livedesk 0.1.607 → 0.1.609

package/electron/update-manager.mjs

@@ -1,23 +1,63 @@
-import { createRequire } from 'node:module';
-import { readFileSync } from 'node:fs';
-import { join } from 'node:path';
-import { resolveDesktopUpdateFeed } from './update-feed-resolver.mjs';
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { EventEmitter } from 'node:events';
+import { resolveDesktopUpdateFeed } from './update-feed-resolver.mjs';
 
-const require = createRequire(import.meta.url);
+const require = createRequire(import.meta.url);
+
+const DEFAULT_CHECK_DEADLINE_MS = 30_000;
+const DEFAULT_DOWNLOAD_STALL_TIMEOUT_MS = 120_000;
+const DEFAULT_RETIRED_EVENT_QUIET_MS = 100;
+const DEFAULT_UPDATER_CLEANUP_RESET_MS = 5_000;
+const MINIMUM_DEADLINE_MS = 10;
+
+export function createPlatformProductUpdater(platform = process.platform) {
+  const module = require('electron-updater');
+  if (platform === 'win32') return new module.NsisUpdater();
+  if (platform === 'darwin') return new module.MacUpdater();
+  try {
+    const packageType = String(readFileSync(join(process.resourcesPath, 'package-type'), 'utf8')).trim();
+    if (packageType === 'deb') return new module.DebUpdater();
+    if (packageType === 'rpm') return new module.RpmUpdater();
+    if (packageType === 'pacman') return new module.PacmanUpdater();
+  } catch {
+    // AppImage is the Linux fallback used by electron-updater itself.
+  }
+  return new module.AppImageUpdater();
+}
+
+function normalizeDeadline(value, fallback) {
+  const milliseconds = Number(value);
+  return Number.isFinite(milliseconds) && milliseconds >= MINIMUM_DEADLINE_MS
+    ? Math.round(milliseconds)
+    : fallback;
+}
 
 export function createProductUpdateManager({
   app,
   onStatus = () => undefined,
   beforeInstall = async () => undefined,
-  onInstallError = async () => undefined,
-  updater = null,
-  platform = process.platform,
-  arch = process.arch,
-  startupCheckTimeoutMs = 2_500,
-  updateFeedConfig = null,
-  updateChannel = ''
-} = {}) {
-  if (!updater) updater = require('electron-updater').autoUpdater;
+  onInstallError = async () => undefined,
+  updater = null,
+  updaterFactory = null,
+  platform = process.platform,
+  arch = process.arch,
+  startupCheckTimeoutMs = 2_500,
+  checkDeadlineMs = DEFAULT_CHECK_DEADLINE_MS,
+  downloadStallTimeoutMs = DEFAULT_DOWNLOAD_STALL_TIMEOUT_MS,
+  retiredEventQuietMs = DEFAULT_RETIRED_EVENT_QUIET_MS,
+  updaterCleanupResetMs = DEFAULT_UPDATER_CLEANUP_RESET_MS,
+  setTimer = setTimeout,
+  clearTimer = clearTimeout,
+  now = Date.now,
+  updateFeedConfig = null,
+  updateChannel = ''
+} = {}) {
+  if (!updater) {
+    updaterFactory ||= () => createPlatformProductUpdater(platform);
+    updater = updaterFactory();
+  }
   let feedConfig = updateFeedConfig;
   let packageMetadata = {};
   try {
@@ -43,109 +83,549 @@ export function createProductUpdateManager({
   let status = {
     state: 'idle',
     currentVersion: app.getVersion(),
-    availableVersion: '',
-    downloaded: false,
-    progress: 0,
-    error: '',
+    availableVersion: '',
+    downloaded: false,
+    downloadedVersion: '',
+    progress: 0,
+    error: '',
+    errorCode: '',
     configured: feed.configured,
     feedUrl: feed.url,
     channel: feed.channel,
     platform: feed.platform,
-    arch: feed.arch,
-    startupCheck: 'idle'
-  };
-  let installPromise = null;
+    arch: feed.arch,
+    lastCheckStartedAt: '',
+    lastCheckCompletedAt: '',
+    cleanupPending: false,
+    reopenRequired: false,
+    startupCheck: 'idle'
+  };
+  let installPromise = null;
+  let installOperationPending = false;
   let checkPromise = null;
   let downloadPromise = null;
-  let cyclePromise = null;
-  let startupPromise = null;
-  let checkOutcome = 'idle';
-  let installRuntimePrepared = false;
-  let installRecoveryPromise = null;
-  const publish = patch => {
-    status = { ...status, ...patch };
-    onStatus({ ...status });
-  };
-  const snapshot = () => ({ ...status, packaged: Boolean(app.isPackaged) });
-  const recoverPreparedRuntime = error => {
