@crouton-kit/crouter 0.3.78 → 0.3.80

package/dist/builtin-pi-packages/pi-crtr-extensions/extensions/__tests__/provider-rotation.test.ts

@@ -1,3 +1,1084 @@
+import { before, after, test } from "node:test";
+import assert from "node:assert/strict";
+import { spawn } from "node:child_process";
+import { chmodSync, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { FileAuthStorageBackend } from "@earendil-works/pi-coding-agent";
+import { dirname, join } from "node:path";
+import { tmpdir } from "node:os";
+
+let home: string;
+let helpers: typeof import("../../lib/subscription-state.ts");
+let providerManagement: typeof import("../../../../core/provider-management.ts");
+let rotationModule: typeof import("../provider-rotation.ts");
+let providerRotationExtension: typeof import("../provider-rotation.ts").default;
+const previousHome = process.env.HOME;
+
+function writeLadderConfig() {
+  const configPath = join(home, ".crouter", "config.json");
+  mkdirSync(dirname(configPath), { recursive: true });
+  writeFileSync(
+    configPath,
+    `${JSON.stringify(
+      {
+        modelLadders: {
+          anthropic: {
+            ultra: "anthropic/claude-fable-5:high",
+            strong: "anthropic/claude-opus-4-8:high",
+            medium: "anthropic/claude-sonnet-4-6:high",
+            light: "anthropic/custom-light-x",
+          },
+          openai: {
+            ultra: "openai-codex/gpt-5.6-sol:max",
+            strong: "openai-codex/gpt-5.6-sol:high",
+            medium: "openai-codex/gpt-5.6-terra:medium",
+            light: "openai-codex/gpt-5.6-luna:low",
+          },
+        },
+      },
+      null,
+      2,
+    )}\n`,
+    "utf8",
+  );
+}
+
+function credential(label: string, overrides: Partial<helpers.SubscriptionCredential> = {}): helpers.SubscriptionCredential {
+  return {
+    label,
+    refresh: `refresh-${label}`,
+    access: `access-${label}`,
+    expires: Date.now() + 60_000,
+    rateLimitedUntil: 0,
+    lastAttemptAt: 0,
+    lastRateLimitedAt: 0,
+    ...overrides,
+  };
+}
+
+function resetRotationState() {
+  rmSync(join(home, ".pi", "agent", "auth.json"), { force: true });
+  helpers.writeSubscriptionPool("anthropic", []);
+  helpers.writeSubscriptionPool("openai-codex", []);
+  helpers.clearPreferredModel();
+}
+
+function makeAuthFileReadOnly(authPath: string): void {
+  chmodSync(authPath, 0o444);
+}
+
+function makeAuthFileWritable(authPath: string): void {
+  chmodSync(authPath, 0o600);
+}
+
+function observeLines(stream: NodeJS.ReadableStream, onLine: (line: string) => void): void {
+  let buffer = "";
+  stream.setEncoding("utf8");
+  stream.on("data", (chunk: string) => {
+    buffer += chunk;
+    let newlineIndex = buffer.indexOf("\n");
+    while (newlineIndex !== -1) {
+      const line = buffer.slice(0, newlineIndex);
+      buffer = buffer.slice(newlineIndex + 1);
+      onLine(line);
+      newlineIndex = buffer.indexOf("\n");
+    }
+  });
+}
+
+function within<T>(promise: Promise<T>, ms: number, message: string): Promise<T> {
+  return new Promise<T>((resolve, reject) => {
+    const timer = setTimeout(() => reject(new Error(message)), ms);
+    promise.then(
+      (value) => {
+        clearTimeout(timer);
+        resolve(value);
+      },
+      (error: unknown) => {
+        clearTimeout(timer);
+        reject(error);
+      },
+    );
+  });
+}
+
+before(async () => {
+  home = mkdtempSync(join(tmpdir(), "pi-provider-rotation-"));
+  process.env.HOME = home;
+  helpers = await import("../../lib/subscription-state.ts");
+  providerManagement = await import("../../../../core/provider-management.ts");
+  rotationModule = await import("../provider-rotation.ts");
+  providerRotationExtension = rotationModule.default;
+});
+
+after(() => {
+  if (previousHome === undefined) delete process.env.HOME;
+  else process.env.HOME = previousHome;
+  rmSync(home, { recursive: true, force: true });
+});
+
+test("normalizes provider subscription pool files", () => {
+  resetRotationState();
+  helpers.writeSubscriptionPool("anthropic", [
+    {
+      label: " personal ",
+      refresh: " refresh-token ",
+      access: " access-token ",
+      expires: 123,
+      rateLimitedUntil: Number.NaN,
+      lastAttemptAt: Number.NaN,
+      lastRateLimitedAt: Number.NaN,
+    },
+  ]);
+
+  assert.deepEqual(helpers.readSubscriptionPool("anthropic"), [
+    {
+      label: "personal",
+      refresh: "refresh-token",
+      access: "access-token",
+      expires: 123,
+      rateLimitedUntil: 0,
+      lastAttemptAt: 0,
+      lastRateLimitedAt: 0,
+    },
+  ]);
+});
+
+// The default label's pool entry is metadata-only -- seeding it from auth.json must never
+// copy a token into the pool, only bootstrap the zeroed cooldown bookkeeping that has
+// nowhere else to live. Assert via the literal key set (not just "the value fields are
+// undefined") so a regression that starts writing `refresh: undefined` etc. -- which would
+// still satisfy an `undefined`-only check -- is caught.
+test("fresh-node seeding of the default slot is metadata-only (no value keys present at all)", () => {
+  resetRotationState();
+  const authPath = join(home, ".pi", "agent", "auth.json");
+  mkdirSync(dirname(authPath), { recursive: true });
+  writeFileSync(
+    authPath,
+    `${JSON.stringify({
+      "openai-codex": {
+        type: "oauth",
+        refresh: "refresh-codex-auth",
+        access: "access-codex-auth",
+        expires: 123456,
+      },
+    })}\n`,
+    "utf8",
+  );
+
+  const pool = helpers.readSubscriptionPool("openai-codex");
+  assert.equal(pool.length, 1);
+  assert.deepEqual(Object.keys(pool[0]).sort(), ["label", "lastAttemptAt", "lastRateLimitedAt", "rateLimitedUntil"]);
+  assert.deepEqual(pool[0], {
+    label: "openai-codex",
+    rateLimitedUntil: 0,
+    lastAttemptAt: 0,
+    lastRateLimitedAt: 0,
+  });
+});
+
+// There is exactly one place the default slot's value is ever stored -- auth.json -- so
+// there is no second copy in the pool to ever diverge from it. Prove this directly: seed
+// the pool from auth.json holding credential A, then overwrite auth.json with a DIFFERENT
+// credential B (simulating an external refresh/re-login the pool never sees), and read the
+// pool again. It must still be the SAME metadata-only entry, unchanged by B -- because
+// there was never a value in the pool to go stale in the first place.
+test("no divergence is possible: overwriting auth.json elsewhere never changes the metadata-only pool entry", () => {
+  resetRotationState();
+  const authPath = join(home, ".pi", "agent", "auth.json");
+  mkdirSync(dirname(authPath), { recursive: true });
+  writeFileSync(
+    authPath,
+    `${JSON.stringify({
+      anthropic: { type: "oauth", refresh: "refresh-A", access: "access-A", expires: 123456 },
+    })}\n`,
+    "utf8",
+  );
+
+  const first = helpers.readSubscriptionPool("anthropic");
+  assert.deepEqual(first, [{ label: "anthropic", rateLimitedUntil: 0, lastAttemptAt: 0, lastRateLimitedAt: 0 }]);
+
+  writeFileSync(
+    authPath,
+    `${JSON.stringify({
+      anthropic: { type: "oauth", refresh: "refresh-B", access: "access-B", expires: 999999 },
+    })}\n`,
+    "utf8",
+  );
+
+  const second = helpers.readSubscriptionPool("anthropic");
+  assert.deepEqual(second, first);
+  assert.deepEqual(Object.keys(second[0]).sort(), ["label", "lastAttemptAt", "lastRateLimitedAt", "rateLimitedUntil"]);
+});
+
+// The default label's pool entry is metadata-only on disk: reading it strips any stored
+// refresh, access, and expires fields and persists the cleaned pool immediately.
