@askexenow/exe-os 0.9.392 → 0.9.393

package/deploy/stack-manifests/v0.9.json

@@ -4909,11 +4909,144 @@
         "composeSha256": "220b251375f372107e8d8d54a9c3e4ceab1f57aae80f4babf2933c3887532263",
         "composeOverrideSha256": "af295ca2f75b85788416e4df51cab86d8b773bf4cafe6cf6df9c7c26b9a42d6d"
       }
+    },
+    "0.9.53": {
+      "version": "0.9.53",
+      "releasedAt": "2026-09-23T21:55:18.488Z",
+      "npmVersion": "0.9.393",
+      "notes": "Dashboard-only Exe dogfood canary replacing unapplied 0.9.52: npm 0.9.393 scopes retained-Compose health to Dashboard, required core, and rendered dependencies while recording unchanged unrelated red containers and failing new regressions. From live stack 0.9.50, update only Dashboard to v0.9.392. Preserve CRM v0.9.66, Auth v0.6.10, and every other service pin. Signed live base and override Compose bytes are unchanged; no config assets are delivered. Public DEMO remains disabled pending separate CRM rollout.",
+      "services": {
+        "exe-db": {
+          "image": "update.askexe.com/askexe/pgvector:0.8.0-pg16@sha256:a132765ec351c65111b5b675928a3a0515a466a40f97277329db8b8209ad8bc9",
+          "env": "EXE_DB_IMAGE",
+          "composeService": "exe-db",
+          "required": true,
+          "category": "core",
+          "description": "Postgres (pgvector) — digest-pinned (bug 32d6e02f; was tag-only in 0.9.25, regressed from 0.9.24)"
+        },
+        "exe-os": {
+          "image": "update.askexe.com/askexe/exe-os:v0.9.382@sha256:266a59a482865eab9f79497999acb33c1fe1868ec54ea5cd1ce971c492f11bd6",
+          "env": "EXE_OS_IMAGE_TAG",
+          "composeService": "exe-os",
+          "healthUrl": "http://127.0.0.1:8765/health",
+          "required": true,
+          "category": "core",
+          "description": "exe-os daemon + MCP server"
+        },
+        "crm": {
+          "image": "update.askexe.com/askexe/exe-crm:v0.9.66@sha256:38bbae74ddd33dbbd62175a46ad0d3f99ef6c671b0c2187e35398ca9c504c3eb",
+          "env": "CRM_IMAGE_TAG",
+          "composeService": "exe-crm",
+          "healthUrl": "http://127.0.0.1:3000/healthz",
+          "category": "app",
+          "gitSha": "a3d107483304d10b05c9f1ee5e1b0182c4628e65",
+          "description": "Central authentication and recovery with server-validated shared sessions for CRM web and worker."
+        },
+        "wiki": {
+          "image": "update.askexe.com/askexe/exe-wiki:v0.9.37@sha256:8fa22e77c0742fbb690f7b4c8431a186692a20ebd335fb141782df4289dc337f",
+          "env": "WIKI_IMAGE_TAG",
+          "composeService": "exe-wiki",
+          "healthUrl": "http://127.0.0.1:3001/api/ping",
+          "category": "app",
+          "description": "Central hosted authentication and recovery with server-validated shared sessions, membership enforcement, and no product-local credential form.",
+          "gitSha": "713a4370c2b641b8f8b07fd1e7390afa79a9c931"
+        },
+        "gateway": {
+          "image": "update.askexe.com/askexe/exe-gateway:v2026.08.07-c15f093-stamped@sha256:1bc11a2a0ad1f3929d59d2685696f22a72042b9fca9c75e15c02dc7d3c640105",
+          "env": "GATEWAY_IMAGE_TAG",
+          "composeService": "exe-gateway",
+          "healthUrl": "http://127.0.0.1:3100/health",
+          "category": "app",
+          "description": "WhatsApp/messaging gateway — provenance-stamped rebuild of main (outbound message persistence fix); pinned by digest, dated immutable tag.",
+          "gitSha": "c15f093a0f59730bd5c2c73791ff77059dfa7cc1"
+        },
+        "monitorAgent": {
+          "image": "update.askexe.com/askexe/exe-monitor-agent:v2026.08.09-10660eb4-stamped@sha256:29fbd445f79484df04f000603e4ff445e76f0380f86d687a0033e3a0ef7d1b7a",
+          "env": "MONITOR_AGENT_IMAGE_TAG",
+          "composeService": "exe-monitor-agent",
+          "category": "monitoring",
+          "gitSha": "10660eb4abdeffbcba2aad13549aa58e208ac7a3"
+        },
+        "monitorHub": {
+          "image": "update.askexe.com/askexe/exe-monitor-hub:v2026.08.09-10660eb4-stamped@sha256:c9a9218c2713b8dffea7e1cf8c0702a614657d311a7a4e821c6a543bab29bb97",
+          "env": "MONITOR_HUB_IMAGE_TAG",
+          "composeService": "exe-monitor-hub",
+          "healthUrl": "http://127.0.0.1:8090/api/health",
+          "category": "monitoring",
+          "gitSha": "10660eb4abdeffbcba2aad13549aa58e208ac7a3"
+        },
+        "auth": {
+          "image": "update.askexe.com/askexe/exe-auth:v0.6.10@sha256:0260349962d087cd3c33fed1d362029416e82ae9cc60abca7969beac2cb8639f",
+          "env": "AUTH_IMAGE_TAG",
+          "composeService": "exe-auth",
+          "healthUrl": "http://127.0.0.1:3300/",
+          "category": "auth",
+          "description": "GoTrue SSO and privileged license authority bridge; stateless auth proxy.",
+          "gitSha": "29fe7015d90b80c94db3a1e3904852b934071711"
+        },
+        "erp": {
+          "image": "update.askexe.com/askexe/exe-erp:v0.3.17@sha256:ef61b59d94c04189fe2975045a3816d2fecc8efe3027e0ee8c17d0fa2efdbc3b",
+          "env": "ERP_IMAGE_TAG",
+          "composeService": "exe-erp",
+          "healthUrl": "http://127.0.0.1:8069/api/method/ping",
+          "healthHost": "localhost",
+          "required": false,
+          "category": "app",
+          "description": "Enterprise Resource Planning with central hosted authentication and subject-bound organization admission.",
+          "gitSha": "a769ec5e0ae53bc5944715845869715ebbffd63a"
+        },
+        "gotrue": {
+          "image": "update.askexe.com/askexe/gotrue:v2.172.1@sha256:b0dd7aa28dd1f9a8bd31f136c8b912661f701d9b863171e5843cb08f18f49de4",
+          "composeService": "gotrue",
+          "healthUrl": "http://127.0.0.1:9999/health",
+          "category": "infra"
+        },
+        "redis": {
+          "image": "update.askexe.com/askexe/redis:7.4-alpine@sha256:6ab0b6e7381779332f97b8ca76193e45b0756f38d4c0dcda72dbb3c32061ab99",
+          "composeService": "redis",
+          "category": "infra"
+        },
+        "clickhouse": {
+          "image": "update.askexe.com/askexe/clickhouse-server:24.8.4.13-alpine@sha256:88a45f9e328549b2579256c46ee38e5c0e25ae58303d9eb6d9c7ed8d6d2bbf3c",
+          "composeService": "clickhouse",
+          "category": "infra"
+        },
+        "cloudflared": {
+          "image": "update.askexe.com/askexe/cloudflared:2026-07@sha256:ba461b8aa9c042156dbd39c38657fe7431bafa063220eab8d5330a523863da9f",
+          "composeService": "cloudflared",
+          "category": "infra"
+        },
+        "exe-sso-edge": {
+          "image": "update.askexe.com/askexe/nginx:alpine@sha256:20316569d8f81a160065d7d2a5eeffc7ca97d79022462ee255fd23fa103a6b5c",
+          "composeService": "exe-sso-edge",
+          "category": "infra"
+        },
+        "exe-otel-collector": {
+          "image": "update.askexe.com/askexe/otel-collector-contrib:0.114.0@sha256:37fa87091cfaaec7234a27e4e395a40c31c2bfaea97a349a4afef6d9e9681197",
+          "composeService": "exe-otel-collector",
+          "category": "infra"
+        },
+        "dashboard": {
+          "image": "update.askexe.com/askexe/exe-dashboard:v0.9.392@sha256:d151441554c00e216084bd1caf2278e8c41fde188c039e0f167e158a511cbeec",
+          "env": "DASHBOARD_IMAGE_TAG",
+          "composeService": "exe-dashboard",
+          "healthUrl": "http://127.0.0.1:3301/health",
+          "required": false,
+          "category": "optional",
+          "description": "Customer dashboard at dashboard.<apex> — credits, usage, API keys, billing",
+          "gitSha": "e11b25ad567389440da8ed5e566a9c59bce24123"
+        }
+      },
+      "rolloutStage": "canary",
+      "config": {
+        "composeSha256": "220b251375f372107e8d8d54a9c3e4ceab1f57aae80f4babf2933c3887532263",
+        "composeOverrideSha256": "af295ca2f75b85788416e4df51cab86d8b773bf4cafe6cf6df9c7c26b9a42d6d"
+      }
     }
   },
   "signature": {
     "keyId": "exe-stack-1",
     "alg": "ed25519",
-    "signature": "xdgiq8L3up4Mr/AAKup4KFb0istz4Mw80ACvfp1K69hy5NXCou/JX3/eyCfgp0ZP20nbzjjEDfYvHATXQ36XCQ=="
+    "signature": "sr79I2vY2ZVjMGGV/aGJp5i3sT3+nZX0urNqH7jw10Zu1yZNZa62y1973V6b2N5DKNwjE7aZHlQn5aF6nouBDg=="
   }
 }