-    if (!installRuntimePrepared) return Promise.resolve();
-    installRuntimePrepared = false;
-    if (!installRecoveryPromise) {
-      installRecoveryPromise = Promise.resolve(onInstallError(error))
-        .catch(() => undefined)
-        .finally(() => {
-          installRecoveryPromise = null;
-          if (status.state === 'error') installPromise = null;
-        });
+  let cyclePromise = null;
+  let startupPromise = null;
+  let ownerGeneration = 0;
+  let activeOwner = null;
+  let availableDownload = null;
+  let installRuntimePrepared = false;
+  let installRecoveryPromise = null;
+  const checkDeadline = normalizeDeadline(checkDeadlineMs, DEFAULT_CHECK_DEADLINE_MS);
+  const downloadStallTimeout = normalizeDeadline(downloadStallTimeoutMs, DEFAULT_DOWNLOAD_STALL_TIMEOUT_MS);
+  const retiredEventQuiet = normalizeDeadline(retiredEventQuietMs, DEFAULT_RETIRED_EVENT_QUIET_MS);
+  const updaterCleanupReset = normalizeDeadline(updaterCleanupResetMs, DEFAULT_UPDATER_CLEANUP_RESET_MS);
+  const updaterEvents = new EventEmitter();
+  const forwardedUpdaterEvents = [
+    'checking-for-update',
+    'update-available',
+    'update-not-available',
+    'download-progress',
+    'update-downloaded',
+    'error'
+  ];
+  const readNow = () => {
+    const value = Number(now());
+    return Number.isFinite(value) ? value : Date.now();
+  };
+  const nowIso = () => new Date(readNow()).toISOString();
+  const publish = patch => {
+    status = { ...status, ...patch };
+    onStatus({ ...status });
+  };
+  const snapshot = () => ({ ...status, packaged: Boolean(app.isPackaged) });
+  const releaseAvailableDownload = record => {
+    const owned = record || availableDownload;
+    if (!owned) return;
+    if (availableDownload === owned) availableDownload = null;
+    owned.cancellationToken?.dispose?.();
+  };
+  const beginOwner = (phase, expectedVersion = '') => {
+    if (activeOwner) throw new Error('desktop-update-operation-already-active');
+    const owner = {
+      generation: ++ownerGeneration,
+      phase,
+      expectedVersion: String(expectedVersion || ''),
+      acceptsEvents: true,
+      outcome: phase,
+      startedAt: readNow(),
+      lastActivityAt: readNow(),
+      deadline: null,
+      closeRequested: false,
+      cancelRequested: false,
+      downloadEventReceived: false,
+      versionMismatch: false,
+      lastProgressPercent: Number.NEGATIVE_INFINITY,
+      lastTransferredBytes: -1,
+      vendorSettled: false,
+      retiredQuietTimer: null,
+      cleanupResetTimer: null,
+      updaterReplaced: false,
+      onRetiredRelease: null
+    };
+    activeOwner = owner;
+    return owner;
+  };
+  const ownerFor = phase => (
+    activeOwner?.acceptsEvents === true && activeOwner.phase === phase
+      ? activeOwner
+      : null
+  );
+  const publishOwned = (owner, patch) => {
+    if (activeOwner !== owner || !owner.acceptsEvents) return false;
+    publish(patch);
+    return true;
+  };
+  const publishOwnedTerminal = (owner, patch) => {
+    if (activeOwner !== owner) return false;
+    publish(patch);
+    return true;
+  };
+  const createOwnedDeadline = (owner, milliseconds) => {
+    let timer = null;
+    let resolved = false;
+    let resolveDeadline;
+    const promise = new Promise(resolve => {
+      resolveDeadline = resolve;
+    });
+    const clear = () => {
+      if (timer !== null) clearTimer(timer);
+      timer = null;
+    };
+    const schedule = dueAt => {
+      clear();
+      owner.lastActivityAt = readNow();
+      const fire = () => {
+        timer = null;
+        if (resolved || activeOwner !== owner || !owner.acceptsEvents) return;
+        const remaining = dueAt - readNow();
+        if (remaining > 0) {
+          timer = setTimer(fire, remaining);
+          timer?.unref?.();
+          return;
+        }
+        resolved = true;
+        resolveDeadline({ generation: owner.generation, at: readNow() });
+      };
+      timer = setTimer(fire, Math.max(0, dueAt - readNow()));
+      timer?.unref?.();
+    };
+    return {
+      promise,
+      restart() {
