Desktop boot: show window immediately, self-heal stale launchd state, fix boot-path latency (#1303)

* Desktop boot: show a window immediately and self-heal stale launchd state Two boot-time fixes in the desktop main process: Show a lightweight "Starting Executor" window at app.whenReady, before any service or sidecar work, then load the real web UI into the same window once the connection resolves (no second-window flash). A pending second-instance now focuses that startup window instead of no-opping while connection is null. Classify the supervised service by both registered and running instead of ignoring the running signal: - registered and running: attach; only kick if the attach still misses it. - registered but not running (the stale plist/unit/task case): restart, and if the OS manager cannot start it, reinstall the service (install is already idempotent) before waiting. If install also fails, fall back to managed spawn immediately. The 15s attach wait is only paid after a kick or install actually succeeds, so a stale registration no longer costs a dead wait. * Desktop boot: keep login-shell PATH capture off the read path captureUserPath shells out to $SHELL -ilc on every bundled-executor call, including read-only `service status` that boot runs first. Skip the capture for `service status` (process env PATH is enough for a read) and memoize it for the rest of the process lifetime so install/restart pay the shell probe at most once instead of on every call. * e2e: invert the stale launchd repro to guard the fast, self-healing boot The repro pinned the broken behavior (stale plist forces a >=14s dead wait). Flip it to guard the fix: the startup window must appear within a few seconds, the kickstart failure must be followed by a self-heal-or-fallback log line rather than a dead wait, boot-to-ready must stay under the fast budget and close to the clean control, and recovery must either repair launchd or fall back cleanly to managed spawn without attaching to the stale plist port. The E2E_RECORD recording now captures the fixed fast boot.

Rhys Sullivan committed 4 months ago

Commit a968cc51 parent 7f618056 files · +340 −108Browse files

Unified · Split

6 files

apps/desktop/src/main/crash-screen.ts +98 −0
apps/desktop/src/main/index.ts +101 −45
apps/desktop/src/main/service.ts +29 −11
e2e/desktop-packaged/stale-launchd-registration.test.ts +114 −54
e2e/recordings/stale-launchd-fast-boot.mp4 +0 −0
e2e/recordings/stale-launchd-slow-boot.mp4 +0 −0

apps/desktop/src/main/crash-screen.ts+98−0

@@ -11,6 +11,104 @@ export interface CrashScreenOptions { · 10 unmodified lines
