# fix\(desktop\): check the backend's launch id before sending the bootstrap token · PR \#21102 · pingdotgg/t3code

[View on GitCafe](https://git.cafe/pingdotgg/t3code/pull/21102)

Repository: [pingdotgg/t3code](https://git.cafe/pingdotgg/t3code)

Visibility: public

State: open

Source repository: Unavailable fork

Source branch: t3/win-16826-backend-ownership

Target branch: main

Head commit: b80f11c49c0920b99f2127f831ac187f25faa796

[Discussion and reviews](https://git.cafe/pingdotgg/t3code/pull/21102)

[Commits](https://git.cafe/pingdotgg/t3code/pull/21102/commits?format=markdown)

[Files changed](https://git.cafe/pingdotgg/t3code/pull/21102/diffs?format=markdown)

## Description

---

A delayed WSL localhost relay can take the port after the desktop scans it. The desktop previously accepted any successful readiness response and could send its bootstrap credential to that other server, leaving startup on an authentication error. Fixes [#16826](https://github.com/pingdotgg/t3code/issues/16826).

Each desktop backend launch now carries a fresh public `desktopLaunchId`. The server echoes it in its descriptor; readiness and each fresh bearer attempt in desktop main compare it before proceeding. The renderer checks the same identity for WSL secondary backends and refreshes topology when it changes. A foreign responder stops only the desktop's spawned child, then the primary or WSL backend selects another port. Explicitly pinned ports report an error and stop instead.

An early child exit waits at most one second for pending ownership resolution before choosing recovery; state-directory ownership errors retain priority. Auth retries refresh the current backend URL, launch ID and credential.

The maintainer rebuild combines readiness and ownership in one GET, handles permanent HTTP errors such as 401/404 as port collisions, and retains retries for 5xx, transport failures and slow cold boots. It removes the extra ownership-error wrapper and replaces duplicate cases with focused coverage across three existing test files. PR-added cases went from eight to seven, then to nine after review exposed early-exit and stale-config regressions. Optional wire fields preserve compatibility with older desktop bootstrap entries and non-desktop servers.

The launch ID detects accidental collisions; it is public correlation metadata, not authenticated ownership. A listener that copies the ID or replaces the endpoint between the descriptor GET and token POST remains outside this protection. Existing cached bearers continue to be reused.

Verification on headless Linux:

- 145 tests passed across 13 focused suites. Four selected regression cases fail with main's production code and pass with this change. Persistent 401/404 collision tests also failed before the rebuild and now pass.
- Desktop, server, web and contracts typechecks, changed-file lint and formatting passed. Independent Opus and Sol reviews completed two rounds; both found no issues on the final head.
- A live HTTP/process harness passed four cases: HTML, wrong-ID, missing-ID, 401 and 404 listeners received zero token POSTs and stayed running while the owned child stopped; a real T3 source server echoed its launch ID and issued a bearer session using a fresh temporary T3 home and synthetic credential. Real HTTP checks also covered a child exiting before the descriptor responded and a port/launch move during auth retry. [Sanitized before/after and live proof](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/8b61bdc3495c8d01/usage-billing-06-proof-final.md).

Not verified: packaged Electron, native Windows or macOS, the actual Windows localhost relay, WSL distro/process lifecycle, iOS or Android. The pinned-port dialog and primary/WSL pool port-policy callbacks were inspected but not driven in a real client. Manager recovery and renderer secondary bootstrap were exercised in focused tests. Screenshots do not establish this nonvisual startup behavior; the previous revision's screenshots are not claimed as current-head proof. Native platform verification and human approval remain for maintainers.

Original implementation and Windows reproduction by @SunkenInTime in [#21102](https://github.com/pingdotgg/t3code/pull/21102).

Maintainer takeover: Codex gpt-6-astra (tests), Codex gpt-6.1-sol (implementation), Claude claude-opus-5-5 and Codex gpt-6-sol (independent reviews), through T3 Code using the Codex and Claude harnesses.