fix(desktop): avoid destroyed-window exception on notification shutdown

[luokerenx4]

Problem and resulting behavior

Closing/destroying the owning desktop window after #1676 can show Electron's uncaught TypeError: Object has been destroyed dialog. ActivityController.stop() disposed its queue and immediately rebuilt it, querying owner.isVisible() after destruction. A packaged workspace smoke returned exit 0 despite the visible dialog.

Stop is now terminal and idempotent: dispose without rebuilding, abort pending reads, and ignore further polls. Surface transitions/preferences cannot restart a stopped controller. Native foreground reads and delayed preference publication check owner destruction. Regressions cover real retirement semantics, repeated stop, destroyed window transitions, timer cleanup and late responses; the controller regression reproduces the reported exception against unchanged dev.

Verification

• Scope: shared desktop notification lifecycle; desktop owner suite rather than changed-file import closure, plus desktop typecheck and real Electron/package acceptance.
• pnpm test:owner:desktop: 24 files / 106 tests passed; desktop typecheck passed.
• pnpm electron:tsc; existing companion-preview.js --smoke: passed, including native owner/pet destruction.
• pnpm electron:smoke:workspace --skip-build --keep-package: unsigned macOS arm64 package passed all 12 receipt checks, including shell CLI, managed Pi, scheduled issue and cleanup.
• pnpm electron:smoke:startup --app-path <candidate executable>: no Recent and unavailable Recent passed against the repaired package.
• Manual isolated package: legacy schema-2 local default migrated to schema 3 and launched the intended Research home; close hid the main window, companion double-click restored it, and Cmd+Q completed managed shutdown with exit 0 and no exception dialog.

Broader Sep30/Oct1 acceptance on clean dev 0a10220d: full build, root/UI/desktop/CLI/Guardian/central-spec typechecks, required critical 18/18, Guardian system, Electron PTY and startup passed. Full hermetic suite completed with 7494 pass / 27 fail / 8 skip across 882 files: 21 Supervisor PTY failures are being addressed separately by #1682/#1684; four startup/config assertions inherit real legacy desktop preferences (#1686); two CLI package-channel tests assume executable shell fixtures although Darwin fixtures now contain Mach-O bytes (#1687). These baseline failures are not claimed as accepted. Native demo checks passed but teardown logged a separate IPC EPIPE (#1688).

Boundary touch and remaining evidence

Desktop lifecycle only; no trading, credentials, persisted shape change, release, or signing. Windows/Intel native exit, macOS Dock restore, multi-monitor composition and signed updater installation remain unverified locally. Notification journal mapping and policy behavior are unchanged.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
openalice-demo	Ready	Preview	Oct 1, 2026 2:18am UTC