fix(quota): bound snapshot persistence under sustained updates - #763

Summary

The Codex and provider quota snapshot writers restart their 250 ms debounce timer on every update. With continuous observations arriving more often than that, disk persistence can be postponed indefinitely. The live in-memory value advances while restart recovery continues to see an old snapshot.

Preserve the 250 ms idle debounce and add a 1,000 ms maximum scheduled deferral from the first pending update, matching the existing quota reset ledger policy. Use the monotonic clock so wall-clock corrections cannot extend the window. The callback snapshots the latest accepted state; each completed, failed or cancelled write resets its timing state. Clearing one Codex account preserves the deadline for the remaining rows, and clearing all accounts cancels it.

The snapshot formats, ownership/identity checks, quota calculations, hydration expiry and atomic replacement behavior remain unchanged. The bound is on timer scheduling: event-loop delays and filesystem failures remain best-effort. This is a pre-existing persistence issue verified on the pinned Bun 1.4.3 test runtime and production Bun 1.4.4, not a new Bun 1.4.4 regression.

Add real-filesystem regressions under controlled timers for idle bursts, consecutive busy windows, latest provider row/Kiro-verdict callbacks, account removal, cancellation/home reset and recovery after a failed write. Add the focused quota-snapshot authority document and its manifest/index entries. Existing broad ownership documents are already at their size limits; no file-size limit was raised.

Verification

Base: fork dev at c4d4bb2da2162e23c314befafc5ec104292902a0. Linux x64; official Bun binaries. Repository tests used the normal preload/shared lock in the host PID namespace.

Real-clock reproduction

A separate probe runs the exported Codex quota writer in an isolated temporary home, first persists value 1, then sends 25 updates at 100 ms intervals. Both probes use the same script except for the imported baseline/fixed source module. Actual snapshot files are read during the run.

This confirms the issue outside fake timers on Bun 1.4.4. The committed regressions cover both writers and deterministically assert the latest disk contents across consecutive busy windows. Against unchanged source they produced 15 passes / 3 expected failures across two files.

Commands and results

The first, third and fourth commands use the pinned Bun 1.4.3 wrapper; the second directly uses official Bun 1.4.4.

For the scoped import-connected quota/Kiro selection, HTTP_PROXY, HTTPS_PROXY, ALL_PROXY and their lowercase variants were removed from the test environment; NO_PROXY remained intact. Production proxy policies and fixtures are unchanged.

The full repository suite was not rerun under the documented concurrent-worktree/resource exception. Validation covers the two writers, connected quota/Kiro paths, main-identity provenance, layout guards and static gates. Native Windows/macOS execution, live provider behavior and broader exact-head CI remain separate. No public setting, DTO or workflow changed; the internal persistence contract is documented in structure/quota-snapshots.md.

Independent review by a separate agent found no material issue. That review also probed a real 1 ms producer for 2.2 seconds against the staged provider writer: 1,995 observations on Bun 1.4.3 and 2,003 on Bun 1.4.4. The first snapshot was visible while updates continued at approximately 1,004 / 1,006 ms, and the final callback value was retained after the producer stopped. This checks minimum-cadence scheduling in addition to the 100 ms Codex probe; it does not turn the best-effort timer into a hard real-time guarantee. This is agent review, not maintainer approval or hosted bot review.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults. This adjusts write scheduling only; identity/account ownership checks, snapshot serialization, configured-home resolution and atomic writes remain with the existing owners. Privacy scan passed.

Co-authored-by: luvs01 27862058+luvs01@users.noreply.github.com

Summary by CodeRabbit

• Bug Fixes
  • Account quota snapshots now save after a short idle period, with a maximum one-second delay even when updates continue.
  • Clearing quotas or switching account homes cancels outdated pending saves, helping prevent stale data from being written.
  • A failed save no longer blocks later updates from being persisted.
• Tests
  • Added coverage for save timing, cancellation, home changes, and recovery after failed writes.