11	readonly reported: boolean;	11	readonly reported: boolean;
12	}	12	}
13		13
		14	export const startupWindowHtml = (): string => `<!doctype html>
		15	<html>
		16	<head>
		17	<meta charset="utf-8" />
		18	<title>Executor</title>
		19	<style>
		20	:root {
		21	color-scheme: light dark;
		22	--background: #0a0a0a;
		23	--foreground: #fafafa;
		24	--muted: #a1a1aa;
		25	--line: #27272a;
		26	--pulse: #fafafa;
		27	}
		28	@media (prefers-color-scheme: light) {
		29	:root {
		30	--background: #f7f7f4;
		31	--foreground: #18181b;
		32	--muted: #60646c;
		33	--line: #d8d8d0;
		34	--pulse: #18181b;
		35	}
		36	}
		37	body {
		38	margin: 0;
		39	min-height: 100vh;
		40	display: grid;
		41	place-items: center;
		42	background: var(--background);
		43	color: var(--foreground);
		44	font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
		45	}
		46	main {
		47	width: min(22rem, calc(100vw - 4rem));
		48	display: grid;
		49	gap: 1rem;
		50	justify-items: center;
		51	text-align: center;
		52	}
		53	.mark {
		54	width: 2.25rem;
		55	height: 2.25rem;
		56	border: 1px solid var(--line);
		57	border-radius: 8px;
		58	display: grid;
		59	place-items: center;
		60	font-size: 0.82rem;
		61	font-weight: 650;
		62	letter-spacing: 0;
		63	}
		64	h1 {
		65	margin: 0;
		66	font-size: 1.05rem;
		67	font-weight: 600;
		68	letter-spacing: 0;
		69	}
		70	p {
		71	margin: -0.35rem 0 0;
		72	color: var(--muted);
		73	font-size: 0.82rem;
		74	line-height: 1.5;
		75	}
		76	.activity {
		77	width: 8rem;
		78	height: 2px;
		79	overflow: hidden;
		80	border-radius: 999px;
		81	background: var(--line);
		82	}
		83	.activity::after {
		84	content: "";
		85	display: block;
		86	width: 45%;
		87	height: 100%;
		88	border-radius: inherit;
		89	background: var(--pulse);
		90	animation: slide 1.15s ease-in-out infinite;
		91	}
		92	@keyframes slide {
		93	0% { transform: translateX(-110%); opacity: 0.35; }
		94	50% { opacity: 0.9; }
		95	100% { transform: translateX(245%); opacity: 0.35; }
		96	}
		97	@media (prefers-reduced-motion: reduce) {
		98	.activity::after { animation: none; transform: none; width: 100%; opacity: 0.55; }
		99	}
		100	</style>
		101	</head>
		102	<body>
		103	<main>
		104	<div class="mark">Ex</div>
		105	<h1>Starting Executor…</h1>
		106	<p>Preparing your local workspace.</p>
		107	<div class="activity" aria-hidden="true"></div>
		108	</main>
		109	</body>
		110	</html>`;
		111
14	export const sidecarCrashHtml = ({ reported }: CrashScreenOptions): string => `<!doctype html>	112	export const sidecarCrashHtml = ({ reported }: CrashScreenOptions): string => `<!doctype html>
15	<html>	113	<html>
16	<head>	114	<head>

