local-operator-ui 0.29.9 → 0.29.11

package/out/main/index.js

@@ -2450,6 +2450,141 @@ const MACOS_ENTITLEMENT_POLICY = {
   unrestrictedEntitlementKeys,
   unrestrictedEntitlementPrefixes
 };
+const DITTO_PATH = "/usr/bin/ditto";
+const SHIPIT_RELATIVE_PATH = path$1.join(
+  "Contents",
+  "Frameworks",
+  "Squirrel.framework",
+  "Versions",
+  "Current",
+  "Resources",
+  "ShipIt"
+);
+const INSTALLER_TOKEN = "local-operator-update-installer";
+const UPDATE_STAGING_DIR = "update-staging";
+const INSTALLER_POLL_SECONDS = "0.2";
+const EXTRACTION_TIMEOUT_MS = 10 * 6e4;
+function shipItPathInBundle(bundlePath) {
+  if (!bundlePath) return null;
+  return path$1.join(bundlePath, SHIPIT_RELATIVE_PATH);
+}
+function updateStagingRoot(userDataDir) {
+  return path$1.join(userDataDir, UPDATE_STAGING_DIR);
+}
+function updateStagingDir(input) {
+  return path$1.join(
+    updateStagingRoot(input.userDataDir),
+    `${input.version}-${input.nonce}`
+  );
+}
+function stagingStatePath(stagingRoot) {
+  return path$1.join(stagingRoot, "state.plist");
+}
+function installerLogPath(shipItCacheDir2) {
+  return path$1.join(shipItCacheDir2, "ShipIt_stderr.log");
+}
+function extractionArguments(zipPath, stagingRoot) {
+  return ["-x", "-k", zipPath, stagingRoot];
+}
+function evaluateStagedBundle(input) {
+  const { reading } = input;
+  if (!reading.exists) {
+    return {
+      ok: false,
+      detail: `the extraction produced no bundle at ${reading.appPath}`
+    };
+  }
+  if (reading.bundleIdentifier !== input.expectedBundleIdentifier) {
+    return {
+      ok: false,
+      detail: `the staged bundle is ${reading.bundleIdentifier ?? "unsigned for an identifier"}, not ${input.expectedBundleIdentifier}`
+    };
+  }
+  if (reading.version !== input.expectedVersion) {
+    return {
+      ok: false,
+      detail: `the staged bundle reports version ${reading.version ?? "unknown"}, not ${input.expectedVersion}`
+    };
+  }
+  if (!reading.executablePresent) {
+    return {
+      ok: false,
+      detail: `the staged bundle at ${reading.appPath} has no executable of its own`
+    };
+  }
+  if (reading.architectures != null && reading.architectures.length > 0 && !reading.architectures.includes(input.runningArchitecture)) {
+    return {
+      ok: false,
+      detail: `the staged bundle is built for ${reading.architectures.join(
+        ", "
+      )} and this app is running as ${input.runningArchitecture}`
+    };
+  }
+  return {
+    ok: true,
+    detail: `${input.expectedBundleIdentifier} ${input.expectedVersion}${reading.architectures ? ` (${reading.architectures.join(", ")})` : ""}`
+  };
+}
+function sameVolume(stagingDevice, targetDevice) {
+  return stagingDevice != null && stagingDevice === targetDevice;
+}
+function fileUrlForDirectory(path2) {
+  const withSlash = path2.endsWith("/") ? path2 : `${path2}/`;
+  return `file://${encodeURI(withSlash)}`;
+}
+function shipItStatePlist(input) {
+  return {
+    bundleIdentifier: input.bundleIdentifier,
+    targetBundleURL: fileUrlForDirectory(input.targetBundlePath),
+    updateBundleURL: fileUrlForDirectory(input.updateBundlePath),
+    launchAfterInstallation: true,
+    useUpdateBundleName: true
+  };
+}
+function buildInstallerSpawn(input) {
+  const script = `#!/bin/sh
+# ${INSTALLER_TOKEN}
+#
+# Why this exists: the app is about to quit so an install can replace it, and the
+# installer must not be running its own check for a running instance of the app
+# while one is still there - ShipIt asks that question once, as its last check
+# before the swap, and an instance of the target app answers it with "abort"
+# (SQRLInstallerErrorDomain Code=-9, the 2026-09-18 09:37 install). So this waits
+# for the app's pid to go, and then replaces itself with the installer: one
+# process, one pid for the app to record, and no shell left in the way.
+while kill -0 "$1" 2>/dev/null; do
+	sleep ${INSTALLER_POLL_SECONDS}
+done
+exec "$LO_UPDATE_INSTALLER_SHIPIT" "$LO_UPDATE_INSTALLER_LABEL" "$LO_UPDATE_INSTALLER_STATE" >>"$LO_UPDATE_INSTALLER_LOG" 2>&1
+`;
+  return {
+    script,
+    env: {
+      LO_UPDATE_INSTALLER_SHIPIT: input.shipItPath,
+      LO_UPDATE_INSTALLER_LABEL: input.label,
+      LO_UPDATE_INSTALLER_STATE: input.statePath,
+      LO_UPDATE_INSTALLER_LOG: input.logPath
+    },
+    // `sh -c <script> <name> <pid>`: the name is $0 and the pid is $1, so the
+    // script text carries no path and no number that a process listing of it
+    // would not otherwise show.
+    args: ["-c", script, "lo-update-installer", String(input.appPid)]
+  };
+}
+function installerIsAlive(input) {
+  if (input.pid == null || input.commandLine == null) return false;
+  const line = input.commandLine;
+  if (line.includes(INSTALLER_TOKEN)) return true;
+  return input.shipItPath != null && input.stagingRoot != null && line.includes(input.shipItPath) && line.includes(input.stagingRoot);
+}
+function installerElsewhere(input) {
+  if (!input.processList || !input.shipItPath || !input.stagingRoot) {
+    return false;
+  }
+  return input.processList.split("\n").some(
+    (line) => line.includes(input.shipItPath) && line.includes(input.stagingRoot)
+  );
+}
 const PENDING_INSTALL_MARKER_FILE = "pending-update-install.json";
 const INSTALL_DISK_SLACK_BYTES = 256 * 1024 * 1024;
 const DOWNLOAD_PAGE_URL = "https://local-operator.com/download";
@@ -2639,7 +2774,7 @@ function matchArtifactMetadata(filePath, files, updatePath) {
   return null;
 }
 function requiredDiskBytes(input) {
-  return input.artifactSize + input.installedBundleSize * 2 + INSTALL_DISK_SLACK_BYTES;
+  return input.artifactSize + input.installedBundleSize * 3 + INSTALL_DISK_SLACK_BYTES;
 }
 function formatGiB(bytes) {
   return `${(bytes / 1024 ** 3).toFixed(1)} GiB`;
@@ -2720,7 +2855,7 @@ function verifyStagedArtifact(input) {
   const installedBundleSize = input.installedBundleSize ?? 0;
   const needed = requiredDiskBytes({ artifactSize, installedBundleSize });
   if (input.freeBytes < needed) {
-    const footprint = installedBundleSize ? `${formatGiB(artifactSize)} artifact + two ${formatGiB(
+    const footprint = installedBundleSize ? `${formatGiB(artifactSize)} artifact + three ${formatGiB(
       installedBundleSize
     )} app copies + ${formatGiB(INSTALL_DISK_SLACK_BYTES)} slack` : `${formatGiB(artifactSize)} artifact + ${formatGiB(INSTALL_DISK_SLACK_BYTES)} slack (the installed app could not be measured)`;
     return {
@@ -2837,7 +2972,10 @@ function parsePendingInstallMarker(raw) {
       targetVersion: parsed.targetVersion,
       artifactPath: typeof parsed.artifactPath === "string" ? parsed.artifactPath : "",
       startedAt: typeof parsed.startedAt === "string" ? parsed.startedAt : "",
-      watchdogPid: typeof parsed.watchdogPid === "number" ? parsed.watchdogPid : null
+      watchdogPid: typeof parsed.watchdogPid === "number" ? parsed.watchdogPid : null,
+      // Absent on a marker written before this field existed, and absent is the
+      // same answer as the fallback's `null`: ask the install's own launchd job.
