feat(runtime-host): establish canonical managed lifecycle transactions

[M4n5ter]

English

Summary

Establish one canonical transaction model for managed Runtime Host lifecycle ownership.

• Persist active, transitional, and blocked authority under one deployment schema with an explicit state discriminator and recovery direction.
• Fence lifecycle changes by State Root so only one lifecycle owner can remain eligible.
• Separate supervisor ownership from reconciliation triggers for systemd and LaunchAgent.
• Discover provider capability and availability only for a new supervised installation; all later management and recovery resolve the persisted provider identity without platform reselection.
• Route setup, configure, lifecycle changes, updates, peer changes, retire, uninstall, and recovery through the same transaction authority.
• Bind stable-operator execution to the persisted deployment generation and exact installed package.
• Store lifecycle-neutral SSH deployment bindings in Desktop without copying Host lifecycle truth.
• Preserve State Root data while making management-artifact cleanup durable and retryable.
• Remove the unreleased [Tracking] Application-scoped peer mesh for Runtime Hosts #3842 peer-management schema, migration, journals, and CLI fallback. listeners.directPeer is the sole managed peer authority.

Refs #3984

Why this is one cross-cutting change

Lifecycle ownership is a consistency boundary, not an isolated provider feature. Converting only setup, one provider, or one client would leave competing mutation paths and two effective authorities. This PR replaces that boundary across its existing callers while deliberately excluding WSL controllers and OpenRC drivers.

Review guide

Suggested order:

1. Persisted authority, state discriminator, and recovery contract:
   • packages/runtime-host/src/operator/managed-deployment.ts
   • packages/cli/src/runtime-host-managed-deployment.ts
2. Transaction coordinator and lifecycle manager:
   • packages/cli/src/runtime-host-lifecycle-transaction.ts
   • packages/cli/src/runtime-host-managed-lifecycle-manager.ts
3. Installation-time provider discovery versus persisted provider resolution.
4. systemd and LaunchAgent projections.
5. CLI management paths and stable-operator fencing.
6. Desktop SSH deployment binding.
7. Transaction, setup, provider, and Desktop tests.

The large diff is primarily production integration, not test volume. No generated release artifacts are included.

Invariants

• One State Root has at most one eligible lifecycle owner.
• Ordinary interrupted transitions recover from; activation compensation completes to and never restores a known-bad owner.
• Exact package launch, operator generation, and package-store roots are verified under the operation lock.
• Provider identity and availability are persisted at installation; later environment changes never silently reselect them.
• A WSL-hosted supervised provider records environment, never machine, availability.
• Uninstall removes management artifacts but preserves the State Root.

Out of scope

• WSL environment profiles, Windows controller, and stdio bridge.
• OpenRC provider drivers and discovery offers.
• Compatibility or migration for unreleased [Tracking] Application-scoped peer mesh for Runtime Hosts #3842 state.

Verification

• npm run format:check
• npm run lint
• npm run build
• npm run typecheck
• npx knip --workspace apps/desktop
• npx knip --workspace packages/ui
• Runtime Host: 1,314 passed, 9 skipped.
• CLI: 545 passed.
• Installed CLI release smoke passed against both the CI-built tarball and a newly built source tarball after the post-rebase fixture alignment.

AI use

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: OpenAI Codex contributed implementation, tests, review, and this description under human direction.

Checklist

• Canonical lifecycle authority and crash recovery
• One schema with explicit authority state
• Installation discovery separated from persisted provider resolution
• systemd and LaunchAgent provider projections
• supervised and on-demand lifecycle management
• exact package/operator fencing
• lifecycle-neutral Desktop SSH binding
• unreleased [Tracking] Application-scoped peer mesh for Runtime Hosts #3842 compatibility removed
• Rebased on origin/main

Does this PR entail a change in behavior?

• Yes — described above
• No

中文

摘要

为 managed Runtime Host lifecycle ownership 建立唯一的 canonical transaction model。

• active、transition 与 blocked authority 使用同一个 deployment schema，通过显式 state discriminator 区分，并记录恢复方向。
• 以 State Root 为 fence 执行 lifecycle change，确保最多只有一个 lifecycle owner 可启动。
• 为 systemd 与 LaunchAgent 拆分 supervisor ownership 和 reconciliation trigger。
• 只有新建 supervised deployment 时才发现 provider capability 与 availability；后续管理和恢复只按持久化 provider identity 解析，绝不根据平台重新选择。
• setup、configure、lifecycle change、update、peer change、retire、uninstall 与 recovery 统一进入同一个 transaction authority。
• stable operator 同时校验持久化的 deployment generation 与实际执行的 exact package。
• Desktop 保存 lifecycle-neutral SSH deployment binding，不复制 Host lifecycle truth。
• 保留 State Root 数据，同时让 management artifact cleanup 可耐久重试。
• [Tracking] Application-scoped peer mesh for Runtime Hosts #3842 尚未发布，因此删除其 peer-management schema、migration、journal 与 CLI fallback；listeners.directPeer 是唯一 managed peer authority。

