feat(desktop): surface adaptive peer connectivity

[M4n5ter]

English

Outcome

Complete the adaptive-connectivity product boundary in Desktop and managed Runtime Hosts. Normal UI reports Direct or Member transit; transport detail is available only in a tooltip. Users never choose QUIC versus WebRTC.

Scope

• Default to Cloudflare public STUN for best-effort public-address discovery, with an explicit no-SLA/privacy disclosure and durable local default | disabled | custom policy.
• Allow Desktop's own peer endpoint and SSH-managed Runtime Hosts to disable public STUN or use private stun: endpoints.
• Validate the same closed STUN policy in the renderer and at the main-process persistence boundary; invalid input stays field-local rather than exposing an IPC error.
• Negotiate a new operator capability so old Hosts continue to receive the strict legacy frame and remain manageable.
• Keep STUN local to connectivity policy; it never enters invitations, Mesh authority, identity, credentials, or Session state.
• Show the winning direct/transit path without a protocol selector.
• Document that STUN carries no Session traffic and that Maka does not add TURN or a new application relay.

Cloudflare currently documents stun.cloudflare.com as a free public STUN service. It can observe source IP/request timing and may change or stop independently of Maka, so the default remains replaceable and fully disableable.

This is stack 4/4 for #4382.

Verification

• Full monorepo typecheck, Biome lint/format, ASF headers, and Astryx surface inventory.
• Runtime Host: 1,465 passed / 12 skipped; Desktop: 1,758 passed.
• Native stack: fmt, clippy with warnings denied, 20 tests, cargo-deny, dependency inventory, and notices.
• Real macOS Desktop: default, disabled, custom IPv4/IPv6 STUN, field validation, persistence across restart, and restore-default flow.
• Controlled Linux double-NAT and lossy-network evidence, plus the reproducible harness, are recorded in [Tracking] WebRTC ICE as a second Runtime Host direct path #4382.
• CI builds the pinned native addon and installs the immutable CLI candidate on macOS, Linux x64/arm64, and Windows x64.

Screenshots

Default, replaceable public-STUN policy:

Custom STUN policy persisted by Desktop:

中文

结果

在 Desktop 与受管理 Runtime Host 中闭合 adaptive connectivity 的产品边界。普通 UI 只显示“直连”或“成员转发”，transport 细节只放在 tooltip；用户不需要选择 QUIC 或 WebRTC。

范围

• 默认使用 Cloudflare 公共 STUN 尽力发现公网地址，并明确披露无 SLA 与网络元数据；本地持久策略封闭为 default | disabled | custom。
• Desktop 自身 peer endpoint 与 SSH-managed Runtime Host 都可以关闭公共 STUN，或使用自有 stun: endpoint。
• Renderer 与 main-process 持久化边界复用同一个封闭 STUN policy；非法输入只显示为字段错误，不泄漏 IPC 错误。
• 通过新 operator capability 协商，旧 Host 继续收到严格的 legacy frame，管理能力不回归。
• STUN 只属于本地 connectivity policy，不进入 invitation、Mesh authority、identity、credential 或 Session 状态。
• 展示 winning direct/transit path，不提供协议选择器。
• 文档明确 STUN 不承载 Session traffic，且 Maka 不加入 TURN 或新的应用转发服务。

Cloudflare 当前将 stun.cloudflare.com 文档化为免费的公共 STUN 服务。它仍可观察源 IP/请求时间，也可能独立于 Maka 变更或停止，因此默认端点始终可替换、可完全关闭。

这是 #4382 的第 4/4 层。

验证

• 仓库完整 typecheck、Biome lint/format、ASF headers 与 Astryx surface inventory。
• Runtime Host：1,465 通过 / 12 跳过；Desktop：1,758 通过。
• Native stack：fmt、clippy 零警告、20 个 tests、cargo-deny、依赖清单与 notices。
• 真实 macOS Desktop：默认、禁用、自定义 IPv4/IPv6 STUN、字段校验、重启后持久化与恢复默认流程。
• [Tracking] WebRTC ICE as a second Runtime Host direct path #4382 记录了受控 Linux 双 NAT、丢包网络证据与可复现 harness。
• CI 在 macOS、Linux x64/arm64 与 Windows x64 上构建 pinned native addon 并安装 immutable CLI candidate。

截图

默认且可替换的公共 STUN 策略：

Desktop 持久化自定义 STUN 策略：

AI use

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: OpenAI Codex implemented, tested, documented, and reviewed the adaptive-connectivity UX and policy under human direction. The human contributor owns review and merge decisions.

Checklist

• Tests cover the decision-relevant behavior
• Formatting, lint, licenses, builds, and affected tests pass locally

[jackwener]

Approved at exact head c82b478cca40055ce704643dd4245571118cee68 at the explicit direction of M4n5ter. No technical review was performed as part of this action; M4n5ter requested the approval and accepts responsibility for subsequent handling.

---

Review notice: This approval was submitted by an automated review agent operated by WAWQAQ and is published at the direction of M4n5ter, who requested this action and is the human accountable for it.