+      installerPid: typeof parsed.installerPid === "number" ? parsed.installerPid : null
     };
   } catch {
     return null;
@@ -3039,9 +3177,48 @@ function isInstallInFlight(input) {
   const age = pendingInstallAgeSeconds(input.marker, input.now);
   if (age === null) return false;
   if (age < 0 || age > PENDING_INSTALL_RECENCY_SECONDS) return false;
+  if (input.marker.installerPid != null) return input.installerRunning;
   if (input.jobState === "running") return true;
   return input.jobState === "registered" && age <= PENDING_INSTALL_HANDOFF_SECONDS;
 }
+function installLivenessText(liveness, installerPid) {
+  if (liveness.decidedBy !== "installer-pid") {
+    return `install job ${liveness.jobState}`;
+  }
+  const named = installerPid ?? "unknown";
+  if (liveness.installerSignal === "elsewhere") {
+    return `the install this app started is still running (pid ${named} has gone; its ShipIt is still at work)`;
+  }
+  if (liveness.installerSignal === "pid") {
+    return `the installer this app started (pid ${named}) is still running`;
+  }
+  return `the installer this app started (pid ${named}) has gone`;
+}
+function installLivenessNow(input) {
+  const pid = input.marker?.installerPid ?? null;
+  if (pid == null) {
+    return {
+      installerRunning: false,
+      jobState: input.jobState(),
+      decidedBy: "install-job",
+      // No pid was asked about, so no pid-shaped fact decided.
+      installerSignal: null
+    };
+  }
+  const pidIsLive = installerIsAlive({
+    pid,
+    commandLine: input.installerCommandLine(),
+    shipItPath: input.shipItPath,
+    stagingRoot: input.stagingRoot
+  });
+  const elsewhere = pidIsLive ? false : input.installerElsewhere();
+  return {
+    installerRunning: pidIsLive || elsewhere,
+    jobState: "unread",
+    decidedBy: "installer-pid",
+    installerSignal: pidIsLive ? "pid" : elsewhere ? "elsewhere" : null
+  };
+}
 function evaluateLaunchDuringInstall(input) {
   const { marker } = input;
   if (!marker) return { kind: "open" };
@@ -3050,7 +3227,8 @@ function evaluateLaunchDuringInstall(input) {
     runningVersion: input.runningVersion,
     installInFlight: isInstallInFlight({
       marker,
-      jobState: input.jobState,
+      jobState: input.liveness.jobState,
+      installerRunning: input.liveness.installerRunning,
       now: input.now
     })
   });
@@ -3125,7 +3303,7 @@ function installLaunchHoldNotice(marker, options = {}) {
   const relaunch = options.relaunchEnsured === false ? "No relaunch could be arranged for this install, so start Local Operator by hand when it finishes." : "Local Operator will open by itself when the install finishes.";
   return {
     title: "Local Operator is still updating",
-    body: `The update to version ${marker.targetVersion} is still installing — this can take a few minutes, and opening the app now would cancel it. ${relaunch} Clicking this notice will not open it any sooner.`
+    body: `The update to version ${marker.targetVersion} is still installing — opening the app now would cancel it. ${relaunch} Clicking this notice will not open it any sooner.`
   };
 }
 function shipItJobLabel(bundleId) {
@@ -3209,15 +3387,36 @@ function buildWatchdogPlan(input) {
 # osascript blocked, no notifier at all), so no notification failure may change
 # what this script decides or what it exits with.
 #
-# With no job label to ask about, the job cannot be consulted at all, so the swap
-# state is the whole signal: the script waits for (b) rather than spending an
-# appear window on a job it cannot see and then relaunching on no evidence.
+# With no liveness signal to ask about, the install cannot be consulted at all,
+# so the swap state is the whole signal: the script waits for (b) rather than
+# spending an appear window on an install it cannot see and then relaunching on no
+# evidence. That covers both "no job label" and "no probe", and it is why an
+# install the app started itself - which has no job by construction - is asked
+# about by the installer's pid instead (install_live).
+#
+# "The install is over" is therefore install_live: the installer's own pid when
+# the app spawned it, and ShipIt's launchd job otherwise. The job is Squirrel's own
+# signal and is not deleted - a marker or a watchdog planned by the older version
+# still has only that one - but it is demoted, for a reason measured on this
+# machine: the job stays REGISTERED long after a successful install, so asking
+# launchd first would hold a finished install open for the whole bound.
 set -u
 APP_PID="\${LO_UPDATE_WATCHDOG_APP_PID:-}"
 BUNDLE="\${LO_UPDATE_WATCHDOG_APP_BUNDLE:-}"
 NAME="\${LO_UPDATE_WATCHDOG_APP_NAME:-}"
 SHIPIT_JOB="\${LO_UPDATE_WATCHDOG_SHIPIT_JOB:-}"
+# The installer's own pid, when the app started the installer itself. An install
+# started that way has no launchd job to ask about, so this is the whole liveness
+# signal and the job label above is not consulted at all - see install_live.
+INSTALLER_PID="\${LO_UPDATE_WATCHDOG_INSTALLER_PID:-}"
 TARGET_VERSION="\${LO_UPDATE_WATCHDOG_TARGET_VERSION:-}"
+# The two facts that identify this install's installer when the recorded pid is no
+# longer it: this app's own ShipIt, and this app's own staging root. Empty (an
+# older plan, or a platform the app could not resolve them on) means the second
+# half of installer_running declines rather than guessing - the pid alone decides,
+# which is exactly what this script did before review R2-1.
+SHIPIT_PATH="\${LO_UPDATE_WATCHDOG_SHIPIT_PATH:-}"
+STAGING_ROOT="\${LO_UPDATE_WATCHDOG_STAGING_ROOT:-}"
 # The two probes, from the platform the plan was built for. Empty means the
 # platform has no such tool and the signal is unavailable - not "the job is not
 # loaded" and not "the swap has not landed". shipit_loaded, swap_landed and
@@ -3230,6 +3429,57 @@ if [ -z "$APP_PID" ] || [ -z "$BUNDLE" ]; then
 fi
 now() { date +%s; }
 app_running() { kill -0 "$APP_PID" 2>/dev/null; }
+# Whether ANY process is this install's ShipIt, for the pid that stopped being it.
+#
+# The same two facts installerElsewhere requires of a line in its listing: this
+# app's OWN ShipIt path AND a state plist under this app's OWN staging root. Both,
+# never either - this machine runs several other applications' ShipIt processes,
+# and a live foreign one must not be read as this install's.
+#
+# One listing per call and only reached when the recorded pid has stopped
+# answering, which is the same economy the app's own reader keeps: a live pid is
+# the whole answer (installer_running below).
+shipit_elsewhere() {
+	[ -n "$SHIPIT_PATH" ] && [ -n "$STAGING_ROOT" ] || return 1
+	ps -Ao command= -ww 2>/dev/null | grep -F "$SHIPIT_PATH" | grep -F "$STAGING_ROOT" >/dev/null 2>&1
+}
+# The installer the app spawned, alive or gone. A pid with nothing under it is
+# gone, which is the same question app_running asks of the app and the same one
+# the app's own reap asks of a watchdog.
