dsh-keys-manager 0.2.2 → 0.2.4

package/lib/index.js

@@ -15,7 +15,8 @@
  */
 import { AsyncLocalStorage } from 'node:async_hooks';
 import { createHash, randomBytes } from 'node:crypto';
-import { KEY_LIMIT, accountRef, applyFailureCooldown, bindingKey, classifyOAuthFailure, isSelectable, markKeySuccess, markKeyUsed, normalizeSettings, patchSettings, pickHealthyExcluding, pickRoundRobin, shouldFailover, statusOfKey, statusOfProvider, validateKeyInput, validateKeyPatch, } from './core.js';
+import { CURSOR_ROUTE, cursorCatalogModels } from 'dsh-llm-omp-transports';
+import { KEY_LIMIT, TEST_SUCCESS_FINISH_KINDS, accountRef, applyFailureCooldown, bindingKey, classifyOAuthFailure, isSelectable, markKeySuccess, markKeyUsed, normalizeSettings, patchSettings, pickHealthyExcluding, pickRoundRobin, shouldFailover, statusOfKey, statusOfProvider, validateKeyInput, validateKeyPatch, } from './core.js';
 import { EXTRA_PROVIDER_MAP, EXTRA_PROVIDERS } from './providers.js';
 import { KeysManagerStore, ensureStateFile, statePath } from './store.js';
 export const name = 'keys-manager';
@@ -255,6 +256,11 @@ const INVOCATIONS = [
     endpoint('beginTransportLogin', ['provider']),
     endpoint('activateTransportAccount', ['provider']),
     endpoint('removeTransportAccount', ['provider']),
+    // The transport card's model picker: the catalog lives in the transports
+    // package (listModels answers only the allow-list), and the selection is
+    // written to the route's own settings path.
+    endpoint('transportModels', ['provider']),
+    endpoint('saveTransportModels', ['provider', 'models']),
 ];
 /** Read a nested value by path. */
 function getPath(value, path) {
@@ -517,6 +523,15 @@ function transportAccountOf(flow, record, now) {
 function transportMethodOf(flow) {
     return flow.methods[0]?.id;
 }
+/**
+ * The catalog a transport route advertises to its model picker.
+ *
+ * Only the Cursor route ships a catalog projection today; a route without one
+ * reports no models rather than borrowing another route's catalog.
+ */
+function transportCatalogOf(route) {
+    return route === CURSOR_ROUTE ? cursorCatalogModels() : [];
+}
 /** Env names that are a single API-key credential, not an OAuth/federation token. */
 function isKeyishEnv(name) {
     if (!/(?:API_KEY|_TOKEN)$/.test(name))
@@ -844,12 +859,15 @@ export class KeysManagerService {
      * order is preserved so the older observation can never commit after the
      * newer one and leave the row on a stale generation.
      *
-     * Round-8 finding I-000106: activation joins the same chain. The only
-     * writer of `row.oauth.grantRef` is {@link reconcileGrantRecord}, which runs
-     * outside the mutation queue, so activation's record read and its projection
-     * write must be mutually exclusive with that writer — otherwise a rotation
-     * landing between them leaves the projection on a generation the row no
-     * longer names.
+     * Round-8 finding I-000106 assumed activation would join this chain. It does
+     * not: activation runs its compare-and-write inside the mutation queue turn,
+     * and the only writer of `row.oauth.grantRef` is {@link reconcileGrantRecord},
+     * which runs outside that queue. The fence is therefore a generation re-check
+     * on both sides of the write — before it (the row must still name the
+     * generation that was read) and after it (a rotation commit can land inside
+     * the seam's compare-and-write await, which only reads the projection key).
+     * Chain members are the echo reconciler, the key-test borrow and adoption
+     * classification.
      */
     grantReconciliations = new Map();
     /**
@@ -944,6 +962,20 @@ export class KeysManagerService {
     credentialsMounted = false;
     /** Providers whose bounded-wait warning already fired (warn once). */
     hydrationWaitWarned = new Set();
+    /**
+     * Stream attempts each provider served without an attributed account
+     * (`I-000120`, D8): the ownership read had not landed, or it had failed.
+     * Counted at the one managed serving site (`wrapStream`), never in the
+     * hydration pass — a failed read serves no request, it only makes later
+     * attempts unattributed. Two earlier branches are outside this definition and
+     * stay uncounted: a provider this manager does not manage (no ownership is
+     * ever asked for) and the `mismatch` profile shape, which hands the request
+     * to pi-ai untouched precisely because this manager's own binding cannot
+     * describe what serves it. Cleared only when a later read decides the route's
+     * attribution; process-local, never persisted and never on the warnings
+     * channel.
+     */
+    unattributedRequests = new Map();
     /** Channels whose lost-subscription warning already fired (warn once). */
     subscriptionLostWarnings = new Set();
     /** Disposer for the `authorization/settled` subscription. */
@@ -1011,7 +1043,13 @@ export class KeysManagerService {
         }
         return (async () => {
             try {
-                await Promise.all(Object.values(this.store.providers).map(async (providerRecord) => {
+                // allSettled, never all: under `all`, a rejection from any single
+                // provider task settles this awaited pass at once, so the finally below
+                // flips `hydrationSettled` while the other providers' reads are still
+                // in flight and `awaitProjectionOwnership` calls them ready. No task
+                // body can reject today (the read error is caught inside it), so this
+                // is a structural guard — do not flip it back for style.
+                await Promise.allSettled(Object.values(this.store.providers).map(async (providerRecord) => {
                     const provider = providerRecord.provider;
                     const accounts = providerRecord.keys.filter(candidate => candidate.kind === 'oauth' && candidate.oauth !== null);
                     try {
@@ -1045,9 +1083,10 @@ export class KeysManagerService {
                         // serves the route ahead of any broker reference exactly like an
                         // unowned grant, so it is classified as foreign below (PR review
                         // rounds 4 and 13).
-                        const owner = record.kind === 'grant' && isOAuthGrantPayload(record.payload)
-                            ? matchOwningAccount(provider, accounts, record.payload)
+                        const projection = record.kind === 'grant' && isOAuthGrantPayload(record.payload)
+                            ? record.payload
                             : undefined;
+                        const owner = projection === undefined ? undefined : matchOwningAccount(provider, accounts, projection);
                         // A newer activation/login claimed the owner while this read was in
                         // flight: the stale read is discarded, never written over it. A
                         // remount replaced the whole store: its classification is gone too.
@@ -1071,8 +1110,13 @@ export class KeysManagerService {
                         // attributable now and must not wait behind another provider's
                         // stalled read (round-10 should-fix SF1). A superseded pass does
                         // not report readiness for a store it no longer describes.
-                        if (this.hydrationEpoch === epoch)
+                        if (this.hydrationEpoch === epoch) {
+                            // A landed read decided this route's attribution; a failed one
+                            // decided nothing and never clears the count (I-000120).
+                            if (!this.ownershipReadFailures.has(provider))
+                                this.unattributedRequests.delete(provider);
                             this.noteProviderHydrated(provider);
+                        }
                     }
                 }));
             }
@@ -1129,10 +1173,24 @@ export class KeysManagerService {
      * repair was skipped while that shape was unknown.
      */
     noteProjectionReadSucceeded(provider) {
-        if (!this.ownershipReadFailures.delete(provider))
-            return;
+        // This read decided the route's attribution, so a count of requests served
+        // without one no longer describes it (I-000120).
+        this.unattributedRequests.delete(provider);
+        const recovering = this.ownershipReadFailures.delete(provider);
+        // Readiness is decided by the read, not by whether it was recovering: a
+        // `record-updated` reconcile can answer the projection while startup
+        // hydration is still pending for another provider, and the old early return
+        // left this one out of `hydratedProviders` — waits kept timing out, routing
+        // stayed skipped, and the count this read had just cleared started growing
+        // again although attribution was already decided. `noteProviderHydrated` is
+        // idempotent (a set add plus waking its waiters).
         this.noteProviderHydrated(provider);
-        void this.scheduleGrantReconciliation(provider, () => this.syncBindingAfterProjectionChange(provider));
+        // Only recovery re-derives the binding: the normal call arrives from a
+        // reconciliation that already owns that re-derive behind it, and the
+        // startup repair is what a failed read skipped.
+        if (recovering) {
+            void this.scheduleGrantReconciliation(provider, () => this.syncBindingAfterProjectionChange(provider));
+        }
     }
     /** Release every provider's readiness wait when hydration cannot proceed. */
     settleHydrationWaits() {
@@ -1184,6 +1242,9 @@ export class KeysManagerService {
             timer = setTimeout(() => {
                 wake(false);
             }, ms);
+            // I-000116: a request waiting on hydration must not hold the process
+            // open for the rest of the wait; every exit path still clears it.
+            timer.unref?.();
             live.add(onLanded);
         });
     }
@@ -1270,6 +1331,16 @@ export class KeysManagerService {
         this.ownershipGenerations.set(provider, generation);
         return generation;
     }
+    /**
+     * Whether a claim landed after `generation` was captured. A reconciliation
+     * reads its snapshot before its awaited record read and decides after it, so
+     * an activation (or login) that claimed the route in between owns the answer
+     * now: the stale body must not clear the claim, mark the route foreign, or
+     * re-point the binding. The hydration write uses the same guard.
+     */
+    ownershipSuperseded(provider, generation) {
+        return (this.ownershipGenerations.get(provider) ?? 0) !== generation;
+    }
     /**
      * Claim the projection owner for one account row, bumping the provider's
      * ownership generation so an in-flight hydration read of an older state
@@ -1279,6 +1350,8 @@ export class KeysManagerService {
         this.activeAccounts.set(provider, accountId);
         this.foreignProjections.delete(provider);
         this.noteProjectionCommitted(provider);
+        // The route has an owner now, so requests are attributed from here on.
