fix(desktop): boot after ready to break Electron ESM startup deadlock

apps/desktop/e2e/storage-root-conflict.spec.ts

@@ -0,0 +1,90 @@
+import { _electron as electron, expect, test } from '@playwright/test';
+import type { ElectronApplication } from '@playwright/test';
+import { mkdir, mkdtemp, readFile, readdir, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { STORAGE_ROOT_MARKER_FILE, resolveStorageRoot } from '@maka/storage/root-authority';
+import { buildFixtureEnv } from '../../../scripts/fixture-env.mjs';
+import { closeElectronApplication } from '../../../scripts/electron-lifecycle.mjs';
+
+const DESKTOP_ROOT = process.cwd();
+
+/**
+ * Prove the app parked at the modal repair dialog — the only success signal
+ * this test accepts.
+ *
+ * The dialog can only appear after ready: the whole boot module runs inside
+ * the `whenReady` callback, so a modal dialog being up simultaneously proves
+ * (a) ready was reached and (b) the root-identity gate fired and is holding
+ * before any store/db write. On macOS the dialog's modal loop stops answering
+ * CDP evaluation, so an evaluate that never settles within the deadline is the
+ * observable form of "dialog is open". A deadlocked main process (the
+ * regression this test guards) answers every evaluate with `isReady() ===
+ * false` forever, and a future removal of the gate would make evaluate answer
+ * `true` — both must fail, only the parked dialog may pass.
+ */
+async function appParkedAtRepairDialog(app: ElectronApplication): Promise<boolean> {
+ for (let attempt = 0; attempt < 40; attempt += 1) {
+ const outcome = await Promise.race([
+ app
+ .evaluate(({ app: electronApp }) => electronApp.isReady())
+ .then((ready) => (ready ? 'ready' : 'not-ready'))
+ .catch(() => 'evaluate-error'),
+ new Promise<string>((resolve) => setTimeout(() => resolve('modal-dialog'), 1_000)),
+ ]);
+ if (outcome === 'modal-dialog') return true;
+ await new Promise((resolve) => setTimeout(resolve, 250));
+ }
+ return false;
+}
+
+/**
+ * A conflicting storage root must park at the repair dialog — never deadlock
+ * in module evaluation — and must not write any store/db files before the
+ * user answers.
+ *
+ * Regression for the Electron ESM startup deadlock: top-level
+ * `await app.whenReady()` inside the repair-confirm path never resolves
+ * because `ready` only fires after the main module finishes evaluating.
+ */
+test('parks at the storage-root repair dialog and writes nothing before the answer', async () => {
+ const userDataDir = await mkdtemp(join(tmpdir(), 'maka-root-conflict-'));
+ const homeDir = join(userDataDir, 'home');
+ await mkdir(homeDir, { recursive: true });
+ let app;
+ try {
+ // Seed a real interactive marker, then corrupt its device id so startup
+ // must stop at the repair dialog (mirrors the disk-identity drift that
+ // triggers root_identity_collision).
+ const workspaceRoot = join(userDataDir, 'workspaces', 'default');
+ await resolveStorageRoot({ path: workspaceRoot, kind: 'interactive' });
+ const markerPath = join(workspaceRoot, STORAGE_ROOT_MARKER_FILE);
+ const marker = JSON.parse(await readFile(markerPath, 'utf8')) as {
+ rootIdentity: { dev: string };
+ };
+ marker.rootIdentity.dev = (BigInt(marker.rootIdentity.dev) + 1n).toString();
+ const conflictingMarker = `${JSON.stringify(marker)}\n`;
+ await writeFile(markerPath, conflictingMarker);
+
+ // Launch without a fixture so the repair gate is live (fixture mode
+ // seeds its own workspace and bypasses the dialog).
+ app = await electron.launch({
+ args: ['.'],
+ cwd: DESKTOP_ROOT,
+ env: buildFixtureEnv(userDataDir, homeDir, {}),
+ });
+
+ // The app must park at the dialog — before this fix the main process
+ // deadlocked in module evaluation and no dialog ever appeared.
+ expect(await appParkedAtRepairDialog(app)).toBe(true);
+
+ // While the dialog is unanswered, no store/db files may be created in
+ // the workspace: the root-identity gate must precede all storage.
+ const workspaceEntries = await readdir(workspaceRoot);
+ expect(workspaceEntries).toEqual([STORAGE_ROOT_MARKER_FILE]);
+ expect(await readFile(markerPath, 'utf8')).toBe(conflictingMarker);
+ } finally {
+ if (app) await closeElectronApplication(app, 5_000);
+ await rm(userDataDir, { recursive: true, force: true });
+ }
+});

apps/desktop/src/main/app-lifecycle.ts

@@ -45,7 +45,7 @@ import { resumeSafeBoundaryContinuationsOnStartup } from './startup-safe-boundar
 
 type AssembledTools = ReturnType<typeof assembleDesktopTools>;
 export interface AppLifecycleDeps {
- // Whether this run stays out of the developer's way. main.ts owns the
+ // Whether this run stays out of the developer's way. boot.ts owns the
  // condition; the dock icon follows it so window visibility and dock
  // presence can never drift apart. A fixture window someone asked to see
  // (MAKA_E2E_SHOW_WINDOW) opts out of both together: as an accessory app it
@@ -82,14 +82,14 @@ export interface AppLifecycleDeps {
  agentGraphSupervisorWakeCoordinator: AgentGraphSupervisorWakeCoordinator;
  agentGraphControlStore: ReturnType<typeof createAgentGraphControlStore>;
  streamEvents: StreamEvents;
- /** Focus-or-create for the main window; stays in main.ts next to the
+ /** Focus-or-create for the main window; stays in boot.ts next to the
  * controller and is registered here on `second-instance` / `activate`. */
  focusOrCreateMainWindow: (signal: AbortSignal) => void;
  emitConnectionListChanged: () => void;
  emitSessionsChanged: (reason: 'migrated') => void;
  handleExternalSettingsChange: () => Promise<void>;
  /** Accessor for the settings IPC handle, which is assigned inside
- * main.ts's `registerIpc()`; teardown disposes it if present. */
+ * boot.ts's `registerIpc()`; teardown disposes it if present. */
  getSettingsIpc: () => SettingsIpcHandle | undefined;
 }
 
@@ -101,9 +101,10 @@ export interface AppLifecycleDeps {
  * `recoverInterruptedSessionsOnStartup`, the `window-all-closed` and `before-quit`
  * handlers, and `runBeforeQuitCleanup`. Startup ORDER is the product, so the
  * bodies stay behaviorally identical to their in-main.ts originals; every
- * process-scoped collaborator is injected. The single-instance lock and
- * `registerIpc()` anchor stay in main.ts. Call this once, at the same point the
- * inline `app.whenReady()` used to sit (immediately after `registerIpc()`).
+ * process-scoped collaborator is injected. The single-instance lock stays in
+ * main.ts; the `registerIpc()` anchor stays in boot.ts. Call this once, at
+ * the same point the inline `app.whenReady()` used to sit (immediately after
+ * `registerIpc()`).
  */
 export function wireAppLifecycle(deps: AppLifecycleDeps): void {
  const {
@@ -239,7 +240,7 @@ export function wireAppLifecycle(deps: AppLifecycleDeps): void {
  // renderer via the existing `sessions:changed` / `connections:event`
  // / `settings:bots:statusChanged` channels, so the UI converges lazily.
  // E2E fixture workspaces are wiped and seeded before stores open in
- // main.ts. SQLite keeps live file handles, so resetting the workspace
+ // boot.ts. SQLite keeps live file handles, so resetting the workspace
  // here after store construction would detach the canonical database.
  await runCredentialStartup();
  const initialWindowSignal = quitCoordinator.getWindowCreationSignal();

