Repository navigation
UP-02: Stage one complete release #108
Description
Part of #89.
Owner: Anders (@andersalm).
Depends on UP-01 (#107) and a reviewed installation layout.
Done means
Release acceptance: Each exposed feature works clearly from start to end, including recovery. Keep unfinished or confusing features hidden until their complete journey passes. Hiding a feature does not complete its task; source checks alone do not establish installed acceptance.
- Stage and verify the complete signed set while live files remain in use unchanged. (PR #246)
- Consumed release metadata stays separate from the Home's own Publisher output. (evidence: UP-07: Accept updates on Mac, Linux and Jetson #113 (comment))
- One lock coordinates installer, updater and migration. Fresh install, custom paths, rerun and legacy upgrade follow that contract. (evidence: UP-07: Accept updates on Mac, Linux and Jetson #113 (comment))
- Interruption and low disk leave a recoverable state and keep one shared fixed free-space reserve after the write (no percentage of the volume). (evidence: UP-02: Stage one complete release #108 (comment), UP-02: Stage one complete release #108 (comment))
- Retention is bounded to the active set, one staged set and one verified rollback for the current update window. (evidence: cleanup after commit in install_transaction.rs, tests committed_cleanup_*; offline Undo moved to Undo without a network: keep the previous release until the next update #297)
Browser plan reconciliation — 2026-10-08
#288 consumes this issue's single installation writer/journal and compatible-generation output for Browser image/helpers/configuration. The image staging lock may serialize its own stage under that authority. Activation and interruption recovery retain one canonical writer; an admitted active or unresolved Browser VM retains its exact dependency closure and profile barrier until #131 settlement/reconciliation proves release. Source tests must connect the real #217 producer closure to the consumer, rather than accept separate handcrafted fixtures.
Activity
andersalm commentedon Sep 29, 2026
Retained staging checks: reject a staged executable that fails validation, then prove a corrected retry succeeds. Review the migration backup helper before reuse: earlier source analysis found that it takes the host lock and requires a direct child of the backup directory. Avoid taking that lock recursively beneath the installation lock. Keep data-migration backups separate from release directories, with a size estimate and cleanup condition. Recheck those source facts on the selected candidate.
andersalm commentedon Sep 30, 2026
UP-02 owns the interrupted installation found by UP-01 proof on PR #132 candidate
47658723.update.rs:972replaces the running binary before writingcomponents.json;host_lock.rs:203exits 75 when the installed executable changes. The operator test therefore left a new binary with the old manifest and source record.Acceptance here must stage and verify the complete set, coordinate the commit with the host, and prove interruption recovery without that mixed set. The retained UP-01 run and CLI recovery receipts are test inputs.
This work remains dependent on #107; automatic restart belongs to #109.
andersalm commentedon Oct 1, 2026
#107 is merged and its accepted update proof remains available; #108 stays in milestone 0.7.3.
The current updater admits signed metadata, then replaces the binary before the manifest and support assets. The retained operator exit 75 therefore remains the complete-set staging test input.
The next step depends on a reviewed installation layout: select the active/staged set paths and shared lock contract before changing that commit seam. Migration backup ownership stays separate.
#156 is in final qualification for its own admission scope; #109 owns automatic restart. #108 remains open at the layout gate.
andersalm commentedon Oct 1, 2026
Candidate
66331ea0proposes the installation contract in draft PR #161, based ondevelopat2b93cfa2; divergence is 0/0 and CI 36868186954 is running.The proposal selects Runtime, manifest, providers and capsules together through one immutable set and atomic active pointer, with a stable custom-path launcher and separate Home-owned data/Publisher output.
It defines one installation→host→object lock order, a future migration entry with an already-held host guard, transaction recovery, disk reserve and bounded retention.
All four basic gates pass. Existing Homes and files remain unchanged; reviewed-layout approval comes before filesystem implementation and installed interruption proof. #109 owns automatic restart.
andersalm commentedon Oct 1, 2026
Candidate:
66331ea07a7c2dafd2812b91a076d7eeae49e606in draft PR #161, based on develop; origin divergence 0/0.CI: 36868186954 is running; the four basic gates pass for this documentation change.
Independent proposal review, round 1: pass. One pinned release set owns Runtime, manifest and release assets; Home retains data/configuration and Publisher output. The contract specifies one lock order, one migration host guard, atomic selection and recovery.
Result: a concrete layout is ready for its required review; implementation and installed acceptance remain open. Existing files and Homes are unchanged.
