- ci.yml: add a `test` job that runs `pnpm test` on ubuntu-latest,
  covering all 247+ vitest unit tests that were previously not run in CI.

- desktop-ci-dist.yml: add real launchd lifecycle e2e test that runs on
  macOS CI runners before the packaged app build. The test exercises:
  1. Bootstrap: register plist → kickstart → verify running + port
  2. Teardown: bootout → verify label unregistered → verify process dead
  3. SIGKILL fallback: bootout → saved-PID SIGKILL → verify dead
  4. Orphan detection: spawn fake orphan → detect via lsof → SIGKILL
  5. Re-bootstrap: fresh cold start after full cleanup

- scripts/launchd-lifecycle-e2e.sh: standalone e2e test script (15 checks)
  that validates the launchd process management primitives used by the
  desktop app's quit and update-install paths.

Fixes:
- dev-env.sh: add Launch Services cache flush (lsregister) after
  patching LSUIElement=true on the dev Electron binary. Without this,
  macOS uses cached plist data and still shows Dock icons for child
  processes. Add verification logging on success/failure.
- daemon-supervisor: force ELECTRON_RUN_AS_NODE=1 on all spawn() calls
  that use process.execPath (Electron binary) as a safety net, even if
  the manifest env omits it.

Tests:
- daemon-supervisor.test.ts (10 tests): constructor, startAutoStart,
  stopUnit SIGTERM/SIGKILL escalation, 5s deadline, stopAll parallel,
  dispose, skip non-managed, ELECTRON_RUN_AS_NODE safety net,
  stoppedByUser suppresses restart, dependent stop order.
- quit-handler.test.ts (8 tests): quit-completely full sequence,
  __nexuForceQuit flag, app.exit(0), error resilience for onBeforeQuit
  and webServer.close, no-plistDir skip, run-in-background hide.
- desktop-stop-smoke.sh: post-stop verification script — checks no
  residual processes, free ports, no launchd labels, no stale state.
  Integrated into desktop-check-dev.sh for CI.

dev-launchd.sh (pnpm start) was launching Electron directly without
going through dev-env.sh, bypassing the LSUIElement=true plist patch
and Launch Services cache flush. This is the direct cause of the Dock
icon proliferation reported by users running pnpm start.

Now pnpm start → dev-launchd.sh → dev-env.sh → electron, matching the
same path that pnpm dev uses via dev.sh → dev-run.sh → dev-env.sh.

Static analysis tests that guard critical invariants across the launch,
environment, and shutdown scripts. These catch regressions like the
dev-launchd.sh bypass of dev-env.sh that caused Dock icon proliferation.

19 invariant checks covering:
- Launch paths: all Electron launch commands go through dev-env.sh
- LSUIElement: plist patch + LS cache flush present
- ELECTRON_RUN_AS_NODE: set in plists, manifests, daemon-supervisor,
  openclaw-process, and catalog-manager
- Shutdown: bootout, orphan kill, port wait, teardown via shared
  function, try/catch wrapping, verification gate ordering

… paths

Bring test coverage for the 6 core lifecycle files from 63.5% to 83.8%
overall statements, with function coverage at 93.8%.

Per-file improvements:
- update-manager.ts: 63.1% → 98.5% (bindEvents, checkNow, downloadUpdate,
  periodicCheck, setChannel/setSource, send to webviews)
- quit-handler.ts: 36.1% → 97.0% (installLaunchdQuitHandler dialog flow,
  force-quit bypass, dev-mode bypass, Cmd+Q interception, dialogOpen guard)
- launchd-manager.ts: 72.7% → 94.9% (uninstallService, stopServiceGracefully
  SIGKILL escalation, restartService, rebootstrapFromPlist, hasPlistFile)
- daemon-supervisor.ts: 46.5% → 69.5% (startUnit port probe, auto-restart
  backoff, refreshDelegatedUnits pgrep, stdout/stderr capture, queryEvents)
- launchd-bootstrap.ts: 92.6% → 93.1% (isLaunchdBootstrapEnabled packaged
  heuristic, ensureNexuProcessesDead edge cases)
- plist-generator.ts: 100% (unchanged)

New test files: daemon-supervisor.test.ts (27), quit-handler-full.test.ts (13),
update-manager-full.test.ts (41), launchd-manager-ops-extended.test.ts (11),
launchd-bootstrap-edge.test.ts (12).

Total: 391 tests across 40 files, all passing.

Fixes:
- update-manager: save initial setTimeout ID so stopPeriodicCheck can
  cancel it during the initial delay window. Previously, calling
  stopPeriodicCheck before the initial delay expired was a no-op,
  allowing the interval to start during teardown.
- update-manager: call stopPeriodicCheck() at the start of
  quitAndInstall() to prevent periodic checks from firing mid-teardown.

