@cortexkit/opencode-magic-context 0.45.0 → 0.46.1

package/src/shared/model-suggestion-retry.test.ts

@@ -1,4 +1,6 @@
-import { describe, expect, mock, test } from "bun:test";
+import { describe, expect, mock, spyOn, test } from "bun:test";
+import { withDreamerModelCooldown } from "../features/magic-context/dreamer/provider-output-failure";
+import { recordedGeminiQuotaMessages } from "../features/magic-context/dreamer/provider-output-failure.test-support";
 
 import { HiddenAgentStepLimit } from "../v2/hooks/hidden-child";
 import {
@@ -406,6 +408,107 @@ describe("promptSyncWithModelSuggestionRetry", () => {
     });
 });
 
+describe("run-scoped primary quota cooldown", () => {
+    test("preserves fallback order, retries the primary after reset, and forgets it in a new run", async () => {
+        let now = 1791425104275;
+        const clock = spyOn(Date, "now").mockImplementation(() => now);
+        const models: string[] = [];
+        const primary = { providerID: "google", modelID: "antigravity-gemini-3.8-flash" };
+        let latestModel = "";
+        let primaryCalls = 0;
+        const client = createClient(
+            mock(async (args: PromptCall) => {
+                latestModel = `${args.body.model?.providerID}/${args.body.model?.modelID}`;
+                models.push(latestModel);
+                if (latestModel.startsWith("google/")) primaryCalls++;
+                if (latestModel === "deepseek/first") throw new Error("fallback unavailable");
+                return {};
+            }),
+        );
+        const run = () =>
+            promptSyncWithValidatedOutputRetry(client, createArgs(primary), {
+                fallbackModels: ["deepseek/first", "deepseek/second"],
+                fetchOutput: async () =>
+                    latestModel.startsWith("google/") && primaryCalls <= 2
+                        ? recordedGeminiQuotaMessages()
+                        : [
+                              {
+                                  info: { role: "assistant" },
+                                  parts: [{ type: "text", text: "valid" }],
+                              },
+                          ],
+                validateOutput: () => "valid",
+            });
+        try {
+            await withDreamerModelCooldown(async () => {
+                await run();
+                await run();
+            });
+            await withDreamerModelCooldown(async () => {
+                await run();
+                await run();
+                now += 5_700_000;
+                await run();
+            });
+            expect(models).toEqual([
+                "google/antigravity-gemini-3.8-flash",
+                "deepseek/first",
+                "deepseek/second",
+                "deepseek/first",
+                "deepseek/second",
+                "google/antigravity-gemini-3.8-flash",
+                "deepseek/first",
+                "deepseek/second",
+                "deepseek/first",
+                "deepseek/second",
+                "google/antigravity-gemini-3.8-flash",
+            ]);
+        } finally {
+            clock.mockRestore();
+        }
+    });
+
+    test("records primary quota exhaustion alongside a failing fallback, not a manifest error", async () => {
+        let model = "";
+        const client = createClient(
+            mock(async (args: PromptCall) => {
+                model = args.body.model?.providerID ?? "";
+                if (model === "deepseek") throw new Error("SessionExecutionFence.Lost");
+                return {};
+            }),
+        );
+        let caught: unknown;
+        await withDreamerModelCooldown(async () => {
+            try {
+                await promptSyncWithValidatedOutputRetry(
+                    client,
+                    createArgs({ providerID: "google", modelID: "antigravity-gemini-3.8-flash" }),
+                    {
+                        fallbackModels: ["deepseek/deepseek-flash"],
+                        fetchOutput: async () => recordedGeminiQuotaMessages(),
+                        validateOutput: () => {
+                            throw new Error("verify manifest missing complete root element");
+                        },
+                    },
+                );
+            } catch (error) {
+                caught = error;
+            }
+        });
+        expect(String(caught)).toContain("primary quota exhausted until");
+        expect(String(caught)).toContain("SessionExecutionFence.Lost");
+        expect(String(caught)).not.toContain("manifest missing");
+        expect(getPromptFailureDetail(caught)).toMatchObject({
+            failureClass: "provider_error",
+            modelAttempted: "deepseek/deepseek-flash",
+            modelsTried: ["google/antigravity-gemini-3.8-flash", "deepseek/deepseek-flash"],
+        });
+        expect(getPromptFailureDetail(caught)?.providerError).toContain(
+            "primary quota exhausted until",
+        );
+    });
+});
+
 describe("promptSyncWithValidatedOutputRetry", () => {
     test("records a step cap as step_limit without a provider error", async () => {
         const prompt = mock(async () => {

