@bitkyc08/opencodex 2.81.0 → 2.83.0

package/src/server/management/config-routes.ts

@@ -9,6 +9,7 @@ import { isAnthropicInstanceId } from "../../providers/anthropic-instance-id";
 import { captureConfigTopLevelRollback } from "../../config/rebase-provenance";
 import type { IntegrationClientId } from "../../integrations/registry";
 import { randomUUID } from "node:crypto";
+import { isDeepStrictEqual } from "node:util";
 import { readFileSync } from "node:fs";
 import type { CatalogModel } from "../../codex/catalog";
 import { catalogModelSlug, invalidateCodexModelsCache, nativeContextLimits, nativeModelRows, uniqueCatalogModelsForPublicList } from "../../codex/catalog";
@@ -182,6 +183,17 @@ interface ClientIntegrationSyncOutcome {
   readonly profileId?: number;
 }
 
+/** Only the Desktop write's own applied markers may change during a background projection. */
+function clientProjectionConfig(config: OcxConfig): OcxConfig {
+  const snapshot = structuredClone(config);
+  const profile = snapshot.claudeCode?.desktopProfile;
+  if (profile) {
+    delete profile.appliedFingerprint;
+    delete profile.appliedAt;
+  }
+  return snapshot;
+}
+
 /**
  * Re-inject native clients that are switched ON and every file integration whose
  * OpenCodex ownership record is the operator's durable opt-in.
@@ -205,17 +217,41 @@ export async function syncEnabledClientIntegrations(
   config: OcxConfig,
   deps: Pick<ManagementContext["deps"],
     "fetchAllModels" | "refreshOwnedCatalogIntegrations" | "writeDesktop3pConfig"> = {},
+  options: { unattended?: { isCurrent: () => boolean } } = {},
 ): Promise<ClientIntegrationSyncOutcome[]> {
   // A sibling instance passes its OWN port here; the Grok fence and the Desktop gateway profile
   // stay on the live owner's (`src/codex/sibling-start.ts`).
   if (port === undefined || siblingOfLivePort() !== null) return [];
-  const { claudeDesktopIntegrationEnabled, grokIntegrationEnabled } = await import("../../codex/desired-state");
+  const projectionConfig = options.unattended ? clientProjectionConfig(config) : undefined;
+  const { claudeDesktopIntegrationEnabled, grokIntegrationEnabled, localClientSyncAllowed } = await import("../../codex/desired-state");
   const out: ClientIntegrationSyncOutcome[] = [];
+  const unattended = options.unattended;
+  const admit = () => {
+    if (!unattended!.isCurrent()) return false;
+    const fresh = loadConfig();
+    return localClientSyncAllowed(fresh) && isDeepStrictEqual(clientProjectionConfig(fresh), projectionConfig);
+  };
+  const stale = () => unattended !== undefined && !admit();
+  if (stale()) return out;
+  const grok = unattended ? await import("../../grok/inject") : undefined;
 
-  if (grokIntegrationEnabled(config)) {
+  if (grokIntegrationEnabled(config) && (!grok || grok.grokManagedBlockPresent())) {
     try {
       const { syncGrokConfig } = await import("../../grok/sync");
-      const r = await syncGrokConfig(port, config, config.hostname ? { hostname: config.hostname } : {});
+      if (stale()) return out;
+      const grokDeps = grok ? {
+        fetchAllModels: deps.fetchAllModels ?? (await import("../management-api")).fetchAllModels,
+        injectGrokConfig: ((...args: Parameters<typeof grok.injectGrokConfig>) =>
+          admit() && grokIntegrationEnabled(loadConfig()) && grok.grokManagedBlockPresent()
+            ? grok.injectGrokConfig(...args)
+            : { ok: true, changed: false, message: "Grok refresh skipped" }),
+      } : undefined;
+      const r = unattended
+        ? await syncGrokConfig(port, config, {
+          ...config.hostname ? { hostname: config.hostname } : {},
+          refreshOnly: { admit },
+        }, grokDeps)
+        : await syncGrokConfig(port, config, config.hostname ? { hostname: config.hostname } : {}, grokDeps);
       out.push(r.ok
         ? { client: "grok", ok: true, changed: r.changed === true }
         : { client: "grok", ok: false, reason: r.message });
@@ -224,9 +260,11 @@ export async function syncEnabledClientIntegrations(
     }
   }
 
