local-operator-ui 0.31.18 → 0.31.20

package/out/main/index.js

@@ -78,6 +78,9 @@ const DESKTOP_MESSAGE_MAX_CHARS = 2e5;
 const SESSION_SEARCH_MAX_CHARS = 256;
 const SESSION_SEARCH_DEFAULT_LIMIT = 100;
 const CHECKPOINT_WARM_MAX_IDS = 16;
+const THREAD_FIND_MAX_CHARS = 256;
+const THREAD_FIND_DEFAULT_LIMIT = 100;
+const THREAD_FIND_MAX_LIMIT = 200;
 const DESKTOP_SYSTEM_PROMPT_MAX_CHARS = 1e6;
 const profileName = zod.z.string().min(1).max(128).refine(
   (name) => name !== "." && name !== ".." && !name.includes("/") && !name.includes("\\") && [...name].every(
@@ -561,6 +564,30 @@ const desktopRequestUnion = zod.z.discriminatedUnion("op", [
     ids: zod.z.array(id$1).max(CHECKPOINT_WARM_MAX_IDS).optional(),
     limit: zod.z.number().int().min(1).max(CHECKPOINT_WARM_MAX_IDS).optional()
   }).strict(),
+  /*
+   * In-thread find (D9): messages of ONE conversation matching `q`, best
+   * first, served from the per-session transcript index.
+   *
+   * A READ like `history` and `checkpoints` beside it. The answer's `state` is
+   * the checkpoint manifest's own ladder: a cold or stale index answers
+   * `building` inside the first-paint budget (with hits ranked from the
+   * previous scan marked `partial`) while the background refresh runs, so the
+   * overlay's first paint is immediate; `unsupported` is a peer conversation
+   * whose journal is not on this device; `error` is a failed refresh inside
+   * its cooldown. The overlay renders both tiers (`exact`/`soft`) and treats
+   * `ranges` as snippet-relative — empty on a soft hit, which has no literal
+   * occurrence of the query by construction.
+   */
+  zod.z.object({
+    op: zod.z.literal("sessions.find"),
+    sessionId,
+    // `.min(1)`: an empty query is not a search. The overlay's client never
+    // sends one — it answers an empty query locally, without a request — so
+    // refusing it by name keeps the vocabulary closed rather than paying a
+    // round trip for an answer the box already knows.
+    q: zod.z.string().min(1).max(THREAD_FIND_MAX_CHARS),
+    limit: zod.z.number().int().min(1).max(THREAD_FIND_MAX_LIMIT).optional()
+  }).strict(),
   /*
    * One child's durable transcript, for the run panel's reader
    * (`docs/run-sidebar.md` § 10.1, § 10.3).
@@ -1794,6 +1821,7 @@ const READ_ONLY_OPS = /* @__PURE__ */ new Set([
   "sessions.aside.get",
   "sessions.checkpoints",
   "sessions.failovers",
+  "sessions.find",
   "sessions.get",
   "sessions.history",
   "sessions.list",
@@ -2086,6 +2114,16 @@ function desktopEndpoint(request) {
           ...request.limit !== void 0 ? { limit: request.limit } : {}
         }
       };
+    case "sessions.find": {
+      const query = new URLSearchParams({
+        q: request.q,
+        limit: String(request.limit ?? THREAD_FIND_DEFAULT_LIMIT)
+      });
+      return {
+        path: `/v1/desktop/sessions/${request.sessionId}/find?${query}`,
+        method: "GET"
+      };
+    }
     case "subagents.transcript": {
       const query = new URLSearchParams({
         limit: String(request.limit ?? 100)
@@ -2827,7 +2865,7 @@ function isMiniViewDismissReason(value) {
 }
 const MINI_VIEW_WIDTH = 640;
 const MINI_VIEW_HEIGHT = 168;
-const DEFAULT_QUICK_SEND_VALUE = "primary+alt+space";
+const DEFAULT_QUICK_SEND_VALUE = "primary+alt+shift+space";
 const FUNCTION_KEY_TOKEN = /^f([1-9]|1[0-9]|2[0-4])$/;
 function isFunctionKeyToken(token) {
   return FUNCTION_KEY_TOKEN.test(token);
@@ -11742,6 +11780,11 @@ const REFUSABLE_DELIVERY = {
   // THE ONE REFUSAL. The residual above says what it rests on and what it cannot
   // see.
   "second-instance": "when-its-plan-is-silent",
+  // A Dock click carries no conversation and installs nothing: it only ever
+  // opens this process's own window, so there is no delivery here to refuse or
+  // to park. (The refusal a QUITTING process answers it with is not this gate's;
+  // it has a line of its own, `applied=skipped+quitting`.)
+  activate: "never",
   // A person clicked a real banner, so refusing it and applying it must not
   // differ — and with a window up it does not even reach this gate.
