits"]["fetched_at"] = "2026-08-25T09:00:01Z"
+        self.assertTrue(select(_request([old, failed], credit_fallback=True))["ok"])
+
+    def test_standalone_refusal_is_shared_only_for_same_manifest_actor(self):
+        case = shim_fixtures.CreditShimTests()
+        case.setUp()
+        self.addCleanup(case.doCleanups)
+        first = case.account("acct-01", account_id="workspace-a")
+        case.account("acct-02", account_id="workspace-a")
+        accounts = [{"id": name, "email": "person@example.com"} for name in ("acct-01", "acct-02")]
+        (case.pool / "accounts.json").write_text(json.dumps({"accounts": accounts}))
+        record_launch(first, os.getpid(), time.time())
+        record_refusal(first, os.getpid(), time.time())
+        self.assertIn("tier=hard", case.run_shim().stdout)
+        accounts[1]["email"] = "other@example.com"
+        (case.pool / "accounts.json").write_text(json.dumps({"accounts": accounts}))
+        self.assertIn("pick=acct-02 tier=credits", case.run_shim().stdout)
+        (case.pool / "accounts.json").write_text('{"accounts":[]}')
+        record_launch(first, os.getpid(), time.time())
+        record_refusal(first, os.getpid(), time.time())
+        self.assertIn("pick=acct-02 tier=credits", case.run_shim().stdout)
+
+    def test_ordinary_gate_log_retains_legacy_fields_and_paid_only_appends_funding(self):
+        case = shim_fixtures.CreditShimTests()
+        case.setUp()
+        self.addCleanup(case.doCleanups)
+        case.account("acct-01", weekly=20)
+        result = case.run_shim(False)
+        self.assertEqual(result.returncode, 0, result.stderr)
+        line = (case.pool / "selection.log").read_text().splitlines()[-1].split(" ", 1)[1]
+        self.assertEqual(line, "acct-01 weekly=20% session=10% band=30 band-count=1 "
+                         f"session-gate=50 session-ok=1 pwd={os.getcwd()}")
+        case.account("acct-01")
+        result = case.run_shim(False)
+        self.assertEqual(result.returncode, 0, result.stderr)
+        line = (case.pool / "selection.log").read_text().splitlines()[-1].split(" ", 1)[1]
+        self.assertEqual(line, "acct-01 weekly=100% session=10% band=30 band-count=0 "
+                         f"session-gate=50 session-ok=0 pwd={os.getcwd()} funding=credits")
+
+    def test_new_modules_parse_as_python39_and_defer_union_annotations(self):
+        for name in ("selector_credits", "selector_funding", "selector_credit_scope", "codex_credit_selection",
+                     "codex_credit_local_scope"):
+            source = (ROOT / "lib" / f"{name}.py").read_text()
+            tree = ast.parse(source, feature_version=(3, 9))
+            self.assertTrue(any(isinstance(node, ast.ImportFrom) and node.module == "__future__"
+                                and any(alias.name == "annotations" for alias in node.names)
+                                for node in tree.body), name)
+
+
+if __name__ == "__main__":
+    unittest.main()