Folder grants close sibling permission cards whose id arrives late

Merged
AF
3d ago
+257-82

When the user allows a whole folder from one permission card, AFT settles the other open asks in that folder and withdraws their cards (#1068). The live-ask registry recorded a sibling ask only after its consent.request reply returned an elicitation id. A folder grant answered in the window between Cingulate creating the second card and AFT receiving its id missed that sibling, so its card stayed open on the phone and its call kept waiting. macOS CI caught the window: consent_folder_grant_settles_and_withdraws_covered_sibling saw only one recorded id.

  • Fix: an ask is now tracked before its request is sent, keyed by call key and session, and overlapping holds are counted. A covering grant that finds a sibling without an id records itself as pending on that entry. When the id arrives, record_elicitation takes the pending grant under the same lock and withdraws the card, so neither ordering misses it.
  • Tests: consent_folder_grant_withdraws_sibling_after_delayed_request_reply holds the sibling's request reply, answers the first card with allow-scope, then releases the reply. It checks that the sibling's call runs without a second answer and that its card is withdrawn exactly once. The existing test now waits for both ids before reading them.

Verified: subc::consent tests three times (138 each), the formatting check and the Windows target check.

Summary by cubic

Fixes a race where a folder grant could leave a sibling consent card open and its call waiting when the sibling's elicitation ID arrived after the grant.

Asks are now registered before consent.request is sent, keyed by call key and session, with overlapping holds counted. A covering grant that finds a sibling without an ID records itself as pending on that entry, and record_elicitation runs the deferred withdrawal under the same lock once the ID arrives, so neither ordering misses the sibling.

Tests

  • New test holds the sibling's request reply, answers the first card with allow-scope, then releases the reply; it checks the sibling's call completes without a second answer and its card is withdrawn exactly once.
  • The existing folder-grant test now waits for both persisted IDs before asserting.