fix(server): skip the update backup when no migrations are pending - #1711

…1711)

## Problem

The service launcher copies the whole database before every update trial, after the old server stops.
On a 22 GB database that is about 91 s of downtime, even when the update adds no migrations.

## Change

1. Launcher runs the target's `__service-preflight`
2. Preflight reports pending migrations
3. Launcher backs up only if some are pending
4. Preflight failure still backs up
5. Launcher context stripped from every child

Step 5 closes the path that overwrote a live `statev2.sqlite` from a test run.

## Scope and approval

Refs #1707, settled in the #1705 profile.
The downtime goal needs the launcher from this build, so its VM proof follows the next nightly.

## Verification

| Check | Result |
| --- | --- |
| Launcher, preflight, context tests | 19/19 pass |
| `tsc --noEmit` on `apps/server` | exit 0 |
| `vp run fork:ci` | exit 0 |

Claude Opus 5.5 in Claude Code, hosted by T3 Code.

## Fork trailers

Fork-Domain: upstream-fixes
Fork-Tier: bugfix
Fork-Upstreamable: no
Co-authored-by: donjor <[email protected]>

…1711)

## Problem

The service launcher copies the whole database before every update trial, after the old server stops.
On a 22 GB database that is about 91 s of downtime, even when the update adds no migrations.

## Change

1. Launcher runs the target's `__service-preflight`
2. Preflight reports pending migrations
3. Launcher backs up only if some are pending
4. Preflight failure still backs up
5. Launcher context stripped from every child

Step 5 closes the path that overwrote a live `statev2.sqlite` from a test run.

## Scope and approval

Refs #1707, settled in the #1705 profile.
The downtime goal needs the launcher from this build, so its VM proof follows the next nightly.

## Verification

| Check | Result |
| --- | --- |
| Launcher, preflight, context tests | 19/19 pass |
| `tsc --noEmit` on `apps/server` | exit 0 |
| `vp run fork:ci` | exit 0 |

Claude Opus 5.5 in Claude Code, hosted by T3 Code.

## Fork trailers

Fork-Domain: upstream-fixes
Fork-Tier: bugfix
Fork-Upstreamable: no
Co-authored-by: donjor <[email protected]>

…1711)

## Problem

The service launcher copies the whole database before every update trial, after the old server stops.
On a 22 GB database that is about 91 s of downtime, even when the update adds no migrations.

## Change

1. Launcher runs the target's `__service-preflight`
2. Preflight reports pending migrations
3. Launcher backs up only if some are pending
4. Preflight failure still backs up
5. Launcher context stripped from every child

Step 5 closes the path that overwrote a live `statev2.sqlite` from a test run.

## Scope and approval

Refs #1707, settled in the #1705 profile.
The downtime goal needs the launcher from this build, so its VM proof follows the next nightly.

## Verification

| Check | Result |
| --- | --- |
| Launcher, preflight, context tests | 19/19 pass |
| `tsc --noEmit` on `apps/server` | exit 0 |
| `vp run fork:ci` | exit 0 |

Claude Opus 5.5 in Claude Code, hosted by T3 Code.

## Fork trailers

Fork-Domain: upstream-fixes
Fork-Tier: bugfix
Fork-Upstreamable: no
Co-authored-by: donjor <[email protected]>

…1711)

## Problem

The service launcher copies the whole database before every update trial, after the old server stops.
On a 22 GB database that is about 91 s of downtime, even when the update adds no migrations.

## Change

1. Launcher runs the target's `__service-preflight`
2. Preflight reports pending migrations
3. Launcher backs up only if some are pending
4. Preflight failure still backs up
5. Launcher context stripped from every child

Step 5 closes the path that overwrote a live `statev2.sqlite` from a test run.

## Scope and approval

Refs #1707, settled in the #1705 profile.
The downtime goal needs the launcher from this build, so its VM proof follows the next nightly.

## Verification

| Check | Result |
| --- | --- |
| Launcher, preflight, context tests | 19/19 pass |
| `tsc --noEmit` on `apps/server` | exit 0 |
| `vp run fork:ci` | exit 0 |

Claude Opus 5.5 in Claude Code, hosted by T3 Code.

## Fork trailers

Fork-Domain: upstream-fixes
Fork-Tier: bugfix
Fork-Upstreamable: no
Co-authored-by: donjor <[email protected]>

…1711)

## Problem

The service launcher copies the whole database before every update trial, after the old server stops.
On a 22 GB database that is about 91 s of downtime, even when the update adds no migrations.

## Change

1. Launcher runs the target's `__service-preflight`
2. Preflight reports pending migrations
3. Launcher backs up only if some are pending
4. Preflight failure still backs up
5. Launcher context stripped from every child

Step 5 closes the path that overwrote a live `statev2.sqlite` from a test run.

## Scope and approval

Refs #1707, settled in the #1705 profile.
The downtime goal needs the launcher from this build, so its VM proof follows the next nightly.

## Verification

| Check | Result |
| --- | --- |
| Launcher, preflight, context tests | 19/19 pass |
| `tsc --noEmit` on `apps/server` | exit 0 |
| `vp run fork:ci` | exit 0 |

Claude Opus 5.5 in Claude Code, hosted by T3 Code.

## Fork trailers

Fork-Domain: upstream-fixes
Fork-Tier: bugfix
Fork-Upstreamable: no
Co-authored-by: donjor <[email protected]>

…1711)

## Problem

The service launcher copies the whole database before every update trial, after the old server stops.
On a 22 GB database that is about 91 s of downtime, even when the update adds no migrations.

## Change

1. Launcher runs the target's `__service-preflight`
2. Preflight reports pending migrations
3. Launcher backs up only if some are pending
4. Preflight failure still backs up
5. Launcher context stripped from every child

Step 5 closes the path that overwrote a live `statev2.sqlite` from a test run.

## Scope and approval

Refs #1707, settled in the #1705 profile.
The downtime goal needs the launcher from this build, so its VM proof follows the next nightly.

## Verification

| Check | Result |
| --- | --- |
| Launcher, preflight, context tests | 19/19 pass |
| `tsc --noEmit` on `apps/server` | exit 0 |
| `vp run fork:ci` | exit 0 |

Claude Opus 5.5 in Claude Code, hosted by T3 Code.

## Fork trailers

Fork-Domain: upstream-fixes
Fork-Tier: bugfix
Fork-Upstreamable: no
Co-authored-by: donjor <[email protected]>

…1711)

## Problem

The service launcher copies the whole database before every update trial, after the old server stops.
On a 22 GB database that is about 91 s of downtime, even when the update adds no migrations.

## Change

1. Launcher runs the target's `__service-preflight`
2. Preflight reports pending migrations
3. Launcher backs up only if some are pending
4. Preflight failure still backs up
5. Launcher context stripped from every child

Step 5 closes the path that overwrote a live `statev2.sqlite` from a test run.

## Scope and approval

Refs #1707, settled in the #1705 profile.
The downtime goal needs the launcher from this build, so its VM proof follows the next nightly.

## Verification

| Check | Result |
| --- | --- |
| Launcher, preflight, context tests | 19/19 pass |
| `tsc --noEmit` on `apps/server` | exit 0 |
| `vp run fork:ci` | exit 0 |

Claude Opus 5.5 in Claude Code, hosted by T3 Code.

## Fork trailers

Fork-Domain: upstream-fixes
Fork-Tier: bugfix
Fork-Upstreamable: no
Co-authored-by: donjor <[email protected]>

…1711)

## Problem

The service launcher copies the whole database before every update trial, after the old server stops.
On a 22 GB database that is about 91 s of downtime, even when the update adds no migrations.

## Change

1. Launcher runs the target's `__service-preflight`
2. Preflight reports pending migrations
3. Launcher backs up only if some are pending
4. Preflight failure still backs up
5. Launcher context stripped from every child

Step 5 closes the path that overwrote a live `statev2.sqlite` from a test run.

## Scope and approval

Refs #1707, settled in the #1705 profile.
The downtime goal needs the launcher from this build, so its VM proof follows the next nightly.

## Verification

| Check | Result |
| --- | --- |
| Launcher, preflight, context tests | 19/19 pass |
| `tsc --noEmit` on `apps/server` | exit 0 |
| `vp run fork:ci` | exit 0 |

Claude Opus 5.5 in Claude Code, hosted by T3 Code.

## Fork trailers

Fork-Domain: upstream-fixes
Fork-Tier: bugfix
Fork-Upstreamable: no
Co-authored-by: donjor <[email protected]>

…1711)

## Problem

The service launcher copies the whole database before every update trial, after the old server stops.
On a 22 GB database that is about 91 s of downtime, even when the update adds no migrations.

## Change

1. Launcher runs the target's `__service-preflight`
2. Preflight reports pending migrations
3. Launcher backs up only if some are pending
4. Preflight failure still backs up
5. Launcher context stripped from every child

Step 5 closes the path that overwrote a live `statev2.sqlite` from a test run.

## Scope and approval

Refs #1707, settled in the #1705 profile.
The downtime goal needs the launcher from this build, so its VM proof follows the next nightly.

## Verification

| Check | Result |
| --- | --- |
| Launcher, preflight, context tests | 19/19 pass |
| `tsc --noEmit` on `apps/server` | exit 0 |
| `vp run fork:ci` | exit 0 |

Claude Opus 5.5 in Claude Code, hosted by T3 Code.