apps/desktop/src/main/index.ts+101−45

   initErrorReporting,
   reportAProblem,
 } from "./diagnostics";
-import { sidecarCrashHtml } from "./crash-screen";
+import { sidecarCrashHtml, startupWindowHtml } from "./crash-screen";
 import { replaceSupervisedDaemonForDesktop } from "./supervised-connection";
 import {
   bundledExecutorPath,
   return url.toString();
 };
+const htmlDataUrl = (html: string): string =>
+  `data:text/html;charset=utf-8,${encodeURIComponent(html)}`;
 // The supervised daemon (and the desktop sidecar) own this data dir — the same
 // path the CLI's `executor web`/daemon uses, so desktop and CLI share state.
 const DESKTOP_DATA_DIR = join(homedir(), ".executor");
   return response === 0;
 };
+const acceptSupervisedConnection = async (
+  attached: SidecarConnection,
+): Promise<SidecarConnection | null> => {
+  if (!shouldReplaceDaemonForDesktop(attached)) return attached;
+  const settings = getServerSettings();
+  return replaceSupervisedDaemonForDesktop(attached, {
+    install: () =>
+      installSupervisedService({
+        port: settings.port,
+        dataDir: DESKTOP_DATA_DIR,
+      }),
+    waitForAttach: () => waitForSupervisedAttach(30_000, { port: settings.port }),
+    attach: attachToSupervisedDaemon,
+    onInstallFailure: (error) => {
+      log.warn("Failed to replace older supervised daemon; re-checking before falling back", error);
+    },
+  });
+};
+const installSupervisedAndWait = async (reason: string): Promise<SidecarConnection | null> => {
+  const settings = getServerSettings();
+  // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: install failure falls back to managed-spawn so the app still launches
+  try {
+    await installSupervisedService({
+      port: settings.port,
+      dataDir: DESKTOP_DATA_DIR,
+    });
+  } catch (error) {
+    log.warn(`Failed to install supervised service after ${reason}; using managed sidecar`, error);
+    return null;
+  }
+  return waitForSupervisedAttach(15_000, { port: settings.port });
+};
 /**
  * Resolve a connection to the OS-supervised daemon, installing it on first run
  * (with consent). Returns null when supervision is unavailable or the user
   // 1. Already running → attach.
   const attached = await attachToSupervisedDaemon();
   if (attached) {
-    if (!shouldReplaceDaemonForDesktop(attached)) return attached;
+    return acceptSupervisedConnection(attached);
-    const settings = getServerSettings();
-    return replaceSupervisedDaemonForDesktop(attached, {
-      install: () =>
-        installSupervisedService({
-          port: settings.port,
-          dataDir: DESKTOP_DATA_DIR,
-        }),
-      waitForAttach: () => waitForSupervisedAttach(30_000, { port: settings.port }),
-      attach: attachToSupervisedDaemon,
-      onInstallFailure: (error) => {
-        log.warn(
-          "Failed to replace older supervised daemon; re-checking before falling back",
-          error,
-        );
-      },
-    });
   }
   // Headless/e2e: the first-run background-service prompt and the systemd/
   const status = await supervisedServiceStatus();
   if (!status.supported) return null;
-  // 2. Registered but not currently serving → kick it and wait.
+  // 2. Registered and running, but the first attach missed it. Kick once and
+  // wait only when the kick command succeeds.
   if (status.registered) {
-    // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: a restart failure just falls through to managed-spawn
+    if (status.running) {
+      const attachedAfterStatus = await attachToSupervisedDaemon();
+      if (attachedAfterStatus) return acceptSupervisedConnection(attachedAfterStatus);
+      // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: a restart failure just falls through to managed-spawn
+      try {
+        await restartSupervisedService();
+      } catch (error) {
+        log.warn(
+          "Failed to restart running supervised service after attach failed; using managed sidecar",
+          error,
+        );
+        return null;
+      }
+      return waitForSupervisedAttach(15_000);
+    }
+    // 3. Registered but not running usually means a stale plist/unit/task. Try
+    // restart first, then reinstall the service if the OS manager cannot start it.
+    // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: restart failure triggers supervised service self-heal
     try {
       await restartSupervisedService();
     } catch (error) {
-      log.warn("Failed to kickstart supervised service", error);
+      log.warn("Failed to restart registered supervised service; reinstalling", error);
+      return installSupervisedAndWait("registered service restart failure");
     }
     return waitForSupervisedAttach(15_000);
   }
-  // 3. First run → ask, then install + start. The unit carries no secret; the
+  // 4. First run → ask, then install + start. The unit carries no secret; the
