fix: check download result and abort IPC/launch on pipeline failure

Two related fixes that prevent a cyclic update loop when download or
patch application fails:

1. ClientStrategy.ExecuteDownloadAsync: return Task<DownloadReport>
   instead of Task so the caller can inspect per-asset results.
   DownloadAndApplyAsync now checks FailedCount and throws on
   failure, giving the CVP fallback a chance to retry.

2. Both scenario in ClientStrategy: check AllPackagesSucceeded after
   ApplyUpgradePackagesAsync. If upgrade packages failed to apply,
   do NOT send ProcessContract via IPC or launch the upgrade
   process — doing so would forward a stale/missing TempPath and
   cause undefined behavior.

3. UpdateStrategy: gate client launch on AllPackagesSucceeded.
   When MainApp packages fail, skip StartAppAsync to avoid
   restarting the old client, which would immediately re-detect
   the update and loop.

Co-Authored-By: Claude <noreply@anthropic.com>

Author: JusterZhu

src/c#/GeneralUpdate.Core/Strategy/ClientStrategy.cs

@@ -573,27 +573,42 @@ private async Task ExecuteStandardWorkflowAsync()
         // ════════════════════════════════════════════════════════════════════
         var orchOptions = Download.Models.DownloadOrchestratorOptions.From(_configInfo);
 
-        async Task ExecuteDownloadAsync(Download.Models.DownloadPlan plan)
+        async Task<Download.Abstractions.DownloadReport> ExecuteDownloadAsync(Download.Models.DownloadPlan plan)
         {
             if (_orchestrator != null)
             {
-                await _orchestrator.ExecuteAsync(plan, _configInfo.TempPath).ConfigureAwait(false);
+                return await _orchestrator.ExecuteAsync(plan, _configInfo.TempPath).ConfigureAwait(false);
             }
             else
             {
                 var httpClient = GeneralUpdate.Core.Network.HttpClientProvider.Shared;
                 var orchestrator = new Download.Orchestrators.DefaultDownloadOrchestrator(
                     httpClient, orchOptions, _customDownloadPolicy,
                     _customDownloadExecutor, _customDownloadPipelineFactory);
-                await orchestrator.ExecuteAsync(plan, _configInfo.TempPath).ConfigureAwait(false);
+                return await orchestrator.ExecuteAsync(plan, _configInfo.TempPath).ConfigureAwait(false);
             }
         }
 
         // Download + report + build version lists + scenario dispatch
         async Task DownloadAndApplyAsync(Download.Models.DownloadPlan plan, UpdateScenario sc)
         {
             GeneralTracer.Info($"ClientStrategy: downloading {plan.Assets.Count} asset(s).");
-            await ExecuteDownloadAsync(plan).ConfigureAwait(false);
+            var downloadReport = await ExecuteDownloadAsync(plan).ConfigureAwait(false);
+
+            if (downloadReport.FailedCount > 0)
+            {
+                var failDetails = string.Join(", ",
+                    downloadReport.Results.Where(r => !r.Success)
+                        .Select(r => $"{r.Asset.Name}: {r.ErrorMessage}"));
+                GeneralTracer.Error($"ClientStrategy: {downloadReport.FailedCount} download(s) failed: {failDetails}");
+                EventManager.Instance.Dispatch(this,
+                    new ExceptionEventArgs(new InvalidOperationException(
+                        $"{downloadReport.FailedCount} download(s) failed. Aborting apply phase."),
+                        "Download failures detected."));
+                // Throw so CVP fallback can retry with chain packages.
+                throw new InvalidOperationException(
+                    $"{downloadReport.FailedCount} download(s) failed. Aborting apply phase.");
+            }
 
