mweinbach7/25/2026, 4:48:56 PM

Introduces three related improvements for cold-start and ongoing UX:

**Pending preflight status**: Runtime bootstrap (download/install) now surfaces as `status: "pending"` rather than `"blocked"`, so `ready` stays true and the chat composer stays enabled while setup finishes in the background. `turn/start` already queues turns until the server is ready. A new `startupProgressMessage` helper names the current step (e.g. "Downloading the Cowork runtime — 62%.").

**Fingerprint-based runtime integrity cache**: The Cowork runtime is ~2.4 GB / ~38 k files. Hashing it twice per session (startup + per turn) cost up to 128 s on Windows with Defender active. Verification now anchors on a stat fingerprint (path, kind, size, nlink, mtime) written to `<runtime-dir>.verified.json`. Subsequent launches and turns re-stat instead of re-hash unless the fingerprint changes, the signed manifest changes, or `COWORK_RUNTIME_FULL_VERIFY=1` is set. The cache is invalidated and removed when a runtime is replaced, pruned, or rolled back.

**Workspace defaults cold-start sync**: Settings saved while the control session is still connecting no longer show a spurious "Workspace settings not updated" error. Changes are persisted to disk immediately; a `scheduleDeferredControlSync` background job pushes them to the live session once the connection lands.

**Product analytics deduplication**: `DesktopProductAnalyticsService.applyPersistedState` now skips re-initialization when the analytics config hasn't changed, preventing thousands of duplicate log lines per session caused by frequent renderer state saves.

Parentf27d884