Fix iOS deleted computer recovery empty state (#8712)

* Fix deleted computer recovery empty state

* Centralize deleted computer recovery state

* Tighten deleted computer recovery outcomes

* Fail closed on unknown deleted-computer recovery state

* Close team-switch recovery race

* Keep recovery button busy through reload

Author: azooz2003-bit

Packages/iOS/CmuxMobileShell/Sources/CmuxMobileShell/MobileShellComposite+ForgottenMacRecovery.swift

@@ -2,6 +2,18 @@ import CMUXMobileCore
 import CmuxMobilePairedMac
 import Foundation
 
+/// Result of an explicit, user-triggered deleted-computer recovery attempt.
+public enum MobileDeletedComputerRecoveryResult: Equatable, Sendable {
+    /// A forgotten Mac was found through same-account Iroh discovery and persisted again.
+    case recovered
+    /// No eligible forgotten Mac was live for the current account/team scope.
+    case notFound
+    /// A previous recovery attempt is still running, so this tap did not start another scan.
+    case alreadyInProgress
+    /// The account or team changed while recovery was running.
+    case staleScope
+}
+
 @MainActor
 extension MobileShellComposite {
     /// Recover a deleted Mac through live same-account Iroh discovery.
@@ -12,26 +24,30 @@ extension MobileShellComposite {
     /// connection path must authenticate the Mac's device ID and app-instance tag
     /// before persistence clears the forgotten marker.
     @discardableResult
-    public func recoverForgottenIrohMacFromAccount() async -> Bool {
+    public func recoverForgottenIrohMacFromAccount() async -> MobileDeletedComputerRecoveryResult {
+        guard !isRecoveringDeletedComputer else { return .alreadyInProgress }
+        isRecoveringDeletedComputer = true
+        defer { isRecoveringDeletedComputer = false }
+
         guard isSignedIn,
               let scope = await currentScopeSnapshot(),
-              let personalIrohDiscovery else { return false }
+              let personalIrohDiscovery else { return .notFound }
         let forgottenIDs = await forgottenMacDeviceIDs(scope: scope)
-        guard !forgottenIDs.isEmpty else { return false }
+        guard !forgottenIDs.isEmpty else { return .notFound }
 
         connectionRecoveryOwner.cancel()
         applyConnectionRecoveryOwnerState()
         invalidateStoredMacReconnectAttempt()
 
         let discovered = await personalIrohDiscovery.discoverLiveMacs()
-        guard await isScopeCurrent(scope) else { return false }
+        guard await isScopeCurrent(scope) else { return .staleScope }
         let candidates = forgottenIrohRecoveryCandidates(
             from: discovered,
             forgottenIDs: forgottenIDs
         )
 
         for mac in candidates {
-            guard await isScopeCurrent(scope) else { return false }
+            guard await isScopeCurrent(scope) else { return .staleScope }
             guard await isForgottenMacDeviceID(
                 mac.deviceID,
                 instanceTag: mac.instanceTag,
@@ -43,15 +59,17 @@ extension MobileShellComposite {
                 ifStillCurrent: { [weak self] in
                     guard let self else { return false }
                     return self.isSignedIn
+                        && self.secondaryAggregationScopeGeneration == scope.generation
                         && self.identityProvider?.currentUserID == scope.userID
                 }
             )
+            guard await isScopeCurrent(scope) else { return .staleScope }
             guard recovered else { continue }
             await loadPairedMacs()
             await loadRegistryDevices()
-            return true
+            return .recovered
         }
-        return false
+        return .notFound
     }
 
     private func forgottenIrohRecoveryCandidates(

Packages/iOS/CmuxMobileShell/Sources/CmuxMobileShell/MobileShellComposite.swift

@@ -1259,6 +1259,7 @@ public final class MobileShellComposite: MobileTerminalOutputSinking {
         storedPairedMacs = []
         pairedMacAliasIDsByRepresentativeID = [:]
         pairedMacs = []
+        pairedMacLoadState = .notLoaded
         hasRecoverableDeletedComputers = false
         resetTerminalThemes()
         // Likewise drop the registry-backed device tree so a shared device never
@@ -1371,6 +1372,7 @@ public final class MobileShellComposite: MobileTerminalOutputSinking {
         storedPairedMacs = []
         pairedMacAliasIDsByRepresentativeID = [:]
         pairedMacs = []
+        pairedMacLoadState = .notLoaded
         forgottenMacDeviceIDsByScope = [:]
         hasRecoverableDeletedComputers = false
         registryDevices = []
@@ -2107,6 +2109,16 @@ public final class MobileShellComposite: MobileTerminalOutputSinking {
 