package/dist/.dist-verified.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "verified_at": "2026-09-23T21:11:44.589Z",
-  "manifest_sha256": "7001b01788ede1ea0aca7f3688cacaa8a618cac6faf6aa49894111e38765e4c5",
-  "package_version": "0.9.392"
+  "verified_at": "2026-09-23T22:15:04.008Z",
+  "manifest_sha256": "c3c456977d8ec9e709146a39b984af444449c4bc1716922aa8323e33f06bdfa9",
+  "package_version": "0.9.393"
 }

package/dist/bin/cli.js

@@ -798,14 +798,14 @@ ${JSON.stringify(stormAlert, null, 2)}`);
   const { runStackUpdateCli } = await import("./stack-update.js");
   await runStackUpdateCli(args.slice(1));
 } else if (args[0] === "release") {
-  const { parseReleaseArgs, runStackRelease } = await import("../stack-release-7YHSLY7J.js");
+  const { parseReleaseArgs, runStackRelease } = await import("../stack-release-YEO6BFVR.js");
   const releaseFlags = parseReleaseArgs(args.slice(1));
   await runStackRelease(releaseFlags);
 } else if (args[0] === "stack-promote") {
-  const { runStackPromoteCli } = await import("../stack-promote-26RFMNSB.js");
+  const { runStackPromoteCli } = await import("../stack-promote-EAPCVGKJ.js");
   await runStackPromoteCli(args.slice(1));
 } else if (args[0] === "stack-generate-manifest") {
-  const { runStackGenerateManifestCli } = await import("../stack-generate-manifest-QWU7Q4MJ.js");
+  const { runStackGenerateManifestCli } = await import("../stack-generate-manifest-XZ534AJH.js");
   process.exit(await runStackGenerateManifestCli(args.slice(1)));
 } else if (args[0] === "repo-truth") {
   const { runRepoTruthCli } = await import("./exe-repo-truth.js");

