dsh-keys-manager 0.2.1 → 0.2.2

package/lib/index.js

@@ -25,6 +25,13 @@ const SERVICE = 'keysManager';
 const NAMESPACE = 'keysManager';
 const BROKER_PREFIX = 'KEYSMGR_';
 const ORIGINAL = Symbol.for('cordis.original');
+/**
+ * The capability `close()`'s pre-close restoration writes under (PR review
+ * round 36). A module-private token, not a boolean a caller can pass: no
+ * cleanup, watchdog or late reconcile can hold it, so the restoration is the
+ * only writer allowed while `shutdownRequested` is up.
+ */
+const PRE_CLOSE_RESTORE = Symbol('keys-manager.pre-close restore');
 const MAX_SWITCHES = 6;
 const ATTEMPT_TTL_MS = 60 * 60 * 1000;
 /** A retry pin only lives for this long; an expired pin is treated as absent. */
@@ -53,6 +60,15 @@ const MAX_ALIAS = 80;
 const INTENTIONAL_REMOVAL_TTL_MS = 5_000;
 /** The credential-record scope pi-ai stores its per-provider grants under (llm-pi-ai/src/auth.ts:29). */
 export const OAUTH_GRANT_RECORD_SCOPE = 'llm-pi-ai';
+/**
+ * The credential-record scope the llm-omp transports package owns: one
+ * `llm-omp-transports/<route>` grant per transport route (its
+ * `CURSOR_CREDENTIAL_KEY` is `llm-omp-transports/cursor`). Keys Manager reads
+ * those records to list/verify an account and deletes one on removal; it
+ * never writes one and never projects one into `llm-pi-ai/<provider>`, so a
+ * transport route keeps serving from its own adapter-owned credential.
+ */
+export const TRANSPORT_CREDENTIAL_SCOPE = 'llm-omp-transports';
 /**
  * Upper bound on one stream's wait for projection-ownership hydration
  * (round-9 should-fix). Hydration reads one `readRecord` per OAuth provider
@@ -65,6 +81,67 @@ export const OAUTH_GRANT_RECORD_SCOPE = 'llm-pi-ai';
  * generation guard in {@link KeysManagerService.hydrateProjectionOwnership}.
  */
 const HYDRATION_WAIT_MS = 500;
+/** Upper bound on one per-row connection test: a stalled provider must not hold the row busy forever. */
+const KEY_TEST_TIMEOUT_MS = 20_000;
+/** The test timeout as user-visible copy; derived so the constant stays the single source of truth. */
+const KEY_TEST_TIMEOUT_LABEL = `${KEY_TEST_TIMEOUT_MS / 1000}s`;
+/**
+ * Hard bound on how long an ordinary request waits for an in-flight row test
+ * (QC B3). The test's own request timeout covers only `ctx.llm.stream`; its
+ * credential-store reads offer no timeout or cancellation, so without a bound
+ * of its own one stalled seam read parks every ordinary request for the
+ * provider indefinitely. The small margin keeps the wait from cutting short a
+ * test whose provider call used its whole budget.
+ */
+const KEY_TEST_ISOLATION_WAIT_MS = KEY_TEST_TIMEOUT_MS + 5_000;
+/**
+ * Hard bound on one abandoned test window's cleanup (QC fix wave 2). The
+ * borrowed projection must be put back before ordinary traffic may resume on
+ * the provider, but the cleanup runs through the same credential seam the
+ * wedged test is parked in, so it cannot be trusted to return. Past this bound
+ * the provider stays isolated and fenced instead of being released on an
+ * unreconciled credential surface.
+ */
+const KEY_TEST_CLEANUP_DEADLINE_MS = 2_000;
+/**
+ * Hard bound on the shutdown drain of the per-provider grant chains (PR review
+ * round 29). A chain body carries the row test's own provider request, and an
+ * adapter that ignores the abort signal keeps that request pending after the
+ * watchdog already restored the borrowed credential, so the chain may never
+ * settle. Past this bound the pending chain is abandoned: process teardown does
+ * not need it, and shutdown must not hang on it.
+ */
+const GRANT_DRAIN_DEADLINE_MS = 2_000;
+/**
+ * How many times one binding decision is re-derived after its write settled on
+ * a serving source that has moved again (PR review round 32). The write itself
+ * is asynchronous, so each settled profile can already describe a source a
+ * newer classification replaced; a small bound chases that without letting a
+ * genuinely flapping route spawn an unbounded write chain.
+ */
+const BINDING_CORRECTION_LIMIT = 3;
+/** The error-like `name` of an unknown thrown value, if it carries one. */
+function errorNameOf(value) {
+    if (typeof value !== 'object' || value === null)
+        return undefined;
+    const name = value.name;
+    return typeof name === 'string' ? name : undefined;
+}
+/**
+ * Whether the 20 s test timeout caused the caught failure. The abort signal
+ * is a whole-request fact, so an error that merely races the timer keeps its
+ * own message (M1): only the timeout's own reason, or the abort the timeout
+ * caused, maps to the timeout copy.
+ */
+function isTestTimeoutAbort(error, signal) {
+    if (!signal.aborted)
+        return false;
+    if (error === signal.reason)
+        return true;
+    if (errorNameOf(signal.reason) !== 'TimeoutError')
+        return false;
+    return errorNameOf(error) === 'AbortError';
+}
 /**
  * Stable failure code for a harvest whose state flush rejected AND whose
  * credential-side rollback then failed to write.
@@ -168,6 +245,16 @@ const INVOCATIONS = [
     endpoint('listAccountAttempts'),
     endpoint('activateAccount', ['provider', 'accountId']),
     endpoint('removeAccount', ['provider', 'accountId']),
+    // One minimal request per key/account row (observation-only: no health,
+    // cursor or binding writes) so a user can tell a bad credential from a bad
+    // route without waiting for a chat failure.
+    endpoint('testKey', ['provider', 'keyId']),
+    // Transport accounts (llm-omp-transports/<route>): managed beside the pi-ai
+    // pool, never through it. The sign-in reuses the same attempt machinery and
+    // is polled through `accountAttempt` above.
+    endpoint('beginTransportLogin', ['provider']),
+    endpoint('activateTransportAccount', ['provider']),
+    endpoint('removeTransportAccount', ['provider']),
 ];
 /** Read a nested value by path. */
 function getPath(value, path) {
@@ -251,6 +338,89 @@ function discoveredModel(model) {
         inputModalities: model.inputModalities,
     });
 }
+/** Credential-bearing header names the carrier must never persist as plain settings. */
+const CREDENTIAL_HEADER_NAMES = new Set(['authorization', 'proxy-authorization', 'cookie', 'api-key', 'apikey', 'x-api-key']);
+/** Carrier headers are non-secret metadata; a credential-bearing name is refused. */
+function isCredentialHeader(header) {
+    const name = header.toLowerCase();
+    return CREDENTIAL_HEADER_NAMES.has(name) || name.endsWith('-api-key');
+}
+/**
+ * Resolve one extra provider's declared static request headers from the
+ * environment. Every value must be non-blank and legal for Fetch; a missing or
+ * unusable value refuses the add before any credential or settings write,
+ * because a blank header would only surface later as an opaque
+ * profile-resolution error.
+ */
+function resolveHeaderEnv(extra) {
+    if (extra.headerEnv === undefined)
+        return undefined;
+    const headers = {};
+    for (const [header, envName] of Object.entries(extra.headerEnv)) {
+        if (isCredentialHeader(header)) {
+            throw new Error(`${extra.id} declares the credential header ${header}; only non-secret metadata headers can be carried`);
+        }
+        const value = process.env[envName]?.trim();
+        if (value === undefined || value.length === 0) {
+            throw new Error(`${extra.id} requires the ${envName} environment variable (${header} header)`);
+        }
+        // The settings seam materializes the profile through Fetch, which rejects
+        // names and values a header cannot carry; refuse them by name here.
+        try {
+            new Headers([[header, value]]);
+        }
+        catch {
+            throw new Error(`${extra.id} cannot carry the ${envName} value as the ${header} header: it is not a valid Fetch header value`);
+        }
+        headers[header] = value;
+    }
+    return headers;
+}
+/** Read a stored profile header map, keeping only the string values a header can carry. */
+function staticHeaders(value) {
+    const headers = {};
+    if (value === null || typeof value !== 'object')
+        return headers;
+    for (const [header, entry] of Object.entries(value)) {
+        if (typeof entry === 'string')
+            headers[header] = entry;
+    }
+    return headers;
+}
+/** Stored header key matching a declared name; Fetch field names are case-insensitive. */
+function storedHeaderKey(stored, header) {
+    const wanted = header.toLowerCase();
+    for (const key of Object.keys(stored)) {
+        if (key.toLowerCase() === wanted)
+            return key;
+    }
+    return undefined;
+}
+/** Resolve the declared header values the environment currently supplies. */
+function environmentHeaders(extra) {
+    const headers = {};
+    if (extra?.headerEnv === undefined)
+        return headers;
+    for (const [header, envName] of Object.entries(extra.headerEnv)) {
+        const value = process.env[envName]?.trim();
+        if (value !== undefined && value.length > 0)
+            headers[header] = value;
+    }
+    return headers;
+}
+/** Declared headers the stored map does not carry yet; a stored value always wins. */
+function missingHeaders(declared, stored) {
+    const missing = {};
+    if (declared === undefined)
+        return missing;
+    for (const [header, value] of Object.entries(declared)) {
+        // A stored variant in any case counts as the same Fetch field, so no
+        // second case variant is ever added.
+        if (storedHeaderKey(stored, header) === undefined)
+            missing[header] = value;
+    }
+    return missing;
+}
 /** Public, secret-free key row. */
 function publicKey(key, now, projectedAccountId) {
     return {
@@ -285,6 +455,68 @@ function publicKey(key, now, projectedAccountId) {
             : {}),
     };
 }
+/**
+ * The usable grant of one transport record, or undefined when the record is
+ * absent or carries a payload this manager cannot read. The payload belongs
+ * to the transports package, so every field is checked structurally.
+ */
+function transportGrantOf(record) {
+    if (record === undefined || record.kind !== 'grant')
+        return undefined;
+    const payload = record.payload;
+    if (payload === null || typeof payload !== 'object' || Array.isArray(payload))
+        return undefined;
+    const source = payload;
+    if (typeof source.access !== 'string' || source.access.length === 0)
+        return undefined;
+    if (typeof source.expires !== 'number' || !Number.isFinite(source.expires))
+        return undefined;
+    return {
+        access: source.access,
+        expires: source.expires,
+        ...(typeof source.refresh === 'string' && source.refresh.length > 0 ? { refresh: source.refresh } : {}),
+        ...(typeof source.email === 'string' && source.email.length > 0 ? { email: source.email } : {}),
+        ...(typeof source.accountId === 'string' && source.accountId.length > 0 ? { accountId: source.accountId } : {}),
+    };
+}
+/**
+ * One transport account row from its route flow and stored record.
+ *
+ * A transport route keeps exactly ONE grant record, and the route's adapter
+ * resolves that record per request — so a usable grant IS the route's live
+ * credential. There is no projection to select between: `active` only
+ * restates that, and activation can never write a pi-ai record. The row
+ * exists while signed out, so the UI can offer the sign-in that writes it.
+ */
+function transportAccountOf(flow, record, now) {
+    const grant = transportGrantOf(record);
+    const status = grant !== undefined
+        ? grant.expires > now
+            ? 'active'
+            : grant.refresh === undefined ? 'needs-reauth' : 'expired'
+        : record === undefined ? 'signed-out' : 'needs-reauth';
+    return {
+        id: flow.key.slice(TRANSPORT_CREDENTIAL_SCOPE.length + 1),
+        scope: flow.key,
+        displayName: flow.label,
+        ...(grant?.email === undefined ? {} : { email: grant.email }),
+        ...(grant?.accountId === undefined ? {} : { accountId: grant.accountId }),
+        ...(grant?.expires === undefined ? {} : { expiresAt: grant.expires }),
+        status,
+        // Derived, never a second opinion: an expired or unreadable grant is not
+        // the route's live credential.
+        active: status === 'active',
+    };
+}
+/**
+ * The method id a transport flow begins with, or undefined when it has none.
+ *
+ * The transports package owns its flow's method id; this manager only reads
+ * the scope prefix, so it must not assume the pi-ai `'oauth'` id.
+ */
+function transportMethodOf(flow) {
+    return flow.methods[0]?.id;
+}
 /** Env names that are a single API-key credential, not an OAuth/federation token. */
 function isKeyishEnv(name) {
     if (!/(?:API_KEY|_TOKEN)$/.test(name))
@@ -427,17 +659,147 @@ export class KeysManagerService {
     credentialWrappers = new WeakMap();
     brokerOwners = new Map();
     bindingCache = new Map();
+    /**
+     * Providers whose managed credentials are being removed right now. While a
+     * provider is unmanaged only the unbind direction of
+     * {@link syncBrokerBinding} may run: a demotion inside the deletion loop
+     * (an `oauth` row iterated before a surviving `api-key` row) must never
+     * re-point the released profile at the broker.
+     */
+    releasingProviders = new Set();
     lastBindingPruneAt = 0;
     selectionQueues = new Map();
     queue = Promise.resolve();
     closing = false;
+    /** The one shutdown this manager runs; a later close() joins it (round 38). */
+    closePromise;
+    /**
+     * The pre-close restoration is running (PR review round 37). Only inside it
+     * — set when {@link restoreBorrowedWindows} starts and cleared in its
+     * `finally`, the cleanup deadline included — does the module-private
+     * {@link PRE_CLOSE_RESTORE} capability let a write past shutdown. A
+     * restoration that outlives its deadline resumes after this went down and
+     * is refused like any other continuation.
+     */
+    preCloseRestorePhase = false;
+    /**
+     * Shutdown has begun (PR review round 34). Set on `close()`'s first line,
+     * before the pre-close restoration runs, so a test arriving while that
+     * restoration is putting the outstanding borrows back is refused instead of
+     * starting a second window the restoration would not cover. Never cleared:
+     * the instance is closing.
+     */
+    shutdownRequested = false;
+    /**
+     * Providers whose in-flight row test borrows the route's credential
+     * surface (QC B4: an OAuth row test's projection, and the broker reference
+     * it may temporarily release). While a provider is borrowed the binding
+     * authority must not derive a real binding from the borrowed world: a
+     * mutation landing inside the window (`addKey`, `deleteKey`, an account
+     * removal) would otherwise persist an unbind decided about a state that is
+     * not the route's. {@link syncBrokerBinding} consults this exactly like
+     * {@link releasingProviders}; the test's own window-end sync passes
+     * `borrow: true` so the restored state is written back in one step.
+     */
+    testBindingBorrows = new Set();
+    /**
+     * Providers with a borrowing row test in flight, mapped to that test's own
+     * promise. The promise is the isolation seam: an ordinary request for the
+     * provider waits on it (bounded, see {@link settleProviderTest}) before
+     * resolving a credential, and reports its own outcome if the test fails.
+     * Only OAuth-row tests borrow (QC N7), so only they register here.
+     */
+    testsInFlight = new Map();
+    /**
+     * Every in-flight row test, by provider — the single-concurrent-test lock
+     * for both row kinds. Separate from {@link testsInFlight} because an
+     * api-key test borrows nothing and must not isolate ordinary requests.
+     */
+    testsActive = new Map();
+    /**
+     * Every row test window that has not been released yet, by provider (PR
+     * review round 33). Shutdown restores each window's borrowed projection
+     * before `closing` refuses the in-window cleanup, so the map outlives
+     * {@link testsActive} for a window whose request never settles.
+     */
+    testWindows = new Map();
+    /**
+     * Upper bound on one ordinary request's wait for an in-flight row test
+     * (QC B3). Injectable so tests can exercise the bound quickly.
+     */
+    isolationWaitMs = KEY_TEST_ISOLATION_WAIT_MS;
+    /**
+     * Providers whose abandoned test window is still being cleaned up (QC fix
+     * wave 2). The fence stays until a cleanup completed: a new test would
+     * borrow a projection that is not back yet, and an ordinary request must not
+     * be served by a borrowed grant or an unbound route.
+     */
+    cleaningTests = new Set();
+    /**
+     * Nesting depth of an in-flight removal per provider (PR review round 12).
+     * {@link settleTestBeforeRemoval} can only wait for a test that already
+     * exists, so a test starting after that check would read the grant and the
+     * projection and then re-project an account the removal deleted. {@link
+     * testKey} refuses while this marker is up. A depth, because `deleteKey`
+     * releases through `releaseLocked` inside its own removal.
+     */
+    removalsInProgress = new Map();
+    /**
+     * Generation of the newest cleanup attempt per provider (PR review round 2).
+     * An attempt that outlives its deadline keeps writing while a later attempt
+     * for the same window starts. Only the newest generation may release
+     * provider-wide state — the fence, the borrow marker, the in-flight maps —
+     * so a superseded attempt can never clear isolation a newer window owns.
+     */
+    cleanupAttempts = new Map();
+    /**
+     * The abandoned window currently fencing each provider (QC fix wave 3,
+     * W-002), so a later test attempt can retry its cleanup. Without this the
+     * fence could only ever clear from the abandoned promise's settlement, and a
+     * promise that settled while the seam was still wedged left the provider
+     * isolated forever.
+     */
+    abandonedWindows = new Map();
+    /** Hard bound on one abandoned window's cleanup. Injectable for tests. */
+    testCleanupDeadlineMs = KEY_TEST_CLEANUP_DEADLINE_MS;
+    /** Hard bound on the shutdown drain of the grant chains. Injectable for tests. */
+    grantDrainDeadlineMs = GRANT_DRAIN_DEADLINE_MS;
+    /** Providers whose isolation-deadline warning already fired (warn once). */
+    isolationWaitWarned = new Set();
     /** Interactive sign-in attempts, by attempt id. */
     loginAttempts = new Map();
     /** The provider → attempt id index for the single-attempt rule. */
     loginsInFlight = new Map();
     loginSequence = 0;
+    /** The route → attempt id index for the single transport sign-in rule. */
+    transportInFlight = new Map();
+    /**
+     * Per-route removal epoch. A removal bumps it before withdrawing the live
+     * attempt, so that attempt's settle path can tell the account is gone and
+     * drop a grant its commit had already started writing.
+     */
+    transportRemovals = new Map();
+    /**
+     * Transport-account rows, hydrated from the `llm-omp-transports/<route>`
+     * records. Kept out of the pi-ai pool document on purpose: the rows are a
+     * read-only projection of another package's records, rebuilt by
+     * {@link refreshTransportAccounts} and rendered by `buildState`.
+     */
+    transportRows = [];
+    /** Tail of the serialized transport read chain. */
+    transportRefresh;
     /** The account row whose grant payload currently IS the projection, per provider. */
     activeAccounts = new Map();
+    /**
+     * Providers whose live projection EXISTS but no managed row owns it (PR
+     * review round 3). `activeAccounts` alone cannot tell "no projection" from
+     * "a projection this process does not manage": an orphan or foreign grant
+     * (hydration found no matching row) still serves ahead of any broker
+     * reference, so the route must not be treated as the key pool's. Set by
+     * hydration and by the reconciler when a record is present but unattributed,
+     * cleared when the record is deleted or becomes owned.
+     */
+    foreignProjections = new Set();
     /**
      * Account rows committed to removal (C6-1/I1 removal-aware oracle), marked
      * by {@link removeOAuthGrant} before its first awaited delete. A multi-row
@@ -538,6 +900,16 @@ export class KeysManagerService {
      * to the requested provider's own unresolved read.
      */
     hydratedProviders = new Set();
+    /**
+     * Providers whose hydration ownership read FAILED (PR review round 8). A
+     * failed read knows nothing about the route, so it is not the "no projection"
+     * answer a successful empty read is: treating it as one let the startup
+     * repair read an empty owner/foreign map as proof that the pool serves and
+     * bind the broker over a persisted OAuth projection it could not read.
+     * Readiness therefore stays false for these providers and the repair skips
+     * them; only a restart can retry the read.
+     */
+    ownershipReadFailures = new Set();
     /**
      * One resolver set per provider still being waited on (round-10 should-fix
      * SF2). A wait registers exactly one entry here and removes it when the wait
@@ -549,11 +921,27 @@ export class KeysManagerService {
     hydrationWaiters = new Map();
     /**
      * True once the load-time hydration read is over (round-10 SF1). From then
-     * on no provider's read can land, so attribution is known for every provider
-     * — including one adopted after the read, whose OAuth rows did not exist
-     * when the projection was looked for.
+     * on no hydration read can land. It is NOT evidence that a given provider's
+     * projection was read (PR review round 17): a provider adopted after the
+     * snapshot was never in it, so readiness is decided per provider
+     * ({@link projectionOwnershipKnown}) and adoption reads its own projection.
      */
     hydrationSettled = false;
+    /**
+     * Credential-store generation of the ownership hydration (PR review round
+     * 27). A remounted credentials service starts a new pass while the previous
+     * store's reads can still be in flight; their answers describe records the
+     * new backend does not hold, so the epoch gates every write and settle of
+     * the pass that started it.
+     */
+    hydrationEpoch = 0;
+    /**
+     * Whether a credential store was ever attached (PR review round 27). The
+     * first attach is the startup mount and keeps its behaviour; every later one
+     * replaces the credential backend, so the ownership classification loaded
+     * from the previous one is stale and the read restarts from unknown.
+     */
+    credentialsMounted = false;
     /** Providers whose bounded-wait warning already fired (warn once). */
     hydrationWaitWarned = new Set();
     /** Channels whose lost-subscription warning already fired (warn once). */
@@ -569,8 +957,16 @@ export class KeysManagerService {
         this.typertRemote = Object.freeze({ service: this, serviceKey: SERVICE, namespace: NAMESPACE });
         this.rebuildBrokerMap();
         this.projectionHydration = this.hydrateProjectionOwnership();
+        // Startup self-heal: repair every managed provider whose persisted binding
+        // the serving credential no longer justifies. The pass waits per provider
+        // for its own ownership read (see {@link repairBrokerBindings}), so a
+        // wedged OAuth read cannot starve an api-key-only route.
+        void this.repairBrokerBindings().catch(error => {
+            this.warn(`startup broker binding repair failed: ${error instanceof Error ? error.message : String(error)}`);
+        });
         this.settledDisposer = this.watchAuthorizationSettled();
         this.recordUpdatedDisposer = this.watchGrantRecordUpdated();
+        this.refreshTransportAccountsIfIdle();
     }
     /**
      * MF3 load-time hydration: a projection outlives this process — pi-ai
@@ -582,7 +978,17 @@ export class KeysManagerService {
      * after a restart. An orphan projection — no matching row, e.g. a foreign
      * or stale grant — is left untouched: the manager never adopts a grant it
      * does not own, and out-of-band updates keep surfacing the native-
-     * management warning.
+     * management warning. A live record that is not a managed grant at all (a
+     * native api-key, an unrecognized payload) is foreign for the same reason
+     * (PR review round 4): it serves the route, so the startup repair must not
+     * bind the broker over it.
+     *
+     * EVERY managed provider's projection is read (PR review round 13), not
+     * only those with OAuth rows: a key-only pool can be overridden by a
+     * native grant persisted for the same route, and a skipped read left the
+     * startup repair free to bind the broker over it. The reads run
+     * concurrently so one provider's stalled read cannot delay another
+     * provider's own readiness (round 9).
      *
      * Returns its own completion (round-8 finding I-000108), and the returned
      * promise is already caught, so a failed hydration degrades to "no owner"
@@ -591,18 +997,23 @@ export class KeysManagerService {
      * each request waits on its own provider's landing instead.
      */
     hydrateProjectionOwnership() {
+        const epoch = this.hydrationEpoch;
+        const records = this.credentialRecords();
+        if (records === undefined) {
+            // The credentials service can mount after this plugin (PR review round
+            // 23): nothing was read, so ownership stays UNKNOWN. Settling here marked
+            // every provider hydrated, and the startup repair read the empty
+            // owner/foreign maps as "the key pool serves", binding the broker over a
+            // persisted projection it never saw. attachCredentials re-runs this read
+            // (and the repair) once the record half is reachable.
