Prove application quiescence before swap

[peters]

Summary

• prove the original child generation is gone before PREPARING_SWAP
• cover both the current app layout and retained versioned application layout
• keep the restart retry deadline as failure-only tolerance

Why

The end-to-end regression must observe the swap boundary directly. Final state alone cannot prove that directory mutation waited for complete application quiescence.

This is stack 15 of 16.

• Base: Validate recovery paths before supervisor shutdown #262
• Next: Address updater stack lint feedback #287

Relates to fintermobilityas/youpark#1310.

Validation

• exact layer b6be696 passed both update-layout quiescence regressions and the complete 391-test surge-core suite
• it resolves the actionable review feedback previously raised on this PR by checking stable process-generation disappearance at PREPARING_SWAP
• complete stack c48f19f passed 681 Rust workspace tests, both blocking Clippy tiers, vendor/version/format/maintainability checks, .NET formatting, and all 58 .NET tests

No migration is required.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

Suppressed comments (1)

crates/surge-core/src/update/manager.rs:4632

• These wrappers still check the child only after download_and_apply has completed, so they would also pass if a refactor moved termination until after the directory swap. That leaves the advertised pre-swap quiescence invariant uncovered. Please observe the child from the progress callback and assert it has exited when PREPARING_SWAP is emitted, before any swap operation begins.

    async fn assert_download_and_apply_quiesces_current_executable_when_target_name_changes(
        current_app_dir_name: &str,
    ) {

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

[peters]

Closing this stacked PR as superseded. The stack hardens in-process quiescence but cannot eliminate the updating process's mixed-install window and no longer matches the required stable app-directory design. Replacement work will use one external-finalizer change and preserve the stable app execution path. The branch is intentionally retained until the replacement is merged so its regression cases remain available for reference.