@cortexkit/opencode-openai-auth 1.3.0 → 1.5.0

package/src/tui-compiled/raw/shared/169b2b4bf30909bc-consumer.js

@@ -3,9 +3,10 @@ import { combineAbortSignals } from "./6371b24a0573d79e-any-signal.js";
 import { ClaustrumScopedCustody, decideScopedRetryAfter401, } from "./0f77ebc3c914c9c6-custody.js";
 import { readClaustrumEnrollmentToken } from "./b9588ad4725c1d10-enrollment.js";
 import { ClaustrumConsumerError } from "./ca0fccaba1d87af4-errors.js";
-import { acquireInsulaQuotaSource } from "./d0f0b6be200311af-insula.js";
-import { acceptVaultRoute, declineVaultRoute, readVaultRoster, recordVaultAccountQuota, recordVaultQuota, refreshVaultRoster, vaultRoutingRows, } from "./30f5bc480f31f51c-roster.js";
-import { SAFETY_POLL_MS, ScopedRosterWatch } from "./dc9290c2a7552ba6-watch.js";
+import { acquireInsulaQuotaSource, } from "./d0f0b6be200311af-insula.js";
+import { pendingVaultQuota, retainVaultQuotaWriter } from "./81dddd203f1b92a3-quota-writer.js";
+import { acceptVaultRoute, applyVaultQuota, declineVaultRoute, forgetPendingVaultDiscovery, readVaultRoster, recordVaultAccountQuota, recordVaultQuota, refreshVaultRoster, reorderVaultRoster, vaultRoutingRows, } from "./30f5bc480f31f51c-roster.js";
+import { SAFETY_POLL_MS } from "./dc9290c2a7552ba6-watch.js";
 /**
  * One plugin host's view of its vault accounts. It turns vault credentials
  * into rows for `/routing`, authorizes each physical send with the vault, and
@@ -19,8 +20,6 @@ export class ClaustrumConsumer {
     #shutdown = new AbortController();
     #logger;
     #custody;
-    /** The custody's client, kept so `start()` can open its vault watch. */
-    #client;
     #connecting;
     #refreshing;
     #roster;
@@ -34,11 +33,16 @@ export class ClaustrumConsumer {
     #insula;
     #vaultWatch;
     #releaseInsulaWatch;
+    #insulaSkips = new Map();
     /** When this instance last completed a discovery, by `now`. */
     #discoveredAt;
+    #releaseQuotaWriter;
     constructor(options) {
         this.#options = options;
         this.#logger = options.logger ?? createLogger('claustrum');
+        this.#releaseQuotaWriter = retainVaultQuotaWriter(options.rosterPath, (publication) => {
+            this.#roster = applyVaultQuota(this.#roster, publication).roster;
+        });
     }
     #assertOpen(signal) {
         this.#shutdown.signal.throwIfAborted();
@@ -90,7 +94,6 @@ export class ClaustrumConsumer {
                     client.close();
                     this.#assertOpen();
                 }
-                this.#client = client;
                 this.#custody = new ClaustrumScopedCustody({
                     client,
                     family: this.#options.family,
@@ -143,9 +146,8 @@ export class ClaustrumConsumer {
     }
     /** Close the watches with the connection they belong to. */
     #stopWatch() {
-        this.#vaultWatch?.stop();
+        this.#vaultWatch?.close();
         this.#vaultWatch = undefined;
-        this.#client = undefined;
         this.#releaseInsulaWatch?.();
         this.#releaseInsulaWatch = undefined;
     }
@@ -179,11 +181,9 @@ export class ClaustrumConsumer {
             let discovered;
             const roster = await refreshVaultRoster({
                 path: this.#options.rosterPath,
-                custody: {
-                    discover: async (signal) => {
-                        discovered = await custody.discover(signal);
-                        return discovered;
-                    },
+                custody,
+                onInventory: (inventory) => {
+                    discovered = inventory;
                 },
                 isActive: () => this.#active(),
                 signal: this.#shutdown.signal,
@@ -196,7 +196,7 @@ export class ClaustrumConsumer {
             });
             this.#assertOpen();
             const changed = roster?.view !== this.#roster?.view;
-            this.#roster = roster;
+            this.#roster = pendingVaultQuota(this.#options.rosterPath, roster);
             custody.retain(roster?.rows ?? []);
             // Each discovery replaces the previous value, including with unknown. A
             // refresh that served a peer's roster discovered nothing and leaves it;
@@ -271,42 +271,30 @@ export class ClaustrumConsumer {
      * reached in vault mode: a host in local mode never connects.