+test("scrubbing the default-slot value on read persists the metadata-only pool to disk", () => {
+  resetRotationState();
+  const poolFile = join(home, ".pi", "agent", "anthropic-subscriptions.json");
+  mkdirSync(dirname(poolFile), { recursive: true });
+  writeFileSync(
+    poolFile,
+    `${JSON.stringify([
+      { label: "anthropic", refresh: "stale-refresh", access: "stale-access", expires: 123, rateLimitedUntil: 0, lastAttemptAt: 0, lastRateLimitedAt: 0 },
+    ])}\n`,
+    "utf8",
+  );
+
+  const pool = helpers.readSubscriptionPool("anthropic");
+  assert.deepEqual(Object.keys(pool[0]).sort(), ["label", "lastAttemptAt", "lastRateLimitedAt", "rateLimitedUntil"]);
+
+  // The raw FILE on disk must ALSO be scrubbed -- not just the in-memory return value.
+  const raw = JSON.parse(readFileSync(poolFile, "utf8"));
+  assert.deepEqual(Object.keys(raw[0]).sort(), ["label", "lastAttemptAt", "lastRateLimitedAt", "rateLimitedUntil"]);
+});
+
+// The brick-repro (root cause of the original bug): two concurrent turns both see the
+// SAME expired default-slot credential and both try to refresh it. Without a real lock
+// serializing read -> decide -> refresh -> write, both call the (single-use) refresh token
+// and the loser gets a genuine invalid_grant from the provider -- bricking that turn. Prove
+// the fix: the injected refresh fn is called EXACTLY ONCE across two concurrent callers;
+// the second caller re-reads the winner's fresh value under the lock and skips its own
+// network call entirely; both callers resolve without throwing; auth.json ends up holding
+// exactly the one refreshed value; the pool entry stays metadata-only throughout.
+//
+// This test is proven to fail without the fix, not just asserted to pass with it -- see
+// the fail-then-pass evidence recorded in the implementation report.
+test("brick-repro: concurrent refreshes of the same expired default-slot token serialize through the lock (exactly one network refresh)", async () => {
+  resetRotationState();
+  const authPath = join(home, ".pi", "agent", "auth.json");
+  mkdirSync(dirname(authPath), { recursive: true });
+  writeFileSync(
+    authPath,
+    `${JSON.stringify({
+      anthropic: { type: "oauth", refresh: "shared-refresh", access: "access-stale", expires: 1 },
+    })}\n`,
+    "utf8",
+  );
+  const poolEntry = helpers.readSubscriptionPool("anthropic")[0];
+  assert.equal(poolEntry.label, "anthropic");
+
+  let refreshCalls = 0;
+  rotationModule.__setRefreshForProviderForTest(async (_providerId, refreshToken) => {
+    refreshCalls += 1;
+    if (refreshCalls === 1) {
+      return { refresh: "shared-refresh-rotated", access: "access-fresh", expires: Date.now() + 60_000 };
+    }
+    // Any refresh call after the first is simulating "this refresh token was already
+    // consumed by the winner" -- a genuine invalid_grant from the provider.
+    throw Object.assign(new Error(`HTTP request failed. status=400; body={"error":"invalid_grant"} for token ${refreshToken}`), { status: 400 });
+  });
+
+  try {
+    const [a, b] = await Promise.all([
+      rotationModule.__refreshCredentialIfNeededForTest("anthropic", poolEntry),
+      rotationModule.__refreshCredentialIfNeededForTest("anthropic", poolEntry),
+    ]);
+
+    assert.equal(refreshCalls, 1);
+    assert.equal(a.access, "access-fresh");
+    assert.equal(b.access, "access-fresh");
+
+    const stillMetadataOnly = helpers.readSubscriptionPool("anthropic")[0];
+    assert.deepEqual(Object.keys(stillMetadataOnly).sort(), ["label", "lastAttemptAt", "lastRateLimitedAt", "rateLimitedUntil"]);
+
+    const authRaw = JSON.parse(readFileSync(authPath, "utf8"));
+    assert.equal(authRaw.anthropic.access, "access-fresh");
+    assert.equal(authRaw.anthropic.refresh, "shared-refresh-rotated");
+  } finally {
+    rotationModule.__setRefreshForProviderForTest(undefined);
+  }
+});
+
+// A GENUINE invalid_grant (the refresh token is actually dead, not merely raced) must
+// still reach the real cooldown -> reauth path through the new lock-delegated seam --
+// the fix must not accidentally swallow or misclassify a real failure. Drives it through
+// the actual provider stream (not the raw helper) so `isInvalidRefreshTokenError` +
+// reauthentication + the AuthStorage persist all fire for real.
+test("a genuine invalid_grant through the default-slot lock still reauthenticates and persists to auth.json", async () => {
+  resetRotationState();
+  writeLadderConfig();
+  const authPath = join(home, ".pi", "agent", "auth.json");
+  mkdirSync(dirname(authPath), { recursive: true });
+  writeFileSync(
+    authPath,
+    `${JSON.stringify({
+      anthropic: { type: "oauth", refresh: "dead-refresh", access: "access-stale", expires: 1 },
+    })}\n`,
+    "utf8",
+  );
+  // Seed the metadata-only pool entry for the default label.
+  helpers.readSubscriptionPool("anthropic");
+
+  const { ctx, setModelCalls, providers, events, pi } = makeRotationCtx();
+  ctx.hasUI = true;
+  ctx.model = { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" };
+  ctx.ui.notify = () => {};
+  const loginCalls: string[] = [];
+  // Plain Error, no typed .status: real pi-ai refresh failures carry the HTTP status
+  // in the message text, so the refresh path still recognizes an invalid_grant from this
+  // shape.
+  rotationModule.__setRefreshForProviderForTest(async (providerId) => {
+    if (providerId === "anthropic") {
+      throw new Error('HTTP request failed. status=400; body={"error":"invalid_grant","error_description":"Refresh token not found or invalid"}');
+    }
+    throw new Error("unexpected refresh");
+  });
+  rotationModule.__setLoginForProviderForTest(async (providerId) => {
+    loginCalls.push(providerId);
+    return { refresh: "refresh-reauthed", access: "access-reauthed", expires: Date.now() + 60_000 };
+  });
+  rotationModule.__setStreamForProviderForTest((_model, _context, options) => {
+    return (async function* () {
+      yield { type: "text_delta", text: `hello with ${options?.apiKey}` };
+    })() as any;
+  });
+
+  try {
+    await providerRotationExtension(pi);
+    await events.session_start?.({}, ctx);
+    const stream = providers["anthropic"].streamSimple({ provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" }, ctx);
+    const emitted = [] as any[];
+    for await (const event of stream) emitted.push(event);
+
+    assert.deepEqual(loginCalls, ["anthropic"]);
+    assert.deepEqual(setModelCalls, []);
+    assert.ok(emitted.some((e) => e.type === "text_delta"));
+    assert.ok(!emitted.some((e) => e.type === "error"));
+
+    // Reauth persisted to auth.json (the single owner), not the pool.
+    const authRaw = JSON.parse(readFileSync(authPath, "utf8"));
+    assert.equal(authRaw.anthropic.refresh, "refresh-reauthed");
+    assert.equal(authRaw.anthropic.access, "access-reauthed");
+
+    // Pool stays metadata-only after reauth too, with the cooldown cleared.
+    const [entry] = helpers.readSubscriptionPool("anthropic");
+    assert.deepEqual(Object.keys(entry).sort(), ["label", "lastAttemptAt", "lastRateLimitedAt", "rateLimitedUntil"]);
+    assert.equal(entry.rateLimitedUntil, 0);
+  } finally {
+    rotationModule.__setRefreshForProviderForTest(undefined);
+    rotationModule.__setLoginForProviderForTest(undefined);
+    rotationModule.__setStreamForProviderForTest(undefined);
+  }
+});
+
+// A locked auth.json write failure must not let default-slot reauth look successful or
+// clear the pool's cooldown bookkeeping.
