onbuzz 5.4.7 → 5.4.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "onbuzz",
-  "version": "5.4.7",
+  "version": "5.4.9",
   "description": "Loxia OnBuzz - Your AI Fleet",
   "type": "module",
   "main": "src/index.js",
@@ -33,9 +33,9 @@
     "electron:build:win": "npm run build:web-ui && electron-builder --win",
     "electron:build:mac": "npm run build:web-ui && electron-builder --mac",
     "electron:build:linux": "npm run build:web-ui && electron-builder --linux",
-    "electron:build:onbuzz:win": "cross-env VITE_BRAND=onbuzz npm run build:web-ui && cross-env LOXIA_BRAND=onbuzz electron-builder --win -c.productName=\"Loxia OnBuzz\" -c.appId=com.loxia.onbuzz -c.executableName=loxia-onbuzz -c.win.icon=electron/icon-onbuzz.png",
-    "electron:build:onbuzz:mac": "cross-env VITE_BRAND=onbuzz npm run build:web-ui && cross-env LOXIA_BRAND=onbuzz electron-builder --mac -c.productName=\"Loxia OnBuzz\" -c.appId=com.loxia.onbuzz -c.executableName=loxia-onbuzz -c.mac.icon=electron/icon-onbuzz.png",
-    "electron:build:onbuzz:linux": "cross-env VITE_BRAND=onbuzz npm run build:web-ui && cross-env LOXIA_BRAND=onbuzz electron-builder --linux -c.productName=\"Loxia OnBuzz\" -c.appId=com.loxia.onbuzz -c.executableName=loxia-onbuzz -c.linux.icon=electron/icon-onbuzz.png"
+    "electron:build:onbuzz:win": "cross-env VITE_BRAND=onbuzz npm run build:web-ui && cross-env LOXIA_BRAND=onbuzz electron-builder --win -c.productName=\"Loxia OnBuzz\" -c.appId=com.loxia.onbuzz -c.executableName=loxia-onbuzz -c.win.icon=electron/icon-onbuzz.png -c.nsis.artifactName=Loxia-OnBuzz-Setup-${version}.${ext}",
+    "electron:build:onbuzz:mac": "cross-env VITE_BRAND=onbuzz npm run build:web-ui && cross-env LOXIA_BRAND=onbuzz electron-builder --mac -c.productName=\"Loxia OnBuzz\" -c.appId=com.loxia.onbuzz -c.executableName=loxia-onbuzz -c.mac.icon=electron/icon-onbuzz.png -c.mac.artifactName=Loxia-OnBuzz-${version}-${arch}.${ext}",
+    "electron:build:onbuzz:linux": "cross-env VITE_BRAND=onbuzz npm run build:web-ui && cross-env LOXIA_BRAND=onbuzz electron-builder --linux -c.productName=\"Loxia OnBuzz\" -c.appId=com.loxia.onbuzz -c.executableName=loxia-onbuzz -c.linux.icon=electron/icon-onbuzz.png -c.linux.artifactName=Loxia-OnBuzz-${version}.${ext}"
   },
   "keywords": [
     "ai",
@@ -128,9 +128,9 @@
     "uuid": "$uuid"
   },
   "build": {
-    "appId": "com.loxia.autopilot",
-    "productName": "Loxia Autopilot",
-    "executableName": "loxia-autopilot",
+    "appId": "com.loxia.onbuzz",
+    "productName": "Loxia OnBuzz",
+    "executableName": "loxia-onbuzz",
     "npmRebuild": false,
     "publish": [
       {
@@ -154,15 +154,20 @@
     },
     "win": {
       "target": "nsis",
-      "icon": "electron/icon.png"
+      "icon": "electron/icon-onbuzz.png"
+    },
+    "nsis": {
+      "artifactName": "Loxia-OnBuzz-Setup-${version}.${ext}"
     },
     "mac": {
       "target": "dmg",
-      "icon": "electron/icon.png"
+      "icon": "electron/icon-onbuzz.png",
+      "artifactName": "Loxia-OnBuzz-${version}-${arch}.${ext}"
     },
     "linux": {
       "target": "AppImage",
-      "icon": "electron/icon.png"
+      "icon": "electron/icon-onbuzz.png",
+      "artifactName": "Loxia-OnBuzz-${version}.${ext}"
     }
   },
   "pkg": {

