fix(api): report the pin a load would actually use

Eighth review pass:

- effective.pinned reported the saved value, but Router::load_model keeps
  a live process's own pin instead, so the field contradicted both
  reality and its documented meaning. It now reports the live pin when
  the model is loaded.
- DELETE no longer resets a pin that was never saved; a pin a /load
  request applied to the process is not part of the entry being erased.
- Validation errors no longer name the config.json section for an
  endpoint whose keys are recipe option names.
- The user-model test cleans up its recipe_options.json entry, and the
  round-trip test covers a second recipe so options with no global-config
  counterpart are exercised.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: jeremyfowers

src/cpp/server/server.cpp

@@ -2828,11 +2828,20 @@ static std::string validate_option_value(const RuntimeConfig& config,
     if (config_key.rfind(recipe_prefix, 0) == 0) {
         config_key = config_key.substr(recipe_prefix.size());
     }
+    const std::string section = RuntimeConfig::recipe_to_config_section(recipe);
     try {
-        config.validate_backend(RuntimeConfig::recipe_to_config_section(recipe), config_key, value);
+        config.validate_backend(section, config_key, value);
     } catch (const std::exception& e) {
-        const std::string message = e.what();
-        if (message.rfind("Unknown key:", 0) != 0) return message;
+        std::string message = e.what();
+        if (message.rfind("Unknown key:", 0) == 0) return "";
+        // The validator names keys as they appear in config.json; this endpoint
+        // speaks recipe option names, so drop the section qualifier.
+        const std::string qualifier = "'" + section + ".";
+        const auto at = message.find(qualifier);
+        if (at != std::string::npos) {
+            message.replace(at, qualifier.size(), "'" + key.substr(0, key.size() - config_key.size()));
+        }
+        return message;
     }
     return "";
 }
@@ -2888,11 +2897,21 @@ void Server::respond_with_model_options(
         without_saved.recipe_options = model_manager_->get_model_default_options(info);
         RecipeOptions defaults = router_->resolve_effective_options(without_saved, no_request_options);
 
+        nlohmann::json effective_json = resolve_all_recipe_options(effective);
+        if (router_->is_model_loaded(model_key)) {
+            // A load keeps a live process's own pin rather than the saved one
+            // (see Router::load_model), so reporting the saved value here would
+            // contradict what "what a load would use" means for every other key.
+            const auto live_pinned = router_->get_model_recipe_options(model_key)
+                                         .get_option("pinned");
+            effective_json["pinned"] = live_pinned.is_boolean() && live_pinned.get<bool>();
+        }
+
         nlohmann::json response = {
             {"model_name", model_id},
             {"recipe", info.recipe},
             {"saved", model_manager_->get_saved_model_options(model_key)},
-            {"effective", resolve_all_recipe_options(effective)},
+            {"effective", std::move(effective_json)},
             {"defaults", resolve_all_recipe_options(defaults)},
             {"reload_required", router_->would_reload(model_key, effective)}
         };
@@ -2985,9 +3004,10 @@ void Server::handle_model_options_delete(const httplib::Request& req, httplib::R
     respond_with_model_options(req, res,
         [this](const std::string& model_key, const ModelInfo&, httplib::Response&,
                bool& touched_pinned) {
-            // Resetting to defaults covers the pin whether or not one was saved:
-            // a request-scoped /load may have pinned the live process instead.
-            touched_pinned = true;
+            // Only a saved pin is this endpoint's to reset. A pin a /load
+            // request applied to the live process is not part of the entry
+            // being erased, and `effective` reports it either way.
+            touched_pinned = model_manager_->get_saved_model_options(model_key).contains("pinned");
             if (!model_manager_->get_saved_model_options(model_key).empty()) {
                 model_manager_->set_saved_model_options(model_key, nlohmann::json::object());
             }

test/server_endpoints.py

@@ -1344,6 +1344,30 @@ def live_pinned():
         self._reset_options()
         self.assertFalse(live_pinned(), "DELETE should unpin the live model")
 
+        # A pin applied by a /load request is not saved anywhere, but a load
+        # would keep it, so `effective` has to report it rather than the saved
+        # value, and DELETE must not reset something it never owned.
+        requests.post(
+            f"{self.base_url}/load",
+            json={"model_name": ENDPOINT_TEST_MODEL, "pinned": True},
+            timeout=TIMEOUT_MODEL_OPERATION,
+        )
+        reported = requests.get(self._options_url(), timeout=TIMEOUT_DEFAULT).json()
+        self.assertEqual(reported["saved"], {})
+        self.assertTrue(
+            reported["effective"]["pinned"],
+            "effective must report the live pin, which is what a load would keep",
+        )
+        self._reset_options()
+        self.assertTrue(
+            live_pinned(), "DELETE must not reset a pin that was never saved"
+        )
+        requests.post(
+            f"{self.base_url}/load",
+            json={"model_name": ENDPOINT_TEST_MODEL, "pinned": False},
+            timeout=TIMEOUT_MODEL_OPERATION,
+        )
+
         print("[OK] pinned changes are applied to the running model")
 
     def test_012x_every_effective_option_can_be_saved_back(self):
@@ -1356,17 +1380,26 @@ def test_012x_every_effective_option_can_be_saved_back(self):
         self.addCleanup(self._reset_options)
         self._reset_options()
 
-        effective = requests.get(self._options_url(), timeout=TIMEOUT_DEFAULT).json()[
-            "effective"
-        ]
-        response = requests.post(
-            self._options_url(), json=effective, timeout=TIMEOUT_DEFAULT
-        )
-        self.assertEqual(
-            response.status_code,
-            200,
-            f"Every reported option must be settable, got {response.text}",
-        )
+        # Both recipes, so the round trip covers options with a global-config
+        # counterpart (steps, cfg_scale) and options without one (flow_shift,
+        # sampling_method, merge_args, the eviction settings).
+        models = [ENDPOINT_TEST_MODEL]
+        if requests.get(f"{self.base_url}/models/SD-Turbo", timeout=TIMEOUT_DEFAULT).ok:
+            models.append("SD-Turbo")
+            self.addCleanup(self._reset_options, "SD-Turbo")
+
+        for model in models:
+            effective = requests.get(
+                self._options_url(model=model), timeout=TIMEOUT_DEFAULT
+            ).json()["effective"]
+            response = requests.post(
+                self._options_url(model=model), json=effective, timeout=TIMEOUT_DEFAULT
+            )
+            self.assertEqual(
+                response.status_code,
+                200,
+                f"Every option reported for {model} must be settable, got {response.text}",
+            )
 
         # merge_args specifically: a boolean, and both values have to round-trip.
         for value in (True, False):
@@ -1436,6 +1469,9 @@ def test_012v_options_accept_a_user_model_public_name(self):
         ).json()["checkpoint"]
 
         def cleanup():
+            # Options first: deleting the model leaves its recipe_options.json
+            # entry behind otherwise.
+            self._reset_options(model_name)
             requests.post(
                 f"{self.base_url}/unload",
                 json={"model_name": model_name},