+            this.warnSubscriptionLost('credentials record access');
+            return Promise.resolve();
+        }
         return (async () => {
             try {
-                const records = this.credentialRecords();
-                if (records === undefined) {
-                    this.warnSubscriptionLost('credentials record access');
-                    return;
-                }
-                for (const providerRecord of Object.values(this.store.providers)) {
+                await Promise.all(Object.values(this.store.providers).map(async (providerRecord) => {
                     const provider = providerRecord.provider;
                     const accounts = providerRecord.keys.filter(candidate => candidate.kind === 'oauth' && candidate.oauth !== null);
-                    if (accounts.length === 0)
-                        continue;
                     try {
                         const grantKey = `${OAUTH_GRANT_RECORD_SCOPE}/${provider}`;
                         // Generation tag (round-3 finding 3): the read below is awaited, and
@@ -614,41 +1025,87 @@ export class KeysManagerService {
                             record = await records.readRecord(grantKey);
                         }
                         catch (error) {
+                            // PR review round 8: a failed read is not an absent projection.
+                            // Record it so readiness stays false and no repair binds the
+                            // broker over a grant this process could not see.
+                            // PR review round 23: unless a newer claim landed while this read
+                            // was in flight — a stale failure must not mark an established
+                            // owner unknown (same generation guard as the hydrated write).
+                            if (this.hydrationEpoch !== epoch || (this.ownershipGenerations.get(provider) ?? 0) !== generation)
+                                return;
+                            this.ownershipReadFailures.add(provider);
                             this.warn(`projection ownership hydration could not read ${grantKey}: ${error instanceof Error ? error.message : String(error)}`);
-                            continue;
+                            return;
                         }
-                        if (record === undefined || record.kind !== 'grant' || !isOAuthGrantPayload(record.payload))
-                            continue;
-                        const owner = matchOwningAccount(provider, accounts, record.payload);
+                        // No record: nothing projects this route, so the pool may serve it.
+                        if (record === undefined)
+                            return;
+                        // A live record this pool cannot interpret — a native api-key, an
+                        // unrecognized payload, or (for a key-only pool) any grant at all —
+                        // serves the route ahead of any broker reference exactly like an
+                        // unowned grant, so it is classified as foreign below (PR review
+                        // rounds 4 and 13).
+                        const owner = record.kind === 'grant' && isOAuthGrantPayload(record.payload)
+                            ? matchOwningAccount(provider, accounts, record.payload)
+                            : undefined;
                         // A newer activation/login claimed the owner while this read was in
-                        // flight: the stale read is discarded, never written over it.
-                        if ((this.ownershipGenerations.get(provider) ?? 0) !== generation)
-                            continue;
+                        // flight: the stale read is discarded, never written over it. A
+                        // remount replaced the whole store: its classification is gone too.
+                        if (this.hydrationEpoch !== epoch || (this.ownershipGenerations.get(provider) ?? 0) !== generation)
+                            return;
                         // A concurrent removal may have dropped the row while this read was
                         // in flight: never resurrect an owner entry for a row that is gone.
                         if (owner !== undefined && providerRecord.keys.some(candidate => candidate.id === owner.id)) {
                             this.activeAccounts.set(provider, owner.id);
+                            this.foreignProjections.delete(provider);
+                        }
+                        else {
+                            // Present but not a managed OAuth grant (PR review rounds 3–4):
+                            // the projection still serves, so the pool is not the route's
+                            // credential source and the startup repair must not bind it.
+                            this.foreignProjections.add(provider);
                         }
                     }
                     finally {
                         // This provider's own read is over (owner or not): its requests are
                         // attributable now and must not wait behind another provider's
-                        // stalled read (round-10 should-fix SF1).
-                        this.noteProviderHydrated(provider);
+                        // stalled read (round-10 should-fix SF1). A superseded pass does
+                        // not report readiness for a store it no longer describes.
+                        if (this.hydrationEpoch === epoch)
+                            this.noteProviderHydrated(provider);
                     }
-                }
+                }));
             }
             finally {
                 // The read is over (completed or abandoned): from now on no result can
                 // land, so every provider is ready — including one whose OAuth rows
                 // appear later, which this read could not have projected.
-                this.hydrationSettled = true;
-                this.settleHydrationWaits();
+                if (this.hydrationEpoch === epoch) {
+                    this.hydrationSettled = true;
+                    this.settleHydrationWaits();
+                }
             }
         })().catch(error => {
             this.warn(`projection ownership hydration failed: ${error instanceof Error ? error.message : String(error)}`);
         });
     }
+    /**
+     * Drop every ownership fact loaded from a previous credential store (PR
+     * review round 27). The classification is per backend: a record that existed
+     * in the old store says nothing about the remounted one, and a route whose
+     * old store held a managed projection would otherwise stay attributed to
+     * that account and off its surviving key pool. The epoch bump discards a read
+     * still in flight from the replaced store instead of letting its answer land
+     * over the new one; ownership stays unknown until the new pass reads.
+     */
+    invalidateProjectionOwnership() {
+        this.hydrationEpoch += 1;
+        this.activeAccounts.clear();
+        this.foreignProjections.clear();
+        this.hydratedProviders.clear();
+        this.ownershipReadFailures.clear();
+        this.hydrationSettled = false;
+    }
     /**
      * Record that one provider's hydration read is over — owner or not (SF1) —
      * and wake the requests waiting on that provider alone (SF2).
@@ -662,6 +1119,21 @@ export class KeysManagerService {
         for (const wake of [...waiters])
             wake();
     }
+    /**
+     * An authoritative projection read answered for this provider, so a failed
+     * startup hydration no longer leaves ownership unknown (PR review round 13:
+     * the marker used to survive until a restart — no attribution, no key
+     * selection, and row tests refused with "ownership is still loading"). The
+     * binding re-derive is queued behind the reconciliation that proved the
+     * read: its attribution decides the route's serving shape, and the startup
+     * repair was skipped while that shape was unknown.
+     */
+    noteProjectionReadSucceeded(provider) {
+        if (!this.ownershipReadFailures.delete(provider))
+            return;
+        this.noteProviderHydrated(provider);
+        void this.scheduleGrantReconciliation(provider, () => this.syncBindingAfterProjectionChange(provider));
+    }
     /** Release every provider's readiness wait when hydration cannot proceed. */
     settleHydrationWaits() {
         for (const provider of Object.keys(this.store.providers))
@@ -680,6 +1152,10 @@ export class KeysManagerService {
      * (I-000108).
      */
     waitForProviderHydration(provider, ms) {
+        // A failed read never becomes ready (PR review round 8): waiting cannot
+        // produce an answer this process does not have.
+        if (this.ownershipReadFailures.has(provider))
+            return Promise.resolve(false);
         if (this.hydrationSettled || this.hydratedProviders.has(provider))
             return Promise.resolve(true);
         return new Promise(resolve => {
@@ -701,7 +1177,9 @@ export class KeysManagerService {
                 resolve(landed);
             };
             const onLanded = () => {
-                wake(true);
+                // A failed read wakes the wait with "not known", never with a guess
+                // about the projection (PR review round 8).
+                wake(!this.ownershipReadFailures.has(provider));
             };
             timer = setTimeout(() => {
                 wake(false);
@@ -724,10 +1202,10 @@ export class KeysManagerService {
      * Wait (bounded) until projection-ownership hydration can attribute this
      * request, and report whether it did.
      *
-     * A provider without OAuth rows can never own a projection, so it never
-     * waits — a stalled read for some other provider must not delay it
-     * (round-9 should-fix: this used to gate every managed provider, API-key-
-     * only ones included).
+     * Readiness is decided PER PROVIDER (round-10 should-fix SF1): every managed
+     * provider's own projection read lands independently (PR review round 13), so
+     * a provider whose read has landed needs no wait and a stalled read for
+     * another provider cannot delay this one.
      *
      * Returns false when the bound elapsed first. The caller then treats
      * attribution as unknown (no owner) and keeps key state untouched: a
@@ -735,34 +1213,45 @@ export class KeysManagerService {
      * repeat the I-000108 corruption. The hydration promise is not cancelled,
      * so a late result still lands under the generation guard and later
      * requests are attributed normally.
-     *
-     * Readiness is decided PER PROVIDER (round-10 should-fix SF1). Hydration
-     * writes owners progressively, so racing the one global promise would
-     * discard an owner this provider already confirmed just because another
-     * provider's read stalled. A provider whose own read has landed — with an
-     * owner or with none — is ready without waiting, and the "unknown" fallback
-     * is confined to the requested provider's own unresolved read.
      */
     async awaitProjectionOwnership(providerId) {
-        const provider = this.store.provider(providerId);
-        if (provider === undefined)
-            return true;
-        const hasOauthRows = provider.keys.some(candidate => candidate.kind === 'oauth' && candidate.oauth !== null);
-        if (!hasOauthRows)
-            return true;
-        // This provider's own read already landed (or a newer claim already owns
-        // it, or the whole read is over): nothing can arrive later, so no wait.
-        if (this.hydrationSettled || this.hydratedProviders.has(providerId) || this.activeAccounts.has(providerId))
+        if (this.projectionOwnershipKnown(providerId))
             return true;
         const landed = await this.waitForProviderHydration(providerId, this.hydrationWaitMs);
         if (landed)
             return true;
         if (!this.hydrationWaitWarned.has(providerId)) {
             this.hydrationWaitWarned.add(providerId);
-            this.warn(`projection ownership hydration did not settle within ${this.hydrationWaitMs}ms for ${providerId}; requests proceed without an attributed account until it does`);
+            this.warn(this.ownershipReadFailures.has(providerId)
+                ? `projection ownership for ${providerId} could not be read; requests proceed without an attributed account until a restart`
+                : `projection ownership hydration did not settle within ${this.hydrationWaitMs}ms for ${providerId}; requests proceed without an attributed account until it does`);
         }
         return false;
     }
+    /**
+     * Whether this provider's projection ownership can already be decided
+     * without waiting (round-10 SF1, made the single readiness rule by PR review
+     * round 3). Every managed provider's projection is read at hydration (a
+     * key-only pool can be overridden by a persisted native grant, PR review
+     * round 13), so the rule is the same for all of them: this provider's own
+     * read landed, or a claim already owns it.
+     *
+     * The process-wide settled flag is deliberately NOT part of this rule (PR
+     * review round 17): a provider adopted after the snapshot was never read by
+     * it, so "hydration is over" says nothing about THAT route's projection.
+     * Adoption reads it itself ({@link readAdoptionProjection}) and an extra
+     * provider's profile is created by its own call, so every managed provider
+     * still answers through its own marker.
+     */
+    projectionOwnershipKnown(providerId) {
+        if (this.store.provider(providerId) === undefined)
+            return true;
+        // A failed read is unknown even after the whole hydration settled: the
+        // settled flag says no read can land, not that this one answered.
+        if (this.ownershipReadFailures.has(providerId))
+            return false;
+        return this.hydratedProviders.has(providerId) || this.activeAccounts.has(providerId);
+    }
     /**
      * Record that a newly committed grant became the provider's projection and
      * return that projection's generation (round-6 finding SF1).
@@ -788,6 +1277,7 @@ export class KeysManagerService {
      */
     claimProjectionOwner(provider, accountId) {
         this.activeAccounts.set(provider, accountId);
+        this.foreignProjections.delete(provider);
         this.noteProjectionCommitted(provider);
     }
     /**
@@ -841,8 +1331,47 @@ export class KeysManagerService {
         this.pruneAttempts(now);
         this.pruneLoginAttempts(now);
     }
+    /**
+     * Whether a continuation that resumes from an await must stop writing
+     * (PR review round 35). `shutdownRequested` is up for `close()`'s own
+     * pre-close restoration, which writes by design: it alone carries the
+     * module-private {@link PRE_CLOSE_RESTORE} capability (round 36), which is
+     * honoured only while that phase is running (round 37). Both facts are read
+     * here, at the caller's write decision, so a capability the phase left
+     * behind cannot pass a check made earlier.
+     */
+    persistenceRefused(capability) {
+        if (!this.closing && !this.shutdownRequested)
+            return false;
+        // PR review round 38: the capability is scoped to the one restoration pass
+        // that runs before shutdown closes the store. Once `closing` is set the
+        // pass is over for good, so a capability left over from a timed-out pass
+        // (or handed to a repeated `close()`) cannot write again.
+        return !(capability === PRE_CLOSE_RESTORE && this.preCloseRestorePhase && !this.closing);
+    }
     /** Stop accepting mutations, drain the queue, then persist the final snapshot. */
-    async close() {
+    close() {
+        // PR review round 38: shutdown is single-entry. A second call (or a
+        // concurrent one) joins the first instead of replaying the restoration,
+        // which would otherwise write to a store the first call already closed.
+        // Not `async`: callers share the identical promise, so a repeated close
+        // cannot observe a second shutdown.
+        if (this.closePromise !== undefined)
+            return this.closePromise;
+        const closing = this.closeOnce();
+        this.closePromise = closing;
+        return closing;
+    }
+    /** The body of the one shutdown this manager runs. */
+    async closeOnce() {
+        // PR review round 34: the entry marker goes up before the restoration, so
+        // the window this function spends putting borrowed projections back cannot
+        // accept a new test and a new borrow.
+        this.shutdownRequested = true;
+        // PR review round 33: `closing` refuses the in-window cleanup, so every
+        // outstanding borrow is put back first. A test whose request ignores the
+        // abort otherwise leaves the tested account projected past unload.
+        await this.restoreBorrowedWindows();
         this.closing = true;
         this.settledDisposer?.();
         this.settledDisposer = undefined;
@@ -861,9 +1390,96 @@ export class KeysManagerService {
         // Round-9 P1: the per-provider reconciliation chains are independent of
         // the mutation queue, so drain them before the store closes — a queued
         // echo must not write a grant record into a manager that is shutting down.
-        await Promise.allSettled([...this.grantReconciliations.values()]);
+        await this.drainGrantReconciliations();
         await this.store.close();
     }
+    /**
+     * Put every outstanding window's borrowed projection back before shutdown
+     * closes the store (PR review round 33).
+     *
+     * `close()` sets `closing`, which refuses {@link cleanupTestWindow} — the one
+     * identity-checked restoration — so a test whose request ignores the abort
+     * used to leave the tested account projected and the binding it released
+     * released, past unload and into the next startup. Each window's captured
+     * facts are restored through the same compare-by-payload path as the late
+     * reconcile, under one cleanup bound and the attempt fence (a superseded
+     * attempt writes nothing), and a window that released the binding re-syncs it
+     * against the restored serving source.
+     *
+     * The request itself is never waited for — an adapter can still rewrite the
+     * projection after its restore — so a restoration that cannot finish in the
+     * bound warns once and leaves the state to the next startup's hydration.
+     */
+    async restoreBorrowedWindows() {
+        // PR review round 37: the capability is scoped to this phase. The flag goes
+        // up before the first await and down however the phase ends — a restoration
+        // the cleanup deadline abandoned is still parked, and it resumes with the
+        // phase already over.
+        this.preCloseRestorePhase = true;
+        try {
+            for (const window of [...this.testWindows.values()]) {
+                const facts = window.facts;
+                if (facts === undefined)
+                    continue;
+                const attempt = (this.cleanupAttempts.get(window.provider) ?? 0) + 1;
+                this.cleanupAttempts.set(window.provider, attempt);
+                const stillCurrent = () => this.cleanupAttempts.get(window.provider) === attempt;
+                const failure = await this.withinCleanupDeadline(async () => {
+                    // QC fix wave 3 (W-001): a borrow or binding release still in flight
+                    // reads as the pre-borrow payload, so the restore would call the route
+                    // clean and let the write land afterwards.
+                    await this.awaitWindowMutations(window);
+                    // The window is still outstanding, so this is an in-window restore (not
+                    // the late one): the attempt fence is the only identity it needs. This
+                    // is also the one writer that holds the pre-close capability.
+                    const restored = await this.restoreProjection(facts.records, window.provider, window.row, facts.key, facts.previous, facts.borrowed, stillCurrent, false, PRE_CLOSE_RESTORE);
+                    if (restored !== undefined)
+                        return restored;
+                    if (!stillCurrent())
+                        return 'a newer cleanup attempt took over this provider';
+                    if (!window.releasedBinding)
+                        return undefined;
+                    // QC B4: the borrow released the profile's binding, so the restored
+                    // serving source must be written back to it.
+                    return await this.syncBrokerBinding(window.provider, { borrow: true })
+                        ? undefined
+                        : 'the route credential binding could not be restored';
+                });
+                if (failure !== undefined) {
+                    this.warn(`shutdown could not put the borrowed credential for ${window.provider} back (${failure}); the projection stays as the store holds it and the next startup's hydration restores it`);
+                }
+            }
+        }
+        finally {
+            this.preCloseRestorePhase = false;
+        }
+    }
+    /**
+     * Drain the grant chains under a hard bound (PR review round 29).
+     *
+     * The work is not cancelled — the credential seam offers no cancellation and
+     * a wedged provider request may never settle — it is only stopped from
+     * holding shutdown: the chain past the deadline is abandoned, and its late
+     * write can only land in a store that is closing anyway.
+     */
+    async drainGrantReconciliations() {
+        // The drain never rejects: a chain failure is that chain's own result.
+        const drained = Promise.allSettled([...this.grantReconciliations.values()]).then(() => false);
+        let timer;
+        const deadline = new Promise(resolve => {
+            timer = setTimeout(() => resolve(true), this.grantDrainDeadlineMs);
+            timer.unref?.();
+        });
+        try {
+            if (await Promise.race([drained, deadline])) {
+                this.warn('shutdown stopped waiting for a grant reconciliation still held by a connection test request that never settled');
+            }
+        }
+        finally {
+            if (timer !== undefined)
+                clearTimeout(timer);
+        }
+    }
     /** Push a user-facing warning that rides the next state response. */
     pushWarning(message) {
         this.warnings.push(message);
@@ -875,12 +1491,53 @@ export class KeysManagerService {
         this.warnings = [];
         return warnings;
     }
+    /**
+     * Report declared headers whose stored value no longer matches what the
+     * environment supplies. The stored value is never replaced — the user may
+     * have set it deliberately — but the divergence must be visible, because
+     * otherwise the route keeps sending the stale value forever.
+     */
+    warnHeaderDrift(extra, declared, stored) {
+        if (declared === undefined)
+            return;
+        for (const [header, value] of Object.entries(declared)) {
+            const storedKey = storedHeaderKey(stored, header);
+            if (storedKey === undefined || stored[storedKey] === value)
+                continue;
+            const envName = extra.headerEnv?.[header] ?? header;
+            this.pushWarning(`The stored ${storedKey} header on the ${extra.id} route differs from the value ${envName} now supplies; the stored value was kept.`);
+        }
+    }
     /** Current settings service, if the composition mounted one. */
     settingsService() {
         if (this.settings !== undefined)
             return this.settings;
         return this.ctx.get('settings');
     }
+    /**
+     * Mount the settings service — the host's `ctx.inject(['settings'])` seam.
+     *
+     * A mount that lands after construction retries the binding repair: the
+     * startup pass could not read a profile yet and would otherwise leave the
+     * route broken for the whole session.
+     */
+    attachSettings(settings) {
+        this.settings = settings;
+        // The repair decides from projection ownership, which the constructor
+        // hydrates asynchronously: a persisted projection read from an empty owner
+        // map would make the route look key-pool-served and bind it to the broker
+        // (PR review round 2). The pass therefore waits per provider for its own
+        // read — never for the process-wide promise, which one wedged OAuth read
+        // can hold forever (PR review round 3).
+        void this.repairBrokerBindings().catch(error => {
+            this.warn(`broker binding repair after the settings mount failed: ${error instanceof Error ? error.message : String(error)}`);
+        });
+    }
+    /** Unmount the settings service that a re-mount replaced. */
+    detachSettings(settings) {
+        if (this.settings === settings)
+            this.settings = undefined;
+    }
     /** Current raw credential provider. */
     credentialsRaw() {
         const current = this.ctx.get('credentials');
@@ -935,6 +1592,29 @@ export class KeysManagerService {
     oauthFlowAvailable(provider) {
         return this.oauthFlowFor(provider) !== undefined;
     }
+    /**
+     * Resolve one transport route's sign-in flow.
+     *
+     * The transports package registers `llm-omp-transports/<route>` itself, so
+     * the live flow list is also this manager's inventory of transport routes:
+     * a route with no registered flow is not a transport account surface, and a
+     * route whose record exists but whose flow is gone is not listed at all
+     * (there would be nothing to sign in with).
+     *
+     * The method id is the flow's own (`methods[0].id`), never a literal
+     * `'oauth'`: the scope prefix is the whole cross-package contract, and the
+     * transports package may name a method that is not OAuth. A flow with no
+     * method cannot be begun and is not a sign-in surface.
+     */
+    transportFlowFor(route) {
+        return (this.ctx.authorization?.list() ?? [])
+            .find(entry => entry.key === `${TRANSPORT_CREDENTIAL_SCOPE}/${route}` && transportMethodOf(entry) !== undefined);
+    }
+    /** Every registered transport flow, in seam order. */
+    transportFlows() {
+        return (this.ctx.authorization?.list() ?? [])
+            .filter(entry => entry.key.startsWith(`${TRANSPORT_CREDENTIAL_SCOPE}/`) && transportMethodOf(entry) !== undefined);
+    }
     /**
      * Warn once per channel: a lost subscription silently disables a whole
      * feature (harvest never runs; rotations never sync), so the degradation
@@ -1004,6 +1684,42 @@ export class KeysManagerService {
         else
             this.failLoginAttempt(attempt, new Error(`the sign-in attempt failed (${settlement || 'unknown outcome'})`));
     }
+    /**
+     * The seam interaction one attempt hands to its flow.
+     *
+     * Shared by the pi-ai and transport sign-ins: both surfaces park notices and
+     * prompts on the same {@link LoginAttempt} and are polled through
+     * `accountAttempt`; only what happens after `authorized` differs.
+     */
+    attemptInteraction(attempt) {
+        return {
+            notify: (notice) => {
+                attempt.notices.push(noticeView(notice));
+                if (attempt.notices.length > 32)
+                    attempt.notices.shift();
+                attempt.updatedAt = Date.now();
+            },
+            prompt: (prompt) => new Promise((resolve, reject) => {
+                if (attempt.settledAt !== undefined) {
+                    reject(new Error('This sign-in attempt has already ended'));
+                    return;
+                }
+                if (prompt.signal?.aborted === true) {
+                    reject(new Error('The sign-in prompt was withdrawn'));
+                    return;
+                }
+                attempt.status = 'prompt';
+                attempt.updatedAt = Date.now();
+                attempt.prompt = promptView(prompt);
+                attempt.resolvePrompt = resolve;
+                attempt.rejectPrompt = reject;
+                // Cancellation propagates to the awaited prompt: a seam-side
+                // withdrawal of this signal releases a flow parked here instead
+                // of leaving it pending forever.
+                prompt.signal?.addEventListener('abort', () => reject(new Error('The sign-in prompt was withdrawn')), { once: true });
+            }),
+        };
+    }
     /**
      * Start one interactive OAuth sign-in. Returns immediately with the
      * attempt view; the attempt walks `pending → (prompt ⇄ pending) →
@@ -1079,33 +1795,7 @@ export class KeysManagerService {
             this.loginsInFlight.delete(provider);
             throw new Error('The credential store does not support records; OAuth sign-in is unavailable');
         }
-        const interaction = {
-            notify: (notice) => {
-                attempt.notices.push(noticeView(notice));
-                if (attempt.notices.length > 32)
-                    attempt.notices.shift();
-                attempt.updatedAt = Date.now();
-            },
-            prompt: (prompt) => new Promise((resolve, reject) => {
-                if (attempt.settledAt !== undefined) {
-                    reject(new Error('This sign-in attempt has already ended'));
-                    return;
-                }
-                if (prompt.signal?.aborted === true) {
-                    reject(new Error('The sign-in prompt was withdrawn'));
-                    return;
-                }
-                attempt.status = 'prompt';
-                attempt.updatedAt = Date.now();
-                attempt.prompt = promptView(prompt);
-                attempt.resolvePrompt = resolve;
-                attempt.rejectPrompt = reject;
-                // Cancellation propagates to the awaited prompt: a seam-side
-                // withdrawal of this signal releases a flow parked here instead
-                // of leaving it pending forever.
-                prompt.signal?.addEventListener('abort', () => reject(new Error('The sign-in prompt was withdrawn')), { once: true });
-            }),
-        };
+        const interaction = this.attemptInteraction(attempt);
         const beginPromise = this.ctx.authorization.begin({
             key: flow.key,
             method: flow.method,
@@ -1156,29 +1846,235 @@ export class KeysManagerService {
         return [...this.loginAttempts.values()].sort((a, b) => b.createdAt - a.createdAt).map(attemptView);
     }
     /**
-     * Detach the parked prompt. With a reason the flow's awaited promise is
-     * rejected too — a parked prompt dropped un-rejected would leave the
-     * seam's flow (and the provider's single-flight slot) wedged until its
-     * own timeout, so every attempt-ending path passes one.
