Adom Hydrogen

@@ -195,6 +195,32 @@ text that fights the card's caption, or when the dock deserves a tighter crop. T cache-busts the image on every manifest re-resolve and on the right-click refresh actions, so a pushed replacement shows up without the user clearing anything. +### Retiring your own older instance: the "(deleted)" trap++Version-aware serve is what makes an update actually reach the user: a fresh build must find+the older instance on its port and stand it down. The fragile part is HOW you identify the+victim.++A package update **unlinks the old binary and writes a new file at the same path**. From+that moment the still-running old process resolves `/proc/self/exe` (and anything derived+from its own path) to `"<path> (deleted)"`, and `stat` or `exec` of that string fails. So+victim-matching that compares executable paths or exact argv silently stops matching exactly+when it matters: right after an update, which is the only time you need it. The old build+keeps the port, the dock's Hard Refresh Open re-runs your steps, your serve decides there is+nothing to retire, and the user's tab renders yesterday's code while `pkg update` reports+success. (Diagnosed on chip-fetcher, 2026-08-24.)++Do this instead:++- Identify the victim by **who owns the port**, not by argv equality.+- Confirm identity by asking the candidate what it is (`--version`, or a `/health` that+  reports `installed_version`), rather than by string-matching its command line.+- If you must compare paths, **strip a trailing `" (deleted)"`** before comparing.+- Never retire a process you cannot positively identify as your own older build, and never+  retire yourself or your parent.+- Belt and braces: have the running server watch its own executable and hand the port over+  once a replacement verifies, so a user who never re-clicks still converges.+ ### The three rules that break every first attempt  Each of these was learned from a bundled bridge shipping it wrong: