Verification for [#21102](https://github.com/pingdotgg/t3code/pull/21102), batch usage-billing-06.

Final head: [cfea66ce57](https://github.com/SunkenInTime/t3code/commit/cfea66ce5786f69626f3ee75d0fe5a86f03fa935).
Base: [5307c233b1](https://github.com/pingdotgg/t3code/commit/5307c233b1f0ae72b8894dd39d94019aaf9e7cb8).
Environment: headless Linux x86_64, Node 24, T3 Code / Codex harness.
All runtime state was disposable; credentials were synthetic. No live developer database was used.

Before:

- Four selected behavioral regressions fail with main's production code: malformed/missing descriptor identity, changed responder before token retry, and wrong-server readiness/recovery. Restoring the PR production code makes those cases pass.
- Persistent HTTP 401/404 collision tests fail on the original implementation because readiness never reaches ownership handling.
- Review exposed two additional failures, each reproduced RED before its fix: child exit before descriptor response loses the collision result; port move during auth retry keeps the old config and mislabels the new owned backend as foreign.

After, exact final-head focused test run:

```
ELECTRON_OVERRIDE_DIST_PATH=/tmp/t3-unit-test-electron pnpm exec vp test run \
  apps/desktop/src/app/DesktopAppErrors.test.ts \
  apps/desktop/src/backend/DesktopBackendManager.test.ts \
  apps/desktop/src/backend/DesktopBackendPool.test.ts \
  apps/desktop/src/backend/DesktopLocalEnvironmentAuth.test.ts \
  apps/desktop/src/ipc/methods/window.test.ts \
  apps/desktop/src/wsl/DesktopWslBackend.test.ts \
  apps/desktop/src/backend/DesktopServerExposure.test.ts \
  apps/server/src/cli/config.test.ts \
  apps/server/src/environment/ServerEnvironment.test.ts \
  apps/web/src/connection/platform.test.ts \
  apps/web/src/connection/desktopLocal.test.ts \
  packages/contracts/src/environment.test.ts \
  packages/contracts/src/ipc.test.ts

Test Files 13 passed (13)
Tests 145 passed (145)
Duration 8.33s
```

Desktop/server/web/contracts typechecks and changed-file lint/format passed. Subsequent changes only touched desktop lifecycle/auth and docs; desktop typecheck and changed-file lint/format passed again after those fixes. No repository-wide checks.

PR-added test cases: original 8 -> reduced 7 -> final 9 across the same three existing files. The two additions cover distinct review-confirmed regressions. No new test files shipped.

Live proof on final head (temporary harness removed before publication):

```
ELECTRON_OVERRIDE_DIST_PATH=/tmp/t3-unit-test-electron pnpm exec vp test run \
  apps/desktop/src/backend/UsageBilling06Live.test.ts

Test Files 1 passed (1)
Tests 4 passed (4)
Duration 10.84s
```

1. Real Node HTTP listeners returned HTML, wrong launch ID, missing ID, HTTP 401 and HTTP 404. For each, real runBackendProcess spawned a disposable Node child; readiness reported portTaken, stopped only that child and never reported ready. Real DesktopLocalEnvironmentAuth returned ForeignServer. Each foreign listener recorded zero token POSTs and remained listening.
2. Real runBackendProcess launched apps/server/src/bin.ts through fd3 with a fresh temporary T3 home and synthetic bootstrap envelope. Readiness matched the launch ID, the environment descriptor echoed it, and real local auth issued a bearer session. Token contents were never printed; scoped cleanup stopped the server and removed state.
3. A real child exited with code 1 before the foreign listener returned its descriptor. The listener withheld its response until onExitObserved. The manager still returned portTaken and did not call onReady for the dead child.
4. Two real HTTP listeners modeled a backend port/launch move. The first token POST returned 503 and updated currentConfig. Request trace was exactly old GET, old POST, new GET, new POST; auth succeeded using the new launch. No token POST went to the old listener after the move.

Limits:

- No packaged Electron, native Windows/macOS, actual Windows localhost relay, WSL distro/process lifecycle, iOS or Android run.
- The pinned-port dialog and real primary/WSL pool port-policy callbacks were inspected, not driven in a real client. Manager port recovery and renderer secondary exchange have focused behavioral tests.
- A foreign response arriving outside the one-second post-exit bound is not guaranteed to classify that run as a collision. 5xx, transport failures and timeouts remain retryable and never permit token delivery.
- The public ID is correlation, not authenticated ownership. Endpoint replacement between descriptor GET and token POST remains possible. Cached bearers remain reused. The legacy renderer primary fallback is unchanged and outside the identity-check claim.