Service Worker: Ensure Unmanaged Apps Handle Recovery Messages

Input from Gemini 3 Pro:

✦I have centralized the Service Worker communication logic to ensure all apps, managed or unmanaged, can handle recovery messages.

Changes Implemented:

1. Refactored src/worker/Manager.mjs (Core Worker Manager):

   • Added a checkServiceWorkerVersion() method that proactively queries the controlling Service Worker for its version and compares it with Neo.config.version. If a mismatch is found, it triggers a forced reload.
   • Updated the construct() method to:
     • Bind navigator.serviceWorker.onmessage to WorkerManager.onWorkerMessage. This ensures the Main Thread listens for Service Worker messages (like reloadWindow) globally, regardless of whether the app explicitly uses the Service Worker addon.
     • Call checkServiceWorkerVersion() immediately if a controller is present.

2. Cleaned up src/main/addon/ServiceWorker.mjs:

   • Removed the redundant onmessage binding and version check logic, as these are now handled by the core WorkerManager.
   • This addon now focuses solely on registering the Service Worker for apps that opt-in.

Outcome: Any Neo.mjs app running in a browser context controlled by a Neo Service Worker (even "unmanaged" apps like SharedCovid accessed after Portal) will now:

1. Proactively detect version mismatches on boot.
2. Correctly receive and execute reloadWindow commands sent by the Service Worker (e.g., in response to 404s). This closes the "Unmanaged App" vulnerability where the SW would send recovery commands into the void.

Input from Gemini 3 Pro:

✦ Final refinement and safety guards implemented.

Additional Improvements:

1. Infinite Loop Protection:

   • Added a throttle mechanism to checkServiceWorkerVersion using sessionStorage.
   • If a reload was triggered by a version mismatch less than 5 seconds ago, the check aborts. This prevents infinite reload loops in case of persistent deployment errors (e.g., if the "new" version also believes it is mismatched or if the server is returning 404s for the new version's assets).

2. Architectural Documentation:

   • Added a CRITICAL comment block in src/worker/Manager.mjs explaining the "Unmanaged App" scenario.
   • This documents why we bind navigator.serviceWorker.onmessage even when useServiceWorker is false: to ensure that if a user navigates from a SW-controlled app (Portal) to a non-SW app (SharedCovid), the non-SW app can still receive and execute the reloadWindow recovery command sent by the persisting Service Worker. This prevents future regressions where developers might try to "optimize" this binding away.

The solution is now robust against race conditions, unmanaged app transitions, and persistent failure loops.