Repository navigation
Prepare Apple reinstall artifacts before removing the installed app #4516
Description
Umbrella: #4368. The user authorized Claude planning, assumption verification and completion workers, followed by correctness-preserving cleanup. Source authority: main ddbfc85. No runtime proof is claimed. Preserve typed errors, existing command envelopes, #4050 full-unit fallback and meaningful integration/regression/native evidence. Do not merge, release, push tags, weaken assertions or retry failures blindly.
Purpose: A replacement that cannot be prepared must not remove the selected installed app or its data.
Current trigger: deployAppleApp in packages/platform-apple/src/deployment/runtime.ts resolves the bundle identifier, uninstalls, and only then calls prepareArtifact. An existing corrupt .ipa or missing Payload/*.app can therefore fail after removal. The daemon rejects missing input paths earlier; do not use that as the regression trigger.
Required behavior: Resolve the target and prepare the replacement before destructive uninstall. If resolution, preparation or pre-uninstall cancellation fails, do not uninstall or install. After preparation, preserve the existing fresh-state uninstall/install behavior and install hooks. Release the prepared artifact on uninstall or install failure and on success. Preserve cache invalidation before/after the complete operation and the resolved return identity. Do not add identity cross-checks, rollback or an install -r substitute. This deliberately supersedes the source comment/tests that preserve the old destructive preparation-failure order. Failure after successful uninstall can still leave the app absent; no transactional guarantee is claimed.
Owned files: packages/platform-apple/src/deployment/runtime.ts and its tests; one existing provider scenario if needed. Keep the Android analogue in its own child contract. No open PR overlaps this platform deployment owner in the current file-level scan.
Completion: Update old-order tests without deleting unique cache/hosted-installer assertions. Prove preparation failure and cancellation do not dispatch uninstall; prove prepared cleanup after uninstall failure; preserve successful fresh reinstall. Extend an actual request-route provider scenario, use isolated prior-production or meaningful mutation detection, obtain independent correctness review, and run exact-head affected validation. Obtain one owned simulator proof that failed preparation preserves the app/data and successful reinstall still clears data, or publish an explicitly blocked draft naming the missing evidence. Use T3 device tools and the returned bound CLI. No native claim from mocks.
Contract clarification: Metadata reads may tolerate an unreadable or missing Info.plist. This child protects failures that preparation actually rejects; it does not validate every .app or guarantee retention after install begins. Decision: #4516 (comment)
Activity
apex-sentinel-staging commentedon Nov 13, 2026
Apex Sentinel · Issue review
Suggested label:
bugThe issue describes an existing destructive sequence where an Apple app is uninstalled before the replacement artifact is prepared, so preparation failures can remove the installed app. It specifies files, required behavior, and tests, making it actionable.
Required sections
Possible duplicates
thymikee commentedon Nov 13, 2026
Current state: Local candidate d7e15e0 prepares Apple reinstall artifacts before uninstall and documents the non-transactional limit. Pinned setup/build,36 runtime tests, the corrupt-ipa physical request scenario, typecheck, full formatting and diff-check passed. The broader two-file provider run failed the iOS Settings flow at5000ms (26passed/1failed); cause remains unproven. The author corrected one directly authored test-stub failure and retained its log.
Next: independent correctness/help review and one unchanged-base run of the same provider command, then meaningful regression proof, exact-head validation and owned simulator data-retention/fresh-reinstall evidence. The candidate remains unpublished and not ready. No timeout increase or blind retry is authorized.
thymikee commentedon Nov 13, 2026
Decision: narrow Apple reinstall protection to actual preparation failures:
Independent review verified the prepare-before-uninstall implementation and cancellation/cache/cleanup owners. It also found that readIosBundleInfo tolerates missing or corrupt Info.plist data, so an invalid .app can pass preparation and fail only after uninstall. Narrow this child's contract and help/docs to failures that preparation actually rejects, such as a corrupt .ipa that cannot be unpacked or an invalid archive layout. Do not promise that every invalid or unreadable build preserves the installed app. Changing install to reject metadata earlier is a separate behavior decision and is not included.
The coordinator accepts the three small findings and fixes them directly: accurate help/docs, a preparation-specific error assertion in the provider scenario, and cache-test names that describe resolution/preparation. No production behavior change is needed. Independent review found the reordered production path correct.
The Settings-flow5000ms timeout reproduced once on unchanged main ddbfc85 with the same command. Base also timed out a different ledger test. Preserve the failed candidate/base logs; root cause and repeatability are unproven. Host load is context only. No quiet-host retry, timeout widening or merge-readiness claim is authorized by this evidence. Regression discrimination, exact validation and owned simulator proof remain.
thymikee commentedon Nov 13, 2026
Current state: Coordinator review corrections are committed at c75dc27. The production reorder is unchanged. Help/docs now describe unpacking failure protection and the invalid-bundle/post-uninstall limit; the provider case pins the zip preparation diagnostic; cache fixture names match preparation/resolution.
