macOS: harden volume discovery and FUSE-T teardown

Run display discovery asynchronously and bound batched disk-image inventory
queries. Filter auxiliary mounts by basename, filesystem and owner, and
keep unresolved candidates separate from verified volumes. Allow targeted
dismounts despite incomplete discovery while requiring complete results
for slot allocation and empty-inventory decisions.

Use nonthrowing GUI snapshots with monotonic freshness, completion events
and safe window lifetimes. Suspend inactivity decisions while the snapshot
is stale, without restarting idle timers: activity counters are cumulative
per volume instance. Refresh logout targets and retry only failed ones.
Show a progress dialog for interactive unmounts, but keep automatic ones
synchronous, so a quit or logout request that arrives meanwhile is handled
afterwards rather than refused. Guard core operations against reentry and
route wait-dialog requests only from worker threads, so a main-thread
message cannot wait for itself.

Bind teardown to captured mount and service identities, including process
start time. Report a service exit that cannot be confirmed after auxiliary
mount removal as a distinct error that keeps the original details. Such
volumes are not retried, and a multi-volume unmount reports all of them
together with any other failure or a declined prompt. Warn about it after
automatic unmounts and at quit, and keep the background application until
the warning is acknowledged. Keep rollback responsive, and let services
remove their auxiliary directories without probing mounted paths. Preserve
released /control compatibility and perform best-effort cleanup for older
services.

Reap bounded subprocesses as soon as their output ends. A child that
survives SIGKILL is reaped by a later call, which starts no new child until
then. Keep subjects and subprocess command, status and error output when
formatting exceptions for wrapping and logs. Clarify discovery and rollback
diagnostics. Fix the localization-dependent busy-volume regression
assertion and extend discovery, snapshot, process identity, cleanup, GUI
lifecycle, inactivity and teardown coverage.

src/Main/CommandLineInterface.cpp

@@ -834,9 +834,10 @@ namespace VeraCrypt
 		return keyfileList;
 	}
 
-	VolumeInfoList CommandLineInterface::GetMountedVolumes (const wxString &mountedVolumeSpec) const
+	VolumeInfoList CommandLineInterface::GetMountedVolumes (const wxString &mountedVolumeSpec)
 	{
-		VolumeInfoList volumes = Core->GetMountedVolumes ();
+		VolumeDiscoveryResult discovery = Core->GetMountedVolumesWithStatus();
+		VolumeInfoList &volumes = discovery.Volumes;
 		VolumeInfoList filteredVolumes;
 
 		wxFileName pathFilter;
@@ -846,7 +847,10 @@ namespace VeraCrypt
 			pathFilter.Normalize (wxPATH_NORM_ABSOLUTE | wxPATH_NORM_DOTS);
 		}
 		else
+		{
+			ArgUnresolvedMounts = discovery.UnresolvedMounts;
 			return volumes;
+		}
 
 		foreach (shared_ptr <VolumeInfo> volume, volumes)
 		{
@@ -866,7 +870,10 @@ namespace VeraCrypt
 		}
 
 		if (!mountedVolumeSpec.IsEmpty() && filteredVolumes.size() < 1)
+		{
+			if (!discovery.IsComplete()) throw VolumeDiscoveryFailed (SRC_POS, wstring (discovery.UnresolvedMounts.front()));
 			throw_err (_("No such volume is mounted."));
+		}
 
 		return filteredVolumes;
 	}

src/Main/CommandLineInterface.h

@@ -86,6 +86,7 @@ namespace VeraCrypt
 		uint64 ArgSize;
 		shared_ptr <VolumePath> ArgVolumePath;
 		VolumeInfoList ArgVolumes;
+		list <DirectoryPath> ArgUnresolvedMounts;
 		VolumeType::Enum ArgVolumeType;
         shared_ptr<SecureBuffer> ArgTokenPin;
         bool ArgAllowScreencapture;
@@ -103,7 +104,7 @@ namespace VeraCrypt
 	protected:
 		void CheckCommandSingle () const;
 		shared_ptr <KeyfileList> ToKeyfileList (const wxString &arg) const;
-		VolumeInfoList GetMountedVolumes (const wxString &filter) const;
+		VolumeInfoList GetMountedVolumes (const wxString &filter);
 
 	private:
 		CommandLineInterface (const CommandLineInterface &);

src/Main/Forms/MainFrame.cpp

@@ -21,6 +21,7 @@
 
 #include "Common/SecurityToken.h"
 #include "Platform/SystemLog.h"
+#include "Platform/SerializerFactory.h"
 #include "Main/Main.h"
 #include "Main/Resources.h"
 #include "Main/Application.h"
@@ -38,12 +39,66 @@
 #include "SecurityTokenKeyfilesDialog.h"
 #include "VolumeCreationWizard.h"
 #include "VolumePropertiesDialog.h"
+#ifdef TC_MACOSX
+#include <chrono>
+#include "Core/Unix/MacOSX/CoreMacOSX.h"
+#endif
 
 namespace VeraCrypt
 {
+#ifdef TC_MACOSX
+	struct VolumeDiscoveryState
+	{
+		VolumeDiscoveryState (wxEvtHandler *target) : Running (false), Completed (false), Succeeded (false), HasResult (false), Generation (0), ResultGeneration (0), Started (chrono::steady_clock::now()), NotificationTarget (target)
+		{
+			// A kernel-blocked metadata read may outlive GUI shutdown. Retain the
+			// read-only serializer registry until process exit as well as this state;
+			// static teardown must not delete it underneath the detached worker.
+			static const bool registryRetained = [] () { SerializerFactory::Initialize(); return true; } ();
+			(void) registryRetained;
+		}
+		// Constructed on the GUI thread (CoreUnix initializes locale state).
+		CoreMacOSX DiscoveryCore;
+		Mutex AccessMutex;
+		bool Running, Completed, Succeeded, HasResult;
+		uint64 Generation, ResultGeneration;
+		chrono::steady_clock::time_point Started;
+		VolumeDiscoveryResult Result;
+		wxEvtHandler *NotificationTarget;
+	};
+
+	class VolumeDiscoveryTask : public Functor
+	{
+	public:
+		VolumeDiscoveryTask (shared_ptr <VolumeDiscoveryState> state, uint64 generation) : State (state), Generation (generation) { }
+		virtual void operator() ()
+		{
+			VolumeDiscoveryResult result;
+			bool succeeded = false;
+			try { result = State->DiscoveryCore.GetMountedVolumesWithStatus(); succeeded = true; }
+			catch (exception &e) { SystemLog::WriteException (e); }
+			catch (...) { }
+			ScopeLock lock (State->AccessMutex);
+			State->Result = result;
+			State->Succeeded = succeeded;
+			State->HasResult = true;
+			State->ResultGeneration = Generation;
+			State->Completed = true;
+			State->Running = false;
+			// Destruction clears this pointer under the same lock before the
+			// window's event handler is destroyed. Never post to a dead window.
+			if (State->NotificationTarget)
+				wxQueueEvent (State->NotificationTarget, new wxCommandEvent (wxEVT_COMMAND_VOLUME_DISCOVERY_COMPLETED));
+		}
+	private:
+		shared_ptr <VolumeDiscoveryState> State;
+		uint64 Generation;
+	};
+#endif
 	DEFINE_EVENT_TYPE(wxEVT_COMMAND_UPDATE_VOLUME_LIST)
 	DEFINE_EVENT_TYPE(wxEVT_COMMAND_PREF_UPDATED)
 	DEFINE_EVENT_TYPE(wxEVT_COMMAND_OPEN_VOLUME_REQUEST)
+	DEFINE_EVENT_TYPE(wxEVT_COMMAND_VOLUME_DISCOVERY_COMPLETED)
 	DEFINE_EVENT_TYPE(wxEVT_COMMAND_SHOW_WARNING)
 