package/dist/bin/registry-proxy.js

@@ -2,7 +2,7 @@
 import {
   registryProxyOptionsFromEnv,
   runRegistryProxy
-} from "../chunk-PRCJG3PK.js";
+} from "../chunk-NJ57AHX4.js";
 import {
   isMainModule
 } from "../chunk-6Y4B3QF6.js";

package/dist/bin/stack-update.js

@@ -7,6 +7,7 @@ import {
   assertRetainedComposeRenderedImage,
   assertRetainedComposeRunningService,
   assertSignedManifestDeliveryGate,
+  assessRetainedHealthBefore,
   backupStackConfig,
   bootstrapStackHost,
   builtinStackManifestPublicKeyPath,
@@ -23,6 +24,7 @@ import {
   loadStackManifestWithFallback,
   parseComposeVolumeNames,
   parseEnv,
+  parseRetainedContainerHealth,
   patchEnv,
   printDanglingVolumes,
   printVolumeCleanupResult,
@@ -33,6 +35,9 @@ import {
   reportStackManifestSource,
   requiredImagePinKeys,
   resolveComposeProjectName,
+  retainedCompletedDependencies,
+  retainedContainerIsHealthy,
+  retainedCriticalServices,
   runScopedServiceSelection,
   runStackUpdate,
   saveServiceSelection,
@@ -41,7 +46,7 @@ import {
   verifyManifestImagesAvailable,
   warnUnmanagedManifestServices,
   withStackUpdateOperationLock
-} from "../chunk-3SXU7KLW.js";
+} from "../chunk-WMGS5U2J.js";
 import "../chunk-EC5H53YD.js";
 import {
   runVerifyStack
@@ -57,7 +62,7 @@ import {
 import {
   logResult,
   runHealthGate
-} from "../chunk-33CHRORT.js";
+} from "../chunk-POBFVHIS.js";
 import "../chunk-L25OAFOU.js";
 import "../chunk-RT57D7C4.js";
 import "../chunk-FTZET5YX.js";
@@ -2076,7 +2081,25 @@ function readInstalledVersion(lockFile) {
     return void 0;
   }
 }
-function printChanges(changes, composeFile, envFile) {
+function printChanges(changes, composeFile, envFile, retainedHealth) {
+  if (retainedHealth) {
+    if (changes.length > 0) {
+      console.log("Planned image tag changes:");
+      for (const c of changes) console.log(`  - ${c.service}: ${c.key}
+      ${c.before ?? "<unset>"} \u2192 ${c.after}`);
+    }
+    console.log("\nCurrent container health (selected service and required dependencies are gates):");
+    for (const [service, container] of retainedHealth.containers) {
+      const critical = retainedHealth.critical.has(service);
+      const healthy = retainedContainerIsHealthy(container, retainedHealth.completedDependencies?.has(service));
+      const label = critical ? "required for this update" : "unrelated, unchanged baseline";
+      console.log(`  ${healthy ? "\u2705" : critical ? "\u274C" : "\u26A0\uFE0F"} ${service}: ${container.state}${container.health ? ` (health: ${container.health})` : ""} \u2014 ${label}`);
+    }
+    const failures = assessRetainedHealthBefore(retainedHealth);
+    if (failures.length > 0) console.log(`
+\u{1F534} Retained-Compose health gate failed: ${failures.join(", ")}`);
+    return failures.length;
+  }
   if (changes.length === 0) {
     const running2 = areCliContainersRunning(composeFile, envFile);
     if (running2) {
@@ -2111,6 +2134,23 @@ function printChanges(changes, composeFile, envFile) {
   }
   return 0;
 }
+function captureRetainedHealthForCli(composeFile, envFile, selectedService, requiredCore) {
+  const args = composeArgsForStack(composeFile, envFile);
+  const config = spawnSync3("docker", [...args, "config", "--format", "json"], {
+    encoding: "utf8",
+    stdio: ["pipe", "pipe", "pipe"],
+    timeout: 2e4
+  });
+  const critical = retainedCriticalServices(config.status === 0 ? config.stdout : null, selectedService, requiredCore);
+  const completedDependencies = retainedCompletedDependencies(config.stdout, critical, selectedService, requiredCore);
+  const ps = spawnSync3("docker", [...args, "ps", "--all", "--format", "json"], {
+    encoding: "utf8",
+    stdio: ["pipe", "pipe", "pipe"],
+    timeout: 2e4
+  });
+  const containers = parseRetainedContainerHealth(ps.status === 0 ? ps.stdout : null);
+  return { critical, completedDependencies, containers };
+}
 function areCliContainersRunning(composeFile, envFile) {
   try {
     const result = spawnSync3("docker", [...composeArgsForStack(composeFile, envFile), "ps", "-q"], {
@@ -2511,7 +2551,16 @@ async function main(args = process.argv.slice(2)) {
       console.log("");
     }
   }
-  const unhealthyCount = printChanges(plan.changes, opts.composeFile, opts.envFile);
+  const retainedHealth = opts.retainCompose && targetRelease ? captureRetainedHealthForCli(
+    opts.composeFile,
+    opts.envFile,
+    Object.values(plan.release.services)[0].composeService ?? opts.serviceName,
+    Object.entries(targetRelease.services).filter(([, service]) => service.required === true && service.category === "core").map(([name, service]) => service.composeService ?? name)
+  ) : void 0;
+  const unhealthyCount = printChanges(plan.changes, opts.composeFile, opts.envFile, retainedHealth);
+  if (opts.retainCompose && unhealthyCount > 0 && !opts.check && !opts.dryRun) {
+    throw new Error("--retain-compose refused: selected service or required dependency is unhealthy");
+  }
   printBreaking(plan.breakingChanges);
   if (opts.verifyImages) {
     const started = Date.now();
@@ -2704,6 +2753,7 @@ export {
   isProductionControlPlaneApply,
   manifestSignatureSkipBanner,
   parseArgs as parseStackUpdateArgs,
+  printChanges,
   reportPartialRun,
   resolveManifestSignaturePolicy,
   main as runStackUpdateCli,