package/src/shared/model-suggestion-retry.ts

@@ -1,4 +1,10 @@
 import type { createOpencodeClient } from "@opencode-ai/sdk";
+import {
+    DreamerProviderOutputFailureError,
+    primaryQuotaFailure,
+    providerOutputFailureFromInvalidManifest,
+    rememberPrimaryQuota,
+} from "../features/magic-context/dreamer/provider-output-failure";
 import { DreamTokenBudgetExceeded } from "../features/magic-context/dreamer/token-budget";
 import { detectOverflow } from "../features/magic-context/overflow-detection";
 import { HiddenCompletionRefusal } from "../hooks/magic-context/compartment-runner-types";
@@ -59,6 +65,8 @@ export interface PromptAttemptInfo {
     totalAttempts: number;
     /** Explicit model override for this attempt, when one was supplied. */
     model?: { providerID: string; modelID: string };
+    /** A run-local quota deadline prevented dispatch; not an actual model call. */
+    skipped?: boolean;
 }
 
 export interface PromptRetryOptions {
@@ -436,14 +444,25 @@ function throwWithPromptFailure(
         legacyError instanceof Error ? legacyError : new Error(extractMessage(legacyError));
     const last = failedAttempts.at(-1);
     const failureClass = last?.failureClass ?? "unknown";
+    const quota = failedAttempts.find(
+        (failure) =>
+            failure.error instanceof DreamerProviderOutputFailureError &&
+            failure.error.quotaResetAt !== undefined,
+    )?.error as DreamerProviderOutputFailureError | undefined;
+    if (quota && error !== quota && !error.message.includes(quota.message))
+        error.message = `${quota.message}; ${error.message}`;
     const providerError =
-        failureClass === "provider_error"
-            ? sanitizeDiagnosticText(shortErr(last?.error ?? legacyError)).slice(0, 500)
+        failureClass === "provider_error" || quota
+            ? sanitizeDiagnosticText(
+                  `${quota ? `${quota.message}; ` : ""}${shortErr(last?.error ?? legacyError)}`,
+              ).slice(0, 500)
             : null;
     promptFailureDetails.set(error, {
         failureClass,
         modelAttempted: last?.attempt.label ?? null,
-        modelsTried: failedAttempts.map((failure) => failure.attempt.label),
+        modelsTried: failedAttempts
+            .filter((failure) => !failure.attempt.skipped)
+            .map((failure) => failure.attempt.label),
         providerError,
         timeoutMs: failureClass === "provider_timeout" ? timeoutMs : null,
         childSessionId: transport ? (transport.childSessionId ?? null) : args.path.id || null,
@@ -667,6 +686,16 @@ async function attemptAndValidate<TOutput, TValidated>(
     }
 
     try {
+        // Only the structured account-pool notice bypasses caller validation.
+        // The near-zero-token heuristic remains owned by manifest callers.
+        const messages = Array.isArray(output)
+            ? output
+            : (output as { messages?: unknown } | null)?.messages;
+        const text = extractLatestAssistantText(messages);
+        if (text) {
+            const failure = providerOutputFailureFromInvalidManifest(messages, text);
+            if (failure?.quotaResetAt !== undefined) throw failure;
+        }
         if (!extractLatestAssistantText(output)) {
             const assistantFailure = extractLatestAssistantFailure(output);
             if (assistantFailure) {
@@ -721,8 +750,22 @@ export async function promptSyncWithValidatedOutputRetry<TOutput, TValidated = T
     const failedAttempts: FailedAttempt[] = [];
     let firstError: unknown = null;
     let lastError: unknown = null;
+    const cooledPrimary = primaryQuotaFailure(explicitPrimaryLabel);
 
