Repository navigation
feat: preserve service during Homebrew upgrades - #223
Merged
Merged
Conversation
- Restored services with independent cancellation and verified unload ordering. - Distinguished package replacement from genuine removal through scoped callbacks. - Added native callback and recovery regressions.
- Staged immutable executables outside package version directories. - Validated build identity, architecture and protocol without acquiring credentials. - Persisted bounded upgrade receipts with monotonic transitions and atomic writes.
- Tracked active streams, turns and accepted headers through completion. - Preserved listener sockets during reversible admission pauses. - Added worker quiescence probes and measured backlog overflow.
- Authenticated local transactions and retained artifact metadata. - Deferred busy upgrades without releasing coordinator ownership. - Restored previous workers after failed handoffs with fresh deadlines. - Blocked competing transitions and preserved retry identities.
- Checked delayed resets after connection acknowledgement. - Used a bounded burst large enough to exhaust kernel queues.
- Preserved managed process identity and socket descriptors across runtime replacement. - Added authenticated guard recovery with bounded attempts and owner release proof. - Restored previous runtimes after failed candidate boot and recorded fault limits.
- Kept proxy registration stable during runtime selection. - Restored retained runtimes and refresh ownership on failure. - Verified removal before cleaning retained state. - Documented deferral and first-adoption maintenance limits.
- Exercised retained listeners, rollback and package metadata. - Preserved poller descriptors during same-process replacement. - Sealed inherited descriptors before launching children. - Recorded traffic and first-adoption interruption separately.
- Exercised the public Homebrew uninstall operation. - Checked package metadata and runtime journal removal. - Verified user configuration, credentials and logs survived.
- Tracked accepted connections before paused handoff and recovered workers after deferred upgrades. - Preserved rollback ownership and release proofs through failed setup or persistence. - Reconciled lost acknowledgements and verified retained runtime management independently. - Expanded native regression coverage for setup failures, inspection, snapshots and full removal.
- Allowed exact configured bootstrap inspection before ownership publication. - Kept unowned package inspection rejected and covered initial installation ordering. - Documented expanded native setup and management checks.
- Decoded public status verdict independently of internal warning representation. - Preserved native retained-runtime management acceptance checks.
- Checked public success and state fields for native package inspection. - Kept internal warning details outside the acceptance assertion.
- Accepted verified stable package identity for snapshot and restore actions. - Kept foreign owners rejected and inherited installer locks required. - Supplied real lock capabilities in native management coverage.
- Waited for verified live runtime after restored service registration. - Checked selected digest and routed traffic after startup completed.
- Retained bootstrap, refresh, selected and rollback executables. - Serialised staging, preparation and cleanup with a private lock. - Kept unknown entries and preserved successful upgrades on cleanup errors. - Added native lifecycle checks for retention and removal.
- Pinned saved executable references under the shared retention lock. - Checked saved executables before changing service jobs. - Released pins for deleted snapshots and genuine removal. - Covered older snapshots, failed validation and native reinstall cleanup.
- Bound release service checks to verified retained runtime bytes and identity. - Proved exact-package reinstall retained its proxy PID and transport. - Replaced stale missing-binary cleanup expectations with verified uninstall. - Covered legacy, retained, unsafe and mismatched status fixtures.
- Required retained digest, selected version and reinstall PID verification. - Rejected deletion of the verified package before genuine uninstall.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Homebrew upgrades currently remove the running proxy before installing its successor, interrupting admitted work and dropping the listener. Compatible macOS upgrades now stage immutable executables, wait for a quiet boundary, and replace the runtime while retaining the managed PID and TCP listener. A private guard retains recovery ownership; failed successors roll back and busy runtimes defer without stopping service.
Package ownership, startup executables and selected runtimes are verified independently. Refresh rollback, status, snapshot/restore and genuine uninstall follow the retained runtime lifecycle. Automatic pruning keeps bootstrap, latest rollback pair and saved snapshot references. Homebrew persists the same-token successor callback for subsequent upgrades.
Validation: full serial race suite, build, vet and Linux/Windows cross-builds passed. Native Homebrew/launchd matrix completed 141/141 admitted turns, HTTP 200=126 and WebSocket 101=14, with zero 503/refused/continuity errors and preserved compatible-upgrade PID/listener. Matrix includes four rollback failures, busy deferral, snapshot/restore, pruning, reinstall and complete uninstall. Whole-branch review findings and pruning follow-up finding are resolved with regressions.
First adoption from legacy metadata remains a maintenance upgrade (12.85-second gap measured separately). Native source fixtures use isolated labels and synthetic upstreams; real Codex upstream and exact release artifact qualification run before deployment. Linux/Windows seamless replacement remains outside this scope.
Release gates now verify retained selected bytes/version separately from bootstrap, exercise an exact-package reinstall with preserved proxy PID and transport, and perform verified genuine uninstall. Hook and status regressions passed, including rejected missing executables, mismatched selection, unsafe modes and forged retained digests. Actual Homebrew install gates run on isolated macOS CI runners.