fix(codex): fence concurrent quota updates

apps/aether-gateway/src/state/catalog.rs

@@ -662,6 +662,21 @@ impl AppState {
         Ok(updated)
     }
 
+    pub(crate) async fn compare_and_update_provider_catalog_key_admin_state(
+        &self,
+        update: &provider_catalog::ProviderCatalogKeyAdminCasUpdate,
+    ) -> Result<bool, GatewayError> {
+        let updated = self
+            .data
+            .compare_and_update_provider_catalog_key_admin_state(update)
+            .await
+            .map_err(|err| GatewayError::Internal(err.to_string()))?;
+        // A conflict means another instance changed credentials. Invalidate on
+        // both outcomes before the caller reloads or reports the conflict.
+        self.invalidate_provider_routing_caches();
+        Ok(updated)
+    }
+
     pub(crate) async fn update_provider_catalog_keys(
         &self,
         keys: &[provider_catalog::StoredProviderCatalogKey],

apps/aether-gateway/src/state/mod.rs

@@ -38,7 +38,10 @@ pub(crate) use self::cache::{
     PROVIDER_TRANSPORT_SNAPSHOT_CACHE_STALE_TTL, PROVIDER_TRANSPORT_SNAPSHOT_CACHE_TTL,
 };
 pub use self::cors::FrontdoorCorsConfig;
-pub(crate) use self::oauth::AgentIdentityAuthConfigFence;
+pub(crate) use self::oauth::{
+    provider_transport_context_allows_credential_rotation, AgentIdentityAuthConfigFence,
+    CodexRuntimeOAuthObservation, ProviderTransportCredentialFence,
+};
 pub(crate) use self::types::{
     AdminWalletMutationOutcome, GatewayAdminPaymentCallbackView, GatewayUserPreferenceView,
     GatewayUserSessionView, LocalExecutionRuntimeMissDiagnostic, LocalMutationOutcome,