package/scripts/bump-version.js

@@ -5,10 +5,25 @@
  * Bumps version across ALL files that track it, commits, tags, and pushes.
  *
  * Usage:
- *   node scripts/bump-version.js patch    → 3.6.0 → 3.6.1
- *   node scripts/bump-version.js minor    → 3.6.0 → 3.7.0
- *   node scripts/bump-version.js major    → 3.6.0 → 4.0.0
- *   node scripts/bump-version.js 3.8.0    → explicit version
+ *   node scripts/bump-version.js patch      → 3.6.0 → 3.6.1
+ *   node scripts/bump-version.js minor      → 3.6.0 → 3.7.0
+ *   node scripts/bump-version.js major      → 3.6.0 → 4.0.0
+ *   node scripts/bump-version.js 3.8.0      → explicit version
+ *   node scripts/bump-version.js --status   → print the version truth table
+ *                                             (package files, latest git tag,
+ *                                             npm latest) and exit
+ *   node scripts/bump-version.js <v> --dry-run
+ *                                           → run every guard + print the plan,
+ *                                             write/commit/push NOTHING
+ *
+ * Guards (all run BEFORE any file is written):
+ *   - explicit versions must be exact semver (x.y.z or x.y.z-pre)
+ *   - the target git tag must NOT already exist  → hard fail
+ *   - the target version must NOT be on npm      → hard fail
+ *   These exist because a release run that half-succeeds (tag pushed, npm
+ *   publish failed) leaves the ecosystem desynced — package.json said 5.4.7
+ *   while the operator believed 5.4.5, and npm was missing 5.4.5/5.4.6
+ *   entirely. Fail EARLY, before anything is mutated.
  */
 
 import fs from 'fs';
@@ -18,6 +33,7 @@ import { fileURLToPath } from 'url';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const ROOT = path.resolve(__dirname, '..');
+const NPM_PKG = '@loxia-labs/loxia-autopilot-one';
 
 // ─── All files that contain a version to sync ──────────────────────────────
 
@@ -46,6 +62,8 @@ function writeVersion(relPath, newVersion) {
 
 // ─── Bump logic ────────────────────────────────────────────────────────────
 
+const EXPLICIT_RE = /^\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?$/;
+
 function bumpVersion(current, type) {
   const [major, minor, patch] = current.split('.').map(Number);
   switch (type) {
@@ -53,24 +71,131 @@ function bumpVersion(current, type) {
     case 'minor': return `${major}.${minor + 1}.0`;
     case 'patch': return `${major}.${minor}.${patch + 1}`;
     default:
-      // Explicit version string — validate format
-      if (/^\d+\.\d+\.\d+/.test(type)) return type;
+      // Explicit version string — must be EXACT semver, no trailing junk.
+      if (EXPLICIT_RE.test(type)) return type;
       throw new Error(`Invalid bump type: "${type}". Use: patch, minor, major, or explicit version (e.g. 3.7.0)`);
   }
 }
 
+// ─── Ecosystem truth (git tags + npm registry) ─────────────────────────────
+
+function gitTagExists(version) {
+  try {
+    const out = execSync(`git tag -l v${version}`, { cwd: ROOT, stdio: 'pipe' }).toString().trim();
+    return out === `v${version}`;
+  } catch { return false; }
+}
+
+function latestGitTag() {
+  try {
+    return execSync('git tag -l "v*" --sort=-v:refname', { cwd: ROOT, stdio: 'pipe' })
+      .toString().split('\n')[0].trim() || '(none)';
+  } catch { return '(unavailable)'; }
+}
+
+/** @returns {'exists'|'missing'|'unknown'} */
+function npmVersionState(version) {
+  try {
+    const out = execSync(`npm view ${NPM_PKG}@${version} version`, { cwd: ROOT, stdio: 'pipe' })
+      .toString().trim();
+    return out === version ? 'exists' : 'missing';
+  } catch (err) {
+    // npm view exits 1 with E404 when the version isn't published — that's
+    // the GOOD case. Anything else (network down) is genuinely unknown.
+    const msg = String(err?.stderr || err?.message || '');
+    return msg.includes('E404') ? 'missing' : 'unknown';
+  }
+}
+
+function npmLatest() {
+  try {
+    return execSync(`npm view ${NPM_PKG} version`, { cwd: ROOT, stdio: 'pipe' }).toString().trim();
+  } catch { return '(unavailable)'; }
+}
+
+// ─── Status panel ──────────────────────────────────────────────────────────
+
+function printStatus() {
+  const pkgV = readVersion('package.json');
+  let tplV = '(missing)';
+  try { tplV = readVersion('package.autopilot.json'); } catch { /* absent */ }
+  const tag = latestGitTag();
+  const npmV = npmLatest();
+
+  const sync = pkgV === tplV ? 'in sync' : '⚠ OUT OF SYNC';
+  console.log('');
+  console.log('  ── Version truth table ─────────────────────────');
+  console.log(`  package.json           : ${pkgV}`);
+  console.log(`  package.autopilot.json : ${tplV}   (${sync})`);
+  console.log(`  latest git tag         : ${tag}`);
+  console.log(`  npm latest (${NPM_PKG.split('/')[1]}) : ${npmV}`);
+  console.log(`  next patch would be    : ${bumpVersion(pkgV, 'patch')}`);
+  if (npmV !== '(unavailable)' && npmV !== pkgV) {
+    console.log(`  ⚠ package.json (${pkgV}) != npm latest (${npmV}) — pick your target deliberately.`);
+  }
+  console.log('  ────────────────────────────────────────────────');
+  console.log('');
+}
+
 // ─── Main ──────────────────────────────────────────────────────────────────
 
