From a1d320dcd593c0aee8413f0d1fec83b32bae861a Mon Sep 17 00:00:00 2001
From: Craig Weber <crgwbr@gmail.com>
Date: Fri, 17 Jul 2026 13:28:32 -0400
Subject: [PATCH] fix: distinguish account organizations sharing an email

Key saved credentials and per-account state by normalized email and organization UUID. Preserve legacy credential slots while validating captures, OAuth logins, switching, and cached usage against the exact organization.
---
 .claude/skills/verify/SKILL.md                |  15 +-
 CHANGELOG.md                                  |   8 +
 CONTRIBUTING.md                               |   5 +-
 README.md                                     |  18 +-
 Sources/PitStop/AppDelegate.swift             | 333 +++++++++++-------
 Sources/PitStop/ClaudeDesktop.swift           |   5 +
 Sources/PitStop/ClaudeLoginAdapter.swift      |  20 +-
 Sources/PitStop/CodexLoginAdapter.swift       |  15 +-
 Sources/PitStop/Credentials.swift             |  27 +-
 Sources/PitStop/GeminiLoginAdapter.swift      |  13 +-
 Sources/PitStop/Keychain.swift                |   3 +-
 Sources/PitStop/OAuthLogin.swift              |  25 +-
 Sources/PitStop/OAuthLoginCoordinator.swift   |  37 +-
 Sources/PitStop/ProfileStore.swift            | 219 ++++++++----
 Sources/PitStop/UsageAPI.swift                |  35 +-
 Sources/PitStop/UsageCache.swift              |  28 ++
 Sources/PitStop/main.swift                    |  13 +-
 Tests/PitStopTests/ClaudeExchangeTests.swift  |  17 +
 .../ClaudeOrganizationTests.swift             |  38 ++
 .../GeminiLoginAdapterTests.swift             |   8 +-
 Tests/PitStopTests/LoginAdapterTests.swift    |  13 +-
 .../OAuthLoginCoordinatorTests.swift          |  42 ++-
 .../ProfileStoreCaptureTests.swift            | 328 +++++++++++++----
 Tests/PitStopTests/UsageCacheTests.swift      |  35 ++
 24 files changed, 946 insertions(+), 354 deletions(-)
 create mode 100644 Tests/PitStopTests/ClaudeOrganizationTests.swift

diff --git a/.claude/skills/verify/SKILL.md b/.claude/skills/verify/SKILL.md
index 32cd355..2d2587c 100644
--- a/.claude/skills/verify/SKILL.md
+++ b/.claude/skills/verify/SKILL.md
@@ -27,12 +27,14 @@ description: How to build, run, and E2E-verify PitStop changes — headless --ch
 Replicates the "two accounts show the same usage" corruption safely:
 
 1. Back up `~/.config/pitstop/profiles.json`.
-2. Copy a real profile's blob:
-   `security find-generic-password -s "PitStop-profile" -a <real-email> -w`
+2. Copy a real profile's blob using that row's `credentialAccount` from
+   `profiles.json`:
+   `security find-generic-password -s "PitStop-profile" -a <credentialAccount> -w`
 3. File it under a fake email:
    `security add-generic-password -s "PitStop-profile" -a poisoned-test@example.com -w "<blob>"`
    and append a matching row to profiles.json (copy the real row, change
-   `email` + `oauthAccount.emailAddress`).
+   `email`, `oauthAccount.emailAddress`, `oauthAccount.organizationUuid`, and
+   `credentialAccount`).
 4. Quit installed app, launch dev binary, wait one cycle.
 5. Expect: fake keychain item deleted by the audit (`security find… -a
    poisoned-test@example.com` exits 44), row gated in the menu with
@@ -46,9 +48,10 @@ Replicates "app relaunched during a 429" without touching the network:
 
 1. Quit the installed app. `~/.config/pitstop/usage-cache.json` holds the
    display state (dates are seconds since 2001-01-01 — unix minus 978307200).
-2. Edit it: set `fetchError["<email>"] = "Rate limited"`,
-   `nextFetchAllowed["<email>"] = now + 600`, and age that account's
-   `usage[<email>].fetchedAt` back ~15 min.
+2. Edit it using the row's provider-namespaced account key: set
+   `fetchError["<account-key>"] = "Rate limited"`,
+   `nextFetchAllowed["<account-key>"] = now + 600`, and age that account's
+   `usage[<account-key>].fetchedAt` back ~15 min.
 3. Relaunch. Expect: the row still shows its bars, plus
    "⚠ Rate limited — retrying in 9m · showing <time> data"; the account is
    NOT re-fetched until the backoff passes (persisted backoff honored).
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 222fa02..4cbd22c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,14 @@ appear on [GitHub Releases](https://github.com/Livin21/pitstop/releases).
 
 ## [Unreleased]
 
+### Fixed
+- **Claude organizations sharing one email collapsed into one account.** Claude
+  profiles, keychain snapshots, usage state, Desktop merging, login validation,
+  and auto-switching are now keyed by email plus organization UUID. Team and
+  personal subscriptions using the same email display independent limits and
+  switch independently; the existing email-keyed snapshot is preserved during
+  migration, and subsequent organizations receive distinct keychain slots.
+
 ## [0.6.0] - 2026-09-07
 ### Added
 - **OpenCode Go usage.** A fourth provider section, read-only: PitStop reads
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 4c2b8b3..203fac1 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -42,8 +42,9 @@ rides the Apple-signed `/usr/bin/security`.)
 - Keep it pure AppKit plus the small SwiftUI settings window. The app
   intentionally has **no third-party dependencies** — don't add one without a
   strong reason.
-- Per-account state is keyed by a provider-namespaced key (e.g. `codex:<email>`)
-  so accounts sharing an email across providers don't collide. Preserve that.
+- Per-account state is keyed by a provider-namespaced stable identity (e.g.
+  `codex:<email>` or Claude's email + organization UUID) so accounts sharing
+  an email across providers or Claude organizations don't collide. Preserve that.
 
 ## Adding a provider
 
diff --git a/README.md b/README.md
index 15c4900..da60ef8 100644
--- a/README.md
+++ b/README.md
@@ -26,8 +26,9 @@ What shows up where:
 
 - **Claude Code** accounts are switchable. **Claude Desktop** (a *different*
   login) shows read-only, tagged **Desktop**; an account signed into both Code
-  and Desktop is one shared usage pool, so it stays a single row tagged
-  **Code · Desktop**.
+  and Desktop in the same organization is one shared usage pool, so it stays a
+  single row tagged **Code · Desktop**. The same email in multiple Claude
+  organizations stays separate, with its org/plan chip identifying each row.
 - **OpenAI Codex** accounts are switchable too — its login lives in
   `~/.codex/auth.json` (shared by the Codex CLI and the Codex app), which
   PitStop snapshots per account and swaps the same way it swaps the Claude
@@ -143,7 +144,8 @@ Or set it up manually:
   launch at login.
 - **Accounts** are snapshots of the Claude Code credential blob:
   - secrets live in the **keychain** (service `PitStop-profile`, one item
-    per account email) — never written to disk;
+    per email + Claude organization; upgraded installs retain their original
+    email-named item for the already-saved account) — never written to disk;
   - non-secret identity (email, org, plan) lives in
     `~/.config/pitstop/profiles.json`.
 - **Claude Desktop** (the chat app) is read separately and read-only. It
@@ -224,9 +226,10 @@ Or set it up manually:
 
 ## Adding a second account
 
-PitStop can only switch between accounts it has snapshotted, and it snapshots
-whatever is *live* on each refresh — so seed each account by being logged into
-it once while PitStop runs:
+PitStop can only switch between accounts/organizations it has snapshotted, and
+it snapshots whatever is *live* on each refresh — so seed each one by being
+logged into it once while PitStop runs. This includes two Claude organizations
+that use the same email:
 
 1. PitStop auto-saves whatever account is currently live.
 2. Sign in with the **other** account — Claude Code: run `/login`; Codex: run
@@ -234,7 +237,8 @@ it once while PitStop runs:
    sign in from the `gemini` CLI or Antigravity (both share the Google login).
 3. PitStop notices it on the next refresh and saves it too (for Claude you can
    also click **Save Current Account**).
-4. Both accounts now appear in the menu — click either to switch.
+4. Both accounts now appear in the menu — same-email Claude rows are
+   distinguished by their org/plan chips — and you can click either to switch.
 
 ## What switching means for running sessions
 
diff --git a/Sources/PitStop/AppDelegate.swift b/Sources/PitStop/AppDelegate.swift
index e90ad40..21ea752 100644
--- a/Sources/PitStop/AppDelegate.swift
+++ b/Sources/PitStop/AppDelegate.swift
@@ -73,17 +73,33 @@ enum Provider: CaseIterable {
     }
 }
 
-/// One row in the menu. Within a provider, accounts merge by email — the same
-/// Claude account signed into both Claude Code and Claude Desktop is one shared
-/// usage pool, so one row. Across providers they don't: a Claude and a Codex
-/// account can share an email yet be different services, so per-account state
-/// is keyed by `key` (provider-namespaced), not bare email.
+/// One row in the menu. Claude Code and Desktop merge only when both email and
+/// organization match; same-email organizations remain independent rows.
 struct MenuAccount {
     enum Source { case code, desktop, both, codex, geminiCli, geminiAntigravity, geminiBoth, openCodeGo }
     var email: String
     var source: Source
     var planLabel: String
     var isActive: Bool
+    /// Opaque provider-namespaced key for usage/error/action state.
+    var key: String
+
+    init(email: String, source: Source, planLabel: String, isActive: Bool,
+         key: String? = nil) {
+        self.email = email
+        self.source = source
+        self.planLabel = planLabel
+        self.isActive = isActive
+        if let key { self.key = key }
+        else if source == .codex { self.key = "codex:\(email)" }
+        else if source == .geminiCli || source == .geminiAntigravity || source == .geminiBoth {
+            self.key = "gemini:\(email)"
+        } else if source == .openCodeGo {
+            self.key = "opencode:\(email)"
+        } else {
+            self.key = email // legacy/test fallback; production Claude rows pass an explicit org key
+        }
+    }
 
     var isCodex: Bool { source == .codex }
     var isGemini: Bool {
@@ -107,14 +123,6 @@ struct MenuAccount {
         case .desktop: return false
         }
     }
-    /// Storage key for usage/error/backoff dicts — namespaced by provider so a
-    /// Claude and a Codex account with the same email don't collide.
-    var key: String {
-        if isCodex { return "codex:\(email)" }
-        if isGemini { return "gemini:\(email)" }
-        if isOpenCode { return "opencode:\(email)" }
-        return email
-    }
     /// Which surface within the provider — shown as a small tag, since the
     /// provider itself is now the section header. Codex has one surface (the
     /// CLI and app share a login), so it needs none.
@@ -143,7 +151,7 @@ final class AppDelegate: NSObject, NSApplicationDelegate, NSMenuDelegate {
     private var backoffTimer: Timer?
 
     private let store = ProfileStore()
-    private var activeEmail: String?
+    private var activeClaudeKey: String?
     /// The account Claude Desktop is logged into, if any (read-only — PitStop
     /// can show its usage but can't switch it). Discovered on each refresh.
     private var desktopAccount: ClaudeDesktop.Account?
@@ -251,6 +259,21 @@ final class AppDelegate: NSObject, NSApplicationDelegate, NSMenuDelegate {
         return i < masks.count ? masks[i] : "account\(i + 1)@example.com"
     }
 
+    private func displayAccount(email: String, planLabel: String) -> String {
+        let shown = displayEmail(email)
+        return planLabel.isEmpty ? shown : "\(shown) · \(planLabel)"
+    }
+
+    private func displayClaudeAccount(key: String) -> String {
+        if let profile = store.profile(forKey: key) {
+            return displayAccount(email: profile.email, planLabel: profile.planLabel)
+        }
+        if let desktopAccount, desktopAccount.key == key {
+            return displayAccount(email: desktopAccount.email, planLabel: desktopAccount.planLabel)
+        }
+        return key
+    }
+
     func applicationDidFinishLaunching(_ notification: Notification) {
         restoreUsageCache()
         statusItem = NSStatusBar.system.statusItem(withLength: NSStatusItem.variableLength)
@@ -331,24 +354,44 @@ final class AppDelegate: NSObject, NSApplicationDelegate, NSMenuDelegate {
                 }
             }
             lastTopLevelError = nil
+            var rejectedClaudeKeys: Set<String> = []
 
             // Keep the saved copy of the live account in sync.
             do {
                 let capture = try await store.captureCurrent()
-                if capture.changed, let email = capture.profile?.email {
-                    credentialsRenewed(for: email)
+                if capture.changed, let key = capture.profile?.key {
+                    credentialsRenewed(for: key)
+                }
+            } catch let error as ProfileStore.CaptureError {
+                lastTopLevelError = error.localizedDescription
+                // A same-email organization mismatch must gate the active row
+                // too. Otherwise the loop below would deliberately skip its
+                // saved-profile audit and fetch usage with the foreign live
+                // token even though captureCurrent just rejected the pairing.
+                if case .mismatch(let owner, let expected) = error {
+                    rejectedClaudeKeys.insert(expected.key)
+                    usage[expected.key] = nil
+                    recordFetchError(ProfileStore.ForeignCredentialsError(
+                        owner: owner, expected: expected), for: expected.key)
+                } else if let expected = ClaudeConfig.activeIdentity() {
+                    // Verification could not complete, so this cycle must not
+                    // consume the unverified live pairing. Keep stale usage,
+                    // retry capture next cycle, and suppress warming/switching.
+                    rejectedClaudeKeys.insert(expected.key)
+                    recordFetchError(error, for: expected.key)
                 }
             } catch {
                 lastTopLevelError = error.localizedDescription
             }
             store.load()
-            activeEmail = ClaudeConfig.activeEmail()
+            activeClaudeKey = ClaudeConfig.activeIdentity()?.key
 
-            for profile in store.profiles where passedBackoffGate(profile.email) {
-                let email = profile.email
+            for profile in store.profiles
+            where !rejectedClaudeKeys.contains(profile.key) && passedBackoffGate(profile.key) {
+                let key = profile.key
                 do {
                     let (creds, source) = try await freshCredentials(
-                        for: email, isActive: email == activeEmail)
+                        for: profile, isActive: key == activeClaudeKey)
                     // Self-heal installs poisoned before capture-time
                     // verification existed: a row whose saved credentials
                     // belong to another account gets gated instead of
@@ -358,16 +401,17 @@ final class AppDelegate: NSObject, NSApplicationDelegate, NSMenuDelegate {
                     // to be this account's on the way out of the store.
                     if source == .saved,
                        case .poisoned(let owner) = await store.auditIdentity(
-                        email: email, accessToken: creds.accessToken) {
-                        usage[email] = nil
-                        recordFetchError(ProfileStore.ForeignCredentialsError(owner: owner),
-                                         for: email)
+                        profile: profile, accessToken: creds.accessToken) {
+                        usage[key] = nil
+                        let expected = profile.identity ?? owner
+                        recordFetchError(ProfileStore.ForeignCredentialsError(
+                            owner: owner, expected: expected), for: key)
                         continue
                     }
                     let report = try await UsageAPI.fetchUsage(accessToken: creds.accessToken)
-                    recordFetchSuccess(report, for: email)
+                    recordFetchSuccess(report, for: key)
                 } catch {
-                    recordFetchError(error, for: email)
+                    recordFetchError(error, for: key)
                 }
             }
 
@@ -398,7 +442,8 @@ final class AppDelegate: NSObject, NSApplicationDelegate, NSMenuDelegate {
     /// treatment. refreshAll still runs immediately; restored backoffs gate
     /// only the accounts that were mid-backoff when the app quit.
     private func restoreUsageCache() {
-        guard let snap = UsageCache.load() else { return }
+        guard let loaded = UsageCache.load() else { return }
+        let snap = loaded.migratingLegacyClaudeKeys(profiles: store.profiles)
         usage = snap.usage
         codexUsage = snap.codexUsage
         geminiUsage = snap.geminiUsage
@@ -434,14 +479,14 @@ final class AppDelegate: NSObject, NSApplicationDelegate, NSMenuDelegate {
         }
     }
 
-    /// True if `email` is clear to fetch. A future-dated backoff returns false
+    /// True if `key` is clear to fetch. A future-dated backoff returns false
     /// (keep showing stale data); a passed gate is cleared so entries are
     /// always future-dated or absent — `menuNeedsUpdate`'s retryDue check
     /// relies on that.
-    private func passedBackoffGate(_ email: String) -> Bool {
-        if let notBefore = nextFetchAllowed[email] {
+    private func passedBackoffGate(_ key: String) -> Bool {
+        if let notBefore = nextFetchAllowed[key] {
             if Date() < notBefore { return false }
-            nextFetchAllowed[email] = nil
+            nextFetchAllowed[key] = nil
         }
         return true
     }
@@ -463,25 +508,25 @@ final class AppDelegate: NSObject, NSApplicationDelegate, NSMenuDelegate {
         needsAction.remove(key)
     }
 
-    private func recordFetchSuccess(_ report: UsageReport, for email: String) {
-        usage[email] = report
-        clearFetchError(for: email)
+    private func recordFetchSuccess(_ report: UsageReport, for key: String) {
+        usage[key] = report
+        clearFetchError(for: key)
     }
 
-    /// Translate a fetch failure into the stale-display state for `email`,
+    /// Translate a fetch failure into the stale-display state for `key`,
     /// shared by the Code (OAuth) and Desktop (claude.ai) fetch paths.
-    private func recordFetchError(_ error: Error, for email: String) {
-        let fails = (failureCount[email] ?? 0) + 1
-        failureCount[email] = fails
+    private func recordFetchError(_ error: Error, for key: String) {
+        let fails = (failureCount[key] ?? 0) + 1
+        failureCount[key] = fails
         switch error {
         case UsageAPI.APIError.rateLimited(let retryAfter):
             // Respect Retry-After; otherwise exponential backoff
             // 2 min → 4 min → … capped at 15 min. Retry timing is rendered
             // from nextFetchAllowed at display time so it never goes stale.
             let delay = retryAfter ?? min(120 * pow(2, Double(fails - 1)), 900)
-            nextFetchAllowed[email] = Date().addingTimeInterval(delay)
-            fetchError[email] = "Rate limited"
-            needsAction.remove(email)
+            nextFetchAllowed[key] = Date().addingTimeInterval(delay)
+            fetchError[key] = "Rate limited"
+            needsAction.remove(key)
         case UsageAPI.APIError.unauthorized,
              ClaudeDesktop.DesktopError.sessionExpired,
              Codex.CodexError.sessionExpired,
@@ -493,13 +538,13 @@ final class AppDelegate: NSObject, NSApplicationDelegate, NSMenuDelegate {
             // the endpoint every cycle. Refresh Now (or a re-login noticed on
             // the next pass) clears this. It needs the user to act, so the row
             // shows the message without a misleading "retrying in …".
-            nextFetchAllowed[email] = Date().addingTimeInterval(3600)
-            fetchError[email] = (error as? LocalizedError)?.errorDescription
+            nextFetchAllowed[key] = Date().addingTimeInterval(3600)
+            fetchError[key] = (error as? LocalizedError)?.errorDescription
                 ?? error.localizedDescription
-            needsAction.insert(email)
+            needsAction.insert(key)
         default:
-            fetchError[email] = error.localizedDescription
-            needsAction.remove(email)
+            fetchError[key] = error.localizedDescription
+            needsAction.remove(key)
         }
     }
 
@@ -512,38 +557,39 @@ final class AppDelegate: NSObject, NSApplicationDelegate, NSMenuDelegate {
     /// rejected token), fall back to the healthy Desktop session here instead of
     /// discarding it and leaving the Code error on the merged row.
     private func refreshDesktopAccount() async {
-        let knownEmail = desktopAccount?.email
-        // Normally skip while the email's backoff is active — except when a
-        // same-email Code profile errored this cycle: that backoff is the Code
+        let knownKey = desktopAccount?.key
+        // Normally skip while this org's backoff is active — except when the
+        // exact matching Code profile errored this cycle: that backoff is the Code
         // failure's, and Desktop is a separate session worth trying as a fallback
         // (its own state is shared on this key, so the shared backoff is Code's).
-        let codeErrored = knownEmail.map { email in
-            store.profiles.contains(where: { $0.email == email }) && fetchError[email] != nil
+        let codeErrored = knownKey.map { key in
+            store.profiles.contains(where: { $0.key == key }) && fetchError[key] != nil
         } ?? false
-        guard codeErrored || (knownEmail.map(passedBackoffGate) ?? true) else { return }
+        guard codeErrored || (knownKey.map(passedBackoffGate) ?? true) else { return }
         do {
             guard let (account, report) = try await ClaudeDesktop.poll() else {
                 desktopAccount = nil
                 return
             }
             desktopAccount = account
-            // Record Desktop usage when no Code profile covers this email; when
+            let key = account.key
+            // Record Desktop usage when no Code profile covers this org; when
             // one does but its Code fetch failed this cycle, refresh the numbers
             // from the healthy Desktop session WITHOUT clearing the Code error,
             // backoff, or needs-action state — the Code credentials are still
             // broken, and clearing the gate here would retry the dead refresh
             // token every cycle and hide the re-login affordance.
-            if !store.profiles.contains(where: { $0.email == account.email }) {
-                recordFetchSuccess(report, for: account.email)
-            } else if fetchError[account.email] != nil {
-                usage[account.email] = report
+            if !store.profiles.contains(where: { $0.key == key }) {
+                recordFetchSuccess(report, for: key)
+            } else if fetchError[key] != nil {
+                usage[key] = report
             }
         } catch {
             // Keep the last-known identity so the row doesn't flicker out;
             // surface the error on it (unless a Code profile owns the email).
-            if let email = knownEmail,
-               !store.profiles.contains(where: { $0.email == email }) {
-                recordFetchError(error, for: email)
+            if let key = knownKey,
+               !store.profiles.contains(where: { $0.key == key }) {
+                recordFetchError(error, for: key)
             }
         }
     }
@@ -774,9 +820,9 @@ final class AppDelegate: NSObject, NSApplicationDelegate, NSMenuDelegate {
     /// OAuth refresh grant (and persisting the result) when needed. The source
     /// comes back with them: the store decides whether the live item really
     /// belongs to this account, so `isActive` is a request, not a verdict.
-    private func freshCredentials(for email: String, isActive: Bool) async throws
+    private func freshCredentials(for profile: Profile, isActive: Bool) async throws
         -> (creds: OAuthCredentials, source: ProfileStore.BlobSource) {
-        guard let stored = try await store.blob(for: email, isActive: isActive) else {
+        guard let stored = try await store.blob(for: profile, isActive: isActive) else {
             throw ProfileStore.StoreError(message: "No stored credentials")
         }
         var creds = try CredentialBlob.parse(stored.data)
@@ -789,7 +835,7 @@ final class AppDelegate: NSObject, NSApplicationDelegate, NSMenuDelegate {
                                                   accessToken: fresh.accessToken,
                                                   refreshToken: fresh.refreshToken,
                                                   expiresAtMs: fresh.expiresAtMs)
-        try await store.storeRefreshedBlob(patched, email: email, source: stored.source)
+        try await store.storeRefreshedBlob(patched, profile: profile, source: stored.source)
         creds.accessToken = fresh.accessToken
         creds.refreshToken = fresh.refreshToken ?? creds.refreshToken
         creds.expiresAtMs = fresh.expiresAtMs
@@ -837,14 +883,14 @@ final class AppDelegate: NSObject, NSApplicationDelegate, NSMenuDelegate {
     private func menuBarReading() -> MenuBarReading {
         switch Settings.menuBarSource {
         case .activeClaudeCode:
-            guard let email = activeEmail, let report = usage[email] else {
-                let tip = activeEmail.flatMap { fetchError[$0] } ?? "PitStop — no usage data yet"
+            guard let key = activeClaudeKey, let report = usage[key] else {
+                let tip = activeClaudeKey.flatMap { fetchError[$0] } ?? "PitStop — no usage data yet"
                 return MenuBarReading(pct: nil, isStale: false, tip: tip)
             }
             let util = IndicatorMetric.current.utilization(of: report)
             return MenuBarReading(pct: util.map { Int($0.rounded()) },
-                                  isStale: fetchError[email] != nil,
-                                  tip: statusTip(email: email, report: report))
+                                  isStale: fetchError[key] != nil,
+                                  tip: statusTip(key: key, report: report))
         case .mostUrgent:
             // Highest binding utilization across every account that has data.
             var best: (name: String, util: Double, stale: Bool)?
@@ -853,7 +899,9 @@ final class AppDelegate: NSObject, NSApplicationDelegate, NSMenuDelegate {
                     best = (name, util, fetchError[key] != nil)
                 }
             }
-            for (key, report) in usage { consider(key, displayEmail(key), report.maxUtilization) }
+            for (key, report) in usage {
+                consider(key, displayClaudeAccount(key: key), report.maxUtilization)
+            }
             for (key, cu) in codexUsage {
                 let email = String(key.dropFirst("codex:".count))
                 consider(key, "\(displayEmail(email)) (Codex)", cu.maxUtilization)
@@ -874,13 +922,13 @@ final class AppDelegate: NSObject, NSApplicationDelegate, NSMenuDelegate {
         }
     }
 
-    private func statusTip(email: String, report: UsageReport) -> String {
-        var tip = "\(displayEmail(email))\n5-hour \(Format.percent(report.fiveHour?.utilization))"
+    private func statusTip(key: String, report: UsageReport) -> String {
+        var tip = "\(displayClaudeAccount(key: key))\n5-hour \(Format.percent(report.fiveHour?.utilization))"
             + " · weekly \(Format.percent(report.sevenDay?.utilization))"
         for s in report.scoped {
             tip += " · \(s.label) \(Format.percent(s.window.utilization))"
         }
-        if let err = fetchError[email] {
+        if let err = fetchError[key] {
             tip += "\n⚠️ \(err) — showing data from \(Format.updated.string(from: report.fetchedAt))"
         }
         return tip
@@ -889,21 +937,22 @@ final class AppDelegate: NSObject, NSApplicationDelegate, NSMenuDelegate {
     // MARK: - Menu
 
     /// All rows to show — saved Code profiles, a Desktop-only Claude account,
-    /// and the Codex account. A Claude account on both Code and Desktop merges
-    /// into one row tagged `.both`; Codex is always its own row (different
-    /// provider, even when it shares an email).
+    /// and other providers. Claude Code and Desktop merge only for the same
+    /// email + organization identity.
     private func accountsForMenu() -> [MenuAccount] {
         var rows = store.profiles.map { profile -> MenuAccount in
-            let onDesktop = desktopAccount?.email == profile.email
+            let onDesktop = desktopAccount?.key == profile.key
             return MenuAccount(email: profile.email,
                                source: onDesktop ? .both : .code,
                                planLabel: profile.planLabel,
-                               isActive: profile.email == activeEmail)
+                               isActive: profile.key == activeClaudeKey,
+                               key: profile.key)
         }
         if let d = desktopAccount,
-           !store.profiles.contains(where: { $0.email == d.email }) {
+           !store.profiles.contains(where: { $0.key == d.key }) {
             rows.append(MenuAccount(email: d.email, source: .desktop,
-                                    planLabel: d.planLabel, isActive: false))
+                                    planLabel: d.planLabel, isActive: false,
+                                    key: d.key))
         }
         for c in codexStore.profiles {
             rows.append(MenuAccount(email: c.email, source: .codex,
@@ -996,8 +1045,8 @@ final class AppDelegate: NSObject, NSApplicationDelegate, NSMenuDelegate {
         // an email are distinguishable; the represented object is the
         // provider-namespaced key the remove action routes on.
         var removable: [(title: String, key: String)] = store.profiles
-            .filter { $0.email != activeEmail }
-            .map { (displayEmail($0.email), $0.email) }
+            .filter { $0.key != activeClaudeKey }
+            .map { (displayAccount(email: $0.email, planLabel: $0.planLabel), $0.key) }
         removable += codexStore.profiles
             .filter { $0.email != codexLiveEmail }
             .map { ("\(displayEmail($0.email)) · Codex", "codex:\($0.email)") }
@@ -1223,7 +1272,7 @@ final class AppDelegate: NSObject, NSApplicationDelegate, NSMenuDelegate {
             onSwitch: (canSwitch && !offerLogin) ? { [weak self] in
                 if isGemini { self?.performGeminiSwitch(to: email) }
                 else if isCodex { self?.performCodexSwitch(to: email) }
-                else { self?.performSwitch(to: email) }
+                else { self?.performSwitch(to: key) }
             } : nil,
             onLogin: offerLogin ? { [weak self] in self?.performLogin(account) } : nil)
     }
@@ -1253,19 +1302,20 @@ final class AppDelegate: NSObject, NSApplicationDelegate, NSMenuDelegate {
 
     // MARK: - Actions
 
-    private func performSwitch(to email: String, auto: Bool = false, reason: String? = nil) {
+    private func performSwitch(to key: String, auto: Bool = false, reason: String? = nil) {
         serializedCredentialOp { [self] in
             do {
-                try await store.switchTo(email: email)
-                activeEmail = email
-                notifiedBucket[email] = nil
+                try await store.switchTo(key: key)
+                activeClaudeKey = key
+                notifiedBucket[key] = nil
+                let label = displayClaudeAccount(key: key)
                 Notifier.shared.post(
-                    title: auto ? "Auto-switched to \(displayEmail(email))"
-                                : "Switched to \(displayEmail(email))",
+                    title: auto ? "Auto-switched to \(label)"
+                                : "Switched to \(label)",
                     body: reason ?? "New Claude Code sessions use this account. Running sessions pick it up on their next token refresh.")
                 refreshAll()
             } catch {
-                showError("Couldn't switch to \(displayEmail(email))", error)
+                showError("Couldn't switch to \(displayClaudeAccount(key: key))", error)
             }
         }
     }
@@ -1279,9 +1329,10 @@ final class AppDelegate: NSObject, NSApplicationDelegate, NSMenuDelegate {
     private func evaluateAutoSwitch() {
         guard Settings.autoSwitchEnabled else { return }
         let kinds = Settings.autoSwitchKinds
-        autoSwitch(provider: .claude, live: activeEmail,
-                   candidates: store.profiles.map(\.email),
+        autoSwitch(provider: .claude, live: activeClaudeKey,
+                   candidates: store.profiles.map(\.key),
                    utilization: { fetchError[$0] == nil ? usage[$0]?.maxUtilization(kinds: kinds) : nil },
+                   display: { displayClaudeAccount(key: $0) },
                    perform: { performSwitch(to: $0, auto: true, reason: $1) })
         autoSwitch(provider: .codex, live: codexLiveEmail,
                    candidates: codexStore.profiles.map(\.email),
@@ -1289,6 +1340,7 @@ final class AppDelegate: NSObject, NSApplicationDelegate, NSMenuDelegate {
                        let key = "codex:\($0)"
                        return fetchError[key] == nil ? codexUsage[key]?.maxUtilization(kinds: kinds) : nil
                    },
+                   display: { displayEmail($0) },
                    perform: { performCodexSwitch(to: $0, auto: true, reason: $1) })
         autoSwitch(provider: .gemini, live: geminiLiveCliEmail,
                    candidates: geminiStore.profiles.map(\.email),
@@ -1296,6 +1348,7 @@ final class AppDelegate: NSObject, NSApplicationDelegate, NSMenuDelegate {
                        let key = "gemini:\($0)"
                        return fetchError[key] == nil ? geminiUsage[key]?.maxUtilization(kinds: kinds) : nil
                    },
+                   display: { displayEmail($0) },
                    perform: { performGeminiSwitch(to: $0, auto: true, reason: $1) })
     }
 
@@ -1305,20 +1358,31 @@ final class AppDelegate: NSObject, NSApplicationDelegate, NSMenuDelegate {
     /// acts on a transient fetch error. A per-provider cooldown stops flapping.
     private func autoSwitch(provider: Provider, live: String?, candidates: [String],
                             utilization: (String) -> Double?,
+                            display: (String) -> String,
                             perform: (String, String) -> Void) {
-        guard let live, let liveUtil = utilization(live) else { return }
         let threshold = Double(Settings.autoSwitchThreshold)
-        guard liveUtil >= threshold else { return }
         if let last = lastAutoSwitch[provider], Date().timeIntervalSince(last) < 180 { return }
+        guard let decision = Self.autoSwitchDecision(
+            live: live, candidates: candidates, threshold: threshold,
+            utilization: utilization) else { return }
+        lastAutoSwitch[provider] = Date()
+        perform(decision.target,
+                "\(display(decision.live)) hit \(Int(decision.liveUtil.rounded()))% — "
+                + "moved to \(display(decision.target)) (\(Int(decision.targetUtil.rounded()))% used).")
+    }
+
+    /// Pure target selection so same-email organization keys are covered by
+    /// tests without manipulating real usage limits or live credentials.
+    static func autoSwitchDecision(live: String?, candidates: [String], threshold: Double,
+                                   utilization: (String) -> Double?)
+        -> (live: String, target: String, liveUtil: Double, targetUtil: Double)? {
+        guard let live, let liveUtil = utilization(live), liveUtil >= threshold else { return nil }
         guard let target = candidates
             .filter({ $0 != live })
-            .compactMap({ e in utilization(e).map { (e, $0) } })
+            .compactMap({ key in utilization(key).map { (key, $0) } })
             .filter({ $0.1 < threshold })
-            .min(by: { $0.1 < $1.1 }) else { return }   // nowhere better to go
-        lastAutoSwitch[provider] = Date()
-        perform(target.0,
-                "\(displayEmail(live)) hit \(Int(liveUtil.rounded()))% — "
-                + "moved to \(displayEmail(target.0)) (\(Int(target.1.rounded()))% used).")
+            .min(by: { $0.1 < $1.1 }) else { return nil }
+        return (live, target.0, liveUtil, target.1)
     }
 
     /// Start a 5-hour session on each saved Claude account that has none
@@ -1331,18 +1395,18 @@ final class AppDelegate: NSObject, NSApplicationDelegate, NSMenuDelegate {
         guard Settings.sessionWarmingEnabled else { return }
         let now = Date()
         for profile in store.profiles {
-            let email = profile.email
-            guard fetchError[email] == nil, !needsAction.contains(email),
-                  nextFetchAllowed[email].map({ $0 <= now }) ?? true,
+            let key = profile.key
+            guard fetchError[key] == nil, !needsAction.contains(key),
+                  nextFetchAllowed[key].map({ $0 <= now }) ?? true,
                   SessionWarmer.shouldWarm(
                       now: now,
                       windowStartMinutes: Settings.warmWindowStartMinutes,
                       windowEndMinutes: Settings.warmWindowEndMinutes,
-                      resetsAt: usage[email]?.fiveHour?.resetsAt,
-                      lastAttempt: lastWarmAttempt[email]) else { continue }
-            lastWarmAttempt[email] = now
-            guard let fresh = try? await freshCredentials(for: email,
-                                                          isActive: email == activeEmail)
+                      resetsAt: usage[key]?.fiveHour?.resetsAt,
+                      lastAttempt: lastWarmAttempt[key]) else { continue }
+            lastWarmAttempt[key] = now
+            guard let fresh = try? await freshCredentials(for: profile,
+                                                          isActive: key == activeClaudeKey)
             else { continue }
             _ = await SessionWarmer.warm(accessToken: fresh.creds.accessToken)
         }
@@ -1474,6 +1538,19 @@ final class AppDelegate: NSObject, NSApplicationDelegate, NSMenuDelegate {
             adapter = ClaudeLoginAdapter()
         }
         let email = account.email
+        let target: LoginTarget
+        if account.provider == .claude {
+            guard let profile = store.profile(forKey: account.key),
+                  let identity = profile.identity else {
+                loginInFlight = false
+                return
+            }
+            target = LoginTarget(email: profile.email,
+                                 organizationID: identity.organizationUUID,
+                                 credentialAccount: profile.credentialAccount)
+        } else {
+            target = LoginTarget(email: email, credentialAccount: email)
+        }
         let ui = OAuthLoginCoordinator.UI(
             openURL: { url in NSWorkspace.shared.open(url) },
             promptPaste: { [weak self] in await self?.pasteWindow.prompt() ?? nil },
@@ -1481,14 +1558,16 @@ final class AppDelegate: NSObject, NSApplicationDelegate, NSMenuDelegate {
         Task { @MainActor in
             defer { loginInFlight = false }
             do {
-                try await OAuthLoginCoordinator().run(adapter: adapter, expectedEmail: email, ui: ui)
+                try await OAuthLoginCoordinator().run(adapter: adapter, target: target, ui: ui)
                 // The rejected token left a 1-hour backoff + needsAction on this
                 // account; clear it so the refresh below actually re-fetches with
                 // the fresh credentials and the row heals immediately (instead of
                 // staying "rejected" until the backoff expires).
                 clearFetchError(for: account.key)
                 if account.isGemini { geminiProject[account.email] = nil }
-                Notifier.shared.post(title: "Signed in to \(displayEmail(email))",
+                let label = account.provider == .claude
+                    ? displayClaudeAccount(key: account.key) : displayEmail(email)
+                Notifier.shared.post(title: "Signed in to \(label)",
                                      body: "Fresh credentials saved. This account is switchable again.")
                 refreshAll()
             } catch LoginError.cancelled {
@@ -1539,7 +1618,8 @@ final class AppDelegate: NSObject, NSApplicationDelegate, NSMenuDelegate {
         serializedCredentialOp { [self] in
             do {
                 if let profile = try await store.captureCurrent().profile {
-                    Notifier.shared.post(title: "Saved \(displayEmail(profile.email))",
+                    Notifier.shared.post(
+                        title: "Saved \(displayAccount(email: profile.email, planLabel: profile.planLabel))",
                                          body: "This account can now be switched to from PitStop.")
                 } else {
                     showError("Nothing to save",
@@ -1557,8 +1637,8 @@ final class AppDelegate: NSObject, NSApplicationDelegate, NSMenuDelegate {
     /// reading, and an account removed mid-refresh gets resurrected by the
     /// in-flight cycle's recordFetch* calls.
     private func pruneOrphanedState() {
-        var valid = Set(store.profiles.map(\.email))
-        if let d = desktopAccount { valid.insert(d.email) }
+        var valid = Set(store.profiles.map(\.key))
+        if let d = desktopAccount { valid.insert(d.key) }
         for c in codexStore.profiles { valid.insert("codex:\(c.email)") }
         for g in geminiStore.profiles { valid.insert("gemini:\(g.email)") }
         if OpenCode.isPresent { valid.insert(OpenCode.accountKey) }
@@ -1591,9 +1671,16 @@ final class AppDelegate: NSObject, NSApplicationDelegate, NSMenuDelegate {
                     let email = String(key.dropFirst("codex:".count))
                     try await codexStore.remove(email: email)
                     codexUsage[key] = nil
-                } else {
-                    try await store.remove(email: key)
+                } else if key.hasPrefix("claude:") {
+                    try await store.remove(key: key)
                     usage[key] = nil
+                } else {
+                    // Compatibility for a legacy menu item constructed before
+                    // the org-aware refresh rebuilt the menu.
+                    if let profile = store.profiles.first(where: { $0.credentialAccount == key }) {
+                        try await store.remove(key: profile.key)
+                        usage[profile.key] = nil
+                    }
                 }
                 fetchError[key] = nil
                 nextFetchAllowed[key] = nil
@@ -1624,24 +1711,24 @@ final class AppDelegate: NSObject, NSApplicationDelegate, NSMenuDelegate {
     // MARK: - Threshold notifications
 
     private func checkThresholds() {
-        guard let email = activeEmail, let report = usage[email],
-              fetchError[email] == nil else { return }
+        guard let key = activeClaudeKey, let report = usage[key],
+              fetchError[key] == nil else { return }
         let pct = report.maxUtilization
         let bucket = pct >= 95 ? 2 : (pct >= 80 ? 1 : 0)
-        let last = notifiedBucket[email] ?? 0
+        let last = notifiedBucket[key] ?? 0
         if bucket > last {
             let reset = report.bindingWindow?.resetsAt.map { Format.reset($0) } ?? ""
             // Point at the saved account with the most headroom.
             let best = store.profiles
-                .filter { $0.email != email }
-                .compactMap { p -> (String, Double)? in
-                    guard let r = usage[p.email], fetchError[p.email] == nil else { return nil }
-                    return (p.email, r.maxUtilization)
+                .filter { $0.key != key }
+                .compactMap { p -> (Profile, Double)? in
+                    guard let r = usage[p.key], fetchError[p.key] == nil else { return nil }
+                    return (p, r.maxUtilization)
                 }
                 .min { $0.1 < $1.1 }
             let hint: String
             if let best, best.1 < 80 {
-                hint = "Best pit: \(displayEmail(best.0)) (\(Int(best.1.rounded()))% used) — switch from the menu."
+                hint = "Best pit: \(displayAccount(email: best.0.email, planLabel: best.0.planLabel)) (\(Int(best.1.rounded()))% used) — switch from the menu."
             } else if best != nil {
                 hint = "All saved accounts are running hot — check the menu."
             } else {
@@ -1649,8 +1736,8 @@ final class AppDelegate: NSObject, NSApplicationDelegate, NSMenuDelegate {
             }
             Notifier.shared.post(
                 title: "Claude Code usage at \(Int(pct.rounded()))%",
-                body: "\(displayEmail(email)) — \(reset). \(hint)")
+                body: "\(displayClaudeAccount(key: key)) — \(reset). \(hint)")
         }
-        notifiedBucket[email] = bucket
+        notifiedBucket[key] = bucket
     }
 }
diff --git a/Sources/PitStop/ClaudeDesktop.swift b/Sources/PitStop/ClaudeDesktop.swift
index 04eaff8..dfcb81a 100644
--- a/Sources/PitStop/ClaudeDesktop.swift
+++ b/Sources/PitStop/ClaudeDesktop.swift
@@ -36,6 +36,11 @@ enum ClaudeDesktop {
         var email: String
         var orgUUID: String
         var planLabel: String
+
+        var identity: ClaudeAccountIdentity {
+            ClaudeAccountIdentity(email: email, organizationUUID: orgUUID)
+        }
+        var key: String { identity.key }
     }
 
     enum DesktopError: LocalizedError {
diff --git a/Sources/PitStop/ClaudeLoginAdapter.swift b/Sources/PitStop/ClaudeLoginAdapter.swift
index 7ed920b..e41edd0 100644
--- a/Sources/PitStop/ClaudeLoginAdapter.swift
+++ b/Sources/PitStop/ClaudeLoginAdapter.swift
@@ -14,7 +14,8 @@ struct ClaudeLoginAdapter: LoginAdapter {
     static let scopes = "org:create_api_key user:profile user:inference "
         + "user:sessions:claude_code user:mcp_servers user:file_upload"
 
-    func authorizeURL(challenge: String, state: String, redirectURI: String, pasteMode: Bool) -> URL {
+    func authorizeURL(challenge: String, state: String, redirectURI: String,
+                      pasteMode: Bool, target: LoginTarget) -> URL {
         var c = URLComponents(string: "https://claude.ai/oauth/authorize")!
         var items = [
             URLQueryItem(name: "client_id", value: UsageAPI.clientID),
@@ -26,6 +27,9 @@ struct ClaudeLoginAdapter: LoginAdapter {
             URLQueryItem(name: "state", value: state),
         ]
         if pasteMode { items.insert(URLQueryItem(name: "code", value: "true"), at: 0) }
+        if let org = target.organizationID {
+            items.append(URLQueryItem(name: "orgUUID", value: org))
+        }
         c.queryItems = items
         return c.url!
     }
@@ -39,8 +43,9 @@ struct ClaudeLoginAdapter: LoginAdapter {
     }
 
     func identity(from tokens: FreshTokens) async throws -> LoginIdentity {
-        let email = try await UsageAPI.fetchAccountEmail(accessToken: tokens.accessToken)
-        return LoginIdentity(email: email, accountID: nil)
+        let identity = try await UsageAPI.fetchAccountIdentity(accessToken: tokens.accessToken)
+        return LoginIdentity(email: identity.email, accountID: nil,
+                             organizationID: identity.organizationUUID)
     }
 
     func buildBlob(old: Data, tokens: FreshTokens) throws -> Data {
@@ -50,12 +55,13 @@ struct ClaudeLoginAdapter: LoginAdapter {
                                     expiresAtMs: tokens.expiresAtMs ?? 0)
     }
 
-    func persist(_ tokens: FreshTokens, email: String) async throws {
+    func persist(_ tokens: FreshTokens, target: LoginTarget) async throws {
         guard let old = try await Keychain.read(service: CredentialBlob.profileService,
-                                                account: email) else {
-            throw LoginError.noSavedProfile(email)
+                                                account: target.credentialAccount) else {
+            throw LoginError.noSavedProfile(target.email)
         }
         let blob = try buildBlob(old: old, tokens: tokens)
-        try await Keychain.upsert(service: CredentialBlob.profileService, account: email, data: blob)
+        try await Keychain.upsert(service: CredentialBlob.profileService,
+                                  account: target.credentialAccount, data: blob)
     }
 }
diff --git a/Sources/PitStop/CodexLoginAdapter.swift b/Sources/PitStop/CodexLoginAdapter.swift
index 0ff3bb8..0cb80a9 100644
--- a/Sources/PitStop/CodexLoginAdapter.swift
+++ b/Sources/PitStop/CodexLoginAdapter.swift
@@ -11,7 +11,8 @@ struct CodexLoginAdapter: LoginAdapter {
 
     static let scopes = "openid profile email offline_access api.connectors.read api.connectors.invoke"
 
-    func authorizeURL(challenge: String, state: String, redirectURI: String, pasteMode: Bool) -> URL {
+    func authorizeURL(challenge: String, state: String, redirectURI: String,
+                      pasteMode: Bool, target: LoginTarget) -> URL {
         var c = URLComponents(string: "https://auth.openai.com/oauth/authorize")!
         c.queryItems = [
             URLQueryItem(name: "response_type", value: "code"),
@@ -39,7 +40,7 @@ struct CodexLoginAdapter: LoginAdapter {
               let id = Codex.identity(fromIDToken: idToken) else {
             throw LoginError.badResponse("Codex sign-in returned no id_token")
         }
-        return LoginIdentity(email: id.email, accountID: id.accountID)
+        return LoginIdentity(email: id.email, accountID: id.accountID, organizationID: nil)
     }
 
     func buildBlob(old: Data, tokens: FreshTokens) throws -> Data {
@@ -52,11 +53,13 @@ struct CodexLoginAdapter: LoginAdapter {
         return Codex.normalizedBlob(patched)
     }
 
-    func persist(_ tokens: FreshTokens, email: String) async throws {
-        guard let old = try await Keychain.read(service: CodexStore.service, account: email) else {
-            throw LoginError.noSavedProfile(email)
+    func persist(_ tokens: FreshTokens, target: LoginTarget) async throws {
+        guard let old = try await Keychain.read(service: CodexStore.service,
+                                                account: target.credentialAccount) else {
+            throw LoginError.noSavedProfile(target.email)
         }
         let blob = try buildBlob(old: old, tokens: tokens)
-        try await Keychain.upsert(service: CodexStore.service, account: email, data: blob)
+        try await Keychain.upsert(service: CodexStore.service,
+                                  account: target.credentialAccount, data: blob)
     }
 }
diff --git a/Sources/PitStop/Credentials.swift b/Sources/PitStop/Credentials.swift
index a9a6267..7aec52a 100644
--- a/Sources/PitStop/Credentials.swift
+++ b/Sources/PitStop/Credentials.swift
@@ -1,5 +1,28 @@
 import Foundation
 
+/// A Claude subscription is scoped to an organization, not just an email.
+/// The same Claude user can belong to multiple organizations whose usage and
+/// credentials must remain independent.
+struct ClaudeAccountIdentity: Hashable, Codable {
+    let email: String
+    let organizationUUID: String
+
+    init(email: String, organizationUUID: String) {
+        self.email = email.trimmingCharacters(in: .whitespacesAndNewlines).lowercased()
+        self.organizationUUID = organizationUUID.trimmingCharacters(in: .whitespacesAndNewlines).lowercased()
+    }
+
+    init?(oauthAccount: [String: Any]) {
+        guard let email = oauthAccount["emailAddress"] as? String,
+              let organizationUUID = oauthAccount["organizationUuid"] as? String,
+              !email.isEmpty, !organizationUUID.isEmpty else { return nil }
+        self.init(email: email, organizationUUID: organizationUUID)
+    }
+
+    /// Opaque provider-namespaced key used by all per-account app state.
+    var key: String { "claude:\(email)#\(organizationUUID)" }
+}
+
 /// The decoded `claudeAiOauth` section of the Claude Code credential blob.
 struct OAuthCredentials {
     var accessToken: String
@@ -74,8 +97,8 @@ enum ClaudeConfig {
         return root["oauthAccount"] as? [String: Any]
     }
 
-    static func activeEmail() -> String? {
-        oauthAccount()?["emailAddress"] as? String
+    static func activeIdentity() -> ClaudeAccountIdentity? {
+        oauthAccount().flatMap(ClaudeAccountIdentity.init(oauthAccount:))
     }
 
     static func setOauthAccount(_ account: [String: Any]) throws {
diff --git a/Sources/PitStop/GeminiLoginAdapter.swift b/Sources/PitStop/GeminiLoginAdapter.swift
index 2f4094a..1c96e49 100644
--- a/Sources/PitStop/GeminiLoginAdapter.swift
+++ b/Sources/PitStop/GeminiLoginAdapter.swift
@@ -16,7 +16,8 @@ extension GeminiLoginAdapter {
     var supportsPaste: Bool { false }
     var pasteRedirectURI: String { "" }
 
