fix(desktop): sweep zombie optimistic rows on the reconnect seam + keep them out of the render cache

[Kyzcreig]

Symptom

Messages painted TWICE in the desktop app after a backend restart — persisting across app relaunches. DB clean (total==distinct), pure render corruption. Live incident 2026-07-15.

Root cause (two compounding halves)

1. Severed stamp: a backend restart / WS reconnect can kill the message.complete frame carrying message_ids (fix(desktop): stop live-sync duplicating every message on send #352's stamping path). The client's optimistic rows (user-<ts>, assistant-stream-<ts>) keep their client-minted ids; the session-sync poll re-fetches the committed rows and the id-only dedupe appends them as duplicates beside the zombies.
2. Cache re-infection: the render-cache write-through persisted the zombie rows to disk (transcript-<sid>.json), so a relaunch re-painted them and the next poll duplicated again — relaunching did NOT fix it. Observed: assistant-stream-1784172446416 cached beside its committed twin (row 695173).

Fix (3 narrow changes)

• appendFetchedMessages sweeps zombies via new dropZombieOptimisticRows: optimistic, non-pending row with exact (role, text) match to an incoming committed row is dropped in favor of the committed twin. Guardrails: committed rows untouchable; pending/streaming rows exempt; empty-text rows exempt; one zombie per incoming row (genuine repeats survive).
• pushTranscriptToRenderCache persists committed rows only (prefix-allowlist isCommittedTranscriptRow; unknown string ids fail open).
• normalizeCachedTranscriptRows drops legacy optimistic rows already on disk before painting; all-optimistic file = cache miss; pass-through path preserves array identity (existing switch-cache-paint contract).

Tests

6 reconnect-seam cases + 4 cache-hygiene cases, driven against the REAL functions (no mocks of the unit under test). RED-proven both halves: reverting the merge-loop line fails 2; reverting the cache filters fails 4. Full desktop suite 1320/1320, tsc clean.

[greptile-apps]

Greptile Summary

This PR fixes a live incident (2026-07-15) where messages painted twice in the desktop app after a backend restart. The root cause was two compounding problems: the message.complete frame carrying committed IDs could be severed by a WS reconnect, leaving optimistic rows (zombie user-<ts> / assistant-stream-<ts> IDs) that the id-only dedupe treated as distinct from their committed DB twins; and the render cache persisted those zombies to disk so every relaunch re-seeded the duplicates.

• dropZombieOptimisticRows uses (role, normalized-text) as a content join key to match each zombie to its arriving committed twin, with guards for pending/empty-text/committed rows and a per-key budget that preserves genuine duplicate sends.
• isCommittedTranscriptRow + pushTranscriptToRenderCache filter out client-minted optimistic IDs before writing to the render cache, and normalizeCachedTranscriptRows drops any legacy zombie rows already on disk before painting.

Confidence Score: 5/5

Safe to merge. The fix is narrow, well-guarded, and backed by 10 RED-proven tests run against real functions with no mocks of the units under test.

The zombie sweep and cache-hygiene changes touch only the render layer — no DB writes, no network calls. Every guard (committed-row protection, pending-row exemption, empty-text exemption, per-key budget) has a corresponding test verified to fail before the fix. The MEDIA-tag normalization edge case raised in a prior review thread was addressed correctly by making renderMediaTags idempotent on both sides of the join key.

No files require special attention. The four changed files are self-contained and the test files drive the exact functions changed.

Important Files Changed

Filename	Overview
apps/desktop/src/app/chat/hooks/use-session-changes.ts	Adds isOptimisticRowId and dropZombieOptimisticRows; wires the sweep into appendFetchedMessages. All guards correctly applied with MEDIA-tag normalization on both sides of the join key.
apps/desktop/src/app/render-cache-hydration.ts	Adds isCommittedTranscriptRow with prefix allowlist; applied in pushTranscriptToRenderCache and normalizeCachedTranscriptRows. Array identity preserved when no filtering needed.
apps/desktop/src/app/chat/hooks/use-session-changes.test.ts	Six new reconnect-seam test cases driven against real functions, covering all guards and the MEDIA-tag normalization edge case.
apps/desktop/src/app/render-cache-hydration.test.ts	Four new cache-hygiene test cases covering write-through filtering, skip-when-all-optimistic, legacy zombie drop, and all-optimistic cache-miss.

_{Reviews (3): Last reviewed commit: "merge fork/main" | Re-trigger Greptile}