fix(gui): stop an order write and a manual switch from racing the pin

Both PUTs move the manual pin, in opposite directions -- the active route
sets it, the order route clears it -- and each handler now applies its edge
optimistically rather than waiting for the reload. They were gated on
separate refs, so they could overlap, and response order is not request
order: whichever reply landed last won the client's pin state regardless of
which write the server processed last. The dashboard could sit on the
inverse of the server's pin until some later reload happened to correct it.

Cross-gate them in both directions, since either can be the newer
statement. A refused mutation returns "busy", which both call sites drop
without a toast, so the order control and the switch confirm are also
disabled while the other is in flight -- otherwise the gate would only turn
a visible race into an invisible no-op.

Found by CodeRabbit on #715.

Author: XertroV

gui/src/components/CodexAccountPool.tsx

@@ -299,6 +299,7 @@ export default function CodexAccountPool({ apiBase, accountModeState = null, ban
         pauseBusy={pauseUpdatingId !== null || pausingExhausted}
         onPriorityChange={(entry, priority) => { void changePriority(entry, priority); }}
         priorityUpdatingId={priorityUpdatingId}
+        switchingId={switchingId}
         pinnedId={activePinnedId}
         onOpenReset={openResetPopup}
         onCopyDoctor={copyDoctor}
@@ -332,6 +333,7 @@ export default function CodexAccountPool({ apiBase, accountModeState = null, ban
         pauseBusy={pauseUpdatingId !== null || pausingExhausted}
         onPriorityChange={(entry, priority) => { void changePriority(entry, priority); }}
         priorityUpdatingId={priorityUpdatingId}
+        switchingId={switchingId}
         pinnedId={activePinnedId}
         onReauth={openReauth}
         onEditAlias={editAlias}
@@ -365,6 +367,7 @@ export default function CodexAccountPool({ apiBase, accountModeState = null, ban
           mainEmail={main?.email}
           accountModeState={accountModeState}
           switchingId={switchingId}
+          orderBusy={priorityUpdatingId !== null}
           onCancel={() => setConfirm(null)}
           onConfirm={() => { void setActive(confirm.id === "__main__" ? "__main__" : confirm.id); }}
         />

gui/src/components/codex-account-pool-cards.tsx

@@ -29,6 +29,7 @@ export function CodexAccountPoolCards({
   pauseBusy,
   onPriorityChange,
   priorityUpdatingId,
+  switchingId,
   pinnedId = null,
   onReauth,
   onEditAlias,
@@ -48,6 +49,8 @@ export function CodexAccountPoolCards({
   pauseBusy: boolean;
   onPriorityChange: (account: CodexAccountEntry, priority: number) => void;
   priorityUpdatingId: string | null;
+  /** In-flight manual switch, which writes the same pin an order write clears. */
+  switchingId: string | null;
   /**
    * The account an operator pinned by hand, which is not always the selected one: under
    * round-robin and fill-first the pin caps selection at its own tier while the cursor
@@ -145,7 +148,9 @@ export function CodexAccountPoolCards({
             // Every row, not just the one being written: the controller serializes order
             // writes behind one mutation ref, so a second row's pick would come back "busy"
             // and be dropped with no toast. Same global lock the pause button uses.
-            disabled={priorityUpdatingId !== null}
+            // A pending switch counts too — it writes the same pin this clears, so the
+            // controller refuses to overlap them, and that refusal is equally silent.
+            disabled={priorityUpdatingId !== null || switchingId !== null}
             onChange={(priority) => onPriorityChange(a, priority)}
           />
           {showReauth

gui/src/components/codex-account-pool-main-card.tsx

@@ -29,6 +29,7 @@ export function CodexAccountPoolMainCard({
   pauseBusy,
   onPriorityChange,
   priorityUpdatingId,
+  switchingId,
   pinnedId = null,
   onOpenReset,
   onCopyDoctor,
@@ -46,6 +47,8 @@ export function CodexAccountPoolMainCard({
   pauseBusy: boolean;
   onPriorityChange: (entry: CodexAccountEntry, priority: number) => void;
   priorityUpdatingId: string | null;
+  /** In-flight manual switch, which writes the same pin an order write clears. */
+  switchingId: string | null;
   /**
    * The account carrying the pin, which is not always the one routing is on: the pin caps
    * selection at its own tier, and under round-robin or fill-first the cursor still moves
@@ -139,8 +142,9 @@ export function CodexAccountPoolMainCard({
           selectId={`codex-account-priority-${mainSwitchEntry.id}`}
           // Any in-flight order write, not just this card's: order writes share one mutation
           // ref, so a pick made during another card's write returns "busy" and is dropped
-          // silently. Mirrors pauseBusy.
-          disabled={priorityUpdatingId !== null}
+          // silently. Mirrors pauseBusy. A pending switch counts too — it writes the same
+          // pin this clears, so the controller refuses to overlap them, just as silently.
+          disabled={priorityUpdatingId !== null || switchingId !== null}
           onChange={(priority) => onPriorityChange(mainSwitchEntry, priority)}
         />
       )}

