@zogien/native-sdk 0.11.0-fork.4 → 0.11.0-fork.5

package/src/platform/windows/webview2_host.cpp

@@ -25,6 +25,7 @@
 #include <cctype>
 #include <climits>
 #include <cmath>
+#include <deque>
 #include <map>
 #include <memory>
 #include <mutex>
@@ -186,21 +187,21 @@ constexpr uint32_t kMenuCommandBase = 0x4000;
 constexpr uint32_t kTrayCommandBase = 0x5000;
 constexpr UINT kNotificationCallbackMessage = WM_APP + 42;
 /* Posted from any thread (effect worker threads) via
- * native_sdk_windows_wake; the window procedure emits kWake on the
- * message loop thread. */
+ * native_sdk_windows_wake; the loop window emits kWake on the message
+ * loop thread. */
 constexpr UINT kWakeMessage = WM_APP + 43;
-/* Posted from any thread via native_sdk_windows_request_frame; the
- * window procedure emits ONE kFrame on the message loop thread. The
- * automation arrival watcher uses it so a queued command wakes an idle
- * frame loop without depending on the 16 ms frame pump. */
+/* Posted from any thread via native_sdk_windows_request_frame; the loop
+ * window emits ONE kFrame on the message loop thread. The automation
+ * arrival watcher uses it so a queued command wakes an idle frame loop
+ * without depending on the 16 ms frame pump. */
 constexpr UINT kRequestFrameMessage = WM_APP + 44;
 /* Posted from Media Foundation worker threads (the audio backend's event
- * pump and source resolver); the window procedure hands the distilled
- * note to audioHandleSessionMessage on the message loop thread. */
+ * pump and source resolver); the loop window hands the distilled note to
+ * audioHandleSessionMessage on the message loop thread. */
 constexpr UINT kAudioSessionMessage = WM_APP + 45;
-/* Posted from the spectrum capture thread every ~40 ms; the window
- * procedure snapshots the analysis bands and emits one SPECTRUM report
- * on the loop thread. A posted message rather than a loop-thread timer
+/* Posted from the spectrum capture thread every ~40 ms; the loop window
+ * snapshots the analysis bands and emits one SPECTRUM report on the loop
+ * thread. A posted message rather than a loop-thread timer
  * on purpose: WM_TIMER is the lowest-priority message and a busy frame
  * loop starves it far below the contract cadence, while posted messages
  * keep their place in the queue. */
@@ -210,6 +211,10 @@ constexpr UINT kAudioSpectrumMessage = WM_APP + 46;
  * menu on a fresh loop turn — the same deferral the macOS host's
  * dispatch_async performs before popUpMenuPositioningItem. */
 constexpr UINT kShowContextMenuMessage = WM_APP + 47;
+/* Posted by queueWebViewEvent when a WebView2 callback queued something
+ * for the app; the loop window delivers the queue on a fresh loop turn,
+ * after the WebView2 callback has returned. */
+constexpr UINT kDeliverWebViewEventsMessage = WM_APP + 48;
 constexpr const char *kAssetVirtualOrigin = "https://native-sdk-app.localhost";
 
 constexpr int kViewWebView = 0;
@@ -370,6 +375,27 @@ struct WindowsMessageDialogOpts {
     size_t tertiary_button_len;
 };
 
+/* An asynchronous dialog request: kind is kDialogOpen, kDialogSave or
+ * kDialogMessage, with the matching options set. */
+struct WindowsDialogRequest {
+    uint64_t id;
+    uint64_t parent_window_id;
+    int kind;
+    const WindowsOpenDialogOpts *open_opts;
+    const WindowsSaveDialogOpts *save_opts;
+    const WindowsMessageDialogOpts *message_opts;
+};
+
+/* A finished asynchronous dialog: outcome is kDialogSelected,
+ * kDialogCancelled or kDialogFailed; paths are newline-joined. */
+struct WindowsDialogResult {
+    uint64_t id;
+    int outcome;
+    int button;
+    size_t count;
+    size_t bytes_written;
+};
+
 using EventCallback = void (*)(void *, const WindowsEvent *);
 using BridgeCallback = void (*)(void *, uint64_t, const char *, size_t, const char *, size_t, const char *, size_t);
 
@@ -608,14 +634,70 @@ struct TrayItem {
     bool enabled = true;
 };
 
+/* Whether the host still exists, for WebView2 completions and events
+ * that arrive after native_sdk_windows_destroy (they hold a weak
+ * reference to this). WebView2 raises every callback on the thread that
+ * created it, the loop thread, so a plain flag is enough: nothing off
+ * the loop thread reads it. */
 struct HostLifetime {
-    std::recursive_mutex mutex;
     bool alive = true;
 };
 
+constexpr int kDialogOpen = 0;
+constexpr int kDialogSave = 1;
+constexpr int kDialogMessage = 2;
+constexpr int kDialogSelected = 0;
+constexpr int kDialogCancelled = 1;
+constexpr int kDialogFailed = 2;
+
+/* One dialog: its options, copied so they outlive the call that passed
+ * them, and for an asynchronous one (native_sdk_windows_request_dialog)
+ * the state its thread shares with the loop and the result it hands
+ * back. */
+struct DialogRequest {
+    uint64_t id = 0;
+    uint64_t parent_window_id = 0;
+    int kind = kDialogOpen;
+    HWND owner = nullptr;
+    std::string title;
+    std::string default_path;
+    std::string default_name;
+    std::string extensions;
+    bool allow_directories = false;
+    bool allow_multiple = false;
+    int style = 0;
+    std::string message;
+    std::string informative_text;
+    std::string primary_button;
+    std::string secondary_button;
+    std::string tertiary_button;
+    /* Under DialogQueue::mutex: the dialog's thread while it runs (zero
+     * before and after), and whether the app asked to close it. */
+    DWORD thread_id = 0;
+    bool cancel_requested = false;
+    /* Written by the dialog's thread before it queues the request. */
+    int outcome = kDialogCancelled;
+    int button = 0;
+    std::vector<std::string> paths;
+};
+
+/* Where dialog threads report. Each asynchronous dialog runs modally on
+ * a thread of its own, owned by its app window, as Chromium's shell
+ * dialogs do: Windows disables the owner while it shows, and the loop
+ * thread keeps pumping timers, wakes and WebView2. The threads hold this
+ * and their request, never the Host, which may be destroyed first. */
+struct DialogQueue {
+    std::mutex mutex;
+    /* Finished requests, oldest first, until poll takes them. */
+    std::deque<std::shared_ptr<DialogRequest>> finished;
+    /* The wake target, cleared when the host retires its loop window. */
+    HWND loop_window = nullptr;
+};
+
 /* App timers (runtime `startTimer`) on the Win32 message loop: each slot
  * owns the SetTimer id kAppTimerIdBase + slot index, scheduled on the
- * first live top-level window so WM_TIMER lands in windowProc. */
+ * host's loop window so WM_TIMER lands in loopWindowProc and closing an
+ * app window never stops one. */
 constexpr size_t kMaxAppTimers = 64;
 constexpr UINT_PTR kAppTimerIdBase = 0x1000;
 /* The 16 ms per-window frame-pump timer (SetTimer id on each top-level
@@ -683,11 +765,21 @@ struct AudioCaptureState {
     std::thread worker;
 };
 
+/* One URL load's hand-over slot. The Media Foundation resolver (worker
+ * thread) leaves the resolved source here and posts a note; the loop
+ * thread collects it, or closes the slot when the load is replaced or
+ * stopped and releases whatever arrives late. The mutex covers only the
+ * hand-over itself, never a call out of the host. */
+struct AudioSourceMailbox {
+    std::mutex mutex;
+    bool open = true;
+    IMFMediaSource *source = nullptr;
+};
+
 /* The app's single audio player (see the audio section further down for
  * the backend rationale). All fields are message-loop-thread state; the
- * lifetime mutex additionally guards `generation` and `source` because
- * the asynchronous URL source resolver hands its result over from a
- * Media Foundation worker thread. */
+ * asynchronous URL source resolver hands its result over through
+ * `resolve_mailbox` instead of writing here. */
 struct AudioState {
     /* Bumped on every load/stop: worker-thread stragglers (resolver
      * completions, retired-session events) carry the generation they
@@ -715,6 +807,7 @@ struct AudioState {
     IMFMediaSource *source = nullptr;
     IMFPresentationClock *clock = nullptr;
     std::shared_ptr<AudioDownloadCancel> download_cancel;
+    std::shared_ptr<AudioSourceMailbox> resolve_mailbox;
 };
 
 /* The one pending app context menu (menus are modal, so one at a time):
@@ -738,6 +831,38 @@ struct PendingContextMenu {
     std::vector<Item> items;
 };
 
+/* A keydown resolved against the app's key bindings, owned so the event
+ * can be emitted after the callback that saw the key has returned. The
+ * match itself happens while the key is current: the modifier state is
+ * read then, and a later turn could see different keys held. */
+struct ShortcutMatch {
+    int kind = 0; // kShortcut, kMenuCommand, or kTrayAction
+    uint64_t window_id = 0;
+    std::string shortcut_id;
+    std::string key;
+    uint32_t modifiers = 0;
+    std::string command;
+    uint32_t tray_item_id = 0;
+};
+
+/* Something a WebView2 callback learned that the app must see, copied out
+ * of the callback's arguments. WebView2 does not support running a nested
+ * message loop or modal UI inside its callbacks, and its other callbacks
+ * cannot run until the current one returns, so app code never runs there:
+ * the callback queues one of these and the loop window delivers it on a
+ * later turn (deliverWebViewEvents). */
+struct DeferredWebViewEvent {
+    enum class Kind { Bridge, Focus, Shortcut, OpenExternal };
+    Kind kind = Kind::Bridge;
+    uint64_t window_id = 0;
+    std::string view_key;
+    std::string label;
+    std::string message;
+    std::string origin;
+    ShortcutMatch shortcut;
+    std::wstring url;
+};
+
 struct Host {
     bool window_drag_initialization_failed = false;
     uint64_t next_window_drag_generation = 1;
@@ -751,11 +876,27 @@ struct Host {
      * means WebView2's own default. */
     bool webview_user_data_folder_resolved = false;
     std::wstring webview_user_data_folder;
+    /* While the loop runs, callback is dispatchEventToRuntime with this
+     * host as its context; it forwards to runtime_callback. */
     EventCallback callback = nullptr;
     void *callback_context = nullptr;
+    EventCallback runtime_callback = nullptr;
+    void *runtime_context = nullptr;
     BridgeCallback bridge_callback = nullptr;
     void *bridge_context = nullptr;
     bool running = false;
+    /* Runtime dispatches on the stack (RuntimeDispatchScope). Above
+     * zero, the runtime queues a new event until the dispatch in
+     * progress commits, so nothing it is handed runs synchronously. */
+    int runtime_dispatch_depth = 0;
+    /* kShutdown has been delivered (or is being delivered). The run
+     * loop's exit and a session end can both reach it, and the app's
+     * stop hook runs exactly once (deliverShutdown). */
+    bool shutdown_delivered = false;
+    /* A session end arrived inside a runtime dispatch: its shutdown is
+     * queued behind that dispatch, and the loop exits once it unwinds
+     * (endSession). */
+    bool session_ending = false;
     std::map<uint64_t, Window> windows;
     std::map<std::string, ChildWebView> webviews;
     std::shared_ptr<WindowsGpuRenderer> gpu_renderer;
@@ -796,9 +937,34 @@ struct Host {
     AudioCaptureState captures[2];
     PendingContextMenu context_menu;
     std::shared_ptr<HostLifetime> lifetime = std::make_shared<HostLifetime>();
+    /* The message loop's own target: a message-only window created with
+     * the host on the loop thread and destroyed with it, so nothing
+     * posted to the loop depends on which app windows are open. Read
+     * from any thread (wake, frame requests), hence atomic; destroy
+     * clears it before tearing the window down. */
+    std::atomic<HWND> loop_window{nullptr};
+    /* A posted kRequestFrameMessage is still queued: requests coalesce
+     * until the loop window takes it. */
+    std::atomic<bool> frame_request_pending{false};
+    /* WebView2 events waiting for the app, in arrival order. One delivery
+     * runs at a time: an event queued while the app is inside an earlier
+     * one (a Bridge command showing a modal dialog) waits for it, the way
+     * WebView2 itself holds later callbacks while one is running. */
+    std::deque<DeferredWebViewEvent> webview_events;
+    bool webview_events_posted = false;
+    bool delivering_webview_events = false;
+    /* WebView2 callbacks currently on the stack; app callbacks run only
+     * at zero (see DeferredWebViewEvent). */
+    int webview_callback_depth = 0;
+    /* Asynchronous dialogs not yet polled, by id (loop thread only), and
+     * the queue their threads report to. */
+    std::map<uint64_t, std::shared_ptr<DialogRequest>> dialogs;
+    std::shared_ptr<DialogQueue> dialog_queue = std::make_shared<DialogQueue>();
 };
 
