[masarray]

Critical defect

Closing the Studio window can leave ARStackStudio.exe resident on Windows. The stale process retains single-instance/session ownership so the next launch appears to do nothing.

This violates the repository lifecycle contract in AGENTS.md: stop new work, cancel/retire timers and callbacks, join workers, release handles, and never leave teardown unbounded.

Root cause

Shutdown authority was fragmented:

• QML close only requested SMV STOP;
• StudioDeviceController owned a separate aboutToQuit hook;
• FirmwareManager owned another quit hook;
• SmartSessionController had no explicit teardown boundary;
• DeviceController and FirmwareManager used Qt::BlockingQueuedConnection plus unbounded QThread::wait() during destruction.

That makes Windows process exit depend on QObject/QML destruction order after the GUI event loop is already ending.

Fix

• Add explicit idempotent SmartSessionController::shutdown() to stop discovery/reconnect/profile-sync/handoff/recovery callback owners first.
• Add explicit bounded DeviceController::shutdown() that requests worker-side STOP/serial close, waits for acknowledgement with a deadline, then performs bounded QThread retirement.
• Apply the same bounded retirement contract to FirmwareManager / FirmwareWorker.
• Remove the competing StudioDeviceController app-quit hook.
• Make main.cpp the single shutdown coordinator while worker event loops are still alive: supervisor -> serial worker -> firmware worker.
• Treat emergency thread termination only as last-resort process-exit containment; reaching it reports lifecycle failure and must fail CI.

Permanent regression gate

Adds ARStack Studio Windows Lifecycle CI. It builds the actual Studio GUI executable on Windows and performs two consecutive cycles:

1. launch with --check-app-lifecycle;
2. close primary window;
3. require clean worker-retirement PASS and actual PID exit within 12 s;
4. immediately reopen the application;
5. require a second clean exit.

This directly proves the reported failure mode: close -> process exit -> lock release -> immediate reopen.

Isolation

No embedded firmware, PTP engine, or apps/ied_simulator/** source is changed.

Merge gate

Keep draft until exact-head Windows lifecycle, existing Studio Qt, S8A/S8B ownership, and repository CI are green. Then validate one packaged Windows build manually against Task Manager before merge/release.

[masarray]

P0 lifecycle checkpoint — exact-head candidate ready for physical Windows verification

Exact PR head: dbb564e396ed6e6b064b9b79ad21de110d1f342d

Automated validation is now green:

• ARStack Studio Windows Lifecycle PASS: two consecutive launch -> primary close -> clean worker retirement -> PID exit -> immediate reopen cycles on Windows Server 2022.
• ARStack Studio Qt, C++ CI, Security/Evidence, Embedded Profile, Control Interop, Dynamic RCB and BRCB gates PASS.
• ARStack Studio Release run 34945762813 PASS end-to-end.
• Native Windows S8A/S8B ownership gates PASS.
• Packaged application contract PASS.
• Fresh Windows package smoke PASS for both portable ZIP and NSIS-installed build with restricted PATH, including packaged lifecycle check and single-instance ownership check.

Release-candidate artifact:

• artifact arstack-studio-windows-x64
• artifact ID 10386788450
• artifact digest sha256:93c114375c71ca856e27745eb5d5ed5ecd2bea9c93fe5e1d8fd9b173309a593f
• portable SHA-256 451547321b27582db72a6101bfdb7ae49c6076c9654a8879024093f345c89da7
• installer SHA-256 ec216397dbde1338cd7f649d14ab118e58d4b93118d41f1181e723ea3d0b68aa

PR remains draft until one real-PC verification against the originally reported symptom: start packaged Studio, close it normally, confirm ARStackStudio.exe disappears from Task Manager, immediately open again, then close again and confirm PID disappears. No firmware/PTP/IED Simulator files are part of this lifecycle fix scope.