+test("a locked default-slot reauth write failure leaves the pool cooled down and surfaces an error", async () => {
+  resetRotationState();
+  writeLadderConfig();
+  const authPath = join(home, ".pi", "agent", "auth.json");
+  mkdirSync(dirname(authPath), { recursive: true });
+  writeFileSync(
+    authPath,
+    `${JSON.stringify({
+      anthropic: { type: "oauth", refresh: "dead-refresh", access: "access-stale", expires: 1 },
+    })}\n`,
+    "utf8",
+  );
+  // Seed the metadata-only default pool entry for the default label.
+  helpers.readSubscriptionPool("anthropic");
+
+  const { ctx, setModelCalls, providers, events, pi } = makeRotationCtx();
+  ctx.hasUI = true;
+  ctx.model = { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" };
+  ctx.ui.notify = () => {};
+  rotationModule.__setRefreshForProviderForTest(async (providerId) => {
+    if (providerId === "anthropic") {
+      throw new Error('HTTP request failed. status=400; body={"error":"invalid_grant","error_description":"Refresh token not found or invalid"}');
+    }
+    throw new Error("unexpected refresh");
+  });
+  rotationModule.__setLoginForProviderForTest(async () => ({ refresh: "refresh-reauthed", access: "access-reauthed", expires: Date.now() + 60_000 }));
+  rotationModule.__setStreamForProviderForTest((_model, _context, options) => {
+    return (async function* () {
+      yield { type: "text_delta", text: `hello with ${options?.apiKey}` };
+    })() as any;
+  });
+
+  try {
+    makeAuthFileReadOnly(authPath);
+    await providerRotationExtension(pi);
+    await events.session_start?.({}, ctx);
+    const stream = providers["anthropic"].streamSimple(
+      { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" },
+      ctx,
+    );
+    const emitted = [] as any[];
+    for await (const event of stream) emitted.push(event);
+
+    assert.deepEqual(setModelCalls, []);
+    assert.ok(emitted.some((e) => e.type === "error"));
+    assert.ok(!emitted.some((e) => e.type === "text_delta"));
+
+    const authRaw = JSON.parse(readFileSync(authPath, "utf8"));
+    assert.equal(authRaw.anthropic.refresh, "dead-refresh");
+
+    const [entry] = helpers.readSubscriptionPool("anthropic");
+    assert.equal(entry.label, "anthropic");
+    assert.ok(entry.rateLimitedUntil > Date.now() + 29 * 24 * 60 * 60 * 1000);
+  } finally {
+    makeAuthFileWritable(authPath);
+    rotationModule.__setRefreshForProviderForTest(undefined);
+    rotationModule.__setLoginForProviderForTest(undefined);
+    rotationModule.__setStreamForProviderForTest(undefined);
+  }
+});
+
+// A genuine invalid_grant through the default-slot lock seam cools the credential down
+// and falls back cross-provider when UI is unavailable: expired OAuth in auth.json, a
+// metadata-only default pool entry, an authenticated Codex fallback, and the real
+// streamSimple path all participate.
+test("a genuine invalid_grant through the default-slot lock with no UI reaches cooldown and falls back cross-provider", async () => {
+  resetRotationState();
+  writeLadderConfig();
+  const authPath = join(home, ".pi", "agent", "auth.json");
+  mkdirSync(dirname(authPath), { recursive: true });
+  writeFileSync(
+    authPath,
+    `${JSON.stringify({
+      anthropic: { type: "oauth", refresh: "dead-refresh", access: "access-stale", expires: 1 },
+    })}\n`,
+    "utf8",
+  );
+  // Seed the metadata-only default pool entry for anthropic -- the seam under test.
+  helpers.readSubscriptionPool("anthropic");
+  // Authenticated Codex fallback already sitting in its own pool.
+  helpers.writeSubscriptionPool("openai-codex", [credential("codex")]);
+
+  const { ctx, setModelCalls, providers, events, pi } = makeRotationCtx();
+  ctx.model = { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" };
+  // ctx.hasUI is deliberately left falsy: reauth must be impossible, so the only path
+  // forward is cooldown + cross-provider fallback.
+  const streamedModels: any[] = [];
+  rotationModule.__setRefreshForProviderForTest(async (providerId) => {
+    if (providerId === "anthropic") {
+      // Plain Error, no typed .status: the refresh path reads the invalid_grant shape from
+      // the message text, matching production failures.
+      throw new Error('HTTP request failed. status=400; body={"error":"invalid_grant","error_description":"Refresh token not found or invalid"}');
+    }
+    throw new Error("unexpected refresh");
+  });
+  rotationModule.__setStreamForProviderForTest((model) => {
+    streamedModels.push(model);
+    return (async function* () {
+      yield { type: "text_delta", text: "hello from codex fallback" };
+    })() as any;
+  });
+
+  try {
+    await providerRotationExtension(pi);
+    await events.session_start?.({}, ctx);
+    const stream = providers["anthropic"].streamSimple(
+      { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" },
+      ctx,
+    );
+    const emitted = [] as any[];
+    for await (const event of stream) emitted.push(event);
+
+    // Fell back cross-provider and actually served the turn on Codex.
+    assert.deepEqual(setModelCalls.map((m) => m.provider), ["openai-codex"]);
+    assert.equal(streamedModels.length, 1);
+    assert.equal(streamedModels[0].provider, "openai-codex");
+    assert.ok(emitted.some((e) => e.type === "text_delta"));
+    assert.ok(!emitted.some((e) => e.type === "error"));
+
+    // The default slot's metadata entry got the ~30-day invalid-refresh-token cooldown,
+    // through the real `withLockAsync` seam -- not a bypass.
+    const [entry] = helpers.readSubscriptionPool("anthropic");
+    assert.equal(entry.label, "anthropic");
+    assert.ok(entry.rateLimitedUntil > Date.now() + 29 * 24 * 60 * 60 * 1000);
+    assert.deepEqual(Object.keys(entry).sort(), ["label", "lastAttemptAt", "lastRateLimitedAt", "rateLimitedUntil"]);
+
+    // No UI -- no reauth happened; auth.json still holds the dead credential unchanged.
+    const authRaw = JSON.parse(readFileSync(authPath, "utf8"));
+    assert.equal(authRaw.anthropic.refresh, "dead-refresh");
+  } finally {
+    rotationModule.__setRefreshForProviderForTest(undefined);
+    rotationModule.__setStreamForProviderForTest(undefined);
+  }
+});
+
+test("/provider-sub add still adds an explicit additional subscription alongside the default slot", () => {
+  resetRotationState();
+  helpers.writeSubscriptionPool("anthropic", [credential("anthropic", { refresh: "refresh-first", access: "access-first" })]);
+
+  helpers.upsertSubscription("anthropic", credential("work", { refresh: "refresh-work", access: "access-work" }));
+
+  assert.deepEqual(helpers.readSubscriptionPool("anthropic").map((entry) => entry.label), ["anthropic", "work"]);
+});
+
+// /provider-sub <provider> add accepts the default label as the login-backed slot.
+// The pool stays metadata-only for that label, and the registered command handler writes
+// the credential to auth.json.
+
+test("/provider-sub add with the default label persists the login credential to auth.json instead of discarding it", async () => {
+  resetRotationState();
+  const authPath = join(home, ".pi", "agent", "auth.json");
+
+  const { ctx, commands, pi } = makeRotationCtx();
+  ctx.hasUI = true;
+  ctx.ui.notify = () => {};
+  ctx.ui.input = async (_message: string, placeholder: string) => placeholder; // accept the prompt's own default
+  rotationModule.__setLoginForProviderForTest(async () => ({ refresh: "refresh-default-login", access: "access-default-login", expires: Date.now() + 60_000 }));
+
+  try {
+    await providerRotationExtension(pi);
+    await commands["provider-sub"].handler("anthropic add", ctx);
+
+    // The credential must be persisted to auth.json (the single owner), NOT discarded.
+    const authRaw = JSON.parse(readFileSync(authPath, "utf8"));
+    assert.equal(authRaw.anthropic.refresh, "refresh-default-login");
+    assert.equal(authRaw.anthropic.access, "access-default-login");
+
+    // The pool gets a metadata-only default entry (no value written into it) with the
+    // cooldown cleared -- not a broken "authenticated but valueless" slot.
