@bitkyc08/opencodex 2.79.0 → 2.81.0

package/src/server/gui-static.ts

@@ -20,12 +20,46 @@ const MIME_TYPES: Record<string, string> = {
  */
 const HASHED_ASSET_PATTERN = /-[a-zA-Z0-9_-]{8,}\.[a-zA-Z0-9]+$/;
 
-export function findGuiDist(): string | null {
+/** `productName` in desktop/src-tauri/tauri.conf.json; Linux packages install resources under `lib/<productName>`. */
+export const DESKTOP_PRODUCT_NAME = "OpenCodex";
+
+/**
+ * Where a compiled `ocx` looks for `gui/dist`, given the directory holding the executable.
+ *
+ * Beside the binary covers a release archive and the Windows desktop install. The desktop shell
+ * ships `ocx` as a sidecar and its resources where Tauri's `resource_dir` puts them: `../Resources`
+ * inside a macOS app bundle, `../lib/<productName>` for a Linux package (`/usr/bin`, `/usr/local/bin`,
+ * an AppImage's `usr/bin`). The shell passes that directory as OPENCODEX_GUI_DIST only to the sidecar
+ * it starts itself; `ocx ensure` from the Codex shim and the login service start the same binary
+ * without the variable, so they find the dashboard here.
+ */
+export function standaloneGuiDistCandidates(executableDir: string, platform: NodeJS.Platform = process.platform): string[] {
+  const candidates = [join(executableDir, "gui", "dist")];
+  if (platform === "darwin") candidates.push(join(executableDir, "..", "Resources", "gui", "dist"));
+  if (platform === "linux") candidates.push(join(executableDir, "..", "lib", DESKTOP_PRODUCT_NAME, "gui", "dist"));
+  return candidates;
+}
+
+/** Overrides for tests; production callers pass nothing and get this process's own layout. */
+export interface GuiDistLookup {
+  /** Directory holding a compiled `ocx`, or null when running from source. */
+  standaloneDir?: string | null;
+  platform?: NodeJS.Platform;
+  /** Directory of this module; a source checkout's `gui/dist` is resolved from it. */
+  moduleDir?: string;
+}
+
+/** Lookup only: checks for `index.html` and never creates, copies or builds anything. */
+export function findGuiDist(lookup: GuiDistLookup = {}): string | null {
+  const standaloneDir = lookup.standaloneDir === undefined
+    ? (isStandaloneBinary() ? standaloneRoot() : null)
+    : lookup.standaloneDir;
+  const moduleDir = lookup.moduleDir ?? import.meta.dir;
   const candidates = [
     process.env.OPENCODEX_GUI_DIST,
-    ...(isStandaloneBinary() ? [join(standaloneRoot(), "gui", "dist")] : []),
-    join(import.meta.dir, "..", "..", "gui", "dist"),
-    join(import.meta.dir, "..", "..", "..", "gui", "dist"),
+    ...(standaloneDir === null ? [] : standaloneGuiDistCandidates(standaloneDir, lookup.platform)),
+    join(moduleDir, "..", "..", "gui", "dist"),
+    join(moduleDir, "..", "..", "..", "gui", "dist"),
   ].filter((candidate): candidate is string => Boolean(candidate));
   for (const c of candidates) {
     if (existsSync(join(c, "index.html"))) return c;

package/src/server/index/spend-ledger-lifecycle.ts

@@ -6,6 +6,7 @@ import {
 import {
   configureSharedSpendLedger,
   spendPolicyFromConfig,
+  waitForSharedSpendReporterDrain,
 } from "../../lib/spend-reservation-ledger";
 import { warnIfSyncedStateDirectory } from "../../lib/synced-state-location";
 
