Commit ef4ec2ad4b9b08d1aca31d68aea28f0a846ef295 | the-knife

author	Theo Browne <me@t3.gg> 2026-07-31 03:46:47-07:00
committer	GitHub <noreply@github.com> 2026-07-31 03:46:47-07:00
log	ef4ec2ad4b9b08d1aca31d68aea28f0a846ef295
tree	577179355579f677b4dec2e9d23aa61ab260e6aa
parent	61514c1294ff79e2a9924551b2042fcc0d1c3a34
signature	Signed by PGP key B5690EEEBB952194

fix(server): self-update no longer rolls itself back on restart (#5095)

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

2 files changed, 23 insertions(+), 6 deletions(-)

apps
- server
  - src
    cloud
    selfUpdate.test.ts
    selfUpdate.ts

apps/server/src/cloud/selfUpdate.test.ts+10-2

 @@ -545,11 +545,19 @@ it.layer(NodeServices.layer)("ServerSelfUpdate.update", (it) => {
       yield* TestClock.adjust(Duration.seconds(10));
       assert.deepEqual(context.commands[3], {
         command: "systemctl",
-        args: ["--user", "restart", "t3code.service"],
+        args: ["--user", "restart", "--no-block", "t3code.service"],
       });
       assert.lengthOf(context.spawns, 0);
       // systemd replaces the process; the server must not exit itself.
       assert.equal(context.exitCount(), 0);
+      // The queued restart returns while this process is still shutting
+      // down; the lock must stay held so a second update cannot rewrite the
+      // unit mid-teardown.
+      const concurrentError = yield* context.service
+        .update({ targetVersion: "0.0.30" })
+        .pipe(Effect.flip);
+      assert.include(concurrentError.reason, "already in progress");
     }).pipe(Effect.provide(TestClock.layer())),
   );
 @@ -583,7 +591,7 @@ it.layer(NodeServices.layer)("ServerSelfUpdate.update", (it) => {
       assert.deepEqual(
         context.commands.slice(-2).map((entry) => entry.args),
         [
-          ["--user", "restart", BOOT_SERVICE_UNIT_FILE],
+          ["--user", "restart", "--no-block", BOOT_SERVICE_UNIT_FILE],
           ["--user", "daemon-reload"],
         ],
       );

apps/server/src/cloud/selfUpdate.ts+13-4

 @@ -354,14 +354,19 @@ export const make = Effect.fn("cloud.server_self_update.make")(function* (option
           targetVersion,
         });
         // Restart after the acknowledgement has had time to cross any relay
-        // hop. If systemd rejects the handoff, restore the previous unit while
+        // hop. --no-block queues the restart job and exits before systemd
-        // this process is still alive and log the failure for diagnostics.
+        // stops this unit: a blocking restart's SIGTERM reaches the systemctl
+        // child (it shares this service's cgroup), which read as a restart
+        // failure and rolled the new unit back while the old server finished
+        // shutting down. With the handoff race gone, a non-zero exit or spawn
+        // error means systemd genuinely rejected the job while this process is
+        // still alive, so restoring the previous unit below stays correct.
         yield* scheduleRestart(
           Effect.gen(function* () {
             const restart = yield* runner
               .run({
                 command: "systemctl",
-                args: ["--user", "restart", BOOT_SERVICE_UNIT_FILE],
+                args: ["--user", "restart", "--no-block", BOOT_SERVICE_UNIT_FILE],
               })
               .pipe(
                 Effect.mapError((cause) =>
 @@ -389,9 +394,13 @@ export const make = Effect.fn("cloud.server_self_update.make")(function* (option
             Effect.catch((error) =>
               Effect.logError("Server self-update could not restart the boot service.").pipe(
                 Effect.annotateLogs({ targetVersion, error: error.reason }),
+                // Permit a retry only after the failed handoff was rolled
+                // back. A queued restart returns while this process is still
+                // shutting down; releasing the lock then would let a second
+                // update rewrite the unit mid-teardown.
+                Effect.andThen(Ref.set(inFlight, false)),
               ),
             ),
-            Effect.ensuring(Ref.set(inFlight, false)),
           ),
         );
       } else {