fix Windows failed-start appearance rollback

Author: Fei-Away

windows/README.en.md

@@ -201,6 +201,8 @@ Starting with Codex Store `26.715.10079.0`, the owl runtime may convert package-
 
 Field results in issue #235 now confirm two independent failures: WindowsApps returns `access-denied` for direct launch on `26.715.10079.0`, while `26.721.3404.0` retains the raw CDP arguments but its production runtime still opens no listener. Either result means that Codex/Windows combination cannot enable the skin within the project's safety boundary. The fallback is currently a safe diagnostic and rollback path, not a compatibility guarantee for affected owl builds. Do not take ownership of WindowsApps or patch the official package; keep the complete error and follow issue #235 for upstream compatibility status.
 
+If debug launch or visible renderer verification fails, the launcher first confirms that every Codex process started by this attempt is closed, then restores only this attempt's appearance-key values that are still unchanged. Newer config edits are preserved instead of replacing the whole file from an old backup. If Codex cannot be confirmed closed, recovery stops and preserves the current config rather than racing the running app. This rollback covers caught script failures only; it is not evidence that an affected official Codex build has restored CDP support.
+
 ### The skin stops working after a Codex update
 
 Run the installer and launch shortcut again. The scripts rediscover the currently registered Store package instead of trusting an executable path from an older app version.

windows/README.md

@@ -178,6 +178,8 @@ Codex Store `26.715.10079.0` 起，owl runtime 可能把应用包激活参数转
 
 Issue #235 的实机结果已经确认两种独立失败：`26.715.10079.0` 的 WindowsApps ACL 会返回 `access-denied`；`26.721.3404.0` 可保留原始 CDP 参数，但 production runtime 仍不监听端口。两种结果都意味着当前 Codex/Windows 组合无法在项目安全边界内启用皮肤；该回退目前是安全诊断与回滚机制，不是对受影响 owl 版本的兼容性保证。不要接管 WindowsApps 所有权或修改官方包；请保留完整错误并关注 Issue #235 的上游兼容状态。
 
+如果调试启动或可见渲染验证失败，启动器会先确认本轮启动的 Codex 已全部关闭，再只恢复本次改动且仍保持原值的外观键；较新的配置编辑会保留，不会被整份旧备份覆盖。若无法确认 Codex 已关闭，恢复会停止并保留当前配置，避免与仍在运行的应用竞争写入。此回滚只覆盖脚本捕获的失败，不代表受影响的官方 Codex 版本已经恢复 CDP 支持。
+
 ### Codex 更新后皮肤失效
 
 重新运行安装器和启动快捷方式。脚本会重新发现当前注册的 Store 包，不依赖旧版本的可执行文件路径。

windows/references/runtime-notes.md

@@ -11,7 +11,7 @@
 - Restore does not require Node to remain installed: it preflights config backups, closes Codex to clear live DOM and CDP, stops only the verified recorded injector, applies requested config changes, then reopens the official app without debug flags.
 - A live recorded injector whose PID no longer matches the saved Node path, injector command line, port, Browser ID, or start time causes start/restore to abort with state preserved; it is never silently archived and replaced.
 - The managed theme root rejects junctions and symbolic links before initialization, import, save, switch, pause, or state writes. Windows uses the bundled Node image-metadata helper to enforce the same 10 MB, 16384px, and 50MP limits before an import is copied.
-- `config.toml` is read from raw bytes as strict UTF-8, written without BOM through same-directory atomic replacement, and backed up byte-for-byte. Install requires Codex to be closed; writes stage the temporary file first, then abort if the destination bytes changed immediately before replacement. Quoted keys and table-header comments are supported; escaped target keys, multiline strings/arrays, dotted target keys, or duplicate target keys fail before writing. Completed restore backups are retained as `config.restored-*.toml` so reinstall captures a fresh baseline.
+- `config.toml` is read from raw bytes as strict UTF-8, written without BOM through same-directory atomic replacement, and backed up byte-for-byte. Install requires Codex to be closed; writes stage the temporary file first, then abort if the destination bytes changed immediately before replacement. Quoted keys and table-header comments are supported; escaped target keys, multiline strings/arrays, dotted target keys, or duplicate target keys fail before writing. A caught startup failure restores each managed appearance key only when its current exact line still equals the value written by that attempt, preserves unrelated/current edits, and restores ownership metadata after the config commit. Recovery is blocked when the attempt's Codex processes cannot be confirmed closed. Completed restore backups are retained as `config.restored-*.toml` so reinstall captures a fresh baseline.
 - A per-user named mutex prevents concurrent install, start, restore, and verify operations from racing state, ports, or config writes.
 - The installer compares every staged runtime file with its selected source by SHA-256, then clears Internet-zone markers only from staged managed `.ps1` copies. Installed shortcuts and tray child processes use process-scoped `RemoteSigned`; Machine/User Policy remains authoritative and no persistent execution policy is changed.
 - Store updates are supported because the launcher queries `Get-AppxPackage OpenAI.Codex` on every launch. State paths are eligible for automatic cleanup only after their Appx full name, family name, install root, and executable are matched against a currently registered package; an active unverified old path requires manual closure.

windows/scripts/apply-community-theme.ps1

@@ -315,6 +315,36 @@ function Set-DreamSkinActiveThemeFromSnapshot {
   return $activeFingerprint
 }
 
+function Get-DreamSkinCommunityStartFailureMessage {
+  param(
+    [Parameter(Mandatory = $true)][string]$Category,
+    [Parameter(Mandatory = $true)][string]$AppearanceRecovery
+  )
+  $messageKey = switch ($Category) {
+    'cdp-launch-failed' { 'CommunityStartCdpLaunchFailed' }
+    'cdp-direct-access-denied' { 'CommunityStartCdpDirectAccessDenied' }
+    'cdp-endpoint-unavailable' { 'CommunityStartCdpEndpointUnavailable' }
+    'port-unavailable' { 'CommunityStartPortUnavailable' }
+    'state-reconciliation-failed' { 'CommunityStartStateReconciliationFailed' }
+    'injector-start-failed' { 'CommunityStartInjectorFailed' }
+    'renderer-verification-failed' { 'CommunityStartRendererVerificationFailed' }
+    'superseded' { 'CommunityStartSuperseded' }
+    default { 'CommunityStartInternalFailure' }
+  }
+  $message = Get-DreamSkinCommunityText -Key $messageKey
+  $recoveryKey = switch ($AppearanceRecovery) {
+    'restored' { 'CommunityStartAppearanceRestored' }
+    'conflict-preserved' { 'CommunityStartAppearanceConflictPreserved' }
+    'blocked' { 'CommunityStartAppearanceBlocked' }
+    'preserved-rendered' { 'CommunityStartAppearancePreservedRendered' }
+    default { $null }
+  }
+  if ($recoveryKey) {
+    $message += ' ' + (Get-DreamSkinCommunityText -Key $recoveryKey)
+  }
+  return $message
+}
+
 function Invoke-DreamSkinCommunityStartAndVerify {
   param(
     [ValidateRange(1000, 300000)]
@@ -325,20 +355,47 @@ function Invoke-DreamSkinCommunityStartAndVerify {
   if (-not (Test-Path -LiteralPath $startScript -PathType Leaf)) {
     throw 'The managed Dream Skin start script is missing.'
   }
+  $stateRoot = Join-Path $env:LOCALAPPDATA 'CodexDreamSkin'
+  $resultToken = [guid]::NewGuid().ToString('N')
+  $resultPath = Get-DreamSkinStartResultPath -StateRoot $stateRoot -Token $resultToken
+  if (Test-Path -LiteralPath $resultPath) {
+    throw (Get-DreamSkinCommunityText -Key 'CommunityStartInvalidResult')
+  }
   $powershell = (Get-Command powershell.exe -ErrorAction Stop).Source
   $argumentLine = '-NoProfile -STA -WindowStyle Hidden -ExecutionPolicy RemoteSigned -File ' +
     (ConvertTo-DreamSkinProcessArgument -Value $startScript) + ' -RestartExisting' +
     ' -RequireUnpaused -OperationLockTimeoutMilliseconds ' +
-    "$OperationLockTimeoutMilliseconds"
-  $startProcess = Start-Process -FilePath $powershell -ArgumentList $argumentLine `
-    -WindowStyle Hidden -PassThru
-  if (-not $startProcess.WaitForExit($OperationLockTimeoutMilliseconds)) {
-    try { Stop-Process -InputObject $startProcess -Force -ErrorAction SilentlyContinue } catch {}
-    [void]$startProcess.WaitForExit(15000)
-    throw "Dream Skin start verification did not finish within $OperationLockTimeoutMilliseconds ms."
-  }
-  if ($startProcess.ExitCode -ne 0) {
-    throw "Dream Skin could not start and visibly verify the active theme (exit code $($startProcess.ExitCode))."
+    "$OperationLockTimeoutMilliseconds" + ' -ResultToken ' + $resultToken
+  try {
+    $startProcess = Start-Process -FilePath $powershell -ArgumentList $argumentLine `
+      -WindowStyle Hidden -PassThru
+    if (-not $startProcess.WaitForExit($OperationLockTimeoutMilliseconds)) {
+      try { Stop-Process -InputObject $startProcess -Force -ErrorAction SilentlyContinue } catch {}
+      [void]$startProcess.WaitForExit(15000)
+      throw (Get-DreamSkinCommunityText -Key 'CommunityStartTimedOut')
+    }
+    try {
+      $result = Read-DreamSkinStartResult -StateRoot $stateRoot -Token $resultToken
+    } catch {
+      throw (Get-DreamSkinCommunityText -Key 'CommunityStartInvalidResult')
+    }
+    $coherentSuccess = $startProcess.ExitCode -eq 0 -and "$($result.outcome)" -ceq 'success'
+    $coherentFailure = $startProcess.ExitCode -ne 0 -and "$($result.outcome)" -ceq 'failure'
+    if (-not ($coherentSuccess -or $coherentFailure)) {
+      throw (Get-DreamSkinCommunityText -Key 'CommunityStartInvalidResult')
+    }
+    if ($coherentFailure) {
+      $message = Get-DreamSkinCommunityStartFailureMessage `
+        -Category "$($result.category)" -AppearanceRecovery "$($result.appearanceRecovery)"
+      $exception = [System.InvalidOperationException]::new($message)
+      $exception.Data['DreamSkinStartCategory'] = "$($result.category)"
+      $exception.Data['DreamSkinAppearanceRecovery'] = "$($result.appearanceRecovery)"
+      throw $exception
+    }
+  } finally {
+    if (Test-Path -LiteralPath $resultPath) {
+      Remove-Item -LiteralPath $resultPath -Force -ErrorAction SilentlyContinue
+    }
   }
 }
 
@@ -667,7 +724,8 @@ function Invoke-DreamSkinCommunityThemeTransaction {
         -Recovery 'Superseded' -InnerException $startFailure.Exception)
     }
     throw (New-DreamSkinCommunityApplyException `
-      -Message 'The imported theme failed visible verification. The previous theme was reapplied and visibly verified.' `
+      -Message ("The imported theme failed visible verification: $($startFailure.Exception.Message) " +
+        'The previous theme was reapplied and visibly verified.') `
       -Recovery 'Verified' -InnerException $startFailure.Exception)
   }