MetaList 0.6.1__tar.gz → 0.6.2__tar.gz

{metalist-0.6.1/metalist.egg-info → metalist-0.6.2}/PKG-INFO

@@ -1,11 +1,11 @@
 Metadata-Version: 2.4
 Name: metalist
-Version: 0.6.1
+Version: 0.6.2
 Summary: A minimalist single-user note-taking app with SSR, fast in-memory tree operations, and efficient sync.
 Project-URL: Homepage, https://github.com/evolvingstuff/metalist
 Project-URL: Repository, https://github.com/evolvingstuff/metalist
 Project-URL: Issues, https://github.com/evolvingstuff/metalist/issues
-Requires-Python: <3.14,>=3.10
+Requires-Python: <3.15,>=3.10
 Description-Content-Type: text/markdown
 Requires-Dist: argon2-cffi==25.1.0
 Requires-Dist: cryptography==50.0.0
@@ -48,6 +48,13 @@ A minimalist single-user note-taking app focused on server-side rendering (SSR),
 - Multi-tab search contexts with server-persisted scroll/search state (survives browser restarts)
 - Manual namespace backups/restores to a user-selected backup folder with retention controls
 
+## Changes in 0.6.2
+
+- Namespace startup allows two minutes, with progress every five seconds, instead of failing after 12 seconds on a busy machine. `METALIST_STARTUP_TIMEOUT_SECONDS` can increase the allowance. Failed children are stopped and reaped.
+- Updates preserve the running Python interpreter and validate a disposable installation and namespace startup before stopping live servers. uv then installs the tested package/dependency versions from its cache without network access.
+- Python 3.14 is supported. Command-line legacy imports also work when Python lacks Tk's native GUI component.
+- Release validation now includes the real uv update, backups, and multi-namespace restart on Windows, macOS, and Linux across Python 3.10–3.14.
+
 ## Changes in 0.6.1
 
 - Removed the unused performance overlay, including its menu option and background state updates, fixing a fatal redundant-state error during note rearranging. Obsolete overlay preferences and command usage are discarded automatically.
@@ -119,11 +126,11 @@ After the first installation, update and restart MetaList with one cross-platfor
 ```bash
 metalist update
 ```
-The updater checks the installed version against the latest PyPI release first. If MetaList is already current, it reports the installed version and leaves all running namespaces untouched. When an update is available, it checks the installer prerequisites, stops running namespaces, and creates and verifies a new backup of every namespace before installation can begin. Each archive includes the complete notes/settings database, the attachments database when present, and any legacy search-history database. Locked namespaces are backed up with their encrypted data and key metadata intact, without requiring a password.
+The updater checks the installed version against the latest PyPI release first. If MetaList is already current, it reports the installed version and leaves all running namespaces untouched. When an update is available, it checks installer prerequisites and uses uv to install the candidate into a disposable tool environment with the current base Python interpreter. It checks dependencies and starts a temporary namespace to verify HTTP readiness, version, and runtime assets. A failed preflight leaves the current installation and running namespaces unchanged. After preflight succeeds, it stops running namespaces, and creates and verifies a new backup of every namespace before installation can begin. Each archive includes the complete notes/settings database, the attachments database when present, and any legacy search-history database. Locked namespaces are backed up with their encrypted data and key metadata intact, without requiring a password.
 
 Backups are saved to `~/MetaList/namespaces/<namespace>/backups/<namespace>-<timestamp>.metalist-backup.tar.gz`; the updater prints each verified path. Existing backups remain unchanged and are not pruned. If any backup fails, the update aborts with the current installation intact; run `metalist` to restart the stopped servers after resolving the failure.
 
-Only after all backups pass does the updater hand off to an external PowerShell process on Windows or `/bin/sh` on macOS/Linux so the installed environment can unlock. It installs the exact version reported by PyPI with a forced cache refresh, launches MetaList again, and reports the installed version (for example, `MetaList updated to v0.5.0.`). This protection requires an installed version containing the backup safeguard and applies to `metalist update`; direct pip/uv install commands do not run it.
+Only after all backups pass does the updater hand off to an external PowerShell process on Windows or `/bin/sh` on macOS/Linux so the installed environment can unlock. It delegates installation to uv, pinning the current base interpreter and the exact tested package/dependency versions, using the cache populated during preflight with network access disabled. It then launches MetaList again, and reports the installed version (for example, `MetaList updated to v0.5.0.`). This protection requires an installed version containing the backup safeguard and applies to `metalist update`; direct pip/uv install commands do not run it.
 
 For pip, users can run `pip install metalist`. For a non-editable local install from this checkout, use `uv pip install .` or `pip install .` instead of the editable command below.
 
@@ -283,6 +290,10 @@ convert-from-legacy.py --namespace work --input /path/to/legacy-export.json
 
 If `--namespace`, `--port`, or `--https-port` are omitted, the import script prompts for them and saves the resulting launch profile inside the target namespace DB. That means a one-time import into `work` can immediately seed later shorthand launches like `metalist work`.
 