apps/desktop/e2e/storage-root-conflict.spec.ts

@@ -0,0 +1,90 @@
+import { _electron as electron, expect, test } from '@playwright/test';
+import type { ElectronApplication } from '@playwright/test';
+import { mkdir, mkdtemp, readFile, readdir, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { STORAGE_ROOT_MARKER_FILE, resolveStorageRoot } from '@maka/storage/root-authority';
+import { buildFixtureEnv } from '../../../scripts/fixture-env.mjs';
+import { closeElectronApplication } from '../../../scripts/electron-lifecycle.mjs';
+
+const DESKTOP_ROOT = process.cwd();
+
+/**
+ * Prove the app parked at the modal repair dialog — the only success signal
+ * this test accepts.
+ *
+ * The dialog can only appear after ready: the whole boot module runs inside
+ * the `whenReady` callback, so a modal dialog being up simultaneously proves
+ * (a) ready was reached and (b) the root-identity gate fired and is holding
+ * before any store/db write. On macOS the dialog's modal loop stops answering
+ * CDP evaluation, so an evaluate that never settles within the deadline is the
+ * observable form of "dialog is open". A deadlocked main process (the
+ * regression this test guards) answers every evaluate with `isReady() ===
+ * false` forever, and a future removal of the gate would make evaluate answer
+ * `true` — both must fail, only the parked dialog may pass.
+ */
+async function appParkedAtRepairDialog(app: ElectronApplication): Promise<boolean> {
+ for (let attempt = 0; attempt < 40; attempt += 1) {
+ const outcome = await Promise.race([
+ app
+ .evaluate(({ app: electronApp }) => electronApp.isReady())
+ .then((ready) => (ready ? 'ready' : 'not-ready'))
+ .catch(() => 'evaluate-error'),
+ new Promise<string>((resolve) => setTimeout(() => resolve('modal-dialog'), 1_000)),
+ ]);
+ if (outcome === 'modal-dialog') return true;
+ await new Promise((resolve) => setTimeout(resolve, 250));
+ }
+ return false;
+}
+
+/**
+ * A conflicting storage root must park at the repair dialog — never deadlock
+ * in module evaluation — and must not write any store/db files before the
+ * user answers.
+ *
+ * Regression for the Electron ESM startup deadlock: top-level
+ * `await app.whenReady()` inside the repair-confirm path never resolves
+ * because `ready` only fires after the main module finishes evaluating.
+ */
+test('parks at the storage-root repair dialog and writes nothing before the answer', async () => {
+ const userDataDir = await mkdtemp(join(tmpdir(), 'maka-root-conflict-'));
+ const homeDir = join(userDataDir, 'home');
+ await mkdir(homeDir, { recursive: true });
+ let app;
+ try {
+ // Seed a real interactive marker, then corrupt its device id so startup
+ // must stop at the repair dialog (mirrors the disk-identity drift that
+ // triggers root_identity_collision).
+ const workspaceRoot = join(userDataDir, 'workspaces', 'default');
+ await resolveStorageRoot({ path: workspaceRoot, kind: 'interactive' });
+ const markerPath = join(workspaceRoot, STORAGE_ROOT_MARKER_FILE);
+ const marker = JSON.parse(await readFile(markerPath, 'utf8')) as {
+ rootIdentity: { dev: string };
+ };
+ marker.rootIdentity.dev = (BigInt(marker.rootIdentity.dev) + 1n).toString();
+ const conflictingMarker = `${JSON.stringify(marker)}\n`;
+ await writeFile(markerPath, conflictingMarker);
+
+ // Launch without a fixture so the repair gate is live (fixture mode
+ // seeds its own workspace and bypasses the dialog).
+ app = await electron.launch({
+ args: ['.'],
+ cwd: DESKTOP_ROOT,
+ env: buildFixtureEnv(userDataDir, homeDir, {}),
+ });
+
+ // The app must park at the dialog — before this fix the main process
+ // deadlocked in module evaluation and no dialog ever appeared.
+ expect(await appParkedAtRepairDialog(app)).toBe(true);
+
+ // While the dialog is unanswered, no store/db files may be created in
+ // the workspace: the root-identity gate must precede all storage.
+ const workspaceEntries = await readdir(workspaceRoot);
+ expect(workspaceEntries).toEqual([STORAGE_ROOT_MARKER_FILE]);
+ expect(await readFile(markerPath, 'utf8')).toBe(conflictingMarker);
+ } finally {
+ if (app) await closeElectronApplication(app, 5_000);
+ await rm(userDataDir, { recursive: true, force: true });
+ }
+});

apps/desktop/src/main/app-lifecycle.ts

@@ -45,7 +45,7 @@ import { resumeSafeBoundaryContinuationsOnStartup } from './startup-safe-boundar
 
 type AssembledTools = ReturnType<typeof assembleDesktopTools>;
 export interface AppLifecycleDeps {
- // Whether this run stays out of the developer's way. main.ts owns the
+ // Whether this run stays out of the developer's way. boot.ts owns the
  // condition; the dock icon follows it so window visibility and dock
  // presence can never drift apart. A fixture window someone asked to see
  // (MAKA_E2E_SHOW_WINDOW) opts out of both together: as an accessory app it
@@ -82,14 +82,14 @@ export interface AppLifecycleDeps {
  agentGraphSupervisorWakeCoordinator: AgentGraphSupervisorWakeCoordinator;
  agentGraphControlStore: ReturnType<typeof createAgentGraphControlStore>;
  streamEvents: StreamEvents;
- /** Focus-or-create for the main window; stays in main.ts next to the
+ /** Focus-or-create for the main window; stays in boot.ts next to the
  * controller and is registered here on `second-instance` / `activate`. */
  focusOrCreateMainWindow: (signal: AbortSignal) => void;
  emitConnectionListChanged: () => void;
  emitSessionsChanged: (reason: 'migrated') => void;
  handleExternalSettingsChange: () => Promise<void>;
  /** Accessor for the settings IPC handle, which is assigned inside
- * main.ts's `registerIpc()`; teardown disposes it if present. */
+ * boot.ts's `registerIpc()`; teardown disposes it if present. */
  getSettingsIpc: () => SettingsIpcHandle | undefined;
 }
 
@@ -101,9 +101,10 @@ export interface AppLifecycleDeps {
  * `recoverInterruptedSessionsOnStartup`, the `window-all-closed` and `before-quit`
  * handlers, and `runBeforeQuitCleanup`. Startup ORDER is the product, so the
  * bodies stay behaviorally identical to their in-main.ts originals; every
- * process-scoped collaborator is injected. The single-instance lock and
- * `registerIpc()` anchor stay in main.ts. Call this once, at the same point the
- * inline `app.whenReady()` used to sit (immediately after `registerIpc()`).
+ * process-scoped collaborator is injected. The single-instance lock stays in
+ * main.ts; the `registerIpc()` anchor stays in boot.ts. Call this once, at
+ * the same point the inline `app.whenReady()` used to sit (immediately after
+ * `registerIpc()`).
  */
 export function wireAppLifecycle(deps: AppLifecycleDeps): void {
  const {
@@ -239,7 +240,7 @@ export function wireAppLifecycle(deps: AppLifecycleDeps): void {
  // renderer via the existing `sessions:changed` / `connections:event`
  // / `settings:bots:statusChanged` channels, so the UI converges lazily.
  // E2E fixture workspaces are wiped and seeded before stores open in
- // main.ts. SQLite keeps live file handles, so resetting the workspace
+ // boot.ts. SQLite keeps live file handles, so resetting the workspace
  // here after store construction would detach the canonical database.
  await runCredentialStartup();
  const initialWindowSignal = quitCoordinator.getWindowCreationSignal();

