@cortexkit/opencode-openai-auth 1.2.0 → 1.3.0

package/src/tui-compiled/raw/shared/0f77ebc3c914c9c6-custody.js

@@ -1,11 +1,14 @@
 import { ClaustrumCredentialError, } from "@cortexkit/claustrum-client";
 import { createLogger } from "./cc9e0702a752cea7-index.js";
+import { ClaustrumUnreachableError, classifyVaultFailure, } from "./94f53cfd572ba4bb-availability.js";
 import { readClaustrumEnrollmentToken } from "./b9588ad4725c1d10-enrollment.js";
 import { ClaustrumConsumerError } from "./ca0fccaba1d87af4-errors.js";
 import { CUSTODY_PLACEHOLDER_PREFIX } from "./d9d2892a4c371301-host-slot.js";
 /** Only a new version of the same account may replace an in-flight 401. */
 export function isScopedCredentialRotation(served, current) {
     return (current !== undefined &&
+        !current.fromKeptReceipt &&
+        !served.fromKeptReceipt &&
         current.credentialId === served.credentialId &&
         current.accountIdentity === served.accountIdentity &&
         current.recordVersion !== served.recordVersion);
@@ -45,6 +48,8 @@ export function decideScopedRetryAfter401(site, served, current, logger = defaul
  * so it cannot expire while a long request is still using it.
  */
 export const SERVING_MARGIN_MS = 300_000;
+/** A kept receipt needs a minute of headroom, not the vault's refresh demand. */
+export const KEPT_RECEIPT_MARGIN_MS = 60_000;
 function invalidMaterial() {
     return new ClaustrumConsumerError('invalid-material', 'Claustrum returned invalid credential material');
 }
@@ -100,11 +105,11 @@ function grantReachOf(listed) {
 }
 /**
  * Reads this consumer's vault credentials (list, fetch, 401 report), with the
- * enrollment token as authorization. Used by every host of a plugin. There is
- * deliberately no credential cache and no single-flight of credential reads:
- * each physical send is authorized by the vault, so a revoked enrollment or a
- * changed record takes effect on the next send. The enrollment token is
- * re-read per operation so an operator's reissue on disk is picked up.
+ * enrollment token as authorization. Used by every host of a plugin. Every
+ * physical send asks the vault first while reachable. Only an unreachable vault permits
+ * reuse of the last validated receipt, in memory and bounded by its expiry.
+ * The enrollment token is re-read per operation so revocation and disconnect
+ * still take effect without a process restart.
  */
 export class ClaustrumScopedCustody {
     #client;
@@ -116,6 +121,16 @@ export class ClaustrumScopedCustody {
     #logger;
     #provenance = new WeakMap();
     #reports = new WeakMap();
+    #kept = new Map();
+    #keptAttempts = new WeakMap();
+    #setTimeout;
+    #clearTimeout;
+    #outage = false;
+    #outageError = new ClaustrumUnreachableError();
+    #probeTimer;
+    #probing = false;
+    #lastProbeAt = -Infinity;
+    #probeDelay = 2_000;
     #closed = false;
     constructor(options) {
         const tokenPath = options.tokenPath;
@@ -134,6 +149,63 @@ export class ClaustrumScopedCustody {
         this.#requireAssertion = options.requireAssertion ?? false;
         this.#now = options.now ?? Date.now;
         this.#logger = options.logger ?? defaultLogger;
+        this.#setTimeout = options.setTimeoutImpl ?? setTimeout;
+        this.#clearTimeout = options.clearTimeoutImpl ?? clearTimeout;
+    }
+    /** A watch losing its transport is the same outage as an unreachable read. */
+    transportLost(error) {
+        if (this.#closed || this.#outage)
+            return;
+        this.#outage = true;
+        this.#outageError =
+            error instanceof ClaustrumCredentialError
+                ? error
+                : new ClaustrumUnreachableError();
+        this.#logger.warn('serving kept vault receipt', { reason: 'unreachable' });
+        this.#scheduleProbe();
+    }
+    /** Any vault answer ends transport fallback, even when it refuses access. */
+    reachable() {
+        if (this.#closed || !this.#outage)
+            return;
+        this.#outage = false;
+        if (this.#probeTimer)
+            this.#clearTimeout(this.#probeTimer);
+        this.#probeTimer = undefined;
+        this.#probeDelay = 2_000;
+        for (const kept of this.#kept.values())
+            kept.since = null;
+        (this.#logger.info ?? defaultLogger.info)('vault receipt serving resumed', { reason: 'reachable' });
+    }
+    #scheduleProbe() {
+        if (this.#closed || !this.#outage || this.#probeTimer || this.#probing)
+            return;
+        this.#probeTimer = this.#setTimeout(() => {
+            this.#probeTimer = undefined;
+            this.#probe(true);
+        }, this.#probeDelay);
+        this.#probeTimer.unref?.();
+    }
+    #probe(idle = false) {
+        if (this.#closed || !this.#outage || this.#probing)
+            return;
+        if (this.#now() - this.#lastProbeAt < 1_000) {
+            this.#scheduleProbe();
+            return;
+        }
+        this.#lastProbeAt = this.#now();
+        this.#probing = true;
+        // Both triggers share list_scoped discovery, including its receipt-drop rules.
