livedesk 0.1.607 → 0.1.609

package/electron/installer-quit-gate.mjs

@@ -0,0 +1,183 @@
+export const DEFAULT_INSTALLER_QUIT_CONFIRMATION_MS = 1_000;
+
+export const InstallerQuitDecision = Object.freeze({
+  NORMAL: 'normal-quit',
+  HOLD: 'hold-update-quit',
+  BLOCK: 'block-stale-update-quit',
+  ALLOW: 'allow-update-quit'
+});
+
+function normalizeDelay(value) {
+  const milliseconds = Number(value);
+  return Number.isFinite(milliseconds) && milliseconds >= 0
+    ? Math.round(milliseconds)
+    : DEFAULT_INSTALLER_QUIT_CONFIRMATION_MS;
+}
+
+/**
+ * electron-updater reports that it intends to quit before the Windows NSIS
+ * spawn promise has necessarily rejected. This gate holds the first quit for
+ * a short error window without importing Electron, so its race is executable
+ * in a plain Node regression test.
+ */
+export function createInstallerQuitGate({
+  requestQuit,
+  confirmationDelayMs = DEFAULT_INSTALLER_QUIT_CONFIRMATION_MS,
+  setTimer = setTimeout,
+  clearTimer = clearTimeout
+} = {}) {
+  if (typeof requestQuit !== 'function') {
+    throw new TypeError('installer-quit-gate-request-quit-required');
+  }
+
+  const confirmationDelay = normalizeDelay(confirmationDelayMs);
+  let generation = 0;
+  let attempt = null;
+
+  const clearConfirmationTimer = ownedAttempt => {
+    if (!ownedAttempt || ownedAttempt.confirmationTimer === null) return;
+    clearTimer(ownedAttempt.confirmationTimer);
+    ownedAttempt.confirmationTimer = null;
+  };
+
+  const snapshot = () => {
+    if (!attempt) {
+      return {
+        generation,
+        state: 'idle',
+        intentObserved: false,
+        failed: false,
+        firstQuitHeld: false,
+        quitReissueRequested: false,
+        staleQuitBlocked: false,
+        error: ''
+      };
+    }
+    return {
+      generation: attempt.generation,
+      state: attempt.state,
+      intentObserved: attempt.intentObserved,
+      failed: attempt.failed,
+      firstQuitHeld: attempt.firstQuitHeld,
+      quitReissueRequested: attempt.quitReissueRequested,
+      staleQuitBlocked: attempt.staleQuitBlocked,
+      error: attempt.error
+    };
+  };
+
+  const beginInstall = () => {
+    clearConfirmationTimer(attempt);
+    attempt = {
+      generation: ++generation,
+      state: 'preparing',
+      intentObserved: false,
+      failed: false,
+      firstQuitHeld: false,
+      quitReissueRequested: false,
+      staleQuitBlocked: false,
+      error: '',
+      confirmationTimer: null
+    };
+    return attempt.generation;
+  };
+
+  const noteBeforeQuitForUpdate = () => {
+    if (!attempt) return false;
+    attempt.intentObserved = true;
+    if (attempt.failed) {
+      attempt.state = 'failed-update-quit-intent';
+    } else if (!attempt.firstQuitHeld) {
+      attempt.state = 'update-quit-intent';
+    }
+    return true;
+  };
+
+  const failInstall = error => {
+    if (!attempt) return false;
+    attempt.failed = true;
+    attempt.error = String(error?.message || error || 'desktop-update-installer-launch-failed');
+    clearConfirmationTimer(attempt);
+
+    if (attempt.firstQuitHeld && !attempt.quitReissueRequested) {
+      // The updater-owned quit was already intercepted. There is no later quit
+      // to consume, so a user's subsequent normal quit must remain available.
+      attempt.intentObserved = false;
+      attempt.state = 'failed-after-held-quit';
+    } else if (attempt.intentObserved) {
+      // The updater has announced a quit, or our delayed reissue is in flight.
+      // Consume that one stale quit before returning to normal quit handling.
