fix(runtime): make the retired connection an actual tombstone

Review reproduced two writes that still committed against a retained
retired row: `credential.vault.set` with a `request_headers` locator, and
`connection.request-headers.replace`. Guarding the catalog update alone
had not established the invariant it claimed, because those are sibling
writes to the same connection — and guarding entry points one at a time
is what left them open.

Every connection-owned write now passes one assertion. The credential
vault and the request-header replacement share it with the catalog
update, so a path added later inherits the refusal instead of needing to
remember it. Reading, querying and deleting stay the exceptions, and the
regression proves the row survives its refusals: after all three writes
are rejected it is still readable and still deletable, which is the only
reason it is retained.

That refusal point moved earlier than an existing expectation: a
client-supplied OAuth token for the retired provider used to be rejected
for its credential kind and is now rejected for its connection, so that
test asserts the connection-level code with the reason stated.

The Desktop detail no longer offers what the storage layer refuses. The
advanced-request, model-management and capability sections are hidden for
a retired connection, leaving the retirement notice and deletion — the
request-header editor was the worst of them, since before the vault
refused it a user could save a header that could never reach a request.

Sessions bound to a retired provider now project as stale in the task
rail. `provider_retired` joins `connection_missing` and `fake_backend`
there: the connection still exists and is still enabled, so nothing else
about the row looks wrong and the task read as healthy until opened.

Also in this push: current main is merged, and since main independently
took epoch 30 for access-credential pairing, this wire removal takes 31.
The Astryx inventory is regenerated and `git diff --check` is clean.

Reported by @hqhq1025; the detail-page half was also observed by
@M4n5ter.

Generated-by: Claude Code
Claude-Session: https://claude.ai/code/session_014ajaRxC4jydavY9nYUFj5J

Author: Joob1n

.github/RELEASE_CHECKLIST.md

@@ -16,7 +16,7 @@ Windows needs no secrets while the build is unsigned: electron-builder skips sig
 
 ## Create the draft
 
-1. Confirm the intended commit is on `main`, CI is green, and `apps/desktop/package.json` contains a version that has never been released.
+1. Confirm the intended commit is on `main`, CI is green, `apps/desktop/package.json` contains a version that has never been released, and the exact `maka-agent` version in `packages/cli/package.json` is public on npm.
 2. In GitHub Actions, run `Release desktop` against `main`.
 3. Confirm every workflow step passes on both platforms and a draft release named `v<version>` exists.
 4. Confirm the draft records the intended commit SHA and contains the macOS DMG, ZIP, `latest-mac.yml`, the Windows `.exe`, ZIP, `latest.yml`, the bundled Git source-materials archive, and matching `.sha256` files.

.github/workflows/ci.yml

@@ -42,7 +42,7 @@ jobs:
           fi
 
       - name: Test CI planner
-        run: node --test --test-concurrency=1 scripts/ci-test-plan.test.mjs
+        run: node --test --test-concurrency=1 scripts/ci-test-plan.test.mjs scripts/verify-windows-harness.test.mjs
 
       # Same shape and the same needs: a regenerate-and-diff contract that runs
       # on Node alone, so it belongs beside the planner test rather than behind

.github/workflows/release-desktop.yml

@@ -49,6 +49,17 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
+      - name: Verify Runtime Host setup package
+        run: |
+          requested_version="$(node -p "require('./packages/cli/package.json').version")"
+          setup_package="maka-agent@${requested_version}"
+          published_version="$(npm view "$setup_package" version)"
+          if [ "$published_version" != "$requested_version" ]; then
+            echo "Published package resolved to ${published_version}, expected ${requested_version}." >&2
+            exit 1
+          fi
+          echo "MAKA_RUNTIME_HOST_SETUP_PACKAGE=$setup_package" >> "$GITHUB_ENV"
+
       - name: Audit production dependencies
         run: npm audit --omit=dev --audit-level=moderate
 

CONTRIBUTING.md

@@ -100,6 +100,16 @@ npm run cli:dev                                  # TUI with the Maka Dev profile
 npm run cli:dev -- run "…"                       # one non-interactive turn
 ```
 
+To exercise Desktop's remote Runtime Host setup with the current worktree, build the same
+self-contained package shape used for releases and opt the development app into that archive:
+
+```sh
+npm run release:cli:pack -- --allow-dirty
+MAKA_RUNTIME_HOST_SETUP_ARCHIVE="$PWD/packages/cli/release/<archive>.tgz" npm run dev
+```
+
+The development app uploads the temporary archive over SSH. Packaged apps ignore this override.
+
 Evaluation commands and contracts live in [`packages/eval`](./packages/eval).
 
 ### Building

CONTRIBUTING.zh-CN.md

@@ -98,6 +98,16 @@ npm --workspace maka-agent exec -- maka          # TUI
 npm --workspace maka-agent exec -- maka run "…"  # 非交互地跑一个 Turn
 ```
 
