feat(audit): Batch 15 live-verify — download-engine lifecycle (R4, L65, L139, B2, B6, L143)

The watched live session for the six deferred lifecycle items, each verified
against real yt-dlp/Electron behavior on Windows:

- R4: cancel now deletes the download's orphaned partials. The engine captures
  the final output path via a new `--print before_dl:dest|%(filename)s`
  (empirically %(filepath)s is still 'NA' that early) and the close handler
  sweeps only unambiguous intermediates (.part / .part-Frag* / .ytdl /
  <stem>.fNNN.<ext>) via the pure, unit-tested lib/partials.ts — never a bare
  <stem>.<ext> or another download's files. Live-verified with decoys.
- L65: verified-acceptable, no code change — a taskkill /F pause leaves the
  .part byte-intact and yt-dlp --continue resumes at the exact byte offset.
- L139: spawn↔self-update interlock (new ytdlpLock.ts). The updater refuses
  while any yt-dlp spawn is live; download/terminal IPC handlers hold (await)
  behind an in-progress exe rewrite instead of failing.
- B2: source indexing is cancellable — AbortSignal through the probe walk
  (kills the in-flight child, live-verified via tasklist), sources:index-cancel
  IPC, and a Cancel button in the Library add-source row.
- B6: app-update download is cancellable — app:update-cancel routes through
  the existing finish() teardown (abort + destroy + unlink, live-verified on
  Electron net.request); Cancel button under the update progress bar. The
  checksum phase is cancelable too.
- L143: closing the window mid-download (non-tray mode) now offers a native
  tray-independent "Quit anyway / Keep downloading" dialog, replacing the
  passive "use the tray to quit" notification.

Peer-review pass caught and fixed: a non-reentrant update lock (concurrent
begin clobbered the settle promise), a dead Cancel window during the B6
checksum fetch + a canceller slot-ownership bug (L140 shape), and a
persist-after-cancel hole in the index walk.

typecheck + 304 tests + eslint + production build green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/main/ipc.ts

@@ -27,9 +27,10 @@ import {
 import { PAGE_BACKGROUND } from '@shared/theme'
 import { getYtdlpVersion, updateYtdlp } from './ytdlp'
 import { getFfmpegVersions } from './ffmpeg'
-import { checkForAppUpdate, downloadAppUpdate, runAppUpdate } from './updater'
+import { checkForAppUpdate, downloadAppUpdate, runAppUpdate, cancelAppUpdate } from './updater'
 import { probeMedia } from './probe'
 import { startDownload, cancelDownload, pauseDownload, previewCommand } from './download'
+import { whenYtdlpUpdateSettled } from './ytdlpLock'
 import { runTerminal, cancelTerminal } from './terminal'
 import { getSettings, setSettings } from './settings'
 import { listHistory, addHistory, removeHistory, removeManyHistory, clearHistory } from './history'
@@ -47,7 +48,7 @@ import {
   setMediaItemDownloaded,
   setSourceWatched
 } from './sources'
-import { indexSource } from './indexer'
+import { indexSourceCancelable, cancelIndexing } from './indexer'
 import { syncWatchedSources } from './sync'
 import { getScheduledSync, setScheduledSync } from './schedule'
 import { getActiveBadge, getErrorBadge } from './badge'
@@ -102,6 +103,7 @@ export function registerIpcHandlers(getMainWindow: () => BrowserWindow | null):
   ipcMain.handle(IpcChannels.appUpdateDownload, (e, url: string) =>
     downloadAppUpdate(url, e.sender)
   )
+  ipcMain.handle(IpcChannels.appUpdateCancel, () => cancelAppUpdate())
   ipcMain.handle(IpcChannels.appUpdateRun, (_e, filePath: string) => runAppUpdate(filePath))
 
   ipcMain.handle(IpcChannels.ytdlpVersion, () => getYtdlpVersion())
@@ -110,7 +112,11 @@ export function registerIpcHandlers(getMainWindow: () => BrowserWindow | null):
 
   ipcMain.handle(IpcChannels.probe, (_e, url: string) => probeMedia(url))
 
-  ipcMain.handle(IpcChannels.downloadStart, (e, opts: StartDownloadOptions) => {
+  ipcMain.handle(IpcChannels.downloadStart, async (e, opts: StartDownloadOptions) => {
+    // L139: hold the spawn until any in-progress yt-dlp self-update has finished
+    // swapping the exe, so a launch-time (auto-resumed) download waits it out instead
+    // of racing the rewrite. Resolves immediately when no update is running.
+    await whenYtdlpUpdateSettled()
     const result = startDownload(e.sender, opts)
     // Pre-spawn failures (missing yt-dlp.exe, bad URL, duplicate id) never reach
     // download.ts's own close/error handlers, so log them here instead — unless the
@@ -128,9 +134,10 @@ export function registerIpcHandlers(getMainWindow: () => BrowserWindow | null):
   })
   ipcMain.handle(IpcChannels.downloadCancel, (_e, id: string) => cancelDownload(id))
   ipcMain.handle(IpcChannels.downloadPause, (_e, id: string) => pauseDownload(id))
-  ipcMain.handle(IpcChannels.terminalRun, (e, id: string, args: string) =>
-    runTerminal(e.sender, id, args)
-  )
+  ipcMain.handle(IpcChannels.terminalRun, async (e, id: string, args: string) => {
+    await whenYtdlpUpdateSettled() // L139: hold behind an in-progress exe rewrite
+    return runTerminal(e.sender, id, args)
+  })
   ipcMain.handle(IpcChannels.terminalCancel, (_e, id: string) => cancelTerminal(id))
 
   ipcMain.handle(IpcChannels.chooseFolder, async (e, current?: string) => {
@@ -241,17 +248,19 @@ export function registerIpcHandlers(getMainWindow: () => BrowserWindow | null):
   // Indexing pushes live progress to the requesting renderer over `indexProgress`
   // and resolves with the final result.
   ipcMain.handle(IpcChannels.sourceIndex, (e, url: string) =>
-    indexSource(url, (p) => {
+    indexSourceCancelable(url, (p) => {
       if (!e.sender.isDestroyed()) e.sender.send(IpcChannels.indexProgress, p)
     })
   )
   ipcMain.handle(IpcChannels.sourceReindex, (e, id: string) => {
     const src = getSource(id)
     if (!src) return { ok: false, error: 'Source not found.' }
-    return indexSource(src.url, (p) => {
+    return indexSourceCancelable(src.url, (p) => {
       if (!e.sender.isDestroyed()) e.sender.send(IpcChannels.indexProgress, p)
     })
   })
+  // Abort the in-flight index/reindex walk (kills the current probe child). (B2)
+  ipcMain.handle(IpcChannels.sourceIndexCancel, () => cancelIndexing())
   ipcMain.handle(IpcChannels.sourceSetWatched, (_e, id: string, watched: boolean) =>
     setSourceWatched(id, watched)
   )