fix(desktop): re-bind open pane to rebuilt runtime after model switch

[beplee]

Fixes part of #93942

Summary

A mid-conversation model/provider switch rebuilds the agent runtime. The rebuilt runtime emits session.info and all later events under a NEW explicit session_id while the pane still holds the dead id as its active session — isActiveEvent goes false for the same conversation, so the open chat freezes until a full resume (scenario B of #93942; the backend even logs "client should resume the stored session," but the client never does).

Mechanism

Event routing pins explicit-sid events correctly (gateway-events.ts:resolveGatewayEventSessionId), but identity matching is (newId === activeSessionIdRef.current) at index.ts:196 — a rebuilt runtime's new id never matches. The existing compression-rotation path doesn't cover this: it fires when the same runtime's stored id rotates; a rebuild produces a new runtime with a new stored id.

This PR

When a session.info lineage-matches the selected conversation (sessionMatchesStoredId over stored_session_id) but carries a different runtime id, adopt the new runtime id as the active session id — durable selection untouched — so every downstream isActiveEvent gate keeps matching without a resume. Guarded: adoption refused while the old runtime shows any live turn (busy/awaiting/streaming), so an overlapping manual switch can never split a conversation across panes.

Non-goals

• No changes to tile reconcile (fix(desktop): reconcile workspace-tile transcripts on sessions.changed #94255 covers that), event routing rules, or backend retry behavior.
• No auto-resume: if the guard refuses adoption (live turn overlap), behavior stays as today until the turn settles.

Test plan

Two regression tests verified failing pre-fix on 41447a6d70; adjacent gateway-event suites 130/130; typecheck clean ×3 projects; eslint clean on touched file.

Together with #94255, closes #93942.

Platforms: Electron desktop, platform-independent logic; tested on Linux (Pop!_OS 24.04).

[Enough1122]

AI code review — automated review for reference, author can ignore or act on any point.

The re-bind mechanism itself looks sound: lineage-matching via stored_session_id, refusing adoption while the old runtime is busy/streaming, and keeping the durable selection untouched are all the right guards for #93942 scenario B.

Points to consider:

1. The regression tests grep source text instead of testing behavior — both tests in tests/desktop/test_bots_chat_stream_rekey.py assert on regex matches over the .ts file: uses >= 3 (test_bots_chat_stream_rekey.py:57) and a 2000-char window containing "busy" (:69-73). They survive any refactor that keeps the identifiers and break on harmless renames, while proving nothing about runtime behavior. Also the second assertion has a precedence hazard: m and "busy" in ... or "state?.busy" in src evaluates as (m and ...) or ..., so it can pass with m === null. A vitest spec driving handleSessionInfoEvent with stubbed deps (asserting setActiveSessionId fires only for a lineage-matching, non-busy rebuild) would actually pin the contract.

2. Rebind requires stored_session_id — the early return when payload?.stored_session_id isn't a string (session-info.ts:84) means a rebuilt runtime that announces itself without one is never adopted. If that field is guaranteed by the gateway, fine; otherwise this path stays broken silently.

3. State entry for the new runtime — after setActiveSessionId(explicitSid) (session-info.ts:103-104), consider ensuring a session-state bucket exists for the new id before subsequent stream events arrive, rather than relying on the apply || rebound patch path to create it.

Minor: deps.sessionStateByRuntimeIdRef vs ctx.deps.activeSessionIdRef mixed styles in one function; and the dead runtime's entry lingers in the map forever.

[beplee]

Good catches — addressed in 953806a7 (test-only, +49/−5, no production change):

1. The precedence hazard was real; the busy-guard assertion now scopes precisely to the rebind helper's body — no more 2000-char window with the (m and X) or Y trap.
2. Checked the backend: session.info always stamps stored_session_id (server.py sets it from session_key or ""), and the rebind refuses non-string/empty values so an unnamed rebuilt runtime can't be adopted as lineage proof. Pinned with a third assertion.
3. The adopted id's state bucket is created by the same event's apply || rebound updateSessionState patch, so no eager creation needed.
4. Dead runtime entries are reaped by the existing cache prune (nothing references them after adoption). On vitest-behavior conversion: agreed as follow-up, same as fix(desktop): reconcile workspace-tile transcripts on sessions.changed #94255 — these structural assertions stay as drift alarms meanwhile.

3/3 tests green on base 1bbb6e5bce.

[beplee]

Follow-up: rebased onto current upstream main (1bbb6e5bce — branch had drifted 69 commits behind, which surfaced as a STALE_BRANCH_DEP red in JS & TS checks, same class as our earlier @types/plist hit). Diff shape unchanged, tests 3/3 green post-rebase. Head is now 8addac0f38.

[beplee]

Root-caused the red and fixed by rebase: the failing check is the known window is not defined teardown crash in user-edit-composer.tsx — upstream already fixed it in 37a8c10ab1 ("stop the edit composer's timers from outliving it", now on main). Our branch predated that commit, so every CI run kept hitting the flake. Rebased onto current main (a935154378) — the timer fix rides in, our diff unchanged (2 files, test + session-info.ts, 3/3 green locally on the new base). Head is now 3faf39fd02. This closes the red deterministically rather than gambling on a rerun.

[teknium1]

Merged via #95600 (rebase-merge) — your model-switch runtime re-bind + hardened assertions are on main as-authored: f4e8eb1. Thanks @beplee! (Folded together with #94255 into the consolidated stale-transcript fix.)