update-machine: read deck's real list table through the bundle's deck (RT-274)

[m4ttheweric]

The first real rt release update-machine run (v2.11.0) marked the served-suite leg and the verify sweep failed on a machine that was fully current.

What changed

Deck contract (lib/release/update-machine.ts)

• Parses deck list's table instead of deck list --json, which deck ignores.
• Managed apps are rows whose owner is not user, deck, local, or unregistered: the same set deck restart --managed restarts.
• A line that is not a deck row fails closed, so it can't read as "no apps".

One deck CLI

• Every leg and the verify sweep call the serving bundle's Contents/Helpers/deck: the dev app's, or mattstack.app's when the dev app isn't running.
• Nothing calls a deck on PATH, which had been a stale hand-installed 1.0.5.

Tests

• fixtures/deck-list-1.0.7.txt is captured from this machine's live deck list.
• The fakes now refuse a bare deck and serve the real table format.

Verification

bun test lib/release commands/__tests__/release-update-machine.test.ts: 174/174. A live rt release update-machine --verify-only --tag v2.11.0 from this branch no longer reports a deck problem. It still reports that the daemon is on b983acc07 (rt#428, merged after the tag), which is correct.

Fixes RT-274.

🤖 Generated with Claude Code

https://claude.ai/code/session_017A8MG18FT27cFsiEWiKGHD

[coderabbitai]

Warning

Review limit reached

Next included review available in 5 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available. Your 83 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 11119504-e7a9-442a-9575-ee5fc55a2e01

📥 Commits

Reviewing files that changed from the base of the PR and between b983acc and 69176c3.

📒 Files selected for processing (4)

• commands/__tests__/release-update-machine.test.ts
• lib/release/__tests__/fixtures/deck-list-1.0.7.txt
• lib/release/__tests__/update-machine.test.ts
• lib/release/update-machine.ts

---

_{Comment @coderabbitai help to get the list of available commands.}

[m4ttheweric]

Review of record (Opus; CodeRabbit rate limited). Nothing blocked the merge. All four findings are fixed in 69176c3:

1. An empty deck list read as "no managed apps, all fresh". deck exits 0 with no rows when its API errors, so an empty managed set is now an error. The command-level fake serves a real table.
2. The serving bundle wasn't resolved for --verify-only, or when the dev-bundle leg was declined or failed early. It is now read from pgrep before the dev-bundle leg and in --verify-only, with tests for both paths.
3. The owner-set comment now says it matches deck's owner filter but can't see kind.
4. A test comment now names runDevAppRebuild instead of the dev-bundle leg.

The reviewer confirmed the parser against every row shape deck prints (long names, - columns, DOWN, !source and [public:...] suffixes, CRLF), and that the owner set matches restartManagedApps. bun test lib/release commands/__tests__/release-update-machine.test.ts: 177/177.