+      attempt.state = 'failed-update-quit-pending';
+    } else {
+      // electron-updater can dispatch its spawn error before its queued
+      // before-quit-for-update event. Retain the failed attempt for that event.
+      attempt.state = 'failed-awaiting-update-quit-intent';
+    }
+    return true;
+  };
+
+  const scheduleConfirmedQuit = ownedAttempt => {
+    if (ownedAttempt.confirmationTimer !== null) return;
+    const fire = () => {
+      ownedAttempt.confirmationTimer = null;
+      if (
+        attempt !== ownedAttempt
+        || ownedAttempt.failed
+        || !ownedAttempt.intentObserved
+        || ownedAttempt.quitReissueRequested
+      ) {
+        return;
+      }
+      ownedAttempt.quitReissueRequested = true;
+      ownedAttempt.state = 'reissuing-update-quit';
+      try {
+        requestQuit();
+      } catch (error) {
+        ownedAttempt.failed = true;
+        ownedAttempt.intentObserved = false;
+        ownedAttempt.error = String(error?.message || error);
+        ownedAttempt.state = 'quit-reissue-failed';
+      }
+    };
+    ownedAttempt.confirmationTimer = setTimer(fire, confirmationDelay);
+    ownedAttempt.confirmationTimer?.unref?.();
+  };
+
+  const handleBeforeQuit = () => {
+    const ownedAttempt = attempt;
+    if (!ownedAttempt?.intentObserved) return InstallerQuitDecision.NORMAL;
+
+    if (ownedAttempt.failed) {
+      ownedAttempt.intentObserved = false;
+      ownedAttempt.staleQuitBlocked = true;
+      ownedAttempt.state = 'failed-update-quit-blocked';
+      return InstallerQuitDecision.BLOCK;
+    }
+
+    if (ownedAttempt.quitReissueRequested) {
+      ownedAttempt.intentObserved = false;
+      ownedAttempt.state = 'update-quit-allowed';
+      return InstallerQuitDecision.ALLOW;
+    }
+
+    if (!ownedAttempt.firstQuitHeld) {
+      ownedAttempt.firstQuitHeld = true;
+      ownedAttempt.state = 'holding-update-quit';
+      scheduleConfirmedQuit(ownedAttempt);
+    }
+    return InstallerQuitDecision.HOLD;
+  };
+
+  const dispose = () => {
+    clearConfirmationTimer(attempt);
+    attempt = null;
+  };
+
+  return {
+    beginInstall,
+    noteBeforeQuitForUpdate,
+    failInstall,
+    handleBeforeQuit,
+    getState: snapshot,
+    dispose
+  };
+}

package/electron/main.mjs

@@ -1,11 +1,12 @@
-import { app, BrowserWindow, clipboard, dialog, ipcMain, Menu, nativeImage, powerMonitor, safeStorage, shell, Tray } from 'electron';
+import { app, autoUpdater as electronAutoUpdater, BrowserWindow, clipboard, dialog, ipcMain, Menu, nativeImage, powerMonitor, safeStorage, shell, Tray } from 'electron';
 import { existsSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { dirname, join, resolve } from 'node:path';
 import { spawn } from 'node:child_process';
 import { createRequire } from 'node:module';
-import { createProductUpdateManager } from './update-manager.mjs';
-import { createRecurringProductUpdateOwner } from './recurring-update-owner.mjs';
+import { createProductUpdateManager } from './update-manager.mjs';
+import { createRecurringProductUpdateOwner } from './recurring-update-owner.mjs';
+import { createInstallerQuitGate, InstallerQuitDecision } from './installer-quit-gate.mjs';
 import { AUTH_REQUEST_TIMEOUT_MS, createPkceAuthorizationUrl, exchangePkceCode, fetchSupabaseUser, parsePkceCallbackUrl, refreshSupabaseSession } from './oauth-pkce.mjs';