     try {
+        if (cooledPrimary)
+            throw {
+                error: cooledPrimary,
+                failureClass: "provider_error",
+                attempt: {
+                    label: explicitPrimaryLabel,
+                    attemptIndex: 0,
+                    isFallback: false,
+                    totalAttempts,
+                    model: baseBody.model,
+                    skipped: true,
+                },
+            } satisfies FailedAttempt;
         return await attemptAndValidate(
             client,
             baseArgs,
@@ -743,6 +786,19 @@ export async function promptSyncWithValidatedOutputRetry<TOutput, TValidated = T
         failedAttempts.push(failure);
         firstError = failure.error;
         lastError = failure.error;
+        if (
+            failure.error instanceof DreamerProviderOutputFailureError &&
+            failure.error.quotaResetAt !== undefined
+        )
+            failure.error.message = failure.error.message.replace(
+                /^provider quota exhausted/,
+                "primary quota exhausted",
+            );
+        const quota = !cooledPrimary && rememberPrimaryQuota(explicitPrimaryLabel, failure.error);
+        if (quota)
+            log(
+                `[${callContext}] ${quota.message}; skipping ${explicitPrimaryLabel} for this run until reset`,
+            );
         if (isNonRetryable(failure.error, options.signal)) {
             throwWithPromptFailure(
                 failure.error,
@@ -763,9 +819,10 @@ export async function promptSyncWithValidatedOutputRetry<TOutput, TValidated = T
             );
         }
 
-        log(
-            `[${callContext}] primary (${explicitPrimaryLabel}) failed validation/prompt: ${shortErr(failure.error)}; trying ${fallbacks.length} fallback(s)`,
-        );
+        if (!cooledPrimary && !quota)
+            log(
+                `[${callContext}] primary (${explicitPrimaryLabel}) failed validation/prompt: ${shortErr(failure.error)}; trying ${fallbacks.length} fallback(s)`,
+            );
     }
 
     for (let i = 0; i < fallbacks.length; i += 1) {

package/src/shared/models-dev-cache.ts

@@ -25,14 +25,14 @@
  * for Pi and Pi's own path is used.
  */
 
-import { mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { readFileSync } from "node:fs";
 import { join } from "node:path";
 import type { ContextLimitProvenance } from "./context-limit-provenance";
 import { getMagicContextStorageDir } from "./data-path";
 import { getHarness } from "./harness";
 import { modelRefLookupOrder } from "./harness-provider-map";
 import { sessionLog } from "./logger";
-import { shouldEnforcePrivateStoragePermissions } from "./storage-permissions";
+import { writeStorageFileAtomicSync } from "./storage-permissions";
 import {
     deriveWindowGeometry,
     getWindowOverlay,
@@ -182,16 +182,8 @@ function persistApiCache(): void {
         }
     }
     try {
-        const dir = getMagicContextStorageDir();
-        mkdirSync(dir, { recursive: true });
         const target = persistFilePath();
-        const tmp = `${target}.${process.pid}.tmp`;
-        if (shouldEnforcePrivateStoragePermissions()) {
-            writeFileSync(tmp, JSON.stringify(obj), { encoding: "utf-8", mode: 0o600 });
-        } else {
-            writeFileSync(tmp, JSON.stringify(obj), { encoding: "utf-8" });
-        }
-        renameSync(tmp, target);
+        writeStorageFileAtomicSync(target, JSON.stringify(obj));
     } catch {
         // best-effort — a failed persist only loses cold-start warmth, not correctness
     }

package/src/shared/protected-tools-policy.ts

@@ -0,0 +1,23 @@
+/** Default result keep counts shared by runtime and configuration; this database-free module is bundled with the TUI. */
+export const DEFAULT_PROTECTED_TOOLS: Readonly<Record<string, number>> = {
+    todowrite: 1,
+    ctx_reduce: 3,
+};
+
+export function normalizeProtectedToolName(name: string | null): string {
+    return (name ?? "").toLowerCase().replace(/^mcp_/, "");
+}
+
+/** Normalize before merging tiers so aliases cannot defeat a project override. */
+export function mergeProtectedTools(
+    ...maps: (Readonly<Record<string, number>> | undefined)[]
+): Record<string, number> {
+    return Object.fromEntries(
+        [DEFAULT_PROTECTED_TOOLS, ...maps].flatMap((map) =>
+            Object.entries(map ?? {}).map(([name, count]) => [
+                normalizeProtectedToolName(name),
+                count,
+            ]),
+        ),
+    );
+}

