fix(startup): resolve startup issues and simplify runtime structure

[testikun]

What happened

Follow-up validation of #5556 / #4032 identified remaining startup usability issues and structural complexity:

• Tool validation caching adds long-term consistency obligations. The cross-transaction reducer requires checkpoint/undo, database-view invalidation versions, detection of other writes, LRU/byte budgets, transaction pinning, terminal eviction, and commit/rollback synchronization. These are interconnected obligations of the same cache architecture. Testing each mechanism does not establish the cache's marginal value.
• Memory/model-connection error toasts appear during the first connection. A local session is already visible, but the target's identity/lifecycle is not yet ready, so valid scoped reads are rejected early. After updating from main, we confirmed that fix(desktop): know a Runtime Host target's identity before it connects #5606 already fixes this issue. The follow-up PR uses that fix rather than adding another initial-connection readiness signal.
• Math fonts in history trigger CSP errors. Vite inlines small KaTeX fonts as data URLs, while the renderer allows only same-origin fonts.
• Temporary profiling remains in production recovery. SessionManager still contains MAKA_STARTUP_PROFILE, two timing Maps, ten timing wrappers, and summary logging.

The goal is to preserve the main startup improvements, reduce maintenance of long-lived derived state, and validate actual application reads and recovery correctness in addition to startup visibility.

How to reproduce

1. On the post-perf(runtime): scope recovery work and tool validation #5556 baseline 518fd529c0, start Desktop with the representative fixture containing 302 sessions and 90,942 RuntimeEvents. Select a session before the Host's first connection completes. Memory/model-connection reads can return Runtime Host target is unavailable and show an error toast. This is now addressed by fix(desktop): know a Runtime Host target's identity before it connects #5606.
2. In the production renderer, display a formula requiring KaTeX_Size3, or explicitly load that font. Inspect the renderer for font data URLs blocked by CSP.
3. Compare the SQLite T1/T2 writer with and without caching, using both short invocations and a stress case with 200 tools and 400 commits in one invocation. Measure uninterrupted writes, one partial event before each tool, and one partial event before each commit.

Checking only whether the window, composer, or history is visible misses the first two application errors. Recovery tests also need unsettled tool states, steering states around consumption, and actual Host restarts.

Environment

• Original ablation baseline: 518fd529c0a15a84e6fa5a13f903bf1f28701cd2 (perf(runtime): scope recovery work and tool validation #5556).
• Follow-up implementation base: 54135dce5, including fix(desktop): know a Runtime Host target's identity before it connects #5606 and perf(desktop): stop idle and streaming render work #5608. The earlier performance figures are not measurements of this newer base.
• macOS arm64 / Apple M2 Pro; Node 24.20.0; Electron 43.4.1; production renderer.
• Real SQLite, separate Host child processes, and UDS; FakeBackend provides model output, without real external tool side effects.

Logs, screenshots, or additional context

Design trade-off: remove the cross-transaction cache, retain local validation

The Host-ready improvement from approximately 13.3 s to 2.3 s in #5556 combines several optimizations and cannot be attributed to the tool validation cache. Removing the cache on the same baseline showed no observed startup regression. Benefits for short invocations and frequent partial writes were limited or unstable.

Hundreds of consecutive tool writes in one invocation, with almost no intervening writes, form the synthetic stress upper bound used here. We do not yet have a real task distribution that justifies keeping the cache as the default architecture for this pattern. However, the cache does have measurable benefits:

200 tools / 400 commits; median of three runs (ms)	Cached	Cache removed
512 B, uninterrupted T1/T2	615	1249
512 B, partial before each tool	1557	1684
512 B, partial before every T1/T2 commit	2224	2089
4096 B, uninterrupted T1/T2	839	2056
4096 B, partial before each tool	2033	2574
4096 B, partial before every T1/T2 commit	3223	3252

This trade-off explicitly accepts additional write cost for some long invocations; it does not imply that every write pattern has only a small difference. These timings cover the writer only, excluding model and real tool execution.

The follow-up PR should:

• Remove the cache Map, LRU, byte budgets, terminal eviction, checkpoint/undo, invalidation versions, and cache-specific transaction synchronization.
• Reconstruct the local dependency closure for each write inside the current SQLite transaction, apply shared validation rules, and discard the resulting state. Preserve parent dependencies, atomicity, exact retry semantics, and the distinction between corrupt persisted facts and invalid candidates.
• Retain recovery-obligation filtering, targeted SQL, indexes, and lazy history loading. Do not restore workspace-wide scans or introduce a replacement cache or second ledger.
• Remove SessionManager's temporary timing layer and keep fonts as local assets under the existing CSP.

The local cache removal reduces the code by a net 766 lines, and profiling cleanup removes a net 39 lines. The healthy UI has no layout change; validation uses error counts and actual font/memory/connection reads.

Correctness validation

The new mixed-state fixture constructs prepared operations, successful/failed outcomes, and unknown-outcome recovery scenarios through the official T1/T2 interfaces. It submits quoted steering through a real Host/UDS connection and sends SIGKILL after the echo is durable. The successor Host must preserve identity, avoid duplicate echoes/terminal events, and reject replay from the old epoch. Both journeys run with ordinary and 100k background-event histories, comparing complete history digests and events after repeated recovery.

Validation on the updated 54135dce5 base: 546 tests passed, 0 failed, 0 skipped in the combined suite; 212 SessionManager/Graph tests passed; three Electron health checks passed. The full build, typecheck, lint/format of all tracked source files, Desktop/UI knip, and pre-commit checks passed. The 546 tests include existing semantic regressions; they are not 546 newly added tests. The count changed from 550 on the earlier base to 546 after adopting #5606's mainline tests and removing the duplicate local implementation. Temporarily disabling one recovery settlement caused the new test to fail; restoring the implementation made it pass.

The PR includes only 13 relevant source, regression-test, and documentation files. The local correctness-matrix handoff document is excluded; the self-contained test runner and generated-data regression tests remain in the PR. Large databases, screenshots, logs, and local performance drivers are excluded. The original fixture remains unchanged, with separate records for history-integrity checks and application health checks.

Local validation does not cover real provider networks, operating-system permission dialogs, or cross-platform behavior, and does not claim that every main-process log is error-free. Test execution cost is not reported as startup performance.

AI disclosure: OpenAI Codex prepared and submitted this report and the take claim at @testikun's request. @testikun is the human contributor of record.

[testikun]

take