   "banner-click": "never",
@@ -11810,6 +11853,17 @@ function reportParksAtQuit(sessions, report) {
     ].join(" ")
   );
 }
+function reportSkippedWhileQuitting(context, requested) {
+  context.report?.(
+    [
+      `trigger=${context.trigger}`,
+      `mode=${MODE_OF_SHOW[requested]}`,
+      `requested=${requested}`,
+      ...requesterFields(context),
+      "applied=skipped+quitting"
+    ].join(" ")
+  );
+}
 function raiseWindow(window, show, context) {
   if (show === "never") return;
   const applied = [];
@@ -11848,6 +11902,17 @@ function readSecondLaunchRequest(input) {
   };
 }
 function applySecondLaunch(request, target2) {
+  if (target2.quitting) {
+    reportSkippedWhileQuitting(
+      {
+        trigger: "second-instance",
+        requester: request.requester ?? void 0,
+        report: target2.report
+      },
+      request.show
+    );
+    return;
+  }
   if (request.session !== null) {
     if (target2.openConversation) {
       target2.openConversation(request.session, request);
@@ -12092,6 +12157,23 @@ class BackendInstaller {
    * and never resolves at all.
    */
   settleUserDecision = null;
+  /**
+   * What to tell the app when THIS window's question cancels a running quit.
+   *
+   * WHY THE INSTALLER CARRIES IT AND `index.ts` OWNS IT (round-1 review,
+   * F-1). The declined "Quit without setup?" - `cancelId: 0`, the default -
+   * lets a quit abort and leaves the process serving, which means any quit
+   * that was in flight is now CANCELLED and the app must stop claiming
+   * otherwise: without a release, `index.ts`'s quit state stays set and every
+   * later second launch and Dock click is refused for the process's life
+   * although the app is running normally. The dialog is the ONE cancellation
+   * a running quit has (see `../quit-state` for the sweep); this module never
+   * reaches for the app's state itself, so the installer stays drivable in a
+   * test and the single release site stays greppable. Optional because the
+   * harness constructs installers with no app around them, and a release that
+   * fires where no quit exists clears an already-false state.
+   */
+  onQuitCancelled;
   /*
    * The last phase announced to the setup window, and whether a failure is
    * currently on screen with nobody's answer yet.
@@ -12203,8 +12285,14 @@ ${error instanceof Error ? error.message : String(error ?? "")}`;
   }
   /**
    * Constructor
+   *
+   * `options.onQuitCancelled` is `index.ts`'s one release for the app's quit
+   * state (see the field's own note); it is handed in rather than imported so
+   * this module never depends on the app's lifecycle and its test can drive
+   * the declined answer with a spy.
    */
-  constructor() {
+  constructor(options = {}) {
+    this.onQuitCancelled = options.onQuitCancelled;
     this.venvPath = managedVenvPath({
       platform: process.platform,
       home: electron.app.getPath("home"),
@@ -12851,6 +12939,7 @@ ${result.stdout}`,
         "Setup quit declined from the setup window",
         LogFileType.INSTALLER
       );
+      this.onQuitCancelled?.();
       return;
     }
     this.attemptCancelled = inFlight;
@@ -32512,8 +32601,8 @@ function createMiniView(options) {
       backgroundThrottling: false,
       /*
        * The argv the preload reads SYNCHRONOUSLY, and both entries are
-       * deliberate: the chrome facts because the keycap's spelling (⌘⌥
-       * against Ctrl+Alt) is a first-frame fact with no IPC round trip to
+       * deliberate: the chrome facts because the keycap's spelling (⌘⌥⇧
+       * against Ctrl+Alt+Shift) is a first-frame fact with no IPC round trip to
        * wait for — the main window composes the same entry through
        * `windowChromeArgumentFor` — and an EXPLICIT telemetry `off` because
        * this window mounts no telemetry surface at all (§D.1), and the
@@ -32613,6 +32702,18 @@ function rememberPickedDirectory(kind, filePaths, directoryPicked = false) {
   if (!first) return;
   lastPickedDirectory.set(kind, directoryPicked ? first : path$1.dirname(first));
 }
+function createQuitState() {
+  let quitting = false;
+  return {
+    begin: () => {
+      quitting = true;
+    },
+    cancel: () => {
+      quitting = false;
+    },
+    isQuitting: () => quitting
+  };
+}
 function titlebarOptions(platform, chrome) {
   if (platform === "darwin") {
     return { titleBarStyle: "hidden" };
@@ -32803,10 +32904,10 @@ async function waitForFleetIdle(input) {
     fleet: (await input.readRoster())?.length ?? 0
   };
 }
-function fleetDrainRefusalSentence(outcome, installLanded = false) {
+function fleetDrainRefusalSentence(outcome) {
   const minutes = Math.max(1, Math.round(outcome.waitedMs / 6e4));
   const waited = `${minutes} minute${minutes === 1 ? "" : "s"}`;
-  const closing = installLanded ? "The install itself has landed, and the server keeps running the build it loaded until it can restart onto it; the app will offer this update again." : "Nothing was installed and the server keeps running the build it loaded; the app will offer this update again.";
+  const closing = "Nothing was installed and the server keeps running the build it loaded; the app will offer this update again.";
   if (outcome.because === "unknown") {
     const lead2 = outcome.credentialsRefused ? "The server refused this app's credentials, so the app could not read which sessions are running on this machine." : "The app could not read which sessions are running on this machine, so it did not update the server.";
     return `${lead2}
@@ -32876,7 +32977,10 @@ async function reengageDisplacedSessions(input) {
   const finalRead = await input.readRoster();
   if (finalRead !== null) after = finalRead;
   const displaced = displacedSessions(input.before, after);
-  const stillResident = snapshot2.filter((row) => stillLive.has(row.sessionId));
+  const stillLiveAtEnd = stillLiveIn(finalRead) ?? stillLive;
+  const stillResident = snapshot2.filter(
+    (row) => stillLiveAtEnd.has(row.sessionId)
+  );
   const engaged = [];
   const failed = [];
   for (const row of displaced) {
@@ -34179,15 +34283,17 @@ class UpdateService {
    */
   installPreflightInFlight = false;
   /**
-   * How long an update press may hold back for the fleet, and how often it
-   * re-reads it.