+        if (!resolved && activeOwner === owner && owner.acceptsEvents) {
+          schedule(readNow() + milliseconds);
+        }
+      },
+      clear() {
+        resolved = true;
+        clear();
+      }
+    };
+  };
+  const retireOwner = owner => {
+    if (activeOwner !== owner) return;
+    owner.acceptsEvents = false;
+    owner.deadline?.clear();
+  };
+  const clearRetiredQuietTimer = owner => {
+    if (!owner || owner.retiredQuietTimer === null) return;
+    clearTimer(owner.retiredQuietTimer);
+    owner.retiredQuietTimer = null;
+  };
+  const clearCleanupResetTimer = owner => {
+    if (!owner || owner.cleanupResetTimer === null) return;
+    clearTimer(owner.cleanupResetTimer);
+    owner.cleanupResetTimer = null;
+  };
+  const finishOwner = owner => {
+    owner.deadline?.clear();
+    clearRetiredQuietTimer(owner);
+    clearCleanupResetTimer(owner);
+    owner.acceptsEvents = false;
+    if (activeOwner === owner) activeOwner = null;
+  };
+  const completeRetiredOwner = owner => {
+    if (activeOwner !== owner || owner.acceptsEvents) return;
+    const onRelease = owner.onRetiredRelease;
+    owner.onRetiredRelease = null;
+    try {
+      onRelease?.();
+    } finally {
+      publishOwnedTerminal(owner, { cleanupPending: false });
+      finishOwner(owner);
+    }
+  };
+  const scheduleRetiredOwnerRelease = owner => {
+    if (activeOwner !== owner || owner.acceptsEvents || !owner.vendorSettled) return;
+    clearRetiredQuietTimer(owner);
+    owner.retiredQuietTimer = setTimer(() => {
+      owner.retiredQuietTimer = null;
+      completeRetiredOwner(owner);
+    }, retiredEventQuiet);
+    owner.retiredQuietTimer?.unref?.();
+  };
+  const replaceCurrentUpdater = () => {
+    const retiredUpdater = updater;
+    retiredUpdater.autoInstallOnAppQuit = false;
+    if (typeof updaterFactory !== 'function') return false;
+    const replacement = updaterFactory();
+    if (!replacement || replacement === retiredUpdater) {
+      throw new Error('desktop-update-updater-factory-did-not-replace-owner');
+    }
+    connectUpdater(replacement);
+    // electron-updater installs downloaded artifacts from an app 'quit'
+    // listener. A retired instance must never launch its older cached file.
+    updater = replacement;
+    return true;
+  };
+  const replaceRetiredUpdater = (owner, { required = false } = {}) => {
+    if (owner.updaterReplaced) return true;
+    try {
+      owner.updaterReplaced = replaceCurrentUpdater();
+      return owner.updaterReplaced;
+    } catch (error) {
+      if (required) {
+        publishOwnedTerminal(owner, {
+          error: String(error?.message || error),
+          errorCode: 'desktop-update-owner-reset-failed',
+          reopenRequired: true
+        });
+      }
+      return false;
+    }
+  };
+  const deferRetiredOwnerRelease = (owner, rawVendorPromise, onRelease = null) => {
+    updater.autoInstallOnAppQuit = false;
+    owner.onRetiredRelease = onRelease;
+    publishOwnedTerminal(owner, { cleanupPending: true });
+    owner.cleanupResetTimer = setTimer(() => {
+      owner.cleanupResetTimer = null;
+      if (activeOwner !== owner || owner.acceptsEvents || owner.vendorSettled) return;
+      if (typeof updaterFactory !== 'function') {
+        publishOwnedTerminal(owner, {
+          error: 'desktop-update-owner-cleanup-stuck',
+          errorCode: 'desktop-update-owner-cleanup-stuck',
+          reopenRequired: true
+        });
+        return;
+      }
+      if (replaceRetiredUpdater(owner, { required: true })) {
+        owner.vendorSettled = true;
+        scheduleRetiredOwnerRelease(owner);
+      }
+    }, updaterCleanupReset);
+    owner.cleanupResetTimer?.unref?.();
+    void Promise.resolve(rawVendorPromise)
+      .catch(() => undefined)
+      .finally(() => {
+        if (activeOwner !== owner || owner.acceptsEvents) return;
+        // A production timeout always retires the whole emitter instance.
+        // Any event that old electron-updater schedules later is then absorbed
+        // by its forwarding listener and cannot enter a new generation.
