@juspay/neurolink 12.32.1 → 12.32.3

package/dist/core/baseProvider.js

@@ -450,6 +450,21 @@ export class BaseProvider {
         const sourceIterator = source[Symbol.asyncIterator]();
         let activeStream = source;
         let activeIterator = sourceIterator;
+        // The StreamResult whose non-stream fields (model, provider, metadata,
+        // analytics, tool*) the caller should see. Starts as the first attempt
+        // and is reassigned to a fallback candidate's own result the moment that
+        // candidate actually commits real output (see the retry loop below) —
+        // never to a candidate that failed before producing anything. Read by
+        // the live getters built at the bottom of this function, so a caller
+        // that reads a field AFTER a fallback takes over sees the attempt that
+        // actually served the stream, not the abandoned one.
+        let activeResult = result;
+        // Some provider results expose getter-only properties. The forwarding
+        // result below must still be writable because NeuroLink's stream pipeline
+        // assigns final fields after constructing it. Keep assignment overrides
+        // scoped to the result that was active when the assignment happened, so a
+        // value written to a rejected attempt cannot shadow a later retry.
+        const assignedValues = new WeakMap();
         const iterableOf = (iterator) => ({
             [Symbol.asyncIterator]: () => iterator,
         });
@@ -526,7 +541,13 @@ export class BaseProvider {
                                 retryHeld.push(chunk);
                                 continue;
                             }
-                            retryCommitted = true;
+                            if (!retryCommitted) {
+                                retryCommitted = true;
+                                // This candidate is now the attempt serving the stream:
+                                // every metadata/analytics/tool field the caller reads must
+                                // resolve from here, never from the abandoned first attempt.
+                                activeResult = retry;
+                            }
                             while (retryHeld.length > 0) {
                                 yield retryHeld.shift();
                             }
@@ -567,14 +588,65 @@ export class BaseProvider {
             cancelStream(activeStream);
             releaseIterator(activeIterator);
         });
-        // A naked spread reads (and thereby snapshots) every enumerable getter
-        // on `result` — including a provider's lazily-populated `toolsUsed` /
-        // `toolExecutions` — before the consumer has pulled a single chunk.
-        // Re-applying the original accessor descriptors keeps those fields live.
-        return preserveLiveStreamAccessors(result, {
-            ...result,
+        // A naked spread would read (and thereby snapshot) every field on
+        // `result` immediately — before the generator above has even started —
+        // permanently freezing the first attempt's values. Define every declared
+        // StreamResult field instead of only the keys present on `result`: retry
+        // providers may expose optional fields the rejected attempt omitted.
+        const target = {
             stream: wrapped,
-        });
+        };
+        const resultKeys = [
+            "knowledge",
+            "agentModeVersion",
+            "provider",
+            "model",
+            "usage",
+            "finishReason",
+            "stopReason",
+            "rawFinishReason",
+            "toolCalls",
+            "toolResults",
+            "toolEvents",
+            "toolExecutions",
+            "toolsUsed",
+            "metadata",
+            "analytics",
+            "evaluation",
+            "events",
+            "workflow",
+            "transcription",
+            "audio",
+            "ttsMetadata",
+        ];
+        for (const key of resultKeys) {
+            Object.defineProperty(target, key, {
+                enumerable: true,
+                configurable: true,
+                get: () => {
+                    const assigned = assignedValues.get(activeResult);
+                    return assigned?.has(key) ? assigned.get(key) : activeResult[key];
+                },
+                set: (value) => {
+                    const descriptor = Object.getOwnPropertyDescriptor(activeResult, key);
+                    if (descriptor?.set) {
+                        descriptor.set.call(activeResult, value);
+                        return;
+                    }
+                    if (!descriptor || "value" in descriptor) {
+                        Reflect.set(activeResult, key, value);
+                        return;
+                    }
+                    let assigned = assignedValues.get(activeResult);
+                    if (!assigned) {
+                        assigned = new Map();
+                        assignedValues.set(activeResult, assigned);
+                    }
+                    assigned.set(key, value);
+                },
+            });
+        }
+        return target;
     }
     /**
      * The eager half of the retired-model stream fallback, for providers whose

package/dist/neurolink.js

@@ -83,7 +83,7 @@ import { hasLifecycleErrorFired, markLifecycleErrorFired, } from "./utils/lifecy
 import { interleaveTTSStream } from "./utils/ttsStream.js";
 import { resolveLifecycleTimeoutMs } from "./utils/lifecycleTimeout.js";
 import { cloneOptionsForCallIsolation } from "./utils/cloneOptions.js";
-import { pickLiveStreamDescriptors, preserveLiveStreamAccessors, } from "./utils/streamResultAccessors.js";
+import { preserveLiveStreamAccessors } from "./utils/streamResultAccessors.js";
 import { coerceJsonToSchema, recoverScalarRoot, schemaAccepts, } from "./utils/json/coerce.js";
 // Factory processing imports
 import { createCleanStreamOptions, enhanceTextGenerationOptions, processFactoryOptions, processStreamingFactoryOptions, validateFactoryConfig, } from "./utils/factoryProcessing.js";
@@ -7828,7 +7828,8 @@ Current user's request: ${currentInput}`;
             // bottom of this method, without ever reading — and thereby freezing —
             // a getter-based provider's value here.
