Terminate relaunch probe before committing update

[mxcl]

What changed

• retain the process used to validate the updated app launch
• terminate that validation process and wait for it to exit before committing the update
• fail closed and roll back if the process cannot be stopped
• document the corrected relaunch lifecycle

Why

AppUpdater launched the installed executable to validate it, armed a fallback, and then terminated the old host without stopping the validation process. For apps managed by launchd, that process could survive as an orphan while launchd started the real managed instance, leaving two copies of the app running.

The validation launch is now explicitly temporary. The final application instance is launched by the existing fallback only after the old host exits.

Validation

• swift test --filter AppUpdaterTests.testRelaunch
• swift test — 57 tests, 0 failures

[coveralls]

Coverage Report for CI Build 30645286099

Coverage decreased (-0.01%) to 59.604%

Details

• Coverage decreased (-0.01%) from the base build.
• Patch coverage: 7 uncovered changes across 1 file (9 of 16 lines covered, 56.25%).
• 1 coverage regression across 1 file.

Uncovered Changes

File	Changed	Covered	%
AppUpdater.swift	16	9	56.25%

Coverage Regressions

1 previously-covered line in 1 file lost coverage.

File	Lines Losing Coverage	Coverage
AppUpdater.swift	1	59.6%

---

Coverage Stats

Relevant Lines:	1161
Covered Lines:	692
Line Coverage:	59.6%
Coverage Strength:	3.14 hits per line

---

💛 - Coveralls

[Copilot]

Pull request overview

This PR fixes the relaunch lifecycle during updates by ensuring the temporary “probe” process used to validate an installed app launch is terminated (and confirmed exited) before the update is committed, preventing orphaned validation processes (notably under launchd) and avoiding duplicate app instances.

Changes:

• Update ApplicationLauncher.launchNewInstance to terminate the validation/probe process and wait for exit before arming the fallback and proceeding.
• Expand unit tests to verify termination ordering and to fail closed when the probe cannot be stopped.
• Update user-facing documentation and refine the .relaunchFailed error message.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
Tests/AppUpdaterTests/AppUpdaterTests.swift	Updates/extends relaunch tests to assert probe-termination sequencing and failure behavior.
README.md	Documents the corrected relaunch lifecycle, including probe termination before commit.
AppUpdater.swift	Implements probe termination + wait in ApplicationLauncher and updates relaunch error text.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[mxcl]

@copilot do you consider your issue resolved?

[Copilot]

@copilot do you consider your issue resolved?

Yes — resolved in 96c3fc9. armFallback in launchNewInstance is now () throws -> Void with no PID parameter, and the call site passes getpid() (the current host's PID) to armFallback(oldProcessIdentifier:applicationURL:), not the probe's PID.