v0.1.6: robust .old/ + staging cleanup under OneDrive / AV / Search

[StuartMeeks]

Summary

• On Windows with OneDrive syncing the install dir, .old/ cleanup leaves a few stragglers because OneDrive holds short-lived sync handles on files the swap just moved in. The current recursive Directory.Delete(... recursive: true) walks happily through most files, races a handle on the last few, throws IOException("being used by another process"), and the catch-all swallows it. Antivirus, Windows Search, indexers, and backup agents cause the same race. Read-only files extracted from archives cause a parallel UnauthorizedAccessException.
• Fix: new internal UpdateInstaller.DeleteDirectoryRobustly(path) helper that clears ReadOnly attributes on every descendant file and retries the recursive delete at 200/400/800 ms on IOException / UnauthorizedAccessException — ~1.4 s budget tuned for OneDrive's typical handle-release latency. Applied to all four recursive-delete sites (CleanupOldInstall, SwapAsync's .old/ reset, ResetStaging, TryDeleteDirectory).
• Exception-propagation contracts unchanged. CleanupOldInstall still swallows on final failure (non-fatal — next startup retries). The other three still throw via UpdateException so the install fails loudly when staging can't be reset.

Why retry instead of OneDrive detection

OneDrive detection is fragile (registry queries, reparse-point sniffing) and the retry strategy generalises to every other class of transient handle holder. Cost when no contention exists: one no-op attribute walk over a tree we're about to delete.

Tests

5 new (172 → 177). Inject deleter and sleeper seams so the retry-with-backoff logic can be exercised deterministically:

• DeleteDirectoryRobustly_when_path_missing_is_noop
• DeleteDirectoryRobustly_succeeds_first_try_calls_deleter_once_no_sleeps
• DeleteDirectoryRobustly_retries_with_backoff_on_transient_io_failure — fails twice with IOException, succeeds on third call; asserts exactly 200ms and 400ms sleeps between.
• DeleteDirectoryRobustly_throws_after_exhausting_retries — asserts 4 deleter calls + 3 sleeps at 200/400/800, then the original exception propagates.
• DeleteDirectoryRobustly_clears_readonly_attribute_on_descendant_files — real Directory.Delete against a tree containing a ReadOnly-marked file; verifies the helper clears the attribute so the underlying delete succeeds.

Test plan

• dotnet build — clean.
• dotnet test — 177 passing.
• dotnet build -c Release — produces NextIteration.SpectreConsole.SelfUpdate.0.1.6.nupkg.
• Maintainer to verify against the pl-app scenario (OneDrive-synced install dir, post-update .old/ should clean up on next startup with the new helper's retry budget).

🤖 Generated with Claude Code