     // MARK: - Paired Mac switching
 
+    /// Whether the current signed-in scope's paired-Mac list is known.
+    public enum PairedMacLoadState: Equatable, Sendable {
+        /// No load has completed for the current scope.
+        case notLoaded
+        /// The current scope's paired-Mac list loaded successfully.
+        case loaded
+        /// The current scope's paired-Mac list could not be loaded.
+        case failed
+    }
+
     /// Every Mac paired with this device, for the host switcher. Refreshed via
     /// ``loadPairedMacs()`` and after switch/forget. Cleared on sign-out so a
     /// shared device never shows the previous user's Macs. The active row is
@@ -2122,6 +2134,8 @@ public final class MobileShellComposite: MobileTerminalOutputSinking {
 
     /// Full store rows for identity-sensitive paths; ``pairedMacs`` is display-coalesced.
     private var storedPairedMacs: [MobilePairedMac] = []
+    /// Load status for ``pairedMacs`` in the current signed-in account/team scope.
+    public internal(set) var pairedMacLoadState: PairedMacLoadState = .notLoaded
     /// Visible representative id to all stored ids for that logical paired Mac.
     public private(set) var pairedMacAliasIDsByRepresentativeID: [String: [String]] = [:]
     /// Same-session delete tombstones keyed by signed-in account/team scope.
@@ -2136,6 +2150,9 @@ public final class MobileShellComposite: MobileTerminalOutputSinking {
     /// True when the current account/team scope has a deleted-computer marker
     /// that can be recovered through explicit same-account Iroh discovery.
     public internal(set) var hasRecoverableDeletedComputers = false
+    /// True while the explicit deleted-computer recovery path is scanning and
+    /// reconnecting through account-scoped Iroh discovery.
+    public internal(set) var isRecoveringDeletedComputer = false
 
     var pairedMacsForIdentityMatching: [MobilePairedMac] {
         storedPairedMacs.isEmpty ? pairedMacs : storedPairedMacs
@@ -2370,14 +2387,20 @@ public final class MobileShellComposite: MobileTerminalOutputSinking {
             storedPairedMacs = []
             pairedMacAliasIDsByRepresentativeID = [:]
             pairedMacs = []
+            pairedMacLoadState = .failed
             hasRecoverableDeletedComputers = false
             return
         }
+        pairedMacLoadState = .notLoaded
         let loaded: [MobilePairedMac]
         do {
             loaded = try await pairedMacStore.loadAll(stackUserID: scope.userID, teamID: scope.teamID)
         } catch {
             mobileShellLog.error("paired mac store loadAll failed: \(String(describing: error), privacy: .public)")
+            if await isScopeCurrent(scope) {
+                pairedMacLoadState = .failed
+                hasRecoverableDeletedComputers = false
+            }
             return
         }
         // The await above suspended the main actor; a sign-out, user switch, or
@@ -2392,6 +2415,7 @@ public final class MobileShellComposite: MobileTerminalOutputSinking {
             return
         }
         hasRecoverableDeletedComputers = hasForgottenMacs
+        pairedMacLoadState = .loaded
         storedPairedMacs = visibleLoaded
         let supportedRouteKinds = runtime?.supportedRouteKinds ?? []
         let coalesced = Self.coalescePairedMacsByDialEndpoint(

Packages/iOS/CmuxMobileShell/Tests/CmuxMobileShellTests/IrohZeroTouchDiscoveryTests.swift

@@ -98,7 +98,7 @@ struct IrohZeroTouchDiscoveryTests {
 
         await fixture.shell.loadPairedMacs()
         #expect(fixture.shell.hasRecoverableDeletedComputers)
-        #expect(await fixture.shell.recoverForgottenIrohMacFromAccount())
+        #expect(await fixture.shell.recoverForgottenIrohMacFromAccount() == .recovered)
 
         #expect(fixture.shell.connectionState == .connected)
         #expect(fixture.factory.attemptedRouteIDs() == ["iroh-mac-a"])
@@ -141,7 +141,7 @@ struct IrohZeroTouchDiscoveryTests {
 
         await fixture.shell.loadPairedMacs()
         #expect(fixture.shell.hasRecoverableDeletedComputers)
-        #expect(await fixture.shell.recoverForgottenIrohMacFromAccount())
+        #expect(await fixture.shell.recoverForgottenIrohMacFromAccount() == .recovered)
 
