fix(config): harden async config-write lifecycle and fail loud on reset errors

Follow-up hardening from the code review of the Channels async-write migration. Closes the
new exposures that the fire-and-forget writes introduced, plus adjacent findings:

- Lifecycle cancellation (review #1/#5): add a VM-lifetime CancellationTokenSource, thread
  its token through the AddChannel / Reset / autosave entry points, and have Dispose cancel
  it and DRAIN the in-flight write + label refresh before disposing the reactive state they
  publish to. Pre-fix, closing the editor mid-write could let the write resume on a
  thread-pool continuation and mutate a disposed ReactiveProperty / Step; the runtime path
  also passed CancellationToken.None, so nothing honored cancellation.
- Reset fails loud (review #3): ApplyResetConfirmationAsync now surfaces ANY unexpected
  exception (e.g. an InvalidOperationException from a type-malformed config reload) as an
  Error status instead of letting it fault the fire-and-forget chain, where the next write's
  catch swallowed it silently. Honors the no-silent-fallbacks rule.
- Search re-entrancy (review #6): SubmitCurrentConfigurationFromInputAsync now ignores a
  re-entrant submit while a probe is in flight (returns the same task), closing the same
  two-rapid-submits-race-the-disk-write hazard the Channels write chain fixed.
- Cleanup: collapse SaveCompletedAsync / SaveFromInputAsync onto one SaveViaAutosaveAsync
  helper (#8); extract the shared ArrangeSlackResetWithLabelRefreshInFlight test setup (#9);
  the single-worker SynchronizationContext test pump no longer dies on a throwing
  continuation, which would mask a real failure as a generic deadlock (#7).

Tests: a dispose-drains-an-in-flight-write test (Channels) and a re-entrancy test (Search).

Deferred (pre-existing, tracked separately): the background label refresh and the save+reload
tail still mutate view-model state off the loop, so a concurrent on-loop edit during a network
resolve can lose an audience edit (review #2/#4). Eliminating that requires marshalling those
mutations back onto the loop (Termina exposes only RequestRedraw) and is its own change; the
lifetime cancellation here bounds the window and closes the disposal portion.

Author: Aaronontheweb

src/Netclaw.Cli.Tests/Tui/Config/ChannelsConfigViewModelTests.cs

@@ -1291,28 +1291,7 @@ public async Task SaveAsync_cancels_and_awaits_in_flight_label_refresh_before_wr
     [Fact]
     public async Task ApplyResetConfirmation_cancels_and_awaits_in_flight_label_refresh_before_writing()
     {
-        WriteAllChannelConfig();
-        WriteAllChannelSecrets();
-        var slackProbe = new FakeSlackProbe
-        {
-            // Block the resolve so the background refresh is genuinely in flight during the reset.
-            DelayBeforeResult = TimeSpan.FromMinutes(5),
-            NextResolutionResult = new SlackChannelResolutionResult(
-                true, null, [new ResolvedSlackChannel("general", "C01")], []),
-        };
-        using var vm = CreateViewModel(slackProbe: slackProbe);
-
-        // Enter Manage Channels to start the background label refresh, then leave it in flight.
-        vm.OpenAdapterManagement(ChannelType.Slack);
-        MoveToManagementAction(vm, ChannelsManagementAction.ManageChannels);
-        vm.ActivateManagementMenuItem();
-        Assert.False(vm.PendingLabelRefresh?.IsCompleted ?? true); // background is in flight
-
-        // Drive the reset confirmation (which bypasses SaveAsync) while the refresh is still running.
-        vm.GoBack();
-        MoveToManagementAction(vm, ChannelsManagementAction.ResetConnection);
-        vm.ActivateManagementMenuItem();
-        vm.MoveResetConfirmation(1);
+        using var vm = ArrangeSlackResetWithLabelRefreshInFlight();
 
         await vm.ApplyResetConfirmationAsync(TestContext.Current.CancellationToken);
 
