@agentcomms/whatsapp 0.18.2 → 0.20.0

package/dist/{sync-D5RWl-ZJ.mjs → sync-Coys7_vB.mjs}

@@ -1,17 +1,17 @@
-import { C as unknown, S as union, b as strictObject, c as boolean, h as number, i as _enum, l as discriminatedUnion, m as looseObject, n as datetime, p as literal, s as array, x as string, y as record } from "./iso-USuVU_sk.mjs";
+import { C as unknown, S as union, b as strictObject, c as boolean, g as object, h as number, i as _enum, l as discriminatedUnion, m as looseObject, n as datetime, p as literal, s as array, x as string, y as record } from "./iso-USuVU_sk.mjs";
 import { access, chmod, constants, link, lstat, mkdir, open, readFile, readdir, readlink, realpath, rename, rm, stat, unlink, utimes } from "node:fs/promises";
-import path, { basename, delimiter, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import path, { basename, delimiter, dirname, isAbsolute, join, posix, relative, resolve, sep, win32 } from "node:path";
 import { domainToASCII, fileURLToPath, pathToFileURL } from "node:url";
 import { createHash, randomBytes, randomInt, timingSafeEqual } from "node:crypto";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
 import { styleText } from "node:util";
 import { homedir, platform, userInfo } from "node:os";
-import { accessSync, constants as constants$1, readFileSync, realpathSync, statSync } from "node:fs";
+import { accessSync, constants as constants$1, lstatSync, readFileSync, readlinkSync, realpathSync, statSync } from "node:fs";
 import { execFile, spawn } from "node:child_process";
 //#endregion
 //#region src/version.ts
 /** The package version, read from package.json at build time. */
-const VERSION$1 = "0.18.2";
+const VERSION$2 = "0.20.0";
 //#endregion
 //#region src/caller.ts
 /** This package's name, as its manifest has it. */
@@ -28,23 +28,20 @@ const CALLER = Object.freeze({
 	packageName: PACKAGE_NAME
 });
 //#endregion
-//#region ../core/dist/update-check-ev9Jxi1R.mjs
+//#region ../core/dist/update-check-N_-uYKZQ.mjs
 /**
 * Every failure a user or an agent can act on carries a specific, stable code from this registry, a message, an
 * optional one-line hint and structured `details`. The code decides the process exit status; agents and skills branch
-* on the code, humans read the message. Exit statuses follow BSD sysexits where one fits; 10 and 11 are ours.
+* on the code, humans read the message. Exit statuses follow BSD sysexits where one fits; 10 is ours.
+*
+* 11 was ours too, for a command the daily update check stopped (design 2026-09-28). Nothing is stopped for being behind
+* any more (design 2026-10-16, U1), so `UPDATE_REQUIRED` and 11 are retired: a client that still sees one is talking to
+* a server older than 0.20.0.
 */
 const EXIT_CODES = {
 	OK: 0,
 	UNEXPECTED: 1,
 	APPROVAL: 10,
-	/**
-	* A command that did not run because a newer release is out and nobody at a terminal could be asked about it
-	* (design 2026-09-28 §3). None of sysexits' codes means "run something else first", and a script that branches on
-	* it has exactly two things to do — update, or put it off — so it has one of its own. 11, beside 10: both mean a
-	* person has to decide before the command can go on.
-	*/
-	UPDATE: 11,
 	USAGE: 64,
 	BAD_DATA: 65,
 	NOT_FOUND: 66,
@@ -109,11 +106,6 @@ const ERROR_REGISTRY = {
 		retryable: false,
 		summary: "a safety setting can only be loosened by a person"
 	},
-	UPDATE_REQUIRED: {
-		exit: EXIT_CODES.UPDATE,
-		retryable: false,
-		summary: "a newer release is out: update first, or put it off until tomorrow"
-	},
 	USAGE: {
 		exit: EXIT_CODES.USAGE,
 		retryable: false,
@@ -903,6 +895,203 @@ var TaintStore = class {
 		return sortedOrigins([...originEntry(sidecar), ...sidecar !== void 0 && isNewer(entry.at, sidecar.at) ? ["read"] : []]);
 	}
 };
+/**
+* One table of dangerous characters, shared by the inbound sanitiser (which strips them from sender-controlled text)
+* and the preview renderer (which makes them visible), so the two can never disagree.
+*/
+/** Zero-width and formatting characters, bidi controls, variation selectors and Unicode tag characters. */
+const INVISIBLE_RANGES = [
+	[173, 173],
+	[847, 847],
+	[1564, 1564],
+	[4447, 4448],
+	[6068, 6069],
+	[6155, 6159],
+	[8203, 8207],
+	[8232, 8233],
+	[8234, 8238],
+	[8288, 8292],
+	[8294, 8303],
+	[12644, 12644],
+	[65024, 65039],
+	[65279, 65279],
+	[65440, 65440],
+	[917504, 917631]
+];
+function isInvisible(codePoint) {
+	for (const [from, to] of INVISIBLE_RANGES) if (codePoint >= from && codePoint <= to) return true;
+	return false;
+}
+/**
+* C0 controls except tab and newline (ESC, and so every ANSI/OSC sequence, starts here), DEL, and C1 controls (CSI
+* among them). A lone carriage return counts: it moves a terminal cursor back over text already printed.
+*/
+function isControl(codePoint) {
+	if (codePoint === 9 || codePoint === 10) return false;
+	return codePoint < 32 || codePoint === 127 || codePoint >= 128 && codePoint <= 159;
+}
+function isDangerous(codePoint) {
+	return isControl(codePoint) || isInvisible(codePoint);
+}
+/**
+* Strips control characters (ESC, CSI, OSC and the rest), DEL, lone carriage returns, zero-width, bidi-control and tag
+* characters from sender-controlled text; returns the text and how many were removed. CRLF becomes LF first.
+*
+* This lives beside the table rather than in the sanitiser because `neutralise` needs it too, and the two must not
+* drift: a pattern that looks for `</untrusted-content` cannot see it through a zero-width space, so stripping
+* has to happen before any such pattern runs, on every path, not only on the ones that render a body.
+*/
+function stripInvisible(text) {
+	let removed = 0;
+	let out = "";
+	for (const char of text.replace(/\r\n/g, "\n")) if (isDangerous(char.codePointAt(0) ?? 0)) removed += 1;
+	else out += char;
+	return {
+		text: out,
+		removed
+	};
+}
+/**
+* Labelling what an agent sends (design 2026-10-15-agent-label): the phrase `<name> (<word>)`, who a message appears to
+* come from, and which setting changes loosen that. Pure: nothing here reads the configuration or talks to a channel,
+* so every channel decides the same way from the same settings.
+*/
+/** L2: the words a label may use, exactly as written. Adding one is a code change with its own review. */
+const AGENT_LABEL_WORDS = Object.freeze([
+	"agent",
+	"assistant",
+	"twin",
+	"minion",
+	"bot",
+	"fake",
+	"AI"
+]);
+/** L4: the kinds of act a rule may name. Slack posts, replies, reacts, edits and shares files; mail sends and replies. */
+const ACT_KINDS = Object.freeze([
+	"post",
+	"reply",
+	"reaction",
+	"edit",
+	"file",
+	"send"
+]);
+/**
+* How an `agent` act looks in one Slack workspace (the owner's decision, 2026-10-17): `app`, the default, posts as the
+* app where S2 says it can, with Slack's APP tag, and labelled as the person elsewhere; `labelled` posts every one as
+* the person, labelled as S3's fallback is, even where the app could post. Slack's APP tag cannot be hidden or renamed,
+* so this is the person's choice between that tag and words in the message.
+*/
+const SLACK_STYLES = Object.freeze(["app", "labelled"]);
+/** L2's characters a name may not hold: parentheses would fake a second label, the rest break an address header. */
+const FORBIDDEN_NAME_CHARACTERS = /[()<>"@,;:\\]/u;
+function isAgentLabelWord(value) {
+	return typeof value === "string" && AGENT_LABEL_WORDS.includes(value);
+}
+function isSlackStyle(value) {
+	return typeof value === "string" && SLACK_STYLES.includes(value);
+}
+/** A Slack workspace's style, by its account id: `app` unless `labelled` is recorded for it. */
+function slackStyleOf(settings, accountId) {
+	const styles = settings?.slackStyles;
+	return styles !== void 0 && Object.hasOwn(styles, accountId) && styles[accountId] === "labelled" ? "labelled" : "app";
+}
+/** Why a name cannot be labelled, or undefined when it can. */
+function nameProblem(name) {
+	if (name.length === 0) return "the name is empty";
+	if (name.trim() !== name) return "the name starts or ends with a space";
+	if (FORBIDDEN_NAME_CHARACTERS.test(name)) return "the name holds a parenthesis or one of <>\"@,;:\\";
+	for (const char of name) if (isDangerous(char.codePointAt(0) ?? 0)) return "the name holds a hidden or control character";
+}
+const ruleKey = (rule) => JSON.stringify([
+	rule.account,
+	rule.accountId ?? null,
+	rule.conversation ?? null,
+	rule.kinds === void 0 ? null : [...rule.kinds].sort(),
+	rule.as
+]);
+/**
+* L5: the changes that need the person's confirmation — anything that could leave a message unlabelled or change how
+* the label looks. Adding an `agent` rule or removing a `me` rule tightens, and is not listed. A Slack workspace moved
+* from `app` to `labelled` trades Slack's own APP tag, which no one can fake, for words in the message, so it waits;
+* moved back to `app`, it tightens. Its values are each moved workspace's style, before and after.
+*/
+function classifyAgentLabelChange(before, after) {
+	const changes = [];
+	const wordBefore = before?.word ?? "agent";
+	const wordAfter = after?.word ?? "agent";
+	if (wordBefore !== wordAfter) changes.push({
+		path: "agentLabel.word",
+		was: wordBefore,
+		now: wordAfter
+	});
+	if ((before?.name ?? null) !== (after?.name ?? null)) changes.push({
+		path: "agentLabel.name",
+		was: before?.name,
+		now: after?.name
+	});
+	const rulesBefore = new Map((before?.rules ?? []).map((rule) => [ruleKey(rule), rule]));
+	const rulesAfter = new Map((after?.rules ?? []).map((rule) => [ruleKey(rule), rule]));
+	const meAdded = [...rulesAfter].some(([key, rule]) => rule.as === "me" && !rulesBefore.has(key));
+	const agentRemoved = [...rulesBefore].some(([key, rule]) => rule.as === "agent" && !rulesAfter.has(key));
+	if (meAdded || agentRemoved) changes.push({
+		path: "agentLabel.rules",
+		was: before?.rules ?? [],
+		now: after?.rules ?? []
+	});
+	if (JSON.stringify(sorted(before?.slackIcons)) !== JSON.stringify(sorted(after?.slackIcons))) changes.push({
+		path: "agentLabel.slackIcons",
+		was: before?.slackIcons ?? {},
+		now: after?.slackIcons ?? {}
+	});
+	const styled = [.../* @__PURE__ */ new Set([...Object.keys(before?.slackStyles ?? {}), ...Object.keys(after?.slackStyles ?? {})])].filter((id) => slackStyleOf(before, id) !== slackStyleOf(after, id)).sort();
+	if (styled.some((id) => slackStyleOf(after, id) === "labelled")) changes.push({
+		path: "agentLabel.slackStyles",
+		was: Object.fromEntries(styled.map((id) => [id, slackStyleOf(before, id)])),
+		now: Object.fromEntries(styled.map((id) => [id, slackStyleOf(after, id)]))
+	});
+	return changes;
+}
+function sorted(record) {
+	return Object.entries(record ?? {}).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+}
+const EMOJI_NAME = /^:[a-z0-9_+'-]{1,100}:$/u;
+function isRule(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const rule = value;
+	if (typeof rule.account !== "string" || rule.account.length === 0) return false;
+	if (rule.as !== "agent" && rule.as !== "me") return false;
+	if (rule.accountId !== void 0 && (typeof rule.accountId !== "string" || rule.accountId.length === 0)) return false;
+	if (rule.conversation !== void 0 && (typeof rule.conversation !== "string" || rule.conversation.length === 0)) return false;
+	if (rule.kinds !== void 0 && !(Array.isArray(rule.kinds) && rule.kinds.length > 0 && rule.kinds.every((kind) => ACT_KINDS.includes(kind)))) return false;
+	return true;
+}
+/**
+* The stored `agentLabel`, read so that a bad value can only tighten. An unknown word reads as `agent`, an invalid
+* name as no name, and a rule list with any invalid rule is ignored whole: dropping one `agent` rule could leave a
+* broader `me` rule in charge. A malformed icon entry is dropped, falling back to the plain photo. A Slack style that is
+* neither `app` nor `labelled` is dropped too, so that workspace is `app`: the stronger disclosure.
+*/
+function readAgentLabelSettings(raw) {
+	if (typeof raw !== "object" || raw === null) return {};
+	const stored = raw;
+	const settings = {};
+	if (isAgentLabelWord(stored.word)) settings.word = stored.word;
+	if (typeof stored.name === "string" && nameProblem(stored.name) === void 0) settings.name = stored.name;
+	if (Array.isArray(stored.rules) && stored.rules.every(isRule)) settings.rules = stored.rules.map((rule) => ({ ...rule }));
+	if (typeof stored.slackIcons === "object" && stored.slackIcons !== null) {
+		const icons = Object.entries(stored.slackIcons).filter((entry) => typeof entry[1] === "string" && EMOJI_NAME.test(entry[1]));
+		if (icons.length > 0) settings.slackIcons = Object.fromEntries(icons);
+	}
+	if (typeof stored.slackStyles === "object" && stored.slackStyles !== null && !Array.isArray(stored.slackStyles)) {
+		const styles = Object.entries(stored.slackStyles).filter((entry) => isSlackStyle(entry[1]));
+		if (styles.length > 0) settings.slackStyles = Object.fromEntries(styles);
+	}
+	return settings;
+}
+/** The person's label settings from a loaded configuration, read as `readAgentLabelSettings` reads them. */
+function agentLabelOf(config) {
+	return readAgentLabelSettings(config.agentLabel);
+}
 /** Every first-party channel, the core first: what core knows about each without installing it. */
 const CHANNEL_SNAPSHOT = [
 	{
@@ -1072,7 +1261,11 @@ const CHANNEL_SNAPSHOT = [
 				word: "slack",
 				can: "post to Slack"
 			},
-			hosts: ["slack.com", "files.slack.com"],
+			hosts: [
+				"slack.com",
+				"files.slack.com",
+				"avatars.slack-edge.com"
+			],
 			approve: "agent-slack approve",
 			skills: {
 				prefix: "slack-",
@@ -2968,17 +3161,508 @@ function commandLinePackage(command, args) {
 	const line = [command, ...withoutPathOptions(args).words].join(" ");
 	return /(@[\w.-]+\/[\w.-]+|(?<=\s)[\w.-]+-mcp)(?=@|\s|$)/.exec(line)?.[1];
 }
+/** The scope every server package is published under; a launcher is named for the rest of the package name. */
+const SCOPE$1 = "@agentcomms";
+const LAUNCH = "launch";
+const RUNTIMES = "runtime";
+const POINTER = ".current";
+const FALLBACK = ".fallback";
+const LOCK = ".lock";
+/**
+* What a launcher hands the process it starts (re-review of 0.20.0, severity 6): its own name, so the process knows it
+* was started through its package's stable launcher — the one the background job switches — and not by npx, a
+* versioned or local registration, or a command from somewhere else. The update notice holds back only for such a
+* process what the job will install (`update-gate.ts`), and only a run of `update --background` started through the
+* core launcher, as the job starts it, records that the job ran (`update-background.ts`).
+*/
+const LAUNCHER_ENV = "AGENT_COMMS_LAUNCHER";
+/** A launcher's name: one plain word, never a path — the unscoped name of a server package. */
+const NAME = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/;
+/** A runtime's folder in `<data>/runtime`: no separator, nothing that starts with a dot. */
+const FOLDER = /^[0-9A-Za-z][0-9A-Za-z.+_-]*$/;
+/** The version a managed runtime's folder starts with, as `mcp prune` reads one. */
+const VERSION$1 = /^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.+-]*)?$/;
+/** The CLI inside a runtime, as words from the runtime's folder: what `managedRuntimeEntry` names. */
+function cliWords(name) {
+	return [
+		"node_modules",
+		SCOPE$1,
+		name,
+		"dist",
+		"cli.mjs"
+	];
+}
+function checkedName(name) {
+	if (!NAME.test(name)) throw new CommsError("CONFIG", `${JSON.stringify(name)} is not a launcher name: one plain word, such as gmail`);
+	return name;
+}
+/** The launcher a server package is started through: its name without the scope, `@agentcomms/gmail` → `gmail`. */
+function launcherName(packageName) {
+	const [scope, rest, extra] = packageName.split("/");
+	if (scope !== SCOPE$1 || rest === void 0 || extra !== void 0) throw new CommsError("CONFIG", `${packageName} is not a package a stable launcher starts`);
+	return checkedName(rest);
+}
+/** Where a launcher and its pointer are: `<data>/launch/<name>` and `<data>/launch/<name>.current`. */
+function launcherPaths(dataDir, name) {
+	const directory = join(dataDir, LAUNCH);
+	checkedName(name);
+	return {
+		launcher: join(directory, name),
+		pointer: join(directory, `${name}${POINTER}`)
+	};
+}
+/** Where the launcher records that it fell back: `<data>/launch/<name>.fallback`. */
+function fallbackRecordPath(dataDir, name) {
+	return join(dataDir, LAUNCH, `${checkedName(name)}${FALLBACK}`);
+}
+/** The CLI a runtime holds for a launcher: `<runtime>/node_modules/@agentcomms/<name>/dist/cli.mjs`. */
+function launcherCli(runtimeDir, name) {
+	return join(runtimeDir, ...cliWords(checkedName(name)));
+}
+/** The version a runtime folder of this launcher is, `0.20.0` for `0.20.0-gmail`; null for any other folder. */
+function launcherRuntimeVersion(runtimeDir, name) {
+	const folder = basename(runtimeDir);
+	const suffix = `-${checkedName(name)}`;
+	if (!folder.endsWith(suffix)) return null;
+	const version = folder.slice(0, -suffix.length);
+	return VERSION$1.test(version) ? version : null;
+}
+/** A runtime folder this launcher may point at: a folder of its own in `<data>/runtime`, named for it. */
+function isOwnFolder(folder, name) {
+	return FOLDER.test(folder) && folder.endsWith(`-${name}`) && folder.length > name.length + 1;
+}
+/** The pointer's text: one runtime folder a line, read by the launcher with nothing but its shell's built-ins. */
+function pointerText(current, previous) {
+	return [
+		"# The runtime the stable launcher beside this file starts, written by agent-communications. Do not edit.",
+		`current=${current}`,
+		...previous === void 0 ? [] : [`previous=${previous}`],
+		""
+	].join("\n");
+}
+/** The pointer in `text`, as runtime folders, or null when it is not one this writes. */
+function parsePointer(text, name) {
+	let current;
+	let previous;
+	for (const line of text.split(/\r?\n/)) {
+		if (line === "" || line.startsWith("#")) continue;
+		const at = line.indexOf("=");
+		const key = at < 0 ? line : line.slice(0, at);
+		const value = at < 0 ? "" : line.slice(at + 1);
+		if (key === "current" && current === void 0) current = value;
+		else if (key === "previous" && previous === void 0) previous = value;
+		else return null;
+	}
+	if (current === void 0 || !isOwnFolder(current, name)) return null;
+	if (previous !== void 0 && !isOwnFolder(previous, name)) return null;
+	return previous === void 0 ? { current } : {
+		current,
+		previous
+	};
+}
+function asPaths(dataDir, folders) {
+	const runtimes = join(dataDir, RUNTIMES);
+	return folders.previous === void 0 ? { current: join(runtimes, folders.current) } : {
+		current: join(runtimes, folders.current),
+		previous: join(runtimes, folders.previous)
+	};
+}
+function unreadable$1(pointer, why) {
+	return new CommsError("CONFIG", `${pointer} cannot be read as a pointer: ${why}`, { hint: "It is written by managed installs and updates, never by hand. Run a managed install or an update again: it writes the pointer afresh." });
+}
+/** The pointer's runtime folders, or undefined when there is no pointer; refused when it is not one this writes. */
+async function readFolders(dataDir, name) {
+	const { pointer } = launcherPaths(dataDir, name);
+	let text;
+	try {
+		text = await readFile(pointer, "utf8");
+	} catch (error) {
+		if (error.code === "ENOENT") return void 0;
+		throw unreadable$1(pointer, error.code ?? String(error));
+	}
+	const folders = parsePointer(text, name);
+	if (folders === null) throw unreadable$1(pointer, `it does not name a runtime of ${name} in ${join(dataDir, RUNTIMES)}`);
+	return folders;
+}
+/**
+* The runtime a launcher starts, and the one before it; undefined when it has no pointer yet.
+*
+* A pointer that is there and is not one this writes is refused rather than taken for none: what it names may be in
+* use, and "no pointer" would let a prune or an update act as though nothing were.
+*/
+async function readPointer(dataDir, name) {
+	const folders = await readFolders(dataDir, name);
+	return folders === void 0 ? void 0 : asPaths(dataDir, folders);
+}
+/** `readPointer`, for a reader that cannot wait: the registration readers, which the command locator calls. */
+function readPointerSync(dataDir, name) {
+	const { pointer } = launcherPaths(dataDir, name);
+	let text;
+	try {
+		text = readFileSync(pointer, "utf8");
+	} catch (error) {
+		if (error.code === "ENOENT") return void 0;
+		throw unreadable$1(pointer, error.code ?? String(error));
+	}
+	const folders = parsePointer(text, name);
+	if (folders === null) throw unreadable$1(pointer, `it does not name a runtime of ${name} in ${join(dataDir, RUNTIMES)}`);
+	return asPaths(dataDir, folders);
+}
+/** Whether the CLI a runtime holds for this launcher is a file that can be read: whether the launcher can start it. */
+async function launcherCanStart(runtimeDir, name) {
+	const cli = launcherCli(runtimeDir, name);
+	try {
+		if (!(await stat(cli)).isFile()) return false;
+		await access(cli, constants$1.R_OK);
+		return true;
+	} catch {
+		return false;
+	}
+}
+/** `launcherCanStart`, for a reader that cannot wait. */
+function launcherCanStartSync(runtimeDir, name) {
+	const cli = launcherCli(runtimeDir, name);
+	try {
+		if (!statSync(cli).isFile()) return false;
+		accessSync(cli, constants$1.R_OK);
+		return true;
+	} catch {
+		return false;
+	}
+}
+/** The folder of a runtime this launcher may be switched to, or why not. Nothing outside `<data>/runtime` is one. */
+async function switchableFolder(dataDir, name, runtimeDir) {
+	const folder = basename(runtimeDir);
+	if (!(resolve(dirname(runtimeDir)) === resolve(join(dataDir, RUNTIMES)) && isOwnFolder(folder, name))) throw new CommsError("CONFIG", `${runtimeDir} is not a runtime of ${name} in ${join(dataDir, RUNTIMES)}, so the launcher was not switched to it`);
+	if (!await launcherCanStart(runtimeDir, name)) throw new CommsError("CONFIG", `${runtimeDir} has no CLI to start at ${launcherCli(runtimeDir, name)}, so the launcher was not switched to it`, { hint: "Install that runtime again: a managed install or an update puts its CLI in place." });
+	return folder;
+}
+/** One change of a pointer at a time, across every process of this installation. */
+function withPointerLock(dataDir, name, change) {
+	return withFileLock(join(dataDir, LAUNCH, `${checkedName(name)}${LOCK}`), change, {
+		timeoutMs: 1e4,
+		staleMs: 3e4
+	});
+}
+/**
+* Points the launcher at `runtimeDir`, and returns the pointer it replaced (undefined when there was none).
+*
+* `switchPointer` without the answer; exported for an install or an update that may have to put it back
+* (`restorePointer`) and must know exactly what it was.
+*/
+async function exchangePointer(dataDir, name, runtimeDir) {
+	const folder = await switchableFolder(dataDir, name, runtimeDir);
+	return withPointerLock(dataDir, name, async () => {
+		const before = await readFolders(dataDir, name).catch(() => void 0);
+		if (before?.current === folder) return asPaths(dataDir, before);
+		await writeFileAtomic(launcherPaths(dataDir, name).pointer, pointerText(folder, before?.current));
+		return before === void 0 ? void 0 : asPaths(dataDir, before);
+	});
+}
+/**
+* Puts back the pointer a switch replaced (`exchangePointer`'s answer; undefined removes the pointer), only while the
+* pointer still names `expected` — what that switch pointed it at. Anything else means something switched it since,
+* and that newer pointer stays. Says whether it put it back.
+*/
+async function restorePointer(dataDir, name, before, expected) {
+	return withPointerLock(dataDir, name, async () => {
+		const now = await readFolders(dataDir, name).catch(() => void 0);
+		if (now === void 0 || now.current !== basename(expected)) return false;
+		const { pointer } = launcherPaths(dataDir, name);
+		if (before === void 0) await rm(pointer, { force: true });
+		else await writeFileAtomic(pointer, pointerText(basename(before.current), before.previous === void 0 ? void 0 : basename(before.previous)));
+		return true;
+	});
+}
+function posixWord$1(word) {
+	return `'${word.replaceAll("'", `'"'"'`)}'`;
+}
+/** The launcher for macOS and Linux: the shell's built-ins only, so nothing is looked for on PATH. */
+function posixSource(dataDir, name, node) {
+	const runtimes = join(dataDir, RUNTIMES);
+	const { pointer } = launcherPaths(dataDir, name);
+	const record = fallbackRecordPath(dataDir, name);
+	return `#!/bin/sh
+# The stable launcher of agent-communications for ${name}, format 1. Written by managed installs and updates; do not edit.
+# It starts the runtime the pointer beside it names, with the Node below. When that runtime's CLI is not there to
+# start, it starts the previous runtime instead, once, and records that beside the pointer. It never falls back from a
+# runtime that started, and never writes to stdout: an MCP client speaks there.