关联 #3984

为什么这是一个横切变更

Lifecycle ownership 是一致性边界，不是孤立的 provider 功能。如果只改 setup、单个 provider 或单个 client，会留下彼此竞争的 mutation path，实际形成两个 authority。本 PR 一次替换现有调用链上的这条边界，但明确不实现 WSL controller 与 OpenRC driver。

审查顺序

建议按以下顺序审查：

1. 持久化 authority、state discriminator 与 recovery contract：
   • packages/runtime-host/src/operator/managed-deployment.ts
   • packages/cli/src/runtime-host-managed-deployment.ts
2. Transaction coordinator 与 lifecycle manager：
   • packages/cli/src/runtime-host-lifecycle-transaction.ts
   • packages/cli/src/runtime-host-managed-lifecycle-manager.ts
3. 安装期 provider discovery 与持久化 provider resolution 的边界。
4. systemd 与 LaunchAgent projection。
5. CLI management path 与 stable-operator fence。
6. Desktop SSH deployment binding。
7. Transaction、setup、provider 与 Desktop 测试。

大部分 diff 来自生产路径整合，不是测试数量；PR 不包含生成的 release artifact。

不变量

• 一个 State Root 最多只有一个 eligible lifecycle owner。
• 普通中断事务恢复 from；activation 补偿完成 to，不会恢复已知失败的 owner。
• exact package launch、operator generation 与 package-store root 在 operation lock 内验证。
• provider identity 与 availability 在安装时持久化；环境后来变化不会静默重新选择。
• WSL 中的 supervised provider 只能记录 environment availability，不能记录 machine。
• uninstall 删除 management artifact，但保留 State Root。

不在本 PR 范围内

• WSL environment profile、Windows controller 与 stdio bridge。
• OpenRC provider driver 与 discovery offer。
• 为尚未发布的 [Tracking] Application-scoped peer mesh for Runtime Hosts #3842 state 提供兼容或迁移。

验证

• npm run format:check
• npm run lint
• npm run build
• npm run typecheck
• npx knip --workspace apps/desktop
• npx knip --workspace packages/ui
• Runtime Host：1,314 passed，9 skipped。
• CLI：545 passed。
• rebase 后修正 fixture，installed CLI release smoke 已分别使用 CI tarball 和当前源码新构建的 tarball 完整通过。

AI 使用情况

已选择：生成式工具作出了实质贡献。

工具及范围：OpenAI Codex 在人工指导下参与了实现、测试、审查和本描述编写。

检查清单

• ✅ canonical lifecycle authority 与崩溃恢复
• ✅ 同一 schema 下的显式 authority state
• ✅ 安装期 discovery 与持久化 provider resolution 分离
• ✅ systemd 与 LaunchAgent provider projection
• ✅ supervised 与 on-demand lifecycle management
• ✅ exact package/operator fence
• ✅ lifecycle-neutral Desktop SSH binding
• ✅ 删除 [Tracking] Application-scoped peer mesh for Runtime Hosts #3842 未发布兼容路径
• ✅ 已基于 origin/main rebase

本 PR 是否包含行为变化？

• 是 — 已在上方说明

[jackwener]

Approving exact head 2a4c6fa283c1ff3b9ecb5a049ceadff7cf3d7589. I found no open P0–P2 issue in the reviewed lifecycle change.

The on-demand update rollback issue is closed. Candidate activation now runs inside the lifecycle replacement transaction, with recursive activation reconciliation disabled. A candidate that cannot start is rejected before package pruning, and the compensation path restores the previous active authority and operator projection. The new failure-injection regression exercises that rollback.

The earlier release-smoke blocker is also closed: the installed-package smoke no longer writes the removed legacy peer field, while retaining managed-service startup and local-IPC readiness coverage. The exact-head CI test, Windows recovery, direct-peer addon builds, immutable tarball build, and all installed-CLI validations succeeded. The Windows package workflow is being rerun after its unchanged packaged-renderer native-window probe timed out; that rerun is not part of this code approval.

The branch merges cleanly with current main (e8028fc9fa405969498ff7250fe37b8a7b44f3ea), producing tree efd20ba260a0104389180007016daf8a48ccbf6b. There are no review threads. This is a high-impact feature, so the maintainer retains the merge decision; this approval does not authorize or perform a merge.

---

Posted by an automated review agent operated by @WAWQAQ. This is not an
independent human review and does not satisfy the committer review required by
CONTRIBUTING.md. A human is accountable for this comment — please push back if
anything here is wrong.

简体中文

本条评论由 @WAWQAQ 运行的自动化审查程序发出。它不构成 CONTRIBUTING.md
所要求的独立人类审查，也不能替代人类审查。有人类对本条评论负责，如有错误请直接指出。