Pinned full formatting,36 runtime tests,the targeted physical reinstall provider scenario,typecheck and diff-check passed. The earlier broader provider command remains failed, with the matching Settings-flow timeout reproduced on unchanged base; root cause/repeatability remain unproven. Next is isolated old-production discrimination and one exact-head affected gate, followed by owned simulator proof or an explicit draft blocker. No quiet-host retry or merge-readiness claim.
thymikee commentedon Nov 13, 2026
Decision: publish the two reinstall safety contracts together:
Claude source reviews verified the small Apple4516 and Android4517 owner changes independently. Both implement the same prepare-before-destructive-uninstall invariant, with platform-specific limits. They share versioned reinstall help, user docs and the Limrun provider scenario. Combine publication into one PR so those surfaces describe the two updated paths consistently. Keep both child contracts and each platform's regression/native evidence separate; this is one implementation per platform, not duplicated work. No merge/release/tag is authorized.
The Apple prior-production proof passed: restored old runtime caused five unit failures and the real corrupt-ipa provider failure. Its exact gate atc75dc272 remained FAILED because the Limrun iOS test still pinned uninstall-before-prepare. Update that stale expectation without deleting credentials, cleanup or identity assertions; the Android analogue needs the same update. Before publication, run platform-specific discrimination and one exact gate on the combined reviewed commit. Applicable live evidence remains mandatory or an explicit draft blocker.
Raw receipt correction: the failed Apple gate selected20checks:6passed,1failed,8skipped and5not-run. The five not-run were unit,provider-integration,command-docs,docs-links,docs-prose. The4050full-unitfallback was retained but not executed. The worker summary saying no unrun checks was incorrect. Keep the actual failed receipt and historical base-reproduced provider timeouts with cause unproven; no blind retry or quiet-host diagnosis is inferred.
thymikee commentedon Nov 13, 2026
Current state: Apple4516 and Android4517 are combined locally at cf65623, preserving one implementation per platform and both child contracts. Independent component reviews found the production reorders correct; small documentation/test findings were fixed by the coordinator. Pinned focused feedback passed55runtime tests across2files,15targeted provider tests with9filtered skips,typecheck,full formatting and diff-check.
Apple's earlier old-production experiment remains proven atc75dc272:5unit failures and1real-provider failure for the destructive old order. Its failed exact gate is preserved; the stale Limrun shared-order expectation was corrected for both platforms. The actual old receipt retained the4050unitfallback but did not execute it after related tests failed. Historical base-reproduced provider timeouts remain cause-unproven. Next: final combined source review, Android-specific discrimination and one exact gate on the new commit. Both native app/data-retention and successful-fresh-reinstall controls remain pending. Unpublished; no readiness claim.
thymikee commentedon Nov 13, 2026
Current state: The full-unit fallback at4e5d112 found one missed legacy Limrun old-order assertion, not a production or timeout failure. Root migrated that sequence and its name while keeping credentials,identity,uninstall and cleanup assertions. Five tests in that legacy file,pinned format and diff-check passed. New combined head88bfc20263d77baedc88db4c4cdb9349bc7fe740 is clean. A sibling source search found no other same-order assumptions in this command family.
The failed exact receipt is preserved:7checks passed,unit failed,4checks did not run,8were skipped. Unit ran19769passed/1failed/10skipped. Both platforms' prior-production regression proofs remain valid for unchanged runtime blobs. One new exact gate is justified by the concrete test repair; no blind retry or cap weakening. Native app/data retention and successful fresh-reinstall controls remain pending. Combined publication with4517 is still unpublished and not ready.
thymikee commentedon Nov 13, 2026
Current state: The combined #4516 + #4517 candidate at 88bfc20 passed its one exact-head affected gate. The receipt records exactCommit=true, checkoutChanged=false and failOpen=false: 11 checks passed, 8 skipped for their named GitHub/manual owners, and provider-integration deduplicated against related tests. None failed or remained unrun. Full unit passed 19,770 with 10 skipped; related tests passed 390. Both prior-production reorder experiments remain recorded separately.
The earlier stale-order and max-lines failures remain historical failed receipts. The historical 5000ms provider timeout causes remain unproven. This pass does not establish GitHub or native evidence.
