test(startup): isolate properties bridge host (#37)

- Issue #37: Windows still overflowed when startup IPC ran from the WebView2 load callback.
- Release the renderer startup gate on the next event-loop task after load returns.
- Keep logger and console forwarding behind the same post-load boundary.

Fixes #37.

src-tauri/src/extension_server.rs

@@ -308,18 +308,16 @@ async fn download_handler(
         None => return Err(StatusCode::BAD_REQUEST),
     };
 
-    if let Some(window) = state.app_handle.get_webview_window("main") {
-        let is_visible = window.is_visible().unwrap_or(true);
-        if !is_visible {
-            let _ = window.show();
-            let _ = window.set_focus();
-            // Sleep briefly to let the webview wake up from macOS App Nap
-            // otherwise the IPC event emitted immediately after is dropped.
-            tokio::time::sleep(std::time::Duration::from_millis(300)).await;
-        } else {
-            let _ = window.show();
-            let _ = window.set_focus();
-        }
+    let is_hidden = state
+        .app_handle
+        .get_webview_window("main")
+        .and_then(|window| window.is_visible().ok())
+        .is_some_and(|is_visible| !is_visible);
+    crate::restore_main_window(&state.app_handle);
+    if is_hidden {
+        // Sleep briefly to let the webview wake up from macOS App Nap
+        // otherwise the IPC event emitted immediately after is dropped.
+        tokio::time::sleep(std::time::Duration::from_millis(300)).await;
     }
 
     if !wait_for_frontend(&state.frontend_ready).await {

src-tauri/src/lib.rs

@@ -3659,6 +3659,7 @@ pub struct AppState {
 #[derive(Default)]
 struct MainWindowRestoreState {
     requested: AtomicBool,
+    startup_complete: AtomicBool,
 }
 
 #[cfg(target_os = "macos")]
@@ -3954,7 +3955,26 @@ where
         .collect()
 }
 
-fn restore_main_window(app_handle: &tauri::AppHandle) {
+pub(crate) fn restore_main_window(app_handle: &tauri::AppHandle) {
+    let startup_complete = app_handle
+        .try_state::<MainWindowRestoreState>()
+        .is_none_or(|state| state.startup_complete.load(Ordering::Acquire));
+    if !startup_complete {
+        if let Some(state) = app_handle.try_state::<MainWindowRestoreState>() {
+            // The first window can be requested by a single-instance callback
+            // or an opened .torrent path while the native host is still being
+            // constructed. Do not touch the HWND until RunEvent::Ready.
+            state.requested.store(true, Ordering::Release);
+            // Ready may have won the transition between the first load and
+            // the request store. Re-check before returning so that request is
+            // serviced by this call instead of being left pending forever.
+            if !state.startup_complete.load(Ordering::Acquire) {
+                return;
+            }
+        } else {
+            return;
+        }
+    }
     let Some(window) = app_handle.get_webview_window("main") else {
         if let Some(state) = app_handle.try_state::<MainWindowRestoreState>() {
             state.requested.store(true, Ordering::Release);
@@ -3967,6 +3987,24 @@ fn restore_main_window(app_handle: &tauri::AppHandle) {
     let _ = window.set_focus();
 }
 
+fn mark_main_window_startup_complete(app_handle: &tauri::AppHandle) {
+    if let Some(state) = app_handle.try_state::<MainWindowRestoreState>() {
+        state.startup_complete.store(true, Ordering::Release);
+    }
+}
+
+#[cfg(target_os = "windows")]
+fn reveal_main_window(app_handle: &tauri::AppHandle) {
+    if let Some(window) = app_handle.get_webview_window("main") {
+        if let Err(error) = window.set_focusable(true) {
+            log::warn!("Could not make the main window focusable: {error}");
+        }
+        if let Err(error) = window.show() {
+            eprintln!("Failed to reveal the main window: {error}");
+        }
+    }
+}
+
 fn restore_pending_main_window(app_handle: &tauri::AppHandle) {
     if app_handle
         .try_state::<MainWindowRestoreState>()
@@ -18162,9 +18200,12 @@ fn toggle_log_pause(caller: tauri::WebviewWindow, pause: bool) -> Result<(), Str
 }
 
 #[tauri::command]
-fn is_log_paused(caller: tauri::WebviewWindow) -> bool {
-    properties_window::ensure_main_window(&caller).is_ok()
-        && LOG_PAUSED.load(std::sync::atomic::Ordering::Relaxed)
+fn is_log_paused() -> bool {
+    // This read is needed during renderer bootstrap, including by standalone
+    // Properties windows. Avoid extracting a WebviewWindow here: on Windows,
+    // WebView2 can invoke the command while its host is still initializing.
+    // Mutating logging commands remain restricted to the main window below.
+    LOG_PAUSED.load(std::sync::atomic::Ordering::Relaxed)
 }
 
 #[tauri::command]
@@ -18512,6 +18553,17 @@ pub fn run() {
             main_window_builder = main_window_builder
                 .inner_size(startup_size.width as f64, startup_size.height as f64)
                 .prevent_overflow();
+            #[cfg(target_os = "windows")]
+            {
+                // Wry installs its parent WM_SETFOCUS handler while WebView2
+                // is still being initialized. Keep the host hidden and
+                // non-activatable until RunEvent::Ready so Windows cannot
+                // re-enter that handler during native construction.
+                main_window_builder = main_window_builder
+                    .visible(false)
+                    .focused(false)
+                    .focusable(false);
+            }
             main_window_builder
                 .build()
                 .map_err(|error| format!("failed to create main window: {error}"))?;
@@ -19847,6 +19899,12 @@ pub fn run() {
         .build(tauri::generate_context!())
         .expect("error while building tauri application")
         .run(|app_handle, event| match event {
+            tauri::RunEvent::Ready => {
+                mark_main_window_startup_complete(app_handle);
+                #[cfg(target_os = "windows")]
+                reveal_main_window(app_handle);
+                restore_pending_main_window(app_handle);
+            }
             #[cfg(target_os = "macos")]
             tauri::RunEvent::Opened { urls } => {
                 let paths = collect_opened_torrent_paths(

src-tauri/src/properties_window.rs

@@ -439,6 +439,7 @@ pub fn open_download_properties_window(
         .visible(false)
         // A hidden WebView2 must not request focus during construction. The
         // native reveal path focuses it after the window is visible.
+        .focused(false)
         .transparent(true);
     #[cfg(any(target_os = "windows", target_os = "macos", target_os = "linux"))]
     let builder = builder.decorations(false);

src/App.tsx

@@ -20,7 +20,6 @@ import {
 } from "./store/useSettingsStore";
 import { isPermissionGranted, requestPermission, sendNotification } from '@tauri-apps/plugin-notification';
 import { WindowControls } from "./components/WindowControls";
-import { PropertiesWindowBridgeHost } from "./components/PropertiesWindowBridgeHost";
 import { useToast } from "./contexts/ToastContext";
 import { setLogStreamActive } from './utils/logger';
 import { updateDockBadge } from './utils/dockBadge';
@@ -1287,7 +1286,6 @@ function App() {
       
       {isAddModalOpen && <AddDownloadsModal />}
 
-      <PropertiesWindowBridgeHost />
       {isDeleteModalOpen && (
         <Suspense fallback={null}>
           <DeleteConfirmationModal />

src/main.tsx

@@ -16,7 +16,29 @@ import { invokeCommand as invoke } from './ipc';
 
 const isPropertiesWindow = getCurrentWindow().label.startsWith('properties-');
 
-void initLogger();
+// WebView2 can overflow its native call stack when the renderer sends IPC
+// during document bootstrapping. Keep all renderer-to-native startup work
+// behind the document load boundary, not just the first logger query. This is
+// also needed for Zustand persistence, whose module initialization reads the
+// native database before React mounts.
+const documentLoaded = new Promise<void>((resolve) => {
+  const releaseAfterNativeLoad = () => {
+    // The load event is dispatched from WebView2's navigation callback. Move
+    // renderer startup to the next task so its first IPC cannot re-enter that
+    // native callback stack.
+    window.setTimeout(resolve, 0);
+  };
+
+  if (document.readyState === 'complete') {
+    releaseAfterNativeLoad();
+    return;
+  }
+  window.addEventListener('load', releaseAfterNativeLoad, { once: true });
+});
+
+void documentLoaded.then(() => {
+  void initLogger();
+});
 
 const serializeConsoleArguments = (values: unknown[]) => values.map(value => {
   if (value instanceof Error) return `${value.name}: ${value.message}\n${value.stack || ''}`;
@@ -36,11 +58,13 @@ const originalConsoleError = console.error.bind(console);
 const originalConsoleWarn = console.warn.bind(console);
 console.error = (...values: unknown[]) => {
   originalConsoleError(...values);
-  void logError(redactConsoleMessage(serializeConsoleArguments(values))).catch(() => undefined);
+  const message = redactConsoleMessage(serializeConsoleArguments(values));
+  void documentLoaded.then(() => logError(message)).catch(() => undefined);
 };
 console.warn = (...values: unknown[]) => {
   originalConsoleWarn(...values);
-  void logWarn(redactConsoleMessage(serializeConsoleArguments(values))).catch(() => undefined);
+  const message = redactConsoleMessage(serializeConsoleArguments(values));
+  void documentLoaded.then(() => logWarn(message)).catch(() => undefined);
 };
 
 const rootElement = document.getElementById("root");
@@ -75,20 +99,46 @@ const PropertiesStartupFailure = () => (
   </main>
 );
 
+const MainStartupFailure = () => (
+  <main className="flex h-screen min-h-0 flex-col items-center justify-center gap-4 bg-main-bg p-6 text-text-primary">
+    <p role="alert">Firelink could not be loaded.</p>
+    <button
+      type="button"
+      className="app-button app-button-primary px-3 text-xs"
+      onClick={() => {
+        void getCurrentWindow().close().catch(error => {
+          console.error('[MainStartupFailure] close failed', error);
+        });
+      }}
+    >
+      Close
+    </button>
+  </main>
+);
+
 const renderMainApp = async () => {
   if (!rootElement) return;
 
-  // Keep the child entrypoint isolated from the main application module. App
-  // imports the persistent Zustand stores, whose module initialization issues
-  // main-window-only IPC commands. Loading it in a Properties child creates a
-  // second persistence owner and can race the bridge handshake.
-  const RootComponent = (await import('./App')).default;
-  renderRoot(RootComponent);
+  await documentLoaded;
+
+  try {
+    // Keep the child entrypoint isolated from the main application module. App
+    // imports the persistent Zustand stores, whose module initialization issues
+    // main-window-only IPC commands. Loading it in a Properties child creates a
+    // second persistence owner and can race the bridge handshake.
+    const RootComponent = (await import('./App')).default;
+    renderRoot(RootComponent);
+  } catch (error) {
+    console.error('Failed to initialize Firelink:', error);
+    renderRoot(MainStartupFailure);
+  }
 };
 
 const renderPropertiesApp = async () => {
   if (!rootElement) return;
 
+  await documentLoaded;
+
   try {
     // Properties starts with the synchronous English catalog and changes locale
     // after its first paint. Waiting for a lazy locale chunk here delays the