fix(nxm): sanitize + bound the xdg-mime runner, decouple UI probes into shared state (#201)

Fixed the UI freezes when switching between destinations, worst when
launched through Steam.

- The Linux registrar's `xdg-mime` calls now strip only `LD_PRELOAD`
from the
child environment (the Steam overlay preload made the query ~2.3 s
instead
of ~0.1 s). The wait stays plain and synchronous: a wedged desktop
helper
  hangs the probe rather than being masked.
- Registration probing is decoupled from the UI lifecycle: a shared
  `INxmRegistrationState` probes only at startup, on entering Nexus, and
after each register/release. Mod-list reloads and navigation-leave paths
no
longer probe; the shell strip, Mods hint, and DMF prompt read last-known
  state.
- `Unregister` self-guards ownership inside both platform registrars, so
callers no longer pre-check and another manager's registration can never
be
  removed.

Build + tests green (1866 passed); verified on hardware in normal and
Steam
launches.

Author: ModifAmorphic

AGENTS.md

@@ -141,12 +141,14 @@ src/        Modificus Curator -- the mod manager app (.NET 10 + Avalonia 12)
                           the current destination's leave effects first (leaving
                           Profiles awaits the unsaved-changes three-choice
                           guard, Cancel/Save-failure keeps the destination
-                          unchanged; leaving Nexus
-                          calls `IntegrationsViewModel.Deactivate` which cancels
-                          the in-flight auth + the shell re-reads nxm status +
-                          reloads the mod list; leaving Settings reloads the mod
-                          list + re-reads the startup-check toggle + refreshes the
-                          app-update notice), then switches the destination, then
+                           unchanged; leaving Nexus
+                           calls `IntegrationsViewModel.Deactivate` which cancels
+                           the in-flight auth + the shell reloads the mod list
+                           (no nxm probe on leave; the registration state
+                           refreshes at Nexus ENTER, its deliberate probe
+                           point); leaving Settings reloads the mod
+                           list + re-reads the startup-check toggle + refreshes the
+                           app-update notice), then switches the destination, then
                           runs the target's enter effects (Settings calls
                           `SettingsViewModel.RefreshFromConfig` synchronously;
                           Nexus awaits `IntegrationsViewModel.RefreshAsync`
@@ -166,7 +168,9 @@ src/        Modificus Curator -- the mod manager app (.NET 10 + Avalonia 12)
                           (bounded detector handoff, no process handle; the
                           state clears in all completion/exception paths)), and
                           the global status strip (running + pending + nxm-handler
-                          + app-update notice). The hosted page VMs are
+                          + app-update notice; the nxm indicator mirrors the
+                          shared `INxmRegistrationState`, seeded by its one
+                          startup probe + updated on each publish). The hosted page VMs are
                           application-lifetime singletons; navigation never calls an
                           old Window-close Detach path. The active profile is owned
                           by `IProfileSession`; launch availability derives directly
@@ -396,11 +400,16 @@ src/        Modificus Curator -- the mod manager app (.NET 10 + Avalonia 12)
                           usable while Darktide runs (only launch + active-profile
                           changes are blocked); the destination also owns the
                           explicit `nxm://` handler registration (a "Nexus download
-                          links" section over `INxmHandlerRegistrar`: register
-                          confirms first since it is a system-wide change that can
-                          affect other mod managers; unregister only releases
-                          Curator's own registration); entering the destination
-                          refreshes auth state, leaving cancels in-flight auth via
+                          links" section over `INxmHandlerRegistrar` for the
+                          mutations + the shared `INxmRegistrationState` for the
+                          status: register confirms first since it is a system-wide
+                          change that can affect other mod managers; unregister
+                          delegates straight to the self-guarded registrar, which
+                          releases only Curator's own registration; after either
+                          action one refresh publishes the state to every
+                          consumer); entering the destination
+                          refreshes auth state (one registration probe per
+                          enter), leaving cancels in-flight auth via
                           `Deactivate`;
                           the Preferences destination (`PreferencesViewModel` +
                           `PreferencesView`): theme + font scale + language + the
@@ -455,6 +464,22 @@ src/        Modificus Curator -- the mod manager app (.NET 10 + Avalonia 12)
                           coordinating IDialogService + IProfileSession + Dispatcher.UIThread) that
                           replaces the no-op default via DI last-registration-wins, registered after
                           AddNxm() in CuratorComposition;
+                          the shared `INxmRegistrationState` (ui/Session/, an
+                          application-lifetime singleton): the last-known OS
+                          `nxm://` registration for every UI surface (shell
+                          status strip, Mods empty-state hint, Nexus page, DMF
+                          prompt wording). `RefreshFromOs` is its only writer
+                          + the UI's only probe: one seed at shell
+                          construction, one per Nexus enter, one after each
+                          register/release action; each publishes `Changed`
+                          (marshaled to the UI thread) so every surface
+                          updates together. All other consumers read
+                          last-known + accept staleness (the OS association is
+                          racy by nature); `ModListViewModel.Reload()` and all
+                          navigation-leave effects perform zero probes;
+                          `DmfPromptService` reads the state + never probes;
+                          only `IntegrationsViewModel` still injects the
+                          registrar (for the register/release mutations);
                           `UpdateCheckRunner` (ui/Session/) the
                           UI-layer glue that fires `IUpdateCheckService.CheckAsync`
                           fire-and-forget on the three automatic triggers
@@ -636,9 +661,11 @@ src/        Modificus Curator -- the mod manager app (.NET 10 + Avalonia 12)
                           profile that becomes active (no persisted flag: a
                           fresh ask per profile). Two cases: DMF in the repo
                           but not the profile -> instant add (case 1); DMF not
-                          in the repo -> a download confirm (the message
-                          tailors to whether Curator owns the `nxm://` handler:
-                          manager-download vs. manual-import guidance); on
+                           in the repo -> a download confirm (the message
+                           tailors to whether Curator owns the `nxm://` handler,
+                           read from the shared `INxmRegistrationState` with no
+                           probe:
+                           manager-download vs. manual-import guidance); on
                           confirm, premium users get the in-app API download
                           under a spinner + add, while everyone else (no auth,
