claude-multiacc 2.0.50 → 2.0.52

package/tests/test_codex_reset_credits_polling.py

@@ -0,0 +1,151 @@
+"""Existing Codex usage polling carries paid balances without extra provider requests."""
+
+import json
+from datetime import datetime
+import os
+import subprocess
+import time
+import unittest
+from unittest.mock import patch
+
+import test_codex_reset as fixtures
+
+
+class CreditPollingTest(fixtures.CodexPoolSandbox, unittest.TestCase):
+    def setUp(self):
+        super().setUp()
+        now = int(time.time())
+        self.server.state["usage"] = {
+            "account_id": "account-test", "plan_type": "pro", "rate_limit": {
+                "allowed": False, "limit_reached": True, "primary_window": {
+                    "used_percent": 100, "limit_window_seconds": 604800, "reset_at": now + 86400}},
+            "credits": {"has_credits": True, "unlimited": False, "balance": "61812.4520750000"},
+            "rate_limit_reached_type": {"type": "rate_limit_reached"}, "spend_control": {"reached": False},
+        }
+        self.server.state["credits"] = {"available_count": 2, "credits": []}
+
+    def command(self, *args, auto_reset="0"):
+        base = f"http://127.0.0.1:{self.server.server_port}/wham"
+        env = dict(os.environ, CODEX_ACCOUNTS_ROOT=str(self.pool), CODEX_MULTIACC_NO_SYNC="1",
+                   CODEX_MULTIACC_AUTO_RESET=auto_reset, CODEX_MULTIACC_USAGE_URL=f"{base}/usage",
+                   CLAUDE_MULTIACC_PATH_PROBE="0", PYTHONDONTWRITEBYTECODE="1")
+        for key in ("CODEX_MULTIACC_RESET_CREDITS_URL", "CODEX_MULTIACC_RESET_CONSUME_URL"):
+            env.pop(key, None)
+        result = subprocess.run([fixtures.REPO / "bin/codex-accounts", *args], env=env,
+                                capture_output=True, text=True, timeout=20, check=False)
+        self.assertEqual(result.returncode, 0, result.stderr)
+        return result
+
+    def test_existing_usage_read_reports_both_credit_types_without_more_calls(self):
+        answer = json.loads(self.command("limits", "--force", "--json").stdout)
+        usage = answer["accounts"][0]["usage"]
+        self.assertEqual(usage["credits"]["balance"], "61812.452075")
+        self.assertEqual(usage["credits"]["account_id"], "account-test")
+        self.assertEqual(usage["credits"]["limit_reached_type"], "rate_limit_reached")
+        self.assertIs(usage["credits"]["ordinary_usage_allowed"], False)
+        self.assertEqual(usage["reset_credits_available"], 2)
+        self.assertEqual(self.server.state["usage_gets"], 1)
+        self.assertEqual(self.server.state["credit_gets"], 1)
+        self.assertEqual(self.server.state["posts"], [])
+        self.assertTrue((self.pool / "acct-01/.limited").exists())
+        listed = json.loads(self.command("list", "--json").stdout)
+        self.assertEqual(listed["accounts"][0]["usage"]["credits"]["balance"], "61812.452075")
+        self.assertEqual(self.server.state["usage_gets"], 1)
+
+    def test_missing_credit_read_preserves_previous_amount_and_reports_staleness(self):
+        self.command("limits", "--force", "--quiet")
+        path = self.pool / "acct-01/limits.json"
+        before = json.loads(path.read_text())["credits"]
+        self.server.state["usage"].pop("credits")
+        self.command("limits", "--force", "--quiet")
+        after = json.loads(path.read_text())["credits"]
+        self.assertEqual(after["balance"], before["balance"])
+        self.assertEqual(after["fetched_at"], before["fetched_at"])
+        self.assertEqual(after["last_error"], "missing_credits")
+        self.assertTrue(after["stale"])
+
+    def test_bad_usage_does_not_silently_keep_paid_admission_fresh(self):
+        self.command("limits", "--force", "--quiet")
+        self.server.state["usage"] = []
+        self.command("limits", "--force", "--quiet")
+        stored = json.loads((self.pool / "acct-01/limits.json").read_text())
+        self.assertEqual(stored["credits"]["last_error"], "invalid_usage")
+        self.assertTrue(stored["credits"]["stale"])