+    const [entry] = helpers.readSubscriptionPool("anthropic");
+    assert.equal(entry.label, "anthropic");
+    assert.deepEqual(Object.keys(entry).sort(), ["label", "lastAttemptAt", "lastRateLimitedAt", "rateLimitedUntil"]);
+    assert.equal(entry.rateLimitedUntil, 0);
+  } finally {
+    rotationModule.__setLoginForProviderForTest(undefined);
+  }
+});
+
+// The retained agent command must use the same coordinated removal as the Providers panel:
+// removing the default metadata slot also removes auth.json, so a later read cannot re-seed it.
+test("/provider-sub rm removes the default slot and its auth.json credential together", async () => {
+  resetRotationState();
+  const authPath = join(home, ".pi", "agent", "auth.json");
+  mkdirSync(dirname(authPath), { recursive: true });
+  writeFileSync(authPath, `${JSON.stringify({ anthropic: { type: "oauth", refresh: "refresh-default", access: "access-default", expires: Date.now() + 60_000 } })}\n`, "utf8");
+  assert.equal(helpers.readSubscriptionPool("anthropic")[0]?.label, "anthropic");
+
+  const { ctx, commands, pi } = makeRotationCtx();
+  ctx.ui.notify = () => {};
+  await providerRotationExtension(pi);
+  await commands["provider-sub"].handler("anthropic rm anthropic", ctx);
+
+  assert.equal(JSON.parse(readFileSync(authPath, "utf8")).anthropic, undefined);
+  assert.equal(helpers.readSubscriptionPool("anthropic").some((entry) => entry.label === "anthropic"), false);
+});
+
+// A locked auth.json write failure must not let the default-label add path clear the
+// pool cooldown bookkeeping or pretend the add succeeded.
+test("/provider-sub add with the default label keeps the pool cooldown when auth.json write fails", async () => {
+  resetRotationState();
+  const authPath = join(home, ".pi", "agent", "auth.json");
+  mkdirSync(dirname(authPath), { recursive: true });
+  writeFileSync(
+    authPath,
+    `${JSON.stringify({
+      anthropic: { type: "oauth", refresh: "refresh-existing", access: "access-existing", expires: Date.now() + 60_000 },
+    })}\n`,
+    "utf8",
+  );
+  helpers.readSubscriptionPool("anthropic");
+  helpers.markSubscriptionRateLimited("anthropic", "anthropic", 60_000, 100, 200);
+  const beforeCooldown = helpers.readSubscriptionPool("anthropic")[0].rateLimitedUntil;
+
+  const { ctx, commands, pi } = makeRotationCtx();
+  ctx.hasUI = true;
+  ctx.ui.notify = () => {};
+  ctx.ui.input = async (_message: string, placeholder: string) => placeholder;
+  rotationModule.__setLoginForProviderForTest(async () => ({ refresh: "refresh-default-login", access: "access-default-login", expires: Date.now() + 60_000 }));
+
+  try {
+    makeAuthFileReadOnly(authPath);
+    await providerRotationExtension(pi);
+    await commands["provider-sub"].handler("anthropic add", ctx);
+
+    const authRaw = JSON.parse(readFileSync(authPath, "utf8"));
+    assert.equal(authRaw.anthropic.refresh, "refresh-existing");
+    const [entry] = helpers.readSubscriptionPool("anthropic");
+    assert.equal(entry.label, "anthropic");
+    assert.equal(entry.rateLimitedUntil, beforeCooldown);
+  } finally {
+    makeAuthFileWritable(authPath);
+    rotationModule.__setLoginForProviderForTest(undefined);
+  }
+});
+
+// loginWithManualInputCleanup (reviews mrf5doek + mrf68z4h): the manual-code-paste
+// dialog races pi-ai's loopback callback server. These exercise the wrapper directly
+// (not through __setLoginForProviderForTest, which bypasses it entirely) against a
+// fake `run` that mimics pi-ai's own "call onManualCodeInput, maybe never await it"
+// behavior. Dismissal is now correlated at the BROKER (aborting the dialog's signal
+// drops its pending entry AND emits an extension_ui_dismiss frame keyed to the
+// request id), not a broad notify -- so these assert on the SIGNAL, not a notify.
+
+test("loginWithManualInputCleanup aborts the still-open manual dialog's signal once the OAuth call settles without it (loopback-wins parity)", async () => {
+  let capturedSignal: AbortSignal | undefined;
+  const notifications: Array<{ message: string; type?: string }> = [];
+  const ctx = {
+    ui: {
+      notify: (message: string, type?: string) => notifications.push({ message, type }),
+      input: (_title: string, _placeholder: string, opts?: { signal?: AbortSignal }) => {
+        capturedSignal = opts?.signal;
+        // Never resolves on its own -- mirrors pi-ai abandoning the manual-input
+        // promise once the loopback callback server wins the race.
+        return new Promise<string | undefined>(() => {});
+      },
+    },
+  } as any;
+
+  const result = await rotationModule.loginWithManualInputCleanup(ctx, async (readCode: any) => {
+    // Start the manual-code prompt (as onManualCodeInput would) but -- like the real
+    // pi-ai race -- never await its outcome; the loopback callback "wins" instead.
+    void readCode("Open this URL...", "placeholder").catch(() => {});
+    return "loopback-code";
+  });
+
+  assert.equal(result, "loopback-code");
+  assert.equal(capturedSignal?.aborted, true, "the abandoned manual-input dialog's signal must be aborted once the OAuth call settles -- the broker turns that abort into a correlated extension_ui_dismiss");
+  assert.equal(notifications.length, 0, "no broad dismiss notify -- an unrelated notify must never be used as a dialog-dismissal signal");
+});
+
+test("loginWithManualInputCleanup dismisses the manual dialog at callback-win (onProgress), NOT after a delayed token exchange", async () => {
+  // Reproduces review mrf68z4h's OpenAI/pi-ai-shaped concern: pi-ai gets the code
+  // from the loopback callback, reports progress ("exchanging..."), then awaits a
+  // token exchange that has no timeout. The manual dialog must be aborted at the
+  // callback-win boundary (dismissManual, wired to onProgress), before the exchange
+  // resolves `run` -- otherwise a slow/hung exchange leaves the overlay up.
+  let order = 0;
+  let abortedAt: number | undefined;
+  let runResolvedAt: number | undefined;
+  const ctx = {
+    ui: {
+      notify: () => {},
+      input: (_title: string, _placeholder: string, opts?: { signal?: AbortSignal }) =>
+        // Mirror the broker: resolve to undefined on abort (which readCode turns
+        // into a throw, inert on the abandoned promise like pi-ai's own .catch).
+        new Promise<string | undefined>((resolve) => {
+          opts?.signal?.addEventListener("abort", () => { abortedAt = order++; resolve(undefined); }, { once: true });
+        }),
+    },
+  } as any;
+
+  const result = await rotationModule.loginWithManualInputCleanup(ctx, async (readCode: any, dismissManual: () => void) => {
+    void readCode("Open this URL...", "placeholder").catch(() => {});
+    dismissManual(); // pi-ai's onProgress fires here -- it already has the code
+    await new Promise((r) => setTimeout(r, 25)); // the (possibly slow) token exchange
+    runResolvedAt = order++;
+    return "exchanged-token";
+  });
+
+  assert.equal(result, "exchanged-token");
+  assert.notEqual(abortedAt, undefined, "the manual dialog's signal must have been aborted");
+  assert.notEqual(runResolvedAt, undefined);
+  assert.ok(abortedAt! < runResolvedAt!, "the manual dialog must be dismissed at callback-win (onProgress), BEFORE the delayed token exchange completes");
+});
+
+test("loginWithManualInputCleanup's readCode rejects (rather than resolving to \"\") when the manual dialog is cancelled or times out", async () => {
+  const ctx = {
+    ui: {
+      notify: () => {},
+      // ctx.ui.input resolving to undefined is exactly what a Cancel button or the
+      // dialog's own timeout produces (dialogPromise's cancelled/timeout default).
+      input: async () => undefined,
+    },
+  } as any;
+
+  // pi-ai only calls its onPrompt paste-only fallback when onManualCodeInput
+  // RESOLVES (even to a falsy value) -- never when it rejects. Asserting
+  // loginWithManualInputCleanup itself rejects (instead of resolving to "", the
+  // pre-fix behavior) proves readCode ends the OAuth attempt directly and pi-ai
+  // never gets the chance to fall through to that second, URL-less dialog.
