fix(agents): prepare desktop runtime and recover initial status reads

[wesbillman]

Pinky is opening this PR on Wes’s behalf.

Summary

Make normal desktop agent setup reliable and keep first-open status loading through short native initialization/contention failures.

• Prepare the existing pinned runtime before just desktop starts Tauri and before packaged desktop builds. Reuse bundles only after validating revision, target, manifest shape/size, executable files and hashes; rebuild missing, stale or corrupt resources. Preparation failures stop launch; help remains nonbuilding.
• Disable new agent creation with an explanation when the local runtime is unavailable. Preserve drafts, existing identities and profile-publication retry for an already-saved identity.
• Retry only the two existing native initialization/busy rejection strings in the coalesced, read-only status refresh: at most twenty 250ms waits, then explicit error/Retry. Disposal and newer mutations retire the read. Never retry writes or hide genuine failures.

Five production files, +85/−6 lines; the remainder is regression tests and two documentation updates. No new runner architecture, migrations, credential changes, mention/autocomplete changes or notice restyling. Existing/release-app agents are untouched.

Validation

Original implementation head: 2b666681e8d85c471e97a86c2e2bc97eb8b3a288, based on e9717dda50eb25e81e0edad30b5d0500a052b591.

• Pre-commit: staged formatting/lint passed, no changes applied.
• Pre-push at this head: TypeScript, 169 related tests in 11 files, design typecheck and all design guards passed. Remote head verified against local head.
• Full frontend suite on the unchanged pre-commit content: 193 files / 2,029 tests passed; pnpm build passed (existing chunk-size warning only).
• Runtime/setup slice: 86 Node integration tests passed, zero skipped; real launcher/recipe/builder boundaries use a synthetic compiler and never launch a GUI.
• Runtime/setup slice: cargo test -p buzz-agent-controller -p buzz-foundation --locked -- --include-ignored: 74 passed, zero skipped. Includes staged ACP lifecycle and isolated worker inference/token-refresh/restart fixtures. cargo build -p buzz-foundation --locked passed; copied runtime manifest and executable hashes verified. Native checks preceded the frontend-only loading follow-up; native implementation was unchanged afterward.
• Built pinned revision 84b0fd04b7831657df2873c3a835412f47cebb03 on aarch64-apple-darwin: cold preparation ~152s; verified warm reuse ~0.130s.
• Human acceptance: first-open Agents visibly stays loading, then displays agent cards without manual Retry. Independent source review found no blockers.
• git diff --check passed; clean worktree after commit/push.

Regression coverage and limits

Mounted UI coverage protects missing-runtime Create/no native writes/draft retention, saved-profile retry, and automatic status recovery. Controlled-clock projection tests cover both transient strings, the exact retry bound, retained snapshots, genuine errors, cancellation and no write replay.

Browser cases added/removed: 0/0. No browser-only contract changed; mounted UI, projection and real subprocess tests exercise the affected boundaries. Existing broad browser and Rust/tool-integration CI remain required; no local browser suite was added as an extra gate.

First-time preparation intentionally takes minutes; warm launches reuse verified resources. Real-account Create → mention → inference reply and a packaged installer have not been newly certified by this PR. Process-running evidence alone is not a claim of relay/inference readiness.

CI, external DCO Check and required reviewer/code-owner approval must pass before merge. This PR does not authorize merge.

CI follow-up: deterministic GIF selection test

GIF-repair head: 4c84ff1a21ef6e07a6416fb5040b06bed5b8c2b2.

The first CI run failed one existing WebKit GIF journey; JavaScript, Rust/tool integration, browser measurements and the other three browser shards passed. WebKit shard 1/2 reported 120 passed / 1 failed / 0 skipped. The failure artifact records GitHub's checkout f23eed3e849569e1a098bffc1e43743974548416 for PR head 2b66668; the embedded GIF test matches that head's source.

At gifs.spec.mjs:261, the draft stayed empty after selecting a GIF. The trace records the selection click at 444177–444611ms, with the cleared-query request at 444604ms inside it. The existing test only counted two tiles after clearing the search, so it could select old results while the 500ms debounce cleared/replaced them (GifPicker.tsx:82–102).