+     * Re-read every `llm-omp-transports/<route>` grant into
+     * {@link transportRows}.
+     *
+     * Every caller gets a pass appended after the one already in flight, so an
+     * awaiting caller observes a read that started after its own write (a
+     * removal, a sign-in commit). Poll-only callers use
+     * {@link refreshTransportAccountsIfIdle} instead, so a slow store cannot
+     * accumulate one pass per page tick. A failed read leaves that route's
+     * previous row alone instead of claiming the account disappeared; the next
+     * pass retries.
      */
-    dropPrompt(attempt, reason) {
-        const reject = attempt.rejectPrompt;
-        attempt.resolvePrompt = undefined;
-        attempt.rejectPrompt = undefined;
-        attempt.prompt = undefined;
-        if (attempt.status === 'prompt')
-            attempt.status = 'pending';
-        attempt.updatedAt = Date.now();
-        if (reject !== undefined && reason !== undefined)
-            reject(reason);
+    refreshTransportAccounts() {
+        const previous = this.transportRefresh ?? Promise.resolve();
+        const pass = previous.then(() => this.readTransportAccounts(), () => this.readTransportAccounts());
+        const tail = pass.then(() => undefined, () => undefined);
+        this.transportRefresh = tail;
+        void tail.then(() => {
+            if (this.transportRefresh === tail)
+                this.transportRefresh = undefined;
+        });
+        return pass;
     }
-    /** Finalize an attempt with a terminal status exactly once. */
-    finishLoginAttempt(attempt, status, error) {
-        if (attempt.settledAt !== undefined)
-            return;
-        attempt.settledAt = Date.now();
-        attempt.status = status;
-        if (error !== undefined) {
+    /** Poll hint: start a pass only when none is in flight. */
+    refreshTransportAccountsIfIdle() {
+        if (this.transportRefresh === undefined)
+            void this.refreshTransportAccounts();
+    }
+    /** One read pass over every registered transport route. */
+    async readTransportAccounts() {
+        try {
+            const flows = this.transportFlows();
+            if (flows.length === 0) {
+                this.transportRows = [];
+                return;
+            }
+            const records = this.credentialRecords();
+            const now = Date.now();
+            const rows = [];
+            for (const flow of flows) {
+                let record;
+                if (records !== undefined) {
+                    try {
+                        record = await records.readRecord(flow.key);
+                    }
+                    catch (error) {
+                        const previous = this.transportRows.find(row => row.scope === flow.key);
+                        if (previous !== undefined)
+                            rows.push(previous);
+                        this.warn(`transport account ${flow.key} could not be read: ${error instanceof Error ? error.message : String(error)}`);
+                        continue;
+                    }
+                }
+                rows.push(transportAccountOf(flow, record, now));
+            }
+            this.transportRows = rows;
+        }
+        catch (error) {
+            // Fire-and-forget callers (getState, the record watcher) must never see
+            // a rejection; the previous rows stay until the next pass.
+            this.warn(`transport account refresh failed: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    /**
+     * Remote: start one transport sign-in.
+     *
+     * The flow lives on the transports package's own key
+     * (`llm-omp-transports/<route>`), so the grant it commits stays that route's
+     * credential: nothing here harvests it into a pool row or a `llm-pi-ai`
+     * projection. The attempt is otherwise the same record the pi-ai dialog
+     * polls through `accountAttempt`, so the client reuses that dialog; an
+     * authorized outcome is terminal here (the flow has already committed).
+     */
+    async beginTransportLogin(route) {
+        if (typeof route !== 'string' || route.length === 0)
+            throw new TypeError('provider is required');
+        const flow = this.transportFlowFor(route);
+        if (flow === undefined)
+            throw new Error(`Provider "${route}" offers no transport sign-in flow`);
+        const pendingId = this.transportInFlight.get(route);
+        if (pendingId !== undefined) {
+            const pendingAttempt = this.loginAttempts.get(pendingId);
+            if (pendingAttempt !== undefined && pendingAttempt.settledAt === undefined)
+                return attemptView(pendingAttempt);
+            this.transportInFlight.delete(route);
+        }
+        const now = Date.now();
+        const attempt = {
+            id: `la_${(++this.loginSequence).toString(36)}_${randomBytes(4).toString('hex')}`,
+            provider: route,
+            status: 'pending',
+            notices: [],
+            createdAt: now,
+            updatedAt: now,
+            controller: new AbortController(),
+        };
+        this.loginAttempts.set(attempt.id, attempt);
+        this.capLoginAttempts();
+        this.transportInFlight.set(route, attempt.id);
+        const generation = this.transportGenerationOf(route);
+        // `transportFlowFor` already proved the seam is mounted and the flow has a
+        // method; the method id is the flow's own, not the pi-ai `'oauth'` literal.
+        const settled = this.ctx.authorization.begin({
+            key: flow.key,
+            method: transportMethodOf(flow),
+            interaction: this.attemptInteraction(attempt),
+            signal: attempt.controller.signal,
+        }).then(async (outcome) => {
+            // A removal during the attempt bumped the route's epoch: the account
+            // is gone, so a grant this flow wrote while being withdrawn must not
+            // recreate it. The seam refuses a commit after the abort, but a commit
+            // that had already started can still land.
+            if (this.transportGenerationOf(route) !== generation) {
+                await this.dropRemovedTransportGrant(flow.key);
+                this.finishLoginAttempt(attempt, 'cancelled');
+                return;
+            }
+            if (outcome.status === 'authorized') {
+                this.finishLoginAttempt(attempt, 'ready');
+                void this.refreshTransportAccounts();
+                return;
+            }
+            this.finishLoginAttempt(attempt, 'cancelled');
+        }, error => this.failLoginAttempt(attempt, error));
+        // A removal awaits this, so it deletes the grant only after the withdrawn
+        // attempt (and any late write it drops) is done. The route keeps its
+        // pending entry until the seam's `begin` resolves: an earlier settle
+        // (prune, release, cancel) must not hide a commit that is still in flight.
+        attempt.settled = settled.then(() => undefined, () => undefined).finally(() => {
+            if (this.transportInFlight.get(route) === attempt.id)
+                this.transportInFlight.delete(route);
+        });
+        return attemptView(attempt);
+    }
+    /**
+     * Remote: confirm one transport route's stored grant.
+     *
+     * A transport route has exactly one grant record and its adapter resolves
+     * that record per request, so the stored grant already IS the route's live
+     * credential. Activation is therefore a state-level re-read: it writes
+     * nothing (in particular no `llm-pi-ai/<route>` projection, which the
+     * transport route never consults) and reports the current status so the UI
+     * can tell "active" from "expired" or "sign in again".
+     */
+    async activateTransportAccount(route) {
+        if (this.transportFlowFor(route) === undefined)
+            throw new Error(`Provider "${route}" offers no transport account`);
+        await this.refreshTransportAccounts();
+        return this.buildState();
+    }
+    /**
+     * Remote: drop one transport route's grant record.
+     *
+     * The record is the whole account — the transports package re-creates none —
+     * so deleting it leaves the route signed out until the next sign-in. A live
+     * sign-in is withdrawn first: left running, its commit would recreate the
+     * grant this removal just deleted. No manager state is written, hence no
+     * `run` queue and no state flush.
+     */
+    async removeTransportAccount(route) {
+        const flow = this.transportFlowFor(route);
+        if (flow === undefined)
+            throw new Error(`Provider "${route}" offers no transport account`);
+        const records = this.credentialRecords();
+        if (records === undefined)
+            throw new Error('The credential store does not support records');
+        const pendingId = this.transportInFlight.get(route);
+        const pending = pendingId === undefined ? undefined : this.loginAttempts.get(pendingId);
+        // Key on the seam promise, not `settledAt`: the prune timeout, a provider
+        // release and a cancel settle the attempt record while `begin` is still
+        // pending (the seam refuses a withdraw during a commit). The epoch bump
+        // and the await must cover that window, or a late `authorized` recreates
+        // the grant this removal deleted.
+        if (pending !== undefined && pending.settled !== undefined) {
+            // Bump the epoch before the abort: the attempt's settle path reads it to
+            // know this removal owns the record, and this await covers that path.
+            this.transportRemovals.set(route, this.transportGenerationOf(route) + 1);
+            pending.controller.abort();
+            await pending.settled;
+        }
+        await records.deleteRecord(flow.key);
+        await this.refreshTransportAccounts();
+        return this.buildState();
+    }
+    /** The route's removal epoch; absent means never removed. */
+    transportGenerationOf(route) {
+        return this.transportRemovals.get(route) ?? 0;
+    }
+    /**
+     * Drop a grant a withdrawn sign-in wrote after its account was removed.
+     *
+     * The seam refuses a commit once the attempt's signal aborts, but a commit
+     * that had already started can still land. The account was deleted, so that
+     * write is deleted too instead of being reported as a signed-in route.
+     */
+    async dropRemovedTransportGrant(key) {
+        const records = this.credentialRecords();
+        if (records === undefined)
+            return;
+        try {
+            await records.deleteRecord(key);
+        }
+        catch (error) {
+            this.warn(`transport account ${key} could not be dropped after its removal: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    /**
+     * Detach the parked prompt. With a reason the flow's awaited promise is
+     * rejected too — a parked prompt dropped un-rejected would leave the
+     * seam's flow (and the provider's single-flight slot) wedged until its
+     * own timeout, so every attempt-ending path passes one.
+     */
+    dropPrompt(attempt, reason) {
+        const reject = attempt.rejectPrompt;
+        attempt.resolvePrompt = undefined;
+        attempt.rejectPrompt = undefined;
+        attempt.prompt = undefined;
+        if (attempt.status === 'prompt')
+            attempt.status = 'pending';
+        attempt.updatedAt = Date.now();
+        if (reject !== undefined && reason !== undefined)
+            reject(reason);
+    }
+    /** Finalize an attempt with a terminal status exactly once. */
+    finishLoginAttempt(attempt, status, error) {
+        if (attempt.settledAt !== undefined)
+            return;
+        attempt.settledAt = Date.now();
+        attempt.status = status;
+        if (error !== undefined) {
             attempt.error = error instanceof Error ? error.message : String(error);
         }
         this.dropPrompt(attempt, new Error(status === 'failed'
@@ -1211,6 +2107,11 @@ export class KeysManagerService {
      * recorded at that same broadcast (R6-SF1): it names the projection whose
      * failures own a cooldown, so the stale-window reset below clears only a
      * window attributed to an OLDER projection.
+     *
+     * A harvest that finds the attempt already settled writes neither the
+     * plugin-scope copy nor a row, but the projection the seam committed for
+     * this attempt is still demoted (ownership-checked, I-000122): a
+     * failed/cancelled login must not keep serving through the route.
      */
     async harvestLogin(attempt, committed, projectionGeneration) {
         // A revoke (provider release) may have finalized this attempt before
@@ -1304,11 +2205,20 @@ export class KeysManagerService {
                 // user sees is failed while the harvest would write the grant and
                 // the account row. Revalidate settlement immediately before the
                 // first credential write: a settled attempt must never grow a grant
-                // copy or a row. Nothing of this harvest is written yet, so the
-                // abort needs no compensation, and the release already published the
-                // terminal it owns.
-                if (attempt.settledAt !== undefined)
+                // copy or a row.
+                //
+                // I-000122: aborting the write is not enough. The seam committed
+                // THIS attempt's grant as the provider's `llm-pi-ai` projection at
+                // the settlement broadcast, so returning here would leave the route
+                // serving a grant whose login failed/cancelled. Compensate that
+                // projection through the same ownership-checked path the failure
+                // handler uses: only this attempt's captured payload is deleted and
+                // a foreign or newer live grant is never touched. The release
+                // already published the terminal it owns.
+                if (attempt.settledAt !== undefined) {
+                    await this.compensateFailedHarvest(attempt, harvest);
                     return;
+                }
                 await records.modifyRecord(grantRef, () => Promise.resolve({ kind: 'grant', payload: structuredClone(payload) }));
                 facts.wroteRef = true;
                 const now = Date.now();
@@ -1431,6 +2341,9 @@ export class KeysManagerService {
                 // owns it until activation or fallback says otherwise.
                 if (attempt.accountId !== undefined)
                     this.claimProjectionOwner(attempt.provider, attempt.accountId);
+                // The committed grant now serves this route, so any broker reference
+                // carried over from the key pool must go.
+                await this.syncBrokerBinding(attempt.provider);
                 // No terminal here: `run` flushes the state document after this
                 // callback resolves, and the ready terminal publishes below — only
                 // once persistence has actually resolved (round-2 review, step 3).
@@ -1477,6 +2390,10 @@ export class KeysManagerService {
             else {
                 await this.compensateFailedHarvest(attempt, harvest);
             }
+            // The rollback restored the rows and the owner map, so the binding must
+            // follow whatever serves the route now: this attempt's projection is
+            // gone, and the surviving pool must serve again (Codex P2).
+            await this.syncBindingAfterProjectionChange(attempt.provider);
         }
     }
     /**
@@ -1664,6 +2581,30 @@ export class KeysManagerService {
      * Resolves `ok: false` only when the compare/delete writes themselves
      * rejected; an ownership mismatch is the guard doing its job (the live
      * record belongs to someone else) and counts as a clean skip.
+     *
+     * Every manager-initiated projection deletion registers the one-shot
+     * {@link intentionalProjectionRemovals} marker before the delete, exactly
+     * as {@link decideAndDeleteProjection} does (I-000125). Unmarked, the
+     * removal's own `credentials/record-updated` echo reconciles as an
+     * external deletion: the route's previously active managed account is
+     * flagged `valueMissing`, its owner claim is dropped and a misleading
+     * "removed outside Keys Manager" warning is pushed — even though that
+     * row and its plugin-scope grant are untouched.
+     *
+     * The marker only silences that echo; the route's state is corrected
+     * explicitly. The removal leaves the route with no stored projection, so the
+     * provider's owner claim — whatever it named before this attempt's grant
+     * replaced the record — is untruthful: {@link oauthOwnerFor} keeps naming a
+     * row pi-ai no longer resolves, `wrapStream` skips key-pool selection, oauth
+     * failures are attributed to that row, and the client keeps "Set active"
+     * disabled — the account cannot be re-activated. The claim is therefore
+     * invalidated (I-000125), and ONLY the claim: the surviving row keeps its
+     * `grantRef` and its `valueMissing: false`, so it stays managed and
+     * re-activatable while the route falls back to its API-key pool.
+     *
+     * The marker is armed only while the provider is still managed: a released
+     * provider has no echo consumer, and a marker nothing consumes would stay
+     * armed for its whole TTL and mask a genuine out-of-band removal.
      */
     async revertHarvestProjection(attempt, harvest) {
         const records = this.credentialRecords();
@@ -1691,7 +2632,55 @@ export class KeysManagerService {
                 return undefined;
             });
             if (owns && await this.projectionStillMatches(records, projectionKey, decidedAgainst)) {
-                await records.deleteRecord(projectionKey);
+                // The claim this removal makes untruthful, captured before the awaited
+                // delete. A newer activation or login claiming the route while the
+                // delete is in flight wins: its generation moves, and its claim names
+                // whatever that writer actually put in place.
+                const ownerBeforeRemoval = this.activeAccounts.get(attempt.provider);
+                const generation = this.ownershipGenerations.get(attempt.provider) ?? 0;
+                // Mark BEFORE the delete, same one-shot bookkeeping the demotion
+                // path uses: the deletion's echo handler reads this marker across
+                // its own awaited record re-read, so the removal stays silent for
+                // this manager's own demotion instead of demoting the active
+                // account.
+                const markedAt = Date.now();
+                // Only arm the marker where an echo can reach its consumer: the
+                // dispatcher drops record-updates for an unmanaged provider, and a
+                // marker nothing consumes would mask a genuine out-of-band removal for
+                // its whole TTL.
+                const providerManaged = this.store.provider(attempt.provider) !== undefined;
+                if (providerManaged)
+                    this.intentionalProjectionRemovals.set(attempt.provider, markedAt);
+                try {
+                    await records.deleteRecord(projectionKey);
+                }
+                catch (error) {
+                    // A delete that threw removed nothing, so no own-removal echo is
+                    // coming. Revoke this call's marker before the failure leaves this
+                    // method — left in place it would consume a genuine out-of-band
+                    // removal as the manager's own for the whole TTL, hiding the
+                    // warning, the missing mark, and the stale owner cleanup. The
+                    // identity check keeps a newer marker untouched.
+                    if (providerManaged && this.intentionalProjectionRemovals.get(attempt.provider) === markedAt) {
+                        this.intentionalProjectionRemovals.delete(attempt.provider);
+                    }
+                    throw error;
+                }
+                // The removal succeeded: the projection the rows were claimed against
+                // is gone, so the provider's owner claim must go with it. The row is
+                // deliberately left untouched — same `grantRef`, still `valueMissing:
+                // false` — because it is still managed and its grant is still live;
+                // re-activating it re-projects the route.
+                if (ownerBeforeRemoval !== undefined
+                    && (this.ownershipGenerations.get(attempt.provider) ?? 0) === generation) {
+                    this.activeAccounts.delete(attempt.provider);
+                    this.store.touch();
+                }
+                // The projection the pool was hidden behind is gone, so the route
+                // falls back to whatever still serves it: rebind its pool here rather
+                // than leaving the profile unbound for pi-ai to bypass the broker
+                // (PR review round 2 must-fix).
+                await this.syncBindingAfterProjectionChange(attempt.provider);
             }
             else if (!owns) {
                 this.warn(`harvest compensation kept the projection for ${attempt.provider}: the live grant no longer matches this attempt's committed payload`);
@@ -1788,6 +2777,16 @@ export class KeysManagerService {
      * is still current before committing.
      */
     onGrantRecordUpdated(key) {
+        // A transport route's record is another package's credential: a write or
+        // removal there (its adapter re-authenticating, or a sign-in on another
+        // surface) only re-reads the account list. It must never reach the pi-ai
+        // reconciliation path below, which would look for a pool row that does not
+        // exist and warn about native management of a route this manager does not
+        // own.
+        if (key.startsWith(`${TRANSPORT_CREDENTIAL_SCOPE}/`)) {
+            void this.refreshTransportAccounts();
+            return;
+        }
         if (!key.startsWith(`${OAUTH_GRANT_RECORD_SCOPE}/`))
             return;
         const provider = key.slice(OAUTH_GRANT_RECORD_SCOPE.length + 1);
@@ -1830,6 +2829,17 @@ export class KeysManagerService {
      * removal is allowed to complete while the write is in flight.
      */
     async reconcileGrantRecord(provider, key) {
+        // PR review round 30: the shutdown drain abandons a chain that has not
+        // settled, and this body resumes after `close()`. Its whole result is a
+        // credential write-back plus a binding sync, so persistence is refused
+        // once shutdown started.
+        if (this.closing)
+            return;
+        // PR review round 32: a remount replaces the credential backend while this
+        // body awaits its read, and the answer then describes records the new store
+        // does not hold. The epoch gates every decision below — owner, foreign
+        // marker, readiness and the binding sync — exactly like the hydration pass.
+        const epoch = this.hydrationEpoch;
         const records = this.credentialRecords();
         if (records === undefined)
             return;
@@ -1837,8 +2847,6 @@ export class KeysManagerService {
         if (providerRecord === undefined)
             return;
         const accounts = providerRecord.keys.filter(candidate => candidate.kind === 'oauth' && candidate.oauth !== null);
-        if (accounts.length === 0)
-            return;
         const activeId = this.activeAccounts.get(provider);
         const active = activeId === undefined
             ? undefined
@@ -1848,7 +2856,29 @@ export class KeysManagerService {
         // the same generation guard load-time hydration applies.
         const generation = this.ownershipGenerations.get(provider) ?? 0;
         const record = await records.readRecord(key);
+        if (this.hydrationEpoch !== epoch)
+            return;
+        // PR review round 35: shutdown abandons this chain, so the body resumes
+        // here after `close()`. The read may finish; the writes below may not.
+        if (this.persistenceRefused())
+            return;
+        // PR review round 13: this read is authoritative for the provider's
+        // projection, so it answers what a failed startup hydration could not —
+        // ownership stops being unknown and the binding repair it skipped runs.
+        this.noteProjectionReadSucceeded(provider);
         if (record === undefined) {
+            // PR review round 31: a harvest outside this chain can commit and claim
+            // a newer projection while this read is in flight, so the absence above
+            // can already be superseded. The newer claim owns the route and settled
+            // the binding itself: this stale removal decides nothing — no owner
+            // delete, no rebind — it only consumes its own one-shot removal marker.
+            if ((this.ownershipGenerations.get(provider) ?? 0) !== generation) {
+                this.intentionalProjectionRemovals.delete(provider);
+                return;
+            }
+            // The projection is gone, so nothing foreign serves this route any more
+            // (PR review round 3).
+            this.foreignProjections.delete(provider);
             // This manager's own demotion marked the removal just before
             // deleting; while the marker is inside its TTL window the echo is
             // ours — consume the one-shot marker and stay silent. An expired
@@ -1856,6 +2886,11 @@ export class KeysManagerService {
             const markedAt = this.intentionalProjectionRemovals.get(provider);
             if (markedAt !== undefined && Date.now() - markedAt <= INTENTIONAL_REMOVAL_TTL_MS) {
                 this.intentionalProjectionRemovals.delete(provider);
+                // The manager's own removal left no projection: converge the binding
+                // with the state the removal created, so the surviving pool serves
+                // through the broker instead of pi-ai's bare credential (PR review
+                // round 2).
+                await this.syncBindingAfterProjectionChange(provider);
                 return;
             }
             if (markedAt !== undefined)
@@ -1870,20 +2905,52 @@ export class KeysManagerService {
                 this.store.touch();
                 this.pushWarning(`The ${provider} OAuth grant was removed outside Keys Manager; the route now resolves through its API-key pool.`);
             }
+            // The row is demoted (or was never the owner) and nothing projects the
+            // route, so the binding must name the key pool now — an unbound profile
+            // here read as a mismatch. This runs for EVERY confirmed deletion, not
+            // only an owned one (PR review round 3): a native writer can replace the
+            // managed projection first and delete it later, leaving the pool to
+            // serve an unbound profile.
+            await this.syncBindingAfterProjectionChange(provider);
             return;
         }
+        // I-000125 marker hygiene: the removal branch above is the marker's ONLY
+        // consumer, so nothing may return before it. A provider that holds no
+        // OAuth row cannot be demoted (nothing to mark and nobody to warn), but
+        // its own removal echo still lands here — returning first would leave the
+        // marker armed for its whole TTL and mask a genuine out-of-band removal of
+        // the projection that serves a row added inside that window.
+        // PR review round 19 (I-000182): the classification below runs for a
+        // key-only provider too. An early return on `accounts.length === 0` left
+        // the foreign marker unset while the native api-key / unrecognized record
+        // still served the route ahead of the broker, so the queued binding repair
+        // treated the pool as the serving source and bound/kept the broker
+        // reference over it. With no OAuth row the unowned-grant branch below
+        // classifies a valid grant the same way.
         if (record.kind === 'api-key') {
             // Native api-key management took the route over: the manager no
             // longer owns any projection here.
             this.activeAccounts.delete(provider);
+            // A live record Keys Manager does not own still serves ahead of the
+            // broker reference, so the pool is not the route's source (round 3).
+            this.foreignProjections.add(provider);
+            // A pending hydration read of the previous owner is now stale: the
+            // route serves a record this pool does not own (round 40).
+            this.noteProjectionCommitted(provider);
             this.pushWarning(`The ${provider} route now holds a natively managed API-key credential; the Keys Manager account pool is not serving it.`);
+            // pi-ai resolves the broker reference before this record, so a route
+            // left bound would keep serving the pool (PR review round 4).
+            await this.syncBindingAfterProjectionChange(provider);
             return;
         }
         if (!isOAuthGrantPayload(record.payload)) {
             // An unrecognized payload is not ours to interpret: drop the stale
             // owner entry so failure attribution and demotion never fire on it.
             this.activeAccounts.delete(provider);
+            this.foreignProjections.add(provider);
+            this.noteProjectionCommitted(provider);
             this.pushWarning(`The ${provider} OAuth record holds an unrecognized payload; Keys Manager left it untouched.`);
+            await this.syncBindingAfterProjectionChange(provider);
             return;
         }
         const payload = record.payload;
@@ -1895,9 +2962,13 @@ export class KeysManagerService {
         const owner = matchOwningAccount(provider, accounts, payload);
         if (owner === undefined) {
             // A foreign account's grant serves the route: no pool row owns the
-            // projection, so the previous owner entry must not survive it.
