[Bug]: manual nodes are persisted only by the desktop app, so a headless nvpair-tui node loses them on every restart

从 services/nvpair-ui-broker/manualnodes.go 和 services/nvpair-tui/ui/manualnodes.go 开始，然后将它们与 desktop/src/electron/service-bridge/manual-nodes-store.ts 以及 supervisor 的 replay 行为进行比较。使用文档中记录的 systemctl 命令重现重启，并检查 node-settings README 以确定每用户数据路径。对于 TUI、desktop 和 service-mode 前端，手动节点在 ready 后能够持久化并 replay，即表示完成。

PAIR version or commit

Debian package nvpair 0.1.1-463 (amd64). nvpair-ui-broker --version reports 0.40.2.

Affected component

Discovery or pairing

Environment

OS:            Ubuntu 26.04 LTS, x86_64
Front end:     nvpair-tui only (started by a `systemd --user` unit inside tmux, linger enabled).
               The Electron desktop app is not installed on these nodes.
GPU / driver:  consumer NVIDIA GPUs, driver 595.91.07
Engine:        Ollama 0.33.3, adopted by PAIR as the node engine
Cluster size:  5 nodes joined to one cluster, split across two routed subnets

Steps to reproduce

1. On a node whose only front end is nvpair-tui, open the Manual tab, press a, enter a peer address, press Enter.
2. Confirm the entry is listed as OLLAMA yes / NODE yes, and that the peer appears in Proxies -> Ollama upstreams.
3. Restart the front end and its broker: systemctl --user restart nvpair-tui.
4. Open the Manual tab again.

Expected behavior

The manual node list survives a restart on any supported front end.

This matters because on a cluster split across routed subnets, manual nodes are the only way to
pair peers at all (mDNS does not cross subnets, and #1 additionally prevents reflectors from
relaying the records). Losing the list on every restart makes such a cluster impractical to
operate without the desktop app.

Actual behavior

After the restart the Manual tab shows No manual nodes. and the peer is gone from
Ollama upstreams. Nothing was written to disk: configs/manual-nodes.json never appears
in the per-user data dir, and the configs/ directory is not created.

Reading the source, the durable list appears to be implemented only in the Electron app:

• desktop/src/electron/service-bridge/manual-nodes-store.ts reads and writes
  <userData>/configs/manual-nodes.json with entries { id, address, name }.
• desktop/src/electron/service-bridge/modular-supervisor.ts notes that
  "PAIR UI owns the durable list (manual-nodes.json) and replays it once".
• services/nvpair-ui-broker/manualnodes.go performs no file I/O, and
  services/nvpair-tui/ui/manualnodes.go neither reads nor writes that file.
• services/nvpair-manual-nodes is stateless by design — its README documents
  node/add, node/remove, nodes/list and no state or config-path flag.

So the replay is desktop-only, even though services/nvpair-node-settings/README.md already
describes manual-nodes.json as living in the per-user data dir, "same directory as
settings.json" — which reads as if the file is meant to be a per-node artifact rather than a
private detail of the desktop app.

Suggested fix

Move ownership of the durable list, and the one-shot replay after ready, into
nvpair-ui-broker. The broker already supervises nvpair-manual-nodes over JSON-RPC and
already has node/add available, so every front end — desktop, TUI, and any future
service mode (cf. #49, #32) — would inherit persistence without its own copy of the logic.

Sanitized logs

Manual tab, immediately after adding the entry:

 ID                    ADDRESS                       OLLAMA    NODE
 manual:peer-a.…       peer-a.example.internal       yes       yes

Per-user data dir at the same moment (no configs/ directory is created):

$ ls "$HOME/.config/Nvidia Corporation/Personal AI Router/configs/"
ls: cannot access '.../configs/': No such file or directory

After systemctl --user restart nvpair-tui:

No manual nodes. Press a to add one by address.
a add node • r remove node • tab next • shift+tab prev • ? help • q quit

$ ls "$HOME/.config/Nvidia Corporation/Personal AI Router/configs/"
ls: cannot access '.../configs/': No such file or directory

Related

• #1 — mDNS answers sent from an ephemeral source port, so reflectors never relay node records
  across subnets. Together with this issue, a routed multi-subnet cluster cannot be kept paired
  from a headless node.
• #49 — Build a service version on Linux.
• #32 — Run a services-only PAIR node as a container or Kubernetes pod.

Confirmations

• I searched existing issues for duplicates.
• This is not a security vulnerability.
• I agree to follow the Code of Conduct.