 	MainFrame::MainFrame (wxWindow* parent) : MainFrameBase (parent),
@@ -56,6 +111,9 @@ namespace VeraCrypt
 		indicator_item_exit (NULL),
 #endif
 		ListItemRightClickEventPending (false),
+#ifdef TC_MACOSX
+		VolumeDiscovery (new VolumeDiscoveryState (this)),
+#endif
 		SelectedItemIndex (-1),
 		SelectedSlotNumber (0),
 		ShowRequestFifo (-1)
@@ -65,6 +123,9 @@ namespace VeraCrypt
 		SetName (Application::GetName());
 		SetTitle (Application::GetName());
 		SetIcon (Resources::GetVeraCryptIcon());
+#ifdef TC_MACOSX
+		CreateStatusBar();
+#endif
 
 #if defined(TC_UNIX) && !defined(TC_MACOSX)
 		try
@@ -105,7 +166,8 @@ namespace VeraCrypt
 		}
 
 		Connect( wxID_EXIT, wxEVT_COMMAND_MENU_SELECTED, wxCommandEventHandler( MainFrame::OnQuit ) );
-		Connect( wxID_ANY, wxEVT_COMMAND_UPDATE_VOLUME_LIST, wxCommandEventHandler( MainFrame::OnUpdateVolumeList ) );
+		Connect( wxID_ANY, wxEVT_COMMAND_UPDATE_VOLUME_LIST, wxThreadEventHandler( MainFrame::OnUpdateVolumeList ) );
+		Connect( wxID_ANY, wxEVT_COMMAND_VOLUME_DISCOVERY_COMPLETED, wxCommandEventHandler( MainFrame::OnVolumeDiscoveryCompleted ) );
 		Connect( wxID_ANY, wxEVT_COMMAND_PREF_UPDATED, wxCommandEventHandler( MainFrame::OnPreferencesUpdated ) );
 		Connect( wxID_ANY, wxEVT_COMMAND_OPEN_VOLUME_REQUEST, wxCommandEventHandler( MainFrame::OnOpenVolumeSystemRequest ) );
 
@@ -116,6 +178,12 @@ namespace VeraCrypt
 
 	MainFrame::~MainFrame ()
 	{
+#ifdef TC_MACOSX
+		{
+			ScopeLock lock (VolumeDiscovery->AccessMutex);
+			VolumeDiscovery->NotificationTarget = nullptr;
+		}
+#endif
 #if defined(TC_UNIX) && !defined(TC_MACOSX)
 		if (ShowRequestFifo != -1)
 		{
@@ -129,7 +197,8 @@ namespace VeraCrypt
 #endif
 
 		Disconnect( wxID_EXIT, wxEVT_COMMAND_MENU_SELECTED, wxCommandEventHandler( MainFrame::OnQuit ) );
-		Disconnect( wxID_ANY, wxEVT_COMMAND_UPDATE_VOLUME_LIST, wxCommandEventHandler( MainFrame::OnUpdateVolumeList ) );
+		Disconnect( wxID_ANY, wxEVT_COMMAND_UPDATE_VOLUME_LIST, wxThreadEventHandler( MainFrame::OnUpdateVolumeList ) );
+		Disconnect( wxID_ANY, wxEVT_COMMAND_VOLUME_DISCOVERY_COMPLETED, wxCommandEventHandler( MainFrame::OnVolumeDiscoveryCompleted ) );
 		Disconnect( wxID_ANY, wxEVT_COMMAND_PREF_UPDATED, wxCommandEventHandler( MainFrame::OnPreferencesUpdated ) );
 		Disconnect( wxID_ANY, wxEVT_COMMAND_OPEN_VOLUME_REQUEST, wxCommandEventHandler( MainFrame::OnOpenVolumeSystemRequest ) );
 #ifdef TC_MACOSX
@@ -268,9 +337,27 @@ namespace VeraCrypt
 		}
 	}
 
+	bool MainFrame::CanConfirmNoMountedVolumes () const
+	{
+#ifdef TC_MACOSX
+		// An unacknowledged unconfirmed cleanup must not disappear with the app.
+		return VolumeSnapshot.CanConfirmEmpty (MountedVolumes.empty()) && !Gui->HasUnconfirmedCleanupWarnings();
+#else
+		return MountedVolumes.empty();
+#endif
+	}
+
 	shared_ptr <VolumeInfo> MainFrame::GetSelectedVolume () const
 	{
+#ifdef TC_MACOSX
+		// Keep selection tied to the displayed instance. Core operations validate
+		// its serial and resolve current image ownership again before acting.
+		foreach (shared_ptr <VolumeInfo> volume, MountedVolumes)
+			if (volume->SlotNumber == SelectedSlotNumber) return volume;
+		return shared_ptr <VolumeInfo>();
+#else
 		return Core->GetMountedVolume (SelectedSlotNumber);
+#endif
 	}
 
 	void MainFrame::InitControls ()
@@ -530,12 +617,13 @@ namespace VeraCrypt
 			wxMenu *CreatePopupMenu ()
 			{
 				unique_ptr <wxMenu> popup (new wxMenu);
+				const bool operationsEnabled = !Busy && !Gui->GetWaitDialog();
 
 				Gui->AppendToMenu (*popup, LangString[Gui->IsInBackgroundMode() ? "SHOW_TC" : "HIDE_TC"], this, wxCommandEventHandler (TaskBarIcon::OnShowHideMenuItemSelected));
 
 				popup->AppendSeparator();
-				Gui->AppendToMenu (*popup, LangString["IDM_MOUNT_FAVORITE_VOLUMES"], this, wxCommandEventHandler (TaskBarIcon::OnMountAllFavoritesMenuItemSelected))->Enable (!Busy);
-				Gui->AppendToMenu (*popup, LangString["HK_UNMOUNT_ALL"], this, wxCommandEventHandler (TaskBarIcon::OnDismountAllMenuItemSelected))->Enable (!Busy);
+				Gui->AppendToMenu (*popup, LangString["IDM_MOUNT_FAVORITE_VOLUMES"], this, wxCommandEventHandler (TaskBarIcon::OnMountAllFavoritesMenuItemSelected))->Enable (operationsEnabled);
+				Gui->AppendToMenu (*popup, LangString["HK_UNMOUNT_ALL"], this, wxCommandEventHandler (TaskBarIcon::OnDismountAllMenuItemSelected))->Enable (operationsEnabled);
 
 				// Favorite volumes
 				if (Gui->GetPreferences().BackgroundTaskMenuMountItemsEnabled && !Frame->FavoriteVolumesMenuMap.empty())
@@ -546,12 +634,12 @@ namespace VeraCrypt
 					{
 						//TBH Gui->AppendToMenu (*popup, LangString["MOUNT"] + L" " + wstring (fp.second.Path) + (fp.second.MountPoint.IsEmpty() ? L"" : L"  " + wstring (fp.second.MountPoint)),
 						Gui->AppendToMenu (*popup, LangString["MOUNT_BUTTON"] + L" " + wstring (fp.second.Path) + (fp.second.MountPoint.IsEmpty() ? L"" : L"  " + wstring (fp.second.MountPoint)),
-							this, wxCommandEventHandler (TaskBarIcon::OnFavoriteVolumeMenuItemSelected), fp.first)->Enable (!Busy);
+							this, wxCommandEventHandler (TaskBarIcon::OnFavoriteVolumeMenuItemSelected), fp.first)->Enable (operationsEnabled);
 					}
 				}
 
