0.1.3

Eggup 0.1.3

Correctness and compatibility publication for the acquisition, archive, and core
subsystems. Integrity evidence remains SHA-256 checksum only — no crate in this
release makes an authenticity or signature claim.

Per-package publication source commits

These are not all the tag commit. eggup-acquisition 0.1.3 had to publish
first, because the other publications in this train resolve or exact-pin it, so
it was released from an earlier commit than the tag:

Package	Published from	Registry checksum
eggup-acquisition 0.1.3	bb8fe41	71ce1a0d…a285a7
eggup-eggfetch 0.1.3	bd43683 (this tag)	e2bdffe9…56ada
eggup-archive 0.1.3	bd43683 (this tag)	a28af652…9824c
eggup-core 0.1.3	bd43683 (this tag)	161b244b…789ad

bb8fe41 is an ancestor of this tag. No existing tag was moved.

eggup-acquisition 0.1.3 — the composed-transport deadline defect is closed

Published 0.1.2 was built from a commit that predated two workspace bug-audit
fixes. The reachable one: ComposedTransport handed the fallback adapter the
caller's full FetchLimits instead of the remaining budget, so a single
composed fetch could run for roughly twice the documented total_timeout — the
connect phase is part of that wall-clock budget. The fallback now receives only
what is left, with connect_timeout clamped alongside it so
connect_timeout <= total_timeout still holds, and an already-exhausted budget
reports Timeout without starting a doomed attempt. The second fix removes a
staged part file that could be left behind when its 0600 hardening failed.

eggup-curl 0.1.2 and eggup-eggfetch 0.1.2 keep caret requirements and now
receive the fix automatically on their next resolve.

Still open for eggup-eggpack 0.1.2: it exact-pins eggup-acquisition =0.1.2 and therefore still composes against the defective seam. Consumers of
that adapter must pin eggup-acquisition 0.1.3 themselves until
eggup-eggpack 0.1.3 publishes. This caveat is unchanged from the 0.1.2 notes.

eggup-eggfetch 0.1.3 — a fallible API no longer aborts the process

Runtime construction used .expect(), so a runtime-build failure (fd exhaustion,
driver creation failure) aborted the process from inside a fallible fetch; it now
returns AcquisitionError::Unavailable, which composition already knows how to
handle. The runtime is built once per calling thread rather than once per fetch,
which keeps EggfetchTransport Send + Sync — a stored runtime would make it
!Sync and break callers sharing one transport across threads. TooLarge now
reports the bound it actually enforces instead of 0.

eggup-archive 0.1.3 — Windows device aliases and truthful cleanup

validate_output_name rejected COM1..COM9 but accepted COM0/LPT0 and the
reserved console names CONIN$, CONOUT$, CLOCK$. All are now rejected.
Near misses such as com10 and console remain valid. residue_path() is now
truthful: a private root that still holds evidence is promoted to
CleanupFailed instead of being described as cleaned.

eggup-core 0.1.3 — self-update, stale-lock recovery, and a compatible error surface

First registry appearance of current-executable transaction parity (M010,
staging inside the installation root so a self-update never needs write authority
above the executable's own directory) and proof-authorized stale-lock recovery
(M011, opt-in; the default acquire still never recovers).

Compatibility. Error keeps exactly the seven variants 0.1.2
published, so an exhaustive match on it compiles unchanged across the upgrade.
This was verified by an external fixture that is byte-identical between the two
versions and that fails against the pre-correction tree. Retained evidence
moved to a new #[non_exhaustive] RecoveryError, used only by the new
opt-in recovery entry points; every previously published signature keeps
Result<T, Error>.

self-replace remains Windows-only, so the Unix/macOS dependency surface is
still sha2 only.

eggup-service 0.1.2 resolves and runs against this Core through its caret
requirement; that graph was proven from the registry with no path or Git
override.

Verification

Hosted Stable, MSRV (1.89), macOS, and Windows lanes green on the
publication commit. Every crate was additionally proven by registry-only
external fixtures that resolve from crates.io with no [patch], path, or Git
override — including control runs against the defective 0.1.2 packages to show
the fixtures actually detect the defects they claim to.

Publication is manual and is never performed by CI.

eggup-eggpack 0.1.3 — archive-member identity is now cross-checked

Added after the rest of the train; published from bd43683 (this tag), checksum
952e88b8…19c5.

Published 0.1.2 bound archive members to declared members positionally,
without cross-checking a bound member's recorded source_path/output_name
against the declaration it was about to represent. A mismatched or reordered
BoundExtraction could therefore bind bytes under a different member identity
whenever the content digests happened to match. Each bound member is now checked
against its declared counterpart and fails closed with
AdapterError::MapMismatch; identical-content members still cannot substitute for
one another.

This version also moves the adapter's exact Eggup dependency set to =0.1.3, which
closes the eggup-eggpack 0.1.2 caveat above: adapter consumers now receive
the acquisition composed-budget fix automatically, with no action required.

The adapter still selects no release, verifies no authenticity, and authorizes no
filesystem destination. Caller-bound destination APIs are unchanged.

---

Additional package publication — eggup-service 0.1.3 (2026-10-09)

Service M011 publishes the source-compatible M010 correction for stopping an
exact-owned failed systemd unit only after ownership, manager state, process IDs,
job state, and cgroup evidence prove quiescence. Foreign, malformed, restarting,
or still-populated units remain incomplete or denied. No public API migration is
required.

Package	Source revision	crates.io checksum	Package size
eggup-service 0.1.3	feb6ae5aea4c9b61c4051957f3662ca49d845f9e	9f7f7ea854577158e66aa202709ab1c97a3aedcf00b06c1ab914d25b132124dc	72.7 KiB compressed; 396.0 KiB unpacked

The package-specific source is later than the shared v0.1.3 tag; that existing
tag remains unchanged. The exact-version registry-only fixture resolves
eggup-service = "=0.1.3" and eggup-core 0.1.3 from crates.io. Hosted run
37883703334 passed
Stable, Rust 1.89 MSRV, macOS, Windows, and the privileged Linux systemd lane,
including positive failed-unit quiescence and Foreign/malformed controls.

wg-basic Distribution M004 C001a adoption: change its service dependency to
eggup-service = "=0.1.3" and refresh the lockfile. The public API is unchanged;
the new runtime behavior lets its failed-candidate recovery path confirm an
owned failed unit is quiescent. M004 retains its independent rootful
qualification and production trust-root requirements.

Packaged changelog note: the immutable .crate includes the pre-upload
changelog snapshot from its recorded source revision, where 0.1.3 is labelled a
release candidate. The checked-in crate changelog and this release record now
reflect publication; the package bytes and checksum above are unchanged.