+            // projection, so the previous owner entry must not survive it — and the
+            // live record keeps the pool from claiming the route (round 3).
             this.activeAccounts.delete(provider);
+            this.foreignProjections.add(provider);
+            this.noteProjectionCommitted(provider);
             this.pushWarning(`An OAuth account for ${provider} is managed natively outside Keys Manager and is not part of the account pool.`);
+            await this.syncBindingAfterProjectionChange(provider);
             return;
         }
         // C6-1 pre-write revalidation: removeAccount / releaseProvider run on
@@ -1958,6 +3029,15 @@ export class KeysManagerService {
         // above only reconciles llm-pi-ai/-scope keys.
         const previousRef = owner.oauth.grantRef;
         await records.modifyRecord(rotatedRef, () => Promise.resolve({ kind: 'grant', payload: structuredClone(payload) }));
+        // PR review round 32: the write above landed in the store this body started
+        // on; a remount since then makes every following decision (the owner
+        // cleanup, the generation commit) describe the replaced backend.
+        if (this.hydrationEpoch !== epoch)
+            return;
+        // PR review round 35: the write above is the last one this body may start
+        // once shutdown began; the compensation and commit below are refused here.
+        if (this.persistenceRefused())
+            return;
         // C6-1 post-write revalidation: a removal that landed while the write
         // was in flight already deleted its own record, so the generation just
         // written must be compensated or it outlives the account. The removed
@@ -1982,6 +3062,14 @@ export class KeysManagerService {
         // distinct record is deleted: in the same-ref case the write landed on
         // the row's own current record and must stay.
         const stillCurrent = await this.rotationStillCurrent(records, provider, key, rotatedRef, claimedGeneration);
+        // PR review round 32: the staleness probe is an await; the store may have
+        // been replaced under it.
+        if (this.hydrationEpoch !== epoch)
+            return;
+        // PR review round 35: the probe is another await; a shutdown that started
+        // under it refuses the discard/compensation below.
+        if (this.persistenceRefused())
+            return;
         if (!stillCurrent) {
             if (rotatedRef !== previousRef) {
                 // R5-MF1: the staleness probe is awaited, and a settled harvest can
@@ -2007,28 +3095,24 @@ export class KeysManagerService {
             }
             return;
         }
-        // SF2: once the new payload persists and the row points at it, delete
-        // the superseded generation's plugin-scope record — harvest parity. A
-        // rotated refresh token must not strand its secret-bearing record
-        // outside manager state; cleanup is best-effort with a warning,
-        // exactly like the harvest-time cleanup.
-        if (previousRef !== rotatedRef) {
-            owner.oauth = { ...owner.oauth, grantRef: rotatedRef };
-            try {
-                await records.deleteRecord(previousRef);
-            }
-            catch (error) {
-                this.warn(`cleanup of the superseded grant record failed for ${provider}: ${error instanceof Error ? error.message : String(error)}`);
-            }
-        }
-        // Refresh-derived identity fields are informational and update in place.
-        owner.oauth = {
-            ...owner.oauth,
-            ...(payload.email === undefined ? {} : { email: payload.email }),
-            ...(payload.accountId === undefined ? {} : { accountId: payload.accountId }),
-            ...(typeof payload.expires === 'number' && Number.isFinite(payload.expires) ? { expiresAt: payload.expires } : {}),
-        };
-        this.store.touch();
+        // SF2: once the new payload persists, the commit repoints the row at it
+        // and deletes the superseded generation's plugin-scope record (harvest
+        // parity). A rotated refresh token must not strand its secret-bearing
+        // record outside manager state; cleanup is best-effort with a warning,
+        // exactly like the harvest-time cleanup. QC N1: the ref scheme, identity
+        // merge and cleanup are the one write-back owned by
+        // {@link commitGrantGeneration}, shared with the connection test.
+        // PR review round 35: the commit is this body's persisted state write; a
+        // shutdown that began under any of the awaits above refuses it.
+        if (this.persistenceRefused())
+            return;
+        await this.commitGrantGeneration(provider, owner, payload, rotatedRef);
+        // PR review round 44: the projection now serves this managed account again,
+        // so a profile that still names the broker would make pi-ai resolve the
+        // pool first and fail with MISSING_CREDENTIAL. Converge the binding with the
+        // serving source, exactly like activation and harvest do — off the grant
+        // chain, which this body runs on (a settings write inside it would re-enter).
+        void this.syncBindingAfterProjectionChange(provider);
     }
     /**
      * C6-1 revalidation: the row captured before an awaited credential write
@@ -2184,6 +3268,10 @@ export class KeysManagerService {
                 this.intentionalProjectionRemovals.delete(provider);
                 await records.modifyRecord(`${OAUTH_GRANT_RECORD_SCOPE}/${provider}`, () => Promise.resolve({ kind: 'grant', payload: structuredClone(stored.payload) }));
                 this.claimProjectionOwner(provider, row.id);
+                // The re-activated grant is the serving credential again, so a broker
+                // reference left by the key pool must go (see syncBrokerBinding): the
+                // committed projection is not rolled back by a settings failure.
+                await this.syncBrokerBinding(provider);
             });
             row.valueMissing = false;
             // Round-5 finding M1: manual recovery ends the cooling window too, the
@@ -2200,6 +3288,1389 @@ export class KeysManagerService {
             return this.buildState();
         });
     }
+    /**
+     * Remote: send one minimal request with the selected key or account row.
+     *
+     * Observation-only by construction: the request runs under a test-only
+     * request scope, so the broker answers with the pinned credential and the
+     * stream listener skips selection and every health/binding write. An OAuth
+     * row's grant is projected only for the duration of the request; the
+     * projection (and the in-memory owner) that served the route before is
+     * restored even when the request fails, so a test never changes which
+     * account the route is on.
+     *
+     * Every expected refusal is a structured `{ ok: false, error }` result
+     * (M2): the inline row line is the only failure surface, so a refusal must
+     * not also raise the page-level banner a thrown RPC error produces.
+     */
+    async testKey(provider, keyId) {
+        // PR review round 34: shutdown marks its entry before it restores the
+        // outstanding borrows, and that restoration is not in this test's window —
+        // so a test arriving now would borrow during it and outlive it.
+        if (this.shutdownRequested)
+            return this.shutdownEntryResult();
+        // PR review round 12: a removal holds the provider from its entry, before
+        // its first await, so a test cannot start in the window this check would
+        // otherwise miss — read the grant and the projection while the removal is
+        // deleting them, then re-project the removed account.
+        if (this.removalsInProgress.has(provider)) {
+            return {
+                ok: false,
+                latencyMs: 0,
+                error: `Provider "${provider}" is being removed; run the connection test again once the removal finishes.`,
+            };
+        }
+        const record = this.store.provider(provider);
+        if (record === undefined)
+            return { ok: false, latencyMs: 0, error: `Provider "${provider}" is not managed` };
+        const row = record.keys.find(candidate => candidate.id === keyId);
+        if (row === undefined)
+            return { ok: false, latencyMs: 0, error: `Key "${keyId}" not found on ${provider}` };
+        // QC fix wave 2: an abandoned window owns this provider until its cleanup
+        // completed. Refused before the running-test check below, because the
+        // abandoned test keeps that entry on purpose: the route's projection is
+        // still unreconciled, so a second test would borrow it twice.
+        if (this.cleaningTests.has(provider)) {
+            // QC fix wave 3 (W-002): the fence must be able to clear itself, so this
+            // attempt first runs one bounded cleanup of the abandoned window instead
+            // of refusing on it forever. A failed attempt still refuses; a successful
+            // one releases the isolation and the requested test proceeds.
+            if (!await this.recoverAbandonedWindow(provider)) {
+                return { ok: false, latencyMs: 0, error: 'A previous test is still being cleaned up' };
+            }
+        }
+        // PR review round 15: the recovery above awaits the abandoned window's
+        // cleanup, and that cleanup is what lifts the fence a removal's own
+        // precheck reads. A removal beginning inside that await therefore passes
+        // its precheck (no fence, no registered test), parks in its credential
+        // deletion, and this attempt would register, read the still-present grant
+        // and re-project the account the removal is deleting. The entry check
+        // cannot cover the await, so the markers are read again here.
+        if (this.removalsInProgress.has(provider) || this.retiringAccounts.has(row)) {
+            return {
+                ok: false,
+                latencyMs: 0,
+                error: `Provider "${provider}" is being removed; run the connection test again once the removal finishes.`,
+            };
+        }
+        // Concurrent tests would race the projection save/restore; one at a time
+        // per provider is enough for a per-row action and keeps the restore exact
+        // (QC N7: the lock covers both row kinds, the isolation guard only the
+        // kind that actually borrows).
+        if (this.testsActive.has(provider)) {
+            return { ok: false, latencyMs: 0, error: 'A test for this provider is already running' };
+        }
+        // Everything that awaits — the ownership readiness wait (QC B6) and the
+        // request — belongs to the guarded promise, so a second call cannot slip
+        // past the lock during the wait.
+        const window = {
+            provider,
+            row,
+            borrowBinding: false,
+            releasedBinding: false,
+            mutations: [],
+            cleaned: false,
+            settled: false,
+            held: false,
+            lateReconcileRequested: false,
+        };
+        // PR review round 21: the request is over when the guarded promise settles,
+        // and that is what a held cleanup waits for. The marker is registered before
+        // any settlement listener (the abandon retry), so that retry observes a
+        // settled window instead of re-holding it forever.
+        const test = this.runRowTest(record, row, window).finally(() => {
+            window.settled = true;
+        });
+        window.test = test;
+        this.testsActive.set(provider, test);
+        // PR review round 33: registered with the lock, because shutdown restores
+        // this window's borrow even when the test promise never settles.
+        this.testWindows.set(provider, window);
+        // The guard holds the whole test as a promise, not just a membership
+        // flag: `streamListener` awaits it so no ordinary request is served by —
+        // or attributed to — the grant an OAuth row test has borrowed. An api-key
+        // test borrows nothing, so it never isolates ordinary traffic (QC N7).
+        if (row.kind === 'oauth')
+            this.testsInFlight.set(provider, test);
+        // QC B3 + QC fix wave 2: this watchdog, not only the finally below, ends a
+        // test wedged in an untimed seam call — and it ends the window the way the
+        // test itself would, because releasing the provider without putting the
+        // borrowed projection and binding back hands ordinary traffic the tested
+        // account's credential.
+        const watchdog = setTimeout(() => {
+            this.abandonTestWindow(window);
+        }, this.isolationWaitMs);
+        watchdog.unref?.();
+        try {
+            return await test;
+        }
+        finally {
+            clearTimeout(watchdog);
+            if (this.testsActive.get(provider) === test)
+                this.testsActive.delete(provider);
+            if (this.testWindows.get(provider)?.test === test)
+                this.testWindows.delete(provider);
+            // PR review MF1: a window whose cleanup could not put the route back
+            // (normal path or watchdog) keeps its isolation entry until a recovery
+            // attempt succeeds, so ordinary traffic is never served by the borrowed
+            // grant while the fence is up.
+            if (this.testsInFlight.get(provider) === test && !this.cleaningTests.has(provider))
+                this.testsInFlight.delete(provider);
+        }
+    }
+    /**
+     * Take over a test window that did not settle within the isolation deadline
+     * (QC fix wave 2) or whose own cleanup could not restore the route (PR
+     * review MF1).
+     *
+     * The fence is set synchronously, before the first cleanup await: the wedged
+     * test may resume at any await from here, and it must observe the
+     * abandonment before it starts a borrow or restores from its own stale
+     * snapshot. The provider keeps its isolation entry until the cleanup
+     * completed — see {@link settleAbandonedWindow}.
+     */
+    abandonTestWindow(window, origin = 'deadline') {
+        // One cleanup owner per window: the watchdog and the normal path can both
+        // observe the same failure, and a second owner would put two cleanups on
+        // one route.
+        if (window.cleaned)
+            return;
+        window.cleaned = true;
+        this.cleaningTests.add(window.provider);
+        this.abandonedWindows.set(window.provider, window);
+        void this.settleAbandonedWindow(window, origin);
+    }
+    /**
+     * Clean up one abandoned window and release its provider only on success.
+     *
+     * A cleanup that cannot finish needs the same untimed seam the wedged test is
+     * parked in, so it fails exactly like the test did. Releasing the provider
+     * then would serve ordinary traffic from the borrowed grant (or, on a
+     * broker-bound profile, from a route whose binding was released and never
+     * restored), so the isolation entry and the fence both stay. Two events can
+     * retry the cleanup: the abandoned promise's settlement, and the next test
+     * attempt ({@link recoverAbandonedWindow}, QC fix wave 3 W-002) — a promise
+     * that settles while the seam is still wedged must not be the only path.
+     */
+    async settleAbandonedWindow(window, origin) {
+        const failure = await this.attemptAbandonedCleanup(window);
+        const cause = origin === 'deadline'
+            ? `did not settle within ${this.isolationWaitMs}ms`
+            : 'could not be cleaned up when it finished';
+        if (failure === undefined && !window.held) {
+            this.warn(`connection test for ${window.provider} ${cause}; its borrowed credential was put back and the provider slot is released`);
+            return;
+        }
+        if (failure === undefined) {
+            // PR review round 21: the route is back, but the request that borrowed it
+            // is still running and can refresh and rewrite that projection. The
+            // provider stays isolated until the settlement reconciles the late write
+            // and releases it.
+            this.warn(`connection test for ${window.provider} ${cause}; its borrowed credential was put back, but its request has not settled, so the provider stays isolated until it does`);
+        }
+        else {
+            this.warn(`connection test for ${window.provider} ${cause} and its cleanup did not complete (${failure}); the provider stays isolated`);
+        }
+        const pending = window.test;
+        if (pending === undefined)
+            return;
+        const retry = () => { void this.retryAbandonedWindow(window); };
+        void pending.then(retry, retry);
+    }
+    /** One later cleanup attempt for an abandoned window, once the seam answers again. */
+    async retryAbandonedWindow(window) {
+        if (!this.cleaningTests.has(window.provider))
+            return;
+        if (this.abandonedWindows.get(window.provider) !== window)
+            return;
+        await this.recoverAbandonedWindow(window.provider, 'settled');
+    }
+    /**
+     * One bounded cleanup attempt for a fenced provider (QC fix wave 3, W-002).
+     *
+     * Returns whether the provider is servable again. The caller's attempt is
+     * what makes the fence self-clearing: `testKey` calls this before refusing,
+     * so isolation no longer depends on the abandoned promise settling after the
+     * seam recovered. A failed attempt keeps the fence and warns exactly once.
+     */
+    async recoverAbandonedWindow(provider, origin = 'next-attempt') {
+        const window = this.abandonedWindows.get(provider);
+        if (window === undefined)
+            return !this.cleaningTests.has(provider);
+        const failure = await this.attemptAbandonedCleanup(window);
+        if (failure === undefined && !window.held) {
+            this.warn(origin === 'settled'
+                ? `the abandoned connection test for ${provider} settled; its borrowed credential was put back and the provider slot is released`
+                : `the abandoned connection test for ${provider} was cleaned up on the next attempt; its borrowed credential was put back and the provider slot is released`);
+            return true;
+        }
+        if (failure === undefined) {
+            // PR review round 21: the cleanup put the route back, but the request it
+            // borrowed it for is still running and can rewrite the projection, so the
+            // provider is not servable yet.
+            this.warn(`the abandoned connection test for ${provider} was cleaned up, but its request has not settled; the provider stays isolated until it does`);
+            return false;
+        }
+        this.warn(`the abandoned connection test for ${provider} is still fenced (${failure}); the provider stays isolated`);
+        return false;
+    }
+    /**
+     * Run the window's cleanup under its hard deadline and drop the provider's
+     * isolation only when it completed. Returns the reason it could not finish.
+     *
+     * PR review round 21: the request that borrowed the route is not part of the
+     * cleanup, so a cleanup can finish while that request is still able to
+     * refresh and rewrite the borrowed projection. Such a window is held
+     * ({@link RowTestWindow.held}) — the fence and the isolation entries stay —
+     * and only its settlement reconciles the late write and releases it.
+     */
+    async attemptAbandonedCleanup(window) {
+        const provider = window.provider;
+        const attempt = (this.cleanupAttempts.get(provider) ?? 0) + 1;
+        this.cleanupAttempts.set(provider, attempt);
+        const stillCurrent = () => this.cleanupAttempts.get(provider) === attempt;
+        this.cleaningTests.add(provider);
+        const failure = await this.withinCleanupDeadline(() => this.cleanupTestWindow(window, stillCurrent));
+        if (failure !== undefined)
+            return failure;
+        // The work outlived its deadline and a newer attempt took the provider
+        // over: its writes may finish (they were decided against the live store),
+        // but it may not release state that attempt now owns.
+        if (!stillCurrent())
+            return 'a newer cleanup attempt took over this provider';
+        if (!window.settled && window.facts !== undefined) {
+            // PR review round 21: the route is back, but the request that borrowed
+            // this projection is still running and can refresh and rewrite it. Hold
+            // the isolation (the fence and the entries above stay) until that
+            // settlement reconciles the late write and releases the provider.
+            window.held = true;
+            return undefined;
+        }
+        // PR review round 28: the request settled while this cleanup ran, so its
+        // settlement could not reconcile the late write itself — a running cleanup
+        // reads as the route's owner. Reconcile that write here, before the release
+        // hands the route back: a failure keeps the fence for the next attempt.
+        if (window.lateReconcileRequested) {
+            window.lateReconcileRequested = false;
+            const late = await this.withinCleanupDeadline(() => this.reconcileLateWindowProjection(window, true, stillCurrent));
+            if (!stillCurrent())
+                return 'a newer cleanup attempt took over this provider';
+            if (late !== undefined)
+                return late;
+        }
+        this.releaseAbandonedWindow(window);
+        return undefined;
+    }
+    /** Drop every isolation entry this window still owns, identity-checked. */
+    releaseAbandonedWindow(window) {
+        if (this.testsActive.get(window.provider) === window.test)
+            this.testsActive.delete(window.provider);
+        if (this.testsInFlight.get(window.provider) === window.test)
+            this.testsInFlight.delete(window.provider);
+        if (this.abandonedWindows.get(window.provider) === window)
+            this.abandonedWindows.delete(window.provider);
+        // PR review round 33: a released window is no longer outstanding, so
+        // shutdown does not restore over the newer window's borrow.
+        if (this.testWindows.get(window.provider) === window)
+            this.testWindows.delete(window.provider);
+        window.held = false;
+        this.cleaningTests.delete(window.provider);
+    }
+    /**
+     * Put the route back the way the window found it: the mutations this window
+     * started, then the projection (compare-by-payload and rotation-aware, so
+     * nothing a writer stored meanwhile is overwritten), then the binding — the
+     * original finally's order, because the binding decision reads the restored
+     * owner map — then the borrow marker. Returns the reason the cleanup could
+     * not complete.
+     *
+     * `stillCurrent` is passed by abandoned-window attempts only: a superseded
+     * attempt that outlived its deadline may finish its writes, but the
+     * provider-wide borrow marker belongs to the newest attempt (PR review
+     * round 2) — deleting it would let ordinary traffic reach a newer window's
+     * borrowed projection.
+     */
+    async cleanupTestWindow(window, stillCurrent) {
+        // PR review round 30: the watchdog can abandon this window during or after
+        // shutdown. Every step below writes (credential record, binding, state), so
+        // the cleanup is refused instead of landing after `close()`; the process is
+        // going away, which leaves the borrowed projection as the store holds it.
+        if (this.closing)
+            return 'Keys Manager is shutting down; the test cleanup was skipped';
+        // QC fix wave 3 (W-001): a re-read cannot tell the pre-borrow payload from
+        // a write that has not landed yet, so the cleanup first waits for the
+        // borrow/binding mutations this window started. Past the caller's deadline
+        // an unsettled mutation is a failed cleanup, not a clean route.
+        await this.awaitWindowMutations(window);
+        // PR review round 35: the wait above is an await, and shutdown's own
+        // restoration owns every outstanding window from its entry — this cleanup
+        // must not write after it.
+        if (this.persistenceRefused())
+            return 'Keys Manager is shutting down; the test cleanup was skipped';
+        const facts = window.facts;
+        if (facts !== undefined) {
+            // PR review round 28: a restore that starts now reads the state the
+            // route carries at this moment, so it also covers a settlement that
+            // asked for a late reconcile before it began; only a settlement landing
+            // while this restore runs still needs the cleanup to re-read afterwards.
+            window.lateReconcileRequested = false;
+            const restored = await this.restoreProjection(facts.records, window.provider, window.row, facts.key, facts.previous, facts.borrowed, stillCurrent);
+            if (restored !== undefined)
+                return restored;
+        }
+        // PR review round 3: a superseded attempt may not persist a binding
+        // decision derived from a world a newer window now owns.
+        if (stillCurrent !== undefined && !stillCurrent())
+            return 'a newer cleanup attempt took over this provider';
+        // PR review round 35: the restore above awaited; a shutdown that started
+        // under it refuses the binding write below.
+        if (this.persistenceRefused())
+            return 'Keys Manager is shutting down; the test cleanup was skipped';
+        // QC B4: one sync at window end, after the owner map and the projection
+        // are back, so the persisted binding matches the state the route actually
+        // restored to.
+        // QC fix wave 3 (S-003): unconditionally, because a binding decision the
+        // borrow made {@link syncBrokerBinding} skip (an `addKey` inside the
+        // window) is only observed here. It stays a no-op when nothing changed and
+        // never overwrites a value Keys Manager did not write; only a window that
+        // actually released the binding reports a refused write as a failure.
+        const rebound = await this.syncBrokerBinding(window.provider, { borrow: true });
+        if (!rebound && window.releasedBinding) {
+            return 'The route credential binding could not be restored after the test; repair it in Models before relying on this route.';
+        }
+        if (stillCurrent === undefined || stillCurrent())
+            this.testBindingBorrows.delete(window.provider);
+        return undefined;
+    }
+    /**
+     * Reconcile the projection once an abandoned window's request finally
+     * settles (PR review round 13).
+     *
+     * The watchdog's cleanup can complete before the wedged request resumes: an
+     * adapter that ignored the abort then refreshes and rewrites the borrowed
+     * grant, and the abandoned window used to skip cleanup on settlement — so
+     * the tested account stayed projected over the restored one and served
+     * ordinary traffic. The shared compare-by-payload restore is idempotent and
+     * only touches a projection this test left (the borrowed grant or a
+     * rotation of the tested row): a foreign payload survives, and a newer
+     * generation is written back to the tested row before the pre-test
+     * projection is restored.
+     *
+     * Returns the failure, so a caller that releases the provider afterwards (PR
+     * review round 21) can keep the fence instead. `ownsFence` is passed by the
+     * settlement of a held window and by the cleanup that releases a window whose
+     * settlement it deferred (PR review round 28): both already own the
+     * provider's fence, which the default guards would read as a competing
+     * cleanup and skip.
+     */
+    async reconcileLateWindowProjection(window, ownsFence = false, stillCurrent) {
+        const facts = window.facts;
+        if (facts === undefined)
+            return undefined;
+        const provider = window.provider;
+        if (!ownsFence) {
+            // A cleanup that is still running — or one that gave up and left the
+            // provider fenced — owns the route: its own attempt reads the late state
+            // and reconciles it, and this late promise must not race it. PR review
+            // round 28: that attempt only knows about the late write through this
+            // marker, set synchronously with `window.settled` in the caller, so a
+            // cleanup that observes a settled window also observes this request.
+            if (this.cleaningTests.has(provider)) {
+                if (this.abandonedWindows.get(provider) === window)
+                    window.lateReconcileRequested = true;
+                return undefined;
+            }
+            const active = this.testsActive.get(provider);
+            if (active !== undefined && active !== window.test)
+                return undefined;
+        }
+        // PR review round 32: the phase runs under its own deadline, so the attempt
+        // that started it can already be superseded when it resumes — the restore
+        // and the binding sync are both gated on that attempt identity, not merely
+        // checked by the caller afterwards.