gui/src/components/codex-account-switch-modal.tsx

@@ -9,13 +9,20 @@ export function CodexAccountSwitchModal({
   mainEmail,
   accountModeState,
   switchingId,
+  orderBusy = false,
   onCancel,
   onConfirm,
 }: {
   confirm: CodexAccountEntry;
   mainEmail?: string;
   accountModeState: CodexAccountModeState | null;
   switchingId: string | null;
+  /**
+   * An in-flight selection-order write. It clears the pin this switch would set, so the
+   * controller refuses to run the two together and drops the loser without a toast --
+   * the button has to be unavailable rather than silently ineffective.
+   */
+  orderBusy?: boolean;
   onCancel: () => void;
   onConfirm: () => void;
 }) {
@@ -59,7 +66,7 @@ export function CodexAccountSwitchModal({
         )}
         <div className="modal-actions">
           <button type="button" className="btn btn-ghost" onClick={onCancel}>{t("codexAuth.cancel")}</button>
-          <button type="button" className="btn btn-primary" disabled={Boolean(switchingId)} onClick={onConfirm}>
+          <button type="button" className="btn btn-primary" disabled={Boolean(switchingId) || orderBusy} onClick={onConfirm}>
             {switchingId ? t("pws.accountSwitching") : t(accountModeState === "direct" ? "codexAuth.prepareForPool" : "codexAuth.setAsNext")}
           </button>
         </div>

gui/src/hooks/useCodexAccountPool.ts

@@ -228,7 +228,12 @@ export function useCodexAccountPool(apiBase: string, enabled = true): CodexAccou
   }, []);
 
   const switchAccount = useCallback(async (id: string | null) => {
-    if (switchingRef.current) return { ok: false, reason: "busy" } as const;
+    // Cross-gated with the order write, not just with itself: both PUTs move the pin,
+    // and in opposite directions, so letting them overlap lets the client settle on
+    // the inverse of the server's final pin until a reload happens to correct it.
+    // Response order is not request order, so neither optimistic write can tell
+    // whether it is the newer statement.
+    if (switchingRef.current || priorityMutationRef.current) return { ok: false, reason: "busy" } as const;
     switchingRef.current = id ?? "__main__";
     setSwitchingId(id ?? "__main__");
     try {
@@ -308,7 +313,9 @@ export function useCodexAccountPool(apiBase: string, enabled = true): CodexAccou
   }, [apiBase, load]);
 
   const setAccountPriority = useCallback(async (id: string, priority: number | null) => {
-    if (priorityMutationRef.current) return { ok: false, reason: "busy" } as const;
+    // The other half of the cross-gate in switchAccount: an order write clears the
+    // pin that a switch sets, so the two cannot be in flight together.
+    if (priorityMutationRef.current || switchingRef.current) return { ok: false, reason: "busy" } as const;
     priorityMutationRef.current = { accountId: id };
     setPriorityUpdatingId(id);
     try {

gui/tests/codex-account-pool-behaviour.test.tsx

@@ -30,6 +30,7 @@ let priorityResponseOk = true;
 let nextPriorityResponseGate: Promise<void> | null = null;
 let nextPauseResponseGate: Promise<void> | null = null;
 let nextActiveResponseGate: Promise<void> | null = null;
+let nextActivePutGate: Promise<void> | null = null;
 let activePinned = false;
 let activePinnedAccountId: string | null = null;
 let omitPinnedAccountId = false;
@@ -55,6 +56,7 @@ beforeEach(() => {
   nextPriorityResponseGate = null;
   nextPauseResponseGate = null;
   nextActiveResponseGate = null;
+  nextActivePutGate = null;
   activePinned = false;
   activePinnedAccountId = null;
   omitPinnedAccountId = false;
@@ -121,6 +123,9 @@ beforeEach(() => {
       if (path.startsWith("codex-auth/active")) {
         if (init?.method === "PUT") {
           const body = JSON.parse(String(init.body)) as { accountId: string | null };
+          const putGate = nextActivePutGate;
+          nextActivePutGate = null;
+          if (putGate) await putGate;
           activePinnedAccountId = body.accountId;
           return {
             ok: true,
@@ -399,6 +404,49 @@ test("an accepted selection-order write clears the pin before reconciliation lan
   });
 });
 
