fix(desktop): serve the last connection snapshot while a refresh is in flight (#4611)

[me2seeks]

Summary

With a healthy model connection configured, the composer intermittently showed 「还没有可用的模型连接，无法发送。前往模型设置」 and disabled Send, then recovered on its own (issue screenshot). On remote Hosts the window is seconds, not milliseconds.

Root cause: useShellConnections emptied its exposed snapshot on every refresh — refreshConnections() wrote {status:'refreshing'} (no snapshot), and the getter served EMPTY_SNAPSHOT until the IPC read landed. app-shell.tsx passes noModelConnection={connections.length === 0}, so every connection_list_changed event, mount, and session switch produced a "no model" window that blocked send. Worse, a failed refresh stayed refreshing forever — the banner never cleared.

Changes, all inside use-shell-connections.ts:

1. Stale-while-revalidate: a refresh keeps serving the last ready snapshot until the new read lands; only unrequested (nothing ever read) still reads empty.
2. Fix the dead seedSnapshot (found in adversarial review): the mount layout effect always wrote the in-flight entry before the shell's passive seed effect ran, so the has(key) guard made every seed a no-op and the initialOnboardingSnapshot fallback in app-shell.tsx unreachable. The guard is relaxed to "no snapshot yet", so the startup snapshot fills the first-paint and failed-first-refresh windows; a successful read still overwrites it.
3. Gate the carry by Host identity (PR review): the default target uses one constant key while the Host behind it can change (profile switch), so its refreshing write now happens inside runOnDefaultRuntimeHost with the resolved identity in hand, and a snapshot produced by the previous default Host is dropped instead of served into the new one's read window. Session/new-task targets key by hostId already, so their carry is always same-Host.

This deliberately reverses the previously test-encoded invalidate-on-refresh contract ("stop exposing previous mutation targets immediately"). Trade-off, stated honestly: a just-deleted connection can remain selectable for one IPC round-trip on the same Host. Every use of a connection is re-validated by the Host (NO_REAL_CONNECTION path with a targeted toast), while the old behavior produced a user-facing dead-end on every refresh and a permanent dead-end after a failed one.

Fixes #4611

Verification

• apps/desktop full suite: 1963 tests, 0 fail — including the rewritten stale-while-revalidate contract test, three new hook tests (seed fills an in-flight first refresh; refresh resolving to a genuinely empty catalog ends ready + empty; first load reads empty until ready), and a default-Host-switch regression test that fails on the pre-fix code (verified by reverting the guard).
• Renderer architecture ratchet passes against the merge base (check-renderer-architecture.mjs --base …).
• tsc -p apps/desktop/tsconfig.main.json clean; biome check clean on changed files.

Known residual (follow-up)

Cold start with a restored active session (or first switch to a not-yet-read Host) can still flash the banner for one IPC round-trip: the session projection is host-keyed and never seeded. Closing it needs a composer-side "settled" predicate in app-shell.tsx, and the renderer architecture ratchet forbids growing that file (attempted; CI rejected the +1 import). The follow-up is an extraction that shrinks the shell enough to pay for the predicate.

Review focus

Two rounds of adversarial sub-agent review plus the automated PR review were run against this diff. Found and fixed: the dead-seed root cause, the missing empty-catalog regression test, and the default-Host identity carry-over. One earlier iteration of this PR also tightened the composer banner predicate in app-shell.tsx; it was reverted because the architecture ratchet forbids the shell growing — see Known residual.

AI use

• Generative tooling made a substantive contribution

Tool(s) and scope: Maka (AI agent) authored the full change: issue triage, design, implementation, tests, and adversarial review iterations (also AI, with human-supervised fixes).

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above

[hqhq1025]

Found one correctness issue in the default-Host transition path. The required test check is also currently failing because the AppShell architecture ratchet reports nonTriviaTokens growing from 15725 to 15784.

Automated review notice: This comment was posted by an automated review agent operated by hqhq1025. It is not an independent human review and does not replace one.

[M4n5ter]

Reviewed exact head 1eb42bcedc746543ec6d3d7b51d01e85b49a3afe.

The original cross-Host stale snapshot defect is closed: the default Host identity is resolved before deciding whether an existing snapshot may be carried. I found one separate P2 refresh-ordering race, detailed inline. It can temporarily clear the connection catalog and block sending, but it neither exposes another Host's catalog nor corrupts durable state, and a subsequent refresh recovers it. I am approving with that follow-up comment.

The exact-head test check is green and the current-main merge result is clean.

---

Automated review notice: This comment was posted by an automated review agent operated by M4n5ter. It is not an independent human review and does not replace one.

[M4n5ter]

P2: Fence this state write with the refresh sequence. A default-Host refresh increments the sequence before awaiting getDefaultHost(), but this callback writes refreshing after that await without checking whether the request is still current. I reproduced the following ordering on this exact head: refresh A waits while resolving its Host; refresh B resolves Host B, reads its snapshot, and publishes ready(connection-b2); then A resolves Host A and this call replaces the newer projection with refreshing and no snapshot. A's eventual result is correctly discarded by the later sequence check, so nothing restores the projection and it remains empty until another refresh or reload. Guard markRefreshing with the same sequence (inside the state updater as well), and add a delayed-default-resolution regression.

---

Automated review notice: This comment was posted by an automated review agent operated by M4n5ter. It is not an independent human review and does not replace one.