ClickOnce Automatic Updates Require Application Restart Despite Zero-Downtime Requirement

Context

A VB.NET WinForms application targets .NET 8 and uses ClickOnce for deployment. The operations team requires true zero-downtime updates — meaning the running process must not restart when a new version is deployed.

Constraint

The ApplicationDeployment.UpdateAsync method downloads the new deployment manifest and assemblies, but the documented behavior explicitly calls Application.Restart() to apply the update. ClickOnce does not leverage .NET's side-by-side assembly loading via AssemblyLoadContext for in-process hot-swapping.

Uncertainty

It is unclear whether any supported configuration, event hook, or manifest setting can suppress the mandatory restart while still allowing the updated assemblies to be loaded into the existing process. The ApplicationDeployment class exposes CheckForUpdateCompleted and UpdateCompleted events, but documentation indicates the restart occurs before these events fire.

• Can the restart be deferred or canceled programmatically after UpdateAsync completes?
• Is there a supported pattern to load the newly downloaded assemblies into the current AssemblyLoadContext without process termination?
• If ClickOnce cannot achieve this, what is the minimal architectural change — separate updater process, MSIX with package extensions, or external orchestrator — that preserves the existing deployment pipeline?