Queue same-process credential writes so each gets its own lock window

[TheGreatAxios]

Summary

• Same-process auth-file writers queue per path so each call starts its own lock deadline instead of sharing one that began at invoke time
• Temp write paths include a per-call counter so two saves in one process never collide on path.pid.tmp
• Concurrent same-process profile saves and lock-window fairness are covered by tests alongside the existing cross-process suite

Verification

• bun test ./src/auth/store.test.ts — 7 pass
• Pre-commit typecheck and build pass on both commits
• Matches the tmpWriteCounter + updateChains pattern already used in src/mcp/auth-store.ts

Fixes CL-7318

[linear-code]

CL-7318

[TheGreatAxios]

Critic · Comment

Ports MCP tmpWriteCounter + per-file updateChains into createAuthStore so same-process writers no longer share one lock deadline or one path.pid.tmp.

Findings

No blocking defects.

Nits

• src/auth/store.test.ts:117 — queues same-process profile writes so neither save is lost stays green on main for N=2 (file lock alone serializes two saves inside LOCK_TIMEOUT_MS). It documents Done-when #3 but does not red without the queue. The lock-window test at :165 is the real red/green pin. Optional follow-up: a higher-concurrency same-process burst (e.g. 20+ profiles) would fail on main via cascaded timeouts and pass with the queue — reproduced locally: main kept 39/50 under a 50-way Promise.all, branch kept 50/50.
• src/auth/store.ts:58 — updateChains never evicts settled entries (same as MCP). Fine for the one-path-per-provider production shape; only matters if a long-lived process injects many distinct home values.

CL-7318 Done-when

1. Failing concurrency test then passes — met (gives queued same-process writes their own lock window; fails on main with both waiters timing out, passes on tip).
2. Both fixes ported — met (tmpWriteCounter at store.ts:53/127, updateChains + enqueueAuthFileOp at store.ts:58/170-188).
3. Two profiles concurrent save without loss — met (test at store.test.ts:117 + suite green).

bun test ./src/auth/store.test.ts — 7 pass.

[TheGreatAxios]

Critic · Approve

Nit-fix tip replaces the weak N=2 same-process save with a 50-way burst that pins shared-deadline loss, and clarifies queue / temp-counter / lock-window comments.

Findings

No blocking defects.

Notes

• Burst pin is real: prior local check kept 39/50 on main without the queue; tip keeps 50/50 (~19ms). Lock-window test remains the precise deadline-freshness pin.
• bun test ./src/auth/store.test.ts — 7 pass.

Ready to merge.