desktop: robust startup + operation logging (portability troubleshooting)

There was essentially no logging — useless for proving the app renders across
different environments. Add real observability:

- tauri-plugin-log -> stdout (so `2>&1 | tee` captures a run) AND a persistent
  file in the app log dir (grabbable after the fact on any machine). Level Info.
- Startup diagnostics: app version, OS/arch, the Linux display/session stack
  (XDG_SESSION_TYPE, desktop, Wayland/X11, GDK_BACKEND), the WebKit render-
  hardening vars actually in effect, resolved log + data dirs, DB open/migrate
  result, and note/label counts.
- log_event command + a frontend logEvent() helper: boot line (data source +
  WebKit user-agent) from main.ts, first-route config/session/destination from
  the router guard, and — via the bridge invoke() wrapper — every failed Tauri
  command named with its error, so a broken basic function is self-identifying.

Task 2040.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FRgehjoz7Yv8LkUfADxACm

desktop/src-tauri/src/lib.rs

@@ -11,21 +11,41 @@ mod local;
 
 #[cfg_attr(mobile, tauri::mobile_entry_point)]
 pub fn run() {
+    use tauri_plugin_log::{Target, TargetKind};
+
     #[cfg(target_os = "linux")]
     harden_linux_webkit_rendering();
 
     tauri::Builder::default()
+        // Logging first, so startup diagnostics (and any setup error) are captured to
+        // stdout AND a persistent file from the very beginning — the basis for
+        // troubleshooting portability across environments.
+        .plugin(
+            tauri_plugin_log::Builder::new()
+                .level(log::LevelFilter::Info)
+                .targets([
+                    Target::new(TargetKind::Stdout),
+                    Target::new(TargetKind::LogDir { file_name: None }),
+                ])
+                .build(),
+        )
         .setup(|app| {
             use tauri::Manager;
+            log_environment(app);
             // The on-device store lives in the platform app-data dir (e.g. Linux
             // ~/.local/share/com.fabledsword.thoughtsync/thoughtsync.db), created on
             // first launch. This is what makes the app work with no server or login.
             let dir = app.path().app_data_dir()?;
             std::fs::create_dir_all(&dir)?;
-            app.manage(local::open(&dir.join("thoughtsync.db"))?);
+            let db_path = dir.join("thoughtsync.db");
+            log::info!("opening local store: {}", db_path.display());
+            let db = local::open(&db_path)?;
+            log::info!("local store ready — {}", local::summary(&db));
+            app.manage(db);
             Ok(())
         })
         .invoke_handler(tauri::generate_handler![
+            log_event,
             integration::integration_status,
             integration::integrate_desktop,
             integration::unintegrate_desktop,
@@ -70,6 +90,59 @@ pub fn run() {
         .expect("error while running the ThoughtSync desktop app");
 }
 
+/// Frontend logging bridge: routes boot milestones and errors from the webview into
+/// the same stdout + file log as the Rust side (see frontend/src/desktop/bridge.ts).
+#[tauri::command]
+fn log_event(level: String, message: String) {
+    match level.as_str() {
+        "error" => log::error!(target: "frontend", "{message}"),
+        "warn" => log::warn!(target: "frontend", "{message}"),
+        "debug" => log::debug!(target: "frontend", "{message}"),
+        _ => log::info!(target: "frontend", "{message}"),
+    }
+}
+
+/// Log the app version and the environment that determines whether the window
+/// renders — the first thing to check when a build works on one machine but not
+/// another.
+fn log_environment(app: &tauri::App) {
+    use tauri::Manager;
+    log::info!(
+        "ThoughtSync desktop v{} starting ({} {})",
+        env!("CARGO_PKG_VERSION"),
+        std::env::consts::OS,
+        std::env::consts::ARCH,
+    );
+    match app.path().app_log_dir() {
+        Ok(d) => log::info!("log directory: {}", d.display()),
+        Err(e) => log::warn!("could not resolve log dir: {e}"),
+    }
+    #[cfg(target_os = "linux")]
+    log_linux_graphics_env();
+}
+
+/// The Linux display + graphics stack, and the WebKit render-hardening vars actually
+/// in effect (set by harden_linux_webkit_rendering, which runs before the logger, so
+/// we report the resulting environment rather than logging from inside it).
+#[cfg(target_os = "linux")]
+fn log_linux_graphics_env() {
+    let v = |k: &str| std::env::var(k).unwrap_or_else(|_| "(unset)".to_string());
+    log::info!(
+        "display: session_type={} desktop={} wayland={} x11={} gdk_backend={}",
+        v("XDG_SESSION_TYPE"),
+        v("XDG_CURRENT_DESKTOP"),
+        v("WAYLAND_DISPLAY"),
+        v("DISPLAY"),
+        v("GDK_BACKEND"),
+    );
+    log::info!(
+        "webkit hardening: dmabuf_disabled={} compositing_disabled={} nv_explicit_sync_disabled={}",
+        v("WEBKIT_DISABLE_DMABUF_RENDERER"),
+        v("WEBKIT_DISABLE_COMPOSITING_MODE"),
+        v("__NV_DISABLE_EXPLICIT_SYNC"),
+    );
+}
+
 /// WebKitGTK's GPU-accelerated rendering (the DMA-BUF renderer + EGL compositing) fails
 /// to initialize on a wide range of Linux GPU/driver/Wayland setups — "Could not create
 /// default EGL display: EGL_BAD_PARAMETER" → a black/blank window. This is a well-known