## Fork trailers

Fork-Domain: upstream-fixes
Fork-Tier: bugfix
Fork-Upstreamable: no
Co-authored-by: donjor <[email protected]>

…1711)

## Problem

The service launcher copies the whole database before every update trial, after the old server stops.
On a 22 GB database that is about 91 s of downtime, even when the update adds no migrations.

## Change

1. Launcher runs the target's `__service-preflight`
2. Preflight reports pending migrations
3. Launcher backs up only if some are pending
4. Preflight failure still backs up
5. Launcher context stripped from every child

Step 5 closes the path that overwrote a live `statev2.sqlite` from a test run.

## Scope and approval

Refs #1707, settled in the #1705 profile.
The downtime goal needs the launcher from this build, so its VM proof follows the next nightly.

## Verification

| Check | Result |
| --- | --- |
| Launcher, preflight, context tests | 19/19 pass |
| `tsc --noEmit` on `apps/server` | exit 0 |
| `vp run fork:ci` | exit 0 |

Claude Opus 5.5 in Claude Code, hosted by T3 Code.

## Fork trailers

Fork-Domain: upstream-fixes
Fork-Tier: bugfix
Fork-Upstreamable: no
Co-authored-by: donjor <[email protected]>

…1711)

## Problem

The service launcher copies the whole database before every update trial, after the old server stops.
On a 22 GB database that is about 91 s of downtime, even when the update adds no migrations.

## Change

1. Launcher runs the target's `__service-preflight`
2. Preflight reports pending migrations
3. Launcher backs up only if some are pending
4. Preflight failure still backs up
5. Launcher context stripped from every child

Step 5 closes the path that overwrote a live `statev2.sqlite` from a test run.

## Scope and approval

Refs #1707, settled in the #1705 profile.
The downtime goal needs the launcher from this build, so its VM proof follows the next nightly.

## Verification

| Check | Result |
| --- | --- |
| Launcher, preflight, context tests | 19/19 pass |
| `tsc --noEmit` on `apps/server` | exit 0 |
| `vp run fork:ci` | exit 0 |

Claude Opus 5.5 in Claude Code, hosted by T3 Code.

## Fork trailers

Fork-Domain: upstream-fixes
Fork-Tier: bugfix
Fork-Upstreamable: no
Co-authored-by: donjor <[email protected]>

…1711)

## Problem

The service launcher copies the whole database before every update trial, after the old server stops.
On a 22 GB database that is about 91 s of downtime, even when the update adds no migrations.

## Change

1. Launcher runs the target's `__service-preflight`
2. Preflight reports pending migrations
3. Launcher backs up only if some are pending
4. Preflight failure still backs up
5. Launcher context stripped from every child

Step 5 closes the path that overwrote a live `statev2.sqlite` from a test run.

## Scope and approval

Refs #1707, settled in the #1705 profile.
The downtime goal needs the launcher from this build, so its VM proof follows the next nightly.

## Verification

| Check | Result |
| --- | --- |
| Launcher, preflight, context tests | 19/19 pass |
| `tsc --noEmit` on `apps/server` | exit 0 |
| `vp run fork:ci` | exit 0 |

Claude Opus 5.5 in Claude Code, hosted by T3 Code.

## Fork trailers

Fork-Domain: upstream-fixes
Fork-Tier: bugfix
Fork-Upstreamable: no
Co-authored-by: donjor <[email protected]>

…1711)

## Problem

The service launcher copies the whole database before every update trial, after the old server stops.
On a 22 GB database that is about 91 s of downtime, even when the update adds no migrations.

## Change

1. Launcher runs the target's `__service-preflight`
2. Preflight reports pending migrations
3. Launcher backs up only if some are pending
4. Preflight failure still backs up
5. Launcher context stripped from every child

Step 5 closes the path that overwrote a live `statev2.sqlite` from a test run.

## Scope and approval

Refs #1707, settled in the #1705 profile.
The downtime goal needs the launcher from this build, so its VM proof follows the next nightly.

## Verification

| Check | Result |
| --- | --- |
| Launcher, preflight, context tests | 19/19 pass |
| `tsc --noEmit` on `apps/server` | exit 0 |
| `vp run fork:ci` | exit 0 |

Claude Opus 5.5 in Claude Code, hosted by T3 Code.

## Fork trailers

Fork-Domain: upstream-fixes
Fork-Tier: bugfix
Fork-Upstreamable: no
Co-authored-by: donjor <[email protected]>

…1711)

## Problem

The service launcher copies the whole database before every update trial, after the old server stops.
On a 22 GB database that is about 91 s of downtime, even when the update adds no migrations.

## Change

1. Launcher runs the target's `__service-preflight`
2. Preflight reports pending migrations
3. Launcher backs up only if some are pending
4. Preflight failure still backs up
5. Launcher context stripped from every child

Step 5 closes the path that overwrote a live `statev2.sqlite` from a test run.

## Scope and approval

Refs #1707, settled in the #1705 profile.
The downtime goal needs the launcher from this build, so its VM proof follows the next nightly.

## Verification

| Check | Result |
| --- | --- |
| Launcher, preflight, context tests | 19/19 pass |
| `tsc --noEmit` on `apps/server` | exit 0 |
| `vp run fork:ci` | exit 0 |

Claude Opus 5.5 in Claude Code, hosted by T3 Code.

## Fork trailers

Fork-Domain: upstream-fixes
Fork-Tier: bugfix
Fork-Upstreamable: no
Co-authored-by: donjor <[email protected]>

…1711)

## Problem

The service launcher copies the whole database before every update trial, after the old server stops.
On a 22 GB database that is about 91 s of downtime, even when the update adds no migrations.

## Change

1. Launcher runs the target's `__service-preflight`
2. Preflight reports pending migrations
3. Launcher backs up only if some are pending
4. Preflight failure still backs up
5. Launcher context stripped from every child

Step 5 closes the path that overwrote a live `statev2.sqlite` from a test run.

## Scope and approval

Refs #1707, settled in the #1705 profile.
The downtime goal needs the launcher from this build, so its VM proof follows the next nightly.

## Verification

| Check | Result |
| --- | --- |
| Launcher, preflight, context tests | 19/19 pass |
| `tsc --noEmit` on `apps/server` | exit 0 |
| `vp run fork:ci` | exit 0 |

Claude Opus 5.5 in Claude Code, hosted by T3 Code.

## Fork trailers

Fork-Domain: upstream-fixes
Fork-Tier: bugfix
Fork-Upstreamable: no
Co-authored-by: donjor <[email protected]>

…1711)

## Problem

The service launcher copies the whole database before every update trial, after the old server stops.
On a 22 GB database that is about 91 s of downtime, even when the update adds no migrations.

## Change

1. Launcher runs the target's `__service-preflight`
2. Preflight reports pending migrations
3. Launcher backs up only if some are pending
4. Preflight failure still backs up
5. Launcher context stripped from every child

Step 5 closes the path that overwrote a live `statev2.sqlite` from a test run.

## Scope and approval

Refs #1707, settled in the #1705 profile.
The downtime goal needs the launcher from this build, so its VM proof follows the next nightly.

## Verification

| Check | Result |
| --- | --- |
| Launcher, preflight, context tests | 19/19 pass |
| `tsc --noEmit` on `apps/server` | exit 0 |
| `vp run fork:ci` | exit 0 |

Claude Opus 5.5 in Claude Code, hosted by T3 Code.

## Fork trailers

Fork-Domain: upstream-fixes
Fork-Tier: bugfix
Fork-Upstreamable: no
Co-authored-by: donjor <[email protected]>

…1711)

## Problem

The service launcher copies the whole database before every update trial, after the old server stops.
On a 22 GB database that is about 91 s of downtime, even when the update adds no migrations.

## Change

1. Launcher runs the target's `__service-preflight`
2. Preflight reports pending migrations
3. Launcher backs up only if some are pending
4. Preflight failure still backs up
5. Launcher context stripped from every child

Step 5 closes the path that overwrote a live `statev2.sqlite` from a test run.

## Scope and approval

Refs #1707, settled in the #1705 profile.
The downtime goal needs the launcher from this build, so its VM proof follows the next nightly.

## Verification

| Check | Result |
| --- | --- |
| Launcher, preflight, context tests | 19/19 pass |
| `tsc --noEmit` on `apps/server` | exit 0 |
| `vp run fork:ci` | exit 0 |

Claude Opus 5.5 in Claude Code, hosted by T3 Code.

## Fork trailers

Fork-Domain: upstream-fixes
Fork-Tier: bugfix
Fork-Upstreamable: no
Co-authored-by: donjor <[email protected]>

…1711)

## Problem

The service launcher copies the whole database before every update trial, after the old server stops.
On a 22 GB database that is about 91 s of downtime, even when the update adds no migrations.

## Change

1. Launcher runs the target's `__service-preflight`
2. Preflight reports pending migrations
3. Launcher backs up only if some are pending
4. Preflight failure still backs up
5. Launcher context stripped from every child

Step 5 closes the path that overwrote a live `statev2.sqlite` from a test run.

