merge(dev): resolve isolate settle and ACL stub conflicts

Keep 750ms Windows Worker OS-join settle and non-Windows hammer skips for
Bun 1.3.14 isolate segfaults; take tip's scoped management-auth icacls fakes.

Author: Wibias

.github/workflows/ci.yml

@@ -47,20 +47,31 @@ concurrency:
 jobs:
   # Which Windows runner this run is allowed to use.
   #
-  # The self-hosted Windows box is a maintainer's PERSONAL machine on a home
-  # network, reachable over Tailscale. Anything that runs on it runs as a local
-  # user with that user's filesystem and LAN in reach, so the only question that
-  # matters is whether the commit is trusted BEFORE a runner ever sees it.
+  # READ THIS BEFORE TREATING IT AS A SECURITY BOUNDARY: it is not one.
   #
-  # `push` on dev/main/preview is trusted: reaching those branches requires the
-  # push permission, which only the maintainers in MAINTAINERS.md hold.
-  # `pull_request` is NOT trusted, and no author check can make it so — the
-  # workflow file itself comes from the PR head, so any `if:` guard written here
-  # is deleted by the same patch it is meant to stop. Fork PRs therefore stay on
-  # GitHub-hosted runners, unconditionally.
+  # On `pull_request` this workflow is loaded from the PR head, so the `case`
+  # below is owned by the proposed patch exactly like an `if:` guard would be.
+  # A hostile PR can delete the branch and hardcode the self-hosted labels into
+  # `$GITHUB_OUTPUT`, and `runs-on` will honour it. That this job runs on
+  # `ubuntu-latest` changes nothing — the untrusted part is its OUTPUT, not its
+  # host. `.github/workflows/ci.yml` is in this workflow's `pull_request.paths`,
+  # so such an edit triggers its own run.
   #
-  # `workflow_dispatch` is the maintainer escape hatch: dispatch requires write
-  # access, so a maintainer can deliberately aim a branch at the home box.
+  # What actually keeps untrusted code off a self-hosted runner lives OUTSIDE
+  # this file, where a PR cannot reach it: the fork-PR approval policy
+  # (`all_external_contributors`) and the judgement of whoever clicks approve.
+  # Runner groups would be the other lever, but they are an organisation
+  # feature and this repository is user-owned, so the approval policy is the
+  # only one available here. GitHub's own guidance is to avoid self-hosted
+  # runners on public repositories for this reason.
+  #
+  # So read the routing below as a COST control that keeps honest pull requests
+  # on GitHub-hosted runners, not as a guarantee about hostile ones.
+  #
+  # `push` on dev/main/preview requires the push permission, and
+  # `workflow_dispatch` requires write access, so both carry a trusted author.
+  # A trusted author is not audited code: merging a contributor PR into `dev`
+  # fires `push`, and its dependencies and postinstall hooks then run here.
   select-windows-runner:
     name: select windows runner
     runs-on: ubuntu-latest
@@ -85,10 +96,12 @@ jobs:
             push|workflow_dispatch) trusted=yes ;;
           esac
 
-          # Repository variable OCX_SELF_HOSTED_WINDOWS acts as a kill switch. When
-          # it is anything other than `1` — including unset, which is the state
-          # before the runner exists — every job falls back to windows-latest and
-          # CI keeps working with the box powered off.
+          # Repository variable OCX_SELF_HOSTED_WINDOWS is an OPERATIONAL switch,
+          # not a security control: a PR that rewrites this script ignores it for
+          # the same reason it ignores the event check above. Its job is to keep CI
+          # working when the box is off or busy. Anything other than `1` —
+          # including unset, the state before a runner exists — falls back to
+          # windows-latest.
           if [ "$trusted" = "yes" ] && [ "${USE_SELF_HOSTED:-}" = "1" ]; then
             echo 'runner=["self-hosted","Windows","X64","ocx-home"]' >> "$GITHUB_OUTPUT"
             echo 'label=self-hosted (ocx-home)' >> "$GITHUB_OUTPUT"

gui/src/client-resource.ts

@@ -40,6 +40,12 @@ type Store<T> = {
   /** Store-level visibilitychange handler, installed only while this store polls. */
   visibilityListener: (() => void) | null;
   generation: number;
+  /**
+   * Set when `setClientResourceData` publishes while nobody is subscribed (session-cache
+   * seed). The first subscribe must quiet-revalidate; otherwise mount never fetches and
+   * seeded rows stay indefinitely stale with `lastAttemptOk: true`.
+   */
+  seedNeedsRevalidate: boolean;
 };
 