 static std::string webViewKey(uint64_t window_id, const std::string &label);
+static void cancelDialogsForWindow(Host *host, uint64_t window_id);
+static void cancelAllDialogs(Host *host);
 static void gpuSurfaceRefreshFrameWakeTimer(Host *host);
 static void gpuSurfaceDestroyFrameWakeTimer(Host *host);
 
@@ -865,6 +1031,13 @@ static HWND parentWindow(Host *host) {
     return nullptr;
 }
 
+/* Where loop-bound work goes: posted notes from worker threads and the
+ * app-level timers. Never an app window — those close independently of
+ * the loop, and their timers and queued posts die with them. */
+static HWND loopWindow(Host *host) {
+    return host ? host->loop_window.load(std::memory_order_acquire) : nullptr;
+}
+
 static void copyWideField(wchar_t *dest, size_t dest_len, const std::wstring &value) {
     if (!dest || dest_len == 0) return;
     size_t count = std::min(value.size(), dest_len - 1);
@@ -1767,7 +1940,10 @@ static void showTrayMenu(Host *host, HWND hwnd) {
     PostMessageW(hwnd, WM_NULL, 0, 0);
 }
 
-static bool emitShortcutForWindow(Host *host, const Window *window, WPARAM wparam) {
+/* Resolve a keydown against the app's shortcuts, then its menu and tray
+ * key equivalents. True when a binding claims the key; `out` then holds
+ * the event to emit. */
+static bool matchShortcutForWindow(Host *host, const Window *window, WPARAM wparam, ShortcutMatch *out) {
     if (!host || (host->shortcuts.empty() && host->menus.empty() && host->tray_items.empty())) return false;
     if (!window) return false;
     std::string key = shortcutKeyFromWParam(wparam);
@@ -1779,16 +1955,11 @@ static bool emitShortcutForWindow(Host *host, const Window *window, WPARAM wpara
         for (const Shortcut &shortcut : host->shortcuts) {
             if (shortcut.key != key) continue;
             if (!shortcutModifiersMatch(shortcut.modifiers, allow_implicit_shift)) continue;
-            if (!host->callback) return true;
-            WindowsEvent event = {};
-            event.kind = kShortcut;
-            event.window_id = window->id;
-            event.shortcut_id = shortcut.id.c_str();
-            event.shortcut_id_len = shortcut.id.size();
-            event.shortcut_key = shortcut.key.c_str();
-            event.shortcut_key_len = shortcut.key.size();
-            event.shortcut_modifiers = shortcut.modifiers;
-            host->callback(host->callback_context, &event);
+            out->kind = kShortcut;
+            out->window_id = window->id;
+            out->shortcut_id = shortcut.id;
+            out->key = shortcut.key;
+            out->modifiers = shortcut.modifiers;
             return true;
         }
         /* Menu accelerators dispatch from the same keydown path: a menu
@@ -1801,13 +1972,9 @@ static bool emitShortcutForWindow(Host *host, const Window *window, WPARAM wpara
                 if (item.separator || !item.enabled || item.key.empty()) continue;
                 if (item.key != key) continue;
                 if (!shortcutModifiersMatch(item.modifiers, allow_implicit_shift)) continue;
-                if (!host->callback) return true;
-                WindowsEvent event = {};
-                event.kind = kMenuCommand;
-                event.window_id = window->id;
-                event.command_name = item.command.c_str();
-                event.command_name_len = item.command.size();
-                host->callback(host->callback_context, &event);
+                out->kind = kMenuCommand;
+                out->window_id = window->id;
+                out->command = item.command;
                 return true;
             }
         }
@@ -1818,18 +1985,145 @@ static bool emitShortcutForWindow(Host *host, const Window *window, WPARAM wpara
             if (item.separator || !item.enabled || item.key.empty()) continue;
             if (item.key != key) continue;
             if (!shortcutModifiersMatch(item.modifiers, allow_implicit_shift)) continue;
-            return emitTrayActionForCommandId(host, host->tray_items, item.command_id);
+            out->kind = kTrayAction;
+            out->window_id = window->id;
+            out->tray_item_id = item.id;
+            /* A tray binding claims the key only while someone listens. */
+            return host->callback != nullptr;
         }
     }
     return false;
 }
 
+static void emitShortcutMatch(Host *host, const ShortcutMatch &match) {
+    if (!host || !host->callback) return;
+    WindowsEvent event = {};
+    event.kind = match.kind;
+    if (match.kind == kShortcut) {
+        event.window_id = match.window_id;
+        event.shortcut_id = match.shortcut_id.c_str();
+        event.shortcut_id_len = match.shortcut_id.size();
+        event.shortcut_key = match.key.c_str();
+        event.shortcut_key_len = match.key.size();
+        event.shortcut_modifiers = match.modifiers;
+    } else if (match.kind == kMenuCommand) {
+        event.window_id = match.window_id;
+        event.command_name = match.command.c_str();
+        event.command_name_len = match.command.size();
+    } else {
+        event.tray_item_id = match.tray_item_id;
+    }
+    host->callback(host->callback_context, &event);
+}
+
+static bool emitShortcutForWindow(Host *host, const Window *window, WPARAM wparam) {
+    ShortcutMatch match;
+    if (!matchShortcutForWindow(host, window, wparam, &match)) return false;
+    emitShortcutMatch(host, match);
+    return true;
+}
+
 static bool emitShortcutForHwnd(Host *host, HWND hwnd, WPARAM wparam) {
     return emitShortcutForWindow(host, windowForHwnd(host, hwnd), wparam);
 }
 
-static bool emitShortcutForWindowId(Host *host, uint64_t window_id, WPARAM wparam) {
-    return emitShortcutForWindow(host, windowForId(host, window_id), wparam);
+/* Marks a runtime dispatch on the stack for its duration. */
+struct RuntimeDispatchScope {
+    Host *host;
+    explicit RuntimeDispatchScope(Host *host_in) : host(host_in) { host->runtime_dispatch_depth += 1; }
+    ~RuntimeDispatchScope() { host->runtime_dispatch_depth -= 1; }
+    RuntimeDispatchScope(const RuntimeDispatchScope &) = delete;
+    RuntimeDispatchScope &operator=(const RuntimeDispatchScope &) = delete;
+};
+
+/* host->callback while the loop runs: every event the host emits enters
+ * the runtime here. Once the shutdown is handed over, nothing else
+ * reaches the app, as on macOS and Linux: an event raised by the stop
+ * hook's own work, or by a dialog closing while a session end unwinds a
+ * dispatch, would queue behind the shutdown and arrive after the hook. */
+static void dispatchEventToRuntime(void *context, const WindowsEvent *event) {
+    Host *host = static_cast<Host *>(context);
+    if (host->shutdown_delivered && event->kind != kShutdown) return;
+    RuntimeDispatchScope scope(host);
+    host->runtime_callback(host->runtime_context, event);
+}
+
+/* Marks a WebView2 callback on the stack for its duration. */
+struct WebViewCallbackScope {
+    Host *host;
+    explicit WebViewCallbackScope(Host *host_in) : host(host_in) { host->webview_callback_depth += 1; }
+    ~WebViewCallbackScope() { host->webview_callback_depth -= 1; }
+    WebViewCallbackScope(const WebViewCallbackScope &) = delete;
+    WebViewCallbackScope &operator=(const WebViewCallbackScope &) = delete;
+};
+
+/* Called from WebView2 callbacks: queue the event and make sure a
+ * delivery is posted to the loop window. */
+static void queueWebViewEvent(Host *host, DeferredWebViewEvent event) {
+    host->webview_events.push_back(std::move(event));
+    if (host->webview_events_posted) return;
+    HWND target = loopWindow(host);
+    host->webview_events_posted = target && PostMessageW(target, kDeliverWebViewEventsMessage, 0, 0);
+}
+
+static void deliverWebViewEvent(Host *host, const DeferredWebViewEvent &event) {
+    switch (event.kind) {
+        case DeferredWebViewEvent::Kind::Bridge: {
+            /* Delivered even if the view closed after sending it: the
+             * page sent the message while it was live, and a reply to a
+             * view that is gone is dropped where it is sent. None goes
+             * to an app whose shutdown was handed over. */
+            if (!host->bridge_callback || host->shutdown_delivered) return;
+            RuntimeDispatchScope scope(host);
+            host->bridge_callback(
+                host->bridge_context,
+                event.window_id,
+                event.label.c_str(),
+                event.label.size(),
+                event.message.c_str(),
+                event.message.size(),
+                event.origin.c_str(),
+                event.origin.size());
+            return;
+        }
+        case DeferredWebViewEvent::Kind::Focus: {
+            /* Focus is state, not input: a view that is gone by now has
+             * nothing to report. */
+            if (!host->callback || host->webviews.find(event.view_key) == host->webviews.end()) return;
+            WindowsEvent focused = {};
+            focused.kind = kViewFocused;
+            focused.window_id = event.window_id;
+            focused.view_label = event.label.c_str();
+            focused.view_label_len = event.label.size();
+            host->callback(host->callback_context, &focused);
+            return;
+        }
+        case DeferredWebViewEvent::Kind::Shortcut:
+            emitShortcutMatch(host, event.shortcut);
+            return;
+        case DeferredWebViewEvent::Kind::OpenExternal:
+            /* The shell may show UI of its own (an app picker), which is
+             * why this waits for the loop rather than running inside
+             * NavigationStarting. */
+            ShellExecuteW(nullptr, L"open", event.url.c_str(), nullptr, nullptr, SW_SHOWNORMAL);
+            return;
+    }
+}
+
+/* The loop window's kDeliverWebViewEventsMessage. A delivery that starts
+ * while another is running (the app is inside a modal loop it opened from
+ * an earlier event) leaves the queue to that outer delivery, so the app
+ * sees these events one at a time and in order. */
+static void deliverWebViewEvents(Host *host) {
+    host->webview_events_posted = false;
+    if (host->delivering_webview_events) return;
+    host->delivering_webview_events = true;
+    while (!host->webview_events.empty()) {
+        DeferredWebViewEvent event = std::move(host->webview_events.front());
+        host->webview_events.pop_front();
+        deliverWebViewEvent(host, event);
+    }
+    host->delivering_webview_events = false;
 }
 
 static std::string webViewKey(uint64_t window_id, const std::string &label) {
@@ -3957,8 +4251,7 @@ constexpr WPARAM kAudioNoteBufferingStarted = 6;
 constexpr WPARAM kAudioNoteBufferingStopped = 7;
 constexpr WPARAM kAudioNoteError = 8;
 
