[Platform] Use graceful, consent-aware restarts and preserve target discovery diagnostics

[rwang23]

[Platform] Use graceful, consent-aware restarts and preserve target discovery diagnostics

Draft status: ready to create; not submitted by the audit run.
Priority: P1
Findings: ACT-013, ACT-014, ACT-015

Summary

The Windows target lifecycle force-terminates the matched app process, target discovery errors can be collapsed into an empty list, and macOS persistence path checks can accept app bundles outside standard Applications locations.

中文摘要：Windows 路径默认强制结束目标应用，可能丢失未提交输入；平台发现错误又可能被误报成“未安装”。macOS 的持久化宿主路径也需要收紧。应改成正常关闭优先、强制关闭二次确认、结构化诊断。

Audit evidence

• The Windows path invokes Stop-Process -Force after matching the selected package/executable.
• Discovery uses unwrap_or_default() in a path that can turn command, permission, JSON, or parsing errors into “no targets found.”
• macOS persistence validation rejects /Volumes and checks for .app/Contents/MacOS/, but this can still admit a bundle under /tmp or another non-standard location.
• The README/agent contract correctly says not to close a running ChatGPT/Codex session without asking; the implementation should make the final force action equally explicit.

This issue is related to, but not a duplicate of, #2. #2 focuses on target/version probe diagnostics; this issue covers platform discovery classification and process lifecycle safety.

Proposed direction

1. Return a typed discovery result that distinguishes unsupported platform, not installed, command unavailable, permission denied, command failed, parse failed, and unsupported version.
2. Request graceful app exit first and wait for a bounded period.
3. If the process remains, show a second confirmation that explicitly warns about unsent prompts or unsaved input before force termination.
4. Preserve a cancel path that leaves the current app and theme state untouched.
5. Restrict persistent macOS host paths to /Applications or $HOME/Applications; after formal signing, validate Team ID/designated requirement.

Acceptance criteria

• “No supported install” is not used for PowerShell/process-command/permission/parse failures.
• The UI presents stable error codes with safe retry and copy-diagnostic actions.
• Windows attempts graceful close before force termination.
• Force termination requires explicit second-stage consent and a visible data-loss warning.
• Canceling the close/apply flow leaves the running target and active session unchanged.
• Tests cover graceful success, graceful timeout, user cancel, force confirmation, command failure, permission failure, malformed output, and multiple targets.
• macOS persistent targets are limited to documented installation roots and path checks are covered by tests.
• Formal signing work adds signer identity verification without weakening existing exact-path/process/loopback checks.

Related audit findings

ACT-013, ACT-014, ACT-015.

A PR design reference is available in demo/pr-blueprints/PR-06-platform-restart-diagnostics.md in the audit bundle.

[rwang23]

The structured diagnostics and graceful-first restart behavior landed in #26. Current Rust tests cover discovery error codes, graceful close, force-confirmation boundaries, exact loopback ownership, and macOS path restrictions.

Physical-Mac apply/restore/persistence validation and formal signer-identity verification remain intentionally pending. Keeping this Issue open for those platform/release gates.