package/src/shared/quota-diagnostic.ts

@@ -0,0 +1,9 @@
+/** Only expose the generated quota deadline, not arbitrary provider output,
+ * account identifiers, or private paths from the surrounding failure text. */
+export function primaryQuotaDiagnostic(error: string | null | undefined): string | null {
+    return (
+        error?.match(
+            /primary quota exhausted until \d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z/,
+        )?.[0] ?? null
+    );
+}

package/src/shared/rpc-server.ts

@@ -1,15 +1,5 @@
 import { randomBytes, timingSafeEqual } from "node:crypto";
-import {
-    chmodSync,
-    mkdirSync,
-    readdirSync,
-    readFileSync,
-    renameSync,
-    rmSync,
-    unlinkSync,
-    writeFileSync,
-} from "node:fs";
-import { dirname } from "node:path";
+import { readdirSync, readFileSync, unlinkSync } from "node:fs";
 import type { Server, ServerWebSocket } from "bun";
 import { log } from "./logger";
 import {
@@ -25,7 +15,7 @@ import {
     rpcPortDir,
     rpcPortFilePath,
 } from "./rpc-utils";
-import { shouldEnforcePrivateStoragePermissions } from "./storage-permissions";
+import { writeStorageFileAtomicSync } from "./storage-permissions";
 
 type RpcHandler = (params: Record<string, unknown>) => Promise<Record<string, unknown>>;
 
@@ -177,38 +167,11 @@ export class MagicContextRpcServer {
         // recent instead of cross-wiring via one shared project file.
         try {
             void this.warnIfOtherLiveInstance();
-            const dir = dirname(this.portFilePath);
-            // The port file carries the RPC bearer token. The normal policy keeps
-            // it owner-only; a trusted-group deployment explicitly delegates every
-            // storage mode to its operator, so this path must not chmod or supply a
-            // restrictive creation mode in that case.
-            const enforcePrivatePermissions = shouldEnforcePrivateStoragePermissions();
-            if (enforcePrivatePermissions) {
-                mkdirSync(dir, { recursive: true, mode: 0o700 });
-                try {
-                    chmodSync(dir, 0o700);
-                } catch {
-                    // Continue RPC startup when directory tightening is rejected.
-                }
-            } else {
-                mkdirSync(dir, { recursive: true });
-            }
-            // Registered before the file appears, so the storage migration guard in
-            // this process never sees its own discovery file as another live host.
+            // The discovery file carries the RPC bearer token. The shared writer
+            // creates its directory and temporary file with owner-only modes.
             this.unregisterOwnInstance ??= registerOwnRpcServerInstance(this.instanceId);
-            const tmpPath = `${this.portFilePath}.tmp`;
-            // A stale tmp from a crashed write could exist with loose perms;
-            // writeFileSync's mode only applies on create, so remove it first.
-            try {
-                rmSync(tmpPath, { force: true });
-            } catch {
-                // best-effort
-            }
-            // Synchronous write so the renameSync below sees a fully-written file.
-            // The private mode keeps the bearer token out of other local accounts;
-            // externally managed storage intentionally leaves its mode to the umask.
-            writeFileSync(
-                tmpPath,
+            writeStorageFileAtomicSync(
+                this.portFilePath,
                 JSON.stringify({
                     port: this.port,
                     pid: process.pid,
@@ -217,18 +180,7 @@ export class MagicContextRpcServer {
                     token: this.token,
                     instance_id: this.instanceId,
                 }),
-                enforcePrivatePermissions
-                    ? { encoding: "utf-8", mode: 0o600 }
-                    : { encoding: "utf-8" },
             );
-            renameSync(tmpPath, this.portFilePath);
-            if (enforcePrivatePermissions) {
-                try {
-                    chmodSync(this.portFilePath, 0o600);
-                } catch {
-                    // Continue RPC startup when port-file tightening is rejected.
-                }
-            }
             log(`[rpc] server listening on 127.0.0.1:${this.port}`);
         } catch (err) {
             log(`[rpc] failed to write port file: ${err}`);