## Scope and approval

Refs #1707, settled in the #1705 profile.
The downtime goal needs the launcher from this build, so its VM proof follows the next nightly.

## Verification

| Check | Result |
| --- | --- |
| Launcher, preflight, context tests | 19/19 pass |
| `tsc --noEmit` on `apps/server` | exit 0 |
| `vp run fork:ci` | exit 0 |

Claude Opus 5.5 in Claude Code, hosted by T3 Code.

## Fork trailers

Fork-Domain: upstream-fixes
Fork-Tier: bugfix
Fork-Upstreamable: no
Co-authored-by: donjor <[email protected]>

…1711)

## Problem

The service launcher copies the whole database before every update trial, after the old server stops.
On a 22 GB database that is about 91 s of downtime, even when the update adds no migrations.

## Change

1. Launcher runs the target's `__service-preflight`
2. Preflight reports pending migrations
3. Launcher backs up only if some are pending
4. Preflight failure still backs up
5. Launcher context stripped from every child

Step 5 closes the path that overwrote a live `statev2.sqlite` from a test run.

## Scope and approval

Refs #1707, settled in the #1705 profile.
The downtime goal needs the launcher from this build, so its VM proof follows the next nightly.

## Verification

| Check | Result |
| --- | --- |
| Launcher, preflight, context tests | 19/19 pass |
| `tsc --noEmit` on `apps/server` | exit 0 |
| `vp run fork:ci` | exit 0 |

Claude Opus 5.5 in Claude Code, hosted by T3 Code.

## Fork trailers

Fork-Domain: upstream-fixes
Fork-Tier: bugfix
Fork-Upstreamable: no
Co-authored-by: donjor <[email protected]>

…1711)

## Problem

The service launcher copies the whole database before every update trial, after the old server stops.
On a 22 GB database that is about 91 s of downtime, even when the update adds no migrations.

## Change

1. Launcher runs the target's `__service-preflight`
2. Preflight reports pending migrations
3. Launcher backs up only if some are pending
4. Preflight failure still backs up
5. Launcher context stripped from every child

Step 5 closes the path that overwrote a live `statev2.sqlite` from a test run.

## Scope and approval

Refs #1707, settled in the #1705 profile.
The downtime goal needs the launcher from this build, so its VM proof follows the next nightly.

## Verification

| Check | Result |
| --- | --- |
| Launcher, preflight, context tests | 19/19 pass |
| `tsc --noEmit` on `apps/server` | exit 0 |
| `vp run fork:ci` | exit 0 |

Claude Opus 5.5 in Claude Code, hosted by T3 Code.

## Fork trailers

Fork-Domain: upstream-fixes
Fork-Tier: bugfix
Fork-Upstreamable: no
Co-authored-by: donjor <[email protected]>

…1711)

## Problem

The service launcher copies the whole database before every update trial, after the old server stops.
On a 22 GB database that is about 91 s of downtime, even when the update adds no migrations.

## Change

1. Launcher runs the target's `__service-preflight`
2. Preflight reports pending migrations
3. Launcher backs up only if some are pending
4. Preflight failure still backs up
5. Launcher context stripped from every child

Step 5 closes the path that overwrote a live `statev2.sqlite` from a test run.

## Scope and approval

Refs #1707, settled in the #1705 profile.
The downtime goal needs the launcher from this build, so its VM proof follows the next nightly.

## Verification

| Check | Result |
| --- | --- |
| Launcher, preflight, context tests | 19/19 pass |
| `tsc --noEmit` on `apps/server` | exit 0 |
| `vp run fork:ci` | exit 0 |

Claude Opus 5.5 in Claude Code, hosted by T3 Code.

## Fork trailers

Fork-Domain: upstream-fixes
Fork-Tier: bugfix
Fork-Upstreamable: no
Co-authored-by: donjor <[email protected]>

…ding (#1711)

Fork-Domain: upstream-fixes
Fork-Tier: bugfix
Fork-Upstreamable: no

…1711)

## Problem

The service launcher copies the whole database before every update trial, after the old server stops.
On a 22 GB database that is about 91 s of downtime, even when the update adds no migrations.

## Change

1. Launcher runs the target's `__service-preflight`
2. Preflight reports pending migrations
3. Launcher backs up only if some are pending
4. Preflight failure still backs up
5. Launcher context stripped from every child

Step 5 closes the path that overwrote a live `statev2.sqlite` from a test run.

## Scope and approval

Refs #1707, settled in the #1705 profile.
The downtime goal needs the launcher from this build, so its VM proof follows the next nightly.

## Verification

| Check | Result |
| --- | --- |
| Launcher, preflight, context tests | 19/19 pass |
| `tsc --noEmit` on `apps/server` | exit 0 |
| `vp run fork:ci` | exit 0 |

Claude Opus 5.5 in Claude Code, hosted by T3 Code.

## Fork trailers

Squashes:

- 3d6a528 fix(server): skip the update backup when no migrations are pending (#1711) (#1711)
- 858784c fixup! fix(server): skip the update backup when no migrations are pending (#1711) (#1711)

Fork-Domain: upstream-fixes
Fork-Tier: bugfix
Fork-Upstreamable: no
Co-authored-by: donjor <[email protected]>

…1711)

## Problem

The service launcher copies the whole database before every update trial, after the old server stops.
On a 22 GB database that is about 91 s of downtime, even when the update adds no migrations.

## Change

1. Launcher runs the target's `__service-preflight`
2. Preflight reports pending migrations
3. Launcher backs up only if some are pending
4. Preflight failure still backs up
5. Launcher context stripped from every child

Step 5 closes the path that overwrote a live `statev2.sqlite` from a test run.

## Scope and approval

Refs #1707, settled in the #1705 profile.
The downtime goal needs the launcher from this build, so its VM proof follows the next nightly.

## Verification

| Check | Result |
| --- | --- |
| Launcher, preflight, context tests | 19/19 pass |
| `tsc --noEmit` on `apps/server` | exit 0 |
| `vp run fork:ci` | exit 0 |

Claude Opus 5.5 in Claude Code, hosted by T3 Code.

## Fork trailers

Squashes:

- 3d6a528 fix(server): skip the update backup when no migrations are pending (#1711) (#1711)
- 858784c fixup! fix(server): skip the update backup when no migrations are pending (#1711) (#1711)

Fork-Domain: upstream-fixes
Fork-Tier: bugfix
Fork-Upstreamable: no
Co-authored-by: donjor <[email protected]>

…1711)

## Problem

The service launcher copies the whole database before every update trial, after the old server stops.
On a 22 GB database that is about 91 s of downtime, even when the update adds no migrations.

## Change

1. Launcher runs the target's `__service-preflight`
2. Preflight reports pending migrations
3. Launcher backs up only if some are pending
4. Preflight failure still backs up
5. Launcher context stripped from every child

Step 5 closes the path that overwrote a live `statev2.sqlite` from a test run.

## Scope and approval

Refs #1707, settled in the #1705 profile.
The downtime goal needs the launcher from this build, so its VM proof follows the next nightly.

## Verification

| Check | Result |
| --- | --- |
| Launcher, preflight, context tests | 19/19 pass |
| `tsc --noEmit` on `apps/server` | exit 0 |
| `vp run fork:ci` | exit 0 |

Claude Opus 5.5 in Claude Code, hosted by T3 Code.

## Fork trailers

Squashes:

- 3d6a528 fix(server): skip the update backup when no migrations are pending (#1711) (#1711)
- 858784c fixup! fix(server): skip the update backup when no migrations are pending (#1711) (#1711)

Fork-Domain: upstream-fixes
Fork-Tier: bugfix
Fork-Upstreamable: no
Co-authored-by: donjor <[email protected]>

…1711)

## Problem

The service launcher copies the whole database before every update trial, after the old server stops.
On a 22 GB database that is about 91 s of downtime, even when the update adds no migrations.

## Change

1. Launcher runs the target's `__service-preflight`
2. Preflight reports pending migrations
3. Launcher backs up only if some are pending
4. Preflight failure still backs up
5. Launcher context stripped from every child

Step 5 closes the path that overwrote a live `statev2.sqlite` from a test run.

## Scope and approval

Refs #1707, settled in the #1705 profile.
The downtime goal needs the launcher from this build, so its VM proof follows the next nightly.

## Verification

| Check | Result |
| --- | --- |
| Launcher, preflight, context tests | 19/19 pass |
| `tsc --noEmit` on `apps/server` | exit 0 |
| `vp run fork:ci` | exit 0 |

Claude Opus 5.5 in Claude Code, hosted by T3 Code.

## Fork trailers

Squashes:

- 3d6a528 fix(server): skip the update backup when no migrations are pending (#1711) (#1711)
- 858784c fixup! fix(server): skip the update backup when no migrations are pending (#1711) (#1711)

Fork-Domain: upstream-fixes
Fork-Tier: bugfix
Fork-Upstreamable: no
Co-authored-by: donjor <[email protected]>

…1711)

## Problem

The service launcher copies the whole database before every update trial, after the old server stops.
On a 22 GB database that is about 91 s of downtime, even when the update adds no migrations.

## Change

1. Launcher runs the target's `__service-preflight`
2. Preflight reports pending migrations
3. Launcher backs up only if some are pending
4. Preflight failure still backs up
5. Launcher context stripped from every child

Step 5 closes the path that overwrote a live `statev2.sqlite` from a test run.