+如需用当前工作区真实验证 Desktop 的远程 Runtime Host setup，可先构建与正式发布相同形态的
+自包含 package，再让开发版应用显式使用该 archive：
+
+```sh
+npm run release:cli:pack -- --allow-dirty
+MAKA_RUNTIME_HOST_SETUP_ARCHIVE="$PWD/packages/cli/release/<archive>.tgz" npm run dev
+```
+
+开发版应用会通过 SSH 上传这个临时 archive；正式打包应用会忽略该覆盖项。
+
 Eval 的命令与 contract 见 [`packages/eval`](./packages/eval)。
 
 ### 构建

apps/desktop/electron-builder.config.mjs

@@ -1,8 +1,19 @@
+const runtimeHostSetupPackage = process.env.MAKA_RUNTIME_HOST_SETUP_PACKAGE?.trim();
+if (
+  runtimeHostSetupPackage !== undefined &&
+  !/^maka-agent@[0-9][0-9A-Za-z.+-]*$/u.test(runtimeHostSetupPackage)
+) {
+  throw new Error('MAKA_RUNTIME_HOST_SETUP_PACKAGE must name an exact Maka CLI version');
+}
+
 export default {
   appId: 'com.maka.desktop',
   productName: 'Maka',
   artifactName: 'Maka-${version}-mac-${arch}.${ext}',
   asar: true,
+  ...(runtimeHostSetupPackage
+    ? { extraMetadata: { runtimeHostSetupPackage } }
+    : {}),
   directories: {
     output: 'release',
   },

apps/desktop/src/main/__tests__/runtime-host-desktop-manager.test.ts

@@ -1,6 +1,10 @@
 import assert from 'node:assert/strict';
 import test from 'node:test';
 import type { BotIncomingMessage } from '@maka/runtime/bots';
+import {
+  RuntimeHostOperationError,
+  RuntimeHostRequestInterruptedError,
+} from '@maka/runtime-host/client';
 import {
   INTERACTIVE_RUNTIME_HOST_COMPOSITION_ID,
   RUNTIME_HOST_COMPATIBILITY_EPOCH,
@@ -12,6 +16,7 @@ import type {
   DesktopRuntimeHostCandidateStartResult,
 } from '../runtime-host-desktop-candidate.js';
 import {
+  RuntimeHostPairingFinalizationInterruptedError,
   RuntimeHostUpgradeCancelledError,
   startRuntimeHostDesktopManager,
 } from '../runtime-host-desktop-manager.js';
@@ -186,6 +191,167 @@ test('keeps Local and remote Hosts active and routes work by owning Host', async
   await manager.close();
 });
 
