Preserve unknown outcomes after mobile action response loss

[BunsDev]

Outcome

Keep a consequential mobile pane action explicitly reconciliation-required when its request may have taken effect but its reply is lost. Parent outcome: #200; related recovery work: #199.

Confirmed source behavior

At main a42dc61, RemoteActionStore.respond consumes the action session before awaiting ControlRequesting.send. Its catch path calls fail(), which removes the pane from busyPaneIDs and presents an ordinary failure. Dismissing that presentation permits a fresh action. The control request timeout does not cancel host execution.

An operation such as merge can update the target branch and then wait for a hook before returning. A timeout/disconnect during that interval cannot establish that the merge failed. The current UI says That did not work and permits a new action without authoritative reconciliation. This was independently identified in review of #429 and remains in its merged source; the later fixture-client wiring correction does not change RemoteActionStore error semantics.

This is a source-ordering finding, not a claim that physical-device duplication has already been observed.

Acceptance

• Reproduce lost reply after a confirmed disposable host-side effect using the production action request path.
• Distinguish known pre-dispatch rejection from may-have-executed outcomes; no blanket error-to-failure conversion.
• Preserve request/session, pane, host and generation context for authoritative reconciliation without persisting raw input, credentials, or prompts.
• A dismiss/retry/reconnect/host switch cannot turn an unknown effect into an ordinary fresh request or attach an old result to a new scope.
• Observe the canonical outcome or an explicit operator recovery path before clearing the consequential-action guard.
• Add negative timeout/disconnect/late-response/cross-host tests and independent R3 review. Do not infer completion from a changed UI label alone.

Boundaries

Do not invent canonical action identity or receipts in the UI. Preserve Beads/product-outcome separation. Existing author work on the merge/PR workflow branch must be integrated without overwriting it.

[BunsDev]

Current-main characterization and next decision

Investigated source 99311138921b7d5108fef9b2bff21fccd9580e5d after #436/#437. The defect remains; no implementation or closure is claimed.

A disposable probe using production MobileControlGateway and RemoteActionSessions confirmed this sequence: actions.respond commits a real filesystem marker before its reply is available; owner cleanup does not cancel the running callback; discarding its eventual reply leaves the effect committed; reconnecting cannot consume the old connection-owned session; starting a fresh action on the same pane commits a second effect.

Evidence boundary: the probe injected a disposable executor and invoked the same owner-cleanup method used on disconnect. This is gateway-boundary characterization, not actual WebSocket/iOS or production Git-merge end-to-end acceptance. No physical-device or distribution claim follows.

The current mobile bridge exposes start/respond/result, but no retained terminal-outcome lookup or operator recovery operation. Its callback execution does not use the separate daemon journal described in the control-plane documentation. Request correlation IDs and single-use continuation IDs cannot be promoted into canonical action identity. A timeout label or an acknowledgement button alone would not safely release the guard.

Decision needed before a complete repair: approve either a host-owned outcome/recovery adapter with bounded durable correlation and restart semantics, or an explicit authorized operator procedure that establishes the old execution cannot continue and reconciles its effects before guard release. This investigation does not establish that an upstream repository change is mandatory; it establishes that no existing approved release mechanism was found on this path.

Focused existing command: pnpm exec vitest run __tests__/actions/remoteActionSessions.test.ts __tests__/bridge/mobileControlGateway.test.ts __tests__/bridge/mobileActionRegistration.test.ts __tests__/bridge/mobileControlProtocol.test.ts — 69 passed. The separate disposable characterization passed once its wire payload was corrected. Full source/iOS acceptance was not run because no implementation was made.

Remaining gates: approved release contract, durable scope-preserving guard, pre-dispatch versus ambiguous-delivery classification, production-path lost-reply reproduction, timeout/disconnect/late-response/cross-host/restart regressions, and independent R3 review. Keeping this issue open and skipping owner-dependent implementation rather than silently inventing recovery authority.