package/dist/bin/vps-health-gate.js

@@ -8,7 +8,7 @@ import {
   logResult,
   main,
   runHealthGate
-} from "../chunk-33CHRORT.js";
+} from "../chunk-POBFVHIS.js";
 import "../chunk-MLKGABMK.js";
 export {
   checkCRM,

package/dist/build-manifest.json

@@ -1,6 +1,6 @@
 {
   "version": 2,
-  "generated_at": "2026-09-23T21:11:44.524Z",
+  "generated_at": "2026-09-23T22:15:03.947Z",
   "files": [
     {
       "path": "active-agent-KMGOYJTP.js",
@@ -179,7 +179,7 @@
     },
     {
       "path": "bin/cli.js",
-      "sha256": "57b256c77dad69f65194abc99fe8b50ce2bfe8d48d211eec73e563c128036147",
+      "sha256": "a26f29a3a9652a702b0bdafd1bbceb13389b3fffc4d49477eae926e855a59ee6",
       "bytes": 69792
     },
     {
@@ -524,7 +524,7 @@
     },
     {
       "path": "bin/registry-proxy.js",
-      "sha256": "3ee14439bf46ca5a72a2a72a6130b9248eabfdd670df0da054c0123c1e954054",
+      "sha256": "e4b41eb986a2f7baf4371bb8a1bd5ec046ef6741c5df16a1f7aaeda5cb946675",
       "bytes": 1885
     },
     {
@@ -549,8 +549,8 @@
     },
     {
       "path": "bin/stack-update.js",
-      "sha256": "ee70fb51e77796565a2d1864764e4865cf24a5671c9753fe73ac198517fdb7ed",
-      "bytes": 128550
+      "sha256": "45e9139c3b040aff8c4e863ada54ca75c58c4c14b7c8571f67a599372a0978bb",
+      "bytes": 131290
     },
     {
       "path": "bin/update.js",
@@ -569,7 +569,7 @@
     },
     {
       "path": "bin/vps-health-gate.js",
-      "sha256": "17c6d47cae46484f15223cfd9cd9e5b07db13506c0579bf932aff4eed897e252",
+      "sha256": "1b4e8961edf1b549fc3900950e8ddd6bf1bff6dc02fed969028f31b4c730a3d3",
       "bytes": 333
     },
     {
@@ -672,11 +672,6 @@
       "sha256": "0649a4d1eb38a53ced9d539731618da75464e0e191ebcc39b03aa2871071c2d4",
       "bytes": 442
     },
-    {
-      "path": "chunk-33CHRORT.js",
-      "sha256": "0f7fbaa13b4c7522f0b14a45b48ce2dfc004790e2577760afb9bb370e69ff90f",
-      "bytes": 7587
-    },
     {
       "path": "chunk-37IIJJZ7.js",
       "sha256": "f7f9ea3373fb44a010f78ef8852bd264f8d67bea44c3ae9abc1d84c7d2771513",
@@ -717,11 +712,6 @@
       "sha256": "46303e5db720a3f0b9ed8ecab75b9c6ea3c4a644f3805c6ae465e2fb9bd23fef",
       "bytes": 5705
     },
-    {
-      "path": "chunk-3SXU7KLW.js",
-      "sha256": "9df2f153a553b1270f7a9011d4f081732ea89b9ac2b042cb149b14f4ed44da22",
-      "bytes": 252039
-    },
     {
       "path": "chunk-3VW5ZP2F.js",
       "sha256": "9eb8516063b9279b0556d589f9d7e3024b554ed2cf60cc84a58c32a193e85744",
@@ -1537,6 +1527,11 @@
       "sha256": "cfdcf9141d53bd73b7b8cc3a4097773d1f854a9dffb7a81324f2782c7d70fe6c",
       "bytes": 14891
     },
+    {
+      "path": "chunk-NJ57AHX4.js",
+      "sha256": "37cd6a8a4df230eca98e5fc2792fa39027c3ca8cbfbb5438f87680a1c996a755",
+      "bytes": 40844
+    },
     {
       "path": "chunk-NKPPPX6I.js",
       "sha256": "4a5f8acc2c7b70708de8b68c7c3b7b3f5981395f2bd1a4db3b3b7151769910db",
@@ -1663,9 +1658,9 @@
       "bytes": 3317
     },
     {
-      "path": "chunk-PRCJG3PK.js",
-      "sha256": "cd4c509a50c7fa4c72cb7a1d62c216f49024b671c65c8b032d4ef664b7da49e7",
-      "bytes": 40844
+      "path": "chunk-POBFVHIS.js",
+      "sha256": "398f78513e36934eebeaceb2644137c3a95acb515783aa0bdf6dd970bb33cbb9",
+      "bytes": 7587
     },
     {
       "path": "chunk-PYS43F2X.js",
@@ -1862,11 +1857,6 @@
       "sha256": "56262268c24e15325112a9d2d1dd785dea9fe96ac44e0c14ff243edd1fbd7e04",
       "bytes": 76651
     },
-    {
-      "path": "chunk-TVSIS36M.js",
-      "sha256": "c12d360e3677fc87730097aab294f995d40c3bb8daf837fbe1856f258cc2a742",
-      "bytes": 3766