The follow-up changes one test file, +15/−4; no production changes. The empty-query fixture now returns a distinctly named result, and the test waits for that rendered result before selecting. Exact URL/alt-text insertion, picker dismissal and existing assertions remain intact. No sleeps, forced clicks, extra retries or timeout increases. Browser cases added/removed remain 0/0.

Validation: bin/pnpm test:browser tests/browser/gifs.spec.mjs --no-deps --project chromium --project webkit --repeat-each=3 passed 18/18, zero skipped, in 24.3s on Apple Silicon macOS. Run state was 2b66668 plus this test delta, SHA-256 4896a38774514db4e145414b998419980cbad29361ac580cc6c64c664c658558; pre-commit applied no changes and the committed file has the same hash. Required pre-commit and pre-push gates passed at the new head; remote head verified. Independent source/trace review found no blocker.

Scope limit: this establishes selection after refreshed results arrive. It does not fix or rule out a real user losing a click on an old tile during replacement; that existing interaction remains outside this agent-setup PR. Fresh hosted Linux CI and required review remain pending.

CI follow-up: warm-switch diagnostic evidence (not a performance fix)

Current head: 58238811e3ca0fcc91adbdbcf70b607924324539.

The second CI run passed all four functional browser shards, including the repaired GIF test, plus JavaScript and Rust/tool integration. Chromium channel-opening instead measured Alpha 73.6 ms, then Beta 107.5 ms against the unchanged <100 ms budget. The failure prevented the last two switches and final no-new-head assertion; these were not reported as passing. Artifact checkout was GitHub merge checkout 18a76929cc92acb6aceb32f94b6829d2c72faba2; its embedded measurement test matched the PR source.

Source/artifact review found both signed startup catch-up markers observed and only the four initial/catch-up head reads recorded. Requests during warm intervals were stream-priority changes. This establishes neither a product cause nor harmless runner noise. A matched local Chromium control at 4c84ff1 produced 12 warm samples per mode: trace-on median 38.1 ms (33.4–48.5), trace-off median 41.7 ms (35.4–49.3). It did not justify removing tracing; no tracing/config changes were made.

This follow-up adds +27/−6 in one test file, recording synchronous click dispatch, animation-frame timestamps and callback-entry offsets, first observed correct-channel visibility, and the final paint opportunity in existing evidence. Original pre-click start/post-await endpoint, predicate, frame schedule, 1-second deadline and strict <100 ms assertion remain. Numeric evidence is saved before the assertion, including a completed over-budget result. These are phase boundaries, not CPU attribution; 1-second timeouts still reject before returning them. No production changes or performance-fix claim. Browser cases added/removed: 0/0. No assertions moved or removed.

Validation on Apple Silicon macOS, production React, Chromium 153.0.8010.12 / WebKit 26.6, Node v24.18.0:

PLAYWRIGHT_JSON_OUTPUT_FILE=test-results/browser/ci-report.json bin/node scripts/ci-test-report.mjs kind=playwright report=test-results/browser/ci-report.json evidence=test-results/browser/ci-timing.json title="PR136 channel-opening diagnostics" -- bin/pnpm test:browser tests/browser/channel-opening.spec.mjs --project '*-measurements' --no-deps --workers=1 --repeat-each=3 --reporter=list,json

Complete file, both engines, three serial repetitions: 12/12 passed, zero skipped. Wall 50.43 s; summed execution 34.14 s; slowest case WebKit 300-author thread opening 3.70 s. All execution belongs to channel-opening.spec.mjs. Warm samples: Chromium 34.2–48.6 ms, WebKit 36–50 ms. Run state was 4c84ff1 plus exactly this test delta; SHA-256 ccb4c3cc8433a8febc6abc0aa5bc55ddd29c4e288e4d045842036b42d4a5320c matches committed bytes. The unmodified Chromium full-file control passed 6/6 in 18.7 s with tracing (and 6/6 in 19.2 s without); those one-engine invocations are not an end-to-end speed comparison against the two-engine validation. No runner or fixture setup changed.

Independent source review found no blocker. Required pre-commit/pre-push hooks passed; unchanged committed bytes, clean worktree and remote head verified; DCO Check succeeded at 5823881. Hosted CI is running. The hosted timing cause remains unresolved; local green does not establish hosted reliability, and a new green run alone would not prove this diagnosed or repaired it. Required review and approval remain outstanding; nothing merged.