+   * How long the rebuild install leg may hold back for the fleet, and how often
+   * it re-reads it.
    *
-   * FIELDS rather than the module's constants read in place, because both halves
-   * are waited on inside one press and the harness has to be able to drive a wait
-   * in milliseconds instead of ten minutes (`scripts/update-robustness.test.mjs`,
-   * the same lever `waitForBackendVersion` and the install budgets already are).
-   * The values they start at are the host tool's own, in
-   * `backend/fleet-drain.ts`, where the reasoning for the ten minutes lives.
+   * FIELDS rather than the module's constants read in place, because the wait has
+   * to be drivable in milliseconds instead of ten minutes
+   * (`scripts/update-robustness.test.mjs`, the same lever `waitForBackendVersion`
+   * and the install budgets already are). The values they start at are the host
+   * tool's own, in `backend/fleet-drain.ts`, where the reasoning for the ten
+   * minutes lives - and where the module head records that the press reaching
+   * this pair is now only the REBUILD route's install leg (the operator's
+   * directive removed the restart-leg drains).
    */
   fleetDrainBudgetMs = FLEET_DRAIN_BUDGET_MS;
   fleetDrainPollMs = FLEET_DRAIN_POLL_MS;
@@ -34216,13 +34322,17 @@ class UpdateService {
   sessionEngageBeatMs = SESSION_ENGAGE_BEAT_MS;
   sessionEngageHoldMs = SESSION_ENGAGE_HOLD_MS;
   /**
-   * How long the press IN FLIGHT has already spent waiting for the fleet.
+   * How long the rebuild press IN FLIGHT has already spent waiting for the fleet.
    *
-   * The budget above is the press's, not each drain's (review round 1, m2): a
-   * rebuild press drains twice - once before the install and once before the
-   * restart - so a per-drain budget let one press hold the button for twenty
-   * minutes while the panel promised ten. Reset at the top of every press, in
-   * `updateBackend`, because the guarantee is about one press.
+   * The budget above belongs to the PRESS, not to each drain (review round 1,
+   * m2): when the restart legs still drained, a rebuild press drained twice -
+   * once before the install and once before the restart - so a per-drain budget
+   * let one press hold the button for twenty minutes while the panel promised
+   * ten. The restart-leg drains are gone (2026-09-29 directive), so the ledger
+   * now carries at most one leg's spend; it is kept because the promise the
+   * draining copy makes is about the press, and because it is the seam the wait
+   * is driven through. Reset at the top of every press, in `updateBackend`,
+   * because the guarantee is about one press.
    */
   fleetDrainSpentMs = 0;
   /**
@@ -36980,13 +37090,16 @@ ${heal.removed.join("\n")}`,
        * publishes a generation and restarts a daemon. It is the managed global
        * arm's own wording, aimed at this arm's mechanism.
        *
-       * AND IT NO LONGER PROMISES A DROPPED TURN. It did, because it described
-       * what the press used to do; the press now waits for the running turns to
-       * finish before it moves the server (`drainFleetForUpdate`), so the honest
-       * consequence is the wait and the sequence, with the cost stated as the
-       * time it takes rather than as work it destroys.
+       * AND IT NO LONGER PROMISES A DROPPED TURN - AND NO LONGER PRICES A WAIT. It
+       * did both at different times, because it described what the press used to
+       * do; the operator's directive of 2026-09-29 removed the fleet wait from the
+       * restart legs ("we don't need to wait for all sessions to drain and turn
+       * over... on idle they should switch over"), so the honest consequence names
+       * the sequence, the promised absence of dropped work, and the fleet effect
+       * that remains - sessions still working move onto the new build when they
+       * next stop or go idle - with the cost stated as the time it takes.
