Make provider profile activation compensate cross-store failures safely #2316

Summary

Implement cross-store compensation for the activation batch in ClineProvider.persistProviderProfile, with concurrent-view failure tests. Deliver this as a separate change from PR #2237.

Requested by @easonLiangWorldedtech. Automatic assignment failed with Resource not accessible by integration (replaceActorsForAssignable), so this issue is being created without an assignee.

Failure and scope

persistProviderProfile saves the profile through ProviderSettingsManager.saveConfig before activation. The activation batch uses Promise.allSettled for profile-list metadata, selected-profile persistence, the mode-profile mapping, shared provider settings, and the view-local configuration overlay.

When a member rejects, the first rejection is thrown after the batch settles. Successful writes remain committed. The throw skips updateTaskApiHandlerIfNeeded and persistStickyProviderProfileToCurrentTask, so storage, selection, configuration, and the running task can disagree.

The partial-commit semantics predate PR #2237. That PR routes the selected-profile write through setValue and adds the overlay update. With only apiConfiguration, _saveViewLocalStateFromMutation does not write durable viewStates. The added durable-write failure surface comes through setValue("currentApiConfigName", name).

Required changes

• Define the previous activation across ProviderSettingsManager secret-backed storage, mode mappings, ContextProxy, durable per-view selections, and view-local overlays.
• Choose one compensation owner: persistProviderProfile, or a consistent caller contract.
• Capture previous state and compensate committed writes after failure. Define how to recover the preceding saveConfig write for both existing and newly created profiles.
• Cover contextProxy.setProviderSettings(providerSettings) and providerSettingsManager.setModeConfig(mode, id), which currently have no previous-value capture or compensation in this batch.
• Preserve newer writes from other views during compensation. Do not replay stale whole-store snapshots.
• Use _restoreSharedValuesAfterFailedViewWrite and per-key getStateWriteGeneration guards where applicable. They cover ContextProxy keys only; define ownership or serialization for the other state.
• Reconcile updateProfileModel restoration with upsertProviderProfile, which currently logs, shows an error, and returns undefined.
• Define explicit recovery and error reporting when compensation fails, without logging credentials.

Affected areas and anchors

Line numbers below were supplied in the originating discussion and can move:

• src/core/webview/ClineProvider.ts: persistProviderProfile, Lines 2916–2941.
• src/core/webview/ClineProvider.ts: _restoreSharedValuesAfterFailedViewWrite, Lines 6396–6428.
• Related methods: upsertProviderProfile, updateProfileModel, setValue, _saveViewLocalStateFromMutation, updateTaskApiHandlerIfNeeded, and persistStickyProviderProfileToCurrentTask.
• src/core/config/ContextProxy.ts: shared provider-settings writes and per-key write generations.
• src/core/config/ProviderSettingsManager.ts: profile storage and mode mappings.
• src/core/webview/__tests__/ClineProvider.spec.ts and relevant storage-manager tests.

Acceptance criteria

• Inject failure in each durable activation write after other writes succeed. Await all activation writes before compensation and finish compensation before the mutation settles.
• Verify recovered consistency across profile storage, profile-list metadata, shared selection, shared provider settings, mode mapping, durable per-view selection, view overlay, task handler, and sticky task profile.
• Cover existing-profile updates and newly created profiles.
• Test another live view saving or activating a profile during compensation. Preserve newer writes, including same-value writes with newer generations.
• Test delayed writes and different completion orders.
• Test compensation failure and retry. Preserve the original failure and explicitly report incomplete recovery.
• Verify consistent behavior through upsertProviderProfile and updateProfileModel, without duplicate or conflicting compensation.
• Retain successful activation and sibling-view synchronization.
• Keep credentials out of diagnostics.

Backlinks

• PR: feat(webview): per-view ack, history and profile restore writes (N5, split 5/5 of #1546) #2237
• Review discussion and authorization: feat(webview): per-view ack, history and profile restore writes (N5, split 5/5 of #1546) #2237 (comment)

This issue records deferred work. It does not establish a fix or decide the PR's merge status.