perf: overhaul session loading, caching, and runtime isolation (#2360)

Improve OpenChamber responsiveness under large session workloads while fixing
cache, synchronization, and persistence correctness across runtimes, projects,
directories, and worktrees.

- prioritize selected and visible sessions during bootstrap and defer
  non-critical enrichment work
- reduce redundant message loading, event processing, store publication, and
  hidden sidebar work
- prevent stale session and message requests from overwriting newer
  authoritative state
- preserve existing data when authoritative fetches fail instead of treating
  failures as successful empty responses
- scope session materialization, messages, drafts, queues, todos, pins,
  permissions, folders, tabs, Git state, and pull request data by runtime and
  directory identity
- harden runtime switching, reconnect, cleanup, mutation reconciliation, and
  persisted-state ordering
- preserve live subagent Task linkage when metadata arrives after an older
  message request or while streaming parts are suspended
- coalesce overlapping tail refreshes without losing newer refresh demand
- improve cold-session loading by moving deferrable work out of the critical
  bootstrap path
- isolate URL authentication, mobile credentials, native secrets, and other
  runtime-owned state across endpoint changes
- bound long-lived caches and remove avoidable allocations from event and
  rendering hot paths
- limit virtualization to archive collections where it improves rendering
  without disrupting active sidebar layout
- stabilize session folders, pin ordering, expanded state, and persisted
  sidebar behavior
- open skill files through the same secure editor and outside-workspace grant
  flow used by file navigation, including worktree sessions
- expand regression coverage for stale completions, runtime collisions,
  reconnect behavior, persistence races, authoritative empty results, and
  subagent refresh ordering
- document the updated synchronization, cache ownership, performance, and
  runtime-isolation invariants

packages/ui/src/apps/mobileConnections.ts

@@ -691,6 +691,30 @@ const deleteSecureToken = async (key: string): Promise<void> => {
 
 // One-time migration: a legacy localStorage record on native might still carry an
 // inline `clientToken`. Move it into the secure store and strip the metadata.
+export const migrateLegacyInlineTokenRecords = async (
+  records: unknown[],
+  migrateToken: (url: string, token: string) => Promise<boolean>,
+): Promise<{ records: unknown[]; migrated: number; failed: number }> => {
+  let migrated = 0;
+  let failed = 0;
+  const next = await Promise.all(records.map(async (item) => {
+    if (!item || typeof item !== 'object') return item;
+    const record = item as Record<string, unknown>;
+    const url = typeof record.url === 'string' ? record.url : null;
+    const token = typeof record.clientToken === 'string' ? record.clientToken.trim() : '';
+    if (!url || !token) return item;
+    if (!await migrateToken(url, token)) {
+      failed += 1;
+      return item;
+    }
+    migrated += 1;
+    const { clientToken: _removed, ...metadata } = record;
+    void _removed;
+    return { ...metadata, hasToken: true };
+  }));
+  return { records: next, migrated, failed };
+};
+
 const migrateLegacyInlineTokens = async (): Promise<void> => {
   if (typeof window === 'undefined' || !isCapacitorApp()) return;
   let parsed: unknown;
@@ -707,11 +731,20 @@ const migrateLegacyInlineTokens = async (): Promise<void> => {
     && Boolean((item as { clientToken: string }).clientToken.trim()));
   if (legacy.length === 0) return;
   logStorage('secure:migrate-start', { count: legacy.length });
-  for (const { url, clientToken } of legacy) {
-    await writeSecureToken(getConnectionStorageKey(url), clientToken);
+  const result = await migrateLegacyInlineTokenRecords(parsed, async (url, token) => {
+    const key = getConnectionStorageKey(url);
+    if (!await writeSecureToken(key, token)) return false;
+    return await readSecureToken(key) === token;
+  });
+  if (result.migrated > 0) {
+    try {
+      window.localStorage.setItem(MOBILE_CONNECTIONS_STORAGE_KEY, JSON.stringify(result.records));
+    } catch (error) {
+      console.warn('[mobile-storage] failed to finalize secure token migration', error);
+      return;
+    }
   }
-  writeConnections(readConnections());
-  logStorage('secure:migrate-done', { count: legacy.length });
+  logStorage('secure:migrate-done', { migrated: result.migrated, failed: result.failed });
 };
 
 export const loadMobileConnections = async (): Promise<MobileSavedConnection[]> => {