 /**
@@ -80,6 +86,7 @@ function getStore<T>(key: string): Store<T> {
       inflightOwner: null,
       visibilityListener: null,
       generation: 0,
+      seedNeedsRevalidate: false,
     };
     stores.set(key, store);
   }
@@ -223,6 +230,8 @@ async function runFetch<T>(
   try {
     const data = await fetcher(controller.signal);
     if (gen !== store.generation || controller.signal.aborted) return;
+    // Cleared on settle (not at subscribe) so StrictMode's aborted first mount still revalidates.
+    store.seedNeedsRevalidate = false;
     store.snapshot = {
       data,
       error: undefined,
@@ -233,6 +242,7 @@ async function runFetch<T>(
     };
   } catch (error) {
     if (gen !== store.generation || controller.signal.aborted) return;
+    store.seedNeedsRevalidate = false;
     store.snapshot = {
       ...store.snapshot,
       // Normalize so a loader that rejects with `undefined` still reads as a failure.
@@ -298,9 +308,12 @@ function subscribeResource<T>(
   store.fetcherByListener.set(onStoreChange, fetcher);
   store.subscriberCount++;
 
-  // Cold start only — keep cached data across transient 0→1 resubscribe gaps.
-  if (store.subscriberCount === 1 && store.snapshot.data === undefined) {
-    void runFetch(store, fetcher, { replaceInflight: true, owner: onStoreChange });
+  // Cold start, or a pre-subscribe seed that still needs a network check. Keep
+  // cached data across transient 0→1 resubscribe gaps when neither applies.
+  if (store.subscriberCount === 1) {
+    if (store.snapshot.data === undefined || store.seedNeedsRevalidate) {
+      void runFetch(store, fetcher, { replaceInflight: true, owner: onStoreChange });
+    }
   }
   recomputePoll(store);
 
@@ -328,7 +341,7 @@ function subscribeResource<T>(
 }
 
 /** Module-level fetch cache with useSyncExternalStore subscriptions (no fetch in useEffect). */
-export interface ClientResourceOptions {
+export interface ClientResourceOptions<T = unknown> {
   pollMs?: number;
   enabled?: boolean;
   /**
@@ -337,18 +350,34 @@ export interface ClientResourceOptions {
    * happening off-screen — a restarting server, for instance.
    */
   pauseWhenHidden?: boolean;
+  /**
+   * Optional seed applied once before the first subscribe (session-cache revisit).
+   * Lives in the store — not a render-time ref — so React Compiler / react-hooks/refs
+   * stay quiet while the mount fetch still quiet-revalidates via `seedNeedsRevalidate`.
+   */
+  initialData?: T;
+}
+
+/** Seed an empty, unsubscribed store. No-ops when data already exists or someone is listening. */
+function seedClientResourceIfEmpty<T>(key: string, data: T): void {
+  const store = getStore<T>(key);
+  if (store.subscriberCount !== 0 || store.snapshot.data !== undefined) return;
+  setClientResourceData(key, data);
 }
 
 export function useClientResource<T>(
   key: string,
   fetcher: (signal: AbortSignal) => Promise<T>,
-  options?: ClientResourceOptions,
+  options?: ClientResourceOptions<T>,
 ): ResourceSnapshot<T> & { refresh: (opts?: { forceLoading?: boolean }) => void } {
   const enabled = options?.enabled !== false;
   const pollMs = options?.pollMs;
   // Default true: a background tab has nobody reading the paint. Opt out for polls that
   // must keep running while hidden, such as waiting for a restarted server to answer.
   const pauseWhenHidden = options?.pauseWhenHidden !== false;
+  if (enabled && options?.initialData !== undefined) {
+    seedClientResourceIfEmpty(key, options.initialData);
+  }
   const fetcherRef = useRef(fetcher);
   // Sync latest fetcher every commit. No dep array on purpose: inline fetchers are
   // reallocated every render; listing them would re-subscribe forever.
@@ -411,7 +440,7 @@ export function useKeyedClientResource<T>(
   key: string,
   deps: readonly unknown[],
   load: (signal: AbortSignal) => Promise<T>,
-  options?: ClientResourceOptions,
+  options?: ClientResourceOptions<T>,
 ): ResourceSnapshot<T> & { refresh: (opts?: { forceLoading?: boolean }) => void } {
   const resource = useClientResource(key, load, options);
   const prevDepsRef = useRef<readonly unknown[] | null>(null);
@@ -447,6 +476,9 @@ export function setClientResourceData<T>(key: string, data: T) {
     hasSucceeded: true,
     lastAttemptOk: true,
   };
+  // Only pre-subscribe seeds need a follow-up fetch. Live publishers (mutation
+  // results) already hold the fresh value and must not schedule a redundant GET.
+  store.seedNeedsRevalidate = store.subscriberCount === 0;
   emit(store);
 }
 

