- Startup gate moves from index.ts into main-process-preflight.ts (before the
single-instance lock and startup diagnostics writes), now returns false so a
blocked launch stops executing instead of running past app.exit(0).
- Serve-mode launches skip the gate: a supervised headless restart must not be
swallowed, and serve must not consume desktop install-recovery state.
- Updater state/arm/reset/scheduling/menu/setup logic ported into the new
UpdaterState class hierarchy; reportRecoveredMacUpdateInstallFailure exported
via the updater facade.
- Arming is now fail-open (armMacUpdateInstallAttemptSafely): a fence failure
logs and proceeds with the install, and supervised-headless-serve installs
never arm the GUI recovery monitor.