v0.2.2 — a suite you can trust under load

This release is about trusting the suite that certifies this app. Nothing here
changes what coffee-bar does for you.

Seven tests could fail on a loaded machine while the code they covered was
correct. A suite that cries wolf is one you stop reading, and that is how a real
defect ships behind nine hundred green checks. Five root causes, each traced to
a specific line and each fix mutation-checked — delete the fix and the guard
must go red.

A test helper published its state non-atomically. It wrote with
fopen(path, "w"), which truncates a file to zero bytes before writing, on a
50 ms cycle — so a reader could catch it empty. Measured at 71 empty reads in
219,902 samples. Worse for the crash test, which reads after a SIGKILL: a kill
landing inside that window left the file empty permanently. The helper now
writes to a sibling path and renames over the target, so a reader sees the old
report or the new one and never neither. (#84)

A file-descriptor bound sat below its own noise floor. The leak guard
allowed a delta of 20 over 40 spawns, but that count is process-global and the
suite's parallel ramp alone measured 16 to 22 — the bound was under the noise
and tripped on innocent runs. Now 200 iterations against a bound of 100: clear
of the worst observed ramp by 4.5x, and still a factor of four under the leak it
exists to catch. (#57)

Two hook-shim tests asserted a guarantee the shim does not make. The shim
gives up after one second and exits silently, by design — a lost confirmation is
not worth a diagnostic on every tool call. Under load that budget expired and
the tests failed on behaviour that had not changed. The budget is now resolvable
and the tests raise it. (#90)

Three tests built disk images at the same time. Their file declares no
suite, so they ran concurrently, and concurrent hdiutil create fails with
Resource busy. All three started within 0.93 s of each other and ran about 45 s
concurrently. That cycle is now serialised: pairwise overlap went from 96 s to
zero. (#94)

A listener test pinned one exit code where two were correct. 52 and 55
both describe a socket accepting a post and then dropping it; which one arrives
depends on where the drop lands relative to the write. It now accepts exactly
those two, and still fails on delivery or refusal. (#94)

The one production change

COFFEE_BAR_SHIM_TIMEOUT_SECONDS sets the hook shim's total run budget, so
tests can raise it above what a loaded machine costs. Absent, unparseable, zero,
negative, non-finite, or above the five-second ceiling all fall back to the
shipped default of one second. Unless you set it deliberately, behaviour is
byte-for-byte what 0.2.1 did.

Install

Download — coffee-bar-0.2.2.dmg below is signed with a Developer ID,
notarised by Apple, and stapled. spctl accepts it with
source=Notarized Developer ID, and stapler validate passes on the disk image
and on the app inside it.

Homebrew — brew install coffee-bar builds from source, which is a
different artifact: ad-hoc signed, carrying no Developer ID, and Gatekeeper
does not accept it the way it accepts the download. The tap formula is bumped
separately from this release; until that lands, brew installs 0.2.1. Use the
disk image above if you want the signed, notarised build.

Fact	Value
File	coffee-bar-0.2.2.dmg
Size	860341 bytes
SHA-256	21839e1612b67a845943102b4737d4cd2f3984d5facee4e428a992774e08331b
Architecture	Apple silicon (arm64) only
Minimum macOS	14.0
Signature	Developer ID Application, team 85FN4Z37V8

This is not a universal binary. lipo -archs on the shipped binary reports
arm64 alone, so an Intel Mac cannot run it.

Verify the download before you open it:

shasum -a 256 coffee-bar-0.2.2.dmg
spctl -a -t open --context context:primary-signature -vv coffee-bar-0.2.2.dmg

What is not claimed: that a first launch with no network succeeds. The
ticket is embedded and stapler validate confirms it locally, which is strong
evidence, but the offline launch itself has never been executed. It is tracked
in #91 rather than asserted here.