             const mcpStreamOutcome = await this.createMCPStream(enhancedOptions);
-            const { stream: mcpStream, provider: providerName, usage: streamUsage, model: streamModel, finishReason: streamFinishReason, toolCalls: streamToolCalls, toolResults: streamToolResults, analytics: streamAnalytics, metadata: providerStreamMetadata, } = mcpStreamOutcome;
+            const { stream: mcpStream } = mcpStreamOutcome;
+            const providerName = mcpStreamOutcome.provider ?? "unknown";
             let streamedTTSResult;
             const { stream: incrementalStream, ttsMetadata: streamTtsMetadata } = await this.createIncrementalTTSStream({
                 stream: mcpStream,
@@ -7841,9 +7842,9 @@ Current user's request: ${currentInput}`;
             });
             ttsMetadataSink?.(streamTtsMetadata);
             const streamState = {
-                finishReason: streamFinishReason ?? "stop",
-                toolCalls: streamToolCalls,
-                toolResults: streamToolResults,
+                finishReason: mcpStreamOutcome.finishReason ?? "stop",
+                toolCalls: mcpStreamOutcome.toolCalls ?? [],
+                toolResults: mcpStreamOutcome.toolResults ?? [],
             };
             streamSpan.setAttribute(ATTR.NL_PROVIDER, providerName || "unknown");
             let accumulatedContent = "";
@@ -7926,7 +7927,7 @@ Current user's request: ${currentInput}`;
                     // not a provider failure, and retrying it on another provider
                     // spends that provider's tokens to exceed a budget the caller set.
                     const cappedByCallerBudget = enhancedOptions.fallbackOnMaxSteps === false &&
-                        providerStreamMetadata?.stopReason === "step-cap";
+                        mcpStreamOutcome.metadata?.stopReason === "step-cap";
                     if (realOutputChunks === 0 &&
                         !cappedByCallerBudget &&
                         !metadata.fallbackAttempted &&
@@ -7949,10 +7950,10 @@ Current user's request: ${currentInput}`;
                         yield* incrementalFallback;
                     }
                     ttsResolver?.(streamedTTSResult);
-                    resolvedUsage = streamUsage;
-                    if (!resolvedUsage && streamAnalytics) {
+                    resolvedUsage = mcpStreamOutcome.usage;
+                    if (!resolvedUsage && mcpStreamOutcome.analytics) {
                         try {
-                            const resolved = await Promise.resolve(streamAnalytics);
+                            const resolved = await Promise.resolve(mcpStreamOutcome.analytics);
                             if (resolved?.tokenUsage) {
                                 resolvedUsage = resolved.tokenUsage;
                             }
@@ -7961,11 +7962,16 @@ Current user's request: ${currentInput}`;
                             // non-blocking
                         }
                     }
+                    if (resolvedUsage) {
+                        mcpStreamOutcome.usage = resolvedUsage;
+                    }
                     self.emitter.emit("stream:complete", {
                         type: "stream:complete",
                         content: accumulatedContent,
                         provider: metadata.fallbackProvider ?? providerName,
-                        model: metadata.fallbackModel ?? streamModel ?? enhancedOptions.model,
+                        model: metadata.fallbackModel ??
