fix(desktop): relink Codex thread across providers

apps/desktop/src/main/__tests__/makerSendToSessionOrdering.test.ts

@@ -521,6 +521,10 @@ describe('sendToSession ordering', () => {
     );
     expect(setModelBlock).toContain('patch.effort = atomicSelection.effort;');
     expect(setModelBlock).toContain('patch.fastMode = atomicSelection.fastMode;');
+    expect(setModelBlock).toContain(
+      "result.status === 'deferred' && result.preservePersistedRoute === true",
+    );
+    expect(setModelBlock).toContain('if (!preservePersistedRoute) {');
     expect(setModelBlock).toContain('await persistSessionFields(sessionId, patch);');
     expect(setModelBlock).toContain('markRemoteSettingPersistedInsideHandler(response);');
     expectOrder(
@@ -548,6 +552,8 @@ describe('sendToSession ordering', () => {
     );
     expect(setModelBlock).toContain('pendingCredentialSwitchHolder?.clear(sessionId);');
     expect(setModelBlock).toContain('restoreControlStores();');
+    expect(setModelBlock).toContain('const hadRelink = appliedCodexThreadRelink !== undefined;');
+    expect(setModelBlock).toContain('await recoverRuntimeAfterSelectionRollback({');
     expect(setModelBlock).toContain('previousRuntime.pendingCredentialSwitch');
     expect(setModelBlock).toContain('withRehydrateCloseSuppressed(sessionId');
     expect(setModelBlock).toContain('recordRecoveredSessionRuntimeMutation(sessionId');

apps/desktop/src/main/__tests__/sessionRuntimeControlWiring.test.ts

@@ -11,6 +11,10 @@ const registerSource = readFileSync(resolve(mainRoot, 'maker-ipc/register.ts'),
   /\r\n?/g,
   '\n',
 );
+const pendingCredentialSwitchSource = readFileSync(
+  resolve(mainRoot, 'maker-ipc/pendingCredentialSwitch.ts'),
+  'utf8',
+).replace(/\r\n?/g, '\n');
 
 function handlerBody(source: string, channel: string, nextChannel: string): string {
   const start = source.indexOf(channel);
@@ -186,6 +190,287 @@ describe('session runtime control wiring', () => {
     expect(axisValidation).toBeLessThan(setModel.indexOf('persistSessionFields(sessionId'));
   });
 
+  it('rolls back a committed Codex thread relink when atomic route persistence fails', () => {
+    const setModel = handlerBody(
+      registerSource,
+      'const handleSetModel = async (',
+      'const recoverRemoteRuntimeAxisPersistence',
+    );
+    const persist = setModel.indexOf('await persistSessionFields(sessionId, patch)');
+    const rollback = setModel.indexOf(
+      'const restored = await rollbackAppliedCodexThreadRelink()',
+      persist,
+    );
+
+    expect(persist).toBeGreaterThan(-1);
+    expect(rollback).toBeGreaterThan(persist);
+    expect(setModel).toContain("throw new Error('Codex thread relink rollback was superseded')");
+  });
+
+  it('rolls back the complete persisted route before an owner-boundary request exits', () => {
+    const setModel = handlerBody(
+      registerSource,
+      'const handleSetModel = async (',
+      'const recoverRemoteRuntimeAxisPersistence',
+    );
+    const guard = setModel.indexOf(
+      'const rollbackRuntimeSelectionForSupersededOwner = async (): Promise<boolean> => {',
+    );
+    const rollback = setModel.indexOf('await rollbackAppliedRuntimeSelection();', guard);
+    const ownerFailure = setModel.indexOf('assertRuntimeOwnerCurrent();', guard);
+
+    expect(setModel).toContain('!isAppSessionBoundaryPending()');
+    expect(setModel).toContain('const rollbackAppliedRuntimeSelection = async ()');
+    expect(setModel).toContain('const runtimeDbSnapshot = getCurrentDbClientSnapshot();');
+    expect(setModel).toContain('effort: sessions.effort');
+    expect(setModel).toContain('fastMode: sessions.fastMode');
+    expect(setModel).toContain('rollbackPersistedCodexRuntimeSelection({');
+    expect(setModel).toContain('sdkSessionId: runtimeStatus.sdkSessionId');
+    expect(setModel).toContain('model: runtimeStatus.model');
+    expect(setModel).toContain('providerId: runtimeStatus.providerId');