apps/desktop/e2e/storage-root-conflict.spec.ts

@@ -0,0 +1,90 @@
+import { _electron as electron, expect, test } from '@playwright/test';
+import type { ElectronApplication } from '@playwright/test';
+import { mkdir, mkdtemp, readFile, readdir, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { STORAGE_ROOT_MARKER_FILE, resolveStorageRoot } from '@maka/storage/root-authority';
+import { buildFixtureEnv } from '../../../scripts/fixture-env.mjs';
+import { closeElectronApplication } from '../../../scripts/electron-lifecycle.mjs';
+
+const DESKTOP_ROOT = process.cwd();
+
+/**
+ * Prove the app parked at the modal repair dialog — the only success signal
+ * this test accepts.
+ *
+ * The dialog can only appear after ready: the whole boot module runs inside
+ * the `whenReady` callback, so a modal dialog being up simultaneously proves
+ * (a) ready was reached and (b) the root-identity gate fired and is holding
+ * before any store/db write. On macOS the dialog's modal loop stops answering
+ * CDP evaluation, so an evaluate that never settles within the deadline is the
+ * observable form of "dialog is open". A deadlocked main process (the
+ * regression this test guards) answers every evaluate with `isReady() ===
+ * false` forever, and a future removal of the gate would make evaluate answer
+ * `true` — both must fail, only the parked dialog may pass.
+ */
+async function appParkedAtRepairDialog(app: ElectronApplication): Promise<boolean> {
+ for (let attempt = 0; attempt < 40; attempt += 1) {
+ const outcome = await Promise.race([
+ app
+ .evaluate(({ app: electronApp }) => electronApp.isReady())
+ .then((ready) => (ready ? 'ready' : 'not-ready'))
+ .catch(() => 'evaluate-error'),
+ new Promise<string>((resolve) => setTimeout(() => resolve('modal-dialog'), 1_000)),
+ ]);
+ if (outcome === 'modal-dialog') return true;
+ await new Promise((resolve) => setTimeout(resolve, 250));
+ }
+ return false;
+}
+
+/**
+ * A conflicting storage root must park at the repair dialog — never deadlock
+ * in module evaluation — and must not write any store/db files before the
+ * user answers.
+ *
+ * Regression for the Electron ESM startup deadlock: top-level
+ * `await app.whenReady()` inside the repair-confirm path never resolves
+ * because `ready` only fires after the main module finishes evaluating.
+ */
+test('parks at the storage-root repair dialog and writes nothing before the answer', async () => {
+ const userDataDir = await mkdtemp(join(tmpdir(), 'maka-root-conflict-'));
+ const homeDir = join(userDataDir, 'home');
+ await mkdir(homeDir, { recursive: true });
+ let app;
+ try {
+ // Seed a real interactive marker, then corrupt its device id so startup
+ // must stop at the repair dialog (mirrors the disk-identity drift that
+ // triggers root_identity_collision).
+ const workspaceRoot = join(userDataDir, 'workspaces', 'default');
+ await resolveStorageRoot({ path: workspaceRoot, kind: 'interactive' });
+ const markerPath = join(workspaceRoot, STORAGE_ROOT_MARKER_FILE);
+ const marker = JSON.parse(await readFile(markerPath, 'utf8')) as {
+ rootIdentity: { dev: string };
+ };
+ marker.rootIdentity.dev = (BigInt(marker.rootIdentity.dev) + 1n).toString();
+ const conflictingMarker = `${JSON.stringify(marker)}\n`;
+ await writeFile(markerPath, conflictingMarker);
+
+ // Launch without a fixture so the repair gate is live (fixture mode
+ // seeds its own workspace and bypasses the dialog).
+ app = await electron.launch({
+ args: ['.'],
+ cwd: DESKTOP_ROOT,
+ env: buildFixtureEnv(userDataDir, homeDir, {}),
+ });
+
+ // The app must park at the dialog — before this fix the main process
+ // deadlocked in module evaluation and no dialog ever appeared.
+ expect(await appParkedAtRepairDialog(app)).toBe(true);
+
+ // While the dialog is unanswered, no store/db files may be created in
+ // the workspace: the root-identity gate must precede all storage.
+ const workspaceEntries = await readdir(workspaceRoot);
+ expect(workspaceEntries).toEqual([STORAGE_ROOT_MARKER_FILE]);
+ expect(await readFile(markerPath, 'utf8')).toBe(conflictingMarker);
+ } finally {
+ if (app) await closeElectronApplication(app, 5_000);
+ await rm(userDataDir, { recursive: true, force: true });
+ }
+});

apps/desktop/src/main/app-lifecycle.ts

@@ -45,7 +45,7 @@ import { resumeSafeBoundaryContinuationsOnStartup } from './startup-safe-boundar
 
 type AssembledTools = ReturnType<typeof assembleDesktopTools>;
 export interface AppLifecycleDeps {
- // Whether this run stays out of the developer's way. main.ts owns the
+ // Whether this run stays out of the developer's way. boot.ts owns the
  // condition; the dock icon follows it so window visibility and dock
  // presence can never drift apart. A fixture window someone asked to see
  // (MAKA_E2E_SHOW_WINDOW) opts out of both together: as an accessory app it
@@ -82,14 +82,14 @@ export interface AppLifecycleDeps {
  agentGraphSupervisorWakeCoordinator: AgentGraphSupervisorWakeCoordinator;
  agentGraphControlStore: ReturnType<typeof createAgentGraphControlStore>;
  streamEvents: StreamEvents;
- /** Focus-or-create for the main window; stays in main.ts next to the
+ /** Focus-or-create for the main window; stays in boot.ts next to the
  * controller and is registered here on `second-instance` / `activate`. */
  focusOrCreateMainWindow: (signal: AbortSignal) => void;
  emitConnectionListChanged: () => void;
  emitSessionsChanged: (reason: 'migrated') => void;
  handleExternalSettingsChange: () => Promise<void>;
  /** Accessor for the settings IPC handle, which is assigned inside
- * main.ts's `registerIpc()`; teardown disposes it if present. */
+ * boot.ts's `registerIpc()`; teardown disposes it if present. */
  getSettingsIpc: () => SettingsIpcHandle | undefined;
 }
 
@@ -101,9 +101,10 @@ export interface AppLifecycleDeps {
  * `recoverInterruptedSessionsOnStartup`, the `window-all-closed` and `before-quit`
  * handlers, and `runBeforeQuitCleanup`. Startup ORDER is the product, so the
  * bodies stay behaviorally identical to their in-main.ts originals; every
- * process-scoped collaborator is injected. The single-instance lock and
- * `registerIpc()` anchor stay in main.ts. Call this once, at the same point the
- * inline `app.whenReady()` used to sit (immediately after `registerIpc()`).
+ * process-scoped collaborator is injected. The single-instance lock stays in
+ * main.ts; the `registerIpc()` anchor stays in boot.ts. Call this once, at
+ * the same point the inline `app.whenReady()` used to sit (immediately after
+ * `registerIpc()`).
  */
 export function wireAppLifecycle(deps: AppLifecycleDeps): void {
  const {
@@ -239,7 +240,7 @@ export function wireAppLifecycle(deps: AppLifecycleDeps): void {
  // renderer via the existing `sessions:changed` / `connections:event`
  // / `settings:bots:statusChanged` channels, so the UI converges lazily.
  // E2E fixture workspaces are wiped and seeded before stores open in
- // main.ts. SQLite keeps live file handles, so resetting the workspace
+ // boot.ts. SQLite keeps live file handles, so resetting the workspace
  // here after store construction would detach the canonical database.
  await runCredentialStartup();
  const initialWindowSignal = quitCoordinator.getWindowCreationSignal();

