fix(desktop): keep your draft editable when an @ mention cannot be sent

[loganj]

🤖

Summary

Fixes four ways the composer could lose your text or cursor while working with @ mentions:

• A failed send no longer wipes your draft. If mention preparation fails while sending (for example, a failed upload), the draft stays as typed, the error is shown, and you can send again.
• A closing menu can no longer steal your cursor. A still-animating ⋯ menu can no longer grab a late pointer event and steal focus from the composer; Escape still refocuses its trigger.
• Delayed automatic mentions no longer overwrite your typing. The per-agent "Automatically mention … in this conversation" toggle re-adds the label to your next draft, but only if that draft is untouched — any draft edit or channel switch cancels the re-add.
• Regenerated automatic mention labels leave no residue. After a regeneration (for example, an agent rename), the current label is the one later updated or removed — no duplicated or leftover text.

Part of the mention-editor stack: #7190 → #7191 → #7192 (review in order); stands on its base branch alone.

Related issue

Continues the merged mention-editor work from #7124 and #7128. No separate tracking issue for this slice.

Testing

• Unit tests cover each fix: draft retention on failed sends, re-add revocation on draft edits or channel switches, and regenerated-label ownership.
• Browser specs cover the closing-menu focus case, failed sends, and an always-mention agent surviving save, reopen, and publication.
• All PR checks pass on this head.

[jedwards27]

Verdict: APPROVE

Reviewed base 802ba6170e57ac71d1ecfd6cf6fb12f02ecf910c → exact live head bb8cca21e13099bc6206b18c62272b72928574ca across systems/integration and product/UI behavior. No material defects found; no author action required.

Findings

• Recipient identity is captured before asynchronous send work, normalized to exact pubkeys, and revalidated against the actual destination before preparation and again before publication (desktop/src/lib/hooks/useMentionSendFlow.ts:460-465,577-603,756-764,829-836,863-891). Publication and address tags use that final admitted set.
• Composer recovery is revision/owner fenced (desktop/src/lib/hooks/useMentionSendFlow.ts:391-430), while delayed automatic restoration is fenced by frame identity and shared revision (desktop/src/lib/hooks/useAddressedAgentMentionRestore.ts:45-78).
• E2E coverage verifies signed channel/recipient identity through mid-send navigation (desktop/e2e/send-channel-binding.spec.ts:120-170) and persisted audience storage → restoration → signed/wire identity (desktop/e2e/persistent-agent-audience.spec.ts:126-199).
• Product/UI coverage exercises pointer/menu focus retention, Escape-trigger restoration, same-name exact-recipient publication, separator/caret/highlight stability after style removal, draft persistence/reopen, reduced motion, narrow layout, send-failure recovery, and channel switching.

Exact-head evidence

At clean bb8cca21e13099bc6206b18c62272b72928574ca:

• Full Desktop package suite: 6021/6021 passed.
• Desktop check/typecheck/build: passed; reported warning/info diagnostics were outside changed lines.
• Independent isolated E2E selections: 48/48 and 50/50 passed across affected specs.
• Differential file-size policy and git diff --check: passed.
• No added production unwrap/expect; exported helper documentation and DCO trailers present.
• Live exact-head CI is green for Desktop Core, macOS/Windows builds, smoke shards, relay E2E, integration shards, Semgrep, zizmor, and DCO.

Residual risk

No native Tauri/OS accessibility-tree journey or independent mutation run was completed. This is a reviewer/tooling-owned confidence gap, not an author-actionable defect: the isolated E2E coverage directly exercises the relevant focus, restoration, failure-recovery, navigation, and signed-recipient behavior.

[jedwards27]

:bot: Jude’s code review agent

Both assigned review lanes clear exact head bb8cca21e13099bc6206b18c62272b72928574ca.

Recipient identity is captured before asynchronous work, carried as normalized exact pubkeys, and revalidated against the actual destination before preparation and publication. Draft recovery is owner/revision fenced, and delayed automatic restoration is frame-identity/revision fenced. Product validation covered focus retention, keyboard restoration, exact same-name recipient publication, separator/caret stability, persistent audience restoration, failure retry, and channel-switch behavior.

Validation: full Desktop package 6,021/6,021; typecheck, lint, and build; 50/50 affected E2E tests; clean git diff --check. The live head remained unchanged immediately before this review, with 17 successful and 10 skipped exact-head checks.

Residual risk: no native Tauri/OS accessibility-tree run and no independent mutation run. These are reviewer/tooling confidence gaps, not author defects.