+        this.unattributedRequests.delete(provider);
     }
     /**
      * Log without ever echoing secret material. */
@@ -1307,17 +1380,32 @@ export class KeysManagerService {
         }
     }
     /** Serialize mutations, rejecting submissions that arrive during shutdown. */
-    run(operation) {
+    run(operation, onFailure) {
         if (this.closing)
             return Promise.reject(new Error('Keys Manager is shutting down'));
         const guarded = async () => {
             if (this.store.readOnly) {
                 throw new Error('The state file could not be read; refusing to write over it. Restart after fixing file access.');
             }
-            const result = await operation();
-            // A mutation is not successful until its state document is durable.
-            await this.store.flush();
-            return result;
+            try {
+                const result = await operation();
+                // A mutation is not successful until its state document is durable.
+                await this.store.flush();
+                return result;
+            }
+            catch (error) {
+                // Failure cleanup belongs to THIS turn's exclusive window, not a later
+                // one: a queued mutation (a removal, say) would otherwise run first and
+                // destroy the state the undo needs to restore. `guarded` resolves only
+                // after the hook, so everything already submitted behind this turn sees
+                // the compensated state. Both awaits are best-effort — the caller must
+                // receive the original error, not the cleanup's.
+                if (onFailure !== undefined) {
+                    await onFailure(error).catch(() => undefined);
+                    await this.store.flush().catch(() => undefined);
+                }
+                throw error;
+            }
         };
         const next = this.queue.then(guarded, guarded);
         this.queue = next.catch(() => { });
@@ -2033,6 +2121,85 @@ export class KeysManagerService {
     transportGenerationOf(route) {
         return this.transportRemovals.get(route) ?? 0;
     }
+    /**
+     * Remote: read one transport route's catalog and configured allow-list.
+     *
+     * @remarks
+     * The catalog comes from the transports package, because the route's
+     * `listModels` answers only the allow-list. An empty allow-list means "all
+     * models", so an unreadable settings store must not answer `[]` — a save
+     * would then clear a narrowed selection — and it rejects instead.
+     */
+    async transportModels(route) {
+        this.assertTransportRoute(route);
+        const configured = this.transportModelIds(route);
+        const catalog = transportCatalogOf(route);
+        // A settings profile can outlive a catalog id; the picker renders the
+        // catalog, so an unknown id would count toward {n} of {total} while
+        // matching no checkbox and failing every save.
+        const known = new Set(catalog.map(row => row.id));
+        return { catalog, models: configured.filter(id => known.has(id)) };
+    }
+    /**
+     * Remote: replace one transport route's model allow-list.
+     *
+     * Writes only the route's own `providers.<route>.models` path through the
+     * live settings revision; an empty list restores the full catalog.
+     */
+    async saveTransportModels(route, models) {
+        this.assertTransportRoute(route);
+        if (!Array.isArray(models) || models.some(id => typeof id !== 'string')) {
+            throw new TypeError('models must be a list of model ids');
+        }
+        const catalog = transportCatalogOf(route);
+        if (catalog.length === 0)
+            throw new Error(`Provider "${route}" offers no model list`);
+        const known = new Map(catalog.map(row => [row.id, row.name]));
+        const selected = [...new Set(models)];
+        const unknown = selected.find(id => !known.has(id));
+        if (unknown !== undefined)
+            throw new Error(`Provider "${route}" has no model "${unknown}"`);
+        await this.mutateSettings(TRANSPORT_CREDENTIAL_SCOPE, [
+            {
+                op: 'set',
+                path: ['providers', route, 'models'],
+                value: selected.map(id => ({ id, name: known.get(id) })),
+            },
+        ]);
+        return this.transportModels(route);
+    }
+    /** Refuse a route the transports package does not register. */
+    assertTransportRoute(route) {
+        if (typeof route !== 'string' || route.length === 0)
+            throw new TypeError('provider is required');
+        if (this.transportFlowFor(route) === undefined)
+            throw new Error(`Provider "${route}" offers no transport account`);
+    }
+    /**
+     * One transport route's configured model ids, read from the live settings.
+     *
+     * @remarks
+     * Rejects when the descriptor is unreadable or this plugin's namespace is
+     * not mounted: a registered route always owns that namespace, so answering
+     * "no models configured" would report the all-models state for a store the
+     * host simply could not read.
+     */
+    transportModelIds(route) {
+        const descriptor = this.describeSettings();
+        if (!descriptor.readable)
+            throw new Error('Cannot read settings: the settings store is unavailable');
+        const namespace = this.namespace(descriptor, TRANSPORT_CREDENTIAL_SCOPE);
+        if (namespace === undefined) {
+            throw new Error(`Settings namespace "${TRANSPORT_CREDENTIAL_SCOPE}" is not mounted`);
+        }
+        const value = getPath(namespace.value, ['providers', route, 'models']);
+        if (!Array.isArray(value))
+            return [];
+        return value.flatMap(row => {
+            const id = row !== null && typeof row === 'object' ? row.id : undefined;
+            return typeof id === 'string' ? [id] : [];
+        });
+    }
     /**
      * Drop a grant a withdrawn sign-in wrote after its account was removed.
      *
@@ -2564,11 +2731,20 @@ export class KeysManagerService {
             return;
         }
         if (harvest.wroteRef) {
-            try {
-                await records.deleteRecord(harvest.grantRef);
+            // A live row still names this ref: a same-ref re-authentication writes
+            // over the record its own pre-existing row depends on, and this
+            // compensation must not leave that row dangling (same guard as the
+            // rotation cleanup, R5-MF1).
+            if (this.grantRefServed(attempt.provider, harvest.grantRef)) {
+                this.warn(`harvest compensation kept ${harvest.grantRef} for ${attempt.provider}: an account row still references it`);
             }
-            catch (error) {
-                this.warn(`harvest compensation could not delete ${harvest.grantRef}: ${error instanceof Error ? error.message : String(error)}`);
+            else {
+                try {
+                    await records.deleteRecord(harvest.grantRef);
+                }
+                catch (error) {
+                    this.warn(`harvest compensation could not delete ${harvest.grantRef}: ${error instanceof Error ? error.message : String(error)}`);
+                }
             }
         }
         await this.revertHarvestProjection(attempt, harvest);
@@ -2872,7 +3048,7 @@ export class KeysManagerService {
             // can already be superseded. The newer claim owns the route and settled
             // the binding itself: this stale removal decides nothing — no owner
             // delete, no rebind — it only consumes its own one-shot removal marker.
-            if ((this.ownershipGenerations.get(provider) ?? 0) !== generation) {
+            if (this.ownershipSuperseded(provider, generation)) {
                 this.intentionalProjectionRemovals.delete(provider);
                 return;
             }
@@ -2928,6 +3104,11 @@ export class KeysManagerService {
         // reference over it. With no OAuth row the unowned-grant branch below
         // classifies a valid grant the same way.
         if (record.kind === 'api-key') {
+            // A newer claim (an activation that wrote and claimed after this body
+            // captured its snapshot) owns the route now; this stale classification
+            // must not clear it.
+            if (this.ownershipSuperseded(provider, generation))
+                return;
             // Native api-key management took the route over: the manager no
             // longer owns any projection here.
             this.activeAccounts.delete(provider);
@@ -2939,11 +3120,15 @@ export class KeysManagerService {
             this.noteProjectionCommitted(provider);
             this.pushWarning(`The ${provider} route now holds a natively managed API-key credential; the Keys Manager account pool is not serving it.`);
             // pi-ai resolves the broker reference before this record, so a route
-            // left bound would keep serving the pool (PR review round 4).
+            // left bound would keep serving the pool (PR review round 4). The sync
+            // stamps the generation it entered with and re-checks before its own
+            // write, so this body's own bump cannot strand it.
             await this.syncBindingAfterProjectionChange(provider);
             return;
         }
         if (!isOAuthGrantPayload(record.payload)) {
+            if (this.ownershipSuperseded(provider, generation))
+                return;
             // An unrecognized payload is not ours to interpret: drop the stale
             // owner entry so failure attribution and demotion never fire on it.
             this.activeAccounts.delete(provider);
@@ -2961,6 +3146,8 @@ export class KeysManagerService {
         // applies, so a restarted process and the live reconciler agree.
         const owner = matchOwningAccount(provider, accounts, payload);
         if (owner === undefined) {
+            if (this.ownershipSuperseded(provider, generation))
+                return;
             // A foreign account's grant serves the route: no pool row owns the
             // projection, so the previous owner entry must not survive it — and the
             // live record keeps the pool from claiming the route (round 3).
@@ -2981,6 +3168,11 @@ export class KeysManagerService {
         // is re-adopted below. Only a removal in progress is refused.
         if (!this.accountRowIsManaged(provider, owner))
             return;
+        // A newer claim landed while this body was resolving its read: the
+        // rotation write, the row commit and the binding sync below all describe a
+        // generation that claim already superseded.
+        if (this.ownershipSuperseded(provider, generation))
+            return;
         // F1 (I-000081): the matched grant IS the live projection, so this row
         // owns it from now on — even when no in-process login or activation
         // ran (the post-restart echo-rotation case: a hydrated row, no owner
@@ -2992,30 +3184,29 @@ export class KeysManagerService {
         // the stale echo claim is discarded exactly like a stale hydration
         // read (the rotation sync below still runs, but a commit that a newer
         // claim has superseded is rejected — round-9 P1).
-        let claimedGeneration;
-        if ((this.ownershipGenerations.get(provider) ?? 0) === generation) {
-            this.claimProjectionOwner(provider, owner.id);
-            claimedGeneration = this.ownershipGenerations.get(provider);
-            // R7-SF3: the live projection proves this row's identity again, so a
-            // demoted row is re-adopted — restore its owner claim (above) and end
-            // the demoted state. `valueMissing` means "not serving but still
-            // managed", not "removal in progress": a native sign-in or pi-ai
-            // write that re-projects the grant recovers the account without a
-            // manual re-activation. The flag is persisted with the rest of the
-            // state document.
