fix(server): t3 update and service restart no longer fail on macOS 15#23017

Approvability

Verdict: Approved at be57564

Macroscope's review found this PR approvable — This is a focused macOS launchd compatibility fix that replaces the rejected bootout --wait option with bounded shutdown polling before restarting or removing the service. Linux behavior remains unchanged, and the new drain, timeout, and failure paths are covered by tests.

^{You can add or adjust custom eligibility rules. Learn more.}

Review in Change Stack →

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

Independent macOS 15.8.1 confirmation of the exit codes your print wait depends on — the gap your description flags as unchecked on 15:

Also hit the failure end-to-end: t3 service install exited 5 with the old job still loaded, and the same command succeeded after a manual plain bootout. Closing my duplicate #24631 in favour of this.

@kareemsetl These match the wait. It polls while print exits 0, treats 112 and 113 as gone, and fails on any other exit. I added your 15.8.1 results to the description.

updated the original branch at e49fd29d93844f6f3fd0eefa2529220910b331f3, preserving @tiliakoos's commits and merging current main without rebasing.

• kept plain bootout, strict bounded drain polling, and the 112/113 completion codes. shared command validation/logging removes the duplicate runner.
• kept the drain check mandatory during maintenance, even after a failed initial status probe. after a failed stop, restoration makes one final five-second probe and bootstraps only on 112/113. systemd recovery is unchanged.
• added coverage in the existing test file for 112, failed maintenance probes, drain timeout during maintenance, and restoration after a transient probe failure. both maintenance failures and the restoration failure were reproduced before their fixes.

verification: blacksmith vp run check:changed passed format, lint, both knip passes, graphql validation, affected server/scripts typechecks, and all 40 service tests. the existing darwin regression fails against current main's unsupported --wait command. all 28 final-head checks are green and git.cafe reports mergeable. two independent reviews approved the preceding head; their restoration-comment nit is also corrected. the final commit addresses the subsequent bot restoration finding with a failing-then-passing regression. coderabbit's final review was rate limited; its green check is not a fresh review. review rounds stopped at the requested limit.

unverified here: native macos 15 launchd and packaged CLI/provider/client integration, because this vm is linux. the original discussion independently confirms 112/113 and rejected --wait on macos 15.8.1; the contributor's macos 27 drain evidence is preserved. no client UI changed, so there are no screenshots.

known limit: optional bootout plus polling can total 240 seconds only when bootout itself hangs, as already discussed and accepted in the original thread. the old shared-deadline suggestion adds machinery for that bounded failure path, so it remains declined. no labels changed, no pr closed, and nothing merged.

Verified in a real dev environment

no changed application behavior could be verified on this linux boat vm. this is an unverifiable result, not a passing runtime verification.

reviewed the description, complete two-file diff, discussion, inline review threads, and commit authors at e49fd29d93844f6f3fd0eefa2529220910b331f3. the pr is open; its listed commits are by tiliakoos and maria-rcks. git.cafe also numbers it #23017. its 28 reported checks are successful; native mergeability was pending when inspected. ci is not runtime proof.

checked the real host prerequisites:

uploaded platform command transcript, downloaded and inspected after upload.

Not verified

native macos launchd is required for every changed behavior: plain bootout followed by bounded print polling, delayed bootstrap until exit 112/113, fail-closed drain timeout/probe errors, and restoration after a failed maintenance stop. the affected user paths are t3 service install, t3 service restart, t3 service uninstall, and update/maintenance through withStopped.

could not reproduce the original macos 15 failure on main or verify the pr fix on this linux vm. linux selects systemd, so a running web app or a real codex turn would bypass the launchd path. no platform mocks or fixtures were substituted. no main worktree/install, pr checkout/install, dev server, provider turn, screenshots, or recording was made. nearby service restart/uninstall and update recovery remain unverified in a real runtime. no source changes or pushes were made, and no processes were started or retained.

next verification requires a disposable macos 15 environment with real launchd: reproduce the rejected bootout --wait on main, then exercise install/repair, restart, uninstall and update on this exact head, including a draining service and recovery failure paths. the macos evidence already in the discussion is prior evidence, not a check reproduced during this pass.

Closing in favour of #26088, which makes the same change. Thanks for the work here!

Closing in favour of #26088, which makes the same change. Thanks for the work here!

No problem thanks