## Scope and approval

Refs #1707, settled in the #1705 profile.
The downtime goal needs the launcher from this build, so its VM proof follows the next nightly.

## Verification

| Check | Result |
| --- | --- |
| Launcher, preflight, context tests | 19/19 pass |
| `tsc --noEmit` on `apps/server` | exit 0 |
| `vp run fork:ci` | exit 0 |

Claude Opus 5.5 in Claude Code, hosted by T3 Code.

## Fork trailers

Squashes:

- 3d6a528 fix(server): skip the update backup when no migrations are pending (#1711) (#1711)
- 858784c fixup! fix(server): skip the update backup when no migrations are pending (#1711) (#1711)

Fork-Domain: upstream-fixes
Fork-Tier: bugfix
Fork-Upstreamable: no
Co-authored-by: donjor <[email protected]>

…1711)

## Problem

The service launcher copies the whole database before every update trial, after the old server stops.
On a 22 GB database that is about 91 s of downtime, even when the update adds no migrations.

## Change

1. Launcher runs the target's `__service-preflight`
2. Preflight reports pending migrations
3. Launcher backs up only if some are pending
4. Preflight failure still backs up
5. Launcher context stripped from every child

Step 5 closes the path that overwrote a live `statev2.sqlite` from a test run.

## Scope and approval

Refs #1707, settled in the #1705 profile.
The downtime goal needs the launcher from this build, so its VM proof follows the next nightly.

## Verification

| Check | Result |
| --- | --- |
| Launcher, preflight, context tests | 19/19 pass |
| `tsc --noEmit` on `apps/server` | exit 0 |
| `vp run fork:ci` | exit 0 |

Claude Opus 5.5 in Claude Code, hosted by T3 Code.

## Fork trailers

Squashes:

- 3d6a528 fix(server): skip the update backup when no migrations are pending (#1711) (#1711)
- 858784c fixup! fix(server): skip the update backup when no migrations are pending (#1711) (#1711)

Fork-Domain: upstream-fixes
Fork-Tier: bugfix
Fork-Upstreamable: no
Co-authored-by: donjor <[email protected]>

…1711)

## Problem

The service launcher copies the whole database before every update trial, after the old server stops.
On a 22 GB database that is about 91 s of downtime, even when the update adds no migrations.

## Change

1. Launcher runs the target's `__service-preflight`
2. Preflight reports pending migrations
3. Launcher backs up only if some are pending
4. Preflight failure still backs up
5. Launcher context stripped from every child

Step 5 closes the path that overwrote a live `statev2.sqlite` from a test run.

## Scope and approval

Refs #1707, settled in the #1705 profile.
The downtime goal needs the launcher from this build, so its VM proof follows the next nightly.

## Verification

| Check | Result |
| --- | --- |
| Launcher, preflight, context tests | 19/19 pass |
| `tsc --noEmit` on `apps/server` | exit 0 |
| `vp run fork:ci` | exit 0 |

Claude Opus 5.5 in Claude Code, hosted by T3 Code.

## Fork trailers

Squashes:

- 3d6a528 fix(server): skip the update backup when no migrations are pending (#1711) (#1711)
- 858784c fixup! fix(server): skip the update backup when no migrations are pending (#1711) (#1711)

Fork-Domain: upstream-fixes
Fork-Tier: bugfix
Fork-Upstreamable: no
Co-authored-by: donjor <[email protected]>

…1711)

## Problem

The service launcher copies the whole database before every update trial, after the old server stops.
On a 22 GB database that is about 91 s of downtime, even when the update adds no migrations.

## Change

1. Launcher runs the target's `__service-preflight`
2. Preflight reports pending migrations
3. Launcher backs up only if some are pending
4. Preflight failure still backs up
5. Launcher context stripped from every child

Step 5 closes the path that overwrote a live `statev2.sqlite` from a test run.

## Scope and approval

Refs #1707, settled in the #1705 profile.
The downtime goal needs the launcher from this build, so its VM proof follows the next nightly.

## Verification

| Check | Result |
| --- | --- |
| Launcher, preflight, context tests | 19/19 pass |
| `tsc --noEmit` on `apps/server` | exit 0 |
| `vp run fork:ci` | exit 0 |

Claude Opus 5.5 in Claude Code, hosted by T3 Code.

## Fork trailers

Squashes:

- 3d6a528 fix(server): skip the update backup when no migrations are pending (#1711) (#1711)
- 858784c fixup! fix(server): skip the update backup when no migrations are pending (#1711) (#1711)

Fork-Domain: upstream-fixes
Fork-Tier: bugfix
Fork-Upstreamable: no
Co-authored-by: donjor <[email protected]>

…1711)

## Problem

The service launcher copies the whole database before every update trial, after the old server stops.
On a 22 GB database that is about 91 s of downtime, even when the update adds no migrations.

## Change

1. Launcher runs the target's `__service-preflight`
2. Preflight reports pending migrations
3. Launcher backs up only if some are pending
4. Preflight failure still backs up
5. Launcher context stripped from every child

Step 5 closes the path that overwrote a live `statev2.sqlite` from a test run.

## Scope and approval

Refs #1707, settled in the #1705 profile.
The downtime goal needs the launcher from this build, so its VM proof follows the next nightly.

## Verification

| Check | Result |
| --- | --- |
| Launcher, preflight, context tests | 19/19 pass |
| `tsc --noEmit` on `apps/server` | exit 0 |
| `vp run fork:ci` | exit 0 |

Claude Opus 5.5 in Claude Code, hosted by T3 Code.

## Fork trailers

Squashes:

- 3d6a528 fix(server): skip the update backup when no migrations are pending (#1711) (#1711)
- 858784c fixup! fix(server): skip the update backup when no migrations are pending (#1711) (#1711)

Fork-Domain: upstream-fixes
Fork-Tier: bugfix
Fork-Upstreamable: no
Co-authored-by: donjor <[email protected]>

…1711)

## Problem

The service launcher copies the whole database before every update trial, after the old server stops.
On a 22 GB database that is about 91 s of downtime, even when the update adds no migrations.

## Change

1. Launcher runs the target's `__service-preflight`
2. Preflight reports pending migrations
3. Launcher backs up only if some are pending
4. Preflight failure still backs up
5. Launcher context stripped from every child

Step 5 closes the path that overwrote a live `statev2.sqlite` from a test run.

## Scope and approval

Refs #1707, settled in the #1705 profile.
The downtime goal needs the launcher from this build, so its VM proof follows the next nightly.

## Verification

| Check | Result |
| --- | --- |
| Launcher, preflight, context tests | 19/19 pass |
| `tsc --noEmit` on `apps/server` | exit 0 |
| `vp run fork:ci` | exit 0 |

Claude Opus 5.5 in Claude Code, hosted by T3 Code.

## Fork trailers

Squashes:

- 3d6a528 fix(server): skip the update backup when no migrations are pending (#1711) (#1711)
- 858784c fixup! fix(server): skip the update backup when no migrations are pending (#1711) (#1711)

Fork-Domain: upstream-fixes
Fork-Tier: bugfix
Fork-Upstreamable: no
Co-authored-by: donjor <[email protected]>

…1711)

## Problem

The service launcher copies the whole database before every update trial, after the old server stops.
On a 22 GB database that is about 91 s of downtime, even when the update adds no migrations.

## Change

1. Launcher runs the target's `__service-preflight`
2. Preflight reports pending migrations
3. Launcher backs up only if some are pending
4. Preflight failure still backs up
5. Launcher context stripped from every child

Step 5 closes the path that overwrote a live `statev2.sqlite` from a test run.

## Scope and approval

Refs #1707, settled in the #1705 profile.
The downtime goal needs the launcher from this build, so its VM proof follows the next nightly.

## Verification

| Check | Result |
| --- | --- |
| Launcher, preflight, context tests | 19/19 pass |
| `tsc --noEmit` on `apps/server` | exit 0 |
| `vp run fork:ci` | exit 0 |

Claude Opus 5.5 in Claude Code, hosted by T3 Code.

## Fork trailers

Squashes:

- 3d6a528 fix(server): skip the update backup when no migrations are pending (#1711) (#1711)
- 858784c fixup! fix(server): skip the update backup when no migrations are pending (#1711) (#1711)

Fork-Domain: upstream-fixes
Fork-Tier: bugfix
Fork-Upstreamable: no
Co-authored-by: donjor <[email protected]>

…1711)

## Problem

The service launcher copies the whole database before every update trial, after the old server stops.
On a 22 GB database that is about 91 s of downtime, even when the update adds no migrations.

## Change

1. Launcher runs the target's `__service-preflight`
2. Preflight reports pending migrations
3. Launcher backs up only if some are pending
4. Preflight failure still backs up
5. Launcher context stripped from every child

Step 5 closes the path that overwrote a live `statev2.sqlite` from a test run.

## Scope and approval

Refs #1707, settled in the #1705 profile.
The downtime goal needs the launcher from this build, so its VM proof follows the next nightly.

## Verification

| Check | Result |
| --- | --- |
| Launcher, preflight, context tests | 19/19 pass |
| `tsc --noEmit` on `apps/server` | exit 0 |
| `vp run fork:ci` | exit 0 |

Claude Opus 5.5 in Claude Code, hosted by T3 Code.

## Fork trailers

Squashes:

- 3d6a528 fix(server): skip the update backup when no migrations are pending (#1711) (#1711)
- 858784c fixup! fix(server): skip the update backup when no migrations are pending (#1711) (#1711)

Fork-Domain: upstream-fixes
Fork-Tier: bugfix
Fork-Upstreamable: no
Co-authored-by: donjor <[email protected]>

…1711)

## Problem

The service launcher copies the whole database before every update trial, after the old server stops.
On a 22 GB database that is about 91 s of downtime, even when the update adds no migrations.

## Change

1. Launcher runs the target's `__service-preflight`
2. Preflight reports pending migrations
3. Launcher backs up only if some are pending
4. Preflight failure still backs up
5. Launcher context stripped from every child

Step 5 closes the path that overwrote a live `statev2.sqlite` from a test run.

## Scope and approval

Refs #1707, settled in the #1705 profile.
The downtime goal needs the launcher from this build, so its VM proof follows the next nightly.

## Verification

| Check | Result |
| --- | --- |
| Launcher, preflight, context tests | 19/19 pass |
| `tsc --noEmit` on `apps/server` | exit 0 |
| `vp run fork:ci` | exit 0 |

Claude Opus 5.5 in Claude Code, hosted by T3 Code.

## Fork trailers

Squashes:

- 3d6a528 fix(server): skip the update backup when no migrations are pending (#1711) (#1711)
- 858784c fixup! fix(server): skip the update backup when no migrations are pending (#1711) (#1711)

Fork-Domain: upstream-fixes
Fork-Tier: bugfix
Fork-Upstreamable: no
Co-authored-by: donjor <[email protected]>

…1711)

## Problem

The service launcher copies the whole database before every update trial, after the old server stops.
On a 22 GB database that is about 91 s of downtime, even when the update adds no migrations.

## Change

1. Launcher runs the target's `__service-preflight`
2. Preflight reports pending migrations
3. Launcher backs up only if some are pending
4. Preflight failure still backs up
5. Launcher context stripped from every child

Step 5 closes the path that overwrote a live `statev2.sqlite` from a test run.

## Scope and approval

Refs #1707, settled in the #1705 profile.
The downtime goal needs the launcher from this build, so its VM proof follows the next nightly.

## Verification

| Check | Result |
| --- | --- |
| Launcher, preflight, context tests | 19/19 pass |
| `tsc --noEmit` on `apps/server` | exit 0 |
| `vp run fork:ci` | exit 0 |

Claude Opus 5.5 in Claude Code, hosted by T3 Code.

## Fork trailers

Squashes:

- 3d6a528 fix(server): skip the update backup when no migrations are pending (#1711) (#1711)
- 858784c fixup! fix(server): skip the update backup when no migrations are pending (#1711) (#1711)

Fork-Domain: upstream-fixes
Fork-Tier: bugfix
Fork-Upstreamable: no
Co-authored-by: donjor <[email protected]>

…1711)

## Problem

The service launcher copies the whole database before every update trial, after the old server stops.
On a 22 GB database that is about 91 s of downtime, even when the update adds no migrations.

## Change

1. Launcher runs the target's `__service-preflight`
2. Preflight reports pending migrations
3. Launcher backs up only if some are pending
4. Preflight failure still backs up
5. Launcher context stripped from every child

Step 5 closes the path that overwrote a live `statev2.sqlite` from a test run.

## Scope and approval

Refs #1707, settled in the #1705 profile.
The downtime goal needs the launcher from this build, so its VM proof follows the next nightly.

## Verification

| Check | Result |
| --- | --- |
| Launcher, preflight, context tests | 19/19 pass |
| `tsc --noEmit` on `apps/server` | exit 0 |
| `vp run fork:ci` | exit 0 |

Claude Opus 5.5 in Claude Code, hosted by T3 Code.

## Fork trailers

Squashes:

- 3d6a528 fix(server): skip the update backup when no migrations are pending (#1711) (#1711)
- 858784c fixup! fix(server): skip the update backup when no migrations are pending (#1711) (#1711)

Fork-Domain: upstream-fixes
Fork-Tier: bugfix
Fork-Upstreamable: no
Co-authored-by: donjor <[email protected]>

…1711)

## Problem

The service launcher copies the whole database before every update trial, after the old server stops.
On a 22 GB database that is about 91 s of downtime, even when the update adds no migrations.

## Change

1. Launcher runs the target's `__service-preflight`
2. Preflight reports pending migrations
3. Launcher backs up only if some are pending
4. Preflight failure still backs up
5. Launcher context stripped from every child

Step 5 closes the path that overwrote a live `statev2.sqlite` from a test run.

## Scope and approval

Refs #1707, settled in the #1705 profile.
The downtime goal needs the launcher from this build, so its VM proof follows the next nightly.

## Verification

| Check | Result |
| --- | --- |
| Launcher, preflight, context tests | 19/19 pass |
| `tsc --noEmit` on `apps/server` | exit 0 |
| `vp run fork:ci` | exit 0 |

Claude Opus 5.5 in Claude Code, hosted by T3 Code.

## Fork trailers

Squashes:

- 3d6a528 fix(server): skip the update backup when no migrations are pending (#1711) (#1711)
- 858784c fixup! fix(server): skip the update backup when no migrations are pending (#1711) (#1711)

Fork-Domain: upstream-fixes
Fork-Tier: bugfix
Fork-Upstreamable: no
Co-authored-by: donjor <[email protected]>

…1711)

## Problem

The service launcher copies the whole database before every update trial, after the old server stops.
On a 22 GB database that is about 91 s of downtime, even when the update adds no migrations.

## Change

1. Launcher runs the target's `__service-preflight`
2. Preflight reports pending migrations
3. Launcher backs up only if some are pending
4. Preflight failure still backs up
5. Launcher context stripped from every child

Step 5 closes the path that overwrote a live `statev2.sqlite` from a test run.

## Scope and approval

Refs #1707, settled in the #1705 profile.
The downtime goal needs the launcher from this build, so its VM proof follows the next nightly.

## Verification

| Check | Result |
| --- | --- |
| Launcher, preflight, context tests | 19/19 pass |
| `tsc --noEmit` on `apps/server` | exit 0 |
| `vp run fork:ci` | exit 0 |

Claude Opus 5.5 in Claude Code, hosted by T3 Code.

## Fork trailers

Squashes:

- 3d6a528 fix(server): skip the update backup when no migrations are pending (#1711) (#1711)
- 858784c fixup! fix(server): skip the update backup when no migrations are pending (#1711) (#1711)

Fork-Domain: upstream-fixes
Fork-Tier: bugfix
Fork-Upstreamable: no
Co-authored-by: donjor <[email protected]>

…1711)

## Problem

The service launcher copies the whole database before every update trial, after the old server stops.
On a 22 GB database that is about 91 s of downtime, even when the update adds no migrations.

## Change

1. Launcher runs the target's `__service-preflight`
2. Preflight reports pending migrations
3. Launcher backs up only if some are pending
4. Preflight failure still backs up
5. Launcher context stripped from every child

Step 5 closes the path that overwrote a live `statev2.sqlite` from a test run.

## Scope and approval

Refs #1707, settled in the #1705 profile.
The downtime goal needs the launcher from this build, so its VM proof follows the next nightly.

## Verification

| Check | Result |
| --- | --- |
| Launcher, preflight, context tests | 19/19 pass |
| `tsc --noEmit` on `apps/server` | exit 0 |
| `vp run fork:ci` | exit 0 |

Claude Opus 5.5 in Claude Code, hosted by T3 Code.

## Fork trailers

Squashes:

- 3d6a528 fix(server): skip the update backup when no migrations are pending (#1711) (#1711)
- 858784c fixup! fix(server): skip the update backup when no migrations are pending (#1711) (#1711)

Fork-Domain: upstream-fixes
Fork-Tier: bugfix
Fork-Upstreamable: no
Co-authored-by: donjor <[email protected]>

## Problem

A client **Update server** moves the service to the new runtime but leaves the `install.sh` `t3` symlink on the old one.
After the `.957` update, `t3 --version` on PATH still printed `.933`, without the `--mcp-*` device-approval flags.
Only `t3 update` repoints that link.

## Change

| Piece | Detail |
| --- | --- |
| Logic | new `launcherRepoint.fork.ts` |
| Reuse | upstream's `repointLauncher` and ownership rule |
| Load | lazy; a static import closes a module cycle |
| Candidates | `T3CODE_INSTALL_BIN_DIR`, PATH, `~/.local/bin` |
| Owned only | links into this home's `runtime/versions` |
| When | after the service launcher accepts the handoff |
| Failure | logged; the update still proceeds |
| Seam | two `fork-hook` lines in `selfUpdate.ts` |
| Scan | `selfUpdate.ts`, `cli/update.ts` in upstream-fixes |

The launcher waits for a handoff delay, then gives a 5s terminate grace, so the repoint finishes inside the uninterruptible handoff.
Windows has no boot service, so client updates never reach it there.

## Scope and approval

Refs #1639: Jordon asked for the client update to move the PATH `t3`.
The Task's live condition needs a nightly carrying this change, so it stays open after merge.