      */
     #openWatch() {
-        const client = this.#client;
-        if (this.#shutdown.signal.aborted || !client || !this.#custody)
+        const custody = this.#custody;
+        if (this.#shutdown.signal.aborted || !custody)
             return;
-        if (!this.#vaultWatch) {
-            const watch = new ScopedRosterWatch({
-                client,
-                enrollmentToken: async () => (await readClaustrumEnrollmentToken(this.#options.tokenPath)).token,
-                view: () => this.#roster?.view,
-                // The existing discovery, so a watched change commits the roster and
-                // re-applies it to kept receipts exactly as a poll does. A refresh
-                // already in flight may have listed before the change was announced,
-                // so wait for it and list again.
-                discover: async () => {
-                    while (this.#refreshing)
-                        await this.#refreshing.catch(() => { });
-                    await this.refresh();
-                },
-                onRefused: (error) => {
-                    // As a poll that met the same refusal from list_scoped would.
-                    this.#custody?.listFailed(error);
+        // The same entry point a host without a consumer uses, so both apply
+        // notices, refusals and outages alike.
+        this.#vaultWatch ??= custody.watchRoster({
+            view: () => this.#roster?.view,
+            // The existing discovery, so a watched change commits the roster and
+            // re-applies it to kept receipts exactly as a poll does. A refresh
+            // already in flight may have listed before the change was announced,
+            // so wait for it and list again.
+            onView: async () => {
+                while (this.#refreshing)
+                    await this.#refreshing.catch(() => { });
+                await this.refresh();
+            },
+            // Custody has dropped kept receipts, as a poll meeting the same
+            // refusal from list_scoped would.
+            onRefused: (error) => this.#options.onError?.(error),
+            onError: (error) => {
+                if (!this.#shutdown.signal.aborted)
                     this.#options.onError?.(error);
-                },
-                onTransportLost: () => this.#custody?.transportLost(),
-                onReachable: () => this.#custody?.reachable(),
-                onError: (error) => {
-                    if (!this.#shutdown.signal.aborted)
-                        this.#options.onError?.(error);
-                },
-                logger: this.#logger,
-                now: this.#options.now,
-                setTimeoutImpl: this.#options.setTimeoutImpl,
-                clearTimeoutImpl: this.#options.clearTimeoutImpl,
-            });
-            this.#vaultWatch = watch;
-            watch.start();
-        }
+            },
+        });
         if (this.#options.insula && this.#insula && !this.#releaseInsulaWatch)
             this.#releaseInsulaWatch = this.#insula.source.watch({
                 provider: this.#options.insula.provider,
@@ -364,7 +352,7 @@ export class ClaustrumConsumer {
             return undefined;
         try {
             await readClaustrumEnrollmentToken(this.#options.tokenPath);
-            const roster = await readVaultRoster(this.#options.rosterPath);
+            const roster = pendingVaultQuota(this.#options.rosterPath, await readVaultRoster(this.#options.rosterPath));
             const row = roster?.rows.find((entry) => entry.routeId === routeId);
             return this.#normalizeInsulaQuota(row?.accountIdentity);
         }
@@ -372,6 +360,44 @@ export class ClaustrumConsumer {
             return undefined;
         }
     }
+    /** Cache-only background lookup, preserving the reason a route has no reading. */
+    async lookupInsulaQuotaForRoute(routeId) {
+        const options = this.#options.insula;
+        if (!options || this.#shutdown.signal.aborted || !(await this.#active()))
+            return { miss: 'unreachable' };
+        try {
+            await readClaustrumEnrollmentToken(this.#options.tokenPath);
+            const roster = pendingVaultQuota(this.#options.rosterPath, await readVaultRoster(this.#options.rosterPath));
+            const account = roster?.rows.find((row) => row.routeId === routeId)?.accountIdentity;
+            if (!account || !this.#insula)
+                return { miss: 'unreachable' };
+            const result = this.#insula.source.lookup(options.provider, account, (this.#options.now ?? Date.now)());
+            const reading = result.reading &&
+                options.normalize(result.reading.entry, result.reading.context);
+            if (result.miss)
+                return { miss: result.miss, ...(reading !== undefined && { reading }) };
+            // Refusing an echo or unsupported window leaves the plugin's poll in charge.