 import { getRuntimeAuthEnvironment, resolveDesktopAuthConfig, resolveDesktopBuildFlavor } from './auth-config.mjs';
 import { createBoundedDesktopLogger } from './bounded-desktop-log.mjs';
@@ -40,11 +41,12 @@ import {
   waitForOwnedRuntimeTreeExit,
   waitForPromiseBeforeDeadline
 } from './runtime-process-owner.mjs';
-import {
-  desktopHubTakeoverPublicationConfirmed,
-  resolveDesktopHubTakeoverPending
-} from './runtime-role-transition.mjs';
-import { createDesktopClipboardOwner } from './desktop-clipboard-owner.mjs';
+import {
+  desktopHubTakeoverPublicationConfirmed,
+  resolveDesktopHubTakeoverPending
+} from './runtime-role-transition.mjs';
+import { createDesktopClipboardOwner } from './desktop-clipboard-owner.mjs';
+import { createRuntimeWindowLoadOwner } from './runtime-window-load-owner.mjs';
 
 // Chromium otherwise leaves an out-of-process Audio Service (~80-90 MiB on
 // Windows) alive after the exact Remote Audio owner, AudioContext, worklet,
@@ -155,10 +157,10 @@ let runtimeRestartWindowStartedAt = 0;
 let runtimeRestartTimer = null;
 let runtimeRestartPromise = null;
 let runtimeLaunchStartedAt = 0;
-let runtimeRoleTakeoverPending = process.env.LIVEDESK_ROLE_TAKEOVER === '1';
-let quitSequenceStarted = false;
-let updateInstallSequenceStarted = false;
-let productUpdates = null;
+let runtimeRoleTakeoverPending = process.env.LIVEDESK_ROLE_TAKEOVER === '1';
+let quitSequenceStarted = false;
+let updateInstallSequenceStarted = false;
+let productUpdates = null;
 let recurringProductUpdates = null;
 let pendingOAuth = null;
 let pendingProtocolUrl = '';
@@ -167,11 +169,34 @@ let desktopAuthRefreshTimer = null;
 let desktopSessionRestorePromise = null;
 let lastDesktopResumeRecoveryAt = 0;
 let desktopSessionEpoch = 0;
-let lastKnownDesktopSession = null;
-let desktopClipboardOwner = null;
-const desktopAuthInvalidationGuard = createDesktopAuthInvalidationGuard();
-const FALLBACK_ICON_DATA_URL = `data:image/svg+xml;charset=utf-8,${encodeURIComponent('<svg xmlns="http://www.w3.org/2000/svg" width="32" height="32" viewBox="0 0 32 32" fill="none"><rect x="1" y="1" width="30" height="30" rx="7" fill="#111827"/><g transform="translate(5 5) scale(.785714)"><rect x="2.5" y="4" width="14" height="9" rx="1.5" stroke="#F8FAFC" stroke-width="1.7" opacity=".42"/><path d="M7 16v1.5h5" stroke="#F8FAFC" stroke-width="1.7" stroke-linecap="round" opacity=".42"/><rect x="10.5" y="2.5" width="14" height="9" rx="1.5" stroke="#F8FAFC" stroke-width="1.7" opacity=".62"/><path d="M15 14.5V16h5" stroke="#F8FAFC" stroke-width="1.7" stroke-linecap="round" opacity=".62"/><rect x="6.5" y="8.5" width="15" height="10" rx="1.7" fill="#F8FAFC" fill-opacity=".12" stroke="#F8FAFC" stroke-width="1.9"/><path d="M12 21v1.5H9.5M16 21v1.5h2.5M9.5 22.5h9" stroke="#F8FAFC" stroke-width="1.9" stroke-linecap="round"/></g></svg>')}`;
-const desktopLogger = createBoundedDesktopLogger({ logPath });
+let lastKnownDesktopSession = null;
+let desktopClipboardOwner = null;
+let runtimeWindowLoadOwner = null;
+const desktopAuthInvalidationGuard = createDesktopAuthInvalidationGuard();
+const installerQuitGate = createInstallerQuitGate({
+  requestQuit: () => app.quit()
+});