apps/desktop/e2e/storage-root-conflict.spec.ts

@@ -0,0 +1,90 @@
+import { _electron as electron, expect, test } from '@playwright/test';
+import type { ElectronApplication } from '@playwright/test';
+import { mkdir, mkdtemp, readFile, readdir, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { STORAGE_ROOT_MARKER_FILE, resolveStorageRoot } from '@maka/storage/root-authority';
+import { buildFixtureEnv } from '../../../scripts/fixture-env.mjs';
+import { closeElectronApplication } from '../../../scripts/electron-lifecycle.mjs';
+
+const DESKTOP_ROOT = process.cwd();
+
+/**
+ * Prove the app parked at the modal repair dialog — the only success signal
+ * this test accepts.
+ *
+ * The dialog can only appear after ready: the whole boot module runs inside
+ * the `whenReady` callback, so a modal dialog being up simultaneously proves
+ * (a) ready was reached and (b) the root-identity gate fired and is holding
+ * before any store/db write. On macOS the dialog's modal loop stops answering
+ * CDP evaluation, so an evaluate that never settles within the deadline is the
+ * observable form of "dialog is open". A deadlocked main process (the
+ * regression this test guards) answers every evaluate with `isReady() ===
+ * false` forever, and a future removal of the gate would make evaluate answer
+ * `true` — both must fail, only the parked dialog may pass.
+ */
+async function appParkedAtRepairDialog(app: ElectronApplication): Promise<boolean> {
+ for (let attempt = 0; attempt < 40; attempt += 1) {
+ const outcome = await Promise.race([
+ app
+ .evaluate(({ app: electronApp }) => electronApp.isReady())
+ .then((ready) => (ready ? 'ready' : 'not-ready'))
+ .catch(() => 'evaluate-error'),
+ new Promise<string>((resolve) => setTimeout(() => resolve('modal-dialog'), 1_000)),
+ ]);
+ if (outcome === 'modal-dialog') return true;
+ await new Promise((resolve) => setTimeout(resolve, 250));
+ }
+ return false;
+}
+
+/**
+ * A conflicting storage root must park at the repair dialog — never deadlock
+ * in module evaluation — and must not write any store/db files before the
+ * user answers.
+ *
+ * Regression for the Electron ESM startup deadlock: top-level
+ * `await app.whenReady()` inside the repair-confirm path never resolves
+ * because `ready` only fires after the main module finishes evaluating.
+ */
+test('parks at the storage-root repair dialog and writes nothing before the answer', async () => {
+ const userDataDir = await mkdtemp(join(tmpdir(), 'maka-root-conflict-'));
+ const homeDir = join(userDataDir, 'home');
+ await mkdir(homeDir, { recursive: true });
+ let app;
+ try {
+ // Seed a real interactive marker, then corrupt its device id so startup
+ // must stop at the repair dialog (mirrors the disk-identity drift that
+ // triggers root_identity_collision).
+ const workspaceRoot = join(userDataDir, 'workspaces', 'default');
+ await resolveStorageRoot({ path: workspaceRoot, kind: 'interactive' });
+ const markerPath = join(workspaceRoot, STORAGE_ROOT_MARKER_FILE);
+ const marker = JSON.parse(await readFile(markerPath, 'utf8')) as {
+ rootIdentity: { dev: string };
+ };
+ marker.rootIdentity.dev = (BigInt(marker.rootIdentity.dev) + 1n).toString();
+ const conflictingMarker = `${JSON.stringify(marker)}\n`;
+ await writeFile(markerPath, conflictingMarker);
+
+ // Launch without a fixture so the repair gate is live (fixture mode
+ // seeds its own workspace and bypasses the dialog).
+ app = await electron.launch({
+ args: ['.'],
+ cwd: DESKTOP_ROOT,
+ env: buildFixtureEnv(userDataDir, homeDir, {}),
+ });
+
+ // The app must park at the dialog — before this fix the main process
+ // deadlocked in module evaluation and no dialog ever appeared.
+ expect(await appParkedAtRepairDialog(app)).toBe(true);
+
+ // While the dialog is unanswered, no store/db files may be created in
+ // the workspace: the root-identity gate must precede all storage.
+ const workspaceEntries = await readdir(workspaceRoot);
+ expect(workspaceEntries).toEqual([STORAGE_ROOT_MARKER_FILE]);
+ expect(await readFile(markerPath, 'utf8')).toBe(conflictingMarker);
+ } finally {
+ if (app) await closeElectronApplication(app, 5_000);
+ await rm(userDataDir, { recursive: true, force: true });
+ }
+});

apps/desktop/src/main/app-lifecycle.ts

@@ -45,7 +45,7 @@ import { resumeSafeBoundaryContinuationsOnStartup } from './startup-safe-boundar
 
 type AssembledTools = ReturnType<typeof assembleDesktopTools>;
 export interface AppLifecycleDeps {
- // Whether this run stays out of the developer's way. main.ts owns the
+ // Whether this run stays out of the developer's way. boot.ts owns the
  // condition; the dock icon follows it so window visibility and dock
  // presence can never drift apart. A fixture window someone asked to see
  // (MAKA_E2E_SHOW_WINDOW) opts out of both together: as an accessory app it
@@ -82,14 +82,14 @@ export interface AppLifecycleDeps {
  agentGraphSupervisorWakeCoordinator: AgentGraphSupervisorWakeCoordinator;
  agentGraphControlStore: ReturnType<typeof createAgentGraphControlStore>;
  streamEvents: StreamEvents;
- /** Focus-or-create for the main window; stays in main.ts next to the
+ /** Focus-or-create for the main window; stays in boot.ts next to the
  * controller and is registered here on `second-instance` / `activate`. */
  focusOrCreateMainWindow: (signal: AbortSignal) => void;
  emitConnectionListChanged: () => void;
  emitSessionsChanged: (reason: 'migrated') => void;
  handleExternalSettingsChange: () => Promise<void>;
  /** Accessor for the settings IPC handle, which is assigned inside
- * main.ts's `registerIpc()`; teardown disposes it if present. */
+ * boot.ts's `registerIpc()`; teardown disposes it if present. */
  getSettingsIpc: () => SettingsIpcHandle | undefined;
 }
 
@@ -101,9 +101,10 @@ export interface AppLifecycleDeps {
  * `recoverInterruptedSessionsOnStartup`, the `window-all-closed` and `before-quit`
  * handlers, and `runBeforeQuitCleanup`. Startup ORDER is the product, so the
  * bodies stay behaviorally identical to their in-main.ts originals; every
- * process-scoped collaborator is injected. The single-instance lock and
- * `registerIpc()` anchor stay in main.ts. Call this once, at the same point the
- * inline `app.whenReady()` used to sit (immediately after `registerIpc()`).
+ * process-scoped collaborator is injected. The single-instance lock stays in
+ * main.ts; the `registerIpc()` anchor stays in boot.ts. Call this once, at
+ * the same point the inline `app.whenReady()` used to sit (immediately after
+ * `registerIpc()`).
  */
 export function wireAppLifecycle(deps: AppLifecycleDeps): void {
  const {
@@ -239,7 +240,7 @@ export function wireAppLifecycle(deps: AppLifecycleDeps): void {
  // renderer via the existing `sessions:changed` / `connections:event`
  // / `settings:bots:statusChanged` channels, so the UI converges lazily.
  // E2E fixture workspaces are wiped and seeded before stores open in
- // main.ts. SQLite keeps live file handles, so resetting the workspace
+ // boot.ts. SQLite keeps live file handles, so resetting the workspace
  // here after store construction would detach the canonical database.
  await runCredentialStartup();
  const initialWindowSignal = quitCoordinator.getWindowCreationSignal();

