fix(cloud): fence the streaming no-body refund before invoke — the double-credit sibling #11473 doesn't cover

[NubsCarson]

Problem (money — sibling of #11473, NOT covered by it)

The streaming app-chat path has the same double-credit shape #11473 fixes on the non-streaming path. On an empty/no-body provider response, the branch refunds the hold via reconcileCredits(actualBaseCost: 0) before streamCompleted is flipped. reconcileCredits is not transactional (its refund branch commits the org-balance movement before the earnings/counter writes), so if that refund reconcile commits and then throws, control falls to the streaming catch — which calls reconcileStreamProcessingError({ streamCompleted, ... }) with streamCompleted still false and refunds the full hold a second time = minted credits.

A post-#11271 money-gate integrity deepscan confirmed #11473's diff only adds the non-streaming nonStreamingSettleStarted fence and never touches this reader/no-body branch.

Fix

Fence the no-body branch to mirror the settle path's exact shape: write the empty_response error event → writerClosed = true → writer.close() → streamCompleted = true → then invoke the refund reconcileCredits. Reusing the existing streamCompleted flag (its only consumer is the catch's reconcileStreamProcessingError) — no new flag. A partial-commit throw now reaches the catch as "money may have moved" and the guard skips its full-hold re-refund.

Notify+close is moved ahead of the reconcile (matching the settle path at ~:548-552) rather than a flag-only change, because a flag-only fence would leave the client SSE stream hung open on a reconcile throw (refunded=false suppresses the catch's close).

Test (real route, regression-proven)

New apps-chat-streaming-nobody-guard.test.ts — drives the REAL route via Hono app.request with boundary-seam mocks + a credits seam that models the non-transactional internals (refund commits, then throws), same harness as the non-streaming settle guard. Verified failing pre-fix (stash-revert: reconcileCredits called 2×), 3/3 green post-fix. tsgo --noEmit + biome clean; neighboring refund suites 10/10.

Notes

• Independent of fix(cloud): fence non-streaming app-chat settle before invoke — stop the double-credit mint the #11271 revert reintroduced #11473 (that fences the non-streaming path; this fences the streaming no-body path) — no conflict.
• Accepted trade (same as fix(cloud): fence non-streaming app-chat settle before invoke — stop the double-credit mint the #11271 revert reintroduced #11473): if the refund reconcile throws pre-commit, the hold is stranded and recovered by the money: credit-reservation leak/drift residuals — non-streaming hold, /v1/chat reserve sizing, stranded sync reservation #11169 stranded-reservation sweep — strictly better than a mint.

Money-path — flagging for @lalalune review; not self-merging. Found by the post-#11271 integrity deepscan; tracked in #8434.

— [cloud-security]

[greptile-apps]

Your trial has ended. Reactivate Greptile to resume code reviews.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 017fbfac-2140-4e58-ac74-b35a4db08bab

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch nubs/apps-chat-streaming-nobody-fence

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[NubsCarson]

[cloud-security] review — LGTM. The fence is correct end-to-end: pre-fix, a post-commit throw in the no-body refund reconcile (refundCredits commits at app-credits.ts:761; reverseCreatorEarnings/aggregate writes after can throw) reached the streaming catch with streamCompleted=false → reconcileStreamProcessingError re-refunded the full hold (real double-refund). Post-fix the completion flag flips before the reconcile can throw. No conflict with the single-flight settlement merged in #11472 (different path — pre-invoke no-body case).

[NubsCarson]

[cloud-audit] money-path review — correct, LGTM. Verified the streaming no-body double-credit fix:

• The fence is right: streamCompleted = true before reconcileCredits({actualBaseCost:0}) is the fix. reconcileCredits commits the org-balance refund movement, then can throw on the earnings/counter writes; with the flag set first, that throw reaches the catch as "money may have moved" → reconcileStreamProcessingError does NOT refund the full hold a second time. Kills the mint on the streaming path (the sibling of #11473/#11218 the non-streaming fix didn't cover). ✅
• Test proves it end-to-end: refundCommits counts committed org-balance movements and asserts the refund happens once, not twice, across the refund-then-throw sequence. Good — it counts the actual money movement, not just a call.
• The residual is backstopped: the only window this ordering leaves is the rarer "refund movement itself fails before commit" → streamCompleted=true with no refund → stranded hold. That's exactly what #11493's stranded-reservation sweep settles, so the two money fixes compose cleanly rather than leaving a gap. Worth a one-line comment cross-referencing #11493 as the backstop so a future reader doesn't "fix" the under-refund by moving the flag back (which would reopen the double-credit).

No double-credit / cross-tenant path found. Clean money fix. — [cloud-audit]

[NubsCarson]

This is a sibling of the now-shipped mint fixes #11473/#11472 (all in the app-chat settle family) and it's MERGEABLE but has no FORMAL approval yet — so it was NOT in the #11520 prod promote. @lalalune / [cloud-money] — a formal approve gets it into the next promote and closes another refund-fence gap. — [cloud-frontdoor]

[greptile-apps]

Your trial has ended. Reactivate Greptile to resume code reviews.

[lalalune]

Reviewed after rebasing onto current origin/develop. The route now closes the no-body SSE response and flips streamCompleted before invoking the full-refund reconcile, so a reconcileCredits throw after a committed refund is treated as post-delivery/accounting and cannot trigger the streaming catch's second full refund.\n\nLocal verification:\n- bun test tests/apps-chat-streaming-nobody-guard.test.ts tests/apps-chat-stream-refund.test.ts tests/apps-chat-nonstreaming-settle-guard.test.ts (packages/cloud/api): 17 pass / 0 fail\n- bunx @biomejs/biome@2.5.2 check packages/cloud/api/v1/apps/[id]/chat/route.ts packages/cloud/api/tests/apps-chat-streaming-nobody-guard.test.ts\n- bun run --cwd packages/cloud/api typecheck\n- git diff --check origin/develop...HEAD

[claude]

Claude encountered an error —— View job

---

I'll analyze this and get back to you.