fix(desktop): bound the shared resume flight and adopt its straggler

[JoaoMarcos44]

Summary

Closes #96522.

singleFlightSessionResume() shares ONE promise per stored session id across every Desktop surface that can recover a dead runtime, and the slot is released only by that promise's .finally(). An unsettled run() therefore makes the conversation unrecoverable for the life of the window, and the rejection-driven retry ladder never arms because nothing ever rejects.

This PR bounds the flight and decides what the straggler means — because a deadline on its own trades a hang for a stranded runtime.

Root cause

The RPC is already bounded: HermesGateway sets requestTimeoutMs = DEFAULT_GATEWAY_REQUEST_TIMEOUT_MS (30s). The run() bodies are not just that RPC — they resolve the owning profile first, and resolveStoredSession() probes backends sequentially on a cache miss, one 30s getSession() per configured profile. Settlement time scales with profile count; a probe wedged the way #93454 describes never settles at all.

Because the map is module-level, a wedge created by any ONE entry point wedges all five:

Call site	Surface
resolve-target-session.ts:101	route resolver
utils.ts:122 (resumeStoredRuntimeSession)	shared recovery
submit.ts:592	prompt submit
use-session-actions/index.ts:1393	cold resume
use-session-tile-delegate.ts:198	tile resume

The half a deadline does not fix

withTimeout() says it outright:

/** Rejection raised by withTimeout. The bounded work is NOT cancelled — the
 * caller decides what a straggler that settles later means. */

For session.resume the straggler is not inert. _claim_or_reuse_live() registers the record before returning, so a late resume has already minted a real runtime on the gateway. Dropping it strands that runtime for the reaper AND makes the next recovery mint another — the per-resume orphan shape this module was built to stop (#91276). The module already solved the identical problem for drift-aborts via registerRecoveredRuntime() / takeRecoveredRuntime(); nothing wired the timeout path into it.

%%{init: {'theme': 'dark', 'themeVariables': { 'primaryColor': '#8b0000', 'mainBkg': '#0a0204', 'primaryTextColor': '#ffccd5', 'primaryBorderColor': '#ff0038', 'lineColor': '#ff0038'}}}%%
graph TD
    A["🩸 Five Recovery Surfaces"] -->|"one shared slot per stored id"| B["🔥 Single Flight"]
    B --> C["⛓️ Profile Ladder<br/>30s per configured backend"]
    C --> D["📡 session.resume RPC<br/>30s budget"]
    B --> E{"⏳ Settlement Ceiling<br/>90s = 30 + 30 + 30"}
    E -->|"settles in budget"| F["⚔️ Runtime Adopted<br/>slot released"]
    E -->|"exceeded"| G["💀 Flight Rejected<br/>slot released · retry ladder arms"]
    G --> H["🕯️ Straggler Still Lands<br/>work was never cancelled"]
    H -->|"no newer flight owns the id"| I["🔮 Recovered-Runtime Cache<br/>next action adopts it"]
    H -->|"newer flight owns the id"| J["🚫 Discarded<br/>its caller adopts its own result"]
    I --> F

Loading

Implementation

• SESSION_RESUME_SETTLEMENT_TIMEOUT_MS = 90_000, derived rather than picked round: active-profile probe (30s, Electron DEFAULT_FETCH_TIMEOUT_MS) + one cross-profile probe (30s) + the resume RPC (30s). A slow-but-healthy multi-profile recovery is never aborted; past that point the flight has held the slot longer than any single healthy recovery needs.
• The flight is wrapped in the repo's existing withTimeout(). Its .finally() still frees the slot, so the next caller gets a FRESH attempt and the existing rejection-driven ladder arms.
• onTimeout attaches a late-settle handler: a straggler that yields a session_id is handed to registerRecoveredRuntime(). Guarded two ways — a straggler that rejects minted nothing, and one that lands while a newer flight already owns the stored id is discarded, because that flight's caller will adopt its own result.
• singleFlightSessionResume() takes an optional timeoutMs so tests can pin the boundary; every production caller uses the derived default.

Two files, +167 / −6. No new dependency, no new module, no behavior change on the success path.

Test plan

apps/desktop/src/app/session/hooks/use-prompt-actions/single-flight-resume.test.ts — 13 passed (6 existing + 7 new).