             await SafeReportDownloadCompletedAsync(hooksCtx).ConfigureAwait(false);
             await SafeOnDownloadCompletedAsync(hooksCtx).ConfigureAwait(false);
@@ -620,9 +635,18 @@ async Task DownloadAndApplyAsync(Download.Models.DownloadPlan plan, UpdateScenar
             {
                 case UpdateScenario.UpgradeOnly:
                     await ApplyUpgradePackagesAsync(uVersions).ConfigureAwait(false);
-                    await SafeOnAfterUpdateAsync(hooksCtx).ConfigureAwait(false);
-                    await SafeReportUpdateAppliedAsync(hooksCtx, _upgradeRecordId).ConfigureAwait(false);
-                    GeneralTracer.Info("ClientStrategy: Upgrade-only update applied, client continues running.");
+                    if ((_osStrategy as AbstractStrategy)?.AllPackagesSucceeded == true)
+                    {
+                        await SafeOnAfterUpdateAsync(hooksCtx).ConfigureAwait(false);
+                        await SafeReportUpdateAppliedAsync(hooksCtx, _upgradeRecordId).ConfigureAwait(false);
+                        GeneralTracer.Info("ClientStrategy: Upgrade-only update applied, client continues running.");
+                    }
+                    else
+                    {
+                        await SafeReportUpdateFailedAsync(hooksCtx,
+                            new InvalidOperationException("Upgrade packages failed to apply.")).ConfigureAwait(false);
+                        GeneralTracer.Error("ClientStrategy: Upgrade-only update failed, client continues running.");
+                    }
                     break;
 
                 case UpdateScenario.MainOnly:
@@ -638,6 +662,20 @@ async Task DownloadAndApplyAsync(Download.Models.DownloadPlan plan, UpdateScenar
 
                 case UpdateScenario.Both:
                     await ApplyUpgradePackagesAsync(uVersions).ConfigureAwait(false);
+
+                    // If upgrade packages failed to apply, the upgrade process binary
+                    // may be in an inconsistent state. Do NOT proceed to send IPC or
+                    // launch the upgrade process — doing so would silently fail or
+                    // cause undefined behavior in the upgrade process.
+                    if ((_osStrategy as AbstractStrategy)?.AllPackagesSucceeded != true)
+                    {
+                        GeneralTracer.Error(
+                            "ClientStrategy: upgrade packages failed to apply, aborting MainApp update and upgrade launch.");
+                        await SafeReportUpdateFailedAsync(hooksCtx,
+                            new InvalidOperationException("Upgrade packages failed to apply.")).ConfigureAwait(false);
+                        break;
+                    }
+
                     await SafeOnAfterUpdateAsync(hooksCtx).ConfigureAwait(false);
                     await SafeReportUpdateAppliedAsync(hooksCtx, _upgradeRecordId).ConfigureAwait(false);
                     SendProcessIpc(cVersions);

src/c#/GeneralUpdate.Core/Strategy/UpdateStrategy.cs

@@ -111,6 +111,7 @@ public async Task ExecuteAsync()
             _osStrategy!.Create(_configInfo);
 
             // Apply MainApp updates -- Client already applied Upgrade packages, IPC only has MainApp versions
+            var pipelineSucceeded = true;
             if (_configInfo.UpdateVersions?.Count > 0)
             {
                 GeneralTracer.Info("UpdateStrategy: applying " + _configInfo.UpdateVersions.Count +
@@ -121,14 +122,35 @@ public async Task ExecuteAsync()
                 // successfully. AbstractStrategy catches per-package failures and
                 // continues the loop, so ExecuteAsync() completing is not a
                 // reliable success signal on its own.
-                if ((_osStrategy as AbstractStrategy)?.AllPackagesSucceeded == true)
+                pipelineSucceeded = (_osStrategy as AbstractStrategy)?.AllPackagesSucceeded == true;
+                if (pipelineSucceeded)
+                {
                     WriteBackClientVersion();
+                }
+                else
+                {
+                    GeneralTracer.Warn("UpdateStrategy: one or more MainApp packages failed, " +
+                                       "skipping manifest write and app launch.");
+                }
             }
             else
             {
                 GeneralTracer.Info("UpdateStrategy: no updates to apply, starting application directly.");
             }
 
+            // When main app updates failed, do NOT launch the client — doing so would
+            // restart it with old files, causing it to re-detect the update and loop.
+            if (!pipelineSucceeded)
+            {
+                await SafeOnUpdateErrorAsync(ctx,
+                    new InvalidOperationException("MainApp pipeline did not complete successfully."))
+                    .ConfigureAwait(false);
+                await SafeReportUpdateFailedAsync(ctx,
+                    new InvalidOperationException("MainApp pipeline did not complete successfully."))
+                    .ConfigureAwait(false);
+                return;
+            }
+
             // Hooks: after all updates applied
             await SafeOnAfterUpdateAsync(ctx).ConfigureAwait(false);