fix: preserve live provider identity across session resume

Address PR #892 review feedback: resume retains the live client identity and model, stored-key case collisions explain manual recovery, and persistence errors appear only once.

Regression tests fail on the reviewed implementation and pass with these changes. Full tests, focused config/CLI/TUI race tests, vet, formatting, release build/smoke, and vulnerability checks pass. Static lint reports four existing suggestions in unchanged files.

Amp-Thread-ID: https://ampcode.com/threads/T-01a0d88d-fcb4-774c-adf5-d34813060e5a
Co-authored-by: Pierre Bruno <pierrebruno@hotmail.ch>

Author: ampagent

internal/config/writer.go

@@ -194,6 +194,11 @@ func RepairUnnamedProvider(path string, replacement string) (result FileConfig,
 			name = "openai"
 		}
 	}
+	if cfg.Providers[unnamed].APIKeyStored {
+		if sibling, collides := conflictingProviderRowName(cfg, unnamed, legacyName); collides && sibling != legacyName {
+			return FileConfig{}, "", fmt.Errorf("the unnamed provider's stored credential uses identity %q, which conflicts with persisted provider %q; manually rename the sibling %q in config.json and reconcile any of its credential references before retrying `zero providers repair-config`; --name cannot safely move the stored credential", legacyName, sibling, sibling)
+		}
+	}
 	if conflict, collides := conflictingProviderRowName(cfg, unnamed, name); collides {
 		if explicit {
 			return FileConfig{}, "", fmt.Errorf(

internal/config/writer_test.go

@@ -1499,6 +1499,27 @@ func TestRepairUnnamedProviderAllowsExplicitUniqueName(t *testing.T) {
 	}
 }
 
+func TestRepairUnnamedStoredProviderCaseCollisionExplainsManualRecovery(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "config.json")
+	before := writeConfigFixture(t, path, FileConfig{
+		ActiveProvider: "legacy",
+		Providers: []ProviderProfile{
+			{APIKeyStored: true},
+			{Name: "LEGACY"},
+		},
+	}, 0o600)
+	for _, name := range []string{"", "work", "Legacy"} {
+		_, _, err := RepairUnnamedProvider(path, name)
+		if err == nil || !strings.Contains(err.Error(), `manually rename the sibling "LEGACY" in config.json`) {
+			t.Fatalf("repair with name %q must explain the manual recovery: %v", name, err)
+		}
+		after, readErr := os.ReadFile(path)
+		if readErr != nil || !bytes.Equal(before, after) {
+			t.Fatal("refused repair changed config")
+		}
+	}
+}
+
 func TestEnsureCatalogProviderValidatesBeforeExistingProfileShortcut(t *testing.T) {
 	path := filepath.Join(t.TempDir(), "config.json")
 	before := writeConfigFixture(t, path, FileConfig{Providers: []ProviderProfile{{Name: "xai"}, {Name: "XAI"}}}, 0o600)

internal/tui/command_center.go

@@ -633,11 +633,11 @@ func (m model) switchProviderModel(providerName, modelID string) (model, string,
 		switch {
 		case err != nil:
 			persistErr = err
-			persistNote = "\nNote: the switch applies to this session, but config.json could not be read: " + redaction.RedactString(err.Error(), redaction.Options{})
+			persistNote = "\nNote: the switch applies to this session, but config.json could not be read."
 		case owner.UserBacked:
 			if cfg, err := config.SetActiveProviderModel(m.userConfigPath, owner.PersistedName, target.Model); err != nil {
 				persistErr = err
-				persistNote = "\nNote: the switch applies to this session, but config.json was not updated: " + redaction.RedactString(err.Error(), redaction.Options{})
+				persistNote = "\nNote: the switch applies to this session, but config.json was not updated."
 			} else {
 				persisted = true
 				// Reconcile the in-memory list the manager and picker read from,