+node=${posixWord$1(node)}
+runtimes=${posixWord$1(runtimes)}
+pointer=${posixWord$1(pointer)}
+record=${posixWord$1(record)}
+cli=${posixWord$1(cliWords(name).join("/"))}
+suffix=${posixWord$1(`-${name}`)}
+${LAUNCHER_ENV}=${posixWord$1(name)}
+export ${LAUNCHER_ENV}
+current=
+previous=
+if [ -f "$pointer" ] && [ -r "$pointer" ]; then
+  while IFS= read -r line || [ -n "$line" ]; do
+    case $line in
+      current=*) [ -z "$current" ] && current=\${line#current=} ;;
+      previous=*) [ -z "$previous" ] && previous=\${line#previous=} ;;
+    esac
+  done < "$pointer"
+fi
+startable() {
+  case $1 in
+    ''|.*|*[!0-9A-Za-z.+_-]*) return 1 ;;
+  esac
+  case $1 in
+    *"$suffix") ;;
+    *) return 1 ;;
+  esac
+  [ "$1" != "$suffix" ] && [ -f "$runtimes/$1/$cli" ] && [ -r "$runtimes/$1/$cli" ]
+}
+if startable "$current"; then
+  exec "$node" "$runtimes/$current/$cli" "$@"
+fi
+if [ "$previous" != "$current" ] && startable "$previous"; then
+  { printf 'from=%s\\n' "$current"; printf 'to=%s\\n' "$previous"; } 2>/dev/null > "$record"
+  exec "$node" "$runtimes/$previous/$cli" "$@"
+fi
+printf '%s\\n' "agent-communications: the ${name} launcher has no runtime it can start: its pointer, $pointer, names \${current:-none}, and the runtime before it \${previous:-none}, and neither CLI is in $runtimes. A managed install or an update puts one in place." >&2
+exit 78
+`;
+}
+/**
+* The launcher for Windows: a CommonJS script Node runs — the registration starts the Node, and this is its first word —
+* which runs the runtime's CLI in the same process, so nothing re-parses the words and no second process is left behind
+* when the client stops the server. `argv[1]` is set to that CLI, as though Node had been started on it.
+*/
+function windowsSource(dataDir, name, node) {
+	const runtimes = join(dataDir, RUNTIMES);
+	const { pointer } = launcherPaths(dataDir, name);
+	const record = fallbackRecordPath(dataDir, name);
+	const json = JSON.stringify;
+	return `// The stable launcher of agent-communications for ${name}, format 1, for Windows. Written by managed installs and
+// updates; do not edit. Started by ${json(node)} with this file as its first word: it starts the runtime the pointer
+// beside it names, in this process. When that runtime's CLI is not there to start, it starts the previous runtime
+// instead, once, and records that beside the pointer. It never falls back from a runtime that started.
+'use strict';
+const fs = require('node:fs');
+const path = require('node:path');
+const { pathToFileURL } = require('node:url');
+const runtimes = ${json(runtimes)};
+const pointer = ${json(pointer)};
+const record = ${json(record)};
+const cli = ${json(cliWords(name))};
+const suffix = ${json(`-${name}`)};
+let current = '';
+let previous = '';
+try {
+  for (const line of fs.readFileSync(pointer, 'utf8').split(/\\r?\\n/)) {
+    if (line.startsWith('current=') && current === '') current = line.slice(8);
+    else if (line.startsWith('previous=') && previous === '') previous = line.slice(9);
+  }
+} catch {}
+function startable(folder) {
+  if (!/^[0-9A-Za-z][0-9A-Za-z.+_-]*$/.test(folder) || !folder.endsWith(suffix) || folder === suffix) return null;
+  const entry = path.join(runtimes, folder, ...cli);
+  try {
+    if (!fs.statSync(entry).isFile()) return null;
+    fs.accessSync(entry, fs.constants.R_OK);
+    return entry;
+  } catch {
+    return null;
+  }
+}
+let entry = startable(current);
+if (entry === null && previous !== current) {
+  entry = startable(previous);
+  if (entry !== null) {
+    try {
+      const temp = record + '.' + process.pid + '.tmp';
+      fs.writeFileSync(temp, 'from=' + current + '\\nto=' + previous + '\\n');
+      fs.renameSync(temp, record);
+    } catch {}
+  }
+}
+if (entry === null) {
+  process.stderr.write('agent-communications: the ' + ${json(name)} + ' launcher has no runtime it can start: its pointer, ' + pointer + ', names ' + (current || 'none') + ', and the runtime before it ' + (previous || 'none') + ', and neither CLI is in ' + runtimes + '. A managed install or an update puts one in place.\\n');
+  process.exit(78);
+}
+process.argv[1] = entry;
+process.env.${LAUNCHER_ENV} = ${json(name)};
+import(pathToFileURL(entry).href).catch((error) => {
+  process.exitCode = 1;
+  console.error(error);
+});
+`;
+}
+/**
+* Writes the launcher `<data>/launch/<name>`: a temporary file, then a rename, so a launcher starting meanwhile runs
+* the old one or the new, whole. It starts the runtime its pointer names with `node` — given as the registration and
+* the shim name it, a link left a link (CUE-492) — and falls back once to `previous` when that runtime cannot start
+* (see the top of this module).
+*
+* POSIX: a shell script, executable by its owner alone. Windows (`platform`): a script for Node, with a `package.json`
+* beside it saying it is CommonJS, whatever a folder above the data directory says; the registration starts `node`.
+*/
+async function writeLauncher(dataDir, name, node, options = {}) {
+	const platform = options.platform ?? process.platform;
+	const { launcher } = launcherPaths(dataDir, name);
+	if (!(platform === "win32" ? win32.isAbsolute(node) : posix.isAbsolute(node))) throw new CommsError("CONFIG", `the launcher's Node has to be named by its full path, not ${JSON.stringify(node)}`);
+	const data = resolve(dataDir);
+	if (platform === "win32") {
+		await writeFileAtomic(join(dirname(launcher), "package.json"), `${JSON.stringify({ type: "commonjs" })}\n`);
+		await writeFileAtomic(launcher, windowsSource(data, name, node));
+		return;
+	}
+	await writeFileAtomic(launcher, posixSource(data, name, node), 448);
+}
+/** Whether the launcher file is there. */
+async function launcherExists(dataDir, name) {
+	try {
+		return (await stat(launcherPaths(dataDir, name).launcher)).isFile();
+	} catch {
+		return false;
+	}
+}
+/** The `--data-dir` a registration pins, in either form, before any `--`. */
+function dataDirPin(args) {
+	for (let index = 0; index < args.length; index += 1) {
+		const word = args[index];
+		if (word === "--") return void 0;
+		if (word === "--data-dir") return args[index + 1] === "--" ? void 0 : args[index + 1] || void 0;
+		if (word.startsWith("--data-dir=")) return word.slice(11) || void 0;
+	}
+}
+/** A path as words to compare: separators made one, a trailing one dropped, without case on Windows. */
+function comparable(path, platform) {
+	const plain = path.replaceAll("\\", "/").replace(/\/+/g, "/").replace(/\/$/, "");
+	return platform === "win32" ? plain.toLowerCase() : plain;
+}
+/**
+* The stable launcher a registered entry starts, read from its own words, or null when it starts none.
+*
+* Ours only when the launcher is in the very data directory the entry itself pins with `--data-dir` — the program on
+* POSIX, the first word after Node on Windows (`platform`) — named like one: a program called `launch/gmail` anywhere
+* else is somebody else's. Nothing is read from disk.
+*/
+function registeredLauncher(server, platform) {
+	const dataDir = dataDirPin(server.args);
+	if (dataDir === void 0) return null;
+	const directory = `${comparable(dataDir, platform)}/${LAUNCH}`;
+	for (const candidate of [server.command, server.args[0]]) {
+		if (candidate === void 0) continue;
+		const words = comparable(candidate, platform);
+		if (!words.startsWith(`${directory}/`)) continue;
+		const name = candidate.split(/[\\/]+/).at(-1) ?? "";
+		if (words !== `${directory}/${comparable(name, platform)}` || !NAME.test(name)) continue;
+		return {
+			dataDir,
+			name,
+			launcher: candidate
+		};
+	}
+	return null;
+}
+/**
+* The programs this package starts, named so that no folder it happens to be in can stand in for them.
+*
+* A bare name is looked up, and on Windows the lookup starts in the current folder: libuv tries it before `PATH`, and
+* so does every program that looks a name up with `SearchPath` or `CreateProcess`. The current folder is where a
+* command was run or a server was started — and, since a download asks where to save, one of the three places a
+* stranger's file may be saved into. A `reg.exe` or `rundll32.exe` saved there would then be what runs the next time
+* this package reads the registry or opens a browser. So a Windows program is named by its full path, under the Windows
+* folder, and every process started on Windows is told, by `NoDefaultCurrentDirectoryInExePath`, not to look in its
+* own current folder for the programs it starts in turn.
+*/
+/** An environment variable by name, whatever its case: Windows's are case-blind, an object passed in is not. */
+function envValue(env, name) {
+	const wanted = name.toLowerCase();
+	for (const [key, value] of Object.entries(env)) if (key.toLowerCase() === wanted && value) return value;
+}
+/**
+* The Windows folder: `%SystemRoot%` (or `%windir%`) when it names a folder on a drive, and `C:\Windows` otherwise.
+* A value that is not a drive's absolute path — relative, a share, a device path — is not taken: it would be looked up
+* against the current folder, or on another machine, which is what naming the program in full is to avoid.
+*/
+function windowsFolder(env = process.env) {
+	for (const name of ["SystemRoot", "windir"]) {
+		const value = envValue(env, name);
+		if (value !== void 0 && /^[A-Za-z]:[\\/]/.test(value)) return path.win32.resolve(value);
+	}
+	return "C:\\Windows";
+}
+/** A program of Windows's own by its full path: `%SystemRoot%\System32\<name>`, never a bare name to look up. */
+function windowsSystemProgram(name, env = process.env) {
+	return path.win32.join(windowsFolder(env), "System32", name);
+}
+/**
+* The environment a child process is started with: `env` as it is, and on Windows also
+* `NoDefaultCurrentDirectoryInExePath=1`, so that the child — `rundll32.exe`, a Node started again — never takes a
+* program from its current folder either. Elsewhere nothing is added: a Unix shell looks in the current folder only
+* when `PATH` says to.
+*/
+function childEnvironment(env = process.env, platform = process.platform) {
+	if (platform !== "win32") return env;
+	return {
+		...env,
+		NoDefaultCurrentDirectoryInExePath: "1"
+	};
+}
+/**
+* The directories of a search path that name a folder on their own: absolute, and on Windows on a drive. An empty
+* entry means the current folder to a Unix shell, and a relative one is read against it; either would make the program
+* found — and run — depend on where this was started, which is where a download may have saved a stranger's file.
+*/
+function absoluteSearchPath(entries, platform = process.platform) {
+	return entries.filter((entry) => platform === "win32" ? /^[A-Za-z]:[\\/]/.test(entry) : entry !== "" && path.posix.isAbsolute(entry));
+}
+/** This Node's real file, or its path as reported when that cannot be resolved. */
+function realFile(path) {
+	try {
+		return realpathSync(path);
+	} catch {
+		return path;
+	}
+}
+/** Two real paths are one file: compared without case on Windows, whose paths are. */
+function sameRealPath(a, b, platform) {
+	return platform === "win32" ? a.toLowerCase() === b.toLowerCase() : a === b;
+}
+/** The names `node` is found by in one folder of PATH, as a shell finds it: with each PATHEXT extension on Windows. */
+function nodeNames(env, platform) {
+	if (platform !== "win32") return ["node"];
+	return (env.PATHEXT ?? ".EXE;.CMD;.BAT").split(";").filter(Boolean).map((extension) => `node${extension.toLowerCase()}`);
+}
+/**
+* The path a command names this Node by: the first `node` on `env`'s PATH that is the same real file as
+* `process.execPath`, as PATH spells it; otherwise `process.execPath`. With no `env`, nothing is looked for.
+*
+* Read when a command is located, as everything else in it is (D6): a link removed or repointed later is what the
+* command then meets. Only absolute folders of PATH are read, as the registrations' own search reads them.
+*/
+function nodeProgram(env, platform = process.platform) {
+	const own = process.execPath;
+	if (env === void 0) return own;
+	const real = realFile(own);
+	const search = env.PATH ?? env.Path ?? "";
+	for (const directory of absoluteSearchPath(search.split(delimiter), platform)) for (const name of nodeNames(env, platform)) {
+		const candidate = join(directory, name);
+		try {
+			if (!statSync(candidate).isFile()) continue;
+			accessSync(candidate, constants$1.X_OK);
+			if (!sameRealPath(realpathSync(candidate), real, platform)) continue;
+			return sameRealPath(candidate, own, platform) ? own : candidate;
+		} catch {}
+	}
+	return own;
+}
 const RECEIPT_VERSION = 1;
 const RECEIPT_FILE = "managed-shims.json";
 const MUTATION_LOCK_FILE = "managed-shims.lock";
 const POSIX_SHIM_MODE = 493;
 const WINDOWS_SHIM_NOTICE = "Managed CLI shims are not offered on Windows yet because cmd.exe re-parses arguments forwarded through .cmd files, including shell metacharacters. Use the full-path command or the labelled PowerShell & line the result provides.";
-function platformOf(context) {
+function platformOf$1(context) {
 	return context.platform ?? process.platform;
 }
 /** Why the selected platform has no managed shim in this release. */
 function managedShimUnsupportedNotice(context = {}) {
-	return platformOf(context) === "win32" ? WINDOWS_SHIM_NOTICE : "Managed CLI shims are offered only on macOS and Linux in this release. Use the full-path command the result provides.";
+	return platformOf$1(context) === "win32" ? WINDOWS_SHIM_NOTICE : "Managed CLI shims are offered only on macOS and Linux in this release. Use the full-path command the result provides.";
 }
 /** The per-user directory managed installs put their command shims in. */
 function managedShimDirectory(context) {
@@ -2987,7 +3671,7 @@ function managedShimDirectory(context) {
 }
 /** Managed CLI shims are POSIX-only until Windows has an argument-forwarding form that does not re-parse input. */
 function managedShimsSupported(context = {}) {
-	const platform = platformOf(context);
+	const platform = platformOf$1(context);
 	return platform === "darwin" || platform === "linux";
 }
 /** A managed shim's name: one plain command word, never a path, so joining it to the directory stays inside it. */
@@ -3171,7 +3855,7 @@ function normalPath(path, platform) {
 	return platform === "win32" ? trimmed.toLowerCase() : trimmed;
 }
 function directoryOnPath(context, directory) {
-	const platform = platformOf(context);
+	const platform = platformOf$1(context);
 	const value = context.env.PATH ?? context.env.Path ?? "";
 	const separator = platform === "win32" ? ";" : ":";
 	return value.split(separator).filter(Boolean).some((part) => normalPath(part, platform) === normalPath(directory, platform));
@@ -3305,59 +3989,6 @@ async function removeManagedShimsForRuntimes(context, runtimes, options = {}) {
 		};
 	});
 }
-/**
-* The programs this package starts, named so that no folder it happens to be in can stand in for them.
-*
-* A bare name is looked up, and on Windows the lookup starts in the current folder: libuv tries it before `PATH`, and
-* so does every program that looks a name up with `SearchPath` or `CreateProcess`. The current folder is where a
-* command was run or a server was started — and, since a download asks where to save, one of the three places a
-* stranger's file may be saved into. A `reg.exe` or `rundll32.exe` saved there would then be what runs the next time
-* this package reads the registry or opens a browser. So a Windows program is named by its full path, under the Windows
-* folder, and every process started on Windows is told, by `NoDefaultCurrentDirectoryInExePath`, not to look in its
-* own current folder for the programs it starts in turn.
-*/
-/** An environment variable by name, whatever its case: Windows's are case-blind, an object passed in is not. */
-function envValue(env, name) {
-	const wanted = name.toLowerCase();
-	for (const [key, value] of Object.entries(env)) if (key.toLowerCase() === wanted && value) return value;
-}
-/**
-* The Windows folder: `%SystemRoot%` (or `%windir%`) when it names a folder on a drive, and `C:\Windows` otherwise.
-* A value that is not a drive's absolute path — relative, a share, a device path — is not taken: it would be looked up
-* against the current folder, or on another machine, which is what naming the program in full is to avoid.
-*/
-function windowsFolder(env = process.env) {
-	for (const name of ["SystemRoot", "windir"]) {
-		const value = envValue(env, name);
-		if (value !== void 0 && /^[A-Za-z]:[\\/]/.test(value)) return path.win32.resolve(value);
-	}
-	return "C:\\Windows";
-}
-/** A program of Windows's own by its full path: `%SystemRoot%\System32\<name>`, never a bare name to look up. */
-function windowsSystemProgram(name, env = process.env) {
-	return path.win32.join(windowsFolder(env), "System32", name);
-}
-/**
-* The environment a child process is started with: `env` as it is, and on Windows also
-* `NoDefaultCurrentDirectoryInExePath=1`, so that the child — `rundll32.exe`, a Node started again — never takes a
-* program from its current folder either. Elsewhere nothing is added: a Unix shell looks in the current folder only
-* when `PATH` says to.
-*/
-function childEnvironment(env = process.env, platform = process.platform) {
-	if (platform !== "win32") return env;
-	return {
-		...env,
-		NoDefaultCurrentDirectoryInExePath: "1"
-	};
-}
-/**
-* The directories of a search path that name a folder on their own: absolute, and on Windows on a drive. An empty
-* entry means the current folder to a Unix shell, and a relative one is read against it; either would make the program
-* found — and run — depend on where this was started, which is where a download may have saved a stranger's file.
-*/
-function absoluteSearchPath(entries, platform = process.platform) {
-	return entries.filter((entry) => platform === "win32" ? /^[A-Za-z]:[\\/]/.test(entry) : entry !== "" && path.posix.isAbsolute(entry));
-}
 /** The install options that pin a server to one account: the generic one, and Gmail's and Slack's own names. */
 const PIN_OPTIONS = Object.freeze([
 	"account",
@@ -3539,6 +4170,8 @@ function pinnedVersion(argument, product, platform) {
 */
 function isProductServer(server, product, platform) {
 	const fold = platform === "win32" ? (text) => text.toLowerCase() : (text) => text;
+	const stable = registeredLauncher(server, platform);
+	if (stable !== null) return fold(stable.name) === fold(unscoped(product.packageName));
 	const launched = fold((server.command.split(/[\\/]+/).at(-1) ?? "").replace(/\.(?:cmd|exe|bat|ps1)$/i, ""));
 	if (launched && [product.binary, ...product.bins ?? []].map(fold).includes(launched)) return true;
 	if (server.packageName) {
@@ -3606,12 +4239,14 @@ async function installManagedRuntime(context, product, version) {
 		private: true
 	}, null, 2)}\n`);
 	const npmCli = await findNpmCli();
+	const prefix = await realpath(root);
 	await run(context.env, process.execPath, [
 		npmCli,
 		"install",
 		"--prefix",
-		root,
+		prefix,
 		"--save-exact",
+		"--ignore-scripts",
 		"--no-audit",
 		"--no-fund",
 		`${product.packageName}@${version}`
@@ -3700,40 +4335,49 @@ async function buildEntry(context, product, options, apply, resolved) {
 			runtimeMissing: false
 		};
 	}
+	const { dataDir } = context.core.paths;
+	const entry = {
+		...managedEntryShape(context, product, node, [
+			...pathArgs,
+			"mcp",
+			...serverArgs
+		]),
+		env
+	};
 	if (!apply) {
-		const { dataDir } = context.core.paths;
+		const name = launcherName(product.packageName);
 		const ready = await reusableRuntime(dataDir, product.packageName, product.version);
+		const pointer = await readPointer(dataDir, name).catch(() => void 0);
 		return {
-			entry: {
-				command: node,
-				args: [
-					ready ?? managedRuntimeEntry(dataDir, product.packageName, product.version),
-					...pathArgs,
-					"mcp",
-					...serverArgs
-				],
-				env
-			},
+			entry,
 			launcher,
-			runtimeMissing: ready === null
+			runtimeMissing: !(ready !== null && await launcherExists(dataDir, name) && pointer?.current === managedRuntimeDir(dataDir, product.packageName, product.version))
 		};
 	}
+	await installManagedRuntime(context, product, product.version);
 	return {
-		entry: {
-			command: node,
-			args: [
-				await installManagedRuntime(context, product, product.version),
-				...pathArgs,
-				"mcp",
-				...serverArgs
-			],
-			env
-		},
+		entry,
 		launcher,
 		runtimeMissing: false
 	};
 }
 /**
+* Points this product's stable launcher at the runtime of the release being installed — every registration of it on
+* this machine starts that from its next start — and writes the launcher afresh, with the Node the preview named.
+* Returns how to put the pointer back (`restorePointer`) if what comes after does not land.
+*/
+async function pointLauncher(context, product, node) {
+	const { dataDir } = context.core.paths;
+	const name = launcherName(product.packageName);
+	const runtime = managedRuntimeDir(dataDir, product.packageName, product.version);
+	await writeLauncher(dataDir, name, node, { platform: platformOf(context) });
+	return {
+		name,
+		runtime,
+		before: await exchangePointer(dataDir, name, runtime)
+	};
+}
+/**
 * The calling package's own CLI entry: `src/cli.ts` from source, `dist/cli.mjs` when bundled.
 *
 * `moduleUrl` comes from the product, not from this file. While this code lived inside the Gmail package,
@@ -4072,8 +4716,9 @@ async function preflightInstall(context, product, options) {
 		if (reported) previous = claimName(product, options, name, [reported], context.platform);
 	}
 	const { options: effective, kept } = keepNarrowing(product, options, previous);
-	const node = await resolveNode(context.env);
-	const command = (options.launcher ?? "managed") === "npx" ? await resolveNpx(context.env, node) : node;
+	const launcher = options.launcher ?? "managed";
+	const node = launcher === "managed" ? nodeProgram(context.env, platformOf(context)) : await resolveNode(context.env);
+	const command = launcher === "npx" ? await resolveNpx(context.env, node) : launcher === "managed" ? managedEntryShape(context, product, node, []).command : node;
 	return {
 		scan,
 		target,
@@ -4084,6 +4729,27 @@ async function preflightInstall(context, product, options) {
 		command
 	};
 }
+function platformOf(context) {
+	return context.platform ?? process.platform;
+}
+/** A product's stable launcher in this installation's data directory: `<data>/launch/<name>`. */
+function productLauncher(dataDir, product) {
+	return launcherPaths(dataDir, launcherName(product.packageName)).launcher;
+}
+/**
+* A managed entry: the stable launcher with `words`. On POSIX it is the program; on Windows Node is, with the launcher
+* as its first word, since a client starts no script there without a shell (see `launcher.ts`).
+*/
+function managedEntryShape(context, product, node, words) {
+	const launcher = productLauncher(context.core.paths.dataDir, product);
+	return platformOf(context) === "win32" ? {
+		command: node,
+		args: [launcher, ...words]
+	} : {
+		command: launcher,
+		args: [...words]
+	};
+}
 /**
 * The `npx` an npx entry starts, as a full path: from PATH, or beside the `node` found, where npm installs it.
 *
@@ -4237,109 +4903,116 @@ async function mcpInstall(context, product, options, planned) {
 	let method = "printed";
 	let applied = false;
 	let notApplied;
-	if (cliName && cliPath && writes) {
-		const codexEnv = (values) => Object.entries(values ?? {}).flatMap(([key, value]) => ["--env", `${key}=${value}`]);
-		const args = options.client === "claude-code" ? [
-			"mcp",
-			"add-json",
-			name,
-			JSON.stringify(entry),
-			"--scope",
-			"user"
-		] : [
-			"mcp",
-			"add",
-			name,
-			...codexEnv(entry.env),
-			"--",
-			entry.command,
-			...entry.args
-		];
-		const replacing = previous.find((server) => server.client === options.client);
-		if (replacing) {
-			const removal = options.client === "claude-code" ? [
+	const pointed = launcher === "managed" && apply ? await pointLauncher(context, product, preflight.node) : null;
+	const unpoint = async () => pointed !== null && await restorePointer(context.core.paths.dataDir, pointed.name, pointed.before, pointed.runtime).catch(() => false);
+	try {
+		if (cliName && cliPath && writes) {
+			const codexEnv = (values) => Object.entries(values ?? {}).flatMap(([key, value]) => ["--env", `${key}=${value}`]);
+			const args = options.client === "claude-code" ? [
 				"mcp",
-				"remove",
+				"add-json",
 				name,
+				JSON.stringify(entry),
 				"--scope",
 				"user"
 			] : [
 				"mcp",
-				"remove",
-				name
+				"add",
+				name,
+				...codexEnv(entry.env),
+				"--",
+				entry.command,
+				...entry.args
 			];
-			try {
-				await run(context.env, cliPath, removal);
-			} catch (error) {
-				const message = error instanceof CommsError ? error.message : String(error);
-				if (!/no (mcp )?server|not found|does not exist/i.test(message)) throw error;
-			}
-			try {
-				await run(context.env, cliPath, args);
-			} catch (error) {
-				const restore = options.client === "claude-code" ? [
+			const replacing = previous.find((server) => server.client === options.client);
+			if (replacing) {
+				const removal = options.client === "claude-code" ? [
 					"mcp",
-					"add-json",
+					"remove",
 					name,
-					JSON.stringify({
-						command: replacing.command,
-						args: replacing.args,
-						...replacing.env ? { env: replacing.env } : {}
-					}),
 					"--scope",
 					"user"
 				] : [
 					"mcp",
-					"add",
-					name,
-					...codexEnv(replacing.env),
-					"--",
-					replacing.command,
-					...replacing.args
+					"remove",
+					name
 				];
-				let restored = true;
 				try {
-					await run(context.env, cliPath, restore);
-				} catch {
-					restored = false;
+					await run(context.env, cliPath, removal);
+				} catch (error) {
+					const message = error instanceof CommsError ? error.message : String(error);
+					if (!/no (mcp )?server|not found|does not exist/i.test(message)) throw error;
+				}
+				try {
+					await run(context.env, cliPath, args);
+				} catch (error) {
+					const restore = options.client === "claude-code" ? [
+						"mcp",
+						"add-json",
+						name,
+						JSON.stringify({
+							command: replacing.command,
+							args: replacing.args,
+							...replacing.env ? { env: replacing.env } : {}
+						}),
+						"--scope",
+						"user"
+					] : [
+						"mcp",
+						"add",
+						name,
+						...codexEnv(replacing.env),
+						"--",
+						replacing.command,
+						...replacing.args
+					];
+					let restored = true;
+					try {
+						await run(context.env, cliPath, restore);
+					} catch {
+						restored = false;
+					}
+					if (restored) throw new CommsError("CONFIG", `could not register "${name}"; the previous entry was put back`, {
+						hint: "Check the client is not running, then try again.",
+						cause: error
+					});
+					throw refusedWithRemedy("CONFIG", `could not register "${name}", and the previous entry could not be put back either — ${cliName} now has no server called "${name}"`, {
+						binary: product.binary,
+						words: installWords(product, effective, name, []),
+						say: (command) => `Re-register it with ${command}. The old entry is in ${backupPath}.`
+					}, { cause: error });
 				}
-				if (restored) throw new CommsError("CONFIG", `could not register "${name}"; the previous entry was put back`, {
-					hint: "Check the client is not running, then try again.",
+			} else try {
+				await run(context.env, cliPath, args);
+			} catch (error) {
+				const message = error instanceof CommsError ? error.message : String(error);
+				if (/already exists/i.test(message)) throw new CommsError("CONFIG", `${cliName} already has an MCP server called "${name}", somewhere this could not read`, {
+					hint: `Look at it with ${clientCommandHint([
+						cliName,
+						"mcp",
+						"get",
+						name
+					], context.platform, `${cliName}'s own \`mcp get\`, for the entry called "${name}"`)}. If it is an older copy of this server, remove it with ${clientCommandHint([
+						cliName,
+						"mcp",
+						"remove",
+						name
+					], context.platform, `${cliName}'s own \`mcp remove\``)} and run this again; if not, choose another --name.`,
 					cause: error
 				});
-				throw refusedWithRemedy("CONFIG", `could not register "${name}", and the previous entry could not be put back either — ${cliName} now has no server called "${name}"`, {
-					binary: product.binary,
-					words: installWords(product, effective, name, []),
-					say: (command) => `Re-register it with ${command}. The old entry is in ${backupPath}.`
-				}, { cause: error });
+				throw error;
 			}
-		} else try {
-			await run(context.env, cliPath, args);
-		} catch (error) {
-			const message = error instanceof CommsError ? error.message : String(error);
-			if (/already exists/i.test(message)) throw new CommsError("CONFIG", `${cliName} already has an MCP server called "${name}", somewhere this could not read`, {
-				hint: `Look at it with ${clientCommandHint([
-					cliName,
-					"mcp",
-					"get",
-					name
-				], context.platform, `${cliName}'s own \`mcp get\`, for the entry called "${name}"`)}. If it is an older copy of this server, remove it with ${clientCommandHint([
-					cliName,
-					"mcp",
-					"remove",
-					name
-				], context.platform, `${cliName}'s own \`mcp remove\``)} and run this again; if not, choose another --name.`,
-				cause: error
-			});
-			throw error;
+			method = "cli";
+			applied = true;
+		} else if (cliName && apply) notApplied = `${cliName} was not found ${clientCliSearch(context.env)}, so nothing was registered`;
+		else if (configPath && writes) {
+			await mergeIntoJsonConfig(configPath, options.client, name, entry);
+			method = "file";
+			applied = true;
 		}
-		method = "cli";
-		applied = true;
-	} else if (cliName && apply) notApplied = `${cliName} was not found ${clientCliSearch(context.env)}, so nothing was registered`;
-	else if (configPath && writes) {
-		await mergeIntoJsonConfig(configPath, options.client, name, entry);
-		method = "file";
-		applied = true;
+	} catch (error) {
+		await unpoint();
+		throw error;
 	}
 	if (record && !applied) try {
 		await appendPrivateLine(ledger, JSON.stringify(record));
@@ -4351,12 +5024,13 @@ async function mcpInstall(context, product, options, planned) {
 	let verification = "skipped";
 	let verifyDetail;
 	if (!options.noVerify) {
-		if (runtimeMissing) verifyDetail = "the managed runtime is not installed, and --print installs nothing";
+		if (runtimeMissing) verifyDetail = "the stable launcher does not start this release's managed runtime yet, and --print installs nothing";
 		else {
 			const check = await verifyEntry(entry, product);
 			verified = check.ok;
 			verification = check.ok ? "passed" : "failed";
 			verifyDetail = check.detail;
+			if (!check.ok && pointed !== null && await unpoint()) verifyDetail = pointed.before === void 0 ? `${check.detail}; so the stable launcher's pointer was taken away again, as there was none before this install` : `${check.detail}; so the stable launcher was pointed back at ${pointed.before.current}, which it starts until this is fixed`;
 		}
 	}
 	return {
@@ -4595,11 +5269,25 @@ async function pruneManagedRuntimes(context, product, options = {}) {
 	const registered = scan.servers;
 	const known = new Set(knownClientConfigs(context.env).map((file) => file.path));
 	const mentions = (aliases, text) => aliases.some((alias) => text === alias || text.includes(`${alias}${sep}`) || text.includes(`${alias}/`));
+	const name = launcherName(product.packageName);
+	let pointer;
+	try {
+		pointer = await readPointer(context.core.paths.dataDir, name);
+	} catch {
+		const at = launcherPaths(context.core.paths.dataDir, name).pointer;
+		return refuse(`${at} could not be read, so none of these can be shown not to be what the stable launcher starts`);
+	}
+	const pointed = (aliases) => {
+		const named = (runtime) => runtime !== void 0 && aliases.some((alias) => resolve(alias) === resolve(runtime));
+		if (named(pointer?.current)) return "the stable launcher starts it";
+		if (named(pointer?.previous)) return "the stable launcher's previous runtime: what it falls back to, and what a rollback goes back to";
+		return null;
+	};
 	const current = managedRuntimeDir(context.core.paths.dataDir, product.packageName, product.version);
 	for (const { path, version, aliases } of candidates) {
 		const owner = registered.find((server) => [server.command, ...server.args].some((part) => mentions(aliases, part)));
 		const printed = options.includePrinted ? void 0 : handedOut.find((record) => !record.applied && mentions(aliases, record.runtime));
-		const reason = path === current ? "this release" : owner ? `registered with ${owner.client} as "${owner.name}"${known.has(owner.path) ? "" : ` in ${owner.path}`}` : printed ? `printed for ${printed.client} as "${printed.name}" on ${printed.at.slice(0, 10)}, and where that entry went cannot be read; once it is gone, \`mcp prune --include-printed\` removes this` : processes.some((line) => mentions(aliases, line)) ? "a running process uses it" : null;
+		const reason = path === current ? "this release" : pointed(aliases) ?? (owner ? `registered with ${owner.client} as "${owner.name}"${known.has(owner.path) ? "" : ` in ${owner.path}`}` : printed ? `printed for ${printed.client} as "${printed.name}" on ${printed.at.slice(0, 10)}, and where that entry went cannot be read; once it is gone, \`mcp prune --include-printed\` removes this` : processes.some((line) => mentions(aliases, line)) ? "a running process uses it" : null);
 		if (reason) {
 			result.kept.push({
 				path,
@@ -4945,62 +5633,6 @@ function connectMailboxWords() {
 */
 const CONVERSION_HOOKS = Symbol("agentcomms.configConversionHooks");
 /**
-* One table of dangerous characters, shared by the inbound sanitiser (which strips them from sender-controlled text)
-* and the preview renderer (which makes them visible), so the two can never disagree.
-*/
-/** Zero-width and formatting characters, bidi controls, variation selectors and Unicode tag characters. */
-const INVISIBLE_RANGES = [
-	[173, 173],
-	[847, 847],
-	[1564, 1564],
-	[4447, 4448],
-	[6068, 6069],
-	[6155, 6159],
-	[8203, 8207],
-	[8232, 8233],
-	[8234, 8238],
-	[8288, 8292],
-	[8294, 8303],
-	[12644, 12644],
-	[65024, 65039],
-	[65279, 65279],
-	[65440, 65440],
-	[917504, 917631]
-];
-function isInvisible(codePoint) {
-	for (const [from, to] of INVISIBLE_RANGES) if (codePoint >= from && codePoint <= to) return true;
-	return false;
-}
-/**
-* C0 controls except tab and newline (ESC, and so every ANSI/OSC sequence, starts here), DEL, and C1 controls (CSI
-* among them). A lone carriage return counts: it moves a terminal cursor back over text already printed.
-*/
-function isControl(codePoint) {
-	if (codePoint === 9 || codePoint === 10) return false;
-	return codePoint < 32 || codePoint === 127 || codePoint >= 128 && codePoint <= 159;
-}
-function isDangerous(codePoint) {
-	return isControl(codePoint) || isInvisible(codePoint);
-}
-/**
-* Strips control characters (ESC, CSI, OSC and the rest), DEL, lone carriage returns, zero-width, bidi-control and tag
-* characters from sender-controlled text; returns the text and how many were removed. CRLF becomes LF first.
-*
-* This lives beside the table rather than in the sanitiser because `neutralise` needs it too, and the two must not
-* drift: a pattern that looks for `</untrusted-content` cannot see it through a zero-width space, so stripping
-* has to happen before any such pattern runs, on every path, not only on the ones that render a body.
-*/
-function stripInvisible(text) {
-	let removed = 0;
-	let out = "";
-	for (const char of text.replace(/\r\n/g, "\n")) if (isDangerous(char.codePointAt(0) ?? 0)) removed += 1;
-	else out += char;
-	return {
-		text: out,
-		removed
-	};
-}
-/**
 * Whether a folder, as written, says where it is on its own: from the home (`~`), or absolute — and on Windows with its
 * drive (`C:\…`) or share (`\\server\share\…`). Windows calls `\outgoing` absolute, but it is on whichever drive is
 * current when it is read, and `C:outgoing` is relative to that drive's current folder; either would move with the
@@ -5151,6 +5783,19 @@ const READABLE_CONFIG_VERSIONS = [
 ];
 const ALIAS_PATTERN = /^[a-z0-9][a-z0-9-]{0,31}$/;
 const ALIAS_MESSAGE = "names must be 1–32 lowercase letters, digits or hyphens, starting with a letter or digit";
+/**
+* How this machine updates (design 2026-10-16, U2), from the most updating to the least: `auto` — the default — checks
+* daily and installs in the background once its job is set up; `every-14-days` checks at most once every 14 days and
+* installs only with the person's yes; `never` asks the registry nothing.
+*/
+const UPDATE_LEVELS = [
+	"auto",
+	"every-14-days",
+	"never"
+];
+function isUpdateLevel(value) {
+	return typeof value === "string" && UPDATE_LEVELS.includes(value);
+}
 /** Which naming a configuration's body has: 1 — plain words — or 2 — `organisation/platform`. */
 function namingOf(config) {
 	return config.version === 3 ? config.naming : config.version;
@@ -5261,7 +5906,8 @@ const defaultsSchema = looseObject({
 	downloadsDir: string().optional(),
 	timezone: string().default("system"),
 	confirm: looseObject({ elicitationClients: array(string()).default([]) }).default({ elicitationClients: [] }),
-	updateCheck: _enum(["on", "off"]).optional()
+	updateCheck: _enum(["on", "off"]).optional(),
+	updates: string().min(1).optional()
 });
 const RESERVED_ALIASES = /* @__PURE__ */ new Set(["all"]);
 /** Within one map, a reserved alias or a duplicate id is a hard error in every version. */
@@ -5335,6 +5981,10 @@ const slackAppRecordSchema = looseObject({
 	clientId: string().min(1),
 	appId: string().min(1).optional()
 });
+const agentAppRecordSchema = looseObject({
+	appId: string().min(1),
+	sha256: string().min(1)
+});
 const organisationRecordSchema = looseObject({
 	label: string(),
 	source: looseObject({
@@ -5355,8 +6005,14 @@ const organisationRecordSchema = looseObject({
 		redirectPort: number().int().min(1).max(65535),
 		apps: looseObject({
 			read: slackAppRecordSchema.optional(),
-			send: slackAppRecordSchema.optional()
+			send: slackAppRecordSchema.optional(),
+			agent: agentAppRecordSchema.optional()
 		}).default({})
+	}).optional(),
+	updates: looseObject({
+		max: string().min(1).optional(),
+		background: boolean().optional(),
+		sha256: string().min(1)
 	}).optional()
 });
 const formerNameSchema = looseObject({
@@ -5538,10 +6194,30 @@ function governingChangePolicy(config, change) {
 	};
 	return [byId(change.target?.id), ...change.loosened.map((loosening) => byId(loosening.id))].includes("confirm") ? "confirm" : "chat";
 }
-/** Whether this machine's daily update check is on: `defaults.updateCheck`, absent reading as `on`. */
+/** 0.18's switch, as written: `defaults.updateCheck`, absent reading as `on`. */
 function updateCheckSetting(config) {
 	return config.defaults.updateCheck ?? "on";
 }
+/**
+* The level this machine's configuration sets (design 2026-10-16, U2): `defaults.updates`, else 0.18's switch read as a
+* level — `on` as `auto`, `off` as `never`. A word this release does not know reads as `auto`, the default.
+*/
+function updateLevelOf(config) {
+	const set = config.defaults.updates;
+	if (set !== void 0) return isUpdateLevel(set) ? set : "auto";
+	return updateCheckSetting(config) === "off" ? "never" : "auto";
+}
+/**
+* How much a level updates, for `classifyChange`: `auto` 2, `every-14-days` 1, `never` 0. A word this release does not
+* know is judged as the most updating on the side it leaves and the least on the side it arrives on, as an account's
+* mode is — an unknown word can cost a person a question, never skip one.
+*/
+function updateRank(config, side) {
+	const set = config.defaults.updates;
+	const level = set === void 0 ? updateLevelOf(config) : isUpdateLevel(set) ? set : null;
+	if (level === null) return side === "before" ? UPDATE_LEVELS.length - 1 : 0;
+	return UPDATE_LEVELS.length - 1 - UPDATE_LEVELS.indexOf(level);
+}
 /** `naming` is the body's: 2 for `organisation/platform` names (version 2, or version 3 over it), 1 for plain ones. */
 function describeIssues(error, naming) {
 	return error.issues.slice(0, 5).map((issue) => {
@@ -6098,7 +6774,8 @@ function classifyChange(before, after) {
 	if (POLICY_RANK$1[a.sendPolicy] < POLICY_RANK$1[b.sendPolicy]) loosen("defaults.sendPolicy", b.sendPolicy, a.sendPolicy);
 	if (POLICY_RANK$1[defaultChangePolicy(after)] < POLICY_RANK$1[defaultChangePolicy(before)]) loosen("defaults.changePolicy", defaultChangePolicy(before), defaultChangePolicy(after));
 	if (b.riskEscalation && !a.riskEscalation) loosen("defaults.riskEscalation", b.riskEscalation, a.riskEscalation);
-	if (updateCheckSetting(before) === "on" && updateCheckSetting(after) === "off") loosen("defaults.updateCheck", updateCheckSetting(before), updateCheckSetting(after));
+	if (!(b.updates !== void 0 && b.updates === a.updates) && updateRank(after, "after") < updateRank(before, "before")) loosen("defaults.updates", before.defaults.updates ?? updateLevelOf(before), after.defaults.updates ?? updateLevelOf(after));
+	else if (updateCheckSetting(before) === "on" && updateCheckSetting(after) === "off") loosen("defaults.updateCheck", updateCheckSetting(before), updateCheckSetting(after));
 	if (a.sendCaps.perHour > b.sendCaps.perHour || a.sendCaps.perDay > b.sendCaps.perDay) loosen("defaults.sendCaps", b.sendCaps, a.sendCaps);
 	const roots = (list) => new Set(list.map((path) => comparablePath(resolve(expandHome(path, homedir())))));
 	const readRoots = (list) => roots(list.filter((root) => namesItsPlace(root)));
@@ -6114,11 +6791,43 @@ function classifyChange(before, after) {
 	if (before.secrets === void 0 && after.secrets !== void 0 && after.secrets.store !== "keychain") {
 		if (holdsSecrets(before)) loosen("secrets.store", secretsStoreOf(before), after.secrets.store);
 	}
+	for (const loosening of classifyAgentLabelChange(agentLabelOf(before), agentLabelOf(after))) loosen(loosening.path, labelSettingValue(loosening, loosening.was), labelSettingValue(loosening, loosening.now));
 	return {
 		loosened: changes.map((change) => change.path),
 		changes
 	};
 }
+/**
+* One label rule in words, as a preview lists it: `acme/slack in C0ACME for post/reply: me`. No comma inside, since a
+* preview joins a list of them with commas.
+*/
+function agentLabelRuleText(rule) {
+	const where = rule.conversation === void 0 ? "" : ` in ${rule.conversation}`;
+	const kinds = rule.kinds === void 0 ? "" : ` for ${rule.kinds.join("/")}`;
+	return `${rule.account}${where}${kinds}: ${rule.as}`;
+}
+/**
+* A label setting's value as a loosening carries it: the rules in words, the icons and the Slack styles as they are, the
+* rest as text.
+*/
+function labelSettingValue(loosening, value) {
+	if (value === void 0 || value === null) return void 0;
+	if (loosening.path === "agentLabel.rules") return value.map(agentLabelRuleText);
+	if (loosening.path === "agentLabel.slackIcons" || loosening.path === "agentLabel.slackStyles") return { ...value };
+	return String(value);
+}
+/** The label settings a change can write, as the file holds them — raw, as `changedSettings` records every setting. */
+const LABEL_SETTINGS = [
+	"word",
+	"name",
+	"rules",
+	"slackIcons",
+	"slackStyles"
+];
+function storedAgentLabel(config) {
+	const stored = config.agentLabel;
+	return typeof stored === "object" && stored !== null && !Array.isArray(stored) ? stored : {};
+}
 /** The settings of a mailbox, and of an account, that a change can write — the ones the classifier judges. */
 const INBOX_SETTINGS = [
 	"sendPolicy",
@@ -6132,7 +6841,7 @@ const ACCOUNT_SETTINGS = [
 ];
 /**
 * Every setting that differs between `before` and `after`, loosened or tightened: the defaults, the secret store,
-* and each mailbox's and account's own settings — including those of one added or removed.
+* the agent label's settings, and each mailbox's and account's own settings — including those of one added or removed.
 *
 * What a change approval binds, beside its loosenings. A preview shows the whole change — "sends approved by never;
 * changes approved by chat" — and binding only the loosenings let a claim drop the tightening a person read, since
@@ -6170,6 +6879,9 @@ function changedSettings(before, after) {
 	const defaultsAfter = after.defaults;
 	for (const key of [.../* @__PURE__ */ new Set([...Object.keys(defaultsBefore), ...Object.keys(defaultsAfter)])].sort()) record(`defaults.${key}`, defaultsBefore[key], defaultsAfter[key]);
 	record("secrets.store", before.secrets?.store, after.secrets?.store);
+	const labelBefore = storedAgentLabel(before);
+	const labelAfter = storedAgentLabel(after);
+	for (const key of LABEL_SETTINGS) record(`agentLabel.${key}`, labelBefore[key], labelAfter[key]);
 	return changes;
 }
 /**
@@ -6973,11 +7685,15 @@ var ApprovalStore = class {
 	#now;
 	#handoffs;
 	#loadConfig;
+	/** `ApprovalStoreOptions.answered`, never throwing. */
+	answered;
 	constructor(stateDir, options = {}) {
 		this.directory = join(stateDir, "approvals");
 		this.#handoffs = options.handoffs;
 		this.#now = options.now ?? (() => /* @__PURE__ */ new Date());
 		this.#loadConfig = options.loadConfig;
+		const answered = options.answered;
+		this.answered = answered === void 0 ? void 0 : (approvalId) => answered(approvalId).catch(() => void 0);
 		registerStoreInternals(this, {
 			directory: this.directory,
 			now: () => this.#now(),
@@ -7566,6 +8282,7 @@ var ApprovalStore = class {
 		}, { usedSaid: options.usedSaid });
 		const failed = failure;
 		if (failed) throw refusedAfter(refusalFor(done.record)(failed.code, failed.reason, done.record), done);
+		if (kind === "send" && done.record.state === "approved") await this.answered?.(approvalId);
 		return done.record;
 	}
 	/**
@@ -7615,6 +8332,7 @@ var ApprovalStore = class {
 		if (failed) throw refusedAfter(refuse(failed.code, failed.reason, done.record), done);
 		const claimToken = randomBytes(16).toString("hex");
 		await this.#markClaimed(done, claimToken);
+		await this.answered?.(approvalId);
 		return {
 			record: done.record,
 			claimToken,
@@ -9248,6 +9966,7 @@ function registrationFactsOf({ packageName, manifest }) {
 /** How a registered entry starts its server: the launcher `mcp install` wrote it with, or `other` for one it did not. */
 function launcherOf(server, facts, platform) {
 	const fold = folding(platform);
+	if (stableLauncherOf(server, facts, platform) !== null) return "managed";
 	const parts = [server.command, ...server.args];
 	if (parts.some((part) => managedRuntimeVersion(part, facts.packageName, platform) !== null)) return "managed";
 	if (server.args.some((arg) => fold(arg).startsWith(fold(`${facts.npxPackage}@`)))) return "npx";
@@ -9255,10 +9974,49 @@ function launcherOf(server, facts, platform) {
 	if (parts.some((part) => local.test(part))) return "local";
 	return "other";
 }
-/** The version an entry pins — a managed runtime's or an npx spec's — or null for one that pins none. */
+/**
+* The version an entry pins — a managed runtime's or an npx spec's — or null for one that pins none.
+*
+* An entry that starts the stable launcher names no version: it runs the release its launcher's pointer names, read
+* here — null when the pointer is not there, cannot be read, or names a folder that is not a release.
+*/
 function registrationVersion(server, facts, platform) {
+	const stable = stableLauncherOf({
+		command: server.command ?? "",
+		args: server.args
+	}, facts, platform);
+	if (stable !== null) {
+		const current = pointedRuntime(stable.dataDir, stable.name);
+		return current === null ? null : launcherRuntimeVersion(current, stable.name);
+	}
 	return server.args.map((arg) => pinnedVersion(arg, facts, platform)).find((found) => found !== null) ?? null;
 }
+/**
+* The stable launcher of this product an entry starts, in the data directory the entry pins, or null: see
+* `registeredLauncher`. Another product's launcher is not this one's.
+*/
+function stableLauncherOf(server, facts, platform) {
+	const stable = registeredLauncher(server, platform);
+	if (stable === null) return null;
+	let own;
+	try {
+		own = launcherName(facts.packageName);
+	} catch {
+		return null;
+	}
+	return folding(platform)(stable.name) === folding(platform)(own) ? {
+		...stable,
+		name: own
+	} : null;
+}
+/** The runtime a launcher's pointer names as current, or null when it has none that can be read. */
+function pointedRuntime(dataDir, name) {
+	try {
+		return readPointerSync(dataDir, name)?.current ?? null;
+	} catch {
+		return null;
+	}
+}
 PATH_OPTIONS.filter(({ key }) => key !== "downloadsDir");
 /**
 * Whether an entry starts this product, judged on its own words: the suite's path options and their values are taken
@@ -9266,6 +10024,7 @@ PATH_OPTIONS.filter(({ key }) => key !== "downloadsDir");
 * A folder pinned as `/tmp/@agentcomms/slack` never makes a Gmail registration Slack's.
 */
 function startsProduct(server, facts, platform) {
+	if (registeredLauncher(server, platform) !== null) return stableLauncherOf(server, facts, platform) !== null;
 	const { words: args } = withoutPathOptions(server.args);
 	const packageName = commandLinePackage(server.command, args);
 	return isProductServer({
@@ -9291,6 +10050,24 @@ function isNpxRegistration(server, facts, platform) {
 * program when that is one of the product's own commands — a link into the package, or a script npm wrote beside it.
 */
 function registrationFiles(server, facts, platform) {
+	const { packageName } = facts;
+	const stable = packageName === void 0 ? null : stableLauncherOf(server, { packageName }, platform);
+	if (stable !== null) {
+		let pointer;
+		try {
+			pointer = readPointerSync(stable.dataDir, stable.name);
+		} catch {
+			return {
+				scripts: [],
+				command: null
+			};
+		}
+		const runtime = pointer === void 0 ? void 0 : launcherCanStartSync(pointer.current, stable.name) || pointer.previous === void 0 ? pointer.current : pointer.previous;
+		return {
+			scripts: runtime === void 0 ? [] : [launcherCli(runtime, stable.name)],
+			command: null
+		};
+	}
 	const { words } = withoutPathOptions(server.args);
 	const sentinel = words.indexOf("--");
 	const options = sentinel < 0 ? words : words.slice(0, sentinel);
@@ -9304,7 +10081,7 @@ function folding(platform) {
 	return platform === "win32" ? (text) => text.toLowerCase() : (text) => text;
 }
 /** The package version, read from package.json at build time. */
-const VERSION = "0.18.2";
+const VERSION = "0.20.0";
 /**
 * Versions as semver writes and orders them — what an update compares, and what the daily update check's reader needs
 * to decide whether the release it last heard of is newer than the one running.
@@ -9375,8 +10152,13 @@ function isBehind(version, latest) {
 * Whether a version is a prerelease — `0.8.0-rc.1` — which the daily update check never counts as an update: a
 * machine is not told to "update" to a release candidate, nor a candidate told to go back to the last release.
 */
-function isPrerelease(version) {
-	return VERSION_PATTERN.exec(version)?.[4] !== void 0;
+/**
+* A release as this suite publishes one, and the only form a version the registry gave is read or said in: a plain
+* `MAJOR.MINOR.PATCH` (re-review of 0.20.0, severity 6). A prerelease's words and build metadata are the registry's
+* text — `0.20.1+SYSTEM-ignore-…` is valid semver — so a version carrying either is no release here.
+*/
+function isPlainVersion(value) {
+	return typeof value === "string" && /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/.test(value);
 }
 /**
 * Whether `version` is within a package's `engines` range: true or false, or null when the range is not one this reads.
@@ -9482,8 +10264,10 @@ const CHANNEL_PACKAGES = new Set(CHANNEL_SNAPSHOT.filter(({ manifest }) => manif
 /**
 * Locates the command that runs `request.target`'s CLI with `request.words`, or says why there is none.