+            return reading === undefined ? { miss: 'unreachable' } : { reading };
+        }
+        catch {
+            return { miss: 'unreachable' };
+        }
+    }
+    /** Skip the fallback poll while insula is cold or its upstream fetch failed. */
+    async pollInsulaQuotaForRoute(routeId, fallback) {
+        const result = await this.lookupInsulaQuotaForRoute(routeId);
+        if (result.miss === 'cold' || result.miss === 'upstream-failed') {
+            if (this.#insulaSkips.get(routeId) !== result.miss) {
+                this.#insulaSkips.set(routeId, result.miss);
+                this.#logger.warn('skipped insula provider poll', {
+                    reason: result.miss,
+                });
+            }
+            return undefined;
+        }
+        this.#insulaSkips.delete(routeId);
+        return result.miss ? fallback() : result.reading;
+    }
     #normalizeInsulaQuota(accountIdentity) {
         if (!this.#options.insula || !accountIdentity)
             return undefined;
@@ -396,7 +422,7 @@ export class ClaustrumConsumer {
             this.#insula = undefined;
             throw new ClaustrumConsumerError('not-active', 'Claustrum scoped custody is not active');
         }
-        const current = await readVaultRoster(this.#options.rosterPath);
+        const current = pendingVaultQuota(this.#options.rosterPath, await readVaultRoster(this.#options.rosterPath));
         this.#assertOpen(signal);
         const observed = roster.rows.find((row) => row.routeId === routeId);
         const configured = current?.rows.find((row) => row.routeId === routeId);
@@ -459,8 +485,12 @@ export class ClaustrumConsumer {
             let current;
             try {
                 current = await this.authorize(routeId, signal);
+                // Cancellation can land after authorize settles, before this continuation.
+                signal?.throwIfAborted();
             }
-            catch {
+            catch (error) {
+                if (signal?.aborted)
+                    throw error;
                 // Re-authorization failed: keep this 401 and report it against the
                 // receipt (served record version) this request was sent with.
             }
@@ -488,13 +518,24 @@ export class ClaustrumConsumer {
     async decline(routeId) {
         this.#assertOpen();
         await declineVaultRoute(this.#options.rosterPath, routeId);
-        this.#roster = await readVaultRoster(this.#options.rosterPath);
+        this.#roster = pendingVaultQuota(this.#options.rosterPath, await readVaultRoster(this.#options.rosterPath));
         this.#custody?.retain(this.#roster?.rows ?? []);
     }
     async accept(routeId) {
         this.#assertOpen();
         await acceptVaultRoute(this.#options.rosterPath, routeId);
-        this.#roster = await readVaultRoster(this.#options.rosterPath);
+        this.#roster = pendingVaultQuota(this.#options.rosterPath, await readVaultRoster(this.#options.rosterPath));
+    }
+    /**
+     * Set the order vault accounts are tried in (`reorderVaultRoster`), then
+     * re-read the roster, so the next routing decision in this process uses
+     * the new order without waiting for a discovery. Never contacts the vault.
+     */
+    async reorder(routeIds) {
+        this.#assertOpen();
+        const result = await reorderVaultRoster(this.#options.rosterPath, routeIds);
+        this.#roster = pendingVaultQuota(this.#options.rosterPath, await readVaultRoster(this.#options.rosterPath));
+        return result;
     }
     /**
      * Store a quota or profile observation for a vault route. The receipt the
@@ -504,7 +545,7 @@ export class ClaustrumConsumer {
      */
     async recordQuota(routeId, observation, attempt) {
         this.#assertOpen();
-        const kept = await recordVaultQuota(this.#options.rosterPath, {
+        return recordVaultQuota(this.#options.rosterPath, {
             routeId,
             observation,
             credentialId: attempt.credentialId,
@@ -516,27 +557,21 @@ export class ClaustrumConsumer {
                 expectedAccountIdentity: attempt.expectedAccountIdentity,
             }),
         });
-        if (kept)
-            this.#roster = await readVaultRoster(this.#options.rosterPath);
-        return kept;
     }
     /**
      * Store a background observation that belongs to an account rather than to
      * a served credential (an insula reading from `cachedInsulaQuotaForRoute`).
