fix(desktop): salvage session-race cluster — Stop→edit/resend busy race + submit ownership proof (#83855, #65328)

[teknium1]

What does this PR do?

Salvages the Desktop session-race sequencing cluster into one green-ready branch: two contributor fixes cherry-picked with authorship preserved, plus a small widening of the fix to a sibling call site of the same race class.

Salvaged commits (authorship preserved)

1. fix(desktop): interrupt-first after Stop so edit/resend avoids session-busy — salvaged from fix(desktop): interrupt-first after Stop so edit/resend avoids session-busy #84629 by @olympusbuildz (fixes fix(desktop): edit/resend after Stop hits session-busy race condition #83855).

   • cancelRun clears frontend busy immediately while the gateway is still winding down the interrupted turn, so editMessage/restoreToMessage computed interruptFirst = false and the rewind submit raced a 4009 "session busy".
   • Adds a 3s per-session cooldown after Stop (markSessionRecentlyInterrupted / shouldInterruptBeforeRewind) so edit/restore still interrupt-first while the gateway settles; idle rewinds stay interrupt-free.
   • Adds a 30s TTL on the _submitInFlight lock (acquireSubmitInFlight / releaseSubmitInFlight) so a hung prompt.submit cannot permanently block all sends for a session.
   • Conflict resolution note: main has since extended the rewind signature with truncateMessageId/truncateRowId and survivor-row rebinding; the cherry-pick was rebased onto that shape — the interruptFirst computation replaces the raw busy read at all four rewind call sites (primary chat restoreToMessage/editMessage + session-tile equivalents) while keeping main's survivor-row plumbing intact.

2. fix(desktop): prove submit target belongs to selected session from both directions — salvaged from fix(desktop): prove submit target belongs to selected session from both directions (#65328) #65381 by @wesleysimplicio (addresses [Bug]: New desktop session routes user input to existing old session instead (regression after 7/16 update) #65328 and the [Desktop] prompt.submit can target stale runtime A when route and stored session already point to B #64789 bug class; applied cleanly).

   • Before trusting activeSessionId as the prompt.submit target, prove runtime ownership both directions against runtimeIdByStoredSessionIdRef: forward (is a different runtime recorded for the selected stored session?) and reverse (is this runtime recorded under a different stored session?). On any conflict, fall through to the session.resume-by-stored-id path that re-establishes the correct runtime instead of silently sending to the wrong chat. Fail closed on a missing ownership entry.
   • This closes the gap found in the prior attempt (fix(desktop): prevent prompt.submit targeting stale runtime session when identity is already split #64814 review): a forward cache miss alone cannot rule out a cross-wired runtime.

Widening (same race class, sibling site)

• use-session-tile-delegate.interruptSession (the tile Stop path) now marks the session recently interrupted — including the recovered runtime id when the interrupt triggers a session-not-found resume — so a quick tile edit/resend also goes interrupt-first during the gateway wind-down. Regression test added.

Issue #72971 assessment (prompt.submit → wrong session after switch mid-stream)

Swept for open PRs claiming this issue: #73282 (direct fix) was closed as implemented_on_main — main's submit.ts already resumes the durable routed session and verifies runtime/durable/selected agreement before submitting (f0ff8d50, v2026.7.20), and #74581 (queue re-homing leak, MERGED) covered the queue-drain variant. The remaining open coverage for the stale-reference class was #65381, salvaged here: the bidirectional ownership proof rejects exactly the stale/cross-wired activeSessionId the renderer submit path could otherwise trust after an unacknowledged session.activate. The renderer submit/edit/restore/reload paths all read activeSessionIdRef.current at call time (not closure captures) on current main, so no additional minimal fix was warranted. The issue's backend suggestions (event-loop GIL stall mitigation, activation version tokens) are out of scope for this frontend cluster.