+        replaceRetiredUpdater(owner);
+        owner.vendorSettled = true;
+        clearCleanupResetTimer(owner);
+        scheduleRetiredOwnerRelease(owner);
+      });
+  };
+  const ignoreRetiredUpdaterEvent = () => {
+    const owner = activeOwner;
+    if (!owner || owner.acceptsEvents) return false;
+    if (owner.vendorSettled) scheduleRetiredOwnerRelease(owner);
+    return true;
+  };
+  const closeUpdaterConnections = async owner => {
+    if (owner.closeRequested) return;
+    owner.closeRequested = true;
+    const netSession = updater.netSession;
+    if (typeof netSession?.closeAllConnections !== 'function') {
+      throw new Error('desktop-update-session-close-unavailable');
+    }
+    await netSession.closeAllConnections();
+  };
+  const recoverPreparedRuntime = error => {
+    if (!installRuntimePrepared) return Promise.resolve();
+    installRuntimePrepared = false;
+    // electron-updater keeps both a one-shot quitAndInstall lock and a cached
+    // installer-on-quit handler on its instance. Disable that instance before
+    // runtime recovery does anything that may allow the app to quit.
+    updater.autoInstallOnAppQuit = false;
+    releaseAvailableDownload();
+    publish({
+      downloaded: false,
+      downloadedVersion: '',
+      progress: 0
+    });
+    if (!installRecoveryPromise) {
+      installRecoveryPromise = Promise.resolve(onInstallError(error))
+        .then(() => {
+          if (typeof updaterFactory === 'function') {
+            try {
+              if (!replaceCurrentUpdater()) {
+                throw new Error('desktop-update-updater-owner-reset-unavailable');
+              }
+            } catch (resetError) {
+              const wrapped = new Error(
+                `desktop-update-updater-owner-reset-failed:${String(resetError?.message || resetError)}`
+              );
+              wrapped.code = 'desktop-update-owner-reset-failed';
+              throw wrapped;
+            }
+          }
+        })
+        .catch(recoveryError => {
+          const message = String(recoveryError?.message || recoveryError);
+          publish({
+            state: 'error',
+            error: message,
+            errorCode: recoveryError?.code === 'desktop-update-owner-reset-failed'
+              ? 'desktop-update-owner-reset-failed'
+              : 'desktop-update-runtime-recovery-failed',
+            reopenRequired: true
+          });
+        })
+        .finally(() => {
+          installRecoveryPromise = null;
+          if (status.state === 'error' && !installOperationPending) installPromise = null;
+        });
     }
-    return installRecoveryPromise;
-  };
-
-  updater.autoDownload = false;
-  updater.autoInstallOnAppQuit = true;
-  if (feed.url) {
-    updater.setFeedURL({ provider: 'generic', url: feed.url });
-  }
-  updater.on('checking-for-update', () => {
-    checkOutcome = 'checking';
-    publish({ state: 'checking', error: '' });
-  });
-  updater.on('update-available', info => {
-    checkOutcome = 'available';
-    publish({ state: 'available', availableVersion: String(info?.version || ''), error: '' });
-  });
-  updater.on('update-not-available', () => {
-    checkOutcome = 'current';
-    publish({ state: 'current', availableVersion: '', downloaded: false, progress: 0, error: '' });
-  });
-  updater.on('download-progress', progress => publish({ state: 'downloading', progress: Number(progress?.percent || 0), error: '' }));
-  updater.on('update-downloaded', info => publish({
-    state: 'downloaded',
-    downloaded: true,
-    progress: 100,
-    availableVersion: String(info?.version || status.availableVersion || ''),
-    error: ''
-  }));
-  updater.on('error', error => {
-    checkOutcome = 'error';
-    publish({ state: 'error', error: String(error?.message || error) });
-    void recoverPreparedRuntime(error);
-  });
+    return installRecoveryPromise;
+  };
+
+  const connectedUpdaters = new WeakSet();
+  const connectUpdater = candidate => {
+    if (!candidate || connectedUpdaters.has(candidate)) return;
+    candidate.autoDownload = false;
+    candidate.autoInstallOnAppQuit = true;
+    if (feed.url) candidate.setFeedURL({ provider: 'generic', url: feed.url });
+    for (const eventName of forwardedUpdaterEvents) {
+      candidate.on(eventName, (...args) => {
+        // A force-retired updater keeps this harmless listener so a late
+        // EventEmitter 'error' cannot terminate Electron. Only the current
+        // instance can reach the manager owner.