 				// Mounted volumes
-				VolumeInfoList mountedVolumes = Core->GetMountedVolumes();
+				VolumeInfoList mountedVolumes = Gui->GetMountedVolumesForUI();
 				if (!mountedVolumes.empty())
 				{
 					if (Gui->GetPreferences().BackgroundTaskMenuOpenItemsEnabled)
@@ -583,14 +671,14 @@ namespace VeraCrypt
 								label += wstring (volume->Path);
 
 							wxMenuItem *item = Gui->AppendToMenu (*popup, label, this, wxCommandEventHandler (TaskBarIcon::OnDismountMenuItemSelected));
-							item->Enable (!Busy);
+							item->Enable (operationsEnabled);
 							DismountMap[item->GetId()] = volume;
 						}
 					}
 				}
 
 				popup->AppendSeparator();
-				Gui->AppendToMenu (*popup, LangString["IDM_PREFERENCES"], this, wxCommandEventHandler (TaskBarIcon::OnPreferencesMenuItemSelected))->Enable (!Busy);
+				Gui->AppendToMenu (*popup, LangString["IDM_PREFERENCES"], this, wxCommandEventHandler (TaskBarIcon::OnPreferencesMenuItemSelected))->Enable (operationsEnabled);
 #ifndef TC_MACOSX
 				popup->AppendSeparator();
 				Gui->AppendToMenu (*popup, LangString["EXIT"], this, wxCommandEventHandler (TaskBarIcon::OnExitMenuItemSelected))->Enable (!Busy && Frame->CanExit());
@@ -808,6 +896,13 @@ namespace VeraCrypt
 
 	void MainFrame::OnClose (wxCloseEvent& event)
 	{
+		// Do not start another core operation from a nested wait event loop.
+		if (Gui->GetWaitDialog())
+		{
+			if (event.CanVeto())
+				event.Veto();
+			return;
+		}
 		if (GetPreferences().WipeCacheOnClose)
 			Core->WipePasswordCache();
 
@@ -816,7 +911,7 @@ namespace VeraCrypt
 		{
 			try
 			{
-				Gui->DismountVolumes (Core->GetMountedVolumes(), GetPreferences().ForceAutoDismount, false);
+				Gui->OnLogOff();
 			}
 			catch (exception &e) { SystemLog::WriteException (e); }
 			catch (...) { SystemLog::WriteException (UnknownException (SRC_POS)); }
@@ -848,7 +943,7 @@ namespace VeraCrypt
 			}
 		}
 		else if (event.CanVeto() && GetPreferences().BackgroundTaskEnabled
-			&& (!GetPreferences().CloseBackgroundTaskOnNoVolumes || !MountedVolumes.empty()))
+			&& (!GetPreferences().CloseBackgroundTaskOnNoVolumes || !CanConfirmNoMountedVolumes()))
 		{
 			// Enter background mode
 			if (!Gui->IsInBackgroundMode())
@@ -1377,18 +1472,37 @@ namespace VeraCrypt
 			UpdateVolumeList();
 			UpdateWipeCacheButton();
 
-			if (GetPreferences().BackgroundTaskEnabled)
+			if (GetPreferences().BackgroundTaskEnabled && !Gui->GetWaitDialog())
 			{
 				// Inactivity auto-dismount
-				if (GetPreferences().DismountOnInactivity)
+				if (GetPreferences().DismountOnInactivity
+#ifdef TC_MACOSX
+					&& VolumeSnapshot.IsFresh()
+#endif
+					)
 				{
 					VolumeInfoList inactiveVolumes;
+#ifdef TC_MACOSX
+					wxLongLong currentTime = chrono::duration_cast <chrono::milliseconds> (chrono::steady_clock::now().time_since_epoch()).count();
+#else
 					wxLongLong currentTime = wxGetLocalTimeMillis().GetValue();
+#endif
 
 					map <wstring, VolumeActivityMapEntry> newActivityTimeMap;
 
 					foreach (shared_ptr <VolumeInfo> volume, MountedVolumes)
 					{
+#ifdef TC_MACOSX
+						// A retained entry has no current counters. Keep its idle state until
+						// they can be read again: unchanged cumulative counters prove idleness.
+						if (volume->Discovery == VolumeInfo::ControlUnavailable)
+						{
+							map <wstring, VolumeActivityMapEntry>::const_iterator entry = VolumeActivityMap.find (volume->Path);
+							if (entry != VolumeActivityMap.end() && entry->second.SerialInstanceNumber == volume->SerialInstanceNumber)
+								newActivityTimeMap[volume->Path] = entry->second;
+							continue;
+						}
+#endif
 						if (VolumeActivityMap.find (volume->Path) != VolumeActivityMap.end()
 							&& VolumeActivityMap[volume->Path].SerialInstanceNumber == volume->SerialInstanceNumber)
 						{
@@ -1447,7 +1561,8 @@ namespace VeraCrypt
 				{
 					Close (true);
 				}
-				else if (MountedVolumes.empty() && (GetPreferences().CloseBackgroundTaskOnNoVolumes || Core->IsInPortableMode()))
+				else if (CanConfirmNoMountedVolumes()
+					&& (GetPreferences().CloseBackgroundTaskOnNoVolumes || Core->IsInPortableMode()))
 				{
 					Close (true);
 				}
@@ -1683,19 +1798,94 @@ namespace VeraCrypt
 		UpdateWipeCacheButton();
 	}
 
-	void MainFrame::UpdateVolumeList ()
+	void MainFrame::OnUpdateVolumeList (wxThreadEvent& event)
+	{
+#ifdef TC_MACOSX
+		{
+			ScopeLock lock (VolumeDiscovery->AccessMutex);
+			++VolumeDiscovery->Generation;
+		}
+		VolumeSnapshot.Invalidate();
+		VolumeListChange change = event.GetPayload <VolumeListChange>();
+		MountedVolumes.remove_if ([&change] (shared_ptr <VolumeInfo> volume) { return volume->SerialInstanceNumber == change.Volume->SerialInstanceNumber; });
+		if (change.Mounted) MountedVolumes.push_back (change.Volume);
+#endif
+		UpdateVolumeList();
+	}
+
+	void MainFrame::OnVolumeDiscoveryCompleted (wxCommandEvent& event)
+	{
+		try { UpdateVolumeList (false); }
+		catch (exception &e) { SystemLog::WriteException (e); }
+		catch (...) { }
+	}
+
+	void MainFrame::UpdateVolumeList (bool startDiscovery)
 	{
 		static Mutex mutex;
 		ScopeLock lock (mutex);
 
 		bool listChanged = false;
 
