feat: integrate native rewind session controls and persistent queues

[Wolf-L]

Summary

One integrated proposal for same-session rewind, native session controls and persistent queues. There are no companion or feature-split PR dependencies. Replaces withdrawn #596, #597, #598 and the withdrawn split refreshes #610, #611, #612.

Refreshed on upstream main 202e66e63343ec4f5a5e35ab590251d813d129ca: adapter 2.2.2, locked Codex 0.160.1 and ACP SDK 1.5.0. Rewind protocol/original implementation credit: Nikita Ashikhmin's #508.

Included behavior

• Same-ID first/latest/historical rewind, persisted-prefix verification, cancellation/settlement and cold reload.
• Named, negotiated runtime inspection/control; safe idle steering; native search; archive/unarchive; attachment metadata. No generic native RPC tunnel.
• Preview-token guarded reversal of a completed native file-change tool's recorded text patches. History, the Git index and unrelated edits are preserved; stale, conflicting, unsafe and unsupported patches fail closed.
• Persistent queue list/add/update/delete/reorder/start, native capability probes and autonomous-turn ownership for output, approvals, cancellation and child interactions. Native Codex retains storage and scheduling.

Integration safeguards

Preserves upstream custom instructions, sessionIndex routing/subscriptions/deletion, title handling and supervised app-server recovery. Queue writes share admission with rewind and runtime mutations. Active/retained autonomous work must settle before history/provider changes; pending entries block rewind and provider-wide controls. Both AIR/index and legacy archive reject active/retained queue ownership without closing it. Ordinary close and rename behavior remains intact.

A lost rewind acknowledgement fences later queue writes. Lazy recovery does not silently dispatch persisted input; explicit load adopts ownership before resume. Provider/file-control deadlines include readiness, and late readiness cannot continue after invalidation. Title writes retained across replaced/closed states are drained before rewind. Compiled process helpers enter before application/config imports and accept no executable source.

Local premerge validation

Official Node 24.21.0; Ubuntu 24.04 and Windows:

• CI-matching npm ci, typecheck, default npm test, build and all six Bun 1.3.11 release targets: 1737 tests passed, 37 skipped.
• Windows focused queue/rewind/extension/title/recovery suites: 153 passed; typecheck passed.
• Isolated pinned native Codex: 28/28 on each platform (18 session-extension plus 10 queue cases).
• Six compiled POSIX process/entrypoint cases passed. On Windows, an intentionally incorrect model reply produced the expected nonzero failure, rather than a false green.
• Bounded independent integration and code/CI reviews found no remaining confirmed blockers. The AIR archive regression first reproduced both entry failures and passed after the fix.
• Production/test/config/workflow/package inputs were tested at 5c5b605; final f5fda96 only corrects two documentation files, with all other tracked files identical. Clean-tree, whitespace and latest-main merge checks passed.

No user session, installed ACP, real account/model or global configuration was used or modified. These are local results, not hosted CI or maintainer approval.

Limits

Windows full-suite green is not claimed: five recovery/index subscription failures reproduced on untouched main. The WSL distribution Node 24.19 deep-JSON failure also reproduces on untouched main; that isolated upstream test and this branch's full suite pass with official Node 24.21. Opt-in account/model tests remain skipped.

File reversal is not a whole-workspace checkpoint and excludes binary, shell and unrecorded subagent writes. Search can miss ancestor-rollout content. External writers and descendants leaving the owned process group remain outside adapter guarantees. Queue cancellation is not atomic whole-queue pause; exactly-once execution is not promised. Cross-compilation is not physical ARM/all-target runtime validation. Loopback fixtures and a denying proxy are not an OS firewall.

中文

本 PR 一次整合回退、会话增强和持久队列，不再拆分功能 PR，也无 companion 依赖。基于最新主线 202e66e，保留上游索引、自定义指令、标题及进程恢复，并注明原始回退设计归属。

队列与回退/运行控制共享互斥；活跃及保留子任务未结束时不能归档或修改历史。AIR 索引与旧归档入口均受保护，普通 close/rename 行为保留。未知回退结果阻止后续队列写入；普通自动恢复不偷偷启动队列，显式 load 先接管所有权再恢复。

CI 对齐验证：Linux 1737 通过、37 跳过；Windows 定向 153 通过；双平台真实原生各 28/28；六发行目标及六项编译产物进程测试通过。最终提交仅补正文档，运行/测试/构建输入与已测版本相同。均为隔离本地验证，未声称托管 CI、真实账号/模型或 ARM 实机通过；Windows 和旧发行版 Node 的上游基线失败如实保留。

文件反向应用不是完整 checkpoint，外部写入及全队列原子暂停不在保证内。