feat: hot-swap upgrade — replace the binary while every tab stays live

[williamdes]

Add src/hotswap.rs: on 'tab-atelier upgrade' / POST /upgrade the running
process re-execs the binary installed at its own path, handing each
tab's PTY master fd (CLOEXEC cleared) plus a pid-validated JSON manifest
across the exec. Because exec keeps the pid, tab shells remain our
children — process groups, controlling TTYs, cgroups, and nftables
rules are untouched, so agents and builds inside the tabs never notice.

The new image adopts the fds at boot (AdoptedPty mirrors alacritty's
Unix Pty: same poller tokens, SIGCHLD pipe, waitpid exit detection)
instead of forking shells; grid contents restore through the existing
saved-output replay and the carried raw ring bytes re-seed viewer
scrollback. PTY readers freeze during the handoff so unread bytes wait
in the kernel and are parsed by the new binary — nothing is lost.

Adopted tabs skip exactly the work that assumes a fresh shell: agent
auto-resume (would double-launch the still-running claude), the GUI
net-off bubblewrap respawn (still jailed), the headless nftables
teardown/re-apply (would blip enforcement; only the gating DNS resolver
is respawned), the cgroup stale reap, and the agent reaper's provenance
record (removed at swap so the new boot can't SIGKILL the inherited
fleet). A shell that dies mid-swap falls back to a normal fresh fork;
a failed exec rolls back fully and the old binary keeps running.

Trigger surface: POST /upgrade (master token, 409 when no binary at the
re-exec path, 501 on Windows), 'upgrade' subcommand on both binaries,
docs/hot-swap.md, openapi.yaml entry.

Co-Authored-By: Claude Fable 5 noreply@anthropic.com
Claude-Session: https://claude.ai/code/session_01LTkVxFVGsaywyG4iJyTyvc

[codecov]

Codecov Report

❌ Patch coverage is 55.38194% with 257 lines in your changes missing coverage. Please review.
✅ Project coverage is 59.08%. Comparing base (581bd2d) to head (9e26330).
⚠️ Report is 2 commits behind head on main.

Files with missing lines	Patch %	Lines
src/hotswap.rs	66.27%	145 Missing ⚠️
src/app.rs	0.00%	46 Missing ⚠️
src/terminal.rs	45.09%	28 Missing ⚠️
src/cli/upgrade.rs	0.00%	24 Missing ⚠️
src/api/upgrade.rs	0.00%	12 Missing ⚠️
src/cli/dispatch.rs	66.66%	1 Missing ⚠️
src/pty_ring.rs	66.66%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main      #23      +/-   ##
==========================================
+ Coverage   52.47%   59.08%   +6.60%     
==========================================
  Files          92       95       +3     
  Lines       28268    29440    +1172     
==========================================
+ Hits        14835    17396    +2561     
+ Misses      13433    12044    -1389     

Flag	Coverage Δ
rust	59.08% <55.38%> (+6.60%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[williamdes]

CI note: Build & test & lint is failing on this branch, but the failures are not from this PR.

The three failing tests were added on main by 8128a04 (“test(cli): drive the CLI verbs against a real in-process API server”), and main’s own push run on that commit fails identically (run 33722747048):

• cli::dispatch::tests::dispatch_routes_each_command_to_its_verb — expects net-off/net-on to queue 2 net changes, but net-off is refused because bubblewrap isn’t installed on the CI runner (“bubblewrap (bwrap) is not installed on the daemon host”), so only 1 is queued.
• cli::share_link::tests::net_toggles_and_allowlists_reach_the_daemon — same bwrap dependency, plus net-allow needs the headless nftables path.
• cli::share_link::tests::ssh_agent_and_default_limits_are_queued — ssh-agent refuses under the GUI edition (“per-tab ssh-agent requires the headless daemon”), and the default-features test suite runs the GUI edition.

All three pass under --no-default-features --features headless,… locally (the coverage numbers in 8128a04’s message were measured on the headless lib). Likely fixes on main: gate these tests/asserts to the headless feature, or install bubblewrap in the workflow. I’ll rebase this branch as soon as main is green again; no fix exists on main yet to port.

---

Generated by Claude Code

[williamdes]

Update: opened #50 with the fix for the three edition/host-gated CLI tests, and cherry-picked the same commit onto this branch (9e26330) so CI here goes green without waiting on the merge. Once #50 (or an equivalent fix) lands on main, the next rebase will drop the duplicate commit automatically.

---

Generated by Claude Code