+                            mcpStreamOutcome.model ??
+                            enhancedOptions.model,
                         finishReason: streamState.finishReason ?? "stop",
                         prompt: enhancedOptions.input?.text ||
                             enhancedOptions.prompt,
@@ -8047,7 +8053,7 @@ Current user's request: ${currentInput}`;
                         try {
                             const finalProvider = metadata.fallbackProvider ?? providerName ?? "unknown";
                             const finalModel = metadata.fallbackModel ??
-                                streamModel ??
+                                mcpStreamOutcome.model ??
                                 enhancedOptions.model ??
                                 "unknown";
                             const finalFinishReason = streamError
@@ -8139,7 +8145,7 @@ Current user's request: ${currentInput}`;
             streamResult.toolCalls = streamState.toolCalls;
             streamResult.toolResults = streamState.toolResults;
             if (!streamResult.usage) {
-                streamResult.usage = streamUsage;
+                streamResult.usage = mcpStreamOutcome.usage;
             }
             if (!streamResult.analytics) {
                 // CRITICAL: do NOT `await` a Promise-typed analytics here. Bedrock
@@ -8155,8 +8161,7 @@ Current user's request: ${currentInput}`;
                 // Promise<AnalyticsData>` — the cast widens the local
                 // `processStreamResult` return type which only declares the
                 // resolved shape.
-                streamResult.analytics =
-                    streamAnalytics;
+                streamResult.analytics = mcpStreamOutcome.analytics;
             }
             // The cost listener wants a resolved cost, but if the provider gave
             // us a Promise (Bedrock) we can't tax the stream's return path on it.
@@ -8183,8 +8188,7 @@ Current user's request: ${currentInput}`;
                 guardrailsBlocked: metadata.guardrailsBlocked,
                 error: metadata.error,
                 events: eventSequence,
-                providerMetadata: providerStreamMetadata,
-                toolTelemetrySource: mcpStreamOutcome,
+                sourceResult: mcpStreamOutcome,
             });
         }
         catch (error) {
@@ -8986,24 +8990,14 @@ Current user's request: ${currentInput}`;
                             throw streamConsumeErr;
                         }
                     })();
-                    // toolsUsed/toolExecutions are attached via defineProperties (not
-                    // listed as plain fields above) so a getter-based provider result
-                    // keeps resolving lazily through this boundary instead of being
-                    // read — and frozen — once, right here, before any chunk is drained.
-                    return Object.defineProperties({
+                    return preserveLiveStreamAccessors(poolStreamResult, {
+                        ...poolStreamResult,
                         stream: wrappedStream,
                         provider: poolStreamProviderName,
-                        usage: poolStreamResult.usage,
                         model: poolStreamResult.model || poolStreamModel,
-                        finishReason: poolStreamResult.finishReason,
                         toolCalls: poolStreamResult.toolCalls ?? [],
                         toolResults: poolStreamResult.toolResults ?? [],
-                        analytics: poolStreamResult.analytics,
-                        metadata: poolStreamResult.metadata,
-                    }, pickLiveStreamDescriptors(poolStreamResult, [
-                        "toolsUsed",
-                        "toolExecutions",
-                    ]));
+                    });
                 }
                 catch (poolStreamError) {
                     if (isAbortError(poolStreamError)) {
@@ -9048,26 +9042,17 @@ Current user's request: ${currentInput}`;
             provider: providerName,
             systemPromptPassedLength: enhancedSystemPrompt.length,
         });
-        // toolsUsed/toolExecutions are attached via defineProperties, not listed
-        // as plain fields: see the identical comment on the ModelPool branch
-        // above — a plain `toolsUsed: streamResult.toolsUsed` here would invoke
-        // and freeze a getter-based provider's value before any chunk is drained.
-        return Object.defineProperties({
-            stream: streamResult.stream,
+        // Preserve every live descriptor from the provider result. Internal model
+        // fallback can switch the descriptor's backing result only after iteration
+        // starts, so eagerly rebuilding selected fields here would re-freeze the
+        // rejected attempt before the caller drains a chunk.