+test('replays pairing finalization after an unknown commit and reconnect', async () => {
+  const local = candidateHarness({ hostId: 'host-a' });
+  const remoteHostId = 'a'.repeat(64);
+  const first = candidateHarness({
+    hostId: remoteHostId,
+    finalizeFailures: [
+      new RuntimeHostOperationError(
+        'access.credential.finalize',
+        'commit_outcome_unknown',
+        'finalization outcome is unknown',
+      ),
+    ],
+    disconnectOnFinalizeFailure: true,
+  });
+  const replacement = candidateHarness({ hostId: remoteHostId });
+  const queue = [local.candidate, first.candidate, replacement.candidate];
+  const manager = await startRuntimeHostDesktopManager(
+    {} as DesktopRuntimeHostCandidateStartInput,
+    {
+      startCandidate: async () => ready(queue.shift()!),
+      reconnectBackoff: { minMs: 0, maxMs: 0 },
+    },
+  );
+  await manager.enable(remoteTarget('office'));
+
+  await manager.finalizePairing('office');
+
+  assert.equal(first.finalizeCalls, 1);
+  assert.equal(replacement.finalizeCalls, 1);
+  await manager.close();
+});
+
+for (const dispatch of ['not_dispatched', 'dispatched'] as const) {
+  test(`replays ${dispatch} pairing finalization after connection loss`, async () => {
+    const local = candidateHarness({ hostId: 'host-a' });
+    const remoteHostId = 'a'.repeat(64);
+    const first = candidateHarness({
+      hostId: remoteHostId,
+      finalizeFailures: [
+        new RuntimeHostRequestInterruptedError(
+          'access.credential.finalize',
+          'command',
+          dispatch,
+          'connection_lost',
+        ),
+      ],
+      disconnectOnFinalizeFailure: true,
+    });
+    const replacement = candidateHarness({ hostId: remoteHostId });
+    const queue = [local.candidate, first.candidate, replacement.candidate];
+    const manager = await startRuntimeHostDesktopManager(
+      {} as DesktopRuntimeHostCandidateStartInput,
+      {
+        startCandidate: async () => ready(queue.shift()!),
+        reconnectBackoff: { minMs: 0, maxMs: 0 },
+      },
+    );
+    await manager.enable(remoteTarget('office'));
+
+    await manager.finalizePairing('office');
+
+    assert.equal(first.finalizeCalls, 1);
+    assert.equal(replacement.finalizeCalls, 1);
+    await manager.close();
+  });
+}
+
+test('defers reconnecting pairing finalization when the manager closes', async () => {
+  const local = candidateHarness({ hostId: 'host-a' });
+  const remoteHostId = 'a'.repeat(64);
+  const remote = candidateHarness({
+    hostId: remoteHostId,
+    finalizeFailures: [
+      new RuntimeHostOperationError(
+        'access.credential.finalize',
+        'commit_outcome_unknown',
+        'finalization outcome is unknown',
+      ),
+    ],
+    disconnectOnFinalizeFailure: true,
+  });
+  let reconnectStarted!: () => void;
+  const reconnecting = new Promise<void>((resolve) => {
+    reconnectStarted = resolve;
+  });
+  let starts = 0;
+  const manager = await startRuntimeHostDesktopManager(
+    {} as DesktopRuntimeHostCandidateStartInput,
+    {
+      startCandidate: async (input) => {
+        starts += 1;
+        if (starts === 1) return ready(local.candidate);
+        if (starts === 2) return ready(remote.candidate);
+        reconnectStarted();
+        const signal = input.signal;
+        assert.ok(signal);
+        return await new Promise<DesktopRuntimeHostCandidateStartResult>((_resolve, reject) => {
+          signal.addEventListener('abort', () => reject(signal.reason), { once: true });
+        });
+      },
+      reconnectBackoff: { minMs: 0, maxMs: 0 },
+    },
+  );
+  await manager.enable(remoteTarget('office'));
+
+  const finalization = assert.rejects(
+    () => manager.finalizePairing('office'),
+    RuntimeHostPairingFinalizationInterruptedError,
+  );
+  await reconnecting;
+  await manager.close();
+  await finalization;
+
+  assert.equal(remote.finalizeCalls, 1);
+  assert.equal(starts, 3);
+});
+
+test('defers pairing finalization when reconnect does not complete in time', async () => {
+  const local = candidateHarness({ hostId: 'host-a' });
+  const remoteHostId = 'a'.repeat(64);
+  const remote = candidateHarness({
+    hostId: remoteHostId,
+    finalizeFailures: [
+      new RuntimeHostOperationError(
+        'access.credential.finalize',
+        'commit_outcome_unknown',
+        'finalization outcome is unknown',
+      ),
+    ],
+    disconnectOnFinalizeFailure: true,
+  });
+  let starts = 0;
+  const manager = await startRuntimeHostDesktopManager(
+    {} as DesktopRuntimeHostCandidateStartInput,
+    {
+      startCandidate: async (input) => {
+        starts += 1;
+        if (starts === 1) return ready(local.candidate);
+        if (starts === 2) return ready(remote.candidate);
+        const signal = input.signal;
+        assert.ok(signal);
+        return await new Promise<DesktopRuntimeHostCandidateStartResult>((_resolve, reject) => {
+          signal.addEventListener('abort', () => reject(signal.reason), { once: true });
+        });
+      },
+      reconnectBackoff: { minMs: 0, maxMs: 0 },
+      pairingFinalizationTimeoutMs: 10,
+    },
+  );
+  await manager.enable(remoteTarget('office'));
+
+  await assert.rejects(
+    () => manager.finalizePairing('office'),
+    RuntimeHostPairingFinalizationInterruptedError,
+  );
+
+  assert.equal(remote.finalizeCalls, 1);
+  assert.equal(starts, 3);
+  await manager.close();
+});
+
 test('coalesces concurrent enable requests for one remote profile', async () => {
   const local = candidateHarness({ hostId: 'host-a' });
   const remote = candidateHarness({ hostId: 'host-b', lifecycleMode: 'remote' });
@@ -504,6 +670,8 @@ function candidateHarness(
     activeTasks?: boolean;
     lifecycleMode?: 'ephemeral' | 'service' | 'remote';
     hostId?: string;
+    finalizeFailures?: Error[];
+    disconnectOnFinalizeFailure?: boolean;
   } = {},
 ) {
   let resolveClosed: (() => void) | undefined;
@@ -515,6 +683,7 @@ function candidateHarness(
   const stoppedSessions: string[] = [];
   let lifecycleState: 'ready' | 'unavailable' = 'ready';
   let prepareUpgradeCalls = 0;
+  let finalizeCalls = 0;
   const prepareUpgradeAuthorities: boolean[] = [];
   const candidate = {
     closed,
@@ -536,6 +705,18 @@ function candidateHarness(
         }
         return { kind: 'prepared' as const, pid: 42 };
       },
+      async finalizeAccessCredential() {
+        finalizeCalls += 1;
+        const failure = options.finalizeFailures?.shift();
+        if (failure) {
+          if (options.disconnectOnFinalizeFailure) {
+            lifecycleState = 'unavailable';
+            resolveClosed?.();
+          }
+          throw failure;
+        }
+        return {};
+      },
     },
     botIncoming: {
       async handleBotIncomingMessage() {
@@ -573,6 +754,9 @@ function candidateHarness(
     get prepareUpgradeAuthorities() {
       return prepareUpgradeAuthorities;
     },
+    get finalizeCalls() {
+      return finalizeCalls;
+    },
   };
 }