[kev1n77]

Summary

Make install, update and uninstall failures recoverable without replacing the official updater dependency. Stage and verify managed files, serialize maintenance, journal file/integration changes and recover interrupted operations. Preserve user data, unknown files and unreadable recovery records.

• Keep the installation directory and user/machine scope consistent, with protected-directory elevation and scoped registry/PATH/shortcut mutations.
• Keep tauri-plugin-updater 2.10.1 from crates.io for discovery, download and transfer signature verification. Configure bounded connection/read stalls through its public API. There is no updater source copy, Cargo patch or special dependency-boundary exception.
• Desktop's update_maintenance adapters own Windows readiness/process-lifetime handoff, native failure receipts, original-token restart, macOS bundle recovery, Linux atomic AppImage publication and graphical package authorization. Re-verify the persisted version/hash/signature and install directly from cache without another server lookup.
• Relocate the running uninstaller, return meaningful quiet-mode exit codes and retain pending cleanup/recovery data. Add native maintenance paths when WebView2 is absent.
• Fix frontend reentrancy, stale path/disk responses, hidden errors and cancellation. Retain legacy records and refuse known downgrades. Harden CLI/SSH recovery and publish the signed standalone Windows maintenance installer as the updater asset.

Type and Areas

Type: bug fix, regression coverage, release integration.

Areas: installer, desktop platform adapters, CLI/SSH provisioning, update UI and release workflows.

Motivation / Impact

A failed update must not strand mixed application files, erase the only recovery backup or quit the application before a native maintenance worker is ready. Uninstall must preserve user configuration, sessions, workspaces and unrelated files, and must not remove another installation's system integrations.

The native maintenance implementation belongs to Desktop, while the official updater retains its discovery/download/verification responsibilities. Service Docker contexts no longer need an extra vendored updater dependency. The existing SystemAPI test now matches the five-minute maintenance handoff timeout and continues to assert the confirmed version and zero mutation retries.

Verification

Rebased onto upstream 6c00f83e8. The adapter migration patch is unchanged by
that rebase; capability projections were regenerated to retain the new upstream
commands. Frontend, script and contract checks were repeated after the rebase.
The native tests and Windows debug build below were completed immediately before
that final synchronization.

After moving maintenance into Desktop and restoring the official dependency:

• cargo build --locked -p openbitfun-desktop --no-default-features --bin openbitfun-desktop --offline -j 8: Windows desktop debug build passed.
• Desktop library test build with cargo test --locked -p openbitfun-desktop --no-default-features --lib --no-run --offline -j 8: passed.
• Native update_maintenance tests: 8 passed, including real Windows Job lifetime/argument parsing, safe raw/archived installer staging, AppImage validation and retained recovery backups.
• Native api::update_api::tests: 10 passed; remote_workspace_policy: 9 passed. Used a temporary copy of the library test executable with the repository's Windows manifest, as documented in the Desktop guide.
• pnpm --dir src/web-ui exec vitest run src/infrastructure/api/service-api/SystemAPI.test.ts src/infrastructure/update: 150 passed.
• node --test scripts/market/*.test.mjs scripts/updater-maintenance.test.mjs scripts/tauri-release-manifest.test.mjs scripts/desktop-tauri-build.test.mjs: 41 passed. Includes the previously failing Market build-context contract and the production PowerShell supervisor fault-injection fixture.
• Capability registry, core boundaries and repository hygiene passed. Official registry source/checksum and absence of an updater source patch are covered by a cross-platform regression check.

Earlier verification on this repair series also passed installer native/frontend tests, CLI self-update/daemon tests, SSH protocol tests and Bash fixtures under WSL. A strict complete release-fast installer build, all 2,870 payload hashes and isolated read-only native preview were verified before this adapter migration; the complete installer package was not rebuilt for this revision.

Reviewer Notes

AI-assisted change with focused automated regression coverage. Native end-to-end platform coverage remains incomplete:

• Real UAC approval/cancellation, alternate administrator credentials and packaged GUI restart need a clean Windows VM.
• macOS authorization/signing/notarization and Linux package/AppImage replacement need native runs. Windows filesystem tests do not establish those platform behaviors.
• Live SSH/remote workspace, Remote Control, Peer Device Mode and Detached Dispatch were not exercised. Update operations remain controller-local through the operation registry.
• Production signing/publication was not performed.

Recovery inventories/journals are additive. Unknown/corrupt records and failed recovery backups are retained rather than reset. Quiet maintenance distinguishes success (0), failure (1) and committed maintenance with cleanup pending (2).

Checklist

• No secrets, build outputs, temporary prompts or unrelated artifacts are included.
• Verification and native platform limits are recorded above.
• User-facing strings, docs and installer locales are updated where applicable.