@@ -1334,32 +1313,12 @@ public async Task Reset_with_in_flight_label_refresh_completes_under_a_single_wo
         // deterministically: it drives the whole reset-with-in-flight-refresh scenario on a context
         // with exactly ONE worker, so a reintroduced sync-over-async bridge hangs the worker and trips
         // the watchdog instead of completing.
-        WriteAllChannelConfig();
-        WriteAllChannelSecrets();
-        var slackProbe = new FakeSlackProbe
-        {
-            // Keep the background refresh genuinely in flight while the reset runs.
-            DelayBeforeResult = TimeSpan.FromMinutes(5),
-            NextResolutionResult = new SlackChannelResolutionResult(
-                true, null, [new ResolvedSlackChannel("general", "C01")], []),
-        };
-
         using var context = new SingleThreadSynchronizationContext();
         var scenario = context.Run(async () =>
         {
-            using var vm = CreateViewModel(slackProbe: slackProbe);
-
-            // Start the background label refresh and leave it in flight. Its continuation captures THIS
-            // single-worker context — exactly the condition that deadlocked the old blocking reset.
-            vm.OpenAdapterManagement(ChannelType.Slack);
-            MoveToManagementAction(vm, ChannelsManagementAction.ManageChannels);
-            vm.ActivateManagementMenuItem();
-            Assert.False(vm.PendingLabelRefresh?.IsCompleted ?? true);
-
-            vm.GoBack();
-            MoveToManagementAction(vm, ChannelsManagementAction.ResetConnection);
-            vm.ActivateManagementMenuItem();
-            vm.MoveResetConfirmation(1);
+            // Arrange on the single-worker context so the background refresh's continuation captures
+            // THIS context — exactly the condition that deadlocked the old blocking reset.
+            using var vm = ArrangeSlackResetWithLabelRefreshInFlight();
 
             // Fire-and-forget exactly like the Termina key handler, then await the serialized write.
             _ = vm.ResetConfirmationFromInputAsync();
@@ -1377,6 +1336,39 @@ public async Task Reset_with_in_flight_label_refresh_completes_under_a_single_wo
         await scenario; // re-throw any assertion failure raised on the worker thread
     }
 
+    [Fact]
+    public async Task Disposing_editor_cancels_and_drains_an_in_flight_config_write()
+    {
+        WriteChannelConfig();
+        WriteChannelSecrets();
+        var slackProbe = new FakeSlackProbe
+        {
+            // Hold the add's label-resolve open so the config write is genuinely in flight at Dispose.
+            DelayBeforeResult = TimeSpan.FromMinutes(5),
+            NextResolutionResult = new SlackChannelResolutionResult(
+                true, null, [new ResolvedSlackChannel("c-09", "C09")], []),
+        };
+        var vm = CreateViewModel(slackProbe: slackProbe);
+        vm.OpenAdapterManagement(ChannelType.Slack);
+        vm.BeginAddChannel();
+        vm.AddChannelInput = "c-09";
+
+        // Dispatch the add fire-and-forget exactly like the key handler; it blocks on the 5-minute resolve.
+        var write = vm.AddChannelFromInputAsync();
+        Assert.False(write.IsCompleted); // in flight, blocked on the label resolve
+
+        // Dispose must cancel the in-flight write via the lifetime token and drain it before returning —
+        // not hang for the 5-minute probe, and not let the write resume on a thread-pool continuation and
+        // mutate disposed reactive state. Run Dispose off the xunit synchronization context so the
+        // in-flight write's continuations can drain on the test context while Dispose waits.
+        var dispose = Task.Run(vm.Dispose, TestContext.Current.CancellationToken);
+        var finished = await Task.WhenAny(
+            dispose, Task.Delay(TimeSpan.FromSeconds(15), TestContext.Current.CancellationToken));
+        Assert.True(ReferenceEquals(finished, dispose), "Dispose did not drain the cancelled in-flight write promptly.");
+        await dispose;  // surface any teardown exception
+        await write;    // the cancelled add unwound without surfacing out
+    }
+
     [Fact]
     public async Task ApplyResetConfirmation_surfaces_save_failure_without_crashing_the_loop()
     {
@@ -1831,6 +1823,35 @@ private static void MoveToManagementAction(ChannelsConfigViewModel vm, ChannelsM
         vm.MoveManagementMenu(index);
     }
 