+Namespace startup allows 120 seconds per child, reports progress every five seconds, and stops/reaps a failed child instead of leaving it running after reporting failure. Set `METALIST_STARTUP_TIMEOUT_SECONDS` to a positive number of seconds to allow more time on a heavily loaded machine. A crashed child still fails immediately. This is a startup allowance, not a guarantee that any machine will finish within two minutes.
+
+The preflight is a disposable empty namespace; it cannot guarantee startup against every real database or prevent a later disk/process failure. If installation succeeds but real namespace startup fails, the new package remains installed: resolve the reported startup issue and run `metalist` again. No automatic code/database rollback is attempted, and backups remain unchanged.
+
 ### Publishing
 For the real user-facing install flow:
 ```bash
@@ -292,15 +303,15 @@ uv tool install metalist
 metalist
 ```
 
-This repo now packages itself under the PyPI distribution name `metalist`. Current releases support Python 3.10 through 3.13.
+This repo now packages itself under the PyPI distribution name `metalist`. Current releases support Python 3.10 through 3.14.
 
 Recommended release path:
 1. In the existing PyPI project `metalist`, configure GitHub Trusted Publishing for `evolvingstuff/metalist` and the workflow file `.github/workflows/publish-pypi.yml`.
-2. Push the candidate commit to a branch and wait for the `Publish to PyPI` validation workflow to pass for that exact commit. GitHub-hosted Windows, macOS, and Linux runners install the built wheel and test application startup outside the source checkout on Python 3.10 through 3.13. You do not need those operating systems locally. Archive verification also checks runtime files, including agent Markdown resources, against both the wheel and source distribution.
+2. Push the candidate commit to a branch and wait for the `Publish to PyPI` validation workflow to pass for that exact commit. GitHub-hosted Windows, macOS, and Linux runners install the built wheel and test application startup outside the source checkout on Python 3.10 through 3.14. Every matrix job also exercises the real `metalist update` path with uv, backups, interpreter preservation, and two-namespace restart against a local release index. The old-version fixture carries the candidate updater so this validates the mechanism being shipped; it does not retroactively fix older installed updaters. You do not need those operating systems locally. Archive verification also checks runtime files, including agent Markdown resources, against both the wheel and source distribution.
 3. Only after every required check passes, create and push the release tag for that same commit. Any intervening change requires a new validation run before tagging. Branch and pull-request runs validate without publishing.
 4. The tag workflow repeats validation and publishes the same artifacts tested by its full matrix. Manual publication also requires all checks to pass. Users can then run it with `uvx metalist`, install it persistently with `uv tool install metalist`, or install it with `pip install metalist`.
 
-If `--input` is omitted, a file picker opens (when `tkinter` is available).
+If `--input` is omitted, a file picker opens (when `tkinter` and its native `_tkinter` component are available).
 Notes tagged with `@implies` are converted into ontology rules and are not imported as notes. Legacy rules that are invalid under the current ontology grammar are reported and skipped while valid rules continue importing.
 
 ### Run Tests

{metalist-0.6.1 → metalist-0.6.2}/README.md

@@ -12,6 +12,13 @@ A minimalist single-user note-taking app focused on server-side rendering (SSR),
 - Multi-tab search contexts with server-persisted scroll/search state (survives browser restarts)
 - Manual namespace backups/restores to a user-selected backup folder with retention controls
 
+## Changes in 0.6.2
+
+- Namespace startup allows two minutes, with progress every five seconds, instead of failing after 12 seconds on a busy machine. `METALIST_STARTUP_TIMEOUT_SECONDS` can increase the allowance. Failed children are stopped and reaped.
+- Updates preserve the running Python interpreter and validate a disposable installation and namespace startup before stopping live servers. uv then installs the tested package/dependency versions from its cache without network access.
+- Python 3.14 is supported. Command-line legacy imports also work when Python lacks Tk's native GUI component.
+- Release validation now includes the real uv update, backups, and multi-namespace restart on Windows, macOS, and Linux across Python 3.10–3.14.
+
 ## Changes in 0.6.1
 
 - Removed the unused performance overlay, including its menu option and background state updates, fixing a fatal redundant-state error during note rearranging. Obsolete overlay preferences and command usage are discarded automatically.
@@ -83,11 +90,11 @@ After the first installation, update and restart MetaList with one cross-platfor
 ```bash
 metalist update
 ```
-The updater checks the installed version against the latest PyPI release first. If MetaList is already current, it reports the installed version and leaves all running namespaces untouched. When an update is available, it checks the installer prerequisites, stops running namespaces, and creates and verifies a new backup of every namespace before installation can begin. Each archive includes the complete notes/settings database, the attachments database when present, and any legacy search-history database. Locked namespaces are backed up with their encrypted data and key metadata intact, without requiring a password.
+The updater checks the installed version against the latest PyPI release first. If MetaList is already current, it reports the installed version and leaves all running namespaces untouched. When an update is available, it checks installer prerequisites and uses uv to install the candidate into a disposable tool environment with the current base Python interpreter. It checks dependencies and starts a temporary namespace to verify HTTP readiness, version, and runtime assets. A failed preflight leaves the current installation and running namespaces unchanged. After preflight succeeds, it stops running namespaces, and creates and verifies a new backup of every namespace before installation can begin. Each archive includes the complete notes/settings database, the attachments database when present, and any legacy search-history database. Locked namespaces are backed up with their encrypted data and key metadata intact, without requiring a password.
 
