update-all

Read first, do not rediscover

Canonical files live in ~/dotfiles/jcode/:

• update-all.sh is the only updater. Never copy it into the skill folder.
• skills/update-all/CONTEXT.md records the last audit, remaining risks and preservation decisions.
• skills/update-all/SKILL.md is this procedure.

Run bash ~/dotfiles/jcode/update-all.sh --context for paths without doing an update. Read the context and ~/.agents/skills/update-all/CHECKLIST.md, then inspect the current branch/dirty state. Last observed dotfiles branch was DATA, not a contract.

Execute

cd ~/dotfiles
bash ./jcode/update-all.sh --parallel --dry-run
bash -x ./jcode/update-all.sh --parallel

Only run the second command when an actual update is requested. It can rebase, build and publish the fork, install tools and update live skills/configs. --jcode-only, --skills-only, --tools-only, --config-only restrict scope. Without --parallel, jobs run serially. flock prevents overlapping updater runs.

With --parallel, core, skills and tools run independently with private logs and ledgers. Skill source pulls run concurrently, then sync and babysit regeneration. Tool jobs are independent except the ordered mise install -> mise use -> herdr pickr chain. The updater waits for every child. Configs and manifest run after the barrier only if independent phases succeeded. Failures produce a nonzero exit and failed ledger entries. Review skipped items too, they may need manual action.

Safety contracts:

• Dirty core or unfinished merge/rebase fails. No automatic stash or reset.
• Rebase the gate branch, build that branch, only then push using an explicit --force-with-lease. A failed build never publishes the branch.
• Fast-forward pulls override global pull.rebase=true and disable autostash.
• Divergent live jcode config is preserved and reported for manual merge, not overwritten. This protects live-only runtime keys without adding a TOML parser.
• Dirty dotfiles skips pull/stage/commit/push but can install current configs. Branch is detected at runtime. No broad staging or automatic empty commits.
• Dry-run writes only reporting/lock directories, never rebases, stashes, pushes, installs tools/configs, copies skills or rewrites the manifest.

Source-only workers

Sourcing does not run main, parse arguments, set shell options or create files:

source ~/dotfiles/jcode/update-all.sh
RUN_DIR=$(mktemp -d "$JCODE_SCRATCH_DIR/update-all-worker.XXXXXX")
LOG="$RUN_DIR/update-all.log"
CHECKLIST_TMP="$RUN_DIR/checklist.tsv"
CHECKLIST="$RUN_DIR/CHECKLIST.md"
checklist_init
PARALLEL=1
# Example worker scope. Coordinator must own locking and disjoint phase scopes.
run_jobs update_skills
rc=$?
checklist_write "$rc"

run_jobs isolates phase failure with errexit in a child. Do not invoke mutating functions inside if/|| wrappers that disable Bash errexit. Workers do not touch the shared ledger/log or call main. Coordinator merges their private reports.

Verify, reload and report

• Read the run log and ledger. Latest aggregate log: ~/.jcode/logs/update-all.log. Per-run logs and per-phase job directories remain in ~/.jcode/logs/update-all-*.
• Count installed */SKILL.md and manifest data rows, ignoring the table header.
• Check babysit has SDK_VERSION=latest, --harness jcode, exactly one jcode harness note and no unresolved {{harness}} placeholder.
• Check local/turn-end-gate still carries the required gate functionality and babysitter-gate.sh / herdr-agent-state.sh remain installed.
• Confirm live-only config keys survive. Skipped config divergence is not a merge.
• Reload skills through skill_manage reload_all. If core rebuilt successfully, run /rebuild in a jcode session (needs ~/.jcode/debug_control), or restart jcode. A build is not proof that the running server is on the new binary: verify with grep -o '/home/prm/[^ ]*jcode' /proc/$(pgrep -f 'jcode serve' | head -1)/maps. The daemon hot-reloads via exec, so its PID and start time are preserved and useless as a staleness signal. See SELFDEV-NOTES.md.

Report source commits, failures/skips, exact ledger/log paths and remaining restart/migration work. Do not claim a dry-run or stub test was a real update.