-/* Position tick on the first top-level window, outside the app-timer id
- * range; 500 ms is the shared coarse cadence (macOS and the null
+/* Position tick on the loop window, outside the app-timer id range; 500 ms is the shared coarse cadence (macOS and the null
  * platform tick the same), so frame-clock scrubber interpolation
  * behaves identically across hosts. */
 constexpr UINT_PTR kAudioPositionTimerId = 0x3000;
@@ -4081,20 +4374,20 @@ struct AudioSessionEventForwarder final : public IMFAsyncCallback {
     }
 };
 
-/* Completes an asynchronous URL source resolution (worker thread) and
- * hands the media source to the loop thread under the host lifetime
- * mutex; a stale generation — the playback was replaced or stopped
- * mid-resolve — shuts the source down right here instead. */
+/* Completes an asynchronous URL source resolution on a Media Foundation
+ * worker thread. The source goes into its load's mailbox and a note goes
+ * to the loop window; nothing here touches host state. A closed mailbox
+ * (the playback was replaced or stopped mid-resolve) means the source is
+ * shut down right here instead. */
 struct AudioSourceResolveForwarder final : public IMFAsyncCallback {
     LONG refs = 1;
     IMFSourceResolver *resolver = nullptr;
-    Host *host = nullptr;
-    std::shared_ptr<HostLifetime> lifetime;
+    std::shared_ptr<AudioSourceMailbox> mailbox;
     HWND hwnd = nullptr;
     uint64_t generation = 0;
 
-    AudioSourceResolveForwarder(IMFSourceResolver *resolver_in, Host *host_in, std::shared_ptr<HostLifetime> lifetime_in, HWND hwnd_in, uint64_t generation_in)
-        : resolver(resolver_in), host(host_in), lifetime(std::move(lifetime_in)), hwnd(hwnd_in), generation(generation_in) {
+    AudioSourceResolveForwarder(IMFSourceResolver *resolver_in, std::shared_ptr<AudioSourceMailbox> mailbox_in, HWND hwnd_in, uint64_t generation_in)
+        : resolver(resolver_in), mailbox(std::move(mailbox_in)), hwnd(hwnd_in), generation(generation_in) {
         resolver->AddRef();
     }
     ~AudioSourceResolveForwarder() { resolver->Release(); }
@@ -4126,23 +4419,24 @@ struct AudioSourceResolveForwarder final : public IMFAsyncCallback {
         IMFMediaSource *source = nullptr;
         if (SUCCEEDED(hr) && object) object->QueryInterface(kNativeSdkIID_IMFMediaSource, reinterpret_cast<void **>(&source));
         if (object) object->Release();
-        std::lock_guard<std::recursive_mutex> guard(lifetime->mutex);
-        const bool current = lifetime->alive && host->audio.active && host->audio.generation == generation;
-        if (!current) {
-            if (source) {
-                source->Shutdown();
-                source->Release();
+        bool open = false;
+        bool kept = false;
+        {
+            std::lock_guard<std::mutex> guard(mailbox->mutex);
+            open = mailbox->open;
+            if (open && source) {
+                /* Reference transferred to the mailbox. */
+                mailbox->source = source;
+                kept = true;
             }
-            return S_OK;
         }
-        if (!source) {
-            PostMessageW(hwnd, kAudioSessionMessage, kAudioNoteSourceFailed, (LPARAM)generation);
-            return S_OK;
+        if (!kept && source) {
+            source->Shutdown();
+            source->Release();
         }
-        /* Reference transferred; the loop thread attaches or (if it
-         * bumps the generation first) releases it in teardown. */
-        host->audio.source = source;
-        PostMessageW(hwnd, kAudioSessionMessage, kAudioNoteSourceResolved, (LPARAM)generation);
+        /* A destroyed loop window makes this a harmless no-op; a kept
+         * source then stays in the mailbox, which teardown closes. */
+        if (open) PostMessageW(hwnd, kAudioSessionMessage, kept ? kAudioNoteSourceResolved : kAudioNoteSourceFailed, (LPARAM)generation);
         return S_OK;
     }
 };
@@ -4316,7 +4610,7 @@ static void audioStopPositionTimer(Host *host) {
 static void audioStartPositionTimer(Host *host) {
     AudioState &audio = host->audio;
     if (audio.position_timer_armed) return;
-    HWND hwnd = parentWindow(host);
+    HWND hwnd = loopWindow(host);
     if (!hwnd) return;
     if (SetTimer(hwnd, kAudioPositionTimerId, kAudioPositionIntervalMs, nullptr)) {
         audio.timer_hwnd = hwnd;
@@ -4713,7 +5007,7 @@ static void audioSpectrumStartCapture(Host *host) {
     AudioSpectrumState &spectrum = host->spectrum;
     if (spectrum.shared) return;
     if (!audioSpectrumSupported()) return;
-    HWND hwnd = parentWindow(host);
+    HWND hwnd = loopWindow(host);
     if (!hwnd) return;
     spectrum.generation += 1;
     spectrum.shared = std::make_shared<AudioSpectrumShared>();
@@ -4899,7 +5193,6 @@ static void audioCaptureStopAll(Host *host) {
  * letting a straggler finish installs the cache entry the completed
  * play earned. */
 static void audioReleaseSession(Host *host, bool cancel_download) {
-    std::lock_guard<std::recursive_mutex> guard(host->lifetime->mutex);
     AudioState &audio = host->audio;
     audioStopPositionTimer(host);
     audioSpectrumStopCapture(host);
@@ -4926,6 +5219,22 @@ static void audioReleaseSession(Host *host, bool cancel_download) {
         audio.source->Release();
         audio.source = nullptr;
     }
+    if (audio.resolve_mailbox) {
+        /* Close the load's mailbox: a resolution still in flight now
+         * shuts its source down itself, and one that already arrived but
+         * was never collected is released here. */
+        IMFMediaSource *uncollected = nullptr;
+        {
+            std::lock_guard<std::mutex> guard(audio.resolve_mailbox->mutex);
+            audio.resolve_mailbox->open = false;
+            uncollected = audio.resolve_mailbox->source;
+            audio.resolve_mailbox->source = nullptr;
+        }
+        if (uncollected) {
+            uncollected->Shutdown();
+            uncollected->Release();
+        }
+    }
     if (cancel_download && audio.download_cancel) audio.download_cancel->cancelled.store(true);
     const uint64_t generation = audio.generation;
     audio = AudioState{};
@@ -4940,7 +5249,7 @@ static bool audioAttachSession(Host *host) {
     AudioState &audio = host->audio;
     IMFMediaSource *source = audio.source;
     if (!source) return false;
-    HWND hwnd = parentWindow(host);
+    HWND hwnd = loopWindow(host);
     if (!hwnd) return false;
     IMFMediaSession *session = nullptr;
     if (FAILED(MFCreateMediaSession(nullptr, &session)) || !session) return false;
@@ -5105,7 +5414,7 @@ static int audioLoadUrlInternal(Host *host, const std::string &url, const std::s
         }
     }
     if (!audioEnsureMediaFoundation()) return 2;
-    HWND hwnd = parentWindow(host);
+    HWND hwnd = loopWindow(host);
     if (!hwnd) return 2;
     IMFSourceResolver *resolver = nullptr;
     if (FAILED(MFCreateSourceResolver(&resolver)) || !resolver) return 2;
@@ -5115,7 +5424,8 @@ static int audioLoadUrlInternal(Host *host, const std::string &url, const std::s
     /* A fresh stream has no bytes yet: buffering starts true and drops
      * when the session actually starts rolling. */
     audio.buffering = true;
-    AudioSourceResolveForwarder *forwarder = new AudioSourceResolveForwarder(resolver, host, host->lifetime, hwnd, audio.generation);
+    audio.resolve_mailbox = std::make_shared<AudioSourceMailbox>();
+    AudioSourceResolveForwarder *forwarder = new AudioSourceResolveForwarder(resolver, audio.resolve_mailbox, hwnd, audio.generation);
     const HRESULT hr = resolver->BeginCreateObjectFromURL(widen(url).c_str(), MF_RESOLUTION_MEDIASOURCE, nullptr, nullptr, forwarder, nullptr);
     forwarder->Release();
     resolver->Release();
@@ -5170,16 +5480,26 @@ static void audioFailed(Host *host) {
     audioEmitReport(host, kAudioEventFailed, 0, 0, 0, 0);
 }
 