-    func authorizeURL(challenge: String, state: String, redirectURI: String, pasteMode: Bool) -> URL {
+    func authorizeURL(challenge: String, state: String, redirectURI: String,
+                      pasteMode: Bool, target: LoginTarget) -> URL {
         var c = URLComponents(string: "https://accounts.google.com/o/oauth2/v2/auth")!
         c.queryItems = [
             .init(name: "client_id", value: client.id),
@@ -60,15 +61,17 @@ extension GeminiLoginAdapter {
         guard let idt = tokens.idToken, let email = Gemini.decodeJWTEmail(idt) else {
             throw LoginError.badResponse("Google sign-in returned no id_token email")
         }
-        return LoginIdentity(email: email, accountID: nil)
+        return LoginIdentity(email: email, accountID: nil, organizationID: nil)
     }
 
-    func persist(_ tokens: FreshTokens, email: String) async throws {
+    func persist(_ tokens: FreshTokens, target: LoginTarget) async throws {
         // Patch the saved blob when one exists — Google may omit refresh_token
         // on re-auth, and rebuilding from scratch would destroy the stored one.
-        let old = (try? await Keychain.read(service: profileService, account: email)) ?? Data()
+        let old = (try? await Keychain.read(service: profileService,
+                                            account: target.credentialAccount)) ?? Data()
         let blob = try buildBlob(old: old, tokens: tokens)
-        try await Keychain.upsert(service: profileService, account: email, data: blob)
+        try await Keychain.upsert(service: profileService,
+                                  account: target.credentialAccount, data: blob)
     }
 }
 
diff --git a/Sources/PitStop/Keychain.swift b/Sources/PitStop/Keychain.swift
index 58e2552..ad6ec94 100644
--- a/Sources/PitStop/Keychain.swift
+++ b/Sources/PitStop/Keychain.swift
@@ -17,7 +17,8 @@ import Foundation
 /// Two services are involved:
 ///  - "Claude Code-credentials" — the live item Claude Code reads/writes.
 ///    Always updated in place (`-U`) to preserve the item and its ACL.
-///  - "PitStop-profile" — one item per saved account (account = email).
+///  - "PitStop-profile" — one item per saved account. Current Claude profiles
+///    use an email + organization key; legacy snapshots retain their email slot.
 ///    Recreated (staged add + delete + add) on write so the items are owned
 ///    by `security` itself and never prompt, without a window where a failed
 ///    write has destroyed the only copy.
diff --git a/Sources/PitStop/OAuthLogin.swift b/Sources/PitStop/OAuthLogin.swift
index e413e11..26bcfd4 100644
--- a/Sources/PitStop/OAuthLogin.swift
+++ b/Sources/PitStop/OAuthLogin.swift
@@ -12,10 +12,21 @@ struct FreshTokens {
 struct LoginIdentity: Equatable {
     var email: String
     var accountID: String?      // Codex chatgpt_account_id
+    var organizationID: String? // Claude organization UUID
+}
+
+/// The saved row an OAuth flow is allowed to heal. `credentialAccount` is
+/// intentionally independent from identity so legacy email-keyed Claude
+/// snapshots can be retained without collisions for newly captured orgs.
+struct LoginTarget: Equatable {
+    var email: String
+    var accountID: String? = nil
+    var organizationID: String? = nil
+    var credentialAccount: String
 }
 
 enum LoginError: LocalizedError {
-    case identityMismatch(expected: String, got: String)
+    case identityMismatch(expected: LoginTarget, got: LoginIdentity)
     case noSavedProfile(String)
     case stateMismatch
     case cancelled
@@ -26,7 +37,12 @@ enum LoginError: LocalizedError {
     var errorDescription: String? {
         switch self {
         case .identityMismatch(let expected, let got):
-            return "You signed in as \(got), but this row is \(expected). "
+            if expected.email.caseInsensitiveCompare(got.email) == .orderedSame,
+               expected.organizationID != nil {
+                return "You signed in to a different Claude organization for \(got.email). "
+                    + "Choose the row's organization and try again."
+            }
+            return "You signed in as \(got.email), but this row is \(expected.email). "
                 + "Switch accounts in your browser and try again."
         case .noSavedProfile(let email): return "No saved profile for \(email)."
         case .stateMismatch: return "Sign-in could not be verified (state mismatch)."
@@ -50,12 +66,13 @@ protocol LoginAdapter {
     /// Hosted redirect used in paste mode (unused when !supportsPaste).
     var pasteRedirectURI: String { get }
 
-    func authorizeURL(challenge: String, state: String, redirectURI: String, pasteMode: Bool) -> URL
+    func authorizeURL(challenge: String, state: String, redirectURI: String,
+                      pasteMode: Bool, target: LoginTarget) -> URL
     func exchange(code: String, state: String, verifier: String, redirectURI: String) async throws -> FreshTokens
     func identity(from tokens: FreshTokens) async throws -> LoginIdentity
     /// Patch the existing saved blob with fresh tokens. Pure, for testing.
     func buildBlob(old: Data, tokens: FreshTokens) throws -> Data
     /// Read the saved profile blob, patch it, and write it back to the profile
     /// slot only. Throws `.noSavedProfile` if there is nothing to heal.
-    func persist(_ tokens: FreshTokens, email: String) async throws
+    func persist(_ tokens: FreshTokens, target: LoginTarget) async throws
 }
diff --git a/Sources/PitStop/OAuthLoginCoordinator.swift b/Sources/PitStop/OAuthLoginCoordinator.swift
index a070ce7..fda6f36 100644
--- a/Sources/PitStop/OAuthLoginCoordinator.swift
+++ b/Sources/PitStop/OAuthLoginCoordinator.swift
@@ -10,30 +10,33 @@ final class OAuthLoginCoordinator {
         var loopbackTimeout: TimeInterval = 120
     }
 
-    /// Identity match against the row's email (case- and whitespace-insensitive).
-    /// Email is unique per account, so this is sufficient; `LoginIdentity.accountID`
-    /// is carried for diagnostics/future use but not required for the match.
-    static func emailMatches(expected: String, _ identity: LoginIdentity) -> Bool {
+    /// Match the authenticated result to the exact saved target. Email remains
+    /// normalized, while provider-specific stable IDs must match when supplied.
+    static func identityMatches(target: LoginTarget, _ identity: LoginIdentity) -> Bool {
         func norm(_ s: String) -> String {
             s.trimmingCharacters(in: .whitespacesAndNewlines).lowercased()
         }
-        return norm(expected) == norm(identity.email)
+        guard norm(target.email) == norm(identity.email) else { return false }
+        if let expected = target.accountID, expected != identity.accountID { return false }
+        if let expected = target.organizationID?.lowercased(),
+           expected != identity.organizationID?.lowercased() { return false }
+        return true
     }
 
     /// Exchange → identity → match → persist. Nothing is written on mismatch.
-    func finish(adapter: LoginAdapter, expectedEmail: String,
+    func finish(adapter: LoginAdapter, target: LoginTarget,
                 code: String, state: String, verifier: String, redirectURI: String) async throws {
         let tokens = try await adapter.exchange(code: code, state: state,
                                                 verifier: verifier, redirectURI: redirectURI)
         let identity = try await adapter.identity(from: tokens)
-        guard Self.emailMatches(expected: expectedEmail, identity) else {
-            throw LoginError.identityMismatch(expected: expectedEmail, got: identity.email)
+        guard Self.identityMatches(target: target, identity) else {
+            throw LoginError.identityMismatch(expected: target, got: identity)
         }
-        try await adapter.persist(tokens, email: expectedEmail)
+        try await adapter.persist(tokens, target: target)
     }
 
     /// Full flow: loopback first, then (Claude) paste fallback.
-    func run(adapter: LoginAdapter, expectedEmail: String, ui: UI) async throws {
+    func run(adapter: LoginAdapter, target: LoginTarget, ui: UI) async throws {
         let pkce = OAuthPKCE.generate()
 
         // --- Attempt A: loopback ---
@@ -43,20 +46,20 @@ final class OAuthLoginCoordinator {
         } catch is LoopbackServer.ServerError {
             // No bindable loopback port: fall through to paste if supported.
             if !adapter.supportsPaste { throw LoginError.portUnavailable }
-            try await runPaste(adapter: adapter, expectedEmail: expectedEmail, pkce: pkce, ui: ui)
+            try await runPaste(adapter: adapter, target: target, pkce: pkce, ui: ui)
             return
         }
         defer { server.stop() }
 
         let redirectURI = "http://localhost:\(server.port)\(adapter.loopbackPath)"
         let authURL = adapter.authorizeURL(challenge: pkce.challenge, state: pkce.state,
-                                           redirectURI: redirectURI, pasteMode: false)
+                                           redirectURI: redirectURI, pasteMode: false, target: target)
         await MainActor.run { ui.openURL(authURL) }
 
         do {
             let cap = try await server.waitForCallback(timeout: ui.loopbackTimeout)
             guard cap.state == pkce.state else { throw LoginError.stateMismatch }
-            try await finish(adapter: adapter, expectedEmail: expectedEmail,
+            try await finish(adapter: adapter, target: target,
                              code: cap.code, state: cap.state,
                              verifier: pkce.verifier, redirectURI: redirectURI)
             return
@@ -68,15 +71,15 @@ final class OAuthLoginCoordinator {
         }
 
         server.stop()
-        try await runPaste(adapter: adapter, expectedEmail: expectedEmail, pkce: pkce, ui: ui)
+        try await runPaste(adapter: adapter, target: target, pkce: pkce, ui: ui)
     }
 
     /// --- Attempt B: paste (Claude) ---
-    private func runPaste(adapter: LoginAdapter, expectedEmail: String,
+    private func runPaste(adapter: LoginAdapter, target: LoginTarget,
                           pkce: (verifier: String, challenge: String, state: String), ui: UI) async throws {
         let redirectURI = adapter.pasteRedirectURI
         let authURL = adapter.authorizeURL(challenge: pkce.challenge, state: pkce.state,
-                                           redirectURI: redirectURI, pasteMode: true)
+                                           redirectURI: redirectURI, pasteMode: true, target: target)
         await MainActor.run { ui.openURL(authURL) }
         let pasted = await ui.promptPaste()   // @MainActor closure; hops to main automatically
         guard let pasted else { throw LoginError.cancelled }
@@ -84,7 +87,7 @@ final class OAuthLoginCoordinator {
             throw LoginError.badResponse("Could not read the pasted code")
         }
         guard cap.state == pkce.state else { throw LoginError.stateMismatch }
-        try await finish(adapter: adapter, expectedEmail: expectedEmail,
+        try await finish(adapter: adapter, target: target,
                          code: cap.code, state: cap.state,
                          verifier: pkce.verifier, redirectURI: redirectURI)
     }
diff --git a/Sources/PitStop/ProfileStore.swift b/Sources/PitStop/ProfileStore.swift
index be9585e..dd0988b 100644
--- a/Sources/PitStop/ProfileStore.swift
+++ b/Sources/PitStop/ProfileStore.swift
@@ -1,19 +1,29 @@
 import Foundation
 
-/// A saved Claude Code account. The secret credential blob lives in the
-/// keychain (service "PitStop-profile", account = email); this struct holds
-/// only non-secret metadata, persisted to ~/.config/pitstop/profiles.json.
+/// A saved Claude Code organization. The secret credential blob lives in the
+/// keychain; this struct holds only non-secret identity and storage metadata.
 struct Profile {
     var email: String
     var savedAt: Date
     var subscriptionType: String?
     var rateLimitTier: String?
+    /// Keychain account attribute. Old installs used the bare email; keeping
+    /// that slot preserves the one credential snapshot they could retain.
+    var credentialAccount: String
+    /// True once this exact email + organization pairing has been confirmed
+    /// against the stored token. Profiles from email-only versions default to
+    /// false so their first live capture cannot take the unchanged fast path.
+    var identityVerified: Bool
     /// The `oauthAccount` object from ~/.claude.json, kept verbatim so it can
     /// be restored exactly on switch.
     var oauthAccount: [String: Any]
 
     var displayName: String? { oauthAccount["displayName"] as? String }
     var organizationName: String? { oauthAccount["organizationName"] as? String }
+    var identity: ClaudeAccountIdentity? { ClaudeAccountIdentity(oauthAccount: oauthAccount) }
+    /// Profiles old enough to lack organizationUuid remain addressable until a
+    /// verified live capture upgrades them in place.
+    var key: String { identity?.key ?? "claude:legacy:\(email.lowercased())" }
 
     /// e.g. "Acme AI · Team · 5x" — drops auto-generated "<email>'s
     /// Organization" names and the noisy default_claude_ tier prefix.
@@ -36,6 +46,8 @@ struct Profile {
         var d: [String: Any] = [
             "email": email,
             "savedAt": savedAt.timeIntervalSince1970,
+            "credentialAccount": credentialAccount,
+            "identityVerified": identityVerified,
             "oauthAccount": oauthAccount,
         ]
         if let subscriptionType { d["subscriptionType"] = subscriptionType }
@@ -50,14 +62,27 @@ struct Profile {
         self.subscriptionType = dict["subscriptionType"] as? String
         self.rateLimitTier = dict["rateLimitTier"] as? String
         self.oauthAccount = dict["oauthAccount"] as? [String: Any] ?? [:]
+        // Backward compatibility: pre-org-aware snapshots live under email.
+        if let credentialAccount = dict["credentialAccount"] as? String,
+           !credentialAccount.isEmpty {
+            self.credentialAccount = credentialAccount
+        } else {
+            self.credentialAccount = email
+        }
+        // Pre-organization versions verified only the email. Missing means
+        // this pairing must pass one exact organization check after upgrade.
+        self.identityVerified = (dict["identityVerified"] as? Bool) ?? false
     }
 
     init(email: String, savedAt: Date, subscriptionType: String?,
-         rateLimitTier: String?, oauthAccount: [String: Any]) {
+         rateLimitTier: String?, credentialAccount: String,
+         identityVerified: Bool = true, oauthAccount: [String: Any]) {
         self.email = email
         self.savedAt = savedAt
         self.subscriptionType = subscriptionType
         self.rateLimitTier = rateLimitTier
+        self.credentialAccount = credentialAccount
+        self.identityVerified = identityVerified
         self.oauthAccount = oauthAccount
     }
 }
@@ -72,20 +97,23 @@ final class ProfileStore {
     /// from ~/.claude.json — two stores written by another program at
     /// different moments. These are the ways that pairing can be refused.
     enum CaptureError: LocalizedError {
-        /// The token provably belongs to a different account than the one
+        /// The token provably belongs to a different organization than the one
         /// ~/.claude.json names (a mid-switch read of crossed stores).
-        case mismatch(tokenOwner: String, configEmail: String)
+        case mismatch(tokenOwner: ClaudeAccountIdentity, configIdentity: ClaudeAccountIdentity)
         /// The token's owner couldn't be confirmed (network, expiry) — the
         /// pair might be fine, but filing it unverified risks poisoning.
         case unverifiable(String)
 
         var errorDescription: String? {
             switch self {
-            case .mismatch(let owner, let email):
+            case .mismatch(let owner, let expected):
+                let ownerDescription = owner.email.caseInsensitiveCompare(expected.email) == .orderedSame
+                    ? "another organization for \(owner.email)"
+                    : owner.email
                 return """
-                    The live Claude login belongs to \(owner), but ~/.claude.json \
-                    still names \(email) — saving that pair would file \(owner)'s \
-                    credentials under \(email). Run `claude` and use /login to sign \
+                    The live Claude login belongs to \(ownerDescription), but ~/.claude.json \
+                    still names \(expected.email) — saving that pair would file those \
+                    credentials under the wrong account. Run `claude` and use /login to sign \
                     in as the account you want live, then try again. Claude Desktop \
                     bundles its own Claude Code and can take the login over.
                     """
@@ -118,8 +146,9 @@ final class ProfileStore {
             try await Keychain.upsertLive(service: CredentialBlob.liveService, data: $0)
         }
         var oauthAccount: () -> [String: Any]? = { ClaudeConfig.oauthAccount() }
-        var verifyOwner: (String) async throws -> String = {
-            try await UsageAPI.fetchAccountEmail(accessToken: $0)
+        var setOauthAccount: ([String: Any]) throws -> Void = { try ClaudeConfig.setOauthAccount($0) }
+        var verifyIdentity: (String) async throws -> ClaudeAccountIdentity = {
+            try await UsageAPI.fetchAccountIdentity(accessToken: $0)
         }
         var refreshToken: (String) async throws
             -> (accessToken: String, refreshToken: String?, expiresAtMs: Double) = {
@@ -134,9 +163,13 @@ final class ProfileStore {
     /// The row-level error for a profile the identity audit gated: its saved
     /// credentials belonged to a different account and were deleted.
     struct ForeignCredentialsError: LocalizedError {
-        let owner: String
+        let owner: ClaudeAccountIdentity
+        let expected: ClaudeAccountIdentity
         var errorDescription: String? {
-            "Was showing \(owner)'s usage — sign in again"
+            if owner.email.caseInsensitiveCompare(expected.email) == .orderedSame {
+                return "Was showing another Claude organization's usage — sign in again"
+            }
+            return "Was showing \(owner.email)'s usage — sign in again"
         }
     }
 
