fix(usage): reject pre-cancelled quota waits

[outlier27-cell]

Problem

Closes #733. A pre-cancelled waitForUsage() can expose an already-fulfilled credential or quota result, crossing the caller's cancellation boundary.

Value

Cancellation takes precedence over stale quota results while Pi retains ownership of the accepted credential-refresh operation.

Approach

Observe rejection of an already-accepted refresh promise before rejecting a pre-cancelled wait, then check signal.throwIfAborted() before registering the race. Existing in-flight cancellation and listener cleanup remain intact. Deterministic tests cover fulfilled/rejected promises, cancellation timing, error identity and unhandled rejection cleanup.

The original contributor history is preserved. Current main f98d6a4737461ba8d8ee100f113b5a7c3a0001a0 is integrated with a merge commit; the resulting PR scope remains two files.

Validation

Integrated head: cde62a1d13e2d3e99cf0df8f5b7746d203f8beb3 (original head 162109c6e1fb6918a8c31f6b442c97a3a045d04c). Node 26.8.1, Bun 1.3.14.

• bun install --frozen-lockfile: passed.
• node --test --experimental-strip-types tests/extensions/usage/providers.test.ts: 17 passed, 0 failed.
• Deterministic production-helper smoke: normal success and error identity preserved; pre-cancelled fulfilled result rejected; pre/in-flight cancellation retains original reason; zero leaked abort listeners or unhandled refresh rejections. No provider calls.
• bun run check: passed, exit 0.
• bun run test: passed, exit 0; Node 2463 total / 2454 passed / 9 skipped / 0 failed; UI 88 files / 1338 passed / 0 failed.
• git diff --check: passed.

These are source tests and direct helper execution. No installed-Pi, live provider/model, or manual UI acceptance is claimed; the user's installed OpenPI source remains a different checkout.

• Two independent final source reviews passed on this exact head. Current-head CI run 38694664766 passed all required checks, including Windows. Independent last-push approval remains required before merge.

Impact

• User-visible: cancelled quota waits reject instead of returning stale results.
• Model-visible context/tools: no schema changes.
• Runtime/lifecycle: pre-cancelled admission respects the caller's signal; accepted refresh work retains its existing owner.
• Persisted configuration/data: no changes or migration.
• Compatibility/risk: scoped two-file change; reversible code update with no new dependency or configuration.

[outlier27-cell]

@tt-a1i 请审核此 PR。#733 的最小取消边界修复已在 0cdac2c 完成，完整 exact-head GitHub CI（Node、Windows、UI、E2E）均通过；当前可合并，仅等待审核。

[outlier27-cell]

@testikun @tt-a1i 请审核此 PR。最新提交的 CI 已通过，当前仅等待维护者审核与合并。

[tt-a1i]

Exact reviewed head: 0cdac2c3b2e0d1bcf217390382011c9bb0206145.

Spec:

• [P2] Observe rejection of an already-started promise on pre-cancellation: Passing Promise.reject(new Error("quota failed")) with an already-aborted signal returns the cancellation reason, but still emits unhandledRejection for the accepted promise. Existing 13/13 tests passed and do not cover this branch. Preserve cancellation precedence while attaching a rejection observer to the already-started promise; add immediate and delayed rejection controls.

Verification: prior exact-head Standards and Spec evidence reused because this head is unchanged; current review/CI/integration metadata refreshed. No complete-suite rerun, installed-runtime/provider run, or visual acceptance performed in this update.

Maintainer fix follow-up

The requested rejection observation is implemented in 162109c6e1fb6918a8c31f6b442c97a3a045d04c, appended to the original contributor branch with a non-force push. Pre-cancellation preserves the exact cancellation reason while observing immediate and delayed rejections of the accepted input Promise; no Pi refresh ownership or abort listener is added. The regression fails on the original helper and passes after the fix. Independent Spec and Standards reviews have no open scoped findings.

Validation: focused 17/17 and bun run check passed. Local bun run test exited 1: 2,317 passed / 1 failed / 1 cancelled / 9 skipped, with UI not reached. The unchanged detached-workflow settlement and setup-lock recovery cases passed as isolated controls with the original owned files restored; load sensitivity remains an inference and the full-suite failure is retained. Exact-head remote CI is running.

The code finding is addressed; the current commit still requires exact-head CI and valid final-push approval before merge.

[tt-a1i]

Exact reviewed head: 162109c6e1fb6918a8c31f6b442c97a3a045d04c.

Spec:

The pre-cancelled wait now observes immediate and delayed input-Promise rejection while preserving cancellation reason precedence. The failure-first regressions pass, normal rejection remains observable, and no pre-cancel abort listener is installed.

Standards:

Pi retains ownership of credential refresh; this patch only observes an already-accepted promise and does not cancel or widen authority. Independent automated Spec and Standards reviews have no open findings on the frozen two-file patch.

Validation:

Focused 17/17 and bun run check passed. Current-head remote CI completed 18/18 SUCCESS, including Runtime, Windows, UI and Web E2E. Local full-test failure remains recorded: 2,317 passed / 1 failed / 1 cancelled / 9 skipped, UI not reached; the two unchanged timeout cases passed as isolated original-head controls. The remote result is separate evidence, not a rewrite of the local failure.

Merge gate:

I pushed the final fix, so branch protection still needs valid approval for the last push from another eligible maintainer. This source approval does not bypass that requirement or authorize a merge.