New test	Pins
a never-settling resume rejects at the deadline instead of wedging the slot forever	the ceiling fires
a later caller for the same stored id gets a FRESH attempt, not the dead flight	the slot is released
a joiner of an already-wedged flight inherits the same deadline	joiners are bounded too
a slow-but-legitimate resume (profile probe + RPC) still settles inside the ceiling	89s healthy resume is not aborted
a runtime minted by a timed-out resume is adopted, not stranded on the gateway	the straggler reaches the cache
a straggler is NOT cached when a newer flight already owns the stored id	no stale adoption
a straggler that fails minted nothing and caches nothing	failure path is inert

Falsification: with the production file reverted to origin/main and the tests kept, 6 of the 7 fail — by timing out at 5000 ms, which is the wedge itself. The seventh (a slow-but-legitimate resume…) passes on old code because old code has no ceiling at all; it exists so a future tightening of the constant cannot silently start aborting legitimate recoveries.

Local run notes

The desktop vite.config.ts in this checkout imports @rolldown/plugin-babel, which is declared in apps/desktop/package.json but absent from the installed tree, and npm install refuses on this machine (EBADENGINE: repo requires npm <11.10.0 || >=11.17.0, local is 11.4.1). The suite was therefore run through a throwaway vitest config providing only the @ alias — the module under test needs nothing else. That config was deleted and is not part of this diff. Hosted CI remains the authority.

Non-duplicate analysis

• fix(desktop): stop unresumable sessions from waking forever #95926 / Desktop: resume of an ended/unresumable session spins 'Waking up…' forever — no error, no Retry (bounded-retry ladder never arms) #95910 (@fangliquanflq) own the user-visible "Waking up… forever" report and add a 35s settlement deadline in this same file. Correct direction, and credited. Two things separate this PR: (a) the abandoned runtime a deadline creates is not addressed there, and it is the specific orphan this module exists to prevent; (b) 35s sits below the derived legitimate worst case — one cross-profile probe plus the RPC is already 60s — so it can abort a healthy multi-profile recovery and re-mint. If fix(desktop): stop unresumable sessions from waking forever #95926 lands first this becomes a small follow-up that raises the constant and adds the adoption; if this lands first, fix(desktop): stop unresumable sessions from waking forever #95926's symptom is covered and its cold-resumeSession regression test still applies.
• [Bug]: macOS Desktop — session not found / dead chat after reconnect (history still in SQLite) #91276 is the resume-storm this module was built for. The orphan here is that same failure mode re-entering through the timeout path.
• Desktop: remote gateway reconnect hangs indefinitely after liveness-probe trip, requires manual app restart #93454 is the unbounded main-process IPC round-trip class that can put a probe into a non-settling state; this PR bounds the consequence, not that cause.
• fix(tui-gateway): serialize WS session transport ownership #95709 touches gateway-side session/transport ownership (tui_gateway). Disjoint file set, disjoint concern — the gateway behaves correctly here; it is the client that abandons a runtime it asked for.

Type of change

• Bug fix (non-breaking change that fixes an issue)

Checklist

• Derived, not guessed, constant with the derivation written into the code
• New tests fail on the prior behavior (falsification recorded above)
• No new dependency, module, or public surface beyond one exported constant and one optional parameter
• Success path unchanged

[Enough1122]

AI code review — automated review for reference; please use your judgment.

fix(desktop): bound the shared resume flight and adopt its straggler — prevents singleFlightSessionResume wedge and strands no gateway runtime.

• apps/desktop/src/app/session/hooks/use-prompt-actions/single-flight-resume.ts — wraps the run() promise with withTimeout(SESSION_RESUME_SETTLEMENT_TIMEOUT_MS) (95s ceiling derived from 3×30s = active-profile getSession probe + one cross-profile probe + resumeStoredRuntimeSession RPC, each on DEFAULT_FETCH_TIMEOUT_MS). isTimeoutError deadline rejects the shared slot so .finally() clears _inFlightResumeByStoredSessionId, un-wedging later callers. Subsequent caller for same storedSessionId gets a fresh attempt rather than joining the dead flight; joiners of an already-wedged flight inherit the same deadline (shared promise), so no caller hangs past the ceiling.
• Straggler adoption: if the timed-out RPC later lands a registered runtime (90s+ probe), its session_id is cached via registerRecoveredRuntime so the next resume-shaped action reuses it instead of minting a duplicate; if a newer flight already claimed the slot, the straggler is dropped (not cached), avoiding wrong-runtime aiming. Failure to mint caches nothing. afterEach fix vi.useRealTimers() ensures fake-timer tests don't leak.
• Tests in single-flight-resume.test.ts cover all edges: never-settling → timeout, fresh attempt after timeout, joiner inherits deadline, 89s healthy slow resume still settles inside ceiling, late land → takeRecoveredRuntime hit, late land contended → not cached, late failure → not cached. Thorough regression for the share-by-promise slot.
• Tight ceiling is deliberately conservative (95s, not 90s) so legitimate 89s probe chains are not aborted — good tradeoff between liveness and correctness.