        */
-      remedy: "The app publishes the new build beside the one the server is using, waits for the turns already running on this machine to finish, and then moves the server onto it, so nothing in flight is cut off. This can take a minute or two.",
+      remedy: "The app publishes the new build beside the one the server is using and then moves the server onto it, so nothing in flight is cut off. Sessions that are still working move onto the new build when they next stop or go idle. This can take a minute or two.",
       detail: `The app started this server itself (${startupMode}).`,
       sourceBuild: false,
       /*
@@ -37660,15 +37773,19 @@ ${heal.removed.join("\n")}`,
     return this.backendService?.servingInstall().owned.owned ?? false;
   }
   /**
-   * Wait for the fleet this app can see to go idle, or refuse the update.
+   * Wait for the fleet this app can see to go idle, or refuse the rebuild.
    *
-   * THE ONE GATE EVERY RESTART AND EVERY IN-PLACE INSTALL GOES THROUGH. A
-   * restart of the server serving this app is `stop(true)` - SIGTERM, ten
-   * seconds, SIGKILL - and the daemon's own `retire.py` declines that exit for
-   * exactly this reason: its shutdown cancels work it owns. The operator's rule
-   * is that nothing kills runtimes en masse, so the app waits for the fleet to
-   * drain before it touches anything, and REFUSES with a remedy at the end of
-   * its budget rather than cutting off a turn on a timer.
+   * THE ONE REMAINING GATE, AND IT GUARDS THE ONE ROUTE THAT CAN CUT A TURN. This
+   * used to stand in front of every restart and every in-place install. The
+   * operator's directive of 2026-09-29 removed it from the RESTART legs - a
+   * daemon bounce cuts no turns, because session runtimes are detached and
+   * converge onto the new build at their own next idle (see the module head in
+   * `backend/fleet-drain.ts`) - so what is left is the route it still has to
+   * guard: the checkout REBUILD's install leg, which rewrites a tree a live
+   * runtime is reading (`update-install.ts`). There the operator's rule stands:
+   * nothing kills runtimes en masse, so the app waits for the fleet to drain
+   * before the rebuild starts, and REFUSES with a remedy at the end of its
+   * budget rather than cutting off a turn on a timer.
    *
    * WHY THE MANAGER'S OWN READERS. `servingWorkState` is the app's existing
    * busy signal (see `servingWorkStateFromSessions`) and `servingSessionFleet`
@@ -37683,7 +37800,7 @@ ${heal.removed.join("\n")}`,
    *   when the update was refused and the caller must not proceed
    */
   async drainFleetForUpdate(input) {
-    const { backend, what } = input;
+    const { backend } = input;
     const spentMs = this.fleetDrainSpentMs;
     const remainingMs = Math.max(0, this.fleetDrainBudgetMs - spentMs);
     const outcome = await waitForFleetIdle({
@@ -37710,7 +37827,7 @@ ${heal.removed.join("\n")}`,
           waitedMs: spentMs + elapsedMs
         });
         logger.info(
-          `Update waiting for the fleet to drain before it may ${what} (${Math.round(elapsedMs / 1e3)}s so far)`,
+          `Update waiting for the fleet to drain before the rebuild may start (${Math.round(elapsedMs / 1e3)}s so far)`,
           LogFileType.UPDATE_SERVICE
         );
       }
@@ -37718,19 +37835,16 @@ ${heal.removed.join("\n")}`,
     this.fleetDrainSpentMs = spentMs + outcome.waitedMs;
     if (outcome.kind === "drained") {
       logger.info(
-        `The fleet is idle (${outcome.fleet} session(s) on the roster, ${outcome.waitedMs}ms waited); the update may ${what}`,
+        `The fleet is idle (${outcome.fleet} session(s) on the roster, ${outcome.waitedMs}ms waited); the rebuild may start`,
         LogFileType.UPDATE_SERVICE
       );
       return true;
     }
-    const message = fleetDrainRefusalSentence(
-      outcome,
-      input.installLanded === true
-    );
+    const message = fleetDrainRefusalSentence(outcome);
     const command = input.command ?? null;
     const pressWaitedMs = spentMs + outcome.waitedMs;
     logger.warn(
-      `Refusing to ${what}: the fleet did not drain in ${pressWaitedMs}ms (${outcome.because}, ${outcome.busy.length} mid-turn, this leg spent ${outcome.waitedMs}ms). ${message}${command ? ` By hand: ${command}` : ""}`,
+      `Refusing to install: the fleet did not drain in ${pressWaitedMs}ms (${outcome.because}, ${outcome.busy.length} mid-turn, this leg spent ${outcome.waitedMs}ms). ${message}${command ? ` By hand: ${command}` : ""}`,
       LogFileType.UPDATE_SERVICE
     );
     this.sendToRenderer("backend-update-error", {
@@ -37747,17 +37861,7 @@ ${heal.removed.join("\n")}`,
         because: outcome.because,
         waitedMs: pressWaitedMs,
         command,
-        credentialsRefused: outcome.credentialsRefused === true,
-        /*
-         * WHICH REFUSAL THIS IS (design round 2, D6). The heading is the reader's
-         * takeaway from a panel they have been looking at for ten minutes, and the
-         * three refusal sites are not the same event: the install leg's refusal left
-         * nothing on disk, while the two restart-leg refusals happen AFTER the build
-         * landed. "The update didn't start" is false on the second pair - the
-         * producer's own doc for `installLanded` says so - so the fact travels with
-         * the report and the panel keys its heading on it.