[masarray]

Exact-head lifecycle checkpoint

Candidate head: dbb564e396ed6e6b064b9b79ad21de110d1f342d

Validation completed on this exact head:

• ARStack Studio Windows Lifecycle: PASS
  • cycle 1: close -> clean worker retirement -> PID exit
  • cycle 2: immediate reopen -> close -> clean worker retirement -> PID exit
• ARStack Studio Qt: PASS
• C++ CI: PASS
• Security and Evidence: PASS
• embedded/interoperability/RCB gates: PASS
• ARStack Studio Release: PASS
  • native Windows Release build
  • S8A/S8B Windows integration gates
  • package contract
  • portable ZIP
  • NSIS installer
  • fresh-Windows portable + installer smoke under restricted PATH

Windows candidate artifact:

• artifact ID 10386788450
• artifact digest sha256:93c114375c71ca856e27745eb5d5ed5ecd2bea9c93fe5e1d8fd9b173309a593f
• portable SHA-256 451547321b27582db72a6101bfdb7ae49c6076c9654a8879024093f345c89da7
• installer SHA-256 ec216397dbde1338cd7f649d14ab118e58d4b93118d41f1181e723ea3d0b68aa

PR remains draft until one real Windows/board session confirms the reported field failure mode is gone: close Studio while a real session is active, confirm ARStackStudio.exe disappears from Task Manager, then reopen immediately. No embedded/PTP/IED Simulator source is changed by this PR.

[masarray]

Stage-main release check · 2026-10-23 — KEEP OPEN until lifecycle gate

Canonical Studio #286 already includes idempotent SmartSessionController::shutdown(), bounded DeviceController::shutdown(), bounded firmware worker retirement and a main.cpp shutdown coordinator, reflecting this PR's Windows process-exit objective. However #99 remains a diverged source branch (10 source-exclusive commits at last GitHub compare). Exact-head #286 Native Preview passed clean install / hot upgrade / uninstall, but the separate ARStack Studio Windows Lifecycle workflow was SKIPPED on current Draft SHA 042df0d40ddd3f061ebeebc81c662c585827e346. This matters: installer upgrade success does not establish the specific close-window→PID-exit→immediate-relaunch test twice or exclude emergency thread termination.

Keep this candidate OPEN until the independent lifecycle job runs successfully on an accepted exact final staging SHA (plus packaged Windows Task Manager observation if required). No direct main merge; no source branch deletion. Do not misreport skipped lifecycle CI as a pass.

[masarray]

2026-10-23 Stage→Main source/CI parity audit — SUPERSEDED Windows shutdown PR, NOT MERGED

Source history diverged: #99 head dbb564e396ed6e6b064b9b79ad21de110d1f342d is NOT a commit ancestor of recovered integration HEAD 8a2428503ee8a1595b03901ac8c1ca2b8343c728. Therefore this is verified functional replacement, NOT ancestry inclusion/cherry-pick.

All nine files/contract roles inspected on final merged checkpoint source: SmartSessionController::shutdown() idempotently stops recovery/discovery/session owners; DeviceController::shutdown() retains finite ACK/thread join/retry/emergency timeouts; FirmwareManager::shutdown() similarly retires its worker using finite timeouts; old competing StudioDeviceController aboutToQuit hook absent; main.cpp is single supervisor→serial→firmware aboutToQuit coordinator, returns error if fallback used; existing workflow .github/workflows/arstack-studio-windows-lifecycle.yml uses --check-app-lifecycle and two real process close→PID exit→immediate reopen cycles.

Current exact-HEAD empirical Windows evidence: Windows Lifecycle run 39945241839 on #288 head 8a2428503ee8a1595b03901ac8c1ca2b8343c728 completed SUCCESS; job Close -> process exit -> immediate reopen explicitly passed Two-cycle normal-close lifecycle regression and Studio UI geometry acceptance and Windows screenshots. Other same-head Native Preview, Qt, ESP32 and C++ workflows also SUCCESS. This specifically resolves the original #99 CI failure mode (stuck exe prevents second launch), unlike old Draft skipped workflows.

Remaining acceptance before public release: manually inspect packaged Windows installer + Task Manager PID clean exit/relaunch on an operator machine, plus unrelated physical SV/PTP FAT and safe USB/firmware STOP. Exact source branch still recoverable if an independent lifecycle regression is reproduced later. No hardware evidence claimed, no new commits/cherry-picks, no branch deletion, no main merge. Current recovery source lives in merged-only checkpoint checkpoint/sv-ptp-autolive-capture-ci-merged-20261023 through #288, not public main.

Disposition: CLOSE this obsolete alternative PR unmerged, no duplicate Windows lifecycle PR competing for integration. Keep the workflow gate as permanent release requirement in future Stage→Main PR.