+#
+# TWO STEPS, because the app's own reader has two (review R2-1: installLivenessNow
+# asks installerIsAlive, and installerElsewhere before it declares the installer
+# dead). One pid is a snapshot: the spawner execs ShipIt so the common case keeps
+# the pid, but a ShipIt that re-execs or forks internally would leave the recorded
+# pid dead while an install it is in the middle of continues - and a script that
+# read that as "the install is over" would relaunch the app into it, which is the
+# Code=-9 abort this whole change exists to remove.
+#
+# The one asymmetry is deliberate and it is in the FIRST step only: the app also
+# reads the pid's command line (installerIsAlive), because a false "alive" there
+# would make recovery refuse forever. Here the only cost of a stale pid being
+# reused is waiting out the bound, and the bound is what ends it - so this asks
+# kill -0 and spends no listing on a pid that answers. The second step is not
+# optional in the same way: its false negative is the direction that starts the
+# app into a live install.
+installer_running() {
+	[ -n "$INSTALLER_PID" ] || return 1
+	if kill -0 "$INSTALLER_PID" 2>/dev/null; then return 0; fi
+	shipit_elsewhere
+}
+# "The install is still running", from whichever signal this install has: the pid
+# the app spawned, or - for an install Squirrel submitted - the job. There is
+# never both: an install the app started itself has no job, and the fallback
+# install has no pid. Asking launchd first would be wrong rather than merely
+# redundant, because this machine keeps the job REGISTERED long after a
+# successful install and a registered job is not a running one.
+install_live() {
+	if [ -n "$INSTALLER_PID" ]; then
+		installer_running
+		return $?
+	fi
+	shipit_loaded
+}
 # Tell the user what is going on, in the only way available: the app is dead
 # while this runs, so this is osascript and nothing else - no app process, no
 # updater. Backgrounded and status-dropped, because a notification is best-effort
@@ -3378,8 +3628,14 @@ swap_landed() {
 }
 job_known=0
 [ -n "$SHIPIT_PROBE" ] && [ -n "$SHIPIT_JOB" ] && job_known=1
+# Whether there is any liveness signal to ask at all. An absent signal is not "the
+# install is over": with neither one the script has the swap state and the bound,
+# exactly as it does on a platform with no probes.
+signal_known=0
+[ -n "$INSTALLER_PID" ] && signal_known=1
+[ "$job_known" -eq 1 ] && signal_known=1
 decided() {
-	if [ "$job_known" -eq 1 ] && ! shipit_loaded; then return 0; fi
+	if [ "$signal_known" -eq 1 ] && ! install_live; then return 0; fi
 	swap_landed && return 0
 	return 1
 }
@@ -3390,28 +3646,69 @@ while app_running; do
 	if [ "$(now)" -ge "$deadline" ]; then break; fi
 	sleep ${intervalSeconds}
 done
-# 1b. The app is gone, so an install is at work: say so a few seconds in, so the
-#     window that just vanished comes with an explanation. This is the moment the
-#     operator of 2026-09-13 was left guessing, and reopening the app four
-#     minutes later is what aborted their install. Skipped when the app is still
-#     running - a quit the user cancelled, where nothing is being installed and
-#     nothing should be claimed.
+# 1b. The app is gone and an install is at work, so the window that just
+#     vanished owes the person an explanation a few seconds in. Only the PAUSE is
+#     here: the notice is raised at 2b below, once the liveness question has an
+#     answer (QA round 2, Q1).
+#
+#     It used to be raised from here, and that is the one thing this step could
+#     not do on Squirrel's path: the job is submitted as part of the quit, so
+#     launchd can answer 113 for the first seconds of the appear window below -
+#     which is exactly why that window exists - and a gate evaluated once, before
+#     the thing it gates on has appeared, suppressed the only notice the user was
+#     going to get in the moment they most needed it.
 if ! app_running; then
 	sleep ${announceSeconds}
-	notify "Installing the update. Keep Local Operator closed until it opens again by itself — this can take a few minutes."
 fi
-# 2. ShipIt's job is submitted as part of the quit, so it may not be loaded the
-#    instant the app is gone: give it a bounded window to appear before treating
-#    "no job" as "the install is over". Skipped when there is no label to ask
-#    about: an appear window for an unaskable job is 30s of pretending, and it
-#    used to end by relaunching with no evidence about the install at all.
-if [ "$job_known" -eq 1 ]; then
+# 2. An install Squirrel submitted starts as part of the quit, so it may not be
+#    visible the instant the app is gone: give it a bounded window to appear
+#    before treating "nothing there" as "the install is over". Two cases skip it,
+#    and the second is UX U6:
+#
+#      - no signal to ask about: an appear window for an unaskable install is
+#        ${appearSeconds}s of pretending, and it used to end by relaunching with
+#        no evidence at all;
+#      - an installer THIS APP spawned itself. That pid exists before the quit, so
+#        the window cannot tell a late start from no start at all: if it is gone at
+#        the first poll the install is over (or never began), and waiting out the
+#        window only pushes the failure report and the app's return half a minute
+#        further away.
+if [ "$signal_known" -eq 1 ] && [ -z "$INSTALLER_PID" ]; then
 	appear_deadline=$(( $(now) + ${appearSeconds} ))
-	while ! shipit_loaded; do
+	while ! install_live; do
 		if [ "$(now)" -ge "$appear_deadline" ] || [ "$(now)" -ge "$deadline" ]; then break; fi
 		sleep ${intervalSeconds}
 	done
 fi
+# 2b. The window that vanished, explained - and it is raised HERE rather than at
+#     1b so that on Squirrel's path it is asked once the job it asks about has
+#     been submitted (QA round 2, Q1). The two conditions are the ones the notice
+#     has to meet, each of them a defect it once had (UX U1):
+#
+#       - the app is still gone: a quit the user cancelled installs nothing, and
+#         nothing should be claimed;
+#       - the install is STILL RUNNING at the moment the notice is raised. Naming
+#         a duration was the other half of that defect: it promised minutes, and
+#         on the direct path the whole window is 2-5 s - so the notice arrived
+#         telling a person to keep closed an app ShipIt had already reopened. The
+#         instruction that matters, "don't reopen it", is the same on both paths
+#         and is all this says now.
+#
+#     What moving it costs: on Squirrel's path the notice now waits for the job to
+#     appear (the loop above breaks the moment it does, so that is a poll
+#     interval, not the whole window), and a job that never appears raises no
+#     notice at all - correct, because nothing is installing and the app is about
+#     to come back with its own failure panel. On the direct path the loop is
+#     skipped and this is the same instant the old code used.
+#
+#     With no signal to ask about, the notice is unconditional: an install that
+#     cannot be asked about cannot be shown to be over either, and staying silent
+#     there would be the original defect back again.
+if ! app_running; then
+	if [ "$signal_known" -eq 0 ] || install_live; then
+		notify "Installing the update. Keep Local Operator closed until it opens again by itself."
+	fi
+fi
 # 3. Wait for the install to be decided - by the job going, or by the swap
 #    landing. The soft bound ends this wait only when there is no loaded job
 #    answering for the install: see the hold below.
@@ -3419,7 +3716,7 @@ holding=0
 while :; do
 	if decided; then break; fi
 	if [ "$(now)" -ge "$deadline" ]; then
-		if [ "$job_known" -eq 1 ] && shipit_loaded; then
+		if [ "$signal_known" -eq 1 ] && install_live; then
 			holding=1
 			notify "The update is still installing. Keep Local Operator closed; it will open again when the install finishes."
 		fi
@@ -3457,9 +3754,23 @@ if [ "$holding" -eq 1 ]; then
 fi
 # Let Squirrel's own relaunch (which happens as the job finishes) land first.
 sleep ${settleSeconds}
-# 4. Nothing to do if Squirrel relaunched the app or the user started it. This is
-#    what makes the script a no-op when the install succeeded, by construction
-#    rather than by claim.