-         */
-        installLanded: input.installLanded === true
+        credentialsRefused: outcome.credentialsRefused === true
       }
     });
     return false;
@@ -37766,15 +37870,22 @@ ${heal.removed.join("\n")}`,
    * Put back the runtimes a restart displaced, and say what came back.
    *
    * Step 5 of the host tool's own order (`~/tools/lop-fleet-update`): the app
-   * snapshots the fleet, drains it, moves the server, and then re-engages what
-   * the move displaced - the unwatched `daemon`-kind sessions in particular,
-   * which nothing else revives. `reengageDisplacedSessions` owns the retire wait
-   * and the ordering rules.
-   *
-   * BEST EFFORT AND NEVER A BLOCKER: this runs after the server is healthy and
-   * the update has already been reported, so a displace list that will not come
-   * back is a logged fact rather than a failed update. That is deliberate - a
-   * `warm` the daemon refuses must not turn a landed update into an error panel.
+   * snapshots the fleet, moves the server, and then re-engages what the move
+   * displaced - the unwatched `daemon`-kind sessions in particular, which nothing
+   * else revives. `reengageDisplacedSessions` owns the retire wait and the
+   * ordering rules.
+   *
+   * BEST EFFORT AND NEVER A BLOCKER: a displace list that will not come back is a
+   * logged fact rather than a failed update. That is deliberate - a `warm` the
+   * daemon refuses must not turn a landed update into an error panel.
+   *
+   * THE RESULT IS RETURNED FOR THE COMPLETION'S COUNT (2026-09-29): the caller
+   * reads `stillResident` - the pre-swap runtimes still resident in the freshest
+   * read at the wait's end, which in the ordinary flow are the sessions still on
+   * the old build - into `sessionsOnOldBuild`. It is a liveness reading rather
+   * than a build read (the field's own docblock names the one narrow over-count).
+   * A failure here answers null and the count is reported as not measured, so
+   * the notice degrades to the numberless sentence rather than inventing a zero.
    */
   async reengageFleetAfterRestart(backend, before) {
     try {
@@ -37796,7 +37907,7 @@ ${heal.removed.join("\n")}`,
             LogFileType.UPDATE_SERVICE
           );
         }
-        return;
+        return result;
       }
       if (result.failed.length > 0) {
         logger.warn(
@@ -37804,11 +37915,13 @@ ${heal.removed.join("\n")}`,
           LogFileType.UPDATE_SERVICE
         );
       }
+      return result;
     } catch (error) {
       logger.warn(
         `Could not re-engage the sessions a restart displaced: ${error instanceof Error ? error.message : String(error)}`,
         LogFileType.UPDATE_SERVICE
       );
+      return null;
     }
   }
   /**
@@ -37857,9 +37970,11 @@ ${heal.removed.join("\n")}`,
    *
    * NOT `sessions.message`, deliberately: a message would admit a turn in every
    * conversation this machine holds, which is work and spend the user did not ask
-   * for, and the drain that ran before the restart is what makes a notice about
-   * interrupted work unnecessary - by construction nothing was mid-turn when the
-   * server moved.
+   * for - and since the operator's directive removed the restart-leg drains
+   * (2026-09-29), a re-engaged session may legitimately have been mid-turn when
+   * the server moved: a daemon bounce cuts no turns, and the session's own turn
+   * kept running in its detached runtime. This call starts a runtime; it never
+   * touches a turn.
    */
   async engageSessionRuntime(backend, row) {
     const relay = backend.getStreamRelay();
@@ -38318,8 +38433,7 @@ ${heal.removed.join("\n")}`,
     const fleetBeforeInstall = rebuildRoute ? await this.readFleetSnapshot(backend) : null;
     if (rebuildRoute && !await this.drainFleetForUpdate({
       backend,
-      command: freshPlan.updateCommand ?? null,
-      what: "install"
+      command: freshPlan.updateCommand ?? null
     })) {
       return false;
     }
@@ -38438,23 +38552,6 @@ ${heal.removed.join("\n")}`,
       });
       return true;
     }
-    if (!await this.drainFleetForUpdate({
-      backend,
-      command: freshPlan.updateCommand ?? null,
-      what: "restart",
-      /*
-       * A press with nothing left to install has no install to report as
-       * landed, and saying one was would be the one false thing in the
-       * refusal.
