fix: check download result and abort IPC/launch on pipeline failure

Two related fixes that prevent a cyclic update loop when download or
patch application fails:

1. ClientStrategy.ExecuteDownloadAsync: return Task<DownloadReport>
   instead of Task so the caller can inspect per-asset results.
   DownloadAndApplyAsync now checks FailedCount and throws on
   failure, giving the CVP fallback a chance to retry.

2. Both scenario in ClientStrategy: check AllPackagesSucceeded after
   ApplyUpgradePackagesAsync. If upgrade packages failed to apply,
   do NOT send ProcessContract via IPC or launch the upgrade
   process — doing so would forward a stale/missing TempPath and
   cause undefined behavior.

3. UpdateStrategy: gate client launch on AllPackagesSucceeded.
   When MainApp packages fail, skip StartAppAsync to avoid
   restarting the old client, which would immediately re-detect
   the update and loop.

Co-authored-by: Claude <noreply@anthropic.com>

Author: JusterZhu

src/c#/GeneralUpdate.Core/Strategy/ClientStrategy.cs

@@ -601,13 +601,13 @@ async Task DownloadAndApplyAsync(Download.Models.DownloadPlan plan, UpdateScenar
                     downloadReport.Results.Where(r => !r.Success)
                         .Select(r => $"{r.Asset.Name}: {r.ErrorMessage}"));
                 GeneralTracer.Error($"ClientStrategy: {downloadReport.FailedCount} download(s) failed: {failDetails}");
-                EventManager.Instance.Dispatch(this,
-                    new ExceptionEventArgs(new InvalidOperationException(
-                        $"{downloadReport.FailedCount} download(s) failed. Aborting apply phase."),
-                        "Download failures detected."));
-                // Throw so CVP fallback can retry with chain packages.
-                throw new InvalidOperationException(
+                // Single exception instance for both event dispatch and throw — no
+                // allocations, consistent correlation in logs and event subscribers.
+                var ex = new InvalidOperationException(
                     $"{downloadReport.FailedCount} download(s) failed. Aborting apply phase.");
+                EventManager.Instance.Dispatch(this, new ExceptionEventArgs(ex, "Download failures detected."));
+                // Throw so CVP fallback can retry with chain packages.
+                throw ex;
             }
 
             await SafeReportDownloadCompletedAsync(hooksCtx).ConfigureAwait(false);
@@ -635,16 +635,18 @@ async Task DownloadAndApplyAsync(Download.Models.DownloadPlan plan, UpdateScenar
             {
                 case UpdateScenario.UpgradeOnly:
                     await ApplyUpgradePackagesAsync(uVersions).ConfigureAwait(false);
-                    if ((_osStrategy as AbstractStrategy)?.AllPackagesSucceeded == true)
+                    if (UpgradePackagesSucceeded())
                     {
                         await SafeOnAfterUpdateAsync(hooksCtx).ConfigureAwait(false);
                         await SafeReportUpdateAppliedAsync(hooksCtx, _upgradeRecordId).ConfigureAwait(false);
                         GeneralTracer.Info("ClientStrategy: Upgrade-only update applied, client continues running.");
                     }
                     else
                     {
-                        await SafeReportUpdateFailedAsync(hooksCtx,
-                            new InvalidOperationException("Upgrade packages failed to apply.")).ConfigureAwait(false);
+                        var failEx = new InvalidOperationException("Upgrade packages failed to apply.");
+                        await SafeOnUpdateErrorAsync(hooksCtx, failEx).ConfigureAwait(false);
+                        await SafeReportUpdateFailedAsync(hooksCtx, failEx).ConfigureAwait(false);
+                        EventManager.Instance.Dispatch(this, new ExceptionEventArgs(failEx, failEx.Message));
                         GeneralTracer.Error("ClientStrategy: Upgrade-only update failed, client continues running.");
                     }
                     break;
@@ -667,12 +669,14 @@ await SafeReportUpdateFailedAsync(hooksCtx,
                     // may be in an inconsistent state. Do NOT proceed to send IPC or
                     // launch the upgrade process — doing so would silently fail or
                     // cause undefined behavior in the upgrade process.
-                    if ((_osStrategy as AbstractStrategy)?.AllPackagesSucceeded != true)
+                    if (!UpgradePackagesSucceeded())
                     {
+                        var failEx = new InvalidOperationException("Upgrade packages failed to apply.");
+                        await SafeOnUpdateErrorAsync(hooksCtx, failEx).ConfigureAwait(false);
+                        await SafeReportUpdateFailedAsync(hooksCtx, failEx).ConfigureAwait(false);
+                        EventManager.Instance.Dispatch(this, new ExceptionEventArgs(failEx, failEx.Message));
                         GeneralTracer.Error(
                             "ClientStrategy: upgrade packages failed to apply, aborting MainApp update and upgrade launch.");
-                        await SafeReportUpdateFailedAsync(hooksCtx,
-                            new InvalidOperationException("Upgrade packages failed to apply.")).ConfigureAwait(false);
                         break;
                     }
 
@@ -1238,6 +1242,17 @@ await Reporter
         return (plan, sc);
     }
 
+    /// <summary>
+    /// Returns <c>true</c> when the OS strategy reports that all upgrade packages
+    /// were applied successfully. For custom <see cref="IStrategy"/> implementations
+    /// that do not expose <see cref="AbstractStrategy.AllPackagesSucceeded"/>,
+    /// returns <c>true</c> (assume success since no failure was signalled).
+    /// </summary>
+    private bool UpgradePackagesSucceeded()
+    {
+        return (_osStrategy as AbstractStrategy)?.AllPackagesSucceeded ?? true;
+    }
+
     /// <summary>
     /// Updates <see cref="_mainRecordId"/> and <see cref="_upgradeRecordId"/> from the
     /// current download plan so status reports use correct record identifiers after fallback.

src/c#/GeneralUpdate.Core/Strategy/UpdateStrategy.cs

@@ -122,7 +122,10 @@ public async Task ExecuteAsync()
                 // successfully. AbstractStrategy catches per-package failures and
                 // continues the loop, so ExecuteAsync() completing is not a
                 // reliable success signal on its own.
-                pipelineSucceeded = (_osStrategy as AbstractStrategy)?.AllPackagesSucceeded == true;
+                // For custom IStrategy implementations that don't expose
+                // AllPackagesSucceeded, assume success (coalesce to true)
+                // since no failure was signalled via an exception.
+                pipelineSucceeded = (_osStrategy as AbstractStrategy)?.AllPackagesSucceeded ?? true;
                 if (pipelineSucceeded)
                 {
                     WriteBackClientVersion();
@@ -142,12 +145,10 @@ public async Task ExecuteAsync()
             // restart it with old files, causing it to re-detect the update and loop.
             if (!pipelineSucceeded)
             {
-                await SafeOnUpdateErrorAsync(ctx,
-                    new InvalidOperationException("MainApp pipeline did not complete successfully."))
-                    .ConfigureAwait(false);
-                await SafeReportUpdateFailedAsync(ctx,
-                    new InvalidOperationException("MainApp pipeline did not complete successfully."))
-                    .ConfigureAwait(false);
+                var failEx = new InvalidOperationException("MainApp pipeline did not complete successfully.");
+                await SafeOnUpdateErrorAsync(ctx, failEx).ConfigureAwait(false);
+                await SafeReportUpdateFailedAsync(ctx, failEx).ConfigureAwait(false);
+                EventManager.Instance.Dispatch(this, new ExceptionEventArgs(failEx, failEx.Message));
                 return;
             }