+# 4. A landed swap gets a LAUNCH OF ITS OWN, and the only difference is -g, which
+#    is UX U7. ShipIt relaunches the app itself once it has swapped - that
+#    instruction IS the state plist this app writes (launchAfterInstallation) - so
+#    on a successful install the app was already back, under a new pid, when this
+#    ran, and the unflagged open -a below fronted a window the user was working in
+#    ~40 s after an install that takes seconds. The check above cannot see that
+#    instance: it holds the OLD pid, which is dead by then, and a name probe must
+#    not be used here (the script's own text is in the watchdog's command line, so
+#    "is anything named like the app running" answers yes about the watchdog). So
+#    the launch still happens - the app has to be running whether or not ShipIt's
+#    own relaunch worked - and -g is what keeps it from taking focus.
+if swap_landed; then
+	if [ -n "$NAME" ] && [ -x "$BUNDLE/Contents/MacOS/$NAME" ]; then
+		open -g -a "$BUNDLE" >/dev/null 2>&1 || "$BUNDLE/Contents/MacOS/$NAME" >/dev/null 2>&1 &
+	fi
+	exit 0
+fi
 if app_running; then exit 0; fi
 if [ -n "$NAME" ] && [ -x "$BUNDLE/Contents/MacOS/$NAME" ]; then
 	open -a "$BUNDLE" >/dev/null 2>&1 || "$BUNDLE/Contents/MacOS/$NAME" >/dev/null 2>&1 &
@@ -3473,6 +3784,15 @@ exit 0
       LO_UPDATE_WATCHDOG_APP_BUNDLE: input.appBundlePath,
       LO_UPDATE_WATCHDOG_APP_NAME: input.executableName,
       LO_UPDATE_WATCHDOG_SHIPIT_JOB: input.shipItJob ?? "",
+      // Empty rather than absent when the app spawned no installer: the script
+      // reads this with a default (`:-`) and its emptiness is the whole answer to
+      // "which liveness signal is this install's" (see `install_live`).
+      LO_UPDATE_WATCHDOG_INSTALLER_PID: input.installerPid != null ? String(input.installerPid) : "",
+      // The identity pair, empty rather than absent for the same reason as the pid:
+      // the script reads them with `:-` defaults and an empty value is the whole
+      // answer to "can this install's installer be recognised under another pid".
+      LO_UPDATE_WATCHDOG_SHIPIT_PATH: input.shipItPath ?? "",
+      LO_UPDATE_WATCHDOG_STAGING_ROOT: input.stagingRoot ?? "",
       LO_UPDATE_WATCHDOG_TARGET_VERSION: input.targetVersion ?? "",
       // Empty off macOS, which the script reads as "this signal is not available
       // here" rather than as a negative answer (see `watchdogSignals`).
@@ -17875,6 +18195,7 @@ function serverUpdateFailureSentence(input) {
 const VERSION_LINE_REGEX = /Version:\s*([^\n]+)/;
 const VERSION_CLEAN_REGEX = /^v/i;
 const BETA_VERSION_REGEX = /v\d+\.\d+\.\d+\.beta\.\d+/;
+const ARCHITECTURE_SEPARATOR_REGEX = /\s+/;
 const GLOBAL_UPDATE_TIMEOUT_MS = 15 * 60 * 1e3;
 const SOURCE_REBUILD_TIMEOUT_MS = 30 * 60 * 1e3;
 const BUNDLE_ID_REGEX = /^[\w.-]+$/;
@@ -17938,6 +18259,112 @@ function readCommandOutput(command, args) {
     return null;
   }
 }
+function runExtraction(zipPath, stagingRoot, options = {}) {
+  const command = options.command ?? DITTO_PATH;
+  const timeoutMs = options.timeoutMs ?? EXTRACTION_TIMEOUT_MS;
+  return new Promise((resolve) => {
+    let settled = false;
+    const finish = (result) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve(result);
+    };
+    const child = node_child_process.spawn(command, extractionArguments(zipPath, stagingRoot), {
+      /*
+       * Its own process group, so the bound below can take down the whole tree.
+       * A kill by pid alone leaves anything the extractor started running, and
+       * this is the one process in the change that is killed rather than waited
+       * for: the same teardown discipline the app applies to its own children,
+       * for the same reason - a half-written staging tree with a live process
+       * inside it is worse than no staging tree.
+       */
+      detached: true,
+      stdio: ["ignore", "ignore", "pipe"]
+    });
+    let stderr = "";
+    child.stderr?.on("data", (chunk) => {
+      stderr += String(chunk);
+    });
+    const timer = setTimeout(() => {
+      logger.warn(
+        `The update bundle's extraction did not finish within ${timeoutMs} ms; stopping it.`,
+        LogFileType.UPDATE_SERVICE
+      );
+      killExtractionTree(
+        child.pid,
+        (message) => logger.warn(message, LogFileType.UPDATE_SERVICE)
+      );
+      finish({
+        ok: false,
+        reason: `it was still running after ${timeoutMs} ms`
+      });
+    }, timeoutMs);
+    child.on("error", (error) => finish({ ok: false, reason: String(error) }));
+    child.on(
+      "close",
+      (code) => finish(
+        code === 0 ? { ok: true } : {
+          ok: false,
+          reason: `ditto exited ${code}${stderr.trim() ? `: ${stderr.trim()}` : ""}`
+        }
+      )
+    );
+  });
+}
+function killExtractionTree(pid, warn) {
+  if (pid == null) return;
+  try {
+    process.kill(-pid, "SIGKILL");
+  } catch (groupError) {
+    try {
+      process.kill(pid, "SIGKILL");
+    } catch (error) {
+      warn(
+        `Could not stop the wedged extraction (pid ${pid}): ${String(error)}`
+      );
+    }
+  }
+}
+function isExecutableFile(path2) {
+  try {
+    fs.accessSync(path2, fs.constants.X_OK);
+    return fs.statSync(path2).isFile();
+  } catch {
+    return false;
+  }
+}
+function deviceId(target2) {
+  try {
+    return fs.statSync(target2).dev;
+  } catch {
+    return null;
+  }
+}
+function readPlistValue(plistPath, key) {
+  return readCommandOutput("/usr/bin/plutil", [
+    "-extract",
+    key,
+    "raw",
+    "-o",
+    "-",
+    plistPath
+  ]);
+}
+function readStagedBundle(appPath) {
+  const plistPath = path$1.join(appPath, "Contents", "Info.plist");
+  const executableName = readPlistValue(plistPath, "CFBundleExecutable");
+  const executablePath = executableName == null ? null : path$1.join(appPath, "Contents", "MacOS", executableName);
+  const architectures2 = executablePath != null && fs.existsSync(executablePath) ? (readCommandOutput("/usr/bin/lipo", ["-archs", executablePath]) ?? "").split(ARCHITECTURE_SEPARATOR_REGEX).filter((entry) => entry.length > 0) : null;
+  return {
+    appPath,
+    exists: fs.existsSync(appPath),
+    bundleIdentifier: readPlistValue(plistPath, "CFBundleIdentifier"),
+    version: readPlistValue(plistPath, "CFBundleShortVersionString"),
+    executablePresent: executablePath != null && fs.existsSync(executablePath),
+    architectures: architectures2 && architectures2.length > 0 ? architectures2 : null
+  };
+}
 const INSTALLER_PROBE_TIMEOUT_MS = 5e3;
 const DRIFT_HOLD_REPORT = {
   "no-drift": "nothing to do",
@@ -18020,6 +18447,34 @@ function probeShipItInstallJobState() {
     return result.error || result.status == null ? null : { status: result.status, output: result.stdout ?? "" };
   });
 }
+function installLivenessFor(input) {
+  const commandLine = input.installerCommandLine ?? defaultInstallerCommandLine;
+  const processList = input.processList ?? defaultProcessList;
+  const bundlePath = input.bundlePath ?? (() => appBundleFromExecutable(process.execPath));
+  const shipItPath = shipItPathInBundle(bundlePath());
+  const stagingRoot = updateStagingRoot(electron.app.getPath("userData"));
+  return installLivenessNow({
+    marker: input.marker,
+    installerCommandLine: () => {
+      const pid = input.marker?.installerPid ?? null;
+      return pid == null ? null : commandLine(pid);
+    },
+    installerElsewhere: () => installerElsewhere({
+      processList: processList(),
+      shipItPath,
+      stagingRoot
+    }),
+    shipItPath,
+    stagingRoot,
+    jobState: input.jobState ?? probeShipItInstallJobState
+  });
+}
+function defaultInstallerCommandLine(pid) {
+  return readCommandOutput("/bin/ps", ["-o", "command=", "-p", String(pid)]);
+}
+function defaultProcessList() {
+  return readCommandOutput("/bin/ps", ["-Ao", "command=", "-ww"]);
+}
 function startRelaunchWatchdog(input) {
   if (process.platform !== "darwin" || !electron.app.isPackaged) return null;
   const bundlePath = appBundleFromExecutable(process.execPath);
@@ -18031,6 +18486,16 @@ function startRelaunchWatchdog(input) {
     // watchdog cannot ask a name about its own ancestor (review R1).
     appPid: process.pid,
     shipItJob: shipItJobForRunningBundle(),
+    // The installer this app started itself, when there is one: without it the
+    // script would wait on a launchd job that this path never submits, and settle
+    // on the bound instead of on the install (management MAJOR-1).
+    installerPid: input.installerPid ?? null,
+    // The same two facts `installerIsAlive`/`installerElsewhere` use on this side
+    // of the seam, so the script's own "is the installer gone" answer cannot
+    // disagree with the app's (review R2-1): the script asks them of a process
+    // listing before it relaunches the app into an install that is still running.
+    shipItPath: shipItPathInBundle(bundlePath),
+    stagingRoot: updateStagingRoot(electron.app.getPath("userData")),
     // What "the install is over" is measured against on disk (review R11):
     // the updater's advertised version, and nothing that is already in place
     // (review R15).
@@ -18053,7 +18518,7 @@ function startRelaunchWatchdog(input) {
     });
     child.unref();
     input.log(
-      `Started the update relaunch watchdog (pid ${child.pid ?? "unknown"}): it starts the app again as soon as the install's job goes or version ${plan.env.LO_UPDATE_WATCHDOG_TARGET_VERSION || "unknown"} is in place, and at the ${plan.timeoutSeconds}s bound if neither happens - or at the ${plan.hardTimeoutSeconds}s hard bound when the install's job is still loaded at the first, which is the case where starting the app would cancel the install.`
+      `Started the update relaunch watchdog (pid ${child.pid ?? "unknown"}): it starts the app again as soon as ${input.installerPid != null ? "the installer this app started is gone" : "the install's job goes"} or version ${plan.env.LO_UPDATE_WATCHDOG_TARGET_VERSION || "unknown"} is in place, and at the ${plan.timeoutSeconds}s bound if neither happens - or at the ${plan.hardTimeoutSeconds}s hard bound when the install is still live at the first, which is the case where starting the app would cancel the install.`
     );
     return child.pid ?? null;
   } catch (error) {
@@ -18074,9 +18539,12 @@ function ensureRelaunchWatchdog(input) {
     );
     return true;
   }
-  const launched = input.startWatchdog(input.marker.targetVersion);
+  const launched = input.startWatchdog(
+    input.marker.targetVersion,
+    input.marker.installerPid ?? null
+  );
   input.log(
-    launched != null ? `Started relaunch watchdog ${launched} for the install already in flight; it will start the app when the install's job goes.` : "No relaunch watchdog is running for the install in flight and none could be started; the app will need starting by hand after it quits."
+    launched != null ? `Started relaunch watchdog ${launched} for the install already in flight; it will start the app when the install goes.` : "No relaunch watchdog is running for the install in flight and none could be started; the app will need starting by hand after it quits."
   );
   return launched != null;
 }
@@ -18152,16 +18620,20 @@ async function showInstallHoldNotice(notice, bannerDeadlineMs = LAUNCH_HOLD_NOTI
 function holdLaunchForLiveInstall(options) {
   if (!electron.app.isPackaged) return false;
   const marker = readPendingInstallMarker(electron.app.getPath("userData"));
-  const jobState = (options.jobState ?? probeShipItInstallJobState)();
+  const liveness = installLivenessFor({
+    marker,
+    jobState: options.jobState,
+    installerCommandLine: options.installerCommandLine
+  });
   const reading = evaluateLaunchDuringInstall({
     marker,
-    jobState,
+    liveness,
     runningVersion: options.runningVersion ?? electron.app.getVersion(),
     now: options.now
   });
   if (reading.kind === "open") return false;
   options.log(
-    `Holding this launch for the install of version ${reading.marker.targetVersion} that is still running (install job ${jobState}): a window here would make this process the running instance Squirrel's final check aborts the install on, so the app tells the user and quits.`
+    `Holding this launch for the install of version ${reading.marker.targetVersion} that is still running (${installLivenessText(liveness, reading.marker.installerPid)}): a window here would make this process the running instance Squirrel's final check aborts the install on, so the app tells the user and quits.`
   );
   const relaunchEnsured = ensureRelaunchWatchdog({
     marker: reading.marker,
@@ -18196,10 +18668,11 @@ function holdLaunchForLiveInstall(options) {
   });
   return true;
 }
-function defaultStartRelaunchWatchdog(targetVersion) {
+function defaultStartRelaunchWatchdog(targetVersion, installerPid) {
   return startRelaunchWatchdog({
     targetVersion,
     runningVersion: electron.app.getVersion(),
+    installerPid,
     log: (message) => logger.info(message, LogFileType.UPDATE_SERVICE)
   });
 }
@@ -18218,6 +18691,12 @@ class UpdateService {
    * available", which is how `shouldFilterUpdateError` would otherwise read it.
    */
   updateStage = "idle";
+  /**
+   * The install that just landed, for the one-line affirmation the next launch
+   * owes the user (UX U4). Null once it has been reported.
+   */
+  pendingInstallSucceeded = null;
+  installSucceededDelivered = false;
   /**
    * How many app-channel checks are in flight right now.
    *
@@ -18273,6 +18752,17 @@ class UpdateService {
   lastPublishedBackendVersion = null;
   /** Path of the artifact this run downloaded, when the updater reported one. */
   downloadedArtifactPath = null;
+  /**
+   * The artifact path the current pre-flight verified, for the staging step.
+   *
+   * `ensureStagedArtifactVerified` resolves it (the updater's own recorded path
+   * first, then the cache's pending directory) and hashes it; staging needs the
+   * same path and must not resolve it a second time, because the second answer is
+   * allowed to be a different file than the one whose sha512 was checked. Set
+   * only on a passing pre-flight, so a refusal leaves this null and staging
+   * refuses too (`stageInstallerHandoff`).
+   */
+  verifiedArtifactPath = null;
   /**
    * Artifacts that failed their size/sha512/disk check, by version.
