fix(swift-ios): retain thread subscriptions across navigation

[saphid]

Review this layer

GitHub shows this PR against t3code/rebuild-mobile-app-swift, so its diff includes every earlier PR in the chain. Review only this layer's change:

This layer's diff: +711 / −56 lines across 9 files; app code +241 / −55, the rest is tests and docs.

Child-view churn can release the selected thread transport while the workspace still owns its selection. Move that lifetime to workspace selection, preserve it across navigation transitions, and reconcile foreground shell/detail authority when delivery is silently stale. Equal cursors do not suppress a changed authoritative HTTP body.

Verification: current-head CI passes, including contract fixtures and native tests. The final bootstrap/environment run passed 38 tests, covering environment switching, error visibility and archive hydration; separate focused checks cover passive-worker lifetime. Skipped checks are not claimed as executed proof.

Delivery: stacked. This branch contains #10758, #10759, #10761, #10762, #10763; merge the chain in order (#10758 → #10759 → #10761 → #10762 → #10763 → #10764 → #10765 → #10766 → #14021 → #10767). Each PR's own change is its top commit(s).

Base: Theo’s t3code/rebuild-mobile-app-swift, 157476f1fb.

Navigation verification: Baseline e163f9cee and candidate a361b2212 use actual WorkspaceView with a synthetic selected thread and a fixture full-screen cover. Both capture tests passed: no client release during cover/return, one release after the production Back action. This is ordinary navigation regression proof; it does not reproduce the race. Focused native tests cover presentation replacement, held-load cancellation, refresh ownership and compact/regular selection.

Before video · Clean candidate video · Annotated candidate video · Evidence receipt

Static context only: the unchanged selected-thread presentation is shown below. The lifetime race is established by the focused native ownership tests, not by a visible animation difference.

Capture currency: checked against 5b93f19c8. WorkspaceView and ThreadDetailView are unchanged since a361b2212; later edits affect environment hydration/error handling and tests, which this synthetic navigation fixture does not exercise.

Independent cross-provider review was unavailable: claude auth status returned exit 1 with loggedIn: false. No Claude review or maintainer approval is claimed.

Refresh onto 157476f1fb (2026-09-27)

Rebased with the thread-sync chain onto the current t3code/rebuild-mobile-app-swift (157476f1fb). Head a082dccec6.

• Focused tests at this layer, measured before the review fixes below (NativeMultiEnvironmentTests, NativeThreadCatchUpTests, NativeRetryIdentityTests, FeatureRootModelTests, iOS Simulator, per-test time limits): 111 passed.
• Full T3CodeTests at the chain top (68d92c2752): 343 XCTest cases passed (1 skipped). Swift Testing ran 892 tests; the only 2 failures are UsageModelsTests currency formatting, which fail identically on unmodified 157476f1fb.
• Independent review: devin -p --sandbox --permission-mode smart --model swe-2-max over the whole chain diff, exit 0. No blocker, high or medium findings. A dead-state finding was fixed. A report that Stop state outlives a vanished thread was not changed, because stopSurvivesCloseReopenAndMissingReconnectSeed requires that behaviour.

Review fixes (rounds 2–5)

• Reopened thread showed a busy … send button. This layer's navigation change lets the compact split view report a reopened thread view as disappeared right after it appears, while it stays on screen. That cancelled the draft restore, so the composer stayed busy until relaunch. The restore now runs outside the view task's lifetime. Found from an on-device activity log and bisected to this layer (upstream 157476f1fb and fix(swift-ios): reconcile silent selected-thread streams #10763 do not reproduce it). In the iOS 27 Simulator, before the fix opens 2–5 of a thread showed …; after it, every reopen restored the draft and showed the send arrow. Also confirmed on a physical iPhone. No unit test: the spurious disappear comes from SwiftUI's split-view presentation, which the unit harness does not reproduce.
• Pairing rejection now also stops the quiet shell reconciliation loop, which kept issuing rejected shell reads every 30 s.
• A passive peer whose socket stayed open kept its 30 s quiet shell reads after a 401 and showed as connected. The rejected credential is now handled before the live-stream shortcut and switches to the long back-off. The rejection is shared with the peer's stream: stream updates no longer mark it connected, a closed stream no longer turns Needs pairing into Reconnecting (which hid Pair again), and a new stream snapshot no longer wakes the HTTP loop before the back-off. Test: livePeerRejectedCredentialStopsReconciling, extended to close and reseed the stream after rejection. Removing either guard of the final fix makes it fail.

Independent review

GPT-6 Astra (codex exec -m gpt-6-astra -c model_reasoning_effort="xhigh" --sandbox read-only) reviewed this layer in rounds 1–4, then checked the round-5 fix on its own. Earlier rounds found the defects fixed above. The final check returned ready, with one minor, non-blocking note.

