feat(desktop): add Runtime Host Pricing adapter

[me2seeks]

English

Summary

• Add the two Desktop main-process Pricing capabilities: load one complete effective snapshot and apply one revision-CAS mutation.
• Assemble revision-pinned pages with bounded restarts, and reject mutation bases from a different Host Epoch.
• Reconcile revision conflicts and uncertain outcomes against fresh authority without replaying a mutation.

Why

Pricing callers should not need to understand Host pagination, connection epochs, or whether a lost mutation response is safe to retry. Keeping those rules in the existing Desktop Runtime Host client also prevents the renderer from becoming a second pricing authority.

Design

• A successful committed or unchanged result reloads the authoritative snapshot. A failed reload remains a known save outcome instead of being reported as an uncertain commit.
• A conflict or response-losing failure performs an authoritative reload and compares the complete intended state, including custom provenance and every canonical rate.
• Resetting an override with a bundled fallback is distinguished from deleting a custom-only entry, and an omitted cache rate remains distinct from an explicit zero.
• Mutations are never automatically replayed.

Scope

This is the isolated Pricing adapter core. It does not register renderer IPC, change the Pricing UI, call the retained usage:pricing:* handlers, activate the Host-backed production path, or add TUI support.

Validation

• npm run format:check
• npm run lint
• npm run typecheck
• Desktop main build and 24 focused Client/Pricing tests, including a real UDS journey
• The full Desktop run reached all new Pricing coverage successfully. Locally on Node 26, the existing xAI loopback OAuth test still reproduces a response-close failure and leaked listener; the unrelated overlay misses from the clean worktree passed after build:overlay.

简体中文

概要

• 为 Desktop main process 增加两个 Pricing 能力：读取一份完整的生效价格 snapshot，以及基于 revision CAS 应用一次 mutation。
• 组装绑定 revision 的分页结果并进行有界重读，同时拒绝来自其他 Host Epoch 的 mutation base。
• 对 revision conflict 与不确定结果重新读取 authority 并对账，绝不自动重放 mutation。

原因

Pricing 调用方不应理解 Host 分页、connection epoch，或自行判断丢失响应的 mutation 能否安全重试。把这些规则留在现有 Desktop Runtime Host client 中，也能避免 renderer 变成第二个 Pricing authority。

设计

• committed 或 unchanged 后重新读取权威 snapshot；如果刷新失败，仍保留“保存结果已知”，不会误报成 commit outcome uncertain。
• 冲突或响应丢失后读取最新 authority，并比较完整目标状态，包括 custom provenance 与所有 canonical rate。
• 区分“删除 override 后恢复内置价格”和“删除 custom-only 后变为未定价”，同时保持 cache rate 的省略值与显式零值不同。
• mutation 不会被自动重放。

范围

本 PR 只包含隔离的 Pricing adapter core，不注册 renderer IPC、不修改 Pricing UI、不调用暂时保留的 usage:pricing:* handler、不激活 Host-backed production path，也不增加 TUI 支持。

验证

• npm run format:check
• npm run lint
• npm run typecheck
• Desktop main build 与 24 项 Client/Pricing focused tests，包括真实 UDS journey
• 完整 Desktop 测试运行时，所有新增 Pricing coverage 均通过。本机 Node 26 下，现有 xAI loopback OAuth 测试仍可独立复现 response close 与监听句柄残留；干净 worktree 中无关的 overlay 缺失在执行 build:overlay 后已通过。

Part of #2015 and #2010.

[Astro-Han]

Thanks for keeping pagination, CAS handling, and uncertain-outcome reconciliation inside the existing Runtime Host client. The adapter boundary and focused coverage look solid overall.

I found one reconnect boundary that seems worth tightening. DesktopPricingSnapshot records hostEpoch, but not the connection identity. Reconnecting to the same live Host can preserve the epoch while changing connectionId, so a snapshot loaded through the previous connection can still pass validation and send a mutation. That skips the fresh load and review required after a reconnect.

Could we bind the snapshot to connectionId, or an equivalent opaque connection token, and add a same-epoch reconnect test? This was the only issue I found in the adapter core.

[Astro-Han]

Thanks for addressing the reconnect ownership boundary by binding Pricing snapshots to both the Host epoch and connection identity. I re-reviewed the expanded adapter across Pricing semantics, connection lifecycle, and test coverage.

Revision-pinned pagination, bounded restart, CAS reconciliation, uncertain-outcome handling, provenance, reset/delete behavior, and omitted-versus-zero rates all look consistent with #2015. The adapter remains on the existing Runtime Host client seam without introducing another Pricing authority, and the focused unit and UDS coverage is proportionate to the failure surface.

The remaining end-to-end response-loss and caller write-block journeys belong to the later integration layer and do not need to hold this isolated adapter core. CI is green. Approving.