[Runtime] Make Full Skin apply transactional and expose controller degradation

[rwang23]

[Runtime] Make Full Skin apply transactional and expose controller degradation

Draft status: ready to create; not submitted by the audit run.
Priority: P1
Findings: ACT-008, ACT-009

Summary

Full Skin switching currently behaves as a sequence of side effects rather than an atomic transaction. A failed candidate may partially affect targets or remove the previous working session, and the page monitor can stop after repeated errors without exposing a degraded state to the UI.

中文摘要：当前 Full Skin 切换不是事务。新主题失败时可能已经影响部分页面，旧主题又被提前清理；监控连续失败后也可能静默停止。需要保留 last-known-good、支持回滚并向 UI 暴露 degraded 状态。

Audit evidence

• The runtime takes/removes the existing session before the new descriptor, targets, and art are fully prepared and verified.
• Multi-target injection returns on the first error without rolling back targets already injected successfully.
• The new runtime session is tracked only after all injections succeed, so partial candidate effects are not represented in state.
• The monitor exits after an error threshold and sets its internal running flag false, but the active session can remain present and the UI may continue to display an active state.

This is complementary to #2. Issue #2 covers prompt diagnostics and exact-version probing; this issue covers atomic application, rollback, and long-lived health state.

Proposed state model

idle → preparing → injecting → verifying → committing → active → degraded → restoring

• Prepare the candidate without changing the active session.
• Inject targets while recording per-target undo information.
• Verify all target readbacks.
• Atomically commit the candidate only after all targets pass.
• Roll back candidate targets in reverse order on any failure.
• Clean up the prior session only after the candidate is committed.
• Keep explicit monitor health and last error information.

Acceptance criteria

• A failure on target N rolls back targets 1..N-1 and preserves the previous known-good session.
• Candidate preparation/download/descriptor failures do not alter the active session.
• Commit and prior-session cleanup have a documented order and recovery behavior.
• Rollback failure enters a visible degraded state with a sanitized diagnostic and safe Restore action.
• Monitor state exposes running/degraded, consecutive error count, last successful check, and retryability.
• The UI never displays a healthy active state after the monitor has terminally stopped.
• Unit/integration tests cover partial multi-target failure, readback failure, rollback failure, monitor threshold, process restart, and Restore.
• Diagnostics do not include chats, tokens, page content, user paths, or full WebSocket URLs.

Related audit findings

ACT-008, ACT-009.

A state-machine diagram and non-production Rust sketch are available in diagrams/runtime-state-machine.mmd and demo/rust/transactional_injection.rs in the audit bundle.

[rwang23]

The transactional switch, rollback/degraded-state behavior, monitor visibility, and Restore coverage landed in #26. Current Node and Rust regression checks pass the partial multi-target rollback, monitor threshold, process restart, and cleanup paths.

Because this changes the Full Skin runtime, an isolated supported Stable/Beta smoke with action-after readback and cleanup is still required. Keeping this Issue open for that runtime acceptance evidence.