   // supervised daemon mints/loads its bearer from auth.json under DESKTOP_DATA_DIR.
   if (!(await confirmEnableBackgroundService())) return null;
-  const settings = getServerSettings();
+  return installSupervisedAndWait("first-run prompt");
-  // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: install failure falls back to managed-spawn so the app still launches
-  try {
-    await installSupervisedService({
-      port: settings.port,
-      dataDir: DESKTOP_DATA_DIR,
-    });
-  } catch (error) {
-    log.error("Failed to install supervised service; using managed sidecar", error);
-    return null;
-  }
-  return waitForSupervisedAttach(15_000);
 };
 // Crash monitor for the supervised daemon: the OS service manager restarts it
         if (supervisedMonitorMisses < SUPERVISED_MONITOR_MISSES_BEFORE_DOWN) return;
         if (!supervisedDaemonDown && window) {
           supervisedDaemonDown = true;
-          const html = sidecarCrashHtml({ reported: errorReportingEnabled });
+          showCrashScreen(window);
-          void window.loadURL(`data:text/html;charset=utf-8,${encodeURIComponent(html)}`);
         }
         return;
       }
   log.info(`[dock-icon] set to ${iconPath} (${image.getSize().width}×${image.getSize().height})`);
 };
-const createWindow = async (conn: SidecarConnection) => {
+const createMainBrowserWindow = (options: { readonly show: boolean }): BrowserWindow => {
   const windowState = windowStateKeeper({
     defaultWidth: 1280,
     defaultHeight: 800,
   });
-  installBearerAuthHeader(conn.baseUrl, conn.authToken);
   const linuxIcon = resolveLinuxIcon();
   const window = new BrowserWindow({
     // header, which is offset to clear them (.desktop-macos-titlebar).
     minWidth: 768,
     minHeight: 480,
-    show: false,
+    show: options.show,
     backgroundColor: "#0a0a0a",
     autoHideMenuBar: true,
     ...(process.platform === "darwin"
     return { action: "deny" };
   });
+  return window;
+};
+const showStartupWindow = async (): Promise<void> => {
+  const window = liveMainWindow() ?? createMainBrowserWindow({ show: true });
+  if (window.isMinimized()) window.restore();
+  if (!window.isVisible()) window.show();
+  window.focus();
+  // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: local startup HTML should not block service startup
+  try {
+    await window.loadURL(htmlDataUrl(startupWindowHtml()));
+  } catch (error) {
+    log.warn("Failed to load startup window", error);
+  }
+};
+const showCrashScreen = (window: BrowserWindow | null = liveMainWindow()): void => {
+  if (!window) return;
+  const html = sidecarCrashHtml({ reported: errorReportingEnabled });
+  void window.loadURL(htmlDataUrl(html));
+};
+const createWindow = async (conn: SidecarConnection) => {
+  installBearerAuthHeader(conn.baseUrl, conn.authToken);
+  const existingWindow = liveMainWindow();
+  const window = existingWindow ?? createMainBrowserWindow({ show: false });
   // A supervised daemon can pass the health probe and still disappear before
   // navigation begins. Treat that as a failed connection instead of leaving the
   // user with a visible BrowserWindow that only shows the black background.
   // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: Electron navigation rejects when the sidecar vanishes during startup
   try {
     await window.loadURL(webUrlForConnection(conn));
+    if (!window.isDestroyed() && !window.isVisible()) window.show();
   } catch (error) {
     log.error("Failed to load Executor web UI", error);
-    destroyWindow(window);
+    if (!existingWindow) destroyWindow(window);
     // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: caller decides whether to fall back or surface startup failure
     throw error;
   }
 // here, the boot-time update check never runs (it sits after a successful
 // sidecar start), so a broken app could never self-update its way out.
 const handleFatalSidecarFailure = async (error: unknown) => {
+  showCrashScreen();
   if (app.isPackaged) {
     // Install whatever finishes downloading by the time the user quits the
     // failure dialog; if it downloads while the dialog is open, the regular
 const boot = async () => {
   installDockIcon();
   installApplicationMenu();
+  await showStartupWindow();
   setupAutoUpdater();
   applyFakeUpdateFromEnv();
   registerIpcHandlers();
   // every request with no explanation. Swap in the crash screen — its
   // buttons drive the regular preload bridge (restart / export diagnostics).
   onUnexpectedSidecarExit(() => {
-    const window = liveMainWindow();
+    showCrashScreen();
-    if (!window) return;
-    const html = sidecarCrashHtml({ reported: errorReportingEnabled });
-    void window.loadURL(`data:text/html;charset=utf-8,${encodeURIComponent(html)}`);
     // A crashing sidecar may be a broken release — quietly stage any
     // available update so the install prompt appears on its own (same
     // self-heal as the fatal startup path).