+const FALLBACK_ICON_DATA_URL = `data:image/svg+xml;charset=utf-8,${encodeURIComponent('<svg xmlns="http://www.w3.org/2000/svg" width="32" height="32" viewBox="0 0 32 32" fill="none"><rect x="1" y="1" width="30" height="30" rx="7" fill="#111827"/><g transform="translate(5 5) scale(.785714)"><rect x="2.5" y="4" width="14" height="9" rx="1.5" stroke="#F8FAFC" stroke-width="1.7" opacity=".42"/><path d="M7 16v1.5h5" stroke="#F8FAFC" stroke-width="1.7" stroke-linecap="round" opacity=".42"/><rect x="10.5" y="2.5" width="14" height="9" rx="1.5" stroke="#F8FAFC" stroke-width="1.7" opacity=".62"/><path d="M15 14.5V16h5" stroke="#F8FAFC" stroke-width="1.7" stroke-linecap="round" opacity=".62"/><rect x="6.5" y="8.5" width="15" height="10" rx="1.7" fill="#F8FAFC" fill-opacity=".12" stroke="#F8FAFC" stroke-width="1.9"/><path d="M12 21v1.5H9.5M16 21v1.5h2.5M9.5 22.5h9" stroke="#F8FAFC" stroke-width="1.9" stroke-linecap="round"/></g></svg>')}`;
+const DESKTOP_RUNTIME_RECOVERY_PAGE_URL = `data:text/html;charset=utf-8,${encodeURIComponent(`<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta http-equiv="Content-Security-Policy" content="default-src 'none'; style-src 'unsafe-inline'">
+  <meta name="viewport" content="width=device-width,initial-scale=1">
+  <title>VuvoDesk Desktop</title>
+  <style>
+    :root { color-scheme: dark; font-family: Inter, ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif; }
+    body { margin: 0; min-height: 100vh; display: grid; place-items: center; background: #0f172a; color: #f8fafc; }
+    main { display: grid; justify-items: center; gap: 18px; padding: 32px; text-align: center; }
+    .mark { width: 42px; height: 42px; border: 3px solid #334155; border-top-color: #38bdf8; border-radius: 999px; animation: spin .9s linear infinite; }
+    h1 { margin: 0; font-size: 22px; font-weight: 650; }
+    p { margin: 0; max-width: 480px; color: #cbd5e1; font-size: 15px; line-height: 1.65; }
+    @keyframes spin { to { transform: rotate(360deg); } }
+  </style>
+</head>
+<body><main><div class="mark" aria-hidden="true"></div><h1>VuvoDesk is reconnecting</h1><p>The service on this computer is starting. This window will reconnect automatically.</p></main></body>
+</html>`)}`;
+const desktopLogger = createBoundedDesktopLogger({ logPath });
 
 function mask(value) {
   return String(value ?? '')
@@ -596,9 +621,11 @@ async function waitForRuntime(options = {}) {
       await new Promise(resolveDelay => setTimeout(resolveDelay, Math.min(200, remainingMs)));
     }
   }
-  log(`runtime identity check timed out; expectedRole=${expectedRole || 'any'}`);
-  return null;
-}
+  if (config.logTimeout !== false) {
+    log(`runtime identity check timed out; expectedRole=${expectedRole || 'any'}`);
+  }
+  return null;
+}
 
 async function stopRuntime() {
   if (runtimeRestartTimer) {
@@ -615,12 +642,18 @@ async function stopRuntime() {
   child.livedeskRuntimeStopDeadline = deadline;
   const operation = (async () => {
     await requestRuntimeShutdown(deadline);
-    const gracefulDeadline = Math.max(
-      Date.now(),
-      deadline - DEFAULT_RUNTIME_FORCED_CLEANUP_RESERVE_MS
-    );
-    await waitForOwnedRuntimeTreeExit(child, { deadline: gracefulDeadline });
-    await drainRuntimeTreeUntilStopped(child, deadline);
+    const gracefulDeadline = Math.max(
+      Date.now(),
+      deadline - DEFAULT_RUNTIME_FORCED_CLEANUP_RESERVE_MS
+    );
+    try {
+      await waitForOwnedRuntimeTreeExit(child, { deadline: gracefulDeadline });
+    } catch (error) {
+      // Preserve the forced-cleanup reserve. A stale ChildProcess terminal
+      // notification must not prevent the exact registered tree drain below.