+        if (candidate !== updater) return;
+        updaterEvents.emit(eventName, ...args);
+      });
+    }
+    connectedUpdaters.add(candidate);
+  };
+
+  updaterEvents.on('checking-for-update', () => {
+    if (ignoreRetiredUpdaterEvent()) return;
+    const owner = ownerFor('checking');
+    if (!owner || owner.outcome === 'error') return;
+    owner.outcome = 'checking';
+    owner.lastActivityAt = readNow();
+    publishOwned(owner, { state: 'checking', error: '', errorCode: '' });
+  });
+  updaterEvents.on('update-available', info => {
+    if (ignoreRetiredUpdaterEvent()) return;
+    const owner = ownerFor('checking');
+    if (!owner || owner.outcome === 'error') return;
+    owner.outcome = 'available';
+    owner.expectedVersion = String(info?.version || owner.expectedVersion || '');
+    owner.lastActivityAt = readNow();
+    const downloaded = Boolean(
+      status.downloaded
+      && status.downloadedVersion
+      && status.downloadedVersion === owner.expectedVersion
+    );
+    publishOwned(owner, {
+      state: 'available',
+      availableVersion: owner.expectedVersion,
+      downloaded,
+      downloadedVersion: downloaded ? status.downloadedVersion : '',
+      progress: downloaded ? 100 : 0,
+      error: '',
+      errorCode: ''
+    });
+  });
+  updaterEvents.on('update-not-available', () => {
+    if (ignoreRetiredUpdaterEvent()) return;
+    const owner = ownerFor('checking');
+    if (!owner || owner.outcome === 'error') return;
+    owner.outcome = 'current';
+    owner.lastActivityAt = readNow();
+    publishOwned(owner, { state: 'current', availableVersion: '', downloaded: false, downloadedVersion: '', progress: 0, error: '', errorCode: '' });
+  });
+  updaterEvents.on('download-progress', progress => {
+    if (ignoreRetiredUpdaterEvent()) return;
+    const owner = ownerFor('downloading');
+    if (!owner || owner.outcome === 'error' || owner.downloadEventReceived) return;
+    const percent = Number(progress?.percent || 0);
+    const transferredBytes = Number(progress?.transferred || 0);
+    const advanced = percent > owner.lastProgressPercent || transferredBytes > owner.lastTransferredBytes;
+    owner.lastProgressPercent = Math.max(owner.lastProgressPercent, percent);
+    owner.lastTransferredBytes = Math.max(owner.lastTransferredBytes, transferredBytes);
+    owner.lastActivityAt = readNow();
+    if (advanced) owner.deadline?.restart();
+    publishOwned(owner, { state: 'downloading', progress: percent, error: '', errorCode: '' });
+  });
+  updaterEvents.on('update-downloaded', info => {
+    if (ignoreRetiredUpdaterEvent()) return;
+    const owner = ownerFor('downloading');
+    if (!owner || owner.outcome === 'error') return;
+    const receivedVersion = String(info?.version || '');
+    if (owner.expectedVersion && receivedVersion && receivedVersion !== owner.expectedVersion) {
+      owner.versionMismatch = true;
+      return;
+    }
+    if (!owner.expectedVersion) owner.expectedVersion = receivedVersion;
+    owner.outcome = 'downloaded';
+    owner.downloadEventReceived = true;
+    owner.lastActivityAt = readNow();
+    publishOwned(owner, {
+      state: 'downloaded',
+      downloaded: true,
+      downloadedVersion: receivedVersion || owner.expectedVersion || status.availableVersion || '',
+      progress: 100,
+      availableVersion: receivedVersion || owner.expectedVersion || status.availableVersion || '',
+      error: '',
+      errorCode: ''
+    });
+  });
+  updaterEvents.on('error', error => {
+    if (ignoreRetiredUpdaterEvent()) return;
+    const recoverRuntime = () => recoverPreparedRuntime(error);
+    const owner = activeOwner?.acceptsEvents === true ? activeOwner : null;
+    if (!owner) {
+      if (!installRuntimePrepared) return;
+      publish({
+        state: 'error',
+        error: String(error?.message || error),
+        errorCode: 'desktop-update-installer-launch-failed'
+      });
+      void recoverRuntime();
+      return;
+    }
+    owner.outcome = 'error';
+    owner.lastActivityAt = readNow();
+    publishOwned(owner, {
+      state: 'error',
+      error: String(error?.message || error),
+      errorCode: owner.phase === 'checking'
+        ? 'desktop-update-check-failed'
+        : 'desktop-update-download-failed'
+    });
+    void recoverRuntime();
+  });
+
+  connectUpdater(updater);
 
   const unavailableStatus = () => ({
-    ...snapshot(),
-    state: 'unavailable',
-    error: feed.error || 'desktop-update-feed-not-configured'
+    ...snapshot(),
+    state: 'unavailable',
+    error: feed.error || 'desktop-update-feed-not-configured',
+    errorCode: feed.error || 'desktop-update-feed-not-configured'
   });
 
-  const checkForUpdates = async () => {
-    if (!app.isPackaged) {
+  const checkForUpdates = async () => {
+    if (status.reopenRequired) return snapshot();
+    if (!app.isPackaged) {
       return { ...status, state: 'development', error: 'desktop-updates-require-packaged-app' };
     }
-    if (!feed.url) return unavailableStatus();
-    if (checkPromise) return checkPromise;
-    const operation = (async () => {
-      checkOutcome = 'checking';
-      publish({ state: 'checking', error: '' });