-    },
     {
       "path": "chunk-TWMWHDOY.js",
       "sha256": "d1a4b120060e1bda1c09919ff863fbb281c71f017d89b31f47e8df07587814c0",
@@ -1917,6 +1907,11 @@
       "sha256": "697ecdef6991c061baab1e9759bc14aecd28631954b2edfdb721c98c72d41c82",
       "bytes": 1813
     },
+    {
+      "path": "chunk-V57YDQQA.js",
+      "sha256": "6284d4a8d979d18fdb3b863f59f91c7cd616c169349bb77766a94693477706e9",
+      "bytes": 3766
+    },
     {
       "path": "chunk-VGMACSEV.js",
       "sha256": "4a51d1fb50f1389160ec2d06ebeb702976a647212f7731ab58f562de3f53f215",
@@ -1972,6 +1967,11 @@
       "sha256": "288099f4b532013a4c9ba4c6129273a6f5036fc99f574e4b4d2b0fddc3792b67",
       "bytes": 1549
     },
+    {
+      "path": "chunk-WMGS5U2J.js",
+      "sha256": "688da29e942b4732af8dc9d226f26a1c57c37e30581a97e30be5af4bfc4ad4ae",
+      "bytes": 260597
+    },
     {
       "path": "chunk-WPTIHQ6M.js",
       "sha256": "a999baf6db449dcd8c856393a0721a50aceb27e74a49f71bbc6b553081d98fc2",
@@ -2574,7 +2574,7 @@
     },
     {
       "path": "hooks/manifest.json",
-      "sha256": "ba4ff8f10ee0055e5a4c3ea79bc8ea9c7f0154d0d7b53cdac2a7f72e901cdd03",
+      "sha256": "af052428c7e0f413b988ae47ed6a7120020847a8d665eb125ff24e0f5571b633",
       "bytes": 1841
     },
     {
@@ -2879,7 +2879,7 @@
     },
     {
       "path": "lib/registry-proxy.js",
-      "sha256": "6b15ba1cbdc4ee922891ad866daf9cc80cce74e01ccbc924e75960a52da8f9c0",
+      "sha256": "086622c69175e1c94ca91d2ac0dab2042db655eb14252e8acabc3e02fc2dd40b",
       "bytes": 749
     },
     {
@@ -3463,8 +3463,8 @@
       "bytes": 111
     },
     {
-      "path": "stack-generate-manifest-QWU7Q4MJ.js",
-      "sha256": "24720f91471c9be72ceb98ad60530cc267b389b7f6124cddb84070be1a7367b0",
+      "path": "stack-generate-manifest-XZ534AJH.js",
+      "sha256": "5a3b5b3ab0b6160c45abf107a099e188db1cd3239f983c774bb32a4304d02fa9",
       "bytes": 56960
     },
     {
@@ -3473,18 +3473,18 @@
       "bytes": 4761
     },
     {
-      "path": "stack-promote-26RFMNSB.js",
-      "sha256": "74b8353d0871bb8fd1b64c449498920d8ecfbe623ad76f65fdec038de34575de",
+      "path": "stack-promote-EAPCVGKJ.js",
+      "sha256": "5dbfd92d46224fa325522dcb29a0c37a04503bcbc240338e6dd81999915e41df",
       "bytes": 7425
     },
     {
-      "path": "stack-release-7YHSLY7J.js",
-      "sha256": "27806d515012b3af2d4c85f87f6dfd439ba46e01dac917cbf95e60cf0fcece2c",
+      "path": "stack-release-YEO6BFVR.js",
+      "sha256": "59e8eb373abf14f60ab5c7b758b8ab9cebe044490622af22c1af3746f0bd2102",
       "bytes": 117550
     },
     {
-      "path": "stack-update-DTMW7GMW.js",
-      "sha256": "d05d7f8051ba0503d7ffa650eb5d85b08e841d94c08263c07eea5b0874770d99",
+      "path": "stack-update-NEDES5S4.js",
+      "sha256": "f70a348356634acc818edf94d0deaf756ca7ad3198d6f339b39b8358a6962afe",
       "bytes": 7863
     },
     {

package/dist/{chunk-PRCJG3PK.js → chunk-NJ57AHX4.js}

@@ -138,7 +138,7 @@ async function assertManifestSignature(manifest, publicKeyPem) {
       "manifest carries no `signature`. Fleets that enforce EXE_STACK_PUBLIC_KEY reject unsigned manifests, so publishing one would ship a release no host can install. Re-sign with the custodied key: node scripts/sign-stack-manifest.mjs deploy/stack-manifests/v0.9.json"
     );
   }
-  const { verifyStackManifestSignature } = await import("./stack-update-DTMW7GMW.js");
+  const { verifyStackManifestSignature } = await import("./stack-update-NEDES5S4.js");
   try {
     verifyStackManifestSignature(manifest, publicKeyPem);
   } catch (err) {

package/dist/{chunk-33CHRORT.js → chunk-POBFVHIS.js}

@@ -212,7 +212,7 @@ async function main(args) {
   console.log("[health-gate] Starting rollback...");
   restorePreDeployBackup();
   try {
-    const { rollbackStackUpdate, defaultStackPaths } = await import("./stack-update-DTMW7GMW.js");
+    const { rollbackStackUpdate, defaultStackPaths } = await import("./stack-update-NEDES5S4.js");
     const paths = defaultStackPaths();
     await rollbackStackUpdate({
       manifestRef: paths.manifestRef,

package/dist/{chunk-TVSIS36M.js → chunk-V57YDQQA.js}

@@ -1,6 +1,6 @@
 import {
   canonicalizeStackManifest
-} from "./chunk-3SXU7KLW.js";
+} from "./chunk-WMGS5U2J.js";
 
 // src/lib/stack-manifest-write.ts
 import { readFileSync, statSync, writeFileSync } from "fs";

package/dist/{chunk-3SXU7KLW.js → chunk-WMGS5U2J.js}

@@ -120,6 +120,162 @@ ${remedy}
   return gaps;
 }
 
+// src/lib/retained-compose-health.ts
+function parseRecords(raw) {
+  if (raw === null || !raw.trim())
+    throw new Error("--retain-compose health state unavailable");
+  const trimmed = raw.trim().replace(/^\ufeff/, "");
+  let records;
+  try {
+    const parsed = JSON.parse(trimmed);
+    records = Array.isArray(parsed) ? parsed : [parsed];
+  } catch {
+    try {
+      records = trimmed.split("\n").filter(Boolean).map((line) => JSON.parse(line));
+    } catch {
+      throw new Error("--retain-compose health state could not be parsed");
+    }
+  }
+  if (records.length === 0 || records.some(
+    (record) => !record || typeof record !== "object" || Array.isArray(record)
+  )) {
+    throw new Error(
+      "--retain-compose health state contains no usable containers"
+    );
+  }
+  return records;
+}
+function parseRetainedContainerHealth(raw) {
+  const containers = /* @__PURE__ */ new Map();
+  for (const record of parseRecords(raw)) {
+    const service = String(record.Service ?? "").trim();
+    if (!service || containers.has(service))
+      throw new Error(
+        "--retain-compose health state has missing or duplicate service names"
+      );
+    containers.set(service, {
+      service,
+      id: String(record.ID ?? "").trim(),
+      state: String(record.State ?? "").trim().toLowerCase(),
+      health: String(record.Health ?? "").trim().toLowerCase(),
+      restartCount: record.RestartCount === void 0 || record.RestartCount === null ? null : Number(record.RestartCount),
+      exitCode: record.ExitCode === void 0 || record.ExitCode === null || String(record.ExitCode).trim() === "" ? null : Number.isInteger(Number(record.ExitCode)) ? Number(record.ExitCode) : null
+    });
+  }
+  return containers;
+}
+function parseRenderedServices(renderedCompose) {
+  let services;
+  try {
+    const parsed = JSON.parse(renderedCompose ?? "");
+    if (!parsed.services || typeof parsed.services !== "object" || Array.isArray(parsed.services))
+      throw new Error();
+    services = parsed.services;
+  } catch {
+    throw new Error("--retain-compose rendered dependency graph unavailable");
+  }
+  return services;
+}
+function retainedCriticalServices(renderedCompose, selectedService, requiredCore) {
+  const services = parseRenderedServices(renderedCompose);
+  const critical = /* @__PURE__ */ new Set();
+  const visit = (service) => {
+    if (!services[service])
+      throw new Error(
+        `--retain-compose required service ${service} absent from rendered Compose`
+      );
+    if (critical.has(service)) return;
+    critical.add(service);
+    const deps = services[service].depends_on;
+    if (deps !== void 0 && !Array.isArray(deps) && (typeof deps !== "object" || deps === null)) {
+      throw new Error(
+        `--retain-compose dependencies for ${service} could not be parsed`
+      );
+    }
+    const names = Array.isArray(deps) ? deps : Object.keys(deps ?? {});
+    for (const name of names) {
+      if (typeof name !== "string")
+        throw new Error(
+          `--retain-compose dependencies for ${service} could not be parsed`
+        );
+      visit(name);
+    }
+  };
+  visit(selectedService);
+  for (const service of requiredCore) visit(service);
+  return critical;
+}
+function retainedCompletedDependencies(renderedCompose, critical, selectedService, requiredCore) {
+  const services = parseRenderedServices(renderedCompose);
+  const inbound = /* @__PURE__ */ new Map();
+  for (const parent of critical) {
+    const dependencies = services[parent]?.depends_on;
+    if (!dependencies) continue;
+    const entries = Array.isArray(dependencies) ? dependencies.map((name) => [
+      String(name),
+      { condition: "service_started" }
+    ]) : Object.entries(dependencies);
+    for (const [name, value] of entries) {
+      if (!critical.has(name)) continue;
+      const condition = value && typeof value === "object" ? String(
+        value.condition ?? "service_started"
+      ) : "service_started";
+      inbound.set(name, [...inbound.get(name) ?? [], condition]);
+    }
+  }
+  const roots = /* @__PURE__ */ new Set([selectedService, ...requiredCore]);
+  return new Set(
+    [...inbound].filter(
+      ([name, conditions]) => !roots.has(name) && // Compose's omitted restart policy is "no". An explicit policy
+      // that restarts the job is not a completed one-shot dependency.
