[4o3F]

Fixes #6054. Replaces the closed #6117/#6119/#6122 with a smaller, one-way design that follows the maintainer review on libnyanpasu/nyanpasu-utils#218.

Depends on (both merged): libnyanpasu/nyanpasu-utils#219 (StopStrategy, default Graceful) and libnyanpasu/nyanpasu-runtime#475 (CoreManagerBuilder::stop_strategy). The runtime gitlink moves to a27c3fc; the service binary is unchanged, so no runtime release is needed.

Changes

• Hidden-window hook (backend/tauri/src/shutdown_hook.rs): WM_QUERYENDSESSION returns TRUE and does nothing; WM_ENDSESSION(FALSE) is logged only; WM_ENDSESSION(TRUE) logs the LOGOFF/CRITICAL/CLOSEAPP flags, sends a session end once, and waits for cleanup at most 30 s with a shutdown block reason. The unused CleaningUp state is removed. No new statics.
• Console path: SetConsoleCtrlHandler maps Ctrl+C/Break to a normal graceful exit and CLOSE/LOGOFF/SHUTDOWN to a session end, sharing the same trigger and bounded wait. Debug builds run in a console and previously died on Ctrl+C without cleanup.
• Stop strategy: setup.rs shares one Arc<AtomicStopStrategy> with the local core (local_host::build) and the hook. A session end stores Kill before requesting exit, so the core is not stopped through the nyanpasu-service --nyanpasu-process-shutdown helper. Normal exits stay graceful.
• Restart intent: a session-end exit never relaunches.
• Service race guard (nyanpasu-core/src/service/control.rs): on Windows, status and elevated service commands return ServiceCommandError::SessionEnding without spawning while GetSystemMetrics(SM_SHUTTINGDOWN) is set. The service actor classifies it as Unknown, so recovery cannot launch an elevated start if the service stops on PRESHUTDOWN before the app receives WM_ENDSESSION.

Out of scope (follow-ups): revocation on WM_ENDSESSION(FALSE), the in-process SCM/IPC status probe (P3), and service-side PRESHUTDOWN timing (P5).

Tests

Message → action and console event → trigger mappings, one-shot session end across window and console, Kill stored before exit and normal stop staying graceful, ExitGate suppressing restart, and service-actor recovery publishing Unknown with zero daemon starts.

Verified on Linux: cargo test -p clash-nyanpasu, cargo test -p nyanpasu-core (except the WSL-only test_device_model_not_empty), clippy, fmt, lint:architecture-ledger, lint:backend-boundaries, typecheck.

Needs Windows verification

• Local and service mode × logoff / restart / shutdown / forced restart / Windows Update: no popup, no new nyanpasu-service.exe, sc.exe, UAC or relauncher after the session ends; hook returns within 30 s.
• Normal quit still graceful; Ctrl+C in a console build cleans up; closing the console kills the core without the helper.
• A shutdown cancelled by another app leaves the app running.

[semanticdiff-com]

Review changes with  

Changed Files

File	Status
backend/nyanpasu-core/src/actor_v2/local_host.rs	74% smaller
backend/tauri/src/shutdown_hook.rs	50% smaller
backend/tauri/src/setup.rs	49% smaller
backend/nyanpasu-core/src/service/control.rs	10% smaller
backend/tauri/src/utils/exit.rs	1% smaller
backend/Cargo.lock	Unsupported file format
backend/nyanpasu-core/Cargo.toml	Unsupported file format
backend/nyanpasu-core/src/actor_v2/service_actor.rs	0% smaller
backend/nyanpasu-runtime	0% smaller
backend/tauri/Cargo.toml	Unsupported file format
backend/tauri/src/lib.rs	0% smaller
frontend/rpc/src/rpc-bindings.ts	0% smaller