-      try {
-        const result = await updater.checkForUpdates();
-        if (checkOutcome === 'checking') {
-          const availableVersion = String(result?.updateInfo?.version || status.availableVersion || '');
-          const updateAvailable = Boolean(availableVersion && availableVersion !== app.getVersion());
-          checkOutcome = updateAvailable ? 'available' : 'current';
-          publish({
-            state: checkOutcome,
-            availableVersion: updateAvailable ? availableVersion : '',
-            downloaded: updateAvailable ? status.downloaded : false,
-            progress: updateAvailable ? status.progress : 0,
-            error: ''
-          });
-        }
-      } catch (error) {
-        checkOutcome = 'error';
-        publish({ state: 'error', error: String(error?.message || error) });
-      }
-      return { ...status, packaged: Boolean(app.isPackaged) };
+    if (!feed.url) return unavailableStatus();
+    if (checkPromise) return checkPromise;
+    if (activeOwner) return snapshot();
+    const operation = (async () => {
+      let owner = null;
+      let ownerReleaseDeferred = false;
+      try {
+        owner = beginOwner('checking');
+        releaseAvailableDownload();
+        owner.deadline = createOwnedDeadline(owner, checkDeadline);
+        owner.deadline.restart();
+        publishOwned(owner, {
+          state: 'checking',
+          error: '',
+          errorCode: '',
+          lastCheckStartedAt: nowIso(),
+          lastCheckCompletedAt: ''
+        });
+        const rawVendorPromise = Promise.resolve().then(() => updater.checkForUpdates());
+        const settledVendorPromise = rawVendorPromise.then(
+          result => ({ kind: 'result', result }),
+          error => ({ kind: 'error', error })
+        );
+        const outcome = await Promise.race([
+          settledVendorPromise,
+          owner.deadline.promise.then(() => ({ kind: 'deadline' }))
+        ]);
+        if (outcome.kind === 'deadline') {
+          retireOwner(owner);
+          publishOwnedTerminal(owner, {
+            state: 'error',
+            availableVersion: '',
+            downloaded: false,
+            downloadedVersion: '',
+            progress: 0,
+            error: 'desktop-update-check-deadline-exceeded',
+            errorCode: 'desktop-update-check-deadline-exceeded',
+            lastCheckCompletedAt: nowIso()
+          });
+          void closeUpdaterConnections(owner).catch(() => undefined);
+          deferRetiredOwnerRelease(owner, rawVendorPromise);
+          ownerReleaseDeferred = true;
+          return snapshot();
+        }
+        owner.deadline.clear();
+        if (outcome.kind === 'error') {
+          owner.outcome = 'error';
+          if (status.state !== 'error') {
+            publishOwned(owner, {
+              state: 'error',
+              error: String(outcome.error?.message || outcome.error),
+              errorCode: 'desktop-update-check-failed'
+            });
+          }
+          return snapshot();
+        }
+        const result = outcome.result;
+        if (owner.outcome === 'checking') {
+          const availableVersion = String(result?.updateInfo?.version || status.availableVersion || '');
+          const updateAvailable = Boolean(availableVersion && availableVersion !== app.getVersion());
+          const downloaded = Boolean(
+            updateAvailable
+            && status.downloaded
+            && status.downloadedVersion
+            && status.downloadedVersion === availableVersion
+          );
+          owner.outcome = updateAvailable ? 'available' : 'current';
+          owner.expectedVersion = updateAvailable ? availableVersion : '';
+          publishOwned(owner, {
+            state: owner.outcome,
+            availableVersion: updateAvailable ? availableVersion : '',
+            downloaded,
+            downloadedVersion: downloaded ? status.downloadedVersion : '',
+            progress: downloaded ? 100 : 0,
+            error: '',
+            errorCode: ''
+          });
+        }
+        if (owner.outcome === 'available') {
+          availableDownload = {
+            generation: owner.generation,
+            version: String(owner.expectedVersion || result?.updateInfo?.version || status.availableVersion || ''),
+            cancellationToken: result?.cancellationToken || null
+          };
+        }
+      } catch (error) {
+        if (owner) owner.outcome = 'error';
+        if (!owner || activeOwner === owner) {
+          publishOwnedTerminal(owner, {
+            state: 'error',
+            error: String(error?.message || error),
+            errorCode: 'desktop-update-check-failed'
+          });
+        }
+      } finally {
+        if (owner && !ownerReleaseDeferred) {
+          publishOwnedTerminal(owner, { lastCheckCompletedAt: nowIso() });
+          finishOwner(owner);
+        }
+      }
+      return { ...status, packaged: Boolean(app.isPackaged) };
     })();
     checkPromise = operation;
     try {
@@ -155,22 +635,123 @@ export function createProductUpdateManager({
     }
   };
 
-  const downloadUpdate = async () => {
-    if (!app.isPackaged) {