      * It lands only while the route is still bound to that known account, so no
      * credential fetch is needed and a replaced account's reading is dropped.
-     * The in-memory roster is reloaded from the file, without a vault call.
+     * Memory updates immediately; durable publication is detached and coalesced.
      */
     async recordAccountQuota(routeId, accountIdentity, observation) {
         this.#assertOpen();
-        const kept = await recordVaultAccountQuota(this.#options.rosterPath, {
+        return recordVaultAccountQuota(this.#options.rosterPath, {
             routeId,
             accountIdentity,
             observation,
         });
-        if (kept)
-            this.#roster = await readVaultRoster(this.#options.rosterPath);
-        return kept;
     }
     close() {
         if (this.#shutdown.signal.aborted)
@@ -551,5 +586,12 @@ export class ClaustrumConsumer {
         this.#insula = undefined;
         this.#roster = undefined;
         this.#grantReach = undefined;
+        void this.#releaseQuotaWriter();
+        forgetPendingVaultDiscovery(this.#options.rosterPath);
+    }
+    /** Close immediately; the last consumer also waits for the writer's bounded drain. */
+    async dispose() {
+        this.close();
+        await this.#releaseQuotaWriter();
     }
 }

package/src/tui-compiled/raw/shared/2577ec69f9973ae9-quota-normalize.js

@@ -56,8 +56,33 @@ export function normalizeQuotaHeaders(h) {
   const secondary = windowFromHeader(h, "x-codex-secondary-used-percent");
   if (secondary)
     snapshot.secondary = secondary;
+  const credits = creditsFromHeaders(h);
+  if (credits)
+    snapshot.credits = credits;
   return snapshot;
 }
+function headerBool(h, name) {
+  const raw = h.get(name)?.trim();
+  if (raw === void 0)
+    return;
+  if (raw.toLowerCase() === "true" || raw === "1")
+    return !0;
+  if (raw.toLowerCase() === "false" || raw === "0")
+    return !1;
+  return;
+}
+function creditsFromHeaders(h) {
+  const hasCredits = headerBool(h, "x-codex-credits-has-credits"), unlimited = headerBool(h, "x-codex-credits-unlimited");
+  if (hasCredits === void 0 || unlimited === void 0)
+    return;
+  const balance = nonNegativeNumberish(h.get("x-codex-credits-balance")?.trim());
+  return {
+    hasCredits,
+    unlimited,
+    ...balance !== void 0 ? { balance } : {},
+    checkedAt: Date.now()
+  };
+}
 export function isCompleteQuotaHeaderFrame(h) {
   const states = QUOTA_USED_PERCENT_HEADERS.map((name) => usedPercentHeaderState(h, name));
   return states.includes("valid") && !states.includes("invalid");
@@ -85,8 +110,26 @@ export function normalizeWsFrame(event) {
   const secondary = windowFromWs(event.rate_limits?.secondary);
   if (secondary)
     snapshot.secondary = secondary;
+  const credits = creditsFromWs(event.credits);
+  if (credits)
+    snapshot.credits = credits;
   return snapshot;
 }
+function creditsFromWs(value) {
+  if (value === null || typeof value !== "object")
+    return;
+  const credits = value;
+  if (typeof credits.has_credits !== "boolean" || typeof credits.unlimited !== "boolean")
+    return;
+  const balance = nonNegativeNumberish(typeof credits.balance === "string" ? credits.balance.trim() : credits.balance);
+  return {
+    hasCredits: credits.has_credits,
+    unlimited: credits.unlimited,
+    ...balance !== void 0 ? { balance } : {},
+    ...typeof credits.overage_limit_reached === "boolean" ? { overageLimitReached: credits.overage_limit_reached } : {},
+    checkedAt: Date.now()
+  };
+}
 function nonNegativeNumberish(value) {
   if (value == null || value === "")
     return;
@@ -147,7 +190,8 @@ export function normalizeWham(json) {
       hasCredits: credits.has_credits,
       unlimited: credits.unlimited,
       overageLimitReached: credits.overage_limit_reached,
-      ...balance !== void 0 ? { balance } : {}
+      ...balance !== void 0 ? { balance } : {},
+      checkedAt: Date.now()
     };
   }
   return snapshot;

package/src/tui-compiled/raw/shared/30f5bc480f31f51c-roster.js

@@ -1,9 +1,12 @@
