fix(dispatch): make Hub-Edge task admission retry-safe

[DeliciousBuding]

Summary

Closes #2347.

• Atomically reserve delivery admission, release rejected attempts and commit a receipt only after acceptance. Pending contention returns 503 delivery_busy + Retry-After; accepted replays return the original data.runId without another executor start.
• Bind Hub deliveries to task identity across HTTP/Desktop thread representations, preserve legacy project/thread binding, and revalidate capability against the stored run. Conflicting bindings return 409 delivery_conflict.
• Desktop preserves delivery IDs, leaves explicit transient rejections queued, repairs lost task/relay ACKs on replay and never downgrades existing running/terminal state or repeats business acceptance notifications.
• Synchronize the public event/OpenAPI contract. A network-only browser fixture exercises the normal App → DesktopHubTaskBridge → useHubIntegration path; no production test seam or second retry loop was added.

Validation

Local integration evidence:

• Full Windows Edge short suite: passed (43.7 s); focused Windows tests and Linux race for deliverydedup/api/runcontrol/errcode passed, with go vet and staticcheck.
• Full Linux Hub short suite with CGO enabled: passed (98.1 s). Existing OpenAPI duplicate-key regression passed. Local Windows full Hub testing encountered a CGO toolchain environment failure; native Windows Hub validation is provided by the required CI matrix, not claimed as a local pass.
• Desktop Vitest: 54 files / 477 tests passed. App and test typechecks, changed-file ESLint, and renderer production build passed.
• Chromium: 6/6 tests passed (4 existing chat-flow cases + actual bridge delivery lifecycle in light/dark at 1440×810). The original implementation was used as a negative control and failed because a busy delivery became failed instead of queued; final source was restored and all 6 passed.
• Visual QA: 4 shell captures and geometry contracts passed (1440×810 and 800×900, light/dark); 1440×810 captures visually reviewed.
• Existing doc SSOT, conventions, OpenAPI/router, Edge error-status and frontend package-boundary verifiers passed.

CI: final head dc27348596dfed2ebfbc24d9336d2a1d3283a990 passed all seven required checks (validate, go-edge, go-hub, windows-go, windows-frontend, backend-required, frontend-required) in run 34058637542. The backend aggregate includes real PostgreSQL/Redis integration and the Edge/Hub fixture lanes. The first run caught a duplicate OpenAPI hubTaskId mapping introduced during document integration; it was corrected, not waived or retried unchanged.

Boundaries

Source plus fixture/renderer verification only: no production rollout, real-model/login E2E or packaged Desktop claim. The new browser regression was run locally through the existing Playwright entrypoint; it is not represented as a newly wired CI gate. Receipts are process-local, not crash-recovery records; queued runs are not automatically restarted. Persistent recovery and full model/workspace/context normalization across transports remain separate design slices. No credentials, migrations or live runtime changes.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: 812d6649-cd56-45bc-8ce5-c9ce2a71ae7a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}