@@ -82,6 +82,7 @@ export class ContextProxy {
 
 	constructor(context: vscode.ExtensionContext) {
 		this.originalContext = context
+
 		this.stateCache = {}
 		this.secretCache = {}
 		this._isInitialized = false
@@ -401,6 +402,12 @@ export class ContextProxy {
 	 */
 	private readonly stateWriteOwner = new Map<string, object>()
 	private readonly secretWriteOwner = new Map<string, object>()
+	/**
+	 * The secret writes that are still in flight, each paired with the claim it took,
+	 * so a reset can wait for them to settle before it deletes the keys. Without the
+	 * pairing a reset cannot tell a settled-but-orphaned write from a live one.
+	 */
+	private readonly pendingSecretWrites = new Map<string, Set<{ settle: Promise<void> }>>()
 	/** How many writes of each secret were started. Unlike the owners, it is not cleared when a write is over. */
 	private readonly secretWriteCount = new Map<string, number>()
 
@@ -465,7 +472,19 @@ export class ContextProxy {
 		// cache (it stays empty until the next write, `refreshSecrets` or a restart) rather than being served.
 		// The entry of the key is removed when the write and its read-back are over (if it is still the latest). A store
 		// that throws at once is turned into a rejection, so it is handled the same.
+		const pending = this.pendingSecretWrites.get(key) ?? new Set<{ settle: Promise<void> }>()
+		let settleWrite: () => void = () => {}
+		const entry: { settle: Promise<void> } = {
+			settle: new Promise<void>((resolve) => {
+				settleWrite = resolve
+			}),
+		}
+		pending.add(entry)
+		this.pendingSecretWrites.set(key, pending)
 		const release = () => {
+			pending.delete(entry)
+			if (pending.size === 0) this.pendingSecretWrites.delete(key)
+			settleWrite()
 			if (this.secretWriteOwner.get(key) === owner) this.secretWriteOwner.delete(key)
 		}
 		const stored = (async () =>
@@ -727,6 +746,13 @@ export class ContextProxy {
 	 * @returns A promise that resolves when all reset operations are complete
 	 */
 	public async resetAllState() {
+		// A secret write that is in flight at this moment has already committed nothing, but it will
+		// commit as soon as it settles, and the deletes below cannot un-commit a write that lands
+		// after them. Wait for the pending writes first, then end the claims, then delete, so the
+		// cleared copy is the last one to land in storage and the cache stays empty afterwards.
+		const inFlight = [...this.pendingSecretWrites.values()].flatMap((writes) => [...writes].map((w) => w.settle))
+		await Promise.allSettled(inFlight)
+
 		// Clear in-memory caches
 		this.stateCache = {}
 		this.secretCache = {}
@@ -735,6 +761,11 @@ export class ContextProxy {
 		for (const key of this.stateWriteGenerations.keys()) {
 			this.stateWriteGenerations.set(key, (this.stateWriteGenerations.get(key) ?? 0) + 1)
 		}
+		// A reset also ends write ownership: a write that is still in flight reads the Memento back
+		// into the cache it just lost, so clearing the caches is not enough to keep pre-reset state
+		// out. Ownership is what the rejection handlers gate on.
+		this.stateWriteOwner.clear()
+		this.secretWriteOwner.clear()
 
 		await Promise.all([
 			...GLOBAL_STATE_KEYS.map((key) => this.originalContext.globalState.update(key, undefined)),
 
