claude-multiacc 2.0.51 → 2.0.53

package/tests/test_claude_pool_prepare.py

@@ -0,0 +1,107 @@
+#!/usr/bin/env python3
+"""The local Claude pool repair retains every transcript and existing setting."""
+
+import json
+import os
+from pathlib import Path
+import subprocess
+import sys
+import tempfile
+import unittest
+
+
+SCRIPT = Path(__file__).resolve().parents[1] / "lib" / "claude_pool_prepare.py"
+
+
+class ClaudePoolPrepareTests(unittest.TestCase):
+    def setUp(self):
+        self.work = tempfile.TemporaryDirectory()
+        self.addCleanup(self.work.cleanup)
+        self.home = Path(self.work.name)
+        self.root = self.home / ".claude-accounts"
+        self.root.mkdir()
+        self.accounts = [self.root / f"acct-{number:02d}" for number in (1, 2)]
+        for account in self.accounts:
+            account.mkdir()
+        (self.root / "accounts.json").write_text(json.dumps({
+            "accounts": [{"id": account.name} for account in self.accounts],
+        }))
+
+    def run_prepare(self, verb):
+        return subprocess.run([sys.executable, str(SCRIPT), verb, "--home", str(self.home)],
+                              capture_output=True, text=True)
+
+    def test_fresh_pool_starts_shared_and_bypassed(self):
+        self.assertEqual(self.run_prepare("check").returncode, 1)
+        result = self.run_prepare("apply")
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertEqual(json.loads(result.stdout)["accounts"], 2)
+        shared = self.home / ".claude" / "projects"
+        self.assertTrue(shared.is_dir())
+        for account in self.accounts:
+            self.assertTrue((account / "projects").is_symlink())
+            self.assertEqual((account / "projects").resolve(), shared.resolve())
+            self.assertEqual(json.loads((account / "settings.json").read_text())
+                             ["permissions"]["defaultMode"], "bypassPermissions")
+        self.assertEqual(self.run_prepare("check").returncode, 0)
+
+    def test_split_history_merges_and_preserves_conflicting_transcripts(self):
+        first, second = self.accounts
+        first_session = first / "projects" / "-work" / "session.jsonl"
+        second_session = second / "projects" / "-work" / "session.jsonl"
+        for session, content, stamp in ((first_session, "old\n", 10),
+                                        (second_session, "new\n", 20)):
+            session.parent.mkdir(parents=True)
+            session.write_text(content)
+            os.utime(session, (stamp, stamp))
+        (first / "projects" / "-work" / "first.jsonl").write_text("first\n")
+        (second / "projects" / "-work" / "second.jsonl").write_text("second\n")
+        (first / "settings.json").write_text(json.dumps({
+            "model": "opus", "permissions": {"defaultMode": "auto", "allow": ["Bash"]}}))
+        result = self.run_prepare("apply")
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertEqual(json.loads(result.stdout)["conflicts_archived"], 1)
+        for account in self.accounts:
+            self.assertEqual((account / "projects" / "-work" / "session.jsonl").read_text(), "new\n")
+            self.assertTrue((account / "projects" / "-work" / "first.jsonl").exists())
+            self.assertTrue((account / "projects" / "-work" / "second.jsonl").exists())
+        self.assertEqual((self.root / "history-repair" / "conflicts" / "acct-02" / "-work" /
+                          "session.jsonl").read_text(), "old\n")
+        settings = json.loads((first / "settings.json").read_text())
+        self.assertEqual(settings["model"], "opus")
+        self.assertEqual(settings["permissions"]["allow"], ["Bash"])
+        self.assertEqual(settings["permissions"]["defaultMode"], "bypassPermissions")
+        self.assertEqual(json.loads(self.run_prepare("apply").stdout)["files_moved"], 0)
+
+    def test_custom_history_link_is_not_replaced(self):
+        custom = self.home / "custom-projects"
+        custom.mkdir()
+        (self.accounts[0] / "projects").symlink_to(custom)
+        result = self.run_prepare("apply")
+        self.assertNotEqual(result.returncode, 0)
+        self.assertEqual((self.accounts[0] / "projects").resolve(), custom.resolve())
+
+    def test_private_history_waits_for_active_pool_session(self):
+        projects = self.accounts[0] / "projects"
+        projects.mkdir()
+        sessions = self.accounts[1] / "sessions"
+        sessions.mkdir()
+        (sessions / f"{os.getpid()}.json").write_text("{}")
+        result = self.run_prepare("apply")
+        self.assertNotEqual(result.returncode, 0)
+        self.assertTrue(projects.is_dir())
+        self.assertFalse(projects.is_symlink())
+        self.assertFalse((self.home / ".claude" / "projects").exists())
+
+    def test_custom_settings_link_is_not_replaced(self):
+        custom = self.home / "settings.json"
+        custom.write_text("{}")
+        (self.accounts[0] / "settings.json").symlink_to(custom)
+        result = self.run_prepare("apply")
+        self.assertNotEqual(result.returncode, 0)
+        self.assertTrue((self.accounts[0] / "settings.json").is_symlink())
+        self.assertFalse((self.home / ".claude" / "projects").exists())
+
+
+if __name__ == "__main__":
+    unittest.main()

