feat(acp,desktop): resume interrupted turns after app restart - #2177

Summary

Managed agents lose in-flight work when the app restarts mid-turn. This adds a durable pending-turn ledger to the buzz-acp harness so an interrupted turn is replayed on the next boot, plus a per-agent Desktop toggle so the behavior can be turned off for a given agent.

Harness (crates/buzz-acp)

• ledger.rs mirrors the in-memory EventQueue to disk after every queue mutation, persisting through a temp file plus rename.
• Boot recovery in lib.rs: staged ledger load → membership gate → TTL expiry → chunked REST fetch with per-event reconciliation (signature/id/channel verification) → ordered queue import → unresolved ordering-barrier registration → one atomic commit.
• A dedicated tokio::time::Sleep arm in the main select! loop fires at the earliest unresolved barrier deadline, so the barrier timeout is a real bound even on a completely quiet harness.
• Live-admission seam: recovered events resolved over WebSocket bypass the steer/interrupt path and dispatch with recovery framing; a suppression set prevents duplicate processing across boot fetch and live delivery.
• Shutdown-drain completion classifies results through complete_batch + ledger sync at both grace-period drain sites; the join-error arm applies a queue-only panic disposition.
• queue.rs gains complete_batch (atomic payload-owning completion), shared enforce_cap, import_recovered/admit_recovered, set_unresolved_barrier/next_unresolved_barrier_deadline, and dirty_channels tracking.
• Membership removal purges the removed channel's durable state completely: drain_channel drops the in-flight batch's recovery mirror alongside the queued events, so the trailing ledger sync cannot re-persist a trigger Ledger::invalidate_channel just purged. in_flight_channels/in_flight_deadlines stay preserved so the live task still completes or expires.
• config.rs gains --resume-on-restart / --resume-ttl-secs, with BUZZ_ACP_RESUME_ON_RESTART as the env equivalent. Resume is on by default.
• format_prompt emits a recovery header and per-event [restart recovery] markers for recovered batches.
• The windows-rust CI job runs cargo test -p buzz-acp ledger::, giving the temp-file-plus-rename persist path Windows-native coverage instead of relying on POSIX rename semantics.
• When resume_on_restart is false, boot best-effort deletes the ledger file so toggling off truly drops pending work — a future re-enable starts clean.

Desktop toggle

• ManagedAgentRecord.resume_on_restart defaults to true via serde, so existing stores deserialize unchanged and no migration is needed.
• BUZZ_ACP_RESUME_ON_RESTART is reserved (strips from user env-var editor and on-disk records) and emitted unconditionally from spawn so the UI toggle is the sole control plane in both directions — no ambient parent-process leak when ON, no user env override when OFF.
• The field participates in spawn_hash, so flipping it raises the restart-required badge rather than leaving a stale process running the old setting.
• "Resume interrupted turns" switch in the Advanced section of the agent Edit dialog, persisted through the standalone set_managed_agent_resume_on_restart command in the same shape as the auto-restart toggle.

Dialog routing fix

The agent-profile pencil path (handleEditAgent) previously short-circuited to the definition dialog for any definition-backed agent, making all instance-level settings unreachable from the UI for agents created via the create flow. The pencil now unconditionally opens the instance-edit dialog, which already handles linked agents (inherited values shown, "edit linked definition" escape hatch wired). The separate handleEditPersona callback retains the definition-edit surface for surfaces that explicitly target it.

Comment blocks in the touched desktop files are condensed so each file stays within the differential file-size ratchet.

Deferred follow-ups

These were raised as MINOR findings and are non-blocking per reviewer sign-off. Each has a clear fix shape and bounded scope.

• Boot recovery gated on membership, not subscription scope (CLI-only). When multiple --channels are passed, boot_recover only attempts recovery for channels whose membership the harness fetched at startup. A channel added to the CLI args but not yet joined (e.g. a new invite) may have ledger records that silently skip recovery. Fix shape: intersect the staged ledger's channel set with the --channels subscription set rather than the membership set. Does not affect the Desktop path, which always passes the full subscribed channel list.
• Permanently unfetchable unresolved records re-arm the 60s ordering barrier each boot. If a ledger entry's event can never be fetched (deleted from relay, bad signature), it stays in the unresolved set indefinitely and the ordering barrier fires on every restart. Fix shape: track per-record fetch-attempt count; after a configurable cap (e.g. 3), classify the record as permanently unresolvable and drop it from the ledger.