+    // Arranges a Slack adapter parked on the reset-confirmation screen with a background label refresh
+    // genuinely in flight (a 5-minute probe delay holds it open). Shared by the reset tests that verify
+    // the reset cancels-and-awaits that refresh without racing its write or deadlocking. The caller owns
+    // disposal of the returned view-model.
+    private ChannelsConfigViewModel ArrangeSlackResetWithLabelRefreshInFlight()
+    {
+        WriteAllChannelConfig();
+        WriteAllChannelSecrets();
+        var slackProbe = new FakeSlackProbe
+        {
+            DelayBeforeResult = TimeSpan.FromMinutes(5),
+            NextResolutionResult = new SlackChannelResolutionResult(
+                true, null, [new ResolvedSlackChannel("general", "C01")], []),
+        };
+        var vm = CreateViewModel(slackProbe: slackProbe);
+
+        // Enter Manage Channels to start the background label refresh, then leave it in flight.
+        vm.OpenAdapterManagement(ChannelType.Slack);
+        MoveToManagementAction(vm, ChannelsManagementAction.ManageChannels);
+        vm.ActivateManagementMenuItem();
+        Assert.False(vm.PendingLabelRefresh?.IsCompleted ?? true); // background is in flight
+
+        vm.GoBack();
+        MoveToManagementAction(vm, ChannelsManagementAction.ResetConnection);
+        vm.ActivateManagementMenuItem();
+        vm.MoveResetConfirmation(1);
+        return vm;
+    }
+
     private static int GetAdapterIndex(ChannelsConfigViewModel vm, ChannelType type)
         => vm.Step.Adapters
             .Select((adapter, index) => (adapter.Type, index))

src/Netclaw.Cli.Tests/Tui/Config/SearchConfigEditorViewModelTests.cs

@@ -209,6 +209,27 @@ public async Task NavigateBack_during_validation_abandons_the_stale_probe_result
         Assert.Equal(SearchConfigEditorScreen.ProviderSelection, vm.CurrentScreen.Value);
     }
 
+    [Fact]
+    public async Task Re_entrant_submit_while_a_probe_is_in_flight_is_ignored()
+    {
+        var gate = new TaskCompletionSource();
+        using var vm = new SearchConfigEditorViewModel(_paths, new GatedHttpClientFactory(gate.Task));
+        vm.SelectBackendForEditing("searxng");
+        vm.SetFieldValue("Search.SearXngEndpoint", "https://search.test.local");
+
+        // First submit starts a probe that blocks in the gated handler.
+        var first = vm.SubmitCurrentConfigurationFromInputAsync(TestContext.Current.CancellationToken);
+        Assert.False(first.IsCompleted);
+
+        // A second Enter while the first is still validating must NOT launch an overlapping probe + disk
+        // write (two would race the same config file). The guard returns the same in-flight task.
+        var second = vm.SubmitCurrentConfigurationFromInputAsync(TestContext.Current.CancellationToken);
+        Assert.Same(first, second);
+
+        gate.SetResult();
+        await first;
+    }
+
     [Fact]
     public void Save_anyway_persists_config_and_secret_semantically()
     {

src/Netclaw.Cli.Tests/Tui/SingleThreadSynchronizationContext.cs

@@ -65,8 +65,26 @@ private void Pump()
     {
         SetSynchronizationContext(this);
         foreach (var (callback, state) in _queue.GetConsumingEnumerable())
-            callback(state);
+        {
+            try
+            {
+                callback(state);
+            }
+            catch (Exception ex)
+            {
+                // Keep the single worker alive if a posted continuation throws. The Run() entry point
+                // already funnels its scenario's exceptions to a TaskCompletionSource (so the test sees
+                // the real failure); letting one stray continuation kill the worker here would drain no
+                // further callbacks and make every awaiting test look like a generic deadlock instead.
+                _lastError ??= ex;
+            }
+        }
     }
 
+    /// <summary>The first exception thrown by a posted continuation, if any — for test diagnostics.</summary>
+    public Exception? LastError => _lastError;
+
+    private volatile Exception? _lastError;
+
     public void Dispose() => _queue.CompleteAdding();
 }

src/Netclaw.Cli/Tui/Config/ChannelsConfigViewModel.cs

@@ -43,6 +43,13 @@ public sealed class ChannelsConfigViewModel : ReactiveViewModel
     private CancellationTokenSource? _labelResolutionCts;
     private Task? _labelRefreshTask;
 
