A save that never ran for its account is not reported as kept

A queue save whose account changed before it ran wrote nothing but still
resolved as a success: its caller heard the change was kept on the phone,
and the storage-failure flag was cleared. It now rejects those callers
with the account-changed error (the switch removes that account's queue,
as before) and leaves the flag alone (tested; the test fails without it).

A concurrency test pins that a change whose retirement save fails is sent
once, however often replay is asked: the sent change has left the queue
before that save, and replay is single-flight, so clearing inFlight there
cannot cause a second send.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: Programcode

apps/mobile/src/lib/offline-queue.test.ts

@@ -3,7 +3,7 @@ import { beforeEach, describe, expect, it, vi } from 'vitest';
 import type { Source } from './sources';
 
 const storage = vi.hoisted(() => new Map<string, string>());
-const net = vi.hoisted(() => ({ offline: false, user: 'user-a' as string | null, uuids: 0, failGet: 0, failSet: 0 }));
+const net = vi.hoisted(() => ({ offline: false, user: 'user-a' as string | null, uuids: 0, failGet: 0, failSet: 0, holdSet: null as Promise<void> | null }));
 // supabase-js answers a request that never reached the server with status 0; readFailed marks it unreachable.
 // The saved copies, kept in memory so a test can see what an offline relaunch would show.
 const copies = vi.hoisted(() => new Map<string, unknown>());
@@ -43,6 +43,7 @@ vi.mock('@react-native-async-storage/async-storage', () => ({
       return storage.get(key) ?? null;
     },
     setItem: async (key: string, value: string) => {
+      if (net.holdSet) await net.holdSet;
       if (net.failSet > 0) {
         net.failSet -= 1;
         throw new Error('storage full');
@@ -98,6 +99,7 @@ beforeEach(async () => {
   net.uuids = 0;
   net.failGet = 0;
   net.failSet = 0;
+  net.holdSet = null;
   vi.clearAllMocks();
   sources.addSource.mockImplementation(async (_userId: string, input: { id: string; title: string; content: string; debateId: string }) => row(input.id, input));
   sources.updateSource.mockResolvedValue(undefined);
@@ -208,6 +210,39 @@ describe('offline queue', () => {
     expect(sources.updateSource).not.toHaveBeenCalled();    net.failSet = 0;
   });
 
+  it('never tells a caller a change is kept when the account changed before its save ran', async () => {
+    const queue = await load();
+    net.offline = true;
+    let release: () => void = () => undefined;
+    net.holdSet = new Promise<void>((resolve) => { release = resolve; });
+    // The first save waits in storage; the second is queued behind it.
+    const first = queue.queueAddSource('user-a', { title: 'First', content: 'Text', type: 'text', debateId: 'd1' });
+    await new Promise((resolve) => setTimeout(resolve, 20));
+    const second = queue.queueAddSource('user-a', { title: 'Second', content: 'Text', type: 'text', debateId: 'd1' });
+    await new Promise((resolve) => setTimeout(resolve, 20));
+    queue.setQueueOwner('user-b');
+    net.holdSet = null;
+    release();
+    // The second save never ran for its account, so it is not reported as kept.
+    await expect(second).rejects.toThrow('account changed');
+    await first.catch(() => undefined);
+  });
+
+  it('sends a change once when the save that retires it fails, however often replay is asked', async () => {
+    const queue = await load();
+    net.offline = true;
+    await queue.queueUpdateSource('user-a', 'd1', 's1', { title: 'One' });
+    await queue.queueUpdateSource('user-a', 'd1', 's2', { title: 'Two' });
+    // Back online, every save fails: "One" is sent, the save that retires it fails, and replay stops.
+    net.failSet = 1000;
+    net.offline = false;
+    await Promise.all([queue.replayOfflineQueue(), queue.replayOfflineQueue()]);
+    await queue.replayOfflineQueue();
+    expect(sent()).toEqual(['edit s1 {"title":"One"}']);
+    expect(queue.getQueueSnapshot().items.map((item) => (item.kind === 'edit' ? item.sourceId : ''))).toEqual(['s2']);
+    net.failSet = 0;
+  });
+
   it('never writes over a stored queue it could not read, and keeps it once a read works', async () => {
     let queue = await load();
     net.offline = true;

apps/mobile/src/lib/offline-queue.ts

@@ -184,7 +184,8 @@ function persist(): Promise<boolean> {
   awaitingSave = [];
   if (!userId) return Promise.resolve(true);
   return storage(async () => {
-    if (gen !== generation) return;
+    // The account changed before this save ran: nothing is written, so nothing may count as kept.
+    if (gen !== generation) return false;
     // A stored queue that could not be read is never written over: it may hold unsynced work.
     if (!hydrated) throw new Error('The offline changes on this phone could not be read.');
     const write = () =>
@@ -196,8 +197,15 @@ function persist(): Promise<boolean> {
       await new Promise((resolve) => setTimeout(resolve, 200));
       await write();
     });
+    return true;
   }).then(
-    () => {
+    (wrote) => {
+      if (!wrote) {
+        // The changes belonged to the account that was replaced; it removed them, as a sign-out does.
+        const error = new Error('The account changed before this change was saved.');
+        confirming.forEach(({ waiter }) => waiter.reject(error));
+        return false;
+      }
       const recovered = storageTroubled;
       storageTroubled = false;
       confirming.forEach(({ waiter }) => waiter.resolve('queued'));