fix(desktop): make inbound 30177 frozen-linkage convergence observable and retryable

The §2.8 canonical-linkage freeze path retained the inbound event as the
head before attempting the corrective library-authoritative re-retain, then
swallowed a failed re-retain to stderr and returned Ok. That left the
non-authoritative head retained with no recovery: replay is dead because the
same event re-arriving is Skipped at the equal-created_at guard before the
convergence branch runs.

Propagate the corrective re-retain failure (converge_frozen_linkage) so the
command cannot report success over a divergent head. The durable retry owner
is the boot-time reconcile_agents_to_events pass, which re-diffs the
still-authoritative on-disk record against the retained head every launch and
re-queues the corrective row at a monotonic bump. Surface the freeze reason
as a typed InboundReconcileOutcome (reconcile_inbound_persona_event now
returns it) instead of stderr-only, and consume it in usePersonaSync.

Co-authored-by: Will Pfleger <pfleger.will@gmail.com>
Signed-off-by: Will Pfleger <pfleger.will@gmail.com>

desktop/src/features/agents/lib/usePersonaSync.ts

@@ -37,11 +37,24 @@ export function startPersonaSync(
 ): () => Promise<void> {
   const reconcile = (event: RelayEvent) => {
     if (event.pubkey !== pubkey) return;
-    void reconcileInboundPersonaEvent(JSON.stringify(event), relayUrl).catch(
-      (error) => {
+    void reconcileInboundPersonaEvent(JSON.stringify(event), relayUrl)
+      .then((outcome) => {
+        // §2.8 interim posture: a frozen-linkage reconcile re-retained the
+        // local head to converge the relay back. Surface the typed degradation
+        // rather than letting it vanish — no UI is wired in this phase, so a
+        // console warning is the minimal observable surface. A rejected invoke
+        // (below) means the corrective re-retain FAILED and the non-authoritative
+        // head is still retained; the boot-time reconcile is the durable retry.
+        if (outcome.degradation) {
+          console.warn(
+            "[usePersonaSync] inbound linkage frozen (§2.8):",
+            outcome.degradation.message,
+          );
+        }
+      })
+      .catch((error) => {
         console.warn("[usePersonaSync] reconcile failed:", error);
-      },
-    );
+      });
   };
 
   // One-shot backfill of existing heads + tombstones (closes the fresh-start

desktop/src/shared/api/tauriPersonas.ts

@@ -443,17 +443,45 @@ export async function confirmAgentSnapshotImport(
   );
 }
 
+// Machine-readable reason an inbound kind:30177 event's linkage authorship was
+// rejected under the §2.8 canonical-linkage rule. Mirrors the Rust
+// `LinkageFreezeReason` (camelCase-serialized).
+export type LinkageFreezeReason = "ownedByLibrary" | "inadmissibleNewLink";
+
+// A frozen-linkage degradation surfaced by `reconcileInboundPersonaEvent`.
+// Mirrors the Rust `LinkageDegradation`.
+export type LinkageDegradation = {
+  reason: LinkageFreezeReason;
+  agentPubkey: string;
+  message: string;
+};
+
+// Typed result of `reconcileInboundPersonaEvent`. `degradation` is null unless
+// the reconcile froze a §2.8 linkage change. Mirrors the Rust
+// `InboundReconcileOutcome`.
+export type InboundReconcileOutcome = {
+  degradation: LinkageDegradation | null;
+};
+
 // Patches a single inbound persona/team/agent projection event into the local
 // store (personas.json). The backend resolves the match key and the
 // pending-edit race; the frontend forwards the raw Nostr event JSON plus the
 // relay it arrived on, so a workspace switch mid-flight cannot retain the event
 // into the newly active community's scoped store.
+//
+// Returns a typed outcome. Its `degradation` is set only when an inbound
+// kind:30177 event's linkage authorship was rejected under the §2.8
+// canonical-linkage rule (interim fail-closed posture) and the local head was
+// re-retained to converge the relay back; otherwise it is null.
 export async function reconcileInboundPersonaEvent(
   eventJson: string,
   arrivalRelayUrl: string,
-): Promise<void> {
-  await invokeTauri("reconcile_inbound_persona_event", {
-    eventJson,
-    arrivalRelayUrl,
-  });
+): Promise<InboundReconcileOutcome> {
+  return invokeTauri<InboundReconcileOutcome>(
+    "reconcile_inbound_persona_event",
+    {
+      eventJson,
+      arrivalRelayUrl,
+    },
+  );
 }

desktop/src/testing/e2eBridge.ts

@@ -11853,7 +11853,9 @@ export function maybeInstallE2eTauriMocks() {
         }
         // Mirror the real Rust backend: emit "agents-data-changed" after reconcile.
         await emit("agents-data-changed");
-        return undefined;
+        // Mirror the typed InboundReconcileOutcome — the e2e mock never
+        // exercises the §2.8 frozen-linkage path, so degradation is always null.
+        return { degradation: null };
       }
       case "set_persona_active":
         return handleSetPersonaActive(