+    expect(setModel).toContain('effort: runtimeStatus.effort');
+    expect(setModel).toContain('fastMode: runtimeStatus.fastMode');
+    expect(setModel).toContain('eq(sessions.model, expected.model)');
+    expect(setModel).toContain('eq(sessions.sdkSessionId, expected.sdkSessionId)');
+    expect(setModel).toContain('eq(sessions.providerId, expected.providerId)');
+    expect(setModel).toContain('eq(sessions.effort, expected.effort');
+    expect(setModel).toContain('eq(sessions.fastMode, expected.fastMode)');
+    expect(guard).toBeGreaterThan(-1);
+    expect(rollback).toBeGreaterThan(guard);
+    expect(ownerFailure).toBeGreaterThan(rollback);
+    expect(setModel.match(/await rollbackRuntimeSelectionForSupersededOwner\(\)/g)).toHaveLength(3);
+    const outerCatch = setModel.lastIndexOf('} catch (err) {');
+    expect(setModel.indexOf('await rollbackAppliedRuntimeSelection();', outerCatch)).toBeGreaterThan(
+      outerCatch,
+    );
+  });
+
+  it('restores host stores and retires the live session after a post-selection failure', () => {
+    const setModel = handlerBody(
+      registerSource,
+      'const handleSetModel = async (',
+      'const recoverRemoteRuntimeAxisPersistence',
+    );
+    const runtimeRecovery = setModel.indexOf(
+      'const recoverRuntimeAfterSelectionRollback = async (',
+    );
+    const ownerGuard = setModel.indexOf('const runtimeRecoveryCurrent =', runtimeRecovery);
+    const restoreStores = setModel.indexOf('restoreControlStores();', ownerGuard);
+    const retireLiveSession = setModel.indexOf(
+      'await withRehydrateCloseSuppressed(sessionId, () => maker.closeSession(sessionId));',
+      restoreStores,
+    );
+    const restoredRouteBroadcast = setModel.indexOf(
+      'broadcastSessionPatched(\n          sessionId,\n          {\n            ...restoredState,',
+      retireLiveSession,
+    );
+    const reconcileRetainedLive = setModel.indexOf(
+      'await reconcileRetainedLiveProfile();',
+      restoredRouteBroadcast,
+    );
+    const rollbackFailure = setModel.indexOf(
+      "'runtime selection rollback could not retire the live session'",
+      reconcileRetainedLive,
+    );
+    const rollback = setModel.indexOf(
+      'const rollbackAppliedRuntimeSelection = async (): Promise<boolean> => {',
+      rollbackFailure,
+    );
+    const sqliteRestore = setModel.indexOf('rollbackPersistedCodexRuntimeSelection({', rollback);
+    const projectionRead = setModel.indexOf('const projectionMeta = await maker.getSessionMeta(sessionId);');
+    const outerCatch = setModel.lastIndexOf('} catch (err) {');
+
+    expect(ownerGuard).toBeGreaterThan(runtimeRecovery);
+    expect(restoreStores).toBeGreaterThan(ownerGuard);
+    expect(retireLiveSession).toBeGreaterThan(restoreStores);
+    expect(restoredRouteBroadcast).toBeGreaterThan(retireLiveSession);
+    expect(reconcileRetainedLive).toBeGreaterThan(restoredRouteBroadcast);
+    expect(rollbackFailure).toBeGreaterThan(reconcileRetainedLive);
+    expect(rollback).toBeGreaterThan(rollbackFailure);
+    expect(sqliteRestore).toBeGreaterThan(rollback);
+    expect(setModel.slice(retireLiveSession, restoredRouteBroadcast)).toContain(
+      'if (recoveryErrors.length === 0)',
+    );
+    expect(setModel.slice(ownerGuard, restoreStores)).toContain('runtimeOwnerBoundaryCurrent()');
+    expect(setModel.slice(ownerGuard, restoreStores)).toContain(
+      'getCurrentDbClientSnapshot()?.clientEpoch === runtimeDbSnapshot.clientEpoch',
+    );
+    expect(projectionRead).toBeGreaterThan(retireLiveSession);
+    expect(outerCatch).toBeGreaterThan(projectionRead);
+    expect(setModel.indexOf('await rollbackAppliedRuntimeSelection();', outerCatch)).toBeGreaterThan(
+      outerCatch,
+    );
+  });
+
+  it('compensates ordinary renderer runtime state when a post-relink metadata read fails', () => {
+    const setModel = handlerBody(
+      registerSource,
+      'const handleSetModel = async (',