+/* Loop thread, on kAudioNoteSourceResolved: take the resolved source
+ * out of the current load's mailbox. */
+static bool audioCollectResolvedSource(Host *host) {
+    AudioState &audio = host->audio;
+    if (!audio.resolve_mailbox) return false;
+    std::lock_guard<std::mutex> guard(audio.resolve_mailbox->mutex);
+    audio.source = audio.resolve_mailbox->source;
+    audio.resolve_mailbox->source = nullptr;
+    return audio.source != nullptr;
+}
+
 /* Distilled session notes, marshalled from Media Foundation worker
  * threads via PostMessage; loop thread. Stale generations (a replaced
  * or stopped playback's stragglers) are dropped here. */
 static void audioHandleSessionMessage(Host *host, WPARAM note, LPARAM generation) {
-    std::lock_guard<std::recursive_mutex> guard(host->lifetime->mutex);
     AudioState &audio = host->audio;
     if (!audio.active || (uint64_t)generation != audio.generation) return;
     switch (note) {
         case kAudioNoteSourceResolved:
-            if (!audioAttachSession(host)) audioFailed(host);
+            if (!audioCollectResolvedSource(host) || !audioAttachSession(host)) audioFailed(host);
             break;
         case kAudioNoteSourceFailed:
         case kAudioNoteError:
@@ -5685,8 +6005,8 @@ static bool createChildWebView(Host *host, const std::string &key) {
         [host, key, parent, lifetime, generation](HRESULT result, ICoreWebView2Environment *environment) -> HRESULT {
             auto token = lifetime.lock();
             if (!token) return S_OK;
-            std::lock_guard<std::recursive_mutex> guard(token->mutex);
             if (!token->alive) return S_OK;
+            WebViewCallbackScope scope(host);
             auto found = host->webviews.find(key);
             if (found == host->webviews.end() || found->second.hwnd != parent || found->second.window_drag_generation != generation || !IsWindow(parent)) return S_OK;
             if (FAILED(result) || !environment) {
@@ -5702,11 +6022,11 @@ static bool createChildWebView(Host *host, const std::string &key) {
                         if (controller) controller->Close();
                         return S_OK;
                     }
-                    std::lock_guard<std::recursive_mutex> guard(token->mutex);
                     if (!token->alive) {
                         if (controller) controller->Close();
                         return S_OK;
                     }
+                    WebViewCallbackScope scope(host);
                     auto found = host->webviews.find(key);
                     if (found == host->webviews.end() || found->second.window_drag_generation != generation) {
                         if (controller) controller->Close();
@@ -5733,16 +6053,16 @@ static bool createChildWebView(Host *host, const std::string &key) {
                         [host, key, lifetime](ICoreWebView2Controller *, IUnknown *) -> HRESULT {
                             auto token = lifetime.lock();
                             if (!token) return S_OK;
-                            std::lock_guard<std::recursive_mutex> guard(token->mutex);
                             if (!token->alive || !host->callback) return S_OK;
+                            WebViewCallbackScope scope(host);
                             auto focused = host->webviews.find(key);
                             if (focused == host->webviews.end()) return S_OK;
-                            WindowsEvent event = {};
-                            event.kind = kViewFocused;
+                            DeferredWebViewEvent event;
+                            event.kind = DeferredWebViewEvent::Kind::Focus;
                             event.window_id = focused->second.window_id;
-                            event.view_label = focused->second.label.c_str();
-                            event.view_label_len = focused->second.label.size();
-                            host->callback(host->callback_context, &event);
+                            event.view_key = key;
+                            event.label = focused->second.label;
+                            queueWebViewEvent(host, std::move(event));
                             return S_OK;
                         }).Get(), &focus_token);
                     if (found->second.webview) {
@@ -5771,8 +6091,8 @@ static bool createChildWebView(Host *host, const std::string &key) {
                                     [host, key, lifetime, drag_generation](HRESULT result, LPCWSTR) -> HRESULT {
                                         auto token = lifetime.lock();
                                         if (!token) return S_OK;
-                                        std::lock_guard<std::recursive_mutex> guard(token->mutex);
                                         if (!token->alive) return S_OK;
+                                        WebViewCallbackScope scope(host);
                                         auto current = host->webviews.find(key);
                                         if (current == host->webviews.end() || current->second.window_drag_generation != drag_generation) return S_OK;
                                         if (FAILED(result)) {
@@ -5800,8 +6120,8 @@ static bool createChildWebView(Host *host, const std::string &key) {
                                 [host, key, bridge_window_id, bridge_label, lifetime](ICoreWebView2 *, ICoreWebView2WebMessageReceivedEventArgs *args) -> HRESULT {
                                     auto token = lifetime.lock();
                                     if (!token) return S_OK;
-                                    std::lock_guard<std::recursive_mutex> guard(token->mutex);
                                     if (!token->alive || !args || !host->bridge_callback) return S_OK;
+                                    WebViewCallbackScope scope(host);
 
                                     LPWSTR message_bytes = nullptr;
                                     if (FAILED(args->TryGetWebMessageAsString(&message_bytes)) || !message_bytes) return S_OK;
@@ -5821,15 +6141,14 @@ static bool createChildWebView(Host *host, const std::string &key) {
                                             : bridgeOriginForWebViewUrl(source_webview->second, source_url);
                                     }
 
-                                    host->bridge_callback(
-                                        host->bridge_context,
-                                        bridge_window_id,
-                                        bridge_label.c_str(),
-                                        bridge_label.size(),
-                                        message.c_str(),
-                                        message.size(),
-                                        origin.c_str(),
-                                        origin.size());
+                                    DeferredWebViewEvent event;
+                                    event.kind = DeferredWebViewEvent::Kind::Bridge;
+                                    event.window_id = bridge_window_id;
+                                    event.view_key = key;
+                                    event.label = bridge_label;
+                                    event.message = std::move(message);
+                                    event.origin = std::move(origin);
+                                    queueWebViewEvent(host, std::move(event));
                                     return S_OK;
                                 }).Get(), &bridge_token);
                         }
@@ -5839,16 +6158,21 @@ static bool createChildWebView(Host *host, const std::string &key) {
                             [host, accelerator_window_id, lifetime](ICoreWebView2Controller *, ICoreWebView2AcceleratorKeyPressedEventArgs *args) -> HRESULT {
                                 auto token = lifetime.lock();
                                 if (!token) return S_OK;
-                                std::lock_guard<std::recursive_mutex> guard(token->mutex);
                                 if (!token->alive || !args) return S_OK;
+                                WebViewCallbackScope scope(host);
                                 COREWEBVIEW2_KEY_EVENT_KIND kind = COREWEBVIEW2_KEY_EVENT_KIND_KEY_DOWN;
                                 if (FAILED(args->get_KeyEventKind(&kind))) return S_OK;
                                 if (kind != COREWEBVIEW2_KEY_EVENT_KIND_KEY_DOWN && kind != COREWEBVIEW2_KEY_EVENT_KIND_SYSTEM_KEY_DOWN) return S_OK;
                                 UINT virtual_key = 0;
                                 if (FAILED(args->get_VirtualKey(&virtual_key))) return S_OK;
-                                if (emitShortcutForWindowId(host, accelerator_window_id, virtual_key)) {
-                                    args->put_Handled(TRUE);
-                                }
+                                /* Handled is decided now, from the key state
+                                 * of this keydown; the app hears it later. */
+                                DeferredWebViewEvent event;
+                                event.kind = DeferredWebViewEvent::Kind::Shortcut;
+                                if (!matchShortcutForWindow(host, windowForId(host, accelerator_window_id), virtual_key, &event.shortcut)) return S_OK;
+                                args->put_Handled(TRUE);
+                                event.window_id = accelerator_window_id;
+                                queueWebViewEvent(host, std::move(event));
                                 return S_OK;
                             }).Get(), &accelerator_token);
 
@@ -5858,8 +6182,8 @@ static bool createChildWebView(Host *host, const std::string &key) {
                             [host, key, environment_ref, lifetime](ICoreWebView2 *, ICoreWebView2WebResourceRequestedEventArgs *args) -> HRESULT {
                                 auto token = lifetime.lock();
                                 if (!token) return S_OK;
-                                std::lock_guard<std::recursive_mutex> guard(token->mutex);
                                 if (!token->alive || !args) return S_OK;
+                                WebViewCallbackScope scope(host);
                                 auto found = host->webviews.find(key);
                                 if (found == host->webviews.end()) return S_OK;
                                 ComPtr<ICoreWebView2WebResourceRequest> request;
@@ -5880,8 +6204,8 @@ static bool createChildWebView(Host *host, const std::string &key) {
                             [host, key, lifetime](ICoreWebView2 *, ICoreWebView2NavigationStartingEventArgs *args) -> HRESULT {
                                 auto token = lifetime.lock();
                                 if (!token) return S_OK;
-                                std::lock_guard<std::recursive_mutex> guard(token->mutex);
                                 if (!token->alive) return S_OK;
+                                WebViewCallbackScope scope(host);
                                 LPWSTR uri_bytes = nullptr;
                                 if (!args || FAILED(args->get_Uri(&uri_bytes))) return S_OK;
                                 std::wstring uri_wide = uri_bytes ? std::wstring(uri_bytes) : std::wstring();
@@ -5891,7 +6215,10 @@ static bool createChildWebView(Host *host, const std::string &key) {
                                 if (found != host->webviews.end() && isInternalAssetUrl(found->second, uri)) return S_OK;
                                 if (uri.empty() || uri.rfind("about:", 0) == 0 || policyListMatches(host->allowed_origins, uri)) return S_OK;
                                 if (host->external_link_action == 1 && policyListMatches(host->allowed_external_urls, uri)) {
-                                    ShellExecuteW(nullptr, L"open", uri_wide.c_str(), nullptr, nullptr, SW_SHOWNORMAL);
+                                    DeferredWebViewEvent event;
+                                    event.kind = DeferredWebViewEvent::Kind::OpenExternal;
+                                    event.url = uri_wide;
+                                    queueWebViewEvent(host, std::move(event));
                                 }
                                 args->put_Cancel(TRUE);
                                 return S_OK;
@@ -6078,6 +6405,145 @@ static void clampChromelessMaximizedFrame(Host *host, HWND hwnd, WINDOWPOS *pos)
     pos->flags &= ~(SWP_NOMOVE | SWP_NOSIZE);
 }
 