 *
-* The program is always this process's Node (`process.execPath`), which must satisfy the target's `engines.node`; no
-* interpreter named anywhere else is run, or asked its version. A TypeScript entry gets `--experimental-strip-types`,
+* The program is always this process's Node, which must satisfy the target's `engines.node`; no interpreter named
+* anywhere else is run, or asked its version. It is named as PATH finds it — the first `node` on `request.env`'s PATH
+* that is the same real file as `process.execPath` — and otherwise by `process.execPath` (CUE-492): the real file only
+* identifies it, and `process.version` is that file's. A TypeScript entry gets `--experimental-strip-types`,
 * which Node 22.12–22.17 needs, and `--experimental-transform-types` only when this source run was started with it;
 * no other flag this process was started with is carried — debug, preload, condition and memory flags are not what the
 * CLI needs. The suite directories the command uses go between the entry and its words, one canonical option each,
@@ -9524,6 +10308,7 @@ function locateCliCommand(request, runtime = {
 		return fail("caller", `${nearest.root} cannot be resolved`);
 	}
 	if (!isAbsolute(process.execPath)) return fail("interpreter", `this Node, ${process.execPath}, is not a full path`);
+	const program = nodeProgram(request.env);
 	const pins = {};
 	for (const key of request.uses) pins[key] = request.paths[key];
 	let words;
@@ -9532,7 +10317,7 @@ function locateCliCommand(request, runtime = {
 	} catch (error) {
 		return fail("arguments", error instanceof Error ? error.message : String(error));
 	}
-	const build = (found) => buildCommand(target, found, words, runtime, callerSource, platform);
+	const build = (found) => buildCommand(target, found, words, runtime, callerSource, platform, program);
 	const located = (built, found, direction) => Object.freeze({
 		ok: true,
 		command: built.command,
@@ -9672,7 +10457,7 @@ function locateCliCommand(request, runtime = {
 * Checks what was found and makes its command: the target's Node range against this Node, then the entry — the source
 * CLI or the manifest's bin for the command it declares — as a readable file inside its package.
 */
-function buildCommand(target, found, words, runtime, callerSource, platform) {
+function buildCommand(target, found, words, runtime, callerSource, platform, program) {
 	const engines = found.manifest.engines;
 	const range = typeof engines === "object" && engines !== null ? engines.node : void 0;
 	if (typeof range !== "string") return {
@@ -9709,7 +10494,7 @@ function buildCommand(target, found, words, runtime, callerSource, platform) {
 	return {
 		ok: true,
 		command: new PrintedCommand(GATE, [
-			process.execPath,
+			program,
 			...flags,
 			checked.path,
 			...words
@@ -10013,7 +10798,8 @@ function cliHandoffs(options) {
 			uses: usesOf(use),
 			paths,
 			platform,
-			...registrations === void 0 ? {} : { registrations }
+			...registrations === void 0 ? {} : { registrations },
+			...options.env === void 0 ? {} : { env: options.env }
 		}, ...options.runtime === void 0 ? [] : [options.runtime]);
 		return result.ok ? result.command : result;
 	};
@@ -10546,7 +11332,13 @@ const SETTING_LABELS = {
 	"defaults.downloadsDir": "downloads folder",
 	"defaults.confirm.elicitationClients": "clients trusted to ask for a send approval",
 	"defaults.updateCheck": "daily update check",
-	"secrets.store": "where credentials are kept"
+	"defaults.updates": "how this machine updates",
+	"secrets.store": "where credentials are kept",
+	"agentLabel.word": "the word after your name in the agent label",
+	"agentLabel.name": "the name in the agent label",
+	"agentLabel.rules": "who each kind of message appears to come from",
+	"agentLabel.slackIcons": "the icon of the agent’s Slack posts",
+	"agentLabel.slackStyles": "how the agent’s Slack messages look"
 };
 /**
 * What the loosening means for the person, in their terms.
@@ -10569,8 +11361,14 @@ function meaning(field, after, scope) {
 		case "defaults.attachDeny": return "files the removed entries protected can be attached";
 		case "defaults.downloadsDir": return "files from other people will be saved here";
 		case "defaults.confirm.elicitationClients": return "these clients may ask you to approve a send in their own window";
-		case "defaults.updateCheck": return "nothing on this machine will ask npm for a newer release, or stop until one is installed";
+		case "defaults.updateCheck": return "a release before 0.20 on this machine will no longer ask npm for a newer release";
+		case "defaults.updates": return after === "every-14-days" ? "this machine will ask npm for a newer release at most once every 14 days, say one is out at most once every 14 days, and install nothing in the background" : after === "never" ? "nothing on this machine will ask npm for a newer release, say one is out, or install one" : "this release cannot tell how that level updates, so it counts as updating least";
 		case "secrets.store": return "credentials will move out of the system keychain into files on this disk";
+		case "agentLabel.word": return "what an agent sends will carry this word after your name";
+		case "agentLabel.name": return after === null ? "where a channel has no name of its own for you, an agent’s message will be refused until a name is set" : "where a channel has no name of its own for you, what an agent sends will carry this name";
+		case "agentLabel.rules": return "what a rule sends as `me` goes out as you, with no label: it will look as if you wrote it yourself";
+		case "agentLabel.slackIcons": return "the app’s Slack posts will show this icon beside your name";
+		case "agentLabel.slackStyles": return "every agent message there goes out as you, labelled in its words, even where the app could post: it trades Slack’s own APP tag, which no one can fake, for words in the message";
 		default: return "";
 	}
 }
@@ -10712,7 +11510,7 @@ async function gatedChangeAtTerminal(core, change, options) {
 		if ((await approveChangeAtTerminal(core, prepared.approvalId, options.env, options.output, streams)).state !== "approved") throw cancelled();
 	} else if (options.answered !== true) {
 		streams.stdout.write(`${prepared.preview}\n\n`);
-		if ((await askLine$1(streams, `Type ${paint(options.output.color, "bold", "yes")} to apply this change: `)).trim().toLowerCase() !== "yes") {
+		if ((await askLine(streams, `Type ${paint(options.output.color, "bold", "yes")} to apply this change: `)).trim().toLowerCase() !== "yes") {
 			await revokeChange(core, prepared.approvalId, "cancelled at the terminal", {
 				surface: "cli",
 				disposition: "person"
@@ -10777,7 +11575,7 @@ async function approveChangeAtTerminal(core, approvalId, env, output, streams =
 	}
 	const prompt = await beginChangeApproval(core, approvalId, { surface: "cli" });
 	streams.stdout.write(`${prompt.preview}\n\n`);
-	const answer = await askLine$1(streams, `Type ${paint(output.color, "bold", prompt.challenge)} to approve this change, or press Enter to cancel: `);
+	const answer = await askLine(streams, `Type ${paint(output.color, "bold", prompt.challenge)} to approve this change, or press Enter to cancel: `);
 	if (!answer.trim()) {
 		await revokeChange(core, approvalId, "cancelled at the terminal", {
 			surface: "cli",
@@ -10797,7 +11595,7 @@ async function approveChangeAtTerminal(core, approvalId, env, output, streams =
 function cancelled() {
 	return new CommsError("USAGE", "cancelled: nothing was changed");
 }
-async function askLine$1(streams, question) {
+async function askLine(streams, question) {
 	const { createInterface } = await import("node:readline/promises");
 	const rl = createInterface({
 		input: streams.stdin,
@@ -11163,80 +11961,6 @@ var InboxStateStore = class {
 		});
 	}
 };
-function openCore(options = {}) {
-	const { paths, pathOverrides } = resolvePathIdentity(options);
-	const now = options.now ?? (() => /* @__PURE__ */ new Date());
-	const handoffs = options.caller === void 0 ? void 0 : cliHandoffs({
-		caller: options.caller,
-		paths,
-		platform: options.platform,
-		env: options.env
-	});
-	const config = new ConfigStore(paths.configDir, { handoffs });
-	const audit = new AuditLog(paths.stateDir, now);
-	let cached = null;
-	return {
-		paths,
-		pathOverrides,
-		config,
-		states: new InboxStateStore(paths.stateDir),
-		approvals: new ApprovalStore(paths.stateDir, {
-			now,
-			handoffs,
-			loadConfig: () => config.load(),
-			audit
-		}),
-		ledger: new SendLedger(paths.stateDir, now),
-		plans: new PlanStore(paths.stateDir, now),
-		taint: new TaintStore(paths.stateDir, now),
-		audit,
-		handoffs,
-		async secrets(kind) {
-			const chosen = kind ?? secretsStoreOf(await config.load());
-			if (cached?.kind === chosen) return cached.store;
-			const store = await openSecretStore(chosen, {
-				secretsDir: paths.secretsDir,
-				namespace: keychainNamespace(paths.configDir),
-				handoffs
-			});
-			cached = {
-				kind: chosen,
-				store
-			};
-			return store;
-		}
-	};
-}
-/**
-* A whole number as it was given: a string of digits and nothing else (surrounding spaces aside), or a number that is
-* whole — and `NaN` for anything else.
-*
-* `Number.parseInt` read `abc` as NaN, `12abc` as 12 and `1e2` as 1; `Number` reads `1e2` as 100, `0x10` as 16 and an
-* empty string as 0. Each of those is a number nobody typed, so none of them is read as one here. A value too large to
-* hold exactly is not one either: it would be used as some other number.
-*/
-function readWholeNumber(raw) {
-	const value = typeof raw === "number" ? raw : typeof raw === "string" && /^[0-9]+$/.test(raw.trim()) ? Number(raw.trim()) : NaN;
-	return Number.isSafeInteger(value) ? value : NaN;
-}
-/**
-* A number option, checked rather than coerced: the number, `undefined` when none was given, or a USAGE refusal that
-* names the option and its range.
-*
-* One check for every command line's number options — `agentcomms`, `agent-gmail` and `agent-slack` — and for the
-* operations those commands share with their tools, so a number the command refuses is refused by the tool in the
-* same words, and nothing reads `--limit 1e2` as 1 or `--port abc` as no port at all.
-*/
-function wholeNumber(raw, rule) {
-	if (raw === void 0) return void 0;
-	const value = readWholeNumber(raw);
-	if (Number.isNaN(value) || value < rule.min || rule.max !== void 0 && value > rule.max) {
-		const range = rule.max === void 0 ? `of ${rule.min} or more` : `from ${rule.min} to ${rule.max}`;
-		const hint = rule.hint ?? (Number.isNaN(value) ? "Digits only: no sign, decimal point, exponent or unit." : null);
-		throw new CommsError("USAGE", `${rule.name} "${String(raw)}" is not a whole number ${range}`, hint === null ? {} : { hint });
-	}
-	return value;
-}
 /**
 * A Google client id as an organisation profile has to write it (design 2026-10-02 §D2): the project number, a hyphen,
 * the client's own part, and Google's suffix — and nothing else.
@@ -11307,6 +12031,142 @@ strictObject({
 		})
 	}).optional()
 });
+/**
+* A string that came from a profile, as it is shown anywhere: chat-template tokens, role markers and envelope look-alikes
+* neutralised (`neutralise`), every control and invisible character made visible, tabs and line breaks flattened to a
+* space, and cut to `width`. `neutralise` keeps line feeds and tabs on purpose — they are legitimate in a message body —
+* so the flattening is what keeps a label from printing a second line of a preview.
+*/
+function shownText(value, width = 120) {
+	return truncateDisplay(neutralise(typeof value === "string" ? value : String(value ?? "")).text, width);
+}
+/**
+* A profile's path as it is shown — in a preview, an error, a command's output: neutralised and on one line, as every
+* other string a person did not write themselves. The path is chosen by whoever named the file — a repository, a
+* message with an attachment — and its name is text like any other.
+*/
+function shownPath(path) {
+	return shownText(path, 400);
+}
+/**
+* The bytes at an absolute path, in one bounded read: open once, check it is a regular file, read at most one byte more
+* than `PROFILE_MAX_BYTES` from the same handle. A path somebody typed can name a FIFO that never ends, a device, a
+* directory; none of them is a profile, and none may be how a command hangs. A symlink is followed: the path is one the
+* person chose. `unopened` says what a file that cannot be opened is: a refusal for the profile, whatever the reason;
+* nothing for a file beside it (`readSideFile`) when it is not there, and a refusal when it is there and cannot be
+* opened.
+*/
+async function readBounded(path, what) {
+	let handle;
+	try {
+		handle = await open(path, constants$1.O_RDONLY | (constants$1.O_NONBLOCK ?? 0));
+	} catch (error) {
+		return what.unopened(error);
+	}
+	try {
+		if (!(await handle.stat()).isFile()) throw new CommsError("USAGE", `${shownPath(path)} is not a file`);
+		const buffer = Buffer.allocUnsafe(65537);
+		const { bytesRead } = await handle.read(buffer, 0, 65537, 0);
+		if (bytesRead > 65536) throw new CommsError("BAD_DATA", `${shownPath(path)} is larger than ${what.size} can be (64 KiB)`, { hint: `${what.size.charAt(0).toUpperCase()}${what.size.slice(1)} is a few hundred bytes of JSON. Check this is the file your organisation sent.` });
+		return Buffer.from(buffer.subarray(0, bytesRead));
+	} catch (error) {
+		if (error instanceof CommsError) throw error;
+		throw new CommsError("NOT_FOUND", `${what.noun} at ${shownPath(path)} could not be read`, { cause: error });
+	} finally {
+		await handle.close();
+	}
+}
+/** The most symbolic links followed from a profile's path to its file: as many as the system itself follows. */
+const LINK_HOPS = 40;
+/**
+* The file a profile's path names, through every symbolic link at its end: the path itself when it is not a link, or
+* cannot be looked at — what reading it then finds is the bounded read's to say. A link's target is read against the
+* folder the link is in. The folders on the way are left as they are spelt: the file beside the result is in the same
+* folder whatever they resolve to.
+*
+* What the files beside a profile are looked for beside (`readProfileFile`): an organisation keeps them beside its
+* profile, in its own checkout, and a person who links to that profile from somewhere else has linked to the profile
+* alone. Looked for beside the link, a caps file is not there, and the caps it names would be lifted.
+*/
+function profileTarget(path) {
+	let at = path;
+	for (let hops = 0; hops < LINK_HOPS; hops += 1) {
+		let link;
+		try {
+			if (!lstatSync(at).isSymbolicLink()) return at;
+			link = readlinkSync(at);
+		} catch {
+			return at;
+		}
+		at = resolve(dirname(at), link);
+	}
+	throw new CommsError("USAGE", `${shownPath(path)} is a chain of more than ${LINK_HOPS} symbolic links`, { hint: "Pass the path of the profile file itself." });
+}
+/** A side file's path for a profile: in the same folder, the profile's name with `.<suffix>.json` for its `.json`. */
+function sidePathFor(profilePath, suffix) {
+	return /\.json$/i.test(profilePath) ? `${profilePath.slice(0, -5)}.${suffix}.json` : `${profilePath}.${suffix}.json`;
+}
+/**
+* Reads one file beside a profile, if there is one, and holds it to the profile: the same organisation, and whatever
+* else `agrees` asks. Read in one bounded read as the profile is (`readBounded`), strict as the profile is, and refused
+* in the same words — naming each problem by where it is, never by the value found there — but naming this file, so
+* the person knows which of the two to fix. Only a file that is not there is none: one that is there and cannot be
+* opened is refused, since read as none it would lift what it says — the caps, or the one app `workspace bot` takes.
+*/
+async function readSideFile(path, profile, side) {
+	const where = shownPath(path);
+	const bytes = await readBounded(path, {
+		unopened: (error) => {
+			if (error.code === "ENOENT") return null;
+			throw new CommsError("NOT_FOUND", `${side.noun} at ${where} could not be opened`, { cause: error });
+		},
+		noun: side.noun,
+		size: side.size
+	});
+	if (bytes === null) return void 0;
+	const refuse = (problem) => {
+		throw new CommsError("BAD_DATA", `${side.noun} ${where} is not valid: ${problem}`, { hint: side.hint });
+	};
+	let text;
+	try {
+		text = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+	} catch {
+		return refuse("it is not UTF-8 text");
+	}
+	let raw;
+	try {
+		raw = JSON.parse(text.startsWith("") ? text.slice(1) : text);
+	} catch {
+		return refuse("it is not valid JSON");
+	}
+	const parsed = side.schema.safeParse(raw);
+	if (!parsed.success) return refuse(parsed.error.issues.slice(0, 6).map((issue) => {
+		const at = issue.path.length > 0 ? issue.path.map(String).join(".") : "the file";
+		return issue.code === "unrecognized_keys" ? `${at}: ${issue.keys.map((key) => `"${shownText(key, 40)}"`).join(", ")} ${issue.keys.length === 1 ? "is not a key" : "are not keys"} it has` : `${at}: ${issue.message}`;
+	}).join("; "));
+	const document = parsed.data;
+	if (document.organisation !== profile.organisation) return refuse(`it names the organisation ${shownText(document.organisation, 40)}, not ${profile.organisation}, whose profile it sits beside`);
+	const problem = side.agrees?.(document, profile);
+	if (problem !== void 0) return refuse(problem);
+	return {
+		path,
+		sha256: createHash("sha256").update(bytes).digest("hex"),
+		document
+	};
+}
+strictObject({
+	agentcomms: literal("organisation-agent-app"),
+	version: literal(1),
+	organisation: string(),
+	slack: strictObject({
+		workspace: string().regex(SLACK_WORKSPACE_ID_PATTERN, "a Slack workspace id is T followed by capital letters or digits"),
+		appId: string().regex(SLACK_APP_ID_PATTERN, "a Slack app id is A followed by 2–20 capital letters or digits")
+	})
+});
+/** The organisation profiles this configuration records — none on version 1, which cannot hold them. */
+function organisationsOf(config) {
+	return hasNames(config) ? config.organisations ?? {} : {};
+}
 strictObject({
 	organisation: string().refine((word) => parseOrganisation(word) !== null, "an organisation is a name’s first half"),
 	role: _enum(["read", "send"]),
@@ -11319,6 +12179,802 @@ strictObject({
 	sha256: string().regex(/^[0-9a-f]{64}$/, "a SHA-256 is 64 lowercase hex digits")
 });
 /**
+* An organisation's update caps (design 2026-10-16, U8): the most its members' machines may update — `max`,
+* `every-14-days` or `never` — and `background: false`, no background job. They only ever tighten: a member's level is
+* capped at `max`, and nothing a member sets goes past it.
+*
+* **They are named in a file beside the profile, not in it** (`readSideFile`): a key such as `updates` in the profile
+* would make every release from 0.13.0 to 0.19.0 refuse it. They go in `<profile>.updates.json`, recorded as the
+* organisation's `updates`.
+*/
+const UPDATE_CAPS = ["every-14-days", "never"];
+/** The updates file for a profile: in the same folder, the profile's name with `.updates.json` for its `.json`. */
+function updatesPathFor(profilePath) {
+	return sidePathFor(profilePath, "updates");
+}
+const updatesSchema = strictObject({
+	organisation: string(),
+	max: _enum(UPDATE_CAPS, { message: "max is every-14-days or never: a cap only ever makes updates less frequent" }).optional(),
+	background: literal(false, { message: "background is false or left out: a cap can only turn background updates off" }).optional()
+});
+/** The updates file, held to the profile's organisation (`readSideFile`). */
+async function readUpdatesFile(path, profile) {
+	const read = await readSideFile(path, profile, {
+		noun: "the updates file",
+		size: "an updates file",
+		schema: updatesSchema,
+		hint: "It names the organisation, and the caps on how its members update and nothing else: `max` (every-14-days or never) and `background` (false). Ask your organisation for its current one."
+	});
+	if (read === void 0) return void 0;
+	const { max, background } = read.document;
+	return {
+		path: read.path,
+		sha256: read.sha256,
+		...max === void 0 ? {} : { max },
+		...background === void 0 ? {} : { background: false }
+	};
+}
+/**
+* The caps file beside a profile, read with no profile to hold it to but the organisation's word: what stands in for
+* the caps the configuration records when `config.json` cannot be read (`effectiveUpdates`, failing closed). Beside the
+* file the path names (`profileTarget`), in the same bounded, strict read, held to the same organisation. Refused as
+* `readProfileFile` refuses it; undefined when there is none.
+*/
+async function readUpdatesBeside(profilePath, organisation) {
+	return readUpdatesFile(updatesPathFor(profileTarget(profilePath)), { organisation });
+}
+/** The systemd units' and the Windows task's name. */
+const UPDATE_JOB_NAME = "agentcomms-update";
+Object.freeze(["update", "--background"]);
+function updateJobSupported(platform) {
+	return platform === "darwin" || platform === "linux" || platform === "win32";
+}
+function updateJobMarkerPath(stateDir) {
+	return join(stateDir, "update-job.json");
+}
+const isTime$1 = (value) => typeof value === "string" && Number.isFinite(Date.parse(value));
+/** The record, or null when there is none — or none this release can read, which is treated as none. */
+async function readUpdateJobMarker(stateDir) {
+	let parsed;
+	try {
+		parsed = JSON.parse(await readFile(updateJobMarkerPath(stateDir), "utf8"));
+	} catch {
+		return null;
+	}
+	const record = parsed;
+	if (typeof record !== "object" || record === null || !updateJobSupported(String(record.platform)) || typeof record.installedAt !== "string" || typeof record.label !== "string") return null;
+	return {
+		platform: record.platform,
+		installedAt: record.installedAt,
+		label: record.label,
+		...isTime$1(record.lastRun) ? { lastRun: record.lastRun } : {}
+	};
+}
+function within$1(at, now, intervalMs) {
+	if (at === void 0 || !isTime$1(at)) return false;
+	const since = now.getTime() - Date.parse(at);
+	return since >= -3e5 && since < intervalMs;
+}
+/** The job's health, from its record; null when there is none (`readUpdateJobMarker`). */
+async function updateJobHealth(stateDir, now = /* @__PURE__ */ new Date()) {
+	const marker = await readUpdateJobMarker(stateDir);
+	if (marker === null) return null;
+	return {
+		marker,
+		working: within$1(marker.lastRun, now, 1728e5) || within$1(marker.installedAt, now, 1728e5),
+		since: marker.lastRun ?? marker.installedAt
+	};
+}
+Object.freeze(["/usr/bin", "/bin"]);
+/** A PowerShell single-quoted string: nothing inside is special but a single quote — the curly ones too — doubled. */
+function powerShellLiteral(text) {
+	return `'${text.replace(/['‘’‚‛]/g, (quote) => quote + quote)}'`;
+}
+`${powerShellLiteral(UPDATE_JOB_NAME)}`;
+Object.freeze(["every-14-days", "never"]);
+/**
+* The daily update check, as every server and command reads it (design 2026-09-28, and 2026-10-16 for the notice that
+* replaced its stop): one file per machine, `update-check.json` in the state directory, saying when the registry was
+* last asked, the latest release it named, whether this machine's registrations were behind it, any "not now" with when
+* it runs out, and when a command last said so.
+*
+* This is the reader, and it has **no network code at all**: it reads and writes that file, and says what it means.
+* Asking the registry is the checker's (`update-check.ts`), which every server and command but WhatsApp's also
+* imports. WhatsApp's package promises it reaches no network — `packages/whatsapp/test/no-network.test.ts` holds it to
+* that — so it imports only this, and learns of an update once any other server or command on the machine has asked.
+*/
+/** The file, in the state directory: one per machine, shared by every server and command on it. */
+const UPDATE_CHECK_FILE = "update-check.json";
+/**
+* The switch that turns the whole thing off for one process — no check, no notice — whatever the setting says. Every
+* test harness and every script here that runs a command or a server sets it, so no test and no verify step asks the
+* real registry.
+*/
+const UPDATE_CHECK_ENV = "AGENT_COMMS_UPDATE_CHECK";
+/**
+* The level for one process, whatever the machine's (design 2026-10-16, U2): `never` switches it all off as
+* `AGENT_COMMS_UPDATE_CHECK=off` does. Any other word leaves the machine's level as it is.
+*/
+const UPDATES_ENV = "AGENT_COMMS_UPDATES";
+/**
+* Set by what starts a server from a release it pins itself — the Claude Code plugin's launcher, the Gemini
+* extension's manifest — to say so: `claude-code-plugin`, `gemini-extension`. No registration here names that server,
+* and `comms_update` never moves it; it changes when the plugin or the extension is updated. So its notice always says
+* where it is updated, whatever the channel's registrations say: restarting would start the release the plugin pins.
+*/
+const UPDATE_STARTED_BY_ENV = "AGENT_COMMS_STARTED_BY";
+const DAY_MS = 864e5;
+/** How long a check is good for on `auto`: the registry is asked at most once in this long, by the whole machine. */
+const UPDATE_CHECK_INTERVAL_MS = DAY_MS;
+/** How long a check, and a notice, is good for on `every-14-days`. */
+const SPACED_INTERVAL_MS = 14 * DAY_MS;
+Object.freeze([
+	1,
+	7,
+	14
+]);
+function readSecurityShown(value) {
+	if (typeof value !== "object" || value === null) return null;
+	const { version, approvals } = value;
+	if (!isPlainVersion(version) || !Array.isArray(approvals)) return null;
+	return {
+		version,
+		approvals: approvals.filter((id) => typeof id === "string" && APPROVAL_ID_PATTERN.test(id)).slice(-32)
+	};
+}
+const NOTICE_OUTCOMES = [
+	"installed",
+	"skipped",
+	"refused",
+	"failed",
+	"job-removed"
+];
+function readBackgroundNotice(value) {
+	if (typeof value !== "object" || value === null) return null;
+	const { at, outcome, version, text } = value;
+	if (!isTime(at) || !NOTICE_OUTCOMES.includes(outcome) || typeof text !== "string") return null;
+	return {
+		at,
+		outcome,
+		version: isVersion(version) ? version : null,
+		text: text.slice(0, 600)
+	};
+}
+const EMPTY_UPDATE_CHECK = Object.freeze({
+	lastChecked: null,
+	latest: null,
+	behind: null,
+	current: null,
+	lastError: null,
+	snoozedUntil: null,
+	checking: null,
+	commandNoticeAt: null,
+	noticeAt: null,
+	pausedAt: null,
+	pausedUntil: null,
+	release: null,
+	securityAsked: null,
+	securityShown: null,
+	backgroundNotice: null,
+	moves: null
+});
+function updateCheckPath(stateDir) {
+	return join(stateDir, UPDATE_CHECK_FILE);
+}
+const isTime = (value) => typeof value === "string" && Number.isFinite(Date.parse(value));
+const isWords = (value) => Array.isArray(value) && value.every((word) => typeof word === "string");
+function readRelease(value) {
+	if (typeof value !== "object" || value === null) return null;
+	const { version, security, needsDecision } = value;
+	if (!isPlainVersion(version)) return null;
+	return {
+		version,
+		security: security === true,
+		needsDecision: needsDecision === true
+	};
+}
+function readCurrent(value) {
+	if (typeof value !== "object" || value === null) return null;
+	const { registered, global } = value;
+	return isWords(registered) && isWords(global) ? {
+		registered: [...registered],
+		global: [...global]
+	} : null;
+}
+/**
+* The record as the file holds it, each field checked on its own: one that is missing or not what it should be reads
+* as not known. A file that is missing, unreadable or not JSON is an empty record — never a reason to stop anything.