package/tests/test_codex_reset_credits.py

@@ -81,6 +81,48 @@ class SpendableCreditsTest(unittest.TestCase):
         self.assertIsNone(credit_view({**value, "fetched_at": "2026-10-04T12:00:00"}, NOW))
         self.assertIsNone(credit_view({**value, "fetched_at": {}}, NOW))
 
+    def test_soft_failure_never_erases_a_known_auth_or_identity_failure(self):
+        previous = snapshot_from_usage(payload(), "account-test", NOW)
+        for error in ("unauthenticated", "account_mismatch"):
+            failed = failed_credits(previous, error, NOW + 10)
+            retry = failed_credits(failed, "network_unreachable", NOW + 20)
+            self.assertEqual(retry["last_error"], error)
+            self.assertEqual(retry["last_error_at"], failed["last_error_at"])
+            self.assertNotIn("last_error", collect_credits(payload(), "account-test", NOW + 30, retry))
+
+    def test_transport_failure_diagnostics_preserve_paid_balance_and_its_timestamp(self):
+        previous = snapshot_from_usage(payload(), "account-test", NOW)
+        for error in ("network_unreachable", "dns_unavailable", "usage_timeout", "http_401", "http_403"):
+            failed = failed_credits(previous, error, NOW + 10)
+            self.assertEqual(failed["last_error"], error)
+            self.assertEqual(failed["balance"], previous["balance"])
+            self.assertEqual(failed["fetched_at"], previous["fetched_at"])
+
+    def test_missing_credit_schema_does_not_hide_identity_mismatch(self):
+        previous = snapshot_from_usage(payload(), "account-test", NOW)
+        result = collect_credits({"account_id": "other"}, "account-test", NOW + 10, previous)
+        self.assertEqual(result["last_error"], "account_mismatch")
+
+    def test_missing_balance_keeps_money_but_obeys_new_spend_control(self):
+        previous = snapshot_from_usage(payload(), "account-test", NOW)
+        for raw in (payload(credits={"has_credits": True, "unlimited": False, "balance": None}),
+                    payload(credits=None)):
+            raw["spend_control_reached"] = True
+            result = collect_credits(raw, "account-test", NOW + 10, previous)
+            self.assertEqual(result["balance"], previous["balance"])
+            self.assertEqual(result["fetched_at"], previous["fetched_at"])
+            self.assertTrue(result["spend_control_reached"])
+            self.assertIn(result["last_error"], ("invalid_credits", "missing_credits"))
+
+    def test_partial_read_never_clears_previous_spending_restrictions(self):
+        previous = snapshot_from_usage(payload(spend_control_reached=True,
+            rate_limit_reached_type="workspace_member_usage_limit_reached"), "account-test", NOW)
+        raw = payload(credits=None, spend_control_reached=False, rate_limit_reached_type="rate_limit_reached")
+        result = collect_credits(raw, "account-test", NOW + 10, previous)
+        self.assertTrue(result["spend_control_reached"])
+        self.assertEqual(result["limit_reached_type"], "workspace_member_usage_limit_reached")
+        self.assertFalse(collect_credits(payload(), "account-test", NOW + 20, result)["spend_control_reached"])
+
     def test_admission_facts_are_never_inferred_from_percentages(self):
         raw = payload(rate_limit={"primary_window": {"used_percent": 0}})
         snapshot = snapshot_from_usage(raw, "account-test", NOW)

