fix(queue): settle interrupted turns before draining

[0xSolarPunk]

Before

• Send now could drain a successor while the interrupted predecessor still awaited terminal settlement.
• Active-input delivery published successor turn metadata before durable input persistence completed, so concurrent predecessor output could be attributed to the successor and then rolled back inconsistently.

flowchart LR
  A[Active turn A] --> B[Send now]
  B --> C[Abort acknowledged]
  C --> D[Drain successor B]
  D --> E[Publish B metadata]
  E --> F[Persist accepted input]
  A -. concurrent output or terminal .-> G[Mixed ownership]
  F -. failure .-> H[Partial rollback]

Loading

After

flowchart LR
  A[Active turn A] --> B[Send now]
  B --> C[Abort acknowledged]
  C --> D[Await A settlement]
  D --> E[Reserve A to B handoff]
  E --> F[Persist accepted input while A remains active]
  F --> G[Validate every owner]
  G --> H[Commit B synchronously]
  H --> I[Drain and settle exactly once]

Loading

The server now retains interrupted execution ownership until exact settlement, rejects accidental live-turn replacement, and stages active-input identity handoff across the queue attempt, event bus, provider operation tracker, and Codex runtime. Durable persistence completes before successor metadata becomes observable; the final handoff and abortability transfer commit synchronously.

Pre-commit failure leaves predecessor ownership unchanged. Post-commit delivery ambiguity retains successor ownership for reconciliation. This closes the server ownership gap that remained after #362 fixed stale client processing state.

Files

• server/chat-execution/ coordinates exact predecessor settlement and staged active-input ownership.
• server/agents/ guards event routing and composes synchronous handoff participants.
• server-agents/codex/ transfers operation, runtime metadata, and abortability at the delivery boundary.
• Regression suites cover delayed and duplicate terminals, persistence failure, cross-layer atomicity, command locking, restart, and native-history recovery.

Tests

• PR-focused server, Codex, command, architecture, and restart suite: 386 passed.
• bun run check: passed with no Svelte errors or warnings.
• Web logic: 83 files, 611 tests passed.
• Web UI partitions: 235 files, 2,278 tests passed.
• Production build and random-port startup completed; the server remained healthy until the expected smoke-test timeout.

Closes #388.

Prompted by: yk (@chiayong)