fix(runtime-host): report startup recovery failures

[M4n5ter]

English

Summary

Runtime Host recovery failures could be hidden by shutdown errors, while Candidate election exposed the temporary host_draining state to Desktop, TUI, and CLI. This made an incompatible stored record look like a generic startup failure.

This change preserves the primary recovery error, carries a bounded non-sensitive failure reason through Candidate exit and election, and presents an actionable shared startup message. It does not migrate or accept incompatible stored records; that remains separate migration work.

Verification

• Reproduced with a real SQLite workspace containing an incompatible persisted message; election returned {"kind":"failed","reason":"stored_data_incompatible"}
• npm test -w @maka/storage
• npm run build -w @maka/runtime-host and the full Runtime Host test suite
• Typechecks for Storage, Runtime Host, Desktop, and CLI
• Biome check for all changed files and git diff --check

AI disclosure

OpenAI Codex assisted with the implementation and verification. I reviewed the resulting changes and confirm this submission.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No

简体中文

摘要

Runtime Host 的恢复错误可能被 shutdown 错误掩盖，同时 Candidate election 会把临时的 host_draining 状态暴露给 Desktop、TUI 和 CLI，导致不兼容的持久化记录最终只显示为模糊的启动失败。

本次变更保留首要恢复错误，通过 Candidate 退出和 election 传递有界且不包含敏感信息的失败分类，并统一显示可操作的启动提示。它不会迁移或接受不兼容的持久化记录；相关兼容工作仍由独立变更负责。

验证

• 使用包含不兼容持久化消息的真实 SQLite 工作区复现；election 返回 {"kind":"failed","reason":"stored_data_incompatible"}
• npm test -w @maka/storage
• npm run build -w @maka/runtime-host 及 Runtime Host 全量测试
• Storage、Runtime Host、Desktop 和 CLI typecheck
• 所有变更文件的 Biome check 与 git diff --check

AI 披露

OpenAI Codex 协助了实现与验证。我已人工审核最终变更，并确认提交此 PR。

检查清单

• 测试覆盖该变更，且在修复前会失败
• lint、format、typecheck 和受影响测试均在本地通过

此 PR 是否改变行为？

• 是——已在摘要中说明
• 否

[M4n5ter]

English

I have manually reviewed this pull request and confirmed the fixes it contains.

The implementation now preserves the primary Runtime Host recovery failure, reports persisted-data incompatibility without exposing stored content, keeps unknown startup failures retryable, and allows a healthy successor Host to win the election after an earlier Candidate fails. I also confirmed that only the explicitly typed stored-data incompatibility is treated as permanent, without inferring storage ownership from generic filesystem or SQLite errors.

The implementation and relevant validation results are acceptable to me.

简体中文

我已人工审查此 Pull Request，并确认其中包含的修复。

当前实现能够保留 Runtime Host 的首要恢复错误，在不暴露持久化内容的前提下报告数据不兼容；未知启动失败仍可重试，较早失败的 Candidate 也不会阻止健康的后继 Host 赢得 election。我同时确认，只有明确类型化的持久化数据不兼容会被视为永久错误，代码不会再根据通用文件系统或 SQLite 错误猜测存储归属。

该实现及相关验证结果对我而言是可接受的。

[M4n5ter]

English

Summary

Runtime Host recovery failures could be hidden by shutdown errors, while Candidate election exposed the temporary host_draining state to Desktop, TUI, and CLI. This made an incompatible stored record look like a generic startup failure.

This change preserves the primary recovery error, carries a bounded non-sensitive failure reason through Candidate exit and election, and presents an actionable shared startup message. It does not migrate or accept incompatible stored records; that remains separate migration work.