+      log(`runtime graceful exit wait expired; forcing exact drain: ${error?.message || error}`);
+    }
+    await drainRuntimeTreeUntilStopped(child, deadline);
     if (runtimeChild === child) runtimeChild = null;
     return true;
   })();
@@ -669,32 +702,56 @@ function requestRuntimeRestart(source = 'manual') {
 async function prepareRuntimeForUpdateInstall() {
   if (updateInstallSequenceStarted) {
     throw new Error('desktop-update-install-already-started');
-  }
-  updateInstallSequenceStarted = true;
+  }
+  updateInstallSequenceStarted = true;
+  installerQuitGate.beginInstall();
   isQuitting = true;
   recurringProductUpdates?.stop();
   try {
     await quiesceDesktopAuthOwner('desktop-update-install');
     await stopRuntime();
   } catch (error) {
+    installerQuitGate.failInstall(error);
     updateInstallSequenceStarted = false;
     isQuitting = false;
     scheduleDesktopAuthRefresh(readEncryptedSession());
+    let recoveryError = null;
+    try {
+      const ready = await restartRuntimeProcess();
+      if (!ready) throw new Error('desktop-update-runtime-recovery-not-ready');
+    } catch (cause) {
+      recoveryError = cause;
+      log(`desktop update preparation recovery failed: ${cause?.message || cause}`);
+    }
+    if (!recoveryError) {
+      recurringProductUpdates?.start();
+    }
+    if (recoveryError) {
+      throw new Error(
+        `desktop-update-preinstall-recovery-failed:${recoveryError?.message || recoveryError}`,
+        { cause: error }
+      );
+    }
     throw error;
   }
-}
-
-async function recoverRuntimeAfterUpdateInstallError(error) {
-  log(`desktop update install launch failed after runtime drain: ${error?.message || error}`);
+}
+
+async function recoverRuntimeAfterUpdateInstallError(error) {
+  // electron-updater can report a Windows installer spawn failure just before
+  // its queued app.quit(). Seal that exact update quit before restarting.
+  installerQuitGate.failInstall(error);
+  log(`desktop update install launch failed after runtime drain: ${error?.message || error}`);
   updateInstallSequenceStarted = false;
   isQuitting = false;
   scheduleDesktopAuthRefresh(readEncryptedSession());
-  if (!runtimeChild) {
-    startRuntime();
-    const ready = await waitForRuntime();
-    if (ready) mainWindow?.loadURL(LOCAL_RUNTIME_URL);
-  }
-}
+  if (!runtimeChild) startRuntime();
+  const ready = await waitForRuntime();
+  if (!ready) {
+    throw new Error('desktop-update-runtime-recovery-not-ready', { cause: error });
+  }
+  mainWindow?.loadURL(LOCAL_RUNTIME_URL);
+  recurringProductUpdates?.start();
+}
 
 async function syncSessionToRuntime(session) {
   const normalized = normalizeSession(session);
@@ -1022,25 +1079,28 @@ function updateTray(status = 'Starting') {
   tray.setToolTip(`${APP_NAME} — ${status}`);
 }
 
-function showWindow() {
-  if (!mainWindow) return;
-  if (mainWindow.isMinimized()) mainWindow.restore();
-  mainWindow.show();
+function showWindow() {
+  if (!mainWindow) return;
+  runtimeWindowLoadOwner?.start('window-show');
+  if (mainWindow.isMinimized()) mainWindow.restore();
+  mainWindow.show();
   mainWindow.focus();
   if (!mainWindow.webContents.isDestroyed()) mainWindow.webContents.invalidate();
   requestDesktopResumeAuthRecovery('window-show');
 }
 