Tests:
- launchd-integration.test.ts: 8 tests that run REAL launchd on macOS
  (skipped on other platforms). Covers:
  1. installService + startService → real service running on real port
  2. bootoutAndWaitForExit → real process confirmed dead
  3. teardownLaunchdServices → full sequence against real launchd
  4. ensureNexuProcessesDead → real orphan process spawned and killed
  5. getServiceStatus → real PID from launchctl print
  6. getServiceStatus → unknown for non-existent label
  7. installService → detects plist content change and re-bootstraps
  8. stopServiceGracefully → real SIGTERM stops service

CI:
- desktop-ci-dist.yml: add `pnpm test` step on macOS runners so real
  launchd integration tests run in CI alongside the shell e2e tests.

Expand launchd-integration.test.ts from 8 to 16 real launchd tests:

9.  Full cycle: start → bootout → verify clean → cold re-start
10. Attach: detect already-running service from previous session
11. KeepAlive: service auto-restarts after SIGKILL (crash simulation)
12. Rapid start/stop cycles leave no orphan processes
13. Port conflict: occupied port → bootout still cleans up
14. bootout on non-registered label is idempotent (no throw)
15. teardownLaunchdServices with non-existent labels is safe
16. waitForExit handles process dying during bootout (race condition)

CI: add pnpm test to desktop-ci-dev.yml (macOS-14) so real launchd
integration tests also run in the dev CI path, not just dist CI.

…Manager methods

Expand from 16 to 33 real launchd tests, covering every LaunchdManager
public method and critical lifecycle scenario against actual launchctl:

Methods:
- installService (fresh, idempotent, content-change re-bootstrap)
- startService, stopService (SIGTERM), restartService (kickstart -k)
- bootoutService, bootoutAndWaitForExit (with PID-aware fallback)
- uninstallService (bootout + delete plist, idempotent)
- stopServiceGracefully (SIGTERM → poll → SIGKILL escalation)
- rebootstrapFromPlist (re-register after bootout)
- getServiceStatus (running/unknown, PID parsing, env parsing)
- isServiceRegistered, hasPlistFile, isServiceInstalled
- waitForExit (with knownPid after bootout)
- getDomain, getPlistDir

Scenarios:
- Full start→stop→restart cycle
- Attach to already-running service from previous session
- KeepAlive auto-restart after SIGKILL (crash simulation)
- Rapid start/stop cycles with no orphans
- Port conflict: bootout cleans up even when port is blocked
- Double bootout is idempotent
- Process dying during bootout (race condition)
- Multiple services: start two, teardown both
- ensureNexuProcessesDead: no-op when clean, kills orphans
- teardownLaunchdServices: non-existent labels are safe

Spin up a local HTTP server that mimics the desktop release CDN and
verify the update feed resolution + YAML serving end-to-end:

1.  Feed URL resolves to valid fetchable URL (stable/arm64)
2.  Server serves latest-mac.yml at correct path
3.  YAML contains all electron-updater required fields
4.  All 3 channels × 2 architectures serve valid responses
5.  404 for invalid paths
6.  Explicit feedUrl overrides default
7.  Custom feed URL pointed at local server is fetchable
8.  Version comparison: server version > current = update available
9.  Download artifact URL serves content
10. Server request logging works
11. GitHub source returns github:// URL
12. NEXU_UPDATE_FEED_URL env takes highest priority

These catch real HTTP/YAML issues that mocked autoUpdater tests miss.

bootstrap.ts configureLocalDevPaths() unconditionally overwrote
process.env.NEXU_HOME with userData/.nexu, clobbering the value
passed by dev-launchd.sh (pnpm start). This caused controller to
read config from a fresh empty directory instead of the intended
.tmp/desktop/nexu-home/, making every pnpm start feel like a
first-time setup.

Fix: only set NEXU_HOME as fallback when not already provided.

Packaged users are unaffected — configureLocalDevPaths() returns
early when app.isPackaged is true (line 47).

Also adds 27 data-directory-invariants tests that guard:
- bootstrap.ts path configuration guards (isPackaged, env respect)
- runtime-config.ts NEXU_HOME resolution order
- controller env.ts data file locations under NEXU_HOME
- plist NEXU_HOME and OPENCLAW_STATE_DIR presence
- dev-launchd.sh path consistency
- AGENTS.md directory layout contract
- Packaged mode backward compatibility with 0.1.7
- OpenClaw state directory separation from NEXU_HOME

Fix: bootstrap.ts configureLocalDevPaths() now respects externally-set
NEXU_HOME instead of unconditionally overwriting it. This fixes pnpm
start creating a fresh config directory on every launch.

