Bound repeated desktop backend crash restarts

[yaacovcorcos]

User impact

• If Scient's local backend repeatedly crashes, desktop restarts use bounded exponential delay and stop after the fifth failure in 60 seconds instead of looping forever.
• The recovery dialog lets users retry explicitly, open the private desktop logs folder, or keep Scient open; replacement dialogs retain focus and accessible native actions.
• A restart budget clears only after 30 seconds of proven post-readiness stability or explicit user retry.
• Failed updater handoffs preserve crash history and resume only when the updater owned the interruption. User, OS, signal, and Windows session shutdown requests remain authoritative.

Upstream provenance and disposition

• Synara donor: 5495a6e81e4da80e996867a1c487c9546cbd0196.
• Disposition: Reimplement. Scient adopts the crash-loop safety principle on its own desktop supervisor without importing Synara's database-recovery policy, storage model, or lifecycle assumptions.
• Exact base: 626cfdeb803e1c6537e3bab07ca6df77e4841371.
• Exact candidate: f5bfcc268c814a4d36749abac727919276965bb8.

Protected-lane decisions

• Preserves Scient identity, private log paths, updater ownership, packaged-startup containment, external-child force-kill refusal, and current storage/credential/session boundaries.
• Intentional shutdown cancels retries. Updater failure cannot erase an independent quit request or leave a late backend exit permanently classified as expected.
• Native acceptance cleanup signals only its tracked fixture child and stubs OS log-folder opening.

Verification

Exact candidate f5bfcc268c814a4d36749abac727919276965bb8:

• Focused lifecycle/regression suite: 47/47.
• Combined packaged-startup verifier: 55 passed, 4 platform-gated skips.
• bun run scient:upstream-check --intake: passed identity, format, lint with 0 errors, all typechecks, full bun run test (web 3,097; CLI/server 2,338 passed and 10 platform skips), desktop/CLI builds, release smoke, upstream state, and clean-worktree certification.
• Stable Chromium at the immediately preceding candidate: 353 passed with expected skips; geometry: 19 passed. The final two-file supervisor-only correction was recertified through the complete unit/build intake suite; exact-head hosted browser coverage is required below.
• git diff --check; clean worktree; tests created no tracked artifacts.
• Exactly three fresh independent read-only reviews of the final exact head returned CLEAR with no P0-P3 findings across correctness/reliability; security/privacy/release safety; and architecture/product/accessibility/test proof.

Hosted gate and limitations

• Current hosted CI for the exact candidate is required before merge, including stable browser, Linux geometry, Electron lifecycle, Windows process regression, Linux/Windows preview smoke, build, and release smoke.
• The final visible native crash-breaker acceptance was intentionally not rerun after it disturbed the user's desktop. Its harness, focus, exit, and cleanup paths have deterministic coverage; this remains an explicit manual-evidence limitation rather than claimed proof.
• No cross-repository agent smoke was required because provider, protocol, shared contracts, approvals, and agent runtime did not change.

Rollback

• Revert this PR. The work is isolated to desktop supervision, updater recovery coordination, diagnostics dialog support, and their tests/acceptance fixture.

Related intake PRs

• Diff/Git refresh: Keep diff mode and Git status refresh responsive #127
• New-chat project picker: Make the new-chat project heading interactive #128
• Migration lineage guard: Guard released migration lineage and dependencies #129 (merged)
• Parent recovery research record: ScientFactory/Scient#49

[yaacovcorcos]

Final integration refresh (2026-07-25): current main dab9b6d was merged normally into this branch; no rebase or force-push. Exact hosted head: 8c3adab. Focused desktop supervisor suite 19/19 passed. git diff --check passes and the task worktree is clean. Fresh hosted CI run https://github.com/ScientFactory/scient-desktop/actions/runs/30160243946 completed successfully, including format, lint, typecheck, full bun run test, stable browser, Linux geometry, desktop build/preload, release smoke, Linux and Windows HTML-preview smoke, and Windows process regression. No unresolved review threads remain. Existing documented manual limitations are unchanged and non-blocking. This candidate is integration-ready against main dab9b6d; this is not merge or release authorization.