fix(desktop): persist runs and recover question workflows

[Sun-sunshine06]

Summary

Make generation and question workflows survive renderer refreshes, window switches, and temporary detachment without introducing a new database. The main process now owns durable run/question state, chat projection, and completion snapshots; the renderer reattaches using ordered replay and preserves unanswered form drafts.

Changes

• Persist runId/generationId, monotonic event sequences, schema version, and explicit run_settled outcomes in per-run JSONL journals. Commit events before broadcasting; validate cursors and fail closed on committed corruption while repairing incomplete tails.
• Subscribe before replay, buffer overlapping live events, deduplicate cursors, recover gaps, and catch up on focus/visibility changes. Support multiple renderer subscribers without replay-triggered tool execution, auto-polish, or stale workspace overwrites.
• Persist questions, answers, cancellation/interruption, and acknowledgement state in ask-journal.jsonl. Scope queues and drafts to the owning request/design; retain input on failed persistence, accept identical answer retries, and reject conflicting retries.
• Project chat/tool/active-message events idempotently. Committed delivery and tool results outrank inferred terminal fallbacks; repaired rows refresh even when replay contains only already-consumed cursors.
• Finalize artifact snapshots in the main process so detached completion does not depend on the original renderer Promise. Reattached renderers refresh the latest snapshot without recreating it.
• Preserve the upstream native cancellation and import-ownership protections; keep generation/workspace ownership until the worker actually settles, and reject duplicate run IDs.

Type of change

• Bug fix
• New feature
• Breaking change

Context

Follow-up to the continuity work in #425, rebased onto main including the v0.2.2 release updates. This PR contains only the recovery implementation, regression tests, and a desktop patch changeset.

Behavioral reference: Open Design run identity, JSONL events, replay, and restart handling. Retains CoDesign's existing file/JSONL and session-chat approach rather than importing the separate logical-task database architecture.

Recovery contract and limits

• Renderer refresh/detachment can reattach to a still-running main-process run and pending questions.
• A main-process restart preserves history and marks orphaned runs/questions interrupted. It does not resurrect provider Promises or automatically repeat tools/side effects.
• Question answers are acknowledged only after persistence. Invalid submissions leave the question available for correction; losing a window no longer cancels the question by itself.
• Additive IPC fields and versioned journals; no SQLite, new production dependencies, or retention/deletion policy.
• Very large histories may need future replay pagination and writer backpressure.

Validation

Executed locally on Windows with Node 22 and repository-pinned pnpm:

• pnpm lint — passed (617 files).
• pnpm typecheck — passed for the workspace.
• pnpm test — passed for the workspace; desktop 152 test files, 1937 passed / 1 skipped. Unchanged workspace packages used valid Turbo cache entries.
• pnpm --filter @open-codesign/desktop build — main, preload, and renderer bundles passed.
• git diff --check — passed. Repository commit/push hooks also passed.

Regression coverage includes temporary-filesystem reopen/torn-write/corruption cases, failed durable answers, identical/conflicting retries, native cancellation ownership, replay/live overlap and gaps, multiple subscribers, headless completion and snapshot persistence, repaired chat authority, stale status responses, design-scoped drafts, and cancellation/import races.

No paid/live-provider manual Electron reload acceptance run was performed. No visual redesign or screenshot recording is included; renderer recovery and import behavior are covered by component tests.

Checklist

• Checked relevant continuity context and upstream implementation
• pnpm lint && pnpm typecheck && pnpm test passes locally
• Added/updated regression tests
• Added a user-visible desktop patch changeset
• Documented recovery boundaries above
• Additive protocol, schema-versioned storage, explicit main-process ownership
• No new production dependencies or database layer