+*/
+async function readUpdateCheck(stateDir) {
+	let parsed;
+	try {
+		parsed = JSON.parse(await readFile(updateCheckPath(stateDir), "utf8"));
+	} catch {
+		return { ...EMPTY_UPDATE_CHECK };
+	}
+	const held = typeof parsed === "object" && parsed !== null ? parsed : {};
+	return {
+		lastChecked: isTime(held.lastChecked) ? held.lastChecked : null,
+		latest: isPlainVersion(held.latest) ? held.latest : null,
+		behind: typeof held.behind === "boolean" ? held.behind : null,
+		current: readCurrent(held.current),
+		lastError: typeof held.lastError === "string" ? held.lastError.slice(0, 300) : null,
+		snoozedUntil: isTime(held.snoozedUntil) ? held.snoozedUntil : null,
+		checking: isTime(held.checking) ? held.checking : null,
+		commandNoticeAt: isTime(held.commandNoticeAt) ? held.commandNoticeAt : null,
+		noticeAt: isTime(held.noticeAt) ? held.noticeAt : null,
+		pausedAt: isTime(held.pausedAt) ? held.pausedAt : null,
+		pausedUntil: isTime(held.pausedUntil) ? held.pausedUntil : null,
+		release: readRelease(held.release),
+		securityAsked: isPlainVersion(held.securityAsked) ? held.securityAsked : null,
+		securityShown: readSecurityShown(held.securityShown),
+		backgroundNotice: readBackgroundNotice(held.backgroundNotice),
+		moves: typeof held.moves === "number" && Number.isInteger(held.moves) && held.moves >= 0 ? held.moves : null
+	};
+}
+/**
+* Reads the record, changes it and writes it back, under a lock beside it, atomically — so a server recording a check
+* and a person's "not now" arriving at the same moment each keep what the other wrote. Returns what `change` returned
+* alongside the record written; `change` returning `null` writes nothing.
+*/
+async function changeUpdateCheck(stateDir, change) {
+	return withFileLock(join(stateDir, ".update-check.lock"), async () => {
+		const current = await readUpdateCheck(stateDir);
+		const next = change(current);
+		if (next === null) return {
+			record: current,
+			result: void 0,
+			written: false
+		};
+		await writeFileAtomic(updateCheckPath(stateDir), `${JSON.stringify(next.record, null, 2)}\n`);
+		return {
+			record: next.record,
+			result: next.result,
+			written: true
+		};
+	}, { timeoutMs: 2e3 });
+}
+/**
+* Whether the check is due: never asked, asked a day or more ago, or — a clock that went back — asked more than a few
+* minutes in the future. A few minutes are allowed for, because two processes' clocks are read at slightly different
+* moments, and a check just claimed by one must not look due to the other.
+*/
+function updateCheckDue(record, now, intervalMs = UPDATE_CHECK_INTERVAL_MS) {
+	return !within(record.lastChecked, now, intervalMs);
+}
+/** Whether `at` is less than `intervalMs` ago — a time from more than a few minutes in the future is not trusted. */
+function within(at, now, intervalMs) {
+	if (at === null) return false;
+	const since = now.getTime() - Date.parse(at);
+	return since >= -CLOCK_SKEW_MS && since < intervalMs;
+}
+const CLOCK_SKEW_MS = 3e5;
+/** What turned updates off for this process, from its environment: `CI`, or a switch. Null when nothing did. */
+function updateCheckSwitchedOff(env) {
+	if (env.CI && env.CI !== "0" && env.CI !== "false") return "CI";
+	const value = env[UPDATE_CHECK_ENV]?.trim().toLowerCase();
+	if (value !== void 0 && [
+		"off",
+		"0",
+		"false",
+		"no"
+	].includes(value)) return UPDATE_CHECK_ENV;
+	if (env["AGENT_COMMS_UPDATES"]?.trim().toLowerCase() === "never") return UPDATES_ENV;
+	return null;
+}
+/** How much a level updates: `auto` 2, `every-14-days` 1, `never` 0. */
+const rankOf = (level) => UPDATE_LEVELS.length - 1 - UPDATE_LEVELS.indexOf(level);
+/** `profileTarget`, for a path read back from the configuration: one it cannot follow is shown as it is. */
+function safeTarget(path) {
+	try {
+		return profileTarget(path);
+	} catch {
+		return path;
+	}
+}
+/**
+* The caps the organisation profiles here name (design 2026-10-16, U8): the strictest `max`, and the first profile
+* with `background: false`, each with where it comes from. A `max` word this release does not know counts as `never`,
+* the strictest it could mean: caps only ever tighten.
+*/
+function organisationCaps(config) {
+	let cap;
+	let backgroundOff;
+	for (const [organisation, record] of Object.entries(organisationsOf(config)).sort(([a], [b]) => a.localeCompare(b))) {
+		const caps = record.updates;
+		if (caps === void 0) continue;
+		const where = {
+			organisation,
+			source: updatesPathFor(safeTarget(record.source.path))
+		};
+		if (caps.max !== void 0) {
+			const level = caps.max === "every-14-days" ? "every-14-days" : "never";
+			if (cap === void 0 || rankOf(level) < rankOf(cap.level)) cap = {
+				...where,
+				level
+			};
+		}
+		if (caps.background === false && backgroundOff === void 0) backgroundOff = where;
+	}
+	return {
+		cap,
+		backgroundOff
+	};
+}
+/**
+* The level in force by the configuration alone (design 2026-10-16, U2, U8): the level set, capped by its
+* organisations' caps, and the organisation that turns background updates off. What `effectiveUpdates` starts from,
+* and what a background run and the background job's setup read — neither of which runs where the environment
+* switched updates off, and neither of which counts a configuration it cannot read as anything.
+*/
+function configuredUpdates(config) {
+	const set = updateLevelOf(config);
+	const caps = organisationCaps(config);
+	const cap = caps.cap !== void 0 && rankOf(caps.cap.level) < rankOf(set) ? caps.cap : void 0;
+	return {
+		level: cap?.level ?? set,
+		set,
+		...cap ? { cap } : {},
+		...caps.backgroundOff ? { backgroundOff: caps.backgroundOff } : {}
+	};
+}
+/**
+* The caps that stand in for the configuration's when `config.json` cannot be read (U8, failing closed): for every
+* organisation the file still names — read loosely, as JSON, whatever its schema says — the caps it records, and the
+* caps file beside its profile, read again (`readUpdatesBeside`). The strictest `max` of them all, and the first
+* `background: false`. A caps file that cannot be read is passed over; what the configuration recorded of it stands.
+* A file that is not JSON at all names no organisation, and so no cap.
+*/
+async function capsWithoutConfig(core) {
+	let raw;
+	try {
+		raw = JSON.parse(await readFile(core.config.path, "utf8"));
+	} catch {
+		return { read: 0 };
+	}
+	const organisations = raw?.organisations;
+	if (typeof organisations !== "object" || organisations === null) return { read: 0 };
+	let cap;
+	let backgroundOff;
+	let read = 0;
+	const take = (organisation, source, caps) => {
+		read += 1;
+		if (caps.max !== void 0) {
+			const level = caps.max === "every-14-days" ? "every-14-days" : "never";
+			if (cap === void 0 || rankOf(level) < rankOf(cap.level)) cap = {
+				organisation,
+				source,
+				level
+			};
+		}
+		if (caps.background === false && backgroundOff === void 0) backgroundOff = {
+			organisation,
+			source
+		};
+	};
+	for (const [organisation, record] of Object.entries(organisations).sort(([a], [b]) => a.localeCompare(b))) {
+		const held = typeof record === "object" && record !== null ? record : {};
+		const path = typeof held.source?.path === "string" && isAbsolute(held.source.path) ? held.source.path : void 0;
+		const source = path === void 0 ? core.config.path : updatesPathFor(safeTarget(path));
+		if (typeof held.updates === "object" && held.updates !== null) take(organisation, source, held.updates);
+		if (path === void 0) continue;
+		try {
+			const file = await readUpdatesBeside(path, organisation);
+			if (file !== void 0) take(organisation, file.path, file);
+		} catch {}
+	}
+	return {
+		...cap ? { cap } : {},
+		...backgroundOff ? { backgroundOff } : {},
+		read
+	};
+}
+/**
+* The level in force here, read from the environment first, then the configuration and its organisations' caps.
+*
+* A configuration that cannot be read sets the default, `auto` — what is wrong with it is for the doctor and the tools
+* to say, and it must not quietly turn updates off — but it never lifts an organisation's cap: the strictest cap that
+* can still be read in its place holds (`capsWithoutConfig`), and nothing installs in the background, which reads the
+* configuration too.
+*/
+async function effectiveUpdates(core, env, now = /* @__PURE__ */ new Date()) {
+	let configured;
+	try {
+		configured = configuredUpdates(await core.config.load());
+	} catch (error) {
+		const { read, cap, backgroundOff } = await capsWithoutConfig(core);
+		configured = {
+			level: cap?.level ?? "auto",
+			set: "auto",
+			...cap ? { cap } : {},
+			...backgroundOff ? { backgroundOff } : {},
+			unreadableConfig: {
+				reason: shownText(error instanceof Error ? error.message : String(error), 200),
+				read
+			}
+		};
+	}
+	const { level, set, ...extra } = configured;
+	const switched = updateCheckSwitchedOff(env);
+	if (switched !== null) return {
+		level: "never",
+		set,
+		by: switched,
+		background: false,
+		...extra
+	};
+	if (level !== "auto" || extra.backgroundOff !== void 0 || extra.unreadableConfig !== void 0) return {
+		level,
+		set,
+		by: "setting",
+		background: false,
+		...extra
+	};
+	const job = await updateJobHealth(core.paths.stateDir, now);
+	return {
+		level,
+		set,
+		by: "setting",
+		background: job?.working === true,
+		...extra,
+		...job !== null && !job.working ? { jobSilent: { since: job.since } } : {}
+	};
+}
+/** Whether a check may run at all, how often, and if not, what turned it off: the environment, then the level. */
+async function updateCheckEnabled(core, env) {
+	const updates = await effectiveUpdates(core, env);
+	if (updates.level === "never") return {
+		on: false,
+		by: updates.by
+	};
+	return {
+		on: true,
+		intervalMs: updates.level === "every-14-days" ? SPACED_INTERVAL_MS : UPDATE_CHECK_INTERVAL_MS
+	};
+}
+/**
+* When a pause ends, while one holds at `now` — or null. A pause holds from when it was asked until its end, and only
+* while that end is at most 14 days after it was asked: a clock gone back to before it was asked, or an end written by
+* hand further off, holds nothing, so no pause ever lasts longer than 14 days from when it was asked.
+*/
+function pauseEnd(record, now) {
+	if (record.pausedAt === null || record.pausedUntil === null) return null;
+	const asked = Date.parse(record.pausedAt);
+	const ends = Date.parse(record.pausedUntil);
+	if (ends - asked > 12099e5) return null;
+	if (now.getTime() < asked - CLOCK_SKEW_MS || now.getTime() >= ends) return null;
+	return new Date(ends);
+}
+/**
+* The security fix this record says is out, for a process running `running`: the latest release, when its manifest
+* declares one and `running` is behind it. Null otherwise.
+*/
+function securityRelease(record, running) {
+	const latest = countedLatest(record);
+	if (latest === null || record.release?.version !== latest || !record.release.security) return null;
+	return isVersion(running) && isBehind(running, latest) ? latest : null;
+}
+/**
+* The person answered the security line (design 2026-10-16, U7): the send or post `approvalId` was approved, or claimed
+* to be sent. When its preview carried the line, that release counts as asked from now on, and the next preview is as
+* it always was. An approval no preview carried it on answers nothing. Called by the approval store
+* (`ApprovalStoreOptions.answered`); it never throws, and a send never waits long on it.
+*/
+async function securityAnswered(stateDir, approvalId) {
+	const carried = (record) => record.securityShown?.approvals.includes(approvalId) === true;
+	try {
+		if (!carried(await readUpdateCheck(stateDir))) return;
+		await changeUpdateCheck(stateDir, (record) => {
+			if (!carried(record) || record.securityShown === null || record.securityShown === void 0) return null;
+			return { record: {
+				...record,
+				securityAsked: record.securityShown.version,
+				securityShown: null
+			} };
+		});
+	} catch {}
+}
+/** A local time as a person reads it in a preview: `2026-09-29 00:00`. */
+function localStamp(at) {
+	const two = (value) => String(value).padStart(2, "0");
+	return `${at.getFullYear()}-${two(at.getMonth() + 1)}-${two(at.getDate())} ${two(at.getHours())}:${two(at.getMinutes())}`;
+}
+/**
+* The latest release as the check counts it: a plain `MAJOR.MINOR.PATCH` — 0.8.0-rc.1 is never an update anybody is
+* told of, and 0.8.1+anything is not a release at all. Null when the file names none.
+*/
+function countedLatest(record) {
+	return isPlainVersion(record.latest) ? record.latest : null;
+}
+/**
+* What the record means for a process running `running`, ignoring any "not now": null when there is nothing newer.
+*
+* `restart` only on the check's positive finding about this very server or command (`current`): a server whose every
+* registration names `latest`, or a command whose package is installed globally at `latest`. Anything else — no
+* registration the scan could see (a plugin's, an extension's, one written by hand), one that pins no release, a
+* configuration it could not read, a check that found out nothing — is `update`: restarting would start the same old
+* code, and a notice that said to restart would give advice that cannot work.
+*/
+function updateVerdict(record, running, where) {
+	const latest = countedLatest(record);
+	if (latest === null || !isVersion(running) || !isBehind(running, latest)) return null;
+	return {
+		kind: (where.surface === "server" ? record.current?.registered : record.current?.global)?.includes(where.channel) === true ? "restart" : "update",
+		running,
+		latest
+	};
+}
+function openCore(options = {}) {
+	const { paths, pathOverrides } = resolvePathIdentity(options);
+	const now = options.now ?? (() => /* @__PURE__ */ new Date());
+	const handoffs = options.caller === void 0 ? void 0 : cliHandoffs({
+		caller: options.caller,
+		paths,
+		platform: options.platform,
+		env: options.env
+	});
+	const config = new ConfigStore(paths.configDir, { handoffs });
+	const audit = new AuditLog(paths.stateDir, now);
+	let cached = null;
+	return {
+		paths,
+		pathOverrides,
+		config,
+		states: new InboxStateStore(paths.stateDir),
+		approvals: new ApprovalStore(paths.stateDir, {
+			now,
+			handoffs,
+			loadConfig: () => config.load(),
+			audit,
+			answered: (approvalId) => securityAnswered(paths.stateDir, approvalId)
+		}),
+		ledger: new SendLedger(paths.stateDir, now),
+		plans: new PlanStore(paths.stateDir, now),
+		taint: new TaintStore(paths.stateDir, now),
+		audit,
+		handoffs,
+		async secrets(kind) {
+			const chosen = kind ?? secretsStoreOf(await config.load());
+			if (cached?.kind === chosen) return cached.store;
+			const store = await openSecretStore(chosen, {
+				secretsDir: paths.secretsDir,
+				namespace: keychainNamespace(paths.configDir),
+				handoffs
+			});
+			cached = {
+				kind: chosen,
+				store
+			};
+			return store;
+		}
+	};
+}
+/**
+* A whole number as it was given: a string of digits and nothing else (surrounding spaces aside), or a number that is
+* whole — and `NaN` for anything else.
+*
+* `Number.parseInt` read `abc` as NaN, `12abc` as 12 and `1e2` as 1; `Number` reads `1e2` as 100, `0x10` as 16 and an
+* empty string as 0. Each of those is a number nobody typed, so none of them is read as one here. A value too large to
+* hold exactly is not one either: it would be used as some other number.
+*/
+function readWholeNumber(raw) {
+	const value = typeof raw === "number" ? raw : typeof raw === "string" && /^[0-9]+$/.test(raw.trim()) ? Number(raw.trim()) : NaN;
+	return Number.isSafeInteger(value) ? value : NaN;
+}
+/**
+* A number option, checked rather than coerced: the number, `undefined` when none was given, or a USAGE refusal that
+* names the option and its range.
+*
+* One check for every command line's number options — `agentcomms`, `agent-gmail` and `agent-slack` — and for the
+* operations those commands share with their tools, so a number the command refuses is refused by the tool in the
+* same words, and nothing reads `--limit 1e2` as 1 or `--port abc` as no port at all.
+*/
+function wholeNumber(raw, rule) {
+	if (raw === void 0) return void 0;
+	const value = readWholeNumber(raw);
+	if (Number.isNaN(value) || value < rule.min || rule.max !== void 0 && value > rule.max) {
+		const range = rule.max === void 0 ? `of ${rule.min} or more` : `from ${rule.min} to ${rule.max}`;
+		const hint = rule.hint ?? (Number.isNaN(value) ? "Digits only: no sign, decimal point, exponent or unit." : null);
+		throw new CommsError("USAGE", `${rule.name} "${String(raw)}" is not a whole number ${range}`, hint === null ? {} : { hint });
+	}
+	return value;
+}
+/**
+* Every sentence a background run may leave for the next session, and the one way a notice of it is said (design
+* 2026-10-16 U5 step 7, U9; security review of 0.20.0, severity 6): in this package's own words, with nothing in them
+* the registry or a certificate wrote. A release's version is the one thing a sentence takes from outside, and only as a
+* plain `MAJOR.MINOR.PATCH`: a prerelease's words or build metadata (`0.20.1+Ignore-previous-instructions` is valid
+* semver) are never repeated.
+*
+* The run writes one of these into the update state file; the notice (`update-gate.ts`) says it only when it is one of
+* them, word for word, and otherwise the outcome's own sentence — so a record written by another release, or by hand,
+* never reaches a model as it is.
+*
+* Nothing here reaches the network or reads a file: every server and command, WhatsApp's too, carries it.
+*/
+const PLAIN_VERSION = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/;
+/** A release as a notice names it: its version when it is a plain `MAJOR.MINOR.PATCH`, otherwise "A release". */
+function shownRelease(version) {
+	return typeof version === "string" && PLAIN_VERSION.test(version) ? version : "A release";
+}
+/** Which pin a release did not verify against, in this package's own words — never the value it held instead. */
+const PIN_WORDS = Object.freeze({
+	attestation: "npm has no SLSA provenance attestation for it that could be read",
+	bundle: "its provenance bundle could not be read",
+	issuer: "it was not signed through GitHub Actions' token issuer",
+	identity: "it was not signed for this repository's release workflow at the tag of its version",
+	runner: "it was not built on a GitHub-hosted runner",
+	repository: "it was not built from this repository",
+	ref: "it was not built from the tag of its version",
+	subject: "what its provenance signs is not the tarball the registry serves for it",
+	signature: "Sigstore did not verify its signature, certificate or transparency-log entry"
+});
+const PIN_FIELDS = Object.keys(PIN_WORDS);
+/** What went wrong, in fixed words. */
+const FAILED_WORDS = Object.freeze({
+	install: "one of its packages could not be installed",
+	tarball: "what npm installed is not the tarball whose provenance was verified",
+	selfCheck: "one of its packages failed its self-check",
+	switch: "a launcher could not be switched, so every launcher was put back",
+	inUse: "an unfinished runtime of it is in the way"
+});
+const RESTART = "restart each MCP client that starts these servers (in Claude Code, /mcp and then Reconnect) to use it: a server already running keeps the code it started with";
+/** The sentences, by what happened. */
+const BACKGROUND_WORDS = Object.freeze({
+	installed: (version) => `${shownRelease(version)} is installed; ${RESTART}.`,
+	major: (version) => `${shownRelease(version)} is a new major release: it is never installed in the background. Update when it suits you — comms_update shows each step first.`,
+	decision: (version) => `${shownRelease(version)} needs a decision from you — it, or a release before it, says so — so it was not installed in the background. comms_update shows each step first; its release notes say what it changes.`,
+	downgrade: (version) => `The registry names ${shownRelease(version)} as the latest release, older than what runs here: nothing was changed in the background.`,
+	waits: (version) => `${shownRelease(version)} waits for you: it was not installed in the background. comms_update shows each step first.`,
+	unverified: (version, field) => `${shownRelease(version)} was not installed: a release could not be verified as built by this repository's release workflow — ${PIN_WORDS[field]}. Nothing was changed.`,
+	refused: (version) => `${shownRelease(version)} was not installed: a release could not be verified as built by this repository's release workflow. Nothing was changed.`,
+	failed: (version, what) => `${shownRelease(version)} was not installed in the background: ${FAILED_WORDS[what]}. Nothing was switched; the next run tries again, and comms_audit_tail shows what went wrong.`,
+	stopped: (version) => `${shownRelease(version)} was not installed in the background, and nothing was switched; the next run tries again, and comms_audit_tail shows what went wrong.`,
+	partlySwitched: (version) => `${shownRelease(version)} was not installed in the background: a launcher could not be switched, and not every launcher could be put back, so some here start ${shownRelease(version)} from their next start and some the release before. comms_audit_tail says which.`,
+	heldUnreadable: "No update is installed in the background while update-held.json in the state directory cannot be read: it says which releases were rolled back. Delete it to hold none.",
+	jobRemoved: "An organisation profile on this machine turned background updates off, so the background update job was removed. Updates are still checked daily, and a notice says when one is out."
+});
+/** Every sentence a run may leave for `outcome` and `version`, the outcome's own first. */
+function sentencesFor(outcome, version) {
+	const words = BACKGROUND_WORDS;
+	switch (outcome) {
+		case "installed": return [words.installed(version ?? "")];
+		case "skipped": return [
+			words.waits(version),
+			words.major(version ?? ""),
+			words.decision(version ?? ""),
+			words.downgrade(version ?? "")
+		];
+		case "refused": return [words.refused(version), ...PIN_FIELDS.map((field) => words.unverified(version, field))];
+		case "failed": return [
+			words.stopped(version),
+			...Object.keys(FAILED_WORDS).map((what) => words.failed(version, what)),
+			words.partlySwitched(version),
+			words.heldUnreadable
+		];
+		case "job-removed": return [words.jobRemoved];
+	}
+}
+/**
+* What a notice says of the last background run: the run's own sentence when it is one of these, word for word, for
+* its outcome and release — and otherwise the outcome's own. Never the record's text as it is.
+*/
+function backgroundNoticeLine(notice) {
+	const sentences = sentencesFor(notice.outcome, notice.version);
+	return sentences.includes(notice.text) ? notice.text : sentences[0];
+}
+/** The SHA-512 in a subresource-integrity string, as hex; null when it holds none. */
+function sha512Hex(integrity) {
+	for (const part of integrity.trim().split(/\s+/)) {
+		if (!part.startsWith("sha512-")) continue;
+		const bytes = Buffer.from(part.slice(7).split("?")[0] ?? "", "base64");
+		if (bytes.length === 64) return bytes.toString("hex");
+	}
+	return null;
+}
+/** The tarball integrity the registry gives for one version, or null when it gives none. */
+function releaseIntegrity(packument, version) {
+	const integrity = packument.versions?.[version]?.dist?.integrity;
+	return typeof integrity === "string" && integrity.trim() !== "" ? integrity : null;
+}
+/** What a release that verified was built by, in one phrase: the preview's and the dry run's words. */
+const BUILT_BY = "this repository's release workflow (.github/workflows/release.yml) at the tag of its version, on a GitHub-hosted runner, as its Sigstore provenance shows";
+/** The scope every package of this suite is published under, and so attested for. */
+const SUITE = "@agentcomms/";
+/**
+* Why the runtime at `runtime` is not what was verified, or null when it is (security review of 0.20.0, severity 5).
+*
+* Every package of this suite npm installed in it — `packageName` itself, and any of ours it depends on at any depth,
+* as Gmail depends on core — has to be, by the runtime's own lockfile, a tarball whose provenance verified: the one
+* whose SHA-512 is `sha512` for `packageName`, and for each other either one already verified (`known`, by
+* `package@version`, the SHA-512 it signs) or one `verify` verifies now, against the integrity npm recorded. npm checks
+* each tarball it downloads against the integrity the registry gives it then, and records that; a registry that gave
+* another one to the install than to the check, or a runtime made some other way, is caught here.
+*
+* The packages of others it holds are checked by npm alone, against the registry's integrity: no pin says who builds
+* them (SECURITY.md says so). No package's install script ran (`installManagedRuntime`).
+*/
+async function runtimeIntegrityProblem(runtime, packageName, sha512, options = {}) {
+	let lock;
+	try {
+		lock = JSON.parse(await readFile(join(runtime, "package-lock.json"), "utf8"));
+	} catch {
+		lock = null;
+	}
+	const own = `node_modules/${packageName}`;
+	const integrity = lock?.packages?.[own]?.integrity;
+	if (typeof integrity !== "string") return `what is in ${runtime} cannot be shown to be the tarball whose provenance was verified: its lockfile records no integrity for ${packageName}`;
+	if (sha512Hex(integrity) !== sha512) return `what is in ${runtime} is not the tarball whose provenance was verified: its lockfile records another integrity for ${packageName}`;
+	const known = options.known ?? /* @__PURE__ */ new Map();
+	for (const [key, entry] of Object.entries(lock?.packages ?? {})) {
+		if (key === own) continue;
+		const name = key.slice(key.lastIndexOf("node_modules/") + 13);
+		if (!key.includes("node_modules/") || !name.startsWith(SUITE)) continue;
+		const version = entry?.version;
+		const recorded = entry?.integrity;
+		if (!isPlainVersion(version) || typeof recorded !== "string" || sha512Hex(recorded) === null) return `${name}, which ${packageName} in ${runtime} depends on, cannot be shown to be a verified tarball: its lockfile records no plain release version or no SHA-512 integrity for it`;
+		const hex = sha512Hex(recorded);
+		if (known.get(`${name}@${version}`) === hex) continue;
+		if (!options.verify) return `${name}@${version}, which ${packageName} in ${runtime} depends on, cannot be verified here`;
+		const verdict = await options.verify({
+			packageName: name,
+			version,
+			integrity: recorded
+		});
+		if (!verdict.ok) return `${name}@${version}, which ${packageName} in ${runtime} depends on, is not a tarball built by this repository's release workflow — ${PIN_WORDS[verdict.field]}`;
+		known.set(`${name}@${version}`, hex);
+	}
+	return null;
+}
+/**
+* The refusal of a whole update or install for one release that did not verify: which, and which pin — never what it
+* held. `hint` replaces the general one where there is more to say: where it can be verified, for a process that
+* cannot.