70 runtime tests verify every data path by calling real functions and
checking real output:

Controller plist env vars (26 tests):
  NEXU_HOME, OPENCLAW_STATE_DIR, OPENCLAW_CONFIG_PATH,
  OPENCLAW_SKILLS_DIR, OPENCLAW_EXTENSIONS_DIR,
  SKILLHUB_STATIC_SKILLS_DIR, PLATFORM_TEMPLATES_DIR, OPENCLAW_BIN,
  OPENCLAW_ELECTRON_EXECUTABLE, NODE_PATH, TMPDIR, PORT, HOST,
  WEB_URL, OPENCLAW_GATEWAY_PORT, OPENCLAW_GATEWAY_TOKEN,
  ELECTRON_RUN_AS_NODE, RUNTIME_MANAGE_OPENCLAW_PROCESS,
  RUNTIME_GATEWAY_PROBE_ENABLED, OPENCLAW_DISABLE_BONJOUR,
  NODE_ENV (dev+prod), HOME, PATH, NEXU_HOME omission

OpenClaw plist env vars (12 tests):
  ELECTRON_RUN_AS_NODE, OPENCLAW_CONFIG, OPENCLAW_CONFIG_PATH,
  OPENCLAW_STATE_DIR, OPENCLAW_LAUNCHD_LABEL (dev+prod),
  OPENCLAW_SERVICE_MARKER, HOME, PATH, NODE_PATH,
  no NEXU_HOME, no PORT

Plist structure (11 tests):
  ProgramArguments, WorkingDirectory, StandardOutPath,
  StandardErrorPath, KeepAlive, RunAtLoad, Label (dev+prod),
  gateway run args, --auth none (dev only), OtherJobEnabled

Path resolution (12 tests):
  desktop-paths.ts helpers (6), resolveLaunchdPaths dev+packaged (4),
  getDefaultPlistDir dev+prod, getLogDir dev+prod

Directory separation (5 tests):
  packaged NEXU_HOME ≠ userData, dev NEXU_HOME ≠ userData,
  NEXU_HOME under home, userData under Application Support,
  dev state repo-scoped

Config resolution (4 tests):
  NEXU_HOME default, env override, runtime-config priority chain

…, not path.resolve

Replace 70 trivial path.resolve assertions with 27 behavior-focused
tests that call real functions and check real output:

generatePlist output (25 tests):
  Call the real function with production-realistic inputs, parse the
  XML, and verify every env var value matches expected paths.
  Key checks:
  - NEXU_HOME → ~/.nexu (not under userData)
  - OPENCLAW_STATE_DIR → under userData (not under NEXU_HOME)
  - OPENCLAW_CONFIG_PATH consistent with OPENCLAW_STATE_DIR
  - OPENCLAW_SKILLS_DIR consistent with OPENCLAW_STATE_DIR
  - OpenClaw plist has NO NEXU_HOME (it doesn't use it)
  These would have caught the #526 bug.

runtime-config resolution (2 tests):
  Call getDesktopRuntimeConfig with different env objects, verify
  the NEXU_HOME priority chain: env > buildConfig > ~/.nexu default.

Real launchd env verification (macOS, 2 tests):
  Start a real launchd service, read launchctl print output, parse
  the environment block, verify NEXU_HOME and OPENCLAW_STATE_DIR
  are what we set and are different directories.

Deleted:
- quit-handler.test.ts (8 tests superseded by quit-handler-full.test.ts)
- data-directory-invariants.test.ts (27 grep-source-code tests, worthless)
- launchd-manager-ops-extended.test.ts (11 tests duplicated in ops.test.ts)

Added edge cases:
- daemon-supervisor: partial failure (one unit hangs), double dispose,
  child.error event handling
- lifecycle-teardown: process.kill EPERM handling, PID deduplication
  across multiple pgrep patterns
- update-install: stopPeriodicCheck before teardown verification,
  ensureNexuProcessesDead throw propagation
- launchd-integration (real launchd): NEXU_HOME with spaces,
  NEXU_HOME with Chinese unicode, OtherJobEnabled cascading behavior
- launchd-lifecycle-e2e.sh: Phase 6 (spaces) + Phase 7 (unicode)
  using .cjs scripts for ESM-safe execution

Net: -878 lines of garbage, +537 lines of behavior-focused tests.
17/17 real launchd e2e checks passing.

Required for running test coverage reports locally and in CI.

Add missing paths that affect launchd/lifecycle behavior:

- apps/controller/** — controller process management, env parsing,
  openclaw process spawning. Changes here can break launchd services.
- scripts/dev-launchd.sh — pnpm start/stop/restart entry point.
- scripts/kill-all.sh — global process cleanup.
- scripts/desktop-stop-smoke.sh — added to dist CI (was only in dev).
- scripts/launchd-lifecycle-e2e.sh — added to dev CI (was only in dist).
- tests/desktop/** — test changes should trigger CI to verify they pass.
- vitest.config.ts — test framework config changes could break all tests.