+#ifdef TC_MACOSX
+		{
+			ScopeLock discoveryLock (VolumeDiscovery->AccessMutex);
+			auto now = chrono::steady_clock::now();
+			if (VolumeDiscovery->Completed)
+			{
+				if (VolumeDiscovery->Succeeded && VolumeDiscovery->ResultGeneration == VolumeDiscovery->Generation)
+				{
+					VolumeDiscoveryResult &result = VolumeDiscovery->Result;
+					// Retain the identity of previously seen but now unreadable services.
+					// New unresolved candidates remain separate, without invented slots.
+					foreach (shared_ptr <VolumeInfo> old, MountedVolumes)
+						if (find (result.UnresolvedMounts.begin(), result.UnresolvedMounts.end(), old->AuxMountPoint) != result.UnresolvedMounts.end()
+							&& none_of (result.Volumes.begin(), result.Volumes.end(), [&old] (shared_ptr <VolumeInfo> volume) { return volume->SerialInstanceNumber == old->SerialInstanceNumber; }))
+						{
+							shared_ptr <VolumeInfo> unknown = old->Clone();
+							unknown->Discovery = VolumeInfo::ControlUnavailable;
+							unknown->VirtualDevice = DevicePath();
+							unknown->MountPoint = DirectoryPath();
+							result.Volumes.push_back (unknown);
+						}
+					MountedVolumes.swap (result.Volumes);
+					VolumeSnapshot.RecordSample (VolumeDiscovery->Started, result.IsComplete());
+				}
+				else
+				{
+					VolumeSnapshot.Invalidate();
+					// A volume event invalidated an in-flight result. Start the
+					// replacement immediately, without waiting for the next timer.
+					if (VolumeDiscovery->ResultGeneration != VolumeDiscovery->Generation) startDiscovery = true;
+				}
+				VolumeDiscovery->Completed = false;
+			}
+			bool stale = !VolumeSnapshot.IsFresh (now);
+			SetStatusText (stale ? LangString[!VolumeDiscovery->HasResult && now - VolumeDiscovery->Started < chrono::seconds (6)
+				? "VOLUME_DISCOVERY_PENDING" : "VOLUME_DISCOVERY_STALLED"]
+				: (VolumeSnapshot.IsComplete() ? wxString() : LangString["VOLUME_DISCOVERY_PARTIAL"]));
+			if (startDiscovery && !VolumeDiscovery->Running)
+			{
+				VolumeDiscovery->Started = now;
+				VolumeDiscovery->Running = true;
+				unique_ptr <Functor> task (new VolumeDiscoveryTask (VolumeDiscovery, VolumeDiscovery->Generation));
+				Thread thread;
+				try { thread.Start (task.get()); }
+				catch (...) { VolumeDiscovery->Running = false; throw; }
+				task.release();
+				thread.Detach();
+			}
+		}
+#else
 		MountedVolumes = Core->GetMountedVolumes();
+#endif
 
 		map < VolumeSlotNumber, shared_ptr <VolumeInfo> > mountedVolumesMap;
 		foreach (shared_ptr <VolumeInfo> volume, MountedVolumes)
 		{
-			mountedVolumesMap[volume->SlotNumber] = volume;
+			// A live replacement may share a slot with a retained unreadable entry.
+			// Keep the visible row and selection on the first (live) instance.
+			mountedVolumesMap.insert (make_pair (volume->SlotNumber, volume));
 		}
 
 		VolumeInfoList protectionTriggeredVolumes;
@@ -1717,6 +1907,12 @@ namespace VeraCrypt
 #else
 				fields[ColumnSlot] = StringConverter::FromNumber (slotNumber);
 				fields[ColumnMountPoint] = volume->MountPoint;
+#ifdef TC_MACOSX
+				if (volume->Discovery == VolumeInfo::DiscoveryUnknown || volume->Discovery == VolumeInfo::ControlUnavailable)
+					fields[ColumnMountPoint] = LangString["VOLUME_STATUS_UNKNOWN"];
+				else if (volume->Discovery == VolumeInfo::ImageAbsent)
+					fields[ColumnMountPoint] = LangString["VOLUME_IMAGE_ABSENT"];
+#endif
 #endif
 				fields[ColumnPath] = volume->Path;
 				fields[ColumnSize] = Gui->SizeToString (volume->Size);

src/Main/Forms/MainFrame.h

@@ -23,15 +23,26 @@
 #include "ChangePasswordDialog.h"
 #ifdef TC_MACOSX
 #include <wx/display.h>
+#include "Main/VolumeSnapshot.h"
 #endif
 
 namespace VeraCrypt
 {
 	struct FavoriteVolume;
+#ifdef TC_MACOSX
+	struct VolumeDiscoveryState;
+#endif
 
 	DECLARE_LOCAL_EVENT_TYPE(wxEVT_COMMAND_UPDATE_VOLUME_LIST, -1);
 	DECLARE_LOCAL_EVENT_TYPE(wxEVT_COMMAND_PREF_UPDATED, -1);
 	DECLARE_LOCAL_EVENT_TYPE(wxEVT_COMMAND_OPEN_VOLUME_REQUEST, -1);
+	DECLARE_LOCAL_EVENT_TYPE(wxEVT_COMMAND_VOLUME_DISCOVERY_COMPLETED, -1);
+
+	struct VolumeListChange
+	{
+		bool Mounted;
+		shared_ptr <VolumeInfo> Volume;
+	};
 
 	class MainFrame : public MainFrameBase
 	{
@@ -45,6 +56,11 @@ namespace VeraCrypt
 #endif
 
 		void MountAllFavorites ();
+		VolumeInfoList GetDisplayedVolumes () const { return MountedVolumes; }
+#ifdef TC_MACOSX
+		bool HasVolumeSnapshot () const { return VolumeSnapshot.HasSample(); }
+#endif
+		bool CanConfirmNoMountedVolumes () const;
 
 #ifdef HAVE_INDICATORS
 		AppIndicator *indicator;
@@ -167,9 +183,17 @@ namespace VeraCrypt
 		void OnVolumePropertiesButtonClick (wxCommandEvent& event);
 		void OnVolumeToolsButtonClick (wxCommandEvent& event);
 		void OnVolumeButtonClick (wxCommandEvent& event);
-		void OnUpdateVolumeList (wxCommandEvent& event) { UpdateVolumeList(); }
-		void OnVolumeDismounted (EventArgs &args) { wxQueueEvent (this, new wxCommandEvent( wxEVT_COMMAND_UPDATE_VOLUME_LIST,0)); }
-		void OnVolumeMounted (EventArgs &args) { wxQueueEvent (this, new wxCommandEvent( wxEVT_COMMAND_UPDATE_VOLUME_LIST,0)); }
+		void OnUpdateVolumeList (wxThreadEvent& event);
+		void OnVolumeDiscoveryCompleted (wxCommandEvent& event);
+		void OnVolumeChange (EventArgs &args, bool mounted)
+		{
+			wxThreadEvent *event = new wxThreadEvent (wxEVT_COMMAND_UPDATE_VOLUME_LIST);
+			VolumeListChange change = { mounted, static_cast <VolumeEventArgs &> (args).mVolume->Clone() };
+			event->SetPayload (change);
+			wxQueueEvent (this, event);
+		}
+		void OnVolumeDismounted (EventArgs &args) { OnVolumeChange (args, false); }
+		void OnVolumeMounted (EventArgs &args) { OnVolumeChange (args, true); }
 		void OnUserGuideMenuItemSelected (wxCommandEvent& event) { Gui->OpenUserGuide (this); }
 		void OnWebsiteMenuItemSelected (wxCommandEvent& event) { Gui->OpenHomepageLink (this, L"website"); }
 		void OnWipeCacheButtonClick (wxCommandEvent& event);
@@ -180,7 +204,7 @@ namespace VeraCrypt
 		void SetVolumePath (const VolumePath &path) { VolumePathComboBox->SetValue (wstring (path)); }
 		void ShowTaskBarIcon (bool show = true);
 		void UpdateControls ();
-		void UpdateVolumeList ();
+		void UpdateVolumeList (bool startDiscovery = true);
 		void UpdateWipeCacheButton ();
 		void WipeCache ();
 
