fix(runtime): make stale disposers, aborted refresh owners, and forced shutdown lease-exact

The debug ring unsubscribe now verifies registration identity so a stale
disposer cannot evict a replacement listener while its admission lease
stays live. An aborted Anthropic refresh owner records durable stale
evidence, so the replacement flight surfaces a retryable stale error
instead of escalating to reauthentication. Forced shutdown releases every
admitted turn exactly once, including leases that never bound a
controller, and late binding after that release stays idempotent. The
guardian, quota, login, MCP decode-boundary, and GUI qualification tests
now prove behavior instead of grepping source.

Author: lidge-jun

gui/tests/apikeys-workspace.test.tsx

@@ -195,3 +195,18 @@ test("stale selected key falls back to overview when list refreshes without it",
 
   await act(async () => { root.unmount(); });
 });
+
+test("capped API-key history qualifies total requests and attribution date in the rendered detail", async () => {
+  const { root, container, rerender } = await mountWorkspace({ historyTruncated: true });
+  await act(async () => { keyButton(container, "alpha").click(); });
+
+  const labels = () => [...container.querySelectorAll("dt")].map(node => node.textContent);
+  expect(labels()).toContain("Requests in available history");
+  expect(labels()).toContain("Available attribution since");
+
+  await rerender({ historyTruncated: false });
+  expect(labels()).toContain("Total attributed requests");
+  expect(labels()).toContain("Attribution available since");
+
+  await act(async () => { root.unmount(); });
+});

gui/tests/usage-layout.test.ts

@@ -1,4 +1,9 @@
 import { expect, test } from "bun:test";
+import { Window } from "happy-dom";
+import { act, createElement } from "react";
+import { clearClientResourceStoresForTests } from "../src/client-resource";
+import { LanguageProvider } from "../src/i18n/provider";
+import Usage from "../src/pages/Usage";
 
 test("Usage renders every section in one scrollable column with a sticky strip", async () => {
   const page = await Bun.file(new URL("../src/pages/Usage.tsx", import.meta.url)).text();
@@ -67,11 +72,73 @@ test("usage workspace i18n keys exist in every locale", async () => {
   }
 });
 
-test("Usage All becomes Available history and API-key lifetime totals are qualified when capped", async () => {
-  const usage = await Bun.file(new URL("../src/pages/Usage.tsx", import.meta.url)).text();
-  const keys = await Bun.file(new URL("../src/components/apikeys-workspace/ApiKeysWorkspace.tsx", import.meta.url)).text();
-  expect(usage).toContain('t("usage.range.available")');
-  expect(usage).toContain('data?.historyTruncated');
-  expect(keys).toContain('api.attribution.totalRequestsAvailable');
-  expect(keys).toContain('api.attribution.sinceAvailable');
+test("Usage renders Available history and a persistent qualification when history is capped", async () => {
+  const globalKeys = ["document", "window", "navigator", "localStorage", "IS_REACT_ACT_ENVIRONMENT"] as const;
+  const previous = Object.fromEntries(globalKeys.map(key => [key, Reflect.get(globalThis, key)]));
+  const originalFetch = globalThis.fetch;
+  const testWindow = new Window({ url: "http://localhost/" });
+  Object.defineProperties(globalThis, {
+    document: { configurable: true, value: testWindow.document },
+    window: { configurable: true, value: testWindow },
+    navigator: { configurable: true, value: testWindow.navigator },
+    localStorage: { configurable: true, value: testWindow.localStorage },
+  });
+  (globalThis as typeof globalThis & { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT = true;
+  clearClientResourceStoresForTests();
+  globalThis.fetch = (async () => Response.json({
+    range: "30d",
+    surface: "all",
+    since: null,
+    generatedAt: Date.now(),
+    summary: {
+      requests: 0,
+      measuredRequests: 0,
+      reportedRequests: 0,
+      unreportedRequests: 0,
+      unsupportedRequests: 0,
+      estimatedRequests: 0,
+      inputTokens: 0,
+      outputTokens: 0,
+      cachedInputTokens: 0,
+      reasoningOutputTokens: 0,
+      totalTokens: 0,
+      coverageRatio: 1,
+    },
+    days: [],
+    models: [],
+    providers: [],
+    historyTruncated: true,
+    truncatedPrefixBytes: 1,
+    entriesTruncated: false,
+    entriesDropped: 0,
+  })) as typeof fetch;
+
+  const container = document.createElement("div");
+  document.body.append(container);
+  const { createRoot } = await import("react-dom/client");
+  const root = createRoot(container);
+  try {
+    await act(async () => {
+      root.render(createElement(LanguageProvider, null, createElement(Usage, { apiBase: "http://usage-qualification-test" })));
+    });
+    const deadline = Date.now() + 1_000;
+    while (!(container.textContent ?? "").includes("Totals cover available history only")) {
+      if (Date.now() >= deadline) throw new Error("Usage qualification did not render");
+      await act(async () => {
+        await new Promise<void>(resolve => testWindow.setTimeout(resolve, 10));
+      });
+    }
+
+    expect(container.querySelector('button[aria-label="Available history"]')).not.toBeNull();
+    expect(container.textContent).toContain("Totals cover available history only because older usage was not loaded.");
+  } finally {
+    await act(async () => { root.unmount(); });
+    container.remove();
+    globalThis.fetch = originalFetch;
+    clearClientResourceStoresForTests();
+    testWindow.close();
+    for (const key of globalKeys) {
+      Object.defineProperty(globalThis, key, { configurable: true, value: previous[key] });
+    }
+  }
 });

src/lib/debug-log-buffer.ts

@@ -11,7 +11,8 @@ const MAX_LINES = 2_000;
 const MAX_DEBUG_SUBSCRIBERS = 64;
 const MAX_DEBUG_LINE_BYTES = 16 * 1024;
 const buffer: DebugLogEntry[] = [];
-const listeners = new Map<(entry: DebugLogEntry) => void, AdmissionLease>();
+interface DebugSubscriberRegistration { lease: AdmissionLease }
+const listeners = new Map<(entry: DebugLogEntry) => void, DebugSubscriberRegistration>();
 const subscriberGate = createAdmissionGate("debug_subscribers", MAX_DEBUG_SUBSCRIBERS);
 let nextSeq = 1;
 let bufferBytes = 0;
@@ -44,17 +45,20 @@ export function getDebugLogEntries(options?: { after?: number; limit?: number })
 }
 
 export function subscribeDebugLogEntries(listener: (entry: DebugLogEntry) => void): () => void {
-  const existing = listeners.get(listener);
-  if (existing) return () => {
-    if (listeners.delete(listener)) existing.release();
-    else existing.release();
-  };
-  const lease = subscriberGate.tryAcquire();
-  if (!lease) throw new ResourceAdmissionError("debug_subscribers", MAX_DEBUG_SUBSCRIBERS);
-  listeners.set(listener, lease);
+  let registration = listeners.get(listener);
+  if (!registration) {
+    const lease = subscriberGate.tryAcquire();
+    if (!lease) throw new ResourceAdmissionError("debug_subscribers", MAX_DEBUG_SUBSCRIBERS);
+    registration = { lease };
+    listeners.set(listener, registration);
+  }
+  let disposed = false;
   return () => {
-    if (listeners.delete(listener)) lease.release();
-    else lease.release();
+    if (disposed) return;
+    disposed = true;
+    if (listeners.get(listener) !== registration) return;
+    listeners.delete(listener);
+    registration.lease.release();
   };
 }
 
@@ -70,7 +74,7 @@ export function evictOldestDebugEntryForBudget(): number {
 export function resetDebugLogBufferForTests(): void {
   buffer.length = 0;
   bufferBytes = 0;
-  for (const lease of listeners.values()) lease.release();
+  for (const registration of listeners.values()) registration.lease.release();
   listeners.clear();
   nextSeq = 1;
 }

