appstore: uninstall stops what an app left running; renamed apps point to their new id (io.pilot.smolmachines)

[TeoSlayer]

Problem

io.pilot.smolmachines was renamed to io.pilot.smol (#398). Its catalogue entry is now a hidden tombstone and cannot be installed. Copies of 1.2.0 are still installed (this includes a developer Mac). Two gaps in pilotctl leave those installs leaking:

1. Uninstall leaves the app's processes running. A VM started through smolmachines.exec (smolvm-bin _boot-vm, about 311 MiB RSS) runs in its own session. So does a redis-server --daemonize, a postmaster, an exec child orphaned by the supervisor's pid-only SIGKILL, or an app instance orphaned by a daemon that died hard. All of these are reparented to init/launchd. appstore uninstall deleted the dir and left them running with nothing to manage them.

2. Nothing tells installed copies about the rename. catalogue/README.md promises tombstone handling, but no released pilotctl implements it. On main:

   command	result with the tombstone
   catalogue	lists Smol Machines (renamed → io.pilot.smol)
   install io.pilot.smolmachines	catalogue entry io.pilot.smolmachines has placeholder sha256 — the release pipeline hasn't filled this in yet
   outdated / upgrade --all (1.2.0 installed)	all installed apps are up to date
   upgrade io.pilot.smolmachines	already up to date (or not a catalogue app)

   So the old adapter stays in place, together with its leaks.

A related problem: 1.2.0 was also published for darwin/amd64, but its install.json has no smolvm build for that platform. Upstream ships none, from v1.2.0 through v1.18.0. On Intel Macs the adapter exited at every start (install assets: stage: no asset for darwin/amd64) until the supervisor suspended it.

Changes

• uninstall stops what the app left running (appstore_procs*.go). It finds processes by the path of their executable: inside the app dir, or inside one of its kept backups. It does not use the process tree, group or session, because those processes are free to leave them. It sends SIGTERM, waits 5 s, then sends SIGKILL. This runs before the delete, and again after it to catch a supervisor respawn. The output, --json (stopped_processes) and the audit record list what was stopped.
  • macOS reads the path from kern.procargs2. The kernel keeps it after the file is deleted.
  • Linux reads /proc/<pid>/exe. Under binfmt emulation (Rosetta for Linux, qemu-user) that link points at the translator, so Linux also looks for an executable mapping in /proc/<pid>/maps.
  • Each pid is checked again right before it is signalled.
• Rename tombstones.
  • catalogue hides them.
  • install <old> warns, then installs renamed_to. It follows one hop only.
  • install <old> --version X refuses and names the new id. The managed-fleet reconcile checks for the old id afterwards, so following the rename there would reinstall the new app every cycle.
  • outdated reports renamed.
  • upgrade --all skips renamed apps. The hourly updater runs it, and the new id has a different publisher key and different method names.
  • upgrade <old> exits 1 and prints the steps: install the new id, then uninstall the old one.
  • view prints a warning. call on an old id that is not installed says it was renamed.
• install refuses a cli bundle whose install.json has no native tool for this os/arch. It fails with platform_mismatch.
• Catalogue lint (catalogue/lint):
  • An entry with no bundle must be a well-formed tombstone. That means renamed_to names an installable entry, hidden is set, the publisher is kept, and there is no version and no metadata_url. Tombstones are checked on every run.
  • A cli bundle may only be published for platforms its install.json ships a tool for. Run against the historical smolmachines 1.2.0 entry, it reports: darwin/amd64: install.json ships smolvm only for darwin/arm64, linux/amd64, linux/arm64 ….
• catalogue/README.md documents all of the above.

The catalogue data is unchanged. The tombstone stays as it is: it holds the publisher pin for installed copies. Moving a node over is pilotctl appstore install io.pilot.smol, then pilotctl appstore uninstall io.pilot.smolmachines --yes.

Verification

Real io.pilot.smolmachines 1.2.0 darwin/arm64 bundle on macOS. The VM was started through smolmachines.exec machine create/start. Everything was isolated in a temp root and HOME, and sandbox-exec denied ~/.pilot and /tmp/pilot.sock.

origin/main:  VM pid=58593 STILL RUNNING after uninstall ... 319712 KB smolvm-bin
              LEAK: VM pid=58593 still running with nothing left to manage it
this branch:  stopped 2 process(es) still running from the app's files:
              smolmachines-app (pid 58665), smolvm-bin (pid 58844)        (0.53 s)
orphaned VM + respawned app (dead-daemon case):
              stopped 2 process(es) ...: smolvm-bin (pid 59091), smolmachines-app (pid 59223)

Migration. After uninstall io.pilot.smolmachines, io.pilot.smol (left running) lists the machine as stopped. It restarts it with its own smolvm-bin, then stops and deletes it.

Linux, real bundle, orphaned in-flight exec child (smolvm-bin serve start, left behind by the pid-only SIGKILL):

• linux/arm64 (native): LEFT on main, stopped on this branch.
• linux/amd64 (Rosetta for Linux, where /proc/<pid>/exe is /run/rosetta/rosetta): same result. The maps fallback caught it.

Tombstone, linux/arm64 docker, committed signed catalogue:

• Listing: 1 line on main, 0 on this branch (text and --json).
• install io.pilot.smolmachines: warned, fetched io.pilot.smol-1.2.0-linux-arm64.tar.gz, sha256 OK (62cd9b71…), installed io.pilot.smol v1.2.0.
• outdated: renamed: install io.pilot.smol, then uninstall io.pilot.smolmachines.
• upgrade --all: skip io.pilot.smolmachines ….
• darwin/amd64 (Rosetta): io.pilot.smol has no bundle for this platform (darwin/amd64); published platforms: darwin/arm64, linux/amd64, linux/arm64.

Tests:

• New: appstore_procs_test.go, appstore_tombstone_test.go, appstore_assets_platform_test.go, lint TestTombstonesMustBeWellFormed, TestCLIBundleNeedsANativeToolForEachPublishedPlatform.
• TestCmdAppStoreUninstallStopsLeftoverProcesses fails on main (stopped_processes = [], want pids …).
• go test -short ./cmd/pilotctl and catalogue/lint pass on:
  • macOS arm64, under sandbox-exec with a temp HOME;
  • darwin/amd64 under Rosetta (new tests);
  • linux/arm64 and linux/amd64 in golang:1.25.13-bookworm.
• go vet passes on every commit.
• Online lint of the committed catalogue with every entry treated as new: the new checks add no findings. The only findings are the four already known ones (cosift, generallegal and wallet legacy native bundles; the slipstream pin).

Not in this PR

• Stopping the app's process group when the supervisor stops an app is app-store Unit 3: Claim-based network mapping — auto-assign networks from token claims #39 (and a SIGTERM-first variant). With it, the in-flight exec child is never orphaned in the first place.
• Teardown of io.pilot.smol VMs when the adapter stops is app-template work for io.pilot.smol. The 1.2.0 smolmachines adapter is signed with the old publisher key and is not rebuilt, so for old installs, uninstall is where the cleanup happens.
• smolvm's disk images live in $HOME/Library/Caches/smolvm, outside $APP, and are shared with io.pilot.smol. Uninstall leaves them. That is what lets io.pilot.smol take over the machines.

🤖 Generated with Claude Code