+        return preserveLiveStreamAccessors(streamResult, {
+            ...streamResult,
             provider: providerName,
-            usage: streamResult.usage,
             model: streamResult.model || options.model,
-            finishReason: streamResult.finishReason,
             toolCalls: streamResult.toolCalls ?? [],
             toolResults: streamResult.toolResults ?? [],
-            analytics: streamResult.analytics,
-            // Pass the provider's metadata object THROUGH BY REFERENCE: native
-            // background-loop streams (Vertex Gemini/Claude) resolve
-            // finishReason/stopReason/rawFinishReason/stepsUsed onto it only when
-            // the loop finishes — snapshotting fields here would freeze them as
-            // undefined before the stream is drained.
-            metadata: streamResult.metadata,
-        }, pickLiveStreamDescriptors(streamResult, ["toolsUsed", "toolExecutions"]));
+        });
     }
     /**
      * Process stream result
@@ -9098,10 +9083,20 @@ Current user's request: ${currentInput}`;
      * Create stream response
      */
     createStreamResponse(streamResult, stream, config) {
-        return Object.defineProperties({
+        const source = config.sourceResult;
+        const responseMetadata = {
+            streamId: config.streamId,
+            startTime: config.startTime,
+            responseTime: config.responseTime,
+            fallback: config.fallback || false,
+            guardrailsBlocked: config.guardrailsBlocked,
+            error: config.error,
+        };
+        const response = {
+            ...(source ?? {}),
             stream,
-            provider: config.providerName,
-            model: config.options.model,
+            provider: source?.provider ?? config.providerName,
+            model: source?.model ?? config.options.model,
             usage: streamResult.usage,
             finishReason: streamResult.finishReason,
             toolCalls: streamResult.toolCalls,
@@ -9109,20 +9104,37 @@ Current user's request: ${currentInput}`;
             analytics: streamResult.analytics,
             evaluation: streamResult.evaluation,
             events: config.events && config.events.length > 0 ? config.events : undefined,
-            metadata: Object.assign(config.providerMetadata ?? {}, {
-                streamId: config.streamId,
-                startTime: config.startTime,
-                responseTime: config.responseTime,
-                fallback: config.fallback || false,
-                guardrailsBlocked: config.guardrailsBlocked,
-                error: config.error,
-            }),
-        }, config.toolTelemetrySource
-            ? pickLiveStreamDescriptors(config.toolTelemetrySource, [
-                "toolsUsed",
-                "toolExecutions",
-            ])
-            : {});
+            metadata: source ? undefined : Object.assign({}, responseMetadata),
+        };
+        if (!source) {
+            return response;
+        }
+        // NeuroLink grades the turn's terminal state itself (a normalized
+        // finishReason, stopReason for aborts and time limits), so those fields
+        // stay plain values here. Copying the provider's getter for them would
+        // report the raw vendor reason, e.g. Anthropic's end_turn, instead.
+        const gradedTerminalFields = new Set([
+            "finishReason",
+            "stopReason",
+            "rawFinishReason",
+        ]);
+        for (const key of Object.getOwnPropertyNames(source)) {
+            const descriptor = Object.getOwnPropertyDescriptor(source, key);
+            if (!gradedTerminalFields.has(key) &&
+                descriptor &&
+                typeof descriptor.get === "function") {
+                Object.defineProperty(response, key, descriptor);
+            }
+        }
+        Object.defineProperty(response, "metadata", {
+            enumerable: true,
+            configurable: true,
+            get: () => Object.assign(source.metadata ?? {}, responseMetadata),
+            set: (value) => {
+                source.metadata = value;
+            },
+        });
+        return response;
     }
     /**
      * Handle stream error with fallback

package/dist/providers/googleVertex/client.js

@@ -905,6 +905,12 @@ export class GoogleVertexProvider extends BaseProvider {
                 ...processedOptions,
                 tools: optionTools,
             };
+            // Captured up-front (mirrors generate()'s inputPrompt) so the
+            // failure branch below can label a `generation:end` it emits before
+            // any content exists.