+  if (stale()) return out;
   const { observeClaudeDesktopMode, resolveClaudeDesktopMode } = await import("../../claude/desktop-first-party");
   // A first-party Desktop must never get a gateway profile written and selected by a sync.
-  if (claudeDesktopIntegrationEnabled(config) && resolveClaudeDesktopMode(config, observeClaudeDesktopMode(config)) !== "first-party") {
+  if (claudeDesktopIntegrationEnabled(config) && resolveClaudeDesktopMode(config, observeClaudeDesktopMode(config)) !== "first-party"
+    && (!unattended || !!config.claudeCode?.desktopProfile?.appliedFingerprint)) {
     try {
       const { writeDesktop3pConfig } = await import("../../claude/desktop-3p");
       const { desktopVisibleNativeSlugs, filterCatalogVisibleModels } = await import("../../codex/catalog");
@@ -240,12 +278,15 @@ export async function syncEnabledClientIntegrations(
         const latest = loadConfig();
         // Discovery awaited: the mode may have changed meanwhile. Re-resolve on the fresh read,
         // immediately before the writer, so a first-party switch during fetchAllModels still wins.
-        if (claudeDesktopIntegrationEnabled(latest) && resolveClaudeDesktopMode(latest, observeClaudeDesktopMode(latest)) !== "first-party") {
+        if (stale()) return;
+        if (claudeDesktopIntegrationEnabled(latest) && resolveClaudeDesktopMode(latest, observeClaudeDesktopMode(latest)) !== "first-party"
+          && (!unattended || !!latest.claudeCode?.desktopProfile?.appliedFingerprint)) {
           const routed = filterCatalogVisibleModels(models, latest)
             .map(model => ({ provider: model.provider, id: model.id, contextWindow: model.contextWindow }));
           const writtenProfile = latest.claudeCode?.desktopProfile;
           const markerBaseline = captureDesktopAppliedMarker(writtenProfile);
-          const r = (deps.writeDesktop3pConfig ?? writeDesktop3pConfig)(
+          // Keep the attended writer's argument count unchanged, including its lock test seam.
+          const writeArgs: Parameters<typeof writeDesktop3pConfig> = [
             port,
             [...desktopVisibleNativeSlugs(latest)],
             routed,
@@ -253,7 +294,13 @@ export async function syncEnabledClientIntegrations(
             "static",
             writtenProfile,
             nativeContextLimits(latest),
-          );
+          ];
+          if (unattended) {
+            writeArgs[7] = undefined;
+            writeArgs[8] = { appliedFingerprint: writtenProfile!.appliedFingerprint!, admit };
+          }
+          const r = (deps.writeDesktop3pConfig ?? writeDesktop3pConfig)(...writeArgs);
+          if (unattended && r.reason === "desktop_refresh_only_skipped") return;
           if (!r.written || !r.fingerprint) {
             out.push({ client: "claude-desktop", ok: false, reason: r.reason ?? "Claude Desktop write failed" });
           } else {
@@ -271,6 +318,7 @@ export async function syncEnabledClientIntegrations(
     }
   }
 
+  if (stale()) return out;
   const { refreshOwnedCatalogIntegrations } = await import("../../integrations/catalog-refresh");
   const refreshOwned = deps.refreshOwnedCatalogIntegrations ?? refreshOwnedCatalogIntegrations;
   out.push(...await refreshOwned({
@@ -280,7 +328,10 @@ export async function syncEnabledClientIntegrations(
     },
     config,
     port,
-  }, ["mcode", "pi", "aside", "raycast", "omo", "cline", "commandcode", "droid", "opencode", "kilo"]));
+  }, unattended
+    ? ["mcode", "pi", "aside", "raycast", "omo", "commandcode", "droid", "opencode", "kilo"]
+    : ["mcode", "pi", "aside", "raycast", "omo", "cline", "commandcode", "droid", "opencode", "kilo"],
+  ...unattended ? [{ refreshOnly: true, admit }] as const : []));
 