Verification

• Reproduced with a real SQLite workspace containing an incompatible persisted message; election returned {"kind":"failed","reason":"stored_data_incompatible"}
• npm test -w @maka/storage
• npm run build -w @maka/runtime-host and the full Runtime Host test suite
• Typechecks for Storage, Runtime Host, Desktop, and CLI
• Biome check for all changed files and git diff --check

AI disclosure

OpenAI Codex assisted with the implementation and verification. I reviewed the resulting changes and confirm this submission.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No

简体中文

摘要

Runtime Host 的恢复错误可能被 shutdown 错误掩盖，同时 Candidate election 会把临时的 host_draining 状态暴露给 Desktop、TUI 和 CLI，导致不兼容的持久化记录最终只显示为模糊的启动失败。

本次变更保留首要恢复错误，通过 Candidate 退出和 election 传递有界且不包含敏感信息的失败分类，并统一显示可操作的启动提示。它不会迁移或接受不兼容的持久化记录；相关兼容工作仍由独立变更负责。

验证

• 使用包含不兼容持久化消息的真实 SQLite 工作区复现；election 返回 {"kind":"failed","reason":"stored_data_incompatible"}
• npm test -w @maka/storage
• npm run build -w @maka/runtime-host 及 Runtime Host 全量测试
• Storage、Runtime Host、Desktop 和 CLI typecheck
• 所有变更文件的 Biome check 与 git diff --check

AI 披露

OpenAI Codex 协助了实现与验证。我已人工审核最终变更，并确认提交此 PR。

检查清单

• 测试覆盖该变更，且在修复前会失败
• lint、format、typecheck 和受影响测试均在本地通过

此 PR 是否改变行为？

• 是——已在摘要中说明
• 否

[M4n5ter]

English

I have manually reviewed this pull request and confirmed the fixes it contains.

The implementation now preserves the primary Runtime Host recovery failure, reports persisted-data incompatibility without exposing stored content, keeps unknown startup failures retryable, and allows a healthy successor Host to win the election after an earlier Candidate fails. I also confirmed that only the explicitly typed stored-data incompatibility is treated as permanent, without inferring storage ownership from generic filesystem or SQLite errors.

The implementation and relevant validation results are acceptable to me.

简体中文

我已人工审查此 Pull Request，并确认其中包含的修复。

当前实现能够保留 Runtime Host 的首要恢复错误，在不暴露持久化内容的前提下报告数据不兼容；未知启动失败仍可重试，较早失败的 Candidate 也不会阻止健康的后继 Host 赢得 election。我同时确认，只有明确类型化的持久化数据不兼容会被视为永久错误，代码不会再根据通用文件系统或 SQLite 错误猜测存储归属。

该实现及相关验证结果对我而言是可接受的。

[M4n5ter]

English

Summary

Runtime Host recovery failures could be hidden by shutdown errors, while Candidate election exposed the temporary host_draining state to Desktop, TUI, and CLI. This made an incompatible stored record look like a generic startup failure.

This change preserves the primary recovery error, carries a bounded non-sensitive failure reason through Candidate exit and election, and presents an actionable shared startup message. It does not migrate or accept incompatible stored records; that remains separate migration work.

Verification

• Reproduced with a real SQLite workspace containing an incompatible persisted message; election returned {"kind":"failed","reason":"stored_data_incompatible"}
• npm test -w @maka/storage
• npm run build -w @maka/runtime-host and the full Runtime Host test suite
• Typechecks for Storage, Runtime Host, Desktop, and CLI
• Biome check for all changed files and git diff --check

AI disclosure

OpenAI Codex assisted with the implementation and verification. I reviewed the resulting changes and confirm this submission.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No

简体中文

摘要

Runtime Host 的恢复错误可能被 shutdown 错误掩盖，同时 Candidate election 会把临时的 host_draining 状态暴露给 Desktop、TUI 和 CLI，导致不兼容的持久化记录最终只显示为模糊的启动失败。

本次变更保留首要恢复错误，通过 Candidate 退出和 election 传递有界且不包含敏感信息的失败分类，并统一显示可操作的启动提示。它不会迁移或接受不兼容的持久化记录；相关兼容工作仍由独立变更负责。

验证

• 使用包含不兼容持久化消息的真实 SQLite 工作区复现；election 返回 {"kind":"failed","reason":"stored_data_incompatible"}
• npm test -w @maka/storage
• npm run build -w @maka/runtime-host 及 Runtime Host 全量测试
• Storage、Runtime Host、Desktop 和 CLI typecheck
• 所有变更文件的 Biome check 与 git diff --check

AI 披露

OpenAI Codex 协助了实现与验证。我已人工审核最终变更，并确认提交此 PR。

检查清单

• 测试覆盖该变更，且在修复前会失败
• lint、format、typecheck 和受影响测试均在本地通过

此 PR 是否改变行为？

• 是——已在摘要中说明
• 否

[M4n5ter]

English

I have manually reviewed this pull request and confirmed the fixes it contains.