-const arg = process.argv[2];
+const args = process.argv.slice(2);
+const dryRun = args.includes('--dry-run');
+const positional = args.filter((a) => !a.startsWith('--'));
+const arg = positional[0];
+
+if (args.includes('--status')) {
+  printStatus();
+  process.exit(0);
+}
+
 if (!arg) {
-  console.log('Usage: node scripts/bump-version.js <patch|minor|major|x.y.z>');
+  console.log('Usage: node scripts/bump-version.js <patch|minor|major|x.y.z> [--dry-run] | --status');
   process.exit(1);
 }
 
 const currentVersion = readVersion('package.json');
-const newVersion = bumpVersion(currentVersion, arg);
+let newVersion;
+try {
+  newVersion = bumpVersion(currentVersion, arg);
+} catch (err) {
+  console.error(`\n  ❌ ${err.message}\n`);
+  process.exit(1);
+}
 
-console.log(`\n  Version bump: ${currentVersion} → ${newVersion}\n`);
+// ── Guards: fail BEFORE mutating anything ──────────────────────────────────
+
+if (gitTagExists(newVersion)) {
+  console.error(`\n  ❌ Tag v${newVersion} already exists — this version was already cut.`);
+  console.error(`     Pick a different version (check with: node scripts/bump-version.js --status)\n`);
+  process.exit(1);
+}
+
+const npmState = npmVersionState(newVersion);
+if (npmState === 'exists') {
+  console.error(`\n  ❌ ${NPM_PKG}@${newVersion} is already published on npm — npm will reject a republish.`);
+  console.error(`     Pick a different version (check with: node scripts/bump-version.js --status)\n`);
+  process.exit(1);
+}
+if (npmState === 'unknown') {
+  console.log(`  ⚠ Could not verify npm registry (offline?) — continuing, but publish may fail if ${newVersion} exists.`);
+}
+
+console.log(`\n  Version bump: ${currentVersion} → ${newVersion}${dryRun ? '   [DRY RUN — nothing will be written]' : ''}\n`);
+
+if (dryRun) {
+  for (const { file, independent } of VERSION_FILES) {
+    const fullPath = path.join(ROOT, file);
+    if (!fs.existsSync(fullPath)) { console.log(`  ⚠ Would skip (not found): ${file}`); continue; }
+    const target = independent && EXPLICIT_RE.test(arg)
+      ? bumpVersion(readVersion(file), 'patch')
+      : independent ? bumpVersion(readVersion(file), arg) : newVersion;
+    console.log(`  → would set ${file}: ${readVersion(file)} → ${target}`);
+  }
+  console.log(`  → would commit "v${newVersion}", tag v${newVersion}, push origin main --tags`);
+  console.log('\n  ✅ All guards passed (dry run).\n');
+  process.exit(0);
+}
 
 // Update all files
 for (const { file, independent } of VERSION_FILES) {
@@ -82,11 +207,11 @@ for (const { file, independent } of VERSION_FILES) {
 
   let targetVersion = newVersion;
 