internal/tui/command_center_test.go

@@ -188,6 +188,9 @@ func TestSwitchProviderModelReportsPersistenceFailures(t *testing.T) {
 		if !strings.Contains(status, "config.json could not be read") {
 			t.Fatalf("status = %q, want a persistence note", status)
 		}
+		if strings.Count(status, err.Error()) != 1 {
+			t.Fatal("persistence error must appear exactly once in the switch status")
+		}
 		// The session did switch, which is exactly why the note has to be there.
 		if next.providerName != "OpenAI" {
 			t.Fatalf("providerName = %q, want OpenAI", next.providerName)
@@ -208,6 +211,9 @@ func TestSwitchProviderModelReportsPersistenceFailures(t *testing.T) {
 		if !strings.Contains(status, "config.json was not updated") {
 			t.Fatalf("status = %q, want the active-provider persistence note", status)
 		}
+		if strings.Count(status, err.Error()) != 1 {
+			t.Fatal("persistence error must appear exactly once in the switch status")
+		}
 	})
 
 	t.Run("env-derived provider stays silent", func(t *testing.T) {

internal/tui/model_test.go

@@ -1243,7 +1243,7 @@ func TestResumeAfterDeletingLiveProjectRow(t *testing.T) {
 		deleteLiveRow bool
 		sameSession   bool
 	}{
-		{name: "different session clears retained identity", deleteLiveRow: true},
+		{name: "different session retains deleted identity", deleteLiveRow: true},
 		{name: "same session retains deleted identity", deleteLiveRow: true, sameSession: true},
 		{name: "no deletion preserves nonempty live fields"},
 	} {
@@ -1277,18 +1277,28 @@ func TestResumeAfterDeletingLiveProjectRow(t *testing.T) {
 				m.providerWizard = nil
 			}
 			wantProvider, wantModel, wantRemoved := m.providerName, m.modelName, m.removedLiveRow
+			liveClient, liveProfile := m.provider, m.providerProfile
 			if tc.sameSession {
 				target = previous
-			} else if tc.deleteLiveRow {
-				wantProvider, wantModel, wantRemoved = "work", "resumed-model", ""
 			}
 			next, message := m.handleResumeCommand(target.SessionID)
 			if message != "" || next.activeSession.SessionID != target.SessionID {
 				t.Fatalf("resume failed: %s", message)
 			}
+			// Resume loads history, not a new provider. Labels and retained row
+			// ownership must still describe the client that answers the next turn.
+			if next.provider != liveClient || len(built) != 0 || !reflect.DeepEqual(next.providerProfile, liveProfile) {
+				t.Fatal("resume changed the live client or its endpoint/credential profile")
+			}
 			if next.removedLiveRow != wantRemoved || next.providerName != wantProvider || next.modelName != wantModel || next.activeProviderRowName() != wantProvider {
 				t.Fatalf("resume identity = (%q, %q, %q, %q), want (%q, %q, %q, %q)", next.removedLiveRow, next.providerName, next.modelName, next.activeProviderRowName(), wantRemoved, wantProvider, wantModel, wantProvider)
 			}
+			if !transcriptContains(next.transcript, "model: project-model") || !transcriptContains(next.transcript, "provider: WORK") {
+				t.Fatal("resume summary does not describe the live project client")
+			}
+			if !tc.sameSession && !transcriptContains(next.transcript, "(recorded: resumed-model)") {
+				t.Fatal("resume summary does not distinguish the recorded model from the live model")
+			}
 			assertUserRowUntouched(t, next, before)
 		})
 	}

internal/tui/session.go

@@ -236,13 +236,8 @@ func (m model) handleResumeCommand(args string) (model, string) {
 	m.activeSession = *session
 	m.pendingSessionTitle = ""
 	m.sessionEvents = append([]sessions.Event{}, events...)
-	if session.SessionID != previousID && m.removedLiveRow != "" {
-		// A deleted row belongs to the previous session. Adopt the resumed
-		// metadata instead of carrying that retained identity into this one.
-		m.removedLiveRow = ""
-		m.providerName = session.Provider
-		m.modelName = session.ModelID
-	}
+	// Resume replaces conversation history, not the live client. Keep its
+	// identity (including a removed row) and model until an actual provider switch.
 	if m.providerName == "" {
 		m.removedLiveRow = ""
 		m.providerName = session.Provider