The implementation now preserves the primary Runtime Host recovery failure, reports persisted-data incompatibility without exposing stored content, keeps unknown startup failures retryable, and allows a healthy successor Host to win the election after an earlier Candidate fails. I also confirmed that only the explicitly typed stored-data incompatibility is treated as permanent, without inferring storage ownership from generic filesystem or SQLite errors.

The implementation and relevant validation results are acceptable to me.

简体中文

我已人工审查此 Pull Request，并确认其中包含的修复。

当前实现能够保留 Runtime Host 的首要恢复错误，在不暴露持久化内容的前提下报告数据不兼容；未知启动失败仍可重试，较早失败的 Candidate 也不会阻止健康的后继 Host 赢得 election。我同时确认，只有明确类型化的持久化数据不兼容会被视为永久错误，代码不会再根据通用文件系统或 SQLite 错误猜测存储归属。

该实现及相关验证结果对我而言是可接受的。

[M4n5ter]

English

Summary

Runtime Host recovery failures could be hidden by shutdown errors, while Candidate election exposed the temporary host_draining state to Desktop, TUI, and CLI. This made an incompatible stored record look like a generic startup failure.

This change preserves the primary recovery error, carries a bounded non-sensitive failure reason through Candidate exit and election, and presents an actionable shared startup message. It does not migrate or accept incompatible stored records; that remains separate migration work.

Verification

• Reproduced with a real SQLite workspace containing an incompatible persisted message; election returned {"kind":"failed","reason":"stored_data_incompatible"}
• npm test -w @maka/storage
• npm run build -w @maka/runtime-host and the full Runtime Host test suite
• Typechecks for Storage, Runtime Host, Desktop, and CLI
• Biome check for all changed files and git diff --check

AI disclosure

OpenAI Codex assisted with the implementation and verification. I reviewed the resulting changes and confirm this submission.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No

简体中文

摘要

Runtime Host 的恢复错误可能被 shutdown 错误掩盖，同时 Candidate election 会把临时的 host_draining 状态暴露给 Desktop、TUI 和 CLI，导致不兼容的持久化记录最终只显示为模糊的启动失败。

本次变更保留首要恢复错误，通过 Candidate 退出和 election 传递有界且不包含敏感信息的失败分类，并统一显示可操作的启动提示。它不会迁移或接受不兼容的持久化记录；相关兼容工作仍由独立变更负责。

验证

• 使用包含不兼容持久化消息的真实 SQLite 工作区复现；election 返回 {"kind":"failed","reason":"stored_data_incompatible"}
• npm test -w @maka/storage
• npm run build -w @maka/runtime-host 及 Runtime Host 全量测试
• Storage、Runtime Host、Desktop 和 CLI typecheck
• 所有变更文件的 Biome check 与 git diff --check

AI 披露

OpenAI Codex 协助了实现与验证。我已人工审核最终变更，并确认提交此 PR。

检查清单

• 测试覆盖该变更，且在修复前会失败
• lint、format、typecheck 和受影响测试均在本地通过

此 PR 是否改变行为？

• 是——已在摘要中说明
• 否

[M4n5ter]

English

I have manually reviewed this pull request and confirmed the fixes it contains.

The implementation now preserves the primary Runtime Host recovery failure, reports persisted-data incompatibility without exposing stored content, keeps unknown startup failures retryable, and allows a healthy successor Host to win the election after an earlier Candidate fails. I also confirmed that only the explicitly typed stored-data incompatibility is treated as permanent, without inferring storage ownership from generic filesystem or SQLite errors.

The implementation and relevant validation results are acceptable to me.

简体中文

我已人工审查此 Pull Request，并确认其中包含的修复。

当前实现能够保留 Runtime Host 的首要恢复错误，在不暴露持久化内容的前提下报告数据不兼容；未知启动失败仍可重试，较早失败的 Candidate 也不会阻止健康的后继 Host 赢得 election。我同时确认，只有明确类型化的持久化数据不兼容会被视为永久错误，代码不会再根据通用文件系统或 SQLite 错误猜测存储归属。

该实现及相关验证结果对我而言是可接受的。

[M4n5ter]

English

Summary

Runtime Host recovery failures could be hidden by shutdown errors, while Candidate election exposed the temporary host_draining state to Desktop, TUI, and CLI. This made an incompatible stored record look like a generic startup failure.