+/* The loop window's procedure: everything marshalled onto the message
+ * loop lands here rather than on an app window, which may close at any
+ * time. Posted messages reach it from nested modal loops (dialogs, menus,
+ * the move/size loop) too, because those dispatch every window message of
+ * the thread; a thread message (PostThreadMessage) would be dropped by
+ * them, and a waitable handle would not be serviced by them at all. */
+static LRESULT CALLBACK loopWindowProc(HWND hwnd, UINT message, WPARAM wparam, LPARAM lparam) {
+    if (message == WM_NCCREATE) {
+        auto *create = reinterpret_cast<CREATESTRUCTW *>(lparam);
+        SetWindowLongPtrW(hwnd, GWLP_USERDATA, reinterpret_cast<LONG_PTR>(create->lpCreateParams));
+    }
+    Host *host = hostFromWindow(hwnd);
+    switch (message) {
+        case kWakeMessage:
+            if (host && host->callback) {
+                WindowsEvent wake = {};
+                wake.kind = kWake;
+                wake.window_id = 1;
+                host->callback(host->callback_context, &wake);
+            }
+            return 0;
+        case kRequestFrameMessage:
+            if (host) {
+                /* Cleared before emitting: a request made while this frame
+                 * runs posts again instead of folding into a finished one. */
+                host->frame_request_pending.store(false, std::memory_order_release);
+                if (host->callback) {
+                    WindowsEvent frame = {};
+                    frame.kind = kFrame;
+                    frame.window_id = 1;
+                    host->callback(host->callback_context, &frame);
+                }
+            }
+            return 0;
+        case kAudioSessionMessage:
+            if (host) audioHandleSessionMessage(host, wparam, lparam);
+            return 0;
+        case kAudioSpectrumMessage:
+            if (host) audioHandleSpectrumMessage(host, wparam);
+            return 0;
+        case kDeliverWebViewEventsMessage:
+            if (host) deliverWebViewEvents(host);
+            return 0;
+        case WM_TIMER:
+            if (host && handleAppTimerMessage(host, wparam)) return 0;
+            if (host && handleAudioTimerMessage(host, wparam)) return 0;
+            return 0;
+        default:
+            break;
+    }
+    return DefWindowProcW(hwnd, message, wparam, lparam);
+}
+
+static HWND createLoopWindow(Host *host) {
+    static bool registered = false;
+    if (!registered) {
+        WNDCLASSEXW wc = {};
+        wc.cbSize = sizeof(wc);
+        wc.lpfnWndProc = loopWindowProc;
+        wc.hInstance = host->instance;
+        wc.lpszClassName = L"NativeSdkLoopWindow";
+        registered = RegisterClassExW(&wc) != 0;
+    }
+    return CreateWindowExW(0, L"NativeSdkLoopWindow", L"", 0, 0, 0, 0, 0, HWND_MESSAGE, nullptr, host->instance, host);
+}
+
+/* Deliver the app's shutdown at most once: the run loop's exit (a
+ * last-window close, quitApp) and a session end (endSession) both lead
+ * here, and the runtime's stop hook must run exactly once. */
+static void deliverShutdown(Host *host) {
+    if (host->shutdown_delivered || !host->callback) return;
+    host->shutdown_delivered = true;
+    WindowsEvent shutdown = {};
+    shutdown.kind = kShutdown;
+    shutdown.window_id = 1;
+    host->callback(host->callback_context, &shutdown);
+}
+
+/* Cancel a dialog the app's windows own, directly or through another
+ * dialog (the overwrite prompt a save dialog raises): its modal loop
+ * holds the dispatch that opened it. The enumeration runs top of the
+ * z-order first, so an inner dialog closes before its owner. */
+static BOOL CALLBACK closeOwnedDialog(HWND hwnd, LPARAM lparam) {
+    Host *host = reinterpret_cast<Host *>(lparam);
+    if (!IsWindowVisible(hwnd) || windowForHwnd(host, hwnd)) return TRUE;
+    for (HWND owner = GetWindow(hwnd, GW_OWNER); owner; owner = GetWindow(owner, GW_OWNER)) {
+        if (!windowForHwnd(host, owner)) continue;
+        PostMessageW(hwnd, WM_CLOSE, 0, 0);
+        break;
+    }
+    return TRUE;
+}
+
+/* A confirmed session end (WM_ENDSESSION, wParam TRUE): logoff, system
+ * shutdown or restart, or a Restart Manager close (ENDSESSION_CLOSEAPP)
+ * from an installer that needs the app's files. It is not the user's
+ * close, so close_policy does not apply: a window hidden behind the
+ * tray gets the message like a visible one.
+ *
+ * Every top-level window receives the message, so only the first acts,
+ * and a quit whose shutdown already ran finishes its own teardown.
+ *
+ * Outside any runtime dispatch (the common case) it delivers the same
+ * shutdown event a quit does, synchronously: at logoff or shutdown
+ * Windows may end the process any time after the message returns, so
+ * the stop hook, and the persistence flush and journal seal that run in
+ * the shutdown dispatch, finish first. The process then ends here
+ * instead of returning to the loop. Restart Manager waits for it to
+ * exit and sends WM_CLOSE as soon as this returns, and Windows considers
+ * a process that hides or destroys its windows ready to be killed, so
+ * the regular teardown would stop at an arbitrary point anyway.
+ * Chromium (SessionEnding), Electron, and tao end the process the same
+ * way. The tray icon goes first: the shell keeps a dead process's icon
+ * until the pointer crosses it, and after a Restart Manager close the
+ * session goes on.
+ *
+ * Inside a runtime dispatch (a dialog the app opened is in its modal
+ * loop) the runtime queues the shutdown until that dispatch commits, to
+ * keep events in causal order, so ending the process here would lose
+ * the stop hook. The host lets the dispatch unwind instead: it cancels
+ * the dialogs the app's windows own, ignores further closes, and
+ * returns. The dispatch finishes, the queued shutdown runs the stop
+ * hook, and the loop exits into the regular teardown. A Restart Manager
+ * close waits for that; at logoff or shutdown it races the session
+ * ending after this returns. */
+static void endSession(Host *host) {
+    if (host->shutdown_delivered) return;
+    if (host->runtime_dispatch_depth == 0) {
+        deliverShutdown(host);
+        removeNotificationIcon(host);
+        TerminateProcess(GetCurrentProcess(), 0);
+        return;
+    }
+    host->session_ending = true;
+    deliverShutdown(host);
+    host->running = false;
+    EnumThreadWindows(GetCurrentThreadId(), closeOwnedDialog, reinterpret_cast<LPARAM>(host));
+}
+
 static LRESULT CALLBACK windowProc(HWND hwnd, UINT message, WPARAM wparam, LPARAM lparam) {
     if (message == WM_NCCREATE) {
         auto *create = reinterpret_cast<CREATESTRUCTW *>(lparam);
@@ -6210,28 +6676,6 @@ static LRESULT CALLBACK windowProc(HWND hwnd, UINT message, WPARAM wparam, LPARA
         }
     }
     switch (message) {
-        case kWakeMessage:
-            if (host) {
-                WindowsEvent wake = {};
-                wake.kind = kWake;
-                wake.window_id = 1;
-                if (host->callback) host->callback(host->callback_context, &wake);
-            }
-            return 0;
-        case kRequestFrameMessage:
-            if (host) {
-                WindowsEvent frame = {};
-                frame.kind = kFrame;
-                frame.window_id = 1;
-                if (host->callback) host->callback(host->callback_context, &frame);
-            }
-            return 0;
-        case kAudioSessionMessage:
-            if (host) audioHandleSessionMessage(host, wparam, lparam);
-            return 0;
-        case kAudioSpectrumMessage:
-            if (host) audioHandleSpectrumMessage(host, wparam);
-            return 0;
         case kShowContextMenuMessage:
             if (host) showAppContextMenu(host, hwnd);
             return 0;
@@ -6415,8 +6859,6 @@ static LRESULT CALLBACK windowProc(HWND hwnd, UINT message, WPARAM wparam, LPARA
             }
             break;
         case WM_TIMER:
-            if (host && handleAppTimerMessage(host, wparam)) return 0;
-            if (host && handleAudioTimerMessage(host, wparam)) return 0;
             if (host && wparam == kFrameTimerId) {
                 for (auto &entry : host->windows) {
                     if (entry.second.hwnd == hwnd) {
@@ -6472,7 +6914,21 @@ static LRESULT CALLBACK windowProc(HWND hwnd, UINT message, WPARAM wparam, LPARA
         case WM_SYSCOLORCHANGE:
             if (host) emitAppearanceIfChanged(host, false);
             break;
+        case WM_QUERYENDSESSION:
+            /* Always yes: the SDK has no quit veto (close_policy governs
+             * the user's close only). Nothing happens until WM_ENDSESSION
+             * confirms the end; another application may still cancel. */
+            return TRUE;
+        case WM_ENDSESSION:
+            /* wParam FALSE: the session goes on. Nothing was done at the
+             * query, so there is nothing to undo. */
+            if (host && wparam) endSession(host);
+            return 0;
         case WM_CLOSE:
+            /* A session end is unwinding a dispatch (endSession): the
+             * loop exits once it does, so Restart Manager's follow-up
+             * close neither hides nor destroys anything. */
+            if (host && host->session_ending) return 0;
             /* close_policy .hide: the user's close (caption X, Alt+F4)
              * hides the window instead of destroying it — the hwnd and
              * every view stay live, the app keeps running behind its
@@ -6511,6 +6967,7 @@ static LRESULT CALLBACK windowProc(HWND hwnd, UINT message, WPARAM wparam, LPARA
             if (host) {
                 for (auto &entry : host->windows) {
                     if (entry.second.hwnd == hwnd) {
+                        cancelDialogsForWindow(host, entry.first);
                         destroyNativeViewsForWindow(host, entry.first);
                         destroyChildWebViewsForWindow(host, entry.first);
                         entry.second.hwnd = nullptr;
@@ -6652,6 +7109,327 @@ static bool createNativeWindow(Host *host, Window &window) {
     return true;
 }
 
