fix(desktop): return expected failures as codes across IPC

[orangeCatDeveloper]

Summary

Changing a busy task's permission, plan, orchestration, or model setting shows a generic fallback instead of the actionable reason. WorkHub attachment validation can likewise collapse to “Retry” because Electron discards custom Error fields at IPC boundaries.

Expected failures now cross Electron as discriminated return values while unexpected failures still throw. Session settings and Plan Mode preserve Runtime Host codes, and attachment send paths preserve AttachmentIngestBlockedError.code; renderer adapters reconstruct typed errors for the locale presenters. No product path parses Error.message.

Boundaries: the Runtime Host protocol is unchanged, so there is no Host version skew. The plan-mode write still uses the session-settings port to keep the renderer architecture ratchet flat.

Refs #2672

Verification

WorkHub attachment rejection with a specific reason: 0/1 before → 1/1 after.

Before

After

Electron expected-failure e2e       2 pass / 0 fail
focused Desktop dist tests        111 pass / 0 fail
apps/desktop typecheck (4)          0 errors
renderer architecture ratchet      passes against ca4136a02
npm run format:check               clean

A session_busy result also reaches both locale presenters as structured data:

当前任务正在运行或有交互待处理，等结束后再改设置。

A task is running or waiting on you. Change this setting after it settles.

Not run: packaged build.

AI use

Select exactly one:

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: Claude Code and Codex — traced the failure paths, implemented the structured envelopes and locale presentation, simplified the error contract and comments, added tests and Electron evidence, rebased onto current main, and updated this description. The protocol boundary and user-facing copy were reviewed by hand.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No

[Astro-Han]

Thanks for moving expected failures into structured results. The overall direction looks sound: Runtime/Host keeps ownership of configuration and Plan state, while Desktop transports the failure code and the renderer owns its presentation. I found one remaining serialization boundary issue in the Plan-abandon path, noted inline.

For simplification, I would keep attachment rejection presentation separate from showSkillInvocationFeedback: its new attachment branch makes a Skill-specific helper responsible for a general submit failure. This is an optional cleanup, not a correctness blocker.

Reviewed at b05a71dde11606456ef1ff902b7dacfc81889d5f. The inline finding was checked with a minimal Electron 43.4.1 contextBridge probe; the full Desktop suite was not rerun, and CI is still running.

AI assistance: Codex with a deep reviewer; the finding was cross-checked against the production path and the Electron probe.

[Astro-Han]

Thanks for the fix. An independent fresh-eye re-review of 2dc82e4596b77ed8cbe42718ce5454c792cd79d7 found no remaining P0–P3 code issue.

The previous Plan-abandon serialization defect is fixed: the structured result remains intact through main and preload, and the renderer-owned session-settings adapter unwraps it after the contextBridge boundary. The setting-update and attachment-rejection paths were also traced through their production consumers. I do not have a further simplification to request.

Two verification items remain: the PR currently conflicts with main, and the required test check failed on the upward-traversal-holds-turn-geometry Storybook render timeout; Windows packaging passed. That story was not changed directly, but this PR does touch AppShell, so the single timeout does not establish that the failure is unrelated. Please resolve the conflicts and verify the resulting head, including a focused Electron check of busy-setting, Plan-abandon, and attachment-rejection feedback.

This pass used exact-source checks and the live CI evidence; it did not rerun the full build or packaged Electron E2E.

AI assistance: a new Codex deep reviewer performed the fresh-eye pass, followed by a primary-agent cross-check.

[Astro-Han]

Thanks for the update! The Session-setting and Plan-abandon paths look sound in this pass. I found one remaining WorkHub attachment issue, noted inline.

This also changes user-visible feedback. Could you add actual before/after screenshots of the resulting toasts? The current text examples help explain the wording, but do not show the interaction. A short recording covering busy-setting rejection, a Plan-abandon conflict, and attachment rejection would be helpful too.

I checked head fe9257020: 106 focused tests passed, and the Electron boundary probe confirmed both the corrected paths and the remaining WorkHub issue. This does not replace full UI acceptance.

AI assistance: Codex and Reviewer Sol, with the finding independently reproduced.

[Astro-Han]

Thanks for closing the WorkHub attachment gap and adding real screenshots. I found no remaining P0–P3 issue at 2df6502. Expected codes now survive main, preload and contextBridge, with typed errors reconstructed in the renderer adapter. The shared attachment preparation also removes duplication. Verification covered 44 focused tests and an isolated Electron probe using this head’s full preload, real WorkHub handler and renderer adapters; setting, Plan and WorkHub attachment failures retained their codes and localized feedback. CI is green. The current conflict in create-workhub-services.ts still needs resolution: keep both main’s new interaction ports and this PR’s attachment result unwrapping, then verify the updated head before merging. AI-assisted review with Codex and Reviewer Sol.