A pod that read the DB floor within the last 5s could repair the counter a reset had just
zeroed back to the old total for the whole counter TTL, since the floor broadcast reaches it
after the counter SET. The reset now SETs a hash-tagged reset fence next to each counter in the
same pipeline, the repair's Lua leaves a fenced counter alone, and the floors are broadcast
before the counters.
The reset also answered 200 when the Redis pipeline was lost, leaving every other pod on the
old counters for up to an hour. The pipeline write returns the swallowed error as a value, the
reset helpers carry it (a failed SCAN too), and /global/spend/reset and /organization/update
with spend answer 500 with the DB write kept and a retry instruction.
A value-carrying broadcast now lands only in the spend counter cache: written into every
additional cache, a reset of thousands of counters evicted the cached BYOK credentials on
every pod.
A reset told window counters apart by the "🪟" substring, so a team whose id merely
contains it kept its primary counter. The reset now uses the reseed's check, a validated
trailing duration, which is the same rule that keeps a window counter out of the DB lookup
244cae37d4