    *
@@ -18541,17 +19031,17 @@ class UpdateService {
       return;
     }
     const marker = readPendingInstallMarker(this.markerDir());
-    const jobState = this.shipItInstallJobState();
+    const liveness = this.installLiveness(marker);
     if (marker) {
       logger.info(
-        `Pending install marker for version ${marker.targetVersion} on disk; its install job is ${jobState}.`,
+        `Pending install marker for version ${marker.targetVersion} on disk; ${installLivenessText(liveness, marker.installerPid)}.`,
         LogFileType.UPDATE_SERVICE
       );
     }
     const outcome = evaluatePendingInstall({
       marker,
       runningVersion: electron.app.getVersion(),
-      // Probed once per evaluation, and only on macOS: a RUNNING job plus a
+      // Probed once per evaluation, and only on macOS: a live installer plus a
       // current marker is what makes "still on the old version" an install in
       // progress rather than an install that failed. A job that is registered
       // but not running is the state a finished install leaves behind, and
@@ -18562,7 +19052,8 @@ class UpdateService {
       // bounds (review R6, R11).
       installInFlight: isInstallInFlight({
         marker,
-        jobState
+        jobState: liveness.jobState,
+        installerRunning: liveness.installerRunning
       })
     });
     switch (outcome.kind) {
@@ -18574,8 +19065,13 @@ class UpdateService {
           LogFileType.UPDATE_SERVICE
         );
         this.reapWatchdog(outcome.marker, true);
+        this.reapStagedUpdateTrees();
         clearPendingInstallMarker(this.markerDir());
         this.retireSupersededInstallRecord();
+        this.pendingInstallSucceeded = {
+          version: outcome.marker.targetVersion
+        };
+        this.scheduleInstallSucceededDelivery();
         return;
       case "stale":
         logger.info(
@@ -18583,13 +19079,14 @@ class UpdateService {
           LogFileType.UPDATE_SERVICE
         );
         this.reapWatchdog(outcome.marker, true);
+        this.reapStagedUpdateTrees();
         clearPendingInstallMarker(this.markerDir());
         this.retireSupersededInstallRecord();
         return;
       case "in-flight": {
         this.installWasInFlight = true;
         logger.info(
-          `Update marker: the install of version ${outcome.marker.targetVersion} is still running (install job ${jobState}). Leaving the marker, the install job and the relaunch watchdog in place.`,
+          `Update marker: the install of version ${outcome.marker.targetVersion} is still running (${installLivenessText(liveness, outcome.marker.installerPid)}). Leaving the marker, the staged tree, the install job and the relaunch watchdog in place.`,
           LogFileType.UPDATE_SERVICE
         );
         this.pendingInstallInFlight = installInFlightPayload(
@@ -18634,6 +19131,7 @@ class UpdateService {
         this.stopInstallInFlightRecheck();
         this.reapWatchdog(outcome.marker, false);
         this.reapFailedInstallLeftovers();
+        this.reapStagedUpdateTrees();
         this.schedulePendingInstallFailureDelivery();
       }
     }
@@ -18645,7 +19143,14 @@ class UpdateService {
    * before a service exists; the rule itself lives there.
    */
   bundleIdentifier() {
-    return runningBundleIdentifier();
+    const bundlePath = this.runningBundleProbe ? this.runningBundleProbe() : appBundleFromExecutable(process.execPath);
+    if (!bundlePath) return null;
+    const value = readCommandOutput("/usr/bin/defaults", [
+      "read",
+      path$1.join(bundlePath, "Contents", "Info.plist"),
+      "CFBundleIdentifier"
+    ]);
+    return value && BUNDLE_ID_REGEX.test(value) ? value : null;
   }
   /**
    * Squirrel's own stderr log for this app, when it exists.
@@ -18804,6 +19309,23 @@ class UpdateService {
    * it.
    */
   installJobStateProbe = null;
+  /**
+   * The `.app` a harness wants this service to treat as the one it runs from.
+   *
+   * A seam, and only a seam: production never sets it, and it exists because
+   * `appBundleFromExecutable(process.execPath)` answers "not a bundle" for every
+   * process that is not a packaged Electron app - which is every harness that
+   * drives this module. Without it, the staging step and the installer's own
+   * liveness could only be asserted by reading their source, and the shipped
+   * code (the `ditto` extraction, the seal probe, the state plist, the detached
+   * spawner) would be exactly the part nothing exercises.
+   *
+   * Substituting it does not change what the code does to the substitute: the
+   * bundle that is pointed at is staged, sealed, probed and handed over as if it
+   * were the running one, and a test that points it at a bundle it built in its
+   * own scratch directory is driving the real path rather than a stub.
+   */
+  runningBundleProbe = null;
   /**
    * What this app's ShipIt install job is doing, right now.
    *
@@ -18819,6 +19341,19 @@ class UpdateService {
     if (this.installJobStateProbe) return this.installJobStateProbe();
     return probeShipItInstallJobState();
   }
+  /**
+   * What the pre-quit work is doing, on the update surface that is already up.
+   *
+   * A phase rather than a percentage: the three steps are `codesign` over the
+   * installed bundle plus a hash of the artifact, the `ditto` extraction and its
+   * seal probe, and the spawn - each of them one indivisible call this app does not
+   * get progress out of, and inventing a bar for them would be a lie about what is
+   * known (UX U5). Sent before each step starts, so the sentence on screen always
+   * names the work that is actually happening.
+   */
+  reportInstallProgress(phase) {
+    this.sendToRenderer("update-install-progress", { phase });
+  }
   /**
    * Deliver the still-installing notice once the renderer can hear it.
    *
@@ -18835,6 +19370,39 @@ class UpdateService {
     }
     setTimeout(deliver, 5e3);
   }
+  /**
+   * Deliver the "the update went in" notice once the renderer can hear it.
+   *
+   * Same shape and the same reason as the in-flight and failure notices: recovery
+   * runs while the window is still loading, and the component subscribes from a
+   * React effect that can run after `did-finish-load`. Unlike the failure there is
+   * nothing to keep on disk if the push is lost - the marker is cleared either way,
+   * because it is the marker's job to be gone and this is a courtesy - so a missed
+   * notice costs the sentence and nothing else.
+   */
+  scheduleInstallSucceededDelivery() {
+    if (!this.pendingInstallSucceeded || this.installSucceededDelivered) return;
+    const deliver = () => this.deliverPendingInstallSucceeded();
+    const webContents = this.mainWindow?.webContents;
+    if (webContents && !webContents.isDestroyed()) {
+      webContents.once("did-finish-load", deliver);
+    }
+    setTimeout(deliver, 5e3);
+  }
+  deliverPendingInstallSucceeded() {
+    if (!this.pendingInstallSucceeded || this.installSucceededDelivered) return;
+    if (!this.sendToRenderer(
+      "update-install-succeeded",
+      this.pendingInstallSucceeded
+    )) {
+      return;
+    }
+    this.installSucceededDelivered = true;
+    logger.info(
+      "Reported a completed update install to the renderer",
+      LogFileType.UPDATE_SERVICE
+    );
+  }
   deliverPendingInstallInFlight() {
     if (!this.pendingInstallInFlight || this.installInFlightDelivered) return;
     if (!this.sendToRenderer(
@@ -18887,8 +19455,12 @@ class UpdateService {
       marker,
       // The service's own method, not the module function, because a harness
       // substitutes this one: substituting the seam is how a test counts the
-      // watchdogs a quit leaves running without spawning any.
-      startWatchdog: (targetVersion) => this.launchWatchdog(targetVersion),
+      // watchdogs a quit leaves running without spawning any. The marker's own
+      // installer pid travels with the call: a watchdog ensured for an install
+      // that is already in flight has to hold on the signal that install is
+      // actually visible by, and for an install this app started itself that is
+      // the pid rather than a job that will never appear (management MAJOR-1).
+      startWatchdog: (targetVersion, installerPid) => this.launchWatchdog(targetVersion, installerPid),
       log: (message) => logger.info(message, LogFileType.UPDATE_SERVICE)
     });
   }
@@ -18896,16 +19468,18 @@ class UpdateService {
    * The pending-install marker, if the machine says an install is live now.
