Rustfmt

src/config/hot_reload/watcher/preparation.rs

@@ -34,9 +34,30 @@ pub(super) async fn reload(
     reload_state: &mut ReloadState,
     dns_resolver: Option<Arc<crate::network::dns_overrides::GenerationDnsResolver>>,
     force: bool,
+    quota_mutation: Option<&Arc<tokio::sync::Mutex<()>>>,
+    quota_source_refresh: Option<&(dyn Fn() -> bool + Send + Sync)>,
 ) -> Option<WatchManifest> {
+    // Serialize source acquisition with API lifecycle commits, then release before DNS.
+    // The source timestamp fences any later mutation during asynchronous preparation.
+    let guard = match quota_mutation {
+        Some(gate) => Some(gate.lock().await),
+        None => None,
+    };
     let source = read_source(path).await?;
     let manifest = WatchManifest::from_source_files(&source.source_files);
+    // A new file edit can restore the exact pre-creation bytes. Refresh only source
+    // evidence for fenced accounts, retaining prepared DNS and immutable WEB state.
+    if !force
+        && quota_source_refresh.is_some_and(|refresh| refresh())
+        && source_matches_active(&config_tx.borrow(), &source)
+    {
+        let mut refreshed = (**config_tx.borrow()).clone();
+        refreshed.quota_source_read_at = source.config.quota_source_read_at;
+        config_tx.send(Arc::new(refreshed)).ok();
+        reload_state.mark_applied(source.rendered_hash);
+        return Some(manifest);
+    }
+    drop(guard);
     if !force && reload_state.is_applied(source.rendered_hash) {
         return Some(manifest);
     }
@@ -66,6 +87,7 @@ pub(super) async fn reload(
             detected_ip_v6,
             reload_state,
             dns_resolver.as_deref(),
+            quota_source_refresh.is_some_and(|refresh| refresh()),
         ),
         Ok(Err(error)) => {
             error!(