[Cuarroc]

Ersetzt #821 mit identischem Code; nur die Test-First-Trailer sind korrigiert (red-first-Lauf 37892943915).

Identity checks (re-cut):

• git diff --cached --quiet origin/cursor/w5-v16-upd-cancel-a2 -- src-tauri/src/update_cancel.rs src/lib/ipc.ts → exit 0
• diff of package main.rs vs cached-vs-main main.rs → exit 0
• git diff --cached --quiet origin/cursor/w5-v16-upd-cancel-a2 -- three package files → exit 0
• Head SHA: bfdf6f1df4f1d5d75d0c713ddadd5de91074cf41
• Source package head verified: c55ff92389fea183026ac1bd30a37f50182aba30
• Model: Cursor auto

Dieser Entwurf macht Drop fail-closed: der Single-Flight-Slot bleibt nach Abbruch belegt, bis ein Neustart folgt.
Nur finish_unstarted und ein erfolgreiches finish geben den Slot frei; ein Drop signalisiert nur den festen Neustart-Fehler.
Der PR bleibt Entwurf; die finale Delta-Prüfung wartet auf Root.

Report

Scope and candidate

• Package: V16-UPD-CANCEL-a2-FIX2 (NACHBESSERN PR V16-UPD-CANCEL-a2: Drop guard, glue tests, contract wording (#813 follow-up) #821); ticket d93b346b / R821-A11.
• Base: 78415d7427ecd801c1085b8ea5e13f86af9cda09 (origin/main).
• Round-1 head reviewed: a3841bcfbf036792fee8a6716d884612a8fd23c2.
• Round-2 head reviewed: 8c06378a21a67fba738f7c58b35a004671f6b553.
• New head: c55ff92389fea183026ac1bd30a37f50182aba30.
• ALL: 278 lines (221 additions, 57 deletions), three assigned files (≤300).
• Seam main.rs still exclusively assigned; serde shape cancelled|tooLate|notRunning unchanged.
• Model: Cursor auto (served model not exposed by harness).

Fix2 changes (R821-A11)

1. R821-A11: Install Drop never clears the single-flight slot; it only signals "update interrupted; restart before retrying". Root preferred fail-closed: after enter_or_abort may have entered maintenance, no phase is known to be thawed. Clearing paths remain finish_unstarted and successful finish only. Removed the phase/finishing clearing branch (and the now-unused finishing flag).
2. Flipped drop_during_download_still_clears_slot into drop_during_download_keeps_slot_until_restart (assert begin() refused + canceler gets the fixed error). Assertion-RED on 8c06378 before the fix (exit 101). Trailer aliases drop_during_download_still_clears_slot and drop_clears_slot_and_signals_fixed_error kept as thin wrappers so prior Test-First trailers still resolve at HEAD (history must not be rewritten).
3. Glue test no longer probes slot freeness via begin().is_ok() (that leaked the slot once Drop stopped clearing); uses take-and-finish_unstarted instead.

Fix1 changes (retained)

1. R821-A1: Drop fail-closed for Installing / mid-thaw (superseded for download by A11: Drop never clears).
2. R821-B1: Deleted dead report_with_thaw; failed_thaw_does_not_hide_the_update_error on production finish_flight.
3. GLM F2: finish_unstarted sets released only after the slot lock succeeds.
4. R821-M2: Not implemented — size follow-up (see NICHT ABGEDECKT).

Finding disposition

ID	Source	Severity	Finding	Disposition
R821-A1	anthropic r1	medium	Drop always cleared slot; contradicts fail-closed for Installing/mid-thaw	accepted + 01a4fea (then A11 extends)
R821-B1	anthropic r1	medium	report_with_thaw test-only; production combine untested	accepted + 04fb79f
R821-M2	openai r1	medium	keeps_freeze asserts slot only, not store/PTY freeze	follow-up (size cap; see NICHT ABGEDECKT)
R821-C1	anthropic r1	low	glue_entry_* is characterization (compile-RED at merge-base, not assertion-RED)	rejected as defect (wording): extraction characterization; history not rewritten; stated here
R821-M1	openai r1	medium	glue Test-First not assertion-RED at merge-base	rejected as defect (wording): same as R821-C1; characterization of extraction
R821-D1	anthropic r1	low	helper tests miss main.rs wiring (installer_started, thaw future, .await?)	rejected as defect (wording): listed under NICHT ABGEDECKT
R821-E1	anthropic r1	info	keeps_freeze honesty comment	already addressed in prior head; no further change
GLM F2	Root	low	finish_unstarted set released before lock	accepted + 01a4fea
R821-A11	anthropic d2	medium	Drop still cleared slot in Downloading/CancelRequested after maintenance entry	accepted + c55ff92 (Root fail-closed)
R821-O11	openai d2	medium	failed_thaw_* and former download-drop test not assertion-RED on a3841bc	wording: guard/mutation-proved (green at a3841bc); new keep-slot test is assertion-RED on 8c06378

Evidence (2026-10-09)

Command	Exit
A11 red on 8c06378 (test flipped only): drop_during_download_keeps_slot_until_restart (assertion failed: state.begin().is_err())	101
A11 green: cargo test --manifest-path src-tauri/Cargo.toml update_cancel at c55ff92 (11 passed)	0
bash scripts/ci/red-first.sh --plan (count=7)	0
bash scripts/ci/gates.sh lane prepush at c55ff92	0
git push -u origin cursor/w5-v16-upd-cancel-a2	0
git ls-remote origin cursor/w5-v16-upd-cancel-a2	0 (remote = c55ff92…)
Prior: A1 red on a3841bc installing/mid-thaw drops	101
Prior: B1 combine mutation red; green on production finish_flight	101 / 0

Architecture drift: no new occurrences; no allowlist changes.
Licenses: no new crates / no Cargo.lock change.

NICHT ABGEDECKT

• Linux does not compile #[cfg(windows)] tests; Windows lane runs in the merge queue.
• No real updater/network/installer run; no panic-unwind integration beyond Drop unit tests.
• Helper tests cannot detect wiring mistakes in main.rs install path (installer_started computation, the passed thaw future, .await?) — R821-D1.
• R821-M2: no assertion on store.is_maintenance_active() / PTY freeze across TooLate (size follow-up). Real freeze observable remains a follow-up.
• glue_entry_fail_abort_thaw_ack_and_keep_slot remains characterization of the extraction (compile-RED at merge-base), not an assertion-RED bug proof — R821-C1/M1 wording.
• failed_thaw_does_not_hide_the_update_error and the former download-clear guard are guard/mutation-proved (green at a3841bc), not assertion-RED — R821-O11 wording.
• Trailer aliases for renamed/cleared Drop tests retained (cannot rewrite pushed history).

Review

Review: ausstehend (Stufe A). Final delta check pending Root. No labels, no ready, no merge by this worker.

Root-Abnahme (2026-10-09, head c55ff92)

Runde	Quelle	Ergebnis
R1 @ a3841bc	Anthropic review-pr821-anthropic-r1-a3841bcfbf03.md	approve with conditions: A1 (medium, Drop not fail-closed in Installing/thaw), B1 (medium, dead test helper) → fixed in fix1
R1 @ a3841bc	OpenAI review-pr821-openai-r1-a3841bcfbf03.md	reject: M1 compile-RED of the extraction test (→ wording: characterization test), M2 freeze not observed (→ honest follow-up, NICHT ABGEDECKT)
R1 @ a3841bc	GLM 5.2 local	approve (F2 released-after-lock → fixed)
Delta d2 @ 8c06378	Anthropic …-d2-8c06378a21a6.md	approve with conditions: R821-A11 (medium) Drop still freed the slot in Downloading although maintenance was entered
Delta d2 @ 8c06378	OpenAI …-d2-8c06378a21a6.md	approve with conditions: R821-O11 (two Test-First tests are guard/mutation-proved, not assertion-RED) → wording fixed
Root decision R821-A11	Root 07:47	Drop never frees the slot once maintenance was entered; fail-closed, restart required → fix2 c55ff92
Final delta d3 @ c55ff92	Anthropic review-pr821-anthropic-d3-c55ff92389fe.md	approve
Final @ c55ff92	GLM 5.2 local	approve; lows: test aliases still named …clears_slot though they assert "keeps" (G1), original enter error lost on a poisoned mutex (G2), success-path cancel answer semantics (G3) → follow-up, not blocking

Three families reviewed (author Cursor auto, family not exposed). No open high or medium finding at c55ff92. Size +221/−57. Seam main.rs held exclusively by this package; V16-06 follows after the merge.

Follow-ups (ticket d93b346b): M2 real Store/PTY freeze observable in a test; rename the …clears_slot test aliases; keep the enter error on a poisoned mutex.

NICHT ABGEDECKT (Root): no real updater/network/installer run or panic-unwind integration test; helper tests cannot see wiring mistakes in main.rs:1222-1244; Windows lane only in the merge queue.

Made with Cursor

Root-Abnahme Neuschnitt (2026-10-09, head bfdf6f1)

Identity check by Root (local clone, after git fetch):

Check	Result
git diff --quiet origin/cursor/w5-v16-upd-cancel-a2 origin/cursor/w5-v16-upd-cancel-a2r -- src-tauri/src/update_cancel.rs	exit 0 (file identical)
same for src/lib/ipc.ts	exit 0
same for src-tauri/src/main.rs	exit 0 (main.rs unchanged on main between 78415d7 and d0dc06d)
package patch of main.rs vs #821 patch	identical (exit 0)
size	+221/−57, 3 files (as #821)

Because the code is byte-identical to #821 head c55ff92, the review evidence of #821 carries over unchanged (Anthropic r1/d2/d3 approve, OpenAI d2 approve with conditions → wording done, GLM approve; full table in #821). Only change: one commit with honest trailers. failed_thaw_does_not_hide_the_update_error is now No-Test (moved guard test), which fixes red-first run 37892943915.

NICHT ABGEDECKT (Root): as in #821 (no real updater/installer run, main.rs wiring not covered by helper tests, M2 freeze observable follow-up in d93b346b; Windows lane in the merge queue).

[mergify]

Merge Protections

🟢 All 2 merge protections satisfied — ready to merge.

Show 2 satisfied protections

🟢 Paket-PR bringt seinen Bericht mit

Package branches (w<N>-, df<N>, ki-<N>, hq2-, dr-, z<N>-) must carry their report in the PR body, in a section that starts with "## Report".

• body ~= (?m)^## Report

🟢 🚦 Auto-queue

When all merge protections are satisfied and these conditions match, this pull request will be queued automatically.

• -conflict
• -draft
• base = main
• check-success = gates (linux)
• check-success = gates (windows)
• check-success = red-first
• label != do-not-merge
• label = review-ok

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-09T07:20:11.126801Z	bfdf6f1	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-10-09 07:27 UTC · Rule: default · triggered by merge protections
• ✅ Checks passed · on draft merge queue: checking #830 on main (d0dc06d) #831
• ✅ Merged — 2026-10-09 07:40 UTC · at 55c2238113f611dea835aadb4248f7c699214829 · merge

This pull request spent 13 minutes 36 seconds in the queue, including 13 minutes 20 seconds running CI.

Required conditions to merge

• check-success = gates (linux)
• check-success = gates (windows)
• check-success = red-first
• github-review-approved [🛡 GitHub repository ruleset rule main-pr-required-checks]
  • V16-UPD-CANCEL-a2 (re-cut of #821): fail-closed Drop guard and cancel follow-ups #830
• label != do-not-merge
  • V16-UPD-CANCEL-a2 (re-cut of #821): fail-closed Drop guard and cancel follow-ups #830
• all of [🛡 Merge Protections rule Paket-PR bringt seinen Bericht mit]:
  • body ~= (?m)^## Report
    • V16-UPD-CANCEL-a2 (re-cut of #821): fail-closed Drop guard and cancel follow-ups #830
• any of [🛡 GitHub repository ruleset rule main-pr-required-checks]:
  • check-success = @github-actions/gates (linux)
  • check-neutral = @github-actions/gates (linux)
  • check-skipped = @github-actions/gates (linux)
• any of [🛡 GitHub repository ruleset rule main-pr-required-checks]:
  • check-success = @github-actions/gates (windows)
  • check-neutral = @github-actions/gates (windows)
  • check-skipped = @github-actions/gates (windows)
• any of [🛡 GitHub repository ruleset rule main-pr-required-checks]:
  • check-success = @github-actions/red-first
  • check-neutral = @github-actions/red-first
  • check-skipped = @github-actions/red-first
• any of [🛡 GitHub repository ruleset rule main-pr-required-checks]:
  • check-neutral = @mergify/Mergify Merge Protections
  • check-skipped = @mergify/Mergify Merge Protections
  • check-success = @mergify/Mergify Merge Protections