-       */
-      installLanded: !installAlreadyCurrent
-    })) {
-      logger.info(
-        installAlreadyCurrent ? "Nothing was left to install; the restart was refused because the fleet did not drain. The daemon keeps serving the build it loaded." : "The install landed; the restart was refused because the fleet did not drain. The daemon keeps serving the build it loaded.",
-        LogFileType.UPDATE_SERVICE
-      );
-      return false;
-    }
     logger.info(
       "Restarting backend service onto the updated install...",
       LogFileType.UPDATE_SERVICE
@@ -38518,13 +38615,12 @@ ${heal.removed.join("\n")}`,
       fleetBeforeInstall,
       fleetBeforeRestart
     );
-    if (reengageSnapshot !== null) {
-      await this.reengageFleetAfterRestart(backend, reengageSnapshot);
-    }
+    const reengage = reengageSnapshot !== null ? await this.reengageFleetAfterRestart(backend, reengageSnapshot) : null;
     this.sendToRenderer("backend-update-completed", {
       installVersion: after,
       runningVersion: reported,
-      restarted: true
+      restarted: true,
+      sessionsOnOldBuild: reengage?.stillResident.length ?? null
     });
     return true;
   }
@@ -38873,14 +38969,6 @@ ${reason}` : ""}`,
       return true;
     }
     const fleetAfterPublish = await this.readFleetSnapshot(backend);
-    if (!await this.drainFleetForUpdate({
-      backend,
-      command: null,
-      what: "restart",
-      installLanded: outcome.replaced
-    })) {
-      return false;
-    }
     logger.info(
       "Restarting backend service onto the published environment...",
       LogFileType.UPDATE_SERVICE
@@ -38969,13 +39057,12 @@ ${reason}` : ""}`,
       fleetAfterPublish,
       fleetBeforeRestart
     );
-    if (reengageSnapshot !== null) {
-      await this.reengageFleetAfterRestart(backend, reengageSnapshot);
-    }
+    const reengage = reengageSnapshot !== null ? await this.reengageFleetAfterRestart(backend, reengageSnapshot) : null;
     this.sendToRenderer("backend-update-completed", {
       installVersion,
       runningVersion: running,
-      restarted: true
+      restarted: true,
+      sessionsOnOldBuild: reengage?.stillResident.length ?? null
     });
     return true;
   }
@@ -40166,7 +40253,12 @@ const userShellPath = createUserShellPath({
   log: (message) => logger.info(message, LogFileType.BACKEND)
 });
 const backendService = new BackendServiceManager({ userShellPath });
-const backendInstaller = new BackendInstaller();
+const quitState = createQuitState();
+const backendInstaller = new BackendInstaller({
+  // The installer's one route back from a cancelled quit: the declined dialog
+  // answer (`./quit-state` owns why there is exactly one such site).
+  onQuitCancelled: () => quitState.cancel()
+});
 const reportBackendFailure = (message, fileType) => {
   if (backendService.isShuttingDown()) {
     logger.error(
@@ -40380,6 +40472,16 @@ if (!gotTheLock) {
         }),
         {
           window: mainWindow,
+          /*
+           * Read PER REQUEST rather than captured once: this handler outlives every
+           * window, and the state is LIVE — set at each quit's first `before-quit`
+           * entry, released when the setup dialog declines to stop a run — so a
+           * request that arrives during a quit is refused instead of answered with
+           * a window the shutdown would take down, and a request after a CANCELLED
+           * quit is answered normally (`./quit-state` owns the transitions;
+           * `window-raise.ts` owns the refusal and its line).
+           */
+          quitting: quitState.isQuitting(),
           openConversation: openConversationInWindow ? (session, request) => openConversationInWindow?.(
             session,
             secondInstanceRequest(request)
@@ -40559,7 +40661,10 @@ electron.app.whenReady().then(async () => {
           });
           return "raised the window";
         }
-        setupMainWindowWithUpdateService();
+        setupMainWindowWithUpdateService(null, false, {
+          show: windowLaunch.show,
+          trigger: "viewer-focus"
+        });
         return "opened a window";
       }
     },
@@ -40609,7 +40714,7 @@ electron.app.whenReady().then(async () => {
        * this feature's slice for a value that is a launch fact (argv, the
        * launch env, the persisted file) and cannot differ between the two
        * calls. The mini view's visible consumer of it is the platform
-       * half: the header's keycap spells ⌘⌥Space against Ctrl+Alt+Space
+       * half: the header's keycap spells ⌘⌥⇧Space against Ctrl+Alt+Shift+Space
        * from exactly this entry.