@@ -233,6 +257,10 @@ namespace VeraCrypt
 		map <int, FavoriteVolume> FavoriteVolumesMenuMap;
 		bool ListItemRightClickEventPending;
 		VolumeInfoList MountedVolumes;
+#ifdef TC_MACOSX
+		shared_ptr <VolumeDiscoveryState> VolumeDiscovery;
+		VolumeSnapshotState VolumeSnapshot;
+#endif
 		unique_ptr <wxTaskBarIcon> mTaskBarIcon;
 		unique_ptr <wxTimer> mTimer;
 		long SelectedItemIndex;

src/Main/Forms/WaitDialog.cpp

@@ -60,6 +60,9 @@ namespace VeraCrypt
 		VC_CONVERT_EXCEPTION (MountPointUnavailable);
 		VC_CONVERT_EXCEPTION (MountServiceIncompatible);
 		VC_CONVERT_EXCEPTION (MountServiceCleanupFailed);
+		VC_CONVERT_EXCEPTION (DismountServiceCleanupFailed);
+		VC_CONVERT_EXCEPTION (MountServiceUnavailable);
+		VC_CONVERT_EXCEPTION (VolumeDiscoveryFailed);
 		VC_CONVERT_EXCEPTION (NoDriveLetterAvailable);
 		VC_CONVERT_EXCEPTION (TemporaryDirectoryFailure);
 		VC_CONVERT_EXCEPTION (UnsupportedSectorSizeHiddenVolumeProtection);

src/Main/GraphicUserInterface.cpp

@@ -11,6 +11,7 @@
 */
 
 #include "System.h"
+#include <chrono>
 
 #ifdef TC_UNIX
 #include <wx/mimetype.h>
@@ -121,7 +122,9 @@ namespace VeraCrypt
 		{
 
 			wxString sValue;
-			if (Gui->GetWaitDialog())
+			// Only a worker can wait for the dialog's queue. The main thread
+			// would block on a reply that only it could deliver.
+			if (Gui->GetWaitDialog() && !wxIsMainThread())
 			{
 				Gui->GetWaitDialog()->RequestAdminPassword(sValue);
 				if (sValue.IsEmpty())
@@ -163,6 +166,9 @@ namespace VeraCrypt
 		BackgroundMode (false),
 		mMainFrame (nullptr),
 		mWaitDialog (nullptr)
+#ifdef TC_MACOSX
+		, mShowingCleanupWarning (false)
+#endif
 	{
 #ifdef TC_UNIX
 		signal (SIGHUP, OnSignal);
@@ -229,7 +235,17 @@ namespace VeraCrypt
 
 	void GraphicUserInterface::AutoDismountVolumes (VolumeInfoList mountedVolumes, bool alwaysForce)
 	{
+#ifdef TC_MACOSX
+		if (mountedVolumes.empty() || GetWaitDialog())
+			return;
+		// An automatic lock request must not leave cached credentials behind
+		// merely because service exit confirmation is delayed or fails.
+		try { OnVolumesAutoDismounted(); }
+		catch (exception &e) { SystemLog::WriteException (e); }
+		catch (...) { }
+#else
 		size_t mountedVolumeCount = Core->GetMountedVolumes().size();
+#endif
 		try
 		{
 			wxBusyCursor busy;
@@ -237,9 +253,10 @@ namespace VeraCrypt
 		}
 		catch (exception &e) { SystemLog::WriteException (e); }
 		catch (...) { SystemLog::WriteException (UnknownException (SRC_POS)); }
-
+#ifndef TC_MACOSX
 		if (Core->GetMountedVolumes().size() < mountedVolumeCount)
 			OnVolumesAutoDismounted();
+#endif
 	}
 
 	void GraphicUserInterface::BackupVolumeHeaders (shared_ptr <VolumePath> volumePath) const
@@ -700,7 +717,7 @@ namespace VeraCrypt
 					throw MissingArgument (SRC_POS);
 
 				wxString sValue;
-				if (Gui->GetWaitDialog())
+				if (Gui->GetWaitDialog() && !wxIsMainThread())
 				{
 					sValue = StringConverter::ToWide (passwordStr).c_str();
 					Gui->GetWaitDialog()->RequestPin (sValue);
@@ -1308,8 +1325,86 @@ namespace VeraCrypt
 		return true;
 	}
 
+#ifdef TC_MACOSX
+	VolumeInfoList GraphicUserInterface::GetVolumesForAutoDismount () const
+	{
+		VolumeInfoList volumes = GetMountedVolumesForUI();
+		try
+		{
+			VolumeDiscoveryResult result = Core->GetMountedVolumesWithStatus();
+			VolumeInfoList captured;
+			captured.swap (volumes);
+			volumes = result.Volumes;
+			foreach (shared_ptr <VolumeInfo> volume, captured)
+				if (find (result.UnresolvedMounts.begin(), result.UnresolvedMounts.end(), volume->AuxMountPoint) != result.UnresolvedMounts.end()
+					&& none_of (volumes.begin(), volumes.end(), [&volume] (shared_ptr <VolumeInfo> current) { return current->SerialInstanceNumber == volume->SerialInstanceNumber; }))
+					volumes.push_back (volume);
+			if (!result.IsComplete()) SystemLog::WriteException (VolumeDiscoveryFailed (SRC_POS, wstring (result.UnresolvedMounts.front())));
+		}
+		catch (exception &e) { SystemLog::WriteException (e); }
+		return volumes;
+	}
+
+	void GraphicUserInterface::ReportUnconfirmedCleanup (const exception &e) const
+	{
+		// Without its auxiliary mount, the volume is no longer listed. Queue the
+		// warning so that the reporting caller, such as the inactivity timer,
+		// returns first and other volumes can still be unmounted automatically.
+		mUnconfirmedCleanupWarnings.push_back (ExceptionToMessage (e));
+		wxTheApp->CallAfter ([] () { Gui->ShowUnconfirmedCleanupWarnings(); });
+	}
+
+	void GraphicUserInterface::ShowUnconfirmedCleanupWarnings () const
+	{
+		// One warning at a time; the active call also shows warnings added meanwhile.
+		// Entries are removed only after acknowledgement, which prevents automatic exit.
+		if (mShowingCleanupWarning)
+			return;
+		mShowingCleanupWarning = true;
+		finally_do_arg (bool *, &mShowingCleanupWarning, { *finally_arg = false; });
+		while (!mUnconfirmedCleanupWarnings.empty())
+		{
+			ShowWarningTopMost (mUnconfirmedCleanupWarnings.front());
+			mUnconfirmedCleanupWarnings.pop_front();
+		}
+	}
+#endif
+
 	void GraphicUserInterface::OnLogOff ()
 	{
+#ifdef TC_MACOSX
+		// This is also called directly by Cocoa. No exception may escape the
+		// native callback, including before the first display snapshot exists.
+		try
+		{
+			if (!GetPreferences().DismountOnLogOff || GetWaitDialog()) return;
+			try { OnVolumesAutoDismounted(); }
+			catch (exception &e) { SystemLog::WriteException (e); }
+			catch (...) { }
+			VolumeInfoList remaining = GetVolumesForAutoDismount();
+
+			const auto deadline = std::chrono::steady_clock::now() + std::chrono::seconds (4);
+			while (!remaining.empty())
+			{
+				bool finalAttempt = std::chrono::steady_clock::now() >= deadline;
+				VolumeInfoList retry;
+				foreach (shared_ptr <VolumeInfo> volume, remaining)
+				{
+					try { DismountVolume (volume, finalAttempt && GetPreferences().ForceAutoDismount, false); }
+					// Without its auxiliary mount, another attempt cannot reach the service.
+					catch (DismountServiceCleanupFailed &e) { SystemLog::WriteException (e); }
+					catch (exception &e) { SystemLog::WriteException (e); retry.push_back (volume); }
+				}
+				remaining.swap (retry);
+				if (finalAttempt || remaining.empty()) break;
+				Thread::Sleep (500);
+			}
+			// A queued warning would never run once termination proceeds.
+			ShowUnconfirmedCleanupWarnings();
+		}
+		catch (exception &e) { SystemLog::WriteException (e); }
+		catch (...) { }
+#else
 		VolumeInfoList mountedVolumes = Core->GetMountedVolumes();
 		if (GetPreferences().BackgroundTaskEnabled && GetPreferences().DismountOnLogOff
 			&& !mountedVolumes.empty())
@@ -1338,10 +1433,11 @@ namespace VeraCrypt
 					Thread::Sleep (500);
 				}
 