@@ -152,19 +185,19 @@ final class ProfileStore {
         case verified
         /// The stored credentials belong to `owner`, not the profile's email;
         /// the poisoned copy has been deleted.
-        case poisoned(owner: String)
+        case poisoned(owner: ClaudeAccountIdentity)
         /// Couldn't reach the identity endpoint — audit again next cycle.
         case unverifiable
     }
 
     private(set) var profiles: [Profile] = []
     private let deps: Deps
-    /// Emails whose stored credentials passed this launch's identity audit.
-    private var auditedEmails: Set<String> = []
+    /// Account keys whose stored credentials passed this launch's identity audit.
+    private var auditedKeys: Set<String> = []
     /// The last owner check performed on the live credential item, cached
     /// against the exact bytes it ran on. Any rewrite of the item changes the
     /// bytes and invalidates it.
-    private var verifiedLive: (blob: Data, owner: String)?
+    private var verifiedLive: (blob: Data, owner: ClaudeAccountIdentity)?
 
     init(deps: Deps = Deps()) {
         self.deps = deps
@@ -173,12 +206,32 @@ final class ProfileStore {
 
     func load() {
         guard let data = try? Data(contentsOf: deps.file),
-              let root = (try? JSONSerialization.jsonObject(with: data)) as? [String: Any],
-              let list = root["profiles"] as? [[String: Any]] else {
+              var root = (try? JSONSerialization.jsonObject(with: data)) as? [String: Any],
+              var list = root["profiles"] as? [[String: Any]] else {
             profiles = []
             return
         }
-        profiles = list.compactMap(Profile.init(dict:)).sorted { $0.email < $1.email }
+
+        // Make the implicit pre-org-aware email slot explicit immediately.
+        // Future captures can then add a same-email organization without ever
+        // reinterpreting which keychain item owns this retained snapshot.
+        var migratedCredentialSlots = false
+        for index in list.indices {
+            guard let email = list[index]["email"] as? String,
+                  (list[index]["credentialAccount"] as? String)?.isEmpty != false else { continue }
+            list[index]["credentialAccount"] = email
+            migratedCredentialSlots = true
+        }
+        profiles = list.compactMap(Profile.init(dict:)).sorted {
+            ($0.email, $0.key) < ($1.email, $1.key)
+        }
+        if migratedCredentialSlots {
+            root["profiles"] = list
+            if let migrated = try? JSONSerialization.data(withJSONObject: root,
+                                                           options: [.prettyPrinted, .sortedKeys]) {
+                try? migrated.write(to: deps.file, options: .atomic)
+            }
+        }
     }
 
     private func save() throws {
@@ -193,29 +246,40 @@ final class ProfileStore {
     /// Snapshot the live Claude Code credentials + identity into a profile.
     /// Called on every refresh so the saved copy of the active account always
     /// holds the newest tokens. `profile` is nil when nobody is logged in;
-    /// `changed` reports whether new credentials were actually stored (so the
-    /// caller can notice an external re-login).
+    /// `changed` reports whether credentials or their exact identity verification
+    /// were stored (so the caller can notice an external re-login or migration).
     @discardableResult
     func captureCurrent() async throws -> (profile: Profile?, changed: Bool) {
         guard let blob = try await deps.readLive() else { return (nil, false) }
         guard let account = deps.oauthAccount(),
-              let email = account["emailAddress"] as? String else { return (nil, false) }
+              let identity = ClaudeAccountIdentity(oauthAccount: account) else { return (nil, false) }
+        let email = (account["emailAddress"] as? String) ?? identity.email
+
+        // Exact organization match first. A single pre-organization legacy
+        // row may be upgraded in place after its live token is verified.
+        let existingIndex = profiles.firstIndex { $0.identity == identity }
+            ?? profiles.firstIndex {
+                $0.identity == nil
+                    && $0.email.caseInsensitiveCompare(identity.email) == .orderedSame
+            }
 
         // Called on every refresh — skip the keychain/file writes when
         // nothing changed since the last capture.
-        if let existing = profiles.first(where: { $0.email == email }),
-           let storedBlob = try? await deps.readProfileBlob(email),
+        if let existingIndex,
+           profiles[existingIndex].identityVerified,
+           let storedBlob = try? await deps.readProfileBlob(profiles[existingIndex].credentialAccount),
            storedBlob == blob,
-           (existing.oauthAccount as NSDictionary) == (account as NSDictionary) {
-            return (existing, false)
+           (profiles[existingIndex].oauthAccount as NSDictionary) == (account as NSDictionary) {
+            return (profiles[existingIndex], false)
         }
 
         // The blob (keychain) and identity (~/.claude.json) are separate
         // stores that Claude Code writes at different moments — reading them
         // mid-switch pairs one account's tokens with another's email, and
         // filing that pair makes both rows report the same usage forever.
-        // Confirm the token's owner before filing; this only runs when the
-        // credentials actually changed, so it's not a per-cycle HTTP call.
+        // Confirm the token's owner before filing; this runs only when the
+        // credentials changed or a legacy pairing still needs its one-time
+        // organization check, so it is not a per-cycle HTTP call.
         var blobToStore = blob
         var creds = try CredentialBlob.parse(blob)
         if creds.isExpired {
@@ -238,9 +302,9 @@ final class ProfileStore {
             try await deps.writeLive(blobToStore)
             creds = try CredentialBlob.parse(blobToStore)
         }
-        let owner: String
+        let owner: ClaudeAccountIdentity
         do {
-            owner = try await deps.verifyOwner(creds.accessToken)
+            owner = try await deps.verifyIdentity(creds.accessToken)
         } catch {
             throw CaptureError.unverifiable(error.localizedDescription)
         }
@@ -248,57 +312,58 @@ final class ProfileStore {
         // asks the same question about the same bytes moments later, and a
         // crossed pair would otherwise re-verify on every refresh.
         verifiedLive = (blobToStore, owner)
-        guard owner.caseInsensitiveCompare(email) == .orderedSame else {
-            throw CaptureError.mismatch(tokenOwner: owner, configEmail: email)
+        guard owner == identity else {
+            throw CaptureError.mismatch(tokenOwner: owner, configIdentity: identity)
         }
 
-        try await deps.writeProfileBlob(email, blobToStore)
+        let credentialAccount = existingIndex.map { profiles[$0].credentialAccount } ?? identity.key
+        try await deps.writeProfileBlob(credentialAccount, blobToStore)
         let profile = Profile(email: email, savedAt: Date(),
                               subscriptionType: creds.subscriptionType,
                               rateLimitTier: creds.rateLimitTier,
+                              credentialAccount: credentialAccount,
+                              identityVerified: true,
                               oauthAccount: account)
-        profiles.removeAll { $0.email == email }
+        if let existingIndex { profiles.remove(at: existingIndex) }
         profiles.append(profile)
-        profiles.sort { $0.email < $1.email }
+        profiles.sort { ($0.email, $0.key) < ($1.email, $1.key) }
         try save()
         return (profile, true)
     }
 
-    /// Make `email` the live Claude Code account: snapshot whatever is
+    /// Make `key` the live Claude Code account: snapshot whatever is
     /// currently live, then write the profile's blob into the live keychain
     /// item and its identity into ~/.claude.json.
-    func switchTo(email: String) async throws {
+    func switchTo(key: String) async throws {
         // A failed snapshot aborts the switch: overwriting the live item
         // without a fresh copy of the outgoing account could lose its only
         // valid refresh token. (A nil return — nobody logged in — is fine.)
         _ = try await captureCurrent()
-        guard let profile = profiles.first(where: { $0.email == email }) else {
-            throw StoreError(message: "No saved profile for \(email)")
+        guard let profile = profiles.first(where: { $0.key == key }) else {
+            throw StoreError(message: "No saved Claude profile for \(key)")
         }
-        guard let blob = try await Keychain.read(service: CredentialBlob.profileService, account: email) else {
-            throw StoreError(message: "No saved credentials for \(email) — log in once with `claude` and save again")
+        guard let blob = try await deps.readProfileBlob(profile.credentialAccount) else {
+            throw StoreError(message: "No saved credentials for \(profile.email) — log in once with `claude` and save again")
         }
-        let previousLive = try await Keychain.read(service: CredentialBlob.liveService)
-        try await Keychain.upsertLive(service: CredentialBlob.liveService, data: blob)
+        let previousLive = try await deps.readLive()
+        try await deps.writeLive(blob)
         do {
-            try ClaudeConfig.setOauthAccount(profile.oauthAccount)
+            try deps.setOauthAccount(profile.oauthAccount)
         } catch {
             // Roll the live item back so the keychain and ~/.claude.json can't
             // disagree — captureCurrent refuses a mismatched pair, so leaving
             // one behind would block every capture until a manual re-login.
             if let previousLive {
-                try? await Keychain.upsertLive(service: CredentialBlob.liveService, data: previousLive)
+                try? await deps.writeLive(previousLive)
             }
             throw error
         }
     }
 
-    func remove(email: String) async throws {
-        try await Keychain.delete(service: CredentialBlob.profileService, account: email)
-        // Clean up any staging item a crashed write left behind.
-        try? await Keychain.delete(service: CredentialBlob.profileService,
-                                   account: Keychain.stagingAccount(for: email))
-        profiles.removeAll { $0.email == email }
+    func remove(key: String) async throws {
+        guard let profile = profiles.first(where: { $0.key == key }) else { return }
+        try await deps.deleteProfileBlob(profile.credentialAccount)
+        profiles.removeAll { $0.key == key }
         try save()
     }
 
@@ -307,24 +372,25 @@ final class ProfileStore {
     /// before capture-time verification existed hold another account's tokens
     /// under this email — both rows then report the same usage. Each email is
     /// checked once per launch (a passing audit is cached; failures are not).
-    func auditIdentity(email: String, accessToken: String) async -> AuditOutcome {
-        guard !auditedEmails.contains(email) else { return .verified }
-        let owner: String
+    func auditIdentity(profile: Profile, accessToken: String) async -> AuditOutcome {
+        guard !auditedKeys.contains(profile.key) else { return .verified }
+        guard let expected = profile.identity else { return .unverifiable }
+        let owner: ClaudeAccountIdentity
         do {
-            owner = try await deps.verifyOwner(accessToken)
+            owner = try await deps.verifyIdentity(accessToken)
         } catch {
             return .unverifiable
         }
-        guard owner.caseInsensitiveCompare(email) == .orderedSame else {
+        guard owner == expected else {
             // Drop the foreign copy — the rightful owner's tokens live under
             // their own profile (or the live item), so nothing real is lost,
             // and the row stops reporting another account's usage. The email
             // is deliberately not marked audited: post-re-login credentials
             // get checked afresh.
-            try? await deps.deleteProfileBlob(email)
+            try? await deps.deleteProfileBlob(profile.credentialAccount)
             return .poisoned(owner: owner)
         }
-        auditedEmails.insert(email)
+        auditedKeys.insert(profile.key)
         return .verified
     }
 
@@ -332,7 +398,7 @@ final class ProfileStore {
     ///
     /// For the account `~/.claude.json` names as active this prefers the live
     /// keychain item — Claude Code keeps that one fresh — but only once the
-    /// live blob is known to belong to `email`. The identity file and the
+    /// live blob is known to belong to this profile. The identity file and the
     /// keychain are separate stores written at different moments, and Claude
     /// Desktop ships its own copy of Claude Code that rewrites the very same
     /// live item, so the two genuinely disagree in practice. Using a live blob
@@ -341,20 +407,20 @@ final class ProfileStore {
     /// with theirs — which the identity audit then deletes as poisoned. When
     /// ownership isn't established the saved snapshot is used instead, which
     /// costs only freshness.
-    func blob(for email: String, isActive: Bool) async throws -> (data: Data, source: BlobSource)? {
-        let saved = try await deps.readProfileBlob(email)
+    func blob(for profile: Profile, isActive: Bool) async throws -> (data: Data, source: BlobSource)? {
+        let saved = try await deps.readProfileBlob(profile.credentialAccount)
         if isActive, let live = try await deps.readLive(),
-           await liveBelongs(to: email, blob: live, saved: saved) {
+           await liveBelongs(to: profile, blob: live, saved: saved) {
             return (live, .live)
         }
         guard let saved else { return nil }
         return (saved, .saved)
     }
 
-    /// Whether the live credential item's token belongs to `email`.
+    /// Whether the live credential item's token belongs to `profile`.
     ///
     /// Two cheap answers come first: bytes identical to the snapshot already
-    /// filed under this email (the steady state — nothing has touched the live
+    /// filed under this profile (the steady state — nothing has touched the live
     /// item since the last capture), then the cached result of a previous
     /// check on these same bytes. Only a live item that is genuinely new costs
     /// an HTTP call, and its answer is cached against those bytes, so a
@@ -364,28 +430,35 @@ final class ProfileStore {
     /// identity call — answers false. Falling back to the saved copy is the
     /// safe direction: `captureCurrent` refreshes and re-verifies an expired
     /// live item at the top of the next cycle anyway.
-    private func liveBelongs(to email: String, blob: Data, saved: Data?) async -> Bool {
+    private func liveBelongs(to profile: Profile, blob: Data, saved: Data?) async -> Bool {
+        guard let expected = profile.identity else { return false }
         if let saved, saved == blob { return true }
         if let cached = verifiedLive, cached.blob == blob {
-            return cached.owner.caseInsensitiveCompare(email) == .orderedSame
+            return cached.owner == expected
         }
         guard let creds = try? CredentialBlob.parse(blob), !creds.isExpired,
-              let owner = try? await deps.verifyOwner(creds.accessToken) else { return false }
+              let owner = try? await deps.verifyIdentity(creds.accessToken) else { return false }
         verifiedLive = (blob, owner)
-        return owner.caseInsensitiveCompare(email) == .orderedSame
+        return owner == expected
     }
 
     /// Persist a blob whose tokens we refreshed ourselves, back to wherever
     /// the blob came from. The saved snapshot always tracks the rotation; the
     /// live item is only rewritten when it was the source, so a refresh of an
     /// inactive account can't displace the live session.
-    func storeRefreshedBlob(_ data: Data, email: String, source: BlobSource) async throws {
-        try await deps.writeProfileBlob(email, data)
+    func storeRefreshedBlob(_ data: Data, profile: Profile, source: BlobSource) async throws {
+        try await deps.writeProfileBlob(profile.credentialAccount, data)
         if source == .live {
             try await deps.writeLive(data)
             // The rotation we just wrote is still this account's, so carry the
             // verification across rather than paying for it again next cycle.
-            verifiedLive = (data, email)
+            if let identity = profile.identity {
+                verifiedLive = (data, identity)
+            }
         }
     }
+
+    func profile(forKey key: String) -> Profile? {
+        profiles.first { $0.key == key }
+    }
 }
diff --git a/Sources/PitStop/UsageAPI.swift b/Sources/PitStop/UsageAPI.swift
index 97dcce1..86e4054 100644
--- a/Sources/PitStop/UsageAPI.swift
+++ b/Sources/PitStop/UsageAPI.swift
@@ -265,21 +265,34 @@ enum UsageAPI {
         return req
     }
 