+        self.assertEqual(stored["weekly_percent"], 100)
+
+    def test_credit_snapshot_survives_unknown_quota_without_inventing_usage(self):
+        self.server.state["usage"].pop("rate_limit")
+        self.command("limits", "--force", "--quiet")
+        stored = json.loads((self.pool / "acct-01/limits.json").read_text())
+        self.assertTrue(stored["no_data"])
+        self.assertNotIn("weekly_percent", stored)
+        self.assertEqual(stored["credits"]["balance"], "61812.452075")
+        self.assertIsNone(stored["credits"]["ordinary_usage_allowed"])
+
+    def test_success_timestamp_is_after_response_instead_of_pass_start(self):
+        original = fixtures.ResetHandler.do_GET
+        observed = []
+
+        def delayed(handler):
+            if handler.path == "/wham/usage":
+                time.sleep(0.05)
+                observed.append(time.time())
+            original(handler)
+
+        with patch.object(fixtures.ResetHandler, "do_GET", delayed):
+            self.command("limits", "--force", "--quiet")
+        stored = json.loads((self.pool / "acct-01/limits.json").read_text())
+        fetched = datetime.fromisoformat(stored["credits"]["fetched_at"].replace("Z", "+00:00")).timestamp()
+        self.assertGreaterEqual(fetched, observed[0])
+        self.assertEqual(stored["fetched_at"], int(fetched))
+
+    def test_failed_http_read_keeps_balance_and_next_pass_honors_backoff(self):
+        self.command("limits", "--force", "--quiet")
+        path = self.pool / "acct-01/limits.json"
+        previous = json.loads(path.read_text())
+        original = fixtures.ResetHandler.do_GET
+        calls = []
+
+        def unavailable(handler):
+            if handler.path == "/wham/usage":
+                calls.append(time.time())
+                handler.send_error(503)
+            else:
+                original(handler)
+
+        with patch.object(fixtures.ResetHandler, "do_GET", unavailable):
+            self.command("limits", "--force", "--quiet")
+            stored = json.loads(path.read_text())
+            self.assertEqual(stored["credits"]["balance"], previous["credits"]["balance"])
+            self.assertEqual(stored["credits"]["fetched_at"], previous["credits"]["fetched_at"])
+            self.assertEqual(stored["credits"]["last_error"], "http_error")
+            self.assertGreaterEqual(stored["last_error_at"], int(calls[-1]))
+            stored["fetched_at"] = 0
+            path.write_text(json.dumps(stored))
+            self.command("limits", "--quiet")
+        self.assertEqual(len(calls), 2)
+
+    def test_legacy_429_backoff_keeps_its_existing_diagnostic(self):
+        path = self.pool / "acct-01/limits.json"
+        for error in (None, "http_429", "network_unreachable"):
+            previous = {"fetched_at": 0, "retry_after": int(time.time()) + 300}
+            if error is not None:
+                previous["last_error"] = error
+            path.write_text(json.dumps(previous))
+            result = self.command("limits")
+            reason = "usage read failure" if error == "network_unreachable" else "429"
+            self.assertIn(f"acct-01: backing off after {reason}", result.stdout)
+        self.assertEqual(self.server.state["usage_gets"], 0)
+
+    def test_earned_reset_requires_new_usage_before_authorizing_paid_fallback(self):
+        self.server.state["responses"] = [(200, {"code": "reset", "windows_reset": 1})]
+        self.command("limits", "--force", "--quiet", auto_reset="1")
+        stored = json.loads((self.pool / "acct-01/limits.json").read_text())
+        self.assertEqual(stored["fetched_at"], 0)
+        self.assertEqual(stored["credits"]["balance"], "61812.452075")
+        self.assertEqual(stored["credits"]["last_error"], "usage_reset_pending")
+        self.assertFalse((self.pool / "acct-01/.limited").exists())
+
+
+if __name__ == "__main__":
+    unittest.main()

package/tests/test_codex_reset_credits_report.py

@@ -0,0 +1,85 @@
+"""Credit report freshness, failure persistence and safe output use isolated files only."""