-  // web-ui has its own version scheme — bump its patch independently
+  // web-ui has its own version scheme. For patch/minor/major it takes the
+  // same bump TYPE; for an EXPLICIT main version it takes a patch bump —
+  // an explicit "5.4.8" must not stomp web-ui's independent numbering.
   if (independent) {
-    const webVersion = readVersion(file);
-    const webNew = bumpVersion(webVersion, arg.match(/^\d/) ? arg : arg); // same bump type
-    targetVersion = webNew;
+    targetVersion = bumpVersion(readVersion(file), EXPLICIT_RE.test(arg) ? 'patch' : arg);
   }
 
   const old = writeVersion(file, targetVersion);
@@ -103,12 +228,9 @@ console.log(`  ✓ Staged ${filesToStage.length} files`);
 execSync(`git commit -m "v${newVersion}"`, { cwd: ROOT, stdio: 'pipe' });
 console.log(`  ✓ Committed: v${newVersion}`);
 
-try {
-  execSync(`git tag v${newVersion}`, { cwd: ROOT, stdio: 'pipe' });
-  console.log(`  ✓ Tagged: v${newVersion}`);
-} catch {
-  console.log(`  ⚠ Tag v${newVersion} already exists, skipping`);
-}
+// Guard ran pre-flight, so a collision here means a race — surface it loudly.
+execSync(`git tag v${newVersion}`, { cwd: ROOT, stdio: 'pipe' });
+console.log(`  ✓ Tagged: v${newVersion}`);
 
 execSync(`git push origin main --tags`, { cwd: ROOT, stdio: 'pipe' });
 console.log(`  ✓ Pushed to origin/main with tags`);

package/scripts/swap-brand.js

@@ -0,0 +1,66 @@
+#!/usr/bin/env node
+/**
+ * Brand swap for publishing: rewrite package.json as the OnBuzz identity
+ * (after snapshotting the current file to package.autopilot.json for restore).
+ *
+ * CRITICAL: the swap must cover the COMPLETE brand surface, including the
+ * electron-builder `build` section. The v5.4.8 release was built with a swap
+ * that changed only name/bin/description — the base config's hardcoded
+ * "Loxia-Autopilot-Setup-…" artifactName leaked into the OnBuzz build, both
+ * brands produced identically-named installers, the OnBuzz upload CLOBBERED
+ * the Autopilot one, and Autopilot updaters sha-failed (installed apps kept
+ * crash-looping). Any build that reads a swapped package.json must inherit
+ * brand-correct artifact names.
+ *
+ * Usage: node scripts/swap-brand.js onbuzz
+ * (Restore is a plain copy: package.autopilot.json → package.json.)
+ */
+
+import fs from 'fs';
+import path from 'path';
+import { fileURLToPath } from 'url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const pkgPath = path.join(ROOT, 'package.json');
+const backupPath = path.join(ROOT, 'package.autopilot.json');
+
+const target = process.argv[2];
+if (target !== 'onbuzz') {
+  console.error('Usage: node scripts/swap-brand.js onbuzz');
+  process.exit(1);
+}
+
+// Snapshot the Autopilot identity for the post-publish restore — byte-exact
+// copy (NOT a re-serialization, which shuffles key order and leaves phantom
+// diffs after the restore).
+fs.copyFileSync(pkgPath, backupPath);
+
+const p = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
+
+// npm identity
+p.name = 'onbuzz';
+p.bin = { onbuzz: './bin/cli.js' };
+p.description = 'Loxia OnBuzz - Your AI Fleet';
+delete p.scripts.prepublishOnly;
+
+// electron-builder identity — keep EVERY brand-bearing field consistent so
+// any electron build from this file produces OnBuzz-named, OnBuzz-branded
+// artifacts that cannot collide with Autopilot's on the shared release.
+if (p.build) {
+  p.build.appId = 'com.loxia.onbuzz';
+  p.build.productName = 'Loxia OnBuzz';
+  p.build.executableName = 'loxia-onbuzz';
+  p.build.nsis = { ...(p.build.nsis || {}), artifactName: 'Loxia-OnBuzz-Setup-${version}.${ext}' };
+  if (p.build.win) p.build.win.icon = 'electron/icon-onbuzz.png';
+  if (p.build.mac) {
+    p.build.mac.artifactName = 'Loxia-OnBuzz-${version}-${arch}.${ext}';
+    p.build.mac.icon = 'electron/icon-onbuzz.png';
+  }
+  if (p.build.linux) {
+    p.build.linux.artifactName = 'Loxia-OnBuzz-${version}.${ext}';
+    p.build.linux.icon = 'electron/icon-onbuzz.png';
+  }
+}
+
+fs.writeFileSync(pkgPath, JSON.stringify(p, null, 2) + '\n');
+console.log('  name: ' + p.name + ' | nsis artifact: ' + p.build?.nsis?.artifactName);

