Preserve exact shell review and queue authority on v4.21.0 main

[AetherAI3]

Residual #281 / #284 safeguards integrated with current main

This preserves the reviewed shell-attachment and queue-authority fixes while integrating main 1690f9f (#319, #328–#336). Current main's v4.21.0 version, release workflows, and operator packets are unchanged by this PR. The historical #303 / v0.4.0 packet repair is not included.

Main's multiline composer, slash picker, history search, planning restrictions, selected-file context, denial feedback and one-turn skills are preserved. New integration coverage checks exact reviewed bytes with pinned context and the idle picker's explicit two-Enter submission flow.

#281 safeguards

• The entire attachment, including metadata and protected trust/omission framing, stays within 8 KiB
• Removed metadata cannot reappear; mask/redact affect only editable content
• Reviewed bytes remain exact under project-rule framing and stay out of blocked-submission history/custody exports
• Line/drop/replace/mask/redact UI, JSON records, and explicit fresh-capture script Send remain available

#284 safeguards

• Send queues one immutable approved snapshot; later same-capture edits/cancellation cannot change it
• Retained snapshots count toward the existing 64 KiB queue bound; failed admission preserves the exact edited draft for retry
• Malformed pasted controls remain local; checkout/session changes discard stale queued work; terminal handoff cannot change a pending queue's context
• Existing feat(console): inspect, edit, and cancel queued chat and shell commands (#284) #315 IDs, edit/remove/clear/resume UI and hold-after-chat-failure behavior, feat: opt-in persistent PowerShell console session #312 PowerShell profiles, and feat(chat): deliver /steer to the active turn with an honest acknowledgement (#283) #314 live steering are preserved

Final integrated verification

Published head e03aabc, exact tested tree 4bbdc702ef1de03f990501651a1734034937c368, Linux Node.js 24.19.0 with isolated test HOME:

• Focused console/attachment/queue/steering/composer/history/picker/planning/selected-context/one-turn-skill suite: 92 passed, 0 failures
• Full npm test: 3,482 passed, 15 platform/environment skips, 0 failures (3,497 total)
• Reproducible npm ci --ignore-scripts passed with a workspace-local cache
• Independent review found no integration blockers
• Build, typecheck, lint, docs:check, verify:production, npm pack --dry-run and git diff --check passed
• Live release:truth passed 12/12
• Smoke still fails this executor's public DNS resolution for example.com; unsigned model checks skip. No paid model calls or real credentials were used

The previous README example and current-version release-truth blockers are cleared by main's own release changes. Actual required CI remains authoritative. Fresh exact-head CI (https://github.com/AetherAI3/aether-agent/actions/runs/37980291934) and CodeQL (https://github.com/AetherAI3/aether-agent/actions/runs/37980291829) failed before job execution. Their checks are not satisfied; this PR is not qualified to merge. No CI rerun or required-check bypass was performed. Existing artifact quota and private ATS checkout-access constraints are not weakened or modified here. Native Windows execution is not claimed from this Linux run.

See docs/issue-281-284-residual-validation.md for separately reproduced #281/#284 acceptance evidence. No automatic issue closure or live-service qualification claim.

[AetherAI3]

Issue #321 landed in PR #329. I checked its current head against both the pre-#321 main and the #321 branch: src/commands/chat.ts auto-merges in both cases, so the composer input-owner changes do not conflict with this shell-review work. The sole merge-tree conflict is docs/generated/commands.md, and it is already present against pre-#321 main. Please regenerate or resolve that file when updating this draft PR.

[AetherAI3]

Issue #322 landed in PR #330. Its current commit auto-merges with this draft's src/commands/chat.ts and the touched queue/shell fixtures. The only merge-tree conflict is docs/generated/commands.md, which already existed against pre-#322 main. The slash picker acts only while the idle composer owns input; it does not change shell review or queue authority. Please resolve/regenerate the generated docs file when updating #309.