package/tests/test_codex_reset_credits_polling.py

@@ -1,10 +1,12 @@
 """Existing Codex usage polling carries paid balances without extra provider requests."""
 
 import json
+from datetime import datetime
 import os
 import subprocess
 import time
 import unittest
+from unittest.mock import patch
 
 import test_codex_reset as fixtures
 
@@ -50,7 +52,7 @@ class CreditPollingTest(fixtures.CodexPoolSandbox, unittest.TestCase):
         self.assertEqual(listed["accounts"][0]["usage"]["credits"]["balance"], "61812.452075")
         self.assertEqual(self.server.state["usage_gets"], 1)
 
-    def test_missing_credit_read_preserves_previous_amount_as_unusable(self):
+    def test_missing_credit_read_preserves_previous_amount_and_reports_staleness(self):
         self.command("limits", "--force", "--quiet")
         path = self.pool / "acct-01/limits.json"
         before = json.loads(path.read_text())["credits"]
@@ -80,6 +82,61 @@ class CreditPollingTest(fixtures.CodexPoolSandbox, unittest.TestCase):
         self.assertEqual(stored["credits"]["balance"], "61812.452075")
         self.assertIsNone(stored["credits"]["ordinary_usage_allowed"])
 
+    def test_success_timestamp_is_after_response_instead_of_pass_start(self):
+        original = fixtures.ResetHandler.do_GET
+        observed = []
+
+        def delayed(handler):
+            if handler.path == "/wham/usage":
+                time.sleep(0.05)
+                observed.append(time.time())
+            original(handler)
+
+        with patch.object(fixtures.ResetHandler, "do_GET", delayed):
+            self.command("limits", "--force", "--quiet")
+        stored = json.loads((self.pool / "acct-01/limits.json").read_text())
+        fetched = datetime.fromisoformat(stored["credits"]["fetched_at"].replace("Z", "+00:00")).timestamp()
+        self.assertGreaterEqual(fetched, observed[0])
+        self.assertEqual(stored["fetched_at"], int(fetched))
+
+    def test_failed_http_read_keeps_balance_and_next_pass_honors_backoff(self):
+        self.command("limits", "--force", "--quiet")
+        path = self.pool / "acct-01/limits.json"
+        previous = json.loads(path.read_text())
+        original = fixtures.ResetHandler.do_GET
+        calls = []
+
+        def unavailable(handler):
+            if handler.path == "/wham/usage":
+                calls.append(time.time())
+                handler.send_error(503)
+            else:
+                original(handler)
+
+        with patch.object(fixtures.ResetHandler, "do_GET", unavailable):
+            self.command("limits", "--force", "--quiet")
+            stored = json.loads(path.read_text())
+            self.assertEqual(stored["credits"]["balance"], previous["credits"]["balance"])
+            self.assertEqual(stored["credits"]["fetched_at"], previous["credits"]["fetched_at"])
+            self.assertEqual(stored["credits"]["last_error"], "http_error")
+            self.assertGreaterEqual(stored["last_error_at"], int(calls[-1]))
+            stored["fetched_at"] = 0
+            path.write_text(json.dumps(stored))
+            self.command("limits", "--quiet")
+        self.assertEqual(len(calls), 2)
+
+    def test_legacy_429_backoff_keeps_its_existing_diagnostic(self):
+        path = self.pool / "acct-01/limits.json"
+        for error in (None, "http_429", "network_unreachable"):
+            previous = {"fetched_at": 0, "retry_after": int(time.time()) + 300}
+            if error is not None:
+                previous["last_error"] = error
+            path.write_text(json.dumps(previous))
+            result = self.command("limits")
+            reason = "usage read failure" if error == "network_unreachable" else "429"
+            self.assertIn(f"acct-01: backing off after {reason}", result.stdout)
+        self.assertEqual(self.server.state["usage_gets"], 0)
+
     def test_earned_reset_requires_new_usage_before_authorizing_paid_fallback(self):
         self.server.state["responses"] = [(200, {"code": "reset", "windows_reset": 1})]
         self.command("limits", "--force", "--quiet", auto_reset="1")

