fix(restore): resolve gatekeeper concurrency blockers

Guard asynchronous session search, parent hydration, and message loading with deletion authority and per-session request epochs so stale responses cannot resurrect deleted or evicted state.

Make Electron shutdown identity-safe and bounded: do not veto or force-exit Windows session end, require the graceful completion handshake, capture immutable descendant identities, reject PID reuse, and confirm process disappearance after enforcement.

Serialize Electron/Tauri cross-host owner and participant transitions with a shared atomic lock so simultaneous startup elects one primary and participant publication cannot cross cohort release.

Validated with Electron native tests, focused UI and server suites, Tauri client-state tests, UI/Electron/server typechecks, cargo check, and focused Rust formatting.

Author: pascalandr

packages/electron-app/electron/main/client-state-cross-host-child.ts

@@ -1,13 +1,35 @@
 import { existsSync, writeFileSync } from "node:fs"
 import { CrossHostRegistration, createCrossHostOwner } from "./client-state-cross-host"
+import { getProcessStartIdentity } from "./client-state-process-identity"
+import { isPidAlive } from "./client-state-process"
+import { ClientStateManager } from "./client-state"
 
-const [directory, startPath, readyPath] = process.argv.slice(2)
+const [directory, startPath, readyPath, mode, userDataPath, participantReadyPath, participantContinuePath] = process.argv.slice(2)
 if (!directory || !startPath) throw new Error("Expected election directory and start path")
 if (readyPath) writeFileSync(readyPath, "")
 while (!existsSync(startPath)) Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 5)
 
-const owner = createCrossHostOwner()
+const manager = mode === "full" && userDataPath
+  ? new ClientStateManager(userDataPath, undefined, {
+      crossHostElectionDirectory: directory,
+      legacyTauriDataPath: null,
+      crossHostDependencies: {
+        pidAlive: isPidAlive,
+        processStartIdentity: getProcessStartIdentity,
+        onParticipantPublished: participantReadyPath && participantContinuePath
+          ? () => {
+              writeFileSync(participantReadyPath, "")
+              while (!existsSync(participantContinuePath)) Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 5)
+            }
+          : undefined,
+      },
+    })
+  : undefined
+const owner = manager ? undefined : createCrossHostOwner()
 const registration = owner && CrossHostRegistration.register(directory, owner, true)
-process.stdout.write(`${JSON.stringify({ acquired: Boolean(registration?.isPrimary) })}\n`)
+process.stdout.write(`${JSON.stringify({ acquired: manager?.isPrimary ?? Boolean(registration?.isPrimary) })}\n`)
 process.stdin.resume()
-process.stdin.once("end", () => registration?.release())
+process.stdin.once("end", () => {
+  if (manager) void manager.drainAndReleasePrimary().finally(() => process.exit())
+  else registration?.release()
+})

packages/electron-app/electron/main/client-state-cross-host.ts

@@ -7,6 +7,8 @@ import {
   openSync,
   readdirSync,
   readFileSync,
+  renameSync,
+  rmdirSync,
   unlinkSync,
   writeFileSync,
 } from "node:fs"
@@ -21,10 +23,17 @@ const PARTICIPANT_SUFFIX = ".json"
 const REMOVAL_CLAIM_PREFIX = "removed."
 const REMOVAL_CLAIM_SUFFIX = ".claim"
 const ACQUIRE_ATTEMPTS = 10
+const PROTOCOL_LOCK_DIRECTORY = "protocol.lock"
+const PROTOCOL_LOCK_OWNER_FILENAME = "owner.json"
+const RETIRED_LOCK_PREFIX = "retired."
+const RETIRED_LOCK_SUFFIX = ".lock"
+const PROTOCOL_LOCK_ATTEMPTS = 500
+const PROTOCOL_LOCK_RETRY_MS = 10
 
 export interface CrossHostLeaseDependencies {
   pidAlive(pid: number): boolean
   processStartIdentity: ProcessStartIdentityLookup
+  onParticipantPublished?(): void
 }
 
 const defaultDependencies: CrossHostLeaseDependencies = {
@@ -168,6 +177,90 @@ function ownerIsStale(owner: ProcessOwner, dependencies: CrossHostLeaseDependenc
   return identity ? identity !== owner.processStartIdentity : undefined
 }
 
