claude-multiacc 2.0.51 → 2.0.52

package/lib/selector_credit_scope.py

@@ -5,6 +5,7 @@ from __future__ import annotations
 from decimal import Decimal
 
 from selector_primitives import timestamp
+from selector_credits import HARD_CREDIT_ERRORS, normalize_credits
 
 FINANCIAL_FIELDS = ("has_credits", "unlimited", "balance", "account_id")
 
@@ -17,7 +18,8 @@ def actor_email(raw: dict) -> str | None:
 def wallet_available(credits: dict) -> bool:
     balance = credits.get("balance")
     funds = credits["unlimited"] or (credits["has_credits"] and balance is not None and Decimal(balance) > 0)
-    return bool(credits["fresh"] and not credits["last_error"] and funds)
+    return bool(credits["account_id"] and credits["fetched_at"]
+                and credits["last_error"] not in HARD_CREDIT_ERRORS and funds)
 
 
 def merge_wallet(local: dict, wallet: dict | None) -> dict:
@@ -25,7 +27,7 @@ def merge_wallet(local: dict, wallet: dict | None) -> dict:
         return local
     merged = dict(local)
     merged.update({key: wallet[key] for key in FINANCIAL_FIELDS})
-    merged["available"] = bool(local["fresh"] and not local["last_error"]
+    merged["available"] = bool(local["fetched_at"] and local["last_error"] not in HARD_CREDIT_ERRORS
                                and not local["spend_control_reached"] and wallet["available"])
     return merged
 
@@ -41,7 +43,7 @@ def actor_key(raw: dict) -> tuple:
 def actor_refusals(candidates: list[dict]) -> dict:
     refusals = {}
     for raw in candidates:
-        if not raw.get("credit_blocked_at") or (raw.get("credits") or {}).get("last_error"):
+        if not raw.get("credit_blocked_at") or (raw.get("credits") or {}).get("last_error") == "account_mismatch":
             continue
         try:
             _, blocked = timestamp(raw["credit_blocked_at"])
@@ -53,3 +55,31 @@ def actor_refusals(candidates: list[dict]) -> dict:
             refusals[key] = {"credit_blocked_at": blocked,
                              "credit_blocked_balance": raw.get("credit_blocked_balance")}
     return refusals
+
+
+def actor_observations(candidates: list[dict], now, max_age: int) -> dict:
+    observations = {}
+    for raw in candidates:
+        credits = normalize_credits(raw.get("credits"), now, max_age)
+        if not credits["fetched_at"] or credits["last_error"] == "account_mismatch":
+            continue
+        key = actor_key(raw)
+        sticky = bool(credits["last_error"] and credits["spend_control_reached"])
+        rank = (sticky, credits["fetched_at"], credits["spend_control_reached"],
+                credits["ordinary_usage_allowed"] is False)
+        previous = observations.get(key)
+        if previous is None or rank > previous[0]:
+            observations[key] = rank, credits
+    return {key: value[1] for key, value in observations.items()}
+
+
+def merge_actor(local: dict, observation: dict | None) -> dict:
+    # A partial response can confirm a new restriction while retaining old money's
+    # timestamp. A peer's newer money is not proof that this local restriction lifted.
+    if observation is None or (local["last_error"] and local["spend_control_reached"]):
+        return local
+    merged = dict(local)
+    for key in ("ordinary_usage_allowed", "spend_control_reached", "limit_reached_type"):
+        merged[key] = observation[key]
+    merged["available"] = wallet_available(local) and not merged["spend_control_reached"]
+    return merged

package/lib/selector_credits.py

@@ -8,6 +8,7 @@ from decimal import Decimal, InvalidOperation
 from selector_primitives import DECIMAL_RE, timestamp
 
