fix(swift-ios): release accepted commands before optional refreshes

[saphid]

Review this layer

This is the first PR in the chain, so the diff GitHub shows here is this layer alone.

This layer's diff: +992 / −29 lines across 4 files; app code +150 / −24, the rest is tests and docs.

Accepted Send and Stop commands keep their UI actions waiting for optional HTTP reads. Release the accepted action immediately and let a generation-owned refresh reconcile the thread separately. Coalesce overlapping Send/Stop refresh requirements without replaying the command.

Pre-restack CI verification: GitHub checks passed on the original head, including contract fixtures and native tests. Skipped checks are not claimed as executed proof.

Before this restack, all 12 standalone command-acknowledgement/retry XCTest cases passed (exit 0). The old-environment late-ack regression relies on the later live-bootstrap connection lifetime and remains covered in the dependent chain.

Delivery: first of the stacked thread-sync chain (#10758 → #10759 → #10761 → #10762 → #10763 → #10764 → #10765 → #10766 → #14021 → #10767); merges on its own.

Base: Theo’s t3code/rebuild-mobile-app-swift, 157476f1fb.

Historical verification scope (before this restack): Native tests passed with optional HTTP reads held while accepted Send/Stop completes. They verify outbox completion, refresh coalescing, cancellation on close/disconnect, and absence of command replay. The direct PR excludes a test requiring the later passive-live lifetime; that test remains in the dependent chain. The native CI job linked above contains the passing receipts. The tests exercise the protocol, state, or accessibility-value boundary changed here.

Refresh onto 157476f1fb (2026-09-27)

Rebased with the thread-sync chain onto the current t3code/rebuild-mobile-app-swift (157476f1fb). Head 93fe314002.

• Focused tests at this head (iOS Simulator, per-test time limits): NativeRetryIdentityTests 14 passed; before the delete fix, NativeMultiEnvironmentTests, NativeThreadCatchUpTests, NativeRetryIdentityTests and FeatureRootModelTests passed 78 tests.
• Full T3CodeTests at the chain top (68d92c2752): 343 XCTest cases passed (1 skipped). Swift Testing ran 892 tests; the only 2 failures are UsageModelsTests currency formatting, which fail identically on unmodified 157476f1fb.
• Independent review: devin -p --sandbox --permission-mode smart --model swe-2-max over the whole chain diff, exit 0. No blocker, high or medium findings. A dead-state finding was fixed. A report that Stop state outlives a vanished thread was not changed, because stopSurvivesCloseReopenAndMissingReconnectSeed requires that behaviour.
• Review fix: Macroscope noted that deleting a thread did not cancel its detached refresh, so a late read could publish the deleted thread again. deleteThread now cancels it once the server accepts the delete (testDeletingThreadCancelsItsAcceptedSendRefresh; without the fix the test hangs). NativeRetryIdentityTests: 14 passed.

Review fixes (rounds 2–4)

• A detail read that started before a newer send was accepted could publish after it and hide the newer message. A superseded read is no longer published (its refresh loop reads again), and a cancelled shell refresh can no longer write its result. Test: testSupersededAcceptedSendRefreshDoesNotPublishItsOlderDetail (fails without the fix).
• A Stop accepted during a send's detail read discarded that read without requesting another, and an older detail could replace the transcript before it included the accepted message. The discarded read now triggers a re-read, and delivered messages stay visible until a server transcript includes them. Test: deliveredMessageSurvivesAnOlderDetailUntilTheServerIncludesIt.
• Retained messages are released once a server transcript confirms them, so they no longer reappear after a rewind, and are dropped when thread details are removed or cleared. Tests: confirmedDeliveredMessageDoesNotReturnAfterARewind, clearedDetailsDropRetainedDeliveredMessages.

Review fixes (round 6: Macroscope and Astra)

• Evicting a cached thread detail forgot its accepted messages, so reopening it with a stale transcript hid them. Eviction now keeps them, and clears only the transcript ID cache so memory stays bounded. Test: evictedDetailKeepsItsDeliveredMessageOnReopen (fails without the fix).
• A restored outbox or a new task's local detail was recorded as the server transcript, so an accepted new-task prompt was treated as confirmed and disappeared on the next older read. Only server transcripts confirm delivery now. Test: startedTaskKeepsItsPromptUntilTheServerIncludesIt (fails without the fix).
• Astra xhigh re-checked these fixes: it found one medium (eviction kept the transcript ID cache, so it could grow without bound), which is fixed above; the re-check of that fix returned ready.

Review fixes (round 7: Macroscope and Astra)

• A newer send can be delivered while an older one waits to retry. Delivered copies were placed before every queued copy, which reversed them; both are now merged by send time. Test: localCopiesKeepSendOrderWhenANewerSendIsDeliveredFirst (fails without the fix). Astra found no issues with this change.

Independent review

GPT-6 Astra (codex exec -m gpt-6-astra -c model_reasoning_effort="xhigh" --sandbox read-only) reviewed this layer four times. Rounds 1–3 found the defects fixed above. Round 4 returned ready to merge.

Follow-ups (minor, not blocking)

• An accepted send's in-flight detail refresh can publish after another client deleted the thread and briefly re-add it. Upstream's awaited refresh has the same race; cancelling accepted-command refreshes on shell removal would close it (Macroscope).

Reproduction

iOS 27 Simulator, Debug builds, paired to a disposable local server through a fault-injecting proxy that never answers GET /api/orchestration/threads/* or /api/orchestration/shell, like a stalled mobile connection. Commands still go through. Both builds include #12655 so the composer can be focused. Send one message, then a second.

• Before (157476f1fb): the first send holds the composer until its refresh reads time out (8 s thread read, then 61 s shell read). The second message's send button stays disabled for about 70 s.
• After (this PR): the second message sends immediately while the reads are still stalled, and its reply arrives.

GIFs are 4× speed. Real-time recordings: before.mp4 · after.mp4.

Model and harness: GPT-6 / Codex. Rebase onto 157476f1fb: Claude Opus 5.5 / Claude Code.

Dismissing prior approval to re-evaluate 302ea89

[saphid]

@t3dotgg this is ready for your review and merge.

Merge order: stacked chain, merge in order: #10758 → #10759 → #10761 → #10762 → #10763 → #10764 → #10765 → #10766 → #10767. #12655 (composer focus freeze) is independent and can merge at any time.

Evidence at head 93fe314002:

• CI: all checks pass on this head.
• Full T3CodeTests at the chain top (70258b6a6b, iOS Simulator): 343 XCTest cases passed (1 skipped). Swift Testing ran 892 tests; the only 2 failures are UsageModelsTests currency formatting, which fail identically on unmodified 157476f1fb.
• Each review fix has a focused regression test that fails without the fix, except where the description says why not.
• Simulator reproduction with stalled reads: on 157476f1fb the second message's send button stayed disabled for about 70 s; with this PR it sends immediately (before/after video in the description).
• An earlier build of this chain (before the review rounds) fixed the stuck-send behaviour on a physical iPhone, as confirmed by the user. The current heads have not been re-verified on a device.

Independent review: GPT-6 Astra xhigh (read-only) reviewed this layer in four rounds and returned ready to merge in round 4. It then re-checked the later fixes: the eviction/local-detail fix (one medium found and fixed, re-check ready) and the send-order fix (no issues).

Macroscope findings on the latest heads have been verified against the source: real ones are fixed, and the rest have a written reason and are listed under Follow-ups in the description.