-function createMainWindow() {
-  const iconPath = appResource('electron', 'icon.png');
-  Menu.setApplicationMenu(null);
-  mainWindow = new BrowserWindow({
-    width: 1440,
-    height: 960,
-    minWidth: 1080,
-    minHeight: 720,
-    show: false,
-    autoHideMenuBar: true,
+function createMainWindow() {
+  const iconPath = appResource('electron', 'icon.png');
+  Menu.setApplicationMenu(null);
+  runtimeWindowLoadOwner?.stop();
+  const window = new BrowserWindow({
+    width: 1440,
+    height: 960,
+    minWidth: 1080,
+    minHeight: 720,
+    show: false,
+    backgroundColor: '#0f172a',
+    autoHideMenuBar: true,
     title: appWindowTitle(),
     icon: existsSync(iconPath) ? iconPath : nativeImage.createFromDataURL(FALLBACK_ICON_DATA_URL),
     webPreferences: {
@@ -1048,41 +1108,89 @@ function createMainWindow() {
       contextIsolation: true,
       nodeIntegration: false,
       sandbox: true,
-      spellcheck: false
-    }
-  });
-  mainWindow.on('page-title-updated', event => {
-    event.preventDefault();
-    mainWindow?.setTitle(appWindowTitle());
-  });
-  mainWindow.on('focus', () => requestDesktopResumeAuthRecovery('window-focus'));
-  mainWindow.webContents.on('will-navigate', (event, url) => {
-    if (isAllowedRuntimeUrl(url)) return;
-    event.preventDefault();
-    void shell.openExternal(url);
-  });
-  mainWindow.webContents.setWindowOpenHandler(({ url }) => {
-    if (isAllowedRuntimeUrl(url)) return { action: 'allow' };
-    void shell.openExternal(url);
-    return { action: 'deny' };
-  });
-  mainWindow.loadURL(LOCAL_RUNTIME_URL);
-  mainWindow.webContents.on('did-finish-load', () => {
-    void restoreEncryptedSession({ syncRuntime: true }).then(session => {
-      if (desktopSessionIsUsable(session)) sendAuthEvent({ ok: true, session, restored: true });
+      spellcheck: false
+    }
+  });
+  mainWindow = window;
+  let loadFailureCount = 0;
+  const reportWindowLoadFailure = (message, context = {}) => {
+    loadFailureCount += 1;
+    if (loadFailureCount === 1 || loadFailureCount % 10 === 0) {
+      log(`desktop renderer recovery ${message}; failures=${loadFailureCount}; generation=${context.generation || 'event'}; attempt=${context.attempt || 'event'}`);
+    }
+  };
+  const windowLoadOwner = createRuntimeWindowLoadOwner({
+    probeRuntime: () => waitForRuntime({ timeoutMs: 1_000, logTimeout: false }),
+    showRecovery: async () => {
+      if (window.isDestroyed() || window.webContents.isDestroyed()) return;
+      if (window.webContents.getURL() !== DESKTOP_RUNTIME_RECOVERY_PAGE_URL) {
+        await window.loadURL(DESKTOP_RUNTIME_RECOVERY_PAGE_URL);
+      }
+      if (process.env.LIVEDESK_E2E_HEADLESS !== '1') showWindow();
+    },
+    loadRuntime: async () => {
+      if (window.isDestroyed() || window.webContents.isDestroyed()) {
+        throw new Error('desktop-runtime-window-destroyed');
+      }
+      await window.loadURL(LOCAL_RUNTIME_URL);
+    },
+    onLoaded: context => {
+      loadFailureCount = 0;
+      updateTray('Running');
+      log(`desktop renderer loaded current runtime; generation=${context.generation}; attempt=${context.attempt}`);
+      if (process.env.LIVEDESK_E2E_HEADLESS !== '1') showWindow();
+    },
+    onAttemptError: (error, context) => {
