From 53ad03aeaa2cea7da7e95ea1db1a5253a8995b74 Mon Sep 17 00:00:00 2001
From: codex <codex@bstein.dev>
Date: Sat, 3 Oct 2026 02:48:39 -0500
Subject: [PATCH] update: report failed installs as failures

---
 scripts/ananke-self-update.sh       |  7 ++++
 testing/scripts/self_update_test.sh | 61 +++++++++++++++++++++++++++++
 2 files changed, 68 insertions(+)
 create mode 100755 testing/scripts/self_update_test.sh

diff --git a/scripts/ananke-self-update.sh b/scripts/ananke-self-update.sh
index cc598fc..dee76f7 100644
--- a/scripts/ananke-self-update.sh
+++ b/scripts/ananke-self-update.sh
@@ -103,6 +103,8 @@ if "${REPO_DIR}/scripts/install.sh"; then
   write_state "ok" "install-success" "${CURRENT_FROM_REV}" "${TARGET_TO_REV}"
   echo "[self-update] completed successfully"
   exit 0
+else
+  INSTALL_EXIT_CODE=$?
 fi
 
 if [[ "${ALLOW_QUALITY_FALLBACK}" == "1" || "${ALLOW_QUALITY_FALLBACK}" == "true" ]]; then
@@ -113,3 +115,8 @@ if [[ "${ALLOW_QUALITY_FALLBACK}" == "1" || "${ALLOW_QUALITY_FALLBACK}" == "true
   echo "[self-update] completed via fallback mode"
   exit 0
 fi
+
+# A failed command used as an if condition does not trigger errexit or ERR.
+write_state "failed" "install-failed;rc=${INSTALL_EXIT_CODE}" "${CURRENT_FROM_REV}" "${TARGET_TO_REV}"
+echo "[self-update] installer failed rc=${INSTALL_EXIT_CODE}; fallback disabled"
+exit "${INSTALL_EXIT_CODE}"
diff --git a/testing/scripts/self_update_test.sh b/testing/scripts/self_update_test.sh
new file mode 100755
index 0000000..7b61676
--- /dev/null
+++ b/testing/scripts/self_update_test.sh
@@ -0,0 +1,61 @@
+#!/usr/bin/env bash
+# Exercise updater exit/status behavior with a local repository and fake installer.
+# Run as root; all writes, Git configuration and installer calls stay in a temp dir.
+set -euo pipefail
+
+if [[ "${EUID}" -ne 0 ]]; then
+  echo "Run this isolated updater regression as root" >&2
+  exit 1
+fi
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+FIXTURE="$(mktemp -d /tmp/ananke-update-test.XXXXXX)"
+trap 'rm -rf "${FIXTURE}"' EXIT
+export GIT_CONFIG_GLOBAL="${FIXTURE}/gitconfig"
+export GIT_CONFIG_NOSYSTEM=1
+git config --global user.name 'Updater regression'
+git config --global user.email 'updater-test@example.invalid'
+mkdir -p "${FIXTURE}/origin/scripts"
+git init -q -b main "${FIXTURE}/origin"
+cat > "${FIXTURE}/origin/scripts/install.sh" <<'INSTALLER'
+#!/usr/bin/env bash
+set -euo pipefail
+printf '%s\n' "${ANANKE_ENFORCE_QUALITY_GATE}" >> "${FIXTURE_CALLS}"
+if [[ "${ANANKE_ENFORCE_QUALITY_GATE}" == 1 ]]; then
+  exit "${FIXTURE_INSTALL_RC}"
+fi
+INSTALLER
+chmod 0755 "${FIXTURE}/origin/scripts/install.sh"
+git -C "${FIXTURE}/origin" add scripts/install.sh
+git -C "${FIXTURE}/origin" commit -qm fixture
+
+# Inputs: case name, installer status, fallback policy, expected exit/state/calls.
+# Output: assertion failure or one concise pass line; no host services are invoked.
+check_update() {
+  local name="$1" install_rc="$2" fallback="$3" expected_rc="$4"
+  local expected_status="$5" expected_calls="$6" actual_rc=0
+  local directory="${FIXTURE}/${name}"
+  mkdir -p "${directory}"
+  env ANANKE_REPO_URL="${FIXTURE}/origin" \
+    ANANKE_REPO_DIR="${directory}/repo" \
+    ANANKE_REPO_BRANCH=main \
+    ANANKE_UPDATE_LOG_FILE="${directory}/update.log" \
+    ANANKE_UPDATE_STATE_FILE="${directory}/state" \
+    ANANKE_UPDATE_LOCK_FILE="${directory}/lock" \
+    ANANKE_UPDATE_ALLOW_QUALITY_FALLBACK="${fallback}" \
+    ANANKE_ENFORCE_QUALITY_GATE=1 \
+    FIXTURE_CALLS="${directory}/calls" FIXTURE_INSTALL_RC="${install_rc}" \
+    bash "${REPO_ROOT}/scripts/ananke-self-update.sh" > "${directory}/output" 2>&1 || actual_rc=$?
+  [[ "${actual_rc}" == "${expected_rc}" ]]
+  grep -qx "status=${expected_status}" "${directory}/state"
+  [[ "$(wc -l < "${directory}/calls")" -eq "${expected_calls}" ]]
+  if [[ "${expected_status}" == failed ]]; then
+    grep -qx "detail=install-failed;rc=${install_rc}" "${directory}/state"
+  fi
+  printf 'PASS %s: exit=%s state=%s calls=%s\n' \
+    "${name}" "${actual_rc}" "${expected_status}" "${expected_calls}"
+}
+
+check_update strict_failure 42 0 42 failed 1
+check_update explicit_legacy_fallback 42 1 0 degraded-ok 2
+check_update strict_success 0 0 0 ok 1