[abruption]

Summary

Closes #28. Closes #29. Closes #30.

#41 (#27) is merged. This PR now targets main and contains the follow-up work for #28–#30. #42 remains unmerged while Codex automatic review completes.

• feat: check for newer stable GitHub releases #28: bounded stable/pinned GitHub release checks, fixed repository/asset validation, original manifest bytes, explicit unauthenticated HTTP download proxy and sanitized JSON results.
• feat: notify users when a newer release is available #29: opt-in cached local notices with freshness, deduplication and a bounded interactive-start hook. No startup network calls, automatic timer, external messaging or installation.
• feat: add verified manual updates with backup and rollback #30: verified local-bundle or fixed-release updates in a detached worker, durable transaction records, shared operation lock, source-only backups, exact shim lifecycle checks and bounded rollback. Tailscaled/sshd and identity/configuration remain in place; binary-version changes are refused.
• Update English, Korean, Simplified Chinese and Japanese documentation.

Independent review — completed before PR creation

Claude Code 2.1.305, requested and response-metadata-confirmed claude-opus-5-5, reviewed frozen source/test/document inputs with tools disabled, safe mode and no session persistence.

The first independent review found three required fixes:

1. Owned candidate exit races could incorrectly block rollback.
2. Journal write failures could prevent the rollback operation itself.
3. Some operational exceptions violated the JSON error contract.

All three were fixed with regression coverage. Additional findings improved interpreter preflight, terminal acknowledgment, original manifest preservation, proxy scope and notification handling. The follow-up on source commit fe436ec reported no remaining required fixes before the live trial. Claude reviewed source material; it did not execute the tests or operate Dots.

Automated validation

• Linux Python 3.11 and 3.13: 256 tests passed each, including real pidfd termination, installer and usage-guide tests.
• ShellCheck, Bash syntax, manifest freshness and diff checks passed.
• Reviewed source CI and final PR CI both passed. Final documentation-only commit retains exactly the reviewed/live-tested executable sources and manifest.
• An initial real Linux /proc exit-race failure was fixed; it was not hidden with a longer sleep or a weakened assertion.

Authorized live Dots trial

User explicitly authorized the trial and confirmed an independent cloud terminal.

• Existing v0.3.0 four-file hashes matched independently obtained Git tag contents before a deliberate legacy manifest migration.
• Normal update to reviewed 0.4.0-dev: started → applied, all source hashes match.
• Intentional immediately exiting shim bundle: failed_rolled_back, exit 1; exact healthy candidate code/manifest restored.
• Deliberately mismatched bundle: refused before code replacement, no new transaction.
• Fresh strict-host-key SSH and DERP ping succeeded after apply and rollback.
• Public node/SSH identity, proxy configuration, existing tailscaled/sshd identities and protected key-file metadata stayed unchanged. No private-key or node-state contents were read or hashed for verification.
• Live explicit-proxy release check returned structured unsupported_release, as expected because published v0.3.1 lacks the new manifest.
• The healthy development candidate remains installed. The experimental watchdog was restarted for the new boot and external observation reports verified_running.

See dated validation evidence.

Limits

• This is a development candidate, not a published v0.4.0 release. A future release must include source-manifest.json alongside the four source assets. No fake public release was created to test downloads.
• applied proves local readiness and bundle consistency; external SSH remains separately verified. Checksums do not independently authenticate a publisher.
• Incomplete transactions, uncertain process identity, stale temporary files and unrecoverable disk errors require manual review. The recovery/archive procedure and remaining validation limits are documented.
• No deliberate VM destruction or live power-loss/SIGKILL trial was performed. A separate pre-deployment boot-change outage is recorded in #20; VM replacement still requires an independent start path.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-21T04:31:04.405981Z	818f32e	PR opened
🔒 Security Review	✅ Completed 2026-10-21T04:36:38.964858Z	818f32e	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.