apps/desktop/src/main/service.ts+29−11

@@ -38,6 +38,8 @@ export const bundledExecutorPath = (): string => · 37 unmodified lines
38		38
39	const executorAvailable = (): boolean => app.isPackaged && existsSync(bundledExecutorPath());	39	const executorAvailable = (): boolean => app.isPackaged && existsSync(bundledExecutorPath());
40		40
		41	let userPathCapture: Promise<string \| undefined> \| null = null;
		42
41	const captureUserPath = async (): Promise<string \| undefined> => {	43	const captureUserPath = async (): Promise<string \| undefined> => {
42	const shell = process.env.SHELL;	44	const shell = process.env.SHELL;
43	if (!shell) return process.env.PATH;	45	if (!shell) return process.env.PATH;
@@ -53,24 +55,37 @@ const captureUserPath = async (): Promise<string \| undefined> => { · 9 unmodified lines
53	}	55	}
54	};	56	};
55		57
56	const serviceEnv = async (dataDir: string): Promise<NodeJS.ProcessEnv> => ({	58	const memoizedUserPath = (): Promise<string \| undefined> => {
57	...process.env,	59	userPathCapture ??= captureUserPath();
58	...(await captureUserPath().then((path) => (path ? { PATH: path } : {}))),	60	return userPathCapture;
59	EXECUTOR_DATA_DIR: dataDir,	61	};
60	EXECUTOR_SCOPE_DIR: dataDir,	62
61	EXECUTOR_CLIENT: "desktop",	63	const serviceEnv = async (
62	...sidecarCrashReportingEnv(),	64	dataDir: string,
63	});	65	options: { readonly captureUserPath: boolean },
		66	): Promise<NodeJS.ProcessEnv> => {
		67	const path = options.captureUserPath ? await memoizedUserPath() : process.env.PATH;
		68	return {
		69	...process.env,
		70	...(path ? { PATH: path } : {}),
		71	EXECUTOR_DATA_DIR: dataDir,
		72	EXECUTOR_SCOPE_DIR: dataDir,
		73	EXECUTOR_CLIENT: "desktop",
		74	...sidecarCrashReportingEnv(),
		75	};
		76	};
64		77
65	const runExecutor = async (	78	const runExecutor = async (
66	args: ReadonlyArray<string>,	79	args: ReadonlyArray<string>,
67	options: { readonly dataDir: string },	80	options: { readonly dataDir: string; readonly captureUserPath?: boolean },
68	): Promise<CommandResult> => {	81	): Promise<CommandResult> => {
69	const bin = bundledExecutorPath();	82	const bin = bundledExecutorPath();
70	try {	83	try {
71	const { stdout, stderr } = await execFileAsync(bin, [...args], {	84	const { stdout, stderr } = await execFileAsync(bin, [...args], {
72	encoding: "utf8",	85	encoding: "utf8",
73	env: await serviceEnv(options.dataDir),	86	env: await serviceEnv(options.dataDir, {
		87	captureUserPath: options.captureUserPath ?? true,
		88	}),
74	});	89	});
75	return { code: 0, stdout, stderr };	90	return { code: 0, stdout, stderr };
76	} catch (error) {	91	} catch (error) {
@@ -92,7 +107,10 @@ const statusValue = (stdout: string, key: "Registered" \| "Running"): boolean => · 15 unmodified lines
92	export const supervisedServiceStatus = async (): Promise<SupervisedServiceStatus> => {	107	export const supervisedServiceStatus = async (): Promise<SupervisedServiceStatus> => {
93	if (!executorAvailable()) return { supported: false, registered: false, running: false };	108	if (!executorAvailable()) return { supported: false, registered: false, running: false };
94	const dataDir = join(app.getPath("home"), ".executor");	109	const dataDir = join(app.getPath("home"), ".executor");
95	const result = await runExecutor(["service", "status"], { dataDir });	110	const result = await runExecutor(["service", "status"], {
		111	dataDir,
		112	captureUserPath: false,
		113	});
96	if (result.code !== 0) {	114	if (result.code !== 0) {
97	serviceLog.warn(`service status failed: ${result.stderr \|\| result.stdout}`);	115	serviceLog.warn(`service status failed: ${result.stderr \|\| result.stdout}`);
98	return { supported: true, registered: false, running: false };	116	return { supported: true, registered: false, running: false };