-            if (owner.valueMissing === true) {
-                owner.valueMissing = false;
-                // R14-SF3: a demotion is earned by a failure, so the row usually
-                // still carries the cooldown `markFailure` wrote. Re-adoption is the
-                // same manual-recovery equivalence `activateAccount` and re-auth
-                // implement: the live projection is serving again, so the old
-                // window ends with it — otherwise the resurrected row renders
-                // "cooling" and stays out of the healthy counts until the timer
-                // expires. Only this proven-adoption branch clears; a row whose
-                // projection did not reappear keeps its window.
-                owner.cooldownUntil = 0;
-                this.store.touch();
-            }
+        // Unconditional: the guard above already returned when a newer claim
+        // landed, and nothing between the two awaits.
+        this.claimProjectionOwner(provider, owner.id);
+        const claimedGeneration = this.ownershipGenerations.get(provider);
+        // R7-SF3: the live projection proves this row's identity again, so a
+        // demoted row is re-adopted — restore its owner claim (above) and end
+        // the demoted state. `valueMissing` means "not serving but still
+        // managed", not "removal in progress": a native sign-in or pi-ai
+        // write that re-projects the grant recovers the account without a
+        // manual re-activation. The flag is persisted with the rest of the
+        // state document.
+        if (owner.valueMissing === true) {
+            owner.valueMissing = false;
+            // R14-SF3: a demotion is earned by a failure, so the row usually
+            // still carries the cooldown `markFailure` wrote. Re-adoption is the
+            // same manual-recovery equivalence `activateAccount` and re-auth
+            // implement: the live projection is serving again, so the old
+            // window ends with it — otherwise the resurrected row renders
+            // "cooling" and stays out of the healthy counts until the timer
+            // expires. Only this proven-adoption branch clears; a row whose
+            // projection did not reappear keeps its window.
+            owner.cooldownUntil = 0;
+            this.store.touch();
         }
         // Rotation sync: the rotated payload is authoritative (the plan's
         // single-writer contract — "sync them back to the owning plugin-scope
@@ -3106,7 +3297,12 @@ export class KeysManagerService {
         // shutdown that began under any of the awaits above refuses it.
         if (this.persistenceRefused())
             return;
-        await this.commitGrantGeneration(provider, owner, payload, rotatedRef);
+        // The commit is the row repoint plus the superseded record's delete, both
+        // after the awaits above (most recently `rotationStillCurrent`'s own record
+        // read). A claim that landed in that read owns the route now, so the commit
+        // refuses like every other mutation in this body.
+        const commitGeneration = claimedGeneration ?? generation;
+        await this.commitGrantGeneration(provider, owner, payload, rotatedRef, () => !this.ownershipSuperseded(provider, commitGeneration));
         // PR review round 44: the projection now serves this managed account again,
         // so a profile that still names the broker would make pi-ai resolve the
         // pool first and fail with MISSING_CREDENTIAL. Converge the binding with the
@@ -3227,66 +3423,655 @@ export class KeysManagerService {
      * Make one account's grant payload the route's stored credential
      * (D1 activation projection).
      *
-     * Round-8 finding I-000106 (must-fix): the decide snapshot used to be read
-     * before the seam's lock, and `reconcileGrantRecord` runs OUTSIDE the
-     * mutation queue — so a rotation echo could repoint `row.oauth.grantRef` and
-     * delete the record being projected between the read and the write, leaving
-     * the route on an older generation than the row names. The whole
-     * read → project → claim section therefore runs on the provider's grant
-     * chain ({@link scheduleGrantReconciliation}) — the same chain the
-     * reconciler bodies use. A rotation committed before this body is observed
-     * in `row.oauth.grantRef`; one that arrives while the body runs is queued
-     * behind it and reconciles the generation this body projected. Either way
-     * the projection holds exactly the generation the row names.
+     * Plan iter-pool-activate-queue, "Spike outcome" — the contract this method
+     * implements. The slow half (read the row's grant, validate it, capture what
+     * the route serves now) runs outside the mutation queue, so a slow credential
+     * store does not delay unrelated mutations. The mutation queue turn owns every
+     * write:
      *
-     * The seam's per-key lock still serializes the read-decide-replace steps of
-     * `modifyRecord` (credentials/src/index.ts:236-250) against other writers.
-     * The account whose payload lands becomes the pool's active account and is
-     * cascade-selectable again.
+     * 1. admission checks in queue order, which produce this method's error
+     *    surface (`Provider "…" is not managed`, `Account "…" not found on …`,
+     *    `Key "…" is not an OAuth account`, `The credential store does not support
+     *    records`) — plus a re-check that the row still names the generation the
+     *    read used;
+     * 2. the projection write as a compare-and-write under the seam's per-key
+     *    lock (credentials/src/index.ts:236-250): it lands only while the live
+     *    record still equals the captured baseline, "both absent" included. A
+     *    rotation, a removal or any foreign writer that replaced the projection
+     *    meanwhile makes the compare fail, so this call refuses with the retryable
+     *    `could not be projected` message and leaves the newer projection
+     *    untouched — there is nothing to delete, because nothing was written;
+     * 3. the owner claim, the row writes and the returned `buildState`.
+     *
+     * There is deliberately no shutdown check after the write: `close()` awaits
+     * this queue before it closes the store, so a turn that started in time always
+     * finishes (measured in the spike that produced this contract). A check there
+     * is what used to leave an orphan projection behind.
+     *
+     * The one write the turn cannot make durable by itself is a rejected state
+     * flush; see {@link compensateActivationFlush} for that compensation.
      */
-    activateAccount(provider, accountId) {
-        return this.run(async () => {
-            const providerRecord = this.store.provider(provider);
-            if (providerRecord === undefined)
-                throw new Error(`Provider "${provider}" is not managed`);
-            const row = providerRecord.keys.find(candidate => candidate.id === accountId);
-            if (row === undefined)
-                throw new Error(`Account "${accountId}" not found on ${provider}`);
-            if (row.kind !== 'oauth' || row.oauth === null)
-                throw new Error(`Key "${accountId}" is not an OAuth account`);
-            const records = this.credentialRecords();
-            if (records === undefined)
-                throw new Error('The credential store does not support records');
-            await this.scheduleGrantReconciliation(provider, async () => {
-                // Re-read the generation under the chain: a rotation that committed
-                // before this body claimed its slot is already reflected here.
-                const grantRef = row.oauth.grantRef;
-                const stored = await records.readRecord(grantRef);
-                if (stored === undefined || stored.kind !== 'grant' || !isOAuthGrantPayload(stored.payload)) {
-                    throw new Error(`The grant payload at ${grantRef} is missing or unusable; sign in to this account again`);
+    async activateAccount(provider, accountId) {
+        const records = this.credentialRecords();
+        // Locator only: it keeps the row's grantRef reachable for the read below.
+        // The turn re-reads the store and decides; this lookup decides nothing.
+        const located = this.store.provider(provider)?.keys.find(candidate => candidate.id === accountId);
+        // The refusals `run` applies (1683, 1685-1687) are hoisted ahead of the
+        // credential read: a refused call should not pay for it at all. They are
+        // not the guarantee — the turn's own admission checks are.
+        if (this.closing)
+            throw new Error('Keys Manager is shutting down');
+        if (this.store.readOnly) {
+            throw new Error('The state file could not be read; refusing to write over it. Restart after fixing file access.');
+        }
+        // The slow half, outside the queue: read the grant this activation would
+        // project and capture what the route serves now as the compare baseline.
+        // Nothing here decides — admission order belongs to the turn.
+        const prepared = located !== undefined
+            && located.kind === 'oauth'
+            && located.oauth !== null
+            && records !== undefined
+            ? await this.prepareActivation(provider, located, records)
+            : undefined;
+        if (prepared !== undefined && records !== undefined) {
+            // Same-`grantRef` rotation: pi-ai can refresh the ACCESS token while
+            // keeping the refresh token, so the reference never moves, both `grantRef`
+            // fences pass, and the projection can already carry the fresh payload
+            // while the plugin-scope record still holds the stale one. Projecting
+            // `prepared.payload` then writes an older credential over a fresher
+            // projection. Re-read the source as late as possible and refuse unless it
+            // still says what this activation prepared.
+            //
+            // This read sits OUTSIDE the queue, exactly where `prepareActivation` does
+            // its credential work: a read inside the turn would put credential I/O
+            // back on the global mutation queue, which is the cross-provider stall —
+            // and the shutdown wait — the activation split exists to remove.
+            //
+            // Residual, named: reading outside the turn only narrows the same-ref
+            // rotation window to this activation's QUEUE WAIT instead of closing it.
+            // Closing it fully needs a seam that lets one read and one write share a
+            // single lock, which `CredentialRecordsLike` (host-types.ts:136-143) does
+            // not promise. What still covers the rest: the in-lock baseline compare on
+            // the projection side, and the post-write `grantRef` recheck for reference
+            // changes. A same-ref rotation that lands while the activation waits in
+            // the queue is the uncovered case.
+            const source = await records.readRecord(prepared.grantRef);
+            const sourceMatches = source !== undefined
+                && source.kind === 'grant'
+                && JSON.stringify(source.payload) === prepared.written;
+            // The preparation can carry a payload its own repair write did not
+            // persist: the ownership-verified projection is then the live credential,
+            // and an absent or unusable ref is that state — not a concurrent writer.
+            const sourceAbsentOrUnusable = source === undefined
+                || source.kind !== 'grant'
+                || !isOAuthGrantPayload(source.payload);
+            if (!sourceMatches && !(prepared.recoveredFromProjection && sourceAbsentOrUnusable)) {
+                throw new Error(`The grant payload for "${accountId}" on ${provider} could not be projected; activate the account again`);
+            }
+        }
+        let undo;
+        try {
+            await this.run(async () => {
+                const providerRecord = this.store.provider(provider);
+                if (providerRecord === undefined)
+                    throw new Error(`Provider "${provider}" is not managed`);
+                const row = providerRecord.keys.find(candidate => candidate.id === accountId);
+                if (row === undefined)
+                    throw new Error(`Account "${accountId}" not found on ${provider}`);
+                if (row.kind !== 'oauth' || row.oauth === null)
+                    throw new Error(`Key "${accountId}" is not an OAuth account`);
+                if (records === undefined) {
+                    throw new Error('The credential store does not support records');
                 }
-                this.intentionalProjectionRemovals.delete(provider);
-                await records.modifyRecord(`${OAUTH_GRANT_RECORD_SCOPE}/${provider}`, () => Promise.resolve({ kind: 'grant', payload: structuredClone(stored.payload) }));
+                if (prepared === undefined) {
+                    // The locator only hints; the turn decides. A row that was not an
+                    // OAuth account when it was located (created, re-added, or repointed
+                    // in between) has nothing prepared for it — that is a stale locator,
+                    // not a store without record support.