package/src/shared/sqlite-context-pragmas.test.ts

@@ -0,0 +1,105 @@
+import { afterEach, describe, expect, it, spyOn } from "bun:test";
+import { readFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import {
+    closeDatabase,
+    openDatabase,
+    openDatabaseAsync,
+} from "../features/magic-context/storage-db";
+import { Database } from "./sqlite";
+import { configureContextDatabasePragmas } from "./sqlite-context-pragmas";
+import { createTestTempDirFromPath } from "./test-temp-dir";
+
+const roots: string[] = [];
+function fixturePath(): string {
+    const root = createTestTempDirFromPath(join(tmpdir(), "mc-context-pragmas-"));
+    roots.push(root);
+    return join(root, "context.db");
+}
+afterEach(() => {
+    closeDatabase();
+    for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true });
+});
+
+describe("context database durability", () => {
+    it("fresh synchronous open uses WAL and synchronous=NORMAL", () => {
+        const db = openDatabase(fixturePath());
+        expect(db?.prepare("PRAGMA journal_mode").get()).toEqual({ journal_mode: "wal" });
+        expect(db?.prepare("PRAGMA synchronous").get()).toEqual({ synchronous: 1 });
+    });
+
+    it("fresh async open uses WAL and synchronous=NORMAL", async () => {
+        const db = await openDatabaseAsync({ dbPath: fixturePath() });
+        expect(db?.prepare("PRAGMA journal_mode").get()).toEqual({ journal_mode: "wal" });
+        expect(db?.prepare("PRAGMA synchronous").get()).toEqual({ synchronous: 1 });
+    });
+
+    it("refuses NORMAL when SQLite cannot activate WAL", () => {
+        const db = new Database(fixturePath());
+        const prepare = db.prepare.bind(db);
+        const spy = spyOn(db, "prepare").mockImplementation((sql: string) =>
+            prepare(sql === "PRAGMA journal_mode=WAL" ? "PRAGMA journal_mode" : sql),
+        );
+        try {
+            expect(() => configureContextDatabasePragmas(db)).toThrow("requires WAL");
+            expect(prepare("PRAGMA synchronous").get()).toEqual({ synchronous: 2 });
+        } finally {
+            spy.mockRestore();
+            db.close();
+        }
+    });
+
+    it("read-only inspection leaves a rollback-journal store unchanged", () => {
+        const path = fixturePath();
+        const writer = new Database(path);
+        writer.exec("CREATE TABLE probe(id INTEGER)");
+        writer.close();
+        const bytes = readFileSync(path);
+        const reader = new Database(path, { readonly: true });
+        try {
+            configureContextDatabasePragmas(reader, true);
+            expect(reader.prepare("PRAGMA journal_mode").get()).toEqual({ journal_mode: "delete" });
+            expect(reader.prepare("PRAGMA synchronous").get()).toEqual({ synchronous: 2 });
+        } finally {
+            reader.close();
+        }
+        expect(readFileSync(path)).toEqual(bytes);
+    });
+
+    it("an independently reopened WAL writer receives the connection-local policy", () => {
+        const path = fixturePath();
+        const first = new Database(path);
+        configureContextDatabasePragmas(first);
+        first.close();
+        const reopened = new Database(path);
+        try {
+            // Bun defaults WAL to NORMAL; Node defaults it to FULL. Exercise an
+            // explicit FULL connection so the assertion is portable to both.
+            reopened.exec("PRAGMA synchronous=FULL");
+            expect(reopened.prepare("PRAGMA synchronous").get()).toEqual({ synchronous: 2 });
+            configureContextDatabasePragmas(reopened);
+            expect(reopened.prepare("PRAGMA synchronous").get()).toEqual({ synchronous: 1 });
+        } finally {
+            reopened.close();
+        }
+    });
+
+    it("WAL configuration releases its read cursor before a sibling commits", () => {
+        const path = fixturePath();
+        const db = new Database(path);
+        const sibling = new Database(path);
+        try {
+            configureContextDatabasePragmas(db);
+            db.exec(
+                "CREATE TABLE probe(id INTEGER PRIMARY KEY, value INTEGER); INSERT INTO probe VALUES (1, 0)",
+            );
+            sibling.exec("UPDATE probe SET value = 1 WHERE id = 1");
+            db.exec("UPDATE probe SET value = 2 WHERE id = 1");
+            expect(db.prepare("SELECT value FROM probe").get()).toEqual({ value: 2 });
+        } finally {
+            db.close();
+            sibling.close();
+        }
+    });
+});

package/src/shared/sqlite-context-pragmas.ts

@@ -0,0 +1,24 @@
+import type { Database } from "./sqlite";
+
+/**
+ * NORMAL avoids a WAL sync on each commit. WAL still recovers consistently after
+ * a crash, but the latest committed work may be lost on power failure. Never use
+ * this durability policy in a rollback journal. In-memory test stores cannot use
+ * WAL and keep their existing synchronous mode.
+ *
+ * Call after the schema fence and busy timeout, before any context-store writes.
+ * Read-only diagnostics must not switch a legacy store's journal mode.
+ */
+export function configureContextDatabasePragmas(db: Database, readonly = false): void {
+    const [row] = db
+        .prepare(readonly ? "PRAGMA journal_mode" : "PRAGMA journal_mode=WAL")
+        .all() as { journal_mode?: string }[];
+    const mode = row?.journal_mode?.toLowerCase();
+    if (mode === "memory" || (readonly && mode !== "wal")) return;
+    if (mode !== "wal") {
+        throw new Error(
+            `context.db requires WAL before synchronous=NORMAL (got ${mode ?? "unknown"})`,
+        );
+    }
+    db.exec("PRAGMA synchronous=NORMAL");
+}

package/src/shared/sqlite-helpers.ts

@@ -25,3 +25,20 @@ export function closeQuietly(db: Database | null | undefined): void {
         // intentional: caller wants quiet close
     }
 }
+
+/**
+ * True only when the connection reports that no transaction is open. Caches
+ * keyed on SQLite's change counters must not keep a value read inside a
+ * transaction: a rollback restores the rows without moving total_changes(),
+ * data_version or schema_version, so the stale entry would look current.
+ * Unknown state (a proxy that cannot read the native getter) counts as "in a
+ * transaction" so callers fall back to a fresh read.
+ */
+export function isKnownAutocommit(db: Database): boolean {
+    const state = db as unknown as { inTransaction?: boolean; isTransaction?: boolean };
+    try {
+        return state.inTransaction === false || state.isTransaction === false;
+    } catch {
+        return false;
+    }
+}

package/src/shared/sqlite.ts

@@ -365,6 +365,12 @@ function trackSqliteConnection(
         ...metadata,
         reference: new WeakRef(db),
     });
+    const prepare = db.prepare.bind(db);
+    Object.defineProperty(db, "prepare", {
+        configurable: true,
+        writable: true,
+        value: (sql: string) => ownPreparedStatement(db, prepare(sql)),
+    });
     return db;
 }
 
@@ -540,6 +546,75 @@ export type Database = BetterSqlite3.Database;
  */
 export type Statement = BetterSqlite3.Statement<unknown[], unknown>;
 
