revert(desktop): drop active cache-clear recovery, keep it passive + observable

Reviewer worry: clearing caches on every cooldown could amplify churn on a
wedged device without helping the dominant crash cause (a GPU/V8 CHECK,
exit 0x80000003), i.e. pour oil on the fire. Back the breaker off to
"stop the loop + passive retry": on re-arm it reloads without mutating any
device state and lets a transient fault clear on its own.

The observability added alongside stays: a warn on breaker-open, an info
per recovery attempt, and the bounded recovery-attempt analytics signal
(recovery_attempt: N) so chronic loopers are still visible.

Author: lefarcen

apps/desktop/src/main/runtime.ts

@@ -2404,23 +2404,19 @@ export async function createDesktopRuntime(options: DesktopRuntimeOptions): Prom
     try {
       // Crash-loop breaker open: park on the crash screen instead of reloading a
       // deterministically-crashing renderer. Re-arm once the cooldown has
-      // elapsed with no further crash, then actively recover — clear the HTTP +
-      // V8 code caches (the most common recoverable cause is a corrupt cached
-      // bundle / shader, and this is non-destructive: no cookies or storage) and
-      // fall through for one reload attempt.
+      // elapsed with no further crash, then fall through for one reload attempt.
+      // The retry is intentionally PASSIVE: mutating a wedged device's state
+      // (clearing caches/storage) on every cooldown risked amplifying the churn
+      // without helping a GPU/V8-CHECK crash, so we only stop the loop and let a
+      // transient fault clear on its own. The attempt is still logged + counted
+      // so the recovery is observable.
       if (rendererCrashLoop.isOpen()) {
         if (rendererCrashLoop.rearmIfCooledDown(Date.now())) {
           rendererRecoveryAttempts += 1;
           console.info(
-            "[open-design desktop] renderer crash-loop cooldown elapsed — clearing caches and attempting recovery reload",
+            "[open-design desktop] renderer crash-loop cooldown elapsed — attempting recovery reload",
             { attempt: rendererRecoveryAttempts },
           );
-          try {
-            await window.webContents.session.clearCache();
-            await window.webContents.session.clearCodeCaches({});
-          } catch {
-            // Best-effort: a failed cache clear must not block the reload attempt.
-          }
           void reportRendererCrash(options, {
             reason: "recovery-attempt",
             exit_code: null,

apps/desktop/tests/main/renderer-crash-loop.test.ts

@@ -119,13 +119,6 @@ describe("renderer crash-loop breaker wiring", () => {
     expect(runtimeSource).toContain("rearmIfCooledDown(");
   });
 
-  test("recovery actively clears caches before the retry reload", () => {
-    // A passive reload alone can't escape a corrupt-cache crash, so the re-arm
-    // path clears the HTTP + V8 code caches (non-destructive) first.
-    expect(runtimeSource).toContain("session.clearCache()");
-    expect(runtimeSource).toContain("clearCodeCaches(");
-  });
-
   test("breaker open and recovery attempts are observable via logs + bounded telemetry", () => {
     // A wedged device must be diagnosable: one warn on open, one info per
     // recovery attempt, and a bounded recovery-attempt analytics signal.