[berry-13]

Summary

Fixes the read-then-write races from the 2026-10-19 Devin performance scan that can lose or duplicate data. bulkWriteTransactions debited the balance before inserting the transaction records, so a failed insert charged the user with no ledger entry; it now writes the ledger first, the same order createTransaction already uses.

updateUserPlugins wrote back the caller's req.user snapshot, so concurrent install and uninstall requests overwrote each other; it now uses $addToSet/$pull and still invalidates the auth user cache. updatePluginAuth (find then save) is a single upsert, createMemory (find then create) is an insert-only upsert that raises the same "already exists" error, savePreset demotes every other default with one updateMany, and toggleUserMemories drops a redundant findById.

Type of change

• Bug fix

Testing

Tested environments/configuration: mongodb-memory-server.

Automated tests:

• transactions.spec.ts: a failed ledger insert never debits the balance.
• user.methods.spec.ts: concurrent installs from a stale snapshot all persist; uninstall removes only the target.
• New pluginAuth.spec.ts and preset.spec.ts; concurrent duplicate case in memory.spec.ts.
• data-schemas (4 suites, 151 tests), packages/api transactions/usage (5 suites, 225 tests), api recordCollectedUsage/PluginService specs: all pass.
• e2e/specs/mock/scenarios/atomic-writes.spec.ts (mock harness, desktop light/dark and mobile): concurrent installs all persist and uninstall removes only its tool, a re-saved tool credential keeps one record, a duplicate memory key returns 409 and keeps the original, the memory preference toggle round-trips, and only the last saved default preset stays default.
• eslint, prettier clean; tsc --noEmit in packages/data-schemas and packages/api clean.

Screenshots / recordings

No user-facing change.

Risk / compatibility

If the balance update fails after the ledger insert, usage is recorded without a charge, which is the safer direction. The plugin-auth and memory upserts are not backed by unique indexes, so two simultaneous first writes can still both insert in a narrow window; making those indexes unique needs a dedupe migration first. createMemory now stores agentId: null for personal-pool entries, matching setMemory; queries already match both. Prompt and tag cascades, the schedules MCP settlement cache, and unbounded memory/prompt list reads were left out on purpose (multi-collection transactions or product decisions).

Checklist

• I reviewed my own changes
• Relevant tests have been added or updated
• Existing relevant tests pass
• The change does not introduce new warnings or errors

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-26T22:19:19.724875Z	33143cb	New commits
🔒 Security Review	✅ Completed 2026-10-26T17:05:24.383792Z	c80f01b	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.