A failed descriptor open stopped the backend but left no recovery path.
Keep ownership of the ready relaunch waiter, cancel it on failure,
and restore only after backend teardown begins. Preserve cleanup errors.
Primary and pooled stops retain failed child handles for retry.
Replacement stays blocked until the prior process exits, including
while a persistent ownership claim is pending. Successful handoff keeps
the update gate closed while the application quits.
Verified: 178 focused tests passed with eight host skips. Both desktop
typechecks and lint passed. Tests use real disposable children and
real strategy/registration owners with external apply edges intercepted.
No installed app, native signed update, or full desktop build was run.
a157b81b9a