+type FinalizableStatement = Statement & { finalize(): void };
+interface StatementOwner {
+    references: Set<WeakRef<FinalizableStatement>>;
+    registered: WeakSet<FinalizableStatement>;
+    /** Set size at which collected references are next swept out. */
+    pruneAt: number;
+}
+const statementOwners = new WeakMap<Database, StatementOwner>();
+const FIRST_PRUNE_AT = 256;
+
+function ownPreparedStatement(db: Database, statement: Statement): Statement {
+    const finalizable = statement as FinalizableStatement;
+    // Node finalizes its statements on close and exposes no finalize() method.
+    if (typeof finalizable.finalize !== "function") return statement;
+    let owner = statementOwners.get(db);
+    if (!owner) {
+        const references = new Set<WeakRef<FinalizableStatement>>();
+        owner = { references, registered: new WeakSet(), pruneAt: FIRST_PRUNE_AT };
+        statementOwners.set(db, owner);
+        const close = db.close.bind(db) as (...args: unknown[]) => unknown;
+        Object.defineProperty(db, "close", {
+            configurable: true,
+            writable: true,
+            value: (...args: unknown[]) => {
+                let failure: unknown;
+                for (const reference of references) {
+                    try {
+                        reference.deref()?.finalize();
+                    } catch (error) {
+                        failure ??= error;
+                    }
+                }
+                references.clear();
+                const result = close(...args);
+                if (failure) throw failure;
+                return result;
+            },
+        });
+    }
+    if (!owner.registered.has(finalizable)) {
+        // No FinalizationRegistry: its callbacks run at GC time, where a throw
+        // is uncaught (seen in Bun's parallel test runner). Sweep references to
+        // collected statements whenever the set doubles instead, so one-shot
+        // statements in a long-running host stay bounded.
+        if (owner.references.size >= owner.pruneAt) {
+            for (const reference of owner.references) {
+                if (reference.deref() === undefined) owner.references.delete(reference);
+            }
+            owner.pruneAt = Math.max(FIRST_PRUNE_AT, owner.references.size * 2);
+        }
+        owner.references.add(new WeakRef(finalizable));
+        owner.registered.add(finalizable);
+    }
+    return statement;
+}
+
+/**
+ * Cached statements must be finalized before closing their connection. Bun's
+ * prepare() leaves SQLite's native close deferred until all statements finish,
+ * even after the JS Database reports closed. Delayed WAL checkpoints can then
+ * overwrite a restored database if a caller reuses the file in the meantime.
+ * The shared Database owns every preparation; use this for caches that also
+ * accept direct bun:sqlite handles. Weak references avoid retaining one-shot
+ * statements for the lifetime of a long-running host.
+ */
+export function prepareCachedStatement(db: Database, sql: string): Statement {
+    return ownPreparedStatement(db, db.prepare(sql));
+}
+
 const privilegeDepth = new WeakMap<Database, number>();
 const transformPassScope = new AsyncLocalStorage<
     { active: boolean; remainingWaitMs: number } | undefined

package/src/shared/status-detail-text.test.ts

@@ -100,7 +100,7 @@ describe("status detail text", () => {
         expect(formatStatusDetailMarkdown(STATUS_FIXTURE)).toBe(`## Magic Context Status
 
 - **Context:** 75.0% of usable context (96,000 / 128,000 tokens)
-- **Cache lifetime:** 1h (config for anthropic/claude-opus-5)
+- **Cache lifetime:** 1h (your config)
 - **Automatic compression:** at 65.0% of usable context
 - **History compression:** Compressing history · 12 history blocks
 - **Reclaimable:** 3 spent tool outputs (~14k tokens)
@@ -148,6 +148,23 @@ describe("status detail text", () => {
         ).not.toContain("MC-S05");
     });
 
+    test("shows the primary quota deadline without exposing surrounding account diagnostics", () => {
+        const summary = formatStatusDetailMarkdown({
+            ...STATUS_FIXTURE,
+            dreamerFailures: [
+                {
+                    task: "verify",
+                    error: "primary quota exhausted until 2026-10-08T03:40:04.275Z; account=private@example.com",
+                    lastSucceededAt: null,
+                    retryCount: 1,
+                },
+            ],
+        });
+        expect(summary).toContain("primary quota exhausted until 2026-10-08T03:40:04.275Z");
+        expect(summary).not.toContain("private@example.com");
+        expect(summary).not.toContain("manifest missing");
+    });
+
     test("keeps internal vocabulary and identifiers out of the summary", () => {
         const summary = formatStatusDetailMarkdown({
             ...STATUS_FIXTURE,