[m-enes-senovali]

Cancelling an update as its download finished could leave a batch installer waiting for the still-running WinZapp indefinitely. The progress modal returned CANCEL, so the caller ignored the launched installer; the next attempt then saw the live install claim and misleadingly reported another open account.

This change serializes cancellation with a UI-granted installer handoff. An early modal return retains the dialog, package and claim until the worker settles, and a confirmed installer launch requires real_exit() regardless of the modal return code. Failed or cancelled prelaunch attempts release only their own token; a live same-process claim is never blindly stolen.

• Route Cancel, Escape and close through the same decision, start the retained worker inside the modal loop, and prevent reentrant install/check/prompt paths while completion is pending.
• Bound the primary parent wait at 300 checks. Timeout exits before copying, killing Node or relaunching; the elevated waiter honors an abort marker and checks the original parent before relaunching.
• Preserve a successful spawn through waiter, PID metadata and handle-close errors. Preserve actual prelaunch script-write errors instead of reporting them as UAC denial.
• Return coordination refusal reasons from the same locked decision while keeping the existing dict/None API compatible.
• Add regression coverage, both new messages and changelog entries in all seven locales, and document the updater lifecycle trap.

Validation:

• 218 distinct focused headless updater tests passed using the latest result for each changed test file. The recorded runs overlap: 197 passed/7 deselected, 26 passed after metadata handling, 66 passed/2 real CMD cases deselected after review feedback, then 17 prompt-coordination tests passed. Overlapping counts are not added together.
• 66 translation tests and 1,556 desktop-safety structural checks passed; translation compile/check passed for seven locales with zero pending entries.
• The repository's winzapp-reviewer source review found one diagnostic-message issue, resolved in the second commit; final-head review found no outstanding findings. This is a local source review, not a GitHub APPROVED review or native acceptance.

The initial CI at cc149371 completed with one failed legacy source-text guard, 19,362 passed and 320 skipped. Completion had moved out of _do_install, so the guard's string lookup failed. The follow-up test-only commit replaces it with three behavioral cases that verify a second synthetic account can claim the prompt after cancellation, dev-mode completion or declining a retry.

Final-head CI at e1ebd1515fba95dca3e77043116c59834035b00b is green: run 38310912209 completed with 19,365 passed / 320 skipped (606.26s). Both the Windows suite and venv + pip install check runs report this exact head SHA and SUCCESS; the pip environment's focused dependency/build checks also passed (28 tests). The reviewer read the test-only follow-up and found no outstanding findings. The PR was marked ready for review following the author's request, then merged by maintainer gabrielhhaber at 2026-10-12 21:43:50 UTC (merge commit d7b64b2232a32f7cd8b21fee2276a69b9ab3e4bf). CI is not current-main or packaged/native user acceptance.

No local full suite, wx GUI/WinEvent, real installer/UAC/CMD, provider, phone or packaged NVDA acceptance was run. Four process-identity probes were excluded and one unrelated hard-link test was blocked by the local sandbox. GitHub CI remains separate evidence. No installed-app/session/data/log/key access or recovery of an older already-running installer was performed; this fix applies to installers generated by a build containing the change.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[gustavo-barrios2006]

Thank you very much, Muhammet.

It is indeed a bug that we hadn't noticed yet. Great contribution to making the program more robust.