+/* ------------------------------------------------------------- dialogs */
+
+static DialogRequest openDialogSpec(const WindowsOpenDialogOpts *opts) {
+    DialogRequest spec;
+    spec.kind = kDialogOpen;
+    spec.title = slice(opts->title, opts->title_len);
+    spec.default_path = slice(opts->default_path, opts->default_path_len);
+    spec.extensions = slice(opts->extensions, opts->extensions_len);
+    spec.allow_directories = opts->allow_directories != 0;
+    spec.allow_multiple = opts->allow_multiple != 0;
+    return spec;
+}
+
+static DialogRequest saveDialogSpec(const WindowsSaveDialogOpts *opts) {
+    DialogRequest spec;
+    spec.kind = kDialogSave;
+    spec.title = slice(opts->title, opts->title_len);
+    spec.default_path = slice(opts->default_path, opts->default_path_len);
+    spec.default_name = slice(opts->default_name, opts->default_name_len);
+    spec.extensions = slice(opts->extensions, opts->extensions_len);
+    return spec;
+}
+
+static DialogRequest messageDialogSpec(const WindowsMessageDialogOpts *opts) {
+    DialogRequest spec;
+    spec.kind = kDialogMessage;
+    spec.style = opts->style;
+    spec.title = slice(opts->title, opts->title_len);
+    spec.message = slice(opts->message, opts->message_len);
+    spec.informative_text = slice(opts->informative_text, opts->informative_text_len);
+    spec.primary_button = slice(opts->primary_button, opts->primary_button_len);
+    spec.secondary_button = slice(opts->secondary_button, opts->secondary_button_len);
+    spec.tertiary_button = slice(opts->tertiary_button, opts->tertiary_button_len);
+    return spec;
+}
+
+/* Show an open dialog modally on the calling thread, which has COM
+ * initialized. S_OK with the chosen paths, or the failure Show reported
+ * (HRESULT_FROM_WIN32(ERROR_CANCELLED) when the user cancelled). */
+static HRESULT showOpenDialogOn(HWND owner, const DialogRequest &spec, std::vector<std::wstring> *paths) {
+    IFileOpenDialog *dialog = nullptr;
+    HRESULT hr = CoCreateInstance(CLSID_FileOpenDialog, nullptr, CLSCTX_INPROC_SERVER, IID_PPV_ARGS(&dialog));
+    if (FAILED(hr) || !dialog) return FAILED(hr) ? hr : E_FAIL;
+
+    DWORD options = 0;
+    if (SUCCEEDED(dialog->GetOptions(&options))) {
+        options |= FOS_FORCEFILESYSTEM | FOS_PATHMUSTEXIST;
+        if (spec.allow_directories) options |= FOS_PICKFOLDERS;
+        else options |= FOS_FILEMUSTEXIST;
+        if (spec.allow_multiple) options |= FOS_ALLOWMULTISELECT;
+        dialog->SetOptions(options);
+    }
+    setDialogTitle(dialog, spec.title.data(), spec.title.size());
+    setDialogFolder(dialog, spec.default_path.data(), spec.default_path.size());
+    if (!spec.allow_directories) setDialogFilters(dialog, spec.extensions.data(), spec.extensions.size());
+
+    hr = dialog->Show(owner);
+    if (SUCCEEDED(hr)) {
+        IShellItemArray *items = nullptr;
+        if (SUCCEEDED(dialog->GetResults(&items)) && items) {
+            DWORD count = 0;
+            items->GetCount(&count);
+            for (DWORD index = 0; index < count; ++index) {
+                IShellItem *item = nullptr;
+                if (SUCCEEDED(items->GetItemAt(index, &item)) && item) {
+                    PWSTR path = nullptr;
+                    if (SUCCEEDED(item->GetDisplayName(SIGDN_FILESYSPATH, &path)) && path) {
+                        paths->push_back(std::wstring(path));
+                        CoTaskMemFree(path);
+                    }
+                    item->Release();
+                }
+            }
+            items->Release();
+        }
+    }
+    dialog->Release();
+    return hr;
+}
+
+/* The save dialog's counterpart of showOpenDialogOn. */
+static HRESULT showSaveDialogOn(HWND owner, const DialogRequest &spec, std::wstring *path) {
+    IFileSaveDialog *dialog = nullptr;
+    HRESULT hr = CoCreateInstance(CLSID_FileSaveDialog, nullptr, CLSCTX_INPROC_SERVER, IID_PPV_ARGS(&dialog));
+    if (FAILED(hr) || !dialog) return FAILED(hr) ? hr : E_FAIL;
+
+    DWORD options = 0;
+    if (SUCCEEDED(dialog->GetOptions(&options))) dialog->SetOptions(options | FOS_FORCEFILESYSTEM | FOS_PATHMUSTEXIST);
+    setDialogTitle(dialog, spec.title.data(), spec.title.size());
+    setDialogFolder(dialog, spec.default_path.data(), spec.default_path.size());
+    setDialogFilters(dialog, spec.extensions.data(), spec.extensions.size());
+    std::wstring default_name = widen(spec.default_name);
+    if (!default_name.empty()) dialog->SetFileName(default_name.c_str());
+
+    hr = dialog->Show(owner);
+    if (SUCCEEDED(hr)) {
+        IShellItem *item = nullptr;
+        if (SUCCEEDED(dialog->GetResult(&item)) && item) {
+            PWSTR chosen = nullptr;
+            if (SUCCEEDED(item->GetDisplayName(SIGDN_FILESYSPATH, &chosen)) && chosen) {
+                *path = std::wstring(chosen);
+                CoTaskMemFree(chosen);
+            }
+            item->Release();
+        }
+    }
+    dialog->Release();
+    return hr;
+}
+
+/* TaskDialogIndirect is a comctl32 v6 export: it only resolves when the
+ * process activates the v6 side-by-side assembly (application manifest).
+ * A static import would abort the whole process at load time with
+ * STATUS_ENTRYPOINT_NOT_FOUND on the system default v5, so it is resolved
+ * dynamically, and null sends callers to MessageBoxW (fixed button
+ * captions, same 0/1/2 result contract). */
+using TaskDialogIndirectFn = HRESULT(WINAPI *)(const TASKDIALOGCONFIG *, int *, int *, BOOL *);
+
+static TaskDialogIndirectFn taskDialogIndirect() {
+    static TaskDialogIndirectFn task_dialog = reinterpret_cast<TaskDialogIndirectFn>(
+        reinterpret_cast<void *>(GetProcAddress(GetModuleHandleW(L"comctl32.dll"), "TaskDialogIndirect")));
+    return task_dialog;
+}
+
+/* Run a message dialog as a task dialog. *pressed is 100, 101 or 102 for
+ * the primary, secondary or tertiary button, and IDCANCEL when it was
+ * closed without one (Esc, the close button, WM_CLOSE). */
+static HRESULT runTaskDialog(TaskDialogIndirectFn task_dialog, HWND owner, const DialogRequest &spec, int *pressed) {
+    std::wstring title = widen(spec.title);
+    std::wstring message = widen(spec.message);
+    std::wstring informative = widen(spec.informative_text);
+    std::wstring primary = widen(spec.primary_button);
+    std::wstring secondary = widen(spec.secondary_button);
+    std::wstring tertiary = widen(spec.tertiary_button);
+    if (primary.empty()) primary = L"OK";
+
+    TASKDIALOG_BUTTON buttons[3] = {};
+    int button_count = 0;
+    buttons[button_count++] = { 100, primary.c_str() };
+    if (!secondary.empty()) buttons[button_count++] = { 101, secondary.c_str() };
+    if (!tertiary.empty()) buttons[button_count++] = { 102, tertiary.c_str() };
+
+    TASKDIALOGCONFIG config = {};
+    config.cbSize = sizeof(config);
+    config.hwndParent = owner;
+    config.dwFlags = TDF_ALLOW_DIALOG_CANCELLATION;
+    config.pszWindowTitle = title.empty() ? L"native-sdk" : title.c_str();
+    config.pszMainInstruction = message.empty() ? config.pszWindowTitle : message.c_str();
+    config.pszContent = informative.empty() ? nullptr : informative.c_str();
+    config.cButtons = static_cast<UINT>(button_count);
+    config.pButtons = buttons;
+    config.nDefaultButton = 100;
+    config.pszMainIcon = spec.style == 2 ? TD_ERROR_ICON : (spec.style == 1 ? TD_WARNING_ICON : TD_INFORMATION_ICON);
+    *pressed = 100;
+    return task_dialog(&config, pressed, nullptr, nullptr);
+}
+
+/* The comctl32 v5 fallback: MessageBoxW, returning its IDOK-style code
+ * (0 when it failed). messageBoxButton maps that to 0/1/2. */
+static int runMessageBox(HWND owner, const DialogRequest &spec) {
+    const int button_count = 1 + (spec.secondary_button.empty() ? 0 : 1) + (spec.tertiary_button.empty() ? 0 : 1);
+    UINT type = MB_OK;
+    if (button_count == 2) type = MB_OKCANCEL;
+    if (button_count == 3) type = MB_YESNOCANCEL;
+    type |= spec.style == 2 ? MB_ICONERROR : (spec.style == 1 ? MB_ICONWARNING : MB_ICONINFORMATION);
+    std::wstring title = widen(spec.title);
+    std::wstring text = widen(spec.message);
+    std::wstring informative = widen(spec.informative_text);
+    if (!informative.empty()) {
+        if (!text.empty()) text += L"\n\n";
+        text += informative;
+    }
+    return MessageBoxW(owner, text.c_str(), title.empty() ? L"native-sdk" : title.c_str(), type);
+}
+
+static int messageBoxButton(const DialogRequest &spec, int result) {
+    if (!spec.secondary_button.empty() && !spec.tertiary_button.empty()) {
+        if (result == IDNO) return 1;
+        if (result == IDCANCEL) return 2;
+        return 0;
+    }
+    if (result == IDCANCEL) return 1;
+    return 0;
+}
+
+/* The request a dialog thread is running, for dialogCreateHook. */
+thread_local DialogRequest *t_dialog_request = nullptr;
+thread_local DialogQueue *t_dialog_queue = nullptr;
+
+/* A dialog thread's WH_CALLWNDPROC hook: a dialog the app cancelled
+ * before its window existed closes as soon as that window is set up. A
+ * cancel after this point finds the window (cancelDialog). */
+static LRESULT CALLBACK dialogCreateHook(int code, WPARAM wparam, LPARAM lparam) {
+    if (code == HC_ACTION && t_dialog_request && t_dialog_queue) {
+        const CWPSTRUCT *sent = reinterpret_cast<const CWPSTRUCT *>(lparam);
+        if (sent->message == WM_INITDIALOG && (GetWindowLongPtrW(sent->hwnd, GWL_STYLE) & WS_CHILD) == 0) {
+            std::lock_guard<std::mutex> lock(t_dialog_queue->mutex);
+            if (t_dialog_request->cancel_requested) PostMessageW(sent->hwnd, WM_CLOSE, 0, 0);
+        }
+    }
+    return CallNextHookEx(nullptr, code, wparam, lparam);
+}
+
+static void runDialogRequest(DialogRequest &request) {
+    if (request.kind == kDialogOpen || request.kind == kDialogSave) {
+        std::vector<std::wstring> paths;
+        HRESULT hr = S_OK;
+        if (request.kind == kDialogOpen) {
+            hr = showOpenDialogOn(request.owner, request, &paths);
+        } else {
+            std::wstring path;
+            hr = showSaveDialogOn(request.owner, request, &path);
+            if (!path.empty()) paths.push_back(path);
+        }
+        for (const std::wstring &path : paths) {
+            std::string utf8 = narrow(path);
+            if (!utf8.empty()) request.paths.push_back(utf8);
+        }
+        if (SUCCEEDED(hr)) {
+            request.outcome = request.paths.empty() ? kDialogCancelled : kDialogSelected;
+        } else {
+            request.outcome = hr == HRESULT_FROM_WIN32(ERROR_CANCELLED) ? kDialogCancelled : kDialogFailed;
+        }
+        return;
+    }
+    if (TaskDialogIndirectFn task_dialog = taskDialogIndirect()) {
+        int pressed = 100;
+        const HRESULT hr = runTaskDialog(task_dialog, request.owner, request, &pressed);
+        if (FAILED(hr)) {
+            request.outcome = kDialogFailed;
+        } else if (pressed >= 100 && pressed <= 102) {
+            request.outcome = kDialogSelected;
+            request.button = pressed - 100;
+        } else {
+            request.outcome = kDialogCancelled;
+        }
+        return;
+    }
+    const int result = runMessageBox(request.owner, request);
+    if (result == 0) {
+        request.outcome = kDialogFailed;
+    } else {
+        // A message box closed by WM_CLOSE reports a button anyway; one
+        // the app cancelled is no answer.
+        std::lock_guard<std::mutex> lock(t_dialog_queue->mutex);
+        request.outcome = request.cancel_requested ? kDialogCancelled : kDialogSelected;
+        request.button = messageBoxButton(request, result);
+    }
+}
+
+/* A dialog thread: a single-threaded apartment of its own, running the
+ * dialog modally, then queueing the result and waking the loop. */
+static void runDialogThread(std::shared_ptr<DialogQueue> queue, std::shared_ptr<DialogRequest> request) {
+    bool cancel_requested = false;
+    {
+        std::lock_guard<std::mutex> lock(queue->mutex);
+        request->thread_id = GetCurrentThreadId();
+        cancel_requested = request->cancel_requested;
+    }
+    if (!cancel_requested) {
+        bool uninitialize = false;
+        if (initializeCom(&uninitialize)) {
+            t_dialog_request = request.get();
+            t_dialog_queue = queue.get();
+            HHOOK hook = SetWindowsHookExW(WH_CALLWNDPROC, dialogCreateHook, nullptr, GetCurrentThreadId());
+            runDialogRequest(*request);
+            if (hook) UnhookWindowsHookEx(hook);
+            t_dialog_request = nullptr;
+            t_dialog_queue = nullptr;
+            finishCom(uninitialize);
+        } else {
+            request->outcome = kDialogFailed;
+        }
+    }
+    std::lock_guard<std::mutex> lock(queue->mutex);
+    request->thread_id = 0;
+    queue->finished.push_back(request);
+    if (queue->loop_window) PostMessageW(queue->loop_window, kWakeMessage, 0, 0);
+}
+
+/* Posted to every dialog window of a dialog thread, the top one first,
+ * so a save dialog's overwrite prompt closes before the dialog that
+ * raised it. Other top-level windows of the thread (COM's) are left
+ * alone. */
+static BOOL CALLBACK closeDialogWindow(HWND hwnd, LPARAM lparam) {
+    (void)lparam;
+    wchar_t class_name[8] = {};
+    if (GetClassNameW(hwnd, class_name, 8) > 0 && wcscmp(class_name, L"#32770") == 0) PostMessageW(hwnd, WM_CLOSE, 0, 0);
+    return TRUE;
+}
+
+/* Close a dialog early; it reports through its thread like any other
+ * finish. One whose window does not exist yet closes from
+ * dialogCreateHook, and one whose thread has not started never shows. */
+static void cancelDialog(Host *host, DialogRequest &dialog) {
+    DWORD thread_id = 0;
+    {
+        std::lock_guard<std::mutex> lock(host->dialog_queue->mutex);
+        dialog.cancel_requested = true;
+        thread_id = dialog.thread_id;
+    }
+    if (thread_id != 0) EnumThreadWindows(thread_id, closeDialogWindow, 0);
+}
+
+/* A closing window takes its dialogs down with it. */
+static void cancelDialogsForWindow(Host *host, uint64_t window_id) {
+    for (auto &entry : host->dialogs) {
+        if (entry.second->parent_window_id == window_id) cancelDialog(host, *entry.second);
+    }
+}
+
+/* Host teardown: every dialog closes, and the threads finish without the
+ * loop. Results already queued are dropped with the queue. */
+static void cancelAllDialogs(Host *host) {
+    for (auto &entry : host->dialogs) cancelDialog(host, *entry.second);
+    host->dialogs.clear();
+    std::lock_guard<std::mutex> lock(host->dialog_queue->mutex);
+    host->dialog_queue->loop_window = nullptr;
+    host->dialog_queue->finished.clear();
+}
+
 } // namespace
 