Next: reviewed-layout approval before filesystem implementation; #109 retains automatic restart ownership.
andersalm commentedon Oct 1, 2026
Candidate
66331ea0in PR #161 is ready for review; CI 36868186954 passed all eight required checks.Independent layout review round 1 and all four basic gates pass; this remains a proposed contract.
irzhywauwas requested once as the required human reviewer. Implementation waits for Irzhy’s layout review, then exact installed interruption and recovery proof.The issue remains open in QA / Review; source and Homes are unchanged.
andersalm commentedon Oct 1, 2026
PR #161 layout proposal remains at
66331ea07a7c2dafd2812b91a076d7eeae49e606; task/remote divergence is 0/0.Independent proposal review round 2 PASS on diff SHA-256
b301462419b0371d8a64f6a8a6c0c316383bd2af4a6ef03b6db5b1f45a07066f: complete-set staging, active-pointer recovery and Home data/trust ownership are coherent.Current
develop@c9205a74merges cleanly as treec5b705aa106cf5f45ecb50e6097a948c0385d90e; narrow diff checks pass, with task 2 behind / 1 ahead of develop.This docs-only proposal adds existing-release layout rules and leaves authority within #173's boundaries; production signing stays under its existing gate.
Next: Irzhy's layout approval before implementation, then exact installed interruption/recovery proof. Source review keeps #108 open for its full journey.
8 remaining items
fix(install): refuse every installer case before Runtime stops
fix: keep a fixed 2 GiB free-space reserve for updates and the installer
fix: keep a fixed 2 GiB free-space reserve for updates and the installer
fix: keep a fixed 2 GiB free-space reserve for updates and the installer
fix: one shared 2 GiB free-space reserve for every user-facing write
fix: setup component installs keep the shared 2 GiB free-space reserve
andersalm commentedon Oct 6, 2026
Status (6 Oct): ticked 1 box from PR #246.
Open: metadata separation, one lock incl. custom paths/migration, interruption/low disk, retention.
andersalm commentedon Oct 8, 2026
Real interrupted update (Jetson, 8 Oct):
elastos updatealpha.8 → alpha.9 killed with SIGKILL right after the 98.6 MB binary download; the Home stayed on alpha.8, and the nextelastos updatecompleted to alpha.9 (installed files = signed hashes, home status ok). Log: ops hops/jetson-interrupt-20261008T151504Z.log.andersalm commentedon Oct 8, 2026
Real low-disk refusal (Linux x86-64, 8 Oct): with 1.0 GB free,
elastos updatealpha.9 → alpha.10 stopped with 'not enough free space: this needs 0.3 GB plus 2 GB kept free' and stayed on alpha.9; after freeing space the same update completed to alpha.10.andersalm commentedon Oct 8, 2026
Done: every box ticked with evidence (8 Oct, alpha.9/alpha.10 real runs and merged PRs).
andersalm commentedon Oct 22, 2026
22 October audit: the Normal CLI support rollback gap remains
Source review of fetched develop
3beb81643and candidate460b1888d344f52cebd1c25866be88ff4085f035confirms the Normal CLI failure path previously recorded in this issue.elastos/crates/elastos-server/src/update.rs:1573-1598journals the five release files and optional model catalogue, activates them, then refreshes support in place.setup.rs:3797-3839writes successive live provider/capsule paths. If a later refresh fails,update.rs:1652-1656calls recovery, which restores the journal's support entries (install_transaction.rs:645-655). Earlier newly written support may remain beside the restored old checksums.The System staged-restart path has separate complete-support staging. The real interrupted-download and low-disk receipts above do not exercise failure after one changed support asset has been installed. #297 concerns offline Undo after success; it does not dispose of this failed-update case.
Recommendation: P1, restore this gate to active release triage under #89/#93. Reuse the complete transaction for the CLI path. Test a failed second support download after the first succeeds, and interruption after the first support replacement. The previous binary, manifests, providers and capsules must form one verified set, reopen Home, and retain user data.
Two source reviewers confirmed the current call path. This audit ran no installed reproduction and leaves the issue state unchanged pending owner triage; its closed state should not be used as proof that this path is covered.
andersalm commentedon Oct 22, 2026
Disposition for the 0.8.0-alpha.25 freeze (22 Oct): the candidate change for this gap (
4010ea154,67ff715caonfix/108-cli-update-support-rollback) is not in alpha.25.elastos updaterepairs the installed release's support when the signed files are still available. This is conditional, not a guarantee. Two cases are known not to be repaired:elastos update, while System's pending-update refusal says to runelastos home --browser.