This change preserves the primary recovery error, carries a bounded non-sensitive failure reason through Candidate exit and election, and presents an actionable shared startup message. It does not migrate or accept incompatible stored records; that remains separate migration work.

Verification

• Reproduced with a real SQLite workspace containing an incompatible persisted message; election returned {"kind":"failed","reason":"stored_data_incompatible"}
• npm test -w @maka/storage
• npm run build -w @maka/runtime-host and the full Runtime Host test suite
• Typechecks for Storage, Runtime Host, Desktop, and CLI
• Biome check for all changed files and git diff --check

AI disclosure

OpenAI Codex assisted with the implementation and verification. I reviewed the resulting changes and confirm this submission.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No

简体中文

摘要

Runtime Host 的恢复错误可能被 shutdown 错误掩盖，同时 Candidate election 会把临时的 host_draining 状态暴露给 Desktop、TUI 和 CLI，导致不兼容的持久化记录最终只显示为模糊的启动失败。

本次变更保留首要恢复错误，通过 Candidate 退出和 election 传递有界且不包含敏感信息的失败分类，并统一显示可操作的启动提示。它不会迁移或接受不兼容的持久化记录；相关兼容工作仍由独立变更负责。

验证

• 使用包含不兼容持久化消息的真实 SQLite 工作区复现；election 返回 {"kind":"failed","reason":"stored_data_incompatible"}
• npm test -w @maka/storage
• npm run build -w @maka/runtime-host 及 Runtime Host 全量测试
• Storage、Runtime Host、Desktop 和 CLI typecheck
• 所有变更文件的 Biome check 与 git diff --check

AI 披露

OpenAI Codex 协助了实现与验证。我已人工审核最终变更，并确认提交此 PR。

检查清单

• 测试覆盖该变更，且在修复前会失败
• lint、format、typecheck 和受影响测试均在本地通过

此 PR 是否改变行为？

• 是——已在摘要中说明
• 否

[M4n5ter]

English

I have manually reviewed this pull request and confirmed the fixes it contains.

The implementation now preserves the primary Runtime Host recovery failure, reports persisted-data incompatibility without exposing stored content, keeps unknown startup failures retryable, and allows a healthy successor Host to win the election after an earlier Candidate fails. I also confirmed that only the explicitly typed stored-data incompatibility is treated as permanent, without inferring storage ownership from generic filesystem or SQLite errors.

The implementation and relevant validation results are acceptable to me.

简体中文

我已人工审查此 Pull Request，并确认其中包含的修复。

当前实现能够保留 Runtime Host 的首要恢复错误，在不暴露持久化内容的前提下报告数据不兼容；未知启动失败仍可重试，较早失败的 Candidate 也不会阻止健康的后继 Host 赢得 election。我同时确认，只有明确类型化的持久化数据不兼容会被视为永久错误，代码不会再根据通用文件系统或 SQLite 错误猜测存储归属。

该实现及相关验证结果对我而言是可接受的。

[M4n5ter]

English

Summary

Runtime Host recovery failures could be hidden by shutdown errors, while Candidate election exposed the temporary host_draining state to Desktop, TUI, and CLI. This made an incompatible stored record look like a generic startup failure.

This change preserves the primary recovery error, carries a bounded non-sensitive failure reason through Candidate exit and election, and presents an actionable shared startup message. It does not migrate or accept incompatible stored records; that remains separate migration work.