## Close conditions

### Behavior

- [x] **Owned link:** repointed to the target
- [x] **Foreign link:** untouched
- [x] **Plain executable copy:** untouched
- [x] **Failed preflight:** link unchanged
- [x] **No owned link:** update unchanged

### Fork shape

- [x] **Seam:** `fork-hook` lines in `selfUpdate.ts`
- [x] **Logic:** in the `.fork.ts` file
- [x] **Domain:** `upstream-fixes`
- [x] **Tier:** `bugfix`
- [x] **Upstreamable:** `yes`
- [x] **Gate:** `vp run fork:ci` passes

## Verification

| Check | Result |
| --- | --- |
| `vp test run` fork + `selfUpdate` tests | 16 passed |
| Hook line commented out | seam test fails |
| `vp run typecheck` (server) | exit 0 |
| `vp lint` changed files | exit 0 |
| `vp run fork:ci` | exit 0 |
| `vp run build:bundle` (server) | exit 0 |
| `ExternalMcpServer.auth.fork.test.ts` | passes; failed on the static import |

Not checked: a live client update; that waits for the next nightly.

Claude Opus 5.5 via Claude Code in T3 Code.

## Fork trailers

Squashes:

- eea26eee63e fix(server): a client server update repoints the install.sh t3 launcher (#1641) (#1641)
- 45fa9325b9d fix(server): skip the update backup when no migrations are pending (#1711) (#1711)
- a721ea1af61 fix(web): show server update progress through reconnect (#1713) (#1713)
- e0fa16f9431 fix(server): t3 update waits for a pending remote update (#1837) (#1837)
- d49f790900d fix(server): a stop during the migration backup no longer kills the update (#1873) (#1873)
- ac8a04f75eb fix(server): t3 pair leaves a running server's schema alone (#1958) (#1958)

Fork-Domain: upstream-fixes
Fork-Tier: bugfix
Fork-Upstreamable: no
Co-authored-by: donjor <[email protected]>
Co-authored-by: donjor <[email protected]>

## Problem

A client **Update server** moves the service to the new runtime but leaves the `install.sh` `t3` symlink on the old one.
After the `.957` update, `t3 --version` on PATH still printed `.933`, without the `--mcp-*` device-approval flags.
Only `t3 update` repoints that link.

## Change

| Piece | Detail |
| --- | --- |
| Logic | new `launcherRepoint.fork.ts` |
| Reuse | upstream's `repointLauncher` and ownership rule |
| Load | lazy; a static import closes a module cycle |
| Candidates | `T3CODE_INSTALL_BIN_DIR`, PATH, `~/.local/bin` |
| Owned only | links into this home's `runtime/versions` |
| When | after the service launcher accepts the handoff |
| Failure | logged; the update still proceeds |
| Seam | two `fork-hook` lines in `selfUpdate.ts` |
| Scan | `selfUpdate.ts`, `cli/update.ts` in upstream-fixes |

The launcher waits for a handoff delay, then gives a 5s terminate grace, so the repoint finishes inside the uninterruptible handoff.
Windows has no boot service, so client updates never reach it there.

## Scope and approval

Refs #1639: Jordon asked for the client update to move the PATH `t3`.
The Task's live condition needs a nightly carrying this change, so it stays open after merge.

## Close conditions

### Behavior

- [x] **Owned link:** repointed to the target
- [x] **Foreign link:** untouched
- [x] **Plain executable copy:** untouched
- [x] **Failed preflight:** link unchanged
- [x] **No owned link:** update unchanged

### Fork shape

- [x] **Seam:** `fork-hook` lines in `selfUpdate.ts`
- [x] **Logic:** in the `.fork.ts` file
- [x] **Domain:** `upstream-fixes`
- [x] **Tier:** `bugfix`
- [x] **Upstreamable:** `yes`
- [x] **Gate:** `vp run fork:ci` passes

## Verification

| Check | Result |
| --- | --- |
| `vp test run` fork + `selfUpdate` tests | 16 passed |
| Hook line commented out | seam test fails |
| `vp run typecheck` (server) | exit 0 |
| `vp lint` changed files | exit 0 |
| `vp run fork:ci` | exit 0 |
| `vp run build:bundle` (server) | exit 0 |
| `ExternalMcpServer.auth.fork.test.ts` | passes; failed on the static import |

Not checked: a live client update; that waits for the next nightly.

Claude Opus 5.5 via Claude Code in T3 Code.

## Fork trailers

Squashes:

- eea26eee63e fix(server): a client server update repoints the install.sh t3 launcher (#1641) (#1641)
- 45fa9325b9d fix(server): skip the update backup when no migrations are pending (#1711) (#1711)
- a721ea1af61 fix(web): show server update progress through reconnect (#1713) (#1713)
- e0fa16f9431 fix(server): t3 update waits for a pending remote update (#1837) (#1837)
- d49f790900d fix(server): a stop during the migration backup no longer kills the update (#1873) (#1873)
- ac8a04f75eb fix(server): t3 pair leaves a running server's schema alone (#1958) (#1958)

Fork-Domain: upstream-fixes
Fork-Tier: bugfix
Fork-Upstreamable: no
Co-authored-by: donjor <[email protected]>
Co-authored-by: donjor <[email protected]>

## Problem

A client **Update server** moves the service to the new runtime but leaves the `install.sh` `t3` symlink on the old one.
After the `.957` update, `t3 --version` on PATH still printed `.933`, without the `--mcp-*` device-approval flags.
Only `t3 update` repoints that link.

## Change

| Piece | Detail |
| --- | --- |
| Logic | new `launcherRepoint.fork.ts` |
| Reuse | upstream's `repointLauncher` and ownership rule |
| Load | lazy; a static import closes a module cycle |
| Candidates | `T3CODE_INSTALL_BIN_DIR`, PATH, `~/.local/bin` |
| Owned only | links into this home's `runtime/versions` |
| When | after the service launcher accepts the handoff |
| Failure | logged; the update still proceeds |
| Seam | two `fork-hook` lines in `selfUpdate.ts` |
| Scan | `selfUpdate.ts`, `cli/update.ts` in upstream-fixes |

The launcher waits for a handoff delay, then gives a 5s terminate grace, so the repoint finishes inside the uninterruptible handoff.
Windows has no boot service, so client updates never reach it there.

## Scope and approval

Refs #1639: Jordon asked for the client update to move the PATH `t3`.
The Task's live condition needs a nightly carrying this change, so it stays open after merge.

## Close conditions

### Behavior

- [x] **Owned link:** repointed to the target
- [x] **Foreign link:** untouched
- [x] **Plain executable copy:** untouched
- [x] **Failed preflight:** link unchanged
- [x] **No owned link:** update unchanged

### Fork shape

- [x] **Seam:** `fork-hook` lines in `selfUpdate.ts`
- [x] **Logic:** in the `.fork.ts` file
- [x] **Domain:** `upstream-fixes`
- [x] **Tier:** `bugfix`
- [x] **Upstreamable:** `yes`
- [x] **Gate:** `vp run fork:ci` passes

## Verification

| Check | Result |
| --- | --- |
| `vp test run` fork + `selfUpdate` tests | 16 passed |
| Hook line commented out | seam test fails |
| `vp run typecheck` (server) | exit 0 |
| `vp lint` changed files | exit 0 |
| `vp run fork:ci` | exit 0 |
| `vp run build:bundle` (server) | exit 0 |
| `ExternalMcpServer.auth.fork.test.ts` | passes; failed on the static import |

Not checked: a live client update; that waits for the next nightly.

Claude Opus 5.5 via Claude Code in T3 Code.

## Fork trailers

Squashes:

- eea26eee63e fix(server): a client server update repoints the install.sh t3 launcher (#1641) (#1641)
- 45fa9325b9d fix(server): skip the update backup when no migrations are pending (#1711) (#1711)
- a721ea1af61 fix(web): show server update progress through reconnect (#1713) (#1713)
- e0fa16f9431 fix(server): t3 update waits for a pending remote update (#1837) (#1837)
- d49f790900d fix(server): a stop during the migration backup no longer kills the update (#1873) (#1873)
- ac8a04f75eb fix(server): t3 pair leaves a running server's schema alone (#1958) (#1958)

Fork-Domain: upstream-fixes
Fork-Tier: bugfix
Fork-Upstreamable: no
Co-authored-by: donjor <[email protected]>
Co-authored-by: donjor <[email protected]>

## Problem

A client **Update server** moves the service to the new runtime but leaves the `install.sh` `t3` symlink on the old one.
After the `.957` update, `t3 --version` on PATH still printed `.933`, without the `--mcp-*` device-approval flags.
Only `t3 update` repoints that link.

## Change

| Piece | Detail |
| --- | --- |
| Logic | new `launcherRepoint.fork.ts` |
| Reuse | upstream's `repointLauncher` and ownership rule |
| Load | lazy; a static import closes a module cycle |
| Candidates | `T3CODE_INSTALL_BIN_DIR`, PATH, `~/.local/bin` |
| Owned only | links into this home's `runtime/versions` |
| When | after the service launcher accepts the handoff |
| Failure | logged; the update still proceeds |
| Seam | two `fork-hook` lines in `selfUpdate.ts` |
| Scan | `selfUpdate.ts`, `cli/update.ts` in upstream-fixes |

The launcher waits for a handoff delay, then gives a 5s terminate grace, so the repoint finishes inside the uninterruptible handoff.
Windows has no boot service, so client updates never reach it there.