@@ -26,7 +27,7 @@ export function waitForFailedStartRollback(error: unknown): Promise<void> {
 }
 
 export interface SpendLedgerServerLifecycle {
-  configure(spend: OcxSpendConfig | undefined): void;
+  configure(spend: OcxSpendConfig | undefined, poolAliases?: unknown, providerIds?: readonly string[]): void;
   track<T extends { stop(closeActiveConnections?: boolean): void | Promise<void> }>(server: T): T;
   release(): void;
   releaseAfterFailedStart(): Promise<void>;
@@ -49,13 +50,18 @@ export function acquireSpendLedgerServerLifecycle(configDir: string): SpendLedge
     owner.release();
   };
   return {
-    configure(spend): void {
-      configureSharedSpendLedger(spendPolicyFromConfig(spend));
+    configure(spend, poolAliases, providerIds): void {
+      configureSharedSpendLedger(spendPolicyFromConfig(spend, poolAliases, providerIds));
     },
     track<T extends { stop(closeActiveConnections?: boolean): void | Promise<void> }>(server: T): T {
       // Capture the raw stop before startServer replaces the public method with full teardown.
       const stop = server.stop.bind(server);
-      failedStartStops.push(() => stop(true));
+      const drainedStop = async (closeActiveConnections?: boolean): Promise<void> => {
+        await stop(closeActiveConnections);
+        await waitForSharedSpendReporterDrain();
+      };
+      Object.defineProperty(server, "stop", { configurable: true, value: drainedStop });
+      failedStartStops.push(() => drainedStop(true));
       return server;
     },
     release,

package/src/server/index.ts

@@ -302,7 +302,7 @@ function startServerWithSpendLedgerOwner(port: number | undefined, deps: StartSe
   configureAppOwnedMemoryBudget(resolveAppOwnedMemoryBudgetBytes(config.appOwnedMemoryBudgetMb));
   enforceAppOwnedMemoryBudget();
   // Observe-only mode still journals physical sends, so every server owns before configuring.
-  spendLedgerLifecycle.configure(config.spend);
+  spendLedgerLifecycle.configure(config.spend, config.spendPoolAliases, Object.keys(config.providers));
   // After ownership: a second server on the same home is refused above, so the process running
   // this line is the only one appending to usage.jsonl and the only one that may compact it.
   setUsageLedgerRetention(config.usageLedgerMaxBytes);
@@ -463,21 +463,19 @@ function startServerWithSpendLedgerOwner(port: number | undefined, deps: StartSe
     return serveGuiFile(rawPath) !== null;
   }
 
-  // Codex treats empty / non-JSON 503 bodies as "Unknown error" (#452). Keep Retry-After and
-  // the server_is_overloaded code so clients can back off, but always return a JSON envelope.
-  // These two run BEFORE the auth/origin checks, so they need the receiving listener's policy
-  // explicitly (#1102). Reaching for the shared `config` here would attach public-policy CORS
-  // headers to a 503 on the loopback listener — no model runs and no credential is spent, but
-  // it is the one error path that would answer a rebinding origin with its own origin echoed
-  // back.
+  // Codex maps 503 + server_is_overloaded to ServerOverloaded ("model at capacity"), retried
+  // only with retry advice that older clients ignore (#6642); server_restarting is a
+  // retryable UnexpectedStatus in every version and never reads as model capacity.
+  // Keep JSON (empty / non-JSON 503 means "Unknown error", #452) and Retry-After.
+  // Drain and busy run BEFORE auth/origin checks: use the receiving listener's policy
+  // (#1102), because shared public `config` could echo a rebinding origin on loopback.
   function drainingResponse(req: Request, policy: RequestPolicyView): Response {
-    const response = formatErrorResponse(503, "server_error", "Service shutting down");
-    const headers = new Headers(response.headers);
-    for (const [name, value] of Object.entries(corsHeaders(req, policy))) {
-      headers.set(name, value);
-    }
-    headers.set("Retry-After", "5");
-    return new Response(response.body, { status: 503, headers });
+    return withCors(new Response(JSON.stringify({
+      error: { type: "server_error", code: "server_restarting", message: "OpenCodex is restarting; retry this request." },
+    }), {
+      status: 503,
+      headers: { "Content-Type": "application/json", "Retry-After": "5" },
+    }), req, policy);
   }
 
   function serverBusyResponse(req: Request, resource: string, policy: RequestPolicyView): Response {
@@ -507,7 +505,9 @@ function startServerWithSpendLedgerOwner(port: number | undefined, deps: StartSe
     const lease = tryAdmitTurn(sessionLaneIdFromRequest(req.headers));
     if (!lease) return serverBusyResponse(req, "active turns", policy);
     // Root, lane, and the refusal that follows from them, all live in ./workflow-refusal.
-    const workflow = admitHttpWorkflowTurn(req.headers);
+    let workflow: ReturnType<typeof admitHttpWorkflowTurn>;
+    try { workflow = admitHttpWorkflowTurn(req.headers); }
+    catch (error) { lease.release(); throw error; }
     if (workflow && !workflow.admitted) {
       lease.release();
       // withCors, because without Access-Control-Allow-Origin the exposed refusal header is