+      (services[name]?.restart === void 0 || services[name]?.restart === "no") && conditions.length > 0 && conditions.every(
+        (condition) => condition === "service_completed_successfully"
+      )
+    ).map(([name]) => name)
+  );
+}
+function retainedContainerIsHealthy(container, completedDependency = false) {
+  return !!container && !!container.id && (completedDependency ? container.state === "exited" && container.exitCode === 0 : container.state === "running" && (container.health === "" || container.health === "healthy")) && (container.restartCount === null || Number.isFinite(container.restartCount) && container.restartCount <= 2);
+}
+function assessRetainedHealthBefore(witness) {
+  const failures = [];
+  for (const service of witness.critical) {
+    if (!retainedContainerIsHealthy(
+      witness.containers.get(service),
+      witness.completedDependencies?.has(service)
+    ))
+      failures.push(service);
+  }
+  for (const [service, container] of witness.containers) {
+    if (!witness.critical.has(service) && !retainedContainerIsHealthy(container) && !container.id) {
+      failures.push(`${service} (unhealthy container identity unavailable)`);
+    }
+  }
+  return failures;
+}
+function assessRetainedHealthAfter(before, after) {
+  const failures = [];
+  for (const service of before.critical) {
+    if (!retainedContainerIsHealthy(
+      after.get(service),
+      before.completedDependencies?.has(service)
+    ))
+      failures.push(service);
+  }
+  for (const [service, current] of after) {
+    if (before.critical.has(service) || retainedContainerIsHealthy(current))
+      continue;
+    const prior = before.containers.get(service);
+    if (!prior || retainedContainerIsHealthy(prior) || !prior.id || prior.id !== current.id || prior.state !== current.state || prior.health !== current.health || prior.restartCount !== current.restartCount) {
+      failures.push(service);
+    }
+  }
+  for (const service of before.containers.keys()) {
+    if (!after.has(service)) failures.push(`${service} (disappeared)`);
+  }
+  return [...new Set(failures)];
+}
+
 // src/lib/stack-lock-derive.ts
 import { spawnSync } from "child_process";
 var GIT_SHA_LABEL = "org.exe.git_sha";
@@ -3953,6 +4109,24 @@ ${lines.join("\n")}`
     options.preDeployBackup(plan.targetVersion);
   } catch {
   }
+  let retainedHealthBaseline;
+  if (options.retainCompose) {
+    const [selectedName, selectedEntry] = Object.entries(plan.release.services)[0];
+    const selected = selectedEntry.composeService ?? selectedName;
+    const requiredCore = Object.entries(targetRelease.services).filter(([, service]) => service.required === true && service.category === "core").map(([name, service]) => service.composeService ?? name);
+    const args = composeArgsForStack(options.composeFile, options.envFile);
+    const rendered = (options.composeConfigCapture ?? defaultComposeConfigCapture)(args, process.env);
+    const critical = retainedCriticalServices(rendered, selected, requiredCore);
+    const completedDependencies = retainedCompletedDependencies(rendered, critical, selected, requiredCore);
+    const rawHealth = (options.composePsCapture ?? defaultComposePsCapture)(args);
+    retainedHealthBaseline = { critical, completedDependencies, containers: parseRetainedContainerHealth(rawHealth) };
+    const failures = assessRetainedHealthBefore(retainedHealthBaseline);
+    if (failures.length > 0) throw new Error(`--retain-compose health gate failed before update: ${failures.join(", ")}`);
+    const preexisting = [...retainedHealthBaseline.containers.values()].filter((container) => !critical.has(container.service) && (container.state !== "running" || container.health === "unhealthy" || container.restartCount !== null && container.restartCount > 2));
+    for (const container of preexisting) {
+      console.warn(`[stack-update] Pre-existing unrelated unhealthy container (unchanged identity required): ${container.service}`);
+    }
+  }
   const stackDir = path.dirname(options.envFile);
   const configBackup = preBootstrapBackup ?? backupStackConfig(stackDir, options.composeFile, envRaw, now);
   const updateBackupDir = configBackup.updateBackupDir;
@@ -4426,6 +4600,15 @@ Push the missing image(s) to the registry, or re-run with --break-glass <reason>
         endPhase3();
       }
     }
+    if (retainedHealthBaseline) {
+      const after = parseRetainedContainerHealth(
+        (options.composePsCapture ?? defaultComposePsCapture)(composeArgs)
+      );
+      const regressions = assessRetainedHealthAfter(retainedHealthBaseline, after);
+      if (regressions.length > 0) {
+        throw new Error(`--retain-compose health regression after update: ${regressions.join(", ")}`);
+      }
+    }
     {
       const cfIngressConfigPath = path.join(path.dirname(options.composeFile), "cloudflared", "config.yml");
       const cfIngressConfigYml = existsSync(cfIngressConfigPath) ? readFileSync(cfIngressConfigPath, "utf8") : null;
@@ -5484,6 +5667,11 @@ function loadDefaultPublicKey() {
 }
 
 export {
+  parseRetainedContainerHealth,
+  retainedCriticalServices,
+  retainedCompletedDependencies,
+  retainedContainerIsHealthy,
+  assessRetainedHealthBefore,
   resolveServiceHealthTimeout,
   serviceSelectionPath,
   loadServiceSelection,

package/dist/hooks/manifest.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "generatedAt": "2026-09-23T21:11:44.253Z",
+  "generatedAt": "2026-09-23T22:15:03.718Z",
   "hashes": {
     "bug-report-worker.js": "7c5f5951fe30192e374d9047c3a7f2975a879a5951457aafea5db95d5d6be6af",
     "codex-stop-task-finalizer.js": "f963449525e068ebf3f04a2950adf21464de71774b60165a84d69621a5eca30a",

package/dist/lib/registry-proxy.js

@@ -11,7 +11,7 @@ import {
   resolveRegistryProxyBuildIdentity,
   resolveStackManifestChannel,
   runRegistryProxy
-} from "../chunk-PRCJG3PK.js";
+} from "../chunk-NJ57AHX4.js";
 import "../chunk-MLKGABMK.js";
 export {
   SERVED_VERSION_PATH,

package/dist/{stack-generate-manifest-QWU7Q4MJ.js → stack-generate-manifest-XZ534AJH.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import {
   writeSignedStackManifest
-} from "./chunk-TVSIS36M.js";
-import "./chunk-3SXU7KLW.js";
+} from "./chunk-V57YDQQA.js";
+import "./chunk-WMGS5U2J.js";
 import "./chunk-EC5H53YD.js";
 import "./chunk-YYRI2AGK.js";
 import "./chunk-L25OAFOU.js";

package/dist/{stack-promote-26RFMNSB.js → stack-promote-EAPCVGKJ.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import {
   writeSignedStackManifest
-} from "./chunk-TVSIS36M.js";
-import "./chunk-3SXU7KLW.js";
+} from "./chunk-V57YDQQA.js";
+import "./chunk-WMGS5U2J.js";
 import "./chunk-EC5H53YD.js";
 import "./chunk-YYRI2AGK.js";
 import "./chunk-L25OAFOU.js";

package/dist/{stack-release-7YHSLY7J.js → stack-release-YEO6BFVR.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import {
   writeSignedStackManifest
-} from "./chunk-TVSIS36M.js";
-import "./chunk-3SXU7KLW.js";
+} from "./chunk-V57YDQQA.js";
+import "./chunk-WMGS5U2J.js";
 import "./chunk-EC5H53YD.js";
 import {
   assertPreflightGate,
@@ -2028,7 +2028,7 @@ async function warmProxyCache(imageRef) {
 async function resolveImageGitShaLabel(ref, dryRun) {
   if (!ref || dryRun) return void 0;
   try {
-    const { readProvenanceLabels } = await import("./stack-generate-manifest-QWU7Q4MJ.js");
+    const { readProvenanceLabels } = await import("./stack-generate-manifest-XZ534AJH.js");
     const labels = await readProvenanceLabels(ref);
     return labels["org.exe.git_sha"] ?? labels["org.opencontainers.image.revision"];
   } catch (err) {

package/dist/{stack-update-DTMW7GMW.js → stack-update-NEDES5S4.js}

@@ -132,7 +132,7 @@ import {
   waitForHttpOk,
   warnUnmanagedManifestServices,
   withStackUpdateOperationLock
-} from "./chunk-3SXU7KLW.js";
+} from "./chunk-WMGS5U2J.js";
 import "./chunk-EC5H53YD.js";
 import "./chunk-YYRI2AGK.js";
 import "./chunk-L25OAFOU.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askexenow/exe-os",
-  "version": "0.9.392",
+  "version": "0.9.393",
   "description": "AI employee operating system \u2014 persistent memory, task management, and multi-agent coordination for Claude Code.",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",

package/release-notes.json

@@ -1,8 +1,8 @@
 {
-  "current": "0.9.392",
+  "current": "0.9.393",
   "notes": {
-    "0.9.392": {
-      "version": "0.9.392",
+    "0.9.393": {
+      "version": "0.9.393",
       "date": "2026-09-23",
       "features": [
         "local CI triage — classify failing checks at zero token cost (#1441)",
@@ -13,6 +13,10 @@
         "sign recoverable B3 invite proofs with native keys"
       ],
       "fixes": [
+        "honor omitted default no-restart policy",
+        "honor completed one-shot dependencies in retained health",
+        "require critical container identity and preserve missing restart data",
+        "scope retained health to selected service and critical dependencies",
         "compare override drift to signed snapshot",
         "attest retained Compose override for scoped releases",
         "no_raw excludes captured searches (bug 37353c88 residual a) (#1509)",
@@ -33,14 +37,13 @@
         "extract-review-findings.sh fails loudly on a broken comments lookup (#1441 follow-up) (#1493)",
         "report duplicate hook entries as a --check failure, not just --apply (#1179 follow-up) (#1492)",
         "ledger mutations commit atomically without a cross-await transaction (#1229 follow-up) (#1490)",
-        "memory/DB layer lifecycle cluster — all 10 bugs (#1473)",
-        "any unreadable SSO-edge config means unverified delivery (#1221 follow-up) (#1489)",
-        "session/orchestration cluster — 6 fixes, 1 verified, 4 documented deferrals (#1469)",
-        "an unreadable grandfather marker is not an absent one (bug d11c5049, D22) (#1317)",
-        "guard-reachability — advisory report, not a blocking gate (bug efabb902) (#1216)"
+        "memory/DB layer lifecycle cluster — all 10 bugs (#1473)"
       ],
       "security": [],
       "other": [
+        "Prepare signed Dashboard canary stack 0.9.53 with scoped updater 0.9.393",
+        "assert required core failure in retained scope",
+        "release(npm): publish 0.9.392 from exact green main source",
         "release(stack): sign Dashboard topology canary 0.9.52",
         "release(stack): pin Dashboard v0.9.392 in canary 0.9.51 (#1511)",
         "release: use declared control runner lane",