apps/desktop/e2e/storage-root-conflict.spec.ts

@@ -0,0 +1,90 @@
+import { _electron as electron, expect, test } from '@playwright/test';
+import type { ElectronApplication } from '@playwright/test';
+import { mkdir, mkdtemp, readFile, readdir, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { STORAGE_ROOT_MARKER_FILE, resolveStorageRoot } from '@maka/storage/root-authority';
+import { buildFixtureEnv } from '../../../scripts/fixture-env.mjs';
+import { closeElectronApplication } from '../../../scripts/electron-lifecycle.mjs';
+
+const DESKTOP_ROOT = process.cwd();
+
+/**
+ * Prove the app parked at the modal repair dialog — the only success signal
+ * this test accepts.
+ *
+ * The dialog can only appear after ready: the whole boot module runs inside
+ * the `whenReady` callback, so a modal dialog being up simultaneously proves
+ * (a) ready was reached and (b) the root-identity gate fired and is holding
+ * before any store/db write. On macOS the dialog's modal loop stops answering
+ * CDP evaluation, so an evaluate that never settles within the deadline is the
+ * observable form of "dialog is open". A deadlocked main process (the
+ * regression this test guards) answers every evaluate with `isReady() ===
+ * false` forever, and a future removal of the gate would make evaluate answer
+ * `true` — both must fail, only the parked dialog may pass.
+ */
+async function appParkedAtRepairDialog(app: ElectronApplication): Promise<boolean> {
+ for (let attempt = 0; attempt < 40; attempt += 1) {
+ const outcome = await Promise.race([
+ app
+ .evaluate(({ app: electronApp }) => electronApp.isReady())
+ .then((ready) => (ready ? 'ready' : 'not-ready'))
+ .catch(() => 'evaluate-error'),
+ new Promise<string>((resolve) => setTimeout(() => resolve('modal-dialog'), 1_000)),
+ ]);
+ if (outcome === 'modal-dialog') return true;
+ await new Promise((resolve) => setTimeout(resolve, 250));
+ }
+ return false;
+}
+
+/**
+ * A conflicting storage root must park at the repair dialog — never deadlock
+ * in module evaluation — and must not write any store/db files before the
+ * user answers.
+ *
+ * Regression for the Electron ESM startup deadlock: top-level
+ * `await app.whenReady()` inside the repair-confirm path never resolves
+ * because `ready` only fires after the main module finishes evaluating.
+ */
+test('parks at the storage-root repair dialog and writes nothing before the answer', async () => {
+ const userDataDir = await mkdtemp(join(tmpdir(), 'maka-root-conflict-'));
+ const homeDir = join(userDataDir, 'home');
+ await mkdir(homeDir, { recursive: true });
+ let app;
+ try {
+ // Seed a real interactive marker, then corrupt its device id so startup
+ // must stop at the repair dialog (mirrors the disk-identity drift that
+ // triggers root_identity_collision).
+ const workspaceRoot = join(userDataDir, 'workspaces', 'default');
+ await resolveStorageRoot({ path: workspaceRoot, kind: 'interactive' });
+ const markerPath = join(workspaceRoot, STORAGE_ROOT_MARKER_FILE);
+ const marker = JSON.parse(await readFile(markerPath, 'utf8')) as {
+ rootIdentity: { dev: string };
+ };
+ marker.rootIdentity.dev = (BigInt(marker.rootIdentity.dev) + 1n).toString();
+ const conflictingMarker = `${JSON.stringify(marker)}\n`;
+ await writeFile(markerPath, conflictingMarker);
+
+ // Launch without a fixture so the repair gate is live (fixture mode
+ // seeds its own workspace and bypasses the dialog).
+ app = await electron.launch({
+ args: ['.'],
+ cwd: DESKTOP_ROOT,
+ env: buildFixtureEnv(userDataDir, homeDir, {}),
+ });
+
+ // The app must park at the dialog — before this fix the main process
+ // deadlocked in module evaluation and no dialog ever appeared.
+ expect(await appParkedAtRepairDialog(app)).toBe(true);
+
+ // While the dialog is unanswered, no store/db files may be created in
+ // the workspace: the root-identity gate must precede all storage.
+ const workspaceEntries = await readdir(workspaceRoot);
+ expect(workspaceEntries).toEqual([STORAGE_ROOT_MARKER_FILE]);
+ expect(await readFile(markerPath, 'utf8')).toBe(conflictingMarker);
+ } finally {
+ if (app) await closeElectronApplication(app, 5_000);
+ await rm(userDataDir, { recursive: true, force: true });
+ }
+});

apps/desktop/src/main/app-lifecycle.ts

@@ -45,7 +45,7 @@ import { resumeSafeBoundaryContinuationsOnStartup } from './startup-safe-boundar
 
 type AssembledTools = ReturnType<typeof assembleDesktopTools>;
 export interface AppLifecycleDeps {
- // Whether this run stays out of the developer's way. main.ts owns the
+ // Whether this run stays out of the developer's way. boot.ts owns the
  // condition; the dock icon follows it so window visibility and dock
  // presence can never drift apart. A fixture window someone asked to see
  // (MAKA_E2E_SHOW_WINDOW) opts out of both together: as an accessory app it
@@ -82,14 +82,14 @@ export interface AppLifecycleDeps {
  agentGraphSupervisorWakeCoordinator: AgentGraphSupervisorWakeCoordinator;
  agentGraphControlStore: ReturnType<typeof createAgentGraphControlStore>;
  streamEvents: StreamEvents;
- /** Focus-or-create for the main window; stays in main.ts next to the
+ /** Focus-or-create for the main window; stays in boot.ts next to the
  * controller and is registered here on `second-instance` / `activate`. */
  focusOrCreateMainWindow: (signal: AbortSignal) => void;
  emitConnectionListChanged: () => void;
  emitSessionsChanged: (reason: 'migrated') => void;
  handleExternalSettingsChange: () => Promise<void>;
  /** Accessor for the settings IPC handle, which is assigned inside
- * main.ts's `registerIpc()`; teardown disposes it if present. */
+ * boot.ts's `registerIpc()`; teardown disposes it if present. */
  getSettingsIpc: () => SettingsIpcHandle | undefined;
 }
 
@@ -101,9 +101,10 @@ export interface AppLifecycleDeps {
  * `recoverInterruptedSessionsOnStartup`, the `window-all-closed` and `before-quit`
  * handlers, and `runBeforeQuitCleanup`. Startup ORDER is the product, so the
  * bodies stay behaviorally identical to their in-main.ts originals; every
- * process-scoped collaborator is injected. The single-instance lock and
- * `registerIpc()` anchor stay in main.ts. Call this once, at the same point the
- * inline `app.whenReady()` used to sit (immediately after `registerIpc()`).
+ * process-scoped collaborator is injected. The single-instance lock stays in
+ * main.ts; the `registerIpc()` anchor stays in boot.ts. Call this once, at
+ * the same point the inline `app.whenReady()` used to sit (immediately after
+ * `registerIpc()`).
  */
 export function wireAppLifecycle(deps: AppLifecycleDeps): void {
  const {
@@ -239,7 +240,7 @@ export function wireAppLifecycle(deps: AppLifecycleDeps): void {
  // renderer via the existing `sessions:changed` / `connections:event`
  // / `settings:bots:statusChanged` channels, so the UI converges lazily.
  // E2E fixture workspaces are wiped and seeded before stores open in
- // main.ts. SQLite keeps live file handles, so resetting the workspace
+ // boot.ts. SQLite keeps live file handles, so resetting the workspace
  // here after store construction would detach the canonical database.
  await runCredentialStartup();
  const initialWindowSignal = quitCoordinator.getWindowCreationSignal();

