stage-345: 2-PR low-risk batch — stream-ownership guard against stale writebacks + Refresh-usage button on provider quota card

[nesquena-hermes]

stage-345 — small 2-PR contributor batch (v0.51.52)

Composition

Per Nathan's "no high-risk merges today" directive: only the 2 low-risk PRs ship this batch. The two higher-risk PRs were deferred to tomorrow with reasons captured.

PR	Author	LOC	Risk	Surface
#2136	LumenYoung	139	Low	api/streaming.py — stream-ownership guard against stale writebacks
#2150	Jordan-SkyLF	83	Trivial	static/panels.js — Refresh-usage button on provider quota card

What ships

#2136 — stale stream writeback guard

cancel_stream() clears active_stream_id early so the UI can accept a new turn while the old worker unwinds. The old worker could still return later from run_conversation() and persist its stale result over the newer transcript — observed corruption pattern on cancel+retry over compressed continuations. New helper:

def _stream_writeback_is_current(session, stream_id):
    return bool(stream_id) and getattr(session, 'active_stream_id', None) == stream_id

…short-circuits both finalize paths (success path in _run_agent_streaming, cancel path in cancel_stream()). 89-line regression suite in tests/test_stale_stream_writeback.py.

#2150 — Refresh usage button on provider quota card

Frontend-only. Calls /api/provider/quota?refresh=1&ts=<now> with cache: 'no-store' to bypass browser/SW/proxy caches. The refresh=1 query param is a no-op at the server today (no in-process cache layer in get_provider_quota()); the win is at the transport layer. Future maintainer follow-up may add server-side TTL caching, at which point the same param becomes load-bearing on both sides.

What's deferred to tomorrow

• perf(sessions): cache CLI session scans #2149 (456 LOC, perf: cache CLI session scans) — touches core session-loading path. Cache invalidation needs careful Opus review; not a same-day ship.
• fix: clarify cancelled chat turn status #2151 (599 LOC, fix: clarify cancelled chat turn status) — conflicts with fix: guard stale stream writebacks #2136 on api/streaming.py. Sequencing fix: guard stale stream writebacks #2136 → master → fix: clarify cancelled chat turn status #2151-rebase keeps both reviewable.
• Add external memory approval queue UI #1975 approved its first-time-contributor workflow run today; CI now actually executes. Still on hold,maintainer-review (1372 LOC is too large to land without explicit human eyes).
• feat: add per-chat RTL toggle button with keyboard shortcut #1721 screenshots posted yesterday were partial — commented requesting the missing 3 artifacts (mid-Arabic-or-Hebrew message, keyboard-shortcut indicator, mobile 390px). Don't @-tag Aron until all 4 land.

Opus advisor finding (deferred to follow-up)

Opus flagged two additional api/streaming.py writeback sites that should also call _stream_writeback_is_current() but are pre-existing (not introduced by #2136):

1. Outer except handler, line 3989 — materializes pending_user_message and appends _error_message without ownership check; if Worker A raises after rotation to Stream B, it stamps B's prompt with A's error.
2. Self-heal retry success path, line 3947 — persists _heal_result without ownership check.

Both pre-existing bug paths, medium severity, low probability. Filing a follow-up issue rather than expanding scope today.

Verification

• Full pytest: 5307 passed, 11 skipped, 1 xfailed, 2 xpassed in 95s (was 5306 before this stage — +1 net new test from fix: guard stale stream writebacks #2136 minus minor adjustments)
• run-browser-tests.sh: 20/20 QA + 11/11 API checks PASSED in 113s
• Live UI smoke test on port 8789 (fresh isolated env):
  • Server up, zero JS errors
  • _stream_writeback_is_current helper present in api/streaming.py (3 occurrences: def + 2 guard sites)
  • "Refresh usage" button live on quota card, enabled, correct label
  • Click flow verified: before → during (Refreshing…/disabled/aria-busy=true) → after (recovered cleanly)
  • Failure toast appears when refresh fails (expected in test env with no provider configured)
• python -m py_compile clean on all modified .py files
• node --check clean on static/panels.js
• Merge-conflict markers: zero in any modified file
• No file overlap between fix: guard stale stream writebacks #2136 and feat: add manual provider usage refresh #2150
• Opus advisor: "Ship both PRs" + 1 follow-up issue (above)

Stats

 11 files changed, 232 insertions(+), 8 deletions(-)

Closes

No linked issues in this batch. #2136 and #2150 both describe behavior they fix without Closes #N references.