docs(desktop): correct safe-send documentation

[yuzhiyang1]

Summary

Correct the stale Desktop README statement that a fixed-list source scanner verifies main-to-renderer sends. The documentation now describes the existing safe-send guard and the convention that new main-window pushes route through it.

The net change is README-only. The proposed helper extraction and behavior tests were removed because there is no current reproduction that justifies a new production seam.

Fixes#4003

Verification

• Documentation-only change; no affected behavior test was added.
• npm run format:check — 1700 files checked, no fixes.
• npm run lint — 2819 files checked, no fixes.
• npm run build
• npm run typecheck
• npx knip --workspace apps/desktop
• npx knip --workspace packages/ui
• npm run check:asf-headers
• git diff --check

AI use

Select exactly one:

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: OpenAI Codex assisted with repository analysis, documentation correction, scope reduction, verification, and PR updates. The human contributor reviewed the change and remains responsible for it.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No

[Astro-Han]

Thanks for taking the behavioral-test direction rather than restoring the old source-regex scanner. That is the right testing style when there is a concrete behavior to protect. After tracing the provenance here, though, I don’t think the current scope has enough evidence behind it yet.

[P2, normal maintainer path] The only currently verifiable defect is the stale README statement claiming that a fixed-list scanner still exists. The older “June 20 repro” appears only in a test comment imported from the pre-GitHub local history; I couldn’t find a corresponding issue, log, or reproduction, and the source-scanning suite was intentionally removed in #1724.

This PR keeps production behavior unchanged but extracts the existing six-line guard into a new factory/module and adds three tests, for a total of +119/-7. Without a current reproduction or an active change to this lifecycle behavior, that adds another concept and maintenance surface without demonstrating uncertainty that needs to be retired now.

Could we narrow this PR to correcting the README? If there is a current teardown reproduction on an active main-to-renderer path, please attach it; at that point, extracting a behavioral seam and pinning the observed failure would make sense.

I’m not approving the current version, but I’d be happy to revisit it once there is a concrete reproduction or the scope is reduced.

Review analysis was assisted by Codex and an @reviewer; Astro-Han traced the historical test provenance, current call path, and proposed test seam and owns this feedback.

中文对照

谢谢选择行为测试，而不是恢复旧的源码正则扫描。存在具体行为需要保护时，这是正确的测试方式。不过在追溯来源以后，我认为当前范围还缺少足够的事实依据。

[P2，正常维护者路径] 目前唯一可以验证的问题，是 README 仍然声称 fixed-list scanner 存在。旧的 “June 20 repro” 只出现在从 GitHub 之前的本地历史导入的一段测试注释里；我没有找到对应的 Issue、日志或复现，而且 source-scanning suite 已经在 #1724 中被有意删除。

当前 PR 不改变生产行为，却把现有 6 行 guard 提取成新的 factory/module，并增加三条测试，总计 +119/-7。在没有当前复现、也没有正在修改这段生命周期行为的情况下，这会增加一个新概念和维护面，却没有证明现在确实存在需要消除的不确定性。

建议把这个 PR 收窄为只修正 README。如果当前活跃的 main-to-renderer 路径能够复现 teardown 问题，请附上复现；届时再提取行为 seam，并用测试锁定观察到的故障，就会更合理。

当前版本暂不 Approve；有具体复现或范围收窄后，我很愿意再看。

本次审查分析由 Codex 和一位 @reviewer 协助；Astro-Han 追溯了历史测试来源、当前调用路径和新增测试 seam，并对这些反馈负责。

[yuzhiyang1]

Addressed in commit 2990c0f. The net PR diff is now README-only: the in-place safeSendToRenderer implementation is restored, and the extracted helper plus behavior tests are removed. The README no longer claims a fixed-list scanner or behavior-test coverage; it documents the existing guard and routing convention. The title and PR description now reflect the documentation-only scope. A behavior seam is deferred until there is a current reproduction to protect.

Format, lint, build, typecheck, both Knip checks, the ASF header audit, and git diff --check pass.

Automated response from OpenAI Codex at @yuzhiyang1's direction.