A bounded Claude worker now owns the single native/execution slot. It will use assigned stopped T3 devices and a privately bound candidate runtime to check failed-preparation app/data retention and a successful fresh-reinstall control on each platform, then clean only its resources. Native evidence and CI are pending. The combined PR is not yet published; no readiness or merge claim.
thymikee commentedon Nov 13, 2026
Current state: Published the combined reinstall fix in #4533 at
88bfc20263d77baedc88db4c4cdb9349bc7fe740. The exact-head affected gate passed (11 passed, 8 named skips, 1 provider deduplication; full unit 19,770 passed/10 skipped; related 390 passed). Separate Apple and Android prior-production experiments detected the old destructive order.Owned native controls also passed through the private candidate daemon: on Android 15/API 35 and iOS 27.0, a saved app marker survived failed archive preparation, and a valid reinstall reset the marker. The invalid first iOS fixture-crash attempt is excluded. Apple runner binary provenance was not independently checked; the changed deployment order runs in the verified candidate daemon and no runner source changes. Native cancellation and protection against arbitrary invalid APK/app bundles are not claimed. Owned fixtures, sessions, daemon and devices were cleaned up.
Remote review evidence is in #4533 (comment) . CI and PR review remain pending, so this is published, not merge-ready. Historical failed receipts and unproven provider timeout causes remain preserved. No merge/release/tag.
thymikee commentedon Nov 13, 2026
Current state: PR #4533 remains open at88bfc20263d77baedc88db4c4cdb9349bc7fe740 and is mergeable. Its current check snapshot has22successful checks and1skipped check. The two published review requests have accepted, test-only local corrections at9d7993318de5d202ecb7c653ff099baca1f43e8f; they are not yet pushed.
The post-prepare cancellation case preserves the earlier cancellation test, checks the identical cancellation reason and exact prepare/cleanup sequence, and fails when cleanup is conditionally skipped. Its isolated controls passed before and after the intended missing-cleanup failure. The provider case now uses a real IPA ZIP without an app bundle and asserts existing INVALID_ARGS plus no uninstall/install, without matching yauzl wording. Root focused checks passed37unit tests and1provider case (3filtered skips). Production is unchanged; original-head native evidence remains attributed to88bfc.
The earlier validator was explicitly superseded and is confirmed interrupted; its24a20eb9 gate was cancelled during unit,not passed. Its completed mutation evidence and all partial logs are preserved, and the experiment BASE is clean. One new bounded Claude worker now owns final old-order discrimination for the revised fixture and the exact9d7993 gate before one push. No blind retry,timeout widening,new production behavior or merge occurred.
thymikee commentedon Nov 13, 2026
Current state: Both PR4533 review corrections are pushed at9d7993318de5d202ecb7c653ff099baca1f43e8f. The post-prepare cancellation case retains the earlier case and proves cleanup without uninstall/install; the provider case now asserts typed INVALID_ARGS from a real no-app IPA archive instead of third-party extractor prose. Both original review threads have replies and are resolved; the last thread query showed none open.
The exact-head affected gate passed: 11 checks passed, 8 named skips, 1 provider deduplication, no failures or unrun checks. Full unit passed 19,771 with 10 skipped; related tests passed 390. The revised provider fixture detects the original destructive order and restored controls pass. The cancellation proof carries over through identical runtime/test blobs. Validation evidence: #4533 (comment) . Original native evidence remains attributed to production-identical88bfc202.
Current-head CI is pending. The existing watch remains until CI is green and no review feedback is open. No merge is authorized.
thymikee commentedon Nov 14, 2026
Current state: PR #4533 is green at9d7993318de5d202ecb7c653ff099baca1f43e8f: 21 reported checks succeeded and1was skipped; none failed or remain pending. Both requested review fixes are pushed, both original threads have replies and are resolved, and the final thread query shows zero open threads. Cubic reports all issues addressed and Sentinel approves with no open findings. The PR is mergeable with CLEAN merge state.
The exact-head local gate, original-order regression experiments, skipped-cleanup mutation and source-identical native retention/fresh-reinstall controls are recorded in #4533 (comment) . The Chief of Staff's watch-until-green/no-open-feedback request is complete. Returning the PR to the user's inbox; no merge, release or tag occurred. Child issues remain open until their implementation merges.
thymikee commentedon Nov 14, 2026
Current state: Merged in #4533 on2026-11-14 at07:27UTC. The reviewed source head was9d7993318de5d202ecb7c653ff099baca1f43e8f; merge commit is2131de146245137ce7b5b53dff33632b14a47e07. GitHub closed both#4516 and#4517 as completed. Exact local validation, regression/mutation discrimination, native retention/fresh-reinstall evidence, green CI and resolved review threads remain recorded in the PR. The coordinator observed the merge and did not perform it. No additional implementation is needed for these two scopes.