fix(desktop): replace conflicting Local Runtime Host during startup

[M4n5ter]

English

Summary

Desktop can resolve an incompatible Local Runtime Host during startup without asking users to discover an unknown process:

• shows the owning process ID and a cross-platform manual fallback;
• offers Stop Host and Continue only for a canonical system-supervised deployment that Desktop is authorized to replace;
• omits Wait for supervised Hosts because the supervisor would restart them;
• keeps Wait and the PID fallback for ephemeral or otherwise unowned Hosts instead of signaling a process without stable authority;
• binds replacement admission to the Host shown in the dialog, then performs the mutation through the locked canonical deployment/provider authority;
• preserves exact package identity for both registry packages and development archives;
• retries the original Desktop connection after the replacement becomes ready.

The admission fence covers interrupted-transition recovery and normal replacement. Compatible Hosts release the State Root before the updater acquires a writer fence and retires the supervisor, preventing a restarted process from becoming the new Host during cutover.

Verification

• Real macOS dogfood against a LaunchAgent-managed incompatible Host replaced PID 16731 with PID 54831, advanced the deployment revision from 3 to 4, and opened Desktop successfully.
• Confirmed the supervised-host dialog contains only Stop Host and Continue, Copy Diagnostics, and Cancel Startup.
• npm run lint
• npm run format:check
• Built @maka/core, @maka/storage, @maka/runtime-host, maka-agent, and the Desktop main process after rebasing onto origin/main.
• 115 focused lifecycle, service-update, Desktop manager, operator, SSH, replacement, and dialog tests passed.
• Parallel deep-code-review and simplify-audit loops completed with no remaining findings.

AI use

Select exactly one:

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: OpenAI Codex implemented, reviewed, tested, and dogfooded the change. Every commit includes the required Generated-by trailer.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No

中文

概要

Desktop 启动时遇到不兼容的本地 Runtime Host，可以直接解决冲突，不再要求用户自行寻找未知进程：

• 显示占用进程的 PID，并提供跨平台通用的手动处理提示；
• 仅在 Desktop 有权替换 canonical 系统托管部署时提供 停止 Host 并继续；
• 系统托管 Host 会被监督器持续拉起，因此不提供无效的 等待；
• 临时或无明确 authority 的 Host 只保留 等待 和 PID 手动处理方式，不在缺少稳定 authority 时向进程发送信号；
• 替换 admission 绑定到弹窗中显示的 Host，实际 mutation 通过加锁的 canonical deployment/provider authority 完成；
• registry package 与 development archive 都保留精确 package identity；
• 替换 Host 就绪后重试原始 Desktop 连接。

admission fence 同时覆盖中断事务恢复与正常替换。兼容 Host 释放 State Root 后，更新器先取得 writer fence，再退休 supervisor，避免重启进程在 cutover 期间成为新 Host。

验证

• 在 macOS 上针对 LaunchAgent 托管的不兼容 Host 进行真实 dogfood：将 PID 16731 替换为 PID 54831，部署 revision 从 3 升至 4，Desktop 正常进入主界面。
• 已确认系统托管 Host 的弹窗只包含 停止 Host 并继续、复制诊断信息 和 取消启动。
• npm run lint
• npm run format:check
• rebase origin/main 后构建 @maka/core、@maka/storage、@maka/runtime-host、maka-agent 与 Desktop 主进程。
• 115 个聚焦于 lifecycle、service update、Desktop manager、operator、SSH、replacement 与 dialog 的测试通过。
• 并行 deep-code-review 与 simplify-audit 循环完成，无剩余 finding。

AI 使用

OpenAI Codex 完成实现、审阅、测试和真实 dogfood；每个提交都包含要求的 Generated-by trailer。

[jackwener]

Reviewed at exact head 5348488762699c8ffd11e488d1005b99d7396169.

The replacement path is appropriately narrow: Desktop offers the destructive action only for a canonical supervised Local Host, the user's consent is bound to the observed Host epoch and PID, and the CLI revalidates that identity under the deployment lock before retiring or replacing anything. Ephemeral, remote-profile, stale-owner, and successor-owner cases remain fail-closed. Registry and development-archive paths both retain exact package identity, and the original connection is retried only after the replacement transaction completes.

The full workspace build, lint, eight affected test files (115/115), diff check, commit attribution, and the current-main merge result passed locally. The first hosted test attempt failed only in three unchanged WorkHub E2E cases; the exact base-main CI run is green and this PR does not change those WorkHub surfaces, so I triggered a failed-job rerun. The Windows package check is still running. Those hosted jobs remain merge gates, but I found no P0–P2 issue in this change.

---

Automated review notice: This comment was posted by an automated review agent operated by WAWQAQ. It is not an independent human review and does not replace one.