+        // Sends never await discovery or let idle backoff delay the next send probe.
+        void this.discover()
+            .catch(() => {
+            if (idle && this.#outage)
+                this.#probeDelay = Math.min(this.#probeDelay * 2, 30_000);
+        })
+            .finally(() => {
+            this.#probing = false;
+            this.#scheduleProbe();
+        });
     }
     #check(signal) {
         if (this.#closed)
@@ -172,17 +244,24 @@ export class ClaustrumScopedCustody {
         }
         catch (error) {
             this.#check(signal);
+            if (classifyVaultFailure(error) === 'unreachable')
+                this.transportLost(error);
+            else
+                this.reachable();
             // Keep the vault's own refusals (ClaustrumCredentialError, carrying
             // code, class and action); replace any other error, whose text may echo
             // request params that include the enrollment token.
             if (error instanceof ClaustrumCredentialError)
                 throw error;
+            if (classifyVaultFailure(error) === 'unreachable')
+                throw new ClaustrumUnreachableError();
             throw new ClaustrumConsumerError('unavailable', 'Claustrum scoped operation unavailable');
         }
         finally {
             removeAbortListener?.();
         }
         this.#check(signal);
+        this.reachable();
         return result;
     }
     /**
@@ -192,8 +271,22 @@ export class ClaustrumScopedCustody {
      * skipped records: they simply are not this consumer's.
      */
     async discover(signal) {
-        const token = await this.#token(signal);
-        const inventory = await this.#call(() => this.#client.listScoped(token), signal);
+        let inventory;
+        let token;
+        try {
+            token = await this.#token(signal);
+        }
+        catch (error) {
+            this.#kept.clear();
+            throw error;
+        }
+        try {
+            inventory = await this.#call(() => this.#client.listScoped(token), signal);
+        }
+        catch (error) {
+            this.listFailed(error);
+            throw error;
+        }
         const skipped = [];
         const candidates = [];
         const counts = new Map();
@@ -241,22 +334,119 @@ export class ClaustrumScopedCustody {
         };
     }
     /**
-     * Fetch the credential for one physical send and wrap it in a fresh receipt.
-     * The vault's served identity (or, without one, the plugin's parse of the
-     * token) must equal the roster's when both are present. Without
-     * `requireAssertion`, absence on either side proves nothing and does not
-     * refuse; the receipt records what the vault asserted separately from what
-     * the roster expected. With it, a reply that does not itself name the
-     * credential id and the expected account is refused.
+     * Apply a failed account listing: any answer from the vault (a refusal such
+     * as a revoked enrollment's `not_found`) drops every kept receipt, while an
+     * unreachable vault keeps them. A vault watch that ends with the same
+     * refusal calls this too, so both paths treat it alike.
