fix(desktop): attach renderer-lifecycle diagnostics to all BrowserWindow instances (#81290)

[Enough1122]

Summary

Secondary session windows and full-instance windows on Hermes Desktop previously attached no renderer-lifecycle diagnostics (render-process-gone, unresponsive, oom, console errors). A peer renderer crash therefore produced a permanently black window with no log evidence and no recovery, exactly as described in #81290 by @akivavh (three reproductions, sanitized live captures, all render-process-gone/unresponsive/did-fail-load lookups returning empty for the affected HWND).

Root cause

The main window had a hand-rolled crash handler attached directly. spawnSecondaryWindow() and createInstanceWindow() only attached navigation / shortcut / zoom / context-menu wiring; nothing listened for renderer death. The diagnostic gap and the recovery gap were the same gap.

Fix

Promote the primary-window crash handling into a shared, Electron-free, dependency-injectable helper electron/window-renderer-lifecycle.ts and install it on every BrowserWindow we create:

Window kind	Behavior
main / secondary / instance	Full recovery under a shared rolling crash-loop budget (3 reloads / 60s). Identical semantics to the previous primary-only behavior, including the #38216 Windows sandbox-relaunch callback, which is wired through callbacks.onCrashLoopSuppressed and only fires for kind: 'main'.
overlay / quick / wake	Log-only. Auxiliary windows must never resurrect themselves.

Logs carry the window kind so black-window reports become attributable, e.g.:

[renderer:secondary] render-process-gone reason=crashed exitCode=3

This is the "黑窗有据可查" property requested in the issue.

Why this is the whole-bug-class fix

Sibling call paths (spawnSecondaryWindow, createInstanceWindow, createOverlayWindow, createQuickWindow, createWakeIndicatorWindowController) all route through the new helper, so any future window added to main.ts only needs the helper call — it inherits the same diagnostics and budget.

Verification

Check	Result
pnpm -C apps/desktop test (electron project) — new + wake-indicator suites	21/21 pass
tsc -p tsconfig.electron.json --noEmit	0 error
eslint apps/desktop/electron/	0 error / 0 warning
Existing electron test surface (full project)	Same 17 pre-existing failures as a clean HEAD stash — environmental, not introduced (verified by stash)
Independent code-reviewer agent review	APPROVE, 0 critical / 0 high. 3 LOW findings fixed in-tree. Behavior equivalence verified line-by-line against the original primary-window path (rolling-guard semantics, #38216 guard inversion, console dual-shape parsing)

Out of scope (deliberate)

• An e2e Playwright regression that crashes a secondary renderer in a real Electron environment. The unit suite covers the helper exhaustively (event dispatch, budget rollover, kind-specific behavior, cleanup, console-error capture), but a true e2e requires running the full desktop app and is parked behind a separate issue if reviewers want it.

Related

• Fixes [Bug]: Secondary Desktop window stays black with no lifecycle diagnostics or recovery #81290
• Preserves the #38216 Windows sandbox-relaunch path with no behavioral change (windows-sandbox-fallback.ts is unchanged; the new helper consults it via the onCrashLoopSuppressed callback only for kind: 'main').

[Enough1122]

PR cleanup: removed developer-process docs (INVESTIGATION.md / PLAN.md / STATUS.md) and the accidental .omc/ .gitignore entry that were committed with the fix; normalized the new TS files to LF line endings. The change is now scoped to the desktop renderer-lifecycle fix only.

[spfcraze]

This was generated by AI during triage.

Summary:
The description says the helper installs on every BrowserWindow, but the OAuth login and portal login windows in main.ts are not wired, so a crashed sign-in renderer leaves no lifecycle entry in desktop.log.

Problems:

• apps/desktop/electron/main.ts creates a BrowserWindow in both openOauthLoginWindow (main.ts:6089) and openPortalLoginWindow (main.ts:6591); neither calls installWindowRendererLifecycle.
• The description's "install it on every BrowserWindow we create" is broader than the diff's coverage: its table enumerates the six wired kinds — main/secondary/instance (full recovery, 3-reloads/60s) and overlay/quick/wake (log-only) — the login windows are in neither.

Solution:
As a wording that matches the diff: the helper installs on the main, secondary, instance, overlay, quick, and wake windows. If the login windows are meant to be included, wiring them log-only would make the description accurate.

---

Checked against c213f99 — the tip of fix/81290-secondary-window-lifecycle when this was written — and 70c6cf8, main at the same moment.

[teknium1]

Merged via PR #83567 — thank you for the excellent work here! All four of your commits were cherry-picked onto current main with your authorship preserved in git log (your branch had fallen ~114 commits behind).

One reconciliation was needed on top: PR #83535 landed after your branch and gave console-message capture a dedicated owner (renderer-log.ts, with per-window labels and error-boundary persistence), so the lifecycle helper's console handling was removed to keep a single owner — this also prevents OAuth/portal pages from spilling third-party console output into desktop.log. Your process-event coverage (render-process-gone / unresponsive / did-fail-load), the shared crash-loop budget, and the full test suite are intact, and the HUD window (added after you branched) now gets the same coverage.

The Electron-free dependency-injected design made this salvage painless — nice architecture.