e2e/desktop-packaged/stale-launchd-registration.test.ts+114−54

 const execFileAsync = promisify(execFile);
 const SERVICE_LABEL = "sh.executor.daemon";
 const SCENARIO_NAME =
-  "Desktop packaged supervised attach: stale launchd registration pins the 15s dead boot wait";
+  "Desktop packaged supervised attach: stale launchd registration self-heals without a dead boot wait";
-const RECORDING_FILE = resolve("recordings/stale-launchd-slow-boot.mp4");
+const RECORDING_FILE = resolve("recordings/stale-launchd-fast-boot.mp4");
 const RECORDING_WIDTH = 1280;
 const RECORDING_HEIGHT = 720;
 const STALE_PLIST_PORT = 58_251;
 interface BootResult {
   readonly pageCdpMs: number;
+  readonly startupWindowMs: number;
   readonly sidecarReadyMs: number;
   readonly connectionKind: string;
   readonly origin: string;
   readonly manifestKind: string;
   readonly manifestPid: number;
-  readonly matchedLogLine: string | null;
+  readonly kickstartFailureLine: string | null;
+  readonly recoveryLogLine: string | null;
+  readonly launchdPrintSucceeded: boolean;
 }
 declare global {
   }
 };
+const launchctlPrintService = async (): Promise<string | null> => {
+  try {
+    const { stdout, stderr } = await execFileAsync("launchctl", ["print", serviceTarget()], {
+      encoding: "utf8",
+    });
+    return `${stdout}${stderr}`.trim();
+  } catch {
+    return null;
+  }
+};
 const captureLaunchdService = (): LaunchdServiceSnapshot | null => {
   if (process.platform !== "darwin") return null;
   const path = launchAgentPath();
   return JSON.parse(readFileSync(manifestPath, "utf8")) as ServerManifest;
 };
-const readKickstartFailureLine = (home: string): string | null => {
+interface StaleRecoveryLog {
+  readonly kickstartFailureLine: string | null;
+  readonly recoveryLogLine: string | null;
+}
+// The desktop's own classification line for a stale registration; electron-log
+// appends the launchctl error on the same line. Production launchctl fails the
+// kickstart with exit 113 ("Could not find service"); a tart guest's
+// `launchctl asuser` session fails it with exit 125 ("Domain does not support
+// specified action"). Same stale state, same self-heal branch, so match the
+// kickstart failure without pinning the environment-specific exit code.
+const isKickstartFailureLine = (line: string): boolean =>
+  line.includes("Failed to restart registered supervised service; reinstalling") &&
+  line.includes("launchctl kickstart failed");
+const isRecoveryLogLine = (line: string): boolean =>
+  line.includes("installed supervised service via bundled executor") ||
+  line.includes("Failed to install supervised service after registered service restart failure") ||
+  line.includes("using managed sidecar");
+const readStaleRecoveryLog = (home: string): StaleRecoveryLog => {
   const logPath = join(home, "Library", "Logs", "Executor", "main.log");
-  if (!existsSync(logPath)) return null;
+  if (!existsSync(logPath)) return { kickstartFailureLine: null, recoveryLogLine: null };
-  return (
+  const lines = readFileSync(logPath, "utf8").split("\n");
-    readFileSync(logPath, "utf8")
+  const kickstartIndex = lines.findIndex(isKickstartFailureLine);
-      .split("\n")
+  if (kickstartIndex < 0) return { kickstartFailureLine: null, recoveryLogLine: null };
-      .find(
+  const recoveryLogLine =
-        (line) =>
+    lines.slice(kickstartIndex + 1).find((line) => isRecoveryLogLine(line)) ?? null;
-          line.includes("launchctl kickstart failed (exit 113)") &&
+  return {
-          line.includes('Could not find service "sh.executor.daemon"'),
+    kickstartFailureLine: lines[kickstartIndex] ?? null,
-      ) ?? null
+    recoveryLogLine,
-  );
+  };
 };
-const waitForKickstartFailureLine = async (home: string): Promise<string> => {
+const waitForStaleRecoveryLog = async (home: string): Promise<StaleRecoveryLog> => {
   const deadline = Date.now() + 30_000;
   for (;;) {
-    const line = readKickstartFailureLine(home);
+    const lines = readStaleRecoveryLog(home);
-    if (line) return line;
+    if (lines.kickstartFailureLine && lines.recoveryLogLine) return lines;
     if (Date.now() >= deadline) {
       const logPath = join(home, "Library", "Logs", "Executor", "main.log");
