@cortexkit/opencode-openai-auth 1.2.0 → 1.4.0

package/src/tui-compiled/runtime/shared/169b2b4bf30909bc-consumer.js

@@ -3,8 +3,10 @@ import { combineAbortSignals } from "./6371b24a0573d79e-any-signal.js";
 import { ClaustrumScopedCustody, decideScopedRetryAfter401, } from "./0f77ebc3c914c9c6-custody.js";
 import { readClaustrumEnrollmentToken } from "./b9588ad4725c1d10-enrollment.js";
 import { ClaustrumConsumerError } from "./ca0fccaba1d87af4-errors.js";
-import { acquireInsulaQuotaSource } from "./d0f0b6be200311af-insula.js";
-import { acceptVaultRoute, declineVaultRoute, readVaultRoster, recordVaultAccountQuota, recordVaultQuota, refreshVaultRoster, vaultRoutingRows, } from "./30f5bc480f31f51c-roster.js";
+import { acquireInsulaQuotaSource, } from "./d0f0b6be200311af-insula.js";
+import { pendingVaultQuota, retainVaultQuotaWriter } from "./81dddd203f1b92a3-quota-writer.js";
+import { acceptVaultRoute, applyVaultQuota, declineVaultRoute, forgetPendingVaultDiscovery, readVaultRoster, recordVaultAccountQuota, recordVaultQuota, refreshVaultRoster, vaultRoutingRows, } from "./30f5bc480f31f51c-roster.js";
+import { SAFETY_POLL_MS } from "./dc9290c2a7552ba6-watch.js";
 /**
  * One plugin host's view of its vault accounts. It turns vault credentials
  * into rows for `/routing`, authorizes each physical send with the vault, and
@@ -29,9 +31,18 @@ export class ClaustrumConsumer {
     #timer;
     #started = false;
     #insula;
+    #vaultWatch;
+    #releaseInsulaWatch;
+    #insulaSkips = new Map();
+    /** When this instance last completed a discovery, by `now`. */
+    #discoveredAt;
+    #releaseQuotaWriter;
     constructor(options) {
         this.#options = options;
         this.#logger = options.logger ?? createLogger('claustrum');
+        this.#releaseQuotaWriter = retainVaultQuotaWriter(options.rosterPath, (publication) => {
+            this.#roster = applyVaultQuota(this.#roster, publication).roster;
+        });
     }
     #assertOpen(signal) {
         this.#shutdown.signal.throwIfAborted();
@@ -91,6 +102,8 @@ export class ClaustrumConsumer {
                     requireAssertion: this.#options.requireAssertion,
                     now: this.#options.now,
                     logger: this.#logger,
+                    setTimeoutImpl: this.#options.setTimeoutImpl,
+                    clearTimeoutImpl: this.#options.clearTimeoutImpl,
                 });
                 if (this.#options.insula && client.insula) {
                     this.#insula = acquireInsulaQuotaSource(client.insula, this.#options.tokenPath);
@@ -122,6 +135,27 @@ export class ClaustrumConsumer {
             ? latest.reach
             : undefined;
     }
+    /** How this consumer currently learns about changes, without I/O. */
+    watchState() {
+        return Object.freeze({
+            vault: this.#vaultWatch?.mode ?? 'polling',
+            ...(this.#options.insula && {
+                insula: this.#insula?.source.watchMode() ?? 'polling',
+            }),
+        });
+    }
+    /** Close the watches with the connection they belong to. */
+    #stopWatch() {
+        this.#vaultWatch?.close();
+        this.#vaultWatch = undefined;
+        this.#releaseInsulaWatch?.();
+        this.#releaseInsulaWatch = undefined;
+    }
+    /** Whether any account is using an in-memory outage receipt, without I/O. */
+    keptReceiptState() {
+        return (this.#custody?.keptReceiptState() ??