This ensures any change that could affect launchd, process lifecycle,
or the test suite triggers the macOS CI runners.

P0-2: Extract single authoritative gracefulShutdown(reason) function.

- Idempotent: shutdownInProgress guard prevents double teardown.
- 8-second hard timeout: if teardown hangs, process.exit(1) fires.
- Handles both launchd mode (teardownLaunchdServices) and orchestrator
  mode (orchestrator.dispose) in one function.
- SIGTERM + SIGINT handlers registered on process, route to
  gracefulShutdown then app.exit(0). This covers:
  - External kill (Activity Monitor, scripts, systemd)
  - Ctrl+C in terminal
  - System shutdown sending SIGTERM
- dev-launchd.sh stop now sends SIGTERM first (triggers graceful
  shutdown in Electron), waits up to 10s, then SIGKILL as fallback.
  Previously it used SIGKILL immediately, bypassing all cleanup.

P1-2: Replace removeAllListeners("before-quit") with removeListener.

- Store the specific handler reference (beforeQuitHandler).
- Only remove that handler, not all before-quit listeners.
- Prevents future listeners (telemetry, flush, etc.) from being
  accidentally removed.

Also fixes: dev.sh kill_residual_processes patterns were outdated
(referenced .tmp/sidecars/ paths that no longer exist), causing
CI stop smoke test failures. Updated to match current process patterns.

PR review fixes:
- launchd-bootstrap: orphan kill now only runs when neither service is
  registered with launchd, preventing SIGKILL of healthy managed services
  during relaunch-after-crash scenarios.
- quit-handler: teardownLaunchdServices always runs on quit-completely,
  even if plistDir is absent (plistDir only affects runtime-ports cleanup).
- desktop-stop-smoke.sh: add web sidecar pattern to process checks.
- desktop-check-dev.sh: replace fixed 2s sleep with bounded polling
  (max 10s) to avoid teardown race flakes.
- dev-env.sh: lsregister success/failure logged accurately.
- dev.sh: kill_residual_processes patterns updated to match current
  process paths (was using stale .tmp/sidecars/ paths).

CODEOWNERS: require @lefarcen review for test changes only.
Tests define the quality gate — source code anyone can change,
but acceptance criteria changes need review.

dev-launchd.sh stop_services now kills the tsc --watch and web watcher
background processes. These were only cleaned by the EXIT trap (which
fires when the start_services function's shell exits), but `pnpm stop`
calls stop_services directly without triggering the trap — leaving
watchers printing to the terminal after stop.

Also adds tsc watcher residual check to desktop-stop-smoke.sh.

- Revert CODEOWNERS to original (only api/migrations).
- Remove OPENCLAW_ENTRY prerequisite from launchd-lifecycle-e2e.sh —
  the script only tests controller, never launches openclaw.

…-robustness

…-based updates, unified teardown

- Extract Electron binary + frameworks to ~/.nexu/runtime/nexu-runner.app/ via
  APFS clone so launchd services never reference the .app bundle, unblocking
  Finder drag-and-drop reinstalls
- Extract controller sidecar to ~/.nexu/runtime/controller-sidecar/ for the
  same reason; openclaw sidecar already extracted by existing logic
- All three extractions use staging dir + atomic rename to prevent half-copies
- Version-aware attach: refuse to attach to services from a different app
  version, build source, userDataPath, or openclawStateDir
- Evidence-based update install: after process sweeps, lsof-check critical
  paths; only abort if .app bundle or sidecar dirs are actually locked
- Unified dev/packaged teardown: Cmd+Q, window close, and no-window exit
  all go through teardownLaunchdServices in both modes
- daemon-supervisor circuit breaker: MAX_CONSECUTIVE_RESTARTS=10 with
  120s window, emits max_restarts_exceeded reason code
- bootoutService tolerates "already gone" errors
- runtime-ports.json atomic write (tmp + rename)
- Tighter orphan cleanup: prefer launchd label + runtime-ports metadata,
  fall back to pgrep with node.* prefix and process tree exclusion

…ion guard tests

Root cause of nightly white-screen: entitlements.mac.inherit.plist dropped
allow-jit, causing V8 to fail mmap with MAP_JIT on macOS 14.7.4+ → renderer
OOM → white screen.

Fix: add back allow-jit and allow-unsigned-executable-memory alongside inherit.

Tests: 8 static analysis tests guard against future entitlement regressions,
verifying both parent and inherit plists have the required V8 JIT keys.

…-robustness