@@ -150,16 +150,85 @@ describe("ContextProxy", () => {
 					rejectPending = reject
 				}),
 			)
-
 			const pending = proxy.updateGlobalState("apiProvider", "anthropic")
 			await proxy.resetAllState()
+			// The Memento answers the read-back with the pre-reset value: only ending write ownership
+			// during the reset keeps the cache cleared. With the mocked store this is the difference
+			// between the guarantee holding and the rejected write repopulating the cache.
+			mockGlobalState.get.mockImplementation((key: string) => (key === "apiProvider" ? "anthropic" : undefined))
 			rejectPending(new Error("disk full"))
-
 			await expect(pending).rejects.toThrow("disk full")
-			// The reset cleared the cache: restoring the pre-reset value would resurrect state
-			// that storage no longer holds.
 			expect(proxy.getGlobalState("apiProvider")).toBeUndefined()
 		})
+		it("does not restore a pre-reset secret when a pending storeSecret settles after the reset", async () => {
+			const durable = new Map<string, string | undefined>()
+			let settle: () => void = () => {}
+			mockSecrets.get.mockImplementation(async (key: string) => durable.get(key))
+			mockSecrets.delete.mockImplementation(async (key: string) => {
+				durable.delete(key)
+			})
+			mockSecrets.store.mockImplementationOnce(
+				(key: string, value: string) =>
+					new Promise<undefined>((resolve) => {
+						settle = () => {
+							durable.set(key, value)
+							resolve(undefined)
+						}
+					}),
+			)
+
+			const pending = proxy.storeSecret("apiKey", "pre-reset-secret")
+			setTimeout(settle, 0)
+			await proxy.resetAllState()
+			await pending
+			expect.soft([
+				await mockSecrets.get("apiKey"),
+				proxy.getSecret("apiKey"),
+				mockSecrets.delete.mock.calls.length,
+			])
+
+			// The pending store is held open on a double that only puts the value into storage
+			// when it settles, so the ordering is observable: the reset must wait for the write to
+			// settle and then delete the keys, so neither the cache nor the durable copy keeps the
+			// value that was in flight when the reset started.
+			expect(await mockSecrets.get("apiKey")).toBeUndefined()
+			expect(proxy.getSecret("apiKey")).toBeUndefined()
+		})
+
+		it("adopts a secret write issued after a reset that waited for a pending write", async () => {
+			const durable = new Map<string, string | undefined>()
+			let settle: () => void = () => {}
+			mockSecrets.get.mockImplementation(async (key: string) => durable.get(key))
+			mockSecrets.delete.mockImplementation(async (key: string) => {
+				durable.delete(key)
+			})
+			mockSecrets.store.mockImplementationOnce(
+				(key: string, value: string) =>
+					new Promise<undefined>((resolve) => {
+						settle = () => {
+							durable.set(key, value)
+							resolve(undefined)
+						}
+					}),
+			)
+
+			const pending = proxy.storeSecret("apiKey", "pre-reset-secret")
+			const reset = proxy.resetAllState()
+			setTimeout(settle, 0)
+			await pending
+			await reset
+
+			// The reset released only its own claims, so the machinery stays usable afterwards:
+			// a write issued once the reset has settled is adopted into the cache and reaches storage.
+			// Back the post-reset write with the durable double as well, so the assertion below reads
+			// storage rather than only the cache.
+			mockSecrets.store.mockImplementationOnce(async (key: string, value: string) => {
+				durable.set(key, value)
+			})
+			await proxy.storeSecret("apiKey", "newer-secret")
+			expect(proxy.getSecret("apiKey")).toBe("newer-secret")
+			expect(await mockSecrets.get("apiKey")).toBe("newer-secret")
+		})
 
 		it("should bypass cache for pass-through state keys", async () => {
 			// Setup mock return value
 
@@ -983,6 +983,17 @@ describe("ProviderSettingsManager", () => {
 			)
 		})
 
+		it('keeps a storage failure whose message mentions "not found" out of the typed not-found signal', async () => {
+			mockSecrets.get.mockRejectedValue(new Error("vault: secret not found"))
+
+			// A message-based classifier would treat this as a missing profile. The typed
+			// signal must stay reserved for a missing config entry.
+			await expect(providerSettingsManager.deleteConfig("default")).rejects.not.toBeInstanceOf(
+				ProviderSettingsNotFoundError,
+			)
+			await expect(providerSettingsManager.deleteConfig("default")).rejects.toThrow("Failed to delete config")
+		})
+
 		it("should throw error when trying to delete last remaining config", async () => {
 			mockSecrets.get.mockResolvedValue(
 				JSON.stringify({
 
@@ -370,8 +370,7 @@ describe("importExport", () => {
 			})
 
 			expect(result.success).toBe(true)
-			// Per-view selection state is machine-local: importing settings must not
-			// apply another machine's view pins, while other settings round-trip.
+			// Importing must not apply another machine's view pins.
 			expect(mockContextProxy.setValues).toHaveBeenCalledWith({ mode: "code" })
 			expect(result).not.toHaveProperty("globalSettings.viewStates")
 		})
 
@@ -99,9 +99,7 @@ function sanitizeGlobalSettings(rawGlobalSettings: unknown): {
 	for (const [key, rawValue] of Object.entries(rawGlobalSettings)) {
 		const path = `globalSettings.${key}`
 
-		// Per-view selection state is machine-local: it round-trips through the
-		// normal runtime and pruning paths, but importing it would pin selections
-		// from another machine's views on this one.
+		// Per-view selections are machine-local: they must not import across machines.
 		if (key === "viewStates") {
 			continue
 		}
 
@@ -164,6 +164,11 @@ import { PendingEditOperationStore, type PendingEditOperationInput } from "./Pen
 
 type PersistedViewState = NonNullable<GlobalState["viewStates"]>[string]
 type ViewLocalStateValues = Partial<RooCodeSettings> & Partial<ExtensionState>
+/**
+ * The subset of view-local values that has a durable per-view record. `saveViewState`
+ * and the mutation path handle exactly these keys, so the generic stays narrow enough
+ * for the compiler to reject e.g. `writeDelayMs`.
+ */
 type PersistedViewStateValues = Pick<ViewLocalStateValues, "mode" | "currentApiConfigName" | "apiConfiguration">
 
 /**
@@ -434,7 +439,7 @@ export class ClineProvider
 	public readonly viewId: string
 
 	/** Stable id for persisted per-view state keys, bound by the host-minted claim. */
-	private viewStateId: string = ""
+	private viewStateId: string
 