 import { createHash } from "node:crypto";
-import { acquireRefreshFileLock, withLock, writeJsonAtomic, } from "./ec971142548df90e-index.js";
+import { resolve } from "node:path";
+import { acquireRefreshFileLock, LockContentionError, withLock, writeJsonAtomic, } from "./ec971142548df90e-index.js";
 import { readPrivateText, windowsPrivateFiles } from "./375d9cca2def037d-private-files.js";
-import { decodeQuotaMap, mergeQuotaObservation, } from "./d5a8f1061ee2f114-index.js";
+import { decodeQuotaMap, isQuotaObservation, mergeQuotaObservation, } from "./d5a8f1061ee2f114-index.js";
 import { ClaustrumConsumerError } from "./ca0fccaba1d87af4-errors.js";
 import { acceptAccount, declineAccount, isDeclined, } from "./7c140680fc81be92-interlock.js";
+import { enqueueVaultQuota, pendingVaultQuota, } from "./81dddd203f1b92a3-quota-writer.js";
+export { drainVaultQuota } from "./81dddd203f1b92a3-quota-writer.js";
 export const DEFAULT_ROUTE_PREFIX = 'vault:';
 function hash(value) {
     return createHash('sha256').update(value).digest('hex');
@@ -313,6 +316,7 @@ const WRITE_LOCK = {
     name: 'claustrum-roster-write',
     ttlMs: 10_000,
     timeoutMs: 5_000,
+    renew: true,
 };
 const DISCOVERY_LEASE = { name: 'claustrum-roster', ttlMs: 30_000 };
 /**
@@ -321,7 +325,7 @@ const DISCOVERY_LEASE = { name: 'claustrum-roster', ttlMs: 30_000 };
  * before any rename performed inside `change`; if it throws, do not rename.
  */
 export async function mutateVaultRoster(path, change, options = {}) {
-    return withLock(path, WRITE_LOCK, async (lock) => {
+    return withLock(path, { ...WRITE_LOCK, signal: options.signal }, async (lock) => {
         const current = await readVaultRoster(path);
         const { next, result } = await change(current, {
             assertOwned: () => lock.assertOwned(),
@@ -333,6 +337,7 @@ export async function mutateVaultRoster(path, change, options = {}) {
             await writeJsonAtomic(path, next, {
                 beforeRename: async () => {
                     await options.beforePublish?.();
+                    options.signal?.throwIfAborted();
                     await lock.assertOwned();
                 },
             });
@@ -373,6 +378,78 @@ export function acceptVaultRoute(path, routeId) {
         };
     });
 }
+function invalidOrder(message) {
+    return new ClaustrumConsumerError('invalid-order', message);
+}
+/**
+ * Why `routeIds` is not an order of these rows: it must name every distinct
+ * route id exactly once and nothing else. The message quotes only ids the
+ * caller supplied; route ids it left out are counted, not named.
+ */
+function vaultOrderProblem(rows, routeIds) {
+    if (!Array.isArray(routeIds))
+        return 'route ids must be an array of route ids';
+    const rosterIds = new Set(rows.map((row) => row.routeId));
+    const given = new Set();
+    for (const id of routeIds) {
+        if (typeof id !== 'string')
+            return 'route ids must be an array of route ids';
+        if (given.has(id))
+            return `route id ${id} appears more than once`;
+        if (!rosterIds.has(id))
+            return `route id ${id} is not in the roster`;
+        given.add(id);
+    }
+    const missing = [...rosterIds].filter((id) => !given.has(id)).length;
+    if (missing > 0)
+        return `the order leaves out ${missing} roster route id${missing === 1 ? '' : 's'}`;
+    return undefined;
+}
+/**
+ * Set the order vault accounts are tried in. Routing reads that order from
+ * the roster's row order (`vaultRoutingRows`), and a later discovery keeps
+ * each account at its position, so the order lasts until the next reorder.
+ * The order is this host's routing preference: the vault has no order of its
+ * own, and this never contacts it.
+ *
+ * `routeIds` must name every roster route id exactly once; anything else
+ * (an unknown, missing or repeated id) refuses with `invalid-order` and
+ * writes nothing. It runs under the roster's write lock, like every other
+ * roster write, so a quota reading or decline committed meanwhile is kept.