+                    throw new Error(`The account "${accountId}" on ${provider} changed before it could be activated; activate it again`);
+                }
+                // A remount replaced the credential backend while the read ran; the
+                // payload came from records this manager no longer serves.
+                //
+                // The row must still name the generation this activation read. A
+                // rotation echo or a removal + re-add that repointed it meanwhile
+                // belongs to a different grant, and projecting the old payload would
+                // either overwrite a newer generation or report a success the row does
+                // not serve. Refusing keeps the record untouched; the caller retries.
+                if (this.credentialRecords() !== records || row.oauth.grantRef !== prepared.grantRef) {
+                    throw new Error(`The grant payload for "${accountId}" on ${provider} could not be projected; activate the account again`);
+                }
+                // The projection write is a compare-and-write under the seam's per-key
+                // lock: it lands only while the route still serves the baseline read
+                // above. A removal or a foreign writer that got there first makes the
+                // compare fail, and this activation refuses without touching the
+                // record — there is nothing to compensate afterwards.
+                const written = await this.compareAndWriteProjection(records, provider, prepared);
+                if (written === undefined) {
+                    throw new Error(`The grant payload for "${accountId}" on ${provider} could not be projected; activate the account again`);
+                }
+                // No post-write shutdown check: `close()` awaits this queue before it
+                // closes the store (`1758-1762`), so a run that starts in time always
+                // finishes before the store goes away. Refusing here after the write
+                // is what used to manufacture an orphan.
+                undo = { valueMissing: row.valueMissing, cooldownUntil: row.cooldownUntil, generation: 0 };
                 this.claimProjectionOwner(provider, row.id);
-                // The re-activated grant is the serving credential again, so a broker
-                // reference left by the key pool must go (see syncBrokerBinding): the
-                // committed projection is not rolled back by a settings failure.
+                undo.generation = this.ownershipGenerations.get(provider) ?? 0;
+                row.valueMissing = false;
+                // Round-5 finding M1: manual recovery ends the cooling window too, the
+                // same reset a successful re-authentication applies. A demoted account
+                // is re-activated while its stale cooldown still sits on the row, which
+                // would render the freshly projected grant as cooling and keep it out
+                // of the healthy counts until the timer expires. Clearing the window
+                // also resets escalation: `applyFailureCooldown` derives the next level
+                // from `cooldownUntil` only (core.ts:168-174).
+                row.cooldownUntil = 0;
+                this.store.touch();
+                // The pre-write check closed the read window, but a rotation commit can
+                // land inside the seam's compare-and-write await: it repoints the row
+                // (a different record key) while the projection write is in flight, and
+                // the in-lock compare cannot see the row. Projecting then leaves the
+                // route serving a generation the row has already superseded, so the
+                // activation refuses and the flush compensation above undoes both — the
+                // claim is set, so the undo path owns it.
+                if (row.oauth.grantRef !== prepared.grantRef) {
+                    throw new Error(`The grant payload for "${accountId}" on ${provider} could not be projected; activate the account again`);
+                }
+            }, async () => {
+                // A rejected flush lands here AFTER the turn resolved its work: `run`
+                // does not roll the mutation back, so the row is still cleared in memory
+                // and the projection still serves the route. Undo both once, by
+                // identity, inside THIS turn's window — a later turn would lose the race
+                // against every mutation already queued behind the activation (a removal
+                // of the account deletes the half-committed projection first, and the
+                // captured baseline could then no longer be restored). Failures before
+                // the write leave `undo` unset: nothing to undo.
+                //
+                // Residual (I-000090 territory): `undo` is assigned only once the write
+                // resolved, so a `modifyRecord` that applies its mutation and THEN
+                // rejects refuses with the raw seam error and keeps the projection. What
+                // compensation could run is undecidable from this repo — the seam would
+                // have to promise it never commits then rejects — so this shape is left
+                // as the seam reports it rather than guessed at.
+                if (undo === undefined)
+                    return;
+                await this.compensateActivationFlush(provider, accountId, prepared, undo, records);
+            });
+            // The re-activated grant is the serving credential again, so a broker
+            // reference left by the key pool must go (see syncBrokerBinding). A
+            // settings refusal does not roll back the committed projection.
+            //
+            // Both the sync and the returned snapshot run in a second queue turn:
+            // the binding attempt must have happened before the view is built (a
+            // refusal pushes its warning, and building the view inside the write turn
+            // drained it, so the RPC reported a clean activation while requests kept
+            // using the pool), and the snapshot itself is state: taken outside the
+            // queue, another mutation could enter, mutate and be mid-flush while
+            // `buildState` pruned and drained, exposing state that is not durable.
+            // The turn waits for such a mutation to finish or fail first.
+            if (this.closing) {
+                // Shutdown opened while this activation was writing, so no new turn may
+                // be appended: `closeOnce` captured `this.queue` when `closing` went up
+                // and closes the store once THAT reference settles, so a turn submitted
+                // here would run after close(). Instead, join the reference shutdown is
+                // itself draining — mutations already queued behind this turn are still
+                // running, and `buildState` prunes and drains, so the snapshot must come
+                // after they settle rather than beside them.
+                await this.queue;
+                // The binding's last-point guard refuses the write once `closing` is
+                // set and reports that refusal itself, so a route that needs converging
+                // now says so in the returned state instead of reporting a clean
+                // success; a route that is already converged needs no write at all. The
+                // next start's repair pass owns the convergence either way.
                 await this.syncBrokerBinding(provider);
+                return this.buildState();
+            }
+            // The projection turn above already committed AND flushed, so the
+            // activation is durable and serving. This second turn only converges the
+            // binding and takes the snapshot; if its flush fails, that activation must
+            // not be reported as failed — a caller would retry an activation that
+            // already landed. `built` is the discriminator: `guarded` runs the body
+            // before the flush, so a BODY failure leaves it unset and still
+            // propagates (shutdown, a refusal), while a post-commit flush failure is
+            // reported in the state the caller receives.
+            let built;
+            try {
+                return await this.run(async () => {
+                    await this.syncBrokerBinding(provider);
+                    built = this.buildState();
+                    return built;
+                });
+            }
+            catch (error) {
+                if (built === undefined)
+                    throw error;
+                const reason = error instanceof Error ? error.message : String(error);
+                const warning = `The ${provider} activation is saved, but its binding and state snapshot could not be persisted (${reason}). The account is serving; the next successful change saves the rest.`;
+                // One channel only: the returned snapshot. `buildState` has already
+                // drained the warning queue, so ALSO queueing this copy would surface
+                // the same failure twice (once in this payload, once on the next
+                // refresh). It still reaches the operator log, which is what a caller
+                // that ignores the returned state leaves visible.
+                this.warn(`activation post-commit persistence failed for ${provider}: ${reason}`);
+                // The snapshot was taken before this warning existed, and re-taking one
+                // outside the queue is the race this turn exists to avoid, so the view
+                // is annotated rather than rebuilt.
+                return { ...built, warnings: [...built.warnings, warning] };
+            }
+        }
+        catch (error) {
+            // Which path covers which case:
+            // - `run` refuses the submission while `closing`, and `guarded` refuses a
+            //   read-only store before the operation runs: nothing was written, so
+            //   `undo` stayed unset and there is nothing to compensate.
+            // - a failure INSIDE the turn (the flush, or the seam) runs the
+            //   compensation hook above, inside that turn's exclusive window, even
+            //   when closing began during it; that hook is the fallback the previous
+            //   independent turn used to be, and it needs no closing branch.
+            // - the hook's own flush is best-effort: a still-unwritable store leaves
+            //   memory restored and the next successful flush persists it.
+            throw error;
+        }
+    }
+    /**
+     * The row's own grant payload, recovered from the live projection when the
+     * plugin-scope record is gone. The projection IS the route's credential, so a
+     * matching payload is written back (compare-at-absent) and used immediately.
+     *
+     * `recoveredFromProjection` marks a payload the ownership-verified projection
+     * supplied when the repair write did not persist it: the ref stays absent or
+     * unusable, so a caller that re-reads it must treat the payload as the live
+     * credential instead of a concurrent writer's record. That case also returns
+     * the projection record it validated: a caller that compares before writing
+     * must use this snapshot as its baseline, or the compare would accept a
+     * rotation that landed after the payload was read. It never marks a
+     * projection whose row has been detached or repointed since the snapshot —
+     * that recovery is refused, because the projection then belongs to a
+     * generation this row no longer names. For the same reason a repair the
+     * updater declined (row gone, retiring, or repointed) resolves `undefined`:
+     * the callers' own "missing or unusable" failure is the truthful answer, not
+     * the payload of a generation this row has left behind.
+     */
+    async recoverGrantPayload(provider, row, records) {
+        const grantRef = row.oauth.grantRef;
+        const stored = await records.readRecord(grantRef);
+        if (stored !== undefined && stored.kind === 'grant' && isOAuthGrantPayload(stored.payload)) {
+            return { payload: stored.payload, recoveredFromProjection: false };
+        }
+        const projectionKey = `${OAUTH_GRANT_RECORD_SCOPE}/${provider}`;
+        // The seam can hand back its own live record and this repair awaits before
+        // it writes: snapshot it once so the ownership check, the write and the
+        // returned baseline all see the payload that was verified, even if the
+        // source is updated in place meanwhile.