Verification

• Reproduced with a real SQLite workspace containing an incompatible persisted message; election returned {"kind":"failed","reason":"stored_data_incompatible"}
• npm test -w @maka/storage
• npm run build -w @maka/runtime-host and the full Runtime Host test suite
• Typechecks for Storage, Runtime Host, Desktop, and CLI
• Biome check for all changed files and git diff --check

AI disclosure

OpenAI Codex assisted with the implementation and verification. I reviewed the resulting changes and confirm this submission.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No

简体中文

摘要

Runtime Host 的恢复错误可能被 shutdown 错误掩盖，同时 Candidate election 会把临时的 host_draining 状态暴露给 Desktop、TUI 和 CLI，导致不兼容的持久化记录最终只显示为模糊的启动失败。

本次变更保留首要恢复错误，通过 Candidate 退出和 election 传递有界且不包含敏感信息的失败分类，并统一显示可操作的启动提示。它不会迁移或接受不兼容的持久化记录；相关兼容工作仍由独立变更负责。

验证

• 使用包含不兼容持久化消息的真实 SQLite 工作区复现；election 返回 {"kind":"failed","reason":"stored_data_incompatible"}
• npm test -w @maka/storage
• npm run build -w @maka/runtime-host 及 Runtime Host 全量测试
• Storage、Runtime Host、Desktop 和 CLI typecheck
• 所有变更文件的 Biome check 与 git diff --check

AI 披露

OpenAI Codex 协助了实现与验证。我已人工审核最终变更，并确认提交此 PR。

检查清单

• 测试覆盖该变更，且在修复前会失败
• lint、format、typecheck 和受影响测试均在本地通过

此 PR 是否改变行为？

• 是——已在摘要中说明
• 否

[M4n5ter]

English

I have manually reviewed this pull request and confirmed the fixes it contains.

The implementation now preserves the primary Runtime Host recovery failure, reports persisted-data incompatibility without exposing stored content, keeps unknown startup failures retryable, and allows a healthy successor Host to win the election after an earlier Candidate fails. I also confirmed that only the explicitly typed stored-data incompatibility is treated as permanent, without inferring storage ownership from generic filesystem or SQLite errors.

The implementation and relevant validation results are acceptable to me.

简体中文

我已人工审查此 Pull Request，并确认其中包含的修复。

当前实现能够保留 Runtime Host 的首要恢复错误，在不暴露持久化内容的前提下报告数据不兼容；未知启动失败仍可重试，较早失败的 Candidate 也不会阻止健康的后继 Host 赢得 election。我同时确认，只有明确类型化的持久化数据不兼容会被视为永久错误，代码不会再根据通用文件系统或 SQLite 错误猜测存储归属。

该实现及相关验证结果对我而言是可接受的。

[M4n5ter]

English

Summary

Runtime Host recovery failures could be hidden by shutdown errors, while Candidate election exposed the temporary host_draining state to Desktop, TUI, and CLI. This made an incompatible stored record look like a generic startup failure.

This change preserves the primary recovery error, carries a bounded non-sensitive failure reason through Candidate exit and election, and presents an actionable shared startup message. It does not migrate or accept incompatible stored records; that remains separate migration work.

Verification

• Reproduced with a real SQLite workspace containing an incompatible persisted message; election returned {"kind":"failed","reason":"stored_data_incompatible"}
• npm test -w @maka/storage
• npm run build -w @maka/runtime-host and the full Runtime Host test suite
• Typechecks for Storage, Runtime Host, Desktop, and CLI
• Biome check for all changed files and git diff --check

AI disclosure

OpenAI Codex assisted with the implementation and verification. I reviewed the resulting changes and confirm this submission.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No

简体中文

摘要

Runtime Host 的恢复错误可能被 shutdown 错误掩盖，同时 Candidate election 会把临时的 host_draining 状态暴露给 Desktop、TUI 和 CLI，导致不兼容的持久化记录最终只显示为模糊的启动失败。

本次变更保留首要恢复错误，通过 Candidate 退出和 election 传递有界且不包含敏感信息的失败分类，并统一显示可操作的启动提示。它不会迁移或接受不兼容的持久化记录；相关兼容工作仍由独立变更负责。

验证

• 使用包含不兼容持久化消息的真实 SQLite 工作区复现；election 返回 {"kind":"failed","reason":"stored_data_incompatible"}
• npm test -w @maka/storage
• npm run build -w @maka/runtime-host 及 Runtime Host 全量测试
• Storage、Runtime Host、Desktop 和 CLI typecheck
• 所有变更文件的 Biome check 与 git diff --check

AI 披露

OpenAI Codex 协助了实现与验证。我已人工审核最终变更，并确认提交此 PR。

检查清单

• 测试覆盖该变更，且在修复前会失败
• lint、format、typecheck 和受影响测试均在本地通过

此 PR 是否改变行为？

• 是——已在摘要中说明
• 否

[M4n5ter]

English

I have manually reviewed this pull request and confirmed the fixes it contains.