 CAPABILITY = "codex_credits_v1"
+HARD_CREDIT_ERRORS = {"account_mismatch", "unauthenticated", "refusal_read_failed"}
 CREDIT_FIELDS = {
     "has_credits", "unlimited", "balance", "fetched_at", "account_id", "ordinary_usage_allowed",
     "spend_control_reached", "limit_reached_type", "last_error", "last_error_at", "stale", "age_seconds"}
@@ -63,7 +64,10 @@ def normalize_credits(raw: object, now: datetime, max_age: int = 900) -> dict:
     account = account.strip() if isinstance(account, str) and len(account) <= 256 else None
     try:
         observed, fetched_at = timestamp(raw.get("fetched_at"))
-        fresh = -30 <= (now - observed).total_seconds() <= max_age and raw.get("stale") is not True
+        age = (now - observed).total_seconds()
+        fresh = -30 <= age <= max_age and raw.get("stale") is not True
+        if age < -30:
+            fetched_at = None
     except (ValueError, TypeError):
         fetched_at, fresh = None, False
     reached = raw.get("limit_reached_type")
@@ -78,8 +82,9 @@ def normalize_credits(raw: object, now: datetime, max_age: int = 900) -> dict:
         "ordinary_usage_allowed": raw.get("ordinary_usage_allowed")
         if isinstance(raw.get("ordinary_usage_allowed"), bool) else None,
         "spend_control_reached": restricted, "limit_reached_type": reached,
-        "last_error": bool(raw.get("last_error")), "fresh": fresh,
-        "available": bool(fresh and account and available and not restricted and not raw.get("last_error"))}
+        "last_error": raw.get("last_error") or False, "fresh": fresh,
+        "available": bool(fetched_at and account and available and not restricted
+                          and raw.get("last_error") not in HARD_CREDIT_ERRORS)}
 
 
 def refusal_recovered(raw: dict, credits: dict, now: datetime) -> bool:
@@ -96,4 +101,5 @@ def refusal_recovered(raw: dict, credits: dict, now: datetime) -> bool:
     current = credits.get("balance")
     increased = old is not None and current is not None and Decimal(current) > Decimal(old)
     cooled = (now - blocked_time).total_seconds() >= 600
-    return bool(fetched > blocked_time and credits["available"] and (increased or cooled))
+    return bool(fetched > blocked_time and credits["available"] and credits["fresh"]
+                and not credits["last_error"] and (increased or cooled))

package/lib/selector_funding.py

@@ -5,8 +5,9 @@ from __future__ import annotations
 from decimal import Decimal, localcontext
 
 from selector_credits import CAPABILITY, normalize_credits, refusal_recovered
-from selector_credit_scope import actor_email, actor_key, actor_refusals, merge_wallet, wallet_available
-from selector_primitives import timestamp
+from selector_credit_scope import (
+    actor_email, actor_key, actor_observations, actor_refusals, merge_actor, merge_wallet, wallet_available,
+)
 
 
 def wallet_snapshots(candidates: list[dict], now, max_age: int) -> dict:
@@ -14,21 +15,20 @@ def wallet_snapshots(candidates: list[dict], now, max_age: int) -> dict:
     for raw in candidates:
         credits = normalize_credits(raw.get("credits"), now, max_age)
         key = credits["account_id"]
-        error = (raw.get("credits") or {}).get("last_error")
-        if not key or error in {"account_mismatch", "unauthenticated", "http_401", "http_403"}:
+        if not key:
             continue
-        credits["available"] = wallet_available(credits)
+        # The snapshot predates a failed refresh: its confirmed money remains true
+        # even when this slot's current credentials no longer authenticate.
+        credits["available"] = wallet_available(dict(credits, last_error=False))
         observed = credits["fetched_at"] or ""
-        if error:
-            try:
-                _, failed_at = timestamp(raw["credits"].get("last_error_at"))
-                observed = max(observed, failed_at)
-            except ValueError:
-                pass
-        credits["wallet_observed_at"] = observed
+        confirmed = bool(observed) and (credits["unlimited"]
+            or (raw.get("credits") or {}).get("has_credits") is False
+            or (credits["has_credits"] and credits["balance"] is not None))
+        credits["wallet_observed_at"], credits["wallet_confirmed"] = observed, confirmed
         previous = wallets.get(key)
-        rank = (observed, not credits["available"])
-        if previous is None or rank > (previous["wallet_observed_at"], not previous["available"]):
+        rank = (confirmed, observed, not credits["available"])
+        if previous is None or rank > (previous["wallet_confirmed"], previous["wallet_observed_at"],
+                                       not previous["available"]):
             wallets[key] = credits
     return wallets
 
