fix(desktop): separate WSL onboarding from shared Host update and interruption consent

[me2seeks]

Parent tracking issue: #5143

What happened

Released Desktop WSL onboarding unconditionally passes --update-existing. When the default root already has a different exact package, setup enters replacement and derives allowInterruptActiveTasks: true from that flag. The user-facing action is “Connect”; it does not separately authorize replacing a shared Host or interrupting another surface's work.

Ordinary connection of an existing profile uses the installed operator connect and is a different path. The defect is re-onboarding/discovering an already deployed environment, not every reconnect.

How to reproduce

1. Provision a WSL on-demand Host with package A and retain its State Root. Another Desktop/TUI may be connected.
2. Use a Desktop whose setup package is B and choose Add WSL environment for the same distribution.
3. Inspect the generated setup invocation: it includes --update-existing without separate update/interruption consent.
4. With a different package, setup forwards interruption permission to lifecycle replacement. If the old Host is running and incompatible, the retirement path can instead fail with Runtime Host cannot prepare for retirement: incompatible; if it is stopped, the writer-lock gate can be acquired.

Steps 3–4 are established by code/artifact inspection and an isolated retirement-boundary reproduction, not by interrupting live user work. The user's exact click before the retirement error remains unconfirmed.

Environment

• Windows Desktop installed artifact inspected: 0.2.0-dev.25.20260908.
• WSL Ubuntu, Linux x64, kernel 6.6.87.2-microsoft-standard-WSL2.
• Managed Host: 0.2.0-dev-fe229269f0df, epoch 121; newer clients observed at epochs 133/136.
• Relevant source rechecked at f09119884e3e640f1c10755da19a583416aed19f.

Logs, screenshots, or additional context

• Unconditional WSL flag
• Setup derives interruption permission
• Existing runtime-host-setup.test.ts explicitly expects replacement interruption permission to be true. That assertion is not evidence of appropriate UI consent.
• feat(runtime-host): support WSL as a local environment #4064 promises daily connection through the persisted operator; feat(runtime-host): add safe managed Host updates #3591 separates manual updates. SSH development-archive setup intentionally has a replacement shortcut, whereas released SSH setup does not add this flag. Preserve that distinction rather than imposing released UX on source development.

Expected behavior / acceptance

• Discover and reuse an existing compatible deployment without replacing its package or changing lifecycle configuration merely to attach a client.
• First install remains explicit. Existing incompatible deployment offers maintenance/client guidance without mutating it.
• Repeated onboarding is idempotent; recognizing an existing profile after setup is too late to prevent package mutation.
• Replace unconditional released WSL update authorization with an explicit maintenance choice. Update permission must not implicitly grant interruption permission.
• Never downgrade an existing Host to match an older Desktop, including when the Host is stopped.
• Retain an explicit development-artifact replacement path for source workflows, but do not bypass ownership, epoch or active-work checks.
• Regression coverage: absent/existing deployment; same/different package; running/stopped Host; idle/active second surface; newer Host + older Desktop; repeated setup; rejected/cancelled maintenance leaves the deployment unchanged before commit.

简体中文

发布版 Desktop 添加 WSL 时固定传入 --update-existing，setup 又把已有部署换包解释为允许中断活动任务。用户点击“连接”不能等同于授权替换共享 Host 和中断 TUI。应先识别已有部署，兼容就复用；不兼容给明确维护入口。禁止为匹配旧 Desktop 降级 Host。源码开发可保留明确的开发包替换快捷路径，但不能绕过协议、所有权和活动保护。现场 retirement 报错前的具体点击尚未确认，不把可达路径冒充完整现场复现。

AI disclosure: OpenAI Codex investigated and drafted/submitted this issue at the user's explicit request.