fix(native): wait for bridge sockets after provider readiness

docs/diagrams/native-bridge-startup.mmd

@@ -0,0 +1,23 @@
+---
+title: Native bridge startup
+---
+flowchart TD
+    ready[Guest ready] --> check[Verify provider]
+    check --> inspect[Inspect all sockets]
+    check -->|identity changed| fail[Refuse startup]
+    inspect -->|unsafe identity| fail
+    inspect -->|ready or pending| recheck[Recheck provider]
+    recheck -->|identity changed| fail
+    recheck --> deadline{Before 10 seconds?}
+    deadline -->|no| fail
+    deadline -->|yes| complete{All sockets private?}
+    complete -->|no| wait[Wait up to 50ms]
+    wait --> check
+    complete -->|yes| audit[Full audit then adoption]
+    fail --> stop[Verified provider stop]
+    stop --> retained[Retain failure evidence]
+    class ready,check,inspect,recheck live
+    class wait wait
+    class audit ok
+    class fail fail
+    class retained idle

docs/guides/native-candidate.md

@@ -699,6 +699,31 @@ within the macOS length limit. A clean `runtime down` keeps this alias, so no ot
 local user can take its name while the pool is stopped. It removes only the provider
 socket files the stop proved closed, through the real data directory.
 
+On a fresh pool boot or a boot after stopping the pool, native waits up to 10 seconds
+for every declared bridge socket to appear with the required private ownership and mode.
+The provider's guest-ready signal can arrive before its bridge threads bind. Native
+rechecks the same provider identity around each observation; it never accepts an unsafe
+socket, changes its permissions or removes it to make startup pass. Existing running-pool
+audits do not wait. A socket timeout or identity refusal takes the verified failed-boot
+stop path and names the recovery command. Use the same selected executor and identical
+`--candidate-root` argument as the failed start, followed by `runtime recover --json`.
+If you explicitly selected an installed executor with `HACK_NATIVE_BINARY` and
+`HACK_NATIVE_HOME`, use those same non-empty values:
+
+```sh
+"$HACK_NATIVE_BINARY" --candidate-root "$HACK_NATIVE_HOME" runtime recover --json
+```
+
+Otherwise use the bundled executor path and the selected home from the failed
+invocation; do not run this variable-based example with either variable unset.
+
+For a checkout-local executor, `--candidate-root` is the source checkout, not the native
+home or `.hack-local` directory; from that checkout run `./hack-local runtime recover --json`.
+Provider-verification failures during the wait carry this guidance too; recovery still
+independently proves ownership before stopping anything. Then retry. This preserves
+retained disks and records an unclean stop; it does not claim the guest shut down cleanly.
+`hack down` may say the project was not started because no project mapping was published.
+
 Host cleanup or a reboot can still remove the alias. For a clean stop, observation
 commands such as `runtime status` accept the absent alias and create nothing, and the
 next `runtime up`, `runtime recover` or approved-host update restores the exact alias