+        const failure = await this.restoreProjection(facts.records, provider, window.row, facts.key, facts.previous, facts.borrowed, stillCurrent, true);
+        if (failure !== undefined) {
+            this.warn(`the late projection write of the abandoned connection test for ${provider} could not be reconciled: ${failure}`);
+            return failure;
+        }
+        if (stillCurrent !== undefined && !stillCurrent())
+            return undefined;
+        await this.syncBindingAfterProjectionChange(provider);
+        return undefined;
+    }
+    /**
+     * Record one in-flight window mutation before it is awaited (QC fix wave 3,
+     * W-001). The normalized promise never rejects: the mutation's own outcome
+     * belongs to the code awaiting it, while the cleanup only needs to know when
+     * the write is over.
+     */
+    recordWindowMutation(window, mutation) {
+        window.mutations.push(mutation.then(() => undefined, () => undefined));
+    }
+    /**
+     * Await every mutation this window recorded, including one the continuation
+     * of an earlier mutation records (a borrow that settles right before its
+     * binding release starts). The microtask hop after each settling round lets
+     * that continuation run before the cleanup judges the route clean. A
+     * mutation the seam never answers is bounded by the caller's deadline, not
+     * here.
+     */
+    async awaitWindowMutations(window) {
+        let awaited = 0;
+        for (;;) {
+            while (awaited < window.mutations.length) {
+                await window.mutations[awaited];
+                awaited += 1;
+            }
+            await Promise.resolve();
+            if (awaited >= window.mutations.length)
+                return;
+        }
+    }
+    /**
+     * Run one cleanup under its hard deadline. The work is not cancelled — the
+     * credential seam offers no cancellation — it is only stopped from holding
+     * the provider past the bound; a late result is ignored.
+     */
+    async withinCleanupDeadline(work) {
+        // The bound never rejects: a seam failure is a cleanup result, not a
+        // control-flow error.
+        const running = work().then(failure => failure, (error) => `the credential store refused the cleanup: ${error instanceof Error ? error.message : String(error)}`);
+        let timer;
+        const deadline = new Promise(resolve => {
+            timer = setTimeout(() => resolve('the credential store did not answer before the cleanup deadline'), this.testCleanupDeadlineMs);
+            timer.unref?.();
+        });
+        try {
+            return await Promise.race([running, deadline]);
+        }
+        finally {
+            if (timer !== undefined)
+                clearTimeout(timer);
+        }
+    }
+    /**
+     * Decide the route's serving shape and run one row test. Separate from
+     * {@link testKey} so the concurrency lock is registered before the first
+     * await.
+     */
+    async runRowTest(record, row, window) {
+        const provider = record.provider;
+        // QC B6: the serving source is decided from projection ownership, which a
+        // restarted process hydrates asynchronously. Until that read lands the
+        // shape is unknown, so the honest answer is a refusal with no request
+        // rather than a test attributed to the wrong credential.
+        if (!await this.awaitProjectionOwnership(provider)) {
+            return { ok: false, latencyMs: 0, error: 'Account ownership is still loading; try again in a moment' };
+        }
+        const route = this.testRouteProfile(record);
+        if ('error' in route)
+            return { ok: false, latencyMs: 0, error: route.error };
+        const profile = route.profile;
+        const apiKeyEnv = typeof profile.apiKeyEnv === 'string' ? profile.apiKeyEnv : undefined;
+        // QC B1: derive the route's serving shape once, from the profile value
+        // read at entry, and only test a row whose credential this shape carries.
+        // pi-ai resolves a named `apiKeyEnv` override before its stored grant, so
+        // `bound` decides that the broker (key pool) authenticates the request and
+        // `projected` that the account's grant does.
+        const bound = apiKeyEnv === record.brokerRef;
+        const projected = this.oauthOwnerFor(provider) !== null;
+        const foreignReference = apiKeyEnv !== undefined && !bound;
+        if (foreignReference) {
+            return {
+                ok: false,
+                latencyMs: 0,
+                error: `This route is served by the credential reference "${apiKeyEnv}" set in the provider settings, which Keys Manager does not manage. Repair the binding in Models, then test again.`,
+            };
+        }
+        // C1: a route served by a projected OAuth account resolves that account's
+        // stored grant, never the API-key pool. `syncBrokerBinding` unsets the
+        // profile's broker reference while a projection exists, so the adapter has
+        // no `apiKey` override to hand pi-ai and the test scope's pinned literal is
+        // never consulted: an api-key row test here would report a pass for a key
+        // the request did not carry. Refuse with the serving source instead of
+        // borrowing (or deleting) the projection — a diagnostic action must not
+        // rewrite the route's credential binding. `oauthOwnerFor` is the read-only
+        // ownership oracle; a stale map entry resolves to null and does not refuse.
+        if (row.kind === 'api-key' && projected) {
+            return {
+                ok: false,
+                latencyMs: 0,
+                error: 'This route is currently served by its OAuth account; the API key pool is not in use. Deactivate the account or let the projection fall back, then test again.',
+            };
+        }
+        if (row.kind === 'api-key' && !bound) {
+            // No `apiKeyEnv` override means pi-ai reads its own stored credential:
+            // the pinned literal never reaches the request, so a pass would be
+            // reported for a key this route did not carry.
+            return {
+                ok: false,
+                latencyMs: 0,
+                error: 'This route is not served by its API-key pool (the provider profile holds no Keys Manager binding). Re-add a key or repair the binding in Models, then test again.',
+            };
+        }
+        const model = normalizeModels(profile.models)[0]?.id;
+        if (model === undefined)
+            return { ok: false, latencyMs: 0, error: 'No model is configured for this provider' };
+        // QC B1: a broker-bound profile hides the borrowed projection from pi-ai,
+        // so the binding is released for the test window through the one authority
+        // and restored at window end (see runOAuthRowTest).
+        const borrowBinding = row.kind === 'oauth' && bound;
+        if (row.kind !== 'oauth')
+            return await this.runApiKeyRowTest(provider, row, model, window);
+        // The window records what this test borrows, so the watchdog can put the
+        // route back exactly as the test's own finally would (QC fix wave 2).
+        window.borrowBinding = borrowBinding;
+        return await this.runOAuthRowTest(provider, row, model, window);
+    }
+    /**
+     * The live provider profile one test must reason about, read once at entry
+     * (QC B1/N6), or the reason it cannot be used. An unreadable settings
+     * snapshot and a missing profile are distinct causes, so the row never
+     * claims a model is missing when the settings service is merely absent.
+     */
+    testRouteProfile(record) {
+        const descriptor = this.describeSettings();
+        if (!descriptor.readable) {
+            return { error: 'The provider settings could not be read, so the test cannot tell which credential serves this route. Try again in a moment.' };
+        }
+        const namespace = this.namespace(descriptor, record.settingsNs);
+        if (namespace === undefined) {
+            return { error: `The settings namespace "${record.settingsNs}" is not mounted; configure this provider in Models and test again.` };
+        }
+        const profile = asProfile(getPath(namespace.value, record.settingsPath));
+        if (profile === undefined) {
+            return { error: 'This provider has no settings profile yet; configure a model for it and test again.' };
+        }
+        return { profile };
+    }
+    /** One request pinned to the row's API-key literal. */
+    async runApiKeyRowTest(provider, row, model, window) {
+        const probe = await this.probeKey(row.ref);
+        // PR review round 10 (I-000179): the probe is an untimed seam call, so the
+        // window can be abandoned — and a release, refused or not, can have
+        // removed the row — while the test is parked here. Re-assert both right
+        // before the send: a late probe result must not send a deleted literal.
+        if (window.cleaned)
+            return this.abandonedTestResult();
+        const live = this.store.provider(provider);
+        if (live === undefined || !live.keys.some(candidate => candidate.id === row.id)) {
+            return { ok: false, latencyMs: 0, error: `Key "${row.id}" was removed from ${provider} before its test could send` };
+        }
+        if (probe.hit === undefined) {
+            return {
+                ok: false,
+                latencyMs: 0,
+                error: probe.failed ? `Could not read credential ${row.ref}` : 'The stored credential is missing',
+            };
+        }
+        // PR review round 40: a native OAuth sign-in (or a demotion) can change the
+        // route's serving source while the probe is parked. Sending now would test a
+        // key the request does not carry, so refuse instead of reporting a false pass.
+        if (this.oauthOwnerFor(provider) !== null || this.foreignProjections.has(provider)) {
+            return {
+                ok: false,
+                latencyMs: 0,
+                error: `The ${provider} route is now served by another credential source; run the test again once it settles.`,
+            };
+        }
+        return await this.runTestRequest(provider, model, {
+            provider,
+            keyId: row.id,
+            keyValue: probe.hit.value,
+            keyUsed: false,
+            oauthAccountId: null,
+            test: true,
+        });
+    }
+    /** One request with the row's grant temporarily projected as the route's credential. */
+    async runOAuthRowTest(provider, row, model, window) {
+        const grant = row.oauth;
+        if (grant === null)
+            return { ok: false, latencyMs: 0, error: `Key "${row.id}" is not an OAuth account` };
+        const records = this.credentialRecords();
+        if (records === undefined)
+            return { ok: false, latencyMs: 0, error: 'The credential store does not support records' };
+        const projectionKey = `${OAUTH_GRANT_RECORD_SCOPE}/${provider}`;
+        let result = { ok: false, latencyMs: 0, error: 'The test did not run' };
+        // The projection write, the request and the restore share the provider's
+        // grant chain, so a rotation echo cannot observe or overwrite the
+        // temporary projection between them.
+        await this.scheduleGrantReconciliation(provider, async () => {
+            const stored = await records.readRecord(grant.grantRef);
+            if (window.cleaned) {
+                // QC fix wave 2: the watchdog abandoned this window while the read was
+                // in flight. Starting (or resuming) the borrow now would land it after
+                // the cleanup that already ran, so the test stops here.
+                result = this.abandonedTestResult();
+                return;
+            }
+            if (stored === undefined || stored.kind !== 'grant' || !isOAuthGrantPayload(stored.payload)) {
+                result = {
+                    ok: false,
+                    latencyMs: 0,
+                    error: `The grant payload at ${grant.grantRef} is missing or unusable; sign in to this account again`,
+                };
+                return;
+            }
+            const borrowed = structuredClone(stored.payload);
+            const captured = await records.readRecord(projectionKey);
+            // PR review round 14: the snapshot and its comparison key are frozen
+            // here. The seam hands back a live record, so a writer mutating that
+            // stored object in place would otherwise change `previous` along with
+            // the updater's `current` and make the borrow look unchanged.
+            const previous = captured === undefined ? undefined : structuredClone(captured);
+            const previousKey = previous === undefined ? undefined : JSON.stringify(previous);
+            if (window.cleaned) {
+                result = this.abandonedTestResult();
+                return;
+            }
+            if (this.shutdownRequested) {
+                // PR review round 30: shutdown abandons the chain parked here, so the
+                // borrow write below must not land after `close()`. Round 34: the
+                // marker is up from shutdown's entry, so the pre-close restoration is
+                // covered too — it does not borrow, and this test must not either.
+                result = this.shutdownEntryResult();
+                return;
+            }
+            // PR review round 12: both reads above are awaits, so a removal can have
+            // deleted the provider or this row while they were in flight (a test that
+            // registered and one that did not are covered: the marker refuses the
+            // latter, this re-check the former). Never write the borrow — and never
+            // re-project the removed account's grant — on that state.
+            // PR review round 15: the existence check alone still holds while a
+            // removal is deleting credentials (the row is spliced only after its
+            // grant delete), so the row's retirement mark is part of the assertion.
+            // The provider-wide marker is deliberately not read here: a removal that
+            // began while this test is registered waits for it in
+            // {@link settleTestBeforeRemoval} and is the designed handshake, while
+            // the row mark is only set by a removal that already passed that check.
+            const live = this.store.provider(provider);
+            const removing = this.retiringAccounts.has(row);
+            if (removing || live === undefined || !live.keys.some(candidate => candidate.id === row.id)) {
+                result = removing
+                    ? { ok: false, latencyMs: 0, error: `Provider "${provider}" is being removed; the test did not borrow its credential` }
+                    : { ok: false, latencyMs: 0, error: `Key "${row.id}" was removed from ${provider} before its test could borrow it` };
+                return;
+            }
+            // QC fix wave 2: record the borrow before the write, so an abandoned
+            // window can restore a borrow whose write lands after the watchdog
+            // looked. The restore decides by payload, so the facts are safe to hold
+            // whether or not the write landed.
+            window.facts = { records, key: projectionKey, previous, borrowed };
+            // QC B4 + PR review round 8: the borrow marker is registered BEFORE the
+            // write is awaited. A mutation landing while the write is still in
+            // flight would otherwise derive a binding from the pre-borrow world — on
+            // an unbound route it binds the broker over the projection this test is
+            // about to borrow, and the window (whose `borrowBinding` was decided at
+            // entry) never releases it.
+            this.testBindingBorrows.add(provider);
+            // QC fix wave 3 (W-001): the write is recorded before it is awaited, so
+            // a cleanup that runs while it is still in flight waits for it instead
+            // of re-reading the pre-borrow payload and calling the route clean.
+            // PR review round 13: the pre-borrow read is awaited, so a native or
+            // manager sign-in can commit a newer projection before this write runs.
+            // The write is therefore a compare-and-swap against the record it
+            // captured: borrowing over that sign-in — and restoring the stale
+            // `previous` at window end — would drop it for good.
+            let borrowRefused = false;
+            const borrowWrite = records.modifyRecord(projectionKey, current => {
+                const unchanged = previous === undefined
+                    ? current === undefined
+                    : current !== undefined && JSON.stringify(current) === previousKey;
+                if (!unchanged) {
+                    borrowRefused = true;
+                    return Promise.resolve(undefined);
+                }
+                return Promise.resolve({ kind: 'grant', payload: structuredClone(borrowed) });
+            });
+            this.recordWindowMutation(window, borrowWrite);
+            try {
+                await borrowWrite;
+            }
+            catch (error) {
+                // Nothing was borrowed, so the fence goes back — unless an abandoned
+                // window's cleanup owns it (it removes the marker when it completes).
+                if (!window.cleaned)
+                    this.testBindingBorrows.delete(provider);
+                result = {
+                    ok: false,
+                    latencyMs: 0,
+                    error: `The grant could not be projected for the test: ${error instanceof Error ? error.message : String(error)}`,
+                };
+                return;
+            }
+            if (this.shutdownRequested) {
+                // PR review round 30: the borrow write settled after shutdown started,
+                // so no binding release, request or restore may follow it. Round 34:
+                // shutdown's entry marker makes that true during the pre-close
+                // restoration as well, which waits this write out and puts it back.
+                result = this.shutdownTestResult();
+                return;
+            }
+            if (borrowRefused) {
+                // The projection belongs to a newer writer, so this window borrowed
+                // nothing and has nothing to restore. An abandoned window's cleanup
+                // owns the fence and the marker.
+                if (!window.cleaned) {
+                    window.facts = undefined;
+                    this.testBindingBorrows.delete(provider);
+                    result = {
+                        ok: false,
+                        latencyMs: 0,
+                        error: `The credential projection for ${provider} changed while the test was starting; the test did not borrow it. Run the test again.`,
+                    };
+                    return;
+                }
+                result = this.abandonedTestResult();
+                return;
+            }
+            if (window.cleaned) {
+                // QC fix wave 2: the window was conceded while this write was in
+                // flight, so the watchdog's cleanup may have read the projection
+                // before it landed. Undo the borrow through the same compare-by-payload
+                // restore (not the stale snapshot) and keep the fence if that fails.
+                // QC fix wave 3 (W-002): only while this window still owns the fence.
+                // A cleanup that completed on a later test attempt already restored
+                // this write; running again now would put a projection back out from
+                // under that newer window.
+                if (this.abandonedWindows.get(provider) === window)
+                    await this.attemptAbandonedCleanup(window);
+                result = this.abandonedTestResult();
+                return;
+            }
+            // QC fix wave 3 (W-002): the owner claim sits after the fence check — an
+            // abandoned window's repair already reconciled the owner from the
+            // restored payload, and claiming it again would name a row the cleanup
+            // no longer serves. QC B4: the borrow marker that hides this window's
+            // credential surface from the binding authority is already set, before
+            // the borrow write (PR review round 8); the window-end sync below writes
+            // the restored state.
+            this.claimProjectionOwner(provider, row.id);
+            let restoreFailure;
+            try {
+                if (window.borrowBinding) {
+                    // QC B1: a broker-bound profile hands pi-ai the broker reference, so
+                    // the projection would be inert for the request. Release it for the
+                    // window through the single binding authority (a failed release
+                    // refuses the test instead of borrowing a second writer).
+                    // QC fix wave 2: the attempt is recorded before it is awaited — it
+                    // may land partially, and a cleanup must re-sync what it touched.
+                    // QC fix wave 3 (W-001): it is also recorded as an in-flight window
+                    // mutation, so a cleanup does not sync a route whose release is
+                    // still on its way to the profile.
+                    window.releasedBinding = true;
+                    const release = this.syncBrokerBinding(provider, { borrow: true });
+                    this.recordWindowMutation(window, release);
+                    const released = await release;
+                    if (window.cleaned) {
+                        // The abandonment landed while this release was in flight, so the
+                        // watchdog's re-sync may have run before the release did and left
+                        // the profile unbound. Re-sync now that the release is complete —
+                        // unless a later attempt already cleaned this window up (W-002).
+                        if (this.abandonedWindows.get(provider) === window)
+                            await this.attemptAbandonedCleanup(window);
+                        result = this.abandonedTestResult();
+                        return;
+                    }
+                    if (!released) {
+                        restoreFailure = 'The route is served by its API-key pool and its credential binding could not be released for the test; the account was not tested.';
+                    }
+                }
+                if (restoreFailure === undefined) {
+                    result = await this.runTestRequest(provider, model, {
+                        provider,
+                        keyId: null,
+                        keyValue: null,
+                        keyUsed: false,
+                        oauthAccountId: row.id,
+                        test: true,
+                    });
+                }
+            }
+            finally {
+                // PR review round 21: the request is over. A cleanup that completed
+                // while it was still running held the provider's isolation for exactly
+                // this point, so the late write is reconciled before that isolation is
+                // released; a failed reconcile keeps the fence (the existing
+                // borrow-could-not-be-undone path).
+                window.settled = true;
+                if (this.closing) {
+                    // PR review round 30: the shutdown drain abandoned this chain; the
+                    // restore and the binding sync below are persistence, and the store
+                    // is closed already. Nothing is written, so the borrowed projection
+                    // stays as the credential store holds it.
+                    restoreFailure ??= this.shutdownTestResult().error;
+                }
+                else if (window.cleaned) {
+                    // QC fix wave 2: this window was abandoned and its cleanup already
+                    // ran (or is running) under the watchdog. Restoring from this
+                    // promise's own pre-test snapshot now would race whatever state the
+                    // route carries by then, so the late settlement writes nothing and
+                    // reports the failure its own result cannot claim.
+                    restoreFailure = this.abandonedTestResult().error;
+                    // PR review round 13: the abandoned request may itself have
+                    // refreshed and rewritten the borrowed projection after that
+                    // cleanup ran. Reconcile that late write against what the window
+                    // found before the route counts as handed back.
+                    const late = await this.reconcileLateWindowProjection(window, window.held);
+                    if (window.held && late === undefined && this.abandonedWindows.get(provider) === window) {
+                        this.releaseAbandonedWindow(window);
+                    }
+                }
+                else {
+                    const restored = await this.cleanupTestWindow(window);
+                    if (restoreFailure === undefined)
+                        restoreFailure = restored;
+                    // PR review MF1: a cleanup that failed on the normal path must enter
+                    // the same fenced recovery the watchdog uses. Reporting the failure
+                    // alone would strand the borrow marker (every later
+                    // `syncBrokerBinding` returns early) and let the borrowed grant keep
+                    // serving ordinary requests. `window.cleaned` guards the case where
+                    // the watchdog took the window over while this cleanup ran — that
+                    // owner is already retrying.
+                    if (restored !== undefined && !window.cleaned)
+                        this.abandonTestWindow(window, 'cleanup');
+                }
+            }
+            if (restoreFailure !== undefined) {
+                result = { ok: false, latencyMs: result.latencyMs, error: restoreFailure };
+            }
+        });
+        return result;
+    }
+    /** The refusal an abandoned test reports instead of a stale success. */
+    abandonedTestResult() {
+        return {
+            ok: false,
+            latencyMs: 0,
+            error: `The connection test was abandoned after ${this.isolationWaitMs}ms and its borrowed credential was cleaned up; run the test again.`,
+        };
+    }
+    /** The refusal a chain reports when shutdown refuses its persistence. */
+    shutdownTestResult() {
+        return {
+            ok: false,
+            latencyMs: 0,
+            error: 'Keys Manager is shutting down; the connection test did not finish and its cleanup was skipped.',
+        };
+    }
+    /** The refusal a test reports when it arrives after shutdown began (round 34). */
+    shutdownEntryResult() {
+        return {
+            ok: false,
+            latencyMs: 0,
+            error: 'Keys Manager is shutting down; the connection test was refused before it borrowed a credential.',
+        };
+    }
+    /**
+     * Mark one provider as being removed for the whole removal body (PR review
+     * round 12). The marker is up before the body's first await — the removal's
+     * own test wait included — so {@link testKey} can refuse a test that would
+     * otherwise start inside the removal. Nesting is a depth because a
+     * last-key `deleteKey` releases through `releaseLocked`.
+     */
+    async withRemovalInProgress(provider, work) {
+        const depth = this.removalsInProgress.get(provider) ?? 0;
+        this.removalsInProgress.set(provider, depth + 1);
+        try {
+            return await work();
+        }
+        finally {
+            if (depth === 0)
+                this.removalsInProgress.delete(provider);
+            else
+                this.removalsInProgress.set(provider, depth);
+        }
+    }
+    /**
+     * Hold a row/account removal until the provider's running row test settles
+     * (PR review round 9, R8-2).
+     *
+     * `testKey` captures its row, its credential and the route's serving shape
+     * before the first await, so a removal landing inside that window can delete
+     * the credential the test is about to send. For a borrowed OAuth account the
+     * removal is worse than a stale read: it compares its decision against the
+     * test's temporary projection, deletes it and demotes every row, and the
+     * test's own restore then writes the removed account's grant back. The
+     * removal therefore waits for the window instead of racing it. The wait is
+     * bounded by {@link isolationWaitMs} — a test wedged in an untimed seam call
+     * must not park the removal forever — and a provider whose abandoned window
+     * still owns the route's records refuses the removal outright. A wait that
+     * hits its own bound refuses too (PR review round 10, I-000179): proceeding
+     * would delete the credential the parked test is about to send. The user can
+     * retry once the abandoned window has been cleaned up.
+     */
+    async settleTestBeforeRemoval(provider) {
+        const refusal = `A previous connection test for ${provider} is still being cleaned up; try again in a moment.`;
+        if (this.cleaningTests.has(provider))
+            throw new Error(refusal);
+        const pending = this.testsActive.get(provider);
+        if (pending === undefined)
+            return;
+        let settled = false;
+        let timer;
+        const bound = new Promise(resolve => {
+            timer = setTimeout(resolve, this.isolationWaitMs);
+            timer.unref?.();
+        });
+        try {
+            await Promise.race([pending.then(() => { settled = true; }, () => { settled = true; }), bound]);
+        }
+        finally {
+            if (timer !== undefined)
+                clearTimeout(timer);
+        }
+        if (this.cleaningTests.has(provider))
+            throw new Error(refusal);
+        if (!settled) {
+            throw new Error(`A connection test for ${provider} did not settle within ${this.isolationWaitMs}ms, so the removal was refused rather than delete a credential its request may still carry; try again in a moment.`);
+        }
+    }
+    /**
+     * Put the projection back as it was before the test borrowed it, without
+     * losing or overwriting anything that changed meanwhile.
+     *
+     * `late` marks the abandoned window's settlement, after the watchdog's
+     * cleanup already released the provider: a removal no longer waits for this
+     * test, so the pre-test projection's owning row may be gone by the time this
+     * runs and must not be projected again (PR review round 19).
+     *
+     * The decision is compare-by-payload against the borrowed grant: only a
+     * live record that still carries it — or a refresh-rotated version of it
+     * that {@link matchOwningAccount} attributes to the tested row — is
+     * replaced. A rotation is reconciled into the tested row first (the same
+     * plugin-scope write-back {@link reconcileGrantRecord} performs), because
+     * the provider may already have consumed the superseded refresh token. A
+     * foreign or newer payload (another account, a native writer) is left
+     * untouched, and a record removed during the window stays removed. In every
+     * branch the owner map ends consistent with what the store actually holds.
+     *
+     * Returns a failure message when the restore or the rotation write-back
+     * did not land, so the caller reports `{ ok: false }` instead of a false
+     * pass.
