feat(updater): add secured preparation controls and restart admission - #51

Latest integrated QA checkpoint (c64d8aa)

Supersedes the earlier unwired-startup note: native launch/Retry gates, sealed successor verification, owned health acknowledgement, persistent two-phase completion recovery and embedded updater presentation are now connected. Official plugin Config is supplied before initialization, QA builds cannot fall back to production HOME without their exact profile, and post-install repaint failure cannot strand a verified replacement.

Private debug qualification succeeded end-to-end: A 0.2.4 → B 0.2.5, actual official replacement, automatic new-process restart, B-owned server health, committed receipt, same origin/project/unsent draft/image. No manual B launch occurred in the accepted cycle4. A further B restart did not reinstall. Local full verify, native 267 + 10 tests, standard all-target Clippy -D warnings, formatting, and focused DOM regressions passed.

This is not public activation/release or notarized same-cut acceptance. Actuation currently requires the explicit compile-bound QA qualification path. General previous-owner proof, full G3 runtime/draft freeze and safe manual restart, actual macOS 13, final signed/notarized acceptance and production key/release obligations remain. The full goal stays active and the PR stays draft. Earlier failed/harness-invalid runs are separately documented, not counted as success.

Evidence and exact limitations: docs/DESKTOP-UPDATER-LAUNCH-QA.md. All QA executables/feed stopped; old intermediate bundle copies reversibly renamed .app.fixture, not offered as installers. Production installation/data/releases were not targeted. Source versions are back at beta.10/0.2.4; beta.11/0.2.5 exists only as a private QA artifact.

Active-goal checkpoint: native installation core (e143546)

The full goal remains automatic updating and distribution, not preparation-only success. Added immutable revalidated cache input, supported exact-endpoint plugin reconstruction, native installation location checks, a durable PID-bound attempt journal, the official install invocation and a complete installed-bundle verifier. Startup/restart does not invoke this path yet, so installation remains unavailable and this PR remains draft. Successor health acknowledgment/attempt archival, launch/restart recovery, complete G3 ownership and signed QA/release gates are next; none was waived.

Validation: full npm run verify; native 236 tests + 10 build-binding tests; 20,673-entry comparison of the historical isolated B against its archive. This comparison is not a new live A-to-B install. Standard native Clippy still reports unintegrated dead-code APIs; excluding only that warning class is documented, not claimed as final release lint. Exact evidence/next steps: docs/DESKTOP-UPDATER-INSTALL-PROGRESS.md.

The prior remote CI SSOT failure was fixed by 7ef7cda; its Node 22/24 and Linux server checks passed. New native-head remote checks are separate. No production app/key/version/release mutation occurred.

Status: preparation and partial restart integration — not a finished auto-updater

Stacked on #50. Keep this PR draft: installationAvailable remains false and native restart explicitly rejects. No production installation, version bump, updater key provisioning or release publication is included.

Latest: runtime admission and unsent draft durability (da8a0c5)

• One production restart authority is injected into HTTP handlers, authentication and existing chat/PTY sockets. The actual handler promise—not response finish or client disconnect—owns the lease. Prepared tokens are invalidated by intervening completion activity.
• Compose real chat/worker/shell readers while every missing required owner remains an explicit blocker. Track OAuth cancellation unwind, title persistence, expired request uncertainty and retiring PTYs without force-draining work. Live worker/SDK and detached-descendant completeness are not claimed.
• Upload and stream ownership spans storage callbacks, descriptor closure and cleanup; exclusive image creation preserves existing file/symlink collisions.
• The actual composer persists unsent text, image Files and queued intents with bounded IndexedDB transactions and stale-write rejection. Preserve route identity, prior committed data and oversized legacy queues. Add explicit recovery retry and restored-intent review, while keeping ordinary text-only background dispatch.
• Independent review regressions were reproduced and fixed: duplicate legacy sends, wrong-project steering acknowledgments, un-retryable recovery/conflicts, silent migration truncation, missing queue notifications and cancelled enrichment launching work later. Stale OAuth UI ownership no longer bypasses admission.