gui/src/components/CodexAccountPool.tsx

@@ -11,7 +11,6 @@ import CodexPoolStrategySetting from "./CodexPoolStrategySetting";
 import { useCodexAutoSwitch } from "../hooks/useCodexAutoSwitch";
 import { readJsonIfOk } from "../fetch-json";
 import { CodexAccountPoolCards, CodexAccountPoolReauthBanner } from "./codex-account-pool-cards";
-import { DataSurfaceStatus } from "./data-surface";
 import { CodexAccountSwitchModal } from "./codex-account-switch-modal";
 import { CodexAccountResetModal } from "./codex-account-reset-modal";
 import { CodexAccountPoolLoadStates, CodexAccountPoolMainCard, CodexAccountPoolPageHead } from "./codex-account-pool-main-card";
@@ -57,10 +56,6 @@ export default function CodexAccountPool({ apiBase, accountModeState = null, ban
   const ownController = useCodexAccountPool(apiBase, !injectedController);
   const controller = injectedController ?? ownController;
   const { accounts, activeId, loadState, switchingId, pauseUpdatingId, pausingExhausted, load } = controller;
-  // The controller owns the visible progress signal. A forced quota refresh keeps rows on screen
-  // and can take ~1s (longer when the server has to refill per-account quota), so without this the
-  // wait is invisible; `refreshingQuota` below stays local because it only guards its own button.
-  const { refreshing } = controller;
   const [confirm, setConfirm] = useState<CodexAccountEntry | null>(null);
   const [showAdd, setShowAdd] = useState(false);
   const [reauthId, setReauthId] = useState<string | null>(null);
@@ -277,12 +272,6 @@ export default function CodexAccountPool({ apiBase, accountModeState = null, ban
         onRetry={() => { void load(); }}
       />
 
-      {/* Revalidation over existing rows. The cold branch above already owns a live region, so
-          this only renders once rows are on screen, keeping one announcement per transition. */}
-      {refreshing && accounts.length > 0 && (
-        <DataSurfaceStatus live={loadState !== "error"}>{t("common.loading")}</DataSurfaceStatus>
-      )}
-
       {!(loadState === "loading" && accounts.length === 0) && (
         <>
           <CodexAccountPoolMainCard

gui/src/components/apikeys-workspace/ApiKeysWorkspace.tsx

@@ -39,6 +39,8 @@ export interface ApiKeysWorkspaceProps {
   copied: boolean;
   filteredModels: ExternalModelRow[];
   modelsLoading: boolean;
+  /** Quiet revalidation / retry over rows already on screen — not a skeleton. */
+  modelsRefreshing?: boolean;
   modelsLoadFailed: boolean;
   modelCount: number;
   hasModelData: boolean;
@@ -76,6 +78,7 @@ export default function ApiKeysWorkspace({
   copied,
   filteredModels,
   modelsLoading,
+  modelsRefreshing = false,
   modelsLoadFailed,
   modelCount,
   hasModelData,
@@ -420,6 +423,7 @@ export default function ApiKeysWorkspace({
                 <ApiKeysModelsPanel
                   filteredModels={filteredModels}
                   modelsLoading={modelsLoading}
+                  modelsRefreshing={modelsRefreshing}
                   modelsLoadFailed={modelsLoadFailed}
                   modelCount={modelCount}
                   hasModelData={hasModelData}

gui/src/components/section-tabs.tsx

@@ -8,8 +8,8 @@
  * The active tab follows the scroll position, so the strip reports where you are rather
  * than only where you last clicked.
  */
-import { useEffect, useRef, useState } from "react";
-import { sectionAnchorId, sectionAnchorPrefix } from "../section-anchors";
+import { useCallback, useEffect, useRef, useState } from "react";
+import { SECTION_TAB_SCROLL_LOCK_MS, sectionAnchorId, sectionAnchorPrefix } from "../section-anchors";
 
 export interface SectionTabItem {
   id: string;
@@ -28,7 +28,41 @@ export function SectionTabs({
   ariaLabel: string;
 }) {
   const [active, setActive] = useState(items[0]?.id ?? "");
-  const stripRef = useRef<HTMLDivElement | null>(null);
+  /** While set, scroll-spy ignores intermediate sections during smooth scroll-to-click. */
+  const scrollLockRef = useRef<string | null>(null);
+  const scrollLockTimerRef = useRef<ReturnType<typeof setTimeout> | null>(null);
+
+  const clearScrollLock = useCallback(() => {
+    scrollLockRef.current = null;
+    if (scrollLockTimerRef.current !== null) {
+      clearTimeout(scrollLockTimerRef.current);
+      scrollLockTimerRef.current = null;
+    }
+  }, []);
+
+  /** Timeout path: drop the click lock and re-read the visible section. */
+  const expireScrollLock = useCallback(() => {
+    clearScrollLock();
+    // If the user interrupted smooth scroll, the target may never cross the observer threshold —
+    // without a resync `active` would stay on the clicked tab while another section is on screen.
+    // Prefer the heading nearest the sticky-strip reading line (not only those with top <= 120),
+    // so a destination that stopped mid-viewport still wins over an off-screen prior heading.
+    let bestId: string | null = null;
+    let bestDistance = Number.POSITIVE_INFINITY;
+    const readingLine = 72;
+    for (const item of items) {
+      const node = document.getElementById(sectionAnchorId(scope, item.id));
+      if (!node) continue;
+      const distance = Math.abs(node.getBoundingClientRect().top - readingLine);
+      if (distance < bestDistance) {
+        bestDistance = distance;
+        bestId = item.id;
+      }
+    }
+    if (bestId) setActive(bestId);
+  }, [clearScrollLock, items, scope]);
+
+  useEffect(() => () => clearScrollLock(), [clearScrollLock]);
 
   // Follow the scroll position. `rootMargin` biases the observer toward the top of the
   // viewport so the heading you are reading wins, not whatever is technically centred.
@@ -41,6 +75,16 @@ export function SectionTabs({
 
     const observer = new IntersectionObserver(
       entries => {
+        const locked = scrollLockRef.current;
+        if (locked) {
+          const lockedNode = document.getElementById(sectionAnchorId(scope, locked));
+          const lockedVisible = entries.some(entry => entry.isIntersecting && entry.target === lockedNode);
+          if (lockedVisible) {
+            clearScrollLock();
+            setActive(locked);
+          }
+          return;
+        }
         const visible = entries
           .filter(entry => entry.isIntersecting)
           .sort((a, b) => a.boundingClientRect.top - b.boundingClientRect.top)[0];
@@ -52,19 +96,21 @@ export function SectionTabs({
     );
     for (const node of nodes) observer.observe(node);
     return () => observer.disconnect();
-  }, [items, scope]);
+  }, [clearScrollLock, items, scope]);
 
   const go = (id: string) => {
     const target = document.getElementById(sectionAnchorId(scope, id));
     if (!target) return;
+    scrollLockRef.current = id;
+    if (scrollLockTimerRef.current !== null) clearTimeout(scrollLockTimerRef.current);
+    scrollLockTimerRef.current = setTimeout(expireScrollLock, SECTION_TAB_SCROLL_LOCK_MS);
     setActive(id);
     // `scroll-margin-top` on the target keeps the heading clear of the pinned strip.
     target.scrollIntoView({ behavior: "smooth", block: "start" });
   };
 
   return (
     <div
-      ref={stripRef}
       className="page-tabs section-tabs"
       role="tablist"
       aria-label={ariaLabel}

gui/src/components/storage-workspace/StorageWorkspace.tsx

@@ -169,18 +169,18 @@ export default function StorageWorkspace({ report, locale }: StorageWorkspacePro
           </div>
         ) : (
           <div className="stw-overview">
-            <div className="usage-cards">
-              <div className="stat">
-                <div className="muted">{t("storage.card.total")}</div>
-                <div className="stat-value">{formatBytes(report.total.bytes, locale)}</div>
+            <div className="stw-summary">
+              <div className="stw-summary-card">
+                <div className="stw-summary-label">{t("storage.card.total")}</div>
+                <div className="stw-summary-value">{formatBytes(report.total.bytes, locale)}</div>
               </div>
-              <div className="stat">
-                <div className="muted">{t("storage.card.files")}</div>
-                <div className="stat-value">{report.total.fileCount.toLocaleString(locale)}</div>
+              <div className="stw-summary-card">
+                <div className="stw-summary-label">{t("storage.card.files")}</div>
+                <div className="stw-summary-value">{report.total.fileCount.toLocaleString(locale)}</div>
               </div>
-              <div className="stat">
-                <div className="muted">{t("storage.card.home")}</div>
-                <div className="stat-value mono stw-home-path" title={report.codexHome}>{report.codexHome}</div>
+              <div className="stw-summary-card">
+                <div className="stw-summary-label">{t("storage.card.home")}</div>
+                <div className="stw-summary-value mono stw-home-path" title={report.codexHome}>{report.codexHome}</div>
               </div>
             </div>
 

gui/src/data-surface.ts

@@ -43,6 +43,8 @@ export type DataSurfaceOptions<T> = {
   enabled?: boolean;
   /** Forwarded to the resource layer; see ClientResourceOptions.pauseWhenHidden. */
   pauseWhenHidden?: boolean;
+  /** Forwarded to the resource layer; see ClientResourceOptions.initialData. */
+  initialData?: T;
 };
 
 /**