+function waitForProtocolLock(): void {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, PROTOCOL_LOCK_RETRY_MS)
+}
+
+function protocolLockOwnerPath(lockDirectory: string): string {
+  return join(lockDirectory, PROTOCOL_LOCK_OWNER_FILENAME)
+}
+
+function retireProtocolLock(electionDirectory: string, observed: string): boolean {
+  const lockDirectory = join(electionDirectory, PROTOCOL_LOCK_DIRECTORY)
+  if (readIfExists(protocolLockOwnerPath(lockDirectory)) !== observed) return false
+  const retired = join(electionDirectory, `${RETIRED_LOCK_PREFIX}${digest(observed)}${RETIRED_LOCK_SUFFIX}`)
+  try {
+    // ponytail: immutable retirement directories accumulate; clean them only if directory growth becomes material.
+    renameSync(lockDirectory, retired)
+    return true
+  } catch (error) {
+    if (hasErrorCode(error, "ENOENT") || hasErrorCode(error, "EEXIST") || hasErrorCode(error, "ENOTEMPTY")) return false
+    throw error
+  }
+}
+
+function acquireProtocolLock(
+  electionDirectory: string,
+  owner: ProcessOwner,
+  dependencies: CrossHostLeaseDependencies,
+): ProcessOwner | undefined {
+  const lockDirectory = join(electionDirectory, PROTOCOL_LOCK_DIRECTORY)
+  const lockOwner = { ...owner, runToken: `${owner.runToken}.${randomUUID()}` }
+  const serialized = serializeOwner(lockOwner)
+  for (let attempt = 0; attempt < PROTOCOL_LOCK_ATTEMPTS; attempt += 1) {
+    try {
+      mkdirSync(lockDirectory, { mode: 0o700 })
+      try {
+        publishProcessLockOwner(protocolLockOwnerPath(lockDirectory), serialized)
+        return lockOwner
+      } catch (error) {
+        try { rmdirSync(lockDirectory) } catch {}
+        throw error
+      }
+    } catch (error) {
+      if (!hasErrorCode(error, "EEXIST")) throw error
+    }
+
+    const observed = readIfExists(protocolLockOwnerPath(lockDirectory))
+    const existing = observed === undefined ? undefined : parseOwner(observed)
+    if (!existing) {
+      if (observed !== undefined && attempt >= ACQUIRE_ATTEMPTS - 1) return undefined
+      waitForProtocolLock()
+      continue
+    }
+    const stale = ownerIsStale(existing, dependencies)
+    if (stale === undefined || !stale) {
+      waitForProtocolLock()
+      continue
+    }
+    retireProtocolLock(electionDirectory, observed!)
+  }
+  return undefined
+}
+
+function publishProcessLockOwner(path: string, value: string): void {
+  let descriptor: number | undefined
+  try {
+    descriptor = openSync(path, "wx", 0o600)
+    writeFileSync(descriptor, value, "utf8")
+    try { fsyncSync(descriptor) } catch (error) {
+      if (!hasErrorCode(error, "EINVAL") && !hasErrorCode(error, "ENOTSUP") && !hasErrorCode(error, "ENOSYS")) throw error
+    }
+    closeSync(descriptor)
+    descriptor = undefined
+  } catch (error) {
+    if (descriptor !== undefined) try { closeSync(descriptor) } catch {}
+    try { unlinkSync(path) } catch {}
+    throw error
+  }
+}
+
+function releaseProtocolLock(electionDirectory: string, owner: ProcessOwner): void {
+  const observed = readIfExists(protocolLockOwnerPath(join(electionDirectory, PROTOCOL_LOCK_DIRECTORY)))
+  const current = observed === undefined ? undefined : parseOwner(observed)
+  if (observed !== undefined && current && sameOwner(current, owner)) retireProtocolLock(electionDirectory, observed)
+}
+
 function removeObservedOwner(
   electionDirectory: string,
   path: string,
@@ -245,59 +338,64 @@ export class CrossHostRegistration {
   ): CrossHostRegistration | undefined {
     if (!owner.processStartIdentity) return undefined
     mkdirSync(electionDirectory, { recursive: true, mode: 0o700 })
+    const protocolLockOwner = acquireProtocolLock(electionDirectory, owner, dependencies)
+    if (!protocolLockOwner) return undefined
     const path = join(electionDirectory, CROSS_HOST_OWNER_FILENAME)
     const participant = participantPath(electionDirectory, owner)
     let primary = false
 
-    if (primaryCandidate) {
-      try {
-        publish(path, serializeOwner(owner))
-        primary = true
-      } catch (error) {
-        if (!hasErrorCode(error, "EEXIST")) throw error
-      }
-    }
-
-    if (primaryCandidate && !primary) {
-      for (let attempt = 0; attempt < ACQUIRE_ATTEMPTS; attempt += 1) {
+    try {
+      if (primaryCandidate) {
         try {
           publish(path, serializeOwner(owner))
           primary = true
-          break
         } catch (error) {
           if (!hasErrorCode(error, "EEXIST")) throw error
         }
+      }
 
-        const observed = readIfExists(path)
-        if (observed === undefined) continue
-        const existing = parseOwner(observed)
-        if (!existing) break
-        if (sameOwner(existing, owner)) {
-          primary = true
-          break
+      if (primaryCandidate && !primary) {
+        for (let attempt = 0; attempt < ACQUIRE_ATTEMPTS; attempt += 1) {
+          try {
+            publish(path, serializeOwner(owner))
+            primary = true
+            break
+          } catch (error) {
+            if (!hasErrorCode(error, "EEXIST")) throw error
+          }
+
+          const observed = readIfExists(path)
+          if (observed === undefined) continue
+          const existing = parseOwner(observed)
+          if (!existing) break
+          if (sameOwner(existing, owner)) {
+            primary = true
+            break
+          }
+          const stale = ownerIsStale(existing, dependencies)
+          if (stale === undefined || !stale || hasOtherLiveParticipants(electionDirectory, owner, dependencies)) break
+          if (!removeObservedOwner(electionDirectory, path, observed, existing, owner)) continue
         }
-        const stale = existing.pid === owner.pid && existing.runToken !== owner.runToken
-          ? true
-          : ownerIsStale(existing, dependencies)
-        if (stale === undefined || !stale || hasOtherLiveParticipants(electionDirectory, owner, dependencies)) break
-        if (!removeObservedOwner(electionDirectory, path, observed, existing, owner)) continue
       }
-    }
 
-    try {
-      publishParticipant(participant, owner)
-    } catch (error) {
-      if (primary) {
-        const observed = readIfExists(path)
-        const current = observed === undefined ? undefined : parseOwner(observed)
-        if (observed !== undefined && current && sameOwner(current, owner)) {
-          removeObservedOwner(electionDirectory, path, observed, owner, owner)
+      try {
+        publishParticipant(participant, owner)
+        dependencies.onParticipantPublished?.()
+      } catch (error) {
+        if (primary) {
+          const observed = readIfExists(path)
+          const current = observed === undefined ? undefined : parseOwner(observed)
+          if (observed !== undefined && current && sameOwner(current, owner)) {
+            removeObservedOwner(electionDirectory, path, observed, owner, owner)
+          }
         }
+        throw error
       }
-      throw error
-    }
 
-    return new CrossHostRegistration(path, owner, electionDirectory, participant, dependencies, primary)
+      return new CrossHostRegistration(path, owner, electionDirectory, participant, dependencies, primary)
+    } finally {
+      releaseProtocolLock(electionDirectory, protocolLockOwner)
+    }
   }
 
   get isPrimary(): boolean {
@@ -309,17 +407,23 @@ export class CrossHostRegistration {
 
   release(): boolean {
     if (this.released) return false
+    const protocolLockOwner = acquireProtocolLock(this.electionDirectory, this.owner, this.dependencies)
+    if (!protocolLockOwner) return false
     let removed = false
-    if (this.isPrimary && !hasOtherLiveParticipants(this.electionDirectory, this.owner, this.dependencies)) {
-      const observed = readIfExists(this.path)
-      const current = observed === undefined ? undefined : parseOwner(observed)
-      if (observed !== undefined && current && sameOwner(current, this.owner)) {
-        removed = removeObservedOwner(this.electionDirectory, this.path, observed, this.owner, this.owner)
+    try {
+      if (this.isPrimary && !hasOtherLiveParticipants(this.electionDirectory, this.owner, this.dependencies)) {
+        const observed = readIfExists(this.path)
+        const current = observed === undefined ? undefined : parseOwner(observed)
+        if (observed !== undefined && current && sameOwner(current, this.owner)) {
+          removed = removeObservedOwner(this.electionDirectory, this.path, observed, this.owner, this.owner)
+        }
       }
+      removeParticipantIfOwned(this.participant, this.owner)
+      this.primary = false
+      this.released = true
+      return removed
+    } finally {
+      releaseProtocolLock(this.electionDirectory, protocolLockOwner)
     }
-    removeParticipantIfOwned(this.participant, this.owner)
-    this.primary = false
-    this.released = true
-    return removed
   }
 }

