refactor(frontend): extract state owners and verify IPC contracts

[jewei]

Changes

• Extract focused launcher-session, native-subscription, and settings-draft owners without changing the SolidJS/Tauri stack or moving search logic out of Rust.
• Merge remote settings by field while preserving local edits. In particular, remote removal of a hidden-app preference now unhides it without losing dirty aliases.
• Replace message-prefix behavior with structured warning codes; storage retryability comes from actual Busy health, not English text.
• Generate canonical serialized examples and exact recursive TypeScript wire/command declarations from Rust. Test-only ts-rs/syn cover actual handler argument domains and success types; runtime wrapper probes consume the same parsed metadata.
• Preserve request IDs, out-of-band backend cancellation, main-only permissions, typed appearance relay, and stale-reply rejection across hide/reopen/dispose.

Independent reviews and repairs

• Initial independent review found that sample assignability missed optional fields, nullable narrowing, command returns, and argument-union drift. The repair adds exact equality and 17 deliberate rejected mutations, representative Some/None examples, and fail-closed parser/serde tests.
• Fresh independent item reviewers 3f96127b-b4b2-458 and 744efc5c-b5fa-4a3 approved 86940f7, independently running Rust/TypeScript/browser checks and inspecting all mutation failures.
• Fresh combined reviewers fe061e2a-d355-46f and 561b5657-535f-40b approved cross-item wiring and the subsequent generic-runtime/canonical-argument contracts. The separately reviewed native harness additions also have two fresh approvals recorded in fix(files): cancel obsolete scans and bound refresh work #12.
• The final frontend tree exactly matches the integration tree (6699dfcd5d6390c47e08d8b4a4a2a6443d64b69f). These are subagent code/test reviews, not claimed human GitHub approvals.

Verification

• bun run verify:full: 44 verifier tests, 230 Rust tests, 219 browser tests, formatting/types/Clippy/build and both profiling-harness compile modes passed. The default Rust suite reported seven ignored desktop/performance tests.
• Final 55 focused tests passed on clean current-base head d7f7bb5, covering controllers, contracts, drafts/settings, appearance, single-flight coordination, and native timing/protocol helpers. Inspected successful hide/reopen, remote-unhide, and drift traces; all 17 mutation diagnostic attachments are retained. Reopen coverage waits for actual new submission rather than guessing microtask counts and rejects stale rows/notices/warnings while the new session remains pending.
• Combined-tree preflight 36383841575 passed all platform jobs and Windows/Linux installed native journeys. Inspected artifacts identify matching build/test source 32a2a66d4af19ef250123ff1ae5bd4a690458830, unchanged source, complete cleanup, and all 25 samples per scenario.

Final PR-context run 36389158435 passed all platform jobs, Windows/Linux installed native journeys, and the protected Required checks gate for head 4c85552. Artifacts identify source 6f60de27306b984a354cd64c25bc76dca1b3ebfd with the exact reviewed tree above, matching build/test identities, unchanged source, complete cleanup, and 25 retained samples per scenario.

An earlier current-base run failed only at Chromium screenshot capture after calculator-copy assertions passed. Its diagnostics remain retained. A fresh-runner workflow on unchanged source passed; because GitHub requires the PR merge-context suite, an empty CI commit obtained the final PR-context run. No source, assertion, screenshot, or required job was weakened.

Package SHA-256:

• Windows installer: 23b391ec6e3c241a5f22e3a645fc8c5842db98de54770be879d057720f4862b6
• Linux Debian package: 71a52b4f46158dbcb1d6a6ea8448a1f773c57a23bf637857f314fc24eaa03828

Browser IPC is mocked; it is not native authorization or physical desktop proof. Native evidence covers its explicit package-bound journeys, not macOS/Wayland interaction or actual screen paint. No production release was published.

[jewei]

Current-base run 36386653460 was blocked by a Chromium Page.captureScreenshot protocol error after the calculator-copy functional assertions passed (218 other tests passed). Retained the original diagnostics and inspected its trace: the page snapshot remained coherent; no additional navigation/reload or application-console failure was observed. Native jobs were correctly skipped and the required gate failed closed. Resetting the test environment through a fresh full workflow_dispatch on unchanged head d7f7bb5; no assertion, screenshot, or required job is being removed. The separate run preserves the failed run and its immutable artifacts.

[jewei]

The fresh-runner reset (36387898202) passed the complete browser suite and native test steps on unchanged source. GitHub still associates the PR gate with its failed merge-context check suite, rather than the separately dispatched head-commit suite. Creating a source-identical empty CI commit to obtain a fresh PR-context run; this preserves both earlier runs and their artifacts and does not bypass protection.