+  const downloadUpdate = async () => {
+    if (status.reopenRequired) return snapshot();
+    if (!app.isPackaged) {
       return { ...status, state: 'development', error: 'desktop-updates-require-packaged-app' };
     }
     if (!feed.url) return unavailableStatus();
-    if (status.downloaded) return { ...status, packaged: true };
-    if (downloadPromise) return downloadPromise;
-    const operation = (async () => {
-      try {
-        publish({ state: 'downloading', progress: Math.max(0, Number(status.progress || 0)), error: '' });
-        await updater.downloadUpdate();
-        if (!status.downloaded) publish({ state: 'downloaded', downloaded: true, progress: 100, error: '' });
-      } catch (error) {
-        publish({ state: 'error', error: String(error?.message || error) });
-      }
-      return { ...status, packaged: Boolean(app.isPackaged) };
+    if (downloadPromise) return downloadPromise;
+    if (activeOwner) return snapshot();
+    const requestedVersion = String(availableDownload?.version || status.availableVersion || '');
+    if (status.downloaded && status.downloadedVersion && status.downloadedVersion === requestedVersion) {
+      releaseAvailableDownload();
+      return { ...status, packaged: true };
+    }
+    const operation = (async () => {
+      let owner = null;
+      let ownerReleaseDeferred = false;
+      const downloadRecord = availableDownload;
+      try {
+        owner = beginOwner('downloading', downloadRecord?.version || status.availableVersion);
+        owner.deadline = createOwnedDeadline(owner, downloadStallTimeout);
+        owner.deadline.restart();
+        publishOwned(owner, {
+          state: 'downloading',
+          progress: Math.max(0, Number(status.progress || 0)),
+          error: '',
+          errorCode: ''
+        });
+        const cancellationToken = downloadRecord?.cancellationToken;
+        const rawVendorPromise = Promise.resolve().then(() => updater.downloadUpdate(cancellationToken));
+        const settledVendorPromise = rawVendorPromise.then(
+          result => ({ kind: 'result', result }),
+          error => ({ kind: 'error', error })
+        );
+        const outcome = await Promise.race([
+          settledVendorPromise,
+          owner.deadline.promise.then(() => ({ kind: 'deadline' }))
+        ]);
+        if (outcome.kind === 'deadline') {
+          retireOwner(owner);
+          publishOwnedTerminal(owner, {
+            state: 'error',
+            downloaded: false,
+            downloadedVersion: '',
+            error: 'desktop-update-download-stalled',
+            errorCode: 'desktop-update-download-stalled'
+          });
+          if (!owner.cancelRequested) {
+            owner.cancelRequested = true;
+            let cancelled = false;
+            if (typeof cancellationToken?.cancel === 'function') {
+              try {
+                cancellationToken.cancel();
+                cancelled = true;
+              } catch {
+                cancelled = false;
+              }
+            }
+            if (!cancelled) {
+              void closeUpdaterConnections(owner).catch(() => undefined);
+            }
+          }
+          deferRetiredOwnerRelease(owner, rawVendorPromise, () => releaseAvailableDownload(downloadRecord));
+          ownerReleaseDeferred = true;
+          return snapshot();
+        }
+        owner.deadline.clear();
+        if (outcome.kind === 'error') {
+          if (status.state !== 'error') {
+            publishOwned(owner, {
+              state: 'error',
+              downloaded: false,
+              downloadedVersion: '',
+              error: String(outcome.error?.message || outcome.error),
+              errorCode: 'desktop-update-download-failed'
+            });
+          }
+          return snapshot();
+        }
+        if (owner.outcome === 'error') return snapshot();
+        if (owner.versionMismatch) {
+          publishOwned(owner, {
+            state: 'error',
+            downloaded: false,
+            downloadedVersion: '',
+            error: 'desktop-update-downloaded-version-mismatch',
+            errorCode: 'desktop-update-downloaded-version-mismatch'
+          });
+          return snapshot();
+        }
+        if (!owner.downloadEventReceived) {
+          publishOwned(owner, {
+            state: 'downloaded',
+            downloaded: true,
+            downloadedVersion: owner.expectedVersion || status.availableVersion || '',
+            progress: 100,
+            availableVersion: owner.expectedVersion || status.availableVersion || '',
+            error: '',
+            errorCode: ''
+          });
+        }
+      } catch (error) {
+        if (!owner || activeOwner === owner) {
+          publishOwnedTerminal(owner, {
+            state: 'error',
+            downloaded: false,
+            downloadedVersion: '',
+            error: String(error?.message || error),
+            errorCode: 'desktop-update-download-failed'
+          });
+        }
+      } finally {
+        if (!ownerReleaseDeferred) {
+          if (owner) finishOwner(owner);
+          releaseAvailableDownload(downloadRecord);
+        }
+      }