+      reportWindowLoadFailure(`${context.phase}: ${error?.message || error}`, context);
+    },
+    retryDelayMs: 1_000
+  });
+  runtimeWindowLoadOwner = windowLoadOwner;
+  window.on('page-title-updated', event => {
+    event.preventDefault();
+    if (!window.isDestroyed()) window.setTitle(appWindowTitle());
+  });
+  window.on('focus', () => requestDesktopResumeAuthRecovery('window-focus'));
+  window.webContents.on('will-navigate', (event, url) => {
+    if (isAllowedRuntimeUrl(url) || url === DESKTOP_RUNTIME_RECOVERY_PAGE_URL) return;
+    event.preventDefault();
+    void shell.openExternal(url);
+  });
+  window.webContents.setWindowOpenHandler(({ url }) => {
+    if (isAllowedRuntimeUrl(url)) return { action: 'allow' };
+    void shell.openExternal(url);
+    return { action: 'deny' };
+  });
+  window.webContents.on('did-fail-load', (_event, errorCode, errorDescription, validatedUrl, isMainFrame) => {
+    if (!isMainFrame || errorCode === -3) return;
+    reportWindowLoadFailure(`main-frame-failed code=${errorCode} url=${validatedUrl || 'unknown'} error=${errorDescription || 'unknown'}`);
+    windowLoadOwner.noteMainFrameFailure(`main-frame-${errorCode}`);
+  });
+  window.webContents.on('render-process-gone', (_event, details) => {
+    reportWindowLoadFailure(`renderer-gone reason=${details?.reason || 'unknown'} exitCode=${details?.exitCode ?? 'unknown'}`);
+    windowLoadOwner.noteRendererGone(`renderer-${details?.reason || 'gone'}`);
+  });
+  window.webContents.on('did-finish-load', () => {
+    if (!isAllowedRuntimeUrl(window.webContents.getURL())) return;
+    void restoreEncryptedSession({ syncRuntime: true }).then(session => {
+      if (desktopSessionIsUsable(session)) sendAuthEvent({ ok: true, session, restored: true });
     }).catch(error => {
-      log(`secure auth session window restore failed: ${error?.message || error}`);
-    });
-  });
-  mainWindow.once('ready-to-show', () => { updateTray('Running'); if (process.env.LIVEDESK_E2E_HEADLESS !== '1') showWindow(); });
-  mainWindow.on('close', event => {
-    if (!isQuitting) {
-      event.preventDefault();
-      mainWindow.hide();
-    }
-  });
-  mainWindow.on('closed', () => { mainWindow = null; });
-}
+      log(`secure auth session window restore failed: ${error?.message || error}`);
+    });
+  });
+  windowLoadOwner.start('window-created');
+  window.on('close', event => {
+    if (!isQuitting) {
+      event.preventDefault();
+      window.hide();
+    }
+  });
+  window.on('closed', () => {
+    windowLoadOwner.stop();
+    if (runtimeWindowLoadOwner === windowLoadOwner) runtimeWindowLoadOwner = null;
+    if (mainWindow === window) mainWindow = null;
+  });
+}
 
 function registerIpc() {
   const handle = (channel, handler) => ipcMain.handle(channel, async (event, ...args) => {
@@ -1221,12 +1329,18 @@ function createTray() {
   updateTray('Starting');
 }
 
-app.on('open-url', (event, url) => {
+app.on('open-url', (event, url) => {
   event.preventDefault();
   if (!isLiveDeskAuthCallbackUrl(url)) return;
   if (app.isReady()) void handleProtocolUrl(url);
   else pendingProtocolUrl = url;
-});
+});
+
+electronAutoUpdater.on('before-quit-for-update', () => {
+  // On Windows this is updater intent, not proof that the asynchronous NSIS
+  // spawn succeeded. The first updater-owned quit is confirmed below.