package/tests/test_codex_reset_fetch.py

@@ -0,0 +1,123 @@
+"""Network failures retain usage evidence, retry safely, and never steal a live poller's lock."""
+
+from contextlib import contextmanager
+from email.message import Message
+import errno
+import io
+import json
+import os
+from pathlib import Path
+import socket
+import sys
+import tempfile
+import time
+import unittest
+from unittest.mock import patch
+import urllib.error
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "lib"))
+from codex_limits_lock import change_lock
+from codex_usage_fetch import failure_kind, fetch_usage, retry_delay
+
+
+def http_error(code, **headers):
+    message = Message()
+    for key, value in headers.items():
+        message[key] = value
+    result = urllib.error.HTTPError("https://example.invalid/usage", code, "failure", message, io.BytesIO())
+    result.close()
+    return result
+
+
+@contextmanager
+def response(value):
+    yield io.BytesIO(json.dumps(value).encode())
+
+
+class UsageFetchTest(unittest.TestCase):
+    def test_transient_route_failure_retries_once_and_returns_response(self):
+        failed = urllib.error.URLError(OSError(errno.EHOSTUNREACH, "No route to host"))
+        with patch("codex_usage_fetch.urllib.request.urlopen", side_effect=[failed, response({"credits": {}})]) as read:
+            self.assertEqual(fetch_usage("request"), {"credits": {}})
+        self.assertEqual(read.call_count, 2)
+
+    def test_dns_failure_is_bounded_to_two_requests(self):
+        failed = urllib.error.URLError(socket.gaierror(socket.EAI_AGAIN, "unavailable"))
+        with patch("codex_usage_fetch.urllib.request.urlopen", side_effect=failed) as read:
+            with self.assertRaises(urllib.error.URLError):
+                fetch_usage("request")
+        self.assertEqual(read.call_count, 2)
+        self.assertEqual(failure_kind(failed), "dns_unavailable")
+
+    def test_elapsed_budget_prevents_retry_after_slow_failure(self):
+        with patch("codex_usage_fetch.time.monotonic", side_effect=[0, 0, 16]), \
+             patch("codex_usage_fetch.urllib.request.urlopen", side_effect=TimeoutError()) as read:
+            with self.assertRaises(TimeoutError):
+                fetch_usage("request")
+        self.assertEqual(read.call_count, 1)
+        self.assertEqual(read.call_args.kwargs["timeout"], 10)
+
+    def test_http_auth_and_rate_limits_never_retry_immediately(self):
+        for code in (401, 403, 429):
+            with self.subTest(code=code), \
+                 patch("codex_usage_fetch.urllib.request.urlopen", side_effect=http_error(code)) as read:
+                with self.assertRaises(urllib.error.HTTPError):
+                    fetch_usage("request")
+                self.assertEqual(read.call_count, 1)
+
+    def test_transient_provider_error_retries_unless_retry_after_present(self):
+        for error, count in ((http_error(503), 2), (http_error(503, **{"Retry-After": "60"}), 1)):
+            with patch("codex_usage_fetch.urllib.request.urlopen", side_effect=error) as read:
+                with self.assertRaises(urllib.error.HTTPError):
+                    fetch_usage("request")
+                self.assertEqual(read.call_count, count)
+
+    def test_retry_after_seconds_and_date_are_honored(self):
+        self.assertEqual(retry_delay(http_error(429, **{"Retry-After": "2100"}), {}, 0), 2100)
+        self.assertEqual(retry_delay(http_error(429, **{"Retry-After": "Thu, 01 Jan 1970 00:02:00 GMT"}), {}, 10), 110)
+        self.assertEqual(retry_delay(TimeoutError(), {"backoff": 600}, 0), 900)
+        self.assertEqual(retry_delay(http_error(429), {"backoff": 1200}, 0), 1800)
+
+    def test_precise_safe_failures_and_edge_challenge(self):
+        self.assertEqual(failure_kind(urllib.error.URLError(OSError(errno.EHOSTUNREACH, "secret"))),
+                         "network_unreachable")
+        self.assertEqual(failure_kind(TimeoutError("secret")), "usage_timeout")
+        self.assertEqual(failure_kind(http_error(403, **{"cf-mitigated": "challenge"})), "edge_challenge")
+        with patch("codex_usage_fetch.urllib.request.urlopen", return_value=response([])) as read:
+            with self.assertRaises(ValueError) as result:
+                fetch_usage("request")
+            self.assertEqual(failure_kind(result.exception), "invalid_usage")
+        self.assertEqual(read.call_count, 1)
+
+
+class UsageLockTest(unittest.TestCase):
+    def test_old_live_collector_is_not_replaced_and_wrong_owner_cannot_release(self):
+        with tempfile.TemporaryDirectory(prefix="codex-lock-test-") as directory:
+            path = Path(directory) / "limits"
+            with patch("codex_limits_lock.process_birth", side_effect=lambda pid: str(pid)):
+                self.assertTrue(change_lock(path, 11))
+                os.utime(path, (time.time() - 600, time.time() - 600))
+                self.assertFalse(change_lock(path, 12))
+                self.assertFalse(change_lock(path, 12, release=True))
+                self.assertTrue(change_lock(path, 11, release=True))
+
+    def test_dead_owner_is_reclaimed_without_waiting_for_age(self):
+        with tempfile.TemporaryDirectory(prefix="codex-lock-test-") as directory:
+            path = Path(directory) / "limits"
+            path.mkdir()
+            (path / "owner.json").write_text(json.dumps({"pid": 11, "birth": "old"}))
+            with patch("codex_limits_lock.process_birth", side_effect=lambda pid: "new" if pid == 12 else ""):
+                self.assertTrue(change_lock(path, 12))
+                self.assertTrue(change_lock(path, 12, release=True))
+
+    def test_reused_pid_cannot_keep_abandoned_lock(self):
+        with tempfile.TemporaryDirectory(prefix="codex-lock-test-") as directory:
+            path = Path(directory) / "limits"
+            path.mkdir()
+            (path / "owner.json").write_text(json.dumps({"pid": 11, "birth": "old"}))
+            with patch("codex_limits_lock.process_birth", return_value="new"):
+                self.assertTrue(change_lock(path, 12))
+
+
+if __name__ == "__main__":
+    unittest.main()

