Risky behavior now covered

• A crashed Electron renderer is reloaded only while its window can still show it. A close already in flight, a destroyed window or web contents, a clean exit, an in-progress or pending quit, and a second crash inside the 30s cooldown all stay closed instead of starting another load.
• Main-process uncaughtExceptionMonitor failures are appended to desktop-main.log synchronously, and unhandledRejection reasons (including non-Error values) are appended asynchronously, even when Sentry crash reporting is off. Registering the handlers twice does not double-log.

Test files added/updated

• apps/desktop/test/renderer-crash-recovery.test.ts (new)
• apps/desktop/test/main-process-local-error-logging.test.ts (new)
• apps/desktop/electron/services/rendererCrashRecovery.ts (extracted decision used by apps/desktop/electron/main.ts; behavior unchanged)

Why this reduces regression risk

These paths landed in the desktop crash fixes (#349) without direct tests. Reloading a window that is already closing, or dropping the only local trace of a main-process failure when crash reporting is disabled, fails closed in production and is easy to regress. The new tests lock both gates.

Validation

• bun test --isolate on the two new files plus apps/desktop/test/crash-reporting-service.test.ts: 6 pass
• bunx biome check on the touched files: clean
• bun run typecheck: clean