+
+import json
+from pathlib import Path
+import sys
+import tempfile
+import unittest
+from unittest.mock import patch
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "lib"))
+import report
+from codex_credits import record_read_failure, snapshot_from_usage
+from test_codex_reset_credits import NOW, payload
+
+
+class CreditReportTest(unittest.TestCase):
+    def setUp(self):
+        scratch = tempfile.TemporaryDirectory(prefix="multiacc-credit-report-")
+        self.addCleanup(scratch.cleanup)
+        self.account = Path(scratch.name)
+        self.path = self.account / "limits.json"
+        self.credits = snapshot_from_usage(payload(), "account-test", NOW)
+
+    def test_report_keeps_earned_resets_and_spendable_credits_separate(self):
+        self.path.write_text(json.dumps({"fetched_at": NOW, "credits": self.credits,
+            "reset_credits_available": 2, "reset_credits_fetched_at": NOW, "weekly_percent": 100}))
+        with patch("report.time.time", return_value=NOW):
+            usage = report._usage(str(self.account), 900)
+        self.assertEqual(usage["reset_credits_available"], 2)
+        self.assertEqual(usage["credits"]["balance"], "1234.5")
+        self.assertFalse(usage["credits"]["stale"])
+        self.assertEqual(usage["weekly_percent"], 100)
+
+    def test_fresh_windows_do_not_refresh_an_old_wallet(self):
+        self.path.write_text(json.dumps({"fetched_at": NOW + 901, "credits": self.credits}))
+        with patch("report.time.time", return_value=NOW + 901):
+            usage = report._usage(str(self.account), 900)
+        self.assertFalse(usage["stale"])
+        self.assertTrue(usage["credits"]["stale"])
+        self.assertEqual(usage["credits"]["age_seconds"], 901)
+
+    def test_failed_read_keeps_windows_and_backoff_without_refreshing_balance(self):
+        previous = {"fetched_at": NOW, "credits": self.credits, "weekly_percent": 100,
+                    "retry_after": NOW + 300, "reset_credits_available": 2}
+        record_read_failure(str(self.path), previous, "http_429", NOW + 10)
+        stored = json.loads(self.path.read_text())
+        self.assertEqual(stored["fetched_at"], NOW)
+        self.assertEqual(stored["retry_after"], NOW + 300)
+        self.assertEqual(stored["credits"]["fetched_at"], self.credits["fetched_at"])
+        with patch("report.time.time", return_value=NOW + 10):
+            usage = report._usage(str(self.account), 900)
+        self.assertEqual(usage["credits"]["last_error"], "http_429")
+        self.assertTrue(usage["credits"]["stale"])
+
+    def test_first_failed_read_records_unknown_and_never_zero(self):
+        record_read_failure(str(self.path), {}, "unauthenticated", NOW)
+        usage = report._usage(str(self.account), 900)
+        self.assertNotIn("credits", usage)
+        self.assertEqual(usage["last_error"], "unauthenticated")
+
+    def test_report_never_passes_arbitrary_wallet_fields_or_error_details(self):
+        credits = {**self.credits, "access_token": "must-not-leak", "last_error": "secret-detail"}
+        self.path.write_text(json.dumps({"fetched_at": NOW, "credits": credits}))
+        usage = report._usage(str(self.account), 900)
+        rendered = json.dumps(usage)
+        self.assertNotIn("must-not-leak", rendered)
+        self.assertNotIn("secret-detail", rendered)
+        self.assertEqual(usage["credits"]["last_error"], "usage_read_failed")
+
+    def test_refusal_evidence_belongs_to_the_observed_wallet_identity(self):
+        self.path.write_text(json.dumps({"fetched_at": NOW, "credits": self.credits}))
+        receipt = self.account / ".credit-refused.json"
+        refused = {"credit_blocked_at": self.credits["fetched_at"], "credit_blocked_balance": "1234.5",
+                   "limited_reason": "credits", "account_id": "account-test"}
+        receipt.write_text(json.dumps(refused))
+        usage = report._usage(str(self.account), 900)
+        self.assertEqual(usage["credit_blocked_balance"], "1234.5")
+        self.assertEqual(usage["limited_reason"], "credits")
+        receipt.write_text(json.dumps({**refused, "account_id": "another-account"}))
+        usage = report._usage(str(self.account), 900)
+        self.assertNotIn("credit_blocked_at", usage)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/tests/test_codex_reset_fetch.py

@@ -0,0 +1,123 @@
+"""Network failures retain usage evidence, retry safely, and never steal a live poller's lock."""