+*/
+function unverifiedRelease(packageName, version, why, pin, act = "update", hint) {
+	const which = act === "update" ? "An update installs" : "An install fetches";
+	const plain = isPlainVersion(version);
+	return new CommsError("BAD_DATA", `nothing was installed or changed: ${plain ? `${packageName}@${version}` : `${packageName} at a version that is not a plain release`} could not be verified as built by this repository's release workflow — ${why}`, {
+		hint: hint ?? `${which} only a release whose Sigstore provenance shows it was built by this repository's release workflow at the tag of its version, on a GitHub-hosted runner, and nothing skips that check. Nothing was prepared to approve. A release published minutes ago can be without its attestation for a while: try again later. If it still does not verify, do not install it some other way; report it as SECURITY.md says.`,
+		details: {
+			package: packageName,
+			...plain ? { version } : {},
+			pin
+		}
+	});
+}
+/**
+* Verifies every release in `wanted` — its tarball's integrity as the registry gives it, and npm's attestation for it,
+* held to the pins the background run holds a release to (design 2026-10-16 U5 step 3). The first that does not verify
+* refuses the whole update or install (`unverifiedRelease`); what verified is returned by package, for the preview
+* and for the integrity check after install. Reads; changes nothing. With no registry or no verifier, the first
+* release is refused before anything is asked.
+*/
+async function verifyReleaseSet(sources, wanted, act = "update", noVerifierHint) {
+	const verified = /* @__PURE__ */ new Map();
+	if (wanted.size === 0) return verified;
+	const { registry, verify, why } = sources;
+	for (const [packageName, version] of [...wanted].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0)) {
+		if (!isPlainVersion(version)) throw unverifiedRelease(packageName, version, "it is not a plain release (MAJOR.MINOR.PATCH)", "version", act);
+		if (registry === null || verify === null) throw unverifiedRelease(packageName, version, why, "verifier", act, noVerifierHint);
+		let integrity;
+		try {
+			integrity = releaseIntegrity((await registry(packageName)).packument, version);
+		} catch (error) {
+			throw new CommsError("PROVIDER_UNAVAILABLE", `nothing was installed or changed: the registry's document of ${packageName} could not be read to verify ${version}: ${error instanceof Error ? error.message : String(error)}`, { hint: "Try again once the registry can be reached." });
+		}
+		if (integrity === null) throw unverifiedRelease(packageName, version, "the registry gives no tarball integrity for it", "subject", act);
+		const verdict = await verify({
+			packageName,
+			version,
+			integrity
+		});
+		if (!verdict.ok) throw unverifiedRelease(packageName, version, PIN_WORDS[verdict.field], verdict.field, act);
+		verified.set(packageName, verdict.provenance);
+	}
+	return verified;
+}
+/**
 * Registering, pruning and listing every declared channel or service MCP server, from the core.
 *
 * `agentcomms mcp install` registers core or a declared service; `comms_server_install` registers any declared
@@ -11482,6 +13138,14 @@ function installOptions(request) {
 	};
 }
 /**
+* The install receipt a fetched runtime keeps in its folder: which release, whether its provenance was verified, and
+* by whom it was installed — core, which verifies, or a channel's own command, which cannot (owner's decision,
+* 2026-10-17). Doctor and a person can read it; nothing else depends on it.
+*/
+const INSTALL_RECEIPT = ".agentcomms-install.json";
+/** A sentence's first letter in capitals: core's command, said after a full stop. */
+const capitalised = (text) => `${text.charAt(0).toUpperCase()}${text.slice(1)}`;
+/**
 * Registering one declared server with one client, as a change.
 *
 * The effects are what a person is agreeing to, one sentence each, and everything that decides what the server may
@@ -11514,6 +13178,101 @@ function serverInstallChange(core, env, request, own, deps = {}) {
 	const launcher = request.launcher ?? "managed";
 	const productNow = async () => own ?? await serverProduct(request.channel, request.launcher);
 	let planned;
+	const sources = () => ({
+		registry: deps.registry ?? null,
+		verify: deps.verifyRelease ?? null,
+		why: deps.verifyRelease === void 0 ? "nothing here can verify provenance: run the install from core's own command or server" : "this install was handed a verifier and no registry"
+	});
+	/**
+	* Core's own command for this same install, located — the one that verifies — said by `say`; `instead` where no
+	* command can be named.
+	*/
+	const coreWords = () => {
+		const words = [
+			"mcp",
+			"install",
+			"--server",
+			request.channel,
+			"--client",
+			request.client
+		];
+		if (request.name !== void 0) words.push("--name", request.name);
+		const pin = pinOf(request);
+		const option = pinOption(request.channel);
+		if (pin !== void 0 && option !== void 0 && option !== "readOnly") words.push(`--${option}`, pin);
+		if (request.readOnly) words.push("--read-only");
+		if (request.force) words.push("--force");
+		return words;
+	};
+	const inCore = (say, instead) => {
+		try {
+			return handoffSentence(requireHandoffs(core, deps.platform).core(coreWords()), say, { instead });
+		} catch {
+			return instead;
+		}
+	};
+	/** Where a process that cannot verify — a channel's own, with no Sigstore — sends the person: core, which can. */
+	const verifyInCore = () => inCore((command) => `Core verifies a release's provenance before it installs it: run ${command} in your own terminal, or call comms_server_install from a chat. Nothing was prepared to approve.`, "Core verifies a release's provenance before it installs it: run core's `mcp install --server` in your own terminal, or call comms_server_install from a chat. Nothing was prepared to approve.");
+	/** Where the release a channel's own command installs unverified is checked: core's command, located. */
+	const checkedInCore = () => inCore((command) => `core's ${command} checks it before it installs it`, "core's `mcp install --server` checks it before it installs it");
+	/** The receipt a runtime this install fetched keeps beside it (`INSTALL_RECEIPT`). */
+	const writeReceipt = (runtime, packageName, version, verified, by) => writeFileAtomic(join(runtime, INSTALL_RECEIPT), `${JSON.stringify({
+		package: packageName,
+		version,
+		verified,
+		by,
+		at: (/* @__PURE__ */ new Date()).toISOString()
+	}, null, 2)}\n`);
+	const verifiedRuntime = async (done) => {
+		const { dataDir } = core.paths;
+		const { packageName, version } = done.product;
+		const runtime = managedRuntimeDir(dataDir, packageName, version);
+		const there = await reusableRuntime(dataDir, packageName, version);
+		if (done.verified === void 0) {
+			if (there !== null) return void 0;
+			if (done.unverifiedOwn) {
+				await installManagedRuntime(context, done.product, version).catch(async (error) => {
+					throw await remedyLocated(error, core);
+				});
+				await writeReceipt(runtime, packageName, version, false, `${label}’s own command`);
+				return {
+					package: packageName,
+					version,
+					verified: false,
+					note: `${packageName}@${version} was installed without its provenance verified: this command cannot check provenance, so it installed the release it is running itself. ${capitalised(checkedInCore())}.`
+				};
+			}
+			throw new CommsError("CONFIG", `this registration changed between being planned and being applied: ${runtime} was on this machine when it was planned, and is not now, so it would be fetched from npm without being verified. So nothing was installed or registered`, { hint: "Run the same install again: it is planned afresh from what is there now, verifies the release it would fetch, and asks again." });
+		}
+		if (there === null) await installManagedRuntime(context, done.product, version).catch(async (error) => {
+			throw await remedyLocated(error, core);
+		});
+		const { sha512 } = done.verified;
+		const problem = await runtimeIntegrityProblem(runtime, packageName, sha512, {
+			verify: sources().verify,
+			known: /* @__PURE__ */ new Map([[`${packageName}@${version}`, sha512]])
+		});
+		if (problem === null) {
+			await writeReceipt(runtime, packageName, version, true, "core");
+			return {
+				package: packageName,
+				version,
+				verified: true
+			};
+		}
+		if (there === null) await rm(runtime, {
+			recursive: true,
+			force: true
+		}).catch(() => void 0);
+		const general = "An install registers only a runtime whose packages of this suite were all built by this repository's release workflow, as their Sigstore provenance shows. If it happens again, do not install it some other way; report it as SECURITY.md says.";
+		throw new CommsError("BAD_DATA", `nothing was registered: ${problem}${there === null ? ", so it was removed" : ""}. The launcher was not pointed at it`, {
+			hint: there === null ? general : `To fetch a verified one, remove ${runtime} — whatever starts it stops until it is installed again — and run this install again: it fetches ${packageName}@${version} from npm and verifies it before anything is registered. ${general}`,
+			details: {
+				package: packageName,
+				version
+			}
+		});
+	};
 	return {
 		plan: async (config) => {
 			checkPin(config, request);
@@ -11523,9 +13282,21 @@ function serverInstallChange(core, env, request, own, deps = {}) {
 				throw await remedyLocated(error, core);
 			});
 			const { target, previous, effective, kept, command } = preflight;
+			const managedApply = request.print !== true && launcher === "managed";
+			const fetches = managedApply && await reusableRuntime(core.paths.dataDir, product.packageName, version) === null;
+			const checksDisk = managedApply && !fetches && deps.verifyRelease !== void 0;
+			const from = sources();
+			const running = deps.running ?? (own === void 0 ? void 0 : {
+				packageName: own.packageName,
+				version: own.version
+			});
+			const unverifiedOwn = fetches && deps.verifyRelease === void 0 && running !== void 0 && running.packageName === product.packageName && running.version === version;
+			const verified = fetches && !unverifiedOwn || checksDisk ? (await verifyReleaseSet(from, /* @__PURE__ */ new Map([[product.packageName, version]]), "install", from.registry === null || from.verify === null ? verifyInCore() : void 0)).get(product.packageName) : void 0;
 			planned = {
 				product,
-				install: plannedInstall(preflight)
+				install: plannedInstall(preflight),
+				verified,
+				unverifiedOwn
 			};
 			const effects = [];
 			if (target.writes) {
@@ -11542,7 +13313,8 @@ function serverInstallChange(core, env, request, own, deps = {}) {
 				if (launcher === "npx") effects.push(`${request.client} will fetch ${facts.npxPackage}@${version} from npm each time it starts it`);
 				else if (launcher === "local") effects.push(`${request.client} will start it from ${await localCliEntry(product.moduleUrl)}`);
 			}
-			if (request.print !== true && launcher === "managed" && await reusableRuntime(core.paths.dataDir, facts.packageName, version) === null) effects.push(`installs ${facts.packageName}@${version} from npm into ${managedRuntimeDir(core.paths.dataDir, facts.packageName, version)}`);
+			if (fetches) effects.push(`installs ${facts.packageName}@${version} from npm into ${managedRuntimeDir(core.paths.dataDir, facts.packageName, version)}`);
+			if (request.print !== true && launcher === "managed") effects.push(launcherSwitchEffect(core.paths.dataDir, facts.packageName, label, version));
 			if (request.print !== true && launcher === "managed" && managedShimsSupported(context)) {
 				const path = managedShimPath({
 					env,
@@ -11551,6 +13323,8 @@ function serverInstallChange(core, env, request, own, deps = {}) {
 				}, facts.binary);
 				effects.push(`writes or repoints the owned CLI shim at ${path}; a foreign file there is left unchanged`);
 			}
+			if (verified !== void 0 && fetches) effects.push(`${verified.package}@${verified.version} was verified before this preview: built by ${BUILT_BY}`);
+			else if (unverifiedOwn) effects.push(`${product.packageName}@${version} will not be verified: this command cannot check provenance, so it installs the release it is running itself; core's \`${coreWords().join(" ")}\` checks it before it installs it`);
 			return {
 				before: config,
 				after: config,
@@ -11560,18 +13334,30 @@ function serverInstallChange(core, env, request, own, deps = {}) {
 		},
 		apply: async () => {
 			if (planned === void 0) throw new CommsError("UNEXPECTED", "the registration was applied before it was planned");
+			const provenance = request.print !== true && launcher === "managed" ? await verifiedRuntime(planned) : void 0;
 			const installed = await mcpInstall(context, planned.product, installOptions(request), planned.install).catch(async (error) => {
 				throw await remedyLocated(error, core);
 			});
 			const result = request.print === true ? installed : await withManagedShim(context, planned.product, installed);
 			return {
 				...result,
+				...provenance?.note === void 0 ? {} : { warnings: [...result.warnings, provenance.note] },
+				...provenance === void 0 ? {} : { provenance },
 				restart: result.applied ? `Restart ${request.client} to load "${result.name}": no MCP client loads a new server into a session that is already running.` : null
 			};
 		}
 	};
 }
 /**
+* What a managed install or update does to the product's stable launcher, as the preview says it (design 2026-10-16,
+* U6): it points it at the release's runtime, and every registration of the product that starts it — in any client —
+* runs that release from its next start.
+*/
+function launcherSwitchEffect(dataDir, packageName, label, version) {
+	const { launcher } = launcherPaths(dataDir, launcherName(packageName));
+	return `points the stable launcher ${launcher} at ${managedRuntimeDir(dataDir, packageName, version)}: every ${label} registration on this machine that starts it runs ${version} from its next start`;
+}
+/**
 * A managed install's CLI shim (CUE-406), once the registration's outcome is known: the command the locator finds in
 * the runtime the entry starts, written where nothing is or over this installation's own unchanged shim, and never
 * over anything else. A shim that cannot be written leaves the registration as it went, and says how to repair both.
@@ -11579,8 +13365,6 @@ function serverInstallChange(core, env, request, own, deps = {}) {
 */
 async function withManagedShim(context, product, installed) {
 	if (installed.launcher !== "managed") return installed;
-	const cliEntry = installed.entry.args[0];
-	if (cliEntry === void 0) throw new CommsError("UNEXPECTED", "the managed entry has no CLI path");
 	const shimContext = {
 		env: context.env,
 		dataDir: context.core.paths.dataDir,
@@ -11594,6 +13378,11 @@ async function withManagedShim(context, product, installed) {
 	let shim;
 	let shimFailure;
 	try {
+		const name = launcherName(product.packageName);
+		const { launcher } = launcherPaths(context.core.paths.dataDir, name);
+		const pointer = await readPointer(context.core.paths.dataDir, name);
+		if (pointer === void 0) throw new CommsError("CONFIG", `the stable launcher ${launcher} has no pointer, so it starts nothing yet`);
+		const cliEntry = launcherCli(pointer.current, name);
 		const located = locateCliCommand({
 			caller: {
 				url: pathToFileURL(cliEntry).href,
@@ -11612,13 +13401,14 @@ async function withManagedShim(context, product, installed) {
 				...context.core.paths,
 				downloadsDir: context.core.paths.dataDir
 			},
-			platform: context.platform
+			platform: context.platform,
+			env: context.env
 		});
 		if (!located.ok) throw new CommsError("CONFIG", `the managed CLI command could not be located: ${located.message}`);
 		shim = await (context.writeShim ?? writeManagedShim)(shimContext, {
 			binary: product.binary,
-			command: located.command.words,
-			entry: located.command.entry
+			command: [launcher],
+			entry: launcher
 		});
 	} catch (error) {
 		shimFailure = error instanceof Error ? error.message : String(error);
@@ -11631,334 +13421,88 @@ async function withManagedShim(context, product, installed) {
 		warnings,
 		...shim === void 0 ? {} : { shim },
 		...shimFailure === void 0 ? {} : { shimFailure }
-	};
-}
-/**
-* A refusal of `mcp install` with its remedy — another install of the same product — said with the command located:
-* the printing package's own, core's, or another product's found among this machine's registrations (CUE-403). The
-* installer says only the words; it may not import the locator.
-*/
-async function remedyLocated(error, core) {
-	const remedy = installRemedyOf(error);
-	if (remedy === void 0 || !(error instanceof CommsError)) return error;
-	const server = SERVERS.find((each) => serverFacts(each).binary === remedy.binary);
-	if (server === void 0) return error;
-	const maker = await requireHandoffs(core).registered();
-	const handoff = isChannel(server) ? maker.of(server, remedy.words) : maker.core([
-		"mcp",
-		"install",
-		"--server",
-		server,
-		...remedy.words.slice(2)
-	]);
-	return new CommsError(error.code, error.message, {
-		hint: handoffSentence(handoff, remedy.say),
-		...error.details === void 0 ? {} : { details: error.details },
-		...error.cause === void 0 ? {} : { cause: error.cause }
-	});
-}
-/**
-* Removing a declared server's unused managed runtimes, as a change.
-*
-* A dry run is free: it removes nothing. Otherwise the plan is that same dry run, and each runtime it would remove is
-* one effect — the removal cannot be taken back — so the approval is bound to exactly that list; and the removal is
-* then restricted to it (`only`), so a runtime that became unused after the list was shown stays.
-*
-* `own` is the calling channel's product, from its own `mcp prune`, so the runtime kept as "this release" is the
-* release of the command that was run; checked to be that channel's, as for an install.
-*/
-function serverPruneChange(core, env, request, own) {
-	if (!isServer(request.channel)) throw new CommsError("USAGE", `"${String(request.channel)}" is not a channel`, { hint: `One of: ${CHANNELS.join(", ")}.` });
-	const context = {
-		env,
-		core
-	};
-	const { packageName, version } = ownProduct(request.channel, own) ?? {
-		packageName: serverFacts(request.channel).packageName,
-		version: "0.18.2"
-	};
-	const product = {
-		packageName,
-		version
-	};
-	const label = serverLabel(request.channel);
-	const base = {
-		includePrinted: request.includePrinted === true,
-		...request.processes ? { processes: request.processes } : {}
-	};
-	let approved = [];
-	return {
-		plan: async (config) => {
-			if (request.dryRun) return {
-				before: config,
-				after: config,
-				summary: `Show which ${label} runtimes are unused`
-			};
-			const preview = await pruneManagedRuntimes(context, product, {
-				...base,
-				dryRun: true
-			});
-			approved = preview.removed.map((item) => item.path);
-			return {
-				before: config,
-				after: config,
-				effects: [...preview.removed.map((item) => `deletes the unused ${label} runtime ${item.version} at ${item.path}`), ...preview.shims.removed.map((path) => `deletes the owned ${label} CLI shim at ${path}`)],
-				summary: `Remove ${approved.length} unused ${label} runtime${approved.length === 1 ? "" : "s"}`
-			};
-		},
-		apply: () => pruneManagedRuntimes(context, product, {
-			...base,
-			dryRun: request.dryRun === true,
-			...request.dryRun ? {} : { only: approved }
-		})
-	};
-}
-/**
-* The daily update check, as every server and command reads it (design 2026-09-28): one file per machine,
-* `update-check.json` in the state directory, saying when the registry was last asked, the latest release it named,
-* whether this machine's registrations were behind it, and any "not now" with when it runs out.
-*
-* This is the reader, and it has **no network code at all**: it reads and writes that file, and says what it means.
-* Asking the registry is the checker's (`update-check.ts`), which every server and command but WhatsApp's also
-* imports. WhatsApp's package promises it reaches no network — `packages/whatsapp/test/no-network.test.ts` holds it to
-* that — so it imports only this, and learns of an update once any other server or command on the machine has asked.
-*/
-/** The file, in the state directory: one per machine, shared by every server and command on it. */
-const UPDATE_CHECK_FILE = "update-check.json";
-/**
-* The switch that turns the whole thing off for one process — no check, no stop — whatever the setting says. Every
-* test harness and every script here that runs a command or a server sets it, so no test and no verify step asks the
-* real registry.
-*/
-const UPDATE_CHECK_ENV = "AGENT_COMMS_UPDATE_CHECK";
-/**
-* Set by what starts a server from a release it pins itself — the Claude Code plugin's launcher, the Gemini
-* extension's manifest — to say so: `claude-code-plugin`, `gemini-extension`. No registration here names that server,
-* and `comms_update` never moves it; it changes when the plugin or the extension is updated. So its stop always says
-* "update", whatever the channel's registrations say: restarting would start the release the plugin pins.
-*/
-const UPDATE_STARTED_BY_ENV = "AGENT_COMMS_STARTED_BY";
-/** What the stop says first, word for word: the owner's words. */
-const UPDATE_FIRST = "Hang on a minute, there's an update. Let's update first.";
-const EMPTY_UPDATE_CHECK = Object.freeze({
-	lastChecked: null,
-	latest: null,
-	behind: null,
-	current: null,
-	lastError: null,
-	snoozedUntil: null,
-	checking: null
-});
-function updateCheckPath(stateDir) {
-	return join(stateDir, UPDATE_CHECK_FILE);
-}
-const isTime = (value) => typeof value === "string" && Number.isFinite(Date.parse(value));
-const isWords = (value) => Array.isArray(value) && value.every((word) => typeof word === "string");
-function readCurrent(value) {
-	if (typeof value !== "object" || value === null) return null;
-	const { registered, global } = value;
-	return isWords(registered) && isWords(global) ? {
-		registered: [...registered],
-		global: [...global]
-	} : null;
-}
-/**
-* The record as the file holds it, each field checked on its own: one that is missing or not what it should be reads
-* as not known. A file that is missing, unreadable or not JSON is an empty record — never a reason to stop anything.
-*/
-async function readUpdateCheck(stateDir) {
-	let parsed;
-	try {
-		parsed = JSON.parse(await readFile(updateCheckPath(stateDir), "utf8"));
-	} catch {
-		return { ...EMPTY_UPDATE_CHECK };
-	}
-	const held = typeof parsed === "object" && parsed !== null ? parsed : {};
-	return {
-		lastChecked: isTime(held.lastChecked) ? held.lastChecked : null,
-		latest: isVersion(held.latest) ? held.latest : null,
-		behind: typeof held.behind === "boolean" ? held.behind : null,
-		current: readCurrent(held.current),
-		lastError: typeof held.lastError === "string" ? held.lastError.slice(0, 300) : null,
-		snoozedUntil: isTime(held.snoozedUntil) ? held.snoozedUntil : null,
-		checking: isTime(held.checking) ? held.checking : null
-	};
-}
-/**
-* Reads the record, changes it and writes it back, under a lock beside it, atomically — so a server recording a check
-* and a person's "not now" arriving at the same moment each keep what the other wrote. Returns what `change` returned
-* alongside the record written; `change` returning `null` writes nothing.
-*/
-async function changeUpdateCheck(stateDir, change) {
-	return withFileLock(join(stateDir, ".update-check.lock"), async () => {
-		const current = await readUpdateCheck(stateDir);
-		const next = change(current);
-		if (next === null) return {
-			record: current,
-			result: void 0,
-			written: false
-		};
-		await writeFileAtomic(updateCheckPath(stateDir), `${JSON.stringify(next.record, null, 2)}\n`);
-		return {
-			record: next.record,
-			result: next.result,
-			written: true
-		};
-	}, { timeoutMs: 2e3 });
-}
-/**
-* Whether the check is due: never asked, asked a day or more ago, or — a clock that went back — asked more than a few
-* minutes in the future. A few minutes are allowed for, because two processes' clocks are read at slightly different
-* moments, and a check just claimed by one must not look due to the other.
-*/
-function updateCheckDue(record, now) {
-	if (record.lastChecked === null) return true;
-	const since = now.getTime() - Date.parse(record.lastChecked);
-	return !(since >= -CLOCK_SKEW_MS && since < 864e5);
-}
-const CLOCK_SKEW_MS = 3e5;
-/** What turned the check off for this process, from its environment: `CI`, or the switch. Null when neither did. */
-function updateCheckSwitchedOff(env) {
-	if (env.CI && env.CI !== "0" && env.CI !== "false") return "CI";
-	const value = env[UPDATE_CHECK_ENV]?.trim().toLowerCase();
-	if (value !== void 0 && [
-		"off",
-		"0",
-		"false",
-		"no"
-	].includes(value)) return UPDATE_CHECK_ENV;
-	return null;
-}
-/** Whether a check may run at all, and if not, what turned it off: the environment first, then the machine's setting. */
-async function updateCheckEnabled(core, env) {
-	const switched = updateCheckSwitchedOff(env);
-	if (switched !== null) return {
-		on: false,
-		by: switched
-	};
-	return await machineSetting(core) === "off" ? {
-		on: false,
-		by: "setting"
-	} : { on: true };
-}
-/**
-* The machine's setting, from `config.json`. A configuration that cannot be read counts as `on`, the default: what is
-* wrong with it is for the doctor and the tools to say, and it must not quietly turn this off.
-*/
-async function machineSetting(core) {
-	try {
-		return updateCheckSetting(await core.config.load());
-	} catch {
-		return "on";
-	}
-}
-/** The start of the next local day: when a "not now" runs out. */
-function nextLocalMidnight(now) {
-	return new Date(now.getFullYear(), now.getMonth(), now.getDate() + 1, 0, 0, 0, 0);
-}
-/** A local time as a person reads it in a preview: `2026-09-29 00:00`. */
-function localStamp(at) {
-	const two = (value) => String(value).padStart(2, "0");
-	return `${at.getFullYear()}-${two(at.getMonth() + 1)}-${two(at.getDate())} ${two(at.getHours())}:${two(at.getMinutes())}`;
-}
-/** Whether a person's "not now" still holds. */
-function updateSnoozed(record, now) {
-	return record.snoozedUntil !== null && now.getTime() < Date.parse(record.snoozedUntil);
-}
-/**
-* The latest release as the check counts it: a version, and not a prerelease — 0.8.0-rc.1 is never an update anybody
-* is stopped for. Null when the file names none.