apps/desktop/e2e/storage-root-conflict.spec.ts

@@ -0,0 +1,90 @@
+import { _electron as electron, expect, test } from '@playwright/test';
+import type { ElectronApplication } from '@playwright/test';
+import { mkdir, mkdtemp, readFile, readdir, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { STORAGE_ROOT_MARKER_FILE, resolveStorageRoot } from '@maka/storage/root-authority';
+import { buildFixtureEnv } from '../../../scripts/fixture-env.mjs';
+import { closeElectronApplication } from '../../../scripts/electron-lifecycle.mjs';
+
+const DESKTOP_ROOT = process.cwd();
+
+/**
+ * Prove the app parked at the modal repair dialog — the only success signal
+ * this test accepts.
+ *
+ * The dialog can only appear after ready: the whole boot module runs inside
+ * the `whenReady` callback, so a modal dialog being up simultaneously proves
+ * (a) ready was reached and (b) the root-identity gate fired and is holding
+ * before any store/db write. On macOS the dialog's modal loop stops answering
+ * CDP evaluation, so an evaluate that never settles within the deadline is the
+ * observable form of "dialog is open". A deadlocked main process (the
+ * regression this test guards) answers every evaluate with `isReady() ===
+ * false` forever, and a future removal of the gate would make evaluate answer
+ * `true` — both must fail, only the parked dialog may pass.
+ */
+async function appParkedAtRepairDialog(app: ElectronApplication): Promise<boolean> {
+ for (let attempt = 0; attempt < 40; attempt += 1) {
+ const outcome = await Promise.race([
+ app
+ .evaluate(({ app: electronApp }) => electronApp.isReady())
+ .then((ready) => (ready ? 'ready' : 'not-ready'))
+ .catch(() => 'evaluate-error'),
+ new Promise<string>((resolve) => setTimeout(() => resolve('modal-dialog'), 1_000)),
+ ]);
+ if (outcome === 'modal-dialog') return true;
+ await new Promise((resolve) => setTimeout(resolve, 250));
+ }
+ return false;
+}
+
+/**
+ * A conflicting storage root must park at the repair dialog — never deadlock
+ * in module evaluation — and must not write any store/db files before the
+ * user answers.
+ *
+ * Regression for the Electron ESM startup deadlock: top-level
+ * `await app.whenReady()` inside the repair-confirm path never resolves
+ * because `ready` only fires after the main module finishes evaluating.
+ */
+test('parks at the storage-root repair dialog and writes nothing before the answer', async () => {
+ const userDataDir = await mkdtemp(join(tmpdir(), 'maka-root-conflict-'));
+ const homeDir = join(userDataDir, 'home');
+ await mkdir(homeDir, { recursive: true });
+ let app;
+ try {
+ // Seed a real interactive marker, then corrupt its device id so startup
+ // must stop at the repair dialog (mirrors the disk-identity drift that
+ // triggers root_identity_collision).
+ const workspaceRoot = join(userDataDir, 'workspaces', 'default');
+ await resolveStorageRoot({ path: workspaceRoot, kind: 'interactive' });
+ const markerPath = join(workspaceRoot, STORAGE_ROOT_MARKER_FILE);
+ const marker = JSON.parse(await readFile(markerPath, 'utf8')) as {
+ rootIdentity: { dev: string };
+ };
+ marker.rootIdentity.dev = (BigInt(marker.rootIdentity.dev) + 1n).toString();
+ const conflictingMarker = `${JSON.stringify(marker)}\n`;
+ await writeFile(markerPath, conflictingMarker);
+
+ // Launch without a fixture so the repair gate is live (fixture mode
+ // seeds its own workspace and bypasses the dialog).
+ app = await electron.launch({
+ args: ['.'],
+ cwd: DESKTOP_ROOT,
+ env: buildFixtureEnv(userDataDir, homeDir, {}),
+ });
+
+ // The app must park at the dialog — before this fix the main process
+ // deadlocked in module evaluation and no dialog ever appeared.
+ expect(await appParkedAtRepairDialog(app)).toBe(true);
+
+ // While the dialog is unanswered, no store/db files may be created in
+ // the workspace: the root-identity gate must precede all storage.
+ const workspaceEntries = await readdir(workspaceRoot);
+ expect(workspaceEntries).toEqual([STORAGE_ROOT_MARKER_FILE]);
+ expect(await readFile(markerPath, 'utf8')).toBe(conflictingMarker);
+ } finally {
+ if (app) await closeElectronApplication(app, 5_000);
+ await rm(userDataDir, { recursive: true, force: true });
+ }
+});

apps/desktop/src/main/app-lifecycle.ts

@@ -45,7 +45,7 @@ import { resumeSafeBoundaryContinuationsOnStartup } from './startup-safe-boundar
 
 type AssembledTools = ReturnType<typeof assembleDesktopTools>;
 export interface AppLifecycleDeps {
- // Whether this run stays out of the developer's way. main.ts owns the
+ // Whether this run stays out of the developer's way. boot.ts owns the
  // condition; the dock icon follows it so window visibility and dock
  // presence can never drift apart. A fixture window someone asked to see
  // (MAKA_E2E_SHOW_WINDOW) opts out of both together: as an accessory app it
@@ -82,14 +82,14 @@ export interface AppLifecycleDeps {
  agentGraphSupervisorWakeCoordinator: AgentGraphSupervisorWakeCoordinator;
  agentGraphControlStore: ReturnType<typeof createAgentGraphControlStore>;
  streamEvents: StreamEvents;
- /** Focus-or-create for the main window; stays in main.ts next to the
+ /** Focus-or-create for the main window; stays in boot.ts next to the
  * controller and is registered here on `second-instance` / `activate`. */
  focusOrCreateMainWindow: (signal: AbortSignal) => void;
  emitConnectionListChanged: () => void;
  emitSessionsChanged: (reason: 'migrated') => void;
  handleExternalSettingsChange: () => Promise<void>;
  /** Accessor for the settings IPC handle, which is assigned inside
- * main.ts's `registerIpc()`; teardown disposes it if present. */
+ * boot.ts's `registerIpc()`; teardown disposes it if present. */
  getSettingsIpc: () => SettingsIpcHandle | undefined;
 }
 
@@ -101,9 +101,10 @@ export interface AppLifecycleDeps {
  * `recoverInterruptedSessionsOnStartup`, the `window-all-closed` and `before-quit`
  * handlers, and `runBeforeQuitCleanup`. Startup ORDER is the product, so the
  * bodies stay behaviorally identical to their in-main.ts originals; every
- * process-scoped collaborator is injected. The single-instance lock and
- * `registerIpc()` anchor stay in main.ts. Call this once, at the same point the
- * inline `app.whenReady()` used to sit (immediately after `registerIpc()`).
+ * process-scoped collaborator is injected. The single-instance lock stays in
+ * main.ts; the `registerIpc()` anchor stays in boot.ts. Call this once, at
+ * the same point the inline `app.whenReady()` used to sit (immediately after
+ * `registerIpc()`).
  */
 export function wireAppLifecycle(deps: AppLifecycleDeps): void {
  const {
@@ -239,7 +240,7 @@ export function wireAppLifecycle(deps: AppLifecycleDeps): void {
  // renderer via the existing `sessions:changed` / `connections:event`
  // / `settings:bots:statusChanged` channels, so the UI converges lazily.
  // E2E fixture workspaces are wiped and seeded before stores open in
- // main.ts. SQLite keeps live file handles, so resetting the workspace
+ // boot.ts. SQLite keeps live file handles, so resetting the workspace
  // here after store construction would detach the canonical database.
  await runCredentialStartup();
  const initialWindowSignal = quitCoordinator.getWindowCreationSignal();