+
+from contextlib import contextmanager
+from email.message import Message
+import errno
+import io
+import json
+import os
+from pathlib import Path
+import socket
+import sys
+import tempfile
+import time
+import unittest
+from unittest.mock import patch
+import urllib.error
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "lib"))
+from codex_limits_lock import change_lock
+from codex_usage_fetch import failure_kind, fetch_usage, retry_delay
+
+
+def http_error(code, **headers):
+    message = Message()
+    for key, value in headers.items():
+        message[key] = value
+    result = urllib.error.HTTPError("https://example.invalid/usage", code, "failure", message, io.BytesIO())
+    result.close()
+    return result
+
+
+@contextmanager
+def response(value):
+    yield io.BytesIO(json.dumps(value).encode())
+
+
+class UsageFetchTest(unittest.TestCase):
+    def test_transient_route_failure_retries_once_and_returns_response(self):
+        failed = urllib.error.URLError(OSError(errno.EHOSTUNREACH, "No route to host"))
+        with patch("codex_usage_fetch.urllib.request.urlopen", side_effect=[failed, response({"credits": {}})]) as read:
+            self.assertEqual(fetch_usage("request"), {"credits": {}})
+        self.assertEqual(read.call_count, 2)
+
+    def test_dns_failure_is_bounded_to_two_requests(self):
+        failed = urllib.error.URLError(socket.gaierror(socket.EAI_AGAIN, "unavailable"))
+        with patch("codex_usage_fetch.urllib.request.urlopen", side_effect=failed) as read:
+            with self.assertRaises(urllib.error.URLError):
+                fetch_usage("request")
+        self.assertEqual(read.call_count, 2)
+        self.assertEqual(failure_kind(failed), "dns_unavailable")
+
+    def test_elapsed_budget_prevents_retry_after_slow_failure(self):
+        with patch("codex_usage_fetch.time.monotonic", side_effect=[0, 0, 16]), \
+             patch("codex_usage_fetch.urllib.request.urlopen", side_effect=TimeoutError()) as read:
+            with self.assertRaises(TimeoutError):
+                fetch_usage("request")
+        self.assertEqual(read.call_count, 1)
+        self.assertEqual(read.call_args.kwargs["timeout"], 10)
+
+    def test_http_auth_and_rate_limits_never_retry_immediately(self):
+        for code in (401, 403, 429):
+            with self.subTest(code=code), \
+                 patch("codex_usage_fetch.urllib.request.urlopen", side_effect=http_error(code)) as read:
+                with self.assertRaises(urllib.error.HTTPError):
+                    fetch_usage("request")
+                self.assertEqual(read.call_count, 1)
+
+    def test_transient_provider_error_retries_unless_retry_after_present(self):
+        for error, count in ((http_error(503), 2), (http_error(503, **{"Retry-After": "60"}), 1)):
+            with patch("codex_usage_fetch.urllib.request.urlopen", side_effect=error) as read:
+                with self.assertRaises(urllib.error.HTTPError):
+                    fetch_usage("request")
+                self.assertEqual(read.call_count, count)
+
+    def test_retry_after_seconds_and_date_are_honored(self):
+        self.assertEqual(retry_delay(http_error(429, **{"Retry-After": "2100"}), {}, 0), 2100)
+        self.assertEqual(retry_delay(http_error(429, **{"Retry-After": "Thu, 01 Jan 1970 00:02:00 GMT"}), {}, 10), 110)
+        self.assertEqual(retry_delay(TimeoutError(), {"backoff": 600}, 0), 900)
+        self.assertEqual(retry_delay(http_error(429), {"backoff": 1200}, 0), 1800)
+
+    def test_precise_safe_failures_and_edge_challenge(self):
+        self.assertEqual(failure_kind(urllib.error.URLError(OSError(errno.EHOSTUNREACH, "secret"))),
+                         "network_unreachable")
+        self.assertEqual(failure_kind(TimeoutError("secret")), "usage_timeout")
+        self.assertEqual(failure_kind(http_error(403, **{"cf-mitigated": "challenge"})), "edge_challenge")
+        with patch("codex_usage_fetch.urllib.request.urlopen", return_value=response([])) as read:
+            with self.assertRaises(ValueError) as result:
+                fetch_usage("request")
+            self.assertEqual(failure_kind(result.exception), "invalid_usage")
+        self.assertEqual(read.call_count, 1)
+
+
+class UsageLockTest(unittest.TestCase):
