The 2.0.0 update helper renames staged files from os.TempDir() onto the
running executable's directory. On the common Arch/Fedora layout where
/tmp is tmpfs and $HOME is persistent, that rename crosses filesystems
and fails with EXDEV ("invalid cross-device link"). The helper's
recovery path then deletes the working binary while failing to restore
it: twenty observed attempts, an orphaned .bak, and no running app.
Guard against this at startup instead of mid-swap:
- swapPathProven() exercises the exact move the helper will perform
(os.Rename from os.TempDir() into the executable's directory) with a
throwaway probe file, then cleans up after itself.
- maybeEnableUpdater() skips the updater entirely when the probe fails
or the build version is empty, logging the reason. A loud skip beats
a destructive attempt that can strand the user with no app.
- renameProbeOK() is the testable core, taking explicit tmp/target dirs.
- updater_probe_test.go covers same-filesystem success with no leftover
files, and fail-closed behavior for missing tmp dir, missing target
dir, and unwritable target dir.
- V3_MIGRATION.md documents the probe and the incident that motivated
it.
John O'Keefe
4f36457563