@@ -37,12 +37,14 @@ def apply_funding(rows: list[dict], candidates: list[dict], now, request: dict)
     max_age = request.get("credit_max_age_seconds", 900)
     wallets = wallet_snapshots(candidates, now, max_age)
     refusals = actor_refusals(candidates)
+    observations = actor_observations(candidates, now, max_age)
     holders = {}
     for raw in candidates:
         account = (raw.get("credits") or {}).get("account_id")
         holders[account] = max(holders.get(account, 0), raw.get("credit_active_holders", 0))
     for row, raw in zip(rows, candidates):
         credits = normalize_credits(raw.get("credits"), now, max_age)
+        credits = merge_actor(credits, observations.get(actor_key(raw)))
         credits = merge_wallet(credits, wallets.get(credits["account_id"]))
         receipt = dict(raw, **refusals.get(actor_key(raw), {}))
         known = row["quota_known"]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-multiacc",
-  "version": "2.0.51",
+  "version": "2.0.52",
   "description": "Unified Claude Code and OpenAI Codex subscription pooling with quota-aware selection.",
   "type": "module",
   "bin": {

package/tests/test_codex_reset_credits.py

@@ -81,6 +81,48 @@ class SpendableCreditsTest(unittest.TestCase):
         self.assertIsNone(credit_view({**value, "fetched_at": "2026-10-04T12:00:00"}, NOW))
         self.assertIsNone(credit_view({**value, "fetched_at": {}}, NOW))
 
+    def test_soft_failure_never_erases_a_known_auth_or_identity_failure(self):
+        previous = snapshot_from_usage(payload(), "account-test", NOW)
+        for error in ("unauthenticated", "account_mismatch"):
+            failed = failed_credits(previous, error, NOW + 10)
+            retry = failed_credits(failed, "network_unreachable", NOW + 20)
+            self.assertEqual(retry["last_error"], error)
+            self.assertEqual(retry["last_error_at"], failed["last_error_at"])
+            self.assertNotIn("last_error", collect_credits(payload(), "account-test", NOW + 30, retry))
+
+    def test_transport_failure_diagnostics_preserve_paid_balance_and_its_timestamp(self):
+        previous = snapshot_from_usage(payload(), "account-test", NOW)
+        for error in ("network_unreachable", "dns_unavailable", "usage_timeout", "http_401", "http_403"):
+            failed = failed_credits(previous, error, NOW + 10)
+            self.assertEqual(failed["last_error"], error)
+            self.assertEqual(failed["balance"], previous["balance"])
+            self.assertEqual(failed["fetched_at"], previous["fetched_at"])
+
+    def test_missing_credit_schema_does_not_hide_identity_mismatch(self):
+        previous = snapshot_from_usage(payload(), "account-test", NOW)
+        result = collect_credits({"account_id": "other"}, "account-test", NOW + 10, previous)
+        self.assertEqual(result["last_error"], "account_mismatch")
+
+    def test_missing_balance_keeps_money_but_obeys_new_spend_control(self):
+        previous = snapshot_from_usage(payload(), "account-test", NOW)
+        for raw in (payload(credits={"has_credits": True, "unlimited": False, "balance": None}),
+                    payload(credits=None)):
+            raw["spend_control_reached"] = True
+            result = collect_credits(raw, "account-test", NOW + 10, previous)
+            self.assertEqual(result["balance"], previous["balance"])
+            self.assertEqual(result["fetched_at"], previous["fetched_at"])
+            self.assertTrue(result["spend_control_reached"])
+            self.assertIn(result["last_error"], ("invalid_credits", "missing_credits"))
+
+    def test_partial_read_never_clears_previous_spending_restrictions(self):
+        previous = snapshot_from_usage(payload(spend_control_reached=True,
+            rate_limit_reached_type="workspace_member_usage_limit_reached"), "account-test", NOW)
+        raw = payload(credits=None, spend_control_reached=False, rate_limit_reached_type="rate_limit_reached")
+        result = collect_credits(raw, "account-test", NOW + 10, previous)
+        self.assertTrue(result["spend_control_reached"])
+        self.assertEqual(result["limit_reached_type"], "workspace_member_usage_limit_reached")
+        self.assertFalse(collect_credits(payload(), "account-test", NOW + 20, result)["spend_control_reached"])
+
     def test_admission_facts_are_never_inferred_from_percentages(self):
         raw = payload(rate_limit={"primary_window": {"used_percent": 0}})
         snapshot = snapshot_from_usage(raw, "account-test", NOW)