                           regular, or unknown premium state) gets the DMF Nexus
@@ -796,12 +823,11 @@ src/        Modificus Curator -- the mod manager app (.NET 10 + Avalonia 12)
                         (INexusClient over the v1 REST endpoints with per-request
                         auth via INexusAuthMessageFactory selector -- ApiKey /
                         OAuth / None factories, the latter doing 401-reactive
-                        refresh; NexusAuthService the OAuth loopback + API-key
-                        validate + sign-out orchestrator (raises
-                        AuthStateChanged on every persisted method change so
-                        the shell's Integrations flow refreshes the nxm handler
-                        status after the dialog closes; the DMF prompt is
-                        profile-creation-only and does not subscribe); NexusOAuthTokenStore
+                         refresh; NexusAuthService the OAuth loopback + API-key
+                         validate + sign-out orchestrator (raises
+                         AuthStateChanged on every persisted method change; the
+                         DMF prompt is
+                         profile-creation-only and does not subscribe); NexusOAuthTokenStore
                         owns the OidcClient + token persistence; LoopbackBrowser
                         the IBrowser impl with an HttpListener on an ephemeral
                         port; Duende.IdentityModel.OidcClient 7.1.0 for the
@@ -958,12 +984,21 @@ src/        Modificus Curator -- the mod manager app (.NET 10 + Avalonia 12)
                         default (the real handler is registered via AddSingleton
                         last-wins, in CuratorComposition after AddNxm()), the OS
                         scheme-handler registrar
-                        (INxmHandlerRegistrar: WindowsNxmHandlerRegistrar writes
-                        HKCU\Software\Classes\nxm; LinuxNxmHandlerRegistrar writes a .desktop
-                        file + xdg-mime default; AppImage registration atomically copies the
-                        handler to a durable per-user directory + creates a sibling symlink
-                        to $APPIMAGE; startup maintenance refreshes those files only while
-                        Curator owns the active association), + NxmHandlerRelay (the testable core the
+                         (INxmHandlerRegistrar: WindowsNxmHandlerRegistrar writes
+                         HKCU\Software\Classes\nxm; LinuxNxmHandlerRegistrar writes a .desktop
+                         file + xdg-mime default; every xdg-mime invocation runs sanitized:
+                         the child's env is the parent's with ONLY LD_PRELOAD removed
+                         (Steam's overlay preload slows host utilities ~10x; Curator's own
+                         env untouched), while the wait stays plain + synchronous (a hung
+                         desktop helper hangs the probe rather than being masked:
+                         deliberate, fail loud); AppImage registration atomically copies the
+                         handler to a durable per-user directory + creates a sibling symlink
+                         to $APPIMAGE; startup maintenance refreshes those files only while
+                         Curator owns the active association; Unregister is self-guarded on
+                         both platforms: it never removes another program's registration +
+                         touches only Curator's own registration files (a no-op or a
+                         removal of Curator's own files depending on platform state), so
+                         callers never pre-check), + NxmHandlerRelay (the testable core the
                         handler exe calls: hot-path IPC delivery + cold-start launch+retry,
                         UseShellExecute=false on both OSes). AOT-friendly (IsAotCompatible;
                         only raw byte/UTF-8 IO in the handler path).
@@ -1045,9 +1080,17 @@ src/        Modificus Curator -- the mod manager app (.NET 10 + Avalonia 12)
                                             dirty-Profiles-draft navigation cancellation, entering
                                             Settings rehydrates + leaving Settings runs the mod-list
                                             + app-update refresh, entering Integrations refreshes +
-                                            leaving cancels auth + refreshes nxm/mod-list, Launch
+                                            leaving cancels auth + reloads the mod list with zero
+                                            registration refreshes on any leave, exactly one seed
+                                            refresh at shell construction + the strip following a
+                                            shared-state publish, Launch
                                             CanExecute + execution following
                                             IProfileSession.ActiveProfileId directly) + the
+                                            NxmRegistrationStateTests (the production shared-state
+                                            contract: unavailable-without-registrar publishes, the
+                                            registrar read on refresh, a probe throw treated as
+                                            not-registered, Changed marshaled through the UI seam)
+                                            + the
                                             ShellLaunchAttemptTests (the launch-attempt state via
                                             deterministic yield + timeout seams: attempt set +
                                             CanExecute false before the launch service runs, false
@@ -1110,7 +1153,9 @@ src/        Modificus Curator -- the mod manager app (.NET 10 + Avalonia 12)
                                             browser-open, the new-profile trigger, the
                                             decline path, the premium in-app download,
                                             the non-premium/unknown/no-auth browser-open
-                                            regardless of the nxm registrar state, and the
+                                            regardless of the registration state (the
+                                            confirm wording follows the shared state
+                                            with zero probes), and the
                                             prompt-timing-after-create)
                                             + the OnboardingService (already complete no-op,
                                             Continue persists + skips Integrations, Set up Nexus
@@ -1133,8 +1178,13 @@ src/        Modificus Curator -- the mod manager app (.NET 10 + Avalonia 12)
                                             Minimized/FullScreen)
     Modificus.Curator.Nxm.Tests/             xUnit tests for the nxm library (parser, framing,
                                             IPC server resilience, SingleInstanceGuard, router,
-                                            relay helper, standalone + AppImage Linux registrar,
-                                            owned-registration maintenance, AddNxm wiring;
+                                            relay helper, standalone + AppImage Linux registrar
+                                            (incl. the child-env sanitizer dropping exactly
+                                            LD_PRELOAD), owned-registration
+                                            maintenance, the Windows registrar's self-guarded
+                                            unregister (absent no-op / foreign preserved / own
+                                            deleted, via the base-key seam over a temp subkey;
+                                            Windows-gated), AddNxm wiring;
                                             serialized via DisableTestParallelization since
                                             real named pipes are an OS-level shared resource)
 docs/               architecture/ + reference/ (src/ per-library API refs + the release strategy reference)