package/tests/test_selector_cached_credits.py

@@ -0,0 +1,135 @@
+"""Cached confirmed funds remain usable through telemetry outages, without an age cap."""
+
+import json
+import unittest
+
+from test_selector import NOW, _request
+from test_selector_credits import _paid
+import test_selector_credit_shim as shim_fixtures
+from selector_policy import select
+
+SOFT_ERRORS = (None, "usage_read_failed", "http_401", "http_403", "http_429", "invalid_usage",
+               "network_unreachable", "dns_unavailable", "usage_timeout", "tls_error", "connection_reset")
+
+
+class CachedCreditTests(unittest.TestCase):
+    def test_cached_positive_survives_every_soft_error_without_fallback_age_limit(self):
+        for error in SOFT_ERRORS:
+            with self.subTest(error=error):
+                row = _paid()
+                row["credits"].update(fetched_at="2020-01-01T00:00:00Z", stale=True, last_error=error,
+                                      last_error_at=NOW)
+                response = select(_request([row], credit_fallback=True, credit_max_age_seconds=30))
+                self.assertTrue(response["ok"], response)
+                self.assertEqual(response["funding_tier"], "credits")
+                self.assertEqual(response["score_basis"]["credit_balance"], "61812.452075")
+
+    def test_cached_unlimited_remains_distinct_from_finite_zero(self):
+        row = _paid()
+        row["credits"].update(fetched_at="2020-01-01T00:00:00Z", stale=True,
+                              last_error="http_429", unlimited=True, balance="0", has_credits=False)
+        self.assertTrue(select(_request([row], credit_fallback=True))["ok"])
+        row["credits"]["unlimited"] = False
+        self.assertFalse(select(_request([row], credit_fallback=True))["ok"])
+
+    def test_newer_confirmed_zero_wins_over_old_positive_with_later_refresh_failure(self):
+        old, zero = _paid(account_id="old"), _paid(account_id="zero")
+        old["credits"].update(fetched_at="2020-01-01T00:00:00Z", last_error="network_unreachable",
+                              last_error_at="2026-08-25T09:00:00Z", stale=True)
+        zero["credits"].update(balance="0", fetched_at="2026-08-25T08:00:00Z", stale=True)
+        self.assertFalse(select(_request([old, zero], credit_fallback=True))["ok"])
+        for error in ("unauthenticated", "account_mismatch", "refusal_read_failed"):
+            zero["credits"]["last_error"] = error
+            self.assertFalse(select(_request([old, zero], credit_fallback=True))["ok"])
+        zero["credits"].pop("last_error")
+        zero["credits"].update(balance="80", has_credits=False)
+        self.assertFalse(select(_request([old, zero], credit_fallback=True))["ok"])
+        zero["credits"]["has_credits"] = True
+        result = select(_request([old, zero], credit_fallback=True))
+        self.assertTrue(result["ok"])
+        self.assertEqual(result["score_basis"]["credit_balance"], "80")
+
+    def test_new_unknown_read_does_not_replace_confirmed_wallet_money(self):
+        old, unknown = _paid(account_id="old"), _paid(account_id="unknown")
+        old["credits"].update(fetched_at="2020-01-01T00:00:00Z", stale=True,
+                              last_error="network_unreachable")
+        unknown["credits"].update(fetched_at=NOW, balance=None)
+        response = select(_request([old, unknown], credit_fallback=True))
+        self.assertTrue(response["ok"])
+        self.assertEqual(response["score_basis"]["credit_balance"], "61812.452075")
+        unknown["credits"]["has_credits"] = False
+        self.assertFalse(select(_request([old, unknown], credit_fallback=True))["ok"])
+        unknown["credits"].update(has_credits=True, balance="0")
+        self.assertFalse(select(_request([old, unknown], credit_fallback=True))["ok"])
+        unknown["credits"]["balance"] = None
+        old["credits"]["balance"] = None
+        self.assertFalse(select(_request([old, unknown], credit_fallback=True))["ok"])
+
+    def test_cached_read_cannot_erase_actual_paid_refusal_even_after_cooldown(self):
+        row = _paid()
+        row.update(limited_reason="credits", credit_blocked_at="2026-08-25T08:00:00Z",