+ * Each row is kept as the same object, so only the positions change: every
+ * row's fields and the rest of the file stay as they were. An order equal to
+ * the current one writes nothing. A host with no roster file yet has no
+ * routes, so only the empty order is accepted.
+ *
+ * A `ClaustrumConsumer` in the same process does not see the new order until
+ * it re-reads the file: call `consumer.reorder` instead to update both.
+ */
+export function reorderVaultRoster(path, routeIds, options = {}) {
+    return mutateVaultRoster(path, (current) => {
+        const rows = current?.rows ?? [];
+        const problem = vaultOrderProblem(rows, routeIds);
+        if (problem)
+            throw invalidOrder(problem);
+        // Group by route id so a hand-edited file that repeats one keeps every
+        // copy: the later copies travel right after the first.
+        const byId = new Map();
+        for (const row of rows) {
+            const group = byId.get(row.routeId);
+            if (group)
+                group.push(row);
+            else
+                byId.set(row.routeId, [row]);
+        }
+        const ids = [...routeIds];
+        const next = ids.flatMap((id) => byId.get(id) ?? []);
+        if (!current || next.every((row, index) => row === rows[index]))
+            return { result: { ids, outcome: 'unchanged' } };
+        return {
+            next: { ...current, rows: next },
+            result: { ids, outcome: 'reordered' },
+        };
+    }, { ...(options.signal && { signal: options.signal }) });
+}
 /**
  * What a receipt may do to a row's quota: `hold` (the row holds the receipt's
  * credential and account), `bind` (the row has never had a known account and
@@ -415,55 +492,73 @@ function receiptFence(row, receipt) {
  * write is fenced on the receipt the reading was taken with: it lands only
  * while the row still holds that receipt's credential (as representative or
  * alias) and account, so a slow read for a replaced account can never land on
- * its successor. Returns whether the observation was kept.
+ * its successor. Resolves false when the fence refuses the reading against the
+ * roster as it stands now (on disk, plus readings this process has not
+ * written yet), and true once the reading is queued for the next write. The
+ * write applies the fence again, so a rebind between the two still refuses.
  */
-export function recordVaultQuota(path, input) {
-    return mutateVaultRoster(path, (current) => {
-        const row = current?.rows.find((entry) => entry.routeId === input.routeId);
-        const fence = !current || !row ? 'refuse' : receiptFence(row, input);
-        if (!current || !row || fence === 'refuse')
-            return { result: false };
-        const quota = mergeQuotaObservation(row.quota, input.observation);
-        // A bound account is `unclaimed`: the vault's list has not named it, and
-        // the next projection keeps it as the account this credential last
-        // logged into until the vault names one.
-        const bound = fence === 'bind'
-            ? { accountIdentity: input.accountIdentity, unclaimed: true }
-            : {};
-        return {
-            next: {
-                ...current,
-                rows: current.rows.map((entry) => entry === row ? { ...entry, ...bound, quota } : entry),
-            },
-            result: true,
-        };
+export async function recordVaultQuota(path, input) {
+    const { routeId, observation, ...receipt } = input;
+    return enqueueFencedVaultQuota(path, {
+        routeId,
+        observation,
+        accountIdentity: receipt.accountIdentity,
+        receipt,
     });
 }
+// The answer callers rely on (false for a replaced account) comes from the
+// fence, so it runs here against the current roster before anything is
+// queued. The read takes no lock: the roster file is replaced atomically.
+async function enqueueFencedVaultQuota(path, publication) {
+    if (!isQuotaObservation(publication.observation))
+        return false;
+    const current = pendingVaultQuota(path, await readVaultRoster(path));
+    if (!applyVaultQuota(current, publication).kept)
+        return false;
+    return enqueueVaultQuota(path, publication);
+}
 /**
  * Merge a quota observation that belongs to an account rather than to a
  * served credential, such as a background reading from insula. The write
  * lands only while the row is still bound to that exact known account, so a
  * reading taken before a replacement never reaches the successor. Unlike
  * `recordVaultQuota` it never binds an account: a row without a known account
- * is refused. Returns whether the observation was kept.
+ * is refused. Resolves false when the row is not bound to that account now,
+ * and true once the reading is queued, as `recordVaultQuota` does.
