Same fake-99.0.0-bundle setup as before, but now drives it through the
hardened UpdateChecker end to end, in-process:
(a) reject-unsigned — the fake bundle, copied then plist-edited without
re-signing (editing Info.plist after copy invalidates the inherited
signature on its own — nothing stripped by hand), must be rejected by
checkNow(): updateAvailable stays nil and statusMessage is the exact
"Update is not signed by MMD" text.
(b) staged-signed — codesign --force --deep --sign the same bundle
(SHOTDECK_SELFTEST_SIGN_IDENTITY or the default Apple Development
identity), re-zip, re-serve the same appcast path; must now stage.
(c) atomic-install — installStaged into a throwaway <tmp>/Applications
(never real /Applications) pre-populated with a copy of the actually
running app; asserts the target lands on 99.0.0, Redline.app.previous
holds the original version, and no replacement-directory cruft is left
beside them.
(d) revert — revertToPrevious swaps the rollback copy back in; asserts the
target is back to the original version and .previous now holds 99.0.0.
Caught a real bug while wiring (d): replaceItemAt(target, withItemAt:
previousURL, backupItemName: "Redline.app.previous") self-clobbers, because
the backup name and the withItemAt source resolve to the same path — the
backup write lands before the swap ever reads it, so target ends up
unchanged. Fixed in UpdateChecker by staging previousURL through a throwaway
ditto copy first (same pattern installStaged already used).
Every existing phase (PICKER-SELFTEST, REGION-PERSIST, SEND-TRUTH, and the
final "UPDATE-SELFTEST PASS version=99.0.0") is unchanged and still prints.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
kua-agentandClaude Fable 5.1
365220ade8