Slot Budget + Config Store Atomic Writer fixes + Trusted Command

src/tls_front/fetcher.rs

@@ -172,6 +172,12 @@ fn sweep_expired_profile_cache(ttl: Duration, now: Instant) {
     profile_cache().retain(|_, value| now.saturating_duration_since(value.updated_at) <= ttl);
 }
 
+fn remove_profile_if_unchanged(key: &ProfileCacheKey, observed: ProfileCacheValue) {
+    profile_cache().remove_if(key, |_, current| {
+        current.profile == observed.profile && current.updated_at == observed.updated_at
+    });
+}
+
 /// Current number of adaptive TLS fetch profile-cache entries.
 pub(crate) fn profile_cache_entries_for_metrics() -> usize {
     profile_cache().len()
@@ -270,8 +276,9 @@ fn order_profiles(
     if let Some(cached) = profile_cache().get(key) {
         let age = now.saturating_duration_since(cached.updated_at);
         if age > strategy.profile_cache_ttl {
+            let observed = *cached;
             drop(cached);
-            profile_cache().remove(key);
+            remove_profile_if_unchanged(key, observed);
             return ordered;
         }
 

src/tls_front/fetcher/tests.rs

@@ -6,6 +6,7 @@ use super::{
     TLS_NAMED_GROUP_X25519MLKEM768, TlsFetchStrategy, X25519_KEY_SHARE_LEN, build_client_hello,
     build_tls_fetch_proxy_header, derive_behavior_profile, encode_tls13_certificate_message,
     fetch_via_rustls_stream, order_profiles, profile_alpn, profile_cache, profile_cache_key,
+    remove_profile_if_unchanged,
 };
 use crate::config::TlsFetchProfile;
 use crate::crypto::SecureRandom;
@@ -225,6 +226,31 @@ fn test_order_profiles_drops_expired_cached_winner() {
     assert!(profile_cache().get(&cache_key).is_none());
 }
 
+#[test]
+fn expired_profile_removal_preserves_concurrent_refresh() {
+    let cache_key = profile_cache_key("mask3.example", 443, "tls3.example", None, None, 0, None);
+    let observed = ProfileCacheValue {
+        profile: TlsFetchProfile::CompatTls12,
+        updated_at: Instant::now() - Duration::from_secs(60),
+    };
+    let refreshed = ProfileCacheValue {
+        profile: TlsFetchProfile::ModernChromeLike,
+        updated_at: Instant::now(),
+    };
+    profile_cache().insert(cache_key.clone(), observed);
+    profile_cache().insert(cache_key.clone(), refreshed);
+
+    remove_profile_if_unchanged(&cache_key, observed);
+
+    let current = profile_cache()
+        .get(&cache_key)
+        .expect("concurrent refresh must remain cached");
+    assert_eq!(current.profile, refreshed.profile);
+    assert_eq!(current.updated_at, refreshed.updated_at);
+    drop(current);
+    profile_cache().remove(&cache_key);
+}
+
 #[test]
 fn test_deterministic_client_hello_is_stable() {
     let rng = SecureRandom::new();