+     */
+    listFailed(error) {
+        if (classifyVaultFailure(error) === 'unreachable')
+            this.transportLost(error);
+        else {
+            this.reachable();
+            this.#kept.clear();
+        }
+    }
+    /** Discard bearer material when a route is removed, declined or rebound. */
+    forget(credentialId) {
+        this.#kept.delete(credentialId);
+    }
+    /** Apply an already-held roster; this never fetches credentials or writes it. */
+    retain(identities) {
+        const current = new Map(identities.map((identity) => [identity.credentialId, identity]));
+        for (const [id, kept] of this.#kept) {
+            const identity = current.get(id);
+            if (!identity?.enabled ||
+                identity.state !== 'active' ||
+                identity.credentialType !== kept.attempt.credentialType ||
+                identity.accountIdentity !== kept.attempt.expectedAccountIdentity)
+                this.forget(id);
+        }
+    }
+    /** A frozen, non-secret summary for a plugin's status display. */
+    keptReceiptState() {
+        let since = null;
+        for (const [id, kept] of this.#kept) {
+            if (!this.#usable(kept.attempt)) {
+                this.forget(id);
+                continue;
+            }
+            if (kept.since !== null)
+                since = Math.min(since ?? kept.since, kept.since);
+        }
+        return Object.freeze({ active: since !== null, since });
+    }
+    #usable(attempt) {
+        return attempt.expiresAtMs === null
+            ? attempt.credentialType === 'api_key'
+            : attempt.expiresAtMs - this.#now() > KEPT_RECEIPT_MARGIN_MS;
+    }
+    /** Ask the vault while reachable; retain one validated receipt in memory only. */
+    async authorize(identity, signal, routeId = 'vault') {
+        this.#check(signal);
+        const { credentialId, credentialType, accountIdentity } = identity;
+        let kept = this.#kept.get(credentialId);
+        if (kept &&
+            (kept.attempt.credentialType !== credentialType ||
+                kept.attempt.expectedAccountIdentity !== accountIdentity)) {
+            this.forget(credentialId);
+            kept = undefined;
+        }
+        // A missing or invalid enrollment is not a transport outage.
+        let token;
+        try {
+            token = await this.#token(signal);
+        }
+        catch (error) {
+            this.#kept.clear();
+            throw error;
+        }
+        if (this.#outage && kept) {
+            this.#probe();
+            return this.#serveKept(credentialId, kept, token, routeId);
+        }
+        try {
+            const attempt = await this.#authorizeFresh({ credentialId, credentialType, accountIdentity }, token, signal);
+            this.#kept.set(credentialId, { attempt, routeId, since: null });
+            return attempt;
+        }
+        catch (error) {
+            this.#check(signal);
+            if (classifyVaultFailure(error) !== 'unreachable') {
+                this.forget(credentialId);
+                throw error;
+            }
+            return this.#serveKept(credentialId, kept, token, routeId, error);
+        }
+    }
+    #serveKept(credentialId, kept, token, routeId, error = this.#outageError) {
+        // A concurrent refusal or 401 may already have discarded this entry.
+        if (!kept ||
+            this.#kept.get(credentialId) !== kept ||
+            !this.#usable(kept.attempt)) {
+            this.forget(credentialId);
+            throw error;
+        }
+        if (kept.since === null)
+            kept.since = this.#now();
+        const attempt = Object.freeze(Object.defineProperty({ ...kept.attempt, fromKeptReceipt: true }, 'accessToken', { value: kept.attempt.accessToken, enumerable: false }));
+        this.#provenance.set(attempt, token);
+        this.#keptAttempts.set(attempt, routeId);
+        return attempt;
+    }
+    /**
+     * Fetch and validate a fresh receipt before retaining it. The vault assertion
+     * (or the plugin's token parse) must agree with the roster when both exist.
+     * With requireAssertion, an absent assertion also refuses rather than
+     * treating the roster's expectation as proof of the served account.
      */
-    async authorize(identity, signal) {
+    async #authorizeFresh(identity, token, signal) {
         if (!identity.credentialId)
             throw new ClaustrumConsumerError('route-unavailable', 'Claustrum dispatch requires a credential id');
         // Capture the caller's fields before yielding so a later mutation cannot move the fence.
         const { credentialId, credentialType, accountIdentity } = identity;
         if (this.#requireAssertion && accountIdentity === undefined)
             throw new ClaustrumConsumerError('identity-unasserted', 'Claustrum dispatch requires a known account identity');
-        const token = await this.#token(signal);
         const served = await this.#call(() => this.#client.getScoped({
             credentialId,
             enrollmentToken: token,
@@ -338,6 +528,21 @@ export class ClaustrumScopedCustody {
         const token = this.#provenance.get(attempt);
         if (!token)
             throw new ClaustrumConsumerError('no-receipt', 'Claustrum failure report requires an original dispatch receipt');
+        const keptRoute = this.#keptAttempts.get(attempt);
+        if (keptRoute !== undefined) {
+            this.forget(attempt.credentialId);
+            this.#logger.debug('scoped 401 not reported', {
+                routeId: keptRoute,
+                reason: 'kept-receipt',
+            });
+            return;
+        }
+        // The provider rejected this token, so it must not come back as a kept
+        // receipt during a later outage. Drop it before reporting, so a report that
+        // fails because the vault is unreachable still drops it.