  */
 export function recordVaultAccountQuota(path, input) {
-    return mutateVaultRoster(path, (current) => {
-        const row = current?.rows.find((entry) => entry.routeId === input.routeId);
-        if (!current ||
-            !row ||
-            row.accountIdentity === undefined ||
-            row.accountIdentity !== input.accountIdentity)
-            return { result: false };
-        const quota = mergeQuotaObservation(row.quota, input.observation);
-        return {
-            next: {
-                ...current,
-                rows: current.rows.map((entry) => entry === row ? { ...entry, quota } : entry),
-            },
-            result: true,
-        };
-    });
+    return enqueueFencedVaultQuota(path, input);
+}
+/** Apply the same identity fence to memory overlays and durable quota batches. */
+export function applyVaultQuota(current, input) {
+    const row = current?.rows.find((entry) => entry.routeId === input.routeId);
+    const fence = !row
+        ? 'refuse'
+        : input.receipt
+            ? receiptFence(row, input.receipt)
+            : row.accountIdentity !== undefined &&
+                row.accountIdentity === input.accountIdentity
+                ? 'hold'
+                : 'refuse';
+    if (!current || !row || fence === 'refuse')
+        return { roster: current, kept: false };
+    const quota = mergeQuotaObservation(row.quota, input.observation);
+    // Binding remembers which account this credential proved, without claiming
+    // that the vault's discovery has named that account yet.
+    const bound = fence === 'bind'
+        ? { accountIdentity: input.accountIdentity, unclaimed: true }
+        : {};
+    return {
+        roster: {
+            ...current,
+            rows: current.rows.map((entry) => entry === row ? { ...entry, ...bound, quota } : entry),
+        },
+        kept: true,
+    };
+}
+const pendingDiscoveries = new Map();
+export function forgetPendingVaultDiscovery(path) {
+    pendingDiscoveries.delete(resolve(path));
 }
 /**
  * Discover and commit the roster. The lease covers the list call and the
@@ -471,12 +566,16 @@ export function recordVaultAccountQuota(path, input) {
  * from a newer one, so a run that lost its lease is refused at commit. A
  * failed list, or custody switching off mid-run, never writes anything; a
  * peer holding the lease means its last committed roster is served instead.
+ * A write-lock timeout keeps the discovered inventory for the next poll,
+ * unless a peer has superseded its base view in the meantime.
  */
 export async function refreshVaultRoster(options) {
     options.signal?.throwIfAborted();
     const active = async () => (await options.isActive?.()) ?? true;
-    if (!(await active()))
+    if (!(await active())) {
+        forgetPendingVaultDiscovery(options.path);
         return undefined;
+    }
     const lease = await acquireRefreshFileLock({
         ...DISCOVERY_LEASE,
         path: options.path,
@@ -489,8 +588,25 @@ export async function refreshVaultRoster(options) {
             throw new ClaustrumConsumerError('roster-busy', 'Claustrum account discovery is already in progress');
         return persisted;
     }
+    const key = resolve(options.path);
+    let discovered;
     try {
-        const inventory = await options.custody.discover(options.signal);
+        const previous = await readVaultRoster(options.path);
+        const pending = pendingDiscoveries.get(key);
+        // Opaque view cursors cannot be ordered. Reuse a discovery only while no
+        // peer has committed a different view since it was read.
+        discovered =
+            pending &&
+                (pending.previousView === previous?.view ||
+                    pending.inventory.view === previous?.view)
+                ? pending
+                : {
+                    inventory: await options.custody.discover(options.signal),
+                    previousView: previous?.view,
+                };
+        pendingDiscoveries.delete(key);
+        const { inventory } = discovered;
+        options.onInventory?.(inventory);
         options.signal?.throwIfAborted();
         return await mutateVaultRoster(options.path, async (current) => {
             if (!(await active()))
@@ -503,8 +619,21 @@ export async function refreshVaultRoster(options) {
             const next = projectVaultRoster(current, inventory, projection);
             const changed = JSON.stringify(current) !== JSON.stringify(next);
             return { ...(changed && { next }), result: next };
+        }, {
+            beforePublish: async () => {
+                options.signal?.throwIfAborted();
+                await lease.assertOwned();
+            },
         });
     }
+    catch (error) {
+        if (error instanceof LockContentionError &&
+            discovered &&
+            !options.signal?.aborted &&
+            (await active()))
+            pendingDiscoveries.set(key, discovered);
+        throw error;
+    }
     finally {
         await lease.release();
     }