+  await assert.rejects(
+    () => rotationModule.loginWithManualInputCleanup(ctx, (readCode) => readCode("Open this URL...", "placeholder")),
+    /OAuth login cancelled/,
+  );
+});
+
+// The default metadata slot is seeded whenever auth.json holds an OAuth credential for
+// the provider, even when the pool already contains explicit non-default accounts.
+test("seeds the default metadata slot even when the pool already has an explicit non-default account", () => {
+  resetRotationState();
+  helpers.writeSubscriptionPool("anthropic", [credential("work", { refresh: "refresh-work", access: "access-work" })]);
+
+  const authPath = join(home, ".pi", "agent", "auth.json");
+  mkdirSync(dirname(authPath), { recursive: true });
+  writeFileSync(
+    authPath,
+    `${JSON.stringify({
+      anthropic: { type: "oauth", refresh: "refresh-native-login", access: "access-native-login", expires: Date.now() + 60_000 },
+    })}\n`,
+    "utf8",
+  );
+
+  const pool = helpers.readSubscriptionPool("anthropic");
+  assert.deepEqual(pool.map((entry) => entry.label).sort(), ["anthropic", "work"]);
+  const defaultEntry = pool.find((entry) => entry.label === "anthropic");
+  assert.deepEqual(Object.keys(defaultEntry!).sort(), ["label", "lastAttemptAt", "lastRateLimitedAt", "rateLimitedUntil"]);
+});
+
+// An api_key auth.json record does not seed the default metadata slot.
+test("does not seed a default metadata slot for an api_key auth.json record", () => {
+  resetRotationState();
+  const authPath = join(home, ".pi", "agent", "auth.json");
+  mkdirSync(dirname(authPath), { recursive: true });
+  writeFileSync(
+    authPath,
+    `${JSON.stringify({
+      anthropic: { type: "api_key", key: "sk-not-oauth" },
+    })}\n`,
+    "utf8",
+  );
+
+  assert.deepEqual(helpers.readSubscriptionPool("anthropic"), []);
+});
+
+// Hold the real auth.json lock in a separate process and prove the seed read fails
+// visibly instead of silently returning an empty default slot while the file is locked.
+test("locked auth.json seeding fails visibly instead of treating an existing default as absent", async () => {
+  resetRotationState();
+  const authPath = join(home, ".pi", "agent", "auth.json");
+  mkdirSync(dirname(authPath), { recursive: true });
+  writeFileSync(
+    authPath,
+    `${JSON.stringify({
+      anthropic: { type: "oauth", refresh: "refresh-locked", access: "access-locked", expires: Date.now() + 60_000 },
+    })}
+`,
+    "utf8",
+  );
+
+  const subscriptionStateUrl = new URL("../../lib/subscription-state.ts", import.meta.url).href;
+  const readProbe = spawn(
+    process.execPath,
+    [
+      "--import",
+      "tsx/esm",
+      "--input-type=module",
+      "-e",
+      String.raw`const { readSubscriptionPool } = await import(${JSON.stringify(subscriptionStateUrl)});
+process.stdout.write("ready\n");
+await new Promise((resolve) => {
+  process.stdin.setEncoding("utf8");
+  process.stdin.once("data", resolve);
+});
+process.stdout.write("about-to-read\n");
+const pool = readSubscriptionPool("anthropic");
+process.stdout.write("result:" + JSON.stringify(pool) + "\n");`,
+    ],
+    { env: { ...process.env, HOME: home }, stdio: ["pipe", "pipe", "pipe"] },
+  );
+  let sawReady = false;
+  let sawResult = false;
+  let readStderr = "";
+  readProbe.stderr!.setEncoding("utf8");
+  readProbe.stderr!.on("data", (chunk: string) => {
+    readStderr += chunk;
+  });
+  const readReady = new Promise<void>((resolve, reject) => {
+    readProbe.once("error", reject);
+    readProbe.once("close", (code) => {
+      if (!sawReady) reject(new Error(`read-probe exited with ${code} before signalling readiness: ${readStderr.trim()}`));
+    });
+    observeLines(readProbe.stdout!, (line) => {
+      if (line === "ready") {
+        sawReady = true;
+        resolve();
+        return;
+      }
+      if (line.startsWith("result:")) sawResult = true;
+    });
+  });
+  const readDone = new Promise<number | null>((resolve, reject) => {
+    readProbe.once("error", reject);
+    readProbe.once("close", resolve);
+  });
+  await readReady;
+
+  const lockHolder = spawn(
+    process.execPath,
+    [
+      "--import",
+      "tsx/esm",
+      "--input-type=module",
+      "-e",
+      String.raw`import { FileAuthStorageBackend } from "@earendil-works/pi-coding-agent";
+const backend = new FileAuthStorageBackend();
+await backend.withLockAsync(async () => {
+  process.stdout.write("locked\n");
+  await new Promise((resolve) => {
+    process.stdin.setEncoding("utf8");
+    process.stdin.once("data", resolve);
+  });
+  return { result: undefined };
+});`,
+    ],
+    { env: { ...process.env, HOME: home }, stdio: ["pipe", "pipe", "pipe"] },
+  );
+  let lockStderr = "";
+  lockHolder.stderr!.setEncoding("utf8");
+  lockHolder.stderr!.on("data", (chunk: string) => {
+    lockStderr += chunk;
+  });
+  let sawLocked = false;
+  const lockReady = new Promise<void>((resolve, reject) => {
+    lockHolder.once("error", reject);
+    lockHolder.once("close", (code) => {
+      if (!sawLocked) reject(new Error(`lock-holder exited with ${code} before signalling readiness: ${lockStderr.trim()}`));
+    });
+    observeLines(lockHolder.stdout!, (line) => {
+      if (line === "locked") {
+        sawLocked = true;
+        resolve();
+      }
+    });
+  });
+  const lockDone = new Promise<void>((resolve, reject) => {
+    lockHolder.once("error", reject);
+    lockHolder.once("close", (code) => {
+      if (code === 0) resolve();
+      else reject(new Error(`lock-holder exited with ${code}: ${lockStderr.trim()}`));
+    });
+  });
+  await lockReady;
+  readProbe.stdin!.write("go\n");
+  readProbe.stdin!.end();
+  const readExitCode = await readDone;
+  lockHolder.stdin!.write("release\n");
+  lockHolder.stdin!.end();
+
+  assert.equal(sawResult, false);
+  assert.notEqual(readExitCode, 0);
+  assert.match(readStderr, /ELOCKED|Lock file is already being held/);
+  await lockDone;
+  assert.deepEqual(helpers.readSubscriptionPool("anthropic"), [{ label: "anthropic", rateLimitedUntil: 0, lastAttemptAt: 0, lastRateLimitedAt: 0 }]);
+});
+
+test("resolves Anthropic to strength-matched OpenAI Codex fallback", () => {
+  resetRotationState();
+  writeLadderConfig();
+
+  assert.deepEqual(helpers.resolveFallbackTarget("anthropic", "anthropic/claude-opus-4-8:high"), {
+    providerId: "openai-codex",
+    modelId: "gpt-5.6-sol",
+    label: "openai-codex/gpt-5.6-sol:high",
+    strength: "strong",
+    thinkingLevel: "high",
+  });
+});
+
+test("resolves OpenAI Codex to strength-matched Anthropic fallback", () => {
+  writeLadderConfig();
+
+  assert.deepEqual(helpers.resolveFallbackTarget("openai-codex", "openai-codex/gpt-5.6-terra:medium"), {
+    providerId: "anthropic",
+    modelId: "claude-sonnet-4-6",
+    label: "anthropic/claude-sonnet-4-6:high",
+    strength: "medium",
+    thinkingLevel: "high",
+  });
+});
+
+// Ultra and strong share the bare model id gpt-5.6-sol; the live thinking level selects
+// the matching ladder rung.
+test("disambiguates colliding ladder rungs by the live thinking level", () => {
+  resetRotationState();
+  writeLadderConfig();
+  const config = helpers.readRotationConfig();
+
+  // max -> ultra rung -> Anthropic ultra (claude-fable-5)
+  assert.deepEqual(helpers.resolveFallbackTarget("openai-codex", "gpt-5.6-sol", config, "max"), {
+    providerId: "anthropic",
+    modelId: "claude-fable-5",
+    label: "anthropic/claude-fable-5:high",
+    strength: "ultra",
+    thinkingLevel: "high",
+  });
+
+  // high -> strong rung -> Anthropic strong (claude-opus-4-8)
+  assert.equal(helpers.resolveFallbackTarget("openai-codex", "gpt-5.6-sol", config, "high").modelId, "claude-opus-4-8");
+
+  // No thinking level falls back to the default-strength tie-break (strong -> opus).