+    def test_old_live_collector_is_not_replaced_and_wrong_owner_cannot_release(self):
+        with tempfile.TemporaryDirectory(prefix="codex-lock-test-") as directory:
+            path = Path(directory) / "limits"
+            with patch("codex_limits_lock.process_birth", side_effect=lambda pid: str(pid)):
+                self.assertTrue(change_lock(path, 11))
+                os.utime(path, (time.time() - 600, time.time() - 600))
+                self.assertFalse(change_lock(path, 12))
+                self.assertFalse(change_lock(path, 12, release=True))
+                self.assertTrue(change_lock(path, 11, release=True))
+
+    def test_dead_owner_is_reclaimed_without_waiting_for_age(self):
+        with tempfile.TemporaryDirectory(prefix="codex-lock-test-") as directory:
+            path = Path(directory) / "limits"
+            path.mkdir()
+            (path / "owner.json").write_text(json.dumps({"pid": 11, "birth": "old"}))
+            with patch("codex_limits_lock.process_birth", side_effect=lambda pid: "new" if pid == 12 else ""):
+                self.assertTrue(change_lock(path, 12))
+                self.assertTrue(change_lock(path, 12, release=True))
+
+    def test_reused_pid_cannot_keep_abandoned_lock(self):
+        with tempfile.TemporaryDirectory(prefix="codex-lock-test-") as directory:
+            path = Path(directory) / "limits"
+            path.mkdir()
+            (path / "owner.json").write_text(json.dumps({"pid": 11, "birth": "old"}))
+            with patch("codex_limits_lock.process_birth", return_value="new"):
+                self.assertTrue(change_lock(path, 12))
+
+
+if __name__ == "__main__":
+    unittest.main()

package/tests/test_selector_cached_credits.py

@@ -0,0 +1,135 @@
+"""Cached confirmed funds remain usable through telemetry outages, without an age cap."""
+
+import json
+import unittest
+
+from test_selector import NOW, _request
+from test_selector_credits import _paid
+import test_selector_credit_shim as shim_fixtures
+from selector_policy import select
+
+SOFT_ERRORS = (None, "usage_read_failed", "http_401", "http_403", "http_429", "invalid_usage",
+               "network_unreachable", "dns_unavailable", "usage_timeout", "tls_error", "connection_reset")
+
+
+class CachedCreditTests(unittest.TestCase):
+    def test_cached_positive_survives_every_soft_error_without_fallback_age_limit(self):
+        for error in SOFT_ERRORS:
+            with self.subTest(error=error):
+                row = _paid()
+                row["credits"].update(fetched_at="2020-01-01T00:00:00Z", stale=True, last_error=error,
+                                      last_error_at=NOW)
+                response = select(_request([row], credit_fallback=True, credit_max_age_seconds=30))
+                self.assertTrue(response["ok"], response)
+                self.assertEqual(response["funding_tier"], "credits")
+                self.assertEqual(response["score_basis"]["credit_balance"], "61812.452075")
+
+    def test_cached_unlimited_remains_distinct_from_finite_zero(self):
+        row = _paid()
+        row["credits"].update(fetched_at="2020-01-01T00:00:00Z", stale=True,
+                              last_error="http_429", unlimited=True, balance="0", has_credits=False)
+        self.assertTrue(select(_request([row], credit_fallback=True))["ok"])
+        row["credits"]["unlimited"] = False
+        self.assertFalse(select(_request([row], credit_fallback=True))["ok"])
+
+    def test_newer_confirmed_zero_wins_over_old_positive_with_later_refresh_failure(self):
+        old, zero = _paid(account_id="old"), _paid(account_id="zero")
+        old["credits"].update(fetched_at="2020-01-01T00:00:00Z", last_error="network_unreachable",
+                              last_error_at="2026-08-25T09:00:00Z", stale=True)
+        zero["credits"].update(balance="0", fetched_at="2026-08-25T08:00:00Z", stale=True)
+        self.assertFalse(select(_request([old, zero], credit_fallback=True))["ok"])
+        for error in ("unauthenticated", "account_mismatch", "refusal_read_failed"):
+            zero["credits"]["last_error"] = error
+            self.assertFalse(select(_request([old, zero], credit_fallback=True))["ok"])
+        zero["credits"].pop("last_error")
+        zero["credits"].update(balance="80", has_credits=False)