-    /// Fetch the authenticated account's email. [verify] endpoint/shape — used
-    /// only to confirm the re-login matches the target row.
-    static func fetchAccountEmail(accessToken: String) async throws -> String {
+    /// Parse the exact subscription identity returned by `/api/oauth/profile`.
+    /// Email alone is not unique: one user may have personal and team orgs.
+    static func parseAccountIdentity(_ data: Data) throws -> ClaudeAccountIdentity {
+        guard let root = try JSONSerialization.jsonObject(with: data) as? [String: Any] else {
+            throw APIError.malformed
+        }
+        let account = root["account"] as? [String: Any]
+        let organization = root["organization"] as? [String: Any]
+        guard let email = account?["email_address"] as? String
+                ?? account?["email"] as? String
+                ?? root["email_address"] as? String
+                ?? root["email"] as? String,
+              let organizationUUID = organization?["uuid"] as? String
+                ?? root["organization_uuid"] as? String else {
+            throw APIError.malformed
+        }
+        return ClaudeAccountIdentity(email: email, organizationUUID: organizationUUID)
+    }
+
+    /// Fetch the authenticated account and organization. Used to prevent a
+    /// same-email token from being filed under the wrong Claude organization.
+    static func fetchAccountIdentity(accessToken: String) async throws -> ClaudeAccountIdentity {
         let (data, resp) = try await URLSession.shared.data(for: profileRequest(accessToken: accessToken))
         guard let http = resp as? HTTPURLResponse else { throw APIError.malformed }
         if http.statusCode == 401 || http.statusCode == 403 { throw APIError.unauthorized }
-        guard http.statusCode == 200,
-              let root = try JSONSerialization.jsonObject(with: data) as? [String: Any] else {
+        guard http.statusCode == 200 else {
             throw APIError.http(http.statusCode)
         }
-        // Accept a couple of plausible shapes: top-level `email`/`email_address`,
-        // or nested under `account`.
-        if let e = root["email"] as? String ?? root["email_address"] as? String { return e }
-        if let account = root["account"] as? [String: Any],
-           let e = account["email_address"] as? String ?? account["email"] as? String { return e }
-        throw APIError.malformed
+        return try parseAccountIdentity(data)
     }
 }
diff --git a/Sources/PitStop/UsageCache.swift b/Sources/PitStop/UsageCache.swift
index 029d8ab..c645b37 100644
--- a/Sources/PitStop/UsageCache.swift
+++ b/Sources/PitStop/UsageCache.swift
@@ -27,6 +27,34 @@ enum UsageCache {
         var nextFetchAllowed: [String: Date] = [:]
         var needsAction: Set<String> = []
         var desktopAccount: ClaudeDesktop.Account?
+
+        /// Move pre-org-aware bare-email Claude state only when that email has
+        /// one unambiguous organization. Ambiguous legacy state is left behind
+        /// and pruned after the first fresh cycle rather than copied to both.
+        func migratingLegacyClaudeKeys(profiles: [Profile]) -> Snapshot {
+            var copy = self
+            var candidates: [String: Set<String>] = [:]
+            for profile in profiles {
+                candidates[profile.email.lowercased(), default: []].insert(profile.key)
+            }
+            if let desktopAccount {
+                candidates[desktopAccount.email.lowercased(), default: []].insert(desktopAccount.key)
+            }
+            for (email, keys) in candidates where keys.count == 1 {
+                guard let key = keys.first, email != key else { continue }
+                func move<T>(_ dict: inout [String: T]) {
+                    if dict[key] == nil, let value = dict.removeValue(forKey: email) {
+                        dict[key] = value
+                    }
+                }
+                move(&copy.usage)
+                move(&copy.fetchError)
+                move(&copy.failureCount)
+                move(&copy.nextFetchAllowed)
+                if copy.needsAction.remove(email) != nil { copy.needsAction.insert(key) }
+            }
+            return copy
+        }
     }
 
     static func save(_ snapshot: Snapshot, to url: URL = file) throws {
diff --git a/Sources/PitStop/main.swift b/Sources/PitStop/main.swift
index 3e58d6e..166b3de 100644
--- a/Sources/PitStop/main.swift
+++ b/Sources/PitStop/main.swift
@@ -14,13 +14,14 @@ if CommandLine.arguments.contains("--check") {
             print("capture failed: \(error.localizedDescription)")
         }
         store.load()
-        let active = ClaudeConfig.activeEmail() ?? "<none>"
-        print("active account: \(active)")
+        let active = ClaudeConfig.activeIdentity()
+        let activeDescription = active.map { "\($0.email) [\($0.organizationUUID)]" } ?? "<none>"
+        print("active account: \(activeDescription)")
         for profile in store.profiles {
-            let isActive = profile.email == active
+            let isActive = profile.identity == active
             print("\n\(isActive ? "●" : "○") \(profile.email)  [\(profile.planLabel)]")
             do {
-                guard let stored = try await store.blob(for: profile.email, isActive: isActive) else {
+                guard let stored = try await store.blob(for: profile, isActive: isActive) else {
                     print("   no stored credentials")
                     continue
                 }
@@ -35,7 +36,7 @@ if CommandLine.arguments.contains("--check") {
                     let patched = try CredentialBlob.patching(
                         stored.data, accessToken: fresh.accessToken,
                         refreshToken: fresh.refreshToken, expiresAtMs: fresh.expiresAtMs)
-                    try await store.storeRefreshedBlob(patched, email: profile.email,
+                    try await store.storeRefreshedBlob(patched, profile: profile,
                                                        source: stored.source)
                     creds.accessToken = fresh.accessToken
                 }
@@ -50,7 +51,7 @@ if CommandLine.arguments.contains("--check") {
         // Claude Desktop (observe-only — its claude.ai session).
         do {
             if let (acct, report) = try await ClaudeDesktop.poll() {
-                let dup = store.profiles.contains { $0.email == acct.email }
+                let dup = store.profiles.contains { $0.key == acct.key }
                     ? "  (also a saved Code account)" : ""
                 print("\n▣ \(acct.email)  [\(acct.planLabel)]  · Desktop\(dup)")
                 print("   5-hour  \(Format.percent(report.fiveHour?.utilization))  \(Format.reset(report.fiveHour?.resetsAt))")
diff --git a/Tests/PitStopTests/ClaudeExchangeTests.swift b/Tests/PitStopTests/ClaudeExchangeTests.swift
index 1aee198..140aefb 100644
--- a/Tests/PitStopTests/ClaudeExchangeTests.swift
+++ b/Tests/PitStopTests/ClaudeExchangeTests.swift
@@ -27,4 +27,21 @@ final class ClaudeExchangeTests: XCTestCase {
         XCTAssertEqual(req.value(forHTTPHeaderField: "Authorization"), "Bearer sk-ant-oat01-TOKEN")
         XCTAssertEqual(req.value(forHTTPHeaderField: "anthropic-beta"), "oauth-2025-04-20")
     }
+
+    func testProfileIdentityIncludesOrganization() throws {
+        let data = try JSONSerialization.data(withJSONObject: [
+            "account": ["email": "Same@Example.com"],
+            "organization": ["uuid": "ORG-TEAM"],
+        ])
+        XCTAssertEqual(try UsageAPI.parseAccountIdentity(data),
+                       ClaudeAccountIdentity(email: "same@example.com",
+                                             organizationUUID: "org-team"))
+    }
+
+    func testProfileIdentityRequiresOrganization() throws {
+        let data = try JSONSerialization.data(withJSONObject: [
+            "account": ["email": "same@example.com"],
+        ])
+        XCTAssertThrowsError(try UsageAPI.parseAccountIdentity(data))
+    }
 }
diff --git a/Tests/PitStopTests/ClaudeOrganizationTests.swift b/Tests/PitStopTests/ClaudeOrganizationTests.swift
new file mode 100644
index 0000000..877556f
--- /dev/null
+++ b/Tests/PitStopTests/ClaudeOrganizationTests.swift
@@ -0,0 +1,38 @@
+import XCTest
+@testable import PitStop
+
+@MainActor
+final class ClaudeOrganizationTests: XCTestCase {
+    func testSameEmailOrganizationsHaveDistinctKeys() {
+        let team = ClaudeAccountIdentity(email: "Same@Example.com", organizationUUID: "ORG-TEAM")
+        let personal = ClaudeAccountIdentity(email: "same@example.com", organizationUUID: "org-personal")
+
+        XCTAssertNotEqual(team.key, personal.key)
+        XCTAssertEqual(team.email, "same@example.com")
+        XCTAssertEqual(team.organizationUUID, "org-team")
+    }
+
+    func testDesktopMergesOnlyWithExactOrganization() {
+        let desktop = ClaudeDesktop.Account(email: "same@example.com", orgUUID: "org-team",
+                                            planLabel: "Team")
+        let team = ClaudeAccountIdentity(email: "same@example.com", organizationUUID: "org-team")
+        let personal = ClaudeAccountIdentity(email: "same@example.com", organizationUUID: "org-personal")
+
+        XCTAssertEqual(desktop.key, team.key)
+        XCTAssertNotEqual(desktop.key, personal.key)
+    }
+
+    func testAutoSwitchCanSelectOtherOrganizationWithSameEmail() throws {
+        let team = ClaudeAccountIdentity(email: "same@example.com", organizationUUID: "org-team").key
+        let personal = ClaudeAccountIdentity(email: "same@example.com", organizationUUID: "org-personal").key
+        let usage = [team: 95.0, personal: 12.0]
+
+        let decision = try XCTUnwrap(AppDelegate.autoSwitchDecision(
+            live: team, candidates: [team, personal], threshold: 90,
+            utilization: { usage[$0] }))
+
+        XCTAssertEqual(decision.target, personal)
+        XCTAssertEqual(decision.liveUtil, 95)
+        XCTAssertEqual(decision.targetUtil, 12)
+    }
+}
diff --git a/Tests/PitStopTests/GeminiLoginAdapterTests.swift b/Tests/PitStopTests/GeminiLoginAdapterTests.swift
index ccc31b2..1b7a851 100644
--- a/Tests/PitStopTests/GeminiLoginAdapterTests.swift
+++ b/Tests/PitStopTests/GeminiLoginAdapterTests.swift
@@ -4,7 +4,9 @@ import XCTest
 final class GeminiLoginAdapterTests: XCTestCase {
     func testCliAuthorizeURL() {
         let url = GeminiCliLoginAdapter().authorizeURL(
-            challenge: "CH", state: "ST", redirectURI: "http://127.0.0.1:51000/oauth2callback", pasteMode: false)
+            challenge: "CH", state: "ST", redirectURI: "http://127.0.0.1:51000/oauth2callback",
+            pasteMode: false,
+            target: LoginTarget(email: "a@x.com", credentialAccount: "a@x.com"))
         let c = URLComponents(url: url, resolvingAgainstBaseURL: false)!
         XCTAssertEqual(c.host, "accounts.google.com")
         let q = Dictionary(uniqueKeysWithValues: (c.queryItems ?? []).map { ($0.name, $0.value ?? "") })
@@ -27,7 +29,9 @@ final class GeminiLoginAdapterTests: XCTestCase {
     func testAntigravityUsesOwnClientAndScopes() {
         XCTAssertEqual(GeminiAntigravityLoginAdapter().provider, .gemini)
         let url = GeminiAntigravityLoginAdapter().authorizeURL(
-            challenge: "CH", state: "ST", redirectURI: "http://127.0.0.1:51000/oauth2callback", pasteMode: false)
+            challenge: "CH", state: "ST", redirectURI: "http://127.0.0.1:51000/oauth2callback",
+            pasteMode: false,
+            target: LoginTarget(email: "a@x.com", credentialAccount: "a@x.com"))
         let q = Dictionary(uniqueKeysWithValues:
             (URLComponents(url: url, resolvingAgainstBaseURL: false)!.queryItems ?? []).map { ($0.name, $0.value ?? "") })
         XCTAssertEqual(q["client_id"], Gemini.antigravityClient.id)
diff --git a/Tests/PitStopTests/LoginAdapterTests.swift b/Tests/PitStopTests/LoginAdapterTests.swift
index 6ff64f3..d777947 100644
--- a/Tests/PitStopTests/LoginAdapterTests.swift
+++ b/Tests/PitStopTests/LoginAdapterTests.swift
@@ -2,10 +2,14 @@ import XCTest
 @testable import PitStop
 
 final class LoginAdapterTests: XCTestCase {
+    private let target = LoginTarget(email: "a@x.com", organizationID: "org-a",
+                                     credentialAccount: "slot")
+
     func testClaudeAuthorizeURLLoopback() throws {
         let url = ClaudeLoginAdapter().authorizeURL(
             challenge: "CH", state: "ST",
-            redirectURI: "http://localhost:51000/callback", pasteMode: false)
+            redirectURI: "http://localhost:51000/callback", pasteMode: false,
+            target: target)
         let c = URLComponents(url: url, resolvingAgainstBaseURL: false)!
         XCTAssertEqual(c.host, "claude.ai")
         let q = Dictionary(uniqueKeysWithValues: (c.queryItems ?? []).map { ($0.name, $0.value ?? "") })
@@ -17,12 +21,14 @@ final class LoginAdapterTests: XCTestCase {
         XCTAssertEqual(q["redirect_uri"], "http://localhost:51000/callback")
         XCTAssertTrue((q["scope"] ?? "").contains("user:inference"))
         XCTAssertNil(q["code"])                       // no code=true in loopback mode
+        XCTAssertEqual(q["orgUUID"], "org-a")
     }
 
     func testClaudeAuthorizeURLPasteMode() throws {
         let url = ClaudeLoginAdapter().authorizeURL(
             challenge: "CH", state: "ST",
-            redirectURI: ClaudeLoginAdapter().pasteRedirectURI, pasteMode: true)
+            redirectURI: ClaudeLoginAdapter().pasteRedirectURI, pasteMode: true,
+            target: target)
         let q = Dictionary(uniqueKeysWithValues:
             (URLComponents(url: url, resolvingAgainstBaseURL: false)!.queryItems ?? [])
             .map { ($0.name, $0.value ?? "") })
@@ -36,7 +42,8 @@ final class LoginAdapterTests: XCTestCase {
         XCTAssertEqual(a.loopbackPath, "/auth/callback")
         XCTAssertFalse(a.supportsPaste)
         let url = a.authorizeURL(challenge: "CH", state: "ST",
-                                 redirectURI: "http://localhost:1455/auth/callback", pasteMode: false)
+                                 redirectURI: "http://localhost:1455/auth/callback", pasteMode: false,
+                                 target: target)
         let c = URLComponents(url: url, resolvingAgainstBaseURL: false)!
         XCTAssertEqual(c.host, "auth.openai.com")
         let q = Dictionary(uniqueKeysWithValues: (c.queryItems ?? []).map { ($0.name, $0.value ?? "") })
diff --git a/Tests/PitStopTests/OAuthLoginCoordinatorTests.swift b/Tests/PitStopTests/OAuthLoginCoordinatorTests.swift
index 49da521..cf6ed7f 100644
--- a/Tests/PitStopTests/OAuthLoginCoordinatorTests.swift
+++ b/Tests/PitStopTests/OAuthLoginCoordinatorTests.swift
@@ -8,10 +8,12 @@ final class FakeAdapter: LoginAdapter, @unchecked Sendable {
     var loopbackPath: String { "/callback" }
     var supportsPaste: Bool { false }
     var pasteRedirectURI: String { "" }
-    var identityToReturn = LoginIdentity(email: "match@example.com", accountID: nil)
-    var persistedEmails: [String] = []
+    var identityToReturn = LoginIdentity(email: "match@example.com", accountID: nil,
+                                         organizationID: nil)
+    var persistedTargets: [LoginTarget] = []
 