Related Issues

• Fixes fix(desktop): edit/resend after Stop hits session-busy race condition #83855 (Stop → edit/resend session-busy race)
• Addresses [Bug]: New desktop session routes user input to existing old session instead (regression after 7/16 update) #65328 / [Desktop] prompt.submit can target stale runtime A when route and stored session already point to B #64789 class (submit routed to wrong runtime session)
• Partial coverage for Desktop GUI: prompt.submit sends to wrong session after session switch while model response is slow #72971 (stale session reference in the renderer submit path; backend WS-stall variant remains open)

Note on #84287: its 8 commits ("serialize turns across processes" turn-lease series by @fangliquanflq) are already on main — every commit landed 1:1 (6e929a9694..6b25e67047 + hardening follow-up d729019e46), confirmed via git cherry (all 8 equivalent). Nothing to salvage from it; not touched here (no close/comment per task constraints).

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✅ Tests (adding or improving test coverage)

Changes Made

• apps/desktop/src/app/session/hooks/use-prompt-actions/utils.ts — recently-interrupted cooldown registry + submit-in-flight TTL lock (salvaged)
• apps/desktop/src/app/session/hooks/use-prompt-actions/index.ts — cancelRun marks cooldown; edit/restore compute interruptFirst via shouldInterruptBeforeRewind (salvaged, rebased onto main's survivor-row rewind signature)
• apps/desktop/src/app/session/hooks/use-prompt-actions/submit.ts — TTL-lock acquire/release + bidirectional ownership proof before accepting activeSessionId (salvaged, both PRs)
• apps/desktop/src/app/chat/session-tile-actions.ts — same interrupt-first + cooldown treatment on the tile rewind/edit paths (salvaged, both PRs)
• apps/desktop/src/app/contrib/wiring.tsx — thread runtimeIdByStoredSessionIdRef to the submit hook (salvaged)
• apps/desktop/src/app/contrib/hooks/use-session-tile-delegate.ts — new: widen cooldown to the tile interrupt path
• Tests: utils.test.ts (cooldown boundary, TTL lock reclaim), index.test.tsx (forward mismatch, reverse-only proof, cache-miss resume, no-conflict control), use-session-tile-delegate.test.ts (tile interrupt cooldown). Three salvaged assertions updated to toMatchObject to tolerate the omit_messages flag main now sends on session.resume.
• contributors/emails/ — attribution mapping for @olympusbuildz (audit_pr_attribution --fix)

Validation

Check	Result
npx vitest run --project ui use-prompt-actions/{utils,rewind,index}	173/173 passed
npx vitest run --project ui use-session-tile-delegate.test.ts	3/3 passed
npx eslint (touched files)	0 errors
npm run typecheck (renderer + electron + e2e)	passed
python3 scripts/audit_pr_attribution.py --fix	all emails mapped

Credits

• @olympusbuildz — fix(desktop): interrupt-first after Stop so edit/resend avoids session-busy #84629 (interrupt-first cooldown + submit lock TTL)
• @wesleysimplicio — fix(desktop): prove submit target belongs to selected session from both directions (#65328) #65381 (bidirectional runtime-ownership proof)
• @fangliquanflq — fix(sessions): prevent concurrent resumes from losing completed replies #84287 turn-lease series (verified already landed on main)

Infographic

[github-actions]

૮ >ﻌ< ა ci review

_{ran on 42f4e60 — chore: map contributor email for salvaged PR attribution}

⚠️ Warnings

CI timings · View report · View job

Wall time 4m20s vs 3m27s (+25.6%). 16 job(s) slower, 17 faster, 4 unchanged.

• Python tests / Run tests slice 8/12: -29.0s
• JS & TS checks / apps/desktop / check:test:ui:shard-2of3: +27.0s
• JS & TS checks / apps/desktop / check:test:ui:shard-3of3: +25.0s
• Python tests / Run tests slice 1/12: -23.0s
• Python tests / Run tests slice 11/12: +22.0s

---

OSV vulnerability scan · View job

5 known vulnerabilities found in pinned dependencies.

• CVE-2026-67213 in package-lock.json
• CVE-2026-67213 in website/package-lock.json
• CVE-2026-70608 in package-lock.json
• CVE-2026-56876 in package-lock.json
• CVE-2026-70606 in package-lock.json

How to fix:

Review the findings in the Security tab. Update the affected dependencies if a patched version is available.