 extern "C" {
@@ -6682,6 +7460,20 @@ Host *native_sdk_windows_create(const char *app_name, size_t app_name_len, const
      * RPC_E_CHANGED_MODE (an MTA got there first) leaves nothing to
      * balance. */
     host->com_initialized = SUCCEEDED(CoInitializeEx(nullptr, COINIT_APARTMENTTHREADED | COINIT_DISABLE_OLE1DDE));
+    /* The loop window exists before any app window and for the host's
+     * whole life, so wakes and timers have a target from the start. */
+    HWND loop_window = createLoopWindow(host);
+    if (!loop_window) {
+        const bool com_initialized = host->com_initialized;
+        delete host;
+        if (com_initialized) CoUninitialize();
+        return nullptr;
+    }
+    host->loop_window.store(loop_window, std::memory_order_release);
+    {
+        std::lock_guard<std::mutex> lock(host->dialog_queue->mutex);
+        host->dialog_queue->loop_window = loop_window;
+    }
     /* One hardware Direct2D/DirectWrite resource domain for every canvas
      * child. Creation also requires the in-memory font and constrained
      * fallback seams: without them packet text cannot match engine layout,
@@ -6725,9 +7517,14 @@ Host *native_sdk_windows_create(const char *app_name, size_t app_name_len, const
 void native_sdk_windows_destroy(Host *host) {
     if (!host) return;
     audioCaptureStopAll(host);
-    std::shared_ptr<HostLifetime> lifetime = host->lifetime;
-    std::lock_guard<std::recursive_mutex> guard(lifetime->mutex);
-    lifetime->alive = false;
+    /* Retire the loop window first: a wake or frame request from here on
+     * finds no target and reports that, instead of posting into a queue
+     * nobody will pump again. */
+    HWND loop_window = host->loop_window.exchange(nullptr, std::memory_order_acq_rel);
+    host->lifetime->alive = false;
+    /* Dialog threads outlive the host: close their dialogs and let them
+     * finish on their own; their results have nowhere to go. */
+    cancelAllDialogs(host);
     /* DestroyWindow below dispatches WM_DESTROY/WM_ACTIVATEAPP
      * synchronously through windowProc; the run loop's handler state is
      * already gone by the time destroy is called, so those teardown
@@ -6747,6 +7544,7 @@ void native_sdk_windows_destroy(Host *host) {
     removeNotificationIcon(host);
     destroyAllWindows(host);
     gpuSurfaceDestroyFrameWakeTimer(host);
+    if (loop_window) DestroyWindow(loop_window);
     const bool com_initialized = host->com_initialized;
     delete host;
     if (com_initialized) CoUninitialize();
@@ -6754,14 +7552,16 @@ void native_sdk_windows_destroy(Host *host) {
 
 void native_sdk_windows_run(Host *host, EventCallback callback, void *context) {
     if (!host) return;
-    host->callback = callback;
-    host->callback_context = context;
+    host->runtime_callback = callback;
+    host->runtime_context = context;
+    host->callback = dispatchEventToRuntime;
+    host->callback_context = host;
     host->running = true;
     if (!host->windows.empty()) createNativeWindow(host, host->windows.begin()->second);
     WindowsEvent start = {};
     start.kind = kStart;
     start.window_id = 1;
-    callback(context, &start);
+    host->callback(host->callback_context, &start);
     emitAppearanceIfChanged(host, true);
     for (auto &entry : host->windows) {
         emit(host, entry.second, kResize);
@@ -6786,10 +7586,7 @@ void native_sdk_windows_run(Host *host, EventCallback callback, void *context) {
         DispatchMessageW(&message);
         if (host->running) gpuSurfaceDrainDueFrameEmissions(host);
     }
-    WindowsEvent shutdown = {};
-    shutdown.kind = kShutdown;
-    shutdown.window_id = 1;
-    callback(context, &shutdown);
+    deliverShutdown(host);
 }
 
 void native_sdk_windows_stop(Host *host) {
@@ -6798,30 +7595,30 @@ void native_sdk_windows_stop(Host *host) {
     PostQuitMessage(0);
 }
 
-/* Thread-safe wake: posts kWakeMessage into the message loop, which
- * emits the kWake event on the loop thread. The lifetime mutex guards
- * the window map against concurrent create/destroy. */
-void native_sdk_windows_wake(Host *host) {
-    if (!host) return;
-    std::shared_ptr<HostLifetime> lifetime = host->lifetime;
-    std::lock_guard<std::recursive_mutex> guard(lifetime->mutex);
-    if (!lifetime->alive || !host->running) return;
-    HWND hwnd = parentWindow(host);
-    if (!hwnd) return;
-    PostMessageW(hwnd, kWakeMessage, 0, 0);
+/* Thread-safe wake: posts kWakeMessage to the loop window, which emits
+ * the kWake event on the loop thread. Enqueue-only, as the wake contract
+ * requires (PlatformServices.wake_fn): it takes no lock the loop thread
+ * could be holding, so a thread the loop is joining can always finish
+ * its wake. The host itself outlives every caller — the runtime fences
+ * its wake paths before teardown. Returns 0 when nothing was posted (the
+ * host is being destroyed, or the thread's queue is full). */
+int native_sdk_windows_wake(Host *host) {
+    if (!host) return 0;
+    HWND target = host->loop_window.load(std::memory_order_acquire);
+    return target && PostMessageW(target, kWakeMessage, 0, 0) ? 1 : 0;
 }
 
-/* Thread-safe frame request: posts kRequestFrameMessage into the message
- * loop, which emits one kFrame event on the loop thread — the automation
- * arrival watcher's wake, guarded exactly like native_sdk_windows_wake. */
-void native_sdk_windows_request_frame(Host *host) {
-    if (!host) return;
-    std::shared_ptr<HostLifetime> lifetime = host->lifetime;
-    std::lock_guard<std::recursive_mutex> guard(lifetime->mutex);
-    if (!lifetime->alive || !host->running) return;
-    HWND hwnd = parentWindow(host);
-    if (!hwnd) return;
-    PostMessageW(hwnd, kRequestFrameMessage, 0, 0);
+/* Thread-safe frame request: posts kRequestFrameMessage to the loop
+ * window, which emits one kFrame event on the loop thread — the
+ * automation arrival watcher's wake, enqueue-only like
+ * native_sdk_windows_wake. Requests coalesce while one is queued. */
+int native_sdk_windows_request_frame(Host *host) {
+    if (!host) return 0;
+    if (host->frame_request_pending.exchange(true, std::memory_order_acq_rel)) return 1;
+    HWND target = host->loop_window.load(std::memory_order_acquire);
+    if (target && PostMessageW(target, kRequestFrameMessage, 0, 0)) return 1;
+    host->frame_request_pending.store(false, std::memory_order_release);
+    return 0;
 }
 
 /* Platform image decoder: WIC (Windows Imaging Component) handles PNG,
@@ -7167,7 +7964,7 @@ int native_sdk_windows_create_window(Host *host, uint64_t window_id, const char
 void native_sdk_windows_start_timer(Host *host, uint64_t timer_id, uint64_t interval_ns, int repeats) {
     if (!host) return;
     native_sdk_windows_cancel_timer(host, timer_id);
-    HWND hwnd = parentWindow(host);
+    HWND hwnd = loopWindow(host);
     if (!hwnd) return;
     AppTimer *slot = nullptr;
     UINT_PTR win32_id = 0;
@@ -7932,167 +8729,154 @@ int native_sdk_windows_close_view(Host *host, uint64_t window_id, const char *la
 
 WindowsOpenDialogResult native_sdk_windows_show_open_dialog(Host *host, const WindowsOpenDialogOpts *opts, char *buffer, size_t buffer_len) {
     WindowsOpenDialogResult result = {};
-    if (!host || !opts || !buffer || buffer_len == 0) return result;
+    /* A session end is unwinding the app's dispatch (endSession): a new
+     * dialog would hold it again, so it answers as cancelled. */
+    if (!host || !opts || !buffer || buffer_len == 0 || host->session_ending) return result;
     bool uninitialize = false;
     if (!initializeCom(&uninitialize)) return result;
 
-    IFileOpenDialog *dialog = nullptr;
-    HRESULT hr = CoCreateInstance(CLSID_FileOpenDialog, nullptr, CLSCTX_INPROC_SERVER, IID_PPV_ARGS(&dialog));
-    if (FAILED(hr) || !dialog) {
-        finishCom(uninitialize);
-        return result;
-    }
-
-    DWORD options = 0;
-    if (SUCCEEDED(dialog->GetOptions(&options))) {
-        options |= FOS_FORCEFILESYSTEM | FOS_PATHMUSTEXIST;
-        if (opts->allow_directories) options |= FOS_PICKFOLDERS;
-        else options |= FOS_FILEMUSTEXIST;
-        if (opts->allow_multiple) options |= FOS_ALLOWMULTISELECT;
-        dialog->SetOptions(options);
-    }
-    setDialogTitle(dialog, opts->title, opts->title_len);
-    setDialogFolder(dialog, opts->default_path, opts->default_path_len);
-    if (!opts->allow_directories) setDialogFilters(dialog, opts->extensions, opts->extensions_len);
-
-    if (SUCCEEDED(dialog->Show(parentWindow(host)))) {
-        IShellItemArray *items = nullptr;
-        if (SUCCEEDED(dialog->GetResults(&items)) && items) {
-            DWORD count = 0;
-            items->GetCount(&count);
-            size_t offset = 0;
-            size_t written_count = 0;
-            for (DWORD index = 0; index < count; ++index) {
-                IShellItem *item = nullptr;
-                if (SUCCEEDED(items->GetItemAt(index, &item)) && item) {
-                    bool overflow = false;
-                    PWSTR path = nullptr;
-                    if (SUCCEEDED(item->GetDisplayName(SIGDN_FILESYSPATH, &path)) && path) {
-                        overflow = !appendPathToBuffer(buffer, buffer_len, &offset, &written_count, std::wstring(path));
-                        CoTaskMemFree(path);
-                    }
-                    item->Release();
-                    if (overflow) break;
-                }
-            }
-            result.count = written_count;
-            result.bytes_written = offset;
-            items->Release();
+    std::vector<std::wstring> paths;
+    if (SUCCEEDED(showOpenDialogOn(parentWindow(host), openDialogSpec(opts), &paths))) {
+        size_t offset = 0;
+        size_t written_count = 0;
+        for (const std::wstring &path : paths) {
+            if (!appendPathToBuffer(buffer, buffer_len, &offset, &written_count, path)) break;
         }
+        result.count = written_count;
+        result.bytes_written = offset;
     }
 
