embedded runtime: intermittent startup spin (window never renders) and packaged-app orderly-exit semantics contradict the docs #329

Source

Payback save-lifecycle journey under #314 (real product #2, PR turinglambdaai/payback#29, 2026-10-26). Both findings reproduce on CI runners as well as a local macOS 26 machine; the second contradicts shipped documentation.

Finding 1 — intermittent startup spin (heisenbug)

Occasionally, after launch the embedded backend reports started but the window never renders, with dozens of Racket threads spinning at full CPU. Observed: locally on macOS 26 (twice, including one self-unrecoverable orphan instance that survived the suite), and on CI mac legs (the same signature during the PR's iteration). Suspected startup race inside the embedded runtime. The journey's e2e driver ships a mitigation (spin-signature detection → one bounded relaunch), but the root cause is upstream of any product.

Requested: diagnose the runtime startup path (backend-started → first render) for a race; the journey log (machine-local ~/Codes/payback-journey/journey-log.md, §5.2.5) has process/thread evidence and the detection signature.

Finding 2 — orderly exit: the documented paths do not work; only the quit Apple Event does

native-ui-testing.md states "native window close or SIGTERM completes the orderly backend shutdown". In reality, on a packaged app: SIGTERM, NSApplication.terminate-adjacent programmatic paths, and the AX close button all fail to exit (signals swallowed, main thread idle); only the quit Apple Event (what Cmd+Q delivers) reliably completes orderly shutdown. Also observed: a second instance of the same app reports a false-positive frontmost while keyboard event routing is entirely broken (not even a title-bar click recovers it) — suites that launch a second instance must not attempt keyboard phases on it.

Requested:

1. Fix or re-document the exit contract for packaged apps; if the quit Apple Event is the only supported orderly-exit path, say so and make the reference driver use it (the payback journey's driver now does, with a frontmost verification before every posted key).
2. State the second-instance keyboard caveat where launch orchestration is documented.

Related: #328 (real-desktop keyboard/AX recipe gaps from the regexmate journey) — these two are runtime/exit semantics rather than driver recipes, filed separately.