+        const projection = structuredClone(await records.readRecord(projectionKey));
+        if (projection === undefined || projection.kind !== 'grant' || !isOAuthGrantPayload(projection.payload))
+            return undefined;
+        // Only a projection this row owns is adopted; recovering a foreign grant
+        // would attach another account's credential to this row.
+        const oauthRows = this.store.provider(provider)?.keys.filter(candidate => candidate.kind === 'oauth' && candidate.oauth !== null) ?? [];
+        if (matchOwningAccount(provider, oauthRows, projection.payload)?.id !== row.id)
+            return undefined;
+        // `row` is a snapshot taken before the reads: a removal or a re-sign-in can
+        // have detached or repointed it since, and the repair must not land on a
+        // ref this row no longer names.
+        if (oauthRows.find(candidate => candidate.id === row.id)?.oauth?.grantRef !== grantRef) {
+            // The row no longer names this ref, so the projection that matched it
+            // belongs to a previous generation: refusing leaves the caller's own
+            // "missing or unusable" failure in place instead of reviving it.
+            return undefined;
+        }
+        // A declined updater is NOT "the ref is occupied by an unusable record":
+        // it means nothing was written for this row, so the projection read above
+        // is a previous generation's payload and must not be served.
+        let declined = false;
+        try {
+            // Compare-at-absent: an occupied ref returns `current`, which the seam
+            // keeps, so a concurrent login's or rotation's record wins the ref.
+            const liveNow = await records.modifyRecord(grantRef, current => {
+                if (current !== undefined)
+                    return Promise.resolve(current);
+                // Runs under the seam's per-key lock, so this is the state the write
+                // commits against: a removal that deleted the ref and marked (or
+                // spliced) the row since the checks above must not be undone by
+                // re-creating the credential it deleted.
+                const liveRow = this.store.provider(provider)?.keys.find(candidate => candidate.id === row.id);
+                if (liveRow === undefined
+                    || this.retiringAccounts.has(liveRow)
+                    || liveRow.kind !== 'oauth'
+                    || liveRow.oauth === null
+                    || liveRow.oauth.grantRef !== grantRef) {
+                    declined = true;
+                    return Promise.resolve(undefined);
+                }
+                return Promise.resolve({ kind: 'grant', payload: structuredClone(projection.payload) });
             });
-            row.valueMissing = false;
-            // Round-5 finding M1: manual recovery ends the cooling window too, the
-            // same reset a successful re-authentication applies. A demoted account
-            // is re-activated while its stale cooldown still sits on the row, which
-            // would render the freshly projected grant as cooling and keep it out
-            // of the healthy counts until the timer expires. Clearing the window
-            // also resets escalation: `applyFailureCooldown` derives the next level
-            // from `cooldownUntil` only (core.ts:168-174).
-            row.cooldownUntil = 0;
-            this.store.touch();
-            // Remote methods hand back the refreshed state view (addKey/deleteKey
-            // precedent), so the client updates its snapshot in one round trip.
-            return this.buildState();
+            // No post-write compensation (PR #37 I-000233): it would prove what THIS
+            // call wrote, not that the record it deleted was still ours — a same-ref
+            // sign-in can commit a fresh record before attaching its row, and the
+            // seam has no compare-and-delete (`deleteRecord(key)` takes no expected
+            // payload). It is redundant: the removal path owns the ref it retires.
+            // `removeOAuthGrant` marks the row in `retiringAccounts` BEFORE its first
+            // awaited delete, and this updater revalidates synchronously under the
+            // seam's per-key lock, so a removal that started first makes the update
+            // decline, and one that starts after this write deletes
+            // `row.oauth.grantRef` — the very ref this updater just proved the row
+            // names — itself.
+            if (declined)
+                return undefined;
+            // The ref may have been taken while this read was parked: the record's
+            // payload is the credential the caller must borrow now, not the
+            // projection this repair declined to write over it.
+            if (liveNow !== undefined && liveNow.kind === 'grant' && isOAuthGrantPayload(liveNow.payload)) {
+                return { payload: liveNow.payload, recoveredFromProjection: false };
+            }
+        }
+        catch (error) {
+            // Best-effort repair: the projection still served this read.
+            this.warn(`could not restore ${grantRef} for ${provider}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        return { payload: projection.payload, recoveredFromProjection: true, projection };
+    }
+    /**
+     * The slow half of an activation, outside the queue: read the row's grant
+     * generation (recovered from the live projection when its record is gone),
+     * validate it, and capture the projection the route serves now.
+     */
+    async prepareActivation(provider, row, records) {
+        const grantRef = row.oauth.grantRef;
+        const recovered = await this.recoverGrantPayload(provider, row, records);
+        if (recovered === undefined) {
+            throw new Error(`The grant payload at ${grantRef} is missing or unusable; sign in to this account again`);
+        }
+        const projectionKey = `${OAUTH_GRANT_RECORD_SCOPE}/${provider}`;
+        // A projection-only recovery already read and ownership-verified the route.
+        // Re-reading it here would open a gap: a same-ref rotation landing in it
+        // leaves the payload from the first read and a baseline from the second, so
+        // the compare would pass and write the older credential. The record the
+        // payload came from is the only truthful baseline for it.
+        const live = recovered.projection ?? await records.readRecord(projectionKey);
+        const payload = structuredClone(recovered.payload);
+        // F5: the restored record decides its owner, so the classification is
+        // derived from the baseline payload through the shared matcher — the same
+        // rule the reconciler applies — rather than from an owner id captured
+        // earlier that the record may no longer belong to.
+        const accounts = this.store.provider(provider)?.keys.filter(candidate => candidate.kind === 'oauth' && candidate.oauth !== null) ?? [];
+        const baselineOwner = live !== undefined && live.kind === 'grant' && isOAuthGrantPayload(live.payload)
+            ? matchOwningAccount(provider, accounts, live.payload)
+            : undefined;
+        return {
+            grantRef,
+            payload,
+            written: JSON.stringify(payload),
+            recoveredFromProjection: recovered.recoveredFromProjection,
+            baseline: live === undefined ? { state: 'absent' } : { state: 'present', record: structuredClone(live) },
+            // Captured with the baseline, before the turn claims the route: the
+            // compensation has to put back the classification that matches the
+            // record it restores, and only this snapshot still knows it. Any present
+            // record no row's payload matches is foreign (a native api-key
+            // credential, an unrecognized payload, an unowned grant), so `none` is
+            // only the absent-baseline case.
+            classification: live === undefined
+                ? { state: 'none' }
+                : baselineOwner !== undefined ? { state: 'owned', rowId: baselineOwner.id } : { state: 'foreign' },
+        };
+    }
+    /** Whether the projection still holds the value this activation read. */
+    matchesActivationBaseline(current, baseline) {
+        if (baseline.state === 'absent')
+            return current === undefined;
+        if (current === undefined)
+            return false;
+        // Compare the FIELDS, never the object shape: `CredentialRecordLike` makes
+        // `key`/`env`/`payload` optional, and a seam whose read path and
+        // `modifyRecord` path materialise different key sets (one omits them, one
+        // sets them to `undefined`) would defeat a structural comparison and refuse
+        // every activation over an already-serving route.
+        //
+        // An api-key projection keeps its secret in `key`/`env` with `payload`
+        // absent, so every field is compared: payload plus the native fields.
+        const baselineRecord = baseline.record;
+        const sameSecret = current.key === baselineRecord.key;
+        const sameEnv = JSON.stringify(current.env ?? null) === JSON.stringify(baselineRecord.env ?? null);
+        const samePayload = JSON.stringify(current.payload ?? null) === JSON.stringify(baselineRecord.payload ?? null);
+        return current.kind === baselineRecord.kind && sameSecret && sameEnv && samePayload;
+    }
+    /**
+     * Write the projection only while the route still serves the baseline. The
+     * seam's `modifyRecord` mutate body runs under the per-key lock, so this is
+     * the one atomic primitive the activation has (I-000090: `deleteRecord` has
+     * no expected-payload form). Returns the payload written, or `undefined` when
+     * the compare failed and nothing was touched.
+     */
+    async compareAndWriteProjection(records, provider, prepared) {
+        const projectionKey = `${OAUTH_GRANT_RECORD_SCOPE}/${provider}`;
+        let landed = false;
+        await records.modifyRecord(projectionKey, async (current) => {
+            if (!this.matchesActivationBaseline(current, prepared.baseline))
+                return undefined;
+            landed = true;
+            // Only this write supersedes a pending own-removal marker: a projection
+            // is about to serve again, so a removal echo still in flight cannot
+            // describe the live record. A refused compare must leave the marker
+            // armed for the removal it belongs to — clearing it there would let that
+            // removal's echo read as an out-of-band deletion (a spurious "removed
+            // outside Keys Manager" warning and a `valueMissing` row).
+            this.intentionalProjectionRemovals.delete(provider);
+            return { kind: 'grant', payload: prepared.payload };
         });
+        return landed ? prepared.written : undefined;
+    }
+    /**
+     * Undo one activation whose state flush was rejected: the row this turn
+     * cleared in memory, the owner claim it took, and the projection it wrote
+     * (back to the captured baseline).
+     *
+     * The baseline decides the mechanism. A present baseline is restored with the
+     * same compare-and-write the projection used; only an absent baseline has to
+     * remove a record, and only while that record is still this activation's own
+     * payload. A foreign writer's record is never deleted.
+     */
+    async compensateActivationFlush(provider, accountId, prepared, undo, records) {
+        const outcome = prepared.baseline.state === 'absent'
+            ? await this.deleteActivationProjection(records, provider, prepared.written, undo.generation)
+            : await this.restoreActivationProjection(records, provider, prepared, undo.generation);
+        // Both helpers awaited, so the classification below decides after the same
+        // read the guard above made before it: a claim that landed inside that I/O
+        // already settled what serves the route, and overwriting it would revert a
+        // newer owner or mark its route foreign. No await separates this check from
+        // the writes in the switch.
