fix(restore): address recursive gatekeeper findings

Preserve inactive workspace identities, selected drafts, attachments, and late prompt hydration so Electron and Tauri restore every tab instead of only the globally active one.

Fence renderer and message hydration races, harden cross-host stale-owner recovery, serialize shutdown after state capture, and make Windows process cleanup use consistent identities and refreshed descendant trees. Distinguish explicit workspace deletion from transient stops, prevent request ownership reactivation, and retire migrated legacy state without shadowing future envelopes.

Add PR behavioral checks and regression coverage across UI persistence, Electron lifecycle/process cleanup, server workspace shutdown, and Tauri client state. Validated with 93 Electron tests, 53 focused UI tests, 23 server tests, 65 Rust tests, all TypeScript typechecks, cargo check, targeted rustfmt, and the production UI build.

Author: pascalandr

.github/workflows/pr-build.yml

@@ -56,3 +56,49 @@ jobs:
       actions_artifacts_retention_days: 7
       actions_artifacts_name_prefix: pr-${{ github.event.pull_request.number }}-${{ github.event.pull_request.head.sha }}-
       set_versions: false
+
+  tests:
+    needs: authorize
+    if: ${{ needs.authorize.outputs.allowed == 'true' && !github.event.pull_request.draft }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Typecheck desktop clients
+        run: npm run typecheck
+
+      - name: Test Electron client state
+        run: npm run test:native --workspace @neuralnomads/codenomad-electron-app
+
+      - name: Test UI restoration authority
+        run: >-
+          node --import tsx --test
+          packages/ui/src/stores/client-state-codec.test.ts
+          packages/ui/src/stores/app-session-snapshot-merge.test.ts
+          packages/ui/src/stores/message-v2/message-hydration-authority.test.ts
+
+      - name: Test server lifecycle
+        run: >-
+          node --import tsx --test
+          packages/server/src/index.test.ts
+          packages/server/src/shutdown.test.ts
+          packages/server/src/workspaces/manager.test.ts
+
+      - name: Test Tauri client state
+        working-directory: packages/tauri-app/src-tauri
+        run: cargo test --locked client_state

packages/electron-app/electron/main/client-state-cross-host.test.ts

@@ -98,7 +98,7 @@ test("stale retirement crash cannot retire a successor", async (t) => {
   assert.equal(JSON.parse(readFileSync(ownerFile(directory), "utf8")).runToken, "successor")
 })
 
-test("stale recovery is identity guarded and blocked by live or uncertain participants", (t) => {
+test("stale recovery is identity guarded and blocked by non-claiming live participants", (t) => {
   for (const value of [
     { alive: false, identity: undefined, recover: true },
     { alive: true, identity: "reused", recover: true },
@@ -149,7 +149,7 @@ test("ordinary release removes only its participant", (t) => {
   assert.deepEqual(readdirSync(directory).filter((name) => name.startsWith("participant.") || name.startsWith("retired.")), [])
 })
 
-test("primary crash remains fenced by its live secondary cohort", async (t) => {
+test("primary crash remains fenced by its non-claiming secondary cohort", async (t) => {
   const directory = temp(t), firstStart = join(directory, "first-start")
   const primary = child(directory, firstStart), secondary = child(directory, firstStart)
   writeFileSync(firstStart, "")

packages/electron-app/electron/main/client-state-cross-host.ts

@@ -181,7 +181,13 @@ function recoveryClaimants(
       try { unlinkSync(recoveryPath(directory, participant)) } catch {}
       continue
     }
-    if (readIfExists(recoveryPath(directory, participant)) !== observedOwner) return undefined
+    const claimPath = recoveryPath(directory, participant)
+    let claim = readIfExists(claimPath)
+    for (let attempt = 0; claim !== observedOwner && attempt < 20; attempt += 1) {
+      Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 5)
+      claim = readIfExists(claimPath)
+    }
+    if (claim !== observedOwner) return undefined
     claimants.push(participant)
   }
   return claimants

packages/electron-app/electron/main/client-state-ipc.ts

@@ -39,24 +39,24 @@ export function setupClientStateIPC(
   }
   const handle = (
     channel: string,
-    operation: (argument: unknown) => unknown,
+    operation: (argument: unknown, token: unknown) => unknown,
   ) => ipcMain.handle(channel, async (event, token: unknown, argument: unknown) => {
     validate(event)
     clientState.assertRendererAccessToken(token)
-    return operation(argument)
+    return operation(argument, token)
   })
 