+            Object.freeze({ active: false, since: null }));
+    }
     /** Rows for `/routing`, from the last committed roster. */
     routingRows() {
         return vaultRoutingRows(this.#roster);
@@ -134,6 +168,7 @@ export class ClaustrumConsumer {
             if (!(await this.#active())) {
                 this.#roster = undefined;
                 this.#grantReach = undefined;
+                this.#stopWatch();
                 this.#custody?.close();
                 this.#custody = undefined;
                 this.#insula?.release();
@@ -146,11 +181,9 @@ export class ClaustrumConsumer {
             let discovered;
             const roster = await refreshVaultRoster({
                 path: this.#options.rosterPath,
-                custody: {
-                    discover: async (signal) => {
-                        discovered = await custody.discover(signal);
-                        return discovered;
-                    },
+                custody,
+                onInventory: (inventory) => {
+                    discovered = inventory;
                 },
                 isActive: () => this.#active(),
                 signal: this.#shutdown.signal,
@@ -163,7 +196,8 @@ export class ClaustrumConsumer {
             });
             this.#assertOpen();
             const changed = roster?.view !== this.#roster?.view;
-            this.#roster = roster;
+            this.#roster = pendingVaultQuota(this.#options.rosterPath, roster);
+            custody.retain(roster?.rows ?? []);
             // Each discovery replaces the previous value, including with unknown. A
             // refresh that served a peer's roster discovered nothing and leaves it;
             // grantReach() hides it once the roster's view no longer matches.
@@ -175,12 +209,23 @@ export class ClaustrumConsumer {
             // notification, and the poll runs every few seconds.
             if (roster && changed)
                 this.#options.onRoster?.(roster);
+            this.#discoveredAt = (this.#options.now ?? Date.now)();
             return roster;
         })().finally(() => {
             this.#refreshing = undefined;
         });
         return this.#refreshing;
     }
+    /**
+     * Poll in the background and open the vault and insula watches. Until the
+     * vault watch is accepted, and whenever it is unavailable, every tick lists
+     * the vault exactly as before watches existed. While it is open a tick
+     * lists only when five minutes have passed since the last discovery, since
+     * the watch keeps no history; it still checks `isCustodyActive`, so a switch
+     * to local mode closes the connection as quickly as before. Insula is
+     * polled on the tick only while its own watch is not open. A host not in
+     * vault mode makes no request.
+     */
     start() {
         if (this.#started)
             return;
@@ -188,8 +233,10 @@ export class ClaustrumConsumer {
         this.#started = true;
         const tick = async () => {
             try {
-                await this.refresh();
+                if (await this.#listDue())
+                    await this.refresh();
                 await this.refreshInsulaQuota();
+                this.#openWatch();
             }
             catch (error) {
                 if (!this.#shutdown.signal.aborted)
@@ -208,6 +255,53 @@ export class ClaustrumConsumer {
         };
         void tick();
     }
+    /** Whether a background tick must list the vault now. */
+    async #listDue() {
+        if (this.#vaultWatch?.mode !== 'watching')
+            return true;
+        const now = (this.#options.now ?? Date.now)();
+        if (this.#discoveredAt === undefined ||
+            now - this.#discoveredAt >= SAFETY_POLL_MS)
+            return true;
+        // refresh() is what closes the connection when the host left vault mode.
+        return !(await this.#active());
+    }
+    /**
+     * Open the vault and insula watches once a vault connection exists. Only
+     * reached in vault mode: a host in local mode never connects.
+     */
+    #openWatch() {
+        const custody = this.#custody;
+        if (this.#shutdown.signal.aborted || !custody)
+            return;
+        // The same entry point a host without a consumer uses, so both apply
+        // notices, refusals and outages alike.
+        this.#vaultWatch ??= custody.watchRoster({
+            view: () => this.#roster?.view,
+            // The existing discovery, so a watched change commits the roster and
+            // re-applies it to kept receipts exactly as a poll does. A refresh
+            // already in flight may have listed before the change was announced,
+            // so wait for it and list again.
+            onView: async () => {
+                while (this.#refreshing)
+                    await this.#refreshing.catch(() => { });
+                await this.refresh();
+            },
+            // Custody has dropped kept receipts, as a poll meeting the same
+            // refusal from list_scoped would.
