fix(collaboration): make shared access lifecycle durable and actionable

[M4n5ter]

English

Summary

• Keep saved shared-task access reachable from the sidebar, including offline entries without a Session projection. Hide the entry when there are no saved shared tasks.
• Add open, retry, local alias and remove actions; allow owners to name Guest credentials. Preserve the actual connection failure across retries.
• Distinguish incompatible Host versions from network failures and explain how to recover without discarding saved access.
• Persist explicit access rejection across restart and stop presenting or retrying rejected access. An unreachable owner is not treated as proof of revocation.
• Report a failed initial connection as a failed join. Retain background recovery only after credential finalization may actually have committed.

This does not enable public application relays or claim to fix every NAT traversal failure. Direct application traffic still requires a direct path or an explicitly approved Mesh transit member.

Verification

• Desktop: 2,313 tests passed. Runtime Host: 1,721 passed, 12 skipped (--test-concurrency=4). Targeted protocol, authority, lifecycle and UI tests: 103 passed.
• Windows Electron/CDP: a real failed join returned peer_path_unavailable, never reported finalizing_access, and left the saved-access count unchanged. Connection reasons and alias save/reopen were verified.
• Windows → remote Mac with Shadowrocket enabled, both at epoch 119: a fresh invitation finalized in about 6 seconds, the actual transcript loaded over WebRTC direct, and Windows restart recovered the same saved authorization without another invitation. Previously rejected access stayed unavailable after restart.
• Before: an unclaimed invitation was retained as background recovery, with only “Reconnecting” visible. After: failed join is explicit; retained entries expose the reason and retry/alias/remove actions.
• Lint, formatting, type checks, renderer architecture and dependency checks run locally.

Compatibility

Protocol compatibility epoch advances to 119 because older peers cannot decode named Guest principals. Update connecting clients and hosts together. Rejected-access persistence uses mount-store schema 2 only when a terminal access decision exists; those stores deliberately reject older readers.

AI use

• Generative tooling made a substantive contribution

Tool(s) and scope: Codex — implementation and tests.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above

简体中文

Summary

• 侧栏提供已保存共享任务的入口，离线、尚无会话投影时也能管理；没有共享记录时不显示入口。
• 增加打开、重试、本机别名和移除操作，Owner 可给 Guest 凭据设置别名；重试期间保留真实连接失败原因。
• 区分 Host 版本不兼容与网络故障，说明恢复方法，不丢弃已保存的授权。
• 明确的授权拒绝会持久化，重启后不再展示旧会话或继续重试；无法连接不等同于授权被撤销。
• 首次连接失败如实报错，只有授权提交可能已发生时才保留后台恢复。

不启用公共应用流量 relay，也不声称修复所有 NAT 打洞失败。应用连接仍只允许直连或明确授权的 Mesh 成员转发。

Verification

• Desktop：2,313 项通过。Runtime Host：1,721 项通过、12 项跳过（并发度 4）。协议、授权、生命周期和 UI 定向测试：103 项通过。
• Windows Electron/CDP 实测：连接失败返回 peer_path_unavailable，未进入授权提交阶段，未增加共享记录；失败原因展示、别名保存与重新打开验证通过。
• Windows → 远程 Mac、Shadowrocket 开启、双方 epoch 119：新邀请码约 6 秒完成授权提交，WebRTC 直连加载真实会话正文；Windows 重启后使用同一授权自动恢复，无需新邀请码。此前已失效的授权在重启后仍保持不可用。
• 修复前：未领取的邀请码被保留为后台恢复，界面只显示“正在重连”。修复后：明确报加入失败；已保存的记录提供失败原因及重试、别名、移除操作。
• 本地执行 lint、格式、类型、renderer 架构及依赖检查。

Compatibility

协议兼容 epoch 升至 119，旧版本无法解析带别名的 Guest 投影，连接双方需一起更新。仅当存在终态授权决定时，共享挂载存储使用 schema 2，并拒绝旧版本读取，防止撤销状态在降级后丢失。

AI use

• Generative tooling made a substantive contribution

Tool(s) and scope: Codex — 实现与测试。

Checklist

• 测试覆盖变更，并能捕获修复前的问题
• 本地 lint、格式、类型及受影响测试通过
• 行为变化已在 Summary 说明

[jackwener]

Approved at exact head e11444969493e082c370a27770841d8d204e2365 at the explicit direction of M4n5ter. No technical review was performed as part of this action; M4n5ter requested the approval and accepts responsibility for subsequent handling.

---

Review notice: This approval was submitted by an automated review agent operated by jackwener and is published at the direction of M4n5ter, who requested this action and is the human accountable for it.