Rustfmt

src/proxy/shared_state.rs

@@ -238,6 +238,22 @@ impl ProxySharedState {
             .apply_config_from_source(source_generation, users, user_enabled)
     }
 
+    /// Serializes cold quota transitions without entering the relay hot path.
+    pub(crate) fn quota_mutation_gate(&self) -> Arc<tokio::sync::Mutex<()>> {
+        self.user_admission.quota_mutation_gate()
+    }
+
+    /// Reconciles the active source calendar under the process quota gate.
+    pub(crate) fn publish_quota_config(
+        &self,
+        source: u64,
+        config: &Arc<crate::config::ProxyConfig>,
+        accepted_after_mutation: bool,
+    ) {
+        self.user_admission
+            .publish_quota_config(source, config, accepted_after_mutation);
+    }
+
     /// Applies one persisted user mutation before asynchronous config reload.
     pub(crate) fn stage_user(
         &self,

src/proxy/user_admission.rs

@@ -121,6 +121,52 @@ impl UserAdmissionAuthority {
         })
     }
 
+    /// Requests source-evidence refresh only while a fresh account is fenced.
+    pub(crate) fn has_fresh_quota_schedules(&self) -> bool {
+        self.quota_store.has_fresh_schedules()
+    }
+
+    /// Shares the process quota gate with lifecycle publication callers.
+    pub(crate) fn quota_mutation_gate(&self) -> Arc<tokio::sync::Mutex<()>> {
+        self.quota_store.mutation_gate()
+    }
+
+    /// Publishes calendars only for credentials owned by the active config source.
+    /// The caller holds the process quota gate; disabled users retain their calendar.
+    pub(crate) fn publish_quota_config(
+        &self,
+        source: u64,
+        config: &Arc<crate::config::ProxyConfig>,
+        accepted_after_mutation: bool,
+    ) {
+        let state = self.state.lock();
+        if state.active_config_source != Some(source) {
+            return;
+        }
+        let now = crate::quota_state::now_epoch_secs();
+        for (user, secret) in &config.access.users {
+            let Some(credential) = credential_id_from_hex(secret) else {
+                continue;
+            };
+            let Some(record) = state.users.get(user) else {
+                continue;
+            };
+            if record
+                .effective()
+                .is_some_and(|effective| effective.credential_id == credential)
+            {
+                self.quota_store.request_schedule(
+                    user,
+                    record.incarnation,
+                    credential,
+                    config,
+                    now,
+                    accepted_after_mutation,
+                );
+            }
+        }
+    }
+
     /// Returns the mutation epoch used to reject stale candidate configuration.
     pub(crate) fn epoch(&self) -> u64 {
         self.state.lock().epoch