package/scripts/verify-update-feed.js

@@ -0,0 +1,121 @@
+#!/usr/bin/env node
+/**
+ * Update-feed verifier — the guarantee that INSTALLED apps can always find
+ * and download the next version.
+ *
+ * How updates actually work: an installed app (any vintage, either naming
+ * era) fetches `<brand>.yml` from the LATEST GitHub release and downloads
+ * exactly the filename that yml names, from that same release. It never
+ * guesses names — so artifact renames between releases are safe IF AND ONLY
+ * IF each release's yml matches its real assets. Every updater incident so
+ * far was a violation of that contract:
+ *   - ≤5.4.7: yml said hyphens, GitHub dot-sanitized the space-named
+ *     uploads → 404 → installed apps crash-looped.
+ *   - 5.4.8: onbuzz.yml pointed at the AUTOPILOT installer with a mismatched
+ *     sha512 (brand artifactName collision) → OnBuzz updates dead.
+ *
+ * Checks, per brand (autopilot + onbuzz), against the live feed:
+ *   1. <brand>.yml exists on the latest release.
+ *   2. yml version matches the release tag.
+ *   3. Every files[].url names an asset that EXISTS on that release
+ *      (byte-for-byte name match).
+ *   4. yml size matches the asset's actual size (catches wrong-file uploads
+ *      even when the name matches — sha512 isn't exposed by the GitHub API,
+ *      size is the practical proxy).
+ *   5. The two brands' installers are DISTINCT files (collision guard).
+ *
+ * Usage:
+ *   node scripts/verify-update-feed.js            → verify latest release
+ *   node scripts/verify-update-feed.js v5.4.8     → verify a specific tag
+ *
+ * Exit 0 = feed healthy. Exit 1 = installed apps cannot update — fix the
+ * release BEFORE walking away.
+ */
+
+const REPO = 'Loxia-ai/autopilot-releases';
+const BRANDS = ['autopilot', 'onbuzz'];
+
+async function getJson(url) {
+  const res = await fetch(url, { headers: { 'User-Agent': 'loxia-feed-verify' } });
+  if (!res.ok) throw new Error(`GET ${url} → ${res.status}`);
+  return res.json();
+}
+
+async function getText(url) {
+  const res = await fetch(url, { headers: { 'User-Agent': 'loxia-feed-verify' } });
+  if (!res.ok) return null;
+  return res.text();
+}
+
+/** Minimal yml field extraction — the electron-builder yml is flat enough. */
+function parseYml(text) {
+  const version = (text.match(/^version:\s*(.+)$/m) || [])[1]?.trim();
+  const files = [];
+  // files: - url: NAME \n sha512: … \n size: N   (block list)
+  const fileBlocks = text.matchAll(/-\s+url:\s*(.+)\n(?:\s+sha512:.*\n)?\s+size:\s*(\d+)/g);
+  for (const m of fileBlocks) files.push({ url: m[1].trim(), size: Number(m[2]) });
+  // fallback: top-level path (older shape) — no size guaranteed
+  const path = (text.match(/^path:\s*(.+)$/m) || [])[1]?.trim();
+  if (path && !files.some((f) => f.url === path)) files.push({ url: path, size: null });
+  return { version, files };
+}
+
+const argTag = process.argv[2];
+const release = argTag
+  ? await getJson(`https://api.github.com/repos/${REPO}/releases/tags/${argTag}`)
+  : await getJson(`https://api.github.com/repos/${REPO}/releases/latest`);
+
+const tag = release.tag_name;
+const tagVersion = tag.replace(/^v/, '');
+const assets = new Map(release.assets.map((a) => [a.name, a]));
+
+console.log(`\n  Verifying update feed on ${tag} (${assets.size} assets)\n`);
+
+const problems = [];
+const brandInstallers = {};
+
+for (const brand of BRANDS) {
+  const ymlName = `${brand}.yml`;
+  if (!assets.has(ymlName)) {
+    problems.push(`[${brand}] ${ymlName} MISSING from ${tag} — installed ${brand} apps see no update feed.`);
+    continue;
+  }
+  const text = await getText(`https://github.com/${REPO}/releases/download/${tag}/${ymlName}`);
+  if (!text) { problems.push(`[${brand}] ${ymlName} exists but could not be fetched.`); continue; }
+
+  const { version, files } = parseYml(text);
+  if (version !== tagVersion) {
+    problems.push(`[${brand}] ${ymlName} says version ${version} but the release tag is ${tagVersion}.`);
+  }
+  if (files.length === 0) {
+    problems.push(`[${brand}] ${ymlName} lists no files — malformed yml.`);
+  }
+
+  for (const f of files) {
+    const asset = assets.get(f.url);
+    if (!asset) {
+      problems.push(`[${brand}] yml names "${f.url}" but NO asset with that exact name exists → updater 404s.`);
+      continue;
+    }
+    if (f.size != null && asset.size !== f.size) {
+      problems.push(`[${brand}] "${f.url}": yml size ${f.size} != asset size ${asset.size} → WRONG FILE uploaded under this name (sha will fail).`);
+    }
+    if (f.url.endsWith('.exe')) brandInstallers[brand] = f.url;
+    console.log(`  [${brand}] ${f.url}  → asset ${asset ? 'found' : 'MISSING'}${f.size != null && asset ? (asset.size === f.size ? ', size OK' : ', SIZE MISMATCH') : ''}`);
+  }
+}
+
+// Cross-brand collision: both ymls must not claim the same installer file.
+if (brandInstallers.autopilot && brandInstallers.onbuzz
+    && brandInstallers.autopilot === brandInstallers.onbuzz) {
+  problems.push(`BRAND COLLISION: autopilot.yml and onbuzz.yml both point at "${brandInstallers.autopilot}" — one brand's users get the other brand's app (or a sha failure).`);
+}
+
+console.log('');
+if (problems.length) {
+  console.error(`  ❌ Update feed BROKEN on ${tag} — installed apps cannot update cleanly:\n`);
+  for (const p of problems) console.error(`   • ${p}`);
+  console.error('');
+  process.exit(1);
+}
+console.log(`  ✅ Update feed healthy on ${tag} — installed apps (all vintages, both brands) can find and download this version.\n`);

