fix(restore): simplify persistence and harden cross-platform cleanup (#602)

## Summary

- Follow up #578 by consolidating desktop persistence, restore
reconciliation, lifecycle coordination, and regression coverage.
- Preserve active drafts and attachments, request-scoped workspace
ownership, deletion tombstones, renderer authority, and bounded shutdown
behavior.
- Fix the reported macOS cleanup failure with targeted BSD process
queries and random-token-guarded process-group cleanup, without an
unverified PID fallback.

## Platform hardening

- Ignore development renderer origins in packaged Electron builds.
- Preserve staged Tauri navigation authority and handle confirmed
Windows session-end shutdown on the UI thread.
- Bound workspace launch preflight, runtime startup, and health
readiness.
- Retain cleanup ownership after unexpected leaders exit and verify
portable POSIX descendants by immutable identity or inherited launch
token.
- Add real Darwin-only process-group integration tests for macOS CI.

## Scope

- 96 files changed.
- 6,295 additions and 12,167 deletions, a net reduction of 5,872 lines
from the merged implementation.
- Consolidated duplicated tests while retaining focused race,
durability, cleanup, and platform contracts.

## Validation

- pm run typecheck
- pm run typecheck --workspace @neuralnomads/codenomad
- Electron native suite: 60 passed
- Tauri suite: 49 passed
- Focused server lifecycle/identity suite: 31 passed, 2 Darwin-only
skipped on Windows
- Focused UI restore/codec/reconciliation suite: 36 passed
- Broader server suite: 59 passed, 3 platform skips
- Broader UI suite: 97 passed, 1 skip; 2 Node 25 solid-toast loader
failures reproduced on the merged baseline
- git diff --check
- Final limited gatekeeper: PASS for server/macOS, UI restore, and
Electron/Tauri

Author: pascalandr

.github/workflows/comment-pr-artifacts.yml

@@ -93,6 +93,11 @@ jobs:
               return;
             }
 
+            if (matchedRun.conclusion !== 'success') {
+              core.setFailed(`PR Build Validation run ${matchedRun.id} concluded ${matchedRun.conclusion}.`);
+              return;
+            }
+
             const artifacts = await github.paginate(
               github.rest.actions.listWorkflowRunArtifacts,
               { owner, repo, run_id: matchedRun.id, per_page: 100 }

.github/workflows/pr-build.yml

@@ -46,7 +46,10 @@ jobs:
           fi
 
   build:
-    needs: authorize
+    needs:
+      - authorize
+      - tests
+      - tests-tauri-windows
     if: ${{ needs.authorize.outputs.allowed == 'true' && !github.event.pull_request.draft }}
     uses: ./.github/workflows/build-and-upload.yml
     with:
@@ -56,3 +59,116 @@ jobs:
       actions_artifacts_retention_days: 7
       actions_artifacts_name_prefix: pr-${{ github.event.pull_request.number }}-${{ github.event.pull_request.head.sha }}-
       set_versions: false
+
+  tests:
+    needs: authorize
+    if: ${{ needs.authorize.outputs.allowed == 'true' && !github.event.pull_request.draft }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Install Linux test dependencies (Tauri)
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y \
+            build-essential \
+            pkg-config \
+            libgtk-3-dev \
+            libglib2.0-dev \
+            libwebkit2gtk-4.1-dev \
+            libsoup-3.0-dev \
+            libayatana-appindicator3-dev \
+            librsvg2-dev
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Typecheck desktop clients
+        run: npm run typecheck
+
+      - name: Test Electron client state
+        run: npm run test:native --workspace @neuralnomads/codenomad-electron-app
+
+      - name: Test changed runnable UI behavior
+        run: >-
+          node --import tsx --test
+          packages/ui/src/lib/hooks/use-app-session-capture.test.ts
+          packages/ui/src/lib/trailing-resync.test.ts
+          packages/ui/src/stores/abort-created-workspace-cleanup.test.ts
+          packages/ui/src/stores/app-session-reconciliation.test.ts
+          packages/ui/src/stores/app-session-restore-gate.test.ts
+          packages/ui/src/stores/app-session-restore-queue.test.ts
+          packages/ui/src/stores/app-session-restore-timeout.test.ts
+          packages/ui/src/stores/app-session-snapshot-merge.test.ts
+          packages/ui/src/stores/restore-workspace-commit-gates.test.ts
+          packages/ui/src/stores/client-state-codec.test.ts
+          packages/ui/src/stores/client-state.test.ts
+          packages/ui/src/stores/instances-restore-cancellation.test.ts
+          packages/ui/src/stores/message-v2/message-hydration-authority.test.ts
+          packages/ui/src/stores/session-generation-recovery.test.ts
+          packages/ui/src/stores/session-metadata.test.ts
+          packages/ui/src/stores/session-pagination.test.ts
+          packages/ui/src/stores/workspace-list-reconciliation-fence.test.ts
+
+      - name: Test restore ownership integration
+        run: >-
+          node --conditions=browser --import tsx --test --test-force-exit
+          packages/ui/src/stores/instances-restore-ownership.test.ts
+
+      - name: Test server
+        run: node --import tsx --test "packages/server/src/**/*.test.ts"
+
+      - name: Prepare Tauri test resources
+        run: >-
+          npm run dev:prep --workspace @codenomad/tauri-app &&
+          node -e "require('fs').mkdirSync('packages/tauri-app/src-tauri/resources/server',{recursive:true})"
+
+      - name: Test Tauri crate
+        working-directory: packages/tauri-app/src-tauri
+        run: cargo test --locked
+
+  tests-tauri-windows:
+    needs: authorize
+    if: ${{ needs.authorize.outputs.allowed == 'true' && !github.event.pull_request.draft }}
+    runs-on: windows-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Test Windows server spawn behavior
+        run: node --import tsx --test packages/server/src/workspaces/__tests__/spawn.test.ts
+
+      - name: Prepare Tauri test resources
+        run: >-
+          npm run dev:prep --workspace @codenomad/tauri-app &&
+          node -e "require('fs').mkdirSync('packages/tauri-app/src-tauri/resources/server',{recursive:true})"
+
+      - name: Test Tauri crate on Windows
+        working-directory: packages/tauri-app/src-tauri
+        run: cargo test --locked

packages/electron-app/electron/main/client-state-cross-host-child.ts

@@ -0,0 +1,47 @@
+import { existsSync, writeFileSync } from "node:fs"
+import { CrossHostRegistration, createCrossHostOwner } from "./client-state-cross-host"
+import { getProcessStartIdentity } from "./client-state-process-identity"
+import { isPidAlive } from "./client-state-process"
+import { ClientStateManager } from "./client-state"
+
+const [directory, startPath, readyPath, mode, userDataPath, participantReadyPath, participantContinuePath, legacyTauriDataPath, operation, payload] = process.argv.slice(2)
+if (!directory || !startPath) throw new Error("Expected election directory and start path")
+if (readyPath) writeFileSync(readyPath, "")
+while (!existsSync(startPath)) Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 5)
+
+const manager = mode === "full" && userDataPath
+  ? new ClientStateManager(userDataPath, undefined, {
+      crossHostElectionDirectory: directory,
+      legacyTauriDataPath: legacyTauriDataPath || null,
+      crossHostDependencies: {
+        pidAlive: isPidAlive,
+        processStartIdentity: getProcessStartIdentity,
+        onParticipantPublished: participantReadyPath && participantContinuePath
+          ? () => {
+              writeFileSync(participantReadyPath, "")
+              while (!existsSync(participantContinuePath)) Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 5)
+            }
+          : undefined,
+      },
+    })
+  : undefined
+const owner = manager ? undefined : createCrossHostOwner()
+const registration = owner && CrossHostRegistration.register(directory, owner, true, {
+  pidAlive: mode === "retire-crash" ? () => false : isPidAlive,
+  processStartIdentity: getProcessStartIdentity,
+  onOwnerPrepared: mode === "owner-crash" ? () => process.exit(91) : undefined,
+  onOwnerRetired: mode === "retire-crash" ? () => process.exit(91) : undefined,
+})
+if (manager?.isPrimary && operation === "save") {
+  await manager.setRestoreEnabled(true)
+  await manager.saveClientState(JSON.parse(payload))
+}
+process.stdout.write(`${JSON.stringify({
+  acquired: manager?.isPrimary ?? Boolean(registration?.isPrimary),
+  state: operation === "load" ? manager?.loadClientState() : undefined,
+})}\n`)
+process.stdin.resume()
+process.stdin.once("end", () => {
+  if (manager) void manager.drainAndReleasePrimary().finally(() => process.exit())
+  else registration?.release()
+})