fix: serialize managed credential refresh with reads and secret edits

Co-Authored-By: Paperclip <noreply@paperclip.ing>

packages/adapters/codex-local/src/server/codex-auth-cache.test.ts

@@ -463,13 +463,15 @@ describe("codex auth cache store", () => {
         releaseFirstCaller = resolve;
       });
 
+      const entered = deferredSignal();
       const firstCall = withAccountHomeSecretMutationLock(env, "company-shared", async () => {
         events.push("first-enter");
+        entered.resolve();
         await firstCallerGate;
         events.push("first-exit");
         return "first";
       });
-      await new Promise((resolve) => setTimeout(resolve, 20));
+      await entered.promise;
       const secondCall = withAccountHomeSecretMutationLock(env, "company-shared", async () => {
         events.push("second-enter");
         events.push("second-exit");
@@ -497,12 +499,14 @@ describe("codex auth cache store", () => {
         releaseCompanyA = resolve;
       });
 
+      const entered = deferredSignal();
       const companyACall = withAccountHomeSecretMutationLock(env, "company-a", async () => {
         events.push("a-enter");
+        entered.resolve();
         await companyAGate;
         events.push("a-exit");
       });
-      await new Promise((resolve) => setTimeout(resolve, 20));
+      await entered.promise;
       const companyBCall = withAccountHomeSecretMutationLock(env, "company-b", async () => {
         events.push("b-enter");
         events.push("b-exit");
@@ -536,6 +540,28 @@ describe("codex auth cache store", () => {
 
       expect(events).toEqual(["promotion-enter", "mutation-enter", "mutation-exit", "promotion-exit"]);
     });
+    it("allows awaited nested writes but expires inherited ownership after release", async () => {
+      const env = envFor(await makeInstanceRoot());
+      const detachedGate = deferredSignal();
+      let detached!: Promise<void>;
+      let enteredDetached = false;
+      await withAccountHomeSecretMutationLock(env, "nested", async () => {
+        await expect(withAccountHomeSecretMutationLock(env, "nested", async () => "nested write")).resolves.toBe("nested write");
+        detached = detachedGate.promise.then(() => withAccountHomeSecretMutationLock(env, "nested", async () => { enteredDetached = true; }));
+      });
+      const holding = deferredSignal();
+      const release = deferredSignal();
+      const other = withAccountHomeSecretMutationLock(env, "nested", async () => { holding.resolve(); await release.promise; });
+      await holding.promise;
+      detachedGate.resolve();
+      try {
+        await new Promise(resolve => setTimeout(resolve, 30));
+        expect(enteredDetached).toBe(false);
+      } finally { release.resolve(); }
+      await Promise.all([other, detached]);
+      expect(enteredDetached).toBe(true);
+    });
+
   });
 
   describe("Phase 8: account-home directory validity before a secret write commits", () => {
@@ -581,3 +607,9 @@ describe("codex auth cache store", () => {
     });
   });
 });
+
+function deferredSignal() {
+  let resolve!: () => void;
+  const promise = new Promise<void>(done => { resolve = done; });
+  return { promise, resolve };
+}