fix(clients): preserve provider-bound drafts

Refs #222

Author: rynfar

apps/mobile/src/features/threads/NewTaskDraftScreen.tsx

@@ -809,14 +809,16 @@ export function NewTaskDraftScreen(props: {
       return;
     }
     const draft = getComposerDraftSnapshot(draftKey);
-    // Snapshot read keeps just-typed selector state; the availability gate
-    // still applies so a stored selection on a disabled provider falls back
-    // to the flow's resolved model.
+    // Snapshot read keeps just-typed selector state. Ambient stale defaults
+    // may fall back, but a human/recovered exact provider choice must remain
+    // blocked rather than silently switch accounts.
     const modelSelection =
-      resolveSelectableModelSelection(
-        selectedEnvironmentServerConfig,
-        draft.modelSelection ?? null,
-      ) ?? flow.selectedModel;
+      draft.providerSelectionExplicit === true && draft.modelSelection !== undefined
+        ? resolveSelectableModelSelection(selectedEnvironmentServerConfig, draft.modelSelection)
+        : (resolveSelectableModelSelection(
+            selectedEnvironmentServerConfig,
+            draft.modelSelection ?? null,
+          ) ?? flow.selectedModel);
     const workspaceMode = draft.workspaceSelection?.mode ?? flow.workspaceMode;
     const selectedBranchName = draft.workspaceSelection?.branch ?? flow.selectedBranchName;
     const selectedWorktreePath =

apps/mobile/src/features/threads/new-task-flow-provider.tsx

@@ -439,10 +439,14 @@ export function NewTaskFlowProvider(props: React.PropsWithChildren) {
       stickySelection: storedStickyModelSelection,
     },
   );
-  const draftModelSelection = resolveSelectableModelSelection(
+  const selectableDraftModelSelection = resolveSelectableModelSelection(
     selectedEnvironmentServerConfig,
     storedDraftModelSelection,
   );
+  const draftModelSelection =
+    selectedProjectDraft.providerSelectionExplicit === true && storedDraftModelSelection !== null
+      ? storedDraftModelSelection
+      : selectableDraftModelSelection;
   const projectDefaultModelSelection = resolveDefaultableModelSelection(
     selectedEnvironmentServerConfig,
     storedProjectDefaultModelSelection,
@@ -530,6 +534,7 @@ export function NewTaskFlowProvider(props: React.PropsWithChildren) {
       const modelSelection = options ? { ...option.selection, options } : option.selection;
       updateComposerDraftSettings(selectedProjectDraftKey, {
         modelSelection,
+        providerSelectionExplicit: true,
         runtimeMode: resolveModelSelectionRuntimeMode(
           selectedEnvironmentServerConfig,
           modelSelection,
@@ -559,6 +564,7 @@ export function NewTaskFlowProvider(props: React.PropsWithChildren) {
           };
       updateComposerDraftSettings(selectedProjectDraftKey, {
         modelSelection: nextSelection,
+        providerSelectionExplicit: true,
       });
       setStickyComposerModelSelection(nextSelection);
     },
@@ -886,6 +892,7 @@ export function NewTaskFlowProvider(props: React.PropsWithChildren) {
       replaceComposerDraftAttachments(draftKey, message.attachments);
       updateComposerDraftSettings(draftKey, {
         modelSelection: message.modelSelection,
+        providerSelectionExplicit: message.modelSelection !== undefined,
         runtimeMode: message.runtimeMode,
         interactionMode: message.interactionMode,
         workspaceSelection: {

apps/mobile/src/state/thread-outbox-manager.ts

@@ -201,6 +201,21 @@ export function createThreadOutboxManager(options: ThreadOutboxManagerOptions) {
       return true;
     });
 
+  /**
+   * Compare-and-set rewrite for a caller holding an exact queue snapshot.
+   * The revision fence also catches a replacement published while this
+   * mutation waits for earlier durable writes.
+   */
+  const updateIfCurrent = (
+    expected: QueuedThreadMessage,
+    replacement: QueuedThreadMessage,
+  ): Promise<boolean> => {
+    if (!currentMessages().some((candidate) => candidate === expected)) {
+      return Promise.resolve(false);
+    }
+    return update(replacement, revisions.get(expected.messageId) ?? 0);
+  };
+
   // `expectedRevision` makes the removal a compare-and-set too: an edit
   // accepted after the caller decided to remove (restore-to-composer reads
   // the payload it is about to delete) keeps the newer message queued.
@@ -267,6 +282,15 @@ export function createThreadOutboxManager(options: ThreadOutboxManagerOptions) {
       return removed;
     });
 