+        const kept = this.#kept.get(attempt.credentialId);
+        if (kept && kept.attempt.recordVersion === attempt.recordVersion)
+            this.forget(attempt.credentialId);
         const pending = this.#reports.get(attempt);
         if (pending)
             return pending;
@@ -366,6 +571,10 @@ export class ClaustrumScopedCustody {
         if (this.#closed)
             return;
         this.#closed = true;
+        if (this.#probeTimer)
+            this.#clearTimeout(this.#probeTimer);
+        this.#probeTimer = undefined;
+        this.#kept.clear();
         this.#client.close();
     }
 }

package/src/tui-compiled/raw/shared/169b2b4bf30909bc-consumer.js

@@ -5,6 +5,7 @@ import { readClaustrumEnrollmentToken } from "./b9588ad4725c1d10-enrollment.js";
 import { ClaustrumConsumerError } from "./ca0fccaba1d87af4-errors.js";
 import { acquireInsulaQuotaSource } from "./d0f0b6be200311af-insula.js";
 import { acceptVaultRoute, declineVaultRoute, readVaultRoster, recordVaultAccountQuota, recordVaultQuota, refreshVaultRoster, vaultRoutingRows, } from "./30f5bc480f31f51c-roster.js";
+import { SAFETY_POLL_MS, ScopedRosterWatch } from "./dc9290c2a7552ba6-watch.js";
 /**
  * One plugin host's view of its vault accounts. It turns vault credentials
  * into rows for `/routing`, authorizes each physical send with the vault, and
@@ -18,6 +19,8 @@ export class ClaustrumConsumer {
     #shutdown = new AbortController();
     #logger;
     #custody;
+    /** The custody's client, kept so `start()` can open its vault watch. */
+    #client;
     #connecting;
     #refreshing;
     #roster;
@@ -29,6 +32,10 @@ export class ClaustrumConsumer {
     #timer;
     #started = false;
     #insula;
+    #vaultWatch;
+    #releaseInsulaWatch;
+    /** When this instance last completed a discovery, by `now`. */
+    #discoveredAt;
     constructor(options) {
         this.#options = options;
         this.#logger = options.logger ?? createLogger('claustrum');
@@ -83,6 +90,7 @@ export class ClaustrumConsumer {
                     client.close();
                     this.#assertOpen();
                 }
+                this.#client = client;
                 this.#custody = new ClaustrumScopedCustody({
                     client,
                     family: this.#options.family,
@@ -91,6 +99,8 @@ export class ClaustrumConsumer {
                     requireAssertion: this.#options.requireAssertion,
                     now: this.#options.now,
                     logger: this.#logger,
+                    setTimeoutImpl: this.#options.setTimeoutImpl,
+                    clearTimeoutImpl: this.#options.clearTimeoutImpl,
                 });
                 if (this.#options.insula && client.insula) {
                     this.#insula = acquireInsulaQuotaSource(client.insula, this.#options.tokenPath);
@@ -122,6 +132,28 @@ export class ClaustrumConsumer {
             ? latest.reach
             : undefined;
     }
+    /** How this consumer currently learns about changes, without I/O. */
+    watchState() {
+        return Object.freeze({
+            vault: this.#vaultWatch?.mode ?? 'polling',
+            ...(this.#options.insula && {
+                insula: this.#insula?.source.watchMode() ?? 'polling',
+            }),
+        });
+    }
+    /** Close the watches with the connection they belong to. */
+    #stopWatch() {
+        this.#vaultWatch?.stop();
+        this.#vaultWatch = undefined;
+        this.#client = undefined;
+        this.#releaseInsulaWatch?.();
+        this.#releaseInsulaWatch = undefined;
+    }
+    /** Whether any account is using an in-memory outage receipt, without I/O. */
+    keptReceiptState() {
+        return (this.#custody?.keptReceiptState() ??
+            Object.freeze({ active: false, since: null }));
+    }
     /** Rows for `/routing`, from the last committed roster. */
     routingRows() {
         return vaultRoutingRows(this.#roster);
@@ -134,6 +166,7 @@ export class ClaustrumConsumer {
             if (!(await this.#active())) {
                 this.#roster = undefined;
                 this.#grantReach = undefined;
+                this.#stopWatch();
                 this.#custody?.close();
                 this.#custody = undefined;
                 this.#insula?.release();
@@ -164,6 +197,7 @@ export class ClaustrumConsumer {
             this.#assertOpen();
             const changed = roster?.view !== this.#roster?.view;
             this.#roster = roster;
+            custody.retain(roster?.rows ?? []);
             // Each discovery replaces the previous value, including with unknown. A
             // refresh that served a peer's roster discovered nothing and leaves it;
             // grantReach() hides it once the roster's view no longer matches.