apps/desktop/e2e/storage-root-conflict.spec.ts

@@ -0,0 +1,90 @@
+import { _electron as electron, expect, test } from '@playwright/test';
+import type { ElectronApplication } from '@playwright/test';
+import { mkdir, mkdtemp, readFile, readdir, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { STORAGE_ROOT_MARKER_FILE, resolveStorageRoot } from '@maka/storage/root-authority';
+import { buildFixtureEnv } from '../../../scripts/fixture-env.mjs';
+import { closeElectronApplication } from '../../../scripts/electron-lifecycle.mjs';
+
+const DESKTOP_ROOT = process.cwd();
+
+/**
+ * Prove the app parked at the modal repair dialog — the only success signal
+ * this test accepts.
+ *
+ * The dialog can only appear after ready: the whole boot module runs inside
+ * the `whenReady` callback, so a modal dialog being up simultaneously proves
+ * (a) ready was reached and (b) the root-identity gate fired and is holding
+ * before any store/db write. On macOS the dialog's modal loop stops answering
+ * CDP evaluation, so an evaluate that never settles within the deadline is the
+ * observable form of "dialog is open". A deadlocked main process (the
+ * regression this test guards) answers every evaluate with `isReady() ===
+ * false` forever, and a future removal of the gate would make evaluate answer
+ * `true` — both must fail, only the parked dialog may pass.
+ */
+async function appParkedAtRepairDialog(app: ElectronApplication): Promise<boolean> {
+ for (let attempt = 0; attempt < 40; attempt += 1) {
+ const outcome = await Promise.race([
+ app
+ .evaluate(({ app: electronApp }) => electronApp.isReady())
+ .then((ready) => (ready ? 'ready' : 'not-ready'))
+ .catch(() => 'evaluate-error'),
+ new Promise<string>((resolve) => setTimeout(() => resolve('modal-dialog'), 1_000)),
+ ]);
+ if (outcome === 'modal-dialog') return true;
+ await new Promise((resolve) => setTimeout(resolve, 250));
+ }
+ return false;
+}
+
+/**
+ * A conflicting storage root must park at the repair dialog — never deadlock
+ * in module evaluation — and must not write any store/db files before the
+ * user answers.
+ *
+ * Regression for the Electron ESM startup deadlock: top-level
+ * `await app.whenReady()` inside the repair-confirm path never resolves
+ * because `ready` only fires after the main module finishes evaluating.
+ */
+test('parks at the storage-root repair dialog and writes nothing before the answer', async () => {
+ const userDataDir = await mkdtemp(join(tmpdir(), 'maka-root-conflict-'));
+ const homeDir = join(userDataDir, 'home');
+ await mkdir(homeDir, { recursive: true });
+ let app;
+ try {
+ // Seed a real interactive marker, then corrupt its device id so startup
+ // must stop at the repair dialog (mirrors the disk-identity drift that
+ // triggers root_identity_collision).
+ const workspaceRoot = join(userDataDir, 'workspaces', 'default');
+ await resolveStorageRoot({ path: workspaceRoot, kind: 'interactive' });
+ const markerPath = join(workspaceRoot, STORAGE_ROOT_MARKER_FILE);
+ const marker = JSON.parse(await readFile(markerPath, 'utf8')) as {
+ rootIdentity: { dev: string };
+ };
+ marker.rootIdentity.dev = (BigInt(marker.rootIdentity.dev) + 1n).toString();
+ const conflictingMarker = `${JSON.stringify(marker)}\n`;
+ await writeFile(markerPath, conflictingMarker);
+
+ // Launch without a fixture so the repair gate is live (fixture mode
+ // seeds its own workspace and bypasses the dialog).
+ app = await electron.launch({
+ args: ['.'],
+ cwd: DESKTOP_ROOT,
+ env: buildFixtureEnv(userDataDir, homeDir, {}),
+ });
+
+ // The app must park at the dialog — before this fix the main process
+ // deadlocked in module evaluation and no dialog ever appeared.
+ expect(await appParkedAtRepairDialog(app)).toBe(true);
+
+ // While the dialog is unanswered, no store/db files may be created in
+ // the workspace: the root-identity gate must precede all storage.
+ const workspaceEntries = await readdir(workspaceRoot);
+ expect(workspaceEntries).toEqual([STORAGE_ROOT_MARKER_FILE]);
+ expect(await readFile(markerPath, 'utf8')).toBe(conflictingMarker);
+ } finally {
+ if (app) await closeElectronApplication(app, 5_000);
+ await rm(userDataDir, { recursive: true, force: true });
+ }
+});

apps/desktop/src/main/app-lifecycle.ts

@@ -45,7 +45,7 @@ import { resumeSafeBoundaryContinuationsOnStartup } from './startup-safe-boundar
 
 type AssembledTools = ReturnType<typeof assembleDesktopTools>;
 export interface AppLifecycleDeps {
- // Whether this run stays out of the developer's way. main.ts owns the
+ // Whether this run stays out of the developer's way. boot.ts owns the
  // condition; the dock icon follows it so window visibility and dock
  // presence can never drift apart. A fixture window someone asked to see
  // (MAKA_E2E_SHOW_WINDOW) opts out of both together: as an accessory app it
@@ -82,14 +82,14 @@ export interface AppLifecycleDeps {
  agentGraphSupervisorWakeCoordinator: AgentGraphSupervisorWakeCoordinator;
  agentGraphControlStore: ReturnType<typeof createAgentGraphControlStore>;
  streamEvents: StreamEvents;
- /** Focus-or-create for the main window; stays in main.ts next to the
+ /** Focus-or-create for the main window; stays in boot.ts next to the
  * controller and is registered here on `second-instance` / `activate`. */
  focusOrCreateMainWindow: (signal: AbortSignal) => void;
  emitConnectionListChanged: () => void;
  emitSessionsChanged: (reason: 'migrated') => void;
  handleExternalSettingsChange: () => Promise<void>;
  /** Accessor for the settings IPC handle, which is assigned inside
- * main.ts's `registerIpc()`; teardown disposes it if present. */
+ * boot.ts's `registerIpc()`; teardown disposes it if present. */
  getSettingsIpc: () => SettingsIpcHandle | undefined;
 }
 
@@ -101,9 +101,10 @@ export interface AppLifecycleDeps {
  * `recoverInterruptedSessionsOnStartup`, the `window-all-closed` and `before-quit`
  * handlers, and `runBeforeQuitCleanup`. Startup ORDER is the product, so the
  * bodies stay behaviorally identical to their in-main.ts originals; every
- * process-scoped collaborator is injected. The single-instance lock and
- * `registerIpc()` anchor stay in main.ts. Call this once, at the same point the
- * inline `app.whenReady()` used to sit (immediately after `registerIpc()`).
+ * process-scoped collaborator is injected. The single-instance lock stays in
+ * main.ts; the `registerIpc()` anchor stays in boot.ts. Call this once, at
+ * the same point the inline `app.whenReady()` used to sit (immediately after
+ * `registerIpc()`).
  */
 export function wireAppLifecycle(deps: AppLifecycleDeps): void {
  const {
@@ -239,7 +240,7 @@ export function wireAppLifecycle(deps: AppLifecycleDeps): void {
  // renderer via the existing `sessions:changed` / `connections:event`
  // / `settings:bots:statusChanged` channels, so the UI converges lazily.
  // E2E fixture workspaces are wiped and seeded before stores open in
- // main.ts. SQLite keeps live file handles, so resetting the workspace
+ // boot.ts. SQLite keeps live file handles, so resetting the workspace
  // here after store construction would detach the canonical database.
  await runCredentialStartup();
  const initialWindowSignal = quitCoordinator.getWindowCreationSignal();