package/src/server/inference/context.ts

@@ -34,7 +34,7 @@ export function createInferenceSendBudget(
 export function expandInferenceOAuthSendBudget(budget: TransientSendBudget | undefined, accounts: number): void {
   if (!budget) return;
   const policy = ingressPolicies.get(budget);
-  if (!policy || budget.used !== 0) return;
+  if (!policy || budget.used !== 0 || ("physicalStarted" in budget && Number(budget.physicalStarted) > 0)) return;
   ingressPolicies.delete(budget);
   if (accounts < 2 || !Number.isSafeInteger(accounts)) return;
   const sends = Math.min(accounts, GENERIC_OAUTH_MAX_ACCOUNTS_PER_REQUEST) * TRANSIENT_RETRY_MAX_ATTEMPTS;

package/src/server/lifecycle.ts

@@ -479,7 +479,7 @@ export async function drainAndShutdown(
   beginBackgroundShellShutdown();
   try {
     while (admittedTurns.size > 0 && Date.now() < deadline) {
-      await Bun.sleep(100);
+      await Bun.sleep(Math.min(100, Math.max(0, deadline - Date.now())));
     }
     if (admittedTurns.size > 0) {
       console.warn(`⚠️  Aborting ${admittedTurns.size} in-flight turn(s) after ${timeoutMs}ms deadline`);