+      return { ...status, packaged: Boolean(app.isPackaged) };
     })();
     downloadPromise = operation;
     try {
@@ -211,12 +792,12 @@ export function createProductUpdateManager({
           publish({ startupCheck: 'complete' });
         });
         let timeoutId;
-        const timeout = new Promise(resolve => {
-          timeoutId = setTimeout(() => resolve('timeout'), Math.max(10, Number(startupCheckTimeoutMs) || 2_500));
-          timeoutId.unref?.();
-        });
-        const result = await Promise.race([background, timeout]);
-        clearTimeout(timeoutId);
+        const timeout = new Promise(resolve => {
+          timeoutId = setTimer(() => resolve('timeout'), Math.max(10, Number(startupCheckTimeoutMs) || 2_500));
+          timeoutId.unref?.();
+        });
+        const result = await Promise.race([background, timeout]);
+        clearTimer(timeoutId);
         if (result === 'timeout') {
           publish({ startupCheck: 'timed-out' });
           return snapshot();
@@ -230,14 +811,33 @@ export function createProductUpdateManager({
         if (startupPromise === operation) startupPromise = null;
       }
     },
-    async install() {
-      if (!app.isPackaged) return { ...snapshot(), state: 'development', error: 'desktop-updates-require-packaged-app' };
-      if (!feed.url) return unavailableStatus();
-      if (installPromise) return installPromise;
-      const operation = (async () => {
-        try {
-          if (!status.downloaded) {
-            const downloadResult = await downloadUpdate();
+    async install() {
+      if (!app.isPackaged) return { ...snapshot(), state: 'development', error: 'desktop-updates-require-packaged-app' };
+      if (!feed.url) return unavailableStatus();
+      if (status.reopenRequired) return snapshot();
+      if (installRecoveryPromise) {
+        await installRecoveryPromise;
+        return snapshot();
+      }
+      if (installPromise) return installPromise;
+      installOperationPending = true;
+      const operation = (async () => {
+        try {
+          if (status.downloaded
+            && (!status.downloadedVersion || status.downloadedVersion !== status.availableVersion)) {
+            publish({
+              state: 'error',
+              downloaded: false,
+              downloadedVersion: '',
+              error: 'desktop-update-downloaded-version-mismatch',
+              errorCode: 'desktop-update-downloaded-version-mismatch'
+            });
+            return snapshot();
+          }
+          if (!status.downloaded) {
+            const downloadResult = availableDownload
+              ? await downloadUpdate()
+              : await checkAndDownload();
             if (!downloadResult.downloaded) return downloadResult;
           }
           // The updater may launch its installer synchronously from
@@ -245,24 +845,42 @@ export function createProductUpdateManager({
           // zero before allowing that replacement process to exist.
           await beforeInstall();
           installRuntimePrepared = true;
-          publish({ state: 'installing', error: '' });
+          publish({ state: 'installing', error: '', errorCode: '' });
           // Long-running desktop Clients must not stop at the assisted NSIS
-          // wizard after the runtime has already shut down for replacement.
-          updater.quitAndInstall(true, true);
-          return snapshot();
-        } catch (error) {
-          await recoverPreparedRuntime(error);
-          publish({ state: 'error', error: String(error?.message || error) });
+          // wizard after the runtime has already shut down for replacement.
+          updater.quitAndInstall(true, true);
+          // BaseUpdater can emit a synchronous error and return instead of
+          // throwing. Keep this install owner locked until runtime recovery
+          // completes, so Retry cannot begin a second pre-install drain.
+          if (installRecoveryPromise) await installRecoveryPromise;
+          return snapshot();
+        } catch (error) {
+          await recoverPreparedRuntime(error);
+          if (!status.reopenRequired) {
+            const message = String(error?.message || error);
+            const preinstallRecoveryFailed = message.includes('desktop-update-preinstall-recovery-failed');
+            publish({
+              state: 'error',
+              error: message,
+              errorCode: preinstallRecoveryFailed
+                ? 'desktop-update-runtime-recovery-failed'
+                : 'desktop-update-installer-launch-failed',
+              reopenRequired: preinstallRecoveryFailed
+            });
+          }
           return snapshot();
         }
       })();
       installPromise = operation;
-      try {
-        return await operation;
-      } finally {
-        if (installPromise === operation && status.state !== 'installing') {
-          installPromise = null;
-        }
+      try {
+        return await operation;
+      } finally {
+        installOperationPending = false;
+        if (installPromise === operation
+          && status.state !== 'installing'
+          && !installRecoveryPromise) {
+          installPromise = null;
+        }
       }
     }
   };