+     */
+    async restoreProjection(records, provider, row, key, previous, borrowed, stillCurrent, late, capability) {
+        let live;
+        try {
+            live = await records.readRecord(key);
+        }
+        catch (error) {
+            const message = `The credential projection at ${key} could not be re-read after the test: ${error instanceof Error ? error.message : String(error)}`;
+            this.pushWarning(message);
+            return message;
+        }
+        // PR review round 3: a cleanup that outlived its deadline can be
+        // superseded by a newer window that borrowed the SAME account meanwhile,
+        // so the compare by payload below still matches a state this attempt no
+        // longer owns. `stillCurrent` is that attempt identity; only an abandoned
+        // attempt has one. Every write decision — the projection, the owner map
+        // and the binding sync — is gated on it.
+        const superseded = () => stillCurrent !== undefined && !stillCurrent();
+        const takeover = 'a newer cleanup attempt took over this provider';
+        // PR review round 36: the re-read above is an await a cleanup can park in
+        // across `close()`, so every write decision refuses persistence from the
+        // moment shutdown starts — unless the caller is the pre-close restoration,
+        // which is the only holder of that capability.
+        const shutdown = 'Keys Manager is shutting down; the test cleanup was skipped';
+        if (this.persistenceRefused(capability))
+            return shutdown;
+        // PR review round 8: the fence is checked in each branch that writes the
+        // owner map, instead of once before every branch. The pre-branch check ran
+        // after the only await, so it pre-empted the branch fences below and made
+        // them untestable; every write is still guarded, at the write itself.
+        const liveGrant = live !== undefined && live.kind === 'grant' && isOAuthGrantPayload(live.payload)
+            ? live.payload
+            : undefined;
+        const previousGrant = previous !== undefined && previous.kind === 'grant' && isOAuthGrantPayload(previous.payload)
+            ? previous.payload
+            : undefined;
+        const carriesBorrowed = liveGrant !== undefined && JSON.stringify(liveGrant) === JSON.stringify(borrowed);
+        // R2-1: the pre-test projection was deleted while this test ran. That
+        // removal came from a writer outside the provider's grant chain — the
+        // manager's own projection release, or a native sign-out — so the
+        // pre-test payload is not this test's to put back: resurrecting it would
+        // restore a credential its owner just stopped serving. The record stays
+        // absent and the owner map follows the (empty) live store. The
+        // `previous === undefined` case is different — that projection was this
+        // test's own write — and is deleted below.
+        if (live === undefined && previous !== undefined) {
+            // PR review round 7: the re-read above is an await, so the attempt fence
+            // is re-checked at this write instead of inherited from an earlier site.
+            if (superseded())
+                return takeover;
+            this.reconcileProjectionOwner(provider, undefined);
+            return undefined;
+        }
+        const rows = this.store.provider(provider)?.keys.filter(candidate => candidate.kind === 'oauth' && candidate.oauth !== null) ?? [];
+        const previousOwner = previousGrant === undefined ? undefined : matchOwningAccount(provider, rows, previousGrant);
+        if (live !== undefined && !carriesBorrowed) {
+            const rotationOwner = liveGrant === undefined ? undefined : matchOwningAccount(provider, rows, liveGrant);
+            if (rotationOwner?.id === row.id && this.accountRowIsManaged(provider, row)) {
+                // PR review round 8: this branch's write-back starts an awaited write,
+                // so it checks the attempt fence where it is about to write.
+                if (superseded())
+                    return takeover;
+                if (this.persistenceRefused(capability))
+                    return shutdown;
+                try {
+                    await this.writeBackRotation(provider, row, liveGrant, capability, stillCurrent);
+                }
+                catch (error) {
+                    // PR review round 38: the helper throws when this attempt was
+                    // superseded mid-write or shutdown started; neither may claim the
+                    // route, and nothing may be written on their behalf.
+                    if (superseded())
+                        return takeover;
+                    if (this.persistenceRefused(capability))
+                        return shutdown;
+                    // The live projection is the only copy of the rotated payload:
+                    // overwriting it with the pre-test payload would strand the account
+                    // on a consumed refresh token, so it stays and owns the route —
+                    // unless this attempt is superseded, and the route is no longer its
+                    // to claim (PR review round 6).
+                    if (superseded())
+                        return takeover;
+                    this.claimProjectionOwner(provider, row.id);
+                    const message = `The rotated grant for ${provider} could not be written back after the test: ${error instanceof Error ? error.message : String(error)}`;
+                    this.pushWarning(message);
+                    return message;
+                }
+            }
+            else {
+                // A foreign or newer payload — another account, a native writer, an
+                // unrecognized record — is not this test's to restore. Only the owner
+                // map follows what is actually stored, and only while this attempt
+                // still owns the provider (PR review round 7: fenced at the write).
+                if (superseded())
+                    return takeover;
+                this.reconcileProjectionOwner(provider, live);
+                return undefined;
+            }
+        }
+        // PR review round 6: the rotation write-back is an await. A cleanup that
+        // outlived its deadline can resume after a newer window borrowed another
+        // account, so the owner map it would reconcile belongs to that window's
+        // world now: finish the write, skip the owner write, report the takeover.
+        if (superseded())
+            return takeover;
+        // QC B2: the pre-test projection already belonged to the tested row, so
+        // the live payload (the borrowed grant, or a rotation just written back
+        // above) IS that row's current grant. Writing `previous` back would revert
+        // it: its echo re-matches the same row, moves `grantRef` to the superseded
+        // generation and deletes the rotated record — leaving the account on a
+        // consumed refresh token.
+        //
+        // PR review round 28: ownership alone cannot decide that, because the
+        // captured `previous` is a *different generation* of the same account
+        // whenever a re-authentication projected a newer payload before the borrow
+        // (the borrow's compare-and-swap then replaced it with the older stored
+        // grant). Keeping the borrowed payload there strands the route on the
+        // stale generation, and the next echo adopts it and deletes the newer one.
+        // Only the payload identity decides: identical payloads are the pre-test
+        // projection itself, and a different one that the store still carries as
+        // the borrow is the newer generation this restore puts back.
+        const staleBorrow = previousGrant !== undefined && JSON.stringify(previousGrant) !== JSON.stringify(borrowed);
+        if (previousOwner?.id === row.id && !(carriesBorrowed && staleBorrow)) {
+            this.reconcileProjectionOwner(provider, live);
+            return undefined;
+        }
+        // PR review round 19 (I-000179 late restore): only a late restore can find
+        // its pre-test projection's owner gone — the watchdog's cleanup released
+        // the provider, so a removal no longer waited for this test and `rows` no
+        // longer matches that payload, leaving nothing else to reject the write.
+        // Restoring it would serve a deleted account's credential. An in-window
+        // restore is protected by settleTestBeforeRemoval and keeps restoring a
+        // pre-test projection no pool row owns (a foreign grant it borrowed over).
+        if (late === true && (previousOwner === undefined || !this.accountRowIsManaged(provider, previousOwner))) {
+            if (superseded())
+                return takeover;
+            this.reconcileProjectionOwner(provider, live);
+            const message = `The credential projection at ${key} was not restored after the test: the account whose grant it carried is no longer managed. The route keeps whichever credential those records hold now.`;
+            this.pushWarning(message);
+            return message;
+        }
+        // The record this restore left in place: the tail reconciles the owner map
+        // against the live record, never against the payload it hoped to restore
+        // (PR review round 8 — the store may hold a present non-grant record).
+        let left;
+        try {
+            if (previous === undefined) {
+                // PR review MF2: the projection was this test's own write, so the
+                // route goes back to having none — but only while the record still
+                // carries what this test left (the borrowed grant, or a rotation of
+                // the tested row). The decision runs inside the seam's per-key lock
+                // and the removal is preceded by {@link projectionStillMatches}, so a
+                // native writer's grant landing after the re-read above survives as
+                // that writer's projection instead of being deleted as a leftover.
+                let decidedAgainst = undefined;
+                await records.modifyRecord(key, async (current) => {
+                    // A superseded attempt, or a cleanup the shutdown overtook, leaves
+                    // the record exactly as it found it.
+                    if (superseded() || this.persistenceRefused(capability))
+                        return undefined;
+                    if (current === undefined)
+                        return undefined;
+                    const currentGrant = current.kind === 'grant' && isOAuthGrantPayload(current.payload)
+                        ? current.payload
+                        : undefined;
+                    const testLeft = currentGrant !== undefined && (JSON.stringify(currentGrant) === JSON.stringify(borrowed)
+                        || matchOwningAccount(provider, rows, currentGrant)?.id === row.id);
+                    if (testLeft)
+                        decidedAgainst = JSON.stringify(current.payload);
+                    return undefined;
+                });
+                if (superseded())
+                    return takeover;
+                if (this.persistenceRefused(capability))
+                    return shutdown;
+                if (decidedAgainst === undefined || !await this.projectionStillMatches(records, key, decidedAgainst)) {
+                    const liveAfter = await records.readRecord(key);
+                    // PR review round 6: this reconcile follows an awaited re-read; a
+                    // superseded attempt may not repoint the owner from a world a newer
+                    // window now owns.
+                    if (superseded())
+                        return takeover;
+                    // PR review round 35: the re-read is the cleanup's last await before
+                    // it would write; a shutdown that began under it stops the restore.
+                    if (this.persistenceRefused(capability))
+                        return shutdown;
+                    this.reconcileProjectionOwner(provider, liveAfter);
+                    // Already gone: the route has no projection, which is the state the
+                    // test found. Anything else is a grant this test may not remove —
+                    // it stays and owns the route, and the test reports that its own
+                    // borrow could not be undone.
+                    if (liveAfter === undefined)
+                        return undefined;
+                    const message = `The credential projection at ${key} changed during the test and was left in place; the route serves whichever credential those records hold now.`;
+                    this.pushWarning(message);
+                    return message;
+                }
+                // The projection this test borrowed may already be a newer window's.
+                if (superseded())
+                    return takeover;
+                if (this.persistenceRefused(capability))
+                    return shutdown;
+                await records.deleteRecord(key);
+            }
+            else {
+                // QC N2: the compare travels with the write, so a foreign payload
+                // stored between the re-read above and this write is never
+                // overwritten. Only a record that still carries what this test left
+                // (the borrowed grant, or a rotation of the tested row) is replaced.
+                const snapshot = structuredClone(previous);
+                left = await records.modifyRecord(key, current => {
+                    // A superseded attempt, or a cleanup the shutdown overtook, leaves
+                    // the record exactly as it found it.
+                    if (superseded() || this.persistenceRefused(capability))
+                        return Promise.resolve(current);
+                    const currentGrant = current !== undefined && current.kind === 'grant' && isOAuthGrantPayload(current.payload)
+                        ? current.payload
+                        : undefined;
+                    const testLeft = currentGrant !== undefined && (JSON.stringify(currentGrant) === JSON.stringify(borrowed)
+                        || matchOwningAccount(provider, rows, currentGrant)?.id === row.id);
+                    return Promise.resolve(testLeft ? snapshot : current);
+                });
+                if (superseded())
+                    return takeover;
+                if (this.persistenceRefused(capability))
+                    return shutdown;
+            }
+        }
+        catch (error) {
+            // The store still holds what the re-read saw: keep the owner map on
+            // that record rather than claiming the pre-test account (I2).
+            if (!superseded())
+                this.reconcileProjectionOwner(provider, live);
+            const message = `The credential projection at ${key} could not be restored after the test: ${error instanceof Error ? error.message : String(error)}`;
+            this.pushWarning(message);
+            return message;
+        }
+        if (superseded())
+            return takeover;
+        this.reconcileProjectionOwner(provider, left);
+        return undefined;
+    }
+    /**
+     * Point the owner map at the OAuth row the stored record identifies.
+     *
+     * The argument is the live record, not its grant payload (PR review round 8):
+     * a payload-only signature cannot tell a removed projection from a PRESENT
+     * record this pool cannot interpret (a native api-key, an unrecognized
+     * payload), so a surviving native record reached this method as `undefined`,
+     * cleared the foreign marker, and `keyPoolServes` then let the window-end
+     * sync bind the broker over it. Only an absent record is a confirmed removal
+     * (I-000167); a present record no row owns keeps the route foreign (round 3).
+     */
+    reconcileProjectionOwner(provider, live) {
+        if (live === undefined) {
+            this.activeAccounts.delete(provider);
+            // A confirmed absence: the foreign marker must clear with the owner, or
+            // `keyPoolServes` keeps the surviving pool unbound forever (I-000167).
+            this.foreignProjections.delete(provider);
+            return;
+        }
+        const rows = this.store.provider(provider)?.keys.filter(candidate => candidate.kind === 'oauth' && candidate.oauth !== null) ?? [];
+        const owner = live.kind === 'grant' && isOAuthGrantPayload(live.payload)
+            ? matchOwningAccount(provider, rows, live.payload)
+            : undefined;
+        if (owner !== undefined) {
+            this.claimProjectionOwner(provider, owner.id);
+            return;
+        }
+        this.activeAccounts.delete(provider);
+        // Present but not a managed grant: a native api-key or an unowned grant
+        // still serves the route ahead of any broker reference.
+        this.foreignProjections.add(provider);
+    }
+    /**
+     * Persist one authoritative rotated grant payload for a row: write the
+     * plugin-scope record for the rotated generation, then hand the commit to
+     * {@link commitGrantGeneration} — the same tail {@link reconcileGrantRecord}
+     * performs. The caller runs inside the provider's grant chain and owns the
+     * decision, including the echo-specific generation guards, so only the
+     * write-back semantics live here.
+     */
+    async writeBackRotation(provider, row, payload, capability, stillCurrent) {
+        const records = this.credentialRecords();
+        if (records === undefined)
+            throw new Error('The credential store does not support records');
+        if (row.oauth === null)
+            throw new Error(`Key "${row.id}" is not an OAuth account`);
+        // PR review round 38: this helper's three steps are separated by awaits, so
+        // both gates are read again at each of them. A superseded attempt may not
+        // write the rotated record, and shutdown refuses the persistence outright
+        // rather than only at the commit below.
+        if (this.persistenceRefused(capability) || (stillCurrent !== undefined && !stillCurrent())) {
+            throw new Error('Keys Manager is shutting down or the test cleanup was superseded');
+        }
+        const hash = createHash('sha256').update(payload.refresh).digest('hex').slice(0, 12);
+        const rotatedRef = accountRef(provider, hash);
+        // PR review round 39: the seam may park this call before it invokes the
+        // updater, so the gates are read inside the updater itself — a write
+        // decided before shutdown/supersession must not land after them.
+        let written = false;
+        await records.modifyRecord(rotatedRef, async () => {
+            if (this.persistenceRefused(capability) || (stillCurrent !== undefined && !stillCurrent()))
+                return undefined;
+            written = true;
+            return { kind: 'grant', payload: structuredClone(payload) };
+        });
+        if (!written)
+            throw new Error('Keys Manager is shutting down or the test cleanup was superseded');
+        // PR review round 35: the write above is an await, and the commit below is
+        // the persisted state write that follows it. Round 36: only the restore
+        // holding the pre-close capability may continue past shutdown entry.
+        if (this.persistenceRefused(capability) || (stillCurrent !== undefined && !stillCurrent())) {
+            throw new Error('Keys Manager is shutting down or the test cleanup was superseded');
+        }
+        await this.commitGrantGeneration(provider, row, payload, rotatedRef, stillCurrent, capability);
+    }
+    /**
+     * The single owner of `row.oauth.grantRef` semantics (QC N1): point the row
+     * at the record holding its rotated generation, merge the refresh-derived
+     * identity fields, and remove the superseded record. Both the echo
+     * reconciler and the connection test's rotation write-back commit through
+     * here, so the ref scheme, the identity merge and the cleanup policy have
+     * exactly one implementation.
+     *
+     * The record write stays with the caller: the reconciler must revalidate the
+     * row between that write and this commit (C6-1), so only the tail is shared.
+     */
+    async commitGrantGeneration(provider, owner, payload, rotatedRef, guard, capability) {
+        // PR review round 38: the rotation write that precedes this call is an
+        // await. An attempt superseded meanwhile must not repoint the row or delete
+        // the record it would find here — that record may be a newer window's
+        // already-committed generation — and shutdown must refuse both writes even
+        // when it began after the caller's own check.
+        if (this.persistenceRefused(capability) || (guard !== undefined && !guard()))
+            return;
+        const current = owner.oauth;
+        if (current === null)
+            return;
+        const previousRef = current.grantRef;
+        owner.oauth = {
+            ...current,
+            ...(previousRef === rotatedRef ? {} : { grantRef: rotatedRef }),
+            ...(payload.email === undefined ? {} : { email: payload.email }),
+            ...(payload.accountId === undefined ? {} : { accountId: payload.accountId }),
+            ...(typeof payload.expires === 'number' && Number.isFinite(payload.expires) ? { expiresAt: payload.expires } : {}),
+        };
+        if (previousRef !== rotatedRef) {
+            // The row repoint above is synchronous, but the delete is a second write:
+            // re-read both gates immediately before it so a shutdown or a takeover
+            // that landed in between cannot remove a record this attempt never owned.
+            if (this.persistenceRefused(capability) || (guard !== undefined && !guard())) {
+                this.store.touch();
+                return;
+            }
+            const records = this.credentialRecords();
+            try {
+                if (records === undefined)
+                    throw new Error('The credential store does not support records');
+                await records.deleteRecord(previousRef);
+            }
+            catch (error) {
+                this.warn(`cleanup of the superseded grant record failed for ${provider}: ${error instanceof Error ? error.message : String(error)}`);
+            }
+        }
+        this.store.touch();
+    }
+    /**
+     * Send the minimal request under the given scope and map its terminal
+     * chunk. A thrown error or the 20-second abort is reported, never swallowed.
+     */
+    async runTestRequest(provider, model, scope) {
+        const started = Date.now();
+        const signal = AbortSignal.timeout(KEY_TEST_TIMEOUT_MS);
+        try {
+            const outcome = await this.als.run(scope, async () => {
+                const stream = this.ctx.llm.stream({
+                    provider,
+                    model,
+                    messages: [{ role: 'user', content: [{ type: 'text', text: 'ping' }] }],
+                    maxTokens: 1,
+                    signal,
+                });
+                for await (const chunk of stream) {
+                    if (chunk.type !== 'finish')
+                        continue;
+                    const kind = chunk.reason?.kind;
+                    if (kind === 'error') {
+                        const failure = chunk.reason?.failure;
+                        return { ok: false, error: failure?.message ?? failure?.code ?? 'The provider reported a failure' };
+                    }
+                    // PR review SF3 + round 8: only a real completion is a pass. The ping
+                    // asks for one token, so `length` is the expected completion; a
+                    // finish chunk with NO reason, `aborted`, or any kind this broker
+                    // does not know means the provider did not answer, so reporting a
+                    // pass would claim a credential it never served.
+                    if (kind === 'stop' || kind === 'length' || kind === 'toolUse') {
+                        // PR review round 42: a successful ping only proves the route
+                        // answered. An api-key row test must also prove the pinned literal
+                        // was the credential that served it — a takeover during the stream
+                        // would otherwise be reported as this key's success.
+                        if (scope.keyId !== null && scope.oauthAccountId === null && scope.keyUsed !== true) {
+                            return { ok: false, error: `The ${provider} route was served by another credential source; the selected key was not used.` };
+                        }
+                        return { ok: true };
+                    }
+                    if (kind === undefined)
+                        return { ok: false, error: 'The provider returned no completion reason' };
+                    return { ok: false, error: kind === 'aborted' ? 'The request was aborted' : `The request ended with "${kind}"` };
+                }
+                return { ok: false, error: 'The provider returned no result' };
+            });
+            return { ...outcome, latencyMs: Date.now() - started };
+        }
+        catch (error) {
+            return {
+                ok: false,
+                latencyMs: Date.now() - started,
+                error: isTestTimeoutAbort(error, signal) ? `Timed out after ${KEY_TEST_TIMEOUT_LABEL}` : error instanceof Error ? error.message : String(error),
+            };
+        }
+    }
     /**
      * Demote the cascade to the key pool by deleting the projection record:
      * pi-ai's per-request resolution prefers the stored credential and only
@@ -2376,6 +4847,7 @@ export class KeysManagerService {
             // the missing pill and leaves "Set active" disabled — the documented
             // re-activation path unreachable until a restart or a new sign-in.
             this.activeAccounts.delete(provider);
+            this.foreignProjections.delete(provider);
             for (const row of providerRecord.keys) {
                 if (row.kind === 'oauth')
                     row.valueMissing = true;
@@ -2385,7 +4857,12 @@ export class KeysManagerService {
             // The projection is not ours anymore (native replacement): keep the
             // stale owner entry from routing attribution or demotion at this row.
             this.activeAccounts.delete(provider);
+            // …and the replacement still serves ahead of the pool (round 3).
+            this.foreignProjections.add(provider);
         }
+        // The projection row is gone: a surviving key pool is the serving source
+        // again, and a route with no API-key row stays unbound.
+        await this.syncBrokerBinding(provider);
         this.store.touch();
     }
     /**
@@ -2431,7 +4908,10 @@ export class KeysManagerService {
      * falls back to the key pool.
      */
     removeAccount(provider, accountId) {
-        return this.run(async () => {
+        return this.run(() => this.withRemovalInProgress(provider, async () => {
+            // R8-2: the removal decides against the route's live records, so it must
+            // not run inside a row test's borrow window.
+            await this.settleTestBeforeRemoval(provider);
             const providerRecord = this.store.provider(provider);
             if (providerRecord === undefined)
                 throw new Error(`Provider "${provider}" is not managed`);
@@ -2446,7 +4926,7 @@ export class KeysManagerService {
             this.store.clearBindings((_key, binding) => binding.keyId === row.id);
             this.store.touch();
             return this.buildState();
-        });
+        }));
     }
     /** Install the broker layer on one credential provider instance. */
     attachCredentials(credentials) {
@@ -2522,6 +5002,23 @@ export class KeysManagerService {
         this.credentialWrappers.set(raw, wrappers);
         if (this.rawCredentials === undefined)
             this.rawCredentials = raw;
+        // A remount replaces the credential backend (PR review round 27): every
+        // projection fact loaded so far describes the previous store, so drop the
+        // classification and restart the ownership read before repairing. The
+        // first mount is startup, whose fresh maps need no invalidation.
+        if (this.credentialsMounted)
+            this.invalidateProjectionOwnership();
+        this.credentialsMounted = true;
+        // The credentials service can mount after this plugin (PR review round 23):
+        // the load-time hydration then read nothing and left ownership unknown, so
+        // the startup repair bound nothing. Re-read the projections now that the
+        // record half is reachable, then repair — the same convergence as startup,
+        // idempotent when the seam was mounted all along. The read lands through
+        // {@link noteProviderHydrated}, so a repair already waiting wakes with it.
+        this.projectionHydration = this.hydrateProjectionOwnership();
+        void this.repairBrokerBindings().catch(error => {
+            this.warn(`broker binding repair after the credentials mount failed: ${error instanceof Error ? error.message : String(error)}`);
+        });
     }
     /** Restore the credential provider methods when our fiber unloads. */
     detachCredentials(credentials) {
@@ -2632,8 +5129,15 @@ export class KeysManagerService {
     namespace(descriptor, ns) {
         return descriptor.namespaces.find(entry => entry.ns === ns);
     }
-    /** Apply one path-addressed settings write through the live revision. */
-    async mutateSettings(ns, ops) {
+    /**
+     * Apply one path-addressed settings write through the live revision.
+     *
+     * `stillWrites` runs after the descriptor re-read and immediately before the
+     * mutation: a decision derived from an earlier snapshot can be stale by then
+     * ({@link syncBrokerBinding}'s bind gate, PR review round 25). A declining
+     * guard skips the write and reports it.
+     */
+    async mutateSettings(ns, ops, stillWrites) {
         const settings = this.settingsService();
         if (settings === undefined)
             throw new Error('Settings are unavailable in this composition');
@@ -2648,7 +5152,10 @@ export class KeysManagerService {
         }
         if (descriptor === undefined)
             throw new Error(`Settings namespace "${ns}" is not mounted`);
+        if (stillWrites !== undefined && !stillWrites())
+            return false;
         await settings.mutate(ns, ops, descriptor.revision);
+        return true;
     }
     /** Prune expired bindings at most once a minute, without a restart. */
     pruneBindings(now) {
@@ -2825,20 +5332,51 @@ export class KeysManagerService {
             pausedKeyCount: allKeys.filter(key => key.status === 'paused').length,
             bindingsCount: Object.keys(this.store.state.sessionBindings).length,
             warnings,
+            transportAccounts: this.transportRows.map(row => ({ ...row })),
         };
     }
-    /** Remote: complete manager state. */
+    /**
+     * Remote: complete manager state.