package/tests/test_codex_reset_credits_polling.py

@@ -1,10 +1,12 @@
 """Existing Codex usage polling carries paid balances without extra provider requests."""
 
 import json
+from datetime import datetime
 import os
 import subprocess
 import time
 import unittest
+from unittest.mock import patch
 
 import test_codex_reset as fixtures
 
@@ -50,7 +52,7 @@ class CreditPollingTest(fixtures.CodexPoolSandbox, unittest.TestCase):
         self.assertEqual(listed["accounts"][0]["usage"]["credits"]["balance"], "61812.452075")
         self.assertEqual(self.server.state["usage_gets"], 1)
 
-    def test_missing_credit_read_preserves_previous_amount_as_unusable(self):
+    def test_missing_credit_read_preserves_previous_amount_and_reports_staleness(self):
         self.command("limits", "--force", "--quiet")
         path = self.pool / "acct-01/limits.json"
         before = json.loads(path.read_text())["credits"]
@@ -80,6 +82,61 @@ class CreditPollingTest(fixtures.CodexPoolSandbox, unittest.TestCase):
         self.assertEqual(stored["credits"]["balance"], "61812.452075")
         self.assertIsNone(stored["credits"]["ordinary_usage_allowed"])
 
+    def test_success_timestamp_is_after_response_instead_of_pass_start(self):
+        original = fixtures.ResetHandler.do_GET
+        observed = []
+
+        def delayed(handler):
+            if handler.path == "/wham/usage":
+                time.sleep(0.05)
+                observed.append(time.time())
+            original(handler)
+
+        with patch.object(fixtures.ResetHandler, "do_GET", delayed):
+            self.command("limits", "--force", "--quiet")
+        stored = json.loads((self.pool / "acct-01/limits.json").read_text())
+        fetched = datetime.fromisoformat(stored["credits"]["fetched_at"].replace("Z", "+00:00")).timestamp()
+        self.assertGreaterEqual(fetched, observed[0])
+        self.assertEqual(stored["fetched_at"], int(fetched))
+
+    def test_failed_http_read_keeps_balance_and_next_pass_honors_backoff(self):
+        self.command("limits", "--force", "--quiet")
+        path = self.pool / "acct-01/limits.json"
+        previous = json.loads(path.read_text())
+        original = fixtures.ResetHandler.do_GET
+        calls = []
+
+        def unavailable(handler):
+            if handler.path == "/wham/usage":
+                calls.append(time.time())
+                handler.send_error(503)
+            else:
+                original(handler)
+
+        with patch.object(fixtures.ResetHandler, "do_GET", unavailable):
+            self.command("limits", "--force", "--quiet")
+            stored = json.loads(path.read_text())
+            self.assertEqual(stored["credits"]["balance"], previous["credits"]["balance"])
+            self.assertEqual(stored["credits"]["fetched_at"], previous["credits"]["fetched_at"])
+            self.assertEqual(stored["credits"]["last_error"], "http_error")
+            self.assertGreaterEqual(stored["last_error_at"], int(calls[-1]))
+            stored["fetched_at"] = 0
+            path.write_text(json.dumps(stored))
+            self.command("limits", "--quiet")
+        self.assertEqual(len(calls), 2)
+
+    def test_legacy_429_backoff_keeps_its_existing_diagnostic(self):
+        path = self.pool / "acct-01/limits.json"
+        for error in (None, "http_429", "network_unreachable"):
+            previous = {"fetched_at": 0, "retry_after": int(time.time()) + 300}
+            if error is not None:
+                previous["last_error"] = error
+            path.write_text(json.dumps(previous))
+            result = self.command("limits")
+            reason = "usage read failure" if error == "network_unreachable" else "429"
+            self.assertIn(f"acct-01: backing off after {reason}", result.stdout)
+        self.assertEqual(self.server.state["usage_gets"], 0)
+
     def test_earned_reset_requires_new_usage_before_authorizing_paid_fallback(self):
         self.server.state["responses"] = [(200, {"code": "reset", "windows_reset": 1})]
         self.command("limits", "--force", "--quiet", auto_reset="1")