+            onRefused: (error) => this.#options.onError?.(error),
+            onError: (error) => {
+                if (!this.#shutdown.signal.aborted)
+                    this.#options.onError?.(error);
+            },
+        });
+        if (this.#options.insula && this.#insula && !this.#releaseInsulaWatch)
+            this.#releaseInsulaWatch = this.#insula.source.watch({
+                provider: this.#options.insula.provider,
+                setTimeoutImpl: this.#options.setTimeoutImpl,
+                clearTimeoutImpl: this.#options.clearTimeoutImpl,
+            });
+    }
     /**
      * Fetch on a background tick, at most once per minute across projects with
      * the same daemon and enrollment token path. Admission must use the cache
@@ -258,7 +352,7 @@ export class ClaustrumConsumer {
             return undefined;
         try {
             await readClaustrumEnrollmentToken(this.#options.tokenPath);
-            const roster = await readVaultRoster(this.#options.rosterPath);
+            const roster = pendingVaultQuota(this.#options.rosterPath, await readVaultRoster(this.#options.rosterPath));
             const row = roster?.rows.find((entry) => entry.routeId === routeId);
             return this.#normalizeInsulaQuota(row?.accountIdentity);
         }
@@ -266,6 +360,44 @@ export class ClaustrumConsumer {
             return undefined;
         }
     }
+    /** Cache-only background lookup, preserving the reason a route has no reading. */
+    async lookupInsulaQuotaForRoute(routeId) {
+        const options = this.#options.insula;
+        if (!options || this.#shutdown.signal.aborted || !(await this.#active()))
+            return { miss: 'unreachable' };
+        try {
+            await readClaustrumEnrollmentToken(this.#options.tokenPath);
+            const roster = pendingVaultQuota(this.#options.rosterPath, await readVaultRoster(this.#options.rosterPath));
+            const account = roster?.rows.find((row) => row.routeId === routeId)?.accountIdentity;
+            if (!account || !this.#insula)
+                return { miss: 'unreachable' };
+            const result = this.#insula.source.lookup(options.provider, account, (this.#options.now ?? Date.now)());
+            const reading = result.reading &&
+                options.normalize(result.reading.entry, result.reading.context);
+            if (result.miss)
+                return { miss: result.miss, ...(reading !== undefined && { reading }) };
+            // Refusing an echo or unsupported window leaves the plugin's poll in charge.
+            return reading === undefined ? { miss: 'unreachable' } : { reading };
+        }
+        catch {
+            return { miss: 'unreachable' };
+        }
+    }
+    /** Skip the fallback poll while insula is cold or its upstream fetch failed. */
+    async pollInsulaQuotaForRoute(routeId, fallback) {
+        const result = await this.lookupInsulaQuotaForRoute(routeId);
+        if (result.miss === 'cold' || result.miss === 'upstream-failed') {
+            if (this.#insulaSkips.get(routeId) !== result.miss) {
+                this.#insulaSkips.set(routeId, result.miss);
+                this.#logger.warn('skipped insula provider poll', {
+                    reason: result.miss,
+                });
+            }
+            return undefined;
+        }
+        this.#insulaSkips.delete(routeId);
+        return result.miss ? fallback() : result.reading;
+    }
     #normalizeInsulaQuota(accountIdentity) {
         if (!this.#options.insula || !accountIdentity)
             return undefined;
@@ -282,20 +414,33 @@ export class ClaustrumConsumer {
     async authorize(routeId, signal) {
         this.#assertOpen(signal);
         const roster = this.#roster ?? (await this.#wait(this.refresh(), signal));
-        if (!roster || !(await this.#active()))
+        if (!roster || !(await this.#active())) {
+            this.#custody?.close();
+            this.#custody = undefined;
+            this.#stopWatch();
+            this.#insula?.release();
+            this.#insula = undefined;
             throw new ClaustrumConsumerError('not-active', 'Claustrum scoped custody is not active');
-        const current = await readVaultRoster(this.#options.rosterPath);