+     *
+     * The transport rows come from another package's records, and reading them
+     * is async while this endpoint is synchronous, so every poll starts a
+     * refresh for the next one (the client ticks every 30 s), unless one is
+     * already in flight. The constructor warms the first read and record
+     * updates refresh immediately, so the one-tick lag only shows on a cold
+     * start.
+     */
     getState() {
+        this.refreshTransportAccountsIfIdle();
         return this.buildState();
     }
     /** Find one directory entry by route id. */
     directoryEntry(provider) {
         return this.ctx.llm.listConfigurableProviders().find(entry => entry.provider === provider);
     }
+    /**
+     * Whether the key pool is the credential source that serves this route: no
+     * OAuth projection owns it and at least one API-key row still holds a value.
+     * This is the one arbiter for both the verdict below and the binding write
+     * ({@link syncBrokerBinding}).
+     */
+    keyPoolServes(record) {
+        return this.oauthOwnerFor(record.provider) === null
+            // A projection no managed row owns still serves ahead of the broker
+            // reference: binding the pool here would take the foreign account out of
+            // service (PR review round 3).
+            && !this.foreignProjections.has(record.provider)
+            && record.keys.some(key => key.kind === 'api-key' && key.valueMissing !== true);
+    }
     /**
      * Classify the live binding. An unreadable settings snapshot is `unknown`,
      * not a confirmed mismatch: transient settings failures must not disable
      * key-pool recovery for a provider that is still managed.
+     *
+     * Only a value Keys Manager never wrote is a `mismatch`: the warning now
+     * means "the user took the profile back", not "the OAuth route is broken".
+     * An unbound profile is healthy while the key pool is not the serving
+     * source (an OAuth projection serves, or no API-key row holds a value) —
+     * that is the OAuth-only route's native shape.
      */
     bindingState(record, descriptor = this.describeSettings()) {
         if (!descriptor.readable) {
@@ -2848,10 +5386,246 @@ export class KeysManagerService {
         }
         const namespace = this.namespace(descriptor, record.settingsNs);
         const profile = namespace === undefined ? undefined : asProfile(getPath(namespace.value, record.settingsPath));
-        const state = profile !== undefined && profile.apiKeyEnv === record.brokerRef ? 'healthy' : 'mismatch';
+        const current = profile !== undefined && typeof profile.apiKeyEnv === 'string' ? profile.apiKeyEnv : undefined;
+        const state = current === record.brokerRef
+            // The broker reference is Keys Manager's own value; a projection that
+            // claimed the route is repaired by the binding sync, not by the user.
+            ? 'healthy'
+            : current !== undefined
+                ? 'mismatch'
+                : this.keyPoolServes(record) ? 'mismatch' : 'healthy';
         this.bindingCache.set(record.provider, state);
         return state;
     }
+    /**
+     * The single authority for a managed provider's pi-ai `apiKeyEnv`.
+     *
+     * pi-ai resolves a named credential synchronously and throws
+     * `MISSING_CREDENTIAL` when the credential seam cannot answer it, so the
+     * broker reference may only sit on a profile whose requests the key pool
+     * actually serves ({@link keyPoolServes}). Every other shape must be
+     * unbound, or pi-ai never reaches its own stored OAuth grant.
+     *
+     * Each direction has exactly one provably owned write:
+     * - bind: a profile that names no credential, or — with `takeover`, passed
+     *   solely by {@link adoptProvider} — the pre-adoption reference adoption
+     *   recorded and deliberately replaces;
+     * - unbind: only the broker reference Keys Manager itself wrote.
+     *
+     * Any other value is a hand-edit (or the pre-adoption reference release
+     * restored): it is never touched, and the `mismatch` verdict stays the
+     * signal that the user took the profile back.
+     *
+     * `write: false` is the startup repair: it only touches a profile that
+     * already exists, so a first run never materializes one from nothing. The
+     * release direction is single-sourced in {@link releasingProviders}: a
+     * provider being unmanaged is never bound again, whatever the row order of
+     * the pool it is deleting.
+     *
+     * A read-side problem or a refused write degrades to a warning: the
+     * callers' committed change must not fail on a settings problem, the user
+     * still sees that the route may resolve the wrong credential source, and
+     * the next repair pass retries.
+     *
+     * Returns whether the profile ends in the shape the serving source justifies
+     * (`true` also when no write was needed). The connection test's borrow is the
+     * one caller that acts on it: a failed release must refuse the test instead
+     * of sending a request the wrong credential source would answer.
+     *
+     * While a row test borrows the route (QC B4) no caller may persist a decision
+     * derived from that borrowed world — an `addKey` landing inside the window
+     * would otherwise unbind the profile for good. The test's own writes pass
+     * `borrow: true`; the window-end sync then writes the restored state.
+     */
+    async syncBrokerBinding(provider, options = {}) {
+        const record = this.store.provider(provider);
+        if (record === undefined)
+            return false;
+        // A borrow hides its world from this authority, except while the provider
+        // is being unmanaged: release is a real state change, and the unbind
+        // direction is already one-way there (a release that skipped it would
+        // leave a dangling broker reference on a profile nothing repairs).
+        if (options.borrow !== true && this.testBindingBorrows.has(provider) && !this.releasingProviders.has(provider)) {
+            return false;
+        }
+        const descriptor = this.describeSettings();
+        if (!descriptor.readable) {
+            // QC N3: a composition that has not mounted the settings service yet is
+            // a not-yet, not a repair failure — the mount seam re-runs this pass and
+            // owns the warning if the write then still fails.
+            if (this.settingsService() === undefined)
+                return false;
+            this.bindingWriteRefused(provider, 'the settings snapshot is unreadable');
+            return false;
+        }
+        const namespace = this.namespace(descriptor, record.settingsNs);
+        if (namespace === undefined) {
+            this.bindingWriteRefused(provider, `settings namespace "${record.settingsNs}" is not mounted`);
+            return false;
+        }
+        const profile = asProfile(getPath(namespace.value, record.settingsPath));
+        if (options.write === false && profile === undefined)
+            return true;
+        const current = profile !== undefined && typeof profile.apiKeyEnv === 'string' ? profile.apiKeyEnv : undefined;
+        const desired = this.keyPoolServes(record) ? record.brokerRef : undefined;
+        // Binding is a guess while this process cannot attribute the projection:
+        // the empty owner/foreign maps otherwise read as "the pool serves" and
+        // overwrite a persisted grant nobody could see (PR review round 24). The
+        // unbind direction is the safe one and still runs.
+        if (desired !== undefined && !this.projectionOwnershipKnown(provider))
+            return false;
+        if (current === desired)
+            return true;
+        if (desired === undefined) {
+            // Never strip a value Keys Manager did not write: a user hand-edit and
+            // a restored pre-adoption reference look exactly like this.
+            if (current !== record.brokerRef)
+                return false;
+        }
+        else {
+            // Never bind over a value Keys Manager did not write — except adoption,
+            // which recorded this exact pre-adoption reference to replace it.
+            if (this.releasingProviders.has(provider))
+                return false;
+            if (current !== undefined && !(options.takeover === true && current === record.originalApiKeyEnv))
+                return false;
+        }
+        const path = [...record.settingsPath, 'apiKeyEnv'];
+        // PR review round 35: the last point before the settings write. Only
+        // `closing` is read: shutdown's own pre-close restoration writes here by
+        // design and runs before that flag goes up.
+        if (this.closing)
+            return false;
+        try {
+            // The entry gate above read a snapshot; ownership can turn unknown while
+            // this write re-reads its descriptor (PR review round 25). Binding is a
+            // guess then, so the gate closes again at the last point before the
+            // mutation. Unbinding stays allowed.
+            const written = await this.mutateSettings(record.settingsNs, [desired === undefined ? { op: 'unset', path } : { op: 'set', path, value: desired }], () => desired === undefined || this.projectionOwnershipKnown(provider));
+            if (!written)
+                return false;
+        }
+        catch (error) {
+            this.bindingWriteRefused(provider, error instanceof Error ? error.message : String(error));
+            return false;
+        }
+        // The mutation is asynchronous, so the serving source can flip while it
+        // settles: a native OAuth write classified foreign after the gates above
+        // unbinds an already-unbound profile and returns, then this older bind
+        // commits over that projection (PR review round 31). Each settled write
+        // therefore re-derives the shape from the live source, and the correction
+        // itself retries — bounded — because the source can move again while the
+        // corrective write settles (PR review round 32). The counter, not a flag,
+        // keeps a genuinely flapping route from cycling: past the bound the next
+        // repair pass owns it.
+        const correction = options.correction ?? 0;
+        if (correction < BINDING_CORRECTION_LIMIT) {
+            // PR review round 35: the mutation above settled across an await, so the
+            // corrective write it may recurse into is refused once shutdown began.
+            if (this.closing)
+                return false;
+            const settled = this.store.provider(provider);
+            if (settled !== undefined && this.keyPoolServes(settled) !== (desired !== undefined)) {
+                return this.syncBrokerBinding(provider, { ...options, correction: correction + 1 });
+            }
+        }
+        // The profile matches the serving source now, by construction.
+        this.bindingCache.set(provider, 'healthy');
+        return true;
+    }
+    /**
+     * Repair every managed provider's binding through the one authority. The
+     * startup pass and the settings-mount seam both run it, so a profile that
+     * was unreadable when hydration settled is still healed in this process
+     * instead of waiting for the next start.
+     */
+    async repairBrokerBindings() {
+        const providers = Object.keys(this.store.providers);
+        const deferred = [];
+        // A provider whose ownership is already known repairs first (PR review
+        // round 3): one wedged OAuth read must not delay a pure key-pool route,
+        // whose shape can never depend on a projection read. The skipped set is
+        // carried to the second pass (PR review round 5): re-deriving readiness
+        // there would drop a provider whose read landed while pass 1 awaited
+        // another provider.
+        for (const provider of providers) {
+            if (!this.projectionOwnershipKnown(provider)) {
+                deferred.push(provider);
+                continue;
+            }
+            await this.repairBinding(provider);
+        }
+        for (const provider of deferred) {
+            // An OAuth provider whose own read has not landed is never repaired
+            // from a guessed shape; the read is bounded, so a provider that never
+            // answers only skips itself.
+            if (!await this.awaitProjectionOwnership(provider))
+                continue;
+            await this.repairBinding(provider);
+        }
+    }
+    /**
+     * One provider's repair pass (PR review round 42). A recorded adoption
+     * takeover debt is settled here only when the authoritative readiness says
+     * no projection serves the route — the case a restart leaves behind when the
+     * foreign record disappeared while the process was down.
+     */
+    async repairBinding(provider) {
+        const record = this.store.provider(provider);
+        const takeover = record?.takeoverPending === true
+            && !this.foreignProjections.has(provider)
+            && this.oauthOwnerFor(provider) === null;
+        const bound = await this.syncBrokerBinding(provider, { write: false, takeover });
+        if (takeover && bound && record !== undefined) {
+            record.takeoverPending = false;
+            this.store.touch();
+        }
+    }
+    /**
+     * Re-derive a managed route's binding after its projection changed outside
+     * this manager's account pool: a removal, a committed harvest that handed
+     * the route back to its API-key pool (PR review round 2), or a foreign
+     * projection taking a bound route over (round 4).
+     *
+     * The route's serving source is no longer the managed pool, or the pool is
+     * the only source left: either way `syncBrokerBinding` derives the one
+     * profile shape pi-ai's resolution order requires. A store refusal only
+     * warns — these are compensation paths and must never fail the change that
+     * triggered them; the next repair pass retries.
+     */
+    async syncBindingAfterProjectionChange(provider) {
+        // PR review round 30: this body is chained behind a hydration read that can
+        // land after `close()` has drained the chains; the binding write it ends in
+        // is persistence, so shutdown refuses it.
+        if (this.closing)
+            return;
+        try {
+            // PR review round 40: adoption keeps the pre-adoption reference while a
+            // foreign projection serves the route and records that it still owes the
+            // takeover on the provider record (so the debt survives a restart). Only
+            // that recorded debt lets this sync pass `takeover`, and it is cleared
+            // once the bind lands; `originalApiKeyEnv` alone proves nothing.
+            const record = this.store.provider(provider);
+            const takeover = record?.takeoverPending === true;
+            const bound = await this.syncBrokerBinding(provider, { takeover });
+            if (takeover && bound && record !== undefined) {
+                record.takeoverPending = false;
+                this.store.touch();
+            }
+        }
+        catch (error) {
+            this.warn(`could not re-derive the pi-ai binding for ${provider} after its projection changed: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    /**
+     * A refused binding write must not fail the change that triggered it, but
+     * it cannot stay in the log alone either: the route may resolve the wrong
+     * credential source until the next repair.
+     */
+    bindingWriteRefused(provider, reason) {
+        this.warn(`could not update the pi-ai broker binding for ${provider}: ${reason}`);
+        this.pushWarning(`The pi-ai credential reference for ${provider} was not updated (${reason}). Requests may use a different credential source until this is repaired.`);
+    }
     /** Candidate credential refs from which an existing key can be imported. */
     importRefs(entry, profile) {
         const refs = [];
@@ -2939,25 +5713,14 @@ export class KeysManagerService {
             if (collision !== undefined)
                 throw new Error(`Broker reference collision for "${provider}"`);
             const originalApiKeyEnv = profile !== undefined && typeof profile.apiKeyEnv === 'string' ? profile.apiKeyEnv : null;
-            const path = [...entry.settingsPath, 'apiKeyEnv'];
+            // A read-only profile cannot carry the binding; refuse before any
+            // managed state or imported credential exists.
+            if (!descriptor.writable)
+                throw new Error('The active profile is read-only');
             const hit = await this.findImport(entry, profile);
             let imported;
             if (hit !== undefined)
                 imported = await this.createKeyRecord(provider, 'Imported', hit.value, hit.ref);
-            try {
-                await this.mutateSettings(entry.settingsNs, [{ op: 'set', path, value: brokerRef }]);
-            }
-            catch (error) {
-                if (imported !== undefined) {
-                    try {
-                        await this.unsetOriginal(imported.ref);
-                    }
-                    catch (cleanupError) {
-                        this.warn(`adoption cleanup left credential ${imported.ref}: ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}`);
-                    }
-                }
-                throw error;
-            }
             const record = {
                 provider,
                 displayName: extra?.name ?? entry.displayName ?? provider,
@@ -2979,14 +5742,165 @@ export class KeysManagerService {
             };
             this.store.providers[provider] = record;
             this.rebuildBrokerMap();
+            // PR review round 17: this provider was not in the startup hydration
+            // snapshot, so its projection is read HERE, before the first binding
+            // sync. Without the read, "not in the snapshot" looked exactly like "no
+            // projection" and the sync bound the pool over the route's native grant.
+            let ownershipRead = await this.readAdoptionProjection(provider);
+            // PR review round 28 (I-000186): a read a projection event overtook lands
+            // nothing, and the reconciliation queued behind it repairs the binding
+            // WITHOUT the takeover only this adoption may perform — so a superseded
+            // answer left a committed adoption on its pre-adoption reference forever
+            // (the pool never serves, and re-adopting returns immediately because the
+            // provider is managed). The retry only reads, and the chain is drained by
+            // definition once this read is its tail: the adoption waits for that
+            // authoritative answer instead of committing an undecided bind.
+            // No deadlock: no grant-chain body awaits the mutation queue this body holds.
+            while (ownershipRead === 'superseded')
+                ownershipRead = await this.readAdoptionProjection(provider);
+            // The binding follows the serving credential, never the route's ability
+            // to hold keys: an OAuth-only route (`caps.keys === false`, no key row)
+            // keeps its profile unbound so pi-ai reaches the stored grant, while a
+            // route with an imported API key binds through the one authority.
+            // Adoption is the only caller allowed to take over the pre-adoption
+            // reference it recorded as `originalApiKeyEnv`.
+            const bound = ownershipRead === 'known'
+                ? await this.syncBrokerBinding(provider, { takeover: true })
+                : false;
+            // A refused write the pool's serving shape required leaves a state no
+            // later repair may touch (it cannot tell that value from a hand edit), so
+            // undo the adoption entirely (PR review round 2). A foreign projection or
+            // an unreadable one needs no write: the profile is not the pool's to
+            // rewrite, and the adoption itself is complete.
+            if (ownershipRead === 'known' && !bound && this.keyPoolServes(record)) {
+                await this.rollbackAdoption(record, imported);
+                throw new Error(`The ${provider} profile refused the credential binding write; the adoption was rolled back. Repair the profile in Models and adopt again.`);
+            }
+            if (ownershipRead === 'known' && this.foreignProjections.has(provider) && record.originalApiKeyEnv !== null) {
+                // A foreign projection serves the route, so this adoption binds
+                // nothing; the pre-adoption reference it kept may only be taken over
+                // when that projection disappears (round 40).
+                record.takeoverPending = true;
+            }
+            if (ownershipRead === 'unknown') {
+                // Ownership stays unknown and nothing was bound; a later authoritative
+                // read clears the marker and re-derives the binding.
+                this.pushWarning(`The ${provider} route was adopted, but its stored credential could not be read; its models profile was left unbound until the credential store answers.`);
+            }
             if (hit !== undefined)
                 this.pushWarning(`Imported the existing credential ${hit.ref}.`);
             this.store.touch();
             return this.buildState();
         });
     }
-    /** Discover models for a new extra provider, falling back to the seed catalog. */
+    /**
+     * Read and classify one provider's live projection at adoption (PR review
+     * round 17) — the same read hydration does, for the one route hydration
+     * cannot cover: a provider that did not exist when the snapshot was taken.
+     *
+     * An adoption owns no account row yet, so any live record is one no row of
+     * this pool owns: a native api-key, an unrecognized payload, and a grant left
+     * behind by a released account all serve the route ahead of the broker
+     * reference, so the route is marked foreign and the pool is not bound over it
+     * (PR review rounds 3–4). An absent record clears any stale marker: the pool
+     * may serve. A failed read is not an absent projection (round 8): ownership
+     * stays unknown, so nothing may be bound and no repair touches the route
+     * until an authoritative read answers ({@link noteProjectionReadSucceeded}).
+     *
+     * Returns `unknown` for that failure; the adoption itself is kept — there is
+     * no write to roll back, and only the binding is undecided.
+     *
+     * The classification runs inside the route's grant chain (PR review round
+     * 22, Codex P1). A native write or deletion reconciled while the read is
+     * outstanding is therefore either already visible to it or queued behind it:
+     * a read whose snapshot a newer event overtook reports `superseded` and lands
+     * nothing, so a stale absence can never bind the broker over a newer
+     * projection state and a stale presence can never leave the pool unbound.
+     */
+    readAdoptionProjection(provider) {
+        return this.scheduleGrantReconciliation(provider, () => this.classifyAdoptionProjection(provider));
+    }
+    /** Body of {@link readAdoptionProjection}: read, then land the classification. */
+    async classifyAdoptionProjection(provider) {
+        // This body's own chain entry. A projection event reconciled during the
+        // read appends a newer tail, which re-reads the live state.
+        const chainTail = this.grantReconciliations.get(provider);
+        const grantKey = `${OAUTH_GRANT_RECORD_SCOPE}/${provider}`;
+        const records = this.credentialRecords();
+        if (records === undefined) {
+            this.ownershipReadFailures.add(provider);
+            this.warn(`projection ownership for ${provider} could not be read during adoption: the credential store is unavailable`);
+            return 'unknown';
+        }
+        let record;
+        try {
+            record = await records.readRecord(grantKey);
+        }
+        catch (error) {
+            this.ownershipReadFailures.add(provider);
+            this.warn(`projection ownership for ${provider} could not be read during adoption: ${error instanceof Error ? error.message : String(error)}`);
+            return 'unknown';
+        }
+        if (this.grantReconciliations.get(provider) !== chainTail) {
+            // Ownership stays unknown until the queued read answers; nothing here may
+            // land, and the adoption binds nothing.
+            this.ownershipReadFailures.add(provider);
+            return 'superseded';
+        }
+        this.ownershipReadFailures.delete(provider);
+        this.noteProviderHydrated(provider);
+        if (record === undefined)
+            this.foreignProjections.delete(provider);
+        else
+            this.foreignProjections.add(provider);
+        return 'known';
+    }
+    /**
+     * Undo an adoption whose initial binding write was refused (PR review
+     * round 2): drop the managed record and its broker entry, delete the
+     * plugin-scope copy this call created, and put back a pre-adoption
+     * reference that landed despite the refusal. The source credential and the
+     * profile's other fields are never touched — adoption only read them.
+     */
+    async rollbackAdoption(record, imported) {
+        const provider = record.provider;
+        delete this.store.providers[provider];
+        this.rebuildBrokerMap();
+        if (imported !== undefined) {
+            try {
+                await this.unsetOriginal(imported.ref);
+            }
+            catch (error) {
+                this.warn(`adoption rollback could not delete the imported credential ${imported.ref} for ${provider}: ${error instanceof Error ? error.message : String(error)}`);
+            }
+        }
+        const descriptor = this.describeSettings();
+        const namespace = this.namespace(descriptor, record.settingsNs);
+        const profile = asProfile(namespace === undefined ? undefined : getPath(namespace.value, record.settingsPath));
+        const current = profile !== undefined && typeof profile.apiKeyEnv === 'string' ? profile.apiKeyEnv : undefined;
+        if (current === record.brokerRef) {
+            try {
+                const path = [...record.settingsPath, 'apiKeyEnv'];
+                await this.mutateSettings(record.settingsNs, [
+                    record.originalApiKeyEnv === null ? { op: 'unset', path } : { op: 'set', path, value: record.originalApiKeyEnv },
+                ]);
+            }
+            catch (error) {
+                this.warn(`adoption rollback could not restore the pre-adoption reference for ${provider}: ${error instanceof Error ? error.message : String(error)}`);
+            }
+        }
+        this.store.touch();
+    }
+    /**
+     * Discover models for a new extra provider, falling back to the seed catalog.
+     * A route that declares a static header installs the seed catalog directly:
+     * the discovery request has no header slot, so probing such an endpoint can
+     * only fail (and would hold the serialized mutation queue for the probe's
+     * whole timeout).
+     */
     async discoverModels(extra, value) {
+        if (extra.headerEnv !== undefined)
+            return { models: normalizeModels(extra.models) };
         let discovered = [];
         let failure;
         try {
@@ -3010,7 +5924,14 @@ export class KeysManagerService {
             return { models, failure };
         return { models: normalizeModels(extra.models), failure };
     }
-    /** Remote: install and adopt one extra built-in provider. */
+    /**
+     * Remote: install and adopt one extra built-in provider.
+     *
+     * Deliberate exemption from the one-authority rule
+     * ({@link syncBrokerBinding}): this call creates the profile it binds and
+     * the key that serves it in the same mutation, so the write below is the
+     * route's first binding rather than a takeover of a value the user owns.
+     */
     addExtraProvider(extraId, alias, value) {
         return this.run(async () => {
             if (typeof extraId !== 'string' || extraId.length === 0)
@@ -3019,9 +5940,18 @@ export class KeysManagerService {
             const extra = EXTRA_PROVIDER_MAP.get(extraId);
             if (extra === undefined)
                 throw new Error(`Unknown extra provider "${extraId}"`);
-            if (this.store.provider(extraId) !== undefined) {
+            // Resolved before the first credential/settings write on every add path,
+            // so a missing variable refuses the add without leaving a key or a
+            // partial profile.
+            const headers = resolveHeaderEnv(extra);
+            const managed = this.store.provider(extraId);
+            if (managed !== undefined) {
                 this.pushWarning('Provider is already managed; the key was added instead.');
-                await this.addKeyLocked(extraId, input.alias, input.value);
+                // The shared managed-key path repairs the declared headers, so every
+                // add-key flow restores them and the repair keeps one implementation.
+                // Hand it the value resolved above: the entry refusal stays the single
+                // decision for this surface, and the environment is read once per add.
+                await this.addKeyLocked(extraId, input.alias, input.value, headers);
                 this.store.touch();
                 return this.buildState();
             }
@@ -3052,8 +5982,20 @@ export class KeysManagerService {
                     keys: [],
                 };
                 const key = await this.createKeyRecord(extraId, input.alias, input.value);
+                const ops = [{ op: 'set', path: ['providers', extraId, 'apiKeyEnv'], value: record.brokerRef }];
+                // Fill the declared headers the stored profile does not carry; a value
+                // the profile already sets for the same header is never overwritten.