Validation on the frozen source set:

• Full npm run verify passed; source/test/locale SHA256 inventory remained identical throughout final promotion verification and after commit hooks.
• Expanded backend integration: 237 passed; worker: 63 passed; OAuth/SDK: 102 passed, one optional live test skipped.
• Focused final composer/storage/queue DOM tests: 62 passed, with EN/KO error/retry UI and ten-locale parity.
• Desktop cargo fmt/locked tests: 182 passed, one opt-in fixture ignored; build-binding 10 passed. GJC e2e 8 passed; browser-sidecar e2e 3 passed.
• Browser skill QA on an isolated origin verified actual composer File/queue restoration, stable IDs and file hashes, project separation, stale-window conflict rejection, and review without automatic replay. This is not native WKWebView or A-to-B installation acceptance.

See docs/DESKTOP-UPDATE-ADMISSION-IMPLEMENTATION.md for exact scope, evidence and gaps. New remote CI is separate from these local results.

Earlier preparation/control implementation retained

• Native bounded discovery/download/archive/signature/staging and persistent opt-out, with web SemVer beta/stable notification fallback.
• Shared native snapshot/command contract and About UI; desktop status comes only from validated native state.
• Main-view/navigation-bound preparation bridge via private UDS, fresh owned-stdin initialization, cookie/exact Origin, native HMAC proof before view-capability disclosure, kernel peer PID, replay/queue/deadline limits and retirement checks. Ordinary browsers gain no native updater permission.
• Actual compile-bound isolated debug QA app tested About status, automatic-off persistence, manual check, malformed-feed recovery, normal exit, same origin and preference after relaunch. Fixed nonblocking accepted sockets, excessive QA automation socket paths and stale startup status.
• The example journal/profile initializer is QA-only; it is not the product attempt writer/resolver. Prior native Clippy and journal proofs are documented in docs/DESKTOP-UPDATER-QA-PREPARATION.md.
• Parent 49c1010 remote Node 22/24, Linux server and Linux desktop/package/GUI checks passed. Do not apply those results to the new head without checking its own runs.

Installer evidence and remaining gates

Historical official updater 2.6.0 probes used private HTTPS and isolated signed A/B copies. Normal and authorization-path replacements succeeded; the latter was not cancellation. A second probe returned failure with complete A unchanged, but the user cannot confirm the authorization action and privileged-writer classification remains unproved. These historical bundles retain the advertised-11/loader-13 mismatch and are primitive evidence only.

Still required:

• G0 installer cancel/writer/error qualification and actual macOS 13 execution. No known local environment is available; no safety/support gate was waived.
• Remaining producer admission/readers, worker-host background ownership, global draft/attachment/send freeze acknowledgment, safe shutdown with proven owned-server exit and lock handoff.
• Product attempt writer/resolver, pre-server next-launch installation, embedded applying/recovery and interrupted-install behavior.
• Integrated signed/notarized QA A-to-B with data/origin/auth/settings/draft preservation; production updater key custody/backup and release gates.
• First updater-enabled manual DMG bootstrap and a distinct subsequent public release that proves automatic updating.

Exact handoff: docs/MACOS-UPDATER-HANDOFF.md and docs/DESKTOP-UPDATE-ADMISSION.md.

SDK lifecycle and root draft bridge checkpoint (721806d)

• Applied the eight exact version/hash-bound SDK/core/AI 0.16.4 lifecycle edits through the same root/staged postinstall. Runtime manifest v2 checks every SDK post-hash and the actual nested dependency resolution before SDK imports. Source integrity is not a whole-worker idle certificate.
• Accounted registry maintenance, auth timeout/cancel losers, and pending settings persistence. Unrepresented streaming/extension tails still remain unknown; public installation is still disabled.
• Registered the page-local draft owner in the actual native-injected view bridge, with stale registration/response revocation. Registration is not a save ACK, restart, or installation authority; the native transaction and previous-owner proof remain pending.
• Fixed the Linux shutdown-order regression in 06bbc51; its CI, Linux server archive and Linux desktop checks passed.
• Local SDK integration promotion passed with unchanged source+patched-SDK hashes; GJC E2E 8, browser E2E 3, desktop Rust 267 + binding 10 passed. A new macOS payload applied the patch from a fresh npm installation and passed out-of-tree patch/native/Bun worker/server smokes. These are not signed/notarized A→B or public-release acceptance.
• No public release, production key provisioning, or changes to the installed app. Full automatic-update-and-distribution goal remains open, including native prepare/commit/sealed draft handoff, owner proof, signing custody and required OS acceptance.