.trae/specs/launcher-shell-hardening/tray-menu-shutdown-addendum.md

# Tray Menu Shutdown Addendum

## Requirements

- Tray menu `Exit App` must commit an irreversible host shutdown request.
- Once shutdown is committed, tray menu actions must not reopen the desktop, settings window, or component library.
- Shutdown cleanup must release Public IPC, plugin runtime, tray icon, fused desktop edit UI, telemetry resources, and the single-instance lock before the forced-exit deadline.
- Forced process termination must be scheduled when the shutdown request is accepted, not only after Avalonia lifetime exit.
- Restart must preserve `RestartRequested` intent and must not route through an exit path that overwrites it.
- Fused desktop component library menu activation must reuse the existing library window and must exit edit mode if opening fails.

## Acceptance

- Selecting `Exit App` from the tray leaves no background host process and allows a later Launcher start to acquire the single-instance lock.
- Selecting `Restart App` starts the Launcher or upgrade helper once, then shuts down the old host as a restart.
- Repeated tray clicks during shutdown are ignored and logged.
- Repeated component-library clicks focus the existing window instead of opening duplicates.
Add HostShutdownGate and shutdown handling Introduce HostShutdownGate to serialize and record the first host shutdown request (Restart preferred over later Exit). Add tests (HostShutdownGateTests) and a tray-menu spec describing shutdown requirements. Integrate the gate into App: expose IsShutdownInProgress, ignore tray/settings/component-library actions during shutdown, reuse/track the fused component library window, ensure edit-mode exit on failures, and close the library during shutdown. Add TrySubmitShutdown to commit shutdown intent, schedule forced termination, perform exit cleanup, and invoke desktop lifetime shutdown. Update HostApplicationLifecycleService to use the new TrySubmitShutdown flow for Exit/Restart. Harden DesktopTrayService.Dispose to clear icons and dispose the tray icon safely. These changes ensure irreversible shutdown commits, prevent UI reopening during shutdown, preserve restart intent, and avoid duplicate or conflicting shutdown actions. 2026-04-23 14:18:09 +08:00			`# Tray Menu Shutdown Addendum`

			`## Requirements`

			- Tray menu `Exit App` must commit an irreversible host shutdown request.
			`- Once shutdown is committed, tray menu actions must not reopen the desktop, settings window, or component library.`
			`- Shutdown cleanup must release Public IPC, plugin runtime, tray icon, fused desktop edit UI, telemetry resources, and the single-instance lock before the forced-exit deadline.`
			`- Forced process termination must be scheduled when the shutdown request is accepted, not only after Avalonia lifetime exit.`
			- Restart must preserve `RestartRequested` intent and must not route through an exit path that overwrites it.
			`- Fused desktop component library menu activation must reuse the existing library window and must exit edit mode if opening fails.`

			`## Acceptance`

			- Selecting `Exit App` from the tray leaves no background host process and allows a later Launcher start to acquire the single-instance lock.
			- Selecting `Restart App` starts the Launcher or upgrade helper once, then shuts down the old host as a restart.
			`- Repeated tray clicks during shutdown are ignored and logged.`
			`- Repeated component-library clicks focus the existing window instead of opening duplicates.`