+      'const recoverRemoteRuntimeAxisPersistence',
+    );
+    const rollback = setModel.indexOf(
+      'const rollbackAppliedRuntimeSelection = async (): Promise<boolean> => {',
+    );
+    const noPersistedRoute = setModel.indexOf('if (!persistedRoute) {', rollback);
+    const captureRelink = setModel.indexOf(
+      'const hadRelink = appliedCodexThreadRelink !== undefined;',
+      noPersistedRoute,
+    );
+    const rollbackRelink = setModel.indexOf(
+      'const restored = await rollbackAppliedCodexThreadRelink();',
+      captureRelink,
+    );
+    const runtimeRecovery = setModel.indexOf(
+      'await recoverRuntimeAfterSelectionRollback({',
+      rollbackRelink,
+    );
+    const projectionRead = setModel.indexOf(
+      'const projectionMeta = await maker.getSessionMeta(sessionId);',
+    );
+    const outerCatch = setModel.lastIndexOf('} catch (err) {');
+    const outerRollback = setModel.indexOf(
+      'await rollbackAppliedRuntimeSelection();',
+      outerCatch,
+    );
+
+    expect(noPersistedRoute).toBeGreaterThan(rollback);
+    expect(captureRelink).toBeGreaterThan(noPersistedRoute);
+    expect(rollbackRelink).toBeGreaterThan(captureRelink);
+    expect(runtimeRecovery).toBeGreaterThan(rollbackRelink);
+    expect(setModel.slice(runtimeRecovery, runtimeRecovery + 500)).toContain(
+      'sdkSessionId: runtimeStatus.sdkSessionId',
+    );
+    expect(setModel.slice(runtimeRecovery, runtimeRecovery + 500)).toContain(
+      'providerId: runtimeStatus.providerId',
+    );
+    expect(projectionRead).toBeGreaterThan(runtimeRecovery);
+    expect(outerRollback).toBeGreaterThan(outerCatch);
+  });
+
+  it('treats teardown pending as stale at the final relink commit boundary', () => {
+    const relink = handlerBody(
+      registerSource,
+      'export async function relinkCodexThreadForCredentialSwitch(',
+      'export function clearPendingCredentialSwitchForSession(',
+    );
+    const guardedCommit = relink.indexOf(
+      'commitCodexProviderThreadRelinkWithBoundaryGuard({',
+    );
+    const pendingGuard = relink.lastIndexOf('!isAppSessionBoundaryPending()', guardedCommit);
+    const broadcast = relink.indexOf('broadcastSessionPatched(', guardedCommit);
+
+    expect(pendingGuard).toBeGreaterThan(-1);
+    expect(pendingGuard).toBeLessThan(guardedCommit);
+    expect(broadcast).toBeGreaterThan(guardedCommit);
+    expect(relink).toContain('rollbackCapturedRelink({');
+  });
+
+  it('passes the locked persistent thread identity into runtime model switching', () => {
+    const setModel = handlerBody(
+      registerSource,
+      'const handleSetModel = async (',
+      'const recoverRemoteRuntimeAxisPersistence',
+    );
+
+    expect(setModel).toContain('agentKind: sessions.agentKind');
+    expect(setModel).toContain('sdkSessionId: sessions.sdkSessionId');
+    expect(setModel).toContain('persistedSession: {');
+    expect(setModel).toContain('model: runtimeStatus.model');
+    expect(setModel).toContain('providerId: runtimeStatus.providerId ?? null');
+  });
+
+  it('keeps the Codex rebuild marker in the production pending-switch projection', () => {
+    const getter = handlerBody(
+      registerSource,
+      'export function getPendingCredentialSwitchTarget(',
+      '// ── Scheduler 撞忙排队桥',
+    );
+
+    expect(getter).toContain('pending.rebuildCodexThread');
+    expect(getter).toContain('{ rebuildCodexThread: true }');
+    expect(getter).toContain('pending.codexThreadRelinkCommitted');
+    expect(getter).toContain('{ codexThreadRelinkCommitted: true }');
+    expect(getter).toContain('pending.ownerScope');
+    expect(getter).toContain('pending.sourceCodexThreadModelProviderId');
+    expect(getter).toContain('pending.previousRoute');
+    expect(getter).toContain('pending.restoreStaleOwnerRoute');
+  });
+
+  it('restores the source route before an in-memory relink pending can be lost on restart', () => {
+    const registration = handlerBody(
+      registerSource,