+  assert.equal(helpers.resolveFallbackTarget("openai-codex", "gpt-5.6-sol", config).modelId, "claude-opus-4-8");
+});
+
+test("parses Retry-After seconds and HTTP dates", () => {
+  const now = Date.UTC(2026, 5, 16, 18, 30, 0);
+  assert.equal(helpers.parseRetryAfterHeader("1.5", now), 1500);
+
+  const retryAt = new Date(now + 15_000).toUTCString();
+  const parsed = helpers.parseRetryAfterHeader(retryAt, now);
+  assert.ok(parsed !== undefined && parsed >= 14_000 && parsed <= 15_000);
+  assert.equal(helpers.parseRetryAfterHeader("", now), undefined);
+  assert.equal(helpers.parseRetryAfterHeader("not-a-delay", now), undefined);
+});
+
+test("restores preferred model when its provider pool frees up", async () => {
+  resetRotationState();
+  writeLadderConfig();
+  helpers.writeSubscriptionPool("openai-codex", [credential("codex")]);
+  helpers.writeRotationConfig({ preferredModel: { providerId: "openai-codex", modelId: "gpt-5.6-sol" } });
+
+  const setModelCalls: any[] = [];
+  const ctx = {
+    model: { provider: "anthropic", id: "claude-opus-4-8", api: "anthropic-messages" },
+    modelRegistry: {
+      find(provider: string, id: string) {
+        return { provider, id, api: provider === "openai-codex" ? "openai-codex-responses" : "anthropic-messages" };
+      },
+    },
+  } as any;
+  const pi = {
+    async setModel(model: any) {
+      setModelCalls.push(model);
+      ctx.model = model;
+      return true;
+    },
+  } as any;
+
+  const restored = await helpers.restorePreferredModelIfPossible(pi, ctx);
+
+  assert.equal(restored, true);
+  assert.deepEqual(setModelCalls[0], {
+    provider: "openai-codex",
+    id: "gpt-5.6-sol",
+    api: "openai-codex-responses",
+  });
+  assert.equal(helpers.readRotationConfig().preferredModel, undefined);
+});
+
+test("keeps newest Retry-After cooldown across overlapping attempts", () => {
+  resetRotationState();
+  helpers.writeSubscriptionPool("anthropic", [credential("personal")]);
+
+  helpers.markSubscriptionAttempt("anthropic", "personal", 100);
+  helpers.markSubscriptionAttempt("anthropic", "personal", 200);
+  helpers.markSubscriptionRateLimited("anthropic", "personal", 60_000, 100, 150);
+  helpers.markSubscriptionRateLimited("anthropic", "personal", 5_000, 200, 205);
+  helpers.markSubscriptionRateLimited("anthropic", "personal", 10_000, 100, 300);
+
+  const [entry] = helpers.readSubscriptionPool("anthropic");
+  assert.deepEqual(
+    { lastAttemptAt: entry.lastAttemptAt, lastRateLimitedAt: entry.lastRateLimitedAt, rateLimitedUntil: entry.rateLimitedUntil },
+    { lastAttemptAt: 200, lastRateLimitedAt: 300, rateLimitedUntil: 10300 },
+  );
+
+  helpers.markSubscriptionSuccess("anthropic", "personal", 250);
+  assert.equal(helpers.readSubscriptionPool("anthropic")[0].rateLimitedUntil, 10300);
+  helpers.markSubscriptionSuccess("anthropic", "personal", 400);
+  assert.equal(helpers.readSubscriptionPool("anthropic")[0].rateLimitedUntil, 0);
+});
+
+// Storage-hardening (design mrf6n12x): the locked read/modify/write primitive must preserve a
+// causally newer cooldown across a stale credential upsert, while still letting an equal-timestamp
+// reauth clear it.
+test("a stale upsert refreshes tokens but cannot erase a newer cooldown; an equal-timestamp reauth clears it", () => {
+  resetRotationState();
+  helpers.writeSubscriptionPool("anthropic", [credential("work", { refresh: "r0", access: "a0", lastRateLimitedAt: 100 })]);
+  // What a node reads before doing a slow token refresh.
+  const snapshot = helpers.readSubscriptionPool("anthropic")[0];
+
+  // "Other node" 429s the slot with a strictly newer basis while the refresh is in flight.
+  helpers.markSubscriptionRateLimited("anthropic", "work", 60_000, 500, 500);
+  const cooled = helpers.readSubscriptionPool("anthropic")[0];
+  assert.equal(cooled.lastRateLimitedAt, 500);
+  assert.equal(cooled.rateLimitedUntil, 60_500);
+
+  // Stale refresh upsert built from the pre-429 snapshot: fresh tokens, stale cooldown basis.
+  helpers.upsertSubscription("anthropic", { ...snapshot, refresh: "r1", access: "a1", expires: snapshot.expires ?? 0 });
+  const merged = helpers.readSubscriptionPool("anthropic")[0];
+  assert.equal(merged.refresh, "r1", "token fields take the incoming value");
+  assert.equal(merged.access, "a1");
+  assert.equal(merged.rateLimitedUntil, 60_500, "the newer cooldown survives the stale upsert");
+  assert.equal(merged.lastRateLimitedAt, 500);
+
+  // Reauth clears the cooldown while preserving lastRateLimitedAt (equal timestamp -> incoming wins).
+  helpers.upsertSubscription("anthropic", { ...merged, refresh: "r2", access: "a2", rateLimitedUntil: 0, lastRateLimitedAt: merged.lastRateLimitedAt });
+  const reauthed = helpers.readSubscriptionPool("anthropic")[0];
+  assert.equal(reauthed.rateLimitedUntil, 0, "an equal-timestamp reauth clears the cooldown");
+  assert.equal(reauthed.refresh, "r2");
+});
+
+test("a stale success cannot reopen a slot cooled down by a newer 429", () => {
+  resetRotationState();
+  helpers.writeSubscriptionPool("anthropic", [credential("personal")]);
+  helpers.markSubscriptionRateLimited("anthropic", "personal", 30_000, 500, 500);
+  // A success whose attempt STARTED before the 429 must not clear the newer cooldown.
+  helpers.markSubscriptionSuccess("anthropic", "personal", 200);
+  assert.equal(helpers.readSubscriptionPool("anthropic")[0].rateLimitedUntil, 30_500);
+  // A success that started after the 429 legitimately clears it.
+  helpers.markSubscriptionSuccess("anthropic", "personal", 600);
+  assert.equal(helpers.readSubscriptionPool("anthropic")[0].rateLimitedUntil, 0);
+});
+
+// A mutation must genuinely go through the per-pool-file cross-process lock: while another
+// process holds the pool file's lock (the SAME FileAuthStorageBackend lock the backend uses),
+// a mutator throws after exhausting its retry budget rather than writing unlocked; once the
+// holder releases, the same call succeeds.
+test("pool mutations take the cross-process pool-file lock", async () => {
+  resetRotationState();
+  helpers.writeSubscriptionPool("openai-codex", [credential("work")]);
+  const poolFile = join(home, ".pi", "agent", "openai-codex-subscriptions.json");
+
+  const lockHolder = spawn(
+    process.execPath,
+    [
+      "--import",
+      "tsx/esm",
+      "--input-type=module",
+      "-e",
+      String.raw`import { FileAuthStorageBackend } from "@earendil-works/pi-coding-agent";
+const backend = new FileAuthStorageBackend(${JSON.stringify(poolFile)});
+await backend.withLockAsync(async () => {
+  process.stdout.write("locked\n");
+  await new Promise((resolve) => {
+    process.stdin.setEncoding("utf8");
+    process.stdin.once("data", resolve);
+  });
+  return { result: undefined };
+});`,
+    ],
+    { env: { ...process.env, HOME: home }, stdio: ["pipe", "pipe", "pipe"] },
+  );
+  let lockStderr = "";
+  lockHolder.stderr!.setEncoding("utf8");
+  lockHolder.stderr!.on("data", (chunk: string) => {
+    lockStderr += chunk;
+  });
+  let sawLocked = false;
+  const lockReady = new Promise<void>((resolve, reject) => {
+    lockHolder.once("error", reject);
+    lockHolder.once("close", (code) => {
+      if (!sawLocked) reject(new Error(`lock-holder exited with ${code} before signalling readiness: ${lockStderr.trim()}`));
+    });
+    observeLines(lockHolder.stdout!, (line) => {
+      if (line === "locked") {
+        sawLocked = true;
+        resolve();
+      }
+    });
+  });
+  // Teardown releases the lock and proves the child completed its awaited unlock before the
+  // post-release mutation runs. A wedged child still gets bounded TERM/KILL cleanup.