+        }
+        const current = pendingVaultQuota(this.#options.rosterPath, await readVaultRoster(this.#options.rosterPath));
         this.#assertOpen(signal);
         const observed = roster.rows.find((row) => row.routeId === routeId);
         const configured = current?.rows.find((row) => row.routeId === routeId);
-        if (configured && !configured.enabled)
+        if (configured && !configured.enabled) {
+            if (observed)
+                this.#custody?.forget(observed.credentialId);
             throw new ClaustrumConsumerError('route-declined', 'Claustrum route is disabled');
+        }
         if (!observed ||
             !configured ||
             configured.state !== 'active' ||
             configured.credentialId !== observed.credentialId ||
-            configured.accountIdentity !== observed.accountIdentity)
+            configured.accountIdentity !== observed.accountIdentity ||
+            configured.credentialType !== observed.credentialType) {
+            if (observed)
+                this.#custody?.forget(observed.credentialId);
             throw new ClaustrumConsumerError('route-unavailable', 'Claustrum route is disabled, removed or changed');
+        }
         const custody = await this.#wait(this.#getCustody(), signal);
         const combined = combineAbortSignals([
             this.#shutdown.signal,
@@ -308,7 +453,7 @@ export class ClaustrumConsumer {
                 ...(configured.accountIdentity !== undefined && {
                     accountIdentity: configured.accountIdentity,
                 }),
-            }, combined.signal);
+            }, combined.signal, routeId);
         }
         finally {
             combined.dispose();
@@ -332,6 +477,10 @@ export class ClaustrumConsumer {
         const signal = options.signal;
         let served = await this.authorize(routeId, signal);
         let response = await dispatch(served, signal);
+        if (response.status === 401 && served.fromKeptReceipt) {
+            await this.reportFailure(served, 401, options.reporterSource ?? 'direct');
+            return response;
+        }
         if (response.status === 401 && !signal?.aborted) {
             let current;
             try {
@@ -365,12 +514,13 @@ export class ClaustrumConsumer {
     async decline(routeId) {
         this.#assertOpen();
         await declineVaultRoute(this.#options.rosterPath, routeId);
-        this.#roster = await readVaultRoster(this.#options.rosterPath);
+        this.#roster = pendingVaultQuota(this.#options.rosterPath, await readVaultRoster(this.#options.rosterPath));
+        this.#custody?.retain(this.#roster?.rows ?? []);
     }
     async accept(routeId) {
         this.#assertOpen();
         await acceptVaultRoute(this.#options.rosterPath, routeId);
-        this.#roster = await readVaultRoster(this.#options.rosterPath);
+        this.#roster = pendingVaultQuota(this.#options.rosterPath, await readVaultRoster(this.#options.rosterPath));
     }
     /**
      * Store a quota or profile observation for a vault route. The receipt the
@@ -380,7 +530,7 @@ export class ClaustrumConsumer {
      */
     async recordQuota(routeId, observation, attempt) {
         this.#assertOpen();
-        const kept = await recordVaultQuota(this.#options.rosterPath, {
+        return recordVaultQuota(this.#options.rosterPath, {
             routeId,
             observation,
             credentialId: attempt.credentialId,
@@ -392,27 +542,21 @@ export class ClaustrumConsumer {
                 expectedAccountIdentity: attempt.expectedAccountIdentity,
             }),
         });
-        if (kept)
-            this.#roster = await readVaultRoster(this.#options.rosterPath);
-        return kept;
     }
     /**
      * Store a background observation that belongs to an account rather than to
      * a served credential (an insula reading from `cachedInsulaQuotaForRoute`).
      * It lands only while the route is still bound to that known account, so no
      * credential fetch is needed and a replaced account's reading is dropped.
-     * The in-memory roster is reloaded from the file, without a vault call.
+     * Memory updates immediately; durable publication is detached and coalesced.