+            const inputPrompt = mergedOptions.input?.text ||
+                mergedOptions.prompt ||
+                "";
             try {
                 // Route Claude models to native Anthropic SDK
                 let result;
@@ -937,6 +943,17 @@ export class GoogleVertexProvider extends BaseProvider {
             catch (error) {
                 this.fireGenerateOnError(options, error, streamStartTime);
                 this.emitStreamEnd(modelName, streamStartTime, false, error);
+                // Unlike Google AI Studio's native stream, Vertex's turn loop is
+                // awaited to completion INSIDE executeNativeGemini3Stream /
+                // executeNativeAnthropicStream before this method ever returns a
+                // StreamResult — a first-call failure (e.g. a 500 on the initial
+                // request) rejects here, before the generic per-stream dedup
+                // machinery in NeuroLink.stream() (which only wraps an already
+                // -returned stream) ever runs. Without this call a failed Vertex
+                // stream reported zero `generation:end` events instead of one:
+                // `emitStreamEnd` above only ever emits `stream:end`, a different
+                // event Pipeline B and analytics don't listen for.
+                this.emitGenerationEnd(modelName, null, streamStartTime, false, error, inputPrompt);
                 throw error;
             }
         }, (r) => r.stream, 
@@ -5682,6 +5699,26 @@ export class GoogleVertexProvider extends BaseProvider {
         const usage = result?.usage && typeof result.usage === "object"
             ? result.usage
             : { input: 0, output: 0, total: 0 };
+        // Mark on the result so the SDK-level runStandardGenerateRequest knows
+        // this provider already emitted `generation:end` itself and skips its
+        // own duplicate emission. Without this flag the public event listener
+        // (and the observability test) would see two events per generate call.
+        if (result && typeof result === "object") {
+            result._generationEndEmitted =
+                true;
+        }
+        // The failure path has no result to carry that flag — `result` is null —
+        // so mark the error instead. Without this, `generateTextInternal`'s
+        // wrapProviderError (which replaces this error with a new one further up
+        // the stack) has nothing to copy forward, and emitGenerateErrorEvent goes
+        // on to emit its own `generation:end` for a failure this provider already
+        // reported — double-counting every failed native Vertex generate in
+        // analytics and as two Pipeline B spans. Same shape as the AI Studio
+        // (#1745) and Bedrock (#1762) fixes for the same gap.
+        if (!success && error && typeof error === "object") {
+            error._generationEndEmitted =
+                true;
+        }
         emitter.emit("generation:end", {
             provider: this.providerName,
             responseTime: Date.now() - startTime,
@@ -5702,14 +5739,6 @@ export class GoogleVertexProvider extends BaseProvider {
                 ? { error: error instanceof Error ? error.message : String(error) }
                 : {}),
         });
-        // Mark on the result so the SDK-level runStandardGenerateRequest knows
-        // this provider already emitted `generation:end` itself and skips its
-        // own duplicate emission. Without this flag the public event listener
-        // (and the observability test) would see two events per generate call.
-        if (result && typeof result === "object") {
-            result._generationEndEmitted =
-                true;
-        }
     }
     /**
      * Turn-clock-shaped adapter over the shared {@link buildLoopExitMessage}.

package/dist/proxy/accountCooldown.js

@@ -60,22 +60,27 @@ function sanitizePersistedCooldown(accountKey, entry) {
         `${hours(ceiling)}h — the stored wait exceeded what "${entry.reason}" can mean`);
     return { ...entry, coolingUntil: latest };
 }
+/**
+ * Read the cooldown file as it is now. A missing file is empty; any other
+ * failure (unreadable, corrupt) returns `fallback`, so a write never discards
+ * entries just because one read failed.