-    func authorizeURL(challenge: String, state: String, redirectURI: String, pasteMode: Bool) -> URL {
+    func authorizeURL(challenge: String, state: String, redirectURI: String,
+                      pasteMode: Bool, target: LoginTarget) -> URL {
         URL(string: "https://example.com/authorize")!
     }
     func exchange(code: String, state: String, verifier: String, redirectURI: String) async throws -> FreshTokens {
@@ -19,38 +21,50 @@ final class FakeAdapter: LoginAdapter, @unchecked Sendable {
     }
     func identity(from tokens: FreshTokens) async throws -> LoginIdentity { identityToReturn }
     func buildBlob(old: Data, tokens: FreshTokens) throws -> Data { Data() }
-    func persist(_ tokens: FreshTokens, email: String) async throws { persistedEmails.append(email) }
+    func persist(_ tokens: FreshTokens, target: LoginTarget) async throws {
+        persistedTargets.append(target)
+    }
 }
 
 final class OAuthLoginCoordinatorTests: XCTestCase {
-    func testEmailMatchNormalizes() {
-        XCTAssertTrue(OAuthLoginCoordinator.emailMatches(
-            expected: "User@Example.com ", LoginIdentity(email: "user@example.com", accountID: nil)))
-        XCTAssertFalse(OAuthLoginCoordinator.emailMatches(
-            expected: "a@x.com", LoginIdentity(email: "b@x.com", accountID: nil)))
+    func testIdentityMatchNormalizesEmailAndChecksOrganization() {
+        let target = LoginTarget(email: "User@Example.com ", organizationID: "ORG-A",
+                                 credentialAccount: "slot")
+        XCTAssertTrue(OAuthLoginCoordinator.identityMatches(
+            target: target, LoginIdentity(email: "user@example.com", accountID: nil,
+                                          organizationID: "org-a")))
+        XCTAssertFalse(OAuthLoginCoordinator.identityMatches(
+            target: target, LoginIdentity(email: "user@example.com", accountID: nil,
+                                          organizationID: "org-b")))
+        XCTAssertFalse(OAuthLoginCoordinator.identityMatches(
+            target: target, LoginIdentity(email: "b@x.com", accountID: nil,
+                                          organizationID: "org-a")))
     }
 
     func testFinishPersistsOnMatch() async throws {
         let a = FakeAdapter()
+        let target = LoginTarget(email: "match@example.com", credentialAccount: "saved-slot")
         try await OAuthLoginCoordinator().finish(
-            adapter: a, expectedEmail: "match@example.com",
+            adapter: a, target: target,
             code: "C", state: "S", verifier: "V", redirectURI: "http://localhost:51900/callback")
-        XCTAssertEqual(a.persistedEmails, ["match@example.com"])
+        XCTAssertEqual(a.persistedTargets, [target])
     }
 
     func testFinishRejectsOnMismatch() async {
         let a = FakeAdapter()
-        a.identityToReturn = LoginIdentity(email: "other@example.com", accountID: nil)
+        a.identityToReturn = LoginIdentity(email: "other@example.com", accountID: nil,
+                                           organizationID: nil)
         do {
             try await OAuthLoginCoordinator().finish(
-                adapter: a, expectedEmail: "match@example.com",
+                adapter: a,
+                target: LoginTarget(email: "match@example.com", credentialAccount: "slot"),
                 code: "C", state: "S", verifier: "V", redirectURI: "x")
             XCTFail("expected mismatch")
         } catch {
             guard case LoginError.identityMismatch = error else {
                 return XCTFail("expected .identityMismatch, got \(error)")
             }
-            XCTAssertTrue(a.persistedEmails.isEmpty)   // nothing written
+            XCTAssertTrue(a.persistedTargets.isEmpty)   // nothing written
         }
     }
 }
diff --git a/Tests/PitStopTests/ProfileStoreCaptureTests.swift b/Tests/PitStopTests/ProfileStoreCaptureTests.swift
index b6fcf14..c5bc574 100644
--- a/Tests/PitStopTests/ProfileStoreCaptureTests.swift
+++ b/Tests/PitStopTests/ProfileStoreCaptureTests.swift
@@ -11,7 +11,8 @@ private final class CaptureHarness {
     var savedBlobs: [String: Data] = [:]
     var deletedBlobs: [String] = []
     var liveWrites: [Data] = []
-    var owners: [String: String] = [:]   // access token → verified owner email
+    var owners: [String: ClaudeAccountIdentity] = [:]
+    var configuredAccounts: [[String: Any]] = []
     var verifyCalls = 0
     var verifyError: Error?
     var refreshed: (access: String, refresh: String?, expMs: Double)?
@@ -28,7 +29,8 @@ private final class CaptureHarness {
             deleteProfileBlob: { [self] in deletedBlobs.append($0); savedBlobs[$0] = nil },
             writeLive: { [self] in liveWrites.append($0); live = $0 },
             oauthAccount: { [self] in account },
-            verifyOwner: { [self] token in
+            setOauthAccount: { [self] account in configuredAccounts.append(account) },
+            verifyIdentity: { [self] token in
                 verifyCalls += 1
                 if let verifyError { throw verifyError }
                 guard let owner = owners[token] else { throw UsageAPI.APIError.unauthorized }
@@ -42,6 +44,27 @@ private final class CaptureHarness {
     }
 }
 
+private func identity(_ email: String = "a@x.com", _ org: String = "org-a")
+    -> ClaudeAccountIdentity {
+    ClaudeAccountIdentity(email: email, organizationUUID: org)
+}
+
+private func account(_ email: String = "a@x.com", _ org: String = "org-a",
+                     name: String? = nil) -> [String: Any] {
+    var value: [String: Any] = ["emailAddress": email, "organizationUuid": org]
+    if let name { value["organizationName"] = name }
+    return value
+}
+
+private func profile(_ email: String = "a@x.com", _ org: String = "org-a",
+                     credentialAccount: String? = nil) -> Profile {
+    let oauth = account(email, org)
+    let id = identity(email, org)
+    return Profile(email: email, savedAt: Date(), subscriptionType: "team",
+                   rateLimitTier: nil, credentialAccount: credentialAccount ?? id.key,
+                   oauthAccount: oauth)
+}
+
 private func blob(access: String, refresh: String? = "rt",
                   expiresAt: Date = Date(timeIntervalSinceNow: 3600)) -> Data {
     var oauth: [String: Any] = [
@@ -61,22 +84,22 @@ final class ProfileStoreCaptureTests: XCTestCase {
     func testCaptureRejectsBlobBelongingToAnotherAccount() async throws {
         let h = CaptureHarness()
         h.live = blob(access: "at-b")
-        h.account = ["emailAddress": "a@x.com"]
-        h.owners["at-b"] = "b@x.com"
+        h.account = account("a@x.com", "org-a")
+        h.owners["at-b"] = identity("b@x.com", "org-b")
         let store = h.makeStore()
 
         do {
             _ = try await store.captureCurrent()
             XCTFail("crossed capture should throw")
         } catch let e as ProfileStore.CaptureError {
-            guard case .mismatch(let owner, let email) = e else {
+            guard case .mismatch(let owner, let expected) = e else {
                 return XCTFail("wrong error: \(e)")
             }
-            XCTAssertEqual(owner, "b@x.com")
-            XCTAssertEqual(email, "a@x.com")
+            XCTAssertEqual(owner, identity("b@x.com", "org-b"))
+            XCTAssertEqual(expected, identity("a@x.com", "org-a"))
         }
         XCTAssertTrue(store.profiles.isEmpty)
-        XCTAssertNil(h.savedBlobs["a@x.com"])
+        XCTAssertNil(h.savedBlobs[identity().key])
         XCTAssertFalse(FileManager.default.fileExists(atPath: h.file.path))
     }
 
@@ -86,7 +109,8 @@ final class ProfileStoreCaptureTests: XCTestCase {
     /// NSAlert and in `--check`'s "capture failed:" line.
     func testMismatchMessageNamesBothAccountsAndTheFix() {
         let text = ProfileStore.CaptureError
-            .mismatch(tokenOwner: "b@x.com", configEmail: "a@x.com")
+            .mismatch(tokenOwner: identity("b@x.com", "org-b"),
+                      configIdentity: identity("a@x.com", "org-a"))
             .localizedDescription
         XCTAssertTrue(text.contains("b@x.com"), text)
         XCTAssertTrue(text.contains("a@x.com"), text)
@@ -97,25 +121,186 @@ final class ProfileStoreCaptureTests: XCTestCase {
     func testCaptureFilesVerifiedBlob() async throws {
         let h = CaptureHarness()
         h.live = blob(access: "at-a")
-        h.account = ["emailAddress": "a@x.com", "organizationName": "Acme"]
-        h.owners["at-a"] = "A@X.com"   // owner match is case-insensitive
+        h.account = account("a@x.com", "org-a", name: "Acme")
+        h.owners["at-a"] = identity("A@X.com", "ORG-A")
         let store = h.makeStore()
 
         let (profile, changed) = try await store.captureCurrent()
 
         XCTAssertEqual(profile?.email, "a@x.com")
         XCTAssertTrue(changed)
-        XCTAssertEqual(h.savedBlobs["a@x.com"], h.live)
+        XCTAssertEqual(h.savedBlobs[identity().key], h.live)
         XCTAssertEqual(store.profiles.count, 1)
     }
 
+    func testCaptureKeepsTwoOrganizationsWithSameEmailSeparate() async throws {
+        let h = CaptureHarness()
+        let teamBlob = blob(access: "at-team")
+        h.live = teamBlob
+        h.account = account("same@x.com", "org-team", name: "Team")
+        h.owners["at-team"] = identity("same@x.com", "org-team")
+        let store = h.makeStore()
+        let teamCapture = try await store.captureCurrent()
+        let team = try XCTUnwrap(teamCapture.profile)
+
+        let personalBlob = blob(access: "at-personal")
+        h.live = personalBlob
+        h.account = account("same@x.com", "org-personal")
+        h.owners["at-personal"] = identity("same@x.com", "org-personal")
+        let personalCapture = try await store.captureCurrent()
+        let personal = try XCTUnwrap(personalCapture.profile)
+
+        XCTAssertEqual(store.profiles.count, 2)
+        XCTAssertNotEqual(team.key, personal.key)
+        XCTAssertEqual(h.savedBlobs[team.credentialAccount], teamBlob)
+        XCTAssertEqual(h.savedBlobs[personal.credentialAccount], personalBlob)
+    }
+
+    func testCaptureRejectsSameEmailFromWrongOrganization() async throws {
+        let h = CaptureHarness()
+        h.live = blob(access: "at-personal")
+        h.account = account("same@x.com", "org-team")
+        h.owners["at-personal"] = identity("same@x.com", "org-personal")
+
+        do {
+            _ = try await h.makeStore().captureCurrent()
+            XCTFail("same-email wrong-org capture should throw")
+        } catch let error as ProfileStore.CaptureError {
+            guard case .mismatch(let owner, let expected) = error else {
+                return XCTFail("wrong error: \(error)")
+            }
+            XCTAssertEqual(owner.organizationUUID, "org-personal")
+            XCTAssertEqual(expected.organizationUUID, "org-team")
+        }
+        XCTAssertTrue(h.savedBlobs.isEmpty)
+    }
+
+    func testLegacyEmailCredentialSurvivesAddingSecondOrganization() async throws {
+        let h = CaptureHarness()
+        try FileManager.default.createDirectory(at: h.file.deletingLastPathComponent(),
+                                                withIntermediateDirectories: true)
+        let legacy: [String: Any] = ["profiles": [[
+            "email": "same@x.com",
+            "savedAt": Date().timeIntervalSince1970,
+            "oauthAccount": account("same@x.com", "org-team", name: "Team"),
+            "subscriptionType": "team",
+        ]]]
+        try JSONSerialization.data(withJSONObject: legacy).write(to: h.file)
+        let teamBlob = blob(access: "at-team")
+        h.savedBlobs["same@x.com"] = teamBlob
+
+        let personalBlob = blob(access: "at-personal")
+        h.live = personalBlob
+        h.account = account("same@x.com", "org-personal")
+        h.owners["at-personal"] = identity("same@x.com", "org-personal")
+        let store = h.makeStore()
+
+        let migratedData = try Data(contentsOf: h.file)
+        let migratedRoot = try XCTUnwrap(
+            try JSONSerialization.jsonObject(with: migratedData) as? [String: Any])
+        let migratedProfiles = try XCTUnwrap(migratedRoot["profiles"] as? [[String: Any]])
+        XCTAssertEqual(migratedProfiles.first?["credentialAccount"] as? String, "same@x.com")
+
+        _ = try await store.captureCurrent()
+
+        XCTAssertEqual(store.profiles.count, 2)
+        let team = try XCTUnwrap(store.profiles.first { $0.identity == identity("same@x.com", "org-team") })
+        let personal = try XCTUnwrap(store.profiles.first { $0.identity == identity("same@x.com", "org-personal") })
+        XCTAssertEqual(team.credentialAccount, "same@x.com")
+        XCTAssertEqual(h.savedBlobs[team.credentialAccount], teamBlob)
+        XCTAssertEqual(h.savedBlobs[personal.credentialAccount], personalBlob)
+    }
+
+    func testLegacyUnchangedCaptureStillVerifiesOrganization() async throws {
+        let h = CaptureHarness()
+        try FileManager.default.createDirectory(at: h.file.deletingLastPathComponent(),
+                                                withIntermediateDirectories: true)
+        let legacy: [String: Any] = ["profiles": [[
+            "email": "same@x.com",
+            "savedAt": Date().timeIntervalSince1970,
+            "oauthAccount": account("same@x.com", "org-team", name: "Team"),
+            "subscriptionType": "team",
+        ]]]
+        try JSONSerialization.data(withJSONObject: legacy).write(to: h.file)
+
+        // The old email-only verifier could file another organization's token
+        // under this metadata. Matching bytes must not bypass the first exact
+        // organization check after upgrade.
+        let crossedBlob = blob(access: "at-personal")
+        h.live = crossedBlob
+        h.savedBlobs["same@x.com"] = crossedBlob
+        h.account = account("same@x.com", "org-team", name: "Team")
+        h.owners["at-personal"] = identity("same@x.com", "org-personal")
+        let store = h.makeStore()
+
+        do {
+            _ = try await store.captureCurrent()
+            XCTFail("legacy same-email crossed capture should be reverified")
+        } catch let error as ProfileStore.CaptureError {
+            guard case .mismatch(let owner, let expected) = error else {
+                return XCTFail("wrong error: \(error)")
+            }
+            XCTAssertEqual(owner, identity("same@x.com", "org-personal"))
+            XCTAssertEqual(expected, identity("same@x.com", "org-team"))
+        }
+        XCTAssertEqual(h.verifyCalls, 1)
+    }
+
+    func testLegacyValidCapturePersistsExactVerification() async throws {
+        let h = CaptureHarness()
+        try FileManager.default.createDirectory(at: h.file.deletingLastPathComponent(),
+                                                withIntermediateDirectories: true)
+        let legacy: [String: Any] = ["profiles": [[
+            "email": "same@x.com",
+            "savedAt": Date().timeIntervalSince1970,
+            "oauthAccount": account("same@x.com", "org-team", name: "Team"),
+            "subscriptionType": "team",
+        ]]]
+        try JSONSerialization.data(withJSONObject: legacy).write(to: h.file)
+        let validBlob = blob(access: "at-team")
+        h.live = validBlob
+        h.savedBlobs["same@x.com"] = validBlob
+        h.account = account("same@x.com", "org-team", name: "Team")
+        h.owners["at-team"] = identity("same@x.com", "org-team")
+
+        let first = try await h.makeStore().captureCurrent()
+        XCTAssertTrue(first.changed)
+        XCTAssertEqual(h.verifyCalls, 1)
+
+        // The successful exact check is durable, so the next launch can take
+        // the unchanged fast path without another profile request.
+        let second = try await h.makeStore().captureCurrent()
+        XCTAssertFalse(second.changed)
+        XCTAssertEqual(h.verifyCalls, 1)
+    }
+
+    func testSwitchTargetsExactSameEmailOrganization() async throws {
+        let h = CaptureHarness()
+        h.live = blob(access: "at-team")
+        h.account = account("same@x.com", "org-team", name: "Team")
+        h.owners["at-team"] = identity("same@x.com", "org-team")
+        let store = h.makeStore()
+        let teamCapture = try await store.captureCurrent()
+        let team = try XCTUnwrap(teamCapture.profile)
+
+        h.live = blob(access: "at-personal")
+        h.account = account("same@x.com", "org-personal")
+        h.owners["at-personal"] = identity("same@x.com", "org-personal")
+        _ = try await store.captureCurrent()
+
+        try await store.switchTo(key: team.key)
+
+        XCTAssertEqual(try CredentialBlob.parse(try XCTUnwrap(h.live)).accessToken, "at-team")
+        XCTAssertEqual(h.configuredAccounts.last?["organizationUuid"] as? String, "org-team")
+    }
+
     /// captureCurrent runs every refresh cycle — the identity check must only
     /// fire when the credentials actually changed, not add an HTTP call per tick.
     func testCaptureSkipsVerificationWhenNothingChanged() async throws {
         let h = CaptureHarness()
         h.live = blob(access: "at-a")
-        h.account = ["emailAddress": "a@x.com"]
-        h.owners["at-a"] = "a@x.com"
+        h.account = account()
+        h.owners["at-a"] = identity()
         _ = try await h.makeStore().captureCurrent()
         XCTAssertEqual(h.verifyCalls, 1)
 
@@ -136,10 +321,10 @@ final class ProfileStoreCaptureTests: XCTestCase {
         let h = CaptureHarness()
         h.live = blob(access: "at-old", refresh: "rt-old",
                       expiresAt: Date(timeIntervalSinceNow: -60))
-        h.account = ["emailAddress": "a@x.com"]
+        h.account = account()
         h.refreshed = ("at-new", "rt-new",
                        Date(timeIntervalSinceNow: 3600).timeIntervalSince1970 * 1000)
-        h.owners["at-new"] = "a@x.com"
+        h.owners["at-new"] = identity()
         let store = h.makeStore()
 
         let (profile, changed) = try await store.captureCurrent()
@@ -147,7 +332,7 @@ final class ProfileStoreCaptureTests: XCTestCase {
         XCTAssertEqual(profile?.email, "a@x.com")
         XCTAssertTrue(changed)
         XCTAssertEqual(h.refreshCalls, 1)
-        let filed = try CredentialBlob.parse(try XCTUnwrap(h.savedBlobs["a@x.com"]))
+        let filed = try CredentialBlob.parse(try XCTUnwrap(h.savedBlobs[identity().key]))
         XCTAssertEqual(filed.accessToken, "at-new")
         XCTAssertEqual(filed.refreshToken, "rt-new")
         XCTAssertEqual(h.liveWrites.count, 1)
@@ -156,7 +341,7 @@ final class ProfileStoreCaptureTests: XCTestCase {
     func testCaptureFilesNothingWhenVerificationFails() async throws {
         let h = CaptureHarness()
         h.live = blob(access: "at-a")
-        h.account = ["emailAddress": "a@x.com"]
+        h.account = account()
         h.verifyError = URLError(.notConnectedToInternet)
         let store = h.makeStore()
 