package/tests/test_codex_reset_fetch.py

@@ -0,0 +1,123 @@
+"""Network failures retain usage evidence, retry safely, and never steal a live poller's lock."""
+
+from contextlib import contextmanager
+from email.message import Message
+import errno
+import io
+import json
+import os
+from pathlib import Path
+import socket
+import sys
+import tempfile
+import time
+import unittest
+from unittest.mock import patch
+import urllib.error
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "lib"))
+from codex_limits_lock import change_lock
+from codex_usage_fetch import failure_kind, fetch_usage, retry_delay
+
+
+def http_error(code, **headers):
+    message = Message()
+    for key, value in headers.items():
+        message[key] = value
+    result = urllib.error.HTTPError("https://example.invalid/usage", code, "failure", message, io.BytesIO())
+    result.close()
+    return result
+
+
+@contextmanager
+def response(value):
+    yield io.BytesIO(json.dumps(value).encode())
+
+
+class UsageFetchTest(unittest.TestCase):
+    def test_transient_route_failure_retries_once_and_returns_response(self):
+        failed = urllib.error.URLError(OSError(errno.EHOSTUNREACH, "No route to host"))
+        with patch("codex_usage_fetch.urllib.request.urlopen", side_effect=[failed, response({"credits": {}})]) as read:
+            self.assertEqual(fetch_usage("request"), {"credits": {}})
+        self.assertEqual(read.call_count, 2)
+
+    def test_dns_failure_is_bounded_to_two_requests(self):
+        failed = urllib.error.URLError(socket.gaierror(socket.EAI_AGAIN, "unavailable"))
+        with patch("codex_usage_fetch.urllib.request.urlopen", side_effect=failed) as read:
+            with self.assertRaises(urllib.error.URLError):
+                fetch_usage("request")
+        self.assertEqual(read.call_count, 2)
+        self.assertEqual(failure_kind(failed), "dns_unavailable")
+
+    def test_elapsed_budget_prevents_retry_after_slow_failure(self):
+        with patch("codex_usage_fetch.time.monotonic", side_effect=[0, 0, 16]), \
+             patch("codex_usage_fetch.urllib.request.urlopen", side_effect=TimeoutError()) as read:
+            with self.assertRaises(TimeoutError):
+                fetch_usage("request")
+        self.assertEqual(read.call_count, 1)
+        self.assertEqual(read.call_args.kwargs["timeout"], 10)
+
+    def test_http_auth_and_rate_limits_never_retry_immediately(self):
+        for code in (401, 403, 429):
+            with self.subTest(code=code), \
+                 patch("codex_usage_fetch.urllib.request.urlopen", side_effect=http_error(code)) as read:
+                with self.assertRaises(urllib.error.HTTPError):
+                    fetch_usage("request")
+                self.assertEqual(read.call_count, 1)
+
+    def test_transient_provider_error_retries_unless_retry_after_present(self):
+        for error, count in ((http_error(503), 2), (http_error(503, **{"Retry-After": "60"}), 1)):
+            with patch("codex_usage_fetch.urllib.request.urlopen", side_effect=error) as read:
+                with self.assertRaises(urllib.error.HTTPError):
+                    fetch_usage("request")
+                self.assertEqual(read.call_count, count)
+
+    def test_retry_after_seconds_and_date_are_honored(self):
+        self.assertEqual(retry_delay(http_error(429, **{"Retry-After": "2100"}), {}, 0), 2100)
+        self.assertEqual(retry_delay(http_error(429, **{"Retry-After": "Thu, 01 Jan 1970 00:02:00 GMT"}), {}, 10), 110)
+        self.assertEqual(retry_delay(TimeoutError(), {"backoff": 600}, 0), 900)
+        self.assertEqual(retry_delay(http_error(429), {"backoff": 1200}, 0), 1800)
+
+    def test_precise_safe_failures_and_edge_challenge(self):
+        self.assertEqual(failure_kind(urllib.error.URLError(OSError(errno.EHOSTUNREACH, "secret"))),
+                         "network_unreachable")
+        self.assertEqual(failure_kind(TimeoutError("secret")), "usage_timeout")
+        self.assertEqual(failure_kind(http_error(403, **{"cf-mitigated": "challenge"})), "edge_challenge")
+        with patch("codex_usage_fetch.urllib.request.urlopen", return_value=response([])) as read:
+            with self.assertRaises(ValueError) as result:
+                fetch_usage("request")
+            self.assertEqual(failure_kind(result.exception), "invalid_usage")
+        self.assertEqual(read.call_count, 1)
+
+
+class UsageLockTest(unittest.TestCase):
+    def test_old_live_collector_is_not_replaced_and_wrong_owner_cannot_release(self):
+        with tempfile.TemporaryDirectory(prefix="codex-lock-test-") as directory:
+            path = Path(directory) / "limits"
+            with patch("codex_limits_lock.process_birth", side_effect=lambda pid: str(pid)):
+                self.assertTrue(change_lock(path, 11))
+                os.utime(path, (time.time() - 600, time.time() - 600))
+                self.assertFalse(change_lock(path, 12))
+                self.assertFalse(change_lock(path, 12, release=True))
+                self.assertTrue(change_lock(path, 11, release=True))
+
+    def test_dead_owner_is_reclaimed_without_waiting_for_age(self):
+        with tempfile.TemporaryDirectory(prefix="codex-lock-test-") as directory:
+            path = Path(directory) / "limits"
+            path.mkdir()
+            (path / "owner.json").write_text(json.dumps({"pid": 11, "birth": "old"}))
+            with patch("codex_limits_lock.process_birth", side_effect=lambda pid: "new" if pid == 12 else ""):
+                self.assertTrue(change_lock(path, 12))
+                self.assertTrue(change_lock(path, 12, release=True))
+
+    def test_reused_pid_cannot_keep_abandoned_lock(self):
+        with tempfile.TemporaryDirectory(prefix="codex-lock-test-") as directory:
+            path = Path(directory) / "limits"
+            path.mkdir()
+            (path / "owner.json").write_text(json.dumps({"pid": 11, "birth": "old"}))
+            with patch("codex_limits_lock.process_birth", return_value="new"):
+                self.assertTrue(change_lock(path, 12))
+
+
+if __name__ == "__main__":
+    unittest.main()

