- mainWindow/autoUpdater/quit handover via setter pattern (no main.ts imports) - Optimistic recovery exit on Reload — re-enters via did-fail-load if reload fails - install-update calls autoUpdater.quitAndInstall() directly (force-kill fix) - Strict allowlist validation in handleRecoveryAction