   ipcMain.handle("client-state:claimAccess", async (event, token: unknown) => {
     validate(event)
     return clientState.claimClientStateAccess(token)
   })
   handle("client-state:load", () => clientState.loadClientState())
-  handle("client-state:save", (snapshot) => clientState.saveClientState(snapshot))
-  handle("client-state:setRestoreEnabled", (enabled) => {
+  handle("client-state:save", (snapshot, token) => clientState.saveClientState(snapshot, token))
+  handle("client-state:setRestoreEnabled", (enabled, token) => {
     if (typeof enabled !== "boolean") throw new Error("Restore enabled must be a boolean")
-    return clientState.setRestoreEnabled(enabled)
+    return clientState.setRestoreEnabled(enabled, token)
   })
-  handle("client-state:clear", () => clientState.clearClientState())
+  handle("client-state:clear", (_argument, token) => clientState.clearClientState(token))
 
   return (window: BrowserWindow): void => {
     window.webContents.on("did-navigate", (_event, url) => {

packages/electron-app/electron/main/client-state-lifecycle.test.ts

@@ -64,18 +64,18 @@ test("late old-window detach preserves replacement tracker during shutdown", asy
   h.lifecycle.detachMainWindow(h.window)
   h.appEvents.get("before-quit")?.({ preventDefault: () => {} })
   await (h.lifecycle as any).shutdown
-  assert.deepEqual(h.calls, ["hide", "renderer", "stop", "replacement-native", "release"])
+  assert.deepEqual(h.calls, ["hide", "renderer", "replacement-native", "stop", "release"])
 })
 
-test("Windows session end starts cleanup without vetoing or explicitly exiting", async () => {
+test("Windows session end vetoes termination until cleanup exits explicitly", async () => {
   const h = harness()
   let prevented = false
   h.windows.get("query-session-end")?.({ preventDefault: () => { prevented = true } })
   h.windows.get("session-end")?.()
   await (h.lifecycle as any).sessionEnd; await tick()
-  assert.equal(prevented, false)
-  assert.deepEqual(h.calls, ["renderer", "stop", "native", "release"])
-  assert.equal(h.exits(), 0)
+  assert.equal(prevented, true)
+  assert.deepEqual(h.calls, ["renderer", "native", "stop", "release"])
+  assert.equal(h.exits(), 1)
 })
 
 test("session end does not force-exit an already-hung ordinary shutdown", async () => {
@@ -84,8 +84,8 @@ test("session end does not force-exit an already-hung ordinary shutdown", async
   h.appEvents.get("before-quit")?.({ preventDefault: () => {} })
   h.windows.get("query-session-end")?.({ preventDefault: () => { prevented = true } })
   await tick()
-  assert.equal(prevented, false)
-  assert.deepEqual(h.calls, ["hide", "renderer", "stop"])
+  assert.equal(prevented, true)
+  assert.deepEqual(h.calls, ["hide", "renderer"])
   assert.equal(h.exits(), 0)
 })
 
@@ -94,11 +94,11 @@ test("ordinary quit hides promptly and waits for CLI stop confirmation", async (
   const h = harness({ stop: () => new Promise<void>((resolve) => { confirmStop = resolve }) })
   h.appEvents.get("before-quit")?.({ preventDefault: () => {} })
   await tick()
-  assert.deepEqual(h.calls, ["hide", "renderer", "stop", "native"])
+  assert.deepEqual(h.calls, ["hide", "renderer", "native", "stop"])
   assert.equal(h.exits(), 0)
   confirmStop()
   await (h.lifecycle as any).shutdown; await tick()
-  assert.deepEqual(h.calls, ["hide", "renderer", "stop", "native", "release"])
+  assert.deepEqual(h.calls, ["hide", "renderer", "native", "stop", "release"])
   assert.equal(h.exits(), 1)
 })
 
@@ -108,15 +108,18 @@ test("ordinary quit does not exit when CLI cleanup is unconfirmed", async () =>
   await assert.rejects((h.lifecycle as any).shutdown, /unconfirmed/)
   await tick()
   assert.equal(h.exits(), 0)
-  assert.deepEqual(h.calls, ["hide", "renderer", "stop", "native"])
+  assert.deepEqual(h.calls, ["hide", "renderer", "native", "stop"])
 })
 
