claude-multiacc 2.0.50 → 2.0.51

package/bin/codex

@@ -468,7 +468,7 @@ limited_hard_blocked() { # $1 acct dir
   local m="$1/.limited" line="" p
   if [ -f "$m" ]; then
     line="$(sed -n 2p "$m" 2>/dev/null)"
-    case "$line" in *reason=client-rate-limit*|*reason=error-cooldown*) return 0 ;; esac
+    case "$line" in *reason=client-rate-limit*|*reason=error-cooldown*|*reason=credit-refused*) return 0 ;; esac
     p="$(limited_percent_of "$1")"
     if [ "$p" -ge 0 ] 2>/dev/null; then
       [ "$p" -ge 100 ]
@@ -841,7 +841,7 @@ ar_set_hist() { # $1 comma list class:epoch -> AR_HIST: well-formed entries, new
 # rollout line must not pin an account out for days — a peer may have redeemed its reset
 # in the meantime. The scheduled 5-minute limits pass marks the real window properly.
 ar_mark_cooldown() { # $1 acct dir
-  local m="$1/.limited" cur="" until=$((now + 600))
+  local m="$1/.limited" cur="" until=$((now + 600)) reason="${2:-error-cooldown}"
   if [ -f "$m" ]; then
     IFS= read -r cur < "$m" 2>/dev/null || cur=""
     num_ok "$cur" || cur=0
@@ -849,7 +849,7 @@ ar_mark_cooldown() { # $1 acct dir
   fi
   {
     echo "$until"
-    echo "bucket=error-cooldown percent=? marked_at=$(date -u +%Y-%m-%dT%H:%M:%SZ) reason=error-cooldown"
+    echo "bucket=$reason percent=? marked_at=$(date -u +%Y-%m-%dT%H:%M:%SZ) reason=$reason"
   } 2>/dev/null > "$1/.limited.$$" \
     && mv -f "$1/.limited.$$" "$m" 2>/dev/null \
     || rm -f "$1/.limited.$$" 2>/dev/null || true
@@ -896,6 +896,7 @@ ar_token_dead() { # $1 session id (the token's, else the file's) or empty
 ar_relaunch() { # $1 token
   local tok="$1" base f line k v n=0 a age
   local ver="" prov="" cls="" acct="" sid="" cwd="" depth="" avoid="" hist="" chain=""
+  local funding="" funding_pid=""
   ar_word_ok "$tok" 8 || return 1
   base="$AR_DIR/r-$tok"
   f="$base.relaunch"
@@ -919,6 +920,8 @@ ar_relaunch() { # $1 token
       avoid) avoid="$v" ;;
       hist) hist="$v" ;;
       chain) ar_word_ok "$v" 1 && chain="$v" ;;
+      funding_tier) [ "$v" = credits ] && funding=credits ;;
+      funding_pid) num_ok "$v" && funding_pid="$v" ;;
     esac
   done < "$f"
   age=$((now - $(file_mtime "$f")))
@@ -939,7 +942,16 @@ ar_relaunch() { # $1 token
   fi
   if [ -n "$acct" ] && [ -d "$ACC_ROOT/$acct" ]; then
     case "$cls" in
-      quota) ar_mark_cooldown "$ACC_ROOT/$acct" ;;
+      quota)
+        if [ "$funding" = credits ] && [ -n "$funding_pid" ]; then
+          "$MCP_PYBIN" "$SELF_DIR/../lib/codex_credit_selection.py" \
