The installer swaps the app with two renames, so an interruption can leave no app at all

[ParallelEntrepreneur]

What is wrong

scripts/install-release.sh:89-93 replaces the app like this:

mv "$tmp/unpack/colonizer" "$app.new"
[ ! -e "$app" ] || mv "$app" "$app.old"
mv "$app.new" "$app"
rm -rf "$app.old"

These are two separate renames, and between them ~/.local/share/colonizer/app doesn't exist.

• If the script is interrupted after the first rename (Ctrl-C, a closed terminal, a full disk), the install is left with no app at all. ~/.local/bin/colonizer then points at nothing.
• Nothing puts app.old back.
• The next run deletes app.old before doing anything else (rm -rf "$app.new" "$app.old", line 89). That destroys the last working copy.

What done looks like

• The swap is atomic, or recoverable:
  • a symlink app -> app-<version>, swapped with ln -sfn and a rename, or
  • a trap that restores app.old when interrupted.
• A run that finds app.old but no app restores it instead of deleting it.
• A test interrupts the installer between the two renames and checks that colonizer still runs.

Source: external audit of v0.1.3 (d89ce76), observation under F10. Confirmed against the script.