The implementation now preserves the primary Runtime Host recovery failure, reports persisted-data incompatibility without exposing stored content, keeps unknown startup failures retryable, and allows a healthy successor Host to win the election after an earlier Candidate fails. I also confirmed that only the explicitly typed stored-data incompatibility is treated as permanent, without inferring storage ownership from generic filesystem or SQLite errors.

The implementation and relevant validation results are acceptable to me.

简体中文

我已人工审查此 Pull Request，并确认其中包含的修复。

当前实现能够保留 Runtime Host 的首要恢复错误，在不暴露持久化内容的前提下报告数据不兼容；未知启动失败仍可重试，较早失败的 Candidate 也不会阻止健康的后继 Host 赢得 election。我同时确认，只有明确类型化的持久化数据不兼容会被视为永久错误，代码不会再根据通用文件系统或 SQLite 错误猜测存储归属。

该实现及相关验证结果对我而言是可接受的。

[M4n5ter]

English

Summary

Runtime Host recovery failures could be hidden by shutdown errors, while Candidate election exposed the temporary host_draining state to Desktop, TUI, and CLI. This made an incompatible stored record look like a generic startup failure.

This change preserves the primary recovery error, carries a bounded non-sensitive failure reason through Candidate exit and election, and presents an actionable shared startup message. It does not migrate or accept incompatible stored records; that remains separate migration work.

Verification

• Reproduced with a real SQLite workspace containing an incompatible persisted message; election returned {"kind":"failed","reason":"stored_data_incompatible"}
• npm test -w @maka/storage
• npm run build -w @maka/runtime-host and the full Runtime Host test suite
• Typechecks for Storage, Runtime Host, Desktop, and CLI
• Biome check for all changed files and git diff --check

AI disclosure

OpenAI Codex assisted with the implementation and verification. I reviewed the resulting changes and confirm this submission.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No

简体中文

摘要

Runtime Host 的恢复错误可能被 shutdown 错误掩盖，同时 Candidate election 会把临时的 host_draining 状态暴露给 Desktop、TUI 和 CLI，导致不兼容的持久化记录最终只显示为模糊的启动失败。

本次变更保留首要恢复错误，通过 Candidate 退出和 election 传递有界且不包含敏感信息的失败分类，并统一显示可操作的启动提示。它不会迁移或接受不兼容的持久化记录；相关兼容工作仍由独立变更负责。

验证

• 使用包含不兼容持久化消息的真实 SQLite 工作区复现；election 返回 {"kind":"failed","reason":"stored_data_incompatible"}
• npm test -w @maka/storage
• npm run build -w @maka/runtime-host 及 Runtime Host 全量测试
• Storage、Runtime Host、Desktop 和 CLI typecheck
• 所有变更文件的 Biome check 与 git diff --check

AI 披露

OpenAI Codex 协助了实现与验证。我已人工审核最终变更，并确认提交此 PR。

检查清单

• 测试覆盖该变更，且在修复前会失败
• lint、format、typecheck 和受影响测试均在本地通过

此 PR 是否改变行为？

• 是——已在摘要中说明
• 否

[M4n5ter]

English

I have manually reviewed this pull request and confirmed the fixes it contains.

The implementation now preserves the primary Runtime Host recovery failure, reports persisted-data incompatibility without exposing stored content, keeps unknown startup failures retryable, and allows a healthy successor Host to win the election after an earlier Candidate fails. I also confirmed that only the explicitly typed stored-data incompatibility is treated as permanent, without inferring storage ownership from generic filesystem or SQLite errors.

The implementation and relevant validation results are acceptable to me.

简体中文

我已人工审查此 Pull Request，并确认其中包含的修复。

当前实现能够保留 Runtime Host 的首要恢复错误，在不暴露持久化内容的前提下报告数据不兼容；未知启动失败仍可重试，较早失败的 Candidate 也不会阻止健康的后继 Host 赢得 election。我同时确认，只有明确类型化的持久化数据不兼容会被视为永久错误，代码不会再根据通用文件系统或 SQLite 错误猜测存储归属。

该实现及相关验证结果对我而言是可接受的。