[SaladDay]

An interrupted first install could leave a downloaded bundle behind, while network and Docker failures offered little guidance. The release bootstrap now retries bounded transfers, checks disk space and asset sizes, reports progress, and clears abandoned staging under a shared lock. It waits for the bundled installer to finish cleanup before removing temporary files and retains repair bundles only after success.

The bundled installer reports Docker-access, disk/quota and directory-permission failures clearly. Retrying an incomplete installation removes it before installing the selected release; completed installations still require the same revision and preserve their data. Operator guidance stays in the installation guide, with lifecycle details in the installer design document.

Validation:

• 28 release-bootstrap tests and 49 installer/output tests pass, including real signal delivery, child cleanup, concurrent locking and truncated HTTP responses.
• Two fresh-context blind reviews completed; the final review found no actionable issues.
• Live checks on mx1 (UID 0) and zju_a100_2 (UID 1004), using the candidate installer modules with checksum-verified v0.0.2 service payloads: occupied-port rejection, default-port avoidance, Core/Web/PG startup, same-release identity/key preservation, incomplete prior-revision cleanup and reinstall, and uninstall. Test containers, volumes, networks and files were removed.
• A live interrupted GitHub download cleaned its staging files. That server's slow connection was not used to claim a completed online installation.
• Linux make check passed distribution, Go, Core/database, SDK and Web unit checks, then stopped because the host lacks the Chrome binary required by browser acceptance. GitHub CI passed backend, tooling, Web and both browser-acceptance shards; the aggregate check is tracked on this PR.