   return out;
 }

package/src/server/management/context.ts

@@ -64,8 +64,8 @@ export interface ManagementApiDeps {
   refreshOwnedCatalogIntegrations?: typeof refreshOwnedCatalogIntegrations;
   /** Platform seam for capability projections; does not alter host-level startup behavior. */
   platform?: NodeJS.Platform;
-  toggleCodexMultiAgentV2?: (enabled: boolean) => void;
-  toggleDefaultModeRequestUserInput?: (enabled: boolean) => void;
+  toggleCodexMultiAgentV2?: (enabled: boolean, env: NodeJS.ProcessEnv, validateBeforeSpawn: () => void) => void;
+  toggleDefaultModeRequestUserInput?: (enabled: boolean, env: NodeJS.ProcessEnv, validateBeforeSpawn: () => void) => void;
   createManagementConvergeCodex?: (config: Readonly<OcxConfig>) => ConvergeCodex;
   /** Test-only destination for best-effort Claude agent-definition sync. */
   claudeAgentConfigDir?: string;

package/src/server/management/grok-coupon-routes.ts

@@ -11,6 +11,7 @@
 
 import { jsonResponse } from "../auth-cors";
 import type { ManagementContext } from "./context";
+import { ConfigMutationLockError } from "../../config/mutation-lock";
 import { isCodexResetCreditOperationId } from "../../codex/reset-credit-recovery";
 import { getValidAccessSnapshotForAccount } from "../../oauth";
 import { listAccounts, captureOAuthAccountSelection } from "../../oauth/store";
@@ -20,8 +21,12 @@ import {
   type GrokResetCoupon,
 } from "../../grok/reset-coupons";
 import {
+  getGrokResetCouponOperationAccountId,
+  markGrokResetCouponAttempt,
   openGrokResetCouponOperation,
   recordGrokResetCouponSettlement,
+  readGrokResetCouponTerminalReplay,
+  settleGrokResetCouponPreflightRefusal,
   type GrokResetCouponOperationRecord,
 } from "../../grok/reset-coupon-ledger";
 
@@ -41,6 +46,11 @@ export interface GrokConsumeCouponRequestBody {
   operationId?: string;
 }
 
+// A recent attempt can still be in flight. Older attempts may be inspected,
+// but a remaining token is not proof that the original request cannot land.
+const GROK_COUPON_ATTEMPT_STALE_MS = 90_000;
+const grokCouponInFlightAttempts = new Set<string>();
+
 function resolveTargetAccountId(requestedAccountId?: string): string {
   if (requestedAccountId && requestedAccountId.trim() !== "") {
     return requestedAccountId.trim();
@@ -130,6 +140,10 @@ export async function handleGrokCouponRoutes(ctx: ManagementContext): Promise<Re
 
     const { accountId: rawAccountId, tokenId: requestedTokenId, operationId } = body;
 
+    if (requestedTokenId !== undefined && (typeof requestedTokenId !== "string" || requestedTokenId.trim() === "")) {
+      return jsonResponse({ error: { code: "invalid_token_id", message: "tokenId must be a non-empty string" } }, 400, req, config);
+    }
+
     if (operationId !== undefined && !isCodexResetCreditOperationId(operationId)) {
       return jsonResponse(
         { error: { code: "invalid_operation_id", message: "operationId must be a valid UUIDv4" } },
@@ -139,9 +153,16 @@ export async function handleGrokCouponRoutes(ctx: ManagementContext): Promise<Re
       );
     }
 
+    let recordedAccountId: string | undefined;
+    if (rawAccountId === undefined && operationId !== undefined) {
+      try { recordedAccountId = getGrokResetCouponOperationAccountId(operationId); }
+      catch {
+        return jsonResponse({ error: { code: "ledger_unavailable", message: "Coupon ledger could not be read or locked; no redemption was attempted" } }, 503, req, config);
+      }
+    }
     let accountId: string;
     try {
-      accountId = resolveTargetAccountId(rawAccountId);
+      accountId = resolveTargetAccountId(rawAccountId ?? recordedAccountId);
     } catch (err) {
       return jsonResponse(
         { error: { code: "no_account", message: err instanceof Error ? err.message : String(err) } },
@@ -165,26 +186,106 @@ export async function handleGrokCouponRoutes(ctx: ManagementContext): Promise<Re
 