      */
     async recordAccountQuota(routeId, accountIdentity, observation) {
         this.#assertOpen();
-        const kept = await recordVaultAccountQuota(this.#options.rosterPath, {
+        return recordVaultAccountQuota(this.#options.rosterPath, {
             routeId,
             accountIdentity,
             observation,
         });
-        if (kept)
-            this.#roster = await readVaultRoster(this.#options.rosterPath);
-        return kept;
     }
     close() {
         if (this.#shutdown.signal.aborted)
@@ -421,10 +565,18 @@ export class ClaustrumConsumer {
         if (this.#timer)
             (this.#options.clearTimeoutImpl ?? clearTimeout)(this.#timer);
         this.#timer = undefined;
+        this.#stopWatch();
         this.#custody?.close();
         this.#insula?.release();
         this.#insula = undefined;
         this.#roster = undefined;
         this.#grantReach = undefined;
+        void this.#releaseQuotaWriter();
+        forgetPendingVaultDiscovery(this.#options.rosterPath);
+    }
+    /** Close immediately; the last consumer also waits for the writer's bounded drain. */
+    async dispose() {
+        this.close();
+        await this.#releaseQuotaWriter();
     }
 }

package/src/tui-compiled/runtime/shared/2577ec69f9973ae9-quota-normalize.js

@@ -56,8 +56,33 @@ export function normalizeQuotaHeaders(h) {
   const secondary = windowFromHeader(h, "x-codex-secondary-used-percent");
   if (secondary)
     snapshot.secondary = secondary;
+  const credits = creditsFromHeaders(h);
+  if (credits)
+    snapshot.credits = credits;
   return snapshot;
 }
+function headerBool(h, name) {
+  const raw = h.get(name)?.trim();
+  if (raw === void 0)
+    return;
+  if (raw.toLowerCase() === "true" || raw === "1")
+    return !0;
+  if (raw.toLowerCase() === "false" || raw === "0")
+    return !1;
+  return;
+}
+function creditsFromHeaders(h) {
+  const hasCredits = headerBool(h, "x-codex-credits-has-credits"), unlimited = headerBool(h, "x-codex-credits-unlimited");
+  if (hasCredits === void 0 || unlimited === void 0)
+    return;
+  const balance = nonNegativeNumberish(h.get("x-codex-credits-balance")?.trim());
+  return {
+    hasCredits,
+    unlimited,
+    ...balance !== void 0 ? { balance } : {},
+    checkedAt: Date.now()
+  };
+}
 export function isCompleteQuotaHeaderFrame(h) {
   const states = QUOTA_USED_PERCENT_HEADERS.map((name) => usedPercentHeaderState(h, name));
   return states.includes("valid") && !states.includes("invalid");
@@ -85,8 +110,26 @@ export function normalizeWsFrame(event) {
   const secondary = windowFromWs(event.rate_limits?.secondary);
   if (secondary)
     snapshot.secondary = secondary;
+  const credits = creditsFromWs(event.credits);
+  if (credits)
+    snapshot.credits = credits;
   return snapshot;
 }
+function creditsFromWs(value) {
+  if (value === null || typeof value !== "object")
+    return;
+  const credits = value;
+  if (typeof credits.has_credits !== "boolean" || typeof credits.unlimited !== "boolean")
+    return;
+  const balance = nonNegativeNumberish(typeof credits.balance === "string" ? credits.balance.trim() : credits.balance);
+  return {
+    hasCredits: credits.has_credits,
+    unlimited: credits.unlimited,
+    ...balance !== void 0 ? { balance } : {},
+    ...typeof credits.overage_limit_reached === "boolean" ? { overageLimitReached: credits.overage_limit_reached } : {},
+    checkedAt: Date.now()
+  };
+}
 function nonNegativeNumberish(value) {
   if (value == null || value === "")
     return;
@@ -147,7 +190,8 @@ export function normalizeWham(json) {
       hasCredits: credits.has_credits,
       unlimited: credits.unlimited,
       overageLimitReached: credits.overage_limit_reached,
-      ...balance !== void 0 ? { balance } : {}
+      ...balance !== void 0 ? { balance } : {},
+      checkedAt: Date.now()
     };
   }
   return snapshot;

package/src/tui-compiled/runtime/shared/30f5bc480f31f51c-roster.js

@@ -1,9 +1,12 @@
 import { createHash } from "node:crypto";
-import { acquireRefreshFileLock, withLock, writeJsonAtomic, } from "./ec971142548df90e-index.js";
+import { resolve } from "node:path";
+import { acquireRefreshFileLock, LockContentionError, withLock, writeJsonAtomic, } from "./ec971142548df90e-index.js";
 import { readPrivateText, windowsPrivateFiles } from "./375d9cca2def037d-private-files.js";
-import { decodeQuotaMap, mergeQuotaObservation, } from "./d5a8f1061ee2f114-index.js";
+import { decodeQuotaMap, isQuotaObservation, mergeQuotaObservation, } from "./d5a8f1061ee2f114-index.js";
 import { ClaustrumConsumerError } from "./ca0fccaba1d87af4-errors.js";
 import { acceptAccount, declineAccount, isDeclined, } from "./7c140680fc81be92-interlock.js";
+import { enqueueVaultQuota, pendingVaultQuota, } from "./81dddd203f1b92a3-quota-writer.js";
+export { drainVaultQuota } from "./81dddd203f1b92a3-quota-writer.js";
 export const DEFAULT_ROUTE_PREFIX = 'vault:';
 function hash(value) {
     return createHash('sha256').update(value).digest('hex');
@@ -313,6 +316,7 @@ const WRITE_LOCK = {
     name: 'claustrum-roster-write',
     ttlMs: 10_000,
     timeoutMs: 5_000,
+    renew: true,
 };
 const DISCOVERY_LEASE = { name: 'claustrum-roster', ttlMs: 30_000 };
 /**
@@ -321,7 +325,7 @@ const DISCOVERY_LEASE = { name: 'claustrum-roster', ttlMs: 30_000 };
  * before any rename performed inside `change`; if it throws, do not rename.
