From db043ff445c9e7019ce630efcf171bfee3a361e7 Mon Sep 17 00:00:00 2001
From: ethernet <arilotter@gmail.com>
Date: Mon, 21 Sep 2026 18:50:17 -0400
Subject: [PATCH] fix(desktop): hold boot progress behind a latched remote
 reauth rejection again
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

shouldHoldBootProgressForReauth (8d22781b1c91, #95701) survived the rewrite
with no caller, so updateBootProgress let a running:true phase or a sibling
attempt's cleared error from an in-flight boot lift the recovery overlay and
re-arm the renderer's retry loop — the Sign in button flicker the helper
exists to stop. Gate updateBootProgress on it; re-emits of the latched
failure still pass so the non-retryable verdict is never lost.
---
 apps/desktop/electron/main.ts | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/apps/desktop/electron/main.ts b/apps/desktop/electron/main.ts
index 292a641b50..573194e572 100644
--- a/apps/desktop/electron/main.ts
+++ b/apps/desktop/electron/main.ts
@@ -75,6 +75,7 @@ import {
   isHostKeyChangedBootFailure,
   isRetryableRemoteBootFailure,
   shouldLatchBackendStartFailure,
+  shouldHoldBootProgressForReauth,
   shouldLatchHostKeyChangedFailure,
   shouldLatchRemoteReauthFailure
 } from './backend-start-failure'
@@ -2237,7 +2238,28 @@ function abandonFirstRunSetupChoiceForRemoteApply() {
   return resumedGatedConnection
 }
 
+// The latched reauth failure whose hold has already been logged, so a burst of
+// dropped updates from one in-flight sibling attempt logs once, not per event.
+let bootProgressHeldFor: Error | null = null
+
 function updateBootProgress(update, options: { allowDecrease?: boolean } = {}) {
+  // A latched CONFIRMED reauth rejection owns the boot surface until a
+  // recovery path clears it. Updates that are not a re-emit of that failure —
+  // a running:true phase or cleared error from an attempt already in flight
+  // when the latch closed, or an unrelated sibling failure that would flip
+  // retryable back on — must not reach the renderer, or the overlay's Sign in
+  // button flickers away again (#95701).
+  if (shouldHoldBootProgressForReauth(remoteReauthFailure ? remoteReauthFailure.message : null, update)) {
+    if (bootProgressHeldFor !== remoteReauthFailure) {
+      bootProgressHeldFor = remoteReauthFailure
+      rememberLog('[boot] remote reauth latched: holding the recovery overlay against a stale boot-progress update')
+    }
+
+    return
+  }
+
+  bootProgressHeldFor = null
+
   const nextProgressRaw =
     typeof update.progress === 'number' ? clampBootProgress(update.progress) : bootProgressState.progress