updater: cap updater.log, sweep abandoned bundle downloads; peer-churn goroutine gate

[TeoSlayer]

Closes two cleanup gaps found in a sweep of Pilot's on-disk and process leftovers, and adds a regression gate. It touches only cmd/updater/, one new file in tests/, and one line of .github/workflows/architecture.yml. No file here is touched by #470, #465, #464 or #467.

1. updater.log is now capped (like daemon.log)

install.sh's launchd job writes the updater's stdout and stderr to ~/.pilot/updater.log. launchd never rotates that file. On one laptop it held every line since the June install: 2,205 lines, 310 KB. Each failed GitHub check (API rate limit exceeded) adds a ~400-byte line an hour.

The updater now runs internal/logcap on its own stderr, the same way the daemon does for daemon.log (#464):

• It copy-truncates into gzipped updater.log.pilot.N.gz.
• New flags: -log-max-size (MB, default 10, 0 disables) and -log-max-backups (default 3).
• By default only a log inside ~/.pilot (or $PILOT_HOME/.pilot) is capped. A log elsewhere is capped only when -log-max-size is set explicitly.
• Under systemd it's a no-op, because stderr goes to journald.

2. Abandoned bundle downloads are removed from the temp dir

pilotctl appstore install <catalogue id> and appstore upgrade both do this: the updater runs upgrade --all hourly. They download to $TMPDIR/pilot-bundle-<n>.tar.gz and unpack into $TMPDIR/pilot-bundle-unpack-<n>, and the unpacked copy is never removed after the install. The tarball also survives a pilotctl killed mid-download, and the updater library's pilot-update-<n> survives a kill mid-download. One laptop had 265-272 of these. Most came from cmd/pilotctl test runs, which leak about 9 per run into the real $TMPDIR; one came from a real install on Sep 22.

The updater now sweeps them at start and on every -interval. It removes an entry only when all of these hold:

• it matches one of those three names;
• it is the expected type (a dir or a regular file, never a symlink);
• it is owned by the updater's user;
• it was last modified more than 24 h ago.

The launchd updater shares the user's per-user $TMPDIR (checked on the live process), so it sees interactive leftovers too.

The root cause, the install not removing its unpack dir, lives in cmd/pilotctl/appstore*.go, which this PR stays out of. A tested patch is ready for a follow-up:

• it removes the unpack dir after a catalogue install and on a failed unpack;
• it never removes a sideload's source dir;
• it isolates the one leaking test.

With that patch the appstore pilotctl tests add 0 temp dirs per run, against 9 on main. This sweep is still needed after that fix: fatalHint exits the process, which skips deferred cleanup, and it clears what is already on disk.

3. Goroutine gate for peer churn

TestPeerChurnDoesNotLeakGoroutines keeps one daemon up while 8 short-lived peers each:

• open a stream to its echo port and round-trip a message;
• exchange datagrams both ways;
• shut down.

The goroutine count must stay within rounds/2 of a post-warm-up baseline.

• Today: delta -1 after 8 peers, on macOS and Linux.
• With one goroutine leaked per TunnelManager.AddPeer: delta 15, fails.

It's added to the architecture workflow's "goroutine reaping" step and takes ~40 s.

Verification

• go test ./cmd/updater passes on macOS arm64, and on Linux arm64 as root and as uid 1000. The root-only case checks that another user's leftover is kept.
• Mutation checks: removing the sweep's age, type or symlink check fails TestSweepRemovesOnlyAbandonedPilotDownloads.
• End to end, the built pilot-updater was run in a Linux container with stderr appended to ~/.pilot/updater.log (11 MB):
  • log after start: 236 bytes, plus updater.log.pilot.1.gz;
  • temp sweep: removed stale download leftovers removed=2 bytes=301000;
  • a fresh unpack dir was kept.
• check-layers: OK: layered architecture clean. go vet is clean.

Related, outside this repo / this PR

• fix(supervisor): stopping an app stops the processes it started app-store#39: stopping an app (daemon stop, uninstall, rescan) SIGKILLed only the app's pid, so every process the app had started was orphaned. It now kills the app's process group. Reproduced on main on macOS and Linux.
• fix(server): UDP readers exit when the server is closed beacon#57: after Close, every UDP reader (2 x NumCPU) spun forever on Linux, because the closed-socket check compared error text and the error is wrapped twice there. This is also why TestDaemonShutdownStopsGoroutines fails on runners with 10 or more CPUs (baseline=3, final=24).
• Gaps in files owned by in-flight work, with patches kept for after feat: native HTTPS-proxy support and -transport=auto (Meta Muse / proxy-only sandboxes) #470:
  • install.sh uninstall leaves the injected skills and heartbeat blocks, the PATH lines in shell profiles, app processes orphaned by an earlier hard daemon exit, and bundle temp dirs. A patch was tested in a container: .profile and .bashrc came back byte-identical to /etc/skel, the orphaned app group was killed, and CLAUDE.md/AGENTS.md hold 0 Pilot lines. It applies to both main and feat: native HTTPS-proxy support and -transport=auto (Meta Muse / proxy-only sandboxes) #470's install.sh.
  • pilotctl daemon status says "pid file stale" when there is no pid file at all (any launchd/systemd-managed daemon).
  • pilotctl daemon start never prunes older pilot-<pid>.log files.

🤖 Generated with Claude Code