 Backups are saved to `~/MetaList/namespaces/<namespace>/backups/<namespace>-<timestamp>.metalist-backup.tar.gz`; the updater prints each verified path. Existing backups remain unchanged and are not pruned. If any backup fails, the update aborts with the current installation intact; run `metalist` to restart the stopped servers after resolving the failure.
 
-Only after all backups pass does the updater hand off to an external PowerShell process on Windows or `/bin/sh` on macOS/Linux so the installed environment can unlock. It installs the exact version reported by PyPI with a forced cache refresh, launches MetaList again, and reports the installed version (for example, `MetaList updated to v0.5.0.`). This protection requires an installed version containing the backup safeguard and applies to `metalist update`; direct pip/uv install commands do not run it.
+Only after all backups pass does the updater hand off to an external PowerShell process on Windows or `/bin/sh` on macOS/Linux so the installed environment can unlock. It delegates installation to uv, pinning the current base interpreter and the exact tested package/dependency versions, using the cache populated during preflight with network access disabled. It then launches MetaList again, and reports the installed version (for example, `MetaList updated to v0.5.0.`). This protection requires an installed version containing the backup safeguard and applies to `metalist update`; direct pip/uv install commands do not run it.
 
 For pip, users can run `pip install metalist`. For a non-editable local install from this checkout, use `uv pip install .` or `pip install .` instead of the editable command below.
 
@@ -247,6 +254,10 @@ convert-from-legacy.py --namespace work --input /path/to/legacy-export.json
 
 If `--namespace`, `--port`, or `--https-port` are omitted, the import script prompts for them and saves the resulting launch profile inside the target namespace DB. That means a one-time import into `work` can immediately seed later shorthand launches like `metalist work`.
 
+Namespace startup allows 120 seconds per child, reports progress every five seconds, and stops/reaps a failed child instead of leaving it running after reporting failure. Set `METALIST_STARTUP_TIMEOUT_SECONDS` to a positive number of seconds to allow more time on a heavily loaded machine. A crashed child still fails immediately. This is a startup allowance, not a guarantee that any machine will finish within two minutes.
+
+The preflight is a disposable empty namespace; it cannot guarantee startup against every real database or prevent a later disk/process failure. If installation succeeds but real namespace startup fails, the new package remains installed: resolve the reported startup issue and run `metalist` again. No automatic code/database rollback is attempted, and backups remain unchanged.
+
 ### Publishing
 For the real user-facing install flow:
 ```bash
@@ -256,15 +267,15 @@ uv tool install metalist
 metalist
 ```
 
-This repo now packages itself under the PyPI distribution name `metalist`. Current releases support Python 3.10 through 3.13.
+This repo now packages itself under the PyPI distribution name `metalist`. Current releases support Python 3.10 through 3.14.
 
 Recommended release path:
 1. In the existing PyPI project `metalist`, configure GitHub Trusted Publishing for `evolvingstuff/metalist` and the workflow file `.github/workflows/publish-pypi.yml`.
-2. Push the candidate commit to a branch and wait for the `Publish to PyPI` validation workflow to pass for that exact commit. GitHub-hosted Windows, macOS, and Linux runners install the built wheel and test application startup outside the source checkout on Python 3.10 through 3.13. You do not need those operating systems locally. Archive verification also checks runtime files, including agent Markdown resources, against both the wheel and source distribution.
+2. Push the candidate commit to a branch and wait for the `Publish to PyPI` validation workflow to pass for that exact commit. GitHub-hosted Windows, macOS, and Linux runners install the built wheel and test application startup outside the source checkout on Python 3.10 through 3.14. Every matrix job also exercises the real `metalist update` path with uv, backups, interpreter preservation, and two-namespace restart against a local release index. The old-version fixture carries the candidate updater so this validates the mechanism being shipped; it does not retroactively fix older installed updaters. You do not need those operating systems locally. Archive verification also checks runtime files, including agent Markdown resources, against both the wheel and source distribution.
 3. Only after every required check passes, create and push the release tag for that same commit. Any intervening change requires a new validation run before tagging. Branch and pull-request runs validate without publishing.
 4. The tag workflow repeats validation and publishes the same artifacts tested by its full matrix. Manual publication also requires all checks to pass. Users can then run it with `uvx metalist`, install it persistently with `uv tool install metalist`, or install it with `pip install metalist`.
 
-If `--input` is omitted, a file picker opens (when `tkinter` is available).
+If `--input` is omitted, a file picker opens (when `tkinter` and its native `_tkinter` component are available).
 Notes tagged with `@implies` are converted into ontology rules and are not imported as notes. Legacy rules that are invalid under the current ontology grammar are reported and skipped while valid rules continue importing.
 
