Keep older chat handles from unregistering newer generations

[Maya-Kid]

Latest dev synchronization (2026-09-21)

Based on dev@474b904dc3e8014d42404a3c067af9906036a953; current head 29a717e1d12ad3782f1634e0bf8d9dd0b9e5daef.

Revalidated the combined integration tree 6cd976351b4d7cc7389730fce530526f4d197992 on isolated Linux PostgreSQL fixtures (all 675 tracked source files hash-matched):

• Rust fmt, strict workspace/all-target Clippy, workspace build: pass. Workspace tests: 1,015 passed, 0 failed, 5 ignored. The new upstream delivery tests were additionally run on an exclusive database as CONTRIBUTING requires: both parent delivery/process-kill tests and the busy-deferral unit test passed. The crash-child entry point ran through its parent, not directly; the existing public-network RSS test remains ignored.
• Combined frontend: 129 module tests, 27 browser subtests (29 including parent suites); build/typecheck/guard passed. Browser fixtures ran serially.
• Five browser scenarios against the actual Linux server and PostgreSQL passed: 65-conversation pagination, stale view ownership, citation preview/reattachment/reload, history-to-idle handoff, and actual assistant INSERT failure. Model replies were locally scripted; this is not a new paid-model accuracy evaluation.
• The single PostgreSQL Chat CI command, cargo test -p utopia-server api::chat::, listed and executed 47 tests. All 37 introduced tests were observed passing: Hand off exhausted tool runs to an evidence-only final answer #845 22, Keep older chat handles from unregistering newer generations #848 1, Publish citation sources added by document reads #849 2, Keep fallback retrieval failures distinct from empty results #850 4, Preserve exact chat outcomes across stream closure and reattachment #851 3, Do not report fallback chat completion when saving fails #852 3, and upstream Assert a chat turn ends in exactly one earned terminal #858 2. No test module was deleted during CI consolidation.
• Seven real filtered runs each omitted one group. Cargo returned green, but the independent execution-coverage checker returned exit 1 for every omission; the complete run returned exit 0. All four shared terminal-contract table rows executed without pending skips.

The evidence-only handoff core remains frozen. Earlier validation below belongs to its stated historical heads. Automated browser checks do not replace the maintainer's requested visual review.

---

When two chat producers overlap in one conversation, the older producer's finish() removes the newer producer's registry entry. The newer answer continues generating and can still persist, but reopening the conversation returns idle instead of reconnecting to it.

Handle::finish now compares the entry's existing snapshot identity and removes it under the same registry write lock. The change preserves the current replacement behavior of begin, the snapshot/subscription locking boundary, and the SSE wire format. It adds no cancellation or request-serialization policy.

Validation on Linux, based on dev@ea0557ba466979449a93b7060ca42a2cf46e2b96:

• The regression invokes the real chat and reattach handlers with PostgreSQL and a gated local HTTP model substitute. Both producers run before the older one finishes; its broadcast channel closing proves cleanup has completed before reattachment. Before the fix, reattachment returns idle. After the fix, it receives the newer answer and done, and both answers are stored. Exactly four model-substitute requests occur; no paid model is used.
• Registry tests cover all six finish orders for three replacements, independent conversations, late old emissions, current-owner cleanup, and snapshot/subscription continuity. Reverting only the ownership check makes the handler regression fail again; restoring it passes.
• cargo fmt --all --check, strict workspace clippy, locked workspace build, and locked workspace tests pass: 977 passed, 0 failed, 1 existing public-network test ignored. Database and PDF dependency guards were enabled against an isolated migrated database.
• Frontend: frozen-lockfile install, 116 tests, and production build/typecheck/style guard pass (Node 22.23.2, pnpm 10.2.1). Backend: Rust 1.98.1.
• A separate combination with Hand off exhausted tool runs to an evidence-only final answer #845 at 02e6aa3691f4f8e7494035d18f2a06bf28b58547 passes 33 Chat tests and 3 Registry tests, retaining its finalization and persistence regressions. This PR does not depend on or modify that branch.

CI runs the new handler regression in the PostgreSQL job with UTOPIA_TEST_REQUIRE_DB=1. No browser E2E was run; this change is limited to server registry ownership. No schema/API migration or production deployment is involved. Rolling back restores the old unregister race; no stored data needs rewriting.