feat(desktop): add device-local agent hosting policy - #7419

_{P2 Badge} Scope protected identities to their configured community

Pass the active relay and owner into this guard before matching a preferred entry. As written, relay_url and owner_pubkey are ignored, so after configuring Scout for owner A on community A, switching the same Desktop to owner/community B still prevents creating, editing, or hosting an unrelated Scout there. This makes a community-scoped binding behave as an installation-wide name reservation.

Useful? React with 👍 / 👎.

This guard intentionally uses the installation-wide local hosting namespace. unique_names::preflight also rejects same-name local records and personas before querying the owner/community directory. Scoping the entire guard would additionally allow an exact protected key or definition to become locally runnable after an account/community switch.

relay_url and owner_pubkey scope discovery preferences; they do not partition the local hosting catalog. I clarified this explicitly in docs/agent-device-policy.md in 76a1a6e. I am keeping that behavior in this PR. Supporting unrelated same-name local agents across communities would require a consistent change to the local catalog collision rules as well as this guard.

_{P2 Badge} Validate preferred public keys when loading the policy

Reject semantically invalid preferred bindings here rather than accepting any strings that deserialize. The documented setup requires hand-editing this file, and a typo in preferred_agents[].pubkey is later forwarded by complete_search as a Nostr authors filter; the relay cannot deserialize that filter and the entire matching people search fails instead of reporting a recoverable policy-load error.

Useful? React with 👍 / 👎.

Fixed in 76a1a6e. Policy loading now validates both preferred public-key fields and canonicalizes valid hex values. Malformed values return a recoverable policy-load error identifying the binding index and field, without forwarding them into a relay authors filter or echoing the supplied value.

The regression reproduced accepting an invalid public key before the fix and now covers malformed agent/owner keys plus uppercase normalization. Full just ci passed, and the final diff received independent review.

_{P2 Badge} Reap existing processes before skipping client-only restore

Run the restore housekeeping before returning for client-only mode, and suppress only the later spawn phase. If the user saves client-only mode and Desktop crashes before graceful shutdown, the next launch returns here before kill_stale_tracked_processes and the three orphan sweeps, allowing the old agent process tree to keep responding and accessing local resources until the periodic sweeper eventually catches it one or two intervals later.

AGENTS.md reference: AGENTS.md:L194-L202

Useful? React with 👍 / 👎.

Fixed in 76a1a6e. Client-only mode now executes the existing tracked-process cleanup and orphan sweeps before suppressing restoration. Changed lifecycle state is saved; no restore candidates proceed to the spawn phase. Errors returned by the preparation step propagate.

Regression tests exercise the production cleanup/restore decision seam and reproduced both skipped housekeeping and swallowed cleanup errors before the fix. They verify ordering and suppression; they do not claim a live crash/process-termination test. Full just ci passed, and the final diff received independent review.

_{P1 Badge} Preserve deletion recovery while selective sync is active

When tombstone_managed_agent_pending hits a transient SQLite error after the managed-agent record has already been removed, it still logs and swallows that failure; this new early return also disables reconcile_deleted_heads, so unique-name mode has no later path that can reconstruct the missing kind:5/kind:9035 work and the deleted agent can remain visible indefinitely. The fresh evidence beyond the earlier registry finding is that eligibility is now prepared, but the actual deletion-journal write can still fail without propagation or retry.

AGENTS.md reference: AGENTS.md:L167-L174

Useful? React with 👍 / 👎.

_{P2 Badge} Keep people discovery usable after policy load failures

If the manually edited device-policy file is malformed, unreadable, or oversized, active() returns its cached error here before any relay request. Consequently ordinary people search—including mention autocomplete and recipient pickers—fails completely rather than merely disabling local hosting; list_relay_agents and list_personas propagate the same error. Treat policy-load failures as fail-closed for execution while allowing these non-hosting reads to proceed without preference filtering so users can still interact with remote identities and recover in Settings.

Useful? React with 👍 / 👎.

_{P2 Badge} Reject persona renames that duplicate linked identities

When unique-name mode is enabled on an installation that already has multiple instances linked to the same persona and more than one still carries the persona's display name, this preflight validates only the current records against the proposed name. Because none has the new name yet, the check passes, and propagate_persona_name_rename subsequently assigns that same new name to every matching linked record, creating duplicate local identities despite unique-name mode. Validate the complete prospective cascade and reject a rename that would assign one name to multiple pubkeys.

Useful? React with 👍 / 👎.