+    // Cancels every input-triggered config write (and its channel-access probe) when the editor is
+    // torn down. Fire-and-forget writes resume on thread-pool continuations (the loop has no
+    // SynchronizationContext), so without a lifetime token a write started just before disposal would
+    // run its probe to completion and then mutate already-disposed reactive state. Threaded into the
+    // FromInput entry points; cancelled and drained in Dispose.
+    private readonly CancellationTokenSource _lifetimeCts = new();
+
     public ChannelsConfigViewModel(
         NetclawPaths paths,
         ISlackProbe slackProbe,
@@ -248,14 +255,20 @@ private static ConfigStatusMessage BuildSaveStatus(string successMessage, IReadO
                 $"Saved. Could not resolve: {string.Join(", ", unresolved.Select(static name => $"#{name}"))} — flagged below; fix or remove them.",
                 ConfigStatusTone.Warning);
 
-    internal async Task<bool> SaveFromInputAsync(CancellationToken ct = default)
-        => await ConfigAutosave.RunAsync(
-            token => SaveAsync("Channels saved.", probeChannelAccess: true, token),
+    // Single autosave wrapper for both the explicit save (probe on) and the completed-action autosaves
+    // (probe off, via SaveCompletedAsync). ConfigAutosave.RunAsync catches any failure and surfaces it
+    // as an Error status; this returns whether the save succeeded.
+    private Task<bool> SaveViaAutosaveAsync(string successMessage, bool probeChannelAccess, CancellationToken ct)
+        => ConfigAutosave.RunAsync(
+            token => SaveAsync(successMessage, probeChannelAccess, token),
             Status,
             "Channel settings save failed",
             RequestRedraw,
             ct);
 
+    internal Task<bool> SaveFromInputAsync(CancellationToken ct = default)
+        => SaveViaAutosaveAsync("Channels saved.", probeChannelAccess: true, ct);
+
     // Input-triggered config writes (autosave, add-channel, reset) run async OFF the Termina loop so
     // they never freeze input/rendering on a probe or disk write. The sync .GetAwaiter().GetResult()
     // bridges they replaced were implicitly serialized by the single-threaded loop — exactly one ran
@@ -290,10 +303,10 @@ async Task ChainAsync()
     // while the add resolves channels against the platform API; the write itself is serialized behind
     // any prior config write by EnqueueConfigWriteAsync.
     internal Task AddChannelFromInputAsync()
-        => EnqueueConfigWriteAsync(() => ApplyAddChannelAsync());
+        => EnqueueConfigWriteAsync(() => ApplyAddChannelAsync(_lifetimeCts.Token));
 
     internal Task ResetConfirmationFromInputAsync()
-        => EnqueueConfigWriteAsync(() => ApplyResetConfirmationAsync());
+        => EnqueueConfigWriteAsync(() => ApplyResetConfirmationAsync(_lifetimeCts.Token));
 
     internal bool TryOpenSelectedAdapterManagement()
     {
@@ -1349,6 +1362,16 @@ internal async Task ApplyResetConfirmationAsync(CancellationToken ct = default)
             // SaveAsync, so it carries its own equivalent guard.
             Status.Value = new ConfigStatusMessage($"Could not save reset: {ex.Message}", ConfigStatusTone.Error);
         }
+        catch (Exception ex)
+        {
+            // Fail LOUD on any other error (e.g. a type-malformed but JSON-valid config surfacing as
+            // InvalidOperationException from the reload's deserialization). This runs as a fire-and-forget
+            // chained write whose ChainAsync swallows a faulted prior task, so an unsurfaced throw here
+            // would vanish with no operator feedback — exactly the silent fallback to avoid. Surface it
+            // and stay on the confirmation screen for retry; catching here also keeps the chained task
+            // from faulting, so subsequent writes are unaffected.
+            Status.Value = new ConfigStatusMessage($"Could not reset {resetName}: {ex.Message}", ConfigStatusTone.Error);
+        }
 