       const tail = existsSync(logPath)
         ? readFileSync(logPath, "utf8").split("\n").slice(-20).join("\n")
         : "<main.log missing>";
-      throw new Error(`Timed out waiting for kickstart failure log line\n${tail}`);
+      throw new Error(`Timed out waiting for stale launchd recovery log lines\n${tail}`);
     }
     await new Promise((resolveWait) => setTimeout(resolveWait, 250));
   }
   readonly home: string;
   readonly env: NodeJS.ProcessEnv;
   readonly recorder: BootRecorder | null;
-  readonly expectKickstartFailure: boolean;
+  readonly expectStartupWindow: boolean;
+  readonly expectStaleRecoveryLog: boolean;
 }): Promise<BootResult> => {
   let app: PackagedApp | undefined;
   const startedAt = Date.now();
     const launched = await launchPackaged(input.env, input.recorder);
     app = launched.app;
     const page = app.cdp;
+    const startupWindowVisible = await page
+      .waitForText("Starting Executor", 5_000)
+      .then(() => true)
+      .catch(() => false);
+    const startupWindowMs = startupWindowVisible ? Date.now() - startedAt : launched.pageCdpMs;
+    expect(
+      !input.expectStartupWindow || startupWindowVisible,
+      "startup window shows before service recovery finishes when required",
+    ).toBe(true);
     await page.waitForText("Settings", 120_000);
     const sidecarReadyMs = Date.now() - startedAt;
     await input.recorder?.captureReadyFrame();
     } | null>("window.executor.getServerConnection()");
     expect(connection, "the app eventually exposes a server connection").not.toBeNull();
     const manifest = readServerManifest(input.home);
-    const matchedLogLine = input.expectKickstartFailure
+    const recoveryLog = input.expectStaleRecoveryLog
-      ? await waitForKickstartFailureLine(input.home)
+      ? await waitForStaleRecoveryLog(input.home)
-      : readKickstartFailureLine(input.home);
+      : readStaleRecoveryLog(input.home);
+    const launchdPrintSucceeded = (await launchctlPrintService()) !== null;
     return {
       pageCdpMs: launched.pageCdpMs,
+      startupWindowMs,
       sidecarReadyMs,
       connectionKind: connection!.kind,
       origin: connection!.origin,
       manifestKind: manifest.kind,
       manifestPid: manifest.pid,
-      matchedLogLine,
+      kickstartFailureLine: recoveryLog.kickstartFailureLine,
+      recoveryLogLine: recoveryLog.recoveryLogLine,
+      launchdPrintSucceeded,
     };
   } finally {
     await input.recorder?.stop();
   static create = (runDir: string): BootRecorder | null => {
     if (process.env.E2E_RECORD !== "1") return null;
-    const frameDir = join(runDir, "stale-launchd-slow-boot-frames");
+    const frameDir = join(runDir, "stale-launchd-fast-boot-frames");
     rmSync(frameDir, { recursive: true, force: true });
     mkdirSync(frameDir, { recursive: true });
     mkdirSync(dirname(RECORDING_FILE), { recursive: true });
   captureReadyFrame = async (): Promise<void> => {
     if (!this.enabled) return;
-    this.enqueueFrame("managed sidecar ready", this.page);
+    this.enqueueFrame("executor ready", this.page);
     await this.queue;
   };
       home: cleanHome,
       env: cleanBootEnv(cleanHome),
       recorder: null,
-      expectKickstartFailure: false,
+      expectStartupWindow: false,
+      expectStaleRecoveryLog: false,
     });
     writeStaleLaunchAgentPlist(staleHome);
       home: staleHome,
       env: packagedAppEnv(staleHome),
       recorder: staleRecorder,
-      expectKickstartFailure: true,
+      expectStartupWindow: true,
+      expectStaleRecoveryLog: true,
     });
     /*
-     * Regression pin for the current broken behavior:
+     * Regression guard for the production incident:
-     * a stale plist makes `service status` report registered even though launchd
+     * a stale plist makes `service status` report registered while launchd cannot
-     * cannot find the label. The packaged app logs the kickstart failure, then
+     * find the label. The app must show a window immediately, then repair or
-     * still pays the full 15s wait before falling back to managed-spawn.
+     * bypass that stale service without paying the old dead 15s wait.