+ */
+async function readCooldownsFromDisk(fallback) {
+    try {
+        const parsed = JSON.parse(await readFile(getCooldownFilePath(), "utf8"));
+        return Object.fromEntries(Object.entries(parsed)
+            .filter((entry) => isPersistedCooldown(entry[1]))
+            .map(([key, entry]) => [key, sanitizePersistedCooldown(key, entry)]));
+    }
+    catch (error) {
+        return error.code === "ENOENT" ? {} : fallback;
+    }
+}
 async function ensureAccountCooldownsLoaded() {
     if (!cacheLoaded) {
         if (!cacheLoadPromise) {
             cacheLoadPromise = (async () => {
-                try {
-                    const parsed = JSON.parse(await readFile(getCooldownFilePath(), "utf8"));
-                    memoryCache = Object.fromEntries(Object.entries(parsed)
-                        .filter((entry) => isPersistedCooldown(entry[1]))
-                        .map(([key, entry]) => [
-                        key,
-                        sanitizePersistedCooldown(key, entry),
-                    ]));
-                }
-                catch {
-                    memoryCache = {};
-                }
+                memoryCache = await readCooldownsFromDisk({});
                 cacheLoaded = true;
             })().finally(() => {
                 cacheLoadPromise = null;
@@ -91,14 +96,18 @@ export async function loadAccountCooldowns() {
 export async function saveAccountCooldown(accountKey, coolingUntil, reason) {
     await mutationMutex.runExclusive(async () => {
         await ensureAccountCooldownsLoaded();
-        const current = memoryCache[accountKey];
+        // Another worker (a draining one during a rolling restart) may have written
+        // the file since this one loaded it, so the change folds onto the file as
+        // it is now rather than onto this worker's copy.
+        const onDisk = await readCooldownsFromDisk(memoryCache);
+        memoryCache = onDisk;
+        const current = onDisk[accountKey];
         if (current && current.coolingUntil > coolingUntil) {
             return;
         }
-        memoryCache[accountKey] = {
-            coolingUntil,
-            reason,
-            updatedAt: Date.now(),
+        memoryCache = {
+            ...onDisk,
+            [accountKey]: { coolingUntil, reason, updatedAt: Date.now() },
         };
         await writeJsonSnapshotAtomically(getCooldownFilePath(), memoryCache);
     });
@@ -106,7 +115,11 @@ export async function saveAccountCooldown(accountKey, coolingUntil, reason) {
 export async function clearAccountCooldown(accountKey, expectedCoolingUntil) {
     await mutationMutex.runExclusive(async () => {
         await ensureAccountCooldownsLoaded();
-        const current = memoryCache[accountKey];
+        // Compare against the file, not this worker's copy: another worker may
+        // have extended this cooldown since, and that one must survive.
+        const onDisk = await readCooldownsFromDisk(memoryCache);
+        memoryCache = onDisk;
+        const current = onDisk[accountKey];
         if (!current) {
             return;
         }
@@ -114,7 +127,9 @@ export async function clearAccountCooldown(accountKey, expectedCoolingUntil) {
             current.coolingUntil !== expectedCoolingUntil) {
             return;
         }
-        delete memoryCache[accountKey];
+        const next = { ...onDisk };
+        delete next[accountKey];
+        memoryCache = next;
         await writeJsonSnapshotAtomically(getCooldownFilePath(), memoryCache);
     });
 }

package/dist/proxy/accountQuota.js

@@ -308,8 +308,8 @@ const FLUSH_INTERVAL_MS = 5_000; // write to disk at most every 5 seconds
 let memoryCache = {};
 let cacheLoaded = false;
 let cacheLoadPromise = null;
-let dirty = false;
-let cacheVersion = 0;
+/** Accounts this worker changed since its last flush. */
+let dirtyKeys = new Set();
 let flushTimer = null;
 const stateMutex = new AsyncMutex();
 const flushMutex = new AsyncMutex();
@@ -332,38 +332,86 @@ export function initAccountQuota(quotaFilePath) {
     memoryCache = {};
     cacheLoaded = false;
     cacheLoadPromise = null;
-    dirty = false;
-    cacheVersion = 0;
+    dirtyKeys = new Set();
 }
 function getQuotaFilePath() {
     return customQuotaFilePath ?? join(homedir(), ".neurolink", QUOTA_FILE);
 }
-/** Flush the in-memory cache to disk (async, non-blocking). */
+/**
+ * Read the quota file as it is now. A missing file is empty; any other failure
+ * (unreadable, corrupt) returns `fallback`, so a flush never discards entries
+ * just because one read failed.