apps/desktop/e2e/storage-root-conflict.spec.ts

@@ -0,0 +1,90 @@
+import { _electron as electron, expect, test } from '@playwright/test';
+import type { ElectronApplication } from '@playwright/test';
+import { mkdir, mkdtemp, readFile, readdir, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { STORAGE_ROOT_MARKER_FILE, resolveStorageRoot } from '@maka/storage/root-authority';
+import { buildFixtureEnv } from '../../../scripts/fixture-env.mjs';
+import { closeElectronApplication } from '../../../scripts/electron-lifecycle.mjs';
+
+const DESKTOP_ROOT = process.cwd();
+
+/**
+ * Prove the app parked at the modal repair dialog — the only success signal
+ * this test accepts.
+ *
+ * The dialog can only appear after ready: the whole boot module runs inside
+ * the `whenReady` callback, so a modal dialog being up simultaneously proves
+ * (a) ready was reached and (b) the root-identity gate fired and is holding
+ * before any store/db write. On macOS the dialog's modal loop stops answering
+ * CDP evaluation, so an evaluate that never settles within the deadline is the
+ * observable form of "dialog is open". A deadlocked main process (the
+ * regression this test guards) answers every evaluate with `isReady() ===
+ * false` forever, and a future removal of the gate would make evaluate answer
+ * `true` — both must fail, only the parked dialog may pass.
+ */
+async function appParkedAtRepairDialog(app: ElectronApplication): Promise<boolean> {
+ for (let attempt = 0; attempt < 40; attempt += 1) {
+ const outcome = await Promise.race([
+ app
+ .evaluate(({ app: electronApp }) => electronApp.isReady())
+ .then((ready) => (ready ? 'ready' : 'not-ready'))
+ .catch(() => 'evaluate-error'),
+ new Promise<string>((resolve) => setTimeout(() => resolve('modal-dialog'), 1_000)),
+ ]);
+ if (outcome === 'modal-dialog') return true;
+ await new Promise((resolve) => setTimeout(resolve, 250));
+ }
+ return false;
+}
+
+/**
+ * A conflicting storage root must park at the repair dialog — never deadlock
+ * in module evaluation — and must not write any store/db files before the
+ * user answers.
+ *
+ * Regression for the Electron ESM startup deadlock: top-level
+ * `await app.whenReady()` inside the repair-confirm path never resolves
+ * because `ready` only fires after the main module finishes evaluating.
+ */
+test('parks at the storage-root repair dialog and writes nothing before the answer', async () => {
+ const userDataDir = await mkdtemp(join(tmpdir(), 'maka-root-conflict-'));
+ const homeDir = join(userDataDir, 'home');
+ await mkdir(homeDir, { recursive: true });
+ let app;
+ try {
+ // Seed a real interactive marker, then corrupt its device id so startup
+ // must stop at the repair dialog (mirrors the disk-identity drift that
+ // triggers root_identity_collision).
+ const workspaceRoot = join(userDataDir, 'workspaces', 'default');
+ await resolveStorageRoot({ path: workspaceRoot, kind: 'interactive' });
+ const markerPath = join(workspaceRoot, STORAGE_ROOT_MARKER_FILE);
+ const marker = JSON.parse(await readFile(markerPath, 'utf8')) as {
+ rootIdentity: { dev: string };
+ };
+ marker.rootIdentity.dev = (BigInt(marker.rootIdentity.dev) + 1n).toString();
+ const conflictingMarker = `${JSON.stringify(marker)}\n`;
+ await writeFile(markerPath, conflictingMarker);
+
+ // Launch without a fixture so the repair gate is live (fixture mode
+ // seeds its own workspace and bypasses the dialog).
+ app = await electron.launch({
+ args: ['.'],
+ cwd: DESKTOP_ROOT,
+ env: buildFixtureEnv(userDataDir, homeDir, {}),
+ });
+
+ // The app must park at the dialog — before this fix the main process
+ // deadlocked in module evaluation and no dialog ever appeared.
+ expect(await appParkedAtRepairDialog(app)).toBe(true);
+
+ // While the dialog is unanswered, no store/db files may be created in
+ // the workspace: the root-identity gate must precede all storage.
+ const workspaceEntries = await readdir(workspaceRoot);
+ expect(workspaceEntries).toEqual([STORAGE_ROOT_MARKER_FILE]);
+ expect(await readFile(markerPath, 'utf8')).toBe(conflictingMarker);
+ } finally {
+ if (app) await closeElectronApplication(app, 5_000);
+ await rm(userDataDir, { recursive: true, force: true });
+ }
+});

apps/desktop/src/main/app-lifecycle.ts

@@ -45,7 +45,7 @@ import { resumeSafeBoundaryContinuationsOnStartup } from './startup-safe-boundar
 
 type AssembledTools = ReturnType<typeof assembleDesktopTools>;
 export interface AppLifecycleDeps {
- // Whether this run stays out of the developer's way. main.ts owns the
+ // Whether this run stays out of the developer's way. boot.ts owns the
  // condition; the dock icon follows it so window visibility and dock
  // presence can never drift apart. A fixture window someone asked to see
  // (MAKA_E2E_SHOW_WINDOW) opts out of both together: as an accessory app it
@@ -82,14 +82,14 @@ export interface AppLifecycleDeps {
  agentGraphSupervisorWakeCoordinator: AgentGraphSupervisorWakeCoordinator;
  agentGraphControlStore: ReturnType<typeof createAgentGraphControlStore>;
  streamEvents: StreamEvents;
- /** Focus-or-create for the main window; stays in main.ts next to the
+ /** Focus-or-create for the main window; stays in boot.ts next to the
  * controller and is registered here on `second-instance` / `activate`. */
  focusOrCreateMainWindow: (signal: AbortSignal) => void;
  emitConnectionListChanged: () => void;
  emitSessionsChanged: (reason: 'migrated') => void;
  handleExternalSettingsChange: () => Promise<void>;
  /** Accessor for the settings IPC handle, which is assigned inside
- * main.ts's `registerIpc()`; teardown disposes it if present. */
+ * boot.ts's `registerIpc()`; teardown disposes it if present. */
  getSettingsIpc: () => SettingsIpcHandle | undefined;
 }
 
@@ -101,9 +101,10 @@ export interface AppLifecycleDeps {
  * `recoverInterruptedSessionsOnStartup`, the `window-all-closed` and `before-quit`
  * handlers, and `runBeforeQuitCleanup`. Startup ORDER is the product, so the
  * bodies stay behaviorally identical to their in-main.ts originals; every
- * process-scoped collaborator is injected. The single-instance lock and
- * `registerIpc()` anchor stay in main.ts. Call this once, at the same point the
- * inline `app.whenReady()` used to sit (immediately after `registerIpc()`).
+ * process-scoped collaborator is injected. The single-instance lock stays in
+ * main.ts; the `registerIpc()` anchor stays in boot.ts. Call this once, at
+ * the same point the inline `app.whenReady()` used to sit (immediately after
+ * `registerIpc()`).
  */
 export function wireAppLifecycle(deps: AppLifecycleDeps): void {
  const {
@@ -239,7 +240,7 @@ export function wireAppLifecycle(deps: AppLifecycleDeps): void {
  // renderer via the existing `sessions:changed` / `connections:event`
  // / `settings:bots:statusChanged` channels, so the UI converges lazily.
  // E2E fixture workspaces are wiped and seeded before stores open in
- // main.ts. SQLite keeps live file handles, so resetting the workspace
+ // boot.ts. SQLite keeps live file handles, so resetting the workspace
  // here after store construction would detach the canonical database.
  await runCredentialStartup();
  const initialWindowSignal = quitCoordinator.getWindowCreationSignal();