[knqiufan]

Which issue or RFC does this PR close?

Refs #2117 (12-A, 12-B and 12-C together), parent #2114 and RFC #1733.

Stacked on #2289 at b2eee7ce73609ad03effeca78ac854a4a2a3f67e; base is codex/desktop-ops-bridge-2116. Also depends on #2291 at 4bc80aac1b50816248daf6d217676ac3ecfb839c, included as a merge parent so CI exercises deployment identity and local setup together. All five new local handoff/retained-Scope checks pass the observed Server ID to the four-argument identity check; retained Scope capture and unconditional stale-report removal coexist.

The current comparison against #2289 includes the inherited #2291 implementation and its newer master baseline. Merge #2289 and #2291 first, then rebase/retarget this PR to master and rerun its checks. #2289 supplies the native Ops bridge and depends on installer/resource work in #2286/#2288.

Keep #2117 open until its exact installed Windows/macOS acceptance is linked; this PR implements the complete feature scope but does not establish that platform evidence.

Rationale for this change

The Local Server view previously offered preparation guidance only. Users can now review and explicitly approve local installation and service plans, recover retained operations without replaying uncertain work, and connect into the actual Server's public default Scope. Connecting an existing Server remains an independent path.

What changes are included in this PR?

• Add first-use entry, bilingual plan review, structured progress/status/errors, cancellation and approved recovery. Keep operation state across page navigation and recover durable references after lost progress/replies.
• Add start/stop/restart, repair, supported login-start settings, diagnosis and registration removal under Local Server. Show installation, configuration, registration, process, liveness, readiness and database state separately. Removal preserves configuration and user data.
• Retain approved action/options with native operation references; require matching metadata for resume. Legacy references remain query-only. Ops journals remain the outcome authority.
• Add a generation-bound native connection handoff accepting no renderer endpoint or command. Require owned/current native facts, pinned resource digest, the exact bundled qualification's source/wheel evidence, discovered package version, identity, basic Memory operations and the exact public default Scope before publishing activation.
• Preserve exact authorized Scope selection through ordinary rechecks only for the same deployment and Principal, clearing revoked selections; reject stale handoff responses and identity/deployment changes during Scope resolution. A replacement while resolving the default Scope prevents the subsequent exact read; replacement during an exact read prevents activation.
• Include fix(desktop): isolate contexts when Server identity changes #2291's deployment-bound read/write contexts, nullable MemoryContext.serverId, unknown-write handling and window-local submitted-draft recovery without replay.
• Update English/Chinese guides, security and validation boundaries. No HTTP/OpenAPI changes or database migration.

Are there any user-facing changes?

Local setup and management are available when the distributor supplies matching trusted Installer/Ops resources. Missing resources leave the independent existing-Server path available. Setup and connection effects require explicit consent; reopening never installs, replays or activates a private session.

Native IPC gains one constrained handoff command, two safe error codes, additive reference/progress fields and #2291's nullable MemoryContext.serverId. New version-1 reference records retain optional action/options. Older strict bridge binaries cannot read those new fields; do not downgrade the controlling bridge during recovery. Saved remote/authenticated profiles are not rewritten, and the existing 20-profile budget remains.

How was this change tested?

Local macOS arm64 with Python 3.12.15, Rust 1.95.0, pnpm 11.13.1 and MacOSX26.5.sdk:

• pnpm --dir desktop test: 163 passing UI tests.
• cargo +1.95.0 test --locked --manifest-path desktop/src-tauri/Cargo.toml: 126 passing top-level tests, two opt-ins ignored. Synthetic HTTP regressions cover pending/failed Scope resolution, version/operation/identity fences, generation ordering and revoked Scope selection. The identity-switch regression was reproduced failing before its fix. Dependency integration reproduced exactly five E0061 errors before adapting the local calls. The discovery/deployment-identity selection now passes 27 tests, including two new local-handoff/Scope-retention groups.
• Source Ops opt-in real_current_ops_inspect_and_preflight_with_missing_server_runtime: one passing test using an actual Python subprocess and disposable home, inspection/preflight only.
• uv run pytest -q tests/test_desktop_contract.py tests/test_desktop_fixture_qualification.py tests/test_ops.py tests/test_ops_installer.py tests/test_ops_local_policy.py: 89 passed, one platform skip. Python and Rust accept the same valid catalog with defaulted file metadata.
• Frontend lint/typecheck/production build, Rust fmt/all-target Clippy with -D warnings, IPC export drift and make check pass. The initial feature's make docs-test passed and validated 983 exported public pages; website sources are unchanged by dependency integration.
• Open Code Review: initial remote review completed 19/19 selected files. Its recheck completed 13/20 before seven frontend tool-round failures. The initial feature's plugin delegate review covered all 33 changed files, including excluded docs/tests. Dependency integration was separately reviewed in plugin delegate mode across its 20 changed files. Meaningful findings were fixed; no actionable findings remain in those reviews.
• ZCode service-chain CI regression: reproduce the Python 3.13 E2E failure with deliberately slow real SQLite processing. Keep Stop's 800 ms request/1000 ms host budgets; validate either confirmed cursor progress or a timeout with the exact durable paused receipt, then read-only wait for actual Memory generation and verify cross-session recall. Both fast/slow cases pass serially and with xdist. ZCode Node tests pass 52 cases with one skip using canonical macOS TMPDIR=/private/tmp (the default /var alias triggers an unrelated path-string assertion); make check passes. This repair changes only the E2E test, not production Hook behavior.
• Browser smoke at 800×600 found no horizontal overflow in the unavailable-native view.

Node was 24.22.1 rather than the engine pin 24.14.1; pinned CI remains separate. UI IPC is mocked and HTTP responses are synthetic. No actual managed apply/service mutation, Windows execution, independently distributed bundle opt-in, signing/notarization, clean-machine setup, login/reboot, real IME/screen-reader or installed credential/clipboard qualification was performed. Product qualification records are unchanged; final published resources and installed acceptance remain coordinated with #2108/#2109/#2112.

AI usage statement

Implemented and reviewed with OpenAI Codex (GPT-6). Open Code Review CLI used its configured DeepSeek Flash reviewer and plugin delegate mode; findings were checked against the contracts and reproduced where applicable before fixes.

[AlexStocks]

[P2] 新增的 connect_local 调用点仍是三参 identity_unchanged，与同时打开的 #2291 四参签名在合并时必然编译失败

本 PR 在 session.rs 新增 5 处 self.identity_unchanged(&api, &identity, generation)（:505、:507、:509、:544、:558），全部按当前 base 的三参签名写。

同期打开的 #2291（fix(desktop): isolate contexts when Server identity changes，head 4bc80aac）把同一文件的签名改成四参：

async fn identity_unchanged(
    &self,
    api: &ServerApi,
    original: &Option<AccessMeResponse>,
    server_id: Option<&str>,
    generation: u32,
) -> Result<(), ApiFailure>

并且改写了本文件里全部既有调用点。两个 PR 与 master 分别都是 mergeable: true，但 GitHub 只跟 base 比较，看不到彼此的语义变化；先合 #2291 再合本 PR（或反之）都会在 desktop/src-tauri/src/connections/session.rs 产生 this function takes 4 arguments but 3 were supplied，master 的 desktop 构建直接红。两者还都改写了 check_expected/check 中 inner.reports.remove(id) 附近的同一段逻辑（#2291 在 if use_as_active 之前无条件移除，#2306 移进 if use_as_active 内并新增 retained_scope），文本冲突后的人工解析同样会遗漏这个参数。

建议：先确定 #2291 与 #2306 的合入顺序；后合入的一方在解决冲突时把 server_id 传给新增的 connect_local 路径（本地交接场景应传入 report.discovery.server.server_id，即 :502 已取的 server_id），并复核 retained_scope 那两支在四参签名下的行为。如果两 PR 无法按序合并，建议本 PR 先 rebase 到 #2291 之上再提交，让编译错误在本 PR 的 CI 里暴露而不是落在 master。