+        self.assertFalse(select(_request([old, zero], credit_fallback=True))["ok"])
+        zero["credits"]["has_credits"] = True
+        result = select(_request([old, zero], credit_fallback=True))
+        self.assertTrue(result["ok"])
+        self.assertEqual(result["score_basis"]["credit_balance"], "80")
+
+    def test_new_unknown_read_does_not_replace_confirmed_wallet_money(self):
+        old, unknown = _paid(account_id="old"), _paid(account_id="unknown")
+        old["credits"].update(fetched_at="2020-01-01T00:00:00Z", stale=True,
+                              last_error="network_unreachable")
+        unknown["credits"].update(fetched_at=NOW, balance=None)
+        response = select(_request([old, unknown], credit_fallback=True))
+        self.assertTrue(response["ok"])
+        self.assertEqual(response["score_basis"]["credit_balance"], "61812.452075")
+        unknown["credits"]["has_credits"] = False
+        self.assertFalse(select(_request([old, unknown], credit_fallback=True))["ok"])
+        unknown["credits"].update(has_credits=True, balance="0")
+        self.assertFalse(select(_request([old, unknown], credit_fallback=True))["ok"])
+        unknown["credits"]["balance"] = None
+        old["credits"]["balance"] = None
+        self.assertFalse(select(_request([old, unknown], credit_fallback=True))["ok"])
+
+    def test_cached_read_cannot_erase_actual_paid_refusal_even_after_cooldown(self):
+        row = _paid()
+        row.update(limited_reason="credits", credit_blocked_at="2026-08-25T08:00:00Z",
+                   credit_blocked_balance="1")
+        for patch in ({"fetched_at": "2026-08-25T08:01:00Z"},
+                      {"fetched_at": NOW, "last_error": "http_429"},
+                      {"fetched_at": NOW, "stale": True}):
+            with self.subTest(patch=patch):
+                candidate = dict(row, credits=dict(row["credits"], **patch))
+                self.assertFalse(select(_request([candidate], credit_fallback=True))["ok"])
+        self.assertTrue(select(_request([row], credit_fallback=True))["ok"])
+
+    def test_newer_actor_restriction_wins_over_later_failed_refresh_of_old_allowance(self):
+        old, denied = _paid(account_id="old"), _paid(account_id="denied")
+        for row in (old, denied):
+            row["credit_actor_email"] = "same@example.com"
+        old["credits"].update(fetched_at="2020-01-01T00:00:00Z", last_error="http_429", last_error_at=NOW)
+        denied["credits"].update(fetched_at="2026-08-25T08:00:00Z", spend_control_reached=True)
+        self.assertFalse(select(_request([old, denied], credit_fallback=True))["ok"])
+        old["credits"]["fetched_at"] = denied["credits"]["fetched_at"]
+        self.assertFalse(select(_request([old, denied], credit_fallback=True))["ok"])
+        denied["credit_actor_email"] = "different@example.com"
+        self.assertEqual(select(_request([old, denied], credit_fallback=True))["account_id"], "old")
+
+    def test_failed_partial_read_restriction_is_not_erased_by_peer_monetary_timestamp(self):
+        blocked, peer = _paid(account_id="blocked"), _paid(account_id="peer")
+        for row in (blocked, peer):
+            row["credit_actor_email"] = "same@example.com"
+        blocked["credits"].update(fetched_at="2020-01-01T00:00:00Z", spend_control_reached=True,
+                                  last_error="invalid_credits", last_error_at=NOW)
+        self.assertFalse(select(_request([blocked, peer], credit_fallback=True))["ok"])
+        blocked["credits"].update(spend_control_reached=False, limit_reached_type="unknown")
+        self.assertFalse(select(_request([blocked, peer], credit_fallback=True))["ok"])
+        peer["credit_actor_email"] = "other@example.com"
+        self.assertEqual(select(_request([blocked, peer], credit_fallback=True))["account_id"], "peer")
+        peer["credit_actor_email"] = "same@example.com"
+        blocked["credits"].update(last_error=None, fetched_at=NOW, limit_reached_type="rate_limit_reached")
+        self.assertTrue(select(_request([blocked, peer], credit_fallback=True))["ok"])
+
+    def test_refusal_still_propagates_across_same_actor_copies_when_refresh_failed(self):
+        blocked, peer = _paid(account_id="blocked"), _paid(account_id="peer")
+        for row in (blocked, peer):