-*/
-function countedLatest(record) {
-	return record.latest !== null && isVersion(record.latest) && !isPrerelease(record.latest) ? record.latest : null;
+	};
 }
 /**
-* What the record means for a process running `running`, ignoring any "not now": null when there is nothing newer.
-*
-* `restart` only on the check's positive finding about this very server or command (`current`): a server whose every
-* registration names `latest`, or a command whose package is installed globally at `latest`. Anything else — no
-* registration the scan could see (a plugin's, an extension's, one written by hand), one that pins no release, a
-* configuration it could not read, a check that found out nothing — is `update`: restarting would start the same old
-* code, and a reply that said to restart would stop every call with advice that cannot work.
+* A refusal of `mcp install` with its remedy — another install of the same product — said with the command located:
+* the printing package's own, core's, or another product's found among this machine's registrations (CUE-403). The
+* installer says only the words; it may not import the locator.
 */
-function updateVerdict(record, running, where) {
-	const latest = countedLatest(record);
-	if (latest === null || !isVersion(running) || !isBehind(running, latest)) return null;
-	return {
-		kind: (where.surface === "server" ? record.current?.registered : record.current?.global)?.includes(where.channel) === true ? "restart" : "update",
-		running,
-		latest
-	};
+async function remedyLocated(error, core) {
+	const remedy = installRemedyOf(error);
+	if (remedy === void 0 || !(error instanceof CommsError)) return error;
+	const server = SERVERS.find((each) => serverFacts(each).binary === remedy.binary);
+	if (server === void 0) return error;
+	const maker = await requireHandoffs(core).registered();
+	const handoff = isChannel(server) ? maker.of(server, remedy.words) : maker.core([
+		"mcp",
+		"install",
+		"--server",
+		server,
+		...remedy.words.slice(2)
+	]);
+	return new CommsError(error.code, error.message, {
+		hint: handoffSentence(handoff, remedy.say),
+		...error.details === void 0 ? {} : { details: error.details },
+		...error.cause === void 0 ? {} : { cause: error.cause }
+	});
 }
 /**
-* The update that stops this process now, from the file as it is — or null: switched off, snoozed, or nothing newer.
-* Reads two files and asks nobody.
+* Removing a declared server's unused managed runtimes, as a change.
+*
+* A dry run is free: it removes nothing. Otherwise the plan is that same dry run, and each runtime it would remove is
+* one effect — the removal cannot be taken back — so the approval is bound to exactly that list; and the removal is
+* then restricted to it (`only`), so a runtime that became unused after the list was shown stays.
 *
-* "Restart" is decided per channel, from its registrations, and a server a plugin or an extension started is not one
-* of them (`UPDATE_STARTED_BY_ENV`): beside a registration the update moved, it was told to restart every day, and
-* restarting started the release the plugin pins. It is told to update.
+* `own` is the calling channel's product, from its own `mcp prune`, so the runtime kept as "this release" is the
+* release of the command that was run; checked to be that channel's, as for an install.
 */
-async function pendingUpdate(options) {
-	if (!(await updateCheckEnabled(options.core, options.env)).on) return null;
-	const record = await readUpdateCheck(options.core.paths.stateDir);
-	if (updateSnoozed(record, (options.now ?? (() => /* @__PURE__ */ new Date()))())) return null;
-	const verdict = updateVerdict(record, options.running, options);
-	const startedBy = options.env[UPDATE_STARTED_BY_ENV]?.trim();
-	if (verdict?.kind === "restart" && options.surface === "server" && startedBy) return {
-		...verdict,
-		kind: "update"
+function serverPruneChange(core, env, request, own) {
+	if (!isServer(request.channel)) throw new CommsError("USAGE", `"${String(request.channel)}" is not a channel`, { hint: `One of: ${CHANNELS.join(", ")}.` });
+	const context = {
+		env,
+		core
 	};
-	return verdict;
-}
-function updateCommands(core, platform) {
-	const handoffs = requireHandoffs(core, platform);
-	return {
-		update: handoffs.core(["update"]),
-		later: handoffs.core(["update", "--later"])
+	const { packageName, version } = ownProduct(request.channel, own) ?? {
+		packageName: serverFacts(request.channel).packageName,
+		version: "0.20.0"
 	};
-}
-/** One of them in a sentence `say` makes: in backticks, or, with no command here, the sentence saying why. */
-function updateCommandSaid(commands, which, say) {
-	return handoffSentence(commands[which], say);
-}
-function updateWaysOf(commands) {
+	const product = {
+		packageName,
+		version
+	};
+	const label = serverLabel(request.channel);
+	const base = {
+		includePrinted: request.includePrinted === true,
+		...request.processes ? { processes: request.processes } : {}
+	};
+	let approved = [];
 	return {
-		update: {
-			tool: "comms_update",
-			command: commands.update
+		plan: async (config) => {
+			if (request.dryRun) return {
+				before: config,
+				after: config,
+				summary: `Show which ${label} runtimes are unused`
+			};
+			const preview = await pruneManagedRuntimes(context, product, {
+				...base,
+				dryRun: true
+			});
+			approved = preview.removed.map((item) => item.path);
+			return {
+				before: config,
+				after: config,
+				effects: [...preview.removed.map((item) => `deletes the unused ${label} runtime ${item.version} at ${item.path}`), ...preview.shims.removed.map((path) => `deletes the owned ${label} CLI shim at ${path}`)],
+				summary: `Remove ${approved.length} unused ${label} runtime${approved.length === 1 ? "" : "s"}`
+			};
 		},
-		later: {
-			tool: "comms_update",
-			arguments: { later: true },
-			command: commands.later
-		}
+		apply: () => pruneManagedRuntimes(context, product, {
+			...base,
+			dryRun: request.dryRun === true,
+			...request.dryRun ? {} : { only: approved }
+		})
 	};
 }
-/** A channel's product name, from core's snapshot of the manifests: `Gmail`. */
-function labelOf(channel) {
-	return CHANNEL_SNAPSHOT.find((entry) => entry.manifest.channel === channel)?.manifest.label ?? channel;
-}
-/**
-* What a stopped tool call says, in words an agent passes on: the owner's sentence first, then the versions, then the
-* two ways on — the update, from chat or a terminal, or "not now", which the person approves like any other change.
-*/
-function updateStopMessage(pending, where, commands) {
-	const server = where.channel === "core" ? "the core server" : `the ${labelOf(where.channel)} server`;
-	const didNotRun = `Nothing was done: ${where.tool} did not run.`;
-	const later = `Not now: call comms_update with \`later: true\` — a change the person approves — and nothing stops again until midnight; the next request after it asks again. ${updateCommandSaid(commands, "later", (command) => `At a terminal: ${command}.`)}`;
-	if (pending.kind === "restart") return [
-		"Hang on a minute, the update is installed, but this server isn't running it yet. Restart the client first.",
-		`This is ${server}, ${pending.running}; ${pending.latest} is installed on this machine — every registration of this server names it — and a client starts it only once it is restarted. ${didNotRun}`,
-		`Ask the person to restart the MCP client — quit it and open it again — and carry on after. ${later}`
-	].join("\n");
-	return [
-		UPDATE_FIRST,
-		`This is ${server}, ${pending.running}; the latest release is ${pending.latest}. ${didNotRun}`,
-		"Ask the person which they want:",
-		`- Update now: call comms_update on the core server. It shows every step and asks before it changes anything; restart the client after. ${updateCommandSaid(commands, "update", (command) => `At a terminal: ${command}.`)} A server comms_update does not find registered here — a plugin's, an extension's — is updated where it was installed.`,
-		`- ${later}`
-	].join("\n");
-}
 /**
 * Bringing a machine to the latest release, from a terminal (`agentcomms update`) or a chat (`comms_update`).
 *
@@ -11973,6 +13517,11 @@ function updateStopMessage(pending, where, commands) {
 * The check reads and asks nobody. The update is a change whose effects are every step, one sentence each, so the
 * approval is bound to exactly that list — the versions in it included: a release published between the question and
 * the yes is a different change, and the claim is refused. Nothing behind, nothing is prepared.
+*
+* A registration that starts the stable launcher (design 2026-10-16, U6) is not registered again: the update installs
+* the latest runtime and switches the launcher's pointer, and no client's configuration is touched. A managed
+* registration from before the launcher names a versioned runtime; the update registers it again on the launcher —
+* the one update that edits it — even when it is already at the latest release.
 */
 /**
 * The packages this suite publishes, whose latest releases an update reads: every declared server owner's, from the
@@ -11984,149 +13533,253 @@ const SERVER_PACKAGES = Object.freeze(SERVERS.map((server) => serverFacts(server
 Object.freeze([.../* @__PURE__ */ new Set([...OWNER_PACKAGES, ...SERVER_PACKAGES])].sort());
 serverFacts("core").packageName;
 /**
-* "Not now": no server or command on this machine stops for the update until the next local midnight.
-*
-* `plan` reads the file on both calls, so a claim made after midnight — a different midnight in the sentence — or
-* for a newer release is a different change, and refused.
-*/
-function updateLaterChange(core, options = {}) {
-	const now = options.now ?? (() => /* @__PURE__ */ new Date());
-	let planned = null;
-	return {
-		plan: async (config) => {
-			const record = await readUpdateCheck(core.paths.stateDir);
-			const until = nextLocalMidnight(now());
-			const latest = countedLatest(record);
-			const changed = record.snoozedUntil === null || Date.parse(record.snoozedUntil) < until.getTime();
-			planned = {
-				until,
-				latest,
-				changed
-			};
-			const what = latest === null ? "the daily update check" : `the update to ${latest}`;
-			return {
-				before: config,
-				after: config,
-				effects: changed ? [`puts off ${what} until midnight, local time (${localStamp(until)}): until then no server or command on this machine stops for it, and the first request after asks again`] : [],
-				summary: latest === null ? "Skip the daily update check until tomorrow" : `Skip the update to ${latest} until tomorrow`
-			};
-		},
-		apply: async () => {
-			if (planned === null) throw new CommsError("UNEXPECTED", "not now was applied before it was planned");
-			const { until, latest, changed } = planned;
-			if (changed) await changeUpdateCheck(core.paths.stateDir, (record) => ({ record: {
-				...record,
-				snoozedUntil: until.toISOString()
-			} }));
-			return {
-				snoozedUntil: (await readUpdateCheck(core.paths.stateDir)).snoozedUntil,
-				latest,
-				changed
-			};
-		}
-	};
-}
-Object.freeze({
-	kind: "send",
-	lookup: true
-});
-Object.freeze({ kind: "change" });
-Object.freeze({
-	kind: "download",
-	argument: "choiceId"
-});
-/**
-* Whether a call claims an approval the person already gave (§2): an approval this machine's approval store holds —
-* every channel keeps its approvals there — that is still waiting to be used, pending or approved, and of the kind the
-* call takes where the surface says which. Only then does the call go past the stop.
-*
-* The key alone is not a claim. An empty `approvalId`, or an id nobody prepared, claims nothing, and let past it
-* would run the tool's first-call path with an update out — a preview, or a tightening applied at once. Each tool
-* refuses an approval it does not know anyway; the stop must not be what an unknown one walks around. The store
-* refuses anything that is not an approval id before it looks, so that is not checked twice.
+* The update notice, where every server and every command meets it (design 2026-10-16, U1). It replaces the stop of
+* the daily update check (design 2026-09-28): nothing is refused for being behind any more. A server's first tool
+* result of its process carries one line beside the result; a command prints the same line once on stderr, at most
+* once a day for the machine, and runs.
 *
-* Nor is every id the store holds. Records stay in it after they are used, revoked or expired, and one of those let
-* any call past the stop for as long as it was kept: an old "not now" the person turned down walked `agentcomms
-* channels` straight through. Such a record claims nothing any more — there is nothing left of it for the person to
-* lose by waiting — except to a look-up (`lookup`), which only reads it.
-*
-* What is not checked here is that the approval was prepared for this very call. The store binds a change to its
-* digest, and a send to its draft, which only the tool can compute; it does, when it claims the approval, and refuses
-* any other. A change that needs no approval claims none, and refuses one it is handed (`gatedChange`), so an approval
-* prepared for another change gets a call past the stop only to that refusal.
+* Reader only, like `update-state.ts`: what asks the registry is handed in — `refresh` to a server's notice, `check` to
+* a command's — by every package but WhatsApp, which has no network code and hands in nothing.
 */
-async function claimsApproval(core, id, claim = {}) {
-	if (typeof id !== "string") return false;
-	const seen = await core.approvals.inspect(id, claim.kind === void 0 ? {} : { kind: claim.kind }).catch(() => null);
-	if (seen === null) return false;
-	const { stored, outcome } = seen;
-	if (claim.lookup === true) return stored.form === "v2" || stored.form === "legacy";
-	return stored.form === "v2" && (outcome.state === "pending" || outcome.claimable);
-}
+/** The product, as a notice names it: never a command's name, which a sentence would read as one to run (CUE-403). */
+const PRODUCT = "agent-communications";
 /**
-* A server's gate. Before a tool runs: if a newer release is out, this machine has not put it off today, the check is
-* on — the setting, `CI` and `AGENT_COMMS_UPDATE_CHECK` — the tool is not exempt, and the call claims no approval the
-* person already gave, the tool does not run and the call is answered with the stop.
+* A server's notice. After a tool answers: if a newer release is out, the machine's level says so (`decideNotice`),
+* and the tool is not exempt, the result carries one line, and no later result of this process carries it again.
+* Nothing is ever refused, and nothing waits for the check: the file is read as it is.
 *
-* The file is read as it is: the check itself never delays a call. A call carrying the id of an approval this machine
-* holds goes ahead — the person said yes to exactly it, perhaps moments before the check landed — and the stop applies
-* from the next new request (§2, as agreed).
+* At most once per process, on the first result there is something to say on: a server started on a day the check is
+* due learns of the release a moment after its first call, and says so on the next.
 */
-function updateToolGate(options) {
+function updateToolNotice(options) {
 	const exempt = new Set(options.exempt);
 	let running = null;
-	return async (tool, args) => {
-		if (updateCheckSwitchedOff(options.env) !== null) return null;
+	let given = false;
+	let turn = Promise.resolve();
+	return (tool) => {
+		if (updateCheckSwitchedOff(options.env) !== null) return Promise.resolve(null);
 		if (options.refresh && running === null) running = options.refresh().catch(() => void 0).finally(() => {
 			running = null;
 		});
-		if (exempt.has(tool)) return null;
-		const pending = await pendingUpdate({
-			...options,
-			surface: "server"
+		if (given || exempt.has(tool)) return Promise.resolve(null);
+		const decided = turn.then(async () => {
+			if (given) return null;
+			const decision = await decideNotice(options, {
+				channel: options.channel,
+				surface: "server"
+			});
+			if (decision === null) return null;
+			given = true;
+			return serverDecisionLine(decision, options.env);
 		});
-		if (pending === null) return null;
-		const claim = options.approvals?.[tool];
-		if (await claimsApproval(options.core, args[claim?.argument ?? "approvalId"], claim)) return null;
-		return stoppedCall(pending, {
-			server: options.server,
-			channel: options.channel,
-			tool
-		}, updateCommands(options.core));
+		turn = decided.catch(() => null);
+		return decided.catch(() => null);
 	};
 }
+/** How long a command's notice is good for, by level: a day, or 14 days on `every-14-days`. */
+function spacingOf(updates, surface) {
+	if (updates.level === "every-14-days") return SPACED_INTERVAL_MS;
+	return surface === "command" ? COMMAND_NOTICE_INTERVAL_MS : null;
+}
+const majorOf = (version) => Number(version.split(".")[0]);
 /**
-* The answer to a stopped call. Its text opens with the owner's sentence, word for word, and says the rest in prose:
-* a client that shows the model only text blocks (Cursor) reads it there. Claude Code and Codex show only
-* `structuredContent`, so the same words are its `message`, with the versions and the two ways on beside them.
+* What the record means for this process's notice now — or null, with nothing written — decided and recorded under the
+* file's lock, so two processes deciding together say it once where the level says once (design 2026-10-16, U2, U3,
+* U7):
+*
+* - switched off for the process — `CI`, `AGENT_COMMS_UPDATE_CHECK=off`, `AGENT_COMMS_UPDATES=never` — nothing;
+* - a security fix (the latest release's manifest says so) is said on `every-14-days`, on `never`, and on `auto` while
+*   its background job is not set up, whatever the pause or the 14-day spacing: the job installs one within a day;
+* - otherwise nothing on `never`, nothing during a pause, and on `auto` with its job set up only what needs the person:
+*   a restart, a major release, a release needing a decision;
+* - `every-14-days` says it at most once in 14 days for the machine, and a command at most once a day.
+*
+* Beside it, by the same rules of level and pause: what the last background run left (U5 step 7), said by the first
+* process it applies to and then cleared from the file — "installed" applies only to a process behind what was
+* installed — and the registrations still naming a versioned runtime (U6), spaced as the notice is.
 */
-function stoppedCall(pending, where, commands) {
-	const message = updateStopMessage(pending, where, commands);
-	const ways = updateWaysOf(commands);
-	const leaving = (value) => JSON.parse(JSON.stringify(value));
-	return {
-		isError: true,
-		content: [{
-			type: "text",
-			text: message
-		}],
-		structuredContent: leaving({ error: {
-			code: "UPDATE_REQUIRED",
-			message,
-			hint: pending.kind === "restart" ? "Restart the MCP client, or put the stop off until midnight with comms_update `later: true` once the person agrees." : "Update with comms_update (the person approves its preview), or put it off until midnight with comms_update `later: true` once the person agrees.",
-			details: {
-				tool: where.tool,
-				server: where.server,
-				running: pending.running,
-				latest: pending.latest,
-				installed: pending.kind === "restart",
-				update: ways.update,
-				later: ways.later
+async function decideNotice(options, where) {
+	if (updateCheckSwitchedOff(options.env) !== null) return null;
+	const now = options.now ?? (() => /* @__PURE__ */ new Date());
+	const updates = await effectiveUpdates(options.core, options.env, now());
+	const startedBy = options.env[UPDATE_STARTED_BY_ENV]?.trim();
+	const offerJob = updates.level === "auto" && !updates.background && await jobCanBeSetUp(options.core, updates);
+	const spacing = spacingOf(updates, where.surface);
+	const reach = updates.background ? await jobReach(options.core, options.env, where.channel) : null;
+	/** What the level and the spacing let this process say now, or null: decided once as read, then under the lock. */
+	const due = (record, at) => {
+		let notice = noticeOf(record, options.running, where, updates, at, reach);
+		const last = where.surface === "command" && updates.level !== "every-14-days" ? record.commandNoticeAt : record.noticeAt;
+		const spaced = spacing !== null && within(last, at, spacing);
+		if (notice !== null) {
+			if (!notice.security) {
+				if (spaced) notice = null;
+			} else if (where.surface === "command" && within(record.commandNoticeAt, at, 864e5)) notice = null;
+		}
+		const quiet = updates.level === "never" || pauseEnd(record, at) !== null;
+		const background = quiet ? null : backgroundFor(record.backgroundNotice, options.running);
+		const moves = quiet || spaced ? 0 : record.moves ?? 0;
+		const jobSilent = quiet || spaced ? null : updates.jobSilent?.since ?? null;
+		if (notice === null && background === null && moves === 0 && jobSilent === null) return null;
+		return {
+			notice,
+			background,
+			moves,
+			jobSilent,
+			offerJob: offerJob && (notice !== null || jobSilent !== null)
+		};
+	};
+	if (due(await readUpdateCheck(options.core.paths.stateDir), now()) === null) return null;
+	return (await changeUpdateCheck(options.core.paths.stateDir, (record) => {
+		const at = now();
+		const decision = due(record, at);
+		if (decision === null) return null;
+		const stamp = at.toISOString();
+		const spaces = decision.notice !== null || decision.moves > 0 || (decision.jobSilent ?? null) !== null;
+		const written = {
+			...record,
+			...spaces ? { noticeAt: stamp } : {},
+			...spaces && where.surface === "command" ? { commandNoticeAt: stamp } : {},
+			...decision.background !== null ? { backgroundNotice: null } : {}
+		};
+		const { notice } = decision;
+		const kind = notice?.kind === "restart" && where.surface === "server" && startedBy ? "update" : notice?.kind;
+		return {
+			record: written,
+			result: {
+				...decision,
+				notice: notice === null || kind === void 0 ? null : {
+					...notice,
+					kind
+				}
 			}
-		} })
+		};
+	})).result ?? null;
+}
+/**
+* What a background run left, when it is this process's to say: an install only to a process running a release before
+* it — one already running it has nothing to restart into — and anything else, a refusal, a skip, a removed job, to
+* any process.
+*/
+function backgroundFor(left, running) {
+	if (left === null || left === void 0) return null;
+	if (left.outcome !== "installed") return left;
+	return left.version !== null && isVersion(running) && isBehind(running, left.version) ? left : null;
+}
+/**
+* Whether the background job could be set up here, so offering it is not offering a refusal (design 2026-10-16 U4):
+* a platform it is written for, no organisation turning background updates off, and the stable core launcher it runs.
+*/
+async function jobCanBeSetUp(core, updates) {
+	if (updates.backgroundOff !== void 0 || !updateJobSupported(process.platform)) return false;
+	try {
+		return (await stat(launcherPaths(core.paths.dataDir, "core").launcher)).isFile();
+	} catch {
+		return false;
+	}
+}
+/** Whether the job reaches a process of `name`'s launcher (`JobReach`); null where it does not, or it cannot be read. */
+async function jobReach(core, env, name) {
+	const launched = env[LAUNCHER_ENV]?.trim();
+	if (name === void 0 || launched !== name) return null;
+	try {
+		const pointer = await readPointer(core.paths.dataDir, name);
+		if (pointer === void 0) return null;
+		const folder = basename(pointer.current);
+		const version = folder.endsWith(`-${name}`) ? folder.slice(0, -(name.length + 1)) : "";
+		return { pointed: isPlainVersion(version) ? version : null };
+	} catch {
+		return null;
+	}
+}
+/**
+* Whether the job covers a security fix for this process: it reaches it (`jobReach`), it installs the fix on its own —
+* not a new major, nor one needing a decision, which it leaves for the person — and its launcher does not start the
+* fix yet, so the job installs it within a day. Once it does, the process still runs the release before: it is told.
+*/
+function coveredByJob(reach, fix, record, running) {
+	if (reach === null) return false;
+	const from = reach.pointed ?? running;
+	if (!isVersion(from) || majorOf(fix) > majorOf(from) || record.release?.needsDecision === true) return false;
+	return !(reach.pointed !== null && !isBehind(reach.pointed, fix));
+}
+/** The notice the record makes for this process, before any spacing: see `decideNotice`. */
+function noticeOf(record, running, where, updates, at, reach) {
+	const pending = updateVerdict(record, running, where);
+	if (pending === null) return null;
+	const background = updates.background && reach !== null;
+	const fix = securityRelease(record, running);
+	const security = fix !== null && !(background && coveredByJob(reach, fix, record, running));
+	const pausedUntil = pauseEnd(record, at);
+	const facts = record.release?.version === pending.latest ? record.release : null;
+	const notice = {
+		...pending,
+		security,
+		major: background && isVersion(running) && majorOf(pending.latest) > majorOf(running),
+		needsDecision: background && facts?.needsDecision === true,
+		pausedUntil
 	};
+	if (security) return notice;
+	if (updates.level === "never" || pausedUntil !== null) return null;
+	if (background && pending.kind !== "restart" && !notice.major && !notice.needsDecision) return null;
+	return notice;
+}
+/** Who started a server from a release it pins itself, in words: the plugin's, the extension's. */
+function startedByWords(startedBy) {
+	if (startedBy === "claude-code-plugin") return "the Claude Code plugin";
+	if (startedBy === "gemini-extension") return "the Gemini extension";
+	return "a plugin or an extension";
+}
+/**
+* The server's line. "Installed" only on the check's positive finding that restarting starts `latest`; a server a
+* plugin or an extension started is updated where it was installed, which `comms_update` never moves.
+*/
+function serverNoticeLine(notice, env = {}) {
+	const paused = pausedWords(notice);
+	if (notice.kind === "restart") return `${PRODUCT} ${notice.latest} is installed; restart the client (in Claude Code, /mcp → Reconnect) to use it.${paused}`;
+	const startedBy = env[UPDATE_STARTED_BY_ENV]?.trim();
+	if (startedBy) return `${PRODUCT} ${notice.latest} is out${whatItIs(notice)}; this server came with ${startedByWords(startedBy)}, and is updated there ${notice.security ? "soon" : "when it suits you"}.${paused}`;
+	return `${PRODUCT} ${notice.latest} is out${whatItIs(notice)}; say "update" ${notice.security ? "soon" : "when it suits you"}.${paused}`;
+}
+/**
+* The line for a background job that has not run in 48 hours (U4, U7): as though there were none, every notice and the
+* security line are said again, and this says why, and where to look.
+*/
+function jobSilentLine(since) {
+	const at = new Date(since);
+	const day = Number.isFinite(at.getTime()) ? localStamp(at).slice(0, 10) : "it was set up";
+	return `${PRODUCT}: background updates have not run since ${day}; check Login Items (macOS) or run doctor.`;
+}
+/** How many registrations, in words: "one registration", "2 registrations". */
+const registrations = (count) => count === 1 ? "one registration" : `${count} registrations`;
+/**
+* A server's one line, from everything `decideNotice` decided: the background run's word first, then the release this
+* server is behind — unless the run's word is about that same release — then the move to the stable launcher, and the
+* offer of the background job.