-				VolumeInfoList mountedVolumes = Core->GetMountedVolumes();
+				mountedVolumes = Core->GetMountedVolumes();
 			}
 
 		}
+#endif
 	}
 
 #ifdef wxHAS_POWER_EVENTS
@@ -2036,6 +2132,7 @@ namespace VeraCrypt
 
 	void GraphicUserInterface::SetBackgroundMode (bool state)
 	{
+		if (!mMainFrame) return;
 #ifdef TC_MACOSX
 		// Hiding an iconized window on OS X apparently cannot be reversed
 		if (state && mMainFrame->IsIconized())
@@ -2210,7 +2307,7 @@ namespace VeraCrypt
 				caption.clear();
 		}
 #endif
-		if (mWaitDialog)
+		if (mWaitDialog && !wxIsMainThread())
 		{
 			return mWaitDialog->RequestShowMessage(subMessage, caption, style, topMost);
 		}
@@ -2218,7 +2315,7 @@ namespace VeraCrypt
 		{
 			if (topMost)
 			{
-				if (!IsActive())
+				if (!IsActive() && mMainFrame)
 					mMainFrame->RequestUserAttention (wxUSER_ATTENTION_ERROR);
 
 				style |= wxSTAY_ON_TOP;
@@ -2304,11 +2401,79 @@ namespace VeraCrypt
 		return routine.m_pVolume;
 	}
 
+	VolumeInfoList GraphicUserInterface::GetMountedVolumesForUI () const
+	{
+#ifdef TC_MACOSX
+		if (mMainFrame)
+		{
+			MainFrame *frame = static_cast <MainFrame *> (mMainFrame.get());
+			return frame->GetDisplayedVolumes();
+		}
+		return VolumeInfoList();
+#else
+		return Core->GetMountedVolumes();
+#endif
+	}
+
+#ifdef TC_MACOSX
+	shared_ptr <VolumeInfo> GraphicUserInterface::DismountVolumeThread (shared_ptr <VolumeInfo> volume, bool ignoreOpenFiles, bool interactive) const
+	{
+		if (!interactive)
+		{
+			// Automatic unmounts run synchronously, as before. A quit or logout
+			// request that arrives meanwhile is then handled afterwards; a hidden
+			// wait's modal session would make macOS refuse it.
+			try
+			{
+				return Core->DismountVolume (volume, ignoreOpenFiles);
+			}
+			catch (DismountServiceCleanupFailed &e)
+			{
+				ReportUnconfirmedCleanup (e);
+				throw;
+			}
+		}
+
+		class DismountRoutine : public WaitThreadRoutine
+		{
+		public:
+			DismountRoutine (shared_ptr <VolumeInfo> volume, bool force) : Volume (volume), Force (force) { }
+			virtual void ExecutionCode () { Volume = Core->DismountVolume (Volume, Force); }
+			shared_ptr <VolumeInfo> Volume;
+			bool Force;
+		} routine (volume, ignoreOpenFiles);
+		ExecuteWaitThreadRoutine (GetTopWindow(), &routine);
+		return routine.Volume;
+	}
+
+	void GraphicUserInterface::DismountAllVolumes (bool ignoreOpenFiles, bool interactive) const
+	{
+		class DiscoveryRoutine : public WaitThreadRoutine
+		{
+		public:
+			virtual void ExecutionCode () { Result = Core->GetMountedVolumesWithStatus(); }
+			VolumeDiscoveryResult Result;
+		} routine;
+		try
+		{
+			if (interactive)
+				ExecuteWaitThreadRoutine (GetTopWindow(), &routine);
+			else
+				routine.ExecutionCode();
+			if (interactive && routine.Result.Volumes.empty() && routine.Result.IsComplete()) ShowInfo (LangString["NO_VOLUMES_MOUNTED"]);
+			DismountVolumes (routine.Result.Volumes, ignoreOpenFiles, interactive);
+			if (!routine.Result.IsComplete()) throw VolumeDiscoveryFailed (SRC_POS, wstring (routine.Result.UnresolvedMounts.front()));
+		}
+		catch (exception &e) { if (interactive) ShowError (e); else SystemLog::WriteException (e); }
+	}
+#endif
+
 	void GraphicUserInterface::ExecuteWaitThreadRoutine (wxWindow *parent, WaitThreadRoutine *pRoutine) const
 	{
 		WaitDialog dlg(parent, LangString["IDT_STATIC_MODAL_WAIT_DLG_INFO"], pRoutine);
+		// Restore an outer wait, whose worker may still route requests through it.
+		finally_do_arg2 (WaitDialog**, &mWaitDialog, WaitDialog*, mWaitDialog, { *finally_arg = finally_arg2; });
 		mWaitDialog = &dlg;
-		finally_do_arg (WaitDialog**, &mWaitDialog, { *finally_arg = nullptr; });
 		dlg.Run();
 	}
 

src/Main/GraphicUserInterface.h

@@ -18,6 +18,9 @@
 #include "Main.h"
 #include "UserInterface.h"
 #include "Forms/WaitDialog.h"
+#ifdef TC_MACOSX
+#include <wx/weakref.h>
+#endif
 
 namespace VeraCrypt
 {
@@ -97,6 +100,13 @@ namespace VeraCrypt
 		virtual void UserEnrichRandomPool (wxWindow *parent, shared_ptr <Hash> hash = shared_ptr <Hash>()) const;
 		virtual void Yield () const;
 		virtual shared_ptr <VolumeInfo> MountVolumeThread (MountOptions &options) const;
+#ifdef TC_MACOSX
+		virtual shared_ptr <VolumeInfo> DismountVolumeThread (shared_ptr <VolumeInfo> volume, bool ignoreOpenFiles, bool interactive = true) const;
+		virtual void DismountAllVolumes (bool ignoreOpenFiles = false, bool interactive = true) const;
+		bool HasUnconfirmedCleanupWarnings () const { return !mUnconfirmedCleanupWarnings.empty(); }
+		void ShowUnconfirmedCleanupWarnings () const;
+#endif
+		VolumeInfoList GetMountedVolumesForUI () const;
 		WaitDialog* GetWaitDialog () { return mWaitDialog; }
 		void ExecuteWaitThreadRoutine (wxWindow *parent, WaitThreadRoutine *pRoutine) const;
 
@@ -127,6 +137,10 @@ namespace VeraCrypt
 #endif
 		static void OnSignal (int signal);
 		virtual void OnVolumesAutoDismounted ();
+#ifdef TC_MACOSX
+		VolumeInfoList GetVolumesForAutoDismount () const;
+		void ReportUnconfirmedCleanup (const exception &e) const;
+#endif
 		virtual int ShowMessage (const wxString &message, long style, bool topMost = false) const;
 		void ThrowTextModeRequired () const;
 
@@ -135,10 +149,18 @@ namespace VeraCrypt
 #ifdef TC_WINDOWS
 		unique_ptr <wxDDEServer> DDEServer;
 #endif
+#ifdef TC_MACOSX
+		wxWeakRef <wxFrame> mMainFrame;
+#else
 		wxFrame *mMainFrame;
+#endif
 		unique_ptr <wxSingleInstanceChecker> SingleInstanceChecker;
 
 		mutable WaitDialog* mWaitDialog;
+#ifdef TC_MACOSX
+		mutable list <wxString> mUnconfirmedCleanupWarnings;
+		mutable bool mShowingCleanupWarning;
+#endif
 public:	
 #ifdef TC_MACOSX
 		static int g_customIdCmdV;

src/Main/UserInterface.cpp

@@ -184,6 +184,20 @@ namespace VeraCrypt
 		DismountVolumes (volumes, ignoreOpenFiles, interactive);
 	}
 
