[BingCHuanJ]

Summary

Fixes mobile web session model selection so switching sessions restores the model and reasoning settings saved by the selected host session instead of reusing a browser-wide preference.

• Keep model and reasoning settings scoped to the selected session.
• Prevent delayed, timed-out, or cancelled remote writes from overwriting another session.
• Preserve compatibility with legacy hosts.
• Add browser and Rust regression coverage.

Type and Areas

Type: bug fix

Areas: mobile web, remote connect, Rust core, desktop/CLI adapters, CI

Motivation / Impact

When a user changed the model in one remote session and then switched to another session in mobile web, the selected model could remain from the previous session instead of following the target session's saved configuration.

This change makes mobile web follow the same per-session behavior as the main application.

Verification

• pnpm --dir src/mobile-web run test:session-model-browser — 56/56 passed
• Remote model fence tests — 5/5 passed
• Remote Connect contract tests — 75/75 passed
• cargo check --offline --locked -p openbitfun-cli --bin openbitfun — passed
• pnpm --dir src/mobile-web exec vite build — passed
• pnpm run i18n:audit — passed
• pnpm run check:core-boundaries — passed
• pnpm run check:repo-hygiene — passed

Reviewer Notes

Browser coverage uses an isolated Chromium profile and covers modern and legacy hosts, session switching, stale responses, timed-out writes, cancellation, device changes, account isolation, and narrow layouts.

The local full Desktop check was blocked before Rust compilation by the missing generated file src/apps/extension-host/dist/extension-host.js. No related feature test failed.

Checklist

• This PR is focused and does not include secrets, temporary prompts, generated scratch files, or unrelated artifacts.
• Relevant verification is recorded above.
• User-facing strings and locales are updated where applicable.

[bobleer]

Review note: pushed 0a3355eaa.

• Legacy hosts: a timed-out write on a host without the fence stayed uncertain forever, which blocked model reads and message sends for that session until the page was reloaded, with a message telling the user to upgrade the host. Repository rules require keeping the older side on a working path. Without a token the client now reports the failure, re-reads the catalog and keeps the session usable. A late legacy write can still land, as it can today. The modelWriteUnconfirmedLegacy strings are gone and the browser test now asserts this behavior.
• test:workspace-identity was failing because RemoteSessionManager gained a value import from RelayHttpClient. The test loader now stubs it. CI does not run this script, so it stayed green.

Verified locally: type-check, test:session-model-browser 56/56, test:workspace-identity 24/24, fence and rpc_execution unit tests, i18n:audit, check:github-config. remote_connect_contracts has 2 failures from a capability list that is already stale on main, not from this PR.

Remaining risk: an accepted model write now holds the routing lease until it finishes, so a hung update_session_model_selection would delay account or device transitions. Only simulated hosts were exercised, no real device or relay. #3378 touches the same match in remote_connect.rs, so whichever lands second needs a small merge.