What

Add controller post-start validation with a single bounded recovery retry, and gate real macOS launchd tests behind an explicit opt-in flag.

Why

Packaged desktop could fail to start when the controller exited or became unreachable right after launch, leaving the shell waiting on a dead readiness probe. Separately, the real launchd integration tests were capable of mutating live host launchd state unless they were run intentionally.

How

• validate controller startup immediately after launchd start using launchd status, port reachability, and /api/internal/desktop/ready with fallback to /api/auth/get-session
• if validation fails, boot out the controller once, choose the next free port, regenerate the controller plist, and retry exactly once with structured failure logging
• add startup regression coverage for exit/unreachable/retry-success/retry-failure scenarios
• require RUN_REAL_LAUNCHD_TESTS=1 before executing real launchd desktop integration tests

Affected areas

• Desktop app (Electron shell)
• Controller (backend / API)
• Web dashboard (React UI)
• OpenClaw runtime
• Skills
• Shared schemas / packages
• Build / CI / Tooling

Checklist

• pnpm typecheck passes
• pnpm lint passes
• pnpm test passes
• pnpm generate-types run (if API routes/schemas changed)
• No credentials or tokens in code or logs
• No any types introduced (use unknown with narrowing)

Notes for reviewers

The main behavior change is in apps/desktop/main/services/launchd-bootstrap.ts, specifically the new controller post-start validation and one-time retry path. The real launchd tests are still available, but now require RUN_REAL_LAUNCHD_TESTS=1 to avoid accidental host-state mutation during routine runs.