+                   credit_blocked_balance="1")
+        for patch in ({"fetched_at": "2026-08-25T08:01:00Z"},
+                      {"fetched_at": NOW, "last_error": "http_429"},
+                      {"fetched_at": NOW, "stale": True}):
+            with self.subTest(patch=patch):
+                candidate = dict(row, credits=dict(row["credits"], **patch))
+                self.assertFalse(select(_request([candidate], credit_fallback=True))["ok"])
+        self.assertTrue(select(_request([row], credit_fallback=True))["ok"])
+
+    def test_newer_actor_restriction_wins_over_later_failed_refresh_of_old_allowance(self):
+        old, denied = _paid(account_id="old"), _paid(account_id="denied")
+        for row in (old, denied):
+            row["credit_actor_email"] = "same@example.com"
+        old["credits"].update(fetched_at="2020-01-01T00:00:00Z", last_error="http_429", last_error_at=NOW)
+        denied["credits"].update(fetched_at="2026-08-25T08:00:00Z", spend_control_reached=True)
+        self.assertFalse(select(_request([old, denied], credit_fallback=True))["ok"])
+        old["credits"]["fetched_at"] = denied["credits"]["fetched_at"]
+        self.assertFalse(select(_request([old, denied], credit_fallback=True))["ok"])
+        denied["credit_actor_email"] = "different@example.com"
+        self.assertEqual(select(_request([old, denied], credit_fallback=True))["account_id"], "old")
+
+    def test_failed_partial_read_restriction_is_not_erased_by_peer_monetary_timestamp(self):
+        blocked, peer = _paid(account_id="blocked"), _paid(account_id="peer")
+        for row in (blocked, peer):
+            row["credit_actor_email"] = "same@example.com"
+        blocked["credits"].update(fetched_at="2020-01-01T00:00:00Z", spend_control_reached=True,
+                                  last_error="invalid_credits", last_error_at=NOW)
+        self.assertFalse(select(_request([blocked, peer], credit_fallback=True))["ok"])
+        blocked["credits"].update(spend_control_reached=False, limit_reached_type="unknown")
+        self.assertFalse(select(_request([blocked, peer], credit_fallback=True))["ok"])
+        peer["credit_actor_email"] = "other@example.com"
+        self.assertEqual(select(_request([blocked, peer], credit_fallback=True))["account_id"], "peer")
+        peer["credit_actor_email"] = "same@example.com"
+        blocked["credits"].update(last_error=None, fetched_at=NOW, limit_reached_type="rate_limit_reached")
+        self.assertTrue(select(_request([blocked, peer], credit_fallback=True))["ok"])
+
+    def test_refusal_still_propagates_across_same_actor_copies_when_refresh_failed(self):
+        blocked, peer = _paid(account_id="blocked"), _paid(account_id="peer")
+        for row in (blocked, peer):
+            row["credit_actor_email"] = "same@example.com"
+        blocked.update(limited_reason="credits", credit_blocked_at="2026-08-25T08:59:59Z",
+                       credit_blocked_balance="61812.452075")
+        blocked["credits"].update(last_error="network_unreachable", stale=True)
+        self.assertFalse(select(_request([blocked, peer], credit_fallback=True))["ok"])
+
+    def test_standalone_shim_accepts_cached_funds_and_keeps_durable_refusal(self):
+        case = shim_fixtures.CreditShimTests()
+        case.setUp()
+        self.addCleanup(case.doCleanups)
+        directory = case.account("acct-01", fetched_at="2020-01-01T00:00:00Z", stale=True,
+                                 last_error="network_unreachable")
+        self.assertIn("tier=credits", case.run_shim().stdout)
+        result = case.run_shim(False, FAKE_ERROR="You've hit your usage limit")
+        self.assertEqual(result.returncode, 1)
+        self.assertIn("tier=hard", case.run_shim().stdout)
+        receipt = json.loads((directory / ".credit-refused.json").read_text())
+        receipt["credit_blocked_at"] = "2019-01-01T00:00:00Z"
+        (directory / ".credit-refused.json").write_text(json.dumps(receipt))
+        self.assertIn("tier=hard", case.run_shim().stdout)
+        case.account("acct-01")
+        self.assertIn("tier=credits", case.run_shim().stdout)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/tests/test_selector_credit_scope.py