+	// Unconfirmed service exits are reported together, followed by any other
+	// failure of the same operation, so that none of them can hide another.
+	static void ThrowUnconfirmedCleanups (const list <DismountServiceCleanupFailed> &failures, const wstring &otherFailure)
+	{
+		wstring details;
+		for (const DismountServiceCleanupFailed &failure : failures)
+			details += (details.empty() ? L"" : L"\n\n") + failure.GetSubject();
+
+		if (!otherFailure.empty())
+			details += L"\n\n" + otherFailure;
+
+		throw DismountServiceCleanupFailed (failures.front().what(), details);
+	}
+
 	void UserInterface::DismountVolumes (VolumeInfoList volumes, bool ignoreOpenFiles, bool interactive, bool emergencyCleanupRequested) const
 	{
 #ifndef TC_LINUX
@@ -197,6 +211,9 @@ namespace VeraCrypt
 		bool twoPassMode = volumes.size() > 1;
 		bool volumesInUse = false;
 		bool firstPass = true;
+		// Such volumes have already left discovery. Report every one of them, even
+		// when another volume fails or a forced-unmount prompt is declined.
+		list <DismountServiceCleanupFailed> unconfirmedCleanups;
 
 #ifdef TC_WINDOWS
 		if (Preferences.CloseExplorerWindowsOnDismount)
@@ -205,60 +222,51 @@ namespace VeraCrypt
 				CloseExplorerWindows (volume);
 		}
 #endif
-		while (!volumes.empty())
+		try
 		{
-			VolumeInfoList volumesLeft;
-			foreach (shared_ptr <VolumeInfo> volume, volumes)
+			while (!volumes.empty())
 			{
-				bool emergencyCleanupPerformed = false;
-				try
+				VolumeInfoList volumesLeft;
+				foreach (shared_ptr <VolumeInfo> volume, volumes)
 				{
-					BusyScope busy (this);
-					volume = Core->DismountVolume (volume, ignoreOpenFiles);
-				}
-				catch (MountedVolumeInUse&)
-				{
-					if (!firstPass || (!interactive && !twoPassMode))
-						throw;
-
-					if (twoPassMode || !interactive)
+					bool emergencyCleanupPerformed = false;
+					try
 					{
-						volumesInUse = true;
-						volumesLeft.push_back (volume);
-						continue;
+						BusyScope busy (this);
+						volume = DismountVolumeThread (volume, ignoreOpenFiles, interactive);
 					}
-					else
+					catch (MountedVolumeInUse&)
 					{
-						if (AskYesNo (StringFormatter (LangString["UNMOUNT_LOCK_FAILED"], wstring (volume->Path)), true, true))
+						if (!firstPass || (!interactive && !twoPassMode))
+							throw;
+
+						if (twoPassMode || !interactive)
 						{
-							BusyScope busy (this);
-							volume = Core->DismountVolume (volume, true);
+							volumesInUse = true;
+							volumesLeft.push_back (volume);
+							continue;
 						}
 						else
-							throw UserAbort (SRC_POS);
-					}
-				}
-#ifdef TC_LINUX
-				catch (FilesystemDismountFailed&)
-				{
-					if (twoPassMode && firstPass)
-					{
-						volumesLeft.push_back (volume);
-						continue;
-					}
-
-					if (emergencyCleanupRequested)
-					{
 						{
-							BusyScope busy (this);
-							volume = Core->EmergencyDismountVolume (volume);
+							if (AskYesNo (StringFormatter (LangString["UNMOUNT_LOCK_FAILED"], wstring (volume->Path)), true, true))
+							{
+								BusyScope busy (this);
+								volume = DismountVolumeThread (volume, true);
+							}
+							else
+								throw UserAbort (SRC_POS);
 						}
-						emergencyCleanupPerformed = true;
-						ShowWarning (StringFormatter (LangString["LINUX_EMERGENCY_UNMOUNTED"], wstring (volume->Path)));
 					}
-					else if (interactive)
+#ifdef TC_LINUX
+					catch (FilesystemDismountFailed&)
 					{
-						if (AskYesNo (StringFormatter (LangString["LINUX_EMERGENCY_UNMOUNT_WARNING"], wstring (volume->Path)), false, true))
+						if (twoPassMode && firstPass)
+						{
+							volumesLeft.push_back (volume);
+							continue;
+						}
+
+						if (emergencyCleanupRequested)
 						{
 							{
 								BusyScope busy (this);
@@ -267,55 +275,88 @@ namespace VeraCrypt
 							emergencyCleanupPerformed = true;
 							ShowWarning (StringFormatter (LangString["LINUX_EMERGENCY_UNMOUNTED"], wstring (volume->Path)));
 						}
+						else if (interactive)
+						{
+							if (AskYesNo (StringFormatter (LangString["LINUX_EMERGENCY_UNMOUNT_WARNING"], wstring (volume->Path)), false, true))
+							{
+								{
+									BusyScope busy (this);
+									volume = Core->EmergencyDismountVolume (volume);
+								}
+								emergencyCleanupPerformed = true;
+								ShowWarning (StringFormatter (LangString["LINUX_EMERGENCY_UNMOUNTED"], wstring (volume->Path)));
+							}
+							else
+								throw UserAbort (SRC_POS);
+						}
+						else
+							throw;
+					}
+#endif
+					catch (DismountServiceCleanupFailed &e)
+					{
+						// The auxiliary mount is gone, so another attempt cannot reach the service.
+						unconfirmedCleanups.push_back (e);
+						continue;
+					}
+					catch (...)
+					{
+						if (twoPassMode && firstPass)
+							volumesLeft.push_back (volume);
+						else
+							throw;
+					}
+
+					if (volume->HiddenVolumeProtectionTriggered)
+						ShowWarning (StringFormatter (LangString["DAMAGE_TO_HIDDEN_VOLUME_PREVENTED"], wstring (volume->Path)));
+
+					if (Preferences.Verbose)
+					{
+						if (!emergencyCleanupPerformed)
+						{
+							if (!message.IsEmpty())
+								message += L'\n';
+							message += StringFormatter (LangString["LINUX_VOL_UNMOUNTED"], wstring (volume->Path));
+						}
+					}
+				}
+
+				if (twoPassMode && firstPass)
+				{
+					volumes = volumesLeft;
+
+					if (volumesInUse && interactive)
+					{
+						if (AskYesNo (LangString["UNMOUNTALL_LOCK_FAILED"], true, true))
+							ignoreOpenFiles = true;
 						else
 							throw UserAbort (SRC_POS);
 					}
-					else
-						throw;
-				}
-#endif
-				catch (...)
-				{
-					if (twoPassMode && firstPass)
-						volumesLeft.push_back (volume);
-					else
-						throw;
 				}
+				else
+					break;
 
-				if (volume->HiddenVolumeProtectionTriggered)
-					ShowWarning (StringFormatter (LangString["DAMAGE_TO_HIDDEN_VOLUME_PREVENTED"], wstring (volume->Path)));
-
-				if (Preferences.Verbose)
-				{
-					if (!emergencyCleanupPerformed)
-					{
-						if (!message.IsEmpty())
-							message += L'\n';
-						message += StringFormatter (LangString["LINUX_VOL_UNMOUNTED"], wstring (volume->Path));
-					}
-				}
+				firstPass = false;
 			}
 
-			if (twoPassMode && firstPass)
-			{
-				volumes = volumesLeft;
+			if (Preferences.Verbose && !message.IsEmpty())
+				ShowInfo (message);
+		}
+		catch (...)
+		{
+			if (unconfirmedCleanups.empty())
+				throw;
 
