fix(hub): keep ambiguous queued-message cancels indeterminate

[welfvh]

Summary

• stop treating a cancel ACK timeout or not-found as proof that the CLI consumed the queued prompt
• persist the row as indeterminate, publish messages-indeterminate, and return the existing busy response
• retain the invoked path only for an explicit consumed: true ACK
• update the mature-scheduled race contract and regression tests

Why

A client pressing Cancel could cause the hub to stamp invoked_at and emit messages-consumed solely because the CLI did not answer or could not find the queue entry. The client then correctly rendered the server-authoritative row as sent, making Cancel appear to deliver the prompt. Timeout/not-found is ambiguous; it is not evidence of model consumption.

Verification

• bun test hub/src/sync/messageService.test.ts — 52 passed
• bun run test:hub — 1,209 passed, 3 skipped, 0 failed
• bun run typecheck:hub — passed

This pull request was generated with AI assistance (OpenAI Codex) and manually reviewed/tested before submission.

[github-actions]

Findings

• None.

Summary

Review mode: initial

No issues found in the added or modified lines. Residual risk: repository code was not executed under this review’s security constraints; static review covered the cancel ACK state machine, concurrent consumed/cancel transitions, SSE propagation, and explicit retry/discard handling.

Testing

Not run (automation). GitHub integration check passed; the main test check was pending at review time.

HAPI Bot