        */
       chromeMode: resolveLaunchWindowChrome({
@@ -41151,6 +41256,10 @@ electron.app.whenReady().then(async () => {
     });
   }
   function setupMainWindowWithUpdateService(initialSession = null, openCatalogue = false, request = ownLaunchRequest()) {
+    if (quitState.isQuitting()) {
+      reportSkippedWhileQuitting(request, request.show);
+      return;
+    }
     const parked = initialSession === null && !openCatalogue ? parkedLaunches[0] : void 0;
     mainWindow = createWindow(
       parked?.session ?? initialSession,
@@ -41314,6 +41423,10 @@ electron.app.whenReady().then(async () => {
       });
       return;
     }
+    if (quitState.isQuitting()) {
+      reportSkippedWhileQuitting(request, request.show);
+      return;
+    }
     if (!canCreateWindowFor(request.show)) {
       if (sessionId2 !== null) parkLaunch(sessionId2, request);
       return;
@@ -41328,9 +41441,22 @@ electron.app.whenReady().then(async () => {
   setupMainWindowWithUpdateService(launchSession, launchCatalogue);
   electron.app.on("activate", () => {
     if (electron.BrowserWindow.getAllWindows().length === 0) {
+      if (quitState.isQuitting()) {
+        reportSkippedWhileQuitting(
+          { trigger: "activate", report: reportRaise },
+          OPERATOR_SHOW
+        );
+        return;
+      }
       setupMainWindowWithUpdateService(null, false, {
         show: OPERATOR_SHOW,
-        trigger: "initial-present"
+        /*
+         * The request names itself on its raise line. It used to present as
+         * `initial-present` — this process's own launch — which is what a Dock
+         * click is not, and the log's whole job is attribution; the refusal
+         * above is the same request and must carry the same name.
+         */
+        trigger: "activate"
       });
     }
   });
@@ -41410,6 +41536,7 @@ const holdQuitForSessionCookieSnapshot = createSessionCookieQuitHold({
   log: (message) => logger.warn(message, LogFileType.BACKEND)
 });
 electron.app.on("before-quit", async (event) => {
+  quitState.begin();
   if (await holdQuitForSessionCookieSnapshot(event)) return;
   logger.info("App is about to quit", LogFileType.BACKEND);
   if (parkedLaunches.length > 0) {

package/out/renderer/assets/{_basePickBy-D1XXNWdy.js → _basePickBy-_G13yD_N.js}

@@ -1 +1 @@
-import{e as o,c as b,g as v,k as O,h as P,j as p,l as w,m as A,n as x,t as c,o as N}from"./_baseUniq-DD_DKvaU.js";import{as as g,aa as y,at as E,au as F,av as M,aw as I,ax as _,ay as $,az as B,aA as T}from"./mermaid.core-BrRc254F.js";var S=/\s/;function z(n){for(var r=n.length;r--&&S.test(n.charAt(r)););return r}var G=/^\s+/;function H(n){return n&&n.slice(0,z(n)+1).replace(G,"")}var m=NaN,L=/^[-+]0x[0-9a-f]+$/i,R=/^0b[01]+$/i,q=/^0o[0-7]+$/i,C=parseInt;function K(n){if(typeof n=="number")return n;if(o(n))return m;if(g(n)){var r=typeof n.valueOf=="function"?n.valueOf():n;n=g(r)?r+"":r}if(typeof n!="string")return n===0?n:+n;n=H(n);var t=R.test(n);return t||q.test(n)?C(n.slice(2),t?2:8):L.test(n)?m:+n}var W=1/0,X=17976931348623157e292;function Y(n){if(!n)return n===0?n:0;if(n=K(n),n===W||n===-1/0){var r=n<0?-1:1;return r*X}return n===n?n:0}function D(n){var r=Y(n),t=r%1;return r===r?t?r-t:r:0}function fn(n){var r=n==null?0:n.length;return r?b(n):[]}var l=Object.prototype,J=l.hasOwnProperty,dn=y(function(n,r){n=Object(n);var t=-1,e=r.length,a=e>2?r[2]:void 0;for(a&&E(r[0],r[1],a)&&(e=1);++t<e;)for(var f=r[t],i=F(f),s=-1,d=i.length;++s<d;){var u=i[s],h=n[u];(h===void 0||M(h,l[u])&&!J.call(n,u))&&(n[u]=f[u])}return n});function un(n){var r=n==null?0:n.length;return r?n[r-1]:void 0}function Q(n){return function(r,t,e){var a=Object(r);if(!I(r)){var f=v(t);r=O(r),t=function(s){return f(a[s],s,a)}}var i=n(r,t,e);return i>-1?a[f?r[i]:i]:void 0}}var U=Math.max;function Z(n,r,t){var e=n==null?0:n.length;if(!e)return-1;var a=t==null?0:D(t);return a<0&&(a=U(e+a,0)),P(n,v(r),a)}var hn=Q(Z);function V(n,r){var t=-1,e=I(n)?Array(n.length):[];return p(n,function(a,f,i){e[++t]=r(a,f,i)}),e}function gn(n,r){var t=_(n)?w:V;return t(n,v(r))}var j=Object.prototype,k=j.hasOwnProperty;function nn(n,r){return n!