@@ -33,10 +33,10 @@ class CreditScopeTests(unittest.TestCase):
         peer.update(runner_id=4, account_id="blocked")
         self.assertEqual(select(_request([blocked, peer], credit_fallback=True))["runner_id"], 4)
 
-    def test_peer_wallet_cannot_erase_local_auth_identity_or_read_failure(self):
+    def test_peer_wallet_cannot_erase_local_auth_identity_or_refusal_read_failure(self):
         failed, busy = _paid(account_id="failed"), _paid(account_id="busy")
         busy["reservation_history"]["active_expires_at"] = "2026-08-25T09:05:00Z"
-        for error in ("account_mismatch", "unauthenticated", "http_401", "usage_read_failed"):
+        for error in ("account_mismatch", "unauthenticated", "refusal_read_failed"):
             with self.subTest(error=error):
                 failed["credits"].update(last_error=error, fetched_at="2026-08-25T08:59:00Z")
                 self.assertFalse(select(_request([failed, busy], credit_fallback=True))["ok"])
@@ -59,14 +59,14 @@ class CreditScopeTests(unittest.TestCase):
         busy["reservation_history"]["active_expires_at"] = "2026-08-25T09:05:00Z"
         self.assertFalse(select(_request([blocked, busy], credit_fallback=True))["ok"])
 
-    def test_latest_failed_financial_observation_does_not_revive_old_positive_balance(self):
+    def test_failed_refresh_does_not_replace_latest_confirmed_monetary_observation(self):
         old, failed = _paid(account_id="old"), _paid(account_id="failed")
         old["credits"]["fetched_at"] = "2026-08-25T08:59:00Z"
         failed["credits"].update(fetched_at="2026-08-25T08:58:00Z", last_error="usage_read_failed",
                                   last_error_at="2026-08-25T09:00:00Z")
-        self.assertFalse(select(_request([old, failed], credit_fallback=True))["ok"])
-        old["credits"]["fetched_at"] = "2026-08-25T09:00:01Z"
         self.assertTrue(select(_request([old, failed], credit_fallback=True))["ok"])
+        old["credits"]["balance"] = "0"
+        self.assertFalse(select(_request([old, failed], credit_fallback=True))["ok"])
 
     def test_standalone_refusal_is_shared_only_for_same_manifest_actor(self):
         case = shim_fixtures.CreditShimTests()

package/tests/test_selector_credit_shim.py

@@ -74,9 +74,9 @@ class CreditShimTests(unittest.TestCase):
         (self.pool / "acct-03" / "auth.json").unlink()
         self.assertIn("tier=hard", self.run_shim(CODEX_MULTIACC_CREDITS="0").stdout)
 
-    def test_zero_unknown_stale_spend_control_and_auth_never_paid(self):
-        for patch in ({"balance": "0"}, {"balance": None}, {"last_error": "usage_read_failed"},
-                      {"fetched_at": "2020-01-01T00:00:00Z"}, {"spend_control_reached": True},
+    def test_zero_unknown_future_spend_control_and_auth_never_paid(self):
+        for patch in ({"balance": "0"}, {"balance": None}, {"last_error": "unauthenticated"},
+                      {"fetched_at": "2099-01-01T00:00:00Z"}, {"spend_control_reached": True},
                       {"account_id": None}, {"limit_reached_type": "workspace_owner_credits_depleted"}):
             with self.subTest(patch=patch):
                 self.account("acct-01", **patch)

package/tests/test_selector_credits.py

@@ -52,8 +52,9 @@ class FundingSelectionTests(unittest.TestCase):
     def test_credits_fail_closed_for_all_restrictions(self):
         bad_credits = ({"balance": "0"}, {"balance": None}, {"balance": "NaN"},
                        {"balance": "-1"}, {"has_credits": False}, {"account_id": None},
-                       {"fetched_at": "2026-08-25T08:44:59Z"}, {"fetched_at": "2026-08-25T09:00:31Z"},
-                       {"last_error": "usage_read_failed"}, {"spend_control_reached": True},
+                       {"fetched_at": None}, {"fetched_at": "2026-08-25T09:00:31Z"},
+                       {"last_error": "unauthenticated"}, {"last_error": "refusal_read_failed"},
+                       {"spend_control_reached": True},
                        {"limit_reached_type": "workspace_owner_usage_limit_reached"},
                        {"limit_reached_type": "unknown"})
         for patch in bad_credits: