Repository navigation
Prepare Android reinstall materialization before uninstalling the app #4517
Description
Umbrella: #4368. The user authorized Claude planning, assumption verification and completion workers, followed by correctness-preserving cleanup. Source authority: main ddbfc85. No runtime proof is claimed. Preserve typed errors, existing command envelopes, #4050 full-unit fallback and meaningful integration/regression/native evidence. Do not merge, release, push tags, weaken assertions or retry failures blindly.
Purpose: Failed replacement materialization must not remove an installed Android app.
Current trigger: packages/platform-android/src/deployment/runtime.ts resolves the package and uninstalls before prepareArtifact. The replaceExisting path passes resolveIdentity:false; preparation extracts archives/checks installable shape but does not validate APK contents. A no-installable archive can fail after app removal.
Required behavior: Keep readiness and package resolution, then prepare before uninstall. Preparation failure or pre-uninstall cancellation must not uninstall or install. Preserve fresh-state semantics, native installation caps, installer hooks and whole-operation cache invalidation. Always clean a prepared artifact after later failure/success. Do not add an APK validator, change to adb install -r, broaden identity inspection or claim rollback. Corrupt APK content and bundletool/install failures that occur after successful preparation may still be destructive; this child only protects materialization failures.
Owned files: packages/platform-android/src/deployment/runtime.ts and its tests; an existing request-route provider scenario if needed. Separate ownership from the Apple child. No open PR overlaps this deployment owner in the current file-level scan.
Completion: Update ordering tests while retaining cache/fuzzy/hosted-installer coverage. Prove a real materialization failure causes no uninstall, prepared cleanup on uninstall failure, cancellation and successful reinstall semantics. Use request-route provider integration, isolated regression/mutation discrimination, independent review and exact-head validation. Obtain one owned Android proof with an archive containing no installable and app/data retention, plus successful fresh reinstall control, or name the blocked live obligation explicitly. Use T3 device tools and its returned bound CLI; do not test on another thread's device.
Activity
apex-sentinel-staging commentedon Nov 13, 2026
Apex Sentinel · Issue review
Suggested label:
bugIt identifies a concrete Android deployment defect: packages/platform-android/src/deployment/runtime.ts can uninstall the app before preparing the replacement artifact, allowing failed materialization to remove the installed app. The issue names the file, required ordering, and tests, so it is actionable despite agent-process wording.
Required sections
thymikee commentedon Nov 13, 2026
Decision: publish the two reinstall safety contracts together:
Claude source reviews verified the small Apple4516 and Android4517 owner changes independently. Both implement the same prepare-before-destructive-uninstall invariant, with platform-specific limits. They share versioned reinstall help, user docs and the Limrun provider scenario. Combine publication into one PR so those surfaces describe the two updated paths consistently. Keep both child contracts and each platform's regression/native evidence separate; this is one implementation per platform, not duplicated work. No merge/release/tag is authorized.
The Apple prior-production proof passed: restored old runtime caused five unit failures and the real corrupt-ipa provider failure. Its exact gate atc75dc272 remained FAILED because the Limrun iOS test still pinned uninstall-before-prepare. Update that stale expectation without deleting credentials, cleanup or identity assertions; the Android analogue needs the same update. Before publication, run platform-specific discrimination and one exact gate on the combined reviewed commit. Applicable live evidence remains mandatory or an explicit draft blocker.
Raw receipt correction: the failed Apple gate selected20checks:6passed,1failed,8skipped and5not-run. The five not-run were unit,provider-integration,command-docs,docs-links,docs-prose. The4050full-unitfallback was retained but not executed. The worker summary saying no unrun checks was incorrect. Keep the actual failed receipt and historical base-reproduced provider timeouts with cause unproven; no blind retry or quiet-host diagnosis is inferred.
thymikee commentedon Nov 13, 2026
Current state: Apple4516 and Android4517 are combined locally at cf65623, preserving one implementation per platform and both child contracts. Independent component reviews found the production reorders correct; small documentation/test findings were fixed by the coordinator. Pinned focused feedback passed55runtime tests across2files,15targeted provider tests with9filtered skips,typecheck,full formatting and diff-check.
Apple's earlier old-production experiment remains proven atc75dc272:5unit failures and1real-provider failure for the destructive old order. Its failed exact gate is preserved; the stale Limrun shared-order expectation was corrected for both platforms. The actual old receipt retained the4050unitfallback but did not execute it after related tests failed. Historical base-reproduced provider timeouts remain cause-unproven. Next: final combined source review, Android-specific discrimination and one exact gate on the new commit. Both native app/data-retention and successful-fresh-reinstall controls remain pending. Unpublished; no readiness claim.
thymikee commentedon Nov 13, 2026
Current state: The full-unit fallback at4e5d112 found one missed legacy Limrun old-order assertion, not a production or timeout failure. Root migrated that sequence and its name while keeping credentials,identity,uninstall and cleanup assertions. Five tests in that legacy file,pinned format and diff-check passed. New combined head88bfc20263d77baedc88db4c4cdb9349bc7fe740 is clean. A sibling source search found no other same-order assumptions in this command family.
The failed exact receipt is preserved:7checks passed,unit failed,4checks did not run,8were skipped. Unit ran19769passed/1failed/10skipped. Both platforms' prior-production regression proofs remain valid for unchanged runtime blobs. One new exact gate is justified by the concrete test repair; no blind retry or cap weakening. Native app/data retention and successful fresh-reinstall controls remain pending. Combined publication with4517 is still unpublished and not ready.
thymikee commentedon Nov 13, 2026
Current state: The combined #4516 + #4517 candidate at 88bfc20 passed its one exact-head affected gate. The receipt records exactCommit=true, checkoutChanged=false and failOpen=false: 11 checks passed, 8 skipped for their named GitHub/manual owners, and provider-integration deduplicated against related tests. None failed or remained unrun. Full unit passed 19,770 with 10 skipped; related tests passed 390. Both prior-production reorder experiments remain recorded separately.
The earlier stale-order and max-lines failures remain historical failed receipts. The historical 5000ms provider timeout causes remain unproven. This pass does not establish GitHub or native evidence.
A bounded Claude worker now owns the single native/execution slot. It will use assigned stopped T3 devices and a privately bound candidate runtime to check failed-preparation app/data retention and a successful fresh-reinstall control on each platform, then clean only its resources. Native evidence and CI are pending. The combined PR is not yet published; no readiness or merge claim.
thymikee commentedon Nov 13, 2026
Current state: Published the combined reinstall fix in #4533 at
88bfc20263d77baedc88db4c4cdb9349bc7fe740. The exact-head affected gate passed (11 passed, 8 named skips, 1 provider deduplication; full unit 19,770 passed/10 skipped; related 390 passed). Separate Apple and Android prior-production experiments detected the old destructive order.Owned native controls also passed through the private candidate daemon: on Android 15/API 35 and iOS 27.0, a saved app marker survived failed archive preparation, and a valid reinstall reset the marker. The invalid first iOS fixture-crash attempt is excluded. Apple runner binary provenance was not independently checked; the changed deployment order runs in the verified candidate daemon and no runner source changes. Native cancellation and protection against arbitrary invalid APK/app bundles are not claimed. Owned fixtures, sessions, daemon and devices were cleaned up.
Remote review evidence is in #4533 (comment) . CI and PR review remain pending, so this is published, not merge-ready. Historical failed receipts and unproven provider timeout causes remain preserved. No merge/release/tag.
thymikee commentedon Nov 13, 2026
Current state: Both PR4533 review corrections are pushed at9d7993318de5d202ecb7c653ff099baca1f43e8f. The post-prepare cancellation case retains the earlier case and proves cleanup without uninstall/install; the provider case now asserts typed INVALID_ARGS from a real no-app IPA archive instead of third-party extractor prose. Both original review threads have replies and are resolved; the last thread query showed none open.
The exact-head affected gate passed: 11 checks passed, 8 named skips, 1 provider deduplication, no failures or unrun checks. Full unit passed 19,771 with 10 skipped; related tests passed 390. The revised provider fixture detects the original destructive order and restored controls pass. The cancellation proof carries over through identical runtime/test blobs. Validation evidence: #4533 (comment) . Original native evidence remains attributed to production-identical88bfc202.
Current-head CI is pending. The existing watch remains until CI is green and no review feedback is open. No merge is authorized.
thymikee commentedon Nov 14, 2026
Current state: PR #4533 is green at9d7993318de5d202ecb7c653ff099baca1f43e8f: 21 reported checks succeeded and1was skipped; none failed or remain pending. Both requested review fixes are pushed, both original threads have replies and are resolved, and the final thread query shows zero open threads. Cubic reports all issues addressed and Sentinel approves with no open findings. The PR is mergeable with CLEAN merge state.
The exact-head local gate, original-order regression experiments, skipped-cleanup mutation and source-identical native retention/fresh-reinstall controls are recorded in #4533 (comment) . The Chief of Staff's watch-until-green/no-open-feedback request is complete. Returning the PR to the user's inbox; no merge, release or tag occurred. Child issues remain open until their implementation merges.
thymikee commentedon Nov 14, 2026
Current state: Merged in #4533 on2026-11-14 at07:27UTC. The reviewed source head was9d7993318de5d202ecb7c653ff099baca1f43e8f; merge commit is2131de146245137ce7b5b53dff33632b14a47e07. GitHub closed both#4516 and#4517 as completed. Exact local validation, regression/mutation discrimination, native retention/fresh-reinstall evidence, green CI and resolved review threads remain recorded in the PR. The coordinator observed the merge and did not perform it. No additional implementation is needed for these two scopes.