-     *
-     * When the fix lands, invert the >=14s stale assertions. The desired
-     * behavior is a fast-fail to managed-spawn, close to the clean control.
      */
-    expect(stale.matchedLogLine, "stale boot logs the launchd kickstart failure").toContain(
+    expect(stale.kickstartFailureLine, "stale boot logs the launchd kickstart failure").toContain(
-      "launchctl kickstart failed (exit 113)",
+      "launchctl kickstart failed",
-    );
-    expect(stale.matchedLogLine, "stale boot says launchd cannot find the label").toContain(
-      'Could not find service "sh.executor.daemon"',
     );
+    expect(
+      stale.kickstartFailureLine,
+      "the failed kickstart is classified as a stale registration to repair",
+    ).toContain("Failed to restart registered supervised service; reinstalling");
+    expect(
+      stale.recoveryLogLine,
+      "kickstart failure is followed by self-heal or fallback logging",
+    ).not.toBeNull();
     expect(
       stale.pageCdpMs,
-      "window/CDP is not reachable until the dead wait is paid",
+      "the Electron page target is reachable before service recovery finishes",
-    ).toBeGreaterThanOrEqual(14_000);
+    ).toBeLessThan(3_000);
     expect(
-      stale.sidecarReadyMs,
+      stale.startupWindowMs,
-      "managed sidecar readiness is delayed by the dead wait",
+      "the startup window appears promptly in the stale launchd case",
-    ).toBeGreaterThanOrEqual(14_000);
+    ).toBeLessThan(3_000);
-    expect(stale.connectionKind, "the app eventually recovers through managed-spawn").toBe(
+    expect(new URL(stale.origin).port, "recovery must not attach to the stale plist port").not.toBe(
-      "desktop-sidecar",
+      String(STALE_PLIST_PORT),
     );
-    expect(
-      new URL(stale.origin).port,
-      "managed recovery must not be a launchd attach to the stale plist port",
-    ).not.toBe(String(STALE_PLIST_PORT));
     expect(
       clean.sidecarReadyMs,
       "the clean control skips supervision and boots quickly",
     ).toBeLessThan(10_000);
     expect(
       stale.sidecarReadyMs,
-      "the stale launchd path is dramatically slower than the clean control",
+      "stale launchd recovery stays within the fast boot budget",
-    ).toBeGreaterThan(clean.sidecarReadyMs + 5_000);
+    ).toBeLessThan(10_000);
+    expect(
+      stale.sidecarReadyMs,
+      "the stale launchd path stays close to the clean control",
+    ).toBeLessThan(clean.sidecarReadyMs + 7_500);
+    const repairedLaunchd = stale.launchdPrintSucceeded && stale.manifestKind === "cli-daemon";
+    const managedFallback =
+      !stale.launchdPrintSucceeded && stale.manifestKind === "desktop-sidecar";
+    expect(
+      repairedLaunchd || managedFallback,
+      "stale state is either repaired into launchd or cleanly falls back to managed spawn",
+    ).toBe(true);
     const recording = staleRecorder?.recordingStats();
     emitEvidence(
-      `[stale-launchd-repro] clean=${clean.sidecarReadyMs}ms stale=${stale.sidecarReadyMs}ms stalePageCdp=${stale.pageCdpMs}ms cleanOrigin=${clean.origin} staleOrigin=${stale.origin} staleConnectionKind=${stale.connectionKind} staleManifestKind=${stale.manifestKind} stalePid=${stale.manifestPid}`,
+      `[stale-launchd-repro] clean=${clean.sidecarReadyMs}ms stale=${stale.sidecarReadyMs}ms staleStartup=${stale.startupWindowMs}ms stalePageCdp=${stale.pageCdpMs}ms cleanOrigin=${clean.origin} staleOrigin=${stale.origin} staleConnectionKind=${stale.connectionKind} staleManifestKind=${stale.manifestKind} stalePid=${stale.manifestPid} launchdPrintAfterBoot=${stale.launchdPrintSucceeded}`,
     );
-    emitEvidence(`[stale-launchd-repro] matchedLogLine=${stale.matchedLogLine}`);
+    emitEvidence(`[stale-launchd-repro] kickstartFailureLine=${stale.kickstartFailureLine}`);
+    emitEvidence(`[stale-launchd-repro] recoveryLogLine=${stale.recoveryLogLine}`);
     if (recording) {
       emitEvidence(
         `[stale-launchd-repro] recording=${recording.path} frames=${recording.frames} size=${recording.size}`,

e2e/recordings/stale-launchd-fast-boot.mp4+0−0

Binary file not shown.

e2e/recordings/stale-launchd-slow-boot.mp4+0−0

Binary file not shown.