package/src/server/management/agent-settings-routes.ts

@@ -8,6 +8,8 @@ import { catalogModelSlug, filterCatalogVisibleModels, invalidateCodexModelsCach
 import { mergeModelPinnedEfforts, modelPinnedEffortsConfigError } from "../../config/provider-validation";
 import { MULTI_AGENT_SURFACE_ADVISORY_VERSION, multiAgentSurfaceAdvisory, resolveMultiAgentMode } from "../../config/multi-agent-surface";
 import { captureConfigTopLevelRollback, parsedConfigRebaseDeletionKeys, projectConfigRebaseProvenance } from "../../config/rebase-provenance";
+import { anthropicSidecarPatchError } from "../../config/schema/anthropic-account-pool";
+import { isAnthropicInstanceId, type AnthropicInstanceId } from "../../providers/anthropic-instance-id";
 import {
   adoptPersistedClaudeCode,
   DEFAULT_SUBAGENT_MODELS,
@@ -71,9 +73,13 @@ import {
   webSearchCandidateRows,
   webSearchModelIsRejected,
   webSearchModelRejection,
+  sidecarAnthropicPoolOptions,
+  sidecarSettingsAfterPatch,
+  sidecarOptionsAuth,
   type WebSearchBackend,
 } from "./web-search-sidecar-options";
 import { drainAndShutdown } from "../lifecycle";
+import { inheritedAnthropicInstance } from "../../sidecar/auth";
 import { filterRequestLogs, getRequestLogEntries, type RequestLogEntry } from "../request-log";
 import { estimateComboCost, estimateRequestCost, normalizeCostTokens, tokensPerSecond } from "../../usage/cost";
 import type { PersistedUsageAttempt } from "../../usage/log";
@@ -1368,6 +1374,12 @@ export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise
     );
     const webSearchOverride = config.claudeCode?.webSearchSidecar;
     const visionOverride = config.claudeCode?.visionSidecar;
+    const helperParent = config.claudeCode?.model?.includes("/") ? config.claudeCode.model.split("/")[0] : undefined;
+    const helperVision = { ...config.visionSidecar, ...visionOverride };
+    // Same pool the runtime picks (vision/plan.ts preferredVisionBackend): explicit, else inherited
+    // from the Claude model's instance, so a usable inherited Pool 2 reports the Anthropic backend.
+    const helperVisionInstance = helperVision.anthropicInstance ?? inheritedAnthropicInstance(config, helperParent);
+    const helperVisionBackend = helperVision.backend ?? (sidecarOptionsAuth(config, helperVisionInstance).isAnthropicAuth ? "anthropic" : "openai");
     const { firstPartyDesired, readFirstPartyProxyStatus } = await import("../../claude/first-party-settings");
     const { observeClaudeDesktopMode } = await import("../../claude/desktop-first-party");
     const { claudeInterceptEnabled, getClaudeInterceptState } = await import("../../claude/intercept/runtime");
@@ -1411,11 +1423,15 @@ export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise
       autoCompactWindow: config.claudeCode?.autoCompactWindow ?? null,
       blockedSkills: config.claudeCode?.blockedSkills ?? null,
       injectAgents: config.claudeCode?.injectAgents !== false,
+      sidecarPools: {
+        webSearchSidecar: sidecarAnthropicPoolOptions(config, { ...config.webSearchSidecar, ...webSearchOverride }, helperParent),
+        visionSidecar: sidecarAnthropicPoolOptions(config, { ...helperVision, backend: helperVisionBackend }, helperParent),
+      },
       ...(webSearchOverride && Object.keys(webSearchOverride).length > 0
-        ? { webSearchSidecar: { backend: webSearchOverride.backend, model: webSearchOverride.model } }
+        ? { webSearchSidecar: { backend: webSearchOverride.backend, model: webSearchOverride.model, ...(webSearchOverride.anthropicInstance ? { anthropicInstance: webSearchOverride.anthropicInstance } : {}) } }
         : {}),
       ...(visionOverride && Object.keys(visionOverride).length > 0
-        ? { visionSidecar: { backend: visionOverride.backend, model: visionOverride.model } }
+        ? { visionSidecar: { backend: visionOverride.backend, model: visionOverride.model, ...(visionOverride.anthropicInstance ? { anthropicInstance: visionOverride.anthropicInstance } : {}) } }
         : {}),
       fastMode: config.fastMode,
       forceAvailable: [...visibleNativeSlugs(config), ...filterCatalogVisibleModels(models, config).map(catalogModelSlug)],
@@ -1563,6 +1579,8 @@ export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise
           ...(residual ? ["settings_residual"] : []),
         ] });
     }
+    const instanceError = anthropicSidecarPatchError(config, body, true);
+    if (instanceError) return jsonResponse({ error: instanceError }, 400);
     for (const field of ["webSearchSidecar", "visionSidecar"] as const) {
       const section = body[field];
       if (section === undefined || section === null) continue;
@@ -1587,7 +1605,9 @@ export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise
       // gates cannot drift.
       if (field === "visionSidecar" && typeof section.model === "string" && section.model !== "") {
         const requested = section.model;
-        const candidates = await visionCandidateRows(config);
+        const candidates = await visionCandidateRows({ ...config, visionSidecar: {
+          ...config.visionSidecar, ...sidecarSettingsAfterPatch(config.claudeCode?.visionSidecar, section),
+        } });
         const hint = section.backend === "anthropic" || section.backend === "openai"
           || section.backend === "routed"
           ? section.backend
@@ -1610,7 +1630,7 @@ export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise
       // module as /api/sidecar-settings — a gate on one route and a stale copy on
       // the other is no gate at all.
       if (field === "webSearchSidecar"
-        && (section.model !== undefined || section.backend !== undefined)) {
+        && (section.model !== undefined || section.backend !== undefined || section.anthropicInstance !== undefined)) {
         const stored = config.claudeCode?.webSearchSidecar;
         // Validate against the SUBMITTED backend across the whole union, not
         // just openai/anthropic (#2457). allowedBackends above already refused
@@ -1629,7 +1649,9 @@ export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise
           : typeof section.model === "string"
             ? section.model
             : stored?.model ?? config.webSearchSidecar?.model;
-        const candidates = await webSearchCandidateRows(config);
+        const candidates = await webSearchCandidateRows({ ...config, webSearchSidecar: {
+          ...config.webSearchSidecar, ...sidecarSettingsAfterPatch(config.claudeCode?.webSearchSidecar, section),
+        } });
         if (effectiveModel && webSearchModelIsRejected(effectiveBackend, effectiveModel, candidates)) {
           return jsonResponse(webSearchModelRejection(
             "webSearchSidecar.model",
@@ -1650,8 +1672,10 @@ export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise
       }
       // The per-field validation above guarantees vision only ever carries the two-member
       // union; the cast is the loop's shared-shape compromise, not a wider write path.
-      const requested = section as { backend?: "openai" | "anthropic" | "xai" | "gemini" | "exa" | null; model?: string };
+      const requested = section as { backend?: "openai" | "anthropic" | "xai" | "gemini" | "exa" | null; model?: string; anthropicInstance?: AnthropicInstanceId | null };
       const override = { ...next[field] } as NonNullable<OcxClaudeCodeConfig[typeof field]>;
+      if (requested.anthropicInstance === null) delete override.anthropicInstance;
+      else if (isAnthropicInstanceId(requested.anthropicInstance)) override.anthropicInstance = requested.anthropicInstance;
       if (requested.backend === null) delete override.backend;
       else if (requested.backend !== undefined) override.backend = requested.backend as never;
       if (requested.model === "") delete override.model;

package/src/server/management/anthropic-account-threshold.ts

@@ -1,7 +1,8 @@
+import { isAnthropicOAuthInstance, configuredAnthropicInstance } from "../../providers/anthropic-instance";
 import type { OcxConfig } from "../../types";
-import { effectiveAnthropicAccountThreshold, parseAnthropicAccountThreshold } from "../../oauth/anthropic-account-threshold";
+import { effectiveAnthropicAccountThresholdForInstance, parseAnthropicAccountThreshold } from "../../oauth/anthropic-account-threshold";
 import { OAUTH_PROVIDERS } from "../../oauth";
-import { setAnthropicAccountThreshold } from "../../oauth/store";
+import { setAnthropicAccountThresholdForInstance } from "../../oauth/store";
 import { jsonResponse } from "../auth-cors";
 import { readManagementJsonBodyOr } from "./body";
 
@@ -10,18 +11,20 @@ export async function handleAnthropicAccountThreshold(req: Request, config: OcxC
   const body = await readManagementJsonBodyOr(req, {});
   if (!body || typeof body !== "object" || Array.isArray(body)) return jsonResponse({ error: "body must be an object" }, 400);
   const fields = body as Record<string, unknown>;
-  const definition = OAUTH_PROVIDERS.anthropic;
-  const effectiveProvider = config.providers.anthropic
+  const provider = fields.provider;
+  if (typeof provider !== "string" || !isAnthropicOAuthInstance(provider)) return jsonResponse({ error: "account threshold requires Anthropic OAuth" }, 400);
+  const definition = OAUTH_PROVIDERS[provider];
+  const effectiveProvider = config.providers[provider]
     ?? definition?.resolveProviderConfig?.(config) ?? definition?.providerConfig;
-  if (fields.provider !== "anthropic" || effectiveProvider?.authMode !== "oauth") {
+  if (effectiveProvider?.authMode !== "oauth" || (provider === "anthropic2" && !configuredAnthropicInstance(config, provider))) {
     return jsonResponse({ error: "account threshold requires Anthropic OAuth" }, 400);
   }
   if (typeof fields.accountId !== "string" || !fields.accountId.trim()) return jsonResponse({ error: "missing accountId" }, 400);
   const threshold = parseAnthropicAccountThreshold(fields.threshold);
   if (fields.threshold !== null && threshold === null) return jsonResponse({ error: "threshold must be an integer 0-100 or null" }, 400);
-  if (!await setAnthropicAccountThreshold(fields.accountId, threshold)) return jsonResponse({ error: "account not found" }, 404);
-  return jsonResponse({ ok: true, provider: "anthropic", accountId: fields.accountId,
+  if (!await setAnthropicAccountThresholdForInstance(provider, fields.accountId, threshold)) return jsonResponse({ error: "account not found" }, 404);
+  return jsonResponse({ ok: true, provider, accountId: fields.accountId,
     autoSwitchThresholdOverride: threshold,
-    effectiveAutoSwitchThreshold: effectiveAnthropicAccountThreshold(config, { autoSwitchThresholdOverride: threshold ?? undefined }),
-    autoSwitchThreshold: effectiveAnthropicAccountThreshold(config) });
+    effectiveAutoSwitchThreshold: effectiveAnthropicAccountThresholdForInstance(provider, config, { autoSwitchThresholdOverride: threshold ?? undefined }),
+    autoSwitchThreshold: effectiveAnthropicAccountThresholdForInstance(provider, config) });
 }

package/src/server/management/anthropic-pool-settings.ts

@@ -0,0 +1,72 @@
+import type { OcxConfig } from "../../types";
+import type { AnthropicAccountPoolConfig } from "../../types/anthropic-account-pool";
+import { configuredAnthropicInstance, type AnthropicInstanceId } from "../../providers/anthropic-instance";
+import { rawAnthropicAccountPool, resolveAnthropicAccountPoolConfig } from "../../oauth/anthropic-pool-config";
+import { readConfigFileSnapshot, validateConfigCandidate } from "../../config/diagnostics";
+import { ConfigWritePublishedError } from "../../config/persist-unlocked";
+import { mutatePersistedConfig } from "../../config";
+import { reconcileLiveStateStores } from "../../lib/state-store-registrations";
+import { jsonResponse } from "../auth-cors";
+
+/** Required instance; never synthesizes a deleted B provider row. */
+export function writeAnthropicPoolSettings(config: OcxConfig, instance: AnthropicInstanceId, value: AnthropicAccountPoolConfig): void {
+  if (instance === "anthropic") config.anthropicAccountPool = value;
+  else {
+    const row = config.providers[instance];
+    if (!configuredAnthropicInstance(config, instance)) throw new Error("Anthropic pool instance is no longer configured");
+    row!.anthropicAccountPool = value;
+  }
+}
+
+/**
+ * Both Anthropic writers share publication-aware recovery from the atomic mutation owner.
+ * Recovery covers only the durable write. Once the file holds the new value, a stale live row
+ * or a failed reconcile is reported as saved with the fixed bookkeeping warning, never a 500.
+ */
+export function persistAnthropicPoolPatch(
+  config: OcxConfig,
+  instance: AnthropicInstanceId,
+  patch: (target: OcxConfig) => { changed: boolean; value: NonNullable<OcxConfig["anthropicAccountPool"]> },
+): { status: "saved"; warning?: "config_bookkeeping_failed" } | { status: "failed"; response: Response } {
+  const before = readConfigFileSnapshot();
+  const unknown = () => ({ status: "failed" as const, response: jsonResponse({
+    error: "Pool settings save state is unknown; reload settings before editing again",
+    code: "config_save_state_unknown",
+  }, 409) });
+  const publish = (value: AnthropicAccountPoolConfig, warned: boolean): { status: "saved"; warning?: "config_bookkeeping_failed" } => {
+    let warning = warned;
+    try { writeAnthropicPoolSettings(config, instance, value); } catch { warning = true; }
+    try { reconcileLiveStateStores(); } catch { warning = true; }
+    return warning ? { status: "saved", warning: "config_bookkeeping_failed" } : { status: "saved" };
+  };
+  let durable: AnthropicAccountPoolConfig | undefined;
+  try {
+    const saved = mutatePersistedConfig(target => {
+      if (instance === "anthropic2" && !configuredAnthropicInstance(target, instance)) {
+        throw new Error("Anthropic pool instance is no longer configured");
+      }
+      return patch(target);
+    });
+    if (saved.status === "unavailable") return unknown();
+    durable = saved.value;
+  } catch (error) {
+    const persisted = readConfigFileSnapshot();
+    if (persisted.diagnostics.source !== "file" || persisted.raw === undefined) return unknown();
+    // File reads may salvage hand edits; recovery success requires a strict, authoritative document.
+    let validated: ReturnType<typeof validateConfigCandidate>;
+    try { validated = validateConfigCandidate(JSON.parse(persisted.raw.replace(/^\uFEFF/, ""))); }
+    catch { return unknown(); }
+    if (!validated.ok) return unknown();
+    const current = validated.config;
+    if (instance === "anthropic2" && !configuredAnthropicInstance(current, instance)) return unknown();
+    let expected: AnthropicAccountPoolConfig;
+    try { expected = patch(structuredClone(current)).value; } catch { return unknown(); }
+    const matches = JSON.stringify(rawAnthropicAccountPool(current, instance)) === JSON.stringify(expected);
+    // A failed live write or reconcile must not turn confirmed publication back into a rollback.
+    if (matches) return publish(resolveAnthropicAccountPoolConfig(current, instance), true);
+    if (error instanceof ConfigWritePublishedError || persisted.raw !== before.raw) return unknown();
+    return { status: "failed", response: jsonResponse({ error: "Pool settings could not be saved" }, 500) };
+  }
+  if (durable === undefined) return unknown();
+  return publish(durable, false);
+}