[Bug]: Backend startup crashes leave desktop blank with no visible error

[chrisdeeming]

Before submitting

• I searched existing issues and did not find a duplicate of this specific failure.
• I included enough detail to reproduce or investigate the problem.

Area

apps/desktop

Steps to reproduce

1. Launch desktop with a backend that fails during startup (observed: a missing SQLite column).
2. The backend exits repeatedly before it can serve the renderer.

Expected behavior

Show a backend-independent startup error with the failure reason and a way to retry or open/copy logs.

Actual behavior

Completely black window. Electron DevTools has no useful error; Network shows a failed t3code://app request. Restarting/reinstalling does not explain the failure.

Production serves the initial UI through the backend. DesktopWindow.ts swallows loadURL() rejection and only logs did-fail-load; backend restart handling keeps retrying without a visible terminal failure state. Frontend error handling cannot run because the page never loads.

Related: #9239 reports a Linux credential-store startup stall; this is a confirmed backend process crash on macOS.

Impact

Blocks work completely

Version or commit

0.0.39 and 0.0.40-nightly.20260907.1346

Environment

macOS 26.6.2 (also occurred before the macOS update), Electron desktop.

Logs or stack traces

Error: no such column: branch_pull_request_json
backend child exits with code=1
ECONNREFUSED 127.0.0.1:3773

The database error is a separate cause; this issue concerns the absence of visible diagnostics when startup fails.

[juliusmarminge]

Triage

Confirmed. This is a real desktop bug: when the local backend child dies before (or while) serving the renderer, production shows a blank window and never surfaces the failure.

This is not a duplicate of #9239. That issue is a Linux credential-store stall. This report is a confirmed backend process crash on macOS (code=1, ECONNREFUSED), with a failed t3code://app load.

What the code does today

Production serves the first UI through the backend (t3code:// → backend in apps/desktop/src/electron/ElectronProtocol.ts). The main window is created after HTTP readiness, then loadURL("t3code://app/").

In DesktopWindow.ts:

• loadURL() rejection is swallowed (catch(() => undefined)).
• did-fail-load only logs.
• Automatic reload retries are development-only.
• The connecting splash is a backend-independent data URL, but it is WSL-only.

In DesktopBackendManager.ts, an unexpected child exit schedules an unbounded restart (backend exited unexpectedly; restart scheduled). The existing terminal UI (onPreflightFailed / showErrorBox) covers WSL preflight and Electron-main bootstrap only — not a crash-looping primary child. handleBackendNotReady clears a latch; it does not replace the blank page.

Frontend error handling cannot run because the page never loads. The child reason is already written to server-child.log; the window never shows it.

Related

• [Bug]: T3 Code opens a blank window when the Linux credential store is locked #9239 / fix(desktop): app no longer opens a blank window when the Linux credential store is locked #9246 — same blank-window symptom, different cause.
• [Bug]: Failed startup session probe bricks the app — fatal, sticky error in root beforeLoad with no recovery #3513 — sticky error after the renderer loads; opposite gap.
• Colliding migration IDs silently skip migrations; one undecodable event row bricks startup #8896 / fix(server): heal skipped 045 and warn on migration slot collisions #9312 — persistence/migration crash-loops (including no such column) that leave desktop without a usable window. Related trigger class.
• fix(server): link thread PRs without an open client #10101 — added branch_pull_request_json, the column in these logs.

The missing-column crash is a separate cause (likely another skipped/unapplied projection migration). This issue should stay scoped to the missing startup diagnostics.

Suggested fix

Add a main-process, backend-independent terminal failure surface (data-URL page like the WSL splash, or a dialog with Open/Copy logs) when:

1. production main-frame t3code://app fails, or
2. the primary child crash-loops past a bound without staying ready.

Show the last child error, plus Retry and Open/Copy logs. Do not rely on the web error boundary for this path.