-				if (volumesInUse && interactive)
-				{
-					if (AskYesNo (LangString["UNMOUNTALL_LOCK_FAILED"], true, true))
-						ignoreOpenFiles = true;
-					else
-						throw UserAbort (SRC_POS);
-				}
-			}
-			else
-				break;
-
-			firstPass = false;
+			wxString otherFailure;
+			try { throw; }
+			catch (UserAbort &) { }
+			catch (exception &e) { otherFailure = ExceptionToMessage (e); }
+			catch (...) { otherFailure = ExceptionToMessage (UnknownException (SRC_POS)); }
+			ThrowUnconfirmedCleanups (unconfirmedCleanups, otherFailure.ToStdWstring());
 		}
 
-		if (Preferences.Verbose && !message.IsEmpty())
-			ShowInfo (message);
+		if (!unconfirmedCleanups.empty())
+			ThrowUnconfirmedCleanups (unconfirmedCleanups, wstring());
 	}
 
 	void UserInterface::DisplayVolumeProperties (const VolumeInfoList &volumes) const
@@ -562,6 +603,11 @@ namespace VeraCrypt
 		EX2MSG (MountPointUnavailable,				LangString["LINUX_EX2MSG_MOUNTPOINTUNAVAILABLE"]);
 		EX2MSG (MountServiceIncompatible,			LangString["MOUNT_SERVICE_INCOMPATIBLE"]);
 		EX2MSG (MountServiceCleanupFailed,			LangString["MOUNT_SERVICE_CLEANUP_FAILED"]);
+		EX2MSG (DismountServiceCleanupFailed, LangString["DISMOUNT_SERVICE_CLEANUP_FAILED"]);
+		EX2MSG (MountServiceUnavailable, LangString["MOUNT_SERVICE_UNAVAILABLE"]);
+		EX2MSG (VolumeDiscoveryFailed, LangString["VOLUME_DISCOVERY_FAILED"]);
+		EX2MSG (MountedVolumeInUse, LangString["VOLUME_IN_USE"]);
+		EX2MSG (TimeOut, LangString["OPERATION_TIMED_OUT"]);
 		EX2MSG (NoDriveLetterAvailable,				LangString["NO_FREE_DRIVES"]);
 		EX2MSG (PasswordEmpty,						LangString["LINUX_EX2MSG_PASSWORDEMPTY"]);
 		EX2MSG (PasswordIncorrect,					LangString["PASSWORD_WRONG"]);
@@ -1305,6 +1351,7 @@ const FileManager fileManagers[] = {
 				, cmdLine.ArgEmergencyUnmount
 #endif
 				);
+			if (!cmdLine.ArgUnresolvedMounts.empty()) throw VolumeDiscoveryFailed (SRC_POS, wstring (cmdLine.ArgUnresolvedMounts.front()));
 			return true;
 
 		case CommandId::DisplayVersion:
@@ -1312,7 +1359,9 @@ const FileManager fileManagers[] = {
 			return true;
 
 		case CommandId::DisplayVolumeProperties:
+			if (cmdLine.ArgVolumes.empty() && !cmdLine.ArgUnresolvedMounts.empty()) throw VolumeDiscoveryFailed (SRC_POS, wstring (cmdLine.ArgUnresolvedMounts.front()));
 			DisplayVolumeProperties (cmdLine.ArgVolumes);
+			if (!cmdLine.ArgUnresolvedMounts.empty()) throw VolumeDiscoveryFailed (SRC_POS, wstring (cmdLine.ArgUnresolvedMounts.front()));
 			return true;
 
 		case CommandId::Help:
@@ -1675,10 +1724,12 @@ const FileManager fileManagers[] = {
             return true;
 
 		case CommandId::ListVolumes:
+			if (cmdLine.ArgVolumes.empty() && !cmdLine.ArgUnresolvedMounts.empty()) throw VolumeDiscoveryFailed (SRC_POS, wstring (cmdLine.ArgUnresolvedMounts.front()));
 			if (Preferences.Verbose)
 				DisplayVolumeProperties (cmdLine.ArgVolumes);
 			else
 				ListMountedVolumes (cmdLine.ArgVolumes);
+			if (!cmdLine.ArgUnresolvedMounts.empty()) throw VolumeDiscoveryFailed (SRC_POS, wstring (cmdLine.ArgUnresolvedMounts.front()));
 			return true;
 
 		case CommandId::RestoreHeaders:
@@ -1914,6 +1965,9 @@ const FileManager fileManagers[] = {
 		VC_CONVERT_EXCEPTION (MountPointUnavailable);
 		VC_CONVERT_EXCEPTION (MountServiceIncompatible);
 		VC_CONVERT_EXCEPTION (MountServiceCleanupFailed);
+		VC_CONVERT_EXCEPTION (DismountServiceCleanupFailed);
+		VC_CONVERT_EXCEPTION (MountServiceUnavailable);
+		VC_CONVERT_EXCEPTION (VolumeDiscoveryFailed);
 		VC_CONVERT_EXCEPTION (NoDriveLetterAvailable);
 		VC_CONVERT_EXCEPTION (TemporaryDirectoryFailure);
 		VC_CONVERT_EXCEPTION (UnsupportedSectorSizeHiddenVolumeProtection);

src/Main/UserInterface.h

@@ -61,6 +61,7 @@ namespace VeraCrypt
 		virtual void ListEMVTokenKeyfiles () const = 0;
 		virtual shared_ptr <VolumeInfo> MountVolume (MountOptions &options, bool tryCachedPasswords = true) const;
 		virtual shared_ptr <VolumeInfo> MountVolumeThread (MountOptions &options) const { return Core->MountVolume (options);}
+		virtual shared_ptr <VolumeInfo> DismountVolumeThread (shared_ptr <VolumeInfo> volume, bool ignoreOpenFiles, bool interactive = true) const { return Core->DismountVolume (volume, ignoreOpenFiles); }
 		virtual VolumeInfoList MountAllDeviceHostedVolumes (MountOptions &options) const;
 		virtual VolumeInfoList MountAllFavoriteVolumes (MountOptions &options);
 		virtual void OpenExplorerWindow (const DirectoryPath &path);

src/Main/VolumeSnapshot.h

@@ -0,0 +1,48 @@
+/*
+ Copyright (c) 2026 AM Crypto. All rights reserved.
+
+ Governed by the Apache License 2.0, included in License.txt.
+*/
+
+// Local GUI discovery state. Kept independent of wxWidgets so lifecycle
+// decisions can be checked without a native event loop or mounted volumes.
+#ifndef TC_HEADER_Main_VolumeSnapshot
+#define TC_HEADER_Main_VolumeSnapshot
+
+#include <chrono>
+
+namespace VeraCrypt
+{
+	class VolumeSnapshotState
+	{
+	public:
+		using Clock = std::chrono::steady_clock;
+		VolumeSnapshotState () : Available (false), Current (false), Complete (false) { }
+
+		// Staleness only suspends decisions. Activity counters are cumulative per
+		// volume instance, so observation gaps do not invalidate idle tracking.
+		void RecordSample (Clock::time_point sampledAt, bool complete)
+		{
+			Available = Current = true;
+			Complete = complete;
+			SampledAt = sampledAt;
+		}
+		void Invalidate () { Current = false; }
+		bool HasSample () const { return Available; }
+		bool IsComplete () const { return Current && Complete; }
+		bool IsFresh (Clock::time_point now = Clock::now()) const
+		{
+			return Current && Available && now - SampledAt < std::chrono::seconds (6);
+		}
+		bool CanConfirmEmpty (bool empty, Clock::time_point now = Clock::now()) const
+		{
+			return empty && IsComplete() && IsFresh (now);
+		}
+
+	private:
+		bool Available, Current, Complete;
+		Clock::time_point SampledAt;
+	};
+}
+
+#endif