fix(desktop): restore edit after cancelled turns

[Nath-Vikky]

Summary

• carry the validated checkpoint turn on TurnDone
• correlate Desktop submissions end-to-end with an opaque submission ID
• apply checkpoint metadata only to the exact optimistic user item
• remove the positional full-history checkpoint refresh from the TurnDone hot path

Problem

When a visible model turn was cancelled or failed, the backend retained both the user prompt and its checkpoint, but the Desktop frontend refreshed checkpoint-turn mappings only after successful TurnDone events.

Once a session contained any authoritative checkpoint mapping, positional fallback was intentionally disabled. The cancelled prompt therefore had no checkpointTurn, leaving Edit disabled until the session was switched or the application was restarted and hydrated again.

Refreshing the full positional mapping on errored turns is not safe: visible local commands such as shell messages do not consume backend checkpoint turns and can shift subsequent mappings.

Fix

Each guarded turn now records a checkpoint candidate and exposes it on TurnDone only after validating:

• the same session and checkpoint store
• the exact turn and message boundary
• a committed, visible, user-authored message at that boundary

Desktop submissions also carry an opaque correlation ID through the Wails submission APIs and event sink. The frontend applies checkpointTurn only to the optimistic user item with that exact ID.

Missing, delayed, stale, local-only, or mismatched events fail closed instead of falling back to positional matching. Existing submission APIs remain available and delegate without correlation metadata.

Verification

• backend coverage for success, provider errors, immediate cancellation, cancel-before-first-event fallback, blocked and parked turns, session replacement, store rebinding, and turn zero
• Desktop coverage for rejected submissions, delayed TurnDone, tab/runtime rebinding, and no-TurnDone commands
• frontend coverage for rapid cancel/resubmit, missing or out-of-order events, shell and management commands, send failures, history pagination, Edit, and inline resend
• go test ./internal/control ./internal/eventwire
• focused Desktop correlation tests repeated 20 times
• frontend checkpoint, transcript, bridge, and send-failure suites: 156/156 passing
• TypeScript typecheck, Hooks lint, repolint, production frontend build, and Windows Wails build
• real Windows Desktop validation with DeepSeek: an immediately cancelled prompt became editable without a restart, rewound to its exact checkpoint, and the edited resend returned the expected marker

Documentation-impact: none - existing user documentation remains correct; this restores the intended live checkpoint metadata reconciliation.

Fixes #5790
Refs #7920

[SivanCola]

我来看下

[SivanCola]

Superseded by #8001, the maintained integration PR for this fix.

#8001 carries your work onto the latest main-v2: checkpoint candidate validation, opaque submission-ID correlation, exact optimistic-user association, removal of unsafe positional checkpoint refresh, and the associated regression coverage. The integration also preserves the current base branch's model-activity telemetry and runtime-owner resume behavior.

Your contribution is credited in the #8001 PR body, and the integration commit includes a public Co-authored-by: Nath-Vikky trailer. Closing this source PR keeps one delivery path while preserving your attribution. Thank you @Nath-Vikky for the checkpoint-correlation fix.