+            refuse "$ACC_ROOT/$acct" "$funding_pid" 2>/dev/null || true
+        fi
+        if [ "$funding" = credits ]; then
+          ar_mark_cooldown "$ACC_ROOT/$acct" credit-refused
+        else
+          ar_mark_cooldown "$ACC_ROOT/$acct"
+        fi ;;
       auth) ar_mark_auth "$ACC_ROOT/$acct" ;;
     esac
   fi
@@ -1073,6 +1085,7 @@ ar_spawn_watcher() { # $1 provider, $2 picked acct dir, then the argv codex is a
     printf 'acct=%s\nacct_dir=%s\ncwd=%s\nlaunched=%s\n' "${pick##*/}" "$pick" "$PWD" "$(date +%s)"
     printf 'tmux=%s\npane=%s\nself=%s\nacc_root=%s\n' "$TMUX" "$TMUX_PANE" "$SELF" "$root"
     printf 'depth=%s\navoid=%s\nhist=%s\nchain=%s\n' "$AR_DEPTH" "$AR_AVOID" "$AR_HIST" "$AR_CHAIN"
+    printf 'funding_tier=%s\n' "$AR_TIER"
   } 2>/dev/null > "$st.tmp" && mv -f "$st.tmp" "$st" 2>/dev/null || {
     rm -f "$st.tmp" "$AR_DIR/$$.argv" 2>/dev/null
     return 1
@@ -1320,6 +1333,12 @@ else
   for d in "${valid[@]}"; do
     if ar_avoided "$d" || limited_hard_blocked "$d"; then hard+=("$d"); else soft+=("$d"); fi
   done
+  paid=()
+  if [ "${#hard[@]}" -gt 0 ]; then
+    for d in "${hard[@]}"; do
+      ar_avoided "$d" || paid+=("$d")
+    done
+  fi
   # A probe only ASKS: the fallback lines below would claim a pick nobody launched.
   if [ "${#soft[@]}" -gt 0 ]; then
     AR_TIER=soft
@@ -1328,6 +1347,15 @@ else
     PICK_STRICT=0
     [ "$AR_PROBE" = "1" ] \
       || sel_log "all-limited fallback=$(basename "$PICK_DIR") weekly=$(fresh_field "$PICK_DIR" weekly_percent || echo '?')%"
+  # Keep the same ChatGPT login. The helper never enables API keys and fails closed
+  # on stale/unknown wallets, spend controls and unresolved paid refusals.
+  elif [ "${CODEX_MULTIACC_CREDITS:-1}" != "0" ] && [ "${#paid[@]}" -gt 0 ] \
+    && credit_pick="$("$MCP_PYBIN" "$SELF_DIR/../lib/codex_credit_selection.py" \
+      pick "$now" "${paid[@]}" 2>/dev/null)" && [ -n "$credit_pick" ]; then
+    AR_TIER=credits
+    PICK_DIR="$credit_pick"
+    PICK_BAND_COUNT=0
+    PICK_GATE_COUNT=0
   else
     AR_TIER=hard
     # Every account is exhausted RIGHT NOW: nothing serves, so hand out the one that
@@ -1384,6 +1412,9 @@ fi
 # CODEX_ACCOUNT pin deliberately does not: a pin is a caller overriding selection,
 # not a turn in the rotation.
 remember_pick "$pick"
+if [ "$AR_TIER" = "credits" ]; then
+  "$MCP_PYBIN" "$SELF_DIR/../lib/codex_credit_selection.py" record "$pick" "$$" 2>/dev/null || true
+fi
 # The picked account carries every registered MCP server before the client starts.
 mcp_ensure "$pick"
 
@@ -1408,9 +1439,12 @@ if [ "$stale" = 1 ] && [ -x "$SELF_DIR/codex-accounts" ]; then
 fi
 
 acct="$(basename "$pick")"
+credit_funding_log=""
+[ "$AR_TIER" = "credits" ] && credit_funding_log=" funding=credits"
 sel_log "$acct weekly=$(fresh_field "$pick" weekly_percent || echo '?')%" \
   "session=$(fresh_field "$pick" session_percent || echo '?')%" \
-  "band=${HEADROOM_BAND} band-count=${PICK_BAND_COUNT} session-gate=${SESSION_GATE_LOG} session-ok=${PICK_GATE_COUNT} pwd=$PWD"
+  "band=${HEADROOM_BAND} band-count=${PICK_BAND_COUNT} session-gate=${SESSION_GATE_LOG}" \
+  "session-ok=${PICK_GATE_COUNT} pwd=$PWD${credit_funding_log}"
 
 export CODEX_SHIM_ACTIVE=1
 
@@ -1427,7 +1461,8 @@ fi
 # A service-spawned pipe that never EOFs must take the plain exec path, or the
 # stdin pre-buffering below would hang the call.
 wants_retry=0
-if [ "${CODEX_SHIM_RETRY:-1}" != "0" ] && [ "${#eligible[@]}" -ge 2 ]; then
+if [ "${CODEX_SHIM_RETRY:-1}" != "0" ] \
+  && { [ "${#eligible[@]}" -ge 2 ] || [ "$AR_TIER" = "credits" ]; }; then
   for a in "$@"; do
     case "$a" in exec|e) wants_retry=1; break ;; esac
   done
@@ -1493,8 +1528,10 @@ fi
 # the pool on its own — the shim's guess must never outlive the evidence for it.
 PARK_AUTH='not (logged|signed) in|authentication (required|failed)|please run `?codex login|run `?codex login`? to|401 unauthorized|token .{0,12}(expired|revoked)|refresh token.{0,20}(expired|invalid|revoked)|invalid_grant|could not refresh'
 PARK_ORG='disabled by (your )?(workspace )?admin|admin (has )?disabled|(workspace|organization) has disabled (codex|chatgpt)|codex.{0,20}disabled for (your|this) (workspace|organization)'
+CREDIT_LIMITPAT='usage_limit_exceeded|usage limit|weekly limit|quota exceeded|insufficient.{0,20}credits'
+CREDIT_LIMITPAT+='|out of credits|credits.{0,20}exhausted|spend.control'
 LIMITPAT='rate[ _-]?limit|usage limit|limit (reached|exceeded)|too many requests|"?429"?|quota exceeded|hit your usage limit'
-ERRPAT="$LIMITPAT|$PARK_AUTH|$PARK_ORG"'|401|403|unauthorized|authentication[_ ]error|invalid[_ ](bearer|token|api key)|token (expired|revoked|invalid)|oauth.*(error|expired|invalid)'
+ERRPAT="$LIMITPAT|$CREDIT_LIMITPAT|$PARK_AUTH|$PARK_ORG"'|401|403|unauthorized|authentication[_ ]error|invalid[_ ](bearer|token|api key)|token (expired|revoked|invalid)|oauth.*(error|expired|invalid)'
 PARK_SOFT_AUTH=3600      # 1h: a mis-parked healthy account is back within the hour
 PARK_SOFT_ORG=21600      # 6h: a workspace policy will not change in minutes
 
@@ -1514,8 +1551,14 @@ while :; do
     # auth word must get the self-expiring cooldown, never a park.
     park_reason=""
     park_soft=0
-    if grep -qiE "$LIMITPAT" "$tmpd/out" "$tmpd/err" 2>/dev/null; then
-      :
+    cooldown_reason=error-cooldown
+    if grep -qiE "$LIMITPAT|$CREDIT_LIMITPAT" "$tmpd/out" "$tmpd/err" 2>/dev/null; then
+      if [ "$AR_TIER" = "credits" ] \
+        && grep -qiE "$CREDIT_LIMITPAT" "$tmpd/out" "$tmpd/err" 2>/dev/null \
+        && ! grep -qiE 'not your usage limit|temporarily limiting|overloaded' "$tmpd/out" "$tmpd/err"; then
+        "$MCP_PYBIN" "$SELF_DIR/../lib/codex_credit_selection.py" refuse "$cur" "$$" 2>/dev/null || true
+        cooldown_reason=credit-refused
+      fi
     elif grep -qiE "$PARK_ORG" "$tmpd/out" "$tmpd/err" 2>/dev/null; then
       park_reason="org-blocked"
       park_detail="a workspace admin has disabled Codex access for the account"
@@ -1536,14 +1579,15 @@ while :; do
     else
       {
         echo $((now + 600))
-        echo "bucket=error-cooldown percent=? marked_at=$(date -u +%Y-%m-%dT%H:%M:%SZ) reason=error-cooldown"
+        echo "bucket=$cooldown_reason percent=? marked_at=$(date -u +%Y-%m-%dT%H:%M:%SZ) reason=$cooldown_reason"
       } 2>/dev/null > "$cur/.limited.$$" \
         && mv -f "$cur/.limited.$$" "$cur/.limited" 2>/dev/null \
         || rm -f "$cur/.limited.$$" 2>/dev/null || true
     fi
     next=""
     n="${#eligible[@]}"
-    start=$((RANDOM % n))
+    start=0
+    [ "$n" -gt 0 ] && start=$((RANDOM % n))
     i=0
     while [ "$i" -lt "$n" ]; do
       c="${eligible[$(((start + i) % n))]}"

package/bin/codex-accounts

@@ -1120,6 +1120,7 @@ root, threshold, quiet, url, force, lib_dir = (sys.argv[1], int(sys.argv[2]),
     sys.argv[3] == '1', sys.argv[4], sys.argv[5] == '1', sys.argv[6])
 sys.path.insert(0, lib_dir)
 from codex_reset_telemetry import refresh_reset_credits
+from codex_credits import collect_credits, failed_credits, record_read_failure
 now = time.time()
 # Don't re-fetch an account whose data is younger than this (endpoint rate-limits).
 MIN_FETCH_INTERVAL = int(os.environ.get('CODEX_MULTIACC_MIN_FETCH', '240'))
@@ -1447,6 +1448,7 @@ for acct in manifest.get('accounts', []):
     if not bearer:
         # Fail OPEN: no usable bearer => leave existing state; never block work on telemetry.
         say(f'{aid}: no fresh bearer (expired or missing chatgpt auth); limits left as-is')
+        record_read_failure(lpath, prev, 'unauthenticated', now)
         continue
     if not account_id:
         account_id = str((jwt_claims(bearer).get('https://api.openai.com/auth') or {})
@@ -1475,16 +1477,15 @@ for acct in manifest.get('accounts', []):
                 wait = min(1800, max(120, int(prev.get('backoff', 60)) * 2))
             prev['retry_after'] = int(now + wait)
             prev['backoff'] = wait
-            tmp = lpath + '.tmp'
-            with open(tmp, 'w') as f:
-                json.dump(prev, f, indent=1)
-            os.replace(tmp, lpath)
             say(f'{aid}: rate limited (429); backing off {wait}s; failing open')
         else:
             say(f'{aid}: usage fetch failed (HTTP {e.code}); failing open')
+        error = f'http_{e.code}' if e.code in (401, 403, 429) else 'http_error'
+        record_read_failure(lpath, prev, error, now)
         continue
     except Exception as e:
         say(f'{aid}: usage fetch failed ({e}); failing open')
+        record_read_failure(lpath, prev, 'usage_read_failed', now)
         continue
 
     def pct_of(v):
@@ -1594,6 +1595,7 @@ for acct in manifest.get('accounts', []):
             walk(data, [])
     except Exception as e:
         say(f'{aid}: unexpected usage payload shape ({e}); failing open')
+        record_read_failure(lpath, prev, 'invalid_usage', now)
         continue
     # Successful fetch: fresh buckets replace everything, backoff state is dropped.
     # THREE selection signals, same reset asymmetry as the claude pool:
@@ -1662,6 +1664,9 @@ for acct in manifest.get('accounts', []):
         b.pop('_reset_known', None)
     out = {'fetched_at': int(now), 'source': 'chatgpt'}
     out.update(reset_view)
+    credits = collect_credits(data, account_id, now, prev.get('credits'))
+    if credits is not None:
+        out['credits'] = credits
     if live:
         out['max_percent'] = maxp
     if weeklyp is not None:
@@ -1694,6 +1699,8 @@ for acct in manifest.get('accounts', []):
         # refreshed account; the next scheduled pass replaces it with server truth.
         out['fetched_at'] = 0
         out['auto_reset'] = reset_result
+        if credits is not None:
+            out['credits'] = failed_credits(credits, 'usage_reset_pending', now)
     tmp = lpath + '.tmp'
     with open(tmp, 'w') as f:
         json.dump(out, f, indent=1)

package/bin/multiacc-select

@@ -11,6 +11,7 @@ from pathlib import Path
 ROOT = Path(__file__).resolve().parents[1]
 sys.path.insert(0, str(ROOT / "lib"))
 
+from selector_credits import CAPABILITY  # noqa: E402
 from selector_policy import select  # noqa: E402
 from selector_primitives import SCHEMA, SELECTOR_VERSION  # noqa: E402
 
@@ -32,7 +33,11 @@ def _strict_object(pairs: list[tuple[str, object]]) -> dict:
 def main() -> int:
     if sys.argv[1:] in (["--help"], ["-h"]):
         print("usage: multiacc-select --request-json - --response-json -\n"
-              "       multiacc-select --version")
+              "       multiacc-select --version|--capabilities")
+        return 0
+    if sys.argv[1:] == ["--capabilities"]:
+        print(json.dumps({"schema": SCHEMA, "selector_version": SELECTOR_VERSION,
+                          "capabilities": [CAPABILITY]}, separators=(",", ":")))
         return 0
     if sys.argv[1:] == ["--version"]:
         print(SELECTOR_VERSION)

package/docs/CODEX.md

@@ -79,6 +79,96 @@ Codex-specific notes:
 - **API-key logins are rejected** — ChatGPT subscription accounts only, matching the
   addon's no-API-keys rule.
 
+## Spendable Codex credits
+
+The existing authenticated usage GET also supplies the account's spendable Codex
+credit wallet. `codex-accounts list/status/limits --json` exposes it as `usage.credits`:
+
+```json
+{
+  "has_credits": true,
+  "unlimited": false,
+  "balance": "61812.452075",
+  "fetched_at": "2026-10-04T12:00:00Z",
+  "account_id": "provider-account-id",
+  "ordinary_usage_allowed": false,
+  "spend_control_reached": false,
+  "limit_reached_type": "rate_limit_reached",
+  "age_seconds": 0,
+  "stale": false
+}
+```
+
+`balance` is a decimal string in provider credit units, never dollars or a percentage.
+A measured `"0"`, unknown `null`, and `unlimited: true` remain distinct. Missing `credits`
+means no usable observation exists. `account_id` binds the read to the authenticated
+provider account; a conflicting response identity invalidates the observation.
+The two admission booleans and limit type preserve explicit provider facts; missing
+values are `null`, never inferred from usage percentages or reset dates.
+
+Wallet freshness uses its own `fetched_at`, independently of the usage windows and
+earned-reset redemption. Failed usage or malformed wallet reads retain the last known
+balance and timestamp with bounded `last_error`/`last_error_at` fields and `stale: true`.
+A successful wallet read clears that failure. Old or future-dated snapshots also become
+stale; the default report horizon is 900 seconds, matching Codex telemetry. An account
+with no previous wallet stays unknown after a failed read. Reports never expose raw
+provider errors, arbitrary response fields or authentication material through this object.
+A successful earned reset marks pre-reset admission facts `usage_reset_pending` until
+the next usage read, so newly refilled included quota is used before paid fallback.
+
+Collection adds no network request, inference, purchase, redemption or billing-mode
+change. Earned `usage.reset_credits_available` remain separate: they reset included
+quota, whereas this wallet funds usage after included quota is exhausted. API-key
+authentication remains unsupported. Consumers must preserve the wallet's timestamp,
+identity, spend-control refusals and failure state when deciding whether credit-backed
+work is possible; `has_credits: true` alone is insufficient.
+The shim's wallet-and-member-bound paid-refusal receipt is reported separately as
+`usage.credit_blocked_at`, `usage.credit_blocked_balance`, and `usage.limited_reason: "credits"`.
+A genuine paid quota refusal writes `.credit-refused.json` and a `.limited` marker with
+`reason=credit-refused`. Authentication and temporary service errors do not create credit
+refusals. Paid work can retry after 600 seconds and a strictly newer successful observation;
+a newer increased balance permits earlier recovery. Zero funds, missing observations and
+provider spending restrictions still deny paid work. Included quota can recover independently.
+Copies of the same member share the receipt; different known members of a workspace do not.
+
+### Credit-aware selection
+
+The standalone shim keeps its session gate and weekly band for included quota, then tries
+its existing 90–99% reserve before spendable credits. It uses the existing ChatGPT login;
+no API-key switch, re-login or billing toggle is needed. `CODEX_MULTIACC_CREDITS=0` disables
+this fallback. Explicit account pins continue to represent the caller's choice.
+
+`multiacc-select --capabilities` advertises `codex_credits_v1`. A caller enables the additive
+policy with `credit_fallback: true` and may request only paid candidates through
+`required_funding_tier: "credits"`. `credit_max_age_seconds` defaults to 900 (accepted range
+30–3600); observations more than 30 seconds in the future cannot authorize spending.
+Optional candidate fields are:
+
+| Field | Meaning |
+| --- | --- |
+| `credits` | The sanitized wallet observation shown above. |
+| `credit_capable` | Caller-confirmed runner support; must be true for paid admission. |
+| `credit_active_holders` | Active holders of this shared wallet, not just the local slot. |
+| `credit_actor_email` | Normalized member email, or null when unknown. |
+| `credit_blocked_at`, `credit_blocked_balance` | The latest actual paid-refusal receipt. |
+| `limited_reason` | `usage` for included quota, `credits` for a paid refusal; other parks remain blocked. |
+
+Successful opted-in responses include `credit_capability`, `funding_tier` (`included`,
+`reserve`, or `credits`) and corresponding score fields. Credit scores carry the decimal
+balance, billing identity, unlimited flag and active holder count; when supplied, the actor
+email is also preserved in the normalized proof and score. New monetary observations replace
+older balances across wallet copies; balances are never summed or merged by maximum.
+Failed monetary observations cannot resurrect an older positive balance. Member permissions,
+actor observation timestamps and local authentication/identity failures remain separate from
+shared finances. Refusals propagate only within the same wallet/member identity; unknown
+actors are handled conservatively. Paid ranking compares balance per active holder, then
+uses the existing deterministic rotation for ties.
+
+The schema and selector version remain `pool-selection.v2` / `2.0.1`. Requests without the
+credit opt-in retain their prior outputs and digests. Extra credit candidate fields without
+opt-in are rejected. Callers must check the capability before issuing paid requests; an old
+runner must never silently execute a decision it cannot enforce.
+
 ```bash
 codex-accounts add                    # sign in a new ChatGPT account (device code —
                                       # open the URL in any browser, enter the code)

package/lib/autoresume.py

@@ -125,9 +125,9 @@ MONTHS = {m: i for i, m in enumerate(
     ("jan", "feb", "mar", "apr", "may", "jun", "jul", "aug", "sep", "oct", "nov", "dec"), 1)}
 
 STATE_KEYS = ("v", "provider", "pid", "ppid", "acct", "acct_dir", "cwd", "launched", "tmux",
-              "pane", "self", "acc_root", "depth", "avoid", "hist", "chain")
+              "pane", "self", "acc_root", "depth", "avoid", "hist", "chain", "funding_tier")
 RELAUNCH_KEYS = ("v", "provider", "class", "acct", "reset", "rtype", "marked", "sid", "cwd",
-                 "depth", "avoid", "hist", "chain")
+                 "depth", "avoid", "hist", "chain", "funding_tier", "funding_pid")
 HIST_KEEP = 32
 
 # ---- knobs --------------------------------------------------------------------------
@@ -806,6 +806,8 @@ def format_relaunch(fields):
     value carrying a line break (or NUL) cannot be written faithfully: ValueError."""
     lines = []
     for key in RELAUNCH_KEYS:
+        if key in ("funding_tier", "funding_pid") and key not in fields:
+            continue
         val = "" if fields.get(key) is None else str(fields[key])
         if any(c in val for c in "\0\n\r"):
             raise ValueError("unwritable value for " + key)
@@ -939,6 +941,7 @@ def load_state(path):
         "tmux": kv["tmux"], "pane": kv["pane"], "self": kv["self"],
         "acc_root": acc_root, "depth": int(depth),
         "avoid": kv.get("avoid", ""), "hist": kv.get("hist", ""), "chain": chain,
+        "funding_tier": "credits" if kv.get("funding_tier") == "credits" else "included",
     }
 
 
@@ -1956,6 +1959,8 @@ class Watcher:
         fields = relaunch_fields(self.provider, verdict, self.acct, self.sid, cwd,
                                  self.st["depth"], avoid,
                                  hist_append(self.st["hist"], cls, now), self.chain)
+        if self.provider == "codex" and self.st.get("funding_tier") == "credits":
+            fields.update(funding_tier="credits", funding_pid=str(self.pid))
         try:
             keys = send_keys_argvs(sock, self.st["pane"], self.provider, token, self.sid,
                                    self.st["self"], self.root)

package/lib/autoresume_probe.py

@@ -31,7 +31,7 @@ def parse_probe(out):
             pick, tier = match.group(1), match.group(2)
     if pick and not ACCT_RE.match(pick):
         return "", ""
-    if tier not in ("eligible", "soft", "hard", "none"):
+    if tier not in ("eligible", "soft", "credits", "hard", "none"):
         return "", ""
     return pick, tier
 
@@ -44,7 +44,7 @@ def probe_allows(cls, pick, tier, current):
     below-threshold requirement; transient/crash may retry anywhere still usable.
     """
     if cls == "quota":
-        return tier in ("eligible", "soft") and bool(pick) and pick != current
+        return tier in ("eligible", "soft", "credits") and bool(pick) and pick != current
     if cls in ROTATE:
         return tier == "eligible" and bool(pick) and pick != current
-    return tier in ("eligible", "soft") and bool(pick)
+    return tier in ("eligible", "soft", "credits") and bool(pick)

package/lib/codex_credit_local_scope.py

@@ -0,0 +1,35 @@
+"""Non-secret local actor identity for shared Codex wallet refusal receipts."""
+
+from __future__ import annotations
+
+import json
+from pathlib import Path
+
+from selector_credit_scope import actor_email, actor_key, actor_refusals
+
+
+def pool_actor(directory: Path) -> str | None:
+    try:
+        document = json.loads((directory.parent / "accounts.json").read_text())
+        accounts = document.get("accounts") or []
+    except (OSError, ValueError, AttributeError):
+        return None
+    for account in accounts:
+        if isinstance(account, dict) and account.get("id") == directory.name:
+            return actor_email({"credit_actor_email": account.get("email")})
+    return None
+
+
+def merged_local_refusals(directories, read_json, refusal_view):
+    candidates = []
+    for item in directories:
+        directory = Path(item)
+        candidates.append({"credits": read_json(directory / "limits.json").get("credits"),
+                           "runner_id": str(directory.parent.resolve()), "account_id": directory.name,
+                           "credit_actor_email": pool_actor(directory), **refusal_view(directory)})
+    return actor_refusals(candidates)
+
+
+def local_refusal_key(directory, credits):
+    return actor_key({"credits": credits, "credit_actor_email": pool_actor(directory),
+                      "runner_id": str(directory.parent.resolve()), "account_id": directory.name})