[johnny4young]

Exact-head qualification (2026-10-07)

Ready for independent maintainer review. CI run 37661223312 passed all 10 jobs on head 99a1c54f9f186feaaaa892cdcb6e1b247b29d176: ShellCheck, shfmt, actionlint, workflow validation, smoke tests and composite-action installs across Linux/macOS/Windows.

• Linux: all 32 portable suites passed
• macOS: 30 suites passed, 2 explicit OS skips, both in the native Bash 3.2 lane and ordinary lane
• Windows: 13 suites passed, 19 explicit OS skips; PowerShell syntax/analyzer/installer checks passed
• The new prune-recovery suite ran and passed on all three OSes
• Hosted checkout 19686ea58f53c8f650c02f8080ea956aefdfdb7d is GitHub's synthetic test merge. Its fetched tree equals the head and locally tested tree b7fbe479fe9628173ba5ed7b3cb5bc09bc3b9d89

The local Ruby limitation below remains accurately recorded; hosted checks supplied that missing coverage. No merge, release or deployment performed.

Problem

gos prune --rollback treated an executable bin/go as a healthy active installation when deciding whether to remove crash-recovery .gos-backup.* / .gos-current.* copies. A broken executable, including one that prints a version and exits 7, could therefore cause the only working recovery copies to be removed. The README promises residue is removed only once active Go works.

Change

• Before removing residue, probe the managed installation's own binary with the existing _gos_go_version_of helper
• Require both a successful exit and a recognizable version; GOTOOLCHAIN=local prevents a project/caller toolchain override from downloading or masking the broken binary
• Probe at most once, only when --rollback is requested and residue actually exists
• Preserve both recovery paths when the probe fails or returns no version; use the same decision for real and dry-run JSON reports
• Explain how to repair the active installation before retrying in human output; update README, architecture reference and changelog

Explicit removal of the named .gos-rollback slot and cache cleanup retain their existing semantics. This guard concerns crash residue, which may be the last working copy after interrupted activation.

Regression evidence

The new offline fixture first failed against main: an active binary printed a valid Go version but exited 7, while the dry-run still reported both recovery copies as removed. It now covers failed, empty and healthy probes, real/dry-run JSON counts, preservation/removal on disk, one probe per cleanup, local toolchain forcing, no network, and no probe for ordinary prune or an absent residue set.

Validation and limits

• New regression suite passed all four fixture groups
• Full portable runner: 25/32 suites passed locally; seven suites failed because Ruby is not installed (action, completions, env-reference, homebrew-tap, packaging, runner validation fixture, workflows)
• scripts/validate-local.bash --required-only is blocked at its required Ruby preflight; command-surface generation cannot be validated locally without it
• bash -n gos.sh install.sh tests/prune-recovery.bash and staged whitespace checks passed
• ShellCheck 0.11.0 and shfmt 3.13.1 now pass locally across all tracked shell sources, using workspace-local official release binaries; Ruby remains unavailable
• Tested local staged tree equals published tree b7fbe479fe9628173ba5ed7b3cb5bc09bc3b9d89
• Exact-head hosted qualification is recorded above; independent maintainer review remains

Risk and scope

Pruning residue now executes the managed binary's local version probe. Unrecognized/custom runtimes are conservatively preserved instead of treated as disposable recovery state. The probe does not authenticate a binary; archive integrity remains gos verify's responsibility.

Based on main 05d9e25361e1d7e328f0fc057b7d79b442ee2304; deduplicated against open #41 and #44–50. #50 improves doctor diagnostics, while this change guards destructive cleanup. No API/schema change, merge, release or deployment.