fix: bound auto-update network load so a bad release can't spam GitHub/gateways#4593

Merged

sanity merged 11 commits into

mainfrom

fix/auto-update-load-bounding

Jun 27, 2026

Commits on Jun 27, 2026

fix: bound auto-update network load so a bad release can't spam GitHub/gateways

sanity
and
claude
committed
fix: macOS wrapper give-up must exit 0 (launchd SuccessfulExit=false respawns non-zero)

sanity
and
claude
committed
fix: address Codex review (rate-limit result + macOS crash-loop semantics)

sanity
and
claude
committed
fix: token bucket must not rewind stored timestamp on backwards clock

sanity
and
claude
committed
fix: use separate GitHub-poll buckets for node vs installer (no starvation)

sanity
and
claude
committed
fix: bucket fails closed on unpersistable write; macOS exit-2 is a benign no-op

sanity
and
claude
committed
fix: count swallowed macOS DMG-swap failures toward the install-failure gate

sanity
and
claude
committed
fix: don't record check-time for rate-limited polls (preserve RateLimited result)

sanity
and
claude
committed
fix: gate only on deterministic verification failures, not transient ones

sanity
and
claude
committed
docs: clarify gate counts present-but-wrong artifacts, not missing ones

sanity
and
claude
committed
docs: document RestartSteps x StartLimit (#4551) tradeoff in systemd units

sanity
and
claude
committed