+                const storedHeaders = staticHeaders(existing.headers);
+                this.warnHeaderDrift(extra, headers, storedHeaders);
+                const missing = missingHeaders(headers, storedHeaders);
+                if (Object.keys(missing).length > 0) {
+                    ops.push({ op: 'set', path: ['providers', extraId, 'headers'], value: { ...storedHeaders, ...missing } });
+                }
                 try {
-                    await this.mutateSettings('llm-pi-ai', [{ op: 'set', path: ['providers', extraId, 'apiKeyEnv'], value: record.brokerRef }]);
+                    // First binding of a profile this manager does not own yet, written
+                    // together with the key that serves it (see the method comment); the
+                    // declared-header repair above travels in the same write.
+                    await this.mutateSettings('llm-pi-ai', ops);
                 }
                 catch (error) {
                     try {
@@ -3067,6 +6009,10 @@ export class KeysManagerService {
                 record.keys.push(key);
                 this.store.providers[extraId] = record;
                 this.rebuildBrokerMap();
+                // Readiness is per provider now (PR review round 17): this route was
+                // created here and its binding is written by this very call, so no
+                // snapshot will ever read it.
+                this.noteProviderHydrated(extraId);
                 this.store.touch();
                 return this.buildState();
             }
@@ -3081,10 +6027,13 @@ export class KeysManagerService {
                 api: extra.api,
                 baseURL: extra.baseURL,
                 apiKeyEnv: brokerRef,
+                ...(headers === undefined ? {} : { headers }),
                 models,
             };
             const key = await this.createKeyRecord(extraId, input.alias, input.value);
             try {
+                // The profile and its binding are created together (see the method
+                // comment); no user value exists to take over here.
                 await this.mutateSettings('llm-pi-ai', [{ op: 'set', path: ['providers', extraId], value: profile }]);
             }
             catch (error) {
@@ -3117,12 +6066,71 @@ export class KeysManagerService {
             };
             this.store.providers[extraId] = record;
             this.rebuildBrokerMap();
+            // Same as the take-over branch above: the profile and its binding are
+            // this call's own write, so the route is attributable immediately.
+            this.noteProviderHydrated(extraId);
             this.store.touch();
             return this.buildState();
         });
     }
+    /**
+     * Restore a managed extra route's declared static headers.
+     *
+     * A managed profile can lose its declared headers through a Models edit;
+     * every managed add-key flow repairs them instead of leaving a route whose
+     * required header is silently absent. Only a live profile with a healthy
+     * binding is ours to repair: a deleted profile would gain a header-only
+     * half-profile, and a replaced one is the state release refuses to touch. A
+     * stored value for the same header always wins. The caller may pass the
+     * headers it already resolved at its own entry (where a missing variable can
+     * still refuse the add before any write); otherwise this method resolves
+     * them. Either way a failure only warns, because the key has already been
+     * added: a route whose headers cannot be resolved, and a settings write that
+     * cannot be performed, both leave the repair pending for the next add so a
+     * half-applied add is never turned into a rejected one.
+     */
+    async repairDeclaredHeaders(record, declared) {
+        const extra = record.extraId === null ? undefined : EXTRA_PROVIDER_MAP.get(record.extraId);
+        if (extra?.headerEnv === undefined)
+            return;
+        let headers = declared;
+        if (headers === undefined) {
+            try {
+                headers = resolveHeaderEnv(extra);
+            }
+            catch (error) {
+                this.pushWarning(`Did not restore the declared headers on the ${extra.id} route: ${error instanceof Error ? error.message : String(error)}`);
+                return;
+            }
+        }
+        if (headers === undefined)
+            return;
+        const liveProfile = this.profileAt(record.settingsNs, record.settingsPath);
+        if (liveProfile === undefined || this.bindingState(record) === 'mismatch') {
+            this.pushWarning(`Did not restore the ${Object.keys(headers).join(', ')} header on the ${extra.id} route: ${liveProfile === undefined ? 'its Models profile no longer exists' : 'its Models profile was replaced'}.`);
+            return;
+        }
+        const stored = staticHeaders(liveProfile.headers);
+        this.warnHeaderDrift(extra, headers, stored);
+        const missing = missingHeaders(headers, stored);
+        if (Object.keys(missing).length === 0)
+            return;
+        try {
+            await this.mutateSettings(record.settingsNs, [
+                { op: 'set', path: [...record.settingsPath, 'headers'], value: { ...stored, ...missing } },
+            ]);
+        }
+        catch (error) {
+            // The key and its credential are already written; a failing settings
+            // write must not reject the add. The repair stays pending, so the next
+            // add-key flow retries it.
+            this.pushWarning(`Did not restore the ${Object.keys(missing).join(', ')} header on the ${extra.id} route: ${error instanceof Error ? error.message : String(error)}`);
+            return;
+        }
+        this.pushWarning(`Restored the missing ${Object.keys(missing).join(', ')} header on the managed profile.`);
+    }
     /** Add one key; caller already owns the mutation queue. */
-    async addKeyLocked(provider, alias, value) {
+    async addKeyLocked(provider, alias, value, declaredHeaders) {
         const record = this.store.provider(provider);
         if (record === undefined)
             throw new Error(`Provider "${provider}" is not managed`);
@@ -3141,6 +6149,15 @@ export class KeysManagerService {
             throw new Error(`A provider may have at most ${KEY_LIMIT} keys`);
         const key = await this.createKeyRecord(provider, input.alias, input.value);
         record.keys.push(key);
+        // After the key add: a refused key (capability or capacity) must leave the
+        // settings document untouched, so the repair never runs ahead of it.
+        await this.repairDeclaredHeaders(record, declaredHeaders);
+        // A route adopted for accounts only, or one whose pool lost its last key,
+        // binds as soon as a usable API-key row exists again. An extra route's
+        // profile is its whole route, so a deleted one is never re-materialized
+        // from a binding write; a native route keeps its directory defaults and
+        // may adopt the binding as its first profile content.
+        await this.syncBrokerBinding(provider, record.extraId === null ? {} : { write: false });
     }
     /** Remote: add one key to a managed provider. */
     addKey(provider, alias, value) {
@@ -3170,7 +6187,9 @@ export class KeysManagerService {
     }
     /** Remote: delete one key, releasing the provider when it was the last one. */
     deleteKey(provider, keyId) {
-        return this.run(async () => {
+        return this.run(() => this.withRemovalInProgress(provider, async () => {
+            // R8-2: a test may still be about to send this row's credential.
+            await this.settleTestBeforeRemoval(provider);
             const record = this.store.provider(provider);
             if (record === undefined)
                 throw new Error(`Provider "${provider}" is not managed`);
@@ -3195,17 +6214,27 @@ export class KeysManagerService {
             }
             record.keys.splice(index, 1);
             this.store.clearBindings((_key, binding) => binding.keyId === key.id);
+            // Removing the last usable API-key row leaves nothing for a broker
+            // reference to resolve; a surviving pool keeps its binding.
+            await this.syncBrokerBinding(provider);
             this.store.touch();
             return this.buildState();
-        });
+        }));
     }
-    /** Read one live profile for release-time cleanup decisions. */
+    /** Read one live profile for repair and release-time cleanup decisions. */
     profileAt(ns, path) {
         const descriptor = this.describeSettings();
         const namespace = this.namespace(descriptor, ns);
         return namespace === undefined ? undefined : asProfile(getPath(namespace.value, path));
     }
-    /** Restore the exact live profile captured before release mutated it. */
+    /**
+     * Restore the exact live profile captured before release mutated it.
+     *
+     * Deliberate exemption from the one-authority rule: release is unmanaging,
+     * so this write puts the pre-adoption document back instead of deriving a
+     * binding from a key pool that is being deleted. Every other caller goes
+     * through {@link syncBrokerBinding}.
+     */
     async restoreProfileSnapshot(record, snapshot) {
         if (record.settingsPath.length === 0) {
             const apiKeyEnv = snapshot !== undefined && typeof snapshot.apiKeyEnv === 'string' ? snapshot.apiKeyEnv : record.brokerRef;
@@ -3218,29 +6247,73 @@ export class KeysManagerService {
                 : { op: 'set', path: record.settingsPath, value: snapshot },
         ]);
     }
-    /** Remove every managed credential, recording progress before a retry. */
+    /**
+     * Remove every managed credential, recording progress before a retry.
+     *
+     * The provider is flagged as releasing for the whole loop: a demotion
+     * inside it (an `oauth` row iterated before a surviving `api-key` row) must
+     * not re-bind the profile, or the reference release just restored would be
+     * overwritten and then stripped by the closing unbind. While unmanaging the
+     * binding only ever goes one way — off.
+     */
     async deleteManagedCredentials(record) {
-        for (const key of record.keys) {
-            if (key.kind === 'oauth' && key.oauth !== null) {
-                // Same cleanup as removeAccount/deleteKey: when this row owns the
-                // activation projection, demote it first so the released route
-                // resolves through the restored apiKeyEnv instead of a grant whose
-                // manager is gone (pi-ai resolution prefers a stored credential).
-                await this.removeOAuthGrant(record.provider, key);
-            }
-            else {
-                await this.unsetOriginal(key.ref);
+        this.releasingProviders.add(record.provider);
+        try {
+            for (const key of record.keys) {
+                if (key.kind === 'oauth' && key.oauth !== null) {
+                    // Same cleanup as removeAccount/deleteKey: when this row owns the
+                    // activation projection, demote it first so the released route
+                    // resolves through the restored apiKeyEnv instead of a grant whose
+                    // manager is gone (pi-ai resolution prefers a stored credential).
+                    await this.removeOAuthGrant(record.provider, key);
+                }
+                else {
+                    await this.unsetOriginal(key.ref);
+                }
+                key.valueMissing = true;
+                this.store.touch();
             }
-            key.valueMissing = true;
-            this.store.touch();
+            this.activeAccounts.delete(record.provider);
+            this.foreignProjections.delete(record.provider);
+            // Every projection row is gone and every key is marked missing. This is
+            // also releaseLocked's binding step: its profile already carries the
+            // captured original, so only a lingering broker reference of our own is
+            // removed and a released route keeps the value the user had.
+            await this.syncBrokerBinding(record.provider);
+        }
+        finally {
+            this.releasingProviders.delete(record.provider);
         }
-        this.activeAccounts.delete(record.provider);
+    }
+    /**
+     * Drop any armed intentional-removal marker for a provider being released.
+     *
+     * The marker only exists to silence the record-updated echo of the manager's
+     * own projection removal, and that echo is dropped outright once the provider
+     * is unmanaged: {@link onGrantRecordUpdated} returns at event time and
+     * {@link reconcileGrantRecord} at body time. A release can land between the
+     * arm and that echo — the abort compensation arms inside the mutation queue
+     * while its echo is still chained behind an in-flight body — leaving the
+     * marker armed for its whole TTL with nothing left to consume it. A provider
+     * re-adopted inside that window would then read a genuine out-of-band
+     * removal as the manager's own: no warning, no `valueMissing`, no
+     * stale-owner cleanup.
+     *
+     * Called only on the successful release path: a release that throws leaves
+     * the provider managed, and its echo may still legitimately arrive.
+     */
+    dropIntentionalRemoval(provider) {
+        this.intentionalProjectionRemovals.delete(provider);
     }
     /** Restore the provider profile and drop management; caller owns the queue. */
     async releaseLocked(provider) {
         const record = this.store.provider(provider);
         if (record === undefined)
             return;
+        // PR review round 10 (I-000179): release is a removal path too — it deletes
+        // every managed credential below, so it holds the same window coordination
+        // as removeAccount/deleteKey instead of racing a running row test.
+        await this.settleTestBeforeRemoval(provider);
         // Round-2 review step 4: releasing a provider revokes its in-flight
         // sign-in attempts. A login whose seam flow is aborted can no longer
         // harvest rows for a provider that is no longer managed (the harvest
@@ -3266,6 +6339,7 @@ export class KeysManagerService {
         // overwrite the live profile.
         if (binding === 'mismatch') {
             await this.deleteManagedCredentials(record);
+            this.dropIntentionalRemoval(provider);
             delete this.store.providers[provider];
             this.store.clearBindings(key => key.endsWith(`\u0000${provider}`));
             this.rebuildBrokerMap();
@@ -3281,14 +6355,54 @@ export class KeysManagerService {
                 profileMutated = true;
             }
             else {
-                // Native and pre-existing extra routes own only apiKeyEnv. Leave every
-                // other profile field (baseURL, models, hand edits) exactly as it is.
+                // Native and pre-existing extra routes own only the values this plugin
+                // wrote: apiKeyEnv, plus the declared static headers it injected into
+                // an adopted profile. Leave every other profile field (baseURL,
+                // models, hand edits) exactly as it is.
+                // Exempt from the one-authority rule by design: release restores the
+                // pre-adoption document, and the deletion loop that follows is
+                // unbind-only ({@link deleteManagedCredentials}).
                 const path = [...record.settingsPath, 'apiKeyEnv'];
-                await this.mutateSettings(record.settingsNs, [
+                const ops = [
                     record.originalApiKeyEnv !== null
                         ? { op: 'set', path, value: record.originalApiKeyEnv }
                         : { op: 'unset', path },
-                ]);
+                ];
+                // An injected header is identified by the environment value the add
+                // wrote into it, so no extra record field has to remember the write.
+                // Anything else stays, and release says so instead of guessing.
+                const storedHeaders = staticHeaders(liveProfile?.headers);
+                const extra = record.extraId === null ? undefined : EXTRA_PROVIDER_MAP.get(record.extraId);
+                const envHeaders = environmentHeaders(extra);
+                const injected = [];
+                for (const [header, envName] of Object.entries(extra?.headerEnv ?? {})) {
+                    // Fetch field names are case-insensitive: attribute the stored
+                    // variant whatever its case, and unset that same stored key.
+                    const storedKey = storedHeaderKey(storedHeaders, header);
+                    if (storedKey === undefined)
+                        continue;
+                    const envValue = envHeaders[header];
+                    if (envValue === undefined) {
+                        this.pushWarning(`Release left the ${storedKey} header in the ${provider} profile: ${envName} is no longer set, so an injected value cannot be identified.`);
+                    }
+                    else if (storedHeaders[storedKey] === envValue) {
+                        injected.push(storedKey);
+                    }
+                    else {
+                        this.pushWarning(`Release left the ${storedKey} header in the ${provider} profile: it is not the value ${envName} currently supplies.`);
+                    }
+                }
+                if (injected.length > 0) {
+                    const remaining = Object.keys(storedHeaders).filter(header => !injected.includes(header));
+                    if (remaining.length === 0) {
+                        ops.push({ op: 'unset', path: [...record.settingsPath, 'headers'] });
+                    }
+                    else {
+                        for (const header of injected)
+                            ops.push({ op: 'unset', path: [...record.settingsPath, 'headers', header] });
+                    }
+                }
+                await this.mutateSettings(record.settingsNs, ops);
                 profileMutated = true;
                 // Remove an auto-created profile only when it is still empty after
                 // clearing apiKeyEnv; a profile with later user edits stays.
@@ -3314,6 +6428,7 @@ export class KeysManagerService {
             }
             throw error;
         }
+        this.dropIntentionalRemoval(provider);
         delete this.store.providers[provider];
         this.store.clearBindings(key => key.endsWith(`\u0000${provider}`));
         this.rebuildBrokerMap();
@@ -3321,12 +6436,12 @@ export class KeysManagerService {
     }
     /** Remote: stop managing a provider and restore its original key reference. */
     releaseProvider(provider) {
-        return this.run(async () => {
+        return this.run(() => this.withRemovalInProgress(provider, async () => {
             if (this.store.provider(provider) === undefined)
                 throw new Error(`Provider "${provider}" is not managed`);
             await this.releaseLocked(provider);
             return this.buildState();
-        });
+        }));
     }
     /** Remote: update manager policy. */
     setSettings(patch) {
@@ -3664,6 +6779,12 @@ export class KeysManagerService {
     /** Waterfall listener: bind a key to the request and observe its terminal chunk. */
     streamListener(options, next) {
         const providerId = options.provider;
+        // A per-row connection test owns its credential pin; it must not select a
+        // key, move a cursor or write health state, so it never enters the
+        // bookkeeping path below.
+        const testScope = this.als.getStore();
+        if (testScope?.test === true)
+            return this.wrapTestStream(next, testScope);
         const sessionId = options.sessionId === undefined ? undefined : String(options.sessionId);
         // `options.provider` is the route the agent/request waterfall finally
         // resolved; noteRequestStep keys its record by the same
@@ -3685,9 +6806,18 @@ export class KeysManagerService {
         if (binding === 'mismatch') {
             if (sessionId !== undefined && step !== undefined)
                 this.clearRetry(providerId, sessionId, step.turn, step.step);
-            return next();
+            // QC B5: the provider stream is handed over as a thunk on both
+            // branches, so it is constructed after the isolation wait — a mismatch
+            // profile still resolves pi-ai's stored grant, so the borrowed
+            // projection reaches it too.
+            return this.isolateFromTest(providerId, () => next());
         }
-        return this.wrapStream(options, next, providerId, sessionId, step);
+        // An ordinary request must never be served by the grant a row test has
+        // borrowed for this provider, nor be attributed to the tested account.
+        // The isolation wrapper waits for that test to settle before the normal
+        // path resolves its credential; a test-scope request returned above, so
+        // it never waits on its own guard.
+        return this.isolateFromTest(providerId, () => this.wrapStream(options, next, providerId, sessionId, step));
     }
     /**
      * The account row whose grant payload currently IS the live projection,
@@ -3701,6 +6831,140 @@ export class KeysManagerService {
         const row = this.store.provider(provider)?.keys.find(candidate => candidate.id === accountId);
         return row !== undefined && row.kind === 'oauth' && row.oauth !== null ? row.id : null;
     }
+    /**
+     * Keep an ordinary request out of the window where a row test borrows (or
+     * is restoring) this provider's projection. The provider stream is built
+     * only after the bounded wait, so neither branch can start a request inside
+     * the borrowed window; a consumer that cancels during the wait constructs
+     * nothing at all. A test-scope request returns from `streamListener` before
+     * this wrapper, so a test never waits on its own guard.
+     */
+    isolateFromTest(providerId, open) {
+        const service = this;
+        let iterator;
+        let waited = false;
+        let closed = false;
+        return {
+            [Symbol.asyncIterator]() {
+                return {
+                    async next() {
+                        if (closed)
+                            return { done: true, value: undefined };
+                        if (!waited) {
+                            waited = true;
+                            await service.settleProviderTest(providerId);
+                        }
+                        // QC N5: the consumer cancelled while this pull waited; there is
+                        // no one left to close a stream built here, so never build it.
+                        if (closed)
+                            return { done: true, value: undefined };
+                        if (iterator === undefined)
+                            iterator = open()[Symbol.asyncIterator]();
+                        return iterator.next();
+                    },
+                    async return(value) {
+                        closed = true;
+                        if (iterator?.return !== undefined)
+                            return iterator.return(value);
+                        return { done: true, value: undefined };
+                    },
+                    async throw(error) {
+                        closed = true;
+                        if (iterator?.throw !== undefined)
+                            return iterator.throw(error);
+                        throw error;
+                    },
+                };
+            },
+        };
+    }
+    /**
+     * Wait (bounded) for the in-flight borrowing test on this provider to
+     * settle. The bound is {@link KEY_TEST_ISOLATION_WAIT_MS}, not the test's
+     * own request timeout: the awaited promise also covers untimed
+     * credential-store reads, so without this an ordinary request could park
+     * here forever. A failed or timed-out test never fails the waiting request.
+     *
+     * QC fix wave 2: the one exception is a provider whose abandoned window is
+     * still fenced. The wait is over, but the route's credential surface has not
+     * been reconciled, so serving the request would answer it with the borrowed
+     * grant (or, after a released binding, with no bound route at all). Such a
+     * request is refused instead — the fence is what keeps cross-use impossible
+     * until the cleanup completes.
+     */
+    async settleProviderTest(providerId) {
+        // QC fix wave 3 (S-004): a fence that is already known at entry is not a
+        // reason to wait — the wait exists for a live test, and this route cannot
+        // be served until its abandoned window is reconciled. Acting on the known
+        // fence keeps the isolation deadline (25 s) off the refusal path.
+        if (this.cleaningTests.has(providerId))
+            throw this.testCleanupRefusal(providerId);
+        const pending = this.testsInFlight.get(providerId);
+        if (pending === undefined)
+            return;
+        const settled = await new Promise(resolve => {
+            let done = false;
+            let timer;
+            const finish = (value) => {
+                if (done)
+                    return;
+                done = true;
+                if (timer !== undefined)
+                    clearTimeout(timer);
+                resolve(value);
+            };
+            timer = setTimeout(() => {
+                if (!this.isolationWaitWarned.has(providerId)) {
+                    this.isolationWaitWarned.add(providerId);
+                    this.warn(`connection test for ${providerId} did not settle within ${this.isolationWaitMs}ms; the waiting request proceeds without it`);
+                }
+                finish(false);
+            }, this.isolationWaitMs);
+            timer.unref?.();
+            void pending.then(() => finish(true), () => finish(true));
+        });
+        // A fence set while the request waited (the watchdog abandoned the test, or
+        // its cleanup failed after settling) still owns the route, whatever the
+        // test's own settlement says.
+        if (this.cleaningTests.has(providerId))
+            throw this.testCleanupRefusal(providerId);
+        if (settled)
+            return;
+    }
+    /** The refusal an ordinary request gets while its route is still unreconciled. */
+    testCleanupRefusal(providerId) {
+        return new Error(`The connection test for ${providerId} is still being cleaned up; this request was not sent.`);
+    }
+    /**
+     * Wrap one connection-test stream: keep the pinned credential scope alive
+     * for every chunk and do nothing else. No selection, no cursor, no health
+     * writes — the request is pure observation.
+     */
+    wrapTestStream(next, scope) {
+        const service = this;
+        let iterator;
+        return {
+            [Symbol.asyncIterator]() {
+                return {
+                    async next() {
+                        if (iterator === undefined)
+                            iterator = await service.als.run(scope, () => next()[Symbol.asyncIterator]());
+                        return service.als.run(scope, () => iterator.next());
+                    },
+                    async return(value) {
+                        if (iterator?.return !== undefined)
+                            return service.als.run(scope, () => iterator.return(value));
+                        return { done: true, value: undefined };
+                    },
+                    async throw(error) {
+                        if (iterator?.throw !== undefined)
+                            return service.als.run(scope, () => iterator.throw(error));
+                        throw error;
+                    },
+                };
+            },
+        };
+    }
     /** Wrap one managed stream so credential resolution sees this key. */
     wrapStream(_options, next, providerId, sessionId, step) {
         const service = this;
@@ -3719,10 +6983,9 @@ export class KeysManagerService {
                             // Attribution must wait for it — otherwise this request selects
                             // and mutates a key cursor even though pi-ai serves the stored
                             // grant, and an OAuth failure is classified as externally
-                            // authenticated. Round-9 should-fix: the wait is bounded and is
-                            // skipped entirely for providers that hold no OAuth rows, so a
-                            // stalled credential read can neither wedge this request nor
-                            // delay an API-key-only provider.
+                            // authenticated. Round-9 should-fix: the wait is bounded per
+                            // provider, so a stalled credential read can neither wedge this
+                            // request nor delay a provider whose own read already landed.
                             const hydrated = await service.awaitProjectionOwnership(providerId);
                             // Round-5 finding C4: while a projection exists, pi-ai serves
                             // the stored grant and never consults the broker, so selecting
@@ -3764,6 +7027,7 @@ export class KeysManagerService {
                                 // when a projection exists, pi-ai serves the stored grant
                                 // and this scope owns the failure attribution.
                                 oauthAccountId,
+                                test: false,
                             };
                             if (sessionId !== undefined && keyId !== undefined) {
                                 const key = bindingKey(sessionId, providerId);
@@ -4122,11 +7386,11 @@ export function apply(ctx) {
         return () => service.detachCredentials(credentials);
     });
     ctx.inject(['settings'], child => {
-        service.settings = child.settings;
-        return () => {
-            if (service.settings === child.settings)
-                service.settings = undefined;
-        };
+        const settings = child.settings;
+        if (settings === undefined)
+            return;
+        service.attachSettings(settings);
+        return () => service.detachSettings(settings);
     });
     const on = ctx.on;
     on('llm/stream', (options, next) => service.streamListener(options, next));