## Scope and approval

Refs #1639: Jordon asked for the client update to move the PATH `t3`.
The Task's live condition needs a nightly carrying this change, so it stays open after merge.

## Close conditions

### Behavior

- [x] **Owned link:** repointed to the target
- [x] **Foreign link:** untouched
- [x] **Plain executable copy:** untouched
- [x] **Failed preflight:** link unchanged
- [x] **No owned link:** update unchanged

### Fork shape

- [x] **Seam:** `fork-hook` lines in `selfUpdate.ts`
- [x] **Logic:** in the `.fork.ts` file
- [x] **Domain:** `upstream-fixes`
- [x] **Tier:** `bugfix`
- [x] **Upstreamable:** `yes`
- [x] **Gate:** `vp run fork:ci` passes

## Verification

| Check | Result |
| --- | --- |
| `vp test run` fork + `selfUpdate` tests | 16 passed |
| Hook line commented out | seam test fails |
| `vp run typecheck` (server) | exit 0 |
| `vp lint` changed files | exit 0 |
| `vp run fork:ci` | exit 0 |
| `vp run build:bundle` (server) | exit 0 |
| `ExternalMcpServer.auth.fork.test.ts` | passes; failed on the static import |

Not checked: a live client update; that waits for the next nightly.

Claude Opus 5.5 via Claude Code in T3 Code.

## Fork trailers

Squashes:

- eea26eee63e fix(server): a client server update repoints the install.sh t3 launcher (#1641) (#1641)
- 45fa9325b9d fix(server): skip the update backup when no migrations are pending (#1711) (#1711)
- a721ea1af61 fix(web): show server update progress through reconnect (#1713) (#1713)
- e0fa16f9431 fix(server): t3 update waits for a pending remote update (#1837) (#1837)
- d49f790900d fix(server): a stop during the migration backup no longer kills the update (#1873) (#1873)
- ac8a04f75eb fix(server): t3 pair leaves a running server's schema alone (#1958) (#1958)

Fork-Domain: upstream-fixes
Fork-Tier: bugfix
Fork-Upstreamable: no
Co-authored-by: donjor <[email protected]>
Co-authored-by: donjor <[email protected]>

## Problem

A client **Update server** moves the service to the new runtime but leaves the `install.sh` `t3` symlink on the old one.
After the `.957` update, `t3 --version` on PATH still printed `.933`, without the `--mcp-*` device-approval flags.
Only `t3 update` repoints that link.

## Change

| Piece | Detail |
| --- | --- |
| Logic | new `launcherRepoint.fork.ts` |
| Reuse | upstream's `repointLauncher` and ownership rule |
| Load | lazy; a static import closes a module cycle |
| Candidates | `T3CODE_INSTALL_BIN_DIR`, PATH, `~/.local/bin` |
| Owned only | links into this home's `runtime/versions` |
| When | after the service launcher accepts the handoff |
| Failure | logged; the update still proceeds |
| Seam | two `fork-hook` lines in `selfUpdate.ts` |
| Scan | `selfUpdate.ts`, `cli/update.ts` in upstream-fixes |

The launcher waits for a handoff delay, then gives a 5s terminate grace, so the repoint finishes inside the uninterruptible handoff.
Windows has no boot service, so client updates never reach it there.

## Scope and approval

Refs #1639: Jordon asked for the client update to move the PATH `t3`.
The Task's live condition needs a nightly carrying this change, so it stays open after merge.

## Close conditions

### Behavior

- [x] **Owned link:** repointed to the target
- [x] **Foreign link:** untouched
- [x] **Plain executable copy:** untouched
- [x] **Failed preflight:** link unchanged
- [x] **No owned link:** update unchanged

### Fork shape

- [x] **Seam:** `fork-hook` lines in `selfUpdate.ts`
- [x] **Logic:** in the `.fork.ts` file
- [x] **Domain:** `upstream-fixes`
- [x] **Tier:** `bugfix`
- [x] **Upstreamable:** `yes`
- [x] **Gate:** `vp run fork:ci` passes

## Verification

| Check | Result |
| --- | --- |
| `vp test run` fork + `selfUpdate` tests | 16 passed |
| Hook line commented out | seam test fails |
| `vp run typecheck` (server) | exit 0 |
| `vp lint` changed files | exit 0 |
| `vp run fork:ci` | exit 0 |
| `vp run build:bundle` (server) | exit 0 |
| `ExternalMcpServer.auth.fork.test.ts` | passes; failed on the static import |

Not checked: a live client update; that waits for the next nightly.

Claude Opus 5.5 via Claude Code in T3 Code.

## Fork trailers

Squashes:

- eea26eee63e fix(server): a client server update repoints the install.sh t3 launcher (#1641) (#1641)
- 45fa9325b9d fix(server): skip the update backup when no migrations are pending (#1711) (#1711)
- a721ea1af61 fix(web): show server update progress through reconnect (#1713) (#1713)
- e0fa16f9431 fix(server): t3 update waits for a pending remote update (#1837) (#1837)
- d49f790900d fix(server): a stop during the migration backup no longer kills the update (#1873) (#1873)
- ac8a04f75eb fix(server): t3 pair leaves a running server's schema alone (#1958) (#1958)

Fork-Domain: upstream-fixes
Fork-Tier: bugfix
Fork-Upstreamable: no
Co-authored-by: donjor <[email protected]>
Co-authored-by: donjor <[email protected]>

## Problem

A client **Update server** moves the service to the new runtime but leaves the `install.sh` `t3` symlink on the old one.
After the `.957` update, `t3 --version` on PATH still printed `.933`, without the `--mcp-*` device-approval flags.
Only `t3 update` repoints that link.

## Change

| Piece | Detail |
| --- | --- |
| Logic | new `launcherRepoint.fork.ts` |
| Reuse | upstream's `repointLauncher` and ownership rule |
| Load | lazy; a static import closes a module cycle |
| Candidates | `T3CODE_INSTALL_BIN_DIR`, PATH, `~/.local/bin` |
| Owned only | links into this home's `runtime/versions` |
| When | after the service launcher accepts the handoff |
| Failure | logged; the update still proceeds |
| Seam | two `fork-hook` lines in `selfUpdate.ts` |
| Scan | `selfUpdate.ts`, `cli/update.ts` in upstream-fixes |

The launcher waits for a handoff delay, then gives a 5s terminate grace, so the repoint finishes inside the uninterruptible handoff.
Windows has no boot service, so client updates never reach it there.

## Scope and approval

Refs #1639: Jordon asked for the client update to move the PATH `t3`.
The Task's live condition needs a nightly carrying this change, so it stays open after merge.

## Close conditions

### Behavior

- [x] **Owned link:** repointed to the target
- [x] **Foreign link:** untouched
- [x] **Plain executable copy:** untouched
- [x] **Failed preflight:** link unchanged
- [x] **No owned link:** update unchanged

### Fork shape

- [x] **Seam:** `fork-hook` lines in `selfUpdate.ts`
- [x] **Logic:** in the `.fork.ts` file
- [x] **Domain:** `upstream-fixes`
- [x] **Tier:** `bugfix`
- [x] **Upstreamable:** `yes`
- [x] **Gate:** `vp run fork:ci` passes

## Verification

| Check | Result |
| --- | --- |
| `vp test run` fork + `selfUpdate` tests | 16 passed |
| Hook line commented out | seam test fails |
| `vp run typecheck` (server) | exit 0 |
| `vp lint` changed files | exit 0 |
| `vp run fork:ci` | exit 0 |
| `vp run build:bundle` (server) | exit 0 |
| `ExternalMcpServer.auth.fork.test.ts` | passes; failed on the static import |

Not checked: a live client update; that waits for the next nightly.

Claude Opus 5.5 via Claude Code in T3 Code.

## Fork trailers

Squashes:

- eea26eee63e fix(server): a client server update repoints the install.sh t3 launcher (#1641) (#1641)
- 45fa9325b9d fix(server): skip the update backup when no migrations are pending (#1711) (#1711)
- a721ea1af61 fix(web): show server update progress through reconnect (#1713) (#1713)
- e0fa16f9431 fix(server): t3 update waits for a pending remote update (#1837) (#1837)
- d49f790900d fix(server): a stop during the migration backup no longer kills the update (#1873) (#1873)
- ac8a04f75eb fix(server): t3 pair leaves a running server's schema alone (#1958) (#1958)

Fork-Domain: upstream-fixes
Fork-Tier: bugfix
Fork-Upstreamable: no
Co-authored-by: donjor <[email protected]>
Co-authored-by: donjor <[email protected]>

## Problem

A client **Update server** moves the service to the new runtime but leaves the `install.sh` `t3` symlink on the old one.
After the `.957` update, `t3 --version` on PATH still printed `.933`, without the `--mcp-*` device-approval flags.
Only `t3 update` repoints that link.