     // Journaling and Idempotency settlement check
     const effectiveOpId = operationId ?? crypto.randomUUID();
-    const opRecord = openGrokResetCouponOperation({
-      accountId,
-      tokenId: requestedTokenId,
-      operationId: effectiveOpId,
-    });
+    if (grokCouponInFlightAttempts.has(effectiveOpId)) return jsonResponse({ error: {
+      code: "attempt_in_progress", message: "This operation still has an active request; retry later",
+    } }, 409, req, config);
+    let opRecord: GrokResetCouponOperationRecord;
+    try {
+      opRecord = openGrokResetCouponOperation({ accountId, tokenId: requestedTokenId, operationId: effectiveOpId });
+    } catch {
+      return jsonResponse({ error: { code: "ledger_unavailable", message: "Coupon ledger could not be read or locked; no redemption was attempted" } }, 503, req, config);
+    }
+
+    let resolvedTokenId = requestedTokenId ?? opRecord.tokenId;
+    let resolvedTokenValidityEnd: number | undefined;
 
     if (opRecord.kind === "replay") {
-      return jsonResponse(
-        {
-          code: opRecord.code,
-          replayed: true,
-          tokenId: opRecord.tokenId,
-          settledAt: opRecord.settledAt,
-        },
-        200,
-        req,
-        config,
-      );
+      if (opRecord.code !== undefined) {
+        return jsonResponse(
+          {
+            code: opRecord.code,
+            replayed: true,
+            tokenId: opRecord.tokenId,
+            settledAt: opRecord.settledAt,
+          },
+          200,
+          req,
+          config,
+        );
+      }
+      if (opRecord.tokenId === undefined) {
+        // Legacy opens may already have dispatched without recording a token.
+        return jsonResponse({ operationId: effectiveOpId, error: {
+          code: "attempt_unresolved", message: "The prior operation has no recorded token; preserve this operationId and do not create a replacement attempt",
+        } }, 409, req, config);
+      }
+      // "attempted" with no recorded outcome: the spend call fired (or the
+      // process died right after the mark) but nothing was settled. Never
+      // replay this as a success — reconcile against upstream instead. A
+      // Remaining-token availability cannot identify the original request's
+      // outcome, and a listed token cannot rule out delayed completion.
+      if (requestedTokenId !== undefined && requestedTokenId !== opRecord.tokenId) {
+        // The retry names a different coupon than the one marked: spending
+        // either of them would surprise the caller — refuse and let them
+        // retry with the recorded token and preserve the operationId.
+        return jsonResponse(
+          {
+            error: {
+              code: "operation_token_mismatch",
+              message: "Operation was attempted with a different coupon; preserve the operationId and retry with the recorded tokenId",
+            },
+          },
+          409,
+          req,
+          config,
+        );
+      }
+      if (
+        opRecord.attemptedAt === undefined ||
+        Date.now() - opRecord.attemptedAt < GROK_COUPON_ATTEMPT_STALE_MS
+      ) {
+        // A fresh attempt may still be in flight in the original request —
+        // no additional upstream inspection is needed until that window ends.
+        // Older attempts are inspected without another redemption.
+        return jsonResponse(
+          { operationId: effectiveOpId,
+            error: {
+              code: "attempt_in_progress",
+              message: "A redemption attempt for this operation is recent and may still be running; retry later",
+            },
+          },
+          409,
+          req,
+          config,
+        );
+      }
+      let remainingTokens: GrokResetCoupon[];
+      try {
+        const remaining = await getGrokRemainingResets({ accessToken: tokenSnapshot.accessToken });
+        remainingTokens = remaining.tokens;
+      } catch (err) {
+        return jsonResponse(
+          { operationId: effectiveOpId, error: { code: "attempt_reconcile_failed", message: err instanceof Error ? err.message : String(err) } },
+          502,
+          req,
+          config,
+        );
+      }
+      // Availability cannot identify which request consumed a coupon. Even a
+      // missing, still-valid token does not confirm this operation succeeded.
+      const listed = remainingTokens.some((t) => t.tokenId === opRecord.tokenId);
+      return jsonResponse({ operationId: effectiveOpId, error: {
+        code: "attempt_unresolved",
+        message: listed
+          ? "The prior redemption may still complete; its listed coupon will not be redeemed again"
+          : "The coupon is no longer listed, but this operation's outcome is unconfirmed; no redemption will be repeated",
+      } }, 409, req, config);
     }
 
+    if (opRecord.kind === "token-mismatch") return jsonResponse({ error: {
+      code: "operation_token_mismatch", message: "Operation ID was previously registered with a different coupon",
+    } }, 409, req, config);
+
     if (opRecord.kind === "identity-mismatch") {
       return jsonResponse(
         {
@@ -213,16 +314,48 @@ export async function handleGrokCouponRoutes(ctx: ManagementContext): Promise<Re
       );
     }
 