+        if (this.ownershipSuperseded(provider, undo.generation))
+            return;
+        // The compensation is about to replace what the route serves (or which row
+        // owns it), so every reconciler that captured the earlier generation read a
+        // world this undoes and must not commit: its projection read may predate the
+        // restore, and its row/binding writes would re-claim an account the restored
+        // baseline does not serve. `ours` keeps the activation's projection and claim
+        // in place — it changes nothing a reconciler could misread — so it needs no
+        // bump.
+        if (outcome !== 'ours')
+            this.noteProjectionCommitted(provider);
+        // P2-B: the row rollback belongs to the outcomes that actually changed what
+        // serves the route. `ours` keeps the activation's projection and claim — the
+        // account IS serving — so restoring the pre-activation demotion would render
+        // a live account as missing/cooling, and a restart without an echo would
+        // persist that lie.
+        if (outcome !== 'ours') {
+            const row = this.store.provider(provider)?.keys.find(candidate => candidate.id === accountId);
+            if (row !== undefined) {
+                row.valueMissing = undo.valueMissing;
+                row.cooldownUntil = undo.cooldownUntil;
+                this.store.touch();
+            }
+        }
+        switch (outcome) {
+            case 'superseded':
+                // The newer claim that moved the generation owns the route and has
+                // already settled what serves it; this undo decides nothing.
+                return;
+            case 'ours':
+                // The activation's projection is still the live record, so its claim
+                // stays: deleting it would call the route pool-served while a record
+                // serves it, and selection plus failure attribution would be wrong
+                // until an echo reconciled the route (never, if the optional
+                // `record-updated` subscription is unavailable).
+                return;
+            case 'baseline':
+                this.applyActivationClassification(provider, prepared.classification);
+                return;
+            case 'foreign':
+                this.activeAccounts.delete(provider);
+                this.foreignProjections.add(provider);
+                return;
+            case 'gone':
+                // Nothing serves the route any more, so the pool does.
+                this.activeAccounts.delete(provider);
+                this.foreignProjections.delete(provider);
+                return;
+        }
+    }
+    /** Put the route's owner classification back to a captured snapshot. */
+    applyActivationClassification(provider, classification) {
+        if (classification.state === 'owned') {
+            this.activeAccounts.set(provider, classification.rowId);
+            this.foreignProjections.delete(provider);
+            return;
+        }
+        this.activeAccounts.delete(provider);
+        if (classification.state === 'foreign')
+            this.foreignProjections.add(provider);
+        else
+            this.foreignProjections.delete(provider);
+    }
+    /** Put the projection back to the present baseline, if it is still ours. */
+    async restoreActivationProjection(records, provider, prepared, generation) {
+        const baseline = prepared.baseline;
+        if (baseline.state !== 'present')
+            return 'baseline';
+        const projectionKey = `${OAUTH_GRANT_RECORD_SCOPE}/${provider}`;
+        let outcome = 'ours';
+        try {
+            await records.modifyRecord(projectionKey, async (current) => {
+                // The generation is decided HERE, under the seam's per-key lock and in
+                // the same synchronous step as the payload compare: a claim that lands
+                // between this compensation's entry and this callback would otherwise
+                // see its own projection matched and get the baseline written back over
+                // a route it owns, while the post-I/O check then exits early and leaves
+                // that newer account claimed beside the restored credential.
+                if (this.ownershipSuperseded(provider, generation)) {
+                    outcome = 'superseded';
+                    return undefined;
+                }
+                if (current === undefined) {
+                    outcome = 'gone';
+                    return undefined;
+                }
+                if (current.kind !== 'grant' || JSON.stringify(current.payload) !== prepared.written) {
+                    // A record this activation did not write serves the route now.
+                    outcome = 'foreign';
+                    return undefined;
+                }
+                // Return the captured record itself: rebuilding it from `kind` and
+                // `payload` would drop the `key`/`env` an api-key projection carries and
+                // leave the route unusable after a failed flush.
+                outcome = 'baseline';
+                return structuredClone(baseline.record);
+            });
+        }
+        catch (error) {
+            // An unreadable or refused seam proves nothing: the activation's
+            // projection may still be live, so `ours` keeps its claim.
+            this.warn(`activation projection restore failed for ${provider}: ${error instanceof Error ? error.message : String(error)}`);
+            return 'ours';
+        }
+        return outcome;
+    }
+    /**
+     * The delete authority's proof for an activation's own projection, as an
+     * explicit three-valued answer (QC R2): only `matches` may authorize touching
+     * the record. `unknown` is a store failure — a closed seam, an unreadable
+     * record — and proves nothing, so it is never permission.
+     */
+    async activationProjectionProof(records, provider, written, generation) {
+        const projectionKey = `${OAUTH_GRANT_RECORD_SCOPE}/${provider}`;
+        try {
+            // Absent and "another writer's record" are different answers: absent
+            // means nothing serves the route any more (our own demotion can remove
+            // the projection without superseding the claim), while `differs` means a
+            // replacement does. Folding them together marked a serviceless route
+            // foreign, which makes `keyPoolServes` false and leaves no usable
+            // credential at all.
+            let state = 'absent';
+            await records.modifyRecord(projectionKey, async (current) => {
+                // The claim is decided under the same lock as the identity compare, for
+                // the same reason as the restore: a newer owner must not have its
+                // projection deleted by an undo that only checks the generation later.
+                if (this.ownershipSuperseded(provider, generation)) {
+                    state = 'superseded';
+                    return undefined;
+                }
+                state = current === undefined
+                    ? 'absent'
+                    : current.kind === 'grant' && JSON.stringify(current.payload) === written ? 'matches' : 'differs';
+                return undefined;
+            });
+            return state;
+        }
+        catch (error) {
+            this.warn(`activation projection proof failed for ${provider}: ${error instanceof Error ? error.message : String(error)}`);
+            return 'unknown';
+        }
+    }
+    /**
+     * Delete one projection an activation just proved it still owns, through the
+     * same guarded shape the demotion path uses (MF2): the intentional-removal
+     * marker is armed before the delete, so the deletion's own echo is read as
+     * ours instead of as an out-of-band removal.
+     */
+    async deleteActivationProjection(records, provider, written, generation) {
+        const projectionKey = `${OAUTH_GRANT_RECORD_SCOPE}/${provider}`;
+        // F2: the identity read and the delete cannot be atomic here — the seam has
+        // no compare-and-delete, `deleteRecord(key)` takes no expected payload
+        // (host-types.ts:142, tracked as I-000090). This read immediately before the
+        // delete narrows the window to the seam call itself; a writer that replaces
+        // the record inside it still loses its grant, and that residual needs the
+        // seam CAS, not another read here. Anything but a proven match is left
+        // alone.
+        const proof = await this.activationProjectionProof(records, provider, written, generation);
+        if (proof === 'superseded')
+            return 'superseded';
+        // `absent` needs no delete and leaves nothing serving (the pool does);
+        // `differs` means another writer's record serves the route; `unknown`
+        // proves nothing and must keep the activation's claim.
+        if (proof === 'absent')
+            return 'gone';
+        if (proof !== 'matches')
+            return proof === 'differs' ? 'foreign' : 'ours';
+        const markedAt = Date.now();
+        this.intentionalProjectionRemovals.set(provider, markedAt);
+        try {
+            await records.deleteRecord(projectionKey);
+        }
+        catch (error) {
+            // A delete that threw removed nothing, so no own-removal echo is coming:
+            // revoke this call's marker or it would mask a genuine one for the TTL.
+            if (this.intentionalProjectionRemovals.get(provider) === markedAt) {
+                this.intentionalProjectionRemovals.delete(provider);
+            }
+            this.warn(`cancelled activation projection cleanup failed for ${provider}: ${error instanceof Error ? error.message : String(error)}`);
+            // R14-SF2 applies here too: a throwing delete may have removed the record
+            // before throwing, so the outcome is re-proved rather than assumed —
+            // guessing is what this file forbids. A second failure
+            // proves nothing and keeps the claim (`ours`).
+            const after = await this.activationProjectionProof(records, provider, written, generation);
+            if (after === 'superseded')
+                return 'superseded';
+            if (after === 'absent')
+                return 'gone';
+            if (after === 'differs')
+                return 'foreign';
+            return 'ours';
+        }
+        return 'gone';
     }
     /**
      * Remote: send one minimal request with the selected key or account row.
@@ -3883,11 +4668,68 @@ export class KeysManagerService {
             test: true,
         });
     }
+    /**
+     * Whether this test may still borrow the route, or the result it must report
+     * instead: the window is live, shutdown has not begun, and the row still
+     * exists, is not retiring, and still names the `grantRef` the test captured.
+     *
+     * Read before the borrow and again after every await that precedes it. The
+     * grant recovery is one: it outlives the isolation deadline on a slow seam,
+     * and a window the watchdog already released no longer compensates its late
+     * borrow (that branch is guarded by `abandonedWindows.get(provider) === window`).
+     */
+    borrowBarrier(window, provider, row, grantRef) {
+        if (window.cleaned) {
+            // QC fix wave 2: the watchdog abandoned this window while an await was in
+            // flight. Starting (or resuming) the borrow now would land it after the
+            // cleanup that already ran, so the test stops here.
+            return this.abandonedTestResult();
+        }
+        if (this.shutdownRequested) {
+            // PR review round 30: shutdown abandons the chain parked here, so the
+            // borrow write must not land after `close()`. Round 34: the marker
+            // is up from shutdown's entry, so the pre-close restoration is covered
+            // too — it does not borrow, and this test must not either.
+            return this.shutdownEntryResult();
+        }
+        // PR review round 12: the reads and the recovery above are awaits, so a
+        // removal can have deleted the provider or this row while they were in
+        // flight (a test that registered and one that did not are covered: the
+        // marker refuses the latter, this re-check the former). Never write the
+        // borrow — and never re-project the removed account's grant — on that state.