+*/
+function serverDecisionLine(decision, env = {}) {
+	const { notice, background, moves } = decision;
+	const parts = [];
+	if (background !== null) parts.push(backgroundNoticeLine(background));
+	if (notice !== null && !(background !== null && background.version === notice.latest)) parts.push(serverNoticeLine(notice, env));
+	if (decision.jobSilent) parts.push(jobSilentLine(decision.jobSilent));
+	if (moves > 0) parts.push(notice !== null ? `The update also moves ${registrations(moves)} onto the stable launcher, the last update that edits a client's configuration.` : `${PRODUCT}: ${moves === 1 ? "one registration still starts" : `${moves} registrations still start`} a versioned runtime; one approved update (say "update") moves ${moves === 1 ? "it" : "them"} onto the stable launcher, after which updates never edit a client's configuration again.`);
+	if (decision.offerJob) parts.push("To have releases install in the background instead, comms_update with backgroundJob \"on\" sets up a daily job: its preview shows the job, when it runs and how to remove it, and sets nothing up without your yes.");
+	return parts.join(" ");
 }
-/** The commands never stopped, by their first word; `mcp` alone runs a server, which stops each call itself. */
+/** What is particular about the release, after "is out": a security fix, a major release, a decision it needs. */
+function whatItIs(notice) {
+	if (notice.security) return ", and fixes a security problem";
+	if (notice.major) return ", a major release, which waits for you";
+	if (notice.needsDecision) return ", and needs a decision from you before it installs";
+	return "";
+}
+/** Every notice during a pause says when it ends (U3): only a security fix is said then. */
+function pausedWords(notice) {
+	if (!notice.pausedUntil) return "";
+	return ` Updates are paused until ${localStamp(notice.pausedUntil)}; a security fix is not held.`;
+}
+/** The commands that never print the notice, by their first word; `mcp` alone runs a server, which has its own. */
 const EXEMPT_COMMANDS = Object.freeze([
 	"update",
 	"doctor",
@@ -12136,201 +13789,105 @@ const EXEMPT_COMMANDS = Object.freeze([
 	"help"
 ]);
 /**
-* Whether a command is left alone by the update gate: `update` in every form, `doctor`, `paths`, `approve`,
-* `approvals`, help, and `mcp` alone — the server, which gates every call itself. `mcp install` and `mcp prune` are
-* not: they register and prune at this command's release. `also` adds a channel's own — WhatsApp's `status`, its
-* doctor. `--help` and `--version` never reach a command.
+* Whether a command is left alone by the update notice: `update` in every form, `doctor`, `paths`, `approve`,
+* `approvals`, help, and `mcp` alone — the server, which gives its own notice. `mcp install` and `mcp prune` are not.
+* `also` adds a channel's own — WhatsApp's `status`, its doctor. `--help` and `--version` never reach a command.
 */
-function exemptFromUpdateGate(path, also = []) {
+function exemptFromUpdateNotice(path, also = []) {
 	const [first] = path;
 	if (first === void 0) return true;
 	if (EXEMPT_COMMANDS.includes(first) || also.includes(first)) return true;
 	return first === "mcp" && path.length === 1;
 }
-/** A Commander command's path below the program, `['mcp', 'install']`: what `exemptFromUpdateGate` reads. */
+/** A Commander command's path below the program, `['mcp', 'install']`: what `exemptFromUpdateNotice` reads. */
 function commandPathOf(command) {
 	const path = [];
 	for (let at = command; at?.parent; at = at.parent) path.unshift(at.name());
 	return path;
 }
+/** How often a command says it, for the whole machine: once a day. */
+const COMMAND_NOTICE_INTERVAL_MS = 864e5;
 /**
-* The approvals a Commander command claims: its `--approval`, the `--mcp-approval` Gmail's `setup` carries beside it,
-* the `--choice` a download carries its question's id in, and an argument named `approvalId` — `agent-gmail send
-* cancel <approvalId>`, `agent-resend send execute <approvalId>`, the commands whose tools take it as `approvalId`.
-* What the gate hands `claimsApproval`, as a tool call's `approvalId` is handed it. Commander has read the arguments
-* by the time a `preAction` hook runs.
-*/
-function approvalsOf(command) {
-	const options = command.opts();
-	const named = (command.registeredArguments ?? []).flatMap((argument, index) => argument.name() === "approvalId" ? [command.processedArgs?.[index]] : []);
-	return [
-		options.approval,
-		options.mcpApproval,
-		options.choice,
-		...named
-	];
-}
-/**
-* The update gate at a terminal, before a command runs. Resolves to null to run the command, or to the exit status to
-* end with instead; throws `UPDATE_REQUIRED` (exit 11) where nobody can be asked.
-*
-* It reads the file first. If the file is a day old it asks the registry — through `check` — waiting at most about
-* three seconds and going on without it after that. Then, when a newer release is out, nothing puts it off, and the
-* command claims no approval the person already gave:
+* The update notice at a terminal, before a command runs. It never stops the command, and never throws.
 *
-* - a person at a terminal (stdin and stdout a terminal, no `--json`, not `CI`, not an agent) is asked "Update now,
-*   later today, or cancel?". Now runs the update, with its own preview and yes, and ends asking them to run the
-*   command again; later records "not now" — their answer is the approval — and runs the command; cancel ends, having
-*   done nothing;
-* - anything else — a script, cron, an agent, `--json` — gets `UPDATE_REQUIRED`, naming `agentcomms update` and
-*   `agentcomms update --later`, and the command does not run.
-*
-* An update installed and not yet run by this command — this command's package is installed globally at the latest
-* release, and what is running is an older copy from somewhere else — stops it the same way, as the servers stop for
-* a client not yet restarted (§3: the terminal stops as chat does). Its "now" says to run the command again from the
-* installed one: there is nothing to update.
+* It reads the file first. If the check is due for the machine's level it asks the registry — through `check` — waiting
+* at most about three seconds and going on without it after that. Then, when the level says so (`decideNotice`), it
+* prints one line on stderr — never on stdout, where a result or `--json` is — and the command runs.
 */
-async function updateGateAtTerminal(options) {
-	const { core, env, streams, output } = options;
+async function updateNoticeAtTerminal(options) {
+	const { core, env, streams } = options;
 	const now = options.now ?? (() => /* @__PURE__ */ new Date());
-	if (!(await updateCheckEnabled(core, env)).on) return null;
-	if (options.check && updateCheckDue(await readUpdateCheck(core.paths.stateDir), now())) {
-		let timer;
-		const gaveUp = new Promise((resolve) => {
-			timer = setTimeout(resolve, options.waitMs ?? 3e3);
-		});
-		try {
-			await Promise.race([options.check().catch(() => void 0), gaveUp]);
-		} finally {
-			clearTimeout(timer);
+	try {
+		if (updateCheckSwitchedOff(env) !== null) return;
+		const enabled = await updateCheckEnabled(core, env);
+		if (enabled.on && options.check && updateCheckDue(await readUpdateCheck(core.paths.stateDir), now(), enabled.intervalMs)) {
+			let timer;
+			const gaveUp = new Promise((resolve) => {
+				timer = setTimeout(resolve, options.waitMs ?? 3e3);
+			});
+			try {
+				await Promise.race([options.check().catch(() => void 0), gaveUp]);
+			} finally {
+				clearTimeout(timer);
+			}
 		}
-	}
-	for (const id of options.approvals ?? []) if (await claimsApproval(core, id, options.approvalClaim)) return null;
-	const where = {
+		const line = await commandNotice(options, now);
+		if (line !== null) streams.stderr.write(`${line}\n`);
+	} catch {}
+}
+/** The command's line, decided and recorded under the file's lock: see `decideNotice`. */
+async function commandNotice(options, now) {
+	const decision = await decideNotice({
+		...options,
+		now
+	}, {
 		channel: options.channel,
 		surface: "command"
-	};
-	const pending = await pendingUpdate({
-		core,
-		env,
-		running: options.running,
-		now,
-		...where
-	});
-	if (pending === null) return null;
-	const person = agentMarker(env) === null && canPrompt(env, streams, {
-		json: output.json,
-		noInput: options.noInput === true
 	});
-	const commands = updateCommands(core, output.platform);
-	if (!person) throw updateRequired(pending, cliOf(options.channel), commands);
-	const bold = (word) => paint(output.color, "bold", word);
-	const answer = (await askLine(streams, pending.kind === "restart" ? `${pending.latest} is installed (this is ${pending.running}). Switch ${bold("now")}, ${bold("later")} today, or ${bold("cancel")}? ` : `${pending.latest} is out (you have ${pending.running}). Update ${bold("now")}, ${bold("later")} today, or ${bold("cancel")}? `)).trim().toLowerCase();
-	if (answer === "now" || answer === "update") {
-		if (pending.kind === "restart") {
-			streams.stdout.write(`${pending.latest} is installed globally; this ${cliOf(options.channel)} is ${pending.running}, started from somewhere else — npx's cache, a project's own install, a checkout. Run your command again from the installed one. The command did not run.\n`);
-			return EXIT_CODES.UPDATE;
-		}
-		if (!options.update) {
-			streams.stdout.write(`This ${cliOf(options.channel)} reads only this machine and cannot fetch the update itself. ${updateCommandSaid(commands, "update", (command) => `Run ${command}, then run your command again.`)}\n`);
-			return EXIT_CODES.UPDATE;
-		}
-		return afterUpdate(await options.update(), options, pending);
-	}
-	if (answer === "later" || answer === "l") {
-		const result = await gatedChangeAtTerminal(core, updateLaterChange(core, { now }), {
-			channel: options.channel,
-			env,
-			output,
-			rerun: ["update", "--later"],
-			rerunOn: "core",
-			answered: true,
-			streams
-		});
-		streams.stderr.write(`Put off until midnight${result.latest ? `: ${result.latest} will be asked about again tomorrow` : ""}.\n`);
-		return null;
-	}
-	throw new CommsError("USAGE", "cancelled: the command did not run, and nothing was changed", { hint: bothSaid(commands, (update, later) => `Update with ${update}, or put it off until tomorrow with ${later}.`) });
+	if (decision === null) return null;
+	return commandDecisionLine(options.core, decision, options.channel, options.output.platform);
 }
 /**
-* The CLI a gate stops, in product words — "Gmail CLI", "core CLI" — for its sentences: never its binary, which is no
-* command most people can run, and which a sentence would read as one (CUE-403).
+* The CLI a notice names, in product words — "Gmail CLI", "core CLI" — never its binary, which is no command most
+* people can run, and which a sentence would read as one (CUE-403).
 */
 function cliOf(channel) {
 	if (channel === "core") return "core CLI";
 	return `${CHANNEL_SNAPSHOT.find((entry) => entry.manifest.channel === channel)?.manifest.label ?? channel} CLI`;
 }
 /**
-* The stop where nobody can be asked: the command does not run. "Update" names the update and "not now"; "restart"
-* — the update installed, and an older copy running — says to run the command from the installed one.
+* The command's line: the update, as core's own command located from what is printing — or why there is none here —
+* or, when this command's package is installed globally at `latest` and an older copy is running, to run that one.
 */
-function updateRequired(pending, cli, commands) {
-	const ways = updateWaysOf(commands);
-	const details = {
-		running: pending.running,
-		latest: pending.latest,
-		installed: pending.kind === "restart",
-		update: ways.update,
-		later: ways.later
-	};
-	if (pending.kind === "restart") return new CommsError("UPDATE_REQUIRED", `Hang on a minute, the update is installed, but this command isn't running it yet. ${pending.latest} is installed globally, and this ${cli} is ${pending.running}: ${handoffSentence(commands.later, (later) => `run the command again from the installed one, or ${later} to put it off until tomorrow`)}`, {
-		hint: `Nothing was done. An older copy is running — npx's cache, a project's own install, a checkout. "Not now" is a change a person approves: an agent gets the preview and an approval id (exit 10), and runs the same command again with --approval <id> once the person agrees.`,
-		details
-	});
-	return new CommsError("UPDATE_REQUIRED", `${UPDATE_FIRST} ${pending.latest} is out (you have ${pending.running}): ${bothSaid(commands, (update, later) => `run ${update} first, or ${later} to put it off until tomorrow`)}`, {
-		hint: `Nothing was done. Both are changes a person approves: an agent gets the preview and an approval id (exit 10), and runs the same command again with --approval <id> once the person agrees.`,
-		details
-	});
-}
-/** The update and "not now" in one sentence; with no command here — the same core gives both or neither — why not. */
-function bothSaid(commands, say) {
-	return handoffSentence(commands.update, (update) => handoffSentence(commands.later, (later) => say(update, later)));
+function commandNoticeLine(core, notice, channel, platform) {
+	const paused = pausedWords(notice);
+	if (notice.kind === "restart") return `${PRODUCT} ${notice.latest} is installed; this ${cliOf(channel)} is ${notice.running}, started from somewhere else — npx's cache, a project's own install, a checkout: run it from the installed one.${paused}`;
+	const update = requireHandoffs(core, platform).core(["update"]);
+	const when = notice.security ? "soon" : "when it suits you";
+	return `${PRODUCT} ${notice.latest} is out${whatItIs(notice)} (this is ${notice.running}); ${handoffSentence(update, (command) => `run ${command} ${when}.`)}${paused}`;
 }
 /**
-* What the terminal says after the person's "now", and the exit status. "Updated. Run your command again." only when
-* the update did everything and this command's release is now installed where it runs from — its global package at
-* the latest. Anything short of that says what, and ends with a status that is not 0: the command has not run, and a
-* script that goes on after `cmd && next` must not take it for the command's success.
+* A command's one line, from everything `decideNotice` decided, as `serverDecisionLine` puts it together — every
+* command named located for this installation, or why there is none here.
 */
-async function afterUpdate(outcome, options, before) {
-	const { streams } = options;
-	const cli = cliOf(options.channel);
-	const notRun = "The command did not run";
-	const commands = updateCommands(options.core, options.output.platform);
-	if (outcome === "failed") {
-		streams.stdout.write(`${notRun}: the update did not finish — each step says how it went, above.\n`);
-		return EXIT_CODES.UNAVAILABLE;
-	}
-	const after = updateVerdict(await readUpdateCheck(options.core.paths.stateDir), options.running, {
-		channel: options.channel,
-		surface: "command"
-	});
-	if (after === null || after.kind === "restart") {
-		if (outcome === "updated") {
-			streams.stdout.write("Updated. Run your command again.\n");
-			return EXIT_CODES.OK;
-		}
-		streams.stdout.write(`${before.latest} is installed here: run your command again from it. It did not run.\n`);
-		return EXIT_CODES.UPDATE;
-	}
-	streams.stdout.write(`${notRun}: the update did not bring it to ${before.latest}. The update moves what this machine registers and has installed globally — what it found is said above — and this ${cli}, ${before.running}, is started from somewhere else: npx's cache, a project's own install, a checkout. ${handoffSentence(commands.later, (later) => `Run it from ${before.latest}, or put this off until tomorrow with ${later}.`)}\n`);
-	return EXIT_CODES.UPDATE;
-}
-async function askLine(streams, question) {
-	const { createInterface } = await import("node:readline/promises");
-	const rl = createInterface({
-		input: streams.stdin,
-		output: streams.stderr
-	});
-	try {
-		return await rl.question(question);
-	} finally {
-		rl.close();
-	}
+function commandDecisionLine(core, decision, channel, platform) {
+	const { notice, background, moves } = decision;
+	const handoffs = requireHandoffs(core, platform);
+	const parts = [];
+	if (background !== null) parts.push(backgroundNoticeLine(background));
+	if (notice !== null && !(background !== null && background.version === notice.latest)) parts.push(commandNoticeLine(core, notice, channel, platform));
+	if (decision.jobSilent) parts.push(jobSilentLine(decision.jobSilent));
+	if (moves > 0) parts.push(notice !== null ? `The update also moves ${registrations(moves)} onto the stable launcher, the last update that edits a client's configuration.` : `${PRODUCT}: ${moves === 1 ? "one registration still starts" : `${moves} registrations still start`} a versioned runtime; ${handoffSentence(handoffs.core(["update"]), (update) => `one approved update, ${update}, moves ${moves === 1 ? "it" : "them"} onto the stable launcher, after which updates never edit a client's configuration again.`)}`);
+	if (decision.offerJob) parts.push(handoffSentence(handoffs.core([
+		"update",
+		"--background-job",
+		"on"
+	]), (command) => `To have releases install in the background instead, run ${command}: it shows the job, when it runs and how to remove it, and sets nothing up without your yes.`));
+	return parts.join(" ");
 }
 channelServer("core").packageName;
 //#endregion
-//#region ../core/dist/tool-arguments-JbqHfSTd.mjs
+//#region ../core/dist/tool-arguments-4c3WR2Gy.mjs
 const APPLIED = Symbol.for("agentcomms.strictToolArguments");
 const TARGET = "draft-2020-12";
 /**
@@ -12342,13 +13899,14 @@ const TARGET = "draft-2020-12";
 * `refuse` is handed a `USAGE` `CommsError` and returns the tool result, so the refusal is in the same envelope as
 * every other refusal that server makes.
 *
-* `gate` is asked next, with the checked arguments, before the handler: the daily update check's stop (design
-* 2026-09-28), which every server builds with `updateToolGate`. Here because this is the one place every tool of every
-* server already passes through, so no tool can be registered without it; given to the wrapper rather than built
-* in, because what it asks the registry with is each server's own — and WhatsApp's is nothing at all. A call it
-* answers reaches nothing, as a refused one does.
+* `notice` is asked once the handler has answered: the update notice (design 2026-10-16, U1), which every server builds
+* with `updateToolNotice`. Here because this is the one place every tool of every server already passes through, so no
+* tool can be registered without it; given to the wrapper rather than built in, because what it asks the registry
+* with is each server's own — and WhatsApp's is nothing at all. It never stops a call: a line it gives is carried
+* beside the result (`withUpdateNotice`), and a tool's output schema is published with room for it
+* (`withUpdateField`), so a client that checks a result against its schema takes the one that carries it.
 */
-function strictToolArguments(server, refuse, gate, retired = {}) {
+function strictToolArguments(server, refuse, notice, retired = {}) {
 	const target = server;
 	if (typeof target.registerTool !== "function") throw new Error("strictToolArguments needs an MCP server: this has no registerTool");
 	if (target[APPLIED]) return;
@@ -12359,15 +13917,21 @@ function strictToolArguments(server, refuse, gate, retired = {}) {
 		const declared = config.inputSchema !== void 0;
 		const schema = strictSchemaOf(name, config.inputSchema);
 		const published = schema["~standard"].jsonSchema.input({ target: TARGET });
-		return register(name, {
+		const output = notice && config.outputSchema !== void 0 ? withUpdateField(config.outputSchema) : null;
+		const room = config.outputSchema === void 0 || output !== null;
+		const registered = output === null ? config : {
 			...config,
+			outputSchema: output
+		};
+		return register(name, {
+			...registered,
 			inputSchema: passThrough(schema)
 		}, async (input, context) => {
 			const parsed = await schema.safeParseAsync(input ?? {});
 			if (!parsed.success) return refuse(refusal(name, published, input, parsed.error.issues, retired[name] ?? {}));
-			const stopped = gate ? await gate(name, parsed.data) : null;
-			if (stopped !== null) return stopped;
-			return declared ? handler(parsed.data, context) : handler(context);
+			const result = await (declared ? handler(parsed.data, context) : handler(context));
+			const line = notice ? await notice(name).catch(() => null) : null;
+			return line === null ? result : withUpdateNotice(result, line, room);
 		});
 	};
 	Object.defineProperty(target, APPLIED, { value: true });
@@ -12407,6 +13971,83 @@ function passThrough(schema) {
 		jsonSchema: schema["~standard"].jsonSchema
 	} };
 }
+/** The field a result carries the update notice in, as every output schema publishes it. */
+const UPDATE_FIELD = "update";
+const UPDATE_PROPERTY = {
+	type: "string",
+	description: "Once per server process at most: a newer agent-communications release is out, or installed and waiting for a restart. Pass it on to the person; nothing was refused."
+};
+const isPlainObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+/**
+* A result with the notice beside it: a text block of its own after the result's — a client that shows the model only
+* text reads it there — and, where the structured content is an object with room for it, its `update` field, which is
+* all Claude Code and Codex show. Nothing of the result is changed or taken away.
+*/
+function withUpdateNotice(result, line, room = true) {
+	if (!isPlainObject(result)) return result;
+	const content = Array.isArray(result.content) ? result.content : [];
+	const next = {
+		...result,
+		content: [...content, {
+			type: "text",
+			text: line
+		}]
+	};
+	const structured = result.structuredContent;
+	if (room && isPlainObject(structured) && !Object.hasOwn(structured, UPDATE_FIELD)) next.structuredContent = {
+		...structured,
+		[UPDATE_FIELD]: line
+	};
+	return next;
+}
+/** A JSON Schema with the `update` field among its properties — each side of a union — or null with no room for it. */
+function publishedWithUpdate(json) {
+	const alternatives = json.anyOf ?? json.oneOf;
+	if (Array.isArray(alternatives) && json.properties === void 0) {
+		const each = alternatives.map(publishedWithUpdate);
+		if (each.some((alternative) => alternative === null)) return null;
+		return {
+			...json,
+			...json.anyOf ? { anyOf: each } : { oneOf: each }
+		};
+	}
+	if (!(Array.isArray(json.type) ? json.type : [json.type]).includes("object") || json.properties === void 0) return null;
+	if (Object.hasOwn(json.properties, UPDATE_FIELD)) return null;
+	return {
+		...json,
+		properties: {
+			...json.properties,
+			[UPDATE_FIELD]: UPDATE_PROPERTY
+		}
+	};
+}
+/**
+* A tool's output schema, published with room for the `update` field: the same schema, with that one property added
+* — a zod object publishes `additionalProperties: false`, and a client that checks a result against it would refuse
+* the one carrying the notice — and checked as it always was, without the field. Null when the schema has no room for
+* it: one that declares `update` itself, or is not an object; that tool's notice is a text block alone.
+*/
+function withUpdateField(outputSchema) {
+	const standard = (isPlainObject(outputSchema) && !("~standard" in outputSchema) && Object.values(outputSchema).every(isZodSchema) ? object(outputSchema) : outputSchema)?.["~standard"];
+	if (typeof standard?.validate !== "function" || standard.jsonSchema === void 0) return null;
+	const { jsonSchema } = standard;
+	const input = publishedWithUpdate(jsonSchema.input({ target: TARGET }));
+	const output = publishedWithUpdate(jsonSchema.output({ target: TARGET }));
+	if (input === null || output === null) return null;
+	return { "~standard": {
+		version: 1,
+		vendor: "agentcomms",
+		validate: (value) => {
+			if (!isPlainObject(value) || !Object.hasOwn(value, UPDATE_FIELD)) return standard.validate(value);
+			const { [UPDATE_FIELD]: _notice, ...rest } = value;
+			return standard.validate(rest);
+		},
+		jsonSchema: {
+			input: () => input,
+			output: () => output
+		}
+	} };
+}
 /** A USAGE refusal naming what was wrong and what the tool takes. */
 function refusal(tool, published, input, issues, retired) {
 	const properties = published.properties ?? {};
@@ -16039,4 +17680,4 @@ async function syncAccount(context, request) {
 	});
 }
 //#endregion
-export { exemptFromUpdateGate as $, requireAccount as A, PATH_OPTIONS as B, chatKindOf as C, writeResult as Ct, text as D, numeric as E, VERSION$1 as Et, expandSource as F, approveAndWaitSentence as G, absoluteSearchPath as H, strictToolArguments as I, childEnvironment as J, approveChangeAtTerminal as K, CHANNEL_SERVERS as L, storeIdentity as M, checkStorePath as N, PLATFORM as O, defaultStorePath as P, escapeForDisplay as Q, CommsError as R, chatRefOf as S, withFileLock as St, kindOf as T, PACKAGE_NAME as Tt, agentMarker as U, UNTRUSTED_NOTICE as V, approvalsOf as W, colorEnabled as X, cliHandoffs as Y, commandPathOf as Z, WhatsAppContext as _, toCommsError as _t, CHAT_KINDS as a, lookupName as at, requireSupportedNode as b, updateToolGate as bt, searchMessages as c, openCore as ct, composeDraft as d, renderInstall as dt, gatedChangeAtTerminal as et, draftMessage as f, renderPrune as ft, visibilityUnitKey as g, serverPruneChange as gt, statusAuthor as h, serverInstallChange as ht, probeStore as i, isCommsError as it, requireNamedConfig as j, newWhatsAppAccount as k, Presenter as l, paint as lt, listKey as m, runCommand as mt, withCheckedCopy as n, handoffText as nt, listChats as o, nameAvailable as ot, Visibility as p, resolvePaths as pt, canPrompt as q, whatsappStatus as r, installExitStatus as rt, readChat as s, nameShapeProblem as st, syncAccount as t, handoffSentence as tt, innerText as u, pathOverridesFromCliOptions as ut, WhatsAppIndex as v, truncateDisplay as vt, coreDataToIso as w, CALLER as wt, inspectSchema as x, windowsSystemProgram as xt, rebuildIndex as y, updateGateAtTerminal as yt, EXIT_CODES as z };
+export { gatedChangeAtTerminal as $, requireAccount as A, PATH_OPTIONS as B, chatKindOf as C, CALLER as Ct, text as D, numeric as E, expandSource as F, approveChangeAtTerminal as G, absoluteSearchPath as H, strictToolArguments as I, cliHandoffs as J, canPrompt as K, CHANNEL_SERVERS as L, storeIdentity as M, checkStorePath as N, PLATFORM as O, defaultStorePath as P, exemptFromUpdateNotice as Q, CommsError as R, chatRefOf as S, writeResult as St, kindOf as T, VERSION$2 as Tt, agentMarker as U, UNTRUSTED_NOTICE as V, approveAndWaitSentence as W, commandPathOf as X, colorEnabled as Y, escapeForDisplay as Z, WhatsAppContext as _, truncateDisplay as _t, CHAT_KINDS as a, nameAvailable as at, requireSupportedNode as b, windowsSystemProgram as bt, searchMessages as c, paint as ct, composeDraft as d, renderPrune as dt, handoffSentence as et, draftMessage as f, resolvePaths as ft, visibilityUnitKey as g, toCommsError as gt, statusAuthor as h, serverPruneChange as ht, probeStore as i, lookupName as it, requireNamedConfig as j, newWhatsAppAccount as k, Presenter as l, pathOverridesFromCliOptions as lt, listKey as m, serverInstallChange as mt, withCheckedCopy as n, installExitStatus as nt, listChats as o, nameShapeProblem as ot, Visibility as p, runCommand as pt, childEnvironment as q, whatsappStatus as r, isCommsError as rt, readChat as s, openCore as st, syncAccount as t, handoffText as tt, innerText as u, renderInstall as ut, WhatsAppIndex as v, updateNoticeAtTerminal as vt, coreDataToIso as w, PACKAGE_NAME as wt, inspectSchema as x, withFileLock as xt, rebuildIndex as y, updateToolNotice as yt, EXIT_CODES as z };