+  /** Remove only the exact queue snapshot the caller inspected. */
+  const removeIfCurrent = (expected: QueuedThreadMessage): Promise<boolean> => {
+    if (!currentMessages().some((candidate) => candidate === expected)) {
+      return Promise.resolve(false);
+    }
+    const expectedRevision = revisions.get(expected.messageId) ?? 0;
+    return remove(expected, expectedRevision).then((removed) => removed !== null);
+  };
+
   const clearEnvironment = (
     environmentId: EnvironmentId,
   ): Promise<ReadonlyArray<QueuedThreadMessage>> => {
@@ -386,7 +410,9 @@ export function createThreadOutboxManager(options: ThreadOutboxManagerOptions) {
     /** Current write revision for a queued message; input to update's CAS. */
     revisionOf: (messageId: MessageId): number => revisions.get(messageId) ?? 0,
     update,
+    updateIfCurrent,
     remove,
+    removeIfCurrent,
     clearEnvironment,
   };
 }

apps/mobile/src/state/thread-outbox-model.ts

@@ -279,6 +279,36 @@ export function preserveQueuedThreadDeliveryHold(
     : undefined;
 }
 
+/**
+ * A held existing-thread send may be explicitly retargeted only to a selected
+ * provider that is currently admissible and proves the thread binding's exact
+ * continuation identity. The returned selection is never rewritten.
+ */
+export function resolveHeldSendSelectedProvider(input: {
+  readonly boundInstanceId: ModelSelectionType["instanceId"] | undefined;
+  readonly selectedModelSelection: ModelSelectionType | null | undefined;
+  readonly providers: ReadonlyArray<ServerProvider> | null | undefined;
+}): ModelSelectionType | null {
+  const selection = input.selectedModelSelection;
+  if (input.boundInstanceId === undefined || selection == null) return null;
+  const transition = resolveProviderContinuationTransition({
+    providers: input.providers ?? [],
+    currentInstanceId: input.boundInstanceId,
+    targetInstanceId: selection.instanceId,
+  });
+  if (!transition.compatible) return null;
+  const provider = input.providers?.find(
+    (candidate) => candidate.instanceId === selection.instanceId,
+  );
+  return getProviderAdmissionAvailability({
+    provider,
+    instanceId: String(selection.instanceId),
+    providerSnapshotKnown: input.providers !== null && input.providers !== undefined,
+  }).status === "available"
+    ? selection
+    : null;
+}
+
 export function retryQueuedThreadMessage(
   message: QueuedThreadMessage,
   input: {

apps/mobile/src/state/thread-outbox-recovery.test.ts

@@ -0,0 +1,110 @@
+import { describe, expect, it, vi } from "vite-plus/test";
+import {
+  CommandId,
+  EnvironmentId,
+  MessageId,
+  ProviderInstanceId,
+  ThreadId,
+} from "@t3tools/contracts";
+
+import { recoverPendingSendToComposer } from "./thread-outbox-recovery";
+import type { QueuedThreadMessage } from "./thread-outbox-model";
+
+function heldMessage(): QueuedThreadMessage {
+  return {
+    environmentId: EnvironmentId.make("environment-1"),
+    threadId: ThreadId.make("thread-1"),
+    messageId: MessageId.make("message-held"),
+    commandId: CommandId.make("command-held"),
+    text: "exact held text",
+    attachments: [
+      {
+        id: "held-image",
+        previewUri: "file:///held.png",
+        type: "image",
+        name: "held.png",
+        mimeType: "image/png",
+        sizeBytes: 12,
+        dataUrl: "data:image/png;base64,AQ==",
+      },
+    ],
+    modelSelection: {
+      instanceId: ProviderInstanceId.make("codex_personal"),
+      model: "gpt-5.4",
+      options: [{ id: "reasoningEffort", value: "xhigh" }],
+    },
+    runtimeMode: "approval-required",
+    interactionMode: "plan",
+    deliveryHold: {
+      kind: "provider-binding-mismatch",
+      reason: "Choose a destination.",
+    },
+    createdAt: "2026-09-01T00:00:00.000Z",
+  };
+}
+
+describe("pending send composer recovery", () => {
+  it("durably flushes the exact payload before CAS-removing the queue item", async () => {
+    const message = heldMessage();
+    const order: string[] = [];
+    const restore = vi.fn((draftKey: string, snapshot: unknown) => {
+      order.push(`restore:${draftKey}`);
+      expect(snapshot).toEqual({
+        text: message.text,
+        attachments: message.attachments,
+        modelSelection: message.modelSelection,
+        runtimeMode: message.runtimeMode,
+        interactionMode: message.interactionMode,
+      });
+    });
+    const flushDraft = vi.fn(async () => {
+      order.push("flush");
+    });
+    const removeIfCurrent = vi.fn(async (candidate: QueuedThreadMessage) => {
+      order.push("remove");
+      expect(candidate).toBe(message);
+      return true;
+    });
+
+    await expect(
+      recoverPendingSendToComposer(
+        { message, draftKey: "environment-1:thread-1" },
+        { restore, flushDraft, removeIfCurrent },
+      ),
+    ).resolves.toBe("removed");
+    expect(order).toEqual(["restore:environment-1:thread-1", "flush", "remove"]);
+  });
+
+  it("keeps the queue item when the durable draft flush fails", async () => {
+    const message = heldMessage();
+    const flushError = new Error("draft disk full");
+    const removeIfCurrent = vi.fn(async () => true);
+
+    await expect(
+      recoverPendingSendToComposer(
+        { message, draftKey: "environment-1:thread-1" },
+        {
+          restore: () => {},
+          flushDraft: async () => {
+            throw flushError;
+          },
+          removeIfCurrent,
+        },
+      ),
+    ).rejects.toBe(flushError);
+    expect(removeIfCurrent).not.toHaveBeenCalled();
+  });
+
+  it("reports a concurrent queue CAS loss without deleting the newer item", async () => {
+    const message = heldMessage();
+    const removeIfCurrent = vi.fn(async () => false);
+
+    await expect(
+      recoverPendingSendToComposer(
+        { message, draftKey: "environment-1:thread-1" },
+        { restore: () => {}, flushDraft: async () => {}, removeIfCurrent },
+      ),
+    ).resolves.toBe("queue-changed");
+    expect(removeIfCurrent).toHaveBeenCalledWith(message);
+  });
+});