@@ -175,12 +209,23 @@ export class ClaustrumConsumer {
             // notification, and the poll runs every few seconds.
             if (roster && changed)
                 this.#options.onRoster?.(roster);
+            this.#discoveredAt = (this.#options.now ?? Date.now)();
             return roster;
         })().finally(() => {
             this.#refreshing = undefined;
         });
         return this.#refreshing;
     }
+    /**
+     * Poll in the background and open the vault and insula watches. Until the
+     * vault watch is accepted, and whenever it is unavailable, every tick lists
+     * the vault exactly as before watches existed. While it is open a tick
+     * lists only when five minutes have passed since the last discovery, since
+     * the watch keeps no history; it still checks `isCustodyActive`, so a switch
+     * to local mode closes the connection as quickly as before. Insula is
+     * polled on the tick only while its own watch is not open. A host not in
+     * vault mode makes no request.
+     */
     start() {
         if (this.#started)
             return;
@@ -188,8 +233,10 @@ export class ClaustrumConsumer {
         this.#started = true;
         const tick = async () => {
             try {
-                await this.refresh();
+                if (await this.#listDue())
+                    await this.refresh();
                 await this.refreshInsulaQuota();
+                this.#openWatch();
             }
             catch (error) {
                 if (!this.#shutdown.signal.aborted)
@@ -208,6 +255,65 @@ export class ClaustrumConsumer {
         };
         void tick();
     }
+    /** Whether a background tick must list the vault now. */
+    async #listDue() {
+        if (this.#vaultWatch?.mode !== 'watching')
+            return true;
+        const now = (this.#options.now ?? Date.now)();
+        if (this.#discoveredAt === undefined ||
+            now - this.#discoveredAt >= SAFETY_POLL_MS)
+            return true;
+        // refresh() is what closes the connection when the host left vault mode.
+        return !(await this.#active());
+    }
+    /**
+     * Open the vault and insula watches once a vault connection exists. Only
+     * reached in vault mode: a host in local mode never connects.
+     */
+    #openWatch() {
+        const client = this.#client;
+        if (this.#shutdown.signal.aborted || !client || !this.#custody)
+            return;
+        if (!this.#vaultWatch) {
+            const watch = new ScopedRosterWatch({
+                client,
+                enrollmentToken: async () => (await readClaustrumEnrollmentToken(this.#options.tokenPath)).token,
+                view: () => this.#roster?.view,
+                // The existing discovery, so a watched change commits the roster and
+                // re-applies it to kept receipts exactly as a poll does. A refresh
+                // already in flight may have listed before the change was announced,
+                // so wait for it and list again.
+                discover: async () => {
+                    while (this.#refreshing)
+                        await this.#refreshing.catch(() => { });
+                    await this.refresh();
+                },
+                onRefused: (error) => {
+                    // As a poll that met the same refusal from list_scoped would.
+                    this.#custody?.listFailed(error);
+                    this.#options.onError?.(error);
+                },
+                onTransportLost: () => this.#custody?.transportLost(),
+                onReachable: () => this.#custody?.reachable(),
+                onError: (error) => {
+                    if (!this.#shutdown.signal.aborted)
+                        this.#options.onError?.(error);
+                },
+                logger: this.#logger,
+                now: this.#options.now,
+                setTimeoutImpl: this.#options.setTimeoutImpl,
+                clearTimeoutImpl: this.#options.clearTimeoutImpl,
+            });
+            this.#vaultWatch = watch;
+            watch.start();
+        }
+        if (this.#options.insula && this.#insula && !this.#releaseInsulaWatch)
+            this.#releaseInsulaWatch = this.#insula.source.watch({
+                provider: this.#options.insula.provider,
+                setTimeoutImpl: this.#options.setTimeoutImpl,
+                clearTimeoutImpl: this.#options.clearTimeoutImpl,
+            });
+    }
     /**
      * Fetch on a background tick, at most once per minute across projects with
      * the same daemon and enrollment token path. Admission must use the cache
@@ -282,20 +388,33 @@ export class ClaustrumConsumer {
     async authorize(routeId, signal) {
         this.#assertOpen(signal);
         const roster = this.#roster ?? (await this.#wait(this.refresh(), signal));