+      'export async function registerPendingCredentialSwitchForSession(',
+      '/**\n * 跨订阅远端压缩身份边界时',
+    );
+    const restartSafeRestore = registration.indexOf(
+      'const restored = await restoreStaleOwnerRoute({',
+    );
+    const registrationAttempt = registration.indexOf('const registered = await service.register(');
+
+    expect(registration).toContain('model: capturedPrevRow.model');
+    expect(registration).toContain('providerId: capturedPrevRow.providerId');
+    expect(registration).toContain('effort: capturedPrevRow.effort');
+    expect(registration).toContain('fastMode: capturedPrevRow.fastMode');
+    expect(registration).toContain(
+      'Codex pending credential switch could not preserve the source route',
+    );
+    expect(restartSafeRestore).toBeGreaterThan(-1);
+    expect(registrationAttempt).toBeGreaterThan(restartSafeRestore);
+  });
+
+  it('binds deferred credential switches to the captured owner scope and runtime epoch', () => {
+    const registration = handlerBody(
+      registerSource,
+      'export async function registerPendingCredentialSwitchForSession(',
+      '/**\n * 跨订阅远端压缩身份边界时',
+    );
+    const service = handlerBody(
+      registerSource,
+      'const pendingCredentialSwitchService = new PendingCredentialSwitchService({',
+      'pendingCredentialSwitchHolder = pendingCredentialSwitchService;',
+    );
+
+    expect(registration).toContain('ownerScopeKey: activeOwnerScopeKey()');
+    expect(registration).toContain(
+      'runtimeOwnerEpoch: captureSessionRuntimeControlOwnerEpoch()',
+    );
+    expect(registration).toContain('target.ownerScope ??');
+    expect(registration).toContain('const dbSnapshot = getCurrentDbClientSnapshot();');
+    expect(registration).toContain('const sourcePersistedSession = target.sourcePersistedSession;');
+    expect(registration).toContain('sourcePersistedSession.sdkSessionId');
+    expect(registration).toContain('sourcePersistedSession.fastMode');
+    expect(registration).toContain('restoreCapturedProfileRoute');
+    expect(registration).toContain('const appliedRoute = persistedRoute ??');
+    expect(registration).toContain('eq(sessions.model, appliedRoute.model)');
+    expect(registration).toContain('sdkSessionId: capturedPrevRow.sdkSessionId');
+    expect(registration).toContain('model: capturedPrevRow.model');
+    expect(registration).toContain('providerId: capturedPrevRow.providerId');
+    expect(registration).toContain('effort: capturedPrevRow.effort');
+    expect(registration).toContain('fastMode: capturedPrevRow.fastMode');
+    expect(registration).toContain(
+      'Codex pending credential switch requires an old-profile rollback snapshot',
+    );
+    const registrationAttempt = registration.indexOf('const registered = await service.register(');
+    const registrationFailure = registration.indexOf('if (!registered) {', registrationAttempt);
+    const failureReturn = registration.indexOf(
+      "throw new Error('Pending credential switch owner changed during registration')",
+      registrationFailure,
+    );
+    expect(registrationAttempt).toBeGreaterThan(-1);
+    expect(registrationFailure).toBeGreaterThan(registrationAttempt);
+    expect(failureReturn).toBeGreaterThan(registrationFailure);
+    expect(pendingCredentialSwitchSource).toContain('restoreStaleOwnerRoute');
+    expect(pendingCredentialSwitchSource).toContain(
+      'await this.compensateStaleOwnerRoute(sessionId, pending);',
+    );
+    expect(pendingCredentialSwitchSource).toContain('this.staleDiscards.has(target)');
+    expect(service).toContain('!isAppSessionBoundaryPending()');
+    expect(service).toContain('activeOwnerScopeKey() === scope.ownerScopeKey');
+    expect(service).toContain(
+      'sessionRuntimeControlOwnerEpochMatches(scope.runtimeOwnerEpoch)',
+    );
+  });
+
   it('commits user effort and Fast state only after the live runtime call succeeds', () => {
     const effort = handlerBody(
       registerSource,