+test("an order write and a manual switch refuse to overlap in either direction", async () => {
+  // Both PUTs move the pin, in opposite directions, and each applies its edge
+  // optimistically. Response order is not request order, so overlapping them can leave
+  // the client on the inverse of the server's final pin until a reload corrects it.
+  accounts = [
+    { id: "a1", email: "main", isMain: true, paused: false, priority: 0, hasCredential: true, quota: null },
+    { id: "a2", email: "pool", isMain: false, paused: false, priority: 0, hasCredential: true, quota: null },
+  ];
+  const seen = await mountController();
+
+  let releasePriority!: () => void;
+  nextPriorityResponseGate = new Promise<void>(resolve => { releasePriority = resolve; });
+  let priorityResult: unknown;
+  let switchDuringOrder: unknown;
+  await act(async () => {
+    const orderWrite = seen.current!.setAccountPriority("a2", 2).then(r => { priorityResult = r; });
+    switchDuringOrder = await seen.current!.switchAccount("a1");
+    releasePriority();
+    await orderWrite;
+  });
+  await act(async () => { await new Promise((r) => setTimeout(r, 30)); });
+
+  expect(switchDuringOrder).toEqual({ ok: false, reason: "busy" });
+  expect(priorityResult).toEqual({ ok: true });
+
+  let releaseSwitch!: () => void;
+  nextActivePutGate = new Promise<void>(resolve => { releaseSwitch = resolve; });
+  let switchResult: unknown;
+  let orderDuringSwitch: unknown;
+  await act(async () => {
+    const switchWrite = seen.current!.switchAccount("a2").then(r => { switchResult = r; });
+    orderDuringSwitch = await seen.current!.setAccountPriority("a2", 1);
+    releaseSwitch();
+    await switchWrite;
+  });
+  await act(async () => { await new Promise((r) => setTimeout(r, 30)); });
+
+  expect(orderDuringSwitch).toEqual({ ok: false, reason: "busy" });
+  expect(switchResult).toEqual({ ok: true, activeId: "a2" });
+  // The refused order write must not have moved the row either.
+  expect(seen.current!.accounts.find(account => account.id === "a2")?.priority).toBe(2);
+});
+
 test("an accepted manual switch moves the pin before reconciliation lands", async () => {
   activePinnedAccountId = "a1";
   const seen = await mountController();

gui/tests/codex-account-pool-controller.test.ts

@@ -45,7 +45,7 @@ test("main and added account cards expose the same persisted pause control", asy
   expect(addedCards).toContain('t(a.paused ? "codexAuth.resume" : "codexAuth.pause")');
 });
 
-test("both cards expose the selection-order control, and the mutation has its own gate", async () => {
+test("both cards expose the selection-order control, and pin writes cannot overlap", async () => {
   const pool = await read("../src/components/CodexAccountPool.tsx");
   const mainCard = await read("../src/components/codex-account-pool-main-card.tsx");
   const addedCards = await read("../src/components/codex-account-pool-cards.tsx");
@@ -76,13 +76,27 @@ test("both cards expose the selection-order control, and the mutation has its ow
 
   expect(hook).toContain("/api/codex-auth/accounts/priority");
   // Sharing pauseMutationRef would make a pause toggle and an order change on two
-  // different accounts reject each other for no reason.
+  // different accounts reject each other for no reason. The manual switch is the one
+  // deliberate exception: it writes the same pin an order write clears, so overlapping
+  // them lets the client settle on the inverse of the server's final pin. Cross-gated
+  // in both directions, since either can be the newer statement.
   const priorityMutation = hook.slice(
     hook.indexOf("const setAccountPriority"),
     hook.indexOf("const pauseExhaustedAccounts"),
   );
-  expect(priorityMutation).toContain("if (priorityMutationRef.current) return");
+  expect(priorityMutation).toMatch(/if \(priorityMutationRef\.current \|\| switchingRef\.current\) return/);
   expect(priorityMutation).not.toContain("pauseMutationRef");
+
+  const switchMutation = hook.slice(hook.indexOf("const switchAccount"), hook.indexOf("const saveAlias"));
+  expect(switchMutation).toMatch(/if \(switchingRef\.current \|\| priorityMutationRef\.current\) return/);
+
+  // A refused mutation returns "busy", which both call sites drop without a toast, so
+  // each control must be unavailable while the other is in flight rather than silently
+  // ineffective.
+  for (const card of [mainCard, addedCards]) {
+    expect(card).toContain("disabled={priorityUpdatingId !== null || switchingId !== null}");
+  }
+  expect(pool).toContain("orderBusy={priorityUpdatingId !== null}");
 });
 
 test("the pool header exposes one bulk action backed by the atomic endpoint", async () => {