Follow-ups (minor, not blocking)

• The wake half of livePeerRejectedCredentialStopsReconciling checks the shell read count after a later stream update is published. That ordering caught the regression in the negative check, but it is not a strict synchronisation point; an explicit worker drain would make it deterministic.
• A rewind transcript that lands between the transcript acknowledging a send and the outbox completion lets the completed message be retained again until the next transcript (Macroscope; narrow ordering).

Model and harness: GPT-6 / Codex. Rebase onto 157476f1fb: Claude Opus 5.5 / Claude Code.

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR is a large production-path concurrency and navigation refactor spanning shell streams, environment refresh workers, selected-thread detail reconciliation, message retention, and SwiftUI presentation ownership. Its broad runtime impact and unresolved High/Medium state-consistency findings require human review.

Not approved because:

• 2 blocking correctness issues found at or above your repo's Minimum Blocking Severity

^{Adjust the Minimum Blocking Severity for this repo — including turning it Off — in Settings. You can add or adjust custom eligibility rules. Learn more.}

[saphid]

@t3dotgg Could you review this SwiftUI reliability/performance fix? It will retain selected-thread subscriptions across navigation and child-view churn. It does not change the visible interface. This is a dependent PR; prerequisites: #10763. Its diff includes those prerequisites and needs rebasing after they land.

[macroscopeapp]

🟠 High App/NativeFeatureClient.swift:1198

The same-client fast path returns with the previous shell epoch intact, so a reconnect with a restarted sequence causes acceptActiveShell to reject the new snapshot and leaves stale projects and threads visible indefinitely. Reset activeShellEpochHasSnapshot (and update activeShellConnectionID) before returning from this path.

🤖 Copy this AI Prompt to have your agent fix this:

In file @apps/swift-ios/App/NativeFeatureClient.swift around line 1198:

The same-client fast path returns with the previous shell epoch intact, so a reconnect with a restarted sequence causes `acceptActiveShell` to reject the new snapshot and leaves stale projects and threads visible indefinitely. Reset `activeShellEpochHasSnapshot` (and update `activeShellConnectionID`) before returning from this path.

[macroscopeapp]

🟡 Medium Root/FeatureRootModel.swift:1925

completeQueuedSubmission re-adds a delivered message to deliveredAwaitingDetail after an authoritative transcript has removed it, so later detail loads continue displaying a message that the server no longer contains. The check at line 1925 reads mutable serverMessageIDs only after await outboxStore.remove(id:); capture the transcript confirmation when completion is scheduled and carry that snapshot through the async completion/retry instead of consulting the later state.

🤖 Copy this AI Prompt to have your agent fix this:

In file @apps/swift-ios/Features/Root/FeatureRootModel.swift around line 1925:

`completeQueuedSubmission` re-adds a delivered message to `deliveredAwaitingDetail` after an authoritative transcript has removed it, so later detail loads continue displaying a message that the server no longer contains. The check at line 1925 reads mutable `serverMessageIDs` only after `await outboxStore.remove(id:)`; capture the transcript confirmation when completion is scheduled and carry that snapshot through the async completion/retry instead of consulting the later state.

[saphid]

Acknowledged as a narrow edge case: it needs a rewind transcript to land between the acknowledging transcript and the outbox completion. Listed as a follow-up in the PR body rather than changed here.

[macroscopeapp]

Sorry, I'm unable to act on this request because you do not have permissions within this repository.

[saphid]

@t3dotgg this is ready for your review and merge.

Merge order: stacked chain, merge in order: #10758 → #10759 → #10761 → #10762 → #10763 → #10764 → #10765 → #10766 → #10767. #12655 (composer focus freeze) is independent and can merge at any time.

Evidence at head a082dccec6:

• CI: all checks pass on this head.
• Full T3CodeTests at the chain top (70258b6a6b, iOS Simulator): 343 XCTest cases passed (1 skipped). Swift Testing ran 892 tests; the only 2 failures are UsageModelsTests currency formatting, which fail identically on unmodified 157476f1fb.
• Each review fix has a focused regression test that fails without the fix, except where the description says why not.
• Also fixes a reopen bug this layer introduced (busy … send button after reopening a thread). It was found from an on-device log, bisected to this layer, and proven fixed in the Simulator.
• An earlier build of this chain (before the review rounds) fixed the stuck-send behaviour on a physical iPhone, as confirmed by the user. The current heads have not been re-verified on a device.

Independent review: GPT-6 Astra xhigh (read-only) reviewed this layer in rounds 1–4 and then checked the round-5 fix on its own: ready, with one minor test-determinism note listed as a follow-up.

Macroscope findings on the latest heads have been verified against the source: real ones are fixed, and the rest have a written reason and are listed under Follow-ups in the description.