package/src/core/__tests__/stateManager.atomicWrite.test.js

@@ -87,19 +87,39 @@ describe('saveJSON — atomic write', () => {
     expect(mockUnlink).not.toHaveBeenCalled(); // ultimately succeeded — no cleanup
   });
 
-  test('gives up after exhausting rename retries and cleans the temp', async () => {
+  // THE CRASH FIX. On Windows, rename over a file with an open read handle
+  // fails EPERM — and readers are constant (agent-list scans, UI polling).
+  // When retries exhaust, saveJSON must NOT reject: most persist calls are
+  // fire-and-forget, so the rejection would reach the global
+  // unhandledRejection handler, whose default branch process.exit(1)'s —
+  // that chain crashed the app at launch / during agent load. Instead it
+  // falls back to the pre-atomic DIRECT write (allowed alongside open read
+  // handles) and cleans the temp.
+  test('rename exhaustion under contention falls back to a direct write — NO rejection', async () => {
     const sm = makeSM();
     mockRename.mockRejectedValue(Object.assign(new Error('busy'), { code: 'EBUSY' }));
-    await expect(sm.saveJSON('/mock/userdata/state/r2.json', {})).rejects.toThrow('busy');
-    expect(mockRename).toHaveBeenCalledTimes(5);
+
+    await expect(sm.saveJSON('/mock/userdata/state/r2.json', { ok: 1 })).resolves.toBeUndefined();
+
+    expect(mockRename).toHaveBeenCalledTimes(8); // patient retry first
+    // Final write went DIRECTLY to the live path (the fallback)...
+    const lastWrite = mockWriteFile.mock.calls.at(-1);
+    expect(lastWrite[0]).toBe('/mock/userdata/state/r2.json');
+    expect(JSON.parse(lastWrite[1])).toEqual({ ok: 1 });
+    // ...and the orphaned temp was cleaned up.
     expect(mockUnlink).toHaveBeenCalledTimes(1);
-  });
+  }, 20000); // real backoff timers (~5.5s) run in this test
 
