An app.json that exists but cannot be read, or a .bak that cannot be written, now yields defaults instead of an unhandled exception before the main window exists. A failed write at exit is logged and ignored, and the session is disposed in a finally block, so the lock and connection are always released.