[nplez1]

Fixes #154

Summary

The updater held the main window forever and sent every status through
mainWindowRef?.webContents.send(...) with no isDestroyed() guard. When the window was destroyed
before the next updater event — closed and reopened on macOS, or recreated after a renderer failure —
the send threw TypeError: Object has been destroyed, escaped as an unhandled rejection, and no
window ever learned the status. currentStatus had already been updated, so the replacement window
started with a status the renderer was never told about.

• One binding owns the window. New UpdaterWindowBinding layer (bindMainWindow,
  releaseMainWindow, liveMainWindow, sendToMainWindow). Binding registers a closed listener
  that clears the reference — only when it still points at that window, so a replacement window's
  predecessor cannot unbind it. All 7 former mainWindowRef?.webContents.send(...) sites now go
  through sendToMainWindow, which skips a destroyed window or webContents and swallows a send
  that races window teardown. Keeping sendStatus running past the send also means the queued
  user-initiated check still launches — previously a throw skipped it.
• A status that lands in the gap is not lost. Binding replays currentStatus once. The replay is
  skipped only for the untouched { state: 'idle' } default — the renderer's own initial store value
  — so a real recorded idle (a benign background-check failure, an abandoned local-build card) still
  reaches the replacement window. The renderer also pulls status on bootstrap, but that pull can
  resolve before the bind, so the replay is what makes the recovery order-independent.
• Window-parented native UI follows the same rule. The local-build picker gets liveMainWindow(),
  so a dialog is never parented to a destroyed window.
• A failed send is recorded (renderer_send_failed) instead of vanishing silently.

Verification

pnpm tc                                  # clean — 18,061 node / 3,231 cli / 34 config / 16,084 web files
pnpm test src/main/updater               # 34 files, 423 tests passed
pnpm run check:code-quality:changed      # passed, 0 new findings
oxfmt --check, oxlint (changed files)    # clean

The full pnpm test suite was not run: this machine's unit gate has the known runtime trap
called out in the task, and the shared orca-queue was held by other worktrees' pnpm tc/test
for the whole session (load average stayed ~1.5, so the focus was verified without it). The focused
suites above are the updater's own; no test outside src/main/updater* was touched.

New src/main/updater.window-lifecycle.test.ts (8 tests) covers a send after the bound window
closed, after only its webContents went away, and a send that itself throws; the replay of a status
that landed while no window was bound, including a recorded idle; the untouched default not being
replayed; a replaced window's closed event not unbinding its successor; and headless serve setting
up with no window. Five of them fail against the previous code. The 18 updater suites now build their
window from createUpdaterMainWindow, which throws like Electron does once destroyed and drives
close/destroyWindow/destroyWebContents separately — the fake cannot make a missing guard look
harmless. That fixture is also a real BrowserWindow, so 97 as never escapes went away.

Review

Reviewed by Opus 5.5, high (claude/opus, Claude Code CLI backend), read-only, over the full diff
against nplez1/main:

• R1 — no BLOCKER, no SHOULD-FIX. 3 MINOR fixed in 016b979e83 / 5e1c8051fa: the idle check
  skipped real recorded idles (now an identity comparison against the initial status), a failed send
  was swallowed without a trace (now recorded), and the fake window never threw the way Electron does
  (it does now).
• Delta re-check R1..R2 — all three resolved; 1 new MINOR fixed in 07d5bd7fc3: with the fixture
  throwing, "the send did not throw" was also satisfied by the catch it is backstopped by, so the two
  destroyed-window tests now also assert that no send failed at all.

Remaining NITs, left by choice: the new tests drive the synchronous menu-check path rather than
autoUpdater's async error event (every send goes through the one helper); the local-build dialog
guard has no test; updater:quitAndInstallAborted still goes to the bound window rather than the
invoking renderer (pre-existing).