I3178 — A self update killed at any stage leaves a usable installation

✕BLOCKED wave 2 · p2 · verification profile · parallel safe

Part of safe-self-update — Every mesh node follows the published release by itself, versions meet safely, and a release's provenance can be checked.

Objective

Drive the installer that self update runs through an interrupted download, a kill at each stage (download, verify, stage, swap, health check), a failed post-update readiness and two concurrent updates, and hold that each ends with the previous or the new version runnable and saying which.

Why

ADR 0161 makes the installer the single implementation of the risky part; I2720 wraps it and I2722 rolls a hub back. The 10-08 pack required stage-by-stage fault injection (U04-U14); nothing exercises those paths today. Sources: chatgpt-majordomus:c200#2.

Current state

Verified: case 85_installer tests the installer's happy path; I2720 READY and I2722 BLOCKED on it (majordomus plan show, 2026-10-18); no case kills install.sh mid-stage.

Desired state

One case per stage under a disposable prefix, run by the rust or structure job.

Scope

• share/install/install.sh.in
• scripts/ci/install-check

Out of scope

• Rewriting the installer in Rust (refused by ADR 0161)

Dependencies

• I2720○READY majordomus self update re-runs the published installer, and never reimplements it
• I2722✕BLOCKED A hub activates a new version under its service manager, checks its health and rolls back by itself

Acceptance criteria

• Every stage kill leaves a launcher that runs and names its version
• Two concurrent updates end with one winner and no torn prefix

Validation

• majordomus plan validate
• bash test/run.sh 85_installer

Evidence required

• case_an_interrupted_update_recovers

Evidence

None recorded. Every token above needs a command or an artifact behind it before this issue can be completed; narrative is refused.

Timeline

started

—

verified

—

completed

—

Those three fields, the evidence above and the state of the dependencies are all the status is made of. There is no status field to disagree with them.

Canonical record: .ai/repo/project/issues/I3178.yaml. Read it back with majordomus plan show I3178.