package/tests/test_selector_cached_credits.py

@@ -0,0 +1,135 @@
+"""Cached confirmed funds remain usable through telemetry outages, without an age cap."""
+
+import json
+import unittest
+
+from test_selector import NOW, _request
+from test_selector_credits import _paid
+import test_selector_credit_shim as shim_fixtures
+from selector_policy import select
+
+SOFT_ERRORS = (None, "usage_read_failed", "http_401", "http_403", "http_429", "invalid_usage",
+               "network_unreachable", "dns_unavailable", "usage_timeout", "tls_error", "connection_reset")
+
+
+class CachedCreditTests(unittest.TestCase):
+    def test_cached_positive_survives_every_soft_error_without_fallback_age_limit(self):
+        for error in SOFT_ERRORS:
+            with self.subTest(error=error):
+                row = _paid()
+                row["credits"].update(fetched_at="2020-01-01T00:00:00Z", stale=True, last_error=error,
+                                      last_error_at=NOW)
+                response = select(_request([row], credit_fallback=True, credit_max_age_seconds=30))
+                self.assertTrue(response["ok"], response)
+                self.assertEqual(response["funding_tier"], "credits")
+                self.assertEqual(response["score_basis"]["credit_balance"], "61812.452075")
+
+    def test_cached_unlimited_remains_distinct_from_finite_zero(self):
+        row = _paid()
+        row["credits"].update(fetched_at="2020-01-01T00:00:00Z", stale=True,
+                              last_error="http_429", unlimited=True, balance="0", has_credits=False)
+        self.assertTrue(select(_request([row], credit_fallback=True))["ok"])
+        row["credits"]["unlimited"] = False
+        self.assertFalse(select(_request([row], credit_fallback=True))["ok"])
+
+    def test_newer_confirmed_zero_wins_over_old_positive_with_later_refresh_failure(self):
+        old, zero = _paid(account_id="old"), _paid(account_id="zero")
+        old["credits"].update(fetched_at="2020-01-01T00:00:00Z", last_error="network_unreachable",
+                              last_error_at="2026-08-25T09:00:00Z", stale=True)
+        zero["credits"].update(balance="0", fetched_at="2026-08-25T08:00:00Z", stale=True)
+        self.assertFalse(select(_request([old, zero], credit_fallback=True))["ok"])
+        for error in ("unauthenticated", "account_mismatch", "refusal_read_failed"):
+            zero["credits"]["last_error"] = error
+            self.assertFalse(select(_request([old, zero], credit_fallback=True))["ok"])
+        zero["credits"].pop("last_error")
+        zero["credits"].update(balance="80", has_credits=False)
+        self.assertFalse(select(_request([old, zero], credit_fallback=True))["ok"])
+        zero["credits"]["has_credits"] = True
+        result = select(_request([old, zero], credit_fallback=True))
+        self.assertTrue(result["ok"])
+        self.assertEqual(result["score_basis"]["credit_balance"], "80")
+
+    def test_new_unknown_read_does_not_replace_confirmed_wallet_money(self):
+        old, unknown = _paid(account_id="old"), _paid(account_id="unknown")
+        old["credits"].update(fetched_at="2020-01-01T00:00:00Z", stale=True,
+                              last_error="network_unreachable")
+        unknown["credits"].update(fetched_at=NOW, balance=None)
+        response = select(_request([old, unknown], credit_fallback=True))
+        self.assertTrue(response["ok"])
+        self.assertEqual(response["score_basis"]["credit_balance"], "61812.452075")
+        unknown["credits"]["has_credits"] = False
+        self.assertFalse(select(_request([old, unknown], credit_fallback=True))["ok"])
+        unknown["credits"].update(has_credits=True, balance="0")
+        self.assertFalse(select(_request([old, unknown], credit_fallback=True))["ok"])
+        unknown["credits"]["balance"] = None
+        old["credits"]["balance"] = None
+        self.assertFalse(select(_request([old, unknown], credit_fallback=True))["ok"])
+
+    def test_cached_read_cannot_erase_actual_paid_refusal_even_after_cooldown(self):
+        row = _paid()
+        row.update(limited_reason="credits", credit_blocked_at="2026-08-25T08:00:00Z",
