fix(desktop): recover startup when Docker or Temporal is unavailable

[yxflc11]

What changed

When macOS launches OpenBot before Docker, the Temporal connection failed during product preflight and Desktop reported a generic installation/Keychain failure. Desktop now keeps one startup pending, identifies the retained local Docker installation with a bounded read-only Engine ping, and automatically continues when Temporal becomes available. Retry wakes the same pending attempt; Quit cancels it and stops only app-owned children.

Only a marked Temporal connection failure enters the wait loop. Migration failures, malformed/private-file configuration failures, denied Keychain access and unknown failures retain their existing fail-closed behavior. Neither Docker nor any container is started or reconfigured. The UI uses the Owner's Docker/waiting copy and removes Keychain advice from unknown errors. Web changes are limited to DesktopInstallScreen and its test; preview copy and other documentation remain Claude-owned.

Acceptance journey

1. OpenBot starts before the retained local Docker engine: show the Docker guidance and Retry button.
2. Open Docker: show the Temporal waiting message while retrying automatically, then continue the same startup once ready.
3. Retry wakes that attempt; quitting cancels startup and cleans up app-owned processes. Unknown and credential failures remain distinguishable.

Verification

Final review follow-up at 85306dd1bd3b64d441013a59995ee2da15046818 (main base 50837bea7bf63290aab250f84fe1b705f942efdb):

• Merged current main, including fix(security): accept the reviewed P5 fixtures under the squash-merge commit #225 and docs: finish the P5 documentation cleanup #226. The credential adapter conflict was a comment only; all 34 exact reviewed tuples from both sides are preserved, with no new exception.
• Claude reviewed the two Web files at af5e6cb1 and accepted the copy/startup behavior, with one requested fix: allow waiting users to change their connection. The follow-up adds that existing onBack action plus Retry dispatch-count, non-Docker waiting-copy and late-ready-after-unmount coverage. Claude also reviewed the final 85306dd1 incremental Web diff and approved the copy and all four regression cases. The Owner subsequently approved this final Web review and authorized merging after all current-head CI checks pass.
• npm run check: passed; 30 test tasks (14 cached), 20 build tasks (16 cached). Desktop 584 passed / 3 skipped, Web 703 passed (including 8 DesktopInstallScreen tests), Server 147 passed. Existing skips remain unqualified.
• Actual component rendering: 8/8 states at 1280×800 and 390×844 with a synthetic Desktop bridge; keyboard Retry/connection-exit focus and activation, no horizontal overflow, non-Docker copy, one retry wakeup and automatic continuation verified.
• npm run ui:acceptance -- --entry ts: PASS 12/12 with disposable PostgreSQL/mTLS Temporal and actual Chrome; 112 API responses, zero unexpected responses or page errors.
• Final Web review accepted. GitHub automatic squash merge is enabled after all required CI checks pass. Current-head run 38076480295 passed the other 15 qualifications; browser recovery and its aggregate check are rerunning after the first disposable native-container startup timed out. The rerun has passed that native qualification step; earlier CI below is historical evidence. The retained candidate ZIP is still pinned to 763c4ff9; this follow-up was not packaged or installed.

Product validation at 763c4ff9 (unchanged by the CI-only follow-up a177f536):

• npm run check: passed; 30 test tasks (14 cached), 20 build tasks (16 cached). Desktop 584 passed / 3 skipped, Web 699 passed, Server 147 passed. Skips do not establish platform qualification.
• Whole TS interface: PASS 12/12, 111 responses, zero unexpected responses or page errors.
• Actual component rendering: 6/6 combinations of Docker unavailable, Temporal waiting and unknown error at 1280×800 and 390×844; keyboard Retry focus, no horizontal overflow and continuation verified with a synthetic Desktop bridge.
• Native candidate with disposable PostgreSQL and real mTLS Temporal: unavailable transport → waiting → automatic recovery → one Owner login; encrypted fixture bootstrap unchanged. Quit during a second outage cancelled waiting and stopped its database in 61 ms. No installed profile or model calls; encryption callback is synthetic.
• Unit regressions cover fixed child exit classification, Docker GET /_ping bounds/refusal, unknown failures, pending startup deduplication, retry wakeup and cancellation.
• macOS arm64 candidate packaged with the existing Worker companion; source-byte and signature checks passed. Hosted CI at a177f536 passed all 17 checks (run 38065184657). A new installation remains pending Owner confirmation after review.

Open-source research

• Evidence: Existing reuse decisions and P5 integration.
• Source copied or substantially adapted: no

Reuses the existing Electron 44.3.0 main/IPC lifecycle, Node 24.21.0, Temporal TypeScript SDK 1.24.0, safe startup phases and existing private configuration loader. No dependency or version changes, no source copied. Docker transport reference: Mac socket locations and Engine API v1.51 ping; read-only, fixed socket targets, 1-second timeout and 16-character response limit. Relevant reuse decisions: Desktop unified onboarding/Server connection and P4/P5 Temporal in docs/OPEN_SOURCE_REUSE.md.

The first hosted scan exposed three existing fixtures at the new #222 squash commit, eadee8d53a3e0788f707e74d81c6cb054df349f4. These were already reviewed at their pre-squash source: the two public gVisor binary digests in experiments/linux-execution/native-config.ts:16–17 and the reserved .invalid URL fixture in scripts/integration/fixtures/web-contract-compatibility.json:16842. Their detector, file, line and both content hashes match the existing entries exactly; only the commit identity changed. The existing historical fixture review remains applicable. The adapter adds only these three immutable tuples, with all-field refusal tests. Full fetched-history scanning, scanner-error refusal, detector coverage and offline/no-verification policy remain unchanged. Raw candidates were not printed or uploaded.

Two pinned offline scans returned 28 findings each and alternated between the two known gVisor digest lines. security:config-check passed 27 cases covering all 34 exact tuples and all-field mutations, both recorded scan outputs pass the adapter, and npm run check passed again at the final a177f536 tree. The packaged application remains the already verified 763c4ff9 product because the follow-up changes only the CI finding adapter and its tests.

Historical startup evidence

The earlier P5 installation's first process exit is still unconfirmed. Its durable backup receipt records Temporal originally running and an engine restart requested after replacement; it does not contain that exit's cause. Temporary installation logs are no longer present after the Mac reboot. A targeted retained container-log query did not recover a conclusive startup event. This fix reproduces and closes the separately reported dependency-order failure; it does not assert that the historical exit had the same cause.

Security impact

• No new privilege or external side effect
• No credentials or private user data included

The dependency hint uses fixed local socket targets and a bounded read-only request. Server authority, configuration validation, task submission and installed data are unchanged. Only the narrowly marked Temporal connection failure is retried.

Documentation and compatibility

The additive Desktop startup state is implemented in the existing IPC contract and consumer. This PR claims macOS arm64 candidate validation only; Windows/Linux qualification and a fresh installation of this candidate remain pending. The Owner assigned preview copy and post-P5 document cleanup to Claude, outside this change's file scope.

AI or automation assistance

• Tools/models used: Codex with repository checks, native fixture and browser rendering tools.
• Human-reviewed areas and evidence: the Owner approved startup behavior, copy and the two Web files; Claude reviewed the Web copy/tests and approved the final 85306dd1 follow-up; the Owner then confirmed the final Web review and authorized merging after current-head CI passes. The accepted P5 UI review applies to P5: default TypeScript control plane and Python retirement #222, not this startup fix.