[Evanlau1798]

What this changes

When persisting Launcher ownership fails, stop the children already owned by that supervisor generation. Previously the failure path could stop monitoring while leaving the daemon or managed tunnel alive.

Cleanup uses the existing owned-child and native tunnel-manager stop paths, coalesces repeated failures, and joins outstanding cleanup before restart. Captured references protect replacement generations; marker PID contents alone never authorize termination. Native stop failures retain ownership evidence and remain observable.

Packaged acceptance also exposed repeated runtime verification costs and a startup ordering race: yielding during verification or CDP port allocation could let Electron become ready before its debugging switches were applied. Startup now shares the verified installation, hashes source files in a bounded trusted Node-mode child, and obtains the loopback port before yielding to Electron readiness. Source, temporary and published runtime integrity checks, rollback and fail-closed errors remain enforced. Patched Electron 42.11.9 and ip-address 10.7.4 pins resolve the audit failures encountered during qualification.

Evidence

• Ownership regressions reproduce surviving owned children, duplicate managed stops and stale-generation interference before the fixes. The 21 focused tests cover real disposable children, foreign-process preservation, native stop failures, cleanup joining and replacement monitoring.
• Startup regressions reproduce late CDP switches with delayed listen/close callbacks, plus repeated handling of permanent verifier faults. Current focused coverage reports 67 passed, 2 existing platform skips, 0 failed. Corruption before copy and after publication remains rejected; failed publication restores the previous runtime.
• The final Windows x64 unpacked artifact completed a fresh-profile cold smoke in 30.5 seconds, within the unchanged 60-second limit, with runtimeVerified: true. Its packaged CJS files match the reviewed source byte for byte.
• The same artifact passed all 10 production Verify runtime checks, including authenticated browser/CDP, installed Codex route, dedicated native tunnel and independent connector.
• Installed Codex 0.163.0, explicit chatgpt-web/gpt-5.6-sol at High, Full MCP mode, read-only MXC sandbox and approvals never: exactly one real Get-Date -Format yyyy command completed with exit 0/output 2026, followed by the expected final answer.
• An actual isolated ownership-marker write failure emitted runtime.state_write_failed, stopped the owned daemon and native managed tunnel, and changed native inventory from ready to stopped. No cleanup-failure event occurred. The marker was restored, the test launcher closed normally, and the separate live service stayed healthy with the same PID throughout that test.

Earlier cold-launch timeouts, the localized effort-verification failure and denied tool attempts remain recorded as failures. The last failed final-artifact copy occurred during disk exhaustion; after space was restored the identical artifact passed. No claim about an underlying OS/driver defect is made.

Scope and invariants

• Read and followed CONTRIBUTING.md; no unrelated provider, feature or broad refactor.
• Model, route, effort, connector and turn-bound capability selection remain explicit; Browser-only gains no broker or connector.
• No weaker integrity checks, added test skips, relaxed deadlines or system privilege changes.
• No browser state, credentials, tunnel IDs, raw logs, generated artifacts or private paths committed.
• Dependency changes are limited to the two security patches required by the audit gate; application version unchanged.

Verification

Candidate: d3917b00cef27dbce30c98679788751ff2450940 (verified/reviewed working inputs matched before committing).

• bun install --frozen-lockfile in root and launcher/, pinned Bun 1.4.0 / 34cbb9a40; both report no changes.
• Literal bun run verify: exit 0, including both audits, root/launcher typechecks, renderer build, runtime bundle, third-party notices and RELOCATABLE_RUNTIME_SMOKE_OK.
• Root tests: 1,040 passed, 90 existing skips, 0 failed. Launcher tests: 454 passed, 4 existing skips, 0 failed.
• Focused regressions, affected manual behavior and real installed-Codex Full MCP integration as described above.
• Fresh independent reviews completed; no confirmed P0/P1/P2 findings remain in the reviewed changes.

Platform or account validation

Actually exercised: Windows x64 unpacked native package, official Electron 42.11.9, Node 22.17.0, pinned Bun 1.4.0; isolated authenticated ChatGPT and Codex homes, dedicated tunnel/connector and separate tunnel registry. Final app.asar SHA-256: 47891d51cde8a1a5adc66fe472d4d041c3762f2c9f1d564003b194a2368f9b15.

Not run: macOS/Linux native packages, NSIS installer/install-over-existing smoke, or hosted CI jobs. No existing installation was replaced. The previous upstream workflow required maintainer approval (action_required, zero jobs executed); the new head's hosted result must be assessed separately. Local qualification passes; no hosted or cross-platform green is claimed.