-  test('a non-transient rename error is NOT retried', async () => {
+  test('a non-transient rename error is NOT retried, NOT fallback-written, and still throws', async () => {
     const sm = makeSM();
     mockRename.mockRejectedValue(Object.assign(new Error('nospace'), { code: 'ENOSPC' }));
     await expect(sm.saveJSON('/mock/userdata/state/r3.json', {})).rejects.toThrow('nospace');
     expect(mockRename).toHaveBeenCalledTimes(1);
+    // No direct write to the live path — a real error must stay visible.
+    for (const [p] of mockWriteFile.mock.calls) {
+      expect(p).not.toBe('/mock/userdata/state/r3.json');
+    }
+    expect(mockUnlink).toHaveBeenCalledTimes(1); // temp cleaned
   });
 });
 

package/src/core/stateManager.js

@@ -1278,18 +1278,46 @@ class StateManager {
       await fs.writeFile(tmpPath, contents, 'utf8');
       await this._renameWithRetry(tmpPath, filePath);
     } catch (err) {
-      // Best-effort cleanup of the temp file; never mask the original error.
+      const transient = err && (err.code === 'EPERM' || err.code === 'EACCES' || err.code === 'EBUSY');
+      if (transient) {
+        // SHARING-VIOLATION FALLBACK — this branch is load-bearing. On
+        // Windows, rename over a file that ANY reader holds open fails with
+        // EPERM, and readers are constant here (agent-list scans, snippet
+        // enrichment, UI polling). When retries exhaust under sustained
+        // contention, DO NOT throw: most persist calls are fire-and-forget,
+        // so the rejection reaches process.on('unhandledRejection') — whose
+        // default branch calls process.exit(1). That exact chain crashed the
+        // app "sometimes at launch, sometimes while loading an agent".
+        // Fall back to the pre-atomic direct write instead: Windows allows
+        // in-place writes alongside open read handles, and our per-path
+        // write chain already guarantees no same-file write interleaving.
+        // Trade-off: this one write loses crash-atomicity — strictly no
+        // worse than the original implementation, and only under contention.
+        this.logger?.warn?.(
+          `Atomic rename blocked by open handles — falling back to direct write: ${path.basename(filePath)}`,
+          { filePath, code: err.code }
+        );
+        try {
+          await fs.writeFile(filePath, contents, 'utf8');
+          return;
+        } finally {
+          try { await fs.unlink(tmpPath); } catch { /* already gone */ }
+        }
+      }
+      // Non-transient (ENOSPC, EROFS, …): clean up and surface the real error.
       try { await fs.unlink(tmpPath); } catch { /* already gone */ }
       throw err;
     }
   }
 
   /**
-   * fs.rename with a small retry for the transient Windows sharing-violation
-   * errors that occur when a replace races an open read handle.
+   * fs.rename with retries for the transient Windows sharing-violation
+   * errors that occur when a replace races an open read handle. Backoff is
+   * patient (~9s worst case) because big conversation files (tens of MB)
+   * can legitimately hold read handles for seconds during agent load.
    * @private
    */
-  async _renameWithRetry(from, to, attempts = 5) {
+  async _renameWithRetry(from, to, attempts = 8) {
     for (let i = 0; i < attempts; i++) {
       try {
         await fs.rename(from, to);
@@ -1297,7 +1325,8 @@ class StateManager {
       } catch (err) {
         const transient = err && (err.code === 'EPERM' || err.code === 'EACCES' || err.code === 'EBUSY');
         if (!transient || i === attempts - 1) throw err;
-        await new Promise((r) => setTimeout(r, 15 * (i + 1)));
+        // 40ms, 120ms, 270ms, 520ms, 900ms, 1.4s, 2.2s → ~5.5s cumulative.
+        await new Promise((r) => setTimeout(r, 40 * (i + 1) * (i + 1) * 0.75 + 10));
       }
     }
   }

package/src/index.js

@@ -1012,7 +1012,16 @@ class LoxiaApplication {
         'ECONNRESET',
         'fetch failed',
         'AbortError',
-        'The operation was aborted'
+        'The operation was aborted',
+        // electron-updater failures (packaged app; backend shares the
+        // process). A broken/missing release asset must NEVER kill the app:
+        // v5.4.7's yml was published without its .exe and every installed
+        // 5.4.5 crash-looped ~40s after launch on exactly this rejection.
+        // The updater retries on its 6h cycle; crashing helps nobody.
+        'Cannot download',
+        'ERR_UPDATER',
+        'HttpError: 404',
+        'builder-util-runtime'
       ];
 
       const isNonCritical = nonCriticalPatterns.some(pattern =>