  */
 export async function mutateVaultRoster(path, change, options = {}) {
-    return withLock(path, WRITE_LOCK, async (lock) => {
+    return withLock(path, { ...WRITE_LOCK, signal: options.signal }, async (lock) => {
         const current = await readVaultRoster(path);
         const { next, result } = await change(current, {
             assertOwned: () => lock.assertOwned(),
@@ -333,6 +337,7 @@ export async function mutateVaultRoster(path, change, options = {}) {
             await writeJsonAtomic(path, next, {
                 beforeRename: async () => {
                     await options.beforePublish?.();
+                    options.signal?.throwIfAborted();
                     await lock.assertOwned();
                 },
             });
@@ -415,55 +420,73 @@ function receiptFence(row, receipt) {
  * write is fenced on the receipt the reading was taken with: it lands only
  * while the row still holds that receipt's credential (as representative or
  * alias) and account, so a slow read for a replaced account can never land on
- * its successor. Returns whether the observation was kept.
+ * its successor. Resolves false when the fence refuses the reading against the
+ * roster as it stands now (on disk, plus readings this process has not
+ * written yet), and true once the reading is queued for the next write. The
+ * write applies the fence again, so a rebind between the two still refuses.
  */
-export function recordVaultQuota(path, input) {
-    return mutateVaultRoster(path, (current) => {
-        const row = current?.rows.find((entry) => entry.routeId === input.routeId);
-        const fence = !current || !row ? 'refuse' : receiptFence(row, input);
-        if (!current || !row || fence === 'refuse')
-            return { result: false };
-        const quota = mergeQuotaObservation(row.quota, input.observation);
-        // A bound account is `unclaimed`: the vault's list has not named it, and
-        // the next projection keeps it as the account this credential last
-        // logged into until the vault names one.
-        const bound = fence === 'bind'
-            ? { accountIdentity: input.accountIdentity, unclaimed: true }
-            : {};
-        return {
-            next: {
-                ...current,
-                rows: current.rows.map((entry) => entry === row ? { ...entry, ...bound, quota } : entry),
-            },
-            result: true,
-        };
+export async function recordVaultQuota(path, input) {
+    const { routeId, observation, ...receipt } = input;
+    return enqueueFencedVaultQuota(path, {
+        routeId,
+        observation,
+        accountIdentity: receipt.accountIdentity,
+        receipt,
     });
 }
+// The answer callers rely on (false for a replaced account) comes from the
+// fence, so it runs here against the current roster before anything is
+// queued. The read takes no lock: the roster file is replaced atomically.
+async function enqueueFencedVaultQuota(path, publication) {
+    if (!isQuotaObservation(publication.observation))
+        return false;
+    const current = pendingVaultQuota(path, await readVaultRoster(path));
+    if (!applyVaultQuota(current, publication).kept)
+        return false;
+    return enqueueVaultQuota(path, publication);
+}
 /**
  * Merge a quota observation that belongs to an account rather than to a
  * served credential, such as a background reading from insula. The write
  * lands only while the row is still bound to that exact known account, so a
  * reading taken before a replacement never reaches the successor. Unlike
  * `recordVaultQuota` it never binds an account: a row without a known account
- * is refused. Returns whether the observation was kept.
+ * is refused. Resolves false when the row is not bound to that account now,
+ * and true once the reading is queued, as `recordVaultQuota` does.
