The desktop picks its backend port with a scan, then waited for any HTTP
answer on that port and sent its bootstrap token there. On Windows, WSL's
localhost relay can bind the same 127.0.0.1 port seconds after the scan, so
the token went to a T3 Code service inside WSL, which rejected it with
invalid_credential and the first launch crashed.

Each launch now passes a random desktopLaunchId in the bootstrap envelope and
the backend echoes it in /.well-known/t3/environment. Readiness only accepts a
server that echoes this launch's id. When another server answers, the desktop
stops its backend and restarts it on the next free port (Windows primary,
WSL-only primary and WSL secondary). Local auth checks the id before every
exchange attempt, and the renderer's WSL bootstrap checks it against the
current IPC entry before its exchange. On a mismatch local auth reports
"another server is answering on port N" instead of the generic bootstrap
failure.

The id is public and the check and the POST are separate requests, so this
catches a different server on the port; it is not authenticated ownership.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>