feat(remote): add host-owned mobile message queues

[bobleer]

Summary

Allow mobile web users to send follow-ups while a turn runs, inspect the host-owned queue, remove unstarted messages, and steer a selected message into the observed active turn. Once the execution host accepts a message, closing the browser or disconnecting the phone no longer makes dispatch depend on that client.

Desktop native sessions and capable CLI/desktop Peer Device controllers use the same scheduler-owned queue. Add typed queue operations, capability negotiation, stable submission/operation receipts, and an IndexedDB outbox for ambiguous responses.

Type and Areas

Type: Feature / reliability fix

Areas: Rust scheduler and runtime contracts, Remote Connect, desktop/Tauri, CLI peer host, web UI, mobile web, localization and generated capability registry.

Motivation / Impact

The mobile composer previously replaced Send with Stop during execution and exposed no queue-management UI. Desktop follow-ups depended on a frontend queue and drain loop.

• Keep Send and Stop independently available on mobile; expose authoritative queue snapshots and queue-only cancellation.
• Make host outcome handling start accepted follow-ups without client queries or subscriptions.
• Deduplicate submissions and operations with stable IDs, payload fingerprints and an owner epoch. Lost acknowledgements are queried before retransmission.
• Retain blocked messages and steering payloads until consumption is acknowledged. Remove stale injections on interruption so recovery cannot consume a blocked message twice.
• Preserve desktop legacy drafts and record edit intent before cancellation so lost responses cannot discard the complete draft.

Verification

Passed locally:

• cargo test --locked -p openbitfun-core --no-default-features --features remote-connect,git --lib agentic::coordination::scheduler::tests — 52 tests, including 11 host queue regressions and real Coordinator follow-up admission without a client.
• cargo test --locked -p openbitfun-runtime-ports --no-default-features --features agent-api --lib dialog_queue::tests — 2 tests.
• cargo test --locked -p openbitfun-services-integrations --no-default-features --features remote-connect --test remote_connect_contracts dialog_queue_wire — legacy/new wire round trip passed.
• NODE_OPTIONS=--no-experimental-webstorage pnpm --dir src/web-ui exec vitest run src/flow_chat/services/flow-chat-manager/MessageModule.test.ts src/flow_chat/services/flow-chat-manager/PendingQueueModule.test.ts src/flow_chat/components/PendingQueuePanel.test.tsx src/flow_chat/session-drivers/local/LocalSessionDriver.test.ts — 48 tests. The Node flag addresses the installed Node version's jsdom/localStorage interaction.
• pnpm --dir src/mobile-web run test:host-queue — 13 tests, including real Chromium page close/reopen with IndexedDB and compact Send/Stop rendering.
• node --test src/mobile-web/tests/session-stream-browser.test.mjs src/mobile-web/tests/host-stream.test.mjs — 12 tests.
• pnpm --dir src/mobile-web run test:ui-components
• pnpm --dir src/mobile-web exec tsc --noEmit
• pnpm --dir src/web-ui exec tsc --noEmit
• pnpm run build:mobile-web
• cargo check --locked -p openbitfun-cli -p openbitfun-desktop
• node scripts/generate-interactive-capabilities.mjs --check
• node scripts/check-core-boundaries.mjs
• pnpm run i18n:audit
• pnpm run theme:color-audit:all — all 23 surfaces passed.
• pnpm run check:repo-hygiene, pnpm run fmt:rs, and git diff --check.

Reviewer Notes

Pending work and receipts remain in host memory. The guarantee starts at host acceptance and requires the execution host to remain running; host restart durability is outside this change. A changed queue epoch prevents automatic replay and preserves cached drafts for an explicit recovery decision.

Queue observation uses bounded, single-flight authoritative polling; polling never drives execution. ACP, Detached Dispatch and older hosts retain their existing driver paths. Generated registry artifacts are included; the local implementation spec and scratch artifacts are excluded under repository policy.

Remote evidence is automated: actual scheduler/coordinator tests, wire compatibility tests and Chromium fixtures with simulated hosts/relay. Physical phone termination/network loss, live SSH workspaces, live peer control, detached dispatch and remote permission answering were not exercised end to end. A pre-existing runtime-port test initializer missing workspace_id was repaired to enable the contract tests.

Checklist

• This PR is focused and does not include secrets, temporary prompts, generated scratch files, or unrelated artifacts.
• Relevant verification is recorded above, or skipped checks are explained.
• User-facing strings, docs, and locales are updated where applicable.

Integration with remote rollback (#3137)

This branch includes #3137 so CI checks the combined mobile queue and rollback behavior. Merge #3137 first, then this PR. Conflicts preserve both the host queue admission lock and the rollback idle precondition: rejected rollback does not retire queued/blocked messages, change the queue epoch, or lose unconsumed steering payloads.

Combined local validation passed: 53 scheduler tests, 74 remote-connect protocol tests, 57 runtime-port contract tests, 69 focused Web UI/mobile chat tests, 13 host-queue/browser tests, 21 mobile workspace/protocol tests, mobile TypeScript, i18n audit, and all 23 theme surfaces. The complete CI Web UI suite exposed missing mocks in two pre-existing tests; these are updated with an additional queued-work rollback regression. Capability-list assertions now include both new offers.