[YakiHugo]

Summary

Interrupted Wuu tasks can start a fresh sampling turn from durable active history with one click, without repeating the original question. Explicit Continue is separate from automatic transport recovery and retains completed output and confirmed tool results. Closes #903.

Changes

• Add turn/start.resume_after_turn_id: acquire the execution lease, refresh history, validate the source turn and tool ledger, then persist a new display-only turn boundary. Concurrent and stale continuations fail closed, including delayed duplicate clicks after completion/restart.
• Preserve protocol-complete assistant items and signed reasoning after a failed stream. Isolate unfinished fragments from later provider input. Once a complete item exists, stop replaying the old request and retain it for explicit Continue; existing tool replay protection remains enabled. Unknown at-most-once tool outcomes block continuation.
• Keep continuation boundaries in order through durable history rewrites. Reconstruct confirmed pending tool results before the next model request.
• Carry the action through desktop IPC and the shared Web bridge, both ordinary and split composers, and failure notices. Distinguish waiting for network, retrying, exhaustion and unsafe replay.
• Validate Responses/Chat Completions history and provider state provenance; adapt assistant-ending Anthropic Messages continuation with request-only guidance, including thinking-enabled requests. No synthetic user prompt is appended to durable history.
• Keep explicit continuation active through overflow compaction until the first successful model response. Route using the source thread runtime context; restore stopped pre-admission input and retry local failed placeholders with their original client ID instead of sending a fabricated continuation boundary.
• Forward complete assistant checkpoints through plugin middleware without changing live message projection.
• Retain existing per-operation and shared workflow budgets: successful steps do not replenish shared or nested recovery budgets. Explicit Continue creates a new user-authorized workflow.

Automatic recovery policy stays bounded: this change does not add indefinite connection waiting, a separate never-submitted retry allowance, or progress-driven shared-budget resets. The fault tests retain cancellation and nested/shared-budget limits.

Test plan

• Fault-injection contracts: initial connection failure, partial output, tool effect before disconnect, retry exhaustion, explicit Stop, duplicate continuation, cross-server lease contention, restart and durable history rewrite.
• Public RPC → persisted history → production adapters → controlled HTTP fixtures for Responses, Chat Completions and Anthropic Messages; assert tails, tool pairing, reasoning and no duplicate question.
• Review regressions: 197 App/history/turn/split/session-switch UI checks; overflow compaction with Anthropic thinking on/off; 46 synthetic plugin model-pipeline E2E checks.
• Precisely scoped recovery race contracts passed. A broader name match also ran the historical editing fixture, which times out under race on this host; an isolated checkout of baseline 7d58d83d reproduces the same timeout with unmodified assertions. The full non-race affected-package run passed.
• Recovery contract suites with race detection; go vet in affected packages.
• Full repository Go tests passed with bounded package concurrency (go test -p 2 ./cmd/... ./internal/... ./prompts/... -count=1). The final affected-package rerun passed after the recovery-boundary fixes.
• Desktop/protocol/shared Web typechecks, full desktop build, 297 focused UI tests, 55 Git tests, 44 shared Web bridge tests, documentation/test policy checks.
• Full desktop local suite: 3724 passed, one skipped, one unrelated existing onboarding CLI-discovery test fails because this host has a fallback Claude executable. The exact baseline source/test files were also exported to an isolated /tmp directory and reproduce the same failure; both blob hashes match the baseline. Earlier runs using Node 25 default Web Storage and the wrong test working directory are retained as failed diagnostic runs; final run uses the documented desktop directory and NODE_OPTIONS=--no-experimental-webstorage.
• Headless Chromium production-component fixture: eight screenshots and JSON report across four recovery states, light 15px/wide and dark 20px/narrow, plus duplicate-click and no-prompt checks. Reproduce with node desktop/scripts/continuation-recovery-e2e.mjs after locked desktop/Web dependencies; optionally set WUU_HEADLESS_CHROMIUM to an existing headless binary.
• Final head 85be31b2098d2651a2bfa024ef721673c937c260: independent runtime/provider and UI reviews cleared; 22 checks succeeded and 3 were skipped by configuration. Final CI. Only canceled font-install jobs and their aggregates were retried on the same SHA; no assertions or dependencies were bypassed.
• Native desktop interaction and real-network/live-model validation are not claimed. All inference failures are simulated; no real model quota, new credentials, model installation, system proxy/VPN changes, or foreground automation were used.

Risk and rollback

Medium: recovery touches admission, durable turn projection and provider history. The continuation API is additive; older hosts reject continuation requests. Older clients may fold display-only continuation boundaries into preceding turns, so use a matching host and shell. Revert this PR to remove the action and new checkpoint handling; no database schema migration is introduced.

Linked issues / docs

Closes #903. Updates English/Chinese conversation and development guides, plus app-server protocol documentation. Reproducible logs and screenshots are local ignored artifacts under artifacts/issue-903/; they are not live-provider acceptance evidence.