apps/mobile/src/state/thread-outbox-recovery.ts

@@ -0,0 +1,58 @@
+import type { QueuedThreadMessage } from "./thread-outbox-model";
+import {
+  flushComposerDrafts,
+  restorePendingSendComposerDraft,
+  type ComposerDraftWorkspaceSelection,
+  type PendingSendComposerSnapshot,
+} from "./use-composer-drafts";
+import { removeThreadOutboxMessageIfCurrent } from "./thread-outbox-removal";
+
+export type PendingSendRecoveryResult = "removed" | "queue-changed";
+
+export function pendingSendComposerSnapshot(
+  message: QueuedThreadMessage,
+  workspaceSelection?: ComposerDraftWorkspaceSelection,
+): PendingSendComposerSnapshot {
+  return {
+    text: message.text,
+    attachments: message.attachments,
+    ...(message.modelSelection === undefined ? {} : { modelSelection: message.modelSelection }),
+    ...(message.runtimeMode === undefined ? {} : { runtimeMode: message.runtimeMode }),
+    ...(message.interactionMode === undefined ? {} : { interactionMode: message.interactionMode }),
+    ...(workspaceSelection === undefined ? {} : { workspaceSelection }),
+  };
+}
+
+/**
+ * Recovery protocol for a held send:
+ * 1. merge its exact payload and selection into the chosen composer;
+ * 2. force that composer snapshot to durable storage;
+ * 3. CAS-remove only the queue object the user opened.
+ *
+ * A crash or flush failure before step 3 leaves the original held item intact.
+ * A concurrent retry makes step 3 return `queue-changed`, so the newer queued
+ * item survives while the restored composer copy remains available to edit.
+ */
+export async function recoverPendingSendToComposer(
+  input: {
+    readonly message: QueuedThreadMessage;
+    readonly draftKey: string;
+    readonly workspaceSelection?: ComposerDraftWorkspaceSelection;
+  },
+  dependencies: {
+    readonly restore: (draftKey: string, snapshot: PendingSendComposerSnapshot) => void;
+    readonly flushDraft: () => Promise<void>;
+    readonly removeIfCurrent: (message: QueuedThreadMessage) => Promise<boolean>;
+  } = {
+    restore: restorePendingSendComposerDraft,
+    flushDraft: flushComposerDrafts,
+    removeIfCurrent: removeThreadOutboxMessageIfCurrent,
+  },
+): Promise<PendingSendRecoveryResult> {
+  dependencies.restore(
+    input.draftKey,
+    pendingSendComposerSnapshot(input.message, input.workspaceSelection),
+  );
+  await dependencies.flushDraft();
+  return (await dependencies.removeIfCurrent(input.message)) ? "removed" : "queue-changed";
+}

apps/mobile/src/state/thread-outbox-removal.ts

@@ -81,6 +81,21 @@ export async function removeThreadOutboxMessage(
   return true;
 }
 
+/**
+ * Removes only the exact queue snapshot the caller inspected, then releases
+ * the files owned by that snapshot.
+ */
+export async function removeThreadOutboxMessageIfCurrent(
+  message: QueuedThreadMessage,
+): Promise<boolean> {
+  const removed = await threadOutboxManager.removeIfCurrent(message);
+  if (!removed) {
+    return false;
+  }
+  await cleanUpRemovedMessages([message]);
+  return true;
+}
+
 /** Removes every queued message of an environment and releases their files. */
 export async function clearThreadOutboxEnvironment(environmentId: EnvironmentId): Promise<void> {
   // clearEnvironment loads and merges persisted messages itself and reports