Use core v0.61.0: safe mode says which line of the config is wrong, and repairs it in one click

[fylorn]

Why

After updating to 2026.10.2, a config that still had client_probes.titling: passthrough made core exit in safe mode too, and the app showed only "core 未运行 / 已停止" with no reason. Safe mode exists for exactly this case. Core 0.61.0 (ThinkWatch-Core#284) now serves the control plane with a stand-in when the configuration does not load and offers a one-click repair; this is the app side.

What

• Config error page (safe mode, Status.config_rejected): file, line and stage, reason (the commonest field errors are now translated), the line itself, and actions: 一键修复 (when core offers one), 打开配置文件 (editor marks the line), 版本历史, 重新启动. It replaces every page except Settings, since the others would show core's stand-in.
• One-click repair (ConfigRepairPlan / RepairConfig): lists the fixes (a value outside its choices goes back to the default, an unknown field is removed), then writes through the normal path; the previous version stays in version history. The yellow "config rejected" banner offers the same repair.
• Back to normal on its own: when a working configuration lands in safe mode (repair, save, rollback, external edit), the shell restarts core in normal mode.
• safe_mode:<pid>: the app connects to a safe-mode core on a cold start too; before, it only connected to running: and never learned the reason.
• exited:<reason>: when the safe-mode core still exits (another instance holds the lock, YAML too broken to read the control key), the shell keeps core's stderr and shows its last error as "core 无法启动" + the reason, instead of "已停止". Menu bar and notices treat it like a failed start. Core's stderr is still echoed to the shell's stderr.
• Pin core v0.61.0 (protocol 37), regenerate tw-api.ts, whitelist the two endpoints, zh translations for the new codes, fixtures.

Tests

• pnpm typecheck, pnpm test (752, new: repair.test.ts, trouble.exited.test.ts)
• cargo fmt, cargo clippy --all-targets -D warnings, cargo test with twcore 0.61.0 (new: a safe-mode core that exits reports what it said; last-error parsing)
• Preview harness (?safe, ?rejected, ?down=exited): the page, the banner, and a repair that brings the app back to the overview
• End to end against twcore: serve --safe on a broken config → /status → /config/repair → repaired file and history

🤖 Generated with Claude Code