    *
    * The marker is read first, because the ordinary answer to "is an update
-   * installing" is no and a file read answers it; the launchd probe behind it is
-   * a process spawn and is only worth paying for when there is a marker to ask
-   * about.
+   * installing" is no and a file read answers it; the probes behind it are process
+   * spawns and are only worth paying for when there is a marker to ask about - and
+   * only the one that can answer for that marker is paid for.
    */
   livePendingInstallMarker() {
     const marker = readPendingInstallMarker(this.markerDir());
     if (!marker) return null;
+    const liveness = this.installLiveness(marker);
     return isInstallInFlight({
       marker,
-      jobState: this.shipItInstallJobState()
+      jobState: liveness.jobState,
+      installerRunning: liveness.installerRunning
     }) ? marker : null;
   }
   /**
@@ -19049,6 +19623,7 @@ class UpdateService {
    * against.
    */
   runningBundlePath() {
+    if (this.runningBundleProbe) return this.runningBundleProbe();
     if (process.platform !== "darwin" || !electron.app.isPackaged) return null;
     const bundlePath = appBundleFromExecutable(process.execPath);
     if (!bundlePath) {
@@ -19353,6 +19928,7 @@ ${heal.removed.join("\n")}`,
       version: info?.version ?? null
     });
     if (verdict.ok) {
+      this.verifiedArtifactPath = artifactPath;
       const required = requiredDiskBytes({
         artifactSize: verdict.size,
         installedBundleSize: installedBundleSize ?? 0
@@ -19490,6 +20066,290 @@ ${heal.removed.join("\n")}`,
     if (sealBlock) return sealBlock;
     return this.ensureStagedArtifactVerified(info);
   }
+  /**
+   * The update bundle this app staged for itself, and everything ShipIt needs to
+   * be pointed at it.
+   *
+   * Assembled in one place rather than passed as six arguments: the spawner, the
+   * state plist and the marker all have to agree about which staging directory
+   * this install got, and a path computed twice is two chances to disagree.
+   */
+  async stageInstallerHandoff(info) {
+    const refuse = (reason) => {
+      logger.info(
+        `Not staging the update for the installer: ${reason}. The install will be handed to Squirrel's own path instead, which takes minutes but is the same install.`,
+        LogFileType.UPDATE_SERVICE
+      );
+      return { kind: "fallback" };
+    };
+    const block = (detail, message, remedy) => {
+      logger.warn(
+        `Refusing to install the staged update: ${detail}`,
+        LogFileType.UPDATE_SERVICE
+      );
+      return {
+        kind: "blocked",
+        block: {
+          code: "download-verification-failed",
+          message,
+          remedy: { text: remedy },
+          detail
+        }
+      };
+    };
+    if (process.platform !== "darwin") {
+      return refuse("the installer this stages for is macOS's ShipIt");
+    }
+    if (!electron.app.isPackaged) {
+      return refuse("this instance is not the bundle an install replaces");
+    }
+    const bundlePath = this.runningBundlePath();
+    if (!bundlePath) {
+      return refuse("the running executable is not inside an app bundle");
+    }
+    const shipItPath = shipItPathInBundle(bundlePath);
+    if (!shipItPath || !isExecutableFile(shipItPath)) {
+      return refuse(
+        `${shipItPath ?? "no Squirrel.framework installer"} is not an executable inside the running bundle`
+      );
+    }
+    const bundleId = this.bundleIdentifier();
+    if (!bundleId) {
+      return refuse("the running bundle has no readable CFBundleIdentifier");
+    }
+    const version = info?.version ?? null;
+    if (!version) {
+      return refuse("the update carries no version to install");
+    }
+    const zipPath = this.verifiedArtifactPath;
+    if (!zipPath) {
+      return refuse("the pre-flight verified no artifact path to extract from");
+    }
+    const userDataDir = electron.app.getPath("userData");
+    const stagingRoot = updateStagingDir({
+      userDataDir,
+      version,
+      nonce: node_crypto.randomBytes(6).toString("hex")
+    });
+    if (!sameVolume(deviceId(userDataDir), deviceId(bundlePath))) {
+      return refuse(
+        `the staging root ${stagingRoot} is on a different volume from the bundle it replaces (${bundlePath})`
+      );
+    }
+    try {
+      fs.mkdirSync(stagingRoot, { recursive: true });
+    } catch (error) {
+      return refuse(`the staging root could not be created: ${String(error)}`);
+    }
+    const started = Date.now();
+    const extraction = await runExtraction(zipPath, stagingRoot);
+    if (!extraction.ok) {
+      return refuse(
+        `the update bundle could not be extracted (${extraction.reason})`
+      );
+    }
+    logger.info(
+      `Extracted the update bundle into ${stagingRoot} in ${Date.now() - started} ms.`,
+      LogFileType.UPDATE_SERVICE
+    );
+    const stagedAppPath = path$1.join(stagingRoot, path$1.basename(bundlePath));
+    const verdict = evaluateStagedBundle({
+      reading: readStagedBundle(stagedAppPath),
+      expectedBundleIdentifier: bundleId,
+      expectedVersion: version,
+      runningArchitecture: process.arch
+    });
+    if (!verdict.ok) {
+      return block(
+        `The staged update bundle is not this application: ${verdict.detail}.`,
+        `The downloaded update${versionSuffix(version)} is not this application, so it wasn't installed.`,
+        "Check for updates again to re-download the release."
+      );
+    }
+    let stagedSeal;
+    try {
+      ({ seal: stagedSeal } = await this.readBundleSeal(stagedAppPath));
+    } catch (error) {
+      return refuse(
+        `the staged bundle's seal could not be probed: ${String(error)}`
+      );
+    }
+    if (stagedSeal.kind === "unsealed") {
+      return block(
+        `The staged update bundle's seal reads \`unsealed\` (${stagedSeal.detail}), so Apple's own validation would have the same answer.`,
+        `The downloaded update${versionSuffix(version)} is damaged, so it wasn't installed.`,
+        "Check for updates again to re-download the release."
+      );
+    }
+    if (stagedSeal.kind !== "sealed") {
+      return refuse(
+        `the staged bundle's seal could not be read (${stagedSeal.detail})`
+      );
+    }
+    const statePath = stagingStatePath(stagingRoot);
+    try {
+      fs.writeFileSync(
+        statePath,
+        JSON.stringify(
+          shipItStatePlist({
+            bundleIdentifier: bundleId,
+            targetBundlePath: bundlePath,
+            updateBundlePath: stagedAppPath
+          })
+        )
+      );
+    } catch (error) {
+      return refuse(
+        `the installer's state plist could not be written: ${String(error)}`
+      );
+    }
+    const label = shipItJobLabel(bundleId);
+    const logPath = installerLogPath(
+      shipItCacheDir(path$1.join(os.homedir(), "Library", "Caches"), bundleId)
+    );
+    try {
+      fs.mkdirSync(path$1.dirname(logPath), { recursive: true });
+      fs.closeSync(fs.openSync(logPath, "a"));
+    } catch (error) {
+      return refuse(
+        `the installer's log ${logPath} could not be opened for appending: ${String(error)}`
+      );
+    }
+    return {
+      kind: "staged",
+      handoff: {
+        stagingRoot,
+        stagedAppPath,
+        shipItPath,
+        statePath,
+        label,
+        // The SAME log launchd's redirection writes for a Squirrel-run
+        // install: the failure panel's detail line and
+        // scripts/update-window-report.mjs both read that path (see
+        // installerLogPath).
+        logPath
+      }
+    };
+  }
+  /**
+   * Start the detached spawner that waits for this process to go, then installs.