@@ -183,11 +368,12 @@ final class ProfileStoreLiveOwnershipTests: XCTestCase {
     /// under this email, which settles ownership without an HTTP call.
     func testUnchangedLiveItemIsUsedWithoutVerifying() async throws {
         let h = CaptureHarness()
+        let p = profile(credentialAccount: "a@x.com")
         h.live = blob(access: "at-a")
-        h.savedBlobs["a@x.com"] = h.live
+        h.savedBlobs[p.credentialAccount] = h.live
         let store = h.makeStore()
 
-        let stored = try await store.blob(for: "a@x.com", isActive: true)
+        let stored = try await store.blob(for: p, isActive: true)
 
         XCTAssertEqual(stored?.data, h.live)
         XCTAssertEqual(stored?.source, .live)
@@ -198,15 +384,16 @@ final class ProfileStoreLiveOwnershipTests: XCTestCase {
     /// while ~/.claude.json still named the old account.
     func testForeignLiveItemFallsBackToSavedSnapshot() async throws {
         let h = CaptureHarness()
+        let p = profile(credentialAccount: "a@x.com")
         h.live = blob(access: "at-b")               // Desktop's account
-        h.savedBlobs["a@x.com"] = blob(access: "at-a")
-        h.owners["at-b"] = "b@x.com"
+        h.savedBlobs[p.credentialAccount] = blob(access: "at-a")
+        h.owners["at-b"] = identity("b@x.com", "org-b")
         let store = h.makeStore()
 
-        let stored = try await store.blob(for: "a@x.com", isActive: true)
+        let stored = try await store.blob(for: p, isActive: true)
 
         XCTAssertEqual(stored?.source, .saved)
-        XCTAssertEqual(stored?.data, h.savedBlobs["a@x.com"])
+        XCTAssertEqual(stored?.data, h.savedBlobs[p.credentialAccount])
         XCTAssertEqual(h.verifyCalls, 1)
     }
 
@@ -214,18 +401,19 @@ final class ProfileStoreLiveOwnershipTests: XCTestCase {
     /// snapshot and never be written back over the live item.
     func testRefreshOfFallbackNeverTouchesLiveItem() async throws {
         let h = CaptureHarness()
+        let p = profile(credentialAccount: "a@x.com")
         let desktopBlob = blob(access: "at-b")
         h.live = desktopBlob
-        h.savedBlobs["a@x.com"] = blob(access: "at-a")
-        h.owners["at-b"] = "b@x.com"
+        h.savedBlobs[p.credentialAccount] = blob(access: "at-a")
+        h.owners["at-b"] = identity("b@x.com", "org-b")
         let store = h.makeStore()
 
-        let fetched = try await store.blob(for: "a@x.com", isActive: true)
+        let fetched = try await store.blob(for: p, isActive: true)
         let stored = try XCTUnwrap(fetched)
         let rotated = blob(access: "at-a2")
-        try await store.storeRefreshedBlob(rotated, email: "a@x.com", source: stored.source)
+        try await store.storeRefreshedBlob(rotated, profile: p, source: stored.source)
 
-        XCTAssertEqual(h.savedBlobs["a@x.com"], rotated)
+        XCTAssertEqual(h.savedBlobs[p.credentialAccount], rotated)
         XCTAssertTrue(h.liveWrites.isEmpty)
         XCTAssertEqual(h.live, desktopBlob)   // still Desktop's, untouched
     }
@@ -234,13 +422,14 @@ final class ProfileStoreLiveOwnershipTests: XCTestCase {
     /// after the last capture — is verified once and then cached by its bytes.
     func testNewLiveItemIsVerifiedOnceThenCached() async throws {
         let h = CaptureHarness()
+        let p = profile(credentialAccount: "a@x.com")
         h.live = blob(access: "at-a2")
-        h.savedBlobs["a@x.com"] = blob(access: "at-a")
-        h.owners["at-a2"] = "A@X.com"               // case-insensitive match
+        h.savedBlobs[p.credentialAccount] = blob(access: "at-a")
+        h.owners["at-a2"] = identity("A@X.com", "ORG-A")
         let store = h.makeStore()
 
         for _ in 0..<3 {
-            let stored = try await store.blob(for: "a@x.com", isActive: true)
+            let stored = try await store.blob(for: p, isActive: true)
             XCTAssertEqual(stored?.source, .live)
         }
         XCTAssertEqual(h.verifyCalls, 1)
@@ -250,13 +439,14 @@ final class ProfileStoreLiveOwnershipTests: XCTestCase {
     /// same answer for as long as the mismatch lasts.
     func testForeignLiveItemIsVerifiedOnlyOnce() async throws {
         let h = CaptureHarness()
+        let p = profile(credentialAccount: "a@x.com")
         h.live = blob(access: "at-b")
-        h.savedBlobs["a@x.com"] = blob(access: "at-a")
-        h.owners["at-b"] = "b@x.com"
+        h.savedBlobs[p.credentialAccount] = blob(access: "at-a")
+        h.owners["at-b"] = identity("b@x.com", "org-b")
         let store = h.makeStore()
 
         for _ in 0..<3 {
-            let stored = try await store.blob(for: "a@x.com", isActive: true)
+            let stored = try await store.blob(for: p, isActive: true)
             XCTAssertEqual(stored?.source, .saved)
         }
         XCTAssertEqual(h.verifyCalls, 1)
@@ -267,17 +457,18 @@ final class ProfileStoreLiveOwnershipTests: XCTestCase {
     func testCaptureVerificationPrimesTheCache() async throws {
         let h = CaptureHarness()
         h.live = blob(access: "at-a")
-        h.account = ["emailAddress": "a@x.com"]
-        h.owners["at-a"] = "a@x.com"
+        h.account = account()
+        h.owners["at-a"] = identity()
         let store = h.makeStore()
 
-        _ = try await store.captureCurrent()
+        let captured = try await store.captureCurrent()
+        let p = try XCTUnwrap(captured.profile)
         XCTAssertEqual(h.verifyCalls, 1)
         // captureCurrent filed the blob, so the byte-equality path settles this
         // one anyway; drop the snapshot to force the cache to answer.
-        h.savedBlobs["a@x.com"] = nil
+        h.savedBlobs[p.credentialAccount] = nil
 
-        let stored = try await store.blob(for: "a@x.com", isActive: true)
+        let stored = try await store.blob(for: p, isActive: true)
         XCTAssertEqual(stored?.source, .live)
         XCTAssertEqual(h.verifyCalls, 1)
     }
@@ -286,43 +477,46 @@ final class ProfileStoreLiveOwnershipTests: XCTestCase {
     /// captureCurrent refreshes and re-verifies the live item next cycle.
     func testUnverifiableLiveItemFallsBackToSavedSnapshot() async throws {
         let h = CaptureHarness()
+        let p = profile(credentialAccount: "a@x.com")
         h.live = blob(access: "at-?")
-        h.savedBlobs["a@x.com"] = blob(access: "at-a")
+        h.savedBlobs[p.credentialAccount] = blob(access: "at-a")
         h.verifyError = URLError(.notConnectedToInternet)
         let store = h.makeStore()
 
-        let offline = try await store.blob(for: "a@x.com", isActive: true)
+        let offline = try await store.blob(for: p, isActive: true)
         XCTAssertEqual(offline?.source, .saved)
 
         // An expired live token can't be identified at all, so it doesn't even
         // reach the identity endpoint.
         h.verifyError = nil
         h.live = blob(access: "at-old", expiresAt: Date(timeIntervalSinceNow: -60))
-        h.owners["at-old"] = "a@x.com"
+        h.owners["at-old"] = identity()
         let store2 = h.makeStore()
         let callsBefore = h.verifyCalls
-        let expired = try await store2.blob(for: "a@x.com", isActive: true)
+        let expired = try await store2.blob(for: p, isActive: true)
         XCTAssertEqual(expired?.source, .saved)
         XCTAssertEqual(h.verifyCalls, callsBefore)
     }
 
     func testInactiveAccountAlwaysUsesItsSnapshot() async throws {
         let h = CaptureHarness()
+        let p = profile(credentialAccount: "a@x.com")
         h.live = blob(access: "at-b")
-        h.savedBlobs["a@x.com"] = blob(access: "at-a")
+        h.savedBlobs[p.credentialAccount] = blob(access: "at-a")
         let store = h.makeStore()
 
-        let stored = try await store.blob(for: "a@x.com", isActive: false)
+        let stored = try await store.blob(for: p, isActive: false)
 
         XCTAssertEqual(stored?.source, .saved)
-        XCTAssertEqual(stored?.data, h.savedBlobs["a@x.com"])
+        XCTAssertEqual(stored?.data, h.savedBlobs[p.credentialAccount])
         XCTAssertEqual(h.verifyCalls, 0)
     }
 
     func testNoCredentialsAnywhereReturnsNil() async throws {
         let h = CaptureHarness()
+        let p = profile(credentialAccount: "a@x.com")
         let store = h.makeStore()
-        let stored = try await store.blob(for: "a@x.com", isActive: true)
+        let stored = try await store.blob(for: p, isActive: true)
         XCTAssertNil(stored)
     }
 
@@ -330,14 +524,15 @@ final class ProfileStoreLiveOwnershipTests: XCTestCase {
     /// own session survives PitStop refreshing its token.
     func testRefreshOfLiveSourceWritesBothStores() async throws {
         let h = CaptureHarness()
+        let p = profile(credentialAccount: "a@x.com")
         h.live = blob(access: "at-a")
-        h.savedBlobs["a@x.com"] = h.live
+        h.savedBlobs[p.credentialAccount] = h.live
         let store = h.makeStore()
 
         let rotated = blob(access: "at-a2")
-        try await store.storeRefreshedBlob(rotated, email: "a@x.com", source: .live)
+        try await store.storeRefreshedBlob(rotated, profile: p, source: .live)
 
-        XCTAssertEqual(h.savedBlobs["a@x.com"], rotated)
+        XCTAssertEqual(h.savedBlobs[p.credentialAccount], rotated)
         XCTAssertEqual(h.liveWrites, [rotated])
         XCTAssertEqual(h.live, rotated)
     }
@@ -351,28 +546,30 @@ final class ProfileStoreAuditTests: XCTestCase {
 
     func testAuditDeletesPoisonedBlobAndReportsOwner() async throws {
         let h = CaptureHarness()
-        h.savedBlobs["a@x.com"] = blob(access: "at-b")
-        h.owners["at-b"] = "b@x.com"
+        let p = profile()
+        h.savedBlobs[p.credentialAccount] = blob(access: "at-b")
+        h.owners["at-b"] = identity("b@x.com", "org-b")
         let store = h.makeStore()
 
-        let outcome = await store.auditIdentity(email: "a@x.com", accessToken: "at-b")
+        let outcome = await store.auditIdentity(profile: p, accessToken: "at-b")
 
-        XCTAssertEqual(outcome, .poisoned(owner: "b@x.com"))
-        XCTAssertEqual(h.deletedBlobs, ["a@x.com"])
-        XCTAssertNil(h.savedBlobs["a@x.com"])
+        XCTAssertEqual(outcome, .poisoned(owner: identity("b@x.com", "org-b")))
+        XCTAssertEqual(h.deletedBlobs, [p.credentialAccount])
+        XCTAssertNil(h.savedBlobs[p.credentialAccount])
         // A poisoned row is never marked audited — after a re-login the new
         // credentials must be re-checked, not waved through.
-        let again = await store.auditIdentity(email: "a@x.com", accessToken: "at-b")
-        XCTAssertEqual(again, .poisoned(owner: "b@x.com"))
+        let again = await store.auditIdentity(profile: p, accessToken: "at-b")
+        XCTAssertEqual(again, .poisoned(owner: identity("b@x.com", "org-b")))
     }
 
     func testAuditVerifiesOncePerLaunch() async throws {
         let h = CaptureHarness()
-        h.owners["at-a"] = "A@x.com"   // case-insensitive match
+        let p = profile()
+        h.owners["at-a"] = identity("A@x.com", "ORG-A")
         let store = h.makeStore()
 
-        let first = await store.auditIdentity(email: "a@x.com", accessToken: "at-a")
-        let second = await store.auditIdentity(email: "a@x.com", accessToken: "at-a")
+        let first = await store.auditIdentity(profile: p, accessToken: "at-a")
+        let second = await store.auditIdentity(profile: p, accessToken: "at-a")
 
         XCTAssertEqual(first, .verified)
         XCTAssertEqual(second, .verified)
@@ -384,14 +581,15 @@ final class ProfileStoreAuditTests: XCTestCase {
         let h = CaptureHarness()
         h.verifyError = URLError(.timedOut)
         let store = h.makeStore()
+        let p = profile()
 
-        let outcome = await store.auditIdentity(email: "a@x.com", accessToken: "at-a")
+        let outcome = await store.auditIdentity(profile: p, accessToken: "at-a")
         XCTAssertEqual(outcome, .unverifiable)
         XCTAssertTrue(h.deletedBlobs.isEmpty)
 
         h.verifyError = nil
-        h.owners["at-a"] = "a@x.com"
-        let retried = await store.auditIdentity(email: "a@x.com", accessToken: "at-a")
+        h.owners["at-a"] = identity()
+        let retried = await store.auditIdentity(profile: p, accessToken: "at-a")
         XCTAssertEqual(retried, .verified)
         XCTAssertEqual(h.verifyCalls, 2)
     }
diff --git a/Tests/PitStopTests/UsageCacheTests.swift b/Tests/PitStopTests/UsageCacheTests.swift
index ec46a2b..51440fd 100644
--- a/Tests/PitStopTests/UsageCacheTests.swift
+++ b/Tests/PitStopTests/UsageCacheTests.swift
@@ -133,4 +133,39 @@ final class UsageCacheTests: XCTestCase {
         try Data("not json".utf8).write(to: url)
         XCTAssertNil(UsageCache.load(from: url, now: Date()))
     }
+
+    func testMigratesBareEmailStateForOneClaudeOrganization() throws {
+        let now = Date()
+        var snap = sampleSnapshot(now: now)
+        snap.desktopAccount = ClaudeDesktop.Account(email: "a@x.com", orgUUID: "org-a",
+                                                    planLabel: "Team")
+        let oauth: [String: Any] = ["emailAddress": "a@x.com", "organizationUuid": "org-a"]
+        let id = ClaudeAccountIdentity(email: "a@x.com", organizationUUID: "org-a")
+        let p = Profile(email: "a@x.com", savedAt: now, subscriptionType: "team",
+                        rateLimitTier: nil, credentialAccount: "a@x.com", oauthAccount: oauth)
+
+        let migrated = snap.migratingLegacyClaudeKeys(profiles: [p])
+
+        XCTAssertNil(migrated.usage["a@x.com"])
+        XCTAssertNotNil(migrated.usage[id.key])
+        XCTAssertEqual(migrated.fetchError[id.key], "Rate limited")
+        XCTAssertEqual(migrated.failureCount[id.key], 2)
+        XCTAssertNotNil(migrated.nextFetchAllowed[id.key])
+    }
+
+    func testDoesNotCopyAmbiguousBareEmailStateToTwoOrganizations() throws {
+        let now = Date()
+        let snap = sampleSnapshot(now: now)
+        func make(_ org: String) -> Profile {
+            let oauth: [String: Any] = ["emailAddress": "a@x.com", "organizationUuid": org]
+            return Profile(email: "a@x.com", savedAt: now, subscriptionType: nil,
+                           rateLimitTier: nil, credentialAccount: org, oauthAccount: oauth)
+        }
+
+        let migrated = snap.migratingLegacyClaudeKeys(profiles: [make("org-a"), make("org-b")])
+
+        XCTAssertNotNil(migrated.usage["a@x.com"])
+        XCTAssertNil(migrated.usage[ClaudeAccountIdentity(email: "a@x.com",
+                                                          organizationUUID: "org-a").key])
+    }
 }