+            row["credit_actor_email"] = "same@example.com"
+        blocked.update(limited_reason="credits", credit_blocked_at="2026-08-25T08:59:59Z",
+                       credit_blocked_balance="61812.452075")
+        blocked["credits"].update(last_error="network_unreachable", stale=True)
+        self.assertFalse(select(_request([blocked, peer], credit_fallback=True))["ok"])
+
+    def test_standalone_shim_accepts_cached_funds_and_keeps_durable_refusal(self):
+        case = shim_fixtures.CreditShimTests()
+        case.setUp()
+        self.addCleanup(case.doCleanups)
+        directory = case.account("acct-01", fetched_at="2020-01-01T00:00:00Z", stale=True,
+                                 last_error="network_unreachable")
+        self.assertIn("tier=credits", case.run_shim().stdout)
+        result = case.run_shim(False, FAKE_ERROR="You've hit your usage limit")
+        self.assertEqual(result.returncode, 1)
+        self.assertIn("tier=hard", case.run_shim().stdout)
+        receipt = json.loads((directory / ".credit-refused.json").read_text())
+        receipt["credit_blocked_at"] = "2019-01-01T00:00:00Z"
+        (directory / ".credit-refused.json").write_text(json.dumps(receipt))
+        self.assertIn("tier=hard", case.run_shim().stdout)
+        case.account("acct-01")
+        self.assertIn("tier=credits", case.run_shim().stdout)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/tests/test_selector_credit_scope.py

@@ -0,0 +1,118 @@
+"""Shared wallets never erase actor permissions, authentication or paid refusals."""
+
+import ast
+import json
+import os
+import time
+import unittest
+
+from test_selector import ROOT, _request
+from test_selector_credits import _paid
+from selector_policy import select
+import test_selector_credit_shim as shim_fixtures
+from codex_credit_selection import record_launch, record_refusal
+
+
+class CreditScopeTests(unittest.TestCase):
+    def test_refusal_follows_same_actor_across_slots_but_not_other_members(self):
+        blocked, peer = _paid(account_id="blocked"), _paid(account_id="peer")
+        blocked.update(credit_actor_email=" Person@Example.COM ", limited_reason="credits",
+                       credit_blocked_at="2026-08-25T08:59:59Z", credit_blocked_balance="61812.452075")
+        peer["credit_actor_email"] = "person@example.com"
+        self.assertFalse(select(_request([blocked, peer], credit_fallback=True))["ok"])
+        peer["credit_actor_email"] = "other@example.com"
+        response = select(_request([blocked, peer], credit_fallback=True))
+        self.assertEqual(response["account_id"], "peer")
+        self.assertEqual(response["score_basis"]["credit_actor_email"], "other@example.com")
+
+    def test_unknown_actor_refusal_remains_with_its_runner_and_slot(self):
+        blocked, peer = _paid(account_id="blocked"), _paid(account_id="peer")
+        blocked.update(limited_reason="credits", credit_blocked_at="2026-08-25T08:59:59Z",
+                       credit_blocked_balance="61812.452075")
+        self.assertEqual(select(_request([blocked, peer], credit_fallback=True))["account_id"], "peer")
+        peer.update(runner_id=4, account_id="blocked")
+        self.assertEqual(select(_request([blocked, peer], credit_fallback=True))["runner_id"], 4)
+
+    def test_peer_wallet_cannot_erase_local_auth_identity_or_refusal_read_failure(self):
+        failed, busy = _paid(account_id="failed"), _paid(account_id="busy")
+        busy["reservation_history"]["active_expires_at"] = "2026-08-25T09:05:00Z"
+        for error in ("account_mismatch", "unauthenticated", "refusal_read_failed"):
+            with self.subTest(error=error):
+                failed["credits"].update(last_error=error, fetched_at="2026-08-25T08:59:00Z")
+                self.assertFalse(select(_request([failed, busy], credit_fallback=True))["ok"])
+
+    def test_peer_wallet_cannot_erase_member_spend_controls_or_share_them(self):
+        blocked, healthy = _paid(account_id="blocked"), _paid(account_id="healthy")
+        blocked["credits"]["spend_control_reached"] = True
+        blocked["credit_actor_email"], healthy["credit_actor_email"] = "a@example.com", "b@example.com"
+        response = select(_request([blocked, healthy], credit_fallback=True))
+        self.assertEqual(response["account_id"], "healthy")