         NotifyContentChanged();
     }
@@ -1361,8 +1384,27 @@ public void RequestQuit()
 
     public override void Dispose()
     {
+        // Cancel any in-flight config write / label refresh, then DRAIN them before disposing the
+        // reactive state they publish to. A fire-and-forget write resumes on a thread-pool continuation
+        // (the loop has no SynchronizationContext), so without this a write could mutate a disposed
+        // ReactiveProperty / Step after teardown. Cancellation makes the in-flight probe abort promptly;
+        // the bounded Wait is a last-resort backstop so Dispose can never block the loop indefinitely on
+        // a wedged probe (it returns false on timeout rather than throwing or hanging).
+        _lifetimeCts.Cancel();
         _labelResolutionCts?.Cancel();
+        try
+        {
+            Task.WhenAll(_pendingConfigWrite, _labelRefreshTask ?? Task.CompletedTask)
+                .Wait(TimeSpan.FromSeconds(5));
+        }
+        catch
+        {
+            // A faulted/cancelled in-flight write has already surfaced its own status (autosave/reset
+            // both catch and report); swallow here so teardown completes regardless.
+        }
+
         _labelResolutionCts?.Dispose();
+        _lifetimeCts.Dispose();
         IsSaved.Dispose();
         Screen.Dispose();
         Status.Dispose();
@@ -1407,17 +1449,12 @@ private void SetActiveAdapterEnabled(bool enabled)
     // is serialized behind any in-flight write and never blocks the loop. Autosave skips the blocking
     // channel-access probe (the background label refresh re-validates instead).
     private void AutosaveCompletedAction(string successMessage)
-        => _ = EnqueueConfigWriteAsync(() => SaveCompletedAsync(successMessage));
+        => _ = EnqueueConfigWriteAsync(() => SaveCompletedAsync(successMessage, _lifetimeCts.Token));
 
     // Awaitable autosave for callers already running inside an enqueued write (ApplyAddChannelAsync),
     // where re-enqueueing would deadlock the op behind itself. Returns whether the save succeeded.
     private Task<bool> SaveCompletedAsync(string successMessage, CancellationToken ct = default)
-        => ConfigAutosave.RunAsync(
-            token => SaveAsync(successMessage, probeChannelAccess: false, token),
-            Status,
-            "Channel settings save failed",
-            RequestRedraw,
-            ct);
+        => SaveViaAutosaveAsync(successMessage, probeChannelAccess: false, ct);
 
     private int GetAdapterIndex(ChannelType type)
         => Step.Adapters

src/Netclaw.Cli/Tui/Config/SearchConfigEditorViewModel.cs

@@ -309,17 +309,36 @@ public async Task TestCurrentConfigurationAsync(CancellationToken ct = default)
     public async Task SaveAsync(CancellationToken ct = default)
         => await SubmitCurrentConfigurationAsync(ct);
 
-    internal async Task SubmitCurrentConfigurationFromInputAsync(CancellationToken ct = default)
+    // Guards against a second Enter (or Enter while a probe is still running) launching an overlapping
+    // submit. The dispatch is fire-and-forget from the synchronous key handler, so without this two
+    // rapid submits would race the same network probe and disk write (the same hazard Channels solved
+    // with its config-write chain). The in-flight task is read/written only on the loop thread (the
+    // synchronous prefix before the first await), so it needs no synchronization. Exposed as
+    // PendingSubmit so tests can await completion deterministically.
+    private Task? _pendingSubmit;
+
+    internal Task? PendingSubmit => _pendingSubmit;
+
+    internal Task SubmitCurrentConfigurationFromInputAsync(CancellationToken ct = default)
     {
-        try
-        {
-            await SubmitCurrentConfigurationAsync(ct);
-        }
-        catch (Exception ex)
+        if (_pendingSubmit is { IsCompleted: false })
+            return _pendingSubmit;
+
+        _pendingSubmit = RunAsync();
+        return _pendingSubmit;
+
+        async Task RunAsync()
         {
-            CurrentScreen.Value = SearchConfigEditorScreen.Entry;
-            Status.Value = new ConfigStatusMessage($"Search settings save failed: {ex.Message}", ConfigStatusTone.Error);
-            RequestRedraw();
+            try
+            {
+                await SubmitCurrentConfigurationAsync(ct);
+            }
+            catch (Exception ex)
+            {
+                CurrentScreen.Value = SearchConfigEditorScreen.Entry;
+                Status.Value = new ConfigStatusMessage($"Search settings save failed: {ex.Message}", ConfigStatusTone.Error);
+                RequestRedraw();
+            }
         }
     }