fix: a quota save no longer fails a login renewal that already saved its token
A local login renewal could report failure after its new token was already saved. The renewal captures reset markers before the token exchange and checks them again when it records that the new token is valid. A quota poll completing in between (quota saves run in the background since 2.1.0) moved the quota marker, so recording the validation was refused and the renewal returned failed. What users saw: OpenCode 1 kept a 401 instead of resending, OpenCode 2 gave up its 401 retry, and Pi ended the stream with an error. The saved token was never lost, and nothing was disabled; the next request revalidated it.
Recording validation for a known account only replaces credential proof and never writes quota state, so it now checks only the refresh-error reset marker (a user's reset during the exchange still refuses it). First-identity publication keeps checking every marker, because it also discards metadata not yet confirmed to belong to the account. Exact credential, version and account-binding checks are unchanged.
Red-first: a Core regression holds the real quota writer and releases it inside the refresh provider; the same interleaving on OpenCode 1, OpenCode 2 and Pi now serves the saved successor with one exchange; a refresh-error reset still refuses. Mutation row known-validation-ignores-quota-only-marker-drift CAUGHT. The original Prime rotation test is unchanged.
Summary by cubic
A login renewal no longer reports failure after its new token was already saved. A quota poll completing during the exchange (quota saves run in the background since 2.1.0) moved a reset marker, so recording the validation was refused and the renewal returned failed — OpenCode 1 kept a 401 instead of resending, OpenCode 2 gave up its 401 retry, and Pi ended the stream with an error. The saved token was never lost.
What changed
- Known-account validation now checks only the refresh-error reset marker because it only replaces credential proof and never writes quota state.
- First-identity publication still checks every reset marker since it also discards metadata not yet confirmed to belong to the account.
- A refresh-error reset during the exchange still refuses validation; credential, version, and account-binding checks are unchanged.