fix(mobile): stop pinning sent messages below newer history#23546

Approvability

Verdict: Approved at f8b4ea3

Macroscope's review found this PR approvable — This is a focused mobile reconciliation fix that uses existing server and snapshot sequence data to remove stale temporary message rows without changing pending-send behavior or wire contracts. The accompanying runtime plumbing and regression tests are narrowly scoped to this behavior.

^{You can add or adjust custom eligibility rules. Learn more.}

Review in Change Stack →

No actionable comments were generated in the recent review.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

thanks @only21mil. using committed receipt ordering instead of client timestamps is the right fix for accepted messages outside bounded history. i preserved your commits and merged current main into this branch.

i added one regression in the existing composer test to exercise main's rewritten composer: an older snapshot retains the accepted row, a bounded snapshot at the receipt sequence removes it, and an unbounded snapshot keeps the echo fallback. this fails against main's composer and passes with your fix. a one-line empty-acknowledgment guard also satisfies current main's effect-dependency lint rule.

verification at 2d60f937e0a9d6255ed37d71f4bac63b39107566:

• blacksmith vp run check:changed passed formatting, lint, both knip passes, seven package typechecks, and 90 tests across six files.
• all 28 ci checks passed. two independent code reviews approved this head without blocking findings. the automatic review bot hit its review limit on this update; its previous review covered the original head.
• current native interaction, cleanup timing, and fresh before/after captures remain unverified. the task's dev server started successfully, but adb has no device and t3's device service returned "agent device access is turned off for this environment." the existing native captures in the body are the original author's evidence, not a verification of this updated head. the dev server and test worker are stopped.

@only21mil, one pre-existing follow-up remains outside this existing-thread fix: the creation path calls completeQueuedMessageDelivery without a message-dispatch sequence. its first prompt can still remain pinned if it leaves the bounded window before the thread is opened. a launch receipt cannot safely substitute for the later initial-message commit sequence.

code and ci are ready for review; fresh native verification remains the outstanding gate.

Verified in a real dev environment

No changed behavior could be verified on this Linux Boat VM. This is an unverifiable result, not a passing verification.

I read the description, all discussion, the ten-file diff, and the eight PR commits at aa84d791f2991826016408c913acf848c7f55d6d. The PR is open and none of its commits are authored by @juliusmarminge or @t3dotgg. GitCafe also identifies this as PR #23546. Its stored CI status reports 28 successful checks, zero failing and zero pending; those are not runtime proof.

The changed interaction is native mobile: send in an existing thread, leave before the echo arrives, let newer turns move that message outside bounded history, and reopen. The fix carries the send receipt sequence into mobile acknowledgment reconciliation and retires the old local row only when a sufficiently recent bounded snapshot covers it. The web client does not use this acknowledgment store, so a Playwright web pass would not exercise the fix.

Device preflight in this VM:

The repository native verification skill requires stopping verification when device access is unavailable. I started no dev server, made no source changes, and captured no app screenshots or recordings. Previous author captures were not reused as evidence for this attempt.

Not verified

The original failure on github/main; this head through the native client and real Codex gpt-6.1-sol provider path; reopening without the stale bottom row; loading earlier activity to recover the historical message; pending/offline sends; receipt-before-echo behavior; cross-thread/environment isolation; and native iOS/Android rendering and timing all remain unverified. No main/PR installation or runtime comparison was attempted after the device blocker. No new checks were run and no fix was made.

Verification needs an enabled device host and an Android device/emulator (or an authorized iOS host), then matching main/head runs with real provider turns and fresh before/after captures.

Verified on Android emulator (API 35) against a real dev server

verified head aa84d791f2991826016408c913acf848c7f55d6d on the t3 android emulator with the matching cached native dev client, metro, and an isolated backend at port 13773 using /home/user/t3code/.t3. no mocks or demo provider were used. codex gpt-6.1-sol completed the turns through the local proxy.

• sent bounded user marker 23546 in an existing thread while the owned backend was paused. the pending row remained visible. left through the header back button, opened a second real thread, then resumed the backend so the outbox delivered without the original detail mounted.
• sent twelve newer user messages through the real web composer to the same thread, waiting for each real codex reply (WEB01 through WEB12). reopened on android without restarting the app. the recent feed ended at WEB12; the old local marker was not appended below it.
• scrolled to the top: load earlier activity was present, and the bounded window began at user turn 03. loaded earlier activity and recovered the marker and USERMARKER reply before WEB01, in chronological order.
• neighboring checks passed: an offline pending row was retained and delivered after reconnect; a normal android send received NEIGHBOROK once; the second thread never displayed the first thread's marker.

an initial attempt used cli-authored agent turns, which do not count toward the ten-user-turn cutoff. it was discarded as proof of bounded reconciliation. the final pass above uses actual user messages.

fresh blacksmith vp run check:changed passed: formatting, lint, both knip passes, seven package typechecks, and 94 tests across six files. the stored pr status also reports 28 successful ci checks. no source changes or pushes were needed.

the screenshots show the same marker before delivery, after reopening, the bounded-window control, and its recovered historical position. the recording shows reopening and scrolling to the bounded-window control.

android pending marker before delivery

android reopened feed ends at WEB12 without the old marker

android bounded history starts at user turn 03

android marker recovered before WEB01 after loading earlier activity

android reopening and bounded-history interaction

Not verified

ios cannot run on this linux vm. the original failure on github/main, initial-thread creation without a dispatch sequence, deliberately delayed receipt-before-echo delivery, other providers, physical devices, and release builds were not exercised. the before screenshot is the pending state on this pr head, not a main-build comparison.