-        if (!roster || !(await this.#active()))
+        if (!roster || !(await this.#active())) {
+            this.#custody?.close();
+            this.#custody = undefined;
+            this.#stopWatch();
+            this.#insula?.release();
+            this.#insula = undefined;
             throw new ClaustrumConsumerError('not-active', 'Claustrum scoped custody is not active');
+        }
         const current = await readVaultRoster(this.#options.rosterPath);
         this.#assertOpen(signal);
         const observed = roster.rows.find((row) => row.routeId === routeId);
         const configured = current?.rows.find((row) => row.routeId === routeId);
-        if (configured && !configured.enabled)
+        if (configured && !configured.enabled) {
+            if (observed)
+                this.#custody?.forget(observed.credentialId);
             throw new ClaustrumConsumerError('route-declined', 'Claustrum route is disabled');
+        }
         if (!observed ||
             !configured ||
             configured.state !== 'active' ||
             configured.credentialId !== observed.credentialId ||
-            configured.accountIdentity !== observed.accountIdentity)
+            configured.accountIdentity !== observed.accountIdentity ||
+            configured.credentialType !== observed.credentialType) {
+            if (observed)
+                this.#custody?.forget(observed.credentialId);
             throw new ClaustrumConsumerError('route-unavailable', 'Claustrum route is disabled, removed or changed');
+        }
         const custody = await this.#wait(this.#getCustody(), signal);
         const combined = combineAbortSignals([
             this.#shutdown.signal,
@@ -308,7 +427,7 @@ export class ClaustrumConsumer {
                 ...(configured.accountIdentity !== undefined && {
                     accountIdentity: configured.accountIdentity,
                 }),
-            }, combined.signal);
+            }, combined.signal, routeId);
         }
         finally {
             combined.dispose();
@@ -332,6 +451,10 @@ export class ClaustrumConsumer {
         const signal = options.signal;
         let served = await this.authorize(routeId, signal);
         let response = await dispatch(served, signal);
+        if (response.status === 401 && served.fromKeptReceipt) {
+            await this.reportFailure(served, 401, options.reporterSource ?? 'direct');
+            return response;
+        }
         if (response.status === 401 && !signal?.aborted) {
             let current;
             try {
@@ -366,6 +489,7 @@ export class ClaustrumConsumer {
         this.#assertOpen();
         await declineVaultRoute(this.#options.rosterPath, routeId);
         this.#roster = await readVaultRoster(this.#options.rosterPath);
+        this.#custody?.retain(this.#roster?.rows ?? []);
     }
     async accept(routeId) {
         this.#assertOpen();
@@ -421,6 +545,7 @@ export class ClaustrumConsumer {
         if (this.#timer)
             (this.#options.clearTimeoutImpl ?? clearTimeout)(this.#timer);
         this.#timer = undefined;
+        this.#stopWatch();
         this.#custody?.close();
         this.#insula?.release();
         this.#insula = undefined;

package/src/tui-compiled/raw/shared/375d9cca2def037d-private-files.js

@@ -184,19 +184,25 @@ export async function replaceWindowsFile(from, to, options = {}) {
     to = resolve(to);
     const now = options.now ?? (() => performance.now());
     const start = now();
-    const deadline = Math.min(start + 500, options.deadline ?? Infinity);
+    const leaseDeadline = options.deadline ?? Infinity;
+    let retryDeadline;
     const delays = [0, 10, 20, 40, 80, 100];
     let original;
     let attempts = 0;
     for (const delay of delays) {
+        const deadline = Math.min(retryDeadline ?? Infinity, leaseDeadline);
         if (now() >= deadline)
             break;
         if (delay)
             await (options.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms))))(Math.min(delay, Math.max(0, deadline - now())));
         if (now() >= deadline)
             break;
+        const fenceStart = now();
         await options.beforeRename?.();
-        if (now() >= deadline)
+        // Ownership checks fence every attempt but do not spend the sharing-retry budget.
+        if (retryDeadline !== undefined)
+            retryDeadline += now() - fenceStart;
+        if (now() >= leaseDeadline)
             break;
         attempts++;
         try {
@@ -212,6 +218,8 @@ export async function replaceWindowsFile(from, to, options = {}) {
                     !detail.reason;
             if (!candidate)
                 break;
+            // Start the retry window only once a rename has actually failed.
+            retryDeadline ??= now() + 500;
         }
     }
     const error = new PrivateFileError(to, 'rename', original ??