+  const childClosed = new Promise<{ code: number | null; signal: NodeJS.Signals | null }>((resolve) =>
+    lockHolder.once("close", (code, signal) => resolve({ code, signal })),
+  );
+  let readyTimer: NodeJS.Timeout | undefined;
+  try {
+    await Promise.race([
+      lockReady,
+      new Promise<never>((_, reject) => {
+        // Boot budget, not a semantics guard: the child is a fresh `node --import tsx/esm`
+        // process that compiles the TS module graph before it can signal. Under the full
+        // tier's --test-concurrency=4 on a 4-vCPU CI runner that boot alone can exceed 10s,
+        // so give it real headroom -- a genuine lock bug shows up as a wrong outcome below,
+        // never as a slow boot.
+        readyTimer = setTimeout(() => reject(new Error("lock-holder did not signal readiness within 60s")), 60_000);
+      }),
+    ]);
+    assert.throws(() => helpers.markSubscriptionAttempt("openai-codex", "work", 123), /ELOCKED|already being held/i);
+  } finally {
+    if (readyTimer) clearTimeout(readyTimer);
+    try {
+      lockHolder.stdin!.write("release\n");
+      lockHolder.stdin!.end();
+    } catch {
+      /* child already gone */
+    }
     // Wait for clean exit first: code 0 proves the async unlock completed. A wedged child gets
     // bounded SIGTERM/SIGKILL cleanup, and its test-owned lock is removed only on that fallback.
     const closedWithin = (ms: number) =>
@@ -241,10 +1322,14 @@ test("auth-driven default reconciliation refuses a colliding explicit identity",
 // cannot reauth into an account held by another slot.
 test("the uniqueness-aware reauth upsert refreshes its slot but rejects another slot's account", () => {
   resetRotationState();
-  helpers.writeSubscriptionPool("openai-codex", [credential("work", { accountId: "acct-old" }), credential("other", { accountId: "acct-held" })]);
+  helpers.writeSubscriptionPool("openai-codex", [credential("work", { accountId: "acct-old", rateLimitedUntil: 900, lastAttemptAt: 100, lastRateLimitedAt: 50 }), credential("other", { accountId: "acct-held" })]);
   helpers.upsertSubscriptionWithUniqueAccount("openai-codex", credential("work", { accountId: "acct-new", refresh: "r-new", access: "a-new" }));
   let pool = helpers.readSubscriptionPool("openai-codex");
-  assert.equal(pool.find((entry) => entry.label === "work")?.accountId, "acct-new");
+  const refreshed = pool.find((entry) => entry.label === "work");
+  assert.equal(refreshed?.accountId, "acct-new");
+  assert.equal(refreshed?.rateLimitedUntil, 900);
+  assert.equal(refreshed?.lastAttemptAt, 100);
+  assert.equal(refreshed?.lastRateLimitedAt, 50);
   assert.throws(
     () => helpers.upsertSubscriptionWithUniqueAccount("openai-codex", credential("work", { accountId: "acct-held", refresh: "r-collision", access: "a-collision" })),
     (err: unknown) => err instanceof helpers.DuplicateSubscriptionError && /already added/i.test((err as Error).message),
@@ -364,6 +1449,7 @@ test("cross-process explicit adds admit exactly one duplicate Codex account", as
   resetRotationState();
   const poolPath = join(home, ".pi", "agent", "openai-codex-subscriptions.json");
   const releasePath = join(home, "release-cross-process-add-race");
+  const holderInsidePath = join(home, "holder-inside-cross-process-add-race");
   const subscriptionStateUrl = new URL("../../lib/subscription-state.ts", import.meta.url).href;
   const spawnContender = (label: string, role: "holder" | "waiter") => {
     const child = spawn(
@@ -373,12 +1459,22 @@ test("cross-process explicit adds admit exactly one duplicate Codex account", as
         "tsx/esm",
         "--input-type=module",
         "-e",
-        String.raw`import { existsSync, writeSync } from "node:fs";
+        String.raw`import { existsSync, writeSync, writeFileSync } from "node:fs";
 import { FileAuthStorageBackend } from "@earendil-works/pi-coding-agent";
 const { addSubscription, DuplicateSubscriptionError } = await import(${JSON.stringify(subscriptionStateUrl)});
 const poolPath = ${JSON.stringify(poolPath)};
 const releasePath = ${JSON.stringify(releasePath)};
+const holderInsidePath = ${JSON.stringify(holderInsidePath)};
 const role = ${JSON.stringify(role)};
+// Yield the CPU while polling for a coordination file instead of a tight busy-spin. Two
+// contenders spinning at 100% CPU starve the parent's timeout observers on an
+// oversubscribed CI runner, which is one way this cross-process test flaked in CI while
+// passing locally. Atomics.wait blocks the thread for the poll interval without burning a
+// core -- the semantics (proceed the instant the file appears) are unchanged.
+const waitForFile = (path) => {
+  const idle = new Int32Array(new SharedArrayBuffer(4));
+  while (!existsSync(path)) Atomics.wait(idle, 0, 0, 5);
+};
 const originalWithLock = FileAuthStorageBackend.prototype.withLock;
 FileAuthStorageBackend.prototype.withLock = function (fn) {
   if (this.authPath !== poolPath) return originalWithLock.call(this, fn);
@@ -393,16 +1489,26 @@ FileAuthStorageBackend.prototype.withLock = function (fn) {
       if ((error).code !== "ELOCKED") throw error;
     }
     writeSync(1, "acquiring\n");
-    while (!existsSync(releasePath)) {}
+    waitForFile(releasePath);
   }
   return originalWithLock.call(this, (current) => {
     if (role === "holder") {
       writeSync(1, "inside\n");
-      while (!existsSync(releasePath)) {}
+      writeFileSync(holderInsidePath, "inside\n");
+      waitForFile(releasePath);
     }
     return fn(current);
   });
 };
+// The holder's wait-for-release runs inside a SYNC withLock hold, which blocks its event
+// loop -- so the lock library's stale-refresh timer cannot fire and the lock's mtime ages.
+// If that sync hold spans this waiter's multi-second tsx boot on a slow CI runner, the
+// lock crosses the stale threshold and the waiter's probe STEALS it instead of hitting
+// ELOCKED (the exact full-tier CI failure). Both contenders therefore boot in parallel,
+// and the waiter gates HERE -- after its own boot, before touching the pool -- on the
+// holder being inside the lock, keeping the holder's sync hold to the sub-second
+// coordination tail, far under the stale window.
+if (role === "waiter") waitForFile(holderInsidePath);
 try {
   addSubscription("openai-codex", {
     label: ${JSON.stringify(label)}, refresh: "refresh-${label}", access: "access-${label}", expires: Date.now() + 60_000,
@@ -445,16 +1551,24 @@ try {
     return { child, closed, label, outcome: () => outcome, signal, stderr: () => stderr, stdout: () => stdout, stdoutEnded };
   };
 
+  // Spawn both contenders up front so their expensive tsx boots overlap and neither boot
+  // happens while the holder is sitting inside its sync lock hold (see the child comment on
+  // lock staleness). The waiter self-gates on holderInsidePath, so the probe ordering --
+  // waiter attempts the lock only while the holder is inside it -- is unchanged.
   const holder = spawnContender("race-left", "holder");
-  const contenders = [holder];
+  const waiter = spawnContender("race-right", "waiter");
+  const contenders = [holder, waiter];
   try {
-    await within(Promise.all([holder.signal("attempt"), holder.signal("inside")]), 10_000, "holder did not reach the locked transform within 10s");
-    const waiter = spawnContender("race-right", "waiter");
-    contenders.push(waiter);
-    await within(Promise.all([waiter.signal("attempt"), waiter.signal("acquiring")]), 10_000, "waiter did not attempt the held pool lock within 10s");
+    // Boot budgets, not semantics guards: each contender is a fresh `node --import tsx/esm`
+    // process that compiles the TS module graph before it can signal. Under the full tier's
+    // --test-concurrency=4 on a 4-vCPU CI runner that boot alone can exceed 10s, so give the
+    // coordination phases real headroom -- a genuine lock bug shows up as a wrong outcome in
+    // the assertions below, never as a slow boot.
+    await within(Promise.all([holder.signal("attempt"), holder.signal("inside")]), 60_000, "holder did not reach the locked transform within 60s");
+    await within(Promise.all([waiter.signal("attempt"), waiter.signal("acquiring")]), 60_000, "waiter did not attempt the held pool lock within 60s");
     writeFileSync(releasePath, "release\n", "utf8");
-    const exitCodes = await within(Promise.all(contenders.map((contender) => contender.closed)), 3000, "cross-process contenders did not exit within 3s");
-    await within(Promise.all(contenders.map((contender) => contender.stdoutEnded)), 1000, "cross-process contender output did not close within 1s");
+    const exitCodes = await within(Promise.all(contenders.map((contender) => contender.closed)), 30_000, "cross-process contenders did not exit within 30s");
+    await within(Promise.all(contenders.map((contender) => contender.stdoutEnded)), 15_000, "cross-process contender output did not close within 15s");
     assert.deepEqual(exitCodes, [0, 0], contenders.map((contender) => contender.stderr()).join("\n"));
     assert.deepEqual(contenders.map((contender) => contender.outcome()).sort(), ["duplicate", "success"], contenders.map((contender) => contender.stdout()).join("\n"));
     const pool = helpers.readSubscriptionPool("openai-codex");
@@ -463,6 +1577,9 @@ try {
   } finally {
     const errors: unknown[] = [];
     try {
+      // Unblock a waiter still gated on the holder-inside file as well as anyone waiting on
+      // release, so an early assertion failure cannot leave a child polling forever.
+      writeFileSync(holderInsidePath, "inside\n", "utf8");
       writeFileSync(releasePath, "release\n", "utf8");
     } catch (error) {
       errors.push(error);
@@ -542,6 +1659,14 @@ test("malformed auth during nested default persistence preserves malformed bytes
   );
 });
 
+test("renames explicit subscriptions without permitting default-slot or case-insensitive collisions", () => {
+  resetRotationState();
+  helpers.writeSubscriptionPool("openai-codex", [credential("openai-codex"), credential("work"), credential("personal")]);
+  assert.deepEqual(helpers.renameSubscription("openai-codex", "work", "Lab").map((entry) => entry.label), ["openai-codex", "Lab", "personal"]);
+  assert.throws(() => helpers.renameSubscription("openai-codex", "Lab", " PERSONAL "), helpers.DuplicateSubscriptionError);
+  assert.throws(() => helpers.renameSubscription("openai-codex", "openai-codex", "anything"), /Default account/);
+});
+
 test("treats numeric subscription refs as 1-based indexes", () => {
   resetRotationState();
   const pool = [credential("alpha"), credential("beta")];
@@ -1516,3 +2641,94 @@ test("treats a Codex usage-limit message on a non-429 status as a rate limit: co
     rotationModule.__setStreamForProviderForTest(undefined);
   }
 });
+
+// --- Provider-management removal routing + login coordination (final review findings #1, #2) ---
+
+function writeDefaultAuthRecord(providerId: "anthropic" | "openai-codex", extra: Record<string, unknown> = {}): void {
+  const authPath = join(home, ".pi", "agent", "auth.json");
+  mkdirSync(dirname(authPath), { recursive: true });
+  writeFileSync(
+    authPath,
+    `${JSON.stringify({ [providerId]: { type: "oauth", refresh: "r", access: "a", expires: Date.now() + 60_000, ...extra } }, null, 2)}\n`,
+    { encoding: "utf8", mode: 0o600 },
+  );
+}
+
+function readAuthRecord(providerId: string): unknown {
+  const raw = readFileSync(join(home, ".pi", "agent", "auth.json"), "utf8");
+  return (JSON.parse(raw) as Record<string, unknown>)[providerId];
+}
+
+// The exact guard finding #1 tripped: removing a managed provider from its HEADER row (no
+// label -- the default cursor position) MUST route through the coordinated service and clear
+// BOTH auth.json and the rotation pool. The old code fell through to a raw AuthStorage.logout(),
+// which cleared only auth.json and left the explicit account configured while the panel said
+// "Removed" -- so the surviving pool entry below is what catches the regression.
+test("removeProviderRow on a managed HEADER row clears auth.json AND the whole pool (finding #1)", () => {
+  resetRotationState();
+  writeDefaultAuthRecord("anthropic");
+  helpers.upsertSubscription("anthropic", credential("work"));
+  assert.ok(helpers.readSubscriptionPool("anthropic").some((e) => e.label === "anthropic"), "default slot seeded from auth.json");
+  assert.ok(helpers.readSubscriptionPool("anthropic").some((e) => e.label === "work"), "explicit account present");
+
+  const notice = providerManagement.removeProviderRow(join(home, ".pi", "agent"), {
+    providerId: "anthropic",
+    name: "Claude",
+    managed: true,
+    configured: true,
+    // no label -> the provider header row
+  });
+
+  assert.equal(notice, "Removed Claude");
+  assert.deepEqual(helpers.readSubscriptionPool("anthropic"), [], "pool fully torn down (would still hold 'work' under the old logout() bug)");
+  assert.equal(readAuthRecord("anthropic"), undefined, "auth.json default record cleared");
+});
+
+// An account ROW (has a label) removes just that account and leaves the rest of the pool intact.
+test("removeProviderRow on a managed account row removes only that account", () => {
+  resetRotationState();
+  writeDefaultAuthRecord("anthropic");
+  helpers.upsertSubscription("anthropic", credential("work"));
+
+  const notice = providerManagement.removeProviderRow(join(home, ".pi", "agent"), {
+    providerId: "anthropic",
+    name: "Claude",
+    managed: true,
+    label: "work",
+  });
+
+  assert.equal(notice, "Removed Claude account");
+  assert.deepEqual(
+    helpers.readSubscriptionPool("anthropic").map((e) => e.label),
+    ["anthropic"],
+    "only the default slot remains",
+  );
+  assert.ok(readAuthRecord("anthropic"), "auth.json default record untouched");
+});
+
+// /login coordination (finding #2): the default slot commits through commitDefaultIdentity, so
+// auth.json gets the oauth record AND the pool default slot reflects the identity as metadata only.
+test("commitManagedLogin default slot writes auth.json + metadata-only pool identity", () => {
+  resetRotationState();
+  helpers.commitManagedLogin("anthropic", "anthropic", { refresh: "r1", access: "a1", expires: Date.now() + 60_000, accountId: "acct-1" });
+
+  const record = readAuthRecord("anthropic") as { type?: string; accountId?: string } | undefined;
+  assert.equal(record?.type, "oauth");
+  assert.equal(record?.accountId, "acct-1");
+
+  const slot = helpers.readSubscriptionPool("anthropic").find((e) => e.label === "anthropic");
+  assert.ok(slot, "default slot present");
+  assert.equal(slot?.accountId, "acct-1", "pool default slot carries the identity");
+  assert.equal(slot?.refresh, undefined, "pool default slot stays metadata-only (no token)");
+});
+
+// The account-uniqueness gate the raw authStorage.login() path skipped: a second slot for the
+// same account (same accountId) is rejected.
+test("commitManagedLogin enforces account uniqueness the raw login path skipped", () => {
+  resetRotationState();
+  helpers.commitManagedLogin("openai-codex", "openai-codex", { refresh: "r", access: "a", expires: Date.now() + 60_000, accountId: "dup" });
+  assert.throws(
+    () => helpers.commitManagedLogin("openai-codex", "second", { refresh: "r2", access: "a2", expires: Date.now() + 60_000, accountId: "dup" }),
+    /already added/,
+  );
+});