refactor(auto-updater): Introduce state machine and guard staged updates

[charlesvien]

Problem

The auto-updater juggled several boolean flags (updateReady, checkingForUpdates, etc.) to track lifecycle, which produced ambiguous states, let periodic checks re-run after an update was already staged and let installUpdate re-enter mid-install. Shutdown during install could also hang forever.

Closes #2169 #2377

Changes

1. Replace flag soup with an explicit idle | checking | downloading | ready | installing | error state machine and structured transition logging
2. Skip periodic checks once an update is staged; only surface the existing prompt on user-initiated checks
3. Make installUpdate idempotent and bound the pre-install cleanup with a 3s withTimeout so a stuck shutdown still proceeds to quitAndInstall
4. Track lastError and derive getStatus() from state, instead of recomputing payloads at every callsite
5. Promote UpdatesStatusPayload to a Zod-inferred type (updatesStatusOutput) per the R6 schema rule
6. Add unit coverage for staged-update guards, idempotent install, shutdown timeout, and the new tRPC status output

How did you test this?

manually

Automatic notifications

• Publish to changelog?
• Alert Sales and Marketing teams?

[charlesvien]

• feat: update defautls #2431
• feat: add enthropic packages to exlude list #2430
• feat: Upgrade Claude adapter to SDK 0.3 with native binary #2385
• fix: Gate unsupported-slash-command on SDK command list #2425
• refactor(auto-title): Untangle auto-title generator #2428
• refactor(auto-updater): Introduce state machine and guard staged updates #2427 👈 (View in Graphite)
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[greptile-apps]

T-Rex Logs

What T-Rex did

• T-Rex ran the requested verification.
• T-Rex did not upload local artifact references as part of the verification run.

_{Ran code and verified through T-Rex}

Prompt To Fix All With AI

Fix the following 3 code review issues. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 3
apps/code/src/main/services/updates/service.ts:227-233
**Reset update quit flag** When `quitAndInstall()` throws, this catch block moves the update state back to `ready` but leaves `AppLifecycleService.isQuittingForUpdate` set from the earlier `setQuittingForUpdate()` call. The next normal app quit then returns early from the `before-quit` handler and skips `gracefulExit()`, so database close, watcher teardown, and analytics/log flushing can be bypassed for the rest of the session. Please clear that lifecycle flag on this failure path, or only set it once the install handoff can no longer fail back into a normal session.

### Issue 2 of 3
apps/code/src/main/services/updates/service.ts:123-128
**Preserve installing status** `isUpdateStaged()` is true for both `ready` and `installing`, so `getStatus()` reports an in-progress install as `updateReady: true`. A renderer reload during the 3s shutdown window then hydrates the store back to `ready`, and `UpdateBanner` shows the clickable Restart button instead of the Restarting state. The status payload needs to distinguish `installing` so the renderer can keep the install UI and avoid sending another no-op install request.

### Issue 3 of 3
apps/code/src/main/services/updates/service.ts:351-367
**Stop staged polling** After an update is downloaded, the hourly interval created in `setupAutoUpdater()` stays active even though every periodic check now short-circuits forever. That leaves the process waking up and writing skipped-check transition logs every hour until restart. Clear `checkIntervalId` when the update reaches `ready`, since no later periodic check can do useful work once the staged update guard is active.

_{Reviews (1): Last reviewed commit: "Bound update install cleanup" | Re-trigger Greptile}

[k11kirky]

Merge activity

• May 29, 10:26 AM UTC: A user started a stack merge that includes this pull request via Graphite.
• May 29, 10:26 AM UTC: @k11kirky merged this pull request with Graphite.