  */
 export function recordVaultAccountQuota(path, input) {
-    return mutateVaultRoster(path, (current) => {
-        const row = current?.rows.find((entry) => entry.routeId === input.routeId);
-        if (!current ||
-            !row ||
-            row.accountIdentity === undefined ||
-            row.accountIdentity !== input.accountIdentity)
-            return { result: false };
-        const quota = mergeQuotaObservation(row.quota, input.observation);
-        return {
-            next: {
-                ...current,
-                rows: current.rows.map((entry) => entry === row ? { ...entry, quota } : entry),
-            },
-            result: true,
-        };
-    });
+    return enqueueFencedVaultQuota(path, input);
+}
+/** Apply the same identity fence to memory overlays and durable quota batches. */
+export function applyVaultQuota(current, input) {
+    const row = current?.rows.find((entry) => entry.routeId === input.routeId);
+    const fence = !row
+        ? 'refuse'
+        : input.receipt
+            ? receiptFence(row, input.receipt)
+            : row.accountIdentity !== undefined &&
+                row.accountIdentity === input.accountIdentity
+                ? 'hold'
+                : 'refuse';
+    if (!current || !row || fence === 'refuse')
+        return { roster: current, kept: false };
+    const quota = mergeQuotaObservation(row.quota, input.observation);
+    // Binding remembers which account this credential proved, without claiming
+    // that the vault's discovery has named that account yet.
+    const bound = fence === 'bind'
+        ? { accountIdentity: input.accountIdentity, unclaimed: true }
+        : {};
+    return {
+        roster: {
+            ...current,
+            rows: current.rows.map((entry) => entry === row ? { ...entry, ...bound, quota } : entry),
+        },
+        kept: true,
+    };
+}
+const pendingDiscoveries = new Map();
+export function forgetPendingVaultDiscovery(path) {
+    pendingDiscoveries.delete(resolve(path));
 }
 /**
  * Discover and commit the roster. The lease covers the list call and the
@@ -471,12 +494,16 @@ export function recordVaultAccountQuota(path, input) {
  * from a newer one, so a run that lost its lease is refused at commit. A
  * failed list, or custody switching off mid-run, never writes anything; a
  * peer holding the lease means its last committed roster is served instead.
+ * A write-lock timeout keeps the discovered inventory for the next poll,
+ * unless a peer has superseded its base view in the meantime.
  */
 export async function refreshVaultRoster(options) {
     options.signal?.throwIfAborted();
     const active = async () => (await options.isActive?.()) ?? true;
-    if (!(await active()))
+    if (!(await active())) {
+        forgetPendingVaultDiscovery(options.path);
         return undefined;
+    }
     const lease = await acquireRefreshFileLock({
         ...DISCOVERY_LEASE,
         path: options.path,
@@ -489,8 +516,25 @@ export async function refreshVaultRoster(options) {
             throw new ClaustrumConsumerError('roster-busy', 'Claustrum account discovery is already in progress');
         return persisted;
     }
+    const key = resolve(options.path);
+    let discovered;
     try {
-        const inventory = await options.custody.discover(options.signal);
+        const previous = await readVaultRoster(options.path);
+        const pending = pendingDiscoveries.get(key);
+        // Opaque view cursors cannot be ordered. Reuse a discovery only while no
+        // peer has committed a different view since it was read.
+        discovered =
+            pending &&
+                (pending.previousView === previous?.view ||
+                    pending.inventory.view === previous?.view)
+                ? pending
+                : {
+                    inventory: await options.custody.discover(options.signal),
+                    previousView: previous?.view,
+                };
+        pendingDiscoveries.delete(key);
+        const { inventory } = discovered;
+        options.onInventory?.(inventory);
         options.signal?.throwIfAborted();
         return await mutateVaultRoster(options.path, async (current) => {
             if (!(await active()))
@@ -503,8 +547,21 @@ export async function refreshVaultRoster(options) {
             const next = projectVaultRoster(current, inventory, projection);
             const changed = JSON.stringify(current) !== JSON.stringify(next);
             return { ...(changed && { next }), result: next };
+        }, {
+            beforePublish: async () => {
+                options.signal?.throwIfAborted();
+                await lease.assertOwned();
+            },
         });
     }
+    catch (error) {
+        if (error instanceof LockContentionError &&
+            discovered &&
+            !options.signal?.aborted &&
+            (await active()))
+            pendingDiscoveries.set(key, discovered);
+        throw error;
+    }
     finally {
         await lease.release();
     }