+   *
+   * Detached with its stdio ignored, like the relaunch watchdog and for the same
+   * reason: it must outlive this process, and a pipe this process holds is a pipe
+   * that can keep it alive. Both of the installer's streams are appended to
+   * Squirrel's own log inside the script rather than inherited from here, so no
+   * descriptor of ours is passed at all.
+   *
+   * Returns the pid, which is the app's own answer to "is an install in flight"
+   * from this moment on (`installerPid` in the marker, `install_live` in the
+   * watchdog's script, `installLivenessNow` in recovery): the process is `exec`d
+   * into ShipIt, so this one pid covers the wait and the whole install.
+   */
+  startInstaller(handoff) {
+    const plan = buildInstallerSpawn({
+      appPid: process.pid,
+      shipItPath: handoff.shipItPath,
+      label: handoff.label,
+      statePath: handoff.statePath,
+      logPath: handoff.logPath
+    });
+    try {
+      const child = node_child_process.spawn("sh", plan.args, {
+        detached: true,
+        stdio: "ignore",
+        env: { ...process.env, ...plan.env }
+      });
+      child.unref();
+      if (child.pid == null) {
+        logger.error(
+          "The installer was spawned but reported no pid; falling back to Squirrel's own install path.",
+          LogFileType.UPDATE_SERVICE
+        );
+        return null;
+      }
+      logger.info(
+        `Started the installer (pid ${child.pid}) for version ${handoff.label}: it waits for this process (pid ${process.pid}) to go and then becomes ${handoff.shipItPath}, which installs ${handoff.stagedAppPath} and starts the app again.`,
+        LogFileType.UPDATE_SERVICE
+      );
+      return child.pid;
+    } catch (error) {
+      logger.error(
+        `Could not start the installer for ${handoff.stagedAppPath}: ${String(error)}`,
+        LogFileType.UPDATE_SERVICE
+      );
+      return null;
+    }
+  }
+  /**
+   * Stop a spawner that has been started but whose marker could not be written.
+   *
+   * The one hole in "spawn, then record": a spawner with no marker would wait
+   * for a quit that this process is not going to make, and a wait nothing can
+   * tell apart from an install in progress is worse than no installer at all. So
+   * the marker write is the only step whose failure undoes the spawn, and the
+   * error the caller sees is the same one it saw before this change.
+   */
+  abortInstaller(pid) {
+    try {
+      process.kill(pid, "SIGTERM");
+      logger.warn(
+        `Stopped the installer (pid ${pid}) because this app could not record the install it was started for.`,
+        LogFileType.UPDATE_SERVICE
+      );
+    } catch (error) {
+      logger.warn(
+        `Could not stop the installer (pid ${pid}) started for an install that was not recorded: ${String(error)}`,
+        LogFileType.UPDATE_SERVICE
+      );
+    }
+  }
+  /**
+   * Remove the staging trees left by installs that are over.
+   *
+   * The app owns this tree now where Squirrel used to own `update.<random>` under
+   * its own cache: it is one install's worth of app either way, but a Squirrel
+   * install's leftovers sit in Apple's cache directory and this one's sit in the
+   * app's own, so nothing else was ever going to clean them up. Called only from
+   * the branches that have decided an install is NOT in flight - reaping a tree a
+   * live installer is reading is the one thing this must never do (the design
+   * note's falsification list).
+   */
+  reapStagedUpdateTrees() {
+    const root = updateStagingRoot(electron.app.getPath("userData"));
+    if (!fs.existsSync(root)) return;
+    for (const entry of fs.readdirSync(root)) {
+      const tree = path$1.join(root, entry);
+      try {
+        reapStagedTree(tree);
+        logger.info(
+          `Reaped the staged update tree ${tree} left by an install that is not running.`,
+          LogFileType.UPDATE_SERVICE
+        );
+      } catch (error) {
+        logger.warn(
+          `Could not reap the staged update tree ${tree}: ${String(error)}`,
+          LogFileType.UPDATE_SERVICE
+        );
+      }
+    }
+  }
+  /**
+   * Both of the machine's liveness answers for this marker.
+   *
+   * The one place the machine is asked, so recovery's reading, the live re-check,
+   * the quit's own guard and the launch hold cannot disagree about the same install
+   * (management MAJOR-1). Which of the two decides (`installLivenessNow`) turns on
+   * the marker's own `installerPid`: an install this app started has no launchd
+   * job, and an install Squirrel submitted has no pid. Both probes are process
+   * spawns, so only the one that can answer is asked.
+   */
+  installLiveness(marker) {
+    return installLivenessFor({
+      marker,
+      bundlePath: () => this.runningBundlePath(),
+      jobState: () => this.shipItInstallJobState()
+    });
+  }
   /**
    * Start the detached relaunch watchdog.
    *
@@ -19497,10 +20357,11 @@ ${heal.removed.join("\n")}`,
    * uses; the plan, the bounds and the log line live there. Kept as a method
    * because a harness substitutes it to count watchdogs without spawning one.
    */
-  launchWatchdog(targetVersion) {
+  launchWatchdog(targetVersion, installerPid = null) {
     return startRelaunchWatchdog({
       targetVersion,
       runningVersion: electron.app.getVersion(),
+      installerPid,
       log: (message) => logger.info(message, LogFileType.UPDATE_SERVICE)
     });
   }
@@ -19917,8 +20778,16 @@ ${heal.removed.join("\n")}`,
       this.installPreflightInFlight = true;
       this.updateStage = "installing";
       let block = null;
+      let handoff = null;
+      this.reportInstallProgress("verifying");
       try {
         block = await this.runInstallPreflight(this.lastUpdateInfo);
+        if (!block) {
+          this.reportInstallProgress("staging");
+          const staged = await this.stageInstallerHandoff(this.lastUpdateInfo);
+          if (staged.kind === "staged") handoff = staged.handoff;
+          if (staged.kind === "blocked") block = staged.block;
+        }
         if (!block) await this.backendService?.stop(false);
       } catch (error) {
         this.updateStage = "idle";
@@ -19937,18 +20806,32 @@ ${heal.removed.join("\n")}`,
         return false;
       }
       const targetVersion = this.lastUpdateInfo?.version ?? electron.app.getVersion();
-      const watchdogPid = this.launchWatchdog(targetVersion);
-      const marker = writePendingInstallMarker(this.markerDir(), {
-        targetVersion,
-        artifactPath: this.downloadedArtifactPath ?? this.downloadHelper()?.file ?? "unknown",
-        startedAt: (/* @__PURE__ */ new Date()).toISOString(),
-        watchdogPid
-      });
+      if (handoff) this.reportInstallProgress("starting");
+      const installerPid = handoff ? this.startInstaller(handoff) : null;
+      const watchdogPid = this.launchWatchdog(targetVersion, installerPid);
+      let marker;
+      try {
+        marker = writePendingInstallMarker(this.markerDir(), {
+          targetVersion,
+          artifactPath: this.downloadedArtifactPath ?? this.downloadHelper()?.file ?? "unknown",
+          startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+          watchdogPid,
+          installerPid
+        });
+      } catch (error) {
+        if (installerPid != null) this.abortInstaller(installerPid);
+        this.updateStage = "idle";
+        throw error;
+      }
       logger.info(
-        `Pending install marker written for version ${marker.targetVersion} (watchdog pid ${watchdogPid ?? "none"}).`,
+        `Pending install marker written for version ${marker.targetVersion} (watchdog pid ${watchdogPid ?? "none"}, ${installerPid != null ? `installer pid ${installerPid}` : "Squirrel's own installer"}).`,
         LogFileType.UPDATE_SERVICE
       );
       this.backendService?.setAutoUpdating(true);
+      if (installerPid != null) {
+        electron.app.quit();
+        return true;
+      }
       electronUpdater.autoUpdater.quitAndInstall(false, true);
       return true;
     });