-test("CLI termination starts before a hung native flush", async () => {
-  const h = harness({ nativeFlush: () => new Promise(() => {}) })
+test("CLI termination waits for the native snapshot flush", async () => {
+  let release!: () => void
+  const h = harness({ nativeFlush: () => new Promise<void>((resolve) => { release = resolve }) })
   h.appEvents.get("before-quit")?.({ preventDefault: () => {} })
   await tick()
-  assert.deepEqual(h.calls, ["hide", "renderer", "stop", "native"])
+  assert.deepEqual(h.calls, ["hide", "renderer", "native"])
   assert.equal(h.exits(), 0)
+  release(); await (h.lifecycle as any).shutdown
+  assert.deepEqual(h.calls, ["hide", "renderer", "native", "stop", "release"])
 })
 
 test("closing the final window hides it before requesting quit", () => {

packages/electron-app/electron/main/client-state-lifecycle.ts

@@ -58,8 +58,9 @@ export class ClientStateLifecycle {
     })
 
     if (this.dependencies.isWindows ?? process.platform === "win32") {
-      window.on("query-session-end", () => {
+      window.on("query-session-end", (event) => {
         if (this.exitAllowed) return
+        event.preventDefault()
         this.promoteToSessionEnd(window)
       })
       window.on("session-end", () => this.promoteToSessionEnd(window))
@@ -93,15 +94,15 @@ export class ClientStateLifecycle {
   private startShutdown(window: BrowserWindow | null): Promise<void> {
     if (this.shutdown) return this.shutdown
     const stages = (async () => {
-      const rendererFlush = this.runStage("renderer shutdown flush", () => this.flushRenderer(window))
-      const cliStop = this.dependencies.cliManager.shutdown().then(() => null, (error: unknown) => error)
-      await rendererFlush
+      await this.runStage("renderer shutdown flush", () => this.flushRenderer(window))
       await this.runStage("native shutdown flush", () => this.flushNative())
-      const cliError = await cliStop
-      if (cliError) throw cliError
+      await this.dependencies.cliManager.shutdown()
       await this.runStage("primary release", () => this.dependencies.clientStateManager.drainAndReleasePrimary())
     })()
-    this.shutdown = stages
+    this.shutdown = stages.catch((error) => {
+      this.shutdown = null
+      throw error
+    })
     return this.shutdown
   }
 
@@ -114,7 +115,8 @@ export class ClientStateLifecycle {
   private promoteToSessionEnd(window: BrowserWindow): void {
     if (this.exitAllowed || this.sessionEnd) return
     this.sessionEnd = this.startShutdown(window)
-    void this.sessionEnd.catch((error) => {
+    void this.sessionEnd.then(() => this.exit()).catch((error) => {
+      this.sessionEnd = null
       console.warn("[client-state] OS session-end cleanup was not contained before termination", error)
     })
   }

packages/electron-app/electron/main/client-state-process-identity.ts

@@ -51,7 +51,7 @@ export function getProcessStartIdentity(pid: number): string | undefined {
           "-NoProfile",
           "-NonInteractive",
           "-Command",
-          `(Get-Process -Id ${pid} -ErrorAction Stop).StartTime.ToUniversalTime().Ticks`,
+          `(Get-CimInstance Win32_Process -Filter "ProcessId = ${pid}" -ErrorAction Stop).CreationDate.ToUniversalTime().Ticks`,
         ],
         "win32",
       )

packages/electron-app/electron/main/client-state.test.ts

@@ -94,8 +94,8 @@ test("first shared primary deterministically migrates legacy host envelopes", as
   const manager = new ClientStateManager(electron, undefined, { crossHostElectionDirectory: election, legacyTauriDataPath: tauri })
   assert.deepEqual(manager.loadClientState().snapshot, { savedAt: 20, host: "tauri" })
   assert.equal(manager.getWindowState(), undefined)
-  assert.equal(existsSync(join(electron, "client-state.json")), true)
-  assert.equal(existsSync(join(tauri, "client-state.json")), true)
+  assert.equal(existsSync(join(electron, "client-state.json")), false)
+  assert.equal(existsSync(join(tauri, "client-state.json")), false)
   await manager.drainAndReleasePrimary()
 })