fix(runtime): preserve listener startup permission diagnostics

[hhyykk]

Goal And Delivered Outcome

A managed Effect daemon that cannot bind its loopback listener exits with an unhandled Node error. The Python launcher then reports runtime_exited_before_ready, retries permission denials, and directs start-goal callers toward reinstalling LoopX.

The listener now publishes the existing safe startup envelope. Permission denials reach EffectRuntimeHostPermissionError, so existing CLI/doctor/quota recovery and no-retry handling apply. Other listener failures retain the shared error classification and existing retry policy. The handler is removed once listening succeeds.

• Observable before → after: real start-goal --guided changes from runtime_exited_before_ready and reinstall guidance to runtime_host_permission_denied and host-approved runtime recovery.
• Intended base: main, starting at 3dd3c550afecfa0c525a34e8744a3cf06774ac94.
• Outcome basis: demonstrated startup defect; no separate issue required.

Author Declaration

• Written by: model_agent — OpenAI Codex, GPT-6 family.
• Specification and revision: no written bug specification; the defect and requested behavior in this PR are the basis. Reuses the existing startup envelope and permission/retry boundary at the base revision.

Criterion	Disposition	Symbol / path	Evidence
Preserve safe typed listener failure before readiness	implemented	effect_runtime_server.ts::failListenerStartup	Real daemon with network failure injection
Stop retrying host permission denials before dispatch	implemented	effect_runtime.py::_start_runtime	EPERM/EACCES launch once; non-permission errors keep existing retries
Keep raw error details private and leave no readiness claim	implemented	existing startup envelope and launcher	Synthetic private marker excluded; no locator or startup lock remains

Scope And Continuation

Complete within listener startup classification. No transport, persistence, authority, capability, or configuration changes. Existing error helpers are reused; a larger transport refactor is unnecessary for this repair. Successful managed Goal execution still requires host-approved loopback access; this PR does not remove that environment restriction.

Validation

• Tested revision: a3d74b1b45b0d92d49c11cc2e050e1c5e9d51c15, unchanged.
• Follow-up on a host permitting loopback and child processes resolves the initially disclosed environment blocks. Inputs: synthetic fixtures and real local runtime operations; no model calls.

Check kind	Result	Evidence / limitation
regression_parity	passed	New listener-failure regression: 4 cases failed before the fix and passed afterward; only the network failure is injected
integration	passed	Full listener-startup, host-permission, Node-probe, compile-cache and Effect runtime Python suites: 134 passed; includes real startup, restart, locator publication and request serving
unit / integration	passed	TypeScript error mapping, compile-cache, filesystem I/O and private snapshot suites: 21 passed
static	passed	Control-plane typecheck, Python compilation, diff checks and semantic advisory
static / integration	passed	Full semantic vocabulary drift smoke and loopx check scoped to the three changed files
real_entrypoint	passed	This revision's actual start-goal --guided succeeds on the connected test Goal; prior permission-denied run proved safe diagnostic/recovery projection
integration	passed	loopx canary premerge --from-git-diff --git-diff-base origin/main: 5 direct checks + 10 selected checks, no failures, warnings or advisory failures
static	passed	Ruff on both changed Python files; the declared development tool was installed from its official package index for this follow-up
manual	passed	Code, test and doc guard passes; unchanged head and clean worktree verified

The selected real-runtime suites now qualify both failure and successful serving paths. Hosted CI and exact-head maintainer review remain separate; passing local premerge does not grant merge authority. No merge performed.

Frontend / Visual Evidence

UI impact: none. CLI error classification/recovery changes; no visual surface changed.

Type of Change / LoopX Area

Bug fix and regression test; control plane / host runtime integration.

Technical Direction

Bounded S10 reliability/diagnostics repair under the existing overall roadmap. Does not claim complete operations or long-horizon qualification.

Shared-authority RFC fixture impact

N/A: no authority provider, schema, promotion, or compatibility projection change.

Boundary Checklist

• Public-safe diff and description; no credentials, private Goal state, raw traces, internal links, or local machine paths.
• Related PRs checked; no duplicate maintainer-owned work.
• Three-file, single-purpose repair; UI impact none.
• DCO sign-off included.