+                   credit_blocked_balance="1")
+        for patch in ({"fetched_at": "2026-08-25T08:01:00Z"},
+                      {"fetched_at": NOW, "last_error": "http_429"},
+                      {"fetched_at": NOW, "stale": True}):
+            with self.subTest(patch=patch):
+                candidate = dict(row, credits=dict(row["credits"], **patch))
+                self.assertFalse(select(_request([candidate], credit_fallback=True))["ok"])
+        self.assertTrue(select(_request([row], credit_fallback=True))["ok"])
+
+    def test_newer_actor_restriction_wins_over_later_failed_refresh_of_old_allowance(self):
+        old, denied = _paid(account_id="old"), _paid(account_id="denied")
+        for row in (old, denied):
+            row["credit_actor_email"] = "same@example.com"
+        old["credits"].update(fetched_at="2020-01-01T00:00:00Z", last_error="http_429", last_error_at=NOW)
+        denied["credits"].update(fetched_at="2026-08-25T08:00:00Z", spend_control_reached=True)
+        self.assertFalse(select(_request([old, denied], credit_fallback=True))["ok"])
+        old["credits"]["fetched_at"] = denied["credits"]["fetched_at"]
+        self.assertFalse(select(_request([old, denied], credit_fallback=True))["ok"])
+        denied["credit_actor_email"] = "different@example.com"
+        self.assertEqual(select(_request([old, denied], credit_fallback=True))["account_id"], "old")
+
+    def test_failed_partial_read_restriction_is_not_erased_by_peer_monetary_timestamp(self):
+        blocked, peer = _paid(account_id="blocked"), _paid(account_id="peer")
+        for row in (blocked, peer):
+            row["credit_actor_email"] = "same@example.com"
+        blocked["credits"].update(fetched_at="2020-01-01T00:00:00Z", spend_control_reached=True,
+                                  last_error="invalid_credits", last_error_at=NOW)
+        self.assertFalse(select(_request([blocked, peer], credit_fallback=True))["ok"])
+        blocked["credits"].update(spend_control_reached=False, limit_reached_type="unknown")
+        self.assertFalse(select(_request([blocked, peer], credit_fallback=True))["ok"])
+        peer["credit_actor_email"] = "other@example.com"
+        self.assertEqual(select(_request([blocked, peer], credit_fallback=True))["account_id"], "peer")
+        peer["credit_actor_email"] = "same@example.com"
+        blocked["credits"].update(last_error=None, fetched_at=NOW, limit_reached_type="rate_limit_reached")
+        self.assertTrue(select(_request([blocked, peer], credit_fallback=True))["ok"])
+
+    def test_refusal_still_propagates_across_same_actor_copies_when_refresh_failed(self):
+        blocked, peer = _paid(account_id="blocked"), _paid(account_id="peer")
+        for row in (blocked, peer):
+            row["credit_actor_email"] = "same@example.com"
+        blocked.update(limited_reason="credits", credit_blocked_at="2026-08-25T08:59:59Z",
+                       credit_blocked_balance="61812.452075")
+        blocked["credits"].update(last_error="network_unreachable", stale=True)
+        self.assertFalse(select(_request([blocked, peer], credit_fallback=True))["ok"])
+
+    def test_standalone_shim_accepts_cached_funds_and_keeps_durable_refusal(self):
+        case = shim_fixtures.CreditShimTests()
+        case.setUp()
+        self.addCleanup(case.doCleanups)
+        directory = case.account("acct-01", fetched_at="2020-01-01T00:00:00Z", stale=True,
+                                 last_error="network_unreachable")
+        self.assertIn("tier=credits", case.run_shim().stdout)
+        result = case.run_shim(False, FAKE_ERROR="You've hit your usage limit")
+        self.assertEqual(result.returncode, 1)
+        self.assertIn("tier=hard", case.run_shim().stdout)
+        receipt = json.loads((directory / ".credit-refused.json").read_text())
+        receipt["credit_blocked_at"] = "2019-01-01T00:00:00Z"
+        (directory / ".credit-refused.json").write_text(json.dumps(receipt))
+        self.assertIn("tier=hard", case.run_shim().stdout)
+        case.account("acct-01")
+        self.assertIn("tier=credits", case.run_shim().stdout)
+
+
+if __name__ == "__main__":
+    unittest.main()