 ### Run Tests

{metalist-0.6.1 → metalist-0.6.2}/app/exception_boundaries.py

@@ -5,6 +5,11 @@ syntax suppressions and is consumed by runtime capture and the startup gate.
 """
 
 CAPTURE_BOUNDARIES = {
+    # Release smoke polls only its own disposable HTTP listeners during an actual update.
+    'scripts/smoke_self_update.py:_has_updated_namespace:probe_capture': ('HTTPError',),
+    # A child can exit between poll and terminate; hung children must be killed and reaped.
+    'app/services/namespace_switcher.py:_stop_failed_namespace_launch:terminate_capture': ('ProcessLookupError',),
+    'app/services/namespace_switcher.py:_stop_failed_namespace_launch:wait_capture': ('TimeoutExpired',),
     # Translate explicitly validated domain input/resource rejection.
     'app/api/routes/auth.py:_delete_namespace_from_body:delete_capture': ('NamespaceInputRejected', 'FileNotFoundError'),
     # Translate explicitly validated domain input/resource rejection.

{metalist-0.6.1 → metalist-0.6.2}/app/services/namespace_switcher.py

@@ -41,7 +41,8 @@ from app.services.input_errors import NamespaceInputRejected
 
 _PROJECT_ROOT = Path(__file__).resolve().parents[2]
 _PLACEHOLDER_NEW_NAMESPACE = "new-namespace"
-_LAUNCH_READY_TIMEOUT_SECONDS = 12.0
+_LAUNCH_READY_TIMEOUT_SECONDS = 120.0
+_LAUNCH_PROGRESS_INTERVAL_SECONDS = 5.0
 _PORT_PROBE_TIMEOUT_SECONDS = 0.75
 _READY_POLL_INTERVAL_SECONDS = 0.25
 _PROCESS_WAIT_POLL_INTERVAL_SECONDS = 0.25
@@ -1568,6 +1569,7 @@ def _launch_namespace_process(
         if name in child_environ:
             del child_environ[name]
     child_environ[ORCHESTRATED_CHILD_ENV_NAME] = "1"
+    child_environ["PYTHONUNBUFFERED"] = "1"
     command = _resolve_main_launch_command(environ=child_environ)
     command.extend(
         [
@@ -1664,18 +1666,69 @@ def _read_namespace_launch_log_tail(*, log_path: Path, log_start_offset: int) ->
     return tail
 
 
+def _stop_failed_namespace_launch(*, process: subprocess.Popen[bytes]) -> None:
+    if process.poll() is not None:
+        return
+    terminate_capture = CapturedExceptionContext(
+        ProcessLookupError,
+        boundary='app/services/namespace_switcher.py:_stop_failed_namespace_launch:terminate_capture',
+    )
+    with terminate_capture:
+        process.terminate()
+    wait_capture = CapturedExceptionContext(
+        subprocess.TimeoutExpired,
+        boundary='app/services/namespace_switcher.py:_stop_failed_namespace_launch:wait_capture',
+    )
+    with wait_capture:
+        process.wait(timeout=_TERMINATE_GRACE_SECONDS)
+    if wait_capture.captured_exception is not None:
+        process.kill()
+        process.wait(timeout=_KILL_GRACE_SECONDS)
+
+
 def _wait_for_namespace_ready(
     *,
     environ: Mapping[str, str],
     namespace: str,
     port: int,
     launched_process: NamespaceLaunchProcess,
+) -> None:
+    is_ready = False
+    try:
+        _poll_namespace_readiness(
+            environ=environ, namespace=namespace, port=port,
+            launched_process=launched_process,
+        )
+        is_ready = True
+    finally:
+        if not is_ready:
+            _stop_failed_namespace_launch(process=launched_process.process)
+
+
+def _poll_namespace_readiness(
+    *,
+    environ: Mapping[str, str],
+    namespace: str,
+    port: int,
+    launched_process: NamespaceLaunchProcess,
 ) -> None:
     main_server_config = resolve_main_server_config(environ=environ)
     connect_host = resolve_backend_connect_host(host=main_server_config.host)
     api_prefix = resolve_api_prefix(environ=environ)
-    deadline = time.monotonic() + _LAUNCH_READY_TIMEOUT_SECONDS
+    started_at = time.monotonic()
+    timeout_text = environ.get("METALIST_STARTUP_TIMEOUT_SECONDS")
+    timeout = _LAUNCH_READY_TIMEOUT_SECONDS
+    if timeout_text is not None:
+        if not timeout_text.isascii() or not timeout_text.isdigit() or int(timeout_text) <= 0:
+            raise ValueError("METALIST_STARTUP_TIMEOUT_SECONDS must be a positive integer")
+        timeout = float(timeout_text)
+    deadline = started_at + timeout
+    next_progress = started_at + _LAUNCH_PROGRESS_INTERVAL_SECONDS
     while time.monotonic() < deadline:
+        now = time.monotonic()
+        if now >= next_progress:
+            print(f"Still starting namespace {namespace} ({now - started_at:.0f}s elapsed)...", flush=True)
+            next_progress = now + _LAUNCH_PROGRESS_INTERVAL_SECONDS
         exit_code = launched_process.process.poll()
         if exit_code is not None:
             log_tail = _read_namespace_launch_log_tail(

{metalist-0.6.1 → metalist-0.6.2}/app/services/self_update.py

@@ -17,6 +17,7 @@ from app.server_runtime import resolve_namespaces_directory
 from app.services.exception_capture import CapturedExceptionContext
 from app.services.namespace_switcher import stop_all_namespace_processes_for_update
 from app.services.update_backups import backup_all_namespaces_for_update
+from app.services.update_preflight import prepare_update as _prepare_update
 
 
 _WINDOWS_CREATE_NEW_CONSOLE = 0x00000010
@@ -73,13 +74,20 @@ def schedule_self_update(
     if uv_executable is None:
         raise RuntimeError("uv executable was not found on PATH; MetaList was not stopped")
 
+    if platform_name == "win32":
+        _resolve_windows_powershell()
+    elif not Path("/bin/sh").is_file():
+        raise RuntimeError("/bin/sh is required for MetaList self-update; MetaList was not stopped")
+    install_command = _prepare_update(
+        uv_executable=uv_executable, target_version=target_version, environ=environ,
+    )
     updater_command: list[str]
     updater_options: dict[str, object]
     if platform_name == "win32":
         powershell_executable = _resolve_windows_powershell()
         updater_command = _build_windows_updater_command(
             powershell_executable=powershell_executable,
-            uv_executable=uv_executable,
+            install_command=install_command,
             metalist_executable=metalist_executable,
             current_pid=current_pid,
             target_version=target_version,
@@ -95,7 +103,7 @@ def schedule_self_update(
             raise RuntimeError("/bin/sh is required for MetaList self-update; MetaList was not stopped")
         updater_command = _build_posix_updater_command(
             shell_executable=str(shell_path),
-            uv_executable=uv_executable,
+            install_command=install_command,
             metalist_executable=metalist_executable,
             current_pid=current_pid,
             target_version=target_version,
@@ -207,18 +215,17 @@ def _quote_powershell_literal(value: str) -> str:
 def _build_windows_updater_command(
     *,
     powershell_executable: str,
-    uv_executable: str,
+    install_command: list[str],
     metalist_executable: str,
     current_pid: int,
     target_version: str,
 ) -> list[str]:
-    quoted_uv = _quote_powershell_literal(uv_executable)
+    quoted_install = " ".join(_quote_powershell_literal(part) for part in install_command)
     quoted_metalist = _quote_powershell_literal(metalist_executable)
-    quoted_package = _quote_powershell_literal(f"metalist=={target_version}")
     script = (
         f"while (Get-Process -Id {current_pid} -ErrorAction SilentlyContinue) "
         "{ Start-Sleep -Milliseconds 100 }; "
-        f"& {quoted_uv} tool install --force --reinstall --refresh {quoted_package}; "
+        f"& {quoted_install}; "
         "if ($LASTEXITCODE -ne 0) { "
         "Write-Host 'MetaList update failed. Review the uv output above.' -ForegroundColor Red; "
         "Start-Sleep -Seconds 10; exit $LASTEXITCODE }; "
@@ -243,22 +250,12 @@ def _build_windows_updater_command(
 def _build_posix_updater_command(
     *,
     shell_executable: str,
-    uv_executable: str,
+    install_command: list[str],
     metalist_executable: str,
     current_pid: int,
     target_version: str,
 ) -> list[str]:
-    uv_command = shlex.join(
-        [
-            uv_executable,
-            "tool",
-            "install",
-            "--force",
-            "--reinstall",
-            "--refresh",
-            f"metalist=={target_version}",
-        ]
-    )
+    uv_command = shlex.join(install_command)
     metalist_command = shlex.join([metalist_executable])
     script = (
         f"while kill -0 {current_pid} 2>/dev/null; do sleep 0.1; done\n"