         #expect(fixture.factory.attemptedRouteIDs() == ["iroh-mac-a"])
         let rows = try await fixture.store.loadAll(stackUserID: "user-1", teamID: nil)
@@ -163,7 +163,7 @@ struct IrohZeroTouchDiscoveryTests {
             scope: scope
         )
 
-        #expect(!(await fixture.shell.recoverForgottenIrohMacFromAccount()))
+        #expect(await fixture.shell.recoverForgottenIrohMacFromAccount() == .notFound)
 
         #expect(fixture.shell.connectionState == .disconnected)
         #expect(fixture.factory.attemptedRouteIDs() == ["iroh-mac-a"])
@@ -175,6 +175,86 @@ struct IrohZeroTouchDiscoveryTests {
         ))
     }
 
+    @Test
+    func concurrentExplicitRecoveryReturnsAlreadyInProgress() async throws {
+        let live = try candidate(deviceID: "mac-a", endpointByte: "a")
+        let discovery = SuspendedIrohDiscovery(candidates: [live])
+        let fixture = try await makeFixture(
+            discovery: discovery,
+            reportedDeviceID: "mac-a"
+        )
+        defer { fixture.cleanup() }
+        let scope = try #require(await fixture.shell.currentScopeSnapshot(userID: "user-1"))
+        await fixture.shell.rememberForgottenMacDeviceID(
+            MobilePairedMac.pairingID(macDeviceID: "mac-a", instanceTag: "stable"),
+            scope: scope
+        )
+        let firstRecovery = Task { @MainActor in
+            await fixture.shell.recoverForgottenIrohMacFromAccount()
+        }
+        await discovery.waitUntilRequested()
+
+        #expect(await fixture.shell.recoverForgottenIrohMacFromAccount() == .alreadyInProgress)
+
+        discovery.resume()
+        #expect(await firstRecovery.value == .recovered)
+        #expect(fixture.factory.attemptedRouteIDs() == ["iroh-mac-a"])
+    }
+
+    @Test
+    func signOutWhileExplicitRecoveryIsSuspendedReturnsStaleScope() async throws {
+        let live = try candidate(deviceID: "mac-a", endpointByte: "a")
+        let discovery = SuspendedIrohDiscovery(candidates: [live])
+        let fixture = try await makeFixture(
+            discovery: discovery,
+            reportedDeviceID: "mac-a"
+        )
+        defer { fixture.cleanup() }
+        let scope = try #require(await fixture.shell.currentScopeSnapshot(userID: "user-1"))
+        await fixture.shell.rememberForgottenMacDeviceID(
+            MobilePairedMac.pairingID(macDeviceID: "mac-a", instanceTag: "stable"),
+            scope: scope
+        )
+        let recovery = Task { @MainActor in
+            await fixture.shell.recoverForgottenIrohMacFromAccount()
+        }
+        await discovery.waitUntilRequested()
+
+        fixture.shell.signOut()
+        discovery.resume()
+
+        #expect(await recovery.value == .staleScope)
+        #expect(fixture.factory.attemptedRouteIDs().isEmpty)
+        #expect(try await fixture.store.loadAll(stackUserID: "user-1", teamID: nil).isEmpty)
+    }
+
+    @Test
+    func teamSwitchWhileExplicitRecoveryIsSuspendedReturnsStaleScope() async throws {
+        let live = try candidate(deviceID: "mac-a", endpointByte: "a")
+        let discovery = SuspendedIrohDiscovery(candidates: [live])
+        let fixture = try await makeFixture(
+            discovery: discovery,
+            reportedDeviceID: "mac-a"
+        )
+        defer { fixture.cleanup() }
+        let scope = try #require(await fixture.shell.currentScopeSnapshot(userID: "user-1"))
+        await fixture.shell.rememberForgottenMacDeviceID(
+            MobilePairedMac.pairingID(macDeviceID: "mac-a", instanceTag: "stable"),
+            scope: scope
+        )
+        let recovery = Task { @MainActor in
+            await fixture.shell.recoverForgottenIrohMacFromAccount()
+        }
+        await discovery.waitUntilRequested()
+
+        fixture.shell.currentTeamDidChange()
+        discovery.resume()
+
+        #expect(await recovery.value == .staleScope)
+        #expect(fixture.factory.attemptedRouteIDs().isEmpty)
+        #expect(try await fixture.store.loadAll(stackUserID: "user-1", teamID: nil).isEmpty)
+    }
+
     @Test
     func unreachableCandidateFallsThroughToNextLiveMac() async throws {
         let first = try candidate(deviceID: "mac-a", endpointByte: "a")