packages/electron-app/electron/main/client-state-lifecycle.test.ts

@@ -11,7 +11,6 @@ function harness(options: {
   flush?: () => Promise<unknown>
   stop?: () => Promise<void>
   nativeFlush?: () => Promise<void>
-  timeout?: number
   otherWindow?: boolean
 } = {}) {
   const windows = new Map<string, (event?: { preventDefault(): void }) => void>()
@@ -29,7 +28,7 @@ function harness(options: {
   const app = { on: (name: string, handler: never) => appEvents.set(name, handler), quit: () => calls.push("quit"), exit: () => { exits++ } } as unknown as App
   const manager = { isPrimary: true, flush: async () => {}, drainAndReleasePrimary: async () => { calls.push("release") } } as ClientStateManager
   const cli = { stop: async () => { calls.push("stop"); await options.stop?.() } } as unknown as CliProcessManager
-  const lifecycle = new ClientStateLifecycle({ app, clientStateManager: manager, cliManager: cli, getMainWindow: () => window, getAllWindows: () => options.otherWindow ? [window, other] : [window], getAllowedRendererOrigins: () => ["http://127.0.0.1:43123"], isTrustedRendererOrigin: () => true, windowsSessionEndFlushTimeoutMs: options.timeout, rendererFlushTimeoutMs: options.timeout && options.timeout * 2, isWindows: true })
+  const lifecycle = new ClientStateLifecycle({ app, clientStateManager: manager, cliManager: cli, getMainWindow: () => window, getAllWindows: () => options.otherWindow ? [window, other] : [window], getAllowedRendererOrigins: () => ["http://127.0.0.1:43123"], isTrustedRendererOrigin: () => true, isWindows: true })
   lifecycle.attachMainWindow(window, { flush: async () => { calls.push("native"); await options.nativeFlush?.() } } as unknown as WindowStateTracker)
   lifecycle.registerAppEvents()
   const close = () => { let prevented = false; windows.get("close")?.({ preventDefault: () => { prevented = true } }); return prevented }
@@ -68,26 +67,26 @@ test("late old-window detach preserves replacement tracker during shutdown", asy
   assert.deepEqual(h.calls, ["hide", "renderer", "stop", "replacement-native", "release"])
 })
 
-test("Windows session end flushes once and exits", async () => {
+test("Windows session end starts cleanup without vetoing or explicitly exiting", async () => {
   const h = harness()
   let prevented = false
   h.windows.get("query-session-end")?.({ preventDefault: () => { prevented = true } })
   h.windows.get("session-end")?.()
   await (h.lifecycle as any).sessionEnd; await tick()
-  assert.equal(prevented, true)
+  assert.equal(prevented, false)
   assert.deepEqual(h.calls, ["renderer", "stop", "native", "release"])
-  assert.equal(h.exits(), 1)
+  assert.equal(h.exits(), 0)
 })
 
-test("session end promotes and bounds an already-hung ordinary shutdown", async () => {
-  const h = harness({ flush: () => new Promise(() => {}), timeout: 20 })
-  const started = Date.now()
+test("session end does not force-exit an already-hung ordinary shutdown", async () => {
+  const h = harness({ flush: () => new Promise(() => {}) })
+  let prevented = false
   h.appEvents.get("before-quit")?.({ preventDefault: () => {} })
-  h.windows.get("query-session-end")?.({ preventDefault: () => {} })
-  await (h.lifecycle as any).sessionEnd; await tick()
-  assert.ok(Date.now() - started < 500)
+  h.windows.get("query-session-end")?.({ preventDefault: () => { prevented = true } })
+  await tick()
+  assert.equal(prevented, false)
   assert.deepEqual(h.calls, ["hide", "renderer", "stop"])
-  assert.equal(h.exits(), 1)
+  assert.equal(h.exits(), 0)
 })
 
 test("ordinary quit hides promptly and waits for CLI stop confirmation", async () => {
@@ -103,6 +102,15 @@ test("ordinary quit hides promptly and waits for CLI stop confirmation", async (
   assert.equal(h.exits(), 1)
 })
 
+test("ordinary quit does not exit when CLI cleanup is unconfirmed", async () => {
+  const h = harness({ stop: async () => { throw new Error("unconfirmed") } })
+  h.appEvents.get("before-quit")?.({ preventDefault: () => {} })
+  await assert.rejects((h.lifecycle as any).shutdown, /unconfirmed/)
+  await tick()
+  assert.equal(h.exits(), 0)
+  assert.deepEqual(h.calls, ["hide", "renderer", "stop", "native"])
+})
+
 test("CLI termination starts before a hung native flush", async () => {
   const h = harness({ nativeFlush: () => new Promise(() => {}) })
   h.appEvents.get("before-quit")?.({ preventDefault: () => {} })