+        healthy["reservation_history"]["active_expires_at"] = "2026-08-25T09:05:00Z"
+        self.assertFalse(select(_request([blocked, healthy], credit_fallback=True))["ok"])
+
+    def test_peer_observation_cannot_end_actor_cooldown_without_new_actor_read(self):
+        blocked, busy = _paid(account_id="blocked"), _paid(account_id="busy")
+        blocked.update(credit_actor_email="a@example.com", limited_reason="credits",
+                       credit_blocked_at="2026-08-25T08:49:00Z", credit_blocked_balance="61812.452075")
+        blocked["credits"]["fetched_at"] = "2026-08-25T08:48:00Z"
+        busy["credit_actor_email"] = "b@example.com"
+        busy["reservation_history"]["active_expires_at"] = "2026-08-25T09:05:00Z"
+        self.assertFalse(select(_request([blocked, busy], credit_fallback=True))["ok"])
+
+    def test_failed_refresh_does_not_replace_latest_confirmed_monetary_observation(self):
+        old, failed = _paid(account_id="old"), _paid(account_id="failed")
+        old["credits"]["fetched_at"] = "2026-08-25T08:59:00Z"
+        failed["credits"].update(fetched_at="2026-08-25T08:58:00Z", last_error="usage_read_failed",
+                                  last_error_at="2026-08-25T09:00:00Z")
+        self.assertTrue(select(_request([old, failed], credit_fallback=True))["ok"])
+        old["credits"]["balance"] = "0"
+        self.assertFalse(select(_request([old, failed], credit_fallback=True))["ok"])
+
+    def test_standalone_refusal_is_shared_only_for_same_manifest_actor(self):
+        case = shim_fixtures.CreditShimTests()
+        case.setUp()
+        self.addCleanup(case.doCleanups)
+        first = case.account("acct-01", account_id="workspace-a")
+        case.account("acct-02", account_id="workspace-a")
+        accounts = [{"id": name, "email": "person@example.com"} for name in ("acct-01", "acct-02")]
+        (case.pool / "accounts.json").write_text(json.dumps({"accounts": accounts}))
+        record_launch(first, os.getpid(), time.time())
+        record_refusal(first, os.getpid(), time.time())
+        self.assertIn("tier=hard", case.run_shim().stdout)
+        accounts[1]["email"] = "other@example.com"
+        (case.pool / "accounts.json").write_text(json.dumps({"accounts": accounts}))
+        self.assertIn("pick=acct-02 tier=credits", case.run_shim().stdout)
+        (case.pool / "accounts.json").write_text('{"accounts":[]}')
+        record_launch(first, os.getpid(), time.time())
+        record_refusal(first, os.getpid(), time.time())
+        self.assertIn("pick=acct-02 tier=credits", case.run_shim().stdout)
+
+    def test_ordinary_gate_log_retains_legacy_fields_and_paid_only_appends_funding(self):
+        case = shim_fixtures.CreditShimTests()
+        case.setUp()
+        self.addCleanup(case.doCleanups)
+        case.account("acct-01", weekly=20)
+        result = case.run_shim(False)
+        self.assertEqual(result.returncode, 0, result.stderr)
+        line = (case.pool / "selection.log").read_text().splitlines()[-1].split(" ", 1)[1]
+        self.assertEqual(line, "acct-01 weekly=20% session=10% band=30 band-count=1 "
+                         f"session-gate=50 session-ok=1 pwd={os.getcwd()}")
+        case.account("acct-01")
+        result = case.run_shim(False)
+        self.assertEqual(result.returncode, 0, result.stderr)
+        line = (case.pool / "selection.log").read_text().splitlines()[-1].split(" ", 1)[1]
+        self.assertEqual(line, "acct-01 weekly=100% session=10% band=30 band-count=0 "
+                         f"session-gate=50 session-ok=0 pwd={os.getcwd()} funding=credits")
+
+    def test_new_modules_parse_as_python39_and_defer_union_annotations(self):
+        for name in ("selector_credits", "selector_funding", "selector_credit_scope", "codex_credit_selection",
+                     "codex_credit_local_scope"):
+            source = (ROOT / "lib" / f"{name}.py").read_text()
+            tree = ast.parse(source, feature_version=(3, 9))
+            self.assertTrue(any(isinstance(node, ast.ImportFrom) and node.module == "__future__"
+                                and any(alias.name == "annotations" for alias in node.names)
+                                for node in tree.body), name)
+
+
+if __name__ == "__main__":
+    unittest.main()