+ */
+async function readQuotasFromDisk(filePath, fallback) {
+    try {
+        const parsed = JSON.parse(await fs.readFile(filePath, "utf-8"));
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+            return fallback;
+        }
+        return parsed;
+    }
+    catch (error) {
+        return error.code === "ENOENT" ? {} : fallback;
+    }
+}
+/** Fold two snapshots of one account so the more recently updated one wins,
+ *  whichever worker wrote it. */
+function foldNewerQuota(onDisk, ours) {
+    if (!onDisk) {
+        return ours;
+    }
+    return onDisk.lastUpdated > ours.lastUpdated
+        ? mergeQuotaSnapshot(ours, onDisk)
+        : mergeQuotaSnapshot(onDisk, ours);
+}
+/** Flush this worker's changed accounts to disk (async, non-blocking). */
 async function flushToDisk() {
     await flushMutex.runExclusive(async () => {
-        let snapshot;
-        let snapshotVersion = 0;
+        let changed;
+        let fallback = {};
         let filePath = "";
         await stateMutex.runExclusive(async () => {
-            if (!dirty) {
+            if (dirtyKeys.size === 0) {
                 return;
             }
-            snapshot = Object.fromEntries(Object.entries(memoryCache).map(([key, quota]) => [key, { ...quota }]));
-            snapshotVersion = cacheVersion;
+            changed = Object.fromEntries([...dirtyKeys].map((key) => [key, { ...memoryCache[key] }]));
+            fallback = Object.fromEntries(Object.entries(memoryCache).map(([key, quota]) => [key, { ...quota }]));
+            dirtyKeys = new Set();
             filePath = getQuotaFilePath();
         });
-        if (!snapshot) {
+        const flushing = changed;
+        if (!flushing) {
             return;
         }
         try {
-            await writeJsonSnapshotAtomically(filePath, snapshot, 0o600);
+            // Another worker (a draining one during a rolling restart) may have
+            // written the file since this one loaded it: fold only this worker's
+            // changes onto the file as it is now, never rewrite it from this copy.
+            const onDisk = await readQuotasFromDisk(filePath, fallback);
+            const merged = { ...onDisk };
+            for (const [key, quota] of Object.entries(flushing)) {
+                merged[key] = foldNewerQuota(onDisk[key], quota);
+            }
+            await writeJsonSnapshotAtomically(filePath, merged, 0o600);
             await stateMutex.runExclusive(async () => {
-                if (cacheVersion === snapshotVersion) {
-                    dirty = false;
+                if (getQuotaFilePath() !== filePath) {
+                    return;
                 }
+                // Adopt what other workers wrote, keeping changes saved meanwhile.
+                memoryCache = {
+                    ...merged,
+                    ...Object.fromEntries([...dirtyKeys].map((key) => [key, memoryCache[key]])),
+                };
             });
         }
         catch {
+            await stateMutex.runExclusive(async () => {
+                if (getQuotaFilePath() === filePath) {
+                    for (const key of Object.keys(flushing)) {
+                        dirtyKeys.add(key);
+                    }
+                }
+            });
             // Non-fatal — quota is best-effort telemetry
         }
     });
@@ -394,13 +442,7 @@ async function ensureAccountQuotasLoaded() {
     if (!cacheLoaded) {
         if (!cacheLoadPromise) {
             cacheLoadPromise = (async () => {
-                try {
-                    const raw = await fs.readFile(getQuotaFilePath(), "utf-8");
-                    memoryCache = JSON.parse(raw);
-                }
-                catch {
-                    memoryCache = {};
-                }
+                memoryCache = await readQuotasFromDisk(getQuotaFilePath(), {});
                 cacheLoaded = true;
             })().finally(() => {
                 cacheLoadPromise = null;
@@ -436,8 +478,7 @@ export async function saveAccountQuota(accountKey, quota) {
         // A header capture reports only the windows the served request touched, so
         // it must fold onto the existing snapshot rather than replace it.
         memoryCache[accountKey] = mergeQuotaSnapshot(memoryCache[accountKey], quota);
-        dirty = true;
-        cacheVersion += 1;
+        dirtyKeys.add(accountKey);
     });
     scheduleFlush();
 }