fix(macapp): setCost failure status erased by its own reload + deferred manual smokes from #991

[dennisonbertram]

Observed behavior

In macapp/Sources/GoCodeUI/ModelSettingsView.swift, ModelSettingsModel.setCost (lines 132–140) was not brought in line with the fix applied elsewhere in this same file for fetch/setExposed/setAllVisible/saveProvider/delete (epic #991, slice U8, PR TBD):

func setCost(_ provider: String, _ model: String, input: Double, output: Double) async {
    do {
        try await client.setModelCost(
            provider: provider, model: model, input: input, output: output)
        await load()
    } catch {
        status = "Could not save cost: \(error.localizedDescription)"
    }
}

The five siblings all call load(clearingStatus: false) on both branches so the message they just set survives the reload (see the load() doc comment at line 40). setCost does not: its success path calls plain load() (clearingStatus: true, the default), and its catch block sets status but never reloads at all. This is the same bug shape the U8 fix addressed for the other five actions — setCost just wasn't included, deliberately, to keep that slice's diff scoped to the findings it was written against.

Expected behavior

setCost should follow the same load(clearingStatus: false) pattern as its siblings on both the success and failure branches, so a status message it sets is not vulnerable to being cleared by a later default-clearing load() and its failure path still refreshes provider/model state.

Reproduction

Preconditions: Settings → Models, a provider with at least one model.
Exact action: Click a model's price, enter a value, Save; observe setCost's catch branch never calls load(), so on failure the provider list is not refreshed to pick up any server-side state change.
Reproduction rate: Deterministic by code inspection (ModelSettingsView.swift:132-140); not exercised against a live daemon in this pass.

Impact

Low severity, UI-consistency only — no data loss or security implication. Confusing feedback if a save fails silently-stale, and this is the last inconsistency in the load(clearingStatus:) pattern introduced for #999/U8.

Suspected seam

Owning file/type: ModelSettingsModel.setCost, macapp/Sources/GoCodeUI/ModelSettingsView.swift:132-140.
Sibling pattern to match: fetch/setExposed/setAllVisible/saveProvider/delete in the same file (all call load(clearingStatus: false)).

Regression test

Add a ModelSettingsModelTests case that sets a fake client to fail setModelCost, asserts model.status still reads the failure message after setCost returns, and — the part not yet covered — asserts providers was refreshed from the fake client's post-failure state (currently it is not, since no reload happens on the catch branch).

Deferred manual smokes from #991 (require a live app/daemon; not run in this pass)

• Transcript autoscroll: scroll-up behavior during live streaming.
• Failed-load retry with the daemon killed mid-session.
• Delete/undo confirmation cancel paths (Sessions).
• Force-rewind "Restore Anyway" path.
• Prompt-history Up/Down navigation with a half-typed draft in the composer.
• VoiceOver and keyboard-only navigation on the Sessions and Models panes.

Latent deferral: caret-aware prompt history (D1 in the plan)

macapp/Package.swift pins .macOS(.v14). Literal caret-position-aware history recall (the #998 wording) needs a SwiftUI TextSelection/caret binding, which is a macOS 15 API, or an NSTextView bridge (NSViewRepresentable). The shipped approximation (recall only when the draft is empty/unchanged) is documented as KTD-7 in the plan; true caret-awareness is out of scope until the platform floor moves or the composer is rebuilt on an NSTextView bridge.

Fix boundaries

In scope (for a follow-up fix): setCost's two branches, matching the sibling pattern; the regression test above.
Out of scope: the deferred manual smokes and the caret-awareness deferral are tracked here for visibility, not for this fix — they need either live-app access or a platform-floor decision, not a code change alone.

Related: #991

[dennisonbertram]

Filed as a follow-up from the epic #991 PR: #1021

[dennisonbertram]

PR #1021 automated repair is now hosted at exact head 575b670938821f9db8b5bb096e3956753b0f0e25 after integrating main b3afc7ec487c60762a91a1219ceb92c523ef0e78. Source/test findings are repaired: async ownership, generation-safe autoscroll, run-control single flight, duplicate history bookkeeping, stale-row refresh errors, and lifecycle/rewind guards. Evidence: focused 93 tests / 12 suites; full Swift 303 tests / 55 suites; build/strict format green; relevant Go packages green; full regression/race/coverage green at 85.6% with zero uncovered functions. Still pending here: all installed-app manual smokes and the separate Settings-specific setCost root-cause result. #1007 external run-control identity remains out of scope.

[dennisonbertram]

Follow-up on the final repair head 01268cf33c337ca0c2c759a48be33a1323875428: hosted live-harnessd exposed a terminal accounting/replay race after the first push. It reproduced locally, a reducer regression was observed red, and the fix now reconciles sealed usage_totals/cost_totals, preserves them through durable-row rebuilds, and prevents late duplicate events from moving cumulative accounting backward. Exact live RunSessionLiveTests and full Swift 304 tests / 55 suites pass. Still pending: installed-app smokes and the separate Settings setCost investigation. Separate hosted Go race remains blocked on already-owned #1039 / green PR #1041; it is not duplicated here.

[dennisonbertram]

Hosted correction for exact head 01268cf33c337ca0c2c759a48be33a1323875428: the rerun completed fully green (build-test, format, live-harnessd, test-fast, test-race). #1039 / PR #1041 remains the safe stacking dependency because the first hosted attempt exposed its known cleanup flake, but #1021 currently has no red hosted check. The unresolved #1020 obligations remain only the separate Settings result and installed-app manual smokes.

[dennisonbertram]

PR #1021 advanced to exact head afa92d20c7ec10438cbbde4550bb8886e2b0465a after the final Codex pass. Added red/green coverage for pending-answer view identity, partial activity refresh after run termination, and conversation-bound rewind refusal/retry. Local gates: focused 13 tests / 3 suites; full Swift 308 tests / 55 suites; Swift build and strict recursive format lint pass. New hosted checks are running. Installed-app macOS smokes and the separate Settings-specific setCost root-cause result remain explicitly pending here.

[dennisonbertram]

Hosted verification is now terminal and green for PR #1021 exact head afa92d20c7ec10438cbbde4550bb8886e2b0465a: macapp build-test, format, and live-harnessd; Go test-fast and test-race. This does not discharge the installed-app macOS smokes or the separate Settings-specific setCost investigation, which remain pending.

[dennisonbertram]

PR #1021 advanced to exact head 7361769b0dc59139db03a64f0e2a07f992127eb1 after resolving the two remaining transcript-accounting review blockers. Usage/cost is now scoped to one run ID, reset immediately for a follow-up, protected from late prior-run stream events, and sealed for completed/failed/cancelled terminals across durable reconciliation. Both regressions were observed red then green. Local gates: focused accounting 4 tests / 1 suite; full Swift 310 tests / 55 suites; Swift build and strict recursive format; relevant Go packages. New hosted checks are running. Installed-app macOS and Settings-specific proof remain pending.