+        // PR review round 15: the existence check alone still holds while a removal
+        // is deleting credentials (the row is spliced only after its grant delete),
+        // so the row's retirement mark is part of the assertion. The provider-wide
+        // marker is deliberately not read here: a removal that began while this
+        // test is registered waits for it in {@link settleTestBeforeRemoval} and is
+        // the designed handshake, while the row mark is only set by a removal that
+        // already passed that check.
+        const live = this.store.provider(provider);
+        const removing = this.retiringAccounts.has(row);
+        const liveRow = live?.keys.find(candidate => candidate.id === row.id);
+        if (removing || liveRow === undefined) {
+            return removing
+                ? { ok: false, latencyMs: 0, error: `Provider "${provider}" is being removed; the test did not borrow its credential` }
+                : { ok: false, latencyMs: 0, error: `Key "${row.id}" was removed from ${provider} before its test could borrow it` };
+        }
+        // PR #37 review (I-000234): a re-sign-in repoints the row instead of
+        // removing it. The recovery read then belongs to the generation the row no
+        // longer names, so borrowing it would test the previous credential and
+        // report the outcome against this row.
+        if (liveRow.oauth === null || liveRow.oauth.grantRef !== grantRef) {
+            return { ok: false, latencyMs: 0, error: `Key "${row.id}" was repointed on ${provider} before its test could borrow it` };
+        }
+        return undefined;
+    }
     /** One request with the row's grant temporarily projected as the route's credential. */
     async runOAuthRowTest(provider, row, model, window) {
         const grant = row.oauth;
         if (grant === null)
             return { ok: false, latencyMs: 0, error: `Key "${row.id}" is not an OAuth account` };
+        // Captured here, not read from the row later: a re-sign-in repoints the
+        // row's generation in place, so the live object would answer with the NEW
+        // ref and the borrow would look current.
+        const grantRef = grant.grantRef;
         const records = this.credentialRecords();
         if (records === undefined)
             return { ok: false, latencyMs: 0, error: 'The credential store does not support records' };
@@ -3897,23 +4739,6 @@ export class KeysManagerService {
         // grant chain, so a rotation echo cannot observe or overwrite the
         // temporary projection between them.
         await this.scheduleGrantReconciliation(provider, async () => {
-            const stored = await records.readRecord(grant.grantRef);
-            if (window.cleaned) {
-                // QC fix wave 2: the watchdog abandoned this window while the read was
-                // in flight. Starting (or resuming) the borrow now would land it after
-                // the cleanup that already ran, so the test stops here.
-                result = this.abandonedTestResult();
-                return;
-            }
-            if (stored === undefined || stored.kind !== 'grant' || !isOAuthGrantPayload(stored.payload)) {
-                result = {
-                    ok: false,
-                    latencyMs: 0,
-                    error: `The grant payload at ${grant.grantRef} is missing or unusable; sign in to this account again`,
-                };
-                return;
-            }
-            const borrowed = structuredClone(stored.payload);
             const captured = await records.readRecord(projectionKey);
             // PR review round 14: the snapshot and its comparison key are frozen
             // here. The seam hands back a live record, so a writer mutating that
@@ -3921,36 +4746,30 @@ export class KeysManagerService {
             // the updater's `current` and make the borrow look unchanged.
             const previous = captured === undefined ? undefined : structuredClone(captured);
             const previousKey = previous === undefined ? undefined : JSON.stringify(previous);
-            if (window.cleaned) {
-                result = this.abandonedTestResult();
+            const blocked = this.borrowBarrier(window, provider, row, grantRef);
+            if (blocked !== undefined) {
+                result = blocked;
                 return;
             }
-            if (this.shutdownRequested) {
-                // PR review round 30: shutdown abandons the chain parked here, so the
-                // borrow write below must not land after `close()`. Round 34: the
-                // marker is up from shutdown's entry, so the pre-close restoration is
-                // covered too — it does not borrow, and this test must not either.
-                result = this.shutdownEntryResult();
+            // The recovery writes a grant record, so it runs only once this test is
+            // known to borrow: an abandoned or retiring test must not restore one.
+            const recovered = await this.recoverGrantPayload(provider, row, records);
+            if (recovered === undefined) {
+                result = {
+                    ok: false,
+                    latencyMs: 0,
+                    error: `The grant payload at ${grantRef} is missing or unusable; sign in to this account again`,
+                };
                 return;
             }
-            // PR review round 12: both reads above are awaits, so a removal can have
-            // deleted the provider or this row while they were in flight (a test that
-            // registered and one that did not are covered: the marker refuses the
-            // latter, this re-check the former). Never write the borrow — and never
-            // re-project the removed account's grant — on that state.
-            // PR review round 15: the existence check alone still holds while a
-            // removal is deleting credentials (the row is spliced only after its
-            // grant delete), so the row's retirement mark is part of the assertion.
-            // The provider-wide marker is deliberately not read here: a removal that
-            // began while this test is registered waits for it in
-            // {@link settleTestBeforeRemoval} and is the designed handshake, while
-            // the row mark is only set by a removal that already passed that check.
-            const live = this.store.provider(provider);
-            const removing = this.retiringAccounts.has(row);
-            if (removing || live === undefined || !live.keys.some(candidate => candidate.id === row.id)) {
-                result = removing
-                    ? { ok: false, latencyMs: 0, error: `Provider "${provider}" is being removed; the test did not borrow its credential` }
-                    : { ok: false, latencyMs: 0, error: `Key "${row.id}" was removed from ${provider} before its test could borrow it` };
+            const borrowed = structuredClone(recovered.payload);
+            // PR #37 review (must-fix): the recovery is an untimed seam round trip
+            // and can outlive the isolation deadline, after which the window's
+            // cleanup has already run and released the window. Registering facts or
+            // borrowing now would land them with no owner: re-run the barrier first.
+            const lateBlocked = this.borrowBarrier(window, provider, row, grantRef);
+            if (lateBlocked !== undefined) {
+                result = lateBlocked;
                 return;
             }
             // QC fix wave 2: record the borrow before the write, so an abandoned
@@ -4597,9 +5416,11 @@ export class KeysManagerService {
             ...(typeof payload.expires === 'number' && Number.isFinite(payload.expires) ? { expiresAt: payload.expires } : {}),
         };
         if (previousRef !== rotatedRef) {
-            // The row repoint above is synchronous, but the delete is a second write:
-            // re-read both gates immediately before it so a shutdown or a takeover
-            // that landed in between cannot remove a record this attempt never owned.
+            // Defence in depth, not a reachable window: no await separates the guard
+            // above from the delete below, so neither a shutdown nor a takeover can
+            // land in between. The re-check is kept because it is the condition the
+            // delete depends on and a future await inserted here would otherwise
+            // silently remove a record this attempt never owned.
             if (this.persistenceRefused(capability) || (guard !== undefined && !guard())) {
                 this.store.touch();
                 return;
@@ -4608,6 +5429,11 @@ export class KeysManagerService {
             try {
                 if (records === undefined)
                     throw new Error('The credential store does not support records');
+                // Declared residual: this delete is an await with no expected-payload
+                // CAS (`deleteRecord(key)` takes only the key), so a claim landing
+                // inside it can still remove the same-ref record an activation just
+                // wrote. Post-delete compensation is out of scope here; closing it
+                // needs a seam-level compare-and-delete.
                 await records.deleteRecord(previousRef);
             }
             catch (error) {
@@ -4641,11 +5467,13 @@ export class KeysManagerService {
                         return { ok: false, error: failure?.message ?? failure?.code ?? 'The provider reported a failure' };
                     }
                     // PR review SF3 + round 8: only a real completion is a pass. The ping
-                    // asks for one token, so `length` is the expected completion; a
+                    // asks for one token, so `max-tokens` is the expected completion; a
                     // finish chunk with NO reason, `aborted`, or any kind this broker
                     // does not know means the provider did not answer, so reporting a
-                    // pass would claim a credential it never served.
-                    if (kind === 'stop' || kind === 'length' || kind === 'toolUse') {
+                    // pass would claim a credential it never served. The accepted kinds
+                    // are the installed `@deepseek-ai/dsh-llm` union (`FinishReasonMap`),
+                    // shared with the tests so the two cannot drift again.
+                    if (kind !== undefined && TEST_SUCCESS_FINISH_KINDS.includes(kind)) {
                         // PR review round 42: a successful ping only proves the route
                         // answered. An api-key row test must also prove the pinned literal
                         // was the credential that served it — a takeover during the stream
@@ -5165,6 +5993,15 @@ export class KeysManagerService {
         this.store.pruneBindings(now);
         this.pruneAttempts(now);
     }
+    /**
+     * Project one provider's unattributed-request count into its row. Additive
+     * and optional (`I-000120`): a row with no count spreads nothing, so an
+     * older snapshot and a healthy store render exactly as before.
+     */
+    unattributedView(provider) {
+        const count = this.unattributedRequests.get(provider) ?? 0;
+        return count > 0 ? { unattributedRequests: count } : {};
+    }
     /** Build the complete UI state. */
     buildState() {
         const now = Date.now();
@@ -5181,6 +6018,11 @@ export class KeysManagerService {
             const profile = namespace === undefined ? undefined : asProfile(getPath(namespace.value, entry.settingsPath));
             const managed = this.store.provider(entry.provider);
             const extra = EXTRA_PROVIDER_MAP.get(entry.provider);
+            // A transport route names its own credential record and registers no
+            // settings namespace, so the profile/capability read below can only
+            // describe the route wrongly: it is neither a DSH route nor key-pool
+            // capable, and it is never adoptable.