 	/**
 	 * Whether this instance wrote an entry under its own session-local temporary id.
@@ -474,15 +479,16 @@ export class ClineProvider
 		mdmService?: MdmService,
 	) {
 		super()
+		// Initialize viewId based on renderContext and monotonically increasing instance identifier for uniqueness.
+		// activeInstances is used for visibility/iteration checks, so we keep tracking instances separately.
+		this.viewId = `${renderContext}-${ClineProvider.nextViewId++}`
+		this.viewStateId = this.viewId
 		this.currentWorkspacePath = getWorkspacePath()
 		this.pendingEditOperations = new PendingEditOperationStore(
 			ClineProvider.PENDING_OPERATION_TIMEOUT_MS,
 			(message) => this.log(message),
 		)
 
-		// Derive the per-instance view id and bind the persisted view-state key to it.
-		this.viewId = `${renderContext}-${ClineProvider.nextViewId++}`
-		this.viewStateId = this.viewId
 		ClineProvider.activeInstances.add(this)
 		this.diagnosticsRecorder.record({ boundary: "provider", phase: "success", type: "created" })
 
@@ -510,6 +516,8 @@ export class ClineProvider
 			await this.postStateToWebviewWithoutClineMessages()
 		})
 
+		void this.loadViewState()
+
 		// Initialize MCP Hub through the singleton manager
 		McpServerManager.getInstance(this.context, this)
 			.then((hub) => {
@@ -2874,9 +2882,18 @@ export class ClineProvider
 
 			const activationResults = await Promise.allSettled([
 				this.updateGlobalState("listApiConfigMeta", await this.providerSettingsManager.listConfig()),
-				this.updateGlobalState("currentApiConfigName", name),
+				// Shared write: adds/updates the profile list entry and the current-profile name.
+				this.setValue("currentApiConfigName", name),
 				this.providerSettingsManager.setModeConfig(mode, id),
 				this.contextProxy.setProviderSettings(providerSettings),
+				// setProviderSettings bypasses the buffer path; the mutation below refreshes this view.
+				// One mutation carries both the name and the settings: pinnedProfileName reads the buffer,
+				// so a buffer that keeps the previous name while holding the new settings pins a profile
+				// this view no longer runs under.
+				this._saveViewLocalStateFromMutation({
+					currentApiConfigName: name,
+					apiConfiguration: providerSettings,
+				}),
 			])
 			const failedActivation = activationResults.find(
 				(result): result is PromiseRejectedResult => result.status === "rejected",
@@ -2987,6 +3004,7 @@ export class ClineProvider
 			await this._saveViewLocalStateFromMutation({ apiConfiguration: providerSettings })
 
 			// Refresh other views pinned to this profile so their overlays cannot go stale.
+			await this.refreshSiblingsAfterProfileSave(name, providerSettings)
 
 			// Change the provider for the current task.
 			// TODO: We should rename `buildApiHandler` for clarity (e.g. `getProviderClient`).
@@ -2996,13 +3014,53 @@ export class ClineProvider
 			await this.persistStickyProviderProfileToCurrentTask(name)
 		} else {
 			await this.updateGlobalState("listApiConfigMeta", await this.providerSettingsManager.listConfig())
+
+			// A non-activating save still changes the profile's settings: refresh the views
+			// that buffered a copy, or their getState() keeps the pre-save values.
+			if (this.pinnedProfileName === name) {
+				await this._saveViewLocalStateFromMutation({ apiConfiguration: providerSettings })
+				// Only rebuild a task that actually runs under the saved profile.
+				if (this.getCurrentTask()?.taskApiConfigName === name) {
+					this.updateTaskApiHandlerIfNeeded(providerSettings, { forceRebuild: true })
+				}
+			}
+			// A non-activating save changes the profile's settings too: refresh every sibling
+			// that buffered a copy (pinned siblings included), or their getState() keeps the pre-save
+			// values. This head had no sibling refresh at all before this change.
+			await this.refreshSiblingsAfterProfileSave(name, providerSettings)
 		}
 
 		if (signal.aborted) return id
 
 		await this.postStateToWebview()
 		return id
 	}
+	/**
+	 * Refresh the buffered overlay of every live sibling pinned to a saved profile and rebuild
+	 * any task that follows it. The handler rebuild is independent of the pin: a task restored
+	 * from history can follow profile A while its view pins profile B.
+	 */
+	private async refreshSiblingsAfterProfileSave(name: string, providerSettings: ProviderSettings): Promise<void> {
+		for (const instance of ClineProvider.getAllInstances()) {
+			if (instance === this || instance._disposed || instance.pinnedProfileName !== name) {
+				continue
+			}
+			// Direct private access: compile-time safe across sibling instances.
+			await instance._saveViewLocalStateFromMutation({ apiConfiguration: providerSettings })
+		}
+
+		const {
+			name: _recordName,
+			id: _recordId,
+			...taskSettings
+		} = providerSettings as ProviderSettings & { name?: string; id?: string }
+		for (const instance of ClineProvider.getAllInstances()) {
+			if (instance._disposed || instance.getCurrentTask()?.taskApiConfigName !== name) {
+				continue
+			}
+			instance.updateTaskApiHandlerIfNeeded(taskSettings, { forceRebuild: true })
+		}
+	}
 
 	async deleteProviderProfile(profileToDelete: ProviderSettingsEntry) {
 		const globalSettings = this.contextProxy.getValues()