fix: harden maintenance failure reconciliation

tools/thothctl/internal/pi/update.go

@@ -469,23 +469,24 @@ func setMaintenance(ctx context.Context, runner Runner, enabled bool) error {
 	if err == nil && valid && status.Active == enabled && status.Admissions == 0 && !status.RecoveryRequired {
 		return nil
 	}
-	// A core recreate or transport interruption may lose only the response. Resolve ambiguity by
-	// reading the durable gate state before deciding that operator recovery is required.
+	// Status identifies the safest immediate state after an ambiguous response. It cannot
+	// acknowledge durability for an operation whose command returned an error.
 	observed, statusErr := MaintenanceStatus(ctx, runner)
-	if statusErr == nil && observed.Active == enabled && observed.Admissions == 0 {
-		// curl exit 22 means the server explicitly rejected the POST. A matching marker after
-		// that rejection selects the safest state, but cannot prove the failed write was durable.
-		if observed.RecoveryRequired || result.ExitCode == 22 {
-			return recoveryRequired("maintenance durability was explicitly not acknowledged", err)
-		}
-		return nil
-	}
 	if valid && status.RecoveryRequired {
 		return recoveryRequired("maintenance durability was explicitly not acknowledged", err)
 	}
+	if statusErr == nil && observed.RecoveryRequired {
+		return recoveryRequired("maintenance durability was explicitly not acknowledged", err)
+	}
 	if err != nil {
+		if statusErr == nil && observed.Active == enabled && observed.Admissions == 0 {
+			return recoveryRequired("maintenance durability was not acknowledged after a failed command", err)
+		}
 		return commandError("maintenance admission gate", result, err)
 	}
+	if statusErr == nil && observed.Active == enabled && observed.Admissions == 0 {
+		return nil
+	}
 	return errors.New("maintenance admission gate did not acknowledge a quiescent state")
 }