src/oauth/index.ts

@@ -4,7 +4,7 @@ import type { OcxConfig, OcxProviderConfig, RefreshPolicy } from "../types";
 import { loadConfig, resolveEnvValue, saveConfig } from "../config";
 import { maskEmail } from "../lib/privacy";
 import { KiroTokenRefreshError, environmentKiroRoutingMetadata, loginKiro, refreshKiroToken, settleKiroLoginTransaction } from "./kiro";
-import { getAccountCredential, getAccountSet, removeAccount, saveAccountCredential, saveCredential, setActiveAccount, getCredential, credentialGeneration, createOAuthRefreshIntentLock, mergeAccountCredential, markAccountNeedsReauthIfGeneration, readOAuthRefreshIntent, writeOAuthRefreshIntent, clearOAuthRefreshIntent } from "./store";
+import { getAccountCredential, getAccountSet, removeAccount, saveAccountCredential, saveCredential, setActiveAccount, getCredential, credentialGeneration, createOAuthRefreshIntentLock, mergeAccountCredential, markAccountNeedsReauthIfGeneration, readOAuthRefreshIntent, writeOAuthRefreshIntent, markOAuthRefreshIntentStaleOwner, clearOAuthRefreshIntent } from "./store";
 import { loginXai, refreshXaiToken, XAI_LOCAL_CLI_DETACH_WARNING, XaiTokenRequestError } from "./xai";
 import { ANTHROPIC_OAUTH_BETA, AnthropicTokenError, loginAnthropic, refreshAnthropicToken } from "./anthropic";
 import { loginKimi, refreshKimiToken } from "./kimi";
@@ -428,15 +428,16 @@ export async function refreshAnthropicAccountWithLock(
       if (pendingIntent) clearOAuthRefreshIntent(provider, accountId, pendingIntent.generation);
       return disk.access;
     }
-    if (
-      deps.replacedStaleFlight
-      && deps.replacedStaleFlight.dispatched === false
-      && !pendingIntent?.uncertain
-      && pendingIntent?.generation === generation
-      && pendingIntent.flightId === deps.replacedStaleFlight.flightId
-    ) {
-      clearOAuthRefreshIntent(provider, accountId, generation);
-      pendingIntent = undefined;
+    if (!pendingIntent?.uncertain && pendingIntent?.generation === generation) {
+      if (pendingIntent.staleOwner) throw new OAuthTokenRefreshStaleError();
+      if (deps.replacedStaleFlight && pendingIntent.flightId === deps.replacedStaleFlight.flightId) {
+        if (deps.replacedStaleFlight.dispatched) {
+          markOAuthRefreshIntentStaleOwner(provider, accountId, generation, deps.replacedStaleFlight.flightId);
+          throw new OAuthTokenRefreshStaleError();
+        }
+        clearOAuthRefreshIntent(provider, accountId, generation);
+        pendingIntent = undefined;
+      }
     }
     if (pendingIntent?.uncertain || pendingIntent?.generation === generation) {
       await markAccountNeedsReauthIfGeneration(provider, accountId, generation, writerGeneration);

src/oauth/store.ts

@@ -58,7 +58,7 @@ export function getAuthRefreshIntentLockPath(provider: string, accountId: string
 export function getAuthRefreshIntentPath(provider: string, accountId: string): string {
   return `${getAuthRefreshIntentLockPath(provider, accountId)}.json`;
 }
-export interface OAuthRefreshIntent { version: 1; provider: string; accountId: string; generation: string; createdAt: number; flightId?: string; uncertain?: true }
+export interface OAuthRefreshIntent { version: 1; provider: string; accountId: string; generation: string; createdAt: number; flightId?: string; staleOwner?: true; uncertain?: true }
 function parseOAuthRefreshIntent(
   provider: string,
   accountId: string,
@@ -72,6 +72,7 @@ function parseOAuthRefreshIntent(
     || typeof value.generation !== "string"
     || typeof value.createdAt !== "number"
     || (value.flightId !== undefined && typeof value.flightId !== "string")
+    || (value.staleOwner !== undefined && value.staleOwner !== true)
   ) {
     return { version: 1, provider, accountId, generation: "", createdAt: 0, uncertain: true };
   }
@@ -107,6 +108,12 @@ export function writeOAuthRefreshIntent(provider: string, accountId: string, gen
   const intent: OAuthRefreshIntent = { version: 1, provider, accountId, generation, createdAt, ...(flightId ? { flightId } : {}) };
   atomicWriteFile(getAuthRefreshIntentPath(provider, accountId), `${JSON.stringify(intent)}\n`);
 }
+export function markOAuthRefreshIntentStaleOwner(provider: string, accountId: string, generation: string, flightId: string): boolean {
+  const current = readOAuthRefreshIntent(provider, accountId);
+  if (current?.uncertain || current?.generation !== generation || current.flightId !== flightId) return false;
+  atomicWriteFile(getAuthRefreshIntentPath(provider, accountId), `${JSON.stringify({ ...current, staleOwner: true })}\n`);
+  return true;
+}
 export function clearOAuthRefreshIntent(provider: string, accountId: string, generation: string): boolean {
   const current = readOAuthRefreshIntent(provider, accountId);
   if (!current || current.generation !== generation) return false;

src/server/lifecycle.ts

@@ -154,11 +154,11 @@ export async function drainAndShutdown(
   const s = server ?? _serverRef;
   draining = true;
   const deadline = Date.now() + timeoutMs;
-  while (activeTurns.size > 0 && Date.now() < deadline) {
+  while (admittedTurns.size > 0 && Date.now() < deadline) {
     await Bun.sleep(100);
   }
-  if (activeTurns.size > 0) {
-    console.warn(`⚠️  Aborting ${activeTurns.size} in-flight turn(s) after ${timeoutMs}ms deadline`);
+  if (admittedTurns.size > 0) {
+    console.warn(`⚠️  Aborting ${admittedTurns.size} in-flight turn(s) after ${timeoutMs}ms deadline`);
     abortAndReleaseAllTurns(new Error("server shutdown"));
   }
   // Debounced replay-state snapshot may still be pending; flush so the last completed turn's