+            const transport = entry.settingsNs === TRANSPORT_CREDENTIAL_SCOPE;
             const oauthFlow = this.oauthFlowAvailable(entry.provider);
             const caps = capabilityOf(entry, profile, oauthFlow);
             const support = { supported: caps.keys, ...(caps.reason === undefined ? {} : { reason: caps.reason }) };
@@ -5198,14 +6040,17 @@ export class KeysManagerService {
                 provider: entry.provider,
                 displayName: extra?.name ?? entry.displayName ?? entry.provider,
                 source: extra !== undefined ? 'extra' : 'dsh',
-                origin: extra !== undefined ? 'plugin' : entry.declared === true ? 'custom' : 'dsh',
+                origin: extra !== undefined || transport ? 'plugin' : entry.declared === true ? 'custom' : 'dsh',
                 managed: managed !== undefined,
                 createdProfile: managed?.createdProfile ?? false,
                 configured: active.has(entry.provider) || profile !== undefined,
                 active: active.has(entry.provider),
-                supported: support.supported,
-                ...(support.reason === undefined ? {} : { reason: support.reason }),
-                accountSupported: accountSupport.supported,
+                supported: transport ? false : support.supported,
+                ...(transport
+                    ? { reason: 'This route is served by a transport plugin; manage its account from this provider card.' }
+                    : support.reason === undefined ? {} : { reason: support.reason }),
+                accountSupported: transport ? false : accountSupport.supported,
+                ...(transport ? { transport: true } : {}),
                 settingsNs: entry.settingsNs,
                 settingsPath: [...entry.settingsPath],
                 apiKeyEnv,
@@ -5224,6 +6069,7 @@ export class KeysManagerService {
                 status: managed !== undefined ? statusOfProvider(managed.keys, now) : 'unmanaged',
                 keys,
                 ...(warning === undefined ? {} : { warning }),
+                ...this.unattributedView(entry.provider),
             });
             seen.add(entry.provider);
         }
@@ -5264,6 +6110,7 @@ export class KeysManagerService {
                 status: managed !== undefined ? statusOfProvider(managed.keys, now) : 'unmanaged',
                 keys,
                 ...(managed === undefined ? {} : { warning: 'This extra provider is managed but its pi-ai route is not registered. Check the provider profile in Models.' }),
+                ...this.unattributedView(extra.id),
             });
             seen.add(extra.id);
         }
@@ -5302,6 +6149,7 @@ export class KeysManagerService {
                 status: statusOfProvider(managed.keys, now),
                 keys,
                 warning: 'This provider route is not currently registered. Check its profile in Models.',
+                ...this.unattributedView(managed.provider),
             });
             seen.add(managed.provider);
         }
@@ -5325,6 +6173,8 @@ export class KeysManagerService {
             writable: descriptor.writable && !this.store.readOnly,
             settings: { ...normalizeSettings(this.store.settings) },
             providers: views,
+            // Managed only: a transport route renders as a card but stays out of
+            // this published count, the key counts and every key-pool write path.
             managedCount: views.filter(view => view.managed).length,
             keyCount: allKeys.length,
             healthyKeyCount: allKeys.filter(key => key.status === 'active').length,
@@ -5494,14 +6344,38 @@ export class KeysManagerService {
         // PR review round 35: the last point before the settings write. Only
         // `closing` is read: shutdown's own pre-close restoration writes here by
         // design and runs before that flag goes up.
-        if (this.closing)
+        //
+        // Reaching this point means the route genuinely needs a write: `current ===
+        // desired` already returned true above, and the preserved / releasing /
+        // foreign-value branches declined for their own reasons. So shutdown is
+        // what stops it, and this is the one place that can say so — the callers
+        // cannot infer it (`pushWarning` caps its list, and a silent `false` has
+        // several non-refusal causes upstream).
+        if (this.closing) {
+            this.bindingWriteRefused(provider, 'Keys Manager is shutting down');
+            return false;
+        }
+        // A caller that stamped the ownership generation it entered with forbids
+        // this write once a newer claim landed: the binding it would commit was
+        // derived from the classification that claim replaced.
+        if (options.ownershipGeneration !== undefined
+            && this.ownershipSuperseded(provider, options.ownershipGeneration))
             return false;
         try {
-            // The entry gate above read a snapshot; ownership can turn unknown while
-            // this write re-reads its descriptor (PR review round 25). Binding is a
-            // guess then, so the gate closes again at the last point before the
+            // The entry gate above read a snapshot, and ownership can turn unknown
+            // while this write re-reads its descriptor (PR review round 25). Binding
+            // is a guess then, so the gate closes again at the last point before the
             // mutation. Unbinding stays allowed.
-            const written = await this.mutateSettings(record.settingsNs, [desired === undefined ? { op: 'unset', path } : { op: 'set', path, value: desired }], () => desired === undefined || this.projectionOwnershipKnown(provider));
+            // That last point is `mutateSettings`' `stillWrites` predicate: it is
+            // evaluated synchronously between the descriptor re-read and
+            // `settings.mutate` (no await between them), and the mutate itself passes
+            // the descriptor's revision as an expected-revision CAS, so a takeover
+            // that changed the namespace in between makes the write fail instead of
+            // landing stale state. A claim the predicate sees must not leave this
+            // binding behind — it describes the classification that claim replaced.
+            const stamp = options.ownershipGeneration;
+            const written = await this.mutateSettings(record.settingsNs, [desired === undefined ? { op: 'unset', path } : { op: 'set', path, value: desired }], () => (desired === undefined || this.projectionOwnershipKnown(provider))
+                && (stamp === undefined || !this.ownershipSuperseded(provider, stamp)));
             if (!written)
                 return false;
         }
@@ -5575,8 +6449,15 @@ export class KeysManagerService {
         const takeover = record?.takeoverPending === true
             && !this.foreignProjections.has(provider)
             && this.oauthOwnerFor(provider) === null;
-        const bound = await this.syncBrokerBinding(provider, { write: false, takeover });
-        if (takeover && bound && record !== undefined) {
+        // The awaited sync can be superseded (an activation claims the route while
+        // it runs). It would then commit a binding derived from the pre-claim
+        // classification, and settling the debt would record a takeover reconciled
+        // for a generation that no longer owns the route. The generation is
+        // captured here, passed to the sync's own last-mile gate, and re-read
+        // immediately before the clear.
+        const generation = this.ownershipGenerations.get(provider) ?? 0;
+        const bound = await this.syncBrokerBinding(provider, { write: false, takeover, ownershipGeneration: generation });
+        if (takeover && bound && record !== undefined && !this.ownershipSuperseded(provider, generation)) {
             record.takeoverPending = false;
             this.store.touch();
         }
@@ -5599,6 +6480,14 @@ export class KeysManagerService {
         // is persistence, so shutdown refuses it.
         if (this.closing)
             return;
+        // The own-generation stamp: this sync must not commit a binding derived
+        // from a classification a newer claim replaced. It travels into
+        // `syncBrokerBinding`, whose `stillWrites` predicate is the last point
+        // before the settings write and runs synchronously right before a
+        // revision-CAS'd mutate; the only window left is that write call itself,
+        // which fails on a revision mismatch rather than committing stale state.
+        // Every caller is covered here rather than at the call sites.
+        const generation = this.ownershipGenerations.get(provider) ?? 0;
         try {
             // PR review round 40: adoption keeps the pre-adoption reference while a
             // foreign projection serves the route and records that it still owes the
@@ -5607,8 +6496,8 @@ export class KeysManagerService {
             // once the bind lands; `originalApiKeyEnv` alone proves nothing.
             const record = this.store.provider(provider);
             const takeover = record?.takeoverPending === true;
-            const bound = await this.syncBrokerBinding(provider, { takeover });
-            if (takeover && bound && record !== undefined) {
+            const bound = await this.syncBrokerBinding(provider, { takeover, ownershipGeneration: generation });
+            if (takeover && bound && record !== undefined && !this.ownershipSuperseded(provider, generation)) {
                 record.takeoverPending = false;
                 this.store.touch();
             }
@@ -5690,6 +6579,12 @@ export class KeysManagerService {
                     throw new Error('This extra provider needs a key; add it from the extra-provider section');
                 throw new Error(`Provider "${provider}" is not registered by any adapter`);
             }
+            // A transport route's credential is the record its own adapter reads, so
+            // adopting it would bind a profile nothing serves (and its namespace is
+            // not even mounted). Refuse before any settings read or write.
+            if (entry.settingsNs === TRANSPORT_CREDENTIAL_SCOPE) {
+                throw new Error(`Provider "${provider}" is served by a transport plugin; manage its account from its provider card`);
+            }
             const descriptor = this.describeSettings();
             const namespace = this.namespace(descriptor, entry.settingsNs);
             if (namespace === undefined)
@@ -5848,6 +6743,7 @@ export class KeysManagerService {
             return 'superseded';
         }
         this.ownershipReadFailures.delete(provider);
+        this.unattributedRequests.delete(provider);
         this.noteProviderHydrated(provider);
         if (record === undefined)
             this.foreignProjections.delete(provider);
@@ -6810,6 +7706,12 @@ export class KeysManagerService {
             // branches, so it is constructed after the isolation wait — a mismatch
             // profile still resolves pi-ai's stored grant, so the borrowed
             // projection reaches it too.
+            //
+            // No ownership read and no unattributed count here: the store already
+            // said this route's profile disagrees with its binding, so this manager
+            // cannot describe what serves it and hands the request over untouched.
+            // The counter is defined over routes whose ownership it did try to read
+            // (see `unattributedRequests`).
             return this.isolateFromTest(providerId, () => next());
         }
         // An ordinary request must never be served by the grant a row test has
@@ -7046,6 +7948,17 @@ export class KeysManagerService {
                                 });
                             }
                             iterator = await service.als.run(store, () => next()[Symbol.asyncIterator]());
+                            // I-000120 / D8 + I-000201: this request is served without an
+                            // attribution, and this is the only site that counts one — but
+                            // only once downstream actually has an iterator. Both causes (the
+                            // bounded wait expired, the read had failed) still arrive here as
+                            // the same `false`, and the hydration pass never counts. A routing
+                            // or adapter failure that throws before dispatch served nothing, so
+                            // it must not inflate the count; `started` keeps one attempt to one
+                            // increment, and a later attempt that does dispatch counts then.
+                            if (!hydrated) {
+                                service.unattributedRequests.set(providerId, (service.unattributedRequests.get(providerId) ?? 0) + 1);
+                            }
                         }
                         if (iterator === undefined)
                             throw new Error('managed stream has no iterator');