metalist-0.6.2/app/services/update_preflight.py

@@ -0,0 +1,126 @@
+"""Validate an update in a disposable installation before stopping live namespaces."""
+from __future__ import annotations
+
+from collections.abc import Mapping
+import json
+import os
+from pathlib import Path
+import socket
+import subprocess
+import sys
+from tempfile import TemporaryDirectory
+
+import httpx
+
+from app.services.namespace_switcher import NamespaceLaunchProcess
+from app.services.namespace_switcher import _stop_failed_namespace_launch
+from app.services.namespace_switcher import _wait_for_namespace_ready
+
+
+def _run_checked(command: list[str], *, environ: Mapping[str, str], directory: Path) -> str:
+    completed = subprocess.run(
+        command, env=dict(environ), cwd=directory, capture_output=True,
+        text=True, encoding="utf-8", check=False, timeout=600,
+    )
+    if completed.returncode != 0:
+        raise RuntimeError(
+            "Update preflight failed; the current installation and running namespaces "
+            f"were not changed.\n{completed.stdout}\n{completed.stderr}"
+        )
+    return completed.stdout
+
+
+def _probe_candidate(*, python: str, executable: str, directory: Path,
+                     environ: Mapping[str, str], target_version: str) -> None:
+    probe_environ = {
+        key: value for key, value in environ.items()
+        if not key.startswith(("METALIST_", "UVICORN_", "SECURITY_", "PYTHON"))
+        and key not in {"TEST_MODE", "API_PREFIX", "V1_API_PREFIX", "SQL_TRACE"}
+    }
+    probe_environ.update(
+        METALIST_DATA_DIRECTORY=str(directory / "probe-data"),
+        METALIST_ENVIRONMENT="production", METALIST_AUTO_GENERATE_TLS="0",
+        PYTHONUNBUFFERED="1", PYTHONUTF8="1", TEST_MODE="0",
+    )
+    if "METALIST_STARTUP_TIMEOUT_SECONDS" in environ:
+        probe_environ["METALIST_STARTUP_TIMEOUT_SECONDS"] = environ["METALIST_STARTUP_TIMEOUT_SECONDS"]
+    with socket.socket() as reservation:
+        reservation.bind(("127.0.0.1", 0))
+        port = reservation.getsockname()[1]
+    _run_checked([
+        python, "-I", "-c",
+        "import sys; from app.server_runtime import save_namespace_launch_profile; "
+        "save_namespace_launch_profile(namespace='update-probe', port=int(sys.argv[1]), https_port=None, mcp_port=None)",
+        str(port),
+    ], environ=probe_environ, directory=directory)
+    log_path = directory / "startup.log"
+    with log_path.open("wb") as log:
+        process = subprocess.Popen(
+            [executable, "--namespace", "update-probe", "--port", str(port)],
+            cwd=directory, env=probe_environ, stdout=log, stderr=subprocess.STDOUT,
+        )
+    try:
+        _wait_for_namespace_ready(
+            environ=probe_environ, namespace="update-probe", port=port,
+            launched_process=NamespaceLaunchProcess(process, log_path, 0),
+        )
+        with httpx.Client(
+            base_url=f"http://127.0.0.1:{port}", timeout=15, trust_env=False,
+            headers={"X-Metalist-Tab-Id": "00000000-0000-4000-8000-000000000001"},
+        ) as client:
+            status = client.get("/api2/auth/status")
+            status.raise_for_status()
+            if status.json()["version"] != target_version:
+                raise RuntimeError("Update candidate started with the wrong version")
+            for path in ("/", "/static/js/main.js", "/static/css/main.css", "/static/note-html-policy.json"):
+                response = client.get(path)
+                response.raise_for_status()
+                if len(response.content) == 0:
+                    raise RuntimeError(f"Update candidate has an empty runtime resource: {path}")
+    finally:
+        _stop_failed_namespace_launch(process=process)
+
+
+def prepare_update(*, uv_executable: str, target_version: str,
+                   environ: Mapping[str, str]) -> list[str]:
+    # A tool environment is replaced during install: pin its external base interpreter.
+    python = str(Path(sys._base_executable).resolve())
+    if not Path(python).is_file():
+        raise RuntimeError("The current base Python interpreter is missing; MetaList was not stopped")
+    print(f"Checking MetaList v{target_version} installation and startup with Python {sys.version.split()[0]}...", flush=True)
+    with TemporaryDirectory(prefix="metalist-update-check-") as temporary:
+        directory = Path(temporary)
+        stage_environ = dict(environ)
+        stage_environ.update(UV_TOOL_DIR=str(directory / "tools"), UV_TOOL_BIN_DIR=str(directory / "bin"))
+        _run_checked([
+            uv_executable, "tool", "install", "--python", python,
+            "--refresh", "--compile-bytecode", f"metalist=={target_version}",
+        ], environ=stage_environ, directory=directory)
+        if sys.platform == "win32":
+            scripts = directory / "tools" / "metalist" / "Scripts"
+            candidate_python = str(scripts / "python.exe")
+            candidate_cli = str(scripts / "metalist.exe")
+        else:
+            scripts = directory / "tools" / "metalist" / "bin"
+            candidate_python = str(scripts / "python")
+            candidate_cli = str(scripts / "metalist")
+        identity = json.loads(_run_checked([
+            candidate_python, "-I", "-c",
+            "import sys,json,importlib.metadata; print(json.dumps([list(sys.version_info[:2]),importlib.metadata.version('metalist')]))",
+        ], environ=stage_environ, directory=directory))
+        if identity != [list(sys.version_info[:2]), target_version]:
+            raise RuntimeError("Update preflight changed Python or installed the wrong MetaList version")
+        _run_checked([uv_executable, "pip", "check", "--python", candidate_python], environ=stage_environ, directory=directory)
+        frozen = _run_checked([uv_executable, "pip", "freeze", "--python", candidate_python], environ=stage_environ, directory=directory)
+        _probe_candidate(python=candidate_python, executable=candidate_cli, directory=directory,
+                         environ=environ, target_version=target_version)
+        # Keep the exact tested dependency set. Offline installation reuses the warmed uv cache.
+        command = [uv_executable, "tool", "install", "--force", "--offline", "--python", python,
+                   "--compile-bytecode", f"metalist=={target_version}"]
+        for requirement in frozen.splitlines():
+            if "==" not in requirement or requirement.startswith("-"):
+                raise RuntimeError(f"Update preflight produced an unpinned requirement: {requirement}")
+            if requirement.split("==")[0].casefold() != "metalist":
+                command.extend(["--with", requirement])
+    print("Update installation and startup check passed; packages are cached for offline installation.", flush=True)
+    return command

{metalist-0.6.1 → metalist-0.6.2}/app/version.py

@@ -1,3 +1,3 @@
 """Single authoritative MetaList application version."""
 
-__version__ = "0.6.1"
+__version__ = "0.6.2"

{metalist-0.6.1 → metalist-0.6.2}/convert-from-legacy.py

@@ -26,7 +26,10 @@ tk = None  # type: ignore[assignment]
 filedialog = None  # type: ignore[assignment]
 _TK_IMPORT_ERROR = None
 
-if importlib.util.find_spec("tkinter") is not None:
+if (
+    importlib.util.find_spec("tkinter") is not None
+    and importlib.util.find_spec("_tkinter") is not None
+):
     import tkinter as tk
     from tkinter import filedialog
 else:

{metalist-0.6.1 → metalist-0.6.2/metalist.egg-info}/PKG-INFO

@@ -1,11 +1,11 @@
 Metadata-Version: 2.4
 Name: metalist
-Version: 0.6.1
+Version: 0.6.2
 Summary: A minimalist single-user note-taking app with SSR, fast in-memory tree operations, and efficient sync.
 Project-URL: Homepage, https://github.com/evolvingstuff/metalist
 Project-URL: Repository, https://github.com/evolvingstuff/metalist
 Project-URL: Issues, https://github.com/evolvingstuff/metalist/issues
-Requires-Python: <3.14,>=3.10
+Requires-Python: <3.15,>=3.10
 Description-Content-Type: text/markdown
 Requires-Dist: argon2-cffi==25.1.0
 Requires-Dist: cryptography==50.0.0
@@ -48,6 +48,13 @@ A minimalist single-user note-taking app focused on server-side rendering (SSR),
 - Multi-tab search contexts with server-persisted scroll/search state (survives browser restarts)
 - Manual namespace backups/restores to a user-selected backup folder with retention controls
 
+## Changes in 0.6.2
+
+- Namespace startup allows two minutes, with progress every five seconds, instead of failing after 12 seconds on a busy machine. `METALIST_STARTUP_TIMEOUT_SECONDS` can increase the allowance. Failed children are stopped and reaped.
+- Updates preserve the running Python interpreter and validate a disposable installation and namespace startup before stopping live servers. uv then installs the tested package/dependency versions from its cache without network access.
+- Python 3.14 is supported. Command-line legacy imports also work when Python lacks Tk's native GUI component.
+- Release validation now includes the real uv update, backups, and multi-namespace restart on Windows, macOS, and Linux across Python 3.10–3.14.
+
 ## Changes in 0.6.1
 
 - Removed the unused performance overlay, including its menu option and background state updates, fixing a fatal redundant-state error during note rearranging. Obsolete overlay preferences and command usage are discarded automatically.
@@ -119,11 +126,11 @@ After the first installation, update and restart MetaList with one cross-platfor
 ```bash
 metalist update
 ```
-The updater checks the installed version against the latest PyPI release first. If MetaList is already current, it reports the installed version and leaves all running namespaces untouched. When an update is available, it checks the installer prerequisites, stops running namespaces, and creates and verifies a new backup of every namespace before installation can begin. Each archive includes the complete notes/settings database, the attachments database when present, and any legacy search-history database. Locked namespaces are backed up with their encrypted data and key metadata intact, without requiring a password.
+The updater checks the installed version against the latest PyPI release first. If MetaList is already current, it reports the installed version and leaves all running namespaces untouched. When an update is available, it checks installer prerequisites and uses uv to install the candidate into a disposable tool environment with the current base Python interpreter. It checks dependencies and starts a temporary namespace to verify HTTP readiness, version, and runtime assets. A failed preflight leaves the current installation and running namespaces unchanged. After preflight succeeds, it stops running namespaces, and creates and verifies a new backup of every namespace before installation can begin. Each archive includes the complete notes/settings database, the attachments database when present, and any legacy search-history database. Locked namespaces are backed up with their encrypted data and key metadata intact, without requiring a password.
 
 Backups are saved to `~/MetaList/namespaces/<namespace>/backups/<namespace>-<timestamp>.metalist-backup.tar.gz`; the updater prints each verified path. Existing backups remain unchanged and are not pruned. If any backup fails, the update aborts with the current installation intact; run `metalist` to restart the stopped servers after resolving the failure.
 
-Only after all backups pass does the updater hand off to an external PowerShell process on Windows or `/bin/sh` on macOS/Linux so the installed environment can unlock. It installs the exact version reported by PyPI with a forced cache refresh, launches MetaList again, and reports the installed version (for example, `MetaList updated to v0.5.0.`). This protection requires an installed version containing the backup safeguard and applies to `metalist update`; direct pip/uv install commands do not run it.
+Only after all backups pass does the updater hand off to an external PowerShell process on Windows or `/bin/sh` on macOS/Linux so the installed environment can unlock. It delegates installation to uv, pinning the current base interpreter and the exact tested package/dependency versions, using the cache populated during preflight with network access disabled. It then launches MetaList again, and reports the installed version (for example, `MetaList updated to v0.5.0.`). This protection requires an installed version containing the backup safeguard and applies to `metalist update`; direct pip/uv install commands do not run it.
 
 For pip, users can run `pip install metalist`. For a non-editable local install from this checkout, use `uv pip install .` or `pip install .` instead of the editable command below.
 
@@ -283,6 +290,10 @@ convert-from-legacy.py --namespace work --input /path/to/legacy-export.json
 
 If `--namespace`, `--port`, or `--https-port` are omitted, the import script prompts for them and saves the resulting launch profile inside the target namespace DB. That means a one-time import into `work` can immediately seed later shorthand launches like `metalist work`.
 
+Namespace startup allows 120 seconds per child, reports progress every five seconds, and stops/reaps a failed child instead of leaving it running after reporting failure. Set `METALIST_STARTUP_TIMEOUT_SECONDS` to a positive number of seconds to allow more time on a heavily loaded machine. A crashed child still fails immediately. This is a startup allowance, not a guarantee that any machine will finish within two minutes.
+
+The preflight is a disposable empty namespace; it cannot guarantee startup against every real database or prevent a later disk/process failure. If installation succeeds but real namespace startup fails, the new package remains installed: resolve the reported startup issue and run `metalist` again. No automatic code/database rollback is attempted, and backups remain unchanged.
+
 ### Publishing
 For the real user-facing install flow:
 ```bash
@@ -292,15 +303,15 @@ uv tool install metalist
 metalist
 ```
 
-This repo now packages itself under the PyPI distribution name `metalist`. Current releases support Python 3.10 through 3.13.
+This repo now packages itself under the PyPI distribution name `metalist`. Current releases support Python 3.10 through 3.14.
 
 Recommended release path:
 1. In the existing PyPI project `metalist`, configure GitHub Trusted Publishing for `evolvingstuff/metalist` and the workflow file `.github/workflows/publish-pypi.yml`.
-2. Push the candidate commit to a branch and wait for the `Publish to PyPI` validation workflow to pass for that exact commit. GitHub-hosted Windows, macOS, and Linux runners install the built wheel and test application startup outside the source checkout on Python 3.10 through 3.13. You do not need those operating systems locally. Archive verification also checks runtime files, including agent Markdown resources, against both the wheel and source distribution.
+2. Push the candidate commit to a branch and wait for the `Publish to PyPI` validation workflow to pass for that exact commit. GitHub-hosted Windows, macOS, and Linux runners install the built wheel and test application startup outside the source checkout on Python 3.10 through 3.14. Every matrix job also exercises the real `metalist update` path with uv, backups, interpreter preservation, and two-namespace restart against a local release index. The old-version fixture carries the candidate updater so this validates the mechanism being shipped; it does not retroactively fix older installed updaters. You do not need those operating systems locally. Archive verification also checks runtime files, including agent Markdown resources, against both the wheel and source distribution.
 3. Only after every required check passes, create and push the release tag for that same commit. Any intervening change requires a new validation run before tagging. Branch and pull-request runs validate without publishing.
 4. The tag workflow repeats validation and publishes the same artifacts tested by its full matrix. Manual publication also requires all checks to pass. Users can then run it with `uvx metalist`, install it persistently with `uv tool install metalist`, or install it with `pip install metalist`.
 
-If `--input` is omitted, a file picker opens (when `tkinter` is available).
+If `--input` is omitted, a file picker opens (when `tkinter` and its native `_tkinter` component are available).
 Notes tagged with `@implies` are converted into ontology rules and are not imported as notes. Legacy rules that are invalid under the current ontology grammar are reported and skipped while valid rules continue importing.
 
 ### Run Tests

{metalist-0.6.1 → metalist-0.6.2}/metalist.egg-info/SOURCES.txt

@@ -159,6 +159,7 @@ app/services/test_reset.py
 app/services/tokens.py
 app/services/undo_state.py
 app/services/update_backups.py
+app/services/update_preflight.py
 app/services/view_cache.py
 app/services/view_diff.py
 app/services/view_state.py

{metalist-0.6.1 → metalist-0.6.2}/pyproject.toml

@@ -7,7 +7,7 @@ name = "metalist"
 dynamic = ["version"]
 description = "A minimalist single-user note-taking app with SSR, fast in-memory tree operations, and efficient sync."
 readme = "README.md"
-requires-python = ">=3.10,<3.14"
+requires-python = ">=3.10,<3.15"
 dependencies = [
     "argon2-cffi==25.1.0",
     "cryptography==50.0.0",