fix(stealth): mark the opacity shield spent when it fires

Both arm sites assigned this.opacityTimeout and neither callback nulled it,
so after any win32 overlay/launcher show the field held an already-fired
Timeout forever. cancelOpacityShield()'s "nothing pending" early return
therefore never fired and every later minimize/close ran a restore pass —
harmless today (the shield and hideMainWindow are the only things that zero
those four windows, and hideMainWindow hides them first, so the isVisible()
guard skips them) but it made the guard, and the test asserting it, vacuous.

Also pins the platform gate on the chrome re-push: it may skip win32, but it
must never exclude darwin. reassertContentProtection() routes through
applyContentProtection after app.dock.hide()/show(), and that flip makes
WindowServer silently reset sharingType — the re-push is the only thing that
restores NSWindowSharingNone. Narrowing the gate the other way would
un-protect the overlay after every dock toggle with nothing to catch it.

Renames the per-window assertion, which said "unconditionally" while the
literal now sits inside a platform gate. The unconditional part is covered
by the CREATED/SHOWN tests.

Mutation probes confirmed failing: either callback's null removed; the gate
flipped to `!== 'darwin'`.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Si93L7isjy1GFkqzjb7gJy

Author: Hardening v2.7

electron/WindowHelper.ts

@@ -2309,6 +2309,11 @@ export class WindowHelper {
 
         if (this.opacityTimeout) clearTimeout(this.opacityTimeout);
         this.opacityTimeout = setTimeout(() => {
+          // Mark the shield spent. Without this the field holds an
+          // already-fired Timeout forever, so cancelOpacityShield()'s
+          // "nothing pending" early return never fires and every later
+          // minimize/close runs a pointless restore pass.
+          this.opacityTimeout = null;
           if (this.overlayWindow && !this.overlayWindow.isDestroyed()) {
             this.overlayWindow.setOpacity(1);
             this.pillWindow?.setOpacity(1);
@@ -2407,6 +2412,8 @@ export class WindowHelper {
 
         if (this.opacityTimeout) clearTimeout(this.opacityTimeout);
         this.opacityTimeout = setTimeout(() => {
+          // Mark the shield spent — see the overlay branch above.
+          this.opacityTimeout = null;
           if (this.launcherWindow && !this.launcherWindow.isDestroyed()) {
             this.launcherWindow.setOpacity(1);
             if (!inactive) this.launcherWindow.focus();

electron/audio/__tests__/OpacityShieldCancelRestores.test.mjs

@@ -134,6 +134,27 @@ for (const [label, body] of [['minimizeWindow', minimizeBody], ['closeWindow', c
     });
 }
 
+test('the shield timer marks itself spent when it fires', () => {
+    // Without this the field holds an already-fired Timeout forever, so
+    // cancelOpacityShield()'s "nothing pending" early return never fires — the
+    // guard reads as meaningful while every later minimize/close runs a
+    // pointless restore pass. Nulling here is what makes that guard real.
+    for (const name of ['switchToOverlay', 'switchToLauncher']) {
+        const body = extractMethodBody(source, sigFor(name, '[^)]*'), name);
+        const callback = extractMethodBody(
+            body,
+            /this\.opacityTimeout\s*=\s*setTimeout\s*\(\s*\(\s*\)\s*=>\s*\{/,
+            `${name}'s opacity-shield callback`,
+        );
+        assert.ok(
+            /this\.opacityTimeout\s*=\s*null/.test(callback),
+            `BUG: ${name}'s opacity-shield callback does not null this.opacityTimeout when it ` +
+            `fires, leaving a stale non-null Timeout behind. cancelOpacityShield()'s early ` +
+            `return then never triggers.`,
+        );
+    }
+});
+
 test('the shield ARM sites still use a bare clearTimeout', () => {
     // The arm sites call setOpacity(0) and *then* clear the previous timer.
     // Routing them through cancelOpacityShield would immediately un-zero the

electron/audio/__tests__/OverlayAlwaysContentProtected.test.mjs

@@ -123,7 +123,7 @@ test('applyContentProtection maps at least two window groups (chrome + followers
 });
 
 for (const win of OVERLAY_CHROME) {
-    test(`applyContentProtection protects ${win} unconditionally (setContentProtection(true))`, () => {
+    test(`applyContentProtection protects ${win} with a literal true, never \`enable\``, () => {
         const owning = groups.filter((g) => g.members.includes(win));
         assert.ok(
             owning.length > 0,
@@ -135,14 +135,38 @@ for (const win of OVERLAY_CHROME) {
                 g.arg,
                 'true',
                 `BUG: ${win} receives \`setContentProtection(${g.arg})\` in applyContentProtection, ` +
-                `not \`true\`. The overlay chrome must be protected unconditionally — coupling it to ` +
+                `not \`true\`. The overlay chrome's protection must not depend on the mode — coupling it to ` +
                 `\`enable\` (undetectable mode) re-exposes the overlay in screen shares whenever ` +
                 `undetectable mode is off (its default).`,
             );
         }
     });
 }
 
+test('the chrome re-push in applyContentProtection still runs on macOS', () => {
+    // The chrome loop is skipped on win32 (there the write is always
+    // value-identical, and identical writes cause the DWM affinity churn
+    // SetContentProtectionDedupe.test.mjs exists to prevent). It must NOT be
+    // skipped off win32: reassertContentProtection() routes through here after
+    // app.dock.hide()/show(), and that macOS activation-policy flip makes
+    // WindowServer re-evaluate each NSWindow and silently reset its sharingType.
+    // The in-memory value is still correct, so only an unconditional re-push
+    // restores NSWindowSharingNone. Narrowing this gate to exclude darwin —
+    // or dropping the chrome from applyContentProtection altogether — silently
+    // un-protects the overlay after every dock toggle.
+    const beforeChrome = body.slice(0, body.indexOf('const overlayChrome'));
+    const gates = beforeChrome.match(/process\.platform\s*[!=]==\s*'[a-z0-9]+'/g) ?? [];
+    for (const gate of gates) {
+        assert.equal(
+            gate,
+            "process.platform !== 'win32'",
+            `BUG: the overlay-chrome re-push in applyContentProtection is gated on \`${gate}\`. ` +
+            `It must run on darwin — reassertContentProtection() relies on it to restore ` +
+            `NSWindowSharingNone after app.dock.hide()/show() resets sharingType.`,
+        );
+    }
+});
+
 test('applyContentProtection keeps the launcher on the undetectable-mode toggle (enable)', () => {
     // Sanity that the split is real: the launcher is NOT meeting chrome and must
     // still follow the toggle, so we are not just blanket-forcing everything true.