## Change

| Piece | Detail |
| --- | --- |
| Logic | new `launcherRepoint.fork.ts` |
| Reuse | upstream's `repointLauncher` and ownership rule |
| Load | lazy; a static import closes a module cycle |
| Candidates | `T3CODE_INSTALL_BIN_DIR`, PATH, `~/.local/bin` |
| Owned only | links into this home's `runtime/versions` |
| When | after the service launcher accepts the handoff |
| Failure | logged; the update still proceeds |
| Seam | two `fork-hook` lines in `selfUpdate.ts` |
| Scan | `selfUpdate.ts`, `cli/update.ts` in upstream-fixes |

The launcher waits for a handoff delay, then gives a 5s terminate grace, so the repoint finishes inside the uninterruptible handoff.
Windows has no boot service, so client updates never reach it there.

## Scope and approval

Refs #1639: Jordon asked for the client update to move the PATH `t3`.
The Task's live condition needs a nightly carrying this change, so it stays open after merge.

## Close conditions

### Behavior

- [x] **Owned link:** repointed to the target
- [x] **Foreign link:** untouched
- [x] **Plain executable copy:** untouched
- [x] **Failed preflight:** link unchanged
- [x] **No owned link:** update unchanged

### Fork shape

- [x] **Seam:** `fork-hook` lines in `selfUpdate.ts`
- [x] **Logic:** in the `.fork.ts` file
- [x] **Domain:** `upstream-fixes`
- [x] **Tier:** `bugfix`
- [x] **Upstreamable:** `yes`
- [x] **Gate:** `vp run fork:ci` passes

## Verification

| Check | Result |
| --- | --- |
| `vp test run` fork + `selfUpdate` tests | 16 passed |
| Hook line commented out | seam test fails |
| `vp run typecheck` (server) | exit 0 |
| `vp lint` changed files | exit 0 |
| `vp run fork:ci` | exit 0 |
| `vp run build:bundle` (server) | exit 0 |
| `ExternalMcpServer.auth.fork.test.ts` | passes; failed on the static import |

Not checked: a live client update; that waits for the next nightly.

Claude Opus 5.5 via Claude Code in T3 Code.

## Fork trailers

Squashes:

- eea26eee63e fix(server): a client server update repoints the install.sh t3 launcher (#1641) (#1641)
- 45fa9325b9d fix(server): skip the update backup when no migrations are pending (#1711) (#1711)
- a721ea1af61 fix(web): show server update progress through reconnect (#1713) (#1713)
- e0fa16f9431 fix(server): t3 update waits for a pending remote update (#1837) (#1837)
- d49f790900d fix(server): a stop during the migration backup no longer kills the update (#1873) (#1873)
- ac8a04f75eb fix(server): t3 pair leaves a running server's schema alone (#1958) (#1958)

Fork-Domain: upstream-fixes
Fork-Tier: bugfix
Fork-Upstreamable: no
Co-authored-by: donjor <[email protected]>
Co-authored-by: donjor <[email protected]>

## Problem

A client **Update server** moves the service to the new runtime but leaves the `install.sh` `t3` symlink on the old one.
After the `.957` update, `t3 --version` on PATH still printed `.933`, without the `--mcp-*` device-approval flags.
Only `t3 update` repoints that link.

## Change

| Piece | Detail |
| --- | --- |
| Logic | new `launcherRepoint.fork.ts` |
| Reuse | upstream's `repointLauncher` and ownership rule |
| Load | lazy; a static import closes a module cycle |
| Candidates | `T3CODE_INSTALL_BIN_DIR`, PATH, `~/.local/bin` |
| Owned only | links into this home's `runtime/versions` |
| When | after the service launcher accepts the handoff |
| Failure | logged; the update still proceeds |
| Seam | two `fork-hook` lines in `selfUpdate.ts` |
| Scan | `selfUpdate.ts`, `cli/update.ts` in upstream-fixes |

The launcher waits for a handoff delay, then gives a 5s terminate grace, so the repoint finishes inside the uninterruptible handoff.
Windows has no boot service, so client updates never reach it there.

## Scope and approval

Refs #1639: Jordon asked for the client update to move the PATH `t3`.
The Task's live condition needs a nightly carrying this change, so it stays open after merge.

## Close conditions

### Behavior

- [x] **Owned link:** repointed to the target
- [x] **Foreign link:** untouched
- [x] **Plain executable copy:** untouched
- [x] **Failed preflight:** link unchanged
- [x] **No owned link:** update unchanged

### Fork shape

- [x] **Seam:** `fork-hook` lines in `selfUpdate.ts`
- [x] **Logic:** in the `.fork.ts` file
- [x] **Domain:** `upstream-fixes`
- [x] **Tier:** `bugfix`
- [x] **Upstreamable:** `yes`
- [x] **Gate:** `vp run fork:ci` passes

## Verification

| Check | Result |
| --- | --- |
| `vp test run` fork + `selfUpdate` tests | 16 passed |
| Hook line commented out | seam test fails |
| `vp run typecheck` (server) | exit 0 |
| `vp lint` changed files | exit 0 |
| `vp run fork:ci` | exit 0 |
| `vp run build:bundle` (server) | exit 0 |
| `ExternalMcpServer.auth.fork.test.ts` | passes; failed on the static import |

Not checked: a live client update; that waits for the next nightly.

Claude Opus 5.5 via Claude Code in T3 Code.

## Fork trailers

Squashes:

- eea26eee63e fix(server): a client server update repoints the install.sh t3 launcher (#1641) (#1641)
- 45fa9325b9d fix(server): skip the update backup when no migrations are pending (#1711) (#1711)
- a721ea1af61 fix(web): show server update progress through reconnect (#1713) (#1713)
- e0fa16f9431 fix(server): t3 update waits for a pending remote update (#1837) (#1837)
- d49f790900d fix(server): a stop during the migration backup no longer kills the update (#1873) (#1873)
- ac8a04f75eb fix(server): t3 pair leaves a running server's schema alone (#1958) (#1958)

Fork-Domain: upstream-fixes
Fork-Tier: bugfix
Fork-Upstreamable: no
Co-authored-by: donjor <[email protected]>
Co-authored-by: donjor <[email protected]>

## Problem

A client **Update server** moves the service to the new runtime but leaves the `install.sh` `t3` symlink on the old one.
After the `.957` update, `t3 --version` on PATH still printed `.933`, without the `--mcp-*` device-approval flags.
Only `t3 update` repoints that link.

## Change

| Piece | Detail |
| --- | --- |
| Logic | new `launcherRepoint.fork.ts` |
| Reuse | upstream's `repointLauncher` and ownership rule |
| Load | lazy; a static import closes a module cycle |
| Candidates | `T3CODE_INSTALL_BIN_DIR`, PATH, `~/.local/bin` |
| Owned only | links into this home's `runtime/versions` |
| When | after the service launcher accepts the handoff |
| Failure | logged; the update still proceeds |
| Seam | two `fork-hook` lines in `selfUpdate.ts` |
| Scan | `selfUpdate.ts`, `cli/update.ts` in upstream-fixes |

The launcher waits for a handoff delay, then gives a 5s terminate grace, so the repoint finishes inside the uninterruptible handoff.
Windows has no boot service, so client updates never reach it there.

## Scope and approval

Refs #1639: Jordon asked for the client update to move the PATH `t3`.
The Task's live condition needs a nightly carrying this change, so it stays open after merge.

## Close conditions

### Behavior

- [x] **Owned link:** repointed to the target
- [x] **Foreign link:** untouched
- [x] **Plain executable copy:** untouched
- [x] **Failed preflight:** link unchanged
- [x] **No owned link:** update unchanged

### Fork shape

- [x] **Seam:** `fork-hook` lines in `selfUpdate.ts`
- [x] **Logic:** in the `.fork.ts` file
- [x] **Domain:** `upstream-fixes`
- [x] **Tier:** `bugfix`
- [x] **Upstreamable:** `yes`
- [x] **Gate:** `vp run fork:ci` passes

## Verification

| Check | Result |
| --- | --- |
| `vp test run` fork + `selfUpdate` tests | 16 passed |
| Hook line commented out | seam test fails |
| `vp run typecheck` (server) | exit 0 |
| `vp lint` changed files | exit 0 |
| `vp run fork:ci` | exit 0 |
| `vp run build:bundle` (server) | exit 0 |
| `ExternalMcpServer.auth.fork.test.ts` | passes; failed on the static import |

Not checked: a live client update; that waits for the next nightly.

Claude Opus 5.5 via Claude Code in T3 Code.

## Fork trailers

Squashes:

- eea26eee63e fix(server): a client server update repoints the install.sh t3 launcher (#1641) (#1641)
- 45fa9325b9d fix(server): skip the update backup when no migrations are pending (#1711) (#1711)
- a721ea1af61 fix(web): show server update progress through reconnect (#1713) (#1713)
- e0fa16f9431 fix(server): t3 update waits for a pending remote update (#1837) (#1837)
- d49f790900d fix(server): a stop during the migration backup no longer kills the update (#1873) (#1873)
- ac8a04f75eb fix(server): t3 pair leaves a running server's schema alone (#1958) (#1958)

Fork-Domain: upstream-fixes
Fork-Tier: bugfix
Fork-Upstreamable: no
Co-authored-by: donjor <[email protected]>
Co-authored-by: donjor <[email protected]>