-    let resolvedTokenId = requestedTokenId;
-    if (!resolvedTokenId) {
+    const settlePreflightRefusal = (code: string, tokenId?: string): Response | null => {
+      try {
+        const result = settleGrokResetCouponPreflightRefusal({
+          operationId: effectiveOpId, accountId, tokenId, code,
+          status: "failed", expectedStatus: "open",
+        });
+        if (result.kind === "recorded") return null;
+        if (result.kind === "replay") return jsonResponse({
+          code: result.code, replayed: true, tokenId: result.tokenId, settledAt: result.settledAt,
+        }, 200, req, config);
+        return jsonResponse({ error: {
+          code: "operation_state_changed",
+          message: "Another request changed this operation during inspection; retry the same operationId to read its durable state",
+        } }, 409, req, config);
+      } catch {
+        return jsonResponse({ error: {
+          code: "ledger_unavailable", message: "Coupon refusal could not be recorded; no redemption was attempted",
+        } }, 503, req, config);
+      }
+    };
+
+    {
+      // Always consult the upstream list: it resolves the token when the
+      // caller omits one, and — for an explicit tokenId — proves the coupon
+      // still exists. Captured validity remains journal metadata, never proof
+      // that this operation succeeded during a later reconciliation.
+      let tokens: GrokResetCoupon[];
       try {
         const remaining = await getGrokRemainingResets({ accessToken: tokenSnapshot.accessToken });
-        if (!remaining.tokens || remaining.tokens.length === 0) {
-          recordGrokResetCouponSettlement({
-            operationId: effectiveOpId,
-            code: "no_coupons_available",
-            status: "failed",
-          });
+        tokens = remaining.tokens ?? [];
+      } catch (err) {
+        return jsonResponse(
+          { error: { code: "fetch_resets_failed", message: err instanceof Error ? err.message : String(err) } },
+          502,
+          req,
+          config,
+        );
+      }
+      if (!resolvedTokenId) {
+        if (tokens.length === 0) {
+          const changed = settlePreflightRefusal("no_coupons_available");
+          if (changed) return changed;
           return jsonResponse(
             { error: { code: "no_coupons_available", message: "No reset coupons available to redeem" } },
             400,
@@ -230,29 +363,131 @@ export async function handleGrokCouponRoutes(ctx: ManagementContext): Promise<Re
             config,
           );
         }
-        resolvedTokenId = remaining.tokens[0].tokenId;
-      } catch (err) {
+        resolvedTokenId = tokens[0].tokenId;
+      }
+      const match = tokens.find((t) => t.tokenId === resolvedTokenId);
+      if (!match) {
+        // The requested coupon is already consumed or expired upstream —
+        // redeeming it would only surface an upstream error.
+        const changed = settlePreflightRefusal("coupon_unavailable", resolvedTokenId);
+        if (changed) return changed;
         return jsonResponse(
-          { error: { code: "fetch_resets_failed", message: err instanceof Error ? err.message : String(err) } },
-          502,
+          {
+            error: {
+              code: "coupon_unavailable",
+              message: "The requested reset coupon is no longer available upstream",
+            },
+          },
+          409,
           req,
           config,
         );
       }
+      const parsedEnd = Date.parse(match.validityEnd);
+      if (!Number.isNaN(parsedEnd)) resolvedTokenValidityEnd = parsedEnd;
+    }
+
+    if (resolvedTokenId === undefined) {
+      // Unreachable: every path above either resolves a token or returns.
+      return jsonResponse(
+        { error: { code: "token_unresolved", message: "No reset coupon token could be resolved" } },
+        500,
+        req,
+        config,
+      );
+    }
+
+    if (grokCouponInFlightAttempts.has(effectiveOpId)) {
+      // The original request holding this operation is still running in this
+      // process — its upstream spend has not concluded, so nothing may spend
+      // on this operationId again regardless of how stale the mark looks.
+      return jsonResponse(
+        {
+          error: {
+            code: "attempt_in_progress",
+            message: "A redemption attempt for this operation is still running; retry later",
+          },
+        },
+        409,
+        req,
+        config,
+      );
     }
 
