fix(dispatch): preserve execution intent and single-owner callbacks

[DeliciousBuding]

Summary

Closes #2350.

• Preserve the same runtime intent across Hub direct HTTP and Desktop WS/relay: selected model/workspace, reasoning/thinking, explicit false/zero, system/append prompts, tools/config, runtime session flags, history/pins, schema and trace identity. Both projections consume one shared fixture; fixture-only edits select the existing Go and frontend lanes.
• Persist callback ownership with Edge admission and return the original owner on replay. Unsupported Edge versions receive no run POST. Desktop only emits task callbacks for an explicitly Desktop-owned run; contradictory receipts remain unresolved without ACK/FAIL/relay ACK.
• Gate direct execution on actual registered device identity and inviter ownership, then reserve that device before POST. Lost/unknown receipts retain the reservation through dispatcher restarts and outbox retries instead of starting another executor. A late receipt cannot downgrade running/completed state; a Desktop-owned replay restores only the original device bridge.
• Carry typed tool/permission/file/route/result events through the existing Edge callback client and per-run FIFO. Typed events have replay keys, bounded retry and queue backpressure; buffered text is flushed before typed boundaries. Preserve text coalescing and final fallback without double reporting.
• Treat Desktop network/5xx/malformed run receipts as unresolved, not proof that execution failed. Keep the existing review notification and Hub-owned retry path.

Compatibility and non-goals

• No workspace allowlist bypass, invented model/workspace, credential distribution, new client retry loop, process recovery or callback owner transfer.
• Team-context tasks remain on the existing Desktop control route: typed stream records do not invoke the authoritative team route-decision endpoint.
• Callback capability means configuration presence, not proven token validity/reachability. Bounded callback attempts are not a durable cross-process event replay guarantee.
• Source/fixture delivery only. No deployment, production restart, real login/model call, packaged Desktop or L3/L4 claim.

Acceptance evidence

Tested head: aab5f0623664942bb54189d021d56d7149ca3033; tree: a28b1e388be60c0dad38991d7bdbd87d701cb919.

Gate	Result
Edge Windows full short suite	PASS: go test -p 2 ./... -short -count=1 -cpu=4 -timeout=10m
Hub Linux full short suite	PASS; final dispatch/dispatchsvc changes also passed the race suite
Edge Linux race	PASS: API, runcontrol, store, lifecycle, hub
Edge vet / staticcheck	PASS
Hub full golangci-lint v2.12.2	PASS: 0 issues
Edge fixture subprocess L2	PASS: complete same-run callback set ACK=1 / stream=1 / done=1 / fail=0
Hub real PostgreSQL 16 + Redis integration	PASS: 157 top-level tests, including actual UUID binding and authorized ACK/done through late receipts
Desktop test:ci	PASS: 376 files / 4,972 tests across all four configurations
Desktop test types, changed-file ESLint, renderer build	PASS
Chromium behavior	PASS: 8 scenarios at 1440x810, light + dark; retry/ACK repair, full context, Edge-owned replay, owner conflict, old-Edge zero-POST, uncertain network/5xx state
Visual QA	PASS: 4 shell captures + 2 chat captures and DOM/geometry assertions; light/dark visually reviewed; review notification captured in the behavior lane
Docs, OpenAPI router contract, conventions	PASS
CI policy and negative tests	PASS: policy verifier + 43 negative/self-tests

Regression evidence includes PostgreSQL 22P02 for an empty-string UUID comparison, Desktop POST uncertainty being falsely marked failed, and pending text stranded before typed output. All are green after the changes. The local full L1 initially exposed a helper hardcoding the default PostgreSQL endpoint; it now reads the same test configuration as TestMain, and the entire L1 passed against isolated non-default fixture services.

The initial GitHub run caught a new sleep, Hub complexity/style lint, and an outdated Edge L2 ownership fixture. These were fixed rather than bypassed: direct preflight and post-admission response handling are separate, callbacks are explicitly configured/owned in the fixture, and three old sleep grace windows were replaced by event waits with a strictly smaller budget. All seven required checks passed individually on run 34072040715: validate, go-edge, go-hub, windows-go, windows-frontend, backend-required, frontend-required. Native Windows Hub verification is left to its required CI lane because the local CGO environment cannot run that suite; this is not a native-Windows local-pass claim.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: ab36a39e-7d49-424c-bef2-be0646cea3e4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}