fix: smooth remote server updates

[t3dotgg]

A remote server update restarts the server in ~9 seconds, but the client stayed disconnected for 90+ seconds, and the progress UI was a three-step rail (Download / Install / Resume) where "Install" is a sub-second launcher handoff and "Resuming" meant nothing to most people.

Two changes:

Keep the managed tunnel across update restarts. Shutdown released the Cloudflare tunnel, so every update forced the replacement tunnel's hostname route through 1-2 minutes of edge propagation — measured on a live update: server listening at T+9s, first inbound request at T+96s. An update handoff always brings a server right back (new version, or the old one after rollback), so the tunnel is never orphaned. The release now checks the launcher's durable state file and skips deletion when an update is pending; the next boot respawns the connector from the stored config against the same tunnel and is reachable as soon as it connects (~T+12s). Explicit unlink and non-update shutdowns still release, so the per-tunnel billing hygiene is unchanged.

Calmer, honest update UI. The version-skew banner is no longer an amber warning: it reads "Server update available" with the raw versions (unreadable for nightlies) in a tooltip. The in-flight rail becomes a single status row, "Downloading…" then "Restarting…", matching what actually happens; failures keep the row with the rollback reason and a Retry action.

Together with #5404 (merged), an update should now be: ~6s "Downloading…", ~10s "Restarting…", reconnected.

---

Written by Claude Fable 5 running in Claude Code.

---

Note

Medium Risk
Changes managed-tunnel lifecycle on shutdown and systemd kill behavior during updates; mistakes could leak tunnels or drop connectivity on uninstall, though new tests cover handoff vs explicit stop.

Overview
Remote server updates were slow to reconnect because shutdown released the managed Cloudflare tunnel, forcing a new tunnel and long hostname route propagation. Shutdown now reads the launcher’s service-state.json and skips tunnel release when a pending update is a handoff (pending update without .service-stopping). Explicit stops (systemctl stop, uninstall) still release the tunnel.

The service launcher writes .service-stopping synchronously on stop() so the child can tell “service going away” from “replacement starting”; recovery clears stale markers. The systemd unit uses KillMode=mixed so the launcher gets signals before the cgroup is torn down. Trial servers register tunnel cleanup before activation when a pending update exists; normal runtimes still wait until after activation.

UI/docs: version skew is no longer an amber warning—“Server update available” with versions in a tooltip. In-flight progress is a single row (Downloading… / Restarting…), folding the sub-second install handoff into download; docs match.

^{Reviewed by Cursor Bugbot for commit 063ddb7. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Preserve managed tunnel during server update handoff on shutdown

• During shutdown, releaseManagedTunnelOnShutdown now checks for a pending update handoff (pending update recorded + no explicit stop marker). If detected, the managed tunnel is kept alive so the replacement server can inherit it.
• The launcher writes a SERVICE_STOP_MARKER_FILE synchronously at the start of stop() so the child can distinguish an explicit stop from an update handoff. The marker is cleared on recovery to avoid stale state.
• The systemd unit's KillMode changes from control-group to mixed in renderBootServiceUnit to support smoother process handoff.
• The server update progress UI is simplified to a single status row (pulsing dot + stage label) replacing the multi-step rail, with action labels shortened to 'Update'/'Retry'.
• Behavioral Change: tunnels are no longer released on shutdown when an update handoff is in progress; they continue to release on explicit stops and other shutdown paths.

^{Macroscope summarized 063ddb7.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 0ec16d2f-1665-432c-be66-c7a817040b4a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Needs human review

This PR changes runtime behavior around server updates: new stop marker protocol, modified tunnel release logic, and systemd KillMode configuration change. While well-tested and from a trusted contributor, the changes to tunnel lifecycle management during updates warrant human review.

^{You can customize Macroscope's approvability policy. Learn more.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 63c155f. Configure here.}