+  installerQuitGate.noteBeforeQuitForUpdate();
+});
 
 if (!app.requestSingleInstanceLock()) {
   app.quit();
@@ -1237,19 +1351,43 @@ if (!app.requestSingleInstanceLock()) {
     showWindow();
   });
   app.whenReady().then(async () => {
-    app.setAsDefaultProtocolClient('livedesk');
-    removeLegacyStartupEntries();
-    migrateLegacyPlaintextSession();
-    productUpdates = createProductUpdateManager({
-      app,
-      onStatus: status => {
+    app.setAsDefaultProtocolClient('livedesk');
+    removeLegacyStartupEntries();
+    migrateLegacyPlaintextSession();
+    let lastProductUpdateLogSignature = '';
+    productUpdates = createProductUpdateManager({
+      app,
+      onStatus: status => {
         if (mainWindow && !mainWindow.isDestroyed() && !mainWindow.webContents.isDestroyed()) {
           mainWindow.webContents.send('updates:status', status);
         }
-        if (status.state === 'available') updateTray(`Update ${status.availableVersion} available`);
-        else if (status.state === 'downloading') updateTray(`Downloading update ${Math.round(status.progress || 0)}%`);
-        else if (status.state === 'downloaded') updateTray(`Update ${status.availableVersion} ready`);
-      },
+        if (status.state === 'available') updateTray(`Update ${status.availableVersion} available`);
+        else if (status.state === 'downloading') updateTray(`Downloading update ${Math.round(status.progress || 0)}%`);
+        else if (status.state === 'downloaded') updateTray(`Update ${status.availableVersion} ready`);
+        const progressBucket = Math.floor(Math.max(0, Number(status.progress || 0)) / 10) * 10;
+        const signature = [
+          status.state,
+          status.channel,
+          status.currentVersion,
+          status.availableVersion,
+          status.downloadedVersion,
+          progressBucket,
+          status.cleanupPending,
+          status.reopenRequired,
+          status.errorCode,
+          status.error,
+          status.lastCheckStartedAt,
+          status.lastCheckCompletedAt,
+          status.startupCheck
+        ].join('|');
+        if (signature !== lastProductUpdateLogSignature) {
+          lastProductUpdateLogSignature = signature;
+          log(
+            `desktop update state=${status.state || 'unknown'} channel=${status.channel || 'unknown'} current=${status.currentVersion || 'unknown'} available=${status.availableVersion || 'none'} downloaded=${status.downloadedVersion || 'none'} progress=${progressBucket} cleanupPending=${Boolean(status.cleanupPending)} reopenRequired=${Boolean(status.reopenRequired)} feed=${status.feedUrl || 'none'} checkStarted=${status.lastCheckStartedAt || 'none'} checkCompleted=${status.lastCheckCompletedAt || 'none'} errorCode=${status.errorCode || 'none'} error=${status.error || 'none'}`,
+            { priority: status.state === 'error' || status.state === 'installing' ? 'normal' : 'low' }
+          );
+        }
+      },
       beforeInstall: prepareRuntimeForUpdateInstall,
       onInstallError: recoverRuntimeAfterUpdateInstallError
     });
@@ -1298,10 +1436,17 @@ if (!app.requestSingleInstanceLock()) {
     pendingProtocolUrl = '';
     if (initialProtocolUrl) void handleProtocolUrl(initialProtocolUrl);
   });
-  app.on('window-all-closed', () => { /* tray-owned desktop stays alive */ });
-  app.on('before-quit', event => {
-    if (quitSequenceStarted) return;
-    event.preventDefault();
+  app.on('window-all-closed', () => { /* tray-owned desktop stays alive */ });
+  app.on('before-quit', event => {
+    if (quitSequenceStarted) return;
+    const installerQuitDecision = installerQuitGate.handleBeforeQuit();
+    if (installerQuitDecision === InstallerQuitDecision.HOLD
+      || installerQuitDecision === InstallerQuitDecision.BLOCK) {
+      event.preventDefault();
+      return;
+    }
+    if (installerQuitDecision === InstallerQuitDecision.ALLOW) return;
+    event.preventDefault();
     recurringProductUpdates?.stop();
     quitSequenceStarted = true;
     isQuitting = true;
@@ -1317,7 +1462,9 @@ if (!app.requestSingleInstanceLock()) {
       isQuitting = false;
       quitSequenceStarted = false;
       updateInstallSequenceStarted = false;
+      installerQuitGate.failInstall(error);
       scheduleDesktopAuthRefresh(readEncryptedSession());
+      recurringProductUpdates?.start();
       updateTray('Runtime cleanup blocked');
       log(`runtime cleanup blocked application quit: ${error?.message || error}`);
     });