-    dialog->Release();
     finishCom(uninitialize);
     return result;
 }
 
 size_t native_sdk_windows_show_save_dialog(Host *host, const WindowsSaveDialogOpts *opts, char *buffer, size_t buffer_len) {
-    if (!host || !opts || !buffer || buffer_len == 0) return 0;
+    /* Cancelled during a session end, like the open dialog. */
+    if (!host || !opts || !buffer || buffer_len == 0 || host->session_ending) return 0;
     bool uninitialize = false;
     if (!initializeCom(&uninitialize)) return 0;
 
-    IFileSaveDialog *dialog = nullptr;
-    HRESULT hr = CoCreateInstance(CLSID_FileSaveDialog, nullptr, CLSCTX_INPROC_SERVER, IID_PPV_ARGS(&dialog));
-    if (FAILED(hr) || !dialog) {
-        finishCom(uninitialize);
-        return 0;
-    }
-
-    DWORD options = 0;
-    if (SUCCEEDED(dialog->GetOptions(&options))) dialog->SetOptions(options | FOS_FORCEFILESYSTEM | FOS_PATHMUSTEXIST);
-    setDialogTitle(dialog, opts->title, opts->title_len);
-    setDialogFolder(dialog, opts->default_path, opts->default_path_len);
-    setDialogFilters(dialog, opts->extensions, opts->extensions_len);
-    std::wstring default_name = widen(slice(opts->default_name, opts->default_name_len));
-    if (!default_name.empty()) dialog->SetFileName(default_name.c_str());
-
     size_t written = 0;
-    if (SUCCEEDED(dialog->Show(parentWindow(host)))) {
-        IShellItem *item = nullptr;
-        if (SUCCEEDED(dialog->GetResult(&item)) && item) {
-            PWSTR path = nullptr;
-            if (SUCCEEDED(item->GetDisplayName(SIGDN_FILESYSPATH, &path)) && path) {
-                std::string utf8_path = narrow(std::wstring(path));
-                if (utf8_path.size() > buffer_len) {
-                    written = overflowSize(buffer_len);
-                } else {
-                    written = utf8_path.size();
-                    if (written > 0) memcpy(buffer, utf8_path.data(), written);
-                }
-                CoTaskMemFree(path);
-            }
-            item->Release();
+    std::wstring path;
+    if (SUCCEEDED(showSaveDialogOn(parentWindow(host), saveDialogSpec(opts), &path)) && !path.empty()) {
+        std::string utf8_path = narrow(path);
+        if (utf8_path.size() > buffer_len) {
+            written = overflowSize(buffer_len);
+        } else {
+            written = utf8_path.size();
+            if (written > 0) memcpy(buffer, utf8_path.data(), written);
         }
     }
 
-    dialog->Release();
     finishCom(uninitialize);
     return written;
 }
 
+/* Returns the pressed button (0 primary, 1 secondary, 2 tertiary), or -1
+ * when a session end left the dialog unanswered: it was cancelled to let
+ * the app's dispatch unwind (endSession), or never shown because one is
+ * unwinding. Closing a task dialog otherwise reports the primary button,
+ * which must not stand in for an answer nobody gave. */
 int native_sdk_windows_show_message_dialog(Host *host, const WindowsMessageDialogOpts *opts) {
     if (!host || !opts) return 0;
-    std::wstring title = widen(slice(opts->title, opts->title_len));
-    std::wstring message = widen(slice(opts->message, opts->message_len));
-    std::wstring informative = widen(slice(opts->informative_text, opts->informative_text_len));
-    std::wstring primary = widen(slice(opts->primary_button, opts->primary_button_len));
-    std::wstring secondary = widen(slice(opts->secondary_button, opts->secondary_button_len));
-    std::wstring tertiary = widen(slice(opts->tertiary_button, opts->tertiary_button_len));
-    if (primary.empty()) primary = L"OK";
-
-    TASKDIALOG_BUTTON buttons[3] = {};
-    int button_count = 0;
-    buttons[button_count++] = { 100, primary.c_str() };
-    if (!secondary.empty()) buttons[button_count++] = { 101, secondary.c_str() };
-    if (!tertiary.empty()) buttons[button_count++] = { 102, tertiary.c_str() };
-
-    TASKDIALOGCONFIG config = {};
-    config.cbSize = sizeof(config);
-    config.hwndParent = parentWindow(host);
-    config.dwFlags = TDF_ALLOW_DIALOG_CANCELLATION;
-    config.pszWindowTitle = title.empty() ? L"native-sdk" : title.c_str();
-    config.pszMainInstruction = message.empty() ? config.pszWindowTitle : message.c_str();
-    config.pszContent = informative.empty() ? nullptr : informative.c_str();
-    config.cButtons = static_cast<UINT>(button_count);
-    config.pButtons = buttons;
-    config.nDefaultButton = 100;
-    config.pszMainIcon = opts->style == 2 ? TD_ERROR_ICON : (opts->style == 1 ? TD_WARNING_ICON : TD_INFORMATION_ICON);
-
-    /* TaskDialogIndirect is a comctl32 v6 export: it only resolves when
-     * the process activates the v6 side-by-side assembly (application
-     * manifest). A static import would abort the whole process at load
-     * time with STATUS_ENTRYPOINT_NOT_FOUND on the system default v5, so
-     * resolve it dynamically and fall back to MessageBoxW (fixed button
-     * captions, same 0/1/2 result contract) when only v5 is available. */
-    using TaskDialogIndirectFn = HRESULT(WINAPI *)(const TASKDIALOGCONFIG *, int *, int *, BOOL *);
-    static TaskDialogIndirectFn task_dialog = reinterpret_cast<TaskDialogIndirectFn>(
-        reinterpret_cast<void *>(GetProcAddress(GetModuleHandleW(L"comctl32.dll"), "TaskDialogIndirect")));
-    if (task_dialog) {
+    if (host->session_ending) return -1;
+    const DialogRequest spec = messageDialogSpec(opts);
+    if (TaskDialogIndirectFn task_dialog = taskDialogIndirect()) {
         int pressed = 100;
-        HRESULT hr = task_dialog(&config, &pressed, nullptr, nullptr);
+        HRESULT hr = runTaskDialog(task_dialog, parentWindow(host), spec, &pressed);
+        if (host->session_ending) return -1;
         if (FAILED(hr)) return 0;
         if (pressed == 101) return 1;
         if (pressed == 102) return 2;
         return 0;
     }
-
-    UINT type = MB_OK;
-    if (button_count == 2) type = MB_OKCANCEL;
-    if (button_count == 3) type = MB_YESNOCANCEL;
-    type |= opts->style == 2 ? MB_ICONERROR : (opts->style == 1 ? MB_ICONWARNING : MB_ICONINFORMATION);
-    std::wstring text = message;
-    if (!informative.empty()) {
-        if (!text.empty()) text += L"\n\n";
-        text += informative;
+    const int result = runMessageBox(parentWindow(host), spec);
+    if (host->session_ending) return -1;
+    return messageBoxButton(spec, result);
+}
+
+/* Show a dialog without blocking: it runs on a thread of its own and
+ * reports through native_sdk_windows_poll_dialog_result after a wake.
+ * The owner is the request's window unless something else already
+ * disabled it (another modal on it), as Electron does: this dialog would
+ * otherwise re-enable a window still held by that one when it closes.
+ * Returns 0 when nothing was started. */
+int native_sdk_windows_request_dialog(Host *host, const WindowsDialogRequest *request) {
+    if (!host || !request || request->id == 0 || host->session_ending || host->shutdown_delivered) return 0;
+    if (host->dialogs.count(request->id) != 0) return 0;
+    auto dialog = std::make_shared<DialogRequest>();
+    switch (request->kind) {
+        case kDialogOpen:
+            if (!request->open_opts) return 0;
+            *dialog = openDialogSpec(request->open_opts);
+            break;
+        case kDialogSave:
+            if (!request->save_opts) return 0;
+            *dialog = saveDialogSpec(request->save_opts);
+            break;
+        case kDialogMessage:
+            if (!request->message_opts) return 0;
+            *dialog = messageDialogSpec(request->message_opts);
+            break;
+        default:
+            return 0;
     }
-    const int result = MessageBoxW(parentWindow(host), text.c_str(), title.empty() ? L"native-sdk" : title.c_str(), type);
-    if (button_count == 3) {
-        if (result == IDNO) return 1;
-        if (result == IDCANCEL) return 2;
+    dialog->id = request->id;
+    auto window = host->windows.find(request->parent_window_id);
+    if (request->parent_window_id != 0 && window != host->windows.end() && window->second.hwnd && IsWindowEnabled(window->second.hwnd)) {
+        dialog->owner = window->second.hwnd;
+        dialog->parent_window_id = request->parent_window_id;
+    }
+    try {
+        std::thread(runDialogThread, host->dialog_queue, dialog).detach();
+    } catch (...) {
         return 0;
     }
-    if (result == IDCANCEL) return 1;
-    return 0;
+    host->dialogs[dialog->id] = dialog;
+    return 1;
+}
+
+void native_sdk_windows_cancel_dialog(Host *host, uint64_t id) {
+    if (!host) return;
+    auto found = host->dialogs.find(id);
+    if (found != host->dialogs.end()) cancelDialog(host, *found->second);
+}
+
+/* Hand back the oldest finished dialog. Returns 0 when none is waiting. */
+int native_sdk_windows_poll_dialog_result(Host *host, char *buffer, size_t buffer_len, WindowsDialogResult *result) {
+    if (!host || !result) return 0;
+    std::shared_ptr<DialogRequest> dialog;
+    {
+        std::lock_guard<std::mutex> lock(host->dialog_queue->mutex);
+        if (host->dialog_queue->finished.empty()) return 0;
+        dialog = host->dialog_queue->finished.front();
+        host->dialog_queue->finished.pop_front();
+    }
+    host->dialogs.erase(dialog->id);
+    *result = {};
+    result->id = dialog->id;
+    result->outcome = dialog->outcome;
+    result->button = dialog->button;
+    size_t offset = 0;
+    size_t count = 0;
+    for (const std::string &path : dialog->paths) {
+        const size_t needed = path.size() + (count > 0 ? 1 : 0);
+        if (!buffer || needed > buffer_len - offset) {
+            /* More paths than the runtime holds: a failure, not a
+             * silently shortened selection. */
+            result->outcome = kDialogFailed;
+            offset = 0;
+            count = 0;
+            break;
+        }
+        if (count > 0) buffer[offset++] = '\n';
+        memcpy(buffer + offset, path.data(), path.size());
+        offset += path.size();
+        count += 1;
+    }
+    result->count = count;
+    result->bytes_written = offset;
+    return 1;
 }
 
 int native_sdk_windows_show_notification(Host *host, const char *title, size_t title_len, const char *subtitle, size_t subtitle_len, const char *body, size_t body_len, const char *notification_id, size_t notification_id_len, const char *action_label, size_t action_label_len, const char *action_command, size_t action_command_len) {