=null&&k.call(n,r)}function vn(n,r){return n!=null&&A(n,r,nn)}function rn(n,r){return n<r}function tn(n,r,t){for(var e=-1,a=n.length;++e<a;){var f=n[e],i=r(f);if(i!=null&&(s===void 0?i===i&&!o(i):t(i,s)))var s=i,d=f}return d}function mn(n){return n&&n.length?tn(n,$,rn):void 0}function an(n,r,t,e){if(!g(n))return n;r=x(r,n);for(var a=-1,f=r.length,i=f-1,s=n;s!=null&&++a<f;){var d=c(r[a]),u=t;if(d==="__proto__"||d==="constructor"||d==="prototype")return n;if(a!=i){var h=s[d];u=void 0,u===void 0&&(u=g(h)?h:B(r[a+1])?[]:{})}T(s,d,u),s=s[d]}return n}function on(n,r,t){for(var e=-1,a=r.length,f={};++e<a;){var i=r[e],s=N(n,i);t(s,i)&&an(f,x(i,n),s)}return f}export{rn as a,tn as b,V as c,on as d,mn as e,fn as f,hn as g,vn as h,dn as i,D as j,un as l,gn as m,Y as t};
+import{e as o,c as b,g as v,k as O,h as P,j as p,l as w,m as A,n as x,t as c,o as N}from"./_baseUniq-cZFY6WR-.js";import{as as g,aa as y,at as E,au as F,av as M,aw as I,ax as _,ay as $,az as B,aA as T}from"./mermaid.core-Dol6F2oY.js";var S=/\s/;function z(n){for(var r=n.length;r--&&S.test(n.charAt(r)););return r}var G=/^\s+/;function H(n){return n&&n.slice(0,z(n)+1).replace(G,"")}var m=NaN,L=/^[-+]0x[0-9a-f]+$/i,R=/^0b[01]+$/i,q=/^0o[0-7]+$/i,C=parseInt;function K(n){if(typeof n=="number")return n;if(o(n))return m;if(g(n)){var r=typeof n.valueOf=="function"?n.valueOf():n;n=g(r)?r+"":r}if(typeof n!="string")return n===0?n:+n;n=H(n);var t=R.test(n);return t||q.test(n)?C(n.slice(2),t?2:8):L.test(n)?m:+n}var W=1/0,X=17976931348623157e292;function Y(n){if(!n)return n===0?n:0;if(n=K(n),n===W||n===-1/0){var r=n<0?-1:1;return r*X}return n===n?n:0}function D(n){var r=Y(n),t=r%1;return r===r?t?r-t:r:0}function fn(n){var r=n==null?0:n.length;return r?b(n):[]}var l=Object.prototype,J=l.hasOwnProperty,dn=y(function(n,r){n=Object(n);var t=-1,e=r.length,a=e>2?r[2]:void 0;for(a&&E(r[0],r[1],a)&&(e=1);++t<e;)for(var f=r[t],i=F(f),s=-1,d=i.length;++s<d;){var u=i[s],h=n[u];(h===void 0||M(h,l[u])&&!J.call(n,u))&&(n[u]=f[u])}return n});function un(n){var r=n==null?0:n.length;return r?n[r-1]:void 0}function Q(n){return function(r,t,e){var a=Object(r);if(!I(r)){var f=v(t);r=O(r),t=function(s){return f(a[s],s,a)}}var i=n(r,t,e);return i>-1?a[f?r[i]:i]:void 0}}var U=Math.max;function Z(n,r,t){var e=n==null?0:n.length;if(!e)return-1;var a=t==null?0:D(t);return a<0&&(a=U(e+a,0)),P(n,v(r),a)}var hn=Q(Z);function V(n,r){var t=-1,e=I(n)?Array(n.length):[];return p(n,function(a,f,i){e[++t]=r(a,f,i)}),e}function gn(n,r){var t=_(n)?w:V;return t(n,v(r))}var j=Object.prototype,k=j.hasOwnProperty;function nn(n,r){return n!=null&&k.call(n,r)}function vn(n,r){return n!=null&&A(n,r,nn)}function rn(n,r){return n<r}function tn(n,r,t){for(var e=-1,a=n.length;++e<a;){var f=n[e],i=r(f);if(i!=null&&(s===void 0?i===i&&!o(i):t(i,s)))var s=i,d=f}return d}function mn(n){return n&&n.length?tn(n,$,rn):void 0}function an(n,r,t,e){if(!g(n))return n;r=x(r,n);for(var a=-1,f=r.length,i=f-1,s=n;s!=null&&++a<f;){var d=c(r[a]),u=t;if(d==="__proto__"||d==="constructor"||d==="prototype")return n;if(a!=i){var h=s[d];u=void 0,u===void 0&&(u=g(h)?h:B(r[a+1])?[]:{})}T(s,d,u),s=s[d]}return n}function on(n,r,t){for(var e=-1,a=r.length,f={};++e<a;){var i=r[e],s=N(n,i);t(s,i)&&an(f,x(i,n),s)}return f}export{rn as a,tn as b,V as c,on as d,mn as e,fn as f,hn as g,vn as h,dn as i,D as j,un as l,gn as m,Y as t};