The 2.0.0 update helper renames staged files from os.TempDir() onto the
running executable's directory. On the common Arch/Fedora layout where
/tmp is tmpfs and $HOME is persistent, that rename crosses filesystems
and fails with EXDEV ("invalid cross-device link"). The helper's
recovery path then deletes the working binary while failing to restore
it: twenty observed attempts, an orphaned .bak, and no running app.
Guard against this at startup instead of mid-swap:
- swapPathProven() exercises the exact move the helper will perform
(os.Rename from os.TempDir() into the executable's directory) with a
throwaway probe file, then cleans up after itself.
- maybeEnableUpdater() skips the updater entirely when the probe fails
or the build version is empty, logging the reason. A loud skip beats
a destructive attempt that can strand the user with no app.
- renameProbeOK() is the testable core, taking explicit tmp/target dirs.
- updater_probe_test.go covers same-filesystem success with no leftover
files, and fail-closed behavior for missing tmp dir, missing target
dir, and unwritable target dir.
- V3_MIGRATION.md documents the probe and the incident that motivated
it.
maybeEnableUpdater inits app.Updater (CurrentVersion from wails.json, embedded public key, accent-themed builtin window) behind two gates: -tags production (wails3 build sets it, dev does not) and application.System.IsDesktop (mobile stays on Obtainium). The startup check is headless; the window opens via a second CheckAndInstall only when an update is found. ANITRACK_UPDATER_CHANNEL=beta opts into -rc pre-releases for testing. updater_flow_test.go drives the REAL framework verifier headless: good signature stages byte-identical, tampered signature rejected (both phases green). Works around the framework process-wide app singleton with a single two-phase test.
John O'Keefe