+    grokCouponInFlightAttempts.add(effectiveOpId);
     try {
-      const redeemResult = await redeemGrokResetCoupon({
-        accessToken: tokenSnapshot.accessToken,
-        tokenId: resolvedTokenId,
-      });
+      // Record the attempt BEFORE the spend call: a crash between redemption
+      // and settlement must still leave the operation non-open so a retry can
+      // never execute it again. The atomic claim admits exactly one contender;
+      // a failed mark write aborts here while nothing has been spent.
+      try {
+        const claimed = markGrokResetCouponAttempt(effectiveOpId, resolvedTokenId, undefined, undefined, resolvedTokenValidityEnd);
+        if (!claimed) {
+          // A concurrent request may already have reached a definitive outcome;
+          // replay it rather than holding the caller on a finished operation.
+          // A failed read proves nothing about the winner, so it stays uncertain:
+          // reporting a definitive error here would let the caller open a
+          // replacement operation while this one may already have spent.
+          let winner: ReturnType<typeof readGrokResetCouponTerminalReplay> = null;
+          try { winner = readGrokResetCouponTerminalReplay(effectiveOpId, accountId, resolvedTokenId); } catch { winner = null; }
+          if (winner) return jsonResponse({
+            code: winner.code, replayed: true, tokenId: winner.tokenId, settledAt: winner.settledAt,
+          }, 200, req, config);
+          return jsonResponse({ error: {
+            code: "attempt_in_progress", message: "Another request already claimed this operation; no redemption was attempted",
+          } }, 409, req, config);
+        }
+      } catch (err) {
+        return jsonResponse(
+          { error: { code: "attempt_mark_failed", message: err instanceof Error ? err.message : String(err) } },
+          500,
+          req,
+          config,
+        );
+      }
 
-      recordGrokResetCouponSettlement({
-        operationId: effectiveOpId,
-        tokenId: resolvedTokenId,
-        code: "redeemed",
-        status: "success",
-      });
+      try {
+        await redeemGrokResetCoupon({
+          accessToken: tokenSnapshot.accessToken,
+          tokenId: resolvedTokenId,
+        });
+      } catch (err) {
+        // A transport error cannot prove that the irreversible request failed.
+        // Keep "attempted" so a later retry can inspect without dispatching again.
+        return jsonResponse(
+          { operationId: effectiveOpId, accountId, tokenId: resolvedTokenId, error: {
+            code: "attempt_unresolved",
+            message: "Redemption delivery is unconfirmed; reuse this operationId to inspect its state and do not create a replacement attempt",
+          } },
+          502,
+          req,
+          config,
+        );
+      }
+
+      // A confirmed redemption remains successful even when settlement fails.
+      // The existing claim protects retries if settlement does not land.
+      let settlementRecorded = false;
+      for (let attempt = 0; attempt < 5; attempt += 1) {
+        try {
+          settlementRecorded = recordGrokResetCouponSettlement({
+            operationId: effectiveOpId,
+            accountId,
+            tokenId: resolvedTokenId,
+            code: "redeemed",
+            status: "success",
+            expectedStatus: "attempted",
+          });
+          break;
+        } catch (error) {
+          // Retry only transient acquisition contention, never an unsafe or
+          // unreadable ledger, a changed claim, or the upstream redemption.
+          const cause = error instanceof ConfigMutationLockError ? error.cause : undefined;
+          if (!cause || typeof cause !== "object" || !("code" in cause)
+            || cause.code !== "SQLITE_BUSY" || attempt === 4) break;
+          await Bun.sleep(20);
+        }
+      }
 
       return jsonResponse(
         {
@@ -262,24 +497,14 @@ export async function handleGrokCouponRoutes(ctx: ManagementContext): Promise<Re
           tokenId: resolvedTokenId,
           accountId,
           operationId: effectiveOpId,
+          settlementRecorded,
         },
         200,
         req,
         config,
       );
-    } catch (err) {
-      recordGrokResetCouponSettlement({
-        operationId: effectiveOpId,
-        tokenId: resolvedTokenId,
-        code: "redeem_failed",
-        status: "failed",
-      });
-      return jsonResponse(
-        { error: { code: "redeem_failed", message: err instanceof Error ? err.message : String(err) } },
-        502,
-        req,
-        config,
-      );
+    } finally {
+      grokCouponInFlightAttempts.delete(effectiveOpId);
     }
   }