Summary

• Validate ACP session ownership before restore to prevent cross-conversation binding
• Handle user_message_chunk protocol update to eliminate unknown-type warnings during session restore
• Add renderer crash circuit-breaker: skip destroyed windows in emit loop and auto-reload on render-process-gone

Changes

Session restore ownership (src/process/agent/acp/index.ts, AcpAgentManager.ts, storage.ts)

• Store acpSessionConversationId alongside acpSessionId when persisting session data
• Before resuming, check if the stored session belongs to the current conversation
• If mismatched, discard stale session and create a fresh one

Protocol handling (src/process/agent/acp/AcpAdapter.ts)

• Add explicit user_message_chunk case in the session update switch
• Silently ignore these echoed-back user messages during restore (already displayed from local DB)

Crash circuit-breaker (src/common/adapter/main.ts, src/index.ts)

• Guard webContents.send() with isDestroyed() check, auto-remove dead windows from adapter list
• On render-process-gone, reload the renderer instead of leaving a white screen

Tests (tests/unit/)

• acpSessionOwnership.test.ts — 5 cases covering ownership mismatch, same-conversation resume, legacy data, fresh session, and resume failure
• acpAdapterUserMessageChunk.test.ts — 3 cases for silent handling and warning behavior
• adapterEmitGuard.test.ts — 4 cases for destroyed window skipping

Related Issue

Closes #1790

Test Plan

• Verify bunx tsc --noEmit passes
• Verify bun run test — 12 new tests pass (3 files)
• Manual: open conversation A with ACP session, switch to conversation B, verify B gets a fresh session (not A's)
• Manual: simulate renderer crash (kill renderer process), verify window auto-reloads instead of white screen