docs/architecture/nxm-scheme-handler.md

@@ -164,19 +164,25 @@ a status line + a toggle button), not something the app does on startup. The
 register path shows a confirmation dialog first: it is a system-wide change
 that can take `nxm://` clicks away from Vortex, Mod Organizer 2, Nexus Mod
 Manager, or other mod managers, so the user must opt in knowingly. The
-unregister path only releases Curator's own registration (it re-checks
-`IsRegistered()` before `Unregister()` so it never deletes another program's
-handler). The composition root never registers, but after single-instance
-ownership succeeds it performs best-effort maintenance of an existing
-Curator-owned AppImage registration. Maintenance refreshes the copied handler
-and symlink only when the desktop file exists and `xdg-mime query default`
-still reports Curator. It never calls `xdg-mime default` or takes ownership from
-another manager. `INxmHandlerRegistrar` is resolved lazily by the Integrations
-view model + the shell status strip. The
-main-window status strip surfaces the current state ("Nexus links: enabled" /
-"Nexus links: disabled" / "Nexus links: unavailable") and refreshes when leaving the
-Nexus destination. No polling: the OS registration rarely changes
-out-of-band.
+unregister path releases only Curator's own registration, and the ownership
+safety lives inside the registrar, not the caller: on Windows it is a logged
+no-op when Curator is not the current handler; on Linux it removes only
+Curator's own desktop file and never touches another manager's registration.
+Callers never pre-check. The composition root never registers, but after
+single-instance ownership succeeds it performs best-effort maintenance of an
+existing Curator-owned AppImage registration. Maintenance refreshes the copied
+handler and symlink only when the desktop file exists and
+`xdg-mime query default` still reports Curator. It never calls
+`xdg-mime default` or takes ownership from another manager.
+`INxmHandlerRegistrar` is resolved by the Integrations view model (the
+register/release mutations) and by the shared UI registration state
+(`INxmRegistrationState`, the sole probe surface: one startup seed, one probe
+on entering the Nexus destination, and one publish after each register/release
+action). The main-window status strip and the Mods empty-state hint consume
+that shared state and update via its `Changed` event (the strip surfaces
+"Nexus links: enabled" / "Nexus links: disabled" / "Nexus links